crypto/heimdal/lib/gssapi/krb5/arcfour.c

   1 /*
   2  * Copyright (c) 2003 - 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5/gsskrb5_locl.h"
  35
  36 RCSID("$Id: arcfour.c 19031 2006-11-13 18:02:57Z lha $");
  37
  38 /*
  39  * Implements draft-brezak-win2k-krb-rc4-hmac-04.txt
  40  *
  41  * The arcfour message have the following formats:
  42  *
  43  * MIC token
  44  *      TOK_ID[2] = 01 01
  45  *      SGN_ALG[2] = 11 00
  46  *      Filler[4]
  47  *      SND_SEQ[8]
  48  *      SGN_CKSUM[8]
  49  *
  50  * WRAP token
  51  *      TOK_ID[2] = 02 01
  52  *      SGN_ALG[2];
  53  *      SEAL_ALG[2]
  54  *      Filler[2]
  55  *      SND_SEQ[2]
  56  *      SGN_CKSUM[8]
  57  *      Confounder[8]
  58  */
  59
  60 /*
  61  * WRAP in DCE-style have a fixed size header, the oid and length over
  62  * the WRAP header is a total of
  63  * GSS_ARCFOUR_WRAP_TOKEN_DCE_DER_HEADER_SIZE +
  64  * GSS_ARCFOUR_WRAP_TOKEN_SIZE byte (ie total of 45 bytes overhead,
  65  * remember the 2 bytes from APPL [0] SEQ).
  66  */
  67
  68 #define GSS_ARCFOUR_WRAP_TOKEN_SIZE 32
  69 #define GSS_ARCFOUR_WRAP_TOKEN_DCE_DER_HEADER_SIZE 13
  70
  71
  72 static krb5_error_code
  73 arcfour_mic_key(krb5_context context, krb5_keyblock *key,
  74                 void *cksum_data, size_t cksum_size,
  75                 void *key6_data, size_t key6_size)
  76 {
  77     krb5_error_code ret;
  78
  79     Checksum cksum_k5;
  80     krb5_keyblock key5;
  81     char k5_data[16];
  82
  83     Checksum cksum_k6;
  84
  85     char T[4];
  86
  87     memset(T, 0, 4);
  88     cksum_k5.checksum.data = k5_data;
  89     cksum_k5.checksum.length = sizeof(k5_data);
  90
  91     if (key->keytype == KEYTYPE_ARCFOUR_56) {
  92         char L40[14] = "fortybits";
  93
  94         memcpy(L40 + 10, T, sizeof(T));
  95         ret = krb5_hmac(context, CKSUMTYPE_RSA_MD5,
  96                         L40, 14, 0, key, &cksum_k5);
  97         memset(&k5_data[7], 0xAB, 9);
  98     } else {
  99         ret = krb5_hmac(context, CKSUMTYPE_RSA_MD5,
 100                         T, 4, 0, key, &cksum_k5);
 101     }
 102     if (ret)
 103         return ret;
 104
 105     key5.keytype = KEYTYPE_ARCFOUR;
 106     key5.keyvalue = cksum_k5.checksum;
 107
 108     cksum_k6.checksum.data = key6_data;
 109     cksum_k6.checksum.length = key6_size;
 110
 111     return krb5_hmac(context, CKSUMTYPE_RSA_MD5,
 112                      cksum_data, cksum_size, 0, &key5, &cksum_k6);
 113 }
 114
 115
 116 static krb5_error_code
 117 arcfour_mic_cksum(krb5_context context,
 118                   krb5_keyblock *key, unsigned usage,
 119                   u_char *sgn_cksum, size_t sgn_cksum_sz,
 120                   const u_char *v1, size_t l1,
 121                   const void *v2, size_t l2,
 122                   const void *v3, size_t l3)
 123 {
 124     Checksum CKSUM;
 125     u_char *ptr;
 126     size_t len;
 127     krb5_crypto crypto;
 128     krb5_error_code ret;
 129
 130     assert(sgn_cksum_sz == 8);
 131
 132     len = l1 + l2 + l3;
 133
 134     ptr = malloc(len);
 135     if (ptr == NULL)
 136         return ENOMEM;
 137
 138     memcpy(ptr, v1, l1);
 139     memcpy(ptr + l1, v2, l2);
 140     memcpy(ptr + l1 + l2, v3, l3);
 141
 142     ret = krb5_crypto_init(context, key, 0, &crypto);
 143     if (ret) {
 144         free(ptr);
 145         return ret;
 146     }
 147
 148     ret = krb5_create_checksum(context,
 149                                crypto,
 150                                usage,
 151                                0,
 152                                ptr, len,
 153                                &CKSUM);
 154     free(ptr);
 155     if (ret == 0) {
 156         memcpy(sgn_cksum, CKSUM.checksum.data, sgn_cksum_sz);
 157         free_Checksum(&CKSUM);
 158     }
 159     krb5_crypto_destroy(context, crypto);
 160
 161     return ret;
 162 }
 163
 164
 165 OM_uint32
 166 _gssapi_get_mic_arcfour(OM_uint32 * minor_status,
 167                         const gsskrb5_ctx context_handle,
 168                         krb5_context context,
 169                         gss_qop_t qop_req,
 170                         const gss_buffer_t message_buffer,
 171                         gss_buffer_t message_token,
 172                         krb5_keyblock *key)
 173 {
 174     krb5_error_code ret;
 175     int32_t seq_number;
 176     size_t len, total_len;
 177     u_char k6_data[16], *p0, *p;
 178     RC4_KEY rc4_key;
 179
 180     _gsskrb5_encap_length (22, &len, &total_len, GSS_KRB5_MECHANISM);
 181
 182     message_token->length = total_len;
 183     message_token->value  = malloc (total_len);
 184     if (message_token->value == NULL) {
 185         *minor_status = ENOMEM;
 186         return GSS_S_FAILURE;
 187     }
 188
 189     p0 = _gssapi_make_mech_header(message_token->value,
 190                                   len,
 191                                   GSS_KRB5_MECHANISM);
 192     p = p0;
 193
 194     *p++ = 0x01; /* TOK_ID */
 195     *p++ = 0x01;
 196     *p++ = 0x11; /* SGN_ALG */
 197     *p++ = 0x00;
 198     *p++ = 0xff; /* Filler */
 199     *p++ = 0xff;
 200     *p++ = 0xff;
 201     *p++ = 0xff;
 202
 203     p = NULL;
 204
 205     ret = arcfour_mic_cksum(context,
 206                             key, KRB5_KU_USAGE_SIGN,
 207                             p0 + 16, 8,  /* SGN_CKSUM */
 208                             p0, 8, /* TOK_ID, SGN_ALG, Filer */
 209                             message_buffer->value, message_buffer->length,
 210                             NULL, 0);
 211     if (ret) {
 212         _gsskrb5_release_buffer(minor_status, message_token);
 213         *minor_status = ret;
 214         return GSS_S_FAILURE;
 215     }
 216
 217     ret = arcfour_mic_key(context, key,
 218                           p0 + 16, 8, /* SGN_CKSUM */
 219                           k6_data, sizeof(k6_data));
 220     if (ret) {
 221         _gsskrb5_release_buffer(minor_status, message_token);
 222         *minor_status = ret;
 223         return GSS_S_FAILURE;
 224     }
 225
 226     HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
 227     krb5_auth_con_getlocalseqnumber (context,
 228                                      context_handle->auth_context,
 229                                      &seq_number);
 230     p = p0 + 8; /* SND_SEQ */
 231     _gsskrb5_encode_be_om_uint32(seq_number, p);
 232
 233     krb5_auth_con_setlocalseqnumber (context,
 234                                      context_handle->auth_context,
 235                                      ++seq_number);
 236     HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
 237
 238     memset (p + 4, (context_handle->more_flags & LOCAL) ? 0 : 0xff, 4);
 239
 240     RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 241     RC4 (&rc4_key, 8, p, p);
 242
 243     memset(&rc4_key, 0, sizeof(rc4_key));
 244     memset(k6_data, 0, sizeof(k6_data));
 245
 246     *minor_status = 0;
 247     return GSS_S_COMPLETE;
 248 }
 249
 250
 251 OM_uint32
 252 _gssapi_verify_mic_arcfour(OM_uint32 * minor_status,
 253                            const gsskrb5_ctx context_handle,
 254                            krb5_context context,
 255                            const gss_buffer_t message_buffer,
 256                            const gss_buffer_t token_buffer,
 257                            gss_qop_t * qop_state,
 258                            krb5_keyblock *key,
 259                            char *type)
 260 {
 261     krb5_error_code ret;
 262     uint32_t seq_number;
 263     OM_uint32 omret;
 264     u_char SND_SEQ[8], cksum_data[8], *p;
 265     char k6_data[16];
 266     int cmp;
 267
 268     if (qop_state)
 269         *qop_state = 0;
 270
 271     p = token_buffer->value;
 272     omret = _gsskrb5_verify_header (&p,
 273                                        token_buffer->length,
 274                                        (u_char *)type,
 275                                        GSS_KRB5_MECHANISM);
 276     if (omret)
 277         return omret;
 278
 279     if (memcmp(p, "\x11\x00", 2) != 0) /* SGN_ALG = HMAC MD5 ARCFOUR */
 280         return GSS_S_BAD_SIG;
 281     p += 2;
 282     if (memcmp (p, "\xff\xff\xff\xff", 4) != 0)
 283         return GSS_S_BAD_MIC;
 284     p += 4;
 285
 286     ret = arcfour_mic_cksum(context,
 287                             key, KRB5_KU_USAGE_SIGN,
 288                             cksum_data, sizeof(cksum_data),
 289                             p - 8, 8,
 290                             message_buffer->value, message_buffer->length,
 291                             NULL, 0);
 292     if (ret) {
 293         *minor_status = ret;
 294         return GSS_S_FAILURE;
 295     }
 296
 297     ret = arcfour_mic_key(context, key,
 298                           cksum_data, sizeof(cksum_data),
 299                           k6_data, sizeof(k6_data));
 300     if (ret) {
 301         *minor_status = ret;
 302         return GSS_S_FAILURE;
 303     }
 304
 305     cmp = memcmp(cksum_data, p + 8, 8);
 306     if (cmp) {
 307         *minor_status = 0;
 308         return GSS_S_BAD_MIC;
 309     }
 310
 311     {
 312         RC4_KEY rc4_key;
 313
 314         RC4_set_key (&rc4_key, sizeof(k6_data), (void*)k6_data);
 315         RC4 (&rc4_key, 8, p, SND_SEQ);
 316
 317         memset(&rc4_key, 0, sizeof(rc4_key));
 318         memset(k6_data, 0, sizeof(k6_data));
 319     }
 320
 321     _gsskrb5_decode_be_om_uint32(SND_SEQ, &seq_number);
 322
 323     if (context_handle->more_flags & LOCAL)
 324         cmp = memcmp(&SND_SEQ[4], "\xff\xff\xff\xff", 4);
 325     else
 326         cmp = memcmp(&SND_SEQ[4], "\x00\x00\x00\x00", 4);
 327
 328     memset(SND_SEQ, 0, sizeof(SND_SEQ));
 329     if (cmp != 0) {
 330         *minor_status = 0;
 331         return GSS_S_BAD_MIC;
 332     }
 333
 334     HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
 335     omret = _gssapi_msg_order_check(context_handle->order, seq_number);
 336     HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
 337     if (omret)
 338         return omret;
 339
 340     *minor_status = 0;
 341     return GSS_S_COMPLETE;
 342 }
 343
 344 OM_uint32
 345 _gssapi_wrap_arcfour(OM_uint32 * minor_status,
 346                      const gsskrb5_ctx context_handle,
 347                      krb5_context context,
 348                      int conf_req_flag,
 349                      gss_qop_t qop_req,
 350                      const gss_buffer_t input_message_buffer,
 351                      int * conf_state,
 352                      gss_buffer_t output_message_buffer,
 353                      krb5_keyblock *key)
 354 {
 355     u_char Klocaldata[16], k6_data[16], *p, *p0;
 356     size_t len, total_len, datalen;
 357     krb5_keyblock Klocal;
 358     krb5_error_code ret;
 359     int32_t seq_number;
 360
 361     if (conf_state)
 362         *conf_state = 0;
 363
 364     datalen = input_message_buffer->length;
 365
 366     if (IS_DCE_STYLE(context_handle)) {
 367         len = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 368         _gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
 369         total_len += datalen;
 370     } else {
 371         datalen += 1; /* padding */
 372         len = datalen + GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 373         _gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
 374     }
 375
 376     output_message_buffer->length = total_len;
 377     output_message_buffer->value  = malloc (total_len);
 378     if (output_message_buffer->value == NULL) {
 379         *minor_status = ENOMEM;
 380         return GSS_S_FAILURE;
 381     }
 382
 383     p0 = _gssapi_make_mech_header(output_message_buffer->value,
 384                                   len,
 385                                   GSS_KRB5_MECHANISM);
 386     p = p0;
 387
 388     *p++ = 0x02; /* TOK_ID */
 389     *p++ = 0x01;
 390     *p++ = 0x11; /* SGN_ALG */
 391     *p++ = 0x00;
 392     if (conf_req_flag) {
 393         *p++ = 0x10; /* SEAL_ALG */
 394         *p++ = 0x00;
 395     } else {
 396         *p++ = 0xff; /* SEAL_ALG */
 397         *p++ = 0xff;
 398     }
 399     *p++ = 0xff; /* Filler */
 400     *p++ = 0xff;
 401
 402     p = NULL;
 403
 404     HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
 405     krb5_auth_con_getlocalseqnumber (context,
 406                                      context_handle->auth_context,
 407                                      &seq_number);
 408
 409     _gsskrb5_encode_be_om_uint32(seq_number, p0 + 8);
 410
 411     krb5_auth_con_setlocalseqnumber (context,
 412                                      context_handle->auth_context,
 413                                      ++seq_number);
 414     HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
 415
 416     memset (p0 + 8 + 4,
 417             (context_handle->more_flags & LOCAL) ? 0 : 0xff,
 418             4);
 419
 420     krb5_generate_random_block(p0 + 24, 8); /* fill in Confounder */
 421
 422     /* p points to data */
 423     p = p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 424     memcpy(p, input_message_buffer->value, input_message_buffer->length);
 425
 426     if (!IS_DCE_STYLE(context_handle))
 427         p[input_message_buffer->length] = 1; /* padding */
 428
 429     ret = arcfour_mic_cksum(context,
 430                             key, KRB5_KU_USAGE_SEAL,
 431                             p0 + 16, 8, /* SGN_CKSUM */
 432                             p0, 8, /* TOK_ID, SGN_ALG, SEAL_ALG, Filler */
 433                             p0 + 24, 8, /* Confounder */
 434                             p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE,
 435                             datalen);
 436     if (ret) {
 437         *minor_status = ret;
 438         _gsskrb5_release_buffer(minor_status, output_message_buffer);
 439         return GSS_S_FAILURE;
 440     }
 441
 442     {
 443         int i;
 444
 445         Klocal.keytype = key->keytype;
 446         Klocal.keyvalue.data = Klocaldata;
 447         Klocal.keyvalue.length = sizeof(Klocaldata);
 448
 449         for (i = 0; i < 16; i++)
 450             Klocaldata[i] = ((u_char *)key->keyvalue.data)[i] ^ 0xF0;
 451     }
 452     ret = arcfour_mic_key(context, &Klocal,
 453                           p0 + 8, 4, /* SND_SEQ */
 454                           k6_data, sizeof(k6_data));
 455     memset(Klocaldata, 0, sizeof(Klocaldata));
 456     if (ret) {
 457         _gsskrb5_release_buffer(minor_status, output_message_buffer);
 458         *minor_status = ret;
 459         return GSS_S_FAILURE;
 460     }
 461
 462
 463     if(conf_req_flag) {
 464         RC4_KEY rc4_key;
 465
 466         RC4_set_key (&rc4_key, sizeof(k6_data), (void *)k6_data);
 467         /* XXX ? */
 468         RC4 (&rc4_key, 8 + datalen, p0 + 24, p0 + 24); /* Confounder + data */
 469         memset(&rc4_key, 0, sizeof(rc4_key));
 470     }
 471     memset(k6_data, 0, sizeof(k6_data));
 472
 473     ret = arcfour_mic_key(context, key,
 474                           p0 + 16, 8, /* SGN_CKSUM */
 475                           k6_data, sizeof(k6_data));
 476     if (ret) {
 477         _gsskrb5_release_buffer(minor_status, output_message_buffer);
 478         *minor_status = ret;
 479         return GSS_S_FAILURE;
 480     }
 481
 482     {
 483         RC4_KEY rc4_key;
 484
 485         RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 486         RC4 (&rc4_key, 8, p0 + 8, p0 + 8); /* SND_SEQ */
 487         memset(&rc4_key, 0, sizeof(rc4_key));
 488         memset(k6_data, 0, sizeof(k6_data));
 489     }
 490
 491     if (conf_state)
 492         *conf_state = conf_req_flag;
 493
 494     *minor_status = 0;
 495     return GSS_S_COMPLETE;
 496 }
 497
 498 OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status,
 499                                  const gsskrb5_ctx context_handle,
 500                                  krb5_context context,
 501                                  const gss_buffer_t input_message_buffer,
 502                                  gss_buffer_t output_message_buffer,
 503                                  int *conf_state,
 504                                  gss_qop_t *qop_state,
 505                                  krb5_keyblock *key)
 506 {
 507     u_char Klocaldata[16];
 508     krb5_keyblock Klocal;
 509     krb5_error_code ret;
 510     uint32_t seq_number;
 511     size_t datalen;
 512     OM_uint32 omret;
 513     u_char k6_data[16], SND_SEQ[8], Confounder[8];
 514     u_char cksum_data[8];
 515     u_char *p, *p0;
 516     int cmp;
 517     int conf_flag;
 518     size_t padlen = 0, len;
 519
 520     if (conf_state)
 521         *conf_state = 0;
 522     if (qop_state)
 523         *qop_state = 0;
 524
 525     p0 = input_message_buffer->value;
 526
 527     if (IS_DCE_STYLE(context_handle)) {
 528         len = GSS_ARCFOUR_WRAP_TOKEN_SIZE +
 529             GSS_ARCFOUR_WRAP_TOKEN_DCE_DER_HEADER_SIZE;
 530         if (input_message_buffer->length < len)
 531             return GSS_S_BAD_MECH;
 532     } else {
 533         len = input_message_buffer->length;
 534     }
 535
 536     omret = _gssapi_verify_mech_header(&p0,
 537                                        len,
 538                                        GSS_KRB5_MECHANISM);
 539     if (omret)
 540         return omret;
 541
 542     /* length of mech header */
 543     len = (p0 - (u_char *)input_message_buffer->value) +
 544         GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 545
 546     if (len > input_message_buffer->length)
 547         return GSS_S_BAD_MECH;
 548
 549     /* length of data */
 550     datalen = input_message_buffer->length - len;
 551
 552     p = p0;
 553
 554     if (memcmp(p, "\x02\x01", 2) != 0)
 555         return GSS_S_BAD_SIG;
 556     p += 2;
 557     if (memcmp(p, "\x11\x00", 2) != 0) /* SGN_ALG = HMAC MD5 ARCFOUR */
 558         return GSS_S_BAD_SIG;
 559     p += 2;
 560
 561     if (memcmp (p, "\x10\x00", 2) == 0)
 562         conf_flag = 1;
 563     else if (memcmp (p, "\xff\xff", 2) == 0)
 564         conf_flag = 0;
 565     else
 566         return GSS_S_BAD_SIG;
 567
 568     p += 2;
 569     if (memcmp (p, "\xff\xff", 2) != 0)
 570         return GSS_S_BAD_MIC;
 571     p = NULL;
 572
 573     ret = arcfour_mic_key(context, key,
 574                           p0 + 16, 8, /* SGN_CKSUM */
 575                           k6_data, sizeof(k6_data));
 576     if (ret) {
 577         *minor_status = ret;
 578         return GSS_S_FAILURE;
 579     }
 580
 581     {
 582         RC4_KEY rc4_key;
 583
 584         RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 585         RC4 (&rc4_key, 8, p0 + 8, SND_SEQ); /* SND_SEQ */
 586         memset(&rc4_key, 0, sizeof(rc4_key));
 587         memset(k6_data, 0, sizeof(k6_data));
 588     }
 589
 590     _gsskrb5_decode_be_om_uint32(SND_SEQ, &seq_number);
 591
 592     if (context_handle->more_flags & LOCAL)
 593         cmp = memcmp(&SND_SEQ[4], "\xff\xff\xff\xff", 4);
 594     else
 595         cmp = memcmp(&SND_SEQ[4], "\x00\x00\x00\x00", 4);
 596
 597     if (cmp != 0) {
 598         *minor_status = 0;
 599         return GSS_S_BAD_MIC;
 600     }
 601
 602     {
 603         int i;
 604
 605         Klocal.keytype = key->keytype;
 606         Klocal.keyvalue.data = Klocaldata;
 607         Klocal.keyvalue.length = sizeof(Klocaldata);
 608
 609         for (i = 0; i < 16; i++)
 610             Klocaldata[i] = ((u_char *)key->keyvalue.data)[i] ^ 0xF0;
 611     }
 612     ret = arcfour_mic_key(context, &Klocal,
 613                           SND_SEQ, 4,
 614                           k6_data, sizeof(k6_data));
 615     memset(Klocaldata, 0, sizeof(Klocaldata));
 616     if (ret) {
 617         *minor_status = ret;
 618         return GSS_S_FAILURE;
 619     }
 620
 621     output_message_buffer->value = malloc(datalen);
 622     if (output_message_buffer->value == NULL) {
 623         *minor_status = ENOMEM;
 624         return GSS_S_FAILURE;
 625     }
 626     output_message_buffer->length = datalen;
 627
 628     if(conf_flag) {
 629         RC4_KEY rc4_key;
 630
 631         RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 632         RC4 (&rc4_key, 8, p0 + 24, Confounder); /* Confounder */
 633         RC4 (&rc4_key, datalen, p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE,
 634              output_message_buffer->value);
 635         memset(&rc4_key, 0, sizeof(rc4_key));
 636     } else {
 637         memcpy(Confounder, p0 + 24, 8); /* Confounder */
 638         memcpy(output_message_buffer->value,
 639                p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE,
 640                datalen);
 641     }
 642     memset(k6_data, 0, sizeof(k6_data));
 643
 644     if (!IS_DCE_STYLE(context_handle)) {
 645         ret = _gssapi_verify_pad(output_message_buffer, datalen, &padlen);
 646         if (ret) {
 647             _gsskrb5_release_buffer(minor_status, output_message_buffer);
 648             *minor_status = 0;
 649             return ret;
 650         }
 651         output_message_buffer->length -= padlen;
 652     }
 653
 654     ret = arcfour_mic_cksum(context,
 655                             key, KRB5_KU_USAGE_SEAL,
 656                             cksum_data, sizeof(cksum_data),
 657                             p0, 8,
 658                             Confounder, sizeof(Confounder),
 659                             output_message_buffer->value,
 660                             output_message_buffer->length + padlen);
 661     if (ret) {
 662         _gsskrb5_release_buffer(minor_status, output_message_buffer);
 663         *minor_status = ret;
 664         return GSS_S_FAILURE;
 665     }
 666
 667     cmp = memcmp(cksum_data, p0 + 16, 8); /* SGN_CKSUM */
 668     if (cmp) {
 669         _gsskrb5_release_buffer(minor_status, output_message_buffer);
 670         *minor_status = 0;
 671         return GSS_S_BAD_MIC;
 672     }
 673
 674     HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
 675     omret = _gssapi_msg_order_check(context_handle->order, seq_number);
 676     HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
 677     if (omret)
 678         return omret;
 679
 680     if (conf_state)
 681         *conf_state = conf_flag;
 682
 683     *minor_status = 0;
 684     return GSS_S_COMPLETE;
 685 }
 686
 687 static OM_uint32
 688 max_wrap_length_arcfour(const gsskrb5_ctx ctx,
 689                         krb5_crypto crypto,
 690                         size_t input_length,
 691                         OM_uint32 *max_input_size)
 692 {
 693     /*
 694      * if GSS_C_DCE_STYLE is in use:
 695      *  - we only need to encapsulate the WRAP token
 696      * However, since this is a fixed since, we just
 697      */
 698     if (IS_DCE_STYLE(ctx)) {
 699         size_t len, total_len;
 700
 701         len = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 702         _gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
 703
 704         if (input_length < len)
 705             *max_input_size = 0;
 706         else
 707             *max_input_size = input_length - len;
 708
 709     } else {
 710         size_t extrasize = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 711         size_t blocksize = 8;
 712         size_t len, total_len;
 713
 714         len = 8 + input_length + blocksize + extrasize;
 715
 716         _gsskrb5_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
 717
 718         total_len -= input_length; /* token length */
 719         if (total_len < input_length) {
 720             *max_input_size = (input_length - total_len);
 721             (*max_input_size) &= (~(OM_uint32)(blocksize - 1));
 722         } else {
 723             *max_input_size = 0;
 724         }
 725     }
 726
 727     return GSS_S_COMPLETE;
 728 }
 729
 730 OM_uint32
 731 _gssapi_wrap_size_arcfour(OM_uint32 *minor_status,
 732                           const gsskrb5_ctx ctx,
 733                           krb5_context context,
 734                           int conf_req_flag,
 735                           gss_qop_t qop_req,
 736                           OM_uint32 req_output_size,
 737                           OM_uint32 *max_input_size,
 738                           krb5_keyblock *key)
 739 {
 740     krb5_error_code ret;
 741     krb5_crypto crypto;
 742
 743     ret = krb5_crypto_init(context, key, 0, &crypto);
 744     if (ret != 0) {
 745         *minor_status = ret;
 746         return GSS_S_FAILURE;
 747     }
 748
 749     ret = max_wrap_length_arcfour(ctx, crypto,
 750                                   req_output_size, max_input_size);
 751     if (ret != 0) {
 752         *minor_status = ret;
 753         krb5_crypto_destroy(context, crypto);
 754         return GSS_S_FAILURE;
 755     }
 756
 757     krb5_crypto_destroy(context, crypto);
 758
 759     return GSS_S_COMPLETE;
 760 }