Skip to content

Commit ac8d9f2

Browse files
jake-descojake-desco
committed
Mech attribute support; use Lifetime consistently
1 parent 27dcc8c commit ac8d9f2

File tree

10 files changed

+841
-22
lines changed

10 files changed

+841
-22
lines changed

‎build-tools/gen-gss-mech-attrs.go‎

Lines changed: 322 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,322 @@
1+
// SPDX-License-Identifier: Apache-2.0
2+
3+
package main
4+
5+
import (
6+
"encoding/asn1"
7+
"flag"
8+
"fmt"
9+
"log"
10+
"os"
11+
"strconv"
12+
"strings"
13+
"text/template"
14+
)
15+
16+
// RFC 5587 Mechanism attributes
17+
var attrsToOids = []struct {
18+
name string
19+
shortDesc string
20+
longDesc string
21+
oid string
22+
}{
23+
{
24+
"GSS_MA_MECH_CONCRETE",
25+
"concrete-mech",
26+
"Mechanism is neither a pseudo-mechanism nor a composite mechanism.",
27+
"1.3.6.1.5.5.13.1",
28+
},
29+
{
30+
"GSS_MA_MECH_PSEUDO",
31+
"pseudo-mech",
32+
"Mechanism is a pseudo-mechanism.",
33+
"1.3.6.1.5.5.13.2",
34+
},
35+
{
36+
"GSS_MA_MECH_COMPOSITE",
37+
"composite-mech",
38+
"Mechanism is a composite of other mechanisms.",
39+
"1.3.6.1.5.5.13.3",
40+
},
41+
{
42+
"GSS_MA_MECH_NEGO",
43+
"mech-negotiation-mech",
44+
"Mechanism negotiates other mechanisms.",
45+
"1.3.6.1.5.5.13.4",
46+
},
47+
{
48+
"GSS_MA_MECH_GLUE",
49+
"mech-glue",
50+
"OID is not a mechanism but the GSS-API itself.",
51+
"1.3.6.1.5.5.13.5",
52+
},
53+
{
54+
"GSS_MA_NOT_MECH",
55+
"not-mech",
56+
"Known OID but not a mechanism OID.",
57+
"1.3.6.1.5.5.13.6",
58+
},
59+
{
60+
"GSS_MA_DEPRECATED",
61+
"mech-deprecated",
62+
"Mechanism is deprecated.",
63+
"1.3.6.1.5.5.13.7",
64+
},
65+
{
66+
"GSS_MA_NOT_DFLT_MECH",
67+
"mech-not-default",
68+
"Mechanism must not be used as a default mechanism.",
69+
"1.3.6.1.5.5.13.8",
70+
},
71+
{
72+
"GSS_MA_ITOK_FRAMED",
73+
"initial-is-framed",
74+
"Mechanism's initial contexts are properly framed.",
75+
"1.3.6.1.5.5.13.9",
76+
},
77+
{
78+
"GSS_MA_AUTH_INIT",
79+
"auth-init-princ",
80+
"Mechanism supports authentication of initiator to acceptor.",
81+
"1.3.6.1.5.5.13.10",
82+
},
83+
{
84+
"GSS_MA_AUTH_TARG",
85+
"auth-targ-princ",
86+
"Mechanism supports authentication of acceptor to initiator.",
87+
"1.3.6.1.5.5.13.11",
88+
},
89+
{
90+
"GSS_MA_AUTH_INIT_INIT",
91+
"auth-init-princ-initial",
92+
"Mechanism supports authentication of initiator using initial credentials.",
93+
"1.3.6.1.5.5.13.12",
94+
},
95+
{
96+
"GSS_MA_AUTH_TARG_INIT",
97+
"auth-target-princ-initial",
98+
"Mechanism supports authentication of acceptor using initial credentials.",
99+
"1.3.6.1.5.5.13.13",
100+
},
101+
{
102+
"GSS_MA_AUTH_INIT_ANON",
103+
"auth-init-princ-anon",
104+
"Mechanism supports GSS_C_NT_ANONYMOUS as an initiator name.",
105+
"1.3.6.1.5.5.13.14",
106+
},
107+
{
108+
"GSS_MA_AUTH_TARG_ANON",
109+
"auth-targ-princ-anon",
110+
"Mechanism supports GSS_C_NT_ANONYMOUS as an acceptor name.",
111+
"1.3.6.1.5.5.13.15",
112+
},
113+
{
114+
"GSS_MA_DELEG_CRED",
115+
"deleg-cred",
116+
"Mechanism supports credential delegation.",
117+
"1.3.6.1.5.5.13.16",
118+
},
119+
{
120+
"GSS_MA_INTEG_PROT",
121+
"integ-prot",
122+
"Mechanism supports per-message integrity protection.",
123+
"1.3.6.1.5.5.13.17",
124+
},
125+
{
126+
"GSS_MA_CONF_PROT",
127+
"conf-prot",
128+
"Mechanism supports per-message confidentiality protection.",
129+
"1.3.6.1.5.5.13.18",
130+
},
131+
{
132+
"GSS_MA_MIC",
133+
"mic",
134+
"Mechanism supports Message Integrity Code (MIC) tokens.",
135+
"1.3.6.1.5.5.13.19",
136+
},
137+
{
138+
"GSS_MA_WRAP",
139+
"wrap",
140+
"Mechanism supports wrap tokens.",
141+
"1.3.6.1.5.5.13.20",
142+
},
143+
{
144+
"GSS_MA_PROT_READY",
145+
"prot-ready",
146+
"Mechanism supports per-message proteciton prior to full context establishment.",
147+
"1.3.6.1.5.5.13.21",
148+
},
149+
{
150+
"GSS_MA_REPLAY_DET",
151+
"replay-detection",
152+
"Mechanism supports replay detection.",
153+
"1.3.6.1.5.5.13.22",
154+
},
155+
{
156+
"GSS_MA_OOS_DET",
157+
"oos-detection",
158+
"Mechanism supports out-of-sequence detection.",
159+
"1.3.6.1.5.5.13.23",
160+
},
161+
{
162+
"GSS_MA_CBINDINGS",
163+
"channel-bindings",
164+
"Mechanism supports channel bindings.",
165+
"1.3.6.1.5.5.13.24",
166+
},
167+
{
168+
"GSS_MA_PFS",
169+
"pfs",
170+
"Mechanism supports Perfect Forward Security.",
171+
"1.3.6.1.5.5.13.25",
172+
},
173+
{
174+
"GSS_MA_COMPRESS",
175+
"compress",
176+
"Mechanism supports compression of data inputs to gss_wrap().",
177+
"1.3.6.1.5.5.13.26",
178+
},
179+
{
180+
"GSS_MA_CTX_TRANS",
181+
"context-transfer",
182+
"Mechanism supports security context export/import.",
183+
"1.3.6.1.5.5.13.27",
184+
},
185+
{
186+
"GSS_MA_NEGOEX_AND_SPNEGO",
187+
"negoex-only",
188+
"NegoEx mechanism should also be negotiable through SPNEGO.",
189+
"1.3.6.1.5.5.13.28",
190+
},
191+
}
192+
193+
var codeTemplate = `// SPDX-License-Identifier: Apache-2.0
194+
195+
package gssapi
196+
197+
// GENERATED CODE: DO NOT EDIT
198+
199+
var mechAttrs = []struct {
200+
id gssMechAttrImpl
201+
mech string
202+
shortDesc string
203+
longDesc string
204+
oidString string
205+
oid Oid
206+
}{
207+
208+
{{range .}}
209+
// {{.Oid.S}}
210+
{ {{.Name}},
211+
"{{.Name}}",
212+
"{{.ShortDesc}}",
213+
"{{.LongDesc}}",
214+
"{{.Oid.S}}",
215+
{{ $length := len .Oid.B }} {{- if gt $length 0}}[]byte{ {{bytesFormat .Oid.B}} } {{- else}}nil{{- end}},
216+
},
217+
{{end}}
218+
}
219+
220+
`
221+
222+
type oid struct {
223+
S string
224+
B []byte
225+
}
226+
227+
type tmplParam struct {
228+
Name string
229+
ShortDesc string
230+
LongDesc string
231+
Oid oid
232+
}
233+
234+
func main() {
235+
output := flag.String("o", "", "output file name")
236+
flag.Parse()
237+
238+
params := makeParams()
239+
240+
funcs := template.FuncMap{
241+
"bytesFormat": bytesFormat,
242+
}
243+
244+
fh := os.Stdout
245+
var err error
246+
if *output != "" {
247+
fh, err = os.Create(*output)
248+
if err != nil {
249+
log.Fatal(err)
250+
}
251+
}
252+
defer func() {
253+
if *output != "" {
254+
fh.Close()
255+
}
256+
}()
257+
258+
var t = template.Must(template.New("code").Funcs(funcs).Parse(codeTemplate))
259+
260+
if err := t.Execute(fh, params); err != nil {
261+
log.Fatal(err)
262+
}
263+
264+
if *output != "" {
265+
fh.Close()
266+
}
267+
}
268+
269+
func makeParams() []tmplParam {
270+
params := make([]tmplParam, len(attrsToOids))
271+
272+
// marshal the OIDs to DER encoding..
273+
for i, entry := range attrsToOids {
274+
var enc []byte
275+
var err error
276+
if entry.oid != "" {
277+
objId := stringToOid(entry.oid)
278+
enc, err = asn1.Marshal(objId)
279+
280+
if err != nil {
281+
panic(fmt.Errorf("parsing %s: %w", objId, err))
282+
}
283+
284+
enc = enc[2:]
285+
}
286+
287+
params[i] = tmplParam{
288+
Name: entry.name,
289+
ShortDesc: entry.shortDesc,
290+
LongDesc: entry.longDesc,
291+
Oid: oid{S: entry.oid, B: enc},
292+
}
293+
}
294+
295+
return params
296+
}
297+
298+
func bytesFormat(b []byte) string {
299+
strs := make([]string, len(b))
300+
for i, s := range b {
301+
strs[i] = fmt.Sprintf("0x%02x", s)
302+
}
303+
return strings.Join(strs, ", ")
304+
}
305+
306+
func stringToOid(s string) asn1.ObjectIdentifier {
307+
// split string into components
308+
elms := strings.Split(s, ".")
309+
310+
oid := make(asn1.ObjectIdentifier, len(elms))
311+
312+
for i, elm := range elms {
313+
j, err := strconv.ParseUint(elm, 10, 32)
314+
if err != nil {
315+
panic(err)
316+
}
317+
318+
oid[i] = int(j)
319+
}
320+
321+
return oid
322+
}

‎v3/cred.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ const (
1818
type CredInfo struct {
1919
Name string
2020
NameType GssNameType
21-
InitiatorExpiry *time.Time // nil: not supported, zero: expired
22-
AcceptorExpiry *time.Time // nil: not supported, zero: expired
21+
InitiatorExpiry GssLifetime
22+
AcceptorExpiry GssLifetime
2323
Usage CredUsage
2424
Mechs []GssMech
2525
}

‎v3/extensions.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package gssapi
2+
3+
type GssapiExtension int
4+
5+
const (
6+
HasExtChannelBound GssapiExtension = iota
7+
HasExtInquireSecContextByOid // GDF : https://ogf.org/documents/GFD.24.pdf
8+
HasExtLocalname // Solaris?
9+
HasExtRFC6680 // RFC 6680 naming extensions
10+
HasExtRFC5587 // RFC 5587 mech inquiry extensions
11+
)

0 commit comments

Comments
 (0)