X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=accept_sec_context.c;h=2258d245e6a65466d36e3dd4dd65290933a7d8ff;hb=aa3e3279477f71dbe2efb212cedea1c0929f25e8;hp=83f6f00df87d9e0a4df8f5dbd9ec9def33661b92;hpb=ef746e48c6b19da0d2b709de370f573eb74480ac;p=mech_eap.git

diff --git a/accept_sec_context.c b/accept_sec_context.c
index 83f6f00..2258d24 100644
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -32,6 +32,16 @@
 
 #include "gssapiP_eap.h"
 
+#ifdef GSSEAP_ENABLE_REAUTH
+static OM_uint32
+eapGssSmAcceptGssReauth(OM_uint32 *minor,
+                        gss_ctx_id_t ctx,
+                        gss_cred_id_t cred,
+                        gss_buffer_t inputToken,
+                        gss_channel_bindings_t chanBindings,
+                        gss_buffer_t outputToken);
+#endif
+
 /*
  * Mark a context as ready for cryptographic operations
  */
@@ -326,7 +336,7 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
         if (GSS_ERROR(major))
             goto cleanup;
 
-        ctx->state = EAP_STATE_GSS_CHANNEL_BINDINGS;
+        ctx->state = EAP_STATE_EXTENSIONS_REQ;
     }
 
     major = GSS_S_CONTINUE_NEEDED;
@@ -339,54 +349,41 @@ cleanup:
 }
 
 static OM_uint32
-eapGssSmAcceptGssChannelBindings(OM_uint32 *minor,
-                                 gss_ctx_id_t ctx,
-                                 gss_cred_id_t cred,
-                                 gss_buffer_t inputToken,
-                                 gss_channel_bindings_t chanBindings,
-                                 gss_buffer_t outputToken)
+acceptGssChannelBindings(OM_uint32 *minor,
+                         gss_ctx_id_t ctx,
+                         gss_cred_id_t cred,
+                         gss_buffer_t inputToken,
+                         gss_channel_bindings_t chanBindings)
 {
-    OM_uint32 major;
+    OM_uint32 major, tmpMinor;
     gss_iov_buffer_desc iov[2];
 
-    outputToken->length = 0;
-    outputToken->value = NULL;
-
-    if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS) {
-        if (inputToken->length < 14) {
-            return GSS_S_DEFECTIVE_TOKEN;
-        }
-
-        iov[0].type = GSS_IOV_BUFFER_TYPE_DATA;
-        iov[0].buffer.length = 0;
-        iov[0].buffer.value = NULL;
-
-        if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS)
-            iov[0].buffer = chanBindings->application_data;
+    iov[0].type = GSS_IOV_BUFFER_TYPE_DATA | GSS_IOV_BUFFER_FLAG_ALLOCATE;
+    iov[0].buffer.length = 0;
+    iov[0].buffer.value = NULL;
 
-        iov[1].type = GSS_IOV_BUFFER_TYPE_HEADER;
-        iov[1].buffer.length = 16;
-        iov[1].buffer.value = (unsigned char *)inputToken->value - 2;
+    iov[1].type = GSS_IOV_BUFFER_TYPE_STREAM;
+    iov[1].buffer = *inputToken;
 
-        assert(load_uint16_be(iov[1].buffer.value) == TOK_TYPE_GSS_CB);
-
-        iov[2].type = GSS_IOV_BUFFER_TYPE_TRAILER;
-        iov[2].buffer.length = inputToken->length - 14;
-        iov[2].buffer.value = (unsigned char *)inputToken->value + 14;
+    major = gssEapUnwrapOrVerifyMIC(minor, ctx, NULL, NULL,
+                                    iov, 2, TOK_TYPE_WRAP);
+    if (GSS_ERROR(major))
+        return major;
 
-        major = gssEapUnwrapOrVerifyMIC(minor, ctx, NULL, NULL,
-                                        iov, 3, TOK_TYPE_GSS_CB);
-        if (GSS_ERROR(major))
-            return major;
+    if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS &&
+        !bufferEqual(&iov[0].buffer, &chanBindings->application_data)) {
+        major = GSS_S_BAD_BINDINGS;
+    } else {
+        major = GSS_S_CONTINUE_NEEDED;
     }
 
-    ctx->state = EAP_STATE_KRB_REAUTH_CRED;
+    gss_release_buffer(&tmpMinor, &iov[0].buffer);
 
-    return GSS_S_CONTINUE_NEEDED;
+    return major;
 }
 
 static OM_uint32
-eapGssSmAcceptKrbReauthCred(OM_uint32 *minor,
+eapGssSmAcceptExtensionsReq(OM_uint32 *minor,
                             gss_ctx_id_t ctx,
                             gss_cred_id_t cred,
                             gss_buffer_t inputToken,
@@ -395,109 +392,64 @@ eapGssSmAcceptKrbReauthCred(OM_uint32 *minor,
 {
     OM_uint32 major;
 
-    major = gssEapMakeReauthCreds(minor, ctx, cred, outputToken);
+    outputToken->length = 0;
+    outputToken->value = NULL;
+
+    major = acceptGssChannelBindings(minor, ctx, cred, inputToken,
+                                     chanBindings);
     if (GSS_ERROR(major))
         return major;
 
-    ctx->state = EAP_STATE_ESTABLISHED;
+    ctx->state = EAP_STATE_EXTENSIONS_RESP;
 
-    return GSS_S_COMPLETE;
-}
-
-static OM_uint32
-eapGssSmAcceptEstablished(OM_uint32 *minor,
-                          gss_ctx_id_t ctx,
-                          gss_cred_id_t cred,
-                          gss_buffer_t inputToken,
-                          gss_channel_bindings_t chanBindings,
-                          gss_buffer_t outputToken)
-{
-    /* Called with already established context */
-    *minor = EINVAL;
-    return GSS_S_BAD_STATUS;
+    return GSS_S_CONTINUE_NEEDED;
 }
 
 static OM_uint32
-acceptReadyKrb(OM_uint32 *minor,
-               gss_ctx_id_t ctx,
-               gss_cred_id_t cred,
-               const gss_name_t initiator,
-               const gss_OID mech,
-               OM_uint32 timeRec)
+eapGssSmAcceptExtensionsResp(OM_uint32 *minor,
+                             gss_ctx_id_t ctx,
+                             gss_cred_id_t cred,
+                             gss_buffer_t inputToken,
+                             gss_channel_bindings_t chanBindings,
+                             gss_buffer_t outputToken)
 {
     OM_uint32 major, tmpMinor;
-    gss_buffer_desc authData = GSS_C_EMPTY_BUFFER;
-
-    major = gssEapGlueToMechName(minor, initiator, &ctx->initiatorName);
-    if (GSS_ERROR(major))
-        goto cleanup;
-
-    major = gssKrbExtractAuthzDataFromSecContext(minor, ctx->kerberosCtx,
-                                                 KRB5_AUTHDATA_RADIUS_AVP,
-                                                 &authData);
-    if (GSS_ERROR(major))
-        goto cleanup;
+    gss_buffer_desc credsToken = GSS_C_EMPTY_BUFFER;
 
-    major = gssEapImportAttrContext(minor, &authData, ctx->initiatorName);
+#ifdef GSSEAP_ENABLE_REAUTH
+    major = gssEapMakeReauthCreds(minor, ctx, cred, &credsToken);
     if (GSS_ERROR(major))
-        goto cleanup;
+        return major;
+#else
+    credsToken.value = "";
+#endif /* GSSEAP_ENABLE_REAUTH */
 
-    if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
-        major = gssEapDuplicateName(minor, cred->name, &ctx->acceptorName);
-        if (GSS_ERROR(major))
-            goto cleanup;
+    major = duplicateBuffer(minor, &credsToken, outputToken);
+    if (GSS_ERROR(major)) {
+        gss_release_buffer(&tmpMinor, &credsToken);
+        return major;
     }
 
-    major = gssEapReauthComplete(minor, ctx, cred, mech, timeRec);
-    if (GSS_ERROR(major))
-        goto cleanup;
+#ifdef GSSEAP_ENABLE_REAUTH
+    gss_release_buffer(&tmpMinor, &credsToken);
+#endif
 
     ctx->state = EAP_STATE_ESTABLISHED;
 
-cleanup:
-    gss_release_buffer(&tmpMinor, &authData);
-
-    return major;
+    return GSS_S_COMPLETE;
 }
 
 static OM_uint32
-eapGssSmAcceptGssReauth(OM_uint32 *minor,
-                         gss_ctx_id_t ctx,
-                         gss_cred_id_t cred,
-                         gss_buffer_t inputToken,
-                         gss_channel_bindings_t chanBindings,
-                         gss_buffer_t outputToken)
+eapGssSmAcceptEstablished(OM_uint32 *minor,
+                          gss_ctx_id_t ctx,
+                          gss_cred_id_t cred,
+                          gss_buffer_t inputToken,
+                          gss_channel_bindings_t chanBindings,
+                          gss_buffer_t outputToken)
 {
-    OM_uint32 major, tmpMinor;
-    gss_cred_id_t krbCred = GSS_C_NO_CREDENTIAL;
-    gss_name_t krbInitiator = GSS_C_NO_NAME;
-    gss_OID mech = GSS_C_NO_OID;
-    OM_uint32 timeRec = GSS_C_INDEFINITE;
-
-    ctx->flags |= CTX_FLAG_KRB_REAUTH_GSS;
-
-    if (cred != GSS_C_NO_CREDENTIAL)
-        krbCred = cred->krbCred;
-
-    major = gssAcceptSecContext(minor,
-                                &ctx->kerberosCtx,
-                                krbCred,
-                                inputToken,
-                                chanBindings,
-                                &krbInitiator,
-                                &mech,
-                                outputToken,
-                                &ctx->gssFlags,
-                                &timeRec,
-                                NULL);
-    if (major == GSS_S_COMPLETE) {
-        major = acceptReadyKrb(minor, ctx, cred,
-                               krbInitiator, mech, timeRec);
-    }
-
-    gssReleaseName(&tmpMinor, &krbInitiator);
-
-    return major;
+    /* Called with already established context */
+    *minor = EINVAL;
+    return GSS_S_BAD_STATUS;
 }
 
 static struct gss_eap_acceptor_sm {
@@ -512,10 +464,12 @@ static struct gss_eap_acceptor_sm {
 } eapGssAcceptorSm[] = {
     { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,    eapGssSmAcceptIdentity           },
     { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,    eapGssSmAcceptAuthenticate       },
-    { TOK_TYPE_GSS_CB,      TOK_TYPE_NONE,       eapGssSmAcceptGssChannelBindings },
-    { TOK_TYPE_NONE,        TOK_TYPE_KRB_CRED,   eapGssSmAcceptKrbReauthCred      },
+    { TOK_TYPE_EXT_REQ,     TOK_TYPE_NONE,       eapGssSmAcceptExtensionsReq      },
+    { TOK_TYPE_NONE,        TOK_TYPE_EXT_RESP,   eapGssSmAcceptExtensionsResp     },
     { TOK_TYPE_NONE,        TOK_TYPE_NONE,       eapGssSmAcceptEstablished        },
+#ifdef GSSEAP_ENABLE_REAUTH
     { TOK_TYPE_GSS_REAUTH,  TOK_TYPE_GSS_REAUTH, eapGssSmAcceptGssReauth          },
+#endif
 };
 
 OM_uint32
@@ -538,6 +492,7 @@ gss_accept_sec_context(OM_uint32 *minor,
     gss_buffer_desc innerInputToken = GSS_C_EMPTY_BUFFER;
     gss_buffer_desc innerOutputToken = GSS_C_EMPTY_BUFFER;
     enum gss_eap_token_type tokType;
+    int initialContextToken = 0;
 
     *minor = 0;
 
@@ -557,6 +512,7 @@ gss_accept_sec_context(OM_uint32 *minor,
         if (GSS_ERROR(major))
             return major;
 
+        initialContextToken = 1;
         *context_handle = ctx;
     }
 
@@ -565,16 +521,23 @@ gss_accept_sec_context(OM_uint32 *minor,
     sm = &eapGssAcceptorSm[ctx->state];
 
     major = gssEapVerifyToken(minor, ctx, input_token,
-                              sm->inputTokenType, &tokType,
-                              &innerInputToken);
-    if (major == GSS_S_DEFECTIVE_TOKEN && tokType == TOK_TYPE_GSS_REAUTH) {
+                              &tokType, &innerInputToken);
+    if (GSS_ERROR(major))
+        goto cleanup;
+
+#ifdef GSSEAP_ENABLE_REAUTH
+    if (tokType == TOK_TYPE_GSS_REAUTH && initialContextToken) {
         ctx->state = EAP_STATE_KRB_REAUTH_GSS;
-    } else if (GSS_ERROR(major)) {
+    } else
+#endif
+    if (tokType != sm->inputTokenType) {
+        major = GSS_S_DEFECTIVE_TOKEN;
         goto cleanup;
     }
 
     /* If credentials were provided, check they're usable with this mech */
-    if (!gssEapCredAvailable(cred, ctx->mechanismUsed)) {
+    if (cred != GSS_C_NO_CREDENTIAL &&
+        !gssEapCredAvailable(cred, ctx->mechanismUsed)) {
         major = GSS_S_BAD_MECH;
         goto cleanup;
     }
@@ -633,3 +596,75 @@ cleanup:
     return major;
 }
 
+#ifdef GSSEAP_ENABLE_REAUTH
+static OM_uint32
+acceptReadyKrb(OM_uint32 *minor,
+               gss_ctx_id_t ctx,
+               gss_cred_id_t cred,
+               const gss_name_t initiator,
+               const gss_OID mech,
+               OM_uint32 timeRec)
+{
+    OM_uint32 major;
+
+    major = gssEapGlueToMechName(minor, initiator, &ctx->initiatorName);
+    if (GSS_ERROR(major))
+        return major;
+
+    if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
+        major = gssEapDuplicateName(minor, cred->name, &ctx->acceptorName);
+        if (GSS_ERROR(major))
+            return major;
+    }
+
+    major = gssEapReauthComplete(minor, ctx, cred, mech, timeRec);
+    if (GSS_ERROR(major))
+        return major;
+
+    ctx->state = EAP_STATE_ESTABLISHED;
+
+    return GSS_S_COMPLETE;
+}
+
+static OM_uint32
+eapGssSmAcceptGssReauth(OM_uint32 *minor,
+                        gss_ctx_id_t ctx,
+                        gss_cred_id_t cred,
+                        gss_buffer_t inputToken,
+                        gss_channel_bindings_t chanBindings,
+                        gss_buffer_t outputToken)
+{
+    OM_uint32 major, tmpMinor;
+    gss_cred_id_t krbCred = GSS_C_NO_CREDENTIAL;
+    gss_name_t krbInitiator = GSS_C_NO_NAME;
+    gss_OID mech = GSS_C_NO_OID;
+    OM_uint32 gssFlags, timeRec = GSS_C_INDEFINITE;
+
+    ctx->flags |= CTX_FLAG_KRB_REAUTH_GSS;
+
+    if (cred != GSS_C_NO_CREDENTIAL)
+        krbCred = cred->krbCred;
+
+    major = gssAcceptSecContext(minor,
+                                &ctx->kerberosCtx,
+                                krbCred,
+                                inputToken,
+                                chanBindings,
+                                &krbInitiator,
+                                &mech,
+                                outputToken,
+                                &gssFlags,
+                                &timeRec,
+                                NULL);
+    if (major == GSS_S_COMPLETE) {
+        major = acceptReadyKrb(minor, ctx, cred,
+                               krbInitiator, mech, timeRec);
+    }
+
+    ctx->gssFlags = gssFlags;
+
+    gssReleaseName(&tmpMinor, &krbInitiator);
+
+    return major;
+}
+#endif /* GSSEAP_ENABLE_REAUTH */