/*     $OpenBSD: encrypt.c,v 1.3 2003/06/26 07:53:27 deraadt Exp $     *//*- * Copyright (c) 1991, 1993 *	The Regents of the University of California.  All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright *    notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright *    notice, this list of conditions and the following disclaimer in the *    documentation and/or other materials provided with the distribution. * 3. Neither the name of the University nor the names of its contributors *    may be used to endorse or promote products derived from this software *    without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ /* * This source code is no longer held under any constraint of USA * `cryptographic laws' since it was exported legally.  The cryptographic * functions were removed from the code and a "Bones" distribution was * made.  A Commodity Jurisdiction Request #012-94 was filed with the * USA State Department, who handed it to the Commerce department.  The * code was determined to fall under General License GTDA under ECCN 5D96G, * and hence exportable.  The cryptographic interfaces were re-added by Eric * Young, and then KTH proceeded to maintain the code in the free world. * *//* * Copyright (C) 1990 by the Massachusetts Institute of Technology * * Export of this software from the United States of America is assumed * to require a specific license from the United States Government. * It is the responsibility of any person or organization contemplating * export to obtain such a license before exporting. * * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and * distribute this software and its documentation for any purpose and * without fee is hereby granted, provided that the above copyright * notice appear in all copies and that both that copyright notice and * this permission notice appear in supporting documentation, and that * the name of M.I.T. not be used in advertising or publicity pertaining * to distribution of the software without specific, written prior * permission.  M.I.T. makes no representations about the suitability of * this software for any purpose.  It is provided "as is" without express * or implied warranty. *//*RCSID("$KTH: encrypt.c,v 1.22.8.1 2002/02/06 03:39:13 assar Exp $");*/#if	defined(ENCRYPTION)#define	ENCRYPT_NAMES#include <stdio.h>#include <stdlib.h>#include <string.h>#include <sys/types.h>#include <arpa/telnet.h>#include "encrypt.h"#include "misc.h"/* * These functions pointers point to the current routines * for encrypting and decrypting data. */void	(*encrypt_output) (unsigned char *, int);int	(*decrypt_input) (int);char	*nclearto;int encrypt_debug_mode = 0;static int decrypt_mode = 0;static int encrypt_mode = 0;static int encrypt_verbose = 0;static int autoencrypt = 0;static int autodecrypt = 0;static int havesessionkey = 0;static int Server = 0;static const char *Name = "Noname";#define	typemask(x)	((x) > 0 ? 1 << ((x)-1) : 0)static long i_support_encrypt = typemask(ENCTYPE_DES_CFB64)     | typemask(ENCTYPE_DES_OFB64);     static long i_support_decrypt = typemask(ENCTYPE_DES_CFB64)     | typemask(ENCTYPE_DES_OFB64);     static long i_wont_support_encrypt = 0;     static long i_wont_support_decrypt = 0;#define	I_SUPPORT_ENCRYPT	(i_support_encrypt & ~i_wont_support_encrypt)#define	I_SUPPORT_DECRYPT	(i_support_decrypt & ~i_wont_support_decrypt)     static long remote_supports_encrypt = 0;     static long remote_supports_decrypt = 0;     static Encryptions encryptions[] = {#if	defined(DES_ENCRYPTION)	 { "DES_CFB64",	ENCTYPE_DES_CFB64,	   cfb64_encrypt,		   cfb64_decrypt,	   cfb64_init,	   cfb64_start,	   cfb64_is,	   cfb64_reply,	   cfb64_session,	   cfb64_keyid,	   cfb64_printsub },	 { "DES_OFB64",	ENCTYPE_DES_OFB64,	   ofb64_encrypt,		   ofb64_decrypt,	   ofb64_init,	   ofb64_start,	   ofb64_is,	   ofb64_reply,	   ofb64_session,	   ofb64_keyid,	   ofb64_printsub },#endif	 { 0, },     };static unsigned char str_send[64] = { IAC, SB, TELOPT_ENCRYPT,				      ENCRYPT_SUPPORT };static unsigned char str_suplen = 0;static unsigned char str_start[72] = { IAC, SB, TELOPT_ENCRYPT };static unsigned char str_end[] = { IAC, SB, TELOPT_ENCRYPT, 0, IAC, SE };Encryptions *findencryption(int type){    Encryptions *ep = encryptions;    if (!(I_SUPPORT_ENCRYPT & remote_supports_decrypt & typemask(type)))	return(0);    while (ep->type && ep->type != type)	++ep;    return(ep->type ? ep : 0);}Encryptions *finddecryption(int type){    Encryptions *ep = encryptions;    if (!(I_SUPPORT_DECRYPT & remote_supports_encrypt & typemask(type)))	return(0);    while (ep->type && ep->type != type)	++ep;    return(ep->type ? ep : 0);}#define	MAXKEYLEN 64static struct key_info {    unsigned char keyid[MAXKEYLEN];    int keylen;    int dir;    int *modep;    Encryptions *(*getcrypt)(int);} ki[2] = {    { { 0 }, 0, DIR_ENCRYPT, &encrypt_mode, findencryption },    { { 0 }, 0, DIR_DECRYPT, &decrypt_mode, finddecryption },};voidencrypt_init(const char *name, int server){    Encryptions *ep = encryptions;    Name = name;    Server = server;    i_support_encrypt = i_support_decrypt = 0;    remote_supports_encrypt = remote_supports_decrypt = 0;    encrypt_mode = 0;    decrypt_mode = 0;    encrypt_output = 0;    decrypt_input = 0;#ifdef notdef    encrypt_verbose = !server;#endif    str_suplen = 4;    while (ep->type) {	if (encrypt_debug_mode)	    printf(">>>%s: I will support %s\r\n",		   Name, ENCTYPE_NAME(ep->type));	i_support_encrypt |= typemask(ep->type);	i_support_decrypt |= typemask(ep->type);	if ((i_wont_support_decrypt & typemask(ep->type)) == 0)	    if ((str_send[str_suplen++] = ep->type) == IAC)		str_send[str_suplen++] = IAC;	if (ep->init)	    (*ep->init)(Server);	++ep;    }    str_send[str_suplen++] = IAC;    str_send[str_suplen++] = SE;}voidencrypt_list_types(void){    Encryptions *ep = encryptions;    printf("Valid encryption types:\n");    while (ep->type) {	printf("\t%s (%d)\r\n", ENCTYPE_NAME(ep->type), ep->type);	++ep;    }}intEncryptEnable(char *type, char *mode){    if (isprefix(type, "help") || isprefix(type, "?")) {	printf("Usage: encrypt enable <type> [input|output]\n");	encrypt_list_types();	return(0);    }    if (EncryptType(type, mode))	return(EncryptStart(mode));    return(0);}intEncryptDisable(char *type, char *mode){    Encryptions *ep;    int ret = 0;    if (isprefix(type, "help") || isprefix(type, "?")) {	printf("Usage: encrypt disable <type> [input|output]\n");	encrypt_list_types();    } else if ((ep = (Encryptions *)genget(type, (char**)encryptions,					   sizeof(Encryptions))) == 0) {	printf("%s: invalid encryption type\n", type);    } else if (Ambiguous(ep)) {	printf("Ambiguous type '%s'\n", type);    } else {	if ((mode == 0) || (isprefix(mode, "input") ? 1 : 0)) {	    if (decrypt_mode == ep->type)		EncryptStopInput();	    i_wont_support_decrypt |= typemask(ep->type);	    ret = 1;	}	if ((mode == 0) || (isprefix(mode, "output"))) {	    if (encrypt_mode == ep->type)		EncryptStopOutput();	    i_wont_support_encrypt |= typemask(ep->type);	    ret = 1;	}	if (ret == 0)	    printf("%s: invalid encryption mode\n", mode);    }    return(ret);}intEncryptType(char *type, char *mode){    Encryptions *ep;    int ret = 0;    if (isprefix(type, "help") || isprefix(type, "?")) {	printf("Usage: encrypt type <type> [input|output]\n");	encrypt_list_types();    } else if ((ep = (Encryptions *)genget(type, (char**)encryptions,					   sizeof(Encryptions))) == 0) {	printf("%s: invalid encryption type\n", type);    } else if (Ambiguous(ep)) {	printf("Ambiguous type '%s'\n", type);    } else {	if ((mode == 0) || isprefix(mode, "input")) {	    decrypt_mode = ep->type;	    i_wont_support_decrypt &= ~typemask(ep->type);	    ret = 1;	}	if ((mode == 0) || isprefix(mode, "output")) {	    encrypt_mode = ep->type;	    i_wont_support_encrypt &= ~typemask(ep->type);	    ret = 1;	}	if (ret == 0)	    printf("%s: invalid encryption mode\n", mode);    }    return(ret);}intEncryptStart(char *mode){    int ret = 0;    if (mode) {	if (isprefix(mode, "input"))	    return(EncryptStartInput());	if (isprefix(mode, "output"))	    return(EncryptStartOutput());	if (isprefix(mode, "help") || isprefix(mode, "?")) {	    printf("Usage: encrypt start [input|output]\n");	    return(0);	}	printf("%s: invalid encryption mode 'encrypt start ?' for help\n", mode);	return(0);    }    ret += EncryptStartInput();    ret += EncryptStartOutput();    return(ret);}intEncryptStartInput(void){    if (decrypt_mode) {	encrypt_send_request_start();	return(1);    }    printf("No previous decryption mode, decryption not enabled\r\n");    return(0);}intEncryptStartOutput(void){    if (encrypt_mode) {	encrypt_start_output(encrypt_mode);	return(1);    }    printf("No previous encryption mode, encryption not enabled\r\n");    return(0);}intEncryptStop(char *mode){    int ret = 0;    if (mode) {	if (isprefix(mode, "input"))	    return(EncryptStopInput());	if (isprefix(mode, "output"))	    return(EncryptStopOutput());	if (isprefix(mode, "help") || isprefix(mode, "?")) {	    printf("Usage: encrypt stop [input|output]\n");	    return(0);	}	printf("%s: invalid encryption mode 'encrypt stop ?' for help\n", mode);	return(0);    }    ret += EncryptStopInput();    ret += EncryptStopOutput();    return(ret);}intEncryptStopInput(void){    encrypt_send_request_end();    return(1);}intEncryptStopOutput(void){    encrypt_send_end();    return(1);}voidencrypt_display(void){    printf("Autoencrypt for output is %s. Autodecrypt for input is %s.\r\n",	   autoencrypt?"on":"off", autodecrypt?"on":"off");    if (encrypt_output)	printf("Currently encrypting output with %s\r\n",	       ENCTYPE_NAME(encrypt_mode));    else	printf("Currently not encrypting output\r\n");	    if (decrypt_input)	printf("Currently decrypting input with %s\r\n",	       ENCTYPE_NAME(decrypt_mode));    else	printf("Currently not decrypting input\r\n");}intEncryptStatus(void){    printf("Autoencrypt for output is %s. Autodecrypt for input is %s.\r\n",	   autoencrypt?"on":"off", autodecrypt?"on":"off");    if (encrypt_output)	printf("Currently encrypting output with %s\r\n",	       ENCTYPE_NAME(encrypt_mode));    else if (encrypt_mode) {	printf("Currently output is clear text.\r\n");	printf("Last encryption mode was %s\r\n",	       ENCTYPE_NAME(encrypt_mode));    } else	printf("Currently not encrypting output\r\n");	    if (decrypt_input) {	printf("Currently decrypting input with %s\r\n",	       ENCTYPE_NAME(decrypt_mode));    } else if (decrypt_mode) {	printf("Currently input is clear text.\r\n");	printf("Last decryption mode was %s\r\n",	       ENCTYPE_NAME(decrypt_mode));    } else	printf("Currently not decrypting input\r\n");    return 1;}voidencrypt_send_support(void){    if (str_suplen) {	/*	 * If the user has requested that decryption start	 * immediatly, then send a "REQUEST START" before	 * we negotiate the type.	 */	if (!Server && autodecrypt)	    encrypt_send_request_start();	telnet_net_write(str_send, str_suplen);	printsub('>', &str_send[2], str_suplen - 2);	str_suplen = 0;    }}intEncryptDebug(int on){    if (on < 0)	encrypt_debug_mode ^= 1;    else	encrypt_debug_mode = on;    printf("Encryption debugging %s\r\n",	   encrypt_debug_mode ? "enabled" : "disabled");    return(1);}/* turn on verbose encryption, but dont keep telling the whole world */void encrypt_verbose_quiet(int on){    if(on < 0)	encrypt_verbose ^= 1;    else	encrypt_verbose = on ? 1 : 0;}intEncryptVerbose(int on){    encrypt_verbose_quiet(on);    printf("Encryption %s verbose\r\n",	   encrypt_verbose ? "is" : "is not");    return(1);}intEncryptAutoEnc(int on){    encrypt_auto(on);    printf("Automatic encryption of output is %s\r\n",	   autoencrypt ? "enabled" : "disabled");    return(1);}intEncryptAutoDec(int on){    decrypt_auto(on);    printf("Automatic decryption of input is %s\r\n",	   autodecrypt ? "enabled" : "disabled");    return(1);}/* Called when we receive a WONT or a DONT ENCRYPT after we sent a DO   encrypt */voidencrypt_not(void)