[Bug 3447] AES-128-CMAC (fixes)

bk: 5a284fd0T53bicpbxwAR7Mqaa_20Pg

diff --git a/ChangeLog b/ChangeLog
index f2a05751a753342117c831cc4007045c67730dcf..7fae02f687727607e813cad8ea2e6813d7cf041b 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,6 @@
 ---
 
+* [Bug 3447] AES-128-CMAC (fixes) <perlinger@ntp.org>
 * [Bug 3441] Validate the assumption that AF_UNSPEC is 0.  stenn@ntp.org
 * [Bug 3439] When running multiple commands / hosts in ntpq... <perlinger@ntp.org>
  - applied patch by ggarvey

diff --git a/libntp/a_md5encrypt.c b/libntp/a_md5encrypt.c
index 7ec7e57f2c9f2d2d9b62385bda1dbb30f566b820..ed776f2e4c3e560d5b8d8962022a2d59ec92841e 100644 (file)
--- a/libntp/a_md5encrypt.c
+++ b/libntp/a_md5encrypt.c
@@ -32,8 +32,7 @@ MD5authencrypt(
        )
 {
        u_char  digest[EVP_MAX_MD_SIZE];
-       u_int   len;
-/*     EVP_MD_CTX *ctx; */
+       u_int   len = 0;
 
        /*
         * Compute digest of key concatenated with packet. Note: the
@@ -43,96 +42,89 @@ MD5authencrypt(
        INIT_SSL();
 #ifdef OPENSSL
        /* Check if CMAC key type specific code required */
-       if (cache_type == NID_cmac) {
-           CMAC_CTX *      ctx;
-
-           if (debug) {
-               fprintf(stderr, "%s:%d:%s():%s:nid\n",
+       if (type == NID_cmac) {
+               CMAC_CTX *      ctx;
+               size_t          slen = 0;
+               
+               if (debug) {
+                       fprintf(stderr, "%s:%d:%s():%s:nid\n",
                                __FILE__, __LINE__, __func__, CMAC);
-           }
-
-           if (!(ctx = CMAC_CTX_new())) {
-               fprintf(stderr,  "MAC encrypt: CMAC %s CTX new failed.\n", CMAC);
-               msyslog(LOG_ERR, "MAC encrypt: CMAC %s CTX new failed.",   CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Init(ctx, key, (u_int)AES_128_KEY_SIZE,
-                                               EVP_aes_128_cbc(), NULL)) {
-               fprintf(stderr,  "MAC encrypt: CMAC %s Init failed.\n",    CMAC);
-               msyslog(LOG_ERR, "MAC encrypt: CMAC %s Init failed.",      CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Update(ctx, (u_char *)pkt, (u_int)length)) {
-               fprintf(stderr,  "MAC encrypt: CMAC %s Update failed.\n",  CMAC);
-               msyslog(LOG_ERR, "MAC encrypt: CMAC %s Update failed.",    CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Final(ctx, digest, &len)) {
-               fprintf(stderr,  "MAC encrypt: CMAC %s Final failed.\n",   CMAC);
-               msyslog(LOG_ERR, "MAC encrypt: CMAC %s Final failed.",     CMAC);
-               len = 0;
-           }
-
-           CMAC_CTX_cleanup(ctx);
-       } else {        /* generic MAC handling */
+               }
+               
+               if (!(ctx = CMAC_CTX_new())) {
+                       fprintf(stderr,  "MAC encrypt: CMAC %s CTX new failed.\n", CMAC);
+                       msyslog(LOG_ERR, "MAC encrypt: CMAC %s CTX new failed.",   CMAC);
+               }
+               else if (!CMAC_Init(ctx, key, AES_128_KEY_SIZE,
+                                   EVP_aes_128_cbc(), NULL)) {
+                       fprintf(stderr,  "MAC encrypt: CMAC %s Init failed.\n",    CMAC);
+                       msyslog(LOG_ERR, "MAC encrypt: CMAC %s Init failed.",      CMAC);
+               }
+               else if (!CMAC_Update(ctx, pkt, length)) {
+                       fprintf(stderr,  "MAC encrypt: CMAC %s Update failed.\n",  CMAC);
+                       msyslog(LOG_ERR, "MAC encrypt: CMAC %s Update failed.",    CMAC);
+               }
+               else if (!CMAC_Final(ctx, digest, &slen)) {
+                       fprintf(stderr,  "MAC encrypt: CMAC %s Final failed.\n",   CMAC);
+                       msyslog(LOG_ERR, "MAC encrypt: CMAC %s Final failed.",     CMAC);
+                       slen = 0;
+               }
+               len = (u_int)slen;
+               
+               CMAC_CTX_cleanup(ctx);
+       } else  /* generic MAC handling */
 #endif
-           EVP_MD_CTX *        ctx;
-
-           if (!(ctx = EVP_MD_CTX_new())) {
-               fprintf(stderr,  "MAC encrypt: MAC %s Digest CTX new failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest CTX new failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           }
+       {
+               EVP_MD_CTX *    ctx;
+               
+               if (!(ctx = EVP_MD_CTX_new())) {
+                       fprintf(stderr,  "MAC encrypt: MAC %s Digest CTX new failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest CTX new failed.",
+                               OBJ_nid2sn(type));
+               }
 #ifdef OPENSSL /* OpenSSL 1 supports return codes 0 fail, 1 okay */
-           else
-           if (!EVP_DigestInit(ctx, EVP_get_digestbynid(type))) {
-               fprintf(stderr,  "MAC encrypt: MAC %s Digest Init failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Init failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           } else
-           if (!EVP_DigestUpdate(ctx, key, (u_int)cache_secretsize)) {
-               fprintf(stderr,  "MAC encrypt: MAC %s Digest Update key failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Update key failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           } else
-           if (!EVP_DigestUpdate(ctx, (u_char *)pkt, (u_int)length)) {
-               fprintf(stderr,  "MAC encrypt: MAC %s Digest Update data failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Update data failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           } else
-           if (!EVP_DigestFinal(ctx, digest, &len)) {
-               fprintf(stderr,  "MAC encrypt: MAC %s Digest Final failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Final failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           }
+               else if (!EVP_DigestInit(ctx, EVP_get_digestbynid(type))) {
+                       fprintf(stderr,  "MAC encrypt: MAC %s Digest Init failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Init failed.",
+                               OBJ_nid2sn(type));
+               }
+               else if (!EVP_DigestUpdate(ctx, key, (u_int)cache_secretsize)) {
+                       fprintf(stderr,  "MAC encrypt: MAC %s Digest Update key failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Update key failed.",
+                               OBJ_nid2sn(type));
+               }
+               else if (!EVP_DigestUpdate(ctx, (u_char *)pkt, (u_int)length)) {
+                       fprintf(stderr,  "MAC encrypt: MAC %s Digest Update data failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Update data failed.",
+                               OBJ_nid2sn(type));
+               }
+               else if (!EVP_DigestFinal(ctx, digest, &len)) {
+                       fprintf(stderr,  "MAC encrypt: MAC %s Digest Final failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Final failed.",
+                               OBJ_nid2sn(type));
+                       len = 0;
+               }
 #else /* !OPENSSL */
-       if (!(ctx && EVP_DigestInit(ctx, EVP_get_digestbynid(type)))) {
-               msyslog(LOG_ERR,
-                   "MAC encrypt: digest init failed");
-               EVP_MD_CTX_free(ctx);
-               return (0);
-       }
-       EVP_DigestUpdate(ctx, key, cache_secretsize);
-       EVP_DigestUpdate(ctx, (u_char *)pkt, length);
-       EVP_DigestFinal(ctx, digest, &len);
+               if (!(ctx && EVP_DigestInit(ctx, EVP_get_digestbynid(type)))) {
+                       msyslog(LOG_ERR,
+                               "MAC encrypt: digest init failed");
+                       EVP_MD_CTX_free(ctx);
+                       return (0);
+               }
+               EVP_DigestUpdate(ctx, key, cache_secretsize);
+               EVP_DigestUpdate(ctx, (u_char *)pkt, length);
+               EVP_DigestFinal(ctx, digest, &len);
 #endif
-       EVP_MD_CTX_free(ctx);
-#ifdef OPENSSL
+               EVP_MD_CTX_free(ctx);
        }
-#endif
        /* If the MAC is longer than the MAX then truncate it. */
        if (len > MAX_MDG_LEN)
-           len = MAX_MDG_LEN;
+               len = MAX_MDG_LEN;
        memmove((u_char *)pkt + length + KEY_MAC_LEN, digest, len);
        return (len + KEY_MAC_LEN);
 }
@@ -153,8 +145,7 @@ MD5authdecrypt(
        )
 {
        u_char  digest[EVP_MAX_MD_SIZE];
-       u_int   len;
-/*     EVP_MD_CTX *ctx; */
+       u_int   len = 0;
 
        /*
         * Compute digest of key concatenated with packet. Note: the
@@ -164,97 +155,89 @@ MD5authdecrypt(
        INIT_SSL();
 #ifdef OPENSSL
        /* Check if CMAC key type specific code required */
-       if (cache_type == NID_cmac) {
-           CMAC_CTX *      ctx;
+       if (type == NID_cmac) {
+               CMAC_CTX *      ctx;
+               size_t          slen = 0;
 
-
-           if (debug) {
-               fprintf(stderr, "%s:%d:%s():%s:nid\n",
+               if (debug) {
+                       fprintf(stderr, "%s:%d:%s():%s:nid\n",
                                __FILE__, __LINE__, __func__, CMAC);
-           }
-
-           if (!(ctx = CMAC_CTX_new())) {
-               fprintf(stderr,  "MAC decrypt: CMAC %s CTX new failed.\n", CMAC);
-               msyslog(LOG_ERR, "MAC decrypt: CMAC %s CTX new failed.",   CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Init(ctx, key, (u_int)AES_128_KEY_SIZE,
-                                               EVP_aes_128_cbc(), NULL)) {
-               fprintf(stderr,  "MAC decrypt: CMAC %s Init failed.\n",    CMAC);
-               msyslog(LOG_ERR, "MAC decrypt: CMAC %s Init failed.",      CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Update(ctx, (u_char *)pkt, (u_int)length)) {
-               fprintf(stderr,  "MAC decrypt: CMAC %s Update failed.\n",  CMAC);
-               msyslog(LOG_ERR, "MAC decrypt: CMAC %s Update failed.",    CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Final(ctx, digest, &len)) {
-               fprintf(stderr,  "MAC decrypt: CMAC %s Final failed.\n",   CMAC);
-               msyslog(LOG_ERR, "MAC decrypt: CMAC %s Final failed.",     CMAC);
-               len = 0;
-           }
-
-           CMAC_CTX_cleanup(ctx);
-       } else {        /* generic MAC handling */
+               }
+               
+               if (!(ctx = CMAC_CTX_new())) {
+                       fprintf(stderr,  "MAC decrypt: CMAC %s CTX new failed.\n", CMAC);
+                       msyslog(LOG_ERR, "MAC decrypt: CMAC %s CTX new failed.",   CMAC);
+               }
+               else if (!CMAC_Init(ctx, key, AES_128_KEY_SIZE,
+                                   EVP_aes_128_cbc(), NULL)) {
+                       fprintf(stderr,  "MAC decrypt: CMAC %s Init failed.\n",    CMAC);
+                       msyslog(LOG_ERR, "MAC decrypt: CMAC %s Init failed.",      CMAC);
+               }
+               else if (!CMAC_Update(ctx, pkt, length)) {
+                       fprintf(stderr,  "MAC decrypt: CMAC %s Update failed.\n",  CMAC);
+                       msyslog(LOG_ERR, "MAC decrypt: CMAC %s Update failed.",    CMAC);
+               }
+               else if (!CMAC_Final(ctx, digest, &slen)) {
+                       fprintf(stderr,  "MAC decrypt: CMAC %s Final failed.\n",   CMAC);
+                       msyslog(LOG_ERR, "MAC decrypt: CMAC %s Final failed.",     CMAC);
+                       slen = 0;
+               }
+               len = (u_int)slen;
+               
+               CMAC_CTX_cleanup(ctx);
+       } else  /* generic MAC handling */
 #endif
-           EVP_MD_CTX *        ctx;
-
-           if (!(ctx = EVP_MD_CTX_new())) {
-               fprintf(stderr,  "MAC decrypt: MAC %s Digest CTX new failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest CTX new failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           }
+       {
+               EVP_MD_CTX *    ctx;
+               
+               if (!(ctx = EVP_MD_CTX_new())) {
+                       fprintf(stderr,  "MAC decrypt: MAC %s Digest CTX new failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest CTX new failed.",
+                               OBJ_nid2sn(type));
+               }
 #ifdef OPENSSL /* OpenSSL 1 supports return codes 0 fail, 1 okay */
-           else
-           if (!EVP_DigestInit(ctx, EVP_get_digestbynid(type))) {
-               fprintf(stderr,  "MAC decrypt: MAC %s Digest Init failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest Init failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           } else
-           if (!EVP_DigestUpdate(ctx, key, (u_int)cache_secretsize)) {
-               fprintf(stderr,  "MAC decrypt: MAC %s Digest Update key failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest Update key failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           } else
-           if (!EVP_DigestUpdate(ctx, (u_char *)pkt, (u_int)length)) {
-               fprintf(stderr,  "MAC decrypt: MAC %s Digest Update data failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest Update data failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           } else
-           if (!EVP_DigestFinal(ctx, digest, &len)) {
-               fprintf(stderr,  "MAC decrypt: MAC %s Digest Final failed.\n",
-                                                       OBJ_nid2sn(type));
-               msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest Final failed.",
-                                                       OBJ_nid2sn(type));
-               len = 0;
-           }
+               else if (!EVP_DigestInit(ctx, EVP_get_digestbynid(type))) {
+                       fprintf(stderr,  "MAC decrypt: MAC %s Digest Init failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest Init failed.",
+                               OBJ_nid2sn(type));
+               }
+               else if (!EVP_DigestUpdate(ctx, key, (u_int)cache_secretsize)) {
+                       fprintf(stderr,  "MAC decrypt: MAC %s Digest Update key failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest Update key failed.",
+                               OBJ_nid2sn(type));
+               }
+               else if (!EVP_DigestUpdate(ctx, (u_char *)pkt, (u_int)length)) {
+                       fprintf(stderr,  "MAC decrypt: MAC %s Digest Update data failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest Update data failed.",
+                               OBJ_nid2sn(type));
+               }
+               else if (!EVP_DigestFinal(ctx, digest, &len)) {
+                       fprintf(stderr,  "MAC decrypt: MAC %s Digest Final failed.\n",
+                               OBJ_nid2sn(type));
+                       msyslog(LOG_ERR, "MAC decrypt: MAC %s Digest Final failed.",
+                               OBJ_nid2sn(type));
+                       len = 0;
+               }
 #else /* !OPENSSL */
-           if (!(ctx && EVP_DigestInit(ctx, EVP_get_digestbynid(type)))) {
-                   msyslog(LOG_ERR,
-                       "MAC decrypt: digest init failed");
-                   EVP_MD_CTX_free(ctx);
-                   return (0);
-           }
-           EVP_DigestUpdate(ctx, key, cache_secretsize);
-           EVP_DigestUpdate(ctx, (u_char *)pkt, (u_int)length);
-           EVP_DigestFinal(ctx, digest, &len);
+               if (!(ctx && EVP_DigestInit(ctx, EVP_get_digestbynid(type)))) {
+                       msyslog(LOG_ERR,
+                               "MAC decrypt: digest init failed");
+                       EVP_MD_CTX_free(ctx);
+                       return (0);
+               }
+               EVP_DigestUpdate(ctx, key, cache_secretsize);
+               EVP_DigestUpdate(ctx, (u_char *)pkt, (u_int)length);
+               EVP_DigestFinal(ctx, digest, &len);
 #endif
-           EVP_MD_CTX_free(ctx);
-#ifdef OPENSSL
+               EVP_MD_CTX_free(ctx);
        }
-#endif
        /* If the MAC is longer than the MAX then truncate it. */
        if (len > MAX_MDG_LEN)
-           len = MAX_MDG_LEN;
+               len = MAX_MDG_LEN;
        if (size != (size_t)len + KEY_MAC_LEN) {
                msyslog(LOG_ERR,
                    "MAC decrypt: MAC length error");

diff --git a/sntp/crypto.c b/sntp/crypto.c
index 63025ba6d5e6b0c728c6d9107729f767437647cd..acfa39aa7f6381b4673c0bebd56465c63fecde6b 100644 (file)
--- a/sntp/crypto.c
+++ b/sntp/crypto.c
@@ -30,9 +30,10 @@ make_mac(
        void * digest
        )
 {
-       u_int           len = mac_size;
+       u_int           len  = 0;
+       size_t          slen = 0;
        int             key_type;
-
+       
        if (cmp_key->key_len > 64)
                return 0;
        if (pkt_size % 4 != 0)
@@ -41,94 +42,88 @@ make_mac(
        INIT_SSL();
        key_type = keytype_from_text(cmp_key->typen, NULL);
 
+#ifdef OPENSSL
        /* Check if CMAC key type specific code required */
        if (key_type == NID_cmac) {
-           CMAC_CTX *      ctx;
-
-           if (debug) {
-               fprintf(stderr, "%s:%d:%s():%s:nid\n",
+               CMAC_CTX *      ctx;
+               
+               if (debug) {
+                       fprintf(stderr, "%s:%d:%s():%s:nid\n",
                                __FILE__, __LINE__, __func__, CMAC);
-           }
-
-#ifdef OPENSSL
-           if (!(ctx = CMAC_CTX_new())) {
-               fprintf(stderr,  "make_mac: CMAC %s CTX new failed.\n", CMAC);
-               msyslog(LOG_ERR, "make_mac: CMAC %s CTX new failed.",   CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Init(ctx, (const u_char *)cmp_key->key_seq,
-                       (u_int)cmp_key->key_len, EVP_aes_128_cbc(), NULL)) {
-               fprintf(stderr,  "make_mac: CMAC %s Init failed.\n",    CMAC);
-               msyslog(LOG_ERR, "make_mac: CMAC %s Init failed.",      CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Update(ctx, pkt_data, (u_int)pkt_size)) {
-               fprintf(stderr,  "make_mac: CMAC %s Update failed.\n",  CMAC);
-               msyslog(LOG_ERR, "make_mac: CMAC %s Update failed.",    CMAC);
-               len = 0;
-           } else
-           if (!CMAC_Final(ctx, digest, &len)) {
-               fprintf(stderr,  "make_mac: CMAC %s Final failed.\n",   CMAC);
-               msyslog(LOG_ERR, "make_mac: CMAC %s Final failed.",     CMAC);
-               len = 0;
-           }
-
-           CMAC_CTX_cleanup(ctx);
+               }
+               
+               if (!(ctx = CMAC_CTX_new())) {
+                       fprintf(stderr,  "make_mac: CMAC %s CTX new failed.\n", CMAC);
+                       msyslog(LOG_ERR, "make_mac: CMAC %s CTX new failed.",   CMAC);
+               }
+               else if (!CMAC_Init(ctx, cmp_key->key_seq,
+                                   (size_t)cmp_key->key_len, EVP_aes_128_cbc(), NULL)) {
+                       fprintf(stderr,  "make_mac: CMAC %s Init failed.\n",    CMAC);
+                       msyslog(LOG_ERR, "make_mac: CMAC %s Init failed.",      CMAC);
+               }
+               else if (!CMAC_Update(ctx, pkt_data, (size_t)pkt_size)) {
+                       fprintf(stderr,  "make_mac: CMAC %s Update failed.\n",  CMAC);
+                       msyslog(LOG_ERR, "make_mac: CMAC %s Update failed.",    CMAC);
+               }
+               else if (!CMAC_Final(ctx, digest, &slen)) {
+                       fprintf(stderr,  "make_mac: CMAC %s Final failed.\n",   CMAC);
+                       msyslog(LOG_ERR, "make_mac: CMAC %s Final failed.",     CMAC);
+                       slen = 0;
+               }
+               len = (u_int)slen;
+               
+               CMAC_CTX_cleanup(ctx);
+               /* Test our AES-128-CMAC implementation */
+               
+       } else  /* MD5 MAC handling */
 #endif
-           /* Test our AES-128-CMAC implementation */
-
-       } else {        /* MD5 MAC handling */
-           EVP_MD_CTX *        ctx;
-
-           if (!(ctx = EVP_MD_CTX_new())) {
-               fprintf(stderr,  "make_mac: MAC %s Digest CTX new failed.\n",
-                                                       cmp_key->typen);
-               msyslog(LOG_ERR, "make_mac: MAC %s Digest CTX new failed.",
-                                                       cmp_key->typen);
-               len = 0;
-           }
+       {
+               EVP_MD_CTX *    ctx;
+               
+               if (!(ctx = EVP_MD_CTX_new())) {
+                       fprintf(stderr,  "make_mac: MAC %s Digest CTX new failed.\n",
+                               cmp_key->typen);
+                       msyslog(LOG_ERR, "make_mac: MAC %s Digest CTX new failed.",
+                               cmp_key->typen);
+               }
 #ifdef OPENSSL /* OpenSSL 1 supports return codes 0 fail, 1 okay */
-           else
-           if (!EVP_DigestInit(ctx, EVP_get_digestbynid(key_type))) {
-               fprintf(stderr,  "make_mac: MAC %s Digest Init failed.\n",
-                                                       cmp_key->typen);
-               msyslog(LOG_ERR, "make_mac: MAC %s Digest Init failed.",
-                                                       cmp_key->typen);
-               len = 0;
-           } else
-           if (!EVP_DigestUpdate(ctx, (const u_char *)cmp_key->key_seq,
-                                               (u_int)cmp_key->key_len)) {
-               fprintf(stderr,  "make_mac: MAC %s Digest Update key failed.\n",
-                                                       cmp_key->typen);
-               msyslog(LOG_ERR, "make_mac: MAC %s Digest Update key failed.",
-                                                       cmp_key->typen);
-               len = 0;
-           } else
-           if (!EVP_DigestUpdate(ctx, pkt_data, (u_int)pkt_size)) {
-               fprintf(stderr,  "make_mac: MAC %s Digest Update data failed.\n",
-                                                       cmp_key->typen);
-               msyslog(LOG_ERR, "make_mac: MAC %s Digest Update data failed.",
-                                                       cmp_key->typen);
-               len = 0;
-           } else
-           if (!EVP_DigestFinal(ctx, digest, &len)) {
-               fprintf(stderr,  "make_mac: MAC %s Digest Final failed.\n",
-                                                       cmp_key->typen);
-               msyslog(LOG_ERR, "make_mac: MAC %s Digest Final failed.",
-                                                       cmp_key->typen);
-               len = 0;
-           }
+               else if (!EVP_DigestInit(ctx, EVP_get_digestbynid(key_type))) {
+                       fprintf(stderr,  "make_mac: MAC %s Digest Init failed.\n",
+                               cmp_key->typen);
+                       msyslog(LOG_ERR, "make_mac: MAC %s Digest Init failed.",
+                               cmp_key->typen);
+               }
+               else if (!EVP_DigestUpdate(ctx, (const u_char *)cmp_key->key_seq,
+                                          (u_int)cmp_key->key_len)) {
+                       fprintf(stderr,  "make_mac: MAC %s Digest Update key failed.\n",
+                               cmp_key->typen);
+                       msyslog(LOG_ERR, "make_mac: MAC %s Digest Update key failed.",
+                               cmp_key->typen);
+               }
+               else if (!EVP_DigestUpdate(ctx, pkt_data, (u_int)pkt_size)) {
+                       fprintf(stderr,  "make_mac: MAC %s Digest Update data failed.\n",
+                               cmp_key->typen);
+                       msyslog(LOG_ERR, "make_mac: MAC %s Digest Update data failed.",
+                               cmp_key->typen);
+               }
+               else if (!EVP_DigestFinal(ctx, digest, &len)) {
+                       fprintf(stderr,  "make_mac: MAC %s Digest Final failed.\n",
+                               cmp_key->typen);
+                       msyslog(LOG_ERR, "make_mac: MAC %s Digest Final failed.",
+                               cmp_key->typen);
+                       len = 0;
+               }
 #else /* !OPENSSL */
-           EVP_DigestInit(ctx, EVP_get_digestbynid(key_type));
-           EVP_DigestUpdate(ctx, (const u_char *)cmp_key->key_seq,
-                                               (u_int)cmp_key->key_len);
-           EVP_DigestUpdate(ctx, pkt_data, (u_int)pkt_size);
-           EVP_DigestFinal(ctx, digest, &len);
+               EVP_DigestInit(ctx, EVP_get_digestbynid(key_type));
+               EVP_DigestUpdate(ctx, (const u_char *)cmp_key->key_seq,
+                                (u_int)cmp_key->key_len);
+               EVP_DigestUpdate(ctx, pkt_data, (u_int)pkt_size);
+               EVP_DigestFinal(ctx, digest, &len);
 #endif
-
-           EVP_MD_CTX_free(ctx);
+               
+               EVP_MD_CTX_free(ctx);
        }
-
+       
        return (int)len;
 }