From 19cb2e2d826dc4e3c938c5a6b51a03338e80fa9e Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 8 May 2017 16:01:26 +0200 Subject: [PATCH 156/160] pam_sss: add support for SSS_PAM_CERT_INFO_WITH_HINT MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The new response type SSS_PAM_CERT_INFO_WITH_HINT is equivalent to SSS_PAM_CERT_INFO but tells pam_sss to prompt for an option user name as well. Resolves: https://pagure.io/SSSD/sssd/issue/3395 Reviewed-by: Fabiano Fidêncio (cherry picked from commit a192a1d72e92dae3e71e062b333e51a5095a0395) --- src/sss_client/pam_message.h | 1 + src/sss_client/pam_sss.c | 129 ++++++++++++++++++++++++++++++++++++++----- src/sss_client/sss_cli.h | 11 +++- 3 files changed, 127 insertions(+), 14 deletions(-) diff --git a/src/sss_client/pam_message.h b/src/sss_client/pam_message.h index 3f4a770ac08ee416ead2f215ab873e8eb277c9eb..f215392f6879f01a0ca12abc8807bac5fc1f1cbb 100644 --- a/src/sss_client/pam_message.h +++ b/src/sss_client/pam_message.h @@ -63,6 +63,7 @@ struct pam_items { char *token_name; char *module_name; char *key_id; + bool user_name_hint; }; int pack_message_v3(struct pam_items *pi, size_t *size, uint8_t **buffer); diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c index db0dcb9de7b893850bcea96a9cdf76dc0b36dcee..1c06079967e3d9076d537c3de8aba93e13f76d09 100644 --- a/src/sss_client/pam_sss.c +++ b/src/sss_client/pam_sss.c @@ -982,6 +982,7 @@ static int eval_response(pam_handle_t *pamh, size_t buflen, uint8_t *buf, break; case SSS_PAM_CERT_INFO: + case SSS_PAM_CERT_INFO_WITH_HINT: if (buf[p + (len - 1)] != '\0') { D(("cert info does not end with \\0.")); break; @@ -994,7 +995,19 @@ static int eval_response(pam_handle_t *pamh, size_t buflen, uint8_t *buf, break; } - if (pi->pam_user == NULL || *(pi->pam_user) == '\0') { + if (type == SSS_PAM_CERT_INFO && pi->cert_user == '\0') { + D(("Invalid CERT message")); + break; + } + + if (type == SSS_PAM_CERT_INFO_WITH_HINT) { + pi->user_name_hint = true; + } else { + pi->user_name_hint = false; + } + + if ((pi->pam_user == NULL || *(pi->pam_user) == '\0') + && pi->cert_user != '\0') { ret = pam_set_item(pamh, PAM_USER, pi->cert_user); if (ret != PAM_SUCCESS) { D(("Failed to set PAM_USER during " @@ -1469,7 +1482,7 @@ done: return ret; } -#define SC_PROMPT_FMT "PIN for %s for user %s" +#define SC_PROMPT_FMT "PIN for %s" static int prompt_sc_pin(pam_handle_t *pamh, struct pam_items *pi) { @@ -1478,32 +1491,108 @@ static int prompt_sc_pin(pam_handle_t *pamh, struct pam_items *pi) char *prompt; size_t size; size_t needed_size; + const struct pam_conv *conv; + const struct pam_message *mesg[2] = { NULL, NULL }; + struct pam_message m[2] = { { 0 }, { 0 } }; + struct pam_response *resp = NULL; - if (pi->token_name == NULL || *pi->token_name == '\0' - || pi->cert_user == NULL || *pi->cert_user == '\0') { + if (pi->token_name == NULL || *pi->token_name == '\0') { return EINVAL; } - size = sizeof(SC_PROMPT_FMT) + strlen(pi->token_name) + - strlen(pi->cert_user); + size = sizeof(SC_PROMPT_FMT) + strlen(pi->token_name); prompt = malloc(size); if (prompt == NULL) { D(("malloc failed.")); return ENOMEM; } - ret = snprintf(prompt, size, SC_PROMPT_FMT, pi->token_name, pi->cert_user); + ret = snprintf(prompt, size, SC_PROMPT_FMT, pi->token_name); if (ret < 0 || ret >= size) { D(("snprintf failed.")); free(prompt); return EFAULT; } - ret = do_pam_conversation(pamh, PAM_PROMPT_ECHO_OFF, prompt, NULL, &answer); - free(prompt); - if (ret != PAM_SUCCESS) { - D(("do_pam_conversation failed.")); - return ret; + if (pi->user_name_hint) { + ret = pam_get_item(pamh, PAM_CONV, (const void **)&conv); + if (ret != PAM_SUCCESS) { + return ret; + } + if (conv == NULL || conv->conv == NULL) { + logger(pamh, LOG_ERR, "No conversation function"); + return PAM_SYSTEM_ERR; + } + + m[0].msg_style = PAM_PROMPT_ECHO_OFF; + m[0].msg = prompt; + m[1].msg_style = PAM_PROMPT_ECHO_ON; + m[1].msg = "User name hint: "; + + mesg[0] = (const struct pam_message *)m; + /* The following assignment might look a bit odd but is recommended in the + * pam_conv man page to make sure that the second argument of the PAM + * conversation function can be interpreted in two different ways. + * Basically it is important that both the actual struct pam_message and + * the pointers to the struct pam_message are arrays. Since the assignment + * makes clear that mesg[] and (*mesg)[] are arrays it should be kept this + * way and not be replaced by other equivalent assignments. */ + mesg[1] = &((*mesg)[1]); + + ret = conv->conv(2, mesg, &resp, conv->appdata_ptr); + if (ret != PAM_SUCCESS) { + D(("Conversation failure: %s.", pam_strerror(pamh, ret))); + return ret; + } + + if (resp == NULL) { + D(("response expected, but resp==NULL")); + return PAM_SYSTEM_ERR; + } + + if (resp[0].resp == NULL || *(resp[0].resp) == '\0') { + D(("Missing PIN.")); + ret = PAM_CRED_INSUFFICIENT; + goto done; + } + + answer = strndup(resp[0].resp, MAX_AUTHTOK_SIZE); + _pam_overwrite((void *)resp[0].resp); + free(resp[0].resp); + resp[0].resp = NULL; + if (answer == NULL) { + D(("strndup failed")); + ret = PAM_BUF_ERR; + goto done; + } + + if (resp[1].resp != NULL && *(resp[1].resp) != '\0') { + ret = pam_set_item(pamh, PAM_USER, resp[1].resp); + free(resp[1].resp); + resp[1].resp = NULL; + if (ret != PAM_SUCCESS) { + D(("Failed to set PAM_USER with user name hint [%s]", + pam_strerror(pamh, ret))); + goto done; + } + + ret = pam_get_item(pamh, PAM_USER, (const void **)&(pi->pam_user)); + if (ret != PAM_SUCCESS) { + D(("Failed to get PAM_USER with user name hint [%s]", + pam_strerror(pamh, ret))); + goto done; + } + + pi->pam_user_size = strlen(pi->pam_user) + 1; + } + } else { + ret = do_pam_conversation(pamh, PAM_PROMPT_ECHO_OFF, prompt, NULL, + &answer); + free(prompt); + if (ret != PAM_SUCCESS) { + D(("do_pam_conversation failed.")); + return ret; + } } if (answer == NULL) { @@ -1552,6 +1641,20 @@ done: free(answer); answer=NULL; + if (resp != NULL) { + if (resp[0].resp != NULL) { + _pam_overwrite((void *)resp[0].resp); + free(resp[0].resp); + } + if (resp[1].resp != NULL) { + _pam_overwrite((void *)resp[1].resp); + free(resp[1].resp); + } + + free(resp); + resp = NULL; + } + return ret; } @@ -1680,7 +1783,7 @@ static int get_authtok_for_authentication(pam_handle_t *pamh, ret = prompt_2fa(pamh, pi, _("First Factor: "), _("Second Factor: ")); } - } else if (pi->cert_user != NULL) { + } else if (pi->token_name != NULL && *(pi->token_name) != '\0') { ret = prompt_sc_pin(pamh, pi); } else { ret = prompt_password(pamh, pi, _("Password: ")); diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h index 59fee7a4eceb2c185e156e812af7f2f4c6b2a0dd..d4198407f2f86c6594aee6a2a43775e429692df0 100644 --- a/src/sss_client/sss_cli.h +++ b/src/sss_client/sss_cli.h @@ -427,7 +427,13 @@ enum response_type { * @param Three zero terminated strings, if one of the * strings is missing the message will contain only * an empty string (\0) for that component. */ - SSS_PAM_CERT_INFO, + SSS_PAM_CERT_INFO, /**< A message indicating that Smartcard/certificate + * based authentication is available and contains + * details about the found Smartcard. + * @param user name, zero terminated + * @param token name, zero terminated + * @param PKCS#11 module name, zero terminated + * @param key id, zero terminated */ SSS_OTP, /**< Indicates that the autotok was a OTP, so don't * cache it. There is no message. * @param None. */ @@ -442,6 +448,9 @@ enum response_type { * be used together with other prompting options * to determine the type of prompting. * @param None. */ + SSS_PAM_CERT_INFO_WITH_HINT, /**< Same as SSS_PAM_CERT_INFO but user name + * might be missing and should be prompted + * for. */ }; /** -- 2.9.4