Annotation of embedaddon/sudo/plugins/sudoers/auth/bsdauth.c, revision 1.1.1.3
1.1 misho 1: /*
1.1.1.3 ! misho 2: * Copyright (c) 2000-2005, 2007-2008, 2010-2013
1.1 misho 3: * Todd C. Miller <Todd.Miller@courtesan.com>
4: *
5: * Permission to use, copy, modify, and distribute this software for any
6: * purpose with or without fee is hereby granted, provided that the above
7: * copyright notice and this permission notice appear in all copies.
8: *
9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: *
17: * Sponsored in part by the Defense Advanced Research Projects
18: * Agency (DARPA) and Air Force Research Laboratory, Air Force
19: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
20: */
21:
22: #include <config.h>
23:
24: #include <sys/types.h>
25: #include <stdio.h>
26: #ifdef STDC_HEADERS
27: # include <stdlib.h>
28: # include <stddef.h>
29: #else
30: # ifdef HAVE_STDLIB_H
31: # include <stdlib.h>
32: # endif
33: #endif /* STDC_HEADERS */
34: #ifdef HAVE_STRING_H
35: # include <string.h>
36: #endif /* HAVE_STRING_H */
37: #ifdef HAVE_STRINGS_H
38: # include <strings.h>
39: #endif /* HAVE_STRING_H */
40: #ifdef HAVE_UNISTD_H
41: # include <unistd.h>
42: #endif /* HAVE_UNISTD_H */
43: #include <ctype.h>
44: #include <pwd.h>
45: #include <signal.h>
46:
47: #include <login_cap.h>
48: #include <bsd_auth.h>
49:
50: #include "sudoers.h"
51: #include "sudo_auth.h"
52:
1.1.1.2 misho 53: # ifndef LOGIN_DEFROOTCLASS
54: # define LOGIN_DEFROOTCLASS "daemon"
55: # endif
56:
57: extern char *login_style; /* from sudoers.c */
58:
59: struct bsdauth_state {
60: auth_session_t *as;
61: login_cap_t *lc;
62: };
1.1 misho 63:
64: int
65: bsdauth_init(struct passwd *pw, sudo_auth *auth)
66: {
1.1.1.2 misho 67: static struct bsdauth_state state;
68: debug_decl(bsdauth_init, SUDO_DEBUG_AUTH)
1.1 misho 69:
1.1.1.2 misho 70: /* Get login class based on auth user, which may not be invoking user. */
71: if (pw->pw_class && *pw->pw_class)
72: state.lc = login_getclass(pw->pw_class);
73: else
74: state.lc = login_getclass(pw->pw_uid ? LOGIN_DEFCLASS : LOGIN_DEFROOTCLASS);
75: if (state.lc == NULL) {
1.1.1.3 ! misho 76: log_warning(USE_ERRNO|NO_MAIL,
! 77: N_("unable to get login class for user %s"), pw->pw_name);
1.1.1.2 misho 78: debug_return_int(AUTH_FATAL);
79: }
80:
81: if ((state.as = auth_open()) == NULL) {
1.1.1.3 ! misho 82: log_warning(USE_ERRNO|NO_MAIL,
! 83: N_("unable to begin bsd authentication"));
1.1.1.2 misho 84: login_close(state.lc);
85: debug_return_int(AUTH_FATAL);
1.1 misho 86: }
87:
88: /* XXX - maybe sanity check the auth style earlier? */
1.1.1.2 misho 89: login_style = login_getstyle(state.lc, login_style, "auth-sudo");
1.1 misho 90: if (login_style == NULL) {
1.1.1.3 ! misho 91: log_warning(NO_MAIL, N_("invalid authentication type"));
1.1.1.2 misho 92: auth_close(state.as);
93: login_close(state.lc);
94: debug_return_int(AUTH_FATAL);
1.1 misho 95: }
96:
1.1.1.2 misho 97: if (auth_setitem(state.as, AUTHV_STYLE, login_style) < 0 ||
98: auth_setitem(state.as, AUTHV_NAME, pw->pw_name) < 0 ||
99: auth_setitem(state.as, AUTHV_CLASS, login_class) < 0) {
1.1.1.3 ! misho 100: log_warning(NO_MAIL, N_("unable to setup authentication"));
1.1.1.2 misho 101: auth_close(state.as);
102: login_close(state.lc);
103: debug_return_int(AUTH_FATAL);
1.1 misho 104: }
105:
1.1.1.2 misho 106: auth->data = (void *) &state;
107: debug_return_int(AUTH_SUCCESS);
1.1 misho 108: }
109:
110: int
111: bsdauth_verify(struct passwd *pw, char *prompt, sudo_auth *auth)
112: {
113: char *pass;
114: char *s;
115: size_t len;
116: int authok = 0;
117: sigaction_t sa, osa;
1.1.1.2 misho 118: auth_session_t *as = ((struct bsdauth_state *) auth->data)->as;
119: debug_decl(bsdauth_verify, SUDO_DEBUG_AUTH)
1.1 misho 120:
121: /* save old signal handler */
122: sigemptyset(&sa.sa_mask);
123: sa.sa_flags = SA_RESTART;
124: sa.sa_handler = SIG_DFL;
125: (void) sigaction(SIGCHLD, &sa, &osa);
126:
127: /*
128: * If there is a challenge then print that instead of the normal
129: * prompt. If the user just hits return we prompt again with echo
130: * turned on, which is useful for challenge/response things like
131: * S/Key.
132: */
133: if ((s = auth_challenge(as)) == NULL) {
134: pass = auth_getpass(prompt, def_passwd_timeout * 60, SUDO_CONV_PROMPT_ECHO_OFF);
135: } else {
136: pass = auth_getpass(prompt, def_passwd_timeout * 60, SUDO_CONV_PROMPT_ECHO_OFF);
137: if (pass && *pass == '\0') {
138: if ((prompt = strrchr(s, '\n')))
139: prompt++;
140: else
141: prompt = s;
142:
143: /*
144: * Append '[echo on]' to the last line of the challenge and
145: * reprompt with echo turned on.
146: */
147: len = strlen(prompt) - 1;
148: while (isspace(prompt[len]) || prompt[len] == ':')
149: prompt[len--] = '\0';
150: easprintf(&s, "%s [echo on]: ", prompt);
151: pass = auth_getpass(prompt, def_passwd_timeout * 60,
152: SUDO_CONV_PROMPT_ECHO_ON);
153: free(s);
154: }
155: }
156:
157: if (pass) {
158: authok = auth_userresponse(as, pass, 1);
159: zero_bytes(pass, strlen(pass));
160: }
161:
162: /* restore old signal handler */
163: (void) sigaction(SIGCHLD, &osa, NULL);
164:
165: if (authok)
1.1.1.2 misho 166: debug_return_int(AUTH_SUCCESS);
1.1 misho 167:
168: if (!pass)
1.1.1.2 misho 169: debug_return_int(AUTH_INTR);
1.1 misho 170:
171: if ((s = auth_getvalue(as, "errormsg")) != NULL)
1.1.1.3 ! misho 172: log_warning(NO_MAIL, "%s", s);
1.1.1.2 misho 173: debug_return_int(AUTH_FAILURE);
1.1 misho 174: }
175:
176: int
177: bsdauth_cleanup(struct passwd *pw, sudo_auth *auth)
178: {
1.1.1.2 misho 179: struct bsdauth_state *state = auth->data;
180: debug_decl(bsdauth_cleanup, SUDO_DEBUG_AUTH)
1.1 misho 181:
1.1.1.2 misho 182: if (state != NULL) {
183: auth_close(state->as);
184: login_close(state->lc);
185: }
1.1 misho 186:
1.1.1.2 misho 187: debug_return_int(AUTH_SUCCESS);
1.1 misho 188: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to bsdauth.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers / auth