Deleted Added
sdiff udiff text old ( 91094 ) new ( 91097 )
full compact
openpam_dispatch.c (91094) openpam_dispatch.c (91097)
1/*-
2 * Copyright (c) 2002 Networks Associates Technologies, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by ThinkSec AS and
6 * NAI Labs, the Security Research Division of Network Associates, Inc.
7 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
8 * DARPA CHATS research program.

--- 75 unchanged lines hidden (view full) ---

84 chain = pamh->chains[PAM_PASSWORD];
85 break;
86 default:
87 return (PAM_SYSTEM_ERR);
88 }
89
90 /* execute */
91 for (err = fail = 0; chain != NULL; chain = chain->next) {
1/*-
2 * Copyright (c) 2002 Networks Associates Technologies, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by ThinkSec AS and
6 * NAI Labs, the Security Research Division of Network Associates, Inc.
7 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
8 * DARPA CHATS research program.

--- 75 unchanged lines hidden (view full) ---

84 chain = pamh->chains[PAM_PASSWORD];
85 break;
86 default:
87 return (PAM_SYSTEM_ERR);
88 }
89
90 /* execute */
91 for (err = fail = 0; chain != NULL; chain = chain->next) {
92 openpam_log(PAM_LOG_DEBUG, "calling %s() in %s",
93 _pam_sm_func_name[primitive], chain->module->path);
92 if (chain->module->func[primitive] == NULL) {
93 openpam_log(PAM_LOG_ERROR, "%s: no %s()",
94 chain->module->path, _pam_sm_func_name[primitive]);
95 continue;
96 } else {
97 pamh->current = chain;
98 r = (chain->module->func[primitive])(pamh, flags,
99 chain->optc, (const char **)chain->optv);

--- 12 unchanged lines hidden (view full) ---

112 *
113 * Note that Solaris libpam does not terminate
114 * the chain here if a required module has
115 * previously failed. I'm not sure why.
116 */
117 if (chain->flag == PAM_SUFFICIENT &&
118 primitive != PAM_SM_SETCRED)
119 break;
94 if (chain->module->func[primitive] == NULL) {
95 openpam_log(PAM_LOG_ERROR, "%s: no %s()",
96 chain->module->path, _pam_sm_func_name[primitive]);
97 continue;
98 } else {
99 pamh->current = chain;
100 r = (chain->module->func[primitive])(pamh, flags,
101 chain->optc, (const char **)chain->optv);

--- 12 unchanged lines hidden (view full) ---

114 *
115 * Note that Solaris libpam does not terminate
116 * the chain here if a required module has
117 * previously failed. I'm not sure why.
118 */
119 if (chain->flag == PAM_SUFFICIENT &&
120 primitive != PAM_SM_SETCRED)
121 break;
122 continue;
120 }
121
122 _openpam_check_error_code(primitive, r);
123
124 /*
125 * Record the return code from the first module to
126 * fail. If a required module fails, record the
127 * return code from the first required module to fail.
128 */
129 if (err == 0)
130 err = r;
131 if (chain->flag == PAM_REQUIRED && !fail) {
123 }
124
125 _openpam_check_error_code(primitive, r);
126
127 /*
128 * Record the return code from the first module to
129 * fail. If a required module fails, record the
130 * return code from the first required module to fail.
131 */
132 if (err == 0)
133 err = r;
134 if (chain->flag == PAM_REQUIRED && !fail) {
135 openpam_log(PAM_LOG_DEBUG, "required module failed");
132 fail = 1;
133 err = r;
134 }
135
136 /*
137 * If a requisite module fails, terminate the chain
138 * immediately.
139 */
140 if (chain->flag == PAM_REQUISITE) {
136 fail = 1;
137 err = r;
138 }
139
140 /*
141 * If a requisite module fails, terminate the chain
142 * immediately.
143 */
144 if (chain->flag == PAM_REQUISITE) {
145 openpam_log(PAM_LOG_DEBUG, "requisite module failed");
141 fail = 1;
142 break;
143 }
144 }
145
146 fail = 1;
147 break;
148 }
149 }
150
146 return (fail ? err : PAM_SUCCESS);
151 if (!fail)
152 err = PAM_SUCCESS;
153 openpam_log(PAM_LOG_DEBUG, "returning: %s", pam_strerror(pamh, err));
154 return (err);
147}
148
149#if !defined(OPENPAM_RELAX_CHECKS)
150static void
151_openpam_check_error_code(int primitive, int r)
152{
153 /* common error codes */
155}
156
157#if !defined(OPENPAM_RELAX_CHECKS)
158static void
159_openpam_check_error_code(int primitive, int r)
160{
161 /* common error codes */
154 if (r == PAM_SERVICE_ERR ||
162 if (r == PAM_SUCCESS ||
163 r == PAM_SERVICE_ERR ||
155 r == PAM_BUF_ERR ||
164 r == PAM_BUF_ERR ||
156 r == PAM_BUF_ERR ||
157 r == PAM_CONV_ERR ||
165 r == PAM_CONV_ERR ||
158 r == PAM_PERM_DENIED)
166 r == PAM_PERM_DENIED ||
167 r == PAM_ABORT)
159 return;
160
161 /* specific error codes */
162 switch (primitive) {
163 case PAM_SM_AUTHENTICATE:
164 if (r == PAM_AUTH_ERR ||
165 r == PAM_CRED_INSUFFICIENT ||
166 r == PAM_AUTHINFO_UNAVAIL ||

--- 37 unchanged lines hidden --- 		168 return;
169
170 /* specific error codes */
171 switch (primitive) {
172 case PAM_SM_AUTHENTICATE:
173 if (r == PAM_AUTH_ERR ||
174 r == PAM_CRED_INSUFFICIENT ||
175 r == PAM_AUTHINFO_UNAVAIL ||

--- 37 unchanged lines hidden ---