key_call.c revision 7c478bd95313f5f23a4c958a745db2134aa03244
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License, Version 1.0 only
* (the "License"). You may not use this file except in compliance
* with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2004 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
* Portions of this source code were derived from Berkeley
* 4.3 BSD under license from the Regents of the University of
* California.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
/*
* key_call.c, Interface to keyserver
*
* setsecretkey(key) - set your secret key
* encryptsessionkey(agent, deskey) - encrypt a session key to talk to agent
* decryptsessionkey(agent, deskey) - decrypt ditto
* gendeskey(deskey) - generate a secure des key
*/
#include "mt.h"
#include "rpc_mt.h"
#include <errno.h>
#include <rpc/key_prot.h>
#include <stdio.h>
#include <syslog.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#define CLASSIC_PK_DH(k, a) (((k) == 192) && ((a) == 0))
#if defined(sparc)
#else /* !sparc */
#endif /* sparc */
#ifdef DEBUG
#else
#endif /* DEBUG */
int key_setnet(struct key_netstarg *);
/*
* Hack to allow the keyserver to use AUTH_DES (for authenticated
* NIS+ calls, for example). The only functions that get called
* are key_encryptsession_pk, key_decryptsession_pk, and key_gendes.
*
* The approach is to have the keyserver fill in pointers to local
* implementations of these functions, and to call those in key_call().
*/
int
const char *secretkey;
{
struct key_netstarg netst;
int ret;
trace1(TR_key_setsecret, 0);
if (getnetname(netName) == 0) {
debug("getnetname failed");
return (-1);
}
netst.st_pub_key[0] = 0;
/*
* Actual key login
* We perform the KEY_NET_PUT instead of the SET_KEY
* rpc call because key_secretkey_is_set function uses
* the KEY_NET_GET call which expects the netname to be
* set along with the key. Keylogin also uses KEY_NET_PUT.
*/
/* erase our copy of the secret key */
if (ret == 1)
return (0);
return (-1);
}
int
char *secretkey,
{
trace1(TR_key_setsecret_g, 0);
return (key_setsecret(secretkey));
}
xdr_keystatus, (char *)&status)) {
return (-1);
}
if (status != KEY_SUCCESS) {
debug("set3 status is nonzero");
return (-1);
}
return (0);
}
int
{
debug("remove secret key call failed");
return (-1);
}
if (status != KEY_SUCCESS) {
debug("remove secret status is nonzero");
return (-1);
}
return (0);
}
/*
* Use effective uid.
*/
int
{
return (key_removesecret_g_ext(0));
}
/*
* Use real uid.
*/
int
{
return (key_removesecret_g_ext(1));
}
/*
* key_secretkey_is_set() returns 1 if the keyserver has a secret key
* stored for the caller's effective uid if use_ruid is 0 or
* stored for the caller's real uid if use_ruid is 1.
* it returns 0 otherwise.
*
* N.B.: The KEY_NET_GET key call is undocumented. Applications shouldn't
* be using it, because it allows them to get the user's secret key.
*
*/
int
{
struct key_netstres kres;
/* avoid leaving secret key in memory */
return (1);
}
return (0);
}
/*
* Use effective uid.
*/
int
key_secretkey_is_set(void)
{
return (key_secretkey_is_set_ext(0));
}
/*
* Use real uid.
*/
int
{
return (key_secretkey_is_set_ext(1));
}
/*
* key_secretkey_is_set_g_ext() returns 1 if the keyserver has a secret key
* stored for the caller's uid, it returns 0 otherwise.
* If (use_ruid == 0), for the caller's effective uid.
* If (use_ruid == 1), for the caller's real uid.
*
* N.B.: The KEY_NET_GET_3 key call is undocumented. Applications shouldn't
* be using it, because it allows them to get the user's secret key.
*/
int
{
/*
* key_secretkey_is_set_g_ext is tricky because keylen == 0
* Rather than handle this on the server side, we call the old
* routine if keylen == 0 and try the newer stuff only if that fails
*/
return (1);
}
return (key_secretkey_is_set_ext(use_ruid));
}
/* avoid leaving secret key in memory */
return (1);
}
return (0);
}
/*
* Use effective uid.
*/
int
{
}
/*
* Use real uid.
*/
int
{
}
int
char *remotename;
{
xdr_cryptkeyres, (char *)&res)) {
return (-1);
}
debug("encrypt status is nonzero");
return (-1);
}
return (0);
}
int
const char *remotename,
const char *remotekey,
)
{
int i;
for (i = 0; i < keynum; i++) {
if (key_encryptsession_pk((char *)remotename,
return (-1);
}
return (0);
}
xdr_cryptkeyarg3, (char *)&arg,
xdr_cryptkeyres3, (char *)&res)) {
return (-1);
}
debug("encrypt3 status is nonzero");
return (-1);
}
debug("number of keys don't match");
return (-1);
}
return (0);
}
int
char *remotename;
{
xdr_cryptkeyres, (char *)&res)) {
return (-1);
}
debug("decrypt status is nonzero");
return (-1);
}
return (0);
}
int
const char *remotename,
const char *remotekey,
)
{
int i;
for (i = 0; i < keynum; i++) {
if (key_decryptsession_pk((char *)remotename,
return (-1);
}
return (0);
}
xdr_cryptkeyarg3, (char *)&arg,
xdr_cryptkeyres3, (char *)&res)) {
return (-1);
}
debug("decrypt3 status is nonzero");
return (-1);
}
debug("number of keys don't match");
return (-1);
}
return (0);
}
int
const char *remotename;
{
xdr_cryptkeyres, (char *)&res)) {
return (-1);
}
debug("encrypt status is nonzero");
return (-1);
}
return (0);
}
int
const char *remotename,
)
{
}
xdr_cryptkeyres3, (char *)&res)) {
return (-1);
}
debug("encrypt3 status is nonzero");
return (-1);
}
debug("encrypt3 didn't return same number of keys");
return (-1);
}
return (0);
}
int
const char *remotename;
{
xdr_cryptkeyres, (char *)&res)) {
return (-1);
}
debug("decrypt status is nonzero");
return (-1);
}
return (0);
}
int
const char *remotename,
)
{
}
xdr_cryptkeyres3, (char *)&res)) {
return (-1);
}
debug("decrypt3 status is nonzero");
return (-1);
}
debug("decrypt3 didn't return same number of keys");
return (-1);
}
return (0);
}
int
{
trace1(TR_key_gendes, 0);
xdr_des_block, (char *)key)) {
return (-1);
}
return (0);
}
int
)
{
trace1(TR_key_gendes_g, 0);
xdr_deskeyarray, (char *)&res)) {
return (-1);
}
debug("return length doesn't match\n");
return (-1);
}
return (0);
}
/*
* Call KEY_NET_PUT Operation to the keyserv.
*
* If use_ruid == 0, use effective uid.
* If use_ruid == 1, use real uid.
*/
int
{
trace1(TR_key_setnet_ext, 0);
return (-1);
}
if (status != KEY_SUCCESS) {
debug("key_setnet status is nonzero");
return (-1);
}
return (1);
}
/*
* Use effective uid.
*/
int
{
return (key_setnet_ext(arg, 0));
}
/*
* Use real uid.
*/
int
{
}
/*
* Input netname, secret and public keys (hex string representation)
* both, of skey or pkey may have zero length. If both lengths are
* specified, they must be the same.
*
* Call KEY_NET_PUT_3 Operation to the keyserv.
*
* If (use_ruid == 1), use real uid.
* If (use_ruid == 0), use effective uid.
*/
int
const char *netname,
const char *skey,
const char *pkey,
int use_ruid)
{
if (skeylen == 0) {
} else {
}
if (pkeylen == 0) {
} else {
}
if (skeylen == 0) {
if (pkeylen == 0) {
debug("keylens are both 0");
return (-1);
}
} else {
debug("keylens don't match");
return (-1);
}
}
if (skeylen != 0) {
sizeof (tmp.st_priv_key));
} else {
}
if (pkeylen != 0) {
} else {
}
return (key_setnet(&tmp));
}
xdr_key_netstarg3, (char *)&arg,
return (-1);
}
if (status != KEY_SUCCESS) {
debug("key_setnet3 status is nonzero");
return (-1);
}
return (0);
}
/*
* Use effective uid.
*/
int
{
algtype, 0));
}
/*
* Use real uid.
*/
int
{
algtype, 1));
}
int
char *pkey;
{
trace1(TR_key_get_conv, 0);
xdr_cryptkeyres, (char *)&res)) {
return (-1);
}
debug("get_conv status is nonzero");
return (-1);
}
return (0);
}
int
const char *pkey,
)
{
trace1(TR_key_get_conv_g, 0);
}
xdr_cryptkeyres3, (char *)&res)) {
return (-1);
}
debug("get_conv3 status is nonzero");
return (-1);
}
debug("get_conv3 number of keys dont match");
return (-1);
}
return (0);
}
struct key_call_private {
int fd; /* client handle fd */
};
static void set_rdev(struct key_call_private *);
static int check_rdev(struct key_call_private *);
static void
key_call_destroy(void *vp)
{
}
}
static pthread_key_t key_call_key;
void
_key_call_fini(void)
{
if (key_call_key &&
}
}
/*
* Keep the handle cached. This call may be made quite often.
*/
static CLIENT *
{
int _update_did();
return (NULL);
}
/*
* if pid has changed, destroy client and rebuild
* or if stale is '1' then destroy client and rebuild
*/
}
int fd;
/*
* Change the version number to the new one.
*/
"out of memory!");
return (NULL);
}
/* Update fd in kcp because it was reopened in _update_did */
(fd >= 0))
}
return (NULL);
}
/*
* RPC calls to the keyserv.
*
* If (use_ruid == 1), use real uid.
* If (use_ruid == 0), use effective uid.
* Returns 0 on failure, 1 on success
*/
int
char *arg;
char *rslt;
int use_ruid;
{
int vers;
bool_t r;
if (r == TRUE) {
/* LINTED pointer alignment */
return (1);
}
return (0);
}
bool_t r;
if (r == TRUE) {
/* LINTED pointer alignment */
return (1);
}
return (0);
}
bool_t r;
if (r == TRUE) {
/* LINTED pointer alignment */
return (1);
}
return (0);
}
(proc == KEY_GET_CONV))
else
return (0);
if (use_ruid)
else
switch (status) {
case RPC_SUCCESS:
return (1);
case RPC_CANTRECV:
/*
* keyserv was probably restarted, so we'll try once more
*/
return (0);
if (use_ruid)
else
wait_time) == RPC_SUCCESS)
return (1);
return (0);
default:
return (0);
}
}
/*
* Use effective uid.
*/
int
char *rslt)
{
}
/*
* Use real uid.
*/
int
{
}
static
void
struct key_call_private *kcp;
{
int fd;
return;
}
}
static
int
struct key_call_private *kcp;
{
return (1); /* can't check it, assume it is okay */
/* could be because file descriptor was closed */
/* it's not our file descriptor, so don't try to close it */
return (0);
}
"keyserv_client: fd %d changed, old=0x%x, new=0x%x",
/* it's not our file descriptor, so don't try to close it */
return (0);
}
return (1); /* fd is okay */
}