keystore_client.c

Go to the documentation of this file.

/******************************************************************************
 *
 *      File:                   keystore_client.c
 *
 *      Function:               Secure Storage Keystore client API Library source
 *
 *      Author(s):              Giordano Scuderi and Nicola Dominante
 *
 *      Copyright:              Copyright (c) 2007 <Giordano Scuderi - gscuderi@unicosrl.it>
 *                                      All Rights Reserved.
 *
 *
 *      Notes:                  Redistributions of any form whatsoever must retain the following
 *                              acknowledgment:
 *                              "This product includes software developed by Giordano Scuderi
 *                              and Nicola Dominante for Unico SRL"
 *
 * ====================================================================
 * Copyright (c) Giordano Scuderi, Unico SRL.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by Giordano Scuderi
 *    for Unico SRL"
 *
 * 4. The names "Secure Storage" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    gscuderi@unicosrl.it.
 *
 * 5. Products derived from this software may not be called "Secure Storage"
 *    nor may "Secure Storage" appear in their names without prior written
 *    permission of Giordano Scuderi (Unico SRL).
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by Giordano Scuderi
 *    for Unico SRL"
 *
 * THIS SOFTWARE IS PROVIDED BY UNICO SRL ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNICO SRL OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 * 
 */

#include <errno.h>
#include <string.h>
#include <netdb.h>
#include "keystore_client.h"

const char *ss_errlist[56] = {
        "Success",
        "Keystore: Wrong parameters number",                                                                                    // 1
        "Keystore: Error in saving data",                                                                                               // 2
        "Keystore: User not authorized",                                                                                                // 3
        "Keystore: Generic Error",                                                                                                              // 4
        "Keystore: Error reading key or iv",                                                                                    // 5
        "Keystore: Cannot delete the key",                                                                                              // 6
        "Keystore: A key for this LFN doesn't exist",                                                                   // 7
        "Keystore: A Key for this LFN just exists",                                                                             // 8
        "Invalid LFN specified",                                                                                                                // 9
        "Invalid VO specified",                                                                                                                 // 10
        "Invalid GUID specified",                                                                                                               // 11
        "Invalid SE specified",                                                                                                                 // 12
        "Invalid Source File specified",                                                                                                // 13
        "Invalid destination file specified",                                                                                   // 14
        "Invalid parameter specified",                                                                                                  // 15
        "File Exist",                                                                                                                                   // 16
        "No such file or directory",                                                                                                    // 17
        "No replica found",                                                                                                                             // 18
        "Permission denied",                                                                                                                    // 19
        "Illegal seek",                                                                                                                                 // 20
        "Invalid offset specified",                                                                                                             // 21
        "Invalid whence specified",                                                                                                             // 22
        "Source file name too long",                                                                                                    // 23
        "Destination file name too long",                                                                                               // 24
        "File name too long",                                                                                                                   // 25
        "Invalid SS_GRID_KEYSTORE_HOST environment variable",                                                   // 26
        "Invalid SS_GRID_KEYSTORE_DN environment variable",                                                             // 27
        "Invalid SS_LOCAL_KEYSTORE_HOST environment variable",                                                  // 28
        "Invalid SS_LOCAL_KEYSTORE_DN environment variable",                                                    // 29
        "Authentication with Keystore failed",                                                                                  // 30
        "Connection to the Keystore failed",                                                                                    // 31
        "Send data to keystore failed",                                                                                                 // 32
        "Receive data to keystore failed",                                                                                              // 33
        "Error when closing connection to the keystore",                                                                // 34
        "AES encryption initializing failed",                                                                                   // 35
        "The specified keystore host is unknown",                                                                               // 36
        "The requested keystore name is valid but does not have an IP address",                 // 37
        "A non-recoverable name server error occurred",                                                                 // 38
        "A temporary error occurred on an authoritative name server.Try again later",   // 39
        "No credentials found",                                                                                                                 // 40
        "No secure context has been established",                                                                               // 41
        "The referenced context could not be accessed",                                                                 // 42
        "The referenced context could not be deleted",                                                                  // 43
        "The context has already expired",                                                                                              // 44
        "The specified QOP is not supported by the mechanism",                                                  // 45
        "Generic error on wrapping message",                                                                                    // 46
        "Invalid token argument",                                                                                                               // 47
        "No token has been read",                                                                                                               // 48
        "Token too large",                                                                                                                              // 49
        "The token failed consistency checks",                                                                                  // 50
        "The MIC was incorrect",                                                                                                                // 51
        "The token is too old to check for duplication",                                                                // 52
        "The token has been verified out of sequence; a later token has already been received",                 // 53
        "The token has been verified out of sequence; an earlier expected token has not yet been received",     // 54
        "Generic error on unwrapping message",                                                                                  // 55
};

// \struct Used to represent client in keystore connection.
struct ss_socket_client {       
        struct sockaddr_in peeraddr_in; 
        int sck;
        gss_ctx_id_t gss_context; 
        char* host;
        int port; 
        char* server_contact;
        int delegate_credentials;
};

extern int errno;

static int get_keystore_env ( char **host, int *port, char **dn ) {
        
        char *ss_host_tmp = getenv(KEYSTORE_HOST);
        if ( ss_host_tmp == NULL ) { // SS_GRID_KEYSTORE_HOST not specified
                errno = SS_ENOGRIDSSKEYSTOREENV;
                return (-1);
        }
        char *ss_port = strrchr(ss_host_tmp, ':');
        if ( ss_port == NULL ) { // Port not specified on SS_GRID_KEYSTORE_HOST
                errno = SS_ENOGRIDSSKEYSTOREENV;
                return (-1);
        } else if ( strlen(ss_port) <= 1 ) { // Port not specified on SS_GRID_KEYSTORE_HOST
                errno = SS_ENOGRIDSSKEYSTOREENV;
                return (-1);
        }
        ss_port += 1;
        int keystore_port = atoi(ss_port);
        ss_port -= 1;
        if ( keystore_port <= 0 ) { // Invalid port specified on SS_GRID_KEYSTORE_HOST
                errno = SS_ENOGRIDSSKEYSTOREENV;
                return (-1);
        }
        size_t n = ss_port - ss_host_tmp;
        if ( n <= 0 ) { // Host not specified on SS_GRID_KEYSTORE_HOST
                errno = SS_ENOGRIDSSKEYSTOREENV;
                return (-1);
        }

        *host = (char*) malloc(n+1);
         memset(*host, '\0', n+1);      
         memcpy(*host,ss_host_tmp,n);
        *port = keystore_port;
        
        char *ss_dn = getenv(KEYSTORE_DN);
        if ( ss_dn == NULL ) { // Distinguished Name not specified on SS_GRID_KEYSTORE_DN
                free(*host);
                errno = SS_ENOGRIDSSKEYSTOREDNENV;
                return (-1);
        }
        *dn = strdup (ss_dn);
        return 0;
}


/******************************************************************************
 * Send a gss token.
 * 
 ******************************************************************************/
static int ss_send_token(void *arg, void *token, size_t token_length){
        
    size_t                      num_written = 0;
    ssize_t                     n_written;
    int                         fd = *( (int *) arg );
    unsigned char               token_length_buffer[4];

    if( token == NULL || (token_length <=0)) {         
        errno = SSKEYSTORE_INVALIDTOKEN;
        return (-1);
    }

    /* encode the token length in network byte order: 4 byte, big endian */
    token_length_buffer[0] = (unsigned char) ((token_length >> 24) & 0xff);
    token_length_buffer[1] = (unsigned char) ((token_length >> 16) & 0xff);
    token_length_buffer[2] = (unsigned char) ((token_length >>  8) & 0xff);
    token_length_buffer[3] = (unsigned char) ((token_length      ) & 0xff);

    /* send the token length */
    while(num_written < 4){
      n_written = send(fd, token_length_buffer + num_written, 4 - num_written,0);      
      if(n_written < 0){
          if(errno == EINTR)//Interrupted by SO,socket is not in error state
            continue;
          else
            return (-1);
      }else{
        num_written += n_written;
      }
    }
    
    /* send the token */
    num_written = 0;
    while(num_written < token_length){
       n_written = send(fd, ((u_char *)token) + num_written, token_length - num_written,0);       
       if(n_written < 0){
           if(errno == EINTR){//Interrupted by SO,socket is not in error state
                continue;
           }else{
             return (-1);
           }
       }else{
         num_written += n_written;
       }
    }    
    return 0;
}

/******************************************************************************
 * Receive a gss token.
 * 
 ******************************************************************************/
static int ss_get_token(void *arg, void **token, size_t *token_length){
        
    size_t                      num_read = 0;
    ssize_t                     n_read;
    int                         fd = *( (int *) arg );
    unsigned char               token_length_buffer[4];

    /* read the token length */
    while(num_read < 4){      
      n_read = recv(fd,token_length_buffer + num_read, 4 - num_read,0); 
      if(n_read < 0){
            if(errno == EINTR){//Interrupted by SO,socket is not in error state
                continue;
            }else{
                return (-1);
            }
      }else{
             if (n_read == 0){                  
                errno = SSKEYSTORE_TOKENEOF;
                return (-1);
             }else{
                num_read += n_read;
             }
      }
    }    
    num_read = 0;
    
    /* decode the token length from network byte order: 4 byte, big endian */
    *token_length  = (((size_t) token_length_buffer[0]) << 24) & 0xffff;
    *token_length |= (((size_t) token_length_buffer[1]) << 16) & 0xffff;
    *token_length |= (((size_t) token_length_buffer[2]) <<  8) & 0xffff;
    *token_length |= (((size_t) token_length_buffer[3])      ) & 0xffff;

    if(*token_length > 1<<24){
        /* token too large */   
        errno = SSKEYSTORE_TOKENTOOLARGE;
        return (-1);
    }

    /* allocate space for the token */
    *((void **)token) = (void *) malloc(*token_length);
    if(*token == NULL){ 
        errno = ENOMEM;
        return (-1);
    }

    /* receive the token */
    num_read = 0;
    while(num_read < *token_length){
      n_read = recv(fd, ((u_char *) (*token)) + num_read,(*token_length) - num_read,0); 
      if(n_read < 0){
            if(errno == EINTR){//Interrupted by SO,socket is not in error state
                continue;
            }else{
                int errno_save = errno;
                free(*token);
                errno = errno_save;
                return (-1);
            }
      }else{
            if(n_read == 0){
                free(*token);
                errno = SSKEYSTORE_TOKENEOF;
                return (-1); 
            }
            num_read += n_read;
      }
    }
    return 0;
}

/******************************************************************************
 * Initialize GSI Authentication.
 * 
 ******************************************************************************/
static int init_gsi_authentication(struct ss_socket_client *ssc){
        
        OM_uint32                   major_status = 0;
        OM_uint32                   minor_status = 0;
        gss_cred_id_t               credential = GSS_C_NO_CREDENTIAL;
        OM_uint32                   req_flags  = 0;
        OM_uint32                   ret_flags  = 0;
        int                         token_status = 0;
        gss_name_t                  targ_name;
        gss_buffer_desc             name_buffer;
        char                        service[1024];
        int                         status;
      
    /* acquire our credentials */
    major_status = globus_gss_assist_acquire_cred(&minor_status, GSS_C_BOTH, &credential);

    if(GSS_ERROR(major_status)!= 0) {   
        errno = SSKEYSTORE_NOCREDFOUND;
        return (-1);
    }    
    /* Request that remote peer authenticate tself */
    req_flags = GSS_C_MUTUAL_FLAG;   
    
    if(ssc-> delegate_credentials) req_flags |= GSS_C_DELEG_FLAG;    
    snprintf(service, sizeof(service), "host@%s", ssc->host);

    /* initialize the security context */
    /* credential has to be fill in beforehand */
    major_status = globus_gss_assist_init_sec_context(&minor_status, credential,&ssc->gss_context,
            (strlen(ssc-> server_contact)== 0) ? service : ssc-> server_contact,
             req_flags, &ret_flags, &token_status, ss_get_token,
             (void *) &ssc->sck, ss_send_token, (void *) &ssc->sck);
    
    gss_release_cred(&minor_status, &credential);

    if(GSS_ERROR(major_status) !=0 ) {
        errno = SSKEYSTORE_NOSECURECONTEXT;
        return (-1);     
    }
    else {      
        major_status = gss_inquire_context(&minor_status,ssc->gss_context,NULL,&targ_name, NULL,
                                         NULL, NULL, NULL, NULL);
     
        status = (major_status == GSS_S_COMPLETE);      
        major_status = gss_display_name(&minor_status, targ_name, &name_buffer, NULL);
        gss_release_name(&minor_status, &targ_name);
    }
    
    if (status == 0 && ssc->gss_context != GSS_C_NO_CONTEXT) {    
        gss_delete_sec_context(&minor_status, &ssc->gss_context, GSS_C_NO_BUFFER);
        errno = SSKEYSTORE_FAILEDINQUIRECONTEXT;
        return (-1);
   }
    return 0;
}

/******************************************************************************
 * Open connection.
 * 
 ******************************************************************************/
static int socket_open(struct ss_socket_client *ssc){
  
  if((ssc->sck = socket(AF_INET, SOCK_STREAM, 0)) == -1 ) {     
        return (-1);
  }
  else {
    int value = 1;
    if (setsockopt(ssc->sck, SOL_SOCKET, SO_REUSEADDR, (void *) &value, sizeof(int)) < 0){      
        return (-1);
    }       
    if(connect(ssc->sck, (struct sockaddr*)&ssc->peeraddr_in,sizeof(struct sockaddr_in)) == -1) {       
        return (-1);
    }
  }  
  return 0;
}

/******************************************************************************
 * Close the connection.
 * 
 ******************************************************************************/
static int socket_close(struct ss_socket_client *ssc){  
        //errno already set
        return (close(ssc->sck));
}

/******************************************************************************
 * Remove authentication and close the connection.
 * 
 ******************************************************************************/
static int ss_close(struct ss_socket_client *ssc)
{
  OM_uint32 minor_status = 0;
  int return_status = 0;
  int errno_save = 0;
  
  if (ssc-> gss_context != GSS_C_NO_CONTEXT) {
     gss_delete_sec_context(&minor_status, &ssc-> gss_context, GSS_C_NO_BUFFER);
     if (minor_status == GSS_S_FAILURE ){
        errno_save = SSKEYSTORE_FAILEDDELETECONTEXT;
        return_status = -1;             
     }else{
        ssc-> gss_context= GSS_C_NO_CONTEXT;
     }
  } 
  socket_close(ssc);
  if (ssc->server_contact != NULL){
        free(ssc->server_contact);
  }
  if (ssc-> host != NULL){
        free(ssc-> host);
  }
  free(ssc);
  errno = errno_save;
  return return_status;
}


/******************************************************************************
 * Open connection and make GSI authentication.
 * 
 ******************************************************************************/
static int ss_open(char *host, int port, char *dn, struct ss_socket_client **client){
  
        struct ss_socket_client *ss_client; 
 
        //Create a new client
        ss_client = malloc(sizeof(struct ss_socket_client));    
        struct hostent *hp; 
        
        if ( ss_client == NULL) {
                errno = ENOMEM;
                return (-1);
        }       
        ss_client -> gss_context = GSS_C_NO_CONTEXT;
        memset ((char *) &ss_client->peeraddr_in, 0, sizeof(struct sockaddr_in));       
    
        if((hp = gethostbyname(host)) == NULL) {
                free(ss_client);
                switch (h_errno){
                        case HOST_NOT_FOUND :
                                errno = SSKEYSTORE_HOSTNOTFOUND;
                                break;
                        case NO_ADDRESS :
                                errno = SSKEYSTORE_NODATAORADDR;
                                break;  
                        case NO_RECOVERY :
                                errno = SSKEYSTORE_NORECOVERY;
                                break;  
                        case TRY_AGAIN :
                                errno = SSKEYSTORE_TRY_AGAIN;
                                break;
                        default :
                                break;
                }
                return (-1);
        }
        else {      
              ss_client->peeraddr_in.sin_family = AF_INET;
              ss_client->peeraddr_in.sin_addr.s_addr = ((struct in_addr *)(hp->h_addr))->s_addr;
              ss_client->peeraddr_in.sin_port = htons(port);          
        }
                
        ss_client -> host = (char*) strdup(host);
        ss_client -> port = port;
        ss_client -> delegate_credentials = 1;          
        //Set DN
        ss_client-> server_contact = (char*) strdup(dn);
        
        //Open connection on socket
        int op;
        if ((op = socket_open(ss_client)) != 0){
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        //Authentication GSI
        int aut;
        if ((aut = init_gsi_authentication(ss_client)) != 0){                   
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }       
        *client = ss_client;
        return 0;
}

/******************************************************************************
 * Send a string value.
 * 
 ******************************************************************************/
static int ss_send_string(struct ss_socket_client* ssc, const char* s){ 
  
  gss_buffer_desc  input_token;
  gss_buffer_desc  output_token;
  OM_uint32        maj_stat, min_stat;
  input_token.value = (void*)s;
  input_token.length = (strlen(s) + 1);

  if(ssc -> gss_context != GSS_C_NO_CONTEXT) {//dovrebbe essere piu corretto GSS_C_NO_CONTEXT rispetto a GSS_C_NO_CREDENTIAL   
    /* set this flag to 0 if you want to encrypt messages. set it to nonzero
       if only integrity protection is requested */     
    int conf_req_flag = 0;     
    maj_stat = gss_wrap (&min_stat,ssc -> gss_context,conf_req_flag, GSS_C_QOP_DEFAULT,
                         &input_token, NULL, &output_token);
     
    if (GSS_ERROR(maj_stat) != 0){
        switch (maj_stat){
                case GSS_S_CONTEXT_EXPIRED :
                        errno = SSKEYSTORE_CONTEXTEXPIRED;
                        break;
                case GSS_S_NO_CONTEXT :
                        errno = SSKEYSTORE_NOSECURECONTEXT;
                        break;  
                case GSS_S_BAD_QOP :
                        errno = SSKEYSTORE_BADQOP;
                        break;  
                case GSS_S_FAILURE :
                        errno = SSKEYSTORE_FAILEDWRAPMSG;
                        break;
                default :
                        break;
        }       
        return (-1);
    }
    int result;
    if ((result = ss_send_token((void*) &ssc->sck, output_token.value, output_token.length)) != 0){             
        return (-1);
    }
     
    gss_release_buffer(&min_stat, &output_token);
  }else{
        errno = SSKEYSTORE_NOSECURECONTEXT;
        return (-1);    
  }     
  return 0;
}

/******************************************************************************
 * Send an int value.
 * 
 ******************************************************************************/
static int ss_send_int(struct ss_socket_client* ssc, int i){    
  
  unsigned char int_buffer[4];
  gss_buffer_desc  input_token;
  gss_buffer_desc  output_token;
  OM_uint32        maj_stat, min_stat;
  input_token.value = (void*)int_buffer;
  input_token.length = 4;  

  if(ssc -> gss_context != GSS_C_NO_CONTEXT) {        
    int_buffer[0] = (unsigned char) ((i >> 24) & 0xff);
    int_buffer[1] = (unsigned char) ((i >> 16) & 0xff);
    int_buffer[2] = (unsigned char) ((i >>  8) & 0xff);
    int_buffer[3] = (unsigned char) ((i      ) & 0xff);
    
    /* set this flag to 0 if you want to encrypt messages. set it to nonzero
       if only integrity protection is requested */
    int conf_req_flag = 0;

    maj_stat = gss_wrap (&min_stat,ssc->gss_context,conf_req_flag,GSS_C_QOP_DEFAULT,&input_token,
        NULL,&output_token);
        
    if (GSS_ERROR(maj_stat) != 0){
        switch (maj_stat){
                case GSS_S_CONTEXT_EXPIRED :
                        errno = SSKEYSTORE_CONTEXTEXPIRED;
                        break;
                case GSS_S_NO_CONTEXT :
                        errno = SSKEYSTORE_NOSECURECONTEXT;
                        break;  
                case GSS_S_BAD_QOP :
                        errno = SSKEYSTORE_BADQOP;
                        break;  
                case GSS_S_FAILURE :
                        errno = SSKEYSTORE_FAILEDWRAPMSG;
                        break;
                default :
                        break;
        }       
        return (-1);
    }
    int result;
    if ((result = ss_send_token((void*) &ssc->sck, output_token.value, output_token.length)) != 0){             
        return (-1);
    }
    
    gss_release_buffer(&min_stat, &output_token);
  }else{
        errno = SSKEYSTORE_NOSECURECONTEXT;
        return (-1);
  } 
  return 0;
}

/******************************************************************************
 * Receive a string value.
 * 
 ******************************************************************************/
static int ss_receive_string(struct ss_socket_client* ssc,unsigned char* s){    
  OM_uint32 maj_stat, min_stat;
  gss_buffer_desc input_token;
  gss_buffer_desc output_token;
  int result;
  
  if(ssc->gss_context != GSS_C_NO_CONTEXT){
        if ((result = ss_get_token(&ssc->sck, &input_token.value, &input_token.length)) != 0){          
                return (-1);
        }         
        maj_stat = gss_unwrap (&min_stat,ssc->gss_context, &input_token,&output_token, NULL, NULL);
        if (GSS_ERROR(maj_stat) != 0) { 
                switch (maj_stat){
                        case GSS_S_DEFECTIVE_TOKEN :
                                errno = SSKEYSTORE_DEFECTIVETOKEN;
                                break;
                        case GSS_S_BAD_SIG :
                                errno = SSKEYSTORE_BADSIG;
                                break;
                        case GSS_S_DUPLICATE_TOKEN :
                                errno = SSKEYSTORE_DUPLICATETOKEN;
                                break;
                        case GSS_S_UNSEQ_TOKEN :
                                errno = SSKEYSTORE_UNSEQTOKEN;
                                break;
                        case GSS_S_GAP_TOKEN :
                                errno = SSKEYSTORE_GAPTOKEN;
                                break;  
                        case GSS_S_CONTEXT_EXPIRED :
                                errno = SSKEYSTORE_CONTEXTEXPIRED;
                                break;
                        case GSS_S_NO_CONTEXT :
                                errno = SSKEYSTORE_NOSECURECONTEXT;
                                break;                          
                        case GSS_S_FAILURE :
                                errno = SSKEYSTORE_FAILEDUNWRAPMSG;
                                break;
                        default :
                                break;
                }
                return (-1);
        }       
        memcpy(s,output_token.value,output_token.length);  
        gss_release_buffer(&min_stat, &output_token);
        gss_release_buffer(&min_stat, &input_token);
  }else{
        errno = SSKEYSTORE_NOSECURECONTEXT;
        return (-1);    
  }
  return 0;
}

/******************************************************************************
 * Receive an int value.
 * 
 ******************************************************************************/
static int ss_receive_int(struct ss_socket_client* ssc,int* i){ 
  unsigned char int_buffer[4];
  OM_uint32 maj_stat, min_stat;
  gss_buffer_desc input_token;
  gss_buffer_desc output_token;

  input_token.value = NULL;

  if(ssc->gss_context != GSS_C_NO_CONTEXT){
        if (ss_get_token(&ssc->sck, &input_token.value, &input_token.length) != 0){             
                return (-1);
        }       
        maj_stat = gss_unwrap (&min_stat,ssc->gss_context,&input_token, &output_token, NULL, NULL);
        if (GSS_ERROR(maj_stat) != 0) { 
                switch (maj_stat){
                        case GSS_S_DEFECTIVE_TOKEN :
                                errno = SSKEYSTORE_DEFECTIVETOKEN;
                                break;
                        case GSS_S_BAD_SIG :
                                errno = SSKEYSTORE_BADSIG;
                                break;
                        case GSS_S_DUPLICATE_TOKEN :
                                errno = SSKEYSTORE_DUPLICATETOKEN;
                                break;
                        case GSS_S_UNSEQ_TOKEN :
                                errno = SSKEYSTORE_UNSEQTOKEN;
                                break;
                        case GSS_S_GAP_TOKEN :
                                errno = SSKEYSTORE_GAPTOKEN;
                                break;  
                        case GSS_S_CONTEXT_EXPIRED :
                                errno = SSKEYSTORE_CONTEXTEXPIRED;
                                break;
                        case GSS_S_NO_CONTEXT :
                                errno = SSKEYSTORE_NOSECURECONTEXT;
                                break;                          
                        case GSS_S_FAILURE :
                                errno = SSKEYSTORE_FAILEDUNWRAPMSG;
                                break;
                        default :
                                break;
                }
                return (-1);
        }       
        memcpy((char*)int_buffer, output_token.value, output_token.length);     
        *i  = (((unsigned int) int_buffer[0]) << 24) & 0xffff;
        *i |= (((unsigned int) int_buffer[1]) << 16) & 0xffff;
        *i |= (((unsigned int) int_buffer[2]) <<  8) & 0xffff;
        *i |= (((unsigned int) int_buffer[3])      ) & 0xffff;
         
        gss_release_buffer(&min_stat, &output_token);
        gss_release_buffer(&min_stat, &input_token);
  }else{
        errno = SSKEYSTORE_NOSECURECONTEXT;
        return (-1);
  }
  return 0;
}

/******************************************************************************
 * Send KEY and IV to keystore.
 * 
 ******************************************************************************/
int ss_send_key ( const char *lfn, const unsigned char *key, const unsigned char *iv ) {
        
        int x;
        struct ss_socket_client *ss_client;     
        char *dn, *host;
        int port;
        if (get_keystore_env(&host, &port, &dn) != 0 ) {
                return (-1);
        }
        if (ss_open(host,port,dn,&ss_client) != 0){
                return (-1);
        }
        // Send KEY and IV to keystore
        // Build value to send to Keystore
        int param1_len = strlen(lfn);
        int param2_len = strlen(key);
        int param3_len = strlen(iv);
        int pack_length = ( sizeof(param_len) * 3 ) + sizeof(param_len) + param1_len + sizeof(param_len) + param2_len + sizeof(param_len) + param3_len;
        int numparam = 3;
        if (ss_send_int(ss_client,pack_length) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        if (ss_send_int(ss_client,SEND) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        if (ss_send_int(ss_client,numparam) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        const unsigned char* param_array[numparam];
        param_array[0] = lfn;
        param_array[1] = key;
        param_array[2] = iv;
        
        for ( x=0; x < numparam ; x++ ) {
                int length = strlen(param_array[x]);
                if (ss_send_int(ss_client,length) != 0) {
                        int errno_save = errno;
                        ss_close(ss_client);
                        errno = errno_save;
                        return (-1);
                }
                if (ss_send_string(ss_client,param_array[x]) != 0) {
                        int errno_save = errno;
                        ss_close(ss_client);
                        errno = errno_save;
                        return (-1);
                }
        }       
        // Receive ack or error from Keystore
        int receive_length = 0;
        if(ss_receive_int(ss_client,&receive_length) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        int iterate = (receive_length / sizeof(int)) -1;
        int response[iterate];
        for (x=0; x < iterate; x++) {           
                if(ss_receive_int(ss_client,&response[x]) != 0) {
                        int errno_save = errno;
                        ss_close(ss_client);
                        errno = errno_save;
                        return (-1);
                }
        }
        ss_close(ss_client);    
        if (response[0] != 0){
                errno = (response[0]+10000);
                return (-1);
        }
        return 0;
}

/******************************************************************************
 * Get KEY and IV from keystore.
 * 
 ******************************************************************************/
int ss_get_key  ( const char *lfn, unsigned char *key, unsigned char *iv ) {
                
        struct ss_socket_client *ss_client;     
        char *dn, *host;
        int port;
        
        if (get_keystore_env(&host, &port, &dn) != 0 ) {
                return (-1);
        }
        if (ss_open(host,port,dn,&ss_client) != 0){
                return (-1);
        }
        // Build value to send to Keystore
        int param1_len = strlen(lfn);
        int pack_length = ( sizeof(param_len) * 3 ) + sizeof(param_len) + param1_len;
        int numparam = 1;
        const unsigned char* param_array[numparam];
        int x;
        
        if (ss_send_int(ss_client,pack_length) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        if (ss_send_int(ss_client,GET) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        if (ss_send_int(ss_client,numparam) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        param_array[0]=lfn;
        for ( x=0; x < numparam ; x++ ) {
                int length = strlen(param_array[x]);
                if (ss_send_int(ss_client,length) != 0) {
                        int errno_save = errno;
                        ss_close(ss_client);
                        errno = errno_save;
                        return (-1);
                }
                if (ss_send_string(ss_client,param_array[x]) != 0) {
                        int errno_save = errno;
                        ss_close(ss_client);
                        errno = errno_save;
                        return (-1);
                }
        }
        // Read ack or error
        int receive_length = 0;
        if(ss_receive_int(ss_client,&receive_length) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        int response=0;
        if(ss_receive_int(ss_client,&response) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }       
        if ( response != 0 ) { // Return Keystore error
                ss_close(ss_client);
                errno = (response + 10000);
                return (-1);
        }
        
        int numparam_resp;
        if(ss_receive_int(ss_client,&numparam_resp) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        int key_len=0;
        if(ss_receive_int(ss_client,&key_len) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        if(ss_receive_string(ss_client,key) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        int iv_len=0;
        if(ss_receive_int(ss_client,&iv_len) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }       
        if(ss_receive_string(ss_client,iv) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        ss_close(ss_client);    
        return 0;
}


/******************************************************************************
 * Delete KEY and IV from keystore.
 * 
 ******************************************************************************/
int ss_delete_key ( const char *lfn ) {
        
        struct ss_socket_client *ss_client;     
        char *dn, *host;
        int port;

        if (get_keystore_env(&host, &port, &dn) != 0 ) {
                return (-1);
        }
        if (ss_open(host,port,dn,&ss_client) != 0){
                return (-1);
        }
        // Build value to send to Keystore
        int param1_len = strlen(lfn);
        int pack_length = ( sizeof(param_len) * 3 ) + sizeof(param_len) + param1_len;
        int numparam = 1;
        const unsigned char* param_array[numparam];
        int x;
        
        // Send LFN to keystore
        if (ss_send_int(ss_client,pack_length) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        if (ss_send_int(ss_client,DEL) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        if (ss_send_int(ss_client,numparam) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        param_array[0]=lfn;
        for ( x=0; x < numparam ; x++ ) {
                int length = strlen(param_array[x]);
                if (ss_send_int(ss_client,length) != 0) {
                        int errno_save = errno;
                        ss_close(ss_client);
                        errno = errno_save;
                        return (-1);
                }
                if (ss_send_string(ss_client,param_array[x]) != 0) {
                        int errno_save = errno;
                        ss_close(ss_client);
                        errno = errno_save;
                        return (-1);
                }
        }       
        // Receive ack or error from Keystore
        int receive_length = 0;
        if(ss_receive_int(ss_client,&receive_length) != 0) {
                int errno_save = errno;
                ss_close(ss_client);
                errno = errno_save;
                return (-1);
        }
        int iterate = (receive_length / sizeof(int)) -1;
        int response[iterate];
        for (x=0; x < iterate; x++) {           
                if(ss_receive_int(ss_client,&response[x]) != 0) {
                        int errno_save = errno;
                        ss_close(ss_client);
                        errno = errno_save;
                        return (-1);
                }
        }       
        ss_close(ss_client);    
        if (response[0] != 0){
                errno = (response[0]+10000);
                return (-1);
        }
        return 0;
}

---