package gssapi

import "github.com/jcmturner/gokrb5/v8/gssapi"

Package gssapi implements Generic Security Services Application Program Interface required for SPNEGO kerberos authentication.

Index

Constants

const (
	// MICTokenFlagSentByAcceptor - this flag indicates the sender is the context acceptor.  When not set, it indicates the sender is the context initiator
	MICTokenFlagSentByAcceptor = 1 << iota
	// MICTokenFlagSealed - this flag indicates confidentiality is provided for.  It SHALL NOT be set in MIC tokens
	MICTokenFlagSealed
	// MICTokenFlagAcceptorSubkey - a subkey asserted by the context acceptor is used to protect the message
	MICTokenFlagAcceptorSubkey
)
const (
	ContextFlagDeleg    = 1
	ContextFlagMutual   = 2
	ContextFlagReplay   = 4
	ContextFlagSequence = 8
	ContextFlagConf     = 16
	ContextFlagInteg    = 32
	ContextFlagAnon     = 64
)

GSS-API context flags assigned numbers.

const (
	StatusBadBindings = 1 << iota
	StatusBadMech
	StatusBadName
	StatusBadNameType
	StatusBadStatus
	StatusBadSig
	StatusBadMIC
	StatusContextExpired
	StatusCredentialsExpired
	StatusDefectiveCredential
	StatusDefectiveToken
	StatusFailure
	StatusNoContext
	StatusNoCred
	StatusBadQOP
	StatusUnauthorized
	StatusUnavailable
	StatusDuplicateElement
	StatusNameNotMN
	StatusComplete
	StatusContinueNeeded
	StatusDuplicateToken
	StatusOldToken
	StatusUnseqToken
	StatusGapToken
)

GSS-API status values

const (
	// HdrLen is the length of the Wrap Token's header
	HdrLen = 16
	// FillerByte is a filler in the WrapToken structure
	FillerByte byte = 0xFF
)

Types

type ContextFlags

type ContextFlags asn1.BitString

ContextFlags flags for GSSAPI DEPRECATED - do not use

func NewContextFlags

func NewContextFlags() ContextFlags

NewContextFlags creates a new ContextFlags instance DEPRECATED - do not use

type ContextToken

type ContextToken interface {
	Marshal() ([]byte, error)
	Unmarshal(b []byte) error
	Verify() (bool, Status)
	Context() context.Context
}

ContextToken is an interface for a GSS-API context token.

type MICToken

type MICToken struct {
	// const GSS Token ID: 0x0404
	Flags byte // contains three flags: acceptor, sealed, acceptor subkey
	// const Filler: 0xFF 0xFF 0xFF 0xFF 0xFF
	SndSeqNum uint64 // sender's sequence number. big-endian
	Payload   []byte // your data! :)
	Checksum  []byte // checksum of { payload | header }
}

MICToken represents a GSS API MIC token, as defined in RFC 4121. It contains the header fields, the payload (this is not transmitted) and the checksum, and provides the logic for converting to/from bytes plus computing and verifying checksums

func NewInitiatorMICToken

func NewInitiatorMICToken(payload []byte, key types.EncryptionKey) (*MICToken, error)

NewInitiatorMICToken builds a new initiator token (acceptor flag will be set to 0) and computes the authenticated checksum. Other flags are set to 0. Note that in certain circumstances you may need to provide a sequence number that has been defined earlier. This is currently not supported.

func (*MICToken) Marshal

func (mt *MICToken) Marshal() ([]byte, error)

Marshal the MICToken into a byte slice. The payload should have been set and the checksum computed, otherwise an error is returned.

func (*MICToken) SetChecksum

func (mt *MICToken) SetChecksum(key types.EncryptionKey, keyUsage uint32) error

SetChecksum uses the passed encryption key and key usage to compute the checksum over the payload and the header, and sets the Checksum field of this MICToken. If the payload has not been set or the checksum has already been set, an error is returned.

func (*MICToken) Unmarshal

func (mt *MICToken) Unmarshal(b []byte, expectFromAcceptor bool) error

Unmarshal bytes into the corresponding MICToken. If expectFromAcceptor is true we expect the token to have been emitted by the gss acceptor, and will check the according flag, returning an error if the token does not match the expectation.

func (*MICToken) Verify

func (mt *MICToken) Verify(key types.EncryptionKey, keyUsage uint32) (bool, error)

Verify computes the token's checksum with the provided key and usage, and compares it to the checksum present in the token. In case of any failure, (false, err) is returned, with err an explanatory error.

type Mechanism

type Mechanism interface {
	OID() asn1.ObjectIdentifier
	AcquireCred() error                                               // acquire credentials for use (eg. AS exchange for KRB5)
	InitSecContext() (ContextToken, error)                            // initiate outbound security context (eg TGS exchange builds AP_REQ to go into ContextToken to send to service)
	AcceptSecContext(ct ContextToken) (bool, context.Context, Status) // service verifies the token server side to establish a context
	MIC() MICToken                                                    // apply integrity check, receive as token separate from message
	VerifyMIC(mt MICToken) (bool, error)                              // validate integrity check token along with message
	Wrap(msg []byte) WrapToken                                        // sign, optionally encrypt, encapsulate
	Unwrap(wt WrapToken) []byte                                       // decapsulate, decrypt if needed, validate integrity check
}

Mechanism is the GSS-API interface for authentication mechanisms.

type OIDName

type OIDName string

OIDName is the type for defined GSS-API OIDs.

const (
	// GSS-API OID names
	OIDKRB5         OIDName = "KRB5"         // MechType OID for Kerberos 5
	OIDMSLegacyKRB5 OIDName = "MSLegacyKRB5" // MechType OID for Kerberos 5
	OIDSPNEGO       OIDName = "SPNEGO"
	OIDGSSIAKerb    OIDName = "GSSIAKerb" // Indicates the client cannot get a service ticket and asks the server to serve as an intermediate to the target KDC. http://k5wiki.kerberos.org/wiki/Projects/IAKERB#IAKERB_mech
)

GSS-API OID names

func (OIDName) OID

func (o OIDName) OID() asn1.ObjectIdentifier

OID returns the OID for the provided OID name.

type Status

type Status struct {
	Code    int
	Message string
}

Status is the GSS-API status and implements the error interface.

func (Status) Error

func (s Status) Error() string

Error returns the Status description.

type WrapToken

type WrapToken struct {
	// const GSS Token ID: 0x0504
	Flags byte // contains three flags: acceptor, sealed, acceptor subkey
	// const Filler: 0xFF
	EC        uint16 // checksum length. big-endian
	RRC       uint16 // right rotation count. big-endian
	SndSeqNum uint64 // sender's sequence number. big-endian
	Payload   []byte // your data! :)
	CheckSum  []byte // authenticated checksum of { payload | header }
}

WrapToken represents a GSS API Wrap token, as defined in RFC 4121. It contains the header fields, the payload and the checksum, and provides the logic for converting to/from bytes plus computing and verifying checksums

func NewInitiatorWrapToken

func NewInitiatorWrapToken(payload []byte, key types.EncryptionKey) (*WrapToken, error)

NewInitiatorWrapToken builds a new initiator token (acceptor flag will be set to 0) and computes the authenticated checksum. Other flags are set to 0, and the RRC and sequence number are initialized to 0. Note that in certain circumstances you may need to provide a sequence number that has been defined earlier. This is currently not supported.

func (*WrapToken) Marshal

func (wt *WrapToken) Marshal() ([]byte, error)

Marshal the WrapToken into a byte slice. The payload should have been set and the checksum computed, otherwise an error is returned.

func (*WrapToken) SetCheckSum

func (wt *WrapToken) SetCheckSum(key types.EncryptionKey, keyUsage uint32) error

SetCheckSum uses the passed encryption key and key usage to compute the checksum over the payload and the header, and sets the CheckSum field of this WrapToken. If the payload has not been set or the checksum has already been set, an error is returned.

func (*WrapToken) Unmarshal

func (wt *WrapToken) Unmarshal(b []byte, expectFromAcceptor bool) error

Unmarshal bytes into the corresponding WrapToken. If expectFromAcceptor is true, we expect the token to have been emitted by the gss acceptor, and will check the according flag, returning an error if the token does not match the expectation.

func (*WrapToken) Verify

func (wt *WrapToken) Verify(key types.EncryptionKey, keyUsage uint32) (bool, error)

Verify computes the token's checksum with the provided key and usage, and compares it to the checksum present in the token. In case of any failure, (false, Err) is returned, with Err an explanatory error.

Source Files

MICToken.go contextFlags.go gssapi.go wrapToken.go

Version
v8.4.4 (latest)
Published
Feb 25, 2023
Platform
windows/amd64
Imports
11 packages
Last checked
4 minutes ago

Tools for package owners.