Blame SOURCES/0039-Ticket-49474-sasl-allow-mechs-does-not-operate-corre.patch

081b2d
From bfaf5b56bb1a416c5e058a9925642098c87e0330 Mon Sep 17 00:00:00 2001
081b2d
From: William Brown <firstyear@redhat.com>
081b2d
Date: Thu, 30 Nov 2017 14:06:59 +0100
081b2d
Subject: [PATCH] Ticket 49474 - sasl allow mechs does not operate correctly
081b2d
081b2d
Bug Description:  In a fix to sasl allowed mechs, the logic
081b2d
was not properly configured.
081b2d
081b2d
Fix Description:  Alter the ids_sasl_supported_mech to be
081b2d
clearer and simpler in it's design.
081b2d
081b2d
https://pagure.io/389-ds-base/issue/49474
081b2d
081b2d
Author: wibrown
081b2d
081b2d
Review by: tbordaz (Thank you!)
081b2d
081b2d
Cherry picked from f75cfbce07b79272a7f1a2e387dc232d45c169f5
081b2d
---
081b2d
 ldap/servers/slapd/saslbind.c | 49 ++++++++-----------------------------------
081b2d
 1 file changed, 9 insertions(+), 40 deletions(-)
081b2d
081b2d
diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
081b2d
index 6734c32a7..67da97148 100644
081b2d
--- a/ldap/servers/slapd/saslbind.c
081b2d
+++ b/ldap/servers/slapd/saslbind.c
081b2d
@@ -835,52 +835,21 @@ ids_sasl_listmech(Slapi_PBlock *pb)
081b2d
 static int
081b2d
 ids_sasl_mech_supported(Slapi_PBlock *pb, const char *mech)
081b2d
 {
081b2d
-    int i, ret = 0;
081b2d
-    char **mechs;
081b2d
-    char **allowed_mechs = NULL;
081b2d
-    char *dupstr;
081b2d
-    const char *str;
081b2d
-    int sasl_result = 0;
081b2d
-    Connection *pb_conn = NULL;
081b2d
-
081b2d
-    slapi_pblock_get(pb, SLAPI_CONNECTION, &pb_conn);
081b2d
-    sasl_conn_t *sasl_conn = (sasl_conn_t *)pb_conn->c_sasl_conn;
081b2d
     slapi_log_err(SLAPI_LOG_TRACE, "ids_sasl_mech_supported", "=>\n");
081b2d
 
081b2d
-    /* sasl_listmech is not thread-safe - caller must lock pb_conn */
081b2d
-    sasl_result = sasl_listmech(sasl_conn,
081b2d
-                                NULL, /* username */
081b2d
-                                "", ",", "",
081b2d
-                                &str, NULL, NULL);
081b2d
-    if (sasl_result != SASL_OK) {
081b2d
-        return 0;
081b2d
-    }
081b2d
-
081b2d
-    dupstr = slapi_ch_strdup(str);
081b2d
-    mechs = slapi_str2charray(dupstr, ",");
081b2d
-    allowed_mechs = config_get_allowed_sasl_mechs_array();
081b2d
+    char **allowed_mechs = ids_sasl_listmech(pb);
081b2d
 
081b2d
-    for (i = 0; mechs[i] != NULL; i++) {
081b2d
-        if (strcasecmp(mech, mechs[i]) == 0) {
081b2d
-            if (allowed_mechs) {
081b2d
-                if (charray_inlist(allowed_mechs, (char *)mech) == 0) {
081b2d
-                    ret = 1;
081b2d
-                }
081b2d
-                break;
081b2d
-            } else {
081b2d
-                ret = 1;
081b2d
-                break;
081b2d
-            }
081b2d
-        }
081b2d
+    /* 0 indicates "now allowed" */
081b2d
+    int allowed_mech_present = 0;
081b2d
+    if (allowed_mechs != NULL) {
081b2d
+        /* Returns 1 if present and allowed. */
081b2d
+        allowed_mech_present = charray_inlist(allowed_mechs, (char *)mech);
081b2d
+        charray_free(allowed_mechs);
081b2d
     }
081b2d
 
081b2d
-    charray_free(allowed_mechs);
081b2d
-    charray_free(mechs);
081b2d
-    slapi_ch_free((void **)&dupstr);
081b2d
-
081b2d
     slapi_log_err(SLAPI_LOG_TRACE, "ids_sasl_mech_supported", "<=\n");
081b2d
 
081b2d
-    return ret;
081b2d
+    return allowed_mech_present;
081b2d
 }
081b2d
 
081b2d
 /*
081b2d
@@ -944,7 +913,7 @@ ids_sasl_check_bind(Slapi_PBlock *pb)
081b2d
      * different error code to SASL_NOMECH.  Must be called
081b2d
      * while holding the pb_conn lock
081b2d
      */
081b2d
-    if (!ids_sasl_mech_supported(pb, mech)) {
081b2d
+    if (ids_sasl_mech_supported(pb, mech) == 0) {
081b2d
         rc = SASL_NOMECH;
081b2d
         goto sasl_check_result;
081b2d
     }
081b2d
-- 
081b2d
2.13.6
081b2d