Projects/GSSExtras - Revision history

Ghudson: /* Approvals */

2009-12-07T16:09:14Z

‎Approvals

Ghudson at 16:09, 7 December 2009

2009-12-07T16:09:00Z

Lukeh at 19:39, 1 December 2009

2009-12-01T19:39:23Z

Lukeh: /* gss_context_query_attributes */

2009-12-01T19:39:01Z

‎gss_context_query_attributes

Lukeh: /* Status */

2009-11-24T19:00:46Z

‎Status

Lukeh at 18:59, 24 November 2009

2009-11-24T18:59:28Z

Lukeh: /* gss_context_query_attributes */

2009-11-24T09:42:13Z

‎gss_context_query_attributes

Lukeh: New page: {{project-early}} Category: early stage projects ==Background== Implement: * gss_pseudo_random (RFC 4401 and RFC 4402) * gss_store_cred (RFC 5588) * gss_...

2009-11-24T09:37:32Z

New page: {{project-early}} <includeonly>Category: early stage projects</includeonly> ==Background== Implement: * gss_pseudo_random (RFC 4401 and RFC 4402) * gss_store_cred (RFC 5588) * gss_...

New page

{{project-early}}

<includeonly>[[Category: early stage projects]]</includeonly>

==Background==

Implement:

* gss_pseudo_random (RFC 4401 and RFC 4402)
* gss_store_cred (RFC 5588)
* gss_context_query_attributes for GSS_C_ATTR_STREAM_SIZES (from Heimdal)

==Architecture==

Each function touches:

* the mechglue
* the Kerberos 5 mechanism
* SPNEGO

==Implementation==

===gss_pseudo_random===

Implemented in terms of krb5_c_prf (why no krb5_k_prf?)

This function is declared in gssapi.h instead of gssapi_ext.h because it is defined in an RFC.

===gss_store_cred===

Copies credentials into default credentials cache (like Solaris, requires default_cred argument be true.) This function is declared in gssapi.h instead of gssapi_ext.h because it is defined in an RFC.

===gss_context_query_attributes===

<pre>
typedef struct gss_context_stream_sizes_struct {
size_t header;
size_t trailer;
size_t max_msg_size;
size_t buffers;
size_t blocksize;
} gss_context_stream_sizes;

GSS_DLLIMP extern gss_OID GSS_C_ATTR_STREAM_SIZES;

OM_uint32 KRB5_CALLCONV gss_context_query_attributes
(
OM_uint32 *, /* minor_status */
const gss_ctx_id_t, /* context_handle */
const gss_OID, /* attribute */
void *, /* data */
size_t /* len */
);
</pre>

The API is similar to gss_inquire_sec_context_by_oid() except it takes a void * pointer instead of a buffer set.

Implemented in terms of gss_wrap_size_limit() and gss_wrap_iov_length(), which begs the question: why do we need this API? (Particularly given that it ostensibly serves the same function as gss_inquire_sec_context_by_oid()). It is slightly more convenient to use though.

So, I would propose we don't merge this.

==Open issues==
==Status==

Code is in the [http://src.mit.edu/fisheye/browse/krb5/users/lhoward/iakerb users/lhoward/gssexts branch].

Tests for PRF and query_context_attributes are in src/tests/gssapi/t_prf.c. No test for gss_store_cred() yet.

← Older revision		Revision as of 16:09, 7 December 2009
Line 72:		Line 72:

	===Approvals===		===Approvals===
		+	#[[User:Ghudson\|Ghudson]] 16:09, 7 December 2009 (UTC)

	===Discussion===		===Discussion===

← Older revision		Revision as of 16:09, 7 December 2009
Line 62:		Line 62:

	Tests are in src/tests/gssapi/t_gssexts.c. This is a variant of t_s4u, the usage is the same. Sorry, no individual tests yet: this file exercises all APIs.		Tests are in src/tests/gssapi/t_gssexts.c. This is a variant of t_s4u, the usage is the same. Sorry, no individual tests yet: this file exercises all APIs.
		+
		+	==Review==
		+
		+	This section documents the review of the project according to [[Project policy]].
		+	It is divided into multiple sections. First, approvals should be listed. To list an approval type
		+	:<nowiki>#~~~~</nowiki>
		+	(hash mark followed by four tilde characters) on its own line.
		+	The next section is for summarizing discussion, which should take place on krbdev@mit.edu. Provide links to the archive at http://mailman.mit.edu/pipermail/krbdev/ if appropriate. Blocking objections can be noted with <nowiki>{{project-block}}</nowiki>.
		+
		+	===Approvals===
		+
		+	===Discussion===

← Older revision		Revision as of 19:39, 1 December 2009
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-review\|2009-12-08}}
−
−	<includeonly>[[Category: early stage projects]]</includeonly>

	==Background==		==Background==

@@ Line 56: / Line 56: @@
 The API is similar to gss_inquire_sec_context_by_oid() except it takes a void * pointer instead of a buffer set. A single OID is presently supported, which returns the sizes of different components in a GSS wrap stream buffer.
-This is implemented in terms of gss_wrap_size_limit() and gss_wrap_iov_length(), which begs the question: why do we need this API? (Particularly given that it ostensibly serves the same function as gss_inquire_sec_context_by_oid()). It is slightly more convenient to use though.
+This is implemented in terms of gss_wrap_size_limit() and gss_wrap_iov_length(), which begs the question: why do we need this API? (Particularly given that it ostensibly serves the same function as gss_inquire_sec_context_by_oid()). It is slightly more convenient to use though. If we do merge this, then we should possibly consider whether some of the other gss_inquire_sec_context_by_oid()-based APIs (internal or otherwise) should be re-factored in terms of this function.
 ==Open issues==

← Older revision		Revision as of 19:00, 24 November 2009
Line 65:		Line 65:
	Code is in the [http://src.mit.edu/fisheye/browse/krb5/users/lhoward/iakerb users/lhoward/gssexts branch].		Code is in the [http://src.mit.edu/fisheye/browse/krb5/users/lhoward/iakerb users/lhoward/gssexts branch].

−	Tests are in src/tests/gssapi/t_gssexts.c. Sorry, no individual tests yet.	+	Tests are in src/tests/gssapi/t_gssexts.c. This is a variant of t_s4u, the usage is the same. Sorry, no individual tests yet: this file exercises all APIs.

← Older revision		Revision as of 18:59, 24 November 2009
Line 65:		Line 65:
	Code is in the [http://src.mit.edu/fisheye/browse/krb5/users/lhoward/iakerb users/lhoward/gssexts branch].		Code is in the [http://src.mit.edu/fisheye/browse/krb5/users/lhoward/iakerb users/lhoward/gssexts branch].

−	Tests ~~for PRF and query_context_attributes~~ are in src/tests/gssapi/~~t_prf~~.c. No ~~test~~ ~~for~~ ~~gss_store_cred()~~ yet.	+	Tests are in src/tests/gssapi/t_gssexts.c. Sorry, no individual tests yet.