Extract client identity and authentication type from SASL authentication

3 files changed, 41 insertions, 9 deletions

diff --git a/src/libpttls/pt_tls_server.c b/src/libpttls/pt_tls_server.c
index 33d97152b..fd5d9520d 100644
--- a/src/libpttls/pt_tls_server.c
+++ b/src/libpttls/pt_tls_server.c
@@ -61,6 +61,7 @@ struct private_pt_tls_server_t {
 	 * TNCCS protocol handler, implemented as tls_t
 	 */
 	tls_t *tnccs;
+
 };
 
 /**
@@ -111,8 +112,27 @@ static status_t process_sasl(private_pt_tls_server_t *this,
 							 sasl_mechanism_t *sasl, chunk_t data)
 {
 	bio_writer_t *writer;
+	status_t status;
+	identification_t *client;
+	tnccs_t *tnccs;
+
+	status = sasl->process(sasl, data);
+	if (status != NEED_MORE)
+	{
+		client = sasl->get_client(sasl);
+		if (client)
+		{
+			DBG1(DBG_TNC, "SASL client identity is '%Y'", client);
+			this->tnccs->set_peer_id(this->tnccs, client);
+			if (streq(sasl->get_name(sasl), "PLAIN"))
+			{
+				tnccs = (tnccs_t*)this->tnccs;
+				tnccs->set_auth_type(tnccs, TNC_AUTH_PASSWORD);
+			}
+		}
+	}
 
-	switch (sasl->process(sasl, data))
+	switch (status)
 	{
 		case NEED_MORE:
 			return NEED_MORE;
diff --git a/src/libpttls/sasl/sasl_mechanism.h b/src/libpttls/sasl/sasl_mechanism.h
index fb1d08097..e8c47c408 100644
--- a/src/libpttls/sasl/sasl_mechanism.h
+++ b/src/libpttls/sasl/sasl_mechanism.h
@@ -51,6 +51,13 @@ struct sasl_mechanism_t {
 	char* (*get_name)(sasl_mechanism_t *this);
 
 	/**
+	 * Get the client identity
+	 *
+	 * @return			client identity
+	 */
+	identification_t* (*get_client)(sasl_mechanism_t *this);
+
+	/**
 	 * Build a SASL message to send to remote host.
 	 *
 	 * A message is returned if the return value is NEED_MORE or SUCCESS. A
diff --git a/src/libpttls/sasl/sasl_plain/sasl_plain.c b/src/libpttls/sasl/sasl_plain/sasl_plain.c
index e8d6dc80b..fdb3523cb 100644
--- a/src/libpttls/sasl/sasl_plain/sasl_plain.c
+++ b/src/libpttls/sasl/sasl_plain/sasl_plain.c
@@ -35,6 +35,12 @@ struct private_sasl_plain_t {
 	identification_t *client;
 };
 
+METHOD(sasl_mechanism_t, get_client, identification_t*,
+	private_sasl_plain_t *this)
+{
+	return this->client;
+}
+
 METHOD(sasl_mechanism_t, get_name, char*,
 	private_sasl_plain_t *this)
 {
@@ -52,7 +58,6 @@ METHOD(sasl_mechanism_t, process_server, status_t,
 	private_sasl_plain_t *this, chunk_t message)
 {
 	chunk_t authz, authi, password;
-	identification_t *id;
 	shared_key_t *shared;
 	u_char *pos;
 
@@ -72,22 +77,21 @@ METHOD(sasl_mechanism_t, process_server, status_t,
 	}
 	authi = chunk_create(message.ptr, pos - message.ptr);
 	password = chunk_skip(message, authi.len + 1);
-	id = identification_create_from_data(authi);
-	shared = lib->credmgr->get_shared(lib->credmgr, SHARED_EAP, id, NULL);
+	DESTROY_IF(this->client);
+	this->client = identification_create_from_data(authi);
+	shared = lib->credmgr->get_shared(lib->credmgr, SHARED_EAP, this->client,
+									  NULL);
 	if (!shared)
 	{
-		DBG1(DBG_CFG, "no shared secret found for '%Y'", id);
-		id->destroy(id);
+		DBG1(DBG_CFG, "no shared secret found for '%Y'", this->client);
 		return FAILED;
 	}
 	if (!chunk_equals(shared->get_key(shared), password))
 	{
-		DBG1(DBG_CFG, "shared secret for '%Y' does not match", id);
-		id->destroy(id);
+		DBG1(DBG_CFG, "shared secret for '%Y' does not match", this->client);
 		shared->destroy(shared);
 		return FAILED;
 	}
-	id->destroy(id);
 	shared->destroy(shared);
 	return SUCCESS;
 }
@@ -151,6 +155,7 @@ sasl_plain_t *sasl_plain_create(char *name, identification_t *client)
 		.public = {
 			.sasl = {
 				.get_name = _get_name,
+				.get_client = _get_client,
 				.destroy = _destroy,
 			},
 		},