source/heimdal/lib/gssapi/decapsulate.c

   1 /*
   2  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "gssapi_locl.h"
  35
  36 RCSID("$Id: decapsulate.c,v 1.12 2005/06/16 20:40:49 lha Exp $");
  37
  38 /*
  39  * return the length of the mechanism in token or -1
  40  * (which implies that the token was bad - GSS_S_DEFECTIVE_TOKEN
  41  */
  42
  43 ssize_t
  44 gssapi_krb5_get_mech (const u_char *ptr,
  45                       size_t total_len,
  46                       const u_char **mech_ret)
  47 {
  48     size_t len, len_len, mech_len, foo;
  49     const u_char *p = ptr;
  50     int e;
  51
  52     if (total_len < 1)
  53         return -1;
  54     if (*p++ != 0x60)
  55         return -1;
  56     e = der_get_length (p, total_len - 1, &len, &len_len);
  57     if (e || 1 + len_len + len != total_len)
  58         return -1;
  59     p += len_len;
  60     if (*p++ != 0x06)
  61         return -1;
  62     e = der_get_length (p, total_len - 1 - len_len - 1,
  63                         &mech_len, &foo);
  64     if (e)
  65         return -1;
  66     p += foo;
  67     *mech_ret = p;
  68     return mech_len;
  69 }
  70
  71 OM_uint32
  72 _gssapi_verify_mech_header(u_char **str,
  73                            size_t total_len,
  74                            gss_OID mech)
  75 {
  76     const u_char *p;
  77     ssize_t mech_len;
  78
  79     mech_len = gssapi_krb5_get_mech (*str, total_len, &p);
  80     if (mech_len < 0)
  81         return GSS_S_DEFECTIVE_TOKEN;
  82
  83     if (mech_len != mech->length)
  84         return GSS_S_BAD_MECH;
  85     if (memcmp(p,
  86                mech->elements,
  87                mech->length) != 0)
  88         return GSS_S_BAD_MECH;
  89     p += mech_len;
  90     *str = rk_UNCONST(p);
  91     return GSS_S_COMPLETE;
  92 }
  93
  94 OM_uint32
  95 gssapi_krb5_verify_header(u_char **str,
  96                           size_t total_len,
  97                           const u_char *type,
  98                           gss_OID oid)
  99 {
 100     OM_uint32 ret;
 101     size_t len;
 102     u_char *p = *str;
 103
 104     ret = _gssapi_verify_mech_header(str, total_len, oid);
 105     if (ret)
 106         return ret;
 107
 108     len = total_len - (*str - p);
 109
 110     if (len < 2)
 111         return GSS_S_DEFECTIVE_TOKEN;
 112
 113     if ((*str)[0] != type[0] || (*str)[1] != type[1])
 114         return GSS_S_DEFECTIVE_TOKEN;
 115     *str += 2;
 116
 117     return 0;
 118 }
 119
 120 /*
 121  * Remove the GSS-API wrapping from `in_token' giving `out_data.
 122  * Does not copy data, so just free `in_token'.
 123  */
 124
 125 OM_uint32
 126 _gssapi_decapsulate(
 127     OM_uint32 *minor_status,
 128     gss_buffer_t input_token_buffer,
 129     krb5_data *out_data,
 130     const gss_OID mech
 131 )
 132 {
 133     u_char *p;
 134     OM_uint32 ret;
 135
 136     p = input_token_buffer->value;
 137     ret = _gssapi_verify_mech_header(&p,
 138                                     input_token_buffer->length,
 139                                     mech);
 140     if (ret) {
 141         *minor_status = 0;
 142         return ret;
 143     }
 144
 145     out_data->length = input_token_buffer->length -
 146         (p - (u_char *)input_token_buffer->value);
 147     out_data->data   = p;
 148     return GSS_S_COMPLETE;
 149 }
 150
 151 /*
 152  * Remove the GSS-API wrapping from `in_token' giving `out_data.
 153  * Does not copy data, so just free `in_token'.
 154  */
 155
 156 OM_uint32
 157 gssapi_krb5_decapsulate(OM_uint32 *minor_status,
 158                         gss_buffer_t input_token_buffer,
 159                         krb5_data *out_data,
 160                         const char *type,
 161                         gss_OID oid)
 162 {
 163     u_char *p;
 164     OM_uint32 ret;
 165
 166     p = input_token_buffer->value;
 167     ret = gssapi_krb5_verify_header(&p,
 168                                     input_token_buffer->length,
 169                                     type,
 170                                     oid);
 171     if (ret) {
 172         *minor_status = 0;
 173         return ret;
 174     }
 175
 176     out_data->length = input_token_buffer->length -
 177         (p - (u_char *)input_token_buffer->value);
 178     out_data->data   = p;
 179     return GSS_S_COMPLETE;
 180 }
 181
 182 /*
 183  * Verify padding of a gss wrapped message and return its length.
 184  */
 185
 186 OM_uint32
 187 _gssapi_verify_pad(gss_buffer_t wrapped_token,
 188                    size_t datalen,
 189                    size_t *padlen)
 190 {
 191     u_char *pad;
 192     size_t padlength;
 193     int i;
 194
 195     pad = (u_char *)wrapped_token->value + wrapped_token->length - 1;
 196     padlength = *pad;
 197
 198     if (padlength > datalen)
 199         return GSS_S_BAD_MECH;
 200
 201     for (i = padlength; i > 0 && *pad == padlength; i--, pad--)
 202         ;
 203     if (i != 0)
 204         return GSS_S_BAD_MIC;
 205
 206     *padlen = padlength;
 207
 208     return 0;
 209 }