From db750842dd9e7bf2dd76bc9be91bbd4d045d3179 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Sun, 14 Jun 2015 18:08:53 -0400 Subject: [PATCH] Fix re-authentication when connection bound is on When re-using a context on a connection, a re-authentication request may end up trying to use an established context handler to establish a new context. This will fail with an error in GSSAPI. Make sure to completely clean up the connection data when a brand new authentication needs to happen so that no data is mistakenly carried over. Note this may leak a small amount of data, but only if authentication is successful, so it is probably fine as is. Closes #38 Signed-off-by: Simo Sorce --- src/mod_auth_gssapi.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/src/mod_auth_gssapi.c b/src/mod_auth_gssapi.c index 66c8659..911ac92 100644 --- a/src/mod_auth_gssapi.c +++ b/src/mod_auth_gssapi.c @@ -110,8 +110,8 @@ static apr_status_t mag_conn_destroy(void *ptr) if (mc->ctx) { (void)gss_delete_sec_context(&min, &mc->ctx, GSS_C_NO_BUFFER); - mc->established = false; } + memset(mc, 0, sizeof(struct mag_conn)); return APR_SUCCESS; } @@ -452,6 +452,13 @@ static int mag_auth(request_rec *req) } } + if (mc && mc->established && auth_type != AUTH_TYPE_BASIC) { + /* if we are re-authenticating make sure the conn context + * is cleaned up so we do not accidentally reuse an existing + * established context */ + mag_conn_destroy(mc); + } + switch (auth_type) { case AUTH_TYPE_NEGOTIATE: if (!parse_auth_header(req->pool, &auth_header, &input)) { @@ -477,13 +484,16 @@ static int mag_auth(request_rec *req) ba_user.length = strlen(ba_user.value); ba_pwd.length = strlen(ba_pwd.value); - if (mc && mc->established && - mag_basic_check(cfg, mc, ba_user, ba_pwd)) { - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, req, - "Already established BASIC AUTH context found!"); - mag_set_req_data(req, cfg, mc); - ret = OK; - goto done; + if (mc && mc->established) { + if (mag_basic_check(cfg, mc, ba_user, ba_pwd)) { + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, req, + "Already established BASIC AUTH context found!"); + mag_set_req_data(req, cfg, mc); + ret = OK; + goto done; + } else { + mag_conn_destroy(mc); + } } maj = gss_import_name(&min, &ba_user, GSS_C_NT_USER_NAME, &client); -- 2.1.4