int DecryptString(char type, char *in, char *out, unsigned char *key, int cipherlen)
{
int plainlen = 0, tmplen;
unsigned char iv[32] =
{ 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8 };
EVP_CIPHER_CTX ctx;
EVP_CIPHER_CTX_init(&ctx);
EVP_DecryptInit_ex(&ctx, CfengineCipher(type), NULL, key, iv);
if (!EVP_DecryptUpdate(&ctx, out, &plainlen, in, cipherlen))
{
Log(LOG_LEVEL_ERR, "Failed to decrypt string");
EVP_CIPHER_CTX_cleanup(&ctx);
return -1;
}
if (!EVP_DecryptFinal_ex(&ctx, out + plainlen, &tmplen))
{
unsigned long err = ERR_get_error();
Log(LOG_LEVEL_ERR, "Failed to decrypt at final of cipher length %d. (EVP_DecryptFinal_ex: %s)", cipherlen, ERR_error_string(err, NULL));
EVP_CIPHER_CTX_cleanup(&ctx);
return -1;
}
plainlen += tmplen;
EVP_CIPHER_CTX_cleanup(&ctx);
return plainlen;
}
int EncryptString(char type, char *in, char *out, unsigned char *key, int plainlen)
{
int cipherlen = 0, tmplen;
unsigned char iv[32] =
{ 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8 };
EVP_CIPHER_CTX ctx;
EVP_CIPHER_CTX_init(&ctx);
EVP_EncryptInit_ex(&ctx, CfengineCipher(type), NULL, key, iv);
if (!EVP_EncryptUpdate(&ctx, out, &cipherlen, in, plainlen))
{
EVP_CIPHER_CTX_cleanup(&ctx);
return -1;
}
if (!EVP_EncryptFinal_ex(&ctx, out + cipherlen, &tmplen))
{
EVP_CIPHER_CTX_cleanup(&ctx);
return -1;
}
cipherlen += tmplen;
EVP_CIPHER_CTX_cleanup(&ctx);
return cipherlen;
}
int DecryptString(char type, char *in, char *out, unsigned char *key, int cipherlen)
{
int plainlen = 0, tmplen;
unsigned char iv[32] =
{ 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8 };
EVP_CIPHER_CTX ctx;
EVP_CIPHER_CTX_init(&ctx);
EVP_DecryptInit_ex(&ctx, CfengineCipher(type), NULL, key, iv);
if (!EVP_DecryptUpdate(&ctx, out, &plainlen, in, cipherlen))
{
CfOut(OUTPUT_LEVEL_ERROR, "", "!! Decrypt FAILED");
EVP_CIPHER_CTX_cleanup(&ctx);
return -1;
}
if (!EVP_DecryptFinal_ex(&ctx, out + plainlen, &tmplen))
{
unsigned long err = ERR_get_error();
CfOut(OUTPUT_LEVEL_ERROR, "", "decryption FAILED at final of %d: %s\n", cipherlen, ERR_error_string(err, NULL));
EVP_CIPHER_CTX_cleanup(&ctx);
return -1;
}
plainlen += tmplen;
EVP_CIPHER_CTX_cleanup(&ctx);
return plainlen;
}
void CfEncryptGetFile(ServerFileGetState *args)
/* Because the stream doesn't end for each file, we need to know the
exact number of bytes transmitted, which might change during
encryption, hence we need to handle this with transactions */
{
int fd, n_read, cipherlen, finlen;
off_t total = 0, count = 0;
char sendbuffer[CF_BUFSIZE + 256], out[CF_BUFSIZE], filename[CF_BUFSIZE];
unsigned char iv[32] =
{ 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8 };
int blocksize = CF_BUFSIZE - 4 * CF_INBAND_OFFSET;
EVP_CIPHER_CTX ctx;
char *key, enctype;
struct stat sb;
ConnectionInfo *conn_info = &args->connect->conn_info;
key = (args->connect)->session_key;
enctype = (args->connect)->encryption_type;
TranslatePath(filename, args->replyfile);
stat(filename, &sb);
Log(LOG_LEVEL_DEBUG, "CfEncryptGetFile('%s'), size = %" PRIdMAX, filename, (intmax_t) sb.st_size);
/* Now check to see if we have remote permission */
if (!TransferRights(filename, args, &sb))
{
RefuseAccess(args->connect, args->buf_size, "");
FailedTransfer(conn_info);
}
EVP_CIPHER_CTX_init(&ctx);
if ((fd = open(filename, O_RDONLY)) == -1)
{
Log(LOG_LEVEL_ERR, "Open error of file '%s'. (open: %s)", filename, GetErrorStr());
FailedTransfer(conn_info);
}
else
{
int div = 3;
if (sb.st_size > 10485760L) /* File larger than 10 MB, checks every 64kB */
{
div = 32;
}
while (true)
{
memset(sendbuffer, 0, CF_BUFSIZE);
if ((n_read = read(fd, sendbuffer, blocksize)) == -1)
{
Log(LOG_LEVEL_ERR, "Read failed in EncryptGetFile. (read: %s)", GetErrorStr());
break;
}
off_t savedlen = sb.st_size;
if (count++ % div == 0) /* Don't do this too often */
{
Log(LOG_LEVEL_DEBUG, "Restatting '%s' - size %d", filename, n_read);
if (stat(filename, &sb))
{
Log(LOG_LEVEL_ERR, "Cannot stat file '%s' (stat: %s)",
filename, GetErrorStr());
break;
}
}
if (sb.st_size != savedlen)
{
AbortTransfer(conn_info, filename);
break;
}
total += n_read;
if (n_read > 0)
{
EVP_EncryptInit_ex(&ctx, CfengineCipher(enctype), NULL, key, iv);
if (!EVP_EncryptUpdate(&ctx, out, &cipherlen, sendbuffer, n_read))
{
FailedTransfer(conn_info);
EVP_CIPHER_CTX_cleanup(&ctx);
close(fd);
return;
}
if (!EVP_EncryptFinal_ex(&ctx, out + cipherlen, &finlen))
{
FailedTransfer(conn_info);
EVP_CIPHER_CTX_cleanup(&ctx);
close(fd);
return;
}
}
if (total >= savedlen)
{
if (SendTransaction(conn_info, out, cipherlen + finlen, CF_DONE) == -1)
{
Log(LOG_LEVEL_VERBOSE, "Send failed in GetFile. (send: %s)", GetErrorStr());
EVP_CIPHER_CTX_cleanup(&ctx);
close(fd);
return;
}
break;
}
else
{
if (SendTransaction(conn_info, out, cipherlen + finlen, CF_MORE) == -1)
{
Log(LOG_LEVEL_VERBOSE, "Send failed in GetFile. (send: %s)", GetErrorStr());
close(fd);
EVP_CIPHER_CTX_cleanup(&ctx);
return;
}
}
}
}
EVP_CIPHER_CTX_cleanup(&ctx);
close(fd);
}
int EncryptCopyRegularFileNet(const char *source, const char *dest, off_t size, AgentConnection *conn)
{
int dd, blocksize = 2048, n_read = 0, towrite, plainlen, more = true, finlen, cnt = 0;
int tosend, cipherlen = 0;
char *buf, in[CF_BUFSIZE], out[CF_BUFSIZE], workbuf[CF_BUFSIZE], cfchangedstr[265];
unsigned char iv[32] =
{ 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8 };
long n_read_total = 0;
EVP_CIPHER_CTX crypto_ctx;
snprintf(cfchangedstr, 255, "%s%s", CF_CHANGEDSTR1, CF_CHANGEDSTR2);
if ((strlen(dest) > CF_BUFSIZE - 20))
{
Log(LOG_LEVEL_ERR, "Filename too long");
return false;
}
unlink(dest); /* To avoid link attacks */
if ((dd = safe_open(dest, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL | O_BINARY, 0600)) == -1)
{
Log(LOG_LEVEL_ERR,
"Copy from server '%s' to destination '%s' failed (open: %s)",
conn->this_server, dest, GetErrorStr());
unlink(dest);
return false;
}
if (size == 0)
{
// No sense in copying an empty file
close(dd);
return true;
}
workbuf[0] = '\0';
EVP_CIPHER_CTX_init(&crypto_ctx);
snprintf(in, CF_BUFSIZE - CF_PROTO_OFFSET, "GET dummykey %s", source);
cipherlen = EncryptString(conn->encryption_type, in, out, conn->session_key, strlen(in) + 1);
snprintf(workbuf, CF_BUFSIZE, "SGET %4d %4d", cipherlen, blocksize);
memcpy(workbuf + CF_PROTO_OFFSET, out, cipherlen);
tosend = cipherlen + CF_PROTO_OFFSET;
/* Send proposition C0 - query */
if (SendTransaction(conn->conn_info, workbuf, tosend, CF_DONE) == -1)
{
Log(LOG_LEVEL_ERR, "Couldn't send data. (SendTransaction: %s)", GetErrorStr());
close(dd);
return false;
}
buf = xmalloc(CF_BUFSIZE + sizeof(int));
n_read_total = 0;
while (more)
{
if ((cipherlen = ReceiveTransaction(conn->conn_info, buf, &more)) == -1)
{
free(buf);
return false;
}
cnt++;
/* If the first thing we get is an error message, break. */
if ((n_read_total == 0) && (strncmp(buf + CF_INBAND_OFFSET, CF_FAILEDSTR, strlen(CF_FAILEDSTR)) == 0))
{
Log(LOG_LEVEL_INFO, "Network access to '%s:%s' denied", conn->this_server, source);
close(dd);
free(buf);
return false;
}
if (strncmp(buf + CF_INBAND_OFFSET, cfchangedstr, strlen(cfchangedstr)) == 0)
{
Log(LOG_LEVEL_INFO, "Source '%s:%s' changed while copying", conn->this_server, source);
close(dd);
free(buf);
return false;
}
EVP_DecryptInit_ex(&crypto_ctx, CfengineCipher(CfEnterpriseOptions()), NULL, conn->session_key, iv);
if (!EVP_DecryptUpdate(&crypto_ctx, workbuf, &plainlen, buf, cipherlen))
{
close(dd);
free(buf);
return false;
}
if (!EVP_DecryptFinal_ex(&crypto_ctx, workbuf + plainlen, &finlen))
{
close(dd);
free(buf);
return false;
}
towrite = n_read = plainlen + finlen;
n_read_total += n_read;
if (!FSWrite(dest, dd, workbuf, towrite))
{
Log(LOG_LEVEL_ERR, "Local disk write failed copying '%s:%s' to '%s:%s'",
conn->this_server, source, dest, GetErrorStr());
if (conn)
{
conn->error = true;
}
free(buf);
unlink(dest);
close(dd);
EVP_CIPHER_CTX_cleanup(&crypto_ctx);
return false;
}
}
/* If the file ends with a `hole', something needs to be written at
the end. Otherwise the kernel would truncate the file at the end
of the last write operation. Write a null character and truncate
it again. */
if (ftruncate(dd, n_read_total) < 0)
{
Log(LOG_LEVEL_ERR, "Copy failed (no space?) while copying '%s' from network '%s'",
dest, GetErrorStr());
free(buf);
unlink(dest);
close(dd);
EVP_CIPHER_CTX_cleanup(&crypto_ctx);
return false;
}
close(dd);
free(buf);
EVP_CIPHER_CTX_cleanup(&crypto_ctx);
return true;
}
int EncryptCopyRegularFileNet(const char *source, const char *dest, off_t size, AgentConnection *conn)
{
int dd, blocksize = 2048, n_read = 0, plainlen, more = true, finlen, cnt = 0;
int tosend, cipherlen = 0;
char *buf, in[CF_BUFSIZE], out[CF_BUFSIZE], workbuf[CF_BUFSIZE], cfchangedstr[265];
unsigned char iv[32] =
{ 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8 };
EVP_CIPHER_CTX crypto_ctx;
snprintf(cfchangedstr, 255, "%s%s", CF_CHANGEDSTR1, CF_CHANGEDSTR2);
if ((strlen(dest) > CF_BUFSIZE - 20))
{
Log(LOG_LEVEL_ERR, "Filename too long");
return false;
}
unlink(dest); /* To avoid link attacks */
if ((dd = safe_open(dest, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL | O_BINARY, 0600)) == -1)
{
Log(LOG_LEVEL_ERR,
"Copy from server '%s' to destination '%s' failed (open: %s)",
conn->this_server, dest, GetErrorStr());
unlink(dest);
return false;
}
if (size == 0)
{
// No sense in copying an empty file
close(dd);
return true;
}
workbuf[0] = '\0';
EVP_CIPHER_CTX_init(&crypto_ctx);
snprintf(in, CF_BUFSIZE - CF_PROTO_OFFSET, "GET dummykey %s", source);
cipherlen = EncryptString(out, sizeof(out), in, strlen(in) + 1, conn->encryption_type, conn->session_key);
tosend = cipherlen + CF_PROTO_OFFSET;
if(tosend > sizeof(workbuf))
{
ProgrammingError("EncryptCopyRegularFileNet: tosend (%d) > workbuf (%ld)",
tosend, sizeof(workbuf));
}
snprintf(workbuf, CF_BUFSIZE, "SGET %4d %4d", cipherlen, blocksize);
memcpy(workbuf + CF_PROTO_OFFSET, out, cipherlen);
/* Send proposition C0 - query */
if (SendTransaction(conn->conn_info, workbuf, tosend, CF_DONE) == -1)
{
Log(LOG_LEVEL_ERR, "Couldn't send data. (SendTransaction: %s)", GetErrorStr());
close(dd);
return false;
}
buf = xmalloc(CF_BUFSIZE + sizeof(int));
bool last_write_made_hole = false;
size_t n_wrote_total = 0;
while (more)
{
if ((cipherlen = ReceiveTransaction(conn->conn_info, buf, &more)) == -1)
{
free(buf);
return false;
}
cnt++;
/* If the first thing we get is an error message, break. */
if (n_wrote_total == 0 &&
strncmp(buf + CF_INBAND_OFFSET, CF_FAILEDSTR, strlen(CF_FAILEDSTR)) == 0)
{
Log(LOG_LEVEL_INFO, "Network access to '%s:%s' denied", conn->this_server, source);
close(dd);
free(buf);
return false;
}
if (strncmp(buf + CF_INBAND_OFFSET, cfchangedstr, strlen(cfchangedstr)) == 0)
{
Log(LOG_LEVEL_INFO, "Source '%s:%s' changed while copying", conn->this_server, source);
close(dd);
free(buf);
return false;
}
EVP_DecryptInit_ex(&crypto_ctx, CfengineCipher(CfEnterpriseOptions()), NULL, conn->session_key, iv);
if (!EVP_DecryptUpdate(&crypto_ctx, workbuf, &plainlen, buf, cipherlen))
{
close(dd);
free(buf);
return false;
}
if (!EVP_DecryptFinal_ex(&crypto_ctx, workbuf + plainlen, &finlen))
{
close(dd);
free(buf);
return false;
}
n_read = plainlen + finlen;
bool w_ok = FileSparseWrite(dd, workbuf, n_read,
&last_write_made_hole);
if (!w_ok)
{
Log(LOG_LEVEL_ERR,
"Local disk write failed copying '%s:%s' to '%s'",
conn->this_server, source, dest);
free(buf);
unlink(dest);
close(dd);
conn->error = true;
EVP_CIPHER_CTX_cleanup(&crypto_ctx);
return false;
}
n_wrote_total += n_read;
}
const bool do_sync = false;
bool ret = FileSparseClose(dd, dest, do_sync,
n_wrote_total, last_write_made_hole);
if (!ret)
{
unlink(dest);
free(buf);
EVP_CIPHER_CTX_cleanup(&crypto_ctx);
return false;
}
free(buf);
EVP_CIPHER_CTX_cleanup(&crypto_ctx);
return true;
}
