1 --- pam_ldap-176/Makefile.am 2004-09-30 22:33:14.000000000 -0400
2 +++ pam_ldap-176/Makefile.am 2004-10-28 17:24:13.691936696 -0400
3 @@ -2,7 +2,7 @@ noinst_PROGRAMS = pam_ldap.so
4 EXTRA_DIST = COPYING.LIB CVSVersionInfo.txt ChangeLog README \
5 ldap.conf pam.conf pam_ldap.spec pam.d
7 -pam_ldap_so_SOURCES = pam_ldap.c pam_ldap.h md5.c md5.h vers.c
8 +pam_ldap_so_SOURCES = pam_ldap.c pam_ldap.h md5.c md5.h vers.c resolve.c resolve.h dnsconfig.c dnsconfig.h snprintf.c snprintf.h
9 pam_ldap_so_LDFLAGS = @pam_ldap_so_LDFLAGS@
12 --- pam_ldap-176/configure.in 2004-09-30 22:33:14.000000000 -0400
13 +++ pam_ldap-176/configure.in 2004-10-28 17:24:13.692936544 -0400
15 AC_CHECK_FUNCS(ldap_initialize)
16 AC_CHECK_FUNCS(ldap_sasl_bind ldap_sasl_interactive_bind_s)
17 AC_CHECK_FUNCS(gethostbyname_r)
18 +AC_CHECK_FUNCS(snprintf strtok_r)
19 +AC_CHECK_LIB(resolv, main)
20 +AC_CHECK_HEADERS(resolv.h)
21 +AC_CHECK_FUNCS(res_search dn_expand)
22 +if test x$ac_cv_func_res_search = xno ; then
23 + AC_MSG_CHECKING([for res_search again])
24 + AC_TRY_LINK([#ifdef HAVE_RESOLV_H
27 + #ifdef HAVE_STDLIB_H
30 + [res_search(NULL,0,0,NULL,0);],
31 + AC_DEFINE(HAVE_RES_SEARCH,1,
32 + [Define if you have res_search().])
33 + ac_cv_func_res_search=yes)
34 + AC_CHECK_FUNCS(res_search)
36 +if test x$ac_cv_func_dn_expand = xno ; then
37 + AC_MSG_CHECKING([for dn_expand again])
38 + AC_TRY_LINK([#ifdef HAVE_RESOLV_H
41 + #ifdef HAVE_STDLIB_H
44 + [dn_expand(NULL,NULL,NULL,NULL,0);],
45 + AC_DEFINE(HAVE_DN_EXPAND,1,
46 + [Define if you have dn_expand().])
47 + ac_cv_func_dn_expand=yes)
48 + AC_CHECK_FUNCS(dn_expand)
51 if test "$ac_cv_func_gethostbyname_r" = "yes"; then
52 AC_CACHE_CHECK(whether gethostbyname_r takes 6 arguments, xad_cv_gethostbyname_r_args, [
53 --- /dev/null 2004-10-19 17:45:17.794252000 -0400
54 +++ pam_ldap-176/dnsconfig.c 2004-10-28 17:32:36.915435096 -0400
57 +/* Copyright (C) 1997-2001 Luke Howard.
58 + This file started off as part of the nss_ldap library.
59 + Contributed by Luke Howard, <lukeh@padl.com>, 1997.
60 + (The author maintains a non-exclusive licence to distribute this file
61 + under their own conditions.)
63 + The nss_ldap library is free software; you can redistribute it and/or
64 + modify it under the terms of the GNU Library General Public License as
65 + published by the Free Software Foundation; either version 2 of the
66 + License, or (at your option) any later version.
68 + The nss_ldap library is distributed in the hope that it will be useful,
69 + but WITHOUT ANY WARRANTY; without even the implied warranty of
70 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
71 + Library General Public License for more details.
73 + You should have received a copy of the GNU Library General Public
74 + License along with the nss_ldap library; see the file COPYING.LIB. If not,
75 + write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
76 + Boston, MA 02111-1307, USA.
80 + * Support DNS SRV records. I look up the SRV record for
81 + * _ldap._tcp.gnu.org.
82 + * and build the DN DC=gnu,DC=org.
83 + * Thanks to Assar & co for resolve.[ch].
86 +static char rcsId[] = "$Id: dnsconfig.c,v 2.24 2001/02/27 14:44:31 lukeh Exp $";
93 +#include <sys/param.h>
96 +#include <netinet/in.h>
97 +#include <arpa/nameser.h>
108 +#ifndef HAVE_SNPRINTF
109 +#include "snprintf.h"
112 +#include "pam_ldap.h"
113 +#include "resolve.h"
114 +#include "dnsconfig.h"
116 +#define DC_ATTR "DC"
117 +#define DC_ATTR_AVA DC_ATTR "="
118 +#define DC_ATTR_AVA_LEN (sizeof(DC_ATTR_AVA) - 1)
120 +/* map gnu.org into DC=gnu,DC=org */
122 +_pam_ldap_getdnsdn (char *src_domain, char **rval)
126 +#ifdef HAVE_STRTOK_R
130 + char domain_copy[BUFSIZ], buffer[BUFSIZ];
132 + /* we need to take a copy of domain, because strtok() modifies
133 + * it in place. Bad.
135 + if (strlen (src_domain) >= sizeof (domain_copy))
137 + return PAM_SYSTEM_ERR;
139 + memset (domain_copy, '\0', sizeof (domain_copy));
140 + memset (buffer, '\0', sizeof (buffer));
141 + strcpy (domain_copy, src_domain);
143 + domain = domain_copy;
145 +#ifndef HAVE_STRTOK_R
146 + while ((p = strtok (domain, ".")))
148 + while ((p = strtok_r (domain, ".", &st)))
153 + if (strlen (buffer) + DC_ATTR_AVA_LEN + len + 1 >= sizeof (buffer))
155 + return PAM_SYSTEM_ERR;
158 + if (domain == NULL)
160 + strcat (buffer, ",");
167 + strcat (buffer, DC_ATTR_AVA);
168 + strcat (buffer, p);
173 + *rval = strdup (buffer);
176 + return PAM_SUCCESS;
181 +_pam_ldap_readconfigfromdns (pam_ldap_config_t * result)
183 + int stat = PAM_SUCCESS;
184 + struct dns_reply *r;
185 + struct resource_record *rr;
186 + char domain[MAXHOSTNAMELEN + 1];
188 + /* only reinitialize variables we'll change here */
189 + result->host = NULL;
190 + result->base = NULL;
191 + result->port = LDAP_PORT;
192 +#ifdef LDAP_VERSION3
193 + result->version = LDAP_VERSION3;
195 + result->version = LDAP_VERSION2;
196 +#endif /* LDAP_VERSION3 */
198 + if ((_res.options & RES_INIT) == 0 && res_init () == -1)
200 + return PAM_SYSTEM_ERR;
203 + snprintf (domain, sizeof (domain), "_ldap._tcp.%s.", _res.defdname);
205 + r = dns_lookup (domain, "srv");
208 + return PAM_SYSTEM_ERR;
211 + /* XXX need to sort by priority and reorder using weights */
212 + for (rr = r->head; rr != NULL; rr = rr->next)
214 + if (rr->type == T_SRV)
216 + if (result->host != NULL)
218 + /* need more space */
221 + length = strlen (result->host) + 1 +
222 + strlen (rr->u.srv->target) + 1 + 5 + 1;
223 + tmp = malloc (length);
227 + return PAM_BUF_ERR;
229 + sprintf (tmp, "%s %s:%d", result->host, rr->u.srv->target,
231 + free (result->host);
232 + result->host = tmp;
237 + result->host = strdup (rr->u.srv->target);
238 + if (result->host == NULL)
241 + return PAM_BUF_ERR;
244 + result->port = rr->u.srv->port;
248 + /* Hack: if the port is the registered SSL port, enable SSL. */
249 + if (result->port == LDAPS_PORT)
251 + result->ssl_on = SSL_LDAPS;
256 + stat = _pam_ldap_getdnsdn (_res.defdname, &result->base);
257 + if (stat != PAM_SUCCESS)
266 + stat = PAM_SUCCESS;
270 --- /dev/null 2004-10-19 17:45:17.794252000 -0400
271 +++ pam_ldap-176/dnsconfig.h 2004-10-28 17:24:13.694936240 -0400
273 +/* Copyright (C) 1997-2001 Luke Howard.
274 + This file started off as part of the nss_ldap library.
275 + Contributed by Luke Howard, <lukeh@padl.com>, 1997.
276 + (The author maintains a non-exclusive licence to distribute this file
277 + under their own conditions.)
279 + The nss_ldap library is free software; you can redistribute it and/or
280 + modify it under the terms of the GNU Library General Public License as
281 + published by the Free Software Foundation; either version 2 of the
282 + License, or (at your option) any later version.
284 + The nss_ldap library is distributed in the hope that it will be useful,
285 + but WITHOUT ANY WARRANTY; without even the implied warranty of
286 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
287 + Library General Public License for more details.
289 + You should have received a copy of the GNU Library General Public
290 + License along with the nss_ldap library; see the file COPYING.LIB. If not,
291 + write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
292 + Boston, MA 02111-1307, USA.
295 +#ifndef _LDAP_PAM_LDAP_DNSCONFIG_H
296 +#define _LDAP_PAM_LDAP_DNSCONFIG_H
298 +/* utility routines. */
300 +int _pam_ldap_getdnsdn (
304 +int _pam_ldap_readconfigfromdns (
305 + pam_ldap_config_t *result);
307 +#endif /* _LDAP_PAM_LDAP_DNSCONFIG_H */
308 --- pam_ldap-176/pam_ldap.c 2004-09-30 22:33:14.000000000 -0400
309 +++ pam_ldap-176/pam_ldap.c 2004-10-28 17:40:56.918423088 -0400
312 #include "pam_ldap.h"
314 +#include "dnsconfig.h"
316 #if defined(HAVE_SECURITY_PAM_MISC_H) || defined(HAVE_PAM_PAM_MISC_H)
317 /* FIXME: is there something better to check? */
318 @@ -1107,11 +1108,15 @@
321 * According to PAM Documentation, such an error in a config file
322 - * SHOULD be logged at LOG_ALERT level
323 + * SHOULD be logged at LOG_ALERT level, but we suppress it if DNS
324 + * can provide us with the needed information
326 - syslog (LOG_ALERT, "pam_ldap: missing \"host\" in file \"%s\"",
328 - return PAM_SERVICE_ERR;
329 + if (_pam_ldap_readconfigfromdns (result) != PAM_SUCCESS)
331 + syslog (LOG_ALERT, "pam_ldap: missing \"host\" in file \"%s\"",
333 + return PAM_SERVICE_ERR;
337 #if !(defined(HAVE_SASL_SASL_H) || defined(HAVE_SASL_H)) && !defined(HAVE_LDAP_SASL_INTERACTIVE_BIND_S)