GNU Simple Authentication and Security Layer 1.8.1

const char *

Appendices

Indices

250-mail.example.com Hello pc.example.org [192.168.1.42], pleased to meet you
250-AUTH DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
250 HELP
AUTH CRAM-MD5
334 PDk5MDgwNDEzMDUwNTUyMTE1NDQ5LjBAbG9jYWxob3N0Pg==
amFzIDBkZDRkODZkMDVjNjI4ODRkYzc3OTcwODE4ZGI5MGY3
235 2.0.0 OK Authenticated

Simon Josefsson Datakonsult AB
Hagagatan 24
113 47 Stockholm
Sweden

E-mail: simon@josefsson.org

$ wget -q ftp://ftp.gnu.org/gnu/gsasl/gsasl-1.8.1.tar.gz
$ tar xfz gsasl-1.8.1.tar.gz
$ cd gsasl-1.8.1/
$ ./configure
...
$ make
...
$ make install
...

$ mkdir ~/kfw
$ cd ~/kfw
$ wget -q http://web.mit.edu/kerberos/dist/kfw/3.2/kfw-3.2.2/kfw-3-2-2-sdk.zip
$ unzip kfw-3-2-2-sdk.zip

perl -pi -e 's,sys\\,sys/,' ~/kfw/kfw-3-2-2-final/inc/krb5/win-mac.h

$ wget -q ftp://alpha.gnu.org/gnu/gsasl/gsasl-1.8.1.tar.gz
$ tar xfz gsasl-1.8.1.tar.gz
$ cd gsasl-1.8.1

$ lt_cv_deplibs_check_method=pass_all ./configure --host=i586-mingw32msvc --build=i686-pc-linux-gnu --with-gssapi-impl=kfw LDFLAGS="-L$HOME/kfw/kfw-3-2-2-final/lib/i386" CPPFLAGS="-I$HOME/kfw/kfw-3-2-2-final/inc/krb5 -DSSIZE_T_DEFINED"

$ make

$ make check

err:module:import_dll Library gssapi32.dll (which is needed by L"Z:\\home\\jas\\src\\gsasl-1.5.2\\lib\\src\\.libs\\libgsasl-7.dll") not found

lib/src/.libs/libgsasl-7.dll
src/.libs/gsasl.exe

gsasl.exe -d interop.josefsson.org

#include <gsasl.h>

int
main (int argc, char *argv[])
{
  Gsasl *ctx = NULL;
  int rc;
...
  rc = gsasl_init (&ctx);
  if (rc != GSASL_OK)
    {
      printf ("SASL initialization failure (%d): %s\n",
              rc, gsasl_strerror (rc));
      return 1;
    }
...

int
main (int argc, char *argv[])
{
  Gsasl *ctx = NULL;
  int rc;
...
  setlocale (LC_ALL, "");
...
  rc = gsasl_init (&ctx);
  if (rc != GSASL_OK)
    {
      printf (gettext ("SASL initialization failure (%d): %s\n"),
              rc, gsasl_strerror (rc));
      return 1;
    }
...

#include <gcrypt.h>
...
int
main (int argc, char *argv[])
{
  Gsasl *ctx = NULL;
  int rc;
...
  /* Check version of libgcrypt. */
  if (!gcry_check_version (GCRYPT_VERSION))
    die ("version mismatch\n");

  /* Allocate a pool of 16k secure memory.  This also drops priviliges
     on some systems. */
  gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);

  /* Tell Libgcrypt that initialization has completed. */
  gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
...
  rc = gsasl_init (&ctx);
  if (rc != GSASL_OK)
    {
      printf ("SASL initialization failure (%d): %s\n",
              rc, gsasl_strerror (rc));
      return 1;
    }
...

  if (!gsasl_check_version (GSASL_VERSION))
    {
      printf ("gsasl_check_version failed:\n"
              "Header file incompatible with shared library.\n");
      exit(1);
    }

gcc -c foo.c `pkg-config libgsasl --cflags`

gcc -o foo foo.o `pkg-config libgsasl --libs`

gcc -o foo foo.c `pkg-config libgsasl --cflags --libs`

AC_ARG_ENABLE(gsasl,
  AC_HELP_STRING([--disable-gsasl], [don't use GNU SASL]),
  gsasl=$enableval)
if test "$gsasl" != "no" ; then
  PKG_CHECK_MODULES(GSASL, libgsasl >= 1.8.1,
    [gsasl=yes],
    [gsasl=no])
  if test "$gsasl" != "yes" ; then
    gsasl=no
    AC_MSG_WARN([Cannot find GNU SASL, disabling])
  else
    gsasl=yes
    AC_DEFINE(USE_GSASL, 1, [Define to 1 if you want GNU SASL.])
  fi
fi
AC_MSG_CHECKING([if GNU SASL should be used])
AC_MSG_RESULT($gsasl)

AC_CHECK_HEADER(gsasl.h,
  AC_CHECK_LIB(gsasl, gsasl_check_version,
    [gsasl=yes AC_SUBST(GSASL_LIBS, -lgsasl)],
    gsasl=no),
  gsasl=no)
AC_ARG_ENABLE(gsasl,
  AC_HELP_STRING([--disable-gsasl], [don't use GNU SASL]),
  gsasl=$enableval)
if test "$gsasl" != "no" ; then
  AC_DEFINE(USE_SASL, 1, [Define to 1 if you want GNU SASL.])
else
  AC_MSG_WARN([Cannot find GNU SASL, diabling])
fi
AC_MSG_CHECKING([if GNU SASL should be used])
AC_MSG_RESULT($gsasl)

int main (int argc, char *argv[])
{
  Gsasl *ctx = NULL;
  int rc;

  if ((rc = gsasl_init (&ctx)) != GSASL_OK)
    {
      printf ("Cannot initialize libgsasl (%d): %s",
              rc, gsasl_strerror (rc));
      return 1;
    }

  client (ctx);

  gsasl_done (ctx);

  return 0;
}

void client (Gsasl *ctx)
{
  Gsasl_session *session;
  const char *mech = "PLAIN";
  int rc;

  /* Create new authentication session. */
  if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
    {
      printf ("Cannot initialize client (%d): %s\n",
              rc, gsasl_strerror (rc));
      return;
    }

  /* Set username and password in session handle.  This info will be
     lost when this session is deallocated below.  */
  gsasl_property_set (session, GSASL_AUTHID, "jas");
  gsasl_property_set (session, GSASL_PASSWORD, "secret");

  /* Do it. */
  client_authenticate (session);

  /* Cleanup. */
  gsasl_finish (session);
}

void client_authenticate (Gsasl_session * session)
{
  char buf[BUFSIZ] = "";
  char *p;
  int rc;

  /* This loop mimics a protocol where the server sends data
     first. */

  do
    {
      printf ("Input base64 encoded data from server:\n");
      fgets (buf, sizeof (buf) - 1, stdin);
      if (buf[strlen (buf) - 1] == '\n')
        buf[strlen (buf) - 1] = '\0';

      rc = gsasl_step64 (session, buf, &p);

      if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
        {
          printf ("Output:\n%s\n", p);
          free (p);
        }
    }
  while (rc == GSASL_NEEDS_MORE);

  printf ("\n");

  if (rc != GSASL_OK)
    {
      printf ("Authentication error (%d): %s\n",
              rc, gsasl_strerror (rc));
      return;
    }

  /* The client is done.  Here you would typically check if the
     server let the client in.  If not, you could try again. */

  printf ("If server accepted us, we're done.\n");
}

const char *client_mechanism (Gsasl *ctx)
{
  static char mech[GSASL_MAX_MECHANISM_SIZE + 1] = "";
  char mechlist[BUFSIZ] = "";
  const char *suggestion;

  printf ("Enter list of server supported mechanisms, separate by SPC:\n");
  fgets (mechlist, sizeof (mechlist) - 1, stdin);

  suggestion = gsasl_client_suggest_mechanism (ctx, mechlist);
  if (suggestion)
    printf ("Library suggests use of `%s'.\n", suggestion);

  printf ("Enter mechanism to use:\n");
  fgets (mech, sizeof (mech) - 1, stdin);
  mech[strlen (mech) - 1] = '\0';

  return mech;
}

Enter list server supported mechanisms, separate by SPC:
CRAM-MD5 DIGEST-MD5 GSSAPI FOO BAR
Library suggests use of `GSSAPI'.
Enter mechanism to use:
CRAM-MD5
Input base64 encoded data from server:
Zm5vcmQ=
Output:
amFzIDkyY2U1NWE5MTM2ZTY4NzEyMTUyZTFjYmFmNjVkZjgx

If server accepted us, we're done.

gsasl_property_set (ctx, GSASL_AUTHID, "jas");
gsasl_property_set (ctx, GSASL_PASSWORD, "secret");

/* Set the callback handler for the library. */
gsasl_callback_set (ctx, callback);

int callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop)
{
  char buf[BUFSIZ] = "";
  int rc = GSASL_NO_CALLBACK;

  /* Get user info from user. */

  printf ("Callback invoked, for property %d.\n", prop);

  switch (prop)
    {
    case GSASL_PASSCODE:
      printf ("Enter passcode:\n");
      fgets (buf, sizeof (buf) - 1, stdin);
      buf[strlen (buf) - 1] = '\0';

      gsasl_property_set (sctx, GSASL_PASSCODE, buf);
      rc = GSASL_OK;
      break;

    case GSASL_AUTHID:
      printf ("Enter username:\n");
      fgets (buf, sizeof (buf) - 1, stdin);
      buf[strlen (buf) - 1] = '\0';

      gsasl_property_set (sctx, GSASL_AUTHID, buf);
      rc = GSASL_OK;
      break;

    default:
      printf ("Unknown property!  Don't worry.\n");
      break;
    }

  return rc;
}

/* client.c --- Example SASL client.
 * Copyright (C) 2004-2019 Simon Josefsson
 *
 * This file is part of GNU SASL.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include <config.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <gsasl.h>

static void
client_authenticate (Gsasl_session * session)
{
  char buf[BUFSIZ] = "";
  char *p;
  int rc;

  /* This loop mimics a protocol where the client send data first. */

  do
    {
      /* Generate client output. */
      rc = gsasl_step64 (session, buf, &p);

      if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
        {
          /* If sucessful, print it. */
          printf ("Output:\n%s\n", p);
          gsasl_free (p);
        }

      if (rc == GSASL_NEEDS_MORE)
        {
          /* If the client need more data from server, get it here. */
          printf ("Input base64 encoded data from server:\n");
          p = fgets (buf, sizeof (buf) - 1, stdin);
	  if (p == NULL)
	    {
	      perror ("fgets");
	      return;
	    }
          if (buf[strlen (buf) - 1] == '\n')
            buf[strlen (buf) - 1] = '\0';
        }
    }
  while (rc == GSASL_NEEDS_MORE);

  printf ("\n");

  if (rc != GSASL_OK)
    {
      printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
      return;
    }

  /* The client is done.  Here you would typically check if the server
     let the client in.  If not, you could try again. */

  printf ("If server accepted us, we're done.\n");
}

static void
client (Gsasl * ctx)
{
  Gsasl_session *session;
  const char *mech = "PLAIN";
  int rc;

  /* Create new authentication session. */
  if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
    {
      printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
      return;
    }

  /* Set username and password in session handle.  This info will be
     lost when this session is deallocated below.  */
  gsasl_property_set (session, GSASL_AUTHID, "jas");
  gsasl_property_set (session, GSASL_PASSWORD, "secret");

  /* Do it. */
  client_authenticate (session);

  /* Cleanup. */
  gsasl_finish (session);
}

int
main (int argc, char *argv[])
{
  Gsasl *ctx = NULL;
  int rc;

  /* Initialize library. */
  if ((rc = gsasl_init (&ctx)) != GSASL_OK)
    {
      printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
      return 1;
    }

  /* Do it. */
  client (ctx);

  /* Cleanup. */
  gsasl_done (ctx);

  return 0;
}

/* client-serverfirst.c --- Example SASL client, where server send data first.
 * Copyright (C) 2004-2019 Simon Josefsson
 *
 * This file is part of GNU SASL.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include <config.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <gsasl.h>

static void
client_authenticate (Gsasl_session * session)
{
  char buf[BUFSIZ] = "";
  char *p;
  int rc;

  /* This loop mimics a protocol where the server send data first. */

  do
    {
      printf ("Input base64 encoded data from server:\n");
      p = fgets (buf, sizeof (buf) - 1, stdin);
      if (p == NULL)
	{
	  perror ("fgets");
	  return;
	}
      if (buf[strlen (buf) - 1] == '\n')
        buf[strlen (buf) - 1] = '\0';

      rc = gsasl_step64 (session, buf, &p);

      if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
        {
          printf ("Output:\n%s\n", p);
          gsasl_free (p);
        }
    }
  while (rc == GSASL_NEEDS_MORE);

  printf ("\n");

  if (rc != GSASL_OK)
    {
      printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
      return;
    }

  /* The client is done.  Here you would typically check if the server
     let the client in.  If not, you could try again. */

  printf ("If server accepted us, we're done.\n");
}

static void
client (Gsasl * ctx)
{
  Gsasl_session *session;
  const char *mech = "CRAM-MD5";
  int rc;

  /* Create new authentication session. */
  if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
    {
      printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
      return;
    }

  /* Set username and password in session handle.  This info will be
     lost when this session is deallocated below.  */
  gsasl_property_set (session, GSASL_AUTHID, "jas");
  gsasl_property_set (session, GSASL_PASSWORD, "secret");

  /* Do it. */
  client_authenticate (session);

  /* Cleanup. */
  gsasl_finish (session);
}

int
main (int argc, char *argv[])
{
  Gsasl *ctx = NULL;
  int rc;

  /* Initialize library. */
  if ((rc = gsasl_init (&ctx)) != GSASL_OK)
    {
      printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
      return 1;
    }

  /* Do it. */
  client (ctx);

  /* Cleanup. */
  gsasl_done (ctx);

  return 0;
}

/* client-mech.c --- Example SASL client, with a choice of mechanism to use.
 * Copyright (C) 2004-2019 Simon Josefsson
 *
 * This file is part of GNU SASL.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include <config.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <gsasl.h>

static void
client_authenticate (Gsasl_session * session)
{
  char buf[BUFSIZ] = "";
  char *p;
  int rc;

  /* This loop mimics a protocol where the server send data first. */

  do
    {
      printf ("Input base64 encoded data from server:\n");
      p = fgets (buf, sizeof (buf) - 1, stdin);
      if (p == NULL)
	{
	  perror ("fgets");
	  return;
	}
      if (buf[strlen (buf) - 1] == '\n')
        buf[strlen (buf) - 1] = '\0';

      rc = gsasl_step64 (session, buf, &p);

      if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
        {
          printf ("Output:\n%s\n", p);
          gsasl_free (p);
        }
    }
  while (rc == GSASL_NEEDS_MORE);

  printf ("\n");

  if (rc != GSASL_OK)
    {
      printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
      return;
    }

  /* The client is done.  Here you would typically check if the server
     let the client in.  If not, you could try again. */

  printf ("If server accepted us, we're done.\n");
}

static const char *
client_mechanism (Gsasl * ctx)
{
  static char mech[GSASL_MAX_MECHANISM_SIZE + 1] = "";
  char mechlist[BUFSIZ] = "";
  const char *suggestion;
  char *p;

  printf ("Enter list of server supported mechanisms, separate by SPC:\n");
  p = fgets (mechlist, sizeof (mechlist) - 1, stdin);
  if (p == NULL)
    {
      perror ("fgets");
      return NULL;
    }

  suggestion = gsasl_client_suggest_mechanism (ctx, mechlist);
  if (suggestion)
    printf ("Library suggests use of `%s'.\n", suggestion);

  printf ("Enter mechanism to use:\n");
  p = fgets (mech, sizeof (mech) - 1, stdin);
  if (p == NULL)
    {
      perror ("fgets");
      return NULL;
    }

  mech[strlen (mech) - 1] = '\0';

  return mech;
}

static void
client (Gsasl * ctx)
{
  Gsasl_session *session;
  const char *mech;
  int rc;

  /* Find out which mechanism to use. */
  mech = client_mechanism (ctx);

  /* Create new authentication session. */
  if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
    {
      printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
      return;
    }

  /* Set username and password in session handle.  This info will be
     lost when this session is deallocated below.  */
  gsasl_property_set (session, GSASL_AUTHID, "jas");
  gsasl_property_set (session, GSASL_PASSWORD, "secret");

  /* Do it. */
  client_authenticate (session);

  /* Cleanup. */
  gsasl_finish (session);
}

int
main (int argc, char *argv[])
{
  Gsasl *ctx = NULL;
  int rc;

  /* Initialize library. */
  if ((rc = gsasl_init (&ctx)) != GSASL_OK)
    {
      printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
      return 1;
    }

  /* Do it. */
  client (ctx);

  /* Cleanup. */
  gsasl_done (ctx);

  return 0;
}

/* client-callback.c --- Example SASL client, with callback for user info.
 * Copyright (C) 2004-2019 Simon Josefsson
 *
 * This file is part of GNU SASL.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include <config.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <gsasl.h>

static void
client_authenticate (Gsasl_session * session)
{
  char buf[BUFSIZ] = "";
  char *p;
  int rc;

  /* This loop mimics a protocol where the server send data first. */

  do
    {
      printf ("Input base64 encoded data from server:\n");
      p = fgets (buf, sizeof (buf) - 1, stdin);
      if (p == NULL)
	{
	  perror ("fgets");
	  return;
	}
      if (buf[strlen (buf) - 1] == '\n')
        buf[strlen (buf) - 1] = '\0';

      rc = gsasl_step64 (session, buf, &p);

      if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
        {
          printf ("Output:\n%s\n", p);
          gsasl_free (p);
        }
    }
  while (rc == GSASL_NEEDS_MORE);

  printf ("\n");

  if (rc != GSASL_OK)
    {
      printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
      return;
    }

  /* The client is done.  Here you would typically check if the server
     let the client in.  If not, you could try again. */

  printf ("If server accepted us, we're done.\n");
}

static void
client (Gsasl * ctx)
{
  Gsasl_session *session;
  const char *mech = "SECURID";
  int rc;

  /* Create new authentication session. */
  if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
    {
      printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
      return;
    }

  /* Do it. */
  client_authenticate (session);

  /* Cleanup. */
  gsasl_finish (session);
}

static int
callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop)
{
  char buf[BUFSIZ] = "";
  int rc = GSASL_NO_CALLBACK;
  char *p;

  /* Get user info from user. */

  printf ("Callback invoked, for property %u.\n", prop);

  switch (prop)
    {
    case GSASL_PASSCODE:
      printf ("Enter passcode:\n");
      p = fgets (buf, sizeof (buf) - 1, stdin);
      if (p == NULL)
	{
	  perror ("fgets");
	  break;
	}
      buf[strlen (buf) - 1] = '\0';

      gsasl_property_set (sctx, GSASL_PASSCODE, buf);
      rc = GSASL_OK;
      break;

    case GSASL_AUTHID:
      printf ("Enter username:\n");
      p = fgets (buf, sizeof (buf) - 1, stdin);
      if (p == NULL)
	{
	  perror ("fgets");
	  break;
	}
      buf[strlen (buf) - 1] = '\0';

      gsasl_property_set (sctx, GSASL_AUTHID, buf);
      rc = GSASL_OK;
      break;

    default:
      printf ("Unknown property!  Don't worry.\n");
      break;
    }

  return rc;
}

int
main (int argc, char *argv[])
{
  Gsasl *ctx = NULL;
  int rc;

  /* Initialize library. */
  if ((rc = gsasl_init (&ctx)) != GSASL_OK)
    {
      printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
      return 1;
    }

  /* Set the callback handler for the library. */
  gsasl_callback_set (ctx, callback);

  /* Do it. */
  client (ctx);

  /* Cleanup. */
  gsasl_done (ctx);

  return 0;
}

/* smtp-server.c --- Example SMTP server with SASL authentication
 * Copyright (C) 2012-2019 Simon Josefsson
 *
 * This file is part of GNU SASL.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

/* This is a minimal SMTP server with GNU SASL authentication support.
   The only valid password is "sesam".  This server will complete
   authentications using LOGIN, PLAIN, DIGEST-MD5, CRAM-MD5, and
   SCRAM-SHA-1.  It accepts an optional command line parameter
   specifying the service name (i.e., a numerical port number or
   /etc/services name).  By default it listens on port "2000".  */

#include <config.h>
#include <string.h>
#include <stdlib.h>
#include <stdarg.h>
#include <netdb.h>
#include <signal.h>

#include <gsasl.h>

static int
callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop)
{
  int rc = GSASL_NO_CALLBACK;

  switch (prop)
    {
    case GSASL_PASSWORD:
      gsasl_property_set (sctx, prop, "sesam");
      rc = GSASL_OK;
      break;

    default:
      /* You may want to log (at debug verbosity level) that an
         unknown property was requested here, possibly after filtering
         known rejected property requests. */
      break;
    }

  return rc;
}

static ssize_t
gettrimline (char **line, size_t * n, FILE * fh)
{
  ssize_t s = getline (line, n, fh);

  if (s >= 2)
    {
      if ((*line)[strlen (*line) - 1] == '\n')
	(*line)[strlen (*line) - 1] = '\0';
      if ((*line)[strlen (*line) - 1] == '\r')
	(*line)[strlen (*line) - 1] = '\0';

      printf ("C: %s\n", *line);
    }

  return s;
}

#define print(fh, ...)							\
  printf ("S: "), printf (__VA_ARGS__), fprintf (fh, __VA_ARGS__)

static void
server_auth (FILE * fh, Gsasl_session * session)
{
  char *line = NULL;
  size_t n = 0;
  char *p;
  int rc;

  /* The ordering and the type of checks in the following loop has to
     be adapted for each protocol depending on its SASL properties.
     SMTP is a "server-first" SASL protocol.  This implementation do
     not support piggy-backing of the initial client challenge nor
     piggy-backing of the terminating server response.  See RFC 2554
     and RFC 4422 for terminology.  That profile results in the
     following loop structure.  Ask on the help-gsasl list if you are
     uncertain.  */
  do
    {
      rc = gsasl_step64 (session, line, &p);
      if (rc == GSASL_NEEDS_MORE || (rc == GSASL_OK && p && *p))
	{
	  print (fh, "334 %s\n", p);
	  gsasl_free (p);

	  if (gettrimline (&line, &n, fh) < 0)
	    {
	      print (fh, "221 localhost getline failure\n");
	      goto done;
	    }
	}
    }
  while (rc == GSASL_NEEDS_MORE);

  if (rc != GSASL_OK)
    {
      print (fh, "535 gsasl_step64 (%d): %s\n", rc, gsasl_strerror (rc));
      goto done;
    }

  {
    const char *authid = gsasl_property_fast (session, GSASL_AUTHID);
    const char *authzid = gsasl_property_fast (session, GSASL_AUTHZID);
    print (fh, "235 OK [authid: %s authzid: %s]\n",
	   authid ? authid : "N/A", authzid ? authzid : "N/A");
  }

done:
  free (line);
}

static void
smtp (FILE * fh, Gsasl * ctx)
{
  char *line = NULL;
  size_t n = 0;
  int rc;

  print (fh, "220 localhost ESMTP GNU SASL smtp-server\n");

  while (gettrimline (&line, &n, fh) >= 0)
    {
      if (strncmp (line, "EHLO ", 5) == 0 || strncmp (line, "ehlo ", 5) == 0)
	{
	  char *mechlist;

	  rc = gsasl_server_mechlist (ctx, &mechlist);
	  if (rc != GSASL_OK)
	    {
	      print (fh, "221 localhost gsasl_server_mechlist (%d): %s\n",
		     rc, gsasl_strerror (rc));
	      goto done;
	    }

	  print (fh, "250-localhost\n");
	  print (fh, "250 AUTH %s\n", mechlist);

	  gsasl_free (mechlist);
	}
      else if (strncmp (line, "AUTH ", 5) == 0
	       || strncmp (line, "auth ", 5) == 0)
	{
	  Gsasl_session *session = NULL;

	  if ((rc = gsasl_server_start (ctx, line + 5, &session)) != GSASL_OK)
	    {
	      print (fh, "221 localhost gsasl_server_start (%d): %s\n",
		     rc, gsasl_strerror (rc));
	      goto done;
	    }

	  server_auth (fh, session);

	  gsasl_finish (session);
	}
      else if (strncmp (line, "QUIT", 4) == 0
	       || strncmp (line, "quit", 4) == 0)
	{
	  print (fh, "221 localhost QUIT\n");
	  goto done;
	}
      else
	print (fh, "500 unrecognized command\n");
    }

  print (fh, "221 localhost getline failure\n");

done:
  free (line);
}

int
main (int argc, char *argv[])
{
  const char *service = argc > 1 ? argv[1] : "2000";
  volatile int run = 1;
  struct addrinfo hints, *addrs;
  int sockfd;
  int rc;
  int yes = 1;
  Gsasl *ctx;

  setvbuf (stdout, NULL, _IONBF, 0);

  rc = gsasl_init (&ctx);
  if (rc < 0)
    {
      printf ("gsasl_init (%d): %s\n", rc, gsasl_strerror (rc));
      exit (EXIT_FAILURE);
    }

  printf ("%s [gsasl header %s library %s]\n",
	  argv[0], GSASL_VERSION, gsasl_check_version (NULL));

  gsasl_callback_set (ctx, callback);

  memset (&hints, 0, sizeof (hints));
  hints.ai_flags = AI_PASSIVE | AI_ADDRCONFIG;
  hints.ai_socktype = SOCK_STREAM;

  rc = getaddrinfo (NULL, service, &hints, &addrs);
  if (rc < 0)
    {
      printf ("getaddrinfo: %s\n", gai_strerror (rc));
      exit (EXIT_FAILURE);
    }

  sockfd = socket (addrs->ai_family, addrs->ai_socktype, addrs->ai_protocol);
  if (sockfd < 0)
    {
      perror ("socket");
      exit (EXIT_FAILURE);
    }

  if (setsockopt (sockfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof (yes)) < 0)
    {
      perror ("setsockopt");
      exit (EXIT_FAILURE);
    }

  rc = bind (sockfd, addrs->ai_addr, addrs->ai_addrlen);
  if (rc < 0)
    {
      perror ("bind");
      exit (EXIT_FAILURE);
    }

  freeaddrinfo (addrs);

  rc = listen (sockfd, SOMAXCONN);
  if (rc < 0)
    {
      perror ("listen");
      exit (EXIT_FAILURE);
    }

  signal (SIGPIPE, SIG_IGN);

  while (run)
    {
      struct sockaddr from;
      socklen_t fromlen = sizeof (from);
      char host[NI_MAXHOST];
      int fd;
      FILE *fh;

      fd = accept (sockfd, &from, &fromlen);
      if (fd < 0)
	{
	  perror ("accept");
	  continue;
	}

      rc = getnameinfo (&from, fromlen, host, sizeof (host),
			NULL, 0, NI_NUMERICHOST);
      if (rc == 0)
	printf ("connection from %s\n", host);
      else
	printf ("getnameinfo: %s\n", gai_strerror (rc));

      fh = fdopen (fd, "w+");
      if (!fh)
	{
	  perror ("fdopen");
	  close (fd);
	  continue;
	}

      smtp (fh, ctx);

      fclose (fh);
    }

  close (sockfd);
  gsasl_done (ctx);

  return 0;
}

  -c, --client               Act as client (the default).
      --client-mechanisms    Write name of supported client mechanisms
                             separated by space to stdout.
  -s, --server               Act as server.
      --server-mechanisms    Write name of supported server mechanisms
                             separated by space to stdout.

      --connect=HOSTNAME[:SERVICE]
                             Connect to TCP server and negotiate on stream
                             instead of stdin/stdout. SERVICE is the protocol
                             service, or an integer denoting the port, and
                             defaults to 143 (imap) if not specified. Also sets
                             the --hostname default.

  -d, --application-data     After authentication, read data from stdin and run
                             it through the mechanism's security layer and
                             print it base64 encoded to stdout. The default is
                             to terminate after authentication.
      --imap                 Use a IMAP-like logon procedure (client only).
                             Also sets the --service default to "imap".
  -m, --mechanism=STRING     Mechanism to use.
      --no-client-first      Disallow client to send data first (client only).

  -n, --anonymous-token=STRING    Token for anonymous authentication, usually
                                  mail address (ANONYMOUS only).
  -a, --authentication-id=STRING  Identity of credential owner.
  -z, --authorization-id=STRING   Identity to request service for.
      --disable-cleartext-validate
                             Disable cleartext validate hook, forcing server to
                             prompt for password.
      --enable-cram-md5-validate  Validate CRAM-MD5 challenge and response
                                  interactively.
      --hostname=STRING      Set the name of the server with the requested
                             service.
  -p, --password=STRING      Password for authentication (insecure for
                             non-testing purposes).
      --passcode=NUMBER      Passcode for authentication (SECURID only).
      --quality-of-protection=<qop-auth | qop-int | qop-conf>
                             How application payload will be protected.
                             "qop-auth" means no protection,
                             "qop-int" means integrity protection,
                             "qop-conf" means confidentiality.
                             Currently only used by DIGEST-MD5, where the
                             default is "qop-int".
  -r, --realm=STRING         Realm. Defaults to hostname.
      --service=STRING       Set the requested service name (should be a
                             registered GSSAPI host based service name).
      --service-name=STRING  Set the generic server name in case of a
                             replicated server (DIGEST-MD5 only).
  -x, --maxbuf=NUMBER        Indicate maximum buffer size (DIGEST-MD5 only).

      --starttls                Force use of STARTTLS.  The default is to use
                                  STARTTLS when available.  (default=off)
      --no-starttls             Unconditionally disable STARTTLS.
                                  (default=off)
      --no-cb                   Don't set any channel bindings.  (default=off)
      --x509-ca-file=FILE       File containing one or more X.509 Certificate
                                  Authorities certificates in PEM format, used
                                  to verify the certificate received from the
                                  server.  If not specified, no verification of
                                  the remote server certificate will be done.
      --x509-cert-file=FILE     File containing client X.509 certificate in PEM
                                  format.  Used together with --x509-key-file
                                  to specify the certificate/key pair.
      --x509-key-file=FILE      Private key for the client X.509 certificate in
                                  PEM format.  Used together with
                                  --x509-key-file to specify the
                                  certificate/key pair.
      --priority                Cipher priority string.

  -q, --quiet, --silent      Don't produce any diagnostic output.
  -v, --verbose              Produce verbose output.

  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

int
callback_gssapi (Gsasl_session_ctx *ctx,
		 char *clientname,
		 char *authentication_id)
{
  int rc = GSASL_AUTHENTICATION_ERROR;

  krb5_principal p;
  krb5_context kcontext;

  krb5_init_context (&kcontext);

  if (krb5_parse_name (kcontext, clientname, &p) != 0)
    return -1;
  if (krb5_kuserok (kcontext, p, authentication_id))
    rc = GSASL_OK;
  krb5_free_principal (kcontext, p);

  return rc;
}

Copyright © 2000, 2001, 2002, 2007, 2008 Free Software Foundation, Inc.
https://fsf.org/

Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.

  Copyright (C)  year  your name.
  Permission is granted to copy, distribute and/or modify this document
  under the terms of the GNU Free Documentation License, Version 1.3
  or any later version published by the Free Software Foundation;
  with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
  Texts.  A copy of the license is included in the section entitled ``GNU
  Free Documentation License''.

    with the Invariant Sections being list their titles, with
    the Front-Cover Texts being list, and with the Back-Cover Texts
    being list.


• Introduction:		Information about protocol and implementation.
• Preparation:		What you should do before using the library.
• Using the Library:		High level overview of how to use the library.
• Properties:		How to specify username, password, etc.
• Mechanisms:		Mechanism specific information.
• Global Functions:		Functions that can be used at all times.
• Callback Functions:		Set and use callbacks.
• Property Functions:		Specify username, password etc.
• Session Functions:		Perform an authentication.
• Utilities:		Functions for various odd things.
• Memory Handling:		Memory de-allocation.
• Error Handling:		Error codes and such.
• Examples:		Demonstrate how to use the library.
• Acknowledgements:		Whom to blame.
• Invoking gsasl:		Command line interface to the library.
Appendices
• Protocol Clarifications:		Our notes on the SASL protocol.
• Old Functions:		Descriptions of old API functions.
• Copying Information:		How you can copy and share GNU SASL.
Indices
• Function and Data Index:		Index of functions, variables and data types.
• Concept Index:		Index of concepts and programs.

• SASL Overview:
• Implementation:
• Features:
• Requirements:
• Supported Platforms:
• Getting help:
• Commercial Support:
• Downloading and Installing:
• Bug Reports:
• Contributing:

• Installing under Windows:		Windows specific build instructions.
• Kerberos on Windows:		Building with Kerberos via GSS-API on Windows.

• Header:
• Initialization:
• Version Check:
• Building the source:
• Autoconf tests:

• EXTERNAL:		Authentication via out of band information.
• ANONYMOUS:		Mechanism for anonymous access to resources.
• PLAIN:		Clear text username and password.
• LOGIN:		Non-standard clear text username and password.
• CRAM-MD5:		Challenge-Response Authentication Mechanism.
• DIGEST-MD5:		Digest Authentication.
• SCRAM-SHA-1:		SCRAM-SHA-1 authentication.
• NTLM:		Microsoft NTLM authentication.
• SECURID:		Authentication using tokens.
• GSSAPI:		GSSAPI (Kerberos 5) authentication.
• GS2-KRB5:		Improved GSSAPI (Kerberos 5) authentication.
• SAML20:		Authenticate using SAML 2.0 via a browser.
• OPENID20:		Authenticate using OpenID 2.0 via a browser.
• KERBEROS_V5:		Experimental KERBEROS_V5 authentication.

• Error values:		A list of all error values used.
• Error strings:		How to get a descriptive string from a value.

• Example 1:		SASL client.
• Example 2:		SASL client where server send data first.
• Example 3:		SASL client, with a choice of mechanism to use.
• Example 4:		SASL client, with callback for user info.
• Example 5:		Example SMTP server with GNU SASL authentication.

• Use of SASLprep in CRAM-MD5:
• Use of SASLprep in LOGIN:

	Index Entry	Section

(
	`(*Gsasl_client_callback_anonymous)`:	Old Functions
	`(*Gsasl_client_callback_authentication_id)`:	Old Functions
	`(*Gsasl_client_callback_authorization_id)`:	Old Functions
	`(*Gsasl_client_callback_passcode)`:	Old Functions
	`(*Gsasl_client_callback_password)`:	Old Functions
	`(*Gsasl_client_callback_service)`:	Old Functions
	`(*Gsasl_server_callback_anonymous)`:	Old Functions
	`(*Gsasl_server_callback_cram_md5)`:	Old Functions
	`(*Gsasl_server_callback_digest_md5)`:	Old Functions
	`(*Gsasl_server_callback_external)`:	Old Functions
	`(*Gsasl_server_callback_gssapi)`:	Old Functions
	`(*Gsasl_server_callback_retrieve)`:	Old Functions
	`(*Gsasl_server_callback_service)`:	Old Functions
	`(*Gsasl_server_callback_validate)`:	Old Functions
	`(*Gsasl_server_callback_validate)`:	Old Functions

G
	`gsasl`:	Invoking gsasl
	`gsasl_appinfo_get`:	Old Functions
	`gsasl_appinfo_set`:	Old Functions
	`gsasl_application_data_get`:	Old Functions
	`gsasl_application_data_set`:	Old Functions
	`gsasl_base64_decode`:	Old Functions
	`gsasl_base64_encode`:	Old Functions
	`gsasl_base64_from`:	Utilities
	`gsasl_base64_to`:	Utilities
	`gsasl_callback`:	Callback Functions
	`gsasl_callback_hook_get`:	Callback Functions
	`gsasl_callback_hook_set`:	Callback Functions
	`gsasl_callback_set`:	Callback Functions
	`gsasl_check_version`:	Version Check
	`gsasl_client_application_data_get`:	Old Functions
	`gsasl_client_application_data_set`:	Old Functions
	`gsasl_client_callback_anonymous_get`:	Old Functions
	`gsasl_client_callback_anonymous_set`:	Old Functions
	`gsasl_client_callback_authentication_id_get`:	Old Functions
	`gsasl_client_callback_authentication_id_set`:	Old Functions
	`gsasl_client_callback_authorization_id_get`:	Old Functions
	`gsasl_client_callback_authorization_id_set`:	Old Functions
	`gsasl_client_callback_maxbuf_get`:	Old Functions
	`gsasl_client_callback_maxbuf_set`:	Old Functions
	`gsasl_client_callback_passcode_get`:	Old Functions
	`gsasl_client_callback_passcode_set`:	Old Functions
	`gsasl_client_callback_password_get`:	Old Functions
	`gsasl_client_callback_password_set`:	Old Functions
	`gsasl_client_callback_pin_get`:	Old Functions
	`gsasl_client_callback_pin_set`:	Old Functions
	`gsasl_client_callback_qop_get`:	Old Functions
	`gsasl_client_callback_qop_set`:	Old Functions
	`gsasl_client_callback_realm_get`:	Old Functions
	`gsasl_client_callback_realm_set`:	Old Functions
	`gsasl_client_callback_service_get`:	Old Functions
	`gsasl_client_callback_service_set`:	Old Functions
	`gsasl_client_ctx_get`:	Old Functions
	`gsasl_client_finish`:	Old Functions
	`gsasl_client_listmech`:	Old Functions
	`gsasl_client_mechlist`:	Global Functions
	`gsasl_client_start`:	Session Functions
	`gsasl_client_step`:	Old Functions
	`gsasl_client_step_base64`:	Old Functions
	`gsasl_client_suggest_mechanism`:	Global Functions
	`gsasl_client_support_p`:	Global Functions
	`gsasl_ctx_get`:	Old Functions
	`gsasl_decode`:	Session Functions
	`gsasl_decode_inline`:	Old Functions
	`gsasl_done`:	Global Functions
	`gsasl_encode`:	Session Functions
	`gsasl_encode_inline`:	Old Functions
	`gsasl_finish`:	Session Functions
	`gsasl_free`:	Memory Handling
	`gsasl_hmac_md5`:	Utilities
	`gsasl_hmac_sha1`:	Utilities
	`gsasl_init`:	Global Functions
	`gsasl_md5`:	Utilities
	`gsasl_md5pwd_get_password`:	Old Functions
	`gsasl_mechanism_name`:	Session Functions
	`gsasl_nonce`:	Utilities
	`gsasl_property_fast`:	Property Functions
	`gsasl_property_get`:	Property Functions
	`gsasl_property_set`:	Property Functions
	`gsasl_property_set_raw`:	Property Functions
	`gsasl_random`:	Utilities
	`gsasl_randomize`:	Old Functions
	`gsasl_register`:	Global Functions
	`gsasl_saslprep`:	Utilities
	`gsasl_server_application_data_get`:	Old Functions
	`gsasl_server_application_data_set`:	Old Functions
	`gsasl_server_callback_anonymous_get`:	Old Functions
	`gsasl_server_callback_anonymous_set`:	Old Functions
	`gsasl_server_callback_cipher_get`:	Old Functions
	`gsasl_server_callback_cipher_set`:	Old Functions
	`gsasl_server_callback_cram_md5_get`:	Old Functions
	`gsasl_server_callback_cram_md5_set`:	Old Functions
	`gsasl_server_callback_digest_md5_get`:	Old Functions
	`gsasl_server_callback_digest_md5_set`:	Old Functions
	`gsasl_server_callback_external_get`:	Old Functions
	`gsasl_server_callback_external_set`:	Old Functions
	`gsasl_server_callback_gssapi_get`:	Old Functions
	`gsasl_server_callback_gssapi_set`:	Old Functions
	`gsasl_server_callback_maxbuf_get`:	Old Functions
	`gsasl_server_callback_maxbuf_set`:	Old Functions
	`gsasl_server_callback_qop_get`:	Old Functions
	`gsasl_server_callback_qop_set`:	Old Functions
	`gsasl_server_callback_realm_get`:	Old Functions
	`gsasl_server_callback_realm_set`:	Old Functions
	`gsasl_server_callback_retrieve_get`:	Old Functions
	`gsasl_server_callback_retrieve_set`:	Old Functions
	`gsasl_server_callback_securid_get`:	Old Functions
	`gsasl_server_callback_securid_set`:	Old Functions
	`gsasl_server_callback_service_get`:	Old Functions
	`gsasl_server_callback_service_set`:	Old Functions
	`gsasl_server_callback_validate_get`:	Old Functions
	`gsasl_server_callback_validate_set`:	Old Functions
	`gsasl_server_ctx_get`:	Old Functions
	`gsasl_server_finish`:	Old Functions
	`gsasl_server_listmech`:	Old Functions
	`gsasl_server_mechlist`:	Global Functions
	`gsasl_server_start`:	Session Functions
	`gsasl_server_step`:	Old Functions
	`gsasl_server_step_base64`:	Old Functions
	`gsasl_server_suggest_mechanism`:	Old Functions
	`gsasl_server_support_p`:	Global Functions
	`gsasl_session_hook_get`:	Callback Functions
	`gsasl_session_hook_set`:	Callback Functions
	`gsasl_sha1`:	Utilities
	`gsasl_simple_getpass`:	Utilities
	`gsasl_step`:	Session Functions
	`gsasl_step64`:	Session Functions
	`gsasl_strerror`:	Error strings
	`gsasl_strerror_name`:	Error strings
	`gsasl_stringprep_nfkc`:	Old Functions
	`gsasl_stringprep_saslprep`:	Old Functions
	`gsasl_stringprep_trace`:	Old Functions

	Index Entry	Section

A
	AIX:	Supported Platforms
	Autoconf tests:	Autoconf tests

C
	Callbacks:	Callback Functions
	channel binding:	Properties
	channel binding:	SCRAM-SHA-1
	command line:	Invoking gsasl
	Compiling your application:	Building the source
	Configure tests:	Autoconf tests
	Contributing:	Contributing
	CRAM-MD5:	CRAM-MD5

D
	Debian:	Supported Platforms
	Debian:	Supported Platforms
	Deprecated functions:	Old Functions
	DIGEST-MD5:	DIGEST-MD5
	Download:	Downloading and Installing

E
	Error Handling:	Error Handling
	Examples:	Examples

F
	FDL, GNU Free Documentation License:	GNU Free Documentation License
	FreeBSD:	Supported Platforms

G
	GS2:	GS2-KRB5
	GS2-KRB5:	GS2-KRB5
	GS2-KRB5-PLUS:	GS2-KRB5
	GSSAPI:	GSSAPI

H
	Hacking:	Contributing
	HP-UX:	Supported Platforms

I
	Identity Provider Identifier:	Properties
	Installation:	Downloading and Installing
	invoking `gsasl`:	Invoking gsasl
	IRIX:	Supported Platforms
	iteration count:	Properties

K
	KERBEROS_V5:	KERBEROS_V5

L
	Library Overview:	Using the Library

M
	Mandrake:	Supported Platforms
	Motorola Coldfire:	Supported Platforms

N
	NetBSD:	Supported Platforms
	NTLM:	NTLM

O
	Obsolete functions:	Old Functions
	OpenBSD:	Supported Platforms
	OpenID:	OPENID20
	Overview:	Using the Library

P
	Properties:	Property Functions

R
	RedHat:	Supported Platforms
	RedHat:	Supported Platforms
	RedHat:	Supported Platforms
	RedHat Advanced Server:	Supported Platforms
	Reporting Bugs:	Bug Reports

S
	salt:	Properties
	SAML:	SAML20
	SAML IdP Identifier:	Properties
	SASL sessions:	Session Functions
	SCRAM:	SCRAM-SHA-1
	SECURID:	SECURID
	Solaris:	Supported Platforms
	Solaris:	Supported Platforms
	SuSE:	Supported Platforms
	SuSE Linux:	Supported Platforms

T
	tls-unique:	Properties
	Tru64:	Supported Platforms

U
	uClibc:	Supported Platforms
	uClinux:	Supported Platforms

W
	Windows:	Supported Platforms

GNU Simple Authentication and Security Layer 1.8.1

Table of Contents

GNU Simple Authentication and Security Layer

1 Introduction

1.1 SASL Overview

1.2 Implementation

1.3 Features

1.4 Requirements

1.5 Supported Platforms

1.6 Getting help

1.7 Commercial Support

1.8 Downloading and Installing

1.8.1 Installing under Windows

1.8.2 Kerberos on Windows

1.9 Bug Reports

1.10 Contributing

2 Preparation

2.1 Header

2.2 Initialization

2.3 Version Check

gsasl_check_version

2.4 Building the source

2.5 Autoconf tests

2.5.1 Autoconf test via ‘pkg-config’

2.5.2 Standalone Autoconf test using Libtool

3 Using the Library

3.1 Choosing a mechanism

3.2 Using a callback

4 Properties

5 Mechanisms

5.1 The EXTERNAL mechanism

5.2 The ANONYMOUS mechanism

5.3 The PLAIN mechanism

5.4 The LOGIN mechanism

5.5 The CRAM-MD5 mechanism

5.6 The DIGEST-MD5 mechanism

5.7 The SCRAM-SHA-1 mechanism

5.8 The NTLM mechanism

5.9 The SECURID mechanism

5.10 The GSSAPI mechanism

5.11 The GS2-KRB5 mechanism

5.12 The SAML20 mechanism

5.13 The OPENID20 mechanism

5.14 The KERBEROS_V5 mechanism

6 Global Functions

gsasl_init

gsasl_done

gsasl_client_mechlist

gsasl_server_mechlist

gsasl_client_support_p

gsasl_server_support_p

gsasl_client_suggest_mechanism

gsasl_register

7 Callback Functions

gsasl_callback_set

gsasl_callback

gsasl_callback_hook_set

gsasl_callback_hook_get

gsasl_session_hook_set

gsasl_session_hook_get

8 Property Functions

gsasl_property_set

gsasl_property_set_raw

gsasl_property_fast

gsasl_property_get

9 Session Functions

gsasl_client_start

gsasl_server_start

gsasl_step

gsasl_step64

gsasl_finish

gsasl_encode

gsasl_decode

gsasl_mechanism_name

10 Utilities

gsasl_saslprep

gsasl_base64_to

gsasl_base64_from

gsasl_simple_getpass

gsasl_nonce

2.5.1 Autoconf test via ‘`pkg-config`’