47 #define LOGSYS_UTILS_ONLY 1 72 #ifndef AES_256_KEY_LENGTH 73 #define AES_256_KEY_LENGTH 32 76 #ifndef AES_192_KEY_LENGTH 77 #define AES_192_KEY_LENGTH 24 80 #ifndef AES_128_KEY_LENGTH 81 #define AES_128_KEY_LENGTH 16 176 unsigned char private_key[1024];
186 void (*log_printf_func) (
189 const char *
function,
201 #define log_printf(level, format, args...) \ 203 instance->log_printf_func ( \ 204 level, instance->log_subsys_id, \ 205 __FUNCTION__, __FILE__, __LINE__, \ 206 (const char *)format, ##args); \ 214 #define MAX_WRAPPED_KEY_LEN 128 220 static int string_to_crypto_cipher_type(
const char* crypto_cipher_type)
222 if (strcmp(crypto_cipher_type,
"none") == 0) {
224 }
else if (strcmp(crypto_cipher_type,
"aes256") == 0) {
226 }
else if (strcmp(crypto_cipher_type,
"aes192") == 0) {
228 }
else if (strcmp(crypto_cipher_type,
"aes128") == 0) {
230 }
else if (strcmp(crypto_cipher_type,
"3des") == 0) {
241 CK_MECHANISM_TYPE cipher;
243 CK_MECHANISM_TYPE wrap_mechanism;
245 PK11SymKey *wrap_key;
246 PK11Context *wrap_key_crypt_context;
247 SECItem tmp_sec_item;
253 memset(&key_item, 0,
sizeof(key_item));
257 wrap_key_crypt_context = NULL;
259 key_item.type = siBuffer;
267 operation = CKA_ENCRYPT|CKA_DECRYPT;
273 operation = CKA_SIGN;
282 if (!case_processed) {
287 slot = PK11_GetBestSlot(cipher, NULL);
290 PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
307 wrap_mechanism = PK11_GetBestWrapMechanism(slot);
308 wrap_key_len = PK11_GetBestKeyLength(slot, wrap_mechanism);
309 wrap_key = PK11_KeyGen(slot, wrap_mechanism, NULL, wrap_key_len, NULL);
310 if (wrap_key == NULL) {
312 PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
323 memset(&tmp_sec_item, 0,
sizeof(tmp_sec_item));
324 wrap_key_crypt_context = PK11_CreateContextBySymKey(wrap_mechanism, CKA_ENCRYPT,
325 wrap_key, &tmp_sec_item);
326 if (wrap_key_crypt_context == NULL) {
328 PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
332 wrapped_key_len = (int)
sizeof(wrapped_key_data);
334 if (PK11_CipherOp(wrap_key_crypt_context, wrapped_key_data, &wrapped_key_len,
335 sizeof(wrapped_key_data), key_item.data, key_item.len) != SECSuccess) {
337 PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
341 if (PK11_Finalize(wrap_key_crypt_context) != SECSuccess) {
343 PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
350 memset(&tmp_sec_item, 0,
sizeof(tmp_sec_item));
351 wrapped_key.data = wrapped_key_data;
352 wrapped_key.len = wrapped_key_len;
354 res_key = PK11_UnwrapSymKey(wrap_key, wrap_mechanism, &tmp_sec_item, &wrapped_key,
355 cipher, operation, key_item.len);
356 if (res_key == NULL) {
358 PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
363 if (wrap_key_crypt_context != NULL) {
364 PK11_DestroyContext(wrap_key_crypt_context, PR_TRUE);
367 if (wrap_key != NULL) {
368 PK11_FreeSymKey(wrap_key);
393 static int encrypt_nss(
395 const unsigned char *buf_in,
396 const size_t buf_in_len,
397 unsigned char *buf_out,
400 PK11Context* crypt_context = NULL;
402 SECItem *nss_sec_param = NULL;
404 unsigned int tmp2_outlen = 0;
405 unsigned char *salt = buf_out;
406 unsigned char *data = buf_out +
SALT_SIZE;
410 memcpy(buf_out, buf_in, buf_in_len);
411 *buf_out_len = buf_in_len;
415 if (PK11_GenerateRandom (salt, SALT_SIZE) != SECSuccess) {
417 "Failure to generate a random number %d",
422 crypt_param.type = siBuffer;
423 crypt_param.data = salt;
428 if (nss_sec_param == NULL) {
430 "Failure to set up PKCS11 param (err %d)",
438 crypt_context = PK11_CreateContextBySymKey (cipher_to_nss[instance->
crypto_cipher_type],
442 if (!crypt_context) {
444 "PK11_CreateContext failed (encrypt) crypt_type=%d (%d): %s",
446 PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
450 if (PK11_CipherOp(crypt_context, data,
453 (
unsigned char *)buf_in, buf_in_len) != SECSuccess) {
455 "PK11_CipherOp failed (encrypt) crypt_type=%d (err %d)",
461 if (PK11_DigestFinal(crypt_context, data + tmp1_outlen,
464 "PK11_DigestFinal failed (encrypt) crypt_type=%d (err %d)",
471 *buf_out_len = tmp1_outlen + tmp2_outlen +
SALT_SIZE;
477 PK11_DestroyContext(crypt_context, PR_TRUE);
480 SECITEM_FreeItem(nss_sec_param, PR_TRUE);
485 static int decrypt_nss (
490 PK11Context* decrypt_context = NULL;
491 SECItem decrypt_param;
493 unsigned int tmp2_outlen = 0;
494 unsigned char *salt = buf;
506 decrypt_param.type = siBuffer;
507 decrypt_param.data = salt;
510 decrypt_context = PK11_CreateContextBySymKey(cipher_to_nss[instance->
crypto_cipher_type],
513 if (!decrypt_context) {
515 "PK11_CreateContext (decrypt) failed (err %d)",
520 if (PK11_CipherOp(decrypt_context, outbuf, &tmp1_outlen,
521 sizeof(outbuf), data, datalen) != SECSuccess) {
523 "PK11_CipherOp (decrypt) failed (err %d)",
528 if (PK11_DigestFinal(decrypt_context, outbuf + tmp1_outlen, &tmp2_outlen,
529 sizeof(outbuf) - tmp1_outlen) != SECSuccess) {
531 "PK11_DigestFinal (decrypt) failed (err %d)",
536 outbuf_len = tmp1_outlen + tmp2_outlen;
538 memset(buf, 0, *buf_len);
539 memcpy(buf, outbuf, outbuf_len);
541 *buf_len = outbuf_len;
546 if (decrypt_context) {
547 PK11_DestroyContext(decrypt_context, PR_TRUE);
558 static int string_to_crypto_hash_type(
const char* crypto_hash_type)
560 if (strcmp(crypto_hash_type,
"none") == 0) {
562 }
else if (strcmp(crypto_hash_type,
"md5") == 0) {
564 }
else if (strcmp(crypto_hash_type,
"sha1") == 0) {
566 }
else if (strcmp(crypto_hash_type,
"sha256") == 0) {
568 }
else if (strcmp(crypto_hash_type,
"sha384") == 0) {
570 }
else if (strcmp(crypto_hash_type,
"sha512") == 0) {
592 static int calculate_nss_hash(
594 const unsigned char *buf,
595 const size_t buf_len,
598 PK11Context* hash_context = NULL;
600 unsigned int hash_tmp_outlen = 0;
605 hash_param.type = siBuffer;
609 hash_context = PK11_CreateContextBySymKey(hash_to_nss[instance->
crypto_hash_type],
616 "PK11_CreateContext failed (hash) hash_type=%d (err %d)",
622 if (PK11_DigestBegin(hash_context) != SECSuccess) {
624 "PK11_DigestBegin failed (hash) hash_type=%d (err %d)",
630 if (PK11_DigestOp(hash_context,
632 buf_len) != SECSuccess) {
634 "PK11_DigestOp failed (hash) hash_type=%d (err %d)",
640 if (PK11_DigestFinal(hash_context,
645 "PK11_DigestFinale failed (hash) hash_type=%d (err %d)",
656 PK11_DestroyContext(hash_context, PR_TRUE);
673 if (NSS_NoDB_Init(
".") != SECSuccess) {
683 const char *crypto_cipher_type,
684 const char *crypto_hash_type)
687 "Initializing transmit/receive security (NSS) crypto: %s hash: %s",
688 crypto_cipher_type, crypto_hash_type);
690 if (init_nss_db(instance) < 0) {
694 if (init_nss_crypto(instance) < 0) {
698 if (init_nss_hash(instance) < 0) {
705 static int encrypt_and_sign_nss_2_3 (
707 const unsigned char *buf_in,
708 const size_t buf_in_len,
709 unsigned char *buf_out,
712 if (encrypt_nss(instance,
721 if (calculate_nss_hash(instance, buf_out, *buf_out_len, buf_out + *buf_out_len) < 0) {
730 static int authenticate_nss_2_3 (
744 if (calculate_nss_hash(instance, buf, datalen, tmp_hash) < 0) {
748 if (memcmp(tmp_hash, buf + datalen, hash_len[instance->
crypto_hash_type]) != 0) {
758 static int decrypt_nss_2_3 (
777 const char *crypto_cipher_type,
778 const char *crypto_hash_type)
780 int crypto_cipher = string_to_crypto_cipher_type(crypto_cipher_type);
781 int crypto_hash = string_to_crypto_hash_type(crypto_hash_type);
788 hdr_size += hash_len[crypto_hash];
793 if (cypher_block_len[crypto_cipher]) {
794 block_size = cypher_block_len[crypto_cipher];
796 block_size = PK11_GetBlockSize(crypto_cipher, NULL);
797 if (block_size < 0) {
805 hdr_size += (block_size * 2);
834 const unsigned char *buf_in,
835 const size_t buf_in_len,
836 unsigned char *buf_out,
847 err = encrypt_and_sign_nss_2_3(instance,
849 buf_out, buf_out_len);
868 "Incoming packet has different crypto type. Rejecting");
874 "Incoming packet has different hash type. Rejecting");
882 if (authenticate_nss_2_3(instance, buf, buf_len) != 0) {
892 "Incoming packet appears to have features not supported by this version of corosync. Rejecting");
899 if (decrypt_nss_2_3(instance, buf, buf_len) != 0) {
913 const unsigned char *private_key,
914 unsigned int private_key_len,
915 const char *crypto_cipher_type,
916 const char *crypto_hash_type,
920 const char *
function,
931 instance = malloc(
sizeof(*instance));
932 if (instance == NULL) {
937 memcpy(instance->
private_key, private_key, private_key_len);
951 if (init_nss(instance, crypto_cipher_type, crypto_hash_type) < 0) {
unsigned char private_key[1024]
unsigned int crypto_header_size
size_t crypto_sec_header_size(const char *crypto_cipher_type, const char *crypto_hash_type)
size_t crypto_get_current_sec_header_size(const struct crypto_instance *instance)
#define log_printf(level, format, args...)
PK11SymKey * nss_sym_key_sign
enum crypto_crypt_t crypto_cipher_type
#define AES_256_KEY_LENGTH
struct crypto_instance * crypto_init(const unsigned char *private_key, unsigned int private_key_len, const char *crypto_cipher_type, const char *crypto_hash_type, void(*log_printf_func)(int level, int subsys, const char *function, const char *file, int line, const char *format,...) __attribute__((format(printf, 6, 7))), int log_level_security, int log_level_notice, int log_level_error, int log_subsys_id)
void(*) in log_level_security)
#define AES_192_KEY_LENGTH
int crypto_encrypt_and_sign(struct crypto_instance *instance, const unsigned char *buf_in, const size_t buf_in_len, unsigned char *buf_out, size_t *buf_out_len)
#define MAX_WRAPPED_KEY_LEN
enum crypto_crypt_t __attribute__
unsigned int private_key_len
int crypto_authenticate_and_decrypt(struct crypto_instance *instance, unsigned char *buf, int *buf_len)
enum crypto_hash_t crypto_hash_type
#define AES_128_KEY_LENGTH
void(* log_printf_func)(int level, int subsys, const char *function, const char *file, int line, const char *format,...) __attribute__((format(printf
CK_MECHANISM_TYPE cipher_to_nss[]
size_t cypher_block_len[]
CK_MECHANISM_TYPE hash_to_nss[]