Merge branch 'master' into debian

0.9.3 most of the changes

diff --git a/configure.ac b/configure.ac
index fabdb9c..5695d5c 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1,5 +1,5 @@
 AC_PREREQ([2.61])
-AC_INIT([mech_eap], [0.9.2], [bugs@project-moonshot.org])
+AC_INIT([mech_eap], [0.9.3], [bugs@project-moonshot.org])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_AUX_DIR([build-aux])
 

diff --git a/libeap/src/crypto/tls_openssl.c b/libeap/src/crypto/tls_openssl.c
index c0a40f9..d155c09 100644 (file)
--- a/libeap/src/crypto/tls_openssl.c
+++ b/libeap/src/crypto/tls_openssl.c
@@ -767,13 +767,7 @@ void tls_deinit(void *ssl_ctx)
 
        tls_openssl_ref_count--;
        if (tls_openssl_ref_count == 0) {
-#ifndef OPENSSL_NO_ENGINE
-               ENGINE_cleanup();
-#endif /* OPENSSL_NO_ENGINE */
-               CRYPTO_cleanup_all_ex_data();
                ERR_remove_state(0);
-               ERR_free_strings();
-               EVP_cleanup();
                os_free(tls_global);
                tls_global = NULL;
        }

diff --git a/mech_eap/accept_sec_context.c b/mech_eap/accept_sec_context.c
index 1cbf275..3518d30 100644 (file)
--- a/mech_eap/accept_sec_context.c
+++ b/mech_eap/accept_sec_context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, JANET(UK)
+ * Copyright (c) 2011, 2013, 2015, JANET(UK)
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -439,6 +439,52 @@ createRadiusHandle(OM_uint32 *minor,
     return GSS_S_COMPLETE;
 }
 
+/**
+ * Choose the correct error for an access reject packet.
+ */
+static OM_uint32
+eapGssAcceptHandleReject(
+                        OM_uint32 *minor,
+                        struct rs_packet *response)
+{
+    rs_avp **vps;
+    rs_const_avp  *vp = NULL;
+    OM_uint32 major;
+    const char * reply_message = NULL;
+    size_t reply_length = 0;
+
+    rs_packet_avps(response, &vps);
+    major = gssEapRadiusGetRawAvp(minor, *vps,
+                                 PW_REPLY_MESSAGE, 0, &vp);
+    if (!GSS_ERROR(major)) {
+       reply_message = rs_avp_string_value(vp);
+       reply_length = rs_avp_length(vp);
+    }
+
+    major = gssEapRadiusGetRawAvp(minor, *vps,
+                                 PW_ERROR_CAUSE, 0, &vp);
+    if (!GSS_ERROR(major)) {
+       switch (rs_avp_integer_value(vp)) {
+           /* Values from http://www.iana.org/assignments/radius-types/radius-types.xhtml#radius-types-18                                                      */
+       case 502: /*request not routable (proxy)*/
+           *minor = GSSEAP_RADIUS_UNROUTABLE;
+           break;
+       case 501: /*administratively prohibited*/
+           *minor = GSSEAP_RADIUS_ADMIN_PROHIBIT;
+           break;
+
+       default:
+           *minor = GSSEAP_RADIUS_AUTH_FAILURE;
+           break;
+       }
+    } else *minor = GSSEAP_RADIUS_AUTH_FAILURE;
+
+    if (reply_message)
+       gssEapSaveStatusInfo(*minor, "%s: %.*s", error_message(*minor),
+                            reply_length, reply_message);
+    else gssEapSaveStatusInfo( *minor, "%s", error_message(*minor));
+    return GSS_S_DEFECTIVE_CREDENTIAL;
+}
 /*
  * Process a EAP response from the initiator.
  */
@@ -527,8 +573,7 @@ eapGssSmAcceptAuthenticate(OM_uint32 *minor,
     case PW_ACCESS_ACCEPT:
         break;
     case PW_ACCESS_REJECT:
-        *minor = GSSEAP_RADIUS_AUTH_FAILURE;
-        major = GSS_S_DEFECTIVE_CREDENTIAL;
+       major = eapGssAcceptHandleReject( minor, resp);
         goto cleanup;
         break;
     default:

diff --git a/mech_eap/gssapiP_eap.h b/mech_eap/gssapiP_eap.h
index 0a81cd8..4dc0f34 100644 (file)
--- a/mech_eap/gssapiP_eap.h
+++ b/mech_eap/gssapiP_eap.h
@@ -337,7 +337,7 @@ gssEapDisplayStatus(OM_uint32 *minor,
                     OM_uint32 status_value,
                     gss_buffer_t status_string);
 
-#define IS_WIRE_ERROR(err)              ((err) > GSSEAP_RESERVED && \
+#define IS_WIRE_ERROR(err)              ((err) >= GSSEAP_RESERVED && \
                                          (err) <= GSSEAP_RADIUS_PROT_FAILURE)
 
 #ifdef GSSEAP_ENABLE_ACCEPTOR

diff --git a/mech_eap/gsseap_err.et b/mech_eap/gsseap_err.et
index fc8ed82..6321e93 100644 (file)
--- a/mech_eap/gsseap_err.et
+++ b/mech_eap/gsseap_err.et
@@ -33,7 +33,7 @@
 error_table eapg
 
 #
-# Protocol errors that can be returned in an error token. This should match
+# Standards-track Protocol errors that can be returned in an error token. This should match
 # up with makeErrorToken in accept_sec_context.c.
 #
 error_code GSSEAP_RESERVED,                     ""
@@ -54,6 +54,13 @@ error_code GSSEAP_UNKNOWN_RADIUS_CODE,          "Received unknown response code
 error_code GSSEAP_MISSING_EAP_REQUEST,          "RADIUS response is missing EAP request"
 error_code GSSEAP_RADIUS_PROT_FAILURE,          "Generic RADIUS failure"
 
+# Extension errors starting with 128 that can be returned in a
+#protocol token; again should match accept_sec_context.c 
+
+error_code GSSEAP_RADIUS_UNROUTABLE, "Proxy had no route to identity
+provider realm"
+
+error_code GSSEAP_RADIUS_ADMIN_PROHIBIT, "IDP Administratively Prohibits Request"
 #
 # Context errors
 #

diff --git a/mech_eap/init_sec_context.c b/mech_eap/init_sec_context.c
index c1f3980..5f87e40 100644 (file)
--- a/mech_eap/init_sec_context.c
+++ b/mech_eap/init_sec_context.c
@@ -630,7 +630,10 @@ eapGssSmInitError(OM_uint32 *minor,
     p = (unsigned char *)inputToken->value;
 
     major = load_uint32_be(&p[0]);
-    *minor = ERROR_TABLE_BASE_eapg + load_uint32_be(&p[4]);
+    *minor =  load_uint32_be(&p[4]);
+    if ((*minor >0) && (*minor < 128))
+      * minor += ERROR_TABLE_BASE_eapg;
+    else *minor = 0;
 
     if (!GSS_ERROR(major) || !IS_WIRE_ERROR(*minor)) {
         major = GSS_S_FAILURE;

diff --git a/mech_eap/util_sm.c b/mech_eap/util_sm.c
index 56248d8..a286bba 100644 (file)
--- a/mech_eap/util_sm.c
+++ b/mech_eap/util_sm.c
@@ -115,10 +115,11 @@ makeErrorToken(OM_uint32 *minor,
         minorStatus = GSSEAP_RADIUS_PROT_FAILURE;
     } else if (!IS_WIRE_ERROR(minorStatus)) {
         /* Don't return non-wire error codes */
-        return GSS_S_COMPLETE;
+      minorStatus = 0;
     }
 
-    minorStatus -= ERROR_TABLE_BASE_eapg;
+    if (minorStatus != 0)
+      minorStatus -= ERROR_TABLE_BASE_eapg;
 
     store_uint32_be(majorStatus, &errorData[0]);
     store_uint32_be(minorStatus, &errorData[4]);