src/lib/gssapi/krb5/gssapiP_krb5.h

   1 /* -*- mode: c; indent-tabs-mode: nil -*- */
   2 /*
   3  * Copyright 2000, 2008 by the Massachusetts Institute of Technology.
   4  * All Rights Reserved.
   5  *
   6  * Export of this software from the United States of America may
   7  *   require a specific license from the United States Government.
   8  *   It is the responsibility of any person or organization contemplating
   9  *   export to obtain such a license before exporting.
  10  *
  11  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  12  * distribute this software and its documentation for any purpose and
  13  * without fee is hereby granted, provided that the above copyright
  14  * notice appear in all copies and that both that copyright notice and
  15  * this permission notice appear in supporting documentation, and that
  16  * the name of M.I.T. not be used in advertising or publicity pertaining
  17  * to distribution of the software without specific, written prior
  18  * permission.  Furthermore if you modify this software you must label
  19  * your software as modified software and not distribute it in such a
  20  * fashion that it might be confused with the original M.I.T. software.
  21  * M.I.T. makes no representations about the suitability of
  22  * this software for any purpose.  It is provided "as is" without express
  23  * or implied warranty.
  24  *
  25  */
  26 /*
  27  * Copyright 1993 by OpenVision Technologies, Inc.
  28  *
  29  * Permission to use, copy, modify, distribute, and sell this software
  30  * and its documentation for any purpose is hereby granted without fee,
  31  * provided that the above copyright notice appears in all copies and
  32  * that both that copyright notice and this permission notice appear in
  33  * supporting documentation, and that the name of OpenVision not be used
  34  * in advertising or publicity pertaining to distribution of the software
  35  * without specific, written prior permission. OpenVision makes no
  36  * representations about the suitability of this software for any
  37  * purpose.  It is provided "as is" without express or implied warranty.
  38  *
  39  * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  40  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  41  * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  42  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
  43  * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
  44  * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  45  * PERFORMANCE OF THIS SOFTWARE.
  46  */
  47
  48 #ifndef _GSSAPIP_KRB5_H_
  49 #define _GSSAPIP_KRB5_H_
  50
  51 #include <k5-int.h>
  52
  53 #ifdef HAVE_MEMORY_H
  54 #include <memory.h>
  55 #endif
  56
  57 /* work around sunos braindamage */
  58 #ifdef major
  59 #undef major
  60 #endif
  61 #ifdef minor
  62 #undef minor
  63 #endif
  64
  65 #include "gssapiP_generic.h"
  66
  67 /* The include of gssapi_krb5.h will dtrt with the above #defines in
  68  * effect.
  69  */
  70 #include "gssapi_krb5.h"
  71 #include "gssapi_err_krb5.h"
  72 #include "gssapi_ext.h"
  73
  74 /* for debugging */
  75 #undef CFX_EXERCISE
  76
  77 /** constants **/
  78
  79 #define GSS_MECH_KRB5_OID_LENGTH 9
  80 #define GSS_MECH_KRB5_OID "\052\206\110\206\367\022\001\002\002"
  81
  82 #define GSS_MECH_KRB5_OLD_OID_LENGTH 5
  83 #define GSS_MECH_KRB5_OLD_OID "\053\005\001\005\002"
  84
  85 /* Incorrect krb5 mech OID emitted by MS. */
  86 #define GSS_MECH_KRB5_WRONG_OID_LENGTH 9
  87 #define GSS_MECH_KRB5_WRONG_OID "\052\206\110\202\367\022\001\002\002"
  88
  89 /* IAKERB variant */
  90 #define GSS_MECH_IAKERB_OID_LENGTH 6
  91 #define GSS_MECH_IAKERB_OID "\053\006\001\005\002\005"
  92
  93 #define CKSUMTYPE_KG_CB         0x8003
  94
  95 #define KG_TOK_CTX_AP_REQ       0x0100
  96 #define KG_TOK_CTX_AP_REP       0x0200
  97 #define KG_TOK_CTX_ERROR        0x0300
  98 #define KG_TOK_SIGN_MSG         0x0101
  99 #define KG_TOK_SEAL_MSG         0x0201
 100 #define KG_TOK_MIC_MSG          0x0101
 101 #define KG_TOK_WRAP_MSG         0x0201
 102 #define KG_TOK_DEL_CTX          0x0102
 103 #define KG2_TOK_MIC_MSG         0x0404
 104 #define KG2_TOK_WRAP_MSG        0x0504
 105 #define KG2_TOK_DEL_CTX         0x0405
 106 #define IAKERB_TOK_PROXY        0x0501
 107
 108 #define KRB5_GSS_FOR_CREDS_OPTION 1
 109
 110 #define KG2_RESP_FLAG_ERROR             0x0001
 111 #define KG2_RESP_FLAG_DELEG_OK          0x0002
 112
 113 /** CFX flags **/
 114 #define FLAG_SENDER_IS_ACCEPTOR 0x01
 115 #define FLAG_WRAP_CONFIDENTIAL  0x02
 116 #define FLAG_ACCEPTOR_SUBKEY    0x04
 117
 118 /* These are to be stored in little-endian order, i.e., des-mac is
 119    stored as 02 00.  */
 120 enum sgn_alg {
 121     SGN_ALG_DES_MAC_MD5           = 0x0000,
 122     SGN_ALG_MD2_5                 = 0x0001,
 123     SGN_ALG_DES_MAC               = 0x0002,
 124     SGN_ALG_3                     = 0x0003, /* not published */
 125     SGN_ALG_HMAC_MD5              = 0x0011, /* microsoft w2k;  */
 126     SGN_ALG_HMAC_SHA1_DES3_KD     = 0x0004
 127 };
 128 enum seal_alg {
 129     SEAL_ALG_NONE            = 0xffff,
 130     SEAL_ALG_DES             = 0x0000,
 131     SEAL_ALG_1               = 0x0001, /* not published */
 132     SEAL_ALG_MICROSOFT_RC4   = 0x0010, /* microsoft w2k;  */
 133     SEAL_ALG_DES3KD          = 0x0002
 134 };
 135
 136 /* for 3DES */
 137 #define KG_USAGE_SEAL 22
 138 #define KG_USAGE_SIGN 23
 139 #define KG_USAGE_SEQ  24
 140
 141 /* for draft-ietf-krb-wg-gssapi-cfx-01 */
 142 #define KG_USAGE_ACCEPTOR_SEAL  22
 143 #define KG_USAGE_ACCEPTOR_SIGN  23
 144 #define KG_USAGE_INITIATOR_SEAL 24
 145 #define KG_USAGE_INITIATOR_SIGN 25
 146
 147 enum qop {
 148     GSS_KRB5_INTEG_C_QOP_MD5       = 0x0001, /* *partial* MD5 = "MD2.5" */
 149     GSS_KRB5_INTEG_C_QOP_DES_MD5   = 0x0002,
 150     GSS_KRB5_INTEG_C_QOP_DES_MAC   = 0x0003,
 151     GSS_KRB5_INTEG_C_QOP_HMAC_SHA1 = 0x0004,
 152     GSS_KRB5_INTEG_C_QOP_MASK      = 0x00ff,
 153     GSS_KRB5_CONF_C_QOP_DES        = 0x0100,
 154     GSS_KRB5_CONF_C_QOP_DES3_KD    = 0x0200,
 155     GSS_KRB5_CONF_C_QOP_MASK       = 0xff00
 156 };
 157
 158 /** internal types **/
 159
 160 typedef struct _krb5_gss_name_rec {
 161     krb5_principal princ;       /* immutable */
 162     char *service;              /* immutable */
 163     char *host;                 /* immutable */
 164     k5_mutex_t lock;            /* protects ad_context only for now */
 165     krb5_authdata_context ad_context;
 166 } krb5_gss_name_rec, *krb5_gss_name_t;
 167
 168 typedef struct _krb5_gss_cred_id_rec {
 169     /* protect against simultaneous accesses */
 170     k5_mutex_t lock;
 171
 172     /* name/type of credential */
 173     gss_cred_usage_t usage;
 174     krb5_gss_name_t name;
 175     unsigned int proxy_cred : 1;
 176     unsigned int default_identity : 1;
 177     unsigned int iakerb_mech : 1;
 178     unsigned int destroy_ccache : 1;
 179
 180     /* keytab (accept) data */
 181     krb5_keytab keytab;
 182     krb5_rcache rcache;
 183
 184     /* ccache (init) data */
 185     krb5_ccache ccache;
 186     krb5_timestamp tgt_expire;
 187     krb5_enctype *req_enctypes;  /* limit negotiated enctypes to this list */
 188     krb5_data password;
 189 } krb5_gss_cred_id_rec, *krb5_gss_cred_id_t;
 190
 191 typedef struct _krb5_gss_ctx_ext_rec {
 192     struct {
 193         krb5_data *conv;
 194         int verified;
 195     } iakerb;
 196 } krb5_gss_ctx_ext_rec, *krb5_gss_ctx_ext_t;
 197
 198 typedef struct _krb5_gss_ctx_id_rec {
 199     krb5_magic magic;
 200     unsigned int initiate : 1;   /* nonzero if initiating, zero if accepting */
 201     unsigned int established : 1;
 202     unsigned int big_endian : 1;
 203     unsigned int have_acceptor_subkey : 1;
 204     unsigned int seed_init : 1;  /* XXX tested but never actually set */
 205     OM_uint32 gss_flags;
 206     unsigned char seed[16];
 207     krb5_gss_name_t here;
 208     krb5_gss_name_t there;
 209     krb5_key subkey; /* One of two potential keys to use with RFC 4121
 210                       * packets; this key must always be set. */
 211     int signalg;
 212     size_t cksum_size;
 213     int sealalg;
 214     krb5_key enc; /* RFC 1964 encryption key; seq xored with a constant
 215                    * for DES, seq for other RFC 1964 enctypes  */
 216     krb5_key seq; /* RFC 1964 sequencing key */
 217     krb5_ticket_times krb_times;
 218     krb5_flags krb_flags;
 219     /* XXX these used to be signed.  the old spec is inspecific, and
 220        the new spec specifies unsigned.  I don't believe that the change
 221        affects the wire encoding. */
 222     gssint_uint64 seq_send;
 223     gssint_uint64 seq_recv;
 224     void *seqstate;
 225     krb5_context k5_context;
 226     krb5_auth_context auth_context;
 227     gss_OID_desc *mech_used;
 228     /* Protocol spec revision for sending packets
 229        0 => RFC 1964 with 3DES and RC4 enhancements
 230        1 => RFC 4121
 231        No others defined so far.  It is always permitted to receive
 232        tokens in RFC 4121 format.  If enc is non-null, receiving RFC
 233        1964 tokens is permitted.*/
 234     int proto;
 235     krb5_cksumtype cksumtype;    /* for "main" subkey */
 236     krb5_key acceptor_subkey; /* CFX only */
 237     krb5_cksumtype acceptor_subkey_cksumtype;
 238     int cred_rcache;             /* did we get rcache from creds? */
 239     krb5_authdata **authdata;
 240 } krb5_gss_ctx_id_rec, *krb5_gss_ctx_id_t;
 241
 242 extern g_set kg_vdb;
 243
 244 #ifndef LEAN_CLIENT
 245 extern k5_mutex_t gssint_krb5_keytab_lock;
 246 #endif /* LEAN_CLIENT */
 247
 248 /** helper functions **/
 249
 250 OM_uint32 kg_get_defcred
 251 (OM_uint32 *minor_status,
 252  gss_cred_id_t *cred);
 253
 254 krb5_error_code kg_checksum_channel_bindings
 255 (krb5_context context, gss_channel_bindings_t cb,
 256  krb5_checksum *cksum,
 257  int bigend);
 258
 259 krb5_error_code kg_make_seq_num (krb5_context context,
 260                                  krb5_key key,
 261                                  int direction, krb5_ui_4 seqnum, unsigned char *cksum,
 262                                  unsigned char *buf);
 263
 264 krb5_error_code kg_get_seq_num (krb5_context context,
 265                                 krb5_key key,
 266                                 unsigned char *cksum, unsigned char *buf, int *direction,
 267                                 krb5_ui_4 *seqnum);
 268
 269 krb5_error_code kg_make_seed (krb5_context context,
 270                               krb5_key key,
 271                               unsigned char *seed);
 272
 273 krb5_error_code
 274 kg_setup_keys(krb5_context context,
 275               krb5_gss_ctx_id_rec *ctx,
 276               krb5_key subkey,
 277               krb5_cksumtype *cksumtype);
 278
 279 int kg_confounder_size (krb5_context context, krb5_enctype enctype);
 280
 281 krb5_error_code kg_make_confounder (krb5_context context,
 282                                     krb5_enctype enctype, unsigned char *buf);
 283
 284 krb5_error_code kg_encrypt (krb5_context context,
 285                             krb5_key key, int usage,
 286                             krb5_pointer iv,
 287                             krb5_const_pointer in,
 288                             krb5_pointer out,
 289                             unsigned int length);
 290
 291 /* Encrypt length bytes at ptr in place, with the given key and usage.  If
 292  * iv is not NULL, use it as the cipher state. */
 293 krb5_error_code kg_encrypt_inplace(krb5_context context, krb5_key key,
 294                                    int usage, krb5_pointer iv,
 295                                    krb5_pointer ptr, unsigned int length);
 296
 297 krb5_error_code kg_encrypt_iov (krb5_context context,
 298                                 int proto, int dce_style,
 299                                 size_t ec, size_t rrc,
 300                                 krb5_key key, int usage,
 301                                 krb5_pointer iv,
 302                                 gss_iov_buffer_desc *iov,
 303                                 int iov_count);
 304
 305 krb5_error_code
 306 kg_arcfour_docrypt (const krb5_keyblock *keyblock, int usage,
 307                     const unsigned char *kd_data, size_t kd_data_len,
 308                     const unsigned char *input_buf, size_t input_len,
 309                     unsigned char *output_buf);
 310
 311 krb5_error_code
 312 kg_arcfour_docrypt_iov (krb5_context context,
 313                         const krb5_keyblock *keyblock, int usage,
 314                         const unsigned char *kd_data, size_t kd_data_len,
 315                         gss_iov_buffer_desc *iov,
 316                         int iov_count);
 317
 318 krb5_error_code kg_decrypt (krb5_context context,
 319                             krb5_key key,  int usage,
 320                             krb5_pointer iv,
 321                             krb5_const_pointer in,
 322                             krb5_pointer out,
 323                             unsigned int length);
 324
 325 krb5_error_code kg_decrypt_iov (krb5_context context,
 326                                 int proto, int dce_style,
 327                                 size_t ec, size_t rrc,
 328                                 krb5_key key,  int usage,
 329                                 krb5_pointer iv,
 330                                 gss_iov_buffer_desc *iov,
 331                                 int iov_count);
 332
 333 OM_uint32 kg_seal (OM_uint32 *minor_status,
 334                    gss_ctx_id_t context_handle,
 335                    int conf_req_flag,
 336                    gss_qop_t qop_req,
 337                    gss_buffer_t input_message_buffer,
 338                    int *conf_state,
 339                    gss_buffer_t output_message_buffer,
 340                    int toktype);
 341
 342 OM_uint32 kg_unseal (OM_uint32 *minor_status,
 343                      gss_ctx_id_t context_handle,
 344                      gss_buffer_t input_token_buffer,
 345                      gss_buffer_t message_buffer,
 346                      int *conf_state,
 347                      gss_qop_t *qop_state,
 348                      int toktype);
 349
 350 OM_uint32 kg_seal_size (OM_uint32 *minor_status,
 351                         gss_ctx_id_t context_handle,
 352                         int conf_req_flag,
 353                         gss_qop_t qop_req,
 354                         OM_uint32 output_size,
 355                         OM_uint32 *input_size);
 356
 357 krb5_error_code kg_ctx_size (krb5_context kcontext,
 358                              krb5_pointer arg,
 359                              size_t *sizep);
 360
 361 krb5_error_code kg_ctx_externalize (krb5_context kcontext,
 362                                     krb5_pointer arg,
 363                                     krb5_octet **buffer,
 364                                     size_t *lenremain);
 365
 366 krb5_error_code kg_ctx_internalize (krb5_context kcontext,
 367                                     krb5_pointer *argp,
 368                                     krb5_octet **buffer,
 369                                     size_t *lenremain);
 370
 371 OM_uint32 kg_sync_ccache_name (krb5_context context, OM_uint32 *minor_status);
 372
 373 OM_uint32 kg_caller_provided_ccache_name (OM_uint32 *minor_status,
 374                                           int *out_caller_provided_name);
 375
 376 OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status,
 377                               const char **out_name);
 378
 379 OM_uint32 kg_set_ccache_name (OM_uint32 *minor_status,
 380                               const char *name);
 381
 382 /* AEAD */
 383
 384 krb5_error_code gss_krb5int_make_seal_token_v3_iov(krb5_context context,
 385                            krb5_gss_ctx_id_rec *ctx,
 386                            int conf_req_flag,
 387                            int *conf_state,
 388                            gss_iov_buffer_desc *iov,
 389                            int iov_count,
 390                            int toktype);
 391
 392 OM_uint32 gss_krb5int_unseal_v3_iov(krb5_context context,
 393                           OM_uint32 *minor_status,
 394                           krb5_gss_ctx_id_rec *ctx,
 395                           gss_iov_buffer_desc *iov,
 396                           int iov_count,
 397                           int *conf_state,
 398                           gss_qop_t *qop_state,
 399                           int toktype);
 400
 401 gss_iov_buffer_t kg_locate_iov (gss_iov_buffer_desc *iov,
 402               int iov_count,
 403               OM_uint32 type);
 404
 405 void kg_iov_msglen(gss_iov_buffer_desc *iov,
 406               int iov_count,
 407               size_t *data_length,
 408               size_t *assoc_data_length);
 409
 410 void kg_release_iov(gss_iov_buffer_desc *iov,
 411                int iov_count);
 412
 413 krb5_error_code kg_make_checksum_iov_v1(krb5_context context,
 414                 krb5_cksumtype type,
 415                 size_t token_cksum_len,
 416                 krb5_key seq,
 417                 krb5_key enc, /* for conf len */
 418                 krb5_keyusage sign_usage,
 419                 gss_iov_buffer_desc *iov,
 420                 int iov_count,
 421                 int toktype,
 422                 krb5_checksum *checksum);
 423
 424 krb5_error_code kg_make_checksum_iov_v3(krb5_context context,
 425                 krb5_cksumtype type,
 426                 size_t rrc,
 427                 krb5_key key,
 428                 krb5_keyusage sign_usage,
 429                 gss_iov_buffer_desc *iov,
 430                 int iov_count);
 431
 432 krb5_error_code kg_verify_checksum_iov_v3(krb5_context context,
 433                 krb5_cksumtype type,
 434                 size_t rrc,
 435                 krb5_key key,
 436                 krb5_keyusage sign_usage,
 437                 gss_iov_buffer_desc *iov,
 438                 int iov_count,
 439                 krb5_boolean *valid);
 440
 441 OM_uint32 kg_seal_iov (OM_uint32 *minor_status,
 442             gss_ctx_id_t context_handle,
 443             int conf_req_flag,
 444             gss_qop_t qop_req,
 445             int *conf_state,
 446             gss_iov_buffer_desc *iov,
 447             int iov_count,
 448             int toktype);
 449
 450 OM_uint32 kg_unseal_iov (OM_uint32 *minor_status,
 451             gss_ctx_id_t context_handle,
 452             int *conf_state,
 453             gss_qop_t *qop_state,
 454             gss_iov_buffer_desc *iov,
 455             int iov_count,
 456             int toktype);
 457
 458 OM_uint32 kg_seal_iov_length(OM_uint32 *minor_status,
 459            gss_ctx_id_t context_handle,
 460            int conf_req_flag,
 461            gss_qop_t qop_req,
 462            int *conf_state,
 463            gss_iov_buffer_desc *iov,
 464            int iov_count);
 465
 466 krb5_cryptotype kg_translate_flag_iov(OM_uint32 type);
 467
 468 OM_uint32 kg_fixup_padding_iov(OM_uint32 *minor_status,
 469         gss_iov_buffer_desc *iov,
 470         int iov_count);
 471
 472 krb5_boolean kg_integ_only_iov(gss_iov_buffer_desc *iov, int iov_count);
 473
 474 krb5_error_code kg_allocate_iov(gss_iov_buffer_t iov, size_t size);
 475
 476 krb5_error_code
 477 krb5_to_gss_cred(krb5_context context,
 478                  krb5_creds *creds,
 479                  krb5_gss_cred_id_t *out_cred);
 480
 481 OM_uint32
 482 kg_cred_resolve(OM_uint32 *minor_status, krb5_context context,
 483                 gss_cred_id_t cred_handle, gss_name_t target_name);
 484
 485 /** declarations of internal name mechanism functions **/
 486
 487 OM_uint32 KRB5_CALLCONV krb5_gss_acquire_cred
 488 (OM_uint32*,       /* minor_status */
 489  gss_name_t,       /* desired_name */
 490  OM_uint32,        /* time_req */
 491  gss_OID_set,      /* desired_mechs */
 492  gss_cred_usage_t, /* cred_usage */
 493  gss_cred_id_t*,   /* output_cred_handle */
 494  gss_OID_set*,     /* actual_mechs */
 495  OM_uint32*        /* time_rec */
 496 );
 497
 498 OM_uint32 KRB5_CALLCONV iakerb_gss_acquire_cred
 499 (OM_uint32*,       /* minor_status */
 500  gss_name_t,       /* desired_name */
 501  OM_uint32,        /* time_req */
 502  gss_OID_set,      /* desired_mechs */
 503  gss_cred_usage_t, /* cred_usage */
 504  gss_cred_id_t*,   /* output_cred_handle */
 505  gss_OID_set*,     /* actual_mechs */
 506  OM_uint32*        /* time_rec */
 507 );
 508
 509 OM_uint32 KRB5_CALLCONV
 510 krb5_gss_acquire_cred_with_password(
 511     OM_uint32 *minor_status,
 512     const gss_name_t desired_name,
 513     const gss_buffer_t password,
 514     OM_uint32 time_req,
 515     const gss_OID_set desired_mechs,
 516     int cred_usage,
 517     gss_cred_id_t *output_cred_handle,
 518     gss_OID_set *actual_mechs,
 519     OM_uint32 *time_rec);
 520
 521 OM_uint32 KRB5_CALLCONV
 522 iakerb_gss_acquire_cred_with_password(
 523     OM_uint32 *minor_status,
 524     const gss_name_t desired_name,
 525     const gss_buffer_t password,
 526     OM_uint32 time_req,
 527     const gss_OID_set desired_mechs,
 528     int cred_usage,
 529     gss_cred_id_t *output_cred_handle,
 530     gss_OID_set *actual_mechs,
 531     OM_uint32 *time_rec);
 532
 533 OM_uint32 KRB5_CALLCONV krb5_gss_release_cred
 534 (OM_uint32*,       /* minor_status */
 535  gss_cred_id_t*    /* cred_handle */
 536 );
 537
 538 OM_uint32 KRB5_CALLCONV krb5_gss_init_sec_context
 539 (OM_uint32*,       /* minor_status */
 540  gss_cred_id_t,    /* claimant_cred_handle */
 541  gss_ctx_id_t*,    /* context_handle */
 542  gss_name_t,       /* target_name */
 543  gss_OID,          /* mech_type */
 544  OM_uint32,        /* req_flags */
 545  OM_uint32,        /* time_req */
 546  gss_channel_bindings_t,
 547  /* input_chan_bindings */
 548  gss_buffer_t,     /* input_token */
 549  gss_OID*,         /* actual_mech_type */
 550  gss_buffer_t,     /* output_token */
 551  OM_uint32*,       /* ret_flags */
 552  OM_uint32*        /* time_rec */
 553 );
 554
 555 OM_uint32 krb5_gss_init_sec_context_ext
 556 (OM_uint32*,       /* minor_status */
 557  gss_cred_id_t,    /* claimant_cred_handle */
 558  gss_ctx_id_t*,    /* context_handle */
 559  gss_name_t,       /* target_name */
 560  gss_OID,          /* mech_type */
 561  OM_uint32,        /* req_flags */
 562  OM_uint32,        /* time_req */
 563  gss_channel_bindings_t,
 564  /* input_chan_bindings */
 565  gss_buffer_t,     /* input_token */
 566  gss_OID*,         /* actual_mech_type */
 567  gss_buffer_t,     /* output_token */
 568  OM_uint32*,       /* ret_flags */
 569  OM_uint32*,       /* time_rec */
 570  krb5_gss_ctx_ext_t /* exts */
 571 );
 572
 573 #ifndef LEAN_CLIENT
 574 OM_uint32 KRB5_CALLCONV krb5_gss_accept_sec_context
 575 (OM_uint32*,       /* minor_status */
 576  gss_ctx_id_t*,    /* context_handle */
 577  gss_cred_id_t,    /* verifier_cred_handle */
 578  gss_buffer_t,     /* input_token_buffer */
 579  gss_channel_bindings_t,
 580  /* input_chan_bindings */
 581  gss_name_t*,      /* src_name */
 582  gss_OID*,         /* mech_type */
 583  gss_buffer_t,     /* output_token */
 584  OM_uint32*,       /* ret_flags */
 585  OM_uint32*,       /* time_rec */
 586  gss_cred_id_t*    /* delegated_cred_handle */
 587 );
 588
 589 OM_uint32 KRB5_CALLCONV krb5_gss_accept_sec_context_ext
 590 (OM_uint32*,       /* minor_status */
 591  gss_ctx_id_t*,    /* context_handle */
 592  gss_cred_id_t,    /* verifier_cred_handle */
 593  gss_buffer_t,     /* input_token_buffer */
 594  gss_channel_bindings_t,
 595  /* input_chan_bindings */
 596  gss_name_t*,      /* src_name */
 597  gss_OID*,         /* mech_type */
 598  gss_buffer_t,     /* output_token */
 599  OM_uint32*,       /* ret_flags */
 600  OM_uint32*,       /* time_rec */
 601  gss_cred_id_t*,   /* delegated_cred_handle */
 602  krb5_gss_ctx_ext_t/*exts */
 603 );
 604 #endif /* LEAN_CLIENT */
 605
 606 OM_uint32 KRB5_CALLCONV krb5_gss_process_context_token
 607 (OM_uint32*,       /* minor_status */
 608  gss_ctx_id_t,     /* context_handle */
 609  gss_buffer_t      /* token_buffer */
 610 );
 611
 612 OM_uint32 KRB5_CALLCONV krb5_gss_delete_sec_context
 613 (OM_uint32*,       /* minor_status */
 614  gss_ctx_id_t*,    /* context_handle */
 615  gss_buffer_t      /* output_token */
 616 );
 617
 618 OM_uint32 KRB5_CALLCONV krb5_gss_context_time
 619 (OM_uint32*,       /* minor_status */
 620  gss_ctx_id_t,     /* context_handle */
 621  OM_uint32*        /* time_rec */
 622 );
 623
 624 OM_uint32 KRB5_CALLCONV krb5_gss_display_status
 625 (OM_uint32*,       /* minor_status */
 626  OM_uint32,        /* status_value */
 627  int,              /* status_type */
 628  gss_OID,          /* mech_type */
 629  OM_uint32*,       /* message_context */
 630  gss_buffer_t      /* status_string */
 631 );
 632
 633 OM_uint32 KRB5_CALLCONV krb5_gss_indicate_mechs
 634 (OM_uint32*,       /* minor_status */
 635  gss_OID_set*      /* mech_set */
 636 );
 637
 638 OM_uint32 KRB5_CALLCONV krb5_gss_compare_name
 639 (OM_uint32*,       /* minor_status */
 640  gss_name_t,       /* name1 */
 641  gss_name_t,       /* name2 */
 642  int*              /* name_equal */
 643 );
 644
 645 OM_uint32 KRB5_CALLCONV krb5_gss_display_name
 646 (OM_uint32*,      /* minor_status */
 647  gss_name_t,      /* input_name */
 648  gss_buffer_t,    /* output_name_buffer */
 649  gss_OID*         /* output_name_type */
 650 );
 651
 652
 653 OM_uint32 KRB5_CALLCONV krb5_gss_import_name
 654 (OM_uint32*,       /* minor_status */
 655  gss_buffer_t,     /* input_name_buffer */
 656  gss_OID,          /* input_name_type */
 657  gss_name_t*       /* output_name */
 658 );
 659
 660 OM_uint32 KRB5_CALLCONV krb5_gss_release_name
 661 (OM_uint32*,       /* minor_status */
 662  gss_name_t*       /* input_name */
 663 );
 664
 665 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_cred
 666 (OM_uint32 *,      /* minor_status */
 667  gss_cred_id_t,    /* cred_handle */
 668  gss_name_t *,     /* name */
 669  OM_uint32 *,      /* lifetime */
 670  gss_cred_usage_t*,/* cred_usage */
 671  gss_OID_set *     /* mechanisms */
 672 );
 673
 674 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_context
 675 (OM_uint32*,       /* minor_status */
 676  gss_ctx_id_t,     /* context_handle */
 677  gss_name_t*,      /* initiator_name */
 678  gss_name_t*,      /* acceptor_name */
 679  OM_uint32*,       /* lifetime_rec */
 680  gss_OID*,         /* mech_type */
 681  OM_uint32*,       /* ret_flags */
 682  int*,             /* locally_initiated */
 683  int*              /* open */
 684 );
 685
 686 /* New V2 entry points */
 687 OM_uint32 KRB5_CALLCONV krb5_gss_get_mic
 688 (OM_uint32 *,           /* minor_status */
 689  gss_ctx_id_t,               /* context_handle */
 690  gss_qop_t,                  /* qop_req */
 691  gss_buffer_t,               /* message_buffer */
 692  gss_buffer_t                /* message_token */
 693 );
 694
 695 OM_uint32 KRB5_CALLCONV krb5_gss_verify_mic
 696 (OM_uint32 *,           /* minor_status */
 697  gss_ctx_id_t,               /* context_handle */
 698  gss_buffer_t,               /* message_buffer */
 699  gss_buffer_t,               /* message_token */
 700  gss_qop_t *                 /* qop_state */
 701 );
 702
 703 OM_uint32 KRB5_CALLCONV krb5_gss_wrap
 704 (OM_uint32 *,           /* minor_status */
 705  gss_ctx_id_t,               /* context_handle */
 706  int,                        /* conf_req_flag */
 707  gss_qop_t,                  /* qop_req */
 708  gss_buffer_t,               /* input_message_buffer */
 709  int *,                      /* conf_state */
 710  gss_buffer_t                /* output_message_buffer */
 711 );
 712
 713 OM_uint32 KRB5_CALLCONV krb5_gss_wrap_iov
 714 (OM_uint32 *,           /* minor_status */
 715  gss_ctx_id_t,              /* context_handle */
 716  int,                       /* conf_req_flag */
 717  gss_qop_t,                 /* qop_req */
 718  int *,                     /* conf_state */
 719  gss_iov_buffer_desc *,     /* iov */
 720  int                        /* iov_count */
 721 );
 722
 723 OM_uint32 KRB5_CALLCONV krb5_gss_wrap_iov_length
 724 (OM_uint32 *,           /* minor_status */
 725  gss_ctx_id_t,              /* context_handle */
 726  int,                       /* conf_req_flag */
 727  gss_qop_t,                 /* qop_req */
 728  int *,                     /* conf_state */
 729  gss_iov_buffer_desc *,     /* iov */
 730  int                        /* iov_count */
 731 );
 732
 733 OM_uint32 KRB5_CALLCONV krb5_gss_unwrap
 734 (OM_uint32 *,           /* minor_status */
 735  gss_ctx_id_t,               /* context_handle */
 736  gss_buffer_t,               /* input_message_buffer */
 737  gss_buffer_t,               /* output_message_buffer */
 738  int *,                      /* conf_state */
 739  gss_qop_t *                 /* qop_state */
 740 );
 741
 742 OM_uint32 KRB5_CALLCONV krb5_gss_unwrap_iov
 743 (OM_uint32 *,           /* minor_status */
 744  gss_ctx_id_t,              /* context_handle */
 745  int *,                     /* conf_state */
 746  gss_qop_t *,               /* qop_state */
 747  gss_iov_buffer_desc *,     /* iov */
 748  int                        /* iov_count */
 749 );
 750
 751 OM_uint32 KRB5_CALLCONV krb5_gss_wrap_size_limit
 752 (OM_uint32 *,           /* minor_status */
 753  gss_ctx_id_t,               /* context_handle */
 754  int,                        /* conf_req_flag */
 755  gss_qop_t,                  /* qop_req */
 756  OM_uint32,                  /* req_output_size */
 757  OM_uint32 *                 /* max_input_size */
 758 );
 759
 760 OM_uint32 KRB5_CALLCONV krb5_gss_import_name_object
 761 (OM_uint32 *,           /* minor_status */
 762  void *,                     /* input_name */
 763  gss_OID,                    /* input_name_type */
 764  gss_name_t *                /* output_name */
 765 );
 766
 767 OM_uint32 KRB5_CALLCONV krb5_gss_export_name_object
 768 (OM_uint32 *,           /* minor_status */
 769  gss_name_t,                 /* input_name */
 770  gss_OID,                    /* desired_name_type */
 771  void * *                    /* output_name */
 772 );
 773
 774 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_cred_by_mech
 775 (OM_uint32  *,          /* minor_status */
 776  gss_cred_id_t,              /* cred_handle */
 777  gss_OID,                    /* mech_type */
 778  gss_name_t *,               /* name */
 779  OM_uint32 *,                /* initiator_lifetime */
 780  OM_uint32 *,                /* acceptor_lifetime */
 781  gss_cred_usage_t *          /* cred_usage */
 782 );
 783 #ifndef LEAN_CLIENT
 784 OM_uint32 KRB5_CALLCONV krb5_gss_export_sec_context
 785 (OM_uint32 *,           /* minor_status */
 786  gss_ctx_id_t *,             /* context_handle */
 787  gss_buffer_t                /* interprocess_token */
 788 );
 789
 790 OM_uint32 KRB5_CALLCONV krb5_gss_import_sec_context
 791 (OM_uint32 *,           /* minor_status */
 792  gss_buffer_t,               /* interprocess_token */
 793  gss_ctx_id_t *              /* context_handle */
 794 );
 795 #endif /* LEAN_CLIENT */
 796
 797 krb5_error_code krb5_gss_ser_init(krb5_context);
 798
 799 OM_uint32 krb5_gss_release_oid
 800 (OM_uint32 *,           /* minor_status */
 801  gss_OID *                   /* oid */
 802 );
 803
 804 OM_uint32 KRB5_CALLCONV krb5_gss_internal_release_oid
 805 (OM_uint32 *,           /* minor_status */
 806  gss_OID *                   /* oid */
 807 );
 808
 809 OM_uint32 KRB5_CALLCONV krb5_gss_inquire_names_for_mech
 810 (OM_uint32 *,           /* minor_status */
 811  gss_OID,                    /* mechanism */
 812  gss_OID_set *               /* name_types */
 813 );
 814
 815 OM_uint32 krb5_gss_canonicalize_name
 816 (OM_uint32  *,          /* minor_status */
 817  const gss_name_t,           /* input_name */
 818  const gss_OID,              /* mech_type */
 819  gss_name_t *                /* output_name */
 820 );
 821
 822 OM_uint32 KRB5_CALLCONV krb5_gss_export_name
 823 (OM_uint32  *,          /* minor_status */
 824  const gss_name_t,           /* input_name */
 825  gss_buffer_t                /* exported_name */
 826 );
 827
 828 OM_uint32 KRB5_CALLCONV krb5_gss_duplicate_name
 829 (OM_uint32  *,          /* minor_status */
 830  const gss_name_t,           /* input_name */
 831  gss_name_t *                /* dest_name */
 832 );
 833
 834 OM_uint32 krb5_gss_validate_cred
 835 (OM_uint32 *,           /* minor_status */
 836  gss_cred_id_t               /* cred */
 837 );
 838
 839 OM_uint32 KRB5_CALLCONV krb5_gss_acquire_cred_impersonate_name(
 840     OM_uint32 *,            /* minor_status */
 841     const gss_cred_id_t,    /* impersonator_cred_handle */
 842     const gss_name_t,       /* desired_name */
 843     OM_uint32,              /* time_req */
 844     const gss_OID_set,      /* desired_mechs */
 845     gss_cred_usage_t,       /* cred_usage */
 846     gss_cred_id_t *,        /* output_cred_handle */
 847     gss_OID_set *,          /* actual_mechs */
 848     OM_uint32 *);           /* time_rec */
 849
 850 OM_uint32
 851 krb5_gss_validate_cred_1(OM_uint32 * /* minor_status */,
 852                          gss_cred_id_t /* cred_handle */,
 853                          krb5_context /* context */);
 854
 855 gss_OID krb5_gss_convert_static_mech_oid(gss_OID oid);
 856
 857 krb5_error_code gss_krb5int_make_seal_token_v3(krb5_context,
 858                                                krb5_gss_ctx_id_rec *,
 859                                                const gss_buffer_desc *,
 860                                                gss_buffer_t,
 861                                                int, int);
 862
 863 OM_uint32 gss_krb5int_unseal_token_v3(krb5_context *contextptr,
 864                                       OM_uint32 *minor_status,
 865                                       krb5_gss_ctx_id_rec *ctx,
 866                                       unsigned char *ptr,
 867                                       unsigned int bodysize,
 868                                       gss_buffer_t message_buffer,
 869                                       int *conf_state, gss_qop_t *qop_state,
 870                                       int toktype);
 871
 872 int gss_krb5int_rotate_left (void *ptr, size_t bufsiz, size_t rc);
 873
 874 /* naming_exts.c */
 875 #define KG_INIT_NAME_NO_COPY 0x1
 876
 877 krb5_error_code
 878 kg_init_name(krb5_context context, krb5_principal principal,
 879              char *service, char *host, krb5_authdata_context ad_context,
 880              krb5_flags flags, krb5_gss_name_t *name);
 881
 882 krb5_error_code
 883 kg_release_name(krb5_context context, krb5_gss_name_t *name);
 884
 885 krb5_error_code
 886 kg_duplicate_name(krb5_context context, const krb5_gss_name_t src,
 887                   krb5_gss_name_t *dst);
 888
 889 krb5_boolean
 890 kg_compare_name(krb5_context context,
 891                 krb5_gss_name_t name1,
 892                 krb5_gss_name_t name2);
 893
 894 krb5_boolean
 895 kg_acceptor_princ(krb5_context context, krb5_gss_name_t name,
 896                   krb5_principal *princ_out);
 897
 898 OM_uint32 KRB5_CALLCONV
 899 krb5_gss_display_name_ext(OM_uint32 *minor_status,
 900                           gss_name_t name,
 901                           gss_OID display_as_name_type,
 902                           gss_buffer_t display_name);
 903
 904 OM_uint32 KRB5_CALLCONV
 905 krb5_gss_inquire_name(OM_uint32 *minor_status,
 906                       gss_name_t name,
 907                       int *name_is_MN,
 908                       gss_OID *MN_mech,
 909                       gss_buffer_set_t *attrs);
 910
 911 OM_uint32 KRB5_CALLCONV
 912 krb5_gss_get_name_attribute(OM_uint32 *minor_status,
 913                             gss_name_t name,
 914                             gss_buffer_t attr,
 915                             int *authenticated,
 916                             int *complete,
 917                             gss_buffer_t value,
 918                             gss_buffer_t display_value,
 919                             int *more);
 920
 921 OM_uint32 KRB5_CALLCONV
 922 krb5_gss_set_name_attribute(OM_uint32 *minor_status,
 923                             gss_name_t name,
 924                             int complete,
 925                             gss_buffer_t attr,
 926                             gss_buffer_t value);
 927
 928 OM_uint32 KRB5_CALLCONV
 929 krb5_gss_delete_name_attribute(OM_uint32 *minor_status,
 930                                gss_name_t name,
 931                                gss_buffer_t attr);
 932
 933 OM_uint32 KRB5_CALLCONV
 934 krb5_gss_export_name_composite(OM_uint32 *minor_status,
 935                                gss_name_t name,
 936                                gss_buffer_t exp_composite_name);
 937
 938 OM_uint32 KRB5_CALLCONV
 939 krb5_gss_map_name_to_any(OM_uint32 *minor_status,
 940                          gss_name_t name,
 941                          int authenticated,
 942                          gss_buffer_t type_id,
 943                          gss_any_t *output);
 944
 945 OM_uint32 KRB5_CALLCONV
 946 krb5_gss_release_any_name_mapping(OM_uint32 *minor_status,
 947                                   gss_name_t name,
 948                                   gss_buffer_t type_id,
 949                                   gss_any_t *input);
 950
 951 OM_uint32 KRB5_CALLCONV
 952 krb5_gss_pseudo_random(OM_uint32 *minor_status,
 953                        gss_ctx_id_t context,
 954                        int prf_key,
 955                        const gss_buffer_t prf_in,
 956                        ssize_t desired_output_len,
 957                        gss_buffer_t prf_out);
 958
 959 OM_uint32 KRB5_CALLCONV
 960 krb5_gss_store_cred(OM_uint32 *minor_status,
 961                     gss_cred_id_t input_cred_handle,
 962                     gss_cred_usage_t cred_usage,
 963                     const gss_OID desired_mech,
 964                     OM_uint32 overwrite_cred,
 965                     OM_uint32 default_cred,
 966                     gss_OID_set *elements_stored,
 967                     gss_cred_usage_t *cred_usage_stored);
 968
 969 /* s4u_gss_glue.c */
 970 OM_uint32
 971 kg_compose_deleg_cred(OM_uint32 *minor_status,
 972                       krb5_gss_cred_id_t impersonator_cred,
 973                       krb5_creds *subject_creds,
 974                       OM_uint32 time_req,
 975                       krb5_gss_cred_id_t *output_cred,
 976                       OM_uint32 *time_rec,
 977                       krb5_context context);
 978
 979 /*
 980  * These take unglued krb5-mech-specific contexts.
 981  */
 982
 983 #define GSS_KRB5_GET_TKT_FLAGS_OID_LENGTH 11
 984 #define GSS_KRB5_GET_TKT_FLAGS_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x01"
 985
 986 OM_uint32 gss_krb5int_get_tkt_flags
 987 (OM_uint32 *minor_status,
 988  const gss_ctx_id_t context_handle,
 989  const gss_OID desired_object,
 990  gss_buffer_set_t *data_set);
 991
 992 #define GSS_KRB5_COPY_CCACHE_OID_LENGTH 11
 993 #define GSS_KRB5_COPY_CCACHE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x02"
 994
 995 OM_uint32 gss_krb5int_copy_ccache
 996 (OM_uint32 *minor_status,
 997  gss_cred_id_t *cred_handle,
 998  const gss_OID desired_oid,
 999  const gss_buffer_t value);
1000
1001 #define GSS_KRB5_CCACHE_NAME_OID_LENGTH 11
1002 #define GSS_KRB5_CCACHE_NAME_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x03"
1003
1004 struct krb5_gss_ccache_name_req {
1005     const char *name;
1006     const char **out_name;
1007 };
1008
1009 OM_uint32
1010 gss_krb5int_ccache_name(OM_uint32 *minor_status, const gss_OID, const gss_OID,
1011                         const gss_buffer_t);
1012
1013 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID_LENGTH 11
1014 #define GSS_KRB5_INQ_SSPI_SESSION_KEY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"
1015
1016 OM_uint32
1017 gss_krb5int_inq_session_key(OM_uint32 *, const gss_ctx_id_t, const gss_OID, gss_buffer_set_t *);
1018
1019 #define GSS_KRB5_SET_ALLOWABLE_ENCTYPES_OID_LENGTH 11
1020 #define GSS_KRB5_SET_ALLOWABLE_ENCTYPES_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x04"
1021
1022 struct krb5_gss_set_allowable_enctypes_req {
1023     OM_uint32 num_ktypes;
1024     krb5_enctype *ktypes;
1025 };
1026
1027 OM_uint32
1028 gss_krb5int_set_allowable_enctypes(OM_uint32 *minor_status,
1029                                    gss_cred_id_t *cred,
1030                                    const gss_OID desired_oid,
1031                                    const gss_buffer_t value);
1032
1033 #define GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID_LENGTH 11
1034 #define GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x06"
1035
1036 OM_uint32
1037 gss_krb5int_export_lucid_sec_context(OM_uint32 *minor_status,
1038                                      const gss_ctx_id_t context_handle,
1039                                      const gss_OID desired_object,
1040                                      gss_buffer_set_t *data_set);
1041
1042 #define GSS_KRB5_FREE_LUCID_SEC_CONTEXT_OID_LENGTH 11
1043 #define GSS_KRB5_FREE_LUCID_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x07"
1044
1045 OM_uint32
1046 gss_krb5int_free_lucid_sec_context(OM_uint32 *, const gss_OID,
1047                                    const gss_OID, gss_buffer_t);
1048
1049 extern k5_mutex_t kg_kdc_flag_mutex;
1050 krb5_error_code krb5_gss_init_context (krb5_context *ctxp);
1051
1052 #define GSS_KRB5_USE_KDC_CONTEXT_OID_LENGTH 11
1053 #define GSS_KRB5_USE_KDC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x08"
1054
1055 OM_uint32 krb5int_gss_use_kdc_context(OM_uint32 *, const gss_OID,
1056                                       const gss_OID, gss_buffer_t);
1057
1058 krb5_error_code krb5_gss_use_kdc_context(void);
1059
1060 #define GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_OID_LENGTH 11
1061 #define GSS_KRB5_REGISTER_ACCEPTOR_IDENTITY_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x09"
1062
1063 OM_uint32
1064 gss_krb5int_register_acceptor_identity(OM_uint32 *, const gss_OID, const gss_OID, gss_buffer_t);
1065
1066 #define GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_OID_LENGTH 11
1067 #define GSS_KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0a"
1068
1069 OM_uint32
1070 gss_krb5int_extract_authz_data_from_sec_context(OM_uint32 *minor_status,
1071                                                 const gss_ctx_id_t context_handle,
1072                                                 const gss_OID desired_object,
1073                                                 gss_buffer_set_t *ad_data);
1074
1075 #define GSS_KRB5_SET_CRED_RCACHE_OID_LENGTH 11
1076 #define GSS_KRB5_SET_CRED_RCACHE_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0b"
1077
1078 OM_uint32
1079 gss_krb5int_set_cred_rcache(OM_uint32 *, gss_cred_id_t *, const gss_OID, const gss_buffer_t);
1080
1081 #define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID_LENGTH 11
1082 #define GSS_KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0c"
1083
1084 OM_uint32
1085 gss_krb5int_extract_authtime_from_sec_context(OM_uint32 *,
1086                                               const gss_ctx_id_t,
1087                                               const gss_OID,
1088                                               gss_buffer_set_t *);
1089
1090 #define GSS_KRB5_IMPORT_CRED_OID_LENGTH 11
1091 #define GSS_KRB5_IMPORT_CRED_OID "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x0d"
1092
1093 struct krb5_gss_import_cred_req {
1094     krb5_ccache id;
1095     krb5_principal keytab_principal;
1096     krb5_keytab keytab;
1097 };
1098
1099 OM_uint32
1100 gss_krb5int_import_cred(OM_uint32 *minor_status,
1101                         gss_cred_id_t *cred,
1102                         const gss_OID desired_oid,
1103                         const gss_buffer_t value);
1104
1105 #ifdef _GSS_STATIC_LINK
1106 int gss_krb5int_lib_init(void);
1107 void gss_krb5int_lib_fini(void);
1108 #endif /* _GSS_STATIC_LINK */
1109
1110 OM_uint32 gss_krb5int_initialize_library(void);
1111 void gss_krb5int_cleanup_library(void);
1112
1113 /* For error message handling.  */
1114 /* Returns a shared string, not a private copy!  */
1115 extern char *
1116 krb5_gss_get_error_message(OM_uint32 minor_code);
1117 extern void
1118 krb5_gss_save_error_string(OM_uint32 minor_code, char *msg);
1119 extern void
1120 krb5_gss_save_error_message(OM_uint32 minor_code, const char *format, ...)
1121 #if !defined(__cplusplus) && (__GNUC__ > 2)
1122     __attribute__((__format__(__printf__, 2, 3)))
1123 #endif
1124     ;
1125     extern void
1126     krb5_gss_save_error_info(OM_uint32 minor_code, krb5_context ctx);
1127 #define get_error_message krb5_gss_get_error_message
1128 #define save_error_string krb5_gss_save_error_string
1129 #define save_error_message krb5_gss_save_error_message
1130 #ifdef KRB5_KERNEL
1131 /* Error messages aren't needed in the kernel, so reduce dependencies. */
1132 #define save_error_info(x,y)
1133 #else
1134 #define save_error_info krb5_gss_save_error_info
1135 #endif
1136 extern void krb5_gss_delete_error_info(void *p);
1137
1138 /* Prefix concatenated with Kerberos encryption type */
1139 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID_LENGTH 10
1140 #define GSS_KRB5_SESSION_KEY_ENCTYPE_OID  "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x04"
1141
1142 /* IAKERB */
1143
1144 OM_uint32 KRB5_CALLCONV
1145 iakerb_gss_init_sec_context(OM_uint32 *minor_status,
1146                             gss_cred_id_t claimant_cred_handle,
1147                             gss_ctx_id_t *context_handle,
1148                             gss_name_t target_name,
1149                             gss_OID mech_type,
1150                             OM_uint32 req_flags,
1151                             OM_uint32 time_req,
1152                             gss_channel_bindings_t input_chan_bindings,
1153                             gss_buffer_t input_token,
1154                             gss_OID *actual_mech_type,
1155                             gss_buffer_t output_token,
1156                             OM_uint32 *ret_flags,
1157                             OM_uint32 *time_rec);
1158
1159 OM_uint32 KRB5_CALLCONV
1160 iakerb_gss_accept_sec_context(OM_uint32 *minor_status,
1161                               gss_ctx_id_t *context_handler,
1162                               gss_cred_id_t verifier_cred_handle,
1163                               gss_buffer_t input_token,
1164                               gss_channel_bindings_t input_chan_bindings,
1165                               gss_name_t *src_name,
1166                               gss_OID *mech_type,
1167                               gss_buffer_t output_token,
1168                               OM_uint32 *ret_flags,
1169                               OM_uint32 *time_rec,
1170                               gss_cred_id_t *delegated_cred_handle);
1171
1172 OM_uint32 KRB5_CALLCONV
1173 iakerb_gss_delete_sec_context(OM_uint32 *minor_status,
1174                               gss_ctx_id_t *context_handle,
1175                               gss_buffer_t output_token);
1176
1177 krb5_error_code
1178 iakerb_make_finished(krb5_context context,
1179                      krb5_key key,
1180                      const krb5_data *conv,
1181                      krb5_data **finished);
1182
1183 krb5_error_code
1184 iakerb_verify_finished(krb5_context context,
1185                        krb5_key key,
1186                        const krb5_data *conv,
1187                        const krb5_data *finished);
1188
1189 /*
1190  * Transfer contents of a krb5_data to a gss_buffer and invalidate the source
1191  * On unix, this is a simple pointer copy
1192  * On windows, memory is reallocated and copied.
1193  */
1194 static inline krb5_error_code
1195 data_to_gss(krb5_data *input_k5data, gss_buffer_t output_buffer)
1196 {
1197     krb5_error_code code = 0;
1198     output_buffer->length = input_k5data->length;
1199 #ifdef _WIN32
1200     if (output_buffer->length > 0) {
1201         output_buffer->value = gssalloc_malloc(output_buffer->length);
1202         if (output_buffer->value)
1203             memcpy(output_buffer->value, input_k5data->data, output_buffer->length);
1204         else
1205             code = ENOMEM;
1206     } else {
1207         output_buffer->value = NULL;
1208     }
1209     free(input_k5data->data);
1210 #else
1211     output_buffer->value = input_k5data->data;
1212 #endif
1213     *input_k5data = empty_data();
1214     return code;
1215 }
1216
1217 #define KRB5_GSS_EXTS_IAKERB_FINISHED 1
1218
1219 #endif /* _GSSAPIP_KRB5_H_ */