Skip to content

Commit

Permalink
gssapi: credential store extensions (#451)
Browse files Browse the repository at this point in the history 
Implement the GSS-API credential store API extensions defined by MIT here:

https://k5wiki.kerberos.org/wiki/Projects/Credential_Store_extensions

Note: we kill off gss_acquire_cred_ext() here. This was never a public API,
although mechanisms could have implemented it and I briefly used it in my
BrowserID prototype mechanism. gss_acquire_cred_ext_from() occupies the place
in the dispatch table where gss_acquire_cred_ext() used to, but this structure
was never visible outside Heimdal (i.e. it is only used by internal
mechanisms);

(Mechanisms that need to accept arbitrary key/value dictionaries from
applications should now implement gss_acquire_cred_from().)
  • Loading branch information
@lhoward @nicowilliams
lhoward authored and nicowilliams committed Jan 3, 2019
1 parent a7d42cd commit e0bb9c1
Show file tree
Hide file tree
Showing 39 changed files with 1,289 additions and 1,054 deletions.
4 changes: 3 additions & 1 deletion lib/gssapi/Makefile.am
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82,9 +82,10 @@ mechsrc = \
mech/doxygen.c \
mech/gss_accept_sec_context.c \
mech/gss_acquire_cred.c \
mech/gss_acquire_cred_ext.c \
mech/gss_acquire_cred_from.c \
mech/gss_acquire_cred_with_password.c \
mech/gss_add_cred.c \
mech/gss_add_cred_from.c \
mech/gss_add_cred_with_password.c \
mech/gss_add_oid_set_member.c \
mech/gss_aeap.c \
Expand Down Expand Up @@ -141,6 +142,7 @@ mechsrc = \
mech/gss_set_sec_context_option.c \
mech/gss_sign.c \
mech/gss_store_cred.c \
mech/gss_store_cred_into.c \
mech/gss_test_oid_set_member.c \
mech/gss_unseal.c \
mech/gss_unwrap.c \
Expand Down
8 changes: 6 additions & 2 deletions lib/gssapi/NTMakefile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -98,9 +98,10 @@ mechsrc = \
mech/cred.h \
mech/gss_accept_sec_context.c \
mech/gss_acquire_cred.c \
mech/gss_acquire_cred_ext.c \
mech/gss_acquire_cred_from.c \
mech/gss_acquire_cred_with_password.c \
mech/gss_add_cred.c \
mech/gss_add_cred_from.c \
mech/gss_add_cred_with_password.c \
mech/gss_add_oid_set_member.c \
mech/gss_aeap.c \
Expand Down Expand Up @@ -158,6 +159,7 @@ mechsrc = \
mech/gss_set_sec_context_option.c \
mech/gss_sign.c \
mech/gss_store_cred.c \
mech/gss_store_cred_into.c \
mech/gss_test_oid_set_member.c \
mech/gss_unseal.c \
mech/gss_unwrap.c \
Expand Down Expand Up @@ -328,9 +330,10 @@ libgssapi_OBJs = \
$(OBJ)\mech/context.obj \
$(OBJ)\mech/gss_accept_sec_context.obj \
$(OBJ)\mech/gss_acquire_cred.obj \
$(OBJ)\mech/gss_acquire_cred_ext.obj \
$(OBJ)\mech/gss_acquire_cred_from.obj \
$(OBJ)\mech/gss_acquire_cred_with_password.obj \
$(OBJ)\mech/gss_add_cred.obj \
$(OBJ)\mech/gss_add_cred_from.obj \
$(OBJ)\mech/gss_add_cred_with_password.obj \
$(OBJ)\mech/gss_add_oid_set_member.obj \
$(OBJ)\mech/gss_aeap.obj \
Expand Down Expand Up @@ -388,6 +391,7 @@ libgssapi_OBJs = \
$(OBJ)\mech/gss_set_sec_context_option.obj \
$(OBJ)\mech/gss_sign.obj \
$(OBJ)\mech/gss_store_cred.obj \
$(OBJ)\mech/gss_store_cred_into.obj \
$(OBJ)\mech/gss_test_oid_set_member.obj \
$(OBJ)\mech/gss_unseal.obj \
$(OBJ)\mech/gss_unwrap.obj \
Expand Down
64 changes: 59 additions & 5 deletions lib/gssapi/gssapi/gssapi.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -141,13 +141,25 @@ typedef struct gss_iov_buffer_desc_struct {
gss_buffer_desc buffer;
} gss_iov_buffer_desc, *gss_iov_buffer_t;

/* Credential store extensions */
typedef struct gss_key_value_element_struct {
const char *key;
const char *value;
} gss_key_value_element_desc;

typedef struct gss_key_value_set_struct {
OM_uint32 count; /* should be size_t, but for MIT compat */
gss_key_value_element_desc *elements;
} gss_key_value_set_desc, *gss_key_value_set_t;

typedef const gss_key_value_set_desc *gss_const_key_value_set_t;

/*
* For now, define a QOP-type as an OM_uint32
*/
typedef OM_uint32 gss_qop_t;



/*
* Flag bits for context-level services.
*/
Expand Down Expand Up @@ -220,6 +232,7 @@ typedef OM_uint32 gss_qop_t;
#define GSS_C_NO_CHANNEL_BINDINGS ((gss_channel_bindings_t) 0)
#define GSS_C_EMPTY_BUFFER {0, NULL}
#define GSS_C_NO_IOV_BUFFER ((gss_iov_buffer_t)0)
#define GSS_C_NO_CRED_STORE ((gss_key_value_set_t)0)

/*
* Some alternate names for a couple of the above
Expand Down Expand Up @@ -1123,16 +1136,57 @@ GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_duplicate_cred (
gss_const_cred_id_t /*input_cred_handle*/,
gss_cred_id_t * /*output_cred_handle*/
);
/*
*
*/

GSSAPI_LIB_FUNCTION const char * GSSAPI_LIB_CALL
gss_oid_to_name(gss_const_OID oid);

GSSAPI_LIB_FUNCTION gss_OID GSSAPI_LIB_CALL
gss_name_to_oid(const char *name);

/*
* Credential store extensions
*/
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_acquire_cred_from(
OM_uint32 * /* minor_status */,
gss_const_name_t /* desired_name */,
OM_uint32 /* time_req */,
const gss_OID_set /* desired_mechs */,
gss_cred_usage_t /* cred_usage */,
gss_const_key_value_set_t /* cred_store */,
gss_cred_id_t * /* output_cred_handle */,
gss_OID_set * /* actual_mechs */,
OM_uint32 * /* time_rec */
);

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_add_cred_from(
OM_uint32 * /* minor_status */,
gss_cred_id_t /* input_cred_handle */,
gss_const_name_t /* desired_name */,
const gss_OID /* desired_mech */,
gss_cred_usage_t /* cred_usage */,
OM_uint32 /* initiator_time_req */,
OM_uint32 /* acceptor_time_req */,
gss_const_key_value_set_t /* cred_store */,
gss_cred_id_t * /* output_cred_handle */,
gss_OID_set * /* actual_mechs */,
OM_uint32 * /* initiator_time_rec */,
OM_uint32 * /*acceptor_time_rec */
);

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_store_cred_into(
OM_uint32 * /* minor_status */,
gss_const_cred_id_t /* input_cred_handle */,
gss_cred_usage_t /* input_usage */,
const gss_OID /* desired_mech */,
OM_uint32 /* overwrite_cred */,
OM_uint32 /* default_cred */,
gss_const_key_value_set_t /* cred_store */,
gss_OID_set * /* elements_stored */,
gss_cred_usage_t * /* cred_usage_stored */
);

GSSAPI_CPP_END

#if defined(__APPLE__) && (defined(__ppc__) || defined(__ppc64__) || defined(__i386__) || defined(__x86_64__))
Expand Down
7 changes: 0 additions & 7 deletions lib/gssapi/gssapi/gssapi_oid.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,13 +109,6 @@ extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_name_oid_desc;
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_ma_mech_description_oid_desc;
#define GSS_C_MA_MECH_DESCRIPTION (&__gss_c_ma_mech_description_oid_desc)

/* credential types */
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_cred_password_oid_desc;
#define GSS_C_CRED_PASSWORD (&__gss_c_cred_password_oid_desc)

extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_c_cred_certificate_oid_desc;
#define GSS_C_CRED_CERTIFICATE (&__gss_c_cred_certificate_oid_desc)

/* Heimdal mechanisms - 1.2.752.43.14 */
extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_sasl_digest_md5_mechanism_oid_desc;
#define GSS_SASL_DIGEST_MD5_MECHANISM (&__gss_sasl_digest_md5_mechanism_oid_desc)
Expand Down
76 changes: 41 additions & 35 deletions lib/gssapi/gssapi_mech.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -360,18 +360,7 @@ typedef OM_uint32 GSSAPI_CALLCONV
_gss_import_cred_t(OM_uint32 * minor_status,
gss_buffer_t cred_token,
gss_cred_id_t * cred_handle);


typedef OM_uint32 GSSAPI_CALLCONV
_gss_acquire_cred_ext_t(OM_uint32 * /*minor_status */,
gss_const_name_t /* desired_name */,
gss_const_OID /* credential_type */,
const void * /* credential_data */,
OM_uint32 /* time_req */,
gss_const_OID /* desired_mech */,
gss_cred_usage_t /* cred_usage */,
gss_cred_id_t * /* output_cred_handle */);


typedef void GSSAPI_CALLCONV
_gss_iter_creds_t(OM_uint32 /* flags */,
void * /* userctx */,
Expand Down Expand Up @@ -447,6 +436,42 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_export_name_composite_t (
gss_buffer_t /* exp_composite_name */
);

typedef OM_uint32 GSSAPI_CALLCONV
_gss_acquire_cred_from_t(OM_uint32 *minor_status,
gss_const_name_t desired_name,
OM_uint32 time_req,
gss_OID_set desired_mechs,
gss_cred_usage_t cred_usage,
gss_const_key_value_set_t cred_store,
gss_cred_id_t *output_cred_handle,
gss_OID_set *actual_mechs,
OM_uint32 *time_rec);

typedef OM_uint32 GSSAPI_CALLCONV
_gss_add_cred_from_t(OM_uint32 *minor_status,
gss_cred_id_t input_cred_handle,
gss_const_name_t desired_name,
const gss_OID desired_mech,
gss_cred_usage_t cred_usage,
OM_uint32 initiator_time_req,
OM_uint32 acceptor_time_req,
gss_const_key_value_set_t cred_store,
gss_cred_id_t *output_cred_handle,
gss_OID_set *actual_mechs,
OM_uint32 *initiator_time_rec,
OM_uint32 *acceptor_time_rec);

typedef OM_uint32 GSSAPI_CALLCONV
_gss_store_cred_into_t(OM_uint32 *minor_status,
gss_const_cred_id_t input_cred_handle,
gss_cred_usage_t input_usage,
gss_OID desired_mech,
OM_uint32 overwrite_cred,
OM_uint32 default_cred,
gss_const_key_value_set_t cred_store,
gss_OID_set *elements_stored,
gss_cred_usage_t *cred_usage_stored);

/*
*
*/
Expand Down Expand Up @@ -485,7 +510,7 @@ typedef OM_uint32 GSSAPI_CALLCONV _gss_authorize_localname_t (
/* mechglue internal */
struct gss_mech_compat_desc_struct;

#define GMI_VERSION 5
#define GMI_VERSION 6

/* gm_flags */
#define GM_USE_MG_CRED 1 /* uses mech glue credentials */
Expand Down Expand Up @@ -535,7 +560,7 @@ typedef struct gssapi_mech_interface_desc {
_gss_store_cred_t *gm_store_cred;
_gss_export_cred_t *gm_export_cred;
_gss_import_cred_t *gm_import_cred;
_gss_acquire_cred_ext_t *gm_acquire_cred_ext;
_gss_acquire_cred_from_t *gm_acquire_cred_from; /* was acquire_cred_ext */
_gss_iter_creds_t *gm_iter_creds;
_gss_destroy_cred_t *gm_destroy_cred;
_gss_cred_hold_t *gm_cred_hold;
Expand All @@ -553,6 +578,8 @@ typedef struct gssapi_mech_interface_desc {
_gss_delete_name_attribute_t *gm_delete_name_attribute;
_gss_export_name_composite_t *gm_export_name_composite;
_gss_duplicate_cred_t *gm_duplicate_cred;
_gss_add_cred_from_t *gm_add_cred_from;
_gss_store_cred_into_t *gm_store_cred_into;
struct gss_mech_compat_desc_struct *gm_compat;
} gssapi_mech_interface_desc, *gssapi_mech_interface;

Expand Down Expand Up @@ -582,25 +609,4 @@ struct _gss_oid_name_table {
extern struct _gss_oid_name_table _gss_ont_mech[];
extern struct _gss_oid_name_table _gss_ont_ma[];

/*
* Extended credentials acqusition API, not to be exported until
* it or something equivalent has been standardised.
*/
extern gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_cred_password_oid_desc;
#define GSS_C_CRED_PASSWORD (&__gss_c_cred_password_oid_desc)

extern gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_cred_certificate_oid_desc;
#define GSS_C_CRED_CERTIFICATE (&__gss_c_cred_certificate_oid_desc)

OM_uint32 _gss_acquire_cred_ext
(OM_uint32 * /*minor_status*/,
gss_const_name_t /*desired_name*/,
gss_const_OID /*credential_type*/,
const void * /*credential_data*/,
OM_uint32 /*time_req*/,
gss_const_OID /*desired_mech*/,
gss_cred_usage_t /*cred_usage*/,
gss_cred_id_t * /*output_cred_handle*/
);

#endif /* GSSAPI_MECH_H */

0 comments on commit e0bb9c1

Please sign in to comment.