[Fedora-directory-commits] ldapserver/ldap/servers/slapd saslbind.c, 1.14, 1.15 slap.h, 1.11, 1.12

Author: nkinder Update of /cvs/dirsec/ldapserver/ldap/servers/slapd In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6854 Modified Files: saslbind.c slap.h Log Message: 184585 - SASL context needs to be disposed of and a new one created when re-binding Index: saslbind.c =================================================================== RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/saslbind.c,v retrieving revision 1.14 retrieving revision 1.15 diff -u -r1.14 -r1.15 --- saslbind.c 10 Nov 2005 22:37:54 -0000 1.14 +++ saslbind.c 14 Mar 2006 19:18:03 -0000 1.15 @@ -881,6 +881,36 @@ sasl_start: + /* Check if we are already authenticated via sasl. If so, + * dispose of the current sasl_conn and create a new one + * using the new mechanism. We also need to do this if the + * mechanism changed in the middle of the SASL authentication + * process. */ + if ((pb->pb_conn->c_flags & CONN_FLAG_SASL_COMPLETE) || continuing) { + /* Lock the connection mutex */ + PR_Lock(pb->pb_conn->c_mutex); + + /* reset flag */ + pb->pb_conn->c_flags &= ~CONN_FLAG_SASL_COMPLETE; + + /* remove any SASL I/O from the connection */ + sasl_io_cleanup(pb->pb_conn); + + /* dispose of sasl_conn and create a new sasl_conn */ + sasl_dispose(&sasl_conn); + ids_sasl_server_new(pb->pb_conn); + sasl_conn = (sasl_conn_t*)pb->pb_conn->c_sasl_conn; + + /* Unlock the connection mutex */ + PR_Unlock(pb->pb_conn->c_mutex); + + if (sasl_conn == NULL) { + send_ldap_result( pb, LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL, + "sasl library unavailable", 0, NULL ); + return; + } + } + rc = sasl_server_start(sasl_conn, mech, cred->bv_val, cred->bv_len, &sdata, &slen); @@ -889,6 +919,8 @@ switch (rc) { case SASL_OK: /* complete */ + /* Set a flag to signify that sasl bind is complete */ + pb->pb_conn->c_flags |= CONN_FLAG_SASL_COMPLETE; /* retrieve the authenticated username */ if (sasl_getprop(sasl_conn, SASL_USERNAME, Index: slap.h =================================================================== RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slap.h,v retrieving revision 1.11 retrieving revision 1.12 diff -u -r1.11 -r1.12 --- slap.h 28 Feb 2006 21:51:26 -0000 1.11 +++ slap.h 14 Mar 2006 19:18:03 -0000 1.12 @@ -1271,6 +1271,9 @@ * Start TLS request operation. */ +#define CONN_FLAG_SASL_COMPLETE 32 /* Flag set when a sasl bind has been + * successfully completed. + */ #define START_TLS_OID "1.3.6.1.4.1.1466.20037"