if (GSS_ERROR(major))
return major;
- /*
- * Now, if we have a username from the identity packet, discard it
- * because it's unauthenticated.
- */
gssEapReleaseName(&tmpMinor, &ctx->initiatorName);
vp = rc_avpair_get(ctx->acceptorCtx.avps, PW_USER_NAME, 0);
if (GSS_ERROR(major))
return major;
- if (ctx->acceptorName == GSS_C_NO_NAME &&
- cred != GSS_C_NO_CREDENTIAL &&
- cred->name != GSS_C_NO_NAME) {
+ assert(ctx->acceptorName == GSS_C_NO_NAME);
+
+ if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
major = gss_duplicate_name(minor, cred->name, &ctx->acceptorName);
if (GSS_ERROR(major))
return major;
}
static OM_uint32
-importInitiatorIdentity(OM_uint32 *minor,
- gss_ctx_id_t ctx,
- gss_buffer_t inputToken,
- gss_buffer_t nameBuf)
+setAcceptorIdentity(OM_uint32 *minor,
+ gss_ctx_id_t ctx,
+ VALUE_PAIR **avps)
{
OM_uint32 major, tmpMinor;
- struct eap_hdr *pdu = (struct eap_hdr *)inputToken->value;
- unsigned char *pos = (unsigned char *)(pdu + 1);
- gss_name_t name;
+ gss_buffer_desc nameBuf;
- assert(pdu->code == EAP_CODE_RESPONSE);
- assert(pos[0] == EAP_TYPE_IDENTITY);
+ /* Awaits further specification */
+ if (ctx->acceptorName == GSS_C_NO_NAME)
+ return GSS_S_COMPLETE;
- nameBuf->value = pos + 1;
- nameBuf->length = inputToken->length - sizeof(*pdu) - 1;
+ major = gss_display_name(minor, ctx->acceptorName, &nameBuf, NULL);
+ if (GSS_ERROR(major))
+ return major;
- major = gssEapImportName(minor, nameBuf, GSS_C_NT_USER_NAME, &name);
+ major = addAvpFromBuffer(minor, ctx->acceptorCtx.radHandle, avps,
+ RADIUS_VENDOR_ATTR_GSS_EAP_ACCEPTOR_SERVICE_NAME,
+ RADIUS_VENDOR_ID_GSS_EAP,
+ &nameBuf);
if (GSS_ERROR(major))
return major;
- gssEapReleaseName(&tmpMinor, &ctx->initiatorName);
- ctx->initiatorName = name;
+ gss_release_buffer(&tmpMinor, &nameBuf);
- return GSS_S_COMPLETE;
+ return major;
}
static OM_uint32
if (inputToken->length > sizeof(*pdu) &&
pdu->code == EAP_CODE_RESPONSE &&
pos[0] == EAP_TYPE_IDENTITY) {
- major = importInitiatorIdentity(minor, ctx, inputToken, &nameBuf);
+ /*
+ * XXX TODO do we really need to set User-Name? FreeRADIUS does
+ * not appear to require it.
+ */
+ major = addAvpFromBuffer(minor, rh, &send, PW_USER_NAME, 0, &nameBuf);
if (GSS_ERROR(major))
goto cleanup;
- major = addAvpFromBuffer(minor, rh, &send, PW_USER_NAME, &nameBuf);
+ major = setAcceptorIdentity(minor, ctx, &send);
if (GSS_ERROR(major))
goto cleanup;
}
- major = addAvpFromBuffer(minor, rh, &send, PW_EAP_MESSAGE, inputToken);
+ major = addAvpFromBuffer(minor, rh, &send, PW_EAP_MESSAGE, 0, inputToken);
if (GSS_ERROR(major))
goto cleanup;
if (ctx->acceptorCtx.lastStatus == CHALLENGE_RC) {
- major = addAvpFromBuffer(minor, rh, &send, PW_STATE,
+ major = addAvpFromBuffer(minor, rh, &send, PW_STATE, 0,
&ctx->acceptorCtx.state);
if (GSS_ERROR(major))
goto cleanup;
ctx->acceptorCtx.lastStatus = code;
- major = getBufferFromAvps(minor, received, PW_EAP_MESSAGE,
+ major = getBufferFromAvps(minor, received, PW_EAP_MESSAGE, 0,
outputToken, TRUE);
if ((major == GSS_S_UNAVAILABLE && code != OK_RC) ||
GSS_ERROR(major))
goto cleanup;
if (code == CHALLENGE_RC) {
- major = getBufferFromAvps(minor, received, PW_STATE,
+ major = getBufferFromAvps(minor, received, PW_STATE, 0,
&ctx->acceptorCtx.state, TRUE);
if (major != GSS_S_UNAVAILABLE && GSS_ERROR(major))
goto cleanup;