make inputs to gssEapImportName const

[mech_eap.orig] / init_sec_context.c

diff --git a/init_sec_context.c b/init_sec_context.c
index a9dadda..a731833 100644 (file)
--- a/init_sec_context.c
+++ b/init_sec_context.c
@@ -161,18 +161,20 @@ peerGetEapReqData(void *ctx)
 }
 
 static void
-peerSetConfigBlob(void *ctx, struct wpa_config_blob *blob)
+peerSetConfigBlob(void *ctx GSSEAP_UNUSED,
+                  struct wpa_config_blob *blob GSSEAP_UNUSED)
 {
 }
 
 static const struct wpa_config_blob *
-peerGetConfigBlob(void *ctx, const char *name)
+peerGetConfigBlob(void *ctx GSSEAP_UNUSED,
+                  const char *name GSSEAP_UNUSED)
 {
     return NULL;
 }
 
 static void
-peerNotifyPending(void *ctx)
+peerNotifyPending(void *ctx GSSEAP_UNUSED)
 {
 }
 
@@ -324,9 +326,9 @@ initBegin(OM_uint32 *minor,
           gss_ctx_id_t ctx,
           gss_name_t target,
           gss_OID mech,
-          OM_uint32 reqFlags,
+          OM_uint32 reqFlags GSSEAP_UNUSED,
           OM_uint32 timeReq,
-          gss_channel_bindings_t chanBindings)
+          gss_channel_bindings_t chanBindings GSSEAP_UNUSED)
 {
     OM_uint32 major;
 
@@ -360,15 +362,10 @@ initBegin(OM_uint32 *minor,
         GSSEAP_MUTEX_UNLOCK(&target->mutex);
     }
 
-    if (mech == GSS_C_NULL_OID) {
-        major = gssEapDefaultMech(minor, &ctx->mechanismUsed);
-    } else if (gssEapIsConcreteMechanismOid(mech)) {
-        if (!gssEapInternalizeOid(mech, &ctx->mechanismUsed))
-            major = duplicateOid(minor, mech, &ctx->mechanismUsed);
-    } else {
-        major = GSS_S_BAD_MECH;
-        *minor = GSSEAP_WRONG_MECH;
-    }
+    major = gssEapCanonicalizeOid(minor,
+                                  mech,
+                                  OID_FLAG_NULL_VALID | OID_FLAG_MAP_NULL_TO_DEFAULT_MECH,
+                                  &ctx->mechanismUsed);
     if (GSS_ERROR(major))
         return major;
 
@@ -384,16 +381,16 @@ initBegin(OM_uint32 *minor,
 
 static OM_uint32
 eapGssSmInitError(OM_uint32 *minor,
-                  gss_cred_id_t cred,
-                  gss_ctx_id_t ctx,
-                  gss_name_t target,
-                  gss_OID mech,
-                  OM_uint32 reqFlags,
-                  OM_uint32 timeReq,
-                  gss_channel_bindings_t chanBindings,
+                  gss_cred_id_t cred GSSEAP_UNUSED,
+                  gss_ctx_id_t ctx GSSEAP_UNUSED,
+                  gss_name_t target GSSEAP_UNUSED,
+                  gss_OID mech GSSEAP_UNUSED,
+                  OM_uint32 reqFlags GSSEAP_UNUSED,
+                  OM_uint32 timeReq GSSEAP_UNUSED,
+                  gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
                   gss_buffer_t inputToken,
-                  gss_buffer_t outputToken,
-                  OM_uint32 *smFlags)
+                  gss_buffer_t outputToken GSSEAP_UNUSED,
+                  OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     OM_uint32 major;
     unsigned char *p;
@@ -424,13 +421,13 @@ eapGssSmInitGssReauth(OM_uint32 *minor,
                       gss_cred_id_t cred,
                       gss_ctx_id_t ctx,
                       gss_name_t target,
-                      gss_OID mech,
+                      gss_OID mech GSSEAP_UNUSED,
                       OM_uint32 reqFlags,
                       OM_uint32 timeReq,
                       gss_channel_bindings_t chanBindings,
                       gss_buffer_t inputToken,
                       gss_buffer_t outputToken,
-                      OM_uint32 *smFlags)
+                      OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     OM_uint32 major, tmpMinor;
     gss_name_t mechTarget = GSS_C_NO_NAME;
@@ -459,7 +456,7 @@ eapGssSmInitGssReauth(OM_uint32 *minor,
                               &ctx->kerberosCtx,
                               mechTarget,
                               (gss_OID)gss_mech_krb5,
-                              reqFlags,
+                              reqFlags | GSS_C_MUTUAL_FLAG,
                               timeReq,
                               chanBindings,
                               inputToken,
@@ -473,6 +470,8 @@ eapGssSmInitGssReauth(OM_uint32 *minor,
     ctx->gssFlags = gssFlags;
 
     if (major == GSS_S_COMPLETE) {
+        assert(GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_REAUTHENTICATE);
+
         major = gssEapReauthComplete(minor, ctx, cred, actualMech, timeRec);
         if (GSS_ERROR(major))
             goto cleanup;
@@ -491,16 +490,16 @@ cleanup:
 #ifdef GSSEAP_DEBUG
 static OM_uint32
 eapGssSmInitVendorInfo(OM_uint32 *minor,
-                       gss_cred_id_t cred,
-                       gss_ctx_id_t ctx,
-                       gss_name_t target,
-                       gss_OID mech,
-                       OM_uint32 reqFlags,
-                       OM_uint32 timeReq,
-                       gss_channel_bindings_t chanBindings,
-                       gss_buffer_t inputToken,
+                       gss_cred_id_t cred GSSEAP_UNUSED,
+                       gss_ctx_id_t ctx GSSEAP_UNUSED,
+                       gss_name_t target GSSEAP_UNUSED,
+                       gss_OID mech GSSEAP_UNUSED,
+                       OM_uint32 reqFlags GSSEAP_UNUSED,
+                       OM_uint32 timeReq GSSEAP_UNUSED,
+                       gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                       gss_buffer_t inputToken GSSEAP_UNUSED,
                        gss_buffer_t outputToken,
-                       OM_uint32 *smFlags)
+                       OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     OM_uint32 major;
 
@@ -514,16 +513,16 @@ eapGssSmInitVendorInfo(OM_uint32 *minor,
 
 static OM_uint32
 eapGssSmInitAcceptorName(OM_uint32 *minor,
-                         gss_cred_id_t cred,
+                         gss_cred_id_t cred GSSEAP_UNUSED,
                          gss_ctx_id_t ctx,
-                         gss_name_t target,
-                         gss_OID mech,
-                         OM_uint32 reqFlags,
-                         OM_uint32 timeReq,
-                         gss_channel_bindings_t chanBindings,
-                         gss_buffer_t inputToken,
+                         gss_name_t target GSSEAP_UNUSED,
+                         gss_OID mech GSSEAP_UNUSED,
+                         OM_uint32 reqFlags GSSEAP_UNUSED,
+                         OM_uint32 timeReq GSSEAP_UNUSED,
+                         gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                         gss_buffer_t inputToken GSSEAP_UNUSED,
                          gss_buffer_t outputToken,
-                         OM_uint32 *smFlags)
+                         OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     OM_uint32 major;
 
@@ -539,7 +538,9 @@ eapGssSmInitAcceptorName(OM_uint32 *minor,
                ctx->acceptorName == GSS_C_NO_NAME) {
         /* Accept target name hint from acceptor */
         major = gssEapImportName(minor, inputToken,
-                                 GSS_C_NT_USER_NAME, &ctx->acceptorName);
+                                 GSS_C_NT_USER_NAME,
+                                 ctx->mechanismUsed,
+                                 &ctx->acceptorName);
         if (GSS_ERROR(major))
             return major;
     }
@@ -558,27 +559,30 @@ eapGssSmInitAcceptorName(OM_uint32 *minor,
 
 static OM_uint32
 eapGssSmInitIdentity(OM_uint32 *minor,
-                     gss_cred_id_t cred,
+                     gss_cred_id_t cred GSSEAP_UNUSED,
                      gss_ctx_id_t ctx,
-                     gss_name_t target,
-                     gss_OID mech,
-                     OM_uint32 reqFlags,
-                     OM_uint32 timeReq,
-                     gss_channel_bindings_t chanBindings,
-                     gss_buffer_t inputToken,
-                     gss_buffer_t outputToken,
+                     gss_name_t target GSSEAP_UNUSED,
+                     gss_OID mech GSSEAP_UNUSED,
+                     OM_uint32 reqFlags GSSEAP_UNUSED,
+                     OM_uint32 timeReq GSSEAP_UNUSED,
+                     gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                     gss_buffer_t inputToken GSSEAP_UNUSED,
+                     gss_buffer_t outputToken GSSEAP_UNUSED,
                      OM_uint32 *smFlags)
 {
     struct eap_config eapConfig;
 
+#ifdef GSSEAP_ENABLE_REAUTH
     if (GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_REAUTHENTICATE) {
+        OM_uint32 tmpMinor;
+
         /* server didn't support reauthentication, sent EAP request */
-        GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);
+        gssDeleteSecContext(&tmpMinor, &ctx->kerberosCtx, GSS_C_NO_BUFFER);
         ctx->flags &= ~(CTX_FLAG_KRB_REAUTH);
-        *smFlags |= SM_FLAG_RESTART;
-    } else {
+        GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);
+    } else
+#endif
         *smFlags |= SM_FLAG_FORCE_SEND_TOKEN;
-    }
 
     assert((ctx->flags & CTX_FLAG_KRB_REAUTH) == 0);
     assert(inputToken == GSS_C_NO_BUFFER);
@@ -613,12 +617,12 @@ static OM_uint32
 eapGssSmInitAuthenticate(OM_uint32 *minor,
                          gss_cred_id_t cred,
                          gss_ctx_id_t ctx,
-                         gss_name_t target,
-                         gss_OID mech,
-                         OM_uint32 reqFlags,
-                         OM_uint32 timeReq,
-                         gss_channel_bindings_t chanBindings,
-                         gss_buffer_t inputToken,
+                         gss_name_t target GSSEAP_UNUSED,
+                         gss_OID mech GSSEAP_UNUSED,
+                         OM_uint32 reqFlags GSSEAP_UNUSED,
+                         OM_uint32 timeReq GSSEAP_UNUSED,
+                         gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                         gss_buffer_t inputToken GSSEAP_UNUSED,
                          gss_buffer_t outputToken,
                          OM_uint32 *smFlags)
 {
@@ -681,6 +685,8 @@ cleanup:
             major = tmpMajor;
             *minor = tmpMinor;
         }
+
+        *smFlags |= SM_FLAG_OUTPUT_TOKEN_CRITICAL;
     }
 
     wpabuf_set(&ctx->initiatorCtx.reqData, NULL, 0);
@@ -691,14 +697,14 @@ cleanup:
 
 static OM_uint32
 eapGssSmInitGssChannelBindings(OM_uint32 *minor,
-                               gss_cred_id_t cred,
+                               gss_cred_id_t cred GSSEAP_UNUSED,
                                gss_ctx_id_t ctx,
-                               gss_name_t target,
-                               gss_OID mech,
-                               OM_uint32 reqFlags,
-                               OM_uint32 timeReq,
+                               gss_name_t target GSSEAP_UNUSED,
+                               gss_OID mech GSSEAP_UNUSED,
+                               OM_uint32 reqFlags GSSEAP_UNUSED,
+                               OM_uint32 timeReq GSSEAP_UNUSED,
                                gss_channel_bindings_t chanBindings,
-                               gss_buffer_t inputToken,
+                               gss_buffer_t inputToken GSSEAP_UNUSED,
                                gss_buffer_t outputToken,
                                OM_uint32 *smFlags)
 {
@@ -716,6 +722,8 @@ eapGssSmInitGssChannelBindings(OM_uint32 *minor,
     assert(outputToken->value != NULL);
 
     *minor = 0;
+    *smFlags |= SM_FLAG_OUTPUT_TOKEN_CRITICAL;
+
     return GSS_S_CONTINUE_NEEDED;
 }
 
@@ -724,20 +732,22 @@ static OM_uint32
 eapGssSmInitReauthCreds(OM_uint32 *minor,
                         gss_cred_id_t cred,
                         gss_ctx_id_t ctx,
-                        gss_name_t target,
-                        gss_OID mech,
-                        OM_uint32 reqFlags,
-                        OM_uint32 timeReq,
-                        gss_channel_bindings_t chanBindings,
+                        gss_name_t target GSSEAP_UNUSED,
+                        gss_OID mech GSSEAP_UNUSED,
+                        OM_uint32 reqFlags GSSEAP_UNUSED,
+                        OM_uint32 timeReq GSSEAP_UNUSED,
+                        gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
                         gss_buffer_t inputToken,
-                        gss_buffer_t outputToken,
-                        OM_uint32 *smFlags)
+                        gss_buffer_t outputToken GSSEAP_UNUSED,
+                        OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     OM_uint32 major;
 
-    major = gssEapStoreReauthCreds(minor, ctx, cred, inputToken);
-    if (GSS_ERROR(major))
-        return major;
+    if (ctx->gssFlags & GSS_C_MUTUAL_FLAG) {
+        major = gssEapStoreReauthCreds(minor, ctx, cred, inputToken);
+        if (GSS_ERROR(major))
+            return major;
+    }
 
     *minor = 0;
     return GSS_S_CONTINUE_NEEDED;
@@ -746,15 +756,15 @@ eapGssSmInitReauthCreds(OM_uint32 *minor,
 
 static OM_uint32
 eapGssSmInitCompleteInitiatorExts(OM_uint32 *minor,
-                                  gss_cred_id_t cred,
+                                  gss_cred_id_t cred GSSEAP_UNUSED,
                                   gss_ctx_id_t ctx,
-                                  gss_name_t target,
-                                  gss_OID mech,
-                                  OM_uint32 reqFlags,
-                                  OM_uint32 timeReq,
-                                  gss_channel_bindings_t chanBindings,
-                                  gss_buffer_t inputToken,
-                                  gss_buffer_t outputToken,
+                                  gss_name_t target GSSEAP_UNUSED,
+                                  gss_OID mech GSSEAP_UNUSED,
+                                  OM_uint32 reqFlags GSSEAP_UNUSED,
+                                  OM_uint32 timeReq GSSEAP_UNUSED,
+                                  gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                                  gss_buffer_t inputToken GSSEAP_UNUSED,
+                                  gss_buffer_t outputToken GSSEAP_UNUSED,
                                   OM_uint32 *smFlags)
 {
     GSSEAP_SM_TRANSITION_NEXT(ctx);
@@ -767,16 +777,16 @@ eapGssSmInitCompleteInitiatorExts(OM_uint32 *minor,
 
 static OM_uint32
 eapGssSmInitCompleteAcceptorExts(OM_uint32 *minor,
-                                 gss_cred_id_t cred,
+                                 gss_cred_id_t cred GSSEAP_UNUSED,
                                  gss_ctx_id_t ctx,
-                                 gss_name_t target,
-                                 gss_OID mech,
-                                 OM_uint32 reqFlags,
-                                 OM_uint32 timeReq,
-                                 gss_channel_bindings_t chanBindings,
-                                 gss_buffer_t inputToken,
-                                 gss_buffer_t outputToken,
-                                 OM_uint32 *smFlags)
+                                 gss_name_t target GSSEAP_UNUSED,
+                                 gss_OID mech GSSEAP_UNUSED,
+                                 OM_uint32 reqFlags GSSEAP_UNUSED,
+                                 OM_uint32 timeReq GSSEAP_UNUSED,
+                                 gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                                 gss_buffer_t inputToken GSSEAP_UNUSED,
+                                 gss_buffer_t outputToken GSSEAP_UNUSED,
+                                 OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
 
@@ -790,7 +800,7 @@ static struct gss_eap_sm eapGssInitiatorSm[] = {
         ITOK_TYPE_CONTEXT_ERR,
         ITOK_TYPE_NONE,
         GSSEAP_STATE_ALL & ~(GSSEAP_STATE_INITIAL),
-        SM_ITOK_FLAG_CRITICAL,
+        0,
         eapGssSmInitError
     },
     {
@@ -821,22 +831,25 @@ static struct gss_eap_sm eapGssInitiatorSm[] = {
     {
         ITOK_TYPE_NONE,
         ITOK_TYPE_NONE,
-        GSSEAP_STATE_INITIAL | GSSEAP_STATE_REAUTHENTICATE,
-        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
+#ifdef GSSEAP_ENABLE_REAUTH
+        GSSEAP_STATE_REAUTHENTICATE |
+#endif
+        GSSEAP_STATE_INITIAL,
+        SM_ITOK_FLAG_REQUIRED,
         eapGssSmInitIdentity
     },
     {
         ITOK_TYPE_EAP_REQ,
         ITOK_TYPE_EAP_RESP,
         GSSEAP_STATE_AUTHENTICATE,
-        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
+        SM_ITOK_FLAG_REQUIRED,
         eapGssSmInitAuthenticate
     },
     {
         ITOK_TYPE_NONE,
         ITOK_TYPE_GSS_CHANNEL_BINDINGS,
         GSSEAP_STATE_INITIATOR_EXTS,
-        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
+        SM_ITOK_FLAG_REQUIRED,
         eapGssSmInitGssChannelBindings
     },
     {
@@ -882,6 +895,7 @@ gss_init_sec_context(OM_uint32 *minor,
 {
     OM_uint32 major, tmpMinor;
     gss_ctx_id_t ctx = *context_handle;
+    int initialContextToken = 0;
 
     *minor = 0;
 
@@ -899,13 +913,7 @@ gss_init_sec_context(OM_uint32 *minor,
             return major;
 
         ctx->flags |= CTX_FLAG_INITIATOR;
-
-        major = initBegin(minor, cred, ctx, target_name, mech_type,
-                          req_flags, time_req, input_chan_bindings);
-        if (GSS_ERROR(major)) {
-            gssEapReleaseContext(minor, &ctx);
-            return major;
-        }
+        initialContextToken = 1;
 
         *context_handle = ctx;
     }
@@ -932,13 +940,19 @@ gss_init_sec_context(OM_uint32 *minor,
 
     GSSEAP_MUTEX_LOCK(&cred->mutex);
 
-
     if ((cred->flags & CRED_FLAG_INITIATE) == 0) {
         major = GSS_S_NO_CRED;
         *minor = GSSEAP_CRED_USAGE_MISMATCH;
         goto cleanup;
     }
 
+    if (initialContextToken) {
+        major = initBegin(minor, cred, ctx, target_name, mech_type,
+                          req_flags, time_req, input_chan_bindings);
+        if (GSS_ERROR(major))
+            goto cleanup;
+    }
+
     major = gssEapSmStep(minor,
                          cred,
                          ctx,
@@ -955,8 +969,14 @@ gss_init_sec_context(OM_uint32 *minor,
         goto cleanup;
 
     if (actual_mech_type != NULL) {
-        if (!gssEapInternalizeOid(ctx->mechanismUsed, actual_mech_type))
-            duplicateOid(&tmpMinor, ctx->mechanismUsed, actual_mech_type);
+        OM_uint32 tmpMajor;
+
+        tmpMajor = gssEapCanonicalizeOid(&tmpMinor, ctx->mechanismUsed, 0, actual_mech_type);
+        if (GSS_ERROR(tmpMajor)) {
+            major = tmpMajor;
+            *minor = tmpMinor;
+            goto cleanup;
+        }
     }
     if (ret_flags != NULL)
         *ret_flags = ctx->gssFlags;