[SCM] Samba Shared Repository - branch master updated
Andreas Schneider
asn at samba.org
Tue Apr 15 04:33:04 MDT 2014
The branch, master has been updated
via d7ce127 auth: Remove support for HAVE_TRUNCATED_SALT from pass_check.c
via 634cc8f auth: Remove USE_BOTH_CRYPT_CALLS block from pass_check.c
via 6e8eb60 auth: Remove linux_bigcrypt support from pass_check.c
via e731655 auth: Remove support for plaintext auth on systems that use getprpwnam()
via cec8330 auth: Remove plaintext OSF1 password support
via 3fa67e6 auth: Remove afs_auth() from pass_check.c and s4's auth_unix
via 94f0716 auth: Remove dfs_auth() from pass_check.c and s4's auth_unix
via f5cff44 auth: Remove unused PASSWORD_LENTH macro from pass_check.c
via 6478b6f auth: Remove static variable ths_user from password_check() code
from 3b82b6f Do not install smbclient4 and nmblookup4
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit d7ce127de9ae2e065f46694b90c45b3eb40d0c7a
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 16:03:57 2014 +1300
auth: Remove support for HAVE_TRUNCATED_SALT from pass_check.c
The comments indicate that this was needed for HP-UX at one point, but
the configure code was never ported to WAF.
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
Autobuild-User(master): Andreas Schneider <asn at cryptomilk.org>
Autobuild-Date(master): Tue Apr 15 12:32:09 CEST 2014 on sn-devel-104
commit 634cc8fdffbf83e339844a8da2812fae3964cd31
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 15:57:13 2014 +1300
auth: Remove USE_BOTH_CRYPT_CALLS block from pass_check.c
This code is dead since the move to the WAF build system, but was set
for HP-UX 9, 10 and 11 in the autoconf build system.
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit 6e8eb605454d663643738bc3bf797035022e3a20
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 15:54:15 2014 +1300
auth: Remove linux_bigcrypt support from pass_check.c
This is dead code, and probably has been for quite some time.
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit e731655f09d7b4bb87cac33738a5f286d453610e
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 15:42:33 2014 +1300
auth: Remove support for plaintext auth on systems that use getprpwnam()
The WAF build does not have the code to detect getprpwnam, so this is
dead code.
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit cec833063e4fa5911ae1cf0c53d38f1d6735ee02
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 15:40:19 2014 +1300
auth: Remove plaintext OSF1 password support
The WAF build does not have the code to detect getprpwnam on which
this is based, and so this is dead code.
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit 3fa67e634696ac5b01a3de34892f4c0f978ff9e3
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 15:16:52 2014 +1300
auth: Remove afs_auth() from pass_check.c and s4's auth_unix
The waf build does not have code to detect support for AFS plaintext
authentication, so this is dead code.
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit 94f0716fffdd4a29055ff47943cae85106e42847
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 10:54:29 2014 +1300
auth: Remove dfs_auth() from pass_check.c and s4's auth_unix
The waf build has no logic to detect DCE/DFS, so this plaintext
authentication mechanism is dead code.
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit f5cff447130e4984d96812cfecc00465fbe4cb34
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 10:53:11 2014 +1300
auth: Remove unused PASSWORD_LENTH macro from pass_check.c
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
commit 6478b6f6694207943da040df73d0d1fb10576ef2
Author: Andrew Bartlett <abartlet at samba.org>
Date: Wed Jan 22 10:40:11 2014 +1300
auth: Remove static variable ths_user from password_check() code
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Andreas Schneider <asn at samba.org>
-----------------------------------------------------------------------
Summary of changes:
ctdb/lib/replace/system/passwd.h | 3 -
lib/replace/system/passwd.h | 3 -
source3/auth/pass_check.c | 535 +-----------------------
source3/include/includes.h | 3 -
source4/auth/ntlm/auth_unix.c | 50 ---
tests/crypttest.c | 851 --------------------------------------
6 files changed, 6 insertions(+), 1439 deletions(-)
delete mode 100644 tests/crypttest.c
Changeset truncated at 500 lines:
diff --git a/ctdb/lib/replace/system/passwd.h b/ctdb/lib/replace/system/passwd.h
index 8257e06..e5c16a0 100644
--- a/ctdb/lib/replace/system/passwd.h
+++ b/ctdb/lib/replace/system/passwd.h
@@ -77,9 +77,6 @@
#define PASSWORD_LENGTH 8
#endif
-#if defined(HAVE_PUTPRPWNAM) && defined(AUTH_CLEARTEXT_SEG_CHARS)
-#define OSF1_ENH_SEC 1
-#endif
#ifndef ALLOW_CHANGE_PASSWORD
#if (defined(HAVE_TERMIOS_H) && defined(HAVE_DUP2) && defined(HAVE_SETSID))
diff --git a/lib/replace/system/passwd.h b/lib/replace/system/passwd.h
index 8257e06..e5c16a0 100644
--- a/lib/replace/system/passwd.h
+++ b/lib/replace/system/passwd.h
@@ -77,9 +77,6 @@
#define PASSWORD_LENGTH 8
#endif
-#if defined(HAVE_PUTPRPWNAM) && defined(AUTH_CLEARTEXT_SEG_CHARS)
-#define OSF1_ENH_SEC 1
-#endif
#ifndef ALLOW_CHANGE_PASSWORD
#if (defined(HAVE_TERMIOS_H) && defined(HAVE_DUP2) && defined(HAVE_SETSID))
diff --git a/source3/auth/pass_check.c b/source3/auth/pass_check.c
index 21694b3..d7e3e6a 100644
--- a/source3/auth/pass_check.c
+++ b/source3/auth/pass_check.c
@@ -27,33 +27,6 @@
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
-/* what is the longest significant password available on your system?
- Knowing this speeds up password searches a lot */
-#ifndef PASSWORD_LENGTH
-#define PASSWORD_LENGTH 8
-#endif
-
-/* these are kept here to keep the string_combinations function simple */
-static char *ths_user;
-
-static const char *get_this_user(void)
-{
- if (!ths_user) {
- return "";
- }
- return ths_user;
-}
-
-#if defined(WITH_PAM) || defined(OSF1_ENH_SEC)
-static const char *set_this_user(const char *newuser)
-{
- char *orig_user = ths_user;
- ths_user = SMB_STRDUP(newuser);
- SAFE_FREE(orig_user);
- return ths_user;
-}
-#endif
-
#if !defined(WITH_PAM)
static char *ths_salt;
/* This must be writable. */
@@ -91,446 +64,26 @@ static const char *set_this_crypted(const char *newcrypted)
}
#endif
-#ifdef WITH_AFS
-
-#include <afs/stds.h>
-#include <afs/kautils.h>
-
-/*******************************************************************
-check on AFS authentication
-********************************************************************/
-static bool afs_auth(char *user, char *password)
-{
- long password_expires = 0;
- char *reason;
-
- /* For versions of AFS prior to 3.3, this routine has few arguments, */
- /* but since I can't find the old documentation... :-) */
- setpag();
- if (ka_UserAuthenticateGeneral
- (KA_USERAUTH_VERSION + KA_USERAUTH_DOSETPAG, user, (char *)0, /* instance */
- (char *)0, /* cell */
- password, 0, /* lifetime, default */
- &password_expires, /*days 'til it expires */
- 0, /* spare 2 */
- &reason) == 0)
- {
- return (True);
- }
- DEBUG(1,
- ("AFS authentication for \"%s\" failed (%s)\n", user, reason));
- return (False);
-}
-#endif
-
-
-#ifdef WITH_DFS
-
-#include <dce/dce_error.h>
-#include <dce/sec_login.h>
-
-/*****************************************************************
- This new version of the DFS_AUTH code was donated by Karsten Muuss
- <muuss at or.uni-bonn.de>. It fixes the following problems with the
- old code :
-
- - Server credentials may expire
- - Client credential cache files have wrong owner
- - purge_context() function is called with invalid argument
-
- This new code was modified to ensure that on exit the uid/gid is
- still root, and the original directory is restored. JRA.
-******************************************************************/
-
-sec_login_handle_t my_dce_sec_context;
-int dcelogin_atmost_once = 0;
-
-/*******************************************************************
-check on a DCE/DFS authentication
-********************************************************************/
-static bool dfs_auth(char *user, char *password)
-{
- struct tm *t;
- error_status_t err;
- int err2;
- int prterr;
- signed32 expire_time, current_time;
- boolean32 password_reset;
- struct passwd *pw;
- sec_passwd_rec_t passwd_rec;
- sec_login_auth_src_t auth_src = sec_login_auth_src_network;
- unsigned char dce_errstr[dce_c_error_string_len];
- gid_t egid;
-
- if (dcelogin_atmost_once)
- return (False);
-
-#ifdef HAVE_CRYPT
- /*
- * We only go for a DCE login context if the given password
- * matches that stored in the local password file..
- * Assumes local passwd file is kept in sync w/ DCE RGY!
- */
-
- if (strcmp((char *)crypt(password, get_this_salt()), get_this_crypted()))
- {
- return (False);
- }
-#endif
-
- sec_login_get_current_context(&my_dce_sec_context, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get current context. %s\n", dce_errstr));
-
- return (False);
- }
-
- sec_login_certify_identity(my_dce_sec_context, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get current context. %s\n", dce_errstr));
-
- return (False);
- }
-
- sec_login_get_expiration(my_dce_sec_context, &expire_time, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get expiration. %s\n", dce_errstr));
-
- return (False);
- }
-
- time(¤t_time);
-
- if (expire_time < (current_time + 60))
- {
- struct passwd *pw;
- sec_passwd_rec_t *key;
-
- sec_login_get_pwent(my_dce_sec_context,
- (sec_login_passwd_t *) & pw, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get pwent. %s\n", dce_errstr));
-
- return (False);
- }
-
- sec_login_refresh_identity(my_dce_sec_context, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't refresh identity. %s\n",
- dce_errstr));
-
- return (False);
- }
-
- sec_key_mgmt_get_key(rpc_c_authn_dce_secret, NULL,
- (unsigned char *)pw->pw_name,
- sec_c_key_version_none,
- (void **)&key, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get key for %s. %s\n",
- pw->pw_name, dce_errstr));
-
- return (False);
- }
-
- sec_login_valid_and_cert_ident(my_dce_sec_context, key,
- &password_reset, &auth_src,
- &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0,
- ("DCE can't validate and certify identity for %s. %s\n",
- pw->pw_name, dce_errstr));
- }
-
- sec_key_mgmt_free_key(key, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't free key.\n", dce_errstr));
- }
- }
-
- if (sec_login_setup_identity((unsigned char *)user,
- sec_login_no_flags,
- &my_dce_sec_context, &err) == 0)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE Setup Identity for %s failed: %s\n",
- user, dce_errstr));
- return (False);
- }
-
- sec_login_get_pwent(my_dce_sec_context,
- (sec_login_passwd_t *) & pw, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get pwent. %s\n", dce_errstr));
-
- return (False);
- }
-
- sec_login_purge_context(&my_dce_sec_context, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't purge context. %s\n", dce_errstr));
-
- return (False);
- }
-
- /*
- * NB. I'd like to change these to call something like change_to_user()
- * instead but currently we don't have a connection
- * context to become the correct user. This is already
- * fairly platform specific code however, so I think
- * this should be ok. I have added code to go
- * back to being root on error though. JRA.
- */
- egid = getegid();
- set_effective_gid(pw->pw_gid);
- set_effective_uid(pw->pw_uid);
- if (sec_login_setup_identity((unsigned char *)user,
- sec_login_no_flags,
- &my_dce_sec_context, &err) == 0)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE Setup Identity for %s failed: %s\n",
- user, dce_errstr));
- goto err;
- }
- sec_login_get_pwent(my_dce_sec_context,
- (sec_login_passwd_t *) & pw, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get pwent. %s\n", dce_errstr));
- goto err;
- }
-
- passwd_rec.version_number = sec_passwd_c_version_none;
- passwd_rec.pepper = NULL;
- passwd_rec.key.key_type = sec_passwd_plain;
- passwd_rec.key.tagged_union.plain = (idl_char *) password;
-
- sec_login_validate_identity(my_dce_sec_context,
- &passwd_rec, &password_reset,
- &auth_src, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0,
- ("DCE Identity Validation failed for principal %s: %s\n",
- user, dce_errstr));
- goto err;
- }
-
- sec_login_certify_identity(my_dce_sec_context, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE certify identity failed: %s\n", dce_errstr));
- goto err;
- }
-
- if (auth_src != sec_login_auth_src_network)
- {
- DEBUG(0, ("DCE context has no network credentials.\n"));
- }
-
- sec_login_set_context(my_dce_sec_context, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0,
- ("DCE login failed for principal %s, cant set context: %s\n",
- user, dce_errstr));
-
- sec_login_purge_context(&my_dce_sec_context, &err);
- goto err;
- }
-
- sec_login_get_pwent(my_dce_sec_context,
- (sec_login_passwd_t *) & pw, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get pwent. %s\n", dce_errstr));
- goto err;
- }
-
- DEBUG(0, ("DCE login succeeded for principal %s on pid %d\n",
- user, getpid()));
-
- DEBUG(3, ("DCE principal: %s\n"
- " uid: %d\n"
- " gid: %d\n",
- pw->pw_name, pw->pw_uid, pw->pw_gid));
- DEBUG(3, (" info: %s\n"
- " dir: %s\n"
- " shell: %s\n",
- pw->pw_gecos, pw->pw_dir, pw->pw_shell));
-
- sec_login_get_expiration(my_dce_sec_context, &expire_time, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0, ("DCE can't get expiration. %s\n", dce_errstr));
- goto err;
- }
-
- set_effective_uid(0);
- set_effective_gid(0);
-
- t = localtime(&expire_time);
- if (t) {
- const char *asct = asctime(t);
- if (asct) {
- DEBUG(0,("DCE context expires: %s", asct));
- }
- }
-
- dcelogin_atmost_once = 1;
- return (True);
-
- err:
-
- /* Go back to root, JRA. */
- set_effective_uid(0);
- set_effective_gid(egid);
- return (False);
-}
-
-void dfs_unlogin(void)
-{
- error_status_t err;
- int err2;
- unsigned char dce_errstr[dce_c_error_string_len];
-
- sec_login_purge_context(&my_dce_sec_context, &err);
- if (err != error_status_ok)
- {
- dce_error_inq_text(err, dce_errstr, &err2);
- DEBUG(0,
- ("DCE purge login context failed for server instance %d: %s\n",
- getpid(), dce_errstr));
- }
-}
-#endif
-
-#ifdef LINUX_BIGCRYPT
-/****************************************************************************
-an enhanced crypt for Linux to handle password longer than 8 characters
-****************************************************************************/
-static int linux_bigcrypt(char *password, char *salt1, char *crypted)
-{
-#define LINUX_PASSWORD_SEG_CHARS 8
- char salt[3];
- int i;
-
- StrnCpy(salt, salt1, 2);
- crypted += 2;
-
- for (i = strlen(password); i > 0; i -= LINUX_PASSWORD_SEG_CHARS) {
- char *p = crypt(password, salt) + 2;
- if (strncmp(p, crypted, LINUX_PASSWORD_SEG_CHARS) != 0)
- return (0);
- password += LINUX_PASSWORD_SEG_CHARS;
- crypted += strlen(p);
- }
-
- return (1);
-}
-#endif
-
-#ifdef OSF1_ENH_SEC
-/****************************************************************************
-an enhanced crypt for OSF1
-****************************************************************************/
-static char *osf1_bigcrypt(char *password, char *salt1)
-{
- static char result[AUTH_MAX_PASSWD_LENGTH] = "";
- char *p1;
- char *p2 = password;
- char salt[3];
- int i;
- int parts = strlen(password) / AUTH_CLEARTEXT_SEG_CHARS;
- if (strlen(password) % AUTH_CLEARTEXT_SEG_CHARS)
- parts++;
-
- StrnCpy(salt, salt1, 2);
- StrnCpy(result, salt1, 2);
- result[2] = '\0';
-
- for (i = 0; i < parts; i++) {
- p1 = crypt(p2, salt);
- strncat(result, p1 + 2,
- AUTH_MAX_PASSWD_LENGTH - strlen(p1 + 2) - 1);
- StrnCpy(salt, &result[2 + i * AUTH_CIPHERTEXT_SEG_CHARS], 2);
- p2 += AUTH_CLEARTEXT_SEG_CHARS;
- }
-
- return (result);
-}
-#endif
/****************************************************************************
core of password checking routine
****************************************************************************/
-static NTSTATUS password_check(const char *password, const void *private_data)
+static NTSTATUS password_check(const char *user, const char *password, const void *private_data)
{
#ifdef WITH_PAM
const char *rhost = (const char *)private_data;
- return smb_pam_passcheck(get_this_user(), rhost, password);
+ return smb_pam_passcheck(user, rhost, password);
#else
bool ret;
-#ifdef WITH_AFS
- if (afs_auth(get_this_user(), password))
- return NT_STATUS_OK;
-#endif /* WITH_AFS */
-#ifdef WITH_DFS
- if (dfs_auth(get_this_user(), password))
- return NT_STATUS_OK;
-#endif /* WITH_DFS */
-#ifdef OSF1_ENH_SEC
-
- ret = (strcmp(osf1_bigcrypt(password, get_this_salt()),
- get_this_crypted()) == 0);
--
Samba Shared Repository
More information about the samba-cvs
mailing list