summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2021-09-24 13:11:38 +0000
committerchristos <christos@NetBSD.org>2021-09-24 13:11:38 +0000
commit2dad03ddfa7dfd2ce0f11927245d2c6fbd2d791e (patch)
tree3f9ade0779e5b19b6a2afcf95cd069b55159f9fc
parenta20220312b7bc693246c0a466063f060c2a5b4e7 (diff)
merge conflicts between 1.0.8 and 1.2.0
-rw-r--r--external/bsd/pam-u2f/dist/.travis.yml253
-rw-r--r--external/bsd/pam-u2f/dist/b64.c1
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang7.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang8.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc7.sh10
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc8.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc9.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-linux.sh10
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-osx11-clang.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-osx9.4-clang.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang7.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang8.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc7.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc8.sh6
-rwxr-xr-xexternal/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc9.sh6
-rw-r--r--external/bsd/pam-u2f/dist/drop_privs.h15
-rw-r--r--external/bsd/pam-u2f/dist/pam-u2f.c75
-rw-r--r--external/bsd/pam-u2f/dist/util.h21
18 files changed, 84 insertions, 367 deletions
diff --git a/external/bsd/pam-u2f/dist/.travis.yml b/external/bsd/pam-u2f/dist/.travis.yml
deleted file mode 100644
index f396b6b253a..00000000000
--- a/external/bsd/pam-u2f/dist/.travis.yml
+++ /dev/null
@@ -1,253 +0,0 @@
-language: c
-
-matrix:
- include:
- - name: Xenial gcc-7
- os: linux
- compiler: gcc-7
- dist: xenial
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - ubuntu-toolchain-r-test
- packages:
- - autoconf
- - check
- - gcc-7
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-xenial-gcc7.sh
- - name: Xenial gcc-8
- os: linux
- compiler: gcc-8
- dist: xenial
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - ubuntu-toolchain-r-test
- packages:
- - autoconf
- - check
- - gcc-8
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-xenial-gcc8.sh
- - name: Xenial gcc-9
- os: linux
- compiler: gcc-9
- dist: xenial
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - ubuntu-toolchain-r-test
- packages:
- - autoconf
- - check
- - gcc-9
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-xenial-gcc9.sh
- - name: Xenial clang-7
- os: linux
- compiler: clang-7
- dist: xenial
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - ubuntu-toolchain-r-test
- - llvm-toolchain-xenial-7
- packages:
- - autoconf
- - check
- - clang-7
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-xenial-clang7.sh
- - name: Xenial clang-8
- os: linux
- compiler: clang-8
- dist: xenial
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - ubuntu-toolchain-r-test
- - llvm-toolchain-xenial-8
- packages:
- - autoconf
- - check
- - clang-8
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-xenial-clang8.sh
- - name: Bionic gcc-7 and clang-format
- os: linux
- compiler: gcc-7
- dist: bionic
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - ubuntu-toolchain-r-test
- packages:
- - autoconf
- - check
- - clang-format-6.0
- - gcc-7
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-bionic-gcc7.sh
- - name: Bionic gcc-8
- os: linux
- compiler: gcc-8
- dist: bionic
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - ubuntu-toolchain-r-test
- packages:
- - autoconf
- - check
- - gcc-8
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-bionic-gcc8.sh
- - name: Bionic gcc-9
- os: linux
- compiler: gcc-9
- dist: bionic
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - sourceline: 'ppa:ubuntu-toolchain-r/test'
- packages:
- - autoconf
- - check
- - gcc-9
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-bionic-gcc9.sh
- - name: Bionic clang-7
- os: linux
- compiler: clang-7
- dist: bionic
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - sourceline: 'ppa:ubuntu-toolchain-r/test'
- - sourceline: 'deb http://apt.llvm.org/bionic/ llvm-toolchain-bionic-7 main'
- key_url: 'https://apt.llvm.org/llvm-snapshot.gpg.key'
- packages:
- - autoconf
- - check
- - clang-7
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-bionic-clang7.sh
- - name: Bionic clang-8
- os: linux
- compiler: clang-8
- dist: bionic
- addons:
- apt:
- sources:
- - sourceline: 'ppa:yubico/stable'
- - sourceline: 'ppa:ubuntu-toolchain-r/test'
- - sourceline: 'deb http://apt.llvm.org/bionic/ llvm-toolchain-bionic-8 main'
- key_url: 'https://apt.llvm.org/llvm-snapshot.gpg.key'
- packages:
- - autoconf
- - check
- - clang-8
- - gengetopt
- - help2man
- - libfido2-dev
- - libpam-dev
- - libssl-dev
- - libtool
- - pkg-config
- script: ./build-aux/ci/build-bionic-clang8.sh
- - name: macOS xcode9.4
- os: osx
- osx_image: xcode9.4
- compiler: clang
- addons:
- homebrew:
- packages:
- - check
- - cmake
- - gengetopt
- - help2man
- - mandoc
- - openssl@1.1
- - pkg-config
- update: true
- script: ./build-aux/ci/build-osx9.4-clang.sh
- - name: macOS xcode11
- os: osx
- osx_image: xcode11
- compiler: clang
- addons:
- homebrew:
- packages:
- - check
- - cmake
- - gengetopt
- - help2man
- - mandoc
- - openssl@1.1
- - pkg-config
- update: true
- script: ./build-aux/ci/build-osx11-clang.sh
diff --git a/external/bsd/pam-u2f/dist/b64.c b/external/bsd/pam-u2f/dist/b64.c
index 0649c1e378b..77880894e83 100644
--- a/external/bsd/pam-u2f/dist/b64.c
+++ b/external/bsd/pam-u2f/dist/b64.c
@@ -4,6 +4,7 @@
#include <openssl/bio.h>
#include <openssl/evp.h>
+#include <limits.h>
#include <stdint.h>
#include <string.h>
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang7.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang7.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang7.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang8.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang8.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang8.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc7.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc7.sh
deleted file mode 100755
index 0a7f276520e..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc7.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-set +x
-source $BUILDROOT/build-aux/ci/format-code.sh "$(git rev-parse HEAD~)"
-set -x
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc8.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc8.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc8.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc9.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc9.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc9.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-linux.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-linux.sh
deleted file mode 100755
index 77ffd20cafa..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-linux.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-pushd "$BUILDROOT" &>/dev/null
- ./autogen.sh
- ./configure --disable-silent-rules --disable-man
- make check
-popd &>/dev/null
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-osx11-clang.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-osx11-clang.sh
deleted file mode 100755
index b2a227b3834..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-osx11-clang.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-osx.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-osx9.4-clang.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-osx9.4-clang.sh
deleted file mode 100755
index b2a227b3834..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-osx9.4-clang.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-osx.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang7.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang7.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang7.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang8.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang8.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang8.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc7.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc7.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc7.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc8.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc8.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc8.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc9.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc9.sh
deleted file mode 100755
index e855574c7a9..00000000000
--- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc9.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-BUILDROOT="$(git rev-parse --show-toplevel)"
-
-source $BUILDROOT/build-aux/ci/build-linux.sh
diff --git a/external/bsd/pam-u2f/dist/drop_privs.h b/external/bsd/pam-u2f/dist/drop_privs.h
index a5256dbde3b..61044cb2771 100644
--- a/external/bsd/pam-u2f/dist/drop_privs.h
+++ b/external/bsd/pam-u2f/dist/drop_privs.h
@@ -31,6 +31,17 @@
#ifdef HAVE_PAM_MODUTIL_DROP_PRIV
#include <security/pam_modutil.h>
+#elif HAVE_OPENPAM_BORROW_CRED
+#include <sys/types.h>
+#include <security/pam_appl.h>
+#include <security/openpam.h>
+
+#define PAM_MODUTIL_DEF_PRIVS(n) /* noop */
+#define pam_modutil_drop_priv(pamh, privs, pwd) \
+ ((openpam_borrow_cred((pamh), (pwd)) == PAM_SUCCESS) ? 0 : -1)
+#define pam_modutil_regain_priv(pamh, privs) \
+ ((openpam_restore_cred((pamh)) == PAM_SUCCESS) ? 0 : -1)
+
#else
#include <pwd.h>
@@ -67,5 +78,5 @@ int pam_modutil_drop_priv(pam_handle_t *, struct _ykpam_privs *,
struct passwd *);
int pam_modutil_regain_priv(pam_handle_t *, struct _ykpam_privs *);
-#endif
-#endif
+#endif /* HAVE_PAM_MODUTIL_DROP_PRIV */
+#endif /* __PAM_U2F_DROP_PRIVS_H_INCLUDED__ */
diff --git a/external/bsd/pam-u2f/dist/pam-u2f.c b/external/bsd/pam-u2f/dist/pam-u2f.c
index 6a29f413bb8..46521b5e6dc 100644
--- a/external/bsd/pam-u2f/dist/pam-u2f.c
+++ b/external/bsd/pam-u2f/dist/pam-u2f.c
@@ -13,6 +13,7 @@
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
+#include <stdint.h>
#include <stdlib.h>
#include <syslog.h>
#include <pwd.h>
@@ -31,8 +32,10 @@ char *secure_getenv(const char *name) {
}
#endif
-static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) {
+static void parse_cfg(int flags __unused, int argc, const char **argv, cfg_t *cfg) {
+#ifndef WITH_FUZZING
struct stat st;
+#endif
FILE *file = NULL;
int fd = -1;
int i;
@@ -70,6 +73,8 @@ static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) {
sscanf(argv[i], "pinverification=%d", &cfg->pinverification);
if (strncmp(argv[i], "authfile=", 9) == 0)
cfg->auth_file = argv[i] + 9;
+ if (strncmp(argv[i], "sshformat", 9) == 0)
+ cfg->sshformat = 1;
if (strncmp(argv[i], "authpending_file=", 17) == 0)
cfg->authpending_file = argv[i] + 17;
if (strncmp(argv[i], "origin=", 7) == 0)
@@ -81,6 +86,10 @@ static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) {
if (strncmp(argv[i], "cue_prompt=", 11) == 0)
cfg->cue_prompt = argv[i] + 11;
if (strncmp(argv[i], "debug_file=", 11) == 0) {
+ if (cfg->is_custom_debug_file)
+ fclose(cfg->debug_file);
+ cfg->debug_file = stderr;
+ cfg->is_custom_debug_file = 0;
const char *filename = argv[i] + 11;
if (strncmp(filename, "stdout", 6) == 0) {
cfg->debug_file = stdout;
@@ -91,7 +100,11 @@ static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) {
} else {
fd = open(filename,
O_WRONLY | O_APPEND | O_CLOEXEC | O_NOFOLLOW | O_NOCTTY);
+#ifndef WITH_FUZZING
if (fd >= 0 && (fstat(fd, &st) == 0) && S_ISREG(st.st_mode)) {
+#else
+ if (fd >= 0) {
+#endif
file = fdopen(fd, "a");
if (file != NULL) {
cfg->debug_file = file;
@@ -122,6 +135,7 @@ static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) {
D(cfg->debug_file, "nouserok=%d", cfg->nouserok);
D(cfg->debug_file, "openasuser=%d", cfg->openasuser);
D(cfg->debug_file, "alwaysok=%d", cfg->alwaysok);
+ D(cfg->debug_file, "sshformat=%d", cfg->sshformat);
D(cfg->debug_file, "authfile=%s",
cfg->auth_file ? cfg->auth_file : "(null)");
D(cfg->debug_file, "authpending_file=%s",
@@ -159,6 +173,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
char *buf = NULL;
char *authfile_dir;
size_t authfile_dir_len;
+ const char *default_authfile;
+ const char *default_authfile_dir;
int pgu_ret, gpn_ret;
int retval = PAM_IGNORE;
device_t *devices = NULL;
@@ -174,12 +190,16 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
PAM_MODUTIL_DEF_PRIVS(privs);
if (!cfg->origin) {
- strcpy(buffer, DEFAULT_ORIGIN_PREFIX);
+ if (!cfg->sshformat) {
+ strcpy(buffer, DEFAULT_ORIGIN_PREFIX);
- if (gethostname(buffer + strlen(DEFAULT_ORIGIN_PREFIX),
- BUFSIZE - strlen(DEFAULT_ORIGIN_PREFIX)) == -1) {
- DBG("Unable to get host name");
- goto done;
+ if (gethostname(buffer + strlen(DEFAULT_ORIGIN_PREFIX),
+ BUFSIZE - strlen(DEFAULT_ORIGIN_PREFIX)) == -1) {
+ DBG("Unable to get host name");
+ goto done;
+ }
+ } else {
+ strcpy(buffer, SSH_ORIGIN);
}
DBG("Origin not specified, using \"%s\"", buffer);
cfg->origin = strdup(buffer);
@@ -207,6 +227,10 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
DBG("Maximum devices number not set. Using default (%d)", MAX_DEVS);
cfg->max_devs = MAX_DEVS;
}
+#if WITH_FUZZING
+ if (cfg->max_devs > 256)
+ cfg->max_devs = 256;
+#endif
devices = calloc(cfg->max_devs, sizeof(device_t));
if (!devices) {
@@ -236,14 +260,22 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
DBG("Found user %s", user);
DBG("Home directory for %s is %s", user, pw->pw_dir);
+ if (!cfg->sshformat) {
+ default_authfile = DEFAULT_AUTHFILE;
+ default_authfile_dir = DEFAULT_AUTHFILE_DIR;
+ } else {
+ default_authfile = DEFAULT_AUTHFILE_SSH;
+ default_authfile_dir = DEFAULT_AUTHFILE_DIR_SSH;
+ }
+
if (!cfg->auth_file) {
buf = NULL;
authfile_dir = secure_getenv(DEFAULT_AUTHFILE_DIR_VAR);
if (!authfile_dir) {
- DBG("Variable %s is not set. Using default value ($HOME/.config/)",
- DEFAULT_AUTHFILE_DIR_VAR);
- authfile_dir_len =
- strlen(pw->pw_dir) + strlen("/.config") + strlen(DEFAULT_AUTHFILE) + 1;
+ DBG("Variable %s is not set. Using default value ($HOME%s/)",
+ DEFAULT_AUTHFILE_DIR_VAR, default_authfile_dir);
+ authfile_dir_len = strlen(pw->pw_dir) + strlen(default_authfile_dir) +
+ strlen(default_authfile) + 1;
buf = malloc(sizeof(char) * (authfile_dir_len));
if (!buf) {
@@ -255,11 +287,11 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
/* Opening a file in a users $HOME, need to drop privs for security */
openasuser = geteuid() == 0 ? 1 : 0;
- snprintf(buf, authfile_dir_len, "%s/.config%s", pw->pw_dir,
- DEFAULT_AUTHFILE);
+ snprintf(buf, authfile_dir_len, "%s%s%s", pw->pw_dir,
+ default_authfile_dir, default_authfile);
} else {
DBG("Variable %s set to %s", DEFAULT_AUTHFILE_DIR_VAR, authfile_dir);
- authfile_dir_len = strlen(authfile_dir) + strlen(DEFAULT_AUTHFILE) + 1;
+ authfile_dir_len = strlen(authfile_dir) + strlen(default_authfile) + 1;
buf = malloc(sizeof(char) * (authfile_dir_len));
if (!buf) {
@@ -268,7 +300,7 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
goto done;
}
- snprintf(buf, authfile_dir_len, "%s%s", authfile_dir, DEFAULT_AUTHFILE);
+ snprintf(buf, authfile_dir_len, "%s%s", authfile_dir, default_authfile);
if (!cfg->openasuser) {
DBG("WARNING: not dropping privileges when reading %s, please "
@@ -320,9 +352,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
}
DBG("Switched to uid %i", pw->pw_uid);
}
- retval =
- get_devices_from_authfile(cfg->auth_file, user, cfg->max_devs, cfg->debug,
- cfg->debug_file, devices, &n_devices);
+ retval = get_devices_from_authfile(cfg, user, devices, &n_devices);
+
if (openasuser) {
if (pam_modutil_regain_priv(pamh, &privs)) {
DBG("could not restore privileges");
@@ -395,8 +426,10 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
if (cfg->manual == 0) {
if (cfg->interactive) {
- converse(pamh, PAM_PROMPT_ECHO_ON,
- cfg->prompt != NULL ? cfg->prompt : DEFAULT_PROMPT);
+ buf = converse(pamh, PAM_PROMPT_ECHO_ON,
+ cfg->prompt != NULL ? cfg->prompt : DEFAULT_PROMPT);
+ free(buf);
+ buf = NULL;
}
retval = do_authentication(cfg, devices, n_devices, pamh);
@@ -428,7 +461,7 @@ done:
free(buf);
buf = NULL;
}
-#define free_const(a) free((void *)(uintptr_t)(a))
+#define free_const(a) free((void *) (uintptr_t)(a))
if (should_free_origin) {
free_const(cfg->origin);
cfg->origin = NULL;
@@ -473,5 +506,5 @@ PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc,
}
#ifdef PAM_MODULE_ENTRY
-PAM_MODULE_ENTRY("pam_u2f");
+PAM_MODULE_ENTRY("pam_u2f");
#endif
diff --git a/external/bsd/pam-u2f/dist/util.h b/external/bsd/pam-u2f/dist/util.h
index 7dc0fcd2737..cc14d6f3985 100644
--- a/external/bsd/pam-u2f/dist/util.h
+++ b/external/bsd/pam-u2f/dist/util.h
@@ -16,21 +16,24 @@
#define DEVSIZE (((PK_LEN) + (KH_LEN) + (RD_LEN)))
#define DEFAULT_AUTHFILE_DIR_VAR "XDG_CONFIG_HOME"
#define DEFAULT_AUTHFILE "/Yubico/u2f_keys"
+#define DEFAULT_AUTHFILE_SSH "/id_ecdsa_sk"
+#define DEFAULT_AUTHFILE_DIR "/.config"
+#define DEFAULT_AUTHFILE_DIR_SSH "/.ssh"
#define DEFAULT_AUTHPENDING_FILE_PATH "/var/run/user/%d/pam-u2f-authpending"
#define DEFAULT_PROMPT "Insert your U2F device, then press ENTER."
#define DEFAULT_CUE "Please touch the device."
#define DEFAULT_ORIGIN_PREFIX "pam://"
+#define SSH_ORIGIN "ssh:"
#define DEBUG_STR "debug(pam_u2f): %s:%d (%s): "
#if defined(DEBUG_PAM)
#define D(file, ...) _debug(file, __FILE__, __LINE__, __func__, __VA_ARGS__)
#else
-#define D(file, ...) ((void)0)
+#define D(file, ...) ((void) 0)
#endif /* DEBUG_PAM */
typedef struct {
unsigned max_devs;
- const char *client_key;
int manual;
int debug;
int nouserok;
@@ -42,6 +45,7 @@ typedef struct {
int userpresence;
int userverification;
int pinverification;
+ int sshformat;
const char *auth_file;
const char *authpending_file;
const char *origin;
@@ -60,8 +64,7 @@ typedef struct {
int old_format;
} device_t;
-int get_devices_from_authfile(const char *authfile, const char *username,
- unsigned max_devs, int verbose, FILE *debug_file,
+int get_devices_from_authfile(const cfg_t *cfg, const char *username,
device_t *devices, unsigned *n_devs);
void free_devices(device_t *devices, const unsigned n_devs);
@@ -70,8 +73,16 @@ int do_authentication(const cfg_t *cfg, const device_t *devices,
int do_manual_authentication(const cfg_t *cfg, const device_t *devices,
const unsigned n_devs, pam_handle_t *pamh);
char *converse(pam_handle_t *pamh, int echocode, const char *prompt);
-void _debug(FILE *, const char *, int, const char *, const char *, ...);
int random_bytes(void *, size_t);
+int cose_type(const char *, int *);
+const char *cose_string(int);
+
+#ifdef __GNUC__
+void _debug(FILE *, const char *, int, const char *, const char *, ...)
+ __attribute__((__format__(printf, 5, 6)));
+#else
+void _debug(FILE *, const char *, int, const char *, const char *, ...);
+#endif /* __GNUC__ */
#if !defined(HAVE_EXPLICIT_BZERO)
void explicit_bzero(void *, size_t);