Fix typo

[mod_auth_gssapi.git] / src / mod_auth_gssapi.c

diff --git a/src/mod_auth_gssapi.c b/src/mod_auth_gssapi.c
index 9f88037..7f4077b 100644 (file)
--- a/src/mod_auth_gssapi.c
+++ b/src/mod_auth_gssapi.c
@@ -100,6 +100,7 @@ static int mag_post_config(apr_pool_t *cfg, apr_pool_t *log,
 
 
 struct mag_conn {
+    apr_pool_t *parent;
     gss_ctx_id_t ctx;
     bool established;
     char *user_name;
@@ -113,10 +114,23 @@ static int mag_pre_connection(conn_rec *c, void *csd)
     mc = apr_pcalloc(c->pool, sizeof(struct mag_conn));
     if (!mc) return DECLINED;
 
+    mc->parent = c->pool;
     ap_set_module_config(c->conn_config, &auth_gssapi_module, (void*)mc);
     return OK;
 }
 
+static apr_status_t mag_conn_destroy(void *ptr)
+{
+    struct mag_conn *mc = (struct mag_conn *)ptr;
+    uint32_t min;
+
+    if (mc->ctx) {
+        (void)gss_delete_sec_context(&min, &mc->ctx, GSS_C_NO_BUFFER);
+        mc->established = false;
+    }
+    return APR_SUCCESS;
+}
+
 static bool mag_conn_is_https(conn_rec *c)
 {
     if (mag_is_https) {
@@ -212,11 +226,15 @@ static int mag_auth(request_rec *req)
         goto done;
     }
 
+    /* register the context in the connection pool, so it can be freed
+     * when the connection is terminated */
+    apr_pool_userdata_set(mc, "mag_conn_ptr", mag_conn_destroy, mc->parent);
+
     if (maj == GSS_S_CONTINUE_NEEDED) {
         if (!cfg->gss_conn_ctx) {
             ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
                           "Mechanism needs continuation but "
-                          "GSSConnectionContext is off.");
+                          "GssapiConnectionBound is off.");
             gss_delete_sec_context(&min, pctx, GSS_C_NO_BUFFER);
             gss_release_buffer(&min, &output);
             output.length = 0;
@@ -224,15 +242,10 @@ static int mag_auth(request_rec *req)
         goto done;
     }
 
-    /* once the connection has been accepted we do not need the context
-     * anymore, discard it. FIXME: we also need a destructor for those
-     * mechanisms (like NTLMSSP) that do not complete in one step */
-    gss_delete_sec_context(&min, pctx, GSS_C_NO_BUFFER);
-
 #ifdef HAVE_GSS_STORE_CRED_INTO
     if (cfg->cred_store && delegated_cred != GSS_C_NO_CREDENTIAL) {
         gss_key_value_set_desc store = {0, NULL};
-        /* FIXME: run substtutions */
+        /* FIXME: run substitutions */
 
         maj = gss_store_cred_into(&min, delegated_cred, GSS_C_INITIATE,
                                   GSS_C_NULL_OID, 1, 1, &store, NULL, NULL);
@@ -265,8 +278,8 @@ static int mag_auth(request_rec *req)
     }
 
     if (mc) {
-        mc->user_name = apr_pstrdup(req->connection->pool, req->user);
-        mc->gss_name = apr_pstrdup(req->connection->pool, clientname);
+        mc->user_name = apr_pstrdup(mc->parent, req->user);
+        mc->gss_name = apr_pstrdup(mc->parent, clientname);
         mc->established = true;
     }
 
@@ -342,7 +355,7 @@ static const char *mag_cred_store(cmd_parms *parms, void *mconfig,
     p = strchr(w, ':');
     if (!p) {
         ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, parms->server,
-                     "%s [%s]", "Invalid syntax for GSSCredStore option", w);
+                     "%s [%s]", "Invalid syntax for GssapiCredStore option", w);
         return NULL;
     }
 
@@ -350,7 +363,7 @@ static const char *mag_cred_store(cmd_parms *parms, void *mconfig,
     value = apr_pstrdup(parms->pool, p + 1);
     if (!key || !value) {
         ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, parms->server,
-                     "%s", "OOM handling GSSCredStore option");
+                     "%s", "OOM handling GssapiCredStore option");
         return NULL;
     }
 
@@ -358,7 +371,7 @@ static const char *mag_cred_store(cmd_parms *parms, void *mconfig,
     elements = apr_palloc(parms->pool, size);
     if (!elements) {
         ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, parms->server,
-                     "%s", "OOM handling GSSCredStore option");
+                     "%s", "OOM handling GssapiCredStore option");
         return NULL;
     }
 
@@ -375,13 +388,13 @@ static const char *mag_cred_store(cmd_parms *parms, void *mconfig,
 }
 
 static const command_rec mag_commands[] = {
-    AP_INIT_FLAG("GSSSSLOnly", mag_ssl_only, NULL, OR_AUTHCFG,
+    AP_INIT_FLAG("GssapiSSLonly", mag_ssl_only, NULL, OR_AUTHCFG,
                   "Work only if connection is SSL Secured"),
-    AP_INIT_FLAG("GSSLocalName", mag_map_to_local, NULL, OR_AUTHCFG,
+    AP_INIT_FLAG("GssapiLocalName", mag_map_to_local, NULL, OR_AUTHCFG,
                   "Work only if connection is SSL Secured"),
-    AP_INIT_FLAG("GSSConnectionContext", mag_conn_ctx, NULL, OR_AUTHCFG,
-                  "Authentication is valid for the life of the connection"),
-    AP_INIT_ITERATE("GSSCredStore", mag_cred_store, NULL, OR_AUTHCFG,
+    AP_INIT_FLAG("GssapiConnectionBound", mag_conn_ctx, NULL, OR_AUTHCFG,
+                  "Authentication is bound to the TCP connection"),
+    AP_INIT_ITERATE("GssapiCredStore", mag_cred_store, NULL, OR_AUTHCFG,
                     "Credential Store"),
     { NULL }
 };