[SSSD] [PATCH 1/3] Let the PAM client send its PID -- 2nd version

Sumit Bose sbose at redhat.com
Mon Sep 14 08:09:49 UTC 2009


Hi,

this is the new version of the cli_pid patch with the missing size
added. There are two related patches.

0002 removes the unused client locale. It was added at a time where we
talked about generating all messages the client should display on the
server side.

Based on the previous discussion 0003 makes cli_pid a mandatory item in
the pam protocol and increments the protocol version to 3. IMO it is not
necessary to push it, but I wouldn't mind if you prefer it this way.

bye,
Sumit
-------------- next part --------------
>From dacbe553befbdc7569369458ba9fa28d015d1d21 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 11 Sep 2009 11:45:19 +0200
Subject: [PATCH 1/3] Let the PAM client send its PID

- the client sends the PID as uint32_t and sssd will use uint32_t too
- fix a possible type issue where a uint32_t is sent as int32 in internal
  dbus communication
---
 server/providers/data_provider.h  |    1 +
 server/providers/dp_auth_util.c   |   11 ++++++---
 server/responder/pam/pamsrv_cmd.c |   19 ++++++++++++++++
 sss_client/pam_sss.c              |   43 +++++++++++++++++++++++++++++-------
 sss_client/sss_cli.h              |    3 +-
 5 files changed, 63 insertions(+), 14 deletions(-)

diff --git a/server/providers/data_provider.h b/server/providers/data_provider.h
index 1886340..790194c 100644
--- a/server/providers/data_provider.h
+++ b/server/providers/data_provider.h
@@ -110,6 +110,7 @@ struct pam_data {
     char *rhost;
     uint8_t *authtok;
     uint8_t *newauthtok;
+    uint32_t cli_pid;
 
     int pam_status;
     int response_delay;
diff --git a/server/providers/dp_auth_util.c b/server/providers/dp_auth_util.c
index 492ac7c..80e9f16 100644
--- a/server/providers/dp_auth_util.c
+++ b/server/providers/dp_auth_util.c
@@ -37,6 +37,7 @@ void pam_print_data(int l, struct pam_data *pd)
     DEBUG(l, ("priv: %d\n", pd->priv));
     DEBUG(l, ("pw_uid: %d\n", pd->pw_uid));
     DEBUG(l, ("gr_gid: %d\n", pd->gr_gid));
+    DEBUG(l, ("cli_pid: %d\n", pd->cli_pid));
 }
 
 int pam_add_response(struct pam_data *pd, enum response_type type,
@@ -76,17 +77,18 @@ bool dp_pack_pam_request(DBusMessage *msg, struct pam_data *pd)
                                    DBUS_TYPE_STRING, &(pd->tty),
                                    DBUS_TYPE_STRING, &(pd->ruser),
                                    DBUS_TYPE_STRING, &(pd->rhost),
-                                   DBUS_TYPE_INT32, &(pd->authtok_type),
+                                   DBUS_TYPE_UINT32, &(pd->authtok_type),
                                    DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE,
                                        &(pd->authtok),
                                        (pd->authtok_size),
-                                   DBUS_TYPE_INT32, &(pd->newauthtok_type),
+                                   DBUS_TYPE_UINT32, &(pd->newauthtok_type),
                                    DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE,
                                        &(pd->newauthtok),
                                        pd->newauthtok_size,
                                    DBUS_TYPE_INT32, &(pd->priv),
                                    DBUS_TYPE_INT32, &(pd->pw_uid),
                                    DBUS_TYPE_INT32, &(pd->gr_gid),
+                                   DBUS_TYPE_UINT32, &(pd->cli_pid),
                                    DBUS_TYPE_INVALID);
 
     return ret;
@@ -104,17 +106,18 @@ bool dp_unpack_pam_request(DBusMessage *msg, struct pam_data *pd, DBusError *dbu
                                 DBUS_TYPE_STRING, &(pd->tty),
                                 DBUS_TYPE_STRING, &(pd->ruser),
                                 DBUS_TYPE_STRING, &(pd->rhost),
-                                DBUS_TYPE_INT32, &(pd->authtok_type),
+                                DBUS_TYPE_UINT32, &(pd->authtok_type),
                                 DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE,
                                     &(pd->authtok),
                                     &(pd->authtok_size),
-                                DBUS_TYPE_INT32, &(pd->newauthtok_type),
+                                DBUS_TYPE_UINT32, &(pd->newauthtok_type),
                                 DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE,
                                     &(pd->newauthtok),
                                     &(pd->newauthtok_size),
                                 DBUS_TYPE_INT32, &(pd->priv),
                                 DBUS_TYPE_INT32, &(pd->pw_uid),
                                 DBUS_TYPE_INT32, &(pd->gr_gid),
+                                DBUS_TYPE_UINT32, &(pd->cli_pid),
                                 DBUS_TYPE_INVALID);
 
     return ret;
diff --git a/server/responder/pam/pamsrv_cmd.c b/server/responder/pam/pamsrv_cmd.c
index 1204e32..62cd2a5 100644
--- a/server/responder/pam/pamsrv_cmd.c
+++ b/server/responder/pam/pamsrv_cmd.c
@@ -71,6 +71,20 @@ static int extract_string(char **var, uint8_t *body, size_t blen, size_t *c) {
     return EOK;
 }
 
+static int extract_uint32_t(uint32_t *var, uint8_t *body, size_t blen, size_t *c) {
+    uint32_t size;
+
+    if (blen-(*c) < 2*sizeof(uint32_t)) return EINVAL;
+
+    size = ((uint32_t *)&body[*c])[0];
+    *c += sizeof(uint32_t);
+
+    *var = ((uint32_t *)&body[*c])[0];
+    *c += sizeof(uint32_t);
+
+    return EOK;
+}
+
 static int pam_parse_in_data_v2(struct sss_names_ctx *snctx,
                              struct pam_data *pd,
                              uint8_t *body, size_t blen)
@@ -119,6 +133,11 @@ static int pam_parse_in_data_v2(struct sss_names_ctx *snctx,
                 ret = extract_string(&pd->rhost, body, blen, &c);
                 if (ret != EOK) return ret;
                 break;
+            case PAM_ITEM_CLI_PID:
+                ret = extract_uint32_t(&pd->cli_pid,
+                                       body, blen, &c);
+                if (ret != EOK) return ret;
+                break;
             case PAM_ITEM_AUTHTOK:
                 ret = extract_authtok(&pd->authtok_type, &pd->authtok_size,
                                       &pd->authtok, body, blen, &c);
diff --git a/sss_client/pam_sss.c b/sss_client/pam_sss.c
index 3d00e28..41dc32b 100644
--- a/sss_client/pam_sss.c
+++ b/sss_client/pam_sss.c
@@ -66,6 +66,7 @@ struct pam_items {
     size_t pam_newauthtok_size;
     char *pam_cli_locale;
     size_t pam_cli_locale_size;
+    pid_t cli_pid;
 };
 
 #define DEBUG_MGS_LEN 1024
@@ -124,11 +125,29 @@ static size_t add_authtok_item(enum pam_item_type type,
     return rp;
 }
 
+
+static size_t add_uint32_t_item(enum pam_item_type type, const uint32_t val,
+                                uint8_t *buf) {
+    size_t rp=0;
+
+
+    ((uint32_t *)(&buf[rp]))[0] = type;
+    rp += sizeof(uint32_t);
+
+    ((uint32_t *)(&buf[rp]))[0] = sizeof(uint32_t);
+    rp += sizeof(uint32_t);
+
+    ((uint32_t *)(&buf[rp]))[0] = val;
+    rp += sizeof(uint32_t);
+
+    return rp;
+}
+
 static size_t add_string_item(enum pam_item_type type, const char *str,
                            const size_t size, uint8_t *buf) {
     size_t rp=0;
 
-    if (*str == '\0') return 0;
+    if (str == NULL || *str == '\0') return 0;
 
     ((uint32_t *)(&buf[rp]))[0] = type;
     rp += sizeof(uint32_t);
@@ -151,20 +170,21 @@ static int pack_message_v2(struct pam_items *pi, size_t *size,
     len = sizeof(uint32_t) +
           2*sizeof(uint32_t) + pi->pam_user_size +
           sizeof(uint32_t);
-    len +=  *pi->pam_service != '\0' ?
+    len += *pi->pam_service != '\0' ?
                 2*sizeof(uint32_t) + pi->pam_service_size : 0;
-    len +=  *pi->pam_tty != '\0' ?
+    len += *pi->pam_tty != '\0' ?
                 2*sizeof(uint32_t) + pi->pam_tty_size : 0;
-    len +=  *pi->pam_ruser != '\0' ?
+    len += *pi->pam_ruser != '\0' ?
                 2*sizeof(uint32_t) + pi->pam_ruser_size : 0;
-    len +=  *pi->pam_rhost != '\0' ?
+    len += *pi->pam_rhost != '\0' ?
                 2*sizeof(uint32_t) + pi->pam_rhost_size : 0;
-    len +=  *pi->pam_cli_locale != '\0' ?
+    len += *pi->pam_cli_locale != '\0' ?
                 2*sizeof(uint32_t) + pi->pam_cli_locale_size : 0;
-    len +=  pi->pam_authtok != NULL ?
+    len += pi->pam_authtok != NULL ?
                 3*sizeof(uint32_t) + pi->pam_authtok_size : 0;
-    len +=  pi->pam_newauthtok != NULL ?
+    len += pi->pam_newauthtok != NULL ?
                 3*sizeof(uint32_t) + pi->pam_newauthtok_size : 0;
+    len += 3*sizeof(uint32_t); /* cli_pid */
 
     buf = malloc(len);
     if (buf == NULL) {
@@ -191,9 +211,11 @@ static int pack_message_v2(struct pam_items *pi, size_t *size,
     rp += add_string_item(PAM_ITEM_RHOST, pi->pam_rhost, pi->pam_rhost_size,
                           &buf[rp]);
 
-    rp += add_string_item(PAM_CLI_LOCALE, pi->pam_cli_locale,
+    rp += add_string_item(PAM_ITEM_CLI_LOCALE, pi->pam_cli_locale,
                           pi->pam_cli_locale_size, &buf[rp]);
 
+    rp += add_uint32_t_item(PAM_ITEM_CLI_PID, (uint32_t) pi->cli_pid, &buf[rp]);
+
     rp += add_authtok_item(PAM_ITEM_AUTHTOK, pi->pam_authtok_type,
                            pi->pam_authtok, pi->pam_authtok_size, &buf[rp]);
     _pam_overwrite_n((void *)pi->pam_authtok, pi->pam_authtok_size);
@@ -486,6 +508,8 @@ static int get_pam_items(pam_handle_t *pamh, struct pam_items *pi)
     }
     pi->pam_cli_locale_size = strlen(pi->pam_cli_locale)+1;
 
+    pi->cli_pid = getpid();
+
     return PAM_SUCCESS;
 }
 
@@ -505,6 +529,7 @@ static void print_pam_items(struct pam_items *pi)
     D(("Authtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_authtok)));
     D(("Newauthtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_newauthtok)));
     D(("Locale: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_cli_locale)));
+    D(("Cli_PID: %d", pi->cli_pid));
 }
 
 static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
diff --git a/sss_client/sss_cli.h b/sss_client/sss_cli.h
index 7e0d4db..2b4e502 100644
--- a/sss_client/sss_cli.h
+++ b/sss_client/sss_cli.h
@@ -149,7 +149,8 @@ enum pam_item_type {
     PAM_ITEM_RHOST,
     PAM_ITEM_AUTHTOK,
     PAM_ITEM_NEWAUTHTOK,
-    PAM_CLI_LOCALE,
+    PAM_ITEM_CLI_LOCALE,
+    PAM_ITEM_CLI_PID,
 };
 
 #define SSS_NSS_MAX_ENTRIES 256
-- 
1.6.2.5

-------------- next part --------------
>From 1799eeb737850133c1959b743880e39fbbb9b394 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 14 Sep 2009 09:38:58 +0200
Subject: [PATCH 2/3] remove unused client locale from PAM protocol

---
 sss_client/pam_sss.c |   19 -------------------
 1 files changed, 0 insertions(+), 19 deletions(-)

diff --git a/sss_client/pam_sss.c b/sss_client/pam_sss.c
index 41dc32b..be22fd3 100644
--- a/sss_client/pam_sss.c
+++ b/sss_client/pam_sss.c
@@ -28,7 +28,6 @@
 #include <stdlib.h>
 #include <stdint.h>
 #include <syslog.h>
-#include <locale.h>
 
 #include <security/pam_modules.h>
 #include <security/pam_misc.h>
@@ -64,8 +63,6 @@ struct pam_items {
     size_t pam_authtok_size;
     int pam_newauthtok_type;
     size_t pam_newauthtok_size;
-    char *pam_cli_locale;
-    size_t pam_cli_locale_size;
     pid_t cli_pid;
 };
 
@@ -178,8 +175,6 @@ static int pack_message_v2(struct pam_items *pi, size_t *size,
                 2*sizeof(uint32_t) + pi->pam_ruser_size : 0;
     len += *pi->pam_rhost != '\0' ?
                 2*sizeof(uint32_t) + pi->pam_rhost_size : 0;
-    len += *pi->pam_cli_locale != '\0' ?
-                2*sizeof(uint32_t) + pi->pam_cli_locale_size : 0;
     len += pi->pam_authtok != NULL ?
                 3*sizeof(uint32_t) + pi->pam_authtok_size : 0;
     len += pi->pam_newauthtok != NULL ?
@@ -211,9 +206,6 @@ static int pack_message_v2(struct pam_items *pi, size_t *size,
     rp += add_string_item(PAM_ITEM_RHOST, pi->pam_rhost, pi->pam_rhost_size,
                           &buf[rp]);
 
-    rp += add_string_item(PAM_ITEM_CLI_LOCALE, pi->pam_cli_locale,
-                          pi->pam_cli_locale_size, &buf[rp]);
-
     rp += add_uint32_t_item(PAM_ITEM_CLI_PID, (uint32_t) pi->cli_pid, &buf[rp]);
 
     rp += add_authtok_item(PAM_ITEM_AUTHTOK, pi->pam_authtok_type,
@@ -447,7 +439,6 @@ static int eval_response(pam_handle_t *pamh, size_t buflen, uint8_t *buf)
 static int get_pam_items(pam_handle_t *pamh, struct pam_items *pi)
 {
     int ret;
-    char *cli_locale;
 
     pi->pam_authtok_type = SSS_AUTHTOK_TYPE_EMPTY;
     pi->pam_authtok = NULL;
@@ -499,15 +490,6 @@ static int get_pam_items(pam_handle_t *pamh, struct pam_items *pi)
     if (ret != PAM_SUCCESS) return ret;
     if (pi->pamstack_oldauthtok == NULL) pi->pamstack_oldauthtok="";
 
-    cli_locale = setlocale(LC_ALL, NULL);
-    if (cli_locale == NULL) {
-        pi->pam_cli_locale = strdup("");
-    } else {
-        pi->pam_cli_locale = strdup(cli_locale);
-        if (pi->pam_cli_locale == NULL) return PAM_BUF_ERR;
-    }
-    pi->pam_cli_locale_size = strlen(pi->pam_cli_locale)+1;
-
     pi->cli_pid = getpid();
 
     return PAM_SUCCESS;
@@ -528,7 +510,6 @@ static void print_pam_items(struct pam_items *pi)
             CHECK_AND_RETURN_PI_STRING(pi->pamstack_oldauthtok)));
     D(("Authtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_authtok)));
     D(("Newauthtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_newauthtok)));
-    D(("Locale: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_cli_locale)));
     D(("Cli_PID: %d", pi->cli_pid));
 }
 
-- 
1.6.2.5

-------------- next part --------------
>From 6b558a39d09f8cc92c2ed3220b7c067e4092ed33 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 14 Sep 2009 09:55:33 +0200
Subject: [PATCH 3/3] make cli_pid mandatory and increase version number of pam protocol

---
 server/responder/pam/pamsrv_cmd.c |   26 +++++++++++++++++++++++++-
 sss_client/pam_sss.c              |    4 ++--
 sss_client/sss_cli.h              |    2 +-
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/server/responder/pam/pamsrv_cmd.c b/server/responder/pam/pamsrv_cmd.c
index 62cd2a5..671dc08 100644
--- a/server/responder/pam/pamsrv_cmd.c
+++ b/server/responder/pam/pamsrv_cmd.c
@@ -167,6 +167,26 @@ static int pam_parse_in_data_v2(struct sss_names_ctx *snctx,
 
 }
 
+static int pam_parse_in_data_v3(struct sss_names_ctx *snctx,
+                             struct pam_data *pd,
+                             uint8_t *body, size_t blen)
+{
+    int ret;
+
+    ret = pam_parse_in_data_v2(snctx, pd, body, blen);
+    if (ret != EOK) {
+        DEBUG(1, ("pam_parse_in_data_v2 failed.\n"));
+        return ret;
+    }
+
+    if (pd->cli_pid == 0) {
+        DEBUG(1, ("Missing client PID.\n"));
+        return EINVAL;
+    }
+
+    return EOK;
+}
+
 static int pam_parse_in_data(struct sss_names_ctx *snctx,
                              struct pam_data *pd,
                              uint8_t *body, size_t blen)
@@ -440,6 +460,9 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
         case 2:
             ret = pam_parse_in_data_v2(cctx->rctx->names, pd, body, blen);
             break;
+        case 3:
+            ret = pam_parse_in_data_v3(cctx->rctx->names, pd, body, blen);
+            break;
         default:
             DEBUG(1, ("Illegal protocol version [%d].\n",
                       cctx->cli_protocol_version->version));
@@ -843,8 +866,9 @@ static int pam_cmd_chauthtok(struct cli_ctx *cctx) {
 struct cli_protocol_version *register_cli_protocol_version(void)
 {
     static struct cli_protocol_version pam_cli_protocol_version[] = {
-        {1, "2008-09-05", "initial version, \\0 terminated strings"},
+        {3, "2009-09-14", "make cli_pid mandatory"},
         {2, "2009-05-12", "new format <type><size><data>"},
+        {1, "2008-09-05", "initial version, \\0 terminated strings"},
         {0, NULL, NULL}
     };
 
diff --git a/sss_client/pam_sss.c b/sss_client/pam_sss.c
index be22fd3..9a1d441 100644
--- a/sss_client/pam_sss.c
+++ b/sss_client/pam_sss.c
@@ -158,7 +158,7 @@ static size_t add_string_item(enum pam_item_type type, const char *str,
     return rp;
 }
 
-static int pack_message_v2(struct pam_items *pi, size_t *size,
+static int pack_message_v3(struct pam_items *pi, size_t *size,
                            uint8_t **buffer) {
     int len;
     uint8_t *buf;
@@ -526,7 +526,7 @@ static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
 
     print_pam_items(pi);
 
-    ret = pack_message_v2(pi, &rd.len, &buf);
+    ret = pack_message_v3(pi, &rd.len, &buf);
     if (ret != 0) {
         D(("pack_message failed."));
         pam_status = PAM_SYSTEM_ERR;
diff --git a/sss_client/sss_cli.h b/sss_client/sss_cli.h
index 2b4e502..b036aec 100644
--- a/sss_client/sss_cli.h
+++ b/sss_client/sss_cli.h
@@ -21,7 +21,7 @@ typedef int errno_t;
 #endif
 
 #define SSS_NSS_PROTOCOL_VERSION 1
-#define SSS_PAM_PROTOCOL_VERSION 2
+#define SSS_PAM_PROTOCOL_VERSION 3
 
 enum sss_cli_command {
 /* null */
-- 
1.6.2.5



More information about the sssd-devel mailing list