Some additional README notes

[mech_eap.orig] / accept_sec_context.c

diff --git a/accept_sec_context.c b/accept_sec_context.c
index b3a56c6..f686a3c 100644 (file)
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -74,7 +74,9 @@ acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
         ctx->gssFlags |= GSS_C_ANON_FLAG;
     }
 
-    major = gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
+    major = gssEapImportName(minor, &nameBuf,
+                             (ctx->gssFlags & GSS_C_ANON_FLAG) ?
+                                GSS_C_NT_ANONYMOUS : GSS_C_NT_USER_NAME,
                              &ctx->initiatorName);
     if (GSS_ERROR(major))
         return major;
@@ -130,10 +132,7 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
                        gss_buffer_t outputToken)
 {
     OM_uint32 major;
-    union {
-        struct eap_hdr pdu;
-        unsigned char data[5];
-    } pkt;
+    struct wpabuf *reqData;
     gss_buffer_desc pktBuffer;
 
     if (inputToken != GSS_C_NO_BUFFER && inputToken->length != 0) {
@@ -149,13 +148,15 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
             return major;
     }
 
-    pkt.pdu.code = EAP_CODE_REQUEST;
-    pkt.pdu.identifier = 0;
-    pkt.pdu.length = htons(sizeof(pkt.data));
-    pkt.data[4] = EAP_TYPE_IDENTITY;
+    reqData = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY, 0,
+                            EAP_CODE_REQUEST, 0);
+    if (reqData == NULL) {
+        *minor = ENOMEM;
+        return GSS_S_FAILURE;
+    }
 
-    pktBuffer.length = sizeof(pkt.data);
-    pktBuffer.value = pkt.data;
+    pktBuffer.length = wpabuf_len(reqData);
+    pktBuffer.value = (void *)wpabuf_head(reqData);
 
     major = duplicateBuffer(minor, &pktBuffer, outputToken);
     if (GSS_ERROR(major))
@@ -163,11 +164,54 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
 
     ctx->state = GSSEAP_STATE_AUTHENTICATE;
 
+    wpabuf_free(reqData);
+
     *minor = 0;
     return GSS_S_CONTINUE_NEEDED;
 }
 
 /*
+ * Returns TRUE if the input token contains an EAP identity response.
+ */
+static int
+isIdentityResponseP(gss_buffer_t inputToken)
+{
+    struct wpabuf respData;
+
+    wpabuf_set(&respData, inputToken->value, inputToken->length);
+
+    return (eap_get_type(&respData) == EAP_TYPE_IDENTITY);
+}
+
+/*
+ * Pass the asserted initiator identity to the authentication server.
+ */
+static OM_uint32
+setInitiatorIdentity(OM_uint32 *minor,
+                     gss_buffer_t inputToken,
+                     VALUE_PAIR **vps)
+{
+    struct wpabuf respData;
+    const unsigned char *pos;
+    size_t len;
+    gss_buffer_desc nameBuf;
+
+    wpabuf_set(&respData, inputToken->value, inputToken->length);
+
+    pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY,
+                           &respData, &len);
+    if (pos == NULL) {
+        *minor = GSSEAP_PEER_BAD_MESSAGE;
+        return GSS_S_DEFECTIVE_TOKEN;
+    }
+
+    nameBuf.value = (void *)pos;
+    nameBuf.length = len;
+
+    return gssEapRadiusAddAvp(minor, vps, PW_USER_NAME, 0, &nameBuf);
+}
+
+/*
  * Pass the asserted acceptor identity to the authentication server.
  */
 static OM_uint32
@@ -307,7 +351,7 @@ createRadiusHandle(OM_uint32 *minor,
     }
 
     if (actx->radServer != NULL) {
-        if (rs_conn_select_server(actx->radConn, actx->radServer) != 0) {
+        if (rs_conn_select_peer(actx->radConn, actx->radServer) != 0) {
             err = rs_err_conn_pop(actx->radConn);
             goto fail;
         }
@@ -336,26 +380,28 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
     struct rs_request *request = NULL;
     struct rs_packet *req = NULL, *resp = NULL;
     struct radius_packet *frreq, *frresp;
-    int sendAcceptorIdentity = 0;
+    int isIdentityResponse = isIdentityResponseP(inputToken);
 
     if (ctx->acceptorCtx.radContext == NULL) {
         /* May be NULL from an imported partial context */
         major = createRadiusHandle(minor, cred, ctx);
         if (GSS_ERROR(major))
             goto cleanup;
-
-        sendAcceptorIdentity = 1;
     }
 
     rconn = ctx->acceptorCtx.radConn;
 
-    if (rs_packet_create_auth_request(rconn, &req, NULL, NULL) != 0) {
+    if (rs_packet_create_authn_request(rconn, &req, NULL, NULL) != 0) {
         major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
         goto cleanup;
     }
     frreq = rs_packet_frpkt(req);
 
-    if (sendAcceptorIdentity) {
+    if (isIdentityResponse) {
+        major = setInitiatorIdentity(minor, inputToken, &frreq->vps);
+        if (GSS_ERROR(major))
+            goto cleanup;
+
         major = setAcceptorIdentity(minor, ctx, &frreq->vps);
         if (GSS_ERROR(major))
             goto cleanup;
@@ -375,8 +421,15 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
         gss_release_buffer(&tmpMinor, &ctx->acceptorCtx.state);
     }
 
-    if (rs_request_create(rconn, &request) != 0 ||
-        rs_request_send(request, req, &resp) != 0) {
+    if (rs_request_create(rconn, &request) != 0) {
+        major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
+        goto cleanup;
+    }
+
+    rs_request_add_reqpkt(request, req);
+    req = NULL;
+
+    if (rs_request_send(request, &resp) != 0) {
         major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
         goto cleanup;
     }
@@ -433,7 +486,10 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
     major = GSS_S_CONTINUE_NEEDED;
 
 cleanup:
-    rs_request_destroy(request);
+    if (request != NULL)
+        rs_request_destroy(request);
+    if (req != NULL)
+        rs_packet_destroy(req);
 
     return major;
 }
@@ -576,6 +632,9 @@ gss_accept_sec_context(OM_uint32 *minor,
     output_token->length = 0;
     output_token->value = NULL;
 
+    if (src_name != NULL)
+        *src_name = GSS_C_NO_NAME;
+
     if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) {
         *minor = GSSEAP_TOK_TRUNC;
         return GSS_S_DEFECTIVE_TOKEN;