Return to pam.c CVS log

Up to [local] / ircnowd / src / ngircd

Annotation of ircnowd/src/ngircd/pam.c, Revision 1.1.1.1

1.1       tomglok     1: /*
                      2:  * ngIRCd -- The Next Generation IRC Daemon
                      3:  * Copyright (c)2001-2014 Alexander Barton (alex@barton.de) and Contributors.
                      4:  *
                      5:  * This program is free software; you can redistribute it and/or modify
                      6:  * it under the terms of the GNU General Public License as published by
                      7:  * the Free Software Foundation; either version 2 of the License, or
                      8:  * (at your option) any later version.
                      9:  * Please read the file COPYING, README and AUTHORS for more information.
                     10:  */
                     11:
                     12: #include "portab.h"
                     13:
                     14: #ifdef PAM
                     15:
                     16: /**
                     17:  * @file
                     18:  * PAM User Authentication
                     19:  */
                     20:
                     21: #include <assert.h>
                     22: #include <stdlib.h>
                     23: #include <string.h>
                     24: #ifdef HAVE_SECURITY_PAM_APPL_H
                     25: # include <security/pam_appl.h>
                     26: #endif
                     27: #ifdef HAVE_PAM_PAM_APPL_H
                     28: # include <pam/pam_appl.h>
                     29: #endif
                     30:
                     31: #include "defines.h"
                     32: #include "log.h"
                     33: #include "conn.h"
                     34: #include "client.h"
                     35: #include "conf.h"
                     36:
                     37: #include "pam.h"
                     38:
                     39: static char *password;
                     40:
                     41: /**
                     42:  * PAM "conversation function".
                     43:  * This is a callback function used by the PAM library to get the password.
                     44:  * Please see the PAM documentation for details :-)
                     45:  */
                     46: static int
                     47: password_conversation(int num_msg, const struct pam_message **msg,
                     48:                      struct pam_response **resp, void *appdata_ptr) {
                     49:        LogDebug("PAM: conv(%d, %d, '%s', '%s')",
                     50:                 num_msg, msg[0]->msg_style, msg[0]->msg, appdata_ptr);
                     51:
                     52:        /* Can we deal with this request? */
                     53:        if (num_msg != 1 || msg[0]->msg_style != PAM_PROMPT_ECHO_OFF) {
                     54:                Log(LOG_ERR, "PAM: Unexpected PAM conversation '%d:%s'!",
                     55:                    msg[0]->msg_style, msg[0]->msg);
                     56:                return PAM_CONV_ERR;
                     57:        }
                     58:
                     59:        if (!appdata_ptr) {
                     60:                /* Sometimes appdata_ptr gets lost!? */
                     61:                appdata_ptr = password;
                     62:        }
                     63:
                     64:        /* Duplicate password ("application data") for the PAM library */
                     65:        *resp = calloc(num_msg, sizeof(struct pam_response));
                     66:        if (!*resp) {
                     67:                Log(LOG_ERR, "PAM: Out of memory!");
                     68:                return PAM_CONV_ERR;
                     69:        }
                     70:
                     71:        (*resp)[0].resp = strdup((char *)appdata_ptr);
                     72:        (*resp)[0].resp_retcode = 0;
                     73:
                     74:        return ((*resp)[0].resp ? PAM_SUCCESS : PAM_CONV_ERR);
                     75: }
                     76:
                     77: /**
                     78:  * PAM "conversation" structure.
                     79:  */
                     80: static struct pam_conv conv = {
                     81:        &password_conversation,
                     82:        NULL
                     83: };
                     84:
                     85: /**
                     86:  * Authenticate a connecting client using PAM.
                     87:  * @param Client The client to authenticate.
                     88:  * @return true when authentication succeeded, false otherwise.
                     89:  */
                     90: GLOBAL bool
                     91: PAM_Authenticate(CLIENT *Client) {
                     92:        pam_handle_t *pam;
                     93:        int retval = PAM_SUCCESS;
                     94:
                     95:        LogDebug("PAM: Authenticate \"%s\" (%s) ...",
                     96:                 Client_OrigUser(Client), Client_Mask(Client));
                     97:
                     98:        /* Set supplied client password */
                     99:        if (password)
                    100:                free(password);
                    101:        password = strdup(Conn_Password(Client_Conn(Client)));
                    102:        conv.appdata_ptr = Conn_Password(Client_Conn(Client));
                    103:
                    104:        /* Initialize PAM */
                    105:        retval = pam_start(Conf_PAMServiceName, Client_OrigUser(Client), &conv, &pam);
                    106:        if (retval != PAM_SUCCESS) {
                    107:                Log(LOG_ERR, "PAM: Failed to create authenticator! (%d)", retval);
                    108:                return false;
                    109:        }
                    110:
                    111:        pam_set_item(pam, PAM_RUSER, Client_User(Client));
                    112:        pam_set_item(pam, PAM_RHOST, Client_Hostname(Client));
                    113: #if defined(HAVE_PAM_FAIL_DELAY) && !defined(NO_PAM_FAIL_DELAY)
                    114:        pam_fail_delay(pam, 0);
                    115: #endif
                    116:
                    117:        /* PAM authentication ... */
                    118:        retval = pam_authenticate(pam, 0);
                    119:
                    120:        /* Success? */
                    121:        if (retval == PAM_SUCCESS)
                    122:                Log(LOG_INFO, "PAM: Authenticated \"%s\" (%s).",
                    123:                    Client_OrigUser(Client), Client_Mask(Client));
                    124:        else
                    125:                Log(LOG_ERR, "PAM: Error on \"%s\" (%s): %s",
                    126:                    Client_OrigUser(Client), Client_Mask(Client),
                    127:                    pam_strerror(pam, retval));
                    128:
                    129:        /* Free PAM structures */
                    130:        if (pam_end(pam, retval) != PAM_SUCCESS)
                    131:                Log(LOG_ERR, "PAM: Failed to release authenticator!");
                    132:
                    133:        return (retval == PAM_SUCCESS);
                    134: }
                    135:
                    136: #endif /* PAM */
                    137:
                    138: /* -eof- */