Changeset 20 in openpam for trunk

Timestamp:

Feb 2, 2002, 6:22:20 PM (19 years ago)

Author:

Dag-Erling Smørgrav

Message:

Add a flag to struct pam_handle that openpam_dispatch() uses to
detect and prevent indirect recursion.
Fail immediately if the requested chain is empty.
If a module couldn't be loaded, or doesn't provide the requested
service, treat it as a normal failure instead of terminating the
chain. (Solaris actually ignores this condition!)

Sponsored by: DARPA, NAI Labs

Location:

trunk/lib

Files:

• openpam_dispatch.c (modified) (3 diffs)
• openpam_impl.h (modified) (1 diff)

trunk/lib/openpam_dispatch.c

@@ -62 +62 @@
                 return (PAM_SYSTEM_ERR);
 
+        /* prevent recursion */
+        if (pamh->dispatching) {
+                openpam_log(PAM_LOG_ERROR, "indirect recursion");
+                return (PAM_SYSTEM_ERR);
+        }
+        pamh->dispatching = 1;
+
+        /* pick a chain */
         switch (primitive) {
         case PAM_AUTHENTICATE:
@@ -78 +86 @@
                 break;
         default:
-                return (PAM_SYSTEM_ERR);
-        }
-
+                pamh->dispatching = 0;
+                return (PAM_SYSTEM_ERR);
+        }
+
+        /* fail if the chain is empty */
+        if (module == NULL)
+                return (PAM_SYSTEM_ERR);
+
+        /* execute */
         for (err = fail = 0; module != NULL; module = module->next) {
                 if (module->primitive[primitive] == NULL) {
                         openpam_log(PAM_LOG_ERROR, "%s: no %s()",
                             module->modpath, _pam_sm_func_name[primitive]);
-                        return (PAM_SYMBOL_ERR);
-                }
-                r = (module->primitive[primitive])(pamh, flags);
-                openpam_log(PAM_LOG_DEBUG, "%s: %s(): %s",
-                    module->modpath, _pam_sm_func_name[primitive],
-                    pam_strerror(pamh, r));
+                        pamh->dispatching = 0;
+                        r = PAM_SYMBOL_ERR;
+                } else {
+                        r = (module->primitive[primitive])(pamh, flags);
+                        openpam_log(PAM_LOG_DEBUG, "%s: %s(): %s",
+                            module->modpath, _pam_sm_func_name[primitive],
+                            pam_strerror(pamh, r));
+                }
 
                 if (r == PAM_IGNORE)
@@ -132 +148 @@
         }
 
-        if (fail)
-                return (err);
-        return (PAM_SUCCESS);
+        pamh->dispatching = 0;
+        return (fail ? err : PAM_SUCCESS);
 }
 

trunk/lib/openpam_impl.h

@@ -92 +92 @@
 struct pam_handle {
         char            *service;
+        int              dispatching;
 
         /* chains */