17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*004388ebScasper * Common Development and Distribution License (the "License"). 6*004388ebScasper * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 2161961e0fSrobinson 227c478bd9Sstevel@tonic-gate /* 23*004388ebScasper * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate /* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */ 287c478bd9Sstevel@tonic-gate /* All Rights Reserved */ 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate /* 317c478bd9Sstevel@tonic-gate * Portions of this source code were derived from Berkeley 4.3 BSD 327c478bd9Sstevel@tonic-gate * under license from the Regents of the University of California. 337c478bd9Sstevel@tonic-gate */ 347c478bd9Sstevel@tonic-gate 357c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 367c478bd9Sstevel@tonic-gate 377c478bd9Sstevel@tonic-gate /* 387c478bd9Sstevel@tonic-gate * publickey.c 397c478bd9Sstevel@tonic-gate * 407c478bd9Sstevel@tonic-gate * 417c478bd9Sstevel@tonic-gate * Public and Private (secret) key lookup routines. These functions 427c478bd9Sstevel@tonic-gate * are used by the secure RPC auth_des flavor to get the public and 437c478bd9Sstevel@tonic-gate * private keys for secure RPC principals. Originally designed to 447c478bd9Sstevel@tonic-gate * talk only to YP, AT&T modified them to talk to files, and now 457c478bd9Sstevel@tonic-gate * they can also talk to NIS+. The policy for these lookups is now 467c478bd9Sstevel@tonic-gate * defined in terms of the nameservice switch as follows : 477c478bd9Sstevel@tonic-gate * publickey: nis files 487c478bd9Sstevel@tonic-gate * 497c478bd9Sstevel@tonic-gate * Note : 507c478bd9Sstevel@tonic-gate * 1. NIS+ combines the netid.byname and publickey.byname maps 517c478bd9Sstevel@tonic-gate * into a single NIS+ table named cred.org_dir 527c478bd9Sstevel@tonic-gate * 2. To use NIS+, the publickey needs to be 537c478bd9Sstevel@tonic-gate * publickey: nisplus 547c478bd9Sstevel@tonic-gate * (or have nisplus as the first entry). 557c478bd9Sstevel@tonic-gate * The nsswitch.conf file should be updated after running nisinit 567c478bd9Sstevel@tonic-gate * to reflect this. 577c478bd9Sstevel@tonic-gate */ 587c478bd9Sstevel@tonic-gate #include "mt.h" 597c478bd9Sstevel@tonic-gate #include "../rpc/rpc_mt.h" 607c478bd9Sstevel@tonic-gate #include <stdio.h> 617c478bd9Sstevel@tonic-gate #include <stdlib.h> 627c478bd9Sstevel@tonic-gate #include <string.h> 637c478bd9Sstevel@tonic-gate #include <syslog.h> 647c478bd9Sstevel@tonic-gate #include <assert.h> 657c478bd9Sstevel@tonic-gate #include <sys/types.h> 667c478bd9Sstevel@tonic-gate #include <pwd.h> 677c478bd9Sstevel@tonic-gate #include "nsswitch.h" 687c478bd9Sstevel@tonic-gate #include <rpc/rpc.h> 697c478bd9Sstevel@tonic-gate #include <rpc/key_prot.h> 707c478bd9Sstevel@tonic-gate #include <rpcsvc/nis.h> 717c478bd9Sstevel@tonic-gate #include <rpcsvc/ypclnt.h> 727c478bd9Sstevel@tonic-gate #include <rpcsvc/nis_dhext.h> 737c478bd9Sstevel@tonic-gate #include <thread.h> 747c478bd9Sstevel@tonic-gate #include "../nis/gen/nis_clnt.h" 757c478bd9Sstevel@tonic-gate #include <nss_dbdefs.h> 767c478bd9Sstevel@tonic-gate 777c478bd9Sstevel@tonic-gate static const char *PKTABLE = "cred.org_dir"; 787c478bd9Sstevel@tonic-gate static const char *PKMAP = "publickey.byname"; 797c478bd9Sstevel@tonic-gate static const char *PKFILE = "/etc/publickey"; 807c478bd9Sstevel@tonic-gate static const char dh_caps_str[] = "DH"; 817c478bd9Sstevel@tonic-gate static const char des_caps_str[] = AUTH_DES_AUTH_TYPE; 827c478bd9Sstevel@tonic-gate 837c478bd9Sstevel@tonic-gate static char *netname2hashname(const char *, char *, int, keylen_t, 847c478bd9Sstevel@tonic-gate algtype_t); 857c478bd9Sstevel@tonic-gate 867c478bd9Sstevel@tonic-gate #define PKTABLE_LEN 12 877c478bd9Sstevel@tonic-gate #define WORKBUFSIZE 1024 887c478bd9Sstevel@tonic-gate 897c478bd9Sstevel@tonic-gate extern int xdecrypt(); 907c478bd9Sstevel@tonic-gate 917c478bd9Sstevel@tonic-gate extern int __yp_match_cflookup(char *, char *, char *, int, char **, 927c478bd9Sstevel@tonic-gate int *, int *); 937c478bd9Sstevel@tonic-gate 947c478bd9Sstevel@tonic-gate 957c478bd9Sstevel@tonic-gate /* 967c478bd9Sstevel@tonic-gate * default publickey policy: 977c478bd9Sstevel@tonic-gate * publickey: nis [NOTFOUND = return] files 987c478bd9Sstevel@tonic-gate */ 997c478bd9Sstevel@tonic-gate 1007c478bd9Sstevel@tonic-gate 1017c478bd9Sstevel@tonic-gate /* NSW_NOTSUCCESS NSW_NOTFOUND NSW_UNAVAIL NSW_TRYAGAIN */ 1027c478bd9Sstevel@tonic-gate #define DEF_ACTION {__NSW_RETURN, __NSW_RETURN, __NSW_CONTINUE, __NSW_CONTINUE} 1037c478bd9Sstevel@tonic-gate 1047c478bd9Sstevel@tonic-gate static struct __nsw_lookup lookup_files = {"files", DEF_ACTION, NULL, NULL}, 1057c478bd9Sstevel@tonic-gate lookup_nis = {"nis", DEF_ACTION, NULL, &lookup_files}; 1067c478bd9Sstevel@tonic-gate static struct __nsw_switchconfig publickey_default = 1077c478bd9Sstevel@tonic-gate {0, "publickey", 2, &lookup_nis}; 1087c478bd9Sstevel@tonic-gate 1097c478bd9Sstevel@tonic-gate #ifndef NUL 1107c478bd9Sstevel@tonic-gate #define NUL '\0' 1117c478bd9Sstevel@tonic-gate #endif 1127c478bd9Sstevel@tonic-gate 1137c478bd9Sstevel@tonic-gate extern mutex_t serialize_pkey; 1147c478bd9Sstevel@tonic-gate 1157c478bd9Sstevel@tonic-gate static void pkey_cache_add(); 1167c478bd9Sstevel@tonic-gate static int pkey_cache_get(); 1177c478bd9Sstevel@tonic-gate static void pkey_cache_flush(); 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate static int extract_secret(); 1207c478bd9Sstevel@tonic-gate 1217c478bd9Sstevel@tonic-gate /* 1227c478bd9Sstevel@tonic-gate * db_root is used for switch backends. 1237c478bd9Sstevel@tonic-gate */ 1247c478bd9Sstevel@tonic-gate static DEFINE_NSS_DB_ROOT(db_root); 1257c478bd9Sstevel@tonic-gate 1267c478bd9Sstevel@tonic-gate /* 1277c478bd9Sstevel@tonic-gate * These functions are the "backends" for the switch for public keys. They 1287c478bd9Sstevel@tonic-gate * get both the public and private keys from each of the supported name 1297c478bd9Sstevel@tonic-gate * services (nis, nisplus, files). They are passed the appropriate parameters 1307c478bd9Sstevel@tonic-gate * and return 0 if unsuccessful with *errp set, or 1 when they got just the 1317c478bd9Sstevel@tonic-gate * public key and 3 when they got both the public and private keys. 1327c478bd9Sstevel@tonic-gate * 1337c478bd9Sstevel@tonic-gate * 1347c478bd9Sstevel@tonic-gate * getkey_nis() 1357c478bd9Sstevel@tonic-gate * 1367c478bd9Sstevel@tonic-gate * Internal implementation of getpublickey() using NIS (aka Yellow Pages, 1377c478bd9Sstevel@tonic-gate * aka YP). 1387c478bd9Sstevel@tonic-gate * 1397c478bd9Sstevel@tonic-gate * NOTE : *** this function returns nsswitch codes and _not_ the 1407c478bd9Sstevel@tonic-gate * value returned by getpublickey. 1417c478bd9Sstevel@tonic-gate */ 1427c478bd9Sstevel@tonic-gate static int 14361961e0fSrobinson getkeys_nis(int *errp, char *netname, char *pkey, char *skey, char *passwd) 1447c478bd9Sstevel@tonic-gate { 1457c478bd9Sstevel@tonic-gate char *domain; 1467c478bd9Sstevel@tonic-gate char *keyval = NULL; 1477c478bd9Sstevel@tonic-gate int keylen, err, r = 0; 1487c478bd9Sstevel@tonic-gate char *p; 1497c478bd9Sstevel@tonic-gate int len; 1507c478bd9Sstevel@tonic-gate 1517c478bd9Sstevel@tonic-gate p = strchr(netname, '@'); 15261961e0fSrobinson if (!p) { 1537c478bd9Sstevel@tonic-gate *errp = __NSW_UNAVAIL; 1547c478bd9Sstevel@tonic-gate return (0); 1557c478bd9Sstevel@tonic-gate } 1567c478bd9Sstevel@tonic-gate 1577c478bd9Sstevel@tonic-gate domain = ++p; 1587c478bd9Sstevel@tonic-gate 1597c478bd9Sstevel@tonic-gate 1607c478bd9Sstevel@tonic-gate /* 1617c478bd9Sstevel@tonic-gate * Instead of calling yp_match(), we use __yp_match_cflookup() here 1627c478bd9Sstevel@tonic-gate * which has time-out control for the binding operation to nis 1637c478bd9Sstevel@tonic-gate * servers. 1647c478bd9Sstevel@tonic-gate */ 1657c478bd9Sstevel@tonic-gate err = __yp_match_cflookup(domain, (char *)PKMAP, netname, 1667c478bd9Sstevel@tonic-gate strlen(netname), &keyval, &keylen, 0); 1677c478bd9Sstevel@tonic-gate 1687c478bd9Sstevel@tonic-gate switch (err) { 1697c478bd9Sstevel@tonic-gate case YPERR_KEY : 1707c478bd9Sstevel@tonic-gate if (keyval) 1717c478bd9Sstevel@tonic-gate free(keyval); 1727c478bd9Sstevel@tonic-gate *errp = __NSW_NOTFOUND; 1737c478bd9Sstevel@tonic-gate return (0); 1747c478bd9Sstevel@tonic-gate default : 1757c478bd9Sstevel@tonic-gate if (keyval) 1767c478bd9Sstevel@tonic-gate free(keyval); 1777c478bd9Sstevel@tonic-gate *errp = __NSW_UNAVAIL; 1787c478bd9Sstevel@tonic-gate return (0); 1797c478bd9Sstevel@tonic-gate case 0: 1807c478bd9Sstevel@tonic-gate break; 1817c478bd9Sstevel@tonic-gate } 1827c478bd9Sstevel@tonic-gate 1837c478bd9Sstevel@tonic-gate p = strchr(keyval, ':'); 1847c478bd9Sstevel@tonic-gate if (p == NULL) { 1857c478bd9Sstevel@tonic-gate free(keyval); 1867c478bd9Sstevel@tonic-gate *errp = __NSW_NOTFOUND; 1877c478bd9Sstevel@tonic-gate return (0); 1887c478bd9Sstevel@tonic-gate } 1897c478bd9Sstevel@tonic-gate *p = 0; 1907c478bd9Sstevel@tonic-gate if (pkey) { 1917c478bd9Sstevel@tonic-gate len = strlen(keyval); 1927c478bd9Sstevel@tonic-gate if (len > HEXKEYBYTES) { 1937c478bd9Sstevel@tonic-gate free(keyval); 1947c478bd9Sstevel@tonic-gate *errp = __NSW_NOTFOUND; 1957c478bd9Sstevel@tonic-gate return (0); 1967c478bd9Sstevel@tonic-gate } 1977c478bd9Sstevel@tonic-gate (void) strcpy(pkey, keyval); 1987c478bd9Sstevel@tonic-gate } 1997c478bd9Sstevel@tonic-gate r = 1; 2007c478bd9Sstevel@tonic-gate p++; 2017c478bd9Sstevel@tonic-gate if (skey && extract_secret(p, skey, passwd)) 2027c478bd9Sstevel@tonic-gate r |= 2; 2037c478bd9Sstevel@tonic-gate free(keyval); 2047c478bd9Sstevel@tonic-gate *errp = __NSW_SUCCESS; 2057c478bd9Sstevel@tonic-gate return (r); 2067c478bd9Sstevel@tonic-gate } 2077c478bd9Sstevel@tonic-gate 2087c478bd9Sstevel@tonic-gate /* 2097c478bd9Sstevel@tonic-gate * getkey_files() 2107c478bd9Sstevel@tonic-gate * 2117c478bd9Sstevel@tonic-gate * The files version of getpublickey. This function attempts to 2127c478bd9Sstevel@tonic-gate * get the publickey from the file PKFILE . 2137c478bd9Sstevel@tonic-gate * 2147c478bd9Sstevel@tonic-gate * This function defines the format of the /etc/publickey file to 2157c478bd9Sstevel@tonic-gate * be : 2167c478bd9Sstevel@tonic-gate * netname <whitespace> publickey:privatekey 2177c478bd9Sstevel@tonic-gate * 2187c478bd9Sstevel@tonic-gate * NOTE : *** this function returns nsswitch codes and _not_ the 2197c478bd9Sstevel@tonic-gate * value returned by getpublickey. 2207c478bd9Sstevel@tonic-gate */ 2217c478bd9Sstevel@tonic-gate 2227c478bd9Sstevel@tonic-gate static int 22361961e0fSrobinson getkeys_files(int *errp, char *netname, char *pkey, char *skey, char *passwd) 2247c478bd9Sstevel@tonic-gate { 2257c478bd9Sstevel@tonic-gate char *mkey; 2267c478bd9Sstevel@tonic-gate char *mval; 2277c478bd9Sstevel@tonic-gate char buf[WORKBUFSIZE]; 2287c478bd9Sstevel@tonic-gate int r = 0; 2297c478bd9Sstevel@tonic-gate char *res; 230*004388ebScasper FILE *fd; 2317c478bd9Sstevel@tonic-gate char *p; 2327c478bd9Sstevel@tonic-gate char *lasts; 2337c478bd9Sstevel@tonic-gate 234*004388ebScasper fd = fopen(PKFILE, "rF"); 235*004388ebScasper if (fd == NULL) { 2367c478bd9Sstevel@tonic-gate *errp = __NSW_UNAVAIL; 2377c478bd9Sstevel@tonic-gate return (0); 2387c478bd9Sstevel@tonic-gate } 2397c478bd9Sstevel@tonic-gate 2407c478bd9Sstevel@tonic-gate /* Search through the file linearly :-( */ 241*004388ebScasper while ((res = fgets(buf, WORKBUFSIZE, fd)) != NULL) { 2427c478bd9Sstevel@tonic-gate 2437c478bd9Sstevel@tonic-gate if ((res[0] == '#') || (res[0] == '\n')) 2447c478bd9Sstevel@tonic-gate continue; 2457c478bd9Sstevel@tonic-gate else { 2467c478bd9Sstevel@tonic-gate mkey = strtok_r(buf, "\t ", &lasts); 2477c478bd9Sstevel@tonic-gate if (mkey == NULL) { 2487c478bd9Sstevel@tonic-gate syslog(LOG_INFO, 2497c478bd9Sstevel@tonic-gate "getpublickey: Bad record in %s for %s", 2507c478bd9Sstevel@tonic-gate PKFILE, netname); 2517c478bd9Sstevel@tonic-gate continue; 2527c478bd9Sstevel@tonic-gate } 25361961e0fSrobinson mval = strtok_r(NULL, " \t#\n", &lasts); 2547c478bd9Sstevel@tonic-gate if (mval == NULL) { 2557c478bd9Sstevel@tonic-gate syslog(LOG_INFO, 2567c478bd9Sstevel@tonic-gate "getpublickey: Bad record in %s for %s", 2577c478bd9Sstevel@tonic-gate PKFILE, netname); 2587c478bd9Sstevel@tonic-gate continue; 2597c478bd9Sstevel@tonic-gate } 2607c478bd9Sstevel@tonic-gate /* NOTE : Case insensitive compare. */ 2617c478bd9Sstevel@tonic-gate if (strcasecmp(mkey, netname) == 0) { 2627c478bd9Sstevel@tonic-gate p = strchr(mval, ':'); 2637c478bd9Sstevel@tonic-gate if (p == NULL) { 2647c478bd9Sstevel@tonic-gate syslog(LOG_INFO, 2657c478bd9Sstevel@tonic-gate "getpublickey: Bad record in %s for %s", 2667c478bd9Sstevel@tonic-gate PKFILE, netname); 2677c478bd9Sstevel@tonic-gate continue; 2687c478bd9Sstevel@tonic-gate } 2697c478bd9Sstevel@tonic-gate 2707c478bd9Sstevel@tonic-gate *p = 0; 2717c478bd9Sstevel@tonic-gate if (pkey) { 2727c478bd9Sstevel@tonic-gate int len = strlen(mval); 2737c478bd9Sstevel@tonic-gate 2747c478bd9Sstevel@tonic-gate if (len > HEXKEYBYTES) { 2757c478bd9Sstevel@tonic-gate syslog(LOG_INFO, 2767c478bd9Sstevel@tonic-gate "getpublickey: Bad record in %s for %s", 2777c478bd9Sstevel@tonic-gate PKFILE, netname); 2787c478bd9Sstevel@tonic-gate continue; 2797c478bd9Sstevel@tonic-gate } 2807c478bd9Sstevel@tonic-gate (void) strcpy(pkey, mval); 2817c478bd9Sstevel@tonic-gate } 2827c478bd9Sstevel@tonic-gate r = 1; 2837c478bd9Sstevel@tonic-gate p++; 2847c478bd9Sstevel@tonic-gate if (skey && extract_secret(p, skey, passwd)) 2857c478bd9Sstevel@tonic-gate r |= 2; 286*004388ebScasper (void) fclose(fd); 2877c478bd9Sstevel@tonic-gate *errp = __NSW_SUCCESS; 2887c478bd9Sstevel@tonic-gate return (r); 2897c478bd9Sstevel@tonic-gate } 2907c478bd9Sstevel@tonic-gate } 2917c478bd9Sstevel@tonic-gate } 2927c478bd9Sstevel@tonic-gate 293*004388ebScasper (void) fclose(fd); 2947c478bd9Sstevel@tonic-gate *errp = __NSW_NOTFOUND; 2957c478bd9Sstevel@tonic-gate return (0); 2967c478bd9Sstevel@tonic-gate } 2977c478bd9Sstevel@tonic-gate 2987c478bd9Sstevel@tonic-gate /* 2997c478bd9Sstevel@tonic-gate * getpublickey(netname, key) 3007c478bd9Sstevel@tonic-gate * 3017c478bd9Sstevel@tonic-gate * This is the actual exported interface for this function. 3027c478bd9Sstevel@tonic-gate */ 3037c478bd9Sstevel@tonic-gate 3047c478bd9Sstevel@tonic-gate int 30561961e0fSrobinson __getpublickey_cached(char *netname, char *pkey, int *from_cache) 3067c478bd9Sstevel@tonic-gate { 3077c478bd9Sstevel@tonic-gate return (__getpublickey_cached_g(netname, KEYSIZE, 0, pkey, 3087c478bd9Sstevel@tonic-gate HEXKEYBYTES+1, from_cache)); 3097c478bd9Sstevel@tonic-gate } 3107c478bd9Sstevel@tonic-gate 3117c478bd9Sstevel@tonic-gate int 31261961e0fSrobinson getpublickey(const char *netname, char *pkey) 3137c478bd9Sstevel@tonic-gate { 3147c478bd9Sstevel@tonic-gate return (__getpublickey_cached((char *)netname, pkey, (int *)0)); 3157c478bd9Sstevel@tonic-gate } 3167c478bd9Sstevel@tonic-gate 3177c478bd9Sstevel@tonic-gate void 3187c478bd9Sstevel@tonic-gate __getpublickey_flush(const char *netname) 3197c478bd9Sstevel@tonic-gate { 3207c478bd9Sstevel@tonic-gate __getpublickey_flush_g(netname, 192, 0); 3217c478bd9Sstevel@tonic-gate } 3227c478bd9Sstevel@tonic-gate 3237c478bd9Sstevel@tonic-gate int 32461961e0fSrobinson getsecretkey(const char *netname, char *skey, const char *passwd) 3257c478bd9Sstevel@tonic-gate { 3267c478bd9Sstevel@tonic-gate return (getsecretkey_g(netname, KEYSIZE, 0, skey, HEXKEYBYTES+1, 3277c478bd9Sstevel@tonic-gate passwd)); 3287c478bd9Sstevel@tonic-gate } 3297c478bd9Sstevel@tonic-gate 3307c478bd9Sstevel@tonic-gate /* 3317c478bd9Sstevel@tonic-gate * Routines to cache publickeys. 3327c478bd9Sstevel@tonic-gate */ 3337c478bd9Sstevel@tonic-gate 3347c478bd9Sstevel@tonic-gate static NIS_HASH_TABLE pkey_tbl; 3357c478bd9Sstevel@tonic-gate struct pkey_item { 3367c478bd9Sstevel@tonic-gate NIS_HASH_ITEM item; 3377c478bd9Sstevel@tonic-gate char *pkey; 3387c478bd9Sstevel@tonic-gate }; 3397c478bd9Sstevel@tonic-gate 3407c478bd9Sstevel@tonic-gate static void 34161961e0fSrobinson pkey_cache_add(const char *netname, char *pkey) 3427c478bd9Sstevel@tonic-gate { 3437c478bd9Sstevel@tonic-gate struct pkey_item *item; 3447c478bd9Sstevel@tonic-gate 34561961e0fSrobinson if (!netname || !pkey) { 3467c478bd9Sstevel@tonic-gate return; 3477c478bd9Sstevel@tonic-gate } 3487c478bd9Sstevel@tonic-gate 34961961e0fSrobinson item = calloc(1, sizeof (struct pkey_item)); 3507c478bd9Sstevel@tonic-gate if (item == NULL) { 3517c478bd9Sstevel@tonic-gate return; 3527c478bd9Sstevel@tonic-gate } 3537c478bd9Sstevel@tonic-gate item->item.name = strdup(netname); 3547c478bd9Sstevel@tonic-gate if (item->item.name == NULL) { 3557c478bd9Sstevel@tonic-gate free((void *)item); 3567c478bd9Sstevel@tonic-gate return; 3577c478bd9Sstevel@tonic-gate } 3587c478bd9Sstevel@tonic-gate item->pkey = strdup(pkey); 3597c478bd9Sstevel@tonic-gate if (item->pkey == 0) { 3607c478bd9Sstevel@tonic-gate free(item->item.name); 3617c478bd9Sstevel@tonic-gate free(item); 3627c478bd9Sstevel@tonic-gate return; 3637c478bd9Sstevel@tonic-gate } 3647c478bd9Sstevel@tonic-gate 3657c478bd9Sstevel@tonic-gate (void) mutex_lock(&serialize_pkey); 3667c478bd9Sstevel@tonic-gate if (!nis_insert_item((NIS_HASH_ITEM *)item, &pkey_tbl)) { 3677c478bd9Sstevel@tonic-gate free(item->item.name); 3687c478bd9Sstevel@tonic-gate free(item->pkey); 3697c478bd9Sstevel@tonic-gate free((void *)item); 3707c478bd9Sstevel@tonic-gate } 3717c478bd9Sstevel@tonic-gate (void) mutex_unlock(&serialize_pkey); 3727c478bd9Sstevel@tonic-gate } 3737c478bd9Sstevel@tonic-gate 3747c478bd9Sstevel@tonic-gate static int 37561961e0fSrobinson pkey_cache_get(const char *netname, char *pkey) 3767c478bd9Sstevel@tonic-gate { 3777c478bd9Sstevel@tonic-gate struct pkey_item *item; 3787c478bd9Sstevel@tonic-gate 37961961e0fSrobinson if (!netname || !pkey) { 3807c478bd9Sstevel@tonic-gate return (0); 3817c478bd9Sstevel@tonic-gate } 3827c478bd9Sstevel@tonic-gate 3837c478bd9Sstevel@tonic-gate (void) mutex_lock(&serialize_pkey); 3847c478bd9Sstevel@tonic-gate item = (struct pkey_item *)nis_find_item((char *)netname, &pkey_tbl); 3857c478bd9Sstevel@tonic-gate if (item) { 3867c478bd9Sstevel@tonic-gate (void) strcpy(pkey, item->pkey); 3877c478bd9Sstevel@tonic-gate } 3887c478bd9Sstevel@tonic-gate 3897c478bd9Sstevel@tonic-gate (void) mutex_unlock(&serialize_pkey); 3907c478bd9Sstevel@tonic-gate return (item != 0); 3917c478bd9Sstevel@tonic-gate } 3927c478bd9Sstevel@tonic-gate 3937c478bd9Sstevel@tonic-gate static void 39461961e0fSrobinson pkey_cache_flush(const char *netname) 3957c478bd9Sstevel@tonic-gate { 3967c478bd9Sstevel@tonic-gate struct pkey_item *item; 3977c478bd9Sstevel@tonic-gate 3987c478bd9Sstevel@tonic-gate (void) mutex_lock(&serialize_pkey); 3997c478bd9Sstevel@tonic-gate 4007c478bd9Sstevel@tonic-gate item = (struct pkey_item *)nis_remove_item((char *)netname, &pkey_tbl); 4017c478bd9Sstevel@tonic-gate if (item) { 4027c478bd9Sstevel@tonic-gate free(item->item.name); 4037c478bd9Sstevel@tonic-gate free(item->pkey); 4047c478bd9Sstevel@tonic-gate free((void *)item); 4057c478bd9Sstevel@tonic-gate } 4067c478bd9Sstevel@tonic-gate (void) mutex_unlock(&serialize_pkey); 4077c478bd9Sstevel@tonic-gate } 4087c478bd9Sstevel@tonic-gate 4097c478bd9Sstevel@tonic-gate /* 4107c478bd9Sstevel@tonic-gate * To avoid a potential deadlock with a single root domain NIS+ server 4117c478bd9Sstevel@tonic-gate * talking to a sub-sub-domain server, the NIS+ directory cache manager 4127c478bd9Sstevel@tonic-gate * code must be able to add public keys to the cache. Hence this routine. 4137c478bd9Sstevel@tonic-gate */ 4147c478bd9Sstevel@tonic-gate void 4157c478bd9Sstevel@tonic-gate __pkey_cache_add(char *netname, char *pkey, keylen_t pkeylen, 4167c478bd9Sstevel@tonic-gate algtype_t algtype) { 4177c478bd9Sstevel@tonic-gate 4187c478bd9Sstevel@tonic-gate char hashname[MAXNETNAMELEN+1]; 4197c478bd9Sstevel@tonic-gate 4207c478bd9Sstevel@tonic-gate pkey_cache_add(netname2hashname(netname, hashname, sizeof (hashname), 4217c478bd9Sstevel@tonic-gate pkeylen, algtype), pkey); 4227c478bd9Sstevel@tonic-gate } 4237c478bd9Sstevel@tonic-gate 4247c478bd9Sstevel@tonic-gate /* 4257c478bd9Sstevel@tonic-gate * Generic DH (any size keys) version of extract_secret. 4267c478bd9Sstevel@tonic-gate */ 4277c478bd9Sstevel@tonic-gate static int 4287c478bd9Sstevel@tonic-gate extract_secret_g( 4297c478bd9Sstevel@tonic-gate char *raw, /* in */ 4307c478bd9Sstevel@tonic-gate char *private, /* out */ 4317c478bd9Sstevel@tonic-gate int prilen, /* in */ 4327c478bd9Sstevel@tonic-gate char *passwd, /* in */ 4337c478bd9Sstevel@tonic-gate char *netname, /* in */ 4347c478bd9Sstevel@tonic-gate keylen_t keylen, /* in */ 4357c478bd9Sstevel@tonic-gate algtype_t algtype) /* in */ 4367c478bd9Sstevel@tonic-gate 4377c478bd9Sstevel@tonic-gate { 4387c478bd9Sstevel@tonic-gate char *buf = malloc(strlen(raw) + 1); /* private tmp buf */ 4397c478bd9Sstevel@tonic-gate char *p; 4407c478bd9Sstevel@tonic-gate 44161961e0fSrobinson if (!buf || !passwd || !raw || !private || !prilen || 44261961e0fSrobinson !VALID_KEYALG(keylen, algtype)) { 4437c478bd9Sstevel@tonic-gate if (private) 4447c478bd9Sstevel@tonic-gate *private = NUL; 4457c478bd9Sstevel@tonic-gate if (buf) 4467c478bd9Sstevel@tonic-gate free(buf); 4477c478bd9Sstevel@tonic-gate return (0); 4487c478bd9Sstevel@tonic-gate } 4497c478bd9Sstevel@tonic-gate 4507c478bd9Sstevel@tonic-gate (void) strcpy(buf, raw); 4517c478bd9Sstevel@tonic-gate 4527c478bd9Sstevel@tonic-gate /* strip off pesky colon if it exists */ 4537c478bd9Sstevel@tonic-gate p = strchr(buf, ':'); 4547c478bd9Sstevel@tonic-gate if (p) { 4557c478bd9Sstevel@tonic-gate *p = 0; 4567c478bd9Sstevel@tonic-gate } 4577c478bd9Sstevel@tonic-gate 4587c478bd9Sstevel@tonic-gate /* raw buf has chksum appended, so let's verify it too */ 45961961e0fSrobinson if (!xdecrypt_g(buf, keylen, algtype, passwd, netname, TRUE)) { 4607c478bd9Sstevel@tonic-gate private[0] = 0; 4617c478bd9Sstevel@tonic-gate free(buf); 4627c478bd9Sstevel@tonic-gate return (1); /* yes, return 1 even if xdecrypt fails */ 4637c478bd9Sstevel@tonic-gate } 4647c478bd9Sstevel@tonic-gate 4657c478bd9Sstevel@tonic-gate if (strlen(buf) >= prilen) { 4667c478bd9Sstevel@tonic-gate private[0] = 0; 4677c478bd9Sstevel@tonic-gate free(buf); 4687c478bd9Sstevel@tonic-gate return (0); 4697c478bd9Sstevel@tonic-gate } 4707c478bd9Sstevel@tonic-gate 4717c478bd9Sstevel@tonic-gate (void) strcpy(private, buf); 4727c478bd9Sstevel@tonic-gate free(buf); 4737c478bd9Sstevel@tonic-gate return (1); 4747c478bd9Sstevel@tonic-gate } 4757c478bd9Sstevel@tonic-gate 4767c478bd9Sstevel@tonic-gate /* 4777c478bd9Sstevel@tonic-gate * extract_secret() 4787c478bd9Sstevel@tonic-gate * 4797c478bd9Sstevel@tonic-gate * This generic function will extract the private key 4807c478bd9Sstevel@tonic-gate * from a string using the given password. Note that 4817c478bd9Sstevel@tonic-gate * it uses the DES based function xdecrypt() 4827c478bd9Sstevel@tonic-gate */ 4837c478bd9Sstevel@tonic-gate static int 48461961e0fSrobinson extract_secret(char *raw, char *private, char *passwd) 4857c478bd9Sstevel@tonic-gate { 4867c478bd9Sstevel@tonic-gate return (extract_secret_g(raw, private, HEXKEYBYTES+1, passwd, 4877c478bd9Sstevel@tonic-gate NULL, KEYSIZE, 0)); 4887c478bd9Sstevel@tonic-gate } 4897c478bd9Sstevel@tonic-gate 4907c478bd9Sstevel@tonic-gate /* 4917c478bd9Sstevel@tonic-gate * getkeys_nisplus_g() 4927c478bd9Sstevel@tonic-gate * 4937c478bd9Sstevel@tonic-gate * Fetches the key pair from NIS+. This version handles any size 4947c478bd9Sstevel@tonic-gate * DH keys. 4957c478bd9Sstevel@tonic-gate */ 4967c478bd9Sstevel@tonic-gate static int 4977c478bd9Sstevel@tonic-gate getkeys_nisplus_g( 4987c478bd9Sstevel@tonic-gate int *err, /* in */ 4997c478bd9Sstevel@tonic-gate char *netname, /* in */ 5007c478bd9Sstevel@tonic-gate char *pkey, /* out */ 5017c478bd9Sstevel@tonic-gate int pkeylen, /* in */ 5027c478bd9Sstevel@tonic-gate char *skey, /* out */ 5037c478bd9Sstevel@tonic-gate int skeylen, /* in */ 5047c478bd9Sstevel@tonic-gate char *passwd, /* in */ 5057c478bd9Sstevel@tonic-gate keylen_t keylen, /* in */ 5067c478bd9Sstevel@tonic-gate algtype_t algtype, /* in */ 5077c478bd9Sstevel@tonic-gate int *retry_cache) /* in/out */ 5087c478bd9Sstevel@tonic-gate { 5097c478bd9Sstevel@tonic-gate nis_result *res; 5107c478bd9Sstevel@tonic-gate int r = 0; 5117c478bd9Sstevel@tonic-gate char *domain, *p; 5127c478bd9Sstevel@tonic-gate char buf[NIS_MAXNAMELEN+1]; 5137c478bd9Sstevel@tonic-gate char keytypename[NIS_MAXNAMELEN+1]; 5147c478bd9Sstevel@tonic-gate int len; 5157c478bd9Sstevel@tonic-gate const bool_t classic_des = AUTH_DES_KEY(keylen, algtype); 5167c478bd9Sstevel@tonic-gate 5177c478bd9Sstevel@tonic-gate domain = strchr(netname, '@'); 51861961e0fSrobinson if (!domain) { 5197c478bd9Sstevel@tonic-gate *err = __NSW_UNAVAIL; 5207c478bd9Sstevel@tonic-gate return (0); 5217c478bd9Sstevel@tonic-gate } 5227c478bd9Sstevel@tonic-gate domain++; 5237c478bd9Sstevel@tonic-gate 5247c478bd9Sstevel@tonic-gate if (retry_cache != NULL && *retry_cache == 1) { 5257c478bd9Sstevel@tonic-gate nis_error bcerr; 5267c478bd9Sstevel@tonic-gate directory_obj obj; 5277c478bd9Sstevel@tonic-gate char hashname[MAXNETNAMELEN]; 5287c478bd9Sstevel@tonic-gate 5297c478bd9Sstevel@tonic-gate bcerr = __nis_CacheBind(domain, &obj); 5307c478bd9Sstevel@tonic-gate xdr_free(xdr_directory_obj, (char *)&obj); 5317c478bd9Sstevel@tonic-gate /* 5327c478bd9Sstevel@tonic-gate * Even if the __nis_CacheBind failed, we may have reached 5337c478bd9Sstevel@tonic-gate * part-way to the goal, so have another look in the public 5347c478bd9Sstevel@tonic-gate * key cache. 5357c478bd9Sstevel@tonic-gate */ 5367c478bd9Sstevel@tonic-gate if (pkey_cache_get(netname2hashname(netname, hashname, 5377c478bd9Sstevel@tonic-gate MAXNETNAMELEN, pkeylen, 5387c478bd9Sstevel@tonic-gate algtype), pkey)) { 5397c478bd9Sstevel@tonic-gate *err = __NSW_SUCCESS; 5407c478bd9Sstevel@tonic-gate return (1); 5417c478bd9Sstevel@tonic-gate } 5427c478bd9Sstevel@tonic-gate *retry_cache = 0; 5437c478bd9Sstevel@tonic-gate } 5447c478bd9Sstevel@tonic-gate 5457c478bd9Sstevel@tonic-gate if ((strlen(netname)+PKTABLE_LEN+strlen(domain)+32) > 5467c478bd9Sstevel@tonic-gate (size_t)NIS_MAXNAMELEN) { 5477c478bd9Sstevel@tonic-gate *err = __NSW_UNAVAIL; 5487c478bd9Sstevel@tonic-gate return (0); 5497c478bd9Sstevel@tonic-gate } 5507c478bd9Sstevel@tonic-gate 5517c478bd9Sstevel@tonic-gate /* 5527c478bd9Sstevel@tonic-gate * Cred table has following format for PK crypto entries: 5537c478bd9Sstevel@tonic-gate * cname auth_type auth_name public private 5547c478bd9Sstevel@tonic-gate * ---------------------------------------------------------- 5557c478bd9Sstevel@tonic-gate * nisname AT netname pubkey prikey 5567c478bd9Sstevel@tonic-gate * 5577c478bd9Sstevel@tonic-gate * where AT can be "DES" for classic AUTH_DES, or something like 5587c478bd9Sstevel@tonic-gate * "DH640-0" for a longer Diffie-Hellman key pair. 5597c478bd9Sstevel@tonic-gate */ 5607c478bd9Sstevel@tonic-gate if (classic_des) 5617c478bd9Sstevel@tonic-gate (void) strcpy(keytypename, des_caps_str); 5627c478bd9Sstevel@tonic-gate else 5637c478bd9Sstevel@tonic-gate (void) sprintf(keytypename, "%s%d-%d", 5647c478bd9Sstevel@tonic-gate dh_caps_str, keylen, algtype); 5657c478bd9Sstevel@tonic-gate (void) sprintf(buf, "[auth_name=\"%s\",auth_type=%s],%s.%s", 5667c478bd9Sstevel@tonic-gate netname, keytypename, PKTABLE, domain); 5677c478bd9Sstevel@tonic-gate if (buf[strlen(buf)-1] != '.') 5687c478bd9Sstevel@tonic-gate (void) strcat(buf, "."); 5697c478bd9Sstevel@tonic-gate 5707c478bd9Sstevel@tonic-gate /* 5717c478bd9Sstevel@tonic-gate * Because of some bootstrapping issues (keylogin, etc) the 5727c478bd9Sstevel@tonic-gate * keys lookup needs to be done without auth. This is 5737c478bd9Sstevel@tonic-gate * less-then-ideal from a security perspective and hopefully 5747c478bd9Sstevel@tonic-gate * will be revisited soon... 5757c478bd9Sstevel@tonic-gate */ 5767c478bd9Sstevel@tonic-gate res = nis_list(buf, USE_DGRAM+NO_AUTHINFO+FOLLOW_LINKS+FOLLOW_PATH, 5777c478bd9Sstevel@tonic-gate NULL, NULL); 5787c478bd9Sstevel@tonic-gate switch (res->status) { 5797c478bd9Sstevel@tonic-gate case NIS_SUCCESS: 5807c478bd9Sstevel@tonic-gate case NIS_S_SUCCESS: 5817c478bd9Sstevel@tonic-gate break; 5827c478bd9Sstevel@tonic-gate case NIS_NOTFOUND: 5837c478bd9Sstevel@tonic-gate case NIS_PARTIAL: 5847c478bd9Sstevel@tonic-gate case NIS_NOSUCHNAME: 5857c478bd9Sstevel@tonic-gate case NIS_NOSUCHTABLE: 5867c478bd9Sstevel@tonic-gate nis_freeresult(res); 5877c478bd9Sstevel@tonic-gate *err = __NSW_NOTFOUND; 5887c478bd9Sstevel@tonic-gate return (0); 5897c478bd9Sstevel@tonic-gate case NIS_S_NOTFOUND: 5907c478bd9Sstevel@tonic-gate case NIS_TRYAGAIN: 5917c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "getkeys: (nis+ key lookup): %s\n", 5927c478bd9Sstevel@tonic-gate nis_sperrno(res->status)); 5937c478bd9Sstevel@tonic-gate nis_freeresult(res); 5947c478bd9Sstevel@tonic-gate *err = __NSW_TRYAGAIN; 5957c478bd9Sstevel@tonic-gate return (0); 5967c478bd9Sstevel@tonic-gate default: 5977c478bd9Sstevel@tonic-gate *err = __NSW_UNAVAIL; 5987c478bd9Sstevel@tonic-gate syslog(LOG_ERR, 5997c478bd9Sstevel@tonic-gate "getkeys: (nis+ key lookup): %s\n", 6007c478bd9Sstevel@tonic-gate nis_sperrno(res->status)); 6017c478bd9Sstevel@tonic-gate nis_freeresult(res); 6027c478bd9Sstevel@tonic-gate return (0); 6037c478bd9Sstevel@tonic-gate } 6047c478bd9Sstevel@tonic-gate 6057c478bd9Sstevel@tonic-gate if (pkey) { 6067c478bd9Sstevel@tonic-gate char *key_start; 6077c478bd9Sstevel@tonic-gate char *colon_pos; 6087c478bd9Sstevel@tonic-gate 6097c478bd9Sstevel@tonic-gate /* 6107c478bd9Sstevel@tonic-gate * For backward compatibility with the old 6117c478bd9Sstevel@tonic-gate * cred.org_dir format, first locate the ":", if any, 6127c478bd9Sstevel@tonic-gate * and prepare to null it out. 6137c478bd9Sstevel@tonic-gate */ 6147c478bd9Sstevel@tonic-gate key_start = (char *)ENTRY_VAL(res->objects.objects_val, 3); 6157c478bd9Sstevel@tonic-gate colon_pos = strchr(key_start, ':'); 6167c478bd9Sstevel@tonic-gate 6177c478bd9Sstevel@tonic-gate /* 6187c478bd9Sstevel@tonic-gate * Set the value of len keeping in mind that both len 6197c478bd9Sstevel@tonic-gate * and pklen include space for the terminating null. 6207c478bd9Sstevel@tonic-gate */ 6217c478bd9Sstevel@tonic-gate 6227c478bd9Sstevel@tonic-gate if (colon_pos != NULL) 6237c478bd9Sstevel@tonic-gate /* 6247c478bd9Sstevel@tonic-gate * Set len to include the colon because that is 6257c478bd9Sstevel@tonic-gate * where the terminating null will be 6267c478bd9Sstevel@tonic-gate * placed. 6277c478bd9Sstevel@tonic-gate */ 6287c478bd9Sstevel@tonic-gate len = (int)((uintptr_t)colon_pos - 6297c478bd9Sstevel@tonic-gate (uintptr_t)key_start + 1); 6307c478bd9Sstevel@tonic-gate else 6317c478bd9Sstevel@tonic-gate /* 6327c478bd9Sstevel@tonic-gate * ENTRY_LEN already includes the terminating 6337c478bd9Sstevel@tonic-gate * null. 6347c478bd9Sstevel@tonic-gate */ 6357c478bd9Sstevel@tonic-gate len = ENTRY_LEN(res->objects.objects_val, 3); 6367c478bd9Sstevel@tonic-gate 6377c478bd9Sstevel@tonic-gate if (len > pkeylen) { 6387c478bd9Sstevel@tonic-gate *err = __NSW_UNAVAIL; 6397c478bd9Sstevel@tonic-gate syslog(LOG_ERR, 6407c478bd9Sstevel@tonic-gate "getkeys(nis+): pub key for '%s' (keytype = '%s') too long", 6417c478bd9Sstevel@tonic-gate netname, keytypename); 6427c478bd9Sstevel@tonic-gate nis_freeresult(res); 6437c478bd9Sstevel@tonic-gate return (0); 6447c478bd9Sstevel@tonic-gate } 6457c478bd9Sstevel@tonic-gate 6467c478bd9Sstevel@tonic-gate (void) strncpy(pkey, key_start, len); 6477c478bd9Sstevel@tonic-gate 6487c478bd9Sstevel@tonic-gate /* 6497c478bd9Sstevel@tonic-gate * Now null out the colon if it exists 6507c478bd9Sstevel@tonic-gate */ 6517c478bd9Sstevel@tonic-gate if (colon_pos != NULL) 6527c478bd9Sstevel@tonic-gate pkey[len-1] = NULL; 6537c478bd9Sstevel@tonic-gate 6547c478bd9Sstevel@tonic-gate } 6557c478bd9Sstevel@tonic-gate r = 1; /* At least public key was found; always true at this point */ 6567c478bd9Sstevel@tonic-gate 6577c478bd9Sstevel@tonic-gate if (skey && extract_secret_g(ENTRY_VAL(res->objects.objects_val, 4), 6587c478bd9Sstevel@tonic-gate skey, skeylen, passwd, netname, keylen, 6597c478bd9Sstevel@tonic-gate algtype)) 6607c478bd9Sstevel@tonic-gate r |= 2; 6617c478bd9Sstevel@tonic-gate 6627c478bd9Sstevel@tonic-gate nis_freeresult(res); 6637c478bd9Sstevel@tonic-gate *err = __NSW_SUCCESS; 6647c478bd9Sstevel@tonic-gate return (r); 6657c478bd9Sstevel@tonic-gate } 6667c478bd9Sstevel@tonic-gate 6677c478bd9Sstevel@tonic-gate 6687c478bd9Sstevel@tonic-gate /* 6697c478bd9Sstevel@tonic-gate * getkeys_ldap_g() 6707c478bd9Sstevel@tonic-gate * 6717c478bd9Sstevel@tonic-gate * Fetches the key pair from LDAP. This version handles any size 6727c478bd9Sstevel@tonic-gate * DH keys. 6737c478bd9Sstevel@tonic-gate */ 6747c478bd9Sstevel@tonic-gate 6757c478bd9Sstevel@tonic-gate void 6767c478bd9Sstevel@tonic-gate _nss_initf_publickey(nss_db_params_t *p) 6777c478bd9Sstevel@tonic-gate { 6787c478bd9Sstevel@tonic-gate p->name = NSS_DBNAM_PUBLICKEY; 6797c478bd9Sstevel@tonic-gate p->default_config = NSS_DEFCONF_PUBLICKEY; 6807c478bd9Sstevel@tonic-gate } 6817c478bd9Sstevel@tonic-gate 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate static int 6847c478bd9Sstevel@tonic-gate getkeys_ldap_g( 6857c478bd9Sstevel@tonic-gate int *err, /* in */ 6867c478bd9Sstevel@tonic-gate char *netname, /* in */ 6877c478bd9Sstevel@tonic-gate char *pkey, /* out */ 6887c478bd9Sstevel@tonic-gate int pkeylen, /* in */ 6897c478bd9Sstevel@tonic-gate char *skey, /* out */ 6907c478bd9Sstevel@tonic-gate int skeylen, /* in */ 6917c478bd9Sstevel@tonic-gate char *passwd, /* in */ 6927c478bd9Sstevel@tonic-gate keylen_t keylen, /* in */ 6937c478bd9Sstevel@tonic-gate algtype_t algtype) /* in */ 6947c478bd9Sstevel@tonic-gate { 6957c478bd9Sstevel@tonic-gate int r = 0; 6967c478bd9Sstevel@tonic-gate char *p; 6977c478bd9Sstevel@tonic-gate char keytypename[NIS_MAXNAMELEN+1]; 6987c478bd9Sstevel@tonic-gate int len; 6997c478bd9Sstevel@tonic-gate const bool_t classic_des = AUTH_DES_KEY(keylen, algtype); 7007c478bd9Sstevel@tonic-gate int rc = 0; 7017c478bd9Sstevel@tonic-gate nss_XbyY_args_t arg; 7027c478bd9Sstevel@tonic-gate nss_XbyY_buf_t *buf = NULL; 7037c478bd9Sstevel@tonic-gate char *keyval; 7047c478bd9Sstevel@tonic-gate 7057c478bd9Sstevel@tonic-gate NSS_XbyY_ALLOC(&buf, 0, NSS_BUFLEN_PUBLICKEY); 7067c478bd9Sstevel@tonic-gate 7077c478bd9Sstevel@tonic-gate NSS_XbyY_INIT(&arg, buf->result, buf->buffer, buf->buflen, NULL); 7087c478bd9Sstevel@tonic-gate arg.key.pkey.name = netname; 7097c478bd9Sstevel@tonic-gate 7107c478bd9Sstevel@tonic-gate /* 7117c478bd9Sstevel@tonic-gate * LDAP stores the public and secret key info in entries using 7127c478bd9Sstevel@tonic-gate * nisKeyObject objectclass. Each key is tagged with the 7137c478bd9Sstevel@tonic-gate * keytype, keylength, and algorithm. The tag has the following 7147c478bd9Sstevel@tonic-gate * format: {<keytype><keylength>-<algorithm>}. For example, 7157c478bd9Sstevel@tonic-gate * {DH192-0}. 7167c478bd9Sstevel@tonic-gate */ 7177c478bd9Sstevel@tonic-gate if (classic_des) 7187c478bd9Sstevel@tonic-gate (void) strcpy(keytypename, "{DH192-0}"); 7197c478bd9Sstevel@tonic-gate else 7207c478bd9Sstevel@tonic-gate (void) sprintf(keytypename, "{%s%d-%d}", 7217c478bd9Sstevel@tonic-gate dh_caps_str, keylen, algtype); 7227c478bd9Sstevel@tonic-gate arg.key.pkey.keytype = keytypename; 7237c478bd9Sstevel@tonic-gate 7247c478bd9Sstevel@tonic-gate if (nss_search(&db_root, _nss_initf_publickey, NSS_DBOP_KEYS_BYNAME, 7257c478bd9Sstevel@tonic-gate &arg) != NSS_SUCCESS) { 7267c478bd9Sstevel@tonic-gate NSS_XbyY_FREE(&buf); 7277c478bd9Sstevel@tonic-gate *err = __NSW_NOTFOUND; 7287c478bd9Sstevel@tonic-gate return (0); 7297c478bd9Sstevel@tonic-gate } 7307c478bd9Sstevel@tonic-gate keyval = buf->buffer; 7317c478bd9Sstevel@tonic-gate p = strchr(keyval, ':'); 7327c478bd9Sstevel@tonic-gate if (p == NULL) { 7337c478bd9Sstevel@tonic-gate NSS_XbyY_FREE(&buf); 7347c478bd9Sstevel@tonic-gate *err = __NSW_NOTFOUND; 7357c478bd9Sstevel@tonic-gate return (0); 7367c478bd9Sstevel@tonic-gate } 7377c478bd9Sstevel@tonic-gate *p = 0; 7387c478bd9Sstevel@tonic-gate if (pkey) { 7397c478bd9Sstevel@tonic-gate len = strlen(keyval); 7407c478bd9Sstevel@tonic-gate if (len > HEXKEYBYTES) { 7417c478bd9Sstevel@tonic-gate NSS_XbyY_FREE(&buf); 7427c478bd9Sstevel@tonic-gate *err = __NSW_NOTFOUND; 7437c478bd9Sstevel@tonic-gate return (0); 7447c478bd9Sstevel@tonic-gate } 7457c478bd9Sstevel@tonic-gate (void) strcpy(pkey, keyval); 7467c478bd9Sstevel@tonic-gate } 7477c478bd9Sstevel@tonic-gate r = 1; 7487c478bd9Sstevel@tonic-gate p++; 7497c478bd9Sstevel@tonic-gate if (skey && extract_secret(p, skey, passwd)) 7507c478bd9Sstevel@tonic-gate r |= 2; 7517c478bd9Sstevel@tonic-gate NSS_XbyY_FREE(&buf); 7527c478bd9Sstevel@tonic-gate *err = __NSW_SUCCESS; 7537c478bd9Sstevel@tonic-gate return (r); 7547c478bd9Sstevel@tonic-gate } 7557c478bd9Sstevel@tonic-gate 7567c478bd9Sstevel@tonic-gate 7577c478bd9Sstevel@tonic-gate /* 7587c478bd9Sstevel@tonic-gate * Convert a netname to a name we will hash on. For classic_des, 7597c478bd9Sstevel@tonic-gate * just copy netname as is. But for new and improved ("now in 7607c478bd9Sstevel@tonic-gate * new longer sizes!") DHEXT, add a ":keylen-algtype" suffix to hash on. 7617c478bd9Sstevel@tonic-gate * 7627c478bd9Sstevel@tonic-gate * Returns the hashname string on success or NULL on failure. 7637c478bd9Sstevel@tonic-gate */ 7647c478bd9Sstevel@tonic-gate static char * 7657c478bd9Sstevel@tonic-gate netname2hashname( 7667c478bd9Sstevel@tonic-gate const char *netname, 7677c478bd9Sstevel@tonic-gate char *hashname, 7687c478bd9Sstevel@tonic-gate int bufsiz, 7697c478bd9Sstevel@tonic-gate keylen_t keylen, 7707c478bd9Sstevel@tonic-gate algtype_t algtype) 7717c478bd9Sstevel@tonic-gate { 7727c478bd9Sstevel@tonic-gate const bool_t classic_des = AUTH_DES_KEY(keylen, algtype); 7737c478bd9Sstevel@tonic-gate 77461961e0fSrobinson if (!netname || !hashname || !bufsiz) 7757c478bd9Sstevel@tonic-gate return (NULL); 7767c478bd9Sstevel@tonic-gate 7777c478bd9Sstevel@tonic-gate if (classic_des) { 7787c478bd9Sstevel@tonic-gate if (bufsiz > strlen(netname)) 7797c478bd9Sstevel@tonic-gate (void) strcpy(hashname, netname); 78061961e0fSrobinson else 7817c478bd9Sstevel@tonic-gate return (NULL); 7827c478bd9Sstevel@tonic-gate } else { 7837c478bd9Sstevel@tonic-gate char tmp[128]; 7847c478bd9Sstevel@tonic-gate (void) sprintf(tmp, ":%d-%d", keylen, algtype); 7857c478bd9Sstevel@tonic-gate if (bufsiz > (strlen(netname) + strlen(tmp))) 7867c478bd9Sstevel@tonic-gate (void) sprintf(hashname, "%s%s", netname, tmp); 78761961e0fSrobinson else 7887c478bd9Sstevel@tonic-gate return (NULL); 7897c478bd9Sstevel@tonic-gate } 7907c478bd9Sstevel@tonic-gate 7917c478bd9Sstevel@tonic-gate return (hashname); 7927c478bd9Sstevel@tonic-gate } 7937c478bd9Sstevel@tonic-gate 7947c478bd9Sstevel@tonic-gate /* 7957c478bd9Sstevel@tonic-gate * Flush netname's publickey of the given key length and algorithm type. 7967c478bd9Sstevel@tonic-gate */ 7977c478bd9Sstevel@tonic-gate void 7987c478bd9Sstevel@tonic-gate __getpublickey_flush_g(const char *netname, keylen_t keylen, algtype_t algtype) 7997c478bd9Sstevel@tonic-gate { 8007c478bd9Sstevel@tonic-gate char *p, hashname[MAXNETNAMELEN+1]; 8017c478bd9Sstevel@tonic-gate 8027c478bd9Sstevel@tonic-gate p = netname2hashname(netname, hashname, MAXNETNAMELEN, keylen, algtype); 8037c478bd9Sstevel@tonic-gate if (p) 8047c478bd9Sstevel@tonic-gate pkey_cache_flush(hashname); 8057c478bd9Sstevel@tonic-gate } 8067c478bd9Sstevel@tonic-gate 8077c478bd9Sstevel@tonic-gate 8087c478bd9Sstevel@tonic-gate /* 8097c478bd9Sstevel@tonic-gate * Generic DH (any size keys) version of __getpublickey_cached. 8107c478bd9Sstevel@tonic-gate */ 8117c478bd9Sstevel@tonic-gate int 8127c478bd9Sstevel@tonic-gate __getpublickey_cached_g(const char netname[], /* in */ 8137c478bd9Sstevel@tonic-gate keylen_t keylen, /* in */ 8147c478bd9Sstevel@tonic-gate algtype_t algtype, /* in */ 8157c478bd9Sstevel@tonic-gate char *pkey, /* out */ 8167c478bd9Sstevel@tonic-gate size_t pkeylen, /* in */ 8177c478bd9Sstevel@tonic-gate int *from_cache) /* in/out */ 8187c478bd9Sstevel@tonic-gate { 8197c478bd9Sstevel@tonic-gate int needfree = 1, res, err; 8207c478bd9Sstevel@tonic-gate struct __nsw_switchconfig *conf; 8217c478bd9Sstevel@tonic-gate struct __nsw_lookup *look; 8227c478bd9Sstevel@tonic-gate enum __nsw_parse_err perr; 8237c478bd9Sstevel@tonic-gate const bool_t classic_des = AUTH_DES_KEY(keylen, algtype); 8247c478bd9Sstevel@tonic-gate int retry_cache = 0; 8257c478bd9Sstevel@tonic-gate 82661961e0fSrobinson if (!netname || !pkey) 8277c478bd9Sstevel@tonic-gate return (0); 8287c478bd9Sstevel@tonic-gate 8297c478bd9Sstevel@tonic-gate if (from_cache) { 8307c478bd9Sstevel@tonic-gate char hashname[MAXNETNAMELEN]; 8317c478bd9Sstevel@tonic-gate if (pkey_cache_get(netname2hashname(netname, hashname, 8327c478bd9Sstevel@tonic-gate MAXNETNAMELEN, keylen, 8337c478bd9Sstevel@tonic-gate algtype), pkey)) { 8347c478bd9Sstevel@tonic-gate *from_cache = 1; 8357c478bd9Sstevel@tonic-gate return (1); 8367c478bd9Sstevel@tonic-gate } 8377c478bd9Sstevel@tonic-gate *from_cache = 0; 8387c478bd9Sstevel@tonic-gate retry_cache = 1; 8397c478bd9Sstevel@tonic-gate } 8407c478bd9Sstevel@tonic-gate 8417c478bd9Sstevel@tonic-gate conf = __nsw_getconfig("publickey", &perr); 84261961e0fSrobinson if (!conf) { 8437c478bd9Sstevel@tonic-gate conf = &publickey_default; 8447c478bd9Sstevel@tonic-gate needfree = 0; 8457c478bd9Sstevel@tonic-gate } 8467c478bd9Sstevel@tonic-gate for (look = conf->lookups; look; look = look->next) { 8477c478bd9Sstevel@tonic-gate if (strcmp(look->service_name, "nisplus") == 0) { 8487c478bd9Sstevel@tonic-gate res = getkeys_nisplus_g(&err, (char *)netname, 84961961e0fSrobinson pkey, pkeylen, NULL, 0, NULL, 8507c478bd9Sstevel@tonic-gate keylen, algtype, &retry_cache); 8517c478bd9Sstevel@tonic-gate if (retry_cache) 8527c478bd9Sstevel@tonic-gate *from_cache = 1; 8537c478bd9Sstevel@tonic-gate } else if (strcmp(look->service_name, "ldap") == 0) { 8547c478bd9Sstevel@tonic-gate res = getkeys_ldap_g(&err, (char *)netname, 85561961e0fSrobinson pkey, pkeylen, NULL, 0, NULL, 8567c478bd9Sstevel@tonic-gate keylen, algtype); 8577c478bd9Sstevel@tonic-gate /* long DH keys will not be in nis or files */ 8587c478bd9Sstevel@tonic-gate } else if (classic_des && 8597c478bd9Sstevel@tonic-gate strcmp(look->service_name, "nis") == 0) 8607c478bd9Sstevel@tonic-gate res = getkeys_nis(&err, (char *)netname, pkey, 86161961e0fSrobinson NULL, NULL); 8627c478bd9Sstevel@tonic-gate else if (classic_des && 8637c478bd9Sstevel@tonic-gate strcmp(look->service_name, "files") == 0) 8647c478bd9Sstevel@tonic-gate res = getkeys_files(&err, (char *)netname, pkey, 86561961e0fSrobinson NULL, NULL); 8667c478bd9Sstevel@tonic-gate else { 8677c478bd9Sstevel@tonic-gate syslog(LOG_INFO, "Unknown publickey nameservice '%s'", 8687c478bd9Sstevel@tonic-gate look->service_name); 8697c478bd9Sstevel@tonic-gate err = __NSW_UNAVAIL; 8707c478bd9Sstevel@tonic-gate } 8717c478bd9Sstevel@tonic-gate 8727c478bd9Sstevel@tonic-gate /* 8737c478bd9Sstevel@tonic-gate * If we found the publickey, save it in the cache. 8747c478bd9Sstevel@tonic-gate * However, if retry_cache == 1, it's already been 8757c478bd9Sstevel@tonic-gate * added to the cache under our feet. 8767c478bd9Sstevel@tonic-gate */ 8777c478bd9Sstevel@tonic-gate if (err == __NSW_SUCCESS && !retry_cache) { 8787c478bd9Sstevel@tonic-gate char hashname[MAXNETNAMELEN]; 8797c478bd9Sstevel@tonic-gate pkey_cache_add(netname2hashname(netname, hashname, 8807c478bd9Sstevel@tonic-gate MAXNETNAMELEN, keylen, 8817c478bd9Sstevel@tonic-gate algtype), pkey); 8827c478bd9Sstevel@tonic-gate } 8837c478bd9Sstevel@tonic-gate 8847c478bd9Sstevel@tonic-gate switch (look->actions[err]) { 8857c478bd9Sstevel@tonic-gate case __NSW_CONTINUE : 8867c478bd9Sstevel@tonic-gate continue; 8877c478bd9Sstevel@tonic-gate case __NSW_RETURN : 8887c478bd9Sstevel@tonic-gate if (needfree) 8897c478bd9Sstevel@tonic-gate __nsw_freeconfig(conf); 8907c478bd9Sstevel@tonic-gate return ((res & 1) != 0); 8917c478bd9Sstevel@tonic-gate default : 8927c478bd9Sstevel@tonic-gate syslog(LOG_INFO, "Unknown action for nameservice %s", 8937c478bd9Sstevel@tonic-gate look->service_name); 8947c478bd9Sstevel@tonic-gate } 8957c478bd9Sstevel@tonic-gate } 8967c478bd9Sstevel@tonic-gate 8977c478bd9Sstevel@tonic-gate if (needfree) 8987c478bd9Sstevel@tonic-gate __nsw_freeconfig(conf); 8997c478bd9Sstevel@tonic-gate return (0); 9007c478bd9Sstevel@tonic-gate } 9017c478bd9Sstevel@tonic-gate 9027c478bd9Sstevel@tonic-gate 9037c478bd9Sstevel@tonic-gate /* 9047c478bd9Sstevel@tonic-gate * The public key cache (used by nisd in this case) must be filled with 9057c478bd9Sstevel@tonic-gate * the data in the NIS_COLD_START file in order for extended Diffie-Hellman 9067c478bd9Sstevel@tonic-gate * operations to work. 9077c478bd9Sstevel@tonic-gate */ 9087c478bd9Sstevel@tonic-gate void 9097c478bd9Sstevel@tonic-gate prime_pkey_cache(directory_obj *dobj) 9107c478bd9Sstevel@tonic-gate { 9117c478bd9Sstevel@tonic-gate int scount; 9127c478bd9Sstevel@tonic-gate 9137c478bd9Sstevel@tonic-gate for (scount = 0; scount < dobj->do_servers.do_servers_len; scount++) { 9147c478bd9Sstevel@tonic-gate nis_server *srv = &(dobj->do_servers.do_servers_val[scount]); 9157c478bd9Sstevel@tonic-gate extdhkey_t *keylens = NULL; 9167c478bd9Sstevel@tonic-gate char *pkey = NULL, hashname[MAXNETNAMELEN]; 9177c478bd9Sstevel@tonic-gate char netname[MAXNETNAMELEN]; 9187c478bd9Sstevel@tonic-gate int kcount, nkeys = 0; 9197c478bd9Sstevel@tonic-gate 9207c478bd9Sstevel@tonic-gate (void) host2netname(netname, srv->name, NULL); 9217c478bd9Sstevel@tonic-gate 9227c478bd9Sstevel@tonic-gate /* determine the number of keys to process */ 9237c478bd9Sstevel@tonic-gate if (!(nkeys = __nis_dhext_extract_keyinfo(srv, &keylens))) 9247c478bd9Sstevel@tonic-gate continue; 9257c478bd9Sstevel@tonic-gate 9267c478bd9Sstevel@tonic-gate /* store them */ 9277c478bd9Sstevel@tonic-gate if (srv->key_type == NIS_PK_DHEXT) { 9287c478bd9Sstevel@tonic-gate for (kcount = 0; kcount < nkeys; kcount++) { 9297c478bd9Sstevel@tonic-gate if (!netname2hashname(netname, hashname, 9307c478bd9Sstevel@tonic-gate MAXNETNAMELEN, 9317c478bd9Sstevel@tonic-gate keylens[kcount].keylen, 9327c478bd9Sstevel@tonic-gate keylens[kcount].algtype)) 9337c478bd9Sstevel@tonic-gate continue; 9347c478bd9Sstevel@tonic-gate 9357c478bd9Sstevel@tonic-gate if (!(pkey = __nis_dhext_extract_pkey( 9367c478bd9Sstevel@tonic-gate &srv->pkey, keylens[kcount].keylen, 9377c478bd9Sstevel@tonic-gate keylens[kcount].algtype))) 9387c478bd9Sstevel@tonic-gate continue; 9397c478bd9Sstevel@tonic-gate 9407c478bd9Sstevel@tonic-gate if (!pkey_cache_get(hashname, pkey)) 9417c478bd9Sstevel@tonic-gate pkey_cache_add(hashname, pkey); 9427c478bd9Sstevel@tonic-gate } 9437c478bd9Sstevel@tonic-gate } else if (srv->key_type == NIS_PK_DH) { 9447c478bd9Sstevel@tonic-gate pkey = srv->pkey.n_bytes; 9457c478bd9Sstevel@tonic-gate 9467c478bd9Sstevel@tonic-gate if (netname2hashname(netname, hashname, MAXNETNAMELEN, 9477c478bd9Sstevel@tonic-gate KEYSIZE, 0) && 9487c478bd9Sstevel@tonic-gate !pkey_cache_get(hashname, pkey)) 9497c478bd9Sstevel@tonic-gate pkey_cache_add(hashname, pkey); 9507c478bd9Sstevel@tonic-gate } 9517c478bd9Sstevel@tonic-gate if (keylens != NULL) 9527c478bd9Sstevel@tonic-gate free(keylens); 9537c478bd9Sstevel@tonic-gate keylens = NULL; 9547c478bd9Sstevel@tonic-gate } 9557c478bd9Sstevel@tonic-gate } 9567c478bd9Sstevel@tonic-gate 9577c478bd9Sstevel@tonic-gate /* 9587c478bd9Sstevel@tonic-gate * Generic (all sizes) DH version of getpublickey. 9597c478bd9Sstevel@tonic-gate */ 9607c478bd9Sstevel@tonic-gate int 9617c478bd9Sstevel@tonic-gate getpublickey_g( 9627c478bd9Sstevel@tonic-gate const char *netname, /* in */ 9637c478bd9Sstevel@tonic-gate int keylen, /* in */ 9647c478bd9Sstevel@tonic-gate int algtype, /* in */ 9657c478bd9Sstevel@tonic-gate char *pkey, /* out */ 9667c478bd9Sstevel@tonic-gate size_t pkeylen) /* in */ 9677c478bd9Sstevel@tonic-gate { 9687c478bd9Sstevel@tonic-gate return (__getpublickey_cached_g(netname, keylen, algtype, pkey, 9697c478bd9Sstevel@tonic-gate pkeylen, (int *)0)); 9707c478bd9Sstevel@tonic-gate } 9717c478bd9Sstevel@tonic-gate 9727c478bd9Sstevel@tonic-gate /* 9737c478bd9Sstevel@tonic-gate * Generic (all sizes) DH version of getsecretkey_g. 9747c478bd9Sstevel@tonic-gate */ 9757c478bd9Sstevel@tonic-gate int 9767c478bd9Sstevel@tonic-gate getsecretkey_g( 9777c478bd9Sstevel@tonic-gate const char *netname, /* in */ 9787c478bd9Sstevel@tonic-gate keylen_t keylen, /* in */ 9797c478bd9Sstevel@tonic-gate algtype_t algtype, /* in */ 9807c478bd9Sstevel@tonic-gate char *skey, /* out */ 9817c478bd9Sstevel@tonic-gate size_t skeylen, /* in */ 9827c478bd9Sstevel@tonic-gate const char *passwd) /* in */ 9837c478bd9Sstevel@tonic-gate { 9847c478bd9Sstevel@tonic-gate int needfree = 1, res, err; 9857c478bd9Sstevel@tonic-gate struct __nsw_switchconfig *conf; 9867c478bd9Sstevel@tonic-gate struct __nsw_lookup *look; 9877c478bd9Sstevel@tonic-gate enum __nsw_parse_err perr; 9887c478bd9Sstevel@tonic-gate const bool_t classic_des = AUTH_DES_KEY(keylen, algtype); 9897c478bd9Sstevel@tonic-gate 99061961e0fSrobinson if (!netname || !skey || !skeylen) 9917c478bd9Sstevel@tonic-gate return (0); 9927c478bd9Sstevel@tonic-gate 9937c478bd9Sstevel@tonic-gate conf = __nsw_getconfig("publickey", &perr); 9947c478bd9Sstevel@tonic-gate 99561961e0fSrobinson if (!conf) { 9967c478bd9Sstevel@tonic-gate conf = &publickey_default; 9977c478bd9Sstevel@tonic-gate needfree = 0; 9987c478bd9Sstevel@tonic-gate } 9997c478bd9Sstevel@tonic-gate 10007c478bd9Sstevel@tonic-gate for (look = conf->lookups; look; look = look->next) { 10017c478bd9Sstevel@tonic-gate if (strcmp(look->service_name, "nisplus") == 0) 10027c478bd9Sstevel@tonic-gate res = getkeys_nisplus_g(&err, (char *)netname, 100361961e0fSrobinson NULL, 0, skey, skeylen, 10047c478bd9Sstevel@tonic-gate (char *)passwd, keylen, algtype, 0); 10057c478bd9Sstevel@tonic-gate else if (strcmp(look->service_name, "ldap") == 0) 10067c478bd9Sstevel@tonic-gate res = getkeys_ldap_g(&err, (char *)netname, 100761961e0fSrobinson NULL, 0, skey, skeylen, 10087c478bd9Sstevel@tonic-gate (char *)passwd, keylen, algtype); 10097c478bd9Sstevel@tonic-gate /* long DH keys will not be in nis or files */ 10107c478bd9Sstevel@tonic-gate else if (classic_des && strcmp(look->service_name, "nis") == 0) 10117c478bd9Sstevel@tonic-gate res = getkeys_nis(&err, (char *)netname, 101261961e0fSrobinson NULL, skey, (char *)passwd); 10137c478bd9Sstevel@tonic-gate else if (classic_des && 10147c478bd9Sstevel@tonic-gate strcmp(look->service_name, "files") == 0) 10157c478bd9Sstevel@tonic-gate res = getkeys_files(&err, (char *)netname, 101661961e0fSrobinson NULL, skey, (char *)passwd); 10177c478bd9Sstevel@tonic-gate else { 10187c478bd9Sstevel@tonic-gate syslog(LOG_INFO, "Unknown publickey nameservice '%s'", 10197c478bd9Sstevel@tonic-gate look->service_name); 10207c478bd9Sstevel@tonic-gate err = __NSW_UNAVAIL; 10217c478bd9Sstevel@tonic-gate } 10227c478bd9Sstevel@tonic-gate switch (look->actions[err]) { 10237c478bd9Sstevel@tonic-gate case __NSW_CONTINUE : 10247c478bd9Sstevel@tonic-gate continue; 10257c478bd9Sstevel@tonic-gate case __NSW_RETURN : 10267c478bd9Sstevel@tonic-gate if (needfree) 10277c478bd9Sstevel@tonic-gate __nsw_freeconfig(conf); 10287c478bd9Sstevel@tonic-gate return ((res & 2) != 0); 10297c478bd9Sstevel@tonic-gate default : 10307c478bd9Sstevel@tonic-gate syslog(LOG_INFO, "Unknown action for nameservice %s", 10317c478bd9Sstevel@tonic-gate look->service_name); 10327c478bd9Sstevel@tonic-gate } 10337c478bd9Sstevel@tonic-gate } 10347c478bd9Sstevel@tonic-gate if (needfree) 10357c478bd9Sstevel@tonic-gate __nsw_freeconfig(conf); 10367c478bd9Sstevel@tonic-gate return (0); 10377c478bd9Sstevel@tonic-gate } 1038