cleanup unused parameter warnings

[mech_eap.git] / accept_sec_context.c

diff --git a/accept_sec_context.c b/accept_sec_context.c
index 723c932..5829ed9 100644 (file)
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -126,16 +126,16 @@ acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
 
 static OM_uint32
 eapGssSmAcceptAcceptorName(OM_uint32 *minor,
-                           gss_cred_id_t cred,
+                           gss_cred_id_t cred GSSEAP_UNUSED,
                            gss_ctx_id_t ctx,
-                           gss_name_t target,
-                           gss_OID mech,
-                           OM_uint32 reqFlags,
-                           OM_uint32 timeReq,
-                           gss_channel_bindings_t chanBindings,
-                           gss_buffer_t inputToken,
+                           gss_name_t target GSSEAP_UNUSED,
+                           gss_OID mech GSSEAP_UNUSED,
+                           OM_uint32 reqFlags GSSEAP_UNUSED,
+                           OM_uint32 timeReq GSSEAP_UNUSED,
+                           gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                           gss_buffer_t inputToken GSSEAP_UNUSED,
                            gss_buffer_t outputToken,
-                           OM_uint32 *smFlags)
+                           OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     OM_uint32 major;
 
@@ -155,20 +155,21 @@ eapGssSmAcceptAcceptorName(OM_uint32 *minor,
 #ifdef GSSEAP_DEBUG
 static OM_uint32
 eapGssSmAcceptVendorInfo(OM_uint32 *minor,
-                         gss_cred_id_t cred,
-                         gss_ctx_id_t ctx,
-                         gss_name_t target,
-                         gss_OID mech,
-                         OM_uint32 reqFlags,
-                         OM_uint32 timeReq,
-                         gss_channel_bindings_t chanBindings,
+                         gss_cred_id_t cred GSSEAP_UNUSED,
+                         gss_ctx_id_t ctx GSSEAP_UNUSED,
+                         gss_name_t target GSSEAP_UNUSED,
+                         gss_OID mech GSSEAP_UNUSED,
+                         OM_uint32 reqFlags GSSEAP_UNUSED,
+                         OM_uint32 timeReq GSSEAP_UNUSED,
+                         gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
                          gss_buffer_t inputToken,
-                         gss_buffer_t outputToken,
-                         OM_uint32 *smFlags)
+                         gss_buffer_t outputToken GSSEAP_UNUSED,
+                         OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     fprintf(stderr, "GSS-EAP: vendor: %.*s\n",
             (int)inputToken->length, (char *)inputToken->value);
 
+    *minor = 0;
     return GSS_S_CONTINUE_NEEDED;
 }
 #endif
@@ -182,11 +183,11 @@ static OM_uint32
 eapGssSmAcceptIdentity(OM_uint32 *minor,
                        gss_cred_id_t cred,
                        gss_ctx_id_t ctx,
-                       gss_name_t target,
-                       gss_OID mech,
-                       OM_uint32 reqFlags,
-                       OM_uint32 timeReq,
-                       gss_channel_bindings_t chanBindings,
+                       gss_name_t target GSSEAP_UNUSED,
+                       gss_OID mech GSSEAP_UNUSED,
+                       OM_uint32 reqFlags GSSEAP_UNUSED,
+                       OM_uint32 timeReq GSSEAP_UNUSED,
+                       gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
                        gss_buffer_t inputToken,
                        gss_buffer_t outputToken,
                        OM_uint32 *smFlags)
@@ -224,6 +225,7 @@ eapGssSmAcceptIdentity(OM_uint32 *minor,
     GSSEAP_SM_TRANSITION_NEXT(ctx);
 
     *minor = 0;
+    *smFlags |= SM_FLAG_OUTPUT_TOKEN_CRITICAL;
 
     return GSS_S_CONTINUE_NEEDED;
 }
@@ -466,11 +468,11 @@ static OM_uint32
 eapGssSmAcceptAuthenticate(OM_uint32 *minor,
                            gss_cred_id_t cred,
                            gss_ctx_id_t ctx,
-                           gss_name_t target,
-                           gss_OID mech,
-                           OM_uint32 reqFlags,
-                           OM_uint32 timeReq,
-                           gss_channel_bindings_t chanBindings,
+                           gss_name_t target GSSEAP_UNUSED,
+                           gss_OID mech GSSEAP_UNUSED,
+                           OM_uint32 reqFlags GSSEAP_UNUSED,
+                           OM_uint32 timeReq GSSEAP_UNUSED,
+                           gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
                            gss_buffer_t inputToken,
                            gss_buffer_t outputToken,
                            OM_uint32 *smFlags)
@@ -541,8 +543,8 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
 
     frresp = rs_packet_frpkt(resp);
     switch (frresp->code) {
-    case PW_AUTHENTICATION_ACK:
     case PW_ACCESS_CHALLENGE:
+    case PW_AUTHENTICATION_ACK:
         break;
     case PW_AUTHENTICATION_REJECT:
         *minor = GSSEAP_RADIUS_AUTH_FAILURE;
@@ -574,9 +576,6 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
         ctx->acceptorCtx.vps = frresp->vps;
         frresp->vps = NULL;
 
-        rs_conn_destroy(ctx->acceptorCtx.radConn);
-        ctx->acceptorCtx.radConn = NULL;
-
         major = acceptReadyEap(minor, ctx, cred);
         if (GSS_ERROR(major))
             goto cleanup;
@@ -586,28 +585,37 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
 
     major = GSS_S_CONTINUE_NEEDED;
     *minor = 0;
+    *smFlags |= SM_FLAG_OUTPUT_TOKEN_CRITICAL;
 
 cleanup:
     if (request != NULL)
         rs_request_destroy(request);
     if (req != NULL)
         rs_packet_destroy(req);
+    if (resp != NULL)
+        rs_packet_destroy(resp);
+    if (GSSEAP_SM_STATE(ctx) == GSSEAP_STATE_INITIATOR_EXTS) {
+        assert(major == GSS_S_CONTINUE_NEEDED);
+
+        rs_conn_destroy(ctx->acceptorCtx.radConn);
+        ctx->acceptorCtx.radConn = NULL;
+    }
 
     return major;
 }
 
 static OM_uint32
 eapGssSmAcceptGssChannelBindings(OM_uint32 *minor,
-                                 gss_cred_id_t cred,
+                                 gss_cred_id_t cred GSSEAP_UNUSED,
                                  gss_ctx_id_t ctx,
-                                 gss_name_t target,
-                                 gss_OID mech,
-                                 OM_uint32 reqFlags,
-                                 OM_uint32 timeReq,
+                                 gss_name_t target GSSEAP_UNUSED,
+                                 gss_OID mech GSSEAP_UNUSED,
+                                 OM_uint32 reqFlags GSSEAP_UNUSED,
+                                 OM_uint32 timeReq GSSEAP_UNUSED,
                                  gss_channel_bindings_t chanBindings,
                                  gss_buffer_t inputToken,
-                                 gss_buffer_t outputToken,
-                                 OM_uint32 *smFlags)
+                                 gss_buffer_t outputToken GSSEAP_UNUSED,
+                                 OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     OM_uint32 major, tmpMinor;
     gss_iov_buffer_desc iov[2];
@@ -622,7 +630,7 @@ eapGssSmAcceptGssChannelBindings(OM_uint32 *minor,
     major = gssEapUnwrapOrVerifyMIC(minor, ctx, NULL, NULL,
                                     iov, 2, TOK_TYPE_WRAP);
     if (GSS_ERROR(major))
-        return GSS_S_BAD_BINDINGS;
+        return major;
 
     if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS &&
         !bufferEqual(&iov[0].buffer, &chanBindings->application_data)) {
@@ -643,14 +651,14 @@ static OM_uint32
 eapGssSmAcceptReauthCreds(OM_uint32 *minor,
                           gss_cred_id_t cred,
                           gss_ctx_id_t ctx,
-                          gss_name_t target,
-                          gss_OID mech,
-                          OM_uint32 reqFlags,
-                          OM_uint32 timeReq,
-                          gss_channel_bindings_t chanBindings,
-                          gss_buffer_t inputToken,
+                          gss_name_t target GSSEAP_UNUSED,
+                          gss_OID mech GSSEAP_UNUSED,
+                          OM_uint32 reqFlags GSSEAP_UNUSED,
+                          OM_uint32 timeReq GSSEAP_UNUSED,
+                          gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                          gss_buffer_t inputToken GSSEAP_UNUSED,
                           gss_buffer_t outputToken,
-                          OM_uint32 *smFlags)
+                          OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     OM_uint32 major;
 
@@ -670,16 +678,16 @@ eapGssSmAcceptReauthCreds(OM_uint32 *minor,
 
 static OM_uint32
 eapGssSmAcceptCompleteInitiatorExts(OM_uint32 *minor,
-                                    gss_cred_id_t cred,
+                                    gss_cred_id_t cred GSSEAP_UNUSED,
                                     gss_ctx_id_t ctx,
-                                    gss_name_t target,
-                                    gss_OID mech,
-                                    OM_uint32 reqFlags,
-                                    OM_uint32 timeReq,
-                                    gss_channel_bindings_t chanBindings,
-                                    gss_buffer_t inputToken,
-                                    gss_buffer_t outputToken,
-                                    OM_uint32 *smFlags)
+                                    gss_name_t target GSSEAP_UNUSED,
+                                    gss_OID mech GSSEAP_UNUSED,
+                                    OM_uint32 reqFlags GSSEAP_UNUSED,
+                                    OM_uint32 timeReq GSSEAP_UNUSED,
+                                    gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                                    gss_buffer_t inputToken GSSEAP_UNUSED,
+                                    gss_buffer_t outputToken GSSEAP_UNUSED,
+                                    OM_uint32 *smFlags GSSEAP_UNUSED)
 {
     GSSEAP_SM_TRANSITION_NEXT(ctx);
 
@@ -690,15 +698,15 @@ eapGssSmAcceptCompleteInitiatorExts(OM_uint32 *minor,
 
 static OM_uint32
 eapGssSmAcceptCompleteAcceptorExts(OM_uint32 *minor,
-                                   gss_cred_id_t cred,
+                                   gss_cred_id_t cred GSSEAP_UNUSED,
                                    gss_ctx_id_t ctx,
-                                   gss_name_t target,
-                                   gss_OID mech,
-                                   OM_uint32 reqFlags,
-                                   OM_uint32 timeReq,
-                                   gss_channel_bindings_t chanBindings,
-                                   gss_buffer_t inputToken,
-                                   gss_buffer_t outputToken,
+                                   gss_name_t target GSSEAP_UNUSED,
+                                   gss_OID mech GSSEAP_UNUSED,
+                                   OM_uint32 reqFlags GSSEAP_UNUSED,
+                                   OM_uint32 timeReq GSSEAP_UNUSED,
+                                   gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
+                                   gss_buffer_t inputToken GSSEAP_UNUSED,
+                                   gss_buffer_t outputToken GSSEAP_UNUSED,
                                    OM_uint32 *smFlags)
 {
     GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
@@ -739,21 +747,21 @@ static struct gss_eap_sm eapGssAcceptorSm[] = {
         ITOK_TYPE_NONE,
         ITOK_TYPE_EAP_REQ,
         GSSEAP_STATE_INITIAL,
-        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
+        SM_ITOK_FLAG_REQUIRED,
         eapGssSmAcceptIdentity,
     },
     {
         ITOK_TYPE_EAP_RESP,
         ITOK_TYPE_EAP_REQ,
         GSSEAP_STATE_AUTHENTICATE,
-        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
+        SM_ITOK_FLAG_REQUIRED,
         eapGssSmAcceptAuthenticate
     },
     {
         ITOK_TYPE_GSS_CHANNEL_BINDINGS,
         ITOK_TYPE_NONE,
         GSSEAP_STATE_INITIATOR_EXTS,
-        SM_ITOK_FLAG_CRITICAL | SM_ITOK_FLAG_REQUIRED,
+        SM_ITOK_FLAG_REQUIRED,
         eapGssSmAcceptGssChannelBindings,
     },
     {
@@ -923,10 +931,10 @@ static OM_uint32
 eapGssSmAcceptGssReauth(OM_uint32 *minor,
                         gss_cred_id_t cred,
                         gss_ctx_id_t ctx,
-                        gss_name_t target,
+                        gss_name_t target GSSEAP_UNUSED,
                         gss_OID mech,
-                        OM_uint32 reqFlags,
-                        OM_uint32 timeReq,
+                        OM_uint32 reqFlags GSSEAP_UNUSED,
+                        OM_uint32 timeReq GSSEAP_UNUSED,
                         gss_channel_bindings_t chanBindings,
                         gss_buffer_t inputToken,
                         gss_buffer_t outputToken,
@@ -962,10 +970,16 @@ eapGssSmAcceptGssReauth(OM_uint32 *minor,
         if (major == GSS_S_COMPLETE) {
             GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
         }
+        ctx->gssFlags = gssFlags;
+    } else if (GSS_ERROR(major) &&
+        (*smFlags & SM_FLAG_INPUT_TOKEN_CRITICAL) == 0) {
+        /* pretend reauthentication attempt never happened */
+        gssDeleteSecContext(&tmpMinor, &ctx->kerberosCtx, GSS_C_NO_BUFFER);
+        ctx->flags &= ~(CTX_FLAG_KRB_REAUTH);
+        GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);
+        major = GSS_S_CONTINUE_NEEDED;
     }
 
-    ctx->gssFlags = gssFlags;
-
     gssReleaseName(&tmpMinor, &krbInitiator);
 
     return major;