[SSSD] [PATCH] KRB5: Return PAM_AUTH_ERR on incorrect password (1.8 backport)
Jakub Hrozek
jhrozek at redhat.com
Mon Sep 17 18:29:23 UTC 2012
On Fri, Sep 14, 2012 at 05:34:17PM +0200, Joschi Brauchle wrote:
> Hallo Jakub,
>
> I have tested the latest patch successfully.
>
> Please note that in the 2nd hunk,
> 1) the line with "KRB5_DEBUG(1, kerr);" should also be removed to
> avoid duplicate debug messages and
> 2) you could directly call "kerr_handle_error" instead of
> "kerr_to_status" (as kerr != 0).
>
> See current version:
> ------------
> @@ -777,9 +812,7 @@ static errno_t changepw_child(int fd, struct
> krb5_req *kr)
> kr->options);
> if (kerr != 0) {
> KRB5_DEBUG(1, kerr);
> - if (kerr == KRB5_KDC_UNREACH) {
> - pam_status = PAM_AUTHINFO_UNAVAIL;
> - }
> + pam_status = kerr_to_status(kerr);
> goto sendresponse;
> }
> ------------
>
> But those are just minor cosmetic problems and do not affect the
> functionality of the patch.
>
> Best regards,
> Joschi Brauchle
>
Thank you for the careful review, Joschi.
An updated patch that fixes the two items pointed out above is attached.
-------------- next part --------------
>From 3ca483e48b5d20d44b43c4d6c8eeb5b255238263 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 9 Sep 2012 08:56:13 -0400
Subject: [PATCH] KRB5: Return PAM_AUTH_ERR on incorrect password
https://fedorahosted.org/sssd/ticket/1515
---
src/providers/krb5/krb5_child.c | 69 +++++++++++++++++++++++------------------
1 file changed, 39 insertions(+), 30 deletions(-)
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 08e525ce258e1b4bd9f529c97242b5859e65ea31..a049705abb5b4f659d0498f4a8448e307b054eee 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -728,6 +728,41 @@ done:
}
+static int kerr_handle_error(krb5_error_code kerr)
+{
+ int pam_status;
+
+ KRB5_DEBUG(1, kerr);
+ switch (kerr) {
+ case KRB5_KDC_UNREACH:
+ pam_status = PAM_AUTHINFO_UNAVAIL;
+ break;
+ case KRB5KDC_ERR_KEY_EXP:
+ pam_status = PAM_NEW_AUTHTOK_REQD;
+ break;
+ case KRB5KRB_AP_ERR_BAD_INTEGRITY:
+ pam_status = PAM_AUTH_ERR;
+ break;
+ case KRB5KDC_ERR_PREAUTH_FAILED:
+ pam_status = PAM_CRED_ERR;
+ break;
+ default:
+ pam_status = PAM_SYSTEM_ERR;
+ break;
+ }
+
+ return pam_status;
+}
+
+static int kerr_to_status(krb5_error_code kerr)
+{
+ if (kerr == 0) {
+ return PAM_SUCCESS;
+ }
+
+ return kerr_handle_error(kerr);;
+}
+
static errno_t changepw_child(int fd, struct krb5_req *kr)
{
int ret;
@@ -776,10 +811,7 @@ static errno_t changepw_child(int fd, struct krb5_req *kr)
changepw_princ,
kr->options);
if (kerr != 0) {
- KRB5_DEBUG(1, kerr);
- if (kerr == KRB5_KDC_UNREACH) {
- pam_status = PAM_AUTHINFO_UNAVAIL;
- }
+ pam_status = kerr_handle_error(kerr);
goto sendresponse;
}
@@ -866,12 +898,7 @@ static errno_t changepw_child(int fd, struct krb5_req *kr)
talloc_zfree(newpass_str);
memset(kr->pd->newauthtok, 0, kr->pd->newauthtok_size);
- if (kerr != 0) {
- KRB5_DEBUG(1, kerr);
- if (kerr == KRB5_KDC_UNREACH) {
- pam_status = PAM_AUTHINFO_UNAVAIL;
- }
- }
+ pam_status = kerr_to_status(kerr);
sendresponse:
ret = sendresponse(fd, kerr, pam_status, kr);
@@ -940,22 +967,7 @@ static errno_t tgt_req_child(int fd, struct krb5_req *kr)
talloc_zfree(pass_str);
memset(kr->pd->authtok, 0, kr->pd->authtok_size);
- if (kerr != 0) {
- KRB5_DEBUG(1, kerr);
- switch (kerr) {
- case KRB5_KDC_UNREACH:
- pam_status = PAM_AUTHINFO_UNAVAIL;
- break;
- case KRB5KDC_ERR_KEY_EXP:
- pam_status = PAM_NEW_AUTHTOK_REQD;
- break;
- case KRB5KDC_ERR_PREAUTH_FAILED:
- pam_status = PAM_CRED_ERR;
- break;
- default:
- pam_status = PAM_SYSTEM_ERR;
- }
- }
+ pam_status = kerr_to_status(kerr);
sendresponse:
ret = sendresponse(fd, kerr, pam_status, kr);
@@ -1029,10 +1041,7 @@ static errno_t renew_tgt_child(int fd, struct krb5_req *kr)
kerr = krb5_get_renewed_creds(kr->ctx, kr->creds, kr->princ, ccache, NULL);
if (kerr != 0) {
- KRB5_DEBUG(1, kerr);
- if (kerr == KRB5_KDC_UNREACH) {
- status = PAM_AUTHINFO_UNAVAIL;
- }
+ status = kerr_handle_error(kerr);
goto done;
}
--
1.7.11.4
More information about the sssd-devel
mailing list