2 * Copyright (C) 2002, 2003 Simon Josefsson
4 * This file is part of Shishi.
6 * Shishi is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * Shishi is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with Shishi; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
29 Shishi_asn1 authenticator
;
32 Shishi_asn1 encapreppart
;
33 int authenticatorcksumkeyusage
;
34 int authenticatorkeyusage
;
35 int authenticatorcksumtype
;
36 char *authenticatorcksumdata
;
37 int authenticatorcksumdatalen
;
42 * @handle: shishi handle as allocated by shishi_init().
43 * @ap: pointer to new structure that holds information about AP exchange
45 * Create a new AP exchange.
47 * Return value: Returns SHISHI_OK iff successful.
50 shishi_ap (Shishi
* handle
, Shishi_ap
** ap
)
54 res
= shishi_ap_nosubkey (handle
, ap
);
57 shishi_error_printf (handle
, "Could not create Authenticator: %s\n",
58 shishi_error (handle
));
62 res
= shishi_authenticator_add_random_subkey (handle
, (*ap
)->authenticator
);
65 shishi_error_printf (handle
, "Could not add random subkey in AP: %s\n",
66 shishi_strerror (res
));
75 * @handle: shishi handle as allocated by shishi_init().
76 * @ap: pointer to new structure that holds information about AP exchange
78 * Create a new AP exchange without subkey in authenticator.
80 * Return value: Returns SHISHI_OK iff successful.
83 shishi_ap_nosubkey (Shishi
* handle
, Shishi_ap
** ap
)
87 *ap
= xcalloc (1, sizeof (**ap
));
91 lap
->authenticatorcksumtype
= SHISHI_NO_CKSUMTYPE
;
92 lap
->authenticatorcksumkeyusage
= SHISHI_KEYUSAGE_APREQ_AUTHENTICATOR_CKSUM
;
93 lap
->authenticatorkeyusage
= SHISHI_KEYUSAGE_APREQ_AUTHENTICATOR
;
95 lap
->authenticator
= shishi_authenticator (handle
);
96 if (lap
->authenticator
== NULL
)
98 shishi_error_printf (handle
, "Could not create Authenticator: %s\n",
99 shishi_error (handle
));
100 return SHISHI_ASN1_ERROR
;
103 lap
->apreq
= shishi_apreq (handle
);
104 if (lap
->apreq
== NULL
)
106 shishi_error_printf (handle
, "Could not create AP-REQ: %s\n",
107 shishi_error (handle
));
108 return SHISHI_ASN1_ERROR
;
111 lap
->aprep
= shishi_aprep (handle
);
112 if (lap
->aprep
== NULL
)
114 shishi_error_printf (handle
, "Could not create AP-REP: %s\n",
115 shishi_error (handle
));
116 return SHISHI_ASN1_ERROR
;
119 lap
->encapreppart
= shishi_encapreppart (handle
);
120 if (lap
->encapreppart
== NULL
)
122 shishi_error_printf (handle
, "Could not create EncAPRepPart: %s\n",
123 shishi_error (handle
));
124 return SHISHI_ASN1_ERROR
;
132 * @ap: structure that holds information about AP exchange
134 * Deallocate resources associated with AP exchange. This should be
135 * called by the application when it no longer need to utilize the AP
139 shishi_ap_done (Shishi_ap
* ap
)
141 shishi_asn1_done (ap
->handle
, ap
->authenticator
);
142 shishi_asn1_done (ap
->handle
, ap
->apreq
);
143 shishi_asn1_done (ap
->handle
, ap
->aprep
);
144 shishi_asn1_done (ap
->handle
, ap
->encapreppart
);
149 * shishi_ap_set_tktoptions:
150 * @ap: structure that holds information about AP exchange
151 * @tkt: ticket to set in AP.
152 * @options: AP-REQ options to set in AP.
154 * Set the ticket (see shishi_ap_tkt_set()) and set the AP-REQ
155 * apoptions (see shishi_apreq_options_set()).
157 * Return value: Returns SHISHI_OK iff successful.
160 shishi_ap_set_tktoptions (Shishi_ap
* ap
, Shishi_tkt
* tkt
, int options
)
164 shishi_ap_tkt_set (ap
, tkt
);
166 rc
= shishi_apreq_options_set (ap
->handle
, shishi_ap_req (ap
), options
);
169 printf ("Could not set AP-Options: %s", shishi_strerror (rc
));
177 * shishi_ap_set_tktoptionsdata:
178 * @ap: structure that holds information about AP exchange
179 * @tkt: ticket to set in AP.
180 * @options: AP-REQ options to set in AP.
181 * @data: input array with data to checksum in Authenticator.
182 * @len: length of input array with data to checksum in Authenticator.
184 * Set the ticket (see shishi_ap_tkt_set()) and set the AP-REQ
185 * apoptions (see shishi_apreq_options_set()) and set the
186 * Authenticator checksum data.
188 * Return value: Returns SHISHI_OK iff successful.
191 shishi_ap_set_tktoptionsdata (Shishi_ap
* ap
,
193 int options
, char *data
, int len
)
197 shishi_ap_tkt_set (ap
, tkt
);
199 rc
= shishi_apreq_options_set (ap
->handle
, shishi_ap_req (ap
), options
);
202 printf ("Could not set AP-Options: %s", shishi_strerror (rc
));
206 shishi_ap_authenticator_cksumdata_set (ap
, data
, len
);
212 * shishi_ap_set_tktoptionsasn1usage:
213 * @ap: structure that holds information about AP exchange
214 * @tkt: ticket to set in AP.
215 * @options: AP-REQ options to set in AP.
216 * @node: input ASN.1 structure to store as authenticator checksum data.
217 * @field: field in ASN.1 structure to use.
218 * @authenticatorcksumkeyusage: key usage for checksum in authenticator.
219 * @authenticatorkeyusage: key usage for authenticator.
221 * Set ticket, options and authenticator checksum data using
222 * shishi_ap_set_tktoptionsdata(). The authenticator checksum data is
223 * the DER encoding of the ASN.1 field provided.
225 * Return value: Returns SHISHI_OK iff successful.
228 shishi_ap_set_tktoptionsasn1usage (Shishi_ap
* ap
,
233 int authenticatorcksumkeyusage
,
234 int authenticatorkeyusage
)
240 res
= shishi_a2d_new_field (ap
->handle
, node
, field
, &buf
, &buflen
);
241 if (res
!= SHISHI_OK
)
244 /* XXX what is this? */
245 memmove (buf
, buf
+ 2, buflen
- 2);
248 res
= shishi_ap_set_tktoptionsdata (ap
, tkt
, options
, buf
, buflen
);
249 if (res
!= SHISHI_OK
)
252 ap
->authenticatorcksumkeyusage
= authenticatorcksumkeyusage
;
253 ap
->authenticatorkeyusage
= authenticatorkeyusage
;
259 * shishi_ap_tktoptions:
260 * @handle: shishi handle as allocated by shishi_init().
261 * @ap: pointer to new structure that holds information about AP exchange
262 * @tkt: ticket to set in newly created AP.
263 * @options: AP-REQ options to set in newly created AP.
265 * Create a new AP exchange using shishi_ap(), and set the ticket and
266 * AP-REQ apoptions using shishi_ap_set_tktoption().
268 * Return value: Returns SHISHI_OK iff successful.
271 shishi_ap_tktoptions (Shishi
* handle
,
272 Shishi_ap
** ap
, Shishi_tkt
* tkt
, int options
)
276 rc
= shishi_ap (handle
, ap
);
280 rc
= shishi_ap_set_tktoptions (*ap
, tkt
, options
);
288 * shishi_ap_tktoptionsdata:
289 * @handle: shishi handle as allocated by shishi_init().
290 * @ap: pointer to new structure that holds information about AP exchange
291 * @tkt: ticket to set in newly created AP.
292 * @options: AP-REQ options to set in newly created AP.
293 * @data: input array with data to checksum in Authenticator.
294 * @len: length of input array with data to checksum in Authenticator.
296 * Create a new AP exchange using shishi_ap(), and set the ticket,
297 * AP-REQ apoptions and the Authenticator checksum data using
298 * shishi_ap_set_tktoptionsdata().
300 * Return value: Returns SHISHI_OK iff successful.
303 shishi_ap_tktoptionsdata (Shishi
* handle
,
305 Shishi_tkt
* tkt
, int options
, char *data
, int len
)
309 rc
= shishi_ap (handle
, ap
);
313 rc
= shishi_ap_set_tktoptionsdata (*ap
, tkt
, options
, data
, len
);
321 * shishi_ap_tktoptionsasn1usage:
322 * @handle: shishi handle as allocated by shishi_init().
323 * @ap: pointer to new structure that holds information about AP exchange
324 * @tkt: ticket to set in newly created AP.
325 * @options: AP-REQ options to set in newly created AP.
326 * @node: input ASN.1 structure to store as authenticator checksum data.
327 * @field: field in ASN.1 structure to use.
328 * @authenticatorcksumkeyusage: key usage for checksum in authenticator.
329 * @authenticatorkeyusage: key usage for authenticator.
331 * Create a new AP exchange using shishi_ap(), and set ticket, options
332 * and authenticator checksum data from the DER encoding of the ASN.1
333 * field using shishi_ap_set_tktoptionsasn1usage().
335 * Return value: Returns SHISHI_OK iff successful.
338 shishi_ap_tktoptionsasn1usage (Shishi
* handle
,
344 int authenticatorcksumkeyusage
,
345 int authenticatorkeyusage
)
349 rc
= shishi_ap (handle
, ap
);
353 rc
= shishi_ap_set_tktoptionsasn1usage (*ap
, tkt
, options
,
355 authenticatorcksumkeyusage
,
356 authenticatorkeyusage
);
365 * @ap: structure that holds information about AP exchange
367 * Return value: Returns the ticket from the AP exchange, or NULL if
368 * not yet set or an error occured.
371 shishi_ap_tkt (Shishi_ap
* ap
)
378 * @ap: structure that holds information about AP exchange
379 * @tkt: ticket to store in AP.
381 * Set the Ticket in the AP exchange.
384 shishi_ap_tkt_set (Shishi_ap
* ap
, Shishi_tkt
* tkt
)
390 * shishi_ap_authenticatorcksumdata:
391 * @ap: structure that holds information about AP exchange
392 * @out: output array that holds authenticator checksum data.
393 * @len: on input, maximum length of output array that holds
394 * authenticator checksum data, on output actual length of
395 * output array that holds authenticator checksum data.
397 * Return value: Returns SHISHI_OK if successful, or
398 * SHISHI_TOO_SMALL_BUFFER if buffer provided was too small.
401 shishi_ap_authenticator_cksumdata (Shishi_ap
* ap
, char *out
, int *len
)
403 if (*len
< ap
->authenticatorcksumdatalen
)
404 return SHISHI_TOO_SMALL_BUFFER
;
405 if (ap
->authenticatorcksumdata
)
406 memcpy (out
, ap
->authenticatorcksumdata
, ap
->authenticatorcksumdatalen
);
407 *len
= ap
->authenticatorcksumdatalen
;
412 * shishi_ap_authenticator_cksumdata_set:
413 * @ap: structure that holds information about AP exchange
414 * @authenticatorcksumdata: input array with authenticator checksum
416 * @authenticatorcksumdatalen: length of input array with authenticator
417 * checksum data to use in AP.
419 * Set the Authenticator Checksum Data in the AP exchange.
422 shishi_ap_authenticator_cksumdata_set (Shishi_ap
* ap
,
423 char *authenticatorcksumdata
,
424 int authenticatorcksumdatalen
)
426 ap
->authenticatorcksumdata
= authenticatorcksumdata
;
427 ap
->authenticatorcksumdatalen
= authenticatorcksumdatalen
;
431 * shishi_ap_authenticatorcksumtype:
432 * @ap: structure that holds information about AP exchange
434 * Get the Authenticator Checksum Type in the AP exchange.
436 * Return value: Return the authenticator checksum type.
439 shishi_ap_authenticator_cksumtype (Shishi_ap
* ap
)
441 return ap
->authenticatorcksumtype
;
445 * shishi_ap_authenticator_cksumtype_set:
446 * @ap: structure that holds information about AP exchange
447 * @cksumtype: authenticator checksum type to set in AP.
449 * Set the Authenticator Checksum Type in the AP exchange.
452 shishi_ap_authenticator_cksumtype_set (Shishi_ap
* ap
,
455 ap
->authenticatorcksumtype
= cksumtype
;
459 * shishi_ap_authenticator:
460 * @ap: structure that holds information about AP exchange
462 * Return value: Returns the Authenticator from the AP exchange, or
463 * NULL if not yet set or an error occured.
467 shishi_ap_authenticator (Shishi_ap
* ap
)
469 return ap
->authenticator
;
473 * shishi_ap_authenticator_set:
474 * @ap: structure that holds information about AP exchange
475 * @authenticator: authenticator to store in AP.
477 * Set the Authenticator in the AP exchange.
480 shishi_ap_authenticator_set (Shishi_ap
* ap
, Shishi_asn1 authenticator
)
482 if (ap
->authenticator
)
483 shishi_asn1_done (ap
->handle
, ap
->authenticator
);
484 ap
->authenticator
= authenticator
;
489 * @ap: structure that holds information about AP exchange
491 * Return value: Returns the AP-REQ from the AP exchange, or NULL if
492 * not yet set or an error occured.
495 shishi_ap_req (Shishi_ap
* ap
)
503 * @ap: structure that holds information about AP exchange
504 * @apreq: apreq to store in AP.
506 * Set the AP-REQ in the AP exchange.
509 shishi_ap_req_set (Shishi_ap
* ap
, Shishi_asn1 apreq
)
512 shishi_asn1_done (ap
->handle
, ap
->apreq
);
518 * @ap: structure that holds information about AP exchange
519 * @out: pointer to output array with der encoding of AP-REQ.
520 * @outlen: pointer to length of output array with der encoding of AP-REQ.
522 * Build AP-REQ using shishi_ap_req_build() and DER encode it. @out
523 * is allocated by this function, and it is the responsibility of
524 * caller to deallocate it.
526 * Return value: Returns SHISHI_OK iff successful.
529 shishi_ap_req_der (Shishi_ap
* ap
, char **out
, size_t *outlen
)
533 rc
= shishi_ap_req_build (ap
);
537 rc
= shishi_new_a2d (ap
->handle
, ap
->apreq
, out
, outlen
);
545 * shishi_ap_req_der_set:
546 * @ap: structure that holds information about AP exchange
547 * @der: input array with DER encoded AP-REQ.
548 * @derlen: length of input array with DER encoded AP-REQ.
550 * DER decode AP-REQ and set it AP exchange. If decoding fails, the
551 * AP-REQ in the AP exchange is lost.
553 * Return value: Returns SHISHI_OK.
556 shishi_ap_req_der_set (Shishi_ap
* ap
, char *der
, size_t derlen
)
558 ap
->apreq
= shishi_der2asn1_apreq (ap
->handle
, der
, derlen
);
563 return SHISHI_ASN1_ERROR
;
567 * shishi_ap_req_build:
568 * @ap: structure that holds information about AP exchange
570 * Checksum data in authenticator and add ticket and authenticator to
573 * Return value: Returns SHISHI_OK iff successful.
576 shishi_ap_req_build (Shishi_ap
* ap
)
581 if (VERBOSE (ap
->handle
))
582 printf ("Building AP-REQ...\n");
584 res
= shishi_apreq_set_ticket (ap
->handle
, ap
->apreq
,
585 shishi_tkt_ticket (ap
->tkt
));
586 if (res
!= SHISHI_OK
)
588 shishi_error_printf (ap
->handle
, "Could not set ticket in AP-REQ: %s\n",
589 shishi_error (ap
->handle
));
593 cksumtype
= shishi_ap_authenticator_cksumtype (ap
);
594 if (cksumtype
== SHISHI_NO_CKSUMTYPE
)
595 res
= shishi_authenticator_add_cksum (ap
->handle
, ap
->authenticator
,
596 shishi_tkt_key (ap
->tkt
),
597 ap
->authenticatorcksumkeyusage
,
598 ap
->authenticatorcksumdata
,
599 ap
->authenticatorcksumdatalen
);
601 res
= shishi_authenticator_add_cksum_type (ap
->handle
, ap
->authenticator
,
602 shishi_tkt_key (ap
->tkt
),
603 ap
->authenticatorcksumkeyusage
,
605 ap
->authenticatorcksumdata
,
606 ap
->authenticatorcksumdatalen
);
607 if (res
!= SHISHI_OK
)
609 shishi_error_printf (ap
->handle
,
610 "Could not add checksum to authenticator: %s\n",
611 shishi_error (ap
->handle
));
615 if (VERBOSE (ap
->handle
))
616 printf ("Got Authenticator...\n");
618 if (VERBOSEASN1 (ap
->handle
))
619 shishi_authenticator_print (ap
->handle
, stdout
, ap
->authenticator
);
621 res
= shishi_apreq_add_authenticator (ap
->handle
, ap
->apreq
,
622 shishi_tkt_key (ap
->tkt
),
623 ap
->authenticatorkeyusage
,
625 if (res
!= SHISHI_OK
)
627 shishi_error_printf (ap
->handle
, "Could not set authenticator: %s\n",
628 shishi_error (ap
->handle
));
632 if (VERBOSEASN1 (ap
->handle
))
633 shishi_apreq_print (ap
->handle
, stdout
, ap
->apreq
);
639 * shishi_ap_req_process_keyusage:
640 * @ap: structure that holds information about AP exchange
641 * @key: cryptographic key used to decrypt ticket in AP-REQ.
642 * @keyusage: key usage to use during decryption, for normal
643 * AP-REQ's this is normally SHISHI_KEYUSAGE_APREQ_AUTHENTICATOR,
644 * for AP-REQ's part of TGS-REQ's, this is normally
645 * SHISHI_KEYUSAGE_TGSREQ_APREQ_AUTHENTICATOR.
647 * Decrypt ticket in AP-REQ using supplied key and decrypt
648 * Authenticator in AP-REQ using key in decrypted ticket, and on
649 * success set the Ticket and Authenticator fields in the AP exchange.
651 * Return value: Returns SHISHI_OK iff successful.
654 shishi_ap_req_process_keyusage (Shishi_ap
* ap
,
658 Shishi_asn1 ticket
, authenticator
;
663 if (VERBOSEASN1 (ap
->handle
))
664 shishi_apreq_print (ap
->handle
, stdout
, ap
->apreq
);
666 rc
= shishi_apreq_get_ticket (ap
->handle
, ap
->apreq
, &ticket
);
669 shishi_error_printf (ap
->handle
,
670 "Could not extract ticket from AP-REQ: %s\n",
671 shishi_strerror (rc
));
675 if (VERBOSEASN1 (ap
->handle
))
676 shishi_ticket_print (ap
->handle
, stdout
, ticket
);
678 tkt
= shishi_tkt2 (ap
->handle
, ticket
, NULL
, NULL
);
680 rc
= shishi_tkt_decrypt (tkt
, key
);
683 shishi_error_printf (ap
->handle
, "Error decrypting ticket: %s\n",
684 shishi_strerror (rc
));
688 rc
= shishi_encticketpart_get_key (ap
->handle
,
689 shishi_tkt_encticketpart (tkt
), &tktkey
);
692 shishi_error_printf (ap
->handle
, "Could not get key from ticket: %s\n",
693 shishi_strerror (rc
));
697 if (VERBOSEASN1 (ap
->handle
))
698 shishi_encticketpart_print (ap
->handle
, stdout
,
699 shishi_tkt_encticketpart (tkt
));
701 rc
= shishi_apreq_decrypt (ap
->handle
, ap
->apreq
, tktkey
,
702 keyusage
, &authenticator
);
705 shishi_error_printf (ap
->handle
, "Error decrypting apreq: %s\n",
706 shishi_strerror (rc
));
710 /* XXX? verify checksum in authenticator. */
712 if (VERBOSEASN1 (ap
->handle
))
713 shishi_authenticator_print (ap
->handle
, stdout
, authenticator
);
716 ap
->authenticator
= authenticator
;
722 * shishi_ap_req_process:
723 * @ap: structure that holds information about AP exchange
724 * @key: cryptographic key used to decrypt ticket in AP-REQ.
726 * Decrypt ticket in AP-REQ using supplied key and decrypt
727 * Authenticator in AP-REQ using key in decrypted ticket, and on
728 * success set the Ticket and Authenticator fields in the AP exchange.
730 * Return value: Returns SHISHI_OK iff successful.
733 shishi_ap_req_process (Shishi_ap
* ap
, Shishi_key
* key
)
735 return shishi_ap_req_process_keyusage (ap
, key
,
736 SHISHI_KEYUSAGE_APREQ_AUTHENTICATOR
);
740 * shishi_ap_req_asn1:
741 * @ap: structure that holds information about AP exchange
742 * @apreq: output AP-REQ variable.
744 * Build AP-REQ using shishi_ap_req_build() and return it.
746 * Return value: Returns SHISHI_OK iff successful.
749 shishi_ap_req_asn1 (Shishi_ap
* ap
, Shishi_asn1
* apreq
)
753 rc
= shishi_ap_req_build (ap
);
764 * @ap: structure that holds information about AP exchange
766 * Extract the application key from AP. If subkeys are used, it is
767 * taken from the Authenticator, otherwise the session key is used.
769 * Return value: Return application key from AP.
772 shishi_ap_key (Shishi_ap
* ap
)
776 /* XXX do real check if subkey is present, don't just assume error
779 rc
= shishi_authenticator_get_subkey (ap
->handle
, ap
->authenticator
,
782 ap
->key
= shishi_tkt_key (ap
->tkt
);
789 * @ap: structure that holds information about AP exchange
791 * Return value: Returns the AP-REP from the AP exchange, or NULL if
792 * not yet set or an error occured.
795 shishi_ap_rep (Shishi_ap
* ap
)
802 * @ap: structure that holds information about AP exchange
803 * @aprep: aprep to store in AP.
805 * Set the AP-REP in the AP exchange.
808 shishi_ap_rep_set (Shishi_ap
* ap
, Shishi_asn1 aprep
)
811 shishi_asn1_done (ap
->handle
, ap
->aprep
);
817 * @ap: structure that holds information about AP exchange
818 * @out: output array with newly allocated DER encoding of AP-REP.
819 * @outlen: length of output array with DER encoding of AP-REP.
821 * Build AP-REP using shishi_ap_rep_build() and DER encode it. @out
822 * is allocated by this function, and it is the responsibility of
823 * caller to deallocate it.
825 * Return value: Returns SHISHI_OK iff successful.
828 shishi_ap_rep_der (Shishi_ap
* ap
, char **out
, size_t * outlen
)
832 rc
= shishi_ap_rep_build (ap
);
836 rc
= shishi_new_a2d (ap
->handle
, ap
->aprep
, out
, outlen
);
844 * shishi_ap_rep_der_set:
845 * @ap: structure that holds information about AP exchange
846 * @der: input array with DER encoded AP-REP.
847 * @derlen: length of input array with DER encoded AP-REP.
849 * DER decode AP-REP and set it AP exchange. If decoding fails, the
850 * AP-REP in the AP exchange remains.
852 * Return value: Returns SHISHI_OK.
855 shishi_ap_rep_der_set (Shishi_ap
* ap
, char *der
, size_t derlen
)
859 aprep
= shishi_der2asn1_aprep (ap
->handle
, der
, derlen
);
862 return SHISHI_ASN1_ERROR
;
870 * shishi_ap_rep_build:
871 * @ap: structure that holds information about AP exchange
873 * Checksum data in authenticator and add ticket and authenticator to
876 * Return value: Returns SHISHI_OK iff successful.
879 shishi_ap_rep_build (Shishi_ap
* ap
)
884 if (VERBOSE (ap
->handle
))
885 printf ("Building AP-REP...\n");
887 aprep
= shishi_aprep (ap
->handle
);
888 rc
= shishi_aprep_enc_part_make (ap
->handle
, aprep
, ap
->authenticator
,
889 shishi_tkt_encticketpart (ap
->tkt
));
892 shishi_error_printf (ap
->handle
, "Error creating AP-REP: %s\n",
893 shishi_strerror (rc
));
897 if (VERBOSEASN1 (ap
->handle
))
898 shishi_aprep_print (ap
->handle
, stdout
, aprep
);
900 shishi_ap_rep_set (ap
, aprep
);
906 * shishi_ap_rep_asn1:
907 * @ap: structure that holds information about AP exchange
908 * @aprep: output AP-REP variable.
910 * Build AP-REP using shishi_ap_rep_build() and return it.
912 * Return value: Returns SHISHI_OK iff successful.
915 shishi_ap_rep_asn1 (Shishi_ap
* ap
, Shishi_asn1
* aprep
)
919 rc
= shishi_ap_rep_build (ap
);
929 * shishi_ap_rep_verify:
930 * @ap: structure that holds information about AP exchange
932 * Verify AP-REP compared to Authenticator.
934 * Return value: Returns SHISHI_OK, SHISHI_APREP_VERIFY_FAILED or an
938 shishi_ap_rep_verify (Shishi_ap
* ap
)
942 if (VERBOSE (ap
->handle
))
943 printf ("Decrypting AP-REP...\n");
945 if (VERBOSEASN1 (ap
->handle
))
946 shishi_aprep_print (ap
->handle
, stdout
, ap
->aprep
);
948 res
= shishi_aprep_decrypt (ap
->handle
, ap
->aprep
,
949 shishi_tkt_key (ap
->tkt
),
950 SHISHI_KEYUSAGE_ENCAPREPPART
,
952 if (res
!= SHISHI_OK
)
955 if (VERBOSEASN1 (ap
->handle
))
956 shishi_encapreppart_print (ap
->handle
, stdout
, ap
->encapreppart
);
958 res
= shishi_aprep_verify (ap
->handle
, ap
->authenticator
, ap
->encapreppart
);
959 if (res
!= SHISHI_OK
)
962 if (VERBOSE (ap
->handle
))
963 printf ("Verified AP-REP successfully...\n");
969 * shishi_ap_rep_verify_der:
970 * @ap: structure that holds information about AP exchange
971 * @der: input array with DER encoded AP-REP.
972 * @derlen: length of input array with DER encoded AP-REP.
974 * DER decode AP-REP and set it in AP exchange using
975 * shishi_ap_rep_der_set() and verify it using shishi_ap_rep_verify().
977 * Return value: Returns SHISHI_OK, SHISHI_APREP_VERIFY_FAILED or an
981 shishi_ap_rep_verify_der (Shishi_ap
* ap
, char *der
, size_t derlen
)
985 res
= shishi_ap_rep_der_set (ap
, der
, derlen
);
986 if (res
!= SHISHI_OK
)
989 res
= shishi_ap_rep_verify (ap
);
990 if (res
!= SHISHI_OK
)
997 * shishi_ap_rep_verify_asn1:
998 * @ap: structure that holds information about AP exchange
999 * @aprep: input AP-REP.
1001 * Set the AP-REP in the AP exchange using shishi_ap_rep_set() and
1002 * verify it using shishi_ap_rep_verify().
1004 * Return value: Returns SHISHI_OK, SHISHI_APREP_VERIFY_FAILED or an
1008 shishi_ap_rep_verify_asn1 (Shishi_ap
* ap
, Shishi_asn1 aprep
)
1012 shishi_ap_rep_set (ap
, aprep
);
1014 res
= shishi_ap_rep_verify (ap
);
1015 if (res
!= SHISHI_OK
)
1023 * @ap: structure that holds information about AP exchange
1025 * Return value: Returns the EncAPREPPart from the AP exchange, or
1026 * NULL if not yet set or an error occured.
1029 shishi_ap_encapreppart (Shishi_ap
* ap
)
1031 return ap
->encapreppart
;
1035 * shishi_ap_encapreppart_set:
1036 * @ap: structure that holds information about AP exchange
1037 * @encapreppart: EncAPRepPart to store in AP.
1039 * Set the EncAPRepPart in the AP exchange.
1042 shishi_ap_encapreppart_set (Shishi_ap
* ap
, Shishi_asn1 encapreppart
)
1044 if (ap
->encapreppart
)
1045 shishi_asn1_done (ap
->handle
, ap
->encapreppart
);
1046 ap
->encapreppart
= encapreppart
;
1049 #define APOPTION_RESERVED "reserved"
1050 #define APOPTION_USE_SESSION_KEY "use-session-key"
1051 #define APOPTION_MUTUAL_REQUIRED "mutual-required"
1052 #define APOPTION_UNKNOWN "unknown"
1055 * shishi_ap_option2string:
1056 * @option: enumerated AP-Option type, see Shishi_apoptions.
1058 * Convert AP-Option type to AP-Option name string. Note that @option
1059 * must be just one of the AP-Option types, it cannot be an binary
1060 * ORed indicating several AP-Options.
1062 * Return value: Returns static string with name of AP-Option that
1063 * must not be deallocated, or "unknown" if AP-Option was not understood.
1066 shishi_ap_option2string (Shishi_apoptions option
)
1072 case SHISHI_APOPTIONS_RESERVED
:
1073 str
= APOPTION_RESERVED
;
1076 case SHISHI_APOPTIONS_USE_SESSION_KEY
:
1077 str
= APOPTION_USE_SESSION_KEY
;
1080 case SHISHI_APOPTIONS_MUTUAL_REQUIRED
:
1081 str
= APOPTION_MUTUAL_REQUIRED
;
1085 str
= APOPTION_UNKNOWN
;
1093 * shishi_ap_string2option:
1094 * @str: zero terminated character array with name of AP-Option,
1095 * e.g. "use-session-key".
1097 * Convert AP-Option name to AP-Option type.
1099 * Return value: Returns enumerated type member corresponding to AP-Option,
1100 * or 0 if string was not understood.
1103 shishi_ap_string2option (const char *str
)
1107 if (strcasecmp (str
, APOPTION_RESERVED
) == 0)
1108 option
= SHISHI_APOPTIONS_RESERVED
;
1109 else if (strcasecmp (str
, APOPTION_USE_SESSION_KEY
) == 0)
1110 option
= SHISHI_APOPTIONS_USE_SESSION_KEY
;
1111 else if (strcasecmp (str
, APOPTION_MUTUAL_REQUIRED
) == 0)
1112 option
= SHISHI_APOPTIONS_MUTUAL_REQUIRED
;
1114 option
= strtol (str
, (char **) NULL
, 0);