From c0ceeba0f823015d92e7505126fbfbbacb0f4728 Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Fri, 13 Feb 2015 09:34:17 +0100
Subject: [PATCH] Fail if authentication modules are changed on reload

---
 src/config.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/src/config.c b/src/config.c
index 97838f61..4306a014 100644
--- a/src/config.c
+++ b/src/config.c
@@ -1157,7 +1157,6 @@ void reload_cfg_file(void *pool, struct cfg_st* config)
 
 	/* authentication methods can't change on reload */
 	memcpy(bak, config->auth, sizeof(config->auth));
-	memset(config->auth, 0, sizeof(config->auth));
 	bak_size = config->auth_methods;
 
 	clear_cfg_file(config);
@@ -1166,17 +1165,27 @@ void reload_cfg_file(void *pool, struct cfg_st* config)
 
 	parse_cfg_file(cfg_file, config, 1);
 
-	/* reset the auth methods */
+	/* check if the authentication methods remained the same */
+	if (config->auth_methods != bak_size) {
+		goto auth_fail;
+	}
+
 	for (i=0;i<config->auth_methods;i++) {
-		if (config->auth[i].enabled)
-			DEL(config->auth[i].additional);
+		if (config->auth[i].enabled != bak[i].enabled) {
+			goto auth_fail;
+		}
+
+		if (config->auth[i].type != bak[i].type) {
+			goto auth_fail;
+		}
 	}
-	memcpy(config->auth, bak, sizeof(config->auth));
-	config->auth_methods = bak_size;
 
 	check_cfg(config);
 
 	return;
+ auth_fail:
+ 	syslog(LOG_ERR, "you cannot switch authentication methods on reload");
+	exit(1);
 }
 
 void write_pid_file(void)