1
  
2
  
3
  
4
  
5
  
6
  
7
  
8
  
9
  
10
  
11
  
12
  
13
  
14
  
15
  
16
  
17
  
18
  
19
  
20
  
21
  
22
  
23
  
24
  
25
  
26
  
27
  
28
  
29
  
30
  
31
  
32
  
33
  
34
  
35
  
36
  
37
  
38
  
39
  
40
  
41
  
42
  
43
  
44
  
45
  
46
  
47
  
48
  
49
  
50
  
51
  
52
  
53
  
54
  
55
  
56
  
57
  
58
  
59
  
60
  
61
  
62
  
63
  
64
  
65
  
66
  
67
  
68
  
69
  
70
  
71
  
72
  
73
  
74
  
75
  
76
  
77
  
78
  
79
  
80
  
81
  
82
  
83
  
84
  
85
  
86
  
87
  
88
  
89
  
90
  
91
  
92
  
93
  
94
  
95
  
96
  
97
  
98
  
99
  
100
  
101
  
102
  
103
  
104
  
105
  
106
  
107
  
108
  
109
  
110
  
111
  
112
  
113
  
114
  
115
  
116
  
117
  
118
  
119
  
120
  
121
  
122
  
123
  
124
  
125
  
126
  
127
  
128
  
129
  
130
  
131
  
132
  
133
  
134
  
135
  
136
  
137
  
138
  
139
  
140
  
141
  
142
  
143
  
144
  
145
  
146
  
147
  
148
  
149
  
150
  
151
  
152
  
153
  
154
  
155
  
156
  
157
  
158
  
159
  
160
  
161
  
162
  
163
  
164
  
165
  
166
  
167
  
168
  
169
  
170
  
171
  
172
  
173
  
174
  
175
  
176
  
177
  
178
  
179
  
180
  
181
  
182
  
183
  
184
  
185
  
186
  
187
  
188
  
189
  
190
  
191
  
192
  
193
  
194
  
195
  
196
  
197
  
198
  
199
  
200
  
201
  
202
  
203
  
204
  
205
  
206
  
207
  
208
  
209
  
210
  
211
  
212
  
213
  
214
  
215
  
216
  
217
  
218
  
219
  
220
  
221
  
222
  
223
  
224
  
225
  
226
  
227
  
228
  
229
  
230
  
231
  
232
  
233
  
234
  
235
  
236
  
237
  
238
  
239
  
240
  
241
  
242
  
243
  
244
  
245
  
246
  
247
  
248
  
249
  
250
  
251
  
252
  
253
  
254
  
255
  
256
  
257
  
258
  
259
  
260
  
261
  
262
  
263
  
264
  
265
  
266
  
267
  
268
  
269
  
270
  
271
  
272
  
273
  
274
  
275
  
276
  
277
  
278
  
279
  
280
  
281
  
282
  
283
  
284
  
285
  
286
  
287
  
288
  
289
  
290
  
291
  
292
  
293
  
294
  
295
  
296
  
297
  
298
  
299
  
300
  
301
  
302
  
303
  
304
  
305
  
306
  
307
  
308
  
309
  
310
  
311
  
312
  
313
  
314
  
315
  
316
  
317
  
318
  
319
  
320
  
321
  
322
  
323
  
324
  
325
  
326
  
327
  
328
  
329
  
330
  
331
  
332
  
333
  
334
  
335
  
336
  
337
  
338
  
339
  
340
  
341
  
342
  
343
  
344
  
345
  
346
  
347
  
348
  
349
  
350
  
351
  
352
  
353
  
354
  
355
  
356
  
357
  
358
  
359
  
360
  
361
  
362
  
363
  
364
  
365
  
366
  
367
  
368
  
369
  
370
  
371
  
372
  
373
  
374
  
375
  
376
  
377
  
378
  
379
  
380
  
381
  
382
  
383
  
384
  
385
  
386
  
387
  
388
  
389
  
390
  
391
  
392
  
393
  
394
  
395
  
396
  
397
  
398
  
399
  
400
  
401
  
402
  
403
  
404
  
405
  
406
  
407
  
408
  
409
  
410
  
411
  
412
  
413
  
414
  
415
  
416
  
417
  
418
  
419
  
420
  
421
  
422
  
423
  
424
  
425
  
426
  
427
  
428
  
429
  
430
  
431
  
432
  
433
  
434
  
435
  
436
  
437
  
438
  
439
  
440
  
441
  
442
  
443
  
444
  
445
  
446
  
447
  
448
  
449
  
450
  
451
  
452
  
453
  
454
  
455
  
456
  
457
  
458
  
459
  
460
  
461
  
462
  
463
  
464
  
465
  
466
  
467
  
468
  
469
  
470
  
471
  
472
  
473
  
474
  
475
  
476
  
477
  
478
  
479
  
480
  
481
  
482
  
483
  
484
  
485
  
486
  
487
  
488
  
489
  
490
  
491
  
492
  
493
  
494
  
495
  
496
  
497
  
498
  
499
  
500
  
501
  
502
  
503
  
504
  
505
  
506
  
507
  
508
  
509
  
510
  
511
  
512
  
513
  
514
  
515
  
516
  
517
  
518
  
519
  
520
  
521
  
522
  
523
  
524
  
525
  
526
  
527
  
528
  
529
  
530
  
531
  
532
  
533
  
534
  
535
  
536
  
537
  
538
  
539
  
540
  
541
  
542
  
543
  
544
  
545
  
546
  
547
  
548
  
549
  
550
  
551
  
552
  
553
  
554
  
555
  
556
  
557
  
558
  
559
  
560
  
561
  
562
  
563
  
564
  
565
  
566
  
567
  
568
  
569
  
570
  
571
  
572
  
573
  
574
  
575
  
576
  
577
  
578
  
579
  
580
  
581
  
582
  
583
  
584
  
585
  
586
  
587
  
588
  
589
  
590
  
591
  
592
  
593
  
594
  
595
  
596
  
597
  
598
  
599
  
600
  
601
  
602
  
603
  
604
  
605
  
606
  
607
  
608
  
609
  
610
  
611
  
612
  
613
  
614
  
615
  
616
  
617
  
618
  
619
  
620
  
621
  
622
  
623
  
624
  
625
  
626
  
627
  
628
  
629
  
630
  
631
  
632
  
633
  
634
  
635
  
636
  
637
  
638
  
639
  
640
  
641
  
642
  
643
  
644
  
645
  
646
  
647
  
648
  
649
  
650
  
651
  
652
  
653
  
654
  
655
  
656
  
657
  
658
  
659
  
660
  
661
  
662
  
663
  
664
  
665
  
666
  
667
  
668
  
669
  
670
  
671
  
672
  
673
  
674
  
675
  
676
  
677
  
678
  
679
  
680
  
681
  
682
  
683
  
684
  
685
  
686
  
687
  
688
  
689
  
690
  
691
  
692
  
693
  
694
  
695
  
696
  
697
  
698
  
699
  
700
  
701
  
702
  
703
  
704
  
705
  
706
  
707
  
708
  
709
  
710
  
711
  
712
  
713
  
714
  
715
  
716
  
717
  
718
  
719
  
720
  
721
  
722
  
723
  
724
  
725
  
726
  
727
  
728
  
729
  
730
  
731
  
732
  
733
  
734
  
735
  
736
  
737
  
738
  
739
  
740
  
741
  
742
  
743
  
744
  
745
  
746
  
747
  
748
  
749
  
750
  
751
  
752
  
753
  
754
  
755
  
756
  
757
  
758
  
759
  
760
  
761
  
762
  
763
  
764
  
765
  
766
  
767
  
768
  
769
  
770
  
771
  
772
  
773
  
774
  
775
  
776
  
777
  
778
  
779
  
780
  
781
  
782
  
783
  
784
  
785
  
786
  
787
  
788
  
789
  
790
  
791
  
792
  
793
  
794
  
795
  
796
  
797
  
798
  
799
  
800
  
801
  
802
  
803
  
804
  
805
  
806
  
807
  
808
  
809
  
810
  
811
  
812
  
813
  
814
  
815
  
816
  
817
  
818
  
819
  
820
  
821
  
822
  
823
  
824
  
825
  
826
  
827
  
828
  
829
  
830
  
831
  
832
  
833
  
834
  
835
  
836
  
837
  
838
  
839
  
840
  
841
  
842
  
843
  
844
  
845
  
846
  
847
  
848
  
849
  
850
  
851
  
852
  
853
  
854
  
855
  
856
  
857
  
858
  
859
  
860
  
861
  
862
  
863
  
864
  
865
  
866
  
867
  
868
  
869
  
870
  
871
  
872
  
873
  
874
  
875
  
876
  
877
  
878
  
879
  
880
  
881
  
882
  
883
  
884
  
885
  
886
  
887
  
888
  
889
  
890
  
891
  
892
  
893
  
894
  
895
  
896
  
897
  
898
  
899
  
900
  
901
  
902
  
903
  
904
  
905
  
906
  
907
  
908
  
909
  
910
  
911
  
912
  
913
  
914
  
915
  
916
  
917
  
918
  
919
  
920
  
921
  
922
  
923
  
924
  
925
  
926
  
927
  
928
  
929
  
930
  
931
  
932
  
933
  
934
  
935
  
936
  
937
  
938
  
939
  
940
  
941
  
942
  
943
  
944
  
945
  
946
  
947
  
948
  
949
  
950
  
951
  
952
  
953
  
954
  
955
  
956
  
957
  
958
  
959
  
960
  
961
  
962
  
963
  
964
  
965
  
966
  
967
  
968
  
969
  
970
  
971
  
972
  
973
  
974
  
975
  
976
  
977
  
978
  
979
  
980
  
981
  
982
  
983
  
984
  
985
  
986
  
987
  
988
  
989
  
990
  
991
  
992
  
993
  
994
  
995
  
996
  
997
  
998
  
999
  
1000
  
1001
  
1002
  
1003
  
1004
  
1005
  
1006
  
1007
  
1008
  
1009
  
1010
  
1011
  
1012
  
1013
  
1014
  
1015
  
1016
  
1017
  
1018
  
1019
  
1020
  
1021
  
1022
  
1023
  
1024
  
1025
  
1026
  
1027
  
1028
  
1029
  
1030
  
1031
  
1032
  
1033
  
1034
  
1035
  
1036
  
1037
  
1038
  
1039
  
1040
  
1041
  
1042
  
1043
  
1044
  
1045
  
1046
  
1047
  
1048
  
1049
  
1050
  
1051
  
1052
  
1053
  
1054
  
1055
  
1056
  
1057
  
1058
  
1059
  
1060
  
1061
  
1062
  
1063
  
1064
  
1065
  
1066
  
1067
  
1068
  
1069
  
1070
  
1071
  
1072
  
1073
  
1074
  
1075
  
1076
  
1077
  
1078
  
1079
  
1080
  
1081
  
1082
  
1083
  
1084
  
1085
  
1086
  
1087
  
1088
  
1089
  
1090
  
1091
  
1092
  
1093
  
1094
  
1095
  
1096
  
1097
  
1098
  
1099
  
1100
  
1101
  
1102
  
1103
  
1104
  
1105
  
1106
  
1107
  
1108
  
1109
  
1110
  
1111
  
1112
  
1113
  
1114
  
1115
  
1116
  
1117
  
1118
  
1119
  
1120
  
1121
  
1122
  
1123
  
1124
  
1125
  
1126
  
1127
  
1128
  
1129
  
1130
  
1131
  
1132
  
1133
  
1134
  
1135
  
1136
  
1137
  
1138
  
1139
  
1140
  
1141
  
1142
  
1143
  
1144
  
1145
  
1146
  
1147
  
1148
  
1149
  
1150
  
1151
  
1152
  
1153
  
1154
  
1155
  
1156
  
1157
  
1158
  
1159
  
1160
  
1161
  
1162
  
1163
  
1164
  
1165
  
1166
  
1167
  
1168
  
1169
  
1170
  
1171
  
1172
  
1173
  
1174
  
1175
  
1176
  
1177
  
1178
  
1179
  
1180
  
1181
  
1182
  
1183
  
1184
  
1185
  
1186
  
1187
  
1188
  
1189
  
1190
  
1191
  
1192
  
1193
  
1194
  
1195
  
1196
  
1197
  
1198
  
1199
  
1200
  
1201
  
1202
  
1203
  
1204
  
1205
  
1206
  
1207
  
1208
  
1209
  
1210
  
1211
  
1212
  
1213
  
1214
  
1215
  
1216
  
1217
  
1218
  
1219
  
1220
  
1221
  
1222
  
1223
  
1224
  
1225
  
1226
  
1227
  
1228
  
1229
  
1230
  
1231
  
1232
  
1233
  
1234
  
1235
  
1236
  
1237
  
1238
  
1239
  
1240
  
1241
  
1242
  
1243
  
1244
  
1245
  
1246
  
1247
  
1248
  
1249
  
1250
  
1251
  
1252
  
1253
  
1254
  
1255
  
1256
  
1257
  
1258
  
1259
  
1260
  
1261
  
1262
  
1263
  
1264
  
1265
  
1266
  
1267
  
1268
  
1269
  
1270
  
1271
  
1272
  
1273
  
1274
  
1275
  
1276
  
1277
  
1278
  
1279
  
1280
  
1281
  
1282
  
1283
  
1284
  
1285
  
1286
  
1287
  
1288
  
1289
  
1290
  
1291
  
1292
  
1293
  
1294
  
1295
  
1296
  
1297
  
1298
  
1299
  
1300
  
1301
  
1302
  
1303
  
1304
  
1305
  
1306
  
1307
  
1308
  
1309
  
1310
  
1311
  
1312
  
1313
  
1314
  
1315
  
1316
  
1317
  
1318
  
1319
  
1320
  
1321
  
1322
  
1323
  
1324
  
1325
  
1326
  
1327
  
1328
  
1329
  
1330
  
1331
  
1332
  
1333
  
1334
  
1335
  
1336
  
1337
  
1338
  
1339
  
1340
  
1341
  
1342
  
1343
  
1344
  
1345
  
1346
  
1347
  
1348
  
1349
  
1350
  
1351
  
1352
  
1353
  
1354
  
1355
  
1356
  
1357
  
1358
  
1359
  
1360
  
1361
  
1362
  
1363
  
1364
  
1365
  
1366
  
1367
  
1368
  
1369
  
1370
  
1371
  
1372
  
1373
  
1374
  
1375
  
1376
  
1377
  
1378
  
1379
  
1380
  
1381
  
1382
  
1383
  
1384
  
1385
  
1386
  
1387
  
1388
  
1389
  
1390
  
1391
  
1392
  
1393
  
1394
  
1395
  
1396
  
1397
  
1398
  
1399
  
1400
  
1401
  
1402
  
1403
  
1404
  
1405
  
1406
  
1407
  
1408
  
1409
  
1410
  
1411
  
1412
  
1413
  
1414
  
1415
  
1416
  
1417
  
1418
  
1419
  
1420
  
1421
  
1422
  
1423
  
1424
  
1425
  
1426
  
1427
  
1428
  
1429
  
1430
  
1431
  
1432
  
1433
  
1434
  
1435
  
1436
  
1437
  
1438
  
1439
  
1440
  
1441
  
1442
  
1443
  
1444
  
1445
  
1446
  
1447
  
1448
  
1449
  
1450
  
1451
  
1452
  
1453
  
1454
  
1455
  
1456
  
1457
  
1458
  
1459
  
1460
  
1461
  
1462
  
1463
  
1464
  
1465
  
1466
  
1467
  
1468
  
1469
  
1470
  
1471
  
1472
  
1473
  
1474
  
1475
  
1476
  
1477
  
1478
  
1479
  
1480
  
1481
  
1482
  
1483
  
1484
  
1485
  
1486
  
1487
  
1488
  
1489
  
1490
  
1491
  
1492
  
1493
  
1494
  
1495
  
1496
  
1497
  
1498
  
1499
  
1500
  
1501
  
1502
  
1503
  
1504
  
1505
  
1506
  
1507
  
1508
  
1509
  
1510
  
1511
  
1512
  
1513
  
1514
  
1515
  
1516
  
1517
  
1518
  
1519
  
1520
  
1521
  
1522
  
1523
  
1524
  
1525
  
1526
  
1527
  
1528
  
1529
  
1530
  
1531
  
1532
  
1533
  
1534
  
1535
  
1536
  
1537
  
1538
  
1539
  
1540
  
1541
  
1542
  
1543
  
1544
  
1545
  
1546
  
1547
  
1548
  
1549
  
1550
  
1551
  
1552
  
1553
  
1554
  
1555
  
1556
  
1557
  
1558
  
1559
  
1560
  
1561
  
1562
  
1563
  
1564
  
1565
  
1566
  
1567
  
1568
  
1569
  
1570
  
1571
  
1572
  
1573
  
1574
  
1575
  
1576
  
1577
  
1578
  
1579
  
1580
  
1581
  
1582
  
1583
  
1584
  
1585
  
1586
  
1587
  
1588
  
1589
  
1590
  
1591
  
1592
  
1593
  
1594
  
1595
  
1596
  
1597
  
1598
  
1599
  
1600
  
1601
  
1602
  
1603
  
1604
  
1605
  
1606
  
1607
  
1608
  
1609
  
1610
  
1611
  
1612
  
1613
  
1614
  
1615
  
1616
  
1617
  
1618
  
1619
  
1620
  
1621
  
1622
  
1623
  
1624
  
1625
  
1626
  
1627
  
1628
  
1629
  
1630
  
1631
  
1632
  
1633
  
1634
  
1635
  
1636
  
1637
  
1638
  
1639
  
1640
  
1641
  
1642
  
1643
  
1644
  
1645
  
1646
  
1647
  
1648
  
1649
  
1650
  
1651
  
1652
  
1653
  
1654
  
1655
  
1656
  
1657
  
1658
  
1659
  
1660
  
1661
  
1662
  
1663
  
1664
  
1665
  
1666
  
1667
  
1668
  
1669
  
1670
  
1671
  
1672
  
1673
  
1674
  
1675
  
1676
  
1677
  
1678
  
1679
  
1680
  
1681
  
1682
  
1683
  
1684
  
1685
  
1686
  
1687
  
1688
  
1689
  
1690
  
1691
  
1692
  
1693
  
1694
  
1695
  
1696
  
1697
  
1698
  
1699
  
1700
  
1701
  
1702
  
1703
  
1704
  
1705
  
1706
  
1707
  
1708
  
1709
  
1710
  
1711
  
1712
  
1713
  
1714
  
1715
  
1716
  
1717
  
1718
  
1719
  
1720
  
1721
  
1722
  
1723
  
1724
  
1725
  
1726
  
1727
  
1728
  
1729
  
1730
  
1731
  
1732
  
1733
  
1734
  
1735
  
1736
  
1737
  
1738
  
1739
  
1740
  
1741
  
1742
  
1743
  
1744
  
1745
  
1746
  
1747
  
1748
  
1749
  
1750
  
1751
  
1752
  
1753
  
1754
  
1755
  
1756
  
1757
  
1758
  
1759
  
1760
  
1761
  
1762
  
1763
  
1764
  
1765
  
1766
  
1767
  
1768
  
1769
  
1770
  
1771
  
1772
  
1773
  
1774
  
1775
  
1776
  
1777
  
1778
  
1779
  
1780
  
1781
  
1782
  
1783
  
1784
  
1785
  
1786
  
1787
  
1788
  
1789
  
1790
  
1791
  
1792
  
1793
  
1794
  
1795
  
1796
  
1797
  
1798
  
1799
  
1800
  
1801
  
1802
  
1803
  
1804
  
1805
  
1806
  
1807
  
1808
  
1809
  
1810
  
1811
  
1812
  
1813
  
1814
  
1815
  
1816
  
1817
  
1818
  
1819
  
1820
  
1821
  
1822
  
1823
  
1824
  
1825
  
1826
  
1827
  
1828
  
1829
  
1830
  
1831
  
1832
  
1833
  
1834
  
1835
  
1836
  
1837
  
1838
  
1839
  
1840
  
1841
  
1842
  
1843
  
1844
  
1845
  
1846
  
1847
  
1848
  
1849
  
1850
  
1851
  
1852
  
1853
  
1854
  
1855
  
1856
  
1857
  
1858
  
1859
  
1860
  
1861
  
1862
  
1863
  
1864
  
1865
  
1866
  
1867
  
1868
  
1869
  
1870
  
1871
  
1872
  
1873
  
1874
  
1875
  
1876
  
1877
  
1878
  
1879
  
1880
  
1881
  
1882
  
1883
  
1884
  
1885
  
1886
  
1887
  
1888
  
1889
  
1890
  
1891
  
1892
  
1893
  
1894
  
1895
  
1896
  
1897
  
1898
  
1899
  
1900
  
1901
  
1902
  
1903
  
1904
  
1905
  
1906
  
1907
  
1908
  
1909
  
1910
  
1911
  
1912
  
1913
  
1914
  
1915
  
1916
  
1917
  
1918
  
1919
  
1920
  
1921
  
1922
  
1923
  
1924
  
1925
  
1926
  
1927
  
1928
  
1929
  
1930
  
1931
  
1932
  
1933
  
1934
  
1935
  
1936
  
1937
  
1938
  
1939
  
1940
  
1941
  
1942
  
1943
  
1944
  
1945
  
1946
  
1947
  
1948
  
1949
  
1950
  
1951
  
1952
  
1953
  
1954
  
1955
  
1956
  
1957
  
1958
  
1959
  
1960
  
1961
  
1962
  
1963
  
1964
  
1965
  
1966
  
1967
  
1968
  
1969
  
1970
  
1971
  
1972
  
1973
  
1974
  
1975
  
1976
  
1977
  
1978
  
1979
  
1980
  
1981
  
1982
  
1983
  
1984
  
1985
  
1986
  
1987
  
1988
  
1989
  
1990
  
1991
  
1992
  
1993
  
1994
  
1995
  
1996
  
1997
  
1998
  
1999
  
2000
  
2001
  
2002
  
2003
  
2004
  
2005
  
2006
  
2007
  
2008
  
2009
  
2010
  
2011
  
2012
  
2013
  
2014
  
2015
  
2016
  
2017
  
2018
  
2019
  
2020
  
2021
  
2022
  
2023
  
2024
  
2025
  
2026
  
2027
  
2028
  
2029
  
2030
  
2031
  
2032
  
2033
  
2034
  
2035
  
2036
  
2037
  
2038
  
2039
  
2040
  
2041
  
2042
  
2043
  
2044
  
2045
  
2046
  
2047
  
2048
  
2049
  
2050
  
2051
  
2052
  
2053
  
2054
  
2055
  
2056
  
2057
  
2058
  
2059
  
2060
  
2061
  
2062
  
2063
  
2064
  
2065
  
2066
  
2067
  
2068
  
2069
  
2070
  
2071
  
2072
  
2073
  
2074
  
2075
  
2076
  
2077
  
2078
  
2079
  
2080
  
2081
  
2082
  
2083
  
2084
  
2085
  
2086
  
2087
  
2088
  
2089
  
2090
  
2091
  
2092
  
2093
  
2094
  
2095
  
2096
  
2097
  
2098
  
2099
  
2100
  
2101
  
2102
  
2103
  
2104
  
2105
  
2106
  
2107
  
2108
  
2109
  
2110
  
2111
  
2112
  
2113
  
2114
  
2115
  
2116
  
2117
  
2118
  
2119
  
2120
  
2121
  
2122
  
2123
  
2124
  
2125
  
2126
  
2127
  
2128
  
2129
  
2130
  
2131
  
2132
  
2133
  
2134
  
2135
  
2136
  
2137
  
2138
  
2139
  
2140
  
2141
  
2142
  
2143
  
2144
  
2145
  
2146
  
2147
  
2148
  
2149
  
2150
  
2151
  
2152
  
2153
  
2154
  
2155
  
2156
  
2157
  
2158
  
2159
  
2160
  
2161
  
2162
  
2163
  
2164
  
2165
  
2166
  
2167
  
2168
  
2169
  
2170
  
2171
  
2172
  
2173
  
2174
  
2175
  
2176
  
2177
  
2178
  
2179
  
2180
  
2181
  
2182
  
2183
  
2184
  
2185
  
2186
  
2187
  
2188
  
2189
  
2190
  
2191
  
2192
  
2193
  
2194
  
2195
  
2196
  
2197
  
2198
  
2199
  
2200
  
2201
  
2202
  
2203
  
2204
  
2205
  
2206
  
2207
  
2208
  
2209
  
2210
  
2211
  
2212
  
2213
  
2214
  
2215
  
2216
  
2217
  
2218
  
2219
  
2220
  
2221
  
2222
  
2223
  
2224
  
2225
  
2226
  
2227
  
2228
  
2229
  
2230
  
2231
  
2232
  
2233
  
2234
  
2235
  
2236
  
2237
  
2238
  
2239
  
2240
  
2241
  
2242
  
2243
  
2244
  
2245
  
2246
  
2247
  
2248
  
2249
  
2250
  
2251
  
2252
  
2253
  
2254
  
2255
  
2256
  
2257
  
2258
  
2259
  
2260
  
2261
  
2262
  
2263
  
2264
  
2265
  
2266
  
2267
  
2268
  
2269
  
2270
  
2271
  
2272
  
2273
  
2274
  
2275
  
2276
  
2277
  
2278
  
2279
  
2280
  
2281
  
2282
  
2283
  
2284
  
2285
  
2286
  
2287
  
2288
  
2289
  
2290
  
2291
  
2292
  
2293
  
2294
  
2295
  
2296
  
2297
  
2298
  
2299
  
2300
  
2301
  
2302
  
2303
  
2304
  
2305
  
2306
  
2307
  
2308
  
2309
  
2310
  
2311
  
2312
  
2313
  
2314
  
2315
  
2316
  
2317
  
2318
  
2319
  
2320
  
2321
  
2322
  
2323
  
2324
  
2325
  
2326
  
2327
  
2328
  
2329
  
2330
  
2331
  
2332
  
2333
  
2334
  
2335
  
2336
  
2337
  
2338
  
2339
  
2340
  
2341
  
2342
  
2343
  
2344
  
2345
  
2346
  
2347
  
2348
  
2349
  
2350
  
2351
  
2352
  
2353
  
2354
  
2355
  
2356
  
2357
  
2358
  
2359
  
2360
  
2361
  
2362
  
2363
  
2364
  
2365
  
2366
  
2367
  
2368
  
2369
  
2370
  
2371
  
2372
  
2373
  
2374
  
2375
  
2376
  
2377
  
2378
  
2379
  
2380
  
2381
  
2382
  
2383
  
2384
  
2385
  
2386
  
2387
  
2388
  
2389
  
2390
  
2391
  
2392
  
2393
  
2394
  
2395
  
2396
  
2397
  
2398
  
2399
  
2400
  
2401
  
2402
  
2403
  
2404
  
2405
  
2406
  
2407
  
2408
  
2409
  
2410
  
2411
  
2412
  
2413
  
2414
  
2415
  
2416
  
2417
  
2418
  
2419
  
2420
  
2421
  
2422
  
2423
  
2424
  
2425
  
2426
  
2427
  
2428
  
2429
  
2430
  
2431
  
2432
  
2433
  
2434
  
2435
  
2436
  
2437
  
2438
  
2439
  
2440
  
2441
  
2442
  
2443
  
2444
  
2445
  
2446
  
2447
  
2448
  
2449
  
2450
  
2451
  
2452
  
2453
  
2454
  
2455
  
2456
  
2457
  
2458
  
2459
  
2460
  
2461
  
2462
  
2463
  
2464
  
2465
  
2466
  
2467
  
2468
  
2469
  
2470
  
2471
  
2472
  
2473
  
2474
  
2475
  
2476
  
2477
  
2478
  
2479
  
2480
  
2481
  
2482
  
2483
  
2484
  
2485
  
2486
  
2487
  
2488
  
2489
  
2490
  
2491
  
2492
  
2493
  
2494
  
2495
  
2496
  
2497
  
2498
  
2499
  
2500
  
2501
  
2502
  
2503
  
2504
  
2505
  
2506
  
2507
  
2508
  
2509
  
2510
  
2511
  
2512
  
2513
  
2514
  
2515
  
2516
  
2517
  
2518
  
2519
  
2520
  
2521
  
2522
  
2523
  
2524
  
2525
  
2526
  
2527
  
2528
  
2529
  
2530
  
2531
  
2532
  
2533
  
2534
  
2535
  
2536
  
2537
  
2538
  
2539
  
2540
  
2541
  
2542
  
2543
  
2544
  
2545
  
2546
  
2547
  
2548
  
2549
  
2550
  
2551
  
2552
  
2553
  
2554
  
2555
  
2556
  
2557
  
2558
  
2559
  
2560
  
2561
  
2562
  
2563
  
2564
  
2565
  
2566
  
2567
  
2568
  
2569
  
2570
  
2571
  
2572
  
2573
  
2574
  
2575
  
2576
  
2577
  
2578
  
2579
  
2580
  
2581
  
2582
  
2583
  
2584
  
2585
  
2586
  
2587
  
2588
  
2589
  
2590
  
2591
  
2592
  
2593
  
2594
  
2595
  
2596
  
2597
  
2598
  
2599
  
2600
  
2601
  
2602
  
2603
  
2604
  
2605
  
2606
  
2607
  
2608
  
2609
  
2610
  
2611
  
2612
  
2613
  
2614
  
2615
  
2616
  
2617
  
2618
  
2619
  
2620
  
2621
  
2622
  
2623
  
2624
  
2625
  
2626
  
2627
  
2628
  
2629
  
2630
  
2631
  
2632
  
2633
  
2634
  
2635
  
2636
  
2637
  
2638
  
2639
  
2640
  
2641
  
2642
  
2643
  
2644
  
2645
  
2646
  
2647
  
2648
  
2649
  
2650
  
2651
  
2652
  
2653
  
2654
  
2655
  
2656
  
2657
  
2658
  
2659
  
2660
  
2661
  
2662
  
2663
  
2664
  
2665
  
2666
  
2667
  
2668
  
2669
  
2670
  
2671
  
2672
  
2673
  
2674
  
2675
  
2676
  
2677
  
2678
  
2679
  
2680
  
2681
  
2682
  
2683
  
2684
  
2685
  
2686
  
2687
  
2688
  
2689
  
2690
  
2691
  
2692
  
2693
  
2694
  
2695
  
2696
  
2697
  
2698
  
2699
  
2700
  
2701
  
2702
  
2703
  
2704
  
2705
  
2706
  
2707
  
2708
  
2709
  
2710
  
2711
  
2712
  
2713
  
2714
  
2715
  
2716
  
2717
  
2718
  
2719
  
2720
  
2721
  
2722
  
2723
  
2724
  
2725
  
2726
  
2727
  
2728
  
2729
  
2730
  
2731
  
2732
  
2733
  
2734
  
2735
  
2736
  
2737
  
2738
  
2739
  
2740
  
2741
  
2742
  
2743
  
2744
  
2745
  
2746
  
2747
  
2748
  
2749
  
2750
  
2751
  
2752
  
2753
  
2754
  
2755
  
2756
  
2757
  
2758
  
2759
  
2760
  
2761
  
2762
  
2763
  
2764
  
2765
  
2766
  
2767
  
2768
  
2769
  
2770
  
2771
  
2772
  
2773
  
2774
  
2775
  
2776
  
2777
  
2778
  
2779
  
2780
  
2781
  
2782
  
2783
  
2784
  
2785
  
2786
  
2787
  
2788
  
2789
  
2790
  
2791
  
2792
  
2793
  
2794
  
2795
  
2796
  
2797
  
2798
  
2799
  
2800
  
2801
  
2802
  
2803
  
2804
  
2805
  
2806
  
2807
  
2808
  
2809
  
2810
  
2811
  
2812
  
2813
  
2814
  
2815
  
2816
  
2817
  
2818
  
2819
  
2820
  
2821
  
2822
  
2823
  
2824
  
2825
  
2826
  
2827
  
2828
  
2829
  
2830
  
2831
  
2832
  
2833
  
2834
  
2835
  
2836
  
2837
  
2838
  
2839
  
2840
  
2841
  
2842
  
2843
  
2844
  
2845
  
2846
  
2847
  
2848
  
2849
  
2850
  
2851
  
2852
  
2853
  
2854
  
2855
  
2856
  
2857
  
2858
  
2859
  
2860
  
2861
  
2862
  
2863
  
2864
  
2865
  
2866
  
2867
  
2868
  
2869
  
2870
  
2871
  
2872
  
2873
  
2874
  
2875
  
2876
  
2877
  
2878
  
2879
  
2880
  
2881
  
2882
  
2883
  
2884
  
2885
  
2886
  
2887
  
2888
  
2889
  
2890
  
2891
  
2892
  
2893
  
2894
  
2895
  
2896
  
2897
  
2898
  
2899
  
2900
  
2901
  
2902
  
2903
  
2904
  
2905
  
2906
  
2907
  
2908
  
2909
  
2910
  
2911
  
2912
  
2913
  
2914
  
2915
  
2916
  
2917
  
2918
  
2919
  
2920
  
2921
  
2922
  
2923
  
2924
  
2925
  
2926
  
2927
  
2928
  
2929
  
2930
  
2931
  
2932
  
2933
  
2934
  
2935
  
2936
  
2937
  
2938
  
2939
  
2940
  
2941
  
2942
  
2943
  
2944
  
2945
  
2946
  
2947
  
2948
  
2949
  
2950
  
2951
  
2952
  
2953
  
2954
  
2955
  
2956
  
2957
  
2958
  
2959
  
2960
  
2961
  
2962
  
2963
  
2964
  
2965
  
2966
  
2967
  
2968
  
2969
  
2970
  
2971
  
2972
  
2973
  
2974
  
2975
  
2976
  
2977
  
2978
  
2979
  
2980
  
2981
  
2982
  
2983
  
2984
  
2985
  
2986
  
2987
  
2988
  
2989
  
2990
  
2991
  
2992
  
2993
  
2994
  
2995
  
2996
  
2997
  
2998
  
2999
  
3000
  
3001
  
3002
  
3003
  
3004
  
3005
  
3006
  
3007
  
3008
  
3009
  
3010
  
3011
  
3012
  
3013
  
3014
  
3015
  
3016
  
3017
  
3018
  
3019
  
3020
  
3021
  
3022
  
3023
  
3024
  
3025
  
3026
  
3027
  
3028
  
3029
  
3030
  
3031
  
3032
  
3033
  
3034
  
3035
  
3036
  
3037
  
3038
  
3039
  
3040
  
3041
  
3042
  
3043
  
3044
  
3045
  
3046
  
3047
  
3048
  
3049
  
3050
  
3051
  
3052
  
3053
  
3054
  
3055
  
3056
  
3057
  
3058
  
3059
  
3060
  
3061
  
3062
  
3063
  
3064
  
3065
  
3066
  
3067
  
3068
  
3069
  
3070
  
3071
  
3072
  
3073
  
3074
  
3075
  
3076
  
3077
  
3078
  
3079
  
3080
  
3081
  
3082
  
3083
  
3084
  
3085
  
3086
  
3087
  
3088
  
3089
  
3090
  
3091
  
3092
  
3093
  
3094
  
3095
  
3096
  
3097
  
3098
  
3099
  
3100
  
3101
  
3102
  
3103
  
3104
  
3105
  
3106
  
3107
  
3108
  
3109
  
3110
  
3111
  
3112
  
3113
  
3114
  
3115
  
3116
  
3117
  
3118
  
3119
  
3120
  
3121
  
3122
  
3123
  
3124
  
3125
  
3126
  
3127
  
3128
  
3129
  
3130
  
3131
  
3132
  
3133
  
3134
  
3135
  
3136
  
3137
  
3138
  
3139
  
3140
  
3141
  
3142
  
3143
  
3144
  
3145
  
3146
  
3147
  
3148
  
3149
  
3150
  
3151
  
3152
  
3153
  
3154
  
3155
  
3156
  
3157
  
3158
  
3159
  
3160
  
3161
  
3162
  
3163
  
3164
  
3165
  
3166
  
3167
  
3168
  
3169
  
3170
  
3171
  
3172
  
3173
  
3174
  
3175
  
3176
  
3177
  
3178
  
3179
  
3180
  
3181
  
3182
  
3183
  
3184
  
3185
  
3186
  
3187
  
3188
  
3189
  
3190
  
3191
  
3192
  
3193
  
3194
  
3195
  
3196
  
3197
  
3198
  
3199
  
3200
  
3201
  
3202
  
3203
  
3204
  
3205
  
3206
  
3207
  
3208
  
3209
  
3210
  
3211
  
3212
  
3213
  
3214
  
3215
  
3216
  
3217
  
3218
  
3219
  
3220
  
3221
  
3222
  
3223
  
3224
  
3225
  
3226
  
3227
  
3228
  
3229
  
3230
  
3231
  
3232
  
3233
  
3234
  
3235
  
3236
  
3237
  
3238
  
3239
  
3240
  
3241
  
3242
  
3243
  
3244
  
3245
  
3246
  
3247
  
3248
  
3249
  
3250
  
3251
  
3252
  
3253
  
3254
  
3255
  
3256
  
3257
  
3258
  
3259
  
3260
  
3261
  
3262
  
3263
  
3264
  
3265
  
3266
  
3267
  
3268
  
3269
  
3270
  
3271
  
3272
  
3273
  
3274
  
3275
  
3276
  
3277
  
3278
  
3279
  
3280
  
3281
  
3282
  
3283
  
3284
  
3285
  
3286
  
3287
  
3288
  
3289
  
3290
  
3291
  
3292
  
3293
  
3294
  
3295
  
3296
  
3297
  
3298
  
3299
  
3300
  
3301
  
3302
  
3303
  
3304
  
3305
  
3306
  
3307
  
3308
  
3309
  
3310
  
3311
  
3312
  
3313
  
3314
  
3315
  
3316
  
3317
  
3318
  
3319
  
3320
  
3321
  
3322
  
3323
  
3324
  
3325
  
3326
  
3327
  
3328
  
3329
  
3330
  
3331
  
3332
  
3333
  
3334
  
3335
  
3336
  
3337
  
3338
  
3339
  
3340
  
3341
  
3342
  
3343
  
3344
  
3345
  
3346
  
3347
  
3348
  
3349
  
3350
  
3351
  
3352
  
3353
  
3354
  
3355
  
3356
  
3357
  
3358
  
3359
  
3360
  
3361
  
3362
  
3363
  
3364
  
3365
  
3366
  
3367
  
3368
  
3369
  
3370
  
3371
  
3372
  
3373
  
3374
  
3375
  
3376
  
3377
  
3378
  
3379
  
3380
  
3381
  
3382
  
3383
  
3384
  
3385
  
3386
  
3387
  
3388
  
3389
  
3390
  
3391
  
3392
  
3393
  
3394
  
3395
  
3396
  
3397
  
3398
  
3399
  
3400
  
3401
  
3402
  
3403
  
3404
  
3405
  
3406
  
3407
  
3408
  
3409
  
3410
  
3411
  
3412
  
3413
  
3414
  
3415
  
3416
  
3417
  
3418
  
3419
  
3420
  
3421
  
3422
  
3423
  
3424
  
3425
  
3426
  
3427
  
3428
  
3429
  
3430
  
3431
  
3432
  
3433
  
3434
  
3435
  
3436
  
3437
  
3438
  
3439
  
3440
  
3441
  
3442
  
3443
  
3444
  
3445
  
3446
  
3447
  
3448
  
3449
  
3450
  
3451
  
3452
  
3453
  
3454
  
3455
  
3456
  
3457
  
3458
  
3459
  
3460
  
3461
  
3462
  
3463
  
3464
  
3465
  
3466
  
3467
  
3468
  
3469
  
3470
  
3471
  
3472
  
3473
  
3474
  
3475
  
3476
  
3477
  
3478
  
3479
  
3480
  
3481
  
3482
  
3483
  
3484
  
3485
  
3486
  
3487
  
3488
  
3489
  
3490
  
3491
  
3492
  
3493
  
3494
  
3495
  
3496
  
3497
  
3498
  
3499
  
3500
  
3501
  
3502
  
3503
  
3504
  
3505
  
3506
  
3507
  
3508
  
3509
  
3510
  
3511
  
3512
  
3513
  
3514
  
3515
  
3516
  
3517
  
3518
  
3519
  
3520
  
3521
  
3522
  
3523
  
3524
  
3525
  
3526
  
3527
  
3528
  
3529
  
3530
  
3531
  
3532
  
3533
  
3534
  
3535
  
3536
  
3537
  
3538
  
3539
  
3540
  
3541
  
3542
  
3543
  
3544
  
3545
  
3546
  
3547
  
3548
  
3549
  
3550
  
3551
  
3552
  
3553
  
3554
  
3555
  
3556
  
3557
  
3558
  
3559
  
3560
  
3561
  
3562
  
3563
  
3564
  
3565
  
3566
  
3567
  
3568
  
3569
  
3570
  
3571
  
3572
  
3573
  
3574
  
3575
  
3576
  
3577
  
3578
  
3579
  
3580
  
3581
  
3582
  
3583
  
3584
  
3585
  
3586
  
3587
  
3588
  
3589
  
3590
  
3591
  
3592
  
3593
  
3594
  
3595
  
3596
  
3597
  
3598
  
3599
  
3600
  
3601
  
3602
  
3603
  
3604
  
3605
  
3606
  
3607
  
3608
  
3609
  
3610
  
3611
  
3612
  
3613
  
3614
  
3615
  
3616
  
3617
  
3618
  
3619
  
3620
  
3621
  
3622
  
3623
  
3624
  
3625
  
3626
  
3627
  
3628
  
3629
  
3630
  
3631
  
3632
  
3633
  
3634
  
3635
  
3636
  
3637
  
3638
  
3639
  
3640
  
3641
  
3642
  
3643
  
3644
  
3645
  
3646
  
3647
  
3648
  
3649
  
3650
  
3651
  
3652
  
3653
  
3654
  
3655
  
3656
  
3657
  
3658
  
3659
  
3660
  
3661
  
3662
  
3663
  
3664
  
3665
  
3666
  
3667
  
3668
  
3669
  
3670
  
3671
  
3672
  
3673
  
3674
  
3675
  
3676
  
3677
  
3678
  
3679
  
3680
  
3681
  
3682
  
3683
  
3684
  
3685
  
3686
  
3687
  
3688
  
3689
  
3690
  
3691
  
3692
  
3693
  
3694
  
3695
  
3696
  
3697
  
3698
  
3699
  
3700
  
3701
  
3702
  
3703
  
3704
  
3705
  
3706
  
3707
  
3708
  
3709
  
3710
  
3711
  
3712
  
3713
  
3714
  
3715
  
3716
  
3717
  
3718
  
3719
  
3720
  
3721
  
3722
  
3723
  
3724
  
3725
  
3726
  
3727
  
3728
  
3729
  
3730
  
3731
  
3732
  
3733
  
3734
  
3735
  
3736
  
3737
  
3738
  
3739
  
3740
  
3741
  
3742
  
3743
  
3744
  
3745
  
3746
  
3747
  
3748
  
3749
  
3750
  
3751
  
3752
  
3753
  
3754
  
3755
  
3756
  
3757
  
3758
  
3759
  
3760
  
3761
  
3762
  
3763
  
3764
  
3765
  
3766
  
3767
  
3768
  
3769
  
3770
  
3771
  
3772
  
3773
  
3774
  
3775
  
3776
  
3777
  
3778
  
3779
  
3780
  
3781
  
3782
  
3783
  
3784
  
3785
  
3786
  
3787
  
3788
  
3789
  
3790
  
3791
  
3792
  
3793
  
3794
  
3795
  
3796
  
3797
  
3798
  
3799
  
3800
  
3801
  
3802
  
3803
  
3804
  
3805
  
3806
  
3807
  
3808
  
3809
  
3810
  
3811
  
3812
  
3813
  
3814
  
3815
  
3816
  
3817
  
3818
  
3819
  
3820
  
3821
  
3822
  
3823
  
3824
  
3825
  
3826
  
3827
  
3828
  
3829
  
3830
  
3831
  
3832
  
3833
  
3834
  
3835
  
3836
  
3837
  
3838
  
3839
  
3840
  
3841
  
3842
  
3843
  
3844
  
3845
  
3846
  
3847
  
3848
  
3849
  
3850
  
3851
  
3852
  
3853
  
3854
  
3855
  
3856
  
3857
  
3858
  
3859
  
3860
  
3861
  
3862
  
3863
  
3864
  
3865
  
3866
  
3867
  
3868
  
3869
  
3870
  
3871
  
3872
  
3873
  
3874
  
3875
  
3876
  
3877
  
3878
  
3879
  
3880
  
3881
  
3882
  
3883
  
3884
  
3885
  
3886
  
3887
  
3888
  
3889
  
3890
  
3891
  
3892
  
3893
  
3894
  
3895
  
3896
  
3897
  
3898
  
3899
  
3900
  
3901
  
3902
  
3903
  
3904
  
3905
  
3906
  
3907
  
3908
  
3909
  
3910
  
3911
  
3912
  
3913
  
3914
  
3915
  
3916
  
3917
  
3918
  
3919
  
3920
  
3921
  
3922
  
3923
  
3924
  
3925
  
3926
  
3927
  
3928
  
3929
  
3930
  
3931
  
3932
  
3933
  
3934
  
3935
  
3936
  
3937
  
3938
  
3939
  
3940
  
3941
  
3942
  
3943
  
3944
  
3945
  
3946
  
3947
  
3948
  
3949
  
3950
  
3951
  
3952
  
3953
  
3954
  
3955
  
3956
  
3957
  
3958
  
3959
  
3960
  
3961
  
3962
  
3963
  
3964
  
3965
  
3966
  
3967
  
3968
  
3969
  
3970
  
3971
  
3972
  
3973
  
3974
  
3975
  
3976
  
3977
  
3978
  
3979
  
3980
  
3981
  
3982
  
3983
  
3984
  
3985
  
3986
  
3987
  
3988
  
3989
  
3990
  
3991
  
3992
  
3993
  
3994
  
3995
  
3996
  
3997
  
3998
  
3999
  
4000
  
4001
  
4002
  
4003
  
4004
  
4005
  
4006
  
4007
  
4008
  
4009
  
4010
  
4011
  
4012
  
4013
  
4014
  
4015
  
4016
  
4017
  
4018
  
4019
  
4020
  
4021
  
4022
  
4023
  
4024
  
4025
  
4026
  
4027
  
4028
  
4029
  
4030
  
4031
  
4032
  
4033
  
4034
  
4035
  
4036
  
4037
  
4038
  
4039
  
4040
  
4041
  
4042
  
4043
  
4044
  
4045
  
4046
  
4047
  
4048
  
4049
  
4050
  
4051
  
4052
  
4053
  
4054
  
4055
  
4056
  
4057
  
4058
  
4059
  
4060
  
4061
  
4062
  
4063
  
4064
  
4065
  
4066
  
4067
  
4068
  
4069
  
4070
  
4071
  
4072
  
4073
  
4074
  
4075
  
4076
  
4077
  
4078
  
4079
  
4080
  
4081
  
4082
  
4083
  
4084
  
4085
  
4086
  
4087
  
4088
  
4089
  
4090
  
4091
  
4092
  
4093
  
4094
  
4095
  
4096
  
4097
  
4098
  
4099
  
4100
  
4101
  
4102
  
4103
  
4104
  
4105
  
4106
  
4107
  
4108
  
4109
  
4110
  
4111
  
4112
  
4113
  
4114
  
4115
  
4116
  
4117
  
4118
  
4119
  
4120
  
4121
  
4122
  
4123
  
4124
  
4125
  
4126
  
4127
  
4128
  
4129
  
4130
  
4131
  
4132
  
4133
  
4134
  
4135
  
4136
  
4137
  
4138
  
4139
  
4140
  
4141
  
4142
  
4143
  
4144
  
4145
  
4146
  
4147
  
4148
  
4149
  
4150
  
4151
  
4152
  
4153
  
4154
  
4155
  
4156
  
4157
  
4158
  
4159
  
4160
  
4161
  
4162
  
4163
  
4164
  
4165
  
4166
  
4167
  
4168
  
4169
  
4170
  
4171
  
4172
  
4173
  
4174
  
4175
  
4176
  
4177
  
4178
  
4179
  
4180
  
4181
  
4182
  
4183
  
4184
  
4185
  
4186
  
4187
  
4188
  
4189
  
4190
  
4191
  
4192
  
4193
  
4194
  
4195
  
4196
  
4197
  
4198
  
4199
  
4200
  
4201
  
4202
  
4203
  
4204
  
4205
  
4206
  
4207
  
4208
  
4209
  
4210
  
4211
  
4212
  
4213
  
4214
  
4215
  
4216
  
4217
  
4218
  
4219
  
4220
  
4221
  
4222
  
4223
  
4224
  
4225
  
4226
  
4227
  
4228
  
4229
  
4230
  
4231
  
4232
  
4233
  
4234
  
4235
  
4236
  
4237
  
4238
  
4239
  
4240
  
4241
  
4242
  
4243
  
4244
  
4245
  
4246
  
4247
  
4248
  
4249
  
4250
  
4251
  
4252
  
4253
  
4254
  
4255
  
4256
  
4257
  
4258
  
4259
  
4260
  
4261
  
4262
  
4263
  
4264
  
4265
  
4266
  
4267
  
4268
  
4269
  
4270
  
4271
  
4272
  
4273
  
4274
  
4275
  
4276
  
4277
  
4278
  
4279
  
4280
  
4281
  
4282
  
4283
  
4284
  
4285
  
4286
  
4287
  
4288
  
4289
  
4290
  
4291
  
4292
  
4293
  
4294
  
4295
  
4296
  
4297
  
4298
  
4299
  
4300
  
4301
  
4302
  
4303
  
4304
  
4305
  
4306
  
4307
  
4308
  
4309
  
4310
  
4311
  
4312
  
4313
  
4314
  
4315
  
4316
  
4317
  
4318
  
4319
  
4320
  
4321
  
4322
  
4323
  
4324
  
4325
  
4326
  
4327
  
4328
  
4329
  
4330
  
4331
  
4332
  
4333
  
4334
  
4335
  
4336
  
4337
  
4338
  
4339
  
4340
  
4341
  
4342
  
4343
  
4344
  
4345
  
4346
  
4347
  
4348
  
4349
  
4350
  
4351
  
4352
  
4353
  
4354
  
4355
  
4356
  
4357
  
4358
  
4359
  
4360
  
4361
  
4362
  
4363
  
4364
  
4365
  
4366
  
4367
  
4368
  
4369
  
4370
  
4371
  
4372
  
4373
  
4374
  
4375
  
4376
  
4377
  
4378
  
4379
  
4380
  
4381
  
4382
  
4383
  
4384
  
4385
  
4386
  
4387
  
4388
  
4389
  
4390
  
4391
  
4392
  
4393
  
4394
  
4395
  
4396
  
4397
  
4398
  
4399
  
4400
  
4401
  
4402
  
4403
  
4404
  
4405
  
4406
  
4407
  
4408
  
4409
  
4410
  
4411
  
4412
  
4413
  
4414
  
4415
  
4416
  
4417
  
4418
  
4419
  
4420
  
4421
  
4422
  
4423
  
4424
  
4425
  
4426
  
4427
  
4428
  
4429
  
4430
  
4431
  
4432
  
4433
  
4434
  
4435
  
4436
  
4437
  
4438
  
4439
  
4440
  
4441
  
4442
  
4443
  
4444
  
4445
  
4446
  
4447
  
4448
  
4449
  
4450
  
4451
  
4452
  
4453
  
4454
  
4455
  
4456
  
4457
  
4458
  
4459
  
4460
  
4461
  
4462
  
4463
  
4464
  
4465
  
4466
  
4467
  
4468
  
4469
  
4470
  
4471
  
4472
  
4473
  
4474
  
4475
  
4476
  
4477
  
4478
  
4479
  
4480
  
4481
  
4482
  
/* -*- c -*- 
|| This file is part of Pike. For copyright information see COPYRIGHT. 
|| Pike is distributed under GPL, LGPL and MPL. See the file COPYING 
|| for more information. 
*/ 
 
/* 
 * Support for GSS-API v2 
 * 
 * Created March 17 2008 by Martin Stjernholm, Roxen IS 
 * 
 * RFC 2743 (obsoletes 2078, which obsoletes 1508): 
 *   Generic Security Service Application Program Interface Version 2, Update 1 
 * RFC 2744 (obsoletes 1509): 
 *   Generic Security Service API Version 2 : C-bindings 
 * 
 * RFC 2743 leaves it unspecified whether a number of GSS-API 
 * functions might do potentially blocking network operations. Some of 
 * those functions are very trivial and unlikely to block in practice, 
 * so I haven't put THREADS_ALLOW/THREADS_DISALLOW around them anyway. 
 * Those functions are: 
 * 
 *   gss_add_oid_set_member, gss_compare_name, 
 *   gss_create_empty_oid_set, gss_display_name, gss_display_status, 
 *   gss_duplicate_name, gss_export_name, gss_release_buffer, 
 *   gss_release_name, gss_release_oid_set, gss_test_oid_set_member 
 * 
 * /mast 
 */ 
 
/* #define GSSAPI_DEBUG */ 
/* #define GSSAPI_DEBUG_MORE */ 
 
 
#include "module.h" 
#include "gssapi_config.h" 
 
#include "bignum.h" 
#include "builtin_functions.h" 
#include "interpret.h" 
#include "operators.h" 
#include "pike_error.h" 
#include "pike_threadlib.h" 
#include "threads.h" 
#include "version.h" 
#include "module_support.h" 
#include "sprintf.h" 
 
#define DEFAULT_CMOD_STORAGE static 
 
DECLARATIONS 
 
#ifdef HAVE_GSSAPI 
 
#ifdef HAVE_GSSAPI_GSSAPI_H 
#include <gssapi/gssapi.h> 
#elif defined (HAVE_GSSAPI_H) 
#include <gssapi.h> 
#elif defined (HAVE_GSSGLUE_GSSAPI_GSSAPI_H) 
#include <gssglue/gssapi/gssapi.h> 
#endif 
 
#define DEFINE_STATIC_OID(NAME, VALUE)                                  \ 
  static const unsigned char PIKE_CONCAT (NAME, _elements)[] = VALUE;   \ 
  static const gss_OID_desc PIKE_CONCAT (NAME, _desc) = {               \ 
    sizeof (PIKE_CONCAT (NAME, _elements)) - 1, &PIKE_CONCAT (NAME, _elements) \ 
  };                                                                    \ 
  static const gss_OID_desc * const NAME = &PIKE_CONCAT (NAME, _desc) 
 
#ifdef HAVE_GSSAPI_GSSAPI_KRB5_H 
#include <gssapi/gssapi_krb5.h> 
#elif defined (HAVE_GSSAPI_KRB5_H) 
#include <gssapi_krb5.h> 
#elif defined (HAVE_GSSGLUE_GSSAPI_GSSAPI_KRB5_H) 
#include <gssglue/gssapi/gssapi_krb5.h> 
#elif !defined(HAVE_GSS_KRB5_NT_PRINCIPAL_NAME) 
/* Can't use #ifdef GSS_KRB5_NT_PRINCIPAL_NAME since it might not be a 
 * macro in gssapi_krb5.h or gssapi.h. */ 
DEFINE_STATIC_OID (GSS_KRB5_NT_PRINCIPAL_NAME, 
                   "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01"); 
#define HAVE_GSS_KRB5_NT_PRINCIPAL_NAME 
#endif 
 
#if defined (GSS_RFC_COMPLIANT_OIDS) && !GSS_RFC_COMPLIANT_OIDS 
/* Kerberos 1.2 compat - it doesn't define these on all platforms. */ 
#ifndef HAVE_GSS_C_NT_USER_NAME 
DEFINE_STATIC_OID (GSS_C_NT_USER_NAME, 
                   "\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x01"); 
#endif 
#ifndef HAVE_GSS_C_NT_MACHINE_UID_NAME 
DEFINE_STATIC_OID (GSS_C_NT_MACHINE_UID_NAME, 
                   "\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x02"); 
#endif 
#ifndef HAVE_GSS_C_NT_STRING_UID_NAME 
DEFINE_STATIC_OID (GSS_C_NT_STRING_UID_NAME, 
                   "\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x03"); 
#endif 
#ifndef HAVE_GSS_C_NT_HOSTBASED_SERVICE 
DEFINE_STATIC_OID (GSS_C_NT_HOSTBASED_SERVICE, 
                   "\x2a\x86\x48\x86\xf7\x12\x01\x02\x01\x04"); 
#endif 
#ifndef HAVE_GSS_C_NT_ANONYMOUS 
DEFINE_STATIC_OID (GSS_C_NT_ANONYMOUS, 
                   "\x2b\x06\01\x05\x06\x03"); 
#endif 
#ifndef HAVE_GSS_C_NT_EXPORT_NAME 
DEFINE_STATIC_OID (GSS_C_NT_EXPORT_NAME, 
                   "\x2b\x06\x01\x05\x06\x04"); 
#endif 
#ifndef HAVE_GSS_KRB5_NT_PRINCIPAL_NAME 
DEFINE_STATIC_OID (GSS_KRB5_NT_PRINCIPAL_NAME, 
                   "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x01"); 
#endif 
#endif 
 
 
#ifndef GSS_C_ROUTINE_ERROR_OFFSET 
#define GSS_C_ROUTINE_ERROR_OFFSET 16 
#endif 
#ifndef GSS_C_SUPPLEMENTARY_OFFSET 
#define GSS_C_SUPPLEMENTARY_OFFSET 0 
#endif 
#ifndef GSS_C_ROUTINE_ERROR_MASK 
#define GSS_C_ROUTINE_ERROR_MASK ((OM_uint32) 0377ul) 
#endif 
#ifndef GSS_C_SUPPLEMENTARY_MASK 
#define GSS_C_SUPPLEMENTARY_MASK ((OM_uint32) 0177777ul) 
#endif 
#ifndef GSS_S_BAD_MIC 
#define GSS_S_BAD_MIC GSS_S_BAD_SIG 
#endif 
 
 
#if defined (GSSAPI_DEBUG) || defined (GSSAPI_DEBUG_MORE) 
#define STATUS_MSG(FN, MAJ, MIN) do {                                   \ 
    fprintf (stderr, "gssapi.cmod:%d: %s returned %x/%x\n",             \ 
             __LINE__, #FN, MAJ, MIN);                                  \ 
  } while (0) 
#define DEBUG_MSG(FPRINTF_ARGS) do {                                    \ 
    fprintf FPRINTF_ARGS;                                               \ 
  } while (0) 
#else 
#define STATUS_MSG(FN, MAJ, MIN) do {} while (0) 
#define DEBUG_MSG(FPRINTF_ARGS) do {} while (0) 
#endif 
 
#ifdef GSSAPI_DEBUG_MORE 
#define MORE_STATUS_MSG STATUS_MSG 
#else 
#define MORE_STATUS_MSG(FN, MAJ, MIN) do {} while (0) 
#endif 
 
#ifdef DEBUG_MALLOC 
#define DMALLOC_REGISTER(X) do {                                        \ 
    void *x_ = (X);                                                     \ 
    if (x_) dmalloc_register (x_, 0, DMALLOC_LOCATION());               \ 
  } while (0) 
#define DMALLOC_UNREGISTER(X) do {                                      \ 
    void *x_ = (X);                                                     \ 
    /* This is something that imho should be built into dmalloc_unregister. */ \ 
    if (!dmalloc_unregister (x_, 0))                                    \ 
      Pike_fatal ("Unregistered unknown block %p.\n", x_);              \ 
  } while (0) 
#else 
#define DMALLOC_REGISTER(X) do {} while (0) 
#define DMALLOC_UNREGISTER(X) do {} while (0) 
#endif 
 
 
#define CHECK_NARROW_STRING(PIKESTR, FN, ARG) do {                      \ 
    if ((PIKESTR)->size_shift)                                          \ 
      SIMPLE_ARG_ERROR (FN, ARG, "String cannot be wide.");             \ 
  } while (0) 
 
static struct svalue int_pos_inf = SVALUE_INIT_FREE; 
 
static void resolve_syms(void); 
 
#define RESOLVE_SYMS() do {                                             \ 
    if (TYPEOF(int_pos_inf) == PIKE_T_FREE) resolve_syms();             \ 
  } while (0) 
 
#define PUSH_TIME(TIME) do {                                            \ 
    if (TIME == GSS_C_INDEFINITE) {                                     \ 
      RESOLVE_SYMS();                                                   \ 
      push_svalue (&int_pos_inf);                                       \ 
    }                                                                   \ 
    else                                                                \ 
      push_ulongest (TIME);                                             \ 
  } while (0) 
 
static DECLSPEC(noreturn) void throw_gssapi_error ( 
  OM_uint32 major, OM_uint32 minor, const gss_OID mech, const char *msg, ...) 
  ATTRIBUTE ((noreturn, format (printf, 4, 5))); 
 
static DECLSPEC(noreturn) void handle_error ( 
  int line, const char *gss_func, 
  OM_uint32 major, OM_uint32 minor, const gss_OID mech 
) 
  ATTRIBUTE ((noreturn)); 
 
#define CHECK_ERROR(FN, MAJ, MIN) do {                                  \ 
    if (GSS_ERROR (MAJ))                                                \ 
      handle_error (__LINE__, #FN, MAJ, MIN, GSS_C_NO_OID);             \ 
  } while (0) 
#define CHECK_ERROR_WITH_MECH(FN, MAJ, MIN, MECH) do {                  \ 
    if (GSS_ERROR (MAJ))                                                \ 
      handle_error (__LINE__, #FN, MAJ, MIN, MECH);                     \ 
  } while (0) 
 
#define CHECK_UNEXPECTED_ERROR(FN, MAJ, MIN) do {                       \ 
    if (GSS_ROUTINE_ERROR (MAJ) == GSS_S_FAILURE)                       \ 
      handle_error (__LINE__, #FN, MAJ, MIN, GSS_C_NO_OID);             \ 
    DO_IF_DEBUG (                                                       \ 
      else if (GSS_ERROR (MAJ))                                         \ 
        Pike_fatal ("Unexpected error from %s: %x/%x\n", #FN, MAJ, MIN); \ 
    );                                                                  \ 
  } while (0) 
 
static void cleanup_buffer (gss_buffer_t buf) 
{ 
  DMALLOC_UNREGISTER (buf); 
  if (buf->value) { 
    OM_uint32 maj, min; 
    maj = gss_release_buffer (&min, buf); 
    MORE_STATUS_MSG (gss_release_buffer, maj, min); 
    CHECK_UNEXPECTED_ERROR (gss_release_buffer, maj, min); 
    buf->value = NULL; 
  } 
} 
 
#define WITH_GSS_BUFFER(BUF) do {                                       \ 
    gss_buffer_desc BUF;                                                \ 
    ONERROR PIKE_CONCAT (BUF, _uwp);                                    \ 
    BUF.value = NULL;                                                   \ 
    SET_ONERROR (PIKE_CONCAT (BUF, _uwp), cleanup_buffer, &BUF);        \ 
    DMALLOC_REGISTER (&BUF);                                            \ 
    do 
 
#define END_GSS_BUFFER(BUF)                                             \ 
    while (0);                                                          \ 
    CALL_AND_UNSET_ONERROR (PIKE_CONCAT (BUF, _uwp));                   \ 
  } while (0) 
 
static void cleanup_oid_set (gss_OID_set *oid_set) 
{ 
  if (*oid_set != GSS_C_NO_OID_SET) { 
    OM_uint32 maj, min; 
    DMALLOC_UNREGISTER (*oid_set); 
    maj = gss_release_oid_set (&min, oid_set); 
    MORE_STATUS_MSG (gss_release_oid_set, maj, min); 
    CHECK_UNEXPECTED_ERROR (gss_release_oid_set, maj, min); 
    *oid_set = GSS_C_NO_OID_SET; 
  } 
} 
 
#define IS_SAME_OID(A, B)                                               \ 
  (A == B || (A->length == B->length &&                                 \ 
              !memcmp (A->elements, B->elements, A->length))) 
 
#define COPY_OID(DST, SRC) do {                                         \ 
    gss_OID dst_ = (DST), src_ = (SRC);                                 \ 
    size_t l_ = src_->length;                                           \ 
    dst_->length = l_;                                                  \ 
    dst_->elements = xalloc (l_);                                       \ 
    memcpy (dst_->elements, src_->elements, l_);                        \ 
  } while (0) 
 
/* Support code to map between gss_OID's and the dotted-decimal 
 * strings we prefer to use in pike. */ 
 
static struct svalue encode_der_oid = SVALUE_INIT_FREE; 
static struct svalue decode_der_oid = SVALUE_INIT_FREE; 
 
/* Cache mapping between DER encoded OIDs and dotted-decimal strings, 
 * both ways. */ 
static struct mapping *der_dd_map = NULL; 
 
static int get_pushed_gss_oid (struct pike_string *dd_oid, gss_OID gss_oid) 
{ 
  struct svalue *v = low_mapping_string_lookup (der_dd_map, dd_oid); 
  if (v) { 
    assert (TYPEOF(*v) == T_STRING && !v->u.string->size_shift); 
    gss_oid->length = v->u.string->str[1]; 
    gss_oid->elements = v->u.string->str + 2; 
    return 0; 
  } 
 
  RESOLVE_SYMS(); 
 
  ref_push_string (dd_oid); 
  apply_svalue (&encode_der_oid, 1); 
  if (TYPEOF(Pike_sp[-1]) != T_STRING || 
      Pike_sp[-1].u.string->size_shift || 
      Pike_sp[-1].u.string->len < 3 || 
      Pike_sp[-1].u.string->str[0] != 0x6) { 
    Pike_error ("encode_der_oid function returned a bogus value: %O\n", 
                Pike_sp - 1); 
  } 
 
  /* We don't cache the oid here since we're not sure that dd_oid is 
   * really kosher, nor that the oid is one that is useful to keep. */ 
 
  /* Keep the string on the stack to avoid ONERROR stuff. */ 
  gss_oid->length = Pike_sp[-1].u.string->str[1]; 
  gss_oid->elements = Pike_sp[-1].u.string->str + 2; 
  return 1; 
} 
 
#define WITH_PUSHED_GSS_OID(GSS_OID, DD_OID) do {                       \ 
    gss_OID_desc GSS_OID;                                               \ 
    int PIKE_CONCAT (GSS_OID, _pushed) =                                \ 
      get_pushed_gss_oid ((DD_OID), &GSS_OID);                          \ 
    do 
 
#define END_GSS_OID(GSS_OID)                                            \ 
    while (0);                                                          \ 
    if (PIKE_CONCAT (GSS_OID, _pushed)) pop_stack();                    \ 
  } while (0) 
 
static struct pike_string *get_dd_oid (const gss_OID_desc * const gss_oid) 
{ 
  struct pike_string *der_oid; 
 
  { 
    struct string_builder sb; 
    size_t l = gss_oid->length; 
    init_string_builder (&sb, 0); 
    string_builder_putchar (&sb, 0x06); /* BER/DER type for OIDs. */ 
    string_builder_putchar (&sb, l); 
    string_builder_binary_strcat (&sb, gss_oid->elements, l); 
    der_oid = finish_string_builder (&sb); 
  } 
 
  { 
    struct svalue *v = low_mapping_string_lookup (der_dd_map, der_oid); 
    if (v) { 
      free_string (der_oid); 
      assert (TYPEOF(*v) == T_STRING); 
      return v->u.string; 
    } 
  } 
 
  RESOLVE_SYMS(); 
 
  ref_push_string (der_oid);    /* Save extra ref for use afterwards. */ 
  push_string (der_oid); 
  apply_svalue (&decode_der_oid, 1); 
  if (TYPEOF(Pike_sp[-1]) != T_STRING || 
      Pike_sp[-1].u.string->size_shift) { 
    Pike_error ("decode_der_oid function returned a bogus value: %O.\n", 
                Pike_sp - 1); 
  } 
 
  { 
    struct pike_string *dd_oid = Pike_sp[-1].u.string; 
 
    /* Update cache both ways. */ 
    mapping_string_insert_string (der_dd_map, der_oid, dd_oid); 
    mapping_string_insert_string (der_dd_map, dd_oid, der_oid); 
 
    /* dd_oid got refs from the cache now. */ 
    free_string ((--Pike_sp)->u.string); 
    free_string ((--Pike_sp)->u.string); 
    return dd_oid; 
  } 
} 
 
/* Conversion between gss_OID_set and multiset(string). */ 
 
static void convert_to_oid_set (struct multiset *oid_strs, gss_OID_set *set) 
/* Caller needs to install an ONERROR handler for *set. It is assumed 
 * that the multiset contains only strings. */ 
{ 
  OM_uint32 maj, min; 
  maj = gss_create_empty_oid_set (&min, set); 
  MORE_STATUS_MSG (gss_create_empty_oid_set, maj, min); 
  DMALLOC_REGISTER (*set); 
  CHECK_UNEXPECTED_ERROR (gss_create_empty_oid_set, maj, min); 
 
  { 
    ptrdiff_t p = multiset_first (oid_strs); 
    struct svalue oid_str; 
    ONERROR uwp; 
    SET_ONERROR (uwp, do_sub_msnode_ref, oid_strs); 
    for (; p >= 0; p = multiset_next (oid_strs, p)) { 
      use_multiset_index (oid_strs, p, oid_str); 
      assert (TYPEOF(oid_str) == T_STRING); 
      WITH_PUSHED_GSS_OID (oid, oid_str.u.string) { 
        /* The storage for oid might disappear in each round, but 
         * gss_add_oid_set_member makes a copy. */ 
        maj = gss_add_oid_set_member (&min, &oid, set); 
        MORE_STATUS_MSG (gss_add_oid_set_member, maj, min); 
        CHECK_UNEXPECTED_ERROR (gss_add_oid_set_member, maj, min); 
      } END_GSS_OID (oid); 
    } 
    CALL_AND_UNSET_ONERROR (uwp); 
  } 
} 
 
static void convert_from_oid_set_and_push (gss_OID_set set) 
{ 
  size_t i, n = set->count; 
  struct multiset *l; 
  struct svalue oid_str; 
  SET_SVAL_TYPE(oid_str, T_STRING); 
 
  l = allocate_multiset (n, 0, NULL); 
  push_multiset (l); 
 
  for (i = 0; i < n; i++) { 
    oid_str.u.string = get_dd_oid (set->elements + i); 
    multiset_insert (l, &oid_str); 
  } 
} 
 
#define RESOLVE_AND_SET(IDENT, SVALUE) do {                             \ 
    push_text (IDENT);                                                  \ 
    SAFE_APPLY_MASTER ("resolv", 1);                                    \ 
    if (SAFE_IS_ZERO (Pike_sp - 1))                                     \ 
      Pike_error ("GSSAPI: Failed to resolve %s.\n", IDENT);            \ 
    move_svalue (&SVALUE, --Pike_sp);                                   \ 
  } while (0) 
 
static void resolve_syms(void) 
{ 
  RESOLVE_AND_SET ("Int.inf", int_pos_inf); 
  RESOLVE_AND_SET ("Standards.ASN1.encode_der_oid", encode_der_oid); 
  RESOLVE_AND_SET ("Standards.ASN1.decode_der_oid", decode_der_oid); 
} 
 
 
/*! @module GSSAPI 
 *! 
 *! This is pike glue for GSS-API ver 2 as specified in @rfc{2743@}. 
 *! 
 *! GSS-API is used to authenticate users and servers, and optionally 
 *! also to encrypt communication between them. The API is generic and 
 *! can be used without any knowledge of the actual implementation of 
 *! these security services, which is typically provided by the 
 *! operating system. 
 *! 
 *! The most common implementation at the time of writing is Kerberos, 
 *! which means that the main benefit of this API is to allow clients 
 *! and servers to authenticate each other using Kerberos, thereby 
 *! making single sign-on possible in a Kerberized environment. 
 *! 
 *! All functions in this module that wraps GSS-API routines might throw 
 *! @[GSSAPI.Error], and by default they do for all such errors. Only in 
 *! some special cases do they return when a GSS-API error has happened, 
 *! and that is noted in the documentation. 
 */ 
 
 
/*! @decl constant int ERROR_MASK 
 *! 
 *! Bitfield mask for the routine error part of major status codes 
 *! like @[GSSAPI.Error.major_status]. After applying this mask, the 
 *! status values may be compared to any of the routine error 
 *! constants. 
 */ 
 
/*! @decl constant int BAD_MECH 
 *! @decl constant int BAD_NAME 
 *! @decl constant int BAD_NAMETYPE 
 *! @decl constant int BAD_BINDINGS 
 *! @decl constant int BAD_STATUS 
 *! @decl constant int BAD_SIG 
 *! @decl constant int NO_CRED 
 *! @decl constant int NO_CONTEXT 
 *! @decl constant int DEFECTIVE_TOKEN 
 *! @decl constant int DEFECTIVE_CREDENTIAL 
 *! @decl constant int CREDENTIALS_EXPIRED 
 *! @decl constant int CONTEXT_EXPIRED 
 *! @decl constant int FAILURE 
 *! @decl constant int BAD_QOP 
 *! @decl constant int UNAUTHORIZED 
 *! @decl constant int UNAVAILABLE 
 *! @decl constant int DUPLICATE_ELEMENT 
 *! @decl constant int NAME_NOT_MN 
 *! 
 *! Constants for routine errors in major status codes like 
 *! @[GSSAPI.Error.major_status]. See @rfc{2743:1.2.1.1@}.  Note that 
 *! major status codes have to be masked with @[GSSAPI.ERROR_MASK] 
 *! before comparison with these. 
 *! 
 *! Brief descriptions of the flags: 
 *! 
 *! @dl 
 *! @item GSSAPI.BAD_BINDINGS 
 *!   Channel binding mismatch. 
 *! @item GSSAPI.BAD_MECH 
 *!   Unsupported mechanism requested. 
 *! @item GSSAPI.BAD_NAME 
 *!   Invalid name provided. 
 *! @item GSSAPI.BAD_NAMETYPE 
 *!   Name of unsupported type provided. 
 *! @item GSSAPI.BAD_STATUS 
 *!   Invalid input status selector. 
 *! @item GSSAPI.BAD_MIC 
 *!   Token had invalid integrity check. 
 *! @item GSSAPI.CONTEXT_EXPIRED 
 *!   Specified security context expired. 
 *! @item GSSAPI.CREDENTIALS_EXPIRED 
 *!   Expired credentials detected. 
 *! @item GSSAPI.DEFECTIVE_CREDENTIAL 
 *!   Defective credential detected. 
 *! @item GSSAPI.DEFECTIVE_TOKEN 
 *!   Defective token detected. 
 *! @item GSSAPI.FAILURE 
 *!   Failure, unspecified at GSS-API level. 
 *!   @[GSSAPI.Error.minor_status] should provide further details. 
 *! @item GSSAPI.NO_CONTEXT 
 *!   No valid security context specified. 
 *! @item GSSAPI.NO_CRED 
 *!   No valid credentials provided. 
 *! @item GSSAPI.BAD_QOP 
 *!   Unsupported QOP value. 
 *! @item GSSAPI.UNAUTHORIZED 
 *!   Operation unauthorized. 
 *! @item GSSAPI.UNAVAILABLE 
 *!   Operation unavailable. 
 *! @item GSSAPI.DUPLICATE_ELEMENT 
 *!   Duplicate credential element requested. 
 *! @item GSSAPI.NAME_NOT_MN 
 *!   Name contains multi-mechanism elements. 
 *! @enddl 
 */ 
 
/*! @decl constant int INFO_MASK 
 *! 
 *! Bitfield mask for the informatory part of major status codes like 
 *! @[GSSAPI.Error.major_status]. 
 */ 
 
/*! @decl constant int CONTINUE_NEEDED 
 *! @decl constant int DUPLICATE_TOKEN 
 *! @decl constant int OLD_TOKEN 
 *! @decl constant int UNSEQ_TOKEN 
 *! @decl constant int GAP_TOKEN 
 *! 
 *! Bitfield flags for informatory codes in major status codes like 
 *! @[GSSAPI.Error.major_status]. See @rfc{2743:1.2.1.1@}. Any 
 *! combination of these might optionally be combined with one routine 
 *! error constant to form a major status code. 
 *! 
 *! Brief descriptions of the flags: 
 *! 
 *! @dl 
 *! @item GSSAPI.CONTINUE_NEEDED 
 *!   Continuation call to routine required. 
 *! @item GSSAPI.DUPLICATE_TOKEN 
 *!   Duplicate per-message token detected. 
 *! @item GSSAPI.OLD_TOKEN 
 *!   Timed-out per-message token detected. 
 *! @item GSSAPI.UNSEQ_TOKEN 
 *!   Reordered (early) per-message token detected. 
 *! @item GSSAPI.GAP_TOKEN 
 *!   Skipped predecessor token(s) detected. 
 *! @enddl 
 */ 
 
/*! @decl array(string) major_status_messages (int major_status) 
 *! 
 *! Given a major status code like @[GSSAPI.Error.major_status] (or 
 *! more commonly @[GSSAPI.Context.last_major_status] in this case), 
 *! returns an array containing messages for all the status values in 
 *! it. The returned string(s) presumably don't end with linefeeds. 
 *! 
 *! This wraps @tt{GSS_Display_status@} according to 
 *! @rfc{2743:2.4.1@}. 
 */ 
PIKEFUN array(string) major_status_messages (int major_status) 
{ 
  OM_uint32 msg_ctx = 0; 
  int n = 0; 
 
  pop_n_elems (args); 
 
  do { 
    WITH_GSS_BUFFER (msg) { 
      OM_uint32 maj, min; 
      maj = gss_display_status (&min, major_status, GSS_C_GSS_CODE, 
                                GSS_C_NO_OID, &msg_ctx, &msg); 
      MORE_STATUS_MSG (gss_display_status, maj, min); 
      CHECK_ERROR (gss_display_status, maj, min); 
      /* NB: The RFC is unspecified on the character encoding in the 
       * returned string. */ 
      push_string (make_shared_binary_string (msg.value, msg.length)); 
      n++; 
    } END_GSS_BUFFER (msg); 
  } while (msg_ctx); 
 
  f_aggregate (n); 
} 
 
/*! @decl array(string) minor_status_messages (int minor_status, @ 
 *!                                            void|string mech) 
 *! 
 *! Given a mechanism-specific minor status code like 
 *! @[GSSAPI.Error.minor_status], returns an array containing messages 
 *! for all the status values in it. The returned string(s) presumably 
 *! don't end with linefeeds. 
 *! 
 *! This wraps @tt{GSS_Display_status@} according to 
 *! @rfc{2743:2.4.1@}. 
 *! 
 *! @param minor_status 
 *!   The mechanism-specific minor status. 
 *! 
 *! @param mech 
 *!   The mechanism that produced the status code. If this is zero or 
 *!   left out, a system default mechanism is used. 
 */ 
PIKEFUN array(string) minor_status_messages (int minor_status, void|string mech) 
{ 
  gss_OID_desc mech_oid_desc; 
  gss_OID mech_oid; 
 
#ifndef PRECOMPILE_API_VERSION 
  /* Live with the pessimal precompile.pike in 7.4.. :P */ 
  struct pike_string *_mech; 
  CHECK_OPT_ARG (mech, _mech, T_STRING, string, "string", 
                 "minor_status_messages", 2); 
#define mech _mech 
#endif 
 
  if (mech) { 
    if (get_pushed_gss_oid (mech, mech_oid = &mech_oid_desc)) 
      /* Make the pop code below handle the extra stack item. */ 
      args++; 
  } 
  else 
    mech_oid = GSS_C_NO_OID; 
 
  { 
    OM_uint32 msg_ctx = 0; 
    int n = 0; 
 
    do { 
      WITH_GSS_BUFFER (msg) { 
        OM_uint32 maj, min; 
        maj = gss_display_status (&min, minor_status, GSS_C_MECH_CODE, 
                                  mech_oid, &msg_ctx, &msg); 
        MORE_STATUS_MSG (gss_display_status, maj, min); 
        CHECK_ERROR_WITH_MECH (gss_display_status, maj, min, mech_oid); 
        /* NB: The RFC is unspecified on the character encoding in the 
         * returned string. */ 
        push_string (make_shared_binary_string (msg.value, msg.length)); 
        n++; 
      } END_GSS_BUFFER (msg); 
    } while (msg_ctx); 
 
    f_aggregate (n); 
  } 
 
  stack_pop_n_elems_keep_top (args); 
 
#undef mech 
} 
 
/*! @class Error 
 *! @inherit Error.Generic 
 *! 
 *! Error object used for GSS-API errors. 
 */ 
 
/*! @decl constant is_gssapi_error = 1 
 *! @decl constant error_type = "gssapi_error" 
 *! 
 *! Object recognition constants. 
 */ 
 
/* Can't use PIKECLASS since precompile.pike doesn't support constants 
 * (at least not in 7.4). */ 
 
struct gssapi_err_struct { 
  INT_TYPE major_status, minor_status; 
  gss_OID_desc mech; 
}; 
 
static struct program *gssapi_err_program = NULL; 
static ptrdiff_t gssapi_err_struct_offset; 
 
#undef THIS 
#define THIS ((struct gssapi_err_struct *)                              \ 
              (Pike_fp->current_storage + gssapi_err_struct_offset)) 
 
/* Assume gssapi_err_program begins with the generic_error_program inherit. */ 
#define GEN_ERR_THIS ((struct generic_error_struct *)                   \ 
                      (Pike_fp->current_storage + 0)) 
 
static void gssapi_err_events (int event) 
{ 
  switch (event) { 
    case PROG_EVENT_INIT: 
      THIS->major_status = THIS->minor_status = 0; 
      THIS->mech.elements = NULL; 
      break; 
    case PROG_EVENT_EXIT: 
      if (THIS->mech.elements) free (THIS->mech.elements); 
      break; 
  } 
} 
 
/*! @decl int major_status 
 *! 
 *! The major status code. This is a bitwise OR of one routine error 
 *! code and zero or more supplementary error info bits. 
 *! 
 *! See @rfc{2743:1.2.1.1@} and @rfc{2744:3.9.1@}.  Note that the 
 *! calling errors mentioned in @rfc{2744@} are never thrown. 
 *! 
 *! @seealso 
 *!   @[major_status_messages] 
 */ 
 
/*! @decl int minor_status 
 *! 
 *! The minor status code specific for the mechanism. 
 *! 
 *! @seealso 
 *!   @[minor_status_messages], @[minor_status_mech] 
 */ 
 
static struct pike_string *make_gss_err_message ( 
  OM_uint32 major, OM_uint32 minor, const gss_OID mech, 
  const char *msg, va_list *args) 
{ 
  struct string_builder sb; 
  ONERROR uwp; 
  init_string_builder (&sb, 0); 
  SET_ONERROR (uwp, free_string_builder, &sb); 
 
  if (msg) { 
    /* args is a pointer to va_list only to be able to pass a dummy 
     * value there when msg is NULL. */ 
    string_builder_vsprintf (&sb, msg, *args); 
    string_builder_strcat (&sb, ": "); 
  } 
 
  if (GSS_ROUTINE_ERROR (major) != GSS_S_FAILURE) { 
    WITH_GSS_BUFFER (msg) { 
      OM_uint32 maj, min, msg_ctx = 0; 
      string_builder_strcat (&sb, "GSSAPI: "); 
      maj = gss_display_status (&min, GSS_ROUTINE_ERROR (major), GSS_C_GSS_CODE, 
                                GSS_C_NO_OID, &msg_ctx, &msg); 
      MORE_STATUS_MSG (gss_display_status, maj, min); 
      if (!GSS_ERROR (maj)) 
        /* NB: The RFC is unspecified on the character encoding in the 
         * returned string. */ 
        string_builder_binary_strcat (&sb, msg.value, msg.length); 
    } END_GSS_BUFFER (msg); 
 
    /* FIXME: Check minor for selected errors? */ 
  } 
 
  else { 
    /* NB: If mech is GSS_C_NO_OID here then gss_display_status can 
     * display the minor message with the wrong mechanism. Not much we 
     * can do about that, but trying to use the system default 
     * mechanism is still better than nothing. E.g. gss_acquire_cred 
     * can fail with a mechanism-specific error when building the 
     * default creds, and we have no way of querying the mechanism in 
     * which it failed. */ 
    WITH_GSS_BUFFER (msg) { 
      OM_uint32 maj, min, msg_ctx = 0; 
      string_builder_strcat (&sb, "Mech: "); 
      maj = gss_display_status (&min, minor, GSS_C_MECH_CODE, 
                                mech, &msg_ctx, &msg); 
      MORE_STATUS_MSG (gss_display_status, maj, min); 
      if (!GSS_ERROR (maj)) 
        string_builder_binary_strcat (&sb, msg.value, msg.length); 
    } END_GSS_BUFFER (msg); 
  } 
 
  string_builder_putchar (&sb, '\n'); 
 
  UNSET_ONERROR (uwp); 
  return finish_string_builder (&sb); 
} 
 
/*! @decl protected void create (void|int major, @ 
 *!                           void|int minor, void|string mech, @ 
 *!                           void|string message, void|array backtrace) 
 *! 
 *! @param major 
 *!   Initial value for @[major_status]. 
 *! 
 *! @param minor 
 *!   Initial value for @[minor_status]. 
 *! 
 *! @param mech 
 *!   Object identifier on dotted-decimal form for the mechanism that 
 *!   @[minor] applies to. 
 *! 
 *! @param message 
 *!   Error message. This is prepended to the message generated from 
 *!   @[major_status] and/or @[minor_status]. @expr{": "@} is inserted 
 *!   in between. 
 *! 
 *! @param backtrace 
 *!   Backtrace. The current backtrace for the calling function is 
 *!   used if left out. 
 */ 
static void gssapi_err_create (INT32 args) 
{ 
  /* get_all_args doesn't handle optional args in 7.4.. :P */ 
  if(args > 5) wrong_number_of_args_error("create",args,5); 
 
  if(args > 0) { 
    if(TYPEOF(Pike_sp[0-args]) != T_INT) 
      SIMPLE_ARG_TYPE_ERROR ("create",1,"void|int"); 
    THIS->major_status = Pike_sp[-args].u.integer; 
  } 
 
  if(args > 1) { 
    if(TYPEOF(Pike_sp[1-args]) != T_INT) 
      SIMPLE_ARG_TYPE_ERROR ("create",2,"void|int"); 
    THIS->minor_status = Pike_sp[-args].u.integer; 
  } 
 
  if(args > 2 && 
     (TYPEOF(Pike_sp[2-args]) != T_INT || Pike_sp[2-args].u.integer)) { 
    if(TYPEOF(Pike_sp[2-args]) != T_STRING) 
      SIMPLE_ARG_TYPE_ERROR ("create",3,"void|string"); 
    WITH_PUSHED_GSS_OID (mech_oid, Pike_sp[2-args].u.string) { 
      if (THIS->mech.elements) free (THIS->mech.elements); 
      COPY_OID (&THIS->mech, &mech_oid); 
    } END_GSS_OID (mech_oid); 
  } 
 
  { 
    gss_OID mech = THIS->mech.elements ? &THIS->mech : GSS_C_NO_OID; 
 
    if(args > 3 && 
       (TYPEOF(Pike_sp[3-args]) != T_INT || Pike_sp[3-args].u.integer)) { 
      if(TYPEOF(Pike_sp[3-args]) != T_STRING) 
        SIMPLE_ARG_TYPE_ERROR ("create",4,"void|string"); 
      ref_push_string (Pike_sp[3-args].u.string); 
      push_static_text (": "); 
      push_string (make_gss_err_message (THIS->major_status, THIS->minor_status, 
                                         mech, NULL, NULL)); 
      f_add (3); 
      do_free_string (GEN_ERR_THIS->error_message); 
      GEN_ERR_THIS->error_message = (--Pike_sp)->u.string; 
    } 
    else { 
      struct pike_string *msg = 
        make_gss_err_message (THIS->major_status, THIS->minor_status, 
                              mech, NULL, NULL); 
      do_free_string (GEN_ERR_THIS->error_message); 
      GEN_ERR_THIS->error_message = msg; 
    } 
  } 
 
  if (GEN_ERR_THIS->error_backtrace) 
    free_array (GEN_ERR_THIS->error_backtrace); 
  if(args > 4 && 
     (TYPEOF(Pike_sp[4-args]) != T_INT || Pike_sp[4-args].u.integer)) { 
    if(TYPEOF(Pike_sp[4-args]) != T_ARRAY) 
      SIMPLE_ARG_TYPE_ERROR ("create",5,"void|array"); 
    add_ref (GEN_ERR_THIS->error_backtrace = Pike_sp[4-args].u.array); 
  } 
  else { 
    f_backtrace (0); 
    GEN_ERR_THIS->error_backtrace = 
      slice_array (Pike_sp[-1].u.array, 0, Pike_sp[-1].u.array->size - 1); 
    pop_stack(); 
  } 
} 
 
/*! @decl array(string) major_status_messages() 
 *! 
 *! Returns an array containing messages for all the status values in 
 *! @[major_status]. See @[GSSAPI.major_status_messages] for further 
 *! details. 
 */ 
static void gssapi_err_major_msgs (INT32 args) 
{ 
  if (args) wrong_number_of_args_error ("major_status_messages", args, 0); 
  push_int (THIS->major_status); 
  f_major_status_messages (1); 
} 
 
/*! @decl array(string) minor_status_messages() 
 *! 
 *! Returns an array containing messages for all the status values in 
 *! @[minor_status]. See @[GSSAPI.minor_status_messages] for further 
 *! details. 
 */ 
static void gssapi_err_minor_msgs (INT32 args) 
{ 
  if (args) wrong_number_of_args_error ("major_status_messages", args, 0); 
  push_int (THIS->minor_status); 
  if (THIS->mech.elements) { 
    ref_push_string (get_dd_oid (&THIS->mech)); 
    f_minor_status_messages (2); 
  } 
  else 
    f_minor_status_messages (1); 
} 
 
/*! @decl string minor_status_mech() 
 *! 
 *! Returns the OID for the mechanism that is used to interpret the 
 *! minor status, or zero if no mechanism has been set. It is returned 
 *! on dotted-decimal form. 
 */ 
static void gssapi_err_minor_mech (INT32 args) 
{ 
  pop_n_elems (args); 
  if (!THIS->mech.elements) 
    push_int (0); 
  else 
    ref_push_string (get_dd_oid (&THIS->mech)); 
} 
 
/*! @endclass */ 
 
static DECLSPEC(noreturn) void throw_gssapi_error ( 
  OM_uint32 major, OM_uint32 minor, const gss_OID mech, const char *msg, ...) 
{ 
  struct object *o = fast_clone_object (gssapi_err_program); 
  struct gssapi_err_struct *gssapi_err = 
    (struct gssapi_err_struct *) (o->storage + gssapi_err_struct_offset); 
  /* Assume gssapi_err_program begins with the generic_error_program inherit. */ 
  struct generic_error_struct *gen_err = 
    (struct generic_error_struct *) (o->storage + 0); 
  struct pike_string *errmsg; 
 
  gssapi_err->major_status = major; 
  gssapi_err->minor_status = minor; 
  if (mech) COPY_OID (&gssapi_err->mech, mech); 
 
  if (msg) { 
    va_list args; 
    va_start (args, msg); 
    errmsg = make_gss_err_message (major, minor, mech, msg, &args); 
    va_end (args); 
  } 
  else 
    errmsg = make_gss_err_message (major, minor, mech, NULL, NULL); 
 
  gen_err->error_message = errmsg; 
 
  generic_error_va (o, NULL, NULL, 0, NULL, NULL); 
} 
 
static DECLSPEC(noreturn) void handle_error ( 
  int DEBUGUSED(line), const char *DEBUGUSED(gss_func), 
  OM_uint32 major, OM_uint32 minor, const gss_OID mech 
) 
/* Assumed to be called only if GSS_ERROR (maj) is true. */ 
{ 
  if (GSS_CALLING_ERROR (major)) { 
#ifdef PIKE_DEBUG 
    OM_uint32 msg_ctx; 
    fprintf (stderr, "Unexpected error in call to %s " 
             "from gssapi.cmod:%d: %x/%x\n", gss_func, line, major, minor); 
 
    msg_ctx = 0; 
    do { 
      OM_uint32 maj, min; 
      /* Can't use WITH_GSS_BUFFER here due to risk for recursion. */ 
      gss_buffer_desc msg; 
      maj = gss_display_status (&min, major, GSS_C_GSS_CODE, 
                                GSS_C_NO_OID, &msg_ctx, &msg); 
      /* MORE_STATUS_MSG (gss_display_status, maj, min); */ 
      if (GSS_ERROR (maj)) { 
        fprintf (stderr, "  Got error from gss_display_status " 
                 "when trying to format major status: %x/%x\n", maj, min); 
        msg_ctx = 0; 
      } 
      else 
        fprintf (stderr, "  Major status: %.*s\n", 
                 (int) msg.length, (char *) msg.value); 
      maj = gss_release_buffer (&min, &msg); /* Ignore errors from this one.. */ 
      /* MORE_STATUS_MSG (gss_release_buffer, maj, min); */ 
    } while (msg_ctx); 
 
    msg_ctx = 0; 
    do { 
      OM_uint32 maj, min; 
      /* Can't use WITH_GSS_BUFFER here due to risk for recursion. */ 
      gss_buffer_desc msg; 
      maj = gss_display_status (&min, minor, GSS_C_MECH_CODE, 
                                mech, &msg_ctx, &msg); 
      /* MORE_STATUS_MSG (gss_display_status, maj, min); */ 
      if (GSS_ERROR (maj)) { 
        fprintf (stderr, "  Got error from gss_display_status " 
                 "when trying to format minor status: %x/%x\n", maj, min); 
        msg_ctx = 0; 
      } 
      else 
        fprintf (stderr, "  Minor status: %.*s\n", 
                 (int) msg.length, (char *) msg.value); 
      maj = gss_release_buffer (&min, &msg); /* Ignore errors from this one.. */ 
      /* MORE_STATUS_MSG (gss_release_buffer, maj, min); */ 
    } while (msg_ctx); 
 
    Pike_fatal ("Unexpected error in call to %s " 
                "from gssapi.cmod:%d: %x/%x\n", gss_func, line, major, minor); 
 
#else  /* !PIKE_DEBUG */ 
    Pike_fatal ("Unexpected error in call to GSS-API function: %x/%x\n", 
                major, minor); 
#endif 
  } 
 
  throw_gssapi_error (major, minor, mech, NULL); 
} 
 
 
/*! @class MissingServicesError 
 *! @inherit Error.Generic 
 *! 
 *! Error object used when one or more required services are missing 
 *! in a @[GSSAPI.Context] object. 
 */ 
 
/*! @decl constant is_gssapi_missing_services_error = 1 
 *! @decl constant error_type = "gssapi_missing_services_error" 
 *! 
 *! Object recognition constants. 
 */ 
 
struct missing_err_struct { 
  INT_TYPE services; 
}; 
 
static struct program *missing_err_program = NULL; 
static ptrdiff_t missing_err_struct_offset; 
 
#undef THIS 
#define THIS ((struct missing_err_struct *)                             \ 
              (Pike_fp->current_storage + missing_err_struct_offset)) 
 
/* We can reuse the same GEN_ERR_THIS as in gssapi_err_program. */ 
 
static void missing_err_events (int event) 
{ 
  switch (event) { 
    case PROG_EVENT_INIT: 
      THIS->services = 0; 
      break; 
  } 
} 
 
/*! @decl int services 
 *! 
 *! Bitfield of @tt{GSSAPI.*_FLAG@} flags for the missing services 
 *! that caused the error. 
 *! 
 *! @seealso 
 *!   @[GSSAPI.describe_services] 
 */ 
 
static void describe_services_and_push (OM_uint32 services) 
{ 
  int n = 0; 
  if (services & GSS_C_DELEG_FLAG)      {push_static_text ("DEL"); n++;} 
  if (services & GSS_C_MUTUAL_FLAG)     {push_static_text ("MUT"); n++;} 
  if (services & GSS_C_REPLAY_FLAG)     {push_static_text ("REPL"); n++;} 
  if (services & GSS_C_SEQUENCE_FLAG)   {push_static_text ("SEQ"); n++;} 
  if (services & GSS_C_CONF_FLAG)       {push_static_text ("CONF"); n++;} 
  if (services & GSS_C_INTEG_FLAG)      {push_static_text ("INTEG"); n++;} 
  if (services & GSS_C_ANON_FLAG)       {push_static_text ("ANON"); n++;} 
  if (services & GSS_C_PROT_READY_FLAG) {push_static_text ("READY"); n++;} 
  if (services & GSS_C_TRANS_FLAG)      {push_static_text ("TRANS"); n++;} 
  f_aggregate (n); 
  push_static_text ("|"); 
  o_multiply(); 
} 
 
static struct pike_string *make_missing_err_message (OM_uint32 missing) 
{ 
  int n = 0; 
  push_static_text ("Required service(s) missing: "); 
  describe_services_and_push (missing); 
  push_static_text ("\n"); 
  f_add (3); 
  assert (TYPEOF(Pike_sp[-1]) == T_STRING); 
  return (--Pike_sp)->u.string; 
} 
 
/*! @decl protected void create (void|int missing_services) 
 *! 
 *! @param missing_services 
 *!   Initial value for @[services]. 
 */ 
static void missing_err_create (INT32 args) 
{ 
  if (args > 1) wrong_number_of_args_error ("create", args, 1); 
 
  if (args) { 
    if (TYPEOF(Pike_sp[-1]) != T_INT) 
      SIMPLE_ARG_TYPE_ERROR ("create", 1, "void|int"); 
    THIS->services = Pike_sp[-1].u.integer; 
  } 
} 
 
/*! @endclass */ 
 
static void throw_missing_services_error (OM_uint32 missing) 
{ 
  struct object *o = fast_clone_object (missing_err_program); 
  struct missing_err_struct *missing_err = 
    (struct missing_err_struct *) (o->storage + missing_err_struct_offset); 
  /* Assume missing_err_program begins with the generic_error_program 
   * inherit. */ 
  struct generic_error_struct *gen_err = 
    (struct generic_error_struct *) (o->storage + 0); 
 
  missing_err->services = missing; 
  gen_err->error_message = make_missing_err_message (missing); 
 
  generic_error_va (o, NULL, NULL, 0, NULL, NULL); 
} 
 
 
/*! @decl constant string NT_HOSTBASED_SERVICE 
 *! @decl constant string NT_USER_NAME 
 *! @decl constant string NT_MACHINE_UID_NAME 
 *! @decl constant string NT_STRING_UID_NAME 
 *! @decl constant string NT_ANONYMOUS 
 *! @decl constant string NT_EXPORT_NAME 
 *! @decl constant string KRB5_NT_PRINCIPAL_NAME 
 *! 
 *! OIDs on dotted-decimal form for the GSS-API mechanism-independent 
 *! name types, and some selected mechanism-specific ones: 
 *! 
 *! @dl 
 *! @item NT_HOSTBASED_SERVICE 
 *!   Name type for a service associated with a host computer. The 
 *!   syntax is @tt{service@@hostname@} where the @tt{@@hostname@} 
 *!   part may be omitted for the local host. See @rfc{2743:4.1@}. 
 *! @item NT_USER_NAME 
 *!   Name type for a named user on a local system. The syntax is 
 *!   @tt{username@}. See @rfc{2743:4.2@}. 
 *! @item NT_MACHINE_UID_NAME 
 *!   Name type for a numeric user identifier corresponding to a user 
 *!   on a local system. The string representing a name of this type 
 *!   should contain a locally-significant user ID, represented in 
 *!   host byte order. See @rfc{2743:4.3@}. 
 *! @item NT_STRING_UID_NAME 
 *!   Name type for a string of digits representing the numeric user 
 *!   identifier of a user on a local system. This name type is 
 *!   similar to the Machine UID Form, except that the buffer contains 
 *!   a string representing the user ID. See @rfc{2743:4.4@}. 
 *! @item NT_ANONYMOUS 
 *!   Name type to identify anonymous names. See @rfc{2743:4.5@}. 
 *! @item NT_EXPORT_NAME 
 *!   Name type for the Mechanism-Independent Exported Name Object 
 *!   type, which is the type of the names returned by 
 *!   @[GSSAPI.Name.export]. See @rfc{2743:4.7@}. 
 *! @item KRB5_NT_PRINCIPAL_NAME 
 *!   Name type for a Kerberos principal. See @rfc{1964:2.1.1@}. 
 *! @enddl 
 */ 
 
/*! @class Name 
 *! 
 *! An object of this class contains a name on the internal form which 
 *! is required by the GSS-API functions. See @rfc{2743:1.1.5@}. 
 */ 
PIKECLASS Name 
{ 
  CVAR gss_name_t name; 
 
  static void cleanup_name (gss_name_t *name) 
  { 
    if (*name != GSS_C_NO_NAME) { 
      OM_uint32 maj, min; 
      DMALLOC_UNREGISTER (*name); 
      maj = gss_release_name (&min, name); 
      MORE_STATUS_MSG (gss_release_name, maj, min); 
      CHECK_UNEXPECTED_ERROR (gss_release_name, maj, min); 
      *name = GSS_C_NO_NAME; 
    } 
  } 
 
#define GET_GSS_NAME_FROM_OBJ_ARG(GSS_NAME, OBJ, FN, ARG) do {          \ 
    struct Name_struct *ns_ =                                           \ 
      (struct Name_struct *) get_storage (OBJ, Name_program);           \ 
    if (!ns_)                                                           \ 
      SIMPLE_ARG_TYPE_ERROR (FN, ARG, "GSSAPI.Name");                   \ 
    GSS_NAME = ns_->name;                                               \ 
  } while (0) 
 
#define PUSH_GSS_NAME_AS_OBJ(NAME) do {                                 \ 
    struct object *o = fast_clone_object (Name_program);                \ 
    OBJ2_NAME (o)->name = NAME;                                         \ 
    debug_malloc_touch (NAME);                                          \ 
    push_object (o);                                                    \ 
  } while (0) 
 
  INIT 
  { 
    THIS->name = GSS_C_NO_NAME; 
  } 
 
  EXIT 
    gc_trivial; 
  { 
    cleanup_name (&THIS->name); 
  } 
 
  static void import_name_from_string (struct pike_string *name_str, 
                                       gss_name_t *name, 
                                       const gss_OID type) 
  { 
    gss_buffer_desc buf; 
    gss_name_t name_tmp = GSS_C_NO_NAME; 
    OM_uint32 maj, min; 
 
    assert (!name_str->size_shift); 
 
    buf.length = name_str->len; 
    buf.value = name_str->str; 
 
    THREADS_ALLOW(); 
    /* RFC 2743 doesn't rule out that this might block. */ 
    maj = gss_import_name (&min, &buf, type, &name_tmp); 
    THREADS_DISALLOW(); 
 
    STATUS_MSG (gss_import_name, maj, min); 
 
    DMALLOC_REGISTER (name_tmp); 
    if (*name != GSS_C_NO_NAME) 
      cleanup_name (name);   /* Cope with race after THREADS_ALLOW. */ 
    *name = name_tmp; 
 
    CHECK_ERROR (gss_import_name, maj, min); 
  } 
 
  /*! @decl protected void create (string name, void|string name_type) 
   *! 
   *! This wraps @tt{GSS_Import_name@} according to @rfc{2743:2.4.5@}. 
   *! 
   *! @param name 
   *!   A name on string form (a contiguous string name in GSS-API 
   *!   parlance). 
   *! 
   *! @param name_type 
   *!   The OID on dotted-decimal form for the type of the name in 
   *!   @[name]. If left out, @[name] is parsed according to a 
   *!   mechanism-specific default printable syntax. 
   *! 
   *! @note 
   *!   If @[name] is the result of @[export] or a similar function 
   *!   then @[name_type] should be @[GSSAPI.NT_EXPORT_NAME]. 
   */ 
  PIKEFUN void create (string name, void|string name_type) 
    flags ID_PROTECTED; 
  { 
    gss_OID_desc type_desc; 
    gss_OID type; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    struct pike_string *_name_type; 
    CHECK_OPT_ARG (name_type, _name_type, 
                   T_STRING, string, "string", "create", 2); 
#define name_type _name_type 
#endif 
 
    CHECK_NARROW_STRING (name, "create", 1); 
 
    if (name_type) 
      /* mega_apply pops for us if get_pushed_gss_oid pushes. */ 
      get_pushed_gss_oid (name_type, type = &type_desc); 
    else 
      type = GSS_C_NO_OID; 
 
    import_name_from_string (name, &THIS->name, type); 
 
#undef name_type 
  } 
 
  /*! @decl string display_name() 
   *! @decl string display_name_type() 
   *! 
   *! @[display_name] returns a representation of the name for display 
   *! purposes, and @[display_name_type] returns an OID on 
   *! dotted-decimal form for the type of that name. 
   *! 
   *! If no type was given to @[create] then @[display_name_type] 
   *! might return zero. 
   *! 
   *! This wraps @tt{GSS_Display_name@} according to 
   *! @rfc{2743:2.4.4@}. 
   *! 
   *! @seealso 
   *!   The @tt{GSSAPI.NT_*@} constants. 
   */ 
 
  PIKEFUN string display_name() 
  { 
    WITH_GSS_BUFFER (d_name) { 
      OM_uint32 maj, min; 
      maj = gss_display_name (&min, THIS->name, &d_name, NULL); 
      STATUS_MSG (gss_display_name, maj, min); 
      CHECK_ERROR (gss_display_name, maj, min); 
 
      push_string (make_shared_binary_string (d_name.value, d_name.length)); 
    } END_GSS_BUFFER (d_name); 
  } 
 
  PIKEFUN string display_name_type() 
  { 
    WITH_GSS_BUFFER (d_name) { 
      gss_OID type; 
      OM_uint32 maj, min; 
      /* Can't leave out the name buffer. */ 
      maj = gss_display_name (&min, THIS->name, &d_name, &type); 
      STATUS_MSG (gss_display_name, maj, min); 
      CHECK_ERROR (gss_display_name, maj, min); 
 
      if (type == GSS_C_NO_OID) 
        push_int (0); 
      else 
        ref_push_string (get_dd_oid (type)); 
    } END_GSS_BUFFER (d_name); 
  } 
 
  static void describe_name (struct string_builder *sb, 
                             gss_name_t name, int with_type) 
  { 
    WITH_GSS_BUFFER (d_name) { 
      gss_OID type; 
      OM_uint32 maj, min; 
      maj = gss_display_name (&min, name, &d_name, &type); 
      MORE_STATUS_MSG (gss_display_name, maj, min); 
 
#ifdef PIKE_DEBUG 
      if (GSS_CALLING_ERROR (maj)) 
        handle_error (__LINE__, "gss_display_name", maj, min, GSS_C_NO_OID); 
#endif 
      switch (GSS_ROUTINE_ERROR (maj)) { 
        default: 
          string_builder_sprintf ( 
            sb, "unexpected gss_display_name error: %x/%x", maj, min); 
          break; 
 
        case GSS_S_BAD_NAME: 
          string_builder_strcat (sb, "ill-formed"); 
          break; 
 
        case GSS_S_COMPLETE: { 
          if (with_type && type != GSS_C_NO_OID) { 
            if (IS_SAME_OID (type, GSS_C_NT_HOSTBASED_SERVICE)) 
              string_builder_strcat (sb, "service: "); 
            else if (IS_SAME_OID (type, GSS_C_NT_USER_NAME)) 
              string_builder_strcat (sb, "user: "); 
            else if (IS_SAME_OID (type, GSS_C_NT_MACHINE_UID_NAME)) 
              string_builder_strcat (sb, "binary uid: "); 
            else if (IS_SAME_OID (type, GSS_C_NT_STRING_UID_NAME)) 
              string_builder_strcat (sb, "decimal uid: "); 
            else if (IS_SAME_OID (type, GSS_C_NT_ANONYMOUS)) 
              string_builder_strcat (sb, "anonymous: "); 
            else if (IS_SAME_OID (type, GSS_C_NT_EXPORT_NAME)) 
              string_builder_strcat (sb, "export name: "); 
            else { 
              string_builder_shared_strcat (sb, get_dd_oid (type)); 
              string_builder_strcat (sb, ": "); 
            } 
          } 
 
          push_static_text ("%O"); 
          push_string (make_shared_binary_string (d_name.value, d_name.length)); 
          f_sprintf (2); 
          string_builder_shared_strcat (sb, Pike_sp[-1].u.string); 
          pop_stack(); 
          break; 
        } 
      } 
    } END_GSS_BUFFER (d_name); 
  } 
 
  PIKEFUN string _sprintf (int flag, ...) 
    flags ID_PROTECTED; 
  { 
    pop_n_elems (args); 
 
    if (flag != 'O') 
      push_int (0); 
 
    else { 
      struct string_builder sb; 
      ONERROR uwp; 
      init_string_builder (&sb, 0); 
      SET_ONERROR (uwp, free_string_builder, &sb); 
 
      string_builder_strcat (&sb, "GSSAPI.Name("); 
      if (THIS->name != GSS_C_NO_NAME) 
        describe_name (&sb, THIS->name, 1); 
      string_builder_putchar (&sb, ')'); 
 
      UNSET_ONERROR (uwp); 
      push_string (finish_string_builder (&sb)); 
    } 
  } 
 
  /*! @decl Name canonicalize (string mech) 
   *! 
   *! Returns a @[GSSAPI.Name] containing the canonical mechanism name 
   *! (MN) of this name. The mechanism is given as a dotted-decimal 
   *! OID in @[mech]. 
   *! 
   *! This wraps @tt{GSS_Canonicalize_name@} according to 
   *! @rfc{2743:2.4.14@}. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers. 
   */ 
  PIKEFUN object(Name) canonicalize (string mech) 
  { 
    gss_name_t mn = GSS_C_NO_NAME; 
    ONERROR uwp; 
 
    if (THIS->name == GSS_C_NO_NAME) 
      Pike_error ("Name object not initialized.\n"); 
 
    WITH_PUSHED_GSS_OID (mech_oid, mech) { 
      gss_name_t n = THIS->name; 
      OM_uint32 maj, min; 
 
      SET_ONERROR (uwp, cleanup_name, &mn); 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_canonicalize_name (&min, n, &mech_oid, &mn); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_canonicalize_name, maj, min); 
      DMALLOC_REGISTER (mn); 
      CHECK_ERROR_WITH_MECH (gss_canonicalize_name, maj, min, &mech_oid); 
    } END_GSS_OID (mech_oid); 
 
    pop_n_elems (args); 
    PUSH_GSS_NAME_AS_OBJ (mn); 
    UNSET_ONERROR (uwp); 
  } 
 
  /*! @decl string export (void|string mech) 
   *! 
   *! Returns the name on the exported format. If @[mech] isn't given 
   *! then the name has to be a mechanism name (MN). If @[mech] is 
   *! given then the name is canonicalized according to that mechanism 
   *! before being exported (see @[canonicalize]). 
   *! 
   *! This wraps @tt{GSS_Export_name@} according to 
   *! @rfc{2743:2.4.15@}. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers if @[mech] is specified. 
   */ 
  PIKEFUN string export (void|string mech) 
  { 
    gss_OID_desc mech_oid_desc; 
    gss_OID mech_oid; 
    gss_name_t mn = GSS_C_NO_NAME; 
    ONERROR uwp; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    struct pike_string *_mech; 
    CHECK_OPT_ARG (mech, _mech, T_STRING, string, "string", "export", 1); 
#define mech _mech 
#endif 
 
    if (THIS->name == GSS_C_NO_NAME) 
      Pike_error ("Name object not initialized.\n"); 
 
    if (mech) { 
      gss_name_t n = THIS->name; 
      OM_uint32 maj, min; 
 
      if (get_pushed_gss_oid (mech, mech_oid = &mech_oid_desc)) 
        /* Make the pop code below handle the extra stack item. */ 
        args++; 
 
      SET_ONERROR (uwp, cleanup_name, &mn); 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_canonicalize_name (&min, n, mech_oid, &mn); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_canonicalize_name, maj, min); 
      DMALLOC_REGISTER (mn); 
      CHECK_ERROR_WITH_MECH (gss_canonicalize_name, maj, min, mech_oid); 
    } 
    else { 
      mech_oid = GSS_C_NO_OID; 
      mn = THIS->name; 
    } 
 
    WITH_GSS_BUFFER (exp) { 
      OM_uint32 maj, min; 
      maj = gss_export_name (&min, mn, &exp); 
      STATUS_MSG (gss_export_name, maj, min); 
      CHECK_ERROR_WITH_MECH (gss_export_name, maj, min, mech_oid); 
      push_string (make_shared_binary_string (exp.value, exp.length)); 
    } END_GSS_BUFFER (exp); 
 
    if (mech) 
      CALL_AND_UNSET_ONERROR (uwp); 
 
    stack_pop_n_elems_keep_top (args); 
#undef mech 
  } 
 
  /*! @decl protected int `== (mixed other) 
   *! 
   *! Returns true if @[other] is a @[GSSAPI.Name] which contains a 
   *! name that refers to the same identity as this one. 
   *! 
   *! This wraps @tt{GSS_Compare_name@} according to 
   *! @rfc{2743:2.4.3@}. 
   *! 
   *! If either @[GSSAPI.Name] object is uninitialized or contains an 
   *! anonymous identity then they are considered different, unless it 
   *! is the very same @[GSSAPI.Name] object (that is an inherent pike 
   *! behavior). 
   *! 
   *! @throws 
   *!   An error is thrown if the names are incomparable, or if either 
   *!   of them are ill-formed. 
   */ 
  PIKEFUN int `== (mixed other) 
    flags ID_PROTECTED; 
  { 
    if (THIS->name != GSS_C_NO_NAME && 
        TYPEOF(*other) == T_OBJECT) { 
      struct Name_struct *other_stor = 
        (struct Name_struct *) get_storage (other->u.object, Name_program); 
 
      if (other_stor && other_stor->name != GSS_C_NO_NAME) { 
        int equal; 
        OM_uint32 maj, min; 
        maj = gss_compare_name (&min, THIS->name, other_stor->name, &equal); 
        STATUS_MSG (gss_compare_name, maj, min); 
        CHECK_ERROR (gss_compare_name, maj, min); 
        RETURN equal; 
      } 
    } 
 
    RETURN 0; 
  } 
 
  /*! @decl protected int __hash() 
   *! 
   *! Tries to export the name (see @[export]) and if that succeeds 
   *! returns a hash made from the exported name string. Otherwise a 
   *! normal hash based on this object is returned. 
   *! 
   *! This means that mechanism names (MNs) can be used as indices in 
   *! mappings without getting duplicate entries for the same 
   *! identity. 
   */ 
  PIKEFUN int __hash() 
    flags ID_PROTECTED; 
  { 
    int got_hash = 0; 
 
    if (THIS->name != GSS_C_NO_NAME) 
      WITH_GSS_BUFFER (exp) { 
        OM_uint32 maj, min; 
        maj = gss_export_name (&min, THIS->name, &exp); 
        STATUS_MSG (gss_export_name, maj, min); 
 
        if (!GSS_ERROR (maj)) { 
          push_string (make_shared_binary_string (exp.value, exp.length)); 
          push_int64(hash_svalue(Pike_sp - 1)); 
          got_hash = 1; 
        } 
      } END_GSS_BUFFER (exp); 
 
    if (!got_hash) { 
      size_t h; 
#if SIZEOF_CHAR_P > 4 
      h=(size_t)(PTR_TO_INT(Pike_fp->current_object) >> 2); 
#else 
      h=(size_t)(PTR_TO_INT(Pike_fp->current_object)); 
#endif 
      RETURN h; 
    } 
  } 
 
#ifdef HAVE_GSS_INQUIRE_MECHS_FOR_NAME 
  /*! @decl multiset(string) mechs() 
   *! 
   *! Returns the OIDs for the mechanisms that might be able to 
   *! process this name. The returned OID strings are on 
   *! dotted-decimal form. 
   *! 
   *! This wraps @tt{GSS_Inquire_mechs_for_name@} according to 
   *! @rfc{2743:2.4.13@}. 
   *! 
   *! @note 
   *!   Some older GSS-API v2 implementations lack this funcion. 
   */ 
  PIKEFUN multiset(string) mechs() 
  { 
    gss_OID_set mechs = GSS_C_NO_OID_SET; 
    ONERROR uwp; 
 
    if (THIS->name == GSS_C_NO_NAME) 
      throw_gssapi_error (GSS_S_BAD_NAMETYPE, 0, GSS_C_NO_OID, NULL); 
 
    SET_ONERROR (uwp, cleanup_oid_set, &mechs); 
 
    { 
      gss_name_t n = THIS->name; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_inquire_mechs_for_name (&min, n, &mechs); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_inquire_mechs_for_name, maj, min); 
      DMALLOC_REGISTER (mechs); 
      CHECK_ERROR (gss_inquire_mechs_for_name, maj, min); 
    } 
 
    convert_from_oid_set_and_push (mechs); 
    CALL_AND_UNSET_ONERROR (uwp); 
  } 
#endif 
} 
 
/*! @endclass */ 
 
 
/*! @decl constant int INITIATE 
 *! @decl constant int ACCEPT 
 *! @decl constant int BOTH 
 *! 
 *! Flags for indicating how a @[GSSAPI.Cred] object may be used: 
 *! 
 *! @dl 
 *! @item INITIATE 
 *!   The credential can only be used to initiate security contexts 
 *!   (i.e. using @[GSSAPI.InitContext]). 
 *! @item ACCEPT 
 *!   The credential can only be used to accept security contexts 
 *!   (i.e. using @[GSSAPI.AcceptContext]). 
 *! @item BOTH 
 *!   The credential may be used both to initiate or accept security 
 *!   contexts. 
 *! @enddl 
 */ 
 
/*! @class Cred 
 *! 
 *! Objects of this class hold one or more credentials that the 
 *! current process can use to assert identities; see 
 *! @rfc{2743:1.1.1@}. 
 *! 
 *! @note 
 *!   If a @[Cred] object is destructed, @tt{GSS_Release_cred@} 
 *!   (@rfc{2743:2.1.2@}) is called. The RFC doesn't preclude that 
 *!   that function might do blocking network I/O, which due to pike's 
 *!   object management might occur essentially anytime in any thread 
 *!   if the object isn't explicitly destructed. To avoid that, it's 
 *!   recommended to call @[release] in credential objects that are no 
 *!   longer used. 
 */ 
PIKECLASS Cred 
{ 
  CVAR gss_cred_id_t cred; 
 
  static void cleanup_cred (gss_cred_id_t *cred) 
  /* Warning: This function uses THREADS_ALLOW/THREADS_DISALLOW. */ 
  { 
    if (*cred != GSS_C_NO_CREDENTIAL) { 
      OM_uint32 maj, min; 
      DMALLOC_UNREGISTER (*cred); 
      THREADS_ALLOW(); 
      maj = gss_release_cred (&min, cred); 
      STATUS_MSG (gss_release_cred, maj, min); 
      THREADS_DISALLOW(); 
      CHECK_UNEXPECTED_ERROR (gss_release_cred, maj, min); 
      *cred = GSS_C_NO_CREDENTIAL; 
    } 
  } 
 
  INIT 
  { 
    THIS->cred = GSS_C_NO_CREDENTIAL; 
  } 
 
  EXIT 
    gc_trivial; 
  { 
    if (THIS->cred != GSS_C_NO_CREDENTIAL) cleanup_cred (&THIS->cred); 
  } 
 
  /*! @decl void acquire (Name|string name, @ 
   *!                     int cred_usage, @ 
   *!                     void|multiset(string) desired_mechs, @ 
   *!                     void|int(0..) desired_time) 
   *! 
   *! Acquire initial credentials for this object. It is an error if 
   *! it already has some credentials. 
   *! 
   *! This wraps @tt{GSS_Acquire_cred@} according to 
   *! @rfc{2743:2.1.1@}. 
   *! 
   *! @param name 
   *!   The name of the identity for which credentials should be 
   *!   acquired. It is up to the GSS-API implementation to check 
   *!   whether the running process is authorized to act on behalf of 
   *!   this identity. 
   *! 
   *!   This can be either a @[GSSAPI.Name] object or a string. In the 
   *!   latter case, the string is converted to a GSS-API name 
   *!   according to a mechanism-specific default printable syntax, 
   *!   i.e. just like if it would be given as the sole argument to 
   *!   @[GSSAPI.Name.create]. 
   *! 
   *!   If this is zero then credentials for the default principal (if 
   *!   any) are retrieved. 
   *! 
   *! @param cred_usage 
   *!   Specifies how the credential will be used. One of 
   *!   @[GSSAPI.INITIATE], @[GSSAPI.ACCEPT] or @[GSSAPI.BOTH]. 
   *! 
   *! @param desired_mechs 
   *!   The mechanisms that the credentials should cover, as a 
   *!   multiset containing their OIDs on dotted-decimal form. If zero 
   *!   or left out then a default set provided by the GSS-API 
   *!   implementation is used. 
   *! 
   *!   It is an error to pass an empty multiset. 
   *! 
   *! @param desired_time 
   *!   Number of seconds the credentials should remain valid. The 
   *!   GSS-API implementation may return credentials that are valid 
   *!   both longer and shorter than this. Zero or left out means use 
   *!   the maximum permitted time. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers. 
   */ 
  PIKEFUN void acquire (zero|object(Name)|string name, 
                        int cred_usage, 
                        void|multiset(string) desired_mechs, 
                        void|zero|int(0..) desired_time) 
  { 
    gss_name_t gss_name = GSS_C_NO_NAME; 
    OM_uint32 time; 
    gss_OID_set mechs = GSS_C_NO_OID_SET; 
    ONERROR uwp1, uwp2; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    struct multiset *_desired_mechs; 
    INT_TYPE _desired_time; 
    CHECK_OPT_ARG (desired_mechs, _desired_mechs, 
                   T_MULTISET, multiset, "multiset(string)", "create", 3); 
    CHECK_OPT_ARG (desired_time, _desired_time, 
                   T_INT, integer, "int(0..)", "create", 4); 
#define desired_mechs _desired_mechs 
#define desired_time _desired_time 
#endif 
 
    switch (TYPEOF(*name)) { 
      case T_OBJECT: 
        GET_GSS_NAME_FROM_OBJ_ARG (gss_name, name->u.object, "acquire", 1); 
        break; 
      case T_STRING: { 
        struct pike_string *name_str = name->u.string; 
        CHECK_NARROW_STRING (name_str, "acquire", 1); 
        SET_ONERROR (uwp1, cleanup_name, &gss_name); 
        import_name_from_string (name_str, &gss_name, GSS_C_NO_OID); 
        break; 
      } 
      case T_INT: 
        if (!name->u.integer) break; 
        /* Fall through */ 
      default: 
        SIMPLE_ARG_TYPE_ERROR ("acquire", 1, "GSSAPI.Name|string"); 
    } 
 
    if (THIS->cred != GSS_C_NO_CREDENTIAL) 
      Pike_error ("The object already contain credentials.\n"); 
 
    if (desired_mechs) { 
      if (!multiset_sizeof (desired_mechs)) 
        SIMPLE_ARG_ERROR ("acquire", 3, "Multiset must not be empty."); 
      if (multiset_ind_types (desired_mechs) & ~BIT_STRING) 
        multiset_fix_type_field (desired_mechs); 
      if (multiset_ind_types (desired_mechs) != BIT_STRING) 
        SIMPLE_ARG_TYPE_ERROR ("acquire", 3, "multiset(string)"); 
      SET_ONERROR (uwp2, cleanup_oid_set, &mechs); 
      convert_to_oid_set (desired_mechs, &mechs); 
    } 
 
    if (desired_time < 0) 
      SIMPLE_ARG_TYPE_ERROR ("acquire", 4, "int(0..)"); 
    time = desired_time; 
    if (!time) time = GSS_C_INDEFINITE; 
 
    { 
      gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      maj = gss_acquire_cred (&min, gss_name, time, mechs, cred_usage, &cred, 
                              NULL, NULL); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_acquire_cred, maj, min); 
 
      DMALLOC_REGISTER (cred); 
      if (THIS->cred != GSS_C_NO_CREDENTIAL) 
        Pike_error ("The object already contain credentials.\n"); 
      THIS->cred = cred; 
 
      CHECK_ERROR (gss_acquire_cred, maj, min); 
    } 
 
    if (desired_mechs) 
      CALL_AND_UNSET_ONERROR (uwp2); 
    if (TYPEOF(*name) == T_STRING) 
      CALL_AND_UNSET_ONERROR (uwp1); 
 
#undef desired_mechs 
#undef desired_time 
  } 
 
  /*! @decl void add (Name|string name, @ 
   *!                 int cred_usage, @ 
   *!                 string desired_mech, @ 
   *!                 void|int(0..)|array(int(0..)) desired_time) 
   *! 
   *! Adds another credential element to this object. If this object 
   *! has no credentials already then it will get the default 
   *! credentials in addition to this specified one. 
   *! 
   *! This wraps @tt{GSS_Add_cred@} according to @rfc{2743:2.1.4@}. 
   *! 
   *! @param name 
   *!   The name of the identity for which a credential should be 
   *!   acquired. It is up to the GSS-API implementation to check 
   *!   whether the running process has sufficient privileges to act 
   *!   on behalf of this identity. 
   *! 
   *!   This can be either a @[GSSAPI.Name] object or a string. In the 
   *!   latter case, the string is converted to a GSS-API name 
   *!   according to a mechanism-specific default printable syntax, 
   *!   i.e. just like if it would be given as the sole argument to 
   *!   @[GSSAPI.Name.create]. 
   *! 
   *!   If this is zero then a credential for the default principal 
   *!   (if any) are retrieved. 
   *! 
   *! @param cred_usage 
   *!   Specifies how the credential will be used. One of 
   *!   @[GSSAPI.INITIATE], @[GSSAPI.ACCEPT] or @[GSSAPI.BOTH]. 
   *! 
   *! @param desired_mech 
   *!   The mechanism that the credential should cover, as an OID on 
   *!   dotted-decimal form. 
   *! 
   *! @param desired_time 
   *!   Number of seconds the credential should remain valid. The 
   *!   GSS-API implementation may return a credential that is valid 
   *!   both longer and shorter than this. Zero or left out means use 
   *!   the maximum permitted time. 
   *! 
   *!   This can also be an array containing two elements. In that 
   *!   case the first element applies to the credential when it is 
   *!   used to initiate contexts, and the second element applies to 
   *!   use for acceptor contexts. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers. 
   */ 
  PIKEFUN void add (zero|object(Name)|string name, 
                    int cred_usage, 
                    string desired_mech, 
                    void|int(0..)|array(int(0..)) desired_time) 
  { 
    gss_name_t gss_name = GSS_C_NO_NAME; 
    OM_uint32 init_time, acc_time; 
    ONERROR uwp; 
 
    switch (TYPEOF(*name)) { 
      case T_OBJECT: 
        GET_GSS_NAME_FROM_OBJ_ARG (gss_name, name->u.object, "add", 1); 
        break; 
      case T_STRING: { 
        struct pike_string *name_str = name->u.string; 
        CHECK_NARROW_STRING (name_str, "add", 1); 
        SET_ONERROR (uwp, cleanup_name, &gss_name); 
        import_name_from_string (name_str, &gss_name, GSS_C_NO_OID); 
        break; 
      } 
      case T_INT: 
        if (!name->u.integer) break; 
        /* Fall through */ 
      default: 
        SIMPLE_ARG_TYPE_ERROR ("add", 1, "GSSAPI.Name|string"); 
    } 
 
    if (!desired_time) 
      init_time = acc_time = 0; 
    else 
      switch (TYPEOF(*desired_time)) { 
        case T_INT: 
          if (desired_time->u.integer < 0) 
            SIMPLE_ARG_ERROR ("add", 4, "Expected positive integer."); 
          init_time = acc_time = desired_time->u.integer; 
          break; 
 
        case T_ARRAY: { 
          struct array *times = desired_time->u.array; 
          int e; 
          if (times->size != 2) 
            SIMPLE_ARG_ERROR ("add", 4, "Array should have two elements."); 
          for (e = 0; e < 2; e++) 
            if (TYPEOF(times->item[e]) != T_INT || times->item[e].u.integer < 0) 
              SIMPLE_ARG_ERROR ("add", 4, 
                                "Array element is not a positive integer."); 
          init_time = times->item[0].u.integer; 
          acc_time = times->item[1].u.integer; 
          break; 
        } 
 
        default: 
          SIMPLE_ARG_TYPE_ERROR ("add", 4, "void|int(0..)|array(int(0..))"); 
      } 
    if (!init_time) init_time = GSS_C_INDEFINITE; 
    if (!acc_time) acc_time = GSS_C_INDEFINITE; 
 
    WITH_PUSHED_GSS_OID (mech_oid, desired_mech) { 
      gss_cred_id_t cred = THIS->cred; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      maj = gss_add_cred (&min, cred, gss_name, &mech_oid, cred_usage, 
                          init_time, acc_time, 
                          cred == GSS_C_NO_CREDENTIAL ? &cred : NULL, 
                          NULL, NULL, NULL); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_add_cred, maj, min); 
 
      if (THIS->cred == GSS_C_NO_CREDENTIAL) { 
        DMALLOC_REGISTER (cred); 
        THIS->cred = cred; 
      } 
      else if (THIS->cred != cred) { 
        cleanup_cred (&cred); 
        Pike_error ("Contained credentials changed asynchronously.\n"); 
      } 
 
      CHECK_ERROR_WITH_MECH (gss_add_cred, maj, min, &mech_oid); 
    } END_GSS_OID (mech_oid); 
 
#undef name 
  } 
 
  /*! @decl GSSAPI.Name name (void|string mech) 
   *! @decl int cred_usage (void|string mech) 
   *! @decl multiset(string) mechs() 
   *! @decl int(0..)|Int.inf lifetime() 
   *! @decl int(0..)|Int.inf init_lifetime (string mech) 
   *! @decl int(0..)|Int.inf accept_lifetime (string mech) 
   *! 
   *! Functions to query various properties about the credentials. 
   *! 
   *! These wrap @tt{GSS_Inquire_cred@} according to @rfc{2743:2.1.3@} 
   *! if @[mech] is not given, and @tt{GSS_Inquire_cred_by_mech@} 
   *! according to @rfc{2743:2.1.5@} otherwise. 
   *! 
   *! @param mech 
   *!   If this is given then the credential for that specific 
   *!   mechanism is queried. @[mech] contains the OID of the 
   *!   mechanism on dotted-decimal form. 
   *! 
   *!   Some of the query functions can only be used for a specific 
   *!   mechanism, in which case @[mech] is required. Some can only be 
   *!   used on the credentials in general, and the @[mech] argument 
   *!   is not applicable. Some can be used both ways, and then 
   *!   @[mech] is optional. 
   *! 
   *! @dl 
   *! @item 
   *!   @tt{name (void|string mech)@} 
   *!   Returns the name of the identity that the credential(s) 
   *!   assert. If @[mech] is given then the returned name is a 
   *!   Mechanism Name (MN). 
   *! 
   *!   The returned @[GSSAPI.Name] object is always a newly created 
   *!   one, even though it typically compares as equal with the ones 
   *!   given to @[acquire] or @[add]. 
   *! 
   *! @item 
   *!   @tt{cred_usage (void|string mech)@} 
   *!   Returns how the credential(s) may be used, one of 
   *!   @[GSSAPI.INITIATE], @[GSSAPI.ACCEPT] or @[GSSAPI.BOTH]. 
   *! 
   *!   If @[mech] is not given then the returned usage value reflects 
   *!   the union of the capabilities in all credentials. 
   *! 
   *! @item 
   *!   @tt{mechs()@} 
   *!   Returns the set of mechanisms supported by the credential. The 
   *!   returned value is a multiset of strings with OIDs on 
   *!   dotted-decimal form. 
   *! 
   *! @item 
   *!   @tt{lifetime()@} 
   *!   Returns the shortest validity lifetime left in any of the 
   *!   mechanisms that are part of the credentials, for either 
   *!   initiator or acceptor use. 
   *! 
   *!   Returns zero if some part of the credentials has expired. 
   *! 
   *!   Returns @[Int.inf] if there is no time limit (in older pikes 
   *!   without @[Int.inf] a large positive integer is returned 
   *!   instead). 
   *! 
   *! @item 
   *!   @tt{init_lifetime (string mech)@} 
   *!   Returns the validity lifetime left for initiator use. 
   *! 
   *!   Returns zero if the credential has expired for this use or if 
   *!   its usage is @[GSSAPI.ACCEPT]. 
   *! 
   *!   Returns @[Int.inf] if there is no time limit (in older pikes 
   *!   without @[Int.inf] a large positive integer is returned 
   *!   instead). 
   *! 
   *! @item 
   *!   @tt{accept_lifetime (string mech)@} 
   *!   Returns the validity lifetime left for acceptor use. 
   *! 
   *!   Returns zero if the credential has expired for this use or if 
   *!   its usage is @[GSSAPI.INITIATE]. 
   *! 
   *!   Returns @[Int.inf] if there is no time limit (in older pikes 
   *!   without @[Int.inf] a large positive integer is returned 
   *!   instead). 
   *! @enddl 
   *! 
   *! @note 
   *!   @rfc{2743@} doesn't preclude that these functions might block 
   *!   on network connections to remote authentication servers. 
   */ 
 
  /* Perhaps we should hoard this data locally to reduce the number of 
   * calls (except the time values)? */ 
 
  PIKEFUN object(Name) name (void|string mech) 
  { 
    gss_name_t name = GSS_C_NO_NAME; 
    ONERROR uwp; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    struct pike_string *_mech; 
    CHECK_OPT_ARG (mech, _mech, T_STRING, string, "string", "name", 1); 
#define mech _mech 
#endif 
 
    if (THIS->cred == GSS_C_NO_CREDENTIAL) 
      throw_gssapi_error (GSS_S_NO_CRED, 0, GSS_C_NO_OID, NULL); 
 
    SET_ONERROR (uwp, cleanup_name, &name); 
 
    if (mech) 
      WITH_PUSHED_GSS_OID (mech_oid, mech) { 
        gss_cred_id_t cred = THIS->cred; 
        OM_uint32 maj, min; 
 
        THREADS_ALLOW(); 
        /* RFC 2743 doesn't rule out that this might block. */ 
        maj = gss_inquire_cred_by_mech (&min, cred, &mech_oid, 
                                        &name, NULL, NULL, NULL); 
        THREADS_DISALLOW(); 
 
        STATUS_MSG (gss_inquire_cred_by_mech, maj, min); 
        DMALLOC_REGISTER (name); 
        CHECK_ERROR_WITH_MECH (gss_inquire_cred_by_mech, maj, min, &mech_oid); 
      } END_GSS_OID (mech_oid); 
 
    else { 
      gss_cred_id_t cred = THIS->cred; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_inquire_cred (&min, cred, &name, NULL, NULL, NULL); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_inquire_cred, maj, min); 
      DMALLOC_REGISTER (name); 
      CHECK_ERROR (gss_inquire_cred, maj, min); 
    } 
 
    pop_n_elems (args); 
    PUSH_GSS_NAME_AS_OBJ (name); 
    UNSET_ONERROR (uwp); 
#undef mech 
  } 
 
  PIKEFUN int cred_usage (void|string mech) 
  { 
    gss_cred_usage_t usage; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    struct pike_string *_mech; 
    CHECK_OPT_ARG (mech, _mech, T_STRING, string, "string", "cred_usage", 1); 
#define mech _mech 
#endif 
 
    if (THIS->cred == GSS_C_NO_CREDENTIAL) 
      throw_gssapi_error (GSS_S_NO_CRED, 0, GSS_C_NO_OID, NULL); 
 
    if (mech) 
      WITH_PUSHED_GSS_OID (mech_oid, mech) { 
        gss_cred_id_t cred = THIS->cred; 
        OM_uint32 maj, min; 
 
        THREADS_ALLOW(); 
        /* RFC 2743 doesn't rule out that this might block. */ 
        maj = gss_inquire_cred_by_mech (&min, cred, &mech_oid, 
                                        NULL, NULL, NULL, &usage); 
        THREADS_DISALLOW(); 
 
        STATUS_MSG (gss_inquire_cred_by_mech, maj, min); 
        CHECK_ERROR_WITH_MECH (gss_inquire_cred_by_mech, maj, min, &mech_oid); 
      } END_GSS_OID (mech_oid); 
 
    else { 
      gss_cred_id_t cred = THIS->cred; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_inquire_cred (&min, cred, NULL, NULL, &usage, NULL); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_inquire_cred, maj, min); 
      CHECK_ERROR (gss_inquire_cred, maj, min); 
    } 
 
    RETURN usage; 
#undef mech 
  } 
 
  PIKEFUN multiset(string) mechs() 
  { 
    gss_OID_set mechs = GSS_C_NO_OID_SET; 
    ONERROR uwp; 
 
    if (THIS->cred == GSS_C_NO_CREDENTIAL) 
      throw_gssapi_error (GSS_S_NO_CRED, 0, GSS_C_NO_OID, NULL); 
 
    SET_ONERROR (uwp, cleanup_oid_set, &mechs); 
 
    { 
      gss_cred_id_t cred = THIS->cred; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_inquire_cred (&min, cred, NULL, NULL, NULL, &mechs); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_inquire_cred, maj, min); 
      DMALLOC_REGISTER (mechs); 
      CHECK_ERROR (gss_inquire_cred, maj, min); 
    } 
 
    convert_from_oid_set_and_push (mechs); 
    CALL_AND_UNSET_ONERROR (uwp); 
  } 
 
  /* Lying a little in the return type here for the sake of pike compat. */ 
  PIKEFUN int(0..) lifetime() 
  { 
    /* GSS-API implementations should always set this according to RFC 
     * 2744 section 5.21, but they might not do that in reality (see 
     * init/accept_lifetime below). */ 
    OM_uint32 time = 0; 
 
    if (THIS->cred == GSS_C_NO_CREDENTIAL) 
      throw_gssapi_error (GSS_S_NO_CRED, 0, GSS_C_NO_OID, NULL); 
 
    { 
      gss_cred_id_t cred = THIS->cred; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_inquire_cred (&min, cred, NULL, &time, NULL, NULL); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_inquire_cred, maj, min); 
      CHECK_ERROR (gss_inquire_cred, maj, min); 
    } 
 
    PUSH_TIME (time); 
  } 
 
  /* Lying a little in the return type here for the sake of pike compat. */ 
  PIKEFUN int(0..) init_lifetime (string mech) 
  { 
    /* GSS-API implementations should always set this according to RFC 
     * 2744 section 5.22, but they might not do that in reality (e.g. 
     * krb5-1.6). */ 
    OM_uint32 time = 0; 
 
    if (THIS->cred == GSS_C_NO_CREDENTIAL) 
      throw_gssapi_error (GSS_S_NO_CRED, 0, GSS_C_NO_OID, NULL); 
 
    WITH_PUSHED_GSS_OID (mech_oid, mech) { 
      gss_cred_id_t cred = THIS->cred; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_inquire_cred_by_mech (&min, cred, &mech_oid, 
                                      NULL, &time, NULL, NULL); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_inquire_cred_by_mech, maj, min); 
      CHECK_ERROR_WITH_MECH (gss_inquire_cred_by_mech, maj, min, &mech_oid); 
    } END_GSS_OID (mech_oid); 
 
    PUSH_TIME (time); 
  } 
 
  /* Lying a little in the return type here for the sake of pike compat. */ 
  PIKEFUN int(0..) accept_lifetime (string mech) 
  { 
    /* GSS-API implementations should always set this according to RFC 
     * 2744 section 5.22, but they might not do that in reality (e.g. 
     * krb5-1.6). */ 
    OM_uint32 time = 0; 
 
    if (THIS->cred == GSS_C_NO_CREDENTIAL) 
      throw_gssapi_error (GSS_S_NO_CRED, 0, GSS_C_NO_OID, NULL); 
 
    WITH_PUSHED_GSS_OID (mech_oid, mech) { 
      gss_cred_id_t cred = THIS->cred; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't rule out that this might block. */ 
      maj = gss_inquire_cred_by_mech (&min, cred, &mech_oid, 
                                      NULL, NULL, &time, NULL); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_inquire_cred_by_mech, maj, min); 
      CHECK_ERROR_WITH_MECH (gss_inquire_cred_by_mech, maj, min, &mech_oid); 
    } END_GSS_OID (mech_oid); 
 
    PUSH_TIME (time); 
  } 
 
  PIKEFUN string _sprintf (int flag, ...) 
    flags ID_PROTECTED; 
  { 
    pop_n_elems (args); 
 
    if (flag != 'O') 
      push_int (0); 
 
    else { 
      struct string_builder sb; 
      ONERROR uwp; 
      init_string_builder (&sb, 0); 
      SET_ONERROR (uwp, free_string_builder, &sb); 
 
      string_builder_strcat (&sb, "GSSAPI.Cred("); 
 
      if (THIS->cred != GSS_C_NO_CREDENTIAL) { 
        gss_cred_id_t cred = THIS->cred; 
        gss_name_t name = GSS_C_NO_NAME; 
        OM_uint32 time; 
        OM_uint32 maj, min; 
        ONERROR uwp2; 
        SET_ONERROR (uwp2, cleanup_name, &name); 
 
        THREADS_ALLOW(); 
        /* RFC 2743 doesn't rule out that this might block. */ 
        maj = gss_inquire_cred (&min, cred, &name, &time, NULL, NULL); 
        THREADS_DISALLOW(); 
 
        MORE_STATUS_MSG (gss_inquire_cred, maj, min); 
        DMALLOC_REGISTER (name); 
 
#ifdef PIKE_DEBUG 
      if (GSS_CALLING_ERROR (maj)) 
        handle_error (__LINE__, "gss_inquire_cred", maj, min, GSS_C_NO_OID); 
#endif 
        switch (GSS_ROUTINE_ERROR (maj)) { 
          default: 
          string_builder_sprintf ( 
            &sb, "unexpected gss_inquire_cred error: %x/%x", maj, min); 
          break; 
 
          case GSS_S_NO_CRED: 
            string_builder_strcat (&sb, "inaccessible"); 
            break; 
 
          case GSS_S_DEFECTIVE_CREDENTIAL: 
            string_builder_strcat (&sb, "defective"); 
            break; 
 
          case GSS_S_COMPLETE: 
          case GSS_S_CREDENTIALS_EXPIRED: 
            if (name != GSS_C_NO_NAME) 
              describe_name (&sb, name, 0); 
            if (!time) { 
              if (name != GSS_C_NO_NAME) string_builder_strcat (&sb, ", "); 
              string_builder_strcat (&sb, "expired"); 
            } 
            break; 
        } 
 
        CALL_AND_UNSET_ONERROR (uwp2); 
      } 
 
      string_builder_putchar (&sb, ')'); 
 
      UNSET_ONERROR (uwp); 
      push_string (finish_string_builder (&sb)); 
    } 
  } 
 
  /*! @decl void release() 
   *! 
   *! Frees the resources for the credential. 
   *! 
   *! This wraps @tt{GSS_Release_cred@} according to 
   *! @rfc{2743:2.1.2@}. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers. 
   */ 
  PIKEFUN void release() 
  { 
    cleanup_cred (&THIS->cred); 
    THIS->cred = GSS_C_NO_CREDENTIAL; 
  } 
} 
 
/*! @endclass */ 
 
 
/*! @decl constant int DELEG_FLAG 
 *! @decl constant int MUTUAL_FLAG 
 *! @decl constant int REPLAY_FLAG 
 *! @decl constant int SEQUENCE_FLAG 
 *! @decl constant int CONF_FLAG 
 *! @decl constant int INTEG_FLAG 
 *! @decl constant int ANON_FLAG 
 *! @decl constant int PROT_READY_FLAG 
 *! @decl constant int TRANS_FLAG 
 *! 
 *! Bitfield flags returned by e.g. @[GSSAPI.Context.services] to 
 *! denote various services that are available in the context. 
 *! 
 *! Brief descriptions of the flags: 
 *! 
 *! @dl 
 *! @item GSSAPI.DELEG_FLAG 
 *!   Delegation. See @rfc{2743:1.2.9@}. 
 *! @item GSSAPI.MUTUAL_FLAG 
 *!   Mutual authentication (actually, acceptor authentication). See 
 *!   @rfc{2743:1.1.1.3@} and @rfc{2743:1.2.5@}. 
 *! @item GSSAPI.REPLAY_FLAG 
 *!   Per-message replay detection. See @rfc{2743:1.2.3@}. 
 *! @item GSSAPI.SEQUENCE_FLAG 
 *!   Per-message sequencing. See @rfc{2743:1.2.3@}. 
 *! @item GSSAPI.CONF_FLAG 
 *!   Per-message confidentiality. See @rfc{2743:1.2.2@}. 
 *! @item GSSAPI.INTEG_FLAG 
 *!   Per-message integrity. See @rfc{2743:1.2.2@}. 
 *! @item GSSAPI.ANON_FLAG 
 *!   Anonymous authentication. See @rfc{2743:1.2.5@}. 
 *! @item GSSAPI.PROT_READY_FLAG 
 *!   Might be set before the context establishment has finished, to 
 *!   denote that per-message protection already is available. See 
 *!   @rfc{2743:1.2.7@}. Is always set in @[GSSAPI.Context] and 
 *!   derived classes when the context is established. 
 *! @item GSSAPI.TRANS_FLAG 
 *!   The context can be transferred between processes using 
 *!   @[GSSAPI.Context.export]. See @rfc{2743:1.2.10@}. 
 *! @enddl 
 */ 
 
/*! @decl string describe_services (int services) 
 *! 
 *! Returns a string that compactly describes the given @[services], 
 *! which is taken as a bitfield of @tt{GSSAPI.*_FLAG@} flags. 
 *! 
 *! The returned string contains capitalized names for the flags 
 *! reminiscent of the @[GSSAPI.*_FLAG] constants, separated by 
 *! @expr{"|"@}. 
 */ 
PIKEFUN string describe_services (int services) 
{ 
  pop_stack(); 
  describe_services_and_push (services); 
} 
 
/*! @class Context 
 *! 
 *! Class representing a security context; see @rfc{2743:1.1.3@} The 
 *! user usually instantiates one of the two inheriting classes 
 *! @[GSSAPI.InitContext] or @[GSSAPI.AcceptContext], based on whether 
 *! the context should act as initiator or acceptor for the 
 *! connection. This class is instantiated directly for imported 
 *! contexts. 
 *! 
 *! @note 
 *!   If a @[Context] object for a partly or completely established 
 *!   context is destructed, @tt{GSS_Delete_sec_context@} 
 *!   (@rfc{2743:2.2.3@}) is called. That function might do blocking 
 *!   network I/O, which due to pike's object management might occur 
 *!   essentially anytime in any thread if the object isn't explicitly 
 *!   destructed. To avoid that, it's strongly recommended to call 
 *!   @[delete] in contexts that are no longer used. 
 */ 
PIKECLASS Context 
{ 
  CVAR gss_ctx_id_t ctx; 
  CVAR OM_uint32 required_services, current_services; 
  CVAR OM_uint32 last_major, last_minor; 
  CVAR gss_qop_t last_qop; 
  CVAR int last_confidential; 
 
#define SAVE_STATUS(MAJ, MIN) do {                                      \ 
    THIS_CONTEXT->last_major = (MAJ);                                   \ 
    THIS_CONTEXT->last_minor = (MIN);                                   \ 
  } while (0) 
 
  static DECLSPEC(noreturn) void handle_context_error ( 
    int line, const char *gss_func, OM_uint32 major, OM_uint32 minor) 
    ATTRIBUTE ((noreturn)); 
 
  static DECLSPEC(noreturn) void handle_context_error ( 
    int line, const char *gss_func, OM_uint32 major, OM_uint32 minor) 
  /* This function can be used directly in inheriting classes too. */ 
  { 
    gss_OID mech = GSS_C_NO_OID; 
    char *ctx_stor = 
      Pike_fp->current_object ? 
      get_storage (Pike_fp->current_object, Context_program) : NULL; 
    if (!ctx_stor) { 
      DWERR("Failed to get object storage - are we being called " 
            "from a Context method?\n" 
            "Anyway, can't get the context mech - minor status messages " 
            "might be wrong below.\n"); 
    } 
    else if (((struct Context_struct *) ctx_stor)->ctx != GSS_C_NO_CONTEXT) { 
      OM_uint32 maj, min; 
      maj = gss_inquire_context (&min, 
                                 ((struct Context_struct *) ctx_stor)->ctx, 
                                 NULL, NULL, NULL, &mech, NULL, NULL, NULL); 
#ifdef PIKE_DEBUG 
      if (GSS_ERROR (maj) && mech == GSS_C_NO_OID) 
        fprintf (stderr, "Failed to get mech for context - " 
                 "gss_inquire_context returned %x/%x.\n" 
                 "Minor status messages might be wrong below.\n", 
                 maj, min); 
#endif 
    } 
 
    handle_error (line, gss_func, major, minor, mech); 
  } 
 
#define CHECK_CONTEXT_ERROR(FN, MAJ, MIN) do {                          \ 
    if (GSS_ERROR (MAJ)) handle_context_error (__LINE__, #FN, MAJ, MIN); \ 
  } while (0) 
 
  /* Implementations are known to return GSS_S_NO_CONTEXT for 
   * contexts during establishment. */ 
#define CHECK_INQUIRE_CONTEXT_ERROR(MAJ, MIN) do {                      \ 
    if (GSS_ERROR (maj) &&                                              \ 
        (GSS_CALLING_ERROR (maj) ||                                     \ 
         GSS_ROUTINE_ERROR (maj) != GSS_S_NO_CONTEXT))                  \ 
      CHECK_UNEXPECTED_ERROR (gss_inquire_context, MAJ, MIN);           \ 
  } while (0) 
 
#define CHECK_GOT_CONTEXT() do {                                        \ 
    if (THIS_CONTEXT->ctx == GSS_C_NO_CONTEXT) {                        \ 
      SAVE_STATUS (GSS_S_NO_CONTEXT, 0);                                \ 
      throw_gssapi_error (GSS_S_NO_CONTEXT, 0, GSS_C_NO_OID, NULL);     \ 
    }                                                                   \ 
  } while (0) 
 
  static void cleanup_context (gss_ctx_id_t *ctx) 
  /* Warning: This function uses THREADS_ALLOW/THREADS_DISALLOW. */ 
  { 
    if (*ctx != GSS_C_NO_CONTEXT) { 
      OM_uint32 maj, min; 
      DMALLOC_UNREGISTER (*ctx); 
      THREADS_ALLOW(); 
      maj = gss_delete_sec_context (&min, ctx, GSS_C_NO_BUFFER); 
      STATUS_MSG (gss_delete_sec_context, maj, min); 
      THREADS_DISALLOW(); 
      CHECK_UNEXPECTED_ERROR (gss_delete_sec_context, maj, min); 
      *ctx = GSS_C_NO_CONTEXT;  /* Paranoia; gssapi lib should do this. */ 
    } 
  } 
 
#define REINIT_THIS() do {                                              \ 
    call_prog_event (Pike_fp->current_object, PROG_EVENT_EXIT);         \ 
    call_prog_event (Pike_fp->current_object, PROG_EVENT_INIT);         \ 
  } while (0) 
 
  INIT 
  { 
    THIS->ctx = GSS_C_NO_CONTEXT; 
    THIS->required_services = THIS->current_services = 0; 
    THIS->last_major = THIS->last_minor = 0; 
    THIS->last_qop = 0; 
    THIS->last_confidential = 0; 
  } 
 
  EXIT 
    gc_trivial; 
  { 
    if (THIS->ctx != GSS_C_NO_CONTEXT) 
      cleanup_context (&THIS->ctx); 
  } 
 
  /*! @decl protected void create (string interprocess_token, @ 
   *!                           void|int required_services) 
   *! 
   *! Creates a context by importing an inter-process token. 
   *! 
   *! This wraps @tt{GSS_Import_sec_context@} according to 
   *! @rfc{2743:2.2.9@}. 
   *! 
   *! @param interprocess_token 
   *!   The inter-process token which has been created by @[export] or 
   *!   some other @tt{GSS_Export_sec_context@} wrapper. 
   *! 
   *! @param required_services 
   *!   Bitfield of @tt{GSSAPI.*_FLAG@} flags specifying all services 
   *!   that must be provided in the context. If the context fail to 
   *!   provide any of them then it is closed and a 
   *!   @[GSSAPI.MissingServicesError] is thrown. 
   *! 
   *!   @[GSSAPI.PROT_READY_FLAG] is ignored in this parameter. The fact 
   *!   that a user calls a per-message function indicates that this 
   *!   service is required at that point, and a 
   *!   @[GSSAPI.MissingServicesError] is thrown if it isn't. 
   *! 
   *! @note 
   *!   It is not possible to retrieve delegated credentials from an 
   *!   imported context. That is a GSS-API limitation. 
   */ 
  PIKEFUN void create (string interprocess_token, 
                       void|zero|int required_services) 
    flags ID_PROTECTED; 
  { 
    gss_buffer_desc input_token; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    INT_TYPE _required_services; 
    CHECK_OPT_ARG (required_services, _required_services, 
                   T_INT, integer, "int", "create", 4); 
#define REQUIRED_SERVICES _required_services 
#else 
#define REQUIRED_SERVICES required_services 
#endif 
 
    CHECK_NARROW_STRING (interprocess_token, "create", 1); 
    input_token.length = interprocess_token->len; 
    input_token.value = interprocess_token->str; 
 
    THIS_CONTEXT->required_services = 
      (REQUIRED_SERVICES & ~GSS_C_PROT_READY_FLAG); 
 
    { 
      gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; 
      OM_uint32 ctx_flags; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      /* RFC 2743 doesn't say clearly whether this might block on 
       * network I/O, but it doesn't seem entirely unreasonable that 
       * it might, so let's play safe. */ 
      maj = gss_import_sec_context (&min, &input_token, &ctx); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_import_sec_context, maj, min); 
      SAVE_STATUS (maj, min); 
 
      if (THIS->ctx == GSS_C_NO_CONTEXT) { 
        DMALLOC_REGISTER (ctx); 
        THIS->ctx = ctx; 
      } 
      else { 
        cleanup_context (&ctx); 
        Pike_error ("Contained context changed asynchronously.\n"); 
      } 
 
      CHECK_CONTEXT_ERROR (gss_import_sec_context, maj, min); 
 
      /* Have to update the cached current_services value. */ 
      maj = gss_inquire_context (&min, ctx, NULL, NULL, NULL, 
                                 NULL, &ctx_flags, NULL, NULL); 
      STATUS_MSG (gss_inquire_context, maj, min); 
 
      /* Don't use CHECK_INQUIRE_CONTEXT_ERROR here - the context 
       * should always be established. */ 
      CHECK_UNEXPECTED_ERROR (gss_inquire_context, maj, min); 
 
      /* Set the prot ready flag since the context is established by 
       * definition here. */ 
      THIS->current_services = ctx_flags | GSS_C_PROT_READY_FLAG; 
 
      { 
        OM_uint32 missing = ~THIS->current_services & REQUIRED_SERVICES; 
        if (missing) { 
          REINIT_THIS(); 
          throw_missing_services_error (missing); 
        } 
      } 
    } 
 
#undef REQUIRED_SERVICES 
  } 
 
  static void f_Context_is_established (INT32 args); 
 
  /*! @decl int required_services (void|int services) 
   *! 
   *! Gets and optionally sets the set of services that must be provided 
   *! in the context. The returned and given value is a bitfield of the 
   *! @tt{GSSAPI.*_FLAG@} constants. 
   *! 
   *! This is mainly useful to change the per-message service flags that 
   *! @[verify_mic] and @[unwrap] use to decide whether a condition is 
   *! an error or not. 
   *! 
   *! @param services 
   *!   New set of required services. If this is not given then the set 
   *!   is not changed. 
   *! 
   *!   If the context is established and @[services] contain a service 
   *!   which isn't currently provided then the context is closed and a 
   *!   @[GSSAPI.MissingServicesError] is thrown immediately. 
   *! 
   *!   @[GSSAPI.PROT_READY_FLAG] is ignored in this parameter. 
   *! 
   *! @returns 
   *!   Returns the current set of required services (after setting them 
   *!   to @[services], if provided). 
   *! 
   *! @seealso 
   *!   @[GSSAPI.describe_services] 
   */ 
  PIKEFUN int required_services (void|int services) 
  { 
    if (services) { 
      OM_uint32 srv; 
 
#ifndef PRECOMPILE_API_VERSION 
      /* Live with the pessimal precompile.pike in 7.4.. :P */ 
      if (TYPEOF(*services) != T_INT) 
        SIMPLE_ARG_TYPE_ERROR ("required_services", 1, "void|int"); 
#endif 
 
      srv = services->u.integer & ~GSS_C_PROT_READY_FLAG; 
 
      f_Context_is_established (0); 
      assert (TYPEOF(Pike_sp[-1]) == T_INT); 
      if ((--Pike_sp)->u.integer) { 
        OM_uint32 missing = ~THIS->current_services & srv; 
        if (missing) { 
          REINIT_THIS(); 
          throw_missing_services_error (missing); 
        } 
      } 
 
      THIS->required_services = srv; 
    } 
 
    RETURN THIS->required_services; 
  } 
 
  /*! @decl int is_established() 
   *! @decl int services() 
   *! @decl int locally_initiated() 
   *! @decl Name source_name() 
   *! @decl Name target_name() 
   *! @decl int(0..) lifetime() 
   *! @decl string mech() 
   *! 
   *! Functions to query various properties about the context. 
   *! 
   *! These wrap @tt{GSS_Inquire_context@} according to 
   *! @rfc{2743:2.2.6@}. 
   *! 
   *! @dl 
   *! @item is_established() 
   *!   Returns nonzero as soon as the context has been established. 
   *!   That means no further rounds through 
   *!   @[GSSAPI.InitContext.init] or @[GSSAPI.AcceptContext.accept], 
   *!   that the remote peer is authenticated as required, and that 
   *!   the set of available services is complete (see @[services]). 
   *! 
   *! @item services() 
   *!   Returns a bitfield of @tt{GSSAPI.*_FLAG@} flags for the 
   *!   services that the context (currently) provides. This field is 
   *!   complete only when the context establishment has finished, 
   *!   i.e. when @[is_established] returns nonzero. 
   *! 
   *!   See also @[GSSAPI.describe_services]. 
   *! 
   *! @item locally_initiated() 
   *!   Returns nonzero if the context is an initiator, zero if it is 
   *!   an acceptor. (This is mainly useful in imported contexts.) 
   *! 
   *! @item source_name() 
   *!   Returns the name of the context initiator. The name is always 
   *!   an MN. Returns an anonymous name if used on the acceptor side 
   *!   and the anonymous authentication service (c.f. 
   *!   @[GSSAPI.ANON_FLAG]) was used. 
   *! 
   *! @item target_name() 
   *!   Returns the name of the context acceptor. If a name is 
   *!   returned then it is always an MN. 
   *! 
   *!   Zero is returned on the initiator side if the initiator didn't 
   *!   specify a target name and the acceptor did not authenticate 
   *!   itself (should never happen if mutual authentication (c.f. 
   *!   @[GSSAPI.MUTUAL_FLAG]) is a required service). 
   *! 
   *!   The returned object is not necessarily the same one as was 
   *!   passed to @[GSSAPI.InitContext.create], even though they are 
   *!   likely to compare as equal (they might not be equal if the 
   *!   passed name wasn't an MN). 
   *! 
   *! @item lifetime() 
   *!   Returns the validity lifetime left for the context. Returns 
   *!   zero if the context has expired, or @[Int.inf] if there is no 
   *!   time limit (in older pikes without @[Int.inf] a large positive 
   *!   integer is returned instead). 
   *! 
   *! @item mech() 
   *!   Returns the mechanism that provides the context. The returned 
   *!   value is its OID on dotted-decimal form. 
   *! @enddl 
   *! 
   *! These functions don't throw errors if the context is missing or 
   *! not completely established, even though they might not be able 
   *! to query the proper values then (GSS-API implementations are 
   *! known to not be completely reliable in handling these queries 
   *! for partly established contexts). The functions instead return 
   *! zero. 
   */ 
 
  PIKEFUN int is_established() 
  { 
    if (THIS->ctx != GSS_C_NO_CONTEXT) { 
      int is_open = 0; 
      OM_uint32 maj, min; 
      maj = gss_inquire_context (&min, THIS->ctx, NULL, NULL, NULL, 
                                 NULL, NULL, NULL, &is_open); 
      STATUS_MSG (gss_inquire_context, maj, min); 
      CHECK_INQUIRE_CONTEXT_ERROR (maj, min); 
      RETURN is_open; 
    } 
 
    RETURN 0; 
  } 
 
  PIKEFUN int services() 
  { 
    RETURN THIS->current_services; 
  } 
 
  PIKEFUN int locally_initiated() 
  { 
    /* Init this in case gss_inquire_context doesn't set it afterall 
     * (perhaps due to nonestablished context, who knows..) */ 
    int locally_initiated = 0; 
 
    if (THIS->ctx != GSS_C_NO_CONTEXT) { 
      OM_uint32 maj, min; 
      maj = gss_inquire_context (&min, THIS->ctx, NULL, NULL, NULL, 
                                 NULL, NULL, &locally_initiated, NULL); 
      STATUS_MSG (gss_inquire_context, maj, min); 
      CHECK_INQUIRE_CONTEXT_ERROR (maj, min); 
    } 
 
    RETURN locally_initiated; 
  } 
 
  PIKEFUN object(Name) source_name() 
  { 
    gss_name_t name = GSS_C_NO_NAME; 
    ONERROR uwp; 
 
    SET_ONERROR (uwp, cleanup_name, &name); 
 
    if (THIS->ctx != GSS_C_NO_CONTEXT) { 
      OM_uint32 maj, min; 
      maj = gss_inquire_context (&min, THIS->ctx, &name, NULL, NULL, 
                                 NULL, NULL, NULL, NULL); 
      STATUS_MSG (gss_inquire_context, maj, min); 
      DMALLOC_REGISTER (name); 
      CHECK_INQUIRE_CONTEXT_ERROR (maj, min); 
    } 
 
    if (name == GSS_C_NO_NAME) 
      push_int (0); /* Might de-facto happen for nonestablished contexts. */ 
    else 
      PUSH_GSS_NAME_AS_OBJ (name); 
    UNSET_ONERROR (uwp); 
  } 
 
  PIKEFUN object(Name) target_name() 
  { 
    gss_name_t name = GSS_C_NO_NAME; 
    ONERROR uwp; 
 
    SET_ONERROR (uwp, cleanup_name, &name); 
 
    if (THIS->ctx != GSS_C_NO_CONTEXT) { 
      OM_uint32 maj, min; 
      maj = gss_inquire_context (&min, THIS->ctx, NULL, &name, NULL, 
                                 NULL, NULL, NULL, NULL); 
      STATUS_MSG (gss_inquire_context, maj, min); 
      DMALLOC_REGISTER (name); 
      CHECK_INQUIRE_CONTEXT_ERROR (maj, min); 
    } 
 
    if (name == GSS_C_NO_NAME) 
      push_int (0); 
    else 
      PUSH_GSS_NAME_AS_OBJ (name); 
    UNSET_ONERROR (uwp); 
  } 
 
  /* Lying a little in the return type here for the sake of pike compat. */ 
  PIKEFUN int(0..) lifetime() 
  { 
    /* Init this in case gss_inquire_context doesn't set it afterall 
     * (perhaps due to nonestablished context, who knows..) */ 
    OM_uint32 time = 0; 
 
    if (THIS->ctx != GSS_C_NO_CONTEXT) { 
      OM_uint32 maj, min; 
      maj = gss_inquire_context (&min, THIS->ctx, NULL, NULL, &time, 
                                 NULL, NULL, NULL, NULL); 
      STATUS_MSG (gss_inquire_context, maj, min); 
      CHECK_INQUIRE_CONTEXT_ERROR (maj, min); 
    } 
 
    PUSH_TIME (time); 
  } 
 
  PIKEFUN string mech() 
  { 
    /* Init this in case gss_inquire_context doesn't set it afterall 
     * (perhaps due to nonestablished context, who knows..) */ 
    gss_OID mech = GSS_C_NO_OID; 
 
    if (THIS->ctx != GSS_C_NO_CONTEXT) { 
      OM_uint32 maj, min; 
      maj = gss_inquire_context (&min, THIS->ctx, NULL, NULL, NULL, 
                                 &mech, NULL, NULL, NULL); 
      STATUS_MSG (gss_inquire_context, maj, min); 
      CHECK_INQUIRE_CONTEXT_ERROR (maj, min); 
    } 
 
    if (mech == GSS_C_NO_OID) 
      push_int (0); 
    else 
      ref_push_string (get_dd_oid (mech)); 
  } 
 
  /*! @decl int last_major_status() 
   *! @decl int last_minor_status() 
   *! 
   *! Returns the major and minor status codes from the last operation 
   *! that called a GSS-API routine, with the exception of those that 
   *! wrap @tt{GSS_Inquire_context@}. 
   */ 
  PIKEFUN int last_major_status() 
  { 
    RETURN THIS->last_major; 
  } 
  PIKEFUN int last_minor_status() 
  { 
    RETURN THIS->last_minor; 
  } 
 
  /*! @decl int last_qop() 
   *! 
   *! Returns the quality of protection provided by the last call to 
   *! @[verify_mic] or @[unwrap]. 
   */ 
  PIKEFUN int last_qop() 
  { 
    RETURN THIS->last_qop; 
  } 
 
  /*! @decl int last_confidential() 
   *! 
   *! Returns nonzero if the last call to @[wrap] or @[unwrap] provided 
   *! confidentiality for the message, i.e. if @[wrap] encrypted it or 
   *! if @[unwrap] decrypted it. Zero is returned otherwise. 
   */ 
  PIKEFUN int last_confidential() 
  { 
    RETURN THIS->last_confidential; 
  } 
 
  PIKEFUN string _sprintf (int flag, ...) 
    flags ID_PROTECTED; 
  { 
    pop_n_elems (args); 
 
    if (flag != 'O') 
      push_int (0); 
 
    else { 
      struct string_builder sb; 
      ONERROR uwp; 
      init_string_builder (&sb, 0); 
      SET_ONERROR (uwp, free_string_builder, &sb); 
 
      { 
        /* A bit ugly to look at the program here, but that'll have to 
         * do since we can't add program constants in 7.4. */ 
        struct program *prog = Pike_fp->current_object->prog; 
        if (prog == InitContext_program) 
          string_builder_strcat (&sb, "GSSAPI.InitContext("); 
        else if (prog == AcceptContext_program) 
          string_builder_strcat (&sb, "GSSAPI.AcceptContext("); 
        else 
          string_builder_strcat (&sb, "GSSAPI.Context("); 
      } 
 
      if (THIS->ctx != GSS_C_NO_CONTEXT) { 
        gss_name_t src_name = GSS_C_NO_NAME; 
        gss_name_t tgt_name = GSS_C_NO_NAME; 
        OM_uint32 time = 0; 
        int loc_init, is_open, first = 1; 
        ONERROR uwp1, uwp2; 
        OM_uint32 maj, min; 
 
        SET_ONERROR (uwp1, cleanup_name, &src_name); 
        SET_ONERROR (uwp2, cleanup_name, &tgt_name); 
 
        maj = gss_inquire_context (&min, THIS->ctx, &src_name, &tgt_name, 
                                   &time, NULL, NULL, &loc_init, &is_open); 
        MORE_STATUS_MSG (gss_inquire_context, maj, min); 
        DMALLOC_REGISTER (src_name); 
        DMALLOC_REGISTER (tgt_name); 
 
#ifdef PIKE_DEBUG 
      if (GSS_CALLING_ERROR (maj)) 
        handle_context_error (__LINE__, "gss_inquire_context", maj, min); 
#endif 
        switch (GSS_ROUTINE_ERROR (maj)) { 
          default: 
            string_builder_sprintf ( 
              &sb, "unexpected gss_inquire_cred error: %x/%x", maj, min); 
            break; 
 
          case GSS_S_NO_CONTEXT: 
            /* This is de-facto returned for nonestablished contexts 
             * (krb5-1.6). */ 
 
          case GSS_S_COMPLETE: 
            if (src_name != GSS_C_NO_NAME || tgt_name != GSS_C_NO_NAME) { 
              /* Be defensive about the names: They might both be 
               * unset e.g. if the context isn't established yet. */ 
              if (src_name != GSS_C_NO_NAME) 
                describe_name (&sb, src_name, 0); 
              else 
                string_builder_strcat (&sb, "unknown"); 
              if (loc_init) 
                string_builder_strcat (&sb, " -> "); 
              else 
                string_builder_strcat (&sb, " <- "); 
              if (tgt_name != GSS_C_NO_NAME) 
                describe_name (&sb, tgt_name, 0); 
              else 
                string_builder_strcat (&sb, "unknown"); 
              first = 0; 
            } 
 
            if (THIS->current_services) { 
              /* Intentionally use the local cached value since the debug 
               * printout might hide errors otherwise. */ 
              if (first) first = 0; else string_builder_strcat (&sb, ", "); 
              describe_services_and_push (THIS->current_services); 
              string_builder_shared_strcat (&sb, Pike_sp[-1].u.string); 
              pop_stack(); 
            } 
 
            if (!is_open) { 
              if (first) first = 0; else string_builder_strcat (&sb, ", "); 
              string_builder_strcat (&sb, "establishing"); 
            } 
 
            else if (!time) { 
              if (first) first = 0; else string_builder_strcat (&sb, ", "); 
              string_builder_strcat (&sb, "expired"); 
            } 
 
            break; 
        } 
 
        CALL_AND_UNSET_ONERROR (uwp2); 
        CALL_AND_UNSET_ONERROR (uwp1); 
      } 
 
      string_builder_putchar (&sb, ')'); 
 
      UNSET_ONERROR (uwp); 
      push_string (finish_string_builder (&sb)); 
    } 
  } 
 
  /*! @decl void process_token (string remote_token) 
   *! 
   *! Passes the given @[remote_token] to the mechanism. 
   *! 
   *! This wraps @tt{GSS_Process_context_token@} according to 
   *! @rfc{2743:2.2.4@}. 
   *! 
   *! This is used for tokens that are received outside the 
   *! handshaking between @tt{GSS_Init_sec_context@} 
   *! (@[GSSAPI.InitContext.init]) and @tt{GSS_Accept_sec_context@} 
   *! (@[GSSAPI.AcceptContext.accept]). 
   *! 
   *! An example is when @[GSSAPI.InitContext.init] returns a final 
   *! token and flags the context as established, but the acceptor 
   *! context detects an error and sends a failure token back. That 
   *! token is processed using this function since 
   *! @[GSSAPI.InitContext.init] doesn't handle any more tokens by 
   *! then. 
   *! 
   *! @note 
   *!   This function might change context state. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers. However, if the remote token is the 
   *!   result of @tt{GSS_Delete_sec_context@} on the remote side then 
   *!   it will not block. 
   */ 
  PIKEFUN void process_token (string remote_token) 
  { 
    gss_buffer_desc input_token; 
 
    CHECK_GOT_CONTEXT(); 
 
    CHECK_NARROW_STRING (remote_token, "process_token", 1); 
    input_token.length = remote_token->len; 
    input_token.value = remote_token->str; 
 
    { 
      gss_ctx_id_t ctx = THIS->ctx; 
      /* Init ctx_flags to the old flags in case gss_inquire_context 
       * doesn't set it afterall (perhaps due to nonestablished 
       * context, who knows..) */ 
      OM_uint32 ctx_flags = THIS->current_services; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      maj = gss_process_context_token (&min, ctx, &input_token); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_process_context_token, maj, min); 
      SAVE_STATUS (maj, min); 
      CHECK_CONTEXT_ERROR (gss_process_context_token, maj, min); 
 
      /* Have to update the cached current_services value. */ 
      maj = gss_inquire_context (&min, ctx, NULL, NULL, NULL, 
                                 NULL, &ctx_flags, NULL, NULL); 
      STATUS_MSG (gss_inquire_context, maj, min); 
      CHECK_INQUIRE_CONTEXT_ERROR (maj, min); 
      THIS->current_services = ctx_flags; 
    } 
  } 
 
  /*! @decl string export() 
   *! 
   *! Exports this context so that it can be imported in another 
   *! process, providing the inter-process context transfer service is 
   *! available (c.f. @[GSSAPI.TRANS_FLAG]). 
   *! 
   *! This wraps @tt{GSS_Export_sec_context@} according to 
   *! @rfc{2743:2.2.8@}. 
   *! 
   *! The returned string is intended to be fed to 
   *! @[GSSAPI.Context.create] (or some other 
   *! @tt{GSS_Import_sec_context@} wrapper) in the receiving process. 
   *! 
   *! This operation frees the context in this object. 
   */ 
  PIKEFUN string export() 
  { 
    CHECK_GOT_CONTEXT(); 
 
    WITH_GSS_BUFFER (interprocess_token) { 
      OM_uint32 maj, min; 
      DMALLOC_UNREGISTER (THIS->ctx); 
      maj = gss_export_sec_context (&min, &THIS->ctx, &interprocess_token); 
      STATUS_MSG (gss_export_sec_context, maj, min); 
      SAVE_STATUS (maj, min); 
      CHECK_CONTEXT_ERROR (gss_export_sec_context, maj, min); 
 
      if (THIS->ctx == GSS_C_NO_CONTEXT) 
        THIS->required_services = THIS->current_services = 0; 
 
      push_string (make_shared_binary_string (interprocess_token.value, 
                                              interprocess_token.length)); 
    } END_GSS_BUFFER (interprocess_token); 
  } 
 
  /*! @decl string get_mic (string message, void|int qop) 
   *! 
   *! Calculates and returns a MIC (message integrity checksum) for 
   *! the given message that allows the receiver to verify its origin 
   *! and integrity through @[verify_mic] or some other 
   *! @tt{GSS_VerifyMIC@} wrapper. 
   *! 
   *! This wraps @tt{GSS_GetMIC@} according to @rfc{2743:2.3.1@}. 
   *! 
   *! This function requires that the context is established, or that 
   *! the early per-message protection service is available (c.f. 
   *! @[GSSAPI.PROT_READY_FLAG]. If not, a 
   *! @[GSSAPI.MissingServicesError] is thrown (but the context is not 
   *! closed). 
   *! 
   *! @param message 
   *!   The message for which the MIC is to be calculated. It may be 
   *!   of zero length. 
   *! 
   *! @param qop 
   *!   The quality of protection. This is a mechanism-specific value 
   *!   that lets the user direct how the underlying mechanism 
   *!   calculates the MIC. See @rfc{2743:1.2.4@}. 
   *! 
   *!   Zero or left out means use the default method. 
   */ 
  PIKEFUN string get_mic (string message, void|zero|int qop) 
  { 
    gss_buffer_desc msg; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    INT_TYPE _qop; 
    CHECK_OPT_ARG (qop, _qop, T_INT, integer, "int", "get_mic", 2); 
#define qop _qop 
#endif 
 
    CHECK_GOT_CONTEXT(); 
 
    if (!(THIS->current_services & GSS_C_PROT_READY_FLAG)) 
      throw_missing_services_error (GSS_C_PROT_READY_FLAG); 
 
    /* Can assume that all the required per-message services are 
     * available here. Otherwise the context establishment functions 
     * would have closed the context. */ 
    assert (!(~THIS->current_services & THIS->required_services)); 
 
    CHECK_NARROW_STRING (message, "get_mic", 1); 
    msg.length = message->len; 
    msg.value = message->str; 
 
    WITH_GSS_BUFFER (mic) { 
      OM_uint32 maj, min; 
      maj = gss_get_mic (&min, THIS->ctx, qop, &msg, &mic); 
      STATUS_MSG (gss_get_mic, maj, min); 
      SAVE_STATUS (maj, min); 
      CHECK_CONTEXT_ERROR (gss_get_mic, maj, min); 
 
      pop_n_elems (args); 
      push_string (make_shared_binary_string (mic.value, mic.length)); 
    } END_GSS_BUFFER (mic); 
 
#undef qop 
  } 
 
  /*! @decl int verify_mic (string message, string mic) 
   *! 
   *! Verifies the origin and integrity of the given @[message] using 
   *! the given @[mic], which has been calculated by the sender using 
   *! @[get_mic] or some other @tt{GSS_GetMIC@} wrapper. 
   *! 
   *! This wraps @tt{GSS_VerifyMIC@} according to @rfc{2743:2.3.2@}. 
   *! 
   *! This function requires that the context is established, or that 
   *! the early per-message protection service is available (c.f. 
   *! @[GSSAPI.PROT_READY_FLAG]. If not, a 
   *! @[GSSAPI.MissingServicesError] is thrown (but the context is not 
   *! closed). 
   *! 
   *! @returns 
   *!   Zero is returned if the verification fails with 
   *!   @[GSSAPI.DEFECTIVE_TOKEN] or @[GSSAPI.BAD_MIC]. 
   *! 
   *!   Otherwise the message origin and integrity checks out, but it 
   *!   might still be considered wrong depending on whether the replay 
   *!   detection or sequencing services are required (see 
   *!   @[required_services]): 
   *! 
   *!   If replay detection (c.f. @[GSSAPI.REPLAY_FLAG]) is required 
   *!   then zero is returned if the message is duplicated 
   *!   (@[GSSAPI.DUPLICATE_TOKEN]) or old (@[GSSAPI.OLD_TOKEN]). 
   *! 
   *!   If sequencing (c.f. @[GSSAPI.SEQUENCE_FLAG]) is required then in 
   *!   addition to the replay detection conditions, zero is also 
   *!   returned if the message is out of sequence 
   *!   (@[GSSAPI.UNSEQ_TOKEN] or @[GSSAPI.GAP_TOKEN]). 
   *! 
   *!   Otherwise nonzero is returned to indicate that the message is 
   *!   valid according to the currently required services. 
   *! 
   *! @throws 
   *!   Any GSS-API errors except @[GSSAPI.DEFECTIVE_TOKEN] and 
   *!   @[GSSAPI.BAD_MIC] are thrown. 
   *! 
   *! @note 
   *!   This function sets the value returned by @[last_qop]. 
   *! 
   *! @note 
   *!   Regardless whether the message is considered valid or not by the 
   *!   return value, @[last_major_status] may be called to check for 
   *!   routine errors or the informatory codes mentioned above. 
   */ 
  PIKEFUN int verify_mic (string message, string mic) 
  { 
    gss_buffer_desc msg, token; 
 
    CHECK_GOT_CONTEXT(); 
 
    if (!(THIS->current_services & GSS_C_PROT_READY_FLAG)) 
      throw_missing_services_error (GSS_C_PROT_READY_FLAG); 
 
    /* Can assume that all the required per-message services are 
     * available here. Otherwise the context establishment functions 
     * would have closed the context. */ 
    assert (!(~THIS->current_services & THIS->required_services)); 
 
    CHECK_NARROW_STRING (message, "verify_mic", 1); 
    msg.length = message->len; 
    msg.value = message->str; 
 
    CHECK_NARROW_STRING (mic, "verify_mic", 2); 
    token.length = mic->len; 
    token.value = mic->str; 
 
    { 
      OM_uint32 maj, min; 
      maj = gss_verify_mic (&min, THIS->ctx, &msg, &token, &THIS->last_qop); 
      STATUS_MSG (gss_verify_mic, maj, min); 
      SAVE_STATUS (maj, min); 
 
#ifdef PIKE_DEBUG 
      if (GSS_CALLING_ERROR (maj)) 
        handle_context_error (__LINE__, "gss_verify_mic", maj, min); 
#endif 
      switch (GSS_ROUTINE_ERROR (maj)) { 
        case 0: 
          if ((maj & (GSS_S_DUPLICATE_TOKEN|GSS_S_OLD_TOKEN)) && 
              (THIS->required_services & (GSS_C_REPLAY_FLAG| 
                                          GSS_C_SEQUENCE_FLAG))) 
            RETURN 0; 
          if ((maj & (GSS_S_UNSEQ_TOKEN|GSS_S_GAP_TOKEN)) && 
              (THIS->required_services & GSS_C_SEQUENCE_FLAG)) 
            RETURN 0; 
          RETURN 1; 
 
        case GSS_S_DEFECTIVE_TOKEN: 
        case GSS_S_BAD_SIG: 
          RETURN 0; 
 
        default: 
          handle_context_error (__LINE__, "gss_verify_mic", maj, min); 
      } 
    } 
  } 
 
  /*! @decl int(0..) wrap_size_limit (int(0..) output_size, int encrypt, @ 
   *!                                 void|int qop) 
   *! 
   *! Returns the maximum size of an input string to @[wrap] that 
   *! would produce no more than @[output_size] bytes in the resulting 
   *! output. 
   *! 
   *! This wraps @tt{GSS_Wrap_size_limit@} according to 
   *! @rfc{2743:2.2.7@}. 
   *! 
   *! @[with_confidentiality] and @[qop] are the same as in the call 
   *! to @[wrap]. 
   */ 
  PIKEFUN int(0..) wrap_size_limit (int(0..) output_size, 
                                    void|int encrypt, 
                                    void|zero|int qop) 
  { 
    OM_uint32 max_input_size = 0; 
    int conf; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    INT_TYPE _qop; 
    CHECK_OPT_ARG (qop, _qop, T_INT, integer, "int", "wrap_size_limit", 3); 
#define qop _qop 
#endif 
 
    if (output_size < 0) 
      SIMPLE_ARG_TYPE_ERROR ("wrap_size_limit", 1, "int(0..)"); 
 
    if (encrypt && encrypt->u.integer >= 0) 
      conf = encrypt->u.integer; 
    else 
      conf = THIS->current_services & GSS_C_CONF_FLAG; 
 
    if (THIS->ctx != GSS_C_NO_CONTEXT) { 
      OM_uint32 maj, min; 
      maj = gss_wrap_size_limit (&min, THIS->ctx, conf, qop, 
                                 output_size, &max_input_size); 
      STATUS_MSG (gss_wrap_size_limit, maj, min); 
      SAVE_STATUS (maj, min); 
      CHECK_CONTEXT_ERROR (gss_wrap_size_limit, maj, min); 
    } 
 
    push_ulongest (max_input_size); 
 
#undef qop 
  } 
 
  /*! @decl string wrap (string message, void|int encrypt, void|int qop) 
   *! 
   *! Calculates a MIC (message integrity checksum) for the given 
   *! message, and returns it together with the message, which is 
   *! optionally encrypted. The returned value can be verified and (if 
   *! applicable) decrypted by the receiver using @[unwrap] or some 
   *! other @tt{GSS_Unwrap@} wrapper. 
   *! 
   *! This wraps @tt{GSS_Wrap@} according to @rfc{2743:2.3.3@}. 
   *! 
   *! This function requires that the context is established, or that 
   *! the early per-message protection service is available (c.f. 
   *! @[GSSAPI.PROT_READY_FLAG]. If not, a 
   *! @[GSSAPI.MissingServicesError] is thrown (but the context is not 
   *! closed). 
   *! 
   *! @param message 
   *!   The message to be wrapped. It may be of zero length. 
   *! 
   *! @param encrypt 
   *!   Set to nonzero to request that the message is encrypted. 
   *!   Otherwise only a MIC is calculated and the returned value 
   *!   contains the unencrypted message. 
   *! 
   *!   If this is set and the confidentiality service (c.f. 
   *!   @[GSSAPI.CONF_FLAG]) is required then the returned value is 
   *!   always encrypted. Otherwise it might not be encrypted anyway, 
   *!   and a call to @[last_confidential] will tell if it is or not. 
   *! 
   *! @param qop 
   *!   The quality of protection. This is a mechanism-specific value 
   *!   that lets the user direct how the underlying mechanism 
   *!   calculates the MIC. See @rfc{2743:1.2.4@}. 
   *! 
   *!   Zero or left out means use the default method. 
   *! 
   *! @note 
   *!   This function sets the value returned by @[last_confidential]. 
   *! 
   *! @seealso 
   *!   @[wrap_size_limit] 
   */ 
  PIKEFUN string wrap (string message, void|zero|int encrypt, void|zero|int qop) 
  { 
    gss_buffer_desc msg; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    INT_TYPE _encrypt, _qop; 
    CHECK_OPT_ARG (encrypt, _encrypt, T_INT, integer, "int", "wrap", 2); 
    CHECK_OPT_ARG (qop, _qop, T_INT, integer, "int", "wrap", 3); 
#define encrypt _encrypt 
#define qop _qop 
#endif 
 
    CHECK_GOT_CONTEXT(); 
 
    if (!(THIS->current_services & GSS_C_PROT_READY_FLAG)) 
      throw_missing_services_error (GSS_C_PROT_READY_FLAG); 
 
    /* Can assume that all the required per-message services are 
     * available here. Otherwise the context establishment functions 
     * would have closed the context. */ 
    assert (!(~THIS->current_services & THIS->required_services)); 
 
    CHECK_NARROW_STRING (message, "wrap", 1); 
    msg.length = message->len; 
    msg.value = message->str; 
 
    WITH_GSS_BUFFER (output_msg) { 
      OM_uint32 maj, min; 
      maj = gss_wrap (&min, THIS->ctx, encrypt, qop, &msg, 
                      &THIS->last_confidential, &output_msg); 
      STATUS_MSG (gss_wrap, maj, min); 
      SAVE_STATUS (maj, min); 
      CHECK_CONTEXT_ERROR (gss_wrap, maj, min); 
 
      /* Paranoia check so we don't let an unencrypted message slip out 
       * when it really shouldn't happen. */ 
      if (encrypt && !THIS->last_confidential && 
          (THIS->required_services & GSS_C_CONF_FLAG)) 
        Pike_fatal ("GSS-API implementation didn't encrypt message " 
                    "even when able and told to (%x/%x, %d, %d).\n", 
                    maj, min, !!(THIS->current_services & GSS_C_CONF_FLAG), 
                    !!(THIS->required_services & GSS_C_CONF_FLAG)); 
 
      pop_n_elems (args); 
      push_string (make_shared_binary_string (output_msg.value, 
                                              output_msg.length)); 
    } END_GSS_BUFFER (output_msg); 
 
#undef encrypt 
#undef qop 
  } 
 
  /*! @decl string unwrap (string message, void|int accept_encrypted_only) 
   *! 
   *! Verifies the origin and integrity of the given message using the 
   *! MIC included in it, and also decrypts the message if it was 
   *! encrypted. The message has been calculated by the sender using 
   *! @[wrap] or some other @tt{GSS_Wrap@} wrapper. 
   *! 
   *! This wraps @tt{GSS_Unwrap@} according to @rfc{2743:2.3.4@}. 
   *! 
   *! This function requires that the context is established, or that 
   *! the early per-message protection service is available (c.f. 
   *! @[GSSAPI.PROT_READY_FLAG]. If not, a 
   *! @[GSSAPI.MissingServicesError] is thrown (but the context is not 
   *! closed). 
   *! 
   *! @param message 
   *!   The message to be unwrapped. 
   *! 
   *! @param accept_encrypted_only 
   *!   If this is nonzero then it is an error if @[message] isn't 
   *!   encrypted, and zero is returned in that case (the status 
   *!   returned by @[last_major_status] will still indicate success, 
   *!   though). 
   *! 
   *! @returns 
   *!   Zero is returned if the verification fails with 
   *!   @[GSSAPI.DEFECTIVE_TOKEN] or @[GSSAPI.BAD_MIC]. 
   *! 
   *!   Zero is also returned if @[message] isn't encrypted and 
   *!   @[accept_encrypted_only] is set. 
   *! 
   *!   Otherwise the message is successfully decrypted (provided it was 
   *!   encrypted to begin with), and its origin and integrity checks 
   *!   out, but it might still be considered wrong depending on whether 
   *!   the replay detection or sequencing services are required (see 
   *!   @[required_services]): 
   *! 
   *!   If replay detection (c.f. @[GSSAPI.REPLAY_FLAG]) is required 
   *!   then zero is returned if the message is duplicated 
   *!   (@[GSSAPI.DUPLICATE_TOKEN]) or old (@[GSSAPI.OLD_TOKEN]). 
   *! 
   *!   If sequencing (c.f. @[GSSAPI.SEQUENCE_FLAG]) is required then in 
   *!   addition to the replay detection conditions, zero is also 
   *!   returned if the message is out of sequence 
   *!   (@[GSSAPI.UNSEQ_TOKEN] or @[GSSAPI.GAP_TOKEN]). 
   *! 
   *!   Otherwise the unwrapped message is returned, which is valid 
   *!   according to the currently required services (note however that 
   *!   requiring the confidentiality service does not imply that an 
   *!   error is signalled whenever an unencrypted message is received - 
   *!   see instead @[accept_encrypted_only] above). 
   *! 
   *! @throws 
   *!   Any GSS-API errors except @[GSSAPI.DEFECTIVE_TOKEN] and 
   *!   @[GSSAPI.BAD_MIC] are thrown. 
   *! 
   *! @note 
   *!   This function sets the value returned by @[last_confidential] 
   *!   and @[last_qop]. 
   *! 
   *! @note 
   *!   Even if the message is considered valid by the return value, 
   *!   @[last_major_status] may be called to check for the informatory 
   *!   codes mentioned above. 
   */ 
  PIKEFUN string unwrap (string message, void|zero|int accept_encrypted_only) 
  { 
    gss_buffer_desc msg; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    INT_TYPE _accept_encrypted_only; 
    CHECK_OPT_ARG (accept_encrypted_only, _accept_encrypted_only, 
                   T_INT, integer, "int", "unwrap", 2); 
#define accept_encrypted_only _accept_encrypted_only 
#endif 
 
    CHECK_GOT_CONTEXT(); 
 
    if (!(THIS->current_services & GSS_C_PROT_READY_FLAG)) 
      throw_missing_services_error (GSS_C_PROT_READY_FLAG); 
 
    /* Can assume that all the required per-message services are 
     * available here. Otherwise the context establishment functions 
     * would have closed the context. */ 
    assert (!(~THIS->current_services & THIS->required_services)); 
 
    CHECK_NARROW_STRING (message, "unwrap", 1); 
    msg.length = message->len; 
    msg.value = message->str; 
 
    WITH_GSS_BUFFER (output_msg) { 
      int res; 
      OM_uint32 maj, min; 
      maj = gss_unwrap (&min, THIS->ctx, &msg, &output_msg, 
                        &THIS->last_confidential, &THIS->last_qop); 
      STATUS_MSG (gss_unwrap, maj, min); 
      SAVE_STATUS (maj, min); 
 
#ifdef PIKE_DEBUG 
      if (GSS_CALLING_ERROR (maj)) 
        handle_context_error (__LINE__, "gss_unwrap", maj, min); 
#endif 
      switch (GSS_ROUTINE_ERROR (maj)) { 
        case 0: 
          if ((maj & (GSS_S_DUPLICATE_TOKEN|GSS_S_OLD_TOKEN)) && 
              (THIS->required_services & (GSS_C_REPLAY_FLAG| 
                                          GSS_C_SEQUENCE_FLAG))) 
            res = 0; 
          else if ((maj & (GSS_S_UNSEQ_TOKEN|GSS_S_GAP_TOKEN)) && 
              (THIS->required_services & GSS_C_SEQUENCE_FLAG)) 
            res = 0; 
          else if (accept_encrypted_only && !THIS->last_confidential) 
            res = 0; 
          else 
            res = 1; 
          break; 
 
        case GSS_S_DEFECTIVE_TOKEN: 
        case GSS_S_BAD_SIG: 
          res = 0; 
          break; 
 
        default: 
          handle_context_error (__LINE__, "gss_unwrap", maj, min); 
      } 
 
      pop_n_elems (args); 
      if (res) 
        push_string (make_shared_binary_string (output_msg.value, 
                                                output_msg.length)); 
      else 
        push_int (0); 
    } END_GSS_BUFFER (output_msg); 
 
#undef accept_encrypted_only 
  } 
 
  /*! @decl void delete() 
   *! 
   *! Frees the resources for the context, provided it is in use. Does 
   *! nothing otherwise. 
   *! 
   *! This wraps @tt{GSS_Delete_sec_context@} according to 
   *! @rfc{2743:2.2.3@}. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers. 
   *! 
   *! @note 
   *!   In compliance with recommendations in GSS-API v2, the optional 
   *!   output token is never used in the call to 
   *!   @tt{GSS_Delete_sec_context@}. 
   */ 
  PIKEFUN void delete() 
  { 
    cleanup_context (&THIS->ctx); 
  } 
} 
 
/*! @endclass */ 
 
 
/*! @class InitContext 
 *! @inherit Context 
 *! 
 *! Variant of @[Context] which is used on the initiator side. 
 */ 
PIKECLASS InitContext 
{ 
  INHERIT Context; 
 
  /* The following are only used during context establishment since 
   * GSS-API doesn't allow us to leave them out in subsequent 
   * gss_init_sec_context calls (at least not explicitly). */ 
  CVAR struct object *cred; 
  CVAR struct object *target_name; 
  CVAR gss_OID_desc mech; 
  CVAR OM_uint32 desired_services; 
  CVAR OM_uint32 desired_time; 
 
  /* Isn't there a neater method to access the inherited objects? */ 
  static ptrdiff_t InitContext_Context_storage_offset; 
#undef THIS_CONTEXT 
#define THIS_CONTEXT ((struct Context_struct *)                         \ 
                      (Pike_fp->current_object->storage +               \ 
                       InitContext_Context_storage_offset)) 
 
  INIT 
  { 
    THIS->cred = THIS->target_name = NULL; 
    THIS->mech.elements = NULL; 
    THIS->desired_services = 0; 
    THIS->desired_time = 0; 
  } 
 
  EXIT 
    gc_trivial; 
  { 
    if (THIS->cred) 
      free_object (THIS->cred); 
    if (THIS->target_name) 
      free_object (debug_malloc_pass (THIS->target_name)); 
    if (THIS->mech.elements) 
      free (THIS->mech.elements); 
  } 
 
  /*! @decl protected void create (void|Cred cred, @ 
   *!                           void|Name|string target_name, @ 
   *!                           void|string mech, @ 
   *!                           void|int required_services, @ 
   *!                           void|int desired_services, @ 
   *!                           void|int(0..) desired_time) 
   *! 
   *! Creates a context for initiator use. This function only accepts 
   *! parameters to be used later during the @[init] call. If there 
   *! are semantic problems with them, such as if the credentials are 
   *! stale or the mechanism isn't supported, then they will be 
   *! signalled later by @[init]. 
   *! 
   *! @param cred 
   *!   Credentials for the identity this context claims. The 
   *!   credentials for the default principal (if any) is used if zero 
   *!   or left out. 
   *! 
   *! @param target_name 
   *!   The name of the target. 
   *! 
   *!   This can be either a @[GSSAPI.Name] object or a string. In the 
   *!   latter case, the string is converted to a GSS-API name 
   *!   according to a mechanism-specific default printable syntax, 
   *!   i.e. just like if it would be given as the sole argument to 
   *!   @[GSSAPI.Name.create]. 
   *! 
   *!   Some mechanisms support unnamed targets (as allowed in GSS-API 
   *!   v2, update 1) and in such cases this may be zero or left out. 
   *! 
   *! @param mech 
   *!   The mechanism to use. It is given as an OID on dotted-decimal 
   *!   form. The GSS-API implementation chooses this using system 
   *!   settings if it's zero or left out, which is the recommended way. 
   *! 
   *! @param required_services 
   *!   Bitfield of @tt{GSSAPI.*_FLAG@} flags specifying all services 
   *!   that must be provided in the context. If the context fail to 
   *!   provide any of them then it is closed and a 
   *!   @[GSSAPI.MissingServicesError] is thrown. 
   *! 
   *!   @[GSSAPI.PROT_READY_FLAG] is ignored in this parameter. The fact 
   *!   that a user calls a per-message function indicates that this 
   *!   service is required at that point, and a 
   *!   @[GSSAPI.MissingServicesError] is thrown if it isn't. 
   *! 
   *! @param desired_services 
   *!   Bitfield of @tt{GSSAPI.*_FLAG@} flags specifying the context 
   *!   services that are wanted but not required. I.e. errors won't 
   *!   be thrown if any of these aren't provided. The services 
   *!   specified in @[required_services] are implicit, so they need 
   *!   not be repeated here. 
   *! 
   *!   @[GSSAPI.PROT_READY_FLAG] is ignored in this parameter. 
   *! 
   *! @param desired_time 
   *!   The desired context validity time in seconds. Zero or left out 
   *!   means use the default. 
   *! 
   *! @note 
   *!   Channel bindings (@rfc{2743:1.1.6@}) are not yet implemented 
   *!   since that feature appear to not be in much active use, and 
   *!   its format is not completely specified (@rfc{2744:3.11@}). 
   */ 
  PIKEFUN void create (void|object(Cred) cred, 
                       void|object(Name)|string target_name, 
                       void|string mech, 
                       void|zero|int required_services, 
                       void|zero|int desired_services, 
                       void|zero|int(0..) desired_time) 
    flags ID_PROTECTED; 
  { 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    struct object *_cred; 
    struct pike_string *_mech; 
    INT_TYPE _required_services; 
    INT_TYPE _desired_services; 
    INT_TYPE _desired_time; 
    CHECK_OPT_ARG (cred, _cred, T_OBJECT, object, "Cred", "create", 1); 
    CHECK_OPT_ARG (mech, _mech, T_STRING, string, "string", "create", 3); 
    CHECK_OPT_ARG (required_services, _required_services, 
                   T_INT, integer, "int", "create", 4); 
    CHECK_OPT_ARG (desired_services, _desired_services, 
                   T_INT, integer, "int", "create", 5); 
    CHECK_OPT_ARG (desired_time, _desired_time, 
                   T_INT, integer, "int(0..)", "create", 6); 
#define CRED _cred 
#define MECH _mech 
#define REQUIRED_SERVICES _required_services 
#define DESIRED_SERVICES _desired_services 
#define DESIRED_TIME _desired_time 
#else 
#define CRED cred 
#define MECH mech 
#define REQUIRED_SERVICES required_services 
#define DESIRED_SERVICES desired_services 
#define DESIRED_TIME desired_time 
#endif 
 
    if (CRED) { 
      if (!get_storage (CRED, Cred_program)) 
        SIMPLE_ARG_TYPE_ERROR ("create", 1, "GSSAPI.Cred"); 
      if (THIS->cred) free_object (THIS->cred); 
      add_ref (THIS->cred = CRED); 
    } 
    else 
      if (THIS->cred) { 
        free_object (THIS->cred); 
        THIS->cred = NULL; 
      } 
 
    if (!target_name) 
      goto free_target_name; 
    switch (TYPEOF(*target_name)) { 
      case T_OBJECT: 
        if (!get_storage (target_name->u.object, Name_program)) 
          SIMPLE_ARG_TYPE_ERROR ("create", 2, "GSSAPI.Name|string"); 
        if (THIS->target_name) free_object (THIS->target_name); 
        add_ref (THIS->target_name = target_name->u.object); 
        break; 
      case T_STRING: { 
        gss_name_t gss_name = GSS_C_NO_NAME; 
        struct pike_string *name_str = target_name->u.string; 
        ONERROR uwp; 
        CHECK_NARROW_STRING (name_str, "create", 2); 
        SET_ONERROR (uwp, cleanup_name, &gss_name); 
        import_name_from_string (name_str, &gss_name, GSS_C_NO_OID); 
        if (THIS->target_name) free_object (THIS->target_name); 
        THIS->target_name = fast_clone_object (Name_program); 
        OBJ2_NAME (THIS->target_name)->name = gss_name; 
        UNSET_ONERROR (uwp); 
        break; 
      } 
      case T_INT: 
        if (!target_name->u.integer) { 
        free_target_name: 
          if (THIS->target_name) free_object (THIS->target_name); 
          THIS->target_name = NULL; 
          break; 
        } 
        /* Fall through */ 
      default: 
        SIMPLE_ARG_TYPE_ERROR ("create", 2, "void|GSSAPI.Name|string"); 
    } 
 
    if (MECH) 
      WITH_PUSHED_GSS_OID (mech_oid, MECH) { 
        if (THIS->mech.elements) free (THIS->mech.elements); 
        COPY_OID (&THIS->mech, &mech_oid); 
      } END_GSS_OID (mech_oid); 
    else 
      if (THIS->mech.elements) { 
        free (THIS->mech.elements); 
        THIS->mech.elements = NULL; 
      } 
 
    THIS_CONTEXT->required_services = 
      (REQUIRED_SERVICES & ~GSS_C_PROT_READY_FLAG); 
 
    THIS->desired_services = 
      ((DESIRED_SERVICES | REQUIRED_SERVICES) & ~GSS_C_PROT_READY_FLAG); 
 
    if (DESIRED_TIME < 0) 
      SIMPLE_ARG_TYPE_ERROR ("create", 6, "int(0..)"); 
    THIS->desired_time = DESIRED_TIME; 
 
#undef CRED 
#undef MECH 
#undef REQUIRED_SERVICES 
#undef DESIRED_SERVICES 
#undef DESIRED_TIME 
  } 
 
  /*! @decl string init (void|string remote_token) 
   *! 
   *! Initiates a security context to send to a remote peer. 
   *! 
   *! This wraps @tt{GSS_Init_sec_context@} according to 
   *! @rfc{2743:2.2.1@}. 
   *! 
   *! The underlying mechanism might require several tokens to be 
   *! passed back and forth to establish the context. If 
   *! @[is_established] returns zero after a call to this function 
   *! then the caller must wait for a token from the remote peer to 
   *! feed as @[remote_token] in another call to this function. 
   *! 
   *! @param remote_token 
   *!   A token from the remote peer, as returned by a call to 
   *!   @[GSSAPI.AcceptContext.accept] (or some other 
   *!   @tt{GSS_Accept_sec_context@} wrapper) in it. This is zero or 
   *!   left out on the initial call, but used later if the remote 
   *!   peer sends back tokens to process as part of the context 
   *!   establishment. 
   *! 
   *! @returns 
   *!   If a string is returned then it must be passed to the remote 
   *!   peer which will feed it to @[GSSAPI.AcceptContext.accept] or 
   *!   some other @tt{GSS_Accept_sec_context@} wrapper. An empty 
   *!   string is never returned. 
   *! 
   *!   Zero is returned if there is no token to send to the remote 
   *!   peer. Note that @[is_established] might still return zero in 
   *!   that case, meaning more remote tokens are necessary. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers. 
   */ 
  PIKEFUN string init (void|string remote_token) 
  { 
    gss_buffer_desc input_token; 
 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    struct pike_string *_remote_token; 
    CHECK_OPT_ARG (remote_token, _remote_token, 
                   T_STRING, string, "string", "init", 1); 
#define remote_token _remote_token 
#endif 
 
    if (THIS_CONTEXT->ctx == GSS_C_NO_CONTEXT) { 
      if (remote_token) 
        SIMPLE_ARG_ERROR ("init", 1, "Remote token passed in initial call."); 
      input_token.length = 0; 
      input_token.value = NULL; 
    } 
    else { 
      if (!remote_token) 
        SIMPLE_ARG_ERROR ("init", 1, 
                          "Remote token required in subsequent call."); 
      CHECK_NARROW_STRING (remote_token, "init", 1); 
      input_token.length = remote_token->len; 
      input_token.value = remote_token->str; 
    } 
 
    WITH_GSS_BUFFER (output_token) { 
      gss_ctx_id_t ctx = THIS_CONTEXT->ctx; 
      const gss_cred_id_t cred = THIS->cred ? 
        ((struct Cred_struct *) get_storage (THIS->cred, Cred_program))->cred : 
        GSS_C_NO_CREDENTIAL; 
      const gss_name_t target_name = THIS->target_name ? 
        ((struct Name_struct *) 
         get_storage (THIS->target_name, Name_program))->name : 
        GSS_C_NO_NAME; 
      const gss_OID mech = THIS->mech.elements ? &THIS->mech : GSS_C_NO_OID; 
      OM_uint32 req_flags = THIS->desired_services; 
      OM_uint32 time_req = THIS->desired_time; 
      OM_uint32 ret_flags; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      maj = gss_init_sec_context (&min, cred, &ctx, target_name, mech, 
                                  req_flags, time_req, 
                                  GSS_C_NO_CHANNEL_BINDINGS, &input_token, 
                                  NULL, &output_token, &ret_flags, NULL); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_init_sec_context, maj, min); 
 
      if (GSS_CALLING_ERROR (maj) == GSS_S_CALL_INACCESSIBLE_READ && 
          target_name == GSS_C_NO_NAME) { 
        /* RFC 2743, section 2.2.1: "In addition to support for other name 
         * types, it is recommended (newly as of GSS-V2, Update 1) that 
         * mechanisms be able to accept GSS_C_NO_NAME as an input type for 
         * targ_name. While recommended, such support is not required, and it 
         * is recognized that not all mechanisms can construct tokens without 
         * explicitly naming the context target, even when mutual 
         * authentication of the target is not obtained. Callers wishing to 
         * make use of this facility and concerned with portability should be 
         * aware that support for GSS_C_NO_NAME as input targ_name type is 
         * unlikely to be provided within mechanism definitions specified prior 
         * to GSS-V2, Update 1." 
         * 
         * If support is lacking then the gssapi lib considers the target name 
         * a required argument, and it should therefore signal the lack of it 
         * as an GSS_S_CALL_INACCESSIBLE_READ error, so we assume this is the 
         * case if target_name contains no name. */ 
        if (GSS_ROUTINE_ERROR (maj)) 
          maj = GSS_ROUTINE_ERROR (maj) | GSS_SUPPLEMENTARY_INFO (maj); 
        else 
          maj = GSS_S_BAD_NAME | GSS_SUPPLEMENTARY_INFO (maj); 
      } 
 
      else if (maj & (GSS_S_OLD_TOKEN|GSS_S_DUPLICATE_TOKEN)) 
        /* RFC 2744, section 5.19: "During context establishment, the 
         * informational status bits GSS_S_OLD_TOKEN and GSS_S_DUPLICATE_TOKEN 
         * indicate fatal errors, and GSS-API mechanisms should always return 
         * them in association with a routine error of GSS_S_FAILURE. This 
         * requirement for pairing did not exist in version 1 of the GSS-API 
         * specification, so applications that wish to run over version 1 
         * implementations must special-case these codes." */ 
        maj = GSS_CALLING_ERROR (maj) | 
          GSS_S_FAILURE | GSS_SUPPLEMENTARY_INFO (maj); 
 
      DEBUG_MSG ((stderr, "gssapi.pmod:%d: gss_init_sec_context " 
                  "status is %x/%x after adjustments\n", __LINE__, maj, min)); 
 
      SAVE_STATUS (maj, min); 
 
      if (THIS_CONTEXT->ctx == GSS_C_NO_CONTEXT) { 
        DMALLOC_REGISTER (ctx); 
        THIS_CONTEXT->ctx = ctx; 
      } 
      else if (THIS_CONTEXT->ctx != ctx) { 
        cleanup_context (&ctx); 
        Pike_error ("Contained context changed asynchronously.\n"); 
      } 
 
      CHECK_CONTEXT_ERROR (gss_init_sec_context, maj, min); 
 
      THIS_CONTEXT->current_services = ret_flags; 
 
      if (!(maj & GSS_S_CONTINUE_NEEDED)) { 
        /* GSSAPIv1 implementations won't set the prot ready flag, so 
         * let's do it here to avoid special cases later. */ 
        THIS_CONTEXT->current_services |= GSS_C_PROT_READY_FLAG; 
 
        /* Clear variables that are of no use after context establishment. */ 
        exit_InitContext_struct(); 
        init_InitContext_struct(); 
 
        { 
          OM_uint32 missing = ~ret_flags & THIS_CONTEXT->required_services; 
          if (missing) { 
            REINIT_THIS(); 
            throw_missing_services_error (missing); 
          } 
        } 
      } 
 
      pop_n_elems (args); 
      if (output_token.length) { 
        if ((THIS_CONTEXT->required_services & GSS_C_ANON_FLAG) && 
            !(ret_flags & GSS_C_ANON_FLAG)) 
          /* RFC 2743, section 2.2.1: "Callers wishing to perform context 
           * establishment only if anonymity support is provided should 
           * transfer a returned token from GSS_Init_sec_context() to the peer 
           * only if it is accompanied by a TRUE anon_state indicator." */ 
          throw_missing_services_error (GSS_C_ANON_FLAG); 
        push_string (make_shared_binary_string (output_token.value, 
                                                output_token.length)); 
      } 
      else 
        push_int (0); 
    } END_GSS_BUFFER (output_token); 
 
#undef remote_token 
  } 
} 
 
/*! @endclass */ 
 
 
/*! @class AcceptContext 
 *! @inherit Context 
 *! 
 *! Variant of @[Context] which is used on the acceptor side. 
 */ 
PIKECLASS AcceptContext 
{ 
  INHERIT Context; 
 
  CVAR struct object *delegated_cred; 
 
  /* The following is only used during context establishment since 
   * GSS-API doesn't allow us to leave it out in subsequent 
   * gss_accept_sec_context calls. */ 
  CVAR struct object *cred; 
 
  /* Isn't there a neater method to access the inherited objects? */ 
  static ptrdiff_t AcceptContext_Context_storage_offset; 
#undef THIS_CONTEXT 
#define THIS_CONTEXT ((struct Context_struct *)                         \ 
                      (Pike_fp->current_object->storage +               \ 
                       AcceptContext_Context_storage_offset)) 
 
  INIT 
  { 
    THIS->delegated_cred = NULL; 
    THIS->cred = NULL; 
  } 
 
  EXIT 
    gc_trivial; 
  { 
    if (THIS->delegated_cred) 
      free_object (THIS->delegated_cred); 
    if (THIS->cred) 
      free_object (THIS->cred); 
  } 
 
  /*! @decl protected void create (void|Cred cred, @ 
   *!                           void|int required_services) 
   *! 
   *! Creates a context for acceptor use. This function only accepts 
   *! parameters to be used later during the @[accept] call. If there 
   *! are semantic problems with them, such as if the credentials are 
   *! stale, then they will be signalled later by @[accept]. 
   *! 
   *! @param cred 
   *!   Credentials for the identity this context claims. The 
   *!   credentials for the default principal (if any) is used if zero 
   *!   or left out. 
   *! 
   *! @param required_services 
   *!   Bitfield of @tt{GSSAPI.*_FLAG@} flags specifying all services 
   *!   that must be provided in the context. If the context fail to 
   *!   provide any of them then it is closed and a 
   *!   @[GSSAPI.MissingServicesError] is thrown. 
   *! 
   *!   @[GSSAPI.PROT_READY_FLAG] is ignored in this parameter. The fact 
   *!   that a user calls a per-message function indicates that this 
   *!   service is required at that point, and a 
   *!   @[GSSAPI.MissingServicesError] is thrown if it isn't. 
   *! 
   *! @note 
   *!   Channel bindings (@rfc{2743:1.1.6@}) are not yet implemented 
   *!   since that feature appear to not be in much active use, and 
   *!   its format is not completely specified (@rfc{2744:3.11@}). 
   */ 
  PIKEFUN void create (void|object(Cred) cred, 
                       void|zero|int required_services) 
    flags ID_PROTECTED; 
  { 
#ifndef PRECOMPILE_API_VERSION 
    /* Live with the pessimal precompile.pike in 7.4.. :P */ 
    struct object *_cred; 
    INT_TYPE _required_services; 
    CHECK_OPT_ARG (cred, _cred, T_OBJECT, object, "Cred", "create", 1); 
    CHECK_OPT_ARG (required_services, _required_services, 
                   T_INT, integer, "int", "create", 2); 
#define CRED _cred 
#define REQUIRED_SERVICES _required_services 
#else 
#define CRED cred 
#define REQUIRED_SERVICES required_services 
#endif 
 
    if (CRED) { 
      if (!get_storage (CRED, Cred_program)) 
        SIMPLE_ARG_TYPE_ERROR ("create", 1, "GSSAPI.Cred"); 
      if (THIS->cred) free_object (THIS->cred); 
      add_ref (THIS->cred = CRED); 
    } 
    else 
      if (THIS->cred) { 
        free_object (THIS->cred); 
        THIS->cred = NULL; 
      } 
 
    THIS_CONTEXT->required_services = 
      (REQUIRED_SERVICES & ~GSS_C_PROT_READY_FLAG); 
 
#undef CRED 
#undef REQUIRED_SERVICES 
  } 
 
  /*! @decl string accept (string remote_token) 
   *! 
   *! Accepts a remotely initiated security context. 
   *! 
   *! This wraps @tt{GSS_Accept_sec_context@} according to 
   *! @rfc{2743:2.2.2@}. 
   *! 
   *! The underlying mechanism might require several tokens to be 
   *! passed back and forth to establish the context. If 
   *! @[is_established] returns zero after a call to this function 
   *! then the caller must wait for a token from the remote peer to 
   *! feed as @[remote_token] in another call to this function. 
   *! 
   *! @param remote_token 
   *!   A token from the remote peer, as returned by a call to 
   *!   @[GSSAPI.InitContext.init] or some other 
   *!   @tt{GSS_Init_sec_context@} wrapper. 
   *! 
   *! @returns 
   *!   If a string is returned then it must be passed to the remote 
   *!   peer which will feed it to @[GSSAPI.InitContext.init] or some 
   *!   other @tt{GSS_Init_sec_context@} wrapper. An empty string is 
   *!   never returned. 
   *! 
   *!   Zero is returned if there is no token to send to the remote 
   *!   peer. Note that @[is_established] might still return zero in 
   *!   that case, meaning more remote tokens are necessary. 
   *! 
   *! @note 
   *!   This function might block on network connections to remote 
   *!   authentication servers. 
   */ 
  PIKEFUN string accept (string remote_token) 
  { 
    gss_buffer_desc input_token; 
 
    CHECK_NARROW_STRING (remote_token, "init", 1); 
    input_token.length = remote_token->len; 
    input_token.value = remote_token->str; 
 
    WITH_GSS_BUFFER (output_token) { 
      gss_ctx_id_t ctx = THIS_CONTEXT->ctx; 
      const gss_cred_id_t cred = THIS->cred ? 
        ((struct Cred_struct *) get_storage (THIS->cred, Cred_program))->cred : 
        GSS_C_NO_CREDENTIAL; 
      OM_uint32 ret_flags; 
      gss_cred_id_t delegated_cred; 
      OM_uint32 maj, min; 
 
      THREADS_ALLOW(); 
      maj = gss_accept_sec_context (&min, &ctx, cred, &input_token, 
                                    GSS_C_NO_CHANNEL_BINDINGS, NULL, 
                                    NULL, &output_token, &ret_flags, NULL, 
                                    &delegated_cred); 
      THREADS_DISALLOW(); 
 
      STATUS_MSG (gss_accept_sec_context, maj, min); 
 
      if (maj & (GSS_S_OLD_TOKEN|GSS_S_DUPLICATE_TOKEN)) 
        /* RFC 2744, section 5.1: "During context establishment, the 
         * informational status bits GSS_S_OLD_TOKEN and GSS_S_DUPLICATE_TOKEN 
         * indicate fatal errors, and GSS-API mechanisms should always return 
         * them in association with a routine error of GSS_S_FAILURE. This 
         * requirement for pairing did not exist in version 1 of the GSS-API 
         * specification, so applications that wish to run over version 1 
         * implementations must special-case these codes." */ 
        maj = 
          (maj & ~(GSS_C_ROUTINE_ERROR_MASK << GSS_C_ROUTINE_ERROR_OFFSET)) | 
          GSS_S_FAILURE; 
 
      DEBUG_MSG ((stderr, "gssapi.pmod:%d: gss_accept_sec_context " 
                  "status is %x/%x after adjustments\n", __LINE__, maj, min)); 
 
      SAVE_STATUS (maj, min); 
 
      if (THIS_CONTEXT->ctx == GSS_C_NO_CONTEXT) { 
        DMALLOC_REGISTER (ctx); 
        THIS_CONTEXT->ctx = ctx; 
      } 
      else if (THIS_CONTEXT->ctx != ctx) { 
        cleanup_context (&ctx); 
        Pike_error ("Contained context changed asynchronously.\n"); 
      } 
 
      if (delegated_cred != GSS_C_NO_CREDENTIAL) { 
        DMALLOC_REGISTER (delegated_cred); 
        if (THIS->delegated_cred) { 
          /* Ensure that the cred handle in the object is released 
           * synchronously since it might block. */ 
          assert (THIS->delegated_cred->prog == Cred_program); 
          cleanup_cred (&((struct Cred_struct *) 
                          THIS->delegated_cred->storage)->cred); 
          free_object (THIS->delegated_cred); 
        } 
        THIS->delegated_cred = fast_clone_object (Cred_program); 
        OBJ2_CRED (THIS->delegated_cred)->cred = delegated_cred; 
      } 
 
      CHECK_CONTEXT_ERROR (gss_accept_sec_context, maj, min); 
 
      THIS_CONTEXT->current_services = ret_flags; 
 
      if (!(maj & GSS_S_CONTINUE_NEEDED)) { 
        /* GSSAPIv1 implementations won't set the prot ready flag, so 
         * let's do it here to avoid special cases later. */ 
        THIS_CONTEXT->current_services |= GSS_C_PROT_READY_FLAG; 
 
        /* Clear variables that are of no use after context establishment. */ 
        if (THIS->cred) { 
          free_object (THIS->cred); 
          THIS->cred = NULL; 
        } 
 
        { 
          OM_uint32 missing = ~ret_flags & THIS_CONTEXT->required_services; 
          if (missing) { 
            REINIT_THIS(); 
            throw_missing_services_error (missing); 
          } 
        } 
      } 
 
      pop_n_elems (args); 
      if (output_token.length) 
        push_string (make_shared_binary_string (output_token.value, 
                                                output_token.length)); 
      else 
        push_int (0); 
    } END_GSS_BUFFER (output_token); 
  } 
 
  /*! @decl Cred delegated_cred() 
   *! 
   *! Returns the delegated credentials from the initiator if the 
   *! delegation (c.f. @[GSSAPI.DELEG_FLAG]) service is in use. 
   */ 
  PIKEFUN object(Cred) delegated_cred() 
  { 
    if (THIS->delegated_cred) 
      ref_push_object (THIS->delegated_cred); 
    else 
      push_int (0); 
  } 
} 
 
/*! @endclass */ 
 
 
/*! @decl multiset(string) indicate_mechs() 
 *! 
 *! Returns the OIDs for the available mechanism in the GSS-API 
 *! implementation. The OIDs are returned on dotted-decimal form. 
 *! 
 *! This wraps @tt{GSS_Indicate_mechs@} according to 
 *! @rfc{2743:2.4.2@}. 
 */ 
PIKEFUN multiset(string) indicate_mechs() 
{ 
  gss_OID_set mechs = GSS_C_NO_OID_SET; 
  OM_uint32 maj, min; 
  ONERROR uwp; 
 
  SET_ONERROR (uwp, cleanup_oid_set, &mechs); 
 
  THREADS_ALLOW(); 
  /* RFC 2743 doesn't rule out that this might block. */ 
  maj = gss_indicate_mechs (&min, &mechs); 
  THREADS_DISALLOW(); 
 
  MORE_STATUS_MSG (gss_indicate_mechs, maj, min); 
  DMALLOC_REGISTER (mechs); 
  CHECK_UNEXPECTED_ERROR (gss_indicate_mechs, maj, min); 
 
  convert_from_oid_set_and_push (mechs); 
 
  CALL_AND_UNSET_ONERROR (uwp); 
} 
 
/*! @decl multiset(string) names_for_mech (string mech) 
 *! 
 *! Returns the OIDs for the name types that the given @[mech] 
 *! supports. Both @[mech] and the returned OID strings are on 
 *! dotted-decimal form. 
 *! 
 *! This wraps @tt{GSS_Inquire_names_for_mech@} according to 
 *! @rfc{2743:2.4.12@}. 
 */ 
PIKEFUN multiset(string) names_for_mech (string mech) 
{ 
  gss_OID_set name_types = GSS_C_NO_OID_SET; 
  ONERROR uwp; 
 
  SET_ONERROR (uwp, cleanup_oid_set, &name_types); 
 
  WITH_PUSHED_GSS_OID (mech_oid, mech) { 
    OM_uint32 maj, min; 
 
    THREADS_ALLOW(); 
    /* RFC 2743 doesn't rule out that this might block. */ 
    maj = gss_inquire_names_for_mech (&min, &mech_oid, &name_types); 
    THREADS_DISALLOW(); 
 
    STATUS_MSG (gss_inquire_names_for_mech, maj, min); 
    DMALLOC_REGISTER (name_types); 
    CHECK_ERROR_WITH_MECH (gss_inquire_names_for_mech, maj, min, &mech_oid); 
  } END_GSS_OID (mech_oid); 
 
  convert_from_oid_set_and_push (name_types); 
  CALL_AND_UNSET_ONERROR (uwp); 
} 
 
/*! @endmodule */ 
 
#endif  /* HAVE_GSSAPI */ 
 
PIKE_MODULE_INIT 
{ 
#ifdef HAVE_GSSAPI 
  der_dd_map = allocate_mapping (10); 
 
  start_new_program(); 
  low_inherit (generic_error_program, NULL, 0, 0, 0, NULL); 
  gssapi_err_struct_offset = ADD_STORAGE (struct gssapi_err_struct); 
  add_string_constant ("error_type", "gssapi_error", 0); 
  add_integer_constant ("is_gssapi_error", 1, 0); 
  PIKE_MAP_VARIABLE ("major_status", 
                     (gssapi_err_struct_offset + 
                      OFFSETOF (gssapi_err_struct, major_status)), 
                     tInt, T_INT, 0); 
  PIKE_MAP_VARIABLE ("minor_status", 
                     (gssapi_err_struct_offset + 
                      OFFSETOF (gssapi_err_struct, minor_status)), 
                     tInt, T_INT, 0); 
  pike_set_prog_event_callback (gssapi_err_events); 
#ifdef PROGRAM_LIVE_OBJ 
  Pike_compiler->new_program->flags &= ~PROGRAM_LIVE_OBJ; 
#endif 
  ADD_FUNCTION ("create", gssapi_err_create, 
                tFunc(tOr(tVoid,tInt) tOr(tVoid,tInt) tOr(tVoid,tString) 
                      tOr(tVoid,tString) tOr(tVoid,tArray), 
                      tVoid), ID_PROTECTED); 
  ADD_FUNCTION ("major_status_messages", gssapi_err_major_msgs, 
                tFunc(tVoid,tArr(tString)), 0); 
  ADD_FUNCTION ("minor_status_messages", gssapi_err_minor_msgs, 
                tFunc(tVoid,tArr(tString)), 0); 
  ADD_FUNCTION ("minor_status_mech", gssapi_err_minor_mech, 
                tFunc(tVoid,tString), 0); 
  gssapi_err_program = end_program(); 
  add_program_constant ("Error", gssapi_err_program, 0); 
 
  start_new_program(); 
  low_inherit (generic_error_program, NULL, 0, 0, 0, NULL); 
  missing_err_struct_offset = ADD_STORAGE (struct missing_err_struct); 
  add_string_constant ("error_type", "gssapi_missing_services_error", 0); 
  add_integer_constant ("is_gssapi_missing_services_error", 1, 0); 
  PIKE_MAP_VARIABLE ("services", 
                     (missing_err_struct_offset + 
                      OFFSETOF (missing_err_struct, services)), 
                     tInt, T_INT, 0); 
  pike_set_prog_event_callback (missing_err_events); 
#ifdef PROGRAM_LIVE_OBJ 
  Pike_compiler->new_program->flags &= ~PROGRAM_LIVE_OBJ; 
#endif 
  ADD_FUNCTION ("create", missing_err_create, 
                tFunc(tOr(tVoid,tInt), tVoid), ID_PROTECTED); 
  missing_err_program = end_program(); 
  add_program_constant ("MissingServicesError", missing_err_program, 0); 
 
  /* As it happens, none of the currently defined errors and flags in 
   * the GSS-API spec conflicts with the sign bit if INT_TYPE is 32 
   * bits, so we can assume native ints for all of the following. */ 
 
  add_integer_constant ("ERROR_MASK", 
                        GSS_C_ROUTINE_ERROR_MASK << GSS_C_ROUTINE_ERROR_OFFSET, 
                        0); 
  add_integer_constant ("BAD_MECH", GSS_S_BAD_MECH, 0); 
  add_integer_constant ("BAD_NAME", GSS_S_BAD_NAME, 0); 
  add_integer_constant ("BAD_NAMETYPE", GSS_S_BAD_NAMETYPE, 0); 
  add_integer_constant ("BAD_BINDINGS", GSS_S_BAD_BINDINGS, 0); 
  add_integer_constant ("BAD_STATUS", GSS_S_BAD_STATUS, 0); 
  add_integer_constant ("BAD_MIC", GSS_S_BAD_MIC, 0); 
  add_integer_constant ("NO_CRED", GSS_S_NO_CRED, 0); 
  add_integer_constant ("NO_CONTEXT", GSS_S_NO_CONTEXT, 0); 
  add_integer_constant ("DEFECTIVE_TOKEN", GSS_S_DEFECTIVE_TOKEN, 0); 
  add_integer_constant ("DEFECTIVE_CREDENTIAL", GSS_S_DEFECTIVE_CREDENTIAL, 0); 
  add_integer_constant ("CREDENTIALS_EXPIRED", GSS_S_CREDENTIALS_EXPIRED, 0); 
  add_integer_constant ("CONTEXT_EXPIRED", GSS_S_CONTEXT_EXPIRED, 0); 
  add_integer_constant ("FAILURE", GSS_S_FAILURE, 0); 
  add_integer_constant ("BAD_QOP", GSS_S_BAD_QOP, 0); 
  add_integer_constant ("UNAUTHORIZED", GSS_S_UNAUTHORIZED, 0); 
  add_integer_constant ("UNAVAILABLE", GSS_S_UNAVAILABLE, 0); 
  add_integer_constant ("DUPLICATE_ELEMENT", GSS_S_DUPLICATE_ELEMENT, 0); 
  add_integer_constant ("NAME_NOT_MN", GSS_S_NAME_NOT_MN, 0); 
 
  add_integer_constant ("INFO_MASK", 
                        GSS_C_SUPPLEMENTARY_MASK << GSS_C_SUPPLEMENTARY_OFFSET, 
                        0); 
  add_integer_constant ("CONTINUE_NEEDED", GSS_S_CONTINUE_NEEDED, 0); 
  add_integer_constant ("DUPLICATE_TOKEN", GSS_S_DUPLICATE_TOKEN, 0); 
  add_integer_constant ("OLD_TOKEN", GSS_S_OLD_TOKEN, 0); 
  add_integer_constant ("UNSEQ_TOKEN", GSS_S_UNSEQ_TOKEN, 0); 
  add_integer_constant ("GAP_TOKEN", GSS_S_GAP_TOKEN, 0); 
 
  { 
    struct svalue str; 
    SET_SVAL(str, T_STRING, 0, string, NULL); 
 
#define ADD_DD_OID_CONSTANT(PIKE_SYM, GSS_SYM) do {                     \ 
      str.u.string = get_dd_oid (GSS_SYM);                              \ 
      simple_add_constant (PIKE_SYM, &str, 0);                          \ 
    } while (0) 
 
    ADD_DD_OID_CONSTANT ("NT_HOSTBASED_SERVICE", GSS_C_NT_HOSTBASED_SERVICE); 
    ADD_DD_OID_CONSTANT ("NT_USER_NAME", GSS_C_NT_USER_NAME); 
    ADD_DD_OID_CONSTANT ("NT_MACHINE_UID_NAME", GSS_C_NT_MACHINE_UID_NAME); 
    ADD_DD_OID_CONSTANT ("NT_STRING_UID_NAME", GSS_C_NT_STRING_UID_NAME); 
    ADD_DD_OID_CONSTANT ("NT_ANONYMOUS", GSS_C_NT_ANONYMOUS); 
    ADD_DD_OID_CONSTANT ("NT_EXPORT_NAME", GSS_C_NT_EXPORT_NAME); 
 
    ADD_DD_OID_CONSTANT ("KRB5_NT_PRINCIPAL_NAME", GSS_KRB5_NT_PRINCIPAL_NAME); 
 
#undef ADD_OID_CONSTANT 
  } 
 
  add_integer_constant ("INITIATE", GSS_C_INITIATE, 0); 
  add_integer_constant ("ACCEPT", GSS_C_ACCEPT, 0); 
  add_integer_constant ("BOTH", GSS_C_BOTH, 0); 
 
  add_integer_constant ("DELEG_FLAG", GSS_C_DELEG_FLAG, 0); 
  add_integer_constant ("MUTUAL_FLAG", GSS_C_MUTUAL_FLAG, 0); 
  add_integer_constant ("REPLAY_FLAG", GSS_C_REPLAY_FLAG, 0); 
  add_integer_constant ("SEQUENCE_FLAG", GSS_C_SEQUENCE_FLAG, 0); 
  add_integer_constant ("CONF_FLAG", GSS_C_CONF_FLAG, 0); 
  add_integer_constant ("INTEG_FLAG", GSS_C_INTEG_FLAG, 0); 
  add_integer_constant ("ANON_FLAG", GSS_C_ANON_FLAG, 0); 
  add_integer_constant ("PROT_READY_FLAG", GSS_C_PROT_READY_FLAG, 0); 
  add_integer_constant ("TRANS_FLAG", GSS_C_TRANS_FLAG, 0); 
 
#endif  /* HAVE_GSSAPI */ 
 
  INIT; 
 
#ifdef HAVE_GSSAPI 
  InitContext_Context_storage_offset = 
    low_get_storage (InitContext_program, Context_program); 
  AcceptContext_Context_storage_offset = 
    low_get_storage (AcceptContext_program, Context_program); 
#else 
  HIDE_MODULE(); 
#endif 
} 
 
PIKE_MODULE_EXIT 
{ 
#ifdef HAVE_GSSAPI 
  if (der_dd_map) free_mapping (der_dd_map); 
  free_svalue (&int_pos_inf); 
  free_svalue (&encode_der_oid); 
  free_svalue (&decode_der_oid); 
  if (gssapi_err_program) free_program (gssapi_err_program); 
  if (missing_err_program) free_program (missing_err_program); 
#endif 
 
  EXIT; 
}