From 74c732c92e16dabe898c12ef0f27e1d0ccab336a Mon Sep 17 00:00:00 2001
From: Luke Howard <lukeh@padl.com>
Date: Thu, 10 Mar 2011 00:53:53 +1100
Subject: [PATCH] if client fails reauth, allow it to retry EAP

---
 accept_sec_context.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/accept_sec_context.c b/accept_sec_context.c
index 723c932..cc03ccf 100644
--- a/accept_sec_context.c
+++ b/accept_sec_context.c
@@ -962,10 +962,15 @@ eapGssSmAcceptGssReauth(OM_uint32 *minor,
         if (major == GSS_S_COMPLETE) {
             GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
         }
+        ctx->gssFlags = gssFlags;
+    } else {
+        gssDeleteSecContext(&tmpMinor, &ctx->kerberosCtx, GSS_C_NO_BUFFER);
+        ctx->flags &= ~(CTX_FLAG_KRB_REAUTH);
+        GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);
+        *smFlags |= SM_FLAG_RESTART;
+        major = GSS_S_CONTINUE_NEEDED;
     }
 
-    ctx->gssFlags = gssFlags;
-
     gssReleaseName(&tmpMinor, &krbInitiator);
 
     return major;
-- 
2.1.4