Add.
[shishi.git] / lib / aprep.c
blobb0daa9fb9237cd3e2016cd23947687d6c580b388
1 /* aprep.c --- AP-REP functions.
2 * Copyright (C) 2002, 2003, 2004 Simon Josefsson
4 * This file is part of Shishi.
6 * Shishi is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * Shishi is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with Shishi; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
22 #include "internal.h"
24 /* Get _shishi_print_armored_data, etc. */
25 #include "diskio.h"
27 #define SHISHI_APREP_DEFAULT_PVNO "5"
28 #define SHISHI_APREP_DEFAULT_PVNO_LEN 0
29 #define SHISHI_APREP_DEFAULT_MSG_TYPE "15" /* KRB_AP_REP */
30 #define SHISHI_APREP_DEFAULT_MSG_TYPE_LEN 0
31 #define SHISHI_APREP_DEFAULT_ENC_PART_ETYPE "0"
32 #define SHISHI_APREP_DEFAULT_ENC_PART_ETYPE_LEN 0
33 #define SHISHI_APREP_DEFAULT_ENC_PART_KVNO "0"
34 #define SHISHI_APREP_DEFAULT_ENC_PART_KVNO_LEN 0
35 #define SHISHI_APREP_DEFAULT_ENC_PART_CIPHER ""
36 #define SHISHI_APREP_DEFAULT_ENC_PART_CIPHER_LEN 0
38 /**
39 * shishi_aprep:
40 * @handle: shishi handle as allocated by shishi_init().
42 * This function creates a new AP-REP, populated with some default
43 * values.
45 * Return value: Returns the authenticator or NULL on
46 * failure.
47 **/
48 Shishi_asn1
49 shishi_aprep (Shishi * handle)
51 Shishi_asn1 node;
52 int res;
54 node = shishi_asn1_aprep (handle);
55 if (!node)
56 return NULL;
58 res = shishi_asn1_write (handle, node, "pvno",
59 SHISHI_APREP_DEFAULT_PVNO,
60 SHISHI_APREP_DEFAULT_PVNO_LEN);
61 if (res != SHISHI_OK)
62 goto error;
64 res = shishi_asn1_write (handle, node, "msg-type",
65 SHISHI_APREP_DEFAULT_MSG_TYPE,
66 SHISHI_APREP_DEFAULT_MSG_TYPE_LEN);
67 if (res != SHISHI_OK)
68 goto error;
70 res = shishi_asn1_write (handle, node, "enc-part.etype",
71 SHISHI_APREP_DEFAULT_ENC_PART_ETYPE,
72 SHISHI_APREP_DEFAULT_ENC_PART_ETYPE_LEN);
73 if (res != SHISHI_OK)
74 goto error;
76 res = shishi_asn1_write (handle, node, "enc-part.kvno",
77 SHISHI_APREP_DEFAULT_ENC_PART_KVNO,
78 SHISHI_APREP_DEFAULT_ENC_PART_KVNO_LEN);
79 if (res != SHISHI_OK)
80 goto error;
82 res = shishi_asn1_write (handle, node, "enc-part.cipher",
83 SHISHI_APREP_DEFAULT_ENC_PART_CIPHER,
84 SHISHI_APREP_DEFAULT_ENC_PART_CIPHER_LEN);
85 if (res != SHISHI_OK)
86 goto error;
88 return node;
90 error:
91 shishi_asn1_done (handle, node);
92 return NULL;
95 /**
96 * shishi_aprep_print:
97 * @handle: shishi handle as allocated by shishi_init().
98 * @fh: file handle open for writing.
99 * @aprep: AP-REP to print.
101 * Print ASCII armored DER encoding of AP-REP to file.
103 * Return value: Returns SHISHI_OK iff successful.
106 shishi_aprep_print (Shishi * handle, FILE * fh, Shishi_asn1 aprep)
108 return _shishi_print_armored_data (handle, fh, aprep, "AP-REP", NULL);
112 * shishi_aprep_save:
113 * @handle: shishi handle as allocated by shishi_init().
114 * @fh: file handle open for writing.
115 * @aprep: AP-REP to save.
117 * Save DER encoding of AP-REP to file.
119 * Return value: Returns SHISHI_OK iff successful.
122 shishi_aprep_save (Shishi * handle, FILE * fh, Shishi_asn1 aprep)
124 return _shishi_save_data (handle, fh, aprep, "AP-REP");
128 * shishi_aprep_to_file:
129 * @handle: shishi handle as allocated by shishi_init().
130 * @aprep: AP-REP to save.
131 * @filetype: input variable specifying type of file to be written,
132 * see Shishi_filetype.
133 * @filename: input variable with filename to write to.
135 * Write AP-REP to file in specified TYPE. The file will be
136 * truncated if it exists.
138 * Return value: Returns SHISHI_OK iff successful.
141 shishi_aprep_to_file (Shishi * handle, Shishi_asn1 aprep,
142 int filetype, const char *filename)
144 FILE *fh;
145 int res;
147 if (VERBOSE (handle))
148 printf (_("Writing AP-REP to %s...\n"), filename);
150 fh = fopen (filename, "w");
151 if (fh == NULL)
152 return SHISHI_FOPEN_ERROR;
154 if (VERBOSE (handle))
155 printf (_("Writing AP-REP in %s format...\n"),
156 filetype == SHISHI_FILETYPE_TEXT ? "TEXT" : "DER");
158 if (filetype == SHISHI_FILETYPE_TEXT)
159 res = shishi_aprep_print (handle, fh, aprep);
160 else
161 res = shishi_aprep_save (handle, fh, aprep);
162 if (res != SHISHI_OK)
163 return res;
165 res = fclose (fh);
166 if (res != 0)
167 return SHISHI_IO_ERROR;
169 if (VERBOSE (handle))
170 printf (_("Writing AP-REP to %s...done\n"), filename);
172 return SHISHI_OK;
176 * shishi_aprep_parse:
177 * @handle: shishi handle as allocated by shishi_init().
178 * @fh: file handle open for reading.
179 * @aprep: output variable with newly allocated AP-REP.
181 * Read ASCII armored DER encoded AP-REP from file and populate given
182 * variable.
184 * Return value: Returns SHISHI_OK iff successful.
187 shishi_aprep_parse (Shishi * handle, FILE * fh, Shishi_asn1 * aprep)
189 return _shishi_aprep_input (handle, fh, aprep, 0);
193 * shishi_aprep_read:
194 * @handle: shishi handle as allocated by shishi_init().
195 * @fh: file handle open for reading.
196 * @aprep: output variable with newly allocated AP-REP.
198 * Read DER encoded AP-REP from file and populate given variable.
200 * Return value: Returns SHISHI_OK iff successful.
203 shishi_aprep_read (Shishi * handle, FILE * fh, Shishi_asn1 * aprep)
205 return _shishi_aprep_input (handle, fh, aprep, 1);
209 * shishi_aprep_from_file:
210 * @handle: shishi handle as allocated by shishi_init().
211 * @aprep: output variable with newly allocated AP-REP.
212 * @filetype: input variable specifying type of file to be read,
213 * see Shishi_filetype.
214 * @filename: input variable with filename to read from.
216 * Read AP-REP from file in specified TYPE.
218 * Return value: Returns SHISHI_OK iff successful.
221 shishi_aprep_from_file (Shishi * handle, Shishi_asn1 * aprep,
222 int filetype, const char *filename)
224 int res;
225 FILE *fh;
227 if (VERBOSE (handle))
228 printf (_("Reading AP-REP from %s...\n"), filename);
230 fh = fopen (filename, "r");
231 if (fh == NULL)
232 return SHISHI_FOPEN_ERROR;
234 if (VERBOSE (handle))
235 printf (_("Reading AP-REP in %s format...\n"),
236 filetype == SHISHI_FILETYPE_TEXT ? "TEXT" : "DER");
238 if (filetype == SHISHI_FILETYPE_TEXT)
239 res = shishi_aprep_parse (handle, fh, aprep);
240 else
241 res = shishi_aprep_read (handle, fh, aprep);
242 if (res != SHISHI_OK)
243 return res;
245 res = fclose (fh);
246 if (res != 0)
247 return SHISHI_IO_ERROR;
249 if (VERBOSE (handle))
250 printf (_("Reading AP-REP from %s...done\n"), filename);
252 return SHISHI_OK;
256 shishi_aprep_enc_part_set (Shishi * handle,
257 Shishi_asn1 aprep,
258 int etype, const char *buf, size_t buflen)
260 int res;
262 res = shishi_asn1_write (handle, aprep, "enc-part.cipher", buf, buflen);
263 if (res != SHISHI_OK)
264 return res;
266 res = shishi_asn1_write_integer (handle, aprep, "enc-part.etype", etype);
267 if (res != SHISHI_OK)
268 return res;
270 return SHISHI_OK;
274 shishi_aprep_enc_part_add (Shishi * handle,
275 Shishi_asn1 aprep,
276 Shishi_asn1 encticketpart,
277 Shishi_asn1 encapreppart)
279 int res;
280 char *buf;
281 size_t buflen;
282 char *der;
283 size_t derlen;
284 Shishi_key *key;
286 res = shishi_encticketpart_get_key (handle, encticketpart, &key);
287 if (res != SHISHI_OK)
288 return res;
290 res = shishi_asn1_to_der (handle, encapreppart, &der, &derlen);
291 if (res != SHISHI_OK)
293 shishi_error_printf (handle, "Could not DER encode authenticator: %s\n",
294 shishi_strerror (res));
295 return !SHISHI_OK;
298 der = xrealloc (der, derlen + 8);
300 while ((derlen % 8) != 0)
302 der[derlen] = '\0';
303 derlen++;
306 res = shishi_encrypt (handle, key, SHISHI_KEYUSAGE_ENCAPREPPART,
307 der, derlen, &buf, &buflen);
309 free (der);
311 if (res != SHISHI_OK)
313 shishi_error_printf (handle, "APRep encryption failed\n");
314 return res;
317 res = shishi_aprep_enc_part_set (handle, aprep, shishi_key_type (key),
318 buf, buflen);
320 free (buf);
322 return res;
326 shishi_aprep_enc_part_make (Shishi * handle,
327 Shishi_asn1 aprep,
328 Shishi_asn1 encapreppart,
329 Shishi_asn1 authenticator,
330 Shishi_asn1 encticketpart)
332 int res;
334 res = shishi_encapreppart_time_copy (handle, encapreppart, authenticator);
335 if (res != SHISHI_OK)
337 shishi_error_printf (handle, "Could not copy time: %s\n",
338 shishi_error (handle));
339 return res;
342 res = shishi_aprep_enc_part_add (handle, aprep, encticketpart,
343 encapreppart);
344 if (res != SHISHI_OK)
346 shishi_error_printf (handle, "Could not add encapreppart: %s\n",
347 shishi_error (handle));
348 return res;
351 return SHISHI_OK;
355 * shishi_aprep_get_enc_part_etype:
356 * @handle: shishi handle as allocated by shishi_init().
357 * @aprep: AP-REP variable to get value from.
358 * @etype: output variable that holds the value.
360 * Extract AP-REP.enc-part.etype.
362 * Return value: Returns SHISHI_OK iff successful.
365 shishi_aprep_get_enc_part_etype (Shishi * handle,
366 Shishi_asn1 aprep, int32_t * etype)
368 return shishi_asn1_read_int32 (handle, aprep, "enc-part.etype", etype);
372 shishi_aprep_decrypt (Shishi * handle,
373 Shishi_asn1 aprep,
374 Shishi_key * key,
375 int keyusage, Shishi_asn1 * encapreppart)
377 int res;
378 int i;
379 char *buf;
380 size_t buflen;
381 char *cipher;
382 size_t cipherlen;
383 int etype;
385 res = shishi_aprep_get_enc_part_etype (handle, aprep, &etype);
386 if (res != SHISHI_OK)
387 return res;
389 if (etype != shishi_key_type (key))
390 return SHISHI_APREP_BAD_KEYTYPE;
392 res = shishi_asn1_read (handle, aprep, "enc-part.cipher",
393 &cipher, &cipherlen);
394 if (res != SHISHI_OK)
395 return res;
397 res = shishi_decrypt (handle, key, keyusage, cipher, cipherlen,
398 &buf, &buflen);
399 free (cipher);
400 if (res != SHISHI_OK)
402 shishi_error_printf (handle,
403 "APRep decryption failed, wrong password?\n");
404 return res;
407 /* The crypto is so 1980; no length indicator. Trim off pad bytes
408 until we can parse it. */
409 for (i = 0; i < 8; i++)
411 if (VERBOSEASN1 (handle))
412 printf ("Trying with %d pad in enckdcrep...\n", i);
414 *encapreppart = shishi_der2asn1_encapreppart (handle, &buf[0],
415 buflen - i);
416 if (*encapreppart != NULL)
417 break;
420 if (*encapreppart == NULL)
422 shishi_error_printf (handle, "Could not DER decode EncAPRepPart. "
423 "Password probably correct (decrypt ok) though\n");
424 return SHISHI_ASN1_ERROR;
427 return SHISHI_OK;
431 shishi_aprep_verify (Shishi * handle,
432 Shishi_asn1 authenticator, Shishi_asn1 encapreppart)
434 char *authenticatorctime;
435 char *encapreppartctime;
436 uint32_t authenticatorcusec, encapreppartcusec;
437 int res;
438 int different;
441 3.2.5. Receipt of KRB_AP_REP message
443 If a KRB_AP_REP message is returned, the client uses the session key from
444 the credentials obtained for the server[3.10] to decrypt the message, and
445 verifies that the timestamp and microsecond fields match those in the
446 Authenticator it sent to the server. If they match, then the client is
447 assured that the server is genuine. The sequence number and subkey (if
448 present) are retained for later use.
452 res = shishi_authenticator_ctime (handle, authenticator,
453 &authenticatorctime);
454 if (res != SHISHI_OK)
455 return res;
457 res = shishi_authenticator_cusec_get (handle, authenticator,
458 &authenticatorcusec);
459 if (res != SHISHI_OK)
460 return res;
462 res = shishi_encapreppart_ctime (handle, encapreppart, &encapreppartctime);
463 if (res != SHISHI_OK)
464 return res;
466 res = shishi_encapreppart_cusec_get (handle, encapreppart,
467 &encapreppartcusec);
468 if (res != SHISHI_OK)
469 return res;
471 if (VERBOSE (handle))
473 printf ("authenticator cusec %08x ctime %s\n", authenticatorcusec,
474 authenticatorctime);
475 printf ("encapreppart cusec %08x ctime %s\n", encapreppartcusec,
476 encapreppartctime);
479 different = authenticatorcusec != encapreppartcusec ||
480 strcmp (authenticatorctime, encapreppartctime) != 0;
482 free (authenticatorctime);
483 free (encapreppartctime);
485 if (different)
486 return SHISHI_APREP_VERIFY_FAILED;
488 return SHISHI_OK;