Add some configure bits for GSS-API

rxgk will require gss_pseudo_random and might want a couple other
krb5-specific bits.  We'll also need substvars to tell whether or
not we can try building these things.

Change-Id: Id18eb3f554605875696095eb40c25ec54df1f74b
Add rxgk boilerplate

Just the skeleton of what needs to be there.  The actual import is split
over multiple commits, to make the reviewer's burden more manageable.

Error table, protocol description, and stubs for the security object
routines, with header to declare them.

The public header rxgk.h currently only contains a few typedefs and the
NewSecurityObject prototypes, and includes the RPC interface and com_err
code headers.

Change-Id: I7893f78119bb4aef12112cc1e51e1ec69de326c2
Dummy Makefile for rxgk

Include a libtool export symbol list for the shared library, which
only has the client RPC calls and the NewFooSecurityObject primitives
for now, since that's all that's stubbed out.

Also connect the rxgk directory up to be buildable from the root, but
nothing depends on it yet so it will not be built.

Looking ahead, build a libafsrpc_rxgk.la object.

Change-Id: I12ddefbdaa1ad4845649e3a32efdeaaa21b5e9b7
Configure glue for rxgk

Add an --enable-rxgk switch to control whether the feature is used.
For now, just build the code as a dependency of finale, but we will
phase it in to other parts of the tree as appropriate.

We want to always build as much code as we can to benefit from the
automated build testing, so build rxgk if there is an appropriate
GSSAPI library available, but do not install anything unless the
configure argument was given.

Provide a symbol in afsconfig.h so that code using rxgk can be
conditionally compiled.

Change-Id: Iab661d47aac77c1a238e809362015b869752df18
Export oafs_h_krb5_generate_random_block

We'll need it for rxgk's random bits.

Change-Id: I074680724dec8e624bfea0bc6b12cc226734afe7
Add rxgk_crypto_rfc3961.c

rxgk wrappers around an external crypto library, in this case, our
in-tree rfc3961 library.  Primitives for encryption/decryption and
MIC/VerifyMIC, ways to generate and free rxgk_key objects, etc..

Change-Id: I7525086043baf54f5c3019b3f5ab3495760c4236
Add RXGK_NOW()

A quick routine to get the current timestamp.

Change-Id: I0051b5c8e5ad61e35431d97454bf2741daba90cb
Add rxgk_token.c

Routines for constructing tokens (both regular and printed), and
helpers.

Provide the ability to print a token using a given session key and
using a random session key; the former is useful for certain variants
of localauth wherein a dummy GSS negotiation is performed with the
same identity acting as initiator and acceptor.

Change-Id: I0cde7fd0cdf9a27777523cd502b21bdccef41dcc
Export {Get,Set}ServiceSpecific from liboafs_rx.la

rxgk will use service-specific data.

Change-Id: Id9e2d4b9920e771e1583b9362e61de6216c246b4
Add rxgk_gss.c

All the routines which deal with GSSAPI types.
This is, in practice, how the client gets a token, and the server
backend for GSSNegotiate().

These routines are split out into a separate file, and their prototypes
hidden behind ifndef KERNEL, because we need to allow rxgk to be usable
in the absence of a gssapi library, which is the case in the kernel.

Provide a compatibility definition of GSS_C_PRF_KEY_FULL, as there
are known implementations in the wild that provide the function but
do not provide the keyusage constants.

Change-Id: Id2966de07853dd6a74cb40225851728d2422421c
Add rxgk_util.c

A few helper routines for the security class implementation, mostly.
No public APIs.

Change-Id: I71218283294795b3ebde5f0a84253dba12786c8e
Implement SRXGK_GSSNegotiate()

In-kernel we must fail; the userspace implementation is already
in the tree in rxgk_gss.c.

Change-Id: Id715e3287df5921a20aebe4e65259fd2097dc2b4
Add rxgk_packet.c

Routines to apply and verify encryption and MICs to the data in
rx packets.  Backend to the rxgk_crypto framework for the actual
crypto operations.

Change-Id: I724efacf7df1d688c0d61a327fa9ee9c8168d715
Implement the rxgk server routines

Provide non-trivial implementations of the security class routines
used by the server, along with helpers as necessary.

In addition to the normal NewServerSecurityObject routine, provide
wrappers NewServiceSecObj and NewEphemeralService_SecObj that create
the security object, create an rx service for the key negotiation service
needed for clients to negotiate tokens useful with this server security
object, and register the getkey function used for the security object
as service-specific data to be used when encrypting tokens produced by
this rx service.  The Ephemeral variant creates a random token-encrypting
key for use by the service, so no getkey routine needs to be supplied
by the caller.

The identity supplied in a client's token is given as a list of
PrAuthNames; we assume that at most one name is supplied at present,
as the meaning of compound identities (and the use of compound
identities for keyed cache managers) is not fully specified yet.
Convert the PrAuthName to an rx_identity for caching in the server
connection state, as the rx_identity type is more compatible with
superuser checks on the connection.

Also provide an rxgk_GetServerInfo routine which extracts the cached
identity, for use in libauth when making superuser checks.
This moves our dependency on rx_identity from the private data structures
into the public header, so move the nested include accordingly.

Change-Id: I0f48b69d4ab758d8a4d76ebfb1daf3009c4fe060
Implement rxgk client security object routines

Also add rxgk_NegotiateSecurityObject, a routine that creates
an rxnull connection to a target server, obtains a token using
the GSSNegotiate RPC on that connection, and uses the resulting
token to make an rxgk connection to that same server.

Change-Id: Ic7e11b02cb1573cfdb6d11d4de9a77ab1c563262
Make libtool symbol lists generated files

That live in the object directory.  For rxgk, we will need to make
the symbol list depend on a configure option, and moving the symbol lists
to the build tree seems better than having to sprinkle
LT_LDLIB_shlib_missing all over the place.

Also add dependencies on the symbols file to libraries which were missing
them.

The actual symbol lists should not be changed by this commit.

Change-Id: I1aad960c9cbfd6e13ab336e3416b05ac654605e2
Build rxgk support into (shared) libafsrpc

The dependency on the GSSAPI library prevents adding rxgk support
elsewhere.

Because the inclusion is conditional, adjust the export symbol list
to match that same condition.

Change-Id: I76c0329ba842fb0d4d66534810b114a0813c90a0
BuildServerSecurityObjects allocate for rxgk

Don't do anything with it for now, just leave a place in the
array.

Change-Id: I304e0f6bcf7d3b2a2cb46c976f41e09809a436db
Let superuser identities be superusers

We have a special rx_identity_kind for superusers, let it actually
be useful for something.

Change-Id: I1d551ed8e5fcfd6bdc29c6c27eee4c2ae67e1a89
Add rxgk support to userok

Change-Id: I5da2a89532453b6bec61fc87218a61455e39f6f0