Changeset 745 for trunk/server/source3/auth/pampass.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/auth/pampass.c (modified) (25 diffs)

trunk/server/source3/auth/pampass.c

@@ -6 +6 @@
    Copyright (C) Andrew Bartlett 2001
    Copyright (C) Jeremy Allison 2001
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -28 +28 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "../libcli/auth/pam_errors.h"
 
 #undef DBGC_CLASS
@@ -60 +62 @@
 typedef int (*smb_pam_conv_fn)(int, const struct pam_message **, struct pam_response **, void *appdata_ptr);
 
-/*
- *  Macros to help make life easy
- */
-#define COPY_STRING(s) (s) ? SMB_STRDUP(s) : NULL
-#define COPY_FSTRING(s) (s[0]) ? SMB_STRDUP(s) : NULL
+static char *smb_pam_copy_string(const char *s)
+{
+        if (s == NULL) {
+                return NULL;
+        }
+        return SMB_STRDUP(s);
+}
+
+static char *smb_pam_copy_fstring(const char *s)
+{
+        if (s[0] == '\0') {
+                return NULL;
+        }
+        return SMB_STRDUP(s);
+}
 
 /*******************************************************************
@@ -76 +88 @@
                 DEBUG(dbglvl, ("smb_pam_error_handler: PAM: %s : %s\n",
                                 msg, pam_strerror(pamh, pam_error)));
-                
                 return False;
         }
@@ -145 +156 @@
                         case PAM_PROMPT_ECHO_ON:
                                 reply[replies].resp_retcode = PAM_SUCCESS;
-                                reply[replies].resp = COPY_STRING(udp->PAM_username);
+                                reply[replies].resp = smb_pam_copy_string(
+                                        udp->PAM_username);
                                 /* PAM frees resp */
                                 break;
@@ -151 +163 @@
                         case PAM_PROMPT_ECHO_OFF:
                                 reply[replies].resp_retcode = PAM_SUCCESS;
-                                reply[replies].resp = COPY_STRING(udp->PAM_password);
+                                reply[replies].resp = smb_pam_copy_string(
+                                        udp->PAM_password);
                                 /* PAM frees resp */
                                 break;
@@ -281 +294 @@
         bool found; 
         *resp = NULL;
-        
+
         DEBUG(10,("smb_pam_passchange_conv: starting converstation for %d messages\n", num_msg));
 
@@ -326 +339 @@
                                         pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
 #ifdef DEBUG_PASSWORD
-                                        DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We actualy sent: %s\n", current_reply));
+                                        DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We actually sent: %s\n", current_reply));
 #endif
                                         reply[replies].resp_retcode = PAM_SUCCESS;
-                                        reply[replies].resp = COPY_FSTRING(current_reply);
+                                        reply[replies].resp = smb_pam_copy_fstring(
+                                                current_reply);
                                         found = True;
                                         break;
@@ -357 +371 @@
                                         pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
                                         reply[replies].resp_retcode = PAM_SUCCESS;
-                                        reply[replies].resp = COPY_FSTRING(current_reply);
+                                        reply[replies].resp = smb_pam_copy_fstring(
+                                                current_reply);
 #ifdef DEBUG_PASSWORD
-                                        DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We actualy sent: %s\n", current_reply));
+                                        DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We actually sent: %s\n", current_reply));
 #endif
                                         found = True;
@@ -366 +381 @@
                         }
                         /* PAM frees resp */
-                        
+
                         if (!found) {
                                 DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
@@ -383 +398 @@
                         reply[replies].resp = NULL;
                         break;
-                        
+
                 default:
                         /* Must be an error of some sort... */
@@ -391 +406 @@
                 }
         }
-                
+
         free_pw_chat(pw_chat);
         if (reply)
@@ -444 +459 @@
 
         smb_free_pam_conv(smb_pam_conv_ptr);
-       
+
         if( pamh != NULL ) {
                 pam_error = pam_end(pamh, 0);
@@ -463 +478 @@
 {
         int pam_error;
-#ifdef PAM_RHOST
-        const char *our_rhost;
-        char addr[INET6_ADDRSTRLEN];
-#endif
 
         *pamh = (pam_handle_t *)NULL;
@@ -478 +489 @@
         }
 
-#ifdef PAM_RHOST
-        if (rhost == NULL) {
-                our_rhost = client_name(get_client_fd());
-                if (strequal(our_rhost,"UNKNOWN"))
-                        our_rhost = client_addr(get_client_fd(),addr,sizeof(addr));
-        } else {
-                our_rhost = rhost;
-        }
-
-        DEBUG(4,("smb_pam_start: PAM: setting rhost to: %s\n", our_rhost));
-        pam_error = pam_set_item(*pamh, PAM_RHOST, our_rhost);
+#if HAVE_PAM_RHOST
+        DEBUG(4,("smb_pam_start: PAM: setting rhost to: %s\n", rhost));
+        pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
         if(!smb_pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
                 smb_pam_end(*pamh, pconv);
@@ -495 +498 @@
         }
 #endif
-#ifdef PAM_TTY
+#if HAVE_PAM_TTY
         DEBUG(4,("smb_pam_start: PAM: setting tty\n"));
         pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
@@ -520 +523 @@
          *      auth required /lib/security/pam_pwdb.so nullok shadow audit
          */
-        
+
         DEBUG(4,("smb_pam_auth: PAM: Authenticate User: %s\n", user));
         pam_error = pam_authenticate(pamh, PAM_SILENT | lp_null_passwords() ? 0 : PAM_DISALLOW_NULL_AUTHTOK);
@@ -640 +643 @@
         int pam_error;
 
-#ifdef PAM_TTY
+#if HAVE_PAM_TTY
         DEBUG(4,("smb_internal_pam_session: PAM: tty set to: %s\n", tty));
         pam_error = pam_set_item(pamh, PAM_TTY, tty);
@@ -774 +777 @@
  */
 
-NTSTATUS smb_pam_accountcheck(const char * user)
+NTSTATUS smb_pam_accountcheck(const char *user, const char *rhost)
 {
         NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
@@ -788 +791 @@
                 return NT_STATUS_NO_MEMORY;
 
-        if (!smb_pam_start(&pamh, user, NULL, pconv))
+        if (!smb_pam_start(&pamh, user, rhost, pconv))
                 return NT_STATUS_ACCOUNT_DISABLED;
 
@@ -802 +805 @@
  */
 
-NTSTATUS smb_pam_passcheck(const char * user, const char * password)
+NTSTATUS smb_pam_passcheck(const char * user, const char * rhost,
+                           const char * password)
 {
         pam_handle_t *pamh = NULL;
@@ -817 +821 @@
                 return NT_STATUS_LOGON_FAILURE;
 
-        if (!smb_pam_start(&pamh, user, NULL, pconv))
+        if (!smb_pam_start(&pamh, user, rhost, pconv))
                 return NT_STATUS_LOGON_FAILURE;
 
@@ -846 +850 @@
  */
 
-bool smb_pam_passchange(const char * user, const char * oldpassword, const char * newpassword)
+bool smb_pam_passchange(const char *user, const char *rhost,
+                        const char *oldpassword, const char *newpassword)
 {
         /* Appropriate quantities of root should be obtained BEFORE calling this function */
@@ -855 +860 @@
                 return False;
 
-        if(!smb_pam_start(&pamh, user, NULL, pconv))
+        if(!smb_pam_start(&pamh, user, rhost, pconv))
                 return False;
 
@@ -870 +875 @@
 
 /* If PAM not used, no PAM restrictions on accounts. */
-NTSTATUS smb_pam_accountcheck(const char * user)
+NTSTATUS smb_pam_accountcheck(const char *user, const char *rhost)
 {
         return NT_STATUS_OK;