Merge pull request #17 from gollub/feature/client_connect_source_address_v4

Add source addr parameter for tac_connect_single

6 files changed, 19 insertions, 10 deletions

diff --git a/Makefile.am b/Makefile.am
index dd73b01..a369073 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -41,7 +41,7 @@ libtac/lib/xalloc.c \
 libtac/lib/xalloc.h \
 $(libtac_include_HEADERS)
 libtac_la_CFLAGS = $(AM_CFLAGS) -Ilibtac/include
-libtac_la_LDFLAGS = -version-info 0:0:0 -shared
+libtac_la_LDFLAGS = -version-info 1:0:0 -shared
 
 moduledir = @pamdir@
 module_LTLIBRARIES = pam_tacplus.la
diff --git a/debian/control b/debian/control
index af07574..6dde527 100644
--- a/debian/control
+++ b/debian/control
@@ -8,13 +8,13 @@ Homepage: https://github.com/jeroennijhof/pam_tacplus
 
 Package: libpam-tacplus
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime, libtac0
+Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime, libtac1
 Description: PAM module for using TACACS+ as an authentication service
  This PAM module support authentication, authorization (account management) and
  accounting (session management) performed using TACACS+ protocol designed by
  Cisco.
 
-Package: libtac0
+Package: libtac1
 Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}
 Description: TACACS+ protocol library 
@@ -24,7 +24,7 @@ Description: TACACS+ protocol library
 Package: libtac-dev
 Section: libdevel
 Architecture: any
-Depends: ${misc:Depends}, libtac0 (= ${binary:Version}), libc6-dev|libc-dev
+Depends: ${misc:Depends}, libtac1 (= ${binary:Version}), libc6-dev|libc-dev
 Description: Development files for TACACS+ protocol library 
  Contains C header files and development files for libtac, a TACACS+ protocol
  implementation.
diff --git a/debian/libtac0.install b/debian/libtac1.install
index 3de3b10..3de3b10 100644
--- a/debian/libtac0.install
+++ b/debian/libtac1.install
diff --git a/libtac/include/libtac.h b/libtac/include/libtac.h
index aad4cbf..18f98f6 100644
--- a/libtac/include/libtac.h
+++ b/libtac/include/libtac.h
@@ -126,7 +126,7 @@ extern int tac_readtimeout_enable;
 extern int tac_timeout;
 
 int tac_connect(struct addrinfo **, char **, int);
-int tac_connect_single(struct addrinfo *, const char *);
+int tac_connect_single(struct addrinfo *, const char *, struct addrinfo *);
 char *tac_ntop(const struct sockaddr *);
 
 int tac_authen_send(int, const char *, char *, char *,
diff --git a/libtac/lib/connect.c b/libtac/lib/connect.c
index 1226797..a186220 100644
--- a/libtac/lib/connect.c
+++ b/libtac/lib/connect.c
@@ -50,7 +50,7 @@ int tac_connect(struct addrinfo **server, char **key, int servers) {
         TACSYSLOG((LOG_ERR, "%s: no TACACS+ servers defined", __FUNCTION__))
     } else {
         for ( tries = 0; tries < servers; tries++ ) {   
-            if((fd=tac_connect_single(server[tries], key[tries])) >= 0 ) {
+            if((fd=tac_connect_single(server[tries], key[tries], NULL)) >= 0 ) {
                 /* tac_secret was set in tac_connect_single on success */
                 break;
             }
@@ -67,7 +67,7 @@ int tac_connect(struct addrinfo **server, char **key, int servers) {
  *   >= 0 : valid fd
  *   <  0 : error status code, see LIBTAC_STATUS_...
  */
-int tac_connect_single(struct addrinfo *server, const char *key) {
+int tac_connect_single(struct addrinfo *server, const char *key, struct addrinfo *srcaddr) {
     int retval = LIBTAC_STATUS_CONN_ERR; /* default retval */
     int fd = -1;
     int flags, rc;
@@ -100,6 +100,15 @@ int tac_connect_single(struct addrinfo *server, const char *key) {
         return LIBTAC_STATUS_CONN_ERR;
     }
 
+    /* bind if source address got explicity defined */
+    if (srcaddr) {
+        if (bind(fd, srcaddr->ai_addr, srcaddr->ai_addrlen) < 0) {
+            TACSYSLOG((LOG_ERR, "%s: Failed to bind source address: %s",
+                __FUNCTION__, strerror(errno)))
+            return LIBTAC_STATUS_CONN_ERR;
+        }
+    }
+
     rc = connect(fd, server->ai_addr, server->ai_addrlen);
     /* FIX this..for some reason errno = 0 on AIX... */
     if((rc == -1) && (errno != EINPROGRESS) && (errno != 0)) {
diff --git a/pam_tacplus.c b/pam_tacplus.c
index b76b317..600331b 100644
--- a/pam_tacplus.c
+++ b/pam_tacplus.c
@@ -169,7 +169,7 @@ int _pam_account(pam_handle_t *pamh, int argc, const char **argv,
 
     status = PAM_SESSION_ERR;
     for(srv_i = 0; srv_i < tac_srv_no; srv_i++) {
-        tac_fd = tac_connect_single(tac_srv[srv_i].addr, tac_srv[srv_i].key);
+        tac_fd = tac_connect_single(tac_srv[srv_i].addr, tac_srv[srv_i].key, NULL);
         if (tac_fd < 0) {
             _pam_log(LOG_WARNING, "%s: error sending %s (fd)",
                 __FUNCTION__, typemsg);
@@ -268,7 +268,7 @@ int pam_sm_authenticate (pam_handle_t * pamh, int flags,
         if (ctrl & PAM_TAC_DEBUG)
             syslog(LOG_DEBUG, "%s: trying srv %d", __FUNCTION__, srv_i );
 
-        tac_fd = tac_connect_single(tac_srv[srv_i].addr, tac_srv[srv_i].key);
+        tac_fd = tac_connect_single(tac_srv[srv_i].addr, tac_srv[srv_i].key, NULL);
         if (tac_fd < 0) {
             _pam_log(LOG_ERR, "connection failed srv %d: %m", srv_i);
             continue;
@@ -489,7 +489,7 @@ int pam_sm_acct_mgmt (pam_handle_t * pamh, int flags,
     if(tac_protocol != NULL && tac_protocol[0] != '\0')
       tac_add_attrib(&attr, "protocol", tac_protocol);
 
-    tac_fd = tac_connect_single(active_server.addr, active_server.key);
+    tac_fd = tac_connect_single(active_server.addr, active_server.key, NULL);
     if(tac_fd < 0) {
         _pam_log (LOG_ERR, "TACACS+ server unavailable");
         if(arep.msg != NULL)