From ed5b177691d52c1c5417ef802854e26c9dd5d4f4 Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Wed, 10 Dec 2014 08:56:23 +0100
Subject: [PATCH] authentication information is only read on load

---
 src/config.c | 128 ++++++++++++++++++++++++++-------------------------
 1 file changed, 66 insertions(+), 62 deletions(-)

diff --git a/src/config.c b/src/config.c
index f42e7938..bf5e1522 100644
--- a/src/config.c
+++ b/src/config.c
@@ -406,75 +406,79 @@ unsigned force_cert_auth;
 		prev = val;
 	} while((val = optionNextValue(pov, prev)) != NULL);
 
-	config->sup_config_type = SUP_CONFIG_FILE;
+	/* authentication information is only read on first load, as
+	 * it cannot be safely switched */
+	if (reload == 0) {
+		config->sup_config_type = SUP_CONFIG_FILE;
 
-	READ_MULTI_LINE("auth", auth, auth_size);
-	for (j=0;j<auth_size;j++) {
-		if (c_strncasecmp(auth[j], "pam", 3) == 0) {
-			config->auth_additional = get_brackets_string(config, auth[j]+3);
-			if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
-				fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
-				exit(1);
-			}
-#ifdef HAVE_PAM
-			config->auth_types |= amod->type;
-			amod = &pam_auth_funcs;
-#else
-			fprintf(stderr, "PAM support is disabled\n");
-			exit(1);
-#endif
-		} else if (strncasecmp(auth[j], "plain", 5) == 0) {
-			if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
-				fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
-				exit(1);
-			}
-
-			config->auth_additional = get_brackets_string(config, auth[j]+5);
-			if (config->auth_additional == NULL) {
-				fprintf(stderr, "Format error in %s\n", auth[j]);
-				exit(1);
-			}
-			amod = &plain_auth_funcs;
-			config->auth_types |= amod->type;
-		} else if (strncasecmp(auth[j], "radius", 6) == 0) {
-			const char *p;
-			if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
-				fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
-				exit(1);
-			}
-
-#ifdef HAVE_RADIUS
-			config->auth_additional = get_brackets_string1(config, auth[j]+6);
-			if (config->auth_additional == NULL) {
-				fprintf(stderr, "No configuration specified; error in %s\n", auth[j]);
-				exit(1);
-			}
-
-			p = get_brackets_string2(config, auth[j]+6);
-			if (p != NULL) {
-				if (strcasecmp(p, "groupconfig") != 0) {
-					fprintf(stderr, "No known configuration option: %s\n", p);
+		READ_MULTI_LINE("auth", auth, auth_size);
+		for (j=0;j<auth_size;j++) {
+			if (c_strncasecmp(auth[j], "pam", 3) == 0) {
+				config->auth_additional = get_brackets_string(config, auth[j]+3);
+				if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
+					fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
 					exit(1);
 				}
-				config->sup_config_type = SUP_CONFIG_RADIUS;
-			}
-			amod = &radius_auth_funcs;
-			config->auth_types |= amod->type;
+#ifdef HAVE_PAM
+				config->auth_types |= amod->type;
+				amod = &pam_auth_funcs;
 #else
-			fprintf(stderr, "Radius support is disabled\n");
-			exit(1);
+				fprintf(stderr, "PAM support is disabled\n");
+				exit(1);
 #endif
-		} else if (c_strcasecmp(auth[j], "certificate") == 0) {
-			config->auth_types |= AUTH_TYPE_CERTIFICATE;
-		} else if (c_strcasecmp(auth[j], "certificate[optional]") == 0) {
-			config->auth_types |= AUTH_TYPE_CERTIFICATE_OPT;
-		} else {
-			fprintf(stderr, "Unknown auth method: %s\n", auth[j]);
-			exit(1);
+			} else if (strncasecmp(auth[j], "plain", 5) == 0) {
+				if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
+					fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
+					exit(1);
+				}
+
+				config->auth_additional = get_brackets_string(config, auth[j]+5);
+				if (config->auth_additional == NULL) {
+					fprintf(stderr, "Format error in %s\n", auth[j]);
+					exit(1);
+				}
+				amod = &plain_auth_funcs;
+				config->auth_types |= amod->type;
+			} else if (strncasecmp(auth[j], "radius", 6) == 0) {
+				const char *p;
+				if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
+					fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
+					exit(1);
+				}
+
+#ifdef HAVE_RADIUS
+				config->auth_additional = get_brackets_string1(config, auth[j]+6);
+				if (config->auth_additional == NULL) {
+					fprintf(stderr, "No configuration specified; error in %s\n", auth[j]);
+					exit(1);
+				}
+
+				p = get_brackets_string2(config, auth[j]+6);
+				if (p != NULL) {
+					if (strcasecmp(p, "groupconfig") != 0) {
+						fprintf(stderr, "No known configuration option: %s\n", p);
+						exit(1);
+					}
+					config->sup_config_type = SUP_CONFIG_RADIUS;
+				}
+				amod = &radius_auth_funcs;
+				config->auth_types |= amod->type;
+#else
+				fprintf(stderr, "Radius support is disabled\n");
+				exit(1);
+#endif
+			} else if (c_strcasecmp(auth[j], "certificate") == 0) {
+				config->auth_types |= AUTH_TYPE_CERTIFICATE;
+			} else if (c_strcasecmp(auth[j], "certificate[optional]") == 0) {
+				config->auth_types |= AUTH_TYPE_CERTIFICATE_OPT;
+			} else {
+				fprintf(stderr, "Unknown auth method: %s\n", auth[j]);
+				exit(1);
+			}
+			talloc_free(auth[j]);
 		}
-		talloc_free(auth[j]);
+		talloc_free(auth);
 	}
-	talloc_free(auth);
 
 	/* When adding allocated data, remember to modify
 	 * reload_cfg_file();