lib/apreq.c

   1 /* apreq.c      AP-REQ functions
   2  * Copyright (C) 2002, 2003  Simon Josefsson
   3  *
   4  * This file is part of Shishi.
   5  *
   6  * Shishi is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * Shishi is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with Shishi; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  */
  21
  22 #include "internal.h"
  23
  24 #define SHISHI_APREQ_DEFAULT_PVNO "5"
  25 #define SHISHI_APREQ_DEFAULT_PVNO_LEN 0
  26 #define SHISHI_APREQ_DEFAULT_MSG_TYPE      "14" /* KRB_AP_REQ */
  27 #define SHISHI_APREQ_DEFAULT_MSG_TYPE_LEN  0
  28 #define SHISHI_APREQ_DEFAULT_AP_OPTIONS      "\x00\x00\x00\x00"
  29 #define SHISHI_APREQ_DEFAULT_AP_OPTIONS_LEN  32
  30 #define SHISHI_APREQ_DEFAULT_TICKET_TKT_VNO      "5"
  31 #define SHISHI_APREQ_DEFAULT_TICKET_TKT_VNO_LEN  0
  32 #define SHISHI_APREQ_DEFAULT_TICKET_REALM      ""
  33 #define SHISHI_APREQ_DEFAULT_TICKET_REALM_LEN  0
  34 #define SHISHI_APREQ_DEFAULT_TICKET_SNAME_NAME_TYPE "1" /* SHISHI_NT_PRINCIPAL */
  35 #define SHISHI_APREQ_DEFAULT_TICKET_SNAME_NAME_TYPE_LEN 0
  36 #define SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_ETYPE "0"
  37 #define SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_ETYPE_LEN 0
  38 #define SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_KVNO "0"
  39 #define SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_KVNO_LEN 0
  40 #define SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_CIPHER ""
  41 #define SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_CIPHER_LEN 0
  42 #define SHISHI_APREQ_DEFAULT_AUTHENTICATOR_ETYPE "0"
  43 #define SHISHI_APREQ_DEFAULT_AUTHENTICATOR_ETYPE_LEN 0
  44 #define SHISHI_APREQ_DEFAULT_AUTHENTICATOR_KVNO "1"
  45 #define SHISHI_APREQ_DEFAULT_AUTHENTICATOR_KVNO_LEN 0
  46 #define SHISHI_APREQ_DEFAULT_AUTHENTICATOR_CIPHER ""
  47 #define SHISHI_APREQ_DEFAULT_AUTHENTICATOR_CIPHER_LEN 0
  48
  49 /**
  50  * shishi_apreq:
  51  * @handle: shishi handle as allocated by shishi_init().
  52  *
  53  * This function creates a new AP-REQ, populated with some default
  54  * values.
  55  *
  56  * Return value: Returns the AP-REQ or NULL on failure.
  57  **/
  58 Shishi_asn1
  59 shishi_apreq (Shishi * handle)
  60 {
  61   Shishi_asn1 node;
  62   int res;
  63
  64   node = shishi_asn1_apreq (handle);
  65   if (!node)
  66     goto error;
  67
  68   res = shishi_asn1_write (handle, node, "pvno",
  69                            SHISHI_APREQ_DEFAULT_PVNO,
  70                            SHISHI_APREQ_DEFAULT_PVNO_LEN);
  71   if (res != SHISHI_OK)
  72     goto error;
  73
  74   res = shishi_asn1_write (handle, node, "msg-type",
  75                            SHISHI_APREQ_DEFAULT_MSG_TYPE,
  76                            SHISHI_APREQ_DEFAULT_MSG_TYPE_LEN);
  77   if (res != SHISHI_OK)
  78     goto error;
  79
  80   res = shishi_asn1_write (handle, node, "ap-options",
  81                            SHISHI_APREQ_DEFAULT_AP_OPTIONS,
  82                            SHISHI_APREQ_DEFAULT_AP_OPTIONS_LEN);
  83   if (res != SHISHI_OK)
  84     goto error;
  85
  86   res = shishi_asn1_write (handle, node, "ticket.tkt-vno",
  87                            SHISHI_APREQ_DEFAULT_TICKET_TKT_VNO,
  88                            SHISHI_APREQ_DEFAULT_TICKET_TKT_VNO_LEN);
  89   if (res != SHISHI_OK)
  90     goto error;
  91
  92   res = shishi_asn1_write (handle, node, "ticket.realm",
  93                            SHISHI_APREQ_DEFAULT_TICKET_REALM,
  94                            SHISHI_APREQ_DEFAULT_TICKET_REALM_LEN);
  95   if (res != SHISHI_OK)
  96     goto error;
  97
  98   res = shishi_asn1_write (handle, node, "ticket.realm",
  99                            SHISHI_APREQ_DEFAULT_TICKET_REALM,
 100                            SHISHI_APREQ_DEFAULT_TICKET_REALM_LEN);
 101   if (res != SHISHI_OK)
 102     goto error;
 103
 104   res = shishi_asn1_write (handle, node, "ticket.sname.name-type",
 105                            SHISHI_APREQ_DEFAULT_TICKET_SNAME_NAME_TYPE,
 106                            SHISHI_APREQ_DEFAULT_TICKET_SNAME_NAME_TYPE_LEN);
 107   if (res != SHISHI_OK)
 108     goto error;
 109
 110   res = shishi_asn1_write (handle, node, "ticket.enc-part.etype",
 111                            SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_ETYPE,
 112                            SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_ETYPE_LEN);
 113   if (res != SHISHI_OK)
 114     goto error;
 115
 116   res = shishi_asn1_write (handle, node, "ticket.enc-part.kvno",
 117                            SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_KVNO,
 118                            SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_KVNO_LEN);
 119   if (res != SHISHI_OK)
 120     goto error;
 121
 122   res = shishi_asn1_write (handle, node, "ticket.enc-part.cipher",
 123                            SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_CIPHER,
 124                            SHISHI_APREQ_DEFAULT_TICKET_ENC_PART_CIPHER_LEN);
 125   if (res != SHISHI_OK)
 126     goto error;
 127
 128   res = shishi_asn1_write (handle, node, "authenticator.etype",
 129                            SHISHI_APREQ_DEFAULT_AUTHENTICATOR_ETYPE,
 130                            SHISHI_APREQ_DEFAULT_AUTHENTICATOR_ETYPE_LEN);
 131   if (res != SHISHI_OK)
 132     goto error;
 133
 134   res = shishi_asn1_write (handle, node, "authenticator.kvno",
 135                            SHISHI_APREQ_DEFAULT_AUTHENTICATOR_KVNO,
 136                            SHISHI_APREQ_DEFAULT_AUTHENTICATOR_KVNO_LEN);
 137   if (res != SHISHI_OK)
 138     goto error;
 139
 140   res = shishi_asn1_write (handle, node, "authenticator.cipher",
 141                            SHISHI_APREQ_DEFAULT_AUTHENTICATOR_CIPHER,
 142                            SHISHI_APREQ_DEFAULT_AUTHENTICATOR_CIPHER_LEN);
 143   if (res != SHISHI_OK)
 144     goto error;
 145
 146   return node;
 147
 148 error:
 149   if (node)
 150     shishi_asn1_done (handle, node);
 151   return NULL;
 152 }
 153
 154 /**
 155  * shishi_apreq_print:
 156  * @handle: shishi handle as allocated by shishi_init().
 157  * @fh: file handle open for writing.
 158  * @apreq: AP-REQ to print.
 159  *
 160  * Print ASCII armored DER encoding of AP-REQ to file.
 161  *
 162  * Return value: Returns SHISHI_OK iff successful.
 163  **/
 164 int
 165 shishi_apreq_print (Shishi * handle, FILE * fh, Shishi_asn1 apreq)
 166 {
 167   return _shishi_print_armored_data (handle, fh, apreq, "AP-REQ", NULL);
 168 }
 169
 170 /**
 171  * shishi_apreq_save:
 172  * @handle: shishi handle as allocated by shishi_init().
 173  * @fh: file handle open for writing.
 174  * @apreq: AP-REQ to save.
 175  *
 176  * Save DER encoding of AP-REQ to file.
 177  *
 178  * Return value: Returns SHISHI_OK iff successful.
 179  **/
 180 int
 181 shishi_apreq_save (Shishi * handle, FILE * fh, Shishi_asn1 apreq)
 182 {
 183   return _shishi_save_data (handle, fh, apreq, "AP-REQ");
 184 }
 185
 186 /**
 187  * shishi_apreq_to_file:
 188  * @handle: shishi handle as allocated by shishi_init().
 189  * @apreq: AP-REQ to save.
 190  * @filetype: input variable specifying type of file to be written,
 191  *            see Shishi_filetype.
 192  * @filename: input variable with filename to write to.
 193  *
 194  * Write AP-REQ to file in specified TYPE.  The file will be
 195  * truncated if it exists.
 196  *
 197  * Return value: Returns SHISHI_OK iff successful.
 198  **/
 199 int
 200 shishi_apreq_to_file (Shishi * handle, Shishi_asn1 apreq,
 201                       int filetype, char *filename)
 202 {
 203   FILE *fh;
 204   int res;
 205
 206   if (VERBOSE (handle))
 207     printf (_("Writing AP-REQ to %s...\n"), filename);
 208
 209   fh = fopen (filename, "w");
 210   if (fh == NULL)
 211     return SHISHI_FOPEN_ERROR;
 212
 213   if (VERBOSE (handle))
 214     printf (_("Writing AP-REQ in %s format...\n"),
 215             filetype == SHISHI_FILETYPE_TEXT ? "TEXT" : "DER");
 216
 217   if (filetype == SHISHI_FILETYPE_TEXT)
 218     res = shishi_apreq_print (handle, fh, apreq);
 219   else
 220     res = shishi_apreq_save (handle, fh, apreq);
 221   if (res != SHISHI_OK)
 222     return res;
 223
 224   res = fclose (fh);
 225   if (res != 0)
 226     return SHISHI_FCLOSE_ERROR;
 227
 228   if (VERBOSE (handle))
 229     printf (_("Writing AP-REQ to %s...done\n"), filename);
 230
 231   return SHISHI_OK;
 232 }
 233
 234 /**
 235  * shishi_apreq_parse:
 236  * @handle: shishi handle as allocated by shishi_init().
 237  * @fh: file handle open for reading.
 238  * @apreq: output variable with newly allocated AP-REQ.
 239  *
 240  * Read ASCII armored DER encoded AP-REQ from file and populate given
 241  * variable.
 242  *
 243  * Return value: Returns SHISHI_OK iff successful.
 244  **/
 245 int
 246 shishi_apreq_parse (Shishi * handle, FILE * fh, Shishi_asn1 * apreq)
 247 {
 248   return _shishi_apreq_input (handle, fh, apreq, 0);
 249 }
 250
 251 /**
 252  * shishi_apreq_read:
 253  * @handle: shishi handle as allocated by shishi_init().
 254  * @fh: file handle open for reading.
 255  * @apreq: output variable with newly allocated AP-REQ.
 256  *
 257  * Read DER encoded AP-REQ from file and populate given variable.
 258  *
 259  * Return value: Returns SHISHI_OK iff successful.
 260  **/
 261 int
 262 shishi_apreq_read (Shishi * handle, FILE * fh, Shishi_asn1 * apreq)
 263 {
 264   return _shishi_apreq_input (handle, fh, apreq, 1);
 265 }
 266
 267 /**
 268  * shishi_apreq_from_file:
 269  * @handle: shishi handle as allocated by shishi_init().
 270  * @apreq: output variable with newly allocated AP-REQ.
 271  * @filetype: input variable specifying type of file to be read,
 272  *            see Shishi_filetype.
 273  * @filename: input variable with filename to read from.
 274  *
 275  * Read AP-REQ from file in specified TYPE.
 276  *
 277  * Return value: Returns SHISHI_OK iff successful.
 278  **/
 279 int
 280 shishi_apreq_from_file (Shishi * handle, Shishi_asn1 * apreq,
 281                         int filetype, char *filename)
 282 {
 283   int res;
 284   FILE *fh;
 285
 286   if (VERBOSE (handle))
 287     printf (_("Reading AP-REQ from %s...\n"), filename);
 288
 289   fh = fopen (filename, "r");
 290   if (fh == NULL)
 291     return SHISHI_FOPEN_ERROR;
 292
 293   if (VERBOSE (handle))
 294     printf (_("Reading AP-REQ in %s format...\n"),
 295             filetype == SHISHI_FILETYPE_TEXT ? "TEXT" : "DER");
 296
 297   if (filetype == SHISHI_FILETYPE_TEXT)
 298     res = shishi_apreq_parse (handle, fh, apreq);
 299   else
 300     res = shishi_apreq_read (handle, fh, apreq);
 301   if (res != SHISHI_OK)
 302     return res;
 303
 304   res = fclose (fh);
 305   if (res != 0)
 306     return SHISHI_FCLOSE_ERROR;
 307
 308   if (VERBOSE (handle))
 309     printf (_("Reading AP-REQ from %s...done\n"), filename);
 310
 311   return SHISHI_OK;
 312 }
 313
 314 /**
 315  * shishi_apreq_set_authenticator:
 316  * @handle: shishi handle as allocated by shishi_init().
 317  * @apreq: AP-REQ to add authenticator field to.
 318  * @etype: encryption type used to encrypt authenticator.
 319  * @buf: input array with encrypted authenticator.
 320  * @buflen: size of input array with encrypted authenticator.
 321  *
 322  * Set the encrypted authenticator field in the AP-REP.  The encrypted
 323  * data is usually created by calling shishi_encrypt() on the DER
 324  * encoded authenticator.  To save time, you may want to use
 325  * shishi_apreq_add_authenticator() instead, which calculates the
 326  * encrypted data and calls this function in one step.
 327  *
 328  * Return value:
 329  **/
 330 int
 331 shishi_apreq_set_authenticator (Shishi * handle,
 332                                 Shishi_asn1 apreq,
 333                                 int32_t etype, char *buf, int buflen)
 334 {
 335   int res;
 336
 337   res =
 338     shishi_asn1_write (handle, apreq, "authenticator.cipher", buf, buflen);
 339   if (res != SHISHI_OK)
 340     return res;
 341
 342   res = shishi_asn1_write_int32 (handle, apreq, "authenticator.etype", etype);
 343   if (res != SHISHI_OK)
 344     return res;
 345
 346   return SHISHI_OK;
 347 }
 348
 349 /**
 350  * shishi_apreq_add_authenticator:
 351  * @handle: shishi handle as allocated by shishi_init().
 352  * @apreq: AP-REQ to add authenticator field to.
 353  * @enckdcreppart: ticket information where the key is taken from.
 354  * @authenticator: authenticator as allocated by shishi_authenticator().
 355  *
 356  * Encrypts DER encoded authenticator using key from ticket and store
 357  * it in the AP-REQ.
 358  *
 359  * Return value: Returns SHISHI_OK iff successful.
 360  **/
 361 int
 362 shishi_apreq_add_authenticator (Shishi * handle,
 363                                 Shishi_asn1 apreq,
 364                                 Shishi_key * key,
 365                                 int keyusage, Shishi_asn1 authenticator)
 366 {
 367   int res;
 368   char *buf;
 369   size_t buflen;
 370   char *der;
 371   size_t derlen;
 372
 373   res = shishi_new_a2d (handle, authenticator, &der, &derlen);
 374   if (res != SHISHI_OK)
 375     {
 376       shishi_error_printf (handle, "Could not DER encode authenticator: %s\n",
 377                            shishi_strerror (res));
 378       return res;
 379     }
 380
 381   res = shishi_encrypt (handle, key, keyusage, der, derlen, &buf, &buflen);
 382
 383   free (der);
 384
 385   if (res != SHISHI_OK)
 386     {
 387       shishi_error_printf (handle, "Cannot encrypt authenticator.\n");
 388       return res;
 389     }
 390
 391   res = shishi_apreq_set_authenticator (handle, apreq, shishi_key_type (key),
 392                                         buf, buflen);
 393
 394   return res;
 395 }
 396
 397 /**
 398  * shishi_apreq_set_ticket:
 399  * @handle: shishi handle as allocated by shishi_init().
 400  * @apreq: AP-REQ to add ticket field to.
 401  * @ticket: input ticket to copy into AP-REQ ticket field.
 402  *
 403  * Copy ticket into AP-REQ.
 404  *
 405  * Return value: Returns SHISHI_OK iff successful.
 406  **/
 407 int
 408 shishi_apreq_set_ticket (Shishi * handle, Shishi_asn1 apreq,
 409                          Shishi_asn1 ticket)
 410 {
 411   int res;
 412   char *format;
 413   unsigned char buf[BUFSIZ];
 414   int buflen;
 415   int i, n;
 416
 417   buflen = BUFSIZ;
 418   res = shishi_asn1_read (handle, ticket, "tkt-vno", buf, &buflen);
 419   if (res != SHISHI_OK)
 420     return res;
 421
 422   res = shishi_asn1_write (handle, apreq, "ticket.tkt-vno", buf, buflen);
 423   if (res != SHISHI_OK)
 424     return res;
 425
 426   buflen = BUFSIZ;
 427   res = shishi_asn1_read (handle, ticket, "realm", buf, &buflen);
 428   if (res != SHISHI_OK)
 429     return res;
 430
 431   res = shishi_asn1_write (handle, apreq, "ticket.realm", buf, buflen);
 432   if (res != SHISHI_OK)
 433     return res;
 434
 435   buflen = BUFSIZ;
 436   res = shishi_asn1_read (handle, ticket, "sname.name-type", buf, &buflen);
 437   if (res != SHISHI_OK)
 438     return res;
 439
 440   res = shishi_asn1_write (handle, apreq, "ticket.sname.name-type",
 441                            buf, buflen);
 442   if (res != SHISHI_OK)
 443     return res;
 444
 445   res = shishi_asn1_number_of_elements (handle, ticket,
 446                                         "sname.name-string", &n);
 447   if (res != SHISHI_OK)
 448     return res;
 449
 450   for (i = 1; i <= n; i++)
 451     {
 452       res = shishi_asn1_write (handle, apreq,
 453                                "ticket.sname.name-string", "NEW", 1);
 454       if (res != SHISHI_OK)
 455         return res;
 456
 457       buflen = BUFSIZ;
 458       asprintf (&format, "sname.name-string.?%d", i);
 459       res = shishi_asn1_read (handle, ticket, format, buf, &buflen);
 460       free (format);
 461       if (res != SHISHI_OK)
 462         return res;
 463
 464       asprintf (&format, "ticket.sname.name-string.?%d", i);
 465       res = shishi_asn1_write (handle, apreq, format, buf, buflen);
 466       free (format);
 467       if (res != SHISHI_OK)
 468         return res;
 469     }
 470
 471   buflen = BUFSIZ;
 472   res = shishi_asn1_read (handle, ticket, "enc-part.etype", buf, &buflen);
 473   if (res != SHISHI_OK)
 474     return res;
 475
 476   res = shishi_asn1_write (handle, apreq, "ticket.enc-part.etype",
 477                            buf, buflen);
 478   if (res != SHISHI_OK)
 479     return res;
 480
 481   buflen = BUFSIZ;
 482   res = shishi_asn1_read (handle, ticket, "enc-part.kvno", buf, &buflen);
 483   if (res != SHISHI_OK && res != SHISHI_ASN1_NO_ELEMENT)
 484     return res;
 485
 486   if (res == SHISHI_ASN1_NO_ELEMENT)
 487     res = shishi_asn1_write (handle, apreq, "ticket.enc-part.kvno", NULL, 0);
 488   else
 489     res = shishi_asn1_write (handle, apreq, "ticket.enc-part.kvno",
 490                              buf, buflen);
 491   if (res != SHISHI_OK)
 492     return res;
 493
 494   buflen = BUFSIZ;
 495   res = shishi_asn1_read (handle, ticket, "enc-part.cipher", buf, &buflen);
 496   if (res != SHISHI_OK)
 497     return res;
 498
 499   res = shishi_asn1_write (handle, apreq, "ticket.enc-part.cipher",
 500                            buf, buflen);
 501   if (res != SHISHI_OK)
 502     return res;
 503
 504   return SHISHI_OK;
 505 }
 506
 507 int
 508 shishi_apreq_options (Shishi * handle, Shishi_asn1 apreq, int *flags)
 509 {
 510   return shishi_asn1_read_bitstring (handle, apreq, "ap-options", flags);
 511 }
 512
 513 int
 514 shishi_apreq_use_session_key_p (Shishi * handle, Shishi_asn1 apreq)
 515 {
 516   int options = 0;
 517
 518   shishi_apreq_options (handle, apreq, &options);
 519
 520   return options & SHISHI_APOPTIONS_USE_SESSION_KEY;
 521 }
 522
 523 int
 524 shishi_apreq_mutual_required_p (Shishi * handle, Shishi_asn1 apreq)
 525 {
 526   int options = 0;
 527
 528   shishi_apreq_options (handle, apreq, &options);
 529
 530   return options & SHISHI_APOPTIONS_MUTUAL_REQUIRED;
 531 }
 532
 533 int
 534 shishi_apreq_options_set (Shishi * handle, Shishi_asn1 apreq, int options)
 535 {
 536   int res;
 537
 538   res = shishi_asn1_write_bitstring (handle, apreq, "ap-options", options);
 539   if (res != SHISHI_OK)
 540     return res;
 541
 542   return SHISHI_OK;
 543 }
 544
 545 int
 546 shishi_apreq_options_add (Shishi * handle, Shishi_asn1 apreq, int option)
 547 {
 548   int options;
 549   int res;
 550
 551   res = shishi_apreq_options (handle, apreq, &options);
 552   if (res != SHISHI_OK)
 553     return res;
 554
 555   options |= option;
 556
 557   res = shishi_apreq_options_set (handle, apreq, options);
 558   if (res != SHISHI_OK)
 559     return res;
 560
 561   return SHISHI_OK;
 562 }
 563
 564 /**
 565  * shishi_kdcrep_get_enc_part_etype:
 566  * @handle: shishi handle as allocated by shishi_init().
 567  * @kdcrep: KDC-REP variable to get value from.
 568  * @etype: output variable that holds the value.
 569  *
 570  * Extract KDC-REP.enc-part.etype.
 571  *
 572  * Return value: Returns SHISHI_OK iff successful.
 573  **/
 574 int
 575 shishi_apreq_get_authenticator_etype (Shishi * handle,
 576                                       Shishi_asn1 apreq, int32_t * etype)
 577 {
 578   return shishi_asn1_read_int32 (handle, apreq, "authenticator.etype", etype);
 579 }
 580
 581 /**
 582  * shishi_apreq_get_ticket:
 583  * @handle: shishi handle as allocated by shishi_init().
 584  * @kdcrep: AP-REQ variable to get ticket from.
 585  * @ticket: output variable to hold extracted ticket.
 586  *
 587  * Extract ticket from AP-REQ.
 588  *
 589  * Return value: Returns SHISHI_OK iff successful.
 590  **/
 591 int
 592 shishi_apreq_get_ticket (Shishi * handle,
 593                          Shishi_asn1 apreq, Shishi_asn1 * ticket)
 594 {
 595   unsigned char buf[BUFSIZ];
 596   char *format;
 597   int buflen;
 598   int res;
 599   int i, n;
 600
 601   /* there's GOT to be an easier way to do this */
 602
 603   *ticket = shishi_asn1_ticket (handle);
 604   if (!*ticket)
 605     return SHISHI_ASN1_ERROR;
 606
 607   buflen = BUFSIZ;
 608   res = shishi_asn1_read (handle, apreq, "ticket.tkt-vno", buf, &buflen);
 609   if (res != SHISHI_OK)
 610     goto error;
 611
 612   res = shishi_asn1_write (handle, *ticket, "tkt-vno", buf, buflen);
 613   if (res != SHISHI_OK)
 614     goto error;
 615
 616   buflen = BUFSIZ;
 617   res = shishi_asn1_read (handle, apreq, "ticket.realm", buf, &buflen);
 618   if (res != SHISHI_OK)
 619     goto error;
 620
 621   res = shishi_asn1_write (handle, *ticket, "realm", buf, buflen);
 622   if (res != SHISHI_OK)
 623     goto error;
 624
 625   buflen = BUFSIZ;
 626   res = shishi_asn1_read (handle, apreq, "ticket.sname.name-type",
 627                           buf, &buflen);
 628   if (res != SHISHI_OK)
 629     goto error;
 630
 631   res = shishi_asn1_write (handle, *ticket, "sname.name-type", buf, buflen);
 632   if (res != SHISHI_OK)
 633     goto error;
 634
 635   res = shishi_asn1_number_of_elements (handle, apreq,
 636                                         "ticket.sname.name-string", &n);
 637   if (res != SHISHI_OK)
 638     goto error;
 639
 640   for (i = 1; i <= n; i++)
 641     {
 642       res = shishi_asn1_write (handle, *ticket, "sname.name-string",
 643                                "NEW", 1);
 644       if (res != SHISHI_OK)
 645         goto error;
 646
 647       buflen = BUFSIZ;
 648       asprintf (&format, "ticket.sname.name-string.?%d", i);
 649       res = shishi_asn1_read (handle, apreq, format, buf, &buflen);
 650       free (format);
 651       if (res != SHISHI_OK)
 652         goto error;
 653
 654       asprintf (&format, "sname.name-string.?%d", i);
 655       res = shishi_asn1_write (handle, *ticket, format, buf, buflen);
 656       free (format);
 657       if (res != SHISHI_OK)
 658         goto error;
 659     }
 660
 661   buflen = BUFSIZ;
 662   res = shishi_asn1_read (handle, apreq, "ticket.enc-part.etype",
 663                           buf, &buflen);
 664   if (res != SHISHI_OK)
 665     goto error;
 666
 667   res = shishi_asn1_write (handle, *ticket, "enc-part.etype", buf, buflen);
 668   if (res != SHISHI_OK)
 669     goto error;
 670
 671   buflen = BUFSIZ;
 672   res = shishi_asn1_read (handle, apreq, "ticket.enc-part.kvno",
 673                           buf, &buflen);
 674   if (res != SHISHI_OK && res != SHISHI_ASN1_NO_ELEMENT)
 675     goto error;
 676
 677   if (res == SHISHI_ASN1_NO_ELEMENT)
 678     res = shishi_asn1_write (handle, *ticket, "enc-part.kvno", NULL, 0);
 679   else
 680     res = shishi_asn1_write (handle, *ticket, "enc-part.kvno", buf, buflen);
 681   if (res != SHISHI_OK)
 682     goto error;
 683
 684   buflen = BUFSIZ;
 685   res = shishi_asn1_read (handle, apreq, "ticket.enc-part.cipher",
 686                           buf, &buflen);
 687   if (res != SHISHI_OK)
 688     goto error;
 689
 690   res = shishi_asn1_write (handle, *ticket, "enc-part.cipher", buf, buflen);
 691   if (res != SHISHI_OK)
 692     goto error;
 693
 694   return SHISHI_OK;
 695
 696 error:
 697   shishi_asn1_done (handle, *ticket);
 698   return res;
 699 }
 700
 701 int
 702 shishi_apreq_decrypt (Shishi * handle,
 703                       Shishi_asn1 apreq,
 704                       Shishi_key * key,
 705                       int keyusage, Shishi_asn1 * authenticator)
 706 {
 707   int res;
 708   int i;
 709   char *buf;
 710   size_t buflen;
 711   char cipher[BUFSIZ];
 712   int cipherlen;
 713   int etype;
 714
 715   res = shishi_apreq_get_authenticator_etype (handle, apreq, &etype);
 716   if (res != SHISHI_OK)
 717     return res;
 718
 719   if (etype != shishi_key_type (key))
 720     return SHISHI_APREQ_BAD_KEYTYPE;
 721
 722   cipherlen = BUFSIZ;
 723   res = shishi_asn1_field (handle, apreq, cipher, &cipherlen,
 724                            "authenticator.cipher");
 725   if (res != SHISHI_OK)
 726     return res;
 727
 728   res = shishi_decrypt (handle, key, keyusage,
 729                         cipher, cipherlen, &buf, &buflen);
 730
 731   if (res != SHISHI_OK)
 732     {
 733       shishi_error_printf (handle,
 734                            "decrypt fail, most likely wrong password\n");
 735       return SHISHI_APREQ_DECRYPT_FAILED;
 736     }
 737
 738   /* The crypto is so 1980; no length indicator. Trim off pad bytes
 739      until we can parse it. */
 740   for (i = 0; i < 8; i++)
 741     {
 742       if (VERBOSEASN1 (handle))
 743         printf ("Trying with %d pad in enckdcrep...\n", i);
 744
 745       *authenticator = shishi_der2asn1_authenticator (handle, &buf[0],
 746                                                       buflen - i);
 747       if (*authenticator != NULL)
 748         break;
 749     }
 750
 751   if (*authenticator == NULL)
 752     {
 753       shishi_error_printf (handle, "Could not DER decode Authenticator. "
 754                            "Password probably correct (decrypt ok) though\n");
 755       return SHISHI_ASN1_ERROR;
 756     }
 757
 758   return SHISHI_OK;
 759 }