netipmid: Make pam_auth configurable
Allow people to disable pam_authenticate if it is not working for their
system.
Tested:
Testing on a system with no dropbear and was able to pass the check.
Patch Tracking Bug: b/271637989
Upstream info / review:
https://gerrit.openbmc.org/c/openbmc/phosphor-net-ipmid/+/61424
Upstream-Status: Submitted
Justification: bugfix(b/271270364)
Google-Bug-Id: 271270364
Google-Bug-Id: 180749812
Change-Id: I028871a9d81a2fcd5f8ace8019a4a9ba92b5f740
Signed-off-by: Willy Tu <wltu@google.com>
(cherry picked from commit a7450ce08882109ea2479751bd53a189be521310)
diff --git a/recipes-phosphor/ipmi/phosphor-ipmi-net/0001-netipmid-Make-pam_auth-configurable.patch b/recipes-phosphor/ipmi/phosphor-ipmi-net/0001-netipmid-Make-pam_auth-configurable.patch
new file mode 100644
index 0000000..5220a43
--- /dev/null
+++ b/recipes-phosphor/ipmi/phosphor-ipmi-net/0001-netipmid-Make-pam_auth-configurable.patch
@@ -0,0 +1,81 @@
+From 3449db8ed153722fe34e36f7f5c9aa91377b435c Mon Sep 17 00:00:00 2001
+From: Willy Tu <wltu@google.com>
+Date: Fri, 3 Mar 2023 16:26:44 -0800
+Subject: [PATCH] netipmid: Make pam_auth configurable
+
+Allow people to disable pam_authenticate if it is not working for their
+system.
+
+Tested:
+Testing on a system with no dropbear and was able to pass the check.
+
+Patch Tracking Bug: b/271637989
+Upstream info / review:
+ https://gerrit.openbmc.org/c/openbmc/phosphor-net-ipmid/+/61424
+Upstream-Status: Submitted
+Justification: bugfix(b/271270364)
+
+Change-Id: I932830cd518b7f8ef6c828405b4959a8d14b1b58
+Signed-off-by: Willy Tu <wltu@google.com>
+---
+ command/rakp12.cpp | 4 ++++
+ meson.build | 1 +
+ meson_options.txt | 7 +++++++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/command/rakp12.cpp b/command/rakp12.cpp
+index c72611e..bcdcc35 100644
+--- a/command/rakp12.cpp
++++ b/command/rakp12.cpp
+@@ -1,3 +1,5 @@
++#include "config.h"
++
+ #include "rakp12.hpp"
+
+ #include "comm_module.hpp"
+@@ -204,6 +206,7 @@ std::vector<uint8_t> RAKP12(const std::vector<uint8_t>& inPayload,
+ logInvalidLoginRedfishEvent(message);
+ return outPayload;
+ }
++#ifdef PAM_AUTHENTICATE
+ // Check whether user is already locked for failed attempts
+ if (!ipmi::ipmiUserPamAuthenticate(userName, passwd))
+ {
+@@ -216,6 +219,7 @@ std::vector<uint8_t> RAKP12(const std::vector<uint8_t>& inPayload,
+ logInvalidLoginRedfishEvent(message);
+ return outPayload;
+ }
++#endif
+
+ uint8_t chNum = static_cast<uint8_t>(getInterfaceIndex());
+ // Get channel based access information
+diff --git a/meson.build b/meson.build
+index 05aa623..44eff6f 100644
+--- a/meson.build
++++ b/meson.build
+@@ -12,6 +12,7 @@ project(
+
+ conf_data = configuration_data()
+ conf_data.set('RMCP_PING', get_option('rmcp_ping').enabled())
++conf_data.set('PAM_AUTHENTICATE', get_option('pam_authenticate').enabled())
+
+ configure_file(output: 'config.h',
+ configuration: conf_data
+diff --git a/meson_options.txt b/meson_options.txt
+index 097dc52..bad5e62 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -11,3 +11,10 @@ option(
+ value: 'enabled',
+ description : 'Enable RMCP Ping support'
+ )
++
++option(
++ 'pam_authenticate',
++ type : 'feature',
++ value: 'enabled',
++ description : 'Enable Pam Authenticate'
++)
+--
+2.40.0.rc0.216.gc4246ad0f0-goog
+
diff --git a/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend b/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend
new file mode 100644
index 0000000..c8b3dd8
--- /dev/null
+++ b/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend
@@ -0,0 +1,5 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+
+EXTRA_OEMESON:append = " -Dpam_authenticate=disabled"
+
+SRC_URI:append = " file://0001-netipmid-Make-pam_auth-configurable.patch"
