151251b2bSBill Paul /*
251251b2bSBill Paul * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
351251b2bSBill Paul * unrestricted use provided that this legend is included on all tape
451251b2bSBill Paul * media and as a part of the software program in whole or part. Users
551251b2bSBill Paul * may copy or modify Sun RPC without charge, but are not authorized
651251b2bSBill Paul * to license or distribute it to anyone else except as part of a product or
751251b2bSBill Paul * program developed by the user.
851251b2bSBill Paul *
951251b2bSBill Paul * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
1051251b2bSBill Paul * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
1151251b2bSBill Paul * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
1251251b2bSBill Paul *
1351251b2bSBill Paul * Sun RPC is provided with no support and without any obligation on the
1451251b2bSBill Paul * part of Sun Microsystems, Inc. to assist in its use, correction,
1551251b2bSBill Paul * modification or enhancement.
1651251b2bSBill Paul *
1751251b2bSBill Paul * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
1851251b2bSBill Paul * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
1951251b2bSBill Paul * OR ANY PART THEREOF.
2051251b2bSBill Paul *
2151251b2bSBill Paul * In no event will Sun Microsystems, Inc. be liable for any lost revenue
2251251b2bSBill Paul * or profits or other special, indirect and consequential damages, even if
2351251b2bSBill Paul * Sun has been advised of the possibility of such damages.
2451251b2bSBill Paul *
2551251b2bSBill Paul * Sun Microsystems, Inc.
2651251b2bSBill Paul * 2550 Garcia Avenue
2751251b2bSBill Paul * Mountain View, California 94043
2851251b2bSBill Paul */
2951251b2bSBill Paul
3051251b2bSBill Paul /*
3151251b2bSBill Paul * Copyright (c) 1986 - 1991 by Sun Microsystems, Inc.
3251251b2bSBill Paul */
3351251b2bSBill Paul
3451251b2bSBill Paul /*
3551251b2bSBill Paul * Keyserver
3651251b2bSBill Paul * Store secret keys per uid. Do public key encryption and decryption
3751251b2bSBill Paul * operations. Generate "random" keys.
3851251b2bSBill Paul * Do not talk to anything but a local root
3951251b2bSBill Paul * process on the local transport only
4051251b2bSBill Paul */
4151251b2bSBill Paul
42ecdf56e7SPhilippe Charnier #include <err.h>
43ecdf56e7SPhilippe Charnier #include <pwd.h>
4451251b2bSBill Paul #include <stdio.h>
4551251b2bSBill Paul #include <stdlib.h>
4651251b2bSBill Paul #include <string.h>
47ecdf56e7SPhilippe Charnier #include <unistd.h>
4851251b2bSBill Paul #include <sys/stat.h>
4951251b2bSBill Paul #include <sys/types.h>
5051251b2bSBill Paul #include <rpc/rpc.h>
5151251b2bSBill Paul #include <sys/param.h>
5251251b2bSBill Paul #include <sys/file.h>
5351251b2bSBill Paul #include <rpc/des_crypt.h>
5451251b2bSBill Paul #include <rpc/des.h>
5551251b2bSBill Paul #include <rpc/key_prot.h>
5651251b2bSBill Paul #include <rpcsvc/crypt.h>
5751251b2bSBill Paul #include "keyserv.h"
5851251b2bSBill Paul
5951251b2bSBill Paul #ifndef NGROUPS
6051251b2bSBill Paul #define NGROUPS 16
6151251b2bSBill Paul #endif
6251251b2bSBill Paul
6351251b2bSBill Paul #ifndef KEYSERVSOCK
6451251b2bSBill Paul #define KEYSERVSOCK "/var/run/keyservsock"
6551251b2bSBill Paul #endif
6651251b2bSBill Paul
67784bddbcSKevin Lo static void randomize( des_block * );
68784bddbcSKevin Lo static void usage( void );
69784bddbcSKevin Lo static int getrootkey( des_block *, int );
70784bddbcSKevin Lo static int root_auth( SVCXPRT *, struct svc_req * );
7151251b2bSBill Paul
7251251b2bSBill Paul #ifdef DEBUG
7351251b2bSBill Paul static int debugging = 1;
7451251b2bSBill Paul #else
7551251b2bSBill Paul static int debugging = 0;
7651251b2bSBill Paul #endif
7751251b2bSBill Paul
7835a624c5SJohn Baldwin static void keyprogram(struct svc_req *rqstp, SVCXPRT *transp);
7951251b2bSBill Paul static des_block masterkey;
8051251b2bSBill Paul static char ROOTKEY[] = "/etc/.rootkey";
8151251b2bSBill Paul
8251251b2bSBill Paul /*
8351251b2bSBill Paul * Hack to allow the keyserver to use AUTH_DES (for authenticated
8451251b2bSBill Paul * NIS+ calls, for example). The only functions that get called
8551251b2bSBill Paul * are key_encryptsession_pk, key_decryptsession_pk, and key_gendes.
8651251b2bSBill Paul *
8751251b2bSBill Paul * The approach is to have the keyserver fill in pointers to local
8851251b2bSBill Paul * implementations of these functions, and to call those in key_call().
8951251b2bSBill Paul */
9051251b2bSBill Paul
9151251b2bSBill Paul extern cryptkeyres *(*__key_encryptsession_pk_LOCAL)();
9251251b2bSBill Paul extern cryptkeyres *(*__key_decryptsession_pk_LOCAL)();
9351251b2bSBill Paul extern des_block *(*__key_gendes_LOCAL)();
9451251b2bSBill Paul extern int (*__des_crypt_LOCAL)();
9551251b2bSBill Paul
96784bddbcSKevin Lo cryptkeyres *key_encrypt_pk_2_svc_prog( uid_t, cryptkeyarg2 * );
97784bddbcSKevin Lo cryptkeyres *key_decrypt_pk_2_svc_prog( uid_t, cryptkeyarg2 * );
98784bddbcSKevin Lo des_block *key_gen_1_svc_prog( void *, struct svc_req * );
9951251b2bSBill Paul
10051251b2bSBill Paul int
main(int argc,char * argv[])10135a624c5SJohn Baldwin main(int argc, char *argv[])
10251251b2bSBill Paul {
10351251b2bSBill Paul int nflag = 0;
10451251b2bSBill Paul int c;
10551251b2bSBill Paul int warn = 0;
10651251b2bSBill Paul char *path = NULL;
10798fb6503SAlfred Perlstein void *localhandle;
10898fb6503SAlfred Perlstein register SVCXPRT *transp;
10998fb6503SAlfred Perlstein struct netconfig *nconf = NULL;
11051251b2bSBill Paul
11151251b2bSBill Paul __key_encryptsession_pk_LOCAL = &key_encrypt_pk_2_svc_prog;
11251251b2bSBill Paul __key_decryptsession_pk_LOCAL = &key_decrypt_pk_2_svc_prog;
11351251b2bSBill Paul __key_gendes_LOCAL = &key_gen_1_svc_prog;
11451251b2bSBill Paul
11551251b2bSBill Paul while ((c = getopt(argc, argv, "ndDvp:")) != -1)
11651251b2bSBill Paul switch (c) {
11751251b2bSBill Paul case 'n':
11851251b2bSBill Paul nflag++;
11951251b2bSBill Paul break;
12051251b2bSBill Paul case 'd':
12151251b2bSBill Paul pk_nodefaultkeys();
12251251b2bSBill Paul break;
12351251b2bSBill Paul case 'D':
12451251b2bSBill Paul debugging = 1;
12551251b2bSBill Paul break;
12651251b2bSBill Paul case 'v':
12751251b2bSBill Paul warn = 1;
12851251b2bSBill Paul break;
12951251b2bSBill Paul case 'p':
13051251b2bSBill Paul path = optarg;
13151251b2bSBill Paul break;
13251251b2bSBill Paul default:
13351251b2bSBill Paul usage();
13451251b2bSBill Paul }
13551251b2bSBill Paul
13651251b2bSBill Paul load_des(warn, path);
13751251b2bSBill Paul __des_crypt_LOCAL = _my_crypt;
138ecdf56e7SPhilippe Charnier if (svc_auth_reg(AUTH_DES, _svcauth_des) == -1)
139ecdf56e7SPhilippe Charnier errx(1, "failed to register AUTH_DES authenticator");
14051251b2bSBill Paul
14151251b2bSBill Paul if (optind != argc) {
14251251b2bSBill Paul usage();
14351251b2bSBill Paul }
14451251b2bSBill Paul
14551251b2bSBill Paul /*
14651251b2bSBill Paul * Initialize
14751251b2bSBill Paul */
14898fb6503SAlfred Perlstein (void) umask(S_IXUSR|S_IXGRP|S_IXOTH);
149ecdf56e7SPhilippe Charnier if (geteuid() != 0)
150ecdf56e7SPhilippe Charnier errx(1, "keyserv must be run as root");
15151251b2bSBill Paul setmodulus(HEXMODULUS);
15251251b2bSBill Paul getrootkey(&masterkey, nflag);
15351251b2bSBill Paul
15498fb6503SAlfred Perlstein rpcb_unset(KEY_PROG, KEY_VERS, NULL);
15598fb6503SAlfred Perlstein rpcb_unset(KEY_PROG, KEY_VERS2, NULL);
15698fb6503SAlfred Perlstein
1578360efbdSAlfred Perlstein if (svc_create(keyprogram, KEY_PROG, KEY_VERS,
1588360efbdSAlfred Perlstein "netpath") == 0) {
1598360efbdSAlfred Perlstein (void) fprintf(stderr,
1608360efbdSAlfred Perlstein "%s: unable to create service\n", argv[0]);
1618360efbdSAlfred Perlstein exit(1);
1628360efbdSAlfred Perlstein }
16351251b2bSBill Paul
1648360efbdSAlfred Perlstein if (svc_create(keyprogram, KEY_PROG, KEY_VERS2,
1658360efbdSAlfred Perlstein "netpath") == 0) {
1668360efbdSAlfred Perlstein (void) fprintf(stderr,
1678360efbdSAlfred Perlstein "%s: unable to create service\n", argv[0]);
1688360efbdSAlfred Perlstein exit(1);
1698360efbdSAlfred Perlstein }
17051251b2bSBill Paul
17198fb6503SAlfred Perlstein localhandle = setnetconfig();
17298fb6503SAlfred Perlstein while ((nconf = getnetconfig(localhandle)) != NULL) {
17398fb6503SAlfred Perlstein if (nconf->nc_protofmly != NULL &&
17498fb6503SAlfred Perlstein strcmp(nconf->nc_protofmly, NC_LOOPBACK) == 0)
17598fb6503SAlfred Perlstein break;
17698fb6503SAlfred Perlstein }
17798fb6503SAlfred Perlstein
17898fb6503SAlfred Perlstein if (nconf == NULL)
17998fb6503SAlfred Perlstein errx(1, "getnetconfig: %s", nc_sperror());
18098fb6503SAlfred Perlstein
18198fb6503SAlfred Perlstein unlink(KEYSERVSOCK);
18298fb6503SAlfred Perlstein rpcb_unset(CRYPT_PROG, CRYPT_VERS, nconf);
18398fb6503SAlfred Perlstein transp = svcunix_create(RPC_ANYSOCK, 0, 0, KEYSERVSOCK);
18498fb6503SAlfred Perlstein if (transp == NULL)
18598fb6503SAlfred Perlstein errx(1, "cannot create AF_LOCAL service");
18698fb6503SAlfred Perlstein if (!svc_reg(transp, KEY_PROG, KEY_VERS, keyprogram, nconf))
18798fb6503SAlfred Perlstein errx(1, "unable to register (KEY_PROG, KEY_VERS, unix)");
18898fb6503SAlfred Perlstein if (!svc_reg(transp, KEY_PROG, KEY_VERS2, keyprogram, nconf))
18998fb6503SAlfred Perlstein errx(1, "unable to register (KEY_PROG, KEY_VERS2, unix)");
19098fb6503SAlfred Perlstein if (!svc_reg(transp, CRYPT_PROG, CRYPT_VERS, crypt_prog_1, nconf))
19198fb6503SAlfred Perlstein errx(1, "unable to register (CRYPT_PROG, CRYPT_VERS, unix)");
19298fb6503SAlfred Perlstein
19398fb6503SAlfred Perlstein endnetconfig(localhandle);
19498fb6503SAlfred Perlstein
19598fb6503SAlfred Perlstein (void) umask(066); /* paranoia */
19698fb6503SAlfred Perlstein
19751251b2bSBill Paul if (!debugging) {
19851251b2bSBill Paul daemon(0,0);
19951251b2bSBill Paul }
20051251b2bSBill Paul
20198fb6503SAlfred Perlstein signal(SIGPIPE, SIG_IGN);
20298fb6503SAlfred Perlstein
20351251b2bSBill Paul svc_run();
20451251b2bSBill Paul abort();
20551251b2bSBill Paul /* NOTREACHED */
20651251b2bSBill Paul }
20751251b2bSBill Paul
20851251b2bSBill Paul /*
20951251b2bSBill Paul * In the event that we don't get a root password, we try to
21051251b2bSBill Paul * randomize the master key the best we can
21151251b2bSBill Paul */
21251251b2bSBill Paul static void
randomize(des_block * master)21335a624c5SJohn Baldwin randomize(des_block *master)
21451251b2bSBill Paul {
2156cf217b2SKris Kennaway master->key.low = arc4random();
2166cf217b2SKris Kennaway master->key.high = arc4random();
21751251b2bSBill Paul }
21851251b2bSBill Paul
21951251b2bSBill Paul /*
22051251b2bSBill Paul * Try to get root's secret key, by prompting if terminal is a tty, else trying
22151251b2bSBill Paul * from standard input.
22251251b2bSBill Paul * Returns 1 on success.
22351251b2bSBill Paul */
22451251b2bSBill Paul static int
getrootkey(des_block * master,int prompt)22535a624c5SJohn Baldwin getrootkey(des_block *master, int prompt)
22651251b2bSBill Paul {
22751251b2bSBill Paul char *passwd;
22851251b2bSBill Paul char name[MAXNETNAMELEN + 1];
22951251b2bSBill Paul char secret[HEXKEYBYTES];
23051251b2bSBill Paul key_netstarg netstore;
23151251b2bSBill Paul int fd;
23251251b2bSBill Paul
23351251b2bSBill Paul if (!prompt) {
23451251b2bSBill Paul /*
23551251b2bSBill Paul * Read secret key out of ROOTKEY
23651251b2bSBill Paul */
23751251b2bSBill Paul fd = open(ROOTKEY, O_RDONLY, 0);
23851251b2bSBill Paul if (fd < 0) {
23951251b2bSBill Paul randomize(master);
24051251b2bSBill Paul return (0);
24151251b2bSBill Paul }
24251251b2bSBill Paul if (read(fd, secret, HEXKEYBYTES) < HEXKEYBYTES) {
243ecdf56e7SPhilippe Charnier warnx("the key read from %s was too short", ROOTKEY);
24451251b2bSBill Paul (void) close(fd);
24551251b2bSBill Paul return (0);
24651251b2bSBill Paul }
24751251b2bSBill Paul (void) close(fd);
24851251b2bSBill Paul if (!getnetname(name)) {
249ecdf56e7SPhilippe Charnier warnx(
250ecdf56e7SPhilippe Charnier "failed to generate host's netname when establishing root's key");
25151251b2bSBill Paul return (0);
25251251b2bSBill Paul }
25351251b2bSBill Paul memcpy(netstore.st_priv_key, secret, HEXKEYBYTES);
25451251b2bSBill Paul memset(netstore.st_pub_key, 0, HEXKEYBYTES);
25551251b2bSBill Paul netstore.st_netname = name;
25651251b2bSBill Paul if (pk_netput(0, &netstore) != KEY_SUCCESS) {
257ecdf56e7SPhilippe Charnier warnx("could not set root's key and netname");
25851251b2bSBill Paul return (0);
25951251b2bSBill Paul }
26051251b2bSBill Paul return (1);
26151251b2bSBill Paul }
26251251b2bSBill Paul /*
26351251b2bSBill Paul * Decrypt yellow pages publickey entry to get secret key
26451251b2bSBill Paul */
26551251b2bSBill Paul passwd = getpass("root password:");
26651251b2bSBill Paul passwd2des(passwd, (char *)master);
26751251b2bSBill Paul getnetname(name);
26851251b2bSBill Paul if (!getsecretkey(name, secret, passwd)) {
269ecdf56e7SPhilippe Charnier warnx("can't find %s's secret key", name);
27051251b2bSBill Paul return (0);
27151251b2bSBill Paul }
27251251b2bSBill Paul if (secret[0] == 0) {
273ecdf56e7SPhilippe Charnier warnx("password does not decrypt secret key for %s", name);
27451251b2bSBill Paul return (0);
27551251b2bSBill Paul }
27651251b2bSBill Paul (void) pk_setkey(0, secret);
27751251b2bSBill Paul /*
27851251b2bSBill Paul * Store it for future use in $ROOTKEY, if possible
27951251b2bSBill Paul */
28051251b2bSBill Paul fd = open(ROOTKEY, O_WRONLY|O_TRUNC|O_CREAT, 0);
28151251b2bSBill Paul if (fd > 0) {
28251251b2bSBill Paul char newline = '\n';
28351251b2bSBill Paul
28451251b2bSBill Paul write(fd, secret, strlen(secret));
28551251b2bSBill Paul write(fd, &newline, sizeof (newline));
28651251b2bSBill Paul close(fd);
28751251b2bSBill Paul }
28851251b2bSBill Paul return (1);
28951251b2bSBill Paul }
29051251b2bSBill Paul
29151251b2bSBill Paul /*
29251251b2bSBill Paul * Procedures to implement RPC service
29351251b2bSBill Paul */
29451251b2bSBill Paul char *
strstatus(keystatus status)29535a624c5SJohn Baldwin strstatus(keystatus status)
29651251b2bSBill Paul {
29751251b2bSBill Paul switch (status) {
29851251b2bSBill Paul case KEY_SUCCESS:
29951251b2bSBill Paul return ("KEY_SUCCESS");
30051251b2bSBill Paul case KEY_NOSECRET:
30151251b2bSBill Paul return ("KEY_NOSECRET");
30251251b2bSBill Paul case KEY_UNKNOWN:
30351251b2bSBill Paul return ("KEY_UNKNOWN");
30451251b2bSBill Paul case KEY_SYSTEMERR:
30551251b2bSBill Paul return ("KEY_SYSTEMERR");
30651251b2bSBill Paul default:
30751251b2bSBill Paul return ("(bad result code)");
30851251b2bSBill Paul }
30951251b2bSBill Paul }
31051251b2bSBill Paul
31151251b2bSBill Paul keystatus *
key_set_1_svc_prog(uid_t uid,keybuf key)31235a624c5SJohn Baldwin key_set_1_svc_prog(uid_t uid, keybuf key)
31351251b2bSBill Paul {
31451251b2bSBill Paul static keystatus status;
31551251b2bSBill Paul
31651251b2bSBill Paul if (debugging) {
31774088581SDimitry Andric (void) fprintf(stderr, "set(%u, %.*s) = ", uid,
31851251b2bSBill Paul (int) sizeof (keybuf), key);
31951251b2bSBill Paul }
32051251b2bSBill Paul status = pk_setkey(uid, key);
32151251b2bSBill Paul if (debugging) {
32251251b2bSBill Paul (void) fprintf(stderr, "%s\n", strstatus(status));
32351251b2bSBill Paul (void) fflush(stderr);
32451251b2bSBill Paul }
32551251b2bSBill Paul return (&status);
32651251b2bSBill Paul }
32751251b2bSBill Paul
32851251b2bSBill Paul cryptkeyres *
key_encrypt_pk_2_svc_prog(uid_t uid,cryptkeyarg2 * arg)32935a624c5SJohn Baldwin key_encrypt_pk_2_svc_prog(uid_t uid, cryptkeyarg2 *arg)
33051251b2bSBill Paul {
33151251b2bSBill Paul static cryptkeyres res;
33251251b2bSBill Paul
33351251b2bSBill Paul if (debugging) {
33474088581SDimitry Andric (void) fprintf(stderr, "encrypt(%u, %s, %08x%08x) = ", uid,
33551251b2bSBill Paul arg->remotename, arg->deskey.key.high,
33651251b2bSBill Paul arg->deskey.key.low);
33751251b2bSBill Paul }
33851251b2bSBill Paul res.cryptkeyres_u.deskey = arg->deskey;
33951251b2bSBill Paul res.status = pk_encrypt(uid, arg->remotename, &(arg->remotekey),
34051251b2bSBill Paul &res.cryptkeyres_u.deskey);
34151251b2bSBill Paul if (debugging) {
34251251b2bSBill Paul if (res.status == KEY_SUCCESS) {
34351251b2bSBill Paul (void) fprintf(stderr, "%08x%08x\n",
34451251b2bSBill Paul res.cryptkeyres_u.deskey.key.high,
34551251b2bSBill Paul res.cryptkeyres_u.deskey.key.low);
34651251b2bSBill Paul } else {
34751251b2bSBill Paul (void) fprintf(stderr, "%s\n", strstatus(res.status));
34851251b2bSBill Paul }
34951251b2bSBill Paul (void) fflush(stderr);
35051251b2bSBill Paul }
35151251b2bSBill Paul return (&res);
35251251b2bSBill Paul }
35351251b2bSBill Paul
35451251b2bSBill Paul cryptkeyres *
key_decrypt_pk_2_svc_prog(uid_t uid,cryptkeyarg2 * arg)35535a624c5SJohn Baldwin key_decrypt_pk_2_svc_prog(uid_t uid, cryptkeyarg2 *arg)
35651251b2bSBill Paul {
35751251b2bSBill Paul static cryptkeyres res;
35851251b2bSBill Paul
35951251b2bSBill Paul if (debugging) {
36074088581SDimitry Andric (void) fprintf(stderr, "decrypt(%u, %s, %08x%08x) = ", uid,
36151251b2bSBill Paul arg->remotename, arg->deskey.key.high,
36251251b2bSBill Paul arg->deskey.key.low);
36351251b2bSBill Paul }
36451251b2bSBill Paul res.cryptkeyres_u.deskey = arg->deskey;
36551251b2bSBill Paul res.status = pk_decrypt(uid, arg->remotename, &(arg->remotekey),
36651251b2bSBill Paul &res.cryptkeyres_u.deskey);
36751251b2bSBill Paul if (debugging) {
36851251b2bSBill Paul if (res.status == KEY_SUCCESS) {
36951251b2bSBill Paul (void) fprintf(stderr, "%08x%08x\n",
37051251b2bSBill Paul res.cryptkeyres_u.deskey.key.high,
37151251b2bSBill Paul res.cryptkeyres_u.deskey.key.low);
37251251b2bSBill Paul } else {
37351251b2bSBill Paul (void) fprintf(stderr, "%s\n", strstatus(res.status));
37451251b2bSBill Paul }
37551251b2bSBill Paul (void) fflush(stderr);
37651251b2bSBill Paul }
37751251b2bSBill Paul return (&res);
37851251b2bSBill Paul }
37951251b2bSBill Paul
38051251b2bSBill Paul keystatus *
key_net_put_2_svc_prog(uid_t uid,key_netstarg * arg)38135a624c5SJohn Baldwin key_net_put_2_svc_prog(uid_t uid, key_netstarg *arg)
38251251b2bSBill Paul {
38351251b2bSBill Paul static keystatus status;
38451251b2bSBill Paul
38551251b2bSBill Paul if (debugging) {
38651251b2bSBill Paul (void) fprintf(stderr, "net_put(%s, %.*s, %.*s) = ",
38751251b2bSBill Paul arg->st_netname, (int)sizeof (arg->st_pub_key),
38851251b2bSBill Paul arg->st_pub_key, (int)sizeof (arg->st_priv_key),
38951251b2bSBill Paul arg->st_priv_key);
39080c7cc1cSPedro F. Giffuni }
39151251b2bSBill Paul
39251251b2bSBill Paul status = pk_netput(uid, arg);
39351251b2bSBill Paul
39451251b2bSBill Paul if (debugging) {
39551251b2bSBill Paul (void) fprintf(stderr, "%s\n", strstatus(status));
39651251b2bSBill Paul (void) fflush(stderr);
39751251b2bSBill Paul }
39851251b2bSBill Paul
39951251b2bSBill Paul return (&status);
40051251b2bSBill Paul }
40151251b2bSBill Paul
40251251b2bSBill Paul key_netstres *
key_net_get_2_svc_prog(uid_t uid,void * arg)40335a624c5SJohn Baldwin key_net_get_2_svc_prog(uid_t uid, void *arg)
40451251b2bSBill Paul {
40551251b2bSBill Paul static key_netstres keynetname;
40651251b2bSBill Paul
40751251b2bSBill Paul if (debugging)
40874088581SDimitry Andric (void) fprintf(stderr, "net_get(%u) = ", uid);
40951251b2bSBill Paul
41051251b2bSBill Paul keynetname.status = pk_netget(uid, &keynetname.key_netstres_u.knet);
41151251b2bSBill Paul if (debugging) {
41251251b2bSBill Paul if (keynetname.status == KEY_SUCCESS) {
41351251b2bSBill Paul fprintf(stderr, "<%s, %.*s, %.*s>\n",
41451251b2bSBill Paul keynetname.key_netstres_u.knet.st_netname,
41551251b2bSBill Paul (int)sizeof (keynetname.key_netstres_u.knet.st_pub_key),
41651251b2bSBill Paul keynetname.key_netstres_u.knet.st_pub_key,
41751251b2bSBill Paul (int)sizeof (keynetname.key_netstres_u.knet.st_priv_key),
41851251b2bSBill Paul keynetname.key_netstres_u.knet.st_priv_key);
41951251b2bSBill Paul } else {
42051251b2bSBill Paul (void) fprintf(stderr, "NOT FOUND\n");
42151251b2bSBill Paul }
42251251b2bSBill Paul (void) fflush(stderr);
42351251b2bSBill Paul }
42451251b2bSBill Paul
42551251b2bSBill Paul return (&keynetname);
42651251b2bSBill Paul
42751251b2bSBill Paul }
42851251b2bSBill Paul
42951251b2bSBill Paul cryptkeyres *
key_get_conv_2_svc_prog(uid_t uid,keybuf arg)43035a624c5SJohn Baldwin key_get_conv_2_svc_prog(uid_t uid, keybuf arg)
43151251b2bSBill Paul {
43251251b2bSBill Paul static cryptkeyres res;
43351251b2bSBill Paul
43451251b2bSBill Paul if (debugging)
43574088581SDimitry Andric (void) fprintf(stderr, "get_conv(%u, %.*s) = ", uid,
43674088581SDimitry Andric (int)sizeof (keybuf), arg);
43751251b2bSBill Paul
43851251b2bSBill Paul
43951251b2bSBill Paul res.status = pk_get_conv_key(uid, arg, &res);
44051251b2bSBill Paul
44151251b2bSBill Paul if (debugging) {
44251251b2bSBill Paul if (res.status == KEY_SUCCESS) {
44351251b2bSBill Paul (void) fprintf(stderr, "%08x%08x\n",
44451251b2bSBill Paul res.cryptkeyres_u.deskey.key.high,
44551251b2bSBill Paul res.cryptkeyres_u.deskey.key.low);
44651251b2bSBill Paul } else {
44751251b2bSBill Paul (void) fprintf(stderr, "%s\n", strstatus(res.status));
44851251b2bSBill Paul }
44951251b2bSBill Paul (void) fflush(stderr);
45051251b2bSBill Paul }
45151251b2bSBill Paul return (&res);
45251251b2bSBill Paul }
45351251b2bSBill Paul
45451251b2bSBill Paul
45551251b2bSBill Paul cryptkeyres *
key_encrypt_1_svc_prog(uid_t uid,cryptkeyarg * arg)45635a624c5SJohn Baldwin key_encrypt_1_svc_prog(uid_t uid, cryptkeyarg *arg)
45751251b2bSBill Paul {
45851251b2bSBill Paul static cryptkeyres res;
45951251b2bSBill Paul
46051251b2bSBill Paul if (debugging) {
46174088581SDimitry Andric (void) fprintf(stderr, "encrypt(%u, %s, %08x%08x) = ", uid,
46251251b2bSBill Paul arg->remotename, arg->deskey.key.high,
46351251b2bSBill Paul arg->deskey.key.low);
46451251b2bSBill Paul }
46551251b2bSBill Paul res.cryptkeyres_u.deskey = arg->deskey;
46651251b2bSBill Paul res.status = pk_encrypt(uid, arg->remotename, NULL,
46751251b2bSBill Paul &res.cryptkeyres_u.deskey);
46851251b2bSBill Paul if (debugging) {
46951251b2bSBill Paul if (res.status == KEY_SUCCESS) {
47051251b2bSBill Paul (void) fprintf(stderr, "%08x%08x\n",
47151251b2bSBill Paul res.cryptkeyres_u.deskey.key.high,
47251251b2bSBill Paul res.cryptkeyres_u.deskey.key.low);
47351251b2bSBill Paul } else {
47451251b2bSBill Paul (void) fprintf(stderr, "%s\n", strstatus(res.status));
47551251b2bSBill Paul }
47651251b2bSBill Paul (void) fflush(stderr);
47751251b2bSBill Paul }
47851251b2bSBill Paul return (&res);
47951251b2bSBill Paul }
48051251b2bSBill Paul
48151251b2bSBill Paul cryptkeyres *
key_decrypt_1_svc_prog(uid_t uid,cryptkeyarg * arg)48235a624c5SJohn Baldwin key_decrypt_1_svc_prog(uid_t uid, cryptkeyarg *arg)
48351251b2bSBill Paul {
48451251b2bSBill Paul static cryptkeyres res;
48551251b2bSBill Paul
48651251b2bSBill Paul if (debugging) {
48774088581SDimitry Andric (void) fprintf(stderr, "decrypt(%u, %s, %08x%08x) = ", uid,
48851251b2bSBill Paul arg->remotename, arg->deskey.key.high,
48951251b2bSBill Paul arg->deskey.key.low);
49051251b2bSBill Paul }
49151251b2bSBill Paul res.cryptkeyres_u.deskey = arg->deskey;
49251251b2bSBill Paul res.status = pk_decrypt(uid, arg->remotename, NULL,
49351251b2bSBill Paul &res.cryptkeyres_u.deskey);
49451251b2bSBill Paul if (debugging) {
49551251b2bSBill Paul if (res.status == KEY_SUCCESS) {
49651251b2bSBill Paul (void) fprintf(stderr, "%08x%08x\n",
49751251b2bSBill Paul res.cryptkeyres_u.deskey.key.high,
49851251b2bSBill Paul res.cryptkeyres_u.deskey.key.low);
49951251b2bSBill Paul } else {
50051251b2bSBill Paul (void) fprintf(stderr, "%s\n", strstatus(res.status));
50151251b2bSBill Paul }
50251251b2bSBill Paul (void) fflush(stderr);
50351251b2bSBill Paul }
50451251b2bSBill Paul return (&res);
50551251b2bSBill Paul }
50651251b2bSBill Paul
50751251b2bSBill Paul /* ARGSUSED */
50851251b2bSBill Paul des_block *
key_gen_1_svc_prog(void * v,struct svc_req * s)50935a624c5SJohn Baldwin key_gen_1_svc_prog(void *v, struct svc_req *s)
51051251b2bSBill Paul {
51151251b2bSBill Paul struct timeval time;
51251251b2bSBill Paul static des_block keygen;
51351251b2bSBill Paul static des_block key;
51451251b2bSBill Paul
515902d9eafSEd Schouten (void)gettimeofday(&time, NULL);
51651251b2bSBill Paul keygen.key.high += (time.tv_sec ^ time.tv_usec);
51751251b2bSBill Paul keygen.key.low += (time.tv_sec ^ time.tv_usec);
51851251b2bSBill Paul ecb_crypt((char *)&masterkey, (char *)&keygen, sizeof (keygen),
51951251b2bSBill Paul DES_ENCRYPT | DES_HW);
52051251b2bSBill Paul key = keygen;
52151251b2bSBill Paul des_setparity((char *)&key);
52251251b2bSBill Paul if (debugging) {
52351251b2bSBill Paul (void) fprintf(stderr, "gen() = %08x%08x\n", key.key.high,
52451251b2bSBill Paul key.key.low);
52551251b2bSBill Paul (void) fflush(stderr);
52651251b2bSBill Paul }
52751251b2bSBill Paul return (&key);
52851251b2bSBill Paul }
52951251b2bSBill Paul
53051251b2bSBill Paul getcredres *
key_getcred_1_svc_prog(uid_t uid,netnamestr * name)53135a624c5SJohn Baldwin key_getcred_1_svc_prog(uid_t uid, netnamestr *name)
53251251b2bSBill Paul {
53351251b2bSBill Paul static getcredres res;
53451251b2bSBill Paul static u_int gids[NGROUPS];
53551251b2bSBill Paul struct unixcred *cred;
53651251b2bSBill Paul
53751251b2bSBill Paul cred = &res.getcredres_u.cred;
53851251b2bSBill Paul cred->gids.gids_val = gids;
53951251b2bSBill Paul if (!netname2user(*name, (uid_t *) &cred->uid, (gid_t *) &cred->gid,
54051251b2bSBill Paul (int *)&cred->gids.gids_len, (gid_t *)gids)) {
54151251b2bSBill Paul res.status = KEY_UNKNOWN;
54251251b2bSBill Paul } else {
54351251b2bSBill Paul res.status = KEY_SUCCESS;
54451251b2bSBill Paul }
54551251b2bSBill Paul if (debugging) {
54651251b2bSBill Paul (void) fprintf(stderr, "getcred(%s) = ", *name);
54751251b2bSBill Paul if (res.status == KEY_SUCCESS) {
54851251b2bSBill Paul (void) fprintf(stderr, "uid=%d, gid=%d, grouplen=%d\n",
54951251b2bSBill Paul cred->uid, cred->gid, cred->gids.gids_len);
55051251b2bSBill Paul } else {
55151251b2bSBill Paul (void) fprintf(stderr, "%s\n", strstatus(res.status));
55251251b2bSBill Paul }
55351251b2bSBill Paul (void) fflush(stderr);
55451251b2bSBill Paul }
55551251b2bSBill Paul return (&res);
55651251b2bSBill Paul }
55751251b2bSBill Paul
55851251b2bSBill Paul /*
55951251b2bSBill Paul * RPC boilerplate
56051251b2bSBill Paul */
56151251b2bSBill Paul static void
keyprogram(struct svc_req * rqstp,SVCXPRT * transp)56235a624c5SJohn Baldwin keyprogram(struct svc_req *rqstp, SVCXPRT *transp)
56351251b2bSBill Paul {
56451251b2bSBill Paul union {
56551251b2bSBill Paul keybuf key_set_1_arg;
56651251b2bSBill Paul cryptkeyarg key_encrypt_1_arg;
56751251b2bSBill Paul cryptkeyarg key_decrypt_1_arg;
56851251b2bSBill Paul netnamestr key_getcred_1_arg;
56951251b2bSBill Paul cryptkeyarg key_encrypt_2_arg;
57051251b2bSBill Paul cryptkeyarg key_decrypt_2_arg;
57151251b2bSBill Paul netnamestr key_getcred_2_arg;
57251251b2bSBill Paul cryptkeyarg2 key_encrypt_pk_2_arg;
57351251b2bSBill Paul cryptkeyarg2 key_decrypt_pk_2_arg;
57451251b2bSBill Paul key_netstarg key_net_put_2_arg;
57551251b2bSBill Paul netobj key_get_conv_2_arg;
57651251b2bSBill Paul } argument;
57751251b2bSBill Paul char *result;
578f249dbccSDag-Erling Smørgrav xdrproc_t xdr_argument, xdr_result;
57935a624c5SJohn Baldwin typedef void *(svc_cb)(uid_t uid, void *arg);
58035a624c5SJohn Baldwin svc_cb *local;
58151251b2bSBill Paul uid_t uid = -1;
58251251b2bSBill Paul int check_auth;
58351251b2bSBill Paul
58451251b2bSBill Paul switch (rqstp->rq_proc) {
58551251b2bSBill Paul case NULLPROC:
586f249dbccSDag-Erling Smørgrav svc_sendreply(transp, (xdrproc_t)xdr_void, NULL);
58751251b2bSBill Paul return;
58851251b2bSBill Paul
58951251b2bSBill Paul case KEY_SET:
590f249dbccSDag-Erling Smørgrav xdr_argument = (xdrproc_t)xdr_keybuf;
591f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_int;
59235a624c5SJohn Baldwin local = (svc_cb *)key_set_1_svc_prog;
59351251b2bSBill Paul check_auth = 1;
59451251b2bSBill Paul break;
59551251b2bSBill Paul
59651251b2bSBill Paul case KEY_ENCRYPT:
597f249dbccSDag-Erling Smørgrav xdr_argument = (xdrproc_t)xdr_cryptkeyarg;
598f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_cryptkeyres;
59935a624c5SJohn Baldwin local = (svc_cb *)key_encrypt_1_svc_prog;
60051251b2bSBill Paul check_auth = 1;
60151251b2bSBill Paul break;
60251251b2bSBill Paul
60351251b2bSBill Paul case KEY_DECRYPT:
604f249dbccSDag-Erling Smørgrav xdr_argument = (xdrproc_t)xdr_cryptkeyarg;
605f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_cryptkeyres;
60635a624c5SJohn Baldwin local = (svc_cb *)key_decrypt_1_svc_prog;
60751251b2bSBill Paul check_auth = 1;
60851251b2bSBill Paul break;
60951251b2bSBill Paul
61051251b2bSBill Paul case KEY_GEN:
611f249dbccSDag-Erling Smørgrav xdr_argument = (xdrproc_t)xdr_void;
612f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_des_block;
61335a624c5SJohn Baldwin local = (svc_cb *)key_gen_1_svc_prog;
61451251b2bSBill Paul check_auth = 0;
61551251b2bSBill Paul break;
61651251b2bSBill Paul
61751251b2bSBill Paul case KEY_GETCRED:
618f249dbccSDag-Erling Smørgrav xdr_argument = (xdrproc_t)xdr_netnamestr;
619f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_getcredres;
62035a624c5SJohn Baldwin local = (svc_cb *)key_getcred_1_svc_prog;
62151251b2bSBill Paul check_auth = 0;
62251251b2bSBill Paul break;
62351251b2bSBill Paul
62451251b2bSBill Paul case KEY_ENCRYPT_PK:
625f249dbccSDag-Erling Smørgrav xdr_argument = (xdrproc_t)xdr_cryptkeyarg2;
626f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_cryptkeyres;
62735a624c5SJohn Baldwin local = (svc_cb *)key_encrypt_pk_2_svc_prog;
62851251b2bSBill Paul check_auth = 1;
62951251b2bSBill Paul break;
63051251b2bSBill Paul
63151251b2bSBill Paul case KEY_DECRYPT_PK:
632f249dbccSDag-Erling Smørgrav xdr_argument = (xdrproc_t)xdr_cryptkeyarg2;
633f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_cryptkeyres;
63435a624c5SJohn Baldwin local = (svc_cb *)key_decrypt_pk_2_svc_prog;
63551251b2bSBill Paul check_auth = 1;
63651251b2bSBill Paul break;
63751251b2bSBill Paul
63851251b2bSBill Paul
63951251b2bSBill Paul case KEY_NET_PUT:
640f249dbccSDag-Erling Smørgrav xdr_argument = (xdrproc_t)xdr_key_netstarg;
641f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_keystatus;
64235a624c5SJohn Baldwin local = (svc_cb *)key_net_put_2_svc_prog;
64351251b2bSBill Paul check_auth = 1;
64451251b2bSBill Paul break;
64551251b2bSBill Paul
64651251b2bSBill Paul case KEY_NET_GET:
64751251b2bSBill Paul xdr_argument = (xdrproc_t) xdr_void;
648f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_key_netstres;
64935a624c5SJohn Baldwin local = (svc_cb *)key_net_get_2_svc_prog;
65051251b2bSBill Paul check_auth = 1;
65151251b2bSBill Paul break;
65251251b2bSBill Paul
65351251b2bSBill Paul case KEY_GET_CONV:
65451251b2bSBill Paul xdr_argument = (xdrproc_t) xdr_keybuf;
655f249dbccSDag-Erling Smørgrav xdr_result = (xdrproc_t)xdr_cryptkeyres;
65635a624c5SJohn Baldwin local = (svc_cb *)key_get_conv_2_svc_prog;
65751251b2bSBill Paul check_auth = 1;
65851251b2bSBill Paul break;
65951251b2bSBill Paul
66051251b2bSBill Paul default:
66151251b2bSBill Paul svcerr_noproc(transp);
66251251b2bSBill Paul return;
66351251b2bSBill Paul }
66451251b2bSBill Paul if (check_auth) {
66551251b2bSBill Paul if (root_auth(transp, rqstp) == 0) {
66651251b2bSBill Paul if (debugging) {
66751251b2bSBill Paul (void) fprintf(stderr,
66851251b2bSBill Paul "not local privileged process\n");
66951251b2bSBill Paul }
67051251b2bSBill Paul svcerr_weakauth(transp);
67151251b2bSBill Paul return;
67251251b2bSBill Paul }
67351251b2bSBill Paul if (rqstp->rq_cred.oa_flavor != AUTH_SYS) {
67451251b2bSBill Paul if (debugging) {
67551251b2bSBill Paul (void) fprintf(stderr,
67651251b2bSBill Paul "not unix authentication\n");
67751251b2bSBill Paul }
67851251b2bSBill Paul svcerr_weakauth(transp);
67951251b2bSBill Paul return;
68051251b2bSBill Paul }
68151251b2bSBill Paul uid = ((struct authsys_parms *)rqstp->rq_clntcred)->aup_uid;
68251251b2bSBill Paul }
68351251b2bSBill Paul
684f249dbccSDag-Erling Smørgrav memset(&argument, 0, sizeof (argument));
685f249dbccSDag-Erling Smørgrav if (!svc_getargs(transp, xdr_argument, &argument)) {
68651251b2bSBill Paul svcerr_decode(transp);
68751251b2bSBill Paul return;
68851251b2bSBill Paul }
68951251b2bSBill Paul result = (*local) (uid, &argument);
690f249dbccSDag-Erling Smørgrav if (!svc_sendreply(transp, xdr_result, result)) {
69151251b2bSBill Paul if (debugging)
69251251b2bSBill Paul (void) fprintf(stderr, "unable to reply\n");
69351251b2bSBill Paul svcerr_systemerr(transp);
69451251b2bSBill Paul }
695f249dbccSDag-Erling Smørgrav if (!svc_freeargs(transp, xdr_argument, &argument)) {
69651251b2bSBill Paul if (debugging)
69751251b2bSBill Paul (void) fprintf(stderr,
69851251b2bSBill Paul "unable to free arguments\n");
69951251b2bSBill Paul exit(1);
70051251b2bSBill Paul }
70151251b2bSBill Paul }
70251251b2bSBill Paul
70351251b2bSBill Paul static int
root_auth(SVCXPRT * trans,struct svc_req * rqstp)70435a624c5SJohn Baldwin root_auth(SVCXPRT *trans, struct svc_req *rqstp)
70551251b2bSBill Paul {
70651251b2bSBill Paul uid_t uid;
707af37179bSAlfred Perlstein struct sockaddr *remote;
70851251b2bSBill Paul
709af37179bSAlfred Perlstein remote = svc_getrpccaller(trans)->buf;
710af37179bSAlfred Perlstein if (remote->sa_family != AF_UNIX) {
71151251b2bSBill Paul if (debugging)
71251251b2bSBill Paul fprintf(stderr, "client didn't use AF_UNIX\n");
71351251b2bSBill Paul return (0);
71451251b2bSBill Paul }
71551251b2bSBill Paul
7164ed6d634SAlfred Perlstein if (__rpc_get_local_uid(trans, &uid) < 0) {
71751251b2bSBill Paul if (debugging)
71851251b2bSBill Paul fprintf(stderr, "__rpc_get_local_uid failed\n");
71951251b2bSBill Paul return (0);
72051251b2bSBill Paul }
72151251b2bSBill Paul
72251251b2bSBill Paul if (debugging)
72374088581SDimitry Andric fprintf(stderr, "local_uid %u\n", uid);
72451251b2bSBill Paul if (uid == 0)
72551251b2bSBill Paul return (1);
72651251b2bSBill Paul if (rqstp->rq_cred.oa_flavor == AUTH_SYS) {
72751251b2bSBill Paul if (((uid_t) ((struct authunix_parms *)
72851251b2bSBill Paul rqstp->rq_clntcred)->aup_uid)
72951251b2bSBill Paul == uid) {
73051251b2bSBill Paul return (1);
73151251b2bSBill Paul } else {
73251251b2bSBill Paul if (debugging)
73351251b2bSBill Paul fprintf(stderr,
73474088581SDimitry Andric "local_uid %u mismatches auth %u\n", uid,
73551251b2bSBill Paul ((uid_t) ((struct authunix_parms *)rqstp->rq_clntcred)->aup_uid));
73651251b2bSBill Paul return (0);
73751251b2bSBill Paul }
73851251b2bSBill Paul } else {
73951251b2bSBill Paul if (debugging)
74051251b2bSBill Paul fprintf(stderr, "Not auth sys\n");
74151251b2bSBill Paul return (0);
74251251b2bSBill Paul }
74351251b2bSBill Paul }
74451251b2bSBill Paul
74551251b2bSBill Paul static void
usage(void)74635a624c5SJohn Baldwin usage(void)
74751251b2bSBill Paul {
74851251b2bSBill Paul (void) fprintf(stderr,
74951251b2bSBill Paul "usage: keyserv [-n] [-D] [-d] [-v] [-p path]\n");
75051251b2bSBill Paul (void) fprintf(stderr, "-d disables the use of default keys\n");
75151251b2bSBill Paul exit(1);
75251251b2bSBill Paul }
753