Merge branch 'master' into tlv-mic

[moonshot.git] / mech_eap / init_sec_context.c

diff --git a/mech_eap/init_sec_context.c b/mech_eap/init_sec_context.c
index 15b7538..becb767 100644 (file)
--- a/mech_eap/init_sec_context.c
+++ b/mech_eap/init_sec_context.c
@@ -199,13 +199,16 @@ peerConfigInit(OM_uint32 *minor,
                gss_cred_id_t cred,
                gss_ctx_id_t ctx)
 {
+    OM_uint32 major;
     krb5_context krbContext;
     struct eap_peer_config *eapPeerConfig = &ctx->initiatorCtx.eapPeerConfig;
-    krb5_error_code code;
-    char *identity, *anonymousIdentity;
+    gss_buffer_desc identity = GSS_C_EMPTY_BUFFER;
+    gss_buffer_desc realm = GSS_C_EMPTY_BUFFER;
 
     eapPeerConfig->identity = NULL;
     eapPeerConfig->identity_len = 0;
+    eapPeerConfig->anonymous_identity = NULL;
+    eapPeerConfig->anonymous_identity_len = 0;
     eapPeerConfig->password = NULL;
     eapPeerConfig->password_len = 0;
 
@@ -220,25 +223,38 @@ peerConfigInit(OM_uint32 *minor,
 
     assert(cred->name != GSS_C_NO_NAME);
 
-    if ((cred->name->flags & (NAME_FLAG_NAI | NAME_FLAG_SERVICE)) == 0) {
+    /*
+     * draft-ietf-abfab-gss-eap-01: the host portion is empty
+     * for initiators.
+     */
+    if ((cred->name->flags & NAME_FLAG_NAI) == 0) {
         *minor = GSSEAP_BAD_INITIATOR_NAME;
         return GSS_S_BAD_NAME;
     }
 
-    code = krb5_unparse_name(krbContext, cred->name->krbPrincipal, &identity);
-    if (code != 0) {
-        *minor = code;
+    /* identity */
+    major = gssEapDisplayName(minor, cred->name, &identity, NULL);
+    if (GSS_ERROR(major))
+        return major;
+
+    eapPeerConfig->identity = (unsigned char *)identity.value;
+    eapPeerConfig->identity_len = identity.length;
+
+    krbPrincRealmToGssBuffer(cred->name->krbPrincipal, &realm);
+
+    /* anonymous_identity */
+    eapPeerConfig->anonymous_identity = GSSEAP_MALLOC(realm.length + 2);
+    if (eapPeerConfig->anonymous_identity == NULL) {
+        *minor = ENOMEM;
         return GSS_S_FAILURE;
     }
 
-    anonymousIdentity = strchr(identity, '@');
-    if (anonymousIdentity == NULL)
-        anonymousIdentity = "";
+    eapPeerConfig->anonymous_identity[0] = '@';
+    memcpy(eapPeerConfig->anonymous_identity + 1, realm.value, realm.length);
+    eapPeerConfig->anonymous_identity[1 + realm.length] = '\0';
+    eapPeerConfig->anonymous_identity_len = 1 + realm.length;
 
-    eapPeerConfig->identity = (unsigned char *)identity;
-    eapPeerConfig->identity_len = strlen(identity);
-    eapPeerConfig->anonymous_identity = (unsigned char *)anonymousIdentity;
-    eapPeerConfig->anonymous_identity_len = strlen(anonymousIdentity);
+    /* password */
     eapPeerConfig->password = (unsigned char *)cred->password.value;
     eapPeerConfig->password_len = cred->password.length;
 
@@ -250,12 +266,19 @@ static OM_uint32
 peerConfigFree(OM_uint32 *minor,
                gss_ctx_id_t ctx)
 {
-    krb5_context krbContext;
     struct eap_peer_config *eapPeerConfig = &ctx->initiatorCtx.eapPeerConfig;
 
-    GSSEAP_KRB_INIT(&krbContext);
+    if (eapPeerConfig->identity != NULL) {
+        GSSEAP_FREE(eapPeerConfig->identity);
+        eapPeerConfig->identity = NULL;
+        eapPeerConfig->identity_len = 0;
+    }
 
-    krb5_free_unparsed_name(krbContext, (char *)eapPeerConfig->identity);
+    if (eapPeerConfig->anonymous_identity != NULL) {
+        GSSEAP_FREE(eapPeerConfig->anonymous_identity);
+        eapPeerConfig->anonymous_identity = NULL;
+        eapPeerConfig->anonymous_identity_len = 0;
+    }
 
     *minor = 0;
     return GSS_S_COMPLETE;
@@ -462,8 +485,8 @@ eapGssSmInitGssReauth(OM_uint32 *minor,
         goto cleanup;
 
     major = gssInitSecContext(minor,
-                              cred->krbCred,
-                              &ctx->kerberosCtx,
+                              cred->reauthCred,
+                              &ctx->reauthCtx,
                               mechTarget,
                               (gss_OID)gss_mech_krb5,
                               reqFlags | GSS_C_MUTUAL_FLAG,
@@ -636,7 +659,7 @@ eapGssSmInitIdentity(OM_uint32 *minor,
         OM_uint32 tmpMinor;
 
         /* server didn't support reauthentication, sent EAP request */
-        gssDeleteSecContext(&tmpMinor, &ctx->kerberosCtx, GSS_C_NO_BUFFER);
+        gssDeleteSecContext(&tmpMinor, &ctx->reauthCtx, GSS_C_NO_BUFFER);
         ctx->flags &= ~(CTX_FLAG_KRB_REAUTH);
         GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);
     } else