auth: Fix handling passdbs with identical driver/args but different mechanisms/userna...

The passdb was wrongly deduplicated in this situation, causing wrong
mechanisms or username_filter setting to be used. This would be a rather
unlikely configuration though.

Fixed by moving mechanisms and username_filter from struct passdb_module
to struct auth_passdb, which is where they should have been in the first
place.

Gbp-Pq: Name auth-Fix-handling-passdbs-with-identical-driver-args-but-.patch

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index ee89e753085e89597799d4b37b56f74a9d3b94c8..cd44cd4783c478bc96c62d197c0121341c3d959a 100644 (file)
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -553,8 +553,8 @@ auth_request_want_skip_passdb(struct auth_request *request,
                              struct auth_passdb *passdb)
 {
        /* if mechanism is not supported, skip */
-       const char *const *mechs = passdb->passdb->mechanisms;
-       const char *const *username_filter = passdb->passdb->username_filter;
+       const char *const *mechs = passdb->mechanisms;
+       const char *const *username_filter = passdb->username_filter;
        const char *username;
 
        username = request->fields.user;
@@ -567,7 +567,7 @@ auth_request_want_skip_passdb(struct auth_request *request,
                return TRUE;
        }
 
-       if (passdb->passdb->username_filter != NULL &&
+       if (passdb->username_filter != NULL &&
            !auth_request_username_accepted(username_filter, username)) {
                auth_request_log_debug(request,
                                       request->mech != NULL ? AUTH_SUBSYS_MECH

diff --git a/src/auth/auth.c b/src/auth/auth.c
index 845c43cadfd7770f90369290eabfcf2dbf1dfac1..a5a4c81fcb6f5afcce4d289d72e0cd7a9bc89cfb 100644 (file)
--- a/src/auth/auth.c
+++ b/src/auth/auth.c
@@ -93,6 +93,24 @@ auth_passdb_preinit(struct auth *auth, const struct auth_passdb_settings *set,
        auth_passdb->override_fields_tmpl =
                passdb_template_build(auth->pool, set->override_fields);
 
+       if (*set->mechanisms == '\0') {
+               auth_passdb->mechanisms = NULL;
+       } else if (strcasecmp(set->mechanisms, "none") == 0) {
+               auth_passdb->mechanisms = (const char *const[]){ NULL };
+       } else {
+               auth_passdb->mechanisms =
+                       (const char *const *)p_strsplit_spaces(auth->pool,
+                               set->mechanisms, " ,");
+       }
+
+       if (*set->username_filter == '\0') {
+               auth_passdb->username_filter = NULL;
+       } else {
+               auth_passdb->username_filter =
+                       (const char *const *)p_strsplit_spaces(auth->pool,
+                               set->username_filter, " ,");
+       }
+
        /* for backwards compatibility: */
        if (set->pass)
                auth_passdb->result_success = AUTH_DB_RULE_CONTINUE;

diff --git a/src/auth/auth.h b/src/auth/auth.h
index 3ca5a9bb12b70ba10420b88ae615ce83410bf75c..6208e4d6f779c70395d65891c8b4701bff738e40 100644 (file)
--- a/src/auth/auth.h
+++ b/src/auth/auth.h
@@ -41,6 +41,11 @@ struct auth_passdb {
        struct passdb_template *default_fields_tmpl;
        struct passdb_template *override_fields_tmpl;
 
+       /* Supported authentication mechanisms, NULL is all, {NULL} is none */
+       const char *const *mechanisms;
+       /* Username filter, NULL is no filter */
+       const char *const *username_filter;
+
        enum auth_passdb_skip skip;
        enum auth_db_rule result_success;
        enum auth_db_rule result_failure;

diff --git a/src/auth/passdb.c b/src/auth/passdb.c
index 9bc2b875c37c5f206eeeee3814fe360082186802..d3c61cc1438729c155ebfe1389596ac08c70a31b 100644 (file)
--- a/src/auth/passdb.c
+++ b/src/auth/passdb.c
@@ -224,19 +224,8 @@ passdb_preinit(pool_t pool, const struct auth_passdb_settings *set)
        passdb->id = ++auth_passdb_id;
        passdb->iface = *iface;
        passdb->args = p_strdup(pool, set->args);
-       if (*set->mechanisms == '\0') {
-               passdb->mechanisms = NULL;
-       } else if (strcasecmp(set->mechanisms, "none") == 0) {
-               passdb->mechanisms = (const char *const[]){NULL};
-       } else {
-               passdb->mechanisms = (const char* const*)p_strsplit_spaces(pool, set->mechanisms, " ,");
-       }
-
-       if (*set->username_filter == '\0') {
-               passdb->username_filter = NULL;
-       } else {
-               passdb->username_filter = (const char* const*)p_strsplit_spaces(pool, set->username_filter, " ,");
-       }
+       /* NOTE: if anything else than driver & args are added here,
+          passdb_find() also needs to be updated. */
        array_push_back(&passdb_modules, &passdb);
        return passdb;
 }

diff --git a/src/auth/passdb.h b/src/auth/passdb.h
index b405aa7e3f45da63cf3510c24c84fefaa5af71fc..8f500505f1079e54eb5434f2bfbc74e345458f6c 100644 (file)
--- a/src/auth/passdb.h
+++ b/src/auth/passdb.h
@@ -63,10 +63,6 @@ struct passdb_module {
        /* Default password scheme for this module.
           If default_cache_key is set, must not be NULL. */
        const char *default_pass_scheme;
-       /* Supported authentication mechanisms, NULL is all, [NULL] is none*/
-       const char *const *mechanisms;
-       /* Username filter, NULL is no filter */
-       const char *const *username_filter;
 
        /* If blocking is set to TRUE, use child processes to access
           this passdb. */