geos_one/CASA
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

More changes to resolve issues brought up during the security

Browse Source 
review of the code.
This commit is contained in:
Juan Carlos Luciani 2007-02-06 22:09:00 +00:00
parent 8719ce2410
commit 51ffdf0702
16 changed files with 550 additions and 427 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CASA-auth-token/client/library/authmech.c
View File

@ -280,7 +280,7 @@ GetAuthMechToken(
if (CASA_SUCCESS(retStatus))
{
char *pAuthToken = NULL;
int authTokenBufLen = 0;
uint32_t authTokenBufLen = 0;
// We found a provider for the service, query it for the buffer size
// needed to obtain the authentication token.

24
CASA-auth-token/client/library/authmsg.c
View File

@ -60,11 +60,11 @@ typedef struct _AuthRespParse
{
XML_Parser p;
int state;
int elementDataProcessed;
size_t elementDataProcessed;
char *pStatusData;
int statusDataLen;
size_t statusDataLen;
char *pLifetimeData;
int lifetimeDataLen;
size_t lifetimeDataLen;
AuthenticateResp *pAuthenticateResp;
CasaStatus status;
@ -305,7 +305,7 @@ ConsumeElementData(
IN const XML_Char *s,
IN int len,
INOUT char **ppElementData,
INOUT int *pElementDataLen)
INOUT size_t *pElementDataLen)
//
// Arguments:
//
@ -352,7 +352,7 @@ ConsumeElementData(
char *pNewBuf;
// We have already received token data, append this data to it.
pNewBuf = (char*) malloc(pAuthRespParse->elementDataProcessed + len + 1);
pNewBuf = (char*) malloc((size_t)(pAuthRespParse->elementDataProcessed + len + 1));
if (pNewBuf)
{
memset(pNewBuf,
@ -714,6 +714,16 @@ CreateAuthenticateResp(
*
*/
// Verify that the response is not too large for the parser
if (respLen > INT_MAX)
{
DbgTrace(0, "-CreateAuthenticateResp- Response too large\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_INFORMATIONAL,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_UNSUCCESSFUL);
goto exit;
}
// Allocate AuthenticateResp object
pAuthenticateResp = malloc(sizeof(*pAuthenticateResp));
if (pAuthenticateResp)
@ -748,7 +758,7 @@ CreateAuthenticateResp(
XML_SetUserData(p, &authRespParse);
// Parse the document
if (XML_Parse(p, pRespMsg, respLen, 1) == XML_STATUS_OK)
if (XML_Parse(p, pRespMsg, (int) respLen, 1) == XML_STATUS_OK)
{
// Verify that the parse operation completed successfully
if (authRespParse.state == DONE_PARSING)
@ -818,6 +828,8 @@ CreateAuthenticateResp(
CASA_STATUS_INSUFFICIENT_RESOURCES);
}
exit:
DbgTrace(1, "-CreateAuthenticateResp- End, retStatus = %08X\n", retStatus);
return retStatus;

24
CASA-auth-token/client/library/authpolicy.c
View File

@ -57,7 +57,7 @@ typedef struct _AuthPolicyParse
{
XML_Parser p;
int state;
int elementDataProcessed;
size_t elementDataProcessed;
AuthPolicy *pAuthPolicy;
CasaStatus status;
@ -206,7 +206,7 @@ ConsumeElementData(
IN const XML_Char *s,
IN int len,
INOUT char **ppElementData,
INOUT int *pElementDataLen)
INOUT size_t *pElementDataLen)
//
// Arguments:
//
@ -253,7 +253,7 @@ ConsumeElementData(
char *pNewBuf;
// We have already received token data, append this data to it.
pNewBuf = (char*) malloc(pAuthPolicyParse->elementDataProcessed + len + 1);
pNewBuf = (char*) malloc((size_t)(pAuthPolicyParse->elementDataProcessed + len + 1));
if (pNewBuf)
{
memset(pNewBuf,
@ -558,7 +558,7 @@ AuthPolicyEndElementHandler(
CasaStatus
CreateAuthPolicy(
IN char *pEncodedData,
IN int encodedDataLen,
IN size_t encodedDataLen,
INOUT AuthPolicy **ppAuthPolicy)
//
// Arguments:
@ -576,7 +576,7 @@ CreateAuthPolicy(
AuthPolicy *pAuthPolicy = NULL;
AuthPolicyParse authPolicyParse = {0};
char *pData = NULL;
int dataLen = 0;
uint32_t dataLen = 0;
DbgTrace(1, "-CreateAuthPolicy- Start\n", 0);
@ -623,6 +623,16 @@ CreateAuthPolicy(
*
*/
// Verify that the encoded data length is not too large
if (encodedDataLen > UINT32_MAX)
{
DbgTrace(0, "-CreateAuthPolicy- Encoded data length too large\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_UNSUCCESSFUL);
goto exit;
}
// Initialize output parameter
*ppAuthPolicy = NULL;
@ -668,7 +678,7 @@ CreateAuthPolicy(
XML_SetUserData(p, &authPolicyParse);
// Parse the document
if (XML_Parse(p, pData, dataLen, 1) == XML_STATUS_OK)
if (XML_Parse(p, pData, (int) dataLen, 1) == XML_STATUS_OK)
{
// Verify that the parse operation completed successfully
if (authPolicyParse.state == DONE_PARSING)
@ -736,6 +746,8 @@ CreateAuthPolicy(
if (pData)
free(pData);
exit:
DbgTrace(1, "-CreateAuthPolicy- End, retStatus = %08X\n", retStatus);
return retStatus;

12
CASA-auth-token/client/library/cache.c
View File

@ -96,7 +96,7 @@ CreateAuthTokenCacheEntry(
wrapperEntrySize = tokenSize + sizeof(WrapperAuthCacheEntry);
// Verify that entrySize will not overflow
if ((tokenSize + sizeof(AuthCacheEntry)) <= U32_MAX)
if ((tokenSize + sizeof(AuthCacheEntry)) <= UINT32_MAX)
{
entrySize = tokenSize + sizeof(AuthCacheEntry);
@ -142,7 +142,7 @@ CreateAuthTokenCacheEntry(
groupOrHostNameStrLen = strlen(pGroupOrHostName);
// Verify that keySize will not overflow
if ((cacheKeyStrLen + groupOrHostNameStrLen + 2) <= U32_MAX)
if ((cacheKeyStrLen + groupOrHostNameStrLen + 2) <= UINT32_MAX)
{
keySize = (uint32_t) (cacheKeyStrLen + groupOrHostNameStrLen + 2);
@ -239,7 +239,7 @@ CreateSessionTokenCacheEntry(
wrapperEntrySize = tokenSize + sizeof(WrapperAuthCacheEntry);
// Verify that entrySize will not overflow
if ((tokenSize + sizeof(AuthCacheEntry)) <= U32_MAX)
if ((tokenSize + sizeof(AuthCacheEntry)) <= UINT32_MAX)
{
entrySize = tokenSize + sizeof(AuthCacheEntry);
@ -284,7 +284,7 @@ CreateSessionTokenCacheEntry(
cacheKeyStrLen = strlen(pCacheKey) + 1;
// Verify that the cacheKeyStrLen can be casted to a uint32_t
if (cacheKeyStrLen <= U32_MAX)
if (cacheKeyStrLen <= UINT32_MAX)
{
miCasaStatus = miCASAWriteBinaryKey(g_hCASAContext,
0,
@ -455,7 +455,7 @@ FindSessionTokenEntryInCache(
cacheKeyStrLen = strlen(pCacheKey) + 1;
// Verify that the cacheKeyStrLen can be casted to a uint32_t
if (cacheKeyStrLen <= U32_MAX)
if (cacheKeyStrLen <= UINT32_MAX)
{
miCasaStatus = miCASAReadBinaryKey(g_hCASAContext,
0,
@ -569,7 +569,7 @@ FindAuthTokenEntryInCache(
groupOrHostNameStrLen = strlen(pGroupOrHostName);
// Verify that keySize will not overflow
if ((cacheKeyStrLen + groupOrHostNameStrLen + 2) <= U32_MAX)
if ((cacheKeyStrLen + groupOrHostNameStrLen + 2) <= UINT32_MAX)
{
keySize = (uint32_t) (cacheKeyStrLen + groupOrHostNameStrLen + 2);

22
CASA-auth-token/client/library/getpolicymsg.c
View File

@ -55,9 +55,9 @@ typedef struct _GetAuthPolicyRespParse
{
XML_Parser p;
int state;
int elementDataProcessed;
size_t elementDataProcessed;
char *pStatusData;
int statusDataLen;
size_t statusDataLen;
GetAuthPolicyResp *pGetAuthPolicyResp;
CasaStatus status;
@ -269,7 +269,7 @@ ConsumeElementData(
IN const XML_Char *s,
IN int len,
INOUT char **ppElementData,
INOUT int *pElementDataLen)
INOUT size_t *pElementDataLen)
//
// Arguments:
//
@ -316,7 +316,7 @@ ConsumeElementData(
char *pNewBuf;
// We have already received token data, append this data to it.
pNewBuf = (char*) malloc(pGetAuthPolicyRespParse->elementDataProcessed + len + 1);
pNewBuf = (char*) malloc((size_t)(pGetAuthPolicyRespParse->elementDataProcessed + len + 1));
if (pNewBuf)
{
memset(pNewBuf,
@ -590,7 +590,7 @@ GetAuthPolicyRespEndElementHandler(
CasaStatus
CreateGetAuthPolicyResp(
IN char *pRespMsg,
IN int respLen,
IN size_t respLen,
INOUT GetAuthPolicyResp **ppGetAuthPolicyResp)
//
// Arguments:
@ -634,6 +634,16 @@ CreateGetAuthPolicyResp(
*
*/
// Verify that the response is not too large for the parser
if (respLen > INT_MAX)
{
DbgTrace(0, "-CreateGetAuthPolicyResp- Response too large\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_INFORMATIONAL,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_UNSUCCESSFUL);
goto exit;
}
// Allocate GetAuthPolicyResp object
pGetAuthPolicyResp = malloc(sizeof(*pGetAuthPolicyResp));
if (pGetAuthPolicyResp)
@ -734,6 +744,8 @@ CreateGetAuthPolicyResp(
CASA_STATUS_INSUFFICIENT_RESOURCES);
}
exit:
DbgTrace(1, "-CreateGetAuthPolicyResp- End, retStatus = %08X\n", retStatus);
return retStatus;

27
CASA-auth-token/client/library/gettokenmsg.c
View File

@ -55,11 +55,11 @@ typedef struct _GetAuthTokenRespParse
{
XML_Parser p;
int state;
int elementDataProcessed;
size_t elementDataProcessed;
char *pStatusData;
int statusDataLen;
size_t statusDataLen;
char *pLifetimeData;
int lifetimeDataLen;
size_t lifetimeDataLen;
GetAuthTokenResp *pGetAuthTokenResp;
CasaStatus status;
@ -302,7 +302,7 @@ ConsumeElementData(
IN const XML_Char *s,
IN int len,
INOUT char **ppElementData,
INOUT int *pElementDataLen)
INOUT size_t *pElementDataLen)
//
// Arguments:
//
@ -349,7 +349,7 @@ ConsumeElementData(
char *pNewBuf;
// We have already received token data, append this data to it.
pNewBuf = (char*) malloc(pGetAuthTokenRespParse->elementDataProcessed + len + 1);
pNewBuf = (char*) malloc((size_t)(pGetAuthTokenRespParse->elementDataProcessed + len + 1));
if (pNewBuf)
{
memset(pNewBuf,
@ -657,7 +657,7 @@ GetAuthTokenRespEndElementHandler(
CasaStatus
CreateGetAuthTokenResp(
IN char *pRespMsg,
IN int respLen,
IN size_t respLen,
INOUT GetAuthTokenResp **ppGetAuthTokenResp)
//
// Arguments:
@ -701,6 +701,16 @@ CreateGetAuthTokenResp(
*
*/
// Verify that the response is not too large for the parser
if (respLen > INT_MAX)
{
DbgTrace(0, "-CreateGetAuthTokenResp- Response too large\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_INFORMATIONAL,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_UNSUCCESSFUL);
goto exit;
}
// Allocate GetAuthTokenResp object
pGetAuthTokenResp = malloc(sizeof(*pGetAuthTokenResp));
if (pGetAuthTokenResp)
@ -734,7 +744,7 @@ CreateGetAuthTokenResp(
XML_SetUserData(p, &getAuthTokenRespParse);
// Parse the document
if (XML_Parse(p, pRespMsg, respLen, 1) == XML_STATUS_OK)
if (XML_Parse(p, pRespMsg, (int) respLen, 1) == XML_STATUS_OK)
{
// Verify that the parse operation completed successfully
if (getAuthTokenRespParse.state == DONE_PARSING)
@ -803,6 +813,9 @@ CreateGetAuthTokenResp(
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_INSUFFICIENT_RESOURCES);
}
exit:
DbgTrace(1, "-CreateGetAuthTokenResp- End, retStatus = %08X\n", retStatus);
return retStatus;

30
CASA-auth-token/client/library/internal.h
View File

@ -41,10 +41,6 @@
#define MAX_RPC_REPLY_SZ (256 * 1024)
#ifndef U32_MAX
#define U32_MAX (~(uint32_t)0)
#endif
//
// Authentication Context structure
//
@ -52,11 +48,11 @@ typedef struct _AuthContext
{
LIST_ENTRY listEntry;
char *pContext;
int contextLen;
size_t contextLen;
char *pMechanism;
int mechanismLen;
size_t mechanismLen;
char *pMechInfo;
int mechInfoLen;
size_t mechInfoLen;
} AuthContext, *PAuthContext;
@ -75,7 +71,7 @@ typedef struct _AuthPolicy
typedef struct _GetAuthPolicyResp
{
char *pPolicy;
int policyLen;
size_t policyLen;
} GetAuthPolicyResp, *PGetAuthPolicyResp;
@ -85,7 +81,7 @@ typedef struct _GetAuthPolicyResp
typedef struct _GetAuthTokenResp
{
char *pToken;
int tokenLen;
size_t tokenLen;
int tokenLifetime;
} GetAuthTokenResp, *PGetAuthTokenResp;
@ -96,7 +92,7 @@ typedef struct _GetAuthTokenResp
typedef struct _AuthenticateResp
{
char *pToken;
int tokenLen;
size_t tokenLen;
int tokenLifetime;
} AuthenticateResp, *PAuthenticateResp;
@ -177,7 +173,7 @@ extern
CasaStatus
CreateGetAuthPolicyResp(
IN char *pRespMsg,
IN int respLen,
IN size_t respLen,
INOUT GetAuthPolicyResp **ppGetAuthPolicyResp);
extern
@ -202,7 +198,7 @@ extern
CasaStatus
CreateAuthPolicy(
IN char *pEncodedData,
IN int encodedDataLen,
IN size_t encodedDataLen,
INOUT AuthPolicy **ppAuthPolicy);
extern
@ -247,7 +243,7 @@ extern
CasaStatus
CreateGetAuthTokenResp(
IN char *pRespMsg,
IN int respLen,
IN size_t respLen,
INOUT GetAuthTokenResp **ppGetAuthTokenResp);
extern
@ -425,17 +421,17 @@ extern
CasaStatus
EncodeData(
IN const void *pData,
IN const int32_t dataLen,
IN const uint32_t dataLen,
INOUT char **ppEncodedData,
INOUT int32_t *pEncodedDataLen);
INOUT uint32_t *pEncodedDataLen);
extern
CasaStatus
DecodeData(
IN const char *pEncodedData,
IN const int32_t encodedDataLen, // Does not include NULL terminator
IN const uint32_t encodedDataLen, // Does not include NULL terminator
INOUT void **ppData,
INOUT int32_t *pDataLen);
INOUT uint32_t *pDataLen);
extern
int

2
CASA-auth-token/client/library/mech_if.h
View File

@ -91,7 +91,7 @@ CasaStatus
IN const char *pHostName,
IN void *pCredStoreScope,
INOUT char *pTokenBuf,
INOUT int *pTokenBufLen);
INOUT uint32_t *pTokenBufLen);
//
// Arguments:
// pIfInstance -

10
CASA-auth-token/client/library/mechanisms/krb5/internal.h
View File

@ -60,7 +60,7 @@ AuthTokenIf_GetAuthToken(
IN const char *pHostName,
IN void *pCredStoreScope,
INOUT char *pTokenBuf,
INOUT int *pTokenBufLen);
INOUT size_t *pTokenBufLen);
extern
int
@ -74,17 +74,17 @@ extern
CasaStatus
EncodeData(
IN const void *pData,
IN const int32_t dataLen,
IN const uint32_t dataLen,
INOUT char **ppEncodedData,
INOUT int32_t *pEncodedDataLen);
INOUT uint32_t *pEncodedDataLen);
extern
CasaStatus
DecodeData(
IN const char *pEncodedData,
IN const int32_t encodedDataLen, // Does not include NULL terminator
IN const uint32_t encodedDataLen, // Does not include NULL terminator
INOUT void **ppData,
INOUT int32_t *pDataLen);
INOUT uint32_t *pDataLen);
extern
int

17
CASA-auth-token/client/library/mechanisms/krb5/linux/get.c
View File

@ -129,7 +129,7 @@ AuthTokenIf_GetAuthToken(
IN const char *pHostName,
IN void *pCredStoreScope,
INOUT char *pTokenBuf,
INOUT int *pTokenBufLen)
INOUT uint32_t *pTokenBufLen)
//
// Arguments:
// pIfInstance -
@ -186,7 +186,7 @@ AuthTokenIf_GetAuthToken(
//=======================================================================--
{
CasaStatus retStatus;
char const *pKrbServiceName = pMechInfo;
char *pKrbServiceName = (char*) pMechInfo;
OM_uint32 gssMajStat;
OM_uint32 gssMinStat;
gss_buffer_desc gssBuffer;
@ -271,9 +271,12 @@ AuthTokenIf_GetAuthToken(
// Proceed based on the result of the gss_init_sec_context operation
if (gssMajStat == GSS_S_COMPLETE
&& gssSendToken.length != 0)
{
// Make sure that the token is not too large
if (gssSendToken.length <= UINT32_MAX)
{
char *pEncodedToken;
int encodedTokenLen;
uint32_t encodedTokenLen;
// The security context was initialized, now return the token to the
// caller after base64 encoding it.
@ -314,6 +317,14 @@ AuthTokenIf_GetAuthToken(
}
}
else
{
DbgTrace(0, "-AuthTokenIf_GetAuthToken- GSS Token too large\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_KRB5TOKEN,
CASA_STATUS_UNSUCCESSFUL);
}
}
else
{
DbgTrace(0, "-AuthTokenIf_GetAuthToken- Error initing sec context\n", 0);
LogGssStatuses("initializing context", gssMajStat, gssMinStat);

26
CASA-auth-token/client/library/mechanisms/krb5/util.c
View File

@ -65,9 +65,9 @@ static const uint8_t g_Expand64[256] =
CasaStatus
EncodeData(
IN const void *pData,
IN const int32_t dataLen,
IN const uint32_t dataLen,
INOUT char **ppEncodedData,
INOUT int32_t *pEncodedDataLen)
INOUT uint32_t *pEncodedDataLen)
//
// Arguments:
//
@ -150,9 +150,9 @@ EncodeData(
CasaStatus
DecodeData(
IN const char *pEncodedData,
IN const int32_t encodedDataLen, // Does not include NULL terminator
IN const uint32_t encodedDataLen, // Does not include NULL terminator
INOUT void **ppData,
INOUT int32_t *pDataLen)
INOUT uint32_t *pDataLen)
//
// Arguments:
//
@ -164,8 +164,8 @@ DecodeData(
//=======================================================================--
{
CasaStatus retStatus;
int i, j;
int decodedSize;
uint32_t i, j;
size_t decodedSize;
DbgTrace(3, "-DecodeData- Start\n", 0);
@ -175,6 +175,9 @@ DecodeData(
j++;
decodedSize = (j * 3 + 3) / 4;
// Verify that we are not going to overflow the uint32
if (decodedSize <= UINT32_MAX)
{
// Allocate buffer to hold the decoded data
*ppData = malloc(decodedSize);
if (*ppData)
@ -265,9 +268,18 @@ DecodeData(
DbgTrace(0, "-DecodeData- Buffer allocation failure\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_PWTOKEN,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_INSUFFICIENT_RESOURCES);
}
}
else
{
DbgTrace(0, "-DecodeData- Prevented uint32 overflow\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_UNSUCCESSFUL);
}
DbgTrace(3, "-DecodeData- End, retStatus = %0X\n", retStatus);

24
CASA-auth-token/client/library/mechanisms/krb5/windows/get.c
View File

@ -43,7 +43,7 @@ AuthTokenIf_GetAuthToken(
IN const char *pHostName,
IN void *pCredStoreScope,
INOUT char *pTokenBuf,
INOUT int *pTokenBufLen)
INOUT uint32_t *pTokenBufLen)
//
// Arguments:
// pIfInstance -
@ -131,6 +131,9 @@ AuthTokenIf_GetAuthToken(
else
{
DbgTrace(0, "-AuthTokenIf_GetAuthToken- Memory allocation failure\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_KRB5TOKEN,
CASA_STATUS_INSUFFICIENT_RESOURCES);
goto exit;
}
}
@ -180,12 +183,15 @@ AuthTokenIf_GetAuthToken(
&expiry);
if (secStatus == SEC_E_OK)
{
// Make sure that the token is not too large
if (sendTok.cbBuffer <= UINT32_MAX)
{
uint32_t encodedTokenLen;
char *pEncodedToken;
int encodedTokenLen;
// The security context was initialized, now return it to the caller after base64 encoding it.
retStatus = EncodeData(sendTok.pvBuffer,
(const int) sendTok.cbBuffer,
(const uint32_t) sendTok.cbBuffer,
&pEncodedToken,
&encodedTokenLen);
if (CASA_SUCCESS(retStatus))
@ -215,6 +221,18 @@ AuthTokenIf_GetAuthToken(
memset(pEncodedToken, 0, strlen(pEncodedToken));
free(pEncodedToken);
}
else
{
DbgTrace(1, "-AuthTokenIf_GetAuthToken- Encoding failed\n", 0);
}
}
else
{
DbgTrace(0, "-AuthTokenIf_GetAuthToken- GSS Token too large\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_KRB5TOKEN,
CASA_STATUS_UNSUCCESSFUL);
}
// Delete the security context
DeleteSecurityContext(&hContext);

25
CASA-auth-token/client/library/mechanisms/pwd/get.c
View File

@ -87,7 +87,7 @@ GetUserCredentials(
// Get the length of the realm string into the secret id structure
// and verify thatr it is not too long.
secretIdLen = sscs_Utf8Strlen(pRealm) + 1;
if (secretIdLen <= U32_MAX)
if (secretIdLen <= UINT32_MAX)
{
secretId.len = secretIdLen;
if (secretId.len <= NSSCS_MAX_SECRET_ID_LEN)
@ -219,7 +219,7 @@ AuthTokenIf_GetAuthToken(
IN const char *pHostName,
IN void *pCredStoreScope,
INOUT char *pTokenBuf,
INOUT int *pTokenBufLen)
INOUT size_t *pTokenBufLen)
//
// Arguments:
// pIfInstance -
@ -299,6 +299,11 @@ AuthTokenIf_GetAuthToken(
&pUsername,
&pPassword);
if (CASA_SUCCESS(retStatus))
{
size_t tokenLen = strlen(pUsername) + 2 + strlen(pPassword) + 2 + 1;
// Make sure that the token is not too large
if (tokenLen <= UINT32_MAX)
{
// Now construct the PW token with the following format:
// "username\r\n" + "password\r\n"
@ -308,14 +313,14 @@ AuthTokenIf_GetAuthToken(
if (pToken)
{
char *pEncodedToken;
int encodedTokenLen;
uint32_t encodedTokenLen;
// Now assemble the token
sprintf(pToken, "%s\r\n%s\r\n", pUsername, pPassword);
// The token has been assembled, now encode it.
retStatus = EncodeData(pToken,
(const int) strlen(pToken),
(const uint32_t) tokenLen,
&pEncodedToken,
&encodedTokenLen);
if (CASA_SUCCESS(retStatus))
@ -345,6 +350,10 @@ AuthTokenIf_GetAuthToken(
memset(pEncodedToken, 0, strlen(pEncodedToken));
free(pEncodedToken);
}
else
{
DbgTrace(1, "-AuthTokenIf_GetAuthToken- Encoding failed\n", 0);
}
// Free the buffer allocated for the token after clearing it
// to avoid leaving sensitive information behind.
@ -358,6 +367,14 @@ AuthTokenIf_GetAuthToken(
CASA_FACILITY_PWTOKEN,
CASA_STATUS_INSUFFICIENT_RESOURCES);
}
}
else
{
DbgTrace(0, "-AuthTokenIf_GetAuthToken- Token too large\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_KRB5TOKEN,
CASA_STATUS_UNSUCCESSFUL);
}
// Free allocated buffers after clearing memory holding the password
free(pUsername);

14
CASA-auth-token/client/library/mechanisms/pwd/internal.h
View File

@ -37,10 +37,6 @@
//===[ Type definitions ]==================================================
#ifndef U32_MAX
#define U32_MAX (~(uint32_t)0)
#endif
//===[ Inlines functions ]===============================================
//===[ Function prototypes ]===============================================
@ -66,7 +62,7 @@ AuthTokenIf_GetAuthToken(
IN const char *pHostName,
IN void *pCredStoreScope,
INOUT char *pTokenBuf,
INOUT int *pTokenBufLen);
INOUT size_t *pTokenBufLen);
//
// Defined in utils.c
@ -76,17 +72,17 @@ extern
CasaStatus
EncodeData(
IN const void *pData,
IN const int32_t dataLen,
IN const uint32_t dataLen,
INOUT char **ppEncodedData,
INOUT int32_t *pEncodedDataLen);
INOUT uint32_t *pEncodedDataLen);
extern
CasaStatus
DecodeData(
IN const char *pEncodedData,
IN const int32_t encodedDataLen, // Does not include NULL terminator
IN const uint32_t encodedDataLen, // Does not include NULL terminator
INOUT void **ppData,
INOUT int32_t *pDataLen);
INOUT uint32_t *pDataLen);
extern
int

26
CASA-auth-token/client/library/mechanisms/pwd/util.c
View File

@ -65,9 +65,9 @@ static const uint8_t g_Expand64[256] =
CasaStatus
EncodeData(
IN const void *pData,
IN const int32_t dataLen,
IN const uint32_t dataLen,
INOUT char **ppEncodedData,
INOUT int32_t *pEncodedDataLen)
INOUT uint32_t *pEncodedDataLen)
//
// Arguments:
//
@ -150,9 +150,9 @@ EncodeData(
CasaStatus
DecodeData(
IN const char *pEncodedData,
IN const int32_t encodedDataLen, // Does not include NULL terminator
IN const uint32_t encodedDataLen, // Does not include NULL terminator
INOUT void **ppData,
INOUT int32_t *pDataLen)
INOUT uint32_t *pDataLen)
//
// Arguments:
//
@ -164,8 +164,8 @@ DecodeData(
//=======================================================================--
{
CasaStatus retStatus;
int i, j;
int decodedSize;
uint32_t i, j;
size_t decodedSize;
DbgTrace(3, "-DecodeData- Start\n", 0);
@ -175,6 +175,9 @@ DecodeData(
j++;
decodedSize = (j * 3 + 3) / 4;
// Verify that we are not going to overflow the uint32
if (decodedSize <= UINT32_MAX)
{
// Allocate buffer to hold the decoded data
*ppData = malloc(decodedSize);
if (*ppData)
@ -265,9 +268,18 @@ DecodeData(
DbgTrace(0, "-DecodeData- Buffer allocation failure\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_PWTOKEN,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_INSUFFICIENT_RESOURCES);
}
}
else
{
DbgTrace(0, "-DecodeData- Prevented uint32 overflow\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_UNSUCCESSFUL);
}
DbgTrace(3, "-DecodeData- End, retStatus = %0X\n", retStatus);

24
CASA-auth-token/client/library/util.c
View File

@ -62,9 +62,9 @@ static const uint8_t g_Expand64[256] =
CasaStatus
EncodeData(
IN const void *pData,
IN const int32_t dataLen,
IN const uint32_t dataLen,
INOUT char **ppEncodedData,
INOUT int32_t *pEncodedDataLen)
INOUT uint32_t *pEncodedDataLen)
//
// Arguments:
//
@ -147,9 +147,9 @@ EncodeData(
CasaStatus
DecodeData(
IN const char *pEncodedData,
IN const int32_t encodedDataLen, // Does not include NULL terminator
IN const uint32_t encodedDataLen, // Does not include NULL terminator
INOUT void **ppData,
INOUT int32_t *pDataLen)
INOUT uint32_t *pDataLen)
//
// Arguments:
//
@ -161,8 +161,8 @@ DecodeData(
//=======================================================================--
{
CasaStatus retStatus;
int i, j;
int decodedSize;
uint32_t i, j;
size_t decodedSize;
DbgTrace(3, "-DecodeData- Start\n", 0);
@ -172,6 +172,9 @@ DecodeData(
j++;
decodedSize = (j * 3 + 3) / 4;
// Verify that we are not going to overflow the uint32
if (decodedSize <= UINT32_MAX)
{
// Allocate buffer to hold the decoded data
*ppData = malloc(decodedSize);
if (*ppData)
@ -265,6 +268,15 @@ DecodeData(
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_INSUFFICIENT_RESOURCES);
}
}
else
{
DbgTrace(0, "-DecodeData- Prevented uint32 overflow\n", 0);
retStatus = CasaStatusBuild(CASA_SEVERITY_ERROR,
CASA_FACILITY_AUTHTOKEN,
CASA_STATUS_UNSUCCESSFUL);
}
DbgTrace(3, "-DecodeData- End, retStatus = %0X\n", retStatus);