accept_sec_context.c

   1 /*
   2  * Copyright (c) 2010, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 #include "gssapiP_eap.h"
  34
  35 #ifdef GSSEAP_ENABLE_REAUTH
  36 static OM_uint32
  37 eapGssSmAcceptGssReauth(OM_uint32 *minor,
  38                         gss_ctx_id_t ctx,
  39                         gss_cred_id_t cred,
  40                         gss_buffer_t inputToken,
  41                         gss_channel_bindings_t chanBindings,
  42                         gss_buffer_t outputToken);
  43 #endif
  44
  45 /*
  46  * Mark a context as ready for cryptographic operations
  47  */
  48 static OM_uint32
  49 acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
  50 {
  51     OM_uint32 major, tmpMinor;
  52     VALUE_PAIR *vp;
  53     gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
  54
  55     /* Cache encryption type derived from selected mechanism OID */
  56     major = gssEapOidToEnctype(minor, ctx->mechanismUsed,
  57                                &ctx->encryptionType);
  58     if (GSS_ERROR(major))
  59         return major;
  60
  61     gssEapReleaseName(&tmpMinor, &ctx->initiatorName);
  62
  63     major = gssEapRadiusGetRawAvp(minor, ctx->acceptorCtx.vps,
  64                                   PW_USER_NAME, 0, &vp);
  65     if (major == GSS_S_COMPLETE) {
  66         nameBuf.length = vp->length;
  67         nameBuf.value = vp->vp_strvalue;
  68     } else {
  69         ctx->gssFlags |= GSS_C_ANON_FLAG;
  70     }
  71
  72     major = gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
  73                              &ctx->initiatorName);
  74     if (GSS_ERROR(major))
  75         return major;
  76
  77     major = gssEapRadiusGetRawAvp(minor, ctx->acceptorCtx.vps,
  78                                   PW_MS_MPPE_SEND_KEY, VENDORPEC_MS, &vp);
  79     if (GSS_ERROR(major))
  80         return major;
  81
  82     major = gssEapDeriveRfc3961Key(minor,
  83                                    vp->vp_octets,
  84                                    vp->length,
  85                                    ctx->encryptionType,
  86                                    &ctx->rfc3961Key);
  87     if (GSS_ERROR(major))
  88         return major;
  89
  90     major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key,
  91                                        &ctx->checksumType);
  92     if (GSS_ERROR(major))
  93         return major;
  94
  95     major = sequenceInit(minor,
  96                          &ctx->seqState, ctx->recvSeq,
  97                          ((ctx->gssFlags & GSS_C_REPLAY_FLAG) != 0),
  98                          ((ctx->gssFlags & GSS_C_SEQUENCE_FLAG) != 0),
  99                          TRUE);
 100     if (GSS_ERROR(major))
 101         return major;
 102
 103     ctx->initiatorName->attrCtx = gssEapCreateAttrContext(cred, ctx);
 104
 105     return GSS_S_COMPLETE;
 106 }
 107
 108 static OM_uint32
 109 eapGssSmAcceptIdentity(OM_uint32 *minor,
 110                        gss_ctx_id_t ctx,
 111                        gss_cred_id_t cred,
 112                        gss_buffer_t inputToken,
 113                        gss_channel_bindings_t chanBindings,
 114                        gss_buffer_t outputToken)
 115 {
 116     OM_uint32 major;
 117     union {
 118         struct eap_hdr pdu;
 119         unsigned char data[5];
 120     } pkt;
 121     gss_buffer_desc pktBuffer;
 122
 123     if (inputToken != GSS_C_NO_BUFFER && inputToken->length != 0)
 124         return GSS_S_DEFECTIVE_TOKEN;
 125
 126     assert(ctx->acceptorName == GSS_C_NO_NAME);
 127
 128     if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
 129         major = gssEapDuplicateName(minor, cred->name, &ctx->acceptorName);
 130         if (GSS_ERROR(major))
 131             return major;
 132     }
 133
 134     pkt.pdu.code = EAP_CODE_REQUEST;
 135     pkt.pdu.identifier = 0;
 136     pkt.pdu.length = htons(sizeof(pkt.data));
 137     pkt.data[4] = EAP_TYPE_IDENTITY;
 138
 139     pktBuffer.length = sizeof(pkt.data);
 140     pktBuffer.value = pkt.data;
 141
 142     major = duplicateBuffer(minor, &pktBuffer, outputToken);
 143     if (GSS_ERROR(major))
 144         return major;
 145
 146     ctx->state = EAP_STATE_AUTHENTICATE;
 147
 148     return GSS_S_CONTINUE_NEEDED;
 149 }
 150
 151 static OM_uint32
 152 setAcceptorIdentity(OM_uint32 *minor,
 153                     gss_ctx_id_t ctx,
 154                     VALUE_PAIR **vps)
 155 {
 156     OM_uint32 major;
 157     gss_buffer_desc nameBuf;
 158     krb5_context krbContext = NULL;
 159     krb5_principal krbPrinc;
 160     struct rs_handle *rh = ctx->acceptorCtx.radHandle;
 161
 162     assert(rh != NULL);
 163
 164     /* Awaits further specification */
 165     if (ctx->acceptorName == GSS_C_NO_NAME)
 166         return GSS_S_COMPLETE;
 167
 168     GSSEAP_KRB_INIT(&krbContext);
 169
 170     krbPrinc = ctx->acceptorName->krbPrincipal;
 171     assert(krbPrinc != NULL);
 172
 173     if (krb5_princ_size(krbContext, krbPrinc) < 2)
 174         return GSS_S_BAD_NAME;
 175
 176     /* Acceptor-Service-Name */
 177     krbDataToGssBuffer(krb5_princ_component(krbContext, krbPrinc, 0), &nameBuf);
 178
 179     major = gssEapRadiusAddAvp(minor, vps,
 180                                PW_GSS_ACCEPTOR_SERVICE_NAME,
 181                                VENDORPEC_UKERNA,
 182                                &nameBuf);
 183     if (GSS_ERROR(major))
 184         return major;
 185
 186     /* Acceptor-Host-Name */
 187     krbDataToGssBuffer(krb5_princ_component(krbContext, krbPrinc, 1), &nameBuf);
 188
 189     major = gssEapRadiusAddAvp(minor, vps,
 190                                PW_GSS_ACCEPTOR_HOST_NAME,
 191                                VENDORPEC_UKERNA,
 192                                &nameBuf);
 193     if (GSS_ERROR(major))
 194         return major;
 195
 196     if (krb5_princ_size(krbContext, krbPrinc) > 2) {
 197         /* Acceptor-Service-Specific */
 198         krb5_principal_data ssiPrinc = *krbPrinc;
 199         char *ssi;
 200
 201         krb5_princ_size(krbContext, &ssiPrinc) -= 2;
 202         krb5_princ_name(krbContext, &ssiPrinc) += 2;
 203
 204         *minor = krb5_unparse_name_flags(krbContext, &ssiPrinc,
 205                                          KRB5_PRINCIPAL_UNPARSE_NO_REALM, &ssi);
 206         if (*minor != 0)
 207             return GSS_S_FAILURE;
 208
 209         nameBuf.value = ssi;
 210         nameBuf.length = strlen(ssi);
 211
 212         major = gssEapRadiusAddAvp(minor, vps,
 213                                    PW_GSS_ACCEPTOR_SERVICE_SPECIFIC,
 214                                    VENDORPEC_UKERNA,
 215                                    &nameBuf);
 216
 217         if (GSS_ERROR(major)) {
 218             krb5_free_unparsed_name(krbContext, ssi);
 219             return major;
 220         }
 221         krb5_free_unparsed_name(krbContext, ssi);
 222     }
 223
 224     krbDataToGssBuffer(krb5_princ_realm(krbContext, krbPrinc), &nameBuf);
 225     if (nameBuf.length != 0) {
 226         /* Acceptor-Realm-Name */
 227         major = gssEapRadiusAddAvp(minor, vps,
 228                                    PW_GSS_ACCEPTOR_REALM_NAME,
 229                                    VENDORPEC_UKERNA,
 230                                    &nameBuf);
 231         if (GSS_ERROR(major))
 232             return major;
 233     }
 234
 235     return GSS_S_COMPLETE;
 236 }
 237
 238 static OM_uint32
 239 createRadiusHandle(OM_uint32 *minor,
 240                    gss_cred_id_t cred,
 241                    gss_ctx_id_t ctx)
 242 {
 243     struct gss_eap_acceptor_ctx *actx = &ctx->acceptorCtx;
 244     const char *configFile = RS_CONFIG_FILE;
 245     const char *configStanza = "gss-eap";
 246     struct rs_alloc_scheme ralloc;
 247     struct rs_error *err;
 248
 249     assert(actx->radHandle == NULL);
 250     assert(actx->radConn == NULL);
 251
 252     if (rs_context_create(&actx->radHandle, RS_DICT_FILE) != 0)
 253         return GSS_S_FAILURE;
 254
 255     if (cred != GSS_C_NO_CREDENTIAL) {
 256         if (cred->radiusConfigFile != NULL)
 257             configFile = cred->radiusConfigFile;
 258         if (cred->radiusConfigStanza != NULL)
 259             configStanza = cred->radiusConfigStanza;
 260     }
 261
 262     ralloc.calloc  = GSSEAP_CALLOC;
 263     ralloc.malloc  = GSSEAP_MALLOC;
 264     ralloc.free    = GSSEAP_FREE;
 265     ralloc.realloc = GSSEAP_REALLOC;
 266
 267     rs_context_set_alloc_scheme(actx->radHandle, &ralloc);
 268
 269     if (rs_context_read_config(actx->radHandle, configFile) != 0) {
 270         err = rs_err_ctx_pop(actx->radHandle);
 271         goto fail;
 272     }
 273
 274     if (rs_conn_create(actx->radHandle, &actx->radConn, configStanza) != 0) {
 275         err = rs_err_conn_pop(actx->radConn);
 276         goto fail;
 277     }
 278
 279     /* XXX TODO rs_conn_select_server does not exist yet */
 280 #if 0
 281     if (actx->radServer != NULL) {
 282         if (rs_conn_select_server(actx->radConn, actx->radServer) != 0) {
 283             err = rs_err_conn_pop(actx->radConn);
 284             goto fail;
 285         }
 286     }
 287 #endif
 288
 289     *minor = 0;
 290     return GSS_S_COMPLETE;
 291
 292 fail:
 293     return gssEapRadiusMapError(minor, err);
 294 }
 295
 296 static OM_uint32
 297 eapGssSmAcceptAuthenticate(OM_uint32 *minor,
 298                            gss_ctx_id_t ctx,
 299                            gss_cred_id_t cred,
 300                            gss_buffer_t inputToken,
 301                            gss_channel_bindings_t chanBindings,
 302                            gss_buffer_t outputToken)
 303 {
 304     OM_uint32 major, tmpMinor;
 305     struct rs_handle *rh;
 306     struct rs_connection *rconn;
 307     struct rs_request *request = NULL;
 308     struct rs_packet *req = NULL, *resp = NULL;
 309     struct radius_packet *frreq, *frresp;
 310     int sendAcceptorIdentity = 0;
 311
 312     if (ctx->acceptorCtx.radHandle == NULL) {
 313         /* May be NULL from an imported partial context */
 314         major = createRadiusHandle(minor, cred, ctx);
 315         if (GSS_ERROR(major))
 316             goto cleanup;
 317
 318         sendAcceptorIdentity = 1;
 319     }
 320
 321     rh = ctx->acceptorCtx.radHandle;
 322     rconn = ctx->acceptorCtx.radConn;
 323
 324     if (rs_packet_create_acc_request(rconn, &req, NULL, NULL) != 0) {
 325         major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
 326         goto cleanup;
 327     }
 328     frreq = rs_packet_frpkt(req);
 329
 330     if (sendAcceptorIdentity) {
 331         major = setAcceptorIdentity(minor, ctx, &frreq->vps);
 332         if (GSS_ERROR(major))
 333             goto cleanup;
 334     }
 335
 336     major = gssEapRadiusAddAvp(minor, &frreq->vps,
 337                                PW_EAP_MESSAGE, 0, inputToken);
 338     if (GSS_ERROR(major))
 339         goto cleanup;
 340
 341     if (ctx->acceptorCtx.state.length != 0) {
 342         major = gssEapRadiusAddAvp(minor, &frreq->vps, PW_STATE, 0,
 343                                    &ctx->acceptorCtx.state);
 344         if (GSS_ERROR(major))
 345             goto cleanup;
 346
 347         gss_release_buffer(&tmpMinor, &ctx->acceptorCtx.state);
 348     }
 349
 350     if (rs_request_create(rconn, &request) != 0 ||
 351         rs_request_send(request, req, &resp) != 0) {
 352         major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
 353         goto cleanup;
 354     }
 355
 356     assert(resp != NULL);
 357
 358     frresp = rs_packet_frpkt(resp);
 359     switch (frresp->code) {
 360     case PW_AUTHENTICATION_ACK:
 361     case PW_ACCESS_CHALLENGE:
 362         major = GSS_S_CONTINUE_NEEDED;
 363         break;
 364     case PW_AUTHENTICATION_REJECT:
 365         major = GSS_S_DEFECTIVE_CREDENTIAL;
 366         goto cleanup;
 367         break;
 368     default:
 369         major = GSS_S_FAILURE;
 370         goto cleanup;
 371         break;
 372     }
 373
 374     major = gssEapRadiusGetAvp(minor, frresp->vps, PW_EAP_MESSAGE, 0,
 375                                outputToken, TRUE);
 376     if ((major == GSS_S_UNAVAILABLE && frresp->code != PW_AUTHENTICATION_ACK) ||
 377         GSS_ERROR(major))
 378         goto cleanup;
 379
 380     if (frresp->code == PW_ACCESS_CHALLENGE) {
 381         major = gssEapRadiusGetAvp(minor, frresp->vps, PW_STATE, 0,
 382                                    &ctx->acceptorCtx.state, TRUE);
 383         if (major != GSS_S_UNAVAILABLE && GSS_ERROR(major))
 384             goto cleanup;
 385     } else {
 386         ctx->acceptorCtx.vps = frresp->vps;
 387         frresp->vps = NULL;
 388
 389         rs_conn_destroy(ctx->acceptorCtx.radConn);
 390         ctx->acceptorCtx.radConn = NULL;
 391
 392         major = acceptReadyEap(minor, ctx, cred);
 393         if (GSS_ERROR(major))
 394             goto cleanup;
 395
 396         ctx->state = EAP_STATE_EXTENSIONS_REQ;
 397     }
 398
 399     major = GSS_S_CONTINUE_NEEDED;
 400
 401 cleanup:
 402     rs_request_destroy(request);
 403
 404     return major;
 405 }
 406
 407 static OM_uint32
 408 acceptGssChannelBindings(OM_uint32 *minor,
 409                          gss_ctx_id_t ctx,
 410                          gss_cred_id_t cred,
 411                          gss_buffer_t inputToken,
 412                          gss_channel_bindings_t chanBindings)
 413 {
 414     OM_uint32 major, tmpMinor;
 415     gss_iov_buffer_desc iov[2];
 416
 417     iov[0].type = GSS_IOV_BUFFER_TYPE_DATA | GSS_IOV_BUFFER_FLAG_ALLOCATE;
 418     iov[0].buffer.length = 0;
 419     iov[0].buffer.value = NULL;
 420
 421     iov[1].type = GSS_IOV_BUFFER_TYPE_STREAM;
 422     iov[1].buffer = *inputToken;
 423
 424     major = gssEapUnwrapOrVerifyMIC(minor, ctx, NULL, NULL,
 425                                     iov, 2, TOK_TYPE_WRAP);
 426     if (GSS_ERROR(major))
 427         return major;
 428
 429     if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS &&
 430         !bufferEqual(&iov[0].buffer, &chanBindings->application_data)) {
 431         major = GSS_S_BAD_BINDINGS;
 432     } else {
 433         major = GSS_S_CONTINUE_NEEDED;
 434     }
 435
 436     gss_release_buffer(&tmpMinor, &iov[0].buffer);
 437
 438     return major;
 439 }
 440
 441 static OM_uint32
 442 eapGssSmAcceptExtensionsReq(OM_uint32 *minor,
 443                             gss_ctx_id_t ctx,
 444                             gss_cred_id_t cred,
 445                             gss_buffer_t inputToken,
 446                             gss_channel_bindings_t chanBindings,
 447                             gss_buffer_t outputToken)
 448 {
 449     OM_uint32 major;
 450
 451     outputToken->length = 0;
 452     outputToken->value = NULL;
 453
 454     major = acceptGssChannelBindings(minor, ctx, cred, inputToken,
 455                                      chanBindings);
 456     if (GSS_ERROR(major))
 457         return major;
 458
 459     ctx->state = EAP_STATE_EXTENSIONS_RESP;
 460
 461     return GSS_S_CONTINUE_NEEDED;
 462 }
 463
 464 static OM_uint32
 465 eapGssSmAcceptExtensionsResp(OM_uint32 *minor,
 466                              gss_ctx_id_t ctx,
 467                              gss_cred_id_t cred,
 468                              gss_buffer_t inputToken,
 469                              gss_channel_bindings_t chanBindings,
 470                              gss_buffer_t outputToken)
 471 {
 472     OM_uint32 major, tmpMinor;
 473     gss_buffer_desc credsToken = GSS_C_EMPTY_BUFFER;
 474
 475 #ifdef GSSEAP_ENABLE_REAUTH
 476     /*
 477      * If we're built with fast reauthentication enabled, then
 478      * fabricate a ticket from the initiator to ourselves.
 479      * Otherwise return an empty token.
 480      */
 481     major = gssEapMakeReauthCreds(minor, ctx, cred, &credsToken);
 482     if (GSS_ERROR(major))
 483         return major;
 484 #else
 485     credsToken.value = "";
 486 #endif /* GSSEAP_ENABLE_REAUTH */
 487
 488     major = duplicateBuffer(minor, &credsToken, outputToken);
 489     if (GSS_ERROR(major)) {
 490         gss_release_buffer(&tmpMinor, &credsToken);
 491         return major;
 492     }
 493
 494 #ifdef GSSEAP_ENABLE_REAUTH
 495     gss_release_buffer(&tmpMinor, &credsToken);
 496 #endif
 497
 498     ctx->state = EAP_STATE_ESTABLISHED;
 499
 500     return GSS_S_COMPLETE;
 501 }
 502
 503 static OM_uint32
 504 eapGssSmAcceptEstablished(OM_uint32 *minor,
 505                           gss_ctx_id_t ctx,
 506                           gss_cred_id_t cred,
 507                           gss_buffer_t inputToken,
 508                           gss_channel_bindings_t chanBindings,
 509                           gss_buffer_t outputToken)
 510 {
 511     /* Called with already established context */
 512     *minor = EINVAL;
 513     return GSS_S_BAD_STATUS;
 514 }
 515
 516 static struct gss_eap_acceptor_sm {
 517     enum gss_eap_token_type inputTokenType;
 518     enum gss_eap_token_type outputTokenType;
 519     OM_uint32 (*processToken)(OM_uint32 *,
 520                               gss_ctx_id_t,
 521                               gss_cred_id_t,
 522                               gss_buffer_t,
 523                               gss_channel_bindings_t,
 524                               gss_buffer_t);
 525 } eapGssAcceptorSm[] = {
 526     { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,    eapGssSmAcceptIdentity           },
 527     { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,    eapGssSmAcceptAuthenticate       },
 528     { TOK_TYPE_EXT_REQ,     TOK_TYPE_NONE,       eapGssSmAcceptExtensionsReq      },
 529     { TOK_TYPE_NONE,        TOK_TYPE_EXT_RESP,   eapGssSmAcceptExtensionsResp     },
 530     { TOK_TYPE_NONE,        TOK_TYPE_NONE,       eapGssSmAcceptEstablished        },
 531 #ifdef GSSEAP_ENABLE_REAUTH
 532     { TOK_TYPE_GSS_REAUTH,  TOK_TYPE_GSS_REAUTH, eapGssSmAcceptGssReauth          },
 533 #endif
 534 };
 535
 536 OM_uint32
 537 gss_accept_sec_context(OM_uint32 *minor,
 538                        gss_ctx_id_t *context_handle,
 539                        gss_cred_id_t cred,
 540                        gss_buffer_t input_token,
 541                        gss_channel_bindings_t input_chan_bindings,
 542                        gss_name_t *src_name,
 543                        gss_OID *mech_type,
 544                        gss_buffer_t output_token,
 545                        OM_uint32 *ret_flags,
 546                        OM_uint32 *time_rec,
 547                        gss_cred_id_t *delegated_cred_handle)
 548 {
 549     OM_uint32 major;
 550     OM_uint32 tmpMajor, tmpMinor;
 551     gss_ctx_id_t ctx = *context_handle;
 552     struct gss_eap_acceptor_sm *sm = NULL;
 553     gss_buffer_desc innerInputToken = GSS_C_EMPTY_BUFFER;
 554     gss_buffer_desc innerOutputToken = GSS_C_EMPTY_BUFFER;
 555     enum gss_eap_token_type tokType;
 556     int initialContextToken = 0;
 557
 558     *minor = 0;
 559
 560     output_token->length = 0;
 561     output_token->value = NULL;
 562
 563     if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) {
 564         return GSS_S_DEFECTIVE_TOKEN;
 565     }
 566
 567     if (ctx == GSS_C_NO_CONTEXT) {
 568         major = gssEapAllocContext(minor, &ctx);
 569         if (GSS_ERROR(major))
 570             return major;
 571
 572         initialContextToken = 1;
 573         *context_handle = ctx;
 574     }
 575
 576     GSSEAP_MUTEX_LOCK(&ctx->mutex);
 577
 578     /* Validate and lock credentials */
 579     if (cred != GSS_C_NO_CREDENTIAL) {
 580         GSSEAP_MUTEX_LOCK(&cred->mutex);
 581
 582         if ((cred->flags & CRED_FLAG_ACCEPT) == 0) {
 583             major = GSS_S_NO_CRED;
 584             goto cleanup;
 585         }
 586     }
 587
 588     sm = &eapGssAcceptorSm[ctx->state];
 589
 590     major = gssEapVerifyToken(minor, ctx, input_token,
 591                               &tokType, &innerInputToken);
 592     if (GSS_ERROR(major))
 593         goto cleanup;
 594
 595     if (!gssEapCredAvailable(cred, ctx->mechanismUsed)) {
 596         major = GSS_S_BAD_MECH;
 597         goto cleanup;
 598     }
 599
 600 #ifdef GSSEAP_ENABLE_REAUTH
 601     /*
 602      * If we're built with fast reauthentication support, it's valid
 603      * for an initiator to send a GSS reauthentication token as its
 604      * initial context token, causing us to short-circuit the state
 605      * machine and process Kerberos GSS messages instead.
 606      */
 607     if (tokType == TOK_TYPE_GSS_REAUTH && initialContextToken) {
 608         ctx->state = EAP_STATE_KRB_REAUTH_GSS;
 609     } else
 610 #endif
 611     if (tokType != sm->inputTokenType) {
 612         major = GSS_S_DEFECTIVE_TOKEN;
 613         goto cleanup;
 614     }
 615
 616     do {
 617         sm = &eapGssAcceptorSm[ctx->state];
 618
 619         major = (sm->processToken)(minor,
 620                                    ctx,
 621                                    cred,
 622                                    &innerInputToken,
 623                                    input_chan_bindings,
 624                                    &innerOutputToken);
 625         if (GSS_ERROR(major))
 626             goto cleanup;
 627     } while (major == GSS_S_CONTINUE_NEEDED && innerOutputToken.length == 0);
 628
 629     if (mech_type != NULL) {
 630         if (!gssEapInternalizeOid(ctx->mechanismUsed, mech_type))
 631             duplicateOid(&tmpMinor, ctx->mechanismUsed, mech_type);
 632     }
 633     if (innerOutputToken.value != NULL) {
 634         tmpMajor = gssEapMakeToken(&tmpMinor, ctx, &innerOutputToken,
 635                                    sm->outputTokenType, output_token);
 636         if (GSS_ERROR(tmpMajor)) {
 637             major = tmpMajor;
 638             *minor = tmpMinor;
 639             goto cleanup;
 640         }
 641     }
 642     if (ret_flags != NULL)
 643         *ret_flags = ctx->gssFlags;
 644     if (delegated_cred_handle != NULL)
 645         *delegated_cred_handle = GSS_C_NO_CREDENTIAL;
 646
 647     if (major == GSS_S_COMPLETE) {
 648         if (src_name != NULL && ctx->initiatorName != GSS_C_NO_NAME) {
 649             major = gssEapDuplicateName(&tmpMinor, ctx->initiatorName, src_name);
 650             if (GSS_ERROR(major))
 651                 goto cleanup;
 652         }
 653         if (time_rec != NULL)
 654             gssEapContextTime(&tmpMinor, ctx, time_rec);
 655     }
 656
 657     assert(ctx->state == EAP_STATE_ESTABLISHED || major == GSS_S_CONTINUE_NEEDED);
 658
 659 cleanup:
 660     if (cred != GSS_C_NO_CREDENTIAL)
 661         GSSEAP_MUTEX_UNLOCK(&cred->mutex);
 662     GSSEAP_MUTEX_UNLOCK(&ctx->mutex);
 663
 664     if (GSS_ERROR(major))
 665         gssEapReleaseContext(&tmpMinor, context_handle);
 666
 667     gss_release_buffer(&tmpMinor, &innerOutputToken);
 668
 669     return major;
 670 }
 671
 672 #ifdef GSSEAP_ENABLE_REAUTH
 673 static OM_uint32
 674 acceptReadyKrb(OM_uint32 *minor,
 675                gss_ctx_id_t ctx,
 676                gss_cred_id_t cred,
 677                const gss_name_t initiator,
 678                const gss_OID mech,
 679                OM_uint32 timeRec)
 680 {
 681     OM_uint32 major;
 682
 683     major = gssEapGlueToMechName(minor, initiator, &ctx->initiatorName);
 684     if (GSS_ERROR(major))
 685         return major;
 686
 687     if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
 688         major = gssEapDuplicateName(minor, cred->name, &ctx->acceptorName);
 689         if (GSS_ERROR(major))
 690             return major;
 691     }
 692
 693     major = gssEapReauthComplete(minor, ctx, cred, mech, timeRec);
 694     if (GSS_ERROR(major))
 695         return major;
 696
 697     ctx->state = EAP_STATE_ESTABLISHED;
 698
 699     return GSS_S_COMPLETE;
 700 }
 701
 702 static OM_uint32
 703 eapGssSmAcceptGssReauth(OM_uint32 *minor,
 704                         gss_ctx_id_t ctx,
 705                         gss_cred_id_t cred,
 706                         gss_buffer_t inputToken,
 707                         gss_channel_bindings_t chanBindings,
 708                         gss_buffer_t outputToken)
 709 {
 710     OM_uint32 major, tmpMinor;
 711     gss_cred_id_t krbCred = GSS_C_NO_CREDENTIAL;
 712     gss_name_t krbInitiator = GSS_C_NO_NAME;
 713     gss_OID mech = GSS_C_NO_OID;
 714     OM_uint32 gssFlags, timeRec = GSS_C_INDEFINITE;
 715
 716     ctx->flags |= CTX_FLAG_KRB_REAUTH_GSS;
 717
 718     if (cred != GSS_C_NO_CREDENTIAL)
 719         krbCred = cred->krbCred;
 720
 721     major = gssAcceptSecContext(minor,
 722                                 &ctx->kerberosCtx,
 723                                 krbCred,
 724                                 inputToken,
 725                                 chanBindings,
 726                                 &krbInitiator,
 727                                 &mech,
 728                                 outputToken,
 729                                 &gssFlags,
 730                                 &timeRec,
 731                                 NULL);
 732     if (major == GSS_S_COMPLETE) {
 733         major = acceptReadyKrb(minor, ctx, cred,
 734                                krbInitiator, mech, timeRec);
 735     }
 736
 737     ctx->gssFlags = gssFlags;
 738
 739     gssReleaseName(&tmpMinor, &krbInitiator);
 740
 741     return major;
 742 }
 743 #endif /* GSSEAP_ENABLE_REAUTH */