|
 |
b5ae06 |
874440 - net-snmp does not work in FIPS mode
|
|
|
b5ae06 |
|
|
|
b5ae06 |
Three upstream commits are here:
|
|
|
b5ae06 |
|
|
|
b5ae06 |
commit dde3a35baaeb683cf1441a16a15441f8b456c520
|
|
|
b5ae06 |
Author: Jan Safranek <jsafranek@users.sourceforge.net>
|
|
|
b5ae06 |
Date: Mon Nov 12 15:45:27 2012 +0100
|
|
|
b5ae06 |
|
|
|
b5ae06 |
CHANGES: snmplib: Fixed crash when MD5 hash is not supported by OpenSSL.
|
|
|
b5ae06 |
|
|
|
b5ae06 |
commit dd53ffbafeb31cde616a89949e70e3d5fe0cc1b3
|
|
|
b5ae06 |
Author: Jan Safranek <jsafranek@users.sourceforge.net>
|
|
|
b5ae06 |
Date: Mon Nov 12 15:46:43 2012 +0100
|
|
|
b5ae06 |
|
|
|
b5ae06 |
Fall back to SHA-1 if MD5 is not available.
|
|
|
b5ae06 |
On paranoid systems where MD5 is disabled use SHA-1 instead of MD5 and don't crash.
|
|
|
b5ae06 |
|
|
|
b5ae06 |
commit 743cb66718904979f55895472501584c30c66f10
|
|
|
b5ae06 |
Author: Jan Safranek <jsafranek@users.sourceforge.net>
|
|
|
b5ae06 |
Date: Mon Nov 12 15:49:15 2012 +0100
|
|
|
b5ae06 |
|
|
|
b5ae06 |
Fixed crash when MD5 and/or SHA-1 hash is not supported by OpenSSL.
|
|
|
b5ae06 |
|
|
|
b5ae06 |
diff -up net-snmp-5.7.2/snmplib/keytools.c.fips net-snmp-5.7.2/snmplib/keytools.c
|
|
|
b5ae06 |
--- net-snmp-5.7.2/snmplib/keytools.c.fips 2012-11-12 13:36:17.868635391 +0100
|
|
|
b5ae06 |
+++ net-snmp-5.7.2/snmplib/keytools.c 2012-11-12 14:24:23.031293984 +0100
|
|
|
b5ae06 |
@@ -156,27 +156,36 @@ generate_Ku(const oid * hashtype, u_int
|
|
|
b5ae06 |
EVP_MD_CTX_init(ctx);
|
|
|
b5ae06 |
#endif
|
|
|
b5ae06 |
#ifndef NETSNMP_DISABLE_MD5
|
|
|
b5ae06 |
- if (ISTRANSFORM(hashtype, HMACMD5Auth))
|
|
|
b5ae06 |
- EVP_DigestInit(ctx, EVP_md5());
|
|
|
b5ae06 |
- else
|
|
|
b5ae06 |
+ if (ISTRANSFORM(hashtype, HMACMD5Auth)) {
|
|
|
b5ae06 |
+ if (!EVP_DigestInit(ctx, EVP_md5()))
|
|
|
b5ae06 |
+ /* MD5 not supported */
|
|
|
b5ae06 |
+ return SNMPERR_GENERR;
|
|
|
b5ae06 |
+ } else
|
|
|
b5ae06 |
#endif
|
|
|
b5ae06 |
- if (ISTRANSFORM(hashtype, HMACSHA1Auth))
|
|
|
b5ae06 |
- EVP_DigestInit(ctx, EVP_sha1());
|
|
|
b5ae06 |
- else
|
|
|
b5ae06 |
- QUITFUN(SNMPERR_GENERR, generate_Ku_quit);
|
|
|
b5ae06 |
+ if (ISTRANSFORM(hashtype, HMACSHA1Auth)) {
|
|
|
b5ae06 |
+ if (!EVP_DigestInit(ctx, EVP_sha1()))
|
|
|
b5ae06 |
+ /* SHA1 not supported */
|
|
|
b5ae06 |
+ return SNMPERR_GENERR;
|
|
|
b5ae06 |
+ } else {
|
|
|
b5ae06 |
+ QUITFUN(SNMPERR_GENERR, generate_Ku_quit);
|
|
|
b5ae06 |
+ }
|
|
|
b5ae06 |
#elif NETSNMP_USE_INTERNAL_CRYPTO
|
|
|
b5ae06 |
#ifndef NETSNMP_DISABLE_MD5
|
|
|
b5ae06 |
if (ISTRANSFORM(hashtype, HMACMD5Auth)) {
|
|
|
b5ae06 |
- MD5_Init(&cmd5);
|
|
|
b5ae06 |
+ if (!MD5_Init(&cmd5))
|
|
|
b5ae06 |
+ /* MD5 not supported */
|
|
|
b5ae06 |
+ return SNMPERR_GENERR;
|
|
|
b5ae06 |
cryptotype = TYPE_MD5;
|
|
|
b5ae06 |
} else
|
|
|
b5ae06 |
#endif
|
|
|
b5ae06 |
- if (ISTRANSFORM(hashtype, HMACSHA1Auth)) {
|
|
|
b5ae06 |
- SHA1_Init(&csha1);
|
|
|
b5ae06 |
- cryptotype = TYPE_SHA1;
|
|
|
b5ae06 |
- } else {
|
|
|
b5ae06 |
- return (SNMPERR_GENERR);
|
|
|
b5ae06 |
- }
|
|
|
b5ae06 |
+ if (ISTRANSFORM(hashtype, HMACSHA1Auth)) {
|
|
|
b5ae06 |
+ if (!SHA1_Init(&csha1))
|
|
|
b5ae06 |
+ /* SHA1 not supported */
|
|
|
b5ae06 |
+ return SNMPERR_GENERR;
|
|
|
b5ae06 |
+ cryptotype = TYPE_SHA1;
|
|
|
b5ae06 |
+ } else {
|
|
|
b5ae06 |
+ return (SNMPERR_GENERR);
|
|
|
b5ae06 |
+ }
|
|
|
b5ae06 |
#else
|
|
|
b5ae06 |
MDbegin(&MD;;
|
|
|
b5ae06 |
#endif /* NETSNMP_USE_OPENSSL */
|
|
|
b5ae06 |
diff -up net-snmp-5.7.2/snmplib/lcd_time.c.fips net-snmp-5.7.2/snmplib/lcd_time.c
|
|
|
b5ae06 |
--- net-snmp-5.7.2/snmplib/lcd_time.c.fips 2012-10-10 00:28:58.000000000 +0200
|
|
|
b5ae06 |
+++ net-snmp-5.7.2/snmplib/lcd_time.c 2012-11-12 13:36:11.326657629 +0100
|
|
|
b5ae06 |
@@ -505,6 +505,12 @@ hash_engineID(const u_char * engineID, u
|
|
|
b5ae06 |
rval = sc_hash(usmHMACMD5AuthProtocol,
|
|
|
b5ae06 |
sizeof(usmHMACMD5AuthProtocol) / sizeof(oid),
|
|
|
b5ae06 |
engineID, engineID_len, buf, &buf_len);
|
|
|
b5ae06 |
+ if (rval == SNMPERR_SC_NOT_CONFIGURED) {
|
|
|
b5ae06 |
+ /* fall back to sha1 */
|
|
|
b5ae06 |
+ rval = sc_hash(usmHMACSHA1AuthProtocol,
|
|
|
b5ae06 |
+ sizeof(usmHMACSHA1AuthProtocol) / sizeof(oid),
|
|
|
b5ae06 |
+ engineID, engineID_len, buf, &buf_len);
|
|
|
b5ae06 |
+ }
|
|
|
b5ae06 |
#else
|
|
|
b5ae06 |
rval = sc_hash(usmHMACSHA1AuthProtocol,
|
|
|
b5ae06 |
sizeof(usmHMACSHA1AuthProtocol) / sizeof(oid),
|
|
|
b5ae06 |
diff -up net-snmp-5.7.2/snmplib/scapi.c.fips net-snmp-5.7.2/snmplib/scapi.c
|
|
|
b5ae06 |
--- net-snmp-5.7.2/snmplib/scapi.c.fips 2012-10-10 00:28:58.000000000 +0200
|
|
|
b5ae06 |
+++ net-snmp-5.7.2/snmplib/scapi.c 2012-11-12 13:36:11.327657627 +0100
|
|
|
b5ae06 |
@@ -438,6 +438,7 @@ sc_generate_keyed_hash(const oid * autht
|
|
|
b5ae06 |
* Returns:
|
|
|
b5ae06 |
* SNMPERR_SUCCESS Success.
|
|
|
b5ae06 |
* SNMP_SC_GENERAL_FAILURE Any error.
|
|
|
b5ae06 |
+ * SNMPERR_SC_NOT_CONFIGURED Hash type not supported.
|
|
|
b5ae06 |
*/
|
|
|
b5ae06 |
int
|
|
|
b5ae06 |
sc_hash(const oid * hashtype, size_t hashtypelen, const u_char * buf,
|
|
|
b5ae06 |
@@ -495,7 +496,10 @@ sc_hash(const oid * hashtype, size_t has
|
|
|
b5ae06 |
EVP_MD_CTX_init(cptr);
|
|
|
b5ae06 |
#endif
|
|
|
b5ae06 |
#endif
|
|
|
b5ae06 |
- EVP_DigestInit(cptr, hashfn);
|
|
|
b5ae06 |
+ if (!EVP_DigestInit(cptr, hashfn)) {
|
|
|
b5ae06 |
+ /* requested hash function is not available */
|
|
|
b5ae06 |
+ return SNMPERR_SC_NOT_CONFIGURED;
|
|
|
b5ae06 |
+ }
|
|
|
b5ae06 |
|
|
|
b5ae06 |
/** pass the data */
|
|
|
b5ae06 |
EVP_DigestUpdate(cptr, buf, buf_len);
|