X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=accept_sec_context.c;h=d7a4708ff04fba50b529a5ebc9858262c7736cb4;hb=163856b1a70d7773c46d4ea5495b85c4dce0f089;hp=cefb5a9c24232d681265625f5fb5350536515537;hpb=1f273eda615c04331df6849cfbf3cfad069ea8b0;p=mech_eap.git

diff --git a/accept_sec_context.c b/accept_sec_context.c
index cefb5a9..d7a4708 100644
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -30,203 +30,301 @@
  * SUCH DAMAGE.
  */
 
+/*
+ * Establish a security context on the acceptor (server). These functions
+ * wrap around libradsec and (thus) talk to a RADIUS server or proxy.
+ */
+
 #include "gssapiP_eap.h"
 
-#ifdef BUILTIN_EAP
-#define EAP_KEY_AVAILABLE(ctx)  ((ctx)->acceptorCtx.eapPolInterface->eapKeyAvailable)
-#define EAP_KEY_DATA(ctx)       ((ctx)->acceptorCtx.eapPolInterface->eapKeyData)
-#define EAP_KEY_LENGTH(ctx)     ((ctx)->acceptorCtx.eapPolInterface->eapKeyDataLen)
-#else
-#define EAP_KEY_AVAILABLE(ctx)  0
-#define EAP_KEY_DATA(ctx)       NULL
-#define EAP_KEY_LENGTH(ctx)     0
-#endif /* BUILTIN_EAP */
+#ifdef GSSEAP_ENABLE_REAUTH
+static OM_uint32
+eapGssSmAcceptGssReauth(OM_uint32 *minor,
+                        gss_ctx_id_t ctx,
+                        gss_cred_id_t cred,
+                        gss_buffer_t inputToken,
+                        gss_channel_bindings_t chanBindings,
+                        gss_buffer_t outputToken);
+#endif
 
+/*
+ * Mark an acceptor context as ready for cryptographic operations
+ */
 static OM_uint32
-acceptReady(OM_uint32 *minor, gss_ctx_id_t ctx);
-
-#ifdef BUILTIN_EAP
-#define EAP_MAX_METHODS 8
-
-#define EAP_TTLS_AUTH_PAP 1
-#define EAP_TTLS_AUTH_CHAP 2
-#define EAP_TTLS_AUTH_MSCHAP 4
-#define EAP_TTLS_AUTH_MSCHAPV2 8
-
-struct eap_user {
-        struct {
-                int vendor;
-                u32 method;
-        } methods[EAP_MAX_METHODS];
-        u8 *password;
-        size_t password_len;
-        int password_hash; /* whether password is hashed with
-                            * nt_password_hash() */
-        int phase2;
-        int force_version;
-        int ttls_auth; /* bitfield of
-                        * EAP_TTLS_AUTH_{PAP,CHAP,MSCHAP,MSCHAPV2} */
-};
+acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
+{
+    OM_uint32 major, tmpMinor;
+    VALUE_PAIR *vp;
+    gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
 
-struct eap_eapol_interface {
-        /* Lower layer to full authenticator variables */
-        Boolean eapResp; /* shared with EAPOL Backend Authentication */
-        struct wpabuf *eapRespData;
-        Boolean portEnabled;
-        int retransWhile;
-        Boolean eapRestart; /* shared with EAPOL Authenticator PAE */
-        int eapSRTT;
-        int eapRTTVAR;
-
-        /* Full authenticator to lower layer variables */
-        Boolean eapReq; /* shared with EAPOL Backend Authentication */
-        Boolean eapNoReq; /* shared with EAPOL Backend Authentication */
-        Boolean eapSuccess;
-        Boolean eapFail;
-        Boolean eapTimeout;
-        struct wpabuf *eapReqData;
-        u8 *eapKeyData;
-        size_t eapKeyDataLen;
-        Boolean eapKeyAvailable; /* called keyAvailable in IEEE 802.1X-2004 */
-
-        /* AAA interface to full authenticator variables */
-        Boolean aaaEapReq;
-        Boolean aaaEapNoReq;
-        Boolean aaaSuccess;
-        Boolean aaaFail;
-        struct wpabuf *aaaEapReqData;
-        u8 *aaaEapKeyData;
-        size_t aaaEapKeyDataLen;
-        Boolean aaaEapKeyAvailable;
-        int aaaMethodTimeout;
-
-        /* Full authenticator to AAA interface variables */
-        Boolean aaaEapResp;
-        struct wpabuf *aaaEapRespData;
-        /* aaaIdentity -> eap_get_identity() */
-        Boolean aaaTimeout;
-};
+    /* Cache encryption type derived from selected mechanism OID */
+    major = gssEapOidToEnctype(minor, ctx->mechanismUsed,
+                               &ctx->encryptionType);
+    if (GSS_ERROR(major))
+        return major;
 
-#define eapol_callbacks     SERVER_eapol_callbacks
+    gssEapReleaseName(&tmpMinor, &ctx->initiatorName);
 
-struct eapol_callbacks {
-        int (*get_eap_user)(void *ctx, const u8 *identity, size_t identity_len,
-                            int phase2, struct eap_user *user);
-        const char * (*get_eap_req_id_text)(void *ctx, size_t *len);
-};
+    major = gssEapRadiusGetRawAvp(minor, ctx->acceptorCtx.vps,
+                                  PW_USER_NAME, 0, &vp);
+    if (major == GSS_S_COMPLETE) {
+        nameBuf.length = vp->length;
+        nameBuf.value = vp->vp_strvalue;
+    } else {
+        ctx->gssFlags |= GSS_C_ANON_FLAG;
+    }
 
-#define eap_config          SERVER_eap_config
-
-struct eap_config {
-        void *ssl_ctx;
-        void *msg_ctx;
-        void *eap_sim_db_priv;
-        Boolean backend_auth;
-        int eap_server;
-        u8 *pac_opaque_encr_key;
-        u8 *eap_fast_a_id;
-        size_t eap_fast_a_id_len;
-        char *eap_fast_a_id_info;
-        int eap_fast_prov;
-        int pac_key_lifetime;
-        int pac_key_refresh_time;
-        int eap_sim_aka_result_ind;
-        int tnc;
-        struct wps_context *wps;
-        const struct wpabuf *assoc_wps_ie;
-        const u8 *peer_addr;
-        int fragment_size;
-};
+    major = gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
+                             &ctx->initiatorName);
+    if (GSS_ERROR(major))
+        return major;
 
-struct eap_sm * eap_server_sm_init(void *eapol_ctx,
-                                   struct eapol_callbacks *eapol_cb,
-                                   struct eap_config *eap_conf);
-void eap_server_sm_deinit(struct eap_sm *sm);
-int eap_server_sm_step(struct eap_sm *sm);
-void eap_sm_notify_cached(struct eap_sm *sm);
-void eap_sm_pending_cb(struct eap_sm *sm);
-int eap_sm_method_pending(struct eap_sm *sm);
-const u8 * eap_get_identity(struct eap_sm *sm, size_t *len);
-struct eap_eapol_interface * eap_get_interface(struct eap_sm *sm);
+    major = gssEapRadiusGetRawAvp(minor, ctx->acceptorCtx.vps,
+                                  PW_MS_MPPE_SEND_KEY, VENDORPEC_MS, &vp);
+    if (GSS_ERROR(major)) {
+        *minor = GSSEAP_KEY_UNAVAILABLE;
+        return GSS_S_UNAVAILABLE;
+    }
 
-#include <eap_server/eap_i.h>
+    major = gssEapDeriveRfc3961Key(minor,
+                                   vp->vp_octets,
+                                   vp->length,
+                                   ctx->encryptionType,
+                                   &ctx->rfc3961Key);
+    if (GSS_ERROR(major))
+        return major;
 
-static OM_uint32
-initTls(OM_uint32 *minor,
-        gss_ctx_id_t ctx)
-{
-    struct tls_config tconf;
-    struct tls_connection_params tparams;
+    major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key,
+                                       &ctx->checksumType);
+    if (GSS_ERROR(major))
+        return major;
 
-    memset(&tconf, 0, sizeof(tconf));
-    ctx->acceptorCtx.tlsContext = tls_init(&tconf);
-    if (ctx->acceptorCtx.tlsContext == NULL)
-        return GSS_S_FAILURE;
+    major = sequenceInit(minor,
+                         &ctx->seqState, ctx->recvSeq,
+                         ((ctx->gssFlags & GSS_C_REPLAY_FLAG) != 0),
+                         ((ctx->gssFlags & GSS_C_SEQUENCE_FLAG) != 0),
+                         TRUE);
+    if (GSS_ERROR(major))
+        return major;
 
-    memset(&tparams, 0, sizeof(tparams));
-    tparams.ca_cert = "ca.pem";
-    tparams.client_cert = "server.pem";
-    tparams.private_key = "server-key.pem";
+    major = gssEapCreateAttrContext(minor, cred, ctx,
+                                    &ctx->initiatorName->attrCtx,
+                                    &ctx->expiryTime);
+    if (GSS_ERROR(major))
+        return major;
 
-    if (tls_global_set_params(ctx->acceptorCtx.tlsContext, &tparams)) {
-        return GSS_S_FAILURE;
+    *minor = 0;
+    return GSS_S_COMPLETE;
+}
+
+/*
+ * Emit a identity EAP request to force the initiator (peer) to identify
+ * itself.
+ */
+static OM_uint32
+eapGssSmAcceptIdentity(OM_uint32 *minor,
+                       gss_ctx_id_t ctx,
+                       gss_cred_id_t cred,
+                       gss_buffer_t inputToken,
+                       gss_channel_bindings_t chanBindings,
+                       gss_buffer_t outputToken)
+{
+    OM_uint32 major;
+    union {
+        struct eap_hdr pdu;
+        unsigned char data[5];
+    } pkt;
+    gss_buffer_desc pktBuffer;
+
+    if (inputToken != GSS_C_NO_BUFFER && inputToken->length != 0) {
+        *minor = GSSEAP_WRONG_SIZE;
+        return GSS_S_DEFECTIVE_TOKEN;
     }
 
-    if (tls_global_set_verify(ctx->acceptorCtx.tlsContext, 0)) {
-        return GSS_S_FAILURE;
+    assert(ctx->acceptorName == GSS_C_NO_NAME);
+
+    if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
+        major = gssEapDuplicateName(minor, cred->name, &ctx->acceptorName);
+        if (GSS_ERROR(major))
+            return major;
     }
 
-    return GSS_S_COMPLETE;
+    pkt.pdu.code = EAP_CODE_REQUEST;
+    pkt.pdu.identifier = 0;
+    pkt.pdu.length = htons(sizeof(pkt.data));
+    pkt.data[4] = EAP_TYPE_IDENTITY;
+
+    pktBuffer.length = sizeof(pkt.data);
+    pktBuffer.value = pkt.data;
+
+    major = duplicateBuffer(minor, &pktBuffer, outputToken);
+    if (GSS_ERROR(major))
+        return major;
+
+    ctx->state = GSSEAP_STATE_AUTHENTICATE;
+
+    *minor = 0;
+    return GSS_S_CONTINUE_NEEDED;
 }
 
-static int
-serverGetEapUser(void *ctx,
-                 const unsigned char *identity,
-                 size_t identityLength,
-                 int phase2,
-                 struct eap_user *user)
+/*
+ * Pass the asserted acceptor identity to the authentication server.
+ */
+static OM_uint32
+setAcceptorIdentity(OM_uint32 *minor,
+                    gss_ctx_id_t ctx,
+                    VALUE_PAIR **vps)
 {
-    gss_ctx_id_t gssCtx = (gss_ctx_id_t)ctx;
-    OM_uint32 major, minor;
-    gss_buffer_desc buf;
+    OM_uint32 major;
+    gss_buffer_desc nameBuf;
+    krb5_context krbContext = NULL;
+    krb5_principal krbPrinc;
+    struct rs_context *rc = ctx->acceptorCtx.radContext;
 
-    memset(user, 0, sizeof(*user));
+    assert(rc != NULL);
 
-    buf.length = identityLength;
-    buf.value = (void *)identity;
+    if (ctx->acceptorName == GSS_C_NO_NAME) {
+        *minor = 0;
+        return GSS_S_COMPLETE;
+    }
 
-    if (phase2 == 0) {
-        user->methods[0].vendor = EAP_VENDOR_IETF;
-        user->methods[0].method = EAP_TYPE_PEAP;
-        return 0;
+    if ((ctx->acceptorName->flags & NAME_FLAG_SERVICE) == 0) {
+        *minor = GSSEAP_BAD_SERVICE_NAME;
+        return GSS_S_BAD_NAME;
     }
 
-    major = gssEapImportName(&minor, &buf, GSS_C_NT_USER_NAME,
-                             &gssCtx->initiatorName);
+    GSSEAP_KRB_INIT(&krbContext);
+
+    krbPrinc = ctx->acceptorName->krbPrincipal;
+    assert(krbPrinc != NULL);
+    assert(KRB_PRINC_LENGTH(krbPrinc) >= 2);
+
+    /* Acceptor-Service-Name */
+    krbPrincComponentToGssBuffer(krbPrinc, 0, &nameBuf);
+
+    major = gssEapRadiusAddAvp(minor, vps,
+                               PW_GSS_ACCEPTOR_SERVICE_NAME,
+                               VENDORPEC_UKERNA,
+                               &nameBuf);
     if (GSS_ERROR(major))
-        return -1;
+        return major;
 
-    /*
-     * OK, obviously there is no real security here, this is simply
-     * for testing the token exchange; this code will be completely
-     * replaced with libradsec once that library is available.
-     */
-    user->methods[0].vendor = EAP_VENDOR_IETF;
-    user->methods[0].method = EAP_TYPE_MSCHAPV2;
-    user->password = (unsigned char *)strdup(" ");
-    user->password_len = 1;
+    /* Acceptor-Host-Name */
+    krbPrincComponentToGssBuffer(krbPrinc, 1, &nameBuf);
 
-    return 0;
+    major = gssEapRadiusAddAvp(minor, vps,
+                               PW_GSS_ACCEPTOR_HOST_NAME,
+                               VENDORPEC_UKERNA,
+                               &nameBuf);
+    if (GSS_ERROR(major))
+        return major;
+
+    if (KRB_PRINC_LENGTH(krbPrinc) > 2) {
+        /* Acceptor-Service-Specific */
+        krb5_principal_data ssiPrinc = *krbPrinc;
+        char *ssi;
+
+        KRB_PRINC_LENGTH(&ssiPrinc) -= 2;
+        KRB_PRINC_NAME(&ssiPrinc) += 2;
+
+        *minor = krb5_unparse_name_flags(krbContext, &ssiPrinc,
+                                         KRB5_PRINCIPAL_UNPARSE_NO_REALM, &ssi);
+        if (*minor != 0)
+            return GSS_S_FAILURE;
+
+        nameBuf.value = ssi;
+        nameBuf.length = strlen(ssi);
+
+        major = gssEapRadiusAddAvp(minor, vps,
+                                   PW_GSS_ACCEPTOR_SERVICE_SPECIFIC,
+                                   VENDORPEC_UKERNA,
+                                   &nameBuf);
+
+        if (GSS_ERROR(major)) {
+            krb5_free_unparsed_name(krbContext, ssi);
+            return major;
+        }
+        krb5_free_unparsed_name(krbContext, ssi);
+    }
+
+    krbPrincRealmToGssBuffer(krbPrinc, &nameBuf);
+    if (nameBuf.length != 0) {
+        /* Acceptor-Realm-Name */
+        major = gssEapRadiusAddAvp(minor, vps,
+                                   PW_GSS_ACCEPTOR_REALM_NAME,
+                                   VENDORPEC_UKERNA,
+                                   &nameBuf);
+        if (GSS_ERROR(major))
+            return major;
+    }
+
+    *minor = 0;
+    return GSS_S_COMPLETE;
 }
 
-static const char *
-serverGetEapReqIdText(void *ctx,
-                      size_t *len)
+/*
+ * Allocate a RadSec handle
+ */
+static OM_uint32
+createRadiusHandle(OM_uint32 *minor,
+                   gss_cred_id_t cred,
+                   gss_ctx_id_t ctx)
 {
-    *len = 0;
-    return NULL;
+    struct gss_eap_acceptor_ctx *actx = &ctx->acceptorCtx;
+    const char *configFile = RS_CONFIG_FILE;
+    const char *configStanza = "gss-eap";
+    struct rs_alloc_scheme ralloc;
+    struct rs_error *err;
+
+    assert(actx->radContext == NULL);
+    assert(actx->radConn == NULL);
+
+    if (rs_context_create(&actx->radContext, RS_DICT_FILE) != 0) {
+        *minor = GSSEAP_RADSEC_CONTEXT_FAILURE;
+        return GSS_S_FAILURE;
+    }
+
+    if (cred != GSS_C_NO_CREDENTIAL) {
+        if (cred->radiusConfigFile != NULL)
+            configFile = cred->radiusConfigFile;
+        if (cred->radiusConfigStanza != NULL)
+            configStanza = cred->radiusConfigStanza;
+    }
+
+    ralloc.calloc  = GSSEAP_CALLOC;
+    ralloc.malloc  = GSSEAP_MALLOC;
+    ralloc.free    = GSSEAP_FREE;
+    ralloc.realloc = GSSEAP_REALLOC;
+
+    rs_context_set_alloc_scheme(actx->radContext, &ralloc);
+
+    if (rs_context_read_config(actx->radContext, configFile) != 0) {
+        err = rs_err_ctx_pop(actx->radContext);
+        goto fail;
+    }
+
+    if (rs_conn_create(actx->radContext, &actx->radConn, configStanza) != 0) {
+        err = rs_err_conn_pop(actx->radConn);
+        goto fail;
+    }
+
+    if (actx->radServer != NULL) {
+        if (rs_conn_select_server(actx->radConn, actx->radServer) != 0) {
+            err = rs_err_conn_pop(actx->radConn);
+            goto fail;
+        }
+    }
+
+    *minor = 0;
+    return GSS_S_COMPLETE;
+
+fail:
+    return gssEapRadiusMapError(minor, err);
 }
 
+/*
+ * Process a EAP response from the initiator.
+ */
 static OM_uint32
 eapGssSmAcceptAuthenticate(OM_uint32 *minor,
                            gss_ctx_id_t ctx,
@@ -235,153 +333,154 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
                            gss_channel_bindings_t chanBindings,
                            gss_buffer_t outputToken)
 {
-    OM_uint32 major;
-    OM_uint32 tmpMinor, tmpMajor;
-    int code;
-    struct wpabuf respData;
-    static struct eapol_callbacks cb = { serverGetEapUser, serverGetEapReqIdText };
-    if (ctx->acceptorCtx.eap == NULL) {
-        struct eap_config eapConfig;
-
-        major = initTls(minor, ctx);
+    OM_uint32 major, tmpMinor;
+    struct rs_connection *rconn;
+    struct rs_request *request = NULL;
+    struct rs_packet *req = NULL, *resp = NULL;
+    struct radius_packet *frreq, *frresp;
+    int sendAcceptorIdentity = 0;
+
+    if (ctx->acceptorCtx.radContext == NULL) {
+        /* May be NULL from an imported partial context */
+        major = createRadiusHandle(minor, cred, ctx);
         if (GSS_ERROR(major))
             goto cleanup;
 
-        memset(&eapConfig, 0, sizeof(eapConfig));
-        eapConfig.eap_server = 1;
-        eapConfig.ssl_ctx = ctx->acceptorCtx.tlsContext;
+        sendAcceptorIdentity = 1;
+    }
 
-        ctx->acceptorCtx.eap = eap_server_sm_init(ctx, &cb, &eapConfig);
-        if (ctx->acceptorCtx.eap == NULL) {
-            major = GSS_S_FAILURE;
-            goto cleanup;
-        }
+    rconn = ctx->acceptorCtx.radConn;
 
-        ctx->acceptorCtx.eapPolInterface = eap_get_interface(ctx->acceptorCtx.eap);
-        ctx->acceptorCtx.eapPolInterface->portEnabled = TRUE;
-        ctx->acceptorCtx.eapPolInterface->eapRestart = TRUE;
+    if (rs_packet_create_acc_request(rconn, &req, NULL, NULL) != 0) {
+        major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
+        goto cleanup;
     }
+    frreq = rs_packet_frpkt(req);
 
-    if (ctx->acceptorName == GSS_C_NO_NAME &&
-        cred != GSS_C_NO_CREDENTIAL &&
-        cred->name != GSS_C_NO_NAME) {
-        major = gss_duplicate_name(minor, cred->name, &ctx->acceptorName);
+    if (sendAcceptorIdentity) {
+        major = setAcceptorIdentity(minor, ctx, &frreq->vps);
         if (GSS_ERROR(major))
             goto cleanup;
     }
 
-    wpabuf_set(&respData, inputToken->value, inputToken->length);
-    ctx->acceptorCtx.eapPolInterface->eapRespData = &respData;
-    ctx->acceptorCtx.eapPolInterface->eapResp = TRUE;
+    major = gssEapRadiusAddAvp(minor, &frreq->vps,
+                               PW_EAP_MESSAGE, 0, inputToken);
+    if (GSS_ERROR(major))
+        goto cleanup;
+
+    if (ctx->acceptorCtx.state.length != 0) {
+        major = gssEapRadiusAddAvp(minor, &frreq->vps, PW_STATE, 0,
+                                   &ctx->acceptorCtx.state);
+        if (GSS_ERROR(major))
+            goto cleanup;
 
-    code = eap_server_sm_step(ctx->acceptorCtx.eap);
+        gss_release_buffer(&tmpMinor, &ctx->acceptorCtx.state);
+    }
 
-    if (ctx->acceptorCtx.eapPolInterface->eapReq) {
-        ctx->acceptorCtx.eapPolInterface->eapReq = 0;
-        major = GSS_S_CONTINUE_NEEDED;
+    if (rs_request_create(rconn, &request) != 0 ||
+        rs_request_send(request, req, &resp) != 0) {
+        major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
+        goto cleanup;
     }
 
-    if (ctx->acceptorCtx.eapPolInterface->eapSuccess) {
-        ctx->acceptorCtx.eapPolInterface->eapSuccess = 0;
-        major = acceptReady(minor, ctx);
-        if (GSS_ERROR(major))
-            goto cleanup;
+    assert(resp != NULL);
 
-        ctx->state = EAP_STATE_GSS_CHANNEL_BINDINGS;
+    frresp = rs_packet_frpkt(resp);
+    switch (frresp->code) {
+    case PW_AUTHENTICATION_ACK:
+    case PW_ACCESS_CHALLENGE:
         major = GSS_S_CONTINUE_NEEDED;
-    } else if (ctx->acceptorCtx.eapPolInterface->eapFail) {
-        ctx->acceptorCtx.eapPolInterface->eapFail = 0;
-        major = GSS_S_FAILURE;
-    } else if (code == 0) {
+        break;
+    case PW_AUTHENTICATION_REJECT:
+        *minor = GSSEAP_RADIUS_AUTH_FAILURE;
+        major = GSS_S_DEFECTIVE_CREDENTIAL;
+        goto cleanup;
+        break;
+    default:
+        *minor = GSSEAP_UNKNOWN_RADIUS_CODE;
         major = GSS_S_FAILURE;
+        goto cleanup;
+        break;
     }
 
-    if (ctx->acceptorCtx.eapPolInterface->eapReqData != NULL) {
-        gss_buffer_desc buf;
+    major = gssEapRadiusGetAvp(minor, frresp->vps, PW_EAP_MESSAGE, 0,
+                               outputToken, TRUE);
+    if (major == GSS_S_UNAVAILABLE && frresp->code == PW_ACCESS_CHALLENGE) {
+        *minor = GSSEAP_MISSING_EAP_REQUEST;
+        major = GSS_S_DEFECTIVE_TOKEN;
+        goto cleanup;
+    } else if (GSS_ERROR(major))
+        goto cleanup;
 
-        buf.length = wpabuf_len(ctx->acceptorCtx.eapPolInterface->eapReqData);
-        buf.value = (void *)wpabuf_head(ctx->acceptorCtx.eapPolInterface->eapReqData);
+    if (frresp->code == PW_ACCESS_CHALLENGE) {
+        major = gssEapRadiusGetAvp(minor, frresp->vps, PW_STATE, 0,
+                                   &ctx->acceptorCtx.state, TRUE);
+        if (GSS_ERROR(major) && *minor != GSSEAP_NO_SUCH_ATTR)
+            goto cleanup;
+    } else {
+        ctx->acceptorCtx.vps = frresp->vps;
+        frresp->vps = NULL;
 
-        tmpMajor = duplicateBuffer(&tmpMinor, &buf, outputToken);
-        if (GSS_ERROR(tmpMajor)) {
-            major = tmpMajor;
-            *minor = tmpMinor;
+        rs_conn_destroy(ctx->acceptorCtx.radConn);
+        ctx->acceptorCtx.radConn = NULL;
+
+        major = acceptReadyEap(minor, ctx, cred);
+        if (GSS_ERROR(major))
             goto cleanup;
-        }
-    }
 
-cleanup:
-    ctx->acceptorCtx.eapPolInterface->eapRespData = NULL;
+        ctx->state = GSSEAP_STATE_EXTENSIONS_REQ;
+    }
 
-    return major;
-}
-#else
-static OM_uint32
-eapGssSmAcceptAuthenticate(OM_uint32 *minor,
-                           gss_ctx_id_t ctx,
-                           gss_cred_id_t cred,
-                           gss_buffer_t inputToken,
-                           gss_channel_bindings_t chanBindings,
-                           gss_buffer_t outputToken)
-{
-    OM_uint32 major, tmpMinor;
+    *minor = 0;
+    major = GSS_S_CONTINUE_NEEDED;
 
 cleanup:
+    rs_request_destroy(request);
+
     return major;
 }
-#endif /* BUILTIN_EAP */
 
 static OM_uint32
-eapGssSmAcceptGssChannelBindings(OM_uint32 *minor,
-                                 gss_ctx_id_t ctx,
-                                 gss_cred_id_t cred,
-                                 gss_buffer_t inputToken,
-                                 gss_channel_bindings_t chanBindings,
-                                 gss_buffer_t outputToken)
+eapGssSmAcceptExtensionsReq(OM_uint32 *minor,
+                            gss_ctx_id_t ctx,
+                            gss_cred_id_t cred,
+                            gss_buffer_t inputToken,
+                            gss_channel_bindings_t chanBindings,
+                            gss_buffer_t outputToken)
 {
-    OM_uint32 major, tmpMinor;
-    gss_iov_buffer_desc iov[2];
+    OM_uint32 major;
+
+    major = gssEapVerifyExtensions(minor, cred, ctx, chanBindings, inputToken);
+    if (GSS_ERROR(major))
+        return major;
 
     outputToken->length = 0;
     outputToken->value = NULL;
 
-    if (chanBindings == GSS_C_NO_CHANNEL_BINDINGS) {
-        ctx->state = EAP_STATE_ESTABLISHED;
-        return GSS_S_COMPLETE;
-    }
-
-    if (inputToken->length < 14) {
-        return GSS_S_DEFECTIVE_TOKEN;
-    }
+    ctx->state = GSSEAP_STATE_EXTENSIONS_RESP;
 
-    iov[0].type = GSS_IOV_BUFFER_TYPE_DATA;
-    iov[0].buffer.length = 0;
-    iov[0].buffer.value = NULL;
-
-    if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS)
-        iov[0].buffer = chanBindings->application_data;
-
-    iov[1].type = GSS_IOV_BUFFER_TYPE_HEADER;
-    iov[1].buffer.length = 16;
-    iov[1].buffer.value = (unsigned char *)inputToken->value - 2;
+    *minor = 0;
+    return GSS_S_CONTINUE_NEEDED;
+}
 
-    assert(load_uint16_be(iov[1].buffer.value) == TOK_TYPE_GSS_CB);
+static OM_uint32
+eapGssSmAcceptExtensionsResp(OM_uint32 *minor,
+                             gss_ctx_id_t ctx,
+                             gss_cred_id_t cred,
+                             gss_buffer_t inputToken,
+                             gss_channel_bindings_t chanBindings,
+                             gss_buffer_t outputToken)
+{
+    OM_uint32 major;
 
-    iov[2].type = GSS_IOV_BUFFER_TYPE_TRAILER;
-    iov[2].buffer.length = inputToken->length - 14;
-    iov[2].buffer.value = (unsigned char *)inputToken->value + 14;
+    major = gssEapMakeExtensions(minor, cred, ctx, chanBindings, outputToken);
+    if (GSS_ERROR(major))
+        return major;
 
-    major = gssEapUnwrapOrVerifyMIC(minor, ctx, NULL, NULL,
-                                    iov, 3, TOK_TYPE_GSS_CB);
-    if (major == GSS_S_COMPLETE) {
-        ctx->state = EAP_STATE_ESTABLISHED;
-    }
+    ctx->state = GSSEAP_STATE_ESTABLISHED;
 
-#if 0
-    gss_release_buffer(&tmpMinor, &iov[0].buffer);
-#endif
-
-    return major;
+    *minor = 0;
+    return GSS_S_COMPLETE;
 }
 
 static OM_uint32
@@ -393,10 +492,44 @@ eapGssSmAcceptEstablished(OM_uint32 *minor,
                           gss_buffer_t outputToken)
 {
     /* Called with already established context */
-    *minor = EINVAL;
+    *minor = GSSEAP_CONTEXT_ESTABLISHED;
     return GSS_S_BAD_STATUS;
 }
 
+static OM_uint32
+makeErrorToken(OM_uint32 *minor,
+               OM_uint32 majorStatus,
+               OM_uint32 minorStatus,
+               gss_buffer_t outputToken)
+{
+    unsigned char errorData[8];
+    gss_buffer_desc errorBuffer;
+
+    assert(GSS_ERROR(majorStatus));
+
+    /*
+     * Only return error codes that the initiator could have caused,
+     * to avoid information leakage.
+     */
+    if (IS_RADIUS_ERROR(minorStatus)) {
+        /* Squash RADIUS error codes */
+        minorStatus = GSSEAP_RADIUS_PROT_FAILURE;
+    } else if (!IS_WIRE_ERROR(minorStatus)) {
+        /* Don't return non-wire error codes */
+        return GSS_S_COMPLETE;
+    }
+
+    minorStatus -= ERROR_TABLE_BASE_eapg;
+
+    store_uint32_be(majorStatus, &errorData[0]);
+    store_uint32_be(minorStatus, &errorData[4]);
+
+    errorBuffer.length = sizeof(errorData);
+    errorBuffer.value = errorData;
+
+    return duplicateBuffer(minor, &errorBuffer, outputToken);
+}
+
 static struct gss_eap_acceptor_sm {
     enum gss_eap_token_type inputTokenType;
     enum gss_eap_token_type outputTokenType;
@@ -407,13 +540,15 @@ static struct gss_eap_acceptor_sm {
                               gss_channel_bindings_t,
                               gss_buffer_t);
 } eapGssAcceptorSm[] = {
-    { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,  eapGssSmAcceptAuthenticate       },
-#if 0
-    { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,  NULL                             },
-    { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,  NULL                             },
+    { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,       eapGssSmAcceptIdentity           },
+    { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,       eapGssSmAcceptAuthenticate       },
+    { TOK_TYPE_EXT_REQ,     TOK_TYPE_NONE,          eapGssSmAcceptExtensionsReq      },
+    { TOK_TYPE_NONE,        TOK_TYPE_EXT_RESP,      eapGssSmAcceptExtensionsResp     },
+    { TOK_TYPE_NONE,        TOK_TYPE_NONE,          eapGssSmAcceptEstablished        },
+    { TOK_TYPE_NONE,        TOK_TYPE_CONTEXT_ERR,   NULL                             },
+#ifdef GSSEAP_ENABLE_REAUTH
+    { TOK_TYPE_GSS_REAUTH,  TOK_TYPE_GSS_REAUTH,    eapGssSmAcceptGssReauth          },
 #endif
-    { TOK_TYPE_GSS_CB,      TOK_TYPE_NONE,     eapGssSmAcceptGssChannelBindings },
-    { TOK_TYPE_NONE,        TOK_TYPE_NONE,     eapGssSmAcceptEstablished        },
 };
 
 OM_uint32
@@ -433,21 +568,18 @@ gss_accept_sec_context(OM_uint32 *minor,
     OM_uint32 tmpMajor, tmpMinor;
     gss_ctx_id_t ctx = *context_handle;
     struct gss_eap_acceptor_sm *sm = NULL;
-    gss_buffer_desc innerInputToken, innerOutputToken;
+    gss_buffer_desc innerInputToken = GSS_C_EMPTY_BUFFER;
+    gss_buffer_desc innerOutputToken = GSS_C_EMPTY_BUFFER;
+    enum gss_eap_token_type tokType;
+    int initialContextToken = 0;
 
     *minor = 0;
 
-    innerOutputToken.length = 0;
-    innerOutputToken.value = NULL;
-
     output_token->length = 0;
     output_token->value = NULL;
 
-    if (cred != GSS_C_NO_CREDENTIAL && !(cred->flags & CRED_FLAG_ACCEPT)) {
-        return GSS_S_NO_CRED;
-    }
-
     if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) {
+        *minor = GSSEAP_TOK_TRUNC;
         return GSS_S_DEFECTIVE_TOKEN;
     }
 
@@ -456,24 +588,53 @@ gss_accept_sec_context(OM_uint32 *minor,
         if (GSS_ERROR(major))
             return major;
 
+        initialContextToken = 1;
         *context_handle = ctx;
     }
 
     GSSEAP_MUTEX_LOCK(&ctx->mutex);
 
+    /* Validate and lock credentials */
+    if (cred != GSS_C_NO_CREDENTIAL) {
+        GSSEAP_MUTEX_LOCK(&cred->mutex);
+
+        if ((cred->flags & CRED_FLAG_ACCEPT) == 0) {
+            *minor = GSSEAP_CRED_USAGE_MISMATCH;
+            major = GSS_S_NO_CRED;
+            goto cleanup;
+        }
+    }
+
     sm = &eapGssAcceptorSm[ctx->state];
 
     major = gssEapVerifyToken(minor, ctx, input_token,
-                              sm->inputTokenType, &innerInputToken);
+                              &tokType, &innerInputToken);
     if (GSS_ERROR(major))
         goto cleanup;
 
-    /* If credentials were provided, check they're usable with this mech */
     if (!gssEapCredAvailable(cred, ctx->mechanismUsed)) {
+        *minor = GSSEAP_CRED_MECH_MISMATCH;
         major = GSS_S_BAD_MECH;
         goto cleanup;
     }
 
+#ifdef GSSEAP_ENABLE_REAUTH
+    /*
+     * If we're built with fast reauthentication support, it's valid
+     * for an initiator to send a GSS reauthentication token as its
+     * initial context token, causing us to short-circuit the state
+     * machine and process Kerberos GSS messages instead.
+     */
+    if (tokType == TOK_TYPE_GSS_REAUTH && initialContextToken) {
+        ctx->state = GSSEAP_STATE_KRB_REAUTH;
+    } else
+#endif
+    if (tokType != sm->inputTokenType) {
+        *minor = GSSEAP_WRONG_TOK_ID;
+        major = GSS_S_DEFECTIVE_TOKEN;
+        goto cleanup;
+    }
+
     do {
         sm = &eapGssAcceptorSm[ctx->state];
 
@@ -483,23 +644,23 @@ gss_accept_sec_context(OM_uint32 *minor,
                                    &innerInputToken,
                                    input_chan_bindings,
                                    &innerOutputToken);
-        if (GSS_ERROR(major))
-            goto cleanup;
+        if (GSS_ERROR(major)) {
+            /* Possibly generate an error token */
+            tmpMajor = makeErrorToken(&tmpMinor, major, *minor, &innerOutputToken);
+            if (GSS_ERROR(tmpMajor)) {
+                major = tmpMajor;
+                goto cleanup;
+            }
+
+            sm = &eapGssAcceptorSm[GSSEAP_STATE_ERROR];
+            goto send_token;
+        }
     } while (major == GSS_S_CONTINUE_NEEDED && innerOutputToken.length == 0);
 
     if (mech_type != NULL) {
         if (!gssEapInternalizeOid(ctx->mechanismUsed, mech_type))
             duplicateOid(&tmpMinor, ctx->mechanismUsed, mech_type);
     }
-    if (innerOutputToken.length != 0) {
-        tmpMajor = gssEapMakeToken(&tmpMinor, ctx, &innerOutputToken,
-                                   sm->outputTokenType, output_token);
-        if (GSS_ERROR(tmpMajor)) {
-            major = tmpMajor;
-            *minor = tmpMinor;
-            goto cleanup;
-        }
-    }
     if (ret_flags != NULL)
         *ret_flags = ctx->gssFlags;
     if (delegated_cred_handle != NULL)
@@ -507,17 +668,33 @@ gss_accept_sec_context(OM_uint32 *minor,
 
     if (major == GSS_S_COMPLETE) {
         if (src_name != NULL && ctx->initiatorName != GSS_C_NO_NAME) {
-            major = gss_duplicate_name(&tmpMinor, ctx->initiatorName, src_name);
+            major = gssEapDuplicateName(&tmpMinor, ctx->initiatorName, src_name);
+            if (GSS_ERROR(major))
+                goto cleanup;
+        }
+        if (time_rec != NULL) {
+            major = gssEapContextTime(&tmpMinor, ctx, time_rec);
             if (GSS_ERROR(major))
                 goto cleanup;
         }
-        if (time_rec != NULL)
-            gss_context_time(&tmpMinor, ctx, time_rec);
     }
 
-    assert(ctx->state == EAP_STATE_ESTABLISHED || major == GSS_S_CONTINUE_NEEDED);
+    assert(ctx->state == GSSEAP_STATE_ESTABLISHED || major == GSS_S_CONTINUE_NEEDED);
+
+send_token:
+    if (innerOutputToken.value != NULL) {
+        tmpMajor = gssEapMakeToken(&tmpMinor, ctx, &innerOutputToken,
+                                   sm->outputTokenType, output_token);
+        if (GSS_ERROR(tmpMajor)) {
+            major = tmpMajor;
+            *minor = tmpMinor;
+            goto cleanup;
+        }
+    }
 
 cleanup:
+    if (cred != GSS_C_NO_CREDENTIAL)
+        GSSEAP_MUTEX_UNLOCK(&cred->mutex);
     GSSEAP_MUTEX_UNLOCK(&ctx->mutex);
 
     if (GSS_ERROR(major))
@@ -528,49 +705,76 @@ cleanup:
     return major;
 }
 
-/*
- * Mark a context as ready for cryptographic operations
- */
+#ifdef GSSEAP_ENABLE_REAUTH
 static OM_uint32
-acceptReady(OM_uint32 *minor, gss_ctx_id_t ctx)
+acceptReadyKrb(OM_uint32 *minor,
+               gss_ctx_id_t ctx,
+               gss_cred_id_t cred,
+               const gss_name_t initiator,
+               const gss_OID mech,
+               OM_uint32 timeRec)
 {
     OM_uint32 major;
 
-    /* Cache encryption type derived from selected mechanism OID */
-    major = gssEapOidToEnctype(minor, ctx->mechanismUsed, &ctx->encryptionType);
+    major = gssEapGlueToMechName(minor, initiator, &ctx->initiatorName);
     if (GSS_ERROR(major))
         return major;
 
-    if (ctx->encryptionType != ENCTYPE_NULL &&
-        EAP_KEY_AVAILABLE(ctx)) {
-        major = gssEapDeriveRfc3961Key(minor,
-                                       EAP_KEY_DATA(ctx),
-                                       EAP_KEY_LENGTH(ctx),
-                                       ctx->encryptionType,
-                                       &ctx->rfc3961Key);
-        if (GSS_ERROR(major))
-            return major;
-
-        major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key,
-                                           &ctx->checksumType);
+    if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
+        major = gssEapDuplicateName(minor, cred->name, &ctx->acceptorName);
         if (GSS_ERROR(major))
             return major;
-    } else {
-        /*
-         * draft-howlett-eap-gss says that integrity/confidentialty should
-         * always be advertised as available, but if we have no keying
-         * material it seems confusing to the caller to advertise this.
-         */
-        ctx->gssFlags &= ~(GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
     }
 
-    major = sequenceInit(minor,
-                         &ctx->seqState, ctx->recvSeq,
-                         ((ctx->gssFlags & GSS_C_REPLAY_FLAG) != 0),
-                         ((ctx->gssFlags & GSS_C_SEQUENCE_FLAG) != 0),
-                         TRUE);
+    major = gssEapReauthComplete(minor, ctx, cred, mech, timeRec);
     if (GSS_ERROR(major))
         return major;
 
+    ctx->state = GSSEAP_STATE_ESTABLISHED;
+
+    *minor = 0;
     return GSS_S_COMPLETE;
 }
+
+static OM_uint32
+eapGssSmAcceptGssReauth(OM_uint32 *minor,
+                        gss_ctx_id_t ctx,
+                        gss_cred_id_t cred,
+                        gss_buffer_t inputToken,
+                        gss_channel_bindings_t chanBindings,
+                        gss_buffer_t outputToken)
+{
+    OM_uint32 major, tmpMinor;
+    gss_cred_id_t krbCred = GSS_C_NO_CREDENTIAL;
+    gss_name_t krbInitiator = GSS_C_NO_NAME;
+    gss_OID mech = GSS_C_NO_OID;
+    OM_uint32 gssFlags, timeRec = GSS_C_INDEFINITE;
+
+    ctx->flags |= CTX_FLAG_KRB_REAUTH;
+
+    if (cred != GSS_C_NO_CREDENTIAL)
+        krbCred = cred->krbCred;
+
+    major = gssAcceptSecContext(minor,
+                                &ctx->kerberosCtx,
+                                krbCred,
+                                inputToken,
+                                chanBindings,
+                                &krbInitiator,
+                                &mech,
+                                outputToken,
+                                &gssFlags,
+                                &timeRec,
+                                NULL);
+    if (major == GSS_S_COMPLETE) {
+        major = acceptReadyKrb(minor, ctx, cred,
+                               krbInitiator, mech, timeRec);
+    }
+
+    ctx->gssFlags = gssFlags;
+
+    gssReleaseName(&tmpMinor, &krbInitiator);
+
+    return major;
+}
+#endif /* GSSEAP_ENABLE_REAUTH */