Use SPNEGO mechanism with GSSAPI on Posix

net/http/http_auth_gssapi_posix.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_gssapi_posix.h"
 
 #include <limits>
 #include <string>
 
 #include "base/base64.h"
 #include "base/file_path.h"
 #include "base/format_macros.h"
 #include "base/logging.h"
 #include "base/string_util.h"
 #include "base/stringprintf.h"
 #include "base/threading/thread_restrictions.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 
 // These are defined for the GSSAPI library:
 // Paraphrasing the comments from gssapi.h:
 // "The implementation must reserve static storage for a
 // gss_OID_desc object for each constant.  That constant
 // should be initialized to point to that gss_OID_desc."
+// These are encoded using ASN.1 BER encoding.
 namespace {
 
 static gss_OID_desc GSS_C_NT_USER_NAME_VAL = {
   10,
   const_cast<char*>("\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x01")
 };
 static gss_OID_desc GSS_C_NT_MACHINE_UID_NAME_VAL = {
   10,
   const_cast<char*>("\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x02")
 };
@@ skipping 33 matching lines @@
 gss_OID GSS_C_NT_USER_NAME = &GSS_C_NT_USER_NAME_VAL;
 gss_OID GSS_C_NT_MACHINE_UID_NAME = &GSS_C_NT_MACHINE_UID_NAME_VAL;
 gss_OID GSS_C_NT_STRING_UID_NAME = &GSS_C_NT_STRING_UID_NAME_VAL;
 gss_OID GSS_C_NT_HOSTBASED_SERVICE_X = &GSS_C_NT_HOSTBASED_SERVICE_X_VAL;
 gss_OID GSS_C_NT_HOSTBASED_SERVICE = &GSS_C_NT_HOSTBASED_SERVICE_VAL;
 gss_OID GSS_C_NT_ANONYMOUS = &GSS_C_NT_ANONYMOUS_VAL;
 gss_OID GSS_C_NT_EXPORT_NAME = &GSS_C_NT_EXPORT_NAME_VAL;
 
 namespace net {
 
-// These are encoded using ASN.1 BER encoding.
+// Exported mechanism for GSSAPI. We always use SPNEGO:
 
-// This one is used by Firefox's nsAuthGSSAPI class.
-gss_OID_desc CHROME_GSS_KRB5_MECH_OID_DESC_VAL = {
-  9,
-  const_cast<char*>("\x2a\x86\x48\x86\xf7\x12\x01\x02\x02")
+// iso.org.dod.internet.security.mechanism.snego (1.3.6.1.5.5.2)
+gss_OID_desc CHROME_GSS_SPNEGO_MECH_OID_DESC_VAL = {
+  6,
+  const_cast<char*>("\x2b\x06\x01\x05\x05\x02")
 };
 
-gss_OID_desc CHROME_GSS_C_NT_HOSTBASED_SERVICE_X_VAL = {
-  6,
-  const_cast<char*>("\x2b\x06\x01\x05\x06\x02")
-};
-
-gss_OID_desc CHROME_GSS_C_NT_HOSTBASED_SERVICE_VAL = {
-  10,
-  const_cast<char*>("\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x04")
-};
-
-gss_OID CHROME_GSS_C_NT_HOSTBASED_SERVICE_X =
-    &CHROME_GSS_C_NT_HOSTBASED_SERVICE_X_VAL;
-gss_OID CHROME_GSS_C_NT_HOSTBASED_SERVICE =
-    &CHROME_GSS_C_NT_HOSTBASED_SERVICE_VAL;
-gss_OID CHROME_GSS_KRB5_MECH_OID_DESC =
-    &CHROME_GSS_KRB5_MECH_OID_DESC_VAL;
+gss_OID CHROME_GSS_SPNEGO_MECH_OID_DESC =
+    &CHROME_GSS_SPNEGO_MECH_OID_DESC_VAL;
 
 // Debugging helpers.
 namespace {
 
 std::string DisplayStatus(OM_uint32 major_status,
                           OM_uint32 minor_status) {
   if (major_status == GSS_S_COMPLETE)
     return "OK";
   return base::StringPrintf("0x%08X 0x%08X", major_status, minor_status);
 }
@@ skipping 745 matching lines @@
   // TODO(cbentzel): Just do this on the first pass?
   std::string spn_principal = WideToASCII(spn);
   gss_buffer_desc spn_buffer = GSS_C_EMPTY_BUFFER;
   spn_buffer.value = const_cast<char*>(spn_principal.c_str());
   spn_buffer.length = spn_principal.size() + 1;
   OM_uint32 minor_status = 0;
   gss_name_t principal_name = GSS_C_NO_NAME;
   OM_uint32 major_status = library_->import_name(
       &minor_status,
       &spn_buffer,
-      CHROME_GSS_C_NT_HOSTBASED_SERVICE,
+      GSS_C_NT_HOSTBASED_SERVICE,
       &principal_name);
   int rv = MapImportNameStatusToError(major_status);
   if (rv != OK) {
     LOG(ERROR) << "Problem importing name from "
                << "spn \"" << spn_principal << "\"\n"
                << DisplayExtendedStatus(library_, major_status, minor_status);
     return rv;
   }
   ScopedName scoped_name(principal_name, library_);
 
@@ skipping 19 matching lines @@
   if (rv != OK) {
     LOG(ERROR) << "Problem initializing context. \n"
                << DisplayExtendedStatus(library_, major_status, minor_status)
                << '\n'
                << DescribeContext(library_, scoped_sec_context_.get());
   }
   return rv;
 }
 
 }  // namespace net