17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * lib/krb5/krb/encode_kdc.c
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * Copyright 1990 by the Massachusetts Institute of Technology.
57c478bd9Sstevel@tonic-gate * All Rights Reserved.
67c478bd9Sstevel@tonic-gate *
77c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
87c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
97c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
107c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
117c478bd9Sstevel@tonic-gate *
127c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
137c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
147c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
157c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
167c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
177c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
187c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
197c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
207c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
217c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
227c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
237c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
247c478bd9Sstevel@tonic-gate * or implied warranty.
257c478bd9Sstevel@tonic-gate *
267c478bd9Sstevel@tonic-gate *
277c478bd9Sstevel@tonic-gate * krb5_encode_kdc_rep() function.
287c478bd9Sstevel@tonic-gate */
297c478bd9Sstevel@tonic-gate
30*159d09a2SMark Phalan #include "k5-int.h"
317c478bd9Sstevel@tonic-gate
327c478bd9Sstevel@tonic-gate /*
337c478bd9Sstevel@tonic-gate Takes KDC rep parts in *rep and *encpart, and formats it into *enc_rep,
347c478bd9Sstevel@tonic-gate using message type type and encryption key client_key and encryption type
357c478bd9Sstevel@tonic-gate etype.
367c478bd9Sstevel@tonic-gate
377c478bd9Sstevel@tonic-gate The string *enc_rep will be allocated before formatting; the caller should
387c478bd9Sstevel@tonic-gate free when finished.
397c478bd9Sstevel@tonic-gate
407c478bd9Sstevel@tonic-gate returns system errors
417c478bd9Sstevel@tonic-gate
427c478bd9Sstevel@tonic-gate dec_rep->enc_part.ciphertext is allocated and filled in.
437c478bd9Sstevel@tonic-gate */
447c478bd9Sstevel@tonic-gate /* due to argument promotion rules, we need to use the DECLARG/OLDDECLARG
457c478bd9Sstevel@tonic-gate stuff... */
467c478bd9Sstevel@tonic-gate krb5_error_code
krb5_encode_kdc_rep(krb5_context context,krb5_msgtype type,const krb5_enc_kdc_rep_part * encpart,int using_subkey,const krb5_keyblock * client_key,krb5_kdc_rep * dec_rep,krb5_data ** enc_rep)47505d05c7Sgtb krb5_encode_kdc_rep(krb5_context context, krb5_msgtype type,
48505d05c7Sgtb const krb5_enc_kdc_rep_part *encpart,
49505d05c7Sgtb int using_subkey, const krb5_keyblock *client_key,
50505d05c7Sgtb krb5_kdc_rep *dec_rep, krb5_data **enc_rep)
517c478bd9Sstevel@tonic-gate {
527c478bd9Sstevel@tonic-gate krb5_data *scratch;
537c478bd9Sstevel@tonic-gate krb5_error_code retval;
547c478bd9Sstevel@tonic-gate krb5_enc_kdc_rep_part tmp_encpart;
557c478bd9Sstevel@tonic-gate krb5_keyusage usage;
567c478bd9Sstevel@tonic-gate
57*159d09a2SMark Phalan if (!krb5_c_valid_enctype(dec_rep->enc_part.enctype))
587c478bd9Sstevel@tonic-gate return KRB5_PROG_ETYPE_NOSUPP;
597c478bd9Sstevel@tonic-gate
607c478bd9Sstevel@tonic-gate switch (type) {
617c478bd9Sstevel@tonic-gate case KRB5_AS_REP:
627c478bd9Sstevel@tonic-gate usage = KRB5_KEYUSAGE_AS_REP_ENCPART;
637c478bd9Sstevel@tonic-gate break;
647c478bd9Sstevel@tonic-gate case KRB5_TGS_REP:
657c478bd9Sstevel@tonic-gate if (using_subkey)
667c478bd9Sstevel@tonic-gate usage = KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY;
677c478bd9Sstevel@tonic-gate else
687c478bd9Sstevel@tonic-gate usage = KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY;
697c478bd9Sstevel@tonic-gate break;
707c478bd9Sstevel@tonic-gate default:
717c478bd9Sstevel@tonic-gate return KRB5_BADMSGTYPE;
727c478bd9Sstevel@tonic-gate }
737c478bd9Sstevel@tonic-gate
747c478bd9Sstevel@tonic-gate /*
757c478bd9Sstevel@tonic-gate * We don't want to modify encpart, but we need to be able to pass
767c478bd9Sstevel@tonic-gate * in the message type to the encoder, so it can set the ASN.1
777c478bd9Sstevel@tonic-gate * type correct.
787c478bd9Sstevel@tonic-gate *
797c478bd9Sstevel@tonic-gate * Although note that it may be doing nothing with the message
807c478bd9Sstevel@tonic-gate * type, to be compatible with old versions of Kerberos that always
817c478bd9Sstevel@tonic-gate * encode this as a TGS_REP regardly of what it really should be;
827c478bd9Sstevel@tonic-gate * also note that the reason why we are passing it in a structure
837c478bd9Sstevel@tonic-gate * instead of as an argument to encode_krb5_enc_kdc_rep_part (the
847c478bd9Sstevel@tonic-gate * way we should) is for compatibility with the ISODE version of
857c478bd9Sstevel@tonic-gate * this fuction. Ah, compatibility....
867c478bd9Sstevel@tonic-gate */
877c478bd9Sstevel@tonic-gate tmp_encpart = *encpart;
887c478bd9Sstevel@tonic-gate tmp_encpart.msg_type = type;
897c478bd9Sstevel@tonic-gate retval = encode_krb5_enc_kdc_rep_part(&tmp_encpart, &scratch);
907c478bd9Sstevel@tonic-gate if (retval) {
917c478bd9Sstevel@tonic-gate return retval;
927c478bd9Sstevel@tonic-gate }
937c478bd9Sstevel@tonic-gate memset(&tmp_encpart, 0, sizeof(tmp_encpart));
947c478bd9Sstevel@tonic-gate
957c478bd9Sstevel@tonic-gate #define cleanup_scratch() { (void) memset(scratch->data, 0, scratch->length); \
967c478bd9Sstevel@tonic-gate krb5_free_data(context, scratch); }
977c478bd9Sstevel@tonic-gate
987c478bd9Sstevel@tonic-gate retval = krb5_encrypt_helper(context, client_key, usage, scratch,
997c478bd9Sstevel@tonic-gate &dec_rep->enc_part);
1007c478bd9Sstevel@tonic-gate
1017c478bd9Sstevel@tonic-gate #define cleanup_encpart() { \
1027c478bd9Sstevel@tonic-gate (void) memset(dec_rep->enc_part.ciphertext.data, 0, \
1037c478bd9Sstevel@tonic-gate dec_rep->enc_part.ciphertext.length); \
1047c478bd9Sstevel@tonic-gate free(dec_rep->enc_part.ciphertext.data); \
1057c478bd9Sstevel@tonic-gate dec_rep->enc_part.ciphertext.length = 0; \
1067c478bd9Sstevel@tonic-gate dec_rep->enc_part.ciphertext.data = 0;}
1077c478bd9Sstevel@tonic-gate
1087c478bd9Sstevel@tonic-gate cleanup_scratch();
1097c478bd9Sstevel@tonic-gate
1107c478bd9Sstevel@tonic-gate if (retval)
1117c478bd9Sstevel@tonic-gate return(retval);
1127c478bd9Sstevel@tonic-gate
1137c478bd9Sstevel@tonic-gate /* now it's ready to be encoded for the wire! */
1147c478bd9Sstevel@tonic-gate
1157c478bd9Sstevel@tonic-gate switch (type) {
1167c478bd9Sstevel@tonic-gate case KRB5_AS_REP:
1177c478bd9Sstevel@tonic-gate retval = encode_krb5_as_rep(dec_rep, enc_rep);
1187c478bd9Sstevel@tonic-gate break;
1197c478bd9Sstevel@tonic-gate case KRB5_TGS_REP:
1207c478bd9Sstevel@tonic-gate retval = encode_krb5_tgs_rep(dec_rep, enc_rep);
1217c478bd9Sstevel@tonic-gate break;
1227c478bd9Sstevel@tonic-gate }
1237c478bd9Sstevel@tonic-gate
1247c478bd9Sstevel@tonic-gate if (retval)
1257c478bd9Sstevel@tonic-gate cleanup_encpart();
1267c478bd9Sstevel@tonic-gate
1277c478bd9Sstevel@tonic-gate return retval;
1287c478bd9Sstevel@tonic-gate }
129