Changeset 745 for trunk/server/source3/auth/pass_check.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/auth/pass_check.c (modified) (18 diffs)

trunk/server/source3/auth/pass_check.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
    Password checking
    Copyright (C) Andrew Tridgell 1992-1998
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -22 +22 @@
 
 #include "includes.h"
+#include "system/passwd.h"
+#include "auth.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
+
+/* what is the longest significant password available on your system?
+ Knowing this speeds up password searches a lot */
+#ifndef PASSWORD_LENGTH
+#define PASSWORD_LENGTH 8
+#endif
 
 /* these are kept here to keep the string_combinations function simple */
@@ -493 +501 @@
 it assumes the string starts lowercased
 ****************************************************************************/
-static NTSTATUS string_combinations2(char *s, int offset, NTSTATUS (*fn) (const char *),
-                                 int N)
+static NTSTATUS string_combinations2(char *s, int offset,
+                                     NTSTATUS (*fn)(const char *s,
+                                                    void *private_data),
+                                     int N, void *private_data)
 {
         int len = strlen(s);
@@ -505 +515 @@
 
         if (N <= 0 || offset >= len)
-                return (fn(s));
+                return (fn(s, private_data));
 
         for (i = offset; i < (len - (N - 1)); i++) {
                 char c = s[i];
-                if (!islower_ascii(c))
+                if (!islower_m(c))
                         continue;
-                s[i] = toupper_ascii(c);
-                if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, i + 1, fn, N - 1),NT_STATUS_WRONG_PASSWORD)) {
-                        return (nt_status);
+                s[i] = toupper_m(c);
+                nt_status = string_combinations2(s, i + 1, fn, N - 1,
+                                                 private_data);
+                if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
+                        return nt_status;
                 }
                 s[i] = c;
@@ -527 +539 @@
 it assumes the string starts lowercased
 ****************************************************************************/
-static NTSTATUS string_combinations(char *s, NTSTATUS (*fn) (const char *), int N)
+static NTSTATUS string_combinations(char *s,
+                                    NTSTATUS (*fn)(const char *s,
+                                                   void *private_data),
+                                    int N, void *private_data)
 {
         int n;
         NTSTATUS nt_status;
-        for (n = 1; n <= N; n++)
-                if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, 0, fn, n), NT_STATUS_WRONG_PASSWORD))
+        for (n = 1; n <= N; n++) {
+                nt_status = string_combinations2(s, 0, fn, n, private_data);
+                if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
                         return nt_status;
+                }
+        }
         return NT_STATUS_WRONG_PASSWORD;
 }
@@ -541 +559 @@
 core of password checking routine
 ****************************************************************************/
-static NTSTATUS password_check(const char *password)
+static NTSTATUS password_check(const char *password, void *private_data)
 {
 #ifdef WITH_PAM
-        return smb_pam_passcheck(get_this_user(), password);
+        const char *rhost = (const char *)private_data;
+        return smb_pam_passcheck(get_this_user(), rhost, password);
 #else
 
@@ -560 +579 @@
 
 #ifdef OSF1_ENH_SEC
-        
+
         ret = (strcmp(osf1_bigcrypt(password, get_this_salt()),
                       get_this_crypted()) == 0);
@@ -573 +592 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-        
+
 #endif /* OSF1_ENH_SEC */
-        
+
 #ifdef ULTRIX_AUTH
         ret = (strcmp((char *)crypt16(password, get_this_salt()), get_this_crypted()) == 0);
@@ -583 +602 @@
                 return NT_STATUS_WRONG_PASSWORD;
         }
-        
+
 #endif /* ULTRIX_AUTH */
-        
+
 #ifdef LINUX_BIGCRYPT
         ret = (linux_bigcrypt(password, get_this_salt(), get_this_crypted()));
@@ -594 +613 @@
         }
 #endif /* LINUX_BIGCRYPT */
-        
+
 #if defined(HAVE_BIGCRYPT) && defined(HAVE_CRYPT) && defined(USE_BOTH_CRYPT_CALLS)
-        
+
         /*
          * Some systems have bigcrypt in the C library but might not
@@ -614 +633 @@
         }
 #else /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
-        
+
 #ifdef HAVE_BIGCRYPT
         ret = (strcmp(bigcrypt(password, get_this_salt()), get_this_crypted()) == 0);
@@ -623 +642 @@
         }
 #endif /* HAVE_BIGCRYPT */
-        
+
 #ifndef HAVE_CRYPT
         DEBUG(1, ("Warning - no crypt available\n"));
@@ -648 +667 @@
 ****************************************************************************/
 
-NTSTATUS pass_check(const struct passwd *pass, const char *user, const char *password, 
-                    int pwlen, bool (*fn) (const char *, const char *), bool run_cracker)
+NTSTATUS pass_check(const struct passwd *pass,
+                    const char *user,
+                    const char *rhost,
+                    const char *password,
+                    bool run_cracker)
 {
         char *pass2 = NULL;
@@ -663 +685 @@
                 return NT_STATUS_LOGON_FAILURE;
 
-        if (((!*password) || (!pwlen)) && !lp_null_passwords())
+        if ((!*password) && !lp_null_passwords())
                 return NT_STATUS_LOGON_FAILURE;
 
@@ -677 +699 @@
         }
 
-        DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
+        DEBUG(4, ("pass_check: Checking (PAM) password for user %s\n", user));
 
 #else /* Not using PAM */
 
-        DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
+        DEBUG(4, ("pass_check: Checking password for user %s\n", user));
 
         if (!pass) {
@@ -819 +841 @@
 
         /* try it as it came to us */
-        nt_status = password_check(password);
+        nt_status = password_check(password, (void *)rhost);
         if NT_STATUS_IS_OK(nt_status) {
-                if (fn) {
-                        fn(user, password);
-                }
                 return (nt_status);
         } else if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
@@ -850 +869 @@
         if (strhasupper(pass2)) {
                 strlower_m(pass2);
-                if NT_STATUS_IS_OK(nt_status = password_check(pass2)) {
-                        if (fn)
-                                fn(user, pass2);
+                nt_status = password_check(pass2, (void *)rhost);
+                if (NT_STATUS_IS_OK(nt_status)) {
                         return (nt_status);
                 }
@@ -864 +882 @@
         /* last chance - all combinations of up to level chars upper! */
         strlower_m(pass2);
- 
-        if (NT_STATUS_IS_OK(nt_status = string_combinations(pass2, password_check, level))) {
-                if (fn)
-                        fn(user, pass2);
+
+        nt_status = string_combinations(pass2, password_check, level,
+                                        (void *)rhost);
+        if (NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
         }
-        
+
         return NT_STATUS_WRONG_PASSWORD;
 }