17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
57c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
67c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
77c478bd9Sstevel@tonic-gate * with the License.
87c478bd9Sstevel@tonic-gate *
97c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
107c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
117c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
127c478bd9Sstevel@tonic-gate * and limitations under the License.
137c478bd9Sstevel@tonic-gate *
147c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
157c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
167c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
177c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
187c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
197c478bd9Sstevel@tonic-gate *
207c478bd9Sstevel@tonic-gate * CDDL HEADER END
217c478bd9Sstevel@tonic-gate */
227c478bd9Sstevel@tonic-gate /*
2349e7ca49Speteh * Copyright 2005 Sun Microsystems, Inc. All rights reserved.
247c478bd9Sstevel@tonic-gate * Use is subject to license terms.
257c478bd9Sstevel@tonic-gate */
267c478bd9Sstevel@tonic-gate
277c478bd9Sstevel@tonic-gate /*
287c478bd9Sstevel@tonic-gate * University Copyright- Copyright (c) 1982, 1986, 1988
297c478bd9Sstevel@tonic-gate * The Regents of the University of California
307c478bd9Sstevel@tonic-gate * All Rights Reserved
317c478bd9Sstevel@tonic-gate *
327c478bd9Sstevel@tonic-gate * University Acknowledgment- Portions of this document are derived from
337c478bd9Sstevel@tonic-gate * software developed by the University of California, Berkeley, and its
347c478bd9Sstevel@tonic-gate * contributors.
357c478bd9Sstevel@tonic-gate */
367c478bd9Sstevel@tonic-gate
377c478bd9Sstevel@tonic-gate /*
387c478bd9Sstevel@tonic-gate * Do the real work of the keyserver.
397c478bd9Sstevel@tonic-gate * Store secret keys. Compute common keys,
407c478bd9Sstevel@tonic-gate * and use them to decrypt and encrypt DES keys.
417c478bd9Sstevel@tonic-gate * Cache the common keys, so the expensive computation is avoided.
427c478bd9Sstevel@tonic-gate */
437c478bd9Sstevel@tonic-gate #include <stdio.h>
447c478bd9Sstevel@tonic-gate #include <stdlib.h>
457c478bd9Sstevel@tonic-gate #include <mp.h>
467c478bd9Sstevel@tonic-gate #include <rpc/rpc.h>
477c478bd9Sstevel@tonic-gate #include <rpc/key_prot.h>
487c478bd9Sstevel@tonic-gate #include <rpc/des_crypt.h>
497c478bd9Sstevel@tonic-gate #include <rpcsvc/nis_dhext.h>
507c478bd9Sstevel@tonic-gate #include <sys/errno.h>
517c478bd9Sstevel@tonic-gate #include <string.h>
527c478bd9Sstevel@tonic-gate #include <thread.h>
537c478bd9Sstevel@tonic-gate #include <syslog.h>
547c478bd9Sstevel@tonic-gate
557c478bd9Sstevel@tonic-gate #include "debug.h"
567c478bd9Sstevel@tonic-gate #include "keyserv_cache.h"
577c478bd9Sstevel@tonic-gate
587c478bd9Sstevel@tonic-gate extern char ROOTKEY[];
597c478bd9Sstevel@tonic-gate extern mechanism_t **mechs;
607c478bd9Sstevel@tonic-gate extern char **cache_options;
617c478bd9Sstevel@tonic-gate extern int *cache_size;
627c478bd9Sstevel@tonic-gate extern int disk_caching;
637c478bd9Sstevel@tonic-gate
647c478bd9Sstevel@tonic-gate static MINT *MODULUS;
657c478bd9Sstevel@tonic-gate static int hash_keys();
667c478bd9Sstevel@tonic-gate static keystatus pk_crypt();
677c478bd9Sstevel@tonic-gate static keystatus pk_crypt3();
687c478bd9Sstevel@tonic-gate static int nodefaultkeys = 0;
697c478bd9Sstevel@tonic-gate
707c478bd9Sstevel@tonic-gate #define DES "des"
717c478bd9Sstevel@tonic-gate #define DESALIAS "dh192-0"
727c478bd9Sstevel@tonic-gate #define DHMECHSTR "diffie_hellman"
737c478bd9Sstevel@tonic-gate #define CLASSIC_PK_DH(k, a) (((k) == 192) && ((a) == 0))
747c478bd9Sstevel@tonic-gate
757c478bd9Sstevel@tonic-gate /*
767c478bd9Sstevel@tonic-gate * Exponential caching management
777c478bd9Sstevel@tonic-gate */
787c478bd9Sstevel@tonic-gate struct cachekey_list {
797c478bd9Sstevel@tonic-gate keybuf secret;
807c478bd9Sstevel@tonic-gate keybuf public;
817c478bd9Sstevel@tonic-gate des_block deskey;
827c478bd9Sstevel@tonic-gate struct cachekey_list *next;
837c478bd9Sstevel@tonic-gate };
847c478bd9Sstevel@tonic-gate #define KEY_HASH_SIZE 256
857c478bd9Sstevel@tonic-gate static struct cachekey_list *g_cachedkeys[KEY_HASH_SIZE];
867c478bd9Sstevel@tonic-gate static rwlock_t g_cachedkeys_lock = DEFAULTRWLOCK;
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate #ifdef DEBUG
897c478bd9Sstevel@tonic-gate int
test_debug(debug_level level,char * file,int line)907c478bd9Sstevel@tonic-gate test_debug(debug_level level, char *file, int line)
917c478bd9Sstevel@tonic-gate {
927c478bd9Sstevel@tonic-gate if (level < debugging)
937c478bd9Sstevel@tonic-gate return (0);
947c478bd9Sstevel@tonic-gate fprintf(stderr, "file %s,\tline %d :\t", file, line);
957c478bd9Sstevel@tonic-gate return (1);
967c478bd9Sstevel@tonic-gate }
977c478bd9Sstevel@tonic-gate
987c478bd9Sstevel@tonic-gate int
real_debug(char * fmt,...)997c478bd9Sstevel@tonic-gate real_debug(char *fmt, ...)
1007c478bd9Sstevel@tonic-gate {
1017c478bd9Sstevel@tonic-gate va_list args;
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate va_start(args, fmt);
1047c478bd9Sstevel@tonic-gate (void) vfprintf(stderr, fmt, args);
1057c478bd9Sstevel@tonic-gate va_end(args);
1067c478bd9Sstevel@tonic-gate fprintf(stderr, "\n");
1077c478bd9Sstevel@tonic-gate fflush(stderr);
1087c478bd9Sstevel@tonic-gate return (1);
1097c478bd9Sstevel@tonic-gate }
1107c478bd9Sstevel@tonic-gate #endif /* DEBUG */
1117c478bd9Sstevel@tonic-gate
1127c478bd9Sstevel@tonic-gate struct cacheuid_list {
1137c478bd9Sstevel@tonic-gate uid_t uid;
1147c478bd9Sstevel@tonic-gate int refcnt;
1157c478bd9Sstevel@tonic-gate keybuf3 *secretkey;
1167c478bd9Sstevel@tonic-gate keybuf3 *publickey;
1177c478bd9Sstevel@tonic-gate netnamestr netname;
1187c478bd9Sstevel@tonic-gate des_block key;
1197c478bd9Sstevel@tonic-gate struct cacheuid_list *next;
1207c478bd9Sstevel@tonic-gate };
1217c478bd9Sstevel@tonic-gate
1227c478bd9Sstevel@tonic-gate #define NUMHASHBUCKETS 256
1237c478bd9Sstevel@tonic-gate #define HASH_UID(x) (x & 0xff)
1247c478bd9Sstevel@tonic-gate
1257c478bd9Sstevel@tonic-gate struct mechdata {
1267c478bd9Sstevel@tonic-gate struct cacheuid_list *bucket[NUMHASHBUCKETS];
1277c478bd9Sstevel@tonic-gate };
1287c478bd9Sstevel@tonic-gate
1297c478bd9Sstevel@tonic-gate struct psdata {
1307c478bd9Sstevel@tonic-gate struct cachekey3_list *common[NUMHASHBUCKETS];
1317c478bd9Sstevel@tonic-gate };
1327c478bd9Sstevel@tonic-gate
1337c478bd9Sstevel@tonic-gate struct mechentry {
1347c478bd9Sstevel@tonic-gate mutex_t mech_lock;
1357c478bd9Sstevel@tonic-gate struct mechdata *mechdata;
1367c478bd9Sstevel@tonic-gate mutex_t ps_lock;
1377c478bd9Sstevel@tonic-gate struct psdata *psdata;
1387c478bd9Sstevel@tonic-gate };
1397c478bd9Sstevel@tonic-gate
1407c478bd9Sstevel@tonic-gate /*
1417c478bd9Sstevel@tonic-gate * we don't need to worry about locking for the keylen + algtype
1427c478bd9Sstevel@tonic-gate * sparse array because it is created once and for all during
1437c478bd9Sstevel@tonic-gate * initialization when there are no threads. The mechentry field
1447c478bd9Sstevel@tonic-gate * and everything underneath it needs protection and this is what
1457c478bd9Sstevel@tonic-gate * the *_lock fields are for.
1467c478bd9Sstevel@tonic-gate */
1477c478bd9Sstevel@tonic-gate struct algtypelist {
1487c478bd9Sstevel@tonic-gate algtype_t algtype;
1497c478bd9Sstevel@tonic-gate struct algtypelist *next;
1507c478bd9Sstevel@tonic-gate struct mechentry mech;
1517c478bd9Sstevel@tonic-gate };
1527c478bd9Sstevel@tonic-gate
1537c478bd9Sstevel@tonic-gate struct keylenlist {
1547c478bd9Sstevel@tonic-gate keylen_t keylen;
1557c478bd9Sstevel@tonic-gate struct algtypelist *ap;
1567c478bd9Sstevel@tonic-gate struct keylenlist *next;
1577c478bd9Sstevel@tonic-gate };
1587c478bd9Sstevel@tonic-gate
1597c478bd9Sstevel@tonic-gate #define KEYSERV_VERSION "1.0"
1607c478bd9Sstevel@tonic-gate
1617c478bd9Sstevel@tonic-gate static struct mechtable {
1627c478bd9Sstevel@tonic-gate char *version;
1637c478bd9Sstevel@tonic-gate struct keylenlist *kp;
1647c478bd9Sstevel@tonic-gate } mechtable = {KEYSERV_VERSION, NULL};
1657c478bd9Sstevel@tonic-gate
1667c478bd9Sstevel@tonic-gate static struct keylenlist **
getkeylen(keylen_t k)1677c478bd9Sstevel@tonic-gate getkeylen(keylen_t k)
1687c478bd9Sstevel@tonic-gate {
1697c478bd9Sstevel@tonic-gate struct keylenlist **kpp;
1707c478bd9Sstevel@tonic-gate
1717c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("getkeylen key: %d", k));
1727c478bd9Sstevel@tonic-gate for (kpp = &mechtable.kp;
1737c478bd9Sstevel@tonic-gate *kpp != NULL && (*kpp)->keylen != k;
1747c478bd9Sstevel@tonic-gate kpp = &(*kpp)->next)
1757c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getkeylen failed %x", kpp));
1767c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getkeylen return: %x", kpp));
1777c478bd9Sstevel@tonic-gate return (kpp);
1787c478bd9Sstevel@tonic-gate }
1797c478bd9Sstevel@tonic-gate
1807c478bd9Sstevel@tonic-gate static void
appendkeylist(struct keylenlist ** kpp,keylen_t k)1817c478bd9Sstevel@tonic-gate appendkeylist(struct keylenlist **kpp, keylen_t k)
1827c478bd9Sstevel@tonic-gate {
1837c478bd9Sstevel@tonic-gate struct keylenlist *kp;
1847c478bd9Sstevel@tonic-gate
1857c478bd9Sstevel@tonic-gate if (*kpp == NULL) {
1867c478bd9Sstevel@tonic-gate kp = (struct keylenlist *)malloc(sizeof (*kp));
1877c478bd9Sstevel@tonic-gate if (kp == NULL) {
1887c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO, ("appendkeylist : malloc failed"));
1897c478bd9Sstevel@tonic-gate return;
1907c478bd9Sstevel@tonic-gate }
1917c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("appendkeylist : %x %x %d", kpp, kp, k));
1927c478bd9Sstevel@tonic-gate kp->keylen = k;
1937c478bd9Sstevel@tonic-gate kp->ap = NULL;
1947c478bd9Sstevel@tonic-gate kp->next = NULL;
1957c478bd9Sstevel@tonic-gate *kpp = kp;
1967c478bd9Sstevel@tonic-gate } else {
1977c478bd9Sstevel@tonic-gate /*EMPTY*/
1987c478bd9Sstevel@tonic-gate /* do nothing; only happens for multiple algtypes */
1997c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
2007c478bd9Sstevel@tonic-gate ("appendkeylist called for non tail element"));
2017c478bd9Sstevel@tonic-gate }
2027c478bd9Sstevel@tonic-gate }
2037c478bd9Sstevel@tonic-gate
2047c478bd9Sstevel@tonic-gate static struct algtypelist **
getalgtype(struct keylenlist ** kpp,algtype_t a)2057c478bd9Sstevel@tonic-gate getalgtype(struct keylenlist **kpp, algtype_t a)
2067c478bd9Sstevel@tonic-gate {
2077c478bd9Sstevel@tonic-gate struct algtypelist **app;
2087c478bd9Sstevel@tonic-gate
2097c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("getalgtype key: %d", a));
2107c478bd9Sstevel@tonic-gate for (app = &(*kpp)->ap;
2117c478bd9Sstevel@tonic-gate *app != NULL && (*app)->algtype != a;
2127c478bd9Sstevel@tonic-gate app = &(*app)->next)
2137c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getalgtype key: %x", app));
2147c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getalgtype return: %x", app));
2157c478bd9Sstevel@tonic-gate return (app);
2167c478bd9Sstevel@tonic-gate }
2177c478bd9Sstevel@tonic-gate
2187c478bd9Sstevel@tonic-gate static void
appendalgtype(struct algtypelist ** app,algtype_t a)2197c478bd9Sstevel@tonic-gate appendalgtype(struct algtypelist **app, algtype_t a)
2207c478bd9Sstevel@tonic-gate {
2217c478bd9Sstevel@tonic-gate struct algtypelist *ap;
2227c478bd9Sstevel@tonic-gate
2237c478bd9Sstevel@tonic-gate if (*app == NULL) {
2247c478bd9Sstevel@tonic-gate ap = (struct algtypelist *)malloc(sizeof (*ap));
2257c478bd9Sstevel@tonic-gate if (ap == NULL) {
2267c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO, ("appendalgtype : malloc failed"));
2277c478bd9Sstevel@tonic-gate return;
2287c478bd9Sstevel@tonic-gate }
2297c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("appendalgtype : %x %x %d", app, ap, a));
2307c478bd9Sstevel@tonic-gate ap->algtype = a;
2317c478bd9Sstevel@tonic-gate mutex_init(&ap->mech.mech_lock, USYNC_THREAD, NULL);
2327c478bd9Sstevel@tonic-gate mutex_init(&ap->mech.ps_lock, USYNC_THREAD, NULL);
2337c478bd9Sstevel@tonic-gate ap->mech.mechdata = NULL;
2347c478bd9Sstevel@tonic-gate ap->mech.psdata = NULL;
2357c478bd9Sstevel@tonic-gate ap->next = NULL;
2367c478bd9Sstevel@tonic-gate *app = ap;
2377c478bd9Sstevel@tonic-gate } else {
2387c478bd9Sstevel@tonic-gate /*EMPTY*/
2397c478bd9Sstevel@tonic-gate /* don't mind duplicate (keylen,algtype) paris for now. */
2407c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
2417c478bd9Sstevel@tonic-gate ("appendalgtype called for non tail element"));
2427c478bd9Sstevel@tonic-gate }
2437c478bd9Sstevel@tonic-gate }
2447c478bd9Sstevel@tonic-gate
2457c478bd9Sstevel@tonic-gate static struct mechentry *
getmechtype(keylen_t k,algtype_t a)2467c478bd9Sstevel@tonic-gate getmechtype(keylen_t k, algtype_t a)
2477c478bd9Sstevel@tonic-gate {
2487c478bd9Sstevel@tonic-gate struct keylenlist **kpp;
2497c478bd9Sstevel@tonic-gate struct algtypelist **app;
2507c478bd9Sstevel@tonic-gate
2517c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("getmechtype %d %d", k, a));
2527c478bd9Sstevel@tonic-gate kpp = getkeylen(k);
2537c478bd9Sstevel@tonic-gate if (*kpp == NULL) {
2547c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getmechtype %d not found in keys", k));
2557c478bd9Sstevel@tonic-gate return (0);
2567c478bd9Sstevel@tonic-gate }
2577c478bd9Sstevel@tonic-gate app = getalgtype(kpp, a);
2587c478bd9Sstevel@tonic-gate if (*app == NULL) {
2597c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getmechtype %d not found in algs", a));
2607c478bd9Sstevel@tonic-gate return (0);
2617c478bd9Sstevel@tonic-gate }
2627c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getmechtype found %x", app));
2637c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getmechtype return %x", &(*app)->mech));
2647c478bd9Sstevel@tonic-gate return (&(*app)->mech);
2657c478bd9Sstevel@tonic-gate }
2667c478bd9Sstevel@tonic-gate
2677c478bd9Sstevel@tonic-gate static keybuf3 *
getkeybuf3(int k)2687c478bd9Sstevel@tonic-gate getkeybuf3(int k)
2697c478bd9Sstevel@tonic-gate {
2707c478bd9Sstevel@tonic-gate keybuf3 *buf;
2717c478bd9Sstevel@tonic-gate
2727c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getkeybuf3 malloc %d", k));
2737c478bd9Sstevel@tonic-gate buf = (keybuf3 *) malloc(sizeof (*buf));
2747c478bd9Sstevel@tonic-gate if (buf == NULL) {
2757c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getkeybuf3 malloc failed"));
2767c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "file %s line %d: malloc failed",
2777c478bd9Sstevel@tonic-gate __FILE__, __LINE__);
2787c478bd9Sstevel@tonic-gate return (NULL);
2797c478bd9Sstevel@tonic-gate }
2807c478bd9Sstevel@tonic-gate buf->keybuf3_len = k;
2817c478bd9Sstevel@tonic-gate /* XXX special case k==0 */
2827c478bd9Sstevel@tonic-gate if (k == 0) {
2837c478bd9Sstevel@tonic-gate buf->keybuf3_val = NULL;
2847c478bd9Sstevel@tonic-gate } else {
2857c478bd9Sstevel@tonic-gate buf->keybuf3_val = (char *)malloc(k);
2867c478bd9Sstevel@tonic-gate if (buf->keybuf3_val == NULL) {
2877c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getkeybuf3 malloc failed"));
2887c478bd9Sstevel@tonic-gate free(buf);
2897c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "file %s line %d: malloc failed",
2907c478bd9Sstevel@tonic-gate __FILE__, __LINE__);
2917c478bd9Sstevel@tonic-gate return (NULL);
2927c478bd9Sstevel@tonic-gate }
2937c478bd9Sstevel@tonic-gate }
2947c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("getkeybuf3 ret %x", buf));
2957c478bd9Sstevel@tonic-gate return (buf);
2967c478bd9Sstevel@tonic-gate }
2977c478bd9Sstevel@tonic-gate
2987c478bd9Sstevel@tonic-gate static void
freekeybuf3(keybuf3 * kp)2997c478bd9Sstevel@tonic-gate freekeybuf3(keybuf3 *kp)
3007c478bd9Sstevel@tonic-gate {
3017c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("freekeybuf3 %x", kp));
3027c478bd9Sstevel@tonic-gate if (kp == NULL)
3037c478bd9Sstevel@tonic-gate return;
3047c478bd9Sstevel@tonic-gate if (kp->keybuf3_val) {
3057c478bd9Sstevel@tonic-gate /* XXX kp->keybuf3_len != 0? */
3067c478bd9Sstevel@tonic-gate free(kp->keybuf3_val);
3077c478bd9Sstevel@tonic-gate }
3087c478bd9Sstevel@tonic-gate free(kp);
3097c478bd9Sstevel@tonic-gate }
3107c478bd9Sstevel@tonic-gate
3117c478bd9Sstevel@tonic-gate static keybuf3 *
cpykeybuf3(keybuf3 * src)3127c478bd9Sstevel@tonic-gate cpykeybuf3(keybuf3 *src)
3137c478bd9Sstevel@tonic-gate {
3147c478bd9Sstevel@tonic-gate keybuf3 *dst;
3157c478bd9Sstevel@tonic-gate
3167c478bd9Sstevel@tonic-gate if (src == NULL) {
3177c478bd9Sstevel@tonic-gate return (NULL);
3187c478bd9Sstevel@tonic-gate }
3197c478bd9Sstevel@tonic-gate if ((dst = getkeybuf3(src->keybuf3_len)) == NULL) {
3207c478bd9Sstevel@tonic-gate return (NULL);
3217c478bd9Sstevel@tonic-gate }
3227c478bd9Sstevel@tonic-gate memcpy(dst->keybuf3_val, src->keybuf3_val, src->keybuf3_len);
3237c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("cpykeybuf3 ret %x", dst));
3247c478bd9Sstevel@tonic-gate return (dst);
3257c478bd9Sstevel@tonic-gate }
3267c478bd9Sstevel@tonic-gate
3277c478bd9Sstevel@tonic-gate static keybuf3 *
setkeybuf3(char * src,int len)3287c478bd9Sstevel@tonic-gate setkeybuf3(char *src, int len)
3297c478bd9Sstevel@tonic-gate {
3307c478bd9Sstevel@tonic-gate keybuf3 *dst;
3317c478bd9Sstevel@tonic-gate
3327c478bd9Sstevel@tonic-gate if ((dst = getkeybuf3(++len)) == NULL) {
3337c478bd9Sstevel@tonic-gate return (NULL);
3347c478bd9Sstevel@tonic-gate }
3357c478bd9Sstevel@tonic-gate memcpy(dst->keybuf3_val, src, len);
3367c478bd9Sstevel@tonic-gate return (dst);
3377c478bd9Sstevel@tonic-gate }
3387c478bd9Sstevel@tonic-gate
3397c478bd9Sstevel@tonic-gate static int
cmpkeybuf3(keybuf3 * k1,keybuf3 * k2)3407c478bd9Sstevel@tonic-gate cmpkeybuf3(keybuf3 *k1, keybuf3 *k2)
3417c478bd9Sstevel@tonic-gate {
3427c478bd9Sstevel@tonic-gate if ((k1 == NULL) || (k2 == NULL)) {
3437c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "cmpkeybuf3: invalid parameter: %x, %x",
3447c478bd9Sstevel@tonic-gate k1, k2);
3457c478bd9Sstevel@tonic-gate return (0);
3467c478bd9Sstevel@tonic-gate }
3477c478bd9Sstevel@tonic-gate if (k1->keybuf3_len != k2->keybuf3_len) {
3487c478bd9Sstevel@tonic-gate return (0);
3497c478bd9Sstevel@tonic-gate }
3507c478bd9Sstevel@tonic-gate return (!memcmp(k1->keybuf3_val, k2->keybuf3_val, k1->keybuf3_len));
3517c478bd9Sstevel@tonic-gate }
3527c478bd9Sstevel@tonic-gate
3537c478bd9Sstevel@tonic-gate static int
storekeybuf3(keybuf3 * dst,keybuf3 * src)3547c478bd9Sstevel@tonic-gate storekeybuf3(keybuf3 *dst, keybuf3 *src)
3557c478bd9Sstevel@tonic-gate {
3567c478bd9Sstevel@tonic-gate keybuf3 *tmp;
3577c478bd9Sstevel@tonic-gate
3587c478bd9Sstevel@tonic-gate if ((tmp = cpykeybuf3(src)) == NULL) {
3597c478bd9Sstevel@tonic-gate return (0);
3607c478bd9Sstevel@tonic-gate }
3617c478bd9Sstevel@tonic-gate *dst = *tmp;
3627c478bd9Sstevel@tonic-gate free(tmp); /* but not the contents */
3637c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("storekeybuf3 ret %d %x",
3647c478bd9Sstevel@tonic-gate dst->keybuf3_len, dst->keybuf3_val));
3657c478bd9Sstevel@tonic-gate return (1);
3667c478bd9Sstevel@tonic-gate }
3677c478bd9Sstevel@tonic-gate
3687c478bd9Sstevel@tonic-gate static deskeyarray *
getdeskeyarray(int k)3697c478bd9Sstevel@tonic-gate getdeskeyarray(int k)
3707c478bd9Sstevel@tonic-gate {
3717c478bd9Sstevel@tonic-gate deskeyarray *buf;
3727c478bd9Sstevel@tonic-gate
3737c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getdeskeyarray malloc %d", k));
3747c478bd9Sstevel@tonic-gate buf = (deskeyarray *) malloc(sizeof (*buf));
3757c478bd9Sstevel@tonic-gate if (buf == NULL) {
3767c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getdeskeyarray malloc failed"));
3777c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "file %s line %d: malloc failed",
3787c478bd9Sstevel@tonic-gate __FILE__, __LINE__);
3797c478bd9Sstevel@tonic-gate return (NULL);
3807c478bd9Sstevel@tonic-gate }
3817c478bd9Sstevel@tonic-gate buf->deskeyarray_len = k;
3827c478bd9Sstevel@tonic-gate /* XXX special case k==0 */
3837c478bd9Sstevel@tonic-gate if (k == 0) {
3847c478bd9Sstevel@tonic-gate buf->deskeyarray_val = NULL;
3857c478bd9Sstevel@tonic-gate } else {
3867c478bd9Sstevel@tonic-gate buf->deskeyarray_val = (des_block *)
3877c478bd9Sstevel@tonic-gate malloc(k * sizeof (des_block));
3887c478bd9Sstevel@tonic-gate if (buf->deskeyarray_val == NULL) {
3897c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getdeskeyarray malloc failed"));
3907c478bd9Sstevel@tonic-gate free(buf);
3917c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "file %s line %d: malloc failed",
3927c478bd9Sstevel@tonic-gate __FILE__, __LINE__);
3937c478bd9Sstevel@tonic-gate return (NULL);
3947c478bd9Sstevel@tonic-gate }
3957c478bd9Sstevel@tonic-gate }
3967c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("getdeskeyarray ret %x", buf));
3977c478bd9Sstevel@tonic-gate return (buf);
3987c478bd9Sstevel@tonic-gate }
3997c478bd9Sstevel@tonic-gate
4007c478bd9Sstevel@tonic-gate static deskeyarray *
cpydeskeyarray(deskeyarray * src)4017c478bd9Sstevel@tonic-gate cpydeskeyarray(deskeyarray *src)
4027c478bd9Sstevel@tonic-gate {
4037c478bd9Sstevel@tonic-gate deskeyarray *dst;
4047c478bd9Sstevel@tonic-gate
4057c478bd9Sstevel@tonic-gate if (src == NULL) {
4067c478bd9Sstevel@tonic-gate return (NULL);
4077c478bd9Sstevel@tonic-gate }
4087c478bd9Sstevel@tonic-gate if ((dst = getdeskeyarray(src->deskeyarray_len)) == NULL) {
4097c478bd9Sstevel@tonic-gate return (NULL);
4107c478bd9Sstevel@tonic-gate }
4117c478bd9Sstevel@tonic-gate memcpy(dst->deskeyarray_val, src->deskeyarray_val,
4127c478bd9Sstevel@tonic-gate src->deskeyarray_len * sizeof (des_block));
4137c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("cpydeskeyarray ret %x", dst));
4147c478bd9Sstevel@tonic-gate return (dst);
4157c478bd9Sstevel@tonic-gate }
4167c478bd9Sstevel@tonic-gate
4177c478bd9Sstevel@tonic-gate static int
storedeskeyarray(deskeyarray * dst,deskeyarray * src)4187c478bd9Sstevel@tonic-gate storedeskeyarray(deskeyarray *dst, deskeyarray *src)
4197c478bd9Sstevel@tonic-gate {
4207c478bd9Sstevel@tonic-gate deskeyarray *tmp;
4217c478bd9Sstevel@tonic-gate
4227c478bd9Sstevel@tonic-gate if ((tmp = cpydeskeyarray(src)) == NULL) {
4237c478bd9Sstevel@tonic-gate return (0);
4247c478bd9Sstevel@tonic-gate }
4257c478bd9Sstevel@tonic-gate *dst = *tmp;
4267c478bd9Sstevel@tonic-gate free(tmp); /* but not the contents */
4277c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("storedeskeyarray ret %d %x",
4287c478bd9Sstevel@tonic-gate dst->deskeyarray_len, dst->deskeyarray_val));
4297c478bd9Sstevel@tonic-gate return (1);
4307c478bd9Sstevel@tonic-gate }
4317c478bd9Sstevel@tonic-gate
4327c478bd9Sstevel@tonic-gate int
setdeskeyarray(deskeyarray * dst,int k)4337c478bd9Sstevel@tonic-gate setdeskeyarray(deskeyarray *dst, int k)
4347c478bd9Sstevel@tonic-gate {
4357c478bd9Sstevel@tonic-gate deskeyarray *tmp;
4367c478bd9Sstevel@tonic-gate
4377c478bd9Sstevel@tonic-gate if ((tmp = getdeskeyarray(k)) == NULL) {
4387c478bd9Sstevel@tonic-gate return (0);
4397c478bd9Sstevel@tonic-gate }
4407c478bd9Sstevel@tonic-gate *dst = *tmp;
4417c478bd9Sstevel@tonic-gate free(tmp); /* but not the contents */
4427c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("setdeskeyarray ret %d %x",
4437c478bd9Sstevel@tonic-gate dst->deskeyarray_len, dst->deskeyarray_val));
4447c478bd9Sstevel@tonic-gate return (1);
4457c478bd9Sstevel@tonic-gate }
4467c478bd9Sstevel@tonic-gate
4477c478bd9Sstevel@tonic-gate static int
cachehit3(keybuf3 * public,keybuf3 * secret,struct cachekey3_list * cp)4487c478bd9Sstevel@tonic-gate cachehit3(keybuf3 *public, keybuf3 *secret, struct cachekey3_list *cp)
4497c478bd9Sstevel@tonic-gate {
4507c478bd9Sstevel@tonic-gate return (cmpkeybuf3(public, cp->public) &&
4517c478bd9Sstevel@tonic-gate cmpkeybuf3(secret, cp->secret));
4527c478bd9Sstevel@tonic-gate }
4537c478bd9Sstevel@tonic-gate
4547c478bd9Sstevel@tonic-gate static struct cacheuid_list **
mapuid2cache(uid_t uid,struct mechdata * mdp)4557c478bd9Sstevel@tonic-gate mapuid2cache(uid_t uid, struct mechdata *mdp)
4567c478bd9Sstevel@tonic-gate {
4577c478bd9Sstevel@tonic-gate struct cacheuid_list **cpp;
4587c478bd9Sstevel@tonic-gate int hash = HASH_UID(uid);
4597c478bd9Sstevel@tonic-gate
4607c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("mapuid2cache %d %d %x", uid, hash, mdp));
4617c478bd9Sstevel@tonic-gate for (cpp = &mdp->bucket[hash];
4627c478bd9Sstevel@tonic-gate *cpp != NULL && (*cpp)->uid != uid;
4637c478bd9Sstevel@tonic-gate cpp = &(*cpp)->next) {
4647c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("mapuid2cache %x", cpp));
4657c478bd9Sstevel@tonic-gate }
4667c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("mapuid2cache ret %x", cpp));
4677c478bd9Sstevel@tonic-gate return (cpp);
4687c478bd9Sstevel@tonic-gate }
4697c478bd9Sstevel@tonic-gate
4707c478bd9Sstevel@tonic-gate static int
appendsecretkey3(struct mechentry * mp,uid_t uid,setkeyarg3 * skey)4717c478bd9Sstevel@tonic-gate appendsecretkey3(struct mechentry *mp, uid_t uid, setkeyarg3 *skey)
4727c478bd9Sstevel@tonic-gate {
4737c478bd9Sstevel@tonic-gate struct mechdata *mdp;
4747c478bd9Sstevel@tonic-gate struct cacheuid_list **cpp, *cp;
4757c478bd9Sstevel@tonic-gate keybuf3 nullkey = {0, NULL};
4767c478bd9Sstevel@tonic-gate
4777c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("appendsecretkey3 %x", mp));
4787c478bd9Sstevel@tonic-gate if ((skey == NULL) || (mp == NULL)) {
4797c478bd9Sstevel@tonic-gate return (0);
4807c478bd9Sstevel@tonic-gate }
4817c478bd9Sstevel@tonic-gate if (skey->key.keybuf3_len == 0) {
4827c478bd9Sstevel@tonic-gate return (0);
4837c478bd9Sstevel@tonic-gate }
4847c478bd9Sstevel@tonic-gate mutex_lock(&mp->mech_lock);
4857c478bd9Sstevel@tonic-gate if ((mdp = mp->mechdata) == NULL) {
4867c478bd9Sstevel@tonic-gate mdp = (struct mechdata *)calloc(1, sizeof (*mdp));
4877c478bd9Sstevel@tonic-gate if (mdp == NULL) {
4887c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
4897c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO,
4907c478bd9Sstevel@tonic-gate ("appendsecretkey3 : calloc failed"));
4917c478bd9Sstevel@tonic-gate return (0);
4927c478bd9Sstevel@tonic-gate }
4937c478bd9Sstevel@tonic-gate mp->mechdata = mdp;
4947c478bd9Sstevel@tonic-gate }
4957c478bd9Sstevel@tonic-gate cpp = mapuid2cache(uid, mdp);
4967c478bd9Sstevel@tonic-gate if (*cpp == NULL) {
4977c478bd9Sstevel@tonic-gate cp = (struct cacheuid_list *)malloc(sizeof (*cp));
4987c478bd9Sstevel@tonic-gate if (cp == NULL) {
4997c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
5007c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO,
5017c478bd9Sstevel@tonic-gate ("appendsecretkey3 : malloc failed"));
5027c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "file %s line %d: malloc failed",
5037c478bd9Sstevel@tonic-gate __FILE__, __LINE__);
5047c478bd9Sstevel@tonic-gate return (0);
5057c478bd9Sstevel@tonic-gate }
5067c478bd9Sstevel@tonic-gate memset(cp, 0, sizeof (*cp));
5077c478bd9Sstevel@tonic-gate cp->uid = uid;
5087c478bd9Sstevel@tonic-gate *cpp = cp;
5097c478bd9Sstevel@tonic-gate } else {
5107c478bd9Sstevel@tonic-gate cp = *cpp;
5117c478bd9Sstevel@tonic-gate }
5127c478bd9Sstevel@tonic-gate freekeybuf3(cp->secretkey);
5137c478bd9Sstevel@tonic-gate if ((cp->secretkey = cpykeybuf3(&skey->key)) == NULL) {
5147c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
5157c478bd9Sstevel@tonic-gate return (0);
5167c478bd9Sstevel@tonic-gate }
5177c478bd9Sstevel@tonic-gate freekeybuf3(cp->publickey);
5187c478bd9Sstevel@tonic-gate if ((cp->publickey = cpykeybuf3(&nullkey)) == NULL) {
5197c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
5207c478bd9Sstevel@tonic-gate return (0);
5217c478bd9Sstevel@tonic-gate }
5227c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
5237c478bd9Sstevel@tonic-gate return (1);
5247c478bd9Sstevel@tonic-gate }
5257c478bd9Sstevel@tonic-gate
5267c478bd9Sstevel@tonic-gate /*
5277c478bd9Sstevel@tonic-gate * Store the vers 3 secretkey for this uid
5287c478bd9Sstevel@tonic-gate */
5297c478bd9Sstevel@tonic-gate static int
storesecretkey3(uid_t uid,setkeyarg3 * skey)5307c478bd9Sstevel@tonic-gate storesecretkey3(uid_t uid, setkeyarg3 *skey)
5317c478bd9Sstevel@tonic-gate {
5327c478bd9Sstevel@tonic-gate struct mechentry *mp;
5337c478bd9Sstevel@tonic-gate
5347c478bd9Sstevel@tonic-gate if (skey == NULL) {
5357c478bd9Sstevel@tonic-gate return (0);
5367c478bd9Sstevel@tonic-gate }
5377c478bd9Sstevel@tonic-gate if ((mp = getmechtype(skey->keylen, skey->algtype)) == NULL) {
5387c478bd9Sstevel@tonic-gate return (0);
5397c478bd9Sstevel@tonic-gate }
5407c478bd9Sstevel@tonic-gate return (appendsecretkey3(mp, uid, skey));
5417c478bd9Sstevel@tonic-gate }
5427c478bd9Sstevel@tonic-gate
5437c478bd9Sstevel@tonic-gate /*
5447c478bd9Sstevel@tonic-gate * Set the vers 3 secretkey key for this uid
5457c478bd9Sstevel@tonic-gate */
5467c478bd9Sstevel@tonic-gate keystatus
pk_setkey3(uid_t uid,setkeyarg3 * skey)5477c478bd9Sstevel@tonic-gate pk_setkey3(uid_t uid, setkeyarg3 *skey)
5487c478bd9Sstevel@tonic-gate {
5497c478bd9Sstevel@tonic-gate if (!storesecretkey3(uid, skey)) {
5507c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
5517c478bd9Sstevel@tonic-gate }
5527c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
5537c478bd9Sstevel@tonic-gate }
5547c478bd9Sstevel@tonic-gate
5557c478bd9Sstevel@tonic-gate /*
5567c478bd9Sstevel@tonic-gate * Set the secretkey key for this uid
5577c478bd9Sstevel@tonic-gate */
5587c478bd9Sstevel@tonic-gate keystatus
pk_setkey(uid,skey)5597c478bd9Sstevel@tonic-gate pk_setkey(uid, skey)
5607c478bd9Sstevel@tonic-gate uid_t uid;
5617c478bd9Sstevel@tonic-gate keybuf skey;
5627c478bd9Sstevel@tonic-gate {
5637c478bd9Sstevel@tonic-gate int storesecretkey(uid_t, keybuf);
5647c478bd9Sstevel@tonic-gate
5657c478bd9Sstevel@tonic-gate if (!storesecretkey(uid, skey)) {
5667c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
5677c478bd9Sstevel@tonic-gate }
5687c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
5697c478bd9Sstevel@tonic-gate }
5707c478bd9Sstevel@tonic-gate
5717c478bd9Sstevel@tonic-gate int
storeotherrootkeys(FILE * fp,char * netname,char * passwd,char * osecret)5727c478bd9Sstevel@tonic-gate storeotherrootkeys(FILE *fp, char *netname, char *passwd, char *osecret)
5737c478bd9Sstevel@tonic-gate {
5747c478bd9Sstevel@tonic-gate des_block master;
5757c478bd9Sstevel@tonic-gate struct keylenlist *kp;
5767c478bd9Sstevel@tonic-gate struct algtypelist *ap;
5777c478bd9Sstevel@tonic-gate keybuf3 *secret;
5787c478bd9Sstevel@tonic-gate setkeyarg3 skey;
5797c478bd9Sstevel@tonic-gate
5807c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("storeotherrootkeys %s %s",
5817c478bd9Sstevel@tonic-gate netname, passwd));
5827c478bd9Sstevel@tonic-gate passwd2des_g(passwd, netname, strlen(netname), &master, FALSE);
5837c478bd9Sstevel@tonic-gate for (kp = mechtable.kp; kp != NULL; kp = kp->next) {
5847c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
5857c478bd9Sstevel@tonic-gate ("storeotherrootkeys key %d", kp->keylen));
5867c478bd9Sstevel@tonic-gate for (ap = kp->ap; ap != NULL; ap = ap->next) {
5877c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
5887c478bd9Sstevel@tonic-gate ("storeotherrootkeys alg: %d", ap->algtype));
5897c478bd9Sstevel@tonic-gate if ((secret = getkeybuf3(kp->keylen/4+1)) == NULL) {
5907c478bd9Sstevel@tonic-gate return (0);
5917c478bd9Sstevel@tonic-gate }
5927c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
5937c478bd9Sstevel@tonic-gate ("storeotherrootkeys calling getsecretkey_g"));
5947c478bd9Sstevel@tonic-gate if (!getsecretkey_g(netname,
5957c478bd9Sstevel@tonic-gate kp->keylen, ap->algtype,
5967c478bd9Sstevel@tonic-gate secret->keybuf3_val, secret->keybuf3_len,
5977c478bd9Sstevel@tonic-gate passwd)) {
5987c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO,
5997c478bd9Sstevel@tonic-gate ("Can't find %s's secret key", netname));
6007c478bd9Sstevel@tonic-gate return (0);
6017c478bd9Sstevel@tonic-gate }
6027c478bd9Sstevel@tonic-gate if (*secret->keybuf3_val == 0) { /* XXX */
6037c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO,
6047c478bd9Sstevel@tonic-gate ("Password does not decrypt secret key for %s",
6057c478bd9Sstevel@tonic-gate netname));
6067c478bd9Sstevel@tonic-gate return (0);
6077c478bd9Sstevel@tonic-gate }
6087c478bd9Sstevel@tonic-gate skey.key = *secret;
6097c478bd9Sstevel@tonic-gate free(secret); /* but not the buffer it points to */
6107c478bd9Sstevel@tonic-gate skey.userkey = master;
6117c478bd9Sstevel@tonic-gate skey.keylen = kp->keylen;
6127c478bd9Sstevel@tonic-gate skey.algtype = ap->algtype;
6137c478bd9Sstevel@tonic-gate if (CLASSIC_PK_DH(kp->keylen, ap->algtype)) {
6147c478bd9Sstevel@tonic-gate pk_setkey((uid_t)0, osecret);
6157c478bd9Sstevel@tonic-gate fprintf(fp, "%s\n", osecret);
6167c478bd9Sstevel@tonic-gate }
6177c478bd9Sstevel@tonic-gate if (pk_setkey3(0, &skey) != KEY_SUCCESS) {
6187c478bd9Sstevel@tonic-gate return (0);
6197c478bd9Sstevel@tonic-gate }
6207c478bd9Sstevel@tonic-gate if (!CLASSIC_PK_DH(kp->keylen, ap->algtype)) {
6217c478bd9Sstevel@tonic-gate fprintf(fp, "%s %d\n", skey.key.keybuf3_val,
6227c478bd9Sstevel@tonic-gate ap->algtype);
6237c478bd9Sstevel@tonic-gate }
6247c478bd9Sstevel@tonic-gate }
6257c478bd9Sstevel@tonic-gate }
6267c478bd9Sstevel@tonic-gate return (1);
6277c478bd9Sstevel@tonic-gate }
6287c478bd9Sstevel@tonic-gate
6297c478bd9Sstevel@tonic-gate /*
6307c478bd9Sstevel@tonic-gate * prohibit the nobody key on this machine k (the -d flag)
6317c478bd9Sstevel@tonic-gate */
63249e7ca49Speteh int
pk_nodefaultkeys()6337c478bd9Sstevel@tonic-gate pk_nodefaultkeys()
6347c478bd9Sstevel@tonic-gate {
6357c478bd9Sstevel@tonic-gate nodefaultkeys = 1;
6367c478bd9Sstevel@tonic-gate return (0);
6377c478bd9Sstevel@tonic-gate }
6387c478bd9Sstevel@tonic-gate
6397c478bd9Sstevel@tonic-gate static void
freedisklist(struct cacheuid_list * cp)6407c478bd9Sstevel@tonic-gate freedisklist(struct cacheuid_list *cp)
6417c478bd9Sstevel@tonic-gate {
6427c478bd9Sstevel@tonic-gate if (cp == NULL) {
6437c478bd9Sstevel@tonic-gate return;
6447c478bd9Sstevel@tonic-gate }
6457c478bd9Sstevel@tonic-gate free(cp->netname); /* ok even if this is NULL */
6467c478bd9Sstevel@tonic-gate freekeybuf3(cp->secretkey);
6477c478bd9Sstevel@tonic-gate freekeybuf3(cp->publickey);
6487c478bd9Sstevel@tonic-gate }
6497c478bd9Sstevel@tonic-gate
6507c478bd9Sstevel@tonic-gate keystatus
pk_clear3(uid_t uid)6517c478bd9Sstevel@tonic-gate pk_clear3(uid_t uid)
6527c478bd9Sstevel@tonic-gate {
6537c478bd9Sstevel@tonic-gate struct keylenlist *kp;
6547c478bd9Sstevel@tonic-gate struct algtypelist *ap;
6557c478bd9Sstevel@tonic-gate struct mechdata *mdp;
6567c478bd9Sstevel@tonic-gate struct cacheuid_list **cpp, *cp;
6577c478bd9Sstevel@tonic-gate
6587c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("pk_clear3 %d", uid));
6597c478bd9Sstevel@tonic-gate for (kp = mechtable.kp; kp != NULL; kp = kp->next) {
6607c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("pk_clear3 key %d", kp->keylen));
6617c478bd9Sstevel@tonic-gate for (ap = kp->ap; ap != NULL; ap = ap->next) {
6627c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
6637c478bd9Sstevel@tonic-gate ("pk_clear3 alg: %d", ap->algtype));
6647c478bd9Sstevel@tonic-gate mutex_lock(&ap->mech.mech_lock);
6657c478bd9Sstevel@tonic-gate if ((mdp = ap->mech.mechdata) == NULL) {
6667c478bd9Sstevel@tonic-gate mutex_unlock(&ap->mech.mech_lock);
6677c478bd9Sstevel@tonic-gate continue;
6687c478bd9Sstevel@tonic-gate }
6697c478bd9Sstevel@tonic-gate cpp = mapuid2cache(uid, mdp);
6707c478bd9Sstevel@tonic-gate if (*cpp == NULL) {
6717c478bd9Sstevel@tonic-gate mutex_unlock(&ap->mech.mech_lock);
6727c478bd9Sstevel@tonic-gate continue;
6737c478bd9Sstevel@tonic-gate }
6747c478bd9Sstevel@tonic-gate cp = (*cpp)->next;
6757c478bd9Sstevel@tonic-gate freedisklist(*cpp);
6767c478bd9Sstevel@tonic-gate *cpp = cp;
6777c478bd9Sstevel@tonic-gate mutex_unlock(&ap->mech.mech_lock);
6787c478bd9Sstevel@tonic-gate }
6797c478bd9Sstevel@tonic-gate }
6807c478bd9Sstevel@tonic-gate /* XXX clear stuff out of the common key cache as well? */
6817c478bd9Sstevel@tonic-gate /* XXX return success only if something was removed? */
6827c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
6837c478bd9Sstevel@tonic-gate }
6847c478bd9Sstevel@tonic-gate
6857c478bd9Sstevel@tonic-gate /*
6867c478bd9Sstevel@tonic-gate * Set the modulus for all our Diffie-Hellman operations
6877c478bd9Sstevel@tonic-gate */
68849e7ca49Speteh int
setmodulus(modx)6897c478bd9Sstevel@tonic-gate setmodulus(modx)
6907c478bd9Sstevel@tonic-gate char *modx;
6917c478bd9Sstevel@tonic-gate {
6927c478bd9Sstevel@tonic-gate MODULUS = mp_xtom(modx);
6937c478bd9Sstevel@tonic-gate return (0);
6947c478bd9Sstevel@tonic-gate }
6957c478bd9Sstevel@tonic-gate
6967c478bd9Sstevel@tonic-gate /*
6977c478bd9Sstevel@tonic-gate * Encrypt the key using the public key associated with remote_name and the
6987c478bd9Sstevel@tonic-gate * secret key associated with uid.
6997c478bd9Sstevel@tonic-gate */
7007c478bd9Sstevel@tonic-gate keystatus
pk_encrypt(uid,remote_name,remote_key,key)7017c478bd9Sstevel@tonic-gate pk_encrypt(uid, remote_name, remote_key, key)
7027c478bd9Sstevel@tonic-gate uid_t uid;
7037c478bd9Sstevel@tonic-gate char *remote_name;
7047c478bd9Sstevel@tonic-gate netobj *remote_key;
7057c478bd9Sstevel@tonic-gate des_block *key;
7067c478bd9Sstevel@tonic-gate {
7077c478bd9Sstevel@tonic-gate return (pk_crypt(uid, remote_name, remote_key, key, DES_ENCRYPT));
7087c478bd9Sstevel@tonic-gate }
7097c478bd9Sstevel@tonic-gate
7107c478bd9Sstevel@tonic-gate /*
7117c478bd9Sstevel@tonic-gate * Encrypt the key using the public key associated with remote_name and the
7127c478bd9Sstevel@tonic-gate * secret key associated with uid using vers 3
7137c478bd9Sstevel@tonic-gate */
7147c478bd9Sstevel@tonic-gate keystatus
pk_encrypt3(uid_t uid,cryptkeyarg3 * arg,deskeyarray * key)7157c478bd9Sstevel@tonic-gate pk_encrypt3(
7167c478bd9Sstevel@tonic-gate uid_t uid,
7177c478bd9Sstevel@tonic-gate cryptkeyarg3 *arg,
7187c478bd9Sstevel@tonic-gate deskeyarray *key
7197c478bd9Sstevel@tonic-gate )
7207c478bd9Sstevel@tonic-gate {
7217c478bd9Sstevel@tonic-gate return (pk_crypt3(uid, arg, key, DES_ENCRYPT));
7227c478bd9Sstevel@tonic-gate }
7237c478bd9Sstevel@tonic-gate
7247c478bd9Sstevel@tonic-gate /*
7257c478bd9Sstevel@tonic-gate * Decrypt the key using the public key associated with remote_name and the
7267c478bd9Sstevel@tonic-gate * secret key associated with uid.
7277c478bd9Sstevel@tonic-gate */
7287c478bd9Sstevel@tonic-gate keystatus
pk_decrypt(uid,remote_name,remote_key,key)7297c478bd9Sstevel@tonic-gate pk_decrypt(uid, remote_name, remote_key, key)
7307c478bd9Sstevel@tonic-gate uid_t uid;
7317c478bd9Sstevel@tonic-gate char *remote_name;
7327c478bd9Sstevel@tonic-gate netobj *remote_key;
7337c478bd9Sstevel@tonic-gate des_block *key;
7347c478bd9Sstevel@tonic-gate {
7357c478bd9Sstevel@tonic-gate return (pk_crypt(uid, remote_name, remote_key, key, DES_DECRYPT));
7367c478bd9Sstevel@tonic-gate }
7377c478bd9Sstevel@tonic-gate
7387c478bd9Sstevel@tonic-gate /*
7397c478bd9Sstevel@tonic-gate * Decrypt the key using the public key associated with remote_name and the
7407c478bd9Sstevel@tonic-gate * secret key associated with uid using vers 3
7417c478bd9Sstevel@tonic-gate */
7427c478bd9Sstevel@tonic-gate keystatus
pk_decrypt3(uid_t uid,cryptkeyarg3 * arg,deskeyarray * key)7437c478bd9Sstevel@tonic-gate pk_decrypt3(
7447c478bd9Sstevel@tonic-gate uid_t uid,
7457c478bd9Sstevel@tonic-gate cryptkeyarg3 *arg,
7467c478bd9Sstevel@tonic-gate deskeyarray *key
7477c478bd9Sstevel@tonic-gate )
7487c478bd9Sstevel@tonic-gate {
7497c478bd9Sstevel@tonic-gate return (pk_crypt3(uid, arg, key, DES_DECRYPT));
7507c478bd9Sstevel@tonic-gate }
7517c478bd9Sstevel@tonic-gate
7527c478bd9Sstevel@tonic-gate /*
7537c478bd9Sstevel@tonic-gate * Key storage management
7547c478bd9Sstevel@tonic-gate */
7557c478bd9Sstevel@tonic-gate
7567c478bd9Sstevel@tonic-gate #define KEY_ONLY 0
7577c478bd9Sstevel@tonic-gate #define KEY_NAME 1
7587c478bd9Sstevel@tonic-gate struct secretkey_netname_list {
7597c478bd9Sstevel@tonic-gate uid_t uid;
7607c478bd9Sstevel@tonic-gate key_netstarg keynetdata;
7617c478bd9Sstevel@tonic-gate uchar_t sc_flag;
7627c478bd9Sstevel@tonic-gate struct secretkey_netname_list *next;
7637c478bd9Sstevel@tonic-gate };
7647c478bd9Sstevel@tonic-gate
7657c478bd9Sstevel@tonic-gate #define HASH_UID(x) (x & 0xff)
7667c478bd9Sstevel@tonic-gate static struct secretkey_netname_list *g_secretkey_netname[KEY_HASH_SIZE];
7677c478bd9Sstevel@tonic-gate static rwlock_t g_secretkey_netname_lock = DEFAULTRWLOCK;
7687c478bd9Sstevel@tonic-gate
7697c478bd9Sstevel@tonic-gate /*
7707c478bd9Sstevel@tonic-gate * Store the keys and netname for this uid
7717c478bd9Sstevel@tonic-gate */
7727c478bd9Sstevel@tonic-gate static int
store_netname(uid,netstore)7737c478bd9Sstevel@tonic-gate store_netname(uid, netstore)
7747c478bd9Sstevel@tonic-gate uid_t uid;
7757c478bd9Sstevel@tonic-gate key_netstarg *netstore;
7767c478bd9Sstevel@tonic-gate {
7777c478bd9Sstevel@tonic-gate struct secretkey_netname_list *new;
7787c478bd9Sstevel@tonic-gate struct secretkey_netname_list **l;
7797c478bd9Sstevel@tonic-gate int hash = HASH_UID(uid);
7807c478bd9Sstevel@tonic-gate
7817c478bd9Sstevel@tonic-gate (void) rw_wrlock(&g_secretkey_netname_lock);
7827c478bd9Sstevel@tonic-gate for (l = &g_secretkey_netname[hash]; *l != NULL && (*l)->uid != uid;
7837c478bd9Sstevel@tonic-gate l = &(*l)->next) {
7847c478bd9Sstevel@tonic-gate }
7857c478bd9Sstevel@tonic-gate if (*l == NULL) {
7867c478bd9Sstevel@tonic-gate /* LINTED pointer alignment */
7877c478bd9Sstevel@tonic-gate new = (struct secretkey_netname_list *)malloc(sizeof (*new));
7887c478bd9Sstevel@tonic-gate if (new == NULL) {
7897c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
7907c478bd9Sstevel@tonic-gate return (0);
7917c478bd9Sstevel@tonic-gate }
7927c478bd9Sstevel@tonic-gate new->uid = uid;
7937c478bd9Sstevel@tonic-gate new->next = NULL;
7947c478bd9Sstevel@tonic-gate *l = new;
7957c478bd9Sstevel@tonic-gate } else {
7967c478bd9Sstevel@tonic-gate new = *l;
7977c478bd9Sstevel@tonic-gate if (new->keynetdata.st_netname)
7987c478bd9Sstevel@tonic-gate (void) free(new->keynetdata.st_netname);
7997c478bd9Sstevel@tonic-gate }
8007c478bd9Sstevel@tonic-gate memcpy(new->keynetdata.st_priv_key, netstore->st_priv_key,
8017c478bd9Sstevel@tonic-gate HEXKEYBYTES);
8027c478bd9Sstevel@tonic-gate memcpy(new->keynetdata.st_pub_key, netstore->st_pub_key, HEXKEYBYTES);
8037c478bd9Sstevel@tonic-gate
8047c478bd9Sstevel@tonic-gate if (netstore->st_netname)
8057c478bd9Sstevel@tonic-gate new->keynetdata.st_netname = strdup(netstore->st_netname);
8067c478bd9Sstevel@tonic-gate else
8077c478bd9Sstevel@tonic-gate new->keynetdata.st_netname = (char *)NULL;
8087c478bd9Sstevel@tonic-gate new->sc_flag = KEY_NAME;
8097c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
8107c478bd9Sstevel@tonic-gate return (1);
8117c478bd9Sstevel@tonic-gate
8127c478bd9Sstevel@tonic-gate }
8137c478bd9Sstevel@tonic-gate
8147c478bd9Sstevel@tonic-gate static int
appendnetname3(struct mechentry * mp,uid_t uid,key_netstarg3 * net)8157c478bd9Sstevel@tonic-gate appendnetname3(struct mechentry *mp, uid_t uid, key_netstarg3 *net)
8167c478bd9Sstevel@tonic-gate {
8177c478bd9Sstevel@tonic-gate struct mechdata *mdp;
8187c478bd9Sstevel@tonic-gate struct cacheuid_list **cpp, *cp;
8197c478bd9Sstevel@tonic-gate
8207c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("appendnetname3 %x", mp));
8217c478bd9Sstevel@tonic-gate if ((mp == NULL) || (net == NULL)) {
8227c478bd9Sstevel@tonic-gate return (0);
8237c478bd9Sstevel@tonic-gate }
8247c478bd9Sstevel@tonic-gate mutex_lock(&mp->mech_lock);
8257c478bd9Sstevel@tonic-gate if ((mdp = mp->mechdata) == NULL) {
8267c478bd9Sstevel@tonic-gate mdp = (struct mechdata *)calloc(1, sizeof (*mdp));
8277c478bd9Sstevel@tonic-gate if (mdp == NULL) {
8287c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
8297c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO, ("appendnetname3 : calloc failed"));
8307c478bd9Sstevel@tonic-gate return (0);
8317c478bd9Sstevel@tonic-gate }
8327c478bd9Sstevel@tonic-gate mp->mechdata = mdp;
8337c478bd9Sstevel@tonic-gate }
8347c478bd9Sstevel@tonic-gate cpp = mapuid2cache(uid, mdp);
8357c478bd9Sstevel@tonic-gate if (*cpp == NULL) {
8367c478bd9Sstevel@tonic-gate cp = (struct cacheuid_list *)malloc(sizeof (*cp));
8377c478bd9Sstevel@tonic-gate if (cp == NULL) {
8387c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
8397c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO, ("appendnetname3 : malloc failed"));
8407c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "file %s line %d: malloc failed",
8417c478bd9Sstevel@tonic-gate __FILE__, __LINE__);
8427c478bd9Sstevel@tonic-gate return (0);
8437c478bd9Sstevel@tonic-gate }
8447c478bd9Sstevel@tonic-gate memset(cp, 0, sizeof (*cp));
8457c478bd9Sstevel@tonic-gate cp->uid = uid;
8467c478bd9Sstevel@tonic-gate *cpp = cp;
8477c478bd9Sstevel@tonic-gate } else {
8487c478bd9Sstevel@tonic-gate cp = *cpp;
8497c478bd9Sstevel@tonic-gate }
8507c478bd9Sstevel@tonic-gate freekeybuf3(cp->secretkey);
8517c478bd9Sstevel@tonic-gate if ((cp->secretkey = cpykeybuf3(&net->st_priv_key)) == NULL) {
8527c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
8537c478bd9Sstevel@tonic-gate return (0);
8547c478bd9Sstevel@tonic-gate }
8557c478bd9Sstevel@tonic-gate freekeybuf3(cp->publickey);
8567c478bd9Sstevel@tonic-gate if ((cp->publickey = cpykeybuf3(&net->st_pub_key)) == NULL) {
8577c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
8587c478bd9Sstevel@tonic-gate return (0);
8597c478bd9Sstevel@tonic-gate }
8607c478bd9Sstevel@tonic-gate free(cp->netname);
8617c478bd9Sstevel@tonic-gate if (net->st_netname) {
8627c478bd9Sstevel@tonic-gate cp->netname = strdup(net->st_netname);
8637c478bd9Sstevel@tonic-gate } else {
8647c478bd9Sstevel@tonic-gate cp->netname = (char *)NULL;
8657c478bd9Sstevel@tonic-gate }
8667c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
8677c478bd9Sstevel@tonic-gate return (1);
8687c478bd9Sstevel@tonic-gate }
8697c478bd9Sstevel@tonic-gate
8707c478bd9Sstevel@tonic-gate keystatus
pk_netput(uid,netstore)8717c478bd9Sstevel@tonic-gate pk_netput(uid, netstore)
8727c478bd9Sstevel@tonic-gate uid_t uid;
8737c478bd9Sstevel@tonic-gate key_netstarg *netstore;
8747c478bd9Sstevel@tonic-gate {
8757c478bd9Sstevel@tonic-gate
8767c478bd9Sstevel@tonic-gate if (!store_netname(uid, netstore)) {
8777c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
8787c478bd9Sstevel@tonic-gate }
8797c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
8807c478bd9Sstevel@tonic-gate }
8817c478bd9Sstevel@tonic-gate
8827c478bd9Sstevel@tonic-gate /*
8837c478bd9Sstevel@tonic-gate * Store the keys and netname for this uid vers 3
8847c478bd9Sstevel@tonic-gate */
8857c478bd9Sstevel@tonic-gate static int
store_netname3(uid_t uid,key_netstarg3 * net)8867c478bd9Sstevel@tonic-gate store_netname3(uid_t uid, key_netstarg3 *net)
8877c478bd9Sstevel@tonic-gate {
8887c478bd9Sstevel@tonic-gate struct mechentry *mp;
8897c478bd9Sstevel@tonic-gate key_netstarg netstore;
8907c478bd9Sstevel@tonic-gate
8917c478bd9Sstevel@tonic-gate if (net == NULL) {
8927c478bd9Sstevel@tonic-gate return (0);
8937c478bd9Sstevel@tonic-gate }
8947c478bd9Sstevel@tonic-gate if ((mp = getmechtype(net->keylen, net->algtype)) == NULL) {
8957c478bd9Sstevel@tonic-gate return (0);
8967c478bd9Sstevel@tonic-gate }
8977c478bd9Sstevel@tonic-gate if (uid == 0 && CLASSIC_PK_DH(net->keylen, net->algtype)) {
8987c478bd9Sstevel@tonic-gate memcpy(netstore.st_priv_key, net->st_priv_key.keybuf3_val,
8997c478bd9Sstevel@tonic-gate HEXKEYBYTES);
9007c478bd9Sstevel@tonic-gate memset(netstore.st_pub_key, 0, HEXKEYBYTES);
9017c478bd9Sstevel@tonic-gate netstore.st_netname = net->st_netname;
9027c478bd9Sstevel@tonic-gate if (pk_netput(uid, &netstore) != KEY_SUCCESS) {
9037c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
9047c478bd9Sstevel@tonic-gate "keyserv: could not set root's key and netname.\n");
9057c478bd9Sstevel@tonic-gate return (0);
9067c478bd9Sstevel@tonic-gate }
9077c478bd9Sstevel@tonic-gate }
9087c478bd9Sstevel@tonic-gate return (appendnetname3(mp, uid, net));
9097c478bd9Sstevel@tonic-gate }
9107c478bd9Sstevel@tonic-gate
9117c478bd9Sstevel@tonic-gate keystatus
pk_netput3(uid_t uid,key_netstarg3 * netstore)9127c478bd9Sstevel@tonic-gate pk_netput3(uid_t uid, key_netstarg3 *netstore)
9137c478bd9Sstevel@tonic-gate {
9147c478bd9Sstevel@tonic-gate
9157c478bd9Sstevel@tonic-gate if (!store_netname3(uid, netstore)) {
9167c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
9177c478bd9Sstevel@tonic-gate }
9187c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
9197c478bd9Sstevel@tonic-gate }
9207c478bd9Sstevel@tonic-gate
9217c478bd9Sstevel@tonic-gate int
addmasterkey(char * master,char * netname,algtype_t algtype)9227c478bd9Sstevel@tonic-gate addmasterkey(char *master, char *netname, algtype_t algtype)
9237c478bd9Sstevel@tonic-gate {
9247c478bd9Sstevel@tonic-gate keybuf3 *secret, *public;
9257c478bd9Sstevel@tonic-gate int bytelen = strlen(master);
9267c478bd9Sstevel@tonic-gate keylen_t keylen = bytelen*4;
9277c478bd9Sstevel@tonic-gate key_netstarg3 tmp;
9287c478bd9Sstevel@tonic-gate
9297c478bd9Sstevel@tonic-gate if ((secret = setkeybuf3(master, bytelen)) == NULL) {
9307c478bd9Sstevel@tonic-gate return (0);
9317c478bd9Sstevel@tonic-gate }
9327c478bd9Sstevel@tonic-gate if ((public = getkeybuf3(bytelen+1)) == NULL) {
9337c478bd9Sstevel@tonic-gate /* the +1 is mandated by getpublickey_g() */
9347c478bd9Sstevel@tonic-gate return (0);
9357c478bd9Sstevel@tonic-gate }
9367c478bd9Sstevel@tonic-gate /*
9377c478bd9Sstevel@tonic-gate * getpublickey_g(netname, keylen, algtype,
9387c478bd9Sstevel@tonic-gate * public->keybuf3_val, public->keybuf3_len);
9397c478bd9Sstevel@tonic-gate * cannot be called since rpc.nisd is not up yet
9407c478bd9Sstevel@tonic-gate * so we continue to return a zero filled public key
9417c478bd9Sstevel@tonic-gate * as in the earlier version
9427c478bd9Sstevel@tonic-gate */
9437c478bd9Sstevel@tonic-gate memset(public->keybuf3_val, 0, bytelen+1);
9447c478bd9Sstevel@tonic-gate tmp.st_priv_key = *secret;
9457c478bd9Sstevel@tonic-gate free(secret);
9467c478bd9Sstevel@tonic-gate tmp.st_pub_key = *public;
9477c478bd9Sstevel@tonic-gate free(public);
9487c478bd9Sstevel@tonic-gate tmp.st_netname = strdup(netname);
9497c478bd9Sstevel@tonic-gate tmp.keylen = keylen;
9507c478bd9Sstevel@tonic-gate tmp.algtype = algtype;
9517c478bd9Sstevel@tonic-gate return (store_netname3(0, &tmp));
9527c478bd9Sstevel@tonic-gate }
9537c478bd9Sstevel@tonic-gate
9547c478bd9Sstevel@tonic-gate /*
9557c478bd9Sstevel@tonic-gate * Fetch the keys and netname for this uid
9567c478bd9Sstevel@tonic-gate */
9577c478bd9Sstevel@tonic-gate static int
fetch_netname(uid,key_netst)9587c478bd9Sstevel@tonic-gate fetch_netname(uid, key_netst)
9597c478bd9Sstevel@tonic-gate uid_t uid;
9607c478bd9Sstevel@tonic-gate struct key_netstarg *key_netst;
9617c478bd9Sstevel@tonic-gate {
9627c478bd9Sstevel@tonic-gate struct secretkey_netname_list *l;
9637c478bd9Sstevel@tonic-gate int hash = HASH_UID(uid);
9647c478bd9Sstevel@tonic-gate
9657c478bd9Sstevel@tonic-gate (void) rw_rdlock(&g_secretkey_netname_lock);
9667c478bd9Sstevel@tonic-gate for (l = g_secretkey_netname[hash]; l != NULL; l = l->next) {
9677c478bd9Sstevel@tonic-gate if ((l->uid == uid) && (l->sc_flag == KEY_NAME)) {
9687c478bd9Sstevel@tonic-gate
9697c478bd9Sstevel@tonic-gate memcpy(key_netst->st_priv_key,
9707c478bd9Sstevel@tonic-gate l->keynetdata.st_priv_key, HEXKEYBYTES);
9717c478bd9Sstevel@tonic-gate
9727c478bd9Sstevel@tonic-gate memcpy(key_netst->st_pub_key,
9737c478bd9Sstevel@tonic-gate l->keynetdata.st_pub_key, HEXKEYBYTES);
9747c478bd9Sstevel@tonic-gate
9757c478bd9Sstevel@tonic-gate if (l->keynetdata.st_netname)
9767c478bd9Sstevel@tonic-gate strcpy(key_netst->st_netname,
9777c478bd9Sstevel@tonic-gate l->keynetdata.st_netname);
9787c478bd9Sstevel@tonic-gate else
9797c478bd9Sstevel@tonic-gate key_netst->st_netname = NULL;
9807c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
9817c478bd9Sstevel@tonic-gate return (1);
9827c478bd9Sstevel@tonic-gate }
9837c478bd9Sstevel@tonic-gate }
9847c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
9857c478bd9Sstevel@tonic-gate return (0);
9867c478bd9Sstevel@tonic-gate }
9877c478bd9Sstevel@tonic-gate
9887c478bd9Sstevel@tonic-gate static void
remove_ref(struct cacheuid_list * cp)9897c478bd9Sstevel@tonic-gate remove_ref(struct cacheuid_list *cp)
9907c478bd9Sstevel@tonic-gate {
9917c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("remove_ref %x", cp));
9927c478bd9Sstevel@tonic-gate /*
9937c478bd9Sstevel@tonic-gate * XXX
9947c478bd9Sstevel@tonic-gate * if we are going to do this along the lines of vn_rele,
9957c478bd9Sstevel@tonic-gate * more stuff needs to be done here and the access to refcnt
9967c478bd9Sstevel@tonic-gate * needs to be mutex locked. Keep it simple for now.
9977c478bd9Sstevel@tonic-gate */
9987c478bd9Sstevel@tonic-gate cp->refcnt--;
9997c478bd9Sstevel@tonic-gate }
10007c478bd9Sstevel@tonic-gate
10017c478bd9Sstevel@tonic-gate static void
add_ref(struct cacheuid_list ** cpp)10027c478bd9Sstevel@tonic-gate add_ref(struct cacheuid_list **cpp)
10037c478bd9Sstevel@tonic-gate {
10047c478bd9Sstevel@tonic-gate struct cacheuid_list *cp;
10057c478bd9Sstevel@tonic-gate
10067c478bd9Sstevel@tonic-gate if (cpp == NULL) {
10077c478bd9Sstevel@tonic-gate return;
10087c478bd9Sstevel@tonic-gate }
10097c478bd9Sstevel@tonic-gate /*LINTED assignment operator "=" found where "==" was expected*/
10107c478bd9Sstevel@tonic-gate if (cp = *cpp) {
10117c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("add_ref %x", cp));
10127c478bd9Sstevel@tonic-gate cp->refcnt++;
10137c478bd9Sstevel@tonic-gate }
10147c478bd9Sstevel@tonic-gate }
10157c478bd9Sstevel@tonic-gate
10167c478bd9Sstevel@tonic-gate static struct cacheuid_list *
getcachekey3(uid_t uid,struct mechentry * mp)10177c478bd9Sstevel@tonic-gate getcachekey3(uid_t uid, struct mechentry *mp)
10187c478bd9Sstevel@tonic-gate {
10197c478bd9Sstevel@tonic-gate struct cacheuid_list **cpp, *cp;
10207c478bd9Sstevel@tonic-gate struct mechdata *mdp;
10217c478bd9Sstevel@tonic-gate
10227c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("getcachekey3 %d %x", uid, mp));
10237c478bd9Sstevel@tonic-gate if (mp == NULL) {
10247c478bd9Sstevel@tonic-gate return (0);
10257c478bd9Sstevel@tonic-gate }
10267c478bd9Sstevel@tonic-gate mutex_lock(&mp->mech_lock);
10277c478bd9Sstevel@tonic-gate if ((mdp = mp->mechdata) == NULL) {
10287c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
10297c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getcachekey3 ret 0"));
10307c478bd9Sstevel@tonic-gate return (0);
10317c478bd9Sstevel@tonic-gate }
10327c478bd9Sstevel@tonic-gate cpp = mapuid2cache(uid, mdp);
10337c478bd9Sstevel@tonic-gate cp = *cpp;
10347c478bd9Sstevel@tonic-gate add_ref(cpp);
10357c478bd9Sstevel@tonic-gate mutex_unlock(&mp->mech_lock);
10367c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getcachekey3 ret %x", *cpp));
10377c478bd9Sstevel@tonic-gate return (cp);
10387c478bd9Sstevel@tonic-gate }
10397c478bd9Sstevel@tonic-gate
10407c478bd9Sstevel@tonic-gate /*
10417c478bd9Sstevel@tonic-gate * Fetch any available cache for this uid (vers 3)
10427c478bd9Sstevel@tonic-gate */
10437c478bd9Sstevel@tonic-gate static struct cacheuid_list *
getanycache3(uid_t uid)10447c478bd9Sstevel@tonic-gate getanycache3(uid_t uid)
10457c478bd9Sstevel@tonic-gate {
10467c478bd9Sstevel@tonic-gate struct keylenlist *kp;
10477c478bd9Sstevel@tonic-gate struct algtypelist *ap;
10487c478bd9Sstevel@tonic-gate struct mechdata *mdp;
10497c478bd9Sstevel@tonic-gate struct cacheuid_list **cpp, *cp;
10507c478bd9Sstevel@tonic-gate
10517c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getanycache3 %d", uid));
10527c478bd9Sstevel@tonic-gate for (kp = mechtable.kp; kp != NULL; kp = kp->next) {
10537c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("getanycache3 key %d", kp->keylen));
10547c478bd9Sstevel@tonic-gate for (ap = kp->ap; ap != NULL; ap = ap->next) {
10557c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
10567c478bd9Sstevel@tonic-gate ("getanycache3 alg: %d", ap->algtype));
10577c478bd9Sstevel@tonic-gate mutex_lock(&ap->mech.mech_lock);
10587c478bd9Sstevel@tonic-gate if ((mdp = ap->mech.mechdata) == NULL) {
10597c478bd9Sstevel@tonic-gate mutex_unlock(&ap->mech.mech_lock);
10607c478bd9Sstevel@tonic-gate continue;
10617c478bd9Sstevel@tonic-gate }
10627c478bd9Sstevel@tonic-gate cpp = mapuid2cache(uid, mdp);
10637c478bd9Sstevel@tonic-gate if (*cpp == NULL) {
10647c478bd9Sstevel@tonic-gate mutex_unlock(&ap->mech.mech_lock);
10657c478bd9Sstevel@tonic-gate continue;
10667c478bd9Sstevel@tonic-gate }
10677c478bd9Sstevel@tonic-gate cp = *cpp;
10687c478bd9Sstevel@tonic-gate cp->refcnt++;
10697c478bd9Sstevel@tonic-gate mutex_unlock(&ap->mech.mech_lock);
10707c478bd9Sstevel@tonic-gate return (cp);
10717c478bd9Sstevel@tonic-gate }
10727c478bd9Sstevel@tonic-gate }
10737c478bd9Sstevel@tonic-gate return (NULL);
10747c478bd9Sstevel@tonic-gate }
10757c478bd9Sstevel@tonic-gate
10767c478bd9Sstevel@tonic-gate static struct cacheuid_list *
fetchcache3(uid_t uid,keylen_t k,algtype_t a)10777c478bd9Sstevel@tonic-gate fetchcache3(uid_t uid, keylen_t k, algtype_t a)
10787c478bd9Sstevel@tonic-gate {
10797c478bd9Sstevel@tonic-gate struct mechentry *mp;
10807c478bd9Sstevel@tonic-gate struct cacheuid_list *cp;
10817c478bd9Sstevel@tonic-gate
10827c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetchcache3 %d %d %d", uid, k, a));
10837c478bd9Sstevel@tonic-gate if ((mp = getmechtype(k, a)) == NULL) {
10847c478bd9Sstevel@tonic-gate return (NULL);
10857c478bd9Sstevel@tonic-gate }
10867c478bd9Sstevel@tonic-gate if ((cp = getcachekey3(uid, mp)) == NULL) {
10877c478bd9Sstevel@tonic-gate return (NULL);
10887c478bd9Sstevel@tonic-gate }
10897c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetchcache3 ret %x", cp));
10907c478bd9Sstevel@tonic-gate return (cp);
10917c478bd9Sstevel@tonic-gate }
10927c478bd9Sstevel@tonic-gate
10937c478bd9Sstevel@tonic-gate /*
10947c478bd9Sstevel@tonic-gate * Fetch the keys and netname for this uid vers 3
10957c478bd9Sstevel@tonic-gate */
10967c478bd9Sstevel@tonic-gate static int
fetch_netname3(uid_t uid,mechtype * net,key_netstarg3 * ret)10977c478bd9Sstevel@tonic-gate fetch_netname3(uid_t uid, mechtype *net, key_netstarg3 *ret)
10987c478bd9Sstevel@tonic-gate {
10997c478bd9Sstevel@tonic-gate struct cacheuid_list *cp;
11007c478bd9Sstevel@tonic-gate
11017c478bd9Sstevel@tonic-gate if ((net == NULL) || (ret == NULL)) {
11027c478bd9Sstevel@tonic-gate return (0);
11037c478bd9Sstevel@tonic-gate }
11047c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetch_netname3 %d %d %d",
11057c478bd9Sstevel@tonic-gate uid, net->keylen, net->algtype));
11067c478bd9Sstevel@tonic-gate if (net->keylen == 0) {
11077c478bd9Sstevel@tonic-gate cp = getanycache3(uid);
11087c478bd9Sstevel@tonic-gate } else {
11097c478bd9Sstevel@tonic-gate cp = fetchcache3(uid, net->keylen, net->algtype);
11107c478bd9Sstevel@tonic-gate }
11117c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetch_netname3 cp %x", cp));
11127c478bd9Sstevel@tonic-gate if (cp == NULL) {
11137c478bd9Sstevel@tonic-gate return (0);
11147c478bd9Sstevel@tonic-gate }
11157c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetch_netname3 sec %x", cp->secretkey));
11167c478bd9Sstevel@tonic-gate if (!storekeybuf3(&ret->st_priv_key, cp->secretkey)) {
11177c478bd9Sstevel@tonic-gate return (0);
11187c478bd9Sstevel@tonic-gate }
11197c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetch_netname3 pub %x", cp->publickey));
11207c478bd9Sstevel@tonic-gate if (!storekeybuf3(&ret->st_pub_key, cp->publickey)) {
11217c478bd9Sstevel@tonic-gate return (0);
11227c478bd9Sstevel@tonic-gate }
11237c478bd9Sstevel@tonic-gate if (cp->netname) {
11247c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetch_netname3 net %s", cp->netname));
11257c478bd9Sstevel@tonic-gate ret->st_netname = strdup(cp->netname);
11267c478bd9Sstevel@tonic-gate } else {
11277c478bd9Sstevel@tonic-gate ret->st_netname = NULL;
11287c478bd9Sstevel@tonic-gate }
11297c478bd9Sstevel@tonic-gate remove_ref(cp);
11307c478bd9Sstevel@tonic-gate return (1);
11317c478bd9Sstevel@tonic-gate }
11327c478bd9Sstevel@tonic-gate
11337c478bd9Sstevel@tonic-gate keystatus
pk_netget(uid,netstore)11347c478bd9Sstevel@tonic-gate pk_netget(uid, netstore)
11357c478bd9Sstevel@tonic-gate uid_t uid;
11367c478bd9Sstevel@tonic-gate key_netstarg *netstore;
11377c478bd9Sstevel@tonic-gate {
11387c478bd9Sstevel@tonic-gate if (!fetch_netname(uid, netstore)) {
11397c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
11407c478bd9Sstevel@tonic-gate }
11417c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
11427c478bd9Sstevel@tonic-gate }
11437c478bd9Sstevel@tonic-gate
11447c478bd9Sstevel@tonic-gate keystatus
pk_netget3(uid_t uid,mechtype * net,key_netstarg3 * ret)11457c478bd9Sstevel@tonic-gate pk_netget3(uid_t uid, mechtype *net, key_netstarg3 *ret)
11467c478bd9Sstevel@tonic-gate {
11477c478bd9Sstevel@tonic-gate if (!fetch_netname3(uid, net, ret)) {
11487c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
11497c478bd9Sstevel@tonic-gate }
11507c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
11517c478bd9Sstevel@tonic-gate }
11527c478bd9Sstevel@tonic-gate
11537c478bd9Sstevel@tonic-gate #define cachehit(pub, sec, list) \
11547c478bd9Sstevel@tonic-gate (memcmp(pub, (list)->public, sizeof (keybuf)) == 0 && \
11557c478bd9Sstevel@tonic-gate memcmp(sec, (list)->secret, sizeof (keybuf)) == 0)
11567c478bd9Sstevel@tonic-gate
11577c478bd9Sstevel@tonic-gate /*
11587c478bd9Sstevel@tonic-gate * Try to find the common key in the cache
11597c478bd9Sstevel@tonic-gate */
116049e7ca49Speteh static int
readcache(pub,sec,deskey,hash)11617c478bd9Sstevel@tonic-gate readcache(pub, sec, deskey, hash)
11627c478bd9Sstevel@tonic-gate char *pub;
11637c478bd9Sstevel@tonic-gate char *sec;
11647c478bd9Sstevel@tonic-gate des_block *deskey;
11657c478bd9Sstevel@tonic-gate int hash;
11667c478bd9Sstevel@tonic-gate {
11677c478bd9Sstevel@tonic-gate register struct cachekey_list **l;
11687c478bd9Sstevel@tonic-gate
11697c478bd9Sstevel@tonic-gate for (l = &g_cachedkeys[hash]; (*l) != NULL && !cachehit(pub, sec, *l);
11707c478bd9Sstevel@tonic-gate l = &(*l)->next)
11717c478bd9Sstevel@tonic-gate ;
11727c478bd9Sstevel@tonic-gate if ((*l) == NULL)
11737c478bd9Sstevel@tonic-gate return (0);
11747c478bd9Sstevel@tonic-gate *deskey = (*l)->deskey;
11757c478bd9Sstevel@tonic-gate return (1);
11767c478bd9Sstevel@tonic-gate }
11777c478bd9Sstevel@tonic-gate
11787c478bd9Sstevel@tonic-gate /*
11797c478bd9Sstevel@tonic-gate * cache result of expensive multiple precision exponential operation
11807c478bd9Sstevel@tonic-gate */
118149e7ca49Speteh static int
writecache(pub,sec,deskey,hash)11827c478bd9Sstevel@tonic-gate writecache(pub, sec, deskey, hash)
11837c478bd9Sstevel@tonic-gate char *pub;
11847c478bd9Sstevel@tonic-gate char *sec;
11857c478bd9Sstevel@tonic-gate des_block *deskey;
11867c478bd9Sstevel@tonic-gate int hash;
11877c478bd9Sstevel@tonic-gate {
11887c478bd9Sstevel@tonic-gate struct cachekey_list *new;
11897c478bd9Sstevel@tonic-gate
11907c478bd9Sstevel@tonic-gate new = (struct cachekey_list *)malloc(sizeof (struct cachekey_list));
11917c478bd9Sstevel@tonic-gate if (new == NULL) {
11927c478bd9Sstevel@tonic-gate return (0);
11937c478bd9Sstevel@tonic-gate }
11947c478bd9Sstevel@tonic-gate memcpy(new->public, pub, sizeof (keybuf));
11957c478bd9Sstevel@tonic-gate memcpy(new->secret, sec, sizeof (keybuf));
11967c478bd9Sstevel@tonic-gate new->deskey = *deskey;
11977c478bd9Sstevel@tonic-gate
11987c478bd9Sstevel@tonic-gate new->next = g_cachedkeys[hash];
11997c478bd9Sstevel@tonic-gate g_cachedkeys[hash] = new;
12007c478bd9Sstevel@tonic-gate return (1);
12017c478bd9Sstevel@tonic-gate }
12027c478bd9Sstevel@tonic-gate
12037c478bd9Sstevel@tonic-gate /*
12047c478bd9Sstevel@tonic-gate * Choose middle 64 bits of the common key to use as our des key, possibly
12057c478bd9Sstevel@tonic-gate * overwriting the lower order bits by setting parity.
12067c478bd9Sstevel@tonic-gate */
120749e7ca49Speteh static int
extractdeskey(ck,deskey)12087c478bd9Sstevel@tonic-gate extractdeskey(ck, deskey)
12097c478bd9Sstevel@tonic-gate MINT *ck;
12107c478bd9Sstevel@tonic-gate des_block *deskey;
12117c478bd9Sstevel@tonic-gate {
12127c478bd9Sstevel@tonic-gate void _mp_move(MINT *, MINT *);
12137c478bd9Sstevel@tonic-gate MINT *a;
12147c478bd9Sstevel@tonic-gate short r;
12157c478bd9Sstevel@tonic-gate int i;
12167c478bd9Sstevel@tonic-gate short base = (1 << 8);
12177c478bd9Sstevel@tonic-gate char *k;
12187c478bd9Sstevel@tonic-gate
12197c478bd9Sstevel@tonic-gate a = mp_itom(0);
12207c478bd9Sstevel@tonic-gate _mp_move(ck, a);
12217c478bd9Sstevel@tonic-gate for (i = 0; i < ((KEYSIZE - 64) / 2) / 8; i++) {
12227c478bd9Sstevel@tonic-gate mp_sdiv(a, base, a, &r);
12237c478bd9Sstevel@tonic-gate }
12247c478bd9Sstevel@tonic-gate k = deskey->c;
12257c478bd9Sstevel@tonic-gate for (i = 0; i < 8; i++) {
12267c478bd9Sstevel@tonic-gate mp_sdiv(a, base, a, &r);
12277c478bd9Sstevel@tonic-gate *k++ = r;
12287c478bd9Sstevel@tonic-gate }
12297c478bd9Sstevel@tonic-gate mp_mfree(a);
12307c478bd9Sstevel@tonic-gate des_setparity((char *)deskey);
12317c478bd9Sstevel@tonic-gate return (0);
12327c478bd9Sstevel@tonic-gate }
12337c478bd9Sstevel@tonic-gate
12347c478bd9Sstevel@tonic-gate static bool_t
fetchsecretkey(uid,buf)12357c478bd9Sstevel@tonic-gate fetchsecretkey(uid, buf)
12367c478bd9Sstevel@tonic-gate uid_t uid;
12377c478bd9Sstevel@tonic-gate char *buf;
12387c478bd9Sstevel@tonic-gate {
12397c478bd9Sstevel@tonic-gate struct secretkey_netname_list *l;
12407c478bd9Sstevel@tonic-gate int hash = HASH_UID(uid);
12417c478bd9Sstevel@tonic-gate
12427c478bd9Sstevel@tonic-gate (void) rw_rdlock(&g_secretkey_netname_lock);
12437c478bd9Sstevel@tonic-gate for (l = g_secretkey_netname[hash]; l != NULL; l = l->next) {
12447c478bd9Sstevel@tonic-gate if (l->uid == uid) {
12457c478bd9Sstevel@tonic-gate memcpy(buf, l->keynetdata.st_priv_key,
12467c478bd9Sstevel@tonic-gate sizeof (keybuf));
12477c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
12487c478bd9Sstevel@tonic-gate return (TRUE);
12497c478bd9Sstevel@tonic-gate }
12507c478bd9Sstevel@tonic-gate }
12517c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
12527c478bd9Sstevel@tonic-gate return (FALSE);
12537c478bd9Sstevel@tonic-gate }
12547c478bd9Sstevel@tonic-gate
12557c478bd9Sstevel@tonic-gate static keybuf3 *
fetchsecretkey3(uid_t uid,keylen_t k,algtype_t a)12567c478bd9Sstevel@tonic-gate fetchsecretkey3(uid_t uid, keylen_t k, algtype_t a)
12577c478bd9Sstevel@tonic-gate {
12587c478bd9Sstevel@tonic-gate struct cacheuid_list *cp;
12597c478bd9Sstevel@tonic-gate
12607c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetchsecretkey3 %d %d %d", uid, k, a));
12617c478bd9Sstevel@tonic-gate if ((cp = fetchcache3(uid, k, a)) == NULL) {
12627c478bd9Sstevel@tonic-gate return (NULL);
12637c478bd9Sstevel@tonic-gate }
12647c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("fetchsecretkey3 ret %x", cp->secretkey));
12657c478bd9Sstevel@tonic-gate return (cp->secretkey);
12667c478bd9Sstevel@tonic-gate }
12677c478bd9Sstevel@tonic-gate
12687c478bd9Sstevel@tonic-gate /*
12697c478bd9Sstevel@tonic-gate * Do the work of pk_encrypt && pk_decrypt
12707c478bd9Sstevel@tonic-gate */
12717c478bd9Sstevel@tonic-gate static keystatus
pk_crypt(uid,remote_name,remote_key,key,mode)12727c478bd9Sstevel@tonic-gate pk_crypt(uid, remote_name, remote_key, key, mode)
12737c478bd9Sstevel@tonic-gate uid_t uid;
12747c478bd9Sstevel@tonic-gate char *remote_name;
12757c478bd9Sstevel@tonic-gate netobj *remote_key;
12767c478bd9Sstevel@tonic-gate des_block *key;
12777c478bd9Sstevel@tonic-gate int mode;
12787c478bd9Sstevel@tonic-gate {
12797c478bd9Sstevel@tonic-gate char xsecret[1024];
12807c478bd9Sstevel@tonic-gate char xpublic[1024];
12817c478bd9Sstevel@tonic-gate des_block deskey;
12827c478bd9Sstevel@tonic-gate int err;
12837c478bd9Sstevel@tonic-gate MINT *public;
12847c478bd9Sstevel@tonic-gate MINT *secret;
12857c478bd9Sstevel@tonic-gate MINT *common;
12867c478bd9Sstevel@tonic-gate char zero[8];
12877c478bd9Sstevel@tonic-gate int hash;
12887c478bd9Sstevel@tonic-gate
12897c478bd9Sstevel@tonic-gate if (!fetchsecretkey(uid, xsecret) || xsecret[0] == 0) {
12907c478bd9Sstevel@tonic-gate memset(zero, 0, sizeof (zero));
12917c478bd9Sstevel@tonic-gate if (nodefaultkeys)
12927c478bd9Sstevel@tonic-gate return (KEY_NOSECRET);
12937c478bd9Sstevel@tonic-gate
12947c478bd9Sstevel@tonic-gate if (!getsecretkey("nobody", xsecret, zero) || xsecret[0] == 0) {
12957c478bd9Sstevel@tonic-gate return (KEY_NOSECRET);
12967c478bd9Sstevel@tonic-gate }
12977c478bd9Sstevel@tonic-gate }
12987c478bd9Sstevel@tonic-gate if (remote_key) {
12997c478bd9Sstevel@tonic-gate memcpy(xpublic, remote_key->n_bytes, remote_key->n_len);
13007c478bd9Sstevel@tonic-gate } else {
13017c478bd9Sstevel@tonic-gate if (!getpublickey(remote_name, xpublic)) {
13027c478bd9Sstevel@tonic-gate if (nodefaultkeys || !getpublickey("nobody", xpublic))
13037c478bd9Sstevel@tonic-gate return (KEY_UNKNOWN);
13047c478bd9Sstevel@tonic-gate }
13057c478bd9Sstevel@tonic-gate }
13067c478bd9Sstevel@tonic-gate
13077c478bd9Sstevel@tonic-gate xsecret[HEXKEYBYTES] = '\0';
13087c478bd9Sstevel@tonic-gate xpublic[HEXKEYBYTES] = '\0';
13097c478bd9Sstevel@tonic-gate
13107c478bd9Sstevel@tonic-gate hash = hash_keys(xpublic, xsecret);
13117c478bd9Sstevel@tonic-gate (void) rw_rdlock(&g_cachedkeys_lock);
13127c478bd9Sstevel@tonic-gate if (!readcache(xpublic, xsecret, &deskey, hash)) {
13137c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_cachedkeys_lock);
13147c478bd9Sstevel@tonic-gate (void) rw_wrlock(&g_cachedkeys_lock);
13157c478bd9Sstevel@tonic-gate if (!readcache(xpublic, xsecret, &deskey, hash)) {
13167c478bd9Sstevel@tonic-gate public = mp_xtom(xpublic);
13177c478bd9Sstevel@tonic-gate secret = mp_xtom(xsecret);
13187c478bd9Sstevel@tonic-gate /* Sanity Check on public and private keys */
13197c478bd9Sstevel@tonic-gate if (public == NULL || secret == NULL) {
13207c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_cachedkeys_lock);
13217c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
13227c478bd9Sstevel@tonic-gate }
13237c478bd9Sstevel@tonic-gate common = mp_itom(0);
13247c478bd9Sstevel@tonic-gate mp_pow(public, secret, MODULUS, common);
13257c478bd9Sstevel@tonic-gate extractdeskey(common, &deskey);
13267c478bd9Sstevel@tonic-gate writecache(xpublic, xsecret, &deskey, hash);
13277c478bd9Sstevel@tonic-gate mp_mfree(secret);
13287c478bd9Sstevel@tonic-gate mp_mfree(public);
13297c478bd9Sstevel@tonic-gate mp_mfree(common);
13307c478bd9Sstevel@tonic-gate }
13317c478bd9Sstevel@tonic-gate }
13327c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_cachedkeys_lock);
13337c478bd9Sstevel@tonic-gate
13347c478bd9Sstevel@tonic-gate err = ecb_crypt((char *)&deskey, (char *)key, sizeof (des_block),
13357c478bd9Sstevel@tonic-gate DES_HW | mode);
13367c478bd9Sstevel@tonic-gate if (DES_FAILED(err)) {
13377c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
13387c478bd9Sstevel@tonic-gate }
13397c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
13407c478bd9Sstevel@tonic-gate }
13417c478bd9Sstevel@tonic-gate
13427c478bd9Sstevel@tonic-gate static int
hash_keys3(keybuf3 * p,keybuf3 * s)13437c478bd9Sstevel@tonic-gate hash_keys3(keybuf3 *p, keybuf3 *s)
13447c478bd9Sstevel@tonic-gate {
13457c478bd9Sstevel@tonic-gate int i;
13467c478bd9Sstevel@tonic-gate int hash = 0;
13477c478bd9Sstevel@tonic-gate char *pub = p->keybuf3_val;
13487c478bd9Sstevel@tonic-gate char *sec = s->keybuf3_val;
13497c478bd9Sstevel@tonic-gate
13507c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("hash_keys3 public %d %s",
13517c478bd9Sstevel@tonic-gate p->keybuf3_len, pub));
13527c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("hash_keys3 secret %d %s",
13537c478bd9Sstevel@tonic-gate s->keybuf3_len, sec));
13547c478bd9Sstevel@tonic-gate for (i = 0; i < s->keybuf3_len; i += 6, pub += 6, sec += 6) {
13557c478bd9Sstevel@tonic-gate hash ^= *pub;
13567c478bd9Sstevel@tonic-gate hash ^= *sec;
13577c478bd9Sstevel@tonic-gate }
13587c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("hash_keys3 ret %d", hash & 0xff));
13597c478bd9Sstevel@tonic-gate return (hash & 0xff);
13607c478bd9Sstevel@tonic-gate }
13617c478bd9Sstevel@tonic-gate
13627c478bd9Sstevel@tonic-gate static struct cachekey3_list **
map_ps2cache(keybuf3 * public,keybuf3 * secret,struct psdata * pdp)13637c478bd9Sstevel@tonic-gate map_ps2cache(keybuf3 *public, keybuf3 *secret, struct psdata *pdp)
13647c478bd9Sstevel@tonic-gate {
13657c478bd9Sstevel@tonic-gate struct cachekey3_list **cpp;
13667c478bd9Sstevel@tonic-gate int hash = hash_keys3(public, secret);
13677c478bd9Sstevel@tonic-gate
13687c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("map_ps2cache %x %d", pdp, hash));
13697c478bd9Sstevel@tonic-gate for (cpp = &pdp->common[hash];
13707c478bd9Sstevel@tonic-gate *cpp != NULL && !(cachehit3(public, secret, *cpp));
13717c478bd9Sstevel@tonic-gate cpp = &(*cpp)->next) {
13727c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0, ("map_ps2cache %x", cpp));
13737c478bd9Sstevel@tonic-gate }
13747c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("map_ps2cache ret %x", cpp));
13757c478bd9Sstevel@tonic-gate return (cpp);
13767c478bd9Sstevel@tonic-gate }
13777c478bd9Sstevel@tonic-gate
13787c478bd9Sstevel@tonic-gate static struct cachekey3_list *
getdeskey3(keylen_t keylen,algtype_t algtype,int desarylen,keybuf3 * public,keybuf3 * secret,uid_t uid)13797c478bd9Sstevel@tonic-gate getdeskey3(
13807c478bd9Sstevel@tonic-gate keylen_t keylen,
13817c478bd9Sstevel@tonic-gate algtype_t algtype,
13827c478bd9Sstevel@tonic-gate int desarylen,
13837c478bd9Sstevel@tonic-gate keybuf3 *public,
13847c478bd9Sstevel@tonic-gate keybuf3 *secret,
13857c478bd9Sstevel@tonic-gate uid_t uid
13867c478bd9Sstevel@tonic-gate )
13877c478bd9Sstevel@tonic-gate {
13887c478bd9Sstevel@tonic-gate struct mechentry *mp;
13897c478bd9Sstevel@tonic-gate struct psdata *pdp;
13907c478bd9Sstevel@tonic-gate struct cachekey3_list **cpp, *cp, *cachep;
13917c478bd9Sstevel@tonic-gate struct cacheuid_list *cu;
13927c478bd9Sstevel@tonic-gate int i;
13937c478bd9Sstevel@tonic-gate int cached = 0;
13947c478bd9Sstevel@tonic-gate
13957c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getdeskey3 %d %d %d %x %x",
13967c478bd9Sstevel@tonic-gate keylen, algtype, desarylen, public, secret));
13977c478bd9Sstevel@tonic-gate if ((mp = getmechtype(keylen, algtype)) == NULL) {
13987c478bd9Sstevel@tonic-gate return (0);
13997c478bd9Sstevel@tonic-gate }
14007c478bd9Sstevel@tonic-gate (void) mutex_lock(&mp->ps_lock);
14017c478bd9Sstevel@tonic-gate if ((pdp = mp->psdata) == NULL) {
14027c478bd9Sstevel@tonic-gate if ((pdp = (struct psdata *)calloc(1, sizeof (*pdp))) ==
14037c478bd9Sstevel@tonic-gate NULL) {
14047c478bd9Sstevel@tonic-gate mutex_unlock(&mp->ps_lock);
14057c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO, ("getdeskey3 : calloc failed"));
14067c478bd9Sstevel@tonic-gate return (0);
14077c478bd9Sstevel@tonic-gate }
14087c478bd9Sstevel@tonic-gate mp->psdata = pdp;
14097c478bd9Sstevel@tonic-gate }
14107c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getdeskey3 %x", pdp));
14117c478bd9Sstevel@tonic-gate cpp = map_ps2cache(public, secret, pdp);
14127c478bd9Sstevel@tonic-gate if (*cpp == NULL) {
14137c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getdeskey3 calling fetchcache3"));
14147c478bd9Sstevel@tonic-gate if (disk_caching &&
14157c478bd9Sstevel@tonic-gate (cu = fetchcache3(uid, keylen, algtype)) != NULL) {
14167c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
14177c478bd9Sstevel@tonic-gate ("getdeskey3 calling cache_retrieve"));
14187c478bd9Sstevel@tonic-gate if ((cachep = cache_retrieve(keylen, algtype, uid,
14197c478bd9Sstevel@tonic-gate public, cu->key)) != NULL) {
14207c478bd9Sstevel@tonic-gate if (cmpkeybuf3(cachep->secret, cu->secretkey)) {
14217c478bd9Sstevel@tonic-gate cached = 1;
14227c478bd9Sstevel@tonic-gate } else {
14237c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
14247c478bd9Sstevel@tonic-gate ("getdeskey3 calling cache_remove"));
14257c478bd9Sstevel@tonic-gate cache_remove(keylen, algtype,
14267c478bd9Sstevel@tonic-gate uid, NULL);
14277c478bd9Sstevel@tonic-gate }
14287c478bd9Sstevel@tonic-gate }
14297c478bd9Sstevel@tonic-gate }
14307c478bd9Sstevel@tonic-gate if (cached) {
14317c478bd9Sstevel@tonic-gate cp = cachep;
14327c478bd9Sstevel@tonic-gate } else {
14337c478bd9Sstevel@tonic-gate if ((cp = (struct cachekey3_list *)
14347c478bd9Sstevel@tonic-gate malloc(sizeof (*cp))) == NULL) {
14357c478bd9Sstevel@tonic-gate mutex_unlock(&mp->ps_lock);
14367c478bd9Sstevel@tonic-gate debug(KEYSERV_INFO,
14377c478bd9Sstevel@tonic-gate ("getdeskey3 : malloc failed"));
14387c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
14397c478bd9Sstevel@tonic-gate "file %s line %d: malloc failed",
14407c478bd9Sstevel@tonic-gate __FILE__, __LINE__);
14417c478bd9Sstevel@tonic-gate return (0);
14427c478bd9Sstevel@tonic-gate }
14437c478bd9Sstevel@tonic-gate cp->refcnt = 0;
14447c478bd9Sstevel@tonic-gate cp->next = NULL;
14457c478bd9Sstevel@tonic-gate if ((cp->public = cpykeybuf3(public)) == NULL) {
14467c478bd9Sstevel@tonic-gate mutex_unlock(&mp->ps_lock);
14477c478bd9Sstevel@tonic-gate return (0);
14487c478bd9Sstevel@tonic-gate }
14497c478bd9Sstevel@tonic-gate if ((cp->secret = cpykeybuf3(secret)) == NULL) {
14507c478bd9Sstevel@tonic-gate mutex_unlock(&mp->ps_lock);
14517c478bd9Sstevel@tonic-gate return (0);
14527c478bd9Sstevel@tonic-gate }
14537c478bd9Sstevel@tonic-gate if (!setdeskeyarray(&cp->deskey, desarylen)) {
14547c478bd9Sstevel@tonic-gate mutex_unlock(&mp->ps_lock);
14557c478bd9Sstevel@tonic-gate return (0);
14567c478bd9Sstevel@tonic-gate }
14577c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getdeskey3 %x %x %x",
14587c478bd9Sstevel@tonic-gate cp->public, cp->secret,
14597c478bd9Sstevel@tonic-gate cp->deskey.deskeyarray_val));
14607c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
14617c478bd9Sstevel@tonic-gate ("getdeskey3 calling __gen_common_dhkeys_g"));
14627c478bd9Sstevel@tonic-gate if (!__gen_common_dhkeys_g(public->keybuf3_val,
14637c478bd9Sstevel@tonic-gate secret->keybuf3_val,
14647c478bd9Sstevel@tonic-gate keylen, algtype,
14657c478bd9Sstevel@tonic-gate cp->deskey.deskeyarray_val, desarylen)) {
14667c478bd9Sstevel@tonic-gate mutex_unlock(&mp->ps_lock);
14677c478bd9Sstevel@tonic-gate return (0);
14687c478bd9Sstevel@tonic-gate }
14697c478bd9Sstevel@tonic-gate for (i = 0; i < desarylen; i++) {
14707c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
14717c478bd9Sstevel@tonic-gate ("getdeskey3 gendh key : (%x,%x)",
14727c478bd9Sstevel@tonic-gate cp->deskey.deskeyarray_val[i].key.high,
14737c478bd9Sstevel@tonic-gate cp->deskey.deskeyarray_val[i].key.low));
14747c478bd9Sstevel@tonic-gate }
14757c478bd9Sstevel@tonic-gate if (disk_caching && cu != NULL) {
14767c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
14777c478bd9Sstevel@tonic-gate ("getdeskey3 calling cache_insert"));
14787c478bd9Sstevel@tonic-gate cache_insert(keylen, algtype, uid, cp->deskey,
14797c478bd9Sstevel@tonic-gate cu->key, public, secret);
14807c478bd9Sstevel@tonic-gate }
14817c478bd9Sstevel@tonic-gate }
14827c478bd9Sstevel@tonic-gate *cpp = cp;
14837c478bd9Sstevel@tonic-gate } else {
14847c478bd9Sstevel@tonic-gate cp = *cpp;
14857c478bd9Sstevel@tonic-gate }
14867c478bd9Sstevel@tonic-gate cp->refcnt++;
14877c478bd9Sstevel@tonic-gate mutex_unlock(&mp->ps_lock);
14887c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("getdeskey3 ret %x", cp));
14897c478bd9Sstevel@tonic-gate return (cp);
14907c478bd9Sstevel@tonic-gate }
14917c478bd9Sstevel@tonic-gate
14927c478bd9Sstevel@tonic-gate keystatus
pk_get_conv_key3(uid_t uid,deskeyarg3 * arg,cryptkeyres3 * res)14937c478bd9Sstevel@tonic-gate pk_get_conv_key3(uid_t uid, deskeyarg3 *arg, cryptkeyres3 *res)
14947c478bd9Sstevel@tonic-gate {
14957c478bd9Sstevel@tonic-gate keybuf3 *xsecret, *xpublic;
14967c478bd9Sstevel@tonic-gate char zero[8];
14977c478bd9Sstevel@tonic-gate struct cachekey3_list *cp;
14987c478bd9Sstevel@tonic-gate
14997c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG, ("pk_get_conv_key3 %d %x %x",
15007c478bd9Sstevel@tonic-gate uid, arg, res));
15017c478bd9Sstevel@tonic-gate if ((xsecret = fetchsecretkey3(uid,
15027c478bd9Sstevel@tonic-gate arg->keylen, arg->algtype)) == NULL) {
15037c478bd9Sstevel@tonic-gate if (nodefaultkeys)
15047c478bd9Sstevel@tonic-gate return (KEY_NOSECRET);
15057c478bd9Sstevel@tonic-gate memset(zero, 0, sizeof (zero));
15067c478bd9Sstevel@tonic-gate if ((xsecret = getkeybuf3(arg->keylen/4+1)) == NULL) {
15077c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
15087c478bd9Sstevel@tonic-gate }
15097c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
15107c478bd9Sstevel@tonic-gate ("pk_get_conv_key3 calling getsecretkey_g"));
15117c478bd9Sstevel@tonic-gate if (!getsecretkey_g("nobody",
15127c478bd9Sstevel@tonic-gate arg->keylen, arg->algtype,
15137c478bd9Sstevel@tonic-gate xsecret->keybuf3_val, xsecret->keybuf3_len,
15147c478bd9Sstevel@tonic-gate zero) || *xsecret->keybuf3_val == 0) { /* XXX */
15157c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
15167c478bd9Sstevel@tonic-gate ("pk_get_conv_key3 calling getsecretkey_g failed"));
15177c478bd9Sstevel@tonic-gate return (KEY_NOSECRET);
15187c478bd9Sstevel@tonic-gate }
15197c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
15207c478bd9Sstevel@tonic-gate ("pk_get_conv_key3 calling getsecretkey_g succeeded"));
15217c478bd9Sstevel@tonic-gate }
15227c478bd9Sstevel@tonic-gate xpublic = &arg->pub_key;
15237c478bd9Sstevel@tonic-gate if ((cp = getdeskey3(arg->keylen, arg->algtype, arg->nkeys,
15247c478bd9Sstevel@tonic-gate xpublic, xsecret, uid)) == NULL) {
15257c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
15267c478bd9Sstevel@tonic-gate }
15277c478bd9Sstevel@tonic-gate storedeskeyarray(&res->cryptkeyres3_u.deskey, &cp->deskey);
15287c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
15297c478bd9Sstevel@tonic-gate }
15307c478bd9Sstevel@tonic-gate
15317c478bd9Sstevel@tonic-gate /*
15327c478bd9Sstevel@tonic-gate * Do the work of pk_encrypt3 && pk_decrypt3
15337c478bd9Sstevel@tonic-gate */
15347c478bd9Sstevel@tonic-gate static keystatus
pk_crypt3(uid_t uid,cryptkeyarg3 * arg,deskeyarray * key,int mode)15357c478bd9Sstevel@tonic-gate pk_crypt3(
15367c478bd9Sstevel@tonic-gate uid_t uid,
15377c478bd9Sstevel@tonic-gate cryptkeyarg3 *arg,
15387c478bd9Sstevel@tonic-gate deskeyarray *key,
15397c478bd9Sstevel@tonic-gate int mode
15407c478bd9Sstevel@tonic-gate )
15417c478bd9Sstevel@tonic-gate {
15427c478bd9Sstevel@tonic-gate keybuf3 *xsecret = NULL, *xpublic = NULL;
15437c478bd9Sstevel@tonic-gate char zero[8];
15447c478bd9Sstevel@tonic-gate struct cachekey3_list *cp;
15457c478bd9Sstevel@tonic-gate int err;
15467c478bd9Sstevel@tonic-gate int xsecret_alloc = 0;
15477c478bd9Sstevel@tonic-gate char ivec[8];
15487c478bd9Sstevel@tonic-gate
15497c478bd9Sstevel@tonic-gate memset(ivec, 0, 8);
15507c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("pk_crypt3 %d %x %x %d",
15517c478bd9Sstevel@tonic-gate uid, arg, key, mode));
15527c478bd9Sstevel@tonic-gate if ((xsecret = fetchsecretkey3(uid,
15537c478bd9Sstevel@tonic-gate arg->keylen, arg->algtype)) == NULL) {
15547c478bd9Sstevel@tonic-gate if (nodefaultkeys)
15557c478bd9Sstevel@tonic-gate return (KEY_NOSECRET);
15567c478bd9Sstevel@tonic-gate memset(zero, 0, sizeof (zero));
15577c478bd9Sstevel@tonic-gate if ((xsecret = getkeybuf3(arg->keylen/4+1)) == NULL) {
15587c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
15597c478bd9Sstevel@tonic-gate }
15607c478bd9Sstevel@tonic-gate xsecret_alloc = 1;
15617c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("pk_crypt3 calling getsecretkey_g"));
15627c478bd9Sstevel@tonic-gate if (!getsecretkey_g("nobody",
15637c478bd9Sstevel@tonic-gate arg->keylen, arg->algtype,
15647c478bd9Sstevel@tonic-gate xsecret->keybuf3_val, xsecret->keybuf3_len,
15657c478bd9Sstevel@tonic-gate zero) || *xsecret->keybuf3_val == 0) { /* XXX */
15667c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
15677c478bd9Sstevel@tonic-gate ("pk_crypt3 calling getsecretkey_g failed"));
15687c478bd9Sstevel@tonic-gate freekeybuf3(xsecret);
15697c478bd9Sstevel@tonic-gate return (KEY_NOSECRET);
15707c478bd9Sstevel@tonic-gate }
15717c478bd9Sstevel@tonic-gate /* XXX optimize to cache nobody's secret key? */
15727c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
15737c478bd9Sstevel@tonic-gate ("pk_crypt3 calling getsecretkey_g succeeded"));
15747c478bd9Sstevel@tonic-gate }
15757c478bd9Sstevel@tonic-gate if (arg->remotekey.keybuf3_len) {
15767c478bd9Sstevel@tonic-gate if ((xpublic = cpykeybuf3(&arg->remotekey)) == NULL) {
15777c478bd9Sstevel@tonic-gate if (xsecret_alloc) freekeybuf3(xsecret);
15787c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
15797c478bd9Sstevel@tonic-gate }
15807c478bd9Sstevel@tonic-gate } else {
15817c478bd9Sstevel@tonic-gate if ((xpublic = getkeybuf3(arg->keylen/4+1)) == NULL) {
15827c478bd9Sstevel@tonic-gate if (xsecret_alloc) freekeybuf3(xsecret);
15837c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
15847c478bd9Sstevel@tonic-gate }
15857c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1, ("pk_crypt3 calling getpublickey_g"));
15867c478bd9Sstevel@tonic-gate if (!getpublickey_g(arg->remotename,
15877c478bd9Sstevel@tonic-gate arg->keylen, arg->algtype,
15887c478bd9Sstevel@tonic-gate xpublic->keybuf3_val, xpublic->keybuf3_len)) {
15897c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
15907c478bd9Sstevel@tonic-gate ("pk_crypt3 calling getpublickey_g nobody"));
15917c478bd9Sstevel@tonic-gate if (nodefaultkeys || !getpublickey_g("nobody",
15927c478bd9Sstevel@tonic-gate arg->keylen, arg->algtype,
15937c478bd9Sstevel@tonic-gate xpublic->keybuf3_val, xpublic->keybuf3_len)) {
15947c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
15957c478bd9Sstevel@tonic-gate ("pk_crypt3 calling getpublickey_g nobody failed"));
15967c478bd9Sstevel@tonic-gate if (xsecret_alloc) freekeybuf3(xsecret);
15977c478bd9Sstevel@tonic-gate freekeybuf3(xpublic);
15987c478bd9Sstevel@tonic-gate return (KEY_UNKNOWN);
15997c478bd9Sstevel@tonic-gate }
16007c478bd9Sstevel@tonic-gate }
16017c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG0,
16027c478bd9Sstevel@tonic-gate ("pk_crypt3 calling getpublickey_g succeeded"));
16037c478bd9Sstevel@tonic-gate }
16047c478bd9Sstevel@tonic-gate
16057c478bd9Sstevel@tonic-gate if ((cp = getdeskey3(arg->keylen, arg->algtype,
16067c478bd9Sstevel@tonic-gate arg->deskey.deskeyarray_len, xpublic, xsecret, uid)) == NULL) {
16077c478bd9Sstevel@tonic-gate if (xsecret_alloc) freekeybuf3(xsecret);
16087c478bd9Sstevel@tonic-gate freekeybuf3(xpublic);
16097c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
16107c478bd9Sstevel@tonic-gate }
16117c478bd9Sstevel@tonic-gate storedeskeyarray(key, &arg->deskey);
16127c478bd9Sstevel@tonic-gate if (CLASSIC_PK_DH(arg->keylen, arg->algtype)) {
16137c478bd9Sstevel@tonic-gate /*EMPTY*/
16147c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG1,
16157c478bd9Sstevel@tonic-gate ("pk_crypt3 WARNING received 192-bit key"));
16167c478bd9Sstevel@tonic-gate } else {
16177c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
16187c478bd9Sstevel@tonic-gate ("pk_crypt3 calling __cbc_triple_crypt"));
16197c478bd9Sstevel@tonic-gate err = __cbc_triple_crypt(cp->deskey.deskeyarray_val,
16207c478bd9Sstevel@tonic-gate (char *)key->deskeyarray_val,
16217c478bd9Sstevel@tonic-gate cp->deskey.deskeyarray_len*sizeof (des_block),
16227c478bd9Sstevel@tonic-gate DES_HW | mode, ivec);
16237c478bd9Sstevel@tonic-gate if (DES_FAILED(err)) {
16247c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
16257c478bd9Sstevel@tonic-gate ("pk_crypt3 calling ecb_crypt/__cbc_triple_crypt failed"));
16267c478bd9Sstevel@tonic-gate if (xsecret_alloc) freekeybuf3(xsecret);
16277c478bd9Sstevel@tonic-gate freekeybuf3(xpublic);
16287c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
16297c478bd9Sstevel@tonic-gate }
16307c478bd9Sstevel@tonic-gate debug(KEYSERV_DEBUG,
16317c478bd9Sstevel@tonic-gate ("pk_crypt3 calling __cbc_triple_crypt succeeded"));
16327c478bd9Sstevel@tonic-gate }
16337c478bd9Sstevel@tonic-gate if (xsecret_alloc) freekeybuf3(xsecret);
16347c478bd9Sstevel@tonic-gate freekeybuf3(xpublic);
16357c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
16367c478bd9Sstevel@tonic-gate }
16377c478bd9Sstevel@tonic-gate
16387c478bd9Sstevel@tonic-gate keystatus
pk_get_conv_key(uid,pubkey,result)16397c478bd9Sstevel@tonic-gate pk_get_conv_key(uid, pubkey, result)
16407c478bd9Sstevel@tonic-gate uid_t uid;
16417c478bd9Sstevel@tonic-gate keybuf pubkey;
16427c478bd9Sstevel@tonic-gate cryptkeyres *result;
16437c478bd9Sstevel@tonic-gate {
16447c478bd9Sstevel@tonic-gate char xsecret[1024];
16457c478bd9Sstevel@tonic-gate char xpublic[1024];
16467c478bd9Sstevel@tonic-gate MINT *public;
16477c478bd9Sstevel@tonic-gate MINT *secret;
16487c478bd9Sstevel@tonic-gate MINT *common;
16497c478bd9Sstevel@tonic-gate char zero[8];
16507c478bd9Sstevel@tonic-gate int hash;
16517c478bd9Sstevel@tonic-gate
16527c478bd9Sstevel@tonic-gate if (!fetchsecretkey(uid, xsecret) || xsecret[0] == 0) {
16537c478bd9Sstevel@tonic-gate memset(zero, 0, sizeof (zero));
16547c478bd9Sstevel@tonic-gate if (nodefaultkeys)
16557c478bd9Sstevel@tonic-gate return (KEY_NOSECRET);
16567c478bd9Sstevel@tonic-gate
16577c478bd9Sstevel@tonic-gate if (!getsecretkey("nobody", xsecret, zero) ||
16587c478bd9Sstevel@tonic-gate xsecret[0] == 0)
16597c478bd9Sstevel@tonic-gate return (KEY_NOSECRET);
16607c478bd9Sstevel@tonic-gate }
16617c478bd9Sstevel@tonic-gate
16627c478bd9Sstevel@tonic-gate memcpy(xpublic, pubkey, sizeof (keybuf));
16637c478bd9Sstevel@tonic-gate xsecret[HEXKEYBYTES] = '\0';
16647c478bd9Sstevel@tonic-gate xpublic[HEXKEYBYTES] = '\0';
16657c478bd9Sstevel@tonic-gate
16667c478bd9Sstevel@tonic-gate hash = hash_keys(xpublic, xsecret);
16677c478bd9Sstevel@tonic-gate (void) rw_rdlock(&g_cachedkeys_lock);
16687c478bd9Sstevel@tonic-gate if (!readcache(xpublic, xsecret, &result->cryptkeyres_u.deskey, hash)) {
16697c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_cachedkeys_lock);
16707c478bd9Sstevel@tonic-gate (void) rw_wrlock(&g_cachedkeys_lock);
16717c478bd9Sstevel@tonic-gate if (!readcache(xpublic, xsecret, &result->cryptkeyres_u.deskey,
16727c478bd9Sstevel@tonic-gate hash)) {
16737c478bd9Sstevel@tonic-gate public = mp_xtom(xpublic);
16747c478bd9Sstevel@tonic-gate secret = mp_xtom(xsecret);
16757c478bd9Sstevel@tonic-gate /* Sanity Check on public and private keys */
16767c478bd9Sstevel@tonic-gate if (public == NULL || secret == NULL) {
16777c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_cachedkeys_lock);
16787c478bd9Sstevel@tonic-gate return (KEY_SYSTEMERR);
16797c478bd9Sstevel@tonic-gate }
16807c478bd9Sstevel@tonic-gate common = mp_itom(0);
16817c478bd9Sstevel@tonic-gate mp_pow(public, secret, MODULUS, common);
16827c478bd9Sstevel@tonic-gate extractdeskey(common, &result->cryptkeyres_u.deskey);
16837c478bd9Sstevel@tonic-gate writecache(xpublic, xsecret,
16847c478bd9Sstevel@tonic-gate &result->cryptkeyres_u.deskey, hash);
16857c478bd9Sstevel@tonic-gate mp_mfree(secret);
16867c478bd9Sstevel@tonic-gate mp_mfree(public);
16877c478bd9Sstevel@tonic-gate mp_mfree(common);
16887c478bd9Sstevel@tonic-gate }
16897c478bd9Sstevel@tonic-gate }
16907c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_cachedkeys_lock);
16917c478bd9Sstevel@tonic-gate
16927c478bd9Sstevel@tonic-gate return (KEY_SUCCESS);
16937c478bd9Sstevel@tonic-gate }
16947c478bd9Sstevel@tonic-gate
16957c478bd9Sstevel@tonic-gate #define findsec(sec, list) \
16967c478bd9Sstevel@tonic-gate (memcmp(sec, (list)->secret, sizeof (keybuf)) == 0)
16977c478bd9Sstevel@tonic-gate
16987c478bd9Sstevel@tonic-gate /*
16997c478bd9Sstevel@tonic-gate * Remove common keys from the cache.
17007c478bd9Sstevel@tonic-gate */
170149e7ca49Speteh static int
removecache(sec)17027c478bd9Sstevel@tonic-gate removecache(sec)
17037c478bd9Sstevel@tonic-gate char *sec;
17047c478bd9Sstevel@tonic-gate {
17057c478bd9Sstevel@tonic-gate struct cachekey_list *found;
17067c478bd9Sstevel@tonic-gate register struct cachekey_list **l;
17077c478bd9Sstevel@tonic-gate int i;
17087c478bd9Sstevel@tonic-gate
17097c478bd9Sstevel@tonic-gate (void) rw_wrlock(&g_cachedkeys_lock);
17107c478bd9Sstevel@tonic-gate for (i = 0; i < KEY_HASH_SIZE; i++) {
17117c478bd9Sstevel@tonic-gate for (l = &g_cachedkeys[i]; (*l) != NULL; ) {
17127c478bd9Sstevel@tonic-gate if (findsec(sec, *l)) {
17137c478bd9Sstevel@tonic-gate found = *l;
17147c478bd9Sstevel@tonic-gate *l = (*l)->next;
17157c478bd9Sstevel@tonic-gate memset((char *)found, 0,
17167c478bd9Sstevel@tonic-gate sizeof (struct cachekey_list));
17177c478bd9Sstevel@tonic-gate free(found);
17187c478bd9Sstevel@tonic-gate } else {
17197c478bd9Sstevel@tonic-gate l = &(*l)->next;
17207c478bd9Sstevel@tonic-gate }
17217c478bd9Sstevel@tonic-gate }
17227c478bd9Sstevel@tonic-gate }
17237c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_cachedkeys_lock);
17247c478bd9Sstevel@tonic-gate return (1);
17257c478bd9Sstevel@tonic-gate }
17267c478bd9Sstevel@tonic-gate
17277c478bd9Sstevel@tonic-gate /*
17287c478bd9Sstevel@tonic-gate * Store the secretkey for this uid
17297c478bd9Sstevel@tonic-gate */
173049e7ca49Speteh int
storesecretkey(uid,key)17317c478bd9Sstevel@tonic-gate storesecretkey(uid, key)
17327c478bd9Sstevel@tonic-gate uid_t uid;
17337c478bd9Sstevel@tonic-gate keybuf key;
17347c478bd9Sstevel@tonic-gate {
17357c478bd9Sstevel@tonic-gate struct secretkey_netname_list *new;
17367c478bd9Sstevel@tonic-gate struct secretkey_netname_list **l;
17377c478bd9Sstevel@tonic-gate int hash = HASH_UID(uid);
17387c478bd9Sstevel@tonic-gate
17397c478bd9Sstevel@tonic-gate (void) rw_wrlock(&g_secretkey_netname_lock);
17407c478bd9Sstevel@tonic-gate for (l = &g_secretkey_netname[hash]; *l != NULL && (*l)->uid != uid;
17417c478bd9Sstevel@tonic-gate l = &(*l)->next) {
17427c478bd9Sstevel@tonic-gate }
17437c478bd9Sstevel@tonic-gate if (*l == NULL) {
17447c478bd9Sstevel@tonic-gate if (key[0] == '\0') {
17457c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
17467c478bd9Sstevel@tonic-gate return (0);
17477c478bd9Sstevel@tonic-gate }
17487c478bd9Sstevel@tonic-gate new = (struct secretkey_netname_list *)malloc(sizeof (*new));
17497c478bd9Sstevel@tonic-gate if (new == NULL) {
17507c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
17517c478bd9Sstevel@tonic-gate return (0);
17527c478bd9Sstevel@tonic-gate }
17537c478bd9Sstevel@tonic-gate new->uid = uid;
17547c478bd9Sstevel@tonic-gate new->sc_flag = KEY_ONLY;
17557c478bd9Sstevel@tonic-gate memset(new->keynetdata.st_pub_key, 0, HEXKEYBYTES);
17567c478bd9Sstevel@tonic-gate new->keynetdata.st_netname = NULL;
17577c478bd9Sstevel@tonic-gate new->next = NULL;
17587c478bd9Sstevel@tonic-gate *l = new;
17597c478bd9Sstevel@tonic-gate } else {
17607c478bd9Sstevel@tonic-gate new = *l;
17617c478bd9Sstevel@tonic-gate if (key[0] == '\0')
17627c478bd9Sstevel@tonic-gate removecache(new->keynetdata.st_priv_key);
17637c478bd9Sstevel@tonic-gate }
17647c478bd9Sstevel@tonic-gate
17657c478bd9Sstevel@tonic-gate memcpy(new->keynetdata.st_priv_key, key,
17667c478bd9Sstevel@tonic-gate HEXKEYBYTES);
17677c478bd9Sstevel@tonic-gate (void) rw_unlock(&g_secretkey_netname_lock);
17687c478bd9Sstevel@tonic-gate return (1);
17697c478bd9Sstevel@tonic-gate }
17707c478bd9Sstevel@tonic-gate
177149e7ca49Speteh static int
hexdigit(val)17727c478bd9Sstevel@tonic-gate hexdigit(val)
17737c478bd9Sstevel@tonic-gate int val;
17747c478bd9Sstevel@tonic-gate {
17757c478bd9Sstevel@tonic-gate return ("0123456789abcdef"[val]);
17767c478bd9Sstevel@tonic-gate }
17777c478bd9Sstevel@tonic-gate
177849e7ca49Speteh int
bin2hex(bin,hex,size)17797c478bd9Sstevel@tonic-gate bin2hex(bin, hex, size)
17807c478bd9Sstevel@tonic-gate unsigned char *bin;
17817c478bd9Sstevel@tonic-gate unsigned char *hex;
17827c478bd9Sstevel@tonic-gate int size;
17837c478bd9Sstevel@tonic-gate {
17847c478bd9Sstevel@tonic-gate int i;
17857c478bd9Sstevel@tonic-gate
17867c478bd9Sstevel@tonic-gate for (i = 0; i < size; i++) {
17877c478bd9Sstevel@tonic-gate *hex++ = hexdigit(*bin >> 4);
17887c478bd9Sstevel@tonic-gate *hex++ = hexdigit(*bin++ & 0xf);
17897c478bd9Sstevel@tonic-gate }
17907c478bd9Sstevel@tonic-gate return (0);
17917c478bd9Sstevel@tonic-gate }
17927c478bd9Sstevel@tonic-gate
179349e7ca49Speteh static int
hexval(dig)17947c478bd9Sstevel@tonic-gate hexval(dig)
17957c478bd9Sstevel@tonic-gate char dig;
17967c478bd9Sstevel@tonic-gate {
17977c478bd9Sstevel@tonic-gate if ('0' <= dig && dig <= '9') {
17987c478bd9Sstevel@tonic-gate return (dig - '0');
17997c478bd9Sstevel@tonic-gate } else if ('a' <= dig && dig <= 'f') {
18007c478bd9Sstevel@tonic-gate return (dig - 'a' + 10);
18017c478bd9Sstevel@tonic-gate } else if ('A' <= dig && dig <= 'F') {
18027c478bd9Sstevel@tonic-gate return (dig - 'A' + 10);
18037c478bd9Sstevel@tonic-gate } else {
18047c478bd9Sstevel@tonic-gate return (-1);
18057c478bd9Sstevel@tonic-gate }
18067c478bd9Sstevel@tonic-gate }
18077c478bd9Sstevel@tonic-gate
180849e7ca49Speteh int
hex2bin(hex,bin,size)18097c478bd9Sstevel@tonic-gate hex2bin(hex, bin, size)
18107c478bd9Sstevel@tonic-gate unsigned char *hex;
18117c478bd9Sstevel@tonic-gate unsigned char *bin;
18127c478bd9Sstevel@tonic-gate int size;
18137c478bd9Sstevel@tonic-gate {
18147c478bd9Sstevel@tonic-gate int i;
18157c478bd9Sstevel@tonic-gate
18167c478bd9Sstevel@tonic-gate for (i = 0; i < size; i++) {
18177c478bd9Sstevel@tonic-gate *bin = hexval(*hex++) << 4;
18187c478bd9Sstevel@tonic-gate *bin++ |= hexval(*hex++);
18197c478bd9Sstevel@tonic-gate }
18207c478bd9Sstevel@tonic-gate return (0);
18217c478bd9Sstevel@tonic-gate }
18227c478bd9Sstevel@tonic-gate
18237c478bd9Sstevel@tonic-gate static int
hash_keys(pub,sec)18247c478bd9Sstevel@tonic-gate hash_keys(pub, sec)
18257c478bd9Sstevel@tonic-gate char *pub;
18267c478bd9Sstevel@tonic-gate char *sec;
18277c478bd9Sstevel@tonic-gate {
18287c478bd9Sstevel@tonic-gate int i;
18297c478bd9Sstevel@tonic-gate int hash = 0;
18307c478bd9Sstevel@tonic-gate
18317c478bd9Sstevel@tonic-gate for (i = 0; i < HEXKEYBYTES; i += 6, pub += 6, sec += 6) {
18327c478bd9Sstevel@tonic-gate hash ^= *pub;
18337c478bd9Sstevel@tonic-gate hash ^= *sec;
18347c478bd9Sstevel@tonic-gate }
18357c478bd9Sstevel@tonic-gate return (hash & 0xff);
18367c478bd9Sstevel@tonic-gate }
18377c478bd9Sstevel@tonic-gate
18387c478bd9Sstevel@tonic-gate /*
1839*bbf21555SRichard Lowe * problem: keyserv loads keys from /etc/.rootkey based on nisauthconf(8)
1840*bbf21555SRichard Lowe * which is too nis+-centric (see secure_rpc(3NSL)).
18417c478bd9Sstevel@tonic-gate *
18427c478bd9Sstevel@tonic-gate * So we want to make sure there is always a AUTH_DES compat entry
18437c478bd9Sstevel@tonic-gate * in the "list" of nis+ mechs so that the 192bit key always gets loaded so
18447c478bd9Sstevel@tonic-gate * non-nis+ services that use AUTH_DES (e.g. nfs) won't get hosed. The real
18457c478bd9Sstevel@tonic-gate * hacky part of it is we muck with the array returned from
18467c478bd9Sstevel@tonic-gate * __nis_get_mechanisms which we really don't have any business
18477c478bd9Sstevel@tonic-gate * doing cause we should not know/care how that is implemented. A better
18487c478bd9Sstevel@tonic-gate * way would be to change the __nis_get_mechanisms interface or add another
18497c478bd9Sstevel@tonic-gate * one similiar to it that forces the "des" compat entry into the list.
18507c478bd9Sstevel@tonic-gate *
18517c478bd9Sstevel@tonic-gate * Return ptr to mechs array on success, else NULL on memory errs.
18527c478bd9Sstevel@tonic-gate */
18537c478bd9Sstevel@tonic-gate mechanism_t **
getmechwrap()18547c478bd9Sstevel@tonic-gate getmechwrap()
18557c478bd9Sstevel@tonic-gate {
18567c478bd9Sstevel@tonic-gate mechanism_t **mechs = __nis_get_mechanisms(FALSE);
18577c478bd9Sstevel@tonic-gate mechanism_t **mechsbak = NULL;
18587c478bd9Sstevel@tonic-gate mechanism_t *desmech = NULL;
18597c478bd9Sstevel@tonic-gate int i = 0;
18607c478bd9Sstevel@tonic-gate
18617c478bd9Sstevel@tonic-gate if (mechs) {
18627c478bd9Sstevel@tonic-gate /* got some valid mechs and possibly the AUTH_DES compat one */
18637c478bd9Sstevel@tonic-gate for (i = 0; mechs[i]; i++) {
18647c478bd9Sstevel@tonic-gate if (AUTH_DES_COMPAT_CHK(mechs[i]))
18657c478bd9Sstevel@tonic-gate return (mechs);
18667c478bd9Sstevel@tonic-gate }
18677c478bd9Sstevel@tonic-gate /* i == number of ptrs not counting terminating NULL */
18687c478bd9Sstevel@tonic-gate }
18697c478bd9Sstevel@tonic-gate
18707c478bd9Sstevel@tonic-gate /* AUTH_DES compat entry not found, let's add it */
18717c478bd9Sstevel@tonic-gate if ((desmech = malloc(sizeof (mechanism_t))) == NULL) {
18727c478bd9Sstevel@tonic-gate if (mechs)
18737c478bd9Sstevel@tonic-gate __nis_release_mechanisms(mechs);
18747c478bd9Sstevel@tonic-gate return (NULL);
18757c478bd9Sstevel@tonic-gate }
18767c478bd9Sstevel@tonic-gate desmech->mechname = NULL;
18777c478bd9Sstevel@tonic-gate desmech->alias = NIS_SEC_CF_DES_ALIAS;
18787c478bd9Sstevel@tonic-gate desmech->keylen = AUTH_DES_KEYLEN;
18797c478bd9Sstevel@tonic-gate desmech->algtype = AUTH_DES_ALGTYPE;
18807c478bd9Sstevel@tonic-gate desmech->qop = NULL;
18817c478bd9Sstevel@tonic-gate desmech->secserv = rpc_gss_svc_default;
18827c478bd9Sstevel@tonic-gate
18837c478bd9Sstevel@tonic-gate mechsbak = mechs;
18847c478bd9Sstevel@tonic-gate /* mechs == NULL and i == 0 is valid "no mechs configed" case */
18857c478bd9Sstevel@tonic-gate if ((mechs = (mechanism_t **)realloc(mechs,
18867c478bd9Sstevel@tonic-gate sizeof (mechanism_t *) * (i + 2))) == NULL) {
18877c478bd9Sstevel@tonic-gate if (mechsbak)
18887c478bd9Sstevel@tonic-gate __nis_release_mechanisms(mechsbak);
18897c478bd9Sstevel@tonic-gate free(desmech);
18907c478bd9Sstevel@tonic-gate return (NULL);
18917c478bd9Sstevel@tonic-gate }
18927c478bd9Sstevel@tonic-gate mechs[i] = desmech;
18937c478bd9Sstevel@tonic-gate mechs[i+1] = NULL;
18947c478bd9Sstevel@tonic-gate
18957c478bd9Sstevel@tonic-gate return (mechs);
18967c478bd9Sstevel@tonic-gate }
18977c478bd9Sstevel@tonic-gate
18987c478bd9Sstevel@tonic-gate int
init_mechs()18997c478bd9Sstevel@tonic-gate init_mechs()
19007c478bd9Sstevel@tonic-gate {
19017c478bd9Sstevel@tonic-gate int nmechs, oldmechseen;
19027c478bd9Sstevel@tonic-gate mechanism_t **mechpp;
19037c478bd9Sstevel@tonic-gate char **cpp;
19047c478bd9Sstevel@tonic-gate
19057c478bd9Sstevel@tonic-gate if (!(mechs = getmechwrap()))
19067c478bd9Sstevel@tonic-gate return (-1);
19077c478bd9Sstevel@tonic-gate
19087c478bd9Sstevel@tonic-gate /*
19097c478bd9Sstevel@tonic-gate * find how many mechanisms were specified and also
19107c478bd9Sstevel@tonic-gate * setup the mechanism table for unique keylen/algtype pair
19117c478bd9Sstevel@tonic-gate */
19127c478bd9Sstevel@tonic-gate nmechs = 0;
19137c478bd9Sstevel@tonic-gate for (mechpp = mechs; *mechpp != NULL; mechpp++) {
19147c478bd9Sstevel@tonic-gate struct keylenlist **kpp;
19157c478bd9Sstevel@tonic-gate struct algtypelist **app;
19167c478bd9Sstevel@tonic-gate
19177c478bd9Sstevel@tonic-gate nmechs++;
19187c478bd9Sstevel@tonic-gate if (((*mechpp)->keylen < 0) || ((*mechpp)->algtype < 0)) {
19197c478bd9Sstevel@tonic-gate continue;
19207c478bd9Sstevel@tonic-gate }
19217c478bd9Sstevel@tonic-gate kpp = getkeylen((*mechpp)->keylen);
19227c478bd9Sstevel@tonic-gate appendkeylist(kpp, (*mechpp)->keylen);
19237c478bd9Sstevel@tonic-gate app = getalgtype(kpp, (*mechpp)->algtype);
19247c478bd9Sstevel@tonic-gate appendalgtype(app, (*mechpp)->algtype);
19257c478bd9Sstevel@tonic-gate }
19267c478bd9Sstevel@tonic-gate
19277c478bd9Sstevel@tonic-gate /*
19287c478bd9Sstevel@tonic-gate * set of mechs for getsubopt()
19297c478bd9Sstevel@tonic-gate */
19307c478bd9Sstevel@tonic-gate cache_options = (char **)calloc((size_t)nmechs + 1,
19317c478bd9Sstevel@tonic-gate sizeof (*cache_options));
19327c478bd9Sstevel@tonic-gate if (cache_options == NULL) {
19337c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "unable to allocate option array");
19347c478bd9Sstevel@tonic-gate return (-1);
19357c478bd9Sstevel@tonic-gate }
19367c478bd9Sstevel@tonic-gate /*
19377c478bd9Sstevel@tonic-gate * cache sizes
19387c478bd9Sstevel@tonic-gate */
19397c478bd9Sstevel@tonic-gate cache_size = (int *)calloc((size_t)nmechs, sizeof (int));
19407c478bd9Sstevel@tonic-gate if (cache_size == NULL) {
19417c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "unable to allocate cache array");
19427c478bd9Sstevel@tonic-gate return (-1);
19437c478bd9Sstevel@tonic-gate }
19447c478bd9Sstevel@tonic-gate
19457c478bd9Sstevel@tonic-gate oldmechseen = 0;
19467c478bd9Sstevel@tonic-gate cpp = cache_options;
19477c478bd9Sstevel@tonic-gate for (mechpp = mechs; *mechpp != NULL; mechpp++) {
19487c478bd9Sstevel@tonic-gate /*
19497c478bd9Sstevel@tonic-gate * usual case: a DH-style mechanism type, with an alias
19507c478bd9Sstevel@tonic-gate */
19517c478bd9Sstevel@tonic-gate if ((*mechpp)->mechname != NULL &&
19527c478bd9Sstevel@tonic-gate strncmp((*mechpp)->mechname, DHMECHSTR,
19537c478bd9Sstevel@tonic-gate strlen(DHMECHSTR)) == 0 &&
19547c478bd9Sstevel@tonic-gate (*mechpp)->alias != NULL) {
19557c478bd9Sstevel@tonic-gate /*
19567c478bd9Sstevel@tonic-gate * Is this trad 192-DH? already added?
19577c478bd9Sstevel@tonic-gate */
19587c478bd9Sstevel@tonic-gate if (strcmp((*mechpp)->alias, DESALIAS) == 0) {
19597c478bd9Sstevel@tonic-gate if (oldmechseen) {
19607c478bd9Sstevel@tonic-gate continue;
19617c478bd9Sstevel@tonic-gate }
19627c478bd9Sstevel@tonic-gate oldmechseen++;
19637c478bd9Sstevel@tonic-gate }
19647c478bd9Sstevel@tonic-gate
19657c478bd9Sstevel@tonic-gate *cpp++ = (*mechpp)->alias;
19667c478bd9Sstevel@tonic-gate continue;
19677c478bd9Sstevel@tonic-gate }
19687c478bd9Sstevel@tonic-gate
19697c478bd9Sstevel@tonic-gate /*
19707c478bd9Sstevel@tonic-gate * HACK: we recognise a special alias for traditional
19717c478bd9Sstevel@tonic-gate * 192-bit DH, unless the latter has already been mentioned
19727c478bd9Sstevel@tonic-gate * in it's full form
19737c478bd9Sstevel@tonic-gate */
19747c478bd9Sstevel@tonic-gate if ((*mechpp)->mechname == NULL && (*mechpp)->alias != NULL &&
19757c478bd9Sstevel@tonic-gate strcmp((*mechpp)->alias, DES) == 0 && !oldmechseen) {
19767c478bd9Sstevel@tonic-gate *cpp++ = DESALIAS;
19777c478bd9Sstevel@tonic-gate oldmechseen++;
19787c478bd9Sstevel@tonic-gate continue;
19797c478bd9Sstevel@tonic-gate }
19807c478bd9Sstevel@tonic-gate
19817c478bd9Sstevel@tonic-gate /*
19827c478bd9Sstevel@tonic-gate * Ignore anything else
19837c478bd9Sstevel@tonic-gate */
19847c478bd9Sstevel@tonic-gate }
19857c478bd9Sstevel@tonic-gate
19867c478bd9Sstevel@tonic-gate /* Terminate the options list */
19877c478bd9Sstevel@tonic-gate *cpp = NULL;
19887c478bd9Sstevel@tonic-gate
19897c478bd9Sstevel@tonic-gate return (0);
19907c478bd9Sstevel@tonic-gate }
1991