Sent @REALM in EAP identity response

[mech_eap.orig] / accept_sec_context.c

diff --git a/accept_sec_context.c b/accept_sec_context.c
index 4d92c80..f686a3c 100644 (file)
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -74,7 +74,9 @@ acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
         ctx->gssFlags |= GSS_C_ANON_FLAG;
     }
 
-    major = gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
+    major = gssEapImportName(minor, &nameBuf,
+                             (ctx->gssFlags & GSS_C_ANON_FLAG) ?
+                                GSS_C_NT_ANONYMOUS : GSS_C_NT_USER_NAME,
                              &ctx->initiatorName);
     if (GSS_ERROR(major))
         return major;
@@ -130,10 +132,7 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
                        gss_buffer_t outputToken)
 {
     OM_uint32 major;
-    union {
-        struct eap_hdr pdu;
-        unsigned char data[5];
-    } pkt;
+    struct wpabuf *reqData;
     gss_buffer_desc pktBuffer;
 
     if (inputToken != GSS_C_NO_BUFFER && inputToken->length != 0) {
@@ -149,13 +148,15 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
             return major;
     }
 
-    pkt.pdu.code = EAP_CODE_REQUEST;
-    pkt.pdu.identifier = 0;
-    pkt.pdu.length = htons(sizeof(pkt.data));
-    pkt.data[4] = EAP_TYPE_IDENTITY;
+    reqData = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY, 0,
+                            EAP_CODE_REQUEST, 0);
+    if (reqData == NULL) {
+        *minor = ENOMEM;
+        return GSS_S_FAILURE;
+    }
 
-    pktBuffer.length = sizeof(pkt.data);
-    pktBuffer.value = pkt.data;
+    pktBuffer.length = wpabuf_len(reqData);
+    pktBuffer.value = (void *)wpabuf_head(reqData);
 
     major = duplicateBuffer(minor, &pktBuffer, outputToken);
     if (GSS_ERROR(major))
@@ -163,11 +164,54 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
 
     ctx->state = GSSEAP_STATE_AUTHENTICATE;
 
+    wpabuf_free(reqData);
+
     *minor = 0;
     return GSS_S_CONTINUE_NEEDED;
 }
 
 /*
+ * Returns TRUE if the input token contains an EAP identity response.
+ */
+static int
+isIdentityResponseP(gss_buffer_t inputToken)
+{
+    struct wpabuf respData;
+
+    wpabuf_set(&respData, inputToken->value, inputToken->length);
+
+    return (eap_get_type(&respData) == EAP_TYPE_IDENTITY);
+}
+
+/*
+ * Pass the asserted initiator identity to the authentication server.
+ */
+static OM_uint32
+setInitiatorIdentity(OM_uint32 *minor,
+                     gss_buffer_t inputToken,
+                     VALUE_PAIR **vps)
+{
+    struct wpabuf respData;
+    const unsigned char *pos;
+    size_t len;
+    gss_buffer_desc nameBuf;
+
+    wpabuf_set(&respData, inputToken->value, inputToken->length);
+
+    pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_IDENTITY,
+                           &respData, &len);
+    if (pos == NULL) {
+        *minor = GSSEAP_PEER_BAD_MESSAGE;
+        return GSS_S_DEFECTIVE_TOKEN;
+    }
+
+    nameBuf.value = (void *)pos;
+    nameBuf.length = len;
+
+    return gssEapRadiusAddAvp(minor, vps, PW_USER_NAME, 0, &nameBuf);
+}
+
+/*
  * Pass the asserted acceptor identity to the authentication server.
  */
 static OM_uint32
@@ -336,15 +380,13 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
     struct rs_request *request = NULL;
     struct rs_packet *req = NULL, *resp = NULL;
     struct radius_packet *frreq, *frresp;
-    int sendAcceptorIdentity = 0;
+    int isIdentityResponse = isIdentityResponseP(inputToken);
 
     if (ctx->acceptorCtx.radContext == NULL) {
         /* May be NULL from an imported partial context */
         major = createRadiusHandle(minor, cred, ctx);
         if (GSS_ERROR(major))
             goto cleanup;
-
-        sendAcceptorIdentity = 1;
     }
 
     rconn = ctx->acceptorCtx.radConn;
@@ -355,7 +397,11 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
     }
     frreq = rs_packet_frpkt(req);
 
-    if (sendAcceptorIdentity) {
+    if (isIdentityResponse) {
+        major = setInitiatorIdentity(minor, inputToken, &frreq->vps);
+        if (GSS_ERROR(major))
+            goto cleanup;
+
         major = setAcceptorIdentity(minor, ctx, &frreq->vps);
         if (GSS_ERROR(major))
             goto cleanup;
@@ -381,6 +427,7 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
     }
 
     rs_request_add_reqpkt(request, req);
+    req = NULL;
 
     if (rs_request_send(request, &resp) != 0) {
         major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
@@ -441,6 +488,8 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
 cleanup:
     if (request != NULL)
         rs_request_destroy(request);
+    if (req != NULL)
+        rs_packet_destroy(req);
 
     return major;
 }
@@ -583,6 +632,9 @@ gss_accept_sec_context(OM_uint32 *minor,
     output_token->length = 0;
     output_token->value = NULL;
 
+    if (src_name != NULL)
+        *src_name = GSS_C_NO_NAME;
+
     if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) {
         *minor = GSSEAP_TOK_TRUNC;
         return GSS_S_DEFECTIVE_TOKEN;