From 0ddb0fd48fdd008f627b688926618c680916f1cc Mon Sep 17 00:00:00 2001 From: Luis Ontanon Date: Wed, 10 Jan 2007 01:15:18 +0000 Subject: * sha1 authentication - remove warnings and test code svn path=/trunk/; revision=20366 --- asn1/snmp/packet-snmp-template.c | 121 +++++++++++++++++++++++++-------------- asn1/snmp/packet-snmp-template.h | 12 ++-- asn1/snmp/snmp.cnf | 15 +++-- 3 files changed, 94 insertions(+), 54 deletions(-) (limited to 'asn1') diff --git a/asn1/snmp/packet-snmp-template.c b/asn1/snmp/packet-snmp-template.c index 09b416f55f..ca89d1d1e0 100644 --- a/asn1/snmp/packet-snmp-template.c +++ b/asn1/snmp/packet-snmp-template.c @@ -95,12 +95,15 @@ #include "packet-snmp.h" #include "format-oid.h" -#include +#include #include -#include #include #include +#ifdef _WIN32 +#include +#endif /* _WIN32 */ + #ifdef HAVE_LIBGCRYPT #include #endif @@ -850,7 +853,7 @@ snmp_variable_decode(tvbuff_t *tvb, proto_tree *snmp_tree, packet_info *pinfo,tv switch (vb_type) { case SNMP_INTEGER: - offset = dissect_ber_integer(FALSE, pinfo, NULL, tvb, start, -1, &(vb_integer_value)); + offset = dissect_ber_integer(FALSE, pinfo, NULL, tvb, start, -1, (void*)&(vb_integer_value)); length = offset - vb_value_start; if (snmp_tree) { #ifdef HAVE_NET_SNMP @@ -1048,6 +1051,11 @@ snmp_variable_decode(tvbuff_t *tvb, proto_tree *snmp_tree, packet_info *pinfo,tv return; } + + + + + static snmp_ue_assoc_t* get_user_assoc(tvbuff_t* engine_tvb, tvbuff_t* user_tvb) { static snmp_ue_assoc_t* a; guint given_username_len; @@ -1095,7 +1103,7 @@ static snmp_ue_assoc_t* get_user_assoc(tvbuff_t* engine_tvb, tvbuff_t* user_tvb) #define D(p) #endif -gboolean snmp_usm_auth_md5(snmp_usm_params_t* p, gchar** error) { +gboolean snmp_usm_auth_md5(snmp_usm_params_t* p, gchar const** error) { guint msg_len; guint8* msg; guint auth_len; @@ -1148,12 +1156,59 @@ gboolean snmp_usm_auth_md5(snmp_usm_params_t* p, gchar** error) { } -gboolean snmp_usm_auth_sha1(snmp_usm_params_t* p _U_, gchar** error _U_) { - *error = "SHA1 authentication Not Yet Implemented"; - return FALSE; +gboolean snmp_usm_auth_sha1(snmp_usm_params_t* p _U_, gchar const** error _U_) { + guint msg_len; + guint8* msg; + guint auth_len; + guint8* auth; + guint8* key; + guint key_len; + guint8 calc_auth[20]; + guint start; + guint end; + guint i; + + if (!p->auth_tvb) { + *error = "No Authenticator"; + return FALSE; + } + + key = p->user_assoc->user.authKey.data; + key_len = p->user_assoc->user.authKey.len; + + if (! key ) { + *error = "User has no authKey"; + return FALSE; + } + + + auth_len = tvb_length_remaining(p->auth_tvb,0); + + + if (auth_len != 12) { + *error = "Authenticator length wrong"; + return FALSE; + } + + msg_len = tvb_length_remaining(p->msg_tvb,0); + msg = ep_tvb_memdup(p->msg_tvb,0,msg_len); + + auth = ep_tvb_memdup(p->auth_tvb,0,auth_len); + + start = p->auth_offset - p->start_offset; + end = start + auth_len; + + /* fill the authenticator with zeros */ + for ( i = start ; i < end ; i++ ) { + msg[i] = '\0'; + } + + sha1_hmac(key, key_len, msg, msg_len, calc_auth); + + return ( memcmp(auth,calc_auth,12) != 0 ) ? FALSE : TRUE; } -tvbuff_t* snmp_usm_priv_des(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U_, gchar** error _U_) { +tvbuff_t* snmp_usm_priv_des(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U_, gchar const** error _U_) { #ifdef HAVE_LIBGCRYPT gcry_error_t err; gcry_cipher_hd_t hd = NULL; @@ -1166,12 +1221,11 @@ tvbuff_t* snmp_usm_priv_des(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U gint cryptgrm_len; guint8* cryptgrm; tvbuff_t* clear_tvb; - guint8 iv[8];; + guint8 iv[8]; guint i; salt_len = tvb_length_remaining(p->priv_tvb,0); - D(("salt_len=%d\n",salt_len)); if (salt_len != 8) { *error = "msgPrivacyParameters lenght != 8"; @@ -1180,21 +1234,14 @@ tvbuff_t* snmp_usm_priv_des(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U salt = ep_tvb_memdup(p->priv_tvb,0,salt_len); - DUMP_DATA("salt",salt,salt_len); - DUMP_DATA("pre_iv",iv,8); - /* The resulting "salt" is XOR-ed with the pre-IV to obtain the IV. */ for (i=0; i<8; i++) { iv[i] = pre_iv[i] ^ salt[i]; } - - DUMP_DATA("iv",iv,8); - DUMP_DATA("des_key",des_key,8); cryptgrm_len = tvb_length_remaining(encryptedData,0); - D(("cryptgrm_len=%d\n",cryptgrm_len)); if (cryptgrm_len % 8) { *error = "the length of the encrypted data is noty a mutiple of 8"; @@ -1202,7 +1249,6 @@ tvbuff_t* snmp_usm_priv_des(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U } cryptgrm = ep_tvb_memdup(encryptedData,0,-1); - DUMP_DATA("cryptgrm",cryptgrm,cryptgrm_len); cleartext = ep_alloc(cryptgrm_len); @@ -1220,20 +1266,6 @@ tvbuff_t* snmp_usm_priv_des(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U gcry_cipher_close(hd); - DUMP_DATA("cleartext",cryptgrm,cryptgrm_len); - - /* - ??? - The first ciphertext block is decrypted, the decryption output is - XOR-ed with the Initialization Vector, and the result is the first - plaintext block. - - For each subsequent block, the ciphertext block is decrypted, the - decryption output is XOR-ed with the previous ciphertext block and - the result is the plaintext block. - */ - - clear_tvb = tvb_new_real_data(cleartext, cryptgrm_len, cryptgrm_len); return clear_tvb; @@ -1248,7 +1280,7 @@ on_gcry_error: #endif } -tvbuff_t* snmp_usm_priv_aes(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U_, gchar** error _U_) { +tvbuff_t* snmp_usm_priv_aes(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U_, gchar const** error _U_) { #ifdef HAVE_LIBGCRYPT *error = "AES decryption Not Yet Implemented"; return NULL; @@ -1258,6 +1290,11 @@ tvbuff_t* snmp_usm_priv_aes(snmp_usm_params_t* p _U_, tvbuff_t* encryptedData _U #endif } + + + + + #include "packet-snmp-fn.c" @@ -1578,8 +1615,6 @@ void snmp_usm_password_to_key_md5( /* SHA1 Password to Key Algorithm COPIED from RFC 3414 A.2.2 */ -#define SHAUpdate(c,b,l) sha1_loop((c),(b),(l)) -#define SHAFinal(d,c) sha1_result((c),(d)) void snmp_usm_password_to_key_sha1( guint8 *password, /* IN */ @@ -1588,12 +1623,12 @@ void snmp_usm_password_to_key_sha1( guint engineLength,/* IN - length of snmpEngineID */ guint8 *key) /* OUT - pointer to caller 20-octet buffer */ { - SHA1_CONTEXT SH; + sha1_context SH; guint8 *cp, password_buf[72]; guint32 password_index = 0; guint32 count = 0, i; - sha1_init (&SH); /* initialize SHA */ + sha1_starts(&SH); /* initialize SHA */ /**********************************************/ /* Use while loop until we've done 1 Megabyte */ @@ -1607,10 +1642,10 @@ void snmp_usm_password_to_key_sha1( /*************************************************/ *cp++ = password[password_index++ % passwordlen]; } - SHAUpdate (&SH, password_buf, 64); + sha1_update (&SH, password_buf, 64); count += 64; } - SHAFinal (key, &SH); /* tell SHA we're done */ + sha1_finish(&SH, key); /*****************************************************/ /* Now localize the key with the engineID and pass */ @@ -1622,9 +1657,9 @@ void snmp_usm_password_to_key_sha1( memcpy(password_buf+20, engineID, engineLength); memcpy(password_buf+20+engineLength, key, 20); - sha1_init(&SH); - SHAUpdate(&SH, password_buf, 40+engineLength); - SHAFinal(key, &SH); + sha1_starts(&SH); + sha1_update(&SH, password_buf, 40+engineLength); + sha1_finish(&SH, key); return; } @@ -1793,7 +1828,7 @@ void proto_register_snmp(void) { { "Authentication OK", "snmp.v3.authOK", FT_BOOLEAN, 8, TFS(&auth_flags), 0, "", HFILL }}, { &hf_snmp_decryptedPDU, { - "Decrypted PDU", "snmp.decryptedPdu", FT_BYTES, BASE_HEX, + "Decrypted ScopedPDU", "snmp.decrypted_pdu", FT_BYTES, BASE_HEX, NULL, 0, "Decrypted PDU", HFILL }}, #include "packet-snmp-hfarr.c" diff --git a/asn1/snmp/packet-snmp-template.h b/asn1/snmp/packet-snmp-template.h index 5c99f70d8e..3a833b84fe 100644 --- a/asn1/snmp/packet-snmp-template.h +++ b/asn1/snmp/packet-snmp-template.h @@ -33,8 +33,8 @@ typedef struct _snmp_usm_key { typedef struct _snmp_ue_assoc_t snmp_ue_assoc_t; typedef struct _snmp_usm_params_t snmp_usm_params_t; -typedef gboolean (*snmp_usm_authenticator_t)(snmp_usm_params_t*, gchar** error); -typedef tvbuff_t* (*snmp_usm_decoder_t)(snmp_usm_params_t*, tvbuff_t* encryptedData, gchar** error); +typedef gboolean (*snmp_usm_authenticator_t)(snmp_usm_params_t*, gchar const** error); +typedef tvbuff_t* (*snmp_usm_decoder_t)(snmp_usm_params_t*, tvbuff_t* encryptedData, gchar const** error); typedef void (*snmp_usm_password_to_key_t)(guint8 *password, guint passwordlen, guint8 *engineID, guint engineLength, guint8 *key); typedef struct _snmp_usm_auth_model_t { @@ -89,12 +89,12 @@ extern guint dissect_snmp_pdu(tvbuff_t *, int, packet_info *, proto_tree *tree, extern int dissect_snmp_engineid(proto_tree *, tvbuff_t *, int, int); /* SNMPv3 USM authentication functions */ -gboolean snmp_usm_auth_md5(snmp_usm_params_t* p, gchar**); -gboolean snmp_usm_auth_sha1(snmp_usm_params_t* p, gchar**); +gboolean snmp_usm_auth_md5(snmp_usm_params_t* p, gchar const**); +gboolean snmp_usm_auth_sha1(snmp_usm_params_t* p, gchar const**); /* SNMPv3 USM privacy functions */ -tvbuff_t* snmp_usm_priv_des(snmp_usm_params_t*, tvbuff_t*, gchar**); -tvbuff_t* snmp_usm_priv_aes(snmp_usm_params_t*, tvbuff_t*, gchar**); +tvbuff_t* snmp_usm_priv_des(snmp_usm_params_t*, tvbuff_t*, gchar const**); +tvbuff_t* snmp_usm_priv_aes(snmp_usm_params_t*, tvbuff_t*, gchar const**); void snmp_usm_password_to_key_md5(guint8 *password, guint passwordlen, guint8 *engineID, guint engineLength, guint8 *key); diff --git a/asn1/snmp/snmp.cnf b/asn1/snmp/snmp.cnf index 9af11329e7..2f7dce769b 100644 --- a/asn1/snmp/snmp.cnf +++ b/asn1/snmp/snmp.cnf @@ -202,7 +202,7 @@ gint pdu_type; if( usm_p.encrypted && crypt_tvb && usm_p.user_assoc && usm_p.user_assoc->user.privProtocol ) { - gchar* error = NULL; + const gchar* error = NULL; tvbuff_t* cleartext_tvb = usm_p.user_assoc->user.privProtocol(&usm_p, crypt_tvb, @@ -212,10 +212,16 @@ gint pdu_type; proto_item* item = get_ber_last_created_item(); expert_add_info_format( pinfo, item, PI_UNDECODED, PI_WARN, "Failed to decrypt encryptedPDU: %%s", error ); } else { - proto_tree* decrypted_tree = proto_item_add_subtree(get_ber_last_created_item(),ett_decrypted); - + proto_tree* encryptedpdu_tree; + proto_item* decrypted_item; + proto_tree* decrypted_tree; + add_new_data_source(pinfo, cleartext_tvb, "Decrypted ScopedPDU"); tvb_set_child_real_data_tvbuff(tvb, cleartext_tvb); + + encryptedpdu_tree = proto_item_add_subtree(get_ber_last_created_item(),ett_encryptedPDU); + decrypted_item = proto_tree_add_item(encryptedpdu_tree, hf_snmp_decryptedPDU,cleartext_tvb,0,-1,FALSE); + decrypted_tree = proto_item_add_subtree(decrypted_item,ett_decrypted); dissect_snmp_ScopedPDU(FALSE, cleartext_tvb, 0, pinfo, decrypted_tree, -1); } @@ -223,7 +229,6 @@ gint pdu_type; #.FN_BODY SNMPv3Message/msgSecurityParameters -// printf(">msgSecurityParameters\n"); switch(MsgSecurityModel){ case SNMP_SEC_USM: /* 3 */ offset = dissect_snmp_UsmSecurityParameters(FALSE, tvb, offset+2, pinfo, tree, -1); @@ -242,7 +247,7 @@ gint pdu_type; if( usm_p.authenticated && usm_p.user_assoc && usm_p.user_assoc->user.authModel ) { - gchar* error = NULL; + const gchar* error = NULL; proto_item* authen_item; proto_tree* authen_tree = proto_item_add_subtree(usm_p.auth_item,ett_authParameters); -- cgit v1.2.3