From a803a95c00f89932d2cfd7a7b424aad05fa276b8 Mon Sep 17 00:00:00 2001
From: Micael Karlberg <bmk@erlang.org>
Date: Thu, 17 Oct 2013 17:45:54 +0200
Subject: [snmp] Wrong block cypher type used for AES

Wrong block cypher type used for AES ('aes_cbf128' instead of
'aes_cfb128') when performing AES block encrypt/decrypt which
breaks SNMP usmAesCfb128Protocol in agent and manager.

OTP-11412
---
 lib/snmp/src/misc/snmp_usm.erl | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

(limited to 'lib/snmp/src/misc/snmp_usm.erl')

diff --git a/lib/snmp/src/misc/snmp_usm.erl b/lib/snmp/src/misc/snmp_usm.erl
index 67e3476816..0c57f535cd 100644
--- a/lib/snmp/src/misc/snmp_usm.erl
+++ b/lib/snmp/src/misc/snmp_usm.erl
@@ -42,6 +42,9 @@
 
 -define(i32(Int), (Int bsr 24) band 255, (Int bsr 16) band 255, (Int bsr 8) band 255, Int band 255).
 
+-define(BLOCK_CIPHER_AES, aes_cfb128).
+-define(BLOCK_CIPHER_DES, des_cbc).
+
 
 %%-----------------------------------------------------------------
 %% Func: passwd2localized_key/3
@@ -210,7 +213,8 @@ des_encrypt(PrivKey, Data, SaltFun) ->
     IV = list_to_binary(snmp_misc:str_xor(PreIV, Salt)),
     TailLen = (8 - (length(Data) rem 8)) rem 8,
     Tail = mk_tail(TailLen),
-    EncData = crypto:block_encrypt(des_cbc, DesKey, IV, [Data,Tail]),
+    EncData = crypto:block_encrypt(?BLOCK_CIPHER_DES, 
+				   DesKey, IV, [Data,Tail]),
     {ok, binary_to_list(EncData), Salt}.
 
 des_decrypt(PrivKey, MsgPrivParams, EncData) 
@@ -224,7 +228,8 @@ des_decrypt(PrivKey, MsgPrivParams, EncData)
     Salt = MsgPrivParams,
     IV = list_to_binary(snmp_misc:str_xor(PreIV, Salt)),
     %% Whatabout errors here???  E.g. not a mulitple of 8!
-    Data = binary_to_list(crypto:block_decrypt(des_cbc, DesKey, IV, EncData)),
+    Data = binary_to_list(crypto:block_decrypt(?BLOCK_CIPHER_DES, 
+					       DesKey, IV, EncData)),
     Data2 = snmp_pdus:strip_encrypted_scoped_pdu_data(Data),
     {ok, Data2};
 des_decrypt(PrivKey, BadMsgPrivParams, EncData) ->
@@ -242,7 +247,8 @@ aes_encrypt(PrivKey, Data, SaltFun) ->
     EngineBoots = snmp_framework_mib:get_engine_boots(),
     EngineTime = snmp_framework_mib:get_engine_time(),
     IV = list_to_binary([?i32(EngineBoots), ?i32(EngineTime) | Salt]),
-    EncData = crypto:block_encrypt(aes_cbf128, AesKey, IV, Data),
+    EncData = crypto:block_encrypt(?BLOCK_CIPHER_AES, 
+				   AesKey, IV, Data),
     {ok, binary_to_list(EncData), Salt}.
 
 aes_decrypt(PrivKey, MsgPrivParams, EncData, EngineBoots, EngineTime)
@@ -251,7 +257,8 @@ aes_decrypt(PrivKey, MsgPrivParams, EncData, EngineBoots, EngineTime)
     Salt = MsgPrivParams,
     IV = list_to_binary([?i32(EngineBoots), ?i32(EngineTime) | Salt]),
     %% Whatabout errors here???  E.g. not a mulitple of 8!
-    Data = binary_to_list(crypto:block_decrypt(aes_cbf128, AesKey, IV, EncData)),
+    Data = binary_to_list(crypto:block_decrypt(?BLOCK_CIPHER_AES, 
+					       AesKey, IV, EncData)),
     Data2 = snmp_pdus:strip_encrypted_scoped_pdu_data(Data),
     {ok, Data2}.
 
-- 
cgit v1.2.3


From 300803837926d0bb28829f313fad07f757188d41 Mon Sep 17 00:00:00 2001
From: Micael Karlberg <bmk@erlang.org>
Date: Fri, 18 Oct 2013 11:32:25 +0200
Subject: [snmp/manager] Incorrect use of EngineBoots and EngineTime when
 encrypting

When performing the AES encryption, invalid values for the
EngineBoots and EngineTime was used. The values of the local
agent was used, which would have produced some values if an
agent was actually running. If not it would have caused a crash.

OTP-11413
---
 lib/snmp/src/misc/snmp_usm.erl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'lib/snmp/src/misc/snmp_usm.erl')

diff --git a/lib/snmp/src/misc/snmp_usm.erl b/lib/snmp/src/misc/snmp_usm.erl
index 0c57f535cd..32198deb8b 100644
--- a/lib/snmp/src/misc/snmp_usm.erl
+++ b/lib/snmp/src/misc/snmp_usm.erl
@@ -16,6 +16,8 @@
 %%
 %% %CopyrightEnd%
 %% 
+%% AES: RFC 3826
+%% 
 
 -module(snmp_usm).
 
@@ -24,7 +26,7 @@
 -export([passwd2localized_key/3, localize_key/3]).
 -export([auth_in/4, auth_out/4, set_msg_auth_params/3]).
 -export([des_encrypt/3, des_decrypt/3]).
--export([aes_encrypt/3, aes_decrypt/5]).
+-export([aes_encrypt/5, aes_decrypt/5]).
 
 
 -define(SNMP_USE_V3, true).
@@ -241,11 +243,9 @@ des_decrypt(PrivKey, BadMsgPrivParams, EncData) ->
     throw({error, {bad_msgPrivParams, PrivKey, BadMsgPrivParams, EncData}}).
     
 
-aes_encrypt(PrivKey, Data, SaltFun) ->
+aes_encrypt(PrivKey, Data, SaltFun, EngineBoots, EngineTime) ->
     AesKey = PrivKey,
     Salt = SaltFun(),
-    EngineBoots = snmp_framework_mib:get_engine_boots(),
-    EngineTime = snmp_framework_mib:get_engine_time(),
     IV = list_to_binary([?i32(EngineBoots), ?i32(EngineTime) | Salt]),
     EncData = crypto:block_encrypt(?BLOCK_CIPHER_AES, 
 				   AesKey, IV, Data),
-- 
cgit v1.2.3