Short circuit SASL auth when no mechanisms are available

[libvirt] [PATCH] Short circuit SASL auth when no mechanisms are available

Daniel P. Berrange posted 1 patch 7 years, 1 month ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/20170315180511.6615-1-berrange@redhat.com

src/rpc/virnetsaslcontext.c | 6 ++++++
1 file changed, 6 insertions(+)

Expand all Fold all

[libvirt] [PATCH] Short circuit SASL auth when no mechanisms are available

Posted by Daniel P. Berrange 7 years, 1 month ago

If the SASL config does not have any mechanisms we currently
just report an empty list to the client which will then
fail to identify a usable mechanism. This is a server config
error, so we should fail immediately on the server side.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---
 src/rpc/virnetsaslcontext.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/rpc/virnetsaslcontext.c b/src/rpc/virnetsaslcontext.c
index 37a5da2..c4492ec 100644
--- a/src/rpc/virnetsaslcontext.c
+++ b/src/rpc/virnetsaslcontext.c
@@ -390,6 +390,12 @@ char *virNetSASLSessionListMechanisms(virNetSASLSessionPtr sasl)
                        err, sasl_errdetail(sasl->conn));
         goto cleanup;
     }
+    VIR_DEBUG("SASL mechanism list is '%s'", mechlist);
+    if (STREQ(mechlist, "")) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                       _("no SASL mechanisms are available"));
+        goto cleanup;
+    }
     ignore_value(VIR_STRDUP(ret, mechlist));
 
  cleanup:
-- 
2.9.3

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCH] Short circuit SASL auth when no mechanisms are available

Posted by Peter Krempa 7 years, 1 month ago

On Wed, Mar 15, 2017 at 18:05:11 +0000, Daniel Berrange wrote:
> If the SASL config does not have any mechanisms we currently
> just report an empty list to the client which will then
> fail to identify a usable mechanism. This is a server config
> error, so we should fail immediately on the server side.
> 
> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> ---
>  src/rpc/virnetsaslcontext.c | 6 ++++++
>  1 file changed, 6 insertions(+)

ACK
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list