Mercurial > crates > nonstick
annotate src/module.rs @ 51:9d1160b02d2c
Safety and doc fixes:
- Don't panic when given a string with a null character;
instead return `PAM_CONV_ERR`.
- Improve pattern matching and use ?s where appropriate.
- Format etc.
author | Paul Fisher <paul@pfish.zone> |
---|---|
date | Sat, 03 May 2025 18:41:25 -0400 |
parents | a921b72743e4 |
children |
rev | line source |
---|---|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
1 //! Functions for use in pam modules. |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
2 |
51 | 3 use crate::constants::{PamFlag, PamResultCode}; |
4 use crate::items::{Item, ItemType}; | |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
5 use libc::c_char; |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
6 use std::ffi::{CStr, CString}; |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
7 |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
8 /// Opaque type, used as a pointer when making pam API calls. |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
9 /// |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
10 /// A module is invoked via an external function such as `pam_sm_authenticate`. |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
11 /// Such a call provides a pam handle pointer. The same pointer should be given |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
12 /// as an argument when making API calls. |
34 | 13 #[repr(C)] |
14 pub struct PamHandle { | |
15 _data: [u8; 0], | |
16 } | |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
17 |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
18 #[link(name = "pam")] |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
19 extern "C" { |
34 | 20 fn pam_get_data( |
21 pamh: *const PamHandle, | |
22 module_data_name: *const c_char, | |
23 data: &mut *const libc::c_void, | |
24 ) -> PamResultCode; | |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
25 |
34 | 26 fn pam_set_data( |
27 pamh: *const PamHandle, | |
28 module_data_name: *const c_char, | |
29 data: *mut libc::c_void, | |
30 cleanup: extern "C" fn( | |
31 pamh: *const PamHandle, | |
32 data: *mut libc::c_void, | |
33 error_status: PamResultCode, | |
34 ), | |
35 ) -> PamResultCode; | |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
36 |
34 | 37 fn pam_get_item( |
38 pamh: *const PamHandle, | |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
39 item_type: ItemType, |
34 | 40 item: &mut *const libc::c_void, |
41 ) -> PamResultCode; | |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
42 |
34 | 43 fn pam_set_item( |
44 pamh: *mut PamHandle, | |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
45 item_type: ItemType, |
34 | 46 item: *const libc::c_void, |
47 ) -> PamResultCode; | |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
48 |
34 | 49 fn pam_get_user( |
50 pamh: *const PamHandle, | |
51 user: &*mut c_char, | |
52 prompt: *const c_char, | |
53 ) -> PamResultCode; | |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
54 |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
55 fn pam_get_authtok( |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
56 pamh: *const PamHandle, |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
57 item_type: ItemType, |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
58 data: &*mut c_char, |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
59 prompt: *const c_char, |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
60 ) -> PamResultCode; |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
61 |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
62 } |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
63 |
34 | 64 pub extern "C" fn cleanup<T>(_: *const PamHandle, c_data: *mut libc::c_void, _: PamResultCode) { |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
65 unsafe { |
34 | 66 let _data: Box<T> = Box::from_raw(c_data.cast::<T>()); |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
67 } |
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
68 } |
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
69 |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
70 pub type PamResult<T> = Result<T, PamResultCode>; |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
71 |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
72 impl PamHandle { |
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
73 /// Gets some value, identified by `key`, that has been set by the module |
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
74 /// previously. |
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
75 /// |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
76 /// See the [`pam_get_data` manual page]( |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
77 /// https://www.man7.org/linux/man-pages/man3/pam_get_data.3.html). |
34 | 78 /// |
79 /// # Errors | |
80 /// | |
81 /// Returns an error if the underlying PAM function call fails. | |
82 /// | |
83 /// # Safety | |
84 /// | |
85 /// The data stored under the provided key must be of type `T` otherwise the | |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
86 /// behaviour of this function is undefined. |
51 | 87 /// |
88 /// The data, if present, is owned by the current PAM conversation. | |
89 pub unsafe fn get_data<T>(&self, key: &str) -> PamResult<Option<&T>> { | |
90 let c_key = CString::new(key).map_err(|_| PamResultCode::PAM_CONV_ERR)?; | |
34 | 91 let mut ptr: *const libc::c_void = std::ptr::null(); |
51 | 92 to_result(pam_get_data(self, c_key.as_ptr(), &mut ptr))?; |
93 match ptr.is_null() { | |
94 true => Ok(None), | |
95 false => { | |
96 let typed_ptr = ptr.cast::<T>(); | |
97 Ok(Some(&*typed_ptr)) | |
98 } | |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
99 } |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
100 } |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
101 |
51 | 102 /// Stores a value that can be retrieved later with `get_data`. |
103 /// The conversation takes ownership of the data. | |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
104 /// |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
105 /// See the [`pam_set_data` manual page]( |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
106 /// https://www.man7.org/linux/man-pages/man3/pam_set_data.3.html). |
34 | 107 /// |
108 /// # Errors | |
109 /// | |
110 /// Returns an error if the underlying PAM function call fails. | |
51 | 111 pub fn set_data<T>(&mut self, key: &str, data: Box<T>) -> PamResult<()> { |
112 let c_key = CString::new(key).map_err(|_| PamResultCode::PAM_CONV_ERR)?; | |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
113 let res = unsafe { |
34 | 114 pam_set_data( |
115 self, | |
116 c_key.as_ptr(), | |
117 Box::into_raw(data).cast::<libc::c_void>(), | |
118 cleanup::<T>, | |
119 ) | |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
120 }; |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
121 to_result(res) |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
122 } |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
123 |
51 | 124 /// Retrieves a value that has been set, possibly by the pam client. |
125 /// This is particularly useful for getting a `PamConv` reference. | |
126 /// | |
127 /// These items are *references to PAM memory* | |
128 /// which are *owned by the conversation*. | |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
129 /// |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
130 /// See the [`pam_get_item` manual page]( |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
131 /// https://www.man7.org/linux/man-pages/man3/pam_get_item.3.html). |
34 | 132 /// |
133 /// # Errors | |
134 /// | |
135 /// Returns an error if the underlying PAM function call fails. | |
136 pub fn get_item<T: crate::items::Item>(&self) -> PamResult<Option<T>> { | |
137 let mut ptr: *const libc::c_void = std::ptr::null(); | |
51 | 138 let out = unsafe { |
34 | 139 let r = pam_get_item(self, T::type_id(), &mut ptr); |
51 | 140 to_result(r)?; |
34 | 141 let typed_ptr = ptr.cast::<T::Raw>(); |
51 | 142 match typed_ptr.is_null() { |
143 true => None, | |
144 false => Some(T::from_raw(typed_ptr)), | |
145 } | |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
146 }; |
51 | 147 Ok(out) |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
148 } |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
149 |
51 | 150 /// Sets an item in the pam context. It can be retrieved using `get_item`. |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
151 /// |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
152 /// See the [`pam_set_item` manual page]( |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
153 /// https://www.man7.org/linux/man-pages/man3/pam_set_item.3.html). |
34 | 154 /// |
155 /// # Errors | |
156 /// | |
157 /// Returns an error if the underlying PAM function call fails. | |
51 | 158 pub fn set_item<T: Item>(&mut self, item: T) -> PamResult<()> { |
34 | 159 let res = |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
160 unsafe { pam_set_item(self, T::type_id(), item.into_raw().cast::<libc::c_void>()) }; |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
161 to_result(res) |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
162 } |
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
163 |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
164 /// Retrieves the name of the user who is authenticating or logging in. |
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
165 /// |
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
166 /// This is really a specialization of `get_item`. |
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
167 /// |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
168 /// See the [`pam_get_user` manual page]( |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
169 /// https://www.man7.org/linux/man-pages/man3/pam_get_user.3.html). |
34 | 170 /// |
171 /// # Errors | |
172 /// | |
173 /// Returns an error if the underlying PAM function call fails. | |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
174 pub fn get_user(&self, prompt: Option<&str>) -> PamResult<String> { |
51 | 175 let prompt = option_cstr(prompt)?; |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
176 let output: *mut c_char = std::ptr::null_mut(); |
51 | 177 let res = unsafe { pam_get_user(self, &output, prompt_ptr(prompt.as_ref())) }; |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
178 match res { |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
179 PamResultCode::PAM_SUCCESS => copy_pam_string(output), |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
180 otherwise => Err(otherwise), |
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
181 } |
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
182 } |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
183 |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
184 /// Retrieves the authentication token from the user. |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
185 /// |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
186 /// This is really a specialization of `get_item`. |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
187 /// |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
188 /// See the [`pam_get_authtok` manual page]( |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
189 /// https://www.man7.org/linux/man-pages/man3/pam_get_authtok.3.html). |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
190 /// |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
191 /// # Errors |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
192 /// |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
193 /// Returns an error if the underlying PAM function call fails. |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
194 pub fn get_authtok(&self, prompt: Option<&str>) -> PamResult<String> { |
51 | 195 let prompt = option_cstr(prompt)?; |
196 let output: *mut c_char = std::ptr::null_mut(); | |
197 let res = unsafe { | |
198 pam_get_authtok( | |
199 self, | |
200 ItemType::AuthTok, | |
201 &output, | |
202 prompt_ptr(prompt.as_ref()), | |
203 ) | |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
204 }; |
51 | 205 to_result(res)?; |
206 copy_pam_string(output) | |
207 } | |
208 } | |
209 | |
210 /// Safely converts a `&str` option to a `CString` option. | |
211 fn option_cstr(prompt: Option<&str>) -> PamResult<Option<CString>> { | |
212 prompt | |
213 .map(CString::new) | |
214 .transpose() | |
215 .map_err(|_| PamResultCode::PAM_CONV_ERR) | |
216 } | |
217 | |
218 /// The pointer to the prompt CString, or null if absent. | |
219 fn prompt_ptr(prompt: Option<&CString>) -> *const c_char { | |
220 match prompt { | |
221 Some(c_str) => c_str.as_ptr(), | |
222 None => std::ptr::null(), | |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
223 } |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
224 } |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
225 |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
226 /// Creates an owned copy of a string that is returned from a |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
227 /// <code>pam_get_<var>whatever</var></code> function. |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
228 fn copy_pam_string(result_ptr: *const c_char) -> PamResult<String> { |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
229 // We really shouldn't get a null pointer back here, but if we do, return nothing. |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
230 if result_ptr.is_null() { |
51 | 231 return Ok(String::new()); |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
232 } |
51 | 233 let bytes = unsafe { CStr::from_ptr(result_ptr) }; |
234 Ok(bytes | |
235 .to_str() | |
236 .map_err(|_| PamResultCode::PAM_CONV_ERR)? | |
237 .into()) | |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
238 } |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
239 |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
240 /// Convenience to transform a `PamResultCode` into a unit `PamResult`. |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
241 fn to_result(result: PamResultCode) -> PamResult<()> { |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
242 match result { |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
243 PamResultCode::PAM_SUCCESS => Ok(()), |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
244 otherwise => Err(otherwise), |
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
245 } |
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
246 } |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
247 |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
248 /// Provides functions that are invoked by the entrypoints generated by the |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
249 /// [`pam_hooks!` macro](../macro.pam_hooks.html). |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
250 /// |
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
251 /// All hooks are ignored by PAM dispatch by default given the default return value of `PAM_IGNORE`. |
45
ce47901aab7a
Rename to “nonstick”, move to root, update docs and license.
Paul Fisher <paul@pfish.zone>
parents:
44
diff
changeset
|
252 /// Override any functions that you want to handle with your module. See [PAM’s root manual page]( |
ce47901aab7a
Rename to “nonstick”, move to root, update docs and license.
Paul Fisher <paul@pfish.zone>
parents:
44
diff
changeset
|
253 /// https://www.man7.org/linux/man-pages/man3/pam.3.html). |
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
254 #[allow(unused_variables)] |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
255 pub trait PamHooks { |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
256 /// This function performs the task of establishing whether the user is permitted to gain access at |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
257 /// this time. It should be understood that the user has previously been validated by an |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
258 /// authentication module. This function checks for other things. Such things might be: the time of |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
259 /// day or the date, the terminal line, remote hostname, etc. This function may also determine |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
260 /// things like the expiration on passwords, and respond that the user change it before continuing. |
34 | 261 fn acct_mgmt(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { |
262 PamResultCode::PAM_IGNORE | |
263 } | |
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
264 |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
265 /// This function performs the task of authenticating the user. |
34 | 266 fn sm_authenticate(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { |
267 PamResultCode::PAM_IGNORE | |
268 } | |
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
269 |
34 | 270 /// This function is used to (re-)set the authentication token of the user. |
271 /// | |
272 /// The PAM library calls this function twice in succession. The first time with | |
273 /// `PAM_PRELIM_CHECK` and then, if the module does not return `PAM_TRY_AGAIN`, subsequently with | |
274 /// `PAM_UPDATE_AUTHTOK`. It is only on the second call that the authorization token is | |
275 /// (possibly) changed. | |
276 fn sm_chauthtok(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { | |
277 PamResultCode::PAM_IGNORE | |
278 } | |
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
279 |
34 | 280 /// This function is called to terminate a session. |
281 fn sm_close_session(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { | |
282 PamResultCode::PAM_IGNORE | |
283 } | |
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
284 |
34 | 285 /// This function is called to commence a session. |
286 fn sm_open_session(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { | |
287 PamResultCode::PAM_IGNORE | |
288 } | |
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
289 |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
290 /// This function performs the task of altering the credentials of the user with respect to the |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
291 /// corresponding authorization scheme. Generally, an authentication module may have access to more |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
292 /// information about a user than their authentication token. This function is used to make such |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
293 /// information available to the application. It should only be called after the user has been |
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
294 /// authenticated but before a session has been established. |
34 | 295 fn sm_setcred(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { |
296 PamResultCode::PAM_IGNORE | |
297 } | |
298 } |