Add rxgk_crypto_rfc3961.c

rxgk wrappers around an external crypto library, in this case, our
in-tree rfc3961 library.  Primitives for encryption/decryption and
MIC/VerifyMIC, ways to generate and free rxgk_key objects, etc..

Change-Id: I7525086043baf54f5c3019b3f5ab3495760c4236
Add RXGK_NOW()

A quick routine to get the current timestamp.

Change-Id: I0051b5c8e5ad61e35431d97454bf2741daba90cb
Export {Get,Set}ServiceSpecific from liboafs_rx.la

rxgk will use service-specific data.

Change-Id: Id9e2d4b9920e771e1583b9362e61de6216c246b4
Add rxgk_util.c

A few helper routines for the security class implementation, and
routines to set and retrieve a getkey function from rx service-specific
data.

Change-Id: I395802b6c3b2436df4b00906544fc797f3e12e9b
Add rxgk_token.c

Routines for constructing tokens (both regular and printed), extracting
and decrypting tokens, and helpers therein.

Provide the ability to print a token using a given session key and
using a random session key; the former is useful for certain variants
of localauth wherein a dummy GSS negotiation is performed with the
same identity acting as initiator and acceptor.

Change-Id: I0cde7fd0cdf9a27777523cd502b21bdccef41dcc
Add rxgk_gss.c

All the routines which deal with GSSAPI types.
This is, in practice, how the client gets a token, and the server
backend for GSSNegotiate().

These routines are split out into a separate file, and their prototypes
hidden behind ifndef KERNEL, because we need to allow rxgk to be usable
in the absence of a gssapi library, which is the case in the kernel.

Provide a compatibility definition of GSS_C_PRF_KEY_FULL, as there
are known implementations in the wild that provide the function but
do not provide the keyusage constants.

Change-Id: Id2966de07853dd6a74cb40225851728d2422421c
Implement SRXGK_GSSNegotiate()

In-kernel we must fail; the userspace implementation is already
in the tree in rxgk_gss.c.

Change-Id: Id715e3287df5921a20aebe4e65259fd2097dc2b4
Add rxgk_packet.c

Routines to apply and verify encryption and MICs to the data in
rx packets.  Backend to the rxgk_crypto framework for the actual
crypto operations.

Change-Id: I724efacf7df1d688c0d61a327fa9ee9c8168d715
Implement the rxgk server routines

Provide non-trivial implementations of the security class routines
used by the server, along with helpers as necessary.

In addition to the normal NewServerSecurityObject routine, provide
wrappers NewServiceSecObj and NewEphemeralService_SecObj that create
the security object, create an rx service for the key negotiation service
needed for clients to negotiate tokens useful with this server security
object, and register the getkey function used for the security object
as service-specific data to be used when encrypting tokens produced by
this rx service.  The Ephemeral variant creates a random token-encrypting
key for use by the service, so no getkey routine needs to be supplied
by the caller.

The identity supplied in a client's token is given as a list of
PrAuthNames; we assume that at most one name is supplied at present,
as the meaning of compound identities (and the use of compound
identities for keyed cache managers) is not fully specified yet.
Convert the PrAuthName to an rx_identity for caching in the server
connection state, as the rx_identity type is more compatible with
superuser checks on the connection.

Also provide an rxgk_GetServerInfo routine which extracts the cached
identity, for use in libauth when making superuser checks.
This moves our dependency on rx_identity from the private data structures
into the public header, so move the nested include accordingly.

Change-Id: I0f48b69d4ab758d8a4d76ebfb1daf3009c4fe060
Implement rxgk client security object routines

Also add rxgk_NegotiateSecurityObject, a routine that creates
an rxnull connection to a target server, obtains a token using
the GSSNegotiate RPC on that connection, and uses the resulting
token to make an rxgk connection to that same server.

Change-Id: Ic7e11b02cb1573cfdb6d11d4de9a77ab1c563262
Implement SRXGK_CombineTokens

Most of the logic we need is already in place in rxgk_token.c; we just
need to pull out the token data structures, combine the identity lists,
and call into that code.

Change-Id: I68dd5dffab579d89601a55b8ed82961f8e12fc1b
Make libtool symbol lists generated files

That live in the object directory.  For rxgk, we will need to make
the symbol list depend on a configure option, and moving the symbol lists
to the build tree seems better than having to sprinkle
LT_LDLIB_shlib_missing all over the place.

Also add dependencies on the symbols file to libraries which were missing
them.

The actual symbol lists should not be changed by this commit.

Change-Id: I1aad960c9cbfd6e13ab336e3416b05ac654605e2
Build rxgk support into (shared) libafsrpc

The dependency on the GSSAPI library prevents adding rxgk support
elsewhere.

Because the inclusion is conditional, adjust the export symbol list
to match that same condition.

Change-Id: I76c0329ba842fb0d4d66534810b114a0813c90a0
BuildServerSecurityObjects allocate for rxgk

Don't do anything with it for now, just leave a place in the
array.

Change-Id: I304e0f6bcf7d3b2a2cb46c976f41e09809a436db
Let superuser identities be superusers

We have a special rx_identity_kind for superusers, let it actually
be useful for something.

Change-Id: I1d551ed8e5fcfd6bdc29c6c27eee4c2ae67e1a89
Add rxgk support to userok

Change-Id: I5da2a89532453b6bec61fc87218a61455e39f6f0
DO NOT MERGE

A snapshot of the pthread-bos bits, all squashed together.
Done so that subsequent commits adding rxgk support to bos/bosserver
can be pushed to gerrit without using a merge commit or adding a
fake dependency chain to one of the patch series.

Change-Id: I0245d598c12dc09a52da5cea26be2104cb826958
Register bosserver for rxgk

Add the server security object, using an ephemeral token-encrypting
key.  We rely on the local hostname being correctly set (and lowercase!)
to match the afs3-bos hostbased service acceptor identity.

Since we are adding a new service, set the number of processes that
will handle that service.

We need to add the GSSAPI CPPFLAGS to the CFLAGS for this module, as we
are not including the gssapi headers.

Change-Id: Ibacf16993d67349c59986ca3c62a0293c723ca67
Check for krb5_get_init_creds_opt_set_out_ccache

The forthcoming bos/rxgk/localauth code will use it.
I am told that the routine it is used in is only needed for MIT krb5,
as Heimdal's gssapi library will fetch initiator credentials from the
default keytab by default.  Since set_out_ccache is only provided
on MIT krb5, that is rather fortuitous.

Change-Id: I68576ea791f6f2253e082b23bb3a82e6bb624bc4
bos: add support for rxgk

While rxgk is experimental, add a new argument -rxgk to attempt
the use of rxgk.  -localauth is supported by using the acceptor
credentials as an initiator and self-negotiating.

afsconf_PickClientSecObj doesn't know about rxgk yet, so we need
to have our own separate control flow for the rxgk case.  This
will be fixed eventually, but it's not clear what the right API
for PickClientSecObj is, yet.

Change-Id: I7af099cfe53c844f96959c904c33ca632c0d3e57