seteuid back to our login user in logout in case there're volumes' prexec_close scripts.

[netatalk.git] / etc / afpd / auth.c

diff --git a/etc/afpd/auth.c b/etc/afpd/auth.c
index 9923ac4ee0a2c0ec204f32c946d43864be48def2..52eb0b59496dea864290fb6940f59db0b89a8841 100644 (file)
--- a/etc/afpd/auth.c
+++ b/etc/afpd/auth.c
@@ -1,5 +1,5 @@
 /*
- * $Id: auth.c,v 1.64 2009-09-28 09:21:09 franklahm Exp $
+ * $Id: auth.c,v 1.69 2009-10-25 07:18:12 didg Exp $
  *
  * Copyright (c) 1990,1993 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.
@@ -47,12 +47,10 @@ extern void afp_get_cmdline( int *ac, char ***av );
 #include "switch.h"
 #include "status.h"
 #include "fork.h"
+#include "extattrs.h"
 #ifdef HAVE_NFSv4_ACLS
 #include "acls.h"
 #endif
-#ifdef HAVE_EXT_ATTRS
-#include "extattrs.h"
-#endif
 
 int afp_version = 11;
 static int afp_version_index;
@@ -96,8 +94,7 @@ static struct uam_obj uam_changepw = {"", "", 0, {{NULL, NULL, NULL, NULL}}, &ua
 static struct uam_obj *afp_uam = NULL;
 
 
-void status_versions( data )
-    char    *data;
+void status_versions( char *data)
 {
     char                *start = data;
     u_int16_t           status;
@@ -161,19 +158,15 @@ static int send_reply(const AFPObj *obj, const int err)
     return AFP_OK;
 }
 
-static int afp_errpwdexpired(obj, ibuf, ibuflen, rbuf, rbuflen )
-    AFPObj  *obj _U_;
-    char    *ibuf _U_, *rbuf _U_;
-    int ibuflen _U_, *rbuflen;
+static int afp_errpwdexpired(AFPObj *obj _U_, char *ibuf _U_, size_t ibuflen _U_, 
+                             char *rbuf _U_, size_t *rbuflen)
 {
     *rbuflen = 0;
     return AFPERR_PWDEXPR;
 }
 
-static int afp_null_nolog(obj, ibuf, ibuflen, rbuf, rbuflen )
-    AFPObj  *obj _U_;
-    char    *ibuf _U_, *rbuf _U_;
-    int ibuflen _U_, *rbuflen;
+static int afp_null_nolog(AFPObj *obj _U_, char *ibuf _U_, size_t ibuflen _U_, 
+                          char *rbuf _U_, size_t *rbuflen)
 {
     *rbuflen = 0;
     return( AFPERR_NOOP );
@@ -202,21 +195,19 @@ static int set_auth_switch(int expired)
         afp_switch = postauth_switch;
         switch (afp_version) {
         case 32:
-            uam_afpserver_action(AFP_SPOTLIGHT_PRIVATE, UAM_AFPSERVER_POSTAUTH, afp_null_nolog, NULL);
-            uam_afpserver_action(AFP_SYNCDIR, UAM_AFPSERVER_POSTAUTH, afp_syncdir, NULL);
-            uam_afpserver_action(AFP_SYNCFORK, UAM_AFPSERVER_POSTAUTH, afp_syncfork, NULL);
 #ifdef HAVE_NFSv4_ACLS
             uam_afpserver_action(AFP_GETACL, UAM_AFPSERVER_POSTAUTH, afp_getacl, NULL);
             uam_afpserver_action(AFP_SETACL, UAM_AFPSERVER_POSTAUTH, afp_setacl, NULL);
             uam_afpserver_action(AFP_ACCESS, UAM_AFPSERVER_POSTAUTH, afp_access, NULL);
 #endif
-#ifdef HAVE_EXT_ATTRS
             uam_afpserver_action(AFP_GETEXTATTR, UAM_AFPSERVER_POSTAUTH, afp_getextattr, NULL);
             uam_afpserver_action(AFP_SETEXTATTR, UAM_AFPSERVER_POSTAUTH, afp_setextattr, NULL);
             uam_afpserver_action(AFP_REMOVEATTR, UAM_AFPSERVER_POSTAUTH, afp_remextattr, NULL);
             uam_afpserver_action(AFP_LISTEXTATTR, UAM_AFPSERVER_POSTAUTH, afp_listextattr, NULL);
-#endif
         case 31:
+            uam_afpserver_action(AFP_SYNCDIR, UAM_AFPSERVER_POSTAUTH, afp_syncdir, NULL);
+            uam_afpserver_action(AFP_SYNCFORK, UAM_AFPSERVER_POSTAUTH, afp_syncfork, NULL);
+            uam_afpserver_action(AFP_SPOTLIGHT_PRIVATE, UAM_AFPSERVER_POSTAUTH, afp_null_nolog, NULL);
             uam_afpserver_action(AFP_ENUMERATE_EXT2, UAM_AFPSERVER_POSTAUTH, afp_enumerate_ext2, NULL);
         case 30:
             uam_afpserver_action(AFP_ENUMERATE_EXT, UAM_AFPSERVER_POSTAUTH, afp_enumerate_ext, NULL);
@@ -327,9 +318,8 @@ static int login(AFPObj *obj, struct passwd *pwd, void (*logout)(void), int expi
     }
 
 #ifdef ADMIN_GRP
-#ifdef DEBUG
-    LOG(log_info, logtype_afpd, "obj->options.admingid == %d", obj->options.admingid);
-#endif /* DEBUG */
+    LOG(log_debug, logtype_afpd, "obj->options.admingid == %d", obj->options.admingid);
+
     if (obj->options.admingid != 0) {
         int i;
         for (i = 0; i < ngroups; i++) {
@@ -341,7 +331,7 @@ static int login(AFPObj *obj, struct passwd *pwd, void (*logout)(void), int expi
         LOG(log_info, logtype_afpd, "admin login -- %s", pwd->pw_name );
     }
     if (!admin)
-#endif /* DEBUG */
+#endif /* ADMIN_GRP */
 #ifdef TRU64
     {
         struct DSI *dsi = obj->handle;
@@ -394,7 +384,8 @@ static int login(AFPObj *obj, struct passwd *pwd, void (*logout)(void), int expi
         uuid = pwd->pw_uid;
 
     set_auth_switch(expired);
-
+    /* save our euid, we need it for preexec_close */
+    obj->uid = geteuid();
     obj->logout = logout;
 
 #ifdef FORCE_UIDGID
@@ -406,10 +397,10 @@ static int login(AFPObj *obj, struct passwd *pwd, void (*logout)(void), int expi
 }
 
 /* ---------------------- */
-int afp_zzz (obj, ibuf, ibuflen, rbuf, rbuflen ) /* Function 122 */
-    AFPObj       *obj;
-    char         *ibuf  _U_, *rbuf;
-    unsigned int ibuflen  _U_, *rbuflen;
+int afp_zzz ( /* Function 122 */
+    AFPObj       *obj,
+    char         *ibuf _U_, size_t ibuflen _U_, 
+    char *rbuf, size_t *rbuflen)
 {
     u_int32_t   retdata;
 
@@ -464,10 +455,10 @@ static int create_session_key(AFPObj *obj)
 
 
 /* ---------------------- */
-int afp_getsession(obj, ibuf, ibuflen, rbuf, rbuflen )
-    AFPObj       *obj;
-    char         *ibuf, *rbuf;
-    unsigned int ibuflen, *rbuflen;
+int afp_getsession(
+    AFPObj *obj,
+    char   *ibuf, size_t ibuflen, 
+    char   *rbuf, size_t *rbuflen)
 {
     u_int16_t           type;
     u_int32_t           idlen = 0;
@@ -479,6 +470,10 @@ int afp_getsession(obj, ibuf, ibuflen, rbuf, rbuflen )
     *rbuflen = 0;
     tklen = 0;
 
+    if (ibuflen < 2 + sizeof(type)) {
+        return AFPERR_PARAM;
+    }
+
     ibuf += 2;
     ibuflen -= 2;
 
@@ -558,10 +553,7 @@ int afp_getsession(obj, ibuf, ibuflen, rbuf, rbuflen )
 }
 
 /* ---------------------- */
-int afp_disconnect(obj, ibuf, ibuflen, rbuf, rbuflen )
-    AFPObj  *obj  _U_;
-    char    *ibuf, *rbuf  _U_;
-    int ibuflen  _U_, *rbuflen;
+int afp_disconnect(AFPObj *obj _U_, char *ibuf, size_t ibuflen _U_, char *rbuf _U_, size_t *rbuflen)
 {
     u_int16_t           type;
 
@@ -613,11 +605,7 @@ int afp_disconnect(obj, ibuf, ibuflen, rbuf, rbuflen )
 }
 
 /* ---------------------- */
-static int get_version(obj, ibuf, ibuflen, len)
-    AFPObj  *obj;
-    char    *ibuf;
-    int     ibuflen;
-    int     len;
+static int get_version(AFPObj *obj, char *ibuf, size_t ibuflen, size_t len)
 {
     int num,i;
 
@@ -648,20 +636,18 @@ static int get_version(obj, ibuf, ibuflen, len)
 }
 
 /* ---------------------- */
-int afp_login(obj, ibuf, ibuflen, rbuf, rbuflen )
-    AFPObj      *obj;
-    char    *ibuf, *rbuf;
-    int     ibuflen, *rbuflen;
+int afp_login(AFPObj *obj, char *ibuf, size_t ibuflen, char *rbuf, size_t *rbuflen)
 {
     struct passwd *pwd = NULL;
-    int     len, i;
+    size_t len;
+    int     i;
 
     *rbuflen = 0;
 
     if ( nologin & 1)
         return send_reply(obj, AFPERR_SHUTDOWN );
 
-    if (ibuflen <= 1)
+    if (ibuflen < 2)
         return send_reply(obj, AFPERR_BADVERS );
 
     ibuf++;
@@ -672,12 +658,12 @@ int afp_login(obj, ibuf, ibuflen, rbuf, rbuflen )
     if (i)
         return send_reply(obj, i );
 
+    if (ibuflen <= len)
+        return send_reply(obj, AFPERR_BADUAM);
+
     ibuf += len;
     ibuflen -= len;
 
-    if (ibuflen <= 1)
-        return send_reply(obj, AFPERR_BADUAM);
-
     len = (unsigned char) *ibuf++;
     ibuflen--;
 
@@ -701,13 +687,10 @@ int afp_login(obj, ibuf, ibuflen, rbuf, rbuflen )
 }
 
 /* ---------------------- */
-int afp_login_ext(obj, ibuf, ibuflen, rbuf, rbuflen )
-    AFPObj  *obj;
-    char    *ibuf, *rbuf;
-    unsigned int    ibuflen, *rbuflen;
+int afp_login_ext(AFPObj *obj, char *ibuf, size_t ibuflen, char *rbuf, size_t *rbuflen)
 {
     struct passwd *pwd = NULL;
-    unsigned int  len;
+    size_t  len;
     int     i;
     char        type;
     u_int16_t   len16;
@@ -718,7 +701,7 @@ int afp_login_ext(obj, ibuf, ibuflen, rbuf, rbuflen )
     if ( nologin & 1)
         return send_reply(obj, AFPERR_SHUTDOWN );
 
-    if (ibuflen <= 4)
+    if (ibuflen < 5)
         return send_reply(obj, AFPERR_BADVERS );
 
     ibuf++;
@@ -733,12 +716,12 @@ int afp_login_ext(obj, ibuf, ibuflen, rbuf, rbuflen )
     if (i)
         return send_reply(obj, i );
 
+    if (ibuflen <= len)
+        return send_reply(obj, AFPERR_BADUAM);
+
     ibuf    += len;
     ibuflen -= len;
 
-    if (ibuflen <= 1)
-        return send_reply(obj, AFPERR_BADUAM);
-
     len = (unsigned char) *ibuf;
     ibuf++;
     ibuflen--;
@@ -756,7 +739,7 @@ int afp_login_ext(obj, ibuf, ibuflen, rbuf, rbuflen )
         return send_reply(obj, AFPERR_BADUAM);
     }
     /* user name */
-    if (len <= 1 +sizeof(len16))
+    if (ibuflen <= 1 +sizeof(len16))
         return send_reply(obj, AFPERR_PARAM);
     type = *ibuf;
     username = ibuf;
@@ -831,15 +814,12 @@ int afp_login_ext(obj, ibuf, ibuflen, rbuf, rbuflen )
 }
 
 /* ---------------------- */
-int afp_logincont(obj, ibuf, ibuflen, rbuf, rbuflen)
-    AFPObj      *obj;
-    char    *ibuf, *rbuf;
-    int     ibuflen, *rbuflen;
+int afp_logincont(AFPObj *obj, char *ibuf, size_t ibuflen, char *rbuf, size_t *rbuflen)
 {
     struct passwd *pwd = NULL;
     int err;
 
-    if ( afp_uam == NULL || afp_uam->u.uam_login.logincont == NULL ) {
+    if ( afp_uam == NULL || afp_uam->u.uam_login.logincont == NULL || ibuflen < 2 ) {
         *rbuflen = 0;
         return send_reply(obj, AFPERR_NOTAUTH );
     }
@@ -854,10 +834,7 @@ int afp_logincont(obj, ibuf, ibuflen, rbuf, rbuflen)
 }
 
 
-int afp_logout(obj, ibuf, ibuflen, rbuf, rbuflen)
-    AFPObj     *obj;
-    char       *ibuf _U_, *rbuf  _U_;
-    int        ibuflen  _U_, *rbuflen  _U_;
+int afp_logout(AFPObj *obj, char *ibuf _U_, size_t ibuflen  _U_, char *rbuf  _U_, size_t *rbuflen  _U_)
 {
     LOG(log_info, logtype_afpd, "logout %s", obj->username);
     close_all_vol();
@@ -872,10 +849,7 @@ int afp_logout(obj, ibuf, ibuflen, rbuf, rbuflen)
  *       to work. this also does a little pre-processing before it hands
  *       it off to the uam.
  */
-int afp_changepw(obj, ibuf, ibuflen, rbuf, rbuflen )
-    AFPObj      *obj;
-    char    *ibuf, *rbuf;
-    int     ibuflen, *rbuflen;
+int afp_changepw(AFPObj *obj, char *ibuf, size_t ibuflen, char *rbuf, size_t *rbuflen)
 {
     char username[MACFILELEN + 1], *start = ibuf;
     struct uam_obj *uam;
@@ -928,6 +902,9 @@ int afp_changepw(obj, ibuf, ibuflen, rbuf, rbuflen )
         return AFPERR_PARAM;
 
     /* send it off to the uam. we really don't use ibuflen right now. */
+    if (ibuflen < (size_t)(ibuf - start)) 
+        return AFPERR_PARAM;
+    
     ibuflen -= (ibuf - start);
     ret = uam->u.uam_changepw(obj, username, pwd, ibuf, ibuflen,
                               rbuf, rbuflen);
@@ -942,10 +919,7 @@ int afp_changepw(obj, ibuf, ibuflen, rbuf, rbuflen )
 
 
 /* FPGetUserInfo */
-int afp_getuserinfo(obj, ibuf, ibuflen, rbuf, rbuflen )
-    AFPObj  *obj _U_;
-    char    *ibuf, *rbuf;
-    int ibuflen _U_, *rbuflen;
+int afp_getuserinfo(AFPObj *obj _U_, char *ibuf, size_t ibuflen _U_, char *rbuf, size_t *rbuflen)
 {
     u_int8_t  thisuser;
     u_int32_t id;
@@ -1096,7 +1070,7 @@ int auth_load(const char *path, const char *list)
 }
 
 /* get rid of all of the uams */
-void auth_unload()
+void auth_unload(void)
 {
     struct uam_mod *mod, *prev, *start = &uam_modules;