1 is the latest approved patch-set.
No files were changed between the latest approved patch-set and the submitted one.


Use mandatory transaction ID in AuthenticateClientOkDPEsipa

The transaction ID in the sequence of AuthenticateClientOkDPEsipa is
optional, so lets use the mandatory transaction ID from the smdpSigned2
field instead.

If the optional transaction ID exists, check if it matches with the
mandatory one.

Related: SYS#8101
Change-Id: I3aed3f6ff6f10b49045ff7a4b0f0019ac1d75c65
---
M src/ipa/libipa/esipa_auth_clnt.c
1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/ipa/libipa/esipa_auth_clnt.c b/src/ipa/libipa/esipa_auth_clnt.c
index 8af59a6..f579dda 100644
--- a/src/ipa/libipa/esipa_auth_clnt.c
+++ b/src/ipa/libipa/esipa_auth_clnt.c
@@ -62,11 +62,21 @@
 	case AuthenticateClientResponseEsipa_PR_authenticateClientOkDPEsipa:
 		res->auth_clnt_ok_dpe =
 		    &msg_to_ipa->choice.authenticateClientResponseEsipa.choice.authenticateClientOkDPEsipa;
-		res->transaction_id = res->auth_clnt_ok_dpe->transactionId;
+		res->transaction_id = &res->auth_clnt_ok_dpe->smdpSigned2.transactionId;
 		if (!IPA_ASN_STR_CMP(res->transaction_id, &req->req.transactionId)) {
 			IPA_LOGP_ESIPA("AuthenticateClient", LERROR,
 				       "eIM responded with unexpected transaction ID (expected: %s, got: %s)\n",
 				       ipa_hexdump(req->req.transactionId.buf, req->req.transactionId.size),
+				       ipa_hexdump(res->auth_clnt_ok_dpe->smdpSigned2.transactionId.buf,
+						   res->auth_clnt_ok_dpe->smdpSigned2.transactionId.size));
+			res->auth_clnt_err = -1;
+		}
+		if (res->auth_clnt_ok_dpe->transactionId &&
+		    !IPA_ASN_STR_CMP(res->transaction_id, res->auth_clnt_ok_dpe->transactionId)) {
+			IPA_LOGP_ESIPA("AuthenticateClient", LERROR,
+				       "eIM responded with different transaction IDs (%s != %s)\n",
+				       ipa_hexdump(res->auth_clnt_ok_dpe->transactionId->buf,
+						   res->auth_clnt_ok_dpe->transactionId->size),
 				       ipa_hexdump(res->transaction_id->buf, res->transaction_id->size));
 			res->auth_clnt_err = -1;
 		}

