Vendor import of OpenPAM Celandine.

svn path=/vendor/openpam/dist/; revision=91684 svn path=/vendor/openpam/CELANDINE/; revision=91686; tag=vendor/openpam/CELANDINE
2002-03-05 13:49:56 +00:00 · 2002-03-05 13:49:56 +00:00 · 4579d22cac · 2020-12-20 02:59:44 +00:00
commit 4579d22cac
parent 46acc37026
113 changed files with 324 additions and 188 deletions
--- a/contrib/openpam/HISTORY
+++ b/contrib/openpam/HISTORY
@ -1,3 +1,26 @@
+============================================================================
+OpenPAM	Celandine						2002-03-05
+
+ - BUGFIX: PAM_TRY_AGAIN is a valid return value for pam_chauthtok().
+
+ - BUGFIX: Run passwd chain twice, first with the PAM_PRELIM_CHECK
+   flag set, then with the PAM_UPDATE_AUTHTOK flag set.
+
+ - BUGFIX: Failure of a "sufficient" module should not terminate the
+   passwd chain if the PAM_PRELIM_CHECK flag is set.
+
+ - BUGFIX: Clear PAM_AUTHTOK after running the service modules.
+
+ - ENHANCE: Prevent applications from specifying the PAM_PRELIM_CHECK
+   or PAM_UPDATE_AUTHTOK flags themselves.
+
+ - BUGFIX: openpam_set_option() did not support changing the value of
+   an existing option.
+
+ - ENHANCE: Add support for module versioning.  OpenPAM will prefer a
+   module with the same version number as the library itself to one
+   with no version number at all.
+
 ============================================================================
 OpenPAM	Cantaloupe						2002-02-22

@ -44,4 +67,4 @@ OpenPAM	Calamite						2002-02-09

 First (beta) release.
 ============================================================================
-$Id$
+$P4: //depot/projects/openpam/HISTORY#5 $
--- a/contrib/openpam/INSTALL
+++ b/contrib/openpam/INSTALL
@ -22,4 +22,4 @@
 
  Change into the top-level OpenPAM directory and run 'make install'.

-$Id$
+$P4: //depot/projects/openpam/INSTALL#2 $
--- a/contrib/openpam/LICENSE
+++ b/contrib/openpam/LICENSE
@ -31,4 +31,4 @@ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGE.

-$Id$
+$P4: //depot/projects/openpam/LICENSE#3 $
--- a/contrib/openpam/MANIFEST
+++ b/contrib/openpam/MANIFEST
@ -1,3 +1,6 @@
+#
+# $P4: //depot/projects/openpam/MANIFEST#5 $
+#
 HISTORY
 INSTALL
 LICENSE
@ -53,6 +56,7 @@ include/security/pam_modules.h
 include/security/pam_types.h
 lib/Makefile
 lib/openpam_dispatch.c
+lib/openpam_dynamic.c
 lib/openpam_findenv.c
 lib/openpam_get_option.c
 lib/openpam_impl.h
--- a/contrib/openpam/Makefile
+++ b/contrib/openpam/Makefile
@ -31,7 +31,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $Id$
+# $P4: //depot/projects/openpam/Makefile#5 $
 #

 SUBDIR		 =
--- a/contrib/openpam/README
+++ b/contrib/openpam/README
@ -27,4 +27,4 @@ These are some of OpenPAM's features:
     future release.Please direct bug reports and inquiries to
     openpam@thinksec.com.

-$Id$
+$P4: //depot/projects/openpam/README#2 $
--- a/contrib/openpam/RELNOTES
+++ b/contrib/openpam/RELNOTES
@ -1,6 +1,6 @@

-		 Release notes for OpenPAM Cantaloupe
-		 ====================================
+		 Release notes for OpenPAM Celandine
+		 ===================================

 This is a beta release.

@ -17,7 +17,4 @@ Known issues:

  - The documentation is still incomplete.

-Oh, and the previous release's code name was misspelled - egg on my
-face!  It should have been "Calliopsis".
-
-$Id$
+$P4: //depot/projects/openpam/RELNOTES#5 $
--- a/contrib/openpam/bin/Makefile
+++ b/contrib/openpam/bin/Makefile
@ -31,7 +31,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $Id$
+# $P4: //depot/projects/openpam/bin/Makefile#4 $
 #

 SUBDIR		 =
--- a/contrib/openpam/bin/su/Makefile
+++ b/contrib/openpam/bin/su/Makefile
@ -31,7 +31,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $Id$
+# $P4: //depot/projects/openpam/bin/su/Makefile#3 $
 #

 PROG		 = su
--- a/contrib/openpam/bin/su/su.c
+++ b/contrib/openpam/bin/su/su.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/bin/su/su.c#4 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/doc/Makefile
+++ b/contrib/openpam/doc/Makefile
@ -31,7 +31,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $Id$
+# $P4: //depot/projects/openpam/doc/Makefile#2 $
 #

 SUBDIR		 =
--- a/contrib/openpam/doc/man/Makefile
+++ b/contrib/openpam/doc/man/Makefile
@ -31,7 +31,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $Id$
+# $P4: //depot/projects/openpam/doc/man/Makefile#4 $
 #

 MAN		 =
--- a/contrib/openpam/doc/man/openpam_get_option.3
+++ b/contrib/openpam/doc/man/openpam_get_option.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/openpam_get_option.3#3 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt OPENPAM_GET_OPTION 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/openpam_log.3
+++ b/contrib/openpam/doc/man/openpam_log.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/openpam_log.3#4 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt OPENPAM_LOG 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/openpam_set_option.3
+++ b/contrib/openpam/doc/man/openpam_set_option.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/openpam_set_option.3#3 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt OPENPAM_SET_OPTION 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/openpam_ttyconv.3
+++ b/contrib/openpam/doc/man/openpam_ttyconv.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/openpam_ttyconv.3#4 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt OPENPAM_TTYCONV 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam.3
+++ b/contrib/openpam/doc/man/pam.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam.3#10 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_acct_mgmt.3
+++ b/contrib/openpam/doc/man/pam_acct_mgmt.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_acct_mgmt.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_ACCT_MGMT 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_authenticate.3
+++ b/contrib/openpam/doc/man/pam_authenticate.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_authenticate.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_AUTHENTICATE 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_chauthtok.3
+++ b/contrib/openpam/doc/man/pam_chauthtok.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_chauthtok.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_CHAUTHTOK 3
 .Os
 .Sh NAME
@ -70,8 +70,12 @@ Conversation failure.
 Permission denied.
 .It Bq Er PAM_SERVICE_ERR
 Error in service module.
+.It Bq Er PAM_SYMBOL_ERR
+Invalid symbol.
 .It Bq Er PAM_SYSTEM_ERR
 System error.
+.It Bq Er PAM_TRY_AGAIN
+Try again.
 .El
 .Sh SEE ALSO
 .Xr pam 3 ,
--- a/contrib/openpam/doc/man/pam_close_session.3
+++ b/contrib/openpam/doc/man/pam_close_session.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_close_session.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_CLOSE_SESSION 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_end.3
+++ b/contrib/openpam/doc/man/pam_end.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_end.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_END 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_error.3
+++ b/contrib/openpam/doc/man/pam_error.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_error.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_ERROR 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_get_authtok.3
+++ b/contrib/openpam/doc/man/pam_get_authtok.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_get_authtok.3#9 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_GET_AUTHTOK 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_get_data.3
+++ b/contrib/openpam/doc/man/pam_get_data.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_get_data.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_GET_DATA 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_get_item.3
+++ b/contrib/openpam/doc/man/pam_get_item.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_get_item.3#9 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_GET_ITEM 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_get_user.3
+++ b/contrib/openpam/doc/man/pam_get_user.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_get_user.3#9 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_GET_USER 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_getenv.3
+++ b/contrib/openpam/doc/man/pam_getenv.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_getenv.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_GETENV 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_getenvlist.3
+++ b/contrib/openpam/doc/man/pam_getenvlist.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_getenvlist.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_GETENVLIST 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_info.3
+++ b/contrib/openpam/doc/man/pam_info.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_info.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_INFO 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_open_session.3
+++ b/contrib/openpam/doc/man/pam_open_session.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_open_session.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_OPEN_SESSION 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_prompt.3
+++ b/contrib/openpam/doc/man/pam_prompt.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_prompt.3#9 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_PROMPT 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_putenv.3
+++ b/contrib/openpam/doc/man/pam_putenv.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_putenv.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_PUTENV 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_set_data.3
+++ b/contrib/openpam/doc/man/pam_set_data.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_set_data.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SET_DATA 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_set_item.3
+++ b/contrib/openpam/doc/man/pam_set_item.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_set_item.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SET_ITEM 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_setcred.3
+++ b/contrib/openpam/doc/man/pam_setcred.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_setcred.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SETCRED 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_setenv.3
+++ b/contrib/openpam/doc/man/pam_setenv.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_setenv.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SETENV 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_sm_acct_mgmt.3
+++ b/contrib/openpam/doc/man/pam_sm_acct_mgmt.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_sm_acct_mgmt.3#4 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SM_ACCT_MGMT 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_sm_authenticate.3
+++ b/contrib/openpam/doc/man/pam_sm_authenticate.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_sm_authenticate.3#4 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SM_AUTHENTICATE 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_sm_chauthtok.3
+++ b/contrib/openpam/doc/man/pam_sm_chauthtok.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_sm_chauthtok.3#4 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SM_CHAUTHTOK 3
 .Os
 .Sh NAME
@ -80,6 +80,8 @@ Permission denied.
 Error in service module.
 .It Bq Er PAM_SYSTEM_ERR
 System error.
+.It Bq Er PAM_TRY_AGAIN
+Try again.
 .El
 .Sh SEE ALSO
 .Xr pam 3 ,
--- a/contrib/openpam/doc/man/pam_sm_close_session.3
+++ b/contrib/openpam/doc/man/pam_sm_close_session.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_sm_close_session.3#4 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SM_CLOSE_SESSION 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_sm_open_session.3
+++ b/contrib/openpam/doc/man/pam_sm_open_session.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_sm_open_session.3#4 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SM_OPEN_SESSION 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_sm_setcred.3
+++ b/contrib/openpam/doc/man/pam_sm_setcred.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_sm_setcred.3#4 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_SM_SETCRED 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_start.3
+++ b/contrib/openpam/doc/man/pam_start.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_start.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_START 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_strerror.3
+++ b/contrib/openpam/doc/man/pam_strerror.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_strerror.3#8 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_STRERROR 3
 .Os
 .Sh NAME
--- a/contrib/openpam/doc/man/pam_verror.3
+++ b/contrib/openpam/doc/man/pam_verror.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_verror.3#6 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_VERROR 3
 .Os
 .Sh NAME
@ -51,8 +51,7 @@ The
 function passes its arguments to
 .Xr pam_vprompt 3
 with a
-.Xr style 3
-argument of
+style argument of
 .Dv PAM_ERROR_MSG ,
 and discards the response.
 .Pp
@ -69,7 +68,6 @@ Conversation failure.
 System error.
 .El
 .Sh SEE ALSO
-.Xr  3 ,
 .Xr pam 3 ,
 .Xr pam_error 3 ,
 .Xr pam_strerror 3 ,
--- a/contrib/openpam/doc/man/pam_vinfo.3
+++ b/contrib/openpam/doc/man/pam_vinfo.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_vinfo.3#6 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_VINFO 3
 .Os
 .Sh NAME
@ -51,8 +51,7 @@ The
 function passes its arguments to
 .Xr pam_vprompt 3
 with a
-.Xr style 3
-argument of
+style argument of
 .Dv PAM_TEXT_INFO ,
 and discards the response.
 .Pp
@ -69,7 +68,6 @@ Conversation failure.
 System error.
 .El
 .Sh SEE ALSO
-.Xr  3 ,
 .Xr pam 3 ,
 .Xr pam_info 3 ,
 .Xr pam_strerror 3 ,
--- a/contrib/openpam/doc/man/pam_vprompt.3
+++ b/contrib/openpam/doc/man/pam_vprompt.3
@ -31,9 +31,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $Id$
+.\" $P4: //depot/projects/openpam/doc/man/pam_vprompt.3#6 $
 .\"
-.Dd February 22, 2002
+.Dd March 5, 2002
 .Dt PAM_VPROMPT 3
 .Os
 .Sh NAME
--- a/contrib/openpam/include/security/openpam.h
+++ b/contrib/openpam/include/security/openpam.h
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/include/security/openpam.h#11 $
 */

 #ifndef _SECURITY_OPENPAM_H_INCLUDED
@ -177,7 +177,7 @@ typedef int (*pam_func_t)(struct pam_handle *, int, int, const char **);
 */
 typedef struct pam_module pam_module_t;
 struct pam_module {
-	const char	*path;
+	char		*path;
 	pam_func_t	 func[PAM_NUM_PRIMITIVES];
 	void		*dlh;
 	int		 refcount;
@ -201,7 +201,8 @@ struct pam_module {
 #define OPENPAM_STATIC_MODULES
 #define PAM_EXTERN static
 #define PAM_MODULE_ENTRY(name)						\
-static struct pam_module _pam_module = { name PAM_SOEXT, {		\
+static char _pam_name[] = name PAM_SOEXT;				\
+static struct pam_module _pam_module = { _pam_name, {			\
    pam_sm_authenticate, pam_sm_setcred, pam_sm_acct_mgmt,		\
    pam_sm_open_session, pam_sm_close_session, pam_sm_chauthtok },	\
    NULL, 0, NULL, NULL };						\
--- a/contrib/openpam/include/security/pam_appl.h
+++ b/contrib/openpam/include/security/pam_appl.h
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/include/security/pam_appl.h#8 $
 */

 #ifndef _PAM_APPL_H_INCLUDED
--- a/contrib/openpam/include/security/pam_constants.h
+++ b/contrib/openpam/include/security/pam_constants.h
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/include/security/pam_constants.h#10 $
 */

 #ifndef _PAM_CONSTANTS_H_INCLUDED
--- a/contrib/openpam/include/security/pam_modules.h
+++ b/contrib/openpam/include/security/pam_modules.h
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/include/security/pam_modules.h#5 $
 */

 #ifndef _PAM_MODULES_H_INCLUDED
--- a/contrib/openpam/include/security/pam_types.h
+++ b/contrib/openpam/include/security/pam_types.h
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/include/security/pam_types.h#4 $
 */

 #ifndef _PAM_TYPES_H_INCLUDED
--- a/contrib/openpam/lib/Makefile
+++ b/contrib/openpam/lib/Makefile
@ -31,7 +31,7 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $Id$
+# $P4: //depot/projects/openpam/lib/Makefile#11 $
 #

 LIB		 = pam
@ -41,9 +41,11 @@ SHLIB_MINOR	 = 0
 WARNS		?= 4
 NO_WERROR	 = yes
 CFLAGS		+= -I${.CURDIR}/../include
+CFLAGS		+= -DLIB_MAJ=${SHLIB_MAJOR}

 SRCS		 =
 SRCS		+= openpam_dispatch.c
+SRCS		+= openpam_dynamic.c
 SRCS		+= openpam_findenv.c
 SRCS		+= openpam_get_option.c
 SRCS		+= openpam_load.c
--- a/contrib/openpam/lib/openpam_dispatch.c
+++ b/contrib/openpam/lib/openpam_dispatch.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_dispatch.c#13 $
 */

 #include <sys/param.h>
@ -111,7 +111,8 @@ openpam_dispatch(pam_handle_t *pamh,
 			continue;
 		if (r == PAM_SUCCESS) {
 			/*
-			 * For pam_setcred(), treat "sufficient" as
+			 * For pam_setcred() and pam_chauthtok() with the
+			 * PAM_PRELIM_CHECK flag, treat "sufficient" as
 			 * "optional".
 			 *
 			 * Note that Solaris libpam does not terminate
@ -119,7 +120,9 @@ openpam_dispatch(pam_handle_t *pamh,
 			 * previously failed.  I'm not sure why.
 			 */
 			if (chain->flag == PAM_SUFFICIENT &&
-			    primitive != PAM_SM_SETCRED)
+			    primitive != PAM_SM_SETCRED &&
+			    (primitive != PAM_SM_CHAUTHTOK ||
+				!(flags & PAM_PRELIM_CHECK)))
 				break;
 			continue;
 		}
@ -203,7 +206,8 @@ _openpam_check_error_code(int primitive, int r)
 		    r == PAM_AUTHTOK_ERR ||
 		    r == PAM_AUTHTOK_RECOVERY_ERR ||
 		    r == PAM_AUTHTOK_LOCK_BUSY ||
-		    r == PAM_AUTHTOK_DISABLE_AGING)
+		    r == PAM_AUTHTOK_DISABLE_AGING ||
+		    r == PAM_TRY_AGAIN)
 			return;
 		break;
 	}
--- a/contrib/openpam/lib/openpam_dynamic.c
+++ b/contrib/openpam/lib/openpam_dynamic.c
@ -0,0 +1,89 @@
+/*-
+ * Copyright (c) 2002 Networks Associates Technologies, Inc.
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by ThinkSec AS and
+ * NAI Labs, the Security Research Division of Network Associates, Inc.
+ * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
+ * DARPA CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $P4: //depot/projects/openpam/lib/openpam_dynamic.c#1 $
+ */
+
+#include <dlfcn.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <security/pam_appl.h>
+
+#include "openpam_impl.h"
+
+/*
+ * OpenPAM internal
+ *
+ * Locate a dynamically linked module
+ */
+
+pam_module_t *
+openpam_dynamic(const char *path)
+{
+	pam_module_t *module;
+	char *vpath;
+	void *dlh;
+	int i;
+
+	if ((module = calloc(1, sizeof *module)) == NULL)
+		goto buf_err;
+
+	/* try versioned module first, then unversioned module */
+	if (asprintf(&vpath, "%s.%d", path, LIB_MAJ) == -1)
+		goto buf_err;
+	if ((dlh = dlopen(vpath, RTLD_NOW)) == NULL) {
+		openpam_log(PAM_LOG_ERROR, "dlopen(): %s", dlerror());
+		*strrchr(vpath, '.') = '\0';
+		if ((dlh = dlopen(vpath, RTLD_NOW)) == NULL) {
+			openpam_log(PAM_LOG_ERROR, "dlopen(): %s", dlerror());
+			free(module);
+			return (NULL);
+		}
+	}
+	module->path = vpath;
+	module->dlh = dlh;
+	for (i = 0; i < PAM_NUM_PRIMITIVES; ++i)
+		module->func[i] = dlsym(dlh, _pam_sm_func_name[i]);
+	return (module);
+ buf_err:
+	openpam_log(PAM_LOG_ERROR, "%m");
+	dlclose(dlh);
+	free(module);
+	return (NULL);
+}
+
+/*
+ * NOPARSE
+ */
--- a/contrib/openpam/lib/openpam_findenv.c
+++ b/contrib/openpam/lib/openpam_findenv.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_findenv.c#6 $
 */

 #include <string.h>
--- a/contrib/openpam/lib/openpam_get_option.c
+++ b/contrib/openpam/lib/openpam_get_option.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_get_option.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/openpam_impl.h
+++ b/contrib/openpam/lib/openpam_impl.h
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_impl.h#10 $
 */

 #ifndef _OPENPAM_IMPL_H_INCLUDED
@ -104,5 +104,6 @@ void		openpam_clear_chains(pam_handle_t *);
 #ifdef OPENPAM_STATIC_MODULES
 pam_module_t   *openpam_static(const char *);
 #endif
+pam_module_t   *openpam_dynamic(const char *);

 #endif
--- a/contrib/openpam/lib/openpam_load.c
+++ b/contrib/openpam/lib/openpam_load.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_load.c#10 $
 */

 #include <dlfcn.h>
@ -54,16 +54,14 @@ const char *_pam_sm_func_name[PAM_NUM_PRIMITIVES] = {
 static pam_module_t *modules;

 /*
- * Load a dynamic module, or locate a static one.  Keep a list of
- * previously found modules to speed up the process.
+ * Locate a matching dynamic or static module.  Keep a list of previously
+ * found modules to speed up the process.
 */

 static pam_module_t *
 openpam_load_module(const char *path)
 {
 	pam_module_t *module;
-	void *dlh;
-	int i;

 	/* check cache first */
 	for (module = modules; module != NULL; module = module->next)
@ -71,17 +69,7 @@ openpam_load_module(const char *path)
 			goto found;

 	/* nope; try to load */
-	if ((dlh = dlopen(path, RTLD_NOW)) == NULL) {
-		openpam_log(PAM_LOG_ERROR, "dlopen(): %s", dlerror());
-	} else {
-		if ((module = calloc(1, sizeof *module)) == NULL)
-			goto buf_err;
-		if ((module->path = strdup(path)) == NULL)
-			goto buf_err;
-		module->dlh = dlh;
-		for (i = 0; i < PAM_NUM_PRIMITIVES; ++i)
-			module->func[i] = dlsym(dlh, _pam_sm_func_name[i]);
-	}
+	module = openpam_dynamic(path);
 	openpam_log(PAM_LOG_DEBUG, "%s dynamic %s",
 	    (module == NULL) ? "no" : "using", path);

@ -101,11 +89,6 @@ openpam_load_module(const char *path)
 found:
 	++module->refcount;
 	return (module);
- buf_err:
-	openpam_log(PAM_LOG_ERROR, "malloc(): %m");
-	dlclose(dlh);
-	free(module);
-	return (NULL);
 }


@ -136,6 +119,7 @@ openpam_release_module(pam_module_t *module)
 		module->prev->next = module->next;
 	if (module->next != NULL)
 		module->next->prev = module->prev;
+	free(module->path);
 	free(module);
 }

--- a/contrib/openpam/lib/openpam_log.c
+++ b/contrib/openpam/lib/openpam_log.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_log.c#9 $
 */

 #include <ctype.h>
--- a/contrib/openpam/lib/openpam_set_option.c
+++ b/contrib/openpam/lib/openpam_set_option.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_set_option.c#3 $
 */

 #include <sys/param.h>
@ -72,10 +72,20 @@ openpam_set_option(pam_handle_t *pamh,
 		    (cur->optv[i][len] == '\0' || cur->optv[i][len] == '='))
 			break;
 	}
+	if (value == NULL) {
+		/* remove */
+		if (i == cur->optc)
+			return (PAM_SUCCESS);
+		for (free(cur->optv[i]); i < cur->optc; ++i)
+			cur->optv[i] = cur->optv[i + 1];
+		cur->optv[i] = NULL;
+		return (PAM_SUCCESS);
+	}
 	if ((opt = malloc(len + strlen(value) + 2)) == NULL)
 		return (PAM_BUF_ERR);
 	sprintf(opt, "%.*s=%s", (int)len, option, value);
 	if (i == cur->optc) {
+		/* add */
 		optv = realloc(cur->optv, sizeof(char *) * (cur->optc + 2));
 		if (optv == NULL) {
 			free(opt);
@ -85,6 +95,10 @@ openpam_set_option(pam_handle_t *pamh,
 		optv[i + 1] = NULL;
 		cur->optv = optv;
 		++cur->optc;
+	} else {
+		/* replace */
+		free(cur->optv[i]);
+		cur->optv[i] = opt;
 	}
 	return (PAM_SUCCESS);
 }
--- a/contrib/openpam/lib/openpam_static.c
+++ b/contrib/openpam/lib/openpam_static.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_static.c#3 $
 */

 #include <string.h>
--- a/contrib/openpam/lib/openpam_ttyconv.c
+++ b/contrib/openpam/lib/openpam_ttyconv.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/openpam_ttyconv.c#8 $
 */

 #include <sys/types.h>
--- a/contrib/openpam/lib/pam_acct_mgmt.c
+++ b/contrib/openpam/lib/pam_acct_mgmt.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_acct_mgmt.c#6 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_authenticate.c
+++ b/contrib/openpam/lib/pam_authenticate.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_authenticate.c#7 $
 */

 #include <sys/param.h>
@ -51,8 +51,11 @@ int
 pam_authenticate(pam_handle_t *pamh,
 	int flags)
 {
+	int pam_err;

-	return (openpam_dispatch(pamh, PAM_SM_AUTHENTICATE, flags));
+	pam_err = openpam_dispatch(pamh, PAM_SM_AUTHENTICATE, flags);
+	pam_set_item(pamh, PAM_AUTHTOK, NULL);
+	return (pam_err);
 }

 /*
--- a/contrib/openpam/lib/pam_authenticate_secondary.c
+++ b/contrib/openpam/lib/pam_authenticate_secondary.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_authenticate_secondary.c#4 $
 */

 #include <security/pam_appl.h>
--- a/contrib/openpam/lib/pam_chauthtok.c
+++ b/contrib/openpam/lib/pam_chauthtok.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_chauthtok.c#8 $
 */

 #include <sys/param.h>
@ -51,8 +51,18 @@ int
 pam_chauthtok(pam_handle_t *pamh,
 	int flags)
 {
+	int pam_err;

-	return (openpam_dispatch(pamh, PAM_SM_CHAUTHTOK, flags));
+	if (flags & PAM_PRELIM_CHECK || flags & PAM_UPDATE_AUTHTOK)
+		return (PAM_SYMBOL_ERR);
+	pam_err = openpam_dispatch(pamh, PAM_SM_CHAUTHTOK,
+	    flags | PAM_PRELIM_CHECK);
+	if (pam_err == PAM_SUCCESS)
+		pam_err = openpam_dispatch(pamh, PAM_SM_CHAUTHTOK,
+		    flags | PAM_UPDATE_AUTHTOK);
+	pam_set_item(pamh, PAM_OLDAUTHTOK, NULL);
+	pam_set_item(pamh, PAM_AUTHTOK, NULL);
+	return (pam_err);
 }

 /*
@ -61,4 +71,5 @@ pam_chauthtok(pam_handle_t *pamh,
 *	=openpam_dispatch
 *	=pam_sm_chauthtok
 *	!PAM_IGNORE
+ *	PAM_SYMBOL_ERR
 */
--- a/contrib/openpam/lib/pam_close_session.c
+++ b/contrib/openpam/lib/pam_close_session.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_close_session.c#6 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_end.c
+++ b/contrib/openpam/lib/pam_end.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_end.c#7 $
 */

 #include <stdlib.h>
--- a/contrib/openpam/lib/pam_error.c
+++ b/contrib/openpam/lib/pam_error.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_error.c#5 $
 */

 #include <stdarg.h>
--- a/contrib/openpam/lib/pam_get_authtok.c
+++ b/contrib/openpam/lib/pam_get_authtok.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_get_authtok.c#11 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_get_data.c
+++ b/contrib/openpam/lib/pam_get_data.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_get_data.c#6 $
 */

 #include <string.h>
--- a/contrib/openpam/lib/pam_get_item.c
+++ b/contrib/openpam/lib/pam_get_item.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_get_item.c#9 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_get_mapped_authtok.c
+++ b/contrib/openpam/lib/pam_get_mapped_authtok.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_get_mapped_authtok.c#4 $
 */

 #include <security/pam_appl.h>
--- a/contrib/openpam/lib/pam_get_mapped_username.c
+++ b/contrib/openpam/lib/pam_get_mapped_username.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_get_mapped_username.c#4 $
 */

 #include <security/pam_appl.h>
--- a/contrib/openpam/lib/pam_get_user.c
+++ b/contrib/openpam/lib/pam_get_user.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_get_user.c#9 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_getenv.c
+++ b/contrib/openpam/lib/pam_getenv.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_getenv.c#5 $
 */

 #include <stdlib.h>
--- a/contrib/openpam/lib/pam_getenvlist.c
+++ b/contrib/openpam/lib/pam_getenvlist.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_getenvlist.c#7 $
 */

 #include <stdlib.h>
--- a/contrib/openpam/lib/pam_info.c
+++ b/contrib/openpam/lib/pam_info.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_info.c#5 $
 */

 #include <stdarg.h>
--- a/contrib/openpam/lib/pam_open_session.c
+++ b/contrib/openpam/lib/pam_open_session.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_open_session.c#6 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_prompt.c
+++ b/contrib/openpam/lib/pam_prompt.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_prompt.c#5 $
 */

 #include <stdarg.h>
--- a/contrib/openpam/lib/pam_putenv.c
+++ b/contrib/openpam/lib/pam_putenv.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_putenv.c#5 $
 */

 #include <stdlib.h>
--- a/contrib/openpam/lib/pam_set_data.c
+++ b/contrib/openpam/lib/pam_set_data.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_set_data.c#7 $
 */

 #include <stdlib.h>
--- a/contrib/openpam/lib/pam_set_item.c
+++ b/contrib/openpam/lib/pam_set_item.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_set_item.c#11 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_set_mapped_authtok.c
+++ b/contrib/openpam/lib/pam_set_mapped_authtok.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_set_mapped_authtok.c#4 $
 */

 #include <security/pam_appl.h>
--- a/contrib/openpam/lib/pam_set_mapped_username.c
+++ b/contrib/openpam/lib/pam_set_mapped_username.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_set_mapped_username.c#4 $
 */

 #include <security/pam_appl.h>
--- a/contrib/openpam/lib/pam_setcred.c
+++ b/contrib/openpam/lib/pam_setcred.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_setcred.c#6 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_setenv.c
+++ b/contrib/openpam/lib/pam_setenv.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_setenv.c#5 $
 */

 #include <stdlib.h>
--- a/contrib/openpam/lib/pam_sm_acct_mgmt.c
+++ b/contrib/openpam/lib/pam_sm_acct_mgmt.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_acct_mgmt.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_authenticate.c
+++ b/contrib/openpam/lib/pam_sm_authenticate.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_authenticate.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_authenticate_secondary.c
+++ b/contrib/openpam/lib/pam_sm_authenticate_secondary.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_authenticate_secondary.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_chauthtok.c
+++ b/contrib/openpam/lib/pam_sm_chauthtok.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_chauthtok.c#3 $
 */

 #include <sys/param.h>
@ -74,6 +74,7 @@ pam_sm_chauthtok(pam_handle_t *pamh,
 *	PAM_AUTHTOK_RECOVERY_ERR
 *	PAM_AUTHTOK_LOCK_BUSY
 *	PAM_AUTHTOK_DISABLE_AGING
+ *	PAM_TRY_AGAIN
 */

 /**
--- a/contrib/openpam/lib/pam_sm_close_session.c
+++ b/contrib/openpam/lib/pam_sm_close_session.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_close_session.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_get_mapped_authtok.c
+++ b/contrib/openpam/lib/pam_sm_get_mapped_authtok.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_get_mapped_authtok.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_get_mapped_username.c
+++ b/contrib/openpam/lib/pam_sm_get_mapped_username.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_get_mapped_username.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_open_session.c
+++ b/contrib/openpam/lib/pam_sm_open_session.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_open_session.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_set_mapped_authtok.c
+++ b/contrib/openpam/lib/pam_sm_set_mapped_authtok.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_set_mapped_authtok.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_set_mapped_username.c
+++ b/contrib/openpam/lib/pam_sm_set_mapped_username.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_set_mapped_username.c#2 $
 */

 #include <sys/param.h>
--- a/contrib/openpam/lib/pam_sm_setcred.c
+++ b/contrib/openpam/lib/pam_sm_setcred.c
@ -31,7 +31,7 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
- * $Id$
+ * $P4: //depot/projects/openpam/lib/pam_sm_setcred.c#2 $
 */

 #include <sys/param.h>
--- a/Show More
+++ b/Show More