mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-08-08 09:21:48 +08:00
Nikos Mavrogiannopoulos
0dafa7b005
Add test-pam-abort, which verifies that pam_auth_deinit() correctly resumes a suspended PAM coroutine before calling pam_end(). The test posts a username-only HTTP request to trigger SEC_AUTH_INIT, leaving the PAM coroutine suspended in PAM_S_WAIT_FOR_PASS while the worker exits without sending a password. The stale pre-auth entry is cleaned up by the sec-mod maintenance cycle (driven by the new sec-mod-db-cleanup-time config knob, set to 3 s in the test config). Bug detection is provided by pam_abort_test.so, a small PAM module that registers a pam_set_data() cleanup which calls abort() if pam_end() fires while conv->conv() has not yet returned. Without the fix, sec-mod would abort and the subsequent authentication check would fail. Relates: #741 Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
5 lines
118 B
Plaintext
5 lines
118 B
Plaintext
#%PAM-1.0
|
|
auth required @PAM_ABORT_MOD@
|
|
account sufficient pam_permit.so
|
|
session sufficient pam_permit.so
|