From c8073e95587710b0997f394a1579b384f4bdc295 Mon Sep 17 00:00:00 2001
From: Rich Megginson <rmeggins@redhat.com>
Date: May 20 2013 22:01:29 +0000
Subject: Ticket #508 - part 2 - lock-free access to FrontendConfig structure


https://fedorahosted.org/389/ticket/508
Reviewed by: mreynolds (Thanks!)
Branch: master
Fix Description: When computing the idletimeout, only check the config
anon_limits_dn if the connection c_dn is NULL.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
(cherry picked from commit 3d212a547210e03deeab8e72456cefda117c1394)

---

diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
index b611f5c..0fd9827 100644
--- a/ldap/servers/slapd/daemon.c
+++ b/ldap/servers/slapd/daemon.c
@@ -1796,27 +1796,28 @@ compute_idletimeout( slapdFrontendConfig_t *fecfg, Connection *conn )
 		 * this is not an anonymous user and no bind-based limits are set,
 		 * use the default idle timeout.
 	 	 */
-		char *anon_dn = config_get_anon_limits_dn();
 
-		if ((conn->c_dn == NULL) && anon_dn && (strlen(anon_dn) > 0)) {
-			Slapi_DN *anon_sdn = slapi_sdn_new_dn_byref( anon_dn );
+		if (conn->c_dn == NULL) {
+			char *anon_dn = config_get_anon_limits_dn();
+			if (anon_dn && (strlen(anon_dn) > 0)) {
+				Slapi_DN *anon_sdn = slapi_sdn_new_dn_byref(anon_dn);
 
-			reslimit_update_from_dn( conn, anon_sdn );
+				reslimit_update_from_dn(conn, anon_sdn);
 
-			if ( slapi_reslimit_get_integer_limit( conn,
-			    idletimeout_reslimit_handle, &idletimeout ) !=
-			    SLAPI_RESLIMIT_STATUS_SUCCESS ) {
-				idletimeout = fecfg->idletimeout;
-			}
+				if (slapi_reslimit_get_integer_limit(conn, idletimeout_reslimit_handle,
+													 &idletimeout)
+					!= SLAPI_RESLIMIT_STATUS_SUCCESS) {
+					idletimeout = fecfg->idletimeout;
+				}
 
-			slapi_sdn_free( &anon_sdn );
+				slapi_sdn_free(&anon_sdn);
+			}
+			slapi_ch_free_string(&anon_dn);
 		} else if ( conn->c_isroot ) {
 			idletimeout = 0;	/* no limit for Directory Manager */
 		} else {
 			idletimeout = fecfg->idletimeout;
 		}
-
-		slapi_ch_free_string( &anon_dn );
 	}
 
 	return( idletimeout );