1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * MICwrap.c
24*0Sstevel@tonic-gate *
25*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved.
26*0Sstevel@tonic-gate * Use is subject to license terms.
27*0Sstevel@tonic-gate *
28*0Sstevel@tonic-gate */
29*0Sstevel@tonic-gate
30*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
31*0Sstevel@tonic-gate
32*0Sstevel@tonic-gate #include <sys/note.h>
33*0Sstevel@tonic-gate #include "dh_gssapi.h"
34*0Sstevel@tonic-gate #include "crypto.h"
35*0Sstevel@tonic-gate
36*0Sstevel@tonic-gate /*
37*0Sstevel@tonic-gate * This module implements the GSS-API entry points gss_sign,
38*0Sstevel@tonic-gate * gss_verify, gss_seal, and gss_unseal.
39*0Sstevel@tonic-gate */
40*0Sstevel@tonic-gate
41*0Sstevel@tonic-gate /*
42*0Sstevel@tonic-gate * __dh_gss_sign: Sign (Caluculate a check sum as specified by the qop
43*0Sstevel@tonic-gate * and encrypt it with a cipher also determined by the qop using the context
44*0Sstevel@tonic-gate * session keys). the message with the given qop and return
45*0Sstevel@tonic-gate * a Diffie-Hellman DH_MIC token pointed to by token.
46*0Sstevel@tonic-gate */
47*0Sstevel@tonic-gate
48*0Sstevel@tonic-gate OM_uint32
__dh_gss_sign(void * ctx,OM_uint32 * minor,gss_ctx_id_t context,int qop_req,gss_buffer_t message,gss_buffer_t token)49*0Sstevel@tonic-gate __dh_gss_sign(void *ctx, /* Per mechanism context (not used) */
50*0Sstevel@tonic-gate OM_uint32 *minor, /* Mechanism status */
51*0Sstevel@tonic-gate gss_ctx_id_t context, /* GSS context */
52*0Sstevel@tonic-gate int qop_req, /* Requested qop */
53*0Sstevel@tonic-gate gss_buffer_t message, /* Input message */
54*0Sstevel@tonic-gate gss_buffer_t token /* output token */)
55*0Sstevel@tonic-gate {
56*0Sstevel@tonic-gate _NOTE(ARGUNUSED(ctx))
57*0Sstevel@tonic-gate /* context is a Diffie-Hellman context */
58*0Sstevel@tonic-gate dh_gss_context_t cntx = (dh_gss_context_t)context;
59*0Sstevel@tonic-gate dh_token_desc tok;
60*0Sstevel@tonic-gate /* grap a pointer to the mic part of the token */
61*0Sstevel@tonic-gate dh_mic_t mic = &tok.ver.dh_version_u.body.dh_token_body_desc_u.sign;
62*0Sstevel@tonic-gate dh_key_set keys;
63*0Sstevel@tonic-gate
64*0Sstevel@tonic-gate /*
65*0Sstevel@tonic-gate * Make sure we can return the mechanism status an the token
66*0Sstevel@tonic-gate * containning the MIC
67*0Sstevel@tonic-gate */
68*0Sstevel@tonic-gate if (minor == 0 || token == GSS_C_NO_BUFFER)
69*0Sstevel@tonic-gate return (GSS_S_CALL_INACCESSIBLE_WRITE);
70*0Sstevel@tonic-gate
71*0Sstevel@tonic-gate /* Make sure the context is valid */
72*0Sstevel@tonic-gate if ((*minor = __dh_validate_context(cntx)) != DH_SUCCESS)
73*0Sstevel@tonic-gate return (GSS_S_NO_CONTEXT);
74*0Sstevel@tonic-gate
75*0Sstevel@tonic-gate /* that it is established, */
76*0Sstevel@tonic-gate if (cntx->state != ESTABLISHED)
77*0Sstevel@tonic-gate return (GSS_S_NO_CONTEXT);
78*0Sstevel@tonic-gate
79*0Sstevel@tonic-gate /* and that it has not expired */
80*0Sstevel@tonic-gate if (cntx->expire != GSS_C_INDEFINITE && cntx->expire < time(0))
81*0Sstevel@tonic-gate return (GSS_S_CONTEXT_EXPIRED);
82*0Sstevel@tonic-gate
83*0Sstevel@tonic-gate /* Package the context session keys in a key_set for __make_token */
84*0Sstevel@tonic-gate keys.dh_key_set_len = cntx->no_keys;
85*0Sstevel@tonic-gate keys.dh_key_set_val = cntx->keys;
86*0Sstevel@tonic-gate
87*0Sstevel@tonic-gate /* Set the token version number and type */
88*0Sstevel@tonic-gate tok.ver.verno = cntx->proto_version;
89*0Sstevel@tonic-gate tok.ver.dh_version_u.body.type = DH_MIC;
90*0Sstevel@tonic-gate
91*0Sstevel@tonic-gate /* Set the token qop, seq_number and client flag */
92*0Sstevel@tonic-gate mic->qop = qop_req;
93*0Sstevel@tonic-gate
94*0Sstevel@tonic-gate mic->seqnum = __dh_next_seqno(cntx);
95*0Sstevel@tonic-gate
96*0Sstevel@tonic-gate mic->client_flag = cntx->initiate;
97*0Sstevel@tonic-gate
98*0Sstevel@tonic-gate /*
99*0Sstevel@tonic-gate * Build the the output token from the message the diffie-hellman
100*0Sstevel@tonic-gate * non serialized tok and the context keys.
101*0Sstevel@tonic-gate */
102*0Sstevel@tonic-gate if ((*minor = __make_token(token, message, &tok, &keys))
103*0Sstevel@tonic-gate != DH_SUCCESS) {
104*0Sstevel@tonic-gate return (GSS_S_FAILURE);
105*0Sstevel@tonic-gate }
106*0Sstevel@tonic-gate
107*0Sstevel@tonic-gate return (GSS_S_COMPLETE);
108*0Sstevel@tonic-gate }
109*0Sstevel@tonic-gate
110*0Sstevel@tonic-gate
111*0Sstevel@tonic-gate /*
112*0Sstevel@tonic-gate * __dh_gss_verify: calculate the signature of the message and compare
113*0Sstevel@tonic-gate * it to the signature represented by the DH_MIC token supplied. If the
114*0Sstevel@tonic-gate * major return value is GSS_S_COMPLETE, then *qop will be the qop that
115*0Sstevel@tonic-gate * was used in token.
116*0Sstevel@tonic-gate */
117*0Sstevel@tonic-gate
118*0Sstevel@tonic-gate OM_uint32
__dh_gss_verify(void * ctx,OM_uint32 * minor,gss_ctx_id_t context,gss_buffer_t message,gss_buffer_t token,int * qop)119*0Sstevel@tonic-gate __dh_gss_verify(void *ctx, /* Per mechanism context (not used) */
120*0Sstevel@tonic-gate OM_uint32 *minor, /* Mechanism status */
121*0Sstevel@tonic-gate gss_ctx_id_t context, /* GSS context */
122*0Sstevel@tonic-gate gss_buffer_t message, /* The message */
123*0Sstevel@tonic-gate gss_buffer_t token, /* The DH_MIC message token */
124*0Sstevel@tonic-gate int *qop /* qop used */)
125*0Sstevel@tonic-gate {
126*0Sstevel@tonic-gate _NOTE(ARGUNUSED(ctx))
127*0Sstevel@tonic-gate /* context is a Diffie-Hellman context */
128*0Sstevel@tonic-gate dh_gss_context_t cntx = (dh_gss_context_t)context;
129*0Sstevel@tonic-gate dh_token_desc tok;
130*0Sstevel@tonic-gate /* Grab the mic of the token */
131*0Sstevel@tonic-gate dh_mic_t mic = &tok.ver.dh_version_u.body.dh_token_body_desc_u.sign;
132*0Sstevel@tonic-gate dh_key_set keys;
133*0Sstevel@tonic-gate OM_uint32 stat;
134*0Sstevel@tonic-gate
135*0Sstevel@tonic-gate if (minor == 0)
136*0Sstevel@tonic-gate return (GSS_S_CALL_INACCESSIBLE_WRITE);
137*0Sstevel@tonic-gate
138*0Sstevel@tonic-gate /* Validate the context */
139*0Sstevel@tonic-gate if ((*minor = __dh_validate_context(cntx)) != DH_SUCCESS)
140*0Sstevel@tonic-gate return (GSS_S_NO_CONTEXT);
141*0Sstevel@tonic-gate
142*0Sstevel@tonic-gate /* Check that the context is established */
143*0Sstevel@tonic-gate if (cntx->state != ESTABLISHED)
144*0Sstevel@tonic-gate return (GSS_S_NO_CONTEXT);
145*0Sstevel@tonic-gate
146*0Sstevel@tonic-gate /* and that it has not expired */
147*0Sstevel@tonic-gate if (cntx->expire != GSS_C_INDEFINITE && cntx->expire < time(0))
148*0Sstevel@tonic-gate return (GSS_S_CONTEXT_EXPIRED);
149*0Sstevel@tonic-gate
150*0Sstevel@tonic-gate /* Package up the context session keys in to a key set */
151*0Sstevel@tonic-gate keys.dh_key_set_len = cntx->no_keys;
152*0Sstevel@tonic-gate keys.dh_key_set_val = cntx->keys;
153*0Sstevel@tonic-gate
154*0Sstevel@tonic-gate /* Deserialize token into tok using messaget and keys */
155*0Sstevel@tonic-gate if ((*minor = __get_token(token, message,
156*0Sstevel@tonic-gate &tok, &keys)) != DH_SUCCESS) {
157*0Sstevel@tonic-gate switch (*minor) {
158*0Sstevel@tonic-gate case DH_DECODE_FAILURE:
159*0Sstevel@tonic-gate return (GSS_S_DEFECTIVE_TOKEN);
160*0Sstevel@tonic-gate case DH_VERIFIER_MISMATCH:
161*0Sstevel@tonic-gate return (GSS_S_BAD_SIG);
162*0Sstevel@tonic-gate default:
163*0Sstevel@tonic-gate return (GSS_S_FAILURE);
164*0Sstevel@tonic-gate }
165*0Sstevel@tonic-gate }
166*0Sstevel@tonic-gate
167*0Sstevel@tonic-gate /* Check that the tok version is supported */
168*0Sstevel@tonic-gate if (tok.ver.verno != cntx->proto_version ||
169*0Sstevel@tonic-gate tok.ver.dh_version_u.body.type != DH_MIC) {
170*0Sstevel@tonic-gate xdr_free(xdr_dh_token_desc, (char *)&tok);
171*0Sstevel@tonic-gate return (GSS_S_DEFECTIVE_TOKEN);
172*0Sstevel@tonic-gate }
173*0Sstevel@tonic-gate
174*0Sstevel@tonic-gate /* Set the return qop */
175*0Sstevel@tonic-gate if (qop != NULL)
176*0Sstevel@tonic-gate *qop = mic->qop;
177*0Sstevel@tonic-gate
178*0Sstevel@tonic-gate /* Sequence & Replay detection here */
179*0Sstevel@tonic-gate stat = __dh_seq_detection(cntx, mic->seqnum);
180*0Sstevel@tonic-gate
181*0Sstevel@tonic-gate /* free the deserialize token tok */
182*0Sstevel@tonic-gate xdr_free(xdr_dh_token_desc, (char *)&tok);
183*0Sstevel@tonic-gate
184*0Sstevel@tonic-gate /*
185*0Sstevel@tonic-gate * If client flag is the same as the initiator flag, we're talking
186*0Sstevel@tonic-gate * to our selves or we're being spoofed. We return
187*0Sstevel@tonic-gate * GSS_S_DUPLICATE_TOKEN since its the best return code in the
188*0Sstevel@tonic-gate * supplementry group.
189*0Sstevel@tonic-gate */
190*0Sstevel@tonic-gate
191*0Sstevel@tonic-gate if (mic->client_flag == cntx->initiate)
192*0Sstevel@tonic-gate stat |= GSS_S_DUPLICATE_TOKEN;
193*0Sstevel@tonic-gate
194*0Sstevel@tonic-gate return (stat);
195*0Sstevel@tonic-gate }
196*0Sstevel@tonic-gate
197*0Sstevel@tonic-gate
198*0Sstevel@tonic-gate /*
199*0Sstevel@tonic-gate * __dh_gss_seal: Seal a message, i.e, it wraps or embeds a supplied message
200*0Sstevel@tonic-gate * in a DH_WRAP token to be delivered to the other side. A message check
201*0Sstevel@tonic-gate * over the whole message is include and is selected base on the supplied
202*0Sstevel@tonic-gate * qop. If the qop supports privacy and confidentiality was requested, then
203*0Sstevel@tonic-gate * the embedded message will be encrypted. A return flag will be set if
204*0Sstevel@tonic-gate * the message was encrypted.
205*0Sstevel@tonic-gate *
206*0Sstevel@tonic-gate * NOTE: IN THE CURRENT PRODUCT NO QOP CAN SUPPORT PRIVACY. THE *conf_state
207*0Sstevel@tonic-gate * FLAG WILL ALWAYS BE ZERO.
208*0Sstevel@tonic-gate */
209*0Sstevel@tonic-gate
210*0Sstevel@tonic-gate OM_uint32
__dh_gss_seal(void * ctx,OM_uint32 * minor,gss_ctx_id_t context,int conf_req,int qop_req,gss_buffer_t input,int * conf_state,gss_buffer_t output)211*0Sstevel@tonic-gate __dh_gss_seal(void * ctx, /* Per mechanism context */
212*0Sstevel@tonic-gate OM_uint32 *minor, /* Mechanism status */
213*0Sstevel@tonic-gate gss_ctx_id_t context, /* GSS context */
214*0Sstevel@tonic-gate int conf_req, /* True to request privacy */
215*0Sstevel@tonic-gate int qop_req, /* Use the requested qop */
216*0Sstevel@tonic-gate gss_buffer_t input, /* Input message to wrap */
217*0Sstevel@tonic-gate int *conf_state, /* True if message was encrypted */
218*0Sstevel@tonic-gate gss_buffer_t output /* Contains the ouputed DH_WRAP token*/)
219*0Sstevel@tonic-gate {
220*0Sstevel@tonic-gate _NOTE(ARGUNUSED(ctx))
221*0Sstevel@tonic-gate /* context is a Diffie-Hellman context */
222*0Sstevel@tonic-gate dh_gss_context_t cntx = (dh_gss_context_t)context;
223*0Sstevel@tonic-gate dh_token_desc tok;
224*0Sstevel@tonic-gate /* Get a pointer to the wrap protion of the token */
225*0Sstevel@tonic-gate dh_wrap_t wrap = &tok.ver.dh_version_u.body.dh_token_body_desc_u.seal;
226*0Sstevel@tonic-gate dh_key_set keys;
227*0Sstevel@tonic-gate gss_buffer_desc body;
228*0Sstevel@tonic-gate
229*0Sstevel@tonic-gate if (minor == 0)
230*0Sstevel@tonic-gate return (GSS_S_CALL_INACCESSIBLE_WRITE);
231*0Sstevel@tonic-gate
232*0Sstevel@tonic-gate /* See if the context is valid */
233*0Sstevel@tonic-gate if ((*minor = __dh_validate_context(cntx)) != DH_SUCCESS)
234*0Sstevel@tonic-gate return (GSS_S_NO_CONTEXT);
235*0Sstevel@tonic-gate
236*0Sstevel@tonic-gate /* that it is established, */
237*0Sstevel@tonic-gate if (cntx->state != ESTABLISHED)
238*0Sstevel@tonic-gate return (GSS_S_NO_CONTEXT);
239*0Sstevel@tonic-gate
240*0Sstevel@tonic-gate /* and that it has not expired */
241*0Sstevel@tonic-gate if (cntx->expire != GSS_C_INDEFINITE && cntx->expire < time(0))
242*0Sstevel@tonic-gate return (GSS_S_CONTEXT_EXPIRED);
243*0Sstevel@tonic-gate
244*0Sstevel@tonic-gate /* Package the session keys in a key_set */
245*0Sstevel@tonic-gate keys.dh_key_set_len = cntx->no_keys;
246*0Sstevel@tonic-gate keys.dh_key_set_val = cntx->keys;
247*0Sstevel@tonic-gate
248*0Sstevel@tonic-gate /* Set the version and token type */
249*0Sstevel@tonic-gate tok.ver.verno = cntx->proto_version;
250*0Sstevel@tonic-gate tok.ver.dh_version_u.body.type = DH_WRAP;
251*0Sstevel@tonic-gate
252*0Sstevel@tonic-gate /* Set the qop, initiate flag, and sequence number */
253*0Sstevel@tonic-gate wrap->mic.qop = qop_req;
254*0Sstevel@tonic-gate wrap->mic.client_flag = cntx->initiate;
255*0Sstevel@tonic-gate wrap->mic.seqnum = __dh_next_seqno(cntx);
256*0Sstevel@tonic-gate
257*0Sstevel@tonic-gate /*
258*0Sstevel@tonic-gate * Wrap the supplied message and encrypted if it is requested
259*0Sstevel@tonic-gate * and allowed. The qop will have to have an associated cipher
260*0Sstevel@tonic-gate * routine. NOTE: BECAUSE OF EXPORT CONTROLS, THE MECHANISM
261*0Sstevel@tonic-gate * CURRENTLY WILL NOT DO ENCRYPTION AND conf_stat WILL ALWAY BE SET
262*0Sstevel@tonic-gate * TO FALSE.
263*0Sstevel@tonic-gate */
264*0Sstevel@tonic-gate if ((*minor = __QOPSeal(wrap->mic.qop, input, conf_req,
265*0Sstevel@tonic-gate &keys, &body, conf_state)) != DH_SUCCESS) {
266*0Sstevel@tonic-gate __free_signature(&tok.verifier);
267*0Sstevel@tonic-gate return (GSS_S_FAILURE);
268*0Sstevel@tonic-gate }
269*0Sstevel@tonic-gate
270*0Sstevel@tonic-gate /* The body now contains the wrapped orignal message */
271*0Sstevel@tonic-gate wrap->body.body_len = body.length;
272*0Sstevel@tonic-gate wrap->body.body_val = (char *)body.value;
273*0Sstevel@tonic-gate
274*0Sstevel@tonic-gate /*
275*0Sstevel@tonic-gate * Tell the other side if encrypted.
276*0Sstevel@tonic-gate * SEE NOTE ABOVE. THIS WILL ALWAYS BE FALSE.
277*0Sstevel@tonic-gate */
278*0Sstevel@tonic-gate if (conf_state)
279*0Sstevel@tonic-gate wrap->conf_flag = *conf_state;
280*0Sstevel@tonic-gate else
281*0Sstevel@tonic-gate wrap->conf_flag = FALSE;
282*0Sstevel@tonic-gate
283*0Sstevel@tonic-gate /* Serialize the token tok into output using the session keys */
284*0Sstevel@tonic-gate if ((*minor = __make_token(output, NULL, &tok, &keys)) != DH_SUCCESS) {
285*0Sstevel@tonic-gate __dh_release_buffer(&body);
286*0Sstevel@tonic-gate return (GSS_S_FAILURE);
287*0Sstevel@tonic-gate }
288*0Sstevel@tonic-gate /* We're done with the wrapped body */
289*0Sstevel@tonic-gate __dh_release_buffer(&body);
290*0Sstevel@tonic-gate
291*0Sstevel@tonic-gate return (GSS_S_COMPLETE);
292*0Sstevel@tonic-gate }
293*0Sstevel@tonic-gate
294*0Sstevel@tonic-gate /*
295*0Sstevel@tonic-gate * __dh_gss_unseal: Unwrap a supplied DH_WRAP token extracting the orginal
296*0Sstevel@tonic-gate * message, qop_used, and whether privacy was used.
297*0Sstevel@tonic-gate *
298*0Sstevel@tonic-gate * NOTE: BECAUSE OF EXPORT CONTROLS, NO QOP IN THE MECHANISM SUPPORTS
299*0Sstevel@tonic-gate * PRIVACY. *conf_state WILL ALWAY BE FALSE.
300*0Sstevel@tonic-gate */
301*0Sstevel@tonic-gate
302*0Sstevel@tonic-gate OM_uint32
__dh_gss_unseal(void * ctx,OM_uint32 * minor,gss_ctx_id_t context,gss_buffer_t input,gss_buffer_t output,int * conf_state,int * qop_used)303*0Sstevel@tonic-gate __dh_gss_unseal(void *ctx, /* Per mechanism context (not used) */
304*0Sstevel@tonic-gate OM_uint32 *minor, /* Mechanism status */
305*0Sstevel@tonic-gate gss_ctx_id_t context, /* GSS context handle */
306*0Sstevel@tonic-gate gss_buffer_t input, /* Wrapped Diffie-Hellman token */
307*0Sstevel@tonic-gate gss_buffer_t output, /* The unwrapped message */
308*0Sstevel@tonic-gate int *conf_state, /* True if the message was encrypted */
309*0Sstevel@tonic-gate int *qop_used /* QOP used in token */)
310*0Sstevel@tonic-gate {
311*0Sstevel@tonic-gate _NOTE(ARGUNUSED(ctx))
312*0Sstevel@tonic-gate /* context is a Diffie-Hellman context */
313*0Sstevel@tonic-gate dh_gss_context_t cntx = (dh_gss_context_t)context;
314*0Sstevel@tonic-gate dh_token_desc tok;
315*0Sstevel@tonic-gate /* Grap the wrap portion of the above token */
316*0Sstevel@tonic-gate dh_wrap_t wrap = &tok.ver.dh_version_u.body.dh_token_body_desc_u.seal;
317*0Sstevel@tonic-gate dh_key_set keys;
318*0Sstevel@tonic-gate gss_buffer_desc message;
319*0Sstevel@tonic-gate OM_uint32 stat;
320*0Sstevel@tonic-gate
321*0Sstevel@tonic-gate if (minor == 0 || conf_state == 0 || output == GSS_C_NO_BUFFER)
322*0Sstevel@tonic-gate return (GSS_S_CALL_INACCESSIBLE_WRITE);
323*0Sstevel@tonic-gate
324*0Sstevel@tonic-gate /* Validate context, */
325*0Sstevel@tonic-gate if ((*minor = __dh_validate_context(cntx)) != DH_SUCCESS)
326*0Sstevel@tonic-gate return (GSS_S_NO_CONTEXT);
327*0Sstevel@tonic-gate
328*0Sstevel@tonic-gate /* check if it is established, */
329*0Sstevel@tonic-gate if (cntx->state != ESTABLISHED)
330*0Sstevel@tonic-gate return (GSS_S_NO_CONTEXT);
331*0Sstevel@tonic-gate
332*0Sstevel@tonic-gate /* and that it has not expired */
333*0Sstevel@tonic-gate if (cntx->expire != GSS_C_INDEFINITE && cntx->expire < time(0))
334*0Sstevel@tonic-gate return (GSS_S_CONTEXT_EXPIRED);
335*0Sstevel@tonic-gate
336*0Sstevel@tonic-gate /* Package up the session keys in to a key_set */
337*0Sstevel@tonic-gate keys.dh_key_set_len = cntx->no_keys;
338*0Sstevel@tonic-gate keys.dh_key_set_val = cntx->keys;
339*0Sstevel@tonic-gate
340*0Sstevel@tonic-gate /* Deserialize the input in to tok using keys */
341*0Sstevel@tonic-gate if ((*minor = __get_token(input, NULL, &tok, &keys)) != DH_SUCCESS) {
342*0Sstevel@tonic-gate switch (*minor) {
343*0Sstevel@tonic-gate case DH_DECODE_FAILURE:
344*0Sstevel@tonic-gate case DH_UNKNOWN_QOP:
345*0Sstevel@tonic-gate return (GSS_S_DEFECTIVE_TOKEN);
346*0Sstevel@tonic-gate case DH_VERIFIER_MISMATCH:
347*0Sstevel@tonic-gate return (GSS_S_BAD_SIG);
348*0Sstevel@tonic-gate default:
349*0Sstevel@tonic-gate return (GSS_S_FAILURE);
350*0Sstevel@tonic-gate }
351*0Sstevel@tonic-gate }
352*0Sstevel@tonic-gate
353*0Sstevel@tonic-gate /* Set the qop_used and confidentiality state */
354*0Sstevel@tonic-gate if (qop_used != NULL)
355*0Sstevel@tonic-gate *qop_used = wrap->mic.qop;
356*0Sstevel@tonic-gate *conf_state = wrap->conf_flag;
357*0Sstevel@tonic-gate
358*0Sstevel@tonic-gate /* See if this is a version that we can support */
359*0Sstevel@tonic-gate if (tok.ver.verno != cntx->proto_version ||
360*0Sstevel@tonic-gate tok.ver.dh_version_u.body.type != DH_WRAP) {
361*0Sstevel@tonic-gate xdr_free(xdr_dh_token_desc, (char *)&tok);
362*0Sstevel@tonic-gate return (GSS_S_DEFECTIVE_TOKEN);
363*0Sstevel@tonic-gate }
364*0Sstevel@tonic-gate
365*0Sstevel@tonic-gate /* Put the unwrapped body in to a gss_buffer */
366*0Sstevel@tonic-gate message.length = wrap->body.body_len;
367*0Sstevel@tonic-gate message.value = wrap->body.body_val;
368*0Sstevel@tonic-gate
369*0Sstevel@tonic-gate /*
370*0Sstevel@tonic-gate * Unwrap the message putting the result in output. We use the
371*0Sstevel@tonic-gate * qop from the token, the session keys, and set *conf_state if
372*0Sstevel@tonic-gate * encryption was used.
373*0Sstevel@tonic-gate *
374*0Sstevel@tonic-gate * NOTE: THIS MECHANISM DOES NOT SUPPORT ENCRYPTION. *conf_state
375*0Sstevel@tonic-gate * WILL ALWAY BE FALSE.
376*0Sstevel@tonic-gate */
377*0Sstevel@tonic-gate if ((*minor = __QOPUnSeal(wrap->mic.qop, &message,
378*0Sstevel@tonic-gate *conf_state, &keys, output))
379*0Sstevel@tonic-gate != DH_SUCCESS) {
380*0Sstevel@tonic-gate xdr_free(xdr_dh_token_desc, (char *)&tok);
381*0Sstevel@tonic-gate return (*minor == DH_UNKNOWN_QOP ?
382*0Sstevel@tonic-gate GSS_S_DEFECTIVE_TOKEN : GSS_S_FAILURE);
383*0Sstevel@tonic-gate }
384*0Sstevel@tonic-gate
385*0Sstevel@tonic-gate /* Sequence & Replay detection here */
386*0Sstevel@tonic-gate stat = __dh_seq_detection(cntx, wrap->mic.seqnum);
387*0Sstevel@tonic-gate
388*0Sstevel@tonic-gate /*
389*0Sstevel@tonic-gate * If client flag is the same as the initiator flag, we're talking
390*0Sstevel@tonic-gate * to our selves or we're being spoofed. We return
391*0Sstevel@tonic-gate * GSS_S_DUPLICATE_TOKEN since its the best return code in the
392*0Sstevel@tonic-gate * supplementry group.
393*0Sstevel@tonic-gate */
394*0Sstevel@tonic-gate
395*0Sstevel@tonic-gate if (wrap->mic.client_flag == cntx->initiate)
396*0Sstevel@tonic-gate stat |= GSS_S_DUPLICATE_TOKEN;
397*0Sstevel@tonic-gate
398*0Sstevel@tonic-gate /* Were done with the deserialize token, tok */
399*0Sstevel@tonic-gate xdr_free(xdr_dh_token_desc, (char *)&tok);
400*0Sstevel@tonic-gate
401*0Sstevel@tonic-gate return (stat);
402*0Sstevel@tonic-gate }
403