Annotation of embedaddon/sudo/plugins/sudoers/auth/bsdauth.c, revision 1.1.1.2
1.1 misho 1: /*
2: * Copyright (c) 2000-2005, 2007-2008, 2010-2011
3: * Todd C. Miller <Todd.Miller@courtesan.com>
4: *
5: * Permission to use, copy, modify, and distribute this software for any
6: * purpose with or without fee is hereby granted, provided that the above
7: * copyright notice and this permission notice appear in all copies.
8: *
9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: *
17: * Sponsored in part by the Defense Advanced Research Projects
18: * Agency (DARPA) and Air Force Research Laboratory, Air Force
19: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
20: */
21:
22: #include <config.h>
23:
24: #include <sys/types.h>
25: #include <sys/param.h>
26: #include <stdio.h>
27: #ifdef STDC_HEADERS
28: # include <stdlib.h>
29: # include <stddef.h>
30: #else
31: # ifdef HAVE_STDLIB_H
32: # include <stdlib.h>
33: # endif
34: #endif /* STDC_HEADERS */
35: #ifdef HAVE_STRING_H
36: # include <string.h>
37: #endif /* HAVE_STRING_H */
38: #ifdef HAVE_STRINGS_H
39: # include <strings.h>
40: #endif /* HAVE_STRING_H */
41: #ifdef HAVE_UNISTD_H
42: # include <unistd.h>
43: #endif /* HAVE_UNISTD_H */
44: #include <ctype.h>
45: #include <pwd.h>
46: #include <signal.h>
47:
48: #include <login_cap.h>
49: #include <bsd_auth.h>
50:
51: #include "sudoers.h"
52: #include "sudo_auth.h"
53:
1.1.1.2 ! misho 54: # ifndef LOGIN_DEFROOTCLASS
! 55: # define LOGIN_DEFROOTCLASS "daemon"
! 56: # endif
! 57:
! 58: extern char *login_style; /* from sudoers.c */
! 59:
! 60: struct bsdauth_state {
! 61: auth_session_t *as;
! 62: login_cap_t *lc;
! 63: };
1.1 misho 64:
65: int
66: bsdauth_init(struct passwd *pw, sudo_auth *auth)
67: {
1.1.1.2 ! misho 68: static struct bsdauth_state state;
! 69: debug_decl(bsdauth_init, SUDO_DEBUG_AUTH)
1.1 misho 70:
1.1.1.2 ! misho 71: /* Get login class based on auth user, which may not be invoking user. */
! 72: if (pw->pw_class && *pw->pw_class)
! 73: state.lc = login_getclass(pw->pw_class);
! 74: else
! 75: state.lc = login_getclass(pw->pw_uid ? LOGIN_DEFCLASS : LOGIN_DEFROOTCLASS);
! 76: if (state.lc == NULL) {
! 77: log_error(USE_ERRNO|NO_MAIL,
! 78: _("unable to get login class for user %s"), pw->pw_name);
! 79: debug_return_int(AUTH_FATAL);
! 80: }
! 81:
! 82: if ((state.as = auth_open()) == NULL) {
! 83: log_error(USE_ERRNO|NO_MAIL,
1.1 misho 84: _("unable to begin bsd authentication"));
1.1.1.2 ! misho 85: login_close(state.lc);
! 86: debug_return_int(AUTH_FATAL);
1.1 misho 87: }
88:
89: /* XXX - maybe sanity check the auth style earlier? */
1.1.1.2 ! misho 90: login_style = login_getstyle(state.lc, login_style, "auth-sudo");
1.1 misho 91: if (login_style == NULL) {
1.1.1.2 ! misho 92: log_error(NO_MAIL, _("invalid authentication type"));
! 93: auth_close(state.as);
! 94: login_close(state.lc);
! 95: debug_return_int(AUTH_FATAL);
1.1 misho 96: }
97:
1.1.1.2 ! misho 98: if (auth_setitem(state.as, AUTHV_STYLE, login_style) < 0 ||
! 99: auth_setitem(state.as, AUTHV_NAME, pw->pw_name) < 0 ||
! 100: auth_setitem(state.as, AUTHV_CLASS, login_class) < 0) {
! 101: log_error(NO_MAIL, _("unable to setup authentication"));
! 102: auth_close(state.as);
! 103: login_close(state.lc);
! 104: debug_return_int(AUTH_FATAL);
1.1 misho 105: }
106:
1.1.1.2 ! misho 107: auth->data = (void *) &state;
! 108: debug_return_int(AUTH_SUCCESS);
1.1 misho 109: }
110:
111: int
112: bsdauth_verify(struct passwd *pw, char *prompt, sudo_auth *auth)
113: {
114: char *pass;
115: char *s;
116: size_t len;
117: int authok = 0;
118: sigaction_t sa, osa;
1.1.1.2 ! misho 119: auth_session_t *as = ((struct bsdauth_state *) auth->data)->as;
! 120: debug_decl(bsdauth_verify, SUDO_DEBUG_AUTH)
1.1 misho 121:
122: /* save old signal handler */
123: sigemptyset(&sa.sa_mask);
124: sa.sa_flags = SA_RESTART;
125: sa.sa_handler = SIG_DFL;
126: (void) sigaction(SIGCHLD, &sa, &osa);
127:
128: /*
129: * If there is a challenge then print that instead of the normal
130: * prompt. If the user just hits return we prompt again with echo
131: * turned on, which is useful for challenge/response things like
132: * S/Key.
133: */
134: if ((s = auth_challenge(as)) == NULL) {
135: pass = auth_getpass(prompt, def_passwd_timeout * 60, SUDO_CONV_PROMPT_ECHO_OFF);
136: } else {
137: pass = auth_getpass(prompt, def_passwd_timeout * 60, SUDO_CONV_PROMPT_ECHO_OFF);
138: if (pass && *pass == '\0') {
139: if ((prompt = strrchr(s, '\n')))
140: prompt++;
141: else
142: prompt = s;
143:
144: /*
145: * Append '[echo on]' to the last line of the challenge and
146: * reprompt with echo turned on.
147: */
148: len = strlen(prompt) - 1;
149: while (isspace(prompt[len]) || prompt[len] == ':')
150: prompt[len--] = '\0';
151: easprintf(&s, "%s [echo on]: ", prompt);
152: pass = auth_getpass(prompt, def_passwd_timeout * 60,
153: SUDO_CONV_PROMPT_ECHO_ON);
154: free(s);
155: }
156: }
157:
158: if (pass) {
159: authok = auth_userresponse(as, pass, 1);
160: zero_bytes(pass, strlen(pass));
161: }
162:
163: /* restore old signal handler */
164: (void) sigaction(SIGCHLD, &osa, NULL);
165:
166: if (authok)
1.1.1.2 ! misho 167: debug_return_int(AUTH_SUCCESS);
1.1 misho 168:
169: if (!pass)
1.1.1.2 ! misho 170: debug_return_int(AUTH_INTR);
1.1 misho 171:
172: if ((s = auth_getvalue(as, "errormsg")) != NULL)
1.1.1.2 ! misho 173: log_error(NO_MAIL, "%s", s);
! 174: debug_return_int(AUTH_FAILURE);
1.1 misho 175: }
176:
177: int
178: bsdauth_cleanup(struct passwd *pw, sudo_auth *auth)
179: {
1.1.1.2 ! misho 180: struct bsdauth_state *state = auth->data;
! 181: debug_decl(bsdauth_cleanup, SUDO_DEBUG_AUTH)
1.1 misho 182:
1.1.1.2 ! misho 183: if (state != NULL) {
! 184: auth_close(state->as);
! 185: login_close(state->lc);
! 186: }
1.1 misho 187:
1.1.1.2 ! misho 188: debug_return_int(AUTH_SUCCESS);
1.1 misho 189: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to bsdauth.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers / auth