[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: heimdal 1.0.2RC6

I would be happy if it didn't loop at all.  For the use cases I  
currently have the looping ought to be done at the application layer,  
not in Heimdal, but it might be easier to just re-run the app.  (E.g.  
login fails.  Just try to log in again.)  Does this make it easier?

I appreciate it that your code has not locked up my test card.  ;-)   
Since it's a prototype, I'm not even sure if I can get it replaced/ 

On Dec 13, 2007, at 12:30 PM, Love Hörnquist Åstrand wrote:

> Hello,
> Its the pkcs11 module in heimdal that distrusts passwords, the  
> reason is that I locked one too many card with looping code that  
> tries more the 3 times with wrong pin codes and thus locks the code.
> It should be made to handle the password/prompting better.
> Love
> 12 dec 2007 kl. 03.04 skrev Henry B. Hotz:
>> This is actually from RC5, but I suspect you haven't changed  
>> anything.
>> Adding a password to krb5_get_init_creds_opt_set_pkinit() seems to  
>> have no effect, at least when pkcs11 is used for the user cert.   
>> You *still* get prompted for the PIN by the library.  It looks  
>> like the password argument gets lost in the hx509 stuff somewhere  
>> between _krb5_pk_load_id() and p11_init_slot().  I believe some  
>> other code works around this by writing their own prompter  
>> function.  I'd rather that wasn't needed.
>> Breakpoint 1, krb5_prompter_posix (context=0x1100f50, data=0x0,  
>> name=0x0, banner=0x0, num_prompts=1, prompts=0xbffff4b8) at  
>> prompter_posix.c:48
>> 48          if (name)
>> (gdb) bt
>> #0  krb5_prompter_posix (context=0x1100f50, data=0x0, name=0x0,  
>> banner=0x0, num_prompts=1, prompts=0xbffff4b8) at prompter_posix.c:48
>> #1  0x00239c75 in hx_pass_prompter (data=0xbffff7f8,  
>> prompter=0xbffff55c) at pkinit.c:1415
>> #2  0x003ee458 in hx509_lock_prompt (lock=0x11033d0,  
>> prompt=0xbffff55c) at lock.c:206
>> #3  0x003ea611 in p11_get_session (context=0x1103330, p=0x1103080,  
>> slot=0x110a540, lock=0x11033d0, psession=0xbffff6d0) at ks_p11.c:433
>> #4  0x003ea3b4 in p11_init_slot (context=0x1103330, p=0x1103080,  
>> lock=0x11033d0, id=0, num=0, slot=0x110a540) at ks_p11.c:352
>> #5  0x003eb54a in p11_init (context=0x1103330, certs=0x1103040,  
>> data=0x1103048, flags=0, residue=0x1f9b "/Library/OpenSC/lib/ 
>> opensc-pkcs11.so", lock=0x11033d0) at ks_p11.c:909
>> #6  0x003e768c in hx509_certs_init (context=0x1103330, name=0x1f94  
>> "pkcs11:/Library/OpenSC/lib/opensc-pkcs11.so", flags=0,  
>> lock=0x11033d0, certs=0x1103318) at keyset.c:118
>> #7  0x00239e47 in _krb5_pk_load_id (context=0x1100f50,  
>> ret_id=0x11034d0, user_id=0x1f94 "pkcs11:/Library/OpenSC/lib/ 
>> opensc-pkcs11.so", anchor_id=0x11034f0 "FILE:/Library/ 
>> KerberosCerts/cacert.pem", chain_list=0x0, revoke_list=0x0,  
>> prompter=0x23d62a <krb5_prompter_posix>, prompter_data=0x0,  
>> password=0xbffffa75 "abc") at pkinit.c:1487
>> #8  0x0023aecb in krb5_get_init_creds_opt_set_pkinit  
>> (context=0x1100f50, opt=0x1103440, principal=0x1103430,  
>> user_id=0x1f94 "pkcs11:/Library/OpenSC/lib/opensc-pkcs11.so",  
>> x509_anchors=0x11034f0 "FILE:/Library/KerberosCerts/cacert.pem",  
>> pool=0x0, pki_revoke=0x0, flags=0, prompter=0x23d62a  
>> <krb5_prompter_posix>, prompter_data=0x0, password=0xbffffa75  
>> "abc") at pkinit.c:1973
>> #9  0x00001e06 in KLoginPrincipal (principal=0xbffffa5e  
>> "hotz@HOTZ.JPL.NASA.GOV", password=0xbffffa75 "abc") at ttest.c:51
>> #10 0x00001f26 in main (argc=3, argv=0xbffff998) at ttest.c:88
>> (gdb)
>> On Dec 9, 2007, at 8:35 AM, Love Hörnquist Åstrand wrote:
>>> Hello,
>>> There is now a 1.0.2RC6 on the snapshot on the ftp area (also mac  
>>> and ubuntu binaries).
>>> Will do a release of 1.0.2 in the middle of next week unless  
>>> something pops up.
>>> Love
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu