Merge branch 'master' into ext-mic

diff --combined mech_eap/init_sec_context.c
index 1945f09,42f9b93..fde5786
--- 1/mech_eap/init_sec_context.c
--- 2/mech_eap/init_sec_context.c
+++ b/mech_eap/init_sec_context.c
@@@ -647,7 -647,6 +647,6 @@@ eapGssSmInitAuthenticate(OM_uint32 *min
  {
      OM_uint32 major;
      OM_uint32 tmpMinor;
-     int code;
      struct wpabuf *resp = NULL;
  
      *minor = 0;
@@@ -668,7 -667,7 +667,7 @@@
  
      major = GSS_S_CONTINUE_NEEDED;
  
-     code = eap_peer_sm_step(ctx->initiatorCtx.eap);
+     eap_peer_sm_step(ctx->initiatorCtx.eap);
      if (ctx->flags & CTX_FLAG_EAP_RESP) {
          ctx->flags &= ~(CTX_FLAG_EAP_RESP);
  
@@@ -715,30 -714,6 +714,30 @@@ cleanup
  }
  
  static OM_uint32
 +eapGssSmInitGssFlags(OM_uint32 *minor,
 +                     gss_cred_id_t cred GSSEAP_UNUSED,
 +                     gss_ctx_id_t ctx,
 +                     gss_name_t target GSSEAP_UNUSED,
 +                     gss_OID mech GSSEAP_UNUSED,
 +                     OM_uint32 reqFlags GSSEAP_UNUSED,
 +                     OM_uint32 timeReq GSSEAP_UNUSED,
 +                     gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
 +                     gss_buffer_t inputToken GSSEAP_UNUSED,
 +                     gss_buffer_t outputToken,
 +                     OM_uint32 *smFlags GSSEAP_UNUSED)
 +{
 +    unsigned char wireFlags[4];
 +    gss_buffer_desc flagsBuf;
 +
 +    store_uint32_be(ctx->gssFlags & GSSEAP_WIRE_FLAGS_MASK, wireFlags);
 +
 +    flagsBuf.length = sizeof(wireFlags);
 +    flagsBuf.value = wireFlags;
 +
 +    return duplicateBuffer(minor, &flagsBuf, outputToken);
 +}
 +
 +static OM_uint32
  eapGssSmInitGssChannelBindings(OM_uint32 *minor,
                                 gss_cred_id_t cred GSSEAP_UNUSED,
                                 gss_ctx_id_t ctx,
@@@ -770,33 -745,6 +769,33 @@@
      return GSS_S_CONTINUE_NEEDED;
  }
  
 +static OM_uint32
 +eapGssSmInitInitiatorMIC(OM_uint32 *minor,
 +                         gss_cred_id_t cred GSSEAP_UNUSED,
 +                         gss_ctx_id_t ctx,
 +                         gss_name_t target GSSEAP_UNUSED,
 +                         gss_OID mech GSSEAP_UNUSED,
 +                         OM_uint32 reqFlags GSSEAP_UNUSED,
 +                         OM_uint32 timeReq GSSEAP_UNUSED,
 +                         gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
 +                         gss_buffer_t inputToken GSSEAP_UNUSED,
 +                         gss_buffer_t outputToken,
 +                         OM_uint32 *smFlags)
 +{
 +    OM_uint32 major;
 +
 +    major = gssEapMakeTokenMIC(minor, ctx, outputToken);
 +    if (GSS_ERROR(major))
 +        return major;
 +
 +    GSSEAP_SM_TRANSITION_NEXT(ctx);
 +
 +    *minor = 0;
 +    *smFlags |= SM_FLAG_OUTPUT_TOKEN_CRITICAL;
 +
 +    return GSS_S_CONTINUE_NEEDED;
 +}
 + 
  #ifdef GSSEAP_ENABLE_REAUTH
  static OM_uint32
  eapGssSmInitReauthCreds(OM_uint32 *minor,
@@@ -825,24 -773,39 +824,24 @@@
  #endif /* GSSEAP_ENABLE_REAUTH */
  
  static OM_uint32
 -eapGssSmInitCompleteInitiatorExts(OM_uint32 *minor,
 -                                  gss_cred_id_t cred GSSEAP_UNUSED,
 -                                  gss_ctx_id_t ctx,
 -                                  gss_name_t target GSSEAP_UNUSED,
 -                                  gss_OID mech GSSEAP_UNUSED,
 -                                  OM_uint32 reqFlags GSSEAP_UNUSED,
 -                                  OM_uint32 timeReq GSSEAP_UNUSED,
 -                                  gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
 -                                  gss_buffer_t inputToken GSSEAP_UNUSED,
 -                                  gss_buffer_t outputToken GSSEAP_UNUSED,
 -                                  OM_uint32 *smFlags)
 +eapGssSmInitAcceptorMIC(OM_uint32 *minor,
 +                        gss_cred_id_t cred GSSEAP_UNUSED,
 +                        gss_ctx_id_t ctx,
 +                        gss_name_t target GSSEAP_UNUSED,
 +                        gss_OID mech GSSEAP_UNUSED,
 +                        OM_uint32 reqFlags GSSEAP_UNUSED,
 +                        OM_uint32 timeReq GSSEAP_UNUSED,
 +                        gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
 +                        gss_buffer_t inputToken,
 +                        gss_buffer_t outputToken GSSEAP_UNUSED,
 +                        OM_uint32 *smFlags GSSEAP_UNUSED)
  {
 -    GSSEAP_SM_TRANSITION_NEXT(ctx);
 -
 -    *minor = 0;
 -    *smFlags |= SM_FLAG_FORCE_SEND_TOKEN;
 +    OM_uint32 major;
  
 -    return GSS_S_CONTINUE_NEEDED;
 -}
 +    major = gssEapVerifyTokenMIC(minor, ctx, inputToken);
 +    if (GSS_ERROR(major))
 +        return major;
  
 -static OM_uint32
 -eapGssSmInitCompleteAcceptorExts(OM_uint32 *minor,
 -                                 gss_cred_id_t cred GSSEAP_UNUSED,
 -                                 gss_ctx_id_t ctx,
 -                                 gss_name_t target GSSEAP_UNUSED,
 -                                 gss_OID mech GSSEAP_UNUSED,
 -                                 OM_uint32 reqFlags GSSEAP_UNUSED,
 -                                 OM_uint32 timeReq GSSEAP_UNUSED,
 -                                 gss_channel_bindings_t chanBindings GSSEAP_UNUSED,
 -                                 gss_buffer_t inputToken GSSEAP_UNUSED,
 -                                 gss_buffer_t outputToken GSSEAP_UNUSED,
 -                                 OM_uint32 *smFlags GSSEAP_UNUSED)
 -{
      GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
  
      *minor = 0;
@@@ -902,13 -865,6 +901,13 @@@ static struct gss_eap_sm eapGssInitiato
      },
      {
          ITOK_TYPE_NONE,
 +        ITOK_TYPE_GSS_FLAGS,
 +        GSSEAP_STATE_INITIATOR_EXTS,
 +        0,
 +        eapGssSmInitGssFlags
 +    },
 +    {
 +        ITOK_TYPE_NONE,
          ITOK_TYPE_GSS_CHANNEL_BINDINGS,
          GSSEAP_STATE_INITIATOR_EXTS,
          SM_ITOK_FLAG_REQUIRED,
@@@ -916,10 -872,10 +915,10 @@@
      },
      {
          ITOK_TYPE_NONE,
 -        ITOK_TYPE_NONE,
 +        ITOK_TYPE_INITIATOR_MIC,
          GSSEAP_STATE_INITIATOR_EXTS,
 -        0,
 -        eapGssSmInitCompleteInitiatorExts
 +        SM_ITOK_FLAG_REQUIRED,
 +        eapGssSmInitInitiatorMIC
      },
  #ifdef GSSEAP_ENABLE_REAUTH
      {
@@@ -932,11 -888,11 +931,11 @@@
  #endif
      /* other extensions go here */
      {
 -        ITOK_TYPE_NONE,
 +        ITOK_TYPE_ACCEPTOR_MIC,
          ITOK_TYPE_NONE,
          GSSEAP_STATE_ACCEPTOR_EXTS,
 -        0,
 -        eapGssSmInitCompleteAcceptorExts
 +        SM_ITOK_FLAG_REQUIRED,
 +        eapGssSmInitAcceptorMIC
      }
  };