1 /* 2 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 */ 5 6 /* 7 * Copyright 2000 by the Massachusetts Institute of Technology. 8 * All Rights Reserved. 9 * 10 * Export of this software from the United States of America may 11 * require a specific license from the United States Government. 12 * It is the responsibility of any person or organization contemplating 13 * export to obtain such a license before exporting. 14 * 15 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 16 * distribute this software and its documentation for any purpose and 17 * without fee is hereby granted, provided that the above copyright 18 * notice appear in all copies and that both that copyright notice and 19 * this permission notice appear in supporting documentation, and that 20 * the name of M.I.T. not be used in advertising or publicity pertaining 21 * to distribution of the software without specific, written prior 22 * permission. Furthermore if you modify this software you must label 23 * your software as modified software and not distribute it in such a 24 * fashion that it might be confused with the original M.I.T. software. 25 * M.I.T. makes no representations about the suitability of 26 * this software for any purpose. It is provided "as is" without express 27 * or implied warranty. 28 * 29 */ 30 /* 31 * Copyright 1993 by OpenVision Technologies, Inc. 32 * 33 * Permission to use, copy, modify, distribute, and sell this software 34 * and its documentation for any purpose is hereby granted without fee, 35 * provided that the above copyright notice appears in all copies and 36 * that both that copyright notice and this permission notice appear in 37 * supporting documentation, and that the name of OpenVision not be used 38 * in advertising or publicity pertaining to distribution of the software 39 * without specific, written prior permission. OpenVision makes no 40 * representations about the suitability of this software for any 41 * purpose. It is provided "as is" without express or implied warranty. 42 * 43 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, 44 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO 45 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR 46 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF 47 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR 48 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 49 * PERFORMANCE OF THIS SOFTWARE. 50 */ 51 52 /* 53 * Copyright (C) 1998 by the FundsXpress, INC. 54 * 55 * All rights reserved. 56 * 57 * Export of this software from the United States of America may require 58 * a specific license from the United States Government. It is the 59 * responsibility of any person or organization contemplating export to 60 * obtain such a license before exporting. 61 * 62 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 63 * distribute this software and its documentation for any purpose and 64 * without fee is hereby granted, provided that the above copyright 65 * notice appear in all copies and that both that copyright notice and 66 * this permission notice appear in supporting documentation, and that 67 * the name of FundsXpress. not be used in advertising or publicity pertaining 68 * to distribution of the software without specific, written prior 69 * permission. FundsXpress makes no representations about the suitability of 70 * this software for any purpose. It is provided "as is" without express 71 * or implied warranty. 72 * 73 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 74 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 75 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 76 */ 77 78 #include "gssapiP_krb5.h" 79 80 size_t KRB5_CALLCONV krb5_encrypt_size(size_t, krb5_enctype); 81 82 /* SUNW15resync - XXX find new home for this func */ 83 #ifdef _KERNEL 84 size_t KRB5_CALLCONV 85 krb5_encrypt_size(size_t length, krb5_enctype crypto) 86 { 87 size_t ret; 88 89 if (krb5_c_encrypt_length(/* XXX */ 0, crypto, length, &ret)) 90 /*LINTED*/ 91 return(-1); /* XXX */ 92 93 return(ret); 94 } 95 #endif 96 97 /* V2 interface */ 98 OM_uint32 99 krb5_gss_wrap_size_limit(minor_status, context_handle, conf_req_flag, 100 qop_req, req_output_size, max_input_size) 101 OM_uint32 *minor_status; 102 gss_ctx_id_t context_handle; 103 int conf_req_flag; 104 gss_qop_t qop_req; 105 OM_uint32 req_output_size; 106 OM_uint32 *max_input_size; 107 { 108 krb5_gss_ctx_id_rec *ctx; 109 OM_uint32 data_size, conflen; 110 OM_uint32 ohlen; 111 int overhead; 112 113 /* Solaris Kerb - check to make sure we aren't writing to a NULL pointer */ 114 if (!max_input_size) 115 return(GSS_S_CALL_INACCESSIBLE_WRITE); 116 117 /* only default qop is allowed */ 118 /* 119 * SUNW15resync 120 * mit 1.2-6: if (qop_req != GSS_C_QOP_DEFAULT) { 121 * Go with Solaris version here, though not sure which is 122 * correct and RFC 2743 does not make it clear. 123 */ 124 if ((qop_req & GSS_KRB5_CONF_C_QOP_MASK) != GSS_C_QOP_DEFAULT) { 125 *minor_status = (OM_uint32) G_UNKNOWN_QOP; 126 /* SUNW15resync - RFC 2743 is clear here but 127 this is still GSS_S_FAILURE in MIT */ 128 return(GSS_S_BAD_QOP); 129 } 130 131 /* validate the context handle */ 132 if (! kg_validate_ctx_id(context_handle)) { 133 *minor_status = (OM_uint32) G_VALIDATE_FAILED; 134 return(GSS_S_NO_CONTEXT); 135 } 136 137 ctx = (krb5_gss_ctx_id_rec *) context_handle; 138 if (! ctx->established) { 139 *minor_status = KG_CTX_INCOMPLETE; 140 return(GSS_S_NO_CONTEXT); 141 } 142 143 if (ctx->proto == 1) { 144 /* No pseudo-ASN.1 wrapper overhead, so no sequence length and 145 OID. */ 146 OM_uint32 sz = req_output_size; 147 /* Token header: 16 octets. */ 148 if (conf_req_flag) { 149 while (sz > 0 && krb5_encrypt_size(sz, ctx->enc->enctype) + 16 > req_output_size) 150 sz--; 151 /* Allow for encrypted copy of header. */ 152 if (sz > 16) 153 sz -= 16; 154 else 155 sz = 0; 156 #ifdef CFX_EXERCISE 157 /* Allow for EC padding. In the MIT implementation, only 158 added while testing. */ 159 if (sz > 65535) 160 sz -= 65535; 161 else 162 sz = 0; 163 #endif 164 } else { 165 /* Allow for token header and checksum. */ 166 if (sz < 16 + ctx->cksum_size) 167 sz = 0; 168 else 169 sz -= (16 + ctx->cksum_size); 170 } 171 172 *max_input_size = sz; 173 *minor_status = 0; 174 return GSS_S_COMPLETE; 175 } 176 177 /* Calculate the token size and subtract that from the output size */ 178 overhead = 7 + ctx->mech_used->length; 179 data_size = req_output_size; 180 conflen = kg_confounder_size(ctx->k5_context, ctx->enc); 181 data_size = (conflen + data_size + 8) & (~(OM_uint32)7); 182 ohlen = g_token_size(ctx->mech_used, 183 (unsigned int) (data_size + ctx->cksum_size + 14)) 184 - req_output_size; 185 186 if (ohlen+overhead < req_output_size) 187 /* 188 * Cannot have trailer length that will cause us to pad over our 189 * length. 190 */ 191 *max_input_size = (req_output_size - ohlen - overhead) & (~(OM_uint32)7); 192 else 193 *max_input_size = 0; 194 195 *minor_status = 0; 196 return(GSS_S_COMPLETE); 197 } 198