Attachment 67690 Details for Bug 149021

[patch] Fixed version of that patch

diff (text/plain), 4.32 KB, created by Guenther Deschner on 2006-02-10 18:50:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Guenther Deschner

Created: 2006-02-10 18:50:16 UTC

Size: 4.32 KB

patch

obsolete

>Index: nsswitch/winbindd_util.c
>===================================================================
>--- nsswitch/winbindd_util.c	(revision 13428)
>+++ nsswitch/winbindd_util.c	(working copy)
>@@ -835,10 +835,10 @@
> 		if ( assume_domain(lp_workgroup())) {
> 			fstrcpy(domain, lp_workgroup());
> 		} else {
>-			fstrcpy( domain, get_global_sam_name() ); 
>+			fstrcpy(domain, "");
>+			return False;
> 		}
>-	} 
>-	else {
>+	} else {
> 		fstrcpy(user, p+1);
> 		fstrcpy(domain, domuser);
> 		domain[PTR_DIFF(p, domuser)] = 0;
>@@ -853,7 +853,9 @@
> 			      char **domain, char **user)
> {
> 	fstring fstr_domain, fstr_user;
>-	parse_domain_user(domuser, fstr_domain, fstr_user);
>+	if (!parse_domain_user(domuser, fstr_domain, fstr_user)) {
>+		return False;
>+	}
> 	*domain = talloc_strdup(mem_ctx, fstr_domain);
> 	*user = talloc_strdup(mem_ctx, fstr_user);
> 	return ((*domain != NULL) && (*user != NULL));
>Index: nsswitch/winbindd_user.c
>===================================================================
>--- nsswitch/winbindd_user.c	(revision 13428)
>+++ nsswitch/winbindd_user.c	(working copy)
>@@ -337,7 +337,7 @@
> 
> 	if (!parse_domain_user(state->request.data.username, domname,
> 			       username)) {
>-		DEBUG(0, ("Could not parse domain user: %s\n",
>+		DEBUG(1, ("Could not parse domain user: %s\n",
> 			  state->request.data.username));
> 		request_error(state);
> 		return;
>Index: nsswitch/winbindd_group.c
>===================================================================
>--- nsswitch/winbindd_group.c	(revision 13428)
>+++ nsswitch/winbindd_group.c	(working copy)
>@@ -992,7 +992,7 @@
> 	if (!parse_domain_user_talloc(state->mem_ctx,
> 				      state->request.data.username,
> 				      &s->domname, &s->username)) {
>-		DEBUG(0, ("Could not parse domain user: %s\n",
>+		DEBUG(1, ("Could not parse domain user: %s\n",
> 			  state->request.data.username));
> 		request_error(state);
> 		return;
>Index: nsswitch/pam_winbind.c
>===================================================================
>--- nsswitch/pam_winbind.c	(revision 13428)
>+++ nsswitch/pam_winbind.c	(working copy)
>@@ -566,10 +569,38 @@
>  *	 0  = OK
>  * 	-1  = System error
>  */
>-static int valid_user(const char *user)
>+static int valid_user(const char *user, pam_handle_t *pamh, int ctrl)
> {
>-	if (getpwnam(user)) return 0;
>-	return 1;
>+	/* check not only if the user is available over NSS calls, also make
>+	 * sure it's really a winbind user, this is important when stacking PAM
>+	 * modules in the 'account' or 'password' facility. */
>+
>+	struct passwd *pwd = NULL;
>+	struct winbindd_request request;
>+	struct winbindd_response response;
>+	int ret;
>+
>+	ZERO_STRUCT(request);
>+	ZERO_STRUCT(response);
>+
>+	pwd = getpwnam(user);
>+	if (pwd == NULL) {
>+		return 1;
>+	}
>+
>+	fstrcpy(request.data.username, user);
>+
>+	ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_GETPWNAM, &request, &response, user);
>+
>+	switch (ret) {
>+		case PAM_USER_UNKNOWN:
>+			return 1;
>+		case PAM_SUCCESS:
>+			return 0;
>+		default:
>+			break;
>+	}
>+	return -1;
> }
> 
> static char *_pam_delete(register char *xx)
>@@ -897,7 +972,7 @@
> 	}
> 
> 	/* Verify the username */
>-	retval = valid_user(username);
>+	retval = valid_user(username, pamh, ctrl);
> 	switch (retval) {
> 	case -1:
> 		/* some sort of system error. The log was already printed */
>@@ -1123,6 +1198,17 @@
> 		return retval;
> 	}
> 
>+	/* check if this is really a user in winbindd, not only in NSS */
>+	retval = valid_user(user, pamh, ctrl);
>+	switch (retval) {
>+		case 1:
>+			return PAM_USER_UNKNOWN;
>+		case -1:
>+			return PAM_SYSTEM_ERR;
>+		default:
>+			break;
>+	}
>+		
> 	/*
> 	 * obtain and verify the current password (OLDAUTHTOK) for
> 	 * the user.
>Index: nsswitch/winbindd_pam.c
>===================================================================
>--- nsswitch/winbindd_pam.c	(revision 13428)
>+++ nsswitch/winbindd_pam.c	(working copy)
>@@ -633,8 +633,17 @@
> 
> 	/* Parse domain and username */
> 	
>-	parse_domain_user(state->request.data.auth.user,
>-			  name_domain, name_user);
>+	if (!parse_domain_user(state->request.data.auth.user,
>+			       name_domain, name_user)) {
>+		set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
>+		DEBUG(5, ("Plain text authentication for %s returned %s "
>+			  "(PAM: %d)\n",
>+			  state->request.data.auth.user, 
>+			  state->response.data.auth.nt_status_string,
>+			  state->response.data.auth.pam_error));
>+		request_error(state);
>+		return;
>+	}
> 
> 	domain = find_auth_domain(state, name_domain);
>

Actions: View | Diff

Attachments on bug 149021: 66977 | 67208 | 67689 | 67690