shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-20 06:50:22 +03:00
Code Releases Activity

sasl: Fix authentication when using PLAIN mechanism

Browse Source 
With some authentication mechanism (PLAIN for example), sasl_client_start()
can return SASL_OK, which translates to virNetSASLSessionClientStart()
returning VIR_NET_SASL_COMPLETE.
cyrus-sasl documentation is a bit vague as to what to do in such situation,
but upstream clarified this a bit in
http://asg.andrew.cmu.edu/archive/message.php?mailbox=archive.cyrus-sasl&msg=10104

When we got VIR_NET_SASL_COMPLETE after virNetSASLSessionClientStart() and
if the remote also tells us that authentication is complete, then we should
end the authentication procedure rather than forcing a call to
virNetSASLSessionClientStep(). Without this patch, when trying to use SASL
PLAIN, I get:
error :authentication failed : Failed to step SASL negotiation: -1
(SASL(-1): generic failure: Unable to find a callback: 32775)

This patch is based on a spice-gtk patch by Dietmar Maurer.
This commit is contained in:
Christophe Fergeau 2013-11-21 18:40:52 +01:00
parent 986900a5af
commit 0955025b9c
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/remote/remote_driver.c
View File

@ -4127,6 +4127,11 @@ remoteAuthSASL(virConnectPtr conn, struct private_data *priv,
VIR_DEBUG("Client step result complete: %d. Data %zu bytes %p",
complete, serverinlen, serverin);
/* Previous server call showed completion & sasl_client_start() told us
* we are locally complete too */
if (complete && err == VIR_NET_SASL_COMPLETE)
goto done;
/* Loop-the-loop...
* Even if the server has completed, the client must *always* do at least one step
* in this loop to verify the server isn't lying about something. Mutual auth */
@ -4201,6 +4206,7 @@ remoteAuthSASL(virConnectPtr conn, struct private_data *priv,
priv->is_secure = 1;
}
done:
VIR_DEBUG("SASL authentication complete");
virNetClientSetSASLSession(priv->client, sasl);
ret = 0;