Mercurial > crates > nonstick
annotate src/module.rs @ 51:9d1160b02d2c
Safety and doc fixes:
- Don't panic when given a string with a null character;
instead return `PAM_CONV_ERR`.
- Improve pattern matching and use ?s where appropriate.
- Format etc.
| author | Paul Fisher <paul@pfish.zone> |
|---|---|
| date | Sat, 03 May 2025 18:41:25 -0400 |
| parents | a921b72743e4 |
| children | daa2cde64601 |
| rev | line source |
|---|---|
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
1 //! Functions for use in pam modules. |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
2 |
| 51 | 3 use crate::constants::{PamFlag, PamResultCode}; |
| 4 use crate::items::{Item, ItemType}; | |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
5 use libc::c_char; |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
6 use std::ffi::{CStr, CString}; |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
7 |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
8 /// Opaque type, used as a pointer when making pam API calls. |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
9 /// |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
10 /// A module is invoked via an external function such as `pam_sm_authenticate`. |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
11 /// Such a call provides a pam handle pointer. The same pointer should be given |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
12 /// as an argument when making API calls. |
| 34 | 13 #[repr(C)] |
| 14 pub struct PamHandle { | |
| 15 _data: [u8; 0], | |
| 16 } | |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
17 |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
18 #[link(name = "pam")] |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
19 extern "C" { |
| 34 | 20 fn pam_get_data( |
| 21 pamh: *const PamHandle, | |
| 22 module_data_name: *const c_char, | |
| 23 data: &mut *const libc::c_void, | |
| 24 ) -> PamResultCode; | |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
25 |
| 34 | 26 fn pam_set_data( |
| 27 pamh: *const PamHandle, | |
| 28 module_data_name: *const c_char, | |
| 29 data: *mut libc::c_void, | |
| 30 cleanup: extern "C" fn( | |
| 31 pamh: *const PamHandle, | |
| 32 data: *mut libc::c_void, | |
| 33 error_status: PamResultCode, | |
| 34 ), | |
| 35 ) -> PamResultCode; | |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
36 |
| 34 | 37 fn pam_get_item( |
| 38 pamh: *const PamHandle, | |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
39 item_type: ItemType, |
| 34 | 40 item: &mut *const libc::c_void, |
| 41 ) -> PamResultCode; | |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
42 |
| 34 | 43 fn pam_set_item( |
| 44 pamh: *mut PamHandle, | |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
45 item_type: ItemType, |
| 34 | 46 item: *const libc::c_void, |
| 47 ) -> PamResultCode; | |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
48 |
| 34 | 49 fn pam_get_user( |
| 50 pamh: *const PamHandle, | |
| 51 user: &*mut c_char, | |
| 52 prompt: *const c_char, | |
| 53 ) -> PamResultCode; | |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
54 |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
55 fn pam_get_authtok( |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
56 pamh: *const PamHandle, |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
57 item_type: ItemType, |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
58 data: &*mut c_char, |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
59 prompt: *const c_char, |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
60 ) -> PamResultCode; |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
61 |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
62 } |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
63 |
| 34 | 64 pub extern "C" fn cleanup<T>(_: *const PamHandle, c_data: *mut libc::c_void, _: PamResultCode) { |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
65 unsafe { |
| 34 | 66 let _data: Box<T> = Box::from_raw(c_data.cast::<T>()); |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
67 } |
|
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
68 } |
|
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
69 |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
70 pub type PamResult<T> = Result<T, PamResultCode>; |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
71 |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
72 impl PamHandle { |
|
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
73 /// Gets some value, identified by `key`, that has been set by the module |
|
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
74 /// previously. |
|
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
75 /// |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
76 /// See the [`pam_get_data` manual page]( |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
77 /// https://www.man7.org/linux/man-pages/man3/pam_get_data.3.html). |
| 34 | 78 /// |
| 79 /// # Errors | |
| 80 /// | |
| 81 /// Returns an error if the underlying PAM function call fails. | |
| 82 /// | |
| 83 /// # Safety | |
| 84 /// | |
| 85 /// The data stored under the provided key must be of type `T` otherwise the | |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
86 /// behaviour of this function is undefined. |
| 51 | 87 /// |
| 88 /// The data, if present, is owned by the current PAM conversation. | |
| 89 pub unsafe fn get_data<T>(&self, key: &str) -> PamResult<Option<&T>> { | |
| 90 let c_key = CString::new(key).map_err(|_| PamResultCode::PAM_CONV_ERR)?; | |
| 34 | 91 let mut ptr: *const libc::c_void = std::ptr::null(); |
| 51 | 92 to_result(pam_get_data(self, c_key.as_ptr(), &mut ptr))?; |
| 93 match ptr.is_null() { | |
| 94 true => Ok(None), | |
| 95 false => { | |
| 96 let typed_ptr = ptr.cast::<T>(); | |
| 97 Ok(Some(&*typed_ptr)) | |
| 98 } | |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
99 } |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
100 } |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
101 |
| 51 | 102 /// Stores a value that can be retrieved later with `get_data`. |
| 103 /// The conversation takes ownership of the data. | |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
104 /// |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
105 /// See the [`pam_set_data` manual page]( |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
106 /// https://www.man7.org/linux/man-pages/man3/pam_set_data.3.html). |
| 34 | 107 /// |
| 108 /// # Errors | |
| 109 /// | |
| 110 /// Returns an error if the underlying PAM function call fails. | |
| 51 | 111 pub fn set_data<T>(&mut self, key: &str, data: Box<T>) -> PamResult<()> { |
| 112 let c_key = CString::new(key).map_err(|_| PamResultCode::PAM_CONV_ERR)?; | |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
113 let res = unsafe { |
| 34 | 114 pam_set_data( |
| 115 self, | |
| 116 c_key.as_ptr(), | |
| 117 Box::into_raw(data).cast::<libc::c_void>(), | |
| 118 cleanup::<T>, | |
| 119 ) | |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
120 }; |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
121 to_result(res) |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
122 } |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
123 |
| 51 | 124 /// Retrieves a value that has been set, possibly by the pam client. |
| 125 /// This is particularly useful for getting a `PamConv` reference. | |
| 126 /// | |
| 127 /// These items are *references to PAM memory* | |
| 128 /// which are *owned by the conversation*. | |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
129 /// |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
130 /// See the [`pam_get_item` manual page]( |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
131 /// https://www.man7.org/linux/man-pages/man3/pam_get_item.3.html). |
| 34 | 132 /// |
| 133 /// # Errors | |
| 134 /// | |
| 135 /// Returns an error if the underlying PAM function call fails. | |
| 136 pub fn get_item<T: crate::items::Item>(&self) -> PamResult<Option<T>> { | |
| 137 let mut ptr: *const libc::c_void = std::ptr::null(); | |
| 51 | 138 let out = unsafe { |
| 34 | 139 let r = pam_get_item(self, T::type_id(), &mut ptr); |
| 51 | 140 to_result(r)?; |
| 34 | 141 let typed_ptr = ptr.cast::<T::Raw>(); |
| 51 | 142 match typed_ptr.is_null() { |
| 143 true => None, | |
| 144 false => Some(T::from_raw(typed_ptr)), | |
| 145 } | |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
146 }; |
| 51 | 147 Ok(out) |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
148 } |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
149 |
| 51 | 150 /// Sets an item in the pam context. It can be retrieved using `get_item`. |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
151 /// |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
152 /// See the [`pam_set_item` manual page]( |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
153 /// https://www.man7.org/linux/man-pages/man3/pam_set_item.3.html). |
| 34 | 154 /// |
| 155 /// # Errors | |
| 156 /// | |
| 157 /// Returns an error if the underlying PAM function call fails. | |
| 51 | 158 pub fn set_item<T: Item>(&mut self, item: T) -> PamResult<()> { |
| 34 | 159 let res = |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
160 unsafe { pam_set_item(self, T::type_id(), item.into_raw().cast::<libc::c_void>()) }; |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
161 to_result(res) |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
162 } |
|
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
163 |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
164 /// Retrieves the name of the user who is authenticating or logging in. |
|
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
165 /// |
|
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
166 /// This is really a specialization of `get_item`. |
|
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
167 /// |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
168 /// See the [`pam_get_user` manual page]( |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
169 /// https://www.man7.org/linux/man-pages/man3/pam_get_user.3.html). |
| 34 | 170 /// |
| 171 /// # Errors | |
| 172 /// | |
| 173 /// Returns an error if the underlying PAM function call fails. | |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
174 pub fn get_user(&self, prompt: Option<&str>) -> PamResult<String> { |
| 51 | 175 let prompt = option_cstr(prompt)?; |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
176 let output: *mut c_char = std::ptr::null_mut(); |
| 51 | 177 let res = unsafe { pam_get_user(self, &output, prompt_ptr(prompt.as_ref())) }; |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
178 match res { |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
179 PamResultCode::PAM_SUCCESS => copy_pam_string(output), |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
180 otherwise => Err(otherwise), |
|
19
d654aa0655e5
Making PamHandle a struct with methods
Anthony Nowell <anthony@algorithmia.com>
parents:
15
diff
changeset
|
181 } |
|
15
27730595f1ea
Adding pam-http module
Anthony Nowell <anthony@algorithmia.com>
parents:
diff
changeset
|
182 } |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
183 |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
184 /// Retrieves the authentication token from the user. |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
185 /// |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
186 /// This is really a specialization of `get_item`. |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
187 /// |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
188 /// See the [`pam_get_authtok` manual page]( |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
189 /// https://www.man7.org/linux/man-pages/man3/pam_get_authtok.3.html). |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
190 /// |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
191 /// # Errors |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
192 /// |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
193 /// Returns an error if the underlying PAM function call fails. |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
194 pub fn get_authtok(&self, prompt: Option<&str>) -> PamResult<String> { |
| 51 | 195 let prompt = option_cstr(prompt)?; |
| 196 let output: *mut c_char = std::ptr::null_mut(); | |
| 197 let res = unsafe { | |
| 198 pam_get_authtok( | |
| 199 self, | |
| 200 ItemType::AuthTok, | |
| 201 &output, | |
| 202 prompt_ptr(prompt.as_ref()), | |
| 203 ) | |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
204 }; |
| 51 | 205 to_result(res)?; |
| 206 copy_pam_string(output) | |
| 207 } | |
| 208 } | |
| 209 | |
| 210 /// Safely converts a `&str` option to a `CString` option. | |
| 211 fn option_cstr(prompt: Option<&str>) -> PamResult<Option<CString>> { | |
| 212 prompt | |
| 213 .map(CString::new) | |
| 214 .transpose() | |
| 215 .map_err(|_| PamResultCode::PAM_CONV_ERR) | |
| 216 } | |
| 217 | |
| 218 /// The pointer to the prompt CString, or null if absent. | |
| 219 fn prompt_ptr(prompt: Option<&CString>) -> *const c_char { | |
| 220 match prompt { | |
| 221 Some(c_str) => c_str.as_ptr(), | |
| 222 None => std::ptr::null(), | |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
223 } |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
224 } |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
225 |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
226 /// Creates an owned copy of a string that is returned from a |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
227 /// <code>pam_get_<var>whatever</var></code> function. |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
228 fn copy_pam_string(result_ptr: *const c_char) -> PamResult<String> { |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
229 // We really shouldn't get a null pointer back here, but if we do, return nothing. |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
230 if result_ptr.is_null() { |
| 51 | 231 return Ok(String::new()); |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
232 } |
| 51 | 233 let bytes = unsafe { CStr::from_ptr(result_ptr) }; |
| 234 Ok(bytes | |
| 235 .to_str() | |
| 236 .map_err(|_| PamResultCode::PAM_CONV_ERR)? | |
| 237 .into()) | |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
238 } |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
239 |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
240 /// Convenience to transform a `PamResultCode` into a unit `PamResult`. |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
241 fn to_result(result: PamResultCode) -> PamResult<()> { |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
242 match result { |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
243 PamResultCode::PAM_SUCCESS => Ok(()), |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
244 otherwise => Err(otherwise), |
|
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
245 } |
|
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
246 } |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
247 |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
248 /// Provides functions that are invoked by the entrypoints generated by the |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
249 /// [`pam_hooks!` macro](../macro.pam_hooks.html). |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
250 /// |
|
44
50371046c61a
Add support for pam_get_authtok and minor cleanups.
Paul Fisher <paul@pfish.zone>
parents:
34
diff
changeset
|
251 /// All hooks are ignored by PAM dispatch by default given the default return value of `PAM_IGNORE`. |
|
45
ce47901aab7a
Rename to “nonstick”, move to root, update docs and license.
Paul Fisher <paul@pfish.zone>
parents:
44
diff
changeset
|
252 /// Override any functions that you want to handle with your module. See [PAM’s root manual page]( |
|
ce47901aab7a
Rename to “nonstick”, move to root, update docs and license.
Paul Fisher <paul@pfish.zone>
parents:
44
diff
changeset
|
253 /// https://www.man7.org/linux/man-pages/man3/pam.3.html). |
|
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
254 #[allow(unused_variables)] |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
255 pub trait PamHooks { |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
256 /// This function performs the task of establishing whether the user is permitted to gain access at |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
257 /// this time. It should be understood that the user has previously been validated by an |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
258 /// authentication module. This function checks for other things. Such things might be: the time of |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
259 /// day or the date, the terminal line, remote hostname, etc. This function may also determine |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
260 /// things like the expiration on passwords, and respond that the user change it before continuing. |
| 34 | 261 fn acct_mgmt(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { |
| 262 PamResultCode::PAM_IGNORE | |
| 263 } | |
|
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
264 |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
265 /// This function performs the task of authenticating the user. |
| 34 | 266 fn sm_authenticate(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { |
| 267 PamResultCode::PAM_IGNORE | |
| 268 } | |
|
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
269 |
| 34 | 270 /// This function is used to (re-)set the authentication token of the user. |
| 271 /// | |
| 272 /// The PAM library calls this function twice in succession. The first time with | |
| 273 /// `PAM_PRELIM_CHECK` and then, if the module does not return `PAM_TRY_AGAIN`, subsequently with | |
| 274 /// `PAM_UPDATE_AUTHTOK`. It is only on the second call that the authorization token is | |
| 275 /// (possibly) changed. | |
| 276 fn sm_chauthtok(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { | |
| 277 PamResultCode::PAM_IGNORE | |
| 278 } | |
|
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
279 |
| 34 | 280 /// This function is called to terminate a session. |
| 281 fn sm_close_session(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { | |
| 282 PamResultCode::PAM_IGNORE | |
| 283 } | |
|
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
284 |
| 34 | 285 /// This function is called to commence a session. |
| 286 fn sm_open_session(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { | |
| 287 PamResultCode::PAM_IGNORE | |
| 288 } | |
|
22
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
289 |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
290 /// This function performs the task of altering the credentials of the user with respect to the |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
291 /// corresponding authorization scheme. Generally, an authentication module may have access to more |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
292 /// information about a user than their authentication token. This function is used to make such |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
293 /// information available to the application. It should only be called after the user has been |
|
4263c1d83d5b
Refactor PamHooks into modules mod
Anthony Nowell <anthony@algorithmia.com>
parents:
19
diff
changeset
|
294 /// authenticated but before a session has been established. |
| 34 | 295 fn sm_setcred(pamh: &mut PamHandle, args: Vec<&CStr>, flags: PamFlag) -> PamResultCode { |
| 296 PamResultCode::PAM_IGNORE | |
| 297 } | |
| 298 } |
