if (ctx == GSS_C_NO_CONTEXT)
return FALSE;
- assert(CTX_IS_INITIATOR(ctx));
+ GSSEAP_ASSERT(CTX_IS_INITIATOR(ctx));
switch (variable) {
case EAPOL_idleWhile:
if (ctx == GSS_C_NO_CONTEXT)
return;
- assert(CTX_IS_INITIATOR(ctx));
+ GSSEAP_ASSERT(CTX_IS_INITIATOR(ctx));
switch (variable) {
case EAPOL_idleWhile:
eapPeerConfig->password = NULL;
eapPeerConfig->password_len = 0;
- assert(cred != GSS_C_NO_CREDENTIAL);
+ GSSEAP_ASSERT(cred != GSS_C_NO_CREDENTIAL);
GSSEAP_KRB_INIT(&krbContext);
wpa_debug_level = 0;
#endif
- assert(cred->name != GSS_C_NO_NAME);
+ GSSEAP_ASSERT(cred->name != GSS_C_NO_NAME);
if ((cred->name->flags & (NAME_FLAG_NAI | NAME_FLAG_SERVICE)) == 0) {
*minor = GSSEAP_BAD_INITIATOR_NAME;
OM_uint32 major;
gss_cred_id_t cred = ctx->cred;
- assert(cred != GSS_C_NO_CREDENTIAL);
+ GSSEAP_ASSERT(cred != GSS_C_NO_CREDENTIAL);
if (cred->expiryTime)
ctx->expiryTime = cred->expiryTime;
*minor = GSSEAP_BAD_ERROR_TOKEN;
}
- assert(GSS_ERROR(major));
+ GSSEAP_ASSERT(GSS_ERROR(major));
return major;
}
gss_OID actualMech = GSS_C_NO_OID;
OM_uint32 gssFlags, timeRec;
- assert(cred != GSS_C_NO_CREDENTIAL);
-
+ /*
+ * Here we use the passed in credential handle because the resolved
+ * context credential does not currently have the reauth creds.
+ */
if (GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_INITIAL) {
if (!gssEapCanReauthP(cred, target, timeReq))
return GSS_S_CONTINUE_NEEDED;
goto cleanup;
}
+ GSSEAP_ASSERT(cred != GSS_C_NO_CREDENTIAL);
+
major = gssEapMechToGlueName(minor, target, &mechTarget);
if (GSS_ERROR(major))
goto cleanup;
ctx->gssFlags = gssFlags;
if (major == GSS_S_COMPLETE) {
- assert(GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_REAUTHENTICATE);
+ GSSEAP_ASSERT(GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_REAUTHENTICATE);
major = gssEapReauthComplete(minor, ctx, cred, actualMech, timeRec);
if (GSS_ERROR(major))
outputToken, NULL);
if (GSS_ERROR(major))
return major;
- } else if (inputToken != GSS_C_NO_BUFFER &&
- ctx->acceptorName == GSS_C_NO_NAME) {
- /* Accept target name hint from acceptor */
+ } else if (inputToken != GSS_C_NO_BUFFER) {
+ /* Accept target name hint from acceptor or verify acceptor*/
+ gss_name_t importedName;
major = gssEapImportName(minor, inputToken,
GSS_C_NT_USER_NAME,
ctx->mechanismUsed,
- &ctx->acceptorName);
+ &importedName);
if (GSS_ERROR(major))
return major;
+ if (ctx->acceptorName) {
+ /* verify name */
+ int equal = 0;
+ OM_uint32 ignoredMinor = 0;
+ major = gss_compare_name(minor, importedName,
+ ctx->acceptorName, &equal);
+ gss_release_name(&ignoredMinor, &importedName);
+ if (GSS_ERROR(major))
+ return major;
+ if (!equal) {
+ *minor = GSSEAP_BAD_CONTEXT_TOKEN;
+ return GSS_S_DEFECTIVE_TOKEN;
+ }
+ } else {
+ /* accept acceptor name hint */
+ ctx->acceptorName = importedName;
+ importedName = NULL;
+ }
}
+
/*
* Currently, other parts of the code assume that the acceptor name
* is available, hence this check.
#endif
*smFlags |= SM_FLAG_FORCE_SEND_TOKEN;
- assert((ctx->flags & CTX_FLAG_KRB_REAUTH) == 0);
- assert(inputToken == GSS_C_NO_BUFFER);
+ GSSEAP_ASSERT((ctx->flags & CTX_FLAG_KRB_REAUTH) == 0);
+ GSSEAP_ASSERT(inputToken == GSS_C_NO_BUFFER);
memset(&eapConfig, 0, sizeof(eapConfig));
*minor = 0;
- assert(inputToken != GSS_C_NO_BUFFER);
+ GSSEAP_ASSERT(inputToken != GSS_C_NO_BUFFER);
major = peerConfigInit(minor, ctx);
if (GSS_ERROR(major))
goto cleanup;
- assert(ctx->initiatorCtx.eap != NULL);
- assert(ctx->flags & CTX_FLAG_EAP_PORT_ENABLED);
+ GSSEAP_ASSERT(ctx->initiatorCtx.eap != NULL);
+ GSSEAP_ASSERT(ctx->flags & CTX_FLAG_EAP_PORT_ENABLED);
ctx->flags |= CTX_FLAG_EAP_REQ; /* we have a Request from the acceptor */
OM_uint32 tmpMajor;
gss_buffer_desc respBuf;
- assert(major == GSS_S_CONTINUE_NEEDED);
+ GSSEAP_ASSERT(major == GSS_S_CONTINUE_NEEDED);
respBuf.length = wpabuf_len(resp);
respBuf.value = (void *)wpabuf_head(resp);
OM_uint32 *smFlags)
{
OM_uint32 major;
- gss_buffer_desc buffer = GSS_C_EMPTY_BUFFER;
+ krb5_error_code code;
+ krb5_context krbContext;
+ krb5_data data;
+ krb5_checksum cksum;
+ gss_buffer_desc cksumBuffer;
- if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS)
- buffer = chanBindings->application_data;
+ if (chanBindings == GSS_C_NO_CHANNEL_BINDINGS ||
+ chanBindings->application_data.length == 0)
+ return GSS_S_CONTINUE_NEEDED;
- major = gssEapWrap(minor, ctx, TRUE, GSS_C_QOP_DEFAULT,
- &buffer, NULL, outputToken);
- if (GSS_ERROR(major))
- return major;
+ GSSEAP_KRB_INIT(&krbContext);
+
+ KRB_DATA_INIT(&data);
+
+ gssBufferToKrbData(&chanBindings->application_data, &data);
+
+ code = krb5_c_make_checksum(krbContext, ctx->checksumType,
+ &ctx->rfc3961Key,
+ KEY_USAGE_GSSEAP_CHBIND_MIC,
+ &data, &cksum);
+ if (code != 0) {
+ *minor = code;
+ return GSS_S_FAILURE;
+ }
+
+ cksumBuffer.length = KRB_CHECKSUM_LENGTH(&cksum);
+ cksumBuffer.value = KRB_CHECKSUM_DATA(&cksum);
- assert(outputToken->value != NULL);
+ major = duplicateBuffer(minor, &cksumBuffer, outputToken);
+ if (GSS_ERROR(major)) {
+ krb5_free_checksum_contents(krbContext, &cksum);
+ return major;
+ }
*minor = 0;
*smFlags |= SM_FLAG_OUTPUT_TOKEN_CRITICAL;
+ krb5_free_checksum_contents(krbContext, &cksum);
+
return GSS_S_CONTINUE_NEEDED;
}
return GSS_S_CONTINUE_NEEDED;
}
-
+
#ifdef GSSEAP_ENABLE_REAUTH
static OM_uint32
eapGssSmInitReauthCreds(OM_uint32 *minor,
{
ITOK_TYPE_ACCEPTOR_NAME_RESP,
ITOK_TYPE_ACCEPTOR_NAME_REQ,
- GSSEAP_STATE_INITIAL | GSSEAP_STATE_AUTHENTICATE,
+ GSSEAP_STATE_INITIAL | GSSEAP_STATE_AUTHENTICATE
+ | GSSEAP_STATE_ACCEPTOR_EXTS ,
0,
eapGssSmInitAcceptorName
},
ITOK_TYPE_NONE,
ITOK_TYPE_GSS_CHANNEL_BINDINGS,
GSSEAP_STATE_INITIATOR_EXTS,
- SM_ITOK_FLAG_REQUIRED,
+ 0,
eapGssSmInitGssChannelBindings
},
{
OM_uint32 major, tmpMinor;
int initialContextToken = (ctx->mechanismUsed == GSS_C_NO_OID);
+ /*
+ * XXX is acquiring the credential lock here necessary? The password is
+ * mutable but the contract could specify that this is not updated whilst
+ * a context is being initialized.
+ */
if (cred != GSS_C_NO_CREDENTIAL)
GSSEAP_MUTEX_LOCK(&cred->mutex);
if (GSS_ERROR(major))
goto cleanup;
- assert(ctx->cred != GSS_C_NO_CREDENTIAL);
+ GSSEAP_ASSERT(ctx->cred != GSS_C_NO_CREDENTIAL);
}
GSSEAP_MUTEX_LOCK(&ctx->cred->mutex);
- assert(ctx->cred->flags & CRED_FLAG_RESOLVED);
- assert(ctx->cred->flags & CRED_FLAG_INITIATE);
+ GSSEAP_ASSERT(ctx->cred->flags & CRED_FLAG_RESOLVED);
+ GSSEAP_ASSERT(ctx->cred->flags & CRED_FLAG_INITIATE);
if (initialContextToken) {
major = initBegin(minor, ctx, target_name, mech_type,
if (time_rec != NULL)
gssEapContextTime(&tmpMinor, ctx, time_rec);
- assert(CTX_IS_ESTABLISHED(ctx) || major == GSS_S_CONTINUE_NEEDED);
+ GSSEAP_ASSERT(CTX_IS_ESTABLISHED(ctx) || major == GSS_S_CONTINUE_NEEDED);
cleanup:
if (cred != GSS_C_NO_CREDENTIAL)
output_token->length = 0;
output_token->value = NULL;
- assert(ctx == GSS_C_NO_CONTEXT || ctx->mechanismUsed != GSS_C_NO_OID);
-
if (ctx == GSS_C_NO_CONTEXT) {
if (input_token != GSS_C_NO_BUFFER && input_token->length != 0) {
*minor = GSSEAP_WRONG_SIZE;