/*
SSSD
PAM Responder - certificate related requests
Copyright (C) Sumit Bose <sbose@redhat.com> 2015
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <time.h>
#include "providers/data_provider.h"
#include "util/child_common.h"
#include "util/strtonum.h"
#include "lib/certmap/sss_certmap.h"
#include "util/crypto/sss_crypto.h"
#ifndef SSSD_LIBEXEC_PATH
#error "SSSD_LIBEXEC_PATH not defined"
#endif /* SSSD_LIBEXEC_PATH */
struct cert_auth_info {
char *cert;
char *token_name;
char *module_name;
char *key_id;
char *label;
};
{
}
{
}
{
}
{
}
{
}
{
}
{
}
struct ldb_result *cert_user_objs)
{
if (i->cert_user_objs != NULL) {
}
}
{
struct cert_auth_info *c;
cert_count++;
} else {
DLIST_REMOVE(*list, c);
}
}
if (_cert_count != NULL) {
}
if (_cert_user_count != NULL) {
}
return;
}
struct priv_sss_debug {
int level;
};
{
}
if (DEBUG_IS_SET(level)) {
}
}
struct certmap_info **certmap_list)
{
int ret;
size_t c;
goto done;
}
/* Try to add default matching rule */
if (ret != 0) {
"Failed to add default matching rule.\n");
}
goto done;
}
for (c = 0; certmap_list[c] != NULL; c++) {
"Trying to add rule [%s][%d][%s][%s].\n",
certmap_list[c]->match_rule,
certmap_list[c]->map_rule,
certmap_list[c]->domains);
if (ret != 0) {
"sss_certmap_add_rule failed for rule [%s] "
"with error [%d][%s], skipping. "
"Please check for typos and if rule syntax is supported.\n",
continue;
}
}
done:
} else {
}
return ret;
}
{
int ret;
bool user_name_hint;
return ret;
}
return ret;
}
}
{
size_t c;
"gdm-password", "kdm", "sudo", "sudo-i",
"gnome-screensaver", NULL };
return false;
}
return false;
}
return false;
}
/* TODO: make services configurable */
return false;
}
for (c = 0; sc_services[c] != NULL; c++) {
break;
}
}
if (sc_services[c] == NULL) {
"Smartcard authentication for service [%s] not supported.\n",
return false;
}
return true;
}
{
int ret;
return EINVAL;
}
case SSS_AUTHTOK_TYPE_SC_PIN:
return ret;
}
return EINVAL;
}
return ENOMEM;
}
break;
/* Nothing to send */
len = 0;
break;
default:
return EINVAL;
}
return EOK;
}
struct sss_certmap_ctx *sss_certmap_ctx,
struct cert_auth_info **_cert_list)
{
int ret;
uint8_t *p;
if (buf_len < 0) {
"Error occurred while reading data from p11_child.\n");
return EIO;
}
if (buf_len == 0) {
goto done;
}
return ENOMEM;
}
p = buf;
do {
if (cert_auth_info == NULL) {
return ENOMEM;
}
"Missing new-line in p11_child response.\n");
return EINVAL;
}
if (pn == p) {
"Missing counter in p11_child response.\n");
return EINVAL;
}
(pn - p));
goto done;
}
p = ++pn;
"Missing new-line in p11_child response.\n");
goto done;
}
if (pn == p) {
"Missing module name in p11_child response.\n");
goto done;
}
(pn - p));
goto done;
}
p = ++pn;
"Missing new-line in p11_child response.\n");
goto done;
}
if (pn == p) {
"Missing key id in p11_child response.\n");
goto done;
}
(pn - p));
goto done;
}
p = ++pn;
"Missing new-line in p11_child response.\n");
goto done;
}
if (pn == p) {
"Missing label in p11_child response.\n");
goto done;
}
(pn - p));
goto done;
}
p = ++pn;
"Missing new-line in p11_child response.\n");
goto done;
}
if (pn == p) {
goto done;
}
(pn - p));
goto done;
}
goto done;
}
if (ret == 0) {
} else {
"Cert [%s] does not match matching rules and is ignored.\n",
}
p = ++pn;
done:
}
*_cert_list = cert_list;
}
return ret;
}
struct pam_check_cert_state {
int child_status;
};
struct tevent_timer *te,
struct tevent_context *ev,
int child_debug_fd,
const char *nss_db,
const char *verify_opts,
struct sss_certmap_ctx *sss_certmap_ctx,
{
return NULL;
}
goto done;
}
if (sss_certmap_ctx == NULL) {
goto done;
}
/* extra_args are added in revers order */
arg_c = 0;
if (verify_opts != NULL) {
}
goto done;
}
}
}
}
}
case SSS_AUTHTOK_TYPE_SC_PIN:
break;
break;
default:
goto done;
}
} else {
goto done;
}
goto done;
}
if (ret == -1) {
goto done;
}
if (ret == -1) {
goto done;
}
if (child_debug_fd == -1) {
}
if (child_pid == 0) { /* child */
/* We should never get here */
} else if (child_pid > 0) { /* parent */
/* Set up SIGCHLD handler */
ret = ERR_P11_CHILD;
goto done;
}
/* Set up timeout handler */
ret = ERR_P11_CHILD;
goto done;
}
"get_p11_child_write_buffer failed.\n");
goto done;
}
}
if (write_buf_len != 0) {
ret = ERR_P11_CHILD;
goto done;
}
} else {
ret = ERR_P11_CHILD;
goto done;
}
}
/* Now either wait for the timeout to fire or the child
* to finish
*/
} else { /* error */
goto done;
}
done:
}
return req;
}
{
struct tevent_req);
struct pam_check_cert_state);
int ret;
return;
}
return;
}
}
{
struct tevent_req);
struct pam_check_cert_state);
int ret;
return;
}
return;
}
return;
}
struct tevent_timer *te,
{
}
struct cert_auth_info **cert_list)
{
}
}
return EOK;
}
struct cert_auth_info *cert_info)
{
int ret;
if (ret != 0) {
return NULL;
}
"LDAP:{subject_dn!nss}", NULL);
if (ret != 0) {
goto done;
}
goto done;
}
if (ret != 0) {
goto done;
}
filter);
}
done:
return prompt;
}
struct cert_auth_info *cert_info,
{
const char *token_name;
const char *module_name;
const char *key_id;
char *prompt;
if (sysdb_username != NULL) {
}
return EIO;
}
return ENOMEM;
}
prompt, prompt_len);
}
}
return EOK;
}
/* The PKCS11_LOGIN_TOKEN_NAME environment variable is e.g. used by the Gnome
* Settings Daemon to determine the name of the token used for login but it
* should be only set if SSSD is called by gdm-smartcard. Otherwise desktop
* components might assume that gdm-smartcard PAM stack is configured
* correctly which might not be the case e.g. if Smartcard authentication was
* used when running gdm-password. */
struct cert_auth_info *cert_info,
enum response_type type)
{
int ret;
return EINVAL;
}
return EINVAL;
}
/* sysdb_username is a fully-qualified name which is used by pam_sss when
* prompting the user for the PIN and as login name if it wasn't set by
* the PAM caller but has to be determined based on the inserted
* Smartcard. If this type of name is irritating at the PIN prompt or the
* re_expression config option was set in a way that user@domain cannot be
* handled anymore some more logic has to be added here. But for the time
* being I think using sysdb_username is fine. */
return ret;
}
"pam_add_response failed to add certificate info.\n");
return ret;
}
return ENOMEM;
}
"pam_add_response failed to add environment variable.\n");
return ret;
}
}
return ret;
}