tree a2181882b587fdded70c269ed4264372aa10cd79
parent 4f9637fafd37b19c795367f79e4ea668de146553
author P Dheeraj Srujan Kumar <p.dheeraj.srujan.kumar@intel.com> 1626106679 +0530
committer Ed Tanous <ed@tanous.net> 1626740813 +0000

Restructure pam conversation function

Altered return values form the function. With the earlier
implementation, the function returned PAM_AUTH_ERR on failure scenarios
which is incorrect. Replaced PAM_AUTH_ERR with PAM_CONV_ERR and
PAM_BUF_ERR at respetive places.

Added a check for number of messages received by the conversation
function capped at PAM_MAX_NUM_MSG.

Added a check for password size, which is capped at PAM_MAX_RESP_SIZE
as the bytes in the password greater than this limit would be discarded
by PAM.

Though pam_response structure and response, which are dynamically
allocated by the pam conversation function are the responsibility of the
caller to free them, with the current implemention, there is a possibility of
memory leak when numMsg would be zero or if PAM_PROMPT_ECHO_OFF
message never arrived.
This commit fixes the possible memory leak by allocating only on
receiving PAM_PROMPT_ECHO_OFF message.

Tested:
 - Basic Authencation is functional.
 - POST on /redfish/v1/SessionService/Sessions was succesfull with
   the right credentials
 - POST on /redfish/v1/AccountService was successfull when the password
   was within the limit, and returned a failure when password length
   exceeded the limit.

Signed-off-by: P Dheeraj Srujan Kumar <p.dheeraj.srujan.kumar@intel.com>
Change-Id: Idfa41d94d5a01b62aec119f88cbdaab1523ad936