[Fedora-directory-commits] ldapserver/ldap/servers/slapd saslbind.c, 1.9.2.3, 1.9.2.4 slap.h, 1.9, 1.9.2.1

[Nathan Kinder (nkinder)]

Author: nkinder

Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv7327

Modified Files:
      Tag: Directory71RtmBranch
	saslbind.c slap.h 
Log Message:
184585 - SASL context needs to be disposed of and a new one created when re-binding


Index: saslbind.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/saslbind.c,v
retrieving revision 1.9.2.3
retrieving revision 1.9.2.4
diff -u -r1.9.2.3 -r1.9.2.4
--- saslbind.c	4 Nov 2005 18:57:48 -0000	1.9.2.3
+++ saslbind.c	14 Mar 2006 19:36:23 -0000	1.9.2.4
@@ -854,6 +854,37 @@
 
  sasl_start:
 
+    /* Check if we are already authenticated via sasl.  If so,
+     * dispose of the current sasl_conn and create a new one
+     * using the new mechanism.  We also need to do this if the
+     * mechanism changed in the middle of the SASL authentication
+     * process. */
+    if ((pb->pb_conn->c_flags & CONN_FLAG_SASL_COMPLETE) || continuing) {
+        /* reset flag */
+        pb->pb_conn->c_flags &= ~CONN_FLAG_SASL_COMPLETE;
+
+        /* Lock the connection mutex */
+        PR_Lock(pb->pb_conn->c_mutex);
+
+        /* remove any SASL I/O from the connection */
+        sasl_io_cleanup(pb->pb_conn);
+
+        /* dispose of sasl_conn and create a new sasl_conn */
+        sasl_dispose(&sasl_conn);
+        ids_sasl_server_new(pb->pb_conn);
+        sasl_conn = (sasl_conn_t*)pb->pb_conn->c_sasl_conn;
+
+        /* Unlock the connection mutex */
+        PR_Unlock(pb->pb_conn->c_mutex);
+
+        if (sasl_conn == NULL) {
+            send_ldap_result( pb, LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL,
+                          "sasl library unavailable", 0, NULL );
+            return;
+        }
+    }
+
+
     rc = sasl_server_start(sasl_conn, mech, 
                            cred->bv_val, cred->bv_len, 
                            &sdata, &slen);
@@ -862,6 +893,8 @@
 
     switch (rc) {
     case SASL_OK:               /* complete */
+        /* Set a flag to signify that sasl bind is complete */
+        pb->pb_conn->c_flags |= CONN_FLAG_SASL_COMPLETE;
 
         /* retrieve the authenticated username */
         if (sasl_getprop(sasl_conn, SASL_USERNAME,


Index: slap.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slap.h,v
retrieving revision 1.9
retrieving revision 1.9.2.1
diff -u -r1.9 -r1.9.2.1
--- slap.h	19 Apr 2005 22:07:37 -0000	1.9
+++ slap.h	14 Mar 2006 19:36:23 -0000	1.9.2.1
@@ -1268,6 +1268,10 @@
 				  * Start TLS request operation. 
 				  */
 
+#define CONN_FLAG_SASL_COMPLETE 32  /* Flag set when a sasl bind has been
+                                     * successfully completed.
+                                     */
+
 
 
 #define START_TLS_OID    "1.3.6.1.4.1.1466.20037"