|
1
|
1 //! Functions for use in pam modules.
|
|
|
2
|
|
|
3 use libc::{c_char};
|
|
|
4 use std::{mem, ptr};
|
|
|
5 use std::ffi::{CStr, CString};
|
|
|
6
|
|
|
7 use constants;
|
|
|
8 use constants::*;
|
|
|
9
|
|
|
10 /// Opaque type, used as a pointer when making pam API calls.
|
|
|
11 ///
|
|
|
12 /// A module is invoked via an external function such as `pam_sm_authenticate`.
|
|
|
13 /// Such a call provides a pam handle pointer. The same pointer should be given
|
|
|
14 /// as an argument when making API calls.
|
|
|
15 #[allow(missing_copy_implementations)]
|
|
|
16 pub enum PamHandleT {}
|
|
|
17
|
|
|
18 #[allow(missing_copy_implementations)]
|
|
|
19 enum PamItemT {}
|
|
|
20
|
|
|
21 #[allow(missing_copy_implementations)]
|
|
|
22 pub enum PamDataT {}
|
|
|
23
|
|
|
24 #[link(name = "pam")]
|
|
|
25 extern {
|
|
|
26 fn pam_get_data(pamh: *const PamHandleT,
|
|
|
27 module_data_name: *const c_char,
|
|
|
28 data: & *mut PamDataT,
|
|
|
29 ) -> PamResultCode;
|
|
|
30
|
|
|
31 fn pam_set_data(pamh: *const PamHandleT,
|
|
|
32 module_data_name: *const c_char,
|
|
|
33 data: Box<PamDataT>,
|
|
|
34 cleanup: extern fn (pamh: *const PamHandleT,
|
|
|
35 data: Box<PamDataT>,
|
|
|
36 error_status: PamResultCode
|
|
|
37 ),
|
|
|
38 ) -> PamResultCode;
|
|
|
39
|
|
|
40 fn pam_get_item(pamh: *const PamHandleT,
|
|
|
41 item_type: PamItemType,
|
|
|
42 item: & *mut PamItemT,
|
|
|
43 ) -> PamResultCode;
|
|
|
44
|
|
|
45 fn pam_set_item(pamh: *mut PamHandleT,
|
|
|
46 item_type: PamItemType,
|
|
|
47 item: &PamItemT,
|
|
|
48 ) -> PamResultCode;
|
|
|
49
|
|
|
50 fn pam_get_user(pamh: *const PamHandleT,
|
|
|
51 user: & *mut c_char,
|
|
|
52 prompt: *const c_char,
|
|
|
53 ) -> PamResultCode;
|
|
|
54 }
|
|
|
55
|
|
|
56 pub type PamResult<T> = Result<T, PamResultCode>;
|
|
|
57
|
|
|
58 /// Type-level mapping for safely retrieving values with `get_item`.
|
|
|
59 ///
|
|
|
60 /// See `pam_get_item` in
|
|
|
61 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
|
|
|
62 pub trait PamItem {
|
|
|
63 /// Maps a Rust type to a pam constant.
|
|
|
64 ///
|
|
|
65 /// For example, the type PamConv maps to the constant PAM_CONV. The pam
|
|
|
66 /// API contract specifies that when the API function `pam_get_item` is
|
|
|
67 /// called with the constant PAM_CONV, it will return a value of type
|
|
|
68 /// `PamConv`.
|
|
|
69 ///
|
|
|
70 /// The argument will always be `None`. Its purpose is to provide a type
|
|
|
71 /// label - the value is not important.
|
|
|
72 fn item_type(_: Option<Self>) -> PamItemType;
|
|
|
73 }
|
|
|
74
|
|
|
75 /// Gets some value, identified by `key`, that has been set by the module
|
|
|
76 /// previously.
|
|
|
77 ///
|
|
|
78 /// See `pam_get_data` in
|
|
|
79 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
|
|
|
80 pub unsafe fn get_data<'a, T>(pamh: &'a PamHandleT, key: &str) -> PamResult<&'a T> {
|
|
|
81 let c_key = CString::new(key).unwrap().as_ptr();
|
|
|
82 let mut ptr: *mut PamDataT = ptr::null_mut();
|
|
|
83 let res = pam_get_data(pamh, c_key, &mut ptr);
|
|
|
84 if constants::PAM_SUCCESS == res && !ptr.is_null() {
|
|
|
85 let raw_data: &PamDataT = ptr.as_ref().unwrap();
|
|
|
86 let data: &T = mem::transmute(raw_data);
|
|
|
87 Ok(data)
|
|
|
88 }
|
|
|
89 else {
|
|
|
90 Err(res)
|
|
|
91 }
|
|
|
92 }
|
|
|
93
|
|
|
94 /// Stores a value that can be retrieved later with `get_data`. The value lives
|
|
|
95 /// as long as the current pam cycle.
|
|
|
96 ///
|
|
|
97 /// See `pam_set_data` in
|
|
|
98 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
|
|
|
99 pub fn set_data<T>(pamh: &PamHandleT, key: &str, data: Box<T>) -> PamResult<()> {
|
|
|
100 let c_key = CString::new(key).unwrap().as_ptr();
|
|
|
101 let res = unsafe {
|
|
|
102 let c_data: Box<PamDataT> = mem::transmute(data);
|
|
|
103 pam_set_data(pamh, c_key, c_data, cleanup::<T>)
|
|
|
104 };
|
|
|
105 if constants::PAM_SUCCESS == res { Ok(()) } else { Err(res) }
|
|
|
106 }
|
|
|
107
|
|
|
108 #[no_mangle]
|
|
|
109 pub extern fn cleanup<T>(_: *const PamHandleT, c_data: Box<PamDataT>, _: PamResultCode) {
|
|
|
110 unsafe {
|
|
|
111 let data: Box<T> = mem::transmute(c_data);
|
|
|
112 mem::drop(data);
|
|
|
113 }
|
|
|
114 }
|
|
|
115
|
|
|
116 /// Retrieves a value that has been set, possibly by the pam client. This is
|
|
|
117 /// particularly useful for getting a `PamConv` reference.
|
|
|
118 ///
|
|
|
119 /// See `pam_get_item` in
|
|
|
120 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
|
|
|
121 pub fn get_item<'a, T: PamItem>(pamh: &'a PamHandleT) -> PamResult<&'a T> {
|
|
|
122 let ptr: *mut PamItemT = ptr::null_mut();
|
|
|
123 let (res, item) = unsafe {
|
|
|
124 let r = pam_get_item(pamh, PamItem::item_type(None::<T>), &ptr);
|
|
|
125 let raw_item: &PamItemT = ptr.as_ref().unwrap();
|
|
|
126 let t: &T = mem::transmute(raw_item);
|
|
|
127 (r, t)
|
|
|
128 };
|
|
|
129 if constants::PAM_SUCCESS == res { Ok(item) } else { Err(res) }
|
|
|
130 }
|
|
|
131
|
|
|
132 /// Retrieves the name of the user who is authenticating or logging in.
|
|
|
133 ///
|
|
|
134 /// This is really a specialization of `get_item`.
|
|
|
135 ///
|
|
|
136 /// See `pam_get_user` in
|
|
|
137 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
|
|
|
138 pub fn get_user<'a>(pamh: &'a PamHandleT, prompt: Option<&str>) -> PamResult<String> {
|
|
|
139 let ptr: *mut c_char = ptr::null_mut();
|
|
|
140 let c_prompt = match prompt {
|
|
|
141 Some(p) => CString::new(p).unwrap().as_ptr(),
|
|
|
142 None => ptr::null(),
|
|
|
143 };
|
|
|
144 let res = unsafe { pam_get_user(pamh, &ptr, c_prompt) };
|
|
|
145 if constants::PAM_SUCCESS == res && !ptr.is_null() {
|
|
|
146 let const_ptr = ptr as *const c_char;
|
|
|
147 let bytes = unsafe { CStr::from_ptr(const_ptr).to_bytes() };
|
|
|
148 String::from_utf8(bytes.to_vec())
|
|
|
149 .map_err(|_| PAM_CONV_ERR)
|
|
|
150 }
|
|
|
151 else {
|
|
|
152 Err(res)
|
|
|
153 }
|
|
|
154 }
|
