RFC 5587

Extended Generic Security Service Mechanism Inquiry APIs

📅 published July 2009, from ietf

RFC 5587 🎀 Extended Generic Security Service Mechanism Inquiry APIs

Who wrote it: N. Williams from Sun 💜 Category: Standards Track 🔥 Date: July 2009 🌸 Obsoletes / Updates: The title block I'm working from doesn't list anything this RFC obsoletes or updates ✨

Abstract 🦋

okay so this doc adds brand new APIs to GSS-API for inquiring about mechanism attributes 💅 the main goal is to cut down on apps hardcoding mechanism identifiers, which is honestly such a glow-up 🌈

the APIs bring in mechanism attributes and attribute sets, a function to ask what attributes a mechanism has, a function to find mechanisms that have a given set of attributes, and a function to display mechanism attributes 🧚

Status of This Memo 📜

this document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 💖 if you want the current standardization state and status, check the current edition of the "Internet Official Protocol Standards" (STD 1) 🫶 and distribution of this memo is unlimited 🌍

Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved. 💜

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents in effect on the date of publication. the license info lives at http://trustee.ietf.org/license-info 📎 please actually read those, bestie, because they explain your rights and restrictions for this document 🙈

Table of Contents 🗂️

1. Introduction ....................................................2
2. Conventions Used in This Document ...............................2
3. New GSS-API Interfaces ..........................................3
   3.1. Mechanism Attributes and Attribute Sets ....................3
   3.2. List of Known Mechanism Attributes .........................4
   3.3. Mechanism Attribute Sets of Existing Mechs .................6
   3.4. New GSS-API Function Interfaces ............................8
        3.4.1. Mechanism Attribute Criticality .....................8
        3.4.2. GSS_Indicate_mechs_by_attrs() .......................9
        3.4.3. GSS_Inquire_attrs_for_mech() .......................10
        3.4.4. GSS_Display_mech_attr() ............................10
        3.4.5. New Major Status Values ............................11
        3.4.6. C-Bindings .........................................11
4. Requirements for Mechanism Designers ...........................13
5. IANA Considerations ............................................13
6. Security Considerations ........................................13
7. References .....................................................13
   7.1. Normative References ......................................13
   7.2. Informative References ....................................14
Appendix A. Typedefs and C Bindings ..................................15

1. Introduction ✨

okay so GSS-API [RFC2743] mechanisms have a bunch of properties that apps might care about 👀 but there's been no APIs for asking about what mechanisms are available and what they can do, so a lot of GSS-API apps have ended up hardcoding mechanism Object Identifiers (OIDs) 😭 and more new mechanisms are coming, so this is only going to get messier 💀 apps really shouldn't have to hardcode their OIDs 🙅‍♀️

here's a super real example 🍓 Secure Shell version 2 (SSHv2) [RFC4251] supports GSS-API mechanisms for authentication [RFC4462], but it straight up bans Simple and Protected GSS-API Negotiation (SPNEGO) [RFC4178] 🚫 any future mechanisms that negotiate other mechanisms would need to be banned too, but right now there's no way to write an app that checks what mechanisms are available and then programmatically excludes stuff "like SPNEGO" 😤 that's the gap this doc is fixing 🔥

2. Conventions Used in This Document 📚

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💜 these are the capital-letter requirement words, so read them carefully, periodt 💅

3. New GSS-API Interfaces 🦋

we're introducing a brand new concept: mechanism attributes 🌈 by letting apps query the attributes tied to individual mechanisms, and find out which mechanisms support a given set of attributes, apps can pick mechanisms based on what they can do without hardcoding mechanism OIDs. it's giving main character energy 👑

Section 3.1 explains the mechanism attributes concept. Sections 3.4.2, 3.4.3, and 3.4.4 describe three new interfaces that deal with mechanisms and attribute sets 🧚 they are:

  • GSS_Indicate_mechs_by_attrs()
  • GSS_Inquire_attrs_for_mech()
  • GSS_Display_mech_attr()

3.1. Mechanism Attributes and Attribute Sets 🎀

okay so we need some way to talk about the features that mechanisms and pseudo-mechanisms provide, so apps can select mechanisms programmatically ✨ a pseudo-mechanism is a mechanism that refers to other mechanisms to provide its services 🫶 SPNEGO is the perfect example, because without other mechanisms it's literally useless 💀

we need two data types here: one for individual mechanism attributes, and one for mechanism attribute sets 💖 to keep the interfaces simple, we reuse the OID and OID set data types and model each individual mechanism attribute type as an OID 🌸 nice and tidy, no cap.

so to make this happen, we define an open namespace of mechanism attributes and give them arcs off of this OID:

<1.3.6.1.5.5.13>

each mechanism has a set of mechanism attributes that it supports, as described in its own specification 🍓🌈

3.2. List of Known Mechanism Attributes ✨

okay bestie, here's the full list of mechanism attributes so far 💅 Table 1 gives each one its OID arc number and arc name, and Table 2 explains what each one actually means 🎀

+-------------------------+---------+-------------------------+
| Mech Attr Name          | OID Arc | Arc Name                |
+-------------------------+---------+-------------------------+
| GSS_C_MA_MECH_CONCRETE  |     (1) | concrete-mech           |
| GSS_C_MA_MECH_PSEUDO    |     (2) | pseudo-mech             |
| GSS_C_MA_MECH_COMPOSITE |     (3) | composite-mech          |
| GSS_C_MA_MECH_NEGO      |     (4) | mech-negotiation-mech   |
| GSS_C_MA_MECH_GLUE      |     (5) | mech-glue               |
| GSS_C_MA_NOT_MECH       |     (6) | not-mech                |
| GSS_C_MA_DEPRECATED     |     (7) | mech-deprecated         |
| GSS_C_MA_NOT_DFLT_MECH  |     (8) | mech-not-default        |
| GSS_C_MA_ITOK_FRAMED    |     (9) | initial-is-framed       |
| GSS_C_MA_AUTH_INIT      |    (10) | auth-init-princ         |
| GSS_C_MA_AUTH_TARG      |    (11) | auth-targ-princ         |
| GSS_C_MA_AUTH_INIT_INIT |    (12) | auth-init-princ-initial |
| GSS_C_MA_AUTH_TARG_INIT |    (13) | auth-targ-princ-initial |
| GSS_C_MA_AUTH_INIT_ANON |    (14) | auth-init-princ-anon    |
| GSS_C_MA_AUTH_TARG_ANON |    (15) | auth-targ-princ-anon    |
| GSS_C_MA_DELEG_CRED     |    (16) | deleg-cred              |
| GSS_C_MA_INTEG_PROT     |    (17) | integ-prot              |
| GSS_C_MA_CONF_PROT      |    (18) | conf-prot               |
| GSS_C_MA_MIC            |    (19) | mic                     |
| GSS_C_MA_WRAP           |    (20) | wrap                    |
| GSS_C_MA_PROT_READY     |    (21) | prot-ready              |
| GSS_C_MA_REPLAY_DET     |    (22) | replay-detection        |
| GSS_C_MA_OOS_DET        |    (23) | oos-detection           |
| GSS_C_MA_CBINDINGS      |    (24) | channel-bindings        |
| GSS_C_MA_PFS            |    (25) | pfs                     |
| GSS_C_MA_COMPRESS       |    (26) | compress                |
| GSS_C_MA_CTX_TRANS      |    (27) | context-transfer        |
| <reserved>              | (28...) |                         |
+-------------------------+---------+-------------------------+

Table 1

+-------------------------+-----------------------------------------+
| Mech Attr Name          | Purpose                                 |
+-------------------------+-----------------------------------------+
| GSS_C_MA_MECH_CONCRETE  | Indicates that a mech is neither a      |
|                         | pseudo-mechanism nor a composite        |
|                         | mechanism.                              |
| GSS_C_MA_MECH_PSEUDO    | Indicates that a mech is a              |
|                         | pseudo-mechanism.                       |
| GSS_C_MA_MECH_COMPOSITE | Indicates that a mech is a composite of |
|                         | other mechanisms.  This is reserved for |
|                         | a specification of "stackable"          |
|                         | pseudo-mechanisms.                      |
| GSS_C_MA_MECH_NEGO      | Indicates that a mech negotiates other  |
|                         | mechs (e.g., SPNEGO has this            |
|                         | attribute).                             |
| GSS_C_MA_MECH_GLUE      | Indicates that the OID is not for a     |
|                         | mechanism but for the GSS-API itself.   |
| GSS_C_MA_NOT_MECH       | Indicates that the OID is known, yet it |
|                         | is also known not to be the OID of any  |
|                         | GSS-API mechanism (or of the GSS-API    |
|                         | itself).                                |
| GSS_C_MA_DEPRECATED     | Indicates that a mech (or its OID) is   |
|                         | deprecated and MUST NOT be used as a    |
|                         | default mechanism.                      |
| GSS_C_MA_NOT_DFLT_MECH  | Indicates that a mech (or its OID) MUST |
|                         | NOT be used as a default mechanism.     |
| GSS_C_MA_ITOK_FRAMED    | Indicates that the given mechanism's    |
|                         | initial context tokens are properly     |
|                         | framed as per Section 3.1 of [RFC2743]. |
| GSS_C_MA_AUTH_INIT      | Indicates support for authentication of |
|                         | initiator to acceptor.                  |
| GSS_C_MA_AUTH_TARG      | Indicates support for authentication of |
|                         | acceptor to initiator.                  |
| GSS_C_MA_AUTH_INIT_INIT | Indicates support for "initial"         |
|                         | authentication of initiator to          |
|                         | acceptor.  "Initial authentication"     |
|                         | refers to the use of passwords, or keys |
|                         | stored on tokens, for authentication.   |
|                         | Whether a mechanism supports initial    |
|                         | authentication may depend on IETF       |
|                         | consensus (see Security                 |
|                         | Considerations).                        |
| GSS_C_MA_AUTH_TARG_INIT | Indicates support for initial           |
|                         | authentication of acceptor to           |
|                         | initiator.                              |
| GSS_C_MA_AUTH_INIT_ANON | Indicates support for                   |
|                         | GSS_C_NT_ANONYMOUS as an initiator      |
|                         | principal name.                         |
| GSS_C_MA_AUTH_TARG_ANON | Indicates support for                   |
|                         | GSS_C_NT_ANONYMOUS as a target          |
|                         | principal name.                         |
| GSS_C_MA_DELEG_CRED     | Indicates support for credential        |
|                         | delegation.                             |
| GSS_C_MA_INTEG_PROT     | Indicates support for per-message       |
|                         | integrity protection.                   |
| GSS_C_MA_CONF_PROT      | Indicates support for per-message       |
|                         | confidentiality protection.             |
| GSS_C_MA_MIC            | Indicates support for Message Integrity |
|                         | Code (MIC) tokens.                      |
| GSS_C_MA_WRAP           | Indicates support for WRAP tokens.      |
| GSS_C_MA_PROT_READY     | Indicates support for per-message       |
|                         | protection prior to full context        |
|                         | establishment.                          |
| GSS_C_MA_REPLAY_DET     | Indicates support for replay detection. |
| GSS_C_MA_OOS_DET        | Indicates support for out-of-sequence   |
|                         | detection.                              |
| GSS_C_MA_CBINDINGS      | Indicates support for channel bindings. |
| GSS_C_MA_PFS            | Indicates support for Perfect Forward   |
|                         | Security.                               |
| GSS_C_MA_COMPRESS       | Indicates support for compression of    |
|                         | data inputs to GSS_Wrap().              |
| GSS_C_MA_CTX_TRANS      | Indicates support for security context  |
|                         | export/import.                          |
+-------------------------+-----------------------------------------+

Table 2

3.3. Mechanism Attribute Sets of Existing Mechs 🦋

the Kerberos V mechanism [RFC1964] comes with these attributes 🔥

  • GSS_C_MA_MECH_CONCRETE
  • GSS_C_MA_ITOK_FRAMED
  • GSS_C_MA_AUTH_INIT
  • GSS_C_MA_AUTH_TARG
  • GSS_C_MA_DELEG_CRED
  • GSS_C_MA_INTEG_PROT
  • GSS_C_MA_CONF_PROT
  • GSS_C_MA_MIC
  • GSS_C_MA_WRAP
  • GSS_C_MA_PROT_READY
  • GSS_C_MA_REPLAY_DET
  • GSS_C_MA_OOS_DET
  • GSS_C_MA_CBINDINGS
  • GSS_C_MA_CTX_TRANS (some implementations, using implementation-specific exported context token formats)

Kerberos V also has a deprecated OID with the same mechanism attributes as above, plus GSS_C_MA_DEPRECATED 🙈

the Simple Public-Key GSS-API Mechanism (SPKM) [RFC2025] family gets its attributes in a separate document. SPKM is currently being reviewed for possibly significant changes because of problems in its specifications, so it's on hold for now 🌸

the Low Infrastructure Public Key (LIPKEY) mechanism [RFC2847] offers these:

  • GSS_C_MA_MECH_CONCRETE
  • GSS_C_MA_ITOK_FRAMED
  • GSS_C_MA_AUTH_INIT_INIT
  • GSS_C_MA_AUTH_TARG (from SPKM-3)
  • GSS_C_MA_AUTH_TARG_ANON (from SPKM-3)
  • GSS_C_MA_INTEG_PROT
  • GSS_C_MA_CONF_PROT
  • GSS_C_MA_REPLAY_DET
  • GSS_C_MA_OOS_DET
  • GSS_C_MA_CTX_TRANS (some implementations, using implementation-specific exported context token formats)

LIPKEY should also provide GSS_C_MA_CBINDINGS, but SPKM-3 needs clarifications on this point 🧚

the SPNEGO mechanism [RFC4178] provides these two:

  • GSS_C_MA_MECH_NEGO
  • GSS_C_MA_ITOK_FRAMED

All other mechanisms' attributes will be described elsewhere ✨

3.4. New GSS-API Function Interfaces 💖

a few new interfaces are here so GSS-API applications can figure out which features a given mechanism provides, and which mechanisms provide which features 🍓

these new interfaces are all OPTIONAL 🫶

applications should use GSS_Indicate_mechs_by_attrs() instead of GSS_Indicate_mechs() wherever possible 👑

applications can use GSS_Indicate_mechs_by_attrs() to find out whether any mechanisms provide a given set of features, and if so, which ones 🦋

GSS_Indicate_mechs_by_attrs() can also be used (just like GSS_Indicate_mechs()) to list the available mechanisms of each type, like concrete, mechanism negotiation pseudo-mechanism, and so on 🌈

3.4.1. Mechanism Attribute Criticality 💅

mechanism attributes may be added at any time 🫠 Not only can new attributes be added to the list of known mechanism attributes at any time, but the set of mechanism attributes a mechanism supports can also change at any time 🌸

for example, new attributes might show up to say whether a mechanism's initiator has to contact an online infrastructure, and/or whether the acceptor has to do so. In that example, Kerberos V would gain a new attribute even though the mechanism itself hasn't been modified 😭

here's the problem, though. An application that uses attributes not defined in this document would have no way of knowing whether a GSS-API implementation and its mechanisms understand those new attributes 💀 To fix that, GSS_Indicate_mechs_by_attrs() and GSS_Inquire_attrs_for_mech() support the idea of critical mechanism attributes 🔥 Applications can search for mechanisms that understand the attributes that are critical to them, and an application can also ask which mechanism attributes a given mechanism understands ✨

3.4.2. GSS_Indicate_mechs_by_attrs() 🎀

Okay so this one is giving filter. You hand it three sets of attribute OIDs and it hands back the mechanisms that fit your vibe. 💅

Inputs:

  • desired_mech_attrs SET OF OBJECT IDENTIFIER -- set of GSS_C_MA_* OIDs that the mechanisms indicated in the mechs output parameter MUST offer. 💖
  • except_mech_attrs SET OF OBJECT IDENTIFIER -- set of GSS_C_MA_* OIDs that the mechanisms indicated in the mechs output parameter MUST NOT offer. 🙅‍♀️
  • critical_mech_attrs SET OF OBJECT IDENTIFIER -- set of GSS_C_MA_* OIDs that the mechanisms indicated in the mechs output parameter MUST understand (i.e., mechs must know whether critical attributes are or are not supported). 🔥

Outputs:

  • major_status INTEGER
  • minor_status INTEGER
  • mechs SET OF OBJECT IDENTIFIER -- set of mechanisms that support the given desired_mech_attrs but not the except_mech_attrs, and all of which understand the given critical_mech_attrs (the caller must release this output with GSS_Release_oid_set()). 🧚

Return major_status codes:

  • GSS_S_COMPLETE indicates success; the output mechs parameter MAY be the empty set (GSS_C_NO_OID_SET). 🌸
  • GSS_S_FAILURE indicates that the request failed for some other reason. 💀

GSS_Indicate_mechs_by_attrs() returns the set of OIDs corresponding to mechanisms that offer at least the desired_mech_attrs but none of the except_mech_attrs, and that understand all of the attributes listed in critical_mech_attrs. It's literally the bouncer for mechanisms, and it's so good at it. ✨

When all three sets of OID input parameters are the empty set, this function acts as a version of GSS_indicate_mechs() that outputs the set of all supported mechanisms. So no filters, no drama, just everything. 🦋

3.4.3. GSS_Inquire_attrs_for_mech() 🧁

This one is the "tell me your whole personality" function. 😭

Inputs:

  • mech OBJECT IDENTIFIER -- mechanism OID

Outputs:

  • major_status INTEGER
  • minor_status INTEGER
  • mech_attrs SET OF OBJECT IDENTIFIER -- set of mech_attrs OIDs (GSS_C_MA_*) supported by the mechanism (the caller must release this output with GSS_Release_oid_set()). 💜
  • known_mech_attrs SET OF OBJECT IDENTIFIER -- set of mech_attrs OIDs known to the mechanism implementation (the caller must release this output with GSS_Release_oid_set()). 🌈

Return major_status codes:

  • GSS_S_COMPLETE indicates success; the output mech_attrs parameter MAY be the empty set (GSS_C_NO_OID_SET). ⭐
  • GSS_S_BAD_MECH indicates that the mechanism named by the mech parameter does not exist or that the mech is GSS_C_NO_OID and no default mechanism could be determined. 🙈
  • GSS_S_FAILURE indicates that the request failed for some other reason. 💀

GSS_Inquire_attrs_for_mech() indicates the set of mechanism attributes supported by a given mechanism. Main character energy, fr fr. 👑

3.4.4. GSS_Display_mech_attr() 🍓

This is the one that gives you the human-readable tea on each attribute. Finally, a function that explains itself! 🫶

Inputs:

  • mech_attr OBJECT IDENTIFIER -- mechanism attribute OID

Outputs:

  • major_status INTEGER
  • minor_status INTEGER
  • name OCTET STRING, -- name of mechanism attribute (e.g., GSS_C_MA_*).
  • short_desc OCTET STRING, -- a short description of the mechanism attribute (the caller must release this output with GSS_Release_buffer()).
  • long_desc OCTET STRING -- a longer description of the mechanism attribute (the caller must release this output with GSS_Release_buffer()).

Return major_status codes:

  • GSS_S_COMPLETE indicates success. ✅
  • GSS_S_BAD_MECH_ATTR indicates that the mechanism attribute referenced by the mech_attr parameter is unknown to the implementation. 😵
  • GSS_S_FAILURE indicates that the request failed for some other reason. 💀

This function can be used to obtain human-readable descriptions of GSS-API mechanism attributes. Honestly, the glow-up of documentation. 🦋

3.4.5. New Major Status Values 🌟

A single, new, major status code is added for GSS_Display_mech_attr():

  • GSS_S_BAD_MECH_ATTR,

roughly corresponding to GSS_S_BAD_MECH but applicable to mechanism attribute OIDs rather than to mechanism OIDs. Same energy, different target. 🎯

For the C-bindings of the GSS-API [RFC2744], GSS_S_BAD_MECH_ATTR shall have a routine error number of 19 (this is shifted to the left by GSS_C_ROUTINE_ERROR_OFFSET). 🔢

3.4.6. C-Bindings 💅

Okay, bestie, there's a bug in the C bindings of the GSS-APIv2u1 [RFC2744]. The C const attribute gets applied to types that are pointer typedefs. That's a problem, because it declares that the pointer argument is const rather than that the object pointed to by it is const. 🙃 To fix it, we're defining new typedefs that include const properly:

typedef const gss_buffer_desc * gss_const_buffer_t;
typedef const struct gss_channel_bindings_struct *
   gss_const_channel_bindings_t;
typedef const <platform-specific> gss_const_ctx_id_t;
typedef const <platform-specific> gss_const_cred_id_t;
typedef const <platform-specific> gss_const_name_t;
typedef const gss_OID_desc * gss_const_OID;
typedef const gss_OID_set_desc * gss_const_OID_set;

Figure 1: const typedefs

Only gss_const_OID and gss_const_OID_set are used below. We include the other const typedefs for convenience, since the C bindings of the GSS-API do use const with pointer typedefs when they should often use the above typedefs instead. 🧠

#define GSS_S_BAD_MECH_ATTR (19ul << GSS_C_ROUTINE_ERROR_OFFSET)

OM_uint32 gss_indicate_mechs_by_attrs(
   OM_uint32         *minor_status,
   gss_const_OID_set  desired_mech_attrs,
   gss_const_OID_set  except_mech_attrs,
   gss_const_OID_set  critical_mech_attrs,
   gss_OID_set       *mechs);

OM_uint32 gss_inquire_attrs_for_mech(
   OM_uint32         *minor_status,
   gss_const_OID      mech,
   gss_OID_set       *mech_attrs,
   gss_OID_set       *known_mech_attrs);

OM_uint32 gss_display_mech_attr(
   OM_uint32         *minor_status,
   gss_const_OID      mech_attr,
   gss_buffer_t       name,
   gss_buffer_t       short_desc,
   gss_buffer_t       long_desc);

Figure 2: C bindings

Note that output buffers must be released via gss_release_buffer(). Output OID sets must be released via gss_release_oid_set(). 🧹

Please see Appendix A for a full set of typedef fragments defined in this document and the necessary code license. 📜

4. Requirements for Mechanism Designers 🎀

All future GSS-API mechanism specifications MUST:

  • list the set of GSS-API mechanism attributes associated with them. 📝

5. IANA Considerations 🌸

The namespace of programming-language symbols with names beginning with GSS_C_MA_* is reserved for allocation by IETF Consensus. IANA allocated a base OID, as an arc of 1.3.6.1.5.5, for the set of GSS_C_MA_* described herein, and registered all of the GSS_C_MA_* values described in Section 3.2. 🗂️

6. Security Considerations 🚨

This document specifies extensions to a security-related API. It imposes new requirements on future GSS-API mechanisms, and the specifications of future protocols that use the GSS-API should make reference to this document where applicable. The ability to inquire about specific properties of mechanisms should improve security. 🔐

The semantics of each mechanism attribute may include a security component. 🛡️

Application developers must understand that mechanism attributes may be added at any time -- both to the set of known mechanism attributes as well as to existing mechanisms' sets of supported mechanism attributes. Therefore, application developers using the APIs described herein must understand what mechanism attributes their applications depend critically on, and must use the mechanism attribute criticality features of these APIs. 😱🚨

7. References 📚

7.1. Normative References

  • [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [RFC2743] Linn, J., "Generic Security Service Application Program Interface Version 2, Update 1", RFC 2743, January 2000.
  • [RFC2744] Wray, J., "Generic Security Service API Version 2 : C-bindings", RFC 2744, January 2000.

7.2. Informative References

  • [RFC1964] Linn, J., "The Kerberos Version 5 GSS-API Mechanism", RFC 1964, June 1996.
  • [RFC2025] Adams, C., "The Simple Public-Key GSS-API Mechanism (SPKM)", RFC 2025, October 1996.
  • [RFC2847] Eisler, M., "LIPKEY - A Low Infrastructure Public Key Mechanism Using SPKM", RFC 2847, June 2000.
  • [RFC4178] Zhu, L., Leach, P., Jaganathan, K., and W. Ingersoll, "The Simple and Protected Generic Security Service Application Program Interface (GSS-API) Negotiation Mechanism", RFC 4178, October 2005.
  • [RFC4251] Ylonen, T. and C. Lonvick, "The Secure Shell (SSH) Protocol Architecture", RFC 4251, January 2006.
  • [RFC4462] Hutzelman, J., Salowey, J., Galbraith, J., and V. Welch, "Generic Security Service Application Program Interface (GSS-API) Authentication and Key Exchange for the Secure Shell (SSH) Protocol", RFC 4462, May 2006.

Appendix A. Typedefs and C Bindings 🎀

okay bestie, this is the appendix where they gather ALL the code fragments from the whole doc in one place 🧚 so it's like a little cheat sheet. the legal stuff comes first (the Copyright and license bit) and then the good stuff: the typedefs and function signatures 💅

Copyright (c) 2009 IETF Trust and the persons identified as authors of the code. All rights reserved. 💜

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

  • Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 📝
  • Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 📦
  • Neither the name of Internet Society, IETF or IETF Trust, nor the names of specific contributors, may be used to endorse or promote products derived from this software without specific prior written permission. 🚫

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 🙈

the typedefs are basically little nicknames for pointer types, with const slapped on so you can't accidentally change stuff you're only reading 🦋

typedef const gss_buffer_desc * gss_const_buffer_t;
typedef const struct gss_channel_bindings_struct *
   gss_const_channel_bindings_t;
typedef const <platform-specific> gss_const_ctx_id_t;
typedef const <platform-specific> gss_const_cred_id_t;
typedef const <platform-specific> gss_const_name_t;
typedef const gss_OID_desc * gss_const_OID;
typedef const gss_OID_set_desc * gss_const_OID_set;
#define GSS_S_BAD_MECH_ATTR (19ul << GSS_C_ROUTINE_ERROR_OFFSET)

and then the three functions, all with the same OM_uint32 return type and a minor_status out-pointer 🌸

OM_uint32 gss_indicate_mechs_by_attrs(
   OM_uint32         *minor_status,
   gss_const_OID_set  desired_mech_attrs,
   gss_const_OID_set  except_mech_attrs,
   gss_const_OID_set  critical_mech_attrs,
   gss_OID_set       *mechs);

OM_uint32 gss_inquire_attrs_for_mech(
   OM_uint32         *minor_status,
   gss_const_OID      mech,
   gss_OID_set       *mech_attrs,
   gss_OID_set       *known_mech_attrs);

OM_uint32 gss_display_mech_attr(
   OM_uint32         *minor_status,
   gss_const_OID      mech_attr,
   gss_buffer_t       name,
   gss_buffer_t       short_desc,
   gss_buffer_t       long_desc);

Author's Address 🧚‍♀️

Nicolas Williams Sun Microsystems 5300 Riata Trace Ct Austin, TX 78727 US

EMail: Nicolas.Williams@sun.com

and that's the whole RFC, bestie! 🎉 all the mechanism attributes, the new error code, the C bindings, all of it. you did it 👑✨

📦 where this page comes from