oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

gss_accept_sec_context: support reassembling split tokens.

Browse Source 
Microsoft will sometimes split GSS tokens when they exceed a certain
size in some protocols.  This is specified in

	[MS-SPNG]: Simple and Protected GSS-API Negotiation
	Mechanism (SPNEGO) Extension

https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SPNG/%5bMS-SPNG%5d.pdf

sections 3.1.5.4 to 3.1.5.9.

We extend gss_accept_sec_context() to recognise partial tokens and
to accumulate the fragments until an entire token is available to
be processed.  If the entire token is not yet available,
GSS_S_CONTINUE_NEEDED is returned with a zero length output token.
This is specified in RFC2744 page 25-26 to indicate that no reply
need be sent.

We include updates to the test framework to test split tokens when
using SPNEGO.
This commit is contained in:
Roland C. Dowdeswell
2021-08-02 22:55:47 +01:00
committed by Luke Howard
parent 80f3194a76
commit 3a6229f64a
7 changed files with 543 additions and 213 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
lib/gssapi/mech/context.h
View File

@@ -30,10 +30,20 @@
#include <gssapi_mech.h>
struct _gss_context {
gssapi_mech_interface gc_mech;
gss_ctx_id_t gc_ctx;
gss_buffer_desc gc_input;
char *gc_free_this;
size_t gc_target_len;
size_t gc_oid_offset;
gssapi_mech_interface gc_mech;
gss_ctx_id_t gc_ctx;
uint8_t gc_initial;
};
#define EXPORT_CONTEXT_VERSION_MASK 0x03
#define EXPORT_CONTEXT_FLAGS_MASK 0xfc
#define EXPORT_CONTEXT_FLAG_ACCUMULATING 0x04
#define EXPORT_CONTEXT_FLAG_MECH_CTX 0x08
void
_gss_mg_error(gssapi_mech_interface, OM_uint32);