X-Git-Url: http://git.samba.org/samba.git/?p=tprouty%2Fsamba.git;a=blobdiff_plain;f=source%2Fnsswitch%2Fwb_common.c;h=6e6d2bbbf84d4f90fc18819dff9708c27ce2de00;hp=0e2092794116eb2f62e8f96e3666cf11ca65a8e1;hb=c1df51abdf366caf3cde84b1399d05abdc36133b;hpb=d720867a788c735e56d53d63265255830ec21208 diff --git a/source/nsswitch/wb_common.c b/source/nsswitch/wb_common.c index 0e20927941..6e6d2bbbf8 100644 --- a/source/nsswitch/wb_common.c +++ b/source/nsswitch/wb_common.c @@ -9,19 +9,17 @@ This library is free software; you can redistribute it and/or - modify it under the terms of the GNU Library General Public + modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either - version 2 of the License, or (at your option) any later version. + version 3 of the License, or (at your option) any later version. This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public License for more details. - You should have received a copy of the GNU Library General Public - License along with this library; if not, write to the - Free Software Foundation, Inc., 59 Temple Place - Suite 330, - Boston, MA 02111-1307, USA. + You should have received a copy of the GNU Lesser General Public License + along with this program. If not, see . */ #include "winbind_client.h" @@ -29,20 +27,21 @@ /* Global variables. These are effectively the client state information */ int winbindd_fd = -1; /* fd for winbindd socket */ +static int is_privileged = 0; /* Free a response structure */ -void free_response(struct winbindd_response *response) +void winbindd_free_response(struct winbindd_response *response) { /* Free any allocated extra_data */ if (response) - SAFE_FREE(response->extra_data); + SAFE_FREE(response->extra_data.data); } /* Initialise a request structure */ -void init_request(struct winbindd_request *request, int request_type) +void winbindd_init_request(struct winbindd_request *request, int request_type) { request->length = sizeof(struct winbindd_request); @@ -53,7 +52,7 @@ void init_request(struct winbindd_request *request, int request_type) /* Initialise a response structure */ -void init_response(struct winbindd_response *response) +static void init_response(struct winbindd_response *response) { /* Initialise return value */ @@ -62,7 +61,7 @@ void init_response(struct winbindd_response *response) /* Close established socket */ -void close_sock(void) +void winbind_close_sock(void) { if (winbindd_fd != -1) { close(winbindd_fd); @@ -71,8 +70,6 @@ void close_sock(void) } #define CONNECT_TIMEOUT 30 -#define WRITE_TIMEOUT CONNECT_TIMEOUT -#define READ_TIMEOUT CONNECT_TIMEOUT /* Make sure socket handle isn't stdin, stdout or stderr */ #define RECURSION_LIMIT 3 @@ -171,54 +168,55 @@ static int winbind_named_pipe_sock(const char *dir) { struct sockaddr_un sunaddr; struct stat st; - pstring path; + char *path = NULL; int fd; int wait_time; int slept; - + /* Check permissions on unix socket directory */ - + if (lstat(dir, &st) == -1) { + errno = ENOENT; return -1; } - - if (!S_ISDIR(st.st_mode) || + + if (!S_ISDIR(st.st_mode) || (st.st_uid != 0 && st.st_uid != geteuid())) { + errno = ENOENT; return -1; } - + /* Connect to socket */ - - strncpy(path, dir, sizeof(path) - 1); - path[sizeof(path) - 1] = '\0'; - - strncat(path, "/", sizeof(path) - 1 - strlen(path)); - path[sizeof(path) - 1] = '\0'; - - strncat(path, WINBINDD_SOCKET_NAME, sizeof(path) - 1 - strlen(path)); - path[sizeof(path) - 1] = '\0'; - + + if (asprintf(&path, "%s/%s", dir, WINBINDD_SOCKET_NAME) < 0) { + return -1; + } + ZERO_STRUCT(sunaddr); sunaddr.sun_family = AF_UNIX; strncpy(sunaddr.sun_path, path, sizeof(sunaddr.sun_path) - 1); - + /* If socket file doesn't exist, don't bother trying to connect with retry. This is an attempt to make the system usable when the winbindd daemon is not running. */ if (lstat(path, &st) == -1) { + errno = ENOENT; + SAFE_FREE(path); return -1; } - + + SAFE_FREE(path); /* Check permissions on unix socket file */ - - if (!S_ISSOCK(st.st_mode) || + + if (!S_ISSOCK(st.st_mode) || (st.st_uid != 0 && st.st_uid != geteuid())) { + errno = ENOENT; return -1; } - + /* Connect to socket */ - + if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) { return -1; } @@ -283,9 +281,23 @@ static int winbind_named_pipe_sock(const char *dir) return -1; } +static const char *winbindd_socket_dir(void) +{ +#ifdef SOCKET_WRAPPER + const char *env_dir; + + env_dir = getenv(WINBINDD_SOCKET_DIR_ENVVAR); + if (env_dir) { + return env_dir; + } +#endif + + return WINBINDD_SOCKET_DIR; +} + /* Connect to winbindd socket */ -static int winbind_open_pipe_sock(int recursing) +static int winbind_open_pipe_sock(int recursing, int need_priv) { #ifdef HAVE_UNIXSOCKET static pid_t our_pid; @@ -295,9 +307,13 @@ static int winbind_open_pipe_sock(int recursing) ZERO_STRUCT(response); if (our_pid != getpid()) { - close_sock(); + winbind_close_sock(); our_pid = getpid(); } + + if ((need_priv != 0) && (is_privileged == 0)) { + winbind_close_sock(); + } if (winbindd_fd != -1) { return winbindd_fd; @@ -307,30 +323,37 @@ static int winbind_open_pipe_sock(int recursing) return -1; } - if ((winbindd_fd = winbind_named_pipe_sock(WINBINDD_SOCKET_DIR)) == -1) { + if ((winbindd_fd = winbind_named_pipe_sock(winbindd_socket_dir())) == -1) { return -1; } + is_privileged = 0; + /* version-check the socket */ - request.flags = WBFLAG_RECURSE; + request.wb_flags = WBFLAG_RECURSE; if ((winbindd_request_response(WINBINDD_INTERFACE_VERSION, &request, &response) != NSS_STATUS_SUCCESS) || (response.data.interface_version != WINBIND_INTERFACE_VERSION)) { - close_sock(); + winbind_close_sock(); return -1; } /* try and get priv pipe */ - request.flags = WBFLAG_RECURSE; + request.wb_flags = WBFLAG_RECURSE; if (winbindd_request_response(WINBINDD_PRIV_PIPE_DIR, &request, &response) == NSS_STATUS_SUCCESS) { int fd; - if ((fd = winbind_named_pipe_sock(response.extra_data)) != -1) { + if ((fd = winbind_named_pipe_sock((char *)response.extra_data.data)) != -1) { close(winbindd_fd); winbindd_fd = fd; + is_privileged = 1; } } - SAFE_FREE(response.extra_data); + if ((need_priv != 0) && (is_privileged == 0)) { + return -1; + } + + SAFE_FREE(response.extra_data.data); return winbindd_fd; #else @@ -340,7 +363,7 @@ static int winbind_open_pipe_sock(int recursing) /* Write data to winbindd socket */ -int write_sock(void *buffer, int count, int recursing) +int winbind_write_sock(void *buffer, int count, int recursing, int need_priv) { int result, nwritten; @@ -348,7 +371,8 @@ int write_sock(void *buffer, int count, int recursing) restart: - if (winbind_open_pipe_sock(recursing) == -1) { + if (winbind_open_pipe_sock(recursing, need_priv) == -1) { + errno = ENOENT; return -1; } @@ -368,7 +392,7 @@ int write_sock(void *buffer, int count, int recursing) ZERO_STRUCT(tv); if (select(winbindd_fd + 1, &r_fds, NULL, NULL, &tv) == -1) { - close_sock(); + winbind_close_sock(); return -1; /* Select error */ } @@ -386,7 +410,7 @@ int write_sock(void *buffer, int count, int recursing) /* Write failed */ - close_sock(); + winbind_close_sock(); return -1; } @@ -396,7 +420,7 @@ int write_sock(void *buffer, int count, int recursing) /* Pipe has closed on remote end */ - close_sock(); + winbind_close_sock(); goto restart; } } @@ -406,11 +430,15 @@ int write_sock(void *buffer, int count, int recursing) /* Read data from winbindd socket */ -static int read_sock(void *buffer, int count) +int winbind_read_sock(void *buffer, int count) { - int result = 0, nread = 0; + int nread = 0; int total_time = 0, selret; + if (winbindd_fd == -1) { + return -1; + } + /* Read data from socket */ while(nread < count) { struct timeval tv; @@ -426,7 +454,7 @@ static int read_sock(void *buffer, int count) tv.tv_sec = 5; if ((selret = select(winbindd_fd + 1, &r_fds, NULL, NULL, &tv)) == -1) { - close_sock(); + winbind_close_sock(); return -1; /* Select error */ } @@ -434,7 +462,7 @@ static int read_sock(void *buffer, int count) /* Not ready for read yet... */ if (total_time >= 30) { /* Timeout */ - close_sock(); + winbind_close_sock(); return -1; } total_time += 5; @@ -445,7 +473,7 @@ static int read_sock(void *buffer, int count) /* Do the Read */ - result = read(winbindd_fd, (char *)buffer + nread, + int result = read(winbindd_fd, (char *)buffer + nread, count - nread); if ((result == -1) || (result == 0)) { @@ -454,7 +482,7 @@ static int read_sock(void *buffer, int count) can do here is just return -1 and fail since the transaction has failed half way through. */ - close_sock(); + winbind_close_sock(); return -1; } @@ -463,12 +491,12 @@ static int read_sock(void *buffer, int count) } } - return result; + return nread; } /* Read reply */ -int read_reply(struct winbindd_response *response) +int winbindd_read_reply(struct winbindd_response *response) { int result1, result2 = 0; @@ -478,9 +506,9 @@ int read_reply(struct winbindd_response *response) /* Read fixed length response */ - if ((result1 = read_sock(response, sizeof(struct winbindd_response))) - == -1) { - + result1 = winbind_read_sock(response, + sizeof(struct winbindd_response)); + if (result1 == -1) { return -1; } @@ -488,7 +516,7 @@ int read_reply(struct winbindd_response *response) the server. This has no meaning in the client's address space so we clear it out. */ - response->extra_data = NULL; + response->extra_data.data = NULL; /* Read variable length response */ @@ -498,13 +526,14 @@ int read_reply(struct winbindd_response *response) /* Mallocate memory for extra data */ - if (!(response->extra_data = malloc(extra_data_len))) { + if (!(response->extra_data.data = malloc(extra_data_len))) { return -1; } - if ((result2 = read_sock(response->extra_data, extra_data_len)) - == -1) { - free_response(response); + result2 = winbind_read_sock(response->extra_data.data, + extra_data_len); + if (result2 == -1) { + winbindd_free_response(response); return -1; } } @@ -518,18 +547,15 @@ int read_reply(struct winbindd_response *response) * send simple types of requests */ -NSS_STATUS winbindd_send_request(int req_type, struct winbindd_request *request) +NSS_STATUS winbindd_send_request(int req_type, int need_priv, + struct winbindd_request *request) { struct winbindd_request lrequest; - char *env; - int value; - + /* Check for our tricky environment variable */ - if ( (env = getenv(WINBINDD_DONT_ENV)) != NULL ) { - value = atoi(env); - if ( value == 1 ) - return NSS_STATUS_NOTFOUND; + if (winbind_env_set()) { + return NSS_STATUS_NOTFOUND; } if (!request) { @@ -539,14 +565,27 @@ NSS_STATUS winbindd_send_request(int req_type, struct winbindd_request *request) /* Fill in request and send down pipe */ - init_request(request, req_type); + winbindd_init_request(request, req_type); - if (write_sock(request, sizeof(*request), request->flags & WBFLAG_RECURSE) == -1) { + if (winbind_write_sock(request, sizeof(*request), + request->wb_flags & WBFLAG_RECURSE, + need_priv) == -1) + { + /* Set ENOENT for consistency. Required by some apps */ + errno = ENOENT; + return NSS_STATUS_UNAVAIL; } if ((request->extra_len != 0) && - (write_sock(request->extra_data, request->extra_len, request->flags & WBFLAG_RECURSE) == -1)) { + (winbind_write_sock(request->extra_data.data, + request->extra_len, + request->wb_flags & WBFLAG_RECURSE, + need_priv) == -1)) + { + /* Set ENOENT for consistency. Required by some apps */ + errno = ENOENT; + return NSS_STATUS_UNAVAIL; } @@ -569,13 +608,16 @@ NSS_STATUS winbindd_get_response(struct winbindd_response *response) init_response(response); /* Wait for reply */ - if (read_reply(response) == -1) { + if (winbindd_read_reply(response) == -1) { + /* Set ENOENT for consistency. Required by some apps */ + errno = ENOENT; + return NSS_STATUS_UNAVAIL; } /* Throw away extra data if client didn't request it */ if (response == &lresponse) { - free_response(response); + winbindd_free_response(response); } /* Copy reply data from socket */ @@ -596,7 +638,7 @@ NSS_STATUS winbindd_request_response(int req_type, int count = 0; while ((status == NSS_STATUS_UNAVAIL) && (count < 10)) { - status = winbindd_send_request(req_type, request); + status = winbindd_send_request(req_type, 0, request); if (status != NSS_STATUS_SUCCESS) return(status); status = winbindd_get_response(response); @@ -606,24 +648,43 @@ NSS_STATUS winbindd_request_response(int req_type, return status; } -/************************************************************************* - A couple of simple functions to disable winbindd lookups and re- - enable them - ************************************************************************/ - -/* Use putenv() instead of setenv() in these functions as not all - environments have the latter. */ - -BOOL winbind_off( void ) +NSS_STATUS winbindd_priv_request_response(int req_type, + struct winbindd_request *request, + struct winbindd_response *response) { - static char *s = CONST_DISCARD(char *, WINBINDD_DONT_ENV "=1"); + NSS_STATUS status = NSS_STATUS_UNAVAIL; + int count = 0; - return putenv(s) != -1; + while ((status == NSS_STATUS_UNAVAIL) && (count < 10)) { + status = winbindd_send_request(req_type, 1, request); + if (status != NSS_STATUS_SUCCESS) + return(status); + status = winbindd_get_response(response); + count += 1; + } + + return status; } -BOOL winbind_on( void ) -{ - static char *s = CONST_DISCARD(char *, WINBINDD_DONT_ENV "=0"); +/************************************************************************* + ************************************************************************/ - return putenv(s) != -1; +const char *nss_err_str(NSS_STATUS ret) +{ + switch (ret) { + case NSS_STATUS_TRYAGAIN: + return "NSS_STATUS_TRYAGAIN"; + case NSS_STATUS_SUCCESS: + return "NSS_STATUS_SUCCESS"; + case NSS_STATUS_NOTFOUND: + return "NSS_STATUS_NOTFOUND"; + case NSS_STATUS_UNAVAIL: + return "NSS_STATUS_UNAVAIL"; +#ifdef NSS_STATUS_RETURN + case NSS_STATUS_RETURN: + return "NSS_STATUS_RETURN"; +#endif + default: + return "UNKNOWN RETURN CODE!!!!!!!"; + } }