again don't release constant OIDs

[cyrus-sasl.git] / plugins / gs2.c

diff --git a/plugins/gs2.c b/plugins/gs2.c
index 15eeadc..4b2077e 100644 (file)
--- a/plugins/gs2.c
+++ b/plugins/gs2.c
@@ -120,7 +120,7 @@ typedef struct context {
     gss_OID mechanism;
     int gs2_flags;
     char *cbindingname;
-    struct gss_channel_bindings_struct bindings;
+    struct gss_channel_bindings_struct gss_cbindings;
     sasl_secret_t *password;
     unsigned int free_password;
     OM_uint32 lifetime;
@@ -245,12 +245,7 @@ sasl_gs2_free_context_contents(context_t *text)
         text->authzid = NULL;
     }
 
-    if (text->mechanism != NULL) {
-        gss_release_oid(&min_stat, &text->mechanism);
-        text->mechanism = GSS_C_NO_OID;
-    }
-
-    gss_release_buffer(&min_stat, &text->bindings.application_data);
+    gss_release_buffer(&min_stat, &text->gss_cbindings.application_data);
 
     if (text->out_buf != NULL) {
         text->utils->free(text->out_buf);
@@ -415,7 +410,7 @@ gs2_server_mech_step(void *conn_context,
                                         ? (gss_cred_id_t)params->gss_creds
                                         : text->server_creds,
                                       &input_token,
-                                      &text->bindings,
+                                      &text->gss_cbindings,
                                       &text->client_name,
                                       &actual_mech,
                                       &output_token,
@@ -426,7 +421,7 @@ gs2_server_mech_step(void *conn_context,
         sasl_gs2_log(text->utils, maj_stat, min_stat);
         text->utils->seterror(text->utils->conn, SASL_NOLOG,
                               "GS2 Failure: gss_accept_sec_context");
-        ret = SASL_BADAUTH;
+        ret = (maj_stat == GSS_S_BAD_BINDINGS) ? SASL_BADBINDING : SASL_BADAUTH;
         goto cleanup;
     }
 
@@ -478,14 +473,14 @@ gs2_server_mech_step(void *conn_context,
                                    GSS_C_NT_USER_NAME,
                                    &without);
         if (GSS_ERROR(maj_stat)) {
-            ret = SASL_BADAUTH;
+            ret = SASL_FAIL;
             goto cleanup;
         }
 
         maj_stat = gss_compare_name(&min_stat, text->client_name,
                                     without, &equal);
         if (GSS_ERROR(maj_stat)) {
-            ret = SASL_BADAUTH;
+            ret = SASL_FAIL;
             goto cleanup;
         }
 
@@ -549,7 +544,6 @@ cleanup:
     gss_release_buffer(&min_stat, &short_name_buf);
     gss_release_buffer(&min_stat, &output_token);
     gss_release_name(&min_stat, &without);
-    gss_release_oid(&min_stat, &actual_mech);
 
     if (ret == SASL_OK && maj_stat != GSS_S_COMPLETE) {
         sasl_gs2_seterror(text->utils, maj_stat, min_stat);
@@ -828,7 +822,7 @@ static int gs2_client_mech_step(void *conn_context,
                                     (gss_OID)text->mechanism,
                                     req_flags,
                                     GSS_C_INDEFINITE,
-                                    &text->bindings,
+                                    &text->gss_cbindings,
                                     serverinlen ? &input_token : GSS_C_NO_BUFFER,
                                     NULL,
                                     &output_token,
@@ -892,7 +886,6 @@ static int gs2_client_mech_step(void *conn_context,
 cleanup:
     gss_release_buffer(&min_stat, &output_token);
     gss_release_buffer(&min_stat, &name_buf);
-    gss_release_oid(&min_stat, &actual_mech);
 
     if (ret == SASL_OK && maj_stat != GSS_S_COMPLETE) {
         sasl_gs2_seterror(text->utils, maj_stat, min_stat);
@@ -1018,11 +1011,11 @@ gs2_save_cbindings(context_t *text,
                    gss_buffer_t header,
                    const sasl_channel_binding_t *cbinding)
 {
-    gss_buffer_t gss_bindings = &text->bindings.application_data;
+    gss_buffer_t gss_cbindings = &text->gss_cbindings.application_data;
     size_t len;
     unsigned char *p;
 
-    assert(gss_bindings->value == NULL);
+    assert(gss_cbindings->value == NULL);
 
     /*
      * The application-data field MUST be set to the gs2-header, excluding
@@ -1039,12 +1032,12 @@ gs2_save_cbindings(context_t *text,
         len += cbinding->len;
     }
 
-    gss_bindings->length = len;
-    gss_bindings->value = text->utils->malloc(len);
-    if (gss_bindings->value == NULL)
+    gss_cbindings->length = len;
+    gss_cbindings->value = text->utils->malloc(len);
+    if (gss_cbindings->value == NULL)
         return SASL_NOMEM;
 
-    p = (unsigned char *)gss_bindings->value;
+    p = (unsigned char *)gss_cbindings->value;
     if (text->gs2_flags & GS2_NONSTD_FLAG) {
         memcpy(p, (unsigned char *)header->value + 2, header->length - 2);
         p += header->length - 2;
@@ -1061,7 +1054,7 @@ gs2_save_cbindings(context_t *text,
     return SASL_OK;
 }
 
-#define CHECK_REMAIN(n)     do { if (remain < (n)) return SASL_BADAUTH; } while (0)
+#define CHECK_REMAIN(n)     do { if (remain < (n)) return SASL_BADPROT; } while (0)
 
 /*
  * Verify gs2-header, save authzid and channel bindings to context.
@@ -1102,7 +1095,7 @@ gs2_verify_initial_message(context_t *text,
         CHECK_REMAIN(1); /* = */
         remain--;
         if (*p++ != '=')
-            return SASL_BADAUTH;
+            return SASL_BADPROT;
 
         ret = gs2_unescape_authzid(text->utils, &p, &remain, &text->cbindingname);
         if (ret != SASL_OK)
@@ -1121,7 +1114,7 @@ gs2_verify_initial_message(context_t *text,
     CHECK_REMAIN(1); /* , */
     remain--;
     if (*p++ != ',')
-        return SASL_BADAUTH;
+        return SASL_BADPROT;
 
     /* authorization identity */
     if (remain > 1 && memcmp(p, "a=", 2) == 0) {
@@ -1138,7 +1131,7 @@ gs2_verify_initial_message(context_t *text,
     CHECK_REMAIN(1); /* , */
     remain--;
     if (*p++ != ',')
-        return SASL_BADAUTH;
+        return SASL_BADPROT;
 
     buf.length = inlen - remain;
     buf.value = (void *)in;