Changeset 988 for vendor/current/nsswitch/pam_winbind.c

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

File:

• vendor/current/nsswitch/pam_winbind.c (modified) (56 diffs)

vendor/current/nsswitch/pam_winbind.c

@@ -12 +12 @@
 
 #include "pam_winbind.h"
-#define CONST_DISCARD(type,ptr) ((type)(void *)ptr)
-
+
+enum pam_winbind_request_type 
+{
+        PAM_WINBIND_AUTHENTICATE,
+        PAM_WINBIND_SETCRED,
+        PAM_WINBIND_ACCT_MGMT,
+        PAM_WINBIND_OPEN_SESSION,
+        PAM_WINBIND_CLOSE_SESSION,
+        PAM_WINBIND_CHAUTHTOK,
+        PAM_WINBIND_CLEANUP
+};
 
 static int wbc_error_to_pam_error(wbcErr status)
@@ -141 +150 @@
         do { \
                 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] LEAVE: " \
-                               function " returning %d (%s)", ctx->pamh, retval, \
+                               function " returning %d (%s)", ctx ? ctx->pamh : NULL, retval, \
                                _pam_error_code_str(retval)); \
                 _pam_log_state(ctx); \
@@ -164 +173 @@
 #endif
 
-
-/*
- * Work around the pam API that has functions with void ** as parameters
- * These lead to strict aliasing warnings with gcc.
- */
-static int _pam_get_item(const pam_handle_t *pamh,
-                         int item_type,
-                         const void *_item)
-{
-        const void **item = (const void **)_item;
-        return pam_get_item(pamh, item_type, item);
-}
-static int _pam_get_data(const pam_handle_t *pamh,
-                         const char *module_data_name,
-                         const void *_data)
-{
-        const void **data = (const void **)_data;
-        return pam_get_data(pamh, module_data_name, data);
-}
 
 /* some syslogging */
@@ -203 +193 @@
         const char *service;
 
-        _pam_get_item(pamh, PAM_SERVICE, &service);
+        pam_get_item(pamh, PAM_SERVICE, (const void **) &service);
 
         format2 = (char *)malloc(strlen(MODULE_NAME)+strlen(format)+strlen(service)+5);
@@ -281 +271 @@
         va_list args;
 
-        if (!_pam_log_is_debug_enabled(r->ctrl)) {
+        if (!r || !_pam_log_is_debug_enabled(r->ctrl)) {
                 return;
         }
@@ -350 +340 @@
         _pam_log_state_datum(ctx, item_type, #item_type, \
                              _LOG_PASSWORD_AS_STRING)
+/*
+ * wrapper to preserve old behaviour of iniparser which ignored
+ * key values that had no value assigned like
+ *    key =
+ * for a key like above newer iniparser will return a zero-length
+ * string, previously iniparser would return NULL
+ *
+ * JRA: For compatibility, tiniparser behaves like iniparser.
+ */
+static const char *tiniparser_getstring_nonempty(struct tiniparser_dictionary *d,
+                        const char *key,
+                        const char *def)
+{
+        const char *ret = tiniparser_getstring(d, key, def);
+        if (ret && strlen(ret) == 0) {
+                ret = NULL;
+        }
+        return ret;
+}
 
 static void _pam_log_state(struct pwb_context *ctx)
 {
-        if (!_pam_log_is_debug_state_enabled(ctx->ctrl)) {
+        if (!ctx || !_pam_log_is_debug_state_enabled(ctx->ctrl)) {
                 return;
         }
@@ -389 +398 @@
                       int argc,
                       const char **argv,
-                      dictionary **result_d)
+                      enum pam_winbind_request_type type,
+                      struct tiniparser_dictionary **result_d)
 {
         int ctrl = 0;
@@ -395 +405 @@
         int i;
         const char **v;
-        dictionary *d = NULL;
+        struct tiniparser_dictionary *d = NULL;
 
         if (flags & PAM_SILENT) {
@@ -413 +423 @@
         }
 
-        d = iniparser_load(CONST_DISCARD(char *, config_file));
+        d = tiniparser_load(config_file);
         if (d == NULL) {
                 goto config_from_pam;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:debug"), false)) {
+        if (tiniparser_getboolean(d, "global:debug", false)) {
                 ctrl |= WINBIND_DEBUG_ARG;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:debug_state"), false)) {
+        if (tiniparser_getboolean(d, "global:debug_state", false)) {
                 ctrl |= WINBIND_DEBUG_STATE;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:cached_login"), false)) {
+        if (tiniparser_getboolean(d, "global:cached_login", false)) {
                 ctrl |= WINBIND_CACHED_LOGIN;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:krb5_auth"), false)) {
+        if (tiniparser_getboolean(d, "global:krb5_auth", false)) {
                 ctrl |= WINBIND_KRB5_AUTH;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:silent"), false)) {
+        if (tiniparser_getboolean(d, "global:silent", false)) {
                 ctrl |= WINBIND_SILENT;
         }
 
-        if (iniparser_getstring(d, CONST_DISCARD(char *, "global:krb5_ccache_type"), NULL) != NULL) {
+        if (tiniparser_getstring_nonempty(d, "global:krb5_ccache_type", NULL) != NULL) {
                 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
         }
 
-        if ((iniparser_getstring(d, CONST_DISCARD(char *, "global:require-membership-of"), NULL)
+        if ((tiniparser_getstring_nonempty(d, "global:require-membership-of", NULL)
              != NULL) ||
-            (iniparser_getstring(d, CONST_DISCARD(char *, "global:require_membership_of"), NULL)
+            (tiniparser_getstring_nonempty(d, "global:require_membership_of", NULL)
              != NULL)) {
                 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:try_first_pass"), false)) {
+        if (tiniparser_getboolean(d, "global:try_first_pass", false)) {
                 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
         }
 
-        if (iniparser_getint(d, CONST_DISCARD(char *, "global:warn_pwd_expire"), 0)) {
+        if (tiniparser_getint(d, "global:warn_pwd_expire", 0)) {
                 ctrl |= WINBIND_WARN_PWD_EXPIRE;
         }
 
-        if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:mkhomedir"), false)) {
+        if (tiniparser_getboolean(d, "global:mkhomedir", false)) {
                 ctrl |= WINBIND_MKHOMEDIR;
         }
@@ -480 +490 @@
                 else if (!strcasecmp(*v, "unknown_ok"))
                         ctrl |= WINBIND_UNKNOWN_OK_ARG;
-                else if (!strncasecmp(*v, "require_membership_of",
-                                      strlen("require_membership_of")))
+                else if ((type == PAM_WINBIND_AUTHENTICATE
+                          || type == PAM_WINBIND_SETCRED) 
+                         && !strncasecmp(*v, "require_membership_of",
+                                         strlen("require_membership_of")))
                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
-                else if (!strncasecmp(*v, "require-membership-of",
-                                      strlen("require-membership-of")))
+                else if ((type == PAM_WINBIND_AUTHENTICATE 
+                          || type == PAM_WINBIND_SETCRED) 
+                         && !strncasecmp(*v, "require-membership-of",
+                                         strlen("require-membership-of")))
                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
                 else if (!strcasecmp(*v, "krb5_auth"))
@@ -495 +509 @@
                 else if (!strcasecmp(*v, "mkhomedir"))
                         ctrl |= WINBIND_MKHOMEDIR;
-                else {
+                else if (!strncasecmp(*v, "warn_pwd_expire",
+                        strlen("warn_pwd_expire")))
+                        ctrl |= WINBIND_WARN_PWD_EXPIRE;
+                else if (type != PAM_WINBIND_CLEANUP) {
                         __pam_log(pamh, ctrl, LOG_ERR,
                                  "pam_parse: unknown option: %s", *v);
@@ -507 +524 @@
         } else {
                 if (d) {
-                        iniparser_freedict(d);
+                        tiniparser_freedict(d);
                 }
         }
@@ -521 +538 @@
 
         if (ctx->dict) {
-                iniparser_freedict(ctx->dict);
+                tiniparser_freedict(ctx->dict);
         }
 
@@ -531 +548 @@
                                      int argc,
                                      const char **argv,
+                                     enum pam_winbind_request_type type,
                                      struct pwb_context **ctx_p)
 {
@@ -539 +557 @@
 #endif
 
-        r = TALLOC_ZERO_P(NULL, struct pwb_context);
+        r = talloc_zero(NULL, struct pwb_context);
         if (!r) {
                 return PAM_BUF_ERR;
@@ -550 +568 @@
         r->argc = argc;
         r->argv = argv;
-        r->ctrl = _pam_parse(pamh, flags, argc, argv, &r->dict);
+        r->ctrl = _pam_parse(pamh, flags, argc, argv, type, &r->dict);
         if (r->ctrl == -1) {
                 TALLOC_FREE(r);
@@ -565 +583 @@
                                       int error_status)
 {
-        int ctrl = _pam_parse(pamh, 0, 0, NULL, NULL);
+        int ctrl = _pam_parse(pamh, 0, 0, NULL, PAM_WINBIND_CLEANUP, NULL);
         if (_pam_log_is_debug_state_enabled(ctrl)) {
                 __pam_log_debug(pamh, ctrl, LOG_DEBUG,
@@ -646 +664 @@
         struct pam_conv *conv;
 
-        retval = _pam_get_item(pamh, PAM_CONV, &conv);
+        retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv);
         if (retval == PAM_SUCCESS) {
                 retval = conv->conv(nargs,
-                                    (const struct pam_message **)message,
+                                    discard_const_p(const struct pam_message *, message),
                                     response, conv->appdata_ptr);
         }
@@ -813 +831 @@
         struct pam_message msg, *pmsg;
         struct pam_response *resp = NULL;
-        const char *prompt;
         int ret;
         bool retval = false;
-        prompt = _("Do you want to change your password now?");
         pmsg = &msg;
         msg.msg_style = PAM_RADIO_TYPE;
-        msg.msg = prompt;
+        msg.msg = _("Do you want to change your password now?");
         ret = converse(ctx->pamh, 1, &pmsg, &resp);
         if (resp == NULL) {
@@ -1050 +1066 @@
                                int dest_buffer_size)
 {
-        int dest_length = strlen(dest);
-        int src_length = strlen(src);
-
-        if (dest_length + src_length + 1 > dest_buffer_size) {
-                return false;
-        }
-
-        memcpy(dest + dest_length, src, src_length + 1);
-        return true;
+        size_t len;
+        len = strlcat(dest, src, dest_buffer_size);
+        return (len < dest_buffer_size);
 }
 
@@ -1221 +1231 @@
                                 struct wbcLogonUserInfo *info)
 {
-        char var[PATH_MAX];
+        char *var = NULL;
         int ret;
         uint32_t i;
@@ -1248 +1258 @@
                        "request returned KRB5CCNAME: %s", krb5ccname);
 
-        if (snprintf(var, sizeof(var), "KRB5CCNAME=%s", krb5ccname) == -1) {
+        if (asprintf(&var, "KRB5CCNAME=%s", krb5ccname) == -1) {
                 return;
         }
 
         ret = pam_putenv(ctx->pamh, var);
-        if (ret) {
+        if (ret != PAM_SUCCESS) {
                 _pam_log(ctx, LOG_ERR,
                          "failed to set KRB5CCNAME to %s: %s",
                          var, pam_strerror(ctx->pamh, ret));
         }
+        free(var);
 }
 
@@ -1318 +1329 @@
         ret = pam_set_data(ctx->pamh, data_name, talloc_strdup(NULL, value),
                            _pam_winbind_cleanup_func);
-        if (ret) {
+        if (ret != PAM_SUCCESS) {
                 _pam_log_debug(ctx, LOG_DEBUG,
                                "Could not set data %s: %s\n",
@@ -1646 +1657 @@
 
                 ret = _pam_create_homedir(ctx, create_dir, mode);
-                if (ret) {
+                if (ret != PAM_SUCCESS) {
                         return ret;
                 }
@@ -1771 +1782 @@
                                              "krb5_cc_type",
                                              0,
-                                             (uint8_t *)cctype,
+                                             discard_const_p(uint8_t, cctype),
                                              strlen(cctype)+1);
                 if (!WBC_ERROR_IS_OK(wbc_status)) {
@@ -1952 +1963 @@
 
         params.account_name             = user;
-        params.level                    = WBC_AUTH_USER_LEVEL_PLAIN;
+        params.level                    = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
         params.old_password.plaintext   = oldpass;
         params.new_password.plaintext   = newpass;
@@ -1991 +2002 @@
 
                 /* FIXME: avoid to send multiple PAM messages after another */
-                switch (reject_reason) {
+                switch ((int)reject_reason) {
                         case -1:
                                 break;
@@ -2129 +2140 @@
         if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) ||
             on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
-                retval = _pam_get_item(ctx->pamh, authtok_flag, &item);
+                retval = pam_get_item(ctx->pamh,
+                                      authtok_flag,
+                                      (const void **) &item);
                 if (retval != PAM_SUCCESS) {
                         /* very strange. */
@@ -2237 +2250 @@
         _pam_delete(token);     /* clean it up */
         if (retval != PAM_SUCCESS ||
-            (retval = _pam_get_item(ctx->pamh, authtok_flag, &item)) != PAM_SUCCESS) {
+            (retval = pam_get_item(ctx->pamh, authtok_flag, (const void **) &item)) != PAM_SUCCESS) {
 
                 _pam_log(ctx, LOG_CRIT, "error manipulating password");
@@ -2287 +2300 @@
                 }
 
-                parm_opt = iniparser_getstring(ctx->dict, key, NULL);
+                parm_opt = tiniparser_getstring_nonempty(ctx->dict, key, NULL);
                 TALLOC_FREE(key);
 
@@ -2335 +2348 @@
                 }
 
-                parm_opt = iniparser_getint(ctx->dict, key, -1);
+                parm_opt = tiniparser_getint(ctx->dict, key, -1);
                 TALLOC_FREE(key);
 
@@ -2357 +2370 @@
         ret = get_conf_item_string(ctx, "require_membership_of",
                                    WINBIND_REQUIRED_MEMBERSHIP);
-        if (ret) {
+        if (ret != NULL) {
                 return ret;
         }
@@ -2370 +2383 @@
                                   WINBIND_WARN_PWD_EXPIRE);
         /* no or broken setting */
-        if (ret <= 0) {
+        if (ret < 0) {
                 return DEFAULT_DAYS_TO_WARN_BEFORE_PWD_EXPIRES;
         }
@@ -2409 +2422 @@
  *
  * @param ctx PAM winbind context.
- * @param upn  USer UPN to be trabslated.
+ * @param upn  User UPN to be translated.
  *
  * @return converted name. NULL pointer on failure. Caller needs to free.
@@ -2424 +2437 @@
         char *name;
         char *p;
+        char *result;
 
         /* This cannot work when the winbind separator = @ */
@@ -2455 +2469 @@
         }
 
-        return talloc_asprintf(ctx, "%s%c%s", domain, sep, name);
+        result = talloc_asprintf(ctx, "%s%c%s", domain, sep, name);
+        wbcFreeMemory(domain);
+        wbcFreeMemory(name);
+        return result;
 }
 
 static int _pam_delete_cred(pam_handle_t *pamh, int flags,
-                         int argc, const char **argv)
+                            int argc, enum pam_winbind_request_type type, 
+                            const char **argv)
 {
         int retval = PAM_SUCCESS;
@@ -2470 +2488 @@
         ZERO_STRUCT(logoff);
 
-        retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (retval) {
-                goto out;
+        retval = _pam_winbind_init_context(pamh, flags, argc, argv, type, &ctx);
+        if (retval != PAM_SUCCESS) {
+                return retval;
         }
 
@@ -2486 +2504 @@
 
                 retval = pam_get_user(pamh, &user, _("Username: "));
-                if (retval) {
+                if (retval != PAM_SUCCESS) {
                         _pam_log(ctx, LOG_ERR,
                                  "could not identify user");
@@ -2524 +2542 @@
                                                      "ccfilename",
                                                      0,
-                                                     (uint8_t *)ccname,
+                                                     discard_const_p(uint8_t, ccname),
                                                      strlen(ccname)+1);
                         if (!WBC_ERROR_IS_OK(wbc_status)) {
@@ -2605 +2623 @@
         struct pwb_context *ctx = NULL;
 
-        retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (retval) {
-                goto out;
+        retval = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                           PAM_WINBIND_AUTHENTICATE, &ctx);
+        if (retval != PAM_SUCCESS) {
+                return retval;
         }
 
@@ -2742 +2761 @@
         }
 
-        if (ctx != NULL) {
-                _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
-                TALLOC_FREE(ctx);
-        }
+        _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
+
+        TALLOC_FREE(ctx);
 
         return retval;
@@ -2757 +2775 @@
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_SETCRED, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
@@ -2767 +2786 @@
 
                 case PAM_DELETE_CRED:
-                        ret = _pam_delete_cred(pamh, flags, argc, argv);
+                        ret = _pam_delete_cred(pamh, flags, argc,
+                                               PAM_WINBIND_SETCRED, argv);
                         break;
                 case PAM_REFRESH_CRED:
@@ -2789 +2809 @@
         }
 
- out:
-
         _PAM_LOG_FUNCTION_LEAVE("pam_sm_setcred", ctx, ret);
 
@@ -2808 +2826 @@
         const char *username;
         int ret = PAM_USER_UNKNOWN;
-        void *tmp = NULL;
+        const char *tmp = NULL;
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_ACCT_MGMT, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
@@ -2849 +2868 @@
                              (const void **)&tmp);
                 if (tmp != NULL) {
-                        ret = atoi((const char *)tmp);
+                        ret = atoi(tmp);
                         switch (ret) {
                         case PAM_AUTHTOK_EXPIRED:
@@ -2906 +2925 @@
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_OPEN_SESSION, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
@@ -2917 +2937 @@
                 ret = _pam_mkhomedir(ctx);
         }
- out:
+
         _PAM_LOG_FUNCTION_LEAVE("pam_sm_open_session", ctx, ret);
 
@@ -2932 +2952 @@
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_CLOSE_SESSION, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
         _PAM_LOG_FUNCTION_ENTER("pam_sm_close_session", ctx);
 
-out:
         _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx, ret);
 
@@ -2975 +2995 @@
         struct passwd *pwd = NULL;
 
-        _pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
-                      &new_authtok_reqd_during_auth);
+        pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
+                      (const void **) &new_authtok_reqd_during_auth);
         pam_set_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
                      NULL, NULL);
@@ -3007 +3027 @@
         /* <DO NOT free() THESE> */
         const char *user;
-        char *pass_old, *pass_new;
+        const char *pass_old;
+        const char *pass_new;
         /* </DO NOT free() THESE> */
 
@@ -3017 +3038 @@
         struct pwb_context *ctx = NULL;
 
-        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
-        if (ret) {
-                goto out;
+        ret = _pam_winbind_init_context(pamh, flags, argc, argv,
+                                        PAM_WINBIND_CHAUTHTOK, &ctx);
+        if (ret != PAM_SUCCESS) {
+                return ret;
         }
 
@@ -3033 +3055 @@
          */
         ret = pam_get_user(pamh, &user, _("Username: "));
-        if (ret) {
+        if (ret != PAM_SUCCESS) {
                 _pam_log(ctx, LOG_ERR,
                          "password - could not identify user");
@@ -3130 +3152 @@
                  */
 
-                ret = _pam_get_item(pamh, PAM_OLDAUTHTOK, &pass_old);
+                ret = pam_get_item(pamh, PAM_OLDAUTHTOK, (const void **) &pass_old);
 
                 if (ret != PAM_SUCCESS) {
@@ -3180 +3202 @@
                  * rebuild the password database file.
                  */
-                _pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
-                              &pwdlastset_update);
+                pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
+                             (const void **) &pwdlastset_update);
 
                 /*
@@ -3194 +3216 @@
                 ret = winbind_chauthtok_request(ctx, user, pass_old,
                                                 pass_new, pwdlastset_update);
-                if (ret) {
+                if (ret != PAM_SUCCESS) {
                         pass_old = pass_new = NULL;
                         goto out;