- (djm) Merge FreeBSD PAM code: replaces PAM password auth kludge with
proper challenge-response module
diff --git a/auth-pam.c b/auth-pam.c
index f3d1956..f471803 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -1,5 +1,11 @@
-/*
- * Copyright (c) 2000 Damien Miller. All rights reserved.
+/*-
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by ThinkSec AS and
+ * NAI Labs, the Security Research Division of Network Associates, Inc.
+ * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
+ * DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -10,446 +16,633 @@
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
*/
#include "includes.h"
+RCSID("$FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $");
#ifdef USE_PAM
-#include "xmalloc.h"
-#include "log.h"
+#include <security/pam_appl.h>
+
#include "auth.h"
-#include "auth-options.h"
#include "auth-pam.h"
-#include "servconf.h"
+#include "buffer.h"
+#include "bufaux.h"
#include "canohost.h"
+#include "log.h"
+#include "monitor_wrap.h"
+#include "msg.h"
+#include "packet.h"
#include "readpass.h"
+#include "servconf.h"
+#include "ssh2.h"
+#include "xmalloc.h"
-extern char *__progname;
+#define __unused
-extern int use_privsep;
+#ifdef USE_POSIX_THREADS
+#include <pthread.h>
+/*
+ * Avoid namespace clash when *not* using pthreads for systems *with*
+ * pthreads, which unconditionally define pthread_t via sys/types.h
+ * (e.g. Linux)
+ */
+typedef pthread_t sp_pthread_t;
+#else
+/*
+ * Simulate threads with processes.
+ */
+typedef pid_t sp_pthread_t;
-RCSID("$Id: auth-pam.c,v 1.57 2003/04/29 13:22:40 djm Exp $");
+static void
+pthread_exit(void *value __unused)
+{
+ _exit(0);
+}
-#define NEW_AUTHTOK_MSG \
- "Warning: Your password has expired, please change it now."
-#define NEW_AUTHTOK_MSG_PRIVSEP \
- "Your password has expired, the session cannot proceed."
+static int
+pthread_create(sp_pthread_t *thread, const void *attr __unused,
+ void *(*thread_start)(void *), void *arg)
+{
+ pid_t pid;
-static int do_pam_conversation(int num_msg, const struct pam_message **msg,
- struct pam_response **resp, void *appdata_ptr);
+ switch ((pid = fork())) {
+ case -1:
+ error("fork(): %s", strerror(errno));
+ return (-1);
+ case 0:
+ thread_start(arg);
+ _exit(1);
+ default:
+ *thread = pid;
+ return (0);
+ }
+}
-/* module-local variables */
-static struct pam_conv conv = {
- (int (*)())do_pam_conversation,
- NULL
+static int
+pthread_cancel(sp_pthread_t thread)
+{
+ return (kill(thread, SIGTERM));
+}
+
+static int
+pthread_join(sp_pthread_t thread, void **value __unused)
+{
+ int status;
+
+ waitpid(thread, &status, 0);
+ return (status);
+}
+#endif
+
+
+static pam_handle_t *sshpam_handle;
+static int sshpam_err;
+static int sshpam_authenticated;
+static int sshpam_new_authtok_reqd;
+static int sshpam_session_open;
+static int sshpam_cred_established;
+
+struct pam_ctxt {
+ sp_pthread_t pam_thread;
+ int pam_psock;
+ int pam_csock;
+ int pam_done;
};
-static char *__pam_msg = NULL;
-static pam_handle_t *__pamh = NULL;
-static const char *__pampasswd = NULL;
-/* states for do_pam_conversation() */
-enum { INITIAL_LOGIN, OTHER } pamstate = INITIAL_LOGIN;
-/* remember whether pam_acct_mgmt() returned PAM_NEW_AUTHTOK_REQD */
-static int password_change_required = 0;
-/* remember whether the last pam_authenticate() succeeded or not */
-static int was_authenticated = 0;
-
-/* Remember what has been initialised */
-static int session_opened = 0;
-static int creds_set = 0;
-
-/* accessor which allows us to switch conversation structs according to
- * the authentication method being used */
-void do_pam_set_conv(struct pam_conv *conv)
-{
- pam_set_item(__pamh, PAM_CONV, conv);
-}
-
-/* start an authentication run */
-int do_pam_authenticate(int flags)
-{
- int retval = pam_authenticate(__pamh, flags);
- was_authenticated = (retval == PAM_SUCCESS);
- return retval;
-}
+static void sshpam_free_ctx(void *);
/*
- * PAM conversation function.
- * There are two states this can run in.
- *
- * INITIAL_LOGIN mode simply feeds the password from the client into
- * PAM in response to PAM_PROMPT_ECHO_OFF, and collects output
- * messages with into __pam_msg. This is used during initial
- * authentication to bypass the normal PAM password prompt.
- *
- * OTHER mode handles PAM_PROMPT_ECHO_OFF with read_passphrase()
- * and outputs messages to stderr. This mode is used if pam_chauthtok()
- * is called to update expired passwords.
+ * Conversation function for authentication thread.
*/
-static int do_pam_conversation(int num_msg, const struct pam_message **msg,
- struct pam_response **resp, void *appdata_ptr)
+static int
+sshpam_thread_conv(int n,
+ const struct pam_message **msg,
+ struct pam_response **resp,
+ void *data)
{
- struct pam_response *reply;
- int count;
- char buf[1024];
-
- /* PAM will free this later */
- reply = xmalloc(num_msg * sizeof(*reply));
-
- for (count = 0; count < num_msg; count++) {
- if (pamstate == INITIAL_LOGIN) {
- /*
- * We can't use stdio yet, queue messages for
- * printing later
- */
- switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
- case PAM_PROMPT_ECHO_ON:
- xfree(reply);
- return PAM_CONV_ERR;
- case PAM_PROMPT_ECHO_OFF:
- if (__pampasswd == NULL) {
- xfree(reply);
- return PAM_CONV_ERR;
- }
- reply[count].resp = xstrdup(__pampasswd);
- reply[count].resp_retcode = PAM_SUCCESS;
- break;
- case PAM_ERROR_MSG:
- case PAM_TEXT_INFO:
- if (PAM_MSG_MEMBER(msg, count, msg) != NULL) {
- message_cat(&__pam_msg,
- PAM_MSG_MEMBER(msg, count, msg));
- }
- reply[count].resp = xstrdup("");
- reply[count].resp_retcode = PAM_SUCCESS;
- break;
- default:
- xfree(reply);
- return PAM_CONV_ERR;
- }
- } else {
- /*
- * stdio is connected, so interact directly
- */
- switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
- case PAM_PROMPT_ECHO_ON:
- fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
- fgets(buf, sizeof(buf), stdin);
- reply[count].resp = xstrdup(buf);
- reply[count].resp_retcode = PAM_SUCCESS;
- break;
- case PAM_PROMPT_ECHO_OFF:
- reply[count].resp =
- read_passphrase(PAM_MSG_MEMBER(msg, count,
- msg), RP_ALLOW_STDIN);
- reply[count].resp_retcode = PAM_SUCCESS;
- break;
- case PAM_ERROR_MSG:
- case PAM_TEXT_INFO:
- if (PAM_MSG_MEMBER(msg, count, msg) != NULL)
- fprintf(stderr, "%s\n",
- PAM_MSG_MEMBER(msg, count, msg));
- reply[count].resp = xstrdup("");
- reply[count].resp_retcode = PAM_SUCCESS;
- break;
- default:
- xfree(reply);
- return PAM_CONV_ERR;
- }
- }
- }
-
- *resp = reply;
-
- return PAM_SUCCESS;
-}
-
-/* Called at exit to cleanly shutdown PAM */
-void do_pam_cleanup_proc(void *context)
-{
- int pam_retval = PAM_SUCCESS;
-
- if (__pamh && session_opened) {
- pam_retval = pam_close_session(__pamh, 0);
- if (pam_retval != PAM_SUCCESS)
- logit("Cannot close PAM session[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
- }
-
- if (__pamh && creds_set) {
- pam_retval = pam_setcred(__pamh, PAM_DELETE_CRED);
- if (pam_retval != PAM_SUCCESS)
- debug("Cannot delete credentials[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
- }
-
- if (__pamh) {
- pam_retval = pam_end(__pamh, pam_retval);
- if (pam_retval != PAM_SUCCESS)
- logit("Cannot release PAM authentication[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
- }
-}
-
-/* Attempt password authentication using PAM */
-int auth_pam_password(Authctxt *authctxt, const char *password)
-{
- extern ServerOptions options;
- int pam_retval;
- struct passwd *pw = authctxt->pw;
-
- do_pam_set_conv(&conv);
-
- __pampasswd = password;
-
- pamstate = INITIAL_LOGIN;
- pam_retval = do_pam_authenticate(
- options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0);
- if (pam_retval == PAM_SUCCESS && pw) {
- debug("PAM password authentication accepted for "
- "%.100s", pw->pw_name);
- return 1;
- } else {
- debug("PAM password authentication failed for "
- "%.100s: %s", pw ? pw->pw_name : "an illegal user",
- PAM_STRERROR(__pamh, pam_retval));
- return 0;
- }
-}
-
-/* Do account management using PAM */
-int do_pam_account(char *username, char *remote_user)
-{
- int pam_retval;
-
- do_pam_set_conv(&conv);
-
- if (remote_user) {
- debug("PAM setting ruser to \"%.200s\"", remote_user);
- pam_retval = pam_set_item(__pamh, PAM_RUSER, remote_user);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM set ruser failed[%d]: %.200s", pam_retval,
- PAM_STRERROR(__pamh, pam_retval));
- }
-
- pam_retval = pam_acct_mgmt(__pamh, 0);
- debug2("pam_acct_mgmt() = %d", pam_retval);
- switch (pam_retval) {
- case PAM_SUCCESS:
- /* This is what we want */
- break;
-#if 0
- case PAM_NEW_AUTHTOK_REQD:
- message_cat(&__pam_msg, use_privsep ?
- NEW_AUTHTOK_MSG_PRIVSEP : NEW_AUTHTOK_MSG);
- /* flag that password change is necessary */
- password_change_required = 1;
- /* disallow other functionality for now */
- no_port_forwarding_flag |= 2;
- no_agent_forwarding_flag |= 2;
- no_x11_forwarding_flag |= 2;
- break;
-#endif
- default:
- logit("PAM rejected by account configuration[%d]: "
- "%.200s", pam_retval, PAM_STRERROR(__pamh,
- pam_retval));
- return(0);
- }
-
- return(1);
-}
-
-/* Do PAM-specific session initialisation */
-void do_pam_session(char *username, const char *ttyname)
-{
- int pam_retval;
-
- do_pam_set_conv(&conv);
-
- if (ttyname != NULL) {
- debug("PAM setting tty to \"%.200s\"", ttyname);
- pam_retval = pam_set_item(__pamh, PAM_TTY, ttyname);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM set tty failed[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
- }
-
- pam_retval = pam_open_session(__pamh, 0);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM session setup failed[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
-
- session_opened = 1;
-}
-
-/* Set PAM credentials */
-void do_pam_setcred(int init)
-{
- int pam_retval;
-
- if (__pamh == NULL)
- return;
-
- do_pam_set_conv(&conv);
-
- debug("PAM establishing creds");
- pam_retval = pam_setcred(__pamh,
- init ? PAM_ESTABLISH_CRED : PAM_REINITIALIZE_CRED);
- if (pam_retval != PAM_SUCCESS) {
- if (was_authenticated)
- fatal("PAM setcred failed[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
- else
- debug("PAM setcred failed[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
- } else
- creds_set = 1;
-}
-
-/* accessor function for file scope static variable */
-int is_pam_password_change_required(void)
-{
- return password_change_required;
-}
-
-/*
- * Have user change authentication token if pam_acct_mgmt() indicated
- * it was expired. This needs to be called after an interactive
- * session is established and the user's pty is connected to
- * stdin/stdout/stderr.
- */
-void do_pam_chauthtok(void)
-{
- int pam_retval;
-
- do_pam_set_conv(&conv);
-
- if (password_change_required) {
- if (use_privsep)
- fatal("Password changing is currently unsupported"
- " with privilege separation");
- pamstate = OTHER;
- pam_retval = pam_chauthtok(__pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM pam_chauthtok failed[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
-#if 0
- /* XXX: This would need to be done in the parent process,
- * but there's currently no way to pass such request. */
- no_port_forwarding_flag &= ~2;
- no_agent_forwarding_flag &= ~2;
- no_x11_forwarding_flag &= ~2;
- if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
- channel_permit_all_opens();
-#endif
- }
-}
-
-/* Cleanly shutdown PAM */
-void finish_pam(void)
-{
- do_pam_cleanup_proc(NULL);
- fatal_remove_cleanup(&do_pam_cleanup_proc, NULL);
-}
-
-/* Start PAM authentication for specified account */
-void start_pam(const char *user)
-{
- int pam_retval;
- extern ServerOptions options;
- extern u_int utmp_len;
- const char *rhost;
-
- debug("Starting up PAM with username \"%.200s\"", user);
-
- pam_retval = pam_start(SSHD_PAM_SERVICE, user, &conv, &__pamh);
-
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM initialisation failed[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
-
- rhost = get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping);
- debug("PAM setting rhost to \"%.200s\"", rhost);
-
- pam_retval = pam_set_item(__pamh, PAM_RHOST, rhost);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM set rhost failed[%d]: %.200s", pam_retval,
- PAM_STRERROR(__pamh, pam_retval));
-#ifdef PAM_TTY_KLUDGE
- /*
- * Some PAM modules (e.g. pam_time) require a TTY to operate,
- * and will fail in various stupid ways if they don't get one.
- * sshd doesn't set the tty until too late in the auth process and may
- * not even need one (for tty-less connections)
- * Kludge: Set a fake PAM_TTY
- */
- pam_retval = pam_set_item(__pamh, PAM_TTY, "NODEVssh");
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM set tty failed[%d]: %.200s",
- pam_retval, PAM_STRERROR(__pamh, pam_retval));
-#endif /* PAM_TTY_KLUDGE */
-
- fatal_add_cleanup(&do_pam_cleanup_proc, NULL);
-}
-
-/* Return list of PAM environment strings */
-char **fetch_pam_environment(void)
-{
-#ifdef HAVE_PAM_GETENVLIST
- return(pam_getenvlist(__pamh));
-#else /* HAVE_PAM_GETENVLIST */
- return(NULL);
-#endif /* HAVE_PAM_GETENVLIST */
-}
-
-void free_pam_environment(char **env)
-{
+ Buffer buffer;
+ struct pam_ctxt *ctxt;
int i;
- if (env != NULL) {
- for (i = 0; env[i] != NULL; i++)
- xfree(env[i]);
+ ctxt = data;
+ if (n <= 0 || n > PAM_MAX_NUM_MSG)
+ return (PAM_CONV_ERR);
+ *resp = xmalloc(n * sizeof **resp);
+ buffer_init(&buffer);
+ for (i = 0; i < n; ++i) {
+ resp[i]->resp_retcode = 0;
+ resp[i]->resp = NULL;
+ switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
+ case PAM_PROMPT_ECHO_OFF:
+ buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+ ssh_msg_send(ctxt->pam_csock,
+ PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+ ssh_msg_recv(ctxt->pam_csock, &buffer);
+ if (buffer_get_char(&buffer) != PAM_AUTHTOK)
+ goto fail;
+ resp[i]->resp = buffer_get_string(&buffer, NULL);
+ break;
+ case PAM_PROMPT_ECHO_ON:
+ buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+ ssh_msg_send(ctxt->pam_csock,
+ PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+ ssh_msg_recv(ctxt->pam_csock, &buffer);
+ if (buffer_get_char(&buffer) != PAM_AUTHTOK)
+ goto fail;
+ resp[i]->resp = buffer_get_string(&buffer, NULL);
+ break;
+ case PAM_ERROR_MSG:
+ buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+ ssh_msg_send(ctxt->pam_csock,
+ PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+ break;
+ case PAM_TEXT_INFO:
+ buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+ ssh_msg_send(ctxt->pam_csock,
+ PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+ break;
+ default:
+ goto fail;
+ }
+ buffer_clear(&buffer);
}
+ buffer_free(&buffer);
+ return (PAM_SUCCESS);
+ fail:
+ while (i)
+ xfree(resp[--i]);
+ xfree(*resp);
+ *resp = NULL;
+ buffer_free(&buffer);
+ return (PAM_CONV_ERR);
}
-/* Print any messages that have been generated during authentication */
-/* or account checking to stderr */
-void print_pam_messages(void)
+/*
+ * Authentication thread.
+ */
+static void *
+sshpam_thread(void *ctxtp)
{
- if (__pam_msg != NULL)
- fputs(__pam_msg, stderr);
+ struct pam_ctxt *ctxt = ctxtp;
+ Buffer buffer;
+ struct pam_conv sshpam_conv = { sshpam_thread_conv, ctxt };
+#ifndef USE_POSIX_THREADS
+ const char *pam_user;
+
+ pam_get_item(sshpam_handle, PAM_USER, (const void **)&pam_user);
+ setproctitle("%s [pam]", pam_user);
+#endif
+
+ buffer_init(&buffer);
+ sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ (const void *)&sshpam_conv);
+ if (sshpam_err != PAM_SUCCESS)
+ goto auth_fail;
+ sshpam_err = pam_authenticate(sshpam_handle, 0);
+ if (sshpam_err != PAM_SUCCESS)
+ goto auth_fail;
+ sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
+ if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD)
+ goto auth_fail;
+ buffer_put_cstring(&buffer, "OK");
+ ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
+ buffer_free(&buffer);
+ pthread_exit(NULL);
+
+ auth_fail:
+ buffer_put_cstring(&buffer,
+ pam_strerror(sshpam_handle, sshpam_err));
+ ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
+ buffer_free(&buffer);
+ pthread_exit(NULL);
+
+ return (NULL); /* Avoid warning for non-pthread case */
}
-/* Append a message to buffer */
-void message_cat(char **p, const char *a)
+static void
+sshpam_thread_cleanup(void *ctxtp)
{
- char *cp;
- size_t new_len;
+ struct pam_ctxt *ctxt = ctxtp;
- new_len = strlen(a);
+ pthread_cancel(ctxt->pam_thread);
+ pthread_join(ctxt->pam_thread, NULL);
+ close(ctxt->pam_psock);
+ close(ctxt->pam_csock);
+}
- if (*p) {
- size_t len = strlen(*p);
+static int
+sshpam_null_conv(int n,
+ const struct pam_message **msg,
+ struct pam_response **resp,
+ void *data)
+{
- *p = xrealloc(*p, new_len + len + 2);
- cp = *p + len;
- } else
- *p = cp = xmalloc(new_len + 2);
+ return (PAM_CONV_ERR);
+}
- memcpy(cp, a, new_len);
- cp[new_len] = '\n';
- cp[new_len + 1] = '\0';
+static struct pam_conv null_conv = { sshpam_null_conv, NULL };
+
+static void
+sshpam_cleanup(void *arg)
+{
+ (void)arg;
+ debug("PAM: cleanup");
+ pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
+ if (sshpam_cred_established) {
+ pam_setcred(sshpam_handle, PAM_DELETE_CRED);
+ sshpam_cred_established = 0;
+ }
+ if (sshpam_session_open) {
+ pam_close_session(sshpam_handle, PAM_SILENT);
+ sshpam_session_open = 0;
+ }
+ sshpam_authenticated = sshpam_new_authtok_reqd = 0;
+ pam_end(sshpam_handle, sshpam_err);
+ sshpam_handle = NULL;
+}
+
+static int
+sshpam_init(const char *user)
+{
+ extern ServerOptions options;
+ extern u_int utmp_len;
+ const char *pam_rhost, *pam_user;
+
+ if (sshpam_handle != NULL) {
+ /* We already have a PAM context; check if the user matches */
+ sshpam_err = pam_get_item(sshpam_handle,
+ PAM_USER, (const void **)&pam_user);
+ if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
+ return (0);
+ fatal_remove_cleanup(sshpam_cleanup, NULL);
+ pam_end(sshpam_handle, sshpam_err);
+ sshpam_handle = NULL;
+ }
+ debug("PAM: initializing for \"%s\"", user);
+ sshpam_err = pam_start("sshd", user, &null_conv, &sshpam_handle);
+ if (sshpam_err != PAM_SUCCESS)
+ return (-1);
+ pam_rhost = get_remote_name_or_ip(utmp_len,
+ options.verify_reverse_mapping);
+ debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
+ sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
+ if (sshpam_err != PAM_SUCCESS) {
+ pam_end(sshpam_handle, sshpam_err);
+ sshpam_handle = NULL;
+ return (-1);
+ }
+ fatal_add_cleanup(sshpam_cleanup, NULL);
+ return (0);
+}
+
+static void *
+sshpam_init_ctx(Authctxt *authctxt)
+{
+ struct pam_ctxt *ctxt;
+ int socks[2];
+
+ /* Initialize PAM */
+ if (sshpam_init(authctxt->user) == -1) {
+ error("PAM: initialization failed");
+ return (NULL);
+ }
+
+ ctxt = xmalloc(sizeof *ctxt);
+ ctxt->pam_done = 0;
+
+ /* Start the authentication thread */
+ if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
+ error("PAM: failed create sockets: %s", strerror(errno));
+ xfree(ctxt);
+ return (NULL);
+ }
+ ctxt->pam_psock = socks[0];
+ ctxt->pam_csock = socks[1];
+ if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
+ error("PAM: failed to start authentication thread: %s",
+ strerror(errno));
+ close(socks[0]);
+ close(socks[1]);
+ xfree(ctxt);
+ return (NULL);
+ }
+ fatal_add_cleanup(sshpam_thread_cleanup, ctxt);
+ return (ctxt);
+}
+
+static int
+sshpam_query(void *ctx, char **name, char **info,
+ u_int *num, char ***prompts, u_int **echo_on)
+{
+ Buffer buffer;
+ struct pam_ctxt *ctxt = ctx;
+ size_t plen;
+ u_char type;
+ char *msg;
+
+ buffer_init(&buffer);
+ *name = xstrdup("");
+ *info = xstrdup("");
+ *prompts = xmalloc(sizeof(char *));
+ **prompts = NULL;
+ plen = 0;
+ *echo_on = xmalloc(sizeof(u_int));
+ while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
+ type = buffer_get_char(&buffer);
+ msg = buffer_get_string(&buffer, NULL);
+ switch (type) {
+ case PAM_PROMPT_ECHO_ON:
+ case PAM_PROMPT_ECHO_OFF:
+ *num = 1;
+ **prompts = xrealloc(**prompts, plen + strlen(msg) + 1);
+ plen += sprintf(**prompts + plen, "%s", msg);
+ **echo_on = (type == PAM_PROMPT_ECHO_ON);
+ xfree(msg);
+ return (0);
+ case PAM_ERROR_MSG:
+ case PAM_TEXT_INFO:
+ /* accumulate messages */
+ **prompts = xrealloc(**prompts, plen + strlen(msg) + 1);
+ plen += sprintf(**prompts + plen, "%s", msg);
+ xfree(msg);
+ break;
+ case PAM_NEW_AUTHTOK_REQD:
+ sshpam_new_authtok_reqd = 1;
+ /* FALLTHROUGH */
+ case PAM_SUCCESS:
+ case PAM_AUTH_ERR:
+ if (**prompts != NULL) {
+ /* drain any accumulated messages */
+#if 0 /* XXX - not compatible with privsep */
+ packet_start(SSH2_MSG_USERAUTH_BANNER);
+ packet_put_cstring(**prompts);
+ packet_put_cstring("");
+ packet_send();
+ packet_write_wait();
+#endif
+ xfree(**prompts);
+ **prompts = NULL;
+ }
+ if (type == PAM_SUCCESS) {
+ *num = 0;
+ **echo_on = 0;
+ ctxt->pam_done = 1;
+ xfree(msg);
+ return (0);
+ }
+ error("PAM: %s", msg);
+ default:
+ *num = 0;
+ **echo_on = 0;
+ xfree(msg);
+ ctxt->pam_done = -1;
+ return (-1);
+ }
+ }
+ return (-1);
+}
+
+/* XXX - see also comment in auth-chall.c:verify_response */
+static int
+sshpam_respond(void *ctx, u_int num, char **resp)
+{
+ Buffer buffer;
+ struct pam_ctxt *ctxt = ctx;
+
+ debug2("PAM: %s", __func__);
+ switch (ctxt->pam_done) {
+ case 1:
+ sshpam_authenticated = 1;
+ return (0);
+ case 0:
+ break;
+ default:
+ return (-1);
+ }
+ if (num != 1) {
+ error("PAM: expected one response, got %u", num);
+ return (-1);
+ }
+ buffer_init(&buffer);
+ buffer_put_cstring(&buffer, *resp);
+ ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer);
+ buffer_free(&buffer);
+ return (1);
+}
+
+static void
+sshpam_free_ctx(void *ctxtp)
+{
+ struct pam_ctxt *ctxt = ctxtp;
+
+ fatal_remove_cleanup(sshpam_thread_cleanup, ctxt);
+ sshpam_thread_cleanup(ctxtp);
+ xfree(ctxt);
+ /*
+ * We don't call sshpam_cleanup() here because we may need the PAM
+ * handle at a later stage, e.g. when setting up a session. It's
+ * still on the cleanup list, so pam_end() *will* be called before
+ * the server process terminates.
+ */
+}
+
+KbdintDevice sshpam_device = {
+ "pam",
+ sshpam_init_ctx,
+ sshpam_query,
+ sshpam_respond,
+ sshpam_free_ctx
+};
+
+KbdintDevice mm_sshpam_device = {
+ "pam",
+ mm_sshpam_init_ctx,
+ mm_sshpam_query,
+ mm_sshpam_respond,
+ mm_sshpam_free_ctx
+};
+
+/*
+ * This replaces auth-pam.c
+ */
+void
+start_pam(const char *user)
+{
+ if (sshpam_init(user) == -1)
+ fatal("PAM: initialisation failed");
+}
+
+void
+finish_pam(void)
+{
+ fatal_remove_cleanup(sshpam_cleanup, NULL);
+ sshpam_cleanup(NULL);
+}
+
+int
+do_pam_account(const char *user, const char *ruser)
+{
+ /* XXX */
+ return (1);
+}
+
+void
+do_pam_session(const char *user, const char *tty)
+{
+ sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ (const void *)&null_conv);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: failed to set PAM_CONV: %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ debug("PAM: setting PAM_TTY to \"%s\"", tty);
+ sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: failed to set PAM_TTY: %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ sshpam_err = pam_open_session(sshpam_handle, 0);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: pam_open_session(): %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ sshpam_session_open = 1;
+}
+
+void
+do_pam_setcred(int init)
+{
+ sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ (const void *)&null_conv);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: failed to set PAM_CONV: %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ if (init) {
+ debug("PAM: establishing credentials");
+ sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
+ } else {
+ debug("PAM: reinitializing credentials");
+ sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
+ }
+ if (sshpam_err == PAM_SUCCESS) {
+ sshpam_cred_established = 1;
+ return;
+ }
+ if (sshpam_authenticated)
+ fatal("PAM: pam_setcred(): %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ else
+ debug("PAM: pam_setcred(): %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+}
+
+int
+is_pam_password_change_required(void)
+{
+ return (sshpam_new_authtok_reqd);
+}
+
+static int
+pam_chauthtok_conv(int n,
+ const struct pam_message **msg,
+ struct pam_response **resp,
+ void *data)
+{
+ char input[PAM_MAX_MSG_SIZE];
+ int i;
+
+ if (n <= 0 || n > PAM_MAX_NUM_MSG)
+ return (PAM_CONV_ERR);
+ *resp = xmalloc(n * sizeof **resp);
+ for (i = 0; i < n; ++i) {
+ switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
+ case PAM_PROMPT_ECHO_OFF:
+ resp[i]->resp =
+ read_passphrase(PAM_MSG_MEMBER(msg, i, msg),
+ RP_ALLOW_STDIN);
+ resp[i]->resp_retcode = PAM_SUCCESS;
+ break;
+ case PAM_PROMPT_ECHO_ON:
+ fputs(PAM_MSG_MEMBER(msg, i, msg), stderr);
+ fgets(input, sizeof input, stdin);
+ resp[i]->resp = xstrdup(input);
+ resp[i]->resp_retcode = PAM_SUCCESS;
+ break;
+ case PAM_ERROR_MSG:
+ case PAM_TEXT_INFO:
+ fputs(PAM_MSG_MEMBER(msg, i, msg), stderr);
+ resp[i]->resp_retcode = PAM_SUCCESS;
+ break;
+ default:
+ goto fail;
+ }
+ }
+ return (PAM_SUCCESS);
+ fail:
+ while (i)
+ xfree(resp[--i]);
+ xfree(*resp);
+ *resp = NULL;
+ return (PAM_CONV_ERR);
+}
+
+/*
+ * XXX this should be done in the authentication phase, but ssh1 doesn't
+ * support that
+ */
+void
+do_pam_chauthtok(void)
+{
+ struct pam_conv pam_conv = { pam_chauthtok_conv, NULL };
+
+ if (use_privsep)
+ fatal("PAM: chauthtok not supprted with privsep");
+ sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ (const void *)&pam_conv);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: failed to set PAM_CONV: %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ debug("PAM: changing password");
+ sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: pam_chauthtok(): %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+}
+
+void
+print_pam_messages(void)
+{
+ /* XXX */
+}
+
+char **
+fetch_pam_environment(void)
+{
+#ifdef HAVE_PAM_GETENVLIST
+ debug("PAM: retrieving environment");
+ return (pam_getenvlist(sshpam_handle));
+#else
+ return (NULL);
+#endif
+}
+
+void
+free_pam_environment(char **env)
+{
+ char **envp;
+
+ for (envp = env; *envp; envp++)
+ xfree(*envp);
+ xfree(env);
}
#endif /* USE_PAM */