inetutils/libtelnet/encrypt.c

/*
  Copyright (C) 1993-2025 Free Software Foundation, Inc.

  This file is part of GNU Inetutils.

  GNU Inetutils is free software: you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation, either version 3 of the License, or (at
  your option) any later version.

  GNU Inetutils is distributed in the hope that it will be useful, but
  WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  General Public License for more details.

  You should have received a copy of the GNU General Public License
  along with this program.  If not, see `http://www.gnu.org/licenses/'. */

/*
 * Copyright (c) 1991, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * Copyright (C) 1990 by the Massachusetts Institute of Technology
 *
 * Export of this software from the United States of America is assumed
 * to require a specific license from the United States Government.
 * It is the responsibility of any person or organization contemplating
 * export to obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of M.I.T. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 */

#include <config.h>

#ifdef	ENCRYPTION

# undef ENCRYPT_NAMES		/* Ignore enctype_names[].  */
# include <arpa/telnet.h>

# include "encrypt.h"
# include "misc.h"

# include <stdlib.h>
# include <string.h>

# include <stdio.h>
# include <attribute.h>
# include "genget.h"

/* String representation of our capabilities.
 * Solaris will gain DES_OFB64!
 */
# ifdef HAVE_CONST_CHAR_ENCTYPE_NAMES
const char *enctype_names[] =
# else
char *enctype_names[] =
# endif
{
  "ANY", "DES_CFB64", "DES_OFB64", 0,
};

/* Callback from consumer.  */
extern void printsub (char, unsigned char *, int);

/*
 * These functions pointers point to the current routines
 * for encrypting and decrypting data.
 */
void (*encrypt_output) (unsigned char *, int);
int (*decrypt_input) (int);

int encrypt_debug_mode = 0;
static int decrypt_mode = 0;
static int encrypt_mode = 0;
static int encrypt_verbose = 0;
static int autoencrypt = 0;
static int autodecrypt = 0;
static int havesessionkey = 0;
static int Server = 0;
static char *Name = "Noname";

# define typemask(x)	((x) > 0 ? 1 << ((x)-1) : 0)

/* Only the type ENCTYPE_DES_CFB64 seems universal.  */
# ifdef ENCTYPE_DES_OFB64
static long i_support_encrypt =
typemask (ENCTYPE_DES_CFB64) | typemask (ENCTYPE_DES_OFB64);
     static long
       i_support_decrypt =
       typemask (ENCTYPE_DES_CFB64) | typemask (ENCTYPE_DES_OFB64);
# else/* !ENCTYPE_DES_OFB64 */
static long i_support_encrypt = typemask (ENCTYPE_DES_CFB64);
static long i_support_decrypt = typemask (ENCTYPE_DES_CFB64);
# endif/* !ENCTYPE_DES_OFB64 */

static long i_wont_support_encrypt = 0;
static long i_wont_support_decrypt = 0;
# define I_SUPPORT_ENCRYPT	(i_support_encrypt & ~i_wont_support_encrypt)
# define I_SUPPORT_DECRYPT	(i_support_decrypt & ~i_wont_support_decrypt)

static long remote_supports_encrypt = 0;
static long remote_supports_decrypt = 0;

static Encryptions encryptions[] = {
# if defined DES_ENCRYPTION || defined SHISHI
  {"DES_CFB64", ENCTYPE_DES_CFB64,
   cfb64_encrypt,
   cfb64_decrypt,
   cfb64_init,
   cfb64_start,
   cfb64_is,
   cfb64_reply,
   cfb64_session,
   cfb64_keyid,
   cfb64_printsub},
#  ifdef ENCTYPE_DES_OFB64
  {"DES_OFB64", ENCTYPE_DES_OFB64,
   ofb64_encrypt,
   ofb64_decrypt,
   ofb64_init,
   ofb64_start,
   ofb64_is,
   ofb64_reply,
   ofb64_session,
   ofb64_keyid,
   ofb64_printsub},
#  endif
  /* ENCTYPE_DES_OFB64 */
# endif/* DES_ENCRYPTION */
  {0,},
};

static unsigned char str_send[64] =
  { IAC, SB, TELOPT_ENCRYPT, ENCRYPT_SUPPORT };
static unsigned char str_suplen = 0;
static unsigned char str_start[72] = { IAC, SB, TELOPT_ENCRYPT };
static unsigned char str_end[] = { IAC, SB, TELOPT_ENCRYPT, 0, IAC, SE };

Encryptions *
findencryption (int type)
{
  Encryptions *ep = encryptions;

  if (!(I_SUPPORT_ENCRYPT & remote_supports_decrypt & typemask (type)))
    return (0);
  while (ep->type && ep->type != type)
    ++ep;
  return (ep->type ? ep : 0);
}

Encryptions *
finddecryption (int type)
{
  Encryptions *ep = encryptions;

  if (!(I_SUPPORT_DECRYPT & remote_supports_encrypt & typemask (type)))
    return (0);
  while (ep->type && ep->type != type)
    ++ep;
  return (ep->type ? ep : 0);
}

# define MAXKEYLEN 64

static struct key_info
{
  unsigned char keyid[MAXKEYLEN];
  int keylen;
  int dir;
  int *modep;
  Encryptions *(*getcrypt) (int);
} ki[2] = {
  {{0}, 0, DIR_ENCRYPT, &encrypt_mode, findencryption},
  {{0}, 0, DIR_DECRYPT, &decrypt_mode, finddecryption},
};

void
encrypt_init (char *name, int server)
{
  Encryptions *ep = encryptions;

  Name = name;
  Server = server;
  i_support_encrypt = i_support_decrypt = 0;
  remote_supports_encrypt = remote_supports_decrypt = 0;
  encrypt_mode = 0;
  decrypt_mode = 0;
  encrypt_output = 0;
  decrypt_input = 0;
  str_suplen = 4;

  while (ep->type)
    {
      if (encrypt_debug_mode)
	printf (">>>%s: I will support %s\r\n",
		Name, ENCTYPE_NAME (ep->type));
      i_support_encrypt |= typemask (ep->type);
      i_support_decrypt |= typemask (ep->type);
      if ((i_wont_support_decrypt & typemask (ep->type)) == 0)
	if ((str_send[str_suplen++] = ep->type) == IAC)
	  str_send[str_suplen++] = IAC;
      if (ep->init)
	(*ep->init) (Server);
      ++ep;
    }
  str_send[str_suplen++] = IAC;
  str_send[str_suplen++] = SE;
}

void
encrypt_list_types (void)
{
  Encryptions *ep = encryptions;

  printf ("Valid encryption types:\n");
  while (ep->type)
    {
      printf ("\t%s (%d)\r\n", ENCTYPE_NAME (ep->type), ep->type);
      ++ep;
    }
}

int
EncryptEnable (char *type, char *mode)
{
  if (isprefix (type, "help") || isprefix (type, "?"))
    {
      printf ("Usage: encrypt enable <type> [input|output]\n");
      encrypt_list_types ();
      return (0);
    }
  if (EncryptType (type, mode))
    return (EncryptStart (mode));
  return (0);
}

int
EncryptDisable (char *type, char *mode)
{
  Encryptions *ep;
  int ret = 0;

  if (isprefix (type, "help") || isprefix (type, "?"))
    {
      printf ("Usage: encrypt disable <type> [input|output]\n");
      encrypt_list_types ();
    }
  else if ((ep = (Encryptions *) genget (type, (char **) encryptions,
					 sizeof (Encryptions))) == 0)
    printf ("%s: invalid encryption type\n", type);
  else if (Ambiguous ((char *) ep))
    printf ("Ambiguous type '%s'\n", type);
  else
    {
      if ((mode == 0) || (isprefix (mode, "input") ? 1 : 0))
	{
	  if (decrypt_mode == ep->type)
	    EncryptStopInput ();
	  i_wont_support_decrypt |= typemask (ep->type);
	  ret = 1;
	}
      if ((mode == 0) || (isprefix (mode, "output")))
	{
	  if (encrypt_mode == ep->type)
	    EncryptStopOutput ();
	  i_wont_support_encrypt |= typemask (ep->type);
	  ret = 1;
	}
      if (ret == 0)
	printf ("%s: invalid encryption mode\n", mode);
    }
  return (ret);
}

int
EncryptType (char *type, char *mode)
{
  Encryptions *ep;
  int ret = 0;

  if (isprefix (type, "help") || isprefix (type, "?"))
    {
      printf ("Usage: encrypt type <type> [input|output]\n");
      encrypt_list_types ();
    }
  else if ((ep = (Encryptions *) genget (type, (char **) encryptions,
					 sizeof (Encryptions))) == 0)
    printf ("%s: invalid encryption type\n", type);
  else if (Ambiguous ((char *) ep))
    printf ("Ambiguous type '%s'\n", type);
  else
    {
      if ((mode == 0) || isprefix (mode, "input"))
	{
	  decrypt_mode = ep->type;
	  i_wont_support_decrypt &= ~typemask (ep->type);
	  ret = 1;
	}
      if ((mode == 0) || isprefix (mode, "output"))
	{
	  encrypt_mode = ep->type;
	  i_wont_support_encrypt &= ~typemask (ep->type);
	  ret = 1;
	}
      if (ret == 0)
	printf ("%s: invalid encryption mode\n", mode);
    }
  return (ret);
}

int
EncryptStart (char *mode)
{
  int ret = 0;
  if (mode)
    {
      if (isprefix (mode, "input"))
	return (EncryptStartInput ());
      if (isprefix (mode, "output"))
	return (EncryptStartOutput ());
      if (isprefix (mode, "help") || isprefix (mode, "?"))
	{
	  printf ("Usage: encrypt start [input|output]\n");
	  return (0);
	}
      printf ("%s: invalid encryption mode 'encrypt start ?' for help\n",
	      mode);
      return (0);
    }
  ret += EncryptStartInput ();
  ret += EncryptStartOutput ();
  return (ret);
}

int
EncryptStartInput (void)
{
  if (decrypt_mode)
    {
      encrypt_send_request_start ();
      return (1);
    }
  printf ("No previous decryption mode, decryption not enabled\r\n");
  return (0);
}

int
EncryptStartOutput (void)
{
  if (encrypt_mode)
    {
      encrypt_start_output (encrypt_mode);
      return (1);
    }
  printf ("No previous encryption mode, encryption not enabled\r\n");
  return (0);
}

int
EncryptStop (char *mode)
{
  int ret = 0;
  if (mode)
    {
      if (isprefix (mode, "input"))
	return (EncryptStopInput ());
      if (isprefix (mode, "output"))
	return (EncryptStopOutput ());
      if (isprefix (mode, "help") || isprefix (mode, "?"))
	{
	  printf ("Usage: encrypt stop [input|output]\n");
	  return (0);
	}
      printf ("%s: invalid encryption mode 'encrypt stop ?' for help\n",
	      mode);
      return (0);
    }
  ret += EncryptStopInput ();
  ret += EncryptStopOutput ();
  return (ret);
}

int
EncryptStopInput (void)
{
  encrypt_send_request_end ();
  return (1);
}

int
EncryptStopOutput (void)
{
  encrypt_send_end ();
  return (1);
}

void
encrypt_display (void)
{
  if (encrypt_output)
    printf ("Currently encrypting output with %s\r\n",
	    ENCTYPE_NAME (encrypt_mode));
  if (decrypt_input)
    printf ("Currently decrypting input with %s\r\n",
	    ENCTYPE_NAME (decrypt_mode));
}

int
EncryptStatus (void)
{
  if (encrypt_output)
    printf ("Currently encrypting output with %s\r\n",
	    ENCTYPE_NAME (encrypt_mode));
  else if (encrypt_mode)
    {
      printf ("Currently output is clear text.\r\n");
      printf ("Last encryption mode was %s\r\n", ENCTYPE_NAME (encrypt_mode));
    }
  if (decrypt_input)
    printf ("Currently decrypting input with %s\r\n",
	    ENCTYPE_NAME (decrypt_mode));
  else if (decrypt_mode)
    {
      printf ("Currently input is clear text.\r\n");
      printf ("Last decryption mode was %s\r\n", ENCTYPE_NAME (decrypt_mode));
    }
  return 1;
}

void
encrypt_send_support (void)
{
  if (str_suplen)
    {
      /*
       * If the user has requested that decryption start
       * immediately, then send a "REQUEST START" before
       * we negotiate the type.
       */
      if (!Server && autodecrypt)
	encrypt_send_request_start ();
      net_write (str_send, str_suplen);
      printsub ('>', &str_send[2], str_suplen - 2);
      str_suplen = 0;
    }
}

int
EncryptDebug (int on)
{
  if (on < 0)
    encrypt_debug_mode ^= 1;
  else
    encrypt_debug_mode = on;
  printf ("Encryption debugging %s\r\n",
	  encrypt_debug_mode ? "enabled" : "disabled");
  return (1);
}

int
EncryptVerbose (int on)
{
  if (on < 0)
    encrypt_verbose ^= 1;
  else
    encrypt_verbose = on;
  printf ("Encryption %s verbose\r\n", encrypt_verbose ? "is" : "is not");
  return (1);
}

int
EncryptAutoEnc (int on)
{
  encrypt_auto (on);
  printf ("Automatic encryption of output is %s\r\n",
	  autoencrypt ? "enabled" : "disabled");
  return (1);
}

int
EncryptAutoDec (int on)
{
  decrypt_auto (on);
  printf ("Automatic decryption of input is %s\r\n",
	  autodecrypt ? "enabled" : "disabled");
  return (1);
}

/*
 * Called when ENCRYPT SUPPORT is received.
 */
void
encrypt_support (unsigned char *typelist, int cnt)
{
  int type, use_type = 0;
  Encryptions *ep;

  /*
   * Forget anything the other side has previously told us.
   */
  remote_supports_decrypt = 0;

  while (cnt-- > 0)
    {
      type = *typelist++;
      if (encrypt_debug_mode)
	printf (">>>%s: He is supporting %s (%d)\r\n",
		Name, ENCTYPE_NAME (type), type);
      if ((type < ENCTYPE_CNT) && (I_SUPPORT_ENCRYPT & typemask (type)))
	{
	  remote_supports_decrypt |= typemask (type);
	  if (use_type == 0)
	    use_type = type;
	}
    }
  if (use_type)
    {
      ep = findencryption (use_type);
      if (!ep)
	return;
      type = ep->start ? (*ep->start) (DIR_ENCRYPT, Server) : 0;
      if (encrypt_debug_mode)
	printf (">>>%s: (*ep->start)() returned %d\r\n", Name, type);
      if (type < 0)
	return;
      encrypt_mode = use_type;
      if (type == 0)
	encrypt_start_output (use_type);
    }
}

void
encrypt_is (unsigned char *data, int cnt)
{
  Encryptions *ep;
  int type, ret;

  if (--cnt < 0)
    return;
  type = *data++;
  if (type < ENCTYPE_CNT)
    remote_supports_encrypt |= typemask (type);

  ep = finddecryption (type);
  if (!ep)
    {
      if (encrypt_debug_mode)
	printf (">>>%s: Can't find type %s (%d) for initial negotiation\r\n",
		Name,
		ENCTYPE_NAME_OK (type) && ENCTYPE_NAME (type)
		? ENCTYPE_NAME (type) : "(unknown)", type);
      return;
    }
  if (!ep->is)
    {
      if (encrypt_debug_mode)
	printf (">>>%s: No initial negotiation needed for type %s (%d)\r\n",
		Name,
		ENCTYPE_NAME_OK (type) && ENCTYPE_NAME (type)
		? ENCTYPE_NAME (type) : "(unknown)", type);
      ret = 0;
    }
  else
    {
      ret = (*ep->is) (data, cnt);
      if (encrypt_debug_mode)
	printf ("(*ep->is)(%p, %d) returned %s (%d).\r\n",
		data, cnt,
		(ret < 0) ? "FAIL "
		: ((ret == 0) ? "SUCCESS " : "MORE_TO_DO "), ret);
    }
  if (ret < 0)
    autodecrypt = 0;
  else
    {
      decrypt_mode = type;
      if (ret == 0 && autodecrypt)
	encrypt_send_request_start ();
    }
}

void
encrypt_reply (unsigned char *data, int cnt)
{
  Encryptions *ep;
  int ret, type;

  if (--cnt < 0)
    return;
  type = *data++;

  ep = findencryption (type);
  if (!ep)
    {
      if (encrypt_debug_mode)
	printf (">>>%s: Can't find type %s (%d) for initial negotiation\r\n",
		Name,
		ENCTYPE_NAME_OK (type) && ENCTYPE_NAME (type)
		? ENCTYPE_NAME (type) : "(unknown)", type);
      return;
    }
  if (!ep->reply)
    {
      if (encrypt_debug_mode)
	printf (">>>%s: No initial negotiation needed for type %s (%d)\r\n",
		Name,
		ENCTYPE_NAME_OK (type) && ENCTYPE_NAME (type)
		? ENCTYPE_NAME (type) : "(unknown)", type);
      ret = 0;
    }
  else
    {
      ret = (*ep->reply) (data, cnt);
      if (encrypt_debug_mode)
	printf ("(*ep->reply)(%p, %d) returned %s (%d).\r\n",
		data, cnt,
		(ret < 0) ? "FAIL "
		: ((ret == 0) ? "SUCCESS " : "MORE_TO_DO "), ret);
    }
  if (encrypt_debug_mode)
    printf (">>>%s: encrypt_reply returned %d\n", Name, ret);
  if (ret < 0)
    autoencrypt = 0;
  else
    {
      encrypt_mode = type;
      if (ret == 0 && autoencrypt)
	encrypt_start_output (type);
    }
}

/*
 * Called when a ENCRYPT START command is received.
 */
void
encrypt_start (unsigned char *data MAYBE_UNUSED, int cnt MAYBE_UNUSED)
{
  Encryptions *ep;

  if (!decrypt_mode)
    {
      /*
       * Something is wrong.  We should not get a START
       * command without having already picked our
       * decryption scheme.  Send a REQUEST-END to
       * attempt to clear the channel...
       */
      printf ("%s: Warning, Cannot decrypt input stream!!!\r\n", Name);
      encrypt_send_request_end ();
      return;
    }

  ep = finddecryption (decrypt_mode);
  if (ep)
    {
      decrypt_input = ep->input;
      if (encrypt_verbose)
	printf ("[ Input is now decrypted with type %s ]\r\n",
		ENCTYPE_NAME (decrypt_mode));
      if (encrypt_debug_mode)
	printf (">>>%s: Start to decrypt input with type %s\r\n",
		Name, ENCTYPE_NAME (decrypt_mode));
    }
  else
    {
      printf ("%s: Warning, Cannot decrypt type %s (%d)!!!\r\n",
	      Name,
	      ENCTYPE_NAME_OK (decrypt_mode) && ENCTYPE_NAME (decrypt_mode)
	      ? ENCTYPE_NAME (decrypt_mode) : "(unknown)", decrypt_mode);
      encrypt_send_request_end ();
    }
}

void
encrypt_session_key (Session_Key *key, int server)
{
  Encryptions *ep = encryptions;

  havesessionkey = 1;

  while (ep->type)
    {
      if (ep->session)
	(*ep->session) (key, server);
      ++ep;
    }
}

/*
 * Called when ENCRYPT END is received.
 */
void
encrypt_end (void)
{
  decrypt_input = 0;
  if (encrypt_debug_mode)
    printf (">>>%s: Input is back to clear text\r\n", Name);
  if (encrypt_verbose)
    printf ("[ Input is now clear text ]\r\n");
}

/*
 * Called when ENCRYPT REQUEST-END is received.
 */
void
encrypt_request_end (void)
{
  encrypt_send_end ();
}

/*
 * Called when ENCRYPT REQUEST-START is received.  If we receive
 * this before a type is picked, then that indicates that the
 * other side wants us to start encrypting data as soon as we
 * can.
 */
void
encrypt_request_start (unsigned char *data MAYBE_UNUSED, int cnt MAYBE_UNUSED)
{
  if (encrypt_mode == 0)
    {
      if (Server)
	autoencrypt = 1;
      return;
    }
  encrypt_start_output (encrypt_mode);
}

static unsigned char str_keyid[(MAXKEYLEN * 2) + 5] =
  { IAC, SB, TELOPT_ENCRYPT };

static void
encrypt_keyid (struct key_info *kp, unsigned char *keyid, int len)
{
  Encryptions *ep;
  int dir = kp->dir;
  int ret = 0;

  if (len > MAXKEYLEN)
    len = MAXKEYLEN;

  ep = (*kp->getcrypt) (*kp->modep);
  if (!ep)
    {
      if (len == 0)
	return;
      kp->keylen = 0;
    }
  else if (len == 0)
    {
      /*
       * Empty option, indicates a failure.
       */
      if (kp->keylen == 0)
	return;
      kp->keylen = 0;
      if (ep->keyid)
	(*ep->keyid) (dir, kp->keyid, &kp->keylen);

    }
  else if ((len != kp->keylen) || (memcmp (keyid, kp->keyid, len) != 0))
    {
      /*
       * Length or contents are different
       */
      kp->keylen = len;
      memmove (kp->keyid, keyid, len);
      if (ep->keyid)
	(*ep->keyid) (dir, kp->keyid, &kp->keylen);
    }
  else
    {
      if (ep->keyid)
	ret = (*ep->keyid) (dir, kp->keyid, &kp->keylen);
      if ((ret == 0) && (dir == DIR_ENCRYPT) && autoencrypt)
	encrypt_start_output (*kp->modep);
      return;
    }

  encrypt_send_keyid (dir, kp->keyid, kp->keylen, 0);
}

void
encrypt_enc_keyid (unsigned char *keyid, int len)
{
  encrypt_keyid (&ki[1], keyid, len);
}

void
encrypt_dec_keyid (unsigned char *keyid, int len)
{
  encrypt_keyid (&ki[0], keyid, len);
}

void
encrypt_send_keyid (int dir, unsigned char *keyid, int keylen, int saveit)
{
  unsigned char *strp;

  str_keyid[3] = (dir == DIR_ENCRYPT) ? ENCRYPT_ENC_KEYID : ENCRYPT_DEC_KEYID;
  if (saveit)
    {
      struct key_info *kp = &ki[(dir == DIR_ENCRYPT) ? 0 : 1];
      memmove (kp->keyid, keyid, keylen);
      kp->keylen = keylen;
    }

  for (strp = &str_keyid[4]; keylen > 0; --keylen)
    {
      if ((*strp++ = *keyid++) == IAC)
	*strp++ = IAC;
    }
  *strp++ = IAC;
  *strp++ = SE;
  net_write (str_keyid, strp - str_keyid);
  printsub ('>', &str_keyid[2], strp - str_keyid - 2);
}

void
encrypt_auto (int on)
{
  if (on < 0)
    autoencrypt ^= 1;
  else
    autoencrypt = on ? 1 : 0;
}

void
decrypt_auto (int on)
{
  if (on < 0)
    autodecrypt ^= 1;
  else
    autodecrypt = on ? 1 : 0;
}

void
encrypt_start_output (int type)
{
  Encryptions *ep;
  unsigned char *p;
  int i;

  ep = findencryption (type);
  if (!ep)
    {
      if (encrypt_debug_mode)
	{
	  printf (">>>%s: Can't encrypt with type %s (%d)\r\n",
		  Name,
		  ENCTYPE_NAME_OK (type) && ENCTYPE_NAME (type)
		  ? ENCTYPE_NAME (type) : "(unknown)", type);
	}
      return;
    }
  if (ep->start)
    {
      i = (*ep->start) (DIR_ENCRYPT, Server);
      if (encrypt_debug_mode)
	{
	  printf (">>>%s: Encrypt start: %s (%d) %s\r\n",
		  Name,
		  (i < 0) ? "failed" :
		  "initial negotiation in progress", i, ENCTYPE_NAME (type));
	}
      if (i)
	return;
    }
  p = str_start + 3;
  *p++ = ENCRYPT_START;
  for (i = 0; i < ki[0].keylen; ++i)
    {
      if ((*p++ = ki[0].keyid[i]) == IAC)
	*p++ = IAC;
    }
  *p++ = IAC;
  *p++ = SE;
  net_write (str_start, p - str_start);
  net_encrypt ();
  printsub ('>', &str_start[2], p - &str_start[2]);
  /*
   * If we are already encrypting in some mode, then
   * encrypt the ring (which includes our request) in
   * the old mode, mark it all as "clear text" and then
   * switch to the new mode.
   */
  encrypt_output = ep->output;
  encrypt_mode = type;
  if (encrypt_debug_mode)
    printf (">>>%s: Started to encrypt output with type %s\r\n",
	    Name, ENCTYPE_NAME (type));
  if (encrypt_verbose)
    printf ("[ Output is now encrypted with type %s ]\r\n",
	    ENCTYPE_NAME (type));
}

void
encrypt_send_end (void)
{
  if (!encrypt_output)
    return;

  str_end[3] = ENCRYPT_END;
  net_write (str_end, sizeof (str_end));
  net_encrypt ();
  printsub ('>', &str_end[2], sizeof (str_end) - 2);
  /*
   * Encrypt the output buffer now because it will not be done by
   * netflush...
   */
  encrypt_output = 0;
  if (encrypt_debug_mode)
    printf (">>>%s: Output is back to clear text\r\n", Name);
  if (encrypt_verbose)
    printf ("[ Output is now clear text ]\r\n");
}

void
encrypt_send_request_start (void)
{
  unsigned char *p;
  int i;

  p = &str_start[3];
  *p++ = ENCRYPT_REQSTART;
  for (i = 0; i < ki[1].keylen; ++i)
    {
      if ((*p++ = ki[1].keyid[i]) == IAC)
	*p++ = IAC;
    }
  *p++ = IAC;
  *p++ = SE;
  net_write (str_start, p - str_start);
  printsub ('>', &str_start[2], p - &str_start[2]);
  if (encrypt_debug_mode)
    printf (">>>%s: Request input to be encrypted\r\n", Name);
}

void
encrypt_send_request_end (void)
{
  str_end[3] = ENCRYPT_REQEND;
  net_write (str_end, sizeof (str_end));
  printsub ('>', &str_end[2], sizeof (str_end) - 2);

  if (encrypt_debug_mode)
    printf (">>>%s: Request input to be clear text\r\n", Name);
}

void
encrypt_wait (void)
{
  if (encrypt_debug_mode)
    printf (">>>%s: in encrypt_wait\r\n", Name);
  if (!havesessionkey || !(I_SUPPORT_ENCRYPT & remote_supports_decrypt))
    return;
  while (autoencrypt && !encrypt_output)
    if (telnet_spin ())
      return;
}

void
encrypt_debug (int mode)
{
  encrypt_debug_mode = mode;
}

static void
encrypt_gen_printsub (unsigned char *data, int cnt, char *buf, int buflen)
{
  char tbuf[16], *cp;

  cnt -= 2;
  data += 2;
  buf[buflen - 1] = '\0';
  buf[buflen - 2] = '*';
  buflen -= 2;
  for (; cnt > 0; cnt--, data++)
    {
      sprintf (tbuf, " %d", *data);
      for (cp = tbuf; *cp && buflen > 0; --buflen)
	*buf++ = *cp++;
      if (buflen <= 0)
	return;
    }
  *buf = '\0';
}

void
encrypt_printsub (unsigned char *data, int cnt, char *buf, int buflen)
{
  Encryptions *ep;
  int type = data[1];

  for (ep = encryptions; ep->type && ep->type != type; ep++)
    ;

  if (ep->printsub)
    (*ep->printsub) (data, cnt, buf, buflen);
  else
    encrypt_gen_printsub (data, cnt, buf, buflen);
}
#endif /* ENCRYPTION */