nsswitch/pam_winbind.c

   1 /* pam_winbind module
   2
   3    Copyright Andrew Tridgell <tridge@samba.org> 2000
   4    Copyright Tim Potter <tpot@samba.org> 2000
   5    Copyright Andrew Bartlett <abartlet@samba.org> 2002
   6    Copyright Guenther Deschner <gd@samba.org> 2005-2008
   7
   8    largely based on pam_userdb by Cristian Gafton <gafton@redhat.com> also
   9    contains large slabs of code from pam_unix by Elliot Lee
  10    <sopwith@redhat.com> (see copyright below for full details)
  11 */
  12
  13 #include "pam_winbind.h"
  14
  15 enum pam_winbind_request_type
  16 {
  17         PAM_WINBIND_AUTHENTICATE,
  18         PAM_WINBIND_SETCRED,
  19         PAM_WINBIND_ACCT_MGMT,
  20         PAM_WINBIND_OPEN_SESSION,
  21         PAM_WINBIND_CLOSE_SESSION,
  22         PAM_WINBIND_CHAUTHTOK,
  23         PAM_WINBIND_CLEANUP
  24 };
  25
  26 static int wbc_error_to_pam_error(wbcErr status)
  27 {
  28         switch (status) {
  29                 case WBC_ERR_SUCCESS:
  30                         return PAM_SUCCESS;
  31                 case WBC_ERR_NOT_IMPLEMENTED:
  32                         return PAM_SERVICE_ERR;
  33                 case WBC_ERR_UNKNOWN_FAILURE:
  34                         break;
  35                 case WBC_ERR_NO_MEMORY:
  36                         return PAM_BUF_ERR;
  37                 case WBC_ERR_INVALID_SID:
  38                 case WBC_ERR_INVALID_PARAM:
  39                         break;
  40                 case WBC_ERR_WINBIND_NOT_AVAILABLE:
  41                         return PAM_AUTHINFO_UNAVAIL;
  42                 case WBC_ERR_DOMAIN_NOT_FOUND:
  43                         return PAM_AUTHINFO_UNAVAIL;
  44                 case WBC_ERR_INVALID_RESPONSE:
  45                         return PAM_BUF_ERR;
  46                 case WBC_ERR_NSS_ERROR:
  47                         return PAM_USER_UNKNOWN;
  48                 case WBC_ERR_AUTH_ERROR:
  49                         return PAM_AUTH_ERR;
  50                 case WBC_ERR_UNKNOWN_USER:
  51                         return PAM_USER_UNKNOWN;
  52                 case WBC_ERR_UNKNOWN_GROUP:
  53                         return PAM_USER_UNKNOWN;
  54                 case WBC_ERR_PWD_CHANGE_FAILED:
  55                         break;
  56         }
  57
  58         /* be paranoid */
  59         return PAM_AUTH_ERR;
  60 }
  61
  62 static const char *_pam_error_code_str(int err)
  63 {
  64         switch (err) {
  65                 case PAM_SUCCESS:
  66                         return "PAM_SUCCESS";
  67                 case PAM_OPEN_ERR:
  68                         return "PAM_OPEN_ERR";
  69                 case PAM_SYMBOL_ERR:
  70                         return "PAM_SYMBOL_ERR";
  71                 case PAM_SERVICE_ERR:
  72                         return "PAM_SERVICE_ERR";
  73                 case PAM_SYSTEM_ERR:
  74                         return "PAM_SYSTEM_ERR";
  75                 case PAM_BUF_ERR:
  76                         return "PAM_BUF_ERR";
  77                 case PAM_PERM_DENIED:
  78                         return "PAM_PERM_DENIED";
  79                 case PAM_AUTH_ERR:
  80                         return "PAM_AUTH_ERR";
  81                 case PAM_CRED_INSUFFICIENT:
  82                         return "PAM_CRED_INSUFFICIENT";
  83                 case PAM_AUTHINFO_UNAVAIL:
  84                         return "PAM_AUTHINFO_UNAVAIL";
  85                 case PAM_USER_UNKNOWN:
  86                         return "PAM_USER_UNKNOWN";
  87                 case PAM_MAXTRIES:
  88                         return "PAM_MAXTRIES";
  89                 case PAM_NEW_AUTHTOK_REQD:
  90                         return "PAM_NEW_AUTHTOK_REQD";
  91                 case PAM_ACCT_EXPIRED:
  92                         return "PAM_ACCT_EXPIRED";
  93                 case PAM_SESSION_ERR:
  94                         return "PAM_SESSION_ERR";
  95                 case PAM_CRED_UNAVAIL:
  96                         return "PAM_CRED_UNAVAIL";
  97                 case PAM_CRED_EXPIRED:
  98                         return "PAM_CRED_EXPIRED";
  99                 case PAM_CRED_ERR:
 100                         return "PAM_CRED_ERR";
 101                 case PAM_NO_MODULE_DATA:
 102                         return "PAM_NO_MODULE_DATA";
 103                 case PAM_CONV_ERR:
 104                         return "PAM_CONV_ERR";
 105                 case PAM_AUTHTOK_ERR:
 106                         return "PAM_AUTHTOK_ERR";
 107                 case PAM_AUTHTOK_RECOVER_ERR:
 108                         return "PAM_AUTHTOK_RECOVER_ERR";
 109                 case PAM_AUTHTOK_LOCK_BUSY:
 110                         return "PAM_AUTHTOK_LOCK_BUSY";
 111                 case PAM_AUTHTOK_DISABLE_AGING:
 112                         return "PAM_AUTHTOK_DISABLE_AGING";
 113                 case PAM_TRY_AGAIN:
 114                         return "PAM_TRY_AGAIN";
 115                 case PAM_IGNORE:
 116                         return "PAM_IGNORE";
 117                 case PAM_ABORT:
 118                         return "PAM_ABORT";
 119                 case PAM_AUTHTOK_EXPIRED:
 120                         return "PAM_AUTHTOK_EXPIRED";
 121 #ifdef PAM_MODULE_UNKNOWN
 122                 case PAM_MODULE_UNKNOWN:
 123                         return "PAM_MODULE_UNKNOWN";
 124 #endif
 125 #ifdef PAM_BAD_ITEM
 126                 case PAM_BAD_ITEM:
 127                         return "PAM_BAD_ITEM";
 128 #endif
 129 #ifdef PAM_CONV_AGAIN
 130                 case PAM_CONV_AGAIN:
 131                         return "PAM_CONV_AGAIN";
 132 #endif
 133 #ifdef PAM_INCOMPLETE
 134                 case PAM_INCOMPLETE:
 135                         return "PAM_INCOMPLETE";
 136 #endif
 137                 default:
 138                         return NULL;
 139         }
 140 }
 141
 142 #define _PAM_LOG_FUNCTION_ENTER(function, ctx) \
 143         do { \
 144                 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] ENTER: " \
 145                                function " (flags: 0x%04x)", ctx->pamh, ctx->flags); \
 146                 _pam_log_state(ctx); \
 147         } while (0)
 148
 149 #define _PAM_LOG_FUNCTION_LEAVE(function, ctx, retval) \
 150         do { \
 151                 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] LEAVE: " \
 152                                function " returning %d (%s)", ctx ? ctx->pamh : NULL, retval, \
 153                                _pam_error_code_str(retval)); \
 154                 _pam_log_state(ctx); \
 155         } while (0)
 156
 157 /* data tokens */
 158
 159 #define MAX_PASSWD_TRIES        3
 160
 161 #ifdef HAVE_GETTEXT
 162 static char initialized = 0;
 163
 164 static inline void textdomain_init(void);
 165 static inline void textdomain_init(void)
 166 {
 167         if (!initialized) {
 168                 bindtextdomain(MODULE_NAME, LOCALEDIR);
 169                 initialized = 1;
 170         }
 171         return;
 172 }
 173 #endif
 174
 175
 176 /* some syslogging */
 177
 178 #ifdef HAVE_PAM_VSYSLOG
 179 static void _pam_log_int(const pam_handle_t *pamh,
 180                          int err,
 181                          const char *format,
 182                          va_list args)
 183 {
 184         pam_vsyslog(pamh, err, format, args);
 185 }
 186 #else
 187 static void _pam_log_int(const pam_handle_t *pamh,
 188                          int err,
 189                          const char *format,
 190                          va_list args)
 191 {
 192         char *format2 = NULL;
 193         const char *service;
 194         int ret;
 195
 196         pam_get_item(pamh, PAM_SERVICE, (const void **) &service);
 197
 198         ret = asprintf(&format2, "%s(%s): %s", MODULE_NAME, service, format);
 199         if (ret == -1) {
 200                 /* what else todo ? */
 201                 vsyslog(err, format, args);
 202                 return;
 203         }
 204
 205         vsyslog(err, format2, args);
 206         SAFE_FREE(format2);
 207 }
 208 #endif /* HAVE_PAM_VSYSLOG */
 209
 210 static bool _pam_log_is_silent(int ctrl)
 211 {
 212         return on(ctrl, WINBIND_SILENT);
 213 }
 214
 215 static void _pam_log(struct pwb_context *r, int err, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 216 static void _pam_log(struct pwb_context *r, int err, const char *format, ...)
 217 {
 218         va_list args;
 219
 220         if (_pam_log_is_silent(r->ctrl)) {
 221                 return;
 222         }
 223
 224         va_start(args, format);
 225         _pam_log_int(r->pamh, err, format, args);
 226         va_end(args);
 227 }
 228 static void __pam_log(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...) PRINTF_ATTRIBUTE(4,5);
 229 static void __pam_log(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...)
 230 {
 231         va_list args;
 232
 233         if (_pam_log_is_silent(ctrl)) {
 234                 return;
 235         }
 236
 237         va_start(args, format);
 238         _pam_log_int(pamh, err, format, args);
 239         va_end(args);
 240 }
 241
 242 static bool _pam_log_is_debug_enabled(int ctrl)
 243 {
 244         if (ctrl == -1) {
 245                 return false;
 246         }
 247
 248         if (_pam_log_is_silent(ctrl)) {
 249                 return false;
 250         }
 251
 252         if (!(ctrl & WINBIND_DEBUG_ARG)) {
 253                 return false;
 254         }
 255
 256         return true;
 257 }
 258
 259 static bool _pam_log_is_debug_state_enabled(int ctrl)
 260 {
 261         if (!(ctrl & WINBIND_DEBUG_STATE)) {
 262                 return false;
 263         }
 264
 265         return _pam_log_is_debug_enabled(ctrl);
 266 }
 267
 268 static void _pam_log_debug(struct pwb_context *r, int err, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 269 static void _pam_log_debug(struct pwb_context *r, int err, const char *format, ...)
 270 {
 271         va_list args;
 272
 273         if (!r || !_pam_log_is_debug_enabled(r->ctrl)) {
 274                 return;
 275         }
 276
 277         va_start(args, format);
 278         _pam_log_int(r->pamh, err, format, args);
 279         va_end(args);
 280 }
 281 static void __pam_log_debug(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...) PRINTF_ATTRIBUTE(4,5);
 282 static void __pam_log_debug(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...)
 283 {
 284         va_list args;
 285
 286         if (!_pam_log_is_debug_enabled(ctrl)) {
 287                 return;
 288         }
 289
 290         va_start(args, format);
 291         _pam_log_int(pamh, err, format, args);
 292         va_end(args);
 293 }
 294
 295 static void _pam_log_state_datum(struct pwb_context *ctx,
 296                                  int item_type,
 297                                  const char *key,
 298                                  int is_string)
 299 {
 300         const void *data = NULL;
 301         if (item_type != 0) {
 302                 pam_get_item(ctx->pamh, item_type, &data);
 303         } else {
 304                 pam_get_data(ctx->pamh, key, &data);
 305         }
 306         if (data != NULL) {
 307                 const char *type = (item_type != 0) ? "ITEM" : "DATA";
 308                 if (is_string != 0) {
 309                         _pam_log_debug(ctx, LOG_DEBUG,
 310                                        "[pamh: %p] STATE: %s(%s) = \"%s\" (%p)",
 311                                        ctx->pamh, type, key, (const char *)data,
 312                                        data);
 313                 } else {
 314                         _pam_log_debug(ctx, LOG_DEBUG,
 315                                        "[pamh: %p] STATE: %s(%s) = %p",
 316                                        ctx->pamh, type, key, data);
 317                 }
 318         }
 319 }
 320
 321 #define _PAM_LOG_STATE_DATA_POINTER(ctx, module_data_name) \
 322         _pam_log_state_datum(ctx, 0, module_data_name, 0)
 323
 324 #define _PAM_LOG_STATE_DATA_STRING(ctx, module_data_name) \
 325         _pam_log_state_datum(ctx, 0, module_data_name, 1)
 326
 327 #define _PAM_LOG_STATE_ITEM_POINTER(ctx, item_type) \
 328         _pam_log_state_datum(ctx, item_type, #item_type, 0)
 329
 330 #define _PAM_LOG_STATE_ITEM_STRING(ctx, item_type) \
 331         _pam_log_state_datum(ctx, item_type, #item_type, 1)
 332
 333 #ifdef DEBUG_PASSWORD
 334 #define _LOG_PASSWORD_AS_STRING 1
 335 #else
 336 #define _LOG_PASSWORD_AS_STRING 0
 337 #endif
 338
 339 #define _PAM_LOG_STATE_ITEM_PASSWORD(ctx, item_type) \
 340         _pam_log_state_datum(ctx, item_type, #item_type, \
 341                              _LOG_PASSWORD_AS_STRING)
 342 /*
 343  * wrapper to preserve old behaviour of iniparser which ignored
 344  * key values that had no value assigned like
 345  *    key =
 346  * for a key like above newer iniparser will return a zero-length
 347  * string, previously iniparser would return NULL
 348  *
 349  * JRA: For compatibility, tiniparser behaves like iniparser.
 350  */
 351 static const char *tiniparser_getstring_nonempty(struct tiniparser_dictionary *d,
 352                         const char *key,
 353                         const char *def)
 354 {
 355         const char *ret = tiniparser_getstring(d, key, def);
 356         if (ret && strlen(ret) == 0) {
 357                 ret = NULL;
 358         }
 359         return ret;
 360 }
 361
 362 static void _pam_log_state(struct pwb_context *ctx)
 363 {
 364         if (!ctx || !_pam_log_is_debug_state_enabled(ctx->ctrl)) {
 365                 return;
 366         }
 367
 368         _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_SERVICE);
 369         _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_USER);
 370         _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_TTY);
 371         _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_RHOST);
 372         _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_RUSER);
 373         _PAM_LOG_STATE_ITEM_PASSWORD(ctx, PAM_OLDAUTHTOK);
 374         _PAM_LOG_STATE_ITEM_PASSWORD(ctx, PAM_AUTHTOK);
 375         _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_USER_PROMPT);
 376         _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_CONV);
 377 #ifdef PAM_FAIL_DELAY
 378         _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_FAIL_DELAY);
 379 #endif
 380 #ifdef PAM_REPOSITORY
 381         _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_REPOSITORY);
 382 #endif
 383
 384         _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_HOMEDIR);
 385         _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_LOGONSCRIPT);
 386         _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_LOGONSERVER);
 387         _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_PROFILEPATH);
 388         _PAM_LOG_STATE_DATA_STRING(ctx,
 389                                    PAM_WINBIND_NEW_AUTHTOK_REQD);
 390                                    /* Use atoi to get PAM result code */
 391         _PAM_LOG_STATE_DATA_STRING(ctx,
 392                                    PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH);
 393         _PAM_LOG_STATE_DATA_POINTER(ctx, PAM_WINBIND_PWD_LAST_SET);
 394 }
 395
 396 static int _pam_parse(const pam_handle_t *pamh,
 397                       int flags,
 398                       int argc,
 399                       const char **argv,
 400                       enum pam_winbind_request_type type,
 401                       struct tiniparser_dictionary **result_d)
 402 {
 403         int ctrl = 0;
 404         const char *config_file = NULL;
 405         int i;
 406         const char **v;
 407         struct tiniparser_dictionary *d = NULL;
 408
 409         if (flags & PAM_SILENT) {
 410                 ctrl |= WINBIND_SILENT;
 411         }
 412
 413         for (i=argc,v=argv; i-- > 0; ++v) {
 414                 if (!strncasecmp(*v, "config", strlen("config"))) {
 415                         ctrl |= WINBIND_CONFIG_FILE;
 416                         config_file = v[i];
 417                         break;
 418                 }
 419         }
 420
 421         if (config_file == NULL) {
 422                 config_file = PAM_WINBIND_CONFIG_FILE;
 423         }
 424
 425         d = tiniparser_load(config_file);
 426         if (d == NULL) {
 427                 goto config_from_pam;
 428         }
 429
 430         if (tiniparser_getboolean(d, "global:debug", false)) {
 431                 ctrl |= WINBIND_DEBUG_ARG;
 432         }
 433
 434         if (tiniparser_getboolean(d, "global:debug_state", false)) {
 435                 ctrl |= WINBIND_DEBUG_STATE;
 436         }
 437
 438         if (tiniparser_getboolean(d, "global:cached_login", false)) {
 439                 ctrl |= WINBIND_CACHED_LOGIN;
 440         }
 441
 442         if (tiniparser_getboolean(d, "global:krb5_auth", false)) {
 443                 ctrl |= WINBIND_KRB5_AUTH;
 444         }
 445
 446         if (tiniparser_getboolean(d, "global:silent", false)) {
 447                 ctrl |= WINBIND_SILENT;
 448         }
 449
 450         if (tiniparser_getstring_nonempty(d, "global:krb5_ccache_type", NULL) != NULL) {
 451                 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
 452         }
 453
 454         if ((tiniparser_getstring_nonempty(d, "global:require-membership-of", NULL)
 455              != NULL) ||
 456             (tiniparser_getstring_nonempty(d, "global:require_membership_of", NULL)
 457              != NULL)) {
 458                 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
 459         }
 460
 461         if (tiniparser_getboolean(d, "global:try_first_pass", false)) {
 462                 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
 463         }
 464
 465         if (tiniparser_getint(d, "global:warn_pwd_expire", 0)) {
 466                 ctrl |= WINBIND_WARN_PWD_EXPIRE;
 467         }
 468
 469         if (tiniparser_getboolean(d, "global:mkhomedir", false)) {
 470                 ctrl |= WINBIND_MKHOMEDIR;
 471         }
 472
 473 config_from_pam:
 474         /* step through arguments */
 475         for (i=argc,v=argv; i-- > 0; ++v) {
 476
 477                 /* generic options */
 478                 if (!strcmp(*v,"debug"))
 479                         ctrl |= WINBIND_DEBUG_ARG;
 480                 else if (!strcasecmp(*v, "debug_state"))
 481                         ctrl |= WINBIND_DEBUG_STATE;
 482                 else if (!strcasecmp(*v, "silent"))
 483                         ctrl |= WINBIND_SILENT;
 484                 else if (!strcasecmp(*v, "use_authtok"))
 485                         ctrl |= WINBIND_USE_AUTHTOK_ARG;
 486                 else if (!strcasecmp(*v, "use_first_pass"))
 487                         ctrl |= WINBIND_USE_FIRST_PASS_ARG;
 488                 else if (!strcasecmp(*v, "try_first_pass"))
 489                         ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
 490                 else if (!strcasecmp(*v, "unknown_ok"))
 491                         ctrl |= WINBIND_UNKNOWN_OK_ARG;
 492                 else if ((type == PAM_WINBIND_AUTHENTICATE
 493                           || type == PAM_WINBIND_SETCRED)
 494                          && !strncasecmp(*v, "require_membership_of",
 495                                          strlen("require_membership_of")))
 496                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
 497                 else if ((type == PAM_WINBIND_AUTHENTICATE
 498                           || type == PAM_WINBIND_SETCRED)
 499                          && !strncasecmp(*v, "require-membership-of",
 500                                          strlen("require-membership-of")))
 501                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
 502                 else if (!strcasecmp(*v, "krb5_auth"))
 503                         ctrl |= WINBIND_KRB5_AUTH;
 504                 else if (!strncasecmp(*v, "krb5_ccache_type",
 505                                       strlen("krb5_ccache_type")))
 506                         ctrl |= WINBIND_KRB5_CCACHE_TYPE;
 507                 else if (!strcasecmp(*v, "cached_login"))
 508                         ctrl |= WINBIND_CACHED_LOGIN;
 509                 else if (!strcasecmp(*v, "mkhomedir"))
 510                         ctrl |= WINBIND_MKHOMEDIR;
 511                 else if (!strncasecmp(*v, "warn_pwd_expire",
 512                         strlen("warn_pwd_expire")))
 513                         ctrl |= WINBIND_WARN_PWD_EXPIRE;
 514                 else if (type != PAM_WINBIND_CLEANUP) {
 515                         __pam_log(pamh, ctrl, LOG_ERR,
 516                                  "pam_parse: unknown option: %s", *v);
 517                         return -1;
 518                 }
 519
 520         }
 521
 522         if (result_d) {
 523                 *result_d = d;
 524         } else {
 525                 if (d) {
 526                         tiniparser_freedict(d);
 527                 }
 528         }
 529
 530         return ctrl;
 531 };
 532
 533 static int _pam_winbind_free_context(struct pwb_context *ctx)
 534 {
 535         if (!ctx) {
 536                 return 0;
 537         }
 538
 539         if (ctx->dict) {
 540                 tiniparser_freedict(ctx->dict);
 541         }
 542
 543         wbcCtxFree(ctx->wbc_ctx);
 544
 545         return 0;
 546 }
 547
 548 static int _pam_winbind_init_context(pam_handle_t *pamh,
 549                                      int flags,
 550                                      int argc,
 551                                      const char **argv,
 552                                      enum pam_winbind_request_type type,
 553                                      struct pwb_context **ctx_p)
 554 {
 555         struct pwb_context *r = NULL;
 556         int ctrl_code;
 557
 558 #ifdef HAVE_GETTEXT
 559         textdomain_init();
 560 #endif
 561
 562         r = talloc_zero(NULL, struct pwb_context);
 563         if (!r) {
 564                 return PAM_BUF_ERR;
 565         }
 566
 567         talloc_set_destructor(r, _pam_winbind_free_context);
 568
 569         r->pamh = pamh;
 570         r->flags = flags;
 571         r->argc = argc;
 572         r->argv = argv;
 573         ctrl_code = _pam_parse(pamh, flags, argc, argv, type, &r->dict);
 574         if (ctrl_code == -1) {
 575                 TALLOC_FREE(r);
 576                 return PAM_SYSTEM_ERR;
 577         }
 578         r->ctrl = ctrl_code;
 579
 580         r->wbc_ctx = wbcCtxCreate();
 581         if (r->wbc_ctx == NULL) {
 582                 TALLOC_FREE(r);
 583                 return PAM_SYSTEM_ERR;
 584         }
 585
 586         *ctx_p = r;
 587
 588         return PAM_SUCCESS;
 589 }
 590
 591 static void _pam_winbind_cleanup_func(pam_handle_t *pamh,
 592                                       void *data,
 593                                       int error_status)
 594 {
 595         int ctrl = _pam_parse(pamh, 0, 0, NULL, PAM_WINBIND_CLEANUP, NULL);
 596         if (_pam_log_is_debug_state_enabled(ctrl)) {
 597                 __pam_log_debug(pamh, ctrl, LOG_DEBUG,
 598                                "[pamh: %p] CLEAN: cleaning up PAM data %p "
 599                                "(error_status = %d)", pamh, data,
 600                                error_status);
 601         }
 602         TALLOC_FREE(data);
 603 }
 604
 605
 606 static const struct ntstatus_errors {
 607         const char *ntstatus_string;
 608         const char *error_string;
 609 } ntstatus_errors[] = {
 610         {"NT_STATUS_OK",
 611                 N_("Success")},
 612         {"NT_STATUS_BACKUP_CONTROLLER",
 613                 N_("No primary Domain Controler available")},
 614         {"NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
 615                 N_("No domain controllers found")},
 616         {"NT_STATUS_NO_LOGON_SERVERS",
 617                 N_("No logon servers")},
 618         {"NT_STATUS_PWD_TOO_SHORT",
 619                 N_("Password too short")},
 620         {"NT_STATUS_PWD_TOO_RECENT",
 621                 N_("The password of this user is too recent to change")},
 622         {"NT_STATUS_PWD_HISTORY_CONFLICT",
 623                 N_("Password is already in password history")},
 624         {"NT_STATUS_PASSWORD_EXPIRED",
 625                 N_("Your password has expired")},
 626         {"NT_STATUS_PASSWORD_MUST_CHANGE",
 627                 N_("You need to change your password now")},
 628         {"NT_STATUS_INVALID_WORKSTATION",
 629                 N_("You are not allowed to logon from this workstation")},
 630         {"NT_STATUS_INVALID_LOGON_HOURS",
 631                 N_("You are not allowed to logon at this time")},
 632         {"NT_STATUS_ACCOUNT_EXPIRED",
 633                 N_("Your account has expired. "
 634                    "Please contact your System administrator")}, /* SCNR */
 635         {"NT_STATUS_ACCOUNT_DISABLED",
 636                 N_("Your account is disabled. "
 637                    "Please contact your System administrator")}, /* SCNR */
 638         {"NT_STATUS_ACCOUNT_LOCKED_OUT",
 639                 N_("Your account has been locked. "
 640                    "Please contact your System administrator")}, /* SCNR */
 641         {"NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
 642                 N_("Invalid Trust Account")},
 643         {"NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT",
 644                 N_("Invalid Trust Account")},
 645         {"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
 646                 N_("Invalid Trust Account")},
 647         {"NT_STATUS_ACCESS_DENIED",
 648                 N_("Access is denied")},
 649         {NULL, NULL}
 650 };
 651
 652 static const char *_get_ntstatus_error_string(const char *nt_status_string)
 653 {
 654         int i;
 655         for (i=0; ntstatus_errors[i].ntstatus_string != NULL; i++) {
 656                 if (!strcasecmp(ntstatus_errors[i].ntstatus_string,
 657                                 nt_status_string)) {
 658                         return _(ntstatus_errors[i].error_string);
 659                 }
 660         }
 661         return NULL;
 662 }
 663
 664 /* --- authentication management functions --- */
 665
 666 /* Attempt a conversation */
 667
 668 static int converse(const pam_handle_t *pamh,
 669                     int nargs,
 670                     struct pam_message **message,
 671                     struct pam_response **response)
 672 {
 673         int retval;
 674         struct pam_conv *conv;
 675
 676         retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv);
 677         if (retval == PAM_SUCCESS) {
 678                 retval = conv->conv(nargs,
 679                                     discard_const_p(const struct pam_message *, message),
 680                                     response, conv->appdata_ptr);
 681         }
 682
 683         return retval; /* propagate error status */
 684 }
 685
 686
 687 static int _make_remark(struct pwb_context *ctx,
 688                         int type,
 689                         const char *text)
 690 {
 691         int retval = PAM_SUCCESS;
 692
 693         struct pam_message *pmsg[1], msg[1];
 694         struct pam_response *resp;
 695
 696         if (ctx->flags & WINBIND_SILENT) {
 697                 return PAM_SUCCESS;
 698         }
 699
 700         pmsg[0] = &msg[0];
 701         msg[0].msg = discard_const_p(char, text);
 702         msg[0].msg_style = type;
 703
 704         resp = NULL;
 705         retval = converse(ctx->pamh, 1, pmsg, &resp);
 706
 707         if (resp) {
 708                 _pam_drop_reply(resp, 1);
 709         }
 710         return retval;
 711 }
 712
 713 static int _make_remark_v(struct pwb_context *ctx,
 714                           int type,
 715                           const char *format,
 716                           va_list args)
 717 {
 718         char *var;
 719         int ret;
 720
 721         ret = vasprintf(&var, format, args);
 722         if (ret < 0) {
 723                 _pam_log(ctx, LOG_ERR, "memory allocation failure");
 724                 return ret;
 725         }
 726
 727         ret = _make_remark(ctx, type, var);
 728         SAFE_FREE(var);
 729         return ret;
 730 }
 731
 732 static int _make_remark_format(struct pwb_context *ctx, int type, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 733 static int _make_remark_format(struct pwb_context *ctx, int type, const char *format, ...)
 734 {
 735         int ret;
 736         va_list args;
 737
 738         va_start(args, format);
 739         ret = _make_remark_v(ctx, type, format, args);
 740         va_end(args);
 741         return ret;
 742 }
 743
 744 static int pam_winbind_request_log(struct pwb_context *ctx,
 745                                    int retval,
 746                                    const char *user,
 747                                    const char *fn)
 748 {
 749         switch (retval) {
 750         case PAM_AUTH_ERR:
 751                 /* incorrect password */
 752                 _pam_log(ctx, LOG_WARNING, "user '%s' denied access "
 753                          "(incorrect password or invalid membership)", user);
 754                 return retval;
 755         case PAM_ACCT_EXPIRED:
 756                 /* account expired */
 757                 _pam_log(ctx, LOG_WARNING, "user '%s' account expired",
 758                          user);
 759                 return retval;
 760         case PAM_AUTHTOK_EXPIRED:
 761                 /* password expired */
 762                 _pam_log(ctx, LOG_WARNING, "user '%s' password expired",
 763                          user);
 764                 return retval;
 765         case PAM_NEW_AUTHTOK_REQD:
 766                 /* new password required */
 767                 _pam_log(ctx, LOG_WARNING, "user '%s' new password "
 768                          "required", user);
 769                 return retval;
 770         case PAM_USER_UNKNOWN:
 771                 /* the user does not exist */
 772                 _pam_log_debug(ctx, LOG_NOTICE, "user '%s' not found",
 773                                user);
 774                 if (ctx->ctrl & WINBIND_UNKNOWN_OK_ARG) {
 775                         return PAM_IGNORE;
 776                 }
 777                 return retval;
 778         case PAM_SUCCESS:
 779                 /* Otherwise, the authentication looked good */
 780                 if (strcmp(fn, "wbcLogonUser") == 0) {
 781                         _pam_log(ctx, LOG_NOTICE,
 782                                  "user '%s' granted access", user);
 783                 } else {
 784                         _pam_log(ctx, LOG_NOTICE,
 785                                  "user '%s' OK", user);
 786                 }
 787                 return retval;
 788         default:
 789                 /* we don't know anything about this return value */
 790                 _pam_log(ctx, LOG_ERR,
 791                          "internal module error (retval = %s(%d), user = '%s')",
 792                         _pam_error_code_str(retval), retval, user);
 793                 return retval;
 794         }
 795 }
 796
 797 static int wbc_auth_error_to_pam_error(struct pwb_context *ctx,
 798                                        struct wbcAuthErrorInfo *e,
 799                                        wbcErr status,
 800                                        const char *username,
 801                                        const char *fn)
 802 {
 803         int ret = PAM_AUTH_ERR;
 804
 805         if (WBC_ERROR_IS_OK(status)) {
 806                 _pam_log_debug(ctx, LOG_DEBUG, "request %s succeeded",
 807                         fn);
 808                 ret = PAM_SUCCESS;
 809                 return pam_winbind_request_log(ctx, ret, username, fn);
 810         }
 811
 812         if (e) {
 813                 if (e->pam_error != PAM_SUCCESS) {
 814                         _pam_log(ctx, LOG_ERR,
 815                                  "request %s failed: %s, "
 816                                  "PAM error: %s (%d), NTSTATUS: %s, "
 817                                  "Error message was: %s",
 818                                  fn,
 819                                  wbcErrorString(status),
 820                                  _pam_error_code_str(e->pam_error),
 821                                  e->pam_error,
 822                                  e->nt_string,
 823                                  e->display_string);
 824                         ret = e->pam_error;
 825                         return pam_winbind_request_log(ctx, ret, username, fn);
 826                 }
 827
 828                 _pam_log(ctx, LOG_ERR, "request %s failed, but PAM error 0!", fn);
 829
 830                 ret = PAM_SERVICE_ERR;
 831                 return pam_winbind_request_log(ctx, ret, username, fn);
 832         }
 833
 834         ret = wbc_error_to_pam_error(status);
 835         return pam_winbind_request_log(ctx, ret, username, fn);
 836 }
 837
 838 #if defined(HAVE_PAM_RADIO_TYPE)
 839 static bool _pam_winbind_change_pwd(struct pwb_context *ctx)
 840 {
 841         struct pam_message msg, *pmsg;
 842         struct pam_response *resp = NULL;
 843         int ret;
 844         bool retval = false;
 845         pmsg = &msg;
 846         msg.msg_style = PAM_RADIO_TYPE;
 847         msg.msg = _("Do you want to change your password now?");
 848         ret = converse(ctx->pamh, 1, &pmsg, &resp);
 849         if (resp == NULL) {
 850                 if (ret == PAM_SUCCESS) {
 851                         _pam_log(ctx, LOG_CRIT, "pam_winbind: system error!\n");
 852                         return false;
 853                 }
 854         }
 855         if (ret != PAM_SUCCESS) {
 856                 return false;
 857         }
 858         _pam_log(ctx, LOG_CRIT, "Received [%s] reply from application.\n", resp->resp);
 859
 860         if ((resp->resp != NULL) && (strcasecmp(resp->resp, "yes") == 0)) {
 861                 retval = true;
 862         }
 863
 864         _pam_drop_reply(resp, 1);
 865         return retval;
 866 }
 867 #else
 868 static bool _pam_winbind_change_pwd(struct pwb_context *ctx)
 869 {
 870         return false;
 871 }
 872 #endif
 873
 874 /**
 875  * send a password expiry message if required
 876  *
 877  * @param ctx PAM winbind context.
 878  * @param next_change expected (calculated) next expiry date.
 879  * @param already_expired pointer to a boolean to indicate if the password is
 880  *        already expired.
 881  *
 882  * @return boolean Returns true if message has been sent, false if not.
 883  */
 884
 885 static bool _pam_send_password_expiry_message(struct pwb_context *ctx,
 886                                               time_t next_change,
 887                                               time_t now,
 888                                               int warn_pwd_expire,
 889                                               bool *already_expired,
 890                                               bool *change_pwd)
 891 {
 892         int days = 0;
 893         struct tm tm_now, tm_next_change;
 894         bool retval = false;
 895         int ret;
 896
 897         if (already_expired) {
 898                 *already_expired = false;
 899         }
 900
 901         if (change_pwd) {
 902                 *change_pwd = false;
 903         }
 904
 905         if (next_change <= now) {
 906                 PAM_WB_REMARK_DIRECT(ctx, "NT_STATUS_PASSWORD_EXPIRED");
 907                 if (already_expired) {
 908                         *already_expired = true;
 909                 }
 910                 return true;
 911         }
 912
 913         if ((next_change < 0) ||
 914             (next_change > now + warn_pwd_expire * SECONDS_PER_DAY)) {
 915                 return false;
 916         }
 917
 918         if ((localtime_r(&now, &tm_now) == NULL) ||
 919             (localtime_r(&next_change, &tm_next_change) == NULL)) {
 920                 return false;
 921         }
 922
 923         days = (tm_next_change.tm_yday+tm_next_change.tm_year*365) -
 924                (tm_now.tm_yday+tm_now.tm_year*365);
 925
 926         if (days == 0) {
 927                 ret = _make_remark(ctx, PAM_TEXT_INFO,
 928                                 _("Your password expires today.\n"));
 929
 930                 /*
 931                  * If change_pwd and already_expired is null.
 932                  * We are just sending a notification message.
 933                  * We don't expect any response in this case.
 934                  */
 935
 936                 if (!change_pwd && !already_expired) {
 937                         return true;
 938                 }
 939
 940                 /*
 941                  * successfully sent the warning message.
 942                  * Give the user a chance to change pwd.
 943                  */
 944                 if (ret == PAM_SUCCESS) {
 945                         if (change_pwd) {
 946                                 retval = _pam_winbind_change_pwd(ctx);
 947                                 if (retval) {
 948                                         *change_pwd = true;
 949                                 }
 950                         }
 951                 }
 952                 return true;
 953         }
 954
 955         if (days > 0 && days < warn_pwd_expire) {
 956
 957                 ret = _make_remark_format(ctx, PAM_TEXT_INFO,
 958                                         _("Your password will expire in %d %s.\n"),
 959                                         days, (days > 1) ? _("days"):_("day"));
 960                 /*
 961                  * If change_pwd and already_expired is null.
 962                  * We are just sending a notification message.
 963                  * We don't expect any response in this case.
 964                  */
 965
 966                 if (!change_pwd && !already_expired) {
 967                         return true;
 968                 }
 969
 970                 /*
 971                  * successfully sent the warning message.
 972                  * Give the user a chance to change pwd.
 973                  */
 974                 if (ret == PAM_SUCCESS) {
 975                         if (change_pwd) {
 976                                 retval = _pam_winbind_change_pwd(ctx);
 977                                 if (retval) {
 978                                         *change_pwd = true;
 979                                 }
 980                         }
 981                 }
 982                 return true;
 983         }
 984
 985         return false;
 986 }
 987
 988 /**
 989  * Send a warning if the password expires in the near future
 990  *
 991  * @param ctx PAM winbind context.
 992  * @param response The full authentication response structure.
 993  * @param already_expired boolean, is the pwd already expired?
 994  *
 995  * @return void.
 996  */
 997
 998 static void _pam_warn_password_expiry(struct pwb_context *ctx,
 999                                       const struct wbcAuthUserInfo *info,
1000                                       const struct wbcUserPasswordPolicyInfo *policy,
1001                                       int warn_pwd_expire,
1002                                       bool *already_expired,
1003                                       bool *change_pwd)
1004 {
1005         time_t now = time(NULL);
1006         time_t next_change = 0;
1007
1008         if (!info || !policy) {
1009                 return;
1010         }
1011
1012         if (already_expired) {
1013                 *already_expired = false;
1014         }
1015
1016         if (change_pwd) {
1017                 *change_pwd = false;
1018         }
1019
1020         /* accounts with WBC_ACB_PWNOEXP set never receive a warning */
1021         if (info->acct_flags & WBC_ACB_PWNOEXP) {
1022                 return;
1023         }
1024
1025         /* no point in sending a warning if this is a grace logon */
1026         if (PAM_WB_GRACE_LOGON(info->user_flags)) {
1027                 return;
1028         }
1029
1030         /* check if the info3 must change timestamp has been set */
1031         next_change = info->pass_must_change_time;
1032
1033         if (_pam_send_password_expiry_message(ctx, next_change, now,
1034                                               warn_pwd_expire,
1035                                               already_expired,
1036                                               change_pwd)) {
1037                 return;
1038         }
1039
1040         /* now check for the global password policy */
1041         /* good catch from Ralf Haferkamp: an expiry of "never" is translated
1042          * to -1 */
1043         if ((policy->expire == (int64_t)-1) ||
1044             (policy->expire == 0)) {
1045                 return;
1046         }
1047
1048         next_change = info->pass_last_set_time + policy->expire;
1049
1050         if (_pam_send_password_expiry_message(ctx, next_change, now,
1051                                               warn_pwd_expire,
1052                                               already_expired,
1053                                               change_pwd)) {
1054                 return;
1055         }
1056
1057         /* no warning sent */
1058 }
1059
1060 #define IS_SID_STRING(name) (strncmp("S-", name, 2) == 0)
1061
1062 /**
1063  * Append a string, making sure not to overflow and to always return a
1064  * NULL-terminated string.
1065  *
1066  * @param dest Destination string buffer (must already be NULL-terminated).
1067  * @param src Source string buffer.
1068  * @param dest_buffer_size Size of dest buffer in bytes.
1069  *
1070  * @return false if dest buffer is not big enough (no bytes copied), true on
1071  * success.
1072  */
1073
1074 static bool safe_append_string(char *dest,
1075                                const char *src,
1076                                int dest_buffer_size)
1077 {
1078         size_t len;
1079         len = strlcat(dest, src, dest_buffer_size);
1080         return (len < dest_buffer_size);
1081 }
1082
1083 /**
1084  * Convert a names into a SID string, appending it to a buffer.
1085  *
1086  * @param ctx PAM winbind context.
1087  * @param user User in PAM request.
1088  * @param name Name to convert.
1089  * @param sid_list_buffer Where to append the string sid.
1090  * @param sid_list_buffer Size of sid_list_buffer (in bytes).
1091  *
1092  * @return false on failure, true on success.
1093  */
1094 static bool winbind_name_to_sid_string(struct pwb_context *ctx,
1095                                        const char *user,
1096                                        const char *name,
1097                                        char *sid_list_buffer,
1098                                        int sid_list_buffer_size)
1099 {
1100         char sid_string[WBC_SID_STRING_BUFLEN];
1101
1102         /* lookup name? */
1103         if (IS_SID_STRING(name)) {
1104                 strlcpy(sid_string, name, sizeof(sid_string));
1105         } else {
1106                 wbcErr wbc_status;
1107                 struct wbcDomainSid sid;
1108                 enum wbcSidType type;
1109
1110                 _pam_log_debug(ctx, LOG_DEBUG,
1111                                "no sid given, looking up: %s\n", name);
1112
1113                 wbc_status = wbcCtxLookupName(ctx->wbc_ctx,
1114                                               "",
1115                                               name,
1116                                               &sid,
1117                                               &type);
1118                 if (!WBC_ERROR_IS_OK(wbc_status)) {
1119                         _pam_log(ctx, LOG_INFO,
1120                                  "could not lookup name: %s\n", name);
1121                         return false;
1122                 }
1123
1124                 wbcSidToStringBuf(&sid, sid_string, sizeof(sid_string));
1125         }
1126
1127         if (!safe_append_string(sid_list_buffer, sid_string,
1128                                 sid_list_buffer_size)) {
1129                 return false;
1130         }
1131         return true;
1132 }
1133
1134 /**
1135  * Convert a list of names into a list of sids.
1136  *
1137  * @param ctx PAM winbind context.
1138  * @param user User in PAM request.
1139  * @param name_list List of names or string sids, separated by commas.
1140  * @param sid_list_buffer Where to put the list of string sids.
1141  * @param sid_list_buffer Size of sid_list_buffer (in bytes).
1142  *
1143  * @return false on failure, true on success.
1144  */
1145 static bool winbind_name_list_to_sid_string_list(struct pwb_context *ctx,
1146                                                  const char *user,
1147                                                  const char *name_list,
1148                                                  char *sid_list_buffer,
1149                                                  int sid_list_buffer_size)
1150 {
1151         bool result = false;
1152         char *current_name = NULL;
1153         const char *search_location;
1154         const char *comma;
1155         int len;
1156
1157         if (sid_list_buffer_size > 0) {
1158                 sid_list_buffer[0] = 0;
1159         }
1160
1161         search_location = name_list;
1162         while ((comma = strchr(search_location, ',')) != NULL) {
1163                 current_name = strndup(search_location,
1164                                        comma - search_location);
1165                 if (NULL == current_name) {
1166                         goto out;
1167                 }
1168
1169                 if (!winbind_name_to_sid_string(ctx, user,
1170                                                 current_name,
1171                                                 sid_list_buffer,
1172                                                 sid_list_buffer_size)) {
1173                         /*
1174                          * If one group name failed, we must not fail
1175                          * the authentication totally, continue with
1176                          * the following group names. If user belongs to
1177                          * one of the valid groups, we must allow it
1178                          * login. -- BoYang
1179                          */
1180
1181                         _pam_log(ctx, LOG_INFO, "cannot convert group %s to sid, "
1182                                  "check if group %s is valid group.", current_name,
1183                                  current_name);
1184                         _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s "
1185                                         "to sid, please contact your administrator to see "
1186                                         "if group %s is valid."), current_name, current_name);
1187                         SAFE_FREE(current_name);
1188                         search_location = comma + 1;
1189                         continue;
1190                 }
1191
1192                 SAFE_FREE(current_name);
1193
1194                 if (!safe_append_string(sid_list_buffer, ",",
1195                                         sid_list_buffer_size)) {
1196                         goto out;
1197                 }
1198
1199                 search_location = comma + 1;
1200         }
1201
1202         if (!winbind_name_to_sid_string(ctx, user, search_location,
1203                                         sid_list_buffer,
1204                                         sid_list_buffer_size)) {
1205                 _pam_log(ctx, LOG_INFO, "cannot convert group %s to sid, "
1206                          "check if group %s is valid group.", search_location,
1207                          search_location);
1208                 _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s "
1209                                 "to sid, please contact your administrator to see "
1210                                 "if group %s is valid."), search_location, search_location);
1211
1212                 /* If no valid groups were converted we should fail outright */
1213                 if (name_list != NULL && strlen(sid_list_buffer) == 0) {
1214                         result = false;
1215                         goto out;
1216                 }
1217                 /*
1218                  * The lookup of the last name failed..
1219                  * It results in require_member_of_sid ends with ','
1220                  * It is malformated parameter here, overwrite the last ','.
1221                  */
1222                 len = strlen(sid_list_buffer);
1223                 if ((len != 0) && (sid_list_buffer[len - 1] == ',')) {
1224                         sid_list_buffer[len - 1] = '\0';
1225                 }
1226         }
1227
1228         result = true;
1229
1230 out:
1231         SAFE_FREE(current_name);
1232         return result;
1233 }
1234
1235 /**
1236  * put krb5ccname variable into environment
1237  *
1238  * @param ctx PAM winbind context.
1239  * @param krb5ccname env variable retrieved from winbindd.
1240  *
1241  * @return void.
1242  */
1243
1244 static void _pam_setup_krb5_env(struct pwb_context *ctx,
1245                                 struct wbcLogonUserInfo *info)
1246 {
1247         char *var = NULL;
1248         int ret;
1249         uint32_t i;
1250         const char *krb5ccname = NULL;
1251
1252         if (off(ctx->ctrl, WINBIND_KRB5_AUTH)) {
1253                 return;
1254         }
1255
1256         if (!info) {
1257                 return;
1258         }
1259
1260         for (i=0; i < info->num_blobs; i++) {
1261                 if (strcasecmp(info->blobs[i].name, "krb5ccname") == 0) {
1262                         krb5ccname = (const char *)info->blobs[i].blob.data;
1263                         break;
1264                 }
1265         }
1266
1267         if (!krb5ccname || (strlen(krb5ccname) == 0)) {
1268                 return;
1269         }
1270
1271         _pam_log_debug(ctx, LOG_DEBUG,
1272                        "request returned KRB5CCNAME: %s", krb5ccname);
1273
1274         if (asprintf(&var, "KRB5CCNAME=%s", krb5ccname) == -1) {
1275                 return;
1276         }
1277
1278         ret = pam_putenv(ctx->pamh, var);
1279         if (ret != PAM_SUCCESS) {
1280                 _pam_log(ctx, LOG_ERR,
1281                          "failed to set KRB5CCNAME to %s: %s",
1282                          var, pam_strerror(ctx->pamh, ret));
1283         }
1284         free(var);
1285 }
1286
1287 /**
1288  * Copy unix username if available (further processed in PAM).
1289  *
1290  * @param ctx PAM winbind context
1291  * @param user_ret A pointer that holds a pointer to a string
1292  * @param unix_username A username
1293  *
1294  * @return void.
1295  */
1296
1297 static void _pam_setup_unix_username(struct pwb_context *ctx,
1298                                      char **user_ret,
1299                                      struct wbcLogonUserInfo *info)
1300 {
1301         const char *unix_username = NULL;
1302         uint32_t i;
1303
1304         if (!user_ret || !info) {
1305                 return;
1306         }
1307
1308         for (i=0; i < info->num_blobs; i++) {
1309                 if (strcasecmp(info->blobs[i].name, "unix_username") == 0) {
1310                         unix_username = (const char *)info->blobs[i].blob.data;
1311                         break;
1312                 }
1313         }
1314
1315         if (!unix_username || !unix_username[0]) {
1316                 return;
1317         }
1318
1319         *user_ret = strdup(unix_username);
1320 }
1321
1322 /**
1323  * Set string into the PAM stack.
1324  *
1325  * @param ctx PAM winbind context.
1326  * @param data_name Key name for pam_set_data.
1327  * @param value String value.
1328  *
1329  * @return void.
1330  */
1331
1332 static void _pam_set_data_string(struct pwb_context *ctx,
1333                                  const char *data_name,
1334                                  const char *value)
1335 {
1336         int ret;
1337
1338         if (!data_name || !value || (strlen(data_name) == 0) ||
1339              (strlen(value) == 0)) {
1340                 return;
1341         }
1342
1343         ret = pam_set_data(ctx->pamh, data_name, talloc_strdup(NULL, value),
1344                            _pam_winbind_cleanup_func);
1345         if (ret != PAM_SUCCESS) {
1346                 _pam_log_debug(ctx, LOG_DEBUG,
1347                                "Could not set data %s: %s\n",
1348                                data_name, pam_strerror(ctx->pamh, ret));
1349         }
1350 }
1351
1352 /**
1353  * Set info3 strings into the PAM stack.
1354  *
1355  * @param ctx PAM winbind context.
1356  * @param data_name Key name for pam_set_data.
1357  * @param value String value.
1358  *
1359  * @return void.
1360  */
1361
1362 static void _pam_set_data_info3(struct pwb_context *ctx,
1363                                 const struct wbcAuthUserInfo *info)
1364 {
1365         _pam_set_data_string(ctx, PAM_WINBIND_HOMEDIR,
1366                              info->home_directory);
1367         _pam_set_data_string(ctx, PAM_WINBIND_LOGONSCRIPT,
1368                              info->logon_script);
1369         _pam_set_data_string(ctx, PAM_WINBIND_LOGONSERVER,
1370                              info->logon_server);
1371         _pam_set_data_string(ctx, PAM_WINBIND_PROFILEPATH,
1372                              info->profile_path);
1373 }
1374
1375 /**
1376  * Free info3 strings in the PAM stack.
1377  *
1378  * @param pamh PAM handle
1379  *
1380  * @return void.
1381  */
1382
1383 static void _pam_free_data_info3(pam_handle_t *pamh)
1384 {
1385         pam_set_data(pamh, PAM_WINBIND_HOMEDIR, NULL, NULL);
1386         pam_set_data(pamh, PAM_WINBIND_LOGONSCRIPT, NULL, NULL);
1387         pam_set_data(pamh, PAM_WINBIND_LOGONSERVER, NULL, NULL);
1388         pam_set_data(pamh, PAM_WINBIND_PROFILEPATH, NULL, NULL);
1389 }
1390
1391 /**
1392  * Send PAM_ERROR_MSG for cached or grace logons.
1393  *
1394  * @param ctx PAM winbind context.
1395  * @param username User in PAM request.
1396  * @param info3_user_flgs Info3 flags containing logon type bits.
1397  *
1398  * @return void.
1399  */
1400
1401 static void _pam_warn_logon_type(struct pwb_context *ctx,
1402                                  const char *username,
1403                                  uint32_t info3_user_flgs)
1404 {
1405         /* inform about logon type */
1406         if (PAM_WB_GRACE_LOGON(info3_user_flgs)) {
1407
1408                 _make_remark(ctx, PAM_ERROR_MSG,
1409                              _("Grace login. "
1410                                "Please change your password as soon you're "
1411                                "online again"));
1412                 _pam_log_debug(ctx, LOG_DEBUG,
1413                                "User %s logged on using grace logon\n",
1414                                username);
1415
1416         } else if (PAM_WB_CACHED_LOGON(info3_user_flgs)) {
1417
1418                 _make_remark(ctx, PAM_ERROR_MSG,
1419                              _("Domain Controller unreachable, "
1420                                "using cached credentials instead. "
1421                                "Network resources may be unavailable"));
1422                 _pam_log_debug(ctx, LOG_DEBUG,
1423                                "User %s logged on using cached credentials\n",
1424                                username);
1425         }
1426 }
1427
1428 /**
1429  * Send PAM_ERROR_MSG for krb5 errors.
1430  *
1431  * @param ctx PAM winbind context.
1432  * @param username User in PAM request.
1433  * @param info3_user_flgs Info3 flags containing logon type bits.
1434  *
1435  * @return void.
1436  */
1437
1438 static void _pam_warn_krb5_failure(struct pwb_context *ctx,
1439                                    const char *username,
1440                                    uint32_t info3_user_flgs)
1441 {
1442         if (PAM_WB_KRB5_CLOCK_SKEW(info3_user_flgs)) {
1443                 _make_remark(ctx, PAM_ERROR_MSG,
1444                              _("Failed to establish your Kerberos Ticket cache "
1445                                "due time differences\n"
1446                                "with the domain controller.  "
1447                                "Please verify the system time.\n"));
1448                 _pam_log_debug(ctx, LOG_DEBUG,
1449                                "User %s: Clock skew when getting Krb5 TGT\n",
1450                                username);
1451         }
1452 }
1453
1454 static bool _pam_check_remark_auth_err(struct pwb_context *ctx,
1455                                        const struct wbcAuthErrorInfo *e,
1456                                        const char *nt_status_string,
1457                                        int *pam_err)
1458 {
1459         const char *ntstatus = NULL;
1460         const char *error_string = NULL;
1461
1462         if (!e || !pam_err) {
1463                 return false;
1464         }
1465
1466         ntstatus = e->nt_string;
1467         if (!ntstatus) {
1468                 return false;
1469         }
1470
1471         if (strcasecmp(ntstatus, nt_status_string) == 0) {
1472
1473                 error_string = _get_ntstatus_error_string(nt_status_string);
1474                 if (error_string) {
1475                         _make_remark(ctx, PAM_ERROR_MSG, error_string);
1476                         *pam_err = e->pam_error;
1477                         return true;
1478                 }
1479
1480                 if (e->display_string) {
1481                         _make_remark(ctx, PAM_ERROR_MSG, _(e->display_string));
1482                         *pam_err = e->pam_error;
1483                         return true;
1484                 }
1485
1486                 _make_remark(ctx, PAM_ERROR_MSG, nt_status_string);
1487                 *pam_err = e->pam_error;
1488
1489                 return true;
1490         }
1491
1492         return false;
1493 };
1494
1495 /**
1496  * Compose Password Restriction String for a PAM_ERROR_MSG conversation.
1497  *
1498  * @param i The wbcUserPasswordPolicyInfo struct.
1499  *
1500  * @return string (caller needs to talloc_free).
1501  */
1502
1503 static char *_pam_compose_pwd_restriction_string(struct pwb_context *ctx,
1504                                                  struct wbcUserPasswordPolicyInfo *i)
1505 {
1506         char *str = NULL;
1507
1508         if (!i) {
1509                 goto failed;
1510         }
1511
1512         str = talloc_asprintf(ctx, _("Your password "));
1513         if (!str) {
1514                 goto failed;
1515         }
1516
1517         if (i->min_length_password > 0) {
1518                 str = talloc_asprintf_append(str,
1519                                _("must be at least %d characters; "),
1520                                i->min_length_password);
1521                 if (!str) {
1522                         goto failed;
1523                 }
1524         }
1525
1526         if (i->password_history > 0) {
1527                 str = talloc_asprintf_append(str,
1528                                _("cannot repeat any of your previous %d "
1529                                 "passwords; "),
1530                                i->password_history);
1531                 if (!str) {
1532                         goto failed;
1533                 }
1534         }
1535
1536         if (i->password_properties & WBC_DOMAIN_PASSWORD_COMPLEX) {
1537                 str = talloc_asprintf_append(str,
1538                                _("must contain capitals, numerals "
1539                                  "or punctuation; "
1540                                  "and cannot contain your account "
1541                                  "or full name; "));
1542                 if (!str) {
1543                         goto failed;
1544                 }
1545         }
1546
1547         str = talloc_asprintf_append(str,
1548                        _("Please type a different password. "
1549                          "Type a password which meets these requirements in "
1550                          "both text boxes."));
1551         if (!str) {
1552                 goto failed;
1553         }
1554
1555         return str;
1556
1557  failed:
1558         TALLOC_FREE(str);
1559         return NULL;
1560 }
1561
1562 static int _pam_create_homedir(struct pwb_context *ctx,
1563                                const char *dirname,
1564                                mode_t mode)
1565 {
1566         struct stat sbuf;
1567
1568         if (stat(dirname, &sbuf) == 0) {
1569                 return PAM_SUCCESS;
1570         }
1571
1572         if (mkdir(dirname, mode) != 0) {
1573
1574                 _make_remark_format(ctx, PAM_TEXT_INFO,
1575                                     _("Creating directory: %s failed: %s"),
1576                                     dirname, strerror(errno));
1577                 _pam_log(ctx, LOG_ERR, "could not create dir: %s (%s)",
1578                  dirname, strerror(errno));
1579                  return PAM_PERM_DENIED;
1580         }
1581
1582         return PAM_SUCCESS;
1583 }
1584
1585 static int _pam_chown_homedir(struct pwb_context *ctx,
1586                               const char *dirname,
1587                               uid_t uid,
1588                               gid_t gid)
1589 {
1590         if (chown(dirname, uid, gid) != 0) {
1591                 _pam_log(ctx, LOG_ERR, "failed to chown user homedir: %s (%s)",
1592                          dirname, strerror(errno));
1593                 return PAM_PERM_DENIED;
1594         }
1595
1596         return PAM_SUCCESS;
1597 }
1598
1599 static int _pam_mkhomedir(struct pwb_context *ctx)
1600 {
1601         struct passwd *pwd = NULL;
1602         char *token = NULL;
1603         char *create_dir = NULL;
1604         char *user_dir = NULL;
1605         int ret;
1606         const char *username;
1607         mode_t mode = 0700;
1608         char *safe_ptr = NULL;
1609         char *p = NULL;
1610
1611         /* Get the username */
1612         ret = pam_get_user(ctx->pamh, &username, NULL);
1613         if ((ret != PAM_SUCCESS) || (!username)) {
1614                 _pam_log_debug(ctx, LOG_DEBUG, "can not get the username");
1615                 return PAM_SERVICE_ERR;
1616         }
1617
1618         pwd = getpwnam(username);
1619         if (pwd == NULL) {
1620                 _pam_log_debug(ctx, LOG_DEBUG, "can not get the username");
1621                 return PAM_USER_UNKNOWN;
1622         }
1623         _pam_log_debug(ctx, LOG_DEBUG, "homedir is: %s", pwd->pw_dir);
1624
1625         ret = _pam_create_homedir(ctx, pwd->pw_dir, 0700);
1626         if (ret == PAM_SUCCESS) {
1627                 ret = _pam_chown_homedir(ctx, pwd->pw_dir,
1628                                          pwd->pw_uid,
1629                                          pwd->pw_gid);
1630         }
1631
1632         if (ret == PAM_SUCCESS) {
1633                 return ret;
1634         }
1635
1636         /* maybe we need to create parent dirs */
1637         create_dir = talloc_strdup(ctx, "/");
1638         if (!create_dir) {
1639                 return PAM_BUF_ERR;
1640         }
1641
1642         /* find final directory */
1643         user_dir = strrchr(pwd->pw_dir, '/');
1644         if (!user_dir) {
1645                 return PAM_BUF_ERR;
1646         }
1647         user_dir++;
1648
1649         _pam_log(ctx, LOG_DEBUG, "final directory: %s", user_dir);
1650
1651         p = pwd->pw_dir;
1652
1653         while ((token = strtok_r(p, "/", &safe_ptr)) != NULL) {
1654
1655                 mode = 0755;
1656
1657                 p = NULL;
1658
1659                 _pam_log_debug(ctx, LOG_DEBUG, "token is %s", token);
1660
1661                 create_dir = talloc_asprintf_append(create_dir, "%s/", token);
1662                 if (!create_dir) {
1663                         return PAM_BUF_ERR;
1664                 }
1665                 _pam_log_debug(ctx, LOG_DEBUG, "current_dir is %s", create_dir);
1666
1667                 if (strcmp(token, user_dir) == 0) {
1668                         _pam_log_debug(ctx, LOG_DEBUG, "assuming last directory: %s", token);
1669                         mode = 0700;
1670                 }
1671
1672                 ret = _pam_create_homedir(ctx, create_dir, mode);
1673                 if (ret != PAM_SUCCESS) {
1674                         return ret;
1675                 }
1676         }
1677
1678         return _pam_chown_homedir(ctx, create_dir,
1679                                   pwd->pw_uid,
1680                                   pwd->pw_gid);
1681 }
1682
1683 /* talk to winbindd */
1684 static int winbind_auth_request(struct pwb_context *ctx,
1685                                 const char *user,
1686                                 const char *pass,
1687                                 const char *member,
1688                                 const char *cctype,
1689                                 const int warn_pwd_expire,
1690                                 struct wbcAuthErrorInfo **p_error,
1691                                 struct wbcLogonUserInfo **p_info,
1692                                 struct wbcUserPasswordPolicyInfo **p_policy,
1693                                 time_t *pwd_last_set,
1694                                 char **user_ret)
1695 {
1696         wbcErr wbc_status;
1697
1698         struct wbcLogonUserParams logon;
1699         char membership_of[1024];
1700         uid_t user_uid = -1;
1701         uint32_t flags = WBFLAG_PAM_INFO3_TEXT |
1702                          WBFLAG_PAM_GET_PWD_POLICY;
1703
1704         struct wbcLogonUserInfo *info = NULL;
1705         struct wbcAuthUserInfo *user_info = NULL;
1706         struct wbcAuthErrorInfo *error = NULL;
1707         struct wbcUserPasswordPolicyInfo *policy = NULL;
1708
1709         int ret = PAM_AUTH_ERR;
1710         int i;
1711         const char *codes[] = {
1712                 "NT_STATUS_PASSWORD_EXPIRED",
1713                 "NT_STATUS_PASSWORD_MUST_CHANGE",
1714                 "NT_STATUS_INVALID_WORKSTATION",
1715                 "NT_STATUS_INVALID_LOGON_HOURS",
1716                 "NT_STATUS_ACCOUNT_EXPIRED",
1717                 "NT_STATUS_ACCOUNT_DISABLED",
1718                 "NT_STATUS_ACCOUNT_LOCKED_OUT",
1719                 "NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
1720                 "NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT",
1721                 "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
1722                 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
1723                 "NT_STATUS_NO_LOGON_SERVERS",
1724                 "NT_STATUS_WRONG_PASSWORD",
1725                 "NT_STATUS_ACCESS_DENIED"
1726         };
1727
1728         if (pwd_last_set) {
1729                 *pwd_last_set = 0;
1730         }
1731
1732         /* Krb5 auth always has to go against the KDC of the user's realm */
1733
1734         if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1735                 flags           |= WBFLAG_PAM_CONTACT_TRUSTDOM;
1736         }
1737
1738         if (ctx->ctrl & (WINBIND_KRB5_AUTH|WINBIND_CACHED_LOGIN)) {
1739                 struct passwd *pwd = NULL;
1740
1741                 pwd = getpwnam(user);
1742                 if (pwd == NULL) {
1743                         return PAM_USER_UNKNOWN;
1744                 }
1745                 user_uid        = pwd->pw_uid;
1746         }
1747
1748         if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1749
1750                 _pam_log_debug(ctx, LOG_DEBUG,
1751                                "enabling krb5 login flag\n");
1752
1753                 flags           |= WBFLAG_PAM_KRB5 |
1754                                    WBFLAG_PAM_FALLBACK_AFTER_KRB5;
1755         }
1756
1757         if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
1758                 _pam_log_debug(ctx, LOG_DEBUG,
1759                                "enabling cached login flag\n");
1760                 flags           |= WBFLAG_PAM_CACHED_LOGIN;
1761         }
1762
1763         if (user_ret) {
1764                 *user_ret = NULL;
1765                 flags           |= WBFLAG_PAM_UNIX_NAME;
1766         }
1767
1768         if (cctype != NULL) {
1769                 _pam_log_debug(ctx, LOG_DEBUG,
1770                                "enabling request for a %s krb5 ccache\n",
1771                                cctype);
1772         }
1773
1774         if (member != NULL) {
1775
1776                 ZERO_STRUCT(membership_of);
1777
1778                 if (!winbind_name_list_to_sid_string_list(ctx, user, member,
1779                                                           membership_of,
1780                                                           sizeof(membership_of))) {
1781                         _pam_log_debug(ctx, LOG_ERR,
1782                                        "failed to serialize membership of sid "
1783                                        "\"%s\"\n", member);
1784                         return PAM_AUTH_ERR;
1785                 }
1786         }
1787
1788         ZERO_STRUCT(logon);
1789
1790         logon.username                  = user;
1791         logon.password                  = pass;
1792
1793         if (cctype) {
1794                 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1795                                              &logon.blobs,
1796                                              "krb5_cc_type",
1797                                              0,
1798                                              discard_const_p(uint8_t, cctype),
1799                                              strlen(cctype)+1);
1800                 if (!WBC_ERROR_IS_OK(wbc_status)) {
1801                         goto done;
1802                 }
1803         }
1804
1805         wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1806                                      &logon.blobs,
1807                                      "flags",
1808                                      0,
1809                                      (uint8_t *)&flags,
1810                                      sizeof(flags));
1811         if (!WBC_ERROR_IS_OK(wbc_status)) {
1812                 goto done;
1813         }
1814
1815         wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1816                                      &logon.blobs,
1817                                      "user_uid",
1818                                      0,
1819                                      (uint8_t *)&user_uid,
1820                                      sizeof(user_uid));
1821         if (!WBC_ERROR_IS_OK(wbc_status)) {
1822                 goto done;
1823         }
1824
1825         if (member) {
1826                 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1827                                              &logon.blobs,
1828                                              "membership_of",
1829                                              0,
1830                                              (uint8_t *)membership_of,
1831                                              sizeof(membership_of));
1832                 if (!WBC_ERROR_IS_OK(wbc_status)) {
1833                         goto done;
1834                 }
1835         }
1836
1837         wbc_status = wbcCtxLogonUser(ctx->wbc_ctx,
1838                                      &logon,
1839                                      &info,
1840                                      &error,
1841                                      &policy);
1842         ret = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
1843                                           user, "wbcLogonUser");
1844         wbcFreeMemory(logon.blobs);
1845         logon.blobs = NULL;
1846
1847         if (info && info->info) {
1848                 user_info = info->info;
1849         }
1850
1851         if (pwd_last_set && user_info) {
1852                 *pwd_last_set = user_info->pass_last_set_time;
1853         }
1854
1855         if (p_info && info) {
1856                 *p_info = info;
1857         }
1858
1859         if (p_policy && policy) {
1860                 *p_policy = policy;
1861         }
1862
1863         if (p_error && error) {
1864                 /* We want to process the error in the caller. */
1865                 *p_error = error;
1866                 return ret;
1867         }
1868
1869         for (i=0; i<ARRAY_SIZE(codes); i++) {
1870                 int _ret = ret;
1871                 if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
1872                         ret = _ret;
1873                         goto done;
1874                 }
1875         }
1876
1877         if ((ret == PAM_SUCCESS) && user_info && policy && info) {
1878
1879                 bool already_expired = false;
1880                 bool change_pwd = false;
1881
1882                 /* warn a user if the password is about to expire soon */
1883                 _pam_warn_password_expiry(ctx, user_info, policy,
1884                                           warn_pwd_expire,
1885                                           &already_expired,
1886                                           &change_pwd);
1887
1888                 if (already_expired == true) {
1889
1890                         SMB_TIME_T last_set = user_info->pass_last_set_time;
1891
1892                         _pam_log_debug(ctx, LOG_DEBUG,
1893                                        "Password has expired "
1894                                        "(Password was last set: %lld, "
1895                                        "the policy says it should expire here "
1896                                        "%lld (now it's: %ld))\n",
1897                                        (long long int)last_set,
1898                                        (long long int)last_set +
1899                                        policy->expire,
1900                                        (long)time(NULL));
1901
1902                         return PAM_AUTHTOK_EXPIRED;
1903                 }
1904
1905                 if (change_pwd) {
1906                         ret = PAM_NEW_AUTHTOK_REQD;
1907                         goto done;
1908                 }
1909
1910                 /* inform about logon type */
1911                 _pam_warn_logon_type(ctx, user, user_info->user_flags);
1912
1913                 /* inform about krb5 failures */
1914                 _pam_warn_krb5_failure(ctx, user, user_info->user_flags);
1915
1916                 /* set some info3 info for other modules in the stack */
1917                 _pam_set_data_info3(ctx, user_info);
1918
1919                 /* put krb5ccname into env */
1920                 _pam_setup_krb5_env(ctx, info);
1921
1922                 /* If winbindd returned a username, return the pointer to it
1923                  * here. */
1924                 _pam_setup_unix_username(ctx, user_ret, info);
1925         }
1926
1927  done:
1928         wbcFreeMemory(logon.blobs);
1929         if (info && info->blobs && !p_info) {
1930                 wbcFreeMemory(info->blobs);
1931         }
1932         if (error && !p_error) {
1933                 wbcFreeMemory(error);
1934         }
1935         if (info && !p_info) {
1936                 wbcFreeMemory(info);
1937         }
1938         if (policy && !p_policy) {
1939                 wbcFreeMemory(policy);
1940         }
1941
1942         return ret;
1943 }
1944
1945 /* talk to winbindd */
1946 static int winbind_chauthtok_request(struct pwb_context *ctx,
1947                                      const char *user,
1948                                      const char *oldpass,
1949                                      const char *newpass,
1950                                      time_t pwd_last_set)
1951 {
1952         wbcErr wbc_status;
1953         struct wbcChangePasswordParams params;
1954         struct wbcAuthErrorInfo *error = NULL;
1955         struct wbcUserPasswordPolicyInfo *policy = NULL;
1956         enum wbcPasswordChangeRejectReason reject_reason = -1;
1957         uint32_t flags = 0;
1958
1959         int i;
1960         const char *codes[] = {
1961                 "NT_STATUS_BACKUP_CONTROLLER",
1962                 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
1963                 "NT_STATUS_NO_LOGON_SERVERS",
1964                 "NT_STATUS_ACCESS_DENIED",
1965                 "NT_STATUS_PWD_TOO_SHORT", /* TODO: tell the min pwd length ? */
1966                 "NT_STATUS_PWD_TOO_RECENT", /* TODO: tell the minage ? */
1967                 "NT_STATUS_PWD_HISTORY_CONFLICT" /* TODO: tell the history length ? */
1968         };
1969         int ret = PAM_AUTH_ERR;
1970
1971         ZERO_STRUCT(params);
1972
1973         if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1974                 flags |= WBFLAG_PAM_KRB5 |
1975                          WBFLAG_PAM_CONTACT_TRUSTDOM;
1976         }
1977
1978         if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
1979                 flags |= WBFLAG_PAM_CACHED_LOGIN;
1980         }
1981
1982         params.account_name             = user;
1983         params.level                    = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
1984         params.old_password.plaintext   = oldpass;
1985         params.new_password.plaintext   = newpass;
1986         params.flags                    = flags;
1987
1988         wbc_status = wbcCtxChangeUserPasswordEx(ctx->wbc_ctx,
1989                                                 &params,
1990                                                 &error,
1991                                                 &reject_reason,
1992                                                 &policy);
1993         ret = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
1994                                           user, "wbcChangeUserPasswordEx");
1995
1996         if (WBC_ERROR_IS_OK(wbc_status)) {
1997                 _pam_log(ctx, LOG_NOTICE,
1998                          "user '%s' password changed", user);
1999                 return PAM_SUCCESS;
2000         }
2001
2002         if (!error) {
2003                 wbcFreeMemory(policy);
2004                 return ret;
2005         }
2006
2007         for (i=0; i<ARRAY_SIZE(codes); i++) {
2008                 int _ret = ret;
2009                 if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
2010                         ret = _ret;
2011                         goto done;
2012                 }
2013         }
2014
2015         if (!strcasecmp(error->nt_string,
2016                         "NT_STATUS_PASSWORD_RESTRICTION")) {
2017
2018                 char *pwd_restriction_string = NULL;
2019                 SMB_TIME_T min_pwd_age = 0;
2020
2021                 if (policy) {
2022                         min_pwd_age     = policy->min_passwordage;
2023                 }
2024
2025                 /* FIXME: avoid to send multiple PAM messages after another */
2026                 switch ((int)reject_reason) {
2027                         case -1:
2028                                 break;
2029                         case WBC_PWD_CHANGE_NO_ERROR:
2030                                 if ((min_pwd_age > 0) &&
2031                                     (pwd_last_set + min_pwd_age > time(NULL))) {
2032                                         PAM_WB_REMARK_DIRECT(ctx,
2033                                              "NT_STATUS_PWD_TOO_RECENT");
2034                                 }
2035                                 break;
2036                         case WBC_PWD_CHANGE_PASSWORD_TOO_SHORT:
2037                                 PAM_WB_REMARK_DIRECT(ctx,
2038                                         "NT_STATUS_PWD_TOO_SHORT");
2039                                 break;
2040                         case WBC_PWD_CHANGE_PWD_IN_HISTORY:
2041                                 PAM_WB_REMARK_DIRECT(ctx,
2042                                         "NT_STATUS_PWD_HISTORY_CONFLICT");
2043                                 break;
2044                         case WBC_PWD_CHANGE_NOT_COMPLEX:
2045                                 _make_remark(ctx, PAM_ERROR_MSG,
2046                                              _("Password does not meet "
2047                                                "complexity requirements"));
2048                                 break;
2049                         default:
2050                                 _pam_log_debug(ctx, LOG_DEBUG,
2051                                                "unknown password change "
2052                                                "reject reason: %d",
2053                                                reject_reason);
2054                                 break;
2055                 }
2056
2057                 pwd_restriction_string =
2058                         _pam_compose_pwd_restriction_string(ctx, policy);
2059                 if (pwd_restriction_string) {
2060                         _make_remark(ctx, PAM_ERROR_MSG,
2061                                      pwd_restriction_string);
2062                         TALLOC_FREE(pwd_restriction_string);
2063                 }
2064         }
2065  done:
2066         wbcFreeMemory(error);
2067         wbcFreeMemory(policy);
2068
2069         return ret;
2070 }
2071
2072 /*
2073  * Checks if a user has an account
2074  *
2075  * return values:
2076  *       1  = User not found
2077  *       0  = OK
2078  *      -1  = System error
2079  */
2080 static int valid_user(struct pwb_context *ctx,
2081                       const char *user)
2082 {
2083         /* check not only if the user is available over NSS calls, also make
2084          * sure it's really a winbind user, this is important when stacking PAM
2085          * modules in the 'account' or 'password' facility. */
2086
2087         wbcErr wbc_status;
2088         struct passwd *pwd = NULL;
2089         struct passwd *wb_pwd = NULL;
2090
2091         pwd = getpwnam(user);
2092         if (pwd == NULL) {
2093                 return 1;
2094         }
2095
2096         wbc_status = wbcCtxGetpwnam(ctx->wbc_ctx, user, &wb_pwd);
2097         wbcFreeMemory(wb_pwd);
2098         if (!WBC_ERROR_IS_OK(wbc_status)) {
2099                 _pam_log(ctx, LOG_DEBUG, "valid_user: wbcGetpwnam gave %s\n",
2100                         wbcErrorString(wbc_status));
2101         }
2102
2103         switch (wbc_status) {
2104                 case WBC_ERR_UNKNOWN_USER:
2105                 /* match other insane libwbclient return codes */
2106                 case WBC_ERR_WINBIND_NOT_AVAILABLE:
2107                 case WBC_ERR_DOMAIN_NOT_FOUND:
2108                         return 1;
2109                 case WBC_ERR_SUCCESS:
2110                         return 0;
2111                 default:
2112                         break;
2113         }
2114         return -1;
2115 }
2116
2117 static char *_pam_delete(register char *xx)
2118 {
2119         _pam_overwrite(xx);
2120         _pam_drop(xx);
2121         return NULL;
2122 }
2123
2124 /*
2125  * obtain a password from the user
2126  */
2127
2128 static int _winbind_read_password(struct pwb_context *ctx,
2129                                   unsigned int ctrl,
2130                                   const char *comment,
2131                                   const char *prompt1,
2132                                   const char *prompt2,
2133                                   const char **pass)
2134 {
2135         int authtok_flag;
2136         int retval;
2137         const char *item;
2138         char *token;
2139
2140         _pam_log(ctx, LOG_DEBUG, "getting password (0x%08x)", ctrl);
2141
2142         /*
2143          * make sure nothing inappropriate gets returned
2144          */
2145
2146         *pass = token = NULL;
2147
2148         /*
2149          * which authentication token are we getting?
2150          */
2151
2152         if (on(WINBIND__OLD_PASSWORD, ctrl)) {
2153                 authtok_flag = PAM_OLDAUTHTOK;
2154         } else {
2155                 authtok_flag = PAM_AUTHTOK;
2156         }
2157
2158         /*
2159          * should we obtain the password from a PAM item ?
2160          */
2161
2162         if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) ||
2163             on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
2164                 retval = pam_get_item(ctx->pamh,
2165                                       authtok_flag,
2166                                       (const void **) &item);
2167                 if (retval != PAM_SUCCESS) {
2168                         /* very strange. */
2169                         _pam_log(ctx, LOG_ALERT,
2170                                  "pam_get_item returned error "
2171                                  "to unix-read-password");
2172                         return retval;
2173                 } else if (item != NULL) {      /* we have a password! */
2174                         *pass = item;
2175                         item = NULL;
2176                         _pam_log(ctx, LOG_DEBUG,
2177                                  "pam_get_item returned a password");
2178                         return PAM_SUCCESS;
2179                 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
2180                         return PAM_AUTHTOK_RECOVER_ERR; /* didn't work */
2181                 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
2182                            && off(WINBIND__OLD_PASSWORD, ctrl)) {
2183                         return PAM_AUTHTOK_RECOVER_ERR;
2184                 }
2185         }
2186         /*
2187          * getting here implies we will have to get the password from the
2188          * user directly.
2189          */
2190
2191         {
2192                 struct pam_message msg[3], *pmsg[3];
2193                 struct pam_response *resp;
2194                 int i, replies;
2195
2196                 /* prepare to converse */
2197
2198                 if (comment != NULL && off(ctrl, WINBIND_SILENT)) {
2199                         pmsg[0] = &msg[0];
2200                         msg[0].msg_style = PAM_TEXT_INFO;
2201                         msg[0].msg = discard_const_p(char, comment);
2202                         i = 1;
2203                 } else {
2204                         i = 0;
2205                 }
2206
2207                 pmsg[i] = &msg[i];
2208                 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
2209                 msg[i++].msg = discard_const_p(char, prompt1);
2210                 replies = 1;
2211
2212                 if (prompt2 != NULL) {
2213                         pmsg[i] = &msg[i];
2214                         msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
2215                         msg[i++].msg = discard_const_p(char, prompt2);
2216                         ++replies;
2217                 }
2218                 /* so call the conversation expecting i responses */
2219                 resp = NULL;
2220                 retval = converse(ctx->pamh, i, pmsg, &resp);
2221                 if (resp == NULL) {
2222                         if (retval == PAM_SUCCESS) {
2223                                 retval = PAM_AUTHTOK_RECOVER_ERR;
2224                         }
2225                         goto done;
2226                 }
2227                 if (retval != PAM_SUCCESS) {
2228                         _pam_drop_reply(resp, i);
2229                         goto done;
2230                 }
2231
2232                 /* interpret the response */
2233
2234                 token = x_strdup(resp[i - replies].resp);
2235                 if (!token) {
2236                         _pam_log(ctx, LOG_NOTICE,
2237                                  "could not recover "
2238                                  "authentication token");
2239                         retval = PAM_AUTHTOK_RECOVER_ERR;
2240                         goto done;
2241                 }
2242
2243                 if (replies == 2) {
2244                         /* verify that password entered correctly */
2245                         if (!resp[i - 1].resp ||
2246                             strcmp(token, resp[i - 1].resp)) {
2247                                 _pam_delete(token);     /* mistyped */
2248                                 retval = PAM_AUTHTOK_RECOVER_ERR;
2249                                 _make_remark(ctx, PAM_ERROR_MSG,
2250                                              MISTYPED_PASS);
2251                         }
2252                 }
2253
2254                 /*
2255                  * tidy up the conversation (resp_retcode) is ignored
2256                  * -- what is it for anyway? AGM
2257                  */
2258                 _pam_drop_reply(resp, i);
2259         }
2260
2261  done:
2262         if (retval != PAM_SUCCESS) {
2263                 _pam_log_debug(ctx, LOG_DEBUG,
2264                                "unable to obtain a password");
2265                 return retval;
2266         }
2267         /* 'token' is the entered password */
2268
2269         /* we store this password as an item */
2270
2271         retval = pam_set_item(ctx->pamh, authtok_flag, token);
2272         _pam_delete(token);     /* clean it up */
2273         if (retval != PAM_SUCCESS ||
2274             (retval = pam_get_item(ctx->pamh, authtok_flag, (const void **) &item)) != PAM_SUCCESS) {
2275
2276                 _pam_log(ctx, LOG_CRIT, "error manipulating password");
2277                 return retval;
2278
2279         }
2280
2281         *pass = item;
2282         item = NULL;            /* break link to password */
2283
2284         return PAM_SUCCESS;
2285 }
2286
2287 static const char *get_conf_item_string(struct pwb_context *ctx,
2288                                         const char *item,
2289                                         int config_flag)
2290 {
2291         int i = 0;
2292         const char *parm_opt = NULL;
2293
2294         if (!(ctx->ctrl & config_flag)) {
2295                 goto out;
2296         }
2297
2298         /* let the pam opt take precedence over the pam_winbind.conf option */
2299         for (i=0; i<ctx->argc; i++) {
2300
2301                 if ((strncmp(ctx->argv[i], item, strlen(item)) == 0)) {
2302                         char *p;
2303
2304                         if ((p = strchr(ctx->argv[i], '=')) == NULL) {
2305                                 _pam_log(ctx, LOG_INFO,
2306                                          "no \"=\" delimiter for \"%s\" found\n",
2307                                          item);
2308                                 goto out;
2309                         }
2310                         _pam_log_debug(ctx, LOG_INFO,
2311                                        "PAM config: %s '%s'\n", item, p+1);
2312                         return p + 1;
2313                 }
2314         }
2315
2316         if (ctx->dict) {
2317                 char *key = NULL;
2318
2319                 key = talloc_asprintf(ctx, "global:%s", item);
2320                 if (!key) {
2321                         goto out;
2322                 }
2323
2324                 parm_opt = tiniparser_getstring_nonempty(ctx->dict, key, NULL);
2325                 TALLOC_FREE(key);
2326
2327                 _pam_log_debug(ctx, LOG_INFO, "CONFIG file: %s '%s'\n",
2328                                item, parm_opt);
2329         }
2330 out:
2331         return parm_opt;
2332 }
2333
2334 static int get_config_item_int(struct pwb_context *ctx,
2335                                const char *item,
2336                                int config_flag)
2337 {
2338         int i, parm_opt = -1;
2339
2340         if (!(ctx->ctrl & config_flag)) {
2341                 goto out;
2342         }
2343
2344         /* let the pam opt take precedence over the pam_winbind.conf option */
2345         for (i = 0; i < ctx->argc; i++) {
2346
2347                 if ((strncmp(ctx->argv[i], item, strlen(item)) == 0)) {
2348                         char *p;
2349
2350                         if ((p = strchr(ctx->argv[i], '=')) == NULL) {
2351                                 _pam_log(ctx, LOG_INFO,
2352                                          "no \"=\" delimiter for \"%s\" found\n",
2353                                          item);
2354                                 goto out;
2355                         }
2356                         parm_opt = atoi(p + 1);
2357                         _pam_log_debug(ctx, LOG_INFO,
2358                                        "PAM config: %s '%d'\n",
2359                                        item, parm_opt);
2360                         return parm_opt;
2361                 }
2362         }
2363
2364         if (ctx->dict) {
2365                 char *key = NULL;
2366
2367                 key = talloc_asprintf(ctx, "global:%s", item);
2368                 if (!key) {
2369                         goto out;
2370                 }
2371
2372                 parm_opt = tiniparser_getint(ctx->dict, key, -1);
2373                 TALLOC_FREE(key);
2374
2375                 _pam_log_debug(ctx, LOG_INFO,
2376                                "CONFIG file: %s '%d'\n",
2377                                item, parm_opt);
2378         }
2379 out:
2380         return parm_opt;
2381 }
2382
2383 static const char *get_krb5_cc_type_from_config(struct pwb_context *ctx)
2384 {
2385         return get_conf_item_string(ctx, "krb5_ccache_type",
2386                                     WINBIND_KRB5_CCACHE_TYPE);
2387 }
2388
2389 static const char *get_member_from_config(struct pwb_context *ctx)
2390 {
2391         const char *ret = NULL;
2392         ret = get_conf_item_string(ctx, "require_membership_of",
2393                                    WINBIND_REQUIRED_MEMBERSHIP);
2394         if (ret != NULL) {
2395                 return ret;
2396         }
2397         return get_conf_item_string(ctx, "require-membership-of",
2398                                     WINBIND_REQUIRED_MEMBERSHIP);
2399 }
2400
2401 static int get_warn_pwd_expire_from_config(struct pwb_context *ctx)
2402 {
2403         int ret;
2404         ret = get_config_item_int(ctx, "warn_pwd_expire",
2405                                   WINBIND_WARN_PWD_EXPIRE);
2406         /* no or broken setting */
2407         if (ret < 0) {
2408                 return DEFAULT_DAYS_TO_WARN_BEFORE_PWD_EXPIRES;
2409         }
2410         return ret;
2411 }
2412
2413 /**
2414  * Retrieve the winbind separator.
2415  *
2416  * @param ctx PAM winbind context.
2417  *
2418  * @return string separator character. NULL on failure.
2419  */
2420
2421 static char winbind_get_separator(struct pwb_context *ctx)
2422 {
2423         wbcErr wbc_status;
2424         static struct wbcInterfaceDetails *details = NULL;
2425
2426         wbc_status = wbcCtxInterfaceDetails(ctx->wbc_ctx, &details);
2427         if (!WBC_ERROR_IS_OK(wbc_status)) {
2428                 _pam_log(ctx, LOG_ERR,
2429                          "Could not retrieve winbind interface details: %s",
2430                          wbcErrorString(wbc_status));
2431                 return '\0';
2432         }
2433
2434         if (!details) {
2435                 return '\0';
2436         }
2437
2438         return details->winbind_separator;
2439 }
2440
2441
2442 /**
2443  * Convert a upn to a name.
2444  *
2445  * @param ctx PAM winbind context.
2446  * @param upn  User UPN to be translated.
2447  *
2448  * @return converted name. NULL pointer on failure. Caller needs to free.
2449  */
2450
2451 static char* winbind_upn_to_username(struct pwb_context *ctx,
2452                                      const char *upn)
2453 {
2454         char sep;
2455         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
2456         struct wbcDomainSid sid;
2457         enum wbcSidType type;
2458         char *domain = NULL;
2459         char *name;
2460         char *p;
2461         char *result;
2462
2463         /* This cannot work when the winbind separator = @ */
2464
2465         sep = winbind_get_separator(ctx);
2466         if (!sep || sep == '@') {
2467                 return NULL;
2468         }
2469
2470         name = talloc_strdup(ctx, upn);
2471         if (!name) {
2472                 return NULL;
2473         }
2474         if ((p = strchr(name, '@')) != NULL) {
2475                 *p = 0;
2476                 domain = p + 1;
2477         }
2478
2479         /* Convert the UPN to a SID */
2480
2481         wbc_status = wbcCtxLookupName(ctx->wbc_ctx, domain, name, &sid, &type);
2482         if (!WBC_ERROR_IS_OK(wbc_status)) {
2483                 return NULL;
2484         }
2485
2486         /* Convert the the SID back to the sAMAccountName */
2487
2488         wbc_status = wbcCtxLookupSid(ctx->wbc_ctx, &sid, &domain, &name, &type);
2489         if (!WBC_ERROR_IS_OK(wbc_status)) {
2490                 return NULL;
2491         }
2492
2493         result = talloc_asprintf(ctx, "%s%c%s", domain, sep, name);
2494         wbcFreeMemory(domain);
2495         wbcFreeMemory(name);
2496         return result;
2497 }
2498
2499 static int _pam_delete_cred(pam_handle_t *pamh, int flags,
2500                             int argc, enum pam_winbind_request_type type,
2501                             const char **argv)
2502 {
2503         int retval = PAM_SUCCESS;
2504         struct pwb_context *ctx = NULL;
2505         struct wbcLogoffUserParams logoff;
2506         struct wbcAuthErrorInfo *error = NULL;
2507         const char *user;
2508         wbcErr wbc_status = WBC_ERR_SUCCESS;
2509
2510         ZERO_STRUCT(logoff);
2511
2512         retval = _pam_winbind_init_context(pamh, flags, argc, argv, type, &ctx);
2513         if (retval != PAM_SUCCESS) {
2514                 return retval;
2515         }
2516
2517         _PAM_LOG_FUNCTION_ENTER("_pam_delete_cred", ctx);
2518
2519         if (ctx->ctrl & WINBIND_KRB5_AUTH) {
2520
2521                 /* destroy the ccache here */
2522
2523                 uint32_t wbc_flags = 0;
2524                 const char *ccname = NULL;
2525                 struct passwd *pwd = NULL;
2526
2527                 retval = pam_get_user(pamh, &user, _("Username: "));
2528                 if (retval != PAM_SUCCESS) {
2529                         _pam_log(ctx, LOG_ERR,
2530                                  "could not identify user");
2531                         goto out;
2532                 }
2533
2534                 if (user == NULL) {
2535                         _pam_log(ctx, LOG_ERR,
2536                                  "username was NULL!");
2537                         retval = PAM_USER_UNKNOWN;
2538                         goto out;
2539                 }
2540
2541                 _pam_log_debug(ctx, LOG_DEBUG,
2542                                "username [%s] obtained", user);
2543
2544                 ccname = pam_getenv(pamh, "KRB5CCNAME");
2545                 if (ccname == NULL) {
2546                         _pam_log_debug(ctx, LOG_DEBUG,
2547                                        "user has no KRB5CCNAME environment");
2548                 }
2549
2550                 pwd = getpwnam(user);
2551                 if (pwd == NULL) {
2552                         retval = PAM_USER_UNKNOWN;
2553                         goto out;
2554                 }
2555
2556                 wbc_flags = WBFLAG_PAM_KRB5 |
2557                         WBFLAG_PAM_CONTACT_TRUSTDOM;
2558
2559                 logoff.username         = user;
2560
2561                 if (ccname) {
2562                         wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2563                                                      &logoff.blobs,
2564                                                      "ccfilename",
2565                                                      0,
2566                                                      discard_const_p(uint8_t, ccname),
2567                                                      strlen(ccname)+1);
2568                         if (!WBC_ERROR_IS_OK(wbc_status)) {
2569                                 goto out;
2570                         }
2571                 }
2572
2573                 wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2574                                              &logoff.blobs,
2575                                              "flags",
2576                                              0,
2577                                              (uint8_t *)&wbc_flags,
2578                                              sizeof(wbc_flags));
2579                 if (!WBC_ERROR_IS_OK(wbc_status)) {
2580                         goto out;
2581                 }
2582
2583                 wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2584                                              &logoff.blobs,
2585                                              "user_uid",
2586                                              0,
2587                                              (uint8_t *)&pwd->pw_uid,
2588                                              sizeof(pwd->pw_uid));
2589                 if (!WBC_ERROR_IS_OK(wbc_status)) {
2590                         goto out;
2591                 }
2592
2593                 wbc_status = wbcCtxLogoffUserEx(ctx->wbc_ctx, &logoff, &error);
2594                 retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
2595                                                      user, "wbcLogoffUser");
2596                 wbcFreeMemory(error);
2597                 wbcFreeMemory(logoff.blobs);
2598                 logoff.blobs = NULL;
2599
2600                 if (!WBC_ERROR_IS_OK(wbc_status)) {
2601                         _pam_log(ctx, LOG_INFO,
2602                                  "failed to logoff user %s: %s\n",
2603                                          user, wbcErrorString(wbc_status));
2604                 }
2605         }
2606
2607 out:
2608         if (logoff.blobs) {
2609                 wbcFreeMemory(logoff.blobs);
2610         }
2611
2612         if (!WBC_ERROR_IS_OK(wbc_status)) {
2613                 retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
2614                      user, "wbcLogoffUser");
2615         }
2616
2617         /*
2618          * Delete the krb5 ccname variable from the PAM environment
2619          * if it was set by winbind.
2620          */
2621         if ((ctx->ctrl & WINBIND_KRB5_AUTH) && pam_getenv(pamh, "KRB5CCNAME")) {
2622                 pam_putenv(pamh, "KRB5CCNAME");
2623         }
2624
2625         _PAM_LOG_FUNCTION_LEAVE("_pam_delete_cred", ctx, retval);
2626
2627         TALLOC_FREE(ctx);
2628
2629         return retval;
2630 }
2631
2632 PAM_EXTERN
2633 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
2634                         int argc, const char **argv)
2635 {
2636         const char *username;
2637         const char *password;
2638         const char *member = NULL;
2639         const char *cctype = NULL;
2640         int warn_pwd_expire;
2641         int retval = PAM_AUTH_ERR;
2642         char *username_ret = NULL;
2643         char *new_authtok_required = NULL;
2644         char *real_username = NULL;
2645         struct pwb_context *ctx = NULL;
2646
2647         retval = _pam_winbind_init_context(pamh, flags, argc, argv,
2648                                            PAM_WINBIND_AUTHENTICATE, &ctx);
2649         if (retval != PAM_SUCCESS) {
2650                 return retval;
2651         }
2652
2653         _PAM_LOG_FUNCTION_ENTER("pam_sm_authenticate", ctx);
2654
2655         /* Get the username */
2656         retval = pam_get_user(pamh, &username, NULL);
2657         if ((retval != PAM_SUCCESS) || (!username)) {
2658                 _pam_log_debug(ctx, LOG_DEBUG,
2659                                "can not get the username");
2660                 retval = PAM_SERVICE_ERR;
2661                 goto out;
2662         }
2663
2664
2665 #if defined(AIX)
2666         /* Decode the user name since AIX does not support logn user
2667            names by default.  The name is encoded as _#uid.  */
2668
2669         if (username[0] == '_') {
2670                 uid_t id = atoi(&username[1]);
2671                 struct passwd *pw = NULL;
2672
2673                 if ((id!=0) && ((pw = getpwuid(id)) != NULL)) {
2674                         real_username = strdup(pw->pw_name);
2675                 }
2676         }
2677 #endif
2678
2679         if (!real_username) {
2680                 /* Just making a copy of the username we got from PAM */
2681                 if ((real_username = strdup(username)) == NULL) {
2682                         _pam_log_debug(ctx, LOG_DEBUG,
2683                                        "memory allocation failure when copying "
2684                                        "username");
2685                         retval = PAM_SERVICE_ERR;
2686                         goto out;
2687                 }
2688         }
2689
2690         /* Maybe this was a UPN */
2691
2692         if (strchr(real_username, '@') != NULL) {
2693                 char *samaccountname = NULL;
2694
2695                 samaccountname = winbind_upn_to_username(ctx,
2696                                                          real_username);
2697                 if (samaccountname) {
2698                         free(real_username);
2699                         real_username = strdup(samaccountname);
2700                 }
2701         }
2702
2703         retval = _winbind_read_password(ctx, ctx->ctrl, NULL,
2704                                         _("Password: "), NULL,
2705                                         &password);
2706
2707         if (retval != PAM_SUCCESS) {
2708                 _pam_log(ctx, LOG_ERR,
2709                          "Could not retrieve user's password");
2710                 retval = PAM_AUTHTOK_ERR;
2711                 goto out;
2712         }
2713
2714         /* Let's not give too much away in the log file */
2715
2716 #ifdef DEBUG_PASSWORD
2717         _pam_log_debug(ctx, LOG_INFO,
2718                        "Verify user '%s' with password '%s'",
2719                        real_username, password);
2720 #else
2721         _pam_log_debug(ctx, LOG_INFO,
2722                        "Verify user '%s'", real_username);
2723 #endif
2724
2725         member = get_member_from_config(ctx);
2726         cctype = get_krb5_cc_type_from_config(ctx);
2727         warn_pwd_expire = get_warn_pwd_expire_from_config(ctx);
2728
2729         /* Now use the username to look up password */
2730         retval = winbind_auth_request(ctx, real_username, password,
2731                                       member, cctype, warn_pwd_expire,
2732                                       NULL, NULL, NULL,
2733                                       NULL, &username_ret);
2734
2735         if (retval == PAM_NEW_AUTHTOK_REQD ||
2736             retval == PAM_AUTHTOK_EXPIRED) {
2737
2738                 char *new_authtok_required_during_auth = NULL;
2739
2740                 new_authtok_required = talloc_asprintf(NULL, "%d", retval);
2741                 if (!new_authtok_required) {
2742                         retval = PAM_BUF_ERR;
2743                         goto out;
2744                 }
2745
2746                 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD,
2747                              new_authtok_required,
2748                              _pam_winbind_cleanup_func);
2749
2750                 retval = PAM_SUCCESS;
2751
2752                 new_authtok_required_during_auth = talloc_asprintf(NULL, "%d", true);
2753                 if (!new_authtok_required_during_auth) {
2754                         retval = PAM_BUF_ERR;
2755                         goto out;
2756                 }
2757
2758                 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
2759                              new_authtok_required_during_auth,
2760                              _pam_winbind_cleanup_func);
2761
2762                 goto out;
2763         }
2764
2765 out:
2766         if (username_ret) {
2767                 pam_set_item (pamh, PAM_USER, username_ret);
2768                 _pam_log_debug(ctx, LOG_INFO,
2769                                "Returned user was '%s'", username_ret);
2770                 free(username_ret);
2771         }
2772
2773         if (real_username) {
2774                 free(real_username);
2775         }
2776
2777         if (!new_authtok_required) {
2778                 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, NULL, NULL);
2779         }
2780
2781         if (retval != PAM_SUCCESS) {
2782                 _pam_free_data_info3(pamh);
2783         }
2784
2785         _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
2786
2787         TALLOC_FREE(ctx);
2788
2789         return retval;
2790 }
2791
2792 PAM_EXTERN
2793 int pam_sm_setcred(pam_handle_t *pamh, int flags,
2794                    int argc, const char **argv)
2795 {
2796         int ret = PAM_SYSTEM_ERR;
2797         struct pwb_context *ctx = NULL;
2798
2799         ret = _pam_winbind_init_context(pamh, flags, argc, argv,
2800                                         PAM_WINBIND_SETCRED, &ctx);
2801         if (ret != PAM_SUCCESS) {
2802                 return ret;
2803         }
2804
2805         _PAM_LOG_FUNCTION_ENTER("pam_sm_setcred", ctx);
2806
2807         switch (flags & ~PAM_SILENT) {
2808
2809                 case PAM_DELETE_CRED:
2810                         ret = _pam_delete_cred(pamh, flags, argc,
2811                                                PAM_WINBIND_SETCRED, argv);
2812                         break;
2813                 case PAM_REFRESH_CRED:
2814                         _pam_log_debug(ctx, LOG_WARNING,
2815                                        "PAM_REFRESH_CRED not implemented");
2816                         ret = PAM_SUCCESS;
2817                         break;
2818                 case PAM_REINITIALIZE_CRED:
2819                         _pam_log_debug(ctx, LOG_WARNING,
2820                                        "PAM_REINITIALIZE_CRED not implemented");
2821                         ret = PAM_SUCCESS;
2822                         break;
2823                 case PAM_ESTABLISH_CRED:
2824                         _pam_log_debug(ctx, LOG_WARNING,
2825                                        "PAM_ESTABLISH_CRED not implemented");
2826                         ret = PAM_SUCCESS;
2827                         break;
2828                 default:
2829                         ret = PAM_SYSTEM_ERR;
2830                         break;
2831         }
2832
2833         _PAM_LOG_FUNCTION_LEAVE("pam_sm_setcred", ctx, ret);
2834
2835         TALLOC_FREE(ctx);
2836
2837         return ret;
2838 }
2839
2840 /*
2841  * Account management. We want to verify that the account exists
2842  * before returning PAM_SUCCESS
2843  */
2844 PAM_EXTERN
2845 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
2846                    int argc, const char **argv)
2847 {
2848         const char *username;
2849         int ret = PAM_USER_UNKNOWN;
2850         const char *tmp = NULL;
2851         struct pwb_context *ctx = NULL;
2852
2853         ret = _pam_winbind_init_context(pamh, flags, argc, argv,
2854                                         PAM_WINBIND_ACCT_MGMT, &ctx);
2855         if (ret != PAM_SUCCESS) {
2856                 return ret;
2857         }
2858
2859         _PAM_LOG_FUNCTION_ENTER("pam_sm_acct_mgmt", ctx);
2860
2861
2862         /* Get the username */
2863         ret = pam_get_user(pamh, &username, NULL);
2864         if ((ret != PAM_SUCCESS) || (!username)) {
2865                 _pam_log_debug(ctx, LOG_DEBUG,
2866                                "can not get the username");
2867                 ret = PAM_SERVICE_ERR;
2868                 goto out;
2869         }
2870
2871         /* Verify the username */
2872         ret = valid_user(ctx, username);
2873         switch (ret) {
2874         case -1:
2875                 /* some sort of system error. The log was already printed */
2876                 ret = PAM_SERVICE_ERR;
2877                 goto out;
2878         case 1:
2879                 /* the user does not exist */
2880                 _pam_log_debug(ctx, LOG_NOTICE, "user '%s' not found",
2881                                username);
2882                 if (ctx->ctrl & WINBIND_UNKNOWN_OK_ARG) {
2883                         ret = PAM_IGNORE;
2884                         goto out;
2885                 }
2886                 ret = PAM_USER_UNKNOWN;
2887                 goto out;
2888         case 0:
2889                 pam_get_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD,
2890                              (const void **)&tmp);
2891                 if (tmp != NULL) {
2892                         ret = atoi(tmp);
2893                         switch (ret) {
2894                         case PAM_AUTHTOK_EXPIRED:
2895                                 /* fall through, since new token is required in this case */
2896                         case PAM_NEW_AUTHTOK_REQD:
2897                                 _pam_log(ctx, LOG_WARNING,
2898                                          "pam_sm_acct_mgmt success but %s is set",
2899                                          PAM_WINBIND_NEW_AUTHTOK_REQD);
2900                                 _pam_log(ctx, LOG_NOTICE,
2901                                          "user '%s' needs new password",
2902                                          username);
2903                                 /* PAM_AUTHTOKEN_REQD does not exist, but is documented in the manpage */
2904                                 ret = PAM_NEW_AUTHTOK_REQD;
2905                                 goto out;
2906                         default:
2907                                 _pam_log(ctx, LOG_WARNING,
2908                                          "pam_sm_acct_mgmt success");
2909                                 _pam_log(ctx, LOG_NOTICE,
2910                                          "user '%s' granted access", username);
2911                                 ret = PAM_SUCCESS;
2912                                 goto out;
2913                         }
2914                 }
2915
2916                 /* Otherwise, the authentication looked good */
2917                 _pam_log(ctx, LOG_NOTICE,
2918                          "user '%s' granted access", username);
2919                 ret = PAM_SUCCESS;
2920                 goto out;
2921         default:
2922                 /* we don't know anything about this return value */
2923                 _pam_log(ctx, LOG_ERR,
2924                          "internal module error (ret = %d, user = '%s')",
2925                          ret, username);
2926                 ret = PAM_SERVICE_ERR;
2927                 goto out;
2928         }
2929
2930         /* should not be reached */
2931         ret = PAM_IGNORE;
2932
2933  out:
2934
2935         _PAM_LOG_FUNCTION_LEAVE("pam_sm_acct_mgmt", ctx, ret);
2936
2937         TALLOC_FREE(ctx);
2938
2939         return ret;
2940 }
2941
2942 PAM_EXTERN
2943 int pam_sm_open_session(pam_handle_t *pamh, int flags,
2944                         int argc, const char **argv)
2945 {
2946         int ret = PAM_SUCCESS;
2947         struct pwb_context *ctx = NULL;
2948
2949         ret = _pam_winbind_init_context(pamh, flags, argc, argv,
2950                                         PAM_WINBIND_OPEN_SESSION, &ctx);
2951         if (ret != PAM_SUCCESS) {
2952                 return ret;
2953         }
2954
2955         _PAM_LOG_FUNCTION_ENTER("pam_sm_open_session", ctx);
2956
2957         if (ctx->ctrl & WINBIND_MKHOMEDIR) {
2958                 /* check and create homedir */
2959                 ret = _pam_mkhomedir(ctx);
2960         }
2961
2962         _PAM_LOG_FUNCTION_LEAVE("pam_sm_open_session", ctx, ret);
2963
2964         TALLOC_FREE(ctx);
2965
2966         return ret;
2967 }
2968
2969 PAM_EXTERN
2970 int pam_sm_close_session(pam_handle_t *pamh, int flags,
2971                          int argc, const char **argv)
2972 {
2973         int ret = PAM_SUCCESS;
2974         struct pwb_context *ctx = NULL;
2975
2976         ret = _pam_winbind_init_context(pamh, flags, argc, argv,
2977                                         PAM_WINBIND_CLOSE_SESSION, &ctx);
2978         if (ret != PAM_SUCCESS) {
2979                 return ret;
2980         }
2981
2982         _PAM_LOG_FUNCTION_ENTER("pam_sm_close_session", ctx);
2983
2984         _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx, ret);
2985
2986         TALLOC_FREE(ctx);
2987
2988         return ret;
2989 }
2990
2991 /**
2992  * evaluate whether we need to re-authenticate with kerberos after a
2993  * password change
2994  *
2995  * @param ctx PAM winbind context.
2996  * @param user The username
2997  *
2998  * @return boolean Returns true if required, false if not.
2999  */
3000
3001 static bool _pam_require_krb5_auth_after_chauthtok(struct pwb_context *ctx,
3002                                                    const char *user)
3003 {
3004
3005         /* Make sure that we only do this if a) the chauthtok got initiated
3006          * during a logon attempt (authenticate->acct_mgmt->chauthtok) b) any
3007          * later password change via the "passwd" command if done by the user
3008          * itself
3009          * NB. If we login from gdm or xdm and the password expires,
3010          * we change the password, but there is no memory cache.
3011          * Thus, even for passthrough login, we should do the
3012          * authentication again to update memory cache.
3013          * --- BoYang
3014          * */
3015
3016         char *new_authtok_reqd_during_auth = NULL;
3017         struct passwd *pwd = NULL;
3018
3019         pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
3020                       (const void **) &new_authtok_reqd_during_auth);
3021         pam_set_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
3022                      NULL, NULL);
3023
3024         if (new_authtok_reqd_during_auth) {
3025                 return true;
3026         }
3027
3028         pwd = getpwnam(user);
3029         if (!pwd) {
3030                 return false;
3031         }
3032
3033         if (getuid() == pwd->pw_uid) {
3034                 return true;
3035         }
3036
3037         return false;
3038 }
3039
3040
3041 PAM_EXTERN
3042 int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
3043                      int argc, const char **argv)
3044 {
3045         unsigned int lctrl;
3046         int ret;
3047         bool cached_login = false;
3048
3049         /* <DO NOT free() THESE> */
3050         const char *user;
3051         const char *pass_old;
3052         const char *pass_new;
3053         /* </DO NOT free() THESE> */
3054
3055         char *Announce;
3056
3057         int retry = 0;
3058         char *username_ret = NULL;
3059         struct wbcAuthErrorInfo *error = NULL;
3060         struct pwb_context *ctx = NULL;
3061
3062         ret = _pam_winbind_init_context(pamh, flags, argc, argv,
3063                                         PAM_WINBIND_CHAUTHTOK, &ctx);
3064         if (ret != PAM_SUCCESS) {
3065                 return ret;
3066         }
3067
3068         _PAM_LOG_FUNCTION_ENTER("pam_sm_chauthtok", ctx);
3069
3070         cached_login = (ctx->ctrl & WINBIND_CACHED_LOGIN);
3071
3072         /* clearing offline bit for auth */
3073         ctx->ctrl &= ~WINBIND_CACHED_LOGIN;
3074
3075         /*
3076          * First get the name of a user
3077          */
3078         ret = pam_get_user(pamh, &user, _("Username: "));
3079         if (ret != PAM_SUCCESS) {
3080                 _pam_log(ctx, LOG_ERR,
3081                          "password - could not identify user");
3082                 goto out;
3083         }
3084
3085         if (user == NULL) {
3086                 _pam_log(ctx, LOG_ERR, "username was NULL!");
3087                 ret = PAM_USER_UNKNOWN;
3088                 goto out;
3089         }
3090
3091         _pam_log_debug(ctx, LOG_DEBUG, "username [%s] obtained", user);
3092
3093         /* check if this is really a user in winbindd, not only in NSS */
3094         ret = valid_user(ctx, user);
3095         switch (ret) {
3096                 case 1:
3097                         ret = PAM_USER_UNKNOWN;
3098                         goto out;
3099                 case -1:
3100                         ret = PAM_SYSTEM_ERR;
3101                         goto out;
3102                 default:
3103                         break;
3104         }
3105
3106         /*
3107          * obtain and verify the current password (OLDAUTHTOK) for
3108          * the user.
3109          */
3110
3111         if (flags & PAM_PRELIM_CHECK) {
3112                 time_t pwdlastset_prelim = 0;
3113
3114                 /* instruct user what is happening */
3115
3116 #define greeting _("Changing password for")
3117                 Announce = talloc_asprintf(ctx, "%s %s", greeting, user);
3118                 if (!Announce) {
3119                         _pam_log(ctx, LOG_CRIT,
3120                                  "password - out of memory");
3121                         ret = PAM_BUF_ERR;
3122                         goto out;
3123                 }
3124 #undef greeting
3125
3126                 lctrl = ctx->ctrl | WINBIND__OLD_PASSWORD;
3127                 ret = _winbind_read_password(ctx, lctrl,
3128                                                 Announce,
3129                                                 _("(current) NT password: "),
3130                                                 NULL,
3131                                                 (const char **) &pass_old);
3132                 TALLOC_FREE(Announce);
3133                 if (ret != PAM_SUCCESS) {
3134                         _pam_log(ctx, LOG_NOTICE,
3135                                  "password - (old) token not obtained");
3136                         goto out;
3137                 }
3138
3139                 /* verify that this is the password for this user */
3140
3141                 ret = winbind_auth_request(ctx, user, pass_old,
3142                                            NULL, NULL, 0,
3143                                            &error, NULL, NULL,
3144                                            &pwdlastset_prelim, NULL);
3145
3146                 if (ret != PAM_ACCT_EXPIRED &&
3147                     ret != PAM_AUTHTOK_EXPIRED &&
3148                     ret != PAM_NEW_AUTHTOK_REQD &&
3149                     ret != PAM_SUCCESS) {
3150                         pass_old = NULL;
3151                         goto out;
3152                 }
3153
3154                 pam_set_data(pamh, PAM_WINBIND_PWD_LAST_SET,
3155                              (void *)pwdlastset_prelim, NULL);
3156
3157                 ret = pam_set_item(pamh, PAM_OLDAUTHTOK,
3158                                    (const void *) pass_old);
3159                 pass_old = NULL;
3160                 if (ret != PAM_SUCCESS) {
3161                         _pam_log(ctx, LOG_CRIT,
3162                                  "failed to set PAM_OLDAUTHTOK");
3163                 }
3164         } else if (flags & PAM_UPDATE_AUTHTOK) {
3165
3166                 time_t pwdlastset_update = 0;
3167
3168                 /*
3169                  * obtain the proposed password
3170                  */
3171
3172                 /*
3173                  * get the old token back.
3174                  */
3175
3176                 ret = pam_get_item(pamh, PAM_OLDAUTHTOK, (const void **) &pass_old);
3177
3178                 if (ret != PAM_SUCCESS) {
3179                         _pam_log(ctx, LOG_NOTICE,
3180                                  "user not authenticated");
3181                         goto out;
3182                 }
3183
3184                 lctrl = ctx->ctrl & ~WINBIND_TRY_FIRST_PASS_ARG;
3185
3186                 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
3187                         lctrl |= WINBIND_USE_FIRST_PASS_ARG;
3188                 }
3189                 retry = 0;
3190                 ret = PAM_AUTHTOK_ERR;
3191                 while ((ret != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
3192                         /*
3193                          * use_authtok is to force the use of a previously entered
3194                          * password -- needed for pluggable password strength checking
3195                          */
3196
3197                         ret = _winbind_read_password(ctx, lctrl,
3198                                                      NULL,
3199                                                      _("Enter new NT password: "),
3200                                                      _("Retype new NT password: "),
3201                                                      (const char **)&pass_new);
3202
3203                         if (ret != PAM_SUCCESS) {
3204                                 _pam_log_debug(ctx, LOG_ALERT,
3205                                                "password - "
3206                                                "new password not obtained");
3207                                 pass_old = NULL;/* tidy up */
3208                                 goto out;
3209                         }
3210
3211                         /*
3212                          * At this point we know who the user is and what they
3213                          * propose as their new password. Verify that the new
3214                          * password is acceptable.
3215                          */
3216
3217                         if (pass_new[0] == '\0') {/* "\0" password = NULL */
3218                                 pass_new = NULL;
3219                         }
3220                 }
3221
3222                 /*
3223                  * By reaching here we have approved the passwords and must now
3224                  * rebuild the password database file.
3225                  */
3226                 pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
3227                              (const void **) &pwdlastset_update);
3228
3229                 /*
3230                  * if cached creds were enabled, make sure to set the
3231                  * WINBIND_CACHED_LOGIN bit here in order to have winbindd
3232                  * update the cached creds storage - gd
3233                  */
3234                 if (cached_login) {
3235                         ctx->ctrl |= WINBIND_CACHED_LOGIN;
3236                 }
3237
3238                 ret = winbind_chauthtok_request(ctx, user, pass_old,
3239                                                 pass_new, pwdlastset_update);
3240                 if (ret != PAM_SUCCESS) {
3241                         pass_old = pass_new = NULL;
3242                         goto out;
3243                 }
3244
3245                 if (_pam_require_krb5_auth_after_chauthtok(ctx, user)) {
3246
3247                         const char *member = NULL;
3248                         const char *cctype = NULL;
3249                         int warn_pwd_expire;
3250                         struct wbcLogonUserInfo *info = NULL;
3251                         struct wbcUserPasswordPolicyInfo *policy = NULL;
3252
3253                         member = get_member_from_config(ctx);
3254                         cctype = get_krb5_cc_type_from_config(ctx);
3255                         warn_pwd_expire = get_warn_pwd_expire_from_config(ctx);
3256
3257                         /* Keep WINBIND_CACHED_LOGIN bit for
3258                          * authentication after changing the password.
3259                          * This will update the cached credentials in case
3260                          * that winbindd_dual_pam_chauthtok() fails
3261                          * to update them.
3262                          * --- BoYang
3263                          * */
3264
3265                         ret = winbind_auth_request(ctx, user, pass_new,
3266                                                    member, cctype, 0,
3267                                                    &error, &info, &policy,
3268                                                    NULL, &username_ret);
3269                         pass_old = pass_new = NULL;
3270
3271                         if (ret == PAM_SUCCESS) {
3272
3273                                 struct wbcAuthUserInfo *user_info = NULL;
3274
3275                                 if (info && info->info) {
3276                                         user_info = info->info;
3277                                 }
3278
3279                                 /* warn a user if the password is about to
3280                                  * expire soon */
3281                                 _pam_warn_password_expiry(ctx, user_info, policy,
3282                                                           warn_pwd_expire,
3283                                                           NULL, NULL);
3284
3285                                 /* set some info3 info for other modules in the
3286                                  * stack */
3287                                 _pam_set_data_info3(ctx, user_info);
3288
3289                                 /* put krb5ccname into env */
3290                                 _pam_setup_krb5_env(ctx, info);
3291
3292                                 if (username_ret) {
3293                                         pam_set_item(pamh, PAM_USER,
3294                                                      username_ret);
3295                                         _pam_log_debug(ctx, LOG_INFO,
3296                                                        "Returned user was '%s'",
3297                                                        username_ret);
3298                                         free(username_ret);
3299                                 }
3300
3301                         }
3302
3303                         if (info && info->blobs) {
3304                                 wbcFreeMemory(info->blobs);
3305                         }
3306                         wbcFreeMemory(info);
3307                         wbcFreeMemory(policy);
3308
3309                         goto out;
3310                 }
3311         } else {
3312                 ret = PAM_SERVICE_ERR;
3313         }
3314
3315 out:
3316         {
3317                 /* Deal with offline errors. */
3318                 int i;
3319                 const char *codes[] = {
3320                         "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
3321                         "NT_STATUS_NO_LOGON_SERVERS",
3322                         "NT_STATUS_ACCESS_DENIED"
3323                 };
3324
3325                 for (i=0; i<ARRAY_SIZE(codes); i++) {
3326                         int _ret;
3327                         if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
3328                                 break;
3329                         }
3330                 }
3331         }
3332
3333         wbcFreeMemory(error);
3334
3335         _PAM_LOG_FUNCTION_LEAVE("pam_sm_chauthtok", ctx, ret);
3336
3337         TALLOC_FREE(ctx);
3338
3339         return ret;
3340 }
3341
3342 #ifdef PAM_STATIC
3343
3344 /* static module data */
3345
3346 struct pam_module _pam_winbind_modstruct = {
3347         MODULE_NAME,
3348         pam_sm_authenticate,
3349         pam_sm_setcred,
3350         pam_sm_acct_mgmt,
3351         pam_sm_open_session,
3352         pam_sm_close_session,
3353         pam_sm_chauthtok
3354 };
3355
3356 #endif
3357
3358 /*
3359  * Copyright (c) Andrew Tridgell  <tridge@samba.org>   2000
3360  * Copyright (c) Tim Potter       <tpot@samba.org>     2000
3361  * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
3362  * Copyright (c) Guenther Deschner <gd@samba.org>      2005-2008
3363  * Copyright (c) Jan Rêkorajski 1999.
3364  * Copyright (c) Andrew G. Morgan 1996-8.
3365  * Copyright (c) Alex O. Yuriev, 1996.
3366  * Copyright (c) Cristian Gafton 1996.
3367  * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
3368  *
3369  * Redistribution and use in source and binary forms, with or without
3370  * modification, are permitted provided that the following conditions
3371  * are met:
3372  * 1. Redistributions of source code must retain the above copyright
3373  *    notice, and the entire permission notice in its entirety,
3374  *    including the disclaimer of warranties.
3375  * 2. Redistributions in binary form must reproduce the above copyright
3376  *    notice, this list of conditions and the following disclaimer in the
3377  *    documentation and/or other materials provided with the distribution.
3378  * 3. The name of the author may not be used to endorse or promote
3379  *    products derived from this software without specific prior
3380  *    written permission.
3381  *
3382  * ALTERNATIVELY, this product may be distributed under the terms of
3383  * the GNU Public License, in which case the provisions of the GPL are
3384  * required INSTEAD OF the above restrictions.  (This clause is
3385  * necessary due to a potential bad interaction between the GPL and
3386  * the restrictions contained in a BSD-style copyright.)
3387  *
3388  * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
3389  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
3390  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
3391  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
3392  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
3393  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
3394  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3395  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
3396  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
3397  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
3398  * OF THE POSSIBILITY OF SUCH DAMAGE.
3399  */