From c5c6ba2546d350a7a01a9f44bb5df9c6652a1e06 Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Mon, 8 May 2017 16:02:36 +0200

Subject: [PATCH 157/160] add_pam_cert_response: add support for

 SSS_PAM_CERT_INFO_WITH_HINT

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Related to https://pagure.io/SSSD/sssd/issue/3395

Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

(cherry picked from commit 6073cfc40747cd6d3142f0f98b880fc390dd7aad)

---

 src/responder/pam/pamsrv.h     |  2 +-

 src/responder/pam/pamsrv_cmd.c |  3 ++-

 src/responder/pam/pamsrv_p11.c | 21 +++++++++++++++------

 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/src/responder/pam/pamsrv.h b/src/responder/pam/pamsrv.h

index b569748fe2a2005cee5df34bef55e803175492a9..57a37b72594f030995f5e22255eb7a8fcd63d10e 100644

--- a/src/responder/pam/pamsrv.h

+++ b/src/responder/pam/pamsrv.h

@@ -101,7 +101,7 @@ errno_t pam_check_cert_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,

 errno_t add_pam_cert_response(struct pam_data *pd, const char *user,

                               const char *token_name, const char *module_name,

-                              const char *key_id);

+                              const char *key_id, enum response_type type);

 bool may_do_cert_auth(struct pam_ctx *pctx, struct pam_data *pd);

diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c

index 36dba37964b71153435b4df5d5328de4361926e6..080cfafa709d63542fbf57d26fab11f0a367dea7 100644

--- a/src/responder/pam/pamsrv_cmd.c

+++ b/src/responder/pam/pamsrv_cmd.c

@@ -1846,7 +1846,8 @@ static void pam_dom_forwarder(struct pam_auth_req *preq)

                     ret = add_pam_cert_response(preq->pd, cert_user,

                                                 preq->token_name,

                                                 preq->module_name,

-                                                preq->key_id);

+                                                preq->key_id,

+                                                SSS_PAM_CERT_INFO);

                     if (ret != EOK) {

                         DEBUG(SSSDBG_OP_FAILURE, "add_pam_cert_response failed.\n");

                         preq->pd->pam_status = PAM_AUTHINFO_UNAVAIL;

diff --git a/src/responder/pam/pamsrv_p11.c b/src/responder/pam/pamsrv_p11.c

index 365300b9075983b603a6f9e91ba6f8f21706388f..4dce43800c3c6b026c545df35c846269cbb49610 100644

--- a/src/responder/pam/pamsrv_p11.c

+++ b/src/responder/pam/pamsrv_p11.c

@@ -580,7 +580,7 @@ errno_t pam_check_cert_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,

 errno_t add_pam_cert_response(struct pam_data *pd, const char *sysdb_username,

                               const char *token_name, const char *module_name,

-                              const char *key_id)

+                              const char *key_id, enum response_type type)

 {

     uint8_t *msg = NULL;

     char *env = NULL;

@@ -590,14 +590,23 @@ errno_t add_pam_cert_response(struct pam_data *pd, const char *sysdb_username,

     size_t module_len;

     size_t key_id_len;

     int ret;

+    const char *username = "";

-    if (sysdb_username == NULL || token_name == NULL || module_name == NULL

-            || key_id == NULL) {

+    if (type != SSS_PAM_CERT_INFO && type != SSS_PAM_CERT_INFO_WITH_HINT) {

+        DEBUG(SSSDBG_CRIT_FAILURE, "Invalid response type [%d].\n", type);

+        return EINVAL;

+    }

+

+    if ((type == SSS_PAM_CERT_INFO && sysdb_username == NULL)

+            || token_name == NULL || module_name == NULL || key_id == NULL) {

         DEBUG(SSSDBG_CRIT_FAILURE, "Missing mandatory user or slot name.\n");

         return EINVAL;

     }

-    user_len = strlen(sysdb_username) + 1;

+    if (sysdb_username != NULL) {

+        username = sysdb_username;

+    }

+    user_len = strlen(username) + 1;

     slot_len = strlen(token_name) + 1;

     module_len = strlen(module_name) + 1;

     key_id_len = strlen(key_id) + 1;

@@ -616,12 +625,12 @@ errno_t add_pam_cert_response(struct pam_data *pd, const char *sysdb_username,

      * re_expression config option was set in a way that user@domain cannot be

      * handled anymore some more logic has to be added here. But for the time

      * being I think using sysdb_username is fine. */

-    memcpy(msg, sysdb_username, user_len);

+    memcpy(msg, username, user_len);

     memcpy(msg + user_len, token_name, slot_len);

     memcpy(msg + user_len + slot_len, module_name, module_len);

     memcpy(msg + user_len + slot_len + module_len, key_id, key_id_len);

-    ret = pam_add_response(pd, SSS_PAM_CERT_INFO, msg_len, msg);

+    ret = pam_add_response(pd, type, msg_len, msg);

     talloc_free(msg);

     if (ret != EOK) {

         DEBUG(SSSDBG_OP_FAILURE,

-- 

2.9.4