}
static void
-peerSetConfigBlob(void *ctx, struct wpa_config_blob *blob)
+peerSetConfigBlob(void *ctx GSSEAP_UNUSED,
+ struct wpa_config_blob *blob GSSEAP_UNUSED)
{
}
static const struct wpa_config_blob *
-peerGetConfigBlob(void *ctx, const char *name)
+peerGetConfigBlob(void *ctx GSSEAP_UNUSED,
+ const char *name GSSEAP_UNUSED)
{
return NULL;
}
static void
-peerNotifyPending(void *ctx)
+peerNotifyPending(void *ctx GSSEAP_UNUSED)
{
}
gss_ctx_id_t ctx,
gss_name_t target,
gss_OID mech,
- OM_uint32 reqFlags,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
OM_uint32 timeReq,
- gss_channel_bindings_t chanBindings,
- gss_buffer_t inputToken)
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED)
{
OM_uint32 major;
if (GSS_ERROR(major))
return major;
- GSSEAP_MUTEX_LOCK(&target->mutex);
+ if (target != GSS_C_NO_NAME) {
+ GSSEAP_MUTEX_LOCK(&target->mutex);
+
+ major = gssEapDuplicateName(minor, target, &ctx->acceptorName);
+ if (GSS_ERROR(major)) {
+ GSSEAP_MUTEX_UNLOCK(&target->mutex);
+ return major;
+ }
- major = gssEapDuplicateName(minor, target, &ctx->acceptorName);
- if (GSS_ERROR(major)) {
GSSEAP_MUTEX_UNLOCK(&target->mutex);
- return major;
}
- GSSEAP_MUTEX_UNLOCK(&target->mutex);
-
if (mech == GSS_C_NULL_OID) {
major = gssEapDefaultMech(minor, &ctx->mechanismUsed);
} else if (gssEapIsConcreteMechanismOid(mech)) {
static OM_uint32
eapGssSmInitError(OM_uint32 *minor,
- gss_cred_id_t cred,
- gss_ctx_id_t ctx,
- gss_name_t target,
- gss_OID mech,
- OM_uint32 reqFlags,
- OM_uint32 timeReq,
- gss_channel_bindings_t chanBindings,
+ gss_cred_id_t cred GSSEAP_UNUSED,
+ gss_ctx_id_t ctx GSSEAP_UNUSED,
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
gss_buffer_t inputToken,
- gss_buffer_t outputToken,
- int *transitionState)
+ gss_buffer_t outputToken GSSEAP_UNUSED,
+ OM_uint32 *smFlags GSSEAP_UNUSED)
{
OM_uint32 major;
unsigned char *p;
gss_cred_id_t cred,
gss_ctx_id_t ctx,
gss_name_t target,
- gss_OID mech,
+ gss_OID mech GSSEAP_UNUSED,
OM_uint32 reqFlags,
OM_uint32 timeReq,
gss_channel_bindings_t chanBindings,
gss_buffer_t inputToken,
gss_buffer_t outputToken,
- int *transitionState)
+ OM_uint32 *smFlags GSSEAP_UNUSED)
{
OM_uint32 major, tmpMinor;
gss_name_t mechTarget = GSS_C_NO_NAME;
assert(cred != GSS_C_NO_CREDENTIAL);
- if (ctx->state == GSSEAP_STATE_INITIAL) {
+ if (GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_INITIAL) {
if (!gssEapCanReauthP(cred, target, timeReq))
return GSS_S_CONTINUE_NEEDED;
- major = initBegin(minor, cred, ctx, target, mech,
- reqFlags, timeReq, chanBindings,
- inputToken);
- if (GSS_ERROR(major))
- goto cleanup;
-
ctx->flags |= CTX_FLAG_KRB_REAUTH;
} else if ((ctx->flags & CTX_FLAG_KRB_REAUTH) == 0) {
major = GSS_S_DEFECTIVE_TOKEN;
&ctx->kerberosCtx,
mechTarget,
(gss_OID)gss_mech_krb5,
- reqFlags,
+ reqFlags | GSS_C_MUTUAL_FLAG,
timeReq,
chanBindings,
inputToken,
ctx->gssFlags = gssFlags;
if (major == GSS_S_COMPLETE) {
+ assert(GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_REAUTHENTICATE);
+
major = gssEapReauthComplete(minor, ctx, cred, actualMech, timeRec);
if (GSS_ERROR(major))
goto cleanup;
- ctx->state = GSSEAP_STATE_NEGO_EXT; /* skip */
+ GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
+ } else {
+ GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_REAUTHENTICATE);
}
- *transitionState = 1;
-
cleanup:
gssReleaseName(&tmpMinor, &mechTarget);
}
#endif /* GSSEAP_ENABLE_REAUTH */
+#ifdef GSSEAP_DEBUG
+static OM_uint32
+eapGssSmInitVendorInfo(OM_uint32 *minor,
+ gss_cred_id_t cred GSSEAP_UNUSED,
+ gss_ctx_id_t ctx GSSEAP_UNUSED,
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+ gss_buffer_t inputToken GSSEAP_UNUSED,
+ gss_buffer_t outputToken,
+ OM_uint32 *smFlags GSSEAP_UNUSED)
+{
+ OM_uint32 major;
+
+ major = makeStringBuffer(minor, "JANET(UK)", outputToken);
+ if (GSS_ERROR(major))
+ return major;
+
+ return GSS_S_CONTINUE_NEEDED;
+}
+#endif
+
+static OM_uint32
+eapGssSmInitAcceptorName(OM_uint32 *minor,
+ gss_cred_id_t cred GSSEAP_UNUSED,
+ gss_ctx_id_t ctx,
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+ gss_buffer_t inputToken GSSEAP_UNUSED,
+ gss_buffer_t outputToken,
+ OM_uint32 *smFlags GSSEAP_UNUSED)
+{
+ OM_uint32 major;
+
+ if (GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_INITIAL &&
+ ctx->acceptorName != GSS_C_NO_NAME) {
+
+ /* Send desired target name to acceptor */
+ major = gssEapDisplayName(minor, ctx->acceptorName,
+ outputToken, NULL);
+ if (GSS_ERROR(major))
+ return major;
+ } else if (inputToken != GSS_C_NO_BUFFER &&
+ ctx->acceptorName == GSS_C_NO_NAME) {
+ /* Accept target name hint from acceptor */
+ major = gssEapImportName(minor, inputToken,
+ GSS_C_NT_USER_NAME, &ctx->acceptorName);
+ if (GSS_ERROR(major))
+ return major;
+ }
+
+ /*
+ * Currently, other parts of the code assume that the acceptor name
+ * is available, hence this check.
+ */
+ if (ctx->acceptorName == GSS_C_NO_NAME) {
+ *minor = GSSEAP_NO_ACCEPTOR_NAME;
+ return GSS_S_FAILURE;
+ }
+
+ return GSS_S_CONTINUE_NEEDED;
+}
+
static OM_uint32
eapGssSmInitIdentity(OM_uint32 *minor,
- gss_cred_id_t cred,
+ gss_cred_id_t cred GSSEAP_UNUSED,
gss_ctx_id_t ctx,
- gss_name_t target,
- gss_OID mech,
- OM_uint32 reqFlags,
- OM_uint32 timeReq,
- gss_channel_bindings_t chanBindings,
- gss_buffer_t inputToken,
- gss_buffer_t outputToken,
- int *transitionState)
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+ gss_buffer_t inputToken GSSEAP_UNUSED,
+ gss_buffer_t outputToken GSSEAP_UNUSED,
+ OM_uint32 *smFlags)
{
- OM_uint32 major;
- int initialContextToken;
+ struct eap_config eapConfig;
+
+#ifdef GSSEAP_ENABLE_REAUTH
+ if (GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_REAUTHENTICATE) {
+ OM_uint32 tmpMinor;
+
+ /* server didn't support reauthentication, sent EAP request */
+ gssDeleteSecContext(&tmpMinor, &ctx->kerberosCtx, GSS_C_NO_BUFFER);
+ ctx->flags &= ~(CTX_FLAG_KRB_REAUTH);
+ GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);
+ } else
+#endif
+ *smFlags |= SM_FLAG_FORCE_SEND_TOKEN;
assert((ctx->flags & CTX_FLAG_KRB_REAUTH) == 0);
+ assert(inputToken == GSS_C_NO_BUFFER);
- initialContextToken = (inputToken->length == 0);
- if (!initialContextToken) {
- *minor = GSSEAP_WRONG_SIZE;
- return GSS_S_DEFECTIVE_TOKEN;
+ memset(&eapConfig, 0, sizeof(eapConfig));
+
+ ctx->initiatorCtx.eap = eap_peer_sm_init(ctx,
+ &gssEapPolicyCallbacks,
+ ctx,
+ &eapConfig);
+ if (ctx->initiatorCtx.eap == NULL) {
+ *minor = GSSEAP_PEER_SM_INIT_FAILURE;
+ return GSS_S_FAILURE;
}
- major = initBegin(minor, cred, ctx, target, mech,
- reqFlags, timeReq, chanBindings,
- inputToken);
- if (GSS_ERROR(major))
- return major;
+ ctx->flags |= CTX_FLAG_EAP_RESTART | CTX_FLAG_EAP_PORT_ENABLED;
+
+ /* poke EAP state machine */
+ if (eap_peer_sm_step(ctx->initiatorCtx.eap) != 0) {
+ *minor = GSSEAP_PEER_SM_STEP_FAILURE;
+ return GSS_S_FAILURE;
+ }
- outputToken->length = 0;
- outputToken->value = NULL;
+ GSSEAP_SM_TRANSITION_NEXT(ctx);
*minor = 0;
- *transitionState = 1;
- return GSS_S_COMPLETE;
+ return GSS_S_CONTINUE_NEEDED;
}
-static struct wpabuf emptyWpaBuffer;
-
static OM_uint32
eapGssSmInitAuthenticate(OM_uint32 *minor,
gss_cred_id_t cred,
gss_ctx_id_t ctx,
- gss_name_t target,
- gss_OID mech,
- OM_uint32 reqFlags,
- OM_uint32 timeReq,
- gss_channel_bindings_t chanBindings,
- gss_buffer_t inputToken,
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+ gss_buffer_t inputToken GSSEAP_UNUSED,
gss_buffer_t outputToken,
- int *transitionState)
+ OM_uint32 *smFlags)
{
OM_uint32 major;
OM_uint32 tmpMinor;
int code;
struct wpabuf *resp = NULL;
- int initialContextToken;
*minor = 0;
- initialContextToken = (inputToken == GSS_C_NO_BUFFER ||
- inputToken->length == 0);
+ assert(inputToken != GSS_C_NO_BUFFER);
major = peerConfigInit(minor, cred, ctx);
if (GSS_ERROR(major))
goto cleanup;
- if (ctx->initiatorCtx.eap == NULL) {
- struct eap_config eapConfig;
-
- memset(&eapConfig, 0, sizeof(eapConfig));
-
- ctx->initiatorCtx.eap = eap_peer_sm_init(ctx,
- &gssEapPolicyCallbacks,
- ctx,
- &eapConfig);
- if (ctx->initiatorCtx.eap == NULL) {
- major = GSS_S_FAILURE;
- *minor = GSSEAP_PEER_SM_INIT_FAILURE;
- goto cleanup;
- }
-
- ctx->flags |= CTX_FLAG_EAP_RESTART | CTX_FLAG_EAP_PORT_ENABLED;
- }
+ assert(ctx->initiatorCtx.eap != NULL);
+ assert(ctx->flags & CTX_FLAG_EAP_PORT_ENABLED);
ctx->flags |= CTX_FLAG_EAP_REQ; /* we have a Request from the acceptor */
- major = GSS_S_CONTINUE_NEEDED;
-
wpabuf_set(&ctx->initiatorCtx.reqData,
inputToken->value, inputToken->length);
+ major = GSS_S_CONTINUE_NEEDED;
+
code = eap_peer_sm_step(ctx->initiatorCtx.eap);
if (ctx->flags & CTX_FLAG_EAP_RESP) {
ctx->flags &= ~(CTX_FLAG_EAP_RESP);
goto cleanup;
ctx->flags &= ~(CTX_FLAG_EAP_SUCCESS);
- *transitionState = 1;
+ major = GSS_S_CONTINUE_NEEDED;
+ GSSEAP_SM_TRANSITION_NEXT(ctx);
} else if (ctx->flags & CTX_FLAG_EAP_FAIL) {
major = GSS_S_DEFECTIVE_CREDENTIAL;
*minor = GSSEAP_PEER_AUTH_FAILURE;
- } else if (code == 0 && initialContextToken) {
- /* */
} else {
major = GSS_S_DEFECTIVE_TOKEN;
*minor = GSSEAP_PEER_BAD_MESSAGE;
OM_uint32 tmpMajor;
gss_buffer_desc respBuf;
- assert(!GSS_ERROR(major));
+ assert(major == GSS_S_CONTINUE_NEEDED);
respBuf.length = wpabuf_len(resp);
respBuf.value = (void *)wpabuf_head(resp);
major = tmpMajor;
*minor = tmpMinor;
}
+
+ *smFlags |= SM_FLAG_OUTPUT_TOKEN_CRITICAL;
}
wpabuf_set(&ctx->initiatorCtx.reqData, NULL, 0);
static OM_uint32
eapGssSmInitGssChannelBindings(OM_uint32 *minor,
- gss_cred_id_t cred,
+ gss_cred_id_t cred GSSEAP_UNUSED,
gss_ctx_id_t ctx,
- gss_name_t target,
- gss_OID mech,
- OM_uint32 reqFlags,
- OM_uint32 timeReq,
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
gss_channel_bindings_t chanBindings,
- gss_buffer_t inputToken,
+ gss_buffer_t inputToken GSSEAP_UNUSED,
gss_buffer_t outputToken,
- int *transitionState)
+ OM_uint32 *smFlags)
{
OM_uint32 major;
gss_buffer_desc buffer = GSS_C_EMPTY_BUFFER;
assert(outputToken->value != NULL);
*minor = 0;
+ *smFlags |= SM_FLAG_OUTPUT_TOKEN_CRITICAL;
+
return GSS_S_CONTINUE_NEEDED;
}
eapGssSmInitReauthCreds(OM_uint32 *minor,
gss_cred_id_t cred,
gss_ctx_id_t ctx,
- gss_name_t target,
- gss_OID mech,
- OM_uint32 reqFlags,
- OM_uint32 timeReq,
- gss_channel_bindings_t chanBindings,
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
gss_buffer_t inputToken,
- gss_buffer_t outputToken,
- int *transitionState)
+ gss_buffer_t outputToken GSSEAP_UNUSED,
+ OM_uint32 *smFlags GSSEAP_UNUSED)
{
OM_uint32 major;
- major = gssEapStoreReauthCreds(minor, ctx, cred, inputToken);
- if (GSS_ERROR(major))
- return major;
+ if (ctx->gssFlags & GSS_C_MUTUAL_FLAG) {
+ major = gssEapStoreReauthCreds(minor, ctx, cred, inputToken);
+ if (GSS_ERROR(major))
+ return major;
+ }
*minor = 0;
return GSS_S_CONTINUE_NEEDED;
#endif /* GSSEAP_ENABLE_REAUTH */
static OM_uint32
-eapGssSmInitNegoExtFinished(OM_uint32 *minor,
- gss_cred_id_t cred,
- gss_ctx_id_t ctx,
- gss_name_t target,
- gss_OID mech,
- OM_uint32 reqFlags,
- OM_uint32 timeReq,
- gss_channel_bindings_t chanBindings,
- gss_buffer_t inputToken,
- gss_buffer_t outputToken,
- int *transitionState)
+eapGssSmInitCompleteInitiatorExts(OM_uint32 *minor,
+ gss_cred_id_t cred GSSEAP_UNUSED,
+ gss_ctx_id_t ctx,
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+ gss_buffer_t inputToken GSSEAP_UNUSED,
+ gss_buffer_t outputToken GSSEAP_UNUSED,
+ OM_uint32 *smFlags)
+{
+ GSSEAP_SM_TRANSITION_NEXT(ctx);
+
+ *minor = 0;
+ *smFlags |= SM_FLAG_FORCE_SEND_TOKEN;
+
+ return GSS_S_CONTINUE_NEEDED;
+}
+
+static OM_uint32
+eapGssSmInitCompleteAcceptorExts(OM_uint32 *minor,
+ gss_cred_id_t cred GSSEAP_UNUSED,
+ gss_ctx_id_t ctx,
+ gss_name_t target GSSEAP_UNUSED,
+ gss_OID mech GSSEAP_UNUSED,
+ OM_uint32 reqFlags GSSEAP_UNUSED,
+ OM_uint32 timeReq GSSEAP_UNUSED,
+ gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+ gss_buffer_t inputToken GSSEAP_UNUSED,
+ gss_buffer_t outputToken GSSEAP_UNUSED,
+ OM_uint32 *smFlags GSSEAP_UNUSED)
{
+ GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
+
*minor = 0;
- *transitionState = 1;
+
return GSS_S_COMPLETE;
}
{
ITOK_TYPE_CONTEXT_ERR,
ITOK_TYPE_NONE,
- GSSEAP_STATE_ALL,
- 1, /* critical */
- 0, /* required */
- eapGssSmInitError,
+ GSSEAP_STATE_ALL & ~(GSSEAP_STATE_INITIAL),
+ 0,
+ eapGssSmInitError
+ },
+ {
+ ITOK_TYPE_ACCEPTOR_NAME_RESP,
+ ITOK_TYPE_ACCEPTOR_NAME_REQ,
+ GSSEAP_STATE_INITIAL | GSSEAP_STATE_AUTHENTICATE,
+ 0,
+ eapGssSmInitAcceptorName
},
+#ifdef GSSEAP_DEBUG
+ {
+ ITOK_TYPE_NONE,
+ ITOK_TYPE_VENDOR_INFO,
+ GSSEAP_STATE_INITIAL,
+ 0,
+ eapGssSmInitVendorInfo
+ },
+#endif
#ifdef GSSEAP_ENABLE_REAUTH
{
ITOK_TYPE_REAUTH_RESP,
ITOK_TYPE_REAUTH_REQ,
- GSSEAP_STATE_INITIAL | GSSEAP_STATE_AUTHENTICATE,
- 0, /* critical */
- 0, /* required */
- eapGssSmInitGssReauth,
+ GSSEAP_STATE_INITIAL | GSSEAP_STATE_REAUTHENTICATE,
+ 0,
+ eapGssSmInitGssReauth
},
#endif
{
ITOK_TYPE_NONE,
ITOK_TYPE_NONE,
+#ifdef GSSEAP_ENABLE_REAUTH
+ GSSEAP_STATE_REAUTHENTICATE |
+#endif
GSSEAP_STATE_INITIAL,
- 1, /* critical */
- 1, /* required */
- eapGssSmInitIdentity,
+ SM_ITOK_FLAG_REQUIRED,
+ eapGssSmInitIdentity
},
{
ITOK_TYPE_EAP_REQ,
ITOK_TYPE_EAP_RESP,
GSSEAP_STATE_AUTHENTICATE,
- 1, /* critical */
- 1, /* required */
- eapGssSmInitAuthenticate,
+ SM_ITOK_FLAG_REQUIRED,
+ eapGssSmInitAuthenticate
},
{
ITOK_TYPE_NONE,
ITOK_TYPE_GSS_CHANNEL_BINDINGS,
- GSSEAP_STATE_NEGO_EXT,
- 1, /* critical */
- 1, /* required */
- eapGssSmInitGssChannelBindings,
+ GSSEAP_STATE_INITIATOR_EXTS,
+ SM_ITOK_FLAG_REQUIRED,
+ eapGssSmInitGssChannelBindings
+ },
+ {
+ ITOK_TYPE_NONE,
+ ITOK_TYPE_NONE,
+ GSSEAP_STATE_INITIATOR_EXTS,
+ 0,
+ eapGssSmInitCompleteInitiatorExts
},
#ifdef GSSEAP_ENABLE_REAUTH
{
ITOK_TYPE_REAUTH_CREDS,
ITOK_TYPE_NONE,
- GSSEAP_STATE_NEGO_EXT,
- 0, /* critical */
- 0, /* required */
- eapGssSmInitReauthCreds,
+ GSSEAP_STATE_ACCEPTOR_EXTS,
+ 0,
+ eapGssSmInitReauthCreds
},
#endif
/* other extensions go here */
{
ITOK_TYPE_NONE,
ITOK_TYPE_NONE,
- GSSEAP_STATE_NEGO_EXT,
- 1, /* critical */
- 1, /* required */
- eapGssSmInitNegoExtFinished
+ GSSEAP_STATE_ACCEPTOR_EXTS,
+ 0,
+ eapGssSmInitCompleteAcceptorExts
}
};
{
OM_uint32 major, tmpMinor;
gss_ctx_id_t ctx = *context_handle;
- int initialContextToken = 0;
*minor = 0;
ctx->flags |= CTX_FLAG_INITIATOR;
- initialContextToken = 1;
+ major = initBegin(minor, cred, ctx, target_name, mech_type,
+ req_flags, time_req, input_chan_bindings);
+ if (GSS_ERROR(major)) {
+ gssEapReleaseContext(minor, &ctx);
+ return major;
+ }
+
*context_handle = ctx;
}
if (time_rec != NULL)
gssEapContextTime(&tmpMinor, ctx, time_rec);
- assert(ctx->state == GSSEAP_STATE_ESTABLISHED || major == GSS_S_CONTINUE_NEEDED);
+ assert(CTX_IS_ESTABLISHED(ctx) || major == GSS_S_CONTINUE_NEEDED);
cleanup:
if (cred != GSS_C_NO_CREDENTIAL)
projects / mech_eap.orig / blobdiff