From: Luke Howard <lukeh@padl.com>
Date: Wed, 9 Mar 2011 14:27:48 +0000 (+1100)
Subject: if reauth token marked critical, don't allow EAP fallback
X-Git-Tag: vm/20110310~10
X-Git-Url: http://www.project-moonshot.org/gitweb/?p=moonshot.git;a=commitdiff_plain;h=5532286518a20a72d338ad23ffe6b9cf58149c53

if reauth token marked critical, don't allow EAP fallback
---

diff --git a/mech_eap/accept_sec_context.c b/mech_eap/accept_sec_context.c
index c39cf6b..b9bdb80 100644
--- a/mech_eap/accept_sec_context.c
+++ b/mech_eap/accept_sec_context.c
@@ -965,7 +965,8 @@ eapGssSmAcceptGssReauth(OM_uint32 *minor,
             GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_ESTABLISHED);
         }
         ctx->gssFlags = gssFlags;
-    } else {
+    } else if ((*smFlags & SM_FLAG_INPUT_TOKEN_CRITICAL) == 0) {
+        /* pretend reauthentication attempt never happened */
         gssDeleteSecContext(&tmpMinor, &ctx->kerberosCtx, GSS_C_NO_BUFFER);
         ctx->flags &= ~(CTX_FLAG_KRB_REAUTH);
         GSSEAP_SM_TRANSITION(ctx, GSSEAP_STATE_INITIAL);