* Copyright (c) 1991 The Regents of the University of California.
* %sccs.include.redist.c%
static char sccsid
[] = "@(#)encrypt.c 5.1 (Berkeley) %G%";
* Copyright (C) 1990 by the Massachusetts Institute of Technology
* Export of this software from the United States of America is assumed
* to require a specific license from the United States Government.
* It is the responsibility of any person or organization contemplating
* export to obtain such a license before exporting.
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
* distribute this software and its documentation for any purpose and
* without fee is hereby granted, provided that the above copyright
* notice appear in all copies and that both that copyright notice and
* this permission notice appear in supporting documentation, and that
* the name of M.I.T. not be used in advertising or publicity pertaining
* to distribution of the software without specific, written prior
* permission. M.I.T. makes no representations about the suitability of
* this software for any purpose. It is provided "as is" without express
* These functions pointers point to the current routines
* for encrypting and decrypting data.
void (*encrypt_output
) P((unsigned char *, int));
int (*decrypt_input
) P((int));
int encrypt_debug_mode
= 0;
static int decrypt_mode
= 0;
static int encrypt_mode
= 0;
static int encrypt_verbose
= 0;
static int autoencrypt
= 0;
static int autodecrypt
= 0;
static int havesessionkey
= 0;
static int encrypt_mark
= 0;
static int decrypt_mark
= 0;
static char *Name
= "Noname";
#define typemask(x) ((x) > 0 ? 1 << ((x)-1) : 0)
static long i_support_encrypt
= typemask(ENCTYPE_KRBDES
);
static long i_support_decrypt
= typemask(ENCTYPE_KRBDES
);
static long remote_supports_encrypt
= 0;
static long remote_supports_decrypt
= 0;
static Encryptions encryptions
[] = {
#if defined(KRBDES_ENCRYPT)
{ "KRBDES", ENCTYPE_KRBDES
,
static unsigned char str_send
[64] = { IAC
, SB
, TELOPT_ENCRYPT
,
static unsigned char str_suplen
= 0;
static unsigned char str_start
[] = { IAC
, SB
, TELOPT_ENCRYPT
, 0, IAC
, SE
};
static unsigned char str_end
[] = { IAC
, SB
, TELOPT_ENCRYPT
, 0, IAC
, SE
};
Encryptions
*ep
= encryptions
;
if (!(i_support_encrypt
& remote_supports_decrypt
& typemask(type
)))
while (ep
->type
&& ep
->type
!= type
)
return(ep
->type
? ep
: 0);
Encryptions
*ep
= encryptions
;
if (!(i_support_decrypt
& remote_supports_encrypt
& typemask(type
)))
while (ep
->type
&& ep
->type
!= type
)
return(ep
->type
? ep
: 0);
encrypt_init(name
, server
)
Encryptions
*ep
= encryptions
;
i_support_encrypt
= i_support_decrypt
= 0;
remote_supports_encrypt
= remote_supports_decrypt
= 0;
encrypt_verbose
= !server
;
printf(">>>%s: I will support %s\r\n",
Name
, ENCTYPE_NAME(ep
->type
));
i_support_encrypt
|= typemask(ep
->type
);
i_support_decrypt
|= typemask(ep
->type
);
if ((str_send
[str_suplen
++] = ep
->type
) == IAC
)
str_send
[str_suplen
++] = IAC
;
str_send
[str_suplen
++] = IAC
;
str_send
[str_suplen
++] = SE
;
Encryptions
*ep
= encryptions
;
printf("Valid encryption types:\n");
printf("\t%s\n\n", ENCTYPE_NAME(ep
->type
));
EncryptEnable(type
, mode
)
if (isprefix(type
, "help") || isprefix(type
, "?")) {
printf("Usage: encrypt enable <type> [input|output]\n");
if (EncryptType(type
, mode
))
return(EncryptStart(mode
));
register Encryptions
*ep
;
if (isprefix(type
, "help") || isprefix(type
, "?")) {
printf("Usage: encrypt type <type> [input|output]\n");
ep
= (Encryptions
*)genget(type
, encryptions
, sizeof(Encryptions
));
printf("%s: invalid encryption type\n", type
);
printf("Ambiguous type '%s'\n", type
);
if (isprefix(mode
, "input"))
else if (isprefix(mode
, "output"))
printf("%s: invalid encryption mode\n", mode
);
decrypt_mode
= encrypt_mode
= ep
->type
;
if (isprefix(mode
, "input"))
return(EncryptStartInput());
if (isprefix(mode
, "output"))
return(EncryptStartOutput());
if (isprefix(mode
, "help") || isprefix(mode
, "?")) {
printf("Usage: encrypt start [input|output]\n");
printf("%s: invalid encryption mode 'encrypt start ?' for help\n", mode
);
ret
+= EncryptStartInput();
ret
+= EncryptStartOutput();
encrypt_send_request_start();
printf("No previous decryption mode, decryption not enabled\r\n");
encrypt_start_output(encrypt_mode
);
printf("No previous encryption mode, encryption not enabled\r\n");
if (isprefix(mode
, "input"))
return(EncryptStopInput());
if (isprefix(mode
, "output"))
return(EncryptStopOutput());
if (isprefix(mode
, "help") || isprefix(mode
, "?")) {
printf("Usage: encrypt stop [input|output]\n");
printf("%s: invalid encryption mode 'encrypt stop ?' for help\n", mode
);
ret
+= EncryptStopInput();
ret
+= EncryptStopOutput();
encrypt_send_request_end();
printf("Currently encrypting output with %s\r\n",
ENCTYPE_NAME(encrypt_mode
));
printf("Currently decrypting input with %s\r\n",
ENCTYPE_NAME(decrypt_mode
));
printf("Currently encrypting output with %s\r\n",
ENCTYPE_NAME(encrypt_mode
));
printf("Currently output is clear text.\r\n");
printf("Last encryption mode was %s\r\n",
ENCTYPE_NAME(encrypt_mode
));
printf("Currently decrypting input with %s\r\n",
ENCTYPE_NAME(decrypt_mode
));
} else if (decrypt_mode
) {
printf("Currently input is clear text.\r\n");
printf("Last decryption mode was %s\r\n",
ENCTYPE_NAME(decrypt_mode
));
* If the user has requested that decryption start
* immediatly, then send a "REQUEST START" before
if (!Server
&& autodecrypt
)
encrypt_send_request_start();
net_write(str_send
, str_suplen
);
printsub('>', &str_send
[2], str_suplen
- 2);
printf("Encryption debugging %s\r\n",
encrypt_debug_mode
? "enabled" : "disabled");
printf("Encryption %s verbose\r\n",
encrypt_verbose
? "is" : "is not");
printf("Automatic encryption of data is %s\r\n",
autoencrypt
? "enabled" : "disabled");
* Called when ENCRYPT SUPPORT is received.
encrypt_support(typelist
, cnt
)
register int type
, use_type
= 0;
* Forget anything the other side has previously told us.
remote_supports_decrypt
= 0;
printf(">>>%s: He is supporting %s (%d)\r\n",
ENCTYPE_NAME(type
), type
);
if ((type
< ENCTYPE_CNT
) &&
(i_support_encrypt
& typemask(type
))) {
remote_supports_decrypt
|= typemask(type
);
ep
= findencryption(use_type
);
type
= ep
->start
? (*ep
->start
)(DIR_ENCRYPT
, Server
) : 0;
printf(">>>%s: (*ep->start)() returned %d\r\n",
encrypt_start_output(use_type
);
remote_supports_encrypt
|= typemask(type
);
if (!(ep
= finddecryption(type
))) {
printf(">>>%s: Can't find type %s (%d) for initial negotiation\r\n",
ENCTYPE_NAME(data
[-1]), data
[1]);
printf(">>>%s: No initial negotiation needed for type %s (%d)\r\n",
ENCTYPE_NAME(type
), type
);
ret
= (*ep
->is
)(data
, cnt
);
/*@*/ if (encrypt_debug_mode
)
/*@*/ printf("(*ep->is)(%x, %d) returned %s(%d)\n", data
, cnt
,
/*@*/ (ret
< 0) ? "FAIL " :
/*@*/ (ret
== 0) ? "SUCCESS " : "MORE_TO_DO ", ret
);
if (ret
== 0 && autodecrypt
)
encrypt_send_request_start();
if (!(ep
= findencryption(type
))) {
printf(">>>%s: Can't find type %s (%d) for initial negotiation\r\n",
ENCTYPE_NAME(data
[-1]), data
[1]);
printf(">>>%s: No initial negotiation needed for type %s (%d)\r\n",
ENCTYPE_NAME(data
[-1]), data
[1]);
ret
= (*ep
->reply
)(data
, cnt
);
/*@*/ if (encrypt_debug_mode
)
/*@*/ printf("(*ep->reply)(%x, %d) returned %s(%d)\n",
/*@*/ (ret
< 0) ? "FAIL " :
/*@*/ (ret
== 0) ? "SUCCESS " : "MORE_TO_DO ", ret
);
printf(">>>%s: encrypt_reply returned %d\n", Name
, ret
);
if (ret
== 0 && autoencrypt
)
encrypt_start_output(type
);
* Called when a ENCRYPT START command is received.
* Something is wrong. We should not get a START
* command without having already picked our
* decryption scheme. Send a REQUEST-END to
* attempt to clear the channel...
printf("%s: Warning, Cannot decrypt input stream!!!\r\n", Name
);
encrypt_send_request_end();
if (ep
= finddecryption(decrypt_mode
)) {
decrypt_input
= ep
->input
;
printf("[ Input is now decrypted with type %s ]\r\n",
ENCTYPE_NAME(decrypt_mode
));
printf(">>>%s: Start to decrypt input with type %s\r\n",
Name
, ENCTYPE_NAME(decrypt_mode
));
printf("%s: Warning, Cannot decrypt type %s (%d)!!!\r\n",
Name
, ENCTYPE_NAME(decrypt_mode
), decrypt_mode
);
encrypt_send_request_end();
encrypt_session_key(key
, server
)
Encryptions
*ep
= encryptions
;
(*ep
->session
)(key
, server
);
if (!encrypt_output
&& autoencrypt
&& !server
)
encrypt_start_output(ep
->type
);
if (!decrypt_input
&& autodecrypt
&& !server
)
encrypt_send_request_start();
* Called when ENCRYPT END is received.
printf(">>>%s: Input is back to clear text\r\n", Name
);
printf("[ Input is now clear text ]\r\n");
* Called when ENCRYPT REQUEST-END is received.
* Called when ENCRYPT REQUEST-START is received. If we receive
* this before a type is picked, then that indicates that the
* other side wants us to start encrypting data as soon as we
if (!encrypt_mode
&& Server
) {
encrypt_start_output(encrypt_mode
);
encrypt_start_output(type
)
if (!(ep
= findencryption(type
))) {
if (encrypt_debug_mode
) {
printf(">>>%s: Marking type %s for later encryption use\r\n",
encrypt_mark
|= typemask(type
);
ret
= (*ep
->start
)(DIR_ENCRYPT
, Server
);
if (encrypt_debug_mode
) {
printf(">>>%s: Start failed for %s\r\n",
Name
, ENCTYPE_NAME(type
));
printf(">>>%s: Start: initial negotiation in progress%s\r\n",
Name
, ENCTYPE_NAME(type
));
str_start
[3] = ENCRYPT_START
;
net_write(str_start
, sizeof(str_start
));
printsub('>', &str_start
[2], sizeof(str_start
) - 2);
* If we are already encrypting in some mode, then
* encrypt the ring (which includes our request) in
* the old mode, mark it all as "clear text" and then
* switch to the new mode.
encrypt_output
= ep
->output
;
printf(">>>%s: Started to encrypt output with type %s\r\n",
Name
, ENCTYPE_NAME(type
));
printf("[ Output is now encrypted with type %s ]\r\n",
str_end
[3] = ENCRYPT_END
;
net_write(str_end
, sizeof(str_end
));
printsub('>', &str_end
[2], sizeof(str_end
) - 2);
* Encrypt the output buffer now because it will not be done by
printf(">>>%s: Output is back to clear text\r\n", Name
);
printf("[ Output is now clear text ]\r\n");
encrypt_send_request_start()
if (!(ep
= findencryption(type
))) {
if (encrypt_debug_mode
) {
printf(">>>%s: Marking type %s for later decryption use\r\n",
decrypt_mark
|= typemask(type
);
if (ep
->start
&& (*ep
->start
)(DIR_DECRYPT
, Server
)) {
if (encrypt_debug_mode
) {
printf(">>>%s: Request failed for %s\r\n",
str_start
[3] = ENCRYPT_REQSTART
;
net_write(str_start
, sizeof(str_start
));
printsub('>', &str_start
[2], sizeof(str_start
) - 2);
printf(">>>%s: Request input to be encrypted\r\n", Name
);
encrypt_send_request_end()
str_end
[3] = ENCRYPT_REQEND
;
net_write(str_end
, sizeof(str_end
));
printsub('>', &str_end
[2], sizeof(str_end
) - 2);
printf(">>>%s: Request input to be clear text\r\n", Name
);
register int encrypt
, decrypt
;
printf(">>>%s: in encrypt_wait\r\n", Name
);
if (!havesessionkey
|| !(i_support_encrypt
& remote_supports_decrypt
))
while (autoencrypt
&& !encrypt_output
)
encrypt_debug_mode
= mode
;
encrypt_gen_printsub(data
, cnt
, buf
, buflen
)
unsigned char *data
, *buf
;
for (; cnt
> 0; cnt
--, data
++) {
sprintf(tbuf
, " %d", *data
);
for (cp
= tbuf
; *cp
&& buflen
> 0; --buflen
)
encrypt_printsub(data
, cnt
, buf
, buflen
)
unsigned char *data
, *buf
;
register int type
= data
[1];
for (ep
= encryptions
; ep
->type
&& ep
->type
!= type
; ep
++)
(*ep
->printsub
)(data
, cnt
, buf
, buflen
);
encrypt_gen_printsub(data
, cnt
, buf
, buflen
);