Mercurial > crates > nonstick

comparison pam/src/module.rs @ 15:27730595f1ea

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Adding pam-http module
author Anthony Nowell <anthony@algorithmia.com>
date Sun, 24 Sep 2017 00:22:29 -0600
parents
children d654aa0655e5
comparison
equal deleted inserted replaced
14:51b097c12d3c 15:27730595f1ea
1 //! Functions for use in pam modules.
2
3 use libc::c_char;
4 use std::{mem, ptr};
5 use std::ffi::{CStr, CString};
6
7 use constants::{PamResultCode, PamItemType};
8
9 /// Opaque type, used as a pointer when making pam API calls.
10 ///
11 /// A module is invoked via an external function such as `pam_sm_authenticate`.
12 /// Such a call provides a pam handle pointer. The same pointer should be given
13 /// as an argument when making API calls.
14 #[allow(missing_copy_implementations)]
15 pub enum PamHandleT {}
16
17 #[allow(missing_copy_implementations)]
18 enum PamItemT {}
19
20 #[allow(missing_copy_implementations)]
21 pub enum PamDataT {}
22
23 #[link(name = "pam")]
24 extern "C" {
25 fn pam_get_data(pamh: *const PamHandleT,
26 module_data_name: *const c_char,
27 data: &mut *const PamDataT)
28 -> PamResultCode;
29
30 fn pam_set_data(pamh: *const PamHandleT,
31 module_data_name: *const c_char,
32 data: Box<PamDataT>,
33 cleanup: extern "C" fn(pamh: *const PamHandleT,
34 data: Box<PamDataT>,
35 error_status: PamResultCode))
36 -> PamResultCode;
37
38 fn pam_get_item(pamh: *const PamHandleT,
39 item_type: PamItemType,
40 item: &mut *const PamItemT)
41 -> PamResultCode;
42
43 fn pam_set_item(pamh: *mut PamHandleT,
44 item_type: PamItemType,
45 item: &PamItemT)
46 -> PamResultCode;
47
48 fn pam_get_user(pamh: *const PamHandleT,
49 user: &*mut c_char,
50 prompt: *const c_char)
51 -> PamResultCode;
52 }
53
54 pub type PamResult<T> = Result<T, PamResultCode>;
55
56 /// Type-level mapping for safely retrieving values with `get_item`.
57 ///
58 /// See `pam_get_item` in
59 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
60 pub trait PamItem {
61 /// Maps a Rust type to a pam constant.
62 ///
63 /// For example, the type PamConv maps to the constant PAM_CONV. The pam
64 /// API contract specifies that when the API function `pam_get_item` is
65 /// called with the constant PAM_CONV, it will return a value of type
66 /// `PamConv`.
67 fn item_type() -> PamItemType;
68 }
69
70 /// Gets some value, identified by `key`, that has been set by the module
71 /// previously.
72 ///
73 /// See `pam_get_data` in
74 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
75 pub unsafe fn get_data<'a, T>(pamh: &'a PamHandleT, key: &str) -> PamResult<&'a T> {
76 let c_key = CString::new(key).unwrap().as_ptr();
77 let mut ptr: *const PamDataT = ptr::null();
78 let res = pam_get_data(pamh, c_key, &mut ptr);
79 if PamResultCode::PAM_SUCCESS == res && !ptr.is_null() {
80 let typed_ptr: *const T = mem::transmute(ptr);
81 let data: &T = &*typed_ptr;
82 Ok(data)
83 } else {
84 Err(res)
85 }
86 }
87
88 /// Stores a value that can be retrieved later with `get_data`. The value lives
89 /// as long as the current pam cycle.
90 ///
91 /// See `pam_set_data` in
92 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
93 pub fn set_data<T>(pamh: &PamHandleT, key: &str, data: Box<T>) -> PamResult<()> {
94 let c_key = CString::new(key).unwrap().as_ptr();
95 let res = unsafe {
96 let c_data: Box<PamDataT> = mem::transmute(data);
97 pam_set_data(pamh, c_key, c_data, cleanup::<T>)
98 };
99 if PamResultCode::PAM_SUCCESS == res {
100 Ok(())
101 } else {
102 Err(res)
103 }
104 }
105
106 #[no_mangle]
107 pub extern "C" fn cleanup<T>(_: *const PamHandleT, c_data: Box<PamDataT>, _: PamResultCode) {
108 unsafe {
109 let data: Box<T> = mem::transmute(c_data);
110 mem::drop(data);
111 }
112 }
113
114 /// Retrieves a value that has been set, possibly by the pam client. This is
115 /// particularly useful for getting a `PamConv` reference.
116 ///
117 /// See `pam_get_item` in
118 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
119 pub fn get_item<'a, T: PamItem>(pamh: &'a PamHandleT) -> PamResult<&'a T> {
120 let mut ptr: *const PamItemT = ptr::null();
121 let (res, item) = unsafe {
122 let r = pam_get_item(pamh, T::item_type(), &mut ptr);
123 let typed_ptr: *const T = mem::transmute(ptr);
124 let t: &T = &*typed_ptr;
125 (r, t)
126 };
127 if PamResultCode::PAM_SUCCESS == res {
128 Ok(item)
129 } else {
130 Err(res)
131 }
132 }
133
134 /// Sets a value in the pam context. The value can be retrieved using
135 /// `get_item`.
136 ///
137 /// Note that all items are strings, except `PAM_CONV` and `PAM_FAIL_DELAY`.
138 ///
139 /// See `pam_set_item` in
140 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
141 pub fn set_item_str<'a, T: PamItem>(pamh: &'a mut PamHandleT, item: &str) -> PamResult<()> {
142 let c_item = CString::new(item).unwrap().as_ptr();
143
144 let res = unsafe {
145 pam_set_item(pamh,
146 T::item_type(),
147
148 // unwrapping is okay here, as c_item will not be a NULL
149 // pointer
150 (c_item as *const PamItemT).as_ref().unwrap())
151 };
152 if PamResultCode::PAM_SUCCESS == res {
153 Ok(())
154 } else {
155 Err(res)
156 }
157 }
158
159 /// Retrieves the name of the user who is authenticating or logging in.
160 ///
161 /// This is really a specialization of `get_item`.
162 ///
163 /// See `pam_get_user` in
164 /// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html
165 pub fn get_user<'a>(pamh: &'a PamHandleT, prompt: Option<&str>) -> PamResult<String> {
166 let ptr: *mut c_char = ptr::null_mut();
167 let c_prompt = match prompt {
168 Some(p) => CString::new(p).unwrap().as_ptr(),
169 None => ptr::null(),
170 };
171 let res = unsafe { pam_get_user(pamh, &ptr, c_prompt) };
172 if PamResultCode::PAM_SUCCESS == res && !ptr.is_null() {
173 let const_ptr = ptr as *const c_char;
174 let bytes = unsafe { CStr::from_ptr(const_ptr).to_bytes() };
175 String::from_utf8(bytes.to_vec()).map_err(|_| PamResultCode::PAM_CONV_ERR)
176 } else {
177 Err(res)
178 }
179 }