svn rev #24425: trunk/src/ include/krb5/ lib/kadm5/ lib/kadm5/srv/

[ghudson@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24425
Commit By: ghudson
Log Message:
Add a name field to the pwqual plugin vtable and log pwqual module
rejections.



Changed Files:
U   trunk/src/include/krb5/pwqual_plugin.h
U   trunk/src/lib/kadm5/server_internal.h
U   trunk/src/lib/kadm5/srv/pwqual.c
U   trunk/src/lib/kadm5/srv/pwqual_dict.c
U   trunk/src/lib/kadm5/srv/pwqual_empty.c
U   trunk/src/lib/kadm5/srv/pwqual_hesiod.c
U   trunk/src/lib/kadm5/srv/pwqual_princ.c
U   trunk/src/lib/kadm5/srv/server_misc.c
Modified: trunk/src/include/krb5/pwqual_plugin.h
===================================================================
--- trunk/src/include/krb5/pwqual_plugin.h	2010-10-05 14:53:09 UTC (rev 24424)
+++ trunk/src/include/krb5/pwqual_plugin.h	2010-10-05 16:00:23 UTC (rev 24425)
@@ -100,6 +100,7 @@
 
 /* Password quality plugin vtable for major version 1. */
 typedef struct krb5_pwqual_vtable_st {
+    const char *name;           /* Mandatory: name of module. */
     krb5_pwqual_open_fn open;
     krb5_pwqual_check_fn check;
     krb5_pwqual_close_fn close;

Modified: trunk/src/lib/kadm5/server_internal.h
===================================================================
--- trunk/src/lib/kadm5/server_internal.h	2010-10-05 14:53:09 UTC (rev 24424)
+++ trunk/src/lib/kadm5/server_internal.h	2010-10-05 16:00:23 UTC (rev 24425)
@@ -172,6 +172,10 @@
 void
 k5_pwqual_free_handles(krb5_context context, pwqual_handle *handles);
 
+/* Return the name of a password quality plugin module. */
+const char *
+k5_pwqual_name(krb5_context context, pwqual_handle handle);
+
 /* Check a password using a password quality plugin module. */
 krb5_error_code
 k5_pwqual_check(krb5_context context, pwqual_handle handle,

Modified: trunk/src/lib/kadm5/srv/pwqual.c
===================================================================
--- trunk/src/lib/kadm5/srv/pwqual.c	2010-10-05 14:53:09 UTC (rev 24424)
+++ trunk/src/lib/kadm5/srv/pwqual.c	2010-10-05 16:00:23 UTC (rev 24425)
@@ -109,6 +109,12 @@
     free(handles);
 }
 
+const char *
+k5_pwqual_name(krb5_context context, pwqual_handle handle)
+{
+    return handle->vt.name;
+}
+
 krb5_error_code
 k5_pwqual_check(krb5_context context, pwqual_handle handle,
                 const char *password, const char *policy_name,

Modified: trunk/src/lib/kadm5/srv/pwqual_dict.c
===================================================================
--- trunk/src/lib/kadm5/srv/pwqual_dict.c	2010-10-05 14:53:09 UTC (rev 24424)
+++ trunk/src/lib/kadm5/srv/pwqual_dict.c	2010-10-05 16:00:23 UTC (rev 24425)
@@ -247,6 +247,7 @@
     if (maj_ver != 1)
         return KRB5_PLUGIN_VER_NOTSUPP;
     vt = (krb5_pwqual_vtable)vtable;
+    vt->name = "dict";
     vt->open = dict_open;
     vt->check = dict_check;
     vt->close = dict_close;

Modified: trunk/src/lib/kadm5/srv/pwqual_empty.c
===================================================================
--- trunk/src/lib/kadm5/srv/pwqual_empty.c	2010-10-05 14:53:09 UTC (rev 24424)
+++ trunk/src/lib/kadm5/srv/pwqual_empty.c	2010-10-05 16:00:23 UTC (rev 24425)
@@ -56,6 +56,7 @@
     if (maj_ver != 1)
         return KRB5_PLUGIN_VER_NOTSUPP;
     vt = (krb5_pwqual_vtable)vtable;
+    vt->name = "empty";
     vt->check = empty_check;
     return 0;
 }

Modified: trunk/src/lib/kadm5/srv/pwqual_hesiod.c
===================================================================
--- trunk/src/lib/kadm5/srv/pwqual_hesiod.c	2010-10-05 14:53:09 UTC (rev 24424)
+++ trunk/src/lib/kadm5/srv/pwqual_hesiod.c	2010-10-05 16:00:23 UTC (rev 24425)
@@ -128,6 +128,7 @@
     if (maj_ver != 1)
         return KRB5_PLUGIN_VER_NOTSUPP;
     vt = (krb5_pwqual_vtable)vtable;
+    vt->name = "hesiod";
     vt->check = hesiod_check;
     return 0;
 }

Modified: trunk/src/lib/kadm5/srv/pwqual_princ.c
===================================================================
--- trunk/src/lib/kadm5/srv/pwqual_princ.c	2010-10-05 14:53:09 UTC (rev 24424)
+++ trunk/src/lib/kadm5/srv/pwqual_princ.c	2010-10-05 16:00:23 UTC (rev 24425)
@@ -70,6 +70,7 @@
     if (maj_ver != 1)
         return KRB5_PLUGIN_VER_NOTSUPP;
     vt = (krb5_pwqual_vtable)vtable;
+    vt->name = "princ";
     vt->check = princ_check;
     return 0;
 }

Modified: trunk/src/lib/kadm5/srv/server_misc.c
===================================================================
--- trunk/src/lib/kadm5/srv/server_misc.c	2010-10-05 14:53:09 UTC (rev 24424)
+++ trunk/src/lib/kadm5/srv/server_misc.c	2010-10-05 16:00:23 UTC (rev 24425)
@@ -33,7 +33,9 @@
 #include    <kdb.h>
 #include    <ctype.h>
 #include    <pwd.h>
+#include    <syslog.h>
 #include    "server_internal.h"
+#include    <adm_proto.h>
 
 kadm5_ret_t
 adb_policy_init(kadm5_server_handle_t handle)
@@ -137,8 +139,19 @@
     }
     for (h = handle->qual_handles; *h != NULL; h++) {
         ret = k5_pwqual_check(handle->context, *h, password, polname, princ);
-        if (ret != 0)
+        if (ret != 0) {
+            const char *e = krb5_get_error_message(handle->context, ret);
+            const char *modname = k5_pwqual_name(handle->context, *h);
+            char *princname;
+            if (krb5_unparse_name(handle->context, princ, &princname) != 0)
+                princname = NULL;
+            krb5_klog_syslog(LOG_ERR, "password quality module %s rejected "
+                             "password for %s: %s", modname,
+                             princname ? princname : "(can't unparse)", e);
+            krb5_free_error_message(handle->context, e);
+            free(princname);
             return ret;
+        }
     }
     return 0;
 }