[SSSD] [PATCH] Remove renewal item if it is not re-added

Sumit Bose sbose at redhat.com
Tue Feb 15 12:04:38 UTC 2011


Hi,

this patch should fix trac ticket #800 aka
https://bugzilla.redhat.com/show_bug.cgi?id=677588 .

I think this issue was introduce by some changes during the review of
the renewal feature.

bye,
Sumit
-------------- next part --------------
From 789e6e71201e7f0b713ee280b65af184d785b032 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 15 Feb 2011 12:59:43 +0100
Subject: [PATCH] Remove renewal item if it is not re-added

---
 src/providers/krb5/krb5_renew_tgt.c |   26 ++++++++++++++++++++++++++
 1 files changed, 26 insertions(+), 0 deletions(-)

diff --git a/src/providers/krb5/krb5_renew_tgt.c b/src/providers/krb5/krb5_renew_tgt.c
index 7d68c3a..6768002 100644
--- a/src/providers/krb5/krb5_renew_tgt.c
+++ b/src/providers/krb5/krb5_renew_tgt.c
@@ -69,6 +69,7 @@ static void renew_tgt(struct tevent_context *ev, struct tevent_timer *te,
                          auth_data->krb5_ctx);
     if (req == NULL) {
         DEBUG(1, ("krb5_auth_send failed.\n"));
+        talloc_steal(auth_data->renew_data, auth_data->pd);
         talloc_free(auth_data);
         return;
     }
@@ -83,6 +84,7 @@ static void renew_tgt_done(struct tevent_req *req)
     int ret;
     int pam_status = PAM_SYSTEM_ERR;
     int dp_err;
+    hash_value_t value;
 
     ret = krb5_auth_recv(req, &pam_status, &dp_err);
     talloc_free(req);
@@ -97,6 +99,21 @@ static void renew_tgt_done(struct tevent_req *req)
             case PAM_SUCCESS:
                 DEBUG(4, ("Successfully renewed TGT for user [%s].\n",
                           auth_data->pd->user));
+
+                ret = hash_lookup(auth_data->table, &auth_data->key, &value);
+                if (ret == HASH_SUCCESS) {
+                    if (value.type == HASH_VALUE_PTR &&
+                        auth_data->renew_data == talloc_get_type(value.ptr,
+                                                           struct renew_data)) {
+                        DEBUG(5, ("New TGT was not added for renewal, "
+                                  "removing list entry for user [%s].\n",
+                                  auth_data->pd->user));
+                        ret = hash_delete(auth_data->table, &auth_data->key);
+                        if (ret != HASH_SUCCESS) {
+                            DEBUG(1, ("hash_delete failed.\n"));
+                        }
+                    }
+                }
                 break;
             case PAM_AUTHINFO_UNAVAIL:
             case PAM_AUTHTOK_LOCK_BUSY:
@@ -149,6 +166,15 @@ static errno_t renew_all_tgts(struct renew_tgt_ctx *renew_tgt_ctx)
             if (auth_data == NULL) {
                 DEBUG(1, ("talloc_zero failed.\n"));
             } else {
+/* We need to steal the pam_data here, because a successful renewal of the
+ * ticket might add a new renewal item to the list with the same key (upn).
+ * This would delete renew_data and all its children. But we cannot be sure
+ * that adding the new renewal item is the last operation of the renewal
+ * process with access the pam_data. To be on the safe side we steal the
+ * pam_data and make it a child of auth_data which is only freed after the
+ * renewal process is finished. In the case of an error during renewal we
+ * might want to steal the pam_data back to renew_data before freeing
+ * auth_data to allow a new renewal attempt. */
                 auth_data->pd = talloc_steal(auth_data, renew_data->pd);
                 auth_data->krb5_ctx = renew_tgt_ctx->krb5_ctx;
                 auth_data->be_ctx = renew_tgt_ctx->be_ctx;
-- 
1.7.3.3



More information about the sssd-devel mailing list