Accepting request 476771 from home:jmoellers:branches:Linux-PAM
OBS-URL: https://build.opensuse.org/request/show/476771 OBS-URL: https://build.opensuse.org/package/show/Linux-PAM/pam?expand=0&rev=169
This commit is contained in:
Thorsten Kukuk
Git OBS Bridge
parent
c31c12f192
commit
acb196a316
156
pam-hostnames-in-access_conf.patch
Normal file
156
pam-hostnames-in-access_conf.patch
Normal file
@ -0,0 +1,156 @@
|
|||||||
|
Index: modules/pam_access/pam_access.c
|
||||||
|
===================================================================
|
||||||
|
--- modules/pam_access/pam_access.c.orig
|
||||||
|
+++ modules/pam_access/pam_access.c
|
||||||
|
@@ -692,10 +692,10 @@ string_match (pam_handle_t *pamh, const
|
||||||
|
return (NO);
|
||||||
|
}
|
||||||
|
|
||||||
|
-
|
||||||
|
/* network_netmask_match - match a string against one token
|
||||||
|
* where string is a hostname or ip (v4,v6) address and tok
|
||||||
|
- * represents either a single ip (v4,v6) address or a network/netmask
|
||||||
|
+ * represents either a hostname, a single ip (v4,v6) address
|
||||||
|
+ * or a network/netmask
|
||||||
|
*/
|
||||||
|
static int
|
||||||
|
network_netmask_match (pam_handle_t *pamh,
|
||||||
|
@@ -704,10 +704,14 @@ network_netmask_match (pam_handle_t *pam
|
||||||
|
char *netmask_ptr;
|
||||||
|
char netmask_string[MAXHOSTNAMELEN + 1];
|
||||||
|
int addr_type;
|
||||||
|
+ struct addrinfo *ai;
|
||||||
|
+ struct sockaddr_storage tok_addr;
|
||||||
|
+ struct addrinfo hint;
|
||||||
|
|
||||||
|
if (item->debug)
|
||||||
|
- pam_syslog (pamh, LOG_DEBUG,
|
||||||
|
+ pam_syslog (pamh, LOG_DEBUG,
|
||||||
|
"network_netmask_match: tok=%s, item=%s", tok, string);
|
||||||
|
+
|
||||||
|
/* OK, check if tok is of type addr/mask */
|
||||||
|
if ((netmask_ptr = strchr(tok, '/')) != NULL)
|
||||||
|
{
|
||||||
|
@@ -717,7 +721,7 @@ network_netmask_match (pam_handle_t *pam
|
||||||
|
*netmask_ptr = 0;
|
||||||
|
netmask_ptr++;
|
||||||
|
|
||||||
|
- if (isipaddr(tok, &addr_type, NULL) == NO)
|
||||||
|
+ if (isipaddr(tok, &addr_type, &tok_addr) == NO)
|
||||||
|
{ /* no netaddr */
|
||||||
|
return NO;
|
||||||
|
}
|
||||||
|
@@ -739,19 +743,47 @@ network_netmask_match (pam_handle_t *pam
|
||||||
|
netmask_ptr = number_to_netmask(netmask, addr_type,
|
||||||
|
netmask_string, MAXHOSTNAMELEN);
|
||||||
|
}
|
||||||
|
- }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Although isipaddr() has already converted the IP address,
|
||||||
|
+ * we call getaddrinfo here to properly construct an addrinfo list
|
||||||
|
+ */
|
||||||
|
+ memset (&hint, '\0', sizeof (hint));
|
||||||
|
+ hint.ai_flags = 0;
|
||||||
|
+ hint.ai_family = AF_UNSPEC;
|
||||||
|
+
|
||||||
|
+ ai = NULL; /* just to be on the safe side */
|
||||||
|
+
|
||||||
|
+ /* The following should not fail ... */
|
||||||
|
+ if (getaddrinfo (tok, NULL, &hint, &ai) != 0)
|
||||||
|
+ {
|
||||||
|
+ return NO;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
else
|
||||||
|
- /* NO, then check if it is only an addr */
|
||||||
|
- if (isipaddr(tok, NULL, NULL) != YES)
|
||||||
|
+ {
|
||||||
|
+ /*
|
||||||
|
+ * It is either an IP address or a hostname.
|
||||||
|
+ * Let getaddrinfo sort everything out
|
||||||
|
+ */
|
||||||
|
+ memset (&hint, '\0', sizeof (hint));
|
||||||
|
+ hint.ai_flags = 0;
|
||||||
|
+ hint.ai_family = AF_UNSPEC;
|
||||||
|
+
|
||||||
|
+ ai = NULL; /* just to be on the safe side */
|
||||||
|
+
|
||||||
|
+ if (getaddrinfo (string, NULL, &hint, &ai) != 0)
|
||||||
|
{
|
||||||
|
+ pam_syslog(pamh, LOG_ERR, "cannot resolve hostname \"%s\"", string);
|
||||||
|
+
|
||||||
|
return NO;
|
||||||
|
}
|
||||||
|
+ netmask_ptr = NULL;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
if (isipaddr(string, NULL, NULL) != YES)
|
||||||
|
{
|
||||||
|
/* Assume network/netmask with a name of a host. */
|
||||||
|
- struct addrinfo hint;
|
||||||
|
-
|
||||||
|
memset (&hint, '\0', sizeof (hint));
|
||||||
|
hint.ai_flags = AI_CANONNAME;
|
||||||
|
hint.ai_family = AF_UNSPEC;
|
||||||
|
@@ -764,27 +796,52 @@ network_netmask_match (pam_handle_t *pam
|
||||||
|
else
|
||||||
|
{
|
||||||
|
struct addrinfo *runp = item->res;
|
||||||
|
+ struct addrinfo *runp1;
|
||||||
|
|
||||||
|
while (runp != NULL)
|
||||||
|
{
|
||||||
|
char buf[INET6_ADDRSTRLEN];
|
||||||
|
|
||||||
|
- inet_ntop (runp->ai_family,
|
||||||
|
- runp->ai_family == AF_INET
|
||||||
|
- ? (void *) &((struct sockaddr_in *) runp->ai_addr)->sin_addr
|
||||||
|
- : (void *) &((struct sockaddr_in6 *) runp->ai_addr)->sin6_addr,
|
||||||
|
- buf, sizeof (buf));
|
||||||
|
+ (void) getnameinfo (runp->ai_addr, runp->ai_addrlen, buf, sizeof (buf), NULL, 0, NI_NUMERICHOST);
|
||||||
|
|
||||||
|
- if (are_addresses_equal(buf, tok, netmask_ptr))
|
||||||
|
+ for (runp1 = ai; runp1 != NULL; runp1 = runp1->ai_next)
|
||||||
|
{
|
||||||
|
- return YES;
|
||||||
|
+ char buf1[INET6_ADDRSTRLEN];
|
||||||
|
+
|
||||||
|
+ if (runp->ai_family != runp1->ai_family)
|
||||||
|
+ continue;
|
||||||
|
+
|
||||||
|
+ (void) getnameinfo (runp1->ai_addr, runp1->ai_addrlen, buf1, sizeof (buf1), NULL, 0, NI_NUMERICHOST);
|
||||||
|
+
|
||||||
|
+ if (are_addresses_equal (buf, buf1, netmask_ptr))
|
||||||
|
+ {
|
||||||
|
+ freeaddrinfo(ai);
|
||||||
|
+ return YES;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
runp = runp->ai_next;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
- return (are_addresses_equal(string, tok, netmask_ptr));
|
||||||
|
+ {
|
||||||
|
+ struct addrinfo *runp1;
|
||||||
|
+
|
||||||
|
+ for (runp1 = ai; runp1 != NULL; runp1 = runp1->ai_next)
|
||||||
|
+ {
|
||||||
|
+ char buf1[INET6_ADDRSTRLEN];
|
||||||
|
+
|
||||||
|
+ (void) getnameinfo (runp1->ai_addr, runp1->ai_addrlen, buf1, sizeof (buf1), NULL, 0, NI_NUMERICHOST);
|
||||||
|
+
|
||||||
|
+ if (are_addresses_equal(string, buf1, netmask_ptr))
|
||||||
|
+ {
|
||||||
|
+ freeaddrinfo(ai);
|
||||||
|
+ return YES;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ freeaddrinfo(ai);
|
||||||
|
|
||||||
|
return NO;
|
||||||
|
}
|
||||||
@ -1,3 +1,9 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Jan 27 10:35:29 UTC 2017 - josef.moellers@suse.com
|
||||||
|
|
||||||
|
- Allow symbolic hostnames in access.conf file.
|
||||||
|
[pam-hostnames-in-access_conf.patch, boo#1019866]
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Thu Dec 8 12:41:05 UTC 2016 - josef.moellers@suse.com
|
Thu Dec 8 12:41:05 UTC 2016 - josef.moellers@suse.com
|
||||||
|
|
||||||
|
|||||||
4
pam.spec
4
pam.spec
@ -1,7 +1,7 @@
|
|||||||
#
|
#
|
||||||
# spec file for package pam
|
# spec file for package pam
|
||||||
#
|
#
|
||||||
# Copyright (c) 2016 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
# Copyright (c) 2017 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
||||||
#
|
#
|
||||||
# All modifications and additions to the file contributed by third parties
|
# All modifications and additions to the file contributed by third parties
|
||||||
# remain the property of their copyright owners, unless otherwise agreed
|
# remain the property of their copyright owners, unless otherwise agreed
|
||||||
@ -59,6 +59,7 @@ Source11: unix2_chkpwd.8
|
|||||||
Patch0: fix-man-links.dif
|
Patch0: fix-man-links.dif
|
||||||
Patch2: pam-limit-nproc.patch
|
Patch2: pam-limit-nproc.patch
|
||||||
Patch3: encryption_method_nis.diff
|
Patch3: encryption_method_nis.diff
|
||||||
|
Patch4: pam-hostnames-in-access_conf.patch
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||||
# Remove with next version update:
|
# Remove with next version update:
|
||||||
BuildRequires: autoconf
|
BuildRequires: autoconf
|
||||||
@ -109,6 +110,7 @@ building both PAM-aware applications and modules for use with PAM.
|
|||||||
%patch0 -p1
|
%patch0 -p1
|
||||||
%patch2 -p1
|
%patch2 -p1
|
||||||
%patch3 -p0
|
%patch3 -p0
|
||||||
|
%patch4 -p0
|
||||||
|
|
||||||
%build
|
%build
|
||||||
autoreconf -fiv
|
autoreconf -fiv
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user