check for non-NULL before calling pairbasicfree()

[mech_eap.orig] / accept_sec_context.c

diff --git a/accept_sec_context.c b/accept_sec_context.c
index 6d65647..129fd64 100644 (file)
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -48,7 +48,8 @@ eapGssSmAcceptGssReauth(OM_uint32 *minor,
                         OM_uint32 timeReq __attribute__((__unused__)),
                         gss_channel_bindings_t chanBindings,
                         gss_buffer_t inputToken,
-                        gss_buffer_t outputToken);
+                        gss_buffer_t outputToken,
+                        OM_uint32 *smFlags);
 #endif
 
 /*
@@ -123,6 +124,28 @@ acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
     return GSS_S_COMPLETE;
 }
 
+#ifdef GSSEAP_DEBUG
+static OM_uint32
+eapGssSmAcceptVendorInfo(OM_uint32 *minor,
+                         gss_cred_id_t cred,
+                         gss_ctx_id_t ctx,
+                         gss_name_t target,
+                         gss_OID mech,
+                         OM_uint32 reqFlags,
+                         OM_uint32 timeReq,
+                         gss_channel_bindings_t chanBindings,
+                         gss_buffer_t inputToken,
+                         gss_buffer_t outputToken,
+                         OM_uint32 *smFlags)
+{
+    fprintf(stderr, "GSS-EAP: vendor %.*s\n",
+            (int)inputToken->length, (char *)inputToken->value);
+
+    return GSS_S_CONTINUE_NEEDED;
+}
+#endif
+
+
 /*
  * Emit a identity EAP request to force the initiator (peer) to identify
  * itself.
@@ -137,7 +160,8 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
                        OM_uint32 timeReq __attribute__((__unused__)),
                        gss_channel_bindings_t chanBindings __attribute__((__unused__)),
                        gss_buffer_t inputToken,
-                       gss_buffer_t outputToken)
+                       gss_buffer_t outputToken,
+                       OM_uint32 *smFlags)
 {
     OM_uint32 major;
     struct wpabuf *reqData;
@@ -177,8 +201,11 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
 
     wpabuf_free(reqData);
 
+    GSSEAP_SM_TRANSITION_NEXT(ctx);
+
     *minor = 0;
-    return GSS_S_COMPLETE; /* advance state */
+
+    return GSS_S_CONTINUE_NEEDED;
 }
 
 /*
@@ -425,7 +452,8 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
                            OM_uint32 timeReq __attribute__((__unused__)),
                            gss_channel_bindings_t chanBindings,
                            gss_buffer_t inputToken,
-                           gss_buffer_t outputToken)
+                           gss_buffer_t outputToken,
+                           OM_uint32 *smFlags)
 {
     OM_uint32 major, tmpMinor;
     struct rs_connection *rconn;
@@ -522,8 +550,6 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
                                    &ctx->acceptorCtx.state, TRUE);
         if (GSS_ERROR(major) && *minor != GSSEAP_NO_SUCH_ATTR)
             goto cleanup;
-
-        major = GSS_S_CONTINUE_NEEDED;
     } else {
         ctx->acceptorCtx.vps = frresp->vps;
         frresp->vps = NULL;
@@ -535,9 +561,12 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
         if (GSS_ERROR(major))
             goto cleanup;
 
-        major = GSS_S_COMPLETE; /* advance state */
+        GSSEAP_SM_TRANSITION_NEXT(ctx);
     }
 
+    major = GSS_S_CONTINUE_NEEDED;
+    *minor = 0;
+
 cleanup:
     if (request != NULL)
         rs_request_destroy(request);
@@ -557,7 +586,8 @@ eapGssSmAcceptGssChannelBindings(OM_uint32 *minor,
                                  OM_uint32 timeReq __attribute__((__unused__)),
                                  gss_channel_bindings_t chanBindings,
                                  gss_buffer_t inputToken,
-                                 gss_buffer_t outputToken)
+                                 gss_buffer_t outputToken,
+                                 OM_uint32 *smFlags)
 {
     OM_uint32 major, tmpMinor;
     gss_iov_buffer_desc iov[2];
@@ -579,7 +609,7 @@ eapGssSmAcceptGssChannelBindings(OM_uint32 *minor,
         major = GSS_S_BAD_BINDINGS;
         *minor = GSSEAP_BINDINGS_MISMATCH;
     } else {
-        major = GSS_S_CONTINUE_NEEDED; /* process additional extensions */
+        major = GSS_S_CONTINUE_NEEDED;
         *minor = 0;
     }
 
@@ -599,7 +629,8 @@ eapGssSmAcceptReauthCreds(OM_uint32 *minor,
                           OM_uint32 timeReq __attribute__((__unused__)),
                           gss_channel_bindings_t chanBindings __attribute__((__unused__)),
                           gss_buffer_t inputToken,
-                          gss_buffer_t outputToken)
+                          gss_buffer_t outputToken,
+                          OM_uint32 *smFlags)
 {
     OM_uint32 major;
 
@@ -608,38 +639,72 @@ eapGssSmAcceptReauthCreds(OM_uint32 *minor,
      * fabricate a ticket from the initiator to ourselves.
      */
     major = gssEapMakeReauthCreds(minor, ctx, cred, outputToken);
-    if (GSS_ERROR(major))
-        return major;
+    if (major == GSS_S_UNAVAILABLE)
+        major = GSS_S_COMPLETE;
+    if (major == GSS_S_COMPLETE)
+        major = GSS_S_CONTINUE_NEEDED;
 
-    *minor = 0;
-    return GSS_S_CONTINUE_NEEDED; /* process additional extensions */
+    return major;
 }
 #endif
 
 static OM_uint32
-eapGssSmAcceptNegoExtFinished(OM_uint32 *minor,
-                              gss_cred_id_t cred,
-                              gss_ctx_id_t ctx,
-                              gss_name_t target __attribute__((__unused__)),
-                              gss_OID mech __attribute__((__unused__)),
-                              OM_uint32 reqFlags __attribute__((__unused__)),
-                              OM_uint32 timeReq __attribute__((__unused__)),
-                              gss_channel_bindings_t chanBindings __attribute__((__unused__)),
-                              gss_buffer_t inputToken,
-                              gss_buffer_t outputToken)
+eapGssSmAcceptCompleteInitiatorExts(OM_uint32 *minor,
+                                    gss_cred_id_t cred,
+                                    gss_ctx_id_t ctx,
+                                    gss_name_t target,
+                                    gss_OID mech,
+                                    OM_uint32 reqFlags,
+                                    OM_uint32 timeReq,
+                                    gss_channel_bindings_t chanBindings,
+                                    gss_buffer_t inputToken,
+                                    gss_buffer_t outputToken,
+                                    OM_uint32 *smFlags)
 {
+    GSSEAP_SM_TRANSITION_NEXT(ctx);
+
     *minor = 0;
-    return GSS_S_COMPLETE; /* advance state */
+
+    return GSS_S_CONTINUE_NEEDED;
+}
+
+static OM_uint32
+eapGssSmAcceptCompleteAcceptorExts(OM_uint32 *minor,
+                                   gss_cred_id_t cred,
+                                   gss_ctx_id_t ctx,
+                                   gss_name_t target,
+                                   gss_OID mech,
+                                   OM_uint32 reqFlags,
+                                   OM_uint32 timeReq,
+                                   gss_channel_bindings_t chanBindings,
+                                   gss_buffer_t inputToken,
+                                   gss_buffer_t outputToken,
+                                   OM_uint32 *smFlags)
+{
+    GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
+
+    *minor = 0;
+    *smFlags |= SM_FLAG_FORCE_SEND_TOKEN;
+
+    return GSS_S_COMPLETE;
 }
 
 static struct gss_eap_sm eapGssAcceptorSm[] = {
+#ifdef GSSEAP_DEBUG
+    {
+        ITOK_TYPE_VENDOR_INFO,
+        ITOK_TYPE_NONE,
+        GSSEAP_STATE_INITIAL,
+        0,
+        eapGssSmAcceptVendorInfo,
+    },
+#endif
 #ifdef GSSEAP_ENABLE_REAUTH
     {
         ITOK_TYPE_REAUTH_REQ,
         ITOK_TYPE_REAUTH_RESP,
         GSSEAP_STATE_INITIAL,
-        0, /* critical */
-        0, /* required */
+        0,
         eapGssSmAcceptGssReauth,
     },
 #endif
@@ -647,41 +712,45 @@ static struct gss_eap_sm eapGssAcceptorSm[] = {
         ITOK_TYPE_NONE,
         ITOK_TYPE_EAP_REQ,
         GSSEAP_STATE_INITIAL,
-        1, /* critical */
-        1, /* required */
+        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
         eapGssSmAcceptIdentity,
     },
     {
         ITOK_TYPE_EAP_RESP,
         ITOK_TYPE_EAP_REQ,
         GSSEAP_STATE_AUTHENTICATE,
-        1, /* critical */
-        1, /* required */
+        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
         eapGssSmAcceptAuthenticate
     },
     {
         ITOK_TYPE_GSS_CHANNEL_BINDINGS,
         ITOK_TYPE_NONE,
-        GSSEAP_STATE_NEGO_EXT,
-        1, /* critical */
-        1, /* required */
+        GSSEAP_STATE_INITIATOR_EXTS,
+        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
         eapGssSmAcceptGssChannelBindings,
     },
     {
         ITOK_TYPE_NONE,
+        ITOK_TYPE_NONE,
+        GSSEAP_STATE_INITIATOR_EXTS,
+        0,
+        eapGssSmAcceptCompleteInitiatorExts,
+    },
+#ifdef GSSEAP_ENABLE_REAUTH
+    {
+        ITOK_TYPE_NONE,
         ITOK_TYPE_REAUTH_CREDS,
-        GSSEAP_STATE_NEGO_EXT,
-        0, /* critical */
-        0, /* required */
+        GSSEAP_STATE_ACCEPTOR_EXTS,
+        0,
         eapGssSmAcceptReauthCreds,
     },
+#endif
     {
         ITOK_TYPE_NONE,
         ITOK_TYPE_NONE,
-        GSSEAP_STATE_NEGO_EXT,
-        1, /* critical */
-        1, /* required */
-        eapGssSmAcceptNegoExtFinished
+        GSSEAP_STATE_ACCEPTOR_EXTS,
+        0,
+        eapGssSmAcceptCompleteAcceptorExts
     },
 };
 
@@ -819,10 +888,8 @@ acceptReadyKrb(OM_uint32 *minor,
     if (GSS_ERROR(major))
         return major;
 
-    ctx->state = GSSEAP_STATE_NEGO_EXT; /* skip */
-
     *minor = 0;
-    return GSS_S_COMPLETE; /* advance state */
+    return GSS_S_COMPLETE;
 }
 
 static OM_uint32
@@ -835,7 +902,8 @@ eapGssSmAcceptGssReauth(OM_uint32 *minor,
                         OM_uint32 timeReq __attribute__((__unused__)),
                         gss_channel_bindings_t chanBindings,
                         gss_buffer_t inputToken,
-                        gss_buffer_t outputToken)
+                        gss_buffer_t outputToken,
+                        OM_uint32 *smFlags)
 {
     OM_uint32 major, tmpMinor;
     gss_name_t krbInitiator = GSS_C_NO_NAME;
@@ -864,6 +932,9 @@ eapGssSmAcceptGssReauth(OM_uint32 *minor,
     if (major == GSS_S_COMPLETE) {
         major = acceptReadyKrb(minor, ctx, cred,
                                krbInitiator, mech, timeRec);
+        if (major == GSS_S_COMPLETE) {
+            GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
+        }
     }
 
     ctx->gssFlags = gssFlags;