|
17
|
1 extern crate pam; |
|
|
2 extern crate rand; |
|
|
3 |
|
|
4 pub mod ffi; |
|
|
5 |
|
|
6 use pam::module::{PamHandleT, get_item, get_user}; |
|
|
7 use pam::constants::{PamResultCode, PAM_PROMPT_ECHO_OFF}; |
|
|
8 use pam::conv::PamConv; |
|
|
9 use std::collections::HashMap; |
|
|
10 use std::time::Duration; |
|
|
11 use rand::Rng; |
|
|
12 use std::str::FromStr; |
|
|
13 |
|
|
14 macro_rules! pam_try { |
|
|
15 ($e:expr) => ( |
|
|
16 match $e { |
|
|
17 Ok(v) => v, |
|
|
18 Err(e) => return e, |
|
|
19 } |
|
|
20 ); |
|
|
21 ($e:expr, $err:expr) => ( |
|
|
22 match $e { |
|
|
23 Ok(v) => v, |
|
|
24 Err(e) => { |
|
|
25 println!("Error: {}", e); |
|
|
26 return $err; |
|
|
27 } |
|
|
28 } |
|
|
29 ); |
|
|
30 } |
|
|
31 |
|
|
32 // This function performs the task of authenticating the user. |
|
|
33 pub fn sm_authenticate(pamh: &PamHandleT, args: Vec<String>, silent: bool) -> PamResultCode { |
|
|
34 println!("Let's auth over HTTP"); |
|
|
35 |
|
|
36 /* TODO: use args to change difficulty ;-) |
|
|
37 let args: HashMap<&str, &str> = args.iter().map(|s| { |
|
|
38 let mut parts = s.splitn(2, "="); |
|
|
39 (parts.next().unwrap(), parts.next().unwrap_or("")) |
|
|
40 }).collect(); |
|
|
41 */ |
|
|
42 |
|
|
43 // TODO: maybe we can change difficulty base on user? |
|
|
44 // let user = pam_try!(get_user(&pamh, None)); |
|
|
45 |
|
|
46 let conv = match get_item::<PamConv>(&pamh) { |
|
|
47 Ok(conv) => conv, |
|
|
48 Err(err) => { |
|
|
49 println!("Couldn't get pam_conv"); |
|
|
50 return err; |
|
|
51 } |
|
|
52 }; |
|
|
53 |
|
|
54 let mut rng = rand::thread_rng(); |
|
|
55 let a = rng.gen::<u32>() % 100; |
|
|
56 let b = rng.gen::<u32>() % 100; |
|
|
57 let math = format!("{} + {} = ", a, b); |
|
|
58 |
|
|
59 // This println kinda helps debugging since the test script doesn't echo |
|
|
60 println!("{}", math); |
|
|
61 |
|
|
62 let password = pam_try!(conv.send(PAM_PROMPT_ECHO_OFF, &math)); |
|
|
63 |
|
|
64 if password.and_then(|p| u32::from_str(&p).ok()) == Some(a+b) { |
|
|
65 return PamResultCode::PAM_SUCCESS; |
|
|
66 } |
|
|
67 |
|
|
68 println!("You failed the PAM sobriety test."); |
|
|
69 return PamResultCode::PAM_AUTH_ERR; |
|
|
70 } |
|
|
71 |
|
|
72 // This function performs the task of altering the credentials of the user with respect to the |
|
|
73 // corresponding authorization scheme. Generally, an authentication module may have access to more |
|
|
74 // information about a user than their authentication token. This function is used to make such |
|
|
75 // information available to the application. It should only be called after the user has been |
|
|
76 // authenticated but before a session has been established. |
|
|
77 pub fn sm_setcred(_pamh: &PamHandleT, _args: Vec<String>, _silent: bool) -> PamResultCode { |
|
|
78 println!("set credentials"); |
|
|
79 PamResultCode::PAM_SUCCESS |
|
|
80 } |
|
|
81 |
|
|
82 // This function performs the task of establishing whether the user is permitted to gain access at |
|
|
83 // this time. It should be understood that the user has previously been validated by an |
|
|
84 // authentication module. This function checks for other things. Such things might be: the time of |
|
|
85 // day or the date, the terminal line, remote hostname, etc. This function may also determine |
|
|
86 // things like the expiration on passwords, and respond that the user change it before continuing. |
|
|
87 pub fn acct_mgmt(_pamh: &PamHandleT, _args: Vec<String>, _silent: bool) -> PamResultCode { |
|
|
88 println!("account management"); |
|
|
89 PamResultCode::PAM_SUCCESS |
|
|
90 } |
