9 #include <openssl/evp.h>
12 * Encrypt or decrypt buf, returning a pointer to the transformed data,
14 * The returned data is the same size as the input data,
15 * which means we must turn off cipher padding, and require that buflen
16 * be a multiple of the cipher block size (8 for Blowfish).
17 * To keep things simple, the return value is a malloc'd
18 * buffer that is overwritten on each call.
20 * Ken Lalonde <ken@globalremit.com>, 2003
23 cipher(char *buf, int buflen, int do_encrypt)
25 static EVP_CIPHER_CTX ctx;
26 static char *out = NULL; /* return value, grown as necessary */
27 static int outlen = 0;
28 static int init = 0, which, blocksize;
32 static const EVP_CIPHER *cipher;
33 unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
34 // Read key from $HOME/.ermt.key
35 char *keyfile = ".ermt.key";
36 unsigned char buf[128];
40 openlog("ermt", LOG_PID, LOG_DAEMON);
41 // Not needed: OpenSSL_add_all_algorithms();
42 // Not needed: ERR_load_crypto_strings();
43 cipher = EVP_bf_cbc(); // or: EVP_aes_{128,192,256}_cbc()
44 // We want the ability to decrypt the output
45 // using "openssl enc -d -kfile K -nopad -nosalt", which
46 // means we must read the key file the same way
47 // openssl does. But be careful: if the key contains
48 // \0 or \r or \n, the effective size will be reduced.
49 if ((fp = fopen(keyfile, "r")) == NULL) {
50 syslog(LOG_ERR, "Can't open key file %s: %m", keyfile);
54 fgets(buf, sizeof buf, fp);
58 ((buf[i-1] == '\n') || (buf[i-1] == '\r')))
61 ((buf[i-1] == '\n') || (buf[i-1] == '\r')))
64 syslog(LOG_ERR, "zero length key");
68 EVP_BytesToKey(cipher, EVP_md5(), NULL,
69 buf, strlen(buf), 1, key, iv);
70 EVP_CIPHER_CTX_init(&ctx);
71 EVP_CipherInit_ex(&ctx, cipher, NULL, key, iv, do_encrypt);
72 EVP_CIPHER_CTX_set_padding(&ctx, 0); // -nopad
73 OPENSSL_cleanse(buf, sizeof buf);
74 OPENSSL_cleanse(key, sizeof key);
75 OPENSSL_cleanse(iv, sizeof iv);
76 blocksize = EVP_CIPHER_CTX_block_size(&ctx);
80 if (which != do_encrypt) {
81 syslog(LOG_ERR, "Cannot switch modes");
85 if ((buflen % blocksize) != 0) {
86 syslog(LOG_ERR, "Buffer size is not a multiple of cipher block size");
90 if (outlen < buflen+blocksize) {
91 outlen = (buflen+blocksize) * 2;
92 out = realloc(out, outlen);
94 if (!EVP_CipherUpdate(&ctx, out, &n, buf, buflen)) {
95 syslog(LOG_ERR, "EVP_CipherUpdate failed");
100 syslog(LOG_ERR, "EVP_CipherUpdate: %d != %d", n, buflen);
104 // assert(ctx->buf_len == 0);
108 /* Decrypt stdin to stdout, and exit */
112 char buf[8*1024], *cp;
115 while ((n = fread(buf, 1, sizeof buf, stdin)) > 0) {
116 if ((cp = cipher(buf, n, 0)) == NULL) {
117 fprintf(stderr, "ermt: Error decoding input; see daemon.err syslog\n");
120 fwrite(cp, 1, n, stdout);
123 perror("ermt: stdin: read");
126 if (fflush(stdout)) {
127 perror("ermt: stdout: write");