Add support for GSS_C_NT_COMPOSITE_EXPORT

ticket: 7347 (new)

diff --git a/src/lib/gssapi/generic/gssapi_ext.h b/src/lib/gssapi/generic/gssapi_ext.h
index 05f1ed7fb4a6b64481f221539a295b9ca14a4f94..dd12ffecbfdbacf37a71a838ef5f9f1bff8e9a6a 100644 (file)
--- a/src/lib/gssapi/generic/gssapi_ext.h
+++ b/src/lib/gssapi/generic/gssapi_ext.h
@@ -368,6 +368,7 @@ gss_add_cred_impersonate_name(
  * Naming extensions
  */
 GSS_DLLIMP extern gss_buffer_t GSS_C_ATTR_LOCAL_LOGIN_USER;
+GSS_DLLIMP extern gss_OID GSS_C_NT_COMPOSITE_EXPORT;
 
 OM_uint32 KRB5_CALLCONV gss_display_name_ext
 (

diff --git a/src/lib/gssapi/generic/gssapi_generic.c b/src/lib/gssapi/generic/gssapi_generic.c
index 4718ac73a8bee37e6117b4f035b0f3e37f7a795c..4759cdef83973ee89252c2da13e29c28b4ff8b42 100644 (file)
--- a/src/lib/gssapi/generic/gssapi_generic.c
+++ b/src/lib/gssapi/generic/gssapi_generic.c
@@ -119,7 +119,13 @@ static const gss_OID_desc const_oids[] = {
      * GSS_C_NT_EXPORT_NAME should be initialized to point
      * to that gss_OID_desc.
      */
-
+    {6, (void *)"\x2b\x06\x01\x05\x06\x06"},
+    /* corresponding to an object-identifier value of
+     * {1(iso), 3(org), 6(dod), 1(internet), 5(security),
+     * 6(nametypes), 6(gss-composite-export)}.  The constant
+     * GSS_C_NT_COMPOSITE_EXPORT should be initialized to point
+     * to that gss_OID_desc.
+     */
     /* GSS_C_INQ_SSPI_SESSION_KEY 1.2.840.113554.1.2.2.5.5 */
     {11, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x05\x05"},
 
@@ -180,37 +186,39 @@ GSS_DLLIMP gss_OID GSS_C_NT_ANONYMOUS           = oids+5;
 GSS_DLLIMP gss_OID GSS_C_NT_EXPORT_NAME         = oids+6;
 gss_OID gss_nt_exported_name                    = oids+6;
 
-GSS_DLLIMP gss_OID GSS_C_INQ_SSPI_SESSION_KEY   = oids+7;
-
-GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_CONCRETE     = oids+8;
-GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_PSEUDO       = oids+9;
-GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_COMPOSITE    = oids+10;
-GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_NEGO         = oids+11;
-GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_GLUE         = oids+12;
-GSS_DLLIMP gss_const_OID GSS_C_MA_NOT_MECH          = oids+13;
-GSS_DLLIMP gss_const_OID GSS_C_MA_DEPRECATED        = oids+14;
-GSS_DLLIMP gss_const_OID GSS_C_MA_NOT_DFLT_MECH     = oids+15;
-GSS_DLLIMP gss_const_OID GSS_C_MA_ITOK_FRAMED       = oids+16;
-GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_INIT         = oids+17;
-GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_TARG         = oids+18;
-GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_INIT_INIT    = oids+19;
-GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_TARG_INIT    = oids+20;
-GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_INIT_ANON    = oids+21;
-GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_TARG_ANON    = oids+22;
-GSS_DLLIMP gss_const_OID GSS_C_MA_DELEG_CRED        = oids+23;
-GSS_DLLIMP gss_const_OID GSS_C_MA_INTEG_PROT        = oids+24;
-GSS_DLLIMP gss_const_OID GSS_C_MA_CONF_PROT         = oids+25;
-GSS_DLLIMP gss_const_OID GSS_C_MA_MIC               = oids+26;
-GSS_DLLIMP gss_const_OID GSS_C_MA_WRAP              = oids+27;
-GSS_DLLIMP gss_const_OID GSS_C_MA_PROT_READY        = oids+28;
-GSS_DLLIMP gss_const_OID GSS_C_MA_REPLAY_DET        = oids+29;
-GSS_DLLIMP gss_const_OID GSS_C_MA_OOS_DET           = oids+30;
-GSS_DLLIMP gss_const_OID GSS_C_MA_CBINDINGS         = oids+31;
-GSS_DLLIMP gss_const_OID GSS_C_MA_PFS               = oids+32;
-GSS_DLLIMP gss_const_OID GSS_C_MA_COMPRESS          = oids+33;
-GSS_DLLIMP gss_const_OID GSS_C_MA_CTX_TRANS         = oids+34;
-
-static gss_OID_set_desc gss_ma_known_attrs_desc = { 27, oids+8 };
+GSS_DLLIMP gss_OID GSS_C_NT_COMPOSITE_EXPORT    = oids+7;
+
+GSS_DLLIMP gss_OID GSS_C_INQ_SSPI_SESSION_KEY   = oids+8;
+
+GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_CONCRETE     = oids+9;
+GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_PSEUDO       = oids+10;
+GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_COMPOSITE    = oids+11;
+GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_NEGO         = oids+12;
+GSS_DLLIMP gss_const_OID GSS_C_MA_MECH_GLUE         = oids+13;
+GSS_DLLIMP gss_const_OID GSS_C_MA_NOT_MECH          = oids+14;
+GSS_DLLIMP gss_const_OID GSS_C_MA_DEPRECATED        = oids+15;
+GSS_DLLIMP gss_const_OID GSS_C_MA_NOT_DFLT_MECH     = oids+16;
+GSS_DLLIMP gss_const_OID GSS_C_MA_ITOK_FRAMED       = oids+17;
+GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_INIT         = oids+18;
+GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_TARG         = oids+19;
+GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_INIT_INIT    = oids+20;
+GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_TARG_INIT    = oids+21;
+GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_INIT_ANON    = oids+22;
+GSS_DLLIMP gss_const_OID GSS_C_MA_AUTH_TARG_ANON    = oids+23;
+GSS_DLLIMP gss_const_OID GSS_C_MA_DELEG_CRED        = oids+24;
+GSS_DLLIMP gss_const_OID GSS_C_MA_INTEG_PROT        = oids+25;
+GSS_DLLIMP gss_const_OID GSS_C_MA_CONF_PROT         = oids+26;
+GSS_DLLIMP gss_const_OID GSS_C_MA_MIC               = oids+27;
+GSS_DLLIMP gss_const_OID GSS_C_MA_WRAP              = oids+28;
+GSS_DLLIMP gss_const_OID GSS_C_MA_PROT_READY        = oids+29;
+GSS_DLLIMP gss_const_OID GSS_C_MA_REPLAY_DET        = oids+30;
+GSS_DLLIMP gss_const_OID GSS_C_MA_OOS_DET           = oids+31;
+GSS_DLLIMP gss_const_OID GSS_C_MA_CBINDINGS         = oids+32;
+GSS_DLLIMP gss_const_OID GSS_C_MA_PFS               = oids+33;
+GSS_DLLIMP gss_const_OID GSS_C_MA_COMPRESS          = oids+34;
+GSS_DLLIMP gss_const_OID GSS_C_MA_CTX_TRANS         = oids+35;
+
+static gss_OID_set_desc gss_ma_known_attrs_desc = { 27, oids+9 };
 gss_OID_set gss_ma_known_attrs = &gss_ma_known_attrs_desc;
 
 #define STRING_BUFFER(x)    { sizeof((x) - 1), (x) }
@@ -222,174 +230,174 @@ static struct mech_attr_info_desc {
     gss_buffer_desc long_desc;
 } mech_attr_info[] = {
     {
-        oids+8,
+        oids+9,
         STRING_BUFFER("GSS_C_MA_MECH_CONCRETE"),
         STRING_BUFFER("concrete-mech"),
         STRING_BUFFER("Mechanism is neither a pseudo-mechanism nor a "
                       "composite mechanism."),
     },
     {
-        oids+9,
+        oids+10,
         STRING_BUFFER("GSS_C_MA_MECH_PSEUDO"),
         STRING_BUFFER("pseudo-mech"),
         STRING_BUFFER("Mechanism is a pseudo-mechanism."),
     },
     {
-        oids+10,
+        oids+11,
         STRING_BUFFER("GSS_C_MA_MECH_COMPOSITE"),
         STRING_BUFFER("composite-mech"),
         STRING_BUFFER("Mechanism is a composite of other mechanisms."),
     },
     {
-        oids+11,
+        oids+12,
         STRING_BUFFER("GSS_C_MA_MECH_NEGO"),
         STRING_BUFFER("mech-negotiation-mech"),
         STRING_BUFFER("Mechanism negotiates other mechanisms."),
     },
     {
-        oids+12,
+        oids+13,
         STRING_BUFFER("GSS_C_MA_MECH_GLUE"),
         STRING_BUFFER("mech-glue"),
         STRING_BUFFER("OID is not a mechanism but the GSS-API itself."),
     },
     {
-        oids+13,
+        oids+14,
         STRING_BUFFER("GSS_C_MA_NOT_MECH"),
         STRING_BUFFER("not-mech"),
         STRING_BUFFER("Known OID but not a mechanism OID."),
     },
     {
-        oids+14,
+        oids+15,
         STRING_BUFFER("GSS_C_MA_DEPRECATED"),
         STRING_BUFFER("mech-deprecated"),
         STRING_BUFFER("Mechanism is deprecated."),
     },
     {
-        oids+15,
+        oids+16,
         STRING_BUFFER("GSS_C_MA_NOT_DFLT_MECH"),
         STRING_BUFFER("mech-not-default"),
         STRING_BUFFER("Mechanism must not be used as a default mechanism."),
     },
     {
-        oids+16,
+        oids+17,
         STRING_BUFFER("GSS_C_MA_ITOK_FRAMED"),
         STRING_BUFFER("initial-is-framed"),
         STRING_BUFFER("Mechanism's initial contexts are properly framed."),
     },
     {
-        oids+17,
+        oids+18,
         STRING_BUFFER("GSS_C_MA_AUTH_INIT"),
         STRING_BUFFER("auth-init-princ"),
         STRING_BUFFER("Mechanism supports authentication of initiator to "
                       "acceptor."),
     },
     {
-        oids+18,
+        oids+19,
         STRING_BUFFER("GSS_C_MA_AUTH_TARG"),
         STRING_BUFFER("auth-targ-princ"),
         STRING_BUFFER("Mechanism supports authentication of acceptor to "
                       "initiator."),
     },
     {
-        oids+19,
+        oids+20,
         STRING_BUFFER("GSS_C_MA_AUTH_INIT_INIT"),
         STRING_BUFFER("auth-init-princ-initial"),
         STRING_BUFFER("Mechanism supports authentication of initiator using "
                       "initial credentials."),
     },
     {
-        oids+20,
+        oids+21,
         STRING_BUFFER("GSS_C_MA_AUTH_TARG_INIT"),
         STRING_BUFFER("auth-target-princ-initial"),
         STRING_BUFFER("Mechanism supports authentication of acceptor using "
                       "initial credentials."),
     },
     {
-        oids+21,
+        oids+22,
         STRING_BUFFER("GSS_C_MA_AUTH_INIT_ANON"),
         STRING_BUFFER("auth-init-princ-anon"),
         STRING_BUFFER("Mechanism supports GSS_C_NT_ANONYMOUS as an initiator "
                       "name."),
     },
     {
-        oids+22,
+        oids+23,
         STRING_BUFFER("GSS_C_MA_AUTH_TARG_ANON"),
         STRING_BUFFER("auth-targ-princ-anon"),
         STRING_BUFFER("Mechanism supports GSS_C_NT_ANONYMOUS as an acceptor "
                       "name."),
     },
     {
-        oids+23,
+        oids+24,
         STRING_BUFFER("GSS_C_MA_DELEG_CRED"),
         STRING_BUFFER("deleg-cred"),
         STRING_BUFFER("Mechanism supports credential delegation."),
     },
     {
-        oids+24,
+        oids+25,
         STRING_BUFFER("GSS_C_MA_INTEG_PROT"),
         STRING_BUFFER("integ-prot"),
         STRING_BUFFER("Mechanism supports per-message integrity protection."),
     },
     {
-        oids+25,
+        oids+26,
         STRING_BUFFER("GSS_C_MA_CONF_PROT"),
         STRING_BUFFER("conf-prot"),
         STRING_BUFFER("Mechanism supports per-message confidentiality "
                       "protection."),
     },
     {
-        oids+26,
+        oids+27,
         STRING_BUFFER("GSS_C_MA_MIC"),
         STRING_BUFFER("mic"),
         STRING_BUFFER("Mechanism supports Message Integrity Code (MIC) "
                       "tokens."),
     },
     {
-        oids+27,
+        oids+28,
         STRING_BUFFER("GSS_C_MA_WRAP"),
         STRING_BUFFER("wrap"),
         STRING_BUFFER("Mechanism supports wrap tokens."),
     },
     {
-        oids+28,
+        oids+29,
         STRING_BUFFER("GSS_C_MA_PROT_READY"),
         STRING_BUFFER("prot-ready"),
         STRING_BUFFER("Mechanism supports per-message proteciton prior to "
                       "full context establishment."),
     },
     {
-        oids+29,
+        oids+30,
         STRING_BUFFER("GSS_C_MA_REPLAY_DET"),
         STRING_BUFFER("replay-detection"),
         STRING_BUFFER("Mechanism supports replay detection."),
     },
     {
-        oids+30,
+        oids+31,
         STRING_BUFFER("GSS_C_MA_OOS_DET"),
         STRING_BUFFER("oos-detection"),
         STRING_BUFFER("Mechanism supports out-of-sequence detection."),
     },
     {
-        oids+31,
+        oids+32,
         STRING_BUFFER("GSS_C_MA_CBINDINGS"),
         STRING_BUFFER("channel-bindings"),
         STRING_BUFFER("Mechanism supports channel bindings."),
     },
     {
-        oids+32,
+        oids+33,
         STRING_BUFFER("GSS_C_MA_PFS"),
         STRING_BUFFER("pfs"),
         STRING_BUFFER("Mechanism supports Perfect Forward Security."),
     },
     {
-        oids+33,
+        oids+34,
         STRING_BUFFER("GSS_C_MA_COMPRESS"),
         STRING_BUFFER("compress"),
         STRING_BUFFER("Mechanism supports compression of data inputs to "
                       "gss_wrap()."),
     },
     {
-        oids+34,
+        oids+35,
         STRING_BUFFER("GSS_C_MA_CTX_TRANS"),
         STRING_BUFFER("context-transfer"),
         STRING_BUFFER("Mechanism supports security context export/import."),

diff --git a/src/lib/gssapi/generic/oid_ops.c b/src/lib/gssapi/generic/oid_ops.c
index 665b5902f4b2223a85f68f7afcc69f4ab9dbf4fb..85584fc3bdd352c7c827a54373a3a80f5c2bc440 100644 (file)
--- a/src/lib/gssapi/generic/oid_ops.c
+++ b/src/lib/gssapi/generic/oid_ops.c
@@ -97,6 +97,7 @@ generic_gss_release_oid(OM_uint32 *minor_status, gss_OID *oid)
         (*oid != GSS_C_NT_HOSTBASED_SERVICE) &&
         (*oid != GSS_C_NT_ANONYMOUS) &&
         (*oid != GSS_C_NT_EXPORT_NAME) &&
+        (*oid != GSS_C_NT_COMPOSITE_EXPORT) &&
         (*oid != gss_nt_service_name)) {
         free((*oid)->elements);
         free(*oid);

diff --git a/src/lib/gssapi/krb5/import_name.c b/src/lib/gssapi/krb5/import_name.c
index 0e730f98e2ff6154c843c69e6cc176c862822def..ebc2a7bbea4bd27054b772468f2b675b2c0444fc 100644 (file)
--- a/src/lib/gssapi/krb5/import_name.c
+++ b/src/lib/gssapi/krb5/import_name.c
@@ -218,7 +218,8 @@ krb5_gss_import_name(minor_status, input_name_buffer,
             uid = atoi(tmp);
             goto do_getpwuid;
 #endif
-        } else if (g_OID_equal(input_name_type, gss_nt_exported_name)) {
+        } else if (g_OID_equal(input_name_type, gss_nt_exported_name) ||
+                   g_OID_equal(input_name_type, GSS_C_NT_COMPOSITE_EXPORT)) {
 #define BOUNDS_CHECK(cp, end, n)                                        \
             do { if ((end) - (cp) < (n)) goto fail_name; } while (0)
             cp = (unsigned char *)tmp;
@@ -231,7 +232,7 @@ krb5_gss_import_name(minor_status, input_name_buffer,
             case 0x01:
                 break;
             case 0x02:
-                has_ad++;
+                has_ad++; /* is composite name */
                 break;
             default:
                 goto fail_name;

diff --git a/src/lib/gssapi/krb5/inq_names.c b/src/lib/gssapi/krb5/inq_names.c
index 9cc43500f4d59f48186fd700093927724af06f78..fcf7dbcd3a5c501f3958c5a21352a0684ac49484 100644 (file)
--- a/src/lib/gssapi/krb5/inq_names.c
+++ b/src/lib/gssapi/krb5/inq_names.c
@@ -77,6 +77,10 @@ krb5_gss_inquire_names_for_mech(minor_status, mechanism, name_types)
             ((major = generic_gss_add_oid_set_member(minor_status,
                                                      gss_nt_krb5_name,
                                                      name_types)
+            ) == GSS_S_COMPLETE) &&
+            ((major = generic_gss_add_oid_set_member(minor_status,
+                                                     GSS_C_NT_COMPOSITE_EXPORT,
+                                                     name_types)
             ) == GSS_S_COMPLETE)
         ) {
             major = generic_gss_add_oid_set_member(minor_status,

diff --git a/src/lib/gssapi/libgssapi_krb5.exports b/src/lib/gssapi/libgssapi_krb5.exports
index a8ee3f2447e1bfd8ace6ab3f7d31a369e0e42373..3da3a237c4de037d1d34dbb7b79247e9db4de33a 100644 (file)
--- a/src/lib/gssapi/libgssapi_krb5.exports
+++ b/src/lib/gssapi/libgssapi_krb5.exports
@@ -1,6 +1,7 @@
 GSS_C_ATTR_LOCAL_LOGIN_USER
 GSS_C_INQ_SSPI_SESSION_KEY
 GSS_C_NT_ANONYMOUS
+GSS_C_NT_COMPOSITE_EXPORT
 GSS_C_NT_EXPORT_NAME
 GSS_C_NT_HOSTBASED_SERVICE
 GSS_C_NT_HOSTBASED_SERVICE_X

diff --git a/src/lib/gssapi/mechglue/g_imp_name.c b/src/lib/gssapi/mechglue/g_imp_name.c
index 7afa188e53c79f150bc9f794165ce86d125574e2..8fcc3d0f267ae49e1e3fc939a3579425a9d713c3 100644 (file)
--- a/src/lib/gssapi/mechglue/g_imp_name.c
+++ b/src/lib/gssapi/mechglue/g_imp_name.c
@@ -209,7 +209,7 @@ importExportName(minor, unionName)
     buf = (unsigned char *)expName.value;
     if (buf[0] != 0x04)
        return (GSS_S_DEFECTIVE_TOKEN);
-    if (buf[1] != 0x01 && buf[1] != 0x02)
+    if (buf[1] != 0x01 && buf[1] != 0x02) /* allow composite names */
        return (GSS_S_DEFECTIVE_TOKEN);
 
     buf += expNameTokIdLen;