remove debugging statement

[moonshot.git] / mech_eap / export_sec_context.c

diff --git a/mech_eap/export_sec_context.c b/mech_eap/export_sec_context.c
index cf3ffb0..2ea2c5c 100644 (file)
--- a/mech_eap/export_sec_context.c
+++ b/mech_eap/export_sec_context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, JANET(UK)
+ * Copyright (c) 2011, JANET(UK)
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,6 +30,11 @@
  * SUCH DAMAGE.
  */
 
+/*
+ * Serialise a security context. On the acceptor, this may be partially
+ * established.
+ */
+
 #include "gssapiP_eap.h"
 
 static OM_uint32
@@ -37,13 +42,57 @@ gssEapExportPartialContext(OM_uint32 *minor,
                            gss_ctx_id_t ctx,
                            gss_buffer_t token)
 {
-    token->length = 0;
-    token->value = NULL;
+    OM_uint32 major, tmpMinor;
+    size_t length, serverLen = 0;
+    unsigned char *p;
+    char serverBuf[MAXHOSTNAMELEN];
+
+    if (ctx->acceptorCtx.radConn != NULL) {
+        if (rs_conn_get_current_peer(ctx->acceptorCtx.radConn,
+                                     serverBuf, sizeof(serverBuf)) != 0) {
+            return gssEapRadiusMapError(minor,
+                                        rs_err_conn_pop(ctx->acceptorCtx.radConn));
+        }
+        serverLen = strlen(serverBuf);
+    }
 
-    /*
-     * The format of this token awaits definition by libradsec.
-     */
-    return GSS_S_COMPLETE;
+    length = 4 + serverLen + 4 + ctx->acceptorCtx.state.length;
+
+    token->value = GSSEAP_MALLOC(length);
+    if (token->value == NULL) {
+        major = GSS_S_FAILURE;
+        *minor = ENOMEM;
+        goto cleanup;
+    }
+    token->length = length;
+
+    p = (unsigned char *)token->value;
+
+    store_uint32_be(serverLen, p);
+    p += 4;
+    if (serverLen != 0) {
+        memcpy(p, serverBuf, serverLen);
+        p += serverLen;
+    }
+
+    store_uint32_be(ctx->acceptorCtx.state.length, p);
+    p += 4;
+    if (ctx->acceptorCtx.state.length != 0) {
+        memcpy(p, ctx->acceptorCtx.state.value,
+               ctx->acceptorCtx.state.length);
+        p += ctx->acceptorCtx.state.length;
+    }
+
+    assert(p == (unsigned char *)token->value + token->length);
+
+    major = GSS_S_COMPLETE;
+    *minor = 0;
+
+cleanup:
+    if (GSS_ERROR(major))
+        gss_release_buffer(&tmpMinor, token);
+
+    return major;
 }
 
 static OM_uint32
@@ -53,33 +102,32 @@ gssEapExportSecContext(OM_uint32 *minor,
 {
     OM_uint32 major, tmpMinor;
     size_t length;
-    gss_buffer_desc initiatorName, acceptorName;
-    gss_buffer_desc partialCtx, key;
+    gss_buffer_desc initiatorName = GSS_C_EMPTY_BUFFER;
+    gss_buffer_desc acceptorName = GSS_C_EMPTY_BUFFER;
+    gss_buffer_desc partialCtx = GSS_C_EMPTY_BUFFER;
+    gss_buffer_desc key;
     unsigned char *p;
 
-    initiatorName.length = 0;
-    initiatorName.value = NULL;
-
-    acceptorName.length = 0;
-    acceptorName.value = NULL;
-
-    partialCtx.length = 0;
-    partialCtx.value = NULL;
-
     if ((CTX_IS_INITIATOR(ctx) && !CTX_IS_ESTABLISHED(ctx)) ||
-        ctx->mechanismUsed == GSS_C_NO_OID)
+        ctx->mechanismUsed == GSS_C_NO_OID) {
+        *minor = GSSEAP_CONTEXT_INCOMPLETE;
         return GSS_S_NO_CONTEXT;
+    }
 
     key.length = KRB_KEY_LENGTH(&ctx->rfc3961Key);
     key.value  = KRB_KEY_DATA(&ctx->rfc3961Key);
 
     if (ctx->initiatorName != GSS_C_NO_NAME) {
-        major = gssEapExportName(minor, ctx->initiatorName, &initiatorName, TRUE);
+        major = gssEapExportNameInternal(minor, ctx->initiatorName,
+                                         &initiatorName,
+                                         EXPORT_NAME_FLAG_COMPOSITE);
         if (GSS_ERROR(major))
             goto cleanup;
     }
     if (ctx->acceptorName != GSS_C_NO_NAME) {
-        major = gssEapExportName(minor, ctx->acceptorName, &acceptorName, TRUE);
+        major = gssEapExportNameInternal(minor, ctx->acceptorName,
+                                         &acceptorName,
+                                         EXPORT_NAME_FLAG_COMPOSITE);
         if (GSS_ERROR(major))
             goto cleanup;
     }
@@ -89,12 +137,14 @@ gssEapExportSecContext(OM_uint32 *minor,
      * contexts.
      */
     if (!CTX_IS_INITIATOR(ctx) && !CTX_IS_ESTABLISHED(ctx)) {
+        assert((ctx->flags & CTX_FLAG_KRB_REAUTH) == 0);
+
         major = gssEapExportPartialContext(minor, ctx, &partialCtx);
         if (GSS_ERROR(major))
             goto cleanup;
     }
 
-    length  = 16;                               /* version, state, flags, etc */
+    length  = 16;                               /* version, state, flags, */
     length += 4 + ctx->mechanismUsed->length;   /* mechanismUsed */
     length += 12 + key.length;                  /* rfc3961Key.value */
     length += 4 + initiatorName.length;         /* initiatorName.value */
@@ -106,8 +156,8 @@ gssEapExportSecContext(OM_uint32 *minor,
 
     token->value = GSSEAP_MALLOC(length);
     if (token->value == NULL) {
-        *minor = ENOMEM;
         major = GSS_S_FAILURE;
+        *minor = ENOMEM;
         goto cleanup;
     }
     token->length = length;
@@ -115,7 +165,7 @@ gssEapExportSecContext(OM_uint32 *minor,
     p = (unsigned char *)token->value;
 
     store_uint32_be(EAP_EXPORT_CONTEXT_V1, &p[0]);        /* version */
-    store_uint32_be(ctx->state,            &p[4]);
+    store_uint32_be(GSSEAP_SM_STATE(ctx),  &p[4]);
     store_uint32_be(ctx->flags,            &p[8]);
     store_uint32_be(ctx->gssFlags,         &p[12]);
     p = store_oid(ctx->mechanismUsed,      &p[16]);
@@ -131,7 +181,10 @@ gssEapExportSecContext(OM_uint32 *minor,
     store_uint64_be(ctx->sendSeq,          &p[8]);
     store_uint64_be(ctx->recvSeq,          &p[16]);
     p += 24;
-    sequenceExternalize(ctx->seqState,     &p, &length);
+
+    major = sequenceExternalize(minor, ctx->seqState, &p, &length);
+    if (GSS_ERROR(major))
+        goto cleanup;
 
     if (partialCtx.value != NULL)
         p = store_buffer(&partialCtx, p, FALSE);
@@ -159,8 +212,15 @@ gss_export_sec_context(OM_uint32 *minor,
     OM_uint32 major, tmpMinor;
     gss_ctx_id_t ctx = *context_handle;
 
-    if (ctx == GSS_C_NO_CONTEXT)
-        return GSS_S_NO_CONTEXT;
+    interprocess_token->length = 0;
+    interprocess_token->value = NULL;
+
+    if (ctx == GSS_C_NO_CONTEXT) {
+        *minor = EINVAL;
+        return GSS_S_CALL_INACCESSIBLE_READ | GSS_S_NO_CONTEXT;
+    }
+
+    *minor = 0;
 
     GSSEAP_MUTEX_LOCK(&ctx->mutex);