1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright 2002 Sun Microsystems, Inc. All rights reserved. 3*0Sstevel@tonic-gate * Use is subject to license terms. 4*0Sstevel@tonic-gate */ 5*0Sstevel@tonic-gate 6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 7*0Sstevel@tonic-gate 8*0Sstevel@tonic-gate /* 9*0Sstevel@tonic-gate * usr/src/cmd/cmd-inet/usr.bin/telnet/encrypt.c 10*0Sstevel@tonic-gate */ 11*0Sstevel@tonic-gate 12*0Sstevel@tonic-gate /* 13*0Sstevel@tonic-gate * Copyright (c) 1991, 1993 14*0Sstevel@tonic-gate * The Regents of the University of California. All rights reserved. 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 17*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 18*0Sstevel@tonic-gate * are met: 19*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 20*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 21*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 22*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 23*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 24*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 25*0Sstevel@tonic-gate * must display the following acknowledgement: 26*0Sstevel@tonic-gate * This product includes software developed by the University of 27*0Sstevel@tonic-gate * California, Berkeley and its contributors. 28*0Sstevel@tonic-gate * 4. Neither the name of the University nor the names of its contributors 29*0Sstevel@tonic-gate * may be used to endorse or promote products derived from this software 30*0Sstevel@tonic-gate * without specific prior written permission. 31*0Sstevel@tonic-gate * 32*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 33*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 34*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 35*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 36*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 37*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 38*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 39*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 40*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 41*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 42*0Sstevel@tonic-gate * SUCH DAMAGE. 43*0Sstevel@tonic-gate */ 44*0Sstevel@tonic-gate 45*0Sstevel@tonic-gate /* based on @(#)encrypt.c 8.1 (Berkeley) 6/4/93 */ 46*0Sstevel@tonic-gate 47*0Sstevel@tonic-gate /* 48*0Sstevel@tonic-gate * Copyright (C) 1990 by the Massachusetts Institute of Technology 49*0Sstevel@tonic-gate * 50*0Sstevel@tonic-gate * Export of this software from the United States of America may 51*0Sstevel@tonic-gate * require a specific license from the United States Government. 52*0Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 53*0Sstevel@tonic-gate * export to obtain such a license before exporting. 54*0Sstevel@tonic-gate * 55*0Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 56*0Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 57*0Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 58*0Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 59*0Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 60*0Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 61*0Sstevel@tonic-gate * to distribution of the software without specific, written prior 62*0Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 63*0Sstevel@tonic-gate * your software as modified software and not distribute it in such a 64*0Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 65*0Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 66*0Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 67*0Sstevel@tonic-gate * or implied warranty. 68*0Sstevel@tonic-gate */ 69*0Sstevel@tonic-gate 70*0Sstevel@tonic-gate #ifdef lint 71*0Sstevel@tonic-gate static char *encrypt_names[] = {0}; 72*0Sstevel@tonic-gate static char *enctype_names[] = {0}; 73*0Sstevel@tonic-gate #else /* lint */ 74*0Sstevel@tonic-gate #define ENCRYPT_NAMES 75*0Sstevel@tonic-gate #endif /* lint */ 76*0Sstevel@tonic-gate #include <arpa/telnet.h> 77*0Sstevel@tonic-gate 78*0Sstevel@tonic-gate #include "externs.h" 79*0Sstevel@tonic-gate 80*0Sstevel@tonic-gate #ifdef __STDC__ 81*0Sstevel@tonic-gate #include <stdlib.h> 82*0Sstevel@tonic-gate #endif 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate /* 85*0Sstevel@tonic-gate * These functions pointers point to the current routines 86*0Sstevel@tonic-gate * for encrypting and decrypting data. 87*0Sstevel@tonic-gate */ 88*0Sstevel@tonic-gate void (*encrypt_output)(uchar_t *, int); 89*0Sstevel@tonic-gate int (*decrypt_input)(int); 90*0Sstevel@tonic-gate static void encrypt_start_output(int); 91*0Sstevel@tonic-gate static void encrypt_send_end(void); 92*0Sstevel@tonic-gate static void encrypt_send_request_start(void); 93*0Sstevel@tonic-gate static void encrypt_send_request_end(void); 94*0Sstevel@tonic-gate 95*0Sstevel@tonic-gate boolean_t encrypt_debug_mode = B_FALSE; 96*0Sstevel@tonic-gate 97*0Sstevel@tonic-gate static int decrypt_mode = 0; 98*0Sstevel@tonic-gate static int encrypt_mode = 0; 99*0Sstevel@tonic-gate static boolean_t encrypt_verbose = B_FALSE; 100*0Sstevel@tonic-gate static boolean_t autoencrypt = B_FALSE; 101*0Sstevel@tonic-gate static boolean_t autodecrypt = B_FALSE; 102*0Sstevel@tonic-gate static char *Name = "Noname"; 103*0Sstevel@tonic-gate 104*0Sstevel@tonic-gate #define typemask(x) ((x) > 0 ? 1 << ((x)-1) : 0) 105*0Sstevel@tonic-gate #define SUCCESS 0x00 106*0Sstevel@tonic-gate #define UNKNOWN gettext("(unknown)") 107*0Sstevel@tonic-gate 108*0Sstevel@tonic-gate static int i_support_encrypt = typemask(TELOPT_ENCTYPE_DES_CFB64); 109*0Sstevel@tonic-gate static int i_support_decrypt = typemask(TELOPT_ENCTYPE_DES_CFB64); 110*0Sstevel@tonic-gate static int i_wont_support_encrypt = 0; 111*0Sstevel@tonic-gate static int i_wont_support_decrypt = 0; 112*0Sstevel@tonic-gate #define I_SUPPORT_ENCRYPT (i_support_encrypt & ~i_wont_support_encrypt) 113*0Sstevel@tonic-gate #define I_SUPPORT_DECRYPT (i_support_decrypt & ~i_wont_support_decrypt) 114*0Sstevel@tonic-gate 115*0Sstevel@tonic-gate static int remote_supports_encrypt = 0; 116*0Sstevel@tonic-gate static int remote_supports_decrypt = 0; 117*0Sstevel@tonic-gate 118*0Sstevel@tonic-gate static Encryptions encryptions[] = { 119*0Sstevel@tonic-gate { "DES_CFB64", TELOPT_ENCTYPE_DES_CFB64, 120*0Sstevel@tonic-gate cfb64_encrypt, 121*0Sstevel@tonic-gate cfb64_decrypt, 122*0Sstevel@tonic-gate cfb64_init, 123*0Sstevel@tonic-gate cfb64_start, 124*0Sstevel@tonic-gate cfb64_is, 125*0Sstevel@tonic-gate cfb64_reply, 126*0Sstevel@tonic-gate cfb64_session, 127*0Sstevel@tonic-gate cfb64_keyid, 128*0Sstevel@tonic-gate cfb64_printsub }, 129*0Sstevel@tonic-gate { 0, }, 130*0Sstevel@tonic-gate }; 131*0Sstevel@tonic-gate 132*0Sstevel@tonic-gate static uchar_t str_send[64] = { IAC, SB, TELOPT_ENCRYPT, 133*0Sstevel@tonic-gate ENCRYPT_SUPPORT }; 134*0Sstevel@tonic-gate static uchar_t str_suplen = 0; 135*0Sstevel@tonic-gate static uchar_t str_start[72] = { IAC, SB, TELOPT_ENCRYPT }; 136*0Sstevel@tonic-gate static uchar_t str_end[] = { IAC, SB, TELOPT_ENCRYPT, 0, IAC, SE }; 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate static Encryptions * 139*0Sstevel@tonic-gate findencryption(int type) 140*0Sstevel@tonic-gate { 141*0Sstevel@tonic-gate Encryptions *ep = encryptions; 142*0Sstevel@tonic-gate 143*0Sstevel@tonic-gate if (!(I_SUPPORT_ENCRYPT & remote_supports_decrypt & typemask(type))) 144*0Sstevel@tonic-gate return (NULL); 145*0Sstevel@tonic-gate for (; (ep->type != NULL) && (ep->type != type); ep++); 146*0Sstevel@tonic-gate return (ep->type ? ep : NULL); 147*0Sstevel@tonic-gate } 148*0Sstevel@tonic-gate 149*0Sstevel@tonic-gate static Encryptions * 150*0Sstevel@tonic-gate finddecryption(int type) 151*0Sstevel@tonic-gate { 152*0Sstevel@tonic-gate Encryptions *ep = encryptions; 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate if (!(I_SUPPORT_DECRYPT & remote_supports_encrypt & typemask(type))) 155*0Sstevel@tonic-gate return (NULL); 156*0Sstevel@tonic-gate while (ep->type && ep->type != type) 157*0Sstevel@tonic-gate ++ep; 158*0Sstevel@tonic-gate return (ep->type ? ep : NULL); 159*0Sstevel@tonic-gate } 160*0Sstevel@tonic-gate 161*0Sstevel@tonic-gate #define MAXKEYLEN 64 162*0Sstevel@tonic-gate 163*0Sstevel@tonic-gate static struct key_info { 164*0Sstevel@tonic-gate uchar_t keyid[MAXKEYLEN]; 165*0Sstevel@tonic-gate int keylen; 166*0Sstevel@tonic-gate int dir; 167*0Sstevel@tonic-gate int *modep; 168*0Sstevel@tonic-gate Encryptions *(*getcrypt)(); 169*0Sstevel@tonic-gate } ki[2] = { 170*0Sstevel@tonic-gate { { 0 }, 0, TELNET_DIR_ENCRYPT, &encrypt_mode, findencryption }, 171*0Sstevel@tonic-gate { { 0 }, 0, TELNET_DIR_DECRYPT, &decrypt_mode, finddecryption }, 172*0Sstevel@tonic-gate }; 173*0Sstevel@tonic-gate #define KI_ENCRYPT 0 174*0Sstevel@tonic-gate #define KI_DECRYPT 1 175*0Sstevel@tonic-gate 176*0Sstevel@tonic-gate void 177*0Sstevel@tonic-gate encrypt_init(char *name) 178*0Sstevel@tonic-gate { 179*0Sstevel@tonic-gate Encryptions *ep = encryptions; 180*0Sstevel@tonic-gate 181*0Sstevel@tonic-gate Name = name; 182*0Sstevel@tonic-gate i_support_encrypt = i_support_decrypt = 0; 183*0Sstevel@tonic-gate remote_supports_encrypt = remote_supports_decrypt = 0; 184*0Sstevel@tonic-gate encrypt_mode = 0; 185*0Sstevel@tonic-gate decrypt_mode = 0; 186*0Sstevel@tonic-gate encrypt_output = 0; 187*0Sstevel@tonic-gate decrypt_input = 0; 188*0Sstevel@tonic-gate #ifdef notdef 189*0Sstevel@tonic-gate encrypt_verbose = !server; 190*0Sstevel@tonic-gate #endif 191*0Sstevel@tonic-gate 192*0Sstevel@tonic-gate str_suplen = 4; 193*0Sstevel@tonic-gate 194*0Sstevel@tonic-gate while (ep->type) { 195*0Sstevel@tonic-gate if (encrypt_debug_mode) 196*0Sstevel@tonic-gate (void) printf(gettext( 197*0Sstevel@tonic-gate ">>>%s: I will support %s\r\n"), 198*0Sstevel@tonic-gate Name, ENCTYPE_NAME(ep->type)); 199*0Sstevel@tonic-gate i_support_encrypt |= typemask(ep->type); 200*0Sstevel@tonic-gate i_support_decrypt |= typemask(ep->type); 201*0Sstevel@tonic-gate if ((i_wont_support_decrypt & typemask(ep->type)) == 0) 202*0Sstevel@tonic-gate if ((str_send[str_suplen++] = ep->type) == IAC) 203*0Sstevel@tonic-gate str_send[str_suplen++] = IAC; 204*0Sstevel@tonic-gate if (ep->init) 205*0Sstevel@tonic-gate (*ep->init)(); 206*0Sstevel@tonic-gate ++ep; 207*0Sstevel@tonic-gate } 208*0Sstevel@tonic-gate str_send[str_suplen++] = IAC; 209*0Sstevel@tonic-gate str_send[str_suplen++] = SE; 210*0Sstevel@tonic-gate } 211*0Sstevel@tonic-gate 212*0Sstevel@tonic-gate static void 213*0Sstevel@tonic-gate encrypt_list_types(void) 214*0Sstevel@tonic-gate { 215*0Sstevel@tonic-gate Encryptions *ep = encryptions; 216*0Sstevel@tonic-gate 217*0Sstevel@tonic-gate (void) printf(gettext("Valid encryption types:\n")); 218*0Sstevel@tonic-gate while (ep->type) { 219*0Sstevel@tonic-gate (void) printf("\t%s (%d)\r\n", 220*0Sstevel@tonic-gate ENCTYPE_NAME(ep->type), ep->type); 221*0Sstevel@tonic-gate ++ep; 222*0Sstevel@tonic-gate } 223*0Sstevel@tonic-gate } 224*0Sstevel@tonic-gate 225*0Sstevel@tonic-gate int 226*0Sstevel@tonic-gate EncryptEnable(char *type, char *mode) 227*0Sstevel@tonic-gate { 228*0Sstevel@tonic-gate if (isprefix(type, "help") || isprefix(type, "?")) { 229*0Sstevel@tonic-gate (void) printf(gettext( 230*0Sstevel@tonic-gate "Usage: encrypt enable <type> [input|output]\n")); 231*0Sstevel@tonic-gate encrypt_list_types(); 232*0Sstevel@tonic-gate return (0); 233*0Sstevel@tonic-gate } 234*0Sstevel@tonic-gate 235*0Sstevel@tonic-gate if (EncryptType(type, mode)) 236*0Sstevel@tonic-gate return (EncryptStart(mode)); 237*0Sstevel@tonic-gate 238*0Sstevel@tonic-gate return (0); 239*0Sstevel@tonic-gate } 240*0Sstevel@tonic-gate 241*0Sstevel@tonic-gate int 242*0Sstevel@tonic-gate EncryptDisable(char *type, char *mode) 243*0Sstevel@tonic-gate { 244*0Sstevel@tonic-gate register Encryptions *ep; 245*0Sstevel@tonic-gate int ret = 0; 246*0Sstevel@tonic-gate 247*0Sstevel@tonic-gate if (isprefix(type, "help") || isprefix(type, "?")) { 248*0Sstevel@tonic-gate (void) printf(gettext( 249*0Sstevel@tonic-gate "Usage: encrypt disable <type> [input|output]\n")); 250*0Sstevel@tonic-gate encrypt_list_types(); 251*0Sstevel@tonic-gate } else if ((ep = (Encryptions *)genget(type, (char **)encryptions, 252*0Sstevel@tonic-gate sizeof (Encryptions))) == 0) { 253*0Sstevel@tonic-gate (void) printf(gettext("%s: invalid encryption type\n"), type); 254*0Sstevel@tonic-gate } else if (Ambiguous(ep)) { 255*0Sstevel@tonic-gate (void) printf(gettext("Ambiguous type '%s'\n"), type); 256*0Sstevel@tonic-gate } else { 257*0Sstevel@tonic-gate if ((mode == 0) || (isprefix(mode, "input") ? 1 : 0)) { 258*0Sstevel@tonic-gate if (decrypt_mode == ep->type) 259*0Sstevel@tonic-gate (void) EncryptStopInput(); 260*0Sstevel@tonic-gate i_wont_support_decrypt |= typemask(ep->type); 261*0Sstevel@tonic-gate ret = 1; 262*0Sstevel@tonic-gate } 263*0Sstevel@tonic-gate if ((mode == 0) || (isprefix(mode, "output"))) { 264*0Sstevel@tonic-gate if (encrypt_mode == ep->type) 265*0Sstevel@tonic-gate (void) EncryptStopOutput(); 266*0Sstevel@tonic-gate i_wont_support_encrypt |= typemask(ep->type); 267*0Sstevel@tonic-gate ret = 1; 268*0Sstevel@tonic-gate } 269*0Sstevel@tonic-gate if (ret == 0) 270*0Sstevel@tonic-gate (void) printf(gettext( 271*0Sstevel@tonic-gate "%s: invalid encryption mode\n"), mode); 272*0Sstevel@tonic-gate } 273*0Sstevel@tonic-gate return (ret); 274*0Sstevel@tonic-gate } 275*0Sstevel@tonic-gate 276*0Sstevel@tonic-gate int 277*0Sstevel@tonic-gate EncryptType(char *type, char *mode) 278*0Sstevel@tonic-gate { 279*0Sstevel@tonic-gate register Encryptions *ep; 280*0Sstevel@tonic-gate int ret = 0; 281*0Sstevel@tonic-gate 282*0Sstevel@tonic-gate if (isprefix(type, "help") || isprefix(type, "?")) { 283*0Sstevel@tonic-gate (void) printf(gettext( 284*0Sstevel@tonic-gate "Usage: encrypt type <type> [input|output]\n")); 285*0Sstevel@tonic-gate encrypt_list_types(); 286*0Sstevel@tonic-gate } else if ((ep = (Encryptions *)genget(type, (char **)encryptions, 287*0Sstevel@tonic-gate sizeof (Encryptions))) == 0) { 288*0Sstevel@tonic-gate (void) printf(gettext("%s: invalid encryption type\n"), type); 289*0Sstevel@tonic-gate } else if (Ambiguous(ep)) { 290*0Sstevel@tonic-gate (void) printf(gettext("Ambiguous type '%s'\n"), type); 291*0Sstevel@tonic-gate } else { 292*0Sstevel@tonic-gate if ((mode == 0) || isprefix(mode, "input")) { 293*0Sstevel@tonic-gate decrypt_mode = ep->type; 294*0Sstevel@tonic-gate i_wont_support_decrypt &= ~typemask(ep->type); 295*0Sstevel@tonic-gate ret = 1; 296*0Sstevel@tonic-gate } 297*0Sstevel@tonic-gate if ((mode == 0) || isprefix(mode, "output")) { 298*0Sstevel@tonic-gate encrypt_mode = ep->type; 299*0Sstevel@tonic-gate i_wont_support_encrypt &= ~typemask(ep->type); 300*0Sstevel@tonic-gate ret = 1; 301*0Sstevel@tonic-gate } 302*0Sstevel@tonic-gate if (ret == 0) 303*0Sstevel@tonic-gate (void) printf(gettext( 304*0Sstevel@tonic-gate "%s: invalid encryption mode\n"), mode); 305*0Sstevel@tonic-gate } 306*0Sstevel@tonic-gate return (ret); 307*0Sstevel@tonic-gate } 308*0Sstevel@tonic-gate 309*0Sstevel@tonic-gate int 310*0Sstevel@tonic-gate EncryptStart(char *mode) 311*0Sstevel@tonic-gate { 312*0Sstevel@tonic-gate register int ret = 0; 313*0Sstevel@tonic-gate if (mode) { 314*0Sstevel@tonic-gate if (isprefix(mode, "input")) 315*0Sstevel@tonic-gate return (EncryptStartInput()); 316*0Sstevel@tonic-gate if (isprefix(mode, "output")) 317*0Sstevel@tonic-gate return (EncryptStartOutput()); 318*0Sstevel@tonic-gate if (isprefix(mode, "help") || isprefix(mode, "?")) { 319*0Sstevel@tonic-gate (void) printf(gettext( 320*0Sstevel@tonic-gate "Usage: encrypt start [input|output]\n")); 321*0Sstevel@tonic-gate return (0); 322*0Sstevel@tonic-gate } 323*0Sstevel@tonic-gate (void) printf(gettext( 324*0Sstevel@tonic-gate "%s: invalid encryption mode 'encrypt start ?' " 325*0Sstevel@tonic-gate "for help\n"), mode); 326*0Sstevel@tonic-gate return (0); 327*0Sstevel@tonic-gate } 328*0Sstevel@tonic-gate ret += EncryptStartInput(); 329*0Sstevel@tonic-gate ret += EncryptStartOutput(); 330*0Sstevel@tonic-gate return (ret); 331*0Sstevel@tonic-gate } 332*0Sstevel@tonic-gate 333*0Sstevel@tonic-gate int 334*0Sstevel@tonic-gate EncryptStartInput(void) 335*0Sstevel@tonic-gate { 336*0Sstevel@tonic-gate if (decrypt_mode) { 337*0Sstevel@tonic-gate encrypt_send_request_start(); 338*0Sstevel@tonic-gate return (1); 339*0Sstevel@tonic-gate } 340*0Sstevel@tonic-gate (void) printf(gettext("No previous decryption mode, " 341*0Sstevel@tonic-gate "decryption not enabled\r\n")); 342*0Sstevel@tonic-gate return (0); 343*0Sstevel@tonic-gate } 344*0Sstevel@tonic-gate 345*0Sstevel@tonic-gate int 346*0Sstevel@tonic-gate EncryptStartOutput(void) 347*0Sstevel@tonic-gate { 348*0Sstevel@tonic-gate if (encrypt_mode) { 349*0Sstevel@tonic-gate encrypt_start_output(encrypt_mode); 350*0Sstevel@tonic-gate return (1); 351*0Sstevel@tonic-gate } 352*0Sstevel@tonic-gate (void) printf(gettext("No previous encryption mode, " 353*0Sstevel@tonic-gate "encryption not enabled\r\n")); 354*0Sstevel@tonic-gate return (0); 355*0Sstevel@tonic-gate } 356*0Sstevel@tonic-gate 357*0Sstevel@tonic-gate int 358*0Sstevel@tonic-gate EncryptStop(char *mode) 359*0Sstevel@tonic-gate { 360*0Sstevel@tonic-gate int ret = 0; 361*0Sstevel@tonic-gate if (mode) { 362*0Sstevel@tonic-gate if (isprefix(mode, "input")) 363*0Sstevel@tonic-gate return (EncryptStopInput()); 364*0Sstevel@tonic-gate if (isprefix(mode, "output")) 365*0Sstevel@tonic-gate return (EncryptStopOutput()); 366*0Sstevel@tonic-gate if (isprefix(mode, "help") || isprefix(mode, "?")) { 367*0Sstevel@tonic-gate (void) printf(gettext( 368*0Sstevel@tonic-gate "Usage: encrypt stop [input|output]\n")); 369*0Sstevel@tonic-gate return (0); 370*0Sstevel@tonic-gate } 371*0Sstevel@tonic-gate (void) printf(gettext( 372*0Sstevel@tonic-gate "%s: invalid encryption mode 'encrypt stop ?' " 373*0Sstevel@tonic-gate "for help\n"), mode); 374*0Sstevel@tonic-gate return (0); 375*0Sstevel@tonic-gate } 376*0Sstevel@tonic-gate ret += EncryptStopInput(); 377*0Sstevel@tonic-gate ret += EncryptStopOutput(); 378*0Sstevel@tonic-gate return (ret); 379*0Sstevel@tonic-gate } 380*0Sstevel@tonic-gate 381*0Sstevel@tonic-gate int 382*0Sstevel@tonic-gate EncryptStopInput(void) 383*0Sstevel@tonic-gate { 384*0Sstevel@tonic-gate encrypt_send_request_end(); 385*0Sstevel@tonic-gate return (1); 386*0Sstevel@tonic-gate } 387*0Sstevel@tonic-gate 388*0Sstevel@tonic-gate int 389*0Sstevel@tonic-gate EncryptStopOutput(void) 390*0Sstevel@tonic-gate { 391*0Sstevel@tonic-gate encrypt_send_end(); 392*0Sstevel@tonic-gate return (1); 393*0Sstevel@tonic-gate } 394*0Sstevel@tonic-gate 395*0Sstevel@tonic-gate void 396*0Sstevel@tonic-gate encrypt_display(void) 397*0Sstevel@tonic-gate { 398*0Sstevel@tonic-gate if (encrypt_output) 399*0Sstevel@tonic-gate (void) printf(gettext( 400*0Sstevel@tonic-gate "Currently encrypting output with %s\r\n"), 401*0Sstevel@tonic-gate ENCTYPE_NAME(encrypt_mode)); 402*0Sstevel@tonic-gate if (decrypt_input) 403*0Sstevel@tonic-gate (void) printf(gettext( 404*0Sstevel@tonic-gate "Currently decrypting input with %s\r\n"), 405*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode)); 406*0Sstevel@tonic-gate } 407*0Sstevel@tonic-gate 408*0Sstevel@tonic-gate int 409*0Sstevel@tonic-gate EncryptStatus(void) 410*0Sstevel@tonic-gate { 411*0Sstevel@tonic-gate if (encrypt_output) 412*0Sstevel@tonic-gate (void) printf(gettext( 413*0Sstevel@tonic-gate "Currently encrypting output with %s\r\n"), 414*0Sstevel@tonic-gate ENCTYPE_NAME(encrypt_mode)); 415*0Sstevel@tonic-gate else if (encrypt_mode) { 416*0Sstevel@tonic-gate (void) printf(gettext("Currently output is clear text.\r\n")); 417*0Sstevel@tonic-gate (void) printf(gettext("Last encryption mode was %s\r\n"), 418*0Sstevel@tonic-gate ENCTYPE_NAME(encrypt_mode)); 419*0Sstevel@tonic-gate } 420*0Sstevel@tonic-gate if (decrypt_input) { 421*0Sstevel@tonic-gate (void) printf(gettext( 422*0Sstevel@tonic-gate "Currently decrypting input with %s\r\n"), 423*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode)); 424*0Sstevel@tonic-gate } else if (decrypt_mode) { 425*0Sstevel@tonic-gate (void) printf(gettext("Currently input is clear text.\r\n")); 426*0Sstevel@tonic-gate (void) printf(gettext("Last decryption mode was %s\r\n"), 427*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode)); 428*0Sstevel@tonic-gate } 429*0Sstevel@tonic-gate return (1); 430*0Sstevel@tonic-gate } 431*0Sstevel@tonic-gate 432*0Sstevel@tonic-gate void 433*0Sstevel@tonic-gate encrypt_send_support(void) 434*0Sstevel@tonic-gate { 435*0Sstevel@tonic-gate if (str_suplen) { 436*0Sstevel@tonic-gate /* 437*0Sstevel@tonic-gate * If the user has requested that decryption start 438*0Sstevel@tonic-gate * immediatly, then send a "REQUEST START" before 439*0Sstevel@tonic-gate * we negotiate the type. 440*0Sstevel@tonic-gate */ 441*0Sstevel@tonic-gate if (autodecrypt) 442*0Sstevel@tonic-gate encrypt_send_request_start(); 443*0Sstevel@tonic-gate (void) net_write(str_send, str_suplen); 444*0Sstevel@tonic-gate printsub('>', &str_send[2], str_suplen - 2); 445*0Sstevel@tonic-gate str_suplen = 0; 446*0Sstevel@tonic-gate } 447*0Sstevel@tonic-gate } 448*0Sstevel@tonic-gate 449*0Sstevel@tonic-gate int 450*0Sstevel@tonic-gate EncryptDebug(int on) 451*0Sstevel@tonic-gate { 452*0Sstevel@tonic-gate encrypt_debug_mode = (on < 0) ? !encrypt_debug_mode : 453*0Sstevel@tonic-gate (on > 0) ? B_TRUE : B_FALSE; 454*0Sstevel@tonic-gate (void) printf(encrypt_debug_mode ? 455*0Sstevel@tonic-gate gettext("Encryption debugging enabled\r\n") : 456*0Sstevel@tonic-gate gettext("Encryption debugging disabled\r\n")); 457*0Sstevel@tonic-gate return (1); 458*0Sstevel@tonic-gate } 459*0Sstevel@tonic-gate 460*0Sstevel@tonic-gate int 461*0Sstevel@tonic-gate EncryptVerbose(int on) 462*0Sstevel@tonic-gate { 463*0Sstevel@tonic-gate encrypt_verbose = (on < 0) ? !encrypt_verbose : 464*0Sstevel@tonic-gate (on > 0) ? B_TRUE : B_FALSE; 465*0Sstevel@tonic-gate (void) printf(encrypt_verbose ? 466*0Sstevel@tonic-gate gettext("Encryption is verbose\r\n") : 467*0Sstevel@tonic-gate gettext("Encryption is not verbose\r\n")); 468*0Sstevel@tonic-gate return (1); 469*0Sstevel@tonic-gate } 470*0Sstevel@tonic-gate 471*0Sstevel@tonic-gate int 472*0Sstevel@tonic-gate EncryptAutoEnc(int on) 473*0Sstevel@tonic-gate { 474*0Sstevel@tonic-gate encrypt_auto(on); 475*0Sstevel@tonic-gate (void) printf(autoencrypt ? 476*0Sstevel@tonic-gate gettext("Automatic encryption of output is enabled\r\n") : 477*0Sstevel@tonic-gate gettext("Automatic encryption of output is disabled\r\n")); 478*0Sstevel@tonic-gate return (1); 479*0Sstevel@tonic-gate } 480*0Sstevel@tonic-gate 481*0Sstevel@tonic-gate int 482*0Sstevel@tonic-gate EncryptAutoDec(int on) 483*0Sstevel@tonic-gate { 484*0Sstevel@tonic-gate decrypt_auto(on); 485*0Sstevel@tonic-gate (void) printf(autodecrypt ? 486*0Sstevel@tonic-gate gettext("Automatic decryption of input is enabled\r\n") : 487*0Sstevel@tonic-gate gettext("Automatic decryption of input is disabled\r\n")); 488*0Sstevel@tonic-gate return (1); 489*0Sstevel@tonic-gate } 490*0Sstevel@tonic-gate 491*0Sstevel@tonic-gate /* 492*0Sstevel@tonic-gate * Called when ENCRYPT SUPPORT is received. 493*0Sstevel@tonic-gate */ 494*0Sstevel@tonic-gate void 495*0Sstevel@tonic-gate encrypt_support(uchar_t *typelist, int cnt) 496*0Sstevel@tonic-gate { 497*0Sstevel@tonic-gate register int type, use_type = 0; 498*0Sstevel@tonic-gate Encryptions *ep; 499*0Sstevel@tonic-gate 500*0Sstevel@tonic-gate /* 501*0Sstevel@tonic-gate * Forget anything the other side has previously told us. 502*0Sstevel@tonic-gate */ 503*0Sstevel@tonic-gate remote_supports_decrypt = 0; 504*0Sstevel@tonic-gate 505*0Sstevel@tonic-gate while (cnt-- > 0) { 506*0Sstevel@tonic-gate type = *typelist++; 507*0Sstevel@tonic-gate if (encrypt_debug_mode) 508*0Sstevel@tonic-gate (void) printf(gettext( 509*0Sstevel@tonic-gate ">>>%s: Remote host supports %s (%d)\r\n"), 510*0Sstevel@tonic-gate Name, ENCTYPE_NAME(type), type); 511*0Sstevel@tonic-gate if ((type < TELOPT_ENCTYPE_CNT) && 512*0Sstevel@tonic-gate (I_SUPPORT_ENCRYPT & typemask(type))) { 513*0Sstevel@tonic-gate remote_supports_decrypt |= typemask(type); 514*0Sstevel@tonic-gate if (use_type == 0) 515*0Sstevel@tonic-gate use_type = type; 516*0Sstevel@tonic-gate } 517*0Sstevel@tonic-gate } 518*0Sstevel@tonic-gate if (use_type) { 519*0Sstevel@tonic-gate ep = findencryption(use_type); 520*0Sstevel@tonic-gate if (!ep) 521*0Sstevel@tonic-gate return; 522*0Sstevel@tonic-gate type = ep->start ? (*ep->start)(TELNET_DIR_ENCRYPT) : 0; 523*0Sstevel@tonic-gate if (encrypt_debug_mode) 524*0Sstevel@tonic-gate (void) printf(gettext( 525*0Sstevel@tonic-gate ">>>%s: (*ep->start)() returned %d\r\n"), 526*0Sstevel@tonic-gate Name, type); 527*0Sstevel@tonic-gate if (type < 0) 528*0Sstevel@tonic-gate return; 529*0Sstevel@tonic-gate encrypt_mode = use_type; 530*0Sstevel@tonic-gate if (type == 0) 531*0Sstevel@tonic-gate encrypt_start_output(use_type); 532*0Sstevel@tonic-gate } 533*0Sstevel@tonic-gate } 534*0Sstevel@tonic-gate 535*0Sstevel@tonic-gate void 536*0Sstevel@tonic-gate encrypt_is(uchar_t *data, int cnt) 537*0Sstevel@tonic-gate { 538*0Sstevel@tonic-gate Encryptions *ep; 539*0Sstevel@tonic-gate register int type, ret; 540*0Sstevel@tonic-gate 541*0Sstevel@tonic-gate if (--cnt < 0) 542*0Sstevel@tonic-gate return; 543*0Sstevel@tonic-gate type = *data++; 544*0Sstevel@tonic-gate if (type < TELOPT_ENCTYPE_CNT) 545*0Sstevel@tonic-gate remote_supports_encrypt |= typemask(type); 546*0Sstevel@tonic-gate if (!(ep = finddecryption(type))) { 547*0Sstevel@tonic-gate if (encrypt_debug_mode) 548*0Sstevel@tonic-gate (void) printf(gettext( 549*0Sstevel@tonic-gate ">>>%s: Can't find type %s (%d) for " 550*0Sstevel@tonic-gate "initial negotiation\r\n"), Name, 551*0Sstevel@tonic-gate ENCTYPE_NAME_OK(type) ? 552*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type); 553*0Sstevel@tonic-gate return; 554*0Sstevel@tonic-gate } 555*0Sstevel@tonic-gate if (!ep->is) { 556*0Sstevel@tonic-gate if (encrypt_debug_mode) 557*0Sstevel@tonic-gate (void) printf(gettext( 558*0Sstevel@tonic-gate ">>>%s: No initial negotiation needed " 559*0Sstevel@tonic-gate "for type %s (%d)\r\n"), Name, 560*0Sstevel@tonic-gate ENCTYPE_NAME_OK(type) ? 561*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type); 562*0Sstevel@tonic-gate ret = 0; 563*0Sstevel@tonic-gate } else { 564*0Sstevel@tonic-gate ret = (*ep->is)(data, cnt); 565*0Sstevel@tonic-gate if (encrypt_debug_mode) 566*0Sstevel@tonic-gate (void) printf(gettext( 567*0Sstevel@tonic-gate "(*ep->is)(%x, %d) returned %s(%d)\n"), 568*0Sstevel@tonic-gate data, cnt, (ret < 0) ? "FAIL " : 569*0Sstevel@tonic-gate (ret == 0) ? "SUCCESS " : "MORE_TO_DO ", ret); 570*0Sstevel@tonic-gate } 571*0Sstevel@tonic-gate if (ret < 0) { 572*0Sstevel@tonic-gate autodecrypt = B_FALSE; 573*0Sstevel@tonic-gate } else { 574*0Sstevel@tonic-gate decrypt_mode = type; 575*0Sstevel@tonic-gate if (ret == 0 && autodecrypt) 576*0Sstevel@tonic-gate encrypt_send_request_start(); 577*0Sstevel@tonic-gate } 578*0Sstevel@tonic-gate } 579*0Sstevel@tonic-gate 580*0Sstevel@tonic-gate void 581*0Sstevel@tonic-gate encrypt_reply(uchar_t *data, int cnt) 582*0Sstevel@tonic-gate { 583*0Sstevel@tonic-gate Encryptions *ep; 584*0Sstevel@tonic-gate register int ret, type; 585*0Sstevel@tonic-gate 586*0Sstevel@tonic-gate if (--cnt < 0) 587*0Sstevel@tonic-gate return; 588*0Sstevel@tonic-gate type = *data++; 589*0Sstevel@tonic-gate if (!(ep = findencryption(type))) { 590*0Sstevel@tonic-gate if (encrypt_debug_mode) 591*0Sstevel@tonic-gate (void) printf(gettext( 592*0Sstevel@tonic-gate ">>>%s: Can't find type %s (%d) " 593*0Sstevel@tonic-gate "for initial negotiation\r\n"), Name, 594*0Sstevel@tonic-gate ENCTYPE_NAME_OK(type) ? 595*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type); 596*0Sstevel@tonic-gate return; 597*0Sstevel@tonic-gate } 598*0Sstevel@tonic-gate if (!ep->reply) { 599*0Sstevel@tonic-gate if (encrypt_debug_mode) 600*0Sstevel@tonic-gate (void) printf(gettext( 601*0Sstevel@tonic-gate ">>>%s: No initial negotiation needed " 602*0Sstevel@tonic-gate "for type %s (%d)\r\n"), Name, 603*0Sstevel@tonic-gate ENCTYPE_NAME_OK(type) ? 604*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type); 605*0Sstevel@tonic-gate ret = 0; 606*0Sstevel@tonic-gate } else { 607*0Sstevel@tonic-gate ret = (*ep->reply)(data, cnt); 608*0Sstevel@tonic-gate if (encrypt_debug_mode) 609*0Sstevel@tonic-gate (void) printf(gettext( 610*0Sstevel@tonic-gate "(*ep->reply)(%x, %d) returned %s(%d)\n"), 611*0Sstevel@tonic-gate data, cnt, (ret < 0) ? "FAIL " : 612*0Sstevel@tonic-gate (ret == 0) ? "SUCCESS " : "MORE_TO_DO ", ret); 613*0Sstevel@tonic-gate } 614*0Sstevel@tonic-gate if (encrypt_debug_mode) 615*0Sstevel@tonic-gate (void) printf(gettext( 616*0Sstevel@tonic-gate ">>>%s: encrypt_reply returned %d\n"), Name, ret); 617*0Sstevel@tonic-gate if (ret < 0) { 618*0Sstevel@tonic-gate autoencrypt = B_FALSE; 619*0Sstevel@tonic-gate } else { 620*0Sstevel@tonic-gate encrypt_mode = type; 621*0Sstevel@tonic-gate if (ret == 0 && autoencrypt) 622*0Sstevel@tonic-gate encrypt_start_output(type); 623*0Sstevel@tonic-gate } 624*0Sstevel@tonic-gate } 625*0Sstevel@tonic-gate 626*0Sstevel@tonic-gate /* 627*0Sstevel@tonic-gate * Called when a ENCRYPT START command is received. 628*0Sstevel@tonic-gate */ 629*0Sstevel@tonic-gate /* ARGSUSED */ 630*0Sstevel@tonic-gate void 631*0Sstevel@tonic-gate encrypt_start(uchar_t *data, int cnt) 632*0Sstevel@tonic-gate { 633*0Sstevel@tonic-gate Encryptions *ep; 634*0Sstevel@tonic-gate 635*0Sstevel@tonic-gate if (!decrypt_mode) { 636*0Sstevel@tonic-gate /* 637*0Sstevel@tonic-gate * Something is wrong. We should not get a START 638*0Sstevel@tonic-gate * command without having already picked our 639*0Sstevel@tonic-gate * decryption scheme. Send a REQUEST-END to 640*0Sstevel@tonic-gate * attempt to clear the channel... 641*0Sstevel@tonic-gate */ 642*0Sstevel@tonic-gate (void) printf(gettext("%s: Warning, cannot decrypt " 643*0Sstevel@tonic-gate "input stream!!!\r\n"), Name); 644*0Sstevel@tonic-gate encrypt_send_request_end(); 645*0Sstevel@tonic-gate return; 646*0Sstevel@tonic-gate } 647*0Sstevel@tonic-gate 648*0Sstevel@tonic-gate if (ep = finddecryption(decrypt_mode)) { 649*0Sstevel@tonic-gate decrypt_input = ep->input; 650*0Sstevel@tonic-gate if (encrypt_verbose) 651*0Sstevel@tonic-gate (void) printf(gettext( 652*0Sstevel@tonic-gate "[ Input is now decrypted with type %s ]\r\n"), 653*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode)); 654*0Sstevel@tonic-gate if (encrypt_debug_mode) 655*0Sstevel@tonic-gate (void) printf(gettext( 656*0Sstevel@tonic-gate ">>>%s: Start to decrypt input with type %s\r\n"), 657*0Sstevel@tonic-gate Name, ENCTYPE_NAME(decrypt_mode)); 658*0Sstevel@tonic-gate } else { 659*0Sstevel@tonic-gate (void) printf(gettext( 660*0Sstevel@tonic-gate "%s: Warning, cannot decrypt type %s (%d)!!!\r\n"), 661*0Sstevel@tonic-gate Name, ENCTYPE_NAME_OK(decrypt_mode) ? 662*0Sstevel@tonic-gate ENCTYPE_NAME(decrypt_mode) : UNKNOWN, 663*0Sstevel@tonic-gate decrypt_mode); 664*0Sstevel@tonic-gate encrypt_send_request_end(); 665*0Sstevel@tonic-gate } 666*0Sstevel@tonic-gate } 667*0Sstevel@tonic-gate 668*0Sstevel@tonic-gate void 669*0Sstevel@tonic-gate encrypt_session_key(Session_Key *key) 670*0Sstevel@tonic-gate { 671*0Sstevel@tonic-gate Encryptions *ep = encryptions; 672*0Sstevel@tonic-gate 673*0Sstevel@tonic-gate while (ep->type) { 674*0Sstevel@tonic-gate if (ep->session) 675*0Sstevel@tonic-gate (*ep->session)(key); 676*0Sstevel@tonic-gate #ifdef notdef 677*0Sstevel@tonic-gate if (!encrypt_output && autoencrypt) 678*0Sstevel@tonic-gate encrypt_start_output(ep->type); 679*0Sstevel@tonic-gate if (!decrypt_input && autodecrypt) 680*0Sstevel@tonic-gate encrypt_send_request_start(); 681*0Sstevel@tonic-gate #endif 682*0Sstevel@tonic-gate ++ep; 683*0Sstevel@tonic-gate } 684*0Sstevel@tonic-gate } 685*0Sstevel@tonic-gate 686*0Sstevel@tonic-gate /* 687*0Sstevel@tonic-gate * Called when ENCRYPT END is received. 688*0Sstevel@tonic-gate */ 689*0Sstevel@tonic-gate void 690*0Sstevel@tonic-gate encrypt_end(void) 691*0Sstevel@tonic-gate { 692*0Sstevel@tonic-gate decrypt_input = 0; 693*0Sstevel@tonic-gate if (encrypt_debug_mode) 694*0Sstevel@tonic-gate (void) printf(gettext( 695*0Sstevel@tonic-gate ">>>%s: Input is back to clear text\r\n"), Name); 696*0Sstevel@tonic-gate if (encrypt_verbose) 697*0Sstevel@tonic-gate (void) printf(gettext("[ Input is now clear text ]\r\n")); 698*0Sstevel@tonic-gate } 699*0Sstevel@tonic-gate 700*0Sstevel@tonic-gate /* 701*0Sstevel@tonic-gate * Called when ENCRYPT REQUEST-END is received. 702*0Sstevel@tonic-gate */ 703*0Sstevel@tonic-gate void 704*0Sstevel@tonic-gate encrypt_request_end(void) 705*0Sstevel@tonic-gate { 706*0Sstevel@tonic-gate encrypt_send_end(); 707*0Sstevel@tonic-gate } 708*0Sstevel@tonic-gate 709*0Sstevel@tonic-gate /* 710*0Sstevel@tonic-gate * Called when ENCRYPT REQUEST-START is received. If we receive 711*0Sstevel@tonic-gate * this before a type is picked, then that indicates that the 712*0Sstevel@tonic-gate * other side wants us to start encrypting data as soon as we 713*0Sstevel@tonic-gate * can. 714*0Sstevel@tonic-gate */ 715*0Sstevel@tonic-gate /* ARGSUSED */ 716*0Sstevel@tonic-gate void 717*0Sstevel@tonic-gate encrypt_request_start(uchar_t *data, int cnt) 718*0Sstevel@tonic-gate { 719*0Sstevel@tonic-gate if (encrypt_mode == 0) 720*0Sstevel@tonic-gate return; 721*0Sstevel@tonic-gate encrypt_start_output(encrypt_mode); 722*0Sstevel@tonic-gate } 723*0Sstevel@tonic-gate 724*0Sstevel@tonic-gate static uchar_t str_keyid[(MAXKEYLEN*2)+5] = { IAC, SB, TELOPT_ENCRYPT }; 725*0Sstevel@tonic-gate static void encrypt_keyid(struct key_info *, uchar_t *, int); 726*0Sstevel@tonic-gate 727*0Sstevel@tonic-gate void 728*0Sstevel@tonic-gate encrypt_enc_keyid(uchar_t *keyid, int len) 729*0Sstevel@tonic-gate { 730*0Sstevel@tonic-gate encrypt_keyid(&ki[KI_DECRYPT], keyid, len); 731*0Sstevel@tonic-gate } 732*0Sstevel@tonic-gate 733*0Sstevel@tonic-gate void 734*0Sstevel@tonic-gate encrypt_dec_keyid(uchar_t *keyid, int len) 735*0Sstevel@tonic-gate { 736*0Sstevel@tonic-gate encrypt_keyid(&ki[KI_ENCRYPT], keyid, len); 737*0Sstevel@tonic-gate } 738*0Sstevel@tonic-gate 739*0Sstevel@tonic-gate static void 740*0Sstevel@tonic-gate encrypt_keyid(struct key_info *kp, uchar_t *keyid, int len) 741*0Sstevel@tonic-gate { 742*0Sstevel@tonic-gate Encryptions *ep; 743*0Sstevel@tonic-gate int dir = kp->dir; 744*0Sstevel@tonic-gate register int ret = 0; 745*0Sstevel@tonic-gate 746*0Sstevel@tonic-gate if (!(ep = (*kp->getcrypt)(*kp->modep))) { 747*0Sstevel@tonic-gate if (len == 0) 748*0Sstevel@tonic-gate return; 749*0Sstevel@tonic-gate kp->keylen = 0; 750*0Sstevel@tonic-gate } else if (len == 0) { 751*0Sstevel@tonic-gate /* 752*0Sstevel@tonic-gate * Empty option, indicates a failure. 753*0Sstevel@tonic-gate */ 754*0Sstevel@tonic-gate if (kp->keylen == 0) 755*0Sstevel@tonic-gate return; 756*0Sstevel@tonic-gate kp->keylen = 0; 757*0Sstevel@tonic-gate if (ep->keyid) 758*0Sstevel@tonic-gate (void) (*ep->keyid)(dir, kp->keyid, &kp->keylen); 759*0Sstevel@tonic-gate 760*0Sstevel@tonic-gate } else if ((len != kp->keylen) || 761*0Sstevel@tonic-gate (memcmp(keyid, kp->keyid, len) != 0)) { 762*0Sstevel@tonic-gate /* 763*0Sstevel@tonic-gate * Length or contents are different 764*0Sstevel@tonic-gate */ 765*0Sstevel@tonic-gate kp->keylen = len; 766*0Sstevel@tonic-gate (void) memcpy(kp->keyid, keyid, len); 767*0Sstevel@tonic-gate if (ep->keyid) 768*0Sstevel@tonic-gate (void) (*ep->keyid)(dir, kp->keyid, &kp->keylen); 769*0Sstevel@tonic-gate } else { 770*0Sstevel@tonic-gate if (ep->keyid) 771*0Sstevel@tonic-gate ret = (*ep->keyid)(dir, kp->keyid, &kp->keylen); 772*0Sstevel@tonic-gate if ((ret == 0) && (dir == TELNET_DIR_ENCRYPT) && autoencrypt) 773*0Sstevel@tonic-gate encrypt_start_output(*kp->modep); 774*0Sstevel@tonic-gate return; 775*0Sstevel@tonic-gate } 776*0Sstevel@tonic-gate 777*0Sstevel@tonic-gate encrypt_send_keyid(dir, kp->keyid, kp->keylen, 0); 778*0Sstevel@tonic-gate } 779*0Sstevel@tonic-gate 780*0Sstevel@tonic-gate void 781*0Sstevel@tonic-gate encrypt_send_keyid(int dir, uchar_t *keyid, int keylen, int saveit) 782*0Sstevel@tonic-gate { 783*0Sstevel@tonic-gate uchar_t *strp; 784*0Sstevel@tonic-gate 785*0Sstevel@tonic-gate str_keyid[3] = (dir == TELNET_DIR_ENCRYPT) 786*0Sstevel@tonic-gate ? ENCRYPT_ENC_KEYID : ENCRYPT_DEC_KEYID; 787*0Sstevel@tonic-gate if (saveit) { 788*0Sstevel@tonic-gate struct key_info *kp = &ki[(dir == TELNET_DIR_ENCRYPT) ? 0 : 1]; 789*0Sstevel@tonic-gate (void) memcpy(kp->keyid, keyid, keylen); 790*0Sstevel@tonic-gate kp->keylen = keylen; 791*0Sstevel@tonic-gate } 792*0Sstevel@tonic-gate 793*0Sstevel@tonic-gate for (strp = &str_keyid[4]; keylen > 0; --keylen) { 794*0Sstevel@tonic-gate if ((*strp++ = *keyid++) == IAC) 795*0Sstevel@tonic-gate *strp++ = IAC; 796*0Sstevel@tonic-gate } 797*0Sstevel@tonic-gate *strp++ = IAC; 798*0Sstevel@tonic-gate *strp++ = SE; 799*0Sstevel@tonic-gate (void) net_write(str_keyid, strp - str_keyid); 800*0Sstevel@tonic-gate printsub('>', &str_keyid[2], strp - str_keyid - 2); 801*0Sstevel@tonic-gate } 802*0Sstevel@tonic-gate 803*0Sstevel@tonic-gate void 804*0Sstevel@tonic-gate encrypt_auto(int on) 805*0Sstevel@tonic-gate { 806*0Sstevel@tonic-gate autoencrypt = (on < 0) ? !autoencrypt : 807*0Sstevel@tonic-gate (on > 0) ? B_TRUE : B_FALSE; 808*0Sstevel@tonic-gate } 809*0Sstevel@tonic-gate 810*0Sstevel@tonic-gate void 811*0Sstevel@tonic-gate decrypt_auto(int on) 812*0Sstevel@tonic-gate { 813*0Sstevel@tonic-gate autodecrypt = (on < 0) ? !autodecrypt : 814*0Sstevel@tonic-gate (on > 0) ? B_TRUE : B_FALSE; 815*0Sstevel@tonic-gate } 816*0Sstevel@tonic-gate 817*0Sstevel@tonic-gate static void 818*0Sstevel@tonic-gate encrypt_start_output(int type) 819*0Sstevel@tonic-gate { 820*0Sstevel@tonic-gate Encryptions *ep; 821*0Sstevel@tonic-gate register uchar_t *p; 822*0Sstevel@tonic-gate register int i; 823*0Sstevel@tonic-gate 824*0Sstevel@tonic-gate if (!(ep = findencryption(type))) { 825*0Sstevel@tonic-gate if (encrypt_debug_mode) { 826*0Sstevel@tonic-gate (void) printf(gettext( 827*0Sstevel@tonic-gate ">>>%s: Can't encrypt with type %s (%d)\r\n"), 828*0Sstevel@tonic-gate Name, ENCTYPE_NAME_OK(type) ? 829*0Sstevel@tonic-gate ENCTYPE_NAME(type) : UNKNOWN, type); 830*0Sstevel@tonic-gate } 831*0Sstevel@tonic-gate return; 832*0Sstevel@tonic-gate } 833*0Sstevel@tonic-gate if (ep->start) { 834*0Sstevel@tonic-gate i = (*ep->start)(TELNET_DIR_ENCRYPT); 835*0Sstevel@tonic-gate if (encrypt_debug_mode) { 836*0Sstevel@tonic-gate (void) printf(gettext( 837*0Sstevel@tonic-gate ">>>%s: Encrypt start: %s (%d) %s\r\n"), 838*0Sstevel@tonic-gate Name, (i < 0) ? 839*0Sstevel@tonic-gate gettext("failed") : 840*0Sstevel@tonic-gate gettext("initial negotiation in progress"), 841*0Sstevel@tonic-gate i, ENCTYPE_NAME(type)); 842*0Sstevel@tonic-gate } 843*0Sstevel@tonic-gate if (i) 844*0Sstevel@tonic-gate return; 845*0Sstevel@tonic-gate } 846*0Sstevel@tonic-gate p = str_start + 3; 847*0Sstevel@tonic-gate *p++ = ENCRYPT_START; 848*0Sstevel@tonic-gate for (i = 0; i < ki[KI_ENCRYPT].keylen; ++i) { 849*0Sstevel@tonic-gate if ((*p++ = ki[KI_ENCRYPT].keyid[i]) == IAC) 850*0Sstevel@tonic-gate *p++ = IAC; 851*0Sstevel@tonic-gate } 852*0Sstevel@tonic-gate *p++ = IAC; 853*0Sstevel@tonic-gate *p++ = SE; 854*0Sstevel@tonic-gate (void) net_write(str_start, p - str_start); 855*0Sstevel@tonic-gate net_encrypt(); 856*0Sstevel@tonic-gate printsub('>', &str_start[2], p - &str_start[2]); 857*0Sstevel@tonic-gate /* 858*0Sstevel@tonic-gate * If we are already encrypting in some mode, then 859*0Sstevel@tonic-gate * encrypt the ring (which includes our request) in 860*0Sstevel@tonic-gate * the old mode, mark it all as "clear text" and then 861*0Sstevel@tonic-gate * switch to the new mode. 862*0Sstevel@tonic-gate */ 863*0Sstevel@tonic-gate encrypt_output = ep->output; 864*0Sstevel@tonic-gate encrypt_mode = type; 865*0Sstevel@tonic-gate if (encrypt_debug_mode) 866*0Sstevel@tonic-gate (void) printf(gettext( 867*0Sstevel@tonic-gate ">>>%s: Started to encrypt output with type %s\r\n"), 868*0Sstevel@tonic-gate Name, ENCTYPE_NAME(type)); 869*0Sstevel@tonic-gate if (encrypt_verbose) 870*0Sstevel@tonic-gate (void) printf(gettext( 871*0Sstevel@tonic-gate "[ Output is now encrypted with type %s ]\r\n"), 872*0Sstevel@tonic-gate ENCTYPE_NAME(type)); 873*0Sstevel@tonic-gate } 874*0Sstevel@tonic-gate 875*0Sstevel@tonic-gate static void 876*0Sstevel@tonic-gate encrypt_send_end(void) 877*0Sstevel@tonic-gate { 878*0Sstevel@tonic-gate if (!encrypt_output) 879*0Sstevel@tonic-gate return; 880*0Sstevel@tonic-gate 881*0Sstevel@tonic-gate str_end[3] = ENCRYPT_END; 882*0Sstevel@tonic-gate (void) net_write(str_end, sizeof (str_end)); 883*0Sstevel@tonic-gate net_encrypt(); 884*0Sstevel@tonic-gate printsub('>', &str_end[2], sizeof (str_end) - 2); 885*0Sstevel@tonic-gate /* 886*0Sstevel@tonic-gate * Encrypt the output buffer now because it will not be done by 887*0Sstevel@tonic-gate * netflush... 888*0Sstevel@tonic-gate */ 889*0Sstevel@tonic-gate encrypt_output = 0; 890*0Sstevel@tonic-gate if (encrypt_debug_mode) 891*0Sstevel@tonic-gate (void) printf(gettext( 892*0Sstevel@tonic-gate ">>>%s: Output is back to clear text\r\n"), Name); 893*0Sstevel@tonic-gate if (encrypt_verbose) 894*0Sstevel@tonic-gate (void) printf(gettext("[ Output is now clear text ]\r\n")); 895*0Sstevel@tonic-gate } 896*0Sstevel@tonic-gate 897*0Sstevel@tonic-gate static void 898*0Sstevel@tonic-gate encrypt_send_request_start(void) 899*0Sstevel@tonic-gate { 900*0Sstevel@tonic-gate register uchar_t *p; 901*0Sstevel@tonic-gate register int i; 902*0Sstevel@tonic-gate 903*0Sstevel@tonic-gate p = &str_start[3]; 904*0Sstevel@tonic-gate *p++ = ENCRYPT_REQSTART; 905*0Sstevel@tonic-gate for (i = 0; i < ki[KI_DECRYPT].keylen; ++i) { 906*0Sstevel@tonic-gate if ((*p++ = ki[KI_DECRYPT].keyid[i]) == IAC) 907*0Sstevel@tonic-gate *p++ = IAC; 908*0Sstevel@tonic-gate } 909*0Sstevel@tonic-gate *p++ = IAC; 910*0Sstevel@tonic-gate *p++ = SE; 911*0Sstevel@tonic-gate (void) net_write(str_start, p - str_start); 912*0Sstevel@tonic-gate printsub('>', &str_start[2], p - &str_start[2]); 913*0Sstevel@tonic-gate if (encrypt_debug_mode) 914*0Sstevel@tonic-gate (void) printf(gettext( 915*0Sstevel@tonic-gate ">>>%s: Request input to be encrypted\r\n"), Name); 916*0Sstevel@tonic-gate } 917*0Sstevel@tonic-gate 918*0Sstevel@tonic-gate static void 919*0Sstevel@tonic-gate encrypt_send_request_end(void) 920*0Sstevel@tonic-gate { 921*0Sstevel@tonic-gate str_end[3] = ENCRYPT_REQEND; 922*0Sstevel@tonic-gate (void) net_write(str_end, sizeof (str_end)); 923*0Sstevel@tonic-gate printsub('>', &str_end[2], sizeof (str_end) - 2); 924*0Sstevel@tonic-gate 925*0Sstevel@tonic-gate if (encrypt_debug_mode) 926*0Sstevel@tonic-gate (void) printf(gettext( 927*0Sstevel@tonic-gate ">>>%s: Request input to be clear text\r\n"), Name); 928*0Sstevel@tonic-gate } 929*0Sstevel@tonic-gate 930*0Sstevel@tonic-gate boolean_t 931*0Sstevel@tonic-gate encrypt_is_encrypting(void) 932*0Sstevel@tonic-gate { 933*0Sstevel@tonic-gate return (encrypt_output && decrypt_input ? B_TRUE : B_FALSE); 934*0Sstevel@tonic-gate } 935*0Sstevel@tonic-gate 936*0Sstevel@tonic-gate static void 937*0Sstevel@tonic-gate encrypt_gen_printsub(uchar_t *data, int cnt, uchar_t *buf, int buflen) 938*0Sstevel@tonic-gate { 939*0Sstevel@tonic-gate char lbuf[ENCR_LBUF_BUFSIZ], *cp; 940*0Sstevel@tonic-gate 941*0Sstevel@tonic-gate if (cnt < 2 || buflen < 2) 942*0Sstevel@tonic-gate return; 943*0Sstevel@tonic-gate cnt -= 2; 944*0Sstevel@tonic-gate data += 2; 945*0Sstevel@tonic-gate buf[buflen-1] = '\0'; 946*0Sstevel@tonic-gate buf[buflen-2] = '*'; 947*0Sstevel@tonic-gate buflen -= 2; 948*0Sstevel@tonic-gate for (; cnt > 0; cnt--, data++) { 949*0Sstevel@tonic-gate (void) snprintf(lbuf, ENCR_LBUF_BUFSIZ, " %d", *data); 950*0Sstevel@tonic-gate for (cp = lbuf; *cp && buflen > 0; --buflen) 951*0Sstevel@tonic-gate *buf++ = *cp++; 952*0Sstevel@tonic-gate if (buflen <= 0) 953*0Sstevel@tonic-gate return; 954*0Sstevel@tonic-gate } 955*0Sstevel@tonic-gate *buf = '\0'; 956*0Sstevel@tonic-gate } 957*0Sstevel@tonic-gate 958*0Sstevel@tonic-gate void 959*0Sstevel@tonic-gate encrypt_printsub(uchar_t *data, int cnt, uchar_t *buf, int buflen) 960*0Sstevel@tonic-gate { 961*0Sstevel@tonic-gate Encryptions *ep; 962*0Sstevel@tonic-gate register int type = data[1]; 963*0Sstevel@tonic-gate 964*0Sstevel@tonic-gate for (ep = encryptions; ep->type && ep->type != type; ep++) 965*0Sstevel@tonic-gate ; 966*0Sstevel@tonic-gate 967*0Sstevel@tonic-gate if (ep->printsub) 968*0Sstevel@tonic-gate (*ep->printsub)(data, cnt, buf, buflen); 969*0Sstevel@tonic-gate else 970*0Sstevel@tonic-gate encrypt_gen_printsub(data, cnt, buf, buflen); 971*0Sstevel@tonic-gate } 972