If we can't make reauth creds, return GSS_S_UNAVAILABLE

[mech_eap.orig] / accept_sec_context.c

diff --git a/accept_sec_context.c b/accept_sec_context.c
index 60f9619..edd2a4d 100644 (file)
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -107,11 +107,10 @@ acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
     if (GSS_ERROR(major))
         return major;
 
-    ctx->initiatorName->attrCtx = gssEapCreateAttrContext(cred, ctx);
-    if (ctx->initiatorName->attrCtx == NULL) {
-        *minor = GSSEAP_ATTR_CONTEXT_FAILURE;
-        return GSS_S_FAILURE;
-    }
+    major = gssEapCreateAttrContext(minor, cred, ctx,
+                                    &ctx->initiatorName->attrCtx);
+    if (GSS_ERROR(major))
+        return major;
 
     *minor = 0;
     return GSS_S_COMPLETE;
@@ -161,7 +160,7 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
     if (GSS_ERROR(major))
         return major;
 
-    ctx->state = EAP_STATE_AUTHENTICATE;
+    ctx->state = GSSEAP_STATE_AUTHENTICATE;
 
     *minor = 0;
     return GSS_S_CONTINUE_NEEDED;
@@ -308,15 +307,12 @@ createRadiusHandle(OM_uint32 *minor,
         goto fail;
     }
 
-    /* XXX TODO rs_conn_select_server does not exist yet */
-#if 0
     if (actx->radServer != NULL) {
         if (rs_conn_select_server(actx->radConn, actx->radServer) != 0) {
             err = rs_err_conn_pop(actx->radConn);
             goto fail;
         }
     }
-#endif
 
     *minor = 0;
     return GSS_S_COMPLETE;
@@ -431,7 +427,7 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
         if (GSS_ERROR(major))
             goto cleanup;
 
-        ctx->state = EAP_STATE_EXTENSIONS_REQ;
+        ctx->state = GSSEAP_STATE_EXTENSIONS_REQ;
     }
 
     *minor = 0;
@@ -460,7 +456,7 @@ eapGssSmAcceptExtensionsReq(OM_uint32 *minor,
     outputToken->length = 0;
     outputToken->value = NULL;
 
-    ctx->state = EAP_STATE_EXTENSIONS_RESP;
+    ctx->state = GSSEAP_STATE_EXTENSIONS_RESP;
 
     *minor = 0;
     return GSS_S_CONTINUE_NEEDED;
@@ -480,7 +476,7 @@ eapGssSmAcceptExtensionsResp(OM_uint32 *minor,
     if (GSS_ERROR(major))
         return major;
 
-    ctx->state = EAP_STATE_ESTABLISHED;
+    ctx->state = GSSEAP_STATE_ESTABLISHED;
 
     *minor = 0;
     return GSS_S_COMPLETE;
@@ -532,7 +528,7 @@ makeErrorToken(OM_uint32 *minor,
     default:
         if (IS_RADIUS_ERROR(minorStatus))
             /* Squash RADIUS error codes */
-            minorStatus = GSSEAP_GENERIC_RADIUS_ERROR;
+            minorStatus = GSSEAP_RADIUS_PROT_FAILURE;
         else
             /* Don't return system error codes */
             return GSS_S_COMPLETE;
@@ -645,7 +641,7 @@ gss_accept_sec_context(OM_uint32 *minor,
      * machine and process Kerberos GSS messages instead.
      */
     if (tokType == TOK_TYPE_GSS_REAUTH && initialContextToken) {
-        ctx->state = EAP_STATE_KRB_REAUTH_GSS;
+        ctx->state = GSSEAP_STATE_KRB_REAUTH;
     } else
 #endif
     if (tokType != sm->inputTokenType) {
@@ -671,7 +667,7 @@ gss_accept_sec_context(OM_uint32 *minor,
                 goto cleanup;
             }
 
-            sm = &eapGssAcceptorSm[EAP_STATE_ERROR];
+            sm = &eapGssAcceptorSm[GSSEAP_STATE_ERROR];
             goto send_token;
         }
     } while (major == GSS_S_CONTINUE_NEEDED && innerOutputToken.length == 0);
@@ -698,7 +694,7 @@ gss_accept_sec_context(OM_uint32 *minor,
         }
     }
 
-    assert(ctx->state == EAP_STATE_ESTABLISHED || major == GSS_S_CONTINUE_NEEDED);
+    assert(ctx->state == GSSEAP_STATE_ESTABLISHED || major == GSS_S_CONTINUE_NEEDED);
 
 send_token:
     if (innerOutputToken.value != NULL) {
@@ -749,7 +745,7 @@ acceptReadyKrb(OM_uint32 *minor,
     if (GSS_ERROR(major))
         return major;
 
-    ctx->state = EAP_STATE_ESTABLISHED;
+    ctx->state = GSSEAP_STATE_ESTABLISHED;
 
     *minor = 0;
     return GSS_S_COMPLETE;
@@ -769,7 +765,7 @@ eapGssSmAcceptGssReauth(OM_uint32 *minor,
     gss_OID mech = GSS_C_NO_OID;
     OM_uint32 gssFlags, timeRec = GSS_C_INDEFINITE;
 
-    ctx->flags |= CTX_FLAG_KRB_REAUTH_GSS;
+    ctx->flags |= CTX_FLAG_KRB_REAUTH;
 
     if (cred != GSS_C_NO_CREDENTIAL)
         krbCred = cred->krbCred;