Projects/Interposer Mechanism - Revision history

Ghudson: /* Interposer initialization */

2012-10-24T22:20:02Z

‎Interposer initialization

Ghudson at 16:42, 19 October 2012

2012-10-19T16:42:43Z

Ghudson at 16:13, 3 October 2012

2012-10-03T16:13:51Z

Ghudson at 16:12, 3 October 2012

2012-10-03T16:12:21Z

Show changes

Simo: /* Requirements */

2012-10-02T21:30:10Z

‎Requirements

Simo: /* Design */

2012-10-02T21:28:59Z

‎Design

Simo: /* Design */

2012-10-02T21:28:13Z

‎Design

Simo: /* Design */

2012-10-02T21:24:47Z

‎Design

Simo: Projects/Interposer Mehcanism moved to Projects/Interposer Mechanism

2012-10-02T21:12:41Z

Projects/Interposer Mehcanism moved to Projects/Interposer Mechanism

Simo at 21:12, 2 October 2012

2012-10-02T21:12:16Z

@@ Line 43: / Line 43: @@
 === gss_mech_interposer() ===
-This function is defined by an interposer module, and is used during module initialization.  It takes no arguments, and returns a gss_OID_set giving the list of mechanisms to interpose.  The list is freed with the mechglue's gss_release_oid_set, so should be created with the mechglue's gss_create_empty_oid_set and gss_add_oid_set_member functions.
+This function is defined by an interposer module, and is used during module initialization.  It takes one argument, which is the OID of the interposer mechanism as specified in /etc/gss/mech, and returns a gss_OID_set giving the list of mechanisms to interpose.  The list is freed with the mechglue's gss_release_oid_set, so should be created with the mechglue's gss_create_empty_oid_set and gss_add_oid_set_member functions.
 == New mechanism functions ==

← Older revision		Revision as of 16:42, 19 October 2012
Line 1:		Line 1:
−	{{project-~~target~~\|1.11}}	+	{{project-rel\|1.11}}
−	{{project-review\|2012-10-06}}

	This project is about creating a means to intercept GSSAPI operations at the mechglue layer, so that any mechanism can be proxied to a separate application.		This project is about creating a means to intercept GSSAPI operations at the mechglue layer, so that any mechanism can be proxied to a separate application.

← Older revision		Revision as of 16:13, 3 October 2012
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-target\|1.11}}
		+	{{project-review\|2012-10-06}}

	This project is about creating a means to intercept GSSAPI operations at the mechglue layer, so that any mechanism can be proxied to a separate application.		This project is about creating a means to intercept GSSAPI operations at the mechglue layer, so that any mechanism can be proxied to a separate application.

@@ Line 13: / Line 13: @@
 = Requirements =
-The Interposer mechanism must be able to intercept any mechanism function.
+* Interposer plugins must be able to intercept any mechanism function.
-The Interposer mechanism must also be able to call back into the mechglue in order to execute code using the original mechanism.
+* Interposer plugins must also be able to call back into the mechglue in order to execute code using the original mechanism.
-The interposer mechanism should be completely transparent to applications, in that pure gssapi application should not need any modification in order to work with the interposer mechanism nor need to issue any special call to use the interposer functionality.
+* Interposer mechanisms should be completely transparent to applications. A pure gssapi application should not need any modification in order to work with the interposer mechanism nor need to issue any special call to use the interposer functionality.
 = Design =

@@ Line 19: / Line 19: @@
 = Design =
-In order to allow interposer plugins to re-enter the mechglue we had to change their function signature so that the SPI does not match the GSs API function signatures, as interposer plugins are allowed to call back into GSSAPI.
+In order to allow interposer plugins to re-enter the mechglue we had to change their function signature so that the SPI does not match the GSSAPI function signatures, as interposer plugins are allowed to call back into GSSAPI.
-The interposer plugins SPI uses the gssi_ prefix (GSS Interposer) for all the mechglue functions it implements.
+The interposer plugin SPI uses the gssi_ prefix (GSS Interposer) for all the mechglue functions it implements.
 The interposer plugins are specified in the gss.conf file with a new option

@@ Line 23: / Line 23: @@
 The interposer plugins are specified in the gss.conf file with a new option
-that identifies them as such. They also exposes an interposer plugin specific
+that identifies them as such. An interposer plugin specific
-initialization function that is used by the mechglue to initialized the plugin
+initialization function is used by the mechglue to initialize the plugin and retrieve the list of mechanism the interposer plugin wants to interpose.
-functions that accept mechanism oids as input. The mechglue makes sure these oids
+These special oids are passed as input to gssapi functions that accept mechanism oids in input instad of the original mechanism oid.
-are never leaked to applications, by providing a mapping back to normal public
-oids whenever they are passed to mechanisms or returned to applications.
+The mechglue makes sure these oids are never leaked to applications, by providing a mapping back to normal public oids before they are returned to applications.
 = Limitations =

@@ Line 27: / Line 27: @@
 and also to retieve the list of mechanism the plugin wnats to interpose.
-In order to allow the interposer plugin to re-enter the mechglue avoiding loops
+In order to allow the interposer plugin to re-enter the mechglue avoiding loops,
-interposer plugins create special invalid mech oids to pass as inputs to gssapi
+interposer plugins create special mech oids by concatenating the interposer mechanism and the original interposed mechanism oid and pass it as input to gssapi
-functions that accept mech oids in input. The mechglue makes sure these oids
+functions that accept mechanism oids as input. The mechglue makes sure these oids
 are never leaked to applications, by providing a mapping back to normal public
 oids whenever they are passed to mechanisms or returned to applications.

← Older revision	Revision as of 21:12, 2 October 2012
(No difference)

@@ Line 24: / Line 24: @@
 The interposer plugins are specified in the gss.conf file with a new option
 that identifies them as such. They also exposes an interposer plugin specific
-initialization function that is used by the mechglue to initialized the plguin
+initialization function that is used by the mechglue to initialized the plugin
 and also to retieve the list of mechanism the plugin wnats to interpose.
@@ Line 94: / Line 94: @@
 plugins. In particular the original functions did not pass to the interposer
 plugin the oid of the mechanism these functions are supposed to act on. This is
-a problem for interposer plugins that can intercept mutiple mechanisms as they
+a problem for an interposer plugin that can intercept multiple mechanisms as it
-have no way to understand on which mechanism they are suppoed to act on behalf
+has no way to understand which mechanism it is supposed to interpose on a specific request.
-of of the multiple ons that are being interposed.
+By passing in the public mechanism oid the mechglue
-By passing in the public mech oid of the interposed mechanism the mechglue
+intended to use interposer plugins can properly handle the request.
 === gssspi_import_sec_context_by_mech() ===
@@ Line 120: / Line 120: @@
 GSSAPI to handle interposition this structure has now 3 new members:
 * is_interposer
-a boolean flag that is used to mark a mechanism as an interposer mechanism and not a real mchanism
+a boolean flag that is used to mark a mechanism as an interposer mechanism and not a real mechanism
 * ine_mech_type
 the oid of the interposer mechanism, it is set on real mechanisms