git.samba.org / nivanova / samba-autobuild / .git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled
[nivanova/samba-autobuild/.git] / nsswitch / pam_winbind.c
diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c
index 04977267c970857409c650957c6538b4c82b3c11..9f855564bcca4af13ea8872e999b38eb2a47b4b8 100644 (file)
--- a/nsswitch/pam_winbind.c
+++ b/nsswitch/pam_winbind.c
@@ -164,25 +164,6 @@ static inline void textdomain_init(void)
 #endif
 
 
-/*
- * Work around the pam API that has functions with void ** as parameters
- * These lead to strict aliasing warnings with gcc.
- */
-static int _pam_get_item(const pam_handle_t *pamh,
-                        int item_type,
-                        const void *_item)
-{
-       const void **item = (const void **)_item;
-       return pam_get_item(pamh, item_type, item);
-}
-static int _pam_get_data(const pam_handle_t *pamh,
-                        const char *module_data_name,
-                        const void *_data)
-{
-       const void **data = (const void **)_data;
-       return pam_get_data(pamh, module_data_name, data);
-}
-
 /* some syslogging */
 
 #ifdef HAVE_PAM_VSYSLOG
@@ -202,7 +183,7 @@ static void _pam_log_int(const pam_handle_t *pamh,
        char *format2 = NULL;
        const char *service;
 
-       _pam_get_item(pamh, PAM_SERVICE, &service);
+       pam_get_item(pamh, PAM_SERVICE, (const void **) &service);
 
        format2 = (char *)malloc(strlen(MODULE_NAME)+strlen(format)+strlen(service)+5);
        if (format2 == NULL) {
@@ -437,13 +418,13 @@ static int _pam_parse(const pam_handle_t *pamh,
                ctrl |= WINBIND_SILENT;
        }
 
-       if (iniparser_getstr(d, discard_const_p(char, "global:krb5_ccache_type")) != NULL) {
+       if (iniparser_getstring(d, discard_const_p(char, "global:krb5_ccache_type"), NULL) != NULL) {
                ctrl |= WINBIND_KRB5_CCACHE_TYPE;
        }
 
-       if ((iniparser_getstr(d, discard_const_p(char, "global:require-membership-of"))
+       if ((iniparser_getstring(d, discard_const_p(char, "global:require-membership-of"), NULL)
             != NULL) ||
-           (iniparser_getstr(d, discard_const_p(char, "global:require_membership_of"))
+           (iniparser_getstring(d, discard_const_p(char, "global:require_membership_of"), NULL)
             != NULL)) {
                ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
        }
@@ -645,7 +626,7 @@ static int converse(const pam_handle_t *pamh,
        int retval;
        struct pam_conv *conv;
 
-       retval = _pam_get_item(pamh, PAM_CONV, &conv);
+       retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv);
        if (retval == PAM_SUCCESS) {
                retval = conv->conv(nargs,
                                    (const struct pam_message **)message,
@@ -812,13 +793,11 @@ static bool _pam_winbind_change_pwd(struct pwb_context *ctx)
 {
        struct pam_message msg, *pmsg;
        struct pam_response *resp = NULL;
-       const char *prompt;
        int ret;
        bool retval = false;
-       prompt = _("Do you want to change your password now?");
        pmsg = &msg;
        msg.msg_style = PAM_RADIO_TYPE;
-       msg.msg = prompt;
+       msg.msg = _("Do you want to change your password now?");
        ret = converse(ctx->pamh, 1, &pmsg, &resp);
        if (resp == NULL) {
                if (ret == PAM_SUCCESS) {
@@ -831,7 +810,7 @@ static bool _pam_winbind_change_pwd(struct pwb_context *ctx)
        }
        _pam_log(ctx, LOG_CRIT, "Received [%s] reply from application.\n", resp->resp);
 
-       if (strcasecmp(resp->resp, "yes") == 0) {
+       if ((resp->resp != NULL) && (strcasecmp(resp->resp, "yes") == 0)) {
                retval = true;
        }
 
@@ -1946,7 +1925,7 @@ static int winbind_chauthtok_request(struct pwb_context *ctx,
        }
 
        params.account_name             = user;
-       params.level                    = WBC_AUTH_USER_LEVEL_PLAIN;
+       params.level                    = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
        params.old_password.plaintext   = oldpass;
        params.new_password.plaintext   = newpass;
        params.flags                    = flags;
@@ -2064,6 +2043,9 @@ static int valid_user(struct pwb_context *ctx,
 
        switch (wbc_status) {
                case WBC_ERR_UNKNOWN_USER:
+               /* match other insane libwbclient return codes */
+               case WBC_ERR_WINBIND_NOT_AVAILABLE:
+               case WBC_ERR_DOMAIN_NOT_FOUND:
                        return 1;
                case WBC_ERR_SUCCESS:
                        return 0;
@@ -2120,7 +2102,9 @@ static int _winbind_read_password(struct pwb_context *ctx,
 
        if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) ||
            on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
-               retval = _pam_get_item(ctx->pamh, authtok_flag, &item);
+               retval = pam_get_item(ctx->pamh,
+                                     authtok_flag,
+                                     (const void **) &item);
                if (retval != PAM_SUCCESS) {
                        /* very strange. */
                        _pam_log(ctx, LOG_ALERT,
@@ -2228,7 +2212,7 @@ static int _winbind_read_password(struct pwb_context *ctx,
        retval = pam_set_item(ctx->pamh, authtok_flag, token);
        _pam_delete(token);     /* clean it up */
        if (retval != PAM_SUCCESS ||
-           (retval = _pam_get_item(ctx->pamh, authtok_flag, &item)) != PAM_SUCCESS) {
+           (retval = pam_get_item(ctx->pamh, authtok_flag, (const void **) &item)) != PAM_SUCCESS) {
 
                _pam_log(ctx, LOG_CRIT, "error manipulating password");
                return retval;
@@ -2278,7 +2262,7 @@ static const char *get_conf_item_string(struct pwb_context *ctx,
                        goto out;
                }
 
-               parm_opt = iniparser_getstr(ctx->dict, key);
+               parm_opt = iniparser_getstring(ctx->dict, key, NULL);
                TALLOC_FREE(key);
 
                _pam_log_debug(ctx, LOG_INFO, "CONFIG file: %s '%s'\n",
@@ -2446,7 +2430,7 @@ static char* winbind_upn_to_username(struct pwb_context *ctx,
                return NULL;
        }
 
-       return talloc_asprintf(ctx, "%s\\%s", domain, name);
+       return talloc_asprintf(ctx, "%s%c%s", domain, sep, name);
 }
 
 static int _pam_delete_cred(pam_handle_t *pamh, int flags,
@@ -2733,9 +2717,10 @@ out:
                _pam_free_data_info3(pamh);
        }
 
-       _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
-
-       TALLOC_FREE(ctx);
+       if (ctx != NULL) {
+               _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
+               TALLOC_FREE(ctx);
+       }
 
        return retval;
 }
@@ -2798,7 +2783,7 @@ int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
 {
        const char *username;
        int ret = PAM_USER_UNKNOWN;
-       void *tmp = NULL;
+       const char *tmp = NULL;
        struct pwb_context *ctx = NULL;
 
        ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
@@ -2839,7 +2824,7 @@ int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
                pam_get_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD,
                             (const void **)&tmp);
                if (tmp != NULL) {
-                       ret = atoi((const char *)tmp);
+                       ret = atoi(tmp);
                        switch (ret) {
                        case PAM_AUTHTOK_EXPIRED:
                                /* fall through, since new token is required in this case */
@@ -2965,8 +2950,8 @@ static bool _pam_require_krb5_auth_after_chauthtok(struct pwb_context *ctx,
        char *new_authtok_reqd_during_auth = NULL;
        struct passwd *pwd = NULL;
 
-       _pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
-                     &new_authtok_reqd_during_auth);
+       pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
+                     (const void **) &new_authtok_reqd_during_auth);
        pam_set_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
                     NULL, NULL);
 
@@ -2997,7 +2982,8 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 
        /* <DO NOT free() THESE> */
        const char *user;
-       char *pass_old, *pass_new;
+       const char *pass_old;
+       const char *pass_new;
        /* </DO NOT free() THESE> */
 
        char *Announce;
@@ -3120,7 +3106,7 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
                 * get the old token back.
                 */
 
-               ret = _pam_get_item(pamh, PAM_OLDAUTHTOK, &pass_old);
+               ret = pam_get_item(pamh, PAM_OLDAUTHTOK, (const void **) &pass_old);
 
                if (ret != PAM_SUCCESS) {
                        _pam_log(ctx, LOG_NOTICE,
@@ -3170,8 +3156,8 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
                 * By reaching here we have approved the passwords and must now
                 * rebuild the password database file.
                 */
-               _pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
-                             &pwdlastset_update);
+               pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
+                            (const void **) &pwdlastset_update);
 
                /*
                 * if cached creds were enabled, make sure to set the
Unnamed repository; edit this file 'description' to name the repository.