FreeBSD Bugzilla – Attachment 163286 Details for
Bug 204596
[NEW PORT] security/pam_pkcs11: PAM module with PKCS#11 token support
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Code changed upstream
pam_pkcs11.patch (text/plain), 16.62 KB, created by
Steve Vickruck
on 2015-11-18 10:12:36 UTC
(
hide
)
Description:
Code changed upstream
Filename:
MIME Type:
Creator:
Steve Vickruck
Created:
2015-11-18 10:12:36 UTC
Size:
16.62 KB
patch
obsolete
>diff -ruN ./pam_pkcs11/Makefile /work/ports/security/pam_pkcs11/Makefile >--- ./pam_pkcs11/Makefile 2015-11-16 14:04:51.493409496 +0000 >+++ /work/ports/security/pam_pkcs11/Makefile 2015-11-18 09:56:26.835949178 +0000 >@@ -3,6 +3,7 @@ > > PORTNAME= pam_pkcs11 > PORTVERSION= 0.6.8 >+PORTREVISION= 1 > CATEGORIES= security > > MAINTAINER= stevev@stevev.org >@@ -13,7 +14,7 @@ > USE_GITHUB= yes > GH_ACCOUNT= OpenSC > GH_PROJECT= pam_pkcs11 >-GH_TAGNAME= HEAD >+GH_TAGNAME= 8bdd819 > > MAKE_CMD= ${GMAKE} > >diff -ruN ./pam_pkcs11/distinfo /work/ports/security/pam_pkcs11/distinfo >--- ./pam_pkcs11/distinfo 2015-11-16 14:04:51.493409496 +0000 >+++ /work/ports/security/pam_pkcs11/distinfo 2015-11-18 09:51:50.357964948 +0000 >@@ -1,2 +1,2 @@ >-SHA256 (OpenSC-pam_pkcs11-0.6.8-HEAD_GH0.tar.gz) = 9e69d12d4cd551644c04e8a6bb62ef46e43671623ceba5f87d3ac61e00351d03 >-SIZE (OpenSC-pam_pkcs11-0.6.8-HEAD_GH0.tar.gz) = 263060 >+SHA256 (OpenSC-pam_pkcs11-0.6.8-8bdd819_GH0.tar.gz) = 1ed59886ff9c65dcb1d9910176e7a714ced6fa8b840a373276d7214601197e01 >+SIZE (OpenSC-pam_pkcs11-0.6.8-8bdd819_GH0.tar.gz) = 263449 >diff -ruN ./pam_pkcs11/files/patch-src_pam__pkcs11_Makefile.am /work/ports/security/pam_pkcs11/files/patch-src_pam__pkcs11_Makefile.am >--- ./pam_pkcs11/files/patch-src_pam__pkcs11_Makefile.am 2015-11-16 14:04:51.492407971 +0000 >+++ /work/ports/security/pam_pkcs11/files/patch-src_pam__pkcs11_Makefile.am 1970-01-01 01:00:00.000000000 +0100 >@@ -1,11 +0,0 @@ >---- src/pam_pkcs11/Makefile.am.orig 2015-11-10 16:34:19 UTC >-+++ src/pam_pkcs11/Makefile.am >-@@ -17,7 +17,7 @@ pam_pkcs11_la_SOURCES = pam_pkcs11.c \ >- pam_config.c pam_config.h >- pam_pkcs11_la_LDFLAGS = -module -avoid-version -shared \ >- -export-symbols-regex '^pam_' >--pam_pkcs11_la_LIBADD = ../mappers/libmappers.la $(CRYPTO_LIBS) >-+pam_pkcs11_la_LIBADD = ../mappers/libmappers.la @LTLIBINTL@ $(CRYPTO_LIBS) >- >- format: >- indent *.c *.h >diff -ruN ./pam_pkcs11/files/patch-src_pam__pkcs11_pam__pkcs11.c /work/ports/security/pam_pkcs11/files/patch-src_pam__pkcs11_pam__pkcs11.c >--- ./pam_pkcs11/files/patch-src_pam__pkcs11_pam__pkcs11.c 2015-11-16 14:04:51.491404630 +0000 >+++ /work/ports/security/pam_pkcs11/files/patch-src_pam__pkcs11_pam__pkcs11.c 1970-01-01 01:00:00.000000000 +0100 >@@ -1,337 +0,0 @@ >---- src/pam_pkcs11/pam_pkcs11.c.orig 2015-11-10 16:34:19 UTC >-+++ src/pam_pkcs11/pam_pkcs11.c >-@@ -29,6 +29,9 @@ >- #ifdef HAVE_SECURITY_PAM_EXT_H >- #include <security/pam_ext.h> >- #endif >-+#ifdef OPENPAM >-+#include <security/openpam.h> >-+#endif >- #include <syslog.h> >- #include <ctype.h> >- #include <string.h> >-@@ -57,6 +60,8 @@ >- #endif >- #define LOGNAME "PAM-PKCS11" /* name for log-file entries */ >- >-+static void pam_pkcs11_prompt(pam_handle_t *, int, char **, char *, ...); >-+ >- /* >- * comodity function that returns 1 on null, empty o spaced string >- */ >-@@ -68,7 +73,7 @@ static int is_spaced_str(const char *str >- return 1; >- } >- >--#ifndef HAVE_SECURITY_PAM_EXT_H >-+#if !defined(HAVE_SECURITY_PAM_EXT_H) && !defined(OPENPAM) >- /* >- * implement pam utilities for older versions of pam. >- */ >-@@ -108,7 +113,7 @@ static int pam_prompt(pam_handle_t *pamh >- free(&resp[0]); >- return PAM_SUCCESS; >- } >-- >-+#elif defined(OPENPAM) >- static void >- pam_syslog(pam_handle_t *pamh, int priority, const char *fmt, ...) >- { >-@@ -120,6 +125,17 @@ pam_syslog(pam_handle_t *pamh, int prior >- } >- #endif >- >-+static void pam_pkcs11_prompt(pam_handle_t *pamh, int style, char **response, char *fmt, ...) >-+{ >-+ char *resp = NULL; >-+ va_list ap; >-+ >-+ va_start(ap, fmt); >-+ pam_vprompt(pamh, style, &resp, fmt, ap); >-+ va_end(ap); >-+ >-+ free(resp); >-+} >- >- /* >- * Gets the users password. Depending whether it was already asked, either >-@@ -205,7 +221,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- textdomain(PACKAGE); >- #endif >- >-- pam_prompt(pamh, PAM_TEXT_INFO , NULL, _("Smartcard authentication starts")); >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO , NULL, _("Smartcard authentication starts")); >- >- /* first of all check whether debugging should be enabled */ >- for (i = 0; i < argc; i++) >-@@ -293,7 +309,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- } else { >- rv = pam_get_item(pamh, PAM_USER, &user); >- if (rv != PAM_SUCCESS || user == NULL || user[0] == '\0') { >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, >- _("Please insert your %s or enter your username."), >- _(configuration->token_type)); >- /* get user name */ >-@@ -324,7 +340,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "load_pkcs11_module() failed loading %s: %s", >- configuration->pkcs11_modulepath, get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2302: PKCS#11 module failed loading")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2302: PKCS#11 module failed loading")); >- sleep(configuration->err_display_time); >- } >- return PAM_AUTHINFO_UNAVAIL; >-@@ -338,7 +354,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("init_pkcs11_module() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "init_pkcs11_module() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2304: PKCS#11 module could not be initialized")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2304: PKCS#11 module could not be initialized")); >- sleep(configuration->err_display_time); >- } >- return PAM_AUTHINFO_UNAVAIL; >-@@ -357,7 +373,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR("no suitable token available"); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "no suitable token available"); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2306: No suitable token available")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2306: No suitable token available")); >- sleep(configuration->err_display_time); >- } >- >-@@ -370,11 +386,11 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- * or because we used one to log in */ >- if (login_token_name || configuration->wait_for_card) { >- if (login_token_name) { >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, >- _("Please insert your smart card called \"%.32s\"."), >- login_token_name); >- } else { >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, >- _("Please insert your smart card.")); >- } >- >-@@ -392,7 +408,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- } >- } else if (user) { >- if (!configuration->quiet) { >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2308: No smartcard found")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2308: No smartcard found")); >- sleep(configuration->err_display_time); >- } >- >-@@ -402,7 +418,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- } else { >- /* we haven't prompted for the user yet, get the user and see if >- * the smart card has been inserted in the mean time */ >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, >- _("Please insert your %s or enter your username."), >- _(configuration->token_type)); >- rv = pam_get_user(pamh, &user, NULL); >-@@ -419,7 +435,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- if (rv != 0) { >- /* user gave us a user id and no smart card go to next module */ >- if (!configuration->quiet) { >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2310: No smartcard found")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2310: No smartcard found")); >- sleep(configuration->err_display_time); >- } >- >-@@ -428,7 +444,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- } >- } >- } else { >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, >- _("%s found."), _(configuration->token_type)); >- } >- rv = open_pkcs11_session(ph, slot_num); >-@@ -436,7 +452,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("open_pkcs11_session() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "open_pkcs11_session() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2312: open PKCS#11 session failed")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2312: open PKCS#11 session failed")); >- sleep(configuration->err_display_time); >- } >- release_pkcs11_module(ph); >-@@ -448,14 +464,14 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("get_slot_login_required() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "get_slot_login_required() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2314: Slot login failed")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2314: Slot login failed")); >- sleep(configuration->err_display_time); >- } >- release_pkcs11_module(ph); >- return pkcs11_pam_fail; >- } else if (rv) { >- /* get password */ >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, >- _("Welcome %.32s!"), get_slot_tokenlabel(ph)); >- >- /* no CKF_PROTECTED_AUTHENTICATION_PATH */ >-@@ -475,7 +491,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- } >- if (rv != PAM_SUCCESS) { >- if (!configuration->quiet) { >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2316: password could not be read")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2316: password could not be read")); >- sleep(configuration->err_display_time); >- } >- release_pkcs11_module(ph); >-@@ -495,7 +511,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- pam_syslog(pamh, LOG_ERR, >- "password length is zero but the 'nullok' argument was not defined."); >- if (!configuration->quiet) { >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2318: Empty smartcard PIN not allowed.")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2318: Empty smartcard PIN not allowed.")); >- sleep(configuration->err_display_time); >- } >- return PAM_AUTH_ERR; >-@@ -503,7 +519,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- } >- else >- { >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, >- _("Enter your %s PIN on the pinpad"), _(configuration->token_type)); >- /* use pin pad */ >- password = NULL; >-@@ -523,7 +539,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("open_pkcs11_login() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "open_pkcs11_login() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2320: Wrong smartcard PIN")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2320: Wrong smartcard PIN")); >- sleep(configuration->err_display_time); >- } >- goto auth_failed_nopw; >-@@ -535,7 +551,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("get_certificate_list() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "get_certificate_list() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2322: No certificate found")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2322: No certificate found")); >- sleep(configuration->err_display_time); >- } >- goto auth_failed_nopw; >-@@ -550,7 +566,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- if (!x509 ) continue; /* sanity check */ >- DBG1("verifying the certificate #%d", i + 1); >- if (!configuration->quiet) { >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, _("verifying certificate")); >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, _("verifying certificate")); >- } >- >- /* verify certificate (date, signature, CRL, ...) */ >-@@ -562,19 +578,19 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- "verify_certificate() failed: %s", get_error()); >- switch (rv) { >- case -2: // X509_V_ERR_CERT_HAS_EXPIRED: >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, >- _("Error 2324: Certificate has expired")); >- break; >- case -3: // X509_V_ERR_CERT_NOT_YET_VALID: >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, >- _("Error 2326: Certificate not yet valid")); >- break; >- case -4: // X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, >- _("Error 2328: Certificate signature invalid")); >- break; >- default: >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, >- _("Error 2330: Certificate invalid")); >- break; >- } >-@@ -610,7 +626,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, >- "pam_set_item() failed %s", pam_strerror(pamh, rv)); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2332: setting PAM userentry failed")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2332: setting PAM userentry failed")); >- sleep(configuration->err_display_time); >- } >- goto auth_failed_nopw; >-@@ -626,7 +642,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("match_user() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "match_user() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2334: No matching user")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2334: No matching user")); >- sleep(configuration->err_display_time); >- } >- goto auth_failed_nopw; >-@@ -647,7 +663,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, >- "no valid certificate which meets all requirements found"); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2336: No matching certificate found")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2336: No matching certificate found")); >- sleep(configuration->err_display_time); >- } >- goto auth_failed_nopw; >-@@ -656,7 +672,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- >- /* if signature check is enforced, generate random data, sign and verify */ >- if (configuration->policy.signature_policy) { >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, _("Checking signature")); >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, _("Checking signature")); >- >- >- #ifdef notdef >-@@ -676,7 +692,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("get_random_value() failed: %s", get_error()); >- if (!configuration->quiet){ >- pam_syslog(pamh, LOG_ERR, "get_random_value() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2338: Getting random value failed")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2338: Getting random value failed")); >- sleep(configuration->err_display_time); >- } >- goto auth_failed_nopw; >-@@ -690,7 +706,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("sign_value() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "sign_value() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2340: Signing failed")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2340: Signing failed")); >- sleep(configuration->err_display_time); >- } >- goto auth_failed_nopw; >-@@ -709,7 +725,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("verify_signature() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "verify_signature() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2342: Verifying signature failed")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, _("Error 2342: Verifying signature failed")); >- sleep(configuration->err_display_time); >- } >- return PAM_AUTH_ERR; >-@@ -790,7 +806,7 @@ PAM_EXTERN int pam_sm_authenticate(pam_h >- ERR1("close_pkcs11_session() failed: %s", get_error()); >- if (!configuration->quiet) { >- pam_syslog(pamh, LOG_ERR, "close_pkcs11_module() failed: %s", get_error()); >-- pam_prompt(pamh, PAM_ERROR_MSG , NULL, ("Error 2344: Closing PKCS#11 session failed")); >-+ pam_pkcs11_prompt(pamh, PAM_ERROR_MSG , NULL, ("Error 2344: Closing PKCS#11 session failed")); >- sleep(configuration->err_display_time); >- } >- return pkcs11_pam_fail; >-@@ -855,7 +871,7 @@ PAM_EXTERN int pam_sm_chauthtok(pam_hand >- >- login_token_name = getenv("PKCS11_LOGIN_TOKEN_NAME"); >- if (login_token_name && (flags & PAM_PRELIM_CHECK)) { >-- pam_prompt(pamh, PAM_TEXT_INFO, NULL, >-+ pam_pkcs11_prompt(pamh, PAM_TEXT_INFO, NULL, >- _("Cannot change the password on your smart card.")); >- } >- return PAM_SERVICE_ERR;
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 204596
:
163191
|
163194
|
163195
|
163286
|
165395