Merge of heimdal 0.7.2

Tested by todd & beck, ok beck.

2 files changed, 228 insertions, 24 deletions

diff --git a/kerberosV/src/lib/gssapi/gss_acquire_cred.3 b/kerberosV/src/lib/gssapi/gss_acquire_cred.3
index 5bfd2482590..7b58e044559 100644
--- a/kerberosV/src/lib/gssapi/gss_acquire_cred.3
+++ b/kerberosV/src/lib/gssapi/gss_acquire_cred.3
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2003 Kungliga Tekniska Högskolan
+.\" Copyright (c) 2003 - 2004 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden).
 .\" All rights reserved.
 .\"
@@ -29,9 +29,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $KTH: gss_acquire_cred.3,v 1.8.2.1 2003/04/28 13:41:42 lha Exp $
+.\" $KTH: gss_acquire_cred.3,v 1.23 2004/09/06 07:08:58 lha Exp $
 .\"
-.Dd April 2, 2003
+.Dd September  9, 2003
 .Dt GSS_ACQUIRE_CRED 3
 .Os HEIMDAL
 .Sh NAME
@@ -59,8 +59,11 @@
 .Nm gss_inquire_cred_by_mech ,
 .Nm gss_inquire_mechs_for_name ,
 .Nm gss_inquire_names_for_mech ,
-.Nm gss_krb5_copy_ccache ,
+.Nm gss_krb5_ccache_name ,
 .Nm gss_krb5_compat_des3_mic ,
+.Nm gss_krb5_copy_ccache ,
+.Nm gsskrb5_extract_authz_data_from_sec_context ,
+.Nm gss_krb5_get_tkt_flags ,
 .Nm gss_process_context_token ,
 .Nm gss_release_buffer ,
 .Nm gss_release_cred ,
@@ -107,7 +110,20 @@ GSS-API library (libgssapi, -lgssapi)
 .Fa "gss_OID_set * actual_mechs"
 .Fa "OM_uint32 * time_rec"
 .Fc
-.\" .Fn gss_add_cred
+.Ft OM_uint32
+.Fo gss_add_cred
+.Fa "OM_uint32 *minor_status"
+.Fa "const gss_cred_id_t input_cred_handle"
+.Fa "const gss_name_t desired_name"
+.Fa "const gss_OID desired_mech"
+.Fa "gss_cred_usage_t cred_usage"
+.Fa "OM_uint32 initiator_time_req"
+.Fa "OM_uint32 acceptor_time_req"
+.Fa "gss_cred_id_t *output_cred_handle"
+.Fa "gss_OID_set *actual_mechs"
+.Fa "OM_uint32 *initiator_time_rec"
+.Fa "OM_uint32 *acceptor_time_rec"
+.Fc
 .Ft OM_uint32
 .Fo gss_add_oid_set_member
 .Fa "OM_uint32 * minor_status"
@@ -244,12 +260,31 @@ GSS-API library (libgssapi, -lgssapi)
 .Fc
 .Ft OM_uint32
 .Fo gss_inquire_cred_by_mech
+.Fa "OM_uint32 * minor_status"
+.Fa "const gss_cred_id_t cred_handle"
+.Fa "const gss_OID mech_type"
+.Fa "gss_name_t * name"
+.Fa "OM_uint32 * initiator_lifetime"
+.Fa "OM_uint32 * acceptor_lifetime"
+.Fa "gss_cred_usage_t * cred_usage"
 .Fc
 .Ft OM_uint32
 .Fo gss_inquire_mechs_for_name
+.Fa "OM_uint32 * minor_status"
+.Fa "const gss_name_t input_name"
+.Fa "gss_OID_set * mech_types"
 .Fc
 .Ft OM_uint32
 .Fo gss_inquire_names_for_mech
+.Fa "OM_uint32 * minor_status"
+.Fa "const gss_OID mechanism"
+.Fa "gss_OID_set * name_types"
+.Fc
+.Ft OM_uint32
+.Fo gss_krb5_ccache_name
+.Fa "OM_uint32 *minor"
+.Fa "const char *name"
+.Fa "const char **old_name"
 .Fc
 .Ft OM_uint32
 .Fo gss_krb5_copy_ccache
@@ -264,7 +299,23 @@ GSS-API library (libgssapi, -lgssapi)
 .Fa "int onoff"
 .Fc
 .Ft OM_uint32
+.Fo gsskrb5_extract_authz_data_from_sec_context
+.Fa "OM_uint32 *minor_status"
+.Fa "gss_ctx_id_t context_handle"
+.Fa "int ad_type"
+.Fa "gss_buffer_t ad_data"
+.Fc
+.Ft OM_uint32
+.Fo gss_krb5_get_tkt_flags
+.Fa "OM_uint32 *minor_status"
+.Fa "gss_ctx_id_t context_handle"
+.Fa "OM_uint32 *tkt_flags"
+.Fc
+.Ft OM_uint32
 .Fo gss_process_context_token
+.Fa "OM_uint32 * minor_status"
+.Fa "const gss_ctx_id_t context_handle"
+.Fa "const gss_buffer_t token_buffer"
 .Fc
 .Ft OM_uint32
 .Fo gss_release_buffer
@@ -370,9 +421,12 @@ are described in RFC 2743 and RFC 2744.
 Version 1 (deprecated) of the C binding is described in RFC 1509.
 .Pp
 Heimdals GSS-API implementation supports the following mechanisms
-.Bl -bullet
+.Pp
+.Bl -bullet -offset indent -compact
 .It
 .Li GSS_KRB5_MECHANISM
+.It
+.Li GSS_SPNEGO_MECHANISM
 .El
 .Pp
 GSS-API have generic name types that all mechanism are supposed to
@@ -407,6 +461,82 @@ name types:
 .Li GSS_KRB5_NT_STRING_UID_NAME
 .El
 .Pp
+In GSS-API, names have two forms, internal names and contiguous string
+names.
+.Bl -bullet
+.It
+.Li Internal name and mechanism name
+.Pp
+Internal names are implementation specific representation of
+a GSS-API name.
+.Li Mechanism names
+special form of internal names corresponds to one and only one mechanism.
+.Pp
+In GSS-API an internal name is stored in a
+.Dv gss_name_t .
+.It
+.Li Contiguous string name and exported name
+.Pp
+Contiguous string names are gssapi names stored in a
+.Dv OCTET STRING
+that together with a name type identifier (OID) uniquely specifies a
+gss-name.
+A special form of the contiguous string name is the exported name that
+have a OID embedded in the string to make it unique.
+Exported name have the nametype
+.Dv GSS_C_NT_EXPORT_NAME .
+.Pp
+In GSS-API an contiguous string name is stored in a
+.Dv gss_buffer_t .
+.Pp
+Exported names also have the property that they are specified by the
+mechanism itself and compatible between diffrent GSS-API
+implementations.
+.El
+.Sh ACCESS CONTROL
+There are two ways of comparing GSS-API names, either comparing two
+internal names with each other or two contiguous string names with
+either other.
+.Pp
+To compare two internal names with each other, import (if needed) the
+names with
+.Fn gss_import_name
+into the GSS-API implementation and the compare the imported name with
+.Fn gss_compare_name .
+.Pp
+Importing names can be slow, so when its possible to store exported
+names in the access control list, comparing contiguous string name
+might be better.
+.Pp
+when comparing contiguous string name, first export them into a
+.Dv GSS_C_NT_EXPORT_NAME
+name with
+.Fn gss_export_name
+and then compare with
+.Xr memcmp 3 .
+.Pp
+Note that there are might be a difference between the two methods of
+comparing names.
+The first (using
+.Fn gss_compare_name )
+will compare to (unauthenticated) names are the same.
+The second will compare if a mechanism will authenticate them as the
+same principal.
+.Pp
+For example, if
+.Fn gss_import_name
+name was used with
+.Dv GSS_C_NO_OID
+the default syntax is used for all mechanism the GSS-API
+implementation supports.
+When compare the imported name of
+.Dv GSS_C_NO_OID
+it may match serveral mechanism names (MN).
+.Pp
+The resulting name from
+.Fn gss_display_name
+must not be used for acccess control.
+.Sh FUNCTIONS
 .Fn gss_display_name
 takes the gss name in
 .Fa input_name
@@ -421,9 +551,35 @@ can either be
 or a pointer to a
 .Li gss_OID
 and will in the latter case contain the OID type of the name.
-The name should only be used for printing.
-Access control should be done with the result of
-.Fn gss_export_name .
+The name must only be used for printing.
+If access control is needed, see section
+.Sx ACCESS CONTROL .
+.Pp
+.Fn gss_inquire_context
+returns information about the context.
+Information is available even after the context have expired.
+.Fa lifetime_rec
+argument is set to
+.Dv GSS_C_INDEFINITE
+(dont expire) or the number of seconds that the context is still valid.
+A value of 0 means that the context is expired.
+.Fa mech_type
+argument should be considered readonly and must not be released.
+.Fa src_name
+and
+.Fn dest_name
+are both mechanims names and must be released with
+.Fn gss_release_name
+when no longer used.
+.Pp
+.Nm gss_context_time
+will return the amount of time (in seconds) of the context is still
+valid.
+If its expired
+.Fa time_rec
+will be set to 0 and
+.Dv GSS_S_CONTEXT_EXPIRED
+returned.
 .Pp
 .Fn gss_sign ,
 .Fn gss_verify ,
@@ -434,17 +590,47 @@ are part of the GSS-API V1 interface and are obsolete.
 The functions should not be used for new applications.
 They are provided so that version 1 applications can link against the
 library.
+.Sh EXTENSIONS
+.Fn gss_krb5_ccache_name
+sets the internal kerberos 5 credential cache name to
+.Fa name .
+The old name is returned in
+.Fa old_name ,
+and must not be freed.
+The data allocated for
+.Fa old_name
+is free upon next call to
+.Fn gss_krb5_ccache_name .
+This function is not threadsafe if
+.Fa old_name
+argument is used.
 .Pp
 .Fn gss_krb5_copy_ccache
-is an extension to the GSS-API API.
-The function will extract the krb5 credentials that are transferred from
-the initiator to the acceptor when using token delegation in the
-Kerberos mechanism.
+will extract the krb5 credentials that are transferred from the
+initiator to the acceptor when using token delegation in the Kerberos
+mechanism.
 The acceptor receives the delegated token in the last argument to
 .Fn gss_accept_sec_context .
 .Pp
-.Nm gss_krb5_compat_des3_mic
-turns on or off the compatibility with older versions of Heimdal using
+.Fn gsskrb5_register_acceptor_identity
+sets the Kerberos 5 principal that the acceptor will use.
+.Pp
+.Fn gsskrb5_extract_authz_data_from_sec_context
+extracts the Kerberos authorizationdata that may be stored within the
+context.
+Tha caller must free the returned buffer
+.Fa ad_data
+with
+.Fn gss_release_buffer
+upon success.
+.Pp
+.Fn gss_krb5_get_tkt_flags
+return the ticket flags for the kerberos ticket receive when
+authenticating the initiator.
+Only valid on the acceptor context.
+.Pp
+.Fn gss_krb5_compat_des3_mic
+turns on or off the compatibility with older version of Heimdal using
 des3 get and verify mic, this is way to programmatically set the
 [gssapi]broken_des3_mic and [gssapi]correct_des3_mic flags (see
 COMPATIBILITY section in
@@ -452,9 +638,9 @@ COMPATIBILITY section in
 If the CPP symbol
 .Dv GSS_C_KRB5_COMPAT_DES3_MIC
 is present,
-.Nm gss_krb5_compat_des3_mic
+.Fn gss_krb5_compat_des3_mic
 exists.
-.Nm gss_krb5_compat_des3_mic
+.Fn gss_krb5_compat_des3_mic
 will be removed in a later version of the GSS-API library.
 .Sh SEE ALSO
 .Xr gssapi 3 ,
diff --git a/kerberosV/src/lib/gssapi/gssapi.3 b/kerberosV/src/lib/gssapi/gssapi.3
index 3b85a556799..5ee61fa583b 100644
--- a/kerberosV/src/lib/gssapi/gssapi.3
+++ b/kerberosV/src/lib/gssapi/gssapi.3
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2003 Kungliga Tekniska Högskolan
+.\" Copyright (c) 2003 - 2005 Kungliga Tekniska Högskolan
 .\" (Royal Institute of Technology, Stockholm, Sweden). 
 .\" All rights reserved. 
 .\"
@@ -29,9 +29,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
 .\" SUCH DAMAGE. 
 .\" 
-.\" $KTH: gssapi.3,v 1.5.2.2 2003/04/30 09:56:26 lha Exp $
+.\" $KTH: gssapi.3,v 1.11 2005/04/20 10:46:15 lha Exp $
 .\"
-.Dd January 23, 2003
+.Dd April 20, 2005
 .Dt GSSAPI 3
 .Os
 .Sh NAME
@@ -45,6 +45,9 @@ provides security services to callers in a generic fashion,
 supportable with a range of underlying mechanisms and technologies and
 hence allowing source-level portability of applications to different
 environments.
+.Pp
+The GSS-API implementation in Heimdal implements the Kerberos 5 and
+the SPNEGO GSS-API security mechanisms.
 .Sh LIST OF FUNCTIONS
 These functions constitute the gssapi library,
 .Em libgssapi .
@@ -80,7 +83,10 @@ gss_inquire_cred.3
 gss_inquire_cred_by_mech.3
 gss_inquire_mechs_for_name.3
 gss_inquire_names_for_mech.3
+gss_krb5_ccache_name.3
 gss_krb5_copy_ccache.3
+gss_krb5_compat_des3_mic.3
+gss_krb5_extract_authz_data_from_sec_context.3
 gss_process_context_token.3
 gss_release_buffer.3
 gss_release_cred.3
@@ -106,15 +112,15 @@ implementations when using
 .Fn gss_get_mic
 /
 .Fn gss_verify_mic .
-Its possible to modify the behavior of the generator of the MIC with
+It is possible to modify the behavior of the generator of the MIC with
 the
 .Pa krb5.conf
 configuration file so that old clients/servers will still
 work.
 .Pp
 New clients/servers will try both the old and new MIC in Heimdal 0.6.
-In 0.7 it will check only if configured and the compatibility code
-will be removed in 0.8.
+In 0.7 it will check only if configured - the compatibility code will
+be removed in 0.8.
 .Pp
 Heimdal 0.6 still generates by default the broken GSS-API DES3 mic,
 this will change in 0.7 to generate correct des3 mic.
@@ -140,12 +146,24 @@ the later will override.
 .Pp
 This config option modifies behaviour for both clients and servers.
 .Pp
-Example:
+Microsoft implemented SPNEGO to Windows2000, however, they manage to
+get it wrong, their implementation didn't fill in the MechListMIC in
+the reply token with the right content.
+There is a work around for this problem, but not all implementation
+support it.
+.Pp
+Heimdal defaults to correct SPNEGO when the the kerberos
+implementation uses CFX, or when its configured by the user.
+To turn on compatibility with peers, use option
+.Nm [gssapi]
+.Ar require_mechlist_mic .
+.Sh EXAMPLES
 .Bd -literal -offset indent
 [gssapi]
 	broken_des3_mic = cvs/*@SU.SE
 	broken_des3_mic = host/*@E.KTH.SE
 	correct_des3_mic = host/*@SU.SE
+	require_mechlist_mic = host/*@SU.SE
 .Ed
 .Sh BUGS
 All of 0.5.x versions of