From: Alan T. DeKok <aland@freeradius.org>
Date: Sat, 6 Sep 2014 18:58:14 +0000 (-0400)
Subject: Reject on any channel bindings attribute mismatch
X-Git-Tag: release_3_0_5~607
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5df1d777ee3bf6933378d2fbbabdf68c43f3a7a2;p=thirdparty%2Ffreeradius-server.git

Reject on any channel bindings attribute mismatch
ABFAB (RFC 7055) is a new deployment.  In this case, it makes sense to
be very strict about channel bindings checks, because we have high
confidence that anyone supplying ABFAb channel bindings will supply
accurate info.

Other uses of channel bindings may require more liberal policies.
---

diff --git a/raddb/sites-available/channel_bindings b/raddb/sites-available/channel_bindings
index 83843290aac..228e6c5b305 100644
--- a/raddb/sites-available/channel_bindings
+++ b/raddb/sites-available/channel_bindings
@@ -13,6 +13,12 @@ authorize {
 	if (&GSS-Acceptor-Service-Name && (&outer.request:GSS-Acceptor-Service-Name != &GSS-Acceptor-Service-Name)) {
 		reject
 	}
+	if (GSS-Acceptor-Host-Name && outer.request:GSS-Acceptor-Host-Name != GSS-Acceptor-Host-Name ) {
+		reject
+	}
+	if (GSS-Acceptor-Realm-Name && outer.request:GSS-Acceptor-Realm-Name != GSS-Acceptor-Realm-Name ) {
+		reject
+	}
 
 	if (&GSS-Acceptor-Service-Name || &GSS-Acceptor-Realm-Name || &GSS-Acceptor-Host-Name) {
 		update control {