Oops, forgot to document second change to roaming_client.c

[openssh.git] / openbsd-compat / port-aix.c

diff --git a/openbsd-compat/port-aix.c b/openbsd-compat/port-aix.c
index a7ced57e9c6ad2d7f5377b8f0b762079602c7ad8..0bdefbf6da0078f0d3ef30f6b9aa089692dbcbf5 100644 (file)
--- a/openbsd-compat/port-aix.c
+++ b/openbsd-compat/port-aix.c
@@ -1,7 +1,7 @@
 /*
  *
  * Copyright (c) 2001 Gert Doering.  All rights reserved.
- * Copyright (c) 2003,2004,2005 Darren Tucker.  All rights reserved.
+ * Copyright (c) 2003,2004,2005,2006 Darren Tucker.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,11 +41,24 @@
 # include <netdb.h>
 #endif
 #include <uinfo.h>
+#include <stdarg.h>
 #include <string.h>
 #include <unistd.h>
 #include <sys/socket.h>
+
+#ifdef WITH_AIXAUTHENTICATE
+# include <login.h>
+# include <userpw.h>
+# if defined(HAVE_SYS_AUDIT_H) && defined(AIX_LOGINFAILED_4ARG)
+#  include <sys/audit.h>
+# endif
+# include <usersec.h>
+#endif
+
 #include "port-aix.h"
 
+static char *lastlogin_msg = NULL;
+
 # ifdef HAVE_SETAUTHDB
 static char old_registry[REGISTRY_SIZE] = "";
 # endif
@@ -229,7 +242,7 @@ sys_auth_allowed_user(struct passwd *pw, Buffer *loginmsg)
 
        /*
         * Don't perform checks for root account (PermitRootLogin controls
-        * logins via * ssh) or if running as non-root user (since
+        * logins via ssh) or if running as non-root user (since
         * loginrestrictions will always fail due to insufficient privilege).
         */
        if (pw->pw_uid == 0 || geteuid() != 0) {
@@ -272,14 +285,23 @@ sys_auth_record_login(const char *user, const char *host, const char *ttynm,
                success = 1;
                if (msg != NULL) {
                        debug("AIX/loginsuccess: msg %s", msg);
-                       buffer_append(loginmsg, msg, strlen(msg));
-                       xfree(msg);
+                       if (lastlogin_msg == NULL)
+                               lastlogin_msg = msg;
                }
        }
        aix_restoreauthdb();
        return (success);
 }
 
+char *
+sys_auth_get_lastlogin_msg(const char *user, uid_t uid)
+{
+       char *msg = lastlogin_msg;
+
+       lastlogin_msg = NULL;
+       return msg;
+}
+
 #  ifdef CUSTOM_FAILED_LOGIN
 /*
  * record_failed_login: generic "login failed" interface function
@@ -352,6 +374,31 @@ aix_restoreauthdb(void)
 
 # endif /* WITH_AIXAUTHENTICATE */
 
+# ifdef USE_AIX_KRB_NAME
+/*
+ * aix_krb5_get_principal_name: returns the user's kerberos client principal name if
+ * configured, otherwise NULL.  Caller must free returned string.
+ */
+char *
+aix_krb5_get_principal_name(char *pw_name)
+{
+       char *authname = NULL, *authdomain = NULL, *principal = NULL;
+
+       setuserdb(S_READ);
+       if (getuserattr(pw_name, S_AUTHDOMAIN, &authdomain, SEC_CHAR) != 0)
+               debug("AIX getuserattr S_AUTHDOMAIN: %s", strerror(errno));
+       if (getuserattr(pw_name, S_AUTHNAME, &authname, SEC_CHAR) != 0)
+               debug("AIX getuserattr S_AUTHNAME: %s", strerror(errno));
+
+       if (authdomain != NULL)
+               xasprintf(&principal, "%s@%s", authname ? authname : pw_name, authdomain);
+       else if (authname != NULL)
+               principal = xstrdup(authname);
+       enduserdb();
+       return principal;
+}
+# endif /* USE_AIX_KRB_NAME */
+
 # if defined(AIX_GETNAMEINFO_HACK) && !defined(BROKEN_ADDRINFO)
 # undef getnameinfo
 /*
@@ -381,4 +428,47 @@ sshaix_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 }
 # endif /* AIX_GETNAMEINFO_HACK */
 
+# if defined(USE_GETGRSET)
+#  include <stdlib.h>
+int
+getgrouplist(const char *user, gid_t pgid, gid_t *groups, int *grpcnt)
+{
+       char *cp, *grplist, *grp;
+       gid_t gid;
+       int ret = 0, ngroups = 0, maxgroups;
+       long l;
+
+       maxgroups = *grpcnt;
+
+       if ((cp = grplist = getgrset(user)) == NULL)
+               return -1;
+
+       /* handle zero-length case */
+       if (maxgroups <= 0) {
+               *grpcnt = 0;
+               return -1;
+       }
+
+       /* copy primary group */
+       groups[ngroups++] = pgid;
+
+       /* copy each entry from getgrset into group list */
+       while ((grp = strsep(&grplist, ",")) != NULL) {
+               l = strtol(grp, NULL, 10);
+               if (ngroups >= maxgroups || l == LONG_MIN || l == LONG_MAX) {
+                       ret = -1;
+                       goto out;
+               }
+               gid = (gid_t)l;
+               if (gid == pgid)
+                       continue;       /* we have already added primary gid */
+               groups[ngroups++] = gid;
+       }
+out:
+       free(cp);
+       *grpcnt = ngroups;
+       return ret;
+}
+# endif        /* USE_GETGRSET */
+
 #endif /* _AIX */