lib/as.c

   1 /* as.c --- High level client AS functions
   2  * Copyright (C) 2002, 2003, 2004, 2006  Simon Josefsson
   3  *
   4  * This file is part of Shishi.
   5  *
   6  * Shishi is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * Shishi is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with Shishi; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  */
  21
  22 #include "internal.h"
  23
  24 struct Shishi_as
  25 {
  26   Shishi *handle;
  27   Shishi_asn1 asreq;
  28   Shishi_asn1 asrep;
  29   Shishi_asn1 krberror;
  30   Shishi_tkt *tkt;
  31 };
  32
  33 /**
  34  * shishi_as:
  35  * @handle: shishi handle as allocated by shishi_init().
  36  * @as: holds pointer to newly allocate Shishi_as structure.
  37  *
  38  * Allocate a new AS exchange variable.
  39  *
  40  * Return value: Returns SHISHI_OK iff successful.
  41  **/
  42 int
  43 shishi_as (Shishi * handle, Shishi_as ** as)
  44 {
  45   Shishi_as *las;
  46   int res;
  47
  48   *as = xmalloc (sizeof (**as));
  49   las = *as;
  50   memset (las, 0, sizeof (*las));
  51
  52   las->handle = handle;
  53
  54   las->asreq = shishi_asreq (handle);
  55   if (las->asreq == NULL)
  56     {
  57       shishi_error_printf (handle, "Could not create AS-REQ: %s\n",
  58                            shishi_error (handle));
  59       return SHISHI_ASN1_ERROR;
  60     }
  61
  62   las->asrep = shishi_asrep (handle);
  63   if (las->asrep == NULL)
  64     {
  65       shishi_error_printf (handle, "Could not create AS-REP: %s\n",
  66                            shishi_error (handle));
  67       return SHISHI_ASN1_ERROR;
  68     }
  69
  70   las->krberror = shishi_krberror (handle);
  71   if (las->krberror == NULL)
  72     {
  73       shishi_error_printf (handle, "Could not create KRB-ERROR: %s\n",
  74                            shishi_error (handle));
  75       return SHISHI_ASN1_ERROR;
  76     }
  77
  78   res = shishi_tkt (handle, &las->tkt);
  79   if (res != SHISHI_OK)
  80     return res;
  81
  82   res = shishi_tkt_flags_set (las->tkt, SHISHI_TICKETFLAGS_INITIAL);
  83   if (res != SHISHI_OK)
  84     return res;
  85
  86   return SHISHI_OK;
  87 }
  88
  89 /**
  90  * shishi_as_done:
  91  * @as: structure that holds information about AS exchange
  92  *
  93  * Deallocate resources associated with AS exchange.  This should be
  94  * called by the application when it no longer need to utilize the AS
  95  * exchange handle.
  96  **/
  97 void
  98 shishi_as_done (Shishi_as * as)
  99 {
 100   shishi_asn1_done (as->handle, as->asreq);
 101   shishi_asn1_done (as->handle, as->asrep);
 102   shishi_asn1_done (as->handle, as->krberror);
 103   shishi_tkt_done (as->tkt);
 104   free (as);
 105 }
 106
 107 /* TODO: add shishi_as_clientserver(h,p,a,client,server) and make the
 108    shishi_as_cnamerealmsname function take real cname/sname pointer
 109    arrays. */
 110
 111 /**
 112  * shishi_as_req:
 113  * @as: structure that holds information about AS exchange
 114  *
 115  * Get ASN.1 AS-REQ structure from AS exchange.
 116  *
 117  * Return value: Returns the generated AS-REQ packet from the AS
 118  *               exchange, or NULL if not yet set or an error occured.
 119  **/
 120 Shishi_asn1
 121 shishi_as_req (Shishi_as * as)
 122 {
 123   return as->asreq;
 124 }
 125
 126 /**
 127  * shishi_as_req_build:
 128  * @as: structure that holds information about AS exchange
 129  *
 130  * Possibly remove unset fields (e.g., rtime).
 131  *
 132  * Return value: Returns SHISHI_OK iff successful.
 133  **/
 134 int
 135 shishi_as_req_build (Shishi_as * as)
 136 {
 137   int res;
 138
 139   res = shishi_kdcreq_build (as->handle, as->asreq);
 140   if (res != SHISHI_OK)
 141     return res;
 142
 143   return SHISHI_OK;
 144 }
 145
 146 /**
 147  * shishi_as_req_set:
 148  * @as: structure that holds information about AS exchange
 149  * @asreq: asreq to store in AS.
 150  *
 151  * Set the AS-REQ in the AS exchange.
 152  **/
 153 void
 154 shishi_as_req_set (Shishi_as * as, Shishi_asn1 asreq)
 155 {
 156   if (as->asreq)
 157     shishi_asn1_done (as->handle, as->asreq);
 158   as->asreq = asreq;
 159 }
 160
 161 /**
 162  * shishi_as_req_der:
 163  * @as: structure that holds information about AS exchange
 164  * @out: output array with newly allocated DER encoding of AS-REQ.
 165  * @outlen: length of output array with DER encoding of AS-REQ.
 166  *
 167  * DER encode AS-REQ.  @out is allocated by this function, and it is
 168  * the responsibility of caller to deallocate it.
 169  *
 170  * Return value: Returns SHISHI_OK iff successful.
 171  **/
 172 int
 173 shishi_as_req_der (Shishi_as * as, char **out, size_t * outlen)
 174 {
 175   int rc;
 176
 177   rc = shishi_asn1_to_der (as->handle, as->asreq, out, outlen);
 178   if (rc != SHISHI_OK)
 179     return rc;
 180
 181   return SHISHI_OK;
 182 }
 183
 184 /**
 185  * shishi_as_req_der_set:
 186  * @as: structure that holds information about AS exchange
 187  * @der: input array with DER encoded AP-REQ.
 188  * @derlen: length of input array with DER encoded AP-REQ.
 189  *
 190  * DER decode AS-REQ and set it AS exchange.  If decoding fails, the
 191  * AS-REQ in the AS exchange remains.
 192  *
 193  * Return value: Returns SHISHI_OK.
 194  **/
 195 int
 196 shishi_as_req_der_set (Shishi_as * as, char *der, size_t derlen)
 197 {
 198   Shishi_asn1 asreq;
 199
 200   asreq = shishi_der2asn1_asreq (as->handle, der, derlen);
 201
 202   if (asreq == NULL)
 203     return SHISHI_ASN1_ERROR;
 204
 205   as->asreq = asreq;
 206
 207   return SHISHI_OK;
 208 }
 209
 210 /**
 211  * shishi_as_rep:
 212  * @as: structure that holds information about AS exchange
 213  *
 214  * Get ASN.1 AS-REP structure from AS exchange.
 215  *
 216  * Return value: Returns the received AS-REP packet from the AS
 217  *               exchange, or NULL if not yet set or an error occured.
 218  **/
 219 Shishi_asn1
 220 shishi_as_rep (Shishi_as * as)
 221 {
 222   return as->asrep;
 223 }
 224
 225 /**
 226  * shishi_as_rep_process:
 227  * @as: structure that holds information about AS exchange
 228  * @key: user's key, used to encrypt the encrypted part of the AS-REP.
 229  * @password: user's password, used if key is NULL.
 230  *
 231  * Process new AS-REP and set ticket.  The key is used to decrypt the
 232  * AP-REP.  If both key and password is NULL, the user is queried for
 233  * it.
 234  *
 235  * Return value: Returns SHISHI_OK iff successful.
 236  **/
 237 int
 238 shishi_as_rep_process (Shishi_as * as, Shishi_key * key, const char *password)
 239 {
 240   Shishi_asn1 ticket, kdcreppart;
 241   int res;
 242
 243   if (VERBOSE (as->handle))
 244     printf ("Processing AS-REQ and AS-REP...\n");
 245
 246   if (VERBOSEASN1 (as->handle))
 247     shishi_kdcreq_print (as->handle, stdout, as->asreq);
 248
 249   if (VERBOSEASN1 (as->handle))
 250     shishi_kdcrep_print (as->handle, stdout, as->asrep);
 251
 252   if (key == NULL && password == NULL)
 253     {
 254       char *passwd;
 255       char *user;
 256       size_t userlen;
 257
 258       res = shishi_asreq_clientrealm (as->handle, as->asreq, &user, &userlen);
 259       if (res != SHISHI_OK)
 260         {
 261           shishi_error_printf (as->handle, "Could not extract cname and "
 262                                "realm from AS-REQ: %s\n",
 263                                shishi_strerror (res),
 264                                shishi_error (as->handle));
 265           return res;
 266         }
 267
 268       res = shishi_prompt_password (as->handle, &passwd,
 269                                     "Enter password for `%s': ", user);
 270       free (user);
 271       if (res != SHISHI_OK)
 272         {
 273           shishi_error_printf (as->handle, "Reading password failed: %s\n",
 274                                shishi_strerror (res));
 275           return res;
 276         }
 277
 278       res = shishi_as_process (as->handle, as->asreq, as->asrep,
 279                                passwd, &kdcreppart);
 280       free (passwd);
 281     }
 282   else if (key == NULL)
 283     res = shishi_as_process (as->handle, as->asreq, as->asrep,
 284                              password, &kdcreppart);
 285   else
 286     res = shishi_kdc_process (as->handle, as->asreq, as->asrep, key,
 287                               SHISHI_KEYUSAGE_ENCASREPPART, &kdcreppart);
 288   if (res != SHISHI_OK)
 289     return res;
 290
 291   if (VERBOSE (as->handle))
 292     printf ("Got EncKDCRepPart...\n");
 293
 294   if (VERBOSEASN1 (as->handle))
 295     shishi_enckdcreppart_print (as->handle, stdout, kdcreppart);
 296
 297   res = shishi_kdcrep_get_ticket (as->handle, as->asrep, &ticket);
 298   if (res != SHISHI_OK)
 299     {
 300       shishi_error_printf (as->handle,
 301                            "Could not extract ticket from AS-REP: %s",
 302                            shishi_error (as->handle));
 303       return res;
 304     }
 305
 306   if (VERBOSE (as->handle))
 307     printf ("Got Ticket...\n");
 308
 309   if (VERBOSEASN1 (as->handle))
 310     shishi_ticket_print (as->handle, stdout, ticket);
 311
 312   /* XXX */
 313   as->tkt = shishi_tkt2 (as->handle, ticket, kdcreppart, as->asrep);
 314
 315   return SHISHI_OK;
 316 }
 317
 318 /**
 319  * shishi_as_rep_build:
 320  * @as: structure that holds information about AS exchange
 321  * @key: user's key, used to encrypt the encrypted part of the AS-REP.
 322  *
 323  * Build AS-REP.
 324  *
 325  * Return value: Returns SHISHI_OK iff successful.
 326  **/
 327 int
 328 shishi_as_rep_build (Shishi_as * as, Shishi_key * key)
 329 {
 330   int rc;
 331
 332   /* XXX there are reasons for having padata in AS-REP */
 333   rc = shishi_kdcrep_clear_padata (as->handle, as->asrep);
 334   if (rc != SHISHI_OK)
 335     return rc;
 336
 337   rc = shishi_enckdcreppart_populate_encticketpart
 338     (as->handle, shishi_tkt_enckdcreppart (as->tkt),
 339      shishi_tkt_encticketpart (as->tkt));
 340   if (rc != SHISHI_OK)
 341     return rc;
 342
 343   rc = shishi_kdc_copy_nonce (as->handle, as->asreq,
 344                               shishi_tkt_enckdcreppart (as->tkt));
 345   if (rc != SHISHI_OK)
 346     return rc;
 347
 348   rc = shishi_kdcrep_add_enc_part (as->handle,
 349                                    as->asrep,
 350                                    key,
 351                                    SHISHI_KEYUSAGE_ENCASREPPART,
 352                                    shishi_tkt_enckdcreppart (as->tkt));
 353   if (rc != SHISHI_OK)
 354     return rc;
 355
 356   rc = shishi_kdcrep_set_ticket (as->handle, as->asrep,
 357                                  shishi_tkt_ticket (as->tkt));
 358   if (rc != SHISHI_OK)
 359     return rc;
 360
 361   rc = shishi_kdc_copy_crealm (as->handle, as->asrep,
 362                                shishi_tkt_encticketpart (as->tkt));
 363   if (rc != SHISHI_OK)
 364     return rc;
 365
 366   rc = shishi_kdc_copy_cname (as->handle, as->asrep,
 367                               shishi_tkt_encticketpart (as->tkt));
 368   if (rc != SHISHI_OK)
 369     return rc;
 370
 371   return SHISHI_OK;
 372 }
 373
 374 /**
 375  * shishi_as_rep_der:
 376  * @as: structure that holds information about AS exchange
 377  * @out: output array with newly allocated DER encoding of AS-REP.
 378  * @outlen: length of output array with DER encoding of AS-REP.
 379  *
 380  * DER encode AS-REP. @out is allocated by this function, and it is
 381  * the responsibility of caller to deallocate it.
 382  *
 383  * Return value: Returns SHISHI_OK iff successful.
 384  **/
 385 int
 386 shishi_as_rep_der (Shishi_as * as, char **out, size_t * outlen)
 387 {
 388   int rc;
 389
 390   rc = shishi_asn1_to_der (as->handle, as->asrep, out, outlen);
 391   if (rc != SHISHI_OK)
 392     return rc;
 393
 394   return SHISHI_OK;
 395 }
 396
 397 /**
 398  * shishi_as_rep_set:
 399  * @as: structure that holds information about AS exchange
 400  * @asrep: asrep to store in AS.
 401  *
 402  * Set the AS-REP in the AS exchange.
 403  **/
 404 void
 405 shishi_as_rep_set (Shishi_as * as, Shishi_asn1 asrep)
 406 {
 407   if (as->asrep)
 408     shishi_asn1_done (as->handle, as->asrep);
 409   as->asrep = asrep;
 410 }
 411
 412 /**
 413  * shishi_as_rep_der_set:
 414  * @as: structure that holds information about AS exchange
 415  * @der: input array with DER encoded AP-REP.
 416  * @derlen: length of input array with DER encoded AP-REP.
 417  *
 418  * DER decode AS-REP and set it AS exchange.  If decoding fails, the
 419  * AS-REP in the AS exchange remains.
 420  *
 421  * Return value: Returns SHISHI_OK.
 422  **/
 423 int
 424 shishi_as_rep_der_set (Shishi_as * as, char *der, size_t derlen)
 425 {
 426   Shishi_asn1 asrep;
 427
 428   asrep = shishi_der2asn1_asrep (as->handle, der, derlen);
 429
 430   if (asrep == NULL)
 431     return SHISHI_ASN1_ERROR;
 432
 433   as->asrep = asrep;
 434
 435   return SHISHI_OK;
 436 }
 437
 438 /**
 439  * shishi_as_krberror:
 440  * @as: structure that holds information about AS exchange
 441  *
 442  * Get ASN.1 KRB-ERROR structure from AS exchange.
 443  *
 444  * Return value: Returns the received KRB-ERROR packet from the AS
 445  *               exchange, or NULL if not yet set or an error occured.
 446  **/
 447 Shishi_asn1
 448 shishi_as_krberror (Shishi_as * as)
 449 {
 450   return as->krberror;
 451 }
 452
 453 /**
 454  * shishi_as_krberror_der:
 455  * @as: structure that holds information about AS exchange
 456  * @out: output array with newly allocated DER encoding of KRB-ERROR.
 457  * @outlen: length of output array with DER encoding of KRB-ERROR.
 458  *
 459  * DER encode KRB-ERROR. @out is allocated by this function, and it is
 460  * the responsibility of caller to deallocate it.
 461  *
 462  * Return value: Returns SHISHI_OK iff successful.
 463  **/
 464 int
 465 shishi_as_krberror_der (Shishi_as * as, char **out, size_t * outlen)
 466 {
 467   int rc;
 468
 469   rc = shishi_krberror_der (as->handle, as->krberror, out, outlen);
 470   if (rc != SHISHI_OK)
 471     return rc;
 472
 473   return SHISHI_OK;
 474 }
 475
 476 /**
 477  * shishi_as_krberror_set:
 478  * @as: structure that holds information about AS exchange
 479  * @krberror: krberror to store in AS.
 480  *
 481  * Set the KRB-ERROR in the AS exchange.
 482  **/
 483 void
 484 shishi_as_krberror_set (Shishi_as * as, Shishi_asn1 krberror)
 485 {
 486   if (as->krberror)
 487     shishi_asn1_done (as->handle, as->krberror);
 488   as->krberror = krberror;
 489 }
 490
 491 /**
 492  * shishi_as_tkt:
 493  * @as: structure that holds information about AS exchange
 494  *
 495  * Get Ticket in AS exchange.
 496  *
 497  * Return value: Returns the newly aquired tkt from the AS
 498  *               exchange, or NULL if not yet set or an error occured.
 499  **/
 500 Shishi_tkt *
 501 shishi_as_tkt (Shishi_as * as)
 502 {
 503   return as->tkt;
 504 }
 505
 506 /**
 507  * shishi_as_tkt_set:
 508  * @as: structure that holds information about AS exchange
 509  * @tkt: tkt to store in AS.
 510  *
 511  * Set the Tkt in the AS exchange.
 512  **/
 513 void
 514 shishi_as_tkt_set (Shishi_as * as, Shishi_tkt * tkt)
 515 {
 516   as->tkt = tkt;
 517 }
 518
 519 /**
 520  * shishi_as_sendrecv_hint:
 521  * @as: structure that holds information about AS exchange
 522  * @hint: additional parameters that modify connection behaviour, or %NULL.
 523  *
 524  * Send AS-REQ and receive AS-REP or KRB-ERROR.  This is the initial
 525  * authentication, usually used to acquire a Ticket Granting Ticket.
 526  * The @hint structure can be used to set, e.g., parameters for TLS
 527  * authentication.
 528  *
 529  * Return value: Returns SHISHI_OK iff successful.
 530  **/
 531 int
 532 shishi_as_sendrecv_hint (Shishi_as * as, Shishi_tkts_hint * hint)
 533 {
 534   int res;
 535
 536   if (VERBOSE (as->handle))
 537     printf ("Sending AS-REQ...\n");
 538
 539   if (VERBOSEASN1 (as->handle))
 540     shishi_kdcreq_print (as->handle, stdout, as->asreq);
 541
 542   res = shishi_kdcreq_sendrecv_hint (as->handle, as->asreq, &as->asrep, hint);
 543   if (res == SHISHI_GOT_KRBERROR)
 544     {
 545       as->krberror = as->asrep;
 546       as->asrep = NULL;
 547
 548       if (VERBOSE (as->handle))
 549         printf ("Received KRB-ERROR...\n");
 550       if (VERBOSEASN1 (as->handle))
 551         shishi_krberror_print (as->handle, stdout, as->krberror);
 552       if (VERBOSEASN1(as->handle))
 553         shishi_krberror_pretty_print (as->handle, stdout, as->krberror);
 554     }
 555   if (res != SHISHI_OK)
 556     return res;
 557
 558   if (VERBOSE (as->handle))
 559     printf ("Received AS-REP...\n");
 560
 561   if (VERBOSEASN1 (as->handle))
 562     shishi_kdcrep_print (as->handle, stdout, as->asrep);
 563
 564   return SHISHI_OK;
 565 }
 566
 567 /**
 568  * shishi_as_sendrecv:
 569  * @as: structure that holds information about AS exchange
 570  *
 571  * Send AS-REQ and receive AS-REP or KRB-ERROR.  This is the initial
 572  * authentication, usually used to acquire a Ticket Granting Ticket.
 573  *
 574  * Return value: Returns SHISHI_OK iff successful.
 575  **/
 576 int
 577 shishi_as_sendrecv (Shishi_as * as)
 578 {
 579   return shishi_as_sendrecv_hint (as, NULL);
 580 }