[openssh-lpk] r23 committed - A contribution from Julian.Zeiss@fiducia.de
codesite...@google.com
Author: eric.auge
Date: Wed Mar 3 02:32:45 2010
Log: A contribution from Julian...@fiducia.de
http://code.google.com/p/openssh-lpk/source/detail?r=23
Added:
/trunk/patch/contrib/contrib-openssh-lpk-5.3p1-0.3.10.patch
=======================================
--- /dev/null
+++ /trunk/patch/contrib/contrib-openssh-lpk-5.3p1-0.3.10.patch Wed Mar 3
02:32:45 2010
@@ -0,0 +1,1896 @@
+This is a forward-port of the OpenSSH LPK support patch.
+
+It adds support for storing OpenSSH public keys in LDAP. It also supports
+grouping of machines in the LDAP data to limit users to specific machines.
+
+The latest homepage for the LPK project is:
+http://code.google.com/p/openssh-lpk/
+
+The 0.3.10 version of the patch includes a fix for 64-bit platforms, as
+discovered by Gentoo, where the bind timeout and search timeout values
were not
+being parsed correctly: http://bugs.gentoo.org/210110
+
+Forward-ported-from: openssh-lpk-5.1p1-0.3.9.patch
+Signed-off-by: Robin H. Johnson <rob...@gentoo.org>
+
+diff -Nuar --exclude '*.orig' --exclude '*.rej'
openssh-5.1p1.orig/auth2-pubkey.c openssh-5.1p1+lpk/auth2-pubkey.c
+--- openssh-5.1p1.orig/auth2-pubkey.c 2008-07-03 19:54:25.000000000 -0700
++++ openssh-5.1p1+lpk/auth2-pubkey.c 2008-08-23 15:02:47.000000000 -0700
+@@ -55,6 +55,10 @@
+ #include "monitor_wrap.h"
+ #include "misc.h"
+
++#ifdef WITH_LDAP_PUBKEY
++#include "ldapauth.h"
++#endif
++
+ /* import */
+ extern ServerOptions options;
+ extern u_char *session_id2;
+@@ -183,10 +187,79 @@
+ u_long linenum = 0;
+ Key *found;
+ char *fp;
++#ifdef WITH_LDAP_PUBKEY
++ ldap_key_t * k;
++ unsigned int i = 0;
++#endif
+
+ /* Temporarily use the user's uid. */
+ temporarily_use_uid(pw);
+
++#ifdef WITH_LDAP_PUBKEY
++ found_key = 0;
++ /* allocate a new key type */
++ found = key_new(key->type);
++
++ /* first check if the options is enabled, then try.. */
++ if (options.lpk.on) {
++ debug("[LDAP] trying LDAP first uid=%s",pw->pw_name);
++ if (ldap_ismember(&options.lpk, pw->pw_name) > 0) {
++ if ((k = ldap_getuserkey(&options.lpk, pw->pw_name)) != NULL) {
++ /* Skip leading whitespace, empty and comment lines. */
++ for (i = 0 ; i < k->num ; i++) {
++ /* dont forget if multiple keys to reset options */
++ char *cp, *options = NULL;
++
++ for (cp = (char *)k->keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++)
++ ;
++ if (!*cp || *cp == '\n' || *cp == '#')
++ continue;
++
++ if (key_read(found, &cp) != 1) {
++ /* no key? check if there are options for this key */
++ int quoted = 0;
++ debug2("[LDAP] user_key_allowed: check options: '%s'", cp);
++ options = cp;
++ for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
++ if (*cp == '\\' && cp[1] == '"')
++ cp++; /* Skip both */
++ else if (*cp == '"')
++ quoted = !quoted;
++ }
++ /* Skip remaining whitespace. */
++ for (; *cp == ' ' || *cp == '\t'; cp++)
++ ;
++ if (key_read(found, &cp) != 1) {
++ debug2("[LDAP] user_key_allowed: advance: '%s'", cp);
++ /* still no key? advance to next line*/
++ continue;
++ }
++ }
++
++ if (key_equal(found, key) &&
++ auth_parse_options(pw, options, file, linenum) == 1) {
++ found_key = 1;
++ debug("[LDAP] matching key found");
++ fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
++ verbose("[LDAP] Found matching %s key: %s", key_type(found), fp);
++
++ /* restoring memory */
++ ldap_keys_free(k);
++ xfree(fp);
++ restore_uid();
++ key_free(found);
++ return found_key;
++ break;
++ }
++ }/* end of LDAP for() */
++ } else {
++ logit("[LDAP] no keys found for '%s'!", pw->pw_name);
++ }
++ } else {
++ logit("[LDAP] '%s' is not in '%s'", pw->pw_name, options.lpk.sgroup);
++ }
++ }
++#endif
+ debug("trying public key file %s", file);
+ f = auth_openkeyfile(file, pw, options.strict_modes);
+
+diff -Nuar --exclude '*.orig' --exclude '*.rej'
openssh-5.1p1.orig/auth-rsa.c openssh-5.1p1+lpk/auth-rsa.c
+--- openssh-5.1p1.orig/auth-rsa.c 2008-07-02 05:37:30.000000000 -0700
++++ openssh-5.1p1+lpk/auth-rsa.c 2008-08-23 15:02:47.000000000 -0700
+@@ -174,10 +174,96 @@
+ FILE *f;
+ u_long linenum = 0;
+ Key *key;
++#ifdef WITH_LDAP_PUBKEY
++ ldap_key_t * k;
++ unsigned int i = 0;
++#endif
+
+ /* Temporarily use the user's uid. */
+ temporarily_use_uid(pw);
+
++#ifdef WITH_LDAP_PUBKEY
++ /* here is the job */
++ key = key_new(KEY_RSA1);
++
++ if (options.lpk.on) {
++ debug("[LDAP] trying LDAP first uid=%s", pw->pw_name);
++ if ( ldap_ismember(&options.lpk, pw->pw_name) > 0) {
++ if ( (k = ldap_getuserkey(&options.lpk, pw->pw_name)) != NULL) {
++ for (i = 0 ; i < k->num ; i++) {
++ char *cp, *options = NULL;
++
++ for (cp = k->keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++)
++ ;
++ if (!*cp || *cp == '\n' || *cp == '#')
++ continue;
++
++ /*
++ * Check if there are options for this key, and if so,
++ * save their starting address and skip the option part
++ * for now. If there are no options, set the starting
++ * address to NULL.
++ */
++ if (*cp < '0' || *cp > '9') {
++ int quoted = 0;
++ options = cp;
++ for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
++ if (*cp == '\\' && cp[1] == '"')
++ cp++; /* Skip both */
++ else if (*cp == '"')
++ quoted = !quoted;
++ }
++ } else
++ options = NULL;
++
++ /* Parse the key from the line. */
++ if (hostfile_read_key(&cp, &bits, key) == 0) {
++ debug("[LDAP] line %d: non ssh1 key syntax", i);
++ continue;
++ }
++ /* cp now points to the comment part. */
++
++ /* Check if the we have found the desired key (identified by its
modulus). */
++ if (BN_cmp(key->rsa->n, client_n) != 0)
++ continue;
++
++ /* check the real bits */
++ if (bits != (unsigned int)BN_num_bits(key->rsa->n))
++ logit("[LDAP] Warning: ldap, line %lu: keysize mismatch: "
++ "actual %d vs. announced %d.", (unsigned long)i,
BN_num_bits(key->rsa->n), bits);
++
++ /* We have found the desired key. */
++ /*
++ * If our options do not allow this key to be used,
++ * do not send challenge.
++ */
++ if (!auth_parse_options(pw, options, "[LDAP]", (unsigned long) i))
++ continue;
++
++ /* break out, this key is allowed */
++ allowed = 1;
++
++ /* add the return stuff etc... */
++ /* Restore the privileged uid. */
++ restore_uid();
++
++ /* return key if allowed */
++ if (allowed && rkey != NULL)
++ *rkey = key;
++ else
++ key_free(key);
++
++ ldap_keys_free(k);
++ return (allowed);
++ }
++ } else {
++ logit("[LDAP] no keys found for '%s'!", pw->pw_name);
++ }
++ } else {
++ logit("[LDAP] '%s' is not in '%s'", pw->pw_name, options.lpk.sgroup);
++ }
++ }
++#endif
+ /* The authorized keys. */
+ file = authorized_keys_file(pw);
+ debug("trying public RSA key file %s", file);
+diff -Nuar --exclude '*.orig' --exclude '*.rej'
openssh-5.1p1.orig/config.h.in openssh-5.1p1+lpk/config.h.in
+--- openssh-5.1p1.orig/config.h.in 2008-07-21 01:30:49.000000000 -0700
++++ openssh-5.1p1+lpk/config.h.in 2008-08-23 15:02:47.000000000 -0700
+@@ -575,6 +575,9 @@
+ /* Define to 1 if you have the <linux/if_tun.h> header file. */
+ #undef HAVE_LINUX_IF_TUN_H
+
++/* Define if you want LDAP support */
++#undef WITH_LDAP_PUBKEY
++
+ /* Define if your libraries define login() */
+ #undef HAVE_LOGIN
+
+diff -Nuar --exclude '*.orig' --exclude '*.rej'
openssh-5.1p1.orig/configure openssh-5.1p1+lpk/configure
+--- openssh-5.1p1.orig/configure 2008-07-21 01:30:50.000000000 -0700
++++ openssh-5.1p1+lpk/configure 2008-08-23 15:02:47.000000000 -0700
+@@ -1468,6 +1468,7 @@
+ --with-tcp-wrappers[=PATH] Enable tcpwrappers support (optionally in
PATH)
+ --with-libedit[=PATH] Enable libedit support for sftp
+ --with-audit=module Enable EXPERIMENTAL audit support
(modules=debug,bsm)
++ --with-ldap[=PATH] Enable LDAP pubkey support (optionally in PATH)
+ --with-ssl-dir=PATH Specify path to OpenSSL installation
+ --without-openssl-header-check Disable OpenSSL version consistency check
+ --with-ssl-engine Enable OpenSSL (hardware) ENGINE support
+@@ -13411,6 +13412,85 @@
+ fi
+
+
++# Check whether user wants LDAP support
++LDAP_MSG="no"
++
++# Check whether --with-ldap was given.
++if test "${with_ldap+set}" = set; then
++ withval=$with_ldap;
++ if test "x$withval" != "xno" ; then
++
++ if test "x$withval" != "xyes" ; then
++ CPPFLAGS="$CPPFLAGS -I${withval}/include"
++ LDFLAGS="$LDFLAGS -L${withval}/lib"
++ fi
++
++
++cat >>confdefs.h <<\_ACEOF
++#define WITH_LDAP_PUBKEY 1
++_ACEOF
++
++ LIBS="-lldap $LIBS"
++ LDAP_MSG="yes"
++
++ { echo "$as_me:$LINENO: checking for LDAP support" >&5
++echo $ECHO_N "checking for LDAP support... $ECHO_C" >&6; }
++ cat >conftest.$ac_ext <<_ACEOF
++/* confdefs.h. */
++_ACEOF
++cat confdefs.h >>conftest.$ac_ext
++cat >>conftest.$ac_ext <<_ACEOF
++/* end confdefs.h. */
++#include <sys/types.h>
++ #include <ldap.h>
++int
++main ()
++{
++(void)ldap_init(0, 0);
++ ;
++ return 0;
++}
++_ACEOF
++rm -f conftest.$ac_objext
++if { (ac_try="$ac_compile"
++case "(($ac_try" in
++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
++ *) ac_try_echo=$ac_try;;
++esac
++eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
++ (eval "$ac_compile") 2>conftest.er1
++ ac_status=$?
++ grep -v '^ *+' conftest.er1 >conftest.err
++ rm -f conftest.er1
++ cat conftest.err >&5
++ echo "$as_me:$LINENO: \$? = $ac_status" >&5
++ (exit $ac_status); } && {
++ test -z "$ac_c_werror_flag" ||
++ test ! -s conftest.err
++ } && test -s conftest.$ac_objext; then
++ { echo "$as_me:$LINENO: result: yes" >&5
++echo "${ECHO_T}yes" >&6; }
++else
++ echo "$as_me: failed program was:" >&5
++sed 's/^/| /' conftest.$ac_ext >&5
++
++
++ { echo "$as_me:$LINENO: result: no" >&5
++echo "${ECHO_T}no" >&6; }
++ { { echo "$as_me:$LINENO: error: ** Incomplete or missing ldap
libraries **" >&5
++echo "$as_me: error: ** Incomplete or missing ldap libraries **" >&2;}
++ { (exit 1); exit 1; }; }
++
++
++fi
++
++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
++ fi
++
++
++fi
++
++
+
+
+
+@@ -32225,6 +32305,7 @@
+ echo " Smartcard support: $SCARD_MSG"
+ echo " S/KEY support: $SKEY_MSG"
+ echo " TCP Wrappers support: $TCPW_MSG"
++echo " LDAP support: $LDAP_MSG"
+ echo " MD5 password support: $MD5_MSG"
+ echo " libedit support: $LIBEDIT_MSG"
+ echo " Solaris process contract support: $SPC_MSG"
+diff -Nuar --exclude '*.orig' --exclude '*.rej'
openssh-5.1p1.orig/configure.ac openssh-5.1p1+lpk/configure.ac
+--- openssh-5.1p1.orig/configure.ac 2008-07-09 04:07:19.000000000 -0700
++++ openssh-5.1p1+lpk/configure.ac 2008-08-23 15:02:47.000000000 -0700
+@@ -1319,6 +1319,37 @@
+ esac ]
+ )
+
++# Check whether user wants LDAP support
++LDAP_MSG="no"
++AC_ARG_WITH(ldap,
++ [ --with-ldap[[=PATH]] Enable LDAP pubkey support (optionally in
PATH)],
++ [
++ if test "x$withval" != "xno" ; then
++
++ if test "x$withval" != "xyes" ; then
++ CPPFLAGS="$CPPFLAGS -I${withval}/include"
++ LDFLAGS="$LDFLAGS -L${withval}/lib"
++ fi
++
++ AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
++ LIBS="-lldap $LIBS"
++ LDAP_MSG="yes"
++
++ AC_MSG_CHECKING([for LDAP support])
++ AC_TRY_COMPILE(
++ [#include <sys/types.h>
++ #include <ldap.h>],
++ [(void)ldap_init(0, 0);],
++ [AC_MSG_RESULT(yes)],
++ [
++ AC_MSG_RESULT(no)
++ AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
++ ]
++ )
++ fi
++ ]
++)
++
+ dnl Checks for library functions. Please keep in alphabetical order
+ AC_CHECK_FUNCS( \
+ arc4random \
+@@ -4229,6 +4260,7 @@
+ echo " Smartcard support: $SCARD_MSG"
+ echo " S/KEY support: $SKEY_MSG"
+ echo " TCP Wrappers support: $TCPW_MSG"
++echo " LDAP support: $LDAP_MSG"
+ echo " MD5 password support: $MD5_MSG"
+ echo " libedit support: $LIBEDIT_MSG"
+ echo " Solaris process contract support: $SPC_MSG"
+diff -Nuar --exclude '*.orig' --exclude '*.rej'
openssh-5.1p1.orig/ldapauth.c openssh-5.1p1+lpk/ldapauth.c
+--- openssh-5.1p1.orig/ldapauth.c 1969-12-31 16:00:00.000000000 -0800
++++ openssh-5.1p1+lpk/ldapauth.c 2008-08-23 15:02:47.000000000 -0700
+@@ -0,0 +1,575 @@
++/*
++ * $Id: openssh-lpk-4.3p1-0.3.7.patch,v 1.3 2006/04/18 15:29:09 eau Exp $
++ */
++
++/*
++ *
++ * Copyright (c) 2005, Eric AUGE <e...@phear.org>
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
++ *
++ * Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
++ * Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
++ * Neither the name of the phear.org nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
++ * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
++ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY,
++ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ *
++ */
++
++#include "includes.h"
++
++#ifdef WITH_LDAP_PUBKEY
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <unistd.h>
++#include <string.h>
++
++#include "ldapauth.h"
++#include "log.h"
++
++static char *attrs[] = {
++ PUBKEYATTR,
++ NULL
++};
++
++/* filter building infos */
++#define FILTER_GROUP_PREFIX "(&(objectclass=posixGroup)"
++#define FILTER_OR_PREFIX "(|"
++#define FILTER_OR_SUFFIX ")"
++#define FILTER_CN_PREFIX "(cn="
++#define FILTER_CN_SUFFIX ")"
++#define FILTER_UID_FORMAT "(memberUid=%s)"
++#define FILTER_GROUP_SUFFIX ")"
++#define FILTER_GROUP_SIZE(group) (size_t)
(strlen(group)+(ldap_count_group(group)*5)+52)
++
++/* just filter building stuff */
++#define REQUEST_GROUP_SIZE(filter, uid) (size_t)
(strlen(filter)+strlen(uid)+1)
++#define REQUEST_GROUP(buffer, prefilter, pwname) \
++ buffer = (char *) calloc(REQUEST_GROUP_SIZE(prefilter, pwname),
sizeof(char)); \
++ if (!buffer) { \
++ perror("calloc()"); \
++ return FAILURE; \
++ } \
++ snprintf(buffer, REQUEST_GROUP_SIZE(prefilter,pwname), prefilter,
pwname)
++/*
++XXX OLD group building macros
++#define REQUEST_GROUP_SIZE(grp, uid) (size_t) (strlen(grp)+strlen(uid)+46)
++#define REQUEST_GROUP(buffer,pwname,grp) \
++ buffer = (char *) calloc(REQUEST_GROUP_SIZE(grp, pwname),
sizeof(char)); \
++ if (!buffer) { \
++ perror("calloc()"); \
++ return FAILURE; \
++ } \
++
snprintf(buffer,REQUEST_GROUP_SIZE(grp,pwname),"(&(objectclass=posixGroup)(cn=%s)(memberUid=%s))",grp,pwname)
++ */
++
++/*
++XXX stock upstream version without extra filter support
++#define REQUEST_USER_SIZE(uid) (size_t) (strlen(uid)+64)
++#define REQUEST_USER(buffer, pwname) \
++ buffer = (char *) calloc(REQUEST_USER_SIZE(pwname), sizeof(char)); \
++ if (!buffer) { \
++ perror("calloc()"); \
++ return NULL; \
++ } \
++
snprintf(buffer,REQUEST_USER_SIZE(pwname),"(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s))",pwname)
++ */
++
++#define REQUEST_USER_SIZE(uid, filter) (size_t)
(strlen(uid)+64+(filter != NULL ? strlen(filter) : 0))
++#define REQUEST_USER(buffer, pwname, customfilter) \
++ buffer = (char *) calloc(REQUEST_USER_SIZE(pwname, customfilter),
sizeof(char)); \
++ if (!buffer) { \
++ perror("calloc()"); \
++ return NULL; \
++ } \
++ snprintf(buffer, REQUEST_USER_SIZE(pwname, customfilter), \
++
"(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)", \
++ pwname, (customfilter != NULL ? customfilter : ""))
++
++/* some portable and working tokenizer, lame though */
++static int tokenize(char ** o, size_t size, char * input) {
++ unsigned int i = 0, num;
++ const char * charset = " \t";
++ char * ptr = input;
++
++ /* leading white spaces are ignored */
++ num = strspn(ptr, charset);
++ ptr += num;
++
++ while ((num = strcspn(ptr, charset))) {
++ if (i < size-1) {
++ o[i++] = ptr;
++ ptr += num;
++ if (*ptr)
++ *ptr++ = '\0';
++ }
++ }
++ o[i] = NULL;
++ return SUCCESS;
++}
++
++void ldap_close(ldap_opt_t * ldap) {
++
++ if (!ldap)
++ return;
++
++ if ( ldap_unbind_ext(ldap->ld, NULL, NULL) < 0)
++ ldap_perror(ldap->ld, "ldap_unbind()");
++
++ ldap->ld = NULL;
++ FLAG_SET_DISCONNECTED(ldap->flags);
++
++ return;
++}
++
++/* init && bind */
++int ldap_connect(ldap_opt_t * ldap) {
++ int version = LDAP_VERSION3;
++
++ if (!ldap->servers)
++ return FAILURE;
++
++ /* Connection Init and setup */
++ ldap->ld = ldap_init(ldap->servers, LDAP_PORT);
++ if (!ldap->ld) {
++ ldap_perror(ldap->ld, "ldap_init()");
++ return FAILURE;
++ }
++
++ if ( ldap_set_option(ldap->ld, LDAP_OPT_PROTOCOL_VERSION,
&version) != LDAP_OPT_SUCCESS) {
++
ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_PROTOCOL_VERSION)");
++ return FAILURE;
++ }
++
++ /* Timeouts setup */
++ if (ldap_set_option(ldap->ld, LDAP_OPT_NETWORK_TIMEOUT,
&ldap->b_timeout) != LDAP_SUCCESS) {
++
ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT)");
++ }
++ if (ldap_set_option(ldap->ld, LDAP_OPT_TIMEOUT, &ldap->s_timeout) !=
LDAP_SUCCESS) {
++ ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_TIMEOUT)");
++ }
++
++ /* TLS support */
++ if ( (ldap->tls == -1) || (ldap->tls == 1) ) {
++ if (ldap_start_tls_s(ldap->ld, NULL, NULL ) != LDAP_SUCCESS) {
++ /* failed then reinit the initial connect */
++ ldap_perror(ldap->ld, "ldap_connect: (TLS) ldap_start_tls()");
++ if (ldap->tls == 1)
++ return FAILURE;
++
++ ldap->ld = ldap_init(ldap->servers, LDAP_PORT);
++ if (!ldap->ld) {
++ ldap_perror(ldap->ld, "ldap_init()");
++ return FAILURE;
++ }
++
++ if ( ldap_set_option(ldap->ld, LDAP_OPT_PROTOCOL_VERSION,
&version) != LDAP_OPT_SUCCESS) {
++ ldap_perror(ldap->ld, "ldap_set_option()");
++ return FAILURE;
++ }
++ }
++ }
++
++
++ if ( ldap_simple_bind_s(ldap->ld, ldap->binddn, ldap->bindpw) !=
LDAP_SUCCESS) {
++ ldap_perror(ldap->ld, "ldap_simple_bind_s()");
++ return FAILURE;
++ }
++
++ /* says it is connected */
++ FLAG_SET_CONNECTED(ldap->flags);
++
++ return SUCCESS;
++}
++
++/* must free allocated ressource */
++static char * ldap_build_host(char *host, int port) {
++ unsigned int size = strlen(host)+11;
++ char * h = (char *) calloc (size, sizeof(char));
++ int rc;
++ if (!h)
++ return NULL;
++
++ rc = snprintf(h, size, "%s:%d ", host, port);
++ if (rc == -1)
++ return NULL;
++ return h;
++}
++
++static int ldap_count_group(const char * input) {
++ const char * charset = " \t";
++ const char * ptr = input;
++ unsigned int count = 0;
++ unsigned int num;
++
++ num = strspn(ptr, charset);
++ ptr += num;
++
++ while ((num = strcspn(ptr, charset))) {
++ count++;
++ ptr += num;
++ ptr++;
++ }
++
++ return count;
++}
++
++/* format filter */
++char * ldap_parse_groups(const char * groups) {
++ unsigned int buffer_size = FILTER_GROUP_SIZE(groups);
++ char * buffer = (char *) calloc(buffer_size, sizeof(char));
++ char * g = NULL;
++ char * garray[32];
++ unsigned int i = 0;
++
++ if ((!groups)||(!buffer))
++ return NULL;
++
++ g = strdup(groups);
++ if (!g) {
++ free(buffer);
++ return NULL;
++ }
++
++ /* first separate into n tokens */
++ if ( tokenize(garray, sizeof(garray)/sizeof(*garray), g) < 0) {
++ free(g);
++ free(buffer);
++ return NULL;
++ }
++
++ /* build the final filter format */
++ strlcat(buffer, FILTER_GROUP_PREFIX, buffer_size);
++ strlcat(buffer, FILTER_OR_PREFIX, buffer_size);
++ i = 0;
++ while (garray[i]) {
++ strlcat(buffer, FILTER_CN_PREFIX, buffer_size);
++ strlcat(buffer, garray[i], buffer_size);
++ strlcat(buffer, FILTER_CN_SUFFIX, buffer_size);
++ i++;
++ }
++ strlcat(buffer, FILTER_OR_SUFFIX, buffer_size);
++ strlcat(buffer, FILTER_UID_FORMAT, buffer_size);
++ strlcat(buffer, FILTER_GROUP_SUFFIX, buffer_size);
++
++ free(g);
++ return buffer;
++}
++
++/* a bit dirty but leak free */
++char * ldap_parse_servers(const char * servers) {
++ char * s = NULL;
++ char * tmp = NULL, *urls[32];
++ unsigned int num = 0 , i = 0 , asize = 0;
++ LDAPURLDesc *urld[32];
++
++ if (!servers)
++ return NULL;
++
++ /* local copy of the arg */
++ s = strdup(servers);
++ if (!s)
++ return NULL;
++
++ /* first separate into URL tokens */
++ if ( tokenize(urls, sizeof(urls)/sizeof(*urls), s) < 0)
++ return NULL;
++
++ i = 0;
++ while (urls[i]) {
++ if (! ldap_is_ldap_url(urls[i]) ||
++ (ldap_url_parse(urls[i], &urld[i]) != 0)) {
++ return NULL;
++ }
++ i++;
++ }
++
++ /* now free(s) */
++ free (s);
++
++ /* how much memory do we need */
++ num = i;
++ for (i = 0 ; i < num ; i++)
++ asize += strlen(urld[i]->lud_host)+11;
++
++ /* alloc */
++ s = (char *) calloc( asize+1 , sizeof(char));
++ if (!s) {
++ for (i = 0 ; i < num ; i++)
++ ldap_free_urldesc(urld[i]);
++ return NULL;
++ }
++
++ /* then build the final host string */
++ for (i = 0 ; i < num ; i++) {
++ /* built host part */
++ tmp = ldap_build_host(urld[i]->lud_host, urld[i]->lud_port);
++ strncat(s, tmp, strlen(tmp));
++ ldap_free_urldesc(urld[i]);
++ free(tmp);
++ }
++
++ return s;
++}
++
++void ldap_options_print(ldap_opt_t * ldap) {
++ debug("ldap options:");
++ debug("servers: %s", ldap->servers);
++ if (ldap->u_basedn)
++ debug("user basedn: %s", ldap->u_basedn);
++ if (ldap->g_basedn)
++ debug("group basedn: %s", ldap->g_basedn);
++ if (ldap->binddn)
++ debug("binddn: %s", ldap->binddn);
++ if (ldap->bindpw)
++ debug("bindpw: %s", ldap->bindpw);
++ if (ldap->sgroup)
++ debug("group: %s", ldap->sgroup);
++ if (ldap->filter)
++ debug("filter: %s", ldap->filter);
++}
++
++void ldap_options_free(ldap_opt_t * l) {
++ if (!l)
++ return;
++ if (l->servers)
++ free(l->servers);
++ if (l->u_basedn)
++ free(l->u_basedn);
++ if (l->g_basedn)
++ free(l->g_basedn);
++ if (l->binddn)
++ free(l->binddn);
++ if (l->bindpw)
++ free(l->bindpw);
++ if (l->sgroup)
++ free(l->sgroup);
++ if (l->fgroup)
++ free(l->fgroup);
++ if (l->filter)
++ free(l->filter);
++ if (l->l_conf)
++ free(l->l_conf);
++ free(l);
++}
++
++/* free keys */
++void ldap_keys_free(ldap_key_t * k) {
++ ldap_value_free_len(k->keys);
++ free(k);
++ return;
++}
++
++ldap_key_t * ldap_getuserkey(ldap_opt_t *l, const char * user) {
++ ldap_key_t * k = (ldap_key_t *) calloc (1, sizeof(ldap_key_t));
++ LDAPMessage *res, *e;
++ char * filter;
++ int i;
++
++ if ((!k) || (!l))
++ return NULL;
++
++ /* Am i still connected ? RETRY n times */
++ /* XXX TODO: setup some conf value for retrying */
++ if (!(l->flags & FLAG_CONNECTED))
++ for (i = 0 ; i < 2 ; i++)
++ if (ldap_connect(l) == 0)
++ break;
++
++ /* quick check for attempts to be evil */
++ if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
++ (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL))
++ return NULL;
++
++ /* build filter for LDAP request */
++ REQUEST_USER(filter, user, l->filter);
++
++ if ( ldap_search_st( l->ld,
++ l->u_basedn,
++ LDAP_SCOPE_SUBTREE,
++ filter,
++ attrs, 0, &l->s_timeout, &res ) != LDAP_SUCCESS) {
++
++ ldap_perror(l->ld, "ldap_search_st()");
++
++ free(filter);
++ free(k);
++
++ /* XXX error on search, timeout etc.. close ask for reconnect */
++ ldap_close(l);
++
++ return NULL;
++ }
++
++ /* free */
++ free(filter);
++
++ /* check if any results */
++ i = ldap_count_entries(l->ld,res);
++ if (i <= 0) {
++ ldap_msgfree(res);
++ free(k);
++ return NULL;
++ }
++
++ if (i > 1)
++ debug("[LDAP] duplicate entries, using the FIRST entry returned");
++
++ e = ldap_first_entry(l->ld, res);
++ k->keys = ldap_get_values_len(l->ld, e, PUBKEYATTR);
++ k->num = ldap_count_values_len(k->keys);
++
++ ldap_msgfree(res);
++ return k;
++}
++
++
++/* -1 if trouble
++ 0 if user is NOT member of current server group
++ 1 if user IS MEMBER of current server group
++ */
++int ldap_ismember(ldap_opt_t * l, const char * user) {
++ LDAPMessage *res;
++ char * filter;
++ int i;
++
++ if ((!l->sgroup) || !(l->g_basedn))
++ return 1;
++
++ /* Am i still connected ? RETRY n times */
++ /* XXX TODO: setup some conf value for retrying */
++ if (!(l->flags & FLAG_CONNECTED))
++ for (i = 0 ; i < 2 ; i++)
++ if (ldap_connect(l) == 0)
++ break;
++
++ /* quick check for attempts to be evil */
++ if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
++ (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL))
++ return FAILURE;
++
++ /* build filter for LDAP request */
++ REQUEST_GROUP(filter, l->fgroup, user);
++
++ if (ldap_search_st( l->ld,
++ l->g_basedn,
++ LDAP_SCOPE_SUBTREE,
++ filter,
++ NULL, 0, &l->s_timeout, &res) != LDAP_SUCCESS) {
++
++ ldap_perror(l->ld, "ldap_search_st()");
++
++ free(filter);
++
++ /* XXX error on search, timeout etc.. close ask for reconnect */
++ ldap_close(l);
++
++ return FAILURE;
++ }
++
++ free(filter);
++
++ /* check if any results */
++ if (ldap_count_entries(l->ld, res) > 0) {
++ ldap_msgfree(res);
++ return 1;
++ }
++
++ ldap_msgfree(res);
++ return 0;
++}
++
++/*
++ * ldap.conf simple parser
++ * XXX TODO: sanity checks
++ * must either
++ * - free the previous ldap_opt_before replacing entries
++ * - free each necessary previously parsed elements
++ * ret:
++ * -1 on FAILURE, 0 on SUCCESS
++ */
++int ldap_parse_lconf(ldap_opt_t * l) {
++ FILE * lcd; /* ldap.conf descriptor */
++ char buf[BUFSIZ];
++ char * s = NULL, * k = NULL, * v = NULL;
++ int li, len;
++
++ lcd = fopen (l->l_conf, "r");
++ if (lcd == NULL) {
++ /* debug("Cannot open %s", l->l_conf); */
++ perror("ldap_parse_lconf()");
++ return FAILURE;
++ }
++
++ while (fgets (buf, sizeof (buf), lcd) != NULL) {
++
++ if (*buf == '\n' || *buf == '#')
++ continue;
++
++ k = buf;
++ v = k;
++ while (*v != '\0' && *v != ' ' && *v != '\t')
++ v++;
++
++ if (*v == '\0')
++ continue;
++
++ *(v++) = '\0';
++
++ while (*v == ' ' || *v == '\t')
++ v++;
++
++ li = strlen (v) - 1;
++ while (v[li] == ' ' || v[li] == '\t' || v[li] == '\n')
++ --li;
++ v[li + 1] = '\0';
++
++ if (!strcasecmp (k, "uri")) {
++ if ((l->servers = ldap_parse_servers(v)) == NULL) {
++ fatal("error in ldap servers");
++ return FAILURE;
++ }
++
++ }
++ else if (!strcasecmp (k, "base")) {
++ s = strchr (v, '?');
++ if (s != NULL) {
++ len = s - v;
++ l->u_basedn = malloc (len + 1);
++ strncpy (l->u_basedn, v, len);
++ l->u_basedn[len] = '\0';
++ } else {
++ l->u_basedn = strdup (v);
++ }
++ }
++ else if (!strcasecmp (k, "binddn")) {
++ l->binddn = strdup (v);
++ }
++ else if (!strcasecmp (k, "bindpw")) {
++ l->bindpw = strdup (v);
++ }
++ else if (!strcasecmp (k, "timelimit")) {
++ l->s_timeout.tv_sec = atoi (v);
++ }
++ else if (!strcasecmp (k, "bind_timelimit")) {
++ l->b_timeout.tv_sec = atoi (v);
++ }
++ else if (!strcasecmp (k, "ssl")) {
++ if (!strcasecmp (v, "start_tls"))
++ l->tls = 1;
++ }
++ }
++
++ fclose (lcd);
++ return SUCCESS;
++}
++
++#endif /* WITH_LDAP_PUBKEY */
+diff -Nuar --exclude '*.orig' --exclude '*.rej'
openssh-5.1p1.orig/ldapauth.h openssh-5.1p1+lpk/ldapauth.h
+--- openssh-5.1p1.orig/ldapauth.h 1969-12-31 16:00:00.000000000 -0800
++++ openssh-5.1p1+lpk/ldapauth.h 2008-08-23 15:02:47.000000000 -0700
+@@ -0,0 +1,124 @@
++/*
++ * $Id: openssh-lpk-4.3p1-0.3.7.patch,v 1.3 2006/04/18 15:29:09 eau Exp $
++ */
++
++/*
++ *
++ * Copyright (c) 2005, Eric AUGE <e...@phear.org>
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
++ *
++ * Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
++ * Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
++ * Neither the name of the phear.org nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
++ * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
++ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY,
++ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ *
++ */
++
++#ifndef LDAPAUTH_H
++#define LDAPAUTH_H
++
++#define LDAP_DEPRECATED 1
++
++#include <string.h>
++#include <time.h>
++#include <ldap.h>
++#include <lber.h>
++
++/* tokens in use for config */
++#define _DEFAULT_LPK_TOKEN "UseLPK"
++#define _DEFAULT_SRV_TOKEN "LpkServers"
++#define _DEFAULT_USR_TOKEN "LpkUserDN"
***The diff for this file has been truncated for email.***