OpenVAS Scanner 23.23.1
nasl_crypto2.c File Reference

This file contains all the crypto functionality needed by the SSH protocol. More...

#include "nasl_crypto2.h"
#include "../misc/strutils.h"
#include "nasl_crypto_helper.h"
#include "nasl_debug.h"
#include "nasl_func.h"
#include "nasl_global_ctxt.h"
#include "nasl_lex_ctxt.h"
#include "nasl_misc_funcs.h"
#include "nasl_packet_forgery.h"
#include "nasl_tree.h"
#include "nasl_var.h"
#include <arpa/inet.h>
#include <gcrypt.h>
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
#include <gpg-error.h>
#include <gvm/base/logging.h>
#include <stddef.h>
#include <stdlib.h>

Data Structures

struct  cipher_table_item
 Struct holding a cipher handler. More...

Macros

#define INTBLOB_LEN   20
#define SIGBLOB_LEN   (2 * INTBLOB_LEN)
#define MAX_CIPHER_ID   32
#define NASL_ENCRYPT   0
#define NASL_DECRYPT   1
#define NASL_AAD   2
#define G_LOG_DOMAIN   "lib nasl"
 GLib logging domain.
#define NUM_RSA_PARAMS   6
 Creates a libgcryt s-expression from a GnuTLS private RSA key.

Typedefs

typedef struct cipher_table_item cipher_table_item_t

Functions

static void print_tls_error (lex_ctxt *lexic, char *txt, int err)
 Prints a GnuTLS error.
static void print_gcrypt_error (lex_ctxt *lexic, char *function, int err)
 Prints a libgcrypt error.
static int find_cipher_hd (cipher_table_item_t *cipher_elem, int *id)
 Helper function to find cipher id in the table.
static int get_new_cipher_id (void)
 Helper function to get a free id for a new cipher.
static gcry_cipher_hd_t verify_cipher_id (lex_ctxt *lexic, int cipher_id)
 Helper function to validate the cipher id.
static cipher_table_item_tcipher_table_item_new (void)
 Create a new cipher handler item parameter.
static void delete_cipher_item (int cipher_id)
 Free and remove a cipher handler from the cipher table.
static int mpi_from_string (lex_ctxt *lexic, gcry_mpi_t *dest, void *data, size_t len, const char *parameter, const char *function)
 Converts a string to a gcry_mpi_t.
static int mpi_from_named_parameter (lex_ctxt *lexic, gcry_mpi_t *dest, const char *parameter, const char *function)
 Converts a named nasl parameter to a gcry_mpi_t.
static int set_mpi_retc (tree_cell *retc, gcry_mpi_t mpi)
 Sets the return value in retc from the MPI mpi.
tree_cellnasl_bn_cmp (lex_ctxt *lexic)
tree_cellnasl_bn_random (lex_ctxt *lexic)
static gnutls_x509_privkey_t nasl_load_privkey_param (lex_ctxt *lexic, const char *priv_name, const char *passphrase_name)
 Loads a private key from a string.
static tree_cellnasl_pem_to (lex_ctxt *lexic, int type)
 Implements the nasl functions pem_to_rsa and pem_to_dsa.
tree_cellnasl_pem_to_rsa (lex_ctxt *lexic)
tree_cellnasl_pem_to_dsa (lex_ctxt *lexic)
static gcry_mpi_t calc_dh_public (gcry_mpi_t g, gcry_mpi_t prime, gcry_mpi_t priv)
 compute the diffie hellman public key.
static gcry_mpi_t calc_dh_key (gcry_mpi_t pub, gcry_mpi_t prime, gcry_mpi_t priv)
 Compute the diffie hellman shared secret key.
tree_cellnasl_dh_generate_key (lex_ctxt *lexic)
tree_cellnasl_dh_compute_key (lex_ctxt *lexic)
static gcry_mpi_t extract_mpi_from_sexp (gcry_sexp_t sexp, const char *token)
 Extracts an MPI value from a libgcryt s-expression.
static int set_retc_from_sexp (tree_cell *retc, gcry_sexp_t sexp, const char *token)
 Sets the return value in retc from an sexpression.
static int strip_pkcs1_padding (tree_cell *retc)
 Strips PKCS#1 padding from the string in retc.
tree_cellnasl_rsa_public_encrypt (lex_ctxt *lexic)
tree_cellnasl_rsa_private_decrypt (lex_ctxt *lexic)
tree_cellnasl_rsa_public_decrypt (lex_ctxt *lexic)
static gcry_sexp_t nasl_sexp_from_privkey (lex_ctxt *lexic, gnutls_x509_privkey_t privkey)
tree_cellnasl_rsa_sign (lex_ctxt *lexic)
tree_cellnasl_dsa_do_verify (lex_ctxt *lexic)
tree_cellnasl_dsa_do_sign (lex_ctxt *lexic)
static tree_cellnasl_bf_cbc (lex_ctxt *lexic, int enc)
 Implements the nasl functions bf_cbc_encrypt and bf_cbc_decrypt.
tree_cellnasl_bf_cbc_encrypt (lex_ctxt *lexic)
tree_cellnasl_bf_cbc_decrypt (lex_ctxt *lexic)
static tree_cellnasl_open_stream_cipher (lex_ctxt *lexic, int cipher, int mode, const char *caller_func)
 Open a stream cipher. This function creates a context handle and stores it in a cipher table. Open cipher must be deleted with delete_cipher_item() at the end of the stream encryption.
static tree_cellencrypt_stream_data (lex_ctxt *lexic, int cipher, const char *caller_func)
 Encrypt data using an existent cipher handle. As the handler is not close, the key is updated to encrypt the next block of the stream data.
tree_cellnasl_close_stream_cipher (lex_ctxt *lexic)
 Nasl function to delete a cipher item from the cipher table.
static tree_cellnasl_mac (lex_ctxt *lexic, int algo, int flags)
tree_cellnasl_aes_mac_cbc (lex_ctxt *lexic)
tree_cellnasl_aes_mac_gcm (lex_ctxt *lexic)
static tree_cellcrypt_data (lex_ctxt *lexic, int cipher, int mode, int flags)
tree_cellnasl_rc4_encrypt (lex_ctxt *lexic)
 Nasl function to encrypt data with a RC4 cipher. If an hd param exist in the lexix context, it will use this handler to encrypt the data as part of a stream data. e.g.: rc4_encrypt(data: data, hd: hd)
tree_cellnasl_open_rc4_cipher (lex_ctxt *lexic)
 Nasl function to open RC4 cipher to encrypt a stream of data. The handler can be used to encrypt stream data. Open cipher must be close with close_stream_cipher() when it is not useful anymore.
tree_cellnasl_aes128_cbc_encrypt (lex_ctxt *lexic)
tree_cellnasl_aes256_cbc_encrypt (lex_ctxt *lexic)
tree_cellnasl_aes128_ctr_encrypt (lex_ctxt *lexic)
tree_cellnasl_aes256_ctr_encrypt (lex_ctxt *lexic)
tree_cellnasl_des_ede_cbc_encrypt (lex_ctxt *lexic)
tree_cellnasl_aes128_gcm_encrypt (lex_ctxt *lexic)
tree_cellnasl_aes128_gcm_encrypt_auth (lex_ctxt *lexic)
tree_cellnasl_aes128_gcm_decrypt (lex_ctxt *lexic)
tree_cellnasl_aes128_gcm_decrypt_auth (lex_ctxt *lexic)
tree_cellnasl_aes256_gcm_encrypt (lex_ctxt *lexic)
tree_cellnasl_aes256_gcm_encrypt_auth (lex_ctxt *lexic)
tree_cellnasl_aes256_gcm_decrypt (lex_ctxt *lexic)
tree_cellnasl_aes256_gcm_decrypt_auth (lex_ctxt *lexic)
tree_cellnasl_aes128_ccm_encrypt (lex_ctxt *lexic)
tree_cellnasl_aes128_ccm_encrypt_auth (lex_ctxt *lexic)
tree_cellnasl_aes128_ccm_decrypt (lex_ctxt *lexic)
tree_cellnasl_aes128_ccm_decrypt_auth (lex_ctxt *lexic)
tree_cellnasl_aes256_ccm_encrypt (lex_ctxt *lexic)
tree_cellnasl_aes256_ccm_encrypt_auth (lex_ctxt *lexic)
tree_cellnasl_aes256_ccm_decrypt (lex_ctxt *lexic)
tree_cellnasl_aes256_ccm_decrypt_auth (lex_ctxt *lexic)
tree_cellnasl_smb3kdf (lex_ctxt *lexic)
 Add the SMB3KDF as specified in [SP800-108] section 5.1.

Variables

static GList * cipher_table = NULL
 List of open cipher handler.

Detailed Description

This file contains all the crypto functionality needed by the SSH protocol.

Macro Definition Documentation

◆ G_LOG_DOMAIN

#define G_LOG_DOMAIN   "lib nasl"

GLib logging domain.

◆ INTBLOB_LEN

#define INTBLOB_LEN   20

◆ MAX_CIPHER_ID

#define MAX_CIPHER_ID   32

◆ NASL_AAD

#define NASL_AAD   2

◆ NASL_DECRYPT

#define NASL_DECRYPT   1

◆ NASL_ENCRYPT

#define NASL_ENCRYPT   0

◆ NUM_RSA_PARAMS

#define NUM_RSA_PARAMS   6

Creates a libgcryt s-expression from a GnuTLS private RSA key.

◆ SIGBLOB_LEN

#define SIGBLOB_LEN   (2 * INTBLOB_LEN)

Typedef Documentation

◆ cipher_table_item_t

Function Documentation

◆ calc_dh_key()

gcry_mpi_t calc_dh_key ( gcry_mpi_t pub,
gcry_mpi_t prime,
gcry_mpi_t priv )
static

Compute the diffie hellman shared secret key.

Neither GnuTLS nor libgcrypt contain a direct counterpart to OpenSSL's DH_compute_key, so we implement it ourselves. This function was copied from from gnutls and adapted to use gcrypt directly and to use a private key given as parameter to the function.

Returns
The key on success and NULL on failure.

◆ calc_dh_public()

gcry_mpi_t calc_dh_public ( gcry_mpi_t g,
gcry_mpi_t prime,
gcry_mpi_t priv )
static

compute the diffie hellman public key.

Neither GnuTLS nor Libgcrypt contain a direct counterpart to OpenSSL's DH_generate_key, so we implement it ourselves. This function was copied from from gnutls and adapted to use gcrypt directly and to use a private key given as parameter to the function.

Returns
The key on success and NULL on failure.

◆ cipher_table_item_new()

cipher_table_item_t * cipher_table_item_new ( void )
static

Create a new cipher handler item parameter.

Returns
New cipher handler item.

◆ crypt_data()

tree_cell * crypt_data ( lex_ctxt * lexic,
int cipher,
int mode,
int flags )
static

◆ delete_cipher_item()

void delete_cipher_item ( int cipher_id)
static

Free and remove a cipher handler from the cipher table.

Parameters
[in]cipher_idID of the cipher handler to free and remove.
Returns
0 on success, -1 on error.

◆ encrypt_stream_data()

tree_cell * encrypt_stream_data ( lex_ctxt * lexic,
int cipher,
const char * caller_func )
static

Encrypt data using an existent cipher handle. As the handler is not close, the key is updated to encrypt the next block of the stream data.

Parameters
[in]cipherThe cipher algorithm. It must be the same used for the handler. It is used to prepare the data. Only GCRY_CIPHER_ARCFOUR is currently supported.
[in]caller_funcName of the caller function to be logged in case of error.
Returns
Returns the encrypted data on success. Otherwise NULL.

◆ extract_mpi_from_sexp()

gcry_mpi_t extract_mpi_from_sexp ( gcry_sexp_t sexp,
const char * token )
static

Extracts an MPI value from a libgcryt s-expression.

The return value is the cadr of the subexpression whose car is given by token. The function returns NULL if the token doesn't occur in the expression or on other errors.

◆ find_cipher_hd()

int find_cipher_hd ( cipher_table_item_t * cipher_elem,
int * id )
static

Helper function to find cipher id in the table.

Returns
0 if the cipher id exits/is in used. -1 otherwise.

◆ get_new_cipher_id()

int get_new_cipher_id ( void )
static

Helper function to get a free id for a new cipher.

Returns
Id for the new cipher.

◆ mpi_from_named_parameter()

int mpi_from_named_parameter ( lex_ctxt * lexic,
gcry_mpi_t * dest,
const char * parameter,
const char * function )
static

Converts a named nasl parameter to a gcry_mpi_t.

The new MPI object is stored in dest. The parameter parameter is the name of the parameter to be taken from lexic. The parameter function is used in error messages to indicate the name of the nasl function.

Returns
0 on success and -1 on failure.

◆ mpi_from_string()

int mpi_from_string ( lex_ctxt * lexic,
gcry_mpi_t * dest,
void * data,
size_t len,
const char * parameter,
const char * function )
static

Converts a string to a gcry_mpi_t.

The string of len bytes at data should contain the MPI as an unsigned int in bigendian form (libgcrypt's GCRYMPI_FMT_USG). The new MPI object is stored in dest. The parameters function and parameter are used in error messages to indicate the nasl function and nasl parameter name of the MPI. The lexic parameter is passed through to the error reporting functions.

The function return 0 on success and -1 on failure.

◆ nasl_aes128_cbc_encrypt()

tree_cell * nasl_aes128_cbc_encrypt ( lex_ctxt * lexic)

◆ nasl_aes128_ccm_decrypt()

tree_cell * nasl_aes128_ccm_decrypt ( lex_ctxt * lexic)

◆ nasl_aes128_ccm_decrypt_auth()

tree_cell * nasl_aes128_ccm_decrypt_auth ( lex_ctxt * lexic)

◆ nasl_aes128_ccm_encrypt()

tree_cell * nasl_aes128_ccm_encrypt ( lex_ctxt * lexic)

◆ nasl_aes128_ccm_encrypt_auth()

tree_cell * nasl_aes128_ccm_encrypt_auth ( lex_ctxt * lexic)

◆ nasl_aes128_ctr_encrypt()

tree_cell * nasl_aes128_ctr_encrypt ( lex_ctxt * lexic)

◆ nasl_aes128_gcm_decrypt()

tree_cell * nasl_aes128_gcm_decrypt ( lex_ctxt * lexic)

◆ nasl_aes128_gcm_decrypt_auth()

tree_cell * nasl_aes128_gcm_decrypt_auth ( lex_ctxt * lexic)

◆ nasl_aes128_gcm_encrypt()

tree_cell * nasl_aes128_gcm_encrypt ( lex_ctxt * lexic)

◆ nasl_aes128_gcm_encrypt_auth()

tree_cell * nasl_aes128_gcm_encrypt_auth ( lex_ctxt * lexic)

◆ nasl_aes256_cbc_encrypt()

tree_cell * nasl_aes256_cbc_encrypt ( lex_ctxt * lexic)

◆ nasl_aes256_ccm_decrypt()

tree_cell * nasl_aes256_ccm_decrypt ( lex_ctxt * lexic)

◆ nasl_aes256_ccm_decrypt_auth()

tree_cell * nasl_aes256_ccm_decrypt_auth ( lex_ctxt * lexic)

◆ nasl_aes256_ccm_encrypt()

tree_cell * nasl_aes256_ccm_encrypt ( lex_ctxt * lexic)

◆ nasl_aes256_ccm_encrypt_auth()

tree_cell * nasl_aes256_ccm_encrypt_auth ( lex_ctxt * lexic)

◆ nasl_aes256_ctr_encrypt()

tree_cell * nasl_aes256_ctr_encrypt ( lex_ctxt * lexic)

◆ nasl_aes256_gcm_decrypt()

tree_cell * nasl_aes256_gcm_decrypt ( lex_ctxt * lexic)

◆ nasl_aes256_gcm_decrypt_auth()

tree_cell * nasl_aes256_gcm_decrypt_auth ( lex_ctxt * lexic)

◆ nasl_aes256_gcm_encrypt()

tree_cell * nasl_aes256_gcm_encrypt ( lex_ctxt * lexic)

◆ nasl_aes256_gcm_encrypt_auth()

tree_cell * nasl_aes256_gcm_encrypt_auth ( lex_ctxt * lexic)

◆ nasl_aes_mac_cbc()

tree_cell * nasl_aes_mac_cbc ( lex_ctxt * lexic)

◆ nasl_aes_mac_gcm()

tree_cell * nasl_aes_mac_gcm ( lex_ctxt * lexic)

◆ nasl_bf_cbc()

tree_cell * nasl_bf_cbc ( lex_ctxt * lexic,
int enc )
static

Implements the nasl functions bf_cbc_encrypt and bf_cbc_decrypt.

◆ nasl_bf_cbc_decrypt()

tree_cell * nasl_bf_cbc_decrypt ( lex_ctxt * lexic)

nasl function

bf_cbc_decrypt(key:key, iv:iv, data:data)

Decrypt the cipher text data using the blowfish algorithm in CBC mode with the key key and the initialization vector iv. The key must be 16 bytes long. The iv must be at least 8 bytes long. data must be a multiple of 8 bytes long.

The return value is an array a with a[0] being the plaintext data and a[1] the new initialization vector to use for the next part of the data.

◆ nasl_bf_cbc_encrypt()

tree_cell * nasl_bf_cbc_encrypt ( lex_ctxt * lexic)

nasl function

bf_cbc_encrypt(key:key, iv:iv, data:data)

Encrypt the plaintext data using the blowfish algorithm in CBC mode with the key key and the initialization vector iv. The key must be 16 bytes long. The iv must be at least 8 bytes long. data must be a multiple of 8 bytes long.

The return value is an array a with a[0] being the encrypted data and a[1] the new initialization vector to use for the next part of the data.

◆ nasl_bn_cmp()

tree_cell * nasl_bn_cmp ( lex_ctxt * lexic)

nasl function

bn_cmp(key1:MPI1, key2:MPI2)

Compares the MPIs key1 and key2 (given as binary strings). Returns -1 if key1 < key2, 0 if key1 == key2 and +1 if key1 > key2.

◆ nasl_bn_random()

tree_cell * nasl_bn_random ( lex_ctxt * lexic)

nasl function

bn_random(need:numBits)

Returns
An MPI as a string with need bits of random data.

◆ nasl_close_stream_cipher()

tree_cell * nasl_close_stream_cipher ( lex_ctxt * lexic)

Nasl function to delete a cipher item from the cipher table.

Parameters
[in]cipher_idThe cipher id to close
Returns
Returns zero on success. Otherwise NULL.

◆ nasl_des_ede_cbc_encrypt()

tree_cell * nasl_des_ede_cbc_encrypt ( lex_ctxt * lexic)

◆ nasl_dh_compute_key()

tree_cell * nasl_dh_compute_key ( lex_ctxt * lexic)

nasl function

dh_compute_key(p:mpi_p, g:mpi_g, dh_server_pub:mpi_server_pub, pub_key:mpi_client_pub, priv_key:mpi_client_priv)

Computes the Diffie-Hellman shared secret key from the shared parameters p and g, the server's public key dh_server_pub and the client's public and private keys pub_key an priv_key. The return value is the shared secret key as an MPI.

◆ nasl_dh_generate_key()

tree_cell * nasl_dh_generate_key ( lex_ctxt * lexic)

nasl function

dh_generate_key(p:mpi_p, g:mpi_g, priv:mpi_priv)

Generates a Diffie-Hellman public key from the shared parameters p and g and the private parameter priv. The return value is the public key as an MPI.

◆ nasl_dsa_do_sign()

tree_cell * nasl_dsa_do_sign ( lex_ctxt * lexic)

nasl function

dsa_do_sign(p:mpi_p, g:mpi_g, q:mpi_q, pub:mpi_pub, priv:mpi_priv, data:hash)

Computes the DSA signature of the hash in data using the private DSA key given by p, g, q, pub and priv. The return value is a 40 byte string encoding the two MPIs r and s of the DSA signature. The first 20 bytes are the value of r and the last 20 bytes are the value of s.

◆ nasl_dsa_do_verify()

tree_cell * nasl_dsa_do_verify ( lex_ctxt * lexic)

nasl function

dsa_do_verify(p:mpi_p, g:mpi_g, q:mpi_q, pub:mpi_pub, r:mpi_r, s:mpi_s, data:hash)

Verify that the DSA signature given by r and s matches the hash given in data using the public DSA key given by p, g, q and pub. Returns 1 if the signature is valid and 0 if it's invalid.

◆ nasl_load_privkey_param()

gnutls_x509_privkey_t nasl_load_privkey_param ( lex_ctxt * lexic,
const char * priv_name,
const char * passphrase_name )
static

Loads a private key from a string.

The string is taken from the nasl parameter whose name is given by priv_name. The passphrase_name is the name of the parameter holding the passphrase if any. The string with the key must be in PEM format.

Returns
The GnuTLS private key object on success, NULL on failure.

◆ nasl_mac()

tree_cell * nasl_mac ( lex_ctxt * lexic,
int algo,
int flags )
static

◆ nasl_open_rc4_cipher()

tree_cell * nasl_open_rc4_cipher ( lex_ctxt * lexic)

Nasl function to open RC4 cipher to encrypt a stream of data. The handler can be used to encrypt stream data. Open cipher must be close with close_stream_cipher() when it is not useful anymore.

Returns
Returns the id of the cipher handler encrypted data on success. Otherwise NULL.

◆ nasl_open_stream_cipher()

tree_cell * nasl_open_stream_cipher ( lex_ctxt * lexic,
int cipher,
int mode,
const char * caller_func )
static

Open a stream cipher. This function creates a context handle and stores it in a cipher table. Open cipher must be deleted with delete_cipher_item() at the end of the stream encryption.

Parameters
[in]cipherThe cipher algorithm.
[in]modeThe cipher mode. Must be compatible with the algorithm.
[in]caller_funcName of the caller function to be logged in case of error.
Returns
Returns the ID of the cipher handler on success. Otherwise NULL.

◆ nasl_pem_to()

tree_cell * nasl_pem_to ( lex_ctxt * lexic,
int type )
static

Implements the nasl functions pem_to_rsa and pem_to_dsa.

◆ nasl_pem_to_dsa()

tree_cell * nasl_pem_to_dsa ( lex_ctxt * lexic)

nasl function

pem_to_dsa(priv:PEM, passphrase:PASSPHRASE)

Reads the private key from the string priv which contains a private DSA key in PEM format. Passphrase is the passphrase needed to decrypt the private key. The function returns the parameter "x" of the DSA key as an MPI.

◆ nasl_pem_to_rsa()

tree_cell * nasl_pem_to_rsa ( lex_ctxt * lexic)

nasl function

pem_to_rsa(priv:PEM, passphrase:PASSPHRASE)

Reads the private key from the string priv which contains a private RSA key in PEM format. Passphrase is the passphrase needed to decrypt the private key. The function returns the parameter "d" of the RSA key as an MPI.

◆ nasl_rc4_encrypt()

tree_cell * nasl_rc4_encrypt ( lex_ctxt * lexic)

Nasl function to encrypt data with a RC4 cipher. If an hd param exist in the lexix context, it will use this handler to encrypt the data as part of a stream data. e.g.: rc4_encrypt(data: data, hd: hd)

Otherwise encrypts the data as block and the key is mandatory: e.g.: rc4_encrypt(data: data, key: key)

Returns
Returns the encrypted data on success. Otherwise NULL.

◆ nasl_rsa_private_decrypt()

tree_cell * nasl_rsa_private_decrypt ( lex_ctxt * lexic)

nasl function

rsa_private_decrypt(data:data, d:mpi_d, e:mpi_e, n:mpi_n, pad:<TRUE:FALSE>)

Decrypt the provided data with the private RSA key given by its parameters d, e and n. The return value is the decrypted data in plaintext format.

TODO: In future releases, string support for padding should be removed

◆ nasl_rsa_public_decrypt()

tree_cell * nasl_rsa_public_decrypt ( lex_ctxt * lexic)

nasl function

rsa_public_decrypt(sig:signature, e:mpi_e, n:mpi_n)

Decrypt the data in signature (usually an rsa-encrypted hash) with the public RSA key given by its parameters e and n. The return value is the decrypted data.

◆ nasl_rsa_public_encrypt()

tree_cell * nasl_rsa_public_encrypt ( lex_ctxt * lexic)

nasl function

rsa_public_encrypt(data:data, e:mpi_e, n:mpi_n, pad:<TRUE:FALSE>)

Encrypt the provided data with the public RSA key given by its parameters e and n. The return value is the encrypted data.

TODO: In future releases, string support for padding should be removed

◆ nasl_rsa_sign()

tree_cell * nasl_rsa_sign ( lex_ctxt * lexic)

nasl function

rsa_sign(data:hash, priv:pem, passphrase:passphrase)

Signs the data with the private RSA key priv given in PEM format. The passphrase is the passphrase needed to decrypt the private key. Returns the signed data.

In the OpenSSL based nasl, the key was not given in PEM form and with a passphrase. Instead it was given as the RSA parameters e, n and d. libgcrypt always requires all the parameters (including p, g, and u), so this function was changed to simply accept the full private key in PEM form. The one place where it was called had that the key available in that form.

◆ nasl_sexp_from_privkey()

gcry_sexp_t nasl_sexp_from_privkey ( lex_ctxt * lexic,
gnutls_x509_privkey_t privkey )
static

◆ nasl_smb3kdf()

tree_cell * nasl_smb3kdf ( lex_ctxt * lexic)

Add the SMB3KDF as specified in [SP800-108] section 5.1.

Parameters
lexic
Returns
tree_cell*

◆ print_gcrypt_error()

void print_gcrypt_error ( lex_ctxt * lexic,
char * function,
int err )
static

Prints a libgcrypt error.

The parameter err should be the libgcrypt error code

◆ print_tls_error()

void print_tls_error ( lex_ctxt * lexic,
char * txt,
int err )
static

Prints a GnuTLS error.

The parameter err should be the GnuTLS error code

◆ set_mpi_retc()

int set_mpi_retc ( tree_cell * retc,
gcry_mpi_t mpi )
static

Sets the return value in retc from the MPI mpi.

The MPI is converted to a byte string as an unsigned int in bigendian form (libgcrypts GCRYMPI_FMT_USG format).

In an earlier implementation of this function, if first byte in the string had it's most significant bit set, i.e. if it would be considered negative when interpreted as two's-complement representation, a null-byte was prepended to make sure the number is always considered positive.

However, this behavior caused problems during certain SSH operations because the buffer returned by this function would be one byte larger than expected. For now, the str_val of retc will always have the content and size returned by gcry_mpi_aprint ().

Returns
0 on success and -1 on failure.

◆ set_retc_from_sexp()

int set_retc_from_sexp ( tree_cell * retc,
gcry_sexp_t sexp,
const char * token )
static

Sets the return value in retc from an sexpression.

The function uses extract_mpi_from_sexp to extract an MPI from the sexpression sexp and the subexpression given by token. The function return 1 on success and 0 on failure.

◆ strip_pkcs1_padding()

int strip_pkcs1_padding ( tree_cell * retc)
static

Strips PKCS#1 padding from the string in retc.

◆ verify_cipher_id()

gcry_cipher_hd_t verify_cipher_id ( lex_ctxt * lexic,
int cipher_id )
static

Helper function to validate the cipher id.

Parameters
[in]cipher_idThe cipher ID to validate.
Returns
Handler on success, Null on error.

Variable Documentation

◆ cipher_table

GList* cipher_table = NULL
static

List of open cipher handler.