224 |
} |
} |
225 |
|
|
226 |
int |
int |
227 |
get_auth (int infd, Shishi ** handle, Shishi_key ** enckey, const char **err_msg) |
get_auth (int infd, Shishi ** handle, Shishi_key ** enckey, const char **err_msg, int * protoversion) |
228 |
{ |
{ |
229 |
Shishi_key *key; |
Shishi_key *key; |
230 |
Shishi_ap *ap; |
Shishi_ap *ap; |
240 |
/* KERBEROS 5 SENDAUTH MESSAGE */ |
/* KERBEROS 5 SENDAUTH MESSAGE */ |
241 |
char krb5sendauth[] = "KRB5_SENDAUTH_V1.0"; |
char krb5sendauth[] = "KRB5_SENDAUTH_V1.0"; |
242 |
/* PROTOCOL VERSION */ |
/* PROTOCOL VERSION */ |
243 |
char krb5sendclient[] = "KCMDV0.2"; |
char krb5kcmd1[] = "KCMDV0.1"; |
244 |
|
char krb5kcmd2[] = "KCMDV0.2"; |
245 |
int auth_correct = 0; |
int auth_correct = 0; |
246 |
char * servername; |
char * servername; |
247 |
|
|
294 |
senderror (infd, 1, "Invalid authentication type.\r\n"); |
senderror (infd, 1, "Invalid authentication type.\r\n"); |
295 |
return 1; |
return 1; |
296 |
} |
} |
297 |
|
|
298 |
free (buf); |
free (buf); |
299 |
|
|
300 |
/* Read protocol version */ |
/* Read protocol version */ |
304 |
senderror (infd, 2, "Error reading protocol message size...\r\n"); |
senderror (infd, 2, "Error reading protocol message size...\r\n"); |
305 |
return 1; |
return 1; |
306 |
} |
} |
|
|
|
307 |
buflen = ntohl (len); |
buflen = ntohl (len); |
308 |
buf = (char *) xmalloc (buflen); |
buf = (char *) xmalloc (buflen); |
309 |
|
|
314 |
return 1; |
return 1; |
315 |
} |
} |
316 |
|
|
317 |
len = strlen (krb5sendclient); |
len = strlen (krb5kcmd1); |
318 |
rc = strncmp (buf, krb5sendclient, buflen >= len ? len : buflen); |
rc = strncmp (buf, krb5kcmd1, buflen >= len ? len : buflen); |
319 |
if (rc) |
if (rc) |
320 |
{ |
{ |
321 |
senderror (infd, 2, "Protocol version not supported...\r\n"); |
len = strlen (krb5kcmd2); |
322 |
return 1; |
rc = strncmp (buf, krb5kcmd2, buflen >= len ? len : buflen); |
323 |
|
if (rc) |
324 |
|
{ |
325 |
|
senderror (infd, 2, "Protocol version not supported...\r\n"); |
326 |
|
return 1; |
327 |
|
} |
328 |
|
*protoversion = 2; |
329 |
} |
} |
330 |
|
else |
331 |
|
*protoversion = 1; |
332 |
|
|
333 |
free (buf); |
free (buf); |
334 |
|
|
388 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |
389 |
|
|
390 |
/* extract subkey if present from ap exchange for secure connection */ |
/* extract subkey if present from ap exchange for secure connection */ |
391 |
|
if (*protoversion == 2) |
392 |
*enckey = NULL; |
{ |
393 |
shishi_authenticator_get_subkey (*handle, shishi_ap_authenticator (ap), enckey); |
*enckey = NULL; |
394 |
|
shishi_authenticator_get_subkey (*handle, shishi_ap_authenticator (ap), enckey); |
395 |
|
} |
396 |
|
|
397 |
#endif |
#endif |
398 |
|
|
399 |
/* User is authenticated. */ |
/* User is authenticated. */ |
|
|
|
400 |
error = 0; |
error = 0; |
401 |
write (infd, &error, sizeof (int)); |
write (infd, &error, sizeof (int)); |
402 |
|
|
433 |
/* We are authenticated to client */ |
/* We are authenticated to client */ |
434 |
} |
} |
435 |
|
|
436 |
|
#ifdef ENCRYPTION |
437 |
|
if (*protoversion == 1) |
438 |
|
{ |
439 |
|
Shishi_tkt * tkt; |
440 |
|
|
441 |
|
tkt = shishi_ap_tkt (ap); |
442 |
|
if (tkt == NULL) |
443 |
|
{ |
444 |
|
syslog (LOG_ERR, "Could not get tkt from AP-REQ: %s\n", shishi_strerror (rc)); |
445 |
|
return 1; |
446 |
|
} |
447 |
|
|
448 |
|
rc = shishi_encticketpart_get_key (*handle, |
449 |
|
shishi_tkt_encticketpart (tkt), enckey); |
450 |
|
if (rc != SHISHI_OK) |
451 |
|
{ |
452 |
|
syslog (LOG_ERR, "Could not get key from Encticketpart: %s\n", shishi_strerror (rc)); |
453 |
|
return 1; |
454 |
|
} |
455 |
|
} |
456 |
|
#endif |
457 |
|
|
458 |
shishi_ap_done (ap); |
shishi_ap_done (ap); |
459 |
|
|
460 |
return SHISHI_OK; |
return SHISHI_OK; |
465 |
/* read encrypted data on socket */ |
/* read encrypted data on socket */ |
466 |
int |
int |
467 |
readenc (Shishi * h, int sock, char *buf, int *len, shishi_ivector *iv, |
readenc (Shishi * h, int sock, char *buf, int *len, shishi_ivector *iv, |
468 |
Shishi_key * enckey) |
Shishi_key * enckey, int proto) |
469 |
{ |
{ |
470 |
char *out; |
char *out; |
471 |
char *outbis; |
char *outbis; |
494 |
hashsize = |
hashsize = |
495 |
shishi_checksum_cksumlen (shishi_cipher_defaultcksumtype (enctype)); |
shishi_checksum_cksumlen (shishi_cipher_defaultcksumtype (enctype)); |
496 |
|
|
497 |
dlen += blocksize - 1 + 4; |
dlen += blocksize - 1; |
498 |
|
if (proto == 2) |
499 |
|
dlen += 4; |
500 |
if (shishi_key_type (enckey) != SHISHI_DES3_CBC_HMAC_SHA1_KD) |
if (shishi_key_type (enckey) != SHISHI_DES3_CBC_HMAC_SHA1_KD) |
501 |
dlen += hashsize; |
dlen += hashsize; |
502 |
else |
else |
523 |
return 1; |
return 1; |
524 |
} |
} |
525 |
|
|
526 |
/* decrypt it */ |
if (proto == 1) |
527 |
rc = |
{ |
528 |
shishi_decrypt_ivupdate (h, enckey, iv->keyusage, iv->iv, iv->ivlen, &iv2, &iv->ivlen, outbis, |
rc = |
529 |
|
shishi_decrypt (h, enckey, iv->keyusage, outbis, dlen, &out, &outlen); |
530 |
|
} |
531 |
|
else |
532 |
|
{ |
533 |
|
rc = |
534 |
|
shishi_decrypt_ivupdate (h, enckey, iv->keyusage, iv->iv, iv->ivlen, &iv2, &iv->ivlen, outbis, |
535 |
dlen, &out, &outlen); |
dlen, &out, &outlen); |
536 |
|
} |
537 |
if (rc != SHISHI_OK) |
if (rc != SHISHI_OK) |
538 |
{ |
{ |
539 |
printf ("decryption error\n"); |
printf ("decryption error\n"); |
540 |
return 1; |
return 1; |
541 |
} |
} |
542 |
|
|
543 |
/* len = first 4 bytes of decrypted data */ |
/* len = first 4 bytes of decrypted data */ |
544 |
*len = ntohl (*((int *) out)); |
if (proto == 2) |
545 |
|
{ |
546 |
|
/* in KCMDV0.2 first 4 bytes of decrypted data = len of data */ |
547 |
|
*len = ntohl (*((int *) out)); |
548 |
|
val = sizeof (int); |
549 |
|
} |
550 |
|
else |
551 |
|
{ |
552 |
|
*len = outlen; |
553 |
|
val = 0; |
554 |
|
} |
555 |
|
|
556 |
/* update iv */ |
if (proto == 2) |
557 |
memcpy (iv->iv, iv2, iv->ivlen); |
{ |
558 |
|
/* update iv */ |
559 |
|
memcpy (iv->iv, iv2, iv->ivlen); |
560 |
|
} |
561 |
|
|
|
/* Temp patch to remove 5 unidentified bytes data from server */ |
|
562 |
memset (buf, 0, BUFLEN); |
memset (buf, 0, BUFLEN); |
|
// if ((unsigned char) out[4] == 255) |
|
|
// val = 5 + sizeof (int); |
|
|
//else |
|
|
val = sizeof (int); |
|
563 |
|
|
564 |
/* copy decrypted data to output */ |
/* copy decrypted data to output */ |
565 |
memcpy (buf, out + val, strlen (out + val)); |
memcpy (buf, out + val, outlen-val); |
566 |
|
|
567 |
free (out); |
free (out); |
568 |
free (outbis); |
free (outbis); |
573 |
/* write encrypted data to socket */ |
/* write encrypted data to socket */ |
574 |
int |
int |
575 |
writeenc (Shishi * h, int sock, char *buf, int wlen, int *len, shishi_ivector *iv, |
writeenc (Shishi * h, int sock, char *buf, int wlen, int *len, shishi_ivector *iv, |
576 |
Shishi_key * enckey) |
Shishi_key * enckey, int proto) |
577 |
{ |
{ |
578 |
char *out; |
char *out; |
579 |
char *bufbis; |
char *bufbis; |
589 |
dlen = htonl (dlen); |
dlen = htonl (dlen); |
590 |
|
|
591 |
/* data to encrypt = size + data */ |
/* data to encrypt = size + data */ |
592 |
bufbis = malloc (wlen + sizeof (int)); |
if (proto == 2) |
593 |
memcpy (bufbis, (char *) &dlen, sizeof (int)); |
{ |
594 |
memcpy (bufbis + sizeof (int), buf, wlen); |
bufbis = malloc (wlen + sizeof (int)); |
595 |
|
memset (bufbis, 0, wlen + sizeof (int)); |
596 |
/* encrypt it */ |
memcpy (bufbis, (char *) &dlen, sizeof (int)); |
597 |
rc = |
memcpy (bufbis + sizeof (int), buf, wlen); |
598 |
shishi_encrypt_ivupdate (h, enckey, iv->keyusage, iv->iv, iv->ivlen, &iv2, &iv->ivlen, bufbis, |
|
599 |
wlen + sizeof (int), &out, &outlen); |
/* encrypt it */ |
600 |
|
rc = |
601 |
|
shishi_encrypt_ivupdate (h, enckey, iv->keyusage, iv->iv, iv->ivlen, &iv2, &iv->ivlen, bufbis, |
602 |
|
wlen + sizeof (int), &out, &outlen); |
603 |
|
} |
604 |
|
else |
605 |
|
{ |
606 |
|
bufbis = malloc (wlen); |
607 |
|
memset (bufbis, 0, wlen); |
608 |
|
memcpy (bufbis, buf, wlen); |
609 |
|
|
610 |
|
/* data to encrypt = size + data */ |
611 |
|
rc = |
612 |
|
shishi_encrypt (h, enckey, iv->keyusage, bufbis, wlen, &out, &outlen); |
613 |
|
} |
614 |
|
|
615 |
if (rc != SHISHI_OK) |
if (rc != SHISHI_OK) |
616 |
{ |
{ |
617 |
printf ("decryption error\n"); |
printf ("decryption error\n"); |
618 |
|
free (bufbis); |
619 |
return 1; |
return 1; |
620 |
} |
} |
621 |
|
|
622 |
free (bufbis); |
free (bufbis); |
623 |
|
|
624 |
/* data to send = original size + encrypted data */ |
/* data to send = original size + encrypted data */ |
|
bufbis = malloc (outlen + sizeof (int)); |
|
|
if (bufbis == NULL) |
|
|
{ |
|
|
printf ("Malloc error!\n"); |
|
|
return 1; |
|
|
} |
|
|
memcpy (bufbis, (char *) &dlen, sizeof (int)); |
|
|
memcpy (bufbis + sizeof (int), out, outlen); |
|
|
|
|
625 |
/* send it */ |
/* send it */ |
626 |
write (sock, bufbis, outlen + sizeof (int)); |
write (sock, &dlen, sizeof (int)); |
627 |
|
write (sock, out, outlen); |
628 |
|
|
629 |
*len = wlen; |
*len = wlen; |
630 |
|
|
631 |
/* update iv */ |
if (proto == 2) |
632 |
memcpy (iv->iv, iv2, iv->ivlen); |
{ |
633 |
|
/* update iv */ |
634 |
|
memcpy (iv->iv, iv2, iv->ivlen); |
635 |
|
} |
636 |
|
|
|
free (bufbis); |
|
637 |
free (out); |
free (out); |
638 |
|
|
639 |
return SHISHI_OK; |
return SHISHI_OK; |