[Fedora-directory-commits] ldapserver/ldap/servers/slapd saslbind.c, 1.14, 1.15 slap.h, 1.11, 1.12

[Nathan Kinder (nkinder)]

Author: nkinder

Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6854

Modified Files:
	saslbind.c slap.h 
Log Message:
184585 - SASL context needs to be disposed of and a new one created when re-binding


Index: saslbind.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/saslbind.c,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- saslbind.c	10 Nov 2005 22:37:54 -0000	1.14
+++ saslbind.c	14 Mar 2006 19:18:03 -0000	1.15
@@ -881,6 +881,36 @@
 
  sasl_start:
 
+    /* Check if we are already authenticated via sasl.  If so,
+     * dispose of the current sasl_conn and create a new one
+     * using the new mechanism.  We also need to do this if the
+     * mechanism changed in the middle of the SASL authentication
+     * process. */
+    if ((pb->pb_conn->c_flags & CONN_FLAG_SASL_COMPLETE) || continuing) {
+        /* Lock the connection mutex */
+        PR_Lock(pb->pb_conn->c_mutex);
+
+        /* reset flag */
+        pb->pb_conn->c_flags &= ~CONN_FLAG_SASL_COMPLETE;
+
+        /* remove any SASL I/O from the connection */
+        sasl_io_cleanup(pb->pb_conn);
+
+        /* dispose of sasl_conn and create a new sasl_conn */
+        sasl_dispose(&sasl_conn);
+        ids_sasl_server_new(pb->pb_conn);
+        sasl_conn = (sasl_conn_t*)pb->pb_conn->c_sasl_conn;
+
+        /* Unlock the connection mutex */
+        PR_Unlock(pb->pb_conn->c_mutex);
+
+        if (sasl_conn == NULL) {
+            send_ldap_result( pb, LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL,
+                          "sasl library unavailable", 0, NULL );
+            return;
+        }
+    }
+
     rc = sasl_server_start(sasl_conn, mech, 
                            cred->bv_val, cred->bv_len, 
                            &sdata, &slen);
@@ -889,6 +919,8 @@
 
     switch (rc) {
     case SASL_OK:               /* complete */
+        /* Set a flag to signify that sasl bind is complete */
+        pb->pb_conn->c_flags |= CONN_FLAG_SASL_COMPLETE;
 
         /* retrieve the authenticated username */
         if (sasl_getprop(sasl_conn, SASL_USERNAME,


Index: slap.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slap.h,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- slap.h	28 Feb 2006 21:51:26 -0000	1.11
+++ slap.h	14 Mar 2006 19:18:03 -0000	1.12
@@ -1271,6 +1271,9 @@
 				  * Start TLS request operation. 
 				  */
 
+#define CONN_FLAG_SASL_COMPLETE 32  /* Flag set when a sasl bind has been 
+                                     * successfully completed.
+                                     */
 
 
 #define START_TLS_OID    "1.3.6.1.4.1.1466.20037"