Attachment 296104 Details for Bug 435168 – pam_krb5-novalidate_on_cpw.patch <pbatkowski@redhat.com>

[patch] pam_krb5-novalidate_on_cpw.patch <pbatkowski@redhat.com>

pam_krb5-novalidate_on_cpw.patch (text/plain), 2.81 KB, created by Jose Plans on 2008-02-27 18:41:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jose Plans

Created: 2008-02-27 18:41:53 UTC

Size: 2.81 KB

patch

obsolete

>--- pam_krb5-1.79-1/pam_krb5afs.c.orig	2008-02-20 09:34:17.000000000 -0500
>+++ pam_krb5-1.79-1/pam_krb5afs.c	2008-02-20 09:34:17.000000000 -0500
>@@ -1756,6 +1756,7 @@ pam_sm_authenticate(pam_handle_t *pamh, 
> 	char *password = NULL;
> 	char *tmp = NULL;
> 	int krc, prc = PAM_SUCCESS;
>+	int in_passwd_change = FALSE;
> 	struct ret_stash *pret = NULL;
> 	struct stash *stash = NULL;
> 	char localname[LINE_MAX];
>@@ -2025,6 +2026,7 @@ pam_sm_authenticate(pam_handle_t *pamh, 
> 			/* If the key expired, attempt to get a password-
> 			 * changing credential. */
> 			if (krc == KRB5KDC_ERR_KEY_EXP) {
>+				in_passwd_change = TRUE;
> 				krc = krb5_get_init_creds_password(context,
> 								   &stash->v5_creds,
> 								   principal,
>@@ -2057,9 +2059,9 @@ pam_sm_authenticate(pam_handle_t *pamh, 
> 		}
> 	}
> 
>-	/* Verify that the TGT is good (i.e., that the reply wasn't spoofed). */
>+	/* Verify that the TGT is good (i.e., that the reply wasn't spoofed). Only do so if we're not doing a password change. */
> 	if (RC_OK) {
>-		if (config->validate && stash->have_v5_creds) {
>+		if (config->validate && stash->have_v5_creds && !in_passwd_change) {
> #ifdef HAVE_KRB5_VERIFY_INIT_CREDS
> 			krc = krb5_verify_init_creds(context,
> 						     &stash->v5_creds,
>@@ -2070,7 +2072,7 @@ pam_sm_authenticate(pam_handle_t *pamh, 
> 			if (krc == KRB5_SUCCESS) {
> 				INFO("TGT for %s successfully verified", user);
> 			} else {
>-				CRIT("TGT verification failed for `%s'");
>+				CRIT("TGT verification failed for `%s'", user);
> 			}
> #else
> #ifdef HAVE_KRB5_DECODE_TICKET
>@@ -3134,6 +3136,35 @@ pam_sm_chauthtok(pam_handle_t *pamh, int
> 									   &config->creds_opt);
> 					if (krc == PAM_SUCCESS) {
> 						DEBUG("obtained v5 TGT with new password");
>+
>+						/* Validate the TGS using the new password. */
>+						if (config->validate && stash->have_v5_creds) {
>+						#ifdef HAVE_KRB5_VERIFY_INIT_CREDS
>+									krc = krb5_verify_init_creds(context,
>+												     &stash->v5_creds,
>+												     NULL,
>+												     NULL,
>+												     NULL,
>+												     NULL);
>+									if (krc == KRB5_SUCCESS) {
>+										INFO("TGT for %s successfully verified", user);
>+									} else {
>+										CRIT("TGT verification failed for `%s'", user);
>+									}
>+						#else
>+						#ifdef HAVE_KRB5_DECODE_TICKET
>+									if (validate_tgt(user, context, config, stash) == 0) {
>+										prc = PAM_AUTH_ERR;
>+									} 
>+						#else
>+									CRIT("verification error: verification not available "
>+									     "because krb5_decode_ticket() not found at "
>+									     "compile-time");
>+									prc = PAM_AUTH_ERR;
>+						#endif
>+						#endif
>+						}
>+
> 						if (config->krb4_convert) {
> 							if (get_v4_tgt_conv(context, principal, NULL, &stash->v5_creds, config, &stash->v4_creds) != 0) {
> 								get_v4_tgt_init_v5(context, principal, authtok, config, &stash->v4_creds);

Actions: View | Diff

Attachments on bug 435168: 296104