auth: Fix 'Password mismatch' casing consistency

global: Replaced all instances of memset(p, 0, sizeof(*p)) with the new i_zero() macro. Used the following script: C_FILES=`git ls-files *.c` H_FILES=`git ls-files *.h` for F in "$C_FILES $H_FILES"; do echo "$F" perl -p -i -e 's/safe_memset\(&\(?([^,]*)\)?,\s*0,\s*sizeof\(\g1\)\)/i_zero_safe(&$1)/g' $F perl -p -i -e 's/safe_memset\(([^,]*),\s*0,\s*sizeof\(\*\g1\)\)/i_zero_safe($1)/g' $F perl -p -i -e 's/memset\(&\(?([^,]*)\)?,\s*0,\s*sizeof\(\g1\)\)/i_zero(&$1)/g' $F perl -p -i -e 's/memset\(([^,]*),\s*0,\s*sizeof\(\*\g1\)\)/i_zero($1)/g' $F done

lib: API change - var_expand*() now returns error string. This allows callers to fail properly if the format string is invalid.

global: unsigned int:1 -> bool:1 perl -i -pe 's/unsigned int ([^,:;]+):1;/bool $1:1;/' **/*.[ch]

auth: Moved cache_key from passdb_module to auth_passdb. This is in preparation for the next changeset, which moves default/override_fields also to auth_passdb.

Remove now-unnecessary direct stdlib.h #includes.

auth: Added %{passdb:field} and %{userdb:field} variables The field expands to either the passdb or userdb extra field. You can also use %{passdb:field:defaultvalue} where if field doesn't exist, it's expanded to defaultvalue. Note that an empty value means that the field still exists and it's not expanded to defaultvalue.

auth: Use special AUTH_SUBSYS_DB/MECH parameters as auth_request_log*() subsystem. This avoids hardcoded strings all over the place and also allows assigning the correct passdb/userdb name for log messages generated by generic passdb/userdb code, which doesn't know exactly where it was called from.

auth: Use a common auth_request_log_unknown_user() for logging "unknown user" entries.

net_ip2addr() changed to return "" instead of NULL on failure. Pretty much everything in the code assumed that it would never fail, which it normally doesn't except if the ip_addr was created for UNIX sockets.

Renamed network.[ch] to net.[ch]. The function prefixes already started with net_ instead of network_. And icecap wants to use network.h for other purpose. :)

auth: Make idle_kill work with auth worker processes.

Started using str_to_*() functions instead of libc's ones. --HG-- branch : HEAD

auth: Initial support for per-protocol auth settings. Currently the list of services is hard-coded. This should be changed so that config lookup returns the service names. --HG-- branch : HEAD

auth: passdb/userdb backends no longer know about struct auth_passdb/auth_userdb. --HG-- branch : HEAD

auth: auth_userdb and auth_passdb no longer has pointer to struct auth. --HG-- branch : HEAD

Removed MEMBER() macro. Require C99 style struct initializer. --HG-- branch : HEAD

pam: Fixed compiler warning with BSDs. --HG-- branch : HEAD

Renamed headers to prevent collision if they were flattened on an install. --HG-- branch : HEAD

pam: Compiling fix. --HG-- branch : HEAD

auth_debug_passwords=yes: Log password for PAM lookups. --HG-- branch : HEAD

Replaced auth_worker_max_request_count setting with passdb pam { args = max_requests=n } --HG-- branch : HEAD

Fail if trying to give unknown parameters to passdb/userdb. Also changed error messages to be consistent. --HG-- branch : HEAD

Solaris: Compile fix for previous PAM changes. --HG-- branch : HEAD

PAM: Attempt to give better error messages. Detect missing /etc/pam.d/service file and log it as an error the first time after startup. Don't return "unknown user" and "password mismatch" as errors but informational messages. --HG-- branch : HEAD

Separate "unknown passdb/userdb X" and "support for X not compiled in" error messages. --HG-- branch : HEAD

Replaced t_push/t_pop calls with T_FRAME*() macros. --HG-- branch : HEAD

Store cache_key via auth_cache_parse_key() which adds TABs between the %variables, making it safer. --HG-- branch : HEAD

PAM lookups are now always done in auth worker processes. --HG-- branch : HEAD

Make sure we don't crash if PAM message is NULL and debug is enabled. --HG-- branch : HEAD

Added failure_show_msg=yes parameter to PAM. If set, the first line of PAM password query is shown to user if authentication fails. This is useful with pam_otp. --HG-- branch : HEAD

Code cleanups. Also if auth_debug is enabled, log PAM messages. --HG-- branch : HEAD

Removed AUTH_PAM_USERPASS code, which was never used. --HG-- branch : HEAD

Crashfix if PAM returns a reply but the process doesn't die. --HG-- branch : HEAD

FIXME comment update --HG-- branch : HEAD

Lowercase the PAM service name when calling with "args = *". Linux PAM did this internally already, but at least BSD didn't. --HG-- branch : HEAD

Set PAM_RUSER. --HG-- branch : HEAD

removed unneeded include --HG-- branch : HEAD

PAM service name supports variables now. --HG-- branch : HEAD

Added more debug logging. --HG-- branch : HEAD

PAM dead-child timeout function was called 1000 times too often. --HG-- branch : HEAD

Added blocking=yes to PAM passdb to use auth workers instead of forking a new process for each lookup. --HG-- branch : HEAD

If PAM child process hasn't responded in two minutes, send KILL signal to it. --HG-- branch : HEAD

Replaced void *context from a lot of callbacks with the actual context type. Also added/fixed some context type checks. --HG-- branch : HEAD

Set default_pass_scheme so that cache_key works instead of just assert-crashing. --HG-- branch : HEAD

Added auth_request_set_credentials() to modify credentials in passdb and implemented it for SQL passdb. Added passdb_need_set_credentials boolean to mechanisms to indicate that it's required (OTP will need it). Patch by Andrey Panin. --HG-- branch : HEAD

Set SIGCHLD handler in init, not in preinit when lib_signals_init() hasn't yet been called. --HG-- branch : HEAD

Use SIGCHLD handler to check for killed child processes instead of a timeout loop. --HG-- branch : HEAD

If password is expired, give "Password expired" error. Currently works only with PAM. Also added "unknown user" PAM return value handling. --HG-- branch : HEAD

Set PAM_TTY. --HG-- branch : HEAD

Don't call pam_setcred() unless setcred=yes PAM passdb argument was given. --HG-- branch : HEAD

Call io_remove() earlier. --HG-- branch : HEAD

If error message from PAM was over ~500 bytes, we crashed. Probably never happened. Also use PIPE_BUF instead of hardcoded 512 bytes. --HG-- branch : HEAD

Removed #ifdef PAM_RHOST, it should be everywhere --HG-- branch : HEAD

deinit, unref, destroy, close, free, etc. functions now take a pointer to their data pointer, and set it to NULL. This makes double-frees less likely to cause security holes. --HG-- branch : HEAD

Added "bool" type and changed all ints that were used as booleans to bool. --HG-- branch : HEAD

Compiler warning fix --HG-- branch : HEAD

Check write()'s return value --HG-- branch : HEAD

PAM: Changed -session to session=yes to be more consistent with other parameters. Check that invalid parameters aren't given. Added a few examples to configuration file. --HG-- branch : HEAD

Separated passdb_module's interface and the actual data struct. Now it's possible to have multiple passdbs of same type but with different settings. --HG-- branch : HEAD

Make auth caching work with non-sql/ldap passdbs too. --HG-- branch : HEAD

Fixed some printf-type mismatches --HG-- branch : HEAD

Open/close PAM session if -session option is given. Patch by Pasi Sj�m. --HG-- branch : HEAD

Removed direct config.h including. I'm not sure why it was done before, probably to reduce compile times a few milliseconds. Ugly anyway.. --HG-- branch : HEAD

Allow PAM to modify username. --HG-- branch : HEAD

If we run out of memory, exit with FATAL_OUTOFMEM status instead of dumping core. Also changed a few other i_panic() calls to others. --HG-- branch : HEAD

Restructuring of auth code. Balancer auth processes were a bad idea. Usually the balancer itself took as much CPU as the actual workers because it acted as a proxy. Now auth worker means different thing: they're used to execute blocking passdb and userdb queries. Currently just MySQL (PAM and checkpassword in TODO). --HG-- branch : HEAD

Moved cache handling from sql/ldap-specific code to generic auth-request code. Did some small optimizations on the way. --HG-- branch : HEAD

Added auth_request_log_*(). --HG-- branch : HEAD

Added name variable for userdb_module and passdb_module and changed their initialization a bit. --HG-- branch : HEAD

s/protocol/service/ in authentication --HG-- branch : HEAD

Added preinit() call to userdb/passdbs, which is called before dropping privileges. init() is called after. SQL/LDAP now parses the config file in preinit, but does the actual connecting only in init(). This fixes LDAP crashing at startup. --HG-- branch : HEAD

Set PAM_RHOST for PAM if it's known. --HG-- branch : HEAD

Logging changes. Make sure we don't write control characters to log and also log IP address. --HG-- branch : HEAD

Don't use hardcoded protocol list for auth process, string is just fine. --HG-- branch : HEAD

Alignment fix --HG-- branch : HEAD

data_stack_pool split into two: unsafe_data_stack_pool which works like before, and a new one which verifies that stack frame stays the same whenever the pool is accessed. --HG-- branch : HEAD

Strict aliasing fix --HG-- branch : HEAD

Fixed crash if login process connection died while there were some auth requests. --HG-- branch : HEAD

Using "*" as PAM service name now uses imap/pop3 service. --HG-- branch : HEAD

Call waitpid() until no processes are left, instead of one per second. --HG-- branch : HEAD

Use "dovecot" service rather than "imap". --HG-- branch : HEAD

Fork new process for each PAM check. Not exactly fast, but we have to do it so we don't block when incorrect password is given. We could try reusing the processes though.. --HG-- branch : HEAD

Added default_pass_scheme to LDAP. Support for more password schemes. Merged password checking code with LDAP and passwd-file, so both support the same schemes now. --HG-- branch : HEAD

OpenPAM uses const too. --HG-- branch : HEAD

auth process fixes, LDAP seems to be working (with the kludge define or fixed libldap) --HG-- branch : HEAD

Async userdb and passdb interface. --HG-- branch : HEAD

We have now separate "userdb" and "passdb". They aren't tied to each others in any way, so it's possible to use whatever user database with whatever password database. Added "static" userdb, which uses same uid/gid for everyone and generates home directory from given template. This could be useful with PAM, although insecure since everyone uses same uid. Not too well tested, and userdb/passdb API still needs to be changed to asynchronous for sql/ldap/etc lookups. --HG-- branch : HEAD