VFS_pam.cpp

Go to the documentation of this file.

 
#include <pwd.h>
#include <grp.h>
#include <unistd.h>
 
#include "VFS.h"
#include "VFS_pam.h"
 
//http://www.linux-pam.org/Linux-PAM-html/adg-introduction-synopsis.html
#include <security/pam_appl.h>
 
VFS_pam::VFS_pam(QString service, QString group, bool debug)
: VFS_auth()
, _service(service)
, _group(group.toLower())
, _debug(debug)
{
        /*
        QJsonObject d;
        d["username"] = "test";
        d["password"] = "test";
        d["type"] = "default";
 
        VFS_request r(VFS_request::read,this,"","",QJsonDocument(d));
        read(&r);
        ls(&r);
        */
}
 
VFS_pam::~VFS_pam()
{
}
 
void VFS_pam::read(VFS_request *r)
{
        QMutexLocker l(&_lock);
 
        QJsonObject d = r->_data.object();
 
        bool auth = r->_path == "";     //if the path is empty we're authenticating.  Otherwise we're just reading the data.
 
        QString user = auth ? d["username"].toString("") : r->_path;
        QString pass = d["password"].toString("");
 
        if (_debug)
                printf("user:'%s' auth:%d service:'%s'\n",qUtf8Printable(user),auth,qUtf8Printable(_service));
 
        if (user.isEmpty())
        {
                r->_reason = "Username cannot be empty.";
                r->_success = false;
                return;
        }
 
        if ( !auth || validUserPass(user, pass) )
        {
                if (_debug) VFS::WARN("AUTHENTICATED!");
 
                //uid_t uid = getuid();
                //struct passwd *pw = getpwuid(uid);
                struct passwd *pw = getpwnam( qUtf8Printable(user) );
                QJsonArray groups = getGroups(pw);
 
                if (_group.isEmpty() || groups.contains(_group))        //only accept if our user is in our group, or no group is specified
                {
                        d["username"] = user;
                        d["uidnumber"] = (int) pw->pw_uid;
 
                        QString realname(pw->pw_gecos);
                        if (realname.isEmpty())
                                realname = user;
                        d["realname"] = realname;
 
                        d["groups"] = groups;
 
                        //d["type"] = type;
                        //d["authpath"] = d["authpath"];
                        //d["parameters"] = d["parameters"];
 
                        r->_data.setObject(d);
                        r->_success = true;
                        return;
                }
                else
                {
                        if (_debug)
                                VFS::WARN("User was authenticated, but did not belong to group '"+_group+"'");
                }
        }
        else
                if (_debug) VFS::ERROR("NOT AUTHENTICATED: "+user);
 
        r->_success = false;
}
 
void VFS_pam::ls(VFS_request *r)
{
        /*
                we need to provide for all users:
                {
                        "username": username,
                        "uidnumber": uid,
                        "realname": realname
                }
        */
 
        if (_debug)
                printf("filter group: %s\n",qUtf8Printable(_group));
 
        QJsonObject o;
        struct passwd *pw;
 
        setpwent();
        while((pw = getpwent()) != nullptr)
        {
                if (_debug)
                        printf("name=%s uid=%d group=%d real=%s\n",pw->pw_name,pw->pw_uid,pw->pw_gid,pw->pw_gecos);
 
                // kind of inefficient that we have to fetch each user,
                // then fetch all groups for each user,
                // then make sure that user is in the group that we want,
                // but there doesn't seem to be a get all "users in group" mechanism
 
                if (_group.isEmpty() || getGroups(pw).contains(_group))
                {
                        QString username(pw->pw_name);
                        int uidnumber((int)pw->pw_uid);
                        QString realname(pw->pw_gecos);
                        if (realname.isEmpty())
                                realname = username;
 
                        o[username] = QJsonObject {
                                { "username", username },
                                { "uidnumber", uidnumber },
                                { "realname", realname }
                        };
                }
        }
        endpwent();
 
        QJsonObject u = r->_data.object();
        u[r->_initialPath] = o;
        r->_data.setObject(u);
        r->_success = true;
 
        if (_debug)
                printf("USERS: %s",qUtf8Printable( r->_data.toJson() ));
}
 
int pam_conv_free( pam_response *resp, int nresp )
{
        for (int i=0; i<nresp; ++i)
        {
                if (resp[i].resp != nullptr)
                {
                        memset(resp[i].resp, 0, strlen(resp[i].resp));
                        free(resp[i].resp);
                }
        }
 
        memset(resp, 0, (unsigned long) nresp * sizeof *resp);
 
        return PAM_CONV_ERR;
}
 
int pam_conv_func(
        int num_msg,
        const struct pam_message **msg,
        struct pam_response **resp,
        void *appdata
)
{
        if (num_msg <= 0 || num_msg > PAM_MAX_NUM_MSG)
                return PAM_CONV_ERR;
 
        struct pam_response *r;
        if ((r = (pam_response *)calloc((size_t) num_msg, sizeof *r)) == nullptr)
                return PAM_BUF_ERR;
 
        QJsonObject *data = (QJsonObject *) appdata;
 
        for (int i=0; i<num_msg; i++)
        {
                r[i].resp = nullptr;
                r[i].resp_retcode = 0;
 
                switch(msg[i]->msg_style)
                {
                        case PAM_PROMPT_ECHO_ON:
                        case PAM_PROMPT_ECHO_OFF:
                                //msg[i]->msg contains a prompt
                                //r->resp = getpass(msg[i]->msg);
                                r[i].resp = strdup(qUtf8Printable((*data)["password"].toString()));
                                r[i].resp_retcode = PAM_SUCCESS;
                                break;
 
                        case PAM_ERROR_MSG:
                                //fprintf(stderr, "%s\n", m->msg);
                                VFS::ERROR(QString("%1").arg(msg[i]->msg),0,"pam");
                                r[i].resp_retcode = PAM_SUCCESS;
                                break;
 
                        case PAM_TEXT_INFO:
                                //fprintf(stdout, "%s\n", m->msg);
                                VFS::LOG(QString("%1").arg(msg[i]->msg),0,"pam");
                                r[i].resp_retcode = PAM_SUCCESS;
                                break;
 
                        default:
                                //free(r);
                                VFS::ERROR(QString("Unknown msg_style: %1").arg(msg[i]->msg),0,"pam");
                                *resp = nullptr;
                                return pam_conv_free(r,num_msg);
                }
        }
 
        *resp = r;
        return PAM_SUCCESS;
}
 
bool VFS_pam::validUserPass(QString user, QString pass)
{
        bool valid = false;
 
        QJsonObject d;
        d["username"] = user;
        d["password"] = pass;
 
        pam_handle_t *pamh=nullptr;
        int retval;
 
        struct pam_conv pam_conversation = {
                pam_conv_func,          // conversation function
                &d                      // application_data
        };
 
        retval = pam_start( qUtf8Printable(_service), qUtf8Printable(user), &pam_conversation, &pamh );
 
        #ifdef HAVE_PAM_FAIL_DELAY
                if (retval == PAM_SUCCESS)      //this does not override the need for a service file in /etc/pam.d -- see reference in the examples folder
                        retval = pam_fail_delay (pamh, 0 ); // micro-seconds
        #endif /* HAVE_PAM_FAIL_DELAY */
 
        if (retval == PAM_SUCCESS)
                retval = pam_authenticate(pamh, 0);
 
        if (_debug && retval == PAM_USER_UNKNOWN)
                VFS::WARN("Unknown user: "+user,0,className());
 
        if (retval == PAM_SUCCESS)
                retval = pam_acct_mgmt(pamh, 0);
 
        if (retval == PAM_SUCCESS)
                valid = true;
        //else
                //get and return a reason from the pam_conversation?
 
        if ( pam_end(pamh,retval) != PAM_SUCCESS )
        {
                pamh = nullptr;
                VFS::ERROR("Failed to release authenticator (2)",0,className());
        }
 
        return valid;
}
 
QJsonArray VFS_pam::getGroups(passwd *pw)
{
        QJsonArray groupList;
 
        if(pw == nullptr)
        {
                if (_debug)
                        VFS::ERROR("getGroups null ps!",0,className());
        }
        else
        {
                #ifdef __APPLE__
                static int groups[NGROUPS_MAX];
                #else
                static gid_t groups[NGROUPS_MAX];
                #endif
 
                int ngroups = NGROUPS_MAX;
                if (getgrouplist(pw->pw_name, (int) pw->pw_gid, groups, &ngroups) > -1)
                {
                        for (int i = 0; i < ngroups; i++)
                        {
                                //printf("GROUP %d\n",groups[i]);
 
                                struct group* gr = getgrgid((gid_t)groups[i]);
                                if(gr == nullptr)
                                {
                                        //perror("getgrgid error: ");
                                        if (_debug)
                                                VFS::ERROR("getgrid error!");
                                }
                                else
                                {
                                        if (_debug)
                                                printf("%s\n",gr->gr_name);
 
                                        QString gname(gr->gr_name);
 
                                        if (!gname.startsWith("_"))
                                                groupList << gname.toLower();
                                }
                        }
                }
        }
 
        return groupList;
}
 
QString VFS_pam::reportDetails()
{
        return "Service: "+_service+" "+"Group: "+_group;
}