# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1737042375 0
# Node ID f77f5e408d6aed7dde4160d37a4313f332ac846c
# Parent  045abdc53ba4ccc4c91881b38ef8b1cfdcaac78b
mod_sasl2_fast: Restore non-FAST SASL handler upon reset

This fixes an issue where, after failed FAST authentication, the FAST handler
was still used (even though the client now wants to try with a password or
other non-FAST credentials).

A little hacky perhaps, but probably the best we can do without baking FAST
support directly into mod_sasl2.

diff -r 045abdc53ba4 -r f77f5e408d6a mod_sasl2_fast/mod_sasl2_fast.lua
--- a/mod_sasl2_fast/mod_sasl2_fast.lua	Thu Jan 16 15:44:24 2025 +0000
+++ b/mod_sasl2_fast/mod_sasl2_fast.lua	Thu Jan 16 15:46:15 2025 +0000
@@ -98,12 +98,19 @@
 	end
 end
 
-function get_sasl_handler()
+-- If FAST fails, we want to restore back to a non-FAST handler
+local function _clean_clone_shim(self)
+	return self.nonfast_sasl_handler:clean_clone();
+end
+
+function get_sasl_handler(username, nonfast_sasl_handler) -- luacheck: ignore 212/username
 	local token_auth_profile = {
 		ht_sha_256 = new_token_tester(hash.hmac_sha256);
 	};
 	local handler = sasl.new(module.host, token_auth_profile);
 	handler.fast = true;
+	handler.nonfast_sasl_handler = nonfast_sasl_handler;
+	handler.clean_clone = _clean_clone_shim;
 	return handler;
 end
 
@@ -115,7 +122,7 @@
 		username = jid.node(event.stream.from);
 		if not username then return; end
 	end
-	local sasl_handler = get_sasl_handler(username);
+	local sasl_handler = get_sasl_handler(username, session.sasl_handler);
 	if not sasl_handler then return; end
 	sasl_handler.fast_auth = true; -- For informational purposes
 	-- Copy channel binding info from primary SASL handler if it's compatible