xref: /freebsd/sys/kgssapi/krb5/krb5_mech.c (revision 24e4dcf4ba5e9dedcf89efd358ea3e1fe5867020)

/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2008 Isilon Inc http://www.isilon.com/
 * Authors: Doug Rabson <dfr@rabson.org>
 * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/cdefs.h>
#include "opt_inet6.h"

#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/kobj.h>
#include <sys/lock.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/module.h>
#include <sys/mutex.h>
#include <kgssapi/gssapi.h>
#include <kgssapi/gssapi_impl.h>

#include "kgss_if.h"
#include "kcrypto.h"

#define GSS_TOKEN_SENT_BY_ACCEPTOR	1
#define GSS_TOKEN_SEALED		2
#define GSS_TOKEN_ACCEPTOR_SUBKEY	4

static gss_OID_desc krb5_mech_oid =
{9, (void *) "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };

struct krb5_data {
	size_t		kd_length;
	void		*kd_data;
};

struct krb5_keyblock {
	uint16_t	kk_type; /* encryption type */
	struct krb5_data kk_key; /* key data */
};

struct krb5_address {
	uint16_t	ka_type;
	struct krb5_data ka_addr;
};

/*
 * The km_elem array is ordered so that the highest received sequence
 * number is listed first.
 */
struct krb5_msg_order {
	uint32_t		km_flags;
	uint32_t		km_start;
	uint32_t		km_length;
	uint32_t		km_jitter_window;
	uint32_t		km_first_seq;
	uint32_t		*km_elem;
};

struct krb5_context {
	struct _gss_ctx_id_t	kc_common;
	struct mtx		kc_lock;
	uint32_t		kc_ac_flags;
	uint32_t		kc_ctx_flags;
	uint32_t		kc_more_flags;
#define LOCAL			1
#define OPEN			2
#define COMPAT_OLD_DES3		4
#define COMPAT_OLD_DES3_SELECTED 8
#define ACCEPTOR_SUBKEY		16
	struct krb5_address	kc_local_address;
	struct krb5_address	kc_remote_address;
	uint16_t		kc_local_port;
	uint16_t		kc_remote_port;
	struct krb5_keyblock	kc_keyblock;
	struct krb5_keyblock	kc_local_subkey;
	struct krb5_keyblock	kc_remote_subkey;
	volatile uint32_t	kc_local_seqnumber;
	uint32_t		kc_remote_seqnumber;
	uint32_t		kc_keytype;
	uint32_t		kc_cksumtype;
	struct krb5_data	kc_source_name;
	struct krb5_data	kc_target_name;
	uint32_t		kc_lifetime;
	struct krb5_msg_order	kc_msg_order;
	struct krb5_key_state	*kc_tokenkey;
	struct krb5_key_state	*kc_encryptkey;
	struct krb5_key_state	*kc_checksumkey;

	struct krb5_key_state	*kc_send_seal_Ke;
	struct krb5_key_state	*kc_send_seal_Ki;
	struct krb5_key_state	*kc_send_seal_Kc;
	struct krb5_key_state	*kc_send_sign_Kc;

	struct krb5_key_state	*kc_recv_seal_Ke;
	struct krb5_key_state	*kc_recv_seal_Ki;
	struct krb5_key_state	*kc_recv_seal_Kc;
	struct krb5_key_state	*kc_recv_sign_Kc;
};

static uint16_t
get_uint16(const uint8_t **pp, size_t *lenp)
{
	const uint8_t *p = *pp;
	uint16_t v;

	if (*lenp < 2)
		return (0);

	v = (p[0] << 8) | p[1];
	*pp = p + 2;
	*lenp = *lenp - 2;

	return (v);
}

static uint32_t
get_uint32(const uint8_t **pp, size_t *lenp)
{
	const uint8_t *p = *pp;
	uint32_t v;

	if (*lenp < 4)
		return (0);

	v = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
	*pp = p + 4;
	*lenp = *lenp - 4;

	return (v);
}

static void
get_data(const uint8_t **pp, size_t *lenp, struct krb5_data *dp)
{
	size_t sz = get_uint32(pp, lenp);

	dp->kd_length = sz;
	dp->kd_data = malloc(sz, M_GSSAPI, M_WAITOK);

	if (*lenp < sz)
		sz = *lenp;
	bcopy(*pp, dp->kd_data, sz);
	(*pp) += sz;
	(*lenp) -= sz;
}

static void
delete_data(struct krb5_data *dp)
{
	if (dp->kd_data) {
		free(dp->kd_data, M_GSSAPI);
		dp->kd_length = 0;
		dp->kd_data = NULL;
	}
}

static void
get_address(const uint8_t **pp, size_t *lenp, struct krb5_address *ka)
{

	ka->ka_type = get_uint16(pp, lenp);
	get_data(pp, lenp, &ka->ka_addr);
}

static void
delete_address(struct krb5_address *ka)
{
	delete_data(&ka->ka_addr);
}

static void
get_keyblock(const uint8_t **pp, size_t *lenp, struct krb5_keyblock *kk)
{

	kk->kk_type = get_uint16(pp, lenp);
	get_data(pp, lenp, &kk->kk_key);
}

static void
delete_keyblock(struct krb5_keyblock *kk)
{
	if (kk->kk_key.kd_data)
		bzero(kk->kk_key.kd_data, kk->kk_key.kd_length);
	delete_data(&kk->kk_key);
}

static void
copy_key(struct krb5_keyblock *from, struct krb5_keyblock **to)
{

	if (from->kk_key.kd_length)
		*to = from;
	else
		*to = NULL;
}

static void
copy_lucid_key(gss_buffer_desc *from, uint32_t type, struct krb5_keyblock *to)
{

	to->kk_type = type;
	to->kk_key.kd_length = from->length;
	if (from->length > 0) {
		to->kk_key.kd_data = malloc(from->length, M_GSSAPI, M_WAITOK);
		memcpy(to->kk_key.kd_data, from->value, from->length);
	}
}

/*
 * Return non-zero if we are initiator.
 */
static __inline int
is_initiator(struct krb5_context *kc)
{
	return (kc->kc_more_flags & LOCAL);
}

/*
 * Return non-zero if we are acceptor.
 */
static __inline int
is_acceptor(struct krb5_context *kc)
{
	return !(kc->kc_more_flags & LOCAL);
}

static void
get_initiator_subkey(struct krb5_context *kc, struct krb5_keyblock **kdp)
{

	if (is_initiator(kc))
		copy_key(&kc->kc_local_subkey, kdp);
	else
		copy_key(&kc->kc_remote_subkey, kdp);
	if (!*kdp)
		copy_key(&kc->kc_keyblock, kdp);
}

static void
get_acceptor_subkey(struct krb5_context *kc, struct krb5_keyblock **kdp)
{

	if (is_initiator(kc))
		copy_key(&kc->kc_remote_subkey, kdp);
	else
		copy_key(&kc->kc_local_subkey, kdp);
}

static OM_uint32
get_keys(struct krb5_context *kc)
{
	struct krb5_keyblock *keydata;
	struct krb5_encryption_class *ec;
	struct krb5_key_state *key;
	int etype;

	keydata = NULL;
	get_acceptor_subkey(kc, &keydata);
	if (!keydata)
		if ((kc->kc_more_flags & ACCEPTOR_SUBKEY) == 0)
			get_initiator_subkey(kc, &keydata);
	if (!keydata)
		return (GSS_S_FAILURE);

	/*
	 * GSS-API treats all DES etypes the same and all DES3 etypes
	 * the same.
	 */
	switch (keydata->kk_type) {
	case ETYPE_DES_CBC_CRC:
	case ETYPE_DES_CBC_MD4:
	case ETYPE_DES_CBC_MD5:
		etype = ETYPE_DES_CBC_CRC;
		break;

	case ETYPE_DES3_CBC_MD5:
	case ETYPE_DES3_CBC_SHA1:
	case ETYPE_OLD_DES3_CBC_SHA1:
		etype = ETYPE_DES3_CBC_SHA1;
		break;

	default:
		etype = keydata->kk_type;
	}

	ec = krb5_find_encryption_class(etype);
	if (!ec)
		return (GSS_S_FAILURE);

	key = krb5_create_key(ec);
	krb5_set_key(key, keydata->kk_key.kd_data);
	kc->kc_tokenkey = key;

	switch (etype) {
	case ETYPE_DES_CBC_CRC:
	case ETYPE_ARCFOUR_HMAC_MD5:
	case ETYPE_ARCFOUR_HMAC_MD5_56: {
		/*
		 * Single DES and ARCFOUR uses a 'derived' key (XOR
		 * with 0xf0) for encrypting wrap tokens. The original
		 * key is used for checksums and sequence numbers.
		 */
		struct krb5_key_state *ekey;
		uint8_t *ekp, *kp;
		int i;

		ekey = krb5_create_key(ec);
		ekp = ekey->ks_key;
		kp = key->ks_key;
		for (i = 0; i < ec->ec_keylen; i++)
			ekp[i] = kp[i] ^ 0xf0;
		krb5_set_key(ekey, ekp);
		kc->kc_encryptkey = ekey;
		refcount_acquire(&key->ks_refs);
		kc->kc_checksumkey = key;
		break;
	}

	case ETYPE_DES3_CBC_SHA1:
		/*
		 * Triple DES uses a RFC 3961 style derived key with
		 * usage number KG_USAGE_SIGN for checksums. The
		 * original key is used for encryption and sequence
		 * numbers.
		 */
		kc->kc_checksumkey = krb5_get_checksum_key(key, KG_USAGE_SIGN);
		refcount_acquire(&key->ks_refs);
		kc->kc_encryptkey = key;
		break;

	default:
		/*
		 * We need eight derived keys four for sending and
		 * four for receiving.
		 */
		if (is_initiator(kc)) {
			/*
			 * We are initiator.
			 */
			kc->kc_send_seal_Ke = krb5_get_encryption_key(key,
			    KG_USAGE_INITIATOR_SEAL);
			kc->kc_send_seal_Ki = krb5_get_integrity_key(key,
			    KG_USAGE_INITIATOR_SEAL);
			kc->kc_send_seal_Kc = krb5_get_checksum_key(key,
			    KG_USAGE_INITIATOR_SEAL);
			kc->kc_send_sign_Kc = krb5_get_checksum_key(key,
			    KG_USAGE_INITIATOR_SIGN);

			kc->kc_recv_seal_Ke = krb5_get_encryption_key(key,
			    KG_USAGE_ACCEPTOR_SEAL);
			kc->kc_recv_seal_Ki = krb5_get_integrity_key(key,
			    KG_USAGE_ACCEPTOR_SEAL);
			kc->kc_recv_seal_Kc = krb5_get_checksum_key(key,
			    KG_USAGE_ACCEPTOR_SEAL);
			kc->kc_recv_sign_Kc = krb5_get_checksum_key(key,
			    KG_USAGE_ACCEPTOR_SIGN);
		} else {
			/*
			 * We are acceptor.
			 */
			kc->kc_send_seal_Ke = krb5_get_encryption_key(key,
			    KG_USAGE_ACCEPTOR_SEAL);
			kc->kc_send_seal_Ki = krb5_get_integrity_key(key,
			    KG_USAGE_ACCEPTOR_SEAL);
			kc->kc_send_seal_Kc = krb5_get_checksum_key(key,
			    KG_USAGE_ACCEPTOR_SEAL);
			kc->kc_send_sign_Kc = krb5_get_checksum_key(key,
			    KG_USAGE_ACCEPTOR_SIGN);

			kc->kc_recv_seal_Ke = krb5_get_encryption_key(key,
			    KG_USAGE_INITIATOR_SEAL);
			kc->kc_recv_seal_Ki = krb5_get_integrity_key(key,
			    KG_USAGE_INITIATOR_SEAL);
			kc->kc_recv_seal_Kc = krb5_get_checksum_key(key,
			    KG_USAGE_INITIATOR_SEAL);
			kc->kc_recv_sign_Kc = krb5_get_checksum_key(key,
			    KG_USAGE_INITIATOR_SIGN);
		}
		break;
	}

	return (GSS_S_COMPLETE);
}

static void
krb5_init(gss_ctx_id_t ctx)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;

	mtx_init(&kc->kc_lock, "krb5 gss lock", NULL, MTX_DEF);
}

static OM_uint32
krb5_lucid_import(gss_ctx_id_t ctx,
    enum sec_context_format format,
    const gss_buffer_t context_token)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;
	kgss_lucid_desc *lctx = (kgss_lucid_desc *)context_token;
	OM_uint32 res;

	kc->kc_more_flags = 0;
	if (lctx->protocol == 0) {
		kc->kc_cksumtype = lctx->rfc_sign;
		kc->kc_keytype = lctx->rfc_seal;
		copy_lucid_key(&lctx->ctx_key, lctx->ctx_type,
		    &kc->kc_keyblock);
	} else if (lctx->protocol == 1) {
		if (lctx->have_subkey != 0) {
			if (lctx->initiate != 0)
				copy_lucid_key(&lctx->subkey_key,
				    lctx->subkey_type,
				    &kc->kc_remote_subkey);
			else
				copy_lucid_key(&lctx->subkey_key,
				    lctx->subkey_type,
				    &kc->kc_local_subkey);
			kc->kc_cksumtype = lctx->subkey_type;
			kc->kc_keytype = lctx->subkey_type;
			kc->kc_more_flags |= ACCEPTOR_SUBKEY;
		} else {
			if (lctx->initiate != 0)
				copy_lucid_key(&lctx->ctx_key,
				    lctx->ctx_type,
				    &kc->kc_remote_subkey);
			else
				copy_lucid_key(&lctx->ctx_key,
				    lctx->ctx_type,
				    &kc->kc_local_subkey);
			kc->kc_cksumtype = lctx->ctx_type;
			kc->kc_keytype = lctx->ctx_type;
		}
	} else {
		return (GSS_S_DEFECTIVE_TOKEN);
	}
	kc->kc_local_seqnumber = lctx->send_seq;
	kc->kc_remote_seqnumber = lctx->recv_seq;
	if (lctx->initiate != 0)
		kc->kc_more_flags |= LOCAL;
	kc->kc_lifetime = lctx->endtime;
	kc->kc_msg_order.km_flags = 0;

	res = get_keys(kc);
	if (GSS_ERROR(res))
		return (res);

	/*
	 * We don't need these anymore.
	 */
	delete_keyblock(&kc->kc_keyblock);
	delete_keyblock(&kc->kc_local_subkey);
	delete_keyblock(&kc->kc_remote_subkey);

	return (GSS_S_COMPLETE);
}

static OM_uint32
krb5_import(gss_ctx_id_t ctx,
    enum sec_context_format format,
    const gss_buffer_t context_token)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;
	OM_uint32 res;
	const uint8_t *p = (const uint8_t *) context_token->value;
	size_t len = context_token->length;
	uint32_t flags;
	int i;

	/* For MIT, just call krb5_lucid_import(). */
	if (format == MIT_V1)
		return (krb5_lucid_import(ctx, format, context_token));

	/*
	 * We support heimdal 0.6 and heimdal 1.1
	 */
	if (format != KGSS_HEIMDAL_0_6 && format != KGSS_HEIMDAL_1_1)
		return (GSS_S_DEFECTIVE_TOKEN);

#define SC_LOCAL_ADDRESS	1
#define SC_REMOTE_ADDRESS	2
#define SC_KEYBLOCK		4
#define SC_LOCAL_SUBKEY		8
#define SC_REMOTE_SUBKEY	16

	/*
	 * Ensure that the token starts with krb5 oid.
	 */
	if (p[0] != 0x00 || p[1] != krb5_mech_oid.length
	    || len < krb5_mech_oid.length + 2
	    || bcmp(krb5_mech_oid.elements, p + 2,
		krb5_mech_oid.length))
		return (GSS_S_DEFECTIVE_TOKEN);
	p += krb5_mech_oid.length + 2;
	len -= krb5_mech_oid.length + 2;

	flags = get_uint32(&p, &len);
	kc->kc_ac_flags = get_uint32(&p, &len);
	if (flags & SC_LOCAL_ADDRESS)
		get_address(&p, &len, &kc->kc_local_address);
	if (flags & SC_REMOTE_ADDRESS)
		get_address(&p, &len, &kc->kc_remote_address);
	kc->kc_local_port = get_uint16(&p, &len);
	kc->kc_remote_port = get_uint16(&p, &len);
	if (flags & SC_KEYBLOCK)
		get_keyblock(&p, &len, &kc->kc_keyblock);
	if (flags & SC_LOCAL_SUBKEY)
		get_keyblock(&p, &len, &kc->kc_local_subkey);
	if (flags & SC_REMOTE_SUBKEY)
		get_keyblock(&p, &len, &kc->kc_remote_subkey);
	kc->kc_local_seqnumber = get_uint32(&p, &len);
	kc->kc_remote_seqnumber = get_uint32(&p, &len);
	kc->kc_keytype = get_uint32(&p, &len);
	kc->kc_cksumtype = get_uint32(&p, &len);
	get_data(&p, &len, &kc->kc_source_name);
	get_data(&p, &len, &kc->kc_target_name);
	kc->kc_ctx_flags = get_uint32(&p, &len);
	kc->kc_more_flags = get_uint32(&p, &len);
	kc->kc_lifetime = get_uint32(&p, &len);
	/*
	 * Heimdal 1.1 adds the message order stuff.
	 */
	if (format == KGSS_HEIMDAL_1_1) {
		kc->kc_msg_order.km_flags = get_uint32(&p, &len);
		kc->kc_msg_order.km_start = get_uint32(&p, &len);
		kc->kc_msg_order.km_length = get_uint32(&p, &len);
		kc->kc_msg_order.km_jitter_window = get_uint32(&p, &len);
		kc->kc_msg_order.km_first_seq = get_uint32(&p, &len);
		kc->kc_msg_order.km_elem =
			malloc(kc->kc_msg_order.km_jitter_window * sizeof(uint32_t),
			    M_GSSAPI, M_WAITOK);
		for (i = 0; i < kc->kc_msg_order.km_jitter_window; i++)
			kc->kc_msg_order.km_elem[i] = get_uint32(&p, &len);
	} else {
		kc->kc_msg_order.km_flags = 0;
	}

	res = get_keys(kc);
	if (GSS_ERROR(res))
		return (res);

	/*
	 * We don't need these anymore.
	 */
	delete_keyblock(&kc->kc_keyblock);
	delete_keyblock(&kc->kc_local_subkey);
	delete_keyblock(&kc->kc_remote_subkey);

	return (GSS_S_COMPLETE);
}

static void
krb5_delete(gss_ctx_id_t ctx, gss_buffer_t output_token)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;

	delete_address(&kc->kc_local_address);
	delete_address(&kc->kc_remote_address);
	delete_keyblock(&kc->kc_keyblock);
	delete_keyblock(&kc->kc_local_subkey);
	delete_keyblock(&kc->kc_remote_subkey);
	delete_data(&kc->kc_source_name);
	delete_data(&kc->kc_target_name);
	if (kc->kc_msg_order.km_elem)
		free(kc->kc_msg_order.km_elem, M_GSSAPI);
	if (output_token) {
		output_token->length = 0;
		output_token->value = NULL;
	}
	if (kc->kc_tokenkey) {
		krb5_free_key(kc->kc_tokenkey);
		if (kc->kc_encryptkey) {
			krb5_free_key(kc->kc_encryptkey);
			krb5_free_key(kc->kc_checksumkey);
		} else {
			krb5_free_key(kc->kc_send_seal_Ke);
			krb5_free_key(kc->kc_send_seal_Ki);
			krb5_free_key(kc->kc_send_seal_Kc);
			krb5_free_key(kc->kc_send_sign_Kc);
			krb5_free_key(kc->kc_recv_seal_Ke);
			krb5_free_key(kc->kc_recv_seal_Ki);
			krb5_free_key(kc->kc_recv_seal_Kc);
			krb5_free_key(kc->kc_recv_sign_Kc);
		}
	}
	mtx_destroy(&kc->kc_lock);
}

static gss_OID
krb5_mech_type(gss_ctx_id_t ctx)
{

	return (&krb5_mech_oid);
}

/*
 * Make a token with the given type and length (the length includes
 * the TOK_ID), initialising the token header appropriately. Return a
 * pointer to the TOK_ID of the token.  A new mbuf is allocated with
 * the framing header plus hlen bytes of space.
 *
 * Format is as follows:
 *
 *	0x60			[APPLICATION 0] SEQUENCE
 *	DER encoded length	length of oid + type + inner token length
 *	0x06 NN <oid data>	OID of mechanism type
 *	TT TT			TOK_ID
 *	<inner token>		data for inner token
 *
 * 1:		der encoded length
 */
static void *
krb5_make_token(char tok_id[2], size_t hlen, size_t len, struct mbuf **mp)
{
	size_t inside_len, len_len, tlen;
	gss_OID oid = &krb5_mech_oid;
	struct mbuf *m;
	uint8_t *p;

	inside_len = 2 + oid->length + len;
	if (inside_len < 128)
		len_len = 1;
	else if (inside_len < 0x100)
		len_len = 2;
	else if (inside_len < 0x10000)
		len_len = 3;
	else if (inside_len < 0x1000000)
		len_len = 4;
	else
		len_len = 5;

	tlen = 1 + len_len + 2 + oid->length + hlen;
	KASSERT(tlen <= MLEN, ("token head too large"));
	MGET(m, M_WAITOK, MT_DATA);
	M_ALIGN(m, tlen);
	m->m_len = tlen;

	p = (uint8_t *) m->m_data;
	*p++ = 0x60;
	switch (len_len) {
	case 1:
		*p++ = inside_len;
		break;
	case 2:
		*p++ = 0x81;
		*p++ = inside_len;
		break;
	case 3:
		*p++ = 0x82;
		*p++ = inside_len >> 8;
		*p++ = inside_len;
		break;
	case 4:
		*p++ = 0x83;
		*p++ = inside_len >> 16;
		*p++ = inside_len >> 8;
		*p++ = inside_len;
		break;
	case 5:
		*p++ = 0x84;
		*p++ = inside_len >> 24;
		*p++ = inside_len >> 16;
		*p++ = inside_len >> 8;
		*p++ = inside_len;
		break;
	}

	*p++ = 0x06;
	*p++ = oid->length;
	bcopy(oid->elements, p, oid->length);
	p += oid->length;

	p[0] = tok_id[0];
	p[1] = tok_id[1];

	*mp = m;

	return (p);
}

/*
 * Verify a token, checking the inner token length and mechanism oid.
 * pointer to the first byte of the TOK_ID. The length of the
 * encapsulated data is checked to be at least len bytes; the actual
 * length of the encapsulated data (including TOK_ID) is returned in
 * *encap_len.
 *
 * If can_pullup is TRUE and the token header is fragmented, we will
 * rearrange it.
 *
 * Format is as follows:
 *
 *	0x60			[APPLICATION 0] SEQUENCE
 *	DER encoded length	length of oid + type + inner token length
 *	0x06 NN <oid data>	OID of mechanism type
 *	TT TT			TOK_ID
 *	<inner token>		data for inner token
 *
 * 1:		der encoded length
 */
static void *
krb5_verify_token(char tok_id[2], size_t len, struct mbuf **mp,
    size_t *encap_len, bool_t can_pullup)
{
	struct mbuf *m;
	size_t tlen, hlen, len_len, inside_len;
	gss_OID oid = &krb5_mech_oid;
	uint8_t *p;

	m = *mp;
	tlen = m_length(m, NULL);
	if (tlen < 2)
		return (NULL);

	/*
	 * Ensure that at least the framing part of the token is
	 * contigous.
	 */
	if (m->m_len < 2) {
		if (can_pullup)
			*mp = m = m_pullup(m, 2);
		else
			return (NULL);
	}

	p = m->m_data;

	if (*p++ != 0x60)
		return (NULL);

	if (*p < 0x80) {
		inside_len = *p++;
		len_len = 1;
	} else {
		/*
		 * Ensure there is enough space for the DER encoded length.
		 */
		len_len = (*p & 0x7f) + 1;
		if (tlen < len_len + 1)
			return (NULL);
		if (m->m_len < len_len + 1) {
			if (can_pullup)
				*mp = m = m_pullup(m, len_len + 1);
			else
				return (NULL);
			p = m->m_data + 1;
		}

		switch (*p++) {
		case 0x81:
			inside_len = *p++;
			break;

		case 0x82:
			inside_len = (p[0] << 8) | p[1];
			p += 2;
			break;

		case 0x83:
			inside_len = (p[0] << 16) | (p[1] << 8) | p[2];
			p += 3;
			break;

		case 0x84:
			inside_len = (p[0] << 24) | (p[1] << 16)
				| (p[2] << 8) | p[3];
			p += 4;
			break;

		default:
			return (NULL);
		}
	}

	if (tlen != inside_len + len_len + 1)
		return (NULL);
	if (inside_len < 2 + oid->length + len)
		return (NULL);

	/*
	 * Now that we know the value of len_len, we can pullup the
	 * whole header. The header is 1 + len_len + 2 + oid->length +
	 * len bytes.
	 */
	hlen = 1 + len_len + 2 + oid->length + len;
	if (m->m_len < hlen) {
		if (can_pullup)
			*mp = m = m_pullup(m, hlen);
		else
			return (NULL);
		p = m->m_data + 1 + len_len;
	}

	if (*p++ != 0x06)
		return (NULL);
	if (*p++ != oid->length)
		return (NULL);
	if (bcmp(oid->elements, p, oid->length))
		return (NULL);
	p += oid->length;

	if (p[0] != tok_id[0])
		return (NULL);

	if (p[1] != tok_id[1])
		return (NULL);

	*encap_len = inside_len - 2 - oid->length;

	return (p);
}

static void
krb5_insert_seq(struct krb5_msg_order *mo, uint32_t seq, int index)
{
	int i;

	if (mo->km_length < mo->km_jitter_window)
		mo->km_length++;

	for (i = mo->km_length - 1; i > index; i--)
		mo->km_elem[i] = mo->km_elem[i - 1];
	mo->km_elem[index] = seq;
}

/*
 * Check sequence numbers according to RFC 2743 section 1.2.3.
 */
static OM_uint32
krb5_sequence_check(struct krb5_context *kc, uint32_t seq)
{
	OM_uint32 res = GSS_S_FAILURE;
	struct krb5_msg_order *mo = &kc->kc_msg_order;
	int check_sequence = mo->km_flags & GSS_C_SEQUENCE_FLAG;
	int check_replay = mo->km_flags & GSS_C_REPLAY_FLAG;
	int i;

	mtx_lock(&kc->kc_lock);

	/*
	 * Message is in-sequence with no gap.
	 */
	if (mo->km_length == 0 || seq == mo->km_elem[0] + 1) {
		/*
		 * This message is received in-sequence with no gaps.
		 */
		krb5_insert_seq(mo, seq, 0);
		res = GSS_S_COMPLETE;
		goto out;
	}

	if (seq > mo->km_elem[0]) {
		/*
		 * This message is received in-sequence with a gap.
		 */
		krb5_insert_seq(mo, seq, 0);
		if (check_sequence)
			res = GSS_S_GAP_TOKEN;
		else
			res = GSS_S_COMPLETE;
		goto out;
	}

	if (seq < mo->km_elem[mo->km_length - 1]) {
		if (check_replay && !check_sequence)
			res = GSS_S_OLD_TOKEN;
		else
			res = GSS_S_UNSEQ_TOKEN;
		goto out;
	}

	for (i = 0; i < mo->km_length; i++) {
		if (mo->km_elem[i] == seq) {
			res = GSS_S_DUPLICATE_TOKEN;
			goto out;
		}
		if (mo->km_elem[i] < seq) {
			/*
			 * We need to insert this seq here,
			 */
			krb5_insert_seq(mo, seq, i);
			if (check_replay && !check_sequence)
				res = GSS_S_COMPLETE;
			else
				res = GSS_S_UNSEQ_TOKEN;
			goto out;
		}
	}

out:
	mtx_unlock(&kc->kc_lock);

	return (res);
}

static uint8_t sgn_alg_des_md5[] = { 0x00, 0x00 };
static uint8_t seal_alg_des[] = { 0x00, 0x00 };
static uint8_t sgn_alg_des3_sha1[] = { 0x04, 0x00 };
static uint8_t seal_alg_des3[] = { 0x02, 0x00 };
static uint8_t seal_alg_rc4[] = { 0x10, 0x00 };
static uint8_t sgn_alg_hmac_md5[] = { 0x11, 0x00 };

/*
 * Return the size of the inner token given the use of the key's
 * encryption class. For wrap tokens, the length of the padded
 * plaintext will be added to this.
 */
static size_t
token_length(struct krb5_key_state *key)
{

	return (16 + key->ks_class->ec_checksumlen);
}

static OM_uint32
krb5_get_mic_old(struct krb5_context *kc, struct mbuf *m,
    struct mbuf **micp, uint8_t sgn_alg[2])
{
	struct mbuf *mlast, *mic, *tm;
	uint8_t *p, dir;
	size_t tlen, mlen, cklen;
	uint32_t seq;
	char buf[8];

	mlen = m_length(m, &mlast);

	tlen = token_length(kc->kc_tokenkey);
	p = krb5_make_token("\x01\x01", tlen, tlen, &mic);
	p += 2;			/* TOK_ID */
	*p++ = sgn_alg[0];	/* SGN_ALG */
	*p++ = sgn_alg[1];

	*p++ = 0xff;		/* filler */
	*p++ = 0xff;
	*p++ = 0xff;
	*p++ = 0xff;

	/*
	 * SGN_CKSUM:
	 *
	 * Calculate the keyed checksum of the token header plus the
	 * message.
	 */
	cklen = kc->kc_checksumkey->ks_class->ec_checksumlen;

	mic->m_len = p - (uint8_t *) mic->m_data;
	mic->m_next = m;
	MGET(tm, M_WAITOK, MT_DATA);
	tm->m_len = cklen;
	mlast->m_next = tm;

	krb5_checksum(kc->kc_checksumkey, 15, mic, mic->m_len - 8,
	    8 + mlen, cklen);
	bcopy(tm->m_data, p + 8, cklen);
	mic->m_next = NULL;
	mlast->m_next = NULL;
	m_free(tm);

	/*
	 * SND_SEQ:
	 *
	 * Take the four bytes of the sequence number least
	 * significant first followed by four bytes of direction
	 * marker (zero for initiator and 0xff for acceptor). Encrypt
	 * that data using the SGN_CKSUM as IV. Note: ARC4 wants the
	 * sequence number big-endian.
	 */
	seq = atomic_fetchadd_32(&kc->kc_local_seqnumber, 1);
	if (sgn_alg[0] == 0x11) {
		p[0] = (seq >> 24);
		p[1] = (seq >> 16);
		p[2] = (seq >> 8);
		p[3] = (seq >> 0);
	} else {
		p[0] = (seq >> 0);
		p[1] = (seq >> 8);
		p[2] = (seq >> 16);
		p[3] = (seq >> 24);
	}
	if (is_initiator(kc)) {
		dir = 0;
	} else {
		dir = 0xff;
	}
	p[4] = dir;
	p[5] = dir;
	p[6] = dir;
	p[7] = dir;
	bcopy(p + 8, buf, 8);

	/*
	 * Set the mic buffer to its final size so that the encrypt
	 * can see the SND_SEQ part.
	 */
	mic->m_len += 8 + cklen;
	krb5_encrypt(kc->kc_tokenkey, mic, mic->m_len - cklen - 8, 8, buf, 8);

	*micp = mic;
	return (GSS_S_COMPLETE);
}

static OM_uint32
krb5_get_mic_new(struct krb5_context *kc,  struct mbuf *m,
    struct mbuf **micp)
{
	struct krb5_key_state *key = kc->kc_send_sign_Kc;
	struct mbuf *mlast, *mic;
	uint8_t *p;
	int flags;
	size_t mlen, cklen;
	uint32_t seq;

	mlen = m_length(m, &mlast);
	cklen = key->ks_class->ec_checksumlen;

	KASSERT(16 + cklen <= MLEN, ("checksum too large for an mbuf"));
	MGET(mic, M_WAITOK, MT_DATA);
	M_ALIGN(mic, 16 + cklen);
	mic->m_len = 16 + cklen;
	p = mic->m_data;

	/* TOK_ID */
	p[0] = 0x04;
	p[1] = 0x04;

	/* Flags */
	flags = 0;
	if (is_acceptor(kc))
		flags |= GSS_TOKEN_SENT_BY_ACCEPTOR;
	if (kc->kc_more_flags & ACCEPTOR_SUBKEY)
		flags |= GSS_TOKEN_ACCEPTOR_SUBKEY;
	p[2] = flags;

	/* Filler */
	p[3] = 0xff;
	p[4] = 0xff;
	p[5] = 0xff;
	p[6] = 0xff;
	p[7] = 0xff;

	/* SND_SEQ */
	p[8] = 0;
	p[9] = 0;
	p[10] = 0;
	p[11] = 0;
	seq = atomic_fetchadd_32(&kc->kc_local_seqnumber, 1);
	p[12] = (seq >> 24);
	p[13] = (seq >> 16);
	p[14] = (seq >> 8);
	p[15] = (seq >> 0);

	/*
	 * SGN_CKSUM:
	 *
	 * Calculate the keyed checksum of the message plus the first
	 * 16 bytes of the token header.
	 */
	mlast->m_next = mic;
	krb5_checksum(key, 0, m, 0, mlen + 16, cklen);
	mlast->m_next = NULL;

	*micp = mic;
	return (GSS_S_COMPLETE);
}

static OM_uint32
krb5_get_mic(gss_ctx_id_t ctx, OM_uint32 *minor_status,
    gss_qop_t qop_req, struct mbuf *m, struct mbuf **micp)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;

	*minor_status = 0;

	if (qop_req != GSS_C_QOP_DEFAULT)
		return (GSS_S_BAD_QOP);

	if (time_uptime > kc->kc_lifetime)
		return (GSS_S_CONTEXT_EXPIRED);

	switch (kc->kc_tokenkey->ks_class->ec_type) {
	case ETYPE_DES_CBC_CRC:
		return (krb5_get_mic_old(kc, m, micp, sgn_alg_des_md5));

	case ETYPE_DES3_CBC_SHA1:
		return (krb5_get_mic_old(kc, m, micp, sgn_alg_des3_sha1));

	case ETYPE_ARCFOUR_HMAC_MD5:
	case ETYPE_ARCFOUR_HMAC_MD5_56:
		return (krb5_get_mic_old(kc, m, micp, sgn_alg_hmac_md5));

	default:
		return (krb5_get_mic_new(kc, m, micp));
	}

	return (GSS_S_FAILURE);
}

static OM_uint32
krb5_verify_mic_old(struct krb5_context *kc, struct mbuf *m, struct mbuf *mic,
    uint8_t sgn_alg[2])
{
	struct mbuf *mlast, *tm;
	uint8_t *p, *tp, dir;
	size_t mlen, tlen, elen;
	size_t cklen;
	uint32_t seq;

	mlen = m_length(m, &mlast);

	tlen = token_length(kc->kc_tokenkey);
	p = krb5_verify_token("\x01\x01", tlen, &mic, &elen, FALSE);
	if (!p)
		return (GSS_S_DEFECTIVE_TOKEN);
#if 0
	/*
	 * Disable this check - heimdal-1.1 generates DES3 MIC tokens
	 * that are 2 bytes too big.
	 */
	if (elen != tlen)
		return (GSS_S_DEFECTIVE_TOKEN);
#endif
	/* TOK_ID */
	p += 2;

	/* SGN_ALG */
	if (p[0] != sgn_alg[0] || p[1] != sgn_alg[1])
		return (GSS_S_DEFECTIVE_TOKEN);
	p += 2;

	if (p[0] != 0xff || p[1] != 0xff || p[2] != 0xff || p[3] != 0xff)
		return (GSS_S_DEFECTIVE_TOKEN);
	p += 4;

	/*
	 * SGN_CKSUM:
	 *
	 * Calculate the keyed checksum of the token header plus the
	 * message.
	 */
	cklen = kc->kc_checksumkey->ks_class->ec_checksumlen;
	mic->m_len = p - (uint8_t *) mic->m_data;
	mic->m_next = m;
	MGET(tm, M_WAITOK, MT_DATA);
	tm->m_len = cklen;
	mlast->m_next = tm;

	krb5_checksum(kc->kc_checksumkey, 15, mic, mic->m_len - 8,
	    8 + mlen, cklen);
	mic->m_next = NULL;
	mlast->m_next = NULL;
	if (bcmp(tm->m_data, p + 8, cklen)) {
		m_free(tm);
		return (GSS_S_BAD_SIG);
	}

	/*
	 * SND_SEQ:
	 *
	 * Take the four bytes of the sequence number least
	 * significant first followed by four bytes of direction
	 * marker (zero for initiator and 0xff for acceptor). Encrypt
	 * that data using the SGN_CKSUM as IV.  Note: ARC4 wants the
	 * sequence number big-endian.
	 */
	bcopy(p, tm->m_data, 8);
	tm->m_len = 8;
	krb5_decrypt(kc->kc_tokenkey, tm, 0, 8, p + 8, 8);

	tp = tm->m_data;
	if (sgn_alg[0] == 0x11) {
		seq = tp[3] | (tp[2] << 8) | (tp[1] << 16) | (tp[0] << 24);
	} else {
		seq = tp[0] | (tp[1] << 8) | (tp[2] << 16) | (tp[3] << 24);
	}

	if (is_initiator(kc)) {
		dir = 0xff;
	} else {
		dir = 0;
	}
	if (tp[4] != dir || tp[5] != dir || tp[6] != dir || tp[7] != dir) {
		m_free(tm);
		return (GSS_S_DEFECTIVE_TOKEN);
	}
	m_free(tm);

	if (kc->kc_msg_order.km_flags &
		(GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG)) {
		return (krb5_sequence_check(kc, seq));
	}

	return (GSS_S_COMPLETE);
}

static OM_uint32
krb5_verify_mic_new(struct krb5_context *kc, struct mbuf *m, struct mbuf *mic)
{
	OM_uint32 res;
	struct krb5_key_state *key = kc->kc_recv_sign_Kc;
	struct mbuf *mlast;
	uint8_t *p;
	int flags;
	size_t mlen, cklen;
	char buf[32];

	mlen = m_length(m, &mlast);
	cklen = key->ks_class->ec_checksumlen;

	KASSERT(mic->m_next == NULL, ("MIC should be contiguous"));
	if (mic->m_len != 16 + cklen)
		return (GSS_S_DEFECTIVE_TOKEN);
	p = mic->m_data;

	/* TOK_ID */
	if (p[0] != 0x04)
		return (GSS_S_DEFECTIVE_TOKEN);
	if (p[1] != 0x04)
		return (GSS_S_DEFECTIVE_TOKEN);

	/* Flags */
	flags = 0;
	if (is_initiator(kc))
		flags |= GSS_TOKEN_SENT_BY_ACCEPTOR;
	if (kc->kc_more_flags & ACCEPTOR_SUBKEY)
		flags |= GSS_TOKEN_ACCEPTOR_SUBKEY;
	if (p[2] != flags)
		return (GSS_S_DEFECTIVE_TOKEN);

	/* Filler */
	if (p[3] != 0xff)
		return (GSS_S_DEFECTIVE_TOKEN);
	if (p[4] != 0xff)
		return (GSS_S_DEFECTIVE_TOKEN);
	if (p[5] != 0xff)
		return (GSS_S_DEFECTIVE_TOKEN);
	if (p[6] != 0xff)
		return (GSS_S_DEFECTIVE_TOKEN);
	if (p[7] != 0xff)
		return (GSS_S_DEFECTIVE_TOKEN);

	/* SND_SEQ */
	if (kc->kc_msg_order.km_flags &
		(GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG)) {
		uint32_t seq;
		if (p[8] || p[9] || p[10] || p[11]) {
			res = GSS_S_UNSEQ_TOKEN;
		} else {
			seq = (p[12] << 24) | (p[13] << 16)
				| (p[14] << 8) | p[15];
			res = krb5_sequence_check(kc, seq);
		}
		if (GSS_ERROR(res))
			return (res);
	} else {
		res = GSS_S_COMPLETE;
	}

	/*
	 * SGN_CKSUM:
	 *
	 * Calculate the keyed checksum of the message plus the first
	 * 16 bytes of the token header.
	 */
	m_copydata(mic, 16, cklen, buf);
	mlast->m_next = mic;
	krb5_checksum(key, 0, m, 0, mlen + 16, cklen);
	mlast->m_next = NULL;
	if (bcmp(buf, p + 16, cklen)) {
		return (GSS_S_BAD_SIG);
	}

	return (GSS_S_COMPLETE);
}

static OM_uint32
krb5_verify_mic(gss_ctx_id_t ctx, OM_uint32 *minor_status,
    struct mbuf *m, struct mbuf *mic, gss_qop_t *qop_state)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;

	*minor_status = 0;
	if (qop_state)
		*qop_state = GSS_C_QOP_DEFAULT;

	if (time_uptime > kc->kc_lifetime)
		return (GSS_S_CONTEXT_EXPIRED);

	switch (kc->kc_tokenkey->ks_class->ec_type) {
	case ETYPE_DES_CBC_CRC:
		return (krb5_verify_mic_old(kc, m, mic, sgn_alg_des_md5));

	case ETYPE_ARCFOUR_HMAC_MD5:
	case ETYPE_ARCFOUR_HMAC_MD5_56:
		return (krb5_verify_mic_old(kc, m, mic, sgn_alg_hmac_md5));

	case ETYPE_DES3_CBC_SHA1:
		return (krb5_verify_mic_old(kc, m, mic, sgn_alg_des3_sha1));

	default:
		return (krb5_verify_mic_new(kc, m, mic));
	}

	return (GSS_S_FAILURE);
}

static OM_uint32
krb5_wrap_old(struct krb5_context *kc, int conf_req_flag,
    struct mbuf **mp, int *conf_state,
    uint8_t sgn_alg[2], uint8_t seal_alg[2])
{
	struct mbuf *m, *mlast, *tm, *cm, *pm;
	size_t mlen, tlen, padlen, datalen;
	uint8_t *p, dir;
	size_t cklen;
	uint8_t buf[8];
	uint32_t seq;

	/*
	 * How many trailing pad bytes do we need?
	 */
	m = *mp;
	mlen = m_length(m, &mlast);
	tlen = kc->kc_tokenkey->ks_class->ec_msgblocklen;
	padlen = tlen - (mlen % tlen);

	/*
	 * The data part of the token has eight bytes of random
	 * confounder prepended and followed by up to eight bytes of
	 * padding bytes each of which is set to the number of padding
	 * bytes.
	 */
	datalen = mlen + 8 + padlen;
	tlen = token_length(kc->kc_tokenkey);

	p = krb5_make_token("\x02\x01", tlen, datalen + tlen, &tm);
	p += 2;			/* TOK_ID */
	*p++ = sgn_alg[0];	/* SGN_ALG */
	*p++ = sgn_alg[1];
	if (conf_req_flag) {
		*p++ = seal_alg[0]; /* SEAL_ALG */
		*p++ = seal_alg[1];
	} else {
		*p++ = 0xff;	/* SEAL_ALG = none */
		*p++ = 0xff;
	}

	*p++ = 0xff;		/* filler */
	*p++ = 0xff;

	/*
	 * Copy the padded message data.
	 */
	if (M_LEADINGSPACE(m) >= 8) {
		m->m_data -= 8;
		m->m_len += 8;
	} else {
		MGET(cm, M_WAITOK, MT_DATA);
		cm->m_len = 8;
		cm->m_next = m;
		m = cm;
	}
	arc4rand(m->m_data, 8, 0);
	if (M_TRAILINGSPACE(mlast) >= padlen) {
		memset(mlast->m_data + mlast->m_len, padlen, padlen);
		mlast->m_len += padlen;
	} else {
		MGET(pm, M_WAITOK, MT_DATA);
		memset(pm->m_data, padlen, padlen);
		pm->m_len = padlen;
		mlast->m_next = pm;
		mlast = pm;
	}
	tm->m_next = m;

	/*
	 * SGN_CKSUM:
	 *
	 * Calculate the keyed checksum of the token header plus the
	 * padded message. Fiddle with tm->m_len so that we only
	 * checksum the 8 bytes of head that we care about.
	 */
	cklen = kc->kc_checksumkey->ks_class->ec_checksumlen;
	tlen = tm->m_len;
	tm->m_len = p - (uint8_t *) tm->m_data;
	MGET(cm, M_WAITOK, MT_DATA);
	cm->m_len = cklen;
	mlast->m_next = cm;
	krb5_checksum(kc->kc_checksumkey, 13, tm, tm->m_len - 8,
	    datalen + 8, cklen);
	tm->m_len = tlen;
	mlast->m_next = NULL;
	bcopy(cm->m_data, p + 8, cklen);
	m_free(cm);

	/*
	 * SND_SEQ:
	 *
	 * Take the four bytes of the sequence number least
	 * significant first (most significant first for ARCFOUR)
	 * followed by four bytes of direction marker (zero for
	 * initiator and 0xff for acceptor). Encrypt that data using
	 * the SGN_CKSUM as IV.
	 */
	seq = atomic_fetchadd_32(&kc->kc_local_seqnumber, 1);
	if (sgn_alg[0] == 0x11) {
		p[0] = (seq >> 24);
		p[1] = (seq >> 16);
		p[2] = (seq >> 8);
		p[3] = (seq >> 0);
	} else {
		p[0] = (seq >> 0);
		p[1] = (seq >> 8);
		p[2] = (seq >> 16);
		p[3] = (seq >> 24);
	}
	if (is_initiator(kc)) {
		dir = 0;
	} else {
		dir = 0xff;
	}
	p[4] = dir;
	p[5] = dir;
	p[6] = dir;
	p[7] = dir;
	krb5_encrypt(kc->kc_tokenkey, tm, p - (uint8_t *) tm->m_data,
	    8, p + 8, 8);

	if (conf_req_flag) {
		/*
		 * Encrypt the padded message with an IV of zero for
		 * DES and DES3, or an IV of the sequence number in
		 * big-endian format for ARCFOUR.
		 */
		if (seal_alg[0] == 0x10) {
			buf[0] = (seq >> 24);
			buf[1] = (seq >> 16);
			buf[2] = (seq >> 8);
			buf[3] = (seq >> 0);
			krb5_encrypt(kc->kc_encryptkey, m, 0, datalen,
			    buf, 4);
		} else {
			krb5_encrypt(kc->kc_encryptkey, m, 0, datalen,
			    NULL, 0);
		}
	}

	if (conf_state)
		*conf_state = conf_req_flag;

	*mp = tm;
	return (GSS_S_COMPLETE);
}

static OM_uint32
krb5_wrap_new(struct krb5_context *kc, int conf_req_flag,
    struct mbuf **mp, int *conf_state)
{
	struct krb5_key_state *Ke = kc->kc_send_seal_Ke;
	struct krb5_key_state *Ki = kc->kc_send_seal_Ki;
	struct krb5_key_state *Kc = kc->kc_send_seal_Kc;
	const struct krb5_encryption_class *ec = Ke->ks_class;
	struct mbuf *m, *mlast, *tm;
	uint8_t *p;
	int flags, EC;
	size_t mlen, blen, mblen, cklen, ctlen;
	uint32_t seq;
	static char zpad[32];

	m = *mp;
	mlen = m_length(m, &mlast);

	blen = ec->ec_blocklen;
	mblen = ec->ec_msgblocklen;
	cklen = ec->ec_checksumlen;

	if (conf_req_flag) {
		/*
		 * For sealed messages, we need space for 16 bytes of
		 * header, blen confounder, plaintext, padding, copy
		 * of header and checksum.
		 *
		 * We pad to mblen (which may be different from
		 * blen). If the encryption class is using CTS, mblen
		 * will be one (i.e. no padding required).
		 */
		if (mblen > 1)
			EC = mlen % mblen;
		else
			EC = 0;
		ctlen = blen + mlen + EC + 16;

		/*
		 * Put initial header and confounder before the
		 * message.
		 */
		M_PREPEND(m, 16 + blen, M_WAITOK);

		/*
		 * Append padding + copy of header and checksum. Try
		 * to fit this into the end of the original message,
		 * otherwise allocate a trailer.
		 */
		if (M_TRAILINGSPACE(mlast) >= EC + 16 + cklen) {
			tm = NULL;
			mlast->m_len += EC + 16 + cklen;
		} else {
			MGET(tm, M_WAITOK, MT_DATA);
			tm->m_len = EC + 16 + cklen;
			mlast->m_next = tm;
		}
	} else {
		/*
		 * For unsealed messages, we need 16 bytes of header
		 * plus space for the plaintext and a checksum. EC is
		 * set to the checksum size. We leave space in tm for
		 * a copy of the header - this will be trimmed later.
		 */
		M_PREPEND(m, 16, M_WAITOK);

		MGET(tm, M_WAITOK, MT_DATA);
		tm->m_len = cklen + 16;
		mlast->m_next = tm;
		ctlen = 0;
		EC = cklen;
	}

	p = m->m_data;

	/* TOK_ID */
	p[0] = 0x05;
	p[1] = 0x04;

	/* Flags */
	flags = 0;
	if (conf_req_flag)
		flags = GSS_TOKEN_SEALED;
	if (is_acceptor(kc))
		flags |= GSS_TOKEN_SENT_BY_ACCEPTOR;
	if (kc->kc_more_flags & ACCEPTOR_SUBKEY)
		flags |= GSS_TOKEN_ACCEPTOR_SUBKEY;
	p[2] = flags;

	/* Filler */
	p[3] = 0xff;

	/* EC + RRC - set to zero initially */
	p[4] = 0;
	p[5] = 0;
	p[6] = 0;
	p[7] = 0;

	/* SND_SEQ */
	p[8] = 0;
	p[9] = 0;
	p[10] = 0;
	p[11] = 0;
	seq = atomic_fetchadd_32(&kc->kc_local_seqnumber, 1);
	p[12] = (seq >> 24);
	p[13] = (seq >> 16);
	p[14] = (seq >> 8);
	p[15] = (seq >> 0);

	if (conf_req_flag) {
		/*
		 * Encrypt according to RFC 4121 section 4.2 and RFC
		 * 3961 section 5.3. Note: we don't generate tokens
		 * with RRC values other than zero. If we did, we
		 * should zero RRC in the copied header.
		 */
		arc4rand(p + 16, blen, 0);
		if (EC) {
			m_copyback(m, 16 + blen + mlen, EC, zpad);
		}
		m_copyback(m, 16 + blen + mlen + EC, 16, p);

		krb5_checksum(Ki, 0, m, 16, ctlen, cklen);
		krb5_encrypt(Ke, m, 16, ctlen, NULL, 0);
	} else {
		/*
		 * The plaintext message is followed by a checksum of
		 * the plaintext plus a version of the header where EC
		 * and RRC are set to zero. Also, the original EC must
		 * be our checksum size.
		 */
		bcopy(p, tm->m_data, 16);
		krb5_checksum(Kc, 0, m, 16, mlen + 16, cklen);
		tm->m_data += 16;
		tm->m_len -= 16;
	}

	/*
	 * Finally set EC to its actual value
	 */
	p[4] = EC >> 8;
	p[5] = EC;

	*mp = m;
	return (GSS_S_COMPLETE);
}

static OM_uint32
krb5_wrap(gss_ctx_id_t ctx, OM_uint32 *minor_status,
    int conf_req_flag, gss_qop_t qop_req,
    struct mbuf **mp, int *conf_state)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;

	*minor_status = 0;
	if (conf_state)
		*conf_state = 0;

	if (qop_req != GSS_C_QOP_DEFAULT)
		return (GSS_S_BAD_QOP);

	if (time_uptime > kc->kc_lifetime)
		return (GSS_S_CONTEXT_EXPIRED);

	switch (kc->kc_tokenkey->ks_class->ec_type) {
	case ETYPE_DES_CBC_CRC:
		return (krb5_wrap_old(kc, conf_req_flag,
			mp, conf_state, sgn_alg_des_md5, seal_alg_des));

	case ETYPE_ARCFOUR_HMAC_MD5:
	case ETYPE_ARCFOUR_HMAC_MD5_56:
		return (krb5_wrap_old(kc, conf_req_flag,
			mp, conf_state, sgn_alg_hmac_md5, seal_alg_rc4));

	case ETYPE_DES3_CBC_SHA1:
		return (krb5_wrap_old(kc, conf_req_flag,
			mp, conf_state, sgn_alg_des3_sha1, seal_alg_des3));

	default:
		return (krb5_wrap_new(kc, conf_req_flag, mp, conf_state));
	}

	return (GSS_S_FAILURE);
}

static void
m_trim(struct mbuf *m, int len)
{
	struct mbuf *n;
	int off;

	if (m == NULL)
		return;
	n = m_getptr(m, len, &off);
	if (n) {
		n->m_len = off;
		if (n->m_next) {
			m_freem(n->m_next);
			n->m_next = NULL;
		}
	}
}

static OM_uint32
krb5_unwrap_old(struct krb5_context *kc, struct mbuf **mp, int *conf_state,
    uint8_t sgn_alg[2], uint8_t seal_alg[2])
{
	OM_uint32 res;
	struct mbuf *m, *mlast, *hm, *cm, *n;
	uint8_t *p, dir;
	size_t tlen, elen, datalen, padlen;
	size_t cklen;
	uint8_t buf[32];
	uint32_t seq;
	int i, conf;

	m = *mp;
	m_length(m, &mlast);

	tlen = token_length(kc->kc_tokenkey);
	cklen = kc->kc_tokenkey->ks_class->ec_checksumlen;

	p = krb5_verify_token("\x02\x01", tlen, &m, &elen, TRUE);
	*mp = m;
	if (!p)
		return (GSS_S_DEFECTIVE_TOKEN);
	datalen = elen - tlen;

	/*
	 * Trim the framing header first to make life a little easier
	 * later.
	 */
	m_adj(m, p - (uint8_t *) m->m_data);

	/* TOK_ID */
	p += 2;

	/* SGN_ALG */
	if (p[0] != sgn_alg[0] || p[1] != sgn_alg[1])
		return (GSS_S_DEFECTIVE_TOKEN);
	p += 2;

	/* SEAL_ALG */
	if (p[0] == seal_alg[0] && p[1] == seal_alg[1])
		conf = 1;
	else if (p[0] == 0xff && p[1] == 0xff)
		conf = 0;
	else
		return (GSS_S_DEFECTIVE_TOKEN);
	p += 2;

	if (p[0] != 0xff || p[1] != 0xff)
		return (GSS_S_DEFECTIVE_TOKEN);
	p += 2;

	/*
	 * SND_SEQ:
	 *
	 * Take the four bytes of the sequence number least
	 * significant first (most significant for ARCFOUR) followed
	 * by four bytes of direction marker (zero for initiator and
	 * 0xff for acceptor). Encrypt that data using the SGN_CKSUM
	 * as IV.
	 */
	krb5_decrypt(kc->kc_tokenkey, m, 8, 8, p + 8, 8);
	if (sgn_alg[0] == 0x11) {
		seq = p[3] | (p[2] << 8) | (p[1] << 16) | (p[0] << 24);
	} else {
		seq = p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
	}

	if (is_initiator(kc)) {
		dir = 0xff;
	} else {
		dir = 0;
	}
	if (p[4] != dir || p[5] != dir || p[6] != dir || p[7] != dir)
		return (GSS_S_DEFECTIVE_TOKEN);

	if (kc->kc_msg_order.km_flags &
	    (GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG)) {
		res = krb5_sequence_check(kc, seq);
		if (GSS_ERROR(res))
			return (res);
	} else {
		res = GSS_S_COMPLETE;
	}

	/*
	 * If the token was encrypted, decode it in-place.
	 */
	if (conf) {
		/*
		 * Decrypt the padded message with an IV of zero for
		 * DES and DES3 or an IV of the big-endian encoded
		 * sequence number for ARCFOUR.
		 */
		if (seal_alg[0] == 0x10) {
			krb5_decrypt(kc->kc_encryptkey, m, 16 + cklen,
			    datalen, p, 4);
		} else {
			krb5_decrypt(kc->kc_encryptkey, m, 16 + cklen,
			    datalen, NULL, 0);
		}
	}
	if (conf_state)
		*conf_state = conf;

	/*
	 * Check the trailing pad bytes.
	 * RFC1964 specifies between 1<->8 bytes, each with a binary value
	 * equal to the number of bytes.
	 */
	if (mlast->m_len > 0)
		padlen = mlast->m_data[mlast->m_len - 1];
	else {
		n = m_getptr(m, tlen + datalen - 1, &i);
		/*
		 * When the position is exactly equal to the # of data bytes
		 * in the mbuf list, m_getptr() will return the last mbuf in
		 * the list and an off == m_len for that mbuf, so that case
		 * needs to be checked as well as a NULL return.
		 */
		if (n == NULL || n->m_len == i)
			return (GSS_S_DEFECTIVE_TOKEN);
		padlen = n->m_data[i];
	}
	if (padlen < 1 || padlen > 8 || padlen > tlen + datalen)
		return (GSS_S_DEFECTIVE_TOKEN);
	m_copydata(m, tlen + datalen - padlen, padlen, buf);
	for (i = 0; i < padlen; i++) {
		if (buf[i] != padlen) {
			return (GSS_S_DEFECTIVE_TOKEN);
		}
	}

	/*
	 * SGN_CKSUM:
	 *
	 * Calculate the keyed checksum of the token header plus the
	 * padded message. We do a little mbuf surgery to trim out the
	 * parts we don't want to checksum.
	 */
	hm = m;
	*mp = m = m_split(m, 16 + cklen, M_WAITOK);
	mlast = m_last(m);
	hm->m_len = 8;
	hm->m_next = m;
	MGET(cm, M_WAITOK, MT_DATA);
	cm->m_len = cklen;
	mlast->m_next = cm;

	krb5_checksum(kc->kc_checksumkey, 13, hm, 0, datalen + 8, cklen);
	hm->m_next = NULL;
	mlast->m_next = NULL;

	if (bcmp(cm->m_data, hm->m_data + 16, cklen)) {
		m_freem(hm);
		m_free(cm);
		return (GSS_S_BAD_SIG);
	}
	m_freem(hm);
	m_free(cm);

	/*
	 * Trim off the confounder and padding.
	 */
	m_adj(m, 8);
	if (mlast->m_len >= padlen) {
		mlast->m_len -= padlen;
	} else {
		m_trim(m, datalen - 8 - padlen);
	}

	*mp = m;
	return (res);
}

static OM_uint32
krb5_unwrap_new(struct krb5_context *kc, struct mbuf **mp, int *conf_state)
{
	OM_uint32 res;
	struct krb5_key_state *Ke = kc->kc_recv_seal_Ke;
	struct krb5_key_state *Ki = kc->kc_recv_seal_Ki;
	struct krb5_key_state *Kc = kc->kc_recv_seal_Kc;
	const struct krb5_encryption_class *ec = Ke->ks_class;
	struct mbuf *m, *mlast, *hm, *cm;
	uint8_t *p;
	int sealed, flags, EC, RRC;
	size_t blen, cklen, ctlen, mlen, plen, tlen;
	char buf[32], buf2[32];

	m = *mp;
	mlen = m_length(m, &mlast);

	if (mlen <= 16)
		return (GSS_S_DEFECTIVE_TOKEN);
	if (m->m_len < 16) {
		m = m_pullup(m, 16);
		*mp = m;
	}
	p = m->m_data;

	/* TOK_ID */
	if (p[0] != 0x05)
		return (GSS_S_DEFECTIVE_TOKEN);
	if (p[1] != 0x04)
		return (GSS_S_DEFECTIVE_TOKEN);

	/* Flags */
	sealed = p[2] & GSS_TOKEN_SEALED;
	flags = sealed;
	if (is_initiator(kc))
		flags |= GSS_TOKEN_SENT_BY_ACCEPTOR;
	if (kc->kc_more_flags & ACCEPTOR_SUBKEY)
		flags |= GSS_TOKEN_ACCEPTOR_SUBKEY;
	if (p[2] != flags)
		return (GSS_S_DEFECTIVE_TOKEN);

	/* Filler */
	if (p[3] != 0xff)
		return (GSS_S_DEFECTIVE_TOKEN);

	/* EC + RRC */
	EC = (p[4] << 8) + p[5];
	RRC = (p[6] << 8) + p[7];

	/* SND_SEQ */
	if (kc->kc_msg_order.km_flags &
		(GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG)) {
		uint32_t seq;
		if (p[8] || p[9] || p[10] || p[11]) {
			res = GSS_S_UNSEQ_TOKEN;
		} else {
			seq = (p[12] << 24) | (p[13] << 16)
				| (p[14] << 8) | p[15];
			res = krb5_sequence_check(kc, seq);
		}
		if (GSS_ERROR(res))
			return (res);
	} else {
		res = GSS_S_COMPLETE;
	}

	/*
	 * Separate the header before dealing with RRC. We only need
	 * to keep the header if the message isn't encrypted.
	 */
	if (sealed) {
		hm = NULL;
		m_adj(m, 16);
	} else {
		hm = m;
		*mp = m = m_split(m, 16, M_WAITOK);
		mlast = m_last(m);
	}

	/*
	 * Undo the effects of RRC by rotating left.
	 */
	if (RRC > 0) {
		struct mbuf *rm;
		size_t rlen;

		rlen = mlen - 16;
		if (RRC <= sizeof(buf) && m->m_len >= rlen) {
			/*
			 * Simple case, just rearrange the bytes in m.
			 */
			bcopy(m->m_data, buf, RRC);
			bcopy(m->m_data + RRC, m->m_data, rlen - RRC);
			bcopy(buf, m->m_data + rlen - RRC, RRC);
		} else {
			/*
			 * More complicated - rearrange the mbuf
			 * chain.
			 */
			rm = m;
			*mp = m = m_split(m, RRC, M_WAITOK);
			m_cat(m, rm);
			mlast = rm;
		}
	}

	blen = ec->ec_blocklen;
	cklen = ec->ec_checksumlen;
	if (sealed) {
		/*
		 * Decrypt according to RFC 4121 section 4.2 and RFC
		 * 3961 section 5.3. The message must be large enough
		 * for a blocksize confounder, at least one block of
		 * cyphertext and a checksum.
		 */
		if (mlen < 16 + 2*blen + cklen)
			return (GSS_S_DEFECTIVE_TOKEN);

		ctlen = mlen - 16 - cklen;
		krb5_decrypt(Ke, m, 0, ctlen, NULL, 0);

		/*
		 * The size of the plaintext is ctlen minus blocklen
		 * (for the confounder), 16 (for the copy of the token
		 * header) and EC (for the filler). The actual
		 * plaintext starts after the confounder.
		 */
		plen = ctlen - blen - 16 - EC;

		/*
		 * Checksum the padded plaintext.
		 */
		m_copydata(m, ctlen, cklen, buf);
		krb5_checksum(Ki, 0, m, 0, ctlen, cklen);
		m_copydata(m, ctlen, cklen, buf2);

		if (bcmp(buf, buf2, cklen))
			return (GSS_S_BAD_SIG);

		/*
		 * Trim the message back to just plaintext.
		 */
		m_adj(m, blen);
		tlen = 16 + EC + cklen;
		if (mlast->m_len >= tlen) {
			mlast->m_len -= tlen;
		} else {
			m_trim(m, plen);
		}
	} else {
		/*
		 * The plaintext message is followed by a checksum of
		 * the plaintext plus a version of the header where EC
		 * and RRC are set to zero. Also, the original EC must
		 * be our checksum size.
		 */
		if (mlen < 16 + cklen || EC != cklen)
			return (GSS_S_DEFECTIVE_TOKEN);

		/*
		 * The size of the plaintext is simply the message
		 * size less header and checksum. The plaintext starts
		 * right after the header (which we have saved in hm).
		 */
		plen = mlen - 16 - cklen;

		/*
		 * Insert a copy of the header (with EC and RRC set to
		 * zero) between the plaintext message and the
		 * checksum.
		 */
		p = hm->m_data;
		p[4] = p[5] = p[6] = p[7] = 0;

		cm = m_split(m, plen, M_WAITOK);
		mlast = m_last(m);
		m->m_next = hm;
		hm->m_next = cm;

		bcopy(cm->m_data, buf, cklen);
		krb5_checksum(Kc, 0, m, 0, plen + 16, cklen);
		if (bcmp(cm->m_data, buf, cklen))
			return (GSS_S_BAD_SIG);

		/*
		 * The checksum matches, discard all buf the plaintext.
		 */
		mlast->m_next = NULL;
		m_freem(hm);
	}

	if (conf_state)
		*conf_state = (sealed != 0);

	return (res);
}

static OM_uint32
krb5_unwrap(gss_ctx_id_t ctx, OM_uint32 *minor_status,
    struct mbuf **mp, int *conf_state, gss_qop_t *qop_state)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;
	OM_uint32 maj_stat;

	*minor_status = 0;
	if (qop_state)
		*qop_state = GSS_C_QOP_DEFAULT;
	if (conf_state)
		*conf_state = 0;

	if (time_uptime > kc->kc_lifetime)
		return (GSS_S_CONTEXT_EXPIRED);

	switch (kc->kc_tokenkey->ks_class->ec_type) {
	case ETYPE_DES_CBC_CRC:
		maj_stat = krb5_unwrap_old(kc, mp, conf_state,
			sgn_alg_des_md5, seal_alg_des);
		break;

	case ETYPE_ARCFOUR_HMAC_MD5:
	case ETYPE_ARCFOUR_HMAC_MD5_56:
		maj_stat = krb5_unwrap_old(kc, mp, conf_state,
			sgn_alg_hmac_md5, seal_alg_rc4);
		break;

	case ETYPE_DES3_CBC_SHA1:
		maj_stat = krb5_unwrap_old(kc, mp, conf_state,
			sgn_alg_des3_sha1, seal_alg_des3);
		break;

	default:
		maj_stat = krb5_unwrap_new(kc, mp, conf_state);
		break;
	}

	if (GSS_ERROR(maj_stat)) {
		m_freem(*mp);
		*mp = NULL;
	}

	return (maj_stat);
}

static OM_uint32
krb5_wrap_size_limit(gss_ctx_id_t ctx, OM_uint32 *minor_status,
    int conf_req_flag, gss_qop_t qop_req, OM_uint32 req_output_size,
    OM_uint32 *max_input_size)
{
	struct krb5_context *kc = (struct krb5_context *)ctx;
	const struct krb5_encryption_class *ec;
	OM_uint32 overhead;

	*minor_status = 0;
	*max_input_size = 0;

	if (qop_req != GSS_C_QOP_DEFAULT)
		return (GSS_S_BAD_QOP);

	ec = kc->kc_tokenkey->ks_class;
	switch (ec->ec_type) {
	case ETYPE_DES_CBC_CRC:
	case ETYPE_DES3_CBC_SHA1:
	case ETYPE_ARCFOUR_HMAC_MD5:
	case ETYPE_ARCFOUR_HMAC_MD5_56:
		/*
		 * up to 5 bytes for [APPLICATION 0] SEQUENCE
		 * 2 + krb5 oid length
		 * 8 bytes of header
		 * 8 bytes of confounder
		 * maximum of 8 bytes of padding
		 * checksum
		 */
		overhead = 5 + 2 + krb5_mech_oid.length;
		overhead += 8 + 8 + ec->ec_msgblocklen;
		overhead += ec->ec_checksumlen;
		break;

	default:
		if (conf_req_flag) {
			/*
			 * 16 byts of header
			 * blocklen bytes of confounder
			 * up to msgblocklen - 1 bytes of padding
			 * 16 bytes for copy of header
			 * checksum
			 */
			overhead = 16 + ec->ec_blocklen;
			overhead += ec->ec_msgblocklen - 1;
			overhead += 16;
			overhead += ec->ec_checksumlen;
		} else {
			/*
			 * 16 bytes of header plus checksum.
			 */
			overhead = 16 + ec->ec_checksumlen;
		}
	}

	*max_input_size = req_output_size - overhead;

	return (GSS_S_COMPLETE);
}

static kobj_method_t krb5_methods[] = {
	KOBJMETHOD(kgss_init,		krb5_init),
	KOBJMETHOD(kgss_import,		krb5_import),
	KOBJMETHOD(kgss_delete,		krb5_delete),
	KOBJMETHOD(kgss_mech_type,	krb5_mech_type),
	KOBJMETHOD(kgss_get_mic,	krb5_get_mic),
	KOBJMETHOD(kgss_verify_mic,	krb5_verify_mic),
	KOBJMETHOD(kgss_wrap,		krb5_wrap),
	KOBJMETHOD(kgss_unwrap,		krb5_unwrap),
	KOBJMETHOD(kgss_wrap_size_limit, krb5_wrap_size_limit),
	{ 0, 0 }
};

static struct kobj_class krb5_class = {
	"kerberosv5",
	krb5_methods,
	sizeof(struct krb5_context)
};

/*
 * Kernel module glue
 */
static int
kgssapi_krb5_modevent(module_t mod, int type, void *data)
{

	switch (type) {
	case MOD_LOAD:
		kgss_install_mech(&krb5_mech_oid, "kerberosv5", &krb5_class);
		break;

	case MOD_UNLOAD:
		kgss_uninstall_mech(&krb5_mech_oid);
		break;
	}

	return (0);
}
static moduledata_t kgssapi_krb5_mod = {
	"kgssapi_krb5",
	kgssapi_krb5_modevent,
	NULL,
};
DECLARE_MODULE(kgssapi_krb5, kgssapi_krb5_mod, SI_SUB_VFS, SI_ORDER_ANY);
MODULE_DEPEND(kgssapi_krb5, kgssapi, 1, 1, 1);
MODULE_DEPEND(kgssapi_krb5, crypto, 1, 1, 1);
MODULE_DEPEND(kgssapi_krb5, rc4, 1, 1, 1);
MODULE_VERSION(kgssapi_krb5, 1);