# HG changeset patch # User Jesse Hallett # Date 1425601510 28800 # Node ID b195a14058bb85325a448e2fa4a2d53fb78650a6 # Parent 8ed8b2cfd90967557a52c8e2db640b12c42ce226 initial commit diff -r 8ed8b2cfd909 -r b195a14058bb .gitignore --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/.gitignore Thu Mar 05 16:25:10 2015 -0800 @@ -0,0 +1,15 @@ +# Compiled files +*.o +*.so +*.rlib +*.dll + +# Executables +*.exe + +# Generated by Cargo +/target/ +Cargo.lock + +# Override top-level .gitignore in Misc repo +!src/tozny diff -r 8ed8b2cfd909 -r b195a14058bb Cargo.toml --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/Cargo.toml Thu Mar 05 16:25:10 2015 -0800 @@ -0,0 +1,9 @@ +[package] + +name = "pam" +version = "0.0.1" +authors = [ "Jesse Hallett PamResultCode, + appdata_ptr: *const AppDataPtr, +} + +impl PamConv { + /// Sends a message to the pam client. + /// + /// This will typically result in the user seeing a message or a prompt. + /// There are several message styles available: + /// + /// - PAM_PROMPT_ECHO_OFF + /// - PAM_PROMPT_ECHO_ON + /// - PAM_ERROR_MSG + /// - PAM_TEXT_INFO + /// - PAM_RADIO_TYPE + /// - PAM_BINARY_PROMPT + /// + /// Note that the user experience will depend on how the client implements + /// these message styles - and not all applications implement all message + /// styles. + pub fn send(&self, style: PamMessageStyle, msg: &str) -> PamResult> { + let resp_ptr: *mut PamResponse = ptr::null_mut(); + let msg = PamMessage { + msg_style: style, + msg: CString::new(msg).unwrap().as_ptr(), + }; + + let ret = (self.conv)(1, &&msg, &resp_ptr, self.appdata_ptr); + + if constants::PAM_SUCCESS == ret { + let s = unsafe { resp_ptr.as_ref() } + .and_then(|r| { + if r.resp.is_null() { + None + } + else { + let bytes = unsafe { CStr::from_ptr(r.resp).to_bytes() }; + String::from_utf8(bytes.to_vec()).ok() + } + }); + Ok(s) + } else { + Err(ret) + } + } +} + +impl PamItem for PamConv { + fn item_type(_: Option) -> PamItemType { PAM_CONV } +} diff -r 8ed8b2cfd909 -r b195a14058bb src/lib.rs --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/src/lib.rs Thu Mar 05 16:25:10 2015 -0800 @@ -0,0 +1,35 @@ +#![feature(core)] +#![feature(libc)] +#![feature(std_misc)] + +//! Interface to the pluggable authentication module framework (PAM). +//! +//! The goal of this library is to provide a type-safe API that can be used to +//! interact with PAM. The library is incomplete - currently it supports +//! a subset of functions for use in a pam authentication module. A pam module +//! is a shared library that is invoked to authenticate a user, or to perform +//! other functions. +//! +//! For general information on writing pam modules, see +//! [The Linux-PAM Module Writers' Guide][module-guide] +//! +//! [module-guide]: http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_MWG.html +//! +//! A typical authentication module will define an external function called +//! `pam_sm_authenticate()`, which will use functions in this library to +//! interrogate the program that requested authentication for more information, +//! and to render a result. For a working example that uses this library, see +//! [tozny-pam][]. +//! +//! [tozny-pam]: https://github.com/tozny/tozny-pam +//! +//! Note that constants that are normally read from pam header files are +//! hard-coded in the `constants` module. The values there are taken from +//! a Linux system. That means that it might take some work to get this library +//! to work on other platforms. + +extern crate libc; + +pub mod conv; +pub mod constants; +pub mod module; diff -r 8ed8b2cfd909 -r b195a14058bb src/module.rs --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/src/module.rs Thu Mar 05 16:25:10 2015 -0800 @@ -0,0 +1,154 @@ +//! Functions for use in pam modules. + +use libc::{c_char}; +use std::{mem, ptr}; +use std::ffi::{CStr, CString}; + +use constants; +use constants::*; + +/// Opaque type, used as a pointer when making pam API calls. +/// +/// A module is invoked via an external function such as `pam_sm_authenticate`. +/// Such a call provides a pam handle pointer. The same pointer should be given +/// as an argument when making API calls. +#[allow(missing_copy_implementations)] +pub enum PamHandleT {} + +#[allow(missing_copy_implementations)] +enum PamItemT {} + +#[allow(missing_copy_implementations)] +pub enum PamDataT {} + +#[link(name = "pam")] +extern { + fn pam_get_data(pamh: *const PamHandleT, + module_data_name: *const c_char, + data: & *mut PamDataT, + ) -> PamResultCode; + + fn pam_set_data(pamh: *const PamHandleT, + module_data_name: *const c_char, + data: Box, + cleanup: extern fn (pamh: *const PamHandleT, + data: Box, + error_status: PamResultCode + ), + ) -> PamResultCode; + + fn pam_get_item(pamh: *const PamHandleT, + item_type: PamItemType, + item: & *mut PamItemT, + ) -> PamResultCode; + + fn pam_set_item(pamh: *mut PamHandleT, + item_type: PamItemType, + item: &PamItemT, + ) -> PamResultCode; + + fn pam_get_user(pamh: *const PamHandleT, + user: & *mut c_char, + prompt: *const c_char, + ) -> PamResultCode; +} + +pub type PamResult = Result; + +/// Type-level mapping for safely retrieving values with `get_item`. +/// +/// See `pam_get_item` in +/// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html +pub trait PamItem { + /// Maps a Rust type to a pam constant. + /// + /// For example, the type PamConv maps to the constant PAM_CONV. The pam + /// API contract specifies that when the API function `pam_get_item` is + /// called with the constant PAM_CONV, it will return a value of type + /// `PamConv`. + /// + /// The argument will always be `None`. Its purpose is to provide a type + /// label - the value is not important. + fn item_type(_: Option) -> PamItemType; +} + +/// Gets some value, identified by `key`, that has been set by the module +/// previously. +/// +/// See `pam_get_data` in +/// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html +pub unsafe fn get_data<'a, T>(pamh: &'a PamHandleT, key: &str) -> PamResult<&'a T> { + let c_key = CString::new(key).unwrap().as_ptr(); + let mut ptr: *mut PamDataT = ptr::null_mut(); + let res = pam_get_data(pamh, c_key, &mut ptr); + if constants::PAM_SUCCESS == res && !ptr.is_null() { + let raw_data: &PamDataT = ptr.as_ref().unwrap(); + let data: &T = mem::transmute(raw_data); + Ok(data) + } + else { + Err(res) + } +} + +/// Stores a value that can be retrieved later with `get_data`. The value lives +/// as long as the current pam cycle. +/// +/// See `pam_set_data` in +/// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html +pub fn set_data(pamh: &PamHandleT, key: &str, data: Box) -> PamResult<()> { + let c_key = CString::new(key).unwrap().as_ptr(); + let res = unsafe { + let c_data: Box = mem::transmute(data); + pam_set_data(pamh, c_key, c_data, cleanup::) + }; + if constants::PAM_SUCCESS == res { Ok(()) } else { Err(res) } +} + +#[no_mangle] +pub extern fn cleanup(_: *const PamHandleT, c_data: Box, _: PamResultCode) { + unsafe { + let data: Box = mem::transmute(c_data); + mem::drop(data); + } +} + +/// Retrieves a value that has been set, possibly by the pam client. This is +/// particularly useful for getting a `PamConv` reference. +/// +/// See `pam_get_item` in +/// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html +pub fn get_item<'a, T: PamItem>(pamh: &'a PamHandleT) -> PamResult<&'a T> { + let ptr: *mut PamItemT = ptr::null_mut(); + let (res, item) = unsafe { + let r = pam_get_item(pamh, PamItem::item_type(None::), &ptr); + let raw_item: &PamItemT = ptr.as_ref().unwrap(); + let t: &T = mem::transmute(raw_item); + (r, t) + }; + if constants::PAM_SUCCESS == res { Ok(item) } else { Err(res) } +} + +/// Retrieves the name of the user who is authenticating or logging in. +/// +/// This is really a specialization of `get_item`. +/// +/// See `pam_get_user` in +/// http://www.linux-pam.org/Linux-PAM-html/mwg-expected-by-module-item.html +pub fn get_user<'a>(pamh: &'a PamHandleT, prompt: Option<&str>) -> PamResult { + let ptr: *mut c_char = ptr::null_mut(); + let c_prompt = match prompt { + Some(p) => CString::new(p).unwrap().as_ptr(), + None => ptr::null(), + }; + let res = unsafe { pam_get_user(pamh, &ptr, c_prompt) }; + if constants::PAM_SUCCESS == res && !ptr.is_null() { + let const_ptr = ptr as *const c_char; + let bytes = unsafe { CStr::from_ptr(const_ptr).to_bytes() }; + String::from_utf8(bytes.to_vec()) + .map_err(|_| PAM_CONV_ERR) + } + else { + Err(res) + } +}