heimdal: Vendor import f62e2f278vendor/heimdal/7.8.0-2023-06-10-f62e2f278vendor/heimdal

Heimdal 7.8.0 does not support OpenSSL 3.0. 7.9.0 will but it hasn't
been released yet. We are importing f62e2f278 for its OpenSSL 3.0
support.

1 files changed, 130 insertions, 27 deletions

diff --git a/lib/gssapi/Makefile.am b/lib/gssapi/Makefile.am
index ad88f6bf5939..3cb8437db285 100644
--- a/lib/gssapi/Makefile.am
+++ b/lib/gssapi/Makefile.am
@@ -2,9 +2,12 @@
 
 include $(top_srcdir)/Makefile.am.common
 
+WFLAGS += $(WFLAGS_ENUM_CONV)
+
 AUTOMAKE_OPTIONS = subdir-objects
 
 AM_CPPFLAGS += \
+	-I$(top_srcdir)/lib \
 	-I$(srcdir)/../krb5 \
 	-I$(srcdir) \
 	-I$(srcdir)/gssapi \
@@ -12,9 +15,10 @@ AM_CPPFLAGS += \
 	-I$(srcdir)/ntlm \
 	-I$(srcdir)/krb5 \
 	-I$(srcdir)/spnego \
+	-I$(srcdir)/sanon \
 	$(INCLUDE_libintl)
 
-lib_LTLIBRARIES = libgssapi.la
+lib_LTLIBRARIES = libgssapi.la test_negoex_mech.la
 
 krb5src = \
 	krb5/8003.c \
@@ -37,6 +41,7 @@ krb5src = \
 	krb5/delete_sec_context.c \
 	krb5/display_name.c \
 	krb5/display_status.c \
+	krb5/duplicate_cred.c \
 	krb5/duplicate_name.c \
 	krb5/encapsulate.c \
 	krb5/export_name.c \
@@ -57,6 +62,7 @@ krb5src = \
 	krb5/inquire_mechs_for_name.c \
 	krb5/inquire_names_for_mech.c \
 	krb5/inquire_sec_context_by_oid.c \
+	krb5/name_attrs.c \
 	krb5/pname_to_uid.c \
 	krb5/process_context_token.c \
 	krb5/prf.c \
@@ -77,13 +83,16 @@ mechsrc = \
 	mech/context.h \
 	mech/context.c \
 	mech/cred.h \
+	mech/cred.c \
 	mech/compat.h \
 	mech/doxygen.c \
 	mech/gss_accept_sec_context.c \
 	mech/gss_acquire_cred.c \
-	mech/gss_acquire_cred_ext.c \
+	mech/gss_acquire_cred_from.c \
+	mech/gss_acquire_cred_impersonate_name.c \
 	mech/gss_acquire_cred_with_password.c \
 	mech/gss_add_cred.c \
+	mech/gss_add_cred_from.c \
 	mech/gss_add_cred_with_password.c \
 	mech/gss_add_oid_set_member.c \
 	mech/gss_aeap.c \
@@ -96,16 +105,20 @@ mechsrc = \
 	mech/gss_decapsulate_token.c \
 	mech/gss_delete_name_attribute.c \
 	mech/gss_delete_sec_context.c \
+	mech/gss_destroy_cred.c \
 	mech/gss_display_name.c \
 	mech/gss_display_name_ext.c \
 	mech/gss_display_status.c \
+	mech/gss_duplicate_cred.c \
 	mech/gss_duplicate_name.c \
 	mech/gss_duplicate_oid.c \
+	mech/gss_duplicate_oid_set.c \
 	mech/gss_encapsulate_token.c \
 	mech/gss_export_name.c \
 	mech/gss_export_name_composite.c \
 	mech/gss_export_sec_context.c \
 	mech/gss_get_mic.c \
+	mech/gss_get_neg_mechs.c \
 	mech/gss_get_name_attribute.c \
 	mech/gss_import_name.c \
 	mech/gss_import_sec_context.c \
@@ -133,12 +146,15 @@ mechsrc = \
 	mech/gss_release_name.c \
 	mech/gss_release_oid.c \
 	mech/gss_release_oid_set.c \
+	mech/gss_rfc4121.c \
 	mech/gss_seal.c \
 	mech/gss_set_cred_option.c \
 	mech/gss_set_name_attribute.c \
+	mech/gss_set_neg_mechs.c \
 	mech/gss_set_sec_context_option.c \
 	mech/gss_sign.c \
 	mech/gss_store_cred.c \
+	mech/gss_store_cred_into.c \
 	mech/gss_test_oid_set_member.c \
 	mech/gss_unseal.c \
 	mech/gss_unwrap.c \
@@ -149,8 +165,10 @@ mechsrc = \
 	mech/gss_wrap.c \
 	mech/gss_wrap_size_limit.c \
 	mech/gss_inquire_sec_context_by_oid.c \
+	mech/gssspi_exchange_meta_data.c \
+	mech/gssspi_query_mechanism_info.c \
+	mech/gssspi_query_meta_data.c \
 	mech/mech_switch.h \
-	mech/mechqueue.h \
 	mech/mech_locl.h \
 	mech/name.h \
 	mech/utils.h
@@ -158,11 +176,14 @@ mechsrc = \
 spnegosrc = \
 	spnego/accept_sec_context.c \
 	spnego/compat.c \
+	spnego/context_storage.c \
 	spnego/context_stubs.c \
-	spnego/cred_stubs.c \
 	spnego/external.c \
 	spnego/init_sec_context.c \
+	spnego/negoex_ctx.c \
+	spnego/negoex_util.c \
 	spnego/spnego_locl.h \
+	spnego/negoex_locl.h \
 	$(srcdir)/spnego/spnego-private.h
 
 ntlmsrc = \
@@ -195,20 +216,54 @@ ntlmsrc = \
 	ntlm/process_context_token.c \
 	ntlm/release_cred.c \
 	ntlm/release_name.c \
+	ntlm/set_sec_context_option.c \
 	ntlm/kdc.c
 
 $(srcdir)/ntlm/ntlm-private.h: $(ntlmsrc)
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p ntlm/ntlm-private.h $(ntlmsrc) || rm -f ntlm/ntlm-private.h
 
+sanonsrc = \
+	sanon/accept_sec_context.c \
+	sanon/acquire_cred.c \
+	sanon/add_cred.c \
+	sanon/canonicalize_name.c \
+	sanon/compare_name.c \
+	sanon/context_time.c \
+	sanon/crypto.c \
+	sanon/delete_sec_context.c \
+	sanon/display_name.c \
+	sanon/display_status.c \
+	sanon/duplicate_cred.c \
+	sanon/duplicate_name.c \
+	sanon/export_name.c \
+	sanon/export_cred.c \
+	sanon/export_sec_context.c \
+	sanon/external.c \
+	sanon/import_cred.c \
+	sanon/import_name.c \
+	sanon/import_sec_context.c \
+	sanon/init_sec_context.c \
+	sanon/inquire_context.c \
+	sanon/inquire_cred.c \
+	sanon/inquire_cred_by_mech.c \
+	sanon/inquire_mechs_for_name.c \
+	sanon/inquire_names_for_mech.c \
+	sanon/inquire_sec_context_by_oid.c \
+	sanon/negoex.c \
+	sanon/process_context_token.c \
+	sanon/release_cred.c \
+	sanon/release_name.c \
+	sanon/sanon_locl.h \
+	sanon/sanon-private.h
+
 dist_libgssapi_la_SOURCES  = \
 	$(krb5src) \
 	$(mechsrc) \
 	$(ntlmsrc) \
-	$(spnegosrc)
+	$(spnegosrc) \
+	$(sanonsrc)
 
 nodist_libgssapi_la_SOURCES  = \
-	gkrb5_err.c \
-	gkrb5_err.h \
 	$(BUILT_SOURCES)
 
 libgssapi_la_DEPENDENCIES = version-script.map
@@ -227,13 +282,15 @@ libgssapi_la_LIBADD = \
 	$(LIB_hcrypto) \
 	$(LIBADD_roken)
 
-man_MANS = gssapi.3 gss_acquire_cred.3 mech/mech.5
+man_MANS = gssapi.3 gss_acquire_cred.3 mech/mech.5 gss-token.1
 
 include_HEADERS = gssapi.h
 noinst_HEADERS = \
+	gssapi_asn1.h \
 	gssapi_mech.h \
 	$(srcdir)/ntlm/ntlm-private.h \
 	$(srcdir)/spnego/spnego-private.h \
+	$(srcdir)/sanon/sanon-private.h \
 	$(srcdir)/krb5/gsskrb5-private.h
 
 nobase_include_HEADERS = \
@@ -244,24 +301,27 @@ nobase_include_HEADERS = \
 	gssapi/gssapi_spnego.h
 
 gssapidir = $(includedir)/gssapi
-nodist_gssapi_HEADERS = gkrb5_err.h
+nodist_gssapi_HEADERS = gkrb5_err.h negoex_err.h
 
-gssapi_files = asn1_GSSAPIContextToken.x
+gssapi_files = 					\
+	asn1_GSSAPIContextToken.c
 
 spnego_files =					\
-	asn1_ContextFlags.x			\
-	asn1_MechType.x				\
-	asn1_MechTypeList.x			\
-	asn1_NegotiationToken.x			\
-	asn1_NegotiationTokenWin.x		\
-	asn1_NegHints.x				\
-	asn1_NegTokenInit.x			\
-	asn1_NegTokenInitWin.x			\
-	asn1_NegTokenResp.x
+	asn1_ContextFlags.c			\
+	asn1_MechType.c				\
+	asn1_MechTypeList.c			\
+	asn1_NegHints.c				\
+	asn1_NegStateEnum.c			\
+	asn1_NegTokenInit.c			\
+	asn1_NegTokenInit2.c			\
+	asn1_NegTokenResp.c			\
+	asn1_NegotiationToken.c			\
+	asn1_NegotiationToken2.c
 
 BUILTHEADERS = \
 	$(srcdir)/krb5/gsskrb5-private.h \
 	$(srcdir)/spnego/spnego-private.h \
+	$(srcdir)/sanon/sanon-private.h \
 	$(srcdir)/ntlm/ntlm-private.h
 
 $(libgssapi_la_OBJECTS): $(BUILTHEADERS)
@@ -269,25 +329,43 @@ $(test_context_OBJECTS): $(BUILTHEADERS)
 
 $(libgssapi_la_OBJECTS): $(srcdir)/version-script.map
 
-BUILT_SOURCES = $(spnego_files:.x=.c) $(gssapi_files:.x=.c)
+BUILT_SOURCES = \
+	$(spnego_files) \
+	$(gssapi_files) \
+	gkrb5_err.c \
+	gkrb5_err.h \
+	negoex_err.c \
+	negoex_err.h
 
-$(libgssapi_la_OBJECTS): gkrb5_err.h
+$(libgssapi_la_OBJECTS): gkrb5_err.h negoex_err.h
 gkrb5_err.h: $(srcdir)/krb5/gkrb5_err.et
+negoex_err.h: $(srcdir)/spnego/negoex_err.et
 
 CLEANFILES = $(BUILT_SOURCES) \
-	gkrb5_err.h gkrb5_err.c \
+	gkrb5_err.[ch] negoex_err.[ch] \
 	$(spnego_files) spnego_asn1*.h* spnego_asn1_files spnego_asn1-template.[cx] \
 	$(gssapi_files) gssapi_asn1*.h* gssapi_asn1_files gssapi_asn1-template.[cx] \
-	gss-commands.h gss-commands.c
+	gss-commands.h gss-commands.c \
+	gssapi_asn1.json gssapi_asn1_oids.c gssapi_asn1_syms.c \
+	spnego_asn1.json spnego_asn1_oids.c spnego_asn1_syms.c
 
-$(spnego_files) spnego_asn1.hx spnego_asn1-priv.hx: spnego_asn1_files
-$(gssapi_files) gssapi_asn1.hx gssapi_asn1-priv.hx: gssapi_asn1_files
+$(spnego_files) spnego_asn1.h spnego_asn1-priv.h: spnego_asn1_files
+	for genfile in '$(spnego_files)'; do \
+		$(CLANG_FORMAT) -style=$(CLANG_FORMAT_STYLE) -i $${genfile}; \
+	done
+
+$(gssapi_files) gssapi_asn1.h gssapi_asn1-priv.h: gssapi_asn1_files
+	for genfile in '$(gssapi_files)'; do \
+		$(CLANG_FORMAT) -style=$(CLANG_FORMAT_STYLE) -i $${genfile}; \
+	done
 
 spnego_asn1_files: $(ASN1_COMPILE_DEP) $(srcdir)/spnego/spnego.asn1 $(srcdir)/spnego/spnego.opt
 	$(ASN1_COMPILE) --option-file=$(srcdir)/spnego/spnego.opt $(srcdir)/spnego/spnego.asn1 spnego_asn1
+	@$(CLANG_FORMAT) -style=$(CLANG_FORMAT_STYLE) -i $$(cat spnego_asn1_files)
 
 gssapi_asn1_files: $(ASN1_COMPILE_DEP) $(srcdir)/mech/gssapi.asn1
 	$(ASN1_COMPILE) $(srcdir)/mech/gssapi.asn1 gssapi_asn1
+	@$(CLANG_FORMAT) -style=$(CLANG_FORMAT_STYLE) -i $$(cat gssapi_asn1_files)
 
 $(srcdir)/krb5/gsskrb5-private.h:
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p krb5/gsskrb5-private.h $(krb5src) || rm -f krb5/gsskrb5-private.h
@@ -295,15 +373,17 @@ $(srcdir)/krb5/gsskrb5-private.h:
 $(srcdir)/spnego/spnego-private.h:
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p spnego/spnego-private.h $(spnegosrc) || rm -f spnego/spnego-private.h
 
+$(srcdir)/sanon/sanon-private.h:
+	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p sanon/sanon-private.h $(sanonsrc) || rm -f sanon/sanon-private.h
 
 TESTS = test_oid test_names test_cfx
-# test_sequence 
+# test_sequence
 
 test_cfx_SOURCES = krb5/test_cfx.c
 
 check_PROGRAMS = test_acquire_cred $(TESTS)
 
-bin_PROGRAMS = gsstool
+bin_PROGRAMS = gsstool gss-token
 noinst_PROGRAMS = test_cred test_kcred test_context test_ntlm test_add_store_cred
 
 test_context_SOURCES = test_context.c test_common.c test_common.h
@@ -320,10 +400,14 @@ LDADD = libgssapi.la \
 	$(top_builddir)/lib/krb5/libkrb5.la \
 	$(LIB_roken)
 
+test_names_LDADD = $(LDADD) $(top_builddir)/lib/asn1/libasn1.la
+test_context_LDADD = $(LDADD) $(top_builddir)/lib/asn1/libasn1.la $(top_builddir)/lib/wind/libwind.la
+
 # gss
 
 dist_gsstool_SOURCES = gsstool.c
 nodist_gsstool_SOURCES = gss-commands.c gss-commands.h
+dist_gss_token_SOURCES = gss-token.c
 
 gsstool_LDADD = libgssapi.la \
 	$(top_builddir)/lib/sl/libsl.la \
@@ -331,6 +415,10 @@ gsstool_LDADD = libgssapi.la \
 	$(LIB_readline) \
 	$(LIB_roken)
 
+gss_token_LDADD = libgssapi.la \
+	$(top_builddir)/lib/krb5/libkrb5.la \
+	$(LIB_roken)
+
 gss-commands.c gss-commands.h: gss-commands.in
 	$(SLC) $(srcdir)/gss-commands.in
 
@@ -352,6 +440,8 @@ EXTRA_DIST = \
 	mech/gssapi.asn1 \
 	spnego/spnego.asn1 \
 	spnego/spnego.opt \
+	spnego/negoex_err.et \
+	test_negoex_mech.c \
 	version-script.map \
 	gss-commands.in
 
@@ -362,6 +452,19 @@ $(libgssapi_la_OBJECTS): $(srcdir)/gssapi/gssapi_oid.h
 gkrb5_err.h gkrb5_err.c: $(srcdir)/krb5/gkrb5_err.et
 	$(COMPILE_ET) $(srcdir)/krb5/gkrb5_err.et
 
+negoex_err.h negoex_err.c: $(srcdir)/spnego/negoex_err.et
+	$(COMPILE_ET) $(srcdir)/spnego/negoex_err.et
+
 $(srcdir)/gssapi/gssapi_oid.h $(srcdir)/mech/gss_oid.c:
 	perl $(srcdir)/gen-oid.pl -b base -h $(srcdir)/oid.txt > $(srcdir)/gssapi/gssapi_oid.h
 	perl $(srcdir)/gen-oid.pl -b base $(srcdir)/oid.txt > $(srcdir)/mech/gss_oid.c
+
+#
+# NegoEx test mechanism, uses decode_GSSAPIContextToken
+#
+
+test_negoex_mech_la_SOURCES = test_negoex_mech.c $(gssapi_files)
+test_negoex_mech_la_LDFLAGS = -module
+test_negoex_mech_la_LIBADD = \
+	$(top_builddir)/lib/asn1/libasn1.la \
+	libgssapi.la