// Copyright 2012 Nexenta Systems, Inc. All rights reserved.
// Copyright (C) 2002 Microsoft Corporation
// All rights reserved.
//
// THIS CODE AND INFORMATION IS PROVIDED "AS IS"
// WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
// OR IMPLIED, INCLUDING BUT NOT LIMITED
// TO THE IMPLIED WARRANTIES OF MERCHANTIBILITY
//
// Date - 10/08/2002
// Author - Sanj Surati
/////////////////////////////////////////////////////////////
//
// DERPARSE.C
//
// SPNEGO Token Handler Source File
//
// as defined in DERPARSE.H.
//
/////////////////////////////////////////////////////////////
#include <stdlib.h>
#include <stdio.h>
#include <memory.h>
#include <sys/byteorder.h>
#include "spnego.h"
#include "derparse.h"
//
// The GSS Mechanism OID enumeration values (SPNEGO_MECH_OID) control which offset in
// the array below, that a mechanism can be found.
//
{
{(unsigned char *)"\x06\x09\x2a\x86\x48\x82\xf7\x12\x01\x02\x02",
{(unsigned char *)"\x06\x09\x2a\x86\x48\x86\xf7\x12\x01\x02\x02",
{(unsigned char *)"\x06\x06\x2b\x06\x01\x05\x05\x02",
{(unsigned char *)"\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a",
}
};
#pragma error_messages (default,E_INITIALIZATION_TYPE_MISMATCH)
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerGetLength
//
// Parameters:
// [in] pbLengthData - DER Length Data
// [in] nBoundaryLength - Length that value must not exceed.
// [out] pnLength - Filled out with length value
// [out] pnNumLengthBytes - Filled out with number of bytes
// consumed by DER length.
//
// Returns:
// int Success - SPNEGO_E_SUCCESS
// Failure - SPNEGO API Error code
//
// Comments :
// Interprets the data at pbLengthData as a DER length. The length must
// fit within the bounds of nBoundary length. We do not currently
// process lengths that take more than 4 bytes.
//
////////////////////////////////////////////////////////////////////////////
long* pnNumLengthBytes )
{
int nNumLengthBytes = 0;
// First check if the extended length bit is set
if ( *pbLengthData & LEN_XTND )
{
// Lower 7 bits contain the number of trailing bytes that describe the length
// Check that the number of bytes we are about to read is within our boundary
// constraints
{
// For now, our handler won't deal with lengths greater than 4 bytes
{
// 0 out the initial length
*pnLength = 0L;
// Bump by 1 byte
pbLengthData++;
#ifdef _LITTLE_ENDIAN
// There may be a cleaner way to do this, but for now, this seems to be
// an easy way to do the transformation
switch ( nNumLengthBytes )
{
case 1:
{
*( ( (unsigned char*) pnLength ) ) = *pbLengthData;
break;
}
case 2:
{
break;
}
case 3:
{
break;
}
case 4:
{
break;
}
} // SWITCH ( nNumLengthBytes )
#else
// We are Big-Endian, so the length can be copied in from the source
// as is. Ensure that we adjust for the number of bytes we actually
// copy.
#endif
// Account for the initial length byte
} // IF Valid Length
} // IF num bytes to read is within the boundary length
} // IF xtended length
else
{
// Extended bit is not set, so the length is in the value and the one
// byte describes the length
*pnNumLengthBytes = 1;
}
return nReturn;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerCheckToken
//
// Parameters:
// [in] pbTokenData - Token Data
// [in] nToken - Token identifier to check for
// [in] nLengthWithToken - Expected token length (with data)
// [in] nBoundaryLength - Length that value must not exceed.
// [out] pnLength - Filled out with data length
// [out] pnTokenLength - Filled out with number of bytes
// consumed by token identifier and length.
//
// Returns:
// int Success - SPNEGO_E_SUCCESS
// Failure - SPNEGO API Error code
//
// Comments :
// Checks the data pointed to by pbTokenData for the specified token
// identifier and the length that immediately follows. If
// nLengthWithToken is > 0, the calculated length must match. The
// length must also not exceed the specified boundary length .
//
////////////////////////////////////////////////////////////////////////////
long nLengthWithToken, long nBoundaryLength,
long* pnLength, long* pnTokenLength )
{
long nNumLengthBytes = 0L;
// Make sure that we've at least got 2 bytes of room to work with
if ( nBoundaryLength >= 2 )
{
// The first byte of the token data MUST match the specified token
if ( *pbTokenData == nToken )
{
// Next byte indicates the length
pbTokenData++;
// Get the length described by the token
&nNumLengthBytes ) ) == SPNEGO_E_SUCCESS )
{
// Verify that the length is LESS THAN the boundary length
// (this should prevent us walking out of our buffer)
{
}
// If we were passed a length to check, do so now
if ( nLengthWithToken > 0L )
{
// Check that the expected length matches
{
}
} // IF need to validate length
if ( SPNEGO_E_SUCCESS == nReturn )
{
}
} // IF ASNDerGetLength
} // IF token matches
else
{
}
} // IF Boundary Length is at least 2 bytes
return nReturn;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerCheckOID
//
// Parameters:
// [in] pbTokenData - Token Data
// [in] nMechOID - OID we are looking for
// [in] nBoundaryLength - Length that value must not exceed.
// [out] pnTokenLength - Filled out with number of bytes
// consumed by token and data.
//
// Returns:
// int Success - SPNEGO_E_SUCCESS
// Failure - SPNEGO API Error code
//
// Comments :
// Checks the data pointed to by pbTokenData for the specified OID.
//
////////////////////////////////////////////////////////////////////////////
long* pnTokenLength )
{
int nReturn = 0L;
long nLength = 0L;
// Verify that we have an OID token
{
// Add the data length to the Token Length
*pnTokenLength += nLength;
// Token Lengths plus the actual length must match the length in our OID list element.
// If it doesn't, we're done
{
// Memcompare the token and the expected field
{
}
}
else
{
}
} // IF OID Token CHecks
return nReturn;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerCalcNumLengthBytes
//
// Parameters:
// [in] nLength - Length to calculate length bytes for.
//
// Returns:
// int Number of bytes necessary to represent length
//
// Comments :
// Helper function to calculate the number of length bytes necessary to
// represent a length value. For our purposes, a 32-bit value should be
// enough to describea length.
//
////////////////////////////////////////////////////////////////////////////
{
if ( nLength <= 0x7F )
{
// A single byte will be sufficient for describing this length.
// The byte will simply contain the length
return 1;
}
else if ( nLength <= 0xFF )
{
// Two bytes are necessary, one to say how many following bytes
// describe the length, and one to give the length
return 2;
}
else if ( nLength <= 0xFFFF )
{
// Three bytes are necessary, one to say how many following bytes
// describe the length, and two to give the length
return 3;
}
else if ( nLength <= 0xFFFFFF )
{
// Four bytes are necessary, one to say how many following bytes
// describe the length, and three to give the length
return 4;
}
else
{
// Five bytes are necessary, one to say how many following bytes
// describe the length, and four to give the length
return 5;
}
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerCalcTokenLength
//
// Parameters:
// [in] nLength - Length to calculate length bytes for.
// [in] nDataLength - Actual Data length value.
//
// Returns:
// long Number of bytes necessary to represent a token, length and data
//
// Comments :
// Helper function to calculate a token and value size, based on a
// supplied length value, and any binary data that will need to be
// written out.
//
////////////////////////////////////////////////////////////////////////////
{
// Add a byte to the length size to account for a single byte to
// hold the token type.
return nTotalLength + nDataLength;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerCalcElementLength
//
// Parameters:
// [in] nDataLength - Length of data.
// [out] pnInternalLength - Filled out with length of element
// without sequence info.
//
// Returns:
// long Number of bytes necessary to represent an element
//
// Comments :
// Helper function to calculate an element length. An element consists
// of a sequence token, a type token and then the data.
//
////////////////////////////////////////////////////////////////////////////
{
// First the type token and the actual data
// Internal length is the length without the element sequence token
if ( NULL != pnInternalLength )
{
}
// Next add in the element's sequence token (remember that its
// length is the total length of the type token and data)
return nTotalLength;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerCalcMechListLength
//
// Parameters:
// [in] mechoid - Mech OID to put in list.
// [out] pnInternalLength - Filled out with length of element
// without the primary sequence token.
//
// Returns:
// long Number of bytes necessary to represent a mechList
//
// Comments :
// Helper function to calculate a MechList length. A mechlist consists
// of a NegTokenInit sequence token, a sequence token for the MechList
// and finally a list of OIDs.
//
////////////////////////////////////////////////////////////////////////////
long* pnInternalLength )
{
// First the OID
long nTotalLength;
int i;
nTotalLength = 0;
for (i = 0; i < mechOidCnt; i++) {
oid_idx = mechOidLst[i];
}
// Next add in a sequence token
// Internal length is the length without the element sequence token
if ( NULL != pnInternalLength )
{
}
// Finally add in the element's sequence token
return nTotalLength;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerWriteLength
//
// Parameters:
// [out] pbData - Buffer to write into.
// [in] nLength - Length to write out.
//
// Returns:
// int Number of bytes written out
//
// Comments :
// Helper function to write out a length value following DER rules .
//
////////////////////////////////////////////////////////////////////////////
{
if ( nNumBytesRequired > 1 )
{
// Write out the number of bytes following which will be used
// Point to where we'll actually write the length
pbData++;
#ifdef _LITTLE_ENDIAN
// There may be a cleaner way to do this, but for now, this seems to be
// an easy way to do the transformation
switch ( nNumLengthBytes )
{
case 1:
{
// Cast the length to a single byte, since we know that it
// is 0x7F or less (or we wouldn't only need a single byte).
break;
}
case 2:
{
break;
}
case 3:
{
break;
}
case 4:
{
break;
}
} // SWITCH ( nNumLengthBytes )
#else
// We are Big-Endian, so the length can be copied in from the source
// as is. Ensure that we adjust for the number of bytes we actually
// copy.
#endif
} // IF > 1 byte for length
else
{
// Cast the length to a single byte, since we know that it
// is 0x7F or less (or we wouldn't only need a single byte).
}
return nNumBytesRequired;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerWriteToken
//
// Parameters:
// [out] pbData - Buffer to write into.
// [in] ucType - Token Type
// [in] pbTokenValue - Actual Value
// [in] nLength - Length of Data.
//
// Returns:
// int Number of bytes written out
//
// Comments :
// Helper function to write out a token and any associated data. If
// pbTokenValue is non-NULL, then it is written out in addition to the
// token identifier and the length bytes.
//
////////////////////////////////////////////////////////////////////////////
unsigned char* pbTokenValue, long nLength )
{
int nTotalBytesWrittenOut = 0L;
int nNumLengthBytesWritten = 0L;
// Write out the type
// Wrote 1 byte, and move data pointer
pbData++;
// Now write out the length and adjust the number of bytes written out
// Write out the token value if we got one. The assumption is that the
// nLength value indicates how many bytes are in pbTokenValue.
if ( NULL != pbTokenValue )
{
}
return nTotalBytesWrittenOut;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerWriteOID
//
// Parameters:
// [out] pbData - Buffer to write into.
// [in] eMechOID - OID to write out.
//
// Returns:
// int Number of bytes written out
//
// Comments :
// Helper function to write out an OID. For these we have the raw bytes
// listed in a global structure. The caller simply indicates which OID
// should be written and we will splat out the data.
//
////////////////////////////////////////////////////////////////////////////
{
}
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerWriteMechList
//
// Parameters:
// [out] pbData - Buffer to write into.
// [in] eMechOID - OID to put in MechList.
//
// Returns:
// int Number of bytes written out
//
// Comments :
// Helper function to write out a MechList. A MechList consists of the
// Init Token Sequence, a sequence token and then the list of OIDs. In
// our case the OID is from a global array of known OIDs.
//
////////////////////////////////////////////////////////////////////////////
{
// First get the length
long nInternalLength = 0L;
long nMechListLength;
long nTempLength = 0L;
int i;
NULL, nInternalLength );
// Adjust the data pointer
pbData += nTempLength;
// Now write the Sequence token and the OID (the OID is a BLOB in the global
// structure.
pbData += nTempLength;
for (i = 0; i < mechOidCnt; i++) {
pbData += nTempLength;
}
return nMechListLength;
}
/////////////////////////////////////////////////////////////////////////////
//
// Function:
// ASNDerWriteElement
//
// Parameters:
// [out] pbData - Buffer to write into.
// [in] ucElementSequence - Sequence Token
// [in] ucType - Token Type
// [in] pbTokenValue - Actual Value
// [in] nLength - Length of Data.
//
// Returns:
// int Number of bytes written out
//
// Comments :
// Helper function to write out a SPNEGO Token element. An element
// consists of a sequence token, a type token and the associated data.
//
////////////////////////////////////////////////////////////////////////////
{
// First get the length
long nInternalLength = 0L;
long nTempLength = 0L;
// Write out the sequence byte and the length of the type and data
// Adjust the data pointer
pbData += nTempLength;
// Now write the type and the data.
return nElementLength;
}