gsskrb5: Add simple name attributes support

This adds Kerberos mechanism support for:

 - composite principal name export/import
 - getting rudimentary name attributes from GSS names using
   gss_get_name_attribute():
    - all (raw) authorization data from the Ticket
    - all (raw) authorization data from the Authenticator
    - transit path
    - realm
    - component count
    - each component
 - gss_inquire_name()
 - gss_display_name_ext() (just for the hostbased service name type
                           though)

The test exercises almost all of the functionality, except for:

 - getting the PAC
 - getting authz-data from the Authenticator
 - getting the transit path

TBD (much) later:

 - amend test_context to do minimal name attribute checks as well
 - gss_set_name_attribute() (to request authz-data)
 - gss_delete_name_attribute()
 - getting specific authorization data elements via URN fragments (as
   opposed to all of them)
 - parsing the PAC, extracting SIDs (each one as a separate value)
 - some configurable local policy (?)
 - plugin interface for additional local policy

lib/gssapi/mech/gss_import_name.c

@@ -31,6 +31,7 @@
 static OM_uint32
 _gss_import_export_name(OM_uint32 *minor_status,
     const gss_buffer_t input_name_buffer,
+    const gss_OID name_type,
     gss_name_t *output_name)
 {
 	OM_uint32 major_status;
@@ -65,6 +66,24 @@ _gss_import_export_name(OM_uint32 *minor_status,
 	p += 2;
 	len -= 2;
 
+        /*
+         * If the name token is a composite token (TOK_ID 0x04 0x02) then per
+         * RFC6680 everything after that is implementation-specific.  This
+         * mech-glue is pluggable however, so we need the format of the rest of
+         * the header to be stable, otherwise we couldn't reliably determine
+         * what mechanism the token is for and we'd have to try all of them.
+         *
+         * So... we keep the same format for the exported composite name token
+         * as for normal exported name tokens (see RFC2743, section 3.2), with
+         * the TOK_ID 0x04 0x02, but only up to the mechanism OID.  We don't
+         * enforce that there be a NAME_LEN in the exported composite name
+         * token, or that it match the length of the remainder of the token.
+         *
+         * FYI, at least one out-of-tree mechanism implements exported
+         * composite name tokens as the same as exported name tokens with
+         * attributes appended and the NAME_LEN not modified to match.
+         */
+
 	/*
 	 * Get the mech length and the name length and sanity
 	 * check the size of of the buffer.
@@ -107,17 +126,19 @@ _gss_import_export_name(OM_uint32 *minor_status,
 
 	mech_oid.elements = p;
 
-	if (len < t + 4)
-		return (GSS_S_BAD_NAME);
-	p += t;
-	len -= t;
+        if (!composite) {
+                if (len < t + 4)
+                        return (GSS_S_BAD_NAME);
+                p += t;
+                len -= t;
 
-	t = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
-	p += 4;
-	len -= 4;
+                t = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
+                p += 4;
+                len -= 4;
 
-	if (!composite && len != t)
-		return (GSS_S_BAD_NAME);
+                if (len != t)
+                        return (GSS_S_BAD_NAME);
+        }
 
 	m = __gss_get_mechanism(&mech_oid);
 	if (!m || !m->gm_import_name)
@@ -127,7 +148,7 @@ _gss_import_export_name(OM_uint32 *minor_status,
 	 * Ask the mechanism to import the name.
 	 */
 	major_status = m->gm_import_name(minor_status,
-	    input_name_buffer, GSS_C_NT_EXPORT_NAME, &new_canonical_name);
+            input_name_buffer, name_type, &new_canonical_name);
 	if (major_status != GSS_S_COMPLETE) {
 		_gss_mg_error(m, *minor_status);
 		return major_status;
@@ -156,6 +177,7 @@ _gss_import_export_name(OM_uint32 *minor_status,
  * - GSS_C_NT_USER_NAME
  * - GSS_C_NT_HOSTBASED_SERVICE
  * - GSS_C_NT_EXPORT_NAME
+ * - GSS_C_NT_COMPOSITE_EXPORT
  * - GSS_C_NT_ANONYMOUS
  * - GSS_KRB5_NT_PRINCIPAL_NAME
  *
@@ -202,9 +224,10 @@ gss_import_name(OM_uint32 *minor_status,
 	 * the mechanism and then import it as an MN. See RFC 2743
 	 * section 3.2 for a description of the format.
 	 */
-	if (gss_oid_equal(name_type, GSS_C_NT_EXPORT_NAME)) {
-		return _gss_import_export_name(minor_status,
-		    input_name_buffer, output_name);
+	if (gss_oid_equal(name_type, GSS_C_NT_EXPORT_NAME) ||
+            gss_oid_equal(name_type, GSS_C_NT_COMPOSITE_EXPORT)) {
+                return _gss_import_export_name(minor_status, input_name_buffer,
+                                               name_type, output_name);
 	}