/*
* keymanagetest.c
*
* HEADER Testing key management API functionality
*
* Expected SUCCESSes: 2 + 2 + 3 for all tests.
*
* Returns:
* Number of FAILUREs.
*
*
* FIX Or how about passing a usmUser name and looking up the entry as
* a means of getting key material? This means the userList is
* available from an application...
*
* ASSUMES No key management functions return non-zero success codes.
*
* Test of generate_Ku(). SUCCESSes: 2
* Test of generate_kul(). SUCCESSes: 2
* Test of {encode,decode}_keychange(). SUCCESSes: 3
*/
#include <net-snmp/net-snmp-config.h>
#include <stdio.h>
#ifdef HAVE_STRING_H
#include <string.h>
#endif
#ifdef HAVE_NETINET_IN_H
#include <netinet/in.h>
#endif
#include <unistd.h>
#include <ctype.h>
#include <net-snmp/library/asn1.h>
#include <net-snmp/library/snmp_api.h>
#include <net-snmp/library/keytools.h>
#include <net-snmp/library/tools.h>
#include <net-snmp/library/scapi.h>
#include <net-snmp/library/transform_oids.h>
#include <net-snmp/library/callback.h>
#include <stdlib.h>
extern char *optarg;
extern int optind, optopt, opterr;
int testcount = 0;
/*
* Globals, &c...
*/
char *local_progname;
#define USAGE "Usage: %s [-h][-aklu][-E <engineID>][-N <newkey>][-O <oldkey>][-P <passphrase>]"
#define OPTIONLIST "aqE:hklN:O:P:u"
int doalltests = 0, dogenKu = 0, dogenkul = 0, dokeychange = 0;
#define ALLOPTIONS (doalltests + dogenKu + dogenkul + dokeychange)
#define LOCAL_MAXBUF (1024 * 8)
#define NL "\n"
#define OUTPUTALWAYS(o) fprintf(stdout, "# %s\n", o);
#define OUTPUT(o) if (!bequiet) { OUTPUTALWAYS(o); }
#define SUCCESS(s) \
{ \
fprintf(stdout, "# Done with %s\n", s); \
}
#define FAILED(e, f) \
{ \
if ((e) != SNMPERR_SUCCESS) { \
fprintf(stdout, "not ok: %d - %s\n", ++testcount, f); \
failcount += 1; \
} else { \
fprintf(stdout, "ok: %d - %s\n", ++testcount, f); \
} \
fflush(stdout); \
}
#define DETAILINT(s, i) \
fprintf(stdout, "# %s: %d\n", s, i);
/*
* Test specific globals.
*/
#define ENGINEID_DEFAULT "1.2.3.4wild"
#define PASSPHRASE_DEFAULT "Clay's Conclusion: Creativity is great, " \
"but plagiarism is faster."
#define OLDKEY_DEFAULT "This is a very old key."
#define NEWKEY_DEFAULT "This key, on the other hand, is very new."
u_char *engineID = NULL;
char *passphrase = NULL;
const u_char *oldkey = NULL;
const u_char *newkey = NULL;
int bequiet = 0;
/*
* Prototypes.
*/
void usage(FILE * ofp);
int test_genkul(void);
int test_genKu(void);
int test_keychange(void);
int
main(int argc, char **argv)
{
int rval = SNMPERR_SUCCESS, failcount = 0;
char ch;
local_progname = argv[0];
optarg = NULL;
/*
* Parse.
*/
while ((ch = getopt(argc, argv, OPTIONLIST)) != EOF) {
switch (ch) {
case 'a':
doalltests = 1;
break;
case 'E':
engineID = (u_char *) optarg;
break;
case 'k':
dokeychange = 1;
break;
case 'l':
dogenkul = 1;
break;
case 'N':
newkey = (u_char *) optarg;
break;
case 'O':
oldkey = (u_char *) optarg;
break;
case 'P':
passphrase = optarg;
break;
case 'u':
dogenKu = 1;
break;
case 'q':
bequiet = 1;
break;
case 'h':
rval = 0;
default:
usage(stdout);
exit(rval);
}
argc -= 1;
argv += 1;
if (optarg) {
argc -= 1;
argv += 1;
}
optind = 1;
optarg = NULL;
} /* endwhile getopt */
if ((argc > 1)) {
usage(stdout);
exit(1000);
} else if (ALLOPTIONS != 1) {
doalltests = 1;
}
/*
* Test stuff.
*/
rval = sc_init();
FAILED(rval, "sc_init().");
if (dogenKu || doalltests) {
failcount += test_genKu();
}
if (dogenkul || doalltests) {
failcount += test_genkul();
}
if (dokeychange || doalltests) {
failcount += test_keychange();
}
fprintf(stdout, "1..%d\n", testcount);
return failcount;
} /* end main() */
void
usage(FILE * ofp)
{
fprintf(ofp,
USAGE
"" NL
" -a All tests." NL
" -E [0x]<engineID> snmpEngineID string."
NL
" -k Test {encode,decode}_keychange()."
NL
" -l generate_kul()."
NL
" -h Help."
NL
" -N [0x]<newkey> New key (for testing KeyChange TC)."
NL
" -O [0x]<oldkey> Old key (for testing KeyChange TC)."
NL
" -P <passphrase> Source string for usmUser master key."
NL
" -u generate_Ku()."
NL
" -q be quiet."
NL "" NL, local_progname);
} /* end usage() */
#ifdef EXAMPLE
/*******************************************************************-o-******
* test_dosomething
*
* Test template.
*
* Returns:
* Number of failures.
*/
int
test_dosomething(void)
{
int rval = SNMPERR_SUCCESS, failcount = 0;
EM0(1, "UNIMPLEMENTED"); /* EM(1); */
test_dosomething_quit:
return failcount;
} /* end test_dosomething() */
#endif /* EXAMPLE */
/*******************************************************************-o-******
* test_genKu
*
* Returns:
* Number of failures.
*
*
* Test generation of usmUser master key from a passphrase.
*
* ASSUMES Passphrase is made of printable characters!
*/
int
test_genKu(void)
{
int rval = SNMPERR_SUCCESS,
failcount = 0,
properlength = BYTESIZE(SNMP_TRANS_AUTHLEN_HMACMD5);
size_t kulen;
const char *hashname = "usmHMACMD5AuthProtocol.";
char *s;
u_char Ku[LOCAL_MAXBUF];
oid *hashtype = usmHMACMD5AuthProtocol;
OUTPUT("Test of generate_Ku --");
/*
* Set passphrase.
*/
if (!passphrase) {
passphrase = strdup(PASSPHRASE_DEFAULT);
}
if (!bequiet)
fprintf(stdout, "Passphrase%s: %s\n",
(strcmp(passphrase, PASSPHRASE_DEFAULT) == 0) ? " (default)" : "",
passphrase);
test_genKu_again:
memset(Ku, 0, LOCAL_MAXBUF);
kulen = LOCAL_MAXBUF;
rval = generate_Ku(hashtype, USM_LENGTH_OID_TRANSFORM,
(const u_char *) passphrase, strlen(passphrase),
Ku, &kulen);
FAILED(rval, "generate_Ku().");
FAILED((kulen != properlength),
"Ku length is the right length for this hashtype.");
binary_to_hex(Ku, kulen, &s);
if (!bequiet)
fprintf(stdout, "# Ku (len=%" NETSNMP_PRIz "u): %s\n", kulen, s);
free_zero(s, kulen);
OUTPUT(hashname);
if (hashtype == usmHMACMD5AuthProtocol) {
hashtype = usmHMACSHA1AuthProtocol;
hashname = "usmHMACSHA1AuthProtocol.";
properlength = BYTESIZE(SNMP_TRANS_AUTHLEN_HMACSHA1);
goto test_genKu_again;
}
return failcount;
} /* end test_genKu() */
/*******************************************************************-o-******
* test_genkul
*
* Returns:
* Number of failures.
*
*
* Test of generate_kul().
*
* A passphrase and engineID are hashed into a master key Ku using
* both known hash transforms. Localized keys, also using both hash
* transforms, are generated from each of these master keys.
*
* ASSUME generate_Ku is already tested.
* ASSUME engineID is initially a NULL terminated string.
*/
int
test_genkul(void)
{
int rval = SNMPERR_SUCCESS,
failcount = 0,
properlength, engineID_len, isdefault = FALSE;
size_t kulen, kul_len;
char *s = NULL;
const char *testname = "Using HMACMD5 to create master key.";
const char *hashname_Ku = "usmHMACMD5AuthProtocol";
u_char Ku[LOCAL_MAXBUF], kul[LOCAL_MAXBUF];
oid *hashtype_Ku = usmHMACMD5AuthProtocol, *hashtype_kul;
OUTPUT("Test of generate_kul --");
/*
* Set passphrase and engineID.
*
* If engineID begins with 0x, assume it is written in (printable)
* hex and convert it to binary data.
*/
if (!passphrase) {
passphrase = strdup(PASSPHRASE_DEFAULT);
}
if (!bequiet)
fprintf(stdout, "# Passphrase%s: %s\n",
(strcmp(passphrase, PASSPHRASE_DEFAULT) == 0) ? " (default)" : "",
passphrase);
if (!engineID) {
engineID = (u_char *) strdup(ENGINEID_DEFAULT);
isdefault = TRUE;
}
engineID_len = strlen((char *) engineID);
if (tolower(*(engineID + 1)) == 'x') {
engineID_len =
hex_to_binary2(engineID + 2, engineID_len - 2, &s);
FAILED((engineID_len < 0),
"Could not resolve hex engineID.");
engineID = (u_char *) s;
binary_to_hex(engineID, engineID_len, &s);
}
if (!bequiet)
fprintf(stdout, "# engineID%s (len=%d): %s\n",
(isdefault) ? " (default)" : "",
engineID_len, ((s != 0) ? ((u_char *) s) : engineID));
SNMP_FREE(s);
/*
* Create a master key using both hash transforms; create localized
* keys using both hash transforms from each master key.
*/
test_genkul_again_master:
memset(Ku, 0, LOCAL_MAXBUF);
kulen = LOCAL_MAXBUF;
hashtype_kul = usmHMACMD5AuthProtocol;
properlength = BYTESIZE(SNMP_TRANS_AUTHLEN_HMACMD5);
rval = generate_Ku(hashtype_Ku, USM_LENGTH_OID_TRANSFORM,
(u_char *) passphrase, strlen(passphrase), Ku, &kulen);
FAILED(rval, "generate_Ku().");
binary_to_hex(Ku, kulen, &s);
if (!bequiet)
fprintf(stdout,
"# Master Ku using \"%s\": \t%s\n", hashname_Ku, s);
free_zero(s, kulen);
test_genkul_again_local:
memset(kul, 0, LOCAL_MAXBUF);
kul_len = LOCAL_MAXBUF;
rval = generate_kul(hashtype_kul, USM_LENGTH_OID_TRANSFORM,
engineID, engineID_len, Ku, kulen, kul, &kul_len);
if ((hashtype_Ku == usmHMACMD5AuthProtocol)
&& (hashtype_kul == usmHMACSHA1AuthProtocol)) {
FAILED((rval == SNMPERR_SUCCESS),
"generate_kul SHOULD fail when Ku length is "
"less than hash transform length.");
} else {
FAILED(rval, "generate_kul().");
FAILED(kul_len != properlength,
"checking if kul length is right for the given hashtype.");
binary_to_hex(kul, kul_len, &s);
fprintf(stdout, "# kul (%s) (len=%" NETSNMP_PRIz "u): %s\n",
((hashtype_Ku == usmHMACMD5AuthProtocol) ? "MD5" : "SHA"),
kul_len, s);
free_zero(s, kul_len);
}
/*
* Create localized key using the other hash transform, but from
* * the same master key.
*/
if (hashtype_kul == usmHMACMD5AuthProtocol) {
hashtype_kul = usmHMACSHA1AuthProtocol;
properlength = BYTESIZE(SNMP_TRANS_AUTHLEN_HMACSHA1);
goto test_genkul_again_local;
}
SUCCESS(testname);
/*
* Re-create the master key using the other hash transform.
*/
if (hashtype_Ku == usmHMACMD5AuthProtocol) {
hashtype_Ku = usmHMACSHA1AuthProtocol;
hashname_Ku = "usmHMACSHA1AuthProtocol";
testname = "Using HMACSHA1 to create master key.";
goto test_genkul_again_master;
}
return failcount;
} /* end test_genkul() */
/*******************************************************************-o-******
* test_keychange
*
* Returns:
* Number of failures.
*
*
* Test of KeyChange TC implementation.
*
* ASSUME newkey and oldkey begin as NULL terminated strings.
*/
int
test_keychange(void)
{
int rval = SNMPERR_SUCCESS,
failcount = 0,
properlength = BYTESIZE(SNMP_TRANS_AUTHLEN_HMACMD5),
oldkey_len,
newkey_len,
isdefault_new = FALSE, isdefault_old = FALSE;
size_t keychange_len, temp_len;
const char *hashname = "usmHMACMD5AuthProtocol.";
char *s;
u_char oldkey_buf[LOCAL_MAXBUF],
newkey_buf[LOCAL_MAXBUF],
temp_buf[LOCAL_MAXBUF], keychange_buf[LOCAL_MAXBUF];
oid *hashtype = usmHMACMD5AuthProtocol;
OUTPUT("Test of KeyChange TC --");
/*
* Set newkey and oldkey.
*/
if (!newkey) { /* newkey */
newkey = (const u_char *) NEWKEY_DEFAULT;
isdefault_new = TRUE;
}
newkey_len = strlen((const char *) newkey);
if (tolower(*(newkey + 1)) == 'x') {
newkey_len = hex_to_binary2((const u_char *) newkey + 2,
newkey_len - 2, &s);
FAILED(newkey_len < 0,
"Could not resolve hex newkey.");
newkey = (const u_char *) s;
binary_to_hex((const u_char *) newkey, newkey_len, &s);
}
if (!oldkey) { /* oldkey */
oldkey = (const u_char *) OLDKEY_DEFAULT;
isdefault_old = TRUE;
}
oldkey_len = strlen((const char *) oldkey);
if (tolower(*(oldkey + 1)) == 'x') {
oldkey_len = hex_to_binary2((const u_char *) oldkey + 2,
oldkey_len - 2, &s);
FAILED(oldkey_len < 0,
"Could not resolve hex oldkey.");
oldkey = (const u_char *) s;
binary_to_hex(oldkey, oldkey_len, &s);
}
test_keychange_again:
memset(oldkey_buf, 0, LOCAL_MAXBUF);
memset(newkey_buf, 0, LOCAL_MAXBUF);
memset(keychange_buf, 0, LOCAL_MAXBUF);
memset(temp_buf, 0, LOCAL_MAXBUF);
memcpy(oldkey_buf, oldkey, SNMP_MIN(oldkey_len, properlength));
memcpy(newkey_buf, newkey, SNMP_MIN(newkey_len, properlength));
keychange_len = LOCAL_MAXBUF;
binary_to_hex(oldkey_buf, properlength, &s);
fprintf(stdout, "# oldkey%s (len=%d): %s\n",
(isdefault_old) ? " (default)" : "", properlength, s);
SNMP_FREE(s);
binary_to_hex(newkey_buf, properlength, &s);
fprintf(stdout, "# newkey%s (len=%d): %s\n",
(isdefault_new) ? " (default)" : "", properlength, s);
SNMP_FREE(s);
rval = encode_keychange(hashtype, USM_LENGTH_OID_TRANSFORM,
oldkey_buf, properlength,
newkey_buf, properlength,
keychange_buf, &keychange_len);
FAILED(rval, "encode_keychange().");
FAILED(keychange_len != (properlength * 2),
"KeyChange string (encoded) is not proper length "
"for this hash transform.");
binary_to_hex(keychange_buf, keychange_len, &s);
fprintf(stdout, "# (%s) KeyChange string: %s\n",
((hashtype == usmHMACMD5AuthProtocol) ? "MD5" : "SHA"), s);
SNMP_FREE(s);
temp_len = properlength;
rval = decode_keychange(hashtype, USM_LENGTH_OID_TRANSFORM,
oldkey_buf, properlength,
keychange_buf, properlength * 2,
temp_buf, &temp_len);
FAILED(rval, "decode_keychange().");
FAILED(temp_len != properlength,
"decoded newkey is not proper length for "
"this hash transform.");
binary_to_hex(temp_buf, temp_len, &s);
fprintf(stdout, "# decoded newkey: %s\n", s);
SNMP_FREE(s);
FAILED(memcmp(newkey_buf, temp_buf, temp_len),
"newkey did not decode properly.");
SUCCESS(hashname);
/*
* Multiplex different test combinations.
*
* First clause is for Test #2, second clause is for (last) Test #3.
*/
if (hashtype == usmHMACMD5AuthProtocol) {
hashtype = usmHMACSHA1AuthProtocol;
hashname = "usmHMACSHA1AuthProtocol (w/DES length kul's).";
properlength = BYTESIZE(SNMP_TRANS_PRIVLEN_1DES)
+ BYTESIZE(SNMP_TRANS_PRIVLEN_1DES_IV);
goto test_keychange_again;
} else if (properlength < BYTESIZE(SNMP_TRANS_AUTHLEN_HMACSHA1)) {
hashtype = usmHMACSHA1AuthProtocol;
hashname = "usmHMACSHA1AuthProtocol.";
properlength = BYTESIZE(SNMP_TRANS_AUTHLEN_HMACSHA1);
goto test_keychange_again;
}
return failcount;
} /* end test_keychange() */