From 251a45a29531689bd4e70d1cba13748cccf07064 Mon Sep 17 00:00:00 2001
From: William Brown <firstyear@redhat.com>
Date: Thu, 30 Nov 2017 14:06:59 +0100
Subject: [PATCH 2/2] Ticket 49474 - sasl allow mechs does not operate
 correctly

Bug Description:  In a fix to sasl allowed mechs, the logic
was not properly configured.

Fix Description:  Alter the ids_sasl_supported_mech to be
clearer and simpler in it's design.

https://pagure.io/389-ds-base/issue/49474

Author: wibrown

Review by: ???
---
 ldap/servers/slapd/saslbind.c | 40 ++++++++++++++++++++++++++--------------
 1 file changed, 26 insertions(+), 14 deletions(-)

diff --git a/ldap/servers/slapd/saslbind.c b/ldap/servers/slapd/saslbind.c
index 6734c32..0a6c759 100644
--- a/ldap/servers/slapd/saslbind.c
+++ b/ldap/servers/slapd/saslbind.c
@@ -835,7 +835,7 @@ ids_sasl_listmech(Slapi_PBlock *pb)
 static int
 ids_sasl_mech_supported(Slapi_PBlock *pb, const char *mech)
 {
-    int i, ret = 0;
+    int ret = 0;
     char **mechs;
     char **allowed_mechs = NULL;
     char *dupstr;
@@ -860,18 +860,30 @@ ids_sasl_mech_supported(Slapi_PBlock *pb, const char *mech)
     mechs = slapi_str2charray(dupstr, ",");
     allowed_mechs = config_get_allowed_sasl_mechs_array();
 
-    for (i = 0; mechs[i] != NULL; i++) {
-        if (strcasecmp(mech, mechs[i]) == 0) {
-            if (allowed_mechs) {
-                if (charray_inlist(allowed_mechs, (char *)mech) == 0) {
-                    ret = 1;
-                }
-                break;
-            } else {
-                ret = 1;
-                break;
-            }
-        }
+    /* charray_inlist returns 1 if present. */
+    /* Default to failing if we get no mechs ... */
+    int sasl_mech_present = 0;
+
+    if (mechs != NULL) {
+        sasl_mech_present = charray_inlist(mechs, (char *)mech);
+    }
+
+    /* Default this to true, in case allowed_mechs is null */
+    int allowed_mech_present = 1;
+
+    if (allowed_mechs != NULL) {
+        allowed_mech_present = charray_inlist(allowed_mechs, (char *)mech);
+    }
+
+    slapi_log_err(SLAPI_LOG_TRACE, "ids_sasl_mech_supported", "sasl_mech_present = %"PRId32"\n", sasl_mech_present);
+    slapi_log_err(SLAPI_LOG_TRACE, "ids_sasl_mech_supported", "allowed_mech_present = %"PRId32"\n", allowed_mech_present);
+
+    if (allowed_mech_present == 1 && sasl_mech_present == 1) {
+        /* We allow it, and it's in the mech list. Yay! */
+        ret = 1;
+    } else {
+        /* One or the other said no :( */
+        ret = 0;
     }
 
     charray_free(allowed_mechs);
@@ -944,7 +956,7 @@ ids_sasl_check_bind(Slapi_PBlock *pb)
      * different error code to SASL_NOMECH.  Must be called
      * while holding the pb_conn lock
      */
-    if (!ids_sasl_mech_supported(pb, mech)) {
+    if (ids_sasl_mech_supported(pb, mech) == 0) {
         rc = SASL_NOMECH;
         goto sasl_check_result;
     }
-- 
1.8.3.1