gssapi/spnego/negoex_ctx.c

/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/*
 * Copyright (C) 2011-2018 PADL Software Pty Ltd.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * * Redistributions of source code must retain the above copyright
 *   notice, this list of conditions and the following disclaimer.
 *
 * * Redistributions in binary form must reproduce the above copyright
 *   notice, this list of conditions and the following disclaimer in
 *   the documentation and/or other materials provided with the
 *   distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "k5-platform.h"
#include "gssapiP_spnego.h"
#include <generic/gssapiP_generic.h>

/*
 * The initial context token emitted by the initiator is a INITIATOR_NEGO
 * message followed by zero or more INITIATOR_META_DATA tokens, and zero
 * or one AP_REQUEST tokens.
 *
 * Upon receiving this, the acceptor computes the list of mutually supported
 * authentication mechanisms and performs the metadata exchange. The output
 * token is ACCEPTOR_NEGO followed by zero or more ACCEPTOR_META_DATA tokens,
 * and zero or one CHALLENGE tokens.
 *
 * Once the metadata exchange is complete and a mechanism is selected, the
 * selected mechanism's context token exchange continues with AP_REQUEST and
 * CHALLENGE messages.
 *
 * Once the context token exchange is complete, VERIFY messages are sent to
 * authenticate the entire exchange.
 */

static void
zero_and_release_buffer_set(gss_buffer_set_t *pbuffers)
{
    OM_uint32 tmpmin;
    gss_buffer_set_t buffers = *pbuffers;
    uint32_t i;

    if (buffers != GSS_C_NO_BUFFER_SET) {
        for (i = 0; i < buffers->count; i++)
            zap(buffers->elements[i].value, buffers->elements[i].length);

        gss_release_buffer_set(&tmpmin, &buffers);
    }

    *pbuffers = GSS_C_NO_BUFFER_SET;
}

static OM_uint32
buffer_set_to_key(OM_uint32 *minor, gss_buffer_set_t buffers,
                  krb5_keyblock *key)
{
    krb5_error_code ret;

    /* Returned keys must be in two buffers, with the key contents in the first
     * and the enctype as a 32-bit little-endian integer in the second. */
    if (buffers->count != 2 || buffers->elements[1].length != 4) {
        *minor = ERR_NEGOEX_NO_VERIFY_KEY;
        return GSS_S_FAILURE;
    }

    krb5_free_keyblock_contents(NULL, key);

    key->contents = k5memdup(buffers->elements[0].value,
                             buffers->elements[0].length, &ret);
    if (key->contents == NULL) {
        *minor = ret;
        return GSS_S_FAILURE;
    }
    key->length = buffers->elements[0].length;
    key->enctype = load_32_le(buffers->elements[1].value);

    return GSS_S_COMPLETE;
}

static OM_uint32
get_session_keys(OM_uint32 *minor, struct negoex_auth_mech *mech)
{
    OM_uint32 major, tmpmin;
    gss_buffer_set_t buffers = GSS_C_NO_BUFFER_SET;

    major = gss_inquire_sec_context_by_oid(&tmpmin, mech->mech_context,
                                           GSS_C_INQ_NEGOEX_KEY, &buffers);
    if (major == GSS_S_COMPLETE) {
        major = buffer_set_to_key(minor, buffers, &mech->key);
        zero_and_release_buffer_set(&buffers);
        if (major != GSS_S_COMPLETE)
            return major;
    }

    major = gss_inquire_sec_context_by_oid(&tmpmin, mech->mech_context,
                                           GSS_C_INQ_NEGOEX_VERIFY_KEY,
                                           &buffers);
    if (major == GSS_S_COMPLETE) {
        major = buffer_set_to_key(minor, buffers, &mech->verify_key);
        zero_and_release_buffer_set(&buffers);
        if (major != GSS_S_COMPLETE)
            return major;
    }

    return GSS_S_COMPLETE;
}

static OM_uint32
emit_initiator_nego(OM_uint32 *minor, spnego_gss_ctx_id_t ctx)
{
    OM_uint32 major;
    uint8_t random[32];

    major = negoex_random(minor, ctx, random, 32);
    if (major != GSS_S_COMPLETE)
        return major;

    negoex_add_nego_message(ctx, INITIATOR_NEGO, random);
    return GSS_S_COMPLETE;
}

static OM_uint32
process_initiator_nego(OM_uint32 *minor, spnego_gss_ctx_id_t ctx,
                       struct negoex_message *messages, size_t nmessages)
{
    struct nego_message *msg;

    assert(!ctx->initiate && ctx->negoex_step == 1);

    msg = negoex_locate_nego_message(messages, nmessages, INITIATOR_NEGO);
    if (msg == NULL) {
        *minor = ERR_NEGOEX_MISSING_NEGO_MESSAGE;
        return GSS_S_DEFECTIVE_TOKEN;
    }

    negoex_restrict_auth_schemes(ctx, msg->schemes, msg->nschemes);
    return GSS_S_COMPLETE;
}

static OM_uint32
emit_acceptor_nego(OM_uint32 *minor, spnego_gss_ctx_id_t ctx)
{
    OM_uint32 major;
    uint8_t random[32];

    major = negoex_random(minor, ctx, random, 32);
    if (major != GSS_S_COMPLETE)
        return major;

    negoex_add_nego_message(ctx, ACCEPTOR_NEGO, random);
    return GSS_S_COMPLETE;
}

static OM_uint32
process_acceptor_nego(OM_uint32 *minor, spnego_gss_ctx_id_t ctx,
                      struct negoex_message *messages, size_t nmessages)
{
    struct nego_message *msg;

    msg = negoex_locate_nego_message(messages, nmessages, ACCEPTOR_NEGO);
    if (msg == NULL) {
        *minor = ERR_NEGOEX_MISSING_NEGO_MESSAGE;
        return GSS_S_DEFECTIVE_TOKEN;
    }

    /* Reorder and prune our mech list to match the acceptor's list (or a
     * subset of it). */
    negoex_common_auth_schemes(ctx, msg->schemes, msg->nschemes);

    return GSS_S_COMPLETE;
}

static void
query_meta_data(spnego_gss_ctx_id_t ctx, gss_cred_id_t cred,
                gss_name_t target, OM_uint32 req_flags)
{
    OM_uint32 major, minor;
    struct negoex_auth_mech *p, *next;

    K5_TAILQ_FOREACH_SAFE(p, &ctx->negoex_mechs, links, next) {
        major = gssspi_query_meta_data(&minor, p->oid, cred, &p->mech_context,
                                       target, req_flags, &p->metadata);
        /* GSS_Query_meta_data failure removes mechanism from list. */
        if (major != GSS_S_COMPLETE)
            negoex_delete_auth_mech(ctx, p);
    }
}

static void
exchange_meta_data(spnego_gss_ctx_id_t ctx, gss_cred_id_t cred,
                   gss_name_t target, OM_uint32 req_flags,
                   struct negoex_message *messages, size_t nmessages)
{
    OM_uint32 major, minor;
    struct negoex_auth_mech *mech;
    enum message_type type;
    struct exchange_message *msg;
    uint32_t i;

    type = ctx->initiate ? ACCEPTOR_META_DATA : INITIATOR_META_DATA;

    for (i = 0; i < nmessages; i++) {
        if (messages[i].type != type)
            continue;
        msg = &messages[i].u.e;

        mech = negoex_locate_auth_scheme(ctx, msg->scheme);
        if (mech == NULL)
            continue;

        major = gssspi_exchange_meta_data(&minor, mech->oid, cred,
                                          &mech->mech_context, target,
                                          req_flags, &msg->token);
        /* GSS_Exchange_meta_data failure removes mechanism from list. */
        if (major != GSS_S_COMPLETE)
            negoex_delete_auth_mech(ctx, mech);
    }
}

/*
 * In the initiator, if we are processing the acceptor's first reply, discard
 * the optimistic context if the acceptor ignored the optimistic token.  If the
 * acceptor continued the optimistic mech, discard all other mechs.
 */
static void
check_optimistic_result(spnego_gss_ctx_id_t ctx,
                        struct negoex_message *messages, size_t nmessages)
{
    struct negoex_auth_mech *mech;
    OM_uint32 tmpmin;

    assert(ctx->initiate && ctx->negoex_step == 2);

    /* Do nothing if we didn't make an optimistic context. */
    mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);
    if (mech == NULL || mech->mech_context == GSS_C_NO_CONTEXT)
        return;

    /* If the acceptor used the optimistic token, it will send an acceptor
     * token or a checksum (or both) in its first reply. */
    if (negoex_locate_exchange_message(messages, nmessages,
                                       CHALLENGE) != NULL ||
        negoex_locate_verify_message(messages, nmessages) != NULL) {
        /* The acceptor continued the optimistic mech, and metadata exchange
         * didn't remove it.  Commit to this mechanism. */
        negoex_select_auth_mech(ctx, mech);
    } else {
        /* The acceptor ignored the optimistic token.  Restart the mech. */
        (void)gss_delete_sec_context(&tmpmin, &mech->mech_context, NULL);
        krb5_free_keyblock_contents(NULL, &mech->key);
        krb5_free_keyblock_contents(NULL, &mech->verify_key);
        mech->complete = mech->sent_checksum = FALSE;
    }
}

/* Perform an initiator step of the underlying mechanism exchange. */
static OM_uint32
mech_init(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred,
          gss_name_t target, OM_uint32 req_flags, OM_uint32 time_req,
          struct negoex_message *messages, size_t nmessages,
          gss_channel_bindings_t bindings, gss_buffer_t output_token,
          OM_uint32 *time_rec)
{
    OM_uint32 major, first_major = 0, first_minor = 0;
    struct negoex_auth_mech *mech = NULL;
    gss_buffer_t input_token = GSS_C_NO_BUFFER;
    struct exchange_message *msg;
    int first_mech;

    output_token->value = NULL;
    output_token->length = 0;

    /* Allow disabling of optimistic token for testing. */
    if (ctx->negoex_step == 1 &&
        secure_getenv("NEGOEX_NO_OPTIMISTIC_TOKEN") != NULL)
        return GSS_S_COMPLETE;

    if (K5_TAILQ_EMPTY(&ctx->negoex_mechs)) {
        *minor = ERR_NEGOEX_NO_AVAILABLE_MECHS;
        return GSS_S_FAILURE;
    }

    /*
     * Get the input token.  The challenge could be for the optimistic mech,
     * which we might have discarded in metadata exchange, so ignore the
     * challenge if it doesn't match the first auth mech.
     */
    mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);
    msg = negoex_locate_exchange_message(messages, nmessages, CHALLENGE);
    if (msg != NULL && GUID_EQ(msg->scheme, mech->scheme))
        input_token = &msg->token;

    if (mech->complete)
        return GSS_S_COMPLETE;

    first_mech = TRUE;

    while (!K5_TAILQ_EMPTY(&ctx->negoex_mechs)) {
        mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);

        major = gss_init_sec_context(minor, cred, &mech->mech_context, target,
                                     mech->oid, req_flags, time_req, bindings,
                                     input_token, &ctx->actual_mech,
                                     output_token, &ctx->ctx_flags, time_rec);

        if (major == GSS_S_COMPLETE)
            mech->complete = 1;

        if (!GSS_ERROR(major))
            return get_session_keys(minor, mech);

        /* Remember the error we got from the first mech. */
        if (first_mech) {
            first_major = major;
            first_minor = *minor;
        }

        /* If we still have multiple mechs to try, move on to the next one. */
        negoex_delete_auth_mech(ctx, mech);
        first_mech = FALSE;
        input_token = GSS_C_NO_BUFFER;
    }

    if (K5_TAILQ_EMPTY(&ctx->negoex_mechs)) {
        major = first_major;
        *minor = first_minor;
    }

    return major;
}

/* Perform an acceptor step of the underlying mechanism exchange. */
static OM_uint32
mech_accept(OM_uint32 *minor, spnego_gss_ctx_id_t ctx,
            gss_cred_id_t cred, struct negoex_message *messages,
            size_t nmessages, gss_channel_bindings_t bindings,
            gss_buffer_t output_token, OM_uint32 *time_rec)
{
    OM_uint32 major, tmpmin;
    struct negoex_auth_mech *mech;
    struct exchange_message *msg;

    assert(!ctx->initiate && !K5_TAILQ_EMPTY(&ctx->negoex_mechs));

    msg = negoex_locate_exchange_message(messages, nmessages, AP_REQUEST);
    if (msg == NULL) {
        /* No input token is okay on the first request or if the mech is
         * complete. */
        if (ctx->negoex_step == 1 ||
            K5_TAILQ_FIRST(&ctx->negoex_mechs)->complete)
            return GSS_S_COMPLETE;
        *minor = ERR_NEGOEX_MISSING_AP_REQUEST_MESSAGE;
        return GSS_S_DEFECTIVE_TOKEN;
    }

    if (ctx->negoex_step == 1) {
        /* Ignore the optimistic token if it isn't for our most preferred
         * mech. */
        mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);
        if (!GUID_EQ(msg->scheme, mech->scheme))
            return GSS_S_COMPLETE;
    } else {
        /* The initiator has selected a mech; discard other entries. */
        mech = negoex_locate_auth_scheme(ctx, msg->scheme);
        if (mech == NULL) {
            *minor = ERR_NEGOEX_NO_AVAILABLE_MECHS;
            return GSS_S_FAILURE;
        }
        negoex_select_auth_mech(ctx, mech);
    }

    if (mech->complete)
        return GSS_S_COMPLETE;

    if (ctx->internal_name != GSS_C_NO_NAME)
        gss_release_name(&tmpmin, &ctx->internal_name);
    if (ctx->deleg_cred != GSS_C_NO_CREDENTIAL)
        gss_release_cred(&tmpmin, &ctx->deleg_cred);

    major = gss_accept_sec_context(minor, &mech->mech_context, cred,
                                   &msg->token, bindings, &ctx->internal_name,
                                   &ctx->actual_mech, output_token,
                                   &ctx->ctx_flags, time_rec,
                                   &ctx->deleg_cred);

    if (major == GSS_S_COMPLETE)
        mech->complete = 1;

    if (!GSS_ERROR(major)) {
        major = get_session_keys(minor, mech);
    } else if (ctx->negoex_step == 1) {
        /* This was an optimistic token; pretend this never happened. */
        major = GSS_S_COMPLETE;
        *minor = 0;
        gss_release_buffer(&tmpmin, output_token);
        gss_delete_sec_context(&tmpmin, &mech->mech_context, GSS_C_NO_BUFFER);
    }

    return major;
}

static krb5_keyusage
verify_keyusage(spnego_gss_ctx_id_t ctx, int make_checksum)
{
    /* Of course, these are the wrong way around in the spec. */
    return (ctx->initiate ^ !make_checksum) ?
        NEGOEX_KEYUSAGE_ACCEPTOR_CHECKSUM : NEGOEX_KEYUSAGE_INITIATOR_CHECKSUM;
}

static OM_uint32
verify_checksum(OM_uint32 *minor, spnego_gss_ctx_id_t ctx,
                struct negoex_message *messages, size_t nmessages,
                gss_buffer_t input_token, int *send_alert_out)
{
    krb5_error_code ret;
    struct negoex_auth_mech *mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);
    struct verify_message *msg;
    krb5_crypto_iov iov[3];
    krb5_keyusage usage = verify_keyusage(ctx, FALSE);
    krb5_boolean valid;

    *send_alert_out = FALSE;
    assert(mech != NULL);

    /* The other party may not be ready to send a verify token yet, or (in the
     * first initiator step) may send one for a mechanism we don't support. */
    msg = negoex_locate_verify_message(messages, nmessages);
    if (msg == NULL || !GUID_EQ(msg->scheme, mech->scheme))
        return GSS_S_COMPLETE;

    /* A recoverable error may cause us to be unable to verify a token from the
     * other party.  In this case we should send an alert. */
    if (mech->verify_key.enctype == ENCTYPE_NULL) {
        *send_alert_out = TRUE;
        return GSS_S_COMPLETE;
    }

    /* Verify the checksum over the existing transcript and the portion of the
     * input token leading up to the verify message. */
    assert(input_token != NULL);
    iov[0].flags = KRB5_CRYPTO_TYPE_DATA;
    iov[0].data = make_data(ctx->negoex_transcript.data,
                            ctx->negoex_transcript.len);
    iov[1].flags = KRB5_CRYPTO_TYPE_DATA;
    iov[1].data = make_data(input_token->value, msg->offset_in_token);
    iov[2].flags = KRB5_CRYPTO_TYPE_CHECKSUM;
    iov[2].data = make_data((uint8_t *)msg->cksum, msg->cksum_len);

    ret = krb5_c_verify_checksum_iov(ctx->kctx, msg->cksum_type,
                                     &mech->verify_key, usage, iov, 3, &valid);
    if (ret) {
        *minor = ret;
        return GSS_S_FAILURE;
    }
    if (!valid || !krb5_c_is_keyed_cksum(msg->cksum_type)) {
        *minor = ERR_NEGOEX_INVALID_CHECKSUM;
        return GSS_S_BAD_SIG;
    }

    mech->verified_checksum = TRUE;
    return GSS_S_COMPLETE;
}

static OM_uint32
make_checksum(OM_uint32 *minor, spnego_gss_ctx_id_t ctx)
{
    krb5_error_code ret;
    krb5_data d;
    krb5_keyusage usage = verify_keyusage(ctx, TRUE);
    krb5_checksum cksum;
    struct negoex_auth_mech *mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);

    assert(mech != NULL);

    if (mech->key.enctype == ENCTYPE_NULL) {
        if (mech->complete) {
            *minor = ERR_NEGOEX_NO_VERIFY_KEY;
            return GSS_S_UNAVAILABLE;
        } else {
            return GSS_S_COMPLETE;
        }
    }

    d = make_data(ctx->negoex_transcript.data, ctx->negoex_transcript.len);
    ret = krb5_c_make_checksum(ctx->kctx, 0, &mech->key, usage, &d, &cksum);
    if (ret) {
        *minor = ret;
        return GSS_S_FAILURE;
    }

    negoex_add_verify_message(ctx, mech->scheme, cksum.checksum_type,
                              cksum.contents, cksum.length);

    mech->sent_checksum = TRUE;
    krb5_free_checksum_contents(ctx->kctx, &cksum);
    return GSS_S_COMPLETE;
}

/* If the other side sent a VERIFY_NO_KEY pulse alert, clear the checksum state
 * on the mechanism so that we send another VERIFY message. */
static void
process_alerts(spnego_gss_ctx_id_t ctx,
               struct negoex_message *messages, uint32_t nmessages)
{
    struct alert_message *msg;
    struct negoex_auth_mech *mech;

    msg = negoex_locate_alert_message(messages, nmessages);
    if (msg != NULL && msg->verify_no_key) {
        mech = negoex_locate_auth_scheme(ctx, msg->scheme);
        if (mech != NULL) {
            mech->sent_checksum = FALSE;
            krb5_free_keyblock_contents(NULL, &mech->key);
            krb5_free_keyblock_contents(NULL, &mech->verify_key);
        }
    }
}

static OM_uint32
make_output_token(OM_uint32 *minor, spnego_gss_ctx_id_t ctx,
                  gss_buffer_t mech_output_token, int send_alert,
                  gss_buffer_t output_token)
{
    OM_uint32 major;
    struct negoex_auth_mech *mech;
    enum message_type type;
    size_t old_transcript_len = ctx->negoex_transcript.len;

    output_token->length = 0;
    output_token->value = NULL;

    /* If the mech is complete and we previously sent a checksum, we just
     * processed the last leg and don't need to send another token. */
    if (mech_output_token->length == 0 &&
        K5_TAILQ_FIRST(&ctx->negoex_mechs)->sent_checksum)
        return GSS_S_COMPLETE;

    if (ctx->negoex_step == 1) {
        if (ctx->initiate)
            major = emit_initiator_nego(minor, ctx);
        else
            major = emit_acceptor_nego(minor, ctx);
        if (major != GSS_S_COMPLETE)
            return major;

        type = ctx->initiate ? INITIATOR_META_DATA : ACCEPTOR_META_DATA;
        K5_TAILQ_FOREACH(mech, &ctx->negoex_mechs, links) {
            if (mech->metadata.length > 0) {
                negoex_add_exchange_message(ctx, type, mech->scheme,
                                            &mech->metadata);
            }
        }
    }

    mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);

    if (mech_output_token->length > 0) {
        type = ctx->initiate ? AP_REQUEST : CHALLENGE;
        negoex_add_exchange_message(ctx, type, mech->scheme,
                                    mech_output_token);
    }

    if (send_alert)
        negoex_add_verify_no_key_alert(ctx, mech->scheme);

    /* Try to add a VERIFY message if we haven't already done so. */
    if (!mech->sent_checksum) {
        major = make_checksum(minor, ctx);
        if (major != GSS_S_COMPLETE)
            return major;
    }

    if (ctx->negoex_transcript.data == NULL) {
        *minor = ENOMEM;
        return GSS_S_FAILURE;
    }

    /* Copy what we added to the transcript into the output token. */
    output_token->length = ctx->negoex_transcript.len - old_transcript_len;
    output_token->value = gssalloc_malloc(output_token->length);
    if (output_token->value == NULL) {
        *minor = ENOMEM;
        return GSS_S_FAILURE;
    }
    memcpy(output_token->value,
           (uint8_t *)ctx->negoex_transcript.data + old_transcript_len,
           output_token->length);

    return GSS_S_COMPLETE;
}

OM_uint32
negoex_init(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred,
            gss_name_t target_name, OM_uint32 req_flags, OM_uint32 time_req,
            gss_buffer_t input_token, gss_channel_bindings_t bindings,
            gss_buffer_t output_token, OM_uint32 *time_rec)
{
    OM_uint32 major, tmpmin;
    gss_buffer_desc mech_output_token = GSS_C_EMPTY_BUFFER;
    struct negoex_message *messages = NULL;
    struct negoex_auth_mech *mech;
    size_t nmessages = 0;
    int send_alert = FALSE;

    if (ctx->negoex_step == 0 && input_token != GSS_C_NO_BUFFER &&
        input_token->length != 0)
        return GSS_S_DEFECTIVE_TOKEN;

    major = negoex_prep_context_for_negoex(minor, ctx);
    if (major != GSS_S_COMPLETE)
        goto cleanup;

    ctx->negoex_step++;

    if (input_token != GSS_C_NO_BUFFER && input_token->length > 0) {
        major = negoex_parse_token(minor, ctx, input_token, &messages,
                                   &nmessages);
        if (major != GSS_S_COMPLETE)
            goto cleanup;
    }

    process_alerts(ctx, messages, nmessages);

    if (ctx->negoex_step == 1) {
        /* Choose a random conversation ID. */
        major = negoex_random(minor, ctx, ctx->negoex_conv_id, GUID_LENGTH);
        if (major != GSS_S_COMPLETE)
            goto cleanup;

        /* Query each mech for its metadata (this may prune the mech list). */
        query_meta_data(ctx, cred, target_name, req_flags);
    } else if (ctx->negoex_step == 2) {
        /* See if the mech processed the optimistic token. */
        check_optimistic_result(ctx, messages, nmessages);

        /* Pass the acceptor metadata to each mech to prune the list. */
        exchange_meta_data(ctx, cred, target_name, req_flags,
                           messages, nmessages);

        /* Process the ACCEPTOR_NEGO message. */
        major = process_acceptor_nego(minor, ctx, messages, nmessages);
        if (major != GSS_S_COMPLETE)
            goto cleanup;
    }

    /* Process the input token and/or produce an output token.  This may prune
     * the mech list, but on success there will be at least one mech entry. */
    major = mech_init(minor, ctx, cred, target_name, req_flags, time_req,
                      messages, nmessages, bindings, &mech_output_token,
                      time_rec);
    if (major != GSS_S_COMPLETE)
        goto cleanup;
    assert(!K5_TAILQ_EMPTY(&ctx->negoex_mechs));

    /* At this point in step 2 we have performed the metadata exchange and
     * chosen a mech we can use, so discard any fallback mech entries. */
    if (ctx->negoex_step == 2)
        negoex_select_auth_mech(ctx, K5_TAILQ_FIRST(&ctx->negoex_mechs));

    major = verify_checksum(minor, ctx, messages, nmessages, input_token,
                            &send_alert);
    if (major != GSS_S_COMPLETE)
        goto cleanup;

    if (input_token != GSS_C_NO_BUFFER) {
        k5_buf_add_len(&ctx->negoex_transcript, input_token->value,
                       input_token->length);
    }

    major = make_output_token(minor, ctx, &mech_output_token, send_alert,
                              output_token);
    if (major != GSS_S_COMPLETE)
        goto cleanup;

    mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);
    major = (mech->complete && mech->verified_checksum) ? GSS_S_COMPLETE :
        GSS_S_CONTINUE_NEEDED;

cleanup:
    free(messages);
    gss_release_buffer(&tmpmin, &mech_output_token);
    negoex_prep_context_for_spnego(ctx);
    return major;
}

OM_uint32
negoex_accept(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred,
              gss_buffer_t input_token, gss_channel_bindings_t bindings,
              gss_buffer_t output_token, OM_uint32 *time_rec)
{
    OM_uint32 major, tmpmin;
    gss_buffer_desc mech_output_token = GSS_C_EMPTY_BUFFER;
    struct negoex_message *messages = NULL;
    struct negoex_auth_mech *mech;
    size_t nmessages;
    int send_alert = FALSE;

    if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) {
        major = GSS_S_DEFECTIVE_TOKEN;
        goto cleanup;
    }

    major = negoex_prep_context_for_negoex(minor, ctx);
    if (major != GSS_S_COMPLETE)
        goto cleanup;

    ctx->negoex_step++;

    major = negoex_parse_token(minor, ctx, input_token, &messages, &nmessages);
    if (major != GSS_S_COMPLETE)
        goto cleanup;

    process_alerts(ctx, messages, nmessages);

    if (ctx->negoex_step == 1) {
        /* Read the INITIATOR_NEGO message to prune the candidate mech list. */
        major = process_initiator_nego(minor, ctx, messages, nmessages);
        if (major != GSS_S_COMPLETE)
            goto cleanup;

        /*
         * Pass the initiator metadata to each mech to prune the list, and
         * query each mech for its acceptor metadata (which may also prune the
         * list).
         */
        exchange_meta_data(ctx, cred, GSS_C_NO_NAME, 0, messages, nmessages);
        query_meta_data(ctx, cred, GSS_C_NO_NAME, 0);

        if (K5_TAILQ_EMPTY(&ctx->negoex_mechs)) {
            *minor = ERR_NEGOEX_NO_AVAILABLE_MECHS;
            major = GSS_S_FAILURE;
            goto cleanup;
        }
    }

    /*
     * Process the input token and possibly produce an output token.  This may
     * prune the list to a single mech.  Continue on error if an output token
     * is generated, so that we send the token to the initiator.
     */
    major = mech_accept(minor, ctx, cred, messages, nmessages, bindings,
                        &mech_output_token, time_rec);
    if (major != GSS_S_COMPLETE && mech_output_token.length == 0)
        goto cleanup;

    if (major == GSS_S_COMPLETE) {
        major = verify_checksum(minor, ctx, messages, nmessages, input_token,
                                &send_alert);
        if (major != GSS_S_COMPLETE)
            goto cleanup;
    }

    k5_buf_add_len(&ctx->negoex_transcript,
                   input_token->value, input_token->length);

    major = make_output_token(minor, ctx, &mech_output_token, send_alert,
                              output_token);
    if (major != GSS_S_COMPLETE)
        goto cleanup;

    mech = K5_TAILQ_FIRST(&ctx->negoex_mechs);
    major = (mech->complete && mech->verified_checksum) ? GSS_S_COMPLETE :
        GSS_S_CONTINUE_NEEDED;

cleanup:
    free(messages);
    gss_release_buffer(&tmpmin, &mech_output_token);
    negoex_prep_context_for_spnego(ctx);
    return major;
}