gsasl-1.8.0/ 0000775 0000000 0000000 00000000000 11760732127 007610 5 0000000 0000000 gsasl-1.8.0/doc/ 0000775 0000000 0000000 00000000000 11760732127 010355 5 0000000 0000000 gsasl-1.8.0/doc/gsasl-callback-password.texi 0000664 0000000 0000000 00000001446 11746471770 015710 0000000 0000000 @deftypefn Prototype int (*Gsasl_client_callback_password) (Gsasl_session_ctx * @var{ctx}, char * @var{out}, size_t * @var{outlen})
@var{ctx}: libgsasl handle.
@var{out}: output array with password.
@var{outlen}: on input the maximum size of the output array, on output
contains the actual size of the output array.
Type of callback function the application implements. It should
populate the output array with password of user and set the output
array length, and return @code{GSASL_OK}, or fail with an error
code. The password must be encoded in UTF-8, but need not be
normalized in any way.
If OUT is NULL, the function should only populate the output length
field with the length, and return GSASL_OK. This usage may be used by
the caller to allocate the proper buffer size.
@end deftypefn
gsasl-1.8.0/doc/gsasl-api-error-labels.texi 0000664 0000000 0000000 00000016774 11760731232 015452 0000000 0000000 @c This file is automatically generated. DO NOT EDIT!
@c Instead, edit print-errors.c and re-run.
@item @code{GSASL_OK}
Libgsasl success
@item @code{GSASL_NEEDS_MORE}
SASL mechanism needs more data
@item @code{GSASL_UNKNOWN_MECHANISM}
Unknown SASL mechanism
@item @code{GSASL_MECHANISM_CALLED_TOO_MANY_TIMES}
SASL mechanism called too many times
@item @code{GSASL_TOO_SMALL_BUFFER}
SASL function needs larger buffer (internal error)
@item @code{GSASL_FOPEN_ERROR}
Could not open file in SASL library
@item @code{GSASL_FCLOSE_ERROR}
Could not close file in SASL library
@item @code{GSASL_MALLOC_ERROR}
Memory allocation error in SASL library
@item @code{GSASL_BASE64_ERROR}
Base 64 coding error in SASL library
@item @code{GSASL_CRYPTO_ERROR}
Low-level crypto error in SASL library
@item @code{GSASL_NEED_CLIENT_ANONYMOUS_CALLBACK}
SASL mechanism needs gsasl_client_callback_anonymous() callback (application error)
@item @code{GSASL_NEED_CLIENT_PASSWORD_CALLBACK}
SASL mechanism needs gsasl_client_callback_password() callback (application error)
@item @code{GSASL_NEED_CLIENT_PASSCODE_CALLBACK}
SASL mechanism needs gsasl_client_callback_passcode() callback (application error)
@item @code{GSASL_NEED_CLIENT_PIN_CALLBACK}
SASL mechanism needs gsasl_client_callback_pin() callback (application error)
@item @code{GSASL_NEED_CLIENT_AUTHORIZATION_ID_CALLBACK}
SASL mechanism needs gsasl_client_callback_authorization_id() callback (application error)
@item @code{GSASL_NEED_CLIENT_AUTHENTICATION_ID_CALLBACK}
SASL mechanism needs gsasl_client_callback_authentication_id() callback (application error)
@item @code{GSASL_NEED_CLIENT_SERVICE_CALLBACK}
SASL mechanism needs gsasl_client_callback_service() callback (application error)
@item @code{GSASL_NEED_SERVER_VALIDATE_CALLBACK}
SASL mechanism needs gsasl_server_callback_validate() callback (application error)
@item @code{GSASL_NEED_SERVER_CRAM_MD5_CALLBACK}
SASL mechanism needs gsasl_server_callback_cram_md5() callback (application error)
@item @code{GSASL_NEED_SERVER_DIGEST_MD5_CALLBACK}
SASL mechanism needs gsasl_server_callback_digest_md5() callback (application error)
@item @code{GSASL_NEED_SERVER_EXTERNAL_CALLBACK}
SASL mechanism needs gsasl_server_callback_external() callback (application error)
@item @code{GSASL_NEED_SERVER_ANONYMOUS_CALLBACK}
SASL mechanism needs gsasl_server_callback_anonymous() callback (application error)
@item @code{GSASL_NEED_SERVER_REALM_CALLBACK}
SASL mechanism needs gsasl_server_callback_realm() callback (application error)
@item @code{GSASL_NEED_SERVER_SECURID_CALLBACK}
SASL mechanism needs gsasl_server_callback_securid() callback (application error)
@item @code{GSASL_NEED_SERVER_SERVICE_CALLBACK}
SASL mechanism needs gsasl_server_callback_service() callback (application error)
@item @code{GSASL_NEED_SERVER_GSSAPI_CALLBACK}
SASL mechanism needs gsasl_server_callback_gssapi() callback (application error)
@item @code{GSASL_NEED_SERVER_RETRIEVE_CALLBACK}
SASL mechanism needs gsasl_server_callback_retrieve() callback (application error)
@item @code{GSASL_UNICODE_NORMALIZATION_ERROR}
Failed to perform Unicode Normalization on string.
@item @code{GSASL_SASLPREP_ERROR}
Could not prepare internationalized (non-ASCII) string.
@item @code{GSASL_MECHANISM_PARSE_ERROR}
SASL mechanism could not parse input
@item @code{GSASL_AUTHENTICATION_ERROR}
Error authenticating user
@item @code{GSASL_CANNOT_GET_CTX}
Cannot get internal library handle (library error)
@item @code{GSASL_INTEGRITY_ERROR}
Integrity error in application payload
@item @code{GSASL_NO_MORE_REALMS}
No more realms available (non-fatal)
@item @code{GSASL_NO_CLIENT_CODE}
Client-side functionality not available in library (application error)
@item @code{GSASL_NO_SERVER_CODE}
Server-side functionality not available in library (application error)
@item @code{GSASL_GSSAPI_RELEASE_BUFFER_ERROR}
GSSAPI library could not deallocate memory in gss_release_buffer() in SASL library. This is a serious internal error.
@item @code{GSASL_GSSAPI_IMPORT_NAME_ERROR}
GSSAPI library could not understand a peer name in gss_import_name() in SASL library. This is most likely due to incorrect service and/or hostnames.
@item @code{GSASL_GSSAPI_INIT_SEC_CONTEXT_ERROR}
GSSAPI error in client while negotiating security context in gss_init_sec_context() in SASL library. This is most likely due insufficient credentials or malicious interactions.
@item @code{GSASL_GSSAPI_ACCEPT_SEC_CONTEXT_ERROR}
GSSAPI error in server while negotiating security context in gss_accept_sec_context() in SASL library. This is most likely due insufficient credentials or malicious interactions.
@item @code{GSASL_GSSAPI_UNWRAP_ERROR}
GSSAPI error while decrypting or decoding data in gss_unwrap() in SASL library. This is most likely due to data corruption.
@item @code{GSASL_GSSAPI_WRAP_ERROR}
GSSAPI error while encrypting or encoding data in gss_wrap() in SASL library.
@item @code{GSASL_GSSAPI_ACQUIRE_CRED_ERROR}
GSSAPI error acquiring credentials in gss_acquire_cred() in SASL library. This is most likely due to not having the proper Kerberos key available in /etc/krb5.keytab on the server.
@item @code{GSASL_GSSAPI_DISPLAY_NAME_ERROR}
GSSAPI error creating a display name denoting the client in gss_display_name() in SASL library. This is probably because the client supplied bad data.
@item @code{GSASL_GSSAPI_UNSUPPORTED_PROTECTION_ERROR}
Other entity requested integrity or confidentiality protection in GSSAPI mechanism but this is currently not implemented.
@item @code{GSASL_KERBEROS_V5_INIT_ERROR}
Kerberos V5 initialization failure.
@item @code{GSASL_KERBEROS_V5_INTERNAL_ERROR}
Kerberos V5 internal error.
@item @code{GSASL_SECURID_SERVER_NEED_ADDITIONAL_PASSCODE}
SecurID needs additional passcode.
@item @code{GSASL_SECURID_SERVER_NEED_NEW_PIN}
SecurID needs new pin.
@item @code{GSASL_INVALID_HANDLE}
The provided library handle was invalid (application error)
@item @code{GSASL_NO_CALLBACK}
No callback specified by caller (application error).
@item @code{GSASL_NO_ANONYMOUS_TOKEN}
Authentication failed because the anonymous token was not provided.
@item @code{GSASL_NO_AUTHID}
Authentication failed because the authentication identity was not provided.
@item @code{GSASL_NO_AUTHZID}
Authentication failed because the authorization identity was not provided.
@item @code{GSASL_NO_PASSWORD}
Authentication failed because the password was not provided.
@item @code{GSASL_NO_PASSCODE}
Authentication failed because the passcode was not provided.
@item @code{GSASL_NO_PIN}
Authentication failed because the pin code was not provided.
@item @code{GSASL_NO_SERVICE}
Authentication failed because the service name was not provided.
@item @code{GSASL_NO_HOSTNAME}
Authentication failed because the host name was not provided.
@item @code{GSASL_GSSAPI_ENCAPSULATE_TOKEN_ERROR}
GSSAPI error encapsulating token.
@item @code{GSASL_GSSAPI_DECAPSULATE_TOKEN_ERROR}
GSSAPI error decapsulating token.
@item @code{GSASL_GSSAPI_INQUIRE_MECH_FOR_SASLNAME_ERROR}
GSSAPI error getting OID for SASL mechanism name.
@item @code{GSASL_GSSAPI_TEST_OID_SET_MEMBER_ERROR}
GSSAPI error testing for OID in OID set.
@item @code{GSASL_GSSAPI_RELEASE_OID_SET_ERROR}
GSSAPI error releasing OID set.
@item @code{GSASL_NO_CB_TLS_UNIQUE}
Authentication failed because a tls-unique CB was not provided.
@item @code{GSASL_NO_SAML20_IDP_IDENTIFIER}
Callback failed to provide SAML20 IdP identifier.
@item @code{GSASL_NO_SAML20_REDIRECT_URL}
Callback failed to provide SAML20 redirect URL.
@item @code{GSASL_NO_OPENID20_REDIRECT_URL}
Callback failed to provide OPENID20 redirect URL.
gsasl-1.8.0/doc/gsasl-callback-gssapi.texi 0000664 0000000 0000000 00000002155 11746471770 015332 0000000 0000000 @deftypefn Prototype int (*Gsasl_server_callback_gssapi) (Gsasl_session_ctx * @var{ctx}, char * @var{clientname}, char * @var{authentication_id})
@var{ctx}: libgsasl handle.
@var{clientname}: input array with GSSAPI client name.
@var{authentication_id}: input array with authentication identity.
Type of callback function the application implements. It should
return GSASL_OK if and only if the GSSAPI user is authorized to log on
as the given authentication_id. GSASL_AUTHENTICATION_ERROR is a good
failure if authentication failed, but any available return code may be
used. This callback is usually implemented in the application as a
call to krb5_kuserok(), such as:
@example
int
callback_gssapi (Gsasl_session_ctx *ctx,
char *clientname,
char *authentication_id)
@{
int rc = GSASL_AUTHENTICATION_ERROR;
krb5_principal p;
krb5_context kcontext;
krb5_init_context (&kcontext);
if (krb5_parse_name (kcontext, clientname, &p) != 0)
return -1;
if (krb5_kuserok (kcontext, p, authentication_id))
rc = GSASL_OK;
krb5_free_principal (kcontext, p);
return rc;
@}
@end example
@end deftypefn
gsasl-1.8.0/doc/gsasl.1 0000664 0000000 0000000 00000012413 11760731232 011465 0000000 0000000 .\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.40.4.
.TH GSASL "1" "May 2012" "gsasl 1.8.0" "User Commands"
.SH NAME
gsasl \- SASL library command line interface
.SH SYNOPSIS
.B gsasl
[\fIOPTIONS\fR]... [\fIHOST \fR[\fIPORT\fR]]...
.SH DESCRIPTION
GNU SASL 1.8.0
.PP
Authenticate user to a server using Simple Authentication and
Security Layer. Currently IMAP and SMTP servers are supported. This
is a command line interface for the GNU SASL library.
.TP
\fB\-h\fR, \fB\-\-help\fR
Print help and exit
.TP
\fB\-V\fR, \fB\-\-version\fR
Print version and exit
.SS "Commands:"
.TP
\fB\-c\fR, \fB\-\-client\fR
Act as client. (default=on)
.TP
\fB\-s\fR, \fB\-\-server\fR
Act as server. (default=off)
.TP
\fB\-\-client\-mechanisms\fR
Write name of supported client mechanisms
separated by space to stdout. (default=off)
.TP
\fB\-\-server\-mechanisms\fR
Write name of supported server mechanisms
separated by space to stdout. (default=off)
.SS "Network options:"
.TP
\fB\-\-connect\fR=\fIHOST[\fR:PORT]
Connect to TCP server and negotiate on stream
instead of stdin/stdout. PORT is the protocol
service, or an integer denoting the port, and
defaults to 143 (imap) if not specified. Also
sets the \fB\-\-hostname\fR default.
.SS "Generic options:"
.TP
\fB\-d\fR, \fB\-\-application\-data\fR
After authentication, read data from stdin and
run it through the mechanism's security layer
and print it base64 encoded to stdout. The
default is to terminate after authentication.
.IP
(default=on)
.TP
\fB\-\-imap\fR
Use a IMAP\-like logon procedure (client only).
Also sets the \fB\-\-service\fR default to 'imap'.
(default=off)
.TP
\fB\-\-smtp\fR
Use a SMTP\-like logon procedure (client only).
Also sets the \fB\-\-service\fR default to 'smtp'.
(default=off)
.TP
\fB\-m\fR, \fB\-\-mechanism\fR=\fISTRING\fR
Mechanism to use.
.TP
\fB\-\-no\-client\-first\fR
Disallow client to send data first (client
only). (default=off)
.SS "SASL mechanism options (they are prompted for when required):"
.TP
\fB\-n\fR, \fB\-\-anonymous\-token\fR=\fISTRING\fR
Token for anonymous authentication, usually
mail address (ANONYMOUS only).
.TP
\fB\-a\fR, \fB\-\-authentication\-id\fR=\fISTRING\fR
Identity of credential owner.
.HP
\fB\-z\fR, \fB\-\-authorization\-id\fR=\fISTRING\fR Identity to request service for.
.TP
\fB\-p\fR, \fB\-\-password\fR=\fISTRING\fR
Password for authentication (insecure for
non\-testing purposes).
.TP
\fB\-r\fR, \fB\-\-realm\fR=\fISTRING\fR
Realm. Defaults to hostname.
.TP
\fB\-x\fR, \fB\-\-maxbuf\fR=\fINUMBER\fR
Indicate maximum buffer size (DIGEST\-MD5 only).
.TP
\fB\-\-passcode\fR=\fINUMBER\fR
Passcode for authentication (SECURID only).
.TP
\fB\-\-service\fR=\fISTRING\fR
Set the requested service name (should be a
registered GSSAPI host based service name).
.TP
\fB\-\-hostname\fR=\fISTRING\fR
Set the name of the server with the requested
service.
.TP
\fB\-\-service\-name\fR=\fISTRING\fR
Set the generic server name in case of a
replicated server (DIGEST\-MD5 only).
.TP
\fB\-\-enable\-cram\-md5\-validate\fR
Validate CRAM\-MD5 challenge and response
.TP
interactively.
(default=off)
.TP
\fB\-\-disable\-cleartext\-validate\fR
Disable cleartext validate hook, forcing server
.TP
to prompt for password.
(default=off)
.TP
\fB\-\-quality\-of\-protection\fR=\fITYPE\fR
How application payload will be protected.
.IP
\&'qop\-auth' means no protection, 'qop\-int'
means integrity protection, 'qop\-conf' means
integrity and confidentialiy protection.
Currently only used by DIGEST\-MD5, where the
default is 'qop\-int'.
.SS "STARTTLS options:"
.TP
\fB\-\-starttls\fR
Force use of STARTTLS. The default is to use
STARTTLS when available. (default=off)
.TP
\fB\-\-no\-starttls\fR
Unconditionally disable STARTTLS.
(default=off)
.TP
\fB\-\-no\-cb\fR
Don't use channel bindings from TLS.
(default=off)
.TP
\fB\-\-x509\-ca\-file\fR=\fIFILE\fR
File containing one or more X.509 Certificate
Authorities certificates in PEM format, used
to verify the certificate received from the
server. If not specified, no verification of
the remote server certificate will be done.
.TP
\fB\-\-x509\-cert\-file\fR=\fIFILE\fR
File containing client X.509 certificate in PEM
format. Used together with \fB\-\-x509\-key\-file\fR
to specify the certificate/key pair.
.TP
\fB\-\-x509\-key\-file\fR=\fIFILE\fR
Private key for the client X.509 certificate in
PEM format. Used together with
\fB\-\-x509\-key\-file\fR to specify the
certificate/key pair.
.TP
\fB\-\-priority\fR=\fISTRING\fR
Cipher priority string.
.SS "Other options:"
.TP
\fB\-\-verbose\fR
Produce verbose output. (default=off)
.TP
\fB\-\-quiet\fR
Don't produce any diagnostic output.
(default=off)
.SH AUTHOR
Written by Simon Josefsson.
.SH "REPORTING BUGS"
Report bugs to: bug\-gsasl@gnu.org
.br
GNU SASL home page:
.br
General help using GNU software:
.SH COPYRIGHT
Copyright \(co 2012 Simon Josefsson.
License GPLv3+: GNU GPL version 3 or later .
.br
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
.SH "SEE ALSO"
The full documentation for
.B gsasl
is maintained as a Texinfo manual. If the
.B info
and
.B gsasl
programs are properly installed at your site, the command
.IP
.B info gsasl
.PP
should give you access to the complete manual.
gsasl-1.8.0/doc/controlflow.png 0000664 0000000 0000000 00000053330 11746471770 013367 0000000 0000000 PNG
IHDR ! w sBITO pHYs e IDATxw\ ;(" 4DAybb㰜bW8O.b+D@RSco. |lfg
0;3Ka$X+W?{"##C"M HNMMnǎ:tFXwpBJJ
F1///MMM------}}
A
_~MLL$EQ]v2dȴi\s,s۷'&&b۵kdmmMQT ?xڵkqqq/^@L