X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=accept_sec_context.c;h=83d6c2de8df676edc4a7bbb11b25c3be59d82b4d;hb=4866125c4be79ec72fc388eabba01505786850b4;hp=5dd68f28c6e943bd514a64472f0e4578361522a0;hpb=cf651f093e72306929b29a67af1242dfad47ca58;p=mech_eap.git diff --git a/accept_sec_context.c b/accept_sec_context.c index 5dd68f2..83d6c2d 100644 --- a/accept_sec_context.c +++ b/accept_sec_context.c @@ -60,10 +60,10 @@ acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred) gssEapReleaseName(&tmpMinor, &ctx->initiatorName); - vp = rc_avpair_get(ctx->acceptorCtx.avps, PW_USER_NAME, 0); + vp = pairfind(ctx->acceptorCtx.avps, PW_USER_NAME); if (vp != NULL) { - nameBuf.length = vp->lvalue; - nameBuf.value = vp->strvalue; + nameBuf.length = vp->length; + nameBuf.value = vp->vp_strvalue; } else { ctx->gssFlags |= GSS_C_ANON_FLAG; } @@ -75,13 +75,12 @@ acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred) ctx->initiatorName->attrCtx = gssEapCreateAttrContext(cred, ctx); - vp = rc_avpair_get(ctx->acceptorCtx.avps, - VENDOR_ATTR_MS_MPPE_SEND_KEY, - VENDOR_ID_MICROSOFT); - if (ctx->encryptionType != ENCTYPE_NULL && vp != NULL) { + major = gssEapRadiusGetRawAvp(minor, ctx->acceptorCtx.avps, + PW_MS_MPPE_SEND_KEY, VENDORPEC_MS, &vp); + if (major == GSS_S_COMPLETE && ctx->encryptionType != ENCTYPE_NULL) { major = gssEapDeriveRfc3961Key(minor, - (unsigned char *)vp->strvalue, - vp->lvalue, + vp->vp_octets, + vp->length, ctx->encryptionType, &ctx->rfc3961Key); if (GSS_ERROR(major)) @@ -130,12 +129,6 @@ eapGssSmAcceptIdentity(OM_uint32 *minor, if (inputToken != GSS_C_NO_BUFFER && inputToken->length != 0) return GSS_S_DEFECTIVE_TOKEN; - assert(ctx->acceptorCtx.radHandle == NULL); - - major = gssEapRadiusAllocHandle(minor, cred, &ctx->acceptorCtx.radHandle); - if (GSS_ERROR(major)) - return major; - assert(ctx->acceptorName == GSS_C_NO_NAME); if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) { @@ -170,6 +163,9 @@ setAcceptorIdentity(OM_uint32 *minor, gss_buffer_desc nameBuf; krb5_context krbContext = NULL; krb5_principal krbPrinc; + struct rs_handle *rh = ctx->acceptorCtx.radHandle; + + assert(rh != NULL); /* Awaits further specification */ if (ctx->acceptorName == GSS_C_NO_NAME) @@ -186,20 +182,20 @@ setAcceptorIdentity(OM_uint32 *minor, /* Acceptor-Service-Name */ krbDataToGssBuffer(krb5_princ_component(krbContext, krbPrinc, 0), &nameBuf); - major = addAvpFromBuffer(minor, ctx->acceptorCtx.radHandle, avps, - VENDOR_ATTR_GSS_ACCEPTOR_SERVICE_NAME, - VENDOR_ID_UKERNA, - &nameBuf); + major = gssEapRadiusAddAvp(minor, rh, avps, + PW_GSS_ACCEPTOR_SERVICE_NAME, + VENDORPEC_UKERNA, + &nameBuf); if (GSS_ERROR(major)) return major; /* Acceptor-Host-Name */ krbDataToGssBuffer(krb5_princ_component(krbContext, krbPrinc, 1), &nameBuf); - major = addAvpFromBuffer(minor, ctx->acceptorCtx.radHandle, avps, - VENDOR_ATTR_GSS_ACCEPTOR_HOST_NAME, - VENDOR_ID_UKERNA, - &nameBuf); + major = gssEapRadiusAddAvp(minor, rh, avps, + PW_GSS_ACCEPTOR_HOST_NAME, + VENDORPEC_UKERNA, + &nameBuf); if (GSS_ERROR(major)) return major; @@ -219,10 +215,10 @@ setAcceptorIdentity(OM_uint32 *minor, nameBuf.value = ssi; nameBuf.length = strlen(ssi); - major = addAvpFromBuffer(minor, ctx->acceptorCtx.radHandle, avps, - VENDOR_ATTR_GSS_ACCEPTOR_SERVICE_SPECIFIC, - VENDOR_ID_UKERNA, - &nameBuf); + major = gssEapRadiusAddAvp(minor, rh, avps, + PW_GSS_ACCEPTOR_SERVICE_SPECIFIC, + VENDORPEC_UKERNA, + &nameBuf); if (GSS_ERROR(major)) { krb5_free_unparsed_name(krbContext, ssi); @@ -234,10 +230,10 @@ setAcceptorIdentity(OM_uint32 *minor, krbDataToGssBuffer(krb5_princ_realm(krbContext, krbPrinc), &nameBuf); if (nameBuf.length != 0) { /* Acceptor-Realm-Name */ - major = addAvpFromBuffer(minor, ctx->acceptorCtx.radHandle, avps, - VENDOR_ATTR_GSS_ACCEPTOR_REALM_NAME, - VENDOR_ID_UKERNA, - &nameBuf); + major = gssEapRadiusAddAvp(minor, rh, avps, + PW_GSS_ACCEPTOR_REALM_NAME, + VENDORPEC_UKERNA, + &nameBuf); if (GSS_ERROR(major)) return major; } @@ -254,83 +250,90 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor, gss_buffer_t outputToken) { OM_uint32 major, tmpMinor; - int code; - VALUE_PAIR *send = NULL; - VALUE_PAIR *received = NULL; - rc_handle *rh = ctx->acceptorCtx.radHandle; - char msgBuffer[4096]; - struct eap_hdr *pdu; - unsigned char *pos; - gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER; - - pdu = (struct eap_hdr *)inputToken->value; - pos = (unsigned char *)(pdu + 1); - - if (inputToken->length > sizeof(*pdu) && - pdu->code == EAP_CODE_RESPONSE && - pos[0] == EAP_TYPE_IDENTITY) { - /* - * XXX TODO do we really need to set User-Name? FreeRADIUS does - * not require it but some other RADIUS servers might. - */ - major = addAvpFromBuffer(minor, rh, &send, PW_USER_NAME, 0, &nameBuf); + struct rs_handle *rh; + struct rs_connection *rconn; + struct rs_packet *req = NULL, *resp = NULL; + struct radius_packet *frreq, *frresp; + int sendAcceptorIdentity = 0; + + if (ctx->acceptorCtx.radHandle == NULL) { + /* May be NULL from an imported partial context */ + major = gssEapRadiusAllocConn(minor, cred, ctx); if (GSS_ERROR(major)) goto cleanup; - major = setAcceptorIdentity(minor, ctx, &send); + sendAcceptorIdentity = 1; + } + + rh = ctx->acceptorCtx.radHandle; + rconn = ctx->acceptorCtx.radConn; + + if (rs_packet_create_acc_request(rconn, &req, NULL, NULL) != 0) { + major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn)); + goto cleanup; + } + frreq = rs_packet_frpkt(req); + + if (sendAcceptorIdentity) { + major = setAcceptorIdentity(minor, ctx, &frreq->vps); if (GSS_ERROR(major)) goto cleanup; } - major = addAvpFromBuffer(minor, rh, &send, PW_EAP_MESSAGE, 0, inputToken); + major = gssEapRadiusAddAvp(minor, rh, &frreq->vps, PW_EAP_MESSAGE, 0, inputToken); if (GSS_ERROR(major)) goto cleanup; - if (ctx->acceptorCtx.lastStatus == CHALLENGE_RC) { - major = addAvpFromBuffer(minor, rh, &send, PW_STATE, 0, - &ctx->acceptorCtx.state); + if (ctx->acceptorCtx.state.length != 0) { + major = gssEapRadiusAddAvp(minor, rh, &frreq->vps, PW_STATE, 0, + &ctx->acceptorCtx.state); if (GSS_ERROR(major)) goto cleanup; gss_release_buffer(&tmpMinor, &ctx->acceptorCtx.state); } - code = rc_auth(rh, 0, send, &received, msgBuffer); - switch (code) { - case OK_RC: - case CHALLENGE_RC: + if (rs_packet_send(req, NULL) != 0) { + major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn)); + goto cleanup; + } + req = NULL; + + if (rs_conn_receive_packet(rconn, &resp) != 0) { + major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn)); + goto cleanup; + } + + frresp = rs_packet_frpkt(resp); + switch (frresp->code) { + case PW_AUTHENTICATION_ACK: + case PW_ACCESS_CHALLENGE: major = GSS_S_CONTINUE_NEEDED; break; - case TIMEOUT_RC: - major = GSS_S_UNAVAILABLE; - break; - case REJECT_RC: + case PW_AUTHENTICATION_REJECT: major = GSS_S_DEFECTIVE_CREDENTIAL; + goto cleanup; break; default: major = GSS_S_FAILURE; goto cleanup; + break; } - if (GSS_ERROR(major)) - goto cleanup; - - ctx->acceptorCtx.lastStatus = code; - - major = getBufferFromAvps(minor, received, PW_EAP_MESSAGE, 0, - outputToken, TRUE); - if ((major == GSS_S_UNAVAILABLE && code != OK_RC) || + major = gssEapRadiusGetAvp(minor, frresp->vps, PW_EAP_MESSAGE, 0, + outputToken, TRUE); + if ((major == GSS_S_UNAVAILABLE && frresp->code != PW_AUTHENTICATION_ACK) || GSS_ERROR(major)) goto cleanup; - if (code == CHALLENGE_RC) { - major = getBufferFromAvps(minor, received, PW_STATE, 0, - &ctx->acceptorCtx.state, TRUE); + if (frresp->code == PW_ACCESS_CHALLENGE) { + major = gssEapRadiusGetAvp(minor, frresp->vps, PW_STATE, 0, + &ctx->acceptorCtx.state, TRUE); if (major != GSS_S_UNAVAILABLE && GSS_ERROR(major)) goto cleanup; } else { - ctx->acceptorCtx.avps = received; - received = NULL; + ctx->acceptorCtx.avps = frresp->vps; + frresp->vps = NULL; major = acceptReadyEap(minor, ctx, cred); if (GSS_ERROR(major)) @@ -342,8 +345,8 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor, major = GSS_S_CONTINUE_NEEDED; cleanup: - if (received != NULL) - rc_avpair_free(received); + rs_packet_destroy(req); + rs_packet_destroy(resp); return major; } @@ -519,6 +522,16 @@ gss_accept_sec_context(OM_uint32 *minor, GSSEAP_MUTEX_LOCK(&ctx->mutex); + /* Validate and lock credentials */ + if (cred != GSS_C_NO_CREDENTIAL) { + GSSEAP_MUTEX_LOCK(&cred->mutex); + + if ((cred->flags & CRED_FLAG_ACCEPT) == 0) { + major = GSS_S_NO_CRED; + goto cleanup; + } + } + sm = &eapGssAcceptorSm[ctx->state]; major = gssEapVerifyToken(minor, ctx, input_token, @@ -526,6 +539,11 @@ gss_accept_sec_context(OM_uint32 *minor, if (GSS_ERROR(major)) goto cleanup; + if (!gssEapCredAvailable(cred, ctx->mechanismUsed)) { + major = GSS_S_BAD_MECH; + goto cleanup; + } + #ifdef GSSEAP_ENABLE_REAUTH /* * If we're built with fast reauthentication support, it's valid @@ -542,19 +560,6 @@ gss_accept_sec_context(OM_uint32 *minor, goto cleanup; } - /* Validate and lock credentials */ - if (cred != GSS_C_NO_CREDENTIAL) { - if ((cred->flags & CRED_FLAG_ACCEPT) == 0) { - major = GSS_S_NO_CRED; - goto cleanup; - } else if (!gssEapCredAvailable(cred, ctx->mechanismUsed)) { - major = GSS_S_BAD_MECH; - goto cleanup; - } - - GSSEAP_MUTEX_LOCK(&cred->mutex); - } - do { sm = &eapGssAcceptorSm[ctx->state];