1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Copyright 2002 Sun Microsystems, Inc. All rights reserved.
3*0Sstevel@tonic-gate * Use is subject to license terms.
4*0Sstevel@tonic-gate */
5*0Sstevel@tonic-gate
6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
7*0Sstevel@tonic-gate
8*0Sstevel@tonic-gate /*
9*0Sstevel@tonic-gate * usr/src/cmd/cmd-inet/usr.bin/telnet/encrypt.c
10*0Sstevel@tonic-gate */
11*0Sstevel@tonic-gate
12*0Sstevel@tonic-gate /*
13*0Sstevel@tonic-gate * Copyright (c) 1991, 1993
14*0Sstevel@tonic-gate * The Regents of the University of California. All rights reserved.
15*0Sstevel@tonic-gate *
16*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
17*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
18*0Sstevel@tonic-gate * are met:
19*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
20*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
21*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
22*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the
23*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution.
24*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software
25*0Sstevel@tonic-gate * must display the following acknowledgement:
26*0Sstevel@tonic-gate * This product includes software developed by the University of
27*0Sstevel@tonic-gate * California, Berkeley and its contributors.
28*0Sstevel@tonic-gate * 4. Neither the name of the University nor the names of its contributors
29*0Sstevel@tonic-gate * may be used to endorse or promote products derived from this software
30*0Sstevel@tonic-gate * without specific prior written permission.
31*0Sstevel@tonic-gate *
32*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
33*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
34*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
35*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
36*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
37*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
38*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
39*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
40*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
41*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42*0Sstevel@tonic-gate * SUCH DAMAGE.
43*0Sstevel@tonic-gate */
44*0Sstevel@tonic-gate
45*0Sstevel@tonic-gate /* based on @(#)encrypt.c 8.1 (Berkeley) 6/4/93 */
46*0Sstevel@tonic-gate
47*0Sstevel@tonic-gate /*
48*0Sstevel@tonic-gate * Copyright (C) 1990 by the Massachusetts Institute of Technology
49*0Sstevel@tonic-gate *
50*0Sstevel@tonic-gate * Export of this software from the United States of America may
51*0Sstevel@tonic-gate * require a specific license from the United States Government.
52*0Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
53*0Sstevel@tonic-gate * export to obtain such a license before exporting.
54*0Sstevel@tonic-gate *
55*0Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
56*0Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
57*0Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
58*0Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
59*0Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
60*0Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
61*0Sstevel@tonic-gate * to distribution of the software without specific, written prior
62*0Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
63*0Sstevel@tonic-gate * your software as modified software and not distribute it in such a
64*0Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
65*0Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
66*0Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
67*0Sstevel@tonic-gate * or implied warranty.
68*0Sstevel@tonic-gate */
69*0Sstevel@tonic-gate
70*0Sstevel@tonic-gate #ifdef lint
71*0Sstevel@tonic-gate static char *encrypt_names[] = {0};
72*0Sstevel@tonic-gate static char *enctype_names[] = {0};
73*0Sstevel@tonic-gate #else /* lint */
74*0Sstevel@tonic-gate #define ENCRYPT_NAMES
75*0Sstevel@tonic-gate #endif /* lint */
76*0Sstevel@tonic-gate #include <arpa/telnet.h>
77*0Sstevel@tonic-gate
78*0Sstevel@tonic-gate #include "externs.h"
79*0Sstevel@tonic-gate
80*0Sstevel@tonic-gate #ifdef __STDC__
81*0Sstevel@tonic-gate #include <stdlib.h>
82*0Sstevel@tonic-gate #endif
83*0Sstevel@tonic-gate
84*0Sstevel@tonic-gate /*
85*0Sstevel@tonic-gate * These functions pointers point to the current routines
86*0Sstevel@tonic-gate * for encrypting and decrypting data.
87*0Sstevel@tonic-gate */
88*0Sstevel@tonic-gate void (*encrypt_output)(uchar_t *, int);
89*0Sstevel@tonic-gate int (*decrypt_input)(int);
90*0Sstevel@tonic-gate static void encrypt_start_output(int);
91*0Sstevel@tonic-gate static void encrypt_send_end(void);
92*0Sstevel@tonic-gate static void encrypt_send_request_start(void);
93*0Sstevel@tonic-gate static void encrypt_send_request_end(void);
94*0Sstevel@tonic-gate
95*0Sstevel@tonic-gate boolean_t encrypt_debug_mode = B_FALSE;
96*0Sstevel@tonic-gate
97*0Sstevel@tonic-gate static int decrypt_mode = 0;
98*0Sstevel@tonic-gate static int encrypt_mode = 0;
99*0Sstevel@tonic-gate static boolean_t encrypt_verbose = B_FALSE;
100*0Sstevel@tonic-gate static boolean_t autoencrypt = B_FALSE;
101*0Sstevel@tonic-gate static boolean_t autodecrypt = B_FALSE;
102*0Sstevel@tonic-gate static char *Name = "Noname";
103*0Sstevel@tonic-gate
104*0Sstevel@tonic-gate #define typemask(x) ((x) > 0 ? 1 << ((x)-1) : 0)
105*0Sstevel@tonic-gate #define SUCCESS 0x00
106*0Sstevel@tonic-gate #define UNKNOWN gettext("(unknown)")
107*0Sstevel@tonic-gate
108*0Sstevel@tonic-gate static int i_support_encrypt = typemask(TELOPT_ENCTYPE_DES_CFB64);
109*0Sstevel@tonic-gate static int i_support_decrypt = typemask(TELOPT_ENCTYPE_DES_CFB64);
110*0Sstevel@tonic-gate static int i_wont_support_encrypt = 0;
111*0Sstevel@tonic-gate static int i_wont_support_decrypt = 0;
112*0Sstevel@tonic-gate #define I_SUPPORT_ENCRYPT (i_support_encrypt & ~i_wont_support_encrypt)
113*0Sstevel@tonic-gate #define I_SUPPORT_DECRYPT (i_support_decrypt & ~i_wont_support_decrypt)
114*0Sstevel@tonic-gate
115*0Sstevel@tonic-gate static int remote_supports_encrypt = 0;
116*0Sstevel@tonic-gate static int remote_supports_decrypt = 0;
117*0Sstevel@tonic-gate
118*0Sstevel@tonic-gate static Encryptions encryptions[] = {
119*0Sstevel@tonic-gate { "DES_CFB64", TELOPT_ENCTYPE_DES_CFB64,
120*0Sstevel@tonic-gate cfb64_encrypt,
121*0Sstevel@tonic-gate cfb64_decrypt,
122*0Sstevel@tonic-gate cfb64_init,
123*0Sstevel@tonic-gate cfb64_start,
124*0Sstevel@tonic-gate cfb64_is,
125*0Sstevel@tonic-gate cfb64_reply,
126*0Sstevel@tonic-gate cfb64_session,
127*0Sstevel@tonic-gate cfb64_keyid,
128*0Sstevel@tonic-gate cfb64_printsub },
129*0Sstevel@tonic-gate { 0, },
130*0Sstevel@tonic-gate };
131*0Sstevel@tonic-gate
132*0Sstevel@tonic-gate static uchar_t str_send[64] = { IAC, SB, TELOPT_ENCRYPT,
133*0Sstevel@tonic-gate ENCRYPT_SUPPORT };
134*0Sstevel@tonic-gate static uchar_t str_suplen = 0;
135*0Sstevel@tonic-gate static uchar_t str_start[72] = { IAC, SB, TELOPT_ENCRYPT };
136*0Sstevel@tonic-gate static uchar_t str_end[] = { IAC, SB, TELOPT_ENCRYPT, 0, IAC, SE };
137*0Sstevel@tonic-gate
138*0Sstevel@tonic-gate static Encryptions *
findencryption(int type)139*0Sstevel@tonic-gate findencryption(int type)
140*0Sstevel@tonic-gate {
141*0Sstevel@tonic-gate Encryptions *ep = encryptions;
142*0Sstevel@tonic-gate
143*0Sstevel@tonic-gate if (!(I_SUPPORT_ENCRYPT & remote_supports_decrypt & typemask(type)))
144*0Sstevel@tonic-gate return (NULL);
145*0Sstevel@tonic-gate for (; (ep->type != NULL) && (ep->type != type); ep++);
146*0Sstevel@tonic-gate return (ep->type ? ep : NULL);
147*0Sstevel@tonic-gate }
148*0Sstevel@tonic-gate
149*0Sstevel@tonic-gate static Encryptions *
finddecryption(int type)150*0Sstevel@tonic-gate finddecryption(int type)
151*0Sstevel@tonic-gate {
152*0Sstevel@tonic-gate Encryptions *ep = encryptions;
153*0Sstevel@tonic-gate
154*0Sstevel@tonic-gate if (!(I_SUPPORT_DECRYPT & remote_supports_encrypt & typemask(type)))
155*0Sstevel@tonic-gate return (NULL);
156*0Sstevel@tonic-gate while (ep->type && ep->type != type)
157*0Sstevel@tonic-gate ++ep;
158*0Sstevel@tonic-gate return (ep->type ? ep : NULL);
159*0Sstevel@tonic-gate }
160*0Sstevel@tonic-gate
161*0Sstevel@tonic-gate #define MAXKEYLEN 64
162*0Sstevel@tonic-gate
163*0Sstevel@tonic-gate static struct key_info {
164*0Sstevel@tonic-gate uchar_t keyid[MAXKEYLEN];
165*0Sstevel@tonic-gate int keylen;
166*0Sstevel@tonic-gate int dir;
167*0Sstevel@tonic-gate int *modep;
168*0Sstevel@tonic-gate Encryptions *(*getcrypt)();
169*0Sstevel@tonic-gate } ki[2] = {
170*0Sstevel@tonic-gate { { 0 }, 0, TELNET_DIR_ENCRYPT, &encrypt_mode, findencryption },
171*0Sstevel@tonic-gate { { 0 }, 0, TELNET_DIR_DECRYPT, &decrypt_mode, finddecryption },
172*0Sstevel@tonic-gate };
173*0Sstevel@tonic-gate #define KI_ENCRYPT 0
174*0Sstevel@tonic-gate #define KI_DECRYPT 1
175*0Sstevel@tonic-gate
176*0Sstevel@tonic-gate void
encrypt_init(char * name)177*0Sstevel@tonic-gate encrypt_init(char *name)
178*0Sstevel@tonic-gate {
179*0Sstevel@tonic-gate Encryptions *ep = encryptions;
180*0Sstevel@tonic-gate
181*0Sstevel@tonic-gate Name = name;
182*0Sstevel@tonic-gate i_support_encrypt = i_support_decrypt = 0;
183*0Sstevel@tonic-gate remote_supports_encrypt = remote_supports_decrypt = 0;
184*0Sstevel@tonic-gate encrypt_mode = 0;
185*0Sstevel@tonic-gate decrypt_mode = 0;
186*0Sstevel@tonic-gate encrypt_output = 0;
187*0Sstevel@tonic-gate decrypt_input = 0;
188*0Sstevel@tonic-gate #ifdef notdef
189*0Sstevel@tonic-gate encrypt_verbose = !server;
190*0Sstevel@tonic-gate #endif
191*0Sstevel@tonic-gate
192*0Sstevel@tonic-gate str_suplen = 4;
193*0Sstevel@tonic-gate
194*0Sstevel@tonic-gate while (ep->type) {
195*0Sstevel@tonic-gate if (encrypt_debug_mode)
196*0Sstevel@tonic-gate (void) printf(gettext(
197*0Sstevel@tonic-gate ">>>%s: I will support %s\r\n"),
198*0Sstevel@tonic-gate Name, ENCTYPE_NAME(ep->type));
199*0Sstevel@tonic-gate i_support_encrypt |= typemask(ep->type);
200*0Sstevel@tonic-gate i_support_decrypt |= typemask(ep->type);
201*0Sstevel@tonic-gate if ((i_wont_support_decrypt & typemask(ep->type)) == 0)
202*0Sstevel@tonic-gate if ((str_send[str_suplen++] = ep->type) == IAC)
203*0Sstevel@tonic-gate str_send[str_suplen++] = IAC;
204*0Sstevel@tonic-gate if (ep->init)
205*0Sstevel@tonic-gate (*ep->init)();
206*0Sstevel@tonic-gate ++ep;
207*0Sstevel@tonic-gate }
208*0Sstevel@tonic-gate str_send[str_suplen++] = IAC;
209*0Sstevel@tonic-gate str_send[str_suplen++] = SE;
210*0Sstevel@tonic-gate }
211*0Sstevel@tonic-gate
212*0Sstevel@tonic-gate static void
encrypt_list_types(void)213*0Sstevel@tonic-gate encrypt_list_types(void)
214*0Sstevel@tonic-gate {
215*0Sstevel@tonic-gate Encryptions *ep = encryptions;
216*0Sstevel@tonic-gate
217*0Sstevel@tonic-gate (void) printf(gettext("Valid encryption types:\n"));
218*0Sstevel@tonic-gate while (ep->type) {
219*0Sstevel@tonic-gate (void) printf("\t%s (%d)\r\n",
220*0Sstevel@tonic-gate ENCTYPE_NAME(ep->type), ep->type);
221*0Sstevel@tonic-gate ++ep;
222*0Sstevel@tonic-gate }
223*0Sstevel@tonic-gate }
224*0Sstevel@tonic-gate
225*0Sstevel@tonic-gate int
EncryptEnable(char * type,char * mode)226*0Sstevel@tonic-gate EncryptEnable(char *type, char *mode)
227*0Sstevel@tonic-gate {
228*0Sstevel@tonic-gate if (isprefix(type, "help") || isprefix(type, "?")) {
229*0Sstevel@tonic-gate (void) printf(gettext(
230*0Sstevel@tonic-gate "Usage: encrypt enable <type> [input|output]\n"));
231*0Sstevel@tonic-gate encrypt_list_types();
232*0Sstevel@tonic-gate return (0);
233*0Sstevel@tonic-gate }
234*0Sstevel@tonic-gate
235*0Sstevel@tonic-gate if (EncryptType(type, mode))
236*0Sstevel@tonic-gate return (EncryptStart(mode));
237*0Sstevel@tonic-gate
238*0Sstevel@tonic-gate return (0);
239*0Sstevel@tonic-gate }
240*0Sstevel@tonic-gate
241*0Sstevel@tonic-gate int
EncryptDisable(char * type,char * mode)242*0Sstevel@tonic-gate EncryptDisable(char *type, char *mode)
243*0Sstevel@tonic-gate {
244*0Sstevel@tonic-gate register Encryptions *ep;
245*0Sstevel@tonic-gate int ret = 0;
246*0Sstevel@tonic-gate
247*0Sstevel@tonic-gate if (isprefix(type, "help") || isprefix(type, "?")) {
248*0Sstevel@tonic-gate (void) printf(gettext(
249*0Sstevel@tonic-gate "Usage: encrypt disable <type> [input|output]\n"));
250*0Sstevel@tonic-gate encrypt_list_types();
251*0Sstevel@tonic-gate } else if ((ep = (Encryptions *)genget(type, (char **)encryptions,
252*0Sstevel@tonic-gate sizeof (Encryptions))) == 0) {
253*0Sstevel@tonic-gate (void) printf(gettext("%s: invalid encryption type\n"), type);
254*0Sstevel@tonic-gate } else if (Ambiguous(ep)) {
255*0Sstevel@tonic-gate (void) printf(gettext("Ambiguous type '%s'\n"), type);
256*0Sstevel@tonic-gate } else {
257*0Sstevel@tonic-gate if ((mode == 0) || (isprefix(mode, "input") ? 1 : 0)) {
258*0Sstevel@tonic-gate if (decrypt_mode == ep->type)
259*0Sstevel@tonic-gate (void) EncryptStopInput();
260*0Sstevel@tonic-gate i_wont_support_decrypt |= typemask(ep->type);
261*0Sstevel@tonic-gate ret = 1;
262*0Sstevel@tonic-gate }
263*0Sstevel@tonic-gate if ((mode == 0) || (isprefix(mode, "output"))) {
264*0Sstevel@tonic-gate if (encrypt_mode == ep->type)
265*0Sstevel@tonic-gate (void) EncryptStopOutput();
266*0Sstevel@tonic-gate i_wont_support_encrypt |= typemask(ep->type);
267*0Sstevel@tonic-gate ret = 1;
268*0Sstevel@tonic-gate }
269*0Sstevel@tonic-gate if (ret == 0)
270*0Sstevel@tonic-gate (void) printf(gettext(
271*0Sstevel@tonic-gate "%s: invalid encryption mode\n"), mode);
272*0Sstevel@tonic-gate }
273*0Sstevel@tonic-gate return (ret);
274*0Sstevel@tonic-gate }
275*0Sstevel@tonic-gate
276*0Sstevel@tonic-gate int
EncryptType(char * type,char * mode)277*0Sstevel@tonic-gate EncryptType(char *type, char *mode)
278*0Sstevel@tonic-gate {
279*0Sstevel@tonic-gate register Encryptions *ep;
280*0Sstevel@tonic-gate int ret = 0;
281*0Sstevel@tonic-gate
282*0Sstevel@tonic-gate if (isprefix(type, "help") || isprefix(type, "?")) {
283*0Sstevel@tonic-gate (void) printf(gettext(
284*0Sstevel@tonic-gate "Usage: encrypt type <type> [input|output]\n"));
285*0Sstevel@tonic-gate encrypt_list_types();
286*0Sstevel@tonic-gate } else if ((ep = (Encryptions *)genget(type, (char **)encryptions,
287*0Sstevel@tonic-gate sizeof (Encryptions))) == 0) {
288*0Sstevel@tonic-gate (void) printf(gettext("%s: invalid encryption type\n"), type);
289*0Sstevel@tonic-gate } else if (Ambiguous(ep)) {
290*0Sstevel@tonic-gate (void) printf(gettext("Ambiguous type '%s'\n"), type);
291*0Sstevel@tonic-gate } else {
292*0Sstevel@tonic-gate if ((mode == 0) || isprefix(mode, "input")) {
293*0Sstevel@tonic-gate decrypt_mode = ep->type;
294*0Sstevel@tonic-gate i_wont_support_decrypt &= ~typemask(ep->type);
295*0Sstevel@tonic-gate ret = 1;
296*0Sstevel@tonic-gate }
297*0Sstevel@tonic-gate if ((mode == 0) || isprefix(mode, "output")) {
298*0Sstevel@tonic-gate encrypt_mode = ep->type;
299*0Sstevel@tonic-gate i_wont_support_encrypt &= ~typemask(ep->type);
300*0Sstevel@tonic-gate ret = 1;
301*0Sstevel@tonic-gate }
302*0Sstevel@tonic-gate if (ret == 0)
303*0Sstevel@tonic-gate (void) printf(gettext(
304*0Sstevel@tonic-gate "%s: invalid encryption mode\n"), mode);
305*0Sstevel@tonic-gate }
306*0Sstevel@tonic-gate return (ret);
307*0Sstevel@tonic-gate }
308*0Sstevel@tonic-gate
309*0Sstevel@tonic-gate int
EncryptStart(char * mode)310*0Sstevel@tonic-gate EncryptStart(char *mode)
311*0Sstevel@tonic-gate {
312*0Sstevel@tonic-gate register int ret = 0;
313*0Sstevel@tonic-gate if (mode) {
314*0Sstevel@tonic-gate if (isprefix(mode, "input"))
315*0Sstevel@tonic-gate return (EncryptStartInput());
316*0Sstevel@tonic-gate if (isprefix(mode, "output"))
317*0Sstevel@tonic-gate return (EncryptStartOutput());
318*0Sstevel@tonic-gate if (isprefix(mode, "help") || isprefix(mode, "?")) {
319*0Sstevel@tonic-gate (void) printf(gettext(
320*0Sstevel@tonic-gate "Usage: encrypt start [input|output]\n"));
321*0Sstevel@tonic-gate return (0);
322*0Sstevel@tonic-gate }
323*0Sstevel@tonic-gate (void) printf(gettext(
324*0Sstevel@tonic-gate "%s: invalid encryption mode 'encrypt start ?' "
325*0Sstevel@tonic-gate "for help\n"), mode);
326*0Sstevel@tonic-gate return (0);
327*0Sstevel@tonic-gate }
328*0Sstevel@tonic-gate ret += EncryptStartInput();
329*0Sstevel@tonic-gate ret += EncryptStartOutput();
330*0Sstevel@tonic-gate return (ret);
331*0Sstevel@tonic-gate }
332*0Sstevel@tonic-gate
333*0Sstevel@tonic-gate int
EncryptStartInput(void)334*0Sstevel@tonic-gate EncryptStartInput(void)
335*0Sstevel@tonic-gate {
336*0Sstevel@tonic-gate if (decrypt_mode) {
337*0Sstevel@tonic-gate encrypt_send_request_start();
338*0Sstevel@tonic-gate return (1);
339*0Sstevel@tonic-gate }
340*0Sstevel@tonic-gate (void) printf(gettext("No previous decryption mode, "
341*0Sstevel@tonic-gate "decryption not enabled\r\n"));
342*0Sstevel@tonic-gate return (0);
343*0Sstevel@tonic-gate }
344*0Sstevel@tonic-gate
345*0Sstevel@tonic-gate int
EncryptStartOutput(void)346*0Sstevel@tonic-gate EncryptStartOutput(void)
347*0Sstevel@tonic-gate {
348*0Sstevel@tonic-gate if (encrypt_mode) {
349*0Sstevel@tonic-gate encrypt_start_output(encrypt_mode);
350*0Sstevel@tonic-gate return (1);
351*0Sstevel@tonic-gate }
352*0Sstevel@tonic-gate (void) printf(gettext("No previous encryption mode, "
353*0Sstevel@tonic-gate "encryption not enabled\r\n"));
354*0Sstevel@tonic-gate return (0);
355*0Sstevel@tonic-gate }
356*0Sstevel@tonic-gate
357*0Sstevel@tonic-gate int
EncryptStop(char * mode)358*0Sstevel@tonic-gate EncryptStop(char *mode)
359*0Sstevel@tonic-gate {
360*0Sstevel@tonic-gate int ret = 0;
361*0Sstevel@tonic-gate if (mode) {
362*0Sstevel@tonic-gate if (isprefix(mode, "input"))
363*0Sstevel@tonic-gate return (EncryptStopInput());
364*0Sstevel@tonic-gate if (isprefix(mode, "output"))
365*0Sstevel@tonic-gate return (EncryptStopOutput());
366*0Sstevel@tonic-gate if (isprefix(mode, "help") || isprefix(mode, "?")) {
367*0Sstevel@tonic-gate (void) printf(gettext(
368*0Sstevel@tonic-gate "Usage: encrypt stop [input|output]\n"));
369*0Sstevel@tonic-gate return (0);
370*0Sstevel@tonic-gate }
371*0Sstevel@tonic-gate (void) printf(gettext(
372*0Sstevel@tonic-gate "%s: invalid encryption mode 'encrypt stop ?' "
373*0Sstevel@tonic-gate "for help\n"), mode);
374*0Sstevel@tonic-gate return (0);
375*0Sstevel@tonic-gate }
376*0Sstevel@tonic-gate ret += EncryptStopInput();
377*0Sstevel@tonic-gate ret += EncryptStopOutput();
378*0Sstevel@tonic-gate return (ret);
379*0Sstevel@tonic-gate }
380*0Sstevel@tonic-gate
381*0Sstevel@tonic-gate int
EncryptStopInput(void)382*0Sstevel@tonic-gate EncryptStopInput(void)
383*0Sstevel@tonic-gate {
384*0Sstevel@tonic-gate encrypt_send_request_end();
385*0Sstevel@tonic-gate return (1);
386*0Sstevel@tonic-gate }
387*0Sstevel@tonic-gate
388*0Sstevel@tonic-gate int
EncryptStopOutput(void)389*0Sstevel@tonic-gate EncryptStopOutput(void)
390*0Sstevel@tonic-gate {
391*0Sstevel@tonic-gate encrypt_send_end();
392*0Sstevel@tonic-gate return (1);
393*0Sstevel@tonic-gate }
394*0Sstevel@tonic-gate
395*0Sstevel@tonic-gate void
encrypt_display(void)396*0Sstevel@tonic-gate encrypt_display(void)
397*0Sstevel@tonic-gate {
398*0Sstevel@tonic-gate if (encrypt_output)
399*0Sstevel@tonic-gate (void) printf(gettext(
400*0Sstevel@tonic-gate "Currently encrypting output with %s\r\n"),
401*0Sstevel@tonic-gate ENCTYPE_NAME(encrypt_mode));
402*0Sstevel@tonic-gate if (decrypt_input)
403*0Sstevel@tonic-gate (void) printf(gettext(
404*0Sstevel@tonic-gate "Currently decrypting input with %s\r\n"),
405*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode));
406*0Sstevel@tonic-gate }
407*0Sstevel@tonic-gate
408*0Sstevel@tonic-gate int
EncryptStatus(void)409*0Sstevel@tonic-gate EncryptStatus(void)
410*0Sstevel@tonic-gate {
411*0Sstevel@tonic-gate if (encrypt_output)
412*0Sstevel@tonic-gate (void) printf(gettext(
413*0Sstevel@tonic-gate "Currently encrypting output with %s\r\n"),
414*0Sstevel@tonic-gate ENCTYPE_NAME(encrypt_mode));
415*0Sstevel@tonic-gate else if (encrypt_mode) {
416*0Sstevel@tonic-gate (void) printf(gettext("Currently output is clear text.\r\n"));
417*0Sstevel@tonic-gate (void) printf(gettext("Last encryption mode was %s\r\n"),
418*0Sstevel@tonic-gate ENCTYPE_NAME(encrypt_mode));
419*0Sstevel@tonic-gate }
420*0Sstevel@tonic-gate if (decrypt_input) {
421*0Sstevel@tonic-gate (void) printf(gettext(
422*0Sstevel@tonic-gate "Currently decrypting input with %s\r\n"),
423*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode));
424*0Sstevel@tonic-gate } else if (decrypt_mode) {
425*0Sstevel@tonic-gate (void) printf(gettext("Currently input is clear text.\r\n"));
426*0Sstevel@tonic-gate (void) printf(gettext("Last decryption mode was %s\r\n"),
427*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode));
428*0Sstevel@tonic-gate }
429*0Sstevel@tonic-gate return (1);
430*0Sstevel@tonic-gate }
431*0Sstevel@tonic-gate
432*0Sstevel@tonic-gate void
encrypt_send_support(void)433*0Sstevel@tonic-gate encrypt_send_support(void)
434*0Sstevel@tonic-gate {
435*0Sstevel@tonic-gate if (str_suplen) {
436*0Sstevel@tonic-gate /*
437*0Sstevel@tonic-gate * If the user has requested that decryption start
438*0Sstevel@tonic-gate * immediatly, then send a "REQUEST START" before
439*0Sstevel@tonic-gate * we negotiate the type.
440*0Sstevel@tonic-gate */
441*0Sstevel@tonic-gate if (autodecrypt)
442*0Sstevel@tonic-gate encrypt_send_request_start();
443*0Sstevel@tonic-gate (void) net_write(str_send, str_suplen);
444*0Sstevel@tonic-gate printsub('>', &str_send[2], str_suplen - 2);
445*0Sstevel@tonic-gate str_suplen = 0;
446*0Sstevel@tonic-gate }
447*0Sstevel@tonic-gate }
448*0Sstevel@tonic-gate
449*0Sstevel@tonic-gate int
EncryptDebug(int on)450*0Sstevel@tonic-gate EncryptDebug(int on)
451*0Sstevel@tonic-gate {
452*0Sstevel@tonic-gate encrypt_debug_mode = (on < 0) ? !encrypt_debug_mode :
453*0Sstevel@tonic-gate (on > 0) ? B_TRUE : B_FALSE;
454*0Sstevel@tonic-gate (void) printf(encrypt_debug_mode ?
455*0Sstevel@tonic-gate gettext("Encryption debugging enabled\r\n") :
456*0Sstevel@tonic-gate gettext("Encryption debugging disabled\r\n"));
457*0Sstevel@tonic-gate return (1);
458*0Sstevel@tonic-gate }
459*0Sstevel@tonic-gate
460*0Sstevel@tonic-gate int
EncryptVerbose(int on)461*0Sstevel@tonic-gate EncryptVerbose(int on)
462*0Sstevel@tonic-gate {
463*0Sstevel@tonic-gate encrypt_verbose = (on < 0) ? !encrypt_verbose :
464*0Sstevel@tonic-gate (on > 0) ? B_TRUE : B_FALSE;
465*0Sstevel@tonic-gate (void) printf(encrypt_verbose ?
466*0Sstevel@tonic-gate gettext("Encryption is verbose\r\n") :
467*0Sstevel@tonic-gate gettext("Encryption is not verbose\r\n"));
468*0Sstevel@tonic-gate return (1);
469*0Sstevel@tonic-gate }
470*0Sstevel@tonic-gate
471*0Sstevel@tonic-gate int
EncryptAutoEnc(int on)472*0Sstevel@tonic-gate EncryptAutoEnc(int on)
473*0Sstevel@tonic-gate {
474*0Sstevel@tonic-gate encrypt_auto(on);
475*0Sstevel@tonic-gate (void) printf(autoencrypt ?
476*0Sstevel@tonic-gate gettext("Automatic encryption of output is enabled\r\n") :
477*0Sstevel@tonic-gate gettext("Automatic encryption of output is disabled\r\n"));
478*0Sstevel@tonic-gate return (1);
479*0Sstevel@tonic-gate }
480*0Sstevel@tonic-gate
481*0Sstevel@tonic-gate int
EncryptAutoDec(int on)482*0Sstevel@tonic-gate EncryptAutoDec(int on)
483*0Sstevel@tonic-gate {
484*0Sstevel@tonic-gate decrypt_auto(on);
485*0Sstevel@tonic-gate (void) printf(autodecrypt ?
486*0Sstevel@tonic-gate gettext("Automatic decryption of input is enabled\r\n") :
487*0Sstevel@tonic-gate gettext("Automatic decryption of input is disabled\r\n"));
488*0Sstevel@tonic-gate return (1);
489*0Sstevel@tonic-gate }
490*0Sstevel@tonic-gate
491*0Sstevel@tonic-gate /*
492*0Sstevel@tonic-gate * Called when ENCRYPT SUPPORT is received.
493*0Sstevel@tonic-gate */
494*0Sstevel@tonic-gate void
encrypt_support(uchar_t * typelist,int cnt)495*0Sstevel@tonic-gate encrypt_support(uchar_t *typelist, int cnt)
496*0Sstevel@tonic-gate {
497*0Sstevel@tonic-gate register int type, use_type = 0;
498*0Sstevel@tonic-gate Encryptions *ep;
499*0Sstevel@tonic-gate
500*0Sstevel@tonic-gate /*
501*0Sstevel@tonic-gate * Forget anything the other side has previously told us.
502*0Sstevel@tonic-gate */
503*0Sstevel@tonic-gate remote_supports_decrypt = 0;
504*0Sstevel@tonic-gate
505*0Sstevel@tonic-gate while (cnt-- > 0) {
506*0Sstevel@tonic-gate type = *typelist++;
507*0Sstevel@tonic-gate if (encrypt_debug_mode)
508*0Sstevel@tonic-gate (void) printf(gettext(
509*0Sstevel@tonic-gate ">>>%s: Remote host supports %s (%d)\r\n"),
510*0Sstevel@tonic-gate Name, ENCTYPE_NAME(type), type);
511*0Sstevel@tonic-gate if ((type < TELOPT_ENCTYPE_CNT) &&
512*0Sstevel@tonic-gate (I_SUPPORT_ENCRYPT & typemask(type))) {
513*0Sstevel@tonic-gate remote_supports_decrypt |= typemask(type);
514*0Sstevel@tonic-gate if (use_type == 0)
515*0Sstevel@tonic-gate use_type = type;
516*0Sstevel@tonic-gate }
517*0Sstevel@tonic-gate }
518*0Sstevel@tonic-gate if (use_type) {
519*0Sstevel@tonic-gate ep = findencryption(use_type);
520*0Sstevel@tonic-gate if (!ep)
521*0Sstevel@tonic-gate return;
522*0Sstevel@tonic-gate type = ep->start ? (*ep->start)(TELNET_DIR_ENCRYPT) : 0;
523*0Sstevel@tonic-gate if (encrypt_debug_mode)
524*0Sstevel@tonic-gate (void) printf(gettext(
525*0Sstevel@tonic-gate ">>>%s: (*ep->start)() returned %d\r\n"),
526*0Sstevel@tonic-gate Name, type);
527*0Sstevel@tonic-gate if (type < 0)
528*0Sstevel@tonic-gate return;
529*0Sstevel@tonic-gate encrypt_mode = use_type;
530*0Sstevel@tonic-gate if (type == 0)
531*0Sstevel@tonic-gate encrypt_start_output(use_type);
532*0Sstevel@tonic-gate }
533*0Sstevel@tonic-gate }
534*0Sstevel@tonic-gate
535*0Sstevel@tonic-gate void
encrypt_is(uchar_t * data,int cnt)536*0Sstevel@tonic-gate encrypt_is(uchar_t *data, int cnt)
537*0Sstevel@tonic-gate {
538*0Sstevel@tonic-gate Encryptions *ep;
539*0Sstevel@tonic-gate register int type, ret;
540*0Sstevel@tonic-gate
541*0Sstevel@tonic-gate if (--cnt < 0)
542*0Sstevel@tonic-gate return;
543*0Sstevel@tonic-gate type = *data++;
544*0Sstevel@tonic-gate if (type < TELOPT_ENCTYPE_CNT)
545*0Sstevel@tonic-gate remote_supports_encrypt |= typemask(type);
546*0Sstevel@tonic-gate if (!(ep = finddecryption(type))) {
547*0Sstevel@tonic-gate if (encrypt_debug_mode)
548*0Sstevel@tonic-gate (void) printf(gettext(
549*0Sstevel@tonic-gate ">>>%s: Can't find type %s (%d) for "
550*0Sstevel@tonic-gate "initial negotiation\r\n"), Name,
551*0Sstevel@tonic-gate ENCTYPE_NAME_OK(type) ?
552*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type);
553*0Sstevel@tonic-gate return;
554*0Sstevel@tonic-gate }
555*0Sstevel@tonic-gate if (!ep->is) {
556*0Sstevel@tonic-gate if (encrypt_debug_mode)
557*0Sstevel@tonic-gate (void) printf(gettext(
558*0Sstevel@tonic-gate ">>>%s: No initial negotiation needed "
559*0Sstevel@tonic-gate "for type %s (%d)\r\n"), Name,
560*0Sstevel@tonic-gate ENCTYPE_NAME_OK(type) ?
561*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type);
562*0Sstevel@tonic-gate ret = 0;
563*0Sstevel@tonic-gate } else {
564*0Sstevel@tonic-gate ret = (*ep->is)(data, cnt);
565*0Sstevel@tonic-gate if (encrypt_debug_mode)
566*0Sstevel@tonic-gate (void) printf(gettext(
567*0Sstevel@tonic-gate "(*ep->is)(%x, %d) returned %s(%d)\n"),
568*0Sstevel@tonic-gate data, cnt, (ret < 0) ? "FAIL " :
569*0Sstevel@tonic-gate (ret == 0) ? "SUCCESS " : "MORE_TO_DO ", ret);
570*0Sstevel@tonic-gate }
571*0Sstevel@tonic-gate if (ret < 0) {
572*0Sstevel@tonic-gate autodecrypt = B_FALSE;
573*0Sstevel@tonic-gate } else {
574*0Sstevel@tonic-gate decrypt_mode = type;
575*0Sstevel@tonic-gate if (ret == 0 && autodecrypt)
576*0Sstevel@tonic-gate encrypt_send_request_start();
577*0Sstevel@tonic-gate }
578*0Sstevel@tonic-gate }
579*0Sstevel@tonic-gate
580*0Sstevel@tonic-gate void
encrypt_reply(uchar_t * data,int cnt)581*0Sstevel@tonic-gate encrypt_reply(uchar_t *data, int cnt)
582*0Sstevel@tonic-gate {
583*0Sstevel@tonic-gate Encryptions *ep;
584*0Sstevel@tonic-gate register int ret, type;
585*0Sstevel@tonic-gate
586*0Sstevel@tonic-gate if (--cnt < 0)
587*0Sstevel@tonic-gate return;
588*0Sstevel@tonic-gate type = *data++;
589*0Sstevel@tonic-gate if (!(ep = findencryption(type))) {
590*0Sstevel@tonic-gate if (encrypt_debug_mode)
591*0Sstevel@tonic-gate (void) printf(gettext(
592*0Sstevel@tonic-gate ">>>%s: Can't find type %s (%d) "
593*0Sstevel@tonic-gate "for initial negotiation\r\n"), Name,
594*0Sstevel@tonic-gate ENCTYPE_NAME_OK(type) ?
595*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type);
596*0Sstevel@tonic-gate return;
597*0Sstevel@tonic-gate }
598*0Sstevel@tonic-gate if (!ep->reply) {
599*0Sstevel@tonic-gate if (encrypt_debug_mode)
600*0Sstevel@tonic-gate (void) printf(gettext(
601*0Sstevel@tonic-gate ">>>%s: No initial negotiation needed "
602*0Sstevel@tonic-gate "for type %s (%d)\r\n"), Name,
603*0Sstevel@tonic-gate ENCTYPE_NAME_OK(type) ?
604*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type);
605*0Sstevel@tonic-gate ret = 0;
606*0Sstevel@tonic-gate } else {
607*0Sstevel@tonic-gate ret = (*ep->reply)(data, cnt);
608*0Sstevel@tonic-gate if (encrypt_debug_mode)
609*0Sstevel@tonic-gate (void) printf(gettext(
610*0Sstevel@tonic-gate "(*ep->reply)(%x, %d) returned %s(%d)\n"),
611*0Sstevel@tonic-gate data, cnt, (ret < 0) ? "FAIL " :
612*0Sstevel@tonic-gate (ret == 0) ? "SUCCESS " : "MORE_TO_DO ", ret);
613*0Sstevel@tonic-gate }
614*0Sstevel@tonic-gate if (encrypt_debug_mode)
615*0Sstevel@tonic-gate (void) printf(gettext(
616*0Sstevel@tonic-gate ">>>%s: encrypt_reply returned %d\n"), Name, ret);
617*0Sstevel@tonic-gate if (ret < 0) {
618*0Sstevel@tonic-gate autoencrypt = B_FALSE;
619*0Sstevel@tonic-gate } else {
620*0Sstevel@tonic-gate encrypt_mode = type;
621*0Sstevel@tonic-gate if (ret == 0 && autoencrypt)
622*0Sstevel@tonic-gate encrypt_start_output(type);
623*0Sstevel@tonic-gate }
624*0Sstevel@tonic-gate }
625*0Sstevel@tonic-gate
626*0Sstevel@tonic-gate /*
627*0Sstevel@tonic-gate * Called when a ENCRYPT START command is received.
628*0Sstevel@tonic-gate */
629*0Sstevel@tonic-gate /* ARGSUSED */
630*0Sstevel@tonic-gate void
encrypt_start(uchar_t * data,int cnt)631*0Sstevel@tonic-gate encrypt_start(uchar_t *data, int cnt)
632*0Sstevel@tonic-gate {
633*0Sstevel@tonic-gate Encryptions *ep;
634*0Sstevel@tonic-gate
635*0Sstevel@tonic-gate if (!decrypt_mode) {
636*0Sstevel@tonic-gate /*
637*0Sstevel@tonic-gate * Something is wrong. We should not get a START
638*0Sstevel@tonic-gate * command without having already picked our
639*0Sstevel@tonic-gate * decryption scheme. Send a REQUEST-END to
640*0Sstevel@tonic-gate * attempt to clear the channel...
641*0Sstevel@tonic-gate */
642*0Sstevel@tonic-gate (void) printf(gettext("%s: Warning, cannot decrypt "
643*0Sstevel@tonic-gate "input stream!!!\r\n"), Name);
644*0Sstevel@tonic-gate encrypt_send_request_end();
645*0Sstevel@tonic-gate return;
646*0Sstevel@tonic-gate }
647*0Sstevel@tonic-gate
648*0Sstevel@tonic-gate if (ep = finddecryption(decrypt_mode)) {
649*0Sstevel@tonic-gate decrypt_input = ep->input;
650*0Sstevel@tonic-gate if (encrypt_verbose)
651*0Sstevel@tonic-gate (void) printf(gettext(
652*0Sstevel@tonic-gate "[ Input is now decrypted with type %s ]\r\n"),
653*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode));
654*0Sstevel@tonic-gate if (encrypt_debug_mode)
655*0Sstevel@tonic-gate (void) printf(gettext(
656*0Sstevel@tonic-gate ">>>%s: Start to decrypt input with type %s\r\n"),
657*0Sstevel@tonic-gate Name, ENCTYPE_NAME(decrypt_mode));
658*0Sstevel@tonic-gate } else {
659*0Sstevel@tonic-gate (void) printf(gettext(
660*0Sstevel@tonic-gate "%s: Warning, cannot decrypt type %s (%d)!!!\r\n"),
661*0Sstevel@tonic-gate Name, ENCTYPE_NAME_OK(decrypt_mode) ?
662*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode) : UNKNOWN,
663*0Sstevel@tonic-gate decrypt_mode);
664*0Sstevel@tonic-gate encrypt_send_request_end();
665*0Sstevel@tonic-gate }
666*0Sstevel@tonic-gate }
667*0Sstevel@tonic-gate
668*0Sstevel@tonic-gate void
encrypt_session_key(Session_Key * key)669*0Sstevel@tonic-gate encrypt_session_key(Session_Key *key)
670*0Sstevel@tonic-gate {
671*0Sstevel@tonic-gate Encryptions *ep = encryptions;
672*0Sstevel@tonic-gate
673*0Sstevel@tonic-gate while (ep->type) {
674*0Sstevel@tonic-gate if (ep->session)
675*0Sstevel@tonic-gate (*ep->session)(key);
676*0Sstevel@tonic-gate #ifdef notdef
677*0Sstevel@tonic-gate if (!encrypt_output && autoencrypt)
678*0Sstevel@tonic-gate encrypt_start_output(ep->type);
679*0Sstevel@tonic-gate if (!decrypt_input && autodecrypt)
680*0Sstevel@tonic-gate encrypt_send_request_start();
681*0Sstevel@tonic-gate #endif
682*0Sstevel@tonic-gate ++ep;
683*0Sstevel@tonic-gate }
684*0Sstevel@tonic-gate }
685*0Sstevel@tonic-gate
686*0Sstevel@tonic-gate /*
687*0Sstevel@tonic-gate * Called when ENCRYPT END is received.
688*0Sstevel@tonic-gate */
689*0Sstevel@tonic-gate void
encrypt_end(void)690*0Sstevel@tonic-gate encrypt_end(void)
691*0Sstevel@tonic-gate {
692*0Sstevel@tonic-gate decrypt_input = 0;
693*0Sstevel@tonic-gate if (encrypt_debug_mode)
694*0Sstevel@tonic-gate (void) printf(gettext(
695*0Sstevel@tonic-gate ">>>%s: Input is back to clear text\r\n"), Name);
696*0Sstevel@tonic-gate if (encrypt_verbose)
697*0Sstevel@tonic-gate (void) printf(gettext("[ Input is now clear text ]\r\n"));
698*0Sstevel@tonic-gate }
699*0Sstevel@tonic-gate
700*0Sstevel@tonic-gate /*
701*0Sstevel@tonic-gate * Called when ENCRYPT REQUEST-END is received.
702*0Sstevel@tonic-gate */
703*0Sstevel@tonic-gate void
encrypt_request_end(void)704*0Sstevel@tonic-gate encrypt_request_end(void)
705*0Sstevel@tonic-gate {
706*0Sstevel@tonic-gate encrypt_send_end();
707*0Sstevel@tonic-gate }
708*0Sstevel@tonic-gate
709*0Sstevel@tonic-gate /*
710*0Sstevel@tonic-gate * Called when ENCRYPT REQUEST-START is received. If we receive
711*0Sstevel@tonic-gate * this before a type is picked, then that indicates that the
712*0Sstevel@tonic-gate * other side wants us to start encrypting data as soon as we
713*0Sstevel@tonic-gate * can.
714*0Sstevel@tonic-gate */
715*0Sstevel@tonic-gate /* ARGSUSED */
716*0Sstevel@tonic-gate void
encrypt_request_start(uchar_t * data,int cnt)717*0Sstevel@tonic-gate encrypt_request_start(uchar_t *data, int cnt)
718*0Sstevel@tonic-gate {
719*0Sstevel@tonic-gate if (encrypt_mode == 0)
720*0Sstevel@tonic-gate return;
721*0Sstevel@tonic-gate encrypt_start_output(encrypt_mode);
722*0Sstevel@tonic-gate }
723*0Sstevel@tonic-gate
724*0Sstevel@tonic-gate static uchar_t str_keyid[(MAXKEYLEN*2)+5] = { IAC, SB, TELOPT_ENCRYPT };
725*0Sstevel@tonic-gate static void encrypt_keyid(struct key_info *, uchar_t *, int);
726*0Sstevel@tonic-gate
727*0Sstevel@tonic-gate void
encrypt_enc_keyid(uchar_t * keyid,int len)728*0Sstevel@tonic-gate encrypt_enc_keyid(uchar_t *keyid, int len)
729*0Sstevel@tonic-gate {
730*0Sstevel@tonic-gate encrypt_keyid(&ki[KI_DECRYPT], keyid, len);
731*0Sstevel@tonic-gate }
732*0Sstevel@tonic-gate
733*0Sstevel@tonic-gate void
encrypt_dec_keyid(uchar_t * keyid,int len)734*0Sstevel@tonic-gate encrypt_dec_keyid(uchar_t *keyid, int len)
735*0Sstevel@tonic-gate {
736*0Sstevel@tonic-gate encrypt_keyid(&ki[KI_ENCRYPT], keyid, len);
737*0Sstevel@tonic-gate }
738*0Sstevel@tonic-gate
739*0Sstevel@tonic-gate static void
encrypt_keyid(struct key_info * kp,uchar_t * keyid,int len)740*0Sstevel@tonic-gate encrypt_keyid(struct key_info *kp, uchar_t *keyid, int len)
741*0Sstevel@tonic-gate {
742*0Sstevel@tonic-gate Encryptions *ep;
743*0Sstevel@tonic-gate int dir = kp->dir;
744*0Sstevel@tonic-gate register int ret = 0;
745*0Sstevel@tonic-gate
746*0Sstevel@tonic-gate if (!(ep = (*kp->getcrypt)(*kp->modep))) {
747*0Sstevel@tonic-gate if (len == 0)
748*0Sstevel@tonic-gate return;
749*0Sstevel@tonic-gate kp->keylen = 0;
750*0Sstevel@tonic-gate } else if (len == 0) {
751*0Sstevel@tonic-gate /*
752*0Sstevel@tonic-gate * Empty option, indicates a failure.
753*0Sstevel@tonic-gate */
754*0Sstevel@tonic-gate if (kp->keylen == 0)
755*0Sstevel@tonic-gate return;
756*0Sstevel@tonic-gate kp->keylen = 0;
757*0Sstevel@tonic-gate if (ep->keyid)
758*0Sstevel@tonic-gate (void) (*ep->keyid)(dir, kp->keyid, &kp->keylen);
759*0Sstevel@tonic-gate
760*0Sstevel@tonic-gate } else if ((len != kp->keylen) ||
761*0Sstevel@tonic-gate (memcmp(keyid, kp->keyid, len) != 0)) {
762*0Sstevel@tonic-gate /*
763*0Sstevel@tonic-gate * Length or contents are different
764*0Sstevel@tonic-gate */
765*0Sstevel@tonic-gate kp->keylen = len;
766*0Sstevel@tonic-gate (void) memcpy(kp->keyid, keyid, len);
767*0Sstevel@tonic-gate if (ep->keyid)
768*0Sstevel@tonic-gate (void) (*ep->keyid)(dir, kp->keyid, &kp->keylen);
769*0Sstevel@tonic-gate } else {
770*0Sstevel@tonic-gate if (ep->keyid)
771*0Sstevel@tonic-gate ret = (*ep->keyid)(dir, kp->keyid, &kp->keylen);
772*0Sstevel@tonic-gate if ((ret == 0) && (dir == TELNET_DIR_ENCRYPT) && autoencrypt)
773*0Sstevel@tonic-gate encrypt_start_output(*kp->modep);
774*0Sstevel@tonic-gate return;
775*0Sstevel@tonic-gate }
776*0Sstevel@tonic-gate
777*0Sstevel@tonic-gate encrypt_send_keyid(dir, kp->keyid, kp->keylen, 0);
778*0Sstevel@tonic-gate }
779*0Sstevel@tonic-gate
780*0Sstevel@tonic-gate void
encrypt_send_keyid(int dir,uchar_t * keyid,int keylen,int saveit)781*0Sstevel@tonic-gate encrypt_send_keyid(int dir, uchar_t *keyid, int keylen, int saveit)
782*0Sstevel@tonic-gate {
783*0Sstevel@tonic-gate uchar_t *strp;
784*0Sstevel@tonic-gate
785*0Sstevel@tonic-gate str_keyid[3] = (dir == TELNET_DIR_ENCRYPT)
786*0Sstevel@tonic-gate ? ENCRYPT_ENC_KEYID : ENCRYPT_DEC_KEYID;
787*0Sstevel@tonic-gate if (saveit) {
788*0Sstevel@tonic-gate struct key_info *kp = &ki[(dir == TELNET_DIR_ENCRYPT) ? 0 : 1];
789*0Sstevel@tonic-gate (void) memcpy(kp->keyid, keyid, keylen);
790*0Sstevel@tonic-gate kp->keylen = keylen;
791*0Sstevel@tonic-gate }
792*0Sstevel@tonic-gate
793*0Sstevel@tonic-gate for (strp = &str_keyid[4]; keylen > 0; --keylen) {
794*0Sstevel@tonic-gate if ((*strp++ = *keyid++) == IAC)
795*0Sstevel@tonic-gate *strp++ = IAC;
796*0Sstevel@tonic-gate }
797*0Sstevel@tonic-gate *strp++ = IAC;
798*0Sstevel@tonic-gate *strp++ = SE;
799*0Sstevel@tonic-gate (void) net_write(str_keyid, strp - str_keyid);
800*0Sstevel@tonic-gate printsub('>', &str_keyid[2], strp - str_keyid - 2);
801*0Sstevel@tonic-gate }
802*0Sstevel@tonic-gate
803*0Sstevel@tonic-gate void
encrypt_auto(int on)804*0Sstevel@tonic-gate encrypt_auto(int on)
805*0Sstevel@tonic-gate {
806*0Sstevel@tonic-gate autoencrypt = (on < 0) ? !autoencrypt :
807*0Sstevel@tonic-gate (on > 0) ? B_TRUE : B_FALSE;
808*0Sstevel@tonic-gate }
809*0Sstevel@tonic-gate
810*0Sstevel@tonic-gate void
decrypt_auto(int on)811*0Sstevel@tonic-gate decrypt_auto(int on)
812*0Sstevel@tonic-gate {
813*0Sstevel@tonic-gate autodecrypt = (on < 0) ? !autodecrypt :
814*0Sstevel@tonic-gate (on > 0) ? B_TRUE : B_FALSE;
815*0Sstevel@tonic-gate }
816*0Sstevel@tonic-gate
817*0Sstevel@tonic-gate static void
encrypt_start_output(int type)818*0Sstevel@tonic-gate encrypt_start_output(int type)
819*0Sstevel@tonic-gate {
820*0Sstevel@tonic-gate Encryptions *ep;
821*0Sstevel@tonic-gate register uchar_t *p;
822*0Sstevel@tonic-gate register int i;
823*0Sstevel@tonic-gate
824*0Sstevel@tonic-gate if (!(ep = findencryption(type))) {
825*0Sstevel@tonic-gate if (encrypt_debug_mode) {
826*0Sstevel@tonic-gate (void) printf(gettext(
827*0Sstevel@tonic-gate ">>>%s: Can't encrypt with type %s (%d)\r\n"),
828*0Sstevel@tonic-gate Name, ENCTYPE_NAME_OK(type) ?
829*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type);
830*0Sstevel@tonic-gate }
831*0Sstevel@tonic-gate return;
832*0Sstevel@tonic-gate }
833*0Sstevel@tonic-gate if (ep->start) {
834*0Sstevel@tonic-gate i = (*ep->start)(TELNET_DIR_ENCRYPT);
835*0Sstevel@tonic-gate if (encrypt_debug_mode) {
836*0Sstevel@tonic-gate (void) printf(gettext(
837*0Sstevel@tonic-gate ">>>%s: Encrypt start: %s (%d) %s\r\n"),
838*0Sstevel@tonic-gate Name, (i < 0) ?
839*0Sstevel@tonic-gate gettext("failed") :
840*0Sstevel@tonic-gate gettext("initial negotiation in progress"),
841*0Sstevel@tonic-gate i, ENCTYPE_NAME(type));
842*0Sstevel@tonic-gate }
843*0Sstevel@tonic-gate if (i)
844*0Sstevel@tonic-gate return;
845*0Sstevel@tonic-gate }
846*0Sstevel@tonic-gate p = str_start + 3;
847*0Sstevel@tonic-gate *p++ = ENCRYPT_START;
848*0Sstevel@tonic-gate for (i = 0; i < ki[KI_ENCRYPT].keylen; ++i) {
849*0Sstevel@tonic-gate if ((*p++ = ki[KI_ENCRYPT].keyid[i]) == IAC)
850*0Sstevel@tonic-gate *p++ = IAC;
851*0Sstevel@tonic-gate }
852*0Sstevel@tonic-gate *p++ = IAC;
853*0Sstevel@tonic-gate *p++ = SE;
854*0Sstevel@tonic-gate (void) net_write(str_start, p - str_start);
855*0Sstevel@tonic-gate net_encrypt();
856*0Sstevel@tonic-gate printsub('>', &str_start[2], p - &str_start[2]);
857*0Sstevel@tonic-gate /*
858*0Sstevel@tonic-gate * If we are already encrypting in some mode, then
859*0Sstevel@tonic-gate * encrypt the ring (which includes our request) in
860*0Sstevel@tonic-gate * the old mode, mark it all as "clear text" and then
861*0Sstevel@tonic-gate * switch to the new mode.
862*0Sstevel@tonic-gate */
863*0Sstevel@tonic-gate encrypt_output = ep->output;
864*0Sstevel@tonic-gate encrypt_mode = type;
865*0Sstevel@tonic-gate if (encrypt_debug_mode)
866*0Sstevel@tonic-gate (void) printf(gettext(
867*0Sstevel@tonic-gate ">>>%s: Started to encrypt output with type %s\r\n"),
868*0Sstevel@tonic-gate Name, ENCTYPE_NAME(type));
869*0Sstevel@tonic-gate if (encrypt_verbose)
870*0Sstevel@tonic-gate (void) printf(gettext(
871*0Sstevel@tonic-gate "[ Output is now encrypted with type %s ]\r\n"),
872*0Sstevel@tonic-gate ENCTYPE_NAME(type));
873*0Sstevel@tonic-gate }
874*0Sstevel@tonic-gate
875*0Sstevel@tonic-gate static void
encrypt_send_end(void)876*0Sstevel@tonic-gate encrypt_send_end(void)
877*0Sstevel@tonic-gate {
878*0Sstevel@tonic-gate if (!encrypt_output)
879*0Sstevel@tonic-gate return;
880*0Sstevel@tonic-gate
881*0Sstevel@tonic-gate str_end[3] = ENCRYPT_END;
882*0Sstevel@tonic-gate (void) net_write(str_end, sizeof (str_end));
883*0Sstevel@tonic-gate net_encrypt();
884*0Sstevel@tonic-gate printsub('>', &str_end[2], sizeof (str_end) - 2);
885*0Sstevel@tonic-gate /*
886*0Sstevel@tonic-gate * Encrypt the output buffer now because it will not be done by
887*0Sstevel@tonic-gate * netflush...
888*0Sstevel@tonic-gate */
889*0Sstevel@tonic-gate encrypt_output = 0;
890*0Sstevel@tonic-gate if (encrypt_debug_mode)
891*0Sstevel@tonic-gate (void) printf(gettext(
892*0Sstevel@tonic-gate ">>>%s: Output is back to clear text\r\n"), Name);
893*0Sstevel@tonic-gate if (encrypt_verbose)
894*0Sstevel@tonic-gate (void) printf(gettext("[ Output is now clear text ]\r\n"));
895*0Sstevel@tonic-gate }
896*0Sstevel@tonic-gate
897*0Sstevel@tonic-gate static void
encrypt_send_request_start(void)898*0Sstevel@tonic-gate encrypt_send_request_start(void)
899*0Sstevel@tonic-gate {
900*0Sstevel@tonic-gate register uchar_t *p;
901*0Sstevel@tonic-gate register int i;
902*0Sstevel@tonic-gate
903*0Sstevel@tonic-gate p = &str_start[3];
904*0Sstevel@tonic-gate *p++ = ENCRYPT_REQSTART;
905*0Sstevel@tonic-gate for (i = 0; i < ki[KI_DECRYPT].keylen; ++i) {
906*0Sstevel@tonic-gate if ((*p++ = ki[KI_DECRYPT].keyid[i]) == IAC)
907*0Sstevel@tonic-gate *p++ = IAC;
908*0Sstevel@tonic-gate }
909*0Sstevel@tonic-gate *p++ = IAC;
910*0Sstevel@tonic-gate *p++ = SE;
911*0Sstevel@tonic-gate (void) net_write(str_start, p - str_start);
912*0Sstevel@tonic-gate printsub('>', &str_start[2], p - &str_start[2]);
913*0Sstevel@tonic-gate if (encrypt_debug_mode)
914*0Sstevel@tonic-gate (void) printf(gettext(
915*0Sstevel@tonic-gate ">>>%s: Request input to be encrypted\r\n"), Name);
916*0Sstevel@tonic-gate }
917*0Sstevel@tonic-gate
918*0Sstevel@tonic-gate static void
encrypt_send_request_end(void)919*0Sstevel@tonic-gate encrypt_send_request_end(void)
920*0Sstevel@tonic-gate {
921*0Sstevel@tonic-gate str_end[3] = ENCRYPT_REQEND;
922*0Sstevel@tonic-gate (void) net_write(str_end, sizeof (str_end));
923*0Sstevel@tonic-gate printsub('>', &str_end[2], sizeof (str_end) - 2);
924*0Sstevel@tonic-gate
925*0Sstevel@tonic-gate if (encrypt_debug_mode)
926*0Sstevel@tonic-gate (void) printf(gettext(
927*0Sstevel@tonic-gate ">>>%s: Request input to be clear text\r\n"), Name);
928*0Sstevel@tonic-gate }
929*0Sstevel@tonic-gate
930*0Sstevel@tonic-gate boolean_t
encrypt_is_encrypting(void)931*0Sstevel@tonic-gate encrypt_is_encrypting(void)
932*0Sstevel@tonic-gate {
933*0Sstevel@tonic-gate return (encrypt_output && decrypt_input ? B_TRUE : B_FALSE);
934*0Sstevel@tonic-gate }
935*0Sstevel@tonic-gate
936*0Sstevel@tonic-gate static void
encrypt_gen_printsub(uchar_t * data,int cnt,uchar_t * buf,int buflen)937*0Sstevel@tonic-gate encrypt_gen_printsub(uchar_t *data, int cnt, uchar_t *buf, int buflen)
938*0Sstevel@tonic-gate {
939*0Sstevel@tonic-gate char lbuf[ENCR_LBUF_BUFSIZ], *cp;
940*0Sstevel@tonic-gate
941*0Sstevel@tonic-gate if (cnt < 2 || buflen < 2)
942*0Sstevel@tonic-gate return;
943*0Sstevel@tonic-gate cnt -= 2;
944*0Sstevel@tonic-gate data += 2;
945*0Sstevel@tonic-gate buf[buflen-1] = '\0';
946*0Sstevel@tonic-gate buf[buflen-2] = '*';
947*0Sstevel@tonic-gate buflen -= 2;
948*0Sstevel@tonic-gate for (; cnt > 0; cnt--, data++) {
949*0Sstevel@tonic-gate (void) snprintf(lbuf, ENCR_LBUF_BUFSIZ, " %d", *data);
950*0Sstevel@tonic-gate for (cp = lbuf; *cp && buflen > 0; --buflen)
951*0Sstevel@tonic-gate *buf++ = *cp++;
952*0Sstevel@tonic-gate if (buflen <= 0)
953*0Sstevel@tonic-gate return;
954*0Sstevel@tonic-gate }
955*0Sstevel@tonic-gate *buf = '\0';
956*0Sstevel@tonic-gate }
957*0Sstevel@tonic-gate
958*0Sstevel@tonic-gate void
encrypt_printsub(uchar_t * data,int cnt,uchar_t * buf,int buflen)959*0Sstevel@tonic-gate encrypt_printsub(uchar_t *data, int cnt, uchar_t *buf, int buflen)
960*0Sstevel@tonic-gate {
961*0Sstevel@tonic-gate Encryptions *ep;
962*0Sstevel@tonic-gate register int type = data[1];
963*0Sstevel@tonic-gate
964*0Sstevel@tonic-gate for (ep = encryptions; ep->type && ep->type != type; ep++)
965*0Sstevel@tonic-gate ;
966*0Sstevel@tonic-gate
967*0Sstevel@tonic-gate if (ep->printsub)
968*0Sstevel@tonic-gate (*ep->printsub)(data, cnt, buf, buflen);
969*0Sstevel@tonic-gate else
970*0Sstevel@tonic-gate encrypt_gen_printsub(data, cnt, buf, buflen);
971*0Sstevel@tonic-gate }
972