47 #define LOGSYS_UTILS_ONLY 1 72 #ifndef AES_256_KEY_LENGTH 73 #define AES_256_KEY_LENGTH 32 76 #ifndef AES_192_KEY_LENGTH 77 #define AES_192_KEY_LENGTH 24 80 #ifndef AES_128_KEY_LENGTH 81 #define AES_128_KEY_LENGTH 16 176 unsigned char private_key[1024];
186 void (*log_printf_func) (
189 const char *
function,
201 #define log_printf(level, format, args...) \ 203 instance->log_printf_func ( \ 204 level, instance->log_subsys_id, \ 205 __FUNCTION__, __FILE__, __LINE__, \ 206 (const char *)format, ##args); \ 213 static int string_to_crypto_cipher_type(
const char* crypto_cipher_type)
215 if (strcmp(crypto_cipher_type,
"none") == 0) {
217 }
else if (strcmp(crypto_cipher_type,
"aes256") == 0) {
219 }
else if (strcmp(crypto_cipher_type,
"aes192") == 0) {
221 }
else if (strcmp(crypto_cipher_type,
"aes128") == 0) {
223 }
else if (strcmp(crypto_cipher_type,
"3des") == 0) {
231 PK11SlotInfo* crypt_slot = NULL;
238 crypt_param.type = siBuffer;
243 if (crypt_slot == NULL) {
249 instance->
nss_sym_key = PK11_ImportSymKey(crypt_slot,
251 PK11_OriginUnwrap, CKA_ENCRYPT|CKA_DECRYPT,
259 PK11_FreeSlot(crypt_slot);
264 static int encrypt_nss(
266 const unsigned char *buf_in,
267 const size_t buf_in_len,
268 unsigned char *buf_out,
271 PK11Context* crypt_context = NULL;
273 SECItem *nss_sec_param = NULL;
275 unsigned int tmp2_outlen = 0;
276 unsigned char *salt = buf_out;
277 unsigned char *data = buf_out +
SALT_SIZE;
281 memcpy(buf_out, buf_in, buf_in_len);
282 *buf_out_len = buf_in_len;
286 if (PK11_GenerateRandom (salt, SALT_SIZE) != SECSuccess) {
288 "Failure to generate a random number %d",
293 crypt_param.type = siBuffer;
294 crypt_param.data = salt;
299 if (nss_sec_param == NULL) {
301 "Failure to set up PKCS11 param (err %d)",
309 crypt_context = PK11_CreateContextBySymKey (cipher_to_nss[instance->
crypto_cipher_type],
313 if (!crypt_context) {
315 "PK11_CreateContext failed (encrypt) crypt_type=%d (err %d)",
321 if (PK11_CipherOp(crypt_context, data,
324 (
unsigned char *)buf_in, buf_in_len) != SECSuccess) {
326 "PK11_CipherOp failed (encrypt) crypt_type=%d (err %d)",
332 if (PK11_DigestFinal(crypt_context, data + tmp1_outlen,
335 "PK11_DigestFinal failed (encrypt) crypt_type=%d (err %d)",
342 *buf_out_len = tmp1_outlen + tmp2_outlen +
SALT_SIZE;
348 PK11_DestroyContext(crypt_context, PR_TRUE);
351 SECITEM_FreeItem(nss_sec_param, PR_TRUE);
356 static int decrypt_nss (
361 PK11Context* decrypt_context = NULL;
362 SECItem decrypt_param;
364 unsigned int tmp2_outlen = 0;
365 unsigned char *salt = buf;
377 decrypt_param.type = siBuffer;
378 decrypt_param.data = salt;
381 decrypt_context = PK11_CreateContextBySymKey(cipher_to_nss[instance->
crypto_cipher_type],
384 if (!decrypt_context) {
386 "PK11_CreateContext (decrypt) failed (err %d)",
391 if (PK11_CipherOp(decrypt_context, outbuf, &tmp1_outlen,
392 sizeof(outbuf), data, datalen) != SECSuccess) {
394 "PK11_CipherOp (decrypt) failed (err %d)",
399 if (PK11_DigestFinal(decrypt_context, outbuf + tmp1_outlen, &tmp2_outlen,
400 sizeof(outbuf) - tmp1_outlen) != SECSuccess) {
402 "PK11_DigestFinal (decrypt) failed (err %d)",
407 outbuf_len = tmp1_outlen + tmp2_outlen;
409 memset(buf, 0, *buf_len);
410 memcpy(buf, outbuf, outbuf_len);
412 *buf_len = outbuf_len;
417 if (decrypt_context) {
418 PK11_DestroyContext(decrypt_context, PR_TRUE);
429 static int string_to_crypto_hash_type(
const char* crypto_hash_type)
431 if (strcmp(crypto_hash_type,
"none") == 0) {
433 }
else if (strcmp(crypto_hash_type,
"md5") == 0) {
435 }
else if (strcmp(crypto_hash_type,
"sha1") == 0) {
437 }
else if (strcmp(crypto_hash_type,
"sha256") == 0) {
439 }
else if (strcmp(crypto_hash_type,
"sha384") == 0) {
441 }
else if (strcmp(crypto_hash_type,
"sha512") == 0) {
450 PK11SlotInfo* hash_slot = NULL;
457 hash_param.type = siBuffer;
461 hash_slot = PK11_GetBestSlot(hash_to_nss[instance->
crypto_hash_type], NULL);
462 if (hash_slot == NULL) {
470 PK11_OriginUnwrap, CKA_SIGN,
478 PK11_FreeSlot(hash_slot);
483 static int calculate_nss_hash(
485 const unsigned char *buf,
486 const size_t buf_len,
489 PK11Context* hash_context = NULL;
491 unsigned int hash_tmp_outlen = 0;
496 hash_param.type = siBuffer;
500 hash_context = PK11_CreateContextBySymKey(hash_to_nss[instance->
crypto_hash_type],
507 "PK11_CreateContext failed (hash) hash_type=%d (err %d)",
513 if (PK11_DigestBegin(hash_context) != SECSuccess) {
515 "PK11_DigestBegin failed (hash) hash_type=%d (err %d)",
521 if (PK11_DigestOp(hash_context,
523 buf_len) != SECSuccess) {
525 "PK11_DigestOp failed (hash) hash_type=%d (err %d)",
531 if (PK11_DigestFinal(hash_context,
536 "PK11_DigestFinale failed (hash) hash_type=%d (err %d)",
547 PK11_DestroyContext(hash_context, PR_TRUE);
564 if (NSS_NoDB_Init(
".") != SECSuccess) {
574 const char *crypto_cipher_type,
575 const char *crypto_hash_type)
578 "Initializing transmit/receive security (NSS) crypto: %s hash: %s",
579 crypto_cipher_type, crypto_hash_type);
581 if (init_nss_db(instance) < 0) {
585 if (init_nss_crypto(instance) < 0) {
589 if (init_nss_hash(instance) < 0) {
596 static int encrypt_and_sign_nss_2_3 (
598 const unsigned char *buf_in,
599 const size_t buf_in_len,
600 unsigned char *buf_out,
603 if (encrypt_nss(instance,
612 if (calculate_nss_hash(instance, buf_out, *buf_out_len, buf_out + *buf_out_len) < 0) {
621 static int authenticate_nss_2_3 (
635 if (calculate_nss_hash(instance, buf, datalen, tmp_hash) < 0) {
639 if (memcmp(tmp_hash, buf + datalen, hash_len[instance->
crypto_hash_type]) != 0) {
649 static int decrypt_nss_2_3 (
668 const char *crypto_cipher_type,
669 const char *crypto_hash_type)
671 int crypto_cipher = string_to_crypto_cipher_type(crypto_cipher_type);
672 int crypto_hash = string_to_crypto_hash_type(crypto_hash_type);
679 hdr_size += hash_len[crypto_hash];
684 if (cypher_block_len[crypto_cipher]) {
685 block_size = cypher_block_len[crypto_cipher];
687 block_size = PK11_GetBlockSize(crypto_cipher, NULL);
688 if (block_size < 0) {
696 hdr_size += (block_size * 2);
725 const unsigned char *buf_in,
726 const size_t buf_in_len,
727 unsigned char *buf_out,
738 err = encrypt_and_sign_nss_2_3(instance,
740 buf_out, buf_out_len);
759 "Incoming packet has different crypto type. Rejecting");
765 "Incoming packet has different hash type. Rejecting");
773 if (authenticate_nss_2_3(instance, buf, buf_len) != 0) {
783 "Incoming packet appears to have features not supported by this version of corosync. Rejecting");
790 if (decrypt_nss_2_3(instance, buf, buf_len) != 0) {
804 const unsigned char *private_key,
805 unsigned int private_key_len,
806 const char *crypto_cipher_type,
807 const char *crypto_hash_type,
811 const char *
function,
822 instance = malloc(
sizeof(*instance));
823 if (instance == NULL) {
828 memcpy(instance->
private_key, private_key, private_key_len);
842 if (init_nss(instance, crypto_cipher_type, crypto_hash_type) < 0) {
unsigned char private_key[1024]
unsigned int crypto_header_size
size_t crypto_sec_header_size(const char *crypto_cipher_type, const char *crypto_hash_type)
size_t crypto_get_current_sec_header_size(const struct crypto_instance *instance)
#define log_printf(level, format, args...)
PK11SymKey * nss_sym_key_sign
enum crypto_crypt_t crypto_cipher_type
#define AES_256_KEY_LENGTH
struct crypto_instance * crypto_init(const unsigned char *private_key, unsigned int private_key_len, const char *crypto_cipher_type, const char *crypto_hash_type, void(*log_printf_func)(int level, int subsys, const char *function, const char *file, int line, const char *format,...) __attribute__((format(printf, 6, 7))), int log_level_security, int log_level_notice, int log_level_error, int log_subsys_id)
void(*) in log_level_security)
#define AES_192_KEY_LENGTH
int crypto_encrypt_and_sign(struct crypto_instance *instance, const unsigned char *buf_in, const size_t buf_in_len, unsigned char *buf_out, size_t *buf_out_len)
enum crypto_crypt_t __attribute__
unsigned int private_key_len
int crypto_authenticate_and_decrypt(struct crypto_instance *instance, unsigned char *buf, int *buf_len)
enum crypto_hash_t crypto_hash_type
#define AES_128_KEY_LENGTH
void(* log_printf_func)(int level, int subsys, const char *function, const char *file, int line, const char *format,...) __attribute__((format(printf
CK_MECHANISM_TYPE cipher_to_nss[]
size_t cypher_block_len[]
CK_MECHANISM_TYPE hash_to_nss[]