X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=init_sec_context.c;h=e3b4d630961df4219d7a9504e0c42b6187c466cd;hb=c3ff83a02d37820b9c70cc3746c72a900dfd85ac;hp=1268d20cd539f5b1a8eb73a22367db9052ce234e;hpb=4064e866bb8ca6458ff0152364c3b2d62a18e45d;p=mech_eap.orig diff --git a/init_sec_context.c b/init_sec_context.c index 1268d20..e3b4d63 100644 --- a/init_sec_context.c +++ b/init_sec_context.c @@ -32,6 +32,23 @@ #include "gssapiP_eap.h" +#ifdef GSSEAP_ENABLE_REAUTH +static int +canReauthP(gss_cred_id_t cred); + +static OM_uint32 +eapGssSmInitGssReauth(OM_uint32 *minor, + gss_cred_id_t cred, + gss_ctx_id_t ctx, + gss_name_t target, + gss_OID mech, + OM_uint32 reqFlags, + OM_uint32 timeReq, + gss_channel_bindings_t chanBindings, + gss_buffer_t inputToken, + gss_buffer_t outputToken); +#endif + static OM_uint32 policyVariableToFlag(enum eapol_bool_var variable) { @@ -234,25 +251,37 @@ initReady(OM_uint32 *minor, gss_ctx_id_t ctx) OM_uint32 major; const unsigned char *key; size_t keyLength; + krb5_enctype encryptionType; + int gotKey = 0; /* Cache encryption type derived from selected mechanism OID */ - major = gssEapOidToEnctype(minor, ctx->mechanismUsed, &ctx->encryptionType); + major = gssEapOidToEnctype(minor, ctx->mechanismUsed, &encryptionType); if (GSS_ERROR(major)) return major; - if (ctx->encryptionType != ENCTYPE_NULL && + if (encryptionType != ENCTYPE_NULL && eap_key_available(ctx->initiatorCtx.eap)) { key = eap_get_eapKeyData(ctx->initiatorCtx.eap, &keyLength); - major = gssEapDeriveRfc3961Key(minor, key, keyLength, - ctx->encryptionType, &ctx->rfc3961Key); - if (GSS_ERROR(major)) - return major; + if (keyLength >= EAP_EMSK_LEN) { + major = gssEapDeriveRfc3961Key(minor, + &key[EAP_EMSK_LEN / 2], + EAP_EMSK_LEN / 2, + encryptionType, + &ctx->rfc3961Key); + if (GSS_ERROR(major)) + return major; + + major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key, + &ctx->checksumType); + if (GSS_ERROR(major)) + return major; + gotKey++; + } + } - major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key, - &ctx->checksumType); - if (GSS_ERROR(major)) - return major; + if (gotKey) { + ctx->encryptionType = encryptionType; } else { /* * draft-howlett-eap-gss says that integrity/confidentialty should @@ -275,37 +304,33 @@ initReady(OM_uint32 *minor, gss_ctx_id_t ctx) } static OM_uint32 -eapGssSmInitIdentity(OM_uint32 *minor, - gss_cred_id_t cred, - gss_ctx_id_t ctx, - gss_name_t target, - gss_OID mech, - OM_uint32 reqFlags, - OM_uint32 timeReq, - gss_channel_bindings_t chanBindings, - gss_buffer_t inputToken, - gss_buffer_t outputToken) +initBegin(OM_uint32 *minor, + gss_cred_id_t cred, + gss_ctx_id_t ctx, + gss_name_t target, + gss_OID mech, + OM_uint32 reqFlags, + OM_uint32 timeReq, + gss_channel_bindings_t chanBindings, + gss_buffer_t inputToken, + gss_buffer_t outputToken) { - time_t now; OM_uint32 major; - int initialContextToken; - - initialContextToken = (inputToken == GSS_C_NO_BUFFER || - inputToken->length == 0); - if (!initialContextToken) - return GSS_S_DEFECTIVE_TOKEN; - time(&now); - if (timeReq == 0 || timeReq == GSS_C_INDEFINITE) + if (cred != GSS_C_NO_CREDENTIAL && cred->expiryTime) + ctx->expiryTime = cred->expiryTime; + else if (timeReq == 0 || timeReq == GSS_C_INDEFINITE) ctx->expiryTime = 0; else - ctx->expiryTime = now + timeReq; + ctx->expiryTime = time(NULL) + timeReq; - major = gss_duplicate_name(minor, cred->name, &ctx->initiatorName); - if (GSS_ERROR(major)) - return major; + if (cred != GSS_C_NO_CREDENTIAL) { + major = gssEapDuplicateName(minor, cred->name, &ctx->initiatorName); + if (GSS_ERROR(major)) + return major; + } - major = gss_duplicate_name(minor, target, &ctx->acceptorName); + major = gssEapDuplicateName(minor, target, &ctx->acceptorName); if (GSS_ERROR(major)) return major; @@ -324,6 +349,34 @@ eapGssSmInitIdentity(OM_uint32 *minor, if (!gssEapCredAvailable(cred, ctx->mechanismUsed)) return GSS_S_BAD_MECH; + return GSS_S_COMPLETE; +} + +static OM_uint32 +eapGssSmInitIdentity(OM_uint32 *minor, + gss_cred_id_t cred, + gss_ctx_id_t ctx, + gss_name_t target, + gss_OID mech, + OM_uint32 reqFlags, + OM_uint32 timeReq, + gss_channel_bindings_t chanBindings, + gss_buffer_t inputToken, + gss_buffer_t outputToken) +{ + OM_uint32 major; + int initialContextToken; + + initialContextToken = (inputToken->length == 0); + if (!initialContextToken) + return GSS_S_DEFECTIVE_TOKEN; + + major = initBegin(minor, cred, ctx, target, mech, + reqFlags, timeReq, chanBindings, + inputToken, outputToken); + if (GSS_ERROR(major)) + return major; + ctx->state = EAP_STATE_AUTHENTICATE; return GSS_S_CONTINUE_NEEDED; @@ -392,14 +445,14 @@ eapGssSmInitAuthenticate(OM_uint32 *minor, ctx->flags &= ~(CTX_FLAG_EAP_SUCCESS); major = GSS_S_CONTINUE_NEEDED; - ctx->state = EAP_STATE_GSS_CHANNEL_BINDINGS; + ctx->state = EAP_STATE_EXTENSIONS_REQ; } else if (ctx->flags & CTX_FLAG_EAP_FAIL) { major = GSS_S_DEFECTIVE_CREDENTIAL; } else if (code == 0 && initialContextToken) { resp = &emptyWpaBuffer; major = GSS_S_CONTINUE_NEEDED; } else { - major = GSS_S_FAILURE; + major = GSS_S_DEFECTIVE_TOKEN; } cleanup: @@ -426,55 +479,81 @@ cleanup: } static OM_uint32 -eapGssSmInitGssChannelBindings(OM_uint32 *minor, - gss_cred_id_t cred, - gss_ctx_id_t ctx, - gss_name_t target, - gss_OID mech, - OM_uint32 reqFlags, - OM_uint32 timeReq, - gss_channel_bindings_t chanBindings, - gss_buffer_t inputToken, - gss_buffer_t outputToken) +initGssChannelBindings(OM_uint32 *minor, + gss_ctx_id_t ctx, + gss_channel_bindings_t chanBindings, + gss_buffer_t outputToken) { OM_uint32 major; - gss_iov_buffer_desc iov[2]; - gss_buffer_desc buf; - - iov[0].type = GSS_IOV_BUFFER_TYPE_DATA; - iov[0].buffer.length = 0; - iov[0].buffer.value = NULL; + gss_buffer_desc buffer = GSS_C_EMPTY_BUFFER; - iov[1].type = GSS_IOV_BUFFER_TYPE_HEADER | GSS_IOV_BUFFER_FLAG_ALLOCATE; - iov[1].buffer.length = 0; - iov[1].buffer.value = NULL; if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS) - iov[0].buffer = chanBindings->application_data; + buffer = chanBindings->application_data; - major = gssEapWrapOrGetMIC(minor, ctx, FALSE, FALSE, iov, 2, - TOK_TYPE_GSS_CB); + major = gssEapWrap(minor, ctx, TRUE, GSS_C_QOP_DEFAULT, + &buffer, NULL, outputToken); if (GSS_ERROR(major)) - goto cleanup; + return major; - /* Skip past token ID */ - assert(iov[1].buffer.length > 2); - assert(load_uint16_be(iov[1].buffer.value) == TOK_TYPE_GSS_CB); + return GSS_S_CONTINUE_NEEDED; +} - buf.length = iov[1].buffer.length - 2; - buf.value = (unsigned char *)iov[1].buffer.value + 2; +static OM_uint32 +eapGssSmInitExtensionsReq(OM_uint32 *minor, + gss_cred_id_t cred, + gss_ctx_id_t ctx, + gss_name_t target, + gss_OID mech, + OM_uint32 reqFlags, + OM_uint32 timeReq, + gss_channel_bindings_t chanBindings, + gss_buffer_t inputToken, + gss_buffer_t outputToken) +{ + OM_uint32 major, tmpMinor; + gss_buffer_desc cbToken = GSS_C_EMPTY_BUFFER; - major = duplicateBuffer(minor, &buf, outputToken); + major = initGssChannelBindings(minor, ctx, chanBindings, &cbToken); if (GSS_ERROR(major)) - goto cleanup; + return major; - major = GSS_S_COMPLETE; - ctx->state = EAP_STATE_ESTABLISHED; + ctx->state = EAP_STATE_EXTENSIONS_RESP; -cleanup: - gssEapReleaseIov(iov, 2); + major = duplicateBuffer(minor, &cbToken, outputToken); + if (GSS_ERROR(major)) { + gss_release_buffer(&tmpMinor, &cbToken); + return major; + } - return major; + gss_release_buffer(&tmpMinor, &cbToken); + + return GSS_S_CONTINUE_NEEDED; +} + +static OM_uint32 +eapGssSmInitExtensionsResp(OM_uint32 *minor, + gss_cred_id_t cred, + gss_ctx_id_t ctx, + gss_name_t target, + gss_OID mech, + OM_uint32 reqFlags, + OM_uint32 timeReq, + gss_channel_bindings_t chanBindings, + gss_buffer_t inputToken, + gss_buffer_t outputToken) +{ +#ifdef GSSEAP_ENABLE_REAUTH + OM_uint32 major; + + major = gssEapStoreReauthCreds(minor, ctx, cred, inputToken); + if (GSS_ERROR(major)) + return major; +#endif + + ctx->state = EAP_STATE_ESTABLISHED; + + return GSS_S_COMPLETE; } static OM_uint32 @@ -508,10 +587,14 @@ static struct gss_eap_initiator_sm { gss_buffer_t, gss_buffer_t); } eapGssInitiatorSm[] = { - { TOK_TYPE_NONE, TOK_TYPE_EAP_RESP, eapGssSmInitIdentity }, - { TOK_TYPE_EAP_REQ, TOK_TYPE_EAP_RESP, eapGssSmInitAuthenticate }, - { TOK_TYPE_NONE, TOK_TYPE_GSS_CB, eapGssSmInitGssChannelBindings }, - { TOK_TYPE_NONE, TOK_TYPE_NONE, eapGssSmInitEstablished }, + { TOK_TYPE_NONE, TOK_TYPE_EAP_RESP, eapGssSmInitIdentity }, + { TOK_TYPE_EAP_REQ, TOK_TYPE_EAP_RESP, eapGssSmInitAuthenticate }, + { TOK_TYPE_NONE, TOK_TYPE_EXT_REQ, eapGssSmInitExtensionsReq }, + { TOK_TYPE_EXT_RESP,TOK_TYPE_NONE, eapGssSmInitExtensionsResp }, + { TOK_TYPE_NONE, TOK_TYPE_NONE, eapGssSmInitEstablished }, +#ifdef GSSEAP_ENABLE_REAUTH + { TOK_TYPE_GSS_REAUTH, TOK_TYPE_GSS_REAUTH, eapGssSmInitGssReauth }, +#endif }; OM_uint32 @@ -535,6 +618,7 @@ gss_init_sec_context(OM_uint32 *minor, struct gss_eap_initiator_sm *sm = NULL; gss_buffer_desc innerInputToken; gss_buffer_desc innerOutputToken = GSS_C_EMPTY_BUFFER; + enum gss_eap_token_type tokType; *minor = 0; @@ -556,6 +640,11 @@ gss_init_sec_context(OM_uint32 *minor, ctx->flags |= CTX_FLAG_INITIATOR; +#ifdef GSSEAP_ENABLE_REAUTH + if (canReauthP(cred)) + ctx->state = EAP_STATE_KRB_REAUTH_GSS; +#endif + *context_handle = ctx; } @@ -565,9 +654,14 @@ gss_init_sec_context(OM_uint32 *minor, if (input_token != GSS_C_NO_BUFFER) { major = gssEapVerifyToken(minor, ctx, input_token, - sm->inputTokenType, &innerInputToken); + &tokType, &innerInputToken); if (GSS_ERROR(major)) goto cleanup; + + if (tokType != sm->inputTokenType) { + major = GSS_S_DEFECTIVE_TOKEN; + goto cleanup; + } } else { innerInputToken.length = 0; innerInputToken.value = NULL; @@ -610,7 +704,7 @@ gss_init_sec_context(OM_uint32 *minor, if (ret_flags != NULL) *ret_flags = ctx->gssFlags; if (time_rec != NULL) - gss_context_time(&tmpMinor, ctx, time_rec); + gssEapContextTime(&tmpMinor, ctx, time_rec); assert(ctx->state == EAP_STATE_ESTABLISHED || major == GSS_S_CONTINUE_NEEDED); @@ -624,3 +718,79 @@ cleanup: return major; } + +#ifdef GSSEAP_ENABLE_REAUTH +static int +canReauthP(gss_cred_id_t cred) +{ + return (cred != GSS_C_NO_CREDENTIAL && + cred->krbCred != GSS_C_NO_CREDENTIAL && + cred->expiryTime > time(NULL)); +} + +static OM_uint32 +eapGssSmInitGssReauth(OM_uint32 *minor, + gss_cred_id_t cred, + gss_ctx_id_t ctx, + gss_name_t target, + gss_OID mech, + OM_uint32 reqFlags, + OM_uint32 timeReq, + gss_channel_bindings_t chanBindings, + gss_buffer_t inputToken, + gss_buffer_t outputToken) +{ + OM_uint32 major, tmpMinor; + gss_name_t mechTarget = GSS_C_NO_NAME; + gss_OID actualMech = GSS_C_NO_OID; + OM_uint32 gssFlags, timeRec; + + assert(cred != GSS_C_NO_CREDENTIAL); + + ctx->flags |= CTX_FLAG_KRB_REAUTH_GSS; + + if (inputToken->length == 0) { + major = initBegin(minor, cred, ctx, target, mech, + reqFlags, timeReq, chanBindings, + inputToken, outputToken); + if (GSS_ERROR(major)) + goto cleanup; + } + + major = gssEapMechToGlueName(minor, target, &mechTarget); + if (GSS_ERROR(major)) + goto cleanup; + + major = gssInitSecContext(minor, + cred->krbCred, + &ctx->kerberosCtx, + mechTarget, + (gss_OID)gss_mech_krb5, + reqFlags, /* | GSS_C_DCE_STYLE, */ + timeReq, + chanBindings, + inputToken, + &actualMech, + outputToken, + &gssFlags, + &timeRec); + if (GSS_ERROR(major)) + goto cleanup; + + ctx->gssFlags = gssFlags; + + if (major == GSS_S_COMPLETE) { + major = gssEapReauthComplete(minor, ctx, cred, actualMech, timeRec); + if (GSS_ERROR(major)) + goto cleanup; + ctx->state = EAP_STATE_ESTABLISHED; + } + +cleanup: + gssReleaseName(&tmpMinor, &mechTarget); + + return major; +} +#endif /* GSSEAP_ENABLE_REAUTH */ + +