check radsec config when acquiring acceptor cred

[mech_eap.orig] / mech_eap / util_radius.cpp

diff --git a/mech_eap/util_radius.cpp b/mech_eap/util_radius.cpp
index 1be1d53..9111e20 100644 (file)
--- a/mech_eap/util_radius.cpp
+++ b/mech_eap/util_radius.cpp
@@ -96,7 +96,7 @@ gss_eap_radius_attr_provider::initWithGssContext(const gss_eap_attr_ctx *manager
                 return false;
 
             /* We assume libradsec validated this for us */
-            assert(pairfind(m_vps, PW_MESSAGE_AUTHENTICATOR) != NULL);
+            GSSEAP_ASSERT(pairfind(m_vps, PW_MESSAGE_AUTHENTICATOR) != NULL);
             m_authenticated = true;
         }
     }
@@ -151,7 +151,7 @@ isInternalAttributeP(uint16_t attrid, uint16_t vendor)
     bool bInternalAttribute = false;
 
     /* should have been filtered */
-    assert(!isSecretAttributeP(attrid, vendor));
+    GSSEAP_ASSERT(!isSecretAttributeP(attrid, vendor));
 
     switch (vendor) {
     case VENDORPEC_UKERNA:
@@ -377,8 +377,7 @@ gss_eap_radius_attr_provider::getAttribute(uint32_t attrid,
     if (isSecretAttributeP(attrid) || isInternalAttributeP(attrid)) {
         return false;
     } else if (isFragmentedAttributeP(attrid)) {
-        return getFragmentedAttribute(ATTRID(attrid),
-                                      VENDOR(attrid),
+        return getFragmentedAttribute(attrid,
                                       authenticated,
                                       complete,
                                       value);
@@ -406,7 +405,8 @@ gss_eap_radius_attr_provider::getAttribute(uint32_t attrid,
         duplicateBuffer(valueBuf, value);
     }
 
-    if (display_value != GSS_C_NO_BUFFER) {
+    if (display_value != GSS_C_NO_BUFFER &&
+        vp->type != PW_TYPE_OCTETS) {
         char displayString[MAX_STRING_LEN];
         gss_buffer_desc displayBuf;
 
@@ -445,6 +445,16 @@ gss_eap_radius_attr_provider::getFragmentedAttribute(uint16_t attribute,
 }
 
 bool
+gss_eap_radius_attr_provider::getFragmentedAttribute(uint32_t attrid,
+                                                     int *authenticated,
+                                                     int *complete,
+                                                     gss_buffer_t value) const
+{
+    return getFragmentedAttribute(ATTRID(attrid), VENDOR(attrid),
+                                  authenticated, complete, value);
+}
+
+bool
 gss_eap_radius_attr_provider::getAttribute(uint16_t attribute,
                                            uint16_t vendor,
                                            int *authenticated,
@@ -480,32 +490,8 @@ gss_eap_radius_attr_provider::releaseAnyNameMapping(gss_buffer_t type_id GSSEAP_
 bool
 gss_eap_radius_attr_provider::init(void)
 {
-    struct rs_context *radContext;
-
     gss_eap_attr_ctx::registerProvider(ATTR_TYPE_RADIUS, createAttrContext);
 
-#if 1
-    /*
-     * This hack is necessary in order to force the loading of the global
-     * dictionary, otherwise accepting reauthentication tokens fails unless
-     * the acceptor has already accepted a normal authentication token.
-     */
-    if (rs_context_create(&radContext) != 0)
-        return false;
-
-    if (rs_context_read_config(radContext, RS_CONFIG_FILE) != 0) {
-        rs_context_destroy(radContext);
-        return false;
-    }
-
-    if (rs_context_init_freeradius_dict(radContext, NULL)) {
-        rs_context_destroy(radContext);
-        return false;
-    }
-
-    rs_context_destroy(radContext);
-#endif
-
     return true;
 }
 
@@ -661,7 +647,7 @@ avpToJson(const VALUE_PAIR *vp)
 {
     JSONObject obj;
 
-    assert(vp->length <= MAX_STRING_LEN);
+    GSSEAP_ASSERT(vp->length <= MAX_STRING_LEN);
 
     switch (vp->type) {
     case PW_TYPE_INTEGER:
@@ -799,7 +785,7 @@ gss_eap_radius_attr_provider::initWithJsonObject(const gss_eap_attr_ctx *ctx,
         pNext = &vp->next;
     }
 
-    m_authenticated = obj["authenticated"].integer();
+    m_authenticated = obj["authenticated"].integer() ? true : false;
 
     return true;
 }
@@ -845,7 +831,7 @@ gssEapRadiusMapError(OM_uint32 *minor,
 {
     int code;
 
-    assert(err != NULL);
+    GSSEAP_ASSERT(err != NULL);
 
     code = rs_err_code(err, 0);
 
@@ -861,3 +847,53 @@ gssEapRadiusMapError(OM_uint32 *minor,
 
     return GSS_S_FAILURE;
 }
+
+OM_uint32
+gssEapCreateRadiusContext(OM_uint32 *minor,
+                          gss_cred_id_t cred,
+                          struct rs_context **pRadContext)
+{
+    const char *configFile = RS_CONFIG_FILE;
+    struct rs_context *radContext;
+    struct rs_alloc_scheme ralloc;
+    struct rs_error *err;
+    OM_uint32 major;
+
+    *pRadContext = NULL;
+
+    if (rs_context_create(&radContext) != 0) {
+        *minor = GSSEAP_RADSEC_CONTEXT_FAILURE;
+        return GSS_S_FAILURE;
+    }
+
+    if (cred->radiusConfigFile.value != NULL)
+        configFile = (const char *)cred->radiusConfigFile.value;
+
+    ralloc.calloc  = GSSEAP_CALLOC;
+    ralloc.malloc  = GSSEAP_MALLOC;
+    ralloc.free    = GSSEAP_FREE;
+    ralloc.realloc = GSSEAP_REALLOC;
+
+    rs_context_set_alloc_scheme(radContext, &ralloc);
+
+    if (rs_context_read_config(radContext, configFile) != 0) {
+        err = rs_err_ctx_pop(radContext);
+        goto fail;
+    }
+
+    if (rs_context_init_freeradius_dict(radContext, NULL) != 0) {
+        err = rs_err_ctx_pop(radContext);
+        goto fail;
+    }
+
+    *pRadContext = radContext;
+
+    *minor = 0;
+    return GSS_S_COMPLETE;
+
+fail:
+    major = gssEapRadiusMapError(minor, err);
+    rs_context_destroy(radContext);
+
+    return major;
+}