17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * lib/krb5/krb/rd_rep.c
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology.
57c478bd9Sstevel@tonic-gate * All Rights Reserved.
67c478bd9Sstevel@tonic-gate *
77c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
87c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
97c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
107c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
11*55fea89dSDan Cross *
127c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
137c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
147c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
157c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
167c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
177c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
187c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
197c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
207c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
217c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
227c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
237c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
247c478bd9Sstevel@tonic-gate * or implied warranty.
25*55fea89dSDan Cross *
267c478bd9Sstevel@tonic-gate *
277c478bd9Sstevel@tonic-gate * krb5_rd_rep()
287c478bd9Sstevel@tonic-gate */
297c478bd9Sstevel@tonic-gate
30159d09a2SMark Phalan #include "k5-int.h"
31159d09a2SMark Phalan #include "auth_con.h"
327c478bd9Sstevel@tonic-gate
337c478bd9Sstevel@tonic-gate /*
347c478bd9Sstevel@tonic-gate * Parses a KRB_AP_REP message, returning its contents.
35*55fea89dSDan Cross *
367c478bd9Sstevel@tonic-gate * repl is filled in with with a pointer to allocated memory containing
37*55fea89dSDan Cross * the fields from the encrypted response.
38*55fea89dSDan Cross *
397c478bd9Sstevel@tonic-gate * the key in kblock is used to decrypt the message.
40*55fea89dSDan Cross *
417c478bd9Sstevel@tonic-gate * returns system errors, encryption errors, replay errors
427c478bd9Sstevel@tonic-gate */
437c478bd9Sstevel@tonic-gate
447c478bd9Sstevel@tonic-gate krb5_error_code KRB5_CALLCONV
krb5_rd_rep(krb5_context context,krb5_auth_context auth_context,const krb5_data * inbuf,krb5_ap_rep_enc_part ** repl)45159d09a2SMark Phalan krb5_rd_rep(krb5_context context, krb5_auth_context auth_context, const krb5_data *inbuf, krb5_ap_rep_enc_part **repl)
467c478bd9Sstevel@tonic-gate {
477c478bd9Sstevel@tonic-gate krb5_error_code retval;
487c478bd9Sstevel@tonic-gate krb5_ap_rep * reply;
497c478bd9Sstevel@tonic-gate krb5_data scratch;
507c478bd9Sstevel@tonic-gate
517c478bd9Sstevel@tonic-gate if (!krb5_is_ap_rep(inbuf))
527c478bd9Sstevel@tonic-gate return KRB5KRB_AP_ERR_MSG_TYPE;
537c478bd9Sstevel@tonic-gate
547c478bd9Sstevel@tonic-gate /* decode it */
557c478bd9Sstevel@tonic-gate
567c478bd9Sstevel@tonic-gate if ((retval = decode_krb5_ap_rep(inbuf, &reply)))
577c478bd9Sstevel@tonic-gate return retval;
587c478bd9Sstevel@tonic-gate
597c478bd9Sstevel@tonic-gate /* put together an eblock for this encryption */
607c478bd9Sstevel@tonic-gate
617c478bd9Sstevel@tonic-gate scratch.length = reply->enc_part.ciphertext.length;
627c478bd9Sstevel@tonic-gate if (!(scratch.data = malloc(scratch.length))) {
637c478bd9Sstevel@tonic-gate krb5_free_ap_rep(context, reply);
647c478bd9Sstevel@tonic-gate return(ENOMEM);
657c478bd9Sstevel@tonic-gate }
667c478bd9Sstevel@tonic-gate
67159d09a2SMark Phalan if ((retval = krb5_c_decrypt(context, auth_context->keyblock,
687c478bd9Sstevel@tonic-gate KRB5_KEYUSAGE_AP_REP_ENCPART, 0,
69159d09a2SMark Phalan &reply->enc_part, &scratch)))
707c478bd9Sstevel@tonic-gate goto clean_scratch;
717c478bd9Sstevel@tonic-gate
727c478bd9Sstevel@tonic-gate /* now decode the decrypted stuff */
737c478bd9Sstevel@tonic-gate retval = decode_krb5_ap_rep_enc_part(&scratch, repl);
747c478bd9Sstevel@tonic-gate if (retval)
757c478bd9Sstevel@tonic-gate goto clean_scratch;
767c478bd9Sstevel@tonic-gate
777c478bd9Sstevel@tonic-gate /* Check reply fields */
787c478bd9Sstevel@tonic-gate if (((*repl)->ctime != auth_context->authentp->ctime) ||
797c478bd9Sstevel@tonic-gate ((*repl)->cusec != auth_context->authentp->cusec)) {
807c478bd9Sstevel@tonic-gate retval = KRB5_MUTUAL_FAILED;
817c478bd9Sstevel@tonic-gate goto clean_scratch;
827c478bd9Sstevel@tonic-gate }
837c478bd9Sstevel@tonic-gate
847c478bd9Sstevel@tonic-gate /* Set auth subkey */
857c478bd9Sstevel@tonic-gate if ((*repl)->subkey) {
867c478bd9Sstevel@tonic-gate if (auth_context->recv_subkey) {
877c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, auth_context->recv_subkey);
887c478bd9Sstevel@tonic-gate auth_context->recv_subkey = NULL;
89159d09a2SMark Phalan }
907c478bd9Sstevel@tonic-gate retval = krb5_copy_keyblock(context, (*repl)->subkey,
91159d09a2SMark Phalan &auth_context->recv_subkey);
927c478bd9Sstevel@tonic-gate if (retval)
937c478bd9Sstevel@tonic-gate goto clean_scratch;
947c478bd9Sstevel@tonic-gate if (auth_context->send_subkey) {
957c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, auth_context->send_subkey);
967c478bd9Sstevel@tonic-gate auth_context->send_subkey = NULL;
97159d09a2SMark Phalan }
987c478bd9Sstevel@tonic-gate retval = krb5_copy_keyblock(context, (*repl)->subkey,
99159d09a2SMark Phalan &auth_context->send_subkey);
1007c478bd9Sstevel@tonic-gate if (retval) {
1017c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, auth_context->send_subkey);
1027c478bd9Sstevel@tonic-gate auth_context->send_subkey = NULL;
103159d09a2SMark Phalan }
1047c478bd9Sstevel@tonic-gate }
105159d09a2SMark Phalan
1067c478bd9Sstevel@tonic-gate /* Get remote sequence number */
1077c478bd9Sstevel@tonic-gate auth_context->remote_seq_number = (*repl)->seq_number;
1087c478bd9Sstevel@tonic-gate
1097c478bd9Sstevel@tonic-gate clean_scratch:
110*55fea89dSDan Cross memset(scratch.data, 0, scratch.length);
111159d09a2SMark Phalan
1127c478bd9Sstevel@tonic-gate krb5_free_ap_rep(context, reply);
1137c478bd9Sstevel@tonic-gate free(scratch.data);
1147c478bd9Sstevel@tonic-gate return retval;
1157c478bd9Sstevel@tonic-gate }
116