__GSS_C_ATTR_STREAM_SIZES_OID_DESC(3)

💅 `__gss_c_attr_stream_sizes_oid_desc(3)` 💅

okay so bestie, this is the Heimdal GSS-API functions(3) page from the Heimdal GSS-API library — and yes, the title line is folded up here instead of copied like a boring screenshot. This page is literally the __gss_c_attr_stream_sizes_oid_desc corner of the manual, but it’s also a big ol’ list of Heimdal GSS-API functions and one variable. Let’s go. ✨

🌸 NAME 🌸

Heimdal GSS-API functions — the Heimdal GSS-API library functions page, bestie. Group-chat energy incoming.

🧩 Functions 🧩

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_add_oid_set_member
    (OM_uint32 *minor_status, const gss_OID member_oid, gss_OID_set
    *oid_set)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap_iov (OM_uint32
    *minor_status, gss_ctx_id_t context_handle, int conf_req_flag,
    gss_qop_t qop_req, int *conf_state, gss_iov_buffer_desc *iov, int
    iov_count)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_unwrap_iov (OM_uint32
    *minor_status, gss_ctx_id_t context_handle, int *conf_state,
    gss_qop_t *qop_state, gss_iov_buffer_desc *iov, int iov_count)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap_iov_length
    (OM_uint32 *minor_status, gss_ctx_id_t context_handle, int
    conf_req_flag, gss_qop_t qop_req, int *conf_state,
    gss_iov_buffer_desc *iov, int iov_count)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_release_iov_buffer
    (OM_uint32 *minor_status, gss_iov_buffer_desc *iov, int iov_count)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_canonicalize_name
    (OM_uint32 *minor_status, const gss_name_t input_name, const gss_OID
    mech_type, gss_name_t *output_name)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_import_name (OM_uint32
    *minor_status, const gss_buffer_t input_name_buffer, const gss_OID
    input_name_type, gss_name_t *output_name)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_init_sec_context
    (OM_uint32 *minor_status, const gss_cred_id_t initiator_cred_handle,
    gss_ctx_id_t *context_handle, const gss_name_t target_name, const
    gss_OID input_mech_type, OM_uint32 req_flags, OM_uint32 time_req,
    const gss_channel_bindings_t input_chan_bindings, const gss_buffer_t
    input_token, gss_OID *actual_mech_type, gss_buffer_t output_token,
    OM_uint32 *ret_flags, OM_uint32 *time_rec)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
    gss_inquire_saslname_for_mech (OM_uint32 *minor_status, const
    gss_OID desired_mech, gss_buffer_t sasl_mech_name, gss_buffer_t
    mech_name, gss_buffer_t mech_description)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_attrs_for_mech
    (OM_uint32 *minor_status, gss_const_OID mech, gss_OID_set
    *mech_attr, gss_OID_set *known_mech_attrs)
GSSAPI_LIB_FUNCTION int GSSAPI_LIB_CALL gss_oid_equal (gss_const_OID a,
    gss_const_OID b)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_release_cred
    (OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_release_name
    (OM_uint32 *minor_status, gss_name_t *input_name)
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap (OM_uint32
    *minor_status, const gss_ctx_id_t context_handle, int conf_req_flag,
    gss_qop_t qop_req, const gss_buffer_t input_message_buffer, int
    *conf_state, gss_buffer_t output_message_buffer)

🧸 Variables 🧸

gss_OID_desc GSSAPI_LIB_FUNCTION __gss_c_attr_stream_sizes_oid_desc

This is the lone variable listed on the page, bestie. Iconic.

🌈 Detailed Description 🌈

The source page keeps this section title-only — no extra prose lives here, it just rolls straight on into the function lore.

🛠️ Function Documentation 🛠️

💖 `gss_add_oid_set_member` 💖

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_add_oid_set_member
    (OM_uint32 *minor_status, const gss_OID member_oid, gss_OID_set
    *oid_set)

Adds an OID to the OID set, but no cap: the function does not make a copy of the OID. So the pointer you pass as member_oid needs to stay stable for the whole time oid_set is used.

If there’s a duplicate member of the OID, the new member is not added to the set.

Parameters:

minor_status — minor status code.
member_oid — member to add to the OID set.
oid_set — OID set to add the member to.

Returns:

a gss_error code; see gss_display_status() about printing the error code.

🦋 `gss_canonicalize_name` 🦋

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_canonicalize_name
    (OM_uint32 *minor_status, const gss_name_t input_name, const gss_OID
    mech_type, gss_name_t *output_name)

gss_canonicalize_name takes an Internal Name (IN) and converts it into a mechanism-specific Mechanism Name (MN).

The input name may be multiple name, or generic name types.

If input_name is of GSS_C_NT_USER_NAME, and the Kerberos mechanism is specified, the resulting MN type is a GSS_KRB5_NT_PRINCIPAL_NAME.

For more information about internalVSmechname.

Parameters:

minor_status — minor status code.
input_name — name to convert; unchanged by gss_canonicalize_name().
mech_type — the type to convert Name to.
output_name — the resulting type; release with gss_release_name(), independent of input_name.

Returns:

a gss_error code; see gss_display_status() about printing the error code.

🎀 `gss_import_name` 🎀

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_import_name (OM_uint32
    *minor_status, const gss_buffer_t input_name_buffer, const gss_OID
    input_name_type, gss_name_t *output_name)

Import a name — internal or mechanism name. Name type glow-up time:

GSS_C_NO_OID
GSS_C_NT_USER_NAME
GSS_C_NT_HOSTBASED_SERVICE
GSS_C_NT_EXPORT_NAME
GSS_C_NT_ANONYMOUS
GSS_KRB5_NT_PRINCIPAL_NAME

For more information about internalVSmechname.

Parameters:

minor_status — minor status code.
input_name_buffer — import name buffer.
input_name_type — type of the import name buffer.
output_name — the resulting type; release with gss_release_name(), independent of input_name.

Returns:

a gss_error code; see gss_display_status() about printing the error code.

👑 `gss_init_sec_context` 👑

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_init_sec_context
    (OM_uint32 *minor_status, const gss_cred_id_t initiator_cred_handle,
    gss_ctx_id_t *context_handle, const gss_name_t target_name, const
    gss_OID input_mech_type, OM_uint32 req_flags, OM_uint32 time_req,
    const gss_channel_bindings_t input_chan_bindings, const gss_buffer_t
    input_token, gss_OID *actual_mech_type, gss_buffer_t output_token,
    OM_uint32 *ret_flags, OM_uint32 *time_rec)

As the initiator, build a context with an acceptor.

Returns in the major:

GSS_S_COMPLETE — if the context if build
GSS_S_CONTINUE_NEEDED — if the caller needs to continue another round of gss_i nit_sec_context
error code — any other error code

Parameters:

minor_status — minor status code.
initiator_cred_handle — the credential to use when building the context; if GSS_C_NO_CREDENTIAL is passed, the default credential for the mechanism will be used.
context_handle — a pointer to a context handle; will be returned as long as there is not an error.
target_name — the target name of acceptor, created using gss_import_name(). The name can be of any name types the mechanism supports; check supported name types with gss_inquire_names_for_mech().
input_mech_type — mechanism type to use; if GSS_C_NO_OID is used, Kerberos (GSS_KRB5_MECHANISM) will be tried. Other available mechanism are listed in the GSS-API mechanisms section.
req_flags — flags using when building the context; see Context creation flags.
time_req — time requested this context should be valid in seconds; common used value is GSS_C_INDEFINITE.
input_chan_bindings — Channel bindings used; if not exepected otherwise, use GSS_C_NO_CHANNEL_BINDINGS.
input_token — input token sent from the acceptor; for the initial packet the buffer of { NULL, 0 } should be used.
actual_mech_type — the actual mech used; MUST NOT be freed since it pointing to static memory.
output_token — if there is an output token, regardless of complete, continue_needed, or error it should be sent to the acceptor.
ret_flags — return what flags was negotitated; caller should check if they are accetable. For example, if GSS_C_MUTUAL_FLAG was negotiated with the acceptor or not.
time_rec — amount of time this context is valid for.

Returns:

a gss_error code; see gss_display_status() about printing the error code.

🧚 `gss_inquire_attrs_for_mech` 🧚

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_inquire_attrs_for_mech
    (OM_uint32 *minor_status, gss_const_OID mech, gss_OID_set
    *mech_attr, gss_OID_set *known_mech_attrs)

List support attributes for a mech and/or all mechanisms. Very “tell me everything” energy.

Parameters:

minor_status — minor status code.
mech — given together with mech_attr will return the list of attributes for mechanism; can optionally be GSS_C_NO_OID.
mech_attr — see mech parameter; can optionally be NULL; release with gss_release_oid_set().
known_mech_attrs — all attributes for mechanisms supported; release with gss_release_oid_set().

🍓 `gss_inquire_saslname_for_mech` 🍓

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
    gss_inquire_saslname_for_mech (OM_uint32 *minor_status, const
    gss_OID desired_mech, gss_buffer_t sasl_mech_name, gss_buffer_t
    mech_name, gss_buffer_t mech_description)

Returns different protocol names and description of the mechanism.

Parameters:

minor_status — minor status code.
desired_mech — mech list query.
sasl_mech_name — SASL GS2 protocol name.
mech_name — gssapi protocol name.
mech_description — description of gssapi mech.

Returns:

returns GSS_S_COMPLETE or a error code.

⭐ `gss_oid_equal` ⭐

GSSAPI_LIB_FUNCTION int GSSAPI_LIB_CALL gss_oid_equal (gss_const_OID a,
    gss_const_OID b)

Compare two GSS-API OIDs with each other.

GSS_C_NO_OID matches nothing, not even it-self. Not even itself, bestie. The audacity.

Parameters:

a — first oid to compare.
b — second oid to compare.

Returns:

non-zero when both oid are the same OID, zero when they are not the same.

🔥 `gss_release_cred` 🔥

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_release_cred
    (OM_uint32 *minor_status, gss_cred_id_t *cred_handle)

Release a credentials.

It’s ok to release the GSS_C_NO_CREDENTIAL/NULL credential; it will return a GSS_S_COMPLETE error code. On return cred_handle is set to GSS_C_NO_CREDENTIAL.

Example:

gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
major = gss_release_cred(&minor, &cred);

Parameters:

minor_status — minor status return code, mech specific.
cred_handle — a pointer to the credential to release.

Returns:

an gssapi error code.

🌸 `gss_release_iov_buffer` 🌸

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_release_iov_buffer
    (OM_uint32 *minor_status, gss_iov_buffer_desc *iov, int iov_count)

Free all buffer allocated by gss_wrap_iov() or gss_unwrap_iov() by looking at the GSS_IOV_BUFFER_FLAG_ALLOCATED flag.

💜 `gss_release_name` 💜

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_release_name
    (OM_uint32 *minor_status, gss_name_t *input_name)

Free a name.

import_name can point to NULL or be NULL, or a pointer to a gss_name_t structure. If it was a pointer to gss_name_t, the pointer will be set to NULL on success and failure.

Parameters:

minor_status — minor status code.
input_name — name to free.

Returns:

a gss_error code; see gss_display_status() about printing the error code.

part 1 of 2 — the rest is still loading, bestie.

💅 `gss_unwrap_iov`

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_unwrap_iov (OM_uint32 *
    minor_status, gss_ctx_id_t context_handle, int * conf_state, gss_qop_t *
    qop_state, gss_iov_buffer_desc * iov, int iov_count)

okay so this one does the reverse girlie thing — it decrypts the data, or verifies the signature on it. that's the whole job. 💖

🎁 `gss_wrap`

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap (OM_uint32 *
    minor_status, const gss_ctx_id_t context_handle, int conf_req_flag,
    gss_qop_t qop_req, const gss_buffer_t input_message_buffer, int *
    conf_state, gss_buffer_t output_message_buffer)

wraps a message, and it can do it two ways, bestie: confidentiality (that's encryption + signature, the full glam) or sealing (just the signature, minimal but cute). ✨

Parameters — let's go through them one by one:

minor_status — the minor status code. yes, it's the little sibling of the major one.
context_handle — the context handle. iconic, necessary, you know her.
conf_req_flag — if this is non-zero, you're requesting confidentiality. say it with your chest.
qop_req — the type of protection you want. ngl in most cases you should just pass in GSS_C_QOP_DEFAULT and let it cook.
input_message_buffer — the messages you're wrapping. 🎀
conf_state — comes back non-zero if confidentiality was actually honoured. a yes/no vibe check on your own request.
output_message_buffer — the resulting buffer. release it with gss_release_buffer(), don't just leave it hanging, that's rude to your memory. 💀

🔐 `gss_wrap_iov`

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap_iov (OM_uint32 *
    minor_status, gss_ctx_id_t context_handle, int conf_req_flag, gss_qop_t
    qop_req, int * conf_state, gss_iov_buffer_desc * iov, int iov_count)

encrypts the data, or signs it. so far so normal, right? but this is the more complicated version of gss_wrap() — and honestly she's giving main character energy. it lets the caller use AEAD data (that's a signed header/trailer, fancy ✨) and it also gives you way more control over where the encrypted data actually gets placed. lowkey powerful.

the maximum packet size is gss_context_stream_sizes.max_msg_size. write that down. 📝

when you're using it in conf_req_flag=1 mode, the caller needs to provide these buffers:

HEADER (of size gss_context_stream_sizes.header) { DATA or SIGN_ONLY } (optional, zero or more) PADDING (of size gss_context_stream_sizes.blocksize, if zero padding is zero, can be omitted) TRAILER (of size gss_context_stream_sizes.trailer)
on DCE-RPC mode, the caller can skip PADDING and TRAILER if the DATA elements is padded to a block boundary and header is of at least size gss_context_stream_sizes.header + gss_context_stream_sizes.trailer.

HEADER, PADDING, TRAILER will be shrunken down to the size actually required to transmit — so if any of them is too large, it gets trimmed. no wasted space, we love a minimal queen. 🦋

to generate gss_wrap() compatible packets, use: HEADER | DATA | PADDING | TRAILER

and when it's used in conf_req_flag=0:

HEADER (of size gss_context_stream_sizes.header) { DATA or SIGN_ONLY } (optional, zero or more) PADDING (of size gss_context_stream_sizes.blocksize, if zero padding is zero, can be omitted) TRAILER (of size gss_context_stream_sizes.trailer)

the input sizes of HEADER, PADDING and TRAILER can be fetched using gss_wrap_iov_length() or gss_context_query_attributes(). two ways to get the same info, pick your fighter. 💅

📏 `gss_wrap_iov_length`

GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_wrap_iov_length (OM_uint32
    * minor_status, gss_ctx_id_t context_handle, int conf_req_flag,
    gss_qop_t qop_req, int * conf_state, gss_iov_buffer_desc * iov, int
    iov_count)

updates the length fields in the iov buffer, but like — only for these types, bestie, don't get it twisted:

GSS_IOV_BUFFER_TYPE_HEADER
GSS_IOV_BUFFER_TYPE_PADDING
GSS_IOV_BUFFER_TYPE_TRAILER

and a gentle suggestion: consider using gss_context_query_attributes() to fetch the data instead. 🙈

🌸 Variable Documentation 🌸

👑 `gss_OID_desc GSSAPI_LIB_FUNCTION __gss_c_attr_stream_sizes_oid_desc`

initial value:

{10, rk_UNCONST('a686)}

this is the one that queries the context for parameters. 🫶

SSPI equivalent, if you were wondering: this function is QueryContextAttributes.

and the tea 🍓: GSS_C_ATTR_STREAM_SIZES data is a gss_context_stream_sizes.

that's the whole page, periodt. 💜

Version 1.5.2 · 11 Jan 2012 · Heimdal GSS-API functions(3) — and that's the source, the version and the date, signed, sealed and delivered with a little kiss. mwah. 🎀💖

📦 where this page comes from

nixpkgs unstable: source
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms

__GSS_C_ATTR_STREAM_SIZES_OID_DESC(3)