gssapi

type Cap int

type ChannelBindings interface {
	Marshal() ([]byte, error)
}

type Config struct {
	// The security compatibility parameter. (NTLM).
	Compatibility int
	// The Quality-of-Protection.
	QoP int
	// The request flag.
	Capabilities Cap
	// The liftime of the context.
	ContextTTL int
	// The target name.
	TargetName string
	// The flag that indicates whether the target name
	// was retrieved from the untrusted source.
	TargetNameFromUntrustedSource bool
	// The context mechanism.
	MechanismType OID
	// The list of mechanism configs.
	MechanismConfigs []MechanismConfig
	// The flag that indicates whether it's a server
	// handle.
	IsServer bool
}

type ContextManager interface {
	// Initialize outbound security context.
	InitSecurityContext(context.Context, *Token, ...Option) (*Token, error)
	// Accepts inbound security context.
	AcceptSecurityContext(context.Context, *Token, ...Option) (*Token, error)
	// Deletes the security context.
	DeleteSecurityContext(context.Context, ...Option) error
	// Resets the security context.
	ResetSecurityContext(context.Context, ...Option) error
	// The maximum message size for the given limit.
	WrapSizeLimit(context.Context, int, ...Option) int
	// Sets the context attribute.
	SetAttribute(context.Context, string, any, ...Option)
	// Extracts the context attribute.
	GetAttribute(context.Context, string, ...Option) (any, error)
}

type ContextOption any

type Credential interface {
	// The target name for the credential.
	TargetName() string
	// The list of supported mechanisms.
	MechanismTypes() []OID
	// The credential usage.
	Usage() CredentialUsage
	// The actual credentials value (protocol specific).
	Value() any
}

type CredentialStore struct {
	// contains filtered or unexported fields
}

type CredentialUsage int

type CredentialsManager interface {
	// Add the credentials to the context.
	AddCredentials(context.Context, Credential) error
	// Obtains the user's identity proof, often a secret cryptographic key.
	AcquireCredentials(context.Context) error
}

type Error struct {
	Status Status
	Err    error
}

type Mechanism interface {
	// The mechanism type object identifier.
	Type() OID
	// The security context init call.
	Init(ctx context.Context, token *Token) (*Token, error)
	// The security context accept call.
	Accept(ctx context.Context, token *Token) (*Token, error)
	// The maximum message size for the given limit. (and flag determining if
	// conf is required).
	WrapSizeLimit(context.Context, int, bool) int
	// Wrap token.
	Wrap(context.Context, *MessageToken) (*MessageToken, error)
	// Unwrap token.
	Unwrap(context.Context, *MessageToken) (*MessageToken, error)
	// MakeSignature token.
	MakeSignature(context.Context, *MessageToken) (*MessageToken, error)
	// VerifySignature token.
	VerifySignature(context.Context, *MessageToken) error
}

type MechanismConfig interface {
	// The mechanism type object identifier.
	Type() OID
	// Copy must return copy of the configuration.
	Copy() MechanismConfig
}

type MechanismEx interface {
	// Wrap token.
	WrapEx(context.Context, *MessageTokenEx) (*MessageTokenEx, error)
	// Unwrap token.
	UnwrapEx(context.Context, *MessageTokenEx) (*MessageTokenEx, error)
	// MakeSignature token.
	MakeSignatureEx(context.Context, *MessageTokenEx) (*MessageTokenEx, error)
	// VerifySignature token.
	VerifySignatureEx(context.Context, *MessageTokenEx) error
}

type MechanismFactory interface {
	// New returns the mechanism instance.
	New(context.Context) (Mechanism, error)
	// DefaultConfig returns the default config for the instance.
	DefaultConfig(context.Context) (MechanismConfig, error)
	// The mechanism type object identifier.
	Type() OID
}

type MechanismFactoryWithConfig struct {
	MechanismFactory
	// contains filtered or unexported fields
}

type MechanismStore struct {
	// contains filtered or unexported fields
}

type MessageToken struct {
	// The quality-of-protection.
	QoP int
	// The request/response capabilities of the token.
	Capabilities Cap
	// The input/output payload for signature calculation
	// and/or encryption (or verification and decryption).
	Payload []byte
	// The input/output signature for verification or
	// generation.
	Signature []byte
}

type MessageTokenEx struct {
	// The quality-of-protection.
	QoP int
	// The list of Payloads.
	Payloads []*PayloadEx
	// The signature.
	Signature []byte
}

type OID asn1.ObjectIdentifier

type Option func(*Config)

type PayloadEx struct {
	// The request/response capabilities of the token. Must be only
	// Confidentiality and/or Integrity.
	Capabilities Cap
	// The payload.
	Payload []byte
}

type SecurityAttributes interface {
	// GetAttribute function retrieves the security context attribute, ie session key,
	// target name.
	GetAttribute(context.Context, string, ...Option) (any, bool)
	// SetAttribute function sets the security context attribute.
	SetAttribute(context.Context, string, any, ...Option)
}

type SecurityContext struct {
	// Status.
	Status Status
	// Error.
	Error error
	// The credential handle.
	Credential Credential
	// The security compatibility parameter. (NTLM).
	Compatibility int
	// The Quality-of-Protection.
	QoP int
	// Target name.
	TargetName string
	// The flag that indicates whether the target name
	// was retrieved from the untrusted source.
	TargetNameFromUntrustedSource bool
	// The selected mechanism.
	Mechanism Mechanism
	// The negotiated capabilities.
	Capabilities Cap
	// The lifetime of the security context.
	ContextTTL int
	// Channel binding.
	ChannelBindings ChannelBindings
	// Mechanism-specific configuration.
	MechanismConfigs []MechanismConfig
	// IsServer.
	IsServer bool
	// attributes.
	Attributes map[string]interface{}
	// Local context mechanism storage.
	MechanismStore *MechanismStore
	// Local context credentials storage.
	CredentialStore *CredentialStore
}

type SecurityService interface {
	// MakeSignature function accepts the payload and returns the
	// signature for the payload.
	MakeSignature(context.Context, *MessageToken, ...Option) (*MessageToken, error)
	// VerifySignature function accepts the payload and signature
	// and returns nil if signature is valid.
	VerifySignature(context.Context, *MessageToken, ...Option) (*MessageToken, error)
	// Wrap function accepts the unencrypted payload and returns the
	// encrypted payload and signature.
	Wrap(context.Context, *MessageToken, ...Option) (*MessageToken, error)
	// Unwrap function accepts the encrypted payload and signature and
	// returns the unencrypted paylaod.
	Unwrap(context.Context, *MessageToken, ...Option) (*MessageToken, error)
}

type SecurityServiceEx interface {
	// MakeSignatureEx function accepts the list of payloads and returns the
	// signature for the payload.
	MakeSignatureEx(context.Context, *MessageTokenEx, ...Option) (*MessageTokenEx, error)
	// VerifySignatureEx function accepts the list of payloads and signature
	// and returns nil if signature is valid.
	VerifySignatureEx(context.Context, *MessageTokenEx, ...Option) (*MessageTokenEx, error)
	// WrapEx function accepts the list of unencrypted payloads and returns the
	// encrypted payload and signature.
	WrapEx(context.Context, *MessageTokenEx, ...Option) (*MessageTokenEx, error)
	// UnwrapEx function accepts the list of encrypted payloads and signature and
	// returns the unencrypted paylaod.
	UnwrapEx(context.Context, *MessageTokenEx, ...Option) (*MessageTokenEx, error)
}

type Status int

type TargetNameSource struct {
	Trusted bool
}

type Token struct {
	// The token payload.
	Payload []byte
}