|
|
@@ -0,0 +1,215 @@
|
|
|
+--- USM.pm 2018-06-29 21:06:28.000000000 +0300
|
|
|
++++ USM.sha512.pm 2025-12-03 11:58:04.962638800 +0300
|
|
|
+@@ -25,8 +25,8 @@
|
|
|
+
|
|
|
+ use Crypt::DES();
|
|
|
+ use Digest::MD5();
|
|
|
+-use Digest::SHA1();
|
|
|
+-use Digest::HMAC();
|
|
|
++use Digest::SHA qw( hmac_sha1 hmac_sha224 hmac_sha256 hmac_sha384 hmac_sha512 );
|
|
|
++use Digest::HMAC_MD5 qw ( hmac_md5 );
|
|
|
+
|
|
|
+ ## Version of the Net::SNMP::Security::USM module
|
|
|
+
|
|
|
+@@ -40,7 +40,9 @@
|
|
|
+
|
|
|
+ our %EXPORT_TAGS = (
|
|
|
+ authprotos => [
|
|
|
+- qw( AUTH_PROTOCOL_NONE AUTH_PROTOCOL_HMACMD5 AUTH_PROTOCOL_HMACSHA )
|
|
|
++ qw( AUTH_PROTOCOL_NONE AUTH_PROTOCOL_HMACMD5 AUTH_PROTOCOL_HMACSHA
|
|
|
++ AUTH_PROTOCOL_HMACSHA224 AUTH_PROTOCOL_HMACSHA256.
|
|
|
++ AUTH_PROTOCOL_HMACSHA384 AUTH_PROTOCOL_HMACSHA512 )
|
|
|
+ ],
|
|
|
+ levels => [
|
|
|
+ qw( SECURITY_LEVEL_NOAUTHNOPRIV SECURITY_LEVEL_AUTHNOPRIV
|
|
|
+@@ -63,9 +65,13 @@
|
|
|
+
|
|
|
+ ## RCC 3414 - Authentication protocols
|
|
|
+
|
|
|
+-sub AUTH_PROTOCOL_NONE { '1.3.6.1.6.3.10.1.1.1' } # usmNoAuthProtocol
|
|
|
+-sub AUTH_PROTOCOL_HMACMD5 { '1.3.6.1.6.3.10.1.1.2' } # usmHMACMD5AuthProtocol
|
|
|
+-sub AUTH_PROTOCOL_HMACSHA { '1.3.6.1.6.3.10.1.1.3' } # usmHMACSHAAuthProtocol
|
|
|
++sub AUTH_PROTOCOL_NONE { '1.3.6.1.6.3.10.1.1.1' } # usmNoAuthProtocol
|
|
|
++sub AUTH_PROTOCOL_HMACMD5 { '1.3.6.1.6.3.10.1.1.2' } # usmHMACMD5AuthProtocol
|
|
|
++sub AUTH_PROTOCOL_HMACSHA { '1.3.6.1.6.3.10.1.1.3' } # usmHMACSHAAuthProtocol
|
|
|
++sub AUTH_PROTOCOL_HMACSHA224 { '1.3.6.1.6.3.10.1.1.4' } # usmHMAC128SHA224AuthProtocol
|
|
|
++sub AUTH_PROTOCOL_HMACSHA256 { '1.3.6.1.6.3.10.1.1.5' } # usmHMAC192SHA256AuthProtocol
|
|
|
++sub AUTH_PROTOCOL_HMACSHA384 { '1.3.6.1.6.3.10.1.1.6' } # usmHMAC256SHA384AuthProtocol
|
|
|
++sub AUTH_PROTOCOL_HMACSHA512 { '1.3.6.1.6.3.10.1.1.7' } # usmHMAC384SHA512AuthProtocol
|
|
|
+
|
|
|
+ ## RFC 3414 - Privacy protocols
|
|
|
+
|
|
|
+@@ -124,6 +130,7 @@
|
|
|
+ '_time_epoc' => time(), # snmpEngineBoots epoc
|
|
|
+ '_user_name' => q{}, # securityName
|
|
|
+ '_auth_data' => undef, # Authentication data
|
|
|
++ '_auth_maclen' => undef, # MAC length
|
|
|
+ '_auth_key' => undef, # authKey
|
|
|
+ '_auth_password' => undef, # Authentication password
|
|
|
+ '_auth_protocol' => AUTH_PROTOCOL_HMACMD5, # authProtocol
|
|
|
+@@ -280,10 +287,10 @@
|
|
|
+ if ($pdu->security_level() > SECURITY_LEVEL_NOAUTHNOPRIV) {
|
|
|
+
|
|
|
+ # Save the location to fill in msgAuthenticationParameters later
|
|
|
+- $auth_location = $msg->length() + 12 + length $pdu_buffer;
|
|
|
++ $auth_location = $msg->length() + $this->{_auth_maclen} + length $pdu_buffer;
|
|
|
+
|
|
|
+ # Set the msgAuthenticationParameters to all zeros
|
|
|
+- $auth_params = pack 'x12';
|
|
|
++ $auth_params = pack "x$this->{_auth_maclen}";
|
|
|
+ }
|
|
|
+
|
|
|
+ if (!defined $msg->prepare(OCTET_STRING, $auth_params)) {
|
|
|
+@@ -418,12 +425,12 @@
|
|
|
+ # to compute the HMAC properly.
|
|
|
+
|
|
|
+ if (my $len = length $auth_params) {
|
|
|
+- if ($len != 12) {
|
|
|
++ if ($len != $this->{_auth_maclen}) {
|
|
|
+ return $this->_error(
|
|
|
+ 'The msgAuthenticationParameters length of %d is invalid', $len
|
|
|
+ );
|
|
|
+ }
|
|
|
+- substr ${$msg->reference}, ($msg->index() - 12), 12, pack 'x12';
|
|
|
++ substr ${$msg->reference}, ($msg->index() - $this->{_auth_maclen}), $this->{_auth_maclen}, pack "x$this->{_auth_maclen}";
|
|
|
+ }
|
|
|
+
|
|
|
+ # msgPrivacyParameters::=OCTET STRING
|
|
|
+@@ -747,6 +754,18 @@
|
|
|
+ quotemeta AUTH_PROTOCOL_HMACMD5, AUTH_PROTOCOL_HMACMD5,
|
|
|
+ '(?:hmac-)?sha(?:-?1|-96)?', AUTH_PROTOCOL_HMACSHA,
|
|
|
+ quotemeta AUTH_PROTOCOL_HMACSHA, AUTH_PROTOCOL_HMACSHA,
|
|
|
++ '(?:hmac-)?sha(?:-?224)', AUTH_PROTOCOL_HMACSHA224,
|
|
|
++ 'usmHMAC128SHA224AuthProtocol', AUTH_PROTOCOL_HMACSHA224,
|
|
|
++ quotemeta AUTH_PROTOCOL_HMACSHA224,AUTH_PROTOCOL_HMACSHA224,
|
|
|
++ '(?:hmac-)?sha(?:-?256)', AUTH_PROTOCOL_HMACSHA256,
|
|
|
++ 'usmHMAC192SHA256AuthProtocol', AUTH_PROTOCOL_HMACSHA256,
|
|
|
++ quotemeta AUTH_PROTOCOL_HMACSHA256,AUTH_PROTOCOL_HMACSHA256,
|
|
|
++ '(?:hmac-)?sha(?:-?384)', AUTH_PROTOCOL_HMACSHA384,
|
|
|
++ 'usmHMAC256SHA384AuthProtocol', AUTH_PROTOCOL_HMACSHA384,
|
|
|
++ quotemeta AUTH_PROTOCOL_HMACSHA384,AUTH_PROTOCOL_HMACSHA384,
|
|
|
++ '(?:hmac-)?sha(?:-?512)', AUTH_PROTOCOL_HMACSHA512,
|
|
|
++ 'usmHMAC384SHA512AuthProtocol', AUTH_PROTOCOL_HMACSHA512,
|
|
|
++ quotemeta AUTH_PROTOCOL_HMACSHA512,AUTH_PROTOCOL_HMACSHA512,
|
|
|
+ };
|
|
|
+
|
|
|
+ sub _auth_protocol
|
|
|
+@@ -1099,8 +1118,7 @@
|
|
|
+ }
|
|
|
+
|
|
|
+ # Set the msgAuthenticationParameters
|
|
|
+- substr ${$msg->reference}, -$auth_location, 12, $this->_auth_hmac($msg);
|
|
|
+-
|
|
|
++ substr ${$msg->reference}, -$auth_location, $this->{_auth_maclen}, $this->_auth_hmac($msg);
|
|
|
+ return TRUE;
|
|
|
+ }
|
|
|
+
|
|
|
+@@ -1125,7 +1143,7 @@
|
|
|
+ return q{} if (!defined($this->{_auth_data}) || !defined $msg);
|
|
|
+
|
|
|
+ return substr
|
|
|
+- $this->{_auth_data}->reset()->add(${$msg->reference()})->digest(), 0, 12;
|
|
|
++ $this->{_auth_data}(${$msg->reference()}, $this->{_auth_key}), 0, $this->{_auth_maclen};
|
|
|
+ }
|
|
|
+
|
|
|
+ sub _auth_data_init
|
|
|
+@@ -1140,13 +1158,33 @@
|
|
|
+
|
|
|
+ if ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACMD5) {
|
|
|
+
|
|
|
+- $this->{_auth_data} =
|
|
|
+- Digest::HMAC->new($this->{_auth_key}, 'Digest::MD5');
|
|
|
++ $this->{_auth_data} = \&hmac_md5;
|
|
|
++ $this->{_auth_maclen} = 12;
|
|
|
+
|
|
|
+ } elsif ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACSHA) {
|
|
|
+
|
|
|
+- $this->{_auth_data} =
|
|
|
+- Digest::HMAC->new($this->{_auth_key}, 'Digest::SHA1');
|
|
|
++ $this->{_auth_data} = \&hmac_sha1;
|
|
|
++ $this->{_auth_maclen} = 12;
|
|
|
++
|
|
|
++ } elsif ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACSHA224) {
|
|
|
++
|
|
|
++ $this->{_auth_data} = \&hmac_sha224;
|
|
|
++ $this->{_auth_maclen} = 16;
|
|
|
++
|
|
|
++ } elsif ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACSHA256) {
|
|
|
++
|
|
|
++ $this->{_auth_data} = \&hmac_sha256;
|
|
|
++ $this->{_auth_maclen} = 24;
|
|
|
++
|
|
|
++ } elsif ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACSHA384) {
|
|
|
++
|
|
|
++ $this->{_auth_data} = \&hmac_sha384;
|
|
|
++ $this->{_auth_maclen} = 32;
|
|
|
++
|
|
|
++ } elsif ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACSHA512) {
|
|
|
++
|
|
|
++ $this->{_auth_data} = \&hmac_sha512;
|
|
|
++ $this->{_auth_maclen} = 48;
|
|
|
+
|
|
|
+ } else {
|
|
|
+
|
|
|
+@@ -1391,7 +1429,7 @@
|
|
|
+ if ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACMD5) {
|
|
|
+ $this->{_priv_data}->{hash} = Digest::MD5->new();
|
|
|
+ } elsif ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACSHA) {
|
|
|
+- $this->{_priv_data}->{hash} = Digest::SHA1->new();
|
|
|
++ $this->{_priv_data}->{hash} = Digest::SHA->new();
|
|
|
+ }
|
|
|
+
|
|
|
+ return TRUE;
|
|
|
+@@ -1626,7 +1664,11 @@
|
|
|
+ my $key_len =
|
|
|
+ {
|
|
|
+ AUTH_PROTOCOL_HMACMD5, [ 16, 'HMAC-MD5' ],
|
|
|
+- AUTH_PROTOCOL_HMACSHA, [ 20, 'HMAC-SHA1' ],
|
|
|
++ AUTH_PROTOCOL_HMACSHA, [ 20, 'HMAC-SHA' ],
|
|
|
++ AUTH_PROTOCOL_HMACSHA224, [ 28, 'HMAC-SHA224' ],
|
|
|
++ AUTH_PROTOCOL_HMACSHA256, [ 32, 'HMAC-SHA256' ],
|
|
|
++ AUTH_PROTOCOL_HMACSHA384, [ 48, 'HMAC-SHA384' ],
|
|
|
++ AUTH_PROTOCOL_HMACSHA512, [ 64, 'HMAC-SHA512' ],
|
|
|
+ };
|
|
|
+
|
|
|
+ if (!exists $key_len->{$this->{_auth_protocol}}) {
|
|
|
+@@ -1681,7 +1723,7 @@
|
|
|
+ if ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACMD5) {
|
|
|
+ $hnnn = Digest::MD5->new();
|
|
|
+ } elsif ($this->{_auth_protocol} eq AUTH_PROTOCOL_HMACSHA) {
|
|
|
+- $hnnn = Digest::SHA1->new();
|
|
|
++ $hnnn = Digest::SHA->new();
|
|
|
+ } else {
|
|
|
+ return $this->_error(
|
|
|
+ 'The authProtocol "%s" is unknown', $this->{_auth_protocol}
|
|
|
+@@ -1782,9 +1824,13 @@
|
|
|
+
|
|
|
+ my $digests =
|
|
|
+ {
|
|
|
+- AUTH_PROTOCOL_HMACMD5, 'Digest::MD5',
|
|
|
+- AUTH_PROTOCOL_HMACSHA, 'Digest::SHA1',
|
|
|
+- };
|
|
|
++ AUTH_PROTOCOL_HMACMD5, ['Digest::MD5', ],
|
|
|
++ AUTH_PROTOCOL_HMACSHA, ['Digest::SHA', 1],
|
|
|
++ AUTH_PROTOCOL_HMACSHA224, ['Digest::SHA', 224],
|
|
|
++ AUTH_PROTOCOL_HMACSHA256, ['Digest::SHA', 256],
|
|
|
++ AUTH_PROTOCOL_HMACSHA384, ['Digest::SHA', 384],
|
|
|
++ AUTH_PROTOCOL_HMACSHA512, ['Digest::SHA', 512],
|
|
|
++ };
|
|
|
+
|
|
|
+ if (!exists $digests->{$this->{_auth_protocol}}) {
|
|
|
+ return $this->_error(
|
|
|
+@@ -1792,7 +1838,12 @@
|
|
|
+ );
|
|
|
+ }
|
|
|
+
|
|
|
+- my $digest = $digests->{$this->{_auth_protocol}}->new;
|
|
|
++ my $digest;
|
|
|
++ if (!defined($digests->{$this->{_auth_protocol}}[1])) {
|
|
|
++ $digest = $digests->{$this->{_auth_protocol}}[0]->new;
|
|
|
++ } else {
|
|
|
++ $digest = $digests->{$this->{_auth_protocol}}[0]->new($digests->{$this->{_auth_protocol}}[1]);
|
|
|
++ }
|
|
|
+
|
|
|
+ # Create the initial digest using the password
|
|
|
+
|