/* Portions of this file are subject to the following copyright(s). See
* the Net-SNMP's COPYING file for more details and other copyrights
* that may apply:
*/
/*
* Portions of this file are copyrighted by:
* Copyright © 2003 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms specified in the COPYING file
* distributed with the Net-SNMP package.
*
* Portions of this file are copyrighted by:
* Copyright (c) 2016 VMware, Inc. All rights reserved.
* Use is subject to license terms specified in the COPYING file
* distributed with the Net-SNMP package.
*/
/*
* scapi.c
*
*/
#include <net-snmp/net-snmp-config.h>
#include <net-snmp/net-snmp-features.h>
#include <sys/types.h>
#ifdef HAVE_STDLIB_H
#include <stdlib.h>
#endif
#if HAVE_STRING_H
#include <string.h>
#else
#include <strings.h>
#endif
#if TIME_WITH_SYS_TIME
# include <sys/time.h>
# include <time.h>
#else
# if HAVE_SYS_TIME_H
# include <sys/time.h>
# else
# include <time.h>
# endif
#endif
#ifdef HAVE_NETINET_IN_H
#include <netinet/in.h>
#endif
#if HAVE_UNISTD_H
#include <unistd.h>
#endif
#if HAVE_DMALLOC_H
#include <dmalloc.h>
#endif
#include <net-snmp/types.h>
#include <net-snmp/output_api.h>
#include <net-snmp/utilities.h>
netsnmp_feature_child_of(usm_support, libnetsnmp)
netsnmp_feature_child_of(usm_scapi, usm_support)
#ifndef NETSNMP_FEATURE_REMOVE_USM_SCAPI
#ifdef NETSNMP_USE_INTERNAL_MD5
#include <net-snmp/library/md5.h>
#endif
#include <net-snmp/library/snmp_api.h>
#include <net-snmp/library/callback.h>
#include <net-snmp/library/snmp_secmod.h>
#include <net-snmp/library/snmpusm.h>
#include <net-snmp/library/keytools.h>
#include <net-snmp/library/scapi.h>
#include <net-snmp/library/mib.h>
#include <net-snmp/library/transform_oids.h>
#ifdef NETSNMP_USE_INTERNAL_CRYPTO
#include <net-snmp/library/openssl_md5.h>
#include <net-snmp/library/openssl_sha.h>
#include <net-snmp/library/openssl_des.h>
#include <net-snmp/library/openssl_aes.h>
#endif
#ifdef NETSNMP_USE_OPENSSL
#include <openssl/hmac.h>
#include <openssl/evp.h>
#include <openssl/rand.h>
#include <openssl/des.h>
#ifdef HAVE_AES
#include <openssl/aes.h>
#endif
#ifndef NETSNMP_DISABLE_DES
#ifdef HAVE_STRUCT_DES_KS_STRUCT_WEAK_KEY
/* these are older names for newer structures that exist in openssl .9.7 */
#define DES_key_schedule des_key_schedule
#define DES_cblock des_cblock
#define DES_key_sched des_key_sched
#define DES_ncbc_encrypt des_ncbc_encrypt
#define DES_cbc_encrypt des_cbc_encrypt
#define OLD_DES
#endif
#endif
#endif /* HAVE_OPENSSL */
#ifdef NETSNMP_USE_INTERNAL_CRYPTO
#endif
#ifdef NETSNMP_USE_PKCS11
#include <security/cryptoki.h>
#endif
#ifdef QUITFUN
#undef QUITFUN
#define QUITFUN(e, l) \
if (e != SNMPERR_SUCCESS) { \
rval = SNMPERR_SC_GENERAL_FAILURE; \
goto l ; \
}
#endif
#ifdef NETSNMP_USE_INTERNAL_CRYPTO
static
int SHA1_hmac(const u_char * data, size_t len, u_char * mac, size_t maclen,
const u_char * secret, size_t secretlen);
static
int MD5_hmac(const u_char * data, size_t len, u_char * mac, size_t maclen,
const u_char * secret, size_t secretlen);
#endif
static netsnmp_auth_alg_info _auth_alg_info[] = {
{ NETSNMP_USMAUTH_NOAUTH, "usmNoAuthProtocol", usmNoAuthProtocol,
OID_LENGTH(usmNoAuthProtocol), 0, 0 },
{ NETSNMP_USMAUTH_HMACSHA1, "usmHMACSHA1AuthProtocol",
usmHMACSHA1AuthProtocol, OID_LENGTH(usmHMACSHA1AuthProtocol),
BYTESIZE(SNMP_TRANS_AUTHLEN_HMACSHA1), USM_MD5_AND_SHA_AUTH_LEN },
#ifndef NETSNMP_DISABLE_MD5
{ NETSNMP_USMAUTH_HMACMD5, "usmHMACMD5AuthProtocol",
usmHMACMD5AuthProtocol, OID_LENGTH(usmHMACMD5AuthProtocol),
BYTESIZE(SNMP_TRANS_AUTHLEN_HMACMD5), USM_MD5_AND_SHA_AUTH_LEN },
#endif
#ifdef HAVE_EVP_SHA224
{ NETSNMP_USMAUTH_HMAC128SHA224, "usmHMAC128SHA224AuthProtocol",
usmHMAC128SHA224AuthProtocol, OID_LENGTH(usmHMAC128SHA224AuthProtocol),
BYTESIZE(SNMP_TRANS_AUTHLEN_HMAC128SHA224), USM_HMAC128SHA224_AUTH_LEN },
{ NETSNMP_USMAUTH_HMAC192SHA256, "usmHMAC192SHA256AuthProtocol",
usmHMAC192SHA256AuthProtocol, OID_LENGTH(usmHMAC192SHA256AuthProtocol),
BYTESIZE(SNMP_TRANS_AUTHLEN_HMAC192SHA256), USM_HMAC192SHA256_AUTH_LEN },
#endif
#ifdef HAVE_EVP_SHA384
{ NETSNMP_USMAUTH_HMAC256SHA384, "usmHMAC256SHA384AuthProtocol",
usmHMAC256SHA384AuthProtocol, OID_LENGTH(usmHMAC256SHA384AuthProtocol),
BYTESIZE(SNMP_TRANS_AUTHLEN_HMAC256SHA384), USM_HMAC256SHA384_AUTH_LEN },
{ NETSNMP_USMAUTH_HMAC384SHA512, "usmHMAC384SHA512AuthProtocol",
usmHMAC384SHA512AuthProtocol, OID_LENGTH(usmHMAC384SHA512AuthProtocol),
BYTESIZE(SNMP_TRANS_AUTHLEN_HMAC384SHA512), USM_HMAC384SHA512_AUTH_LEN },
#endif
{ -1, "unknown", NULL, 0, 0, 0 }
};
static netsnmp_priv_alg_info _priv_alg_info[] = {
{ USM_CREATE_USER_PRIV_NONE, "usmNoPrivProtocol",
usmNoPrivProtocol, OID_LENGTH(usmNoPrivProtocol), 0, 0, 0 },
#ifndef NETSNMP_DISABLE_DES
{ USM_CREATE_USER_PRIV_DES, "usmDESPrivProtocol",
usmDESPrivProtocol, OID_LENGTH(usmDESPrivProtocol),
BYTESIZE(SNMP_TRANS_PRIVLEN_1DES),
BYTESIZE(SNMP_TRANS_PRIVLEN_1DES_IV),
BYTESIZE(SNMP_TRANS_PRIVLEN_1DES) },
#endif
#ifdef HAVE_AES
{ USM_CREATE_USER_PRIV_AES, "usmAESPrivProtocol",
usmAESPrivProtocol, OID_LENGTH(usmAESPrivProtocol),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES_IV),
0 },
#ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
{ USM_CREATE_USER_PRIV_AES192, "usmAES192PrivProtocol",
usmAES192PrivProtocol, OID_LENGTH(usmAES192PrivProtocol),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES192),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES192_IV),
0 },
{ USM_CREATE_USER_PRIV_AES192_CISCO, "usmAES192CiscoPrivProtocol",
usmAES192CiscoPrivProtocol, OID_LENGTH(usmAES192CiscoPrivProtocol),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES192),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES192_IV),
0 },
{ USM_CREATE_USER_PRIV_AES256, "usmAES256PrivProtocol",
usmAES256PrivProtocol, OID_LENGTH(usmAES256PrivProtocol),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES256),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES256_IV),
0 },
{ USM_CREATE_USER_PRIV_AES256_CISCO, "usmAES256CiscoPrivProtocol",
usmAES256CiscoPrivProtocol, OID_LENGTH(usmAES256CiscoPrivProtocol),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES256),
BYTESIZE(SNMP_TRANS_PRIVLEN_AES256_IV),
0 },
#endif
#endif
{ -1, NULL, NULL, 0 , 0, 0, 0 },
};
/*
* sc_get_priv_alg(oid *privoid, u_int len)
*
* returns a pointer to a netsnmp_priv_alg_info struct
*/
netsnmp_priv_alg_info *
sc_get_priv_alg_byoid(const oid *privoid, u_int len)
{
int i = 0;
DEBUGTRACE;
if ((NULL == privoid) || (0 == len))
return NULL;
for( ; _priv_alg_info[i].type != -1; ++i) {
if (len != _priv_alg_info[i].oid_len)
continue;
if (snmp_oid_compare(_priv_alg_info[i].alg_oid,
_priv_alg_info[i].oid_len,
privoid, len) == 0 )
return(&_priv_alg_info[i]);
}
DEBUGMSGTL(("scapi", "no match for OID "));
DEBUGMSGOID(("scapi", privoid, len));
DEBUGMSG(("scapi", "\n"));
return NULL;
}
/*
* sc_get_priv_alg_bytype(u_int type)
*
* returns a pointer to a netsnmp_priv_alg_info struct
*/
netsnmp_priv_alg_info *
sc_get_priv_alg_bytype(u_int type)
{
int i = 0;
DEBUGTRACE;
for( ; _priv_alg_info[i].type != -1; ++i) {
if (type != _priv_alg_info[i].type)
continue;
return(&_priv_alg_info[i]);
}
return NULL;
}
/*
* sc_find_auth_alg(oid *authoid, u_int len)
*
* returns a pointer to a netsnmp_auth_alg_info struct
*/
netsnmp_auth_alg_info *
sc_find_auth_alg_byoid(const oid *authoid, u_int len)
{
int i = 0;
DEBUGTRACE;
if ((NULL == authoid) || (0 == len))
return NULL;
for( ; _auth_alg_info[i].type != -1; ++i) {
if (len != _auth_alg_info[i].oid_len)
continue;
if (snmp_oid_compare(_auth_alg_info[i].alg_oid,
_auth_alg_info[i].oid_len,
authoid, len) == 0 )
return(&_auth_alg_info[i]);
}
/* DEBUGMSGTL(("scapi", "No auth alg found for"));
DEBUGMSGOID(("scapi", authoid, len ));*/
return NULL;
}
/*
* sc_get_auth_alg_byindex(u_int index)
*
* returns a pointer to a netsnmp_auth_alg_info struct
*/
netsnmp_auth_alg_info *
sc_get_auth_alg_byindex(u_int index)
{
DEBUGTRACE;
if (index >= (sizeof(_auth_alg_info)) / (sizeof(_auth_alg_info[0])) ||
-1 == _auth_alg_info[index].type)
return NULL;
return(&_auth_alg_info[index]);
}
/*
* sc_find_auth_alg_bytype(u_int type)
*
* returns a pointer to a netsnmp_auth_alg_info struct
*/
netsnmp_auth_alg_info *
sc_find_auth_alg_bytype(u_int type)
{
int i = 0;
DEBUGTRACE;
for( ; _auth_alg_info[i].type != -1; ++i) {
if (type != _auth_alg_info[i].type)
continue;
return(&_auth_alg_info[i]);
}
return NULL;
}
/*
* sc_get_authtype(oid *hashtype, u_int hashtype_len):
*
* Given a hashing type ("hashtype" and its length hashtype_len), return
* its type (the last suboid). NETSNMP_USMAUTH_* constants are defined in
* transform_oids.h.
*
* Returns SNMPERR_GENERR for an unknown hashing type.
*/
int
sc_get_authtype(const oid * hashtype, u_int hashtype_len)
{
netsnmp_auth_alg_info *aai;
DEBUGTRACE;
aai = sc_find_auth_alg_byoid(hashtype, hashtype_len);
if (NULL == aai)
return SNMPERR_GENERR;
return aai->type;
}
int
sc_get_privtype(const oid * privtype, u_int privtype_len)
{
netsnmp_priv_alg_info *pai;
DEBUGTRACE;
pai = sc_get_priv_alg_byoid(privtype, privtype_len);
if (NULL == pai)
return SNMPERR_GENERR;
return pai->type;
}
/*
* sc_get_auth_maclen(int hashtype):
*
* Given a hash type, return its MAC length, which may be shorter than
* the full hash length.
*
* Returns 0 for an unknown hash type.
*/
int
sc_get_auth_maclen(int hashtype)
{
netsnmp_auth_alg_info *aai;
DEBUGTRACE;
aai = sc_find_auth_alg_bytype(hashtype);
if (NULL == aai)
return 0;
return aai->mac_length;
}
/*
* sc_get_proper_auth_length_bytype(int hashtype):
*
* Given a hashing type, return the length of the hash result.
*
* Returns either the length or SNMPERR_GENERR for an unknown hashing type.
*/
int
sc_get_proper_auth_length_bytype(int hashtype)
{
netsnmp_auth_alg_info *aai;
DEBUGTRACE;
aai = sc_find_auth_alg_bytype(hashtype);
if (NULL == aai)
return SNMPERR_GENERR;
return aai->proper_length;
}
/*
* sc_get_auth_oid(int hashtype, int *oid_len):
*
* Given a type, return the OID and optionally set OID length.
*/
oid *
sc_get_auth_oid(int type, size_t *oid_len)
{
netsnmp_auth_alg_info *ai;
DEBUGTRACE;
ai = sc_find_auth_alg_bytype(type);
if (NULL == ai)
return NULL;
if (NULL != oid_len)
*oid_len = ai->oid_len;
return ai->alg_oid;
}
/*
* sc_get_auth_name(int hashtype):
*
* Given a type, return the name string
*/
const char*
sc_get_auth_name(int type)
{
netsnmp_auth_alg_info *ai;
DEBUGTRACE;
ai = sc_find_auth_alg_bytype(type);
if (NULL == ai)
return NULL;
return ai->name;
}
/*
* sc_get_priv_oid(int type, int *oid_len):
*
* Given a type, return the OID and optionally set OID length.
*/
oid *
sc_get_priv_oid(int type, size_t *oid_len)
{
netsnmp_priv_alg_info *ai;
DEBUGTRACE;
ai = sc_get_priv_alg_bytype(type);
if (NULL == ai)
return NULL;
if (NULL != oid_len)
*oid_len = ai->oid_len;
return ai->alg_oid;
}
/*
* sc_get_properlength(oid *hashtype, u_int hashtype_len):
*
* Given a hashing type ("hashtype" and its length hashtype_len), return
* the length of the hash result.
*
* Returns either the length or SNMPERR_GENERR for an unknown hashing type.
*/
int
sc_get_properlength(const oid * hashtype, u_int hashtype_len)
{
DEBUGTRACE;
/*
* Determine transform type hash length.
*/
return sc_get_proper_auth_length_bytype(
sc_get_authtype(hashtype, hashtype_len));
}
netsnmp_feature_child_of(scapi_get_proper_priv_length, netsnmp_unused)
#ifndef NETSNMP_FEATURE_REMOVE_SCAPI_GET_PROPER_PRIV_LENGTH
int
sc_get_proper_priv_length(const oid * privtype, u_int privtype_len)
{
netsnmp_priv_alg_info *pai;
DEBUGTRACE;
pai = sc_get_priv_alg_byoid(privtype, privtype_len);
if (NULL == pai)
return 0;
return pai->proper_length;
}
#endif /* NETSNMP_FEATURE_REMOVE_SCAPI_GET_PROPER_PRIV_LENGTH */
/*
* sc_get_priv_alg_byindex(u_int index)
*
* returns a pointer to a netsnmp_priv_alg_info struct
*/
netsnmp_priv_alg_info *
sc_get_priv_alg_byindex(u_int index)
{
DEBUGTRACE;
if (index >= (sizeof(_priv_alg_info)) / (sizeof(_priv_alg_info[0])) ||
-1 == _priv_alg_info[index].type)
return NULL;
return(&_priv_alg_info[index]);
}
int
sc_get_proper_priv_length_bytype(int privtype)
{
netsnmp_priv_alg_info *pai;
DEBUGTRACE;
pai = sc_get_priv_alg_bytype(privtype);
if (NULL == pai)
return 0;
return pai->proper_length;
}
/*******************************************************************-o-******
* sc_init
*
* Returns:
* SNMPERR_SUCCESS Success.
*/
int
sc_init(void)
{
int rval = SNMPERR_SUCCESS;
#if !defined(NETSNMP_USE_OPENSSL)
#if defined(NETSNMP_USE_INTERNAL_MD5) || defined(NETSNMP_USE_INTERNAL_CRYPTO)
struct timeval tv;
DEBUGTRACE;
gettimeofday(&tv, (struct timezone *) 0);
netsnmp_srandom((unsigned)(tv.tv_sec ^ tv.tv_usec));
#elif NETSNMP_USE_PKCS11
DEBUGTRACE;
rval = pkcs_init();
#else
rval = SNMPERR_SC_NOT_CONFIGURED;
#endif /* NETSNMP_USE_INTERNAL_MD5 */
/*
* XXX ogud: The only reason to do anything here with openssl is to
* * XXX ogud: seed random number generator
*/
#endif /* ifndef NETSNMP_USE_OPENSSL */
return rval;
} /* end sc_init() */
/*******************************************************************-o-******
* sc_random
*
* Parameters:
* *buf Pre-allocated buffer.
* *buflen Size of buffer.
*
* Returns:
* SNMPERR_SUCCESS Success.
*/
int
sc_random(u_char * buf, size_t * buflen)
#if defined(NETSNMP_USE_INTERNAL_MD5) || defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11) || defined(NETSNMP_USE_INTERNAL_CRYPTO)
{
int rval = SNMPERR_SUCCESS;
#if !defined(NETSNMP_USE_OPENSSL) && !defined(NETSNMP_USE_PKCS11)
int i;
int rndval;
u_char *ucp = buf;
#endif
DEBUGTRACE;
#ifdef NETSNMP_USE_OPENSSL
RAND_bytes(buf, *buflen); /* will never fail */
#elif NETSNMP_USE_PKCS11 /* NETSNMP_USE_PKCS11 */
pkcs_random(buf, *buflen);
#else /* NETSNMP_USE_INTERNAL_MD5 */
/*
* fill the buffer with random integers. Note that random()
* is defined in config.h and may not be truly the random()
* system call if something better existed
*/
rval = *buflen - *buflen % sizeof(rndval);
for (i = 0; i < rval; i += sizeof(rndval)) {
rndval = netsnmp_random();
memcpy(ucp, &rndval, sizeof(rndval));
ucp += sizeof(rndval);
}
rndval = netsnmp_random();
memcpy(ucp, &rndval, *buflen % sizeof(rndval));
rval = SNMPERR_SUCCESS;
#endif /* NETSNMP_USE_OPENSSL */
return rval;
} /* end sc_random() */
#else
_SCAPI_NOT_CONFIGURED
#endif /* */
#ifdef NETSNMP_USE_OPENSSL
const EVP_MD *
sc_get_openssl_hashfn(int auth_type)
{
const EVP_MD *hashfn = NULL;
DEBUGTRACE;
switch (auth_type) {
#ifndef NETSNMP_DISABLE_MD5
case NETSNMP_USMAUTH_HMACMD5:
hashfn = (const EVP_MD *) EVP_md5();
break;
#endif
case NETSNMP_USMAUTH_HMACSHA1:
hashfn = (const EVP_MD *) EVP_sha1();
break;
#ifdef HAVE_EVP_SHA224
case NETSNMP_USMAUTH_HMAC128SHA224:
hashfn = (const EVP_MD *) EVP_sha224();
break;
case NETSNMP_USMAUTH_HMAC192SHA256:
hashfn = (const EVP_MD *) EVP_sha256();
break;
#endif /* HAVE_EVP_SHA224 */
#ifdef HAVE_EVP_SHA384
case NETSNMP_USMAUTH_HMAC256SHA384:
hashfn = (const EVP_MD *) EVP_sha384();
break;
case NETSNMP_USMAUTH_HMAC384SHA512:
hashfn = (const EVP_MD *) EVP_sha512();
break;
#endif /* HAVE_EVP_SHA384 */
}
return hashfn;
}
const EVP_CIPHER *
sc_get_openssl_privfn(int priv_type)
{
const EVP_CIPHER *fn = NULL;
DEBUGTRACE;
switch(priv_type & (USM_PRIV_MASK_ALG | USM_PRIV_MASK_VARIANT)) {
#ifdef HAVE_AES
case USM_CREATE_USER_PRIV_AES:
fn = (const EVP_CIPHER *)EVP_aes_128_cfb();
break;
#ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
case USM_CREATE_USER_PRIV_AES192:
fn = (const void*)EVP_aes_192_cfb();
break;
case USM_CREATE_USER_PRIV_AES256:
fn = (const void*)EVP_aes_256_cfb();
break;
#endif
#endif /* HAVE_AES */
}
return fn;
}
#endif /* openssl */
/*******************************************************************-o-******
* sc_generate_keyed_hash
*
* Parameters:
* authtype Type of authentication transform.
* authtypelen
* *key Pointer to key (Kul) to use in keyed hash.
* keylen Length of key in bytes.
* *message Pointer to the message to hash.
* msglen Length of the message.
* *MAC Will be returned with allocated bytes containg hash.
* *maclen Length of the hash buffer in bytes; also indicates
* whether the MAC should be truncated.
*
* Returns:
* SNMPERR_SUCCESS Success.
* SNMPERR_GENERR All errs
*
*
* A hash of the first msglen bytes of message using a keyed hash defined
* by authtype is created and stored in MAC. MAC is ASSUMED to be a buffer
* of at least maclen bytes. If the length of the hash is greater than
* maclen, it is truncated to fit the buffer. If the length of the hash is
* less than maclen, maclen set to the number of hash bytes generated.
*
* ASSUMED that the number of hash bits is a multiple of 8.
*/
int
sc_generate_keyed_hash(const oid * authtypeOID, size_t authtypeOIDlen,
const u_char * key, u_int keylen,
const u_char * message, u_int msglen,
u_char * MAC, size_t * maclen)
#if defined(NETSNMP_USE_INTERNAL_MD5) || defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11) || defined(NETSNMP_USE_INTERNAL_CRYPTO)
{
int rval = SNMPERR_SUCCESS, auth_type;
int iproperlength;
size_t properlength;
u_char buf[SNMP_MAXBUF_SMALL];
#if defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11)
unsigned int buf_len = sizeof(buf);
#endif
#ifdef NETSNMP_USE_OPENSSL
const EVP_MD *hashfn;
#elif defined(NETSNMP_USE_PKCS11)
u_long ck_type;
#endif
DEBUGTRACE;
#ifdef NETSNMP_ENABLE_TESTING_CODE
{
int i;
DEBUGMSG(("sc_generate_keyed_hash",
"sc_generate_keyed_hash(): key=0x"));
for (i = 0; i < keylen; i++)
DEBUGMSG(("sc_generate_keyed_hash", "%02x", key[i] & 0xff));
DEBUGMSG(("sc_generate_keyed_hash", " (%d)\n", keylen));
}
#endif /* NETSNMP_ENABLE_TESTING_CODE */
/*
* Sanity check.
*/
if (!authtypeOID || !key || !message || !MAC || !maclen
|| (keylen <= 0) || (msglen <= 0) || (*maclen <= 0)) {
QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);
}
auth_type = sc_get_authtype(authtypeOID, authtypeOIDlen);
iproperlength = sc_get_auth_maclen(auth_type);
if (iproperlength == SNMPERR_GENERR)
return SNMPERR_GENERR;
properlength = (size_t)iproperlength;
if (keylen < properlength) {
QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);
}
#ifdef NETSNMP_ENABLE_TESTING_CODE
DEBUGMSGTL(("scapi", "iproperlength: %d, maclen:%" NETSNMP_PRIz "d\n", iproperlength,
*maclen));
#endif
#ifdef NETSNMP_USE_OPENSSL
/** get hash function */
hashfn = sc_get_openssl_hashfn(auth_type);
if (NULL == hashfn) {
QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);
}
HMAC(hashfn, key, keylen, message, msglen, buf, &buf_len);
if (buf_len != properlength) {
QUITFUN(rval, sc_generate_keyed_hash_quit);
}
if (*maclen > buf_len)
*maclen = buf_len;
memcpy(MAC, buf, *maclen);
#elif NETSNMP_USE_PKCS11 /* NETSNMP_USE_PKCS11 */
#ifndef NETSNMP_DISABLE_MD5
if (NETSNMP_USMAUTH_HMACMD5 == auth_type) {
if (pkcs_sign(CKM_MD5_HMAC,key, keylen, message,
msglen, buf, &buf_len) != SNMPERR_SUCCESS) {
QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);
}
} else
#endif
if (NETSNMP_USMAUTH_HMACSHA1 == auth_type) {
if (pkcs_sign(CKM_SHA_1_HMAC,key, keylen, message,
msglen, buf, &buf_len) != SNMPERR_SUCCESS) {
QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);
}
} else {
QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);
}
if (buf_len != properlength) {
QUITFUN(rval, sc_generate_keyed_hash_quit);
}
if (*maclen > buf_len)
*maclen = buf_len;
memcpy(MAC, buf, *maclen);
#elif NETSNMP_USE_INTERNAL_CRYPTO
if (*maclen > properlength)
*maclen = properlength;
#ifndef NETSNMP_DISABLE_MD5
if (NETSNMP_USMAUTH_HMACMD5 == auth_type)
rval = MD5_hmac(message, msglen, MAC, *maclen, key, keylen);
else
#endif
if (NETSNMP_USMAUTH_HMACSHA1 == auth_type)
rval = SHA1_hmac(message, msglen, MAC, *maclen, key, keylen);
else {
QUITFUN(SNMPERR_GENERR, sc_generate_keyed_hash_quit);
}
if (rval != 0) {
rval = SNMPERR_GENERR;
goto sc_generate_keyed_hash_quit;
}
#else /* NETSNMP_USE_INTERNAL_MD5 */
if (*maclen > properlength)
*maclen = properlength;
if (MDsign(message, msglen, MAC, *maclen, key, keylen)) {
rval = SNMPERR_GENERR;
goto sc_generate_keyed_hash_quit;
}
#endif /* NETSNMP_USE_OPENSSL */
#ifdef NETSNMP_ENABLE_TESTING_CODE
{
char *s;
int len = binary_to_hex(MAC, *maclen, &s);
DEBUGMSGTL(("scapi", "Full v3 message hash: %s\n", s));
SNMP_ZERO(s, len);
SNMP_FREE(s);
}
#endif /* NETSNMP_ENABLE_TESTING_CODE */
sc_generate_keyed_hash_quit:
memset(buf, 0, SNMP_MAXBUF_SMALL);
return rval;
} /* end sc_generate_keyed_hash() */
#else
_SCAPI_NOT_CONFIGURED
#endif /* */
/*******************************************************************-o-******
* sc_hash(): a generic wrapper around whatever hashing package we are using.
*
* IN:
* hashtype - oid pointer to a hash type
* hashtypelen - length of oid pointer
* buf - u_char buffer to be hashed
* buf_len - integer length of buf data
* MAC_len - length of the passed MAC buffer size.
*
* OUT:
* MAC - pre-malloced space to store hash output.
* MAC_len - length of MAC output to the MAC buffer.
*
* Returns:
* SNMPERR_SUCCESS Success.
* SNMP_SC_GENERAL_FAILURE Any error.
* SNMPERR_SC_NOT_CONFIGURED Hash type not supported.
*/
int
sc_hash(const oid * hashtype, size_t hashtypelen, const u_char * buf,
size_t buf_len, u_char * MAC, size_t * MAC_len)
{
int auth_type;
DEBUGTRACE;
if (hashtype == NULL)
return (SNMPERR_GENERR);
auth_type = sc_get_authtype(hashtype, hashtypelen);
if (auth_type < 0 )
return (SNMPERR_GENERR);
return sc_hash_type(auth_type, buf, buf_len, MAC, MAC_len);
}
/*******************************************************************-o-******
* sc_hash_type():
* a generic wrapper around whatever hashing package we are using.
*
* IN:
* hashtype - oid pointer to a hash type
* hashtypelen - length of oid pointer
* buf - u_char buffer to be hashed
* buf_len - integer length of buf data
* MAC_len - length of the passed MAC buffer size.
*
* OUT:
* MAC - pre-malloced space to store hash output.
* MAC_len - length of MAC output to the MAC buffer.
*
* Returns:
* SNMPERR_SUCCESS Success.
* SNMP_SC_GENERAL_FAILURE Any error.
* SNMPERR_SC_NOT_CONFIGURED Hash type not supported.
*/
int
sc_hash_type(int auth_type, const u_char * buf, size_t buf_len, u_char * MAC,
size_t * MAC_len)
#if defined(NETSNMP_USE_INTERNAL_MD5) || defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11) || defined(NETSNMP_USE_INTERNAL_CRYPTO)
{
#if defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11) || defined(NETSNMP_USE_INTERNAL_CRYPTO)
int rval = SNMPERR_SUCCESS;
#endif
#if defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11)
unsigned int tmp_len;
#endif
int ret;
#ifdef NETSNMP_USE_OPENSSL
const EVP_MD *hashfn;
EVP_MD_CTX *cptr;
#endif
#ifdef NETSNMP_USE_INTERNAL_CRYPTO
MD5_CTX cmd5;
SHA_CTX csha1;
#endif
DEBUGTRACE;
if (buf == NULL || buf_len <= 0 || MAC == NULL || MAC_len == NULL )
return (SNMPERR_GENERR);
ret = sc_get_proper_auth_length_bytype(auth_type);
if (( ret < 0 ) || (*MAC_len < (size_t)ret ))
return (SNMPERR_GENERR);
#ifdef NETSNMP_USE_OPENSSL
/*
* Determine transform type.
*/
hashfn = sc_get_openssl_hashfn(auth_type);
if (NULL == hashfn)
return SNMPERR_GENERR;
/** initialize the pointer */
#if defined(HAVE_EVP_MD_CTX_NEW)
cptr = EVP_MD_CTX_new();
#elif defined(HAVE_EVP_MD_CTX_CREATE)
cptr = EVP_MD_CTX_create();
#else
cptr = malloc(sizeof(*cptr));
#if defined(OLD_DES)
memset(cptr, 0, sizeof(*cptr));
#else
EVP_MD_CTX_init(cptr);
#endif
#endif
if (!EVP_DigestInit(cptr, hashfn)) {
/* requested hash function is not available */
return SNMPERR_SC_NOT_CONFIGURED;
}
/** pass the data */
EVP_DigestUpdate(cptr, buf, buf_len);
/** do the final pass */
EVP_DigestFinal(cptr, MAC, &tmp_len);
*MAC_len = tmp_len;
#if defined(HAVE_EVP_MD_CTX_FREE)
EVP_MD_CTX_free(cptr);
#elif defined(HAVE_EVP_MD_CTX_DESTROY)
EVP_MD_CTX_destroy(cptr);
#else
#if !defined(OLD_DES)
EVP_MD_CTX_cleanup(cptr);
#endif
free(cptr);
#endif
return (rval);
#elif NETSNMP_USE_INTERNAL_CRYPTO
#ifndef NETSNMP_DISABLE_MD5
if (NETSNMP_USMAUTH_HMACMD5 == auth_type) {
if (*MAC_len < MD5_DIGEST_LENGTH)
return (SNMPERR_GENERR); /* the buffer isn't big enough */
MD5_Init(&cmd5);
MD5_Update(&cmd5, buf, buf_len);
MD5_Final(MAC, &cmd5);
*MAC_len = MD5_DIGEST_LENGTH;
} else
#endif
if (NETSNMP_USMAUTH_HMACSHA1 == auth_type) {
if (*MAC_len < SHA_DIGEST_LENGTH)
return (SNMPERR_GENERR); /* the buffer isn't big enough */
SHA1_Init(&csha1);
SHA1_Update(&csha1, buf, buf_len);
SHA1_Final(MAC, &csha1);
*MAC_len = SHA_DIGEST_LENGTH;
} else {
return (SNMPERR_GENERR);
}
return (rval);
#elif NETSNMP_USE_PKCS11 /* NETSNMP_USE_PKCS11 */
#ifndef NETSNMP_DISABLE_MD5
if (NETSNMP_USMAUTH_HMACMD5 == auth_type) {
rval = pkcs_digest(CKM_MD5, buf, buf_len, MAC, &tmp_len);
*MAC_len = tmp_len;
} else
#endif
if (NETSNMP_USMAUTH_HMACSHA1 == auth_type) {
rval = pkcs_digest(CKM_SHA_1, buf, buf_len, MAC, &tmp_len);
*MAC_len = tmp_len;
} else {
return (SNMPERR_GENERR);
}
return (rval);
#else /* NETSNMP_USE_INTERNAL_MD5 */
if (MDchecksum(buf, buf_len, MAC, *MAC_len)) {
return SNMPERR_GENERR;
}
if (*MAC_len > 16)
*MAC_len = 16;
return SNMPERR_SUCCESS;
#endif /* NETSNMP_USE_OPENSSL */
}
#else /* !defined(NETSNMP_USE_OPENSSL) && !defined(NETSNMP_USE_INTERNAL_MD5) */
_SCAPI_NOT_CONFIGURED
#endif /* !defined(NETSNMP_USE_OPENSSL) && !defined(NETSNMP_USE_INTERNAL_MD5) */
/*******************************************************************-o-******
* sc_check_keyed_hash
*
* Parameters:
* authtype Transform type of authentication hash.
* *key Key bits in a string of bytes.
* keylen Length of key in bytes.
* *message Message for which to check the hash.
* msglen Length of message.
* *MAC Given hash.
* maclen Length of given hash; indicates truncation if it is
* shorter than the normal size of output for
* given hash transform.
* Returns:
* SNMPERR_SUCCESS Success.
* SNMP_SC_GENERAL_FAILURE Any error
*
*
* Check the hash given in MAC against the hash of message. If the length
* of MAC is less than the length of the transform hash output, only maclen
* bytes are compared. The length of MAC cannot be greater than the
* length of the hash transform output.
*/
int
sc_check_keyed_hash(const oid * authtypeOID, size_t authtypeOIDlen,
const u_char * key, u_int keylen,
const u_char * message, u_int msglen,
const u_char * MAC, u_int maclen)
#if defined(NETSNMP_USE_INTERNAL_MD5) || defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_PKCS11) || defined(NETSNMP_USE_INTERNAL_CRYPTO)
{
int rval = SNMPERR_SUCCESS, auth_type, auth_size;
size_t buf_len = SNMP_MAXBUF_SMALL;
u_char buf[SNMP_MAXBUF_SMALL];
DEBUGTRACE;
#ifdef NETSNMP_ENABLE_TESTING_CODE
{
int i;
DEBUGMSG(("scapi", "sc_check_keyed_hash(): key=0x"));
for (i = 0; i < keylen; i++)
DEBUGMSG(("scapi", "%02x", key[i] & 0xff));
DEBUGMSG(("scapi", " (%d)\n", keylen));
}
#endif /* NETSNMP_ENABLE_TESTING_CODE */
/*
* Sanity check.
*/
if (!authtypeOID || !key || !message || !MAC
|| (keylen <= 0) || (msglen <= 0) || (maclen <= 0)) {
QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
}
auth_type = sc_get_authtype(authtypeOID, authtypeOIDlen);
if (auth_type < 0 )
return (SNMPERR_GENERR);
auth_size = sc_get_auth_maclen(auth_type);
if (0 == auth_size || maclen != auth_size) {
QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
}
/*
* Generate a full hash of the message, then compare
* the result with the given MAC which may be shorter than
* the full hash length.
*/
rval = sc_generate_keyed_hash(authtypeOID, authtypeOIDlen, key, keylen,
message, msglen, buf, &buf_len);
QUITFUN(rval, sc_check_keyed_hash_quit);
if (maclen > msglen) {
QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
} else if (memcmp(buf, MAC, maclen) != 0) {
QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
}
sc_check_keyed_hash_quit:
memset(buf, 0, SNMP_MAXBUF_SMALL);
return rval;
} /* end sc_check_keyed_hash() */
#else
_SCAPI_NOT_CONFIGURED
#endif /* NETSNMP_USE_INTERNAL_MD5 */
/*******************************************************************-o-******
* sc_encrypt
*
* Parameters:
* privtype Type of privacy cryptographic transform.
* *key Key bits for crypting.
* keylen Length of key (buffer) in bytes.
* *iv IV bits for crypting.
* ivlen Length of iv (buffer) in bytes.
* *plaintext Plaintext to crypt.
* ptlen Length of plaintext.
* *ciphertext Ciphertext to crypt.
* *ctlen Length of ciphertext.
*
* Returns:
* SNMPERR_SUCCESS Success.
* SNMPERR_SC_NOT_CONFIGURED Encryption is not supported.
* SNMPERR_SC_GENERAL_FAILURE Any other error
*
*
* Encrypt plaintext into ciphertext using key and iv.
*
* ctlen contains actual number of crypted bytes in ciphertext upon
* successful return.
*/
int
sc_encrypt(const oid * privtype, size_t privtypelen,
u_char * key, u_int keylen,
u_char * iv, u_int ivlen,
const u_char * plaintext, u_int ptlen,
u_char * ciphertext, size_t * ctlen)
#if defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_INTERNAL_CRYPTO)
{
int rval = SNMPERR_SUCCESS;
u_char pad_block[128]; /* bigger than anything I need */
u_char my_iv[128]; /* ditto */
netsnmp_priv_alg_info *pai = NULL;
#ifndef NETSNMP_DISABLE_DES
int pad, plast, pad_size = 0;
#ifdef OLD_DES
DES_key_schedule key_sch;
#else
DES_key_schedule key_sched_store;
DES_key_schedule *key_sch = &key_sched_store;
#endif /* OLD_DES */
DES_cblock key_struct;
#endif /* NETSNMP_DISABLE_DES */
DEBUGTRACE;
/*
* Sanity check.
*/
#if !defined(NETSNMP_ENABLE_SCAPI_AUTHPRIV)
snmp_log(LOG_ERR, "Encryption support not enabled.(2)\n");
return SNMPERR_SC_NOT_CONFIGURED;
#endif
if (!privtype || !key || !iv || !plaintext || !ciphertext || !ctlen
|| (keylen <= 0) || (ivlen <= 0) || (ivlen > sizeof(my_iv))
|| (ptlen <= 0) || (*ctlen <= 0)) {
DEBUGMSGTL(("scapi:encrypt", "bad arguments 1\n"));
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
} else if (ptlen > *ctlen) {
DEBUGMSGTL(("scapi:encrypt", "bad arguments 2\n"));
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
#ifdef NETSNMP_ENABLE_TESTING_CODE
{
size_t buf_len = 128, out_len = 0;
u_char *buf = (u_char *) malloc(buf_len);
if (buf != NULL) {
if (sprint_realloc_hexstring(&buf, &buf_len, &out_len, 1,
iv, ivlen)) {
DEBUGMSGTL(("scapi", "encrypt: IV: %s\n", buf));
} else {
DEBUGMSGTL(("scapi", "encrypt: IV: %s [TRUNCATED]\n", buf));
}
out_len = 0;
if (sprint_realloc_hexstring(&buf, &buf_len, &out_len, 1,
key, keylen)) {
DEBUGMSG(("scapi", "key: %s\n", buf));
} else {
DEBUGMSG(("scapi", "key: %s [TRUNCATED]\n", buf));
}
out_len = 0;
if (sprint_realloc_hexstring(&buf, &buf_len, &out_len, 1,
plaintext, 16)) {
DEBUGMSGTL(("scapi", "encrypt: string: %s\n", buf));
} else {
DEBUGMSGTL(("scapi", "encrypt: string: %s [TRUNCATED]\n",
buf));
}
free(buf);
} else {
DEBUGMSGTL(("scapi",
"encrypt: malloc fail for debug output\n"));
}
}
#endif /* NETSNMP_ENABLE_TESTING_CODE */
/*
* Determine privacy transform.
*/
pai = sc_get_priv_alg_byoid(privtype, privtypelen);
if (NULL == pai ||
(keylen < pai->proper_length) || (ivlen < pai->iv_length)) {
DEBUGMSGTL(("scapi:encrypt",
"bad arguments 3 pai %p, keylen %d ivlen %d\n",
pai, keylen, ivlen));
if (pai)
DEBUGMSGTL(("scapi:encrypt", " pai: properlen %d, ivlen %d\n",
pai->proper_length, pai->iv_length));
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
pad_size = pai->pad_size;
memset(my_iv, 0, sizeof(my_iv));
#ifndef NETSNMP_DISABLE_DES
if (USM_CREATE_USER_PRIV_DES == (pai->type & USM_PRIV_MASK_ALG)) {
/*
* now calculate the padding needed
*/
pad = pad_size - (ptlen % pad_size);
plast = (int) ptlen - (pad_size - pad);
if (pad == pad_size)
pad = 0;
if (ptlen + pad > *ctlen) {
DEBUGMSGTL(("scapi:encrypt", "not enough space\n"));
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit); /* not enough space */
}
if (pad > 0) { /* copy data into pad block if needed */
memcpy(pad_block, plaintext + plast, pad_size - pad);
memset(&pad_block[pad_size - pad], pad, pad); /* filling in padblock */
}
memcpy(key_struct, key, sizeof(key_struct));
(void) DES_key_sched(&key_struct, key_sch);
memcpy(my_iv, iv, ivlen);
/*
* encrypt the data
*/
DES_ncbc_encrypt(plaintext, ciphertext, plast, key_sch,
(DES_cblock *) my_iv, DES_ENCRYPT);
if (pad > 0) {
/*
* then encrypt the pad block
*/
DES_ncbc_encrypt(pad_block, ciphertext + plast, pad_size,
key_sch, (DES_cblock *) my_iv, DES_ENCRYPT);
*ctlen = plast + pad_size;
} else {
*ctlen = plast;
}
}
#endif
#if defined(NETSNMP_USE_OPENSSL) && defined(HAVE_AES)
if (USM_CREATE_USER_PRIV_AES == (pai->type & USM_PRIV_MASK_ALG)) {
EVP_CIPHER_CTX *ctx;
const EVP_CIPHER *cipher;
int len, rc, enclen;
cipher = sc_get_openssl_privfn(pai->type);
if (NULL == cipher) {
DEBUGMSGTL(("scapi:encrypt", "cipher not found\n"));
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
memcpy(my_iv, iv, ivlen);
/*
* encrypt the data
*/
ctx = EVP_CIPHER_CTX_new();
if (!ctx) {
DEBUGMSGTL(("scapi:encrypt", "openssl error: ctx_new\n"));
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
rc = EVP_EncryptInit(ctx, cipher, key, my_iv);
if (rc != 1) {
DEBUGMSGTL(("scapi:encrypt", "openssl error: init\n"));
EVP_CIPHER_CTX_free(ctx);
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
rc = EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, ptlen);
if (rc != 1) {
DEBUGMSGTL(("scapi:encrypt", "openssl error: update\n"));
EVP_CIPHER_CTX_free(ctx);
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
enclen = len;
rc = EVP_EncryptFinal(ctx, ciphertext + len, &len);
if (rc != 1) {
DEBUGMSGTL(("scapi:encrypt", "openssl error: final\n"));
EVP_CIPHER_CTX_free(ctx);
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
enclen += len;
ptlen = enclen;
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
*ctlen = ptlen;
}
#endif
sc_encrypt_quit:
/*
* clear memory just in case
*/
memset(my_iv, 0, sizeof(my_iv));
memset(pad_block, 0, sizeof(pad_block));
#ifndef NETSNMP_DISABLE_DES
memset(key_struct, 0, sizeof(key_struct));
#ifdef OLD_DES
memset(&key_sch, 0, sizeof(key_sch));
#else
memset(&key_sched_store, 0, sizeof(key_sched_store));
#endif
#endif
return rval;
} /* end sc_encrypt() */
#elif defined(NETSNMP_USE_PKCS11)
{
int rval = SNMPERR_SUCCESS, priv_type
u_char pkcs_des_key[8];
netsnmp_priv_alg_info *pai;
DEBUGTRACE;
/*
* Sanity check.
*/
#if !defined(NETSNMP_ENABLE_SCAPI_AUTHPRIV)
snmp_log(LOG_ERR, "Encryption support not enabled.(1)\n");
return SNMPERR_SC_NOT_CONFIGURED;
#endif
if (!privtype || !key || !iv || !plaintext || !ciphertext || !ctlen
|| (keylen <= 0) || (ivlen <= 0) || (ptlen <= 0) || (*ctlen <= 0)) {
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
} else if (ptlen > *ctlen) {
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
/*
* Determine privacy transform.
*/
pai = sc_get_priv_alg_byoid(privtype, privtypelen);
if (NULL == pai || USM_CREATE_USER_PRIV_DES != priv_type ||
(keylen < pai->proper_length) || (ivlen < pai->iv_length)) {
QUITFUN(SNMPERR_GENERR, sc_encrypt_quit);
}
memset(pkcs_des_key, 0, sizeof(pkcs_des_key));
memcpy(pkcs_des_key, key, sizeof(pkcs_des_key));
rval = pkcs_encrpyt(CKM_DES_CBC, pkcs_des_key,
sizeof(pkcs_des_key), iv, ivlen, plaintext, ptlen,
ciphertext, ctlen);
sc_encrypt_quit:
return rval;
}
#else
{
# if NETSNMP_USE_INTERNAL_MD5
{
snmp_log(LOG_ERR, "Encryption support not enabled.(3)\n");
DEBUGMSGTL(("scapi", "Encrypt function not defined.\n"));
return SNMPERR_SC_GENERAL_FAILURE;
}
# else
_SCAPI_NOT_CONFIGURED
# endif /* NETSNMP_USE_INTERNAL_MD5 */
}
#endif /* */
/*******************************************************************-o-******
* sc_decrypt
*
* Parameters:
* privtype
* *key
* keylen
* *iv
* ivlen
* *ciphertext
* ctlen
* *plaintext
* *ptlen
*
* Returns:
* SNMPERR_SUCCESS Success.
* SNMPERR_SC_NOT_CONFIGURED Encryption is not supported.
* SNMPERR_SC_GENERAL_FAILURE Any other error
*
*
* Decrypt ciphertext into plaintext using key and iv.
*
* ptlen contains actual number of plaintext bytes in plaintext upon
* successful return.
*/
int
sc_decrypt(const oid * privtype, size_t privtypelen,
u_char * key, u_int keylen,
u_char * iv, u_int ivlen,
u_char * ciphertext, u_int ctlen,
u_char * plaintext, size_t * ptlen)
#if defined(NETSNMP_USE_OPENSSL) || defined(NETSNMP_USE_INTERNAL_CRYPTO)
{
int rval = SNMPERR_SUCCESS;
u_char my_iv[128];
#ifndef NETSNMP_DISABLE_DES
#ifdef OLD_DES
DES_key_schedule key_sch;
#else
DES_key_schedule key_sched_store;
DES_key_schedule *key_sch = &key_sched_store;
#endif
DES_cblock key_struct;
#endif
netsnmp_priv_alg_info *pai = NULL;
DEBUGTRACE;
if (!privtype || !key || !iv || !plaintext || !ciphertext || !ptlen
|| (ctlen <= 0) || (*ptlen <= 0) || (*ptlen < ctlen)) {
DEBUGMSGTL(("scapi", "decrypt: arg sanity checks failed\n"));
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
}
#ifdef NETSNMP_ENABLE_TESTING_CODE
{
size_t buf_len = 128, out_len = 0;
u_char *buf = (u_char *) malloc(buf_len);
if (buf != NULL) {
if (sprint_realloc_hexstring(&buf, &buf_len, &out_len, 1,
iv, ivlen)) {
DEBUGMSGTL(("scapi", "decrypt: IV: %s\n", buf));
} else {
DEBUGMSGTL(("scapi", "decrypt: IV: %s [TRUNCATED]\n", buf));
}
out_len = 0;
if (sprint_realloc_hexstring(&buf, &buf_len, &out_len, 1,
key, keylen)) {
DEBUGMSG(("scapi", "key: %s\n", buf));
} else {
DEBUGMSG(("scapi", "key: %s [TRUNCATED]\n", buf));
}
free(buf);
} else {
DEBUGMSGTL(("scapi",
"decrypt: malloc fail for debug output\n"));
}
}
#endif /* NETSNMP_ENABLE_TESTING_CODE */
/*
* Determine privacy transform.
*/
pai = sc_get_priv_alg_byoid(privtype, privtypelen);
if (NULL == pai ||
(keylen < pai->proper_length) || (ivlen < pai->iv_length)) {
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
}
memset(my_iv, 0, sizeof(my_iv));
#ifndef NETSNMP_DISABLE_DES
if (USM_CREATE_USER_PRIV_DES == (pai->type & USM_PRIV_MASK_ALG)) {
memcpy(key_struct, key, sizeof(key_struct));
(void) DES_key_sched(&key_struct, key_sch);
memcpy(my_iv, iv, ivlen);
DES_cbc_encrypt(ciphertext, plaintext, ctlen, key_sch,
(DES_cblock *) my_iv, DES_DECRYPT);
*ptlen = ctlen;
}
#endif
#if defined(NETSNMP_USE_OPENSSL) && defined(HAVE_AES)
if (USM_CREATE_USER_PRIV_AES == (pai->type & USM_PRIV_MASK_ALG)) {
EVP_CIPHER_CTX *ctx;
const EVP_CIPHER *cipher;
int len, rc;
cipher = sc_get_openssl_privfn(pai->type);
if (NULL == cipher)
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
memcpy(my_iv, iv, ivlen);
/*
* decrypt the data
*/
ctx = EVP_CIPHER_CTX_new();
if (!ctx) {
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
}
rc = EVP_DecryptInit(ctx, cipher, key, my_iv);
if (rc != 1) {
EVP_CIPHER_CTX_free(ctx);
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
}
rc = EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ctlen);
if (rc != 1) {
EVP_CIPHER_CTX_free(ctx);
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
}
rc = EVP_DecryptFinal(ctx, plaintext + len, &len);
if (rc != 1) {
EVP_CIPHER_CTX_free(ctx);
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
}
/* Clean up */
EVP_CIPHER_CTX_free(ctx);
*ptlen = ctlen;
}
#endif
/*
* exit cond
*/
sc_decrypt_quit:
#ifndef NETSNMP_DISABLE_DES
#ifdef OLD_DES
memset(&key_sch, 0, sizeof(key_sch));
#else
memset(&key_sched_store, 0, sizeof(key_sched_store));
#endif
memset(key_struct, 0, sizeof(key_struct));
#endif
memset(my_iv, 0, sizeof(my_iv));
return rval;
} /* USE OPEN_SSL */
#elif NETSNMP_USE_PKCS11 /* USE PKCS */
{
int rval = SNMPERR_SUCCESS;
u_char pkcs_des_key[8];
netsnmp_priv_alg_info *pai;
DEBUGTRACE;
if (!privtype || !key || !iv || !plaintext || !ciphertext || !ptlen
|| (ctlen <= 0) || (*ptlen <= 0) || (*ptlen < ctlen)) {
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
}
/*
* Determine privacy transform.
*/
pai = sc_get_priv_alg_byoid(privtype, privtypelen);
if (NULL == pai || USM_CREATE_USER_PRIV_DES != priv_type ||
(keylen < pai->proper_length) || (ivlen < pai->iv_length)) {
QUITFUN(SNMPERR_GENERR, sc_decrypt_quit);
}
memset(pkcs_des_key, 0, sizeof(pkcs_des_key));
memcpy(pkcs_des_key, key, sizeof(pkcs_des_key));
rval = pkcs_decrpyt(CKM_DES_CBC, pkcs_des_key,
sizeof(pkcs_des_key), iv, ivlen, ciphertext,
ctlen, plaintext, ptlen);
*ptlen = ctlen;
sc_decrypt_quit:
return rval;
} /* USE PKCS */
#else
{
#if !defined(NETSNMP_ENABLE_SCAPI_AUTHPRIV)
snmp_log(LOG_ERR, "Encryption support not enabled.(4)\n");
return SNMPERR_SC_NOT_CONFIGURED;
#else
# if NETSNMP_USE_INTERNAL_MD5
{
DEBUGMSGTL(("scapi", "Decryption function not defined.\n"));
return SNMPERR_SC_GENERAL_FAILURE;
}
# else
_SCAPI_NOT_CONFIGURED
# endif /* NETSNMP_USE_INTERNAL_MD5 */
#endif /* */
}
#endif /* NETSNMP_USE_OPENSSL */
#ifdef NETSNMP_USE_INTERNAL_CRYPTO
/* These functions are basically copies of the MDSign() routine in
md5.c modified to be used with the OpenSSL hashing functions. The
copyright below is from the md5.c file that these functions were
taken from: */
/*
* ** **************************************************************************
* ** md5.c -- Implementation of MD5 Message Digest Algorithm **
* ** Updated: 2/16/90 by Ronald L. Rivest **
* ** (C) 1990 RSA Data Security, Inc. **
* ** **************************************************************************
*/
/*
* MD5_hmac(data, len, MD5): do a checksum on an arbirtrary amount
* of data, and prepended with a secret in the standard fashion
*/
static int
MD5_hmac(const u_char * data, size_t len, u_char * mac, size_t maclen,
const u_char * secret, size_t secretlen)
{
#define MD5_HASHKEYLEN 64
#define MD5_SECRETKEYLEN 16
MD5_CTX cmd5;
u_char K1[MD5_HASHKEYLEN];
u_char K2[MD5_HASHKEYLEN];
u_char extendedAuthKey[MD5_HASHKEYLEN];
u_char buf[MD5_HASHKEYLEN];
size_t i;
const u_char *cp;
u_char *newdata = NULL;
int rc = 0;
DEBUGTRACE;
/*
* memset(K1,0,MD5_HASHKEYLEN);
* memset(K2,0,MD5_HASHKEYLEN);
* memset(buf,0,MD5_HASHKEYLEN);
* memset(extendedAuthKey,0,MD5_HASHKEYLEN);
*/
if (secretlen != MD5_SECRETKEYLEN || secret == NULL ||
mac == NULL || data == NULL ||
len <= 0 || maclen <= 0) {
/*
* DEBUGMSGTL(("md5","MD5 signing not properly initialized"));
*/
return -1;
}
memset(extendedAuthKey, 0, MD5_HASHKEYLEN);
memcpy(extendedAuthKey, secret, secretlen);
for (i = 0; i < MD5_HASHKEYLEN; i++) {
K1[i] = extendedAuthKey[i] ^ 0x36;
K2[i] = extendedAuthKey[i] ^ 0x5c;
}
MD5_Init(&cmd5);
rc = !MD5_Update(&cmd5, K1, MD5_HASHKEYLEN);
if (rc)
goto update_end;
i = len;
if (((uintptr_t) data) % sizeof(long) != 0) {
/*
* this relies on the ability to use integer math and thus we
* must rely on data that aligns on 32-bit-word-boundries
*/
newdata = netsnmp_memdup(data, len);
cp = newdata;
} else {
cp = data;
}
while (i >= 64) {
rc = !MD5_Update(&cmd5, cp, 64);
if (rc)
goto update_end;
cp += 64;
i -= 64;
}
rc = !MD5_Update(&cmd5, cp, i);
if (rc)
goto update_end;
memset(buf, 0, MD5_HASHKEYLEN);
MD5_Final(buf, &cmd5);
MD5_Init(&cmd5);
rc = !MD5_Update(&cmd5, K2, MD5_HASHKEYLEN);
if (rc)
goto update_end;
rc = !MD5_Update(&cmd5, buf, MD5_SECRETKEYLEN);
if (rc)
goto update_end;
/*
* copy the sign checksum to the outgoing pointer
*/
MD5_Final(buf, &cmd5);
memcpy(mac, buf, maclen);
update_end:
memset(buf, 0, MD5_HASHKEYLEN);
memset(K1, 0, MD5_HASHKEYLEN);
memset(K2, 0, MD5_HASHKEYLEN);
memset(extendedAuthKey, 0, MD5_HASHKEYLEN);
memset(&cmd5, 0, sizeof(cmd5));
if (newdata)
free(newdata);
return rc;
}
static int
SHA1_hmac(const u_char * data, size_t len, u_char * mac, size_t maclen,
const u_char * secret, size_t secretlen)
{
#define SHA1_HASHKEYLEN 64
#define SHA1_SECRETKEYLEN 20
SHA_CTX csha1;
u_char K1[SHA1_HASHKEYLEN];
u_char K2[SHA1_HASHKEYLEN];
u_char extendedAuthKey[SHA1_HASHKEYLEN];
u_char buf[SHA1_HASHKEYLEN];
size_t i;
const u_char *cp;
u_char *newdata = NULL;
int rc = 0;
DEBUGTRACE;
/*
* memset(K1,0,SHA1_HASHKEYLEN);
* memset(K2,0,SHA1_HASHKEYLEN);
* memset(buf,0,SHA1_HASHKEYLEN);
* memset(extendedAuthKey,0,SHA1_HASHKEYLEN);
*/
if (secretlen != SHA1_SECRETKEYLEN || secret == NULL ||
mac == NULL || data == NULL ||
len <= 0 || maclen <= 0) {
/*
* DEBUGMSGTL(("sha1","SHA1 signing not properly initialized"));
*/
return -1;
}
memset(extendedAuthKey, 0, SHA1_HASHKEYLEN);
memcpy(extendedAuthKey, secret, secretlen);
for (i = 0; i < SHA1_HASHKEYLEN; i++) {
K1[i] = extendedAuthKey[i] ^ 0x36;
K2[i] = extendedAuthKey[i] ^ 0x5c;
}
SHA1_Init(&csha1);
rc = !SHA1_Update(&csha1, K1, SHA1_HASHKEYLEN);
if (rc)
goto update_end;
i = len;
if (((uintptr_t) data) % sizeof(long) != 0) {
/*
* this relies on the ability to use integer math and thus we
* must rely on data that aligns on 32-bit-word-boundries
*/
newdata = netsnmp_memdup(data, len);
cp = newdata;
} else {
cp = data;
}
while (i >= 64) {
rc = !SHA1_Update(&csha1, cp, 64);
if (rc)
goto update_end;
cp += 64;
i -= 64;
}
rc = !SHA1_Update(&csha1, cp, i);
if (rc)
goto update_end;
memset(buf, 0, SHA1_HASHKEYLEN);
SHA1_Final(buf, &csha1);
SHA1_Init(&csha1);
rc = !SHA1_Update(&csha1, K2, SHA1_HASHKEYLEN);
if (rc)
goto update_end;
rc = !SHA1_Update(&csha1, buf, SHA1_SECRETKEYLEN);
if (rc)
goto update_end;
/*
* copy the sign checksum to the outgoing pointer
*/
SHA1_Final(buf, &csha1);
memcpy(mac, buf, maclen);
update_end:
memset(buf, 0, SHA1_HASHKEYLEN);
memset(K1, 0, SHA1_HASHKEYLEN);
memset(K2, 0, SHA1_HASHKEYLEN);
memset(extendedAuthKey, 0, SHA1_HASHKEYLEN);
memset(&csha1, 0, sizeof(csha1));
if (newdata)
free(newdata);
return rc;
}
#endif /* NETSNMP_USE_INTERNAL_CRYPTO */
#endif /* NETSNMP_FEATURE_REMOVE_USM_SCAPI */