lib/authenticator.c

   1 /* authenticator.c      functions for authenticators
   2  * Copyright (C) 2002, 2003  Simon Josefsson
   3  *
   4  * This file is part of Shishi.
   5  *
   6  * Shishi is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * Shishi is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with Shishi; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  */
  21
  22 #include "internal.h"
  23
  24 /**
  25  * shishi_authenticator:
  26  * @handle: shishi handle as allocated by shishi_init().
  27  *
  28  * This function creates a new Authenticator, populated with some
  29  * default values.  It uses the current time as returned by the system
  30  * for the ctime and cusec fields.
  31  *
  32  * Return value: Returns the authenticator or NULL on
  33  * failure.
  34  **/
  35 Shishi_asn1
  36 shishi_authenticator (Shishi * handle)
  37 {
  38   int res;
  39   Shishi_asn1 node = NULL;
  40   struct timeval tv;
  41   struct timezone tz;
  42
  43   node = shishi_asn1_authenticator (handle);
  44   if (!node)
  45     return NULL;
  46
  47   res = shishi_asn1_write (handle, node, "authenticator-vno", "5", 0);
  48   if (res != SHISHI_OK)
  49     goto error;
  50
  51   res = shishi_authenticator_set_crealm (handle, node,
  52                                          shishi_realm_default (handle));
  53   if (res != SHISHI_OK)
  54     goto error;
  55
  56   res = shishi_authenticator_client_set (handle, node,
  57                                          shishi_principal_default (handle));
  58   if (res != SHISHI_OK)
  59     goto error;
  60
  61   gettimeofday (&tv, &tz);
  62   res = shishi_authenticator_cusec_set (handle, node, tv.tv_usec % 1000000);
  63   if (res != SHISHI_OK)
  64     goto error;
  65
  66   res = shishi_asn1_write (handle, node, "ctime",
  67                            shishi_generalize_time (handle, time (NULL)), 0);
  68   if (res != SHISHI_OK)
  69     goto error;
  70
  71   res = shishi_asn1_write (handle, node, "seq-number", NULL, 0);
  72   if (res != SHISHI_OK)
  73     goto error;
  74
  75   return node;
  76
  77 error:
  78   shishi_asn1_done (handle, node);
  79   return NULL;
  80 }
  81
  82 /**
  83  * shishi_authenticator_subkey:
  84  * @handle: shishi handle as allocated by shishi_init().
  85  *
  86  * This function creates a new Authenticator, populated with some
  87  * default values.  It uses the current time as returned by the system
  88  * for the ctime and cusec fields. It adds a random subkey.
  89  *
  90  * Return value: Returns the authenticator or NULL on
  91  * failure.
  92  **/
  93 Shishi_asn1
  94 shishi_authenticator_subkey (Shishi * handle)
  95 {
  96   Shishi_asn1 node;
  97   int res;
  98
  99   node = shishi_authenticator (handle);
 100   if (node == NULL)
 101     return NULL;
 102
 103   res = shishi_authenticator_add_random_subkey (handle, node);
 104   if (res != SHISHI_OK)
 105     return NULL;
 106
 107   return node;
 108 }
 109
 110 /**
 111  * shishi_authenticator_print:
 112  * @handle: shishi handle as allocated by shishi_init().
 113  * @fh: file handle open for writing.
 114  * @authenticator: authenticator as allocated by shishi_authenticator().
 115  *
 116  * Print ASCII armored DER encoding of authenticator to file.
 117  *
 118  * Return value: Returns SHISHI_OK iff successful.
 119  **/
 120 int
 121 shishi_authenticator_print (Shishi * handle,
 122                             FILE * fh, Shishi_asn1 authenticator)
 123 {
 124   return _shishi_print_armored_data (handle, fh, authenticator,
 125                                      "Authenticator", NULL);
 126 }
 127
 128 /**
 129  * shishi_authenticator_save:
 130  * @handle: shishi handle as allocated by shishi_init().
 131  * @fh: file handle open for writing.
 132  * @authenticator: authenticator as allocated by shishi_authenticator().
 133  *
 134  * Save DER encoding of authenticator to file.
 135  *
 136  * Return value: Returns SHISHI_OK iff successful.
 137  **/
 138 int
 139 shishi_authenticator_save (Shishi * handle,
 140                            FILE * fh, Shishi_asn1 authenticator)
 141 {
 142   return _shishi_save_data (handle, fh, authenticator, "Authenticator");
 143 }
 144
 145 /**
 146  * shishi_authenticator_to_file:
 147  * @handle: shishi handle as allocated by shishi_init().
 148  * @authenticator: Authenticator to save.
 149  * @filetype: input variable specifying type of file to be written,
 150  *            see Shishi_filetype.
 151  * @filename: input variable with filename to write to.
 152  *
 153  * Write Authenticator to file in specified TYPE.  The file will be
 154  * truncated if it exists.
 155  *
 156  * Return value: Returns SHISHI_OK iff successful.
 157  **/
 158 int
 159 shishi_authenticator_to_file (Shishi * handle, Shishi_asn1 authenticator,
 160                               int filetype, char *filename)
 161 {
 162   FILE *fh;
 163   int res;
 164
 165   if (VERBOSE (handle))
 166     printf (_("Writing Authenticator to %s...\n"), filename);
 167
 168   fh = fopen (filename, "w");
 169   if (fh == NULL)
 170     return SHISHI_FOPEN_ERROR;
 171
 172   if (VERBOSE (handle))
 173     printf (_("Writing Authenticator in %s format...\n"),
 174             filetype == SHISHI_FILETYPE_TEXT ? "TEXT" : "DER");
 175
 176   if (filetype == SHISHI_FILETYPE_TEXT)
 177     res = shishi_authenticator_print (handle, fh, authenticator);
 178   else
 179     res = shishi_authenticator_save (handle, fh, authenticator);
 180   if (res != SHISHI_OK)
 181     return res;
 182
 183   res = fclose (fh);
 184   if (res != 0)
 185     return SHISHI_FCLOSE_ERROR;
 186
 187   if (VERBOSE (handle))
 188     printf (_("Writing Authenticator to %s...done\n"), filename);
 189
 190   return SHISHI_OK;
 191 }
 192
 193 /**
 194  * shishi_authenticator_parse:
 195  * @handle: shishi handle as allocated by shishi_init().
 196  * @fh: file handle open for reading.
 197  * @authenticator: output variable with newly allocated authenticator.
 198  *
 199  * Read ASCII armored DER encoded authenticator from file and populate
 200  * given authenticator variable.
 201  *
 202  * Return value: Returns SHISHI_OK iff successful.
 203  **/
 204 int
 205 shishi_authenticator_parse (Shishi * handle,
 206                             FILE * fh, Shishi_asn1 * authenticator)
 207 {
 208   return _shishi_authenticator_input (handle, fh, authenticator, 0);
 209 }
 210
 211 /**
 212  * shishi_authenticator_read:
 213  * @handle: shishi handle as allocated by shishi_init().
 214  * @fh: file handle open for reading.
 215  * @authenticator: output variable with newly allocated authenticator.
 216  *
 217  * Read DER encoded authenticator from file and populate given
 218  * authenticator variable.
 219  *
 220  * Return value: Returns SHISHI_OK iff successful.
 221  **/
 222 int
 223 shishi_authenticator_read (Shishi * handle,
 224                            FILE * fh, Shishi_asn1 * authenticator)
 225 {
 226   return _shishi_authenticator_input (handle, fh, authenticator, 1);
 227 }
 228
 229 /**
 230  * shishi_authenticator_from_file:
 231  * @handle: shishi handle as allocated by shishi_init().
 232  * @authenticator: output variable with newly allocated Authenticator.
 233  * @filetype: input variable specifying type of file to be read,
 234  *            see Shishi_filetype.
 235  * @filename: input variable with filename to read from.
 236  *
 237  * Read Authenticator from file in specified TYPE.
 238  *
 239  * Return value: Returns SHISHI_OK iff successful.
 240  **/
 241 int
 242 shishi_authenticator_from_file (Shishi * handle, Shishi_asn1 * authenticator,
 243                                 int filetype, char *filename)
 244 {
 245   int res;
 246   FILE *fh;
 247
 248   if (VERBOSE (handle))
 249     printf (_("Reading Authenticator from %s...\n"), filename);
 250
 251   fh = fopen (filename, "r");
 252   if (fh == NULL)
 253     return SHISHI_FOPEN_ERROR;
 254
 255   if (VERBOSE (handle))
 256     printf (_("Reading Authenticator in %s format...\n"),
 257             filetype == SHISHI_FILETYPE_TEXT ? "TEXT" : "DER");
 258
 259   if (filetype == SHISHI_FILETYPE_TEXT)
 260     res = shishi_authenticator_parse (handle, fh, authenticator);
 261   else
 262     res = shishi_authenticator_read (handle, fh, authenticator);
 263   if (res != SHISHI_OK)
 264     return res;
 265
 266   res = fclose (fh);
 267   if (res != 0)
 268     return SHISHI_FCLOSE_ERROR;
 269
 270   if (VERBOSE (handle))
 271     printf (_("Reading Authenticator from %s...done\n"), filename);
 272
 273   return SHISHI_OK;
 274 }
 275
 276 /**
 277  * shishi_authenticator_set_crealm:
 278  * @handle: shishi handle as allocated by shishi_init().
 279  * @authenticator: authenticator as allocated by shishi_authenticator().
 280  * @crealm: input array with realm.
 281  *
 282  * Set realm field in authenticator to specified value.
 283  *
 284  * Return value: Returns SHISHI_OK iff successful.
 285  **/
 286 int
 287 shishi_authenticator_set_crealm (Shishi * handle,
 288                                  Shishi_asn1 authenticator,
 289                                  const char *crealm)
 290 {
 291   int res;
 292
 293   res = shishi_asn1_write (handle, authenticator, "crealm", crealm, 0);
 294   if (res != SHISHI_OK)
 295     return res;
 296
 297   return SHISHI_OK;
 298 }
 299
 300 /**
 301  * shishi_authenticator_set_cname:
 302  * @handle: shishi handle as allocated by shishi_init().
 303  * @authenticator: authenticator as allocated by shishi_authenticator().
 304  * @name_type: type of principial, see Shishi_name_type, usually
 305  *             SHISHI_NT_UNKNOWN.
 306  * @cname: input array with principal name.
 307  *
 308  * Set principal field in authenticator to specified value.
 309  *
 310  * Return value: Returns SHISHI_OK iff successful.
 311  **/
 312 int
 313 shishi_authenticator_set_cname (Shishi * handle,
 314                                 Shishi_asn1 authenticator,
 315                                 Shishi_name_type name_type,
 316                                 const char *cname[])
 317 {
 318   int res;
 319
 320   res = shishi_principal_name_set (handle, authenticator, "cname",
 321                                    name_type, cname);
 322   if (res != SHISHI_OK)
 323     return res;
 324
 325   return SHISHI_OK;
 326 }
 327
 328 /**
 329  * shishi_authenticator_client_set:
 330  * @handle: shishi handle as allocated by shishi_init().
 331  * @authenticator: Authenticator to set client name field in.
 332  * @client: zero-terminated string with principal name on RFC 1964 form.
 333  *
 334  * Set the client name field in the Authenticator.
 335  *
 336  * Return value: Returns SHISHI_OK iff successful.
 337  **/
 338 int
 339 shishi_authenticator_client_set (Shishi * handle,
 340                                  Shishi_asn1 authenticator,
 341                                  const char *client)
 342 {
 343   int res;
 344
 345   res = shishi_principal_set (handle, authenticator, "cname", client);
 346   if (res != SHISHI_OK)
 347     return res;
 348
 349   return SHISHI_OK;
 350 }
 351
 352 /**
 353  * shishi_authenticator_ctime:
 354  * @handle: shishi handle as allocated by shishi_init().
 355  * @authenticator: Authenticator as allocated by shishi_authenticator().
 356  * @ctime: newly allocated zero-terminated character array with client time.
 357  *
 358  * Extract client time from Authenticator.
 359  *
 360  * Return value: Returns SHISHI_OK iff successful.
 361  **/
 362 int
 363 shishi_authenticator_ctime (Shishi * handle,
 364                             Shishi_asn1 authenticator, char **ctime)
 365 {
 366   return shishi_time (handle, authenticator, "ctime", ctime);
 367 }
 368
 369 /**
 370  * shishi_authenticator_ctime_set:
 371  * @handle: shishi handle as allocated by shishi_init().
 372  * @authenticator: Authenticator as allocated by shishi_authenticator().
 373  * @ctime: string with generalized time value to store in Authenticator.
 374  *
 375  * Store client time in Authenticator.
 376  *
 377  * Return value: Returns SHISHI_OK iff successful.
 378  **/
 379 int
 380 shishi_authenticator_ctime_set (Shishi * handle,
 381                                 Shishi_asn1 authenticator, char *ctime)
 382 {
 383   int res;
 384
 385   res = shishi_asn1_write (handle, authenticator, "ctime",
 386                            ctime, GENERALIZEDTIME_TIME_LEN);
 387   if (res != SHISHI_OK)
 388     return res;
 389
 390   return SHISHI_OK;
 391 }
 392
 393 /**
 394  * shishi_authenticator_cusec_get:
 395  * @handle: shishi handle as allocated by shishi_init().
 396  * @authenticator: Authenticator as allocated by shishi_authenticator().
 397  * @cusec: output integer with client microseconds field.
 398  *
 399  * Extract client microseconds field from Authenticator.
 400  *
 401  * Return value: Returns SHISHI_OK iff successful.
 402  **/
 403 int
 404 shishi_authenticator_cusec_get (Shishi * handle,
 405                                 Shishi_asn1 authenticator, int *cusec)
 406 {
 407   int res;
 408
 409   res = shishi_asn1_read_uint32 (handle, authenticator, "cusec", cusec);
 410   if (res != SHISHI_OK)
 411     return res;
 412
 413   return SHISHI_OK;
 414 }
 415
 416 /**
 417  * shishi_authenticator_cusec_set:
 418  * @handle: shishi handle as allocated by shishi_init().
 419  * @authenticator: authenticator as allocated by shishi_authenticator().
 420  * @cusec: client microseconds to set in authenticator, 0-999999.
 421  *
 422  * Set the cusec field in the Authenticator.
 423  *
 424  * Return value: Returns SHISHI_OK iff successful.
 425  **/
 426 int
 427 shishi_authenticator_cusec_set (Shishi * handle,
 428                                 Shishi_asn1 authenticator, int cusec)
 429 {
 430   int res;
 431
 432   res = shishi_asn1_write_uint32 (handle, authenticator, "cusec", cusec);
 433   if (res != SHISHI_OK)
 434     return res;
 435
 436   return SHISHI_OK;
 437 }
 438
 439 int
 440 shishi_authenticator_cname_get (Shishi * handle,
 441                                 Shishi_asn1 authenticator,
 442                                 char *cname, size_t * cnamelen)
 443 {
 444   return shishi_principal_name_get (handle, authenticator,
 445                                     "cname", cname, cnamelen);
 446 }
 447
 448 int
 449 shishi_authenticator_cnamerealm_get (Shishi * handle,
 450                                      Shishi_asn1 authenticator,
 451                                      char *cnamerealm, size_t * cnamerealmlen)
 452 {
 453   return shishi_principal_name_realm_get (handle, authenticator,
 454                                           "cname",
 455                                           authenticator,
 456                                           "crealm",
 457                                           cnamerealm, cnamerealmlen);
 458 }
 459
 460 int
 461 shishi_authenticator_remove_cksum (Shishi * handle, Shishi_asn1 authenticator)
 462 {
 463   int res;
 464
 465   /* XXX remove this function */
 466
 467   res = shishi_asn1_write (handle, authenticator, "cksum", NULL, 0);
 468   if (res != SHISHI_OK)
 469     return res;
 470
 471   return SHISHI_OK;
 472 }
 473
 474 /**
 475  * shishi_authenticator_cksum:
 476  * @handle: shishi handle as allocated by shishi_init().
 477  * @authenticator: authenticator as allocated by shishi_authenticator().
 478  * @cksumtype: output checksum type.
 479  * @cksum: output checksum data from authenticator.
 480  * @cksumlen: on input, maximum size of output checksum data buffer,
 481  *            on output, actual size of output checksum data buffer.
 482  *
 483  * Read checksum value from authenticator.
 484  *
 485  * Return value: Returns SHISHI_OK iff successful.
 486  **/
 487 int
 488 shishi_authenticator_cksum (Shishi * handle,
 489                             Shishi_asn1 authenticator,
 490                             int32_t * cksumtype,
 491                             char *cksum, size_t * cksumlen)
 492 {
 493   int res;
 494
 495   res = shishi_asn1_read_int32 (handle, authenticator,
 496                                 "cksum.cksumtype", cksumtype);
 497   if (res != SHISHI_OK)
 498     return res;
 499
 500   res = shishi_asn1_read (handle, authenticator, "cksum.checksum",
 501                           cksum, cksumlen);
 502   if (res != SHISHI_OK)
 503     return res;
 504
 505   return SHISHI_OK;
 506 }
 507
 508 /**
 509  * shishi_authenticator_set_cksum:
 510  * @handle: shishi handle as allocated by shishi_init().
 511  * @authenticator: authenticator as allocated by shishi_authenticator().
 512  * @cksumtype: input checksum type to store in authenticator.
 513  * @cksum: input checksum data to store in authenticator.
 514  * @cksumlen: size of input checksum data to store in authenticator.
 515  *
 516  * Store checksum value in authenticator.  A checksum is usually created
 517  * by calling shishi_checksum() on some application specific data using
 518  * the key from the ticket that is being used.  To save time, you may
 519  * want to use shishi_authenticator_add_cksum() instead, which calculates
 520  * the checksum and calls this function in one step.
 521  *
 522  * Return value: Returns SHISHI_OK iff successful.
 523  **/
 524 int
 525 shishi_authenticator_set_cksum (Shishi * handle,
 526                                 Shishi_asn1 authenticator,
 527                                 int32_t cksumtype,
 528                                 char *cksum, size_t cksumlen)
 529 {
 530   int res;
 531
 532   res = shishi_asn1_write_int32 (handle, authenticator,
 533                                  "cksum.cksumtype", cksumtype);
 534   if (res != SHISHI_OK)
 535     return res;
 536
 537   res = shishi_asn1_write (handle, authenticator, "cksum.checksum",
 538                            cksum, cksumlen);
 539   if (res != SHISHI_OK)
 540     return res;
 541
 542   return SHISHI_OK;
 543 }
 544
 545 /**
 546  * shishi_authenticator_add_cksum:
 547  * @handle: shishi handle as allocated by shishi_init().
 548  * @authenticator: authenticator as allocated by shishi_authenticator().
 549  * @key: key to to use for encryption.
 550  * @keyusage: kerberos key usage value to use in encryption.
 551  * @data: input array with data to calculate checksum on.
 552  * @datalen: size of input array with data to calculate checksum on.
 553  *
 554  * Calculate checksum for data and store it in the authenticator.
 555  *
 556  * Return value: Returns SHISHI_OK iff successful.
 557  **/
 558 int
 559 shishi_authenticator_add_cksum (Shishi * handle,
 560                                 Shishi_asn1 authenticator,
 561                                 Shishi_key * key,
 562                                 int keyusage, char *data, size_t datalen)
 563 {
 564   return shishi_authenticator_add_cksum_type (handle, authenticator, key,
 565                                               keyusage,
 566                                               shishi_cipher_defaultcksumtype
 567                                               (shishi_key_type (key)),
 568                                               data, datalen);
 569 }
 570
 571 /**
 572  * shishi_authenticator_add_cksum_type:
 573  * @handle: shishi handle as allocated by shishi_init().
 574  * @authenticator: authenticator as allocated by shishi_authenticator().
 575  * @key: key to to use for encryption.
 576  * @keyusage: kerberos key usage value to use in encryption.
 577  * @cksumtype: checksum to type to calculate checksum.
 578  * @data: input array with data to calculate checksum on.
 579  * @datalen: size of input array with data to calculate checksum on.
 580  *
 581  * Calculate checksum for data and store it in the authenticator.
 582  *
 583  * Return value: Returns SHISHI_OK iff successful.
 584  **/
 585 int
 586 shishi_authenticator_add_cksum_type (Shishi * handle,
 587                                      Shishi_asn1 authenticator,
 588                                      Shishi_key * key,
 589                                      int keyusage, int cksumtype,
 590                                      char *data, size_t datalen)
 591 {
 592   int res;
 593
 594   if (data && datalen > 0)
 595     {
 596       char *cksum;
 597       size_t cksumlen;
 598
 599       res = shishi_checksum (handle, key, keyusage, cksumtype,
 600                              data, datalen, &cksum, &cksumlen);
 601       if (res != SHISHI_OK)
 602         return res;
 603
 604       res = shishi_authenticator_set_cksum (handle, authenticator,
 605                                             cksumtype, cksum, cksumlen);
 606       free (cksum);
 607     }
 608   else
 609     res = shishi_authenticator_remove_cksum (handle, authenticator);
 610
 611   return res;
 612 }
 613
 614 /**
 615  * shishi_authenticator_clear_authorizationdata:
 616  * @handle: shishi handle as allocated by shishi_init().
 617  * @authenticator: Authenticator as allocated by shishi_authenticator().
 618  *
 619  * Remove the authorization-data field from Authenticator.
 620  *
 621  * Return value: Returns SHISHI_OK iff successful.
 622  **/
 623 int
 624 shishi_authenticator_clear_authorizationdata (Shishi * handle,
 625                                               Shishi_asn1 authenticator)
 626 {
 627   int res;
 628
 629   res = shishi_asn1_write (handle, authenticator,
 630                            "authorization-data", NULL, 0);
 631   if (res != SHISHI_OK)
 632     return SHISHI_ASN1_ERROR;
 633
 634   return SHISHI_OK;
 635 }
 636
 637 /**
 638  * shishi_authenticator_add_authorizationdata:
 639  * @handle: shishi handle as allocated by shishi_init().
 640  * @authenticator: authenticator as allocated by shishi_authenticator().
 641  * @adtype: input authorization data type to add.
 642  * @addata: input authorization data to add.
 643  * @addatalen: size of input authorization data to add.
 644  *
 645  * Add authorization data to authenticator.
 646  *
 647  * Return value: Returns SHISHI_OK iff successful.
 648  **/
 649 int
 650 shishi_authenticator_add_authorizationdata (Shishi * handle,
 651                                             Shishi_asn1 authenticator,
 652                                             int adtype,
 653                                             char *addata, size_t addatalen)
 654 {
 655   char *format;
 656   int res;
 657   int i;
 658
 659   res = shishi_asn1_write (handle, authenticator,
 660                            "authorization-data", "NEW", 1);
 661   if (res != SHISHI_OK)
 662     return res;
 663
 664   res = shishi_asn1_number_of_elements (handle, authenticator,
 665                                         "authorization-data", &i);
 666   if (res != SHISHI_OK)
 667     return res;
 668
 669   asprintf (&format, "authorization-data.?%d.ad-type", i);
 670   res = shishi_asn1_write_integer (handle, authenticator, format, adtype);
 671   if (res != SHISHI_OK)
 672     {
 673       free (format);
 674       return res;
 675     }
 676
 677   sprintf (format, "authorization-data.?%d.ad-data", i);
 678   res = shishi_asn1_write (handle, authenticator, format, addata, addatalen);
 679   free (format);
 680   if (res != SHISHI_OK)
 681     return res;
 682
 683   return SHISHI_OK;
 684 }
 685
 686 /**
 687  * shishi_authenticator_authorizationdata:
 688  * @handle: shishi handle as allocated by shishi_init().
 689  * @authenticator: authenticator as allocated by shishi_authenticator().
 690  * @adtype: output authorization data type.
 691  * @addata: output authorization data.
 692  * @addatalen: on input, maximum size of output authorization data,
 693  *             on output, actual size of authorization data.
 694  * @nth: element number of authorization-data to extract.
 695  *
 696  * Extract n:th authorization data from authenticator.  The first
 697  * field is 1.
 698  *
 699  * Return value: Returns SHISHI_OK iff successful.
 700  **/
 701 int
 702 shishi_authenticator_authorizationdata (Shishi * handle,
 703                                         Shishi_asn1 authenticator,
 704                                         int *adtype,
 705                                         char *addata, size_t * addatalen,
 706                                         int nth)
 707 {
 708   char *format;
 709   int res;
 710   int i;
 711
 712   res = shishi_asn1_number_of_elements (handle, authenticator,
 713                                         "authorization-data", &i);
 714   if (res != SHISHI_OK)
 715     return SHISHI_ASN1_ERROR;
 716
 717   if (nth > i)
 718     return SHISHI_OUT_OF_RANGE;
 719
 720   asprintf (&format, "authorization-data.?%d.ad-type", nth);
 721   res = shishi_asn1_read_int32 (handle, authenticator, format, adtype);
 722   free (format);
 723   if (res != SHISHI_OK)
 724     return res;
 725
 726   asprintf (&format, "authorization-data.?%d.ad-data", i);
 727   res = shishi_asn1_read (handle, authenticator, format, addata, addatalen);
 728   free (format);
 729   if (res != SHISHI_OK)
 730     return res;
 731
 732   return SHISHI_OK;
 733 }
 734
 735 /**
 736  * shishi_authenticator_remove_subkey:
 737  * @handle: shishi handle as allocated by shishi_init().
 738  * @authenticator: authenticator as allocated by shishi_authenticator().
 739  *
 740  * Remove subkey from the authenticator.
 741  *
 742  * Return value: Returns SHISHI_OK iff successful.
 743  **/
 744 int
 745 shishi_authenticator_remove_subkey (Shishi * handle,
 746                                     Shishi_asn1 authenticator)
 747 {
 748   int res;
 749
 750   res = shishi_asn1_write (handle, authenticator, "subkey", NULL, 0);
 751   if (res != SHISHI_OK)
 752     return res;
 753
 754   return SHISHI_OK;
 755 }
 756
 757 /**
 758  * shishi_authenticator_get_subkey:
 759  * @handle: shishi handle as allocated by shishi_init().
 760  * @authenticator: authenticator as allocated by shishi_authenticator().
 761  * @subkey: output newly allocated subkey from authenticator.
 762  *
 763  * Read subkey value from authenticator.
 764  *
 765  * Return value: Returns SHISHI_OK if successful or SHISHI_ASN1_NO_ELEMENT
 766  *               if subkey is not present.
 767  **/
 768 int
 769 shishi_authenticator_get_subkey (Shishi * handle,
 770                                  Shishi_asn1 authenticator,
 771                                  Shishi_key ** subkey)
 772 {
 773   int res;
 774   int subkeytype;
 775   char *subkeyvalue;
 776   size_t subkeylen;
 777   int n;
 778
 779   res = shishi_asn1_number_of_elements (handle, authenticator, "subkey", &n);
 780   if (res != SHISHI_OK)
 781     return res;
 782
 783   res = shishi_asn1_read_int32 (handle, authenticator,
 784                                 "subkey.keytype", &subkeytype);
 785   if (res != SHISHI_OK)
 786     return res;
 787
 788   res = shishi_asn1_read2 (handle, authenticator, "subkey.keyvalue",
 789                            &subkeyvalue, &subkeylen);
 790   if (res != SHISHI_OK)
 791     return res;
 792
 793   res = shishi_key (handle, subkey);
 794   if (res != SHISHI_OK)
 795     return res;
 796
 797   shishi_key_type_set (*subkey, subkeytype);
 798   shishi_key_value_set (*subkey, subkeyvalue);
 799
 800   return SHISHI_OK;
 801 }
 802
 803 /**
 804  * shishi_authenticator_set_subkey:
 805  * @handle: shishi handle as allocated by shishi_init().
 806  * @authenticator: authenticator as allocated by shishi_authenticator().
 807  * @subkeytype: input subkey type to store in authenticator.
 808  * @subkey: input subkey data to store in authenticator.
 809  * @subkeylen: size of input subkey data to store in authenticator.
 810  *
 811  * Store subkey value in authenticator.  A subkey is usually created
 812  * by calling shishi_key_random() using the default encryption type of
 813  * the key from the ticket that is being used.  To save time, you may
 814  * want to use shishi_authenticator_add_subkey() instead, which calculates
 815  * the subkey and calls this function in one step.
 816  *
 817  * Return value: Returns SHISHI_OK iff successful.
 818  **/
 819 int
 820 shishi_authenticator_set_subkey (Shishi * handle,
 821                                  Shishi_asn1 authenticator,
 822                                  int32_t subkeytype,
 823                                  char *subkey, size_t subkeylen)
 824 {
 825   int res;
 826
 827   res = shishi_asn1_write_int32 (handle, authenticator,
 828                                  "subkey.keytype", subkeytype);
 829   if (res != SHISHI_OK)
 830     return res;
 831
 832   res = shishi_asn1_write (handle, authenticator, "subkey.keyvalue",
 833                            subkey, subkeylen);
 834   if (res != SHISHI_OK)
 835     return res;
 836
 837   return SHISHI_OK;
 838 }
 839
 840 /**
 841  * shishi_authenticator_add_random_subkey:
 842  * @handle: shishi handle as allocated by shishi_init().
 843  * @authenticator: authenticator as allocated by shishi_authenticator().
 844  *
 845  * Generate random subkey and store it in the authenticator.
 846  *
 847  * Return value: Returns SHISHI_OK iff successful.
 848  **/
 849 int
 850 shishi_authenticator_add_random_subkey (Shishi * handle,
 851                                         Shishi_asn1 authenticator)
 852 {
 853   int res;
 854   int *etypes;
 855   Shishi_key *subkey;
 856
 857   res = shishi_cfg_clientkdcetype (handle, &etypes);
 858   if (!res)
 859     return res;
 860
 861   res = shishi_key_random (handle, etypes[0], &subkey);
 862   if (res != SHISHI_OK)
 863     return res;
 864
 865   res = shishi_authenticator_set_subkey (handle, authenticator,
 866                                          shishi_key_type (subkey),
 867                                          shishi_key_value (subkey),
 868                                          shishi_key_length (subkey));
 869
 870   shishi_key_done (subkey);
 871
 872   return res;
 873 }
 874
 875 /**
 876  * shishi_authenticator_add_subkey:
 877  * @handle: shishi handle as allocated by shishi_init().
 878  * @authenticator: authenticator as allocated by shishi_authenticator().
 879  * @subkey: subkey to add to authenticator.
 880  *
 881  * Store subkey in the authenticator.
 882  *
 883  * Return value: Returns SHISHI_OK iff successful.
 884  **/
 885 int
 886 shishi_authenticator_add_subkey (Shishi * handle,
 887                                  Shishi_asn1 authenticator,
 888                                  Shishi_key * subkey)
 889 {
 890   int res;
 891   int *etypes;
 892
 893   res = shishi_cfg_clientkdcetype (handle, &etypes);
 894   if (res != SHISHI_OK)
 895     return res;
 896
 897   res = shishi_authenticator_set_subkey (handle, authenticator,
 898                                          shishi_key_type (subkey),
 899                                          shishi_key_value (subkey),
 900                                          shishi_key_length (subkey));
 901
 902   return res;
 903 }