Look for mech_eap dependencies in

[mech_eap.git] / accept_sec_context.c

diff --git a/accept_sec_context.c b/accept_sec_context.c
index bfb6a70..d192d71 100644 (file)
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -74,7 +74,9 @@ acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
         ctx->gssFlags |= GSS_C_ANON_FLAG;
     }
 
-    major = gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
+    major = gssEapImportName(minor, &nameBuf,
+                             (ctx->gssFlags & GSS_C_ANON_FLAG) ?
+                                GSS_C_NT_ANONYMOUS : GSS_C_NT_USER_NAME,
                              &ctx->initiatorName);
     if (GSS_ERROR(major))
         return major;
@@ -130,10 +132,7 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
                        gss_buffer_t outputToken)
 {
     OM_uint32 major;
-    union {
-        struct eap_hdr pdu;
-        unsigned char data[5];
-    } pkt;
+    struct wpabuf *reqData;
     gss_buffer_desc pktBuffer;
 
     if (inputToken != GSS_C_NO_BUFFER && inputToken->length != 0) {
@@ -149,13 +148,15 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
             return major;
     }
 
-    pkt.pdu.code = EAP_CODE_REQUEST;
-    pkt.pdu.identifier = 0;
-    pkt.pdu.length = htons(sizeof(pkt.data));
-    pkt.data[4] = EAP_TYPE_IDENTITY;
+    reqData = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY, 0,
+                            EAP_CODE_REQUEST, 0);
+    if (reqData == NULL) {
+        *minor = ENOMEM;
+        return GSS_S_FAILURE;
+    }
 
-    pktBuffer.length = sizeof(pkt.data);
-    pktBuffer.value = pkt.data;
+    pktBuffer.length = wpabuf_len(reqData);
+    pktBuffer.value = (void *)wpabuf_head(reqData);
 
     major = duplicateBuffer(minor, &pktBuffer, outputToken);
     if (GSS_ERROR(major))
@@ -163,6 +164,8 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
 
     ctx->state = GSSEAP_STATE_AUTHENTICATE;
 
+    wpabuf_free(reqData);
+
     *minor = 0;
     return GSS_S_CONTINUE_NEEDED;
 }
@@ -181,13 +184,14 @@ isIdentityResponseP(gss_buffer_t inputToken)
 }
 
 /*
- * Pass the asserted initiator identity to the authentication server.
+ * Save the asserted initiator identity from the EAP identity response.
  */
 static OM_uint32
-setInitiatorIdentity(OM_uint32 *minor,
-                     gss_buffer_t inputToken,
-                     VALUE_PAIR **vps)
+importInitiatorIdentity(OM_uint32 *minor,
+                        gss_ctx_id_t ctx,
+                        gss_buffer_t inputToken)
 {
+    OM_uint32 tmpMinor;
     struct wpabuf respData;
     const unsigned char *pos;
     size_t len;
@@ -205,7 +209,43 @@ setInitiatorIdentity(OM_uint32 *minor,
     nameBuf.value = (void *)pos;
     nameBuf.length = len;
 
-    return gssEapRadiusAddAvp(minor, vps, PW_USER_NAME, 0, &nameBuf);
+    gssEapReleaseName(&tmpMinor, &ctx->initiatorName);
+
+    return gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
+                            &ctx->initiatorName);
+}
+
+/*
+ * Pass the asserted initiator identity to the authentication server.
+ */
+static OM_uint32
+setInitiatorIdentity(OM_uint32 *minor,
+                     gss_ctx_id_t ctx,
+                     VALUE_PAIR **vps)
+{
+    OM_uint32 major, tmpMinor;
+    gss_buffer_desc nameBuf;
+
+    /*
+     * We should have got an EAP identity response, but if we didn't, then
+     * we will just avoid sending User-Name. Note that radsecproxy requires
+     * User-Name to be sent on every request (presumably so it can remain
+     * stateless).
+     */
+    if (ctx->initiatorName != GSS_C_NO_NAME) {
+        major = gssEapDisplayName(minor, ctx->initiatorName, &nameBuf, NULL);
+        if (GSS_ERROR(major))
+            return major;
+
+        major = gssEapRadiusAddAvp(minor, vps, PW_USER_NAME, 0, &nameBuf);
+        if (GSS_ERROR(major))
+            return major;
+
+        gss_release_buffer(&tmpMinor, &nameBuf);
+    }
+
+    *minor = 0;
+    return GSS_S_COMPLETE;
 }
 
 /*
@@ -377,7 +417,6 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
     struct rs_request *request = NULL;
     struct rs_packet *req = NULL, *resp = NULL;
     struct radius_packet *frreq, *frresp;
-    int isIdentityResponse = isIdentityResponseP(inputToken);
 
     if (ctx->acceptorCtx.radContext == NULL) {
         /* May be NULL from an imported partial context */
@@ -386,6 +425,12 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
             goto cleanup;
     }
 
+    if (isIdentityResponseP(inputToken)) {
+        major = importInitiatorIdentity(minor, ctx, inputToken);
+        if (GSS_ERROR(major))
+            return major;
+    }
+
     rconn = ctx->acceptorCtx.radConn;
 
     if (rs_packet_create_authn_request(rconn, &req, NULL, NULL) != 0) {
@@ -394,15 +439,13 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
     }
     frreq = rs_packet_frpkt(req);
 
-    if (isIdentityResponse) {
-        major = setInitiatorIdentity(minor, inputToken, &frreq->vps);
-        if (GSS_ERROR(major))
-            goto cleanup;
+    major = setInitiatorIdentity(minor, ctx, &frreq->vps);
+    if (GSS_ERROR(major))
+        goto cleanup;
 
-        major = setAcceptorIdentity(minor, ctx, &frreq->vps);
-        if (GSS_ERROR(major))
-            goto cleanup;
-    }
+    major = setAcceptorIdentity(minor, ctx, &frreq->vps);
+    if (GSS_ERROR(major))
+        goto cleanup;
 
     major = gssEapRadiusAddAvp(minor, &frreq->vps,
                                PW_EAP_MESSAGE, 0, inputToken);
@@ -629,6 +672,9 @@ gss_accept_sec_context(OM_uint32 *minor,
     output_token->length = 0;
     output_token->value = NULL;
 
+    if (src_name != NULL)
+        *src_name = GSS_C_NO_NAME;
+
     if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) {
         *minor = GSSEAP_TOK_TRUNC;
         return GSS_S_DEFECTIVE_TOKEN;