diff options
| author | Stefan Metzmacher <metze@samba.org> | 2017-05-12 12:44:05 +0200 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2017-06-15 09:13:23 +0200 |
| commit | 7605c67e079339c5e1b5b13199a705ece23c0ad6 (patch) | |
| tree | 05a25af44f6461fadaa768429e550ed12d332151 /source4/ldap_server | |
| parent | e8d431250edebf96c1d80aacf2f676c93da907f4 (diff) | |
| download | samba-7605c67e079339c5e1b5b13199a705ece23c0ad6.tar.gz | |
s4:ldap_server: make sure we destroy the gensec context on error
If the client tries a new bind we need to start with a fresh context.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4/ldap_server')
| -rw-r--r-- | source4/ldap_server/ldap_bind.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/source4/ldap_server/ldap_bind.c b/source4/ldap_server/ldap_bind.c index 06b52fe9510..5c390b61fda 100644 --- a/source4/ldap_server/ldap_bind.c +++ b/source4/ldap_server/ldap_bind.c @@ -431,8 +431,6 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call) result = LDAP_INVALID_CREDENTIALS; errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_LOGON_DENIED, 0x0C0904DC, status); - talloc_unlink(conn, conn->gensec); - conn->gensec = NULL; goto do_reply; } @@ -559,6 +557,18 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call) } do_reply: + if (result != LDAP_SASL_BIND_IN_PROGRESS) { + /* + * We should destroy the gensec context + * when we hit a fatal error. + * + * Note: conn->gensec is already cleared + * for the LDAP_SUCCESS case. + */ + talloc_unlink(conn, conn->gensec); + conn->gensec = NULL; + } + resp->response.resultcode = result; resp->response.dn = NULL; resp->response.errormessage = errstr; |