?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
dnscrypto-proxy: Support files updated.
[tomato.git] / release / src / router / samba3 / source / pam_smbpass / support.c
blob2062ec2f099b3dcd99ef93b3a7684d8a71a26e02
1 /* Unix NT password database implementation, version 0.6.
2 *
3 * This program is free software; you can redistribute it and/or modify it under
4 * the terms of the GNU General Public License as published by the Free
5 * Software Foundation; either version 2 of the License, or (at your option)
6 * any later version.
7 *
8 * This program is distributed in the hope that it will be useful, but WITHOUT
9 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
10 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
11 * more details.
12 *
13 * You should have received a copy of the GNU General Public License along with
14 * this program; if not, write to the Free Software Foundation, Inc., 675
15 * Mass Ave, Cambridge, MA 02139, USA.
16 */
17
18 #include "includes.h"
19 #include "general.h"
20
21 #include "support.h"
22
23
24 #define _pam_overwrite(x) \
25 do { \
26 register char *__xx__; \
27 if ((__xx__=(x))) \
28 while (*__xx__) \
29 *__xx__++ = '\0'; \
30 } while (0)
31
32 /*
33 * Don't just free it, forget it too.
34 */
35
36 #define _pam_drop(X) \
37 do { \
38 if (X) { \
39 free(X); \
40 X=NULL; \
41 } \
42 } while (0)
43
44 #define _pam_drop_reply(/* struct pam_response * */ reply, /* int */ replies) \
45 do { \
46 int reply_i; \
47 \
48 for (reply_i=0; reply_i<replies; ++reply_i) { \
49 if (reply[reply_i].resp) { \
50 _pam_overwrite(reply[reply_i].resp); \
51 free(reply[reply_i].resp); \
52 } \
53 } \
54 if (reply) \
55 free(reply); \
56 } while (0)
57
58
59 int converse(pam_handle_t *, int, int, struct pam_message **,
60 struct pam_response **);
61 int make_remark(pam_handle_t *, unsigned int, int, const char *);
62 void _cleanup(pam_handle_t *, void *, int);
63 char *_pam_delete(register char *);
64
65 /* default configuration file location */
66
67 char *servicesf = dyn_CONFIGFILE;
68
69 /* syslogging function for errors and other information */
70
71 void _log_err( int err, const char *format, ... )
72 {
73 va_list args;
74
75 va_start( args, format );
76 openlog( "PAM_smbpass", LOG_CONS | LOG_PID, LOG_AUTH );
77 vsyslog( err, format, args );
78 va_end( args );
79 closelog();
80 }
81
82 /* this is a front-end for module-application conversations */
83
84 int converse( pam_handle_t * pamh, int ctrl, int nargs
85 , struct pam_message **message
86 , struct pam_response **response )
87 {
88 int retval;
89 struct pam_conv *conv;
90
91 retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv);
92 if (retval == PAM_SUCCESS) {
93
94 retval = conv->conv(nargs, (const struct pam_message **) message
95 ,response, conv->appdata_ptr);
96
97 if (retval != PAM_SUCCESS && on(SMB_DEBUG, ctrl)) {
98 _log_err(LOG_DEBUG, "conversation failure [%s]"
99 ,pam_strerror(pamh, retval));
100 }
101 } else {
102 _log_err(LOG_ERR, "couldn't obtain coversation function [%s]"
103 ,pam_strerror(pamh, retval));
104 }
105
106 return retval; /* propagate error status */
107 }
108
109 int make_remark( pam_handle_t * pamh, unsigned int ctrl
110 , int type, const char *text )
111 {
112 if (off(SMB__QUIET, ctrl)) {
113 struct pam_message *pmsg[1], msg[1];
114 struct pam_response *resp;
115
116 pmsg[0] = &msg[0];
117 msg[0].msg = CONST_DISCARD(char *, text);
118 msg[0].msg_style = type;
119 resp = NULL;
120
121 return converse(pamh, ctrl, 1, pmsg, &resp);
122 }
123 return PAM_SUCCESS;
124 }
125
126
127 /* set the control flags for the SMB module. */
128
129 int set_ctrl( int flags, int argc, const char **argv )
130 {
131 int i = 0;
132 const char *service_file = dyn_CONFIGFILE;
133 unsigned int ctrl;
134
135 ctrl = SMB_DEFAULTS; /* the default selection of options */
136
137 /* set some flags manually */
138
139 /* A good, sane default (matches Samba's behavior). */
140 set( SMB__NONULL, ctrl );
141
142 /* initialize service file location */
143 service_file=servicesf;
144
145 if (flags & PAM_SILENT) {
146 set( SMB__QUIET, ctrl );
147 }
148
149 /* Run through the arguments once, looking for an alternate smb config
150 file location */
151 while (i < argc) {
152 int j;
153
154 for (j = 0; j < SMB_CTRLS_; ++j) {
155 if (smb_args[j].token
156 && !strncmp(argv[i], smb_args[j].token, strlen(smb_args[j].token)))
157 {
158 break;
159 }
160 }
161
162 if (j == SMB_CONF_FILE) {
163 service_file = argv[i] + 8;
164 }
165 i++;
166 }
167
168 /* Read some options from the Samba config. Can be overridden by
169 the PAM config. */
170 if(lp_load(service_file,True,False,False,True) == False) {
171 _log_err( LOG_ERR, "Error loading service file %s", service_file );
172 }
173
174 secrets_init();
175
176 if (lp_null_passwords()) {
177 set( SMB__NULLOK, ctrl );
178 }
179
180 /* now parse the rest of the arguments to this module */
181
182 while (argc-- > 0) {
183 int j;
184
185 for (j = 0; j < SMB_CTRLS_; ++j) {
186 if (smb_args[j].token
187 && !strncmp(*argv, smb_args[j].token, strlen(smb_args[j].token)))
188 {
189 break;
190 }
191 }
192
193 if (j >= SMB_CTRLS_) {
194 _log_err( LOG_ERR, "unrecognized option [%s]", *argv );
195 } else {
196 ctrl &= smb_args[j].mask; /* for turning things off */
197 ctrl |= smb_args[j].flag; /* for turning things on */
198 }
199
200 ++argv; /* step to next argument */
201 }
202
203 /* auditing is a more sensitive version of debug */
204
205 if (on( SMB_AUDIT, ctrl )) {
206 set( SMB_DEBUG, ctrl );
207 }
208 /* return the set of flags */
209
210 return ctrl;
211 }
212
213 /* use this to free strings. ESPECIALLY password strings */
214
215 char * _pam_delete( register char *xx )
216 {
217 _pam_overwrite( xx );
218 _pam_drop( xx );
219 return NULL;
220 }
221
222 void _cleanup( pam_handle_t * pamh, void *x, int error_status )
223 {
224 x = _pam_delete( (char *) x );
225 }
226
227 /* JHT
228 *
229 * Safe duplication of character strings. "Paranoid"; don't leave
230 * evidence of old token around for later stack analysis.
231 *
232 */
233 char * smbpXstrDup( const char *x )
234 {
235 register char *newstr = NULL;
236
237 if (x != NULL) {
238 register int i;
239
240 for (i = 0; x[i]; ++i); /* length of string */
241 if ((newstr = SMB_MALLOC_ARRAY(char, ++i)) == NULL) {
242 i = 0;
243 _log_err( LOG_CRIT, "out of memory in smbpXstrDup" );
244 } else {
245 while (i-- > 0) {
246 newstr[i] = x[i];
247 }
248 }
249 x = NULL;
250 }
251 return newstr; /* return the duplicate or NULL on error */
252 }
253
254 /* ************************************************************** *
255 * Useful non-trivial functions *
256 * ************************************************************** */
257
258 void _cleanup_failures( pam_handle_t * pamh, void *fl, int err )
259 {
260 int quiet;
261 const char *service = NULL;
262 struct _pam_failed_auth *failure;
263
264 #ifdef PAM_DATA_SILENT
265 quiet = err & PAM_DATA_SILENT; /* should we log something? */
266 #else
267 quiet = 0;
268 #endif
269 #ifdef PAM_DATA_REPLACE
270 err &= PAM_DATA_REPLACE; /* are we just replacing data? */
271 #endif
272 failure = (struct _pam_failed_auth *) fl;
273
274 if (failure != NULL) {
275
276 #ifdef PAM_DATA_SILENT
277 if (!quiet && !err) { /* under advisement from Sun,may go away */
278 #else
279 if (!quiet) { /* under advisement from Sun,may go away */
280 #endif
281
282 /* log the number of authentication failures */
283 if (failure->count != 0) {
284 pam_get_item( pamh, PAM_SERVICE, (const void **) &service );
285 _log_err( LOG_NOTICE
286 , "%d authentication %s "
287 "from %s for service %s as %s(%d)"
288 , failure->count
289 , failure->count == 1 ? "failure" : "failures"
290 , failure->agent
291 , service == NULL ? "**unknown**" : service
292 , failure->user, failure->id );
293 if (failure->count > SMB_MAX_RETRIES) {
294 _log_err( LOG_ALERT
295 , "service(%s) ignoring max retries; %d > %d"
296 , service == NULL ? "**unknown**" : service
297 , failure->count
298 , SMB_MAX_RETRIES );
299 }
300 }
301 }
302 _pam_delete( failure->agent ); /* tidy up */
303 _pam_delete( failure->user ); /* tidy up */
304 SAFE_FREE( failure );
305 }
306 }
307
308 int _smb_verify_password( pam_handle_t * pamh, struct samu *sampass,
309 const char *p, unsigned int ctrl )
310 {
311 uchar lm_pw[16];
312 uchar nt_pw[16];
313 int retval = PAM_AUTH_ERR;
314 char *data_name;
315 const char *name;
316
317 if (!sampass)
318 return PAM_ABORT;
319
320 name = pdb_get_username(sampass);
321
322 #ifdef HAVE_PAM_FAIL_DELAY
323 if (off( SMB_NODELAY, ctrl )) {
324 (void) pam_fail_delay( pamh, 1000000 ); /* 1 sec delay for on failure */
325 }
326 #endif
327
328 if (!pdb_get_nt_passwd(sampass))
329 {
330 _log_err( LOG_DEBUG, "user %s has null SMB password"
331 , name );
332
333 if (off( SMB__NONULL, ctrl )
334 && (pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ))
335 { /* this means we've succeeded */
336 return PAM_SUCCESS;
337 } else {
338 const char *service;
339
340 pam_get_item( pamh, PAM_SERVICE, (const void **)&service );
341 _log_err( LOG_NOTICE, "failed auth request by %s for service %s as %s",
342 uidtoname(getuid()), service ? service : "**unknown**", name);
343 return PAM_AUTH_ERR;
344 }
345 }
346
347 data_name = SMB_MALLOC_ARRAY(char, sizeof(FAIL_PREFIX) + strlen( name ));
348 if (data_name == NULL) {
349 _log_err( LOG_CRIT, "no memory for data-name" );
350 return PAM_AUTH_ERR;
351 }
352 strncpy( data_name, FAIL_PREFIX, sizeof(FAIL_PREFIX) );
353 strncpy( data_name + sizeof(FAIL_PREFIX) - 1, name, strlen( name ) + 1 );
354
355 /*
356 * The password we were given wasn't an encrypted password, or it
357 * didn't match the one we have. We encrypt the password now and try
358 * again.
359 */
360
361 nt_lm_owf_gen(p, nt_pw, lm_pw);
362
363 /* the moment of truth -- do we agree with the password? */
364
365 if (!memcmp( nt_pw, pdb_get_nt_passwd(sampass), 16 )) {
366
367 retval = PAM_SUCCESS;
368 if (data_name) { /* reset failures */
369 pam_set_data(pamh, data_name, NULL, _cleanup_failures);
370 }
371 } else {
372
373 const char *service;
374
375 pam_get_item( pamh, PAM_SERVICE, (const void **)&service );
376
377 if (data_name != NULL) {
378 struct _pam_failed_auth *newauth = NULL;
379 const struct _pam_failed_auth *old = NULL;
380
381 /* get a failure recorder */
382
383 newauth = SMB_MALLOC_P( struct _pam_failed_auth );
384
385 if (newauth != NULL) {
386
387 /* any previous failures for this user ? */
388 pam_get_data(pamh, data_name, (const void **) &old);
389
390 if (old != NULL) {
391 newauth->count = old->count + 1;
392 if (newauth->count >= SMB_MAX_RETRIES) {
393 retval = PAM_MAXTRIES;
394 }
395 } else {
396 _log_err(LOG_NOTICE,
397 "failed auth request by %s for service %s as %s",
398 uidtoname(getuid()),
399 service ? service : "**unknown**", name);
400 newauth->count = 1;
401 }
402 if (!sid_to_uid(pdb_get_user_sid(sampass), &(newauth->id))) {
403 _log_err(LOG_NOTICE,
404 "failed auth request by %s for service %s as %s",
405 uidtoname(getuid()),
406 service ? service : "**unknown**", name);
407 }
408 newauth->user = smbpXstrDup( name );
409 newauth->agent = smbpXstrDup( uidtoname( getuid() ) );
410 pam_set_data( pamh, data_name, newauth, _cleanup_failures );
411
412 } else {
413 _log_err( LOG_CRIT, "no memory for failure recorder" );
414 _log_err(LOG_NOTICE,
415 "failed auth request by %s for service %s as %s(%d)",
416 uidtoname(getuid()),
417 service ? service : "**unknown**", name);
418 }
419 }
420 _log_err(LOG_NOTICE,
421 "failed auth request by %s for service %s as %s(%d)",
422 uidtoname(getuid()),
423 service ? service : "**unknown**", name);
424 retval = PAM_AUTH_ERR;
425 }
426
427 _pam_delete( data_name );
428
429 return retval;
430 }
431
432
433 /*
434 * _smb_blankpasswd() is a quick check for a blank password
435 *
436 * returns TRUE if user does not have a password
437 * - to avoid prompting for one in such cases (CG)
438 */
439
440 int _smb_blankpasswd( unsigned int ctrl, struct samu *sampass )
441 {
442 int retval;
443
444 /*
445 * This function does not have to be too smart if something goes
446 * wrong, return FALSE and let this case to be treated somewhere
447 * else (CG)
448 */
449
450 if (on( SMB__NONULL, ctrl ))
451 return 0; /* will fail but don't let on yet */
452
453 if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ))
454 return 0;
455
456 if (pdb_get_nt_passwd(sampass) == NULL)
457 retval = 1;
458 else
459 retval = 0;
460
461 return retval;
462 }
463
464 /*
465 * obtain a password from the user
466 */
467
468 int _smb_read_password( pam_handle_t * pamh, unsigned int ctrl,
469 const char *comment, const char *prompt1,
470 const char *prompt2, const char *data_name, char **pass )
471 {
472 int authtok_flag;
473 int retval;
474 char *item = NULL;
475 char *token;
476
477 struct pam_message msg[3], *pmsg[3];
478 struct pam_response *resp;
479 int i, expect;
480
481
482 /* make sure nothing inappropriate gets returned */
483
484 *pass = token = NULL;
485
486 /* which authentication token are we getting? */
487
488 authtok_flag = on(SMB__OLD_PASSWD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
489
490 /* should we obtain the password from a PAM item ? */
491
492 if (on(SMB_TRY_FIRST_PASS, ctrl) || on(SMB_USE_FIRST_PASS, ctrl)) {
493 retval = pam_get_item( pamh, authtok_flag, (const void **) &item );
494 if (retval != PAM_SUCCESS) {
495 /* very strange. */
496 _log_err( LOG_ALERT
497 , "pam_get_item returned error to smb_read_password" );
498 return retval;
499 } else if (item != NULL) { /* we have a password! */
500 *pass = item;
501 item = NULL;
502 return PAM_SUCCESS;
503 } else if (on( SMB_USE_FIRST_PASS, ctrl )) {
504 return PAM_AUTHTOK_RECOVER_ERR; /* didn't work */
505 } else if (on( SMB_USE_AUTHTOK, ctrl )
506 && off( SMB__OLD_PASSWD, ctrl ))
507 {
508 return PAM_AUTHTOK_RECOVER_ERR;
509 }
510 }
511
512 /*
513 * getting here implies we will have to get the password from the
514 * user directly.
515 */
516
517 /* prepare to converse */
518 if (comment != NULL && off(SMB__QUIET, ctrl)) {
519 pmsg[0] = &msg[0];
520 msg[0].msg_style = PAM_TEXT_INFO;
521 msg[0].msg = CONST_DISCARD(char *, comment);
522 i = 1;
523 } else {
524 i = 0;
525 }
526
527 pmsg[i] = &msg[i];
528 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
529 msg[i++].msg = CONST_DISCARD(char *, prompt1);
530
531 if (prompt2 != NULL) {
532 pmsg[i] = &msg[i];
533 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
534 msg[i++].msg = CONST_DISCARD(char *, prompt2);
535 expect = 2;
536 } else
537 expect = 1;
538
539 resp = NULL;
540
541 retval = converse( pamh, ctrl, i, pmsg, &resp );
542
543 if (resp != NULL) {
544 int j = comment ? 1 : 0;
545 /* interpret the response */
546
547 if (retval == PAM_SUCCESS) { /* a good conversation */
548
549 token = smbpXstrDup(resp[j++].resp);
550 if (token != NULL) {
551 if (expect == 2) {
552 /* verify that password entered correctly */
553 if (!resp[j].resp || strcmp( token, resp[j].resp )) {
554 _pam_delete( token );
555 retval = PAM_AUTHTOK_RECOVER_ERR;
556 make_remark( pamh, ctrl, PAM_ERROR_MSG
557 , MISTYPED_PASS );
558 }
559 }
560 } else {
561 _log_err(LOG_NOTICE, "could not recover authentication token");
562 }
563 }
564
565 /* tidy up */
566 _pam_drop_reply( resp, expect );
567
568 } else {
569 retval = (retval == PAM_SUCCESS) ? PAM_AUTHTOK_RECOVER_ERR : retval;
570 }
571
572 if (retval != PAM_SUCCESS) {
573 if (on( SMB_DEBUG, ctrl ))
574 _log_err( LOG_DEBUG, "unable to obtain a password" );
575 return retval;
576 }
577 /* 'token' is the entered password */
578
579 if (off( SMB_NOT_SET_PASS, ctrl )) {
580
581 /* we store this password as an item */
582
583 retval = pam_set_item( pamh, authtok_flag, (const void *)token );
584 _pam_delete( token ); /* clean it up */
585 if (retval != PAM_SUCCESS
586 || (retval = pam_get_item( pamh, authtok_flag
587 ,(const void **)&item )) != PAM_SUCCESS)
588 {
589 _log_err( LOG_CRIT, "error manipulating password" );
590 return retval;
591 }
592 } else {
593 /*
594 * then store it as data specific to this module. pam_end()
595 * will arrange to clean it up.
596 */
597
598 retval = pam_set_data( pamh, data_name, (void *) token, _cleanup );
599 if (retval != PAM_SUCCESS
600 || (retval = pam_get_data( pamh, data_name, (const void **)&item ))
601 != PAM_SUCCESS)
602 {
603 _log_err( LOG_CRIT, "error manipulating password data [%s]"
604 , pam_strerror( pamh, retval ));
605 _pam_delete( token );
606 item = NULL;
607 return retval;
608 }
609 token = NULL; /* break link to password */
610 }
611
612 *pass = item;
613 item = NULL; /* break link to password */
614
615 return PAM_SUCCESS;
616 }
617
618 int _pam_smb_approve_pass(pam_handle_t * pamh,
619 unsigned int ctrl,
620 const char *pass_old,
621 const char *pass_new )
622 {
623
624 /* Further checks should be handled through module stacking. -SRL */
625 if (pass_new == NULL || (pass_old && !strcmp( pass_old, pass_new )))
626 {
627 if (on(SMB_DEBUG, ctrl)) {
628 _log_err( LOG_DEBUG,
629 "passwd: bad authentication token (null or unchanged)" );
630 }
631 make_remark( pamh, ctrl, PAM_ERROR_MSG, pass_new == NULL ?
632 "No password supplied" : "Password unchanged" );
633 return PAM_AUTHTOK_ERR;
634 }
635
636 return PAM_SUCCESS;
637 }
Tomato firmware and modifications.