1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /*
3 * Copyright 2000 by the Massachusetts Institute of Technology.
4 * All Rights Reserved.
5 *
6 * Export of this software from the United States of America may
7 * require a specific license from the United States Government.
8 * It is the responsibility of any person or organization contemplating
9 * export to obtain such a license before exporting.
10 *
11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
12 * distribute this software and its documentation for any purpose and
13 * without fee is hereby granted, provided that the above copyright
14 * notice appear in all copies and that both that copyright notice and
15 * this permission notice appear in supporting documentation, and that
16 * the name of M.I.T. not be used in advertising or publicity pertaining
17 * to distribution of the software without specific, written prior
18 * permission. Furthermore if you modify this software you must label
19 * your software as modified software and not distribute it in such a
20 * fashion that it might be confused with the original M.I.T. software.
21 * M.I.T. makes no representations about the suitability of
22 * this software for any purpose. It is provided "as is" without express
23 * or implied warranty.
24 */
25 /*
26 * Copyright 1993 by OpenVision Technologies, Inc.
27 *
28 * Permission to use, copy, modify, distribute, and sell this software
29 * and its documentation for any purpose is hereby granted without fee,
30 * provided that the above copyright notice appears in all copies and
31 * that both that copyright notice and this permission notice appear in
32 * supporting documentation, and that the name of OpenVision not be used
33 * in advertising or publicity pertaining to distribution of the software
34 * without specific, written prior permission. OpenVision makes no
35 * representations about the suitability of this software for any
36 * purpose. It is provided "as is" without express or implied warranty.
37 *
38 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
39 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
40 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
41 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
42 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
43 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
44 * PERFORMANCE OF THIS SOFTWARE.
45 */
46
47 /*
48 * Copyright (C) 1998 by the FundsXpress, INC.
49 *
50 * All rights reserved.
51 *
52 * Export of this software from the United States of America may require
53 * a specific license from the United States Government. It is the
54 * responsibility of any person or organization contemplating export to
55 * obtain such a license before exporting.
56 *
57 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
58 * distribute this software and its documentation for any purpose and
59 * without fee is hereby granted, provided that the above copyright
60 * notice appear in all copies and that both that copyright notice and
61 * this permission notice appear in supporting documentation, and that
62 * the name of FundsXpress. not be used in advertising or publicity pertaining
63 * to distribution of the software without specific, written prior
64 * permission. FundsXpress makes no representations about the suitability of
65 * this software for any purpose. It is provided "as is" without express
66 * or implied warranty.
67 *
68 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
69 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
70 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
71 */
72
73 #include "gssapiP_krb5.h"
74
75 /* V2 interface */
76 OM_uint32 KRB5_CALLCONV
krb5_gss_wrap_size_limit(OM_uint32 * minor_status,gss_ctx_id_t context_handle,int conf_req_flag,gss_qop_t qop_req,OM_uint32 req_output_size,OM_uint32 * max_input_size)77 krb5_gss_wrap_size_limit(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
78 int conf_req_flag, gss_qop_t qop_req,
79 OM_uint32 req_output_size, OM_uint32 *max_input_size)
80 {
81 krb5_gss_ctx_id_rec *ctx;
82 OM_uint32 data_size, conflen;
83 OM_uint32 ohlen;
84 int overhead;
85
86 /* only default qop is allowed */
87 if (qop_req != GSS_C_QOP_DEFAULT) {
88 *minor_status = (OM_uint32) G_UNKNOWN_QOP;
89 return GSS_S_BAD_QOP;
90 }
91
92 ctx = (krb5_gss_ctx_id_rec *) context_handle;
93 if (ctx->terminated || !ctx->established) {
94 *minor_status = KG_CTX_INCOMPLETE;
95 return(GSS_S_NO_CONTEXT);
96 }
97
98 if (ctx->proto == 1) {
99 /* No pseudo-ASN.1 wrapper overhead, so no sequence length and
100 OID. */
101 OM_uint32 sz = req_output_size;
102
103 /* Token header: 16 octets. */
104 if (conf_req_flag) {
105 krb5_key key;
106 krb5_enctype enctype;
107
108 key = ctx->have_acceptor_subkey ? ctx->acceptor_subkey
109 : ctx->subkey;
110 enctype = key->keyblock.enctype;
111
112 while (sz > 0 && krb5_encrypt_size(sz, enctype) + 16 > req_output_size)
113 sz--;
114 /* Allow for encrypted copy of header. */
115 if (sz > 16)
116 sz -= 16;
117 else
118 sz = 0;
119 #ifdef CFX_EXERCISE
120 /* Allow for EC padding. In the MIT implementation, only
121 added while testing. */
122 if (sz > 65535)
123 sz -= 65535;
124 else
125 sz = 0;
126 #endif
127 } else {
128 krb5_cksumtype cksumtype;
129 krb5_error_code err;
130 size_t cksumsize;
131
132 cksumtype = ctx->have_acceptor_subkey ? ctx->acceptor_subkey_cksumtype
133 : ctx->cksumtype;
134
135 err = krb5_c_checksum_length(ctx->k5_context, cksumtype, &cksumsize);
136 if (err) {
137 *minor_status = err;
138 return GSS_S_FAILURE;
139 }
140
141 /* Allow for token header and checksum. */
142 if (sz < 16 + cksumsize)
143 sz = 0;
144 else
145 sz -= (16 + cksumsize);
146 }
147
148 *max_input_size = sz;
149 *minor_status = 0;
150 return GSS_S_COMPLETE;
151 }
152
153 /* Calculate the token size and subtract that from the output size */
154 overhead = 7 + ctx->mech_used->length;
155 data_size = req_output_size;
156 conflen = kg_confounder_size(ctx->k5_context, ctx->enc->keyblock.enctype);
157 data_size = (conflen + data_size + 8) & (~(OM_uint32)7);
158 ohlen = g_token_size(ctx->mech_used,
159 (unsigned int) (data_size + ctx->cksum_size + 14))
160 - req_output_size;
161
162 if (ohlen+overhead < req_output_size)
163 /*
164 * Cannot have trailer length that will cause us to pad over our
165 * length.
166 */
167 *max_input_size = (req_output_size - ohlen - overhead) & (~(OM_uint32)7);
168 else
169 *max_input_size = 0;
170
171 *minor_status = 0;
172 return(GSS_S_COMPLETE);
173 }
174