Reject on any channel bindings attribute mismatch

ABFAB (RFC 7055) is a new deployment.  In this case, it makes sense to
be very strict about channel bindings checks, because we have high
confidence that anyone supplying ABFAb channel bindings will supply
accurate info.

Other uses of channel bindings may require more liberal policies.

diff --git a/raddb/sites-available/channel_bindings b/raddb/sites-available/channel_bindings
index 83843290aac1f463d213c4e8cd572ec946f73e0b..228e6c5b305f239063ee449828111cd4d624888d 100644 (file)
--- a/raddb/sites-available/channel_bindings
+++ b/raddb/sites-available/channel_bindings
@@ -13,6 +13,12 @@ authorize {
        if (&GSS-Acceptor-Service-Name && (&outer.request:GSS-Acceptor-Service-Name != &GSS-Acceptor-Service-Name)) {
                reject
        }
+       if (GSS-Acceptor-Host-Name && outer.request:GSS-Acceptor-Host-Name != GSS-Acceptor-Host-Name ) {
+               reject
+       }
+       if (GSS-Acceptor-Realm-Name && outer.request:GSS-Acceptor-Realm-Name != GSS-Acceptor-Realm-Name ) {
+               reject
+       }
 
        if (&GSS-Acceptor-Service-Name || &GSS-Acceptor-Realm-Name || &GSS-Acceptor-Host-Name) {
                update control {