Mention `copy-devices`.

[rsync.git] / authenticate.c

diff --git a/authenticate.c b/authenticate.c
index a106b0f60a8cb88e37080bc5e2a58ce28c66f379..4306d1672317521665c7debe05f2a1e4cd27ef06 100644 (file)
--- a/authenticate.c
+++ b/authenticate.c
@@ -2,7 +2,7 @@
  * Support rsync daemon authentication.
  *
  * Copyright (C) 1998-2000 Andrew Tridgell
- * Copyright (C) 2002-2015 Wayne Davison
+ * Copyright (C) 2002-2020 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -20,9 +20,9 @@
 
 #include "rsync.h"
 #include "itypes.h"
+#include "ifuncs.h"
 
 extern int read_only;
-extern int protocol_version;
 extern char *password_file;
 
 /***************************************************************************
@@ -119,7 +119,7 @@ static const char *check_secret(int module, const char *user, const char *group,
                if ((st.st_mode & 06) != 0) {
                        rprintf(FLOG, "secrets file must not be other-accessible (see strict modes option)\n");
                        ok = 0;
-               } else if (MY_UID() == 0 && st.st_uid != 0) {
+               } else if (MY_UID() == ROOT_UID && st.st_uid != ROOT_UID) {
                        rprintf(FLOG, "secrets file must be owned by root when running as root (see strict modes)\n");
                        ok = 0;
                }
@@ -163,8 +163,8 @@ static const char *check_secret(int module, const char *user, const char *group,
 
        fclose(fh);
 
-       memset(line, 0, sizeof line);
-       memset(pass2, 0, sizeof pass2);
+       force_memzero(line, sizeof line);
+       force_memzero(pass2, sizeof pass2);
 
        return err;
 }
@@ -196,7 +196,7 @@ static const char *getpassf(const char *filename)
                        rprintf(FERROR, "ERROR: password file must not be other-accessible\n");
                        exit_cleanup(RERR_SYNTAX);
                }
-               if (MY_UID() == 0 && st.st_uid != 0) {
+               if (MY_UID() == ROOT_UID && st.st_uid != ROOT_UID) {
                        rprintf(FERROR, "ERROR: password file must be owned by root when running as root\n");
                        exit_cleanup(RERR_SYNTAX);
                }
@@ -227,7 +227,7 @@ char *auth_server(int f_in, int f_out, int module, const char *host,
        char *users = lp_auth_users(module);
        char challenge[MAX_DIGEST_LEN*2];
        char line[BIGPATHBUFLEN];
-       char **auth_uid_groups = NULL;
+       const char **auth_uid_groups = NULL;
        int auth_uid_groups_cnt = -1;
        const char *err = NULL;
        int group_match = -1;
@@ -238,11 +238,6 @@ char *auth_server(int f_in, int f_out, int module, const char *host,
        if (!users || !*users)
                return "";
 
-       if (protocol_version < 21) { /* Don't allow a weak checksum for the password. */
-               rprintf(FERROR, "ERROR: protocol version is too old!\n");
-               exit_cleanup(RERR_PROTOCOL);
-       }
-
        gen_challenge(addr, challenge);
 
        io_printf(f_out, "%s%s\n", leader, challenge);
@@ -256,8 +251,7 @@ char *auth_server(int f_in, int f_out, int module, const char *host,
        }
        *pass++ = '\0';
 
-       if (!(users = strdup(users)))
-               out_of_memory("auth_server");
+       users = strdup(users);
 
        for (tok = strtok(users, " ,\t"); tok; tok = strtok(NULL, " ,\t")) {
                char *opts;
@@ -293,8 +287,7 @@ char *auth_server(int f_in, int f_out, int module, const char *host,
                                else {
                                        gid_t *gid_array = gid_list.items;
                                        auth_uid_groups_cnt = gid_list.count;
-                                       if ((auth_uid_groups = new_array(char *, auth_uid_groups_cnt)) == NULL)
-                                               out_of_memory("auth_server");
+                                       auth_uid_groups = new_array(const char *, auth_uid_groups_cnt);
                                        for (j = 0; j < auth_uid_groups_cnt; j++)
                                                auth_uid_groups[j] = gid_to_group(gid_array[j]);
                                }
@@ -320,18 +313,18 @@ char *auth_server(int f_in, int f_out, int module, const char *host,
        else if (opt_ch == 'd')
                err = "denied by rule";
        else {
-               char *group = group_match >= 0 ? auth_uid_groups[group_match] : NULL;
+               const char *group = group_match >= 0 ? auth_uid_groups[group_match] : NULL;
                err = check_secret(module, line, group, challenge, pass);
        }
 
-       memset(challenge, 0, sizeof challenge);
-       memset(pass, 0, strlen(pass));
+       force_memzero(challenge, sizeof challenge);
+       force_memzero(pass, strlen(pass));
 
        if (auth_uid_groups) {
                int j;
                for (j = 0; j < auth_uid_groups_cnt; j++) {
                        if (auth_uid_groups[j])
-                               free(auth_uid_groups[j]);
+                               free((char*)auth_uid_groups[j]);
                }
                free(auth_uid_groups);
        }
@@ -363,12 +356,12 @@ void auth_client(int fd, const char *user, const char *challenge)
                /* XXX: cyeoh says that getpass is deprecated, because
                 * it may return a truncated password on some systems,
                 * and it is not in the LSB.
-                 *
-                 * Andrew Klein says that getpassphrase() is present
-                 * on Solaris and reads up to 256 characters.
-                 *
-                 * OpenBSD has a readpassphrase() that might be more suitable.
-                 */
+                *
+                * Andrew Klein says that getpassphrase() is present
+                * on Solaris and reads up to 256 characters.
+                *
+                * OpenBSD has a readpassphrase() that might be more suitable.
+                */
                pass = getpass("Password: ");
        }