X-Git-Url: https://git.ozlabs.org/?a=blobdiff_plain;f=pppd%2Fplugins%2Fwinbind.c;h=0c395c34711af6cef39d3ac01e3603f7205ebbc5;hb=HEAD;hp=8d8e981db190c8c74075094778a0f6e33866c52f;hpb=2c8046d6a1470ffb7593b456b403a03b90e13b3c;p=ppp.git diff --git a/pppd/plugins/winbind.c b/pppd/plugins/winbind.c index 8d8e981..7f930df 100644 --- a/pppd/plugins/winbind.c +++ b/pppd/plugins/winbind.c @@ -34,14 +34,6 @@ * ***********************************************************************/ -#include "pppd.h" -#include "chap-new.h" -#include "chap_ms.h" -#ifdef MPPE -#include "md5.h" -#endif -#include "fsm.h" -#include "ipcp.h" #include #include #include @@ -53,6 +45,20 @@ #include #include #include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include #define BUF_LEN 1024 @@ -67,7 +73,7 @@ static int set_ntlm_auth(char **argv) p = argv[0]; if (p[0] != '/') { - option_error("ntlm_auth-helper argument must be full path"); + ppp_option_error("ntlm_auth-helper argument must be full path"); return 0; } p = strdup(p); @@ -81,28 +87,18 @@ static int set_ntlm_auth(char **argv) return 1; } -static option_t Options[] = { +static struct option Options[] = { { "ntlm_auth-helper", o_special, (void *) &set_ntlm_auth, "Path to ntlm_auth executable", OPT_PRIV }, { NULL } }; -static int -winbind_secret_check(void); - -static int winbind_pap_auth(char *user, - char *passwd, - char **msgp, - struct wordlist **paddrs, - struct wordlist **popts); -static int winbind_chap_verify(char *user, char *ourname, int id, - struct chap_digest_type *digest, - unsigned char *challenge, - unsigned char *response, - char *message, int message_space); -static int winbind_allowed_address(u_int32_t addr); - -char pppd_version[] = VERSION; +static pap_check_hook_fn winbind_secret_check; +static pap_auth_hook_fn winbind_pap_auth; +static chap_verify_hook_fn winbind_chap_verify; +static int winbind_allowed_address(uint32_t addr); + +char pppd_version[] = PPPD_VERSION; /********************************************************************** * %FUNCTION: plugin_init @@ -127,7 +123,7 @@ plugin_init(void) /* Don't ask the peer for anything other than MS-CHAP or MS-CHAP V2 */ chap_mdtype_all &= (MDTYPE_MICROSOFT_V2 | MDTYPE_MICROSOFT); - add_options(Options); + ppp_add_options(Options); info("WINBIND plugin initialized."); } @@ -165,7 +161,7 @@ plugin_init(void) Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -size_t strhex_to_str(char *p, size_t len, const char *strhex) +size_t strhex_to_str(unsigned char *p, size_t len, const char *strhex) { size_t i; size_t num_chars = 0; @@ -285,7 +281,7 @@ unsigned int run_ntlm_auth(const char *username, return NOT_AUTHENTICATED; } - forkret = safe_fork(child_in[0], child_out[1], 2); + forkret = ppp_safe_fork(child_in[0], child_out[1], 2); if (forkret == -1) { if (error_string) { *error_string = strdup("fork failed!"); @@ -296,15 +292,23 @@ unsigned int run_ntlm_auth(const char *username, if (forkret == 0) { /* child process */ + uid_t uid; + gid_t gid; + close(child_out[0]); close(child_in[1]); /* run winbind as the user that invoked pppd */ - setgid(getgid()); - setuid(getuid()); + gid = getgid(); + if (setgid(gid) == -1 || getgid() != gid) { + fatal("pppd/winbind: could not setgid to %d: %m", gid); + } + uid = getuid(); + if (setuid(uid) == -1 || getuid() != uid) { + fatal("pppd/winbind: could not setuid to %d: %m", uid); + } execl("/bin/sh", "sh", "-c", ntlm_auth, NULL); - perror("pppd/winbind: could not exec /bin/sh"); - exit(1); + fatal("pppd/winbind: could not exec /bin/sh: %m"); } /* parent */ @@ -429,6 +433,7 @@ unsigned int run_ntlm_auth(const char *username, /* parent */ if (close(child_out[0]) == -1) { + close(child_in[1]); notice("error closing pipe?!? for child OUT[0]"); return NOT_AUTHENTICATED; } @@ -439,7 +444,7 @@ unsigned int run_ntlm_auth(const char *username, return NOT_AUTHENTICATED; } - while ((wait(&status) == -1) && errno == EINTR) + while ((wait(&status) == -1) && errno == EINTR && !ppp_signaled(SIGTERM)) ; if ((authenticated == AUTHENTICATED) && nt_key && !got_user_session_key) { @@ -514,9 +519,9 @@ winbind_chap_verify(char *user, char *ourname, int id, int challenge_len, response_len; char domainname[256]; char *domain; - char *username; + const char *username; char *p; - char saresponse[MS_AUTH_RESPONSE_LENGTH+1]; + unsigned char saresponse[MS_AUTH_RESPONSE_LENGTH+1]; /* The first byte of each of these strings contains their length */ challenge_len = *challenge++; @@ -548,7 +553,7 @@ winbind_chap_verify(char *user, char *ourname, int id, u_char *lm_response = NULL; int nt_response_size = 0; int lm_response_size = 0; - u_char session_key[16]; + u_char session_key[MD4_DIGEST_LENGTH]; if (response_len != MS_CHAP_RESPONSE_LEN) break; /* not even the right length */ @@ -558,14 +563,14 @@ winbind_chap_verify(char *user, char *ourname, int id, nt_response = &response[MS_CHAP_NTRESP]; nt_response_size = MS_CHAP_NTRESP_LEN; } else { -#ifdef MSLANMAN +#ifdef PPP_WITH_MSLANMAN lm_response = &response[MS_CHAP_LANMANRESP]; lm_response_size = MS_CHAP_LANMANRESP_LEN; #else /* Should really propagate this into the error packet. */ notice("Peer request for LANMAN auth not supported"); return NOT_AUTHENTICATED; -#endif /* MSLANMAN */ +#endif /* PPP_WITH_MSLANMAN */ } /* ship off to winbind, and check */ @@ -579,7 +584,9 @@ winbind_chap_verify(char *user, char *ourname, int id, nt_response, nt_response_size, session_key, &error_string) == AUTHENTICATED) { - mppe_set_keys(challenge, session_key); +#ifdef PPP_WITH_MPPE + mppe_set_chapv1(challenge, session_key); +#endif slprintf(message, message_space, "Access granted"); return AUTHENTICATED; @@ -598,7 +605,7 @@ winbind_chap_verify(char *user, char *ourname, int id, case CHAP_MICROSOFT_V2: { u_char Challenge[8]; - u_char session_key[MD4_SIGNATURE_SIZE]; + u_char session_key[MD4_DIGEST_LENGTH]; char *error_string = NULL; if (response_len != MS_CHAP2_RESPONSE_LEN) @@ -624,8 +631,10 @@ winbind_chap_verify(char *user, char *ourname, int id, &response[MS_CHAP2_NTRESP], &response[MS_CHAP2_PEER_CHALLENGE], challenge, user, saresponse); - mppe_set_keys2(session_key, &response[MS_CHAP2_NTRESP], +#ifdef PPP_WITH_MPPE + mppe_set_chapv2(session_key, &response[MS_CHAP2_NTRESP], MS_CHAP2_AUTHENTICATOR); +#endif if (response[MS_CHAP2_FLAGS]) { slprintf(message, message_space, "S=%s", saresponse); } else { @@ -656,7 +665,7 @@ winbind_chap_verify(char *user, char *ourname, int id, } static int -winbind_allowed_address(u_int32_t addr) +winbind_allowed_address(uint32_t addr) { ipcp_options *wo = &ipcp_wantoptions[0]; if (wo->hisaddr !=0 && wo->hisaddr == addr) {