You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
117 lines
4.3 KiB
117 lines
4.3 KiB
7 years ago
|
874440 - net-snmp does not work in FIPS mode
|
||
|
|
|
||
|
|
Three upstream commits are here:
|
||
|
|
|
||
|
|
commit dde3a35baaeb683cf1441a16a15441f8b456c520
|
||
|
|
Author: Jan Safranek <jsafranek@users.sourceforge.net>
|
||
|
|
Date: Mon Nov 12 15:45:27 2012 +0100
|
||
|
|
|
||
|
|
CHANGES: snmplib: Fixed crash when MD5 hash is not supported by OpenSSL.
|
||
|
|
|
||
|
|
commit dd53ffbafeb31cde616a89949e70e3d5fe0cc1b3
|
||
|
|
Author: Jan Safranek <jsafranek@users.sourceforge.net>
|
||
|
|
Date: Mon Nov 12 15:46:43 2012 +0100
|
||
|
|
|
||
|
|
Fall back to SHA-1 if MD5 is not available.
|
||
|
|
On paranoid systems where MD5 is disabled use SHA-1 instead of MD5 and don't crash.
|
||
|
|
|
||
|
|
commit 743cb66718904979f55895472501584c30c66f10
|
||
|
|
Author: Jan Safranek <jsafranek@users.sourceforge.net>
|
||
|
|
Date: Mon Nov 12 15:49:15 2012 +0100
|
||
|
|
|
||
|
|
Fixed crash when MD5 and/or SHA-1 hash is not supported by OpenSSL.
|
||
|
|
|
||
|
|
diff -up net-snmp-5.7.2/snmplib/keytools.c.fips net-snmp-5.7.2/snmplib/keytools.c
|
||
|
|
--- net-snmp-5.7.2/snmplib/keytools.c.fips 2012-11-12 13:36:17.868635391 +0100
|
||
|
|
+++ net-snmp-5.7.2/snmplib/keytools.c 2012-11-12 14:24:23.031293984 +0100
|
||
|
|
@@ -156,27 +156,36 @@ generate_Ku(const oid * hashtype, u_int
|
||
|
|
EVP_MD_CTX_init(ctx);
|
||
|
|
#endif
|
||
|
|
#ifndef NETSNMP_DISABLE_MD5
|
||
|
|
- if (ISTRANSFORM(hashtype, HMACMD5Auth))
|
||
|
|
- EVP_DigestInit(ctx, EVP_md5());
|
||
|
|
- else
|
||
|
|
+ if (ISTRANSFORM(hashtype, HMACMD5Auth)) {
|
||
|
|
+ if (!EVP_DigestInit(ctx, EVP_md5()))
|
||
|
|
+ /* MD5 not supported */
|
||
|
|
+ return SNMPERR_GENERR;
|
||
|
|
+ } else
|
||
|
|
#endif
|
||
|
|
- if (ISTRANSFORM(hashtype, HMACSHA1Auth))
|
||
|
|
- EVP_DigestInit(ctx, EVP_sha1());
|
||
|
|
- else
|
||
|
|
- QUITFUN(SNMPERR_GENERR, generate_Ku_quit);
|
||
|
|
+ if (ISTRANSFORM(hashtype, HMACSHA1Auth)) {
|
||
|
|
+ if (!EVP_DigestInit(ctx, EVP_sha1()))
|
||
|
|
+ /* SHA1 not supported */
|
||
|
|
+ return SNMPERR_GENERR;
|
||
|
|
+ } else {
|
||
|
|
+ QUITFUN(SNMPERR_GENERR, generate_Ku_quit);
|
||
|
|
+ }
|
||
|
|
#elif NETSNMP_USE_INTERNAL_CRYPTO
|
||
|
|
#ifndef NETSNMP_DISABLE_MD5
|
||
|
|
if (ISTRANSFORM(hashtype, HMACMD5Auth)) {
|
||
|
|
- MD5_Init(&cmd5);
|
||
|
|
+ if (!MD5_Init(&cmd5))
|
||
|
|
+ /* MD5 not supported */
|
||
|
|
+ return SNMPERR_GENERR;
|
||
|
|
cryptotype = TYPE_MD5;
|
||
|
|
} else
|
||
|
|
#endif
|
||
|
|
- if (ISTRANSFORM(hashtype, HMACSHA1Auth)) {
|
||
|
|
- SHA1_Init(&csha1);
|
||
|
|
- cryptotype = TYPE_SHA1;
|
||
|
|
- } else {
|
||
|
|
- return (SNMPERR_GENERR);
|
||
|
|
- }
|
||
|
|
+ if (ISTRANSFORM(hashtype, HMACSHA1Auth)) {
|
||
|
|
+ if (!SHA1_Init(&csha1))
|
||
|
|
+ /* SHA1 not supported */
|
||
|
|
+ return SNMPERR_GENERR;
|
||
|
|
+ cryptotype = TYPE_SHA1;
|
||
|
|
+ } else {
|
||
|
|
+ return (SNMPERR_GENERR);
|
||
|
|
+ }
|
||
|
|
#else
|
||
|
|
MDbegin(&MD);
|
||
|
|
#endif /* NETSNMP_USE_OPENSSL */
|
||
|
|
diff -up net-snmp-5.7.2/snmplib/lcd_time.c.fips net-snmp-5.7.2/snmplib/lcd_time.c
|
||
|
|
--- net-snmp-5.7.2/snmplib/lcd_time.c.fips 2012-10-10 00:28:58.000000000 +0200
|
||
|
|
+++ net-snmp-5.7.2/snmplib/lcd_time.c 2012-11-12 13:36:11.326657629 +0100
|
||
|
|
@@ -505,6 +505,12 @@ hash_engineID(const u_char * engineID, u
|
||
|
|
rval = sc_hash(usmHMACMD5AuthProtocol,
|
||
|
|
sizeof(usmHMACMD5AuthProtocol) / sizeof(oid),
|
||
|
|
engineID, engineID_len, buf, &buf_len);
|
||
|
|
+ if (rval == SNMPERR_SC_NOT_CONFIGURED) {
|
||
|
|
+ /* fall back to sha1 */
|
||
|
|
+ rval = sc_hash(usmHMACSHA1AuthProtocol,
|
||
|
|
+ sizeof(usmHMACSHA1AuthProtocol) / sizeof(oid),
|
||
|
|
+ engineID, engineID_len, buf, &buf_len);
|
||
|
|
+ }
|
||
|
|
#else
|
||
|
|
rval = sc_hash(usmHMACSHA1AuthProtocol,
|
||
|
|
sizeof(usmHMACSHA1AuthProtocol) / sizeof(oid),
|
||
|
|
diff -up net-snmp-5.7.2/snmplib/scapi.c.fips net-snmp-5.7.2/snmplib/scapi.c
|
||
|
|
--- net-snmp-5.7.2/snmplib/scapi.c.fips 2012-10-10 00:28:58.000000000 +0200
|
||
|
|
+++ net-snmp-5.7.2/snmplib/scapi.c 2012-11-12 13:36:11.327657627 +0100
|
||
|
|
@@ -438,6 +438,7 @@ sc_generate_keyed_hash(const oid * autht
|
||
|
|
* Returns:
|
||
|
|
* SNMPERR_SUCCESS Success.
|
||
|
|
* SNMP_SC_GENERAL_FAILURE Any error.
|
||
|
|
+ * SNMPERR_SC_NOT_CONFIGURED Hash type not supported.
|
||
|
|
*/
|
||
|
|
int
|
||
|
|
sc_hash(const oid * hashtype, size_t hashtypelen, const u_char * buf,
|
||
|
|
@@ -495,7 +496,10 @@ sc_hash(const oid * hashtype, size_t has
|
||
|
|
EVP_MD_CTX_init(cptr);
|
||
|
|
#endif
|
||
|
|
#endif
|
||
|
|
- EVP_DigestInit(cptr, hashfn);
|
||
|
|
+ if (!EVP_DigestInit(cptr, hashfn)) {
|
||
|
|
+ /* requested hash function is not available */
|
||
|
|
+ return SNMPERR_SC_NOT_CONFIGURED;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
/** pass the data */
|
||
|
|
EVP_DigestUpdate(cptr, buf, buf_len);
|