From 26a0d63bcbf280d20bd984fd00fd82e82ed62de5 Mon Sep 17 00:00:00 2001 From: Mark Reynolds Date: Thu, 12 Dec 2013 12:48:08 -0500 Subject: [PATCH 66/78] Ticket 47613 - Issues setting allowed mechanisms Bug Description: Adding an empty value for nsslapd-allowed-sasl-mechanisms blocks all sasl authentication. Also changing the allowed sasl mechansism does require a restart after making a change. Fix Description: Reject an empty values for nsslapd-allowed-sasl-mechanisms, and allow config changes to occur without restarting the server. https://fedorahosted.org/389/ticket/47613 Reviewed by: nhosoi(Thanks!) (cherry picked from commit 43959232f792db2b79e614f6db78f7569920fdc1) (cherry picked from commit a1e386188663c9197b80b3b51cca0d58ce0c9181) --- ldap/servers/slapd/configdse.c | 1 - ldap/servers/slapd/libglobs.c | 10 +++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ldap/servers/slapd/configdse.c b/ldap/servers/slapd/configdse.c index bd1566e..b54062d 100644 --- a/ldap/servers/slapd/configdse.c +++ b/ldap/servers/slapd/configdse.c @@ -81,7 +81,6 @@ static const char *requires_restart[] = { #endif "cn=config:" CONFIG_RETURN_EXACT_CASE_ATTRIBUTE, "cn=config:" CONFIG_SCHEMA_IGNORE_TRAILING_SPACES, - "cn=config:nsslapd-allowed-sasl-mechanisms", "cn=config,cn=ldbm:nsslapd-idlistscanlimit", "cn=config,cn=ldbm:nsslapd-parentcheck", "cn=config,cn=ldbm:nsslapd-dbcachesize", diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index a763135..64510d6 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -6761,8 +6761,7 @@ config_set_allowed_sasl_mechs(const char *attrname, char *value, char *errorbuf, { slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); - if(!apply || slapdFrontendConfig->allowed_sasl_mechs){ - /* we only set this at startup, if we try again just return SUCCESS */ + if(!apply){ return LDAP_SUCCESS; } @@ -6777,6 +6776,7 @@ config_set_allowed_sasl_mechs(const char *attrname, char *value, char *errorbuf, } CFG_LOCK_WRITE(slapdFrontendConfig); + slapi_ch_free_string(&slapdFrontendConfig->allowed_sasl_mechs); slapdFrontendConfig->allowed_sasl_mechs = slapi_ch_strdup(value); CFG_UNLOCK_WRITE(slapdFrontendConfig); @@ -7476,7 +7476,11 @@ invalid_sasl_mech(char *str) int i; if(str == NULL){ - return 0; + return 1; + } + if(strlen(str) < 1){ + /* ignore empty values */ + return 1; } /* -- 1.8.1.4