oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

gss: port NegoEx implementation from MIT

Browse Source 
An implementation of draft-zhu-negoex-04 for MIT Kerberos was developed in
2011. This has been recently integrated, with many fixes from Greg Hudson. This
commit ports it to Heimdal. The implementation has been interoperability tested
with MIT Kerberos and Windows, using the GSS EAP mechanism developed as part of
the Moonshot project.

The SPNEGO code was also updated to import the state machine from Apple which
improves mechListMIC processing and avoids discarding initial context tokens
generated during mechanism probing, that can be used for optimistic tokens.

Finally, to aid in testing, the GSS-API mechanism glue configuration file can
be changed using the environment variable GSS_MECH_CONFIG. This environment
variable name, along with the format of the configuration file, is compatible
with MIT (although it would be difficult for a single mechanism binary to
support both implementations).
This commit is contained in:
Luke Howard
2019-12-30 13:34:10 +11:00
parent ae5c60286a
commit 4fb6a6adc9
45 changed files with 6241 additions and 863 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
lib/gssapi/gssapi_mech.h
View File

@@ -484,6 +484,29 @@ _gss_get_neg_mechs_t(OM_uint32 *minor_status,
gss_const_cred_id_t cred_handle,
gss_OID_set *mechs);
typedef OM_uint32 GSSAPI_CALLCONV
_gss_query_mechanism_info_t(OM_uint32 *minor_status,
gss_const_OID mech_oid,
unsigned char auth_scheme[16]);
typedef OM_uint32 GSSAPI_CALLCONV
_gss_query_meta_data_t(OM_uint32 *minor_status,
gss_const_OID mech_oid,
gss_cred_id_t cred_handle,
gss_ctx_id_t *ctx_handle,
gss_const_name_t targ_name,
OM_uint32 req_flags,
gss_buffer_t meta_data);
typedef OM_uint32 GSSAPI_CALLCONV
_gss_exchange_meta_data_t(OM_uint32 *minor_status,
gss_const_OID mech_oid,
gss_cred_id_t cred_handle,
gss_ctx_id_t *ctx_handle,
gss_const_name_t targ_name,
OM_uint32 req_flags,
gss_const_buffer_t meta_data);
/*
*
*/
@@ -597,6 +620,9 @@ typedef struct gssapi_mech_interface_desc {
_gss_store_cred_into_t *gm_store_cred_into;
_gss_set_neg_mechs_t *gm_set_neg_mechs;
_gss_get_neg_mechs_t *gm_get_neg_mechs;
_gss_query_mechanism_info_t *gm_query_mechanism_info;
_gss_query_meta_data_t *gm_query_meta_data;
_gss_exchange_meta_data_t *gm_exchange_meta_data;
struct gss_mech_compat_desc_struct *gm_compat;
} gssapi_mech_interface_desc, *gssapi_mech_interface;
@@ -669,4 +695,17 @@ gss_mg_set_error_string(gss_OID mech,
OM_uint32 maj, OM_uint32 min,
const char *fmt, ...);
gss_cred_id_t
_gss_mg_find_mech_cred(gss_const_cred_id_t cred_handle,
gss_const_OID mech_type);
#include <krb5.h>
/*
* Mechglue krb5 context for use by NegoEx. This is not shared with the
* krb5 GSS mechanism so we don't clobber its error state.
*/
krb5_context
_gss_mg_krb5_context(void);
#endif /* GSSAPI_MECH_H */