From 789e6e71201e7f0b713ee280b65af184d785b032 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 15 Feb 2011 12:59:43 +0100 Subject: [PATCH] Remove renewal item if it is not re-added --- src/providers/krb5/krb5_renew_tgt.c | 26 ++++++++++++++++++++++++++ 1 files changed, 26 insertions(+), 0 deletions(-) diff --git a/src/providers/krb5/krb5_renew_tgt.c b/src/providers/krb5/krb5_renew_tgt.c index 7d68c3a..6768002 100644 --- a/src/providers/krb5/krb5_renew_tgt.c +++ b/src/providers/krb5/krb5_renew_tgt.c @@ -69,6 +69,7 @@ static void renew_tgt(struct tevent_context *ev, struct tevent_timer *te, auth_data->krb5_ctx); if (req == NULL) { DEBUG(1, ("krb5_auth_send failed.\n")); + talloc_steal(auth_data->renew_data, auth_data->pd); talloc_free(auth_data); return; } @@ -83,6 +84,7 @@ static void renew_tgt_done(struct tevent_req *req) int ret; int pam_status = PAM_SYSTEM_ERR; int dp_err; + hash_value_t value; ret = krb5_auth_recv(req, &pam_status, &dp_err); talloc_free(req); @@ -97,6 +99,21 @@ static void renew_tgt_done(struct tevent_req *req) case PAM_SUCCESS: DEBUG(4, ("Successfully renewed TGT for user [%s].\n", auth_data->pd->user)); + + ret = hash_lookup(auth_data->table, &auth_data->key, &value); + if (ret == HASH_SUCCESS) { + if (value.type == HASH_VALUE_PTR && + auth_data->renew_data == talloc_get_type(value.ptr, + struct renew_data)) { + DEBUG(5, ("New TGT was not added for renewal, " + "removing list entry for user [%s].\n", + auth_data->pd->user)); + ret = hash_delete(auth_data->table, &auth_data->key); + if (ret != HASH_SUCCESS) { + DEBUG(1, ("hash_delete failed.\n")); + } + } + } break; case PAM_AUTHINFO_UNAVAIL: case PAM_AUTHTOK_LOCK_BUSY: @@ -149,6 +166,15 @@ static errno_t renew_all_tgts(struct renew_tgt_ctx *renew_tgt_ctx) if (auth_data == NULL) { DEBUG(1, ("talloc_zero failed.\n")); } else { +/* We need to steal the pam_data here, because a successful renewal of the + * ticket might add a new renewal item to the list with the same key (upn). + * This would delete renew_data and all its children. But we cannot be sure + * that adding the new renewal item is the last operation of the renewal + * process with access the pam_data. To be on the safe side we steal the + * pam_data and make it a child of auth_data which is only freed after the + * renewal process is finished. In the case of an error during renewal we + * might want to steal the pam_data back to renew_data before freeing + * auth_data to allow a new renewal attempt. */ auth_data->pd = talloc_steal(auth_data, renew_data->pd); auth_data->krb5_ctx = renew_tgt_ctx->krb5_ctx; auth_data->be_ctx = renew_tgt_ctx->be_ctx; -- 1.7.3.3