17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * Copyright 2002 Sun Microsystems, Inc. All rights reserved.
37c478bd9Sstevel@tonic-gate * Use is subject to license terms.
47c478bd9Sstevel@tonic-gate */
57c478bd9Sstevel@tonic-gate
67c478bd9Sstevel@tonic-gate /*
77c478bd9Sstevel@tonic-gate * usr/src/cmd/cmd-inet/usr.bin/telnet/enc_des.c
87c478bd9Sstevel@tonic-gate */
97c478bd9Sstevel@tonic-gate
107c478bd9Sstevel@tonic-gate /*
117c478bd9Sstevel@tonic-gate * Copyright (c) 1991, 1993
127c478bd9Sstevel@tonic-gate * The Regents of the University of California. All rights reserved.
137c478bd9Sstevel@tonic-gate *
147c478bd9Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
157c478bd9Sstevel@tonic-gate * modification, are permitted provided that the following conditions
167c478bd9Sstevel@tonic-gate * are met:
177c478bd9Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
187c478bd9Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
197c478bd9Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
207c478bd9Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the
217c478bd9Sstevel@tonic-gate * documentation and/or other materials provided with the distribution.
227c478bd9Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software
237c478bd9Sstevel@tonic-gate * must display the following acknowledgement:
247c478bd9Sstevel@tonic-gate * This product includes software developed by the University of
257c478bd9Sstevel@tonic-gate * California, Berkeley and its contributors.
267c478bd9Sstevel@tonic-gate * 4. Neither the name of the University nor the names of its contributors
277c478bd9Sstevel@tonic-gate * may be used to endorse or promote products derived from this software
287c478bd9Sstevel@tonic-gate * without specific prior written permission.
297c478bd9Sstevel@tonic-gate *
307c478bd9Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
317c478bd9Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
327c478bd9Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
337c478bd9Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
347c478bd9Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
357c478bd9Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
367c478bd9Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
377c478bd9Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
387c478bd9Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
397c478bd9Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
407c478bd9Sstevel@tonic-gate * SUCH DAMAGE.
417c478bd9Sstevel@tonic-gate */
427c478bd9Sstevel@tonic-gate
437c478bd9Sstevel@tonic-gate /*
447c478bd9Sstevel@tonic-gate * Copyright (C) 1998 by the FundsXpress, INC.
457c478bd9Sstevel@tonic-gate *
467c478bd9Sstevel@tonic-gate * All rights reserved.
477c478bd9Sstevel@tonic-gate *
487c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may require
497c478bd9Sstevel@tonic-gate * a specific license from the United States Government. It is the
507c478bd9Sstevel@tonic-gate * responsibility of any person or organization contemplating export to
517c478bd9Sstevel@tonic-gate * obtain such a license before exporting.
527c478bd9Sstevel@tonic-gate *
537c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
547c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
557c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
567c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
577c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
587c478bd9Sstevel@tonic-gate * the name of FundsXpress. not be used in advertising or publicity pertaining
597c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
607c478bd9Sstevel@tonic-gate * permission. FundsXpress makes no representations about the suitability of
617c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
627c478bd9Sstevel@tonic-gate * or implied warranty.
637c478bd9Sstevel@tonic-gate *
647c478bd9Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
657c478bd9Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
667c478bd9Sstevel@tonic-gate * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
677c478bd9Sstevel@tonic-gate */
687c478bd9Sstevel@tonic-gate
697c478bd9Sstevel@tonic-gate /* based on @(#)enc_des.c 8.1 (Berkeley) 6/4/93 */
7048bbca81SDaniel Hoffman /*
7148bbca81SDaniel Hoffman * Copyright (c) 2016 by Delphix. All rights reserved.
7248bbca81SDaniel Hoffman */
737c478bd9Sstevel@tonic-gate
747c478bd9Sstevel@tonic-gate #include <krb5.h>
757c478bd9Sstevel@tonic-gate #include <stdio.h>
767c478bd9Sstevel@tonic-gate #include <arpa/telnet.h>
777c478bd9Sstevel@tonic-gate
787c478bd9Sstevel@tonic-gate #ifdef __STDC__
797c478bd9Sstevel@tonic-gate #include <stdlib.h>
807c478bd9Sstevel@tonic-gate #endif
817c478bd9Sstevel@tonic-gate
827c478bd9Sstevel@tonic-gate #include "externs.h"
837c478bd9Sstevel@tonic-gate
847c478bd9Sstevel@tonic-gate extern boolean_t encrypt_debug_mode;
857c478bd9Sstevel@tonic-gate extern krb5_context telnet_context;
867c478bd9Sstevel@tonic-gate
877c478bd9Sstevel@tonic-gate #define KEYFLAG_SHIFT 2
887c478bd9Sstevel@tonic-gate #define SHIFT_VAL(a, b) (KEYFLAG_SHIFT*((a)+((b)*2)))
897c478bd9Sstevel@tonic-gate
907c478bd9Sstevel@tonic-gate static struct _fb {
917c478bd9Sstevel@tonic-gate Block temp_feed;
927c478bd9Sstevel@tonic-gate int state[2]; /* state for each direction */
937c478bd9Sstevel@tonic-gate int keyid[2]; /* keyid for each direction */
947c478bd9Sstevel@tonic-gate int once;
957c478bd9Sstevel@tonic-gate unsigned char fb_feed[64];
967c478bd9Sstevel@tonic-gate boolean_t need_start;
977c478bd9Sstevel@tonic-gate boolean_t validkey;
987c478bd9Sstevel@tonic-gate struct stinfo {
997c478bd9Sstevel@tonic-gate Block str_output;
1007c478bd9Sstevel@tonic-gate Block str_feed;
1017c478bd9Sstevel@tonic-gate Block str_iv;
1027c478bd9Sstevel@tonic-gate unsigned char str_keybytes[DES_BLOCKSIZE];
1037c478bd9Sstevel@tonic-gate krb5_keyblock str_key;
1047c478bd9Sstevel@tonic-gate int str_index;
1057c478bd9Sstevel@tonic-gate int str_flagshift;
1067c478bd9Sstevel@tonic-gate } streams[2]; /* one for encrypt, one for decrypt */
1077c478bd9Sstevel@tonic-gate } des_cfb;
1087c478bd9Sstevel@tonic-gate
1097c478bd9Sstevel@tonic-gate static void cfb64_stream_iv(Block, struct stinfo *);
1107c478bd9Sstevel@tonic-gate static void cfb64_stream_key(Block, struct stinfo *);
1117c478bd9Sstevel@tonic-gate
1127c478bd9Sstevel@tonic-gate static void
ecb_encrypt(struct stinfo * stp,Block in,Block out)1137c478bd9Sstevel@tonic-gate ecb_encrypt(struct stinfo *stp, Block in, Block out)
1147c478bd9Sstevel@tonic-gate {
1157c478bd9Sstevel@tonic-gate krb5_error_code code;
1167c478bd9Sstevel@tonic-gate krb5_data din;
1177c478bd9Sstevel@tonic-gate krb5_enc_data dout;
1187c478bd9Sstevel@tonic-gate
1197c478bd9Sstevel@tonic-gate din.length = DES_BLOCKSIZE;
1207c478bd9Sstevel@tonic-gate din.data = (char *)in;
1217c478bd9Sstevel@tonic-gate
1227c478bd9Sstevel@tonic-gate dout.ciphertext.length = DES_BLOCKSIZE;
1237c478bd9Sstevel@tonic-gate dout.ciphertext.data = (char *)out;
1247c478bd9Sstevel@tonic-gate /* this is a kerberos enctype, not a telopt enctype */
1257c478bd9Sstevel@tonic-gate dout.enctype = ENCTYPE_UNKNOWN;
1267c478bd9Sstevel@tonic-gate
127*95c74518SToomas Soome code = krb5_c_encrypt(telnet_context, &stp->str_key, 0, NULL,
1287c478bd9Sstevel@tonic-gate &din, &dout);
1297c478bd9Sstevel@tonic-gate if (code)
1307c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(
1317c478bd9Sstevel@tonic-gate "Error encrypting stream data (%s)\r\n"), code);
1327c478bd9Sstevel@tonic-gate }
1337c478bd9Sstevel@tonic-gate
1347c478bd9Sstevel@tonic-gate void
cfb64_init(void)1357c478bd9Sstevel@tonic-gate cfb64_init(void)
1367c478bd9Sstevel@tonic-gate {
1377c478bd9Sstevel@tonic-gate register struct _fb *fbp = &des_cfb;
1387c478bd9Sstevel@tonic-gate
1397c478bd9Sstevel@tonic-gate (void) memset((void *)fbp, 0, sizeof (*fbp));
1407c478bd9Sstevel@tonic-gate fbp->state[0] = des_cfb.state[1] = ENCR_STATE_FAILED;
1417c478bd9Sstevel@tonic-gate fbp->fb_feed[0] = IAC;
1427c478bd9Sstevel@tonic-gate fbp->fb_feed[1] = SB;
1437c478bd9Sstevel@tonic-gate fbp->fb_feed[2] = TELOPT_ENCRYPT;
1447c478bd9Sstevel@tonic-gate fbp->fb_feed[3] = ENCRYPT_IS;
1457c478bd9Sstevel@tonic-gate
1467c478bd9Sstevel@tonic-gate fbp->fb_feed[4] = TELOPT_ENCTYPE_DES_CFB64;
1477c478bd9Sstevel@tonic-gate fbp->streams[TELNET_DIR_DECRYPT].str_flagshift =
1487c478bd9Sstevel@tonic-gate SHIFT_VAL(0, CFB);
1497c478bd9Sstevel@tonic-gate fbp->streams[TELNET_DIR_ENCRYPT].str_flagshift =
1507c478bd9Sstevel@tonic-gate SHIFT_VAL(1, CFB);
1517c478bd9Sstevel@tonic-gate }
1527c478bd9Sstevel@tonic-gate
1537c478bd9Sstevel@tonic-gate
1547c478bd9Sstevel@tonic-gate /*
1557c478bd9Sstevel@tonic-gate * Returns:
1567c478bd9Sstevel@tonic-gate * -1: some error. Negotiation is done, encryption not ready.
1577c478bd9Sstevel@tonic-gate * 0: Successful, initial negotiation all done.
1587c478bd9Sstevel@tonic-gate * 1: successful, negotiation not done yet.
1597c478bd9Sstevel@tonic-gate * 2: Not yet. Other things (like getting the key from
1607c478bd9Sstevel@tonic-gate * Kerberos) have to happen before we can continue.
1617c478bd9Sstevel@tonic-gate */
1627c478bd9Sstevel@tonic-gate int
cfb64_start(int dir)1637c478bd9Sstevel@tonic-gate cfb64_start(int dir)
1647c478bd9Sstevel@tonic-gate {
1657c478bd9Sstevel@tonic-gate struct _fb *fbp = &des_cfb;
1667c478bd9Sstevel@tonic-gate int x;
1677c478bd9Sstevel@tonic-gate unsigned char *p;
1687c478bd9Sstevel@tonic-gate register int state;
1697c478bd9Sstevel@tonic-gate
1707c478bd9Sstevel@tonic-gate switch (dir) {
1717c478bd9Sstevel@tonic-gate case TELNET_DIR_DECRYPT:
1727c478bd9Sstevel@tonic-gate /*
1737c478bd9Sstevel@tonic-gate * This is simply a request to have the other side
17448bbca81SDaniel Hoffman * start output (our input). The other side will negotiate an
1757c478bd9Sstevel@tonic-gate * IV so we need not look for it.
1767c478bd9Sstevel@tonic-gate */
1777c478bd9Sstevel@tonic-gate state = fbp->state[dir];
1787c478bd9Sstevel@tonic-gate if (state == ENCR_STATE_FAILED)
1797c478bd9Sstevel@tonic-gate state = ENCR_STATE_IN_PROGRESS;
1807c478bd9Sstevel@tonic-gate break;
1817c478bd9Sstevel@tonic-gate
1827c478bd9Sstevel@tonic-gate case TELNET_DIR_ENCRYPT:
1837c478bd9Sstevel@tonic-gate state = fbp->state[dir];
1847c478bd9Sstevel@tonic-gate if (state == ENCR_STATE_FAILED)
1857c478bd9Sstevel@tonic-gate state = ENCR_STATE_IN_PROGRESS;
1867c478bd9Sstevel@tonic-gate else if ((state & ENCR_STATE_NO_SEND_IV) == 0)
1877c478bd9Sstevel@tonic-gate break;
1887c478bd9Sstevel@tonic-gate
1897c478bd9Sstevel@tonic-gate if (!fbp->validkey) {
1907c478bd9Sstevel@tonic-gate fbp->need_start = B_TRUE;
1917c478bd9Sstevel@tonic-gate break;
1927c478bd9Sstevel@tonic-gate }
1937c478bd9Sstevel@tonic-gate state &= ~ENCR_STATE_NO_SEND_IV;
1947c478bd9Sstevel@tonic-gate state |= ENCR_STATE_NO_RECV_IV;
1957c478bd9Sstevel@tonic-gate if (encrypt_debug_mode)
1967c478bd9Sstevel@tonic-gate (void) printf(gettext("Creating new feed\r\n"));
1977c478bd9Sstevel@tonic-gate /*
1987c478bd9Sstevel@tonic-gate * Create a random feed and send it over.
1997c478bd9Sstevel@tonic-gate */
2007c478bd9Sstevel@tonic-gate {
2017c478bd9Sstevel@tonic-gate krb5_data d;
2027c478bd9Sstevel@tonic-gate krb5_error_code code;
2037c478bd9Sstevel@tonic-gate
2047c478bd9Sstevel@tonic-gate d.data = (char *)fbp->temp_feed;
2057c478bd9Sstevel@tonic-gate d.length = sizeof (fbp->temp_feed);
2067c478bd9Sstevel@tonic-gate
2077c478bd9Sstevel@tonic-gate code = krb5_c_random_make_octets(telnet_context, &d);
2087c478bd9Sstevel@tonic-gate if (code != 0)
2097c478bd9Sstevel@tonic-gate return (ENCR_STATE_FAILED);
2107c478bd9Sstevel@tonic-gate }
2117c478bd9Sstevel@tonic-gate
2127c478bd9Sstevel@tonic-gate p = fbp->fb_feed + 3;
2137c478bd9Sstevel@tonic-gate *p++ = ENCRYPT_IS;
2147c478bd9Sstevel@tonic-gate p++;
2157c478bd9Sstevel@tonic-gate *p++ = FB64_IV;
2167c478bd9Sstevel@tonic-gate for (x = 0; x < sizeof (Block); ++x) {
2177c478bd9Sstevel@tonic-gate if ((*p++ = fbp->temp_feed[x]) == IAC)
2187c478bd9Sstevel@tonic-gate *p++ = IAC;
2197c478bd9Sstevel@tonic-gate }
2207c478bd9Sstevel@tonic-gate *p++ = IAC;
2217c478bd9Sstevel@tonic-gate *p++ = SE;
2227c478bd9Sstevel@tonic-gate printsub('>', &fbp->fb_feed[2], p - &fbp->fb_feed[2]);
2237c478bd9Sstevel@tonic-gate (void) net_write(fbp->fb_feed, p - fbp->fb_feed);
2247c478bd9Sstevel@tonic-gate break;
2257c478bd9Sstevel@tonic-gate default:
2267c478bd9Sstevel@tonic-gate return (ENCR_STATE_FAILED);
2277c478bd9Sstevel@tonic-gate }
2287c478bd9Sstevel@tonic-gate return (fbp->state[dir] = state);
2297c478bd9Sstevel@tonic-gate }
2307c478bd9Sstevel@tonic-gate
2317c478bd9Sstevel@tonic-gate /*
2327c478bd9Sstevel@tonic-gate * Returns:
2337c478bd9Sstevel@tonic-gate * -1: some error. Negotiation is done, encryption not ready.
2347c478bd9Sstevel@tonic-gate * 0: Successful, initial negotiation all done.
2357c478bd9Sstevel@tonic-gate * 1: successful, negotiation not done yet.
2367c478bd9Sstevel@tonic-gate */
2377c478bd9Sstevel@tonic-gate int
cfb64_is(unsigned char * data,int cnt)2387c478bd9Sstevel@tonic-gate cfb64_is(unsigned char *data, int cnt)
2397c478bd9Sstevel@tonic-gate {
2407c478bd9Sstevel@tonic-gate unsigned char *p;
2417c478bd9Sstevel@tonic-gate struct _fb *fbp = &des_cfb;
2427c478bd9Sstevel@tonic-gate register int state = fbp->state[TELNET_DIR_DECRYPT];
2437c478bd9Sstevel@tonic-gate
2447c478bd9Sstevel@tonic-gate if (cnt-- < 1)
2457c478bd9Sstevel@tonic-gate goto failure;
2467c478bd9Sstevel@tonic-gate
2477c478bd9Sstevel@tonic-gate switch (*data++) {
2487c478bd9Sstevel@tonic-gate case FB64_IV:
2497c478bd9Sstevel@tonic-gate if (cnt != sizeof (Block)) {
2507c478bd9Sstevel@tonic-gate if (encrypt_debug_mode)
2517c478bd9Sstevel@tonic-gate (void) printf(gettext(
2527c478bd9Sstevel@tonic-gate "CFB64: initial vector failed "
2537c478bd9Sstevel@tonic-gate "on size\r\n"));
2547c478bd9Sstevel@tonic-gate state = ENCR_STATE_FAILED;
2557c478bd9Sstevel@tonic-gate goto failure;
2567c478bd9Sstevel@tonic-gate }
2577c478bd9Sstevel@tonic-gate
2587c478bd9Sstevel@tonic-gate if (encrypt_debug_mode)
2597c478bd9Sstevel@tonic-gate (void) printf(gettext(
2607c478bd9Sstevel@tonic-gate "CFB64: initial vector received\r\n"));
2617c478bd9Sstevel@tonic-gate
2627c478bd9Sstevel@tonic-gate if (encrypt_debug_mode)
2637c478bd9Sstevel@tonic-gate (void) printf(gettext(
2647c478bd9Sstevel@tonic-gate "Initializing Decrypt stream\r\n"));
2657c478bd9Sstevel@tonic-gate
2667c478bd9Sstevel@tonic-gate cfb64_stream_iv((void *)data,
2677c478bd9Sstevel@tonic-gate &fbp->streams[TELNET_DIR_DECRYPT]);
2687c478bd9Sstevel@tonic-gate
2697c478bd9Sstevel@tonic-gate p = fbp->fb_feed + 3;
2707c478bd9Sstevel@tonic-gate *p++ = ENCRYPT_REPLY;
2717c478bd9Sstevel@tonic-gate p++;
2727c478bd9Sstevel@tonic-gate *p++ = FB64_IV_OK;
2737c478bd9Sstevel@tonic-gate *p++ = IAC;
2747c478bd9Sstevel@tonic-gate *p++ = SE;
2757c478bd9Sstevel@tonic-gate printsub('>', &fbp->fb_feed[2], p - &fbp->fb_feed[2]);
2767c478bd9Sstevel@tonic-gate (void) net_write(fbp->fb_feed, p - fbp->fb_feed);
2777c478bd9Sstevel@tonic-gate
2787c478bd9Sstevel@tonic-gate state = fbp->state[TELNET_DIR_DECRYPT] = ENCR_STATE_IN_PROGRESS;
2797c478bd9Sstevel@tonic-gate break;
2807c478bd9Sstevel@tonic-gate
2817c478bd9Sstevel@tonic-gate default:
2827c478bd9Sstevel@tonic-gate if (encrypt_debug_mode) {
2837c478bd9Sstevel@tonic-gate (void) printf(gettext(
2847c478bd9Sstevel@tonic-gate "Unknown option type: %d\r\n"), *(data-1));
2857c478bd9Sstevel@tonic-gate printd(data, cnt);
2867c478bd9Sstevel@tonic-gate (void) printf("\r\n");
2877c478bd9Sstevel@tonic-gate }
2887c478bd9Sstevel@tonic-gate /* FALL THROUGH */
2897c478bd9Sstevel@tonic-gate failure:
2907c478bd9Sstevel@tonic-gate /*
2917c478bd9Sstevel@tonic-gate * We failed. Send an FB64_IV_BAD option
2927c478bd9Sstevel@tonic-gate * to the other side so it will know that
2937c478bd9Sstevel@tonic-gate * things failed.
2947c478bd9Sstevel@tonic-gate */
2957c478bd9Sstevel@tonic-gate p = fbp->fb_feed + 3;
2967c478bd9Sstevel@tonic-gate *p++ = ENCRYPT_REPLY;
2977c478bd9Sstevel@tonic-gate p++;
2987c478bd9Sstevel@tonic-gate *p++ = FB64_IV_BAD;
2997c478bd9Sstevel@tonic-gate *p++ = IAC;
3007c478bd9Sstevel@tonic-gate *p++ = SE;
3017c478bd9Sstevel@tonic-gate printsub('>', &fbp->fb_feed[2], p - &fbp->fb_feed[2]);
3027c478bd9Sstevel@tonic-gate (void) net_write(fbp->fb_feed, p - fbp->fb_feed);
3037c478bd9Sstevel@tonic-gate
3047c478bd9Sstevel@tonic-gate break;
3057c478bd9Sstevel@tonic-gate }
3067c478bd9Sstevel@tonic-gate return (fbp->state[TELNET_DIR_DECRYPT] = state);
3077c478bd9Sstevel@tonic-gate }
3087c478bd9Sstevel@tonic-gate
3097c478bd9Sstevel@tonic-gate /*
3107c478bd9Sstevel@tonic-gate * Returns:
3117c478bd9Sstevel@tonic-gate * -1: some error. Negotiation is done, encryption not ready.
3127c478bd9Sstevel@tonic-gate * 0: Successful, initial negotiation all done.
3137c478bd9Sstevel@tonic-gate * 1: successful, negotiation not done yet.
3147c478bd9Sstevel@tonic-gate */
3157c478bd9Sstevel@tonic-gate int
cfb64_reply(unsigned char * data,int cnt)3167c478bd9Sstevel@tonic-gate cfb64_reply(unsigned char *data, int cnt)
3177c478bd9Sstevel@tonic-gate {
3187c478bd9Sstevel@tonic-gate struct _fb *fbp = &des_cfb;
3197c478bd9Sstevel@tonic-gate register int state = fbp->state[TELNET_DIR_ENCRYPT];
3207c478bd9Sstevel@tonic-gate
3217c478bd9Sstevel@tonic-gate if (cnt-- < 1)
3227c478bd9Sstevel@tonic-gate goto failure;
3237c478bd9Sstevel@tonic-gate
3247c478bd9Sstevel@tonic-gate switch (*data++) {
3257c478bd9Sstevel@tonic-gate case FB64_IV_OK:
3267c478bd9Sstevel@tonic-gate cfb64_stream_iv(fbp->temp_feed,
3277c478bd9Sstevel@tonic-gate &fbp->streams[TELNET_DIR_ENCRYPT]);
3287c478bd9Sstevel@tonic-gate if (state == ENCR_STATE_FAILED)
3297c478bd9Sstevel@tonic-gate state = ENCR_STATE_IN_PROGRESS;
3307c478bd9Sstevel@tonic-gate state &= ~ENCR_STATE_NO_RECV_IV;
3317c478bd9Sstevel@tonic-gate encrypt_send_keyid(TELNET_DIR_ENCRYPT,
3327c478bd9Sstevel@tonic-gate (unsigned char *)"\0", 1, 1);
3337c478bd9Sstevel@tonic-gate break;
3347c478bd9Sstevel@tonic-gate
3357c478bd9Sstevel@tonic-gate case FB64_IV_BAD:
3367c478bd9Sstevel@tonic-gate (void) memset(fbp->temp_feed, 0, sizeof (Block));
3377c478bd9Sstevel@tonic-gate cfb64_stream_iv(fbp->temp_feed,
3387c478bd9Sstevel@tonic-gate &fbp->streams[TELNET_DIR_ENCRYPT]);
3397c478bd9Sstevel@tonic-gate state = ENCR_STATE_FAILED;
3407c478bd9Sstevel@tonic-gate break;
3417c478bd9Sstevel@tonic-gate
3427c478bd9Sstevel@tonic-gate default:
3437c478bd9Sstevel@tonic-gate if (encrypt_debug_mode) {
3447c478bd9Sstevel@tonic-gate (void) printf(gettext(
3457c478bd9Sstevel@tonic-gate "Unknown option type: %d\r\n"), data[-1]);
3467c478bd9Sstevel@tonic-gate printd(data, cnt);
3477c478bd9Sstevel@tonic-gate (void) printf("\r\n");
3487c478bd9Sstevel@tonic-gate }
3497c478bd9Sstevel@tonic-gate /* FALL THROUGH */
3507c478bd9Sstevel@tonic-gate failure:
3517c478bd9Sstevel@tonic-gate state = ENCR_STATE_FAILED;
3527c478bd9Sstevel@tonic-gate break;
3537c478bd9Sstevel@tonic-gate }
3547c478bd9Sstevel@tonic-gate return (fbp->state[TELNET_DIR_ENCRYPT] = state);
3557c478bd9Sstevel@tonic-gate }
3567c478bd9Sstevel@tonic-gate
3577c478bd9Sstevel@tonic-gate void
cfb64_session(Session_Key * key)3587c478bd9Sstevel@tonic-gate cfb64_session(Session_Key *key)
3597c478bd9Sstevel@tonic-gate {
3607c478bd9Sstevel@tonic-gate struct _fb *fbp = &des_cfb;
3617c478bd9Sstevel@tonic-gate
3627c478bd9Sstevel@tonic-gate if (!key || key->type != SK_DES) {
3637c478bd9Sstevel@tonic-gate if (encrypt_debug_mode)
3647c478bd9Sstevel@tonic-gate (void) printf(gettext(
3657c478bd9Sstevel@tonic-gate "Can't set DES's session key (%d != %d)\r\n"),
3667c478bd9Sstevel@tonic-gate key ? key->type : -1, SK_DES);
3677c478bd9Sstevel@tonic-gate return;
3687c478bd9Sstevel@tonic-gate }
3697c478bd9Sstevel@tonic-gate
3707c478bd9Sstevel@tonic-gate fbp->validkey = B_TRUE;
3717c478bd9Sstevel@tonic-gate
3727c478bd9Sstevel@tonic-gate cfb64_stream_key(key->data, &fbp->streams[TELNET_DIR_ENCRYPT]);
3737c478bd9Sstevel@tonic-gate cfb64_stream_key(key->data, &fbp->streams[TELNET_DIR_DECRYPT]);
3747c478bd9Sstevel@tonic-gate
3757c478bd9Sstevel@tonic-gate /*
3767c478bd9Sstevel@tonic-gate * Now look to see if cfb64_start() was was waiting for
3777c478bd9Sstevel@tonic-gate * the key to show up. If so, go ahead an call it now
3787c478bd9Sstevel@tonic-gate * that we have the key.
3797c478bd9Sstevel@tonic-gate */
3807c478bd9Sstevel@tonic-gate if (fbp->need_start) {
3817c478bd9Sstevel@tonic-gate fbp->need_start = B_FALSE;
3827c478bd9Sstevel@tonic-gate (void) cfb64_start(TELNET_DIR_ENCRYPT);
3837c478bd9Sstevel@tonic-gate }
3847c478bd9Sstevel@tonic-gate }
3857c478bd9Sstevel@tonic-gate
3867c478bd9Sstevel@tonic-gate /*
3877c478bd9Sstevel@tonic-gate * We only accept a keyid of 0. If we get a keyid of
3887c478bd9Sstevel@tonic-gate * 0, then mark the state as SUCCESS.
3897c478bd9Sstevel@tonic-gate */
3907c478bd9Sstevel@tonic-gate int
cfb64_keyid(dir,kp,lenp)3917c478bd9Sstevel@tonic-gate cfb64_keyid(dir, kp, lenp)
3927c478bd9Sstevel@tonic-gate int dir, *lenp;
3937c478bd9Sstevel@tonic-gate unsigned char *kp;
3947c478bd9Sstevel@tonic-gate {
3957c478bd9Sstevel@tonic-gate struct _fb *fbp = &des_cfb;
3967c478bd9Sstevel@tonic-gate register int state = fbp->state[dir];
3977c478bd9Sstevel@tonic-gate
3987c478bd9Sstevel@tonic-gate if (*lenp != 1 || (*kp != '\0')) {
3997c478bd9Sstevel@tonic-gate *lenp = 0;
4007c478bd9Sstevel@tonic-gate return (state);
4017c478bd9Sstevel@tonic-gate }
4027c478bd9Sstevel@tonic-gate
4037c478bd9Sstevel@tonic-gate if (state == ENCR_STATE_FAILED)
4047c478bd9Sstevel@tonic-gate state = ENCR_STATE_IN_PROGRESS;
4057c478bd9Sstevel@tonic-gate
4067c478bd9Sstevel@tonic-gate state &= ~ENCR_STATE_NO_KEYID;
4077c478bd9Sstevel@tonic-gate
4087c478bd9Sstevel@tonic-gate return (fbp->state[dir] = state);
4097c478bd9Sstevel@tonic-gate }
4107c478bd9Sstevel@tonic-gate
4117c478bd9Sstevel@tonic-gate /*
4127c478bd9Sstevel@tonic-gate * Print ENCRYPT suboptions to NetTrace when "set opt" is used
4137c478bd9Sstevel@tonic-gate */
4147c478bd9Sstevel@tonic-gate void
cfb64_printsub(unsigned char * data,int cnt,unsigned char * buf,int buflen)4157c478bd9Sstevel@tonic-gate cfb64_printsub(unsigned char *data, int cnt, unsigned char *buf, int buflen)
4167c478bd9Sstevel@tonic-gate {
4177c478bd9Sstevel@tonic-gate char lbuf[ENCR_LBUF_BUFSIZ];
4187c478bd9Sstevel@tonic-gate register int i;
4197c478bd9Sstevel@tonic-gate char *cp;
4207c478bd9Sstevel@tonic-gate unsigned char type[] = "CFB64";
4217c478bd9Sstevel@tonic-gate
4227c478bd9Sstevel@tonic-gate buf[buflen-1] = '\0'; /* make sure it's NULL terminated */
4237c478bd9Sstevel@tonic-gate buflen -= 1;
4247c478bd9Sstevel@tonic-gate
4257c478bd9Sstevel@tonic-gate switch (data[2]) {
4267c478bd9Sstevel@tonic-gate case FB64_IV:
4277c478bd9Sstevel@tonic-gate (void) snprintf(lbuf, ENCR_LBUF_BUFSIZ, "%s_IV", type);
4287c478bd9Sstevel@tonic-gate cp = lbuf;
4297c478bd9Sstevel@tonic-gate goto common;
4307c478bd9Sstevel@tonic-gate
4317c478bd9Sstevel@tonic-gate case FB64_IV_OK:
4327c478bd9Sstevel@tonic-gate (void) snprintf(lbuf, ENCR_LBUF_BUFSIZ, "%s_IV_OK", type);
4337c478bd9Sstevel@tonic-gate cp = lbuf;
4347c478bd9Sstevel@tonic-gate goto common;
4357c478bd9Sstevel@tonic-gate
4367c478bd9Sstevel@tonic-gate case FB64_IV_BAD:
4377c478bd9Sstevel@tonic-gate (void) snprintf(lbuf, ENCR_LBUF_BUFSIZ, "%s_IV_BAD", type);
4387c478bd9Sstevel@tonic-gate cp = lbuf;
4397c478bd9Sstevel@tonic-gate goto common;
4407c478bd9Sstevel@tonic-gate
4417c478bd9Sstevel@tonic-gate default:
4427c478bd9Sstevel@tonic-gate (void) snprintf(lbuf, ENCR_LBUF_BUFSIZ, " %d (unknown)",
4437c478bd9Sstevel@tonic-gate data[2]);
4447c478bd9Sstevel@tonic-gate cp = lbuf;
4457c478bd9Sstevel@tonic-gate common:
4467c478bd9Sstevel@tonic-gate for (; (buflen > 0) && (*buf = *cp++); buf++)
4477c478bd9Sstevel@tonic-gate buflen--;
4487c478bd9Sstevel@tonic-gate for (i = 3; i < cnt; i++) {
4497c478bd9Sstevel@tonic-gate (void) snprintf(lbuf, ENCR_LBUF_BUFSIZ, " %d", data[i]);
4507c478bd9Sstevel@tonic-gate for (cp = lbuf; (buflen > 0) && (*buf = *cp++); buf++)
4517c478bd9Sstevel@tonic-gate buflen--;
4527c478bd9Sstevel@tonic-gate }
4537c478bd9Sstevel@tonic-gate break;
4547c478bd9Sstevel@tonic-gate }
4557c478bd9Sstevel@tonic-gate }
4567c478bd9Sstevel@tonic-gate
4577c478bd9Sstevel@tonic-gate
4587c478bd9Sstevel@tonic-gate static void
cfb64_stream_iv(Block seed,register struct stinfo * stp)4597c478bd9Sstevel@tonic-gate cfb64_stream_iv(Block seed, register struct stinfo *stp)
4607c478bd9Sstevel@tonic-gate {
4617c478bd9Sstevel@tonic-gate (void) memcpy((void *)stp->str_iv, (void *)seed, sizeof (Block));
4627c478bd9Sstevel@tonic-gate (void) memcpy((void *)stp->str_output, (void *)seed, sizeof (Block));
4637c478bd9Sstevel@tonic-gate
4647c478bd9Sstevel@tonic-gate stp->str_index = sizeof (Block);
4657c478bd9Sstevel@tonic-gate }
4667c478bd9Sstevel@tonic-gate
4677c478bd9Sstevel@tonic-gate void
cfb64_stream_key(Block key,register struct stinfo * stp)4687c478bd9Sstevel@tonic-gate cfb64_stream_key(Block key, register struct stinfo *stp)
4697c478bd9Sstevel@tonic-gate {
4707c478bd9Sstevel@tonic-gate (void) memcpy((void *)stp->str_keybytes, (void *)key, sizeof (Block));
4717c478bd9Sstevel@tonic-gate stp->str_key.length = DES_BLOCKSIZE;
4727c478bd9Sstevel@tonic-gate stp->str_key.contents = stp->str_keybytes;
4737c478bd9Sstevel@tonic-gate /*
4747c478bd9Sstevel@tonic-gate * the original version of this code uses des ecb mode, but
4757c478bd9Sstevel@tonic-gate * it only ever does one block at a time. cbc with a zero iv
4767c478bd9Sstevel@tonic-gate * is identical
4777c478bd9Sstevel@tonic-gate */
4787c478bd9Sstevel@tonic-gate /* this is a kerberos enctype, not a telopt enctype */
4797c478bd9Sstevel@tonic-gate stp->str_key.enctype = ENCTYPE_DES_CBC_RAW;
4807c478bd9Sstevel@tonic-gate
4817c478bd9Sstevel@tonic-gate (void) memcpy((void *)stp->str_output, (void *)stp->str_iv,
4827c478bd9Sstevel@tonic-gate sizeof (Block));
4837c478bd9Sstevel@tonic-gate
4847c478bd9Sstevel@tonic-gate stp->str_index = sizeof (Block);
4857c478bd9Sstevel@tonic-gate }
4867c478bd9Sstevel@tonic-gate
4877c478bd9Sstevel@tonic-gate /*
4887c478bd9Sstevel@tonic-gate * DES 64 bit Cipher Feedback
4897c478bd9Sstevel@tonic-gate *
4907c478bd9Sstevel@tonic-gate * key --->+-----+
4917c478bd9Sstevel@tonic-gate * +->| DES |--+
4927c478bd9Sstevel@tonic-gate * | +-----+ |
4937c478bd9Sstevel@tonic-gate * | v
4947c478bd9Sstevel@tonic-gate * INPUT --(--------->(+)+---> DATA
4957c478bd9Sstevel@tonic-gate * | |
4967c478bd9Sstevel@tonic-gate * +-------------+
4977c478bd9Sstevel@tonic-gate *
4987c478bd9Sstevel@tonic-gate *
4997c478bd9Sstevel@tonic-gate * Given:
5007c478bd9Sstevel@tonic-gate * iV: Initial vector, 64 bits (8 bytes) long.
5017c478bd9Sstevel@tonic-gate * Dn: the nth chunk of 64 bits (8 bytes) of data to encrypt (decrypt).
5027c478bd9Sstevel@tonic-gate * On: the nth chunk of 64 bits (8 bytes) of encrypted (decrypted) output.
5037c478bd9Sstevel@tonic-gate *
5047c478bd9Sstevel@tonic-gate * V0 = DES(iV, key)
5057c478bd9Sstevel@tonic-gate * On = Dn ^ Vn
5067c478bd9Sstevel@tonic-gate * V(n+1) = DES(On, key)
5077c478bd9Sstevel@tonic-gate */
5087c478bd9Sstevel@tonic-gate
5097c478bd9Sstevel@tonic-gate void
cfb64_encrypt(register unsigned char * s,int c)5107c478bd9Sstevel@tonic-gate cfb64_encrypt(register unsigned char *s, int c)
5117c478bd9Sstevel@tonic-gate {
5127c478bd9Sstevel@tonic-gate register struct stinfo *stp =
5137c478bd9Sstevel@tonic-gate &des_cfb.streams[TELNET_DIR_ENCRYPT];
5147c478bd9Sstevel@tonic-gate register int index;
5157c478bd9Sstevel@tonic-gate
5167c478bd9Sstevel@tonic-gate index = stp->str_index;
5177c478bd9Sstevel@tonic-gate while (c-- > 0) {
5187c478bd9Sstevel@tonic-gate if (index == sizeof (Block)) {
5197c478bd9Sstevel@tonic-gate Block b;
5207c478bd9Sstevel@tonic-gate ecb_encrypt(stp, stp->str_output, b);
5217c478bd9Sstevel@tonic-gate (void) memcpy((void *)stp->str_feed, (void *)b,
5227c478bd9Sstevel@tonic-gate sizeof (Block));
5237c478bd9Sstevel@tonic-gate index = 0;
5247c478bd9Sstevel@tonic-gate }
5257c478bd9Sstevel@tonic-gate
5267c478bd9Sstevel@tonic-gate /* On encryption, we store (feed ^ data) which is cypher */
5277c478bd9Sstevel@tonic-gate *s = stp->str_output[index] = (stp->str_feed[index] ^ *s);
5287c478bd9Sstevel@tonic-gate s++;
5297c478bd9Sstevel@tonic-gate index++;
5307c478bd9Sstevel@tonic-gate }
5317c478bd9Sstevel@tonic-gate stp->str_index = index;
5327c478bd9Sstevel@tonic-gate }
5337c478bd9Sstevel@tonic-gate
5347c478bd9Sstevel@tonic-gate int
cfb64_decrypt(int data)5357c478bd9Sstevel@tonic-gate cfb64_decrypt(int data)
5367c478bd9Sstevel@tonic-gate {
5377c478bd9Sstevel@tonic-gate register struct stinfo *stp =
5387c478bd9Sstevel@tonic-gate &des_cfb.streams[TELNET_DIR_DECRYPT];
5397c478bd9Sstevel@tonic-gate int index;
5407c478bd9Sstevel@tonic-gate
5417c478bd9Sstevel@tonic-gate if (data == -1) {
5427c478bd9Sstevel@tonic-gate /*
5437c478bd9Sstevel@tonic-gate * Back up one byte. It is assumed that we will
5447c478bd9Sstevel@tonic-gate * never back up more than one byte. If we do, this
5457c478bd9Sstevel@tonic-gate * may or may not work.
5467c478bd9Sstevel@tonic-gate */
5477c478bd9Sstevel@tonic-gate if (stp->str_index)
5487c478bd9Sstevel@tonic-gate --stp->str_index;
5497c478bd9Sstevel@tonic-gate return (0);
5507c478bd9Sstevel@tonic-gate }
5517c478bd9Sstevel@tonic-gate
5527c478bd9Sstevel@tonic-gate index = stp->str_index++;
5537c478bd9Sstevel@tonic-gate if (index == sizeof (Block)) {
5547c478bd9Sstevel@tonic-gate Block b;
5557c478bd9Sstevel@tonic-gate ecb_encrypt(stp, stp->str_output, b);
5567c478bd9Sstevel@tonic-gate (void) memcpy((void *)stp->str_feed, (void *)b, sizeof (Block));
5577c478bd9Sstevel@tonic-gate stp->str_index = 1; /* Next time will be 1 */
5587c478bd9Sstevel@tonic-gate index = 0; /* But now use 0 */
5597c478bd9Sstevel@tonic-gate }
5607c478bd9Sstevel@tonic-gate
5617c478bd9Sstevel@tonic-gate /* On decryption we store (data) which is cypher. */
5627c478bd9Sstevel@tonic-gate stp->str_output[index] = data;
5637c478bd9Sstevel@tonic-gate return (data ^ stp->str_feed[index]);
5647c478bd9Sstevel@tonic-gate }
565