[Pkg-shadow-commits] r2723 - in upstream/trunk: . src
Nicolas FRANÇOIS
nekral-guest at alioth.debian.org
Mon Apr 20 12:47:04 UTC 2009
Author: nekral-guest
Date: 2009-04-20 12:47:04 +0000 (Mon, 20 Apr 2009)
New Revision: 2723
Modified:
upstream/trunk/ChangeLog
upstream/trunk/src/login.c
Log:
* src/login.c: Added helper functions get_pam_user() and
get_failent_user().
Modified: upstream/trunk/ChangeLog
===================================================================
--- upstream/trunk/ChangeLog 2009-04-20 12:33:01 UTC (rev 2722)
+++ upstream/trunk/ChangeLog 2009-04-20 12:47:04 UTC (rev 2723)
@@ -1,5 +1,10 @@
2009-04-20 Nicolas François <nicolas.francois at centraliens.net>
+ * src/login.c: Added helper functions get_pam_user() and
+ get_failent_user().
+
+2009-04-20 Nicolas François <nicolas.francois at centraliens.net>
+
* src/login.c: Added parameter to check_nologin. This will help
getting rid of the global pwent variable.
Modified: upstream/trunk/src/login.c
===================================================================
--- upstream/trunk/src/login.c 2009-04-20 12:33:01 UTC (rev 2722)
+++ upstream/trunk/src/login.c 2009-04-20 12:47:04 UTC (rev 2723)
@@ -45,6 +45,7 @@
#include <stdio.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
+#include <assert.h>
#include "defines.h"
#include "faillog.h"
#include "failure.h"
@@ -129,12 +130,15 @@
static void usage (void);
static void setup_tty (void);
static void process_flags (int, char *const *);
+static const char *get_failent_user (const char *user)
#ifndef USE_PAM
static struct faillog faillog;
static void bad_time_notify (void);
static void check_nologin (bool login_to_root);
+#else
+static void get_pam_user (char **ptr_pam_user);
#endif
static void init_env (void);
@@ -396,8 +400,58 @@
exit (0);
}
+#ifdef USE_PAM
+/*
+ * get_pam_user - Get the username according to PAM
+ *
+ * ptr_pam_user shall point to a malloc'ed string (or NULL).
+ */
+static void get_pam_user (char **ptr_pam_user)
+{
+ int retcode;
+ void *ptr_user;
+ assert (NULL != ptr_pam_user);
+
+ retcode = pam_get_item (pamh, PAM_USER, (const void **)&ptr_user);
+ PAM_FAIL_CHECK;
+
+ if (NULL != *ptr_pam_user) {
+ free (*ptr_pam_user);
+ }
+ if (NULL != ptr_user) {
+ *ptr_pam_user = xstrdup ((const char *)ptr_user);
+ } else {
+ *ptr_pam_user = NULL;
+ }
+}
+#endif
+
/*
+ * get_failent_user - Return a string that can be used to log failure
+ * from an user.
+ *
+ * This will be either the user argument, or "UNKNOWN".
+ *
+ * It is quite common to mistyped the password for username, and passwords
+ * should not be logged.
+ */
+static const char *get_failent_user (const char *user)
+{
+ const char *failent_user = "UNKNOWN";
+ bool log_unkfail_enab = getdef_bool("LOG_UNKFAIL_ENAB");
+
+ if ((NULL != user) && ('\0' != user[0])) {
+ if ( log_unkfail_enab
+ || (getpwnam (user) != NULL)) {
+ failent_user = user;
+ }
+ }
+
+ return failent_user;
+}
+
+/*
* login - create a new login session for a user
*
* login is typically called by getty as the second step of a
@@ -442,12 +496,12 @@
static char temp_pw[2];
static char temp_shell[] = "/bin/sh";
#endif
+ const char *failent_user;
#ifdef USE_PAM
int retcode;
pid_t child;
- char *pam_user;
- char **ptr_pam_user = &pam_user;
+ char *pam_user = NULL;
#else
struct spwd *spwd = NULL;
#endif
@@ -690,8 +744,7 @@
/* if we didn't get a user on the command line,
set it to NULL */
- retcode = pam_get_item (pamh, PAM_USER, (const void **)ptr_pam_user);
- PAM_FAIL_CHECK;
+ get_pam_user (&pam_user);
if ((NULL != pam_user) && ('\0' == pam_user[0])) {
retcode = pam_set_item (pamh, PAM_USER, NULL);
PAM_FAIL_CHECK;
@@ -707,7 +760,6 @@
*/
failcount = 0;
while (true) {
- const char *failent_user;
failed = false;
failcount++;
@@ -720,32 +772,9 @@
retcode = pam_authenticate (pamh, 0);
- {
- int saved_retcode = retcode;
- retcode = pam_get_item (pamh, PAM_USER,
- (const void **) ptr_pam_user);
- PAM_FAIL_CHECK;
- retcode = saved_retcode;
- }
+ get_pam_user (&pam_user);
+ failent_user = get_failent_user (pam_user);
- if ((NULL != pam_user) && ('\0' != pam_user[0])) {
- pwd = xgetpwnam(pam_user);
- if (NULL != pwd) {
- pwent = *pwd;
- failent_user = pwent.pw_name;
- } else {
- if ( getdef_bool("LOG_UNKFAIL_ENAB")
- && (NULL != pam_user)) {
- failent_user = pam_user;
- } else {
- failent_user = "UNKNOWN";
- }
- }
- } else {
- pwd = NULL;
- failent_user = "UNKNOWN";
- }
-
if (retcode == PAM_MAXTRIES) {
SYSLOG ((LOG_NOTICE,
"TOO MANY LOGIN TRIES (%d)%s FOR '%s'",
@@ -821,20 +850,21 @@
PAM_FAIL_CHECK;
/* Grab the user information out of the password file for future usage
- First get the username that we are actually using, though.
+ * First get the username that we are actually using, though.
+ *
+ * From now on, we will discard changes of the user (PAM_USER) by
+ * PAM APIs.
*/
- retcode = pam_get_item (pamh, PAM_USER, (const void **)ptr_pam_user);
- PAM_FAIL_CHECK;
+ get_pam_user (&pam_user);
if (NULL != username) {
free (username);
}
- username = xstrdup (pam_user);
+ username = pam_user;
+ failent_user = get_failent_user (username);
pwd = xgetpwnam (username);
if (NULL == pwd) {
- SYSLOG ((LOG_ERR, "xgetpwnam(%s) failed",
- getdef_bool ("LOG_UNKFAIL_ENAB") ?
- username : "UNKNOWN"));
+ SYSLOG ((LOG_ERR, "cannot find user %s", failent_user));
exit (1);
}
@@ -873,6 +903,8 @@
continue;
}
}
+ /* Get the username to be used to log failures */
+ failent_user = get_failent_user (username);
pwd = xgetpwnam (username);
if (NULL == pwd) {
@@ -924,15 +956,8 @@
goto auth_ok;
}
- /*
- * Don't log unknown usernames - I mistyped the password for
- * username at least once. Should probably use LOG_AUTHPRIV
- * for those who really want to log them. --marekm
- */
SYSLOG ((LOG_WARN, "invalid password for '%s' %s",
- ( (NULL != pwd)
- || getdef_bool ("LOG_UNKFAIL_ENAB")) ?
- username : "UNKNOWN", fromhost));
+ failent_user, fromhost));
failed = true;
auth_ok:
@@ -971,8 +996,6 @@
failure (pwent.pw_uid, tty, &faillog);
}
if (getdef_str ("FTMP_FILE") != NULL) {
- const char *failent_user;
-
#if HAVE_UTMPX_H
failent = utxent;
if (sizeof (failent.ut_tv) == sizeof (struct timeval)) {
@@ -989,15 +1012,6 @@
failent = utent;
failent.ut_time = time (NULL);
#endif
- if (NULL != pwd) {
- failent_user = pwent.pw_name;
- } else {
- if (getdef_bool ("LOG_UNKFAIL_ENAB")) {
- failent_user = username;
- } else {
- failent_user = "UNKNOWN";
- }
- }
strncpy (failent.ut_user, failent_user,
sizeof (failent.ut_user));
failent.ut_type = USER_PROCESS;
More information about the Pkg-shadow-commits
mailing list