100 lines
3.7 KiB
Diff
100 lines
3.7 KiB
Diff
This is a cheap, non-very-portable way to make debugging a run-time option.
|
|
|
|
diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
|
|
index 6598482..85e1c0d 100644
|
|
--- a/src/plugins/preauth/pkinit/pkinit.h
|
|
+++ b/src/plugins/preauth/pkinit/pkinit.h
|
|
@@ -34,6 +34,7 @@
|
|
#include <krb5/krb5.h>
|
|
#include <krb5/preauth_plugin.h>
|
|
#include <k5-int-pkinit.h>
|
|
+#include <autoconf.h>
|
|
#include <profile.h>
|
|
#include "pkinit_accessor.h"
|
|
|
|
@@ -96,12 +97,15 @@ extern int longhorn; /* XXX Talking to a Longhorn server? */
|
|
#define pkiDebug printf
|
|
#else
|
|
/* Still evaluates for side effects. */
|
|
-static inline void pkiDebug (const char *fmt, ...) { }
|
|
+/* static inline void pkiDebug (const char *fmt, ...) { } */
|
|
+#define pkiDebug if (pkinit_debug_is_enabled()) printf
|
|
/* This is better if the compiler doesn't inline variadic functions
|
|
well, but gcc will warn about "left-hand operand of comma
|
|
expression has no effect". Still evaluates for side effects. */
|
|
/* #define pkiDebug (void) */
|
|
#endif
|
|
+extern void pkinit_debug_init(krb5_context context, krb5_data *realm, int kdc);
|
|
+extern int pkinit_debug_is_enabled(void);
|
|
|
|
/* Solaris compiler doesn't grok __FUNCTION__
|
|
* hack for now. Fix all the uses eventually. */
|
|
diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
|
|
index 6888c1b..bb39fce 100644
|
|
--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
|
|
+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
|
|
@@ -1002,6 +1002,8 @@ pkinit_client_process(krb5_context context,
|
|
pkinit_req_context reqctx = (pkinit_req_context)request_context;
|
|
krb5_keyblock *armor_key = NULL;
|
|
|
|
+ pkinit_debug_init(context, &(request->server->realm), 0);
|
|
+
|
|
pkiDebug("pkinit_client_process %p %p %p %p\n",
|
|
context, plgctx, reqctx, request);
|
|
|
|
diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c
|
|
index a6d7762..2b59fd0 100644
|
|
--- a/src/plugins/preauth/pkinit/pkinit_lib.c
|
|
+++ b/src/plugins/preauth/pkinit/pkinit_lib.c
|
|
@@ -452,3 +452,28 @@ print_buffer_bin(unsigned char *buf, unsigned int len, char *filename)
|
|
|
|
fclose(f);
|
|
}
|
|
+
|
|
+/* This is a cheat to avoid having to rewrite every caller of pkiDebug() to pass
|
|
+ in a context structure, which is where this flag would be better placed. */
|
|
+static __thread int pkinit_debug_enabled = 0;
|
|
+
|
|
+void
|
|
+pkinit_debug_init(krb5_context context, krb5_data *realm, int kdc)
|
|
+{
|
|
+ pkinit_debug_enabled = -1;
|
|
+ if (kdc) {
|
|
+ pkinit_kdcdefault_boolean(context, realm, "pkinit_debug",
|
|
+ -1, &pkinit_debug_enabled);
|
|
+ }
|
|
+ if (pkinit_debug_enabled == -1) {
|
|
+ pkinit_libdefault_boolean(context, realm, "pkinit_debug",
|
|
+ 0, &pkinit_debug_enabled);
|
|
+ }
|
|
+ printf("pkinit_debug: %d\n", pkinit_debug_enabled);
|
|
+}
|
|
+
|
|
+int
|
|
+pkinit_debug_is_enabled(void)
|
|
+{
|
|
+ return (pkinit_debug_enabled == 1);
|
|
+}
|
|
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
|
|
index 5a7a5ad..d7a0a44 100644
|
|
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
|
|
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
|
|
@@ -108,6 +108,8 @@ pkinit_server_get_edata(krb5_context context,
|
|
pkinit_kdc_context plgctx = NULL;
|
|
krb5_keyblock *armor_key = NULL;
|
|
|
|
+ pkinit_debug_init(context, &(request->server->realm), 1);
|
|
+
|
|
pkiDebug("pkinit_server_get_edata: entered!\n");
|
|
|
|
/* Remove (along with armor_key) when FAST PKINIT is settled. */
|
|
@@ -315,6 +317,8 @@ pkinit_server_verify_padata(krb5_context context,
|
|
int is_signed = 1;
|
|
krb5_keyblock *armor_key;
|
|
|
|
+ pkinit_debug_init(context, &(request->server->realm), 1);
|
|
+
|
|
pkiDebug("pkinit_verify_padata: entered!\n");
|
|
if (data == NULL || data->length <= 0 || data->contents == NULL)
|
|
return 0;
|