X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=mech_eap%2Futil_attr.cpp;h=48c4291444993fcea3dd8146027e8a8b26ff766b;hb=refs%2Fheads%2Fddf-name;hp=522864546076e536191871a8e188b532bb5eced6;hpb=98729e7570442335c3825a17fb3fe4a725d255a3;p=moonshot.git

diff --git a/mech_eap/util_attr.cpp b/mech_eap/util_attr.cpp
index 5228645..48c4291 100644
--- a/mech_eap/util_attr.cpp
+++ b/mech_eap/util_attr.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, JANET(UK)
+ * Copyright (c) 2011, JANET(UK)
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,69 +30,390 @@
  * SUCH DAMAGE.
  */
 
+/*
+ * Attribute provider mechanism.
+ */
+
 #include "gssapiP_eap.h"
 
+#include <typeinfo>
 #include <string>
+#include <sstream>
 #include <exception>
 #include <new>
 
-static gss_eap_attr_create_cb
-gss_eap_attr_factories[ATTR_TYPE_MAX] = {
-    gss_eap_radius_attr_provider::createAttrContext,
-    gss_eap_saml_assertion_provider::createAttrContext,
-    gss_eap_saml_attr_provider::createAttrContext,
-    gss_eap_shib_attr_provider::createAttrContext
-};
+/* lazy initialisation */
+static GSSEAP_THREAD_ONCE gssEapAttrProvidersInitOnce = GSSEAP_ONCE_INITIALIZER;
+static OM_uint32 gssEapAttrProvidersInitStatus = GSS_S_UNAVAILABLE;
+
+static void
+gssEapAttrProvidersInitInternal(void)
+{
+    OM_uint32 major, minor;
+
+    assert(gssEapAttrProvidersInitStatus == GSS_S_UNAVAILABLE);
+
+    major = gssEapRadiusAttrProviderInit(&minor);
+    if (major == GSS_S_COMPLETE)
+        major = gssEapSamlAttrProvidersInit(&minor);
+    if (major == GSS_S_COMPLETE)
+        major = gssEapLocalAttrProviderInit(&minor);
+
+#ifdef GSSEAP_DEBUG
+    assert(major == GSS_S_COMPLETE);
+#endif
+
+    gssEapAttrProvidersInitStatus = major;
+}
+
+static OM_uint32
+gssEapAttrProvidersInit(OM_uint32 *minor)
+{
+    GSSEAP_ONCE(&gssEapAttrProvidersInitOnce, gssEapAttrProvidersInitInternal);
+
+    if (GSS_ERROR(gssEapAttrProvidersInitStatus))
+        *minor = GSSEAP_NO_ATTR_PROVIDERS;
+
+    return gssEapAttrProvidersInitStatus;
+}
+
+OM_uint32
+gssEapAttrProvidersFinalize(OM_uint32 *minor)
+{
+    OM_uint32 major = GSS_S_COMPLETE;
+
+    if (gssEapAttrProvidersInitStatus == GSS_S_COMPLETE) {
+        major = gssEapLocalAttrProviderFinalize(minor);
+        if (major == GSS_S_COMPLETE)
+            major = gssEapSamlAttrProvidersFinalize(minor);
+        if (major == GSS_S_COMPLETE)
+            major = gssEapRadiusAttrProviderFinalize(minor);
+
+        gssEapAttrProvidersInitStatus = GSS_S_UNAVAILABLE;
+    }
+
+    return major;
+}
+
+static gss_eap_attr_create_provider gssEapAttrFactories[ATTR_TYPE_MAX + 1];
+static gss_buffer_desc gssEapAttrPrefixes[ATTR_TYPE_MAX + 1];
 
-gss_eap_attr_ctx *
-gss_eap_attr_ctx::createAttrContext(gss_cred_id_t gssCred,
-                                    gss_ctx_id_t gssCtx)
+/*
+ * Register a provider for a particular type and prefix
+ */
+void
+gss_eap_attr_ctx::registerProvider(unsigned int type,
+                                   const char *prefix,
+                                   gss_eap_attr_create_provider factory)
 {
-    gss_eap_attr_ctx *ctx;
+    assert(type <= ATTR_TYPE_MAX);
 
-    ctx = new gss_eap_attr_ctx(NULL, gssCred, gssCtx);
+    assert(gssEapAttrFactories[type] == NULL);
 
-    for (unsigned int i = 0; i < ATTR_TYPE_MAX; i++) {
+    gssEapAttrFactories[type] = factory;
+    if (prefix != NULL) {
+        gssEapAttrPrefixes[type].value = (void *)prefix;
+        gssEapAttrPrefixes[type].length = strlen(prefix);
+    } else {
+        gssEapAttrPrefixes[type].value = NULL;
+        gssEapAttrPrefixes[type].length = 0;
+    }
+}
+
+/*
+ * Unregister a provider
+ */
+void
+gss_eap_attr_ctx::unregisterProvider(unsigned int type)
+{
+    assert(type <= ATTR_TYPE_MAX);
+
+    gssEapAttrFactories[type] = NULL;
+    gssEapAttrPrefixes[type].value = NULL;
+    gssEapAttrPrefixes[type].length = 0;
+}
+
+/*
+ * Create an attribute context, that manages instances of providers
+ */
+gss_eap_attr_ctx::gss_eap_attr_ctx(void)
+{
+    m_flags = 0;
+
+    for (unsigned int i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
         gss_eap_attr_provider *provider;
 
-        provider = (gss_eap_attr_factories[i])(ctx, gssCred, gssCtx);
-        if (provider != NULL)
-            ctx->m_providers[i] = provider;
+        if (gssEapAttrFactories[i] != NULL) {
+            provider = (gssEapAttrFactories[i])();
+        } else {
+            provider = NULL;
+        }
+
+        m_providers[i] = provider;
     }
+}
 
-    return ctx;
+/*
+ * Convert an attribute prefix to a type
+ */
+unsigned int
+gss_eap_attr_ctx::attributePrefixToType(const gss_buffer_t prefix)
+{
+    unsigned int i;
+
+    for (i = ATTR_TYPE_MIN; i < ATTR_TYPE_MAX; i++) {
+        if (bufferEqual(&gssEapAttrPrefixes[i], prefix))
+            return i;
+    }
+
+    return ATTR_TYPE_LOCAL;
 }
 
-gss_eap_attr_ctx::~gss_eap_attr_ctx(void)
+/*
+ * Convert a type to an attribute prefix
+ */
+const gss_buffer_t
+gss_eap_attr_ctx::attributeTypeToPrefix(unsigned int type)
 {
-    for (unsigned int i = 0; i < ATTR_TYPE_MAX; i++)
-        delete m_providers[i];
+    if (type < ATTR_TYPE_MIN || type >= ATTR_TYPE_MAX)
+        return GSS_C_NO_BUFFER;
+
+    return &gssEapAttrPrefixes[type];
 }
 
 bool
-gss_eap_attr_ctx::init(void)
+gss_eap_attr_ctx::providerEnabled(unsigned int type) const
 {
-    return gss_eap_radius_attr_provider::init() &&
-           gss_eap_saml_assertion_provider::init() &&
-           gss_eap_saml_attr_provider::init() &&
-           gss_eap_shib_attr_provider::init();
+    if (type == ATTR_TYPE_LOCAL &&
+        (m_flags & ATTR_FLAG_DISABLE_LOCAL))
+        return false;
+
+    if (m_providers[type] == NULL)
+        return false;
+
+    return true;
 }
 
 void
-gss_eap_attr_ctx::finalize(void)
+gss_eap_attr_ctx::releaseProvider(unsigned int type)
 {
-    gss_eap_shib_attr_provider::finalize();
-    gss_eap_saml_attr_provider::finalize();
-    gss_eap_saml_assertion_provider::finalize();
-    gss_eap_radius_attr_provider::finalize();
+    delete m_providers[type];
+    m_providers[type] = NULL;
 }
 
+/*
+ * Initialize a context from an existing context.
+ */
+bool
+gss_eap_attr_ctx::initFromExistingContext(const gss_eap_attr_ctx *manager)
+{
+    bool ret = true;
+
+    m_flags = manager->m_flags;
+
+    for (unsigned int i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+        gss_eap_attr_provider *provider;
+
+        if (!providerEnabled(i)) {
+            releaseProvider(i);
+            continue;
+        }
+
+        provider = m_providers[i];
+
+        ret = provider->initFromExistingContext(this,
+                                                manager->m_providers[i]);
+        if (ret == false) {
+            releaseProvider(i);
+            break;
+        }
+    }
+
+    return ret;
+}
+
+/*
+ * Initialize a context from a GSS credential and context.
+ */
+bool
+gss_eap_attr_ctx::initFromGssContext(const gss_cred_id_t cred,
+                                     const gss_ctx_id_t ctx)
+{
+    bool ret = true;
+
+    if (cred != GSS_C_NO_CREDENTIAL &&
+        (cred->flags & GSS_EAP_DISABLE_LOCAL_ATTRS_FLAG)) {
+        m_flags |= ATTR_FLAG_DISABLE_LOCAL;
+    }
+
+    for (unsigned int i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+        gss_eap_attr_provider *provider;
+
+        if (!providerEnabled(i)) {
+            releaseProvider(i);
+            continue;
+        }
+
+        provider = m_providers[i];
+
+        ret = provider->initFromGssContext(this, cred, ctx);
+        if (ret == false) {
+            releaseProvider(i);
+            break;
+        }
+    }
+
+    return ret;
+}
+
+static DDF
+findSourceForProvider(DDF &sources, const char *key)
+{
+    DDF source = sources.first();
+
+    while (!source.isnull()) {
+        DDF obj = source.getmember(key);
+
+        if (strcmp(key, source.name()) == 0)
+            break;
+
+        source = sources.next();
+    }
+
+    return source;
+}
+
+bool
+gss_eap_attr_ctx::unmarshallAndInit(DDF &obj)
+{
+    bool ret = false;
+    bool foundSource[ATTR_TYPE_MAX + 1];
+    unsigned int type;
+
+    for (type = ATTR_TYPE_MIN; type <= ATTR_TYPE_MAX; type++)
+        foundSource[type] = false;
+
+    if (obj["version"].integer() != 1)
+        return false;
+
+    m_flags = obj["flags"].integer();
+
+    DDF sources = obj["sources"];
+
+    /* Initialize providers from serialized state */
+    for (type = ATTR_TYPE_MIN; type <= ATTR_TYPE_MAX; type++) {
+        if (!providerEnabled(type)) {
+            releaseProvider(type);
+            continue;
+        }
+
+        gss_eap_attr_provider *provider = m_providers[type];
+        const char *key = provider->marshallingKey();
+        if (key == NULL)
+            continue;
+
+        DDF source = findSourceForProvider(sources, key);
+        if (source.isnull() ||
+            !provider->unmarshallAndInit(this, source)) {
+            releaseProvider(type);
+            return false;
+        }
+
+        foundSource[type] = true;
+    }
+
+    /* Initialize remaining providers from initialized providers */ 
+    for (type = ATTR_TYPE_MIN; type <= ATTR_TYPE_MAX; type++) {
+        gss_eap_attr_provider *provider;
+
+        if (foundSource[type] || !providerEnabled(type))
+            continue;
+
+        provider = m_providers[type];
+
+        ret = provider->initFromGssContext(this,
+                                           GSS_C_NO_CREDENTIAL,
+                                           GSS_C_NO_CONTEXT);
+        if (ret == false) {
+            releaseProvider(type);
+            return false;
+        }
+    }
+
+    return true;
+}
+
+DDF
+gss_eap_attr_ctx::marshall(void) const
+{
+    DDF obj(NULL);
+    unsigned int i;
+
+    obj.addmember("version").integer(1);
+    obj.addmember("flags").integer(m_flags);
+
+    DDF sources = obj.addmember("sources").list();
+
+    for (i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+        gss_eap_attr_provider *provider = m_providers[i];
+
+        if (provider == NULL)
+            continue; /* provider not initialised */
+
+        const char *key = provider->marshallingKey();
+        if (key == NULL)
+            continue; /* provider does not have state */
+
+        DDF source = provider->marshall();
+        sources.add(source.name(key));
+    }
+
+    return obj;
+}
+
+/*
+ * Initialize a context from an exported context or name token
+ */
+bool
+gss_eap_attr_ctx::initFromBuffer(const gss_buffer_t buffer)
+{
+    bool ret;
+
+    if (buffer->length == 0)
+        return false;
+
+    DDF obj(NULL);
+    std::string str((const char *)buffer->value, buffer->length);
+    std::istringstream source(str);
+
+    source >> obj;
+
+    ret = unmarshallAndInit(obj);
+
+    obj.destroy();
+
+    return ret;
+}
+
+gss_eap_attr_ctx::~gss_eap_attr_ctx(void)
+{
+    for (unsigned int i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++)
+        delete m_providers[i];
+}
+
+/*
+ * Locate provider for a given type
+ */
 gss_eap_attr_provider *
 gss_eap_attr_ctx::getProvider(unsigned int type) const
 {
+    assert(type >= ATTR_TYPE_MIN && type <= ATTR_TYPE_MAX);
     return m_providers[type];
 }
 
+/*
+ * Locate provider for a given prefix
+ */
 gss_eap_attr_provider *
 gss_eap_attr_ctx::getProvider(const gss_buffer_t prefix) const
 {
@@ -103,19 +424,20 @@ gss_eap_attr_ctx::getProvider(const gss_buffer_t prefix) const
     return m_providers[type];
 }
 
-gss_eap_attr_ctx::gss_eap_attr_ctx(const gss_eap_attr_ctx &ctx)
-    : gss_eap_attr_provider(ctx)
+/*
+ * Get primary provider. Only the primary provider is serialised when
+ * gss_export_sec_context() or gss_export_name_composite() is called.
+ */
+gss_eap_attr_provider *
+gss_eap_attr_ctx::getPrimaryProvider(void) const
 {
-    for (unsigned int i = 0; i < ATTR_TYPE_MAX; i++) {
-        if (ctx.m_providers[i] != NULL) {
-            m_providers[i] = (gss_eap_attr_factories[i])(&ctx,
-                                                         GSS_C_NO_CREDENTIAL,
-                                                         GSS_C_NO_CONTEXT);
-        }
-    }
+    return m_providers[ATTR_TYPE_MIN];
 }
 
-void
+/*
+ * Set an attribute
+ */
+bool
 gss_eap_attr_ctx::setAttribute(int complete,
                                const gss_buffer_t attr,
                                const gss_buffer_t value)
@@ -123,43 +445,53 @@ gss_eap_attr_ctx::setAttribute(int complete,
     gss_buffer_desc suffix = GSS_C_EMPTY_BUFFER;
     unsigned int type;
     gss_eap_attr_provider *provider;
+    bool ret = false;
 
     decomposeAttributeName(attr, &type, &suffix);
 
     provider = m_providers[type];
     if (provider != NULL) {
-        provider->setAttribute(complete,
-                               (type == ATTR_TYPE_LOCAL) ? attr : &suffix,
-                               value);
-                               
+        ret = provider->setAttribute(complete,
+                                     (type == ATTR_TYPE_LOCAL) ? attr : &suffix,
+                                     value);
     }
+
+    return ret;
 }
 
-void
+/*
+ * Delete an attrbiute
+ */
+bool
 gss_eap_attr_ctx::deleteAttribute(const gss_buffer_t attr)
 {
     gss_buffer_desc suffix = GSS_C_EMPTY_BUFFER;
     unsigned int type;
     gss_eap_attr_provider *provider;
+    bool ret = false;
 
     decomposeAttributeName(attr, &type, &suffix);
 
     provider = m_providers[type];
     if (provider != NULL) {
-        provider->deleteAttribute(type == ATTR_TYPE_LOCAL ? attr : &suffix);
+        ret = provider->deleteAttribute(type == ATTR_TYPE_LOCAL ? attr : &suffix);
     }
+
+    return ret;
 }
 
+/*
+ * Enumerate attribute types with callback
+ */
 bool
 gss_eap_attr_ctx::getAttributeTypes(gss_eap_attr_enumeration_cb cb, void *data) const
 {
     bool ret = false;
     size_t i;
 
-    for (i = 0; i < ATTR_TYPE_MAX; i++) {
-        gss_eap_attr_provider *provider;
+    for (i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+        gss_eap_attr_provider *provider = m_providers[i];
 
-        provider = m_providers[i];
         if (provider == NULL)
             continue;
 
@@ -177,12 +509,11 @@ struct eap_gss_get_attr_types_args {
 };
 
 static bool
-addAttribute(const gss_eap_attr_provider *provider,
+addAttribute(const gss_eap_attr_provider *provider GSSEAP_UNUSED,
              const gss_buffer_t attribute,
              void *data)
 {
     eap_gss_get_attr_types_args *args = (eap_gss_get_attr_types_args *)data;
-    gss_buffer_t prefix = GSS_C_NO_BUFFER;
     gss_buffer_desc qualified;
     OM_uint32 major, minor;
 
@@ -191,12 +522,15 @@ addAttribute(const gss_eap_attr_provider *provider,
         major = gss_add_buffer_set_member(&minor, &qualified, &args->attrs);
         gss_release_buffer(&minor, &qualified);
     } else {
-        major = gss_add_buffer_set_member(&minor, prefix, &args->attrs);
+        major = gss_add_buffer_set_member(&minor, attribute, &args->attrs);
     }
 
-    return GSS_ERROR(major) ? false : true;
+    return GSS_ERROR(major) == false;
 }
 
+/*
+ * Enumerate attribute types, output is buffer set
+ */
 bool
 gss_eap_attr_ctx::getAttributeTypes(gss_buffer_set_t *attrs)
 {
@@ -213,12 +547,11 @@ gss_eap_attr_ctx::getAttributeTypes(gss_buffer_set_t *attrs)
 
     args.attrs = *attrs;
 
-    for (i = 0; i < ATTR_TYPE_MAX; i++) {
-        gss_eap_attr_provider *provider;
+    for (i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+        gss_eap_attr_provider *provider = m_providers[i];
 
         args.type = i;
 
-        provider = m_providers[i];
         if (provider == NULL)
             continue;
 
@@ -227,13 +560,15 @@ gss_eap_attr_ctx::getAttributeTypes(gss_buffer_set_t *attrs)
             break;
     }
 
-    if (ret == false) {
+    if (ret == false)
         gss_release_buffer_set(&minor, attrs);
-    }
 
     return ret;
 }
 
+/*
+ * Get attribute with given name
+ */
 bool
 gss_eap_attr_ctx::getAttribute(const gss_buffer_t attr,
                                int *authenticated,
@@ -250,10 +585,8 @@ gss_eap_attr_ctx::getAttribute(const gss_buffer_t attr,
     decomposeAttributeName(attr, &type, &suffix);
 
     provider = m_providers[type];
-    if (provider == NULL) {
-        *more = 0;
+    if (provider == NULL)
         return false;
-    }
 
     ret = provider->getAttribute(type == ATTR_TYPE_LOCAL ? attr : &suffix,
                                  authenticated, complete,
@@ -262,92 +595,135 @@ gss_eap_attr_ctx::getAttribute(const gss_buffer_t attr,
     return ret;
 }
 
+/*
+ * Map attribute context to C++ object
+ */
 gss_any_t
 gss_eap_attr_ctx::mapToAny(int authenticated,
                            gss_buffer_t type_id) const
 {
-    return NULL;
+    unsigned int type;
+    gss_eap_attr_provider *provider;
+    gss_buffer_desc suffix;
+
+    decomposeAttributeName(type_id, &type, &suffix);
+
+    provider = m_providers[type];
+    if (provider == NULL)
+        return (gss_any_t)NULL;
+
+    return provider->mapToAny(authenticated, &suffix);
 }
 
+/*
+ * Release mapped context
+ */
 void
 gss_eap_attr_ctx::releaseAnyNameMapping(gss_buffer_t type_id,
                                         gss_any_t input) const
 {
+    unsigned int type;
+    gss_eap_attr_provider *provider;
+    gss_buffer_desc suffix;
+
+    decomposeAttributeName(type_id, &type, &suffix);
+
+    provider = m_providers[type];
+    if (provider != NULL)
+        provider->releaseAnyNameMapping(&suffix, input);
 }
 
+/*
+ * Export attribute context to buffer
+ */
 void
-gss_eap_attr_ctx::marshall(gss_buffer_t buffer) const
+gss_eap_attr_ctx::exportToBuffer(gss_buffer_t buffer) const
 {
-    /* For now, just marshall the RADIUS context. */
+    DDF obj = marshall();
+    std::ostringstream sink;
+
+    sink << obj;
+    std::string str = sink.str();
+
+    duplicateBuffer(str, buffer);
+
+    obj.destroy();
 }
 
-bool
-gss_eap_attr_ctx::unmarshall(const gss_eap_attr_ctx *ctx,
-                             const gss_buffer_t buffer)
+/*
+ * Return soonest expiry time of providers
+ */
+time_t
+gss_eap_attr_ctx::getExpiryTime(void) const
 {
-    int i;
+    unsigned int i;
+    time_t expiryTime = 0;
 
-    for (i = 0; i < ATTR_TYPE_MAX; i++) {
+    for (i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
         gss_eap_attr_provider *provider = m_providers[i];
+        time_t providerExpiryTime;
 
-    }
-}
+        if (provider == NULL)
+            continue;
 
+        providerExpiryTime = provider->getExpiryTime();
+        if (providerExpiryTime == 0)
+            continue;
 
-/*
- * C wrappers
- */
+        if (expiryTime == 0 || providerExpiryTime < expiryTime)
+            expiryTime = providerExpiryTime;
+    }
 
-static OM_uint32
-mapException(OM_uint32 *minor, std::exception &e)
-{
-    *minor = 0;
-    return GSS_S_FAILURE;
-}
-
-static gss_buffer_desc attributePrefixes[] = {
-    {
-        /* ATTR_TYPE_RADIUS_AVP */
-        sizeof("urn:ietf:params:gss-eap:radius-avp"),
-        (void *)"urn:ietf:params:gss-eap:radius-avp",
-    },
-    {
-        /* ATTR_TYPE_SAML_AAA_ASSERTION */
-        sizeof("urn:ietf:params:gss-eap:saml-aaa-assertion"),
-        (void *)"urn:ietf:params:gss-eap:saml-aaa-assertion"
-    },
-    {
-        /* ATTR_TYPE_SAML_ATTR */
-        sizeof("urn:ietf:params:gss-eap:saml-attr"),
-        (void *)"urn:ietf:params:gss-eap:saml-attr"
-    },
-};
+    return expiryTime;
+}
 
-unsigned int
-gss_eap_attr_ctx::attributePrefixToType(const gss_buffer_t prefix)
+OM_uint32
+gss_eap_attr_ctx::mapException(OM_uint32 *minor, std::exception &e) const
 {
     unsigned int i;
+    OM_uint32 major;
 
-    for (i = ATTR_TYPE_MIN;
-         i < sizeof(attributePrefixes) / sizeof(attributePrefixes[0]);
-         i++)
-    {
-        if (bufferEqual(&attributePrefixes[i], prefix))
-            return i;
+    /* Errors we handle ourselves */
+    major = GSS_S_FAILURE;
+
+    if (typeid(e) == typeid(std::bad_alloc)) {
+        *minor = ENOMEM;
+        goto cleanup;
     }
 
-    return ATTR_TYPE_LOCAL;
-}
+    /* Errors we delegate to providers */
+    major = GSS_S_CONTINUE_NEEDED;
 
-gss_buffer_t
-gss_eap_attr_ctx::attributeTypeToPrefix(unsigned int type)
-{
-    if (type < ATTR_TYPE_MIN || type >= ATTR_TYPE_LOCAL)
-        return GSS_C_NO_BUFFER;
+    for (i = ATTR_TYPE_MIN; i <= ATTR_TYPE_MAX; i++) {
+        gss_eap_attr_provider *provider = m_providers[i];
 
-    return &attributePrefixes[type];
+        if (provider == NULL)
+            continue;
+
+        major = provider->mapException(minor, e);
+        if (major != GSS_S_CONTINUE_NEEDED)
+            break;
+    }
+
+    if (major == GSS_S_CONTINUE_NEEDED) {
+        *minor = GSSEAP_ATTR_CONTEXT_FAILURE;
+        major = GSS_S_FAILURE;
+    }
+
+cleanup:
+#if 0
+    /* rethrow for now for debugging */
+    throw e;
+#endif
+
+    assert(GSS_ERROR(major));
+
+    return major;
 }
 
+/*
+ * Decompose attribute name into prefix and suffix
+ */
 void
 gss_eap_attr_ctx::decomposeAttributeName(const gss_buffer_t attribute,
                                          gss_buffer_t prefix,
@@ -375,52 +751,75 @@ gss_eap_attr_ctx::decomposeAttributeName(const gss_buffer_t attribute,
     }
 }
 
+/*
+ * Decompose attribute name into type and suffix
+ */
 void
-gss_eap_attr_ctx::composeAttributeName(const gss_buffer_t prefix,
-                                       const gss_buffer_t suffix,
-                                       gss_buffer_t attribute)
+gss_eap_attr_ctx::decomposeAttributeName(const gss_buffer_t attribute,
+                                         unsigned int *type,
+                                         gss_buffer_t suffix)
 {
-    size_t len = 0;
-    char *p;
+    gss_buffer_desc prefix = GSS_C_EMPTY_BUFFER;
 
-    attribute->length = 0;
-    attribute->value = NULL;
+    decomposeAttributeName(attribute, &prefix, suffix);
+    *type = attributePrefixToType(&prefix);
+}
+
+/*
+ * Compose attribute name from prefix, suffix; returns C++ string
+ */
+std::string
+gss_eap_attr_ctx::composeAttributeName(const gss_buffer_t prefix,
+                                       const gss_buffer_t suffix)
+{
+    std::string str;
 
     if (prefix == GSS_C_NO_BUFFER || prefix->length == 0)
-        return;
+        return str;
+
+    str.append((const char *)prefix->value, prefix->length);
 
-    len = prefix->length;
     if (suffix != GSS_C_NO_BUFFER) {
-        len += 1 + suffix->length;
+        str.append(" ");
+        str.append((const char *)suffix->value, suffix->length);
     }
 
-    attribute->value = GSSEAP_MALLOC(len + 1);
-    if (attribute->value == NULL) {
-        throw new std::bad_alloc;
-    }
-    attribute->length = len;
+    return str;
+}
 
-    p = (char *)attribute->value;
-    memcpy(p, prefix->value, prefix->length);
-    if (suffix != NULL) {
-        p[prefix->length] = ' ';
-        memcpy(p + prefix->length + 1, suffix->value, suffix->length);
-    }
+/*
+ * Compose attribute name from type, suffix; returns C++ string
+ */
+std::string
+gss_eap_attr_ctx::composeAttributeName(unsigned int type,
+                                       const gss_buffer_t suffix)
+{
+    const gss_buffer_t prefix = attributeTypeToPrefix(type);
 
-    p[attribute->length] = '\0';
+    return composeAttributeName(prefix, suffix);
 }
 
+/*
+ * Compose attribute name from prefix, suffix; returns GSS buffer
+ */
 void
-gss_eap_attr_ctx::decomposeAttributeName(const gss_buffer_t attribute,
-                                         unsigned int*type,
-                                         gss_buffer_t suffix)
+gss_eap_attr_ctx::composeAttributeName(const gss_buffer_t prefix,
+                                       const gss_buffer_t suffix,
+                                       gss_buffer_t attribute)
 {
-    gss_buffer_desc prefix = GSS_C_EMPTY_BUFFER;
+    std::string str = composeAttributeName(prefix, suffix);
 
-    decomposeAttributeName(attribute, &prefix, suffix);
-    *type = attributePrefixToType(&prefix);
+    if (str.length() != 0) {
+        return duplicateBuffer(str, attribute);
+    } else {
+        attribute->length = 0;
+        attribute->value = NULL;
+    }
 }
 
+/*
+ * Compose attribute name from type, suffix; returns GSS buffer
+ */
 void
 gss_eap_attr_ctx::composeAttributeName(unsigned int type,
                                        const gss_buffer_t suffix,
@@ -428,9 +827,12 @@ gss_eap_attr_ctx::composeAttributeName(unsigned int type,
 {
     gss_buffer_t prefix = attributeTypeToPrefix(type);
 
-    composeAttributeName(prefix, suffix, attribute);
+    return composeAttributeName(prefix, suffix, attribute);
 }
 
+/*
+ * C wrappers
+ */
 OM_uint32
 gssEapInquireName(OM_uint32 *minor,
                   gss_name_t name,
@@ -438,14 +840,34 @@ gssEapInquireName(OM_uint32 *minor,
                   gss_OID *MN_mech,
                   gss_buffer_set_t *attrs)
 {
-    if (name->attrCtx == NULL)
+    OM_uint32 major;
+
+    if (name_is_MN != NULL)
+        *name_is_MN = (name->mechanismUsed != GSS_C_NULL_OID);
+
+    if (MN_mech != NULL) {
+        major = gssEapCanonicalizeOid(minor, name->mechanismUsed,
+                                      OID_FLAG_NULL_VALID, MN_mech);
+        if (GSS_ERROR(major))
+            return major;
+    }
+
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor))) {
         return GSS_S_UNAVAILABLE;
+    }
 
     try {
-        if (!name->attrCtx->getAttributeTypes(attrs))
+        if (!name->attrCtx->getAttributeTypes(attrs)) {
+            *minor = GSSEAP_NO_ATTR_CONTEXT;
             return GSS_S_UNAVAILABLE;
+        }
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -464,25 +886,35 @@ gssEapGetNameAttribute(OM_uint32 *minor,
     *authenticated = 0;
     *complete = 0;
 
-    value->length = 0;
-    value->value = NULL;
+    if (value != NULL) {
+        value->length = 0;
+        value->value = NULL;
+    }
 
     if (display_value != NULL) {
         display_value->length = 0;
         display_value->value = NULL;
     }
 
-    *more = -1;
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
 
-    if (name->attrCtx == NULL)
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor))) {
         return GSS_S_UNAVAILABLE;
+    }
 
     try {
         if (!name->attrCtx->getAttribute(attr, authenticated, complete,
-                                         value, display_value, more))
+                                         value, display_value, more)) {
+            *minor = GSSEAP_NO_SUCH_ATTR;
+            gssEapSaveStatusInfo(*minor, "Unknown naming attribute %.*s",
+                                 (int)attr->length, (char *)attr->value);
             return GSS_S_UNAVAILABLE;
+        }
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -493,13 +925,23 @@ gssEapDeleteNameAttribute(OM_uint32 *minor,
                           gss_name_t name,
                           gss_buffer_t attr)
 {
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
         return GSS_S_UNAVAILABLE;
 
     try {
-        name->attrCtx->deleteAttribute(attr);
-    } catch (std::exception &ex) {
-        return mapException(minor, ex);
+        if (!name->attrCtx->deleteAttribute(attr)) {
+            *minor = GSSEAP_NO_SUCH_ATTR;
+            gssEapSaveStatusInfo(*minor, "Unknown naming attribute %.*s",
+                                 (int)attr->length, (char *)attr->value);
+            return GSS_S_UNAVAILABLE;
+        }
+    } catch (std::exception &e) {
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -512,13 +954,23 @@ gssEapSetNameAttribute(OM_uint32 *minor,
                        gss_buffer_t attr,
                        gss_buffer_t value)
 {
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
         return GSS_S_UNAVAILABLE;
 
     try {
-        name->attrCtx->setAttribute(complete, attr, value);
-    } catch (std::exception &ex) {
-        return mapException(minor, ex);
+        if (!name->attrCtx->setAttribute(complete, attr, value)) {
+             *minor = GSSEAP_NO_SUCH_ATTR;
+            gssEapSaveStatusInfo(*minor, "Unknown naming attribute %.*s",
+                                 (int)attr->length, (char *)attr->value);
+            return GSS_S_UNAVAILABLE;
+        }
+    } catch (std::exception &e) {
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -529,13 +981,20 @@ gssEapExportAttrContext(OM_uint32 *minor,
                         gss_name_t name,
                         gss_buffer_t buffer)
 {
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        buffer->length = 0;
+        buffer->value = NULL;
+
+        return GSS_S_COMPLETE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
         return GSS_S_UNAVAILABLE;
 
     try {
-        name->attrCtx->marshall(buffer);
+        name->attrCtx->exportToBuffer(buffer);
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -546,7 +1005,30 @@ gssEapImportAttrContext(OM_uint32 *minor,
                         gss_buffer_t buffer,
                         gss_name_t name)
 {
-    GSSEAP_NOT_IMPLEMENTED;
+    gss_eap_attr_ctx *ctx = NULL;
+
+    assert(name->attrCtx == NULL);
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
+        return GSS_S_UNAVAILABLE;
+
+    if (buffer->length != 0) {
+        try {
+            ctx = new gss_eap_attr_ctx();
+
+            if (!ctx->initFromBuffer(buffer)) {
+                delete ctx;
+                *minor = GSSEAP_BAD_ATTR_TOKEN;
+                return GSS_S_DEFECTIVE_TOKEN;
+            }
+            name->attrCtx = ctx;
+        } catch (std::exception &e) {
+            delete ctx;
+            return name->attrCtx->mapException(minor, e);
+        }
+    }
+
+    return GSS_S_COMPLETE;
 }
 
 OM_uint32
@@ -554,13 +1036,26 @@ gssEapDuplicateAttrContext(OM_uint32 *minor,
                            gss_name_t in,
                            gss_name_t out)
 {
+    gss_eap_attr_ctx *ctx = NULL;
+
+    assert(out->attrCtx == NULL);
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
+        return GSS_S_UNAVAILABLE;
+
     try {
-        if (in->attrCtx != NULL)
-            out->attrCtx = new gss_eap_attr_ctx(*(in->attrCtx));
-        else
-            out->attrCtx = NULL;
+        if (in->attrCtx != NULL) {
+            ctx = new gss_eap_attr_ctx();
+            if (!ctx->initFromExistingContext(in->attrCtx)) {
+                delete ctx;
+                *minor = GSSEAP_ATTR_CONTEXT_FAILURE;
+                return GSS_S_FAILURE;
+            }
+            out->attrCtx = ctx;
+        }
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        delete ctx;
+        return in->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -573,10 +1068,18 @@ gssEapMapNameToAny(OM_uint32 *minor,
                    gss_buffer_t type_id,
                    gss_any_t *output)
 {
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
+        return GSS_S_UNAVAILABLE;
+
     try {
         *output = name->attrCtx->mapToAny(authenticated, type_id);
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -588,7 +1091,12 @@ gssEapReleaseAnyNameMapping(OM_uint32 *minor,
                             gss_buffer_t type_id,
                             gss_any_t *input)
 {
-    if (name->attrCtx == NULL)
+    if (name->attrCtx == NULL) {
+        *minor = GSSEAP_NO_ATTR_CONTEXT;
+        return GSS_S_UNAVAILABLE;
+    }
+
+    if (GSS_ERROR(gssEapAttrProvidersInit(minor)))
         return GSS_S_UNAVAILABLE;
 
     try {
@@ -596,7 +1104,7 @@ gssEapReleaseAnyNameMapping(OM_uint32 *minor,
             name->attrCtx->releaseAnyNameMapping(type_id, *input);
         *input = NULL;
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        return name->attrCtx->mapException(minor, e);
     }
 
     return GSS_S_COMPLETE;
@@ -609,37 +1117,50 @@ gssEapReleaseAttrContext(OM_uint32 *minor,
     if (name->attrCtx != NULL)
         delete name->attrCtx;
 
+    *minor = 0;
     return GSS_S_COMPLETE;
 }
 
+/*
+ * Public accessor for initialisng a context from a GSS context. Also
+ * sets expiry time on GSS context as a side-effect.
+ */
 OM_uint32
-gssEapAttrProvidersInit(OM_uint32 *minor)
+gssEapCreateAttrContext(OM_uint32 *minor,
+                        gss_cred_id_t gssCred,
+                        gss_ctx_id_t gssCtx,
+                        struct gss_eap_attr_ctx **pAttrContext,
+                        time_t *pExpiryTime)
 {
-    try {
-        gss_eap_attr_ctx::init();
-    } catch (std::exception &e) {
-        return mapException(minor, e);
-    }
+    gss_eap_attr_ctx *ctx = NULL;
+    OM_uint32 major;
 
-    return GSS_S_COMPLETE;
-}
+    assert(gssCtx != GSS_C_NO_CONTEXT);
+
+    major = gssEapAttrProvidersInit(minor);
+    if (GSS_ERROR(major))
+        return major;
+
+    *minor = GSSEAP_ATTR_CONTEXT_FAILURE;
+    major = GSS_S_FAILURE;
 
-OM_uint32
-gssEapAttrProvidersFinalize(OM_uint32 *minor)
-{
     try {
-        gss_eap_attr_ctx::finalize();
+        ctx = new gss_eap_attr_ctx();
+        if (ctx->initFromGssContext(gssCred, gssCtx)) {
+            *minor = 0;
+            major = GSS_S_COMPLETE;
+        } else {
+            delete ctx;
+        }
     } catch (std::exception &e) {
-        return mapException(minor, e);
+        if (ctx != NULL)
+            major = ctx->mapException(minor, e);
     }
 
-    return GSS_S_COMPLETE;
-}
+    if (major == GSS_S_COMPLETE) {
+        *pAttrContext = ctx;
+        *pExpiryTime = ctx->getExpiryTime();
+    }
 
-struct gss_eap_attr_ctx *
-gssEapCreateAttrContext(gss_cred_id_t cred,
-                        gss_ctx_id_t ctx)
-{
-    assert(ctx != GSS_C_NO_CONTEXT);
-    return gss_eap_attr_ctx::createAttrContext(cred, ctx);
+    return major;
 }