[SSSD] [PATCH] Remove renewal item if it is not re-added
Sumit Bose
sbose at redhat.com
Tue Feb 15 12:04:38 UTC 2011
Hi,
this patch should fix trac ticket #800 aka
https://bugzilla.redhat.com/show_bug.cgi?id=677588 .
I think this issue was introduce by some changes during the review of
the renewal feature.
bye,
Sumit
-------------- next part --------------
From 789e6e71201e7f0b713ee280b65af184d785b032 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 15 Feb 2011 12:59:43 +0100
Subject: [PATCH] Remove renewal item if it is not re-added
---
src/providers/krb5/krb5_renew_tgt.c | 26 ++++++++++++++++++++++++++
1 files changed, 26 insertions(+), 0 deletions(-)
diff --git a/src/providers/krb5/krb5_renew_tgt.c b/src/providers/krb5/krb5_renew_tgt.c
index 7d68c3a..6768002 100644
--- a/src/providers/krb5/krb5_renew_tgt.c
+++ b/src/providers/krb5/krb5_renew_tgt.c
@@ -69,6 +69,7 @@ static void renew_tgt(struct tevent_context *ev, struct tevent_timer *te,
auth_data->krb5_ctx);
if (req == NULL) {
DEBUG(1, ("krb5_auth_send failed.\n"));
+ talloc_steal(auth_data->renew_data, auth_data->pd);
talloc_free(auth_data);
return;
}
@@ -83,6 +84,7 @@ static void renew_tgt_done(struct tevent_req *req)
int ret;
int pam_status = PAM_SYSTEM_ERR;
int dp_err;
+ hash_value_t value;
ret = krb5_auth_recv(req, &pam_status, &dp_err);
talloc_free(req);
@@ -97,6 +99,21 @@ static void renew_tgt_done(struct tevent_req *req)
case PAM_SUCCESS:
DEBUG(4, ("Successfully renewed TGT for user [%s].\n",
auth_data->pd->user));
+
+ ret = hash_lookup(auth_data->table, &auth_data->key, &value);
+ if (ret == HASH_SUCCESS) {
+ if (value.type == HASH_VALUE_PTR &&
+ auth_data->renew_data == talloc_get_type(value.ptr,
+ struct renew_data)) {
+ DEBUG(5, ("New TGT was not added for renewal, "
+ "removing list entry for user [%s].\n",
+ auth_data->pd->user));
+ ret = hash_delete(auth_data->table, &auth_data->key);
+ if (ret != HASH_SUCCESS) {
+ DEBUG(1, ("hash_delete failed.\n"));
+ }
+ }
+ }
break;
case PAM_AUTHINFO_UNAVAIL:
case PAM_AUTHTOK_LOCK_BUSY:
@@ -149,6 +166,15 @@ static errno_t renew_all_tgts(struct renew_tgt_ctx *renew_tgt_ctx)
if (auth_data == NULL) {
DEBUG(1, ("talloc_zero failed.\n"));
} else {
+/* We need to steal the pam_data here, because a successful renewal of the
+ * ticket might add a new renewal item to the list with the same key (upn).
+ * This would delete renew_data and all its children. But we cannot be sure
+ * that adding the new renewal item is the last operation of the renewal
+ * process with access the pam_data. To be on the safe side we steal the
+ * pam_data and make it a child of auth_data which is only freed after the
+ * renewal process is finished. In the case of an error during renewal we
+ * might want to steal the pam_data back to renew_data before freeing
+ * auth_data to allow a new renewal attempt. */
auth_data->pd = talloc_steal(auth_data, renew_data->pd);
auth_data->krb5_ctx = renew_tgt_ctx->krb5_ctx;
auth_data->be_ctx = renew_tgt_ctx->be_ctx;
--
1.7.3.3
More information about the sssd-devel
mailing list