- (djm) Workaround PAM inconsistencies between Solaris derived PAM code

   and Linux-PAM. Based on report and fix from Andrew Morgan
   <morgan@transmeta.com>

diff --git a/CREDITS b/CREDITS
index b8c54824ac2c534c963957c81898714518227585..797b1895aea6f15040b551f41b7be9b330fb9ebf 100644 (file)
--- a/CREDITS
+++ b/CREDITS
@@ -8,6 +8,7 @@ Alexandre Oliva <oliva@lsd.ic.unicamp.br> - AIX fixes
 Andre Lucas <andre.lucas@dial.pipex.com> - new login code, many fixes
 Andreas Steinmetz <ast@domdv.de> - Shadow password expiry support
 Andrew McGill <andrewm@datrix.co.za> - SCO fixes
+Andrew Morgan <morgan@transmeta.com> - PAM bugfixes
 Andrew Stribblehill <a.d.stribblehill@durham.ac.uk> - Bugfixes
 Andy Sloane <andy@guildsoftware.com> - bugfixes
 Aran Cox <acox@cv.telegroup.com> - SCO bugfixes

diff --git a/ChangeLog b/ChangeLog
index 38bd2b3f4a31815798a547af85b8f4b535f7f9d5..a99195e5de791d5ec2befde20fb919a95861f15d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+20001220
+ - (djm) Workaround PAM inconsistencies between Solaris derived PAM code 
+   and Linux-PAM. Based on report and fix from Andrew Morgan
+   <morgan@transmeta.com>
+
 20001218
  - (stevesk) rsa.c: entropy.h not needed.
  - (bal) split CFLAGS into CFLAGS and CPPFLAGS in configure.in and Makefile.

diff --git a/acconfig.h b/acconfig.h
index bfbacba429b155508ba7336c4d1f240b533c7b63..21832fe2de53945d8dd62a4105ad06832c87ded3 100644 (file)
--- a/acconfig.h
+++ b/acconfig.h
@@ -218,6 +218,10 @@
 /* to pam_strerror */
 #undef HAVE_OLD_PAM
 
+/* Define if you are using Solaris-derived PAM which passes pam_messages  */
+/* to the conversation function with an extra level of indirection */
+#undef PAM_SUN_CODEBASE
+ 
 /* Set this to your mail directory if you don't have maillock.h */
 #undef MAIL_DIRECTORY
 

diff --git a/auth-pam.c b/auth-pam.c
index ea62a774875dcec68058868ea8e35f44d58cb6aa..dfec2d6aafc64fdf70d19c90d76ab16485982fd9 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -97,13 +97,13 @@ static int pamconv(int num_msg, const struct pam_message **msg,
                return PAM_CONV_ERR; 
 
        for (count = 0; count < num_msg; count++) {
-               switch ((*msg)[count].msg_style) {
+               switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
                        case PAM_PROMPT_ECHO_ON:
                                if (pamstate == INITIAL_LOGIN) {
                                        free(reply);
                                        return PAM_CONV_ERR;
                                } else {
-                                       fputs((*msg)[count].msg, stderr);
+                                       fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
                                        fgets(buf, sizeof(buf), stdin);
                                        reply[count].resp = xstrdup(buf);
                                        reply[count].resp_retcode = PAM_SUCCESS;
@@ -118,7 +118,7 @@ static int pamconv(int num_msg, const struct pam_message **msg,
                                        reply[count].resp = xstrdup(pampasswd);
                                } else {
                                        reply[count].resp = 
-                                               xstrdup(read_passphrase((*msg)[count].msg, 1));
+                                               xstrdup(read_passphrase(PAM_MSG_MEMBER(msg, count, msg), 1));
                                }
                                reply[count].resp_retcode = PAM_SUCCESS;
                                break;
@@ -126,9 +126,9 @@ static int pamconv(int num_msg, const struct pam_message **msg,
                        case PAM_TEXT_INFO:
                                if ((*msg)[count].msg != NULL) {
                                        if (pamstate == INITIAL_LOGIN)
-                                               pam_msg_cat((*msg)[count].msg);
+                                               pam_msg_cat(PAM_MSG_MEMBER(msg, count, msg));
                                        else {
-                                               fputs((*msg)[count].msg, stderr);
+                                               fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
                                                fputs("\n", stderr);
                                        }
                                }

diff --git a/auth2-pam.c b/auth2-pam.c
index a760214b4077feadef9d4fa44079be7f582ef623..9e60d20c3e0b696c3ecdf9f660c84275fd857480 100644 (file)
--- a/auth2-pam.c
+++ b/auth2-pam.c
@@ -70,8 +70,8 @@ do_conversation2(int num_msg, const struct pam_message **msg,
        packet_put_cstring("");                         /* Instructions */
        packet_put_cstring("");                         /* Language */
        for (i = 0, j = 0; i < num_msg; i++) {
-               if(((*msg)[i].msg_style == PAM_PROMPT_ECHO_ON) ||
-                  ((*msg)[i].msg_style == PAM_PROMPT_ECHO_OFF) ||
+               if((PAM_MSG_MEMBER(msg, i, msg_style) == PAM_PROMPT_ECHO_ON) ||
+                  (PAM_MSG_MEMBER(msg, i, msg_style) == PAM_PROMPT_ECHO_OFF) ||
                   (i == num_msg - 1)) {
                        j++;
                }
@@ -79,7 +79,7 @@ do_conversation2(int num_msg, const struct pam_message **msg,
        packet_put_int(j);                              /* Number of prompts. */
        context_pam2.num_expected = j;
        for (i = 0, j = 0; i < num_msg; i++) {
-               switch((*msg)[i].msg_style) {
+               switch(PAM_MSG_MEMBER(msg, i, msg_style)) {
                        case PAM_PROMPT_ECHO_ON:
                                echo = 1;
                                break;
@@ -91,18 +91,18 @@ do_conversation2(int num_msg, const struct pam_message **msg,
                                break;
                }
                if(text) {
-                       tmp = xmalloc(strlen(text) + strlen((*msg)[i].msg) + 2);
+                       tmp = xmalloc(strlen(text) + strlen(PAM_MSG_MEMBER(msg, i, msg)) + 2);
                        strcpy(tmp, text);
                        strcat(tmp, "\n");
-                       strcat(tmp, (*msg)[i].msg);
+                       strcat(tmp, PAM_MSG_MEMBER(msg, i, msg));
                        xfree(text);
                        text = tmp;
                        tmp = NULL;
                } else {
-                       text = xstrdup((*msg)[i].msg);
+                       text = xstrdup(PAM_MSG_MEMBER(msg, i, msg));
                }
-               if(((*msg)[i].msg_style == PAM_PROMPT_ECHO_ON) ||
-                  ((*msg)[i].msg_style == PAM_PROMPT_ECHO_OFF) ||
+               if((PAM_MSG_MEMBER(msg, i, msg_style) == PAM_PROMPT_ECHO_ON) ||
+                  (PAM_MSG_MEMBER(msg, i, msg_style) == PAM_PROMPT_ECHO_OFF) ||
                   (i == num_msg - 1)) {
                        debug("sending prompt ssh-%d(pam-%d) = \"%s\"",
                              j, i, text);

diff --git a/configure.in b/configure.in
index 9f3b10c4321a7ed01c13e5f7f3e0f0f0dd1be538..4601cd38baba13f7a7f82c7181e0ee424ac9d41a 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -88,6 +88,7 @@ case "$host" in
 *-*-hpux11*)
        CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE"
        IPADDR_IN_DISPLAY=yes
+       AC_DEFINE(PAM_SUN_CODEBASE)
        AC_DEFINE(USE_PIPES)
        AC_DEFINE(DISABLE_SHADOW)
        AC_DEFINE(DISABLE_UTMP)
@@ -149,6 +150,7 @@ mips-sony-bsd|mips-sony-newsos4)
        CPPFLAGS="$CPPFLAGS -I/usr/local/include"
        LDFLAGS="$LDFLAGS -L/usr/local/lib -R/usr/local/lib -L/usr/ucblib -R/usr/ucblib"
        need_dash_r=1
+       AC_DEFINE(PAM_SUN_CODEBASE)
        # hardwire lastlog location (can't detect it on some versions)
        conf_lastlog_location="/var/adm/lastlog"
        AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
@@ -164,6 +166,7 @@ mips-sony-bsd|mips-sony-newsos4)
 *-*-sunos4*)
        CPPFLAGS="$CPPFLAGS -DSUNOS4"
        AC_CHECK_FUNCS(getpwanam)
+       AC_DEFINE(PAM_SUN_CODEBASE)
        conf_utmp_location=/etc/utmp
        conf_wtmp_location=/var/adm/wtmp
        conf_lastlog_location=/var/adm/lastlog
@@ -1614,6 +1617,13 @@ echo "         Libraries: ${LIBS}"
 
 echo ""
 
+if test "x$PAM_MSG" = "xyes" ; then
+       echo "PAM is enabled. You may need to install a PAM control file for sshd,"
+       echo "otherwise password authentication may fail. Example PAM control files"
+       echo "can be found in the contrib/ subdirectory"
+       echo ""
+fi
+
 if test ! -z "$BUILTIN_RNG" ; then
        echo "WARNING: you are using the builtin random number collection service."
        echo "Please read WARNING.RNG and request that your OS vendor includes"

diff --git a/defines.h b/defines.h
index 642b007971b00118f20a363c46ec9fc251aa8081..4c3941cad2c3541ced39e681192c9ec40943997b 100644 (file)
--- a/defines.h
+++ b/defines.h
@@ -340,6 +340,12 @@ struct winsize {
 # define PAM_STRERROR(a,b) pam_strerror((a),(b))
 #endif
 
+#ifdef PAM_SUN_CODEBASE
+# define PAM_MSG_MEMBER(msg, n, member) ((*(msg))[(n)].member)
+#else
+# define PAM_MSG_MEMBER(msg, n, member) ((msg)[(n)]->member)
+#endif
+
 #if defined(BROKEN_GETADDRINFO) && defined(HAVE_GETADDRINFO)
 # undef HAVE_GETADDRINFO
 #endif /* defined(BROKEN_GETADDRINFO) && defined(HAVE_GETADDRINFO) */