www.project-moonshot.org Git - mech_eap.orig/blob - accept_sec_context.c

   1 /*
   2  * Copyright (c) 2010, JANET(UK)
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of JANET(UK) nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 #include "gssapiP_eap.h"
  34
  35 #ifdef GSSEAP_ENABLE_REAUTH
  36 static OM_uint32
  37 eapGssSmAcceptGssReauth(OM_uint32 *minor,
  38                         gss_ctx_id_t ctx,
  39                         gss_cred_id_t cred,
  40                         gss_buffer_t inputToken,
  41                         gss_channel_bindings_t chanBindings,
  42                         gss_buffer_t outputToken);
  43 #endif
  44
  45 /*
  46  * Mark a context as ready for cryptographic operations
  47  */
  48 static OM_uint32
  49 acceptReadyEap(OM_uint32 *minor, gss_ctx_id_t ctx, gss_cred_id_t cred)
  50 {
  51     OM_uint32 major, tmpMinor;
  52     VALUE_PAIR *vp;
  53     gss_buffer_desc nameBuf = GSS_C_EMPTY_BUFFER;
  54
  55     /* Cache encryption type derived from selected mechanism OID */
  56     major = gssEapOidToEnctype(minor, ctx->mechanismUsed,
  57                                &ctx->encryptionType);
  58     if (GSS_ERROR(major))
  59         return major;
  60
  61     gssEapReleaseName(&tmpMinor, &ctx->initiatorName);
  62
  63     vp = pairfind(ctx->acceptorCtx.avps, PW_USER_NAME);
  64     if (vp != NULL) {
  65         nameBuf.length = vp->length;
  66         nameBuf.value = vp->vp_strvalue;
  67     } else {
  68         ctx->gssFlags |= GSS_C_ANON_FLAG;
  69     }
  70
  71     major = gssEapImportName(minor, &nameBuf, GSS_C_NT_USER_NAME,
  72                              &ctx->initiatorName);
  73     if (GSS_ERROR(major))
  74         return major;
  75
  76     ctx->initiatorName->attrCtx = gssEapCreateAttrContext(cred, ctx);
  77
  78     major = gssEapRadiusGetRawAvp(minor, ctx->acceptorCtx.avps,
  79                                   PW_MS_MPPE_SEND_KEY, VENDORPEC_MS, &vp);
  80     if (major == GSS_S_COMPLETE && ctx->encryptionType != ENCTYPE_NULL) {
  81         major = gssEapDeriveRfc3961Key(minor,
  82                                        vp->vp_octets,
  83                                        vp->length,
  84                                        ctx->encryptionType,
  85                                        &ctx->rfc3961Key);
  86         if (GSS_ERROR(major))
  87             return major;
  88
  89         major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key,
  90                                            &ctx->checksumType);
  91         if (GSS_ERROR(major))
  92             return major;
  93     } else {
  94         /*
  95          * draft-howlett-eap-gss says that integrity/confidentialty should
  96          * always be advertised as available, but if we have no keying
  97          * material it seems confusing to the caller to advertise this.
  98          */
  99         ctx->gssFlags &= ~(GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG);
 100         ctx->encryptionType = ENCTYPE_NULL;
 101     }
 102
 103     major = sequenceInit(minor,
 104                          &ctx->seqState, ctx->recvSeq,
 105                          ((ctx->gssFlags & GSS_C_REPLAY_FLAG) != 0),
 106                          ((ctx->gssFlags & GSS_C_SEQUENCE_FLAG) != 0),
 107                          TRUE);
 108     if (GSS_ERROR(major))
 109         return major;
 110
 111     return GSS_S_COMPLETE;
 112 }
 113
 114 static OM_uint32
 115 eapGssSmAcceptIdentity(OM_uint32 *minor,
 116                        gss_ctx_id_t ctx,
 117                        gss_cred_id_t cred,
 118                        gss_buffer_t inputToken,
 119                        gss_channel_bindings_t chanBindings,
 120                        gss_buffer_t outputToken)
 121 {
 122     OM_uint32 major;
 123     union {
 124         struct eap_hdr pdu;
 125         unsigned char data[5];
 126     } pkt;
 127     gss_buffer_desc pktBuffer;
 128
 129     if (inputToken != GSS_C_NO_BUFFER && inputToken->length != 0)
 130         return GSS_S_DEFECTIVE_TOKEN;
 131
 132     assert(ctx->acceptorName == GSS_C_NO_NAME);
 133
 134     if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
 135         major = gssEapDuplicateName(minor, cred->name, &ctx->acceptorName);
 136         if (GSS_ERROR(major))
 137             return major;
 138     }
 139
 140     pkt.pdu.code = EAP_CODE_REQUEST;
 141     pkt.pdu.identifier = 0;
 142     pkt.pdu.length = htons(sizeof(pkt.data));
 143     pkt.data[4] = EAP_TYPE_IDENTITY;
 144
 145     pktBuffer.length = sizeof(pkt.data);
 146     pktBuffer.value = pkt.data;
 147
 148     major = duplicateBuffer(minor, &pktBuffer, outputToken);
 149     if (GSS_ERROR(major))
 150         return major;
 151
 152     ctx->state = EAP_STATE_AUTHENTICATE;
 153
 154     return GSS_S_CONTINUE_NEEDED;
 155 }
 156
 157 static OM_uint32
 158 setAcceptorIdentity(OM_uint32 *minor,
 159                     gss_ctx_id_t ctx,
 160                     VALUE_PAIR **avps)
 161 {
 162     OM_uint32 major;
 163     gss_buffer_desc nameBuf;
 164     krb5_context krbContext = NULL;
 165     krb5_principal krbPrinc;
 166     struct rs_handle *rh = ctx->acceptorCtx.radHandle;
 167
 168     assert(rh != NULL);
 169
 170     /* Awaits further specification */
 171     if (ctx->acceptorName == GSS_C_NO_NAME)
 172         return GSS_S_COMPLETE;
 173
 174     GSSEAP_KRB_INIT(&krbContext);
 175
 176     krbPrinc = ctx->acceptorName->krbPrincipal;
 177     assert(krbPrinc != NULL);
 178
 179     if (krb5_princ_size(krbContext, krbPrinc) < 2)
 180         return GSS_S_BAD_NAME;
 181
 182     /* Acceptor-Service-Name */
 183     krbDataToGssBuffer(krb5_princ_component(krbContext, krbPrinc, 0), &nameBuf);
 184
 185     major = gssEapRadiusAddAvp(minor, rh, avps,
 186                                PW_GSS_ACCEPTOR_SERVICE_NAME,
 187                                VENDORPEC_UKERNA,
 188                                &nameBuf);
 189     if (GSS_ERROR(major))
 190         return major;
 191
 192     /* Acceptor-Host-Name */
 193     krbDataToGssBuffer(krb5_princ_component(krbContext, krbPrinc, 1), &nameBuf);
 194
 195     major = gssEapRadiusAddAvp(minor, rh, avps,
 196                                PW_GSS_ACCEPTOR_HOST_NAME,
 197                                VENDORPEC_UKERNA,
 198                                &nameBuf);
 199     if (GSS_ERROR(major))
 200         return major;
 201
 202     if (krb5_princ_size(krbContext, krbPrinc) > 2) {
 203         /* Acceptor-Service-Specific */
 204         krb5_principal_data ssiPrinc = *krbPrinc;
 205         char *ssi;
 206
 207         krb5_princ_size(krbContext, &ssiPrinc) -= 2;
 208         krb5_princ_name(krbContext, &ssiPrinc) += 2;
 209
 210         *minor = krb5_unparse_name_flags(krbContext, &ssiPrinc,
 211                                          KRB5_PRINCIPAL_UNPARSE_NO_REALM, &ssi);
 212         if (*minor != 0)
 213             return GSS_S_FAILURE;
 214
 215         nameBuf.value = ssi;
 216         nameBuf.length = strlen(ssi);
 217
 218         major = gssEapRadiusAddAvp(minor, rh, avps,
 219                                    PW_GSS_ACCEPTOR_SERVICE_SPECIFIC,
 220                                    VENDORPEC_UKERNA,
 221                                    &nameBuf);
 222
 223         if (GSS_ERROR(major)) {
 224             krb5_free_unparsed_name(krbContext, ssi);
 225             return major;
 226         }
 227         krb5_free_unparsed_name(krbContext, ssi);
 228     }
 229
 230     krbDataToGssBuffer(krb5_princ_realm(krbContext, krbPrinc), &nameBuf);
 231     if (nameBuf.length != 0) {
 232         /* Acceptor-Realm-Name */
 233         major = gssEapRadiusAddAvp(minor, rh, avps,
 234                                    PW_GSS_ACCEPTOR_REALM_NAME,
 235                                    VENDORPEC_UKERNA,
 236                                    &nameBuf);
 237         if (GSS_ERROR(major))
 238             return major;
 239     }
 240
 241     return GSS_S_COMPLETE;
 242 }
 243
 244 static OM_uint32
 245 eapGssSmAcceptAuthenticate(OM_uint32 *minor,
 246                            gss_ctx_id_t ctx,
 247                            gss_cred_id_t cred,
 248                            gss_buffer_t inputToken,
 249                            gss_channel_bindings_t chanBindings,
 250                            gss_buffer_t outputToken)
 251 {
 252     OM_uint32 major, tmpMinor;
 253     struct rs_handle *rh;
 254     struct rs_connection *rconn;
 255     struct rs_packet *req = NULL, *resp = NULL;
 256     struct radius_packet *frreq, *frresp;
 257     int sendAcceptorIdentity = 0;
 258
 259     if (ctx->acceptorCtx.radHandle == NULL) {
 260         /* May be NULL from an imported partial context */
 261         major = gssEapRadiusAllocConn(minor, cred, ctx);
 262         if (GSS_ERROR(major))
 263             goto cleanup;
 264
 265         sendAcceptorIdentity = 1;
 266     }
 267
 268     rh = ctx->acceptorCtx.radHandle;
 269     rconn = ctx->acceptorCtx.radConn;
 270
 271     if (rs_packet_create_acc_request(rconn, &req, NULL, NULL) != 0) {
 272         major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
 273         goto cleanup;
 274     }
 275     frreq = rs_packet_frpkt(req);
 276
 277     if (sendAcceptorIdentity) {
 278         major = setAcceptorIdentity(minor, ctx, &frreq->vps);
 279         if (GSS_ERROR(major))
 280             goto cleanup;
 281     }
 282
 283     major = gssEapRadiusAddAvp(minor, rh, &frreq->vps, PW_EAP_MESSAGE, 0, inputToken);
 284     if (GSS_ERROR(major))
 285         goto cleanup;
 286
 287     if (ctx->acceptorCtx.state.length != 0) {
 288         major = gssEapRadiusAddAvp(minor, rh, &frreq->vps, PW_STATE, 0,
 289                                    &ctx->acceptorCtx.state);
 290         if (GSS_ERROR(major))
 291             goto cleanup;
 292
 293         gss_release_buffer(&tmpMinor, &ctx->acceptorCtx.state);
 294     }
 295
 296     if (rs_packet_send(req, NULL) != 0) {
 297         major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
 298         goto cleanup;
 299     }
 300     req = NULL;
 301
 302     if (rs_conn_receive_packet(rconn, &resp) != 0) {
 303         major = gssEapRadiusMapError(minor, rs_err_conn_pop(rconn));
 304         goto cleanup;
 305     }
 306
 307     frresp = rs_packet_frpkt(resp);
 308     switch (frresp->code) {
 309     case PW_AUTHENTICATION_ACK:
 310     case PW_ACCESS_CHALLENGE:
 311         major = GSS_S_CONTINUE_NEEDED;
 312         break;
 313     case PW_AUTHENTICATION_REJECT:
 314         major = GSS_S_DEFECTIVE_CREDENTIAL;
 315         goto cleanup;
 316         break;
 317     default:
 318         major = GSS_S_FAILURE;
 319         goto cleanup;
 320         break;
 321     }
 322
 323     major = gssEapRadiusGetAvp(minor, frresp->vps, PW_EAP_MESSAGE, 0,
 324                                outputToken, TRUE);
 325     if ((major == GSS_S_UNAVAILABLE && frresp->code != PW_AUTHENTICATION_ACK) ||
 326         GSS_ERROR(major))
 327         goto cleanup;
 328
 329     if (frresp->code == PW_ACCESS_CHALLENGE) {
 330         major = gssEapRadiusGetAvp(minor, frresp->vps, PW_STATE, 0,
 331                                    &ctx->acceptorCtx.state, TRUE);
 332         if (major != GSS_S_UNAVAILABLE && GSS_ERROR(major))
 333             goto cleanup;
 334     } else {
 335         ctx->acceptorCtx.avps = frresp->vps;
 336         frresp->vps = NULL;
 337
 338         major = acceptReadyEap(minor, ctx, cred);
 339         if (GSS_ERROR(major))
 340             goto cleanup;
 341
 342         ctx->state = EAP_STATE_EXTENSIONS_REQ;
 343     }
 344
 345     major = GSS_S_CONTINUE_NEEDED;
 346
 347 cleanup:
 348     rs_packet_destroy(req);
 349     rs_packet_destroy(resp);
 350
 351     return major;
 352 }
 353
 354 static OM_uint32
 355 acceptGssChannelBindings(OM_uint32 *minor,
 356                          gss_ctx_id_t ctx,
 357                          gss_cred_id_t cred,
 358                          gss_buffer_t inputToken,
 359                          gss_channel_bindings_t chanBindings)
 360 {
 361     OM_uint32 major, tmpMinor;
 362     gss_iov_buffer_desc iov[2];
 363
 364     iov[0].type = GSS_IOV_BUFFER_TYPE_DATA | GSS_IOV_BUFFER_FLAG_ALLOCATE;
 365     iov[0].buffer.length = 0;
 366     iov[0].buffer.value = NULL;
 367
 368     iov[1].type = GSS_IOV_BUFFER_TYPE_STREAM;
 369     iov[1].buffer = *inputToken;
 370
 371     major = gssEapUnwrapOrVerifyMIC(minor, ctx, NULL, NULL,
 372                                     iov, 2, TOK_TYPE_WRAP);
 373     if (GSS_ERROR(major))
 374         return major;
 375
 376     if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS &&
 377         !bufferEqual(&iov[0].buffer, &chanBindings->application_data)) {
 378         major = GSS_S_BAD_BINDINGS;
 379     } else {
 380         major = GSS_S_CONTINUE_NEEDED;
 381     }
 382
 383     gss_release_buffer(&tmpMinor, &iov[0].buffer);
 384
 385     return major;
 386 }
 387
 388 static OM_uint32
 389 eapGssSmAcceptExtensionsReq(OM_uint32 *minor,
 390                             gss_ctx_id_t ctx,
 391                             gss_cred_id_t cred,
 392                             gss_buffer_t inputToken,
 393                             gss_channel_bindings_t chanBindings,
 394                             gss_buffer_t outputToken)
 395 {
 396     OM_uint32 major;
 397
 398     outputToken->length = 0;
 399     outputToken->value = NULL;
 400
 401     major = acceptGssChannelBindings(minor, ctx, cred, inputToken,
 402                                      chanBindings);
 403     if (GSS_ERROR(major))
 404         return major;
 405
 406     ctx->state = EAP_STATE_EXTENSIONS_RESP;
 407
 408     return GSS_S_CONTINUE_NEEDED;
 409 }
 410
 411 static OM_uint32
 412 eapGssSmAcceptExtensionsResp(OM_uint32 *minor,
 413                              gss_ctx_id_t ctx,
 414                              gss_cred_id_t cred,
 415                              gss_buffer_t inputToken,
 416                              gss_channel_bindings_t chanBindings,
 417                              gss_buffer_t outputToken)
 418 {
 419     OM_uint32 major, tmpMinor;
 420     gss_buffer_desc credsToken = GSS_C_EMPTY_BUFFER;
 421
 422 #ifdef GSSEAP_ENABLE_REAUTH
 423     /*
 424      * If we're built with fast reauthentication enabled, then
 425      * fabricate a ticket from the initiator to ourselves.
 426      * Otherwise return an empty token.
 427      */
 428     major = gssEapMakeReauthCreds(minor, ctx, cred, &credsToken);
 429     if (GSS_ERROR(major))
 430         return major;
 431 #else
 432     credsToken.value = "";
 433 #endif /* GSSEAP_ENABLE_REAUTH */
 434
 435     major = duplicateBuffer(minor, &credsToken, outputToken);
 436     if (GSS_ERROR(major)) {
 437         gss_release_buffer(&tmpMinor, &credsToken);
 438         return major;
 439     }
 440
 441 #ifdef GSSEAP_ENABLE_REAUTH
 442     gss_release_buffer(&tmpMinor, &credsToken);
 443 #endif
 444
 445     ctx->state = EAP_STATE_ESTABLISHED;
 446
 447     return GSS_S_COMPLETE;
 448 }
 449
 450 static OM_uint32
 451 eapGssSmAcceptEstablished(OM_uint32 *minor,
 452                           gss_ctx_id_t ctx,
 453                           gss_cred_id_t cred,
 454                           gss_buffer_t inputToken,
 455                           gss_channel_bindings_t chanBindings,
 456                           gss_buffer_t outputToken)
 457 {
 458     /* Called with already established context */
 459     *minor = EINVAL;
 460     return GSS_S_BAD_STATUS;
 461 }
 462
 463 static struct gss_eap_acceptor_sm {
 464     enum gss_eap_token_type inputTokenType;
 465     enum gss_eap_token_type outputTokenType;
 466     OM_uint32 (*processToken)(OM_uint32 *,
 467                               gss_ctx_id_t,
 468                               gss_cred_id_t,
 469                               gss_buffer_t,
 470                               gss_channel_bindings_t,
 471                               gss_buffer_t);
 472 } eapGssAcceptorSm[] = {
 473     { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,    eapGssSmAcceptIdentity           },
 474     { TOK_TYPE_EAP_RESP,    TOK_TYPE_EAP_REQ,    eapGssSmAcceptAuthenticate       },
 475     { TOK_TYPE_EXT_REQ,     TOK_TYPE_NONE,       eapGssSmAcceptExtensionsReq      },
 476     { TOK_TYPE_NONE,        TOK_TYPE_EXT_RESP,   eapGssSmAcceptExtensionsResp     },
 477     { TOK_TYPE_NONE,        TOK_TYPE_NONE,       eapGssSmAcceptEstablished        },
 478 #ifdef GSSEAP_ENABLE_REAUTH
 479     { TOK_TYPE_GSS_REAUTH,  TOK_TYPE_GSS_REAUTH, eapGssSmAcceptGssReauth          },
 480 #endif
 481 };
 482
 483 OM_uint32
 484 gss_accept_sec_context(OM_uint32 *minor,
 485                        gss_ctx_id_t *context_handle,
 486                        gss_cred_id_t cred,
 487                        gss_buffer_t input_token,
 488                        gss_channel_bindings_t input_chan_bindings,
 489                        gss_name_t *src_name,
 490                        gss_OID *mech_type,
 491                        gss_buffer_t output_token,
 492                        OM_uint32 *ret_flags,
 493                        OM_uint32 *time_rec,
 494                        gss_cred_id_t *delegated_cred_handle)
 495 {
 496     OM_uint32 major;
 497     OM_uint32 tmpMajor, tmpMinor;
 498     gss_ctx_id_t ctx = *context_handle;
 499     struct gss_eap_acceptor_sm *sm = NULL;
 500     gss_buffer_desc innerInputToken = GSS_C_EMPTY_BUFFER;
 501     gss_buffer_desc innerOutputToken = GSS_C_EMPTY_BUFFER;
 502     enum gss_eap_token_type tokType;
 503     int initialContextToken = 0;
 504
 505     *minor = 0;
 506
 507     output_token->length = 0;
 508     output_token->value = NULL;
 509
 510     if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) {
 511         return GSS_S_DEFECTIVE_TOKEN;
 512     }
 513
 514     if (ctx == GSS_C_NO_CONTEXT) {
 515         major = gssEapAllocContext(minor, &ctx);
 516         if (GSS_ERROR(major))
 517             return major;
 518
 519         initialContextToken = 1;
 520         *context_handle = ctx;
 521     }
 522
 523     GSSEAP_MUTEX_LOCK(&ctx->mutex);
 524
 525     /* Validate and lock credentials */
 526     if (cred != GSS_C_NO_CREDENTIAL) {
 527         GSSEAP_MUTEX_LOCK(&cred->mutex);
 528
 529         if ((cred->flags & CRED_FLAG_ACCEPT) == 0) {
 530             major = GSS_S_NO_CRED;
 531             goto cleanup;
 532         }
 533     }
 534
 535     sm = &eapGssAcceptorSm[ctx->state];
 536
 537     major = gssEapVerifyToken(minor, ctx, input_token,
 538                               &tokType, &innerInputToken);
 539     if (GSS_ERROR(major))
 540         goto cleanup;
 541
 542     if (!gssEapCredAvailable(cred, ctx->mechanismUsed)) {
 543         major = GSS_S_BAD_MECH;
 544         goto cleanup;
 545     }
 546
 547 #ifdef GSSEAP_ENABLE_REAUTH
 548     /*
 549      * If we're built with fast reauthentication support, it's valid
 550      * for an initiator to send a GSS reauthentication token as its
 551      * initial context token, causing us to short-circuit the state
 552      * machine and process Kerberos GSS messages instead.
 553      */
 554     if (tokType == TOK_TYPE_GSS_REAUTH && initialContextToken) {
 555         ctx->state = EAP_STATE_KRB_REAUTH_GSS;
 556     } else
 557 #endif
 558     if (tokType != sm->inputTokenType) {
 559         major = GSS_S_DEFECTIVE_TOKEN;
 560         goto cleanup;
 561     }
 562
 563     do {
 564         sm = &eapGssAcceptorSm[ctx->state];
 565
 566         major = (sm->processToken)(minor,
 567                                    ctx,
 568                                    cred,
 569                                    &innerInputToken,
 570                                    input_chan_bindings,
 571                                    &innerOutputToken);
 572         if (GSS_ERROR(major))
 573             goto cleanup;
 574     } while (major == GSS_S_CONTINUE_NEEDED && innerOutputToken.length == 0);
 575
 576     if (mech_type != NULL) {
 577         if (!gssEapInternalizeOid(ctx->mechanismUsed, mech_type))
 578             duplicateOid(&tmpMinor, ctx->mechanismUsed, mech_type);
 579     }
 580     if (innerOutputToken.value != NULL) {
 581         tmpMajor = gssEapMakeToken(&tmpMinor, ctx, &innerOutputToken,
 582                                    sm->outputTokenType, output_token);
 583         if (GSS_ERROR(tmpMajor)) {
 584             major = tmpMajor;
 585             *minor = tmpMinor;
 586             goto cleanup;
 587         }
 588     }
 589     if (ret_flags != NULL)
 590         *ret_flags = ctx->gssFlags;
 591     if (delegated_cred_handle != NULL)
 592         *delegated_cred_handle = GSS_C_NO_CREDENTIAL;
 593
 594     if (major == GSS_S_COMPLETE) {
 595         if (src_name != NULL && ctx->initiatorName != GSS_C_NO_NAME) {
 596             major = gssEapDuplicateName(&tmpMinor, ctx->initiatorName, src_name);
 597             if (GSS_ERROR(major))
 598                 goto cleanup;
 599         }
 600         if (time_rec != NULL)
 601             gssEapContextTime(&tmpMinor, ctx, time_rec);
 602     }
 603
 604     assert(ctx->state == EAP_STATE_ESTABLISHED || major == GSS_S_CONTINUE_NEEDED);
 605
 606 cleanup:
 607     if (cred != GSS_C_NO_CREDENTIAL)
 608         GSSEAP_MUTEX_UNLOCK(&cred->mutex);
 609     GSSEAP_MUTEX_UNLOCK(&ctx->mutex);
 610
 611     if (GSS_ERROR(major))
 612         gssEapReleaseContext(&tmpMinor, context_handle);
 613
 614     gss_release_buffer(&tmpMinor, &innerOutputToken);
 615
 616     return major;
 617 }
 618
 619 #ifdef GSSEAP_ENABLE_REAUTH
 620 static OM_uint32
 621 acceptReadyKrb(OM_uint32 *minor,
 622                gss_ctx_id_t ctx,
 623                gss_cred_id_t cred,
 624                const gss_name_t initiator,
 625                const gss_OID mech,
 626                OM_uint32 timeRec)
 627 {
 628     OM_uint32 major;
 629
 630     major = gssEapGlueToMechName(minor, initiator, &ctx->initiatorName);
 631     if (GSS_ERROR(major))
 632         return major;
 633
 634     if (cred != GSS_C_NO_CREDENTIAL && cred->name != GSS_C_NO_NAME) {
 635         major = gssEapDuplicateName(minor, cred->name, &ctx->acceptorName);
 636         if (GSS_ERROR(major))
 637             return major;
 638     }
 639
 640     major = gssEapReauthComplete(minor, ctx, cred, mech, timeRec);
 641     if (GSS_ERROR(major))
 642         return major;
 643
 644     ctx->state = EAP_STATE_ESTABLISHED;
 645
 646     return GSS_S_COMPLETE;
 647 }
 648
 649 static OM_uint32
 650 eapGssSmAcceptGssReauth(OM_uint32 *minor,
 651                         gss_ctx_id_t ctx,
 652                         gss_cred_id_t cred,
 653                         gss_buffer_t inputToken,
 654                         gss_channel_bindings_t chanBindings,
 655                         gss_buffer_t outputToken)
 656 {
 657     OM_uint32 major, tmpMinor;
 658     gss_cred_id_t krbCred = GSS_C_NO_CREDENTIAL;
 659     gss_name_t krbInitiator = GSS_C_NO_NAME;
 660     gss_OID mech = GSS_C_NO_OID;
 661     OM_uint32 gssFlags, timeRec = GSS_C_INDEFINITE;
 662
 663     ctx->flags |= CTX_FLAG_KRB_REAUTH_GSS;
 664
 665     if (cred != GSS_C_NO_CREDENTIAL)
 666         krbCred = cred->krbCred;
 667
 668     major = gssAcceptSecContext(minor,
 669                                 &ctx->kerberosCtx,
 670                                 krbCred,
 671                                 inputToken,
 672                                 chanBindings,
 673                                 &krbInitiator,
 674                                 &mech,
 675                                 outputToken,
 676                                 &gssFlags,
 677                                 &timeRec,
 678                                 NULL);
 679     if (major == GSS_S_COMPLETE) {
 680         major = acceptReadyKrb(minor, ctx, cred,
 681                                krbInitiator, mech, timeRec);
 682     }
 683
 684     ctx->gssFlags = gssFlags;
 685
 686     gssReleaseName(&tmpMinor, &krbInitiator);
 687
 688     return major;
 689 }
 690 #endif /* GSSEAP_ENABLE_REAUTH */