source4/heimdal/lib/gssapi/arcfour.c

   1 /*
   2  * Copyright (c) 2003 - 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "gssapi_locl.h"
  35
  36 RCSID("$Id: arcfour.c,v 1.17 2005/05/06 07:13:32 lha Exp $");
  37
  38 /*
  39  * Implements draft-brezak-win2k-krb-rc4-hmac-04.txt
  40  *
  41  * The arcfour message have the following formats:
  42  *
  43  * MIC token
  44  *      TOK_ID[2] = 01 01
  45  *      SGN_ALG[2] = 11 00
  46  *      Filler[4]
  47  *      SND_SEQ[8]
  48  *      SGN_CKSUM[8]
  49  *
  50  * WRAP token
  51  *      TOK_ID[2] = 02 01
  52  *      SGN_ALG[2];
  53  *      SEAL_ALG[2]
  54  *      Filler[2]
  55  *      SND_SEQ[2]
  56  *      SGN_CKSUM[8]
  57  *      Confounder[8]
  58  */
  59
  60
  61 static krb5_error_code
  62 arcfour_mic_key(krb5_context context, krb5_keyblock *key,
  63                 void *cksum_data, size_t cksum_size,
  64                 void *key6_data, size_t key6_size)
  65 {
  66     krb5_error_code ret;
  67
  68     Checksum cksum_k5;
  69     krb5_keyblock key5;
  70     char k5_data[16];
  71
  72     Checksum cksum_k6;
  73
  74     char T[4];
  75
  76     memset(T, 0, 4);
  77     cksum_k5.checksum.data = k5_data;
  78     cksum_k5.checksum.length = sizeof(k5_data);
  79
  80     if (key->keytype == KEYTYPE_ARCFOUR_56) {
  81         char L40[14] = "fortybits";
  82
  83         memcpy(L40 + 10, T, sizeof(T));
  84         ret = krb5_hmac(context, CKSUMTYPE_RSA_MD5,
  85                         L40, 14, 0, key, &cksum_k5);
  86         memset(&k5_data[7], 0xAB, 9);
  87     } else {
  88         ret = krb5_hmac(context, CKSUMTYPE_RSA_MD5,
  89                         T, 4, 0, key, &cksum_k5);
  90     }
  91     if (ret)
  92         return ret;
  93
  94     key5.keytype = KEYTYPE_ARCFOUR;
  95     key5.keyvalue = cksum_k5.checksum;
  96
  97     cksum_k6.checksum.data = key6_data;
  98     cksum_k6.checksum.length = key6_size;
  99
 100     return krb5_hmac(context, CKSUMTYPE_RSA_MD5,
 101                      cksum_data, cksum_size, 0, &key5, &cksum_k6);
 102 }
 103
 104
 105 static krb5_error_code
 106 arcfour_mic_cksum(krb5_keyblock *key, unsigned usage,
 107                   u_char *sgn_cksum, size_t sgn_cksum_sz,
 108                   const char *v1, size_t l1,
 109                   const void *v2, size_t l2,
 110                   const void *v3, size_t l3)
 111 {
 112     Checksum CKSUM;
 113     u_char *ptr;
 114     size_t len;
 115     krb5_crypto crypto;
 116     krb5_error_code ret;
 117
 118     assert(sgn_cksum_sz == 8);
 119
 120     len = l1 + l2 + l3;
 121
 122     ptr = malloc(len);
 123     if (ptr == NULL)
 124         return ENOMEM;
 125
 126     memcpy(ptr, v1, l1);
 127     memcpy(ptr + l1, v2, l2);
 128     memcpy(ptr + l1 + l2, v3, l3);
 129
 130     ret = krb5_crypto_init(gssapi_krb5_context, key, 0, &crypto);
 131     if (ret) {
 132         free(ptr);
 133         return ret;
 134     }
 135
 136     ret = krb5_create_checksum(gssapi_krb5_context,
 137                                crypto,
 138                                usage,
 139                                0,
 140                                ptr, len,
 141                                &CKSUM);
 142     free(ptr);
 143     if (ret == 0) {
 144         memcpy(sgn_cksum, CKSUM.checksum.data, sgn_cksum_sz);
 145         free_Checksum(&CKSUM);
 146     }
 147     krb5_crypto_destroy(gssapi_krb5_context, crypto);
 148
 149     return ret;
 150 }
 151
 152
 153 OM_uint32
 154 _gssapi_get_mic_arcfour(OM_uint32 * minor_status,
 155                         const gss_ctx_id_t context_handle,
 156                         gss_qop_t qop_req,
 157                         const gss_buffer_t message_buffer,
 158                         gss_buffer_t message_token,
 159                         krb5_keyblock *key)
 160 {
 161     krb5_error_code ret;
 162     int32_t seq_number;
 163     size_t len, total_len;
 164     u_char k6_data[16], *p0, *p;
 165     RC4_KEY rc4_key;
 166
 167     gssapi_krb5_encap_length (22, &len, &total_len, GSS_KRB5_MECHANISM);
 168
 169     message_token->length = total_len;
 170     message_token->value  = malloc (total_len);
 171     if (message_token->value == NULL) {
 172         *minor_status = ENOMEM;
 173         return GSS_S_FAILURE;
 174     }
 175
 176     p0 = _gssapi_make_mech_header(message_token->value,
 177                                   len,
 178                                   GSS_KRB5_MECHANISM);
 179     p = p0;
 180
 181     *p++ = 0x01; /* TOK_ID */
 182     *p++ = 0x01;
 183     *p++ = 0x11; /* SGN_ALG */
 184     *p++ = 0x00;
 185     *p++ = 0xff; /* Filler */
 186     *p++ = 0xff;
 187     *p++ = 0xff;
 188     *p++ = 0xff;
 189
 190     p = NULL;
 191
 192     ret = arcfour_mic_cksum(key, KRB5_KU_USAGE_SIGN,
 193                             p0 + 16, 8,  /* SGN_CKSUM */
 194                             p0, 8, /* TOK_ID, SGN_ALG, Filer */
 195                             message_buffer->value, message_buffer->length,
 196                             NULL, 0);
 197     if (ret) {
 198         gss_release_buffer(minor_status, message_token);
 199         *minor_status = ret;
 200         return GSS_S_FAILURE;
 201     }
 202
 203     ret = arcfour_mic_key(gssapi_krb5_context, key,
 204                           p0 + 16, 8, /* SGN_CKSUM */
 205                           k6_data, sizeof(k6_data));
 206     if (ret) {
 207         gss_release_buffer(minor_status, message_token);
 208         *minor_status = ret;
 209         return GSS_S_FAILURE;
 210     }
 211
 212     HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
 213     krb5_auth_con_getlocalseqnumber (gssapi_krb5_context,
 214                                      context_handle->auth_context,
 215                                      &seq_number);
 216     p = p0 + 8; /* SND_SEQ */
 217     gssapi_encode_be_om_uint32(seq_number, p);
 218
 219     krb5_auth_con_setlocalseqnumber (gssapi_krb5_context,
 220                                      context_handle->auth_context,
 221                                      ++seq_number);
 222     HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
 223
 224     memset (p + 4, (context_handle->more_flags & LOCAL) ? 0 : 0xff, 4);
 225
 226     RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 227     RC4 (&rc4_key, 8, p, p);
 228
 229     memset(&rc4_key, 0, sizeof(rc4_key));
 230     memset(k6_data, 0, sizeof(k6_data));
 231
 232     *minor_status = 0;
 233     return GSS_S_COMPLETE;
 234 }
 235
 236
 237 OM_uint32
 238 _gssapi_verify_mic_arcfour(OM_uint32 * minor_status,
 239                            const gss_ctx_id_t context_handle,
 240                            const gss_buffer_t message_buffer,
 241                            const gss_buffer_t token_buffer,
 242                            gss_qop_t * qop_state,
 243                            krb5_keyblock *key,
 244                            char *type)
 245 {
 246     krb5_error_code ret;
 247     int32_t seq_number;
 248     OM_uint32 omret;
 249     char cksum_data[8], k6_data[16], SND_SEQ[8];
 250     u_char *p;
 251     int cmp;
 252
 253     if (qop_state)
 254         *qop_state = 0;
 255
 256     p = token_buffer->value;
 257     omret = gssapi_krb5_verify_header (&p,
 258                                        token_buffer->length,
 259                                        type,
 260                                        GSS_KRB5_MECHANISM);
 261     if (omret)
 262         return omret;
 263
 264     if (memcmp(p, "\x11\x00", 2) != 0) /* SGN_ALG = HMAC MD5 ARCFOUR */
 265         return GSS_S_BAD_SIG;
 266     p += 2;
 267     if (memcmp (p, "\xff\xff\xff\xff", 4) != 0)
 268         return GSS_S_BAD_MIC;
 269     p += 4;
 270
 271     ret = arcfour_mic_cksum(key, KRB5_KU_USAGE_SIGN,
 272                             cksum_data, sizeof(cksum_data),
 273                             p - 8, 8,
 274                             message_buffer->value, message_buffer->length,
 275                             NULL, 0);
 276     if (ret) {
 277         *minor_status = ret;
 278         return GSS_S_FAILURE;
 279     }
 280
 281     ret = arcfour_mic_key(gssapi_krb5_context, key,
 282                           cksum_data, sizeof(cksum_data),
 283                           k6_data, sizeof(k6_data));
 284     if (ret) {
 285         *minor_status = ret;
 286         return GSS_S_FAILURE;
 287     }
 288
 289     cmp = memcmp(cksum_data, p + 8, 8);
 290     if (cmp) {
 291         *minor_status = 0;
 292         return GSS_S_BAD_MIC;
 293     }
 294
 295     {
 296         RC4_KEY rc4_key;
 297
 298         RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 299         RC4 (&rc4_key, 8, p, SND_SEQ);
 300
 301         memset(&rc4_key, 0, sizeof(rc4_key));
 302         memset(k6_data, 0, sizeof(k6_data));
 303     }
 304
 305     gssapi_decode_be_om_uint32(SND_SEQ, &seq_number);
 306
 307     if (context_handle->more_flags & LOCAL)
 308         cmp = memcmp(&SND_SEQ[4], "\xff\xff\xff\xff", 4);
 309     else
 310         cmp = memcmp(&SND_SEQ[4], "\x00\x00\x00\x00", 4);
 311
 312     memset(SND_SEQ, 0, sizeof(SND_SEQ));
 313     if (cmp != 0) {
 314         *minor_status = 0;
 315         return GSS_S_BAD_MIC;
 316     }
 317
 318     HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
 319     omret = _gssapi_msg_order_check(context_handle->order, seq_number);
 320     HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
 321     if (omret)
 322         return omret;
 323
 324     *minor_status = 0;
 325     return GSS_S_COMPLETE;
 326 }
 327
 328 OM_uint32
 329 _gssapi_wrap_arcfour(OM_uint32 * minor_status,
 330                      const gss_ctx_id_t context_handle,
 331                      int conf_req_flag,
 332                      gss_qop_t qop_req,
 333                      const gss_buffer_t input_message_buffer,
 334                      int * conf_state,
 335                      gss_buffer_t output_message_buffer,
 336                      krb5_keyblock *key)
 337 {
 338     u_char Klocaldata[16], k6_data[16], *p, *p0;
 339     size_t len, total_len, datalen;
 340     krb5_keyblock Klocal;
 341     krb5_error_code ret;
 342     int32_t seq_number;
 343
 344     if (conf_state)
 345         *conf_state = 0;
 346
 347     datalen = input_message_buffer->length;
 348     len = GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 349     /* if GSS_C_DCE_STYLE is in use:
 350      *  - we only need to encapsulate the WRAP token
 351      *  - we should not add padding
 352      */
 353     if (!(context_handle->flags & GSS_C_DCE_STYLE)) {
 354         datalen += 1 /* padding */;
 355         len += datalen;
 356     }
 357     _gssapi_encap_length(len, &len, &total_len, GSS_KRB5_MECHANISM);
 358     if (context_handle->flags & GSS_C_DCE_STYLE) {
 359         total_len += datalen;
 360     }
 361
 362     output_message_buffer->length = total_len;
 363     output_message_buffer->value  = malloc (total_len);
 364     if (output_message_buffer->value == NULL) {
 365         *minor_status = ENOMEM;
 366         return GSS_S_FAILURE;
 367     }
 368
 369     p0 = _gssapi_make_mech_header(output_message_buffer->value,
 370                                   len,
 371                                   GSS_KRB5_MECHANISM);
 372     p = p0;
 373
 374     *p++ = 0x02; /* TOK_ID */
 375     *p++ = 0x01;
 376     *p++ = 0x11; /* SGN_ALG */
 377     *p++ = 0x00;
 378     if (conf_req_flag) {
 379         *p++ = 0x10; /* SEAL_ALG */
 380         *p++ = 0x00;
 381     } else {
 382         *p++ = 0xff; /* SEAL_ALG */
 383         *p++ = 0xff;
 384     }
 385     *p++ = 0xff; /* Filler */
 386     *p++ = 0xff;
 387
 388     p = NULL;
 389
 390     HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
 391     krb5_auth_con_getlocalseqnumber (gssapi_krb5_context,
 392                                      context_handle->auth_context,
 393                                      &seq_number);
 394
 395     gssapi_encode_be_om_uint32(seq_number, p0 + 8);
 396
 397     krb5_auth_con_setlocalseqnumber (gssapi_krb5_context,
 398                                      context_handle->auth_context,
 399                                      ++seq_number);
 400     HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
 401
 402     memset (p0 + 8 + 4,
 403             (context_handle->more_flags & LOCAL) ? 0 : 0xff,
 404             4);
 405
 406     krb5_generate_random_block(p0 + 24, 8); /* fill in Confounder */
 407
 408     /* p points to data */
 409     p = p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 410     memcpy(p, input_message_buffer->value, input_message_buffer->length);
 411     /* only add padding when GSS_C_DCE_STYLE is not in use */
 412     if (!(context_handle->flags & GSS_C_DCE_STYLE)) {
 413         p[input_message_buffer->length] = 1; /* PADDING */
 414     }
 415
 416     ret = arcfour_mic_cksum(key, KRB5_KU_USAGE_SEAL,
 417                             p0 + 16, 8, /* SGN_CKSUM */
 418                             p0, 8, /* TOK_ID, SGN_ALG, SEAL_ALG, Filler */
 419                             p0 + 24, 8, /* Confounder */
 420                             p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE,
 421                             datalen);
 422     if (ret) {
 423         *minor_status = ret;
 424         gss_release_buffer(minor_status, output_message_buffer);
 425         return GSS_S_FAILURE;
 426     }
 427
 428     {
 429         int i;
 430
 431         Klocal.keytype = key->keytype;
 432         Klocal.keyvalue.data = Klocaldata;
 433         Klocal.keyvalue.length = sizeof(Klocaldata);
 434
 435         for (i = 0; i < 16; i++)
 436             Klocaldata[i] = ((u_char *)key->keyvalue.data)[i] ^ 0xF0;
 437     }
 438     ret = arcfour_mic_key(gssapi_krb5_context, &Klocal,
 439                           p0 + 8, 4, /* SND_SEQ */
 440                           k6_data, sizeof(k6_data));
 441     memset(Klocaldata, 0, sizeof(Klocaldata));
 442     if (ret) {
 443         gss_release_buffer(minor_status, output_message_buffer);
 444         *minor_status = ret;
 445         return GSS_S_FAILURE;
 446     }
 447
 448
 449     if(conf_req_flag) {
 450         RC4_KEY rc4_key;
 451
 452         RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 453         /* XXX ? */
 454         RC4 (&rc4_key, 8 + datalen, p0 + 24, p0 + 24); /* Confounder + data */
 455         memset(&rc4_key, 0, sizeof(rc4_key));
 456     }
 457     memset(k6_data, 0, sizeof(k6_data));
 458
 459     ret = arcfour_mic_key(gssapi_krb5_context, key,
 460                           p0 + 16, 8, /* SGN_CKSUM */
 461                           k6_data, sizeof(k6_data));
 462     if (ret) {
 463         gss_release_buffer(minor_status, output_message_buffer);
 464         *minor_status = ret;
 465         return GSS_S_FAILURE;
 466     }
 467
 468     {
 469         RC4_KEY rc4_key;
 470
 471         RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 472         RC4 (&rc4_key, 8, p0 + 8, p0 + 8); /* SND_SEQ */
 473         memset(&rc4_key, 0, sizeof(rc4_key));
 474         memset(k6_data, 0, sizeof(k6_data));
 475     }
 476
 477     if (conf_state)
 478         *conf_state = conf_req_flag;
 479
 480     *minor_status = 0;
 481     return GSS_S_COMPLETE;
 482 }
 483
 484 OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status,
 485                                  const gss_ctx_id_t context_handle,
 486                                  const gss_buffer_t input_message_buffer,
 487                                  gss_buffer_t output_message_buffer,
 488                                  int *conf_state,
 489                                  gss_qop_t *qop_state,
 490                                  krb5_keyblock *key)
 491 {
 492     u_char Klocaldata[16];
 493     krb5_keyblock Klocal;
 494     krb5_error_code ret;
 495     int32_t seq_number;
 496     size_t len, datalen;
 497     OM_uint32 omret;
 498     char k6_data[16], SND_SEQ[8], Confounder[8];
 499     char cksum_data[8];
 500     u_char *p, *p0;
 501     int cmp;
 502     int conf_flag;
 503     size_t padlen = 0;
 504
 505     if (conf_state)
 506         *conf_state = 0;
 507     if (qop_state)
 508         *qop_state = 0;
 509
 510     p0 = input_message_buffer->value;
 511     len = input_message_buffer->length;
 512     /* if we have GSS_C_DCE_STYLE in use, we only need to decapsulate the WRAP token */
 513     if (context_handle->flags & GSS_C_DCE_STYLE) {
 514         if (input_message_buffer->length < (GSS_ARCFOUR_WRAP_TOKEN_OFFSET+GSS_ARCFOUR_WRAP_TOKEN_SIZE)) {
 515             return GSS_S_BAD_MECH;
 516         }
 517         len = GSS_ARCFOUR_WRAP_TOKEN_OFFSET+GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 518     }
 519     omret = _gssapi_verify_mech_header(&p0,
 520                                        len,
 521                                        GSS_KRB5_MECHANISM);
 522     if (omret)
 523         return omret;
 524     p = p0;
 525
 526     datalen = input_message_buffer->length -
 527         (p - ((u_char *)input_message_buffer->value)) -
 528         GSS_ARCFOUR_WRAP_TOKEN_SIZE;
 529
 530     if (memcmp(p, "\x02\x01", 2) != 0)
 531         return GSS_S_BAD_SIG;
 532     p += 2;
 533     if (memcmp(p, "\x11\x00", 2) != 0) /* SGN_ALG = HMAC MD5 ARCFOUR */
 534         return GSS_S_BAD_SIG;
 535     p += 2;
 536
 537     if (memcmp (p, "\x10\x00", 2) == 0)
 538         conf_flag = 1;
 539     else if (memcmp (p, "\xff\xff", 2) == 0)
 540         conf_flag = 0;
 541     else
 542         return GSS_S_BAD_SIG;
 543
 544     p += 2;
 545     if (memcmp (p, "\xff\xff", 2) != 0)
 546         return GSS_S_BAD_MIC;
 547     p = NULL;
 548
 549     ret = arcfour_mic_key(gssapi_krb5_context, key,
 550                           p0 + 16, 8, /* SGN_CKSUM */
 551                           k6_data, sizeof(k6_data));
 552     if (ret) {
 553         *minor_status = ret;
 554         return GSS_S_FAILURE;
 555     }
 556
 557     {
 558         RC4_KEY rc4_key;
 559
 560         RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 561         RC4 (&rc4_key, 8, p0 + 8, SND_SEQ); /* SND_SEQ */
 562         memset(&rc4_key, 0, sizeof(rc4_key));
 563         memset(k6_data, 0, sizeof(k6_data));
 564     }
 565
 566     gssapi_decode_be_om_uint32(SND_SEQ, &seq_number);
 567
 568     if (context_handle->more_flags & LOCAL)
 569         cmp = memcmp(&SND_SEQ[4], "\xff\xff\xff\xff", 4);
 570     else
 571         cmp = memcmp(&SND_SEQ[4], "\x00\x00\x00\x00", 4);
 572
 573     if (cmp != 0) {
 574         *minor_status = 0;
 575         return GSS_S_BAD_MIC;
 576     }
 577
 578     {
 579         int i;
 580
 581         Klocal.keytype = key->keytype;
 582         Klocal.keyvalue.data = Klocaldata;
 583         Klocal.keyvalue.length = sizeof(Klocaldata);
 584
 585         for (i = 0; i < 16; i++)
 586             Klocaldata[i] = ((u_char *)key->keyvalue.data)[i] ^ 0xF0;
 587     }
 588     ret = arcfour_mic_key(gssapi_krb5_context, &Klocal,
 589                           SND_SEQ, 4,
 590                           k6_data, sizeof(k6_data));
 591     memset(Klocaldata, 0, sizeof(Klocaldata));
 592     if (ret) {
 593         *minor_status = ret;
 594         return GSS_S_FAILURE;
 595     }
 596
 597     output_message_buffer->value = malloc(datalen);
 598     if (output_message_buffer->value == NULL) {
 599         *minor_status = ENOMEM;
 600         return GSS_S_FAILURE;
 601     }
 602     output_message_buffer->length = datalen;
 603
 604     if(conf_flag) {
 605         RC4_KEY rc4_key;
 606
 607         RC4_set_key (&rc4_key, sizeof(k6_data), k6_data);
 608         RC4 (&rc4_key, 8, p0 + 24, Confounder); /* Confounder */
 609         RC4 (&rc4_key, datalen, p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE,
 610              output_message_buffer->value);
 611         memset(&rc4_key, 0, sizeof(rc4_key));
 612     } else {
 613         memcpy(Confounder, p0 + 24, 8); /* Confounder */
 614         memcpy(output_message_buffer->value,
 615                p0 + GSS_ARCFOUR_WRAP_TOKEN_SIZE,
 616                datalen);
 617     }
 618     memset(k6_data, 0, sizeof(k6_data));
 619
 620     if (!(context_handle->flags & GSS_C_DCE_STYLE)) {
 621         ret = _gssapi_verify_pad(output_message_buffer, datalen, &padlen);
 622         if (ret) {
 623             gss_release_buffer(minor_status, output_message_buffer);
 624             *minor_status = 0;
 625             return ret;
 626         }
 627         output_message_buffer->length -= padlen;
 628     }
 629
 630     ret = arcfour_mic_cksum(key, KRB5_KU_USAGE_SEAL,
 631                             cksum_data, sizeof(cksum_data),
 632                             p0, 8,
 633                             Confounder, sizeof(Confounder),
 634                             output_message_buffer->value,
 635                             output_message_buffer->length + padlen);
 636     if (ret) {
 637         gss_release_buffer(minor_status, output_message_buffer);
 638         *minor_status = ret;
 639         return GSS_S_FAILURE;
 640     }
 641
 642     cmp = memcmp(cksum_data, p0 + 16, 8); /* SGN_CKSUM */
 643     if (cmp) {
 644         gss_release_buffer(minor_status, output_message_buffer);
 645         *minor_status = 0;
 646         return GSS_S_BAD_MIC;
 647     }
 648
 649     HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
 650     omret = _gssapi_msg_order_check(context_handle->order, seq_number);
 651     HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
 652     if (omret)
 653         return omret;
 654
 655     if (conf_state)
 656         *conf_state = conf_flag;
 657
 658     *minor_status = 0;
 659     return GSS_S_COMPLETE;
 660 }