more error handling improvements

diff --git a/TODO b/TODO
index 5bdebb2..668ff4e 100644 (file)
--- a/TODO
+++ b/TODO
@@ -1,8 +1,3 @@
-- better handling of mechanism-specific error namespace
-- textual error codes
-- better interfaces for initiator EAP configuration/credential management
-- make CBT ASN.1 ??
 - integration with initiator-side EAP channel bindings
 - integration with final supplicant architecture
-- integration with libradsec
 - port to Heimdal

diff --git a/gsseap_err.et b/gsseap_err.et
index 0fb4407..9b5cf6f 100644 (file)
--- a/gsseap_err.et
+++ b/gsseap_err.et
@@ -70,5 +70,7 @@ error_code GSSEAP_BAD_PADDING_IOV,          "Padding IOV is not permitted for RF
 error_code GSSEAP_BAD_PRF_KEY,              "PRF key usage type is unknown"
 error_code GSSEAP_BAD_ERROR_TOKEN,          "Error token is malformed or corrupt"
 error_code GSSEAP_BAD_WRAP_TOKEN,           "Bad RFC 4121 wrap or MIC token"
+error_code GSSEAP_BINDINGS_MISMATCH,        "Channel bindings do not match"
+error_code GSSEAP_NO_MECHGLUE_SYMBOL,       "Could not find symbol in mechanism glue"
 
 end

diff --git a/util_exts.c b/util_exts.c
index ccc86ec..54a3437 100644 (file)
--- a/util_exts.c
+++ b/util_exts.c
@@ -88,10 +88,11 @@ verifyGssChannelBindings(OM_uint32 *minor,
     major = gssEapUnwrapOrVerifyMIC(minor, ctx, NULL, NULL,
                                     iov, 2, TOK_TYPE_WRAP);
     if (GSS_ERROR(major))
-        return major;
+        return GSS_S_BAD_BINDINGS;
 
     if (chanBindings != GSS_C_NO_CHANNEL_BINDINGS &&
         !bufferEqual(&iov[0].buffer, &chanBindings->application_data)) {
+        *minor = GSSEAP_BINDINGS_MISMATCH;
         major = GSS_S_BAD_BINDINGS;
     } else {
         major = GSS_S_COMPLETE;
@@ -430,6 +431,7 @@ decodeExtensions(OM_uint32 *minor,
         gss_buffer_desc extension;
 
         if (remain < 8) {
+            *minor = GSSEAP_WRONG_SIZE;
             major = GSS_S_DEFECTIVE_TOKEN;
             goto cleanup;
         }
@@ -447,6 +449,7 @@ decodeExtensions(OM_uint32 *minor,
         extension.length = load_uint32_be(&p[4]);
 
         if (remain < 8 + extension.length) {
+            *minor = GSSEAP_WRONG_SIZE;
             major = GSS_S_DEFECTIVE_TOKEN;
             goto cleanup;
         }

diff --git a/util_mech.c b/util_mech.c
index 717e09b..62540ae 100644 (file)
--- a/util_mech.c
+++ b/util_mech.c
@@ -105,8 +105,10 @@ gssEapValidateMechs(OM_uint32 *minor,
     for (i = 0; i < mechs->count; i++) {
         gss_OID oid = &mechs->elements[i];
 
-        if (!gssEapIsConcreteMechanismOid(oid))
+        if (!gssEapIsConcreteMechanismOid(oid)) {
+            *minor = GSSEAP_WRONG_MECH;
             return GSS_S_BAD_MECH;
+        }
     }
 
     return GSS_S_COMPLETE;

diff --git a/util_name.c b/util_name.c
index 575e3c3..d01646c 100644 (file)
--- a/util_name.c
+++ b/util_name.c
@@ -94,6 +94,8 @@ gssEapReleaseName(OM_uint32 *minor, gss_name_t *pName)
     krb5_context krbContext = NULL;
     OM_uint32 tmpMinor;
 
+    *minor = 0;
+
     if (pName == NULL) {
         return GSS_S_COMPLETE;
     }
@@ -112,7 +114,6 @@ gssEapReleaseName(OM_uint32 *minor, gss_name_t *pName)
     GSSEAP_FREE(name);
     *pName = NULL;
 
-    *minor = 0;
     return GSS_S_COMPLETE;
 }
 

diff --git a/util_oid.c b/util_oid.c
index 687943d..0f10076 100644 (file)
--- a/util_oid.c
+++ b/util_oid.c
@@ -63,7 +63,6 @@ duplicateOid(OM_uint32 *minor,
 {
     gss_OID p;
 
-    *minor = 0;
     *newOid = GSS_C_NO_OID;
 
     p = (gss_OID)GSSEAP_MALLOC(sizeof(*p));
@@ -75,12 +74,14 @@ duplicateOid(OM_uint32 *minor,
     p->elements = GSSEAP_MALLOC(p->length);
     if (p->elements == NULL) {
         GSSEAP_FREE(p);
+        *minor = ENOMEM;
         return GSS_S_FAILURE;
     }
 
     memcpy(p->elements, oid->elements, p->length);
     *newOid = p;
 
+    *minor = 0;
     return GSS_S_COMPLETE;
 }
 

diff --git a/util_reauth.c b/util_reauth.c
index 409287e..239f2b8 100644 (file)
--- a/util_reauth.c
+++ b/util_reauth.c
@@ -804,11 +804,20 @@ static OM_uint32
                           gss_buffer_t,
                           int *);
 
-#define NEXT_SYMBOL(local, global)  ((local) = dlsym(RTLD_NEXT, (global)))
+#define NEXT_SYMBOL(local, global)  do {        \
+        ((local) = dlsym(RTLD_NEXT, (global))); \
+        if ((local) == NULL) {                  \
+            *minor = GSSEAP_NO_MECHGLUE_SYMBOL; \
+            major = GSS_S_UNAVAILABLE;          \
+            /* but continue */                  \
+        }                                       \
+    } while (0)
 
 OM_uint32
 gssEapReauthInitialize(OM_uint32 *minor)
 {
+    OM_uint32 major = GSS_S_COMPLETE;
+
     NEXT_SYMBOL(gssInitSecContextNext,         "gss_init_sec_context");
     NEXT_SYMBOL(gssAcceptSecContextNext,       "gss_accept_sec_context");
     NEXT_SYMBOL(gssReleaseCredNext,            "gss_release_cred");
@@ -820,7 +829,7 @@ gssEapReauthInitialize(OM_uint32 *minor)
     NEXT_SYMBOL(gssStoreCredNext,              "gss_store_cred");
     NEXT_SYMBOL(gssGetNameAttributeNext,       "gss_get_name_attribute");
 
-    return GSS_S_COMPLETE;
+    return major;
 }
 
 OM_uint32
@@ -838,8 +847,10 @@ gssInitSecContext(OM_uint32 *minor,
                   OM_uint32 *ret_flags,
                   OM_uint32 *time_rec)
 {
-    if (gssInitSecContextNext == NULL)
+    if (gssInitSecContextNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssInitSecContextNext(minor, cred, context_handle,
                                  target_name, mech_type, req_flags,
@@ -861,8 +872,10 @@ gssAcceptSecContext(OM_uint32 *minor,
                     OM_uint32 *time_rec,
                     gss_cred_id_t *delegated_cred_handle)
 {
-    if (gssAcceptSecContextNext == NULL)
+    if (gssAcceptSecContextNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssAcceptSecContextNext(minor, context_handle, cred,
                                    input_token, input_chan_bindings,
@@ -874,8 +887,10 @@ OM_uint32
 gssReleaseCred(OM_uint32 *minor,
                gss_cred_id_t *cred_handle)
 {
-    if (gssReleaseCredNext == NULL)
+    if (gssReleaseCredNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssReleaseCredNext(minor, cred_handle);
 }
@@ -884,8 +899,10 @@ OM_uint32
 gssReleaseName(OM_uint32 *minor,
                gss_name_t *name)
 {
-    if (gssReleaseName == NULL)
+    if (gssReleaseName == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssReleaseNameNext(minor, name);
 }
@@ -895,8 +912,10 @@ gssDeleteSecContext(OM_uint32 *minor,
                     gss_ctx_id_t *context_handle,
                     gss_buffer_t output_token)
 {
-    if (gssDeleteSecContextNext == NULL)
+    if (gssDeleteSecContextNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssDeleteSecContextNext(minor, context_handle, output_token);
 }
@@ -907,8 +926,10 @@ gssDisplayName(OM_uint32 *minor,
                gss_buffer_t buffer,
                gss_OID *name_type)
 {
-    if (gssDisplayNameNext == NULL)
+    if (gssDisplayNameNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssDisplayNameNext(minor, name, buffer, name_type);
 }
@@ -919,8 +940,10 @@ gssImportName(OM_uint32 *minor,
               gss_OID name_type,
               gss_name_t *name)
 {
-    if (gssImportNameNext == NULL)
+    if (gssImportNameNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssImportNameNext(minor, buffer, name_type, name);
 }
@@ -931,8 +954,10 @@ gssInquireSecContextByOid(OM_uint32 *minor,
                           const gss_OID desired_object,
                           gss_buffer_set_t *data_set)
 {
-    if (gssInquireSecContextByOidNext == NULL)
+    if (gssInquireSecContextByOidNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssInquireSecContextByOidNext(minor, context_handle,
                                          desired_object, data_set);
@@ -948,8 +973,10 @@ gssStoreCred(OM_uint32 *minor,
              gss_OID_set *elements_stored,
              gss_cred_usage_t *cred_usage_stored)
 {
-    if (gssStoreCredNext == NULL)
+    if (gssStoreCredNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssStoreCredNext(minor, input_cred_handle, input_usage,
                             desired_mech, overwrite_cred, default_cred,
@@ -966,8 +993,10 @@ gssGetNameAttribute(OM_uint32 *minor,
                     gss_buffer_t display_value,
                     int *more)
 {
-    if (gssGetNameAttributeNext == NULL)
+    if (gssGetNameAttributeNext == NULL) {
+        *minor = GSSEAP_NO_MECHGLUE_SYMBOL;
         return GSS_S_UNAVAILABLE;
+    }
 
     return gssGetNameAttributeNext(minor, name, attr, authenticated, complete,
                                    value, display_value, more);