lib/as.c

   1 /* as.c         High level client AS functions
   2  * Copyright (C) 2002, 2003  Simon Josefsson
   3  *
   4  * This file is part of Shishi.
   5  *
   6  * Shishi is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * Shishi is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with Shishi; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  */
  21
  22 #include "internal.h"
  23
  24 struct Shishi_as
  25 {
  26   Shishi *handle;
  27   Shishi_asn1 asreq;
  28   Shishi_asn1 asrep;
  29   Shishi_asn1 krberror;
  30   Shishi_tkt *tkt;
  31 };
  32
  33 /**
  34  * shishi_as:
  35  * @handle: shishi handle as allocated by shishi_init().
  36  * @as: holds pointer to newly allocate Shishi_as structure.
  37  *
  38  * Allocate a new AS exchange variable.
  39  *
  40  * Return value: Returns SHISHI_OK iff successful.
  41  **/
  42 int
  43 shishi_as (Shishi * handle, Shishi_as ** as)
  44 {
  45   Shishi_as *las;
  46   int res;
  47
  48   *as = xmalloc (sizeof (**as));
  49   las = *as;
  50   memset (las, 0, sizeof (*las));
  51
  52   las->handle = handle;
  53
  54   las->asreq = shishi_asreq (handle);
  55   if (las->asreq == NULL)
  56     {
  57       shishi_error_printf (handle, "Could not create AS-REQ: %s\n",
  58                            shishi_error (handle));
  59       return SHISHI_ASN1_ERROR;
  60     }
  61
  62   /* XXX there are reasons for having padata in AS-REQ */
  63   res = shishi_kdcreq_clear_padata (las->handle, las->asreq);
  64   if (res != SHISHI_OK)
  65     return res;
  66
  67   las->asrep = shishi_asrep (handle);
  68   if (las->asrep == NULL)
  69     {
  70       shishi_error_printf (handle, "Could not create AS-REP: %s\n",
  71                            shishi_error (handle));
  72       return SHISHI_ASN1_ERROR;
  73     }
  74
  75   las->krberror = shishi_krberror (handle);
  76   if (las->krberror == NULL)
  77     {
  78       shishi_error_printf (handle, "Could not create KRB-ERROR: %s\n",
  79                            shishi_error (handle));
  80       return SHISHI_ASN1_ERROR;
  81     }
  82
  83   res = shishi_tkt (handle, &las->tkt);
  84   if (res != SHISHI_OK)
  85     return res;
  86
  87   res = shishi_tkt_flags_set (las->tkt, SHISHI_TICKETFLAGS_INITIAL);
  88   if (res != SHISHI_OK)
  89     return res;
  90
  91   return SHISHI_OK;
  92 }
  93
  94 /**
  95  * shishi_as_done:
  96  * @as: structure that holds information about AS exchange
  97  *
  98  * Deallocate resources associated with AS exchange.  This should be
  99  * called by the application when it no longer need to utilize the AS
 100  * exchange handle.
 101  **/
 102 void
 103 shishi_as_done (Shishi_as * as)
 104 {
 105   shishi_asn1_done (as->handle, as->asreq);
 106   shishi_asn1_done (as->handle, as->asrep);
 107   shishi_asn1_done (as->handle, as->krberror);
 108   shishi_tkt_done (as->tkt);
 109   free (as);
 110 }
 111
 112 /* TODO: add shishi_as_clientserver(h,p,a,client,server) and make the
 113    shishi_as_cnamerealmsname function take real cname/sname pointer
 114    arrays. */
 115
 116 /**
 117  * shishi_as_asreq:
 118  * @as: structure that holds information about AS exchange
 119  *
 120  * Return value: Returns the generated AS-REQ packet from the AS
 121  *               exchange, or NULL if not yet set or an error occured.
 122  **/
 123 Shishi_asn1
 124 shishi_as_req (Shishi_as * as)
 125 {
 126   return as->asreq;
 127 }
 128
 129 /**
 130  * shishi_as_req_build:
 131  * @as: structure that holds information about AS exchange
 132  *
 133  * Possibly remove unset fields (e.g., rtime).
 134  *
 135  * Return value: Returns SHISHI_OK iff successful.
 136  **/
 137 int
 138 shishi_as_req_build (Shishi_as * as)
 139 {
 140   int res;
 141
 142   res = shishi_kdcreq_build (as->handle, as->asreq);
 143   if (res != SHISHI_OK)
 144     return res;
 145
 146   return SHISHI_OK;
 147 }
 148
 149 /**
 150  * shishi_as_req_set:
 151  * @as: structure that holds information about AS exchange
 152  * @asreq: asreq to store in AS.
 153  *
 154  * Set the AS-REQ in the AS exchange.
 155  **/
 156 void
 157 shishi_as_req_set (Shishi_as * as, Shishi_asn1 asreq)
 158 {
 159   if (as->asreq)
 160     shishi_asn1_done (as->handle, as->asreq);
 161   as->asreq = asreq;
 162 }
 163
 164 /**
 165  * shishi_as_req_der:
 166  * @as: structure that holds information about AS exchange
 167  * @out: output array with newly allocated DER encoding of AS-REQ.
 168  * @outlen: length of output array with DER encoding of AS-REQ.
 169  *
 170  * DER encode AS-REQ.  @out is allocated by this function, and it is
 171  * the responsibility of caller to deallocate it.
 172  *
 173  * Return value: Returns SHISHI_OK iff successful.
 174  **/
 175 int
 176 shishi_as_req_der (Shishi_as * as, char **out, size_t * outlen)
 177 {
 178   int rc;
 179
 180   rc = shishi_new_a2d (as->handle, as->asreq, out, outlen);
 181   if (rc != SHISHI_OK)
 182     return rc;
 183
 184   return SHISHI_OK;
 185 }
 186
 187 /**
 188  * shishi_as_req_der_set:
 189  * @as: structure that holds information about AS exchange
 190  * @der: input array with DER encoded AP-REQ.
 191  * @derlen: length of input array with DER encoded AP-REQ.
 192  *
 193  * DER decode AS-REQ and set it AS exchange.  If decoding fails, the
 194  * AS-REQ in the AS exchange remains.
 195  *
 196  * Return value: Returns SHISHI_OK.
 197  **/
 198 int
 199 shishi_as_req_der_set (Shishi_as * as, char *der, size_t derlen)
 200 {
 201   Shishi_asn1 asreq;
 202
 203   asreq = shishi_der2asn1_asreq (as->handle, der, derlen);
 204
 205   if (asreq == NULL)
 206     return SHISHI_ASN1_ERROR;
 207
 208   as->asreq = asreq;
 209
 210   return SHISHI_OK;
 211 }
 212
 213 /**
 214  * shishi_as_rep:
 215  * @as: structure that holds information about AS exchange
 216  *
 217  * Return value: Returns the received AS-REP packet from the AS
 218  *               exchange, or NULL if not yet set or an error occured.
 219  **/
 220 Shishi_asn1
 221 shishi_as_rep (Shishi_as * as)
 222 {
 223   return as->asrep;
 224 }
 225
 226 /**
 227  * shishi_as_rep_process:
 228  * @as: structure that holds information about AS exchange
 229  * @key: user's key, used to encrypt the encrypted part of the AS-REP.
 230  * @password: user's password, used if key is NULL.
 231  *
 232  * Process new AS-REP and set ticket.  The key is used to decrypt the
 233  * AP-REP.  If both key and password is NULL, the user is queried for
 234  * it.
 235  *
 236  * Return value: Returns SHISHI_OK iff successful.
 237  **/
 238 int
 239 shishi_as_rep_process (Shishi_as * as, Shishi_key * key, const char *password)
 240 {
 241   Shishi_asn1 ticket, kdcreppart;
 242   char user[BUFSIZ];
 243   int userlen;
 244   int res;
 245
 246   if (VERBOSE (as->handle))
 247     printf ("Processing AS-REQ and AS-REP...\n");
 248
 249   if (VERBOSEASN1 (as->handle))
 250     shishi_kdcreq_print (as->handle, stdout, as->asreq);
 251
 252   if (VERBOSEASN1 (as->handle))
 253     shishi_kdcrep_print (as->handle, stdout, as->asrep);
 254
 255   userlen = sizeof (user);
 256   res = shishi_asreq_cnamerealm_get (as->handle, as->asreq, user, &userlen);
 257   if (res != SHISHI_OK)
 258     {
 259       shishi_error_printf (as->handle, "Could not extract cname and "
 260                            "realm from AS-REQ: %s\n", shishi_strerror (res),
 261                            shishi_error (as->handle));
 262       return res;
 263     }
 264   user[userlen] = '\0';
 265
 266   if (key == NULL && password == NULL)
 267     {
 268       char *password;
 269
 270       res = shishi_prompt_password (as->handle, &password,
 271                                     "Enter password for `%s': ", user);
 272       if (res != SHISHI_OK)
 273         {
 274           shishi_error_printf (as->handle, "Reading password failed: %s\n",
 275                                shishi_strerror (res));
 276           return res;
 277         }
 278
 279       res = shishi_as_process (as->handle, as->asreq, as->asrep,
 280                                password, &kdcreppart);
 281       free (password);
 282     }
 283   else if (key == NULL)
 284     res = shishi_as_process (as->handle, as->asreq, as->asrep,
 285                              password, &kdcreppart);
 286   else
 287     res = shishi_kdc_process (as->handle, as->asreq, as->asrep, key,
 288                               SHISHI_KEYUSAGE_ENCASREPPART, &kdcreppart);
 289   if (res != SHISHI_OK)
 290     return res;
 291
 292   if (VERBOSE (as->handle))
 293     printf ("Got EncKDCRepPart...\n");
 294
 295   if (VERBOSEASN1 (as->handle))
 296     shishi_enckdcreppart_print (as->handle, stdout, kdcreppart);
 297
 298   res = shishi_kdcrep_get_ticket (as->handle, as->asrep, &ticket);
 299   if (res != SHISHI_OK)
 300     {
 301       shishi_error_printf (as->handle,
 302                            "Could not extract ticket from AS-REP: %s",
 303                            shishi_error (as->handle));
 304       return res;
 305     }
 306
 307   if (VERBOSE (as->handle))
 308     printf ("Got Ticket...\n");
 309
 310   if (VERBOSEASN1 (as->handle))
 311     shishi_ticket_print (as->handle, stdout, ticket);
 312
 313   /* XXX */
 314   as->tkt = shishi_tkt2 (as->handle, ticket, kdcreppart, as->asrep);
 315
 316   return SHISHI_OK;
 317 }
 318
 319 /**
 320  * shishi_as_rep_build:
 321  * @as: structure that holds information about AS exchange
 322  * @key: user's key, used to encrypt the encrypted part of the AS-REP.
 323  *
 324  * Build AS-REP.
 325  *
 326  * Return value: Returns SHISHI_OK iff successful.
 327  **/
 328 int
 329 shishi_as_rep_build (Shishi_as * as, Shishi_key * key)
 330 {
 331   int rc;
 332
 333   /* XXX there are reasons for having padata in AS-REP */
 334   rc = shishi_kdcrep_clear_padata (as->handle, as->asrep);
 335   if (rc != SHISHI_OK)
 336     return rc;
 337
 338   rc = shishi_enckdcreppart_populate_encticketpart
 339     (as->handle, shishi_tkt_enckdcreppart (as->tkt),
 340      shishi_tkt_encticketpart (as->tkt));
 341   if (rc != SHISHI_OK)
 342     return rc;
 343
 344   rc = shishi_kdc_copy_nonce (as->handle, as->asreq,
 345                               shishi_tkt_enckdcreppart (as->tkt));
 346   if (rc != SHISHI_OK)
 347     return rc;
 348
 349   rc = shishi_kdcrep_add_enc_part (as->handle,
 350                                    as->asrep,
 351                                    key,
 352                                    SHISHI_KEYUSAGE_ENCASREPPART,
 353                                    shishi_tkt_enckdcreppart (as->tkt));
 354   if (rc != SHISHI_OK)
 355     return rc;
 356
 357   rc = shishi_kdcrep_set_ticket (as->handle, as->asrep,
 358                                  shishi_tkt_ticket (as->tkt));
 359   if (rc != SHISHI_OK)
 360     return rc;
 361
 362   rc = shishi_kdc_copy_crealm (as->handle, as->asrep,
 363                                shishi_tkt_encticketpart (as->tkt));
 364   if (rc != SHISHI_OK)
 365     return rc;
 366
 367   rc = shishi_kdc_copy_cname (as->handle, as->asrep,
 368                               shishi_tkt_encticketpart (as->tkt));
 369   if (rc != SHISHI_OK)
 370     return rc;
 371
 372   return SHISHI_OK;
 373 }
 374
 375 /**
 376  * shishi_as_rep_der:
 377  * @as: structure that holds information about AS exchange
 378  * @out: output array with newly allocated DER encoding of AS-REP.
 379  * @outlen: length of output array with DER encoding of AS-REP.
 380  *
 381  * DER encode AS-REP. @out is allocated by this function, and it is
 382  * the responsibility of caller to deallocate it.
 383  *
 384  * Return value: Returns SHISHI_OK iff successful.
 385  **/
 386 int
 387 shishi_as_rep_der (Shishi_as * as, char **out, size_t * outlen)
 388 {
 389   int rc;
 390
 391   rc = shishi_new_a2d (as->handle, as->asrep, out, outlen);
 392   if (rc != SHISHI_OK)
 393     return rc;
 394
 395   return SHISHI_OK;
 396 }
 397
 398 /**
 399  * shishi_as_rep_set:
 400  * @as: structure that holds information about AS exchange
 401  * @asrep: asrep to store in AS.
 402  *
 403  * Set the AS-REP in the AS exchange.
 404  **/
 405 void
 406 shishi_as_rep_set (Shishi_as * as, Shishi_asn1 asrep)
 407 {
 408   if (as->asrep)
 409     shishi_asn1_done (as->handle, as->asrep);
 410   as->asrep = asrep;
 411 }
 412
 413 /**
 414  * shishi_as_rep_der_set:
 415  * @as: structure that holds information about AS exchange
 416  * @der: input array with DER encoded AP-REP.
 417  * @derlen: length of input array with DER encoded AP-REP.
 418  *
 419  * DER decode AS-REP and set it AS exchange.  If decoding fails, the
 420  * AS-REP in the AS exchange remains.
 421  *
 422  * Return value: Returns SHISHI_OK.
 423  **/
 424 int
 425 shishi_as_rep_der_set (Shishi_as * as, char *der, size_t derlen)
 426 {
 427   Shishi_asn1 asrep;
 428
 429   asrep = shishi_der2asn1_asrep (as->handle, der, derlen);
 430
 431   if (asrep == NULL)
 432     return SHISHI_ASN1_ERROR;
 433
 434   as->asrep = asrep;
 435
 436   return SHISHI_OK;
 437 }
 438
 439 /**
 440  * shishi_as_get_krberror:
 441  * @as: structure that holds information about AS exchange
 442  *
 443  * Return value: Returns the received KRB-ERROR packet from the AS
 444  *               exchange, or NULL if not yet set or an error occured.
 445  **/
 446 Shishi_asn1
 447 shishi_as_krberror (Shishi_as * as)
 448 {
 449   return as->krberror;
 450 }
 451
 452 /**
 453  * shishi_as_krberror_der:
 454  * @as: structure that holds information about AS exchange
 455  * @out: output array with newly allocated DER encoding of KRB-ERROR.
 456  * @outlen: length of output array with DER encoding of KRB-ERROR.
 457  *
 458  * DER encode KRB-ERROR. @out is allocated by this function, and it is
 459  * the responsibility of caller to deallocate it.
 460  *
 461  * Return value: Returns SHISHI_OK iff successful.
 462  **/
 463 int
 464 shishi_as_krberror_der (Shishi_as * as, char **out, size_t * outlen)
 465 {
 466   int rc;
 467
 468   rc = shishi_new_a2d (as->handle, as->krberror, out, outlen);
 469   if (rc != SHISHI_OK)
 470     return rc;
 471
 472   return SHISHI_OK;
 473 }
 474
 475 /**
 476  * shishi_as_krberror_set:
 477  * @as: structure that holds information about AS exchange
 478  * @krberror: krberror to store in AS.
 479  *
 480  * Set the KRB-ERROR in the AS exchange.
 481  **/
 482 void
 483 shishi_as_krberror_set (Shishi_as * as, Shishi_asn1 krberror)
 484 {
 485   if (as->krberror)
 486     shishi_asn1_done (as->handle, as->krberror);
 487   as->krberror = krberror;
 488 }
 489
 490 /**
 491  * shishi_as_get_tkt:
 492  * @as: structure that holds information about AS exchange
 493  *
 494  * Return value: Returns the newly aquired tkt from the AS
 495  *               exchange, or NULL if not yet set or an error occured.
 496  **/
 497 Shishi_tkt *
 498 shishi_as_tkt (Shishi_as * as)
 499 {
 500   return as->tkt;
 501 }
 502
 503 /**
 504  * shishi_as_tkt_set:
 505  * @as: structure that holds information about AS exchange
 506  * @tkt: tkt to store in AS.
 507  *
 508  * Set the Tkt in the AS exchange.
 509  **/
 510 void
 511 shishi_as_tkt_set (Shishi_as * as, Shishi_tkt * tkt)
 512 {
 513   as->tkt = tkt;
 514 }
 515
 516 /**
 517  * shishi_as_sendrecv:
 518  * @as: structure that holds information about AS exchange
 519  *
 520  * Send AS-REQ and receive AS-REP or KRB-ERROR.  This is the initial
 521  * authentication, usually used to acquire a Ticket Granting Ticket.
 522  *
 523  * Return value: Returns SHISHI_OK iff successful.
 524  **/
 525 int
 526 shishi_as_sendrecv (Shishi_as * as)
 527 {
 528   int res;
 529
 530   if (VERBOSE (as->handle))
 531     printf ("Sending AS-REQ...\n");
 532
 533   if (VERBOSEASN1 (as->handle))
 534     shishi_kdcreq_print (as->handle, stdout, as->asreq);
 535
 536   res = shishi_kdcreq_sendrecv (as->handle, as->asreq, &as->asrep);
 537   if (res == SHISHI_GOT_KRBERROR)
 538     {
 539       as->krberror = as->asrep;
 540       as->asrep = NULL;
 541
 542       if (VERBOSE (as->handle))
 543         printf ("Received KRB-ERROR...\n");
 544       if (VERBOSEASN1 (as->handle))
 545         shishi_krberror_print (as->handle, stdout, as->krberror);
 546     }
 547   if (res != SHISHI_OK)
 548     return res;
 549
 550   if (VERBOSE (as->handle))
 551     printf ("Received AS-REP...\n");
 552
 553   if (VERBOSEASN1 (as->handle))
 554     shishi_kdcrep_print (as->handle, stdout, as->asrep);
 555
 556   return SHISHI_OK;
 557 }