diff options
| author | christos <christos@NetBSD.org> | 2021-09-24 13:11:38 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2021-09-24 13:11:38 +0000 |
| commit | 2dad03ddfa7dfd2ce0f11927245d2c6fbd2d791e (patch) | |
| tree | 3f9ade0779e5b19b6a2afcf95cd069b55159f9fc /external/bsd | |
| parent | a20220312b7bc693246c0a466063f060c2a5b4e7 (diff) | |
merge conflicts between 1.0.8 and 1.2.0
Diffstat (limited to 'external/bsd')
18 files changed, 84 insertions, 367 deletions
diff --git a/external/bsd/pam-u2f/dist/.travis.yml b/external/bsd/pam-u2f/dist/.travis.yml deleted file mode 100644 index f396b6b253a..00000000000 --- a/external/bsd/pam-u2f/dist/.travis.yml +++ /dev/null @@ -1,253 +0,0 @@ -language: c - -matrix: - include: - - name: Xenial gcc-7 - os: linux - compiler: gcc-7 - dist: xenial - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - ubuntu-toolchain-r-test - packages: - - autoconf - - check - - gcc-7 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-xenial-gcc7.sh - - name: Xenial gcc-8 - os: linux - compiler: gcc-8 - dist: xenial - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - ubuntu-toolchain-r-test - packages: - - autoconf - - check - - gcc-8 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-xenial-gcc8.sh - - name: Xenial gcc-9 - os: linux - compiler: gcc-9 - dist: xenial - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - ubuntu-toolchain-r-test - packages: - - autoconf - - check - - gcc-9 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-xenial-gcc9.sh - - name: Xenial clang-7 - os: linux - compiler: clang-7 - dist: xenial - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - ubuntu-toolchain-r-test - - llvm-toolchain-xenial-7 - packages: - - autoconf - - check - - clang-7 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-xenial-clang7.sh - - name: Xenial clang-8 - os: linux - compiler: clang-8 - dist: xenial - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - ubuntu-toolchain-r-test - - llvm-toolchain-xenial-8 - packages: - - autoconf - - check - - clang-8 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-xenial-clang8.sh - - name: Bionic gcc-7 and clang-format - os: linux - compiler: gcc-7 - dist: bionic - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - ubuntu-toolchain-r-test - packages: - - autoconf - - check - - clang-format-6.0 - - gcc-7 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-bionic-gcc7.sh - - name: Bionic gcc-8 - os: linux - compiler: gcc-8 - dist: bionic - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - ubuntu-toolchain-r-test - packages: - - autoconf - - check - - gcc-8 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-bionic-gcc8.sh - - name: Bionic gcc-9 - os: linux - compiler: gcc-9 - dist: bionic - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - sourceline: 'ppa:ubuntu-toolchain-r/test' - packages: - - autoconf - - check - - gcc-9 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-bionic-gcc9.sh - - name: Bionic clang-7 - os: linux - compiler: clang-7 - dist: bionic - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - sourceline: 'ppa:ubuntu-toolchain-r/test' - - sourceline: 'deb http://apt.llvm.org/bionic/ llvm-toolchain-bionic-7 main' - key_url: 'https://apt.llvm.org/llvm-snapshot.gpg.key' - packages: - - autoconf - - check - - clang-7 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-bionic-clang7.sh - - name: Bionic clang-8 - os: linux - compiler: clang-8 - dist: bionic - addons: - apt: - sources: - - sourceline: 'ppa:yubico/stable' - - sourceline: 'ppa:ubuntu-toolchain-r/test' - - sourceline: 'deb http://apt.llvm.org/bionic/ llvm-toolchain-bionic-8 main' - key_url: 'https://apt.llvm.org/llvm-snapshot.gpg.key' - packages: - - autoconf - - check - - clang-8 - - gengetopt - - help2man - - libfido2-dev - - libpam-dev - - libssl-dev - - libtool - - pkg-config - script: ./build-aux/ci/build-bionic-clang8.sh - - name: macOS xcode9.4 - os: osx - osx_image: xcode9.4 - compiler: clang - addons: - homebrew: - packages: - - check - - cmake - - gengetopt - - help2man - - mandoc - - openssl@1.1 - - pkg-config - update: true - script: ./build-aux/ci/build-osx9.4-clang.sh - - name: macOS xcode11 - os: osx - osx_image: xcode11 - compiler: clang - addons: - homebrew: - packages: - - check - - cmake - - gengetopt - - help2man - - mandoc - - openssl@1.1 - - pkg-config - update: true - script: ./build-aux/ci/build-osx11-clang.sh diff --git a/external/bsd/pam-u2f/dist/b64.c b/external/bsd/pam-u2f/dist/b64.c index 0649c1e378b..77880894e83 100644 --- a/external/bsd/pam-u2f/dist/b64.c +++ b/external/bsd/pam-u2f/dist/b64.c @@ -4,6 +4,7 @@ #include <openssl/bio.h> #include <openssl/evp.h> +#include <limits.h> #include <stdint.h> #include <string.h> diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang7.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang7.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang7.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang8.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang8.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-clang8.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc7.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc7.sh deleted file mode 100755 index 0a7f276520e..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc7.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -set +x -source $BUILDROOT/build-aux/ci/format-code.sh "$(git rev-parse HEAD~)" -set -x - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc8.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc8.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc8.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc9.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc9.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-bionic-gcc9.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-linux.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-linux.sh deleted file mode 100755 index 77ffd20cafa..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-linux.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -pushd "$BUILDROOT" &>/dev/null - ./autogen.sh - ./configure --disable-silent-rules --disable-man - make check -popd &>/dev/null diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-osx11-clang.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-osx11-clang.sh deleted file mode 100755 index b2a227b3834..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-osx11-clang.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-osx.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-osx9.4-clang.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-osx9.4-clang.sh deleted file mode 100755 index b2a227b3834..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-osx9.4-clang.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-osx.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang7.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang7.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang7.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang8.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang8.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-clang8.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc7.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc7.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc7.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc8.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc8.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc8.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc9.sh b/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc9.sh deleted file mode 100755 index e855574c7a9..00000000000 --- a/external/bsd/pam-u2f/dist/build-aux/ci/build-xenial-gcc9.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash -set -ex - -BUILDROOT="$(git rev-parse --show-toplevel)" - -source $BUILDROOT/build-aux/ci/build-linux.sh diff --git a/external/bsd/pam-u2f/dist/drop_privs.h b/external/bsd/pam-u2f/dist/drop_privs.h index a5256dbde3b..61044cb2771 100644 --- a/external/bsd/pam-u2f/dist/drop_privs.h +++ b/external/bsd/pam-u2f/dist/drop_privs.h @@ -31,6 +31,17 @@ #ifdef HAVE_PAM_MODUTIL_DROP_PRIV #include <security/pam_modutil.h> +#elif HAVE_OPENPAM_BORROW_CRED +#include <sys/types.h> +#include <security/pam_appl.h> +#include <security/openpam.h> + +#define PAM_MODUTIL_DEF_PRIVS(n) /* noop */ +#define pam_modutil_drop_priv(pamh, privs, pwd) \ + ((openpam_borrow_cred((pamh), (pwd)) == PAM_SUCCESS) ? 0 : -1) +#define pam_modutil_regain_priv(pamh, privs) \ + ((openpam_restore_cred((pamh)) == PAM_SUCCESS) ? 0 : -1) + #else #include <pwd.h> @@ -67,5 +78,5 @@ int pam_modutil_drop_priv(pam_handle_t *, struct _ykpam_privs *, struct passwd *); int pam_modutil_regain_priv(pam_handle_t *, struct _ykpam_privs *); -#endif -#endif +#endif /* HAVE_PAM_MODUTIL_DROP_PRIV */ +#endif /* __PAM_U2F_DROP_PRIVS_H_INCLUDED__ */ diff --git a/external/bsd/pam-u2f/dist/pam-u2f.c b/external/bsd/pam-u2f/dist/pam-u2f.c index 6a29f413bb8..46521b5e6dc 100644 --- a/external/bsd/pam-u2f/dist/pam-u2f.c +++ b/external/bsd/pam-u2f/dist/pam-u2f.c @@ -13,6 +13,7 @@ #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> +#include <stdint.h> #include <stdlib.h> #include <syslog.h> #include <pwd.h> @@ -31,8 +32,10 @@ char *secure_getenv(const char *name) { } #endif -static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) { +static void parse_cfg(int flags __unused, int argc, const char **argv, cfg_t *cfg) { +#ifndef WITH_FUZZING struct stat st; +#endif FILE *file = NULL; int fd = -1; int i; @@ -70,6 +73,8 @@ static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) { sscanf(argv[i], "pinverification=%d", &cfg->pinverification); if (strncmp(argv[i], "authfile=", 9) == 0) cfg->auth_file = argv[i] + 9; + if (strncmp(argv[i], "sshformat", 9) == 0) + cfg->sshformat = 1; if (strncmp(argv[i], "authpending_file=", 17) == 0) cfg->authpending_file = argv[i] + 17; if (strncmp(argv[i], "origin=", 7) == 0) @@ -81,6 +86,10 @@ static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) { if (strncmp(argv[i], "cue_prompt=", 11) == 0) cfg->cue_prompt = argv[i] + 11; if (strncmp(argv[i], "debug_file=", 11) == 0) { + if (cfg->is_custom_debug_file) + fclose(cfg->debug_file); + cfg->debug_file = stderr; + cfg->is_custom_debug_file = 0; const char *filename = argv[i] + 11; if (strncmp(filename, "stdout", 6) == 0) { cfg->debug_file = stdout; @@ -91,7 +100,11 @@ static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) { } else { fd = open(filename, O_WRONLY | O_APPEND | O_CLOEXEC | O_NOFOLLOW | O_NOCTTY); +#ifndef WITH_FUZZING if (fd >= 0 && (fstat(fd, &st) == 0) && S_ISREG(st.st_mode)) { +#else + if (fd >= 0) { +#endif file = fdopen(fd, "a"); if (file != NULL) { cfg->debug_file = file; @@ -122,6 +135,7 @@ static void parse_cfg(int flags, int argc, const char **argv, cfg_t *cfg) { D(cfg->debug_file, "nouserok=%d", cfg->nouserok); D(cfg->debug_file, "openasuser=%d", cfg->openasuser); D(cfg->debug_file, "alwaysok=%d", cfg->alwaysok); + D(cfg->debug_file, "sshformat=%d", cfg->sshformat); D(cfg->debug_file, "authfile=%s", cfg->auth_file ? cfg->auth_file : "(null)"); D(cfg->debug_file, "authpending_file=%s", @@ -159,6 +173,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, char *buf = NULL; char *authfile_dir; size_t authfile_dir_len; + const char *default_authfile; + const char *default_authfile_dir; int pgu_ret, gpn_ret; int retval = PAM_IGNORE; device_t *devices = NULL; @@ -174,12 +190,16 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, PAM_MODUTIL_DEF_PRIVS(privs); if (!cfg->origin) { - strcpy(buffer, DEFAULT_ORIGIN_PREFIX); + if (!cfg->sshformat) { + strcpy(buffer, DEFAULT_ORIGIN_PREFIX); - if (gethostname(buffer + strlen(DEFAULT_ORIGIN_PREFIX), - BUFSIZE - strlen(DEFAULT_ORIGIN_PREFIX)) == -1) { - DBG("Unable to get host name"); - goto done; + if (gethostname(buffer + strlen(DEFAULT_ORIGIN_PREFIX), + BUFSIZE - strlen(DEFAULT_ORIGIN_PREFIX)) == -1) { + DBG("Unable to get host name"); + goto done; + } + } else { + strcpy(buffer, SSH_ORIGIN); } DBG("Origin not specified, using \"%s\"", buffer); cfg->origin = strdup(buffer); @@ -207,6 +227,10 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, DBG("Maximum devices number not set. Using default (%d)", MAX_DEVS); cfg->max_devs = MAX_DEVS; } +#if WITH_FUZZING + if (cfg->max_devs > 256) + cfg->max_devs = 256; +#endif devices = calloc(cfg->max_devs, sizeof(device_t)); if (!devices) { @@ -236,14 +260,22 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, DBG("Found user %s", user); DBG("Home directory for %s is %s", user, pw->pw_dir); + if (!cfg->sshformat) { + default_authfile = DEFAULT_AUTHFILE; + default_authfile_dir = DEFAULT_AUTHFILE_DIR; + } else { + default_authfile = DEFAULT_AUTHFILE_SSH; + default_authfile_dir = DEFAULT_AUTHFILE_DIR_SSH; + } + if (!cfg->auth_file) { buf = NULL; authfile_dir = secure_getenv(DEFAULT_AUTHFILE_DIR_VAR); if (!authfile_dir) { - DBG("Variable %s is not set. Using default value ($HOME/.config/)", - DEFAULT_AUTHFILE_DIR_VAR); - authfile_dir_len = - strlen(pw->pw_dir) + strlen("/.config") + strlen(DEFAULT_AUTHFILE) + 1; + DBG("Variable %s is not set. Using default value ($HOME%s/)", + DEFAULT_AUTHFILE_DIR_VAR, default_authfile_dir); + authfile_dir_len = strlen(pw->pw_dir) + strlen(default_authfile_dir) + + strlen(default_authfile) + 1; buf = malloc(sizeof(char) * (authfile_dir_len)); if (!buf) { @@ -255,11 +287,11 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, /* Opening a file in a users $HOME, need to drop privs for security */ openasuser = geteuid() == 0 ? 1 : 0; - snprintf(buf, authfile_dir_len, "%s/.config%s", pw->pw_dir, - DEFAULT_AUTHFILE); + snprintf(buf, authfile_dir_len, "%s%s%s", pw->pw_dir, + default_authfile_dir, default_authfile); } else { DBG("Variable %s set to %s", DEFAULT_AUTHFILE_DIR_VAR, authfile_dir); - authfile_dir_len = strlen(authfile_dir) + strlen(DEFAULT_AUTHFILE) + 1; + authfile_dir_len = strlen(authfile_dir) + strlen(default_authfile) + 1; buf = malloc(sizeof(char) * (authfile_dir_len)); if (!buf) { @@ -268,7 +300,7 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, goto done; } - snprintf(buf, authfile_dir_len, "%s%s", authfile_dir, DEFAULT_AUTHFILE); + snprintf(buf, authfile_dir_len, "%s%s", authfile_dir, default_authfile); if (!cfg->openasuser) { DBG("WARNING: not dropping privileges when reading %s, please " @@ -320,9 +352,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, } DBG("Switched to uid %i", pw->pw_uid); } - retval = - get_devices_from_authfile(cfg->auth_file, user, cfg->max_devs, cfg->debug, - cfg->debug_file, devices, &n_devices); + retval = get_devices_from_authfile(cfg, user, devices, &n_devices); + if (openasuser) { if (pam_modutil_regain_priv(pamh, &privs)) { DBG("could not restore privileges"); @@ -395,8 +426,10 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, if (cfg->manual == 0) { if (cfg->interactive) { - converse(pamh, PAM_PROMPT_ECHO_ON, - cfg->prompt != NULL ? cfg->prompt : DEFAULT_PROMPT); + buf = converse(pamh, PAM_PROMPT_ECHO_ON, + cfg->prompt != NULL ? cfg->prompt : DEFAULT_PROMPT); + free(buf); + buf = NULL; } retval = do_authentication(cfg, devices, n_devices, pamh); @@ -428,7 +461,7 @@ done: free(buf); buf = NULL; } -#define free_const(a) free((void *)(uintptr_t)(a)) +#define free_const(a) free((void *) (uintptr_t)(a)) if (should_free_origin) { free_const(cfg->origin); cfg->origin = NULL; @@ -473,5 +506,5 @@ PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, } #ifdef PAM_MODULE_ENTRY -PAM_MODULE_ENTRY("pam_u2f"); +PAM_MODULE_ENTRY("pam_u2f"); #endif diff --git a/external/bsd/pam-u2f/dist/util.h b/external/bsd/pam-u2f/dist/util.h index 7dc0fcd2737..cc14d6f3985 100644 --- a/external/bsd/pam-u2f/dist/util.h +++ b/external/bsd/pam-u2f/dist/util.h @@ -16,21 +16,24 @@ #define DEVSIZE (((PK_LEN) + (KH_LEN) + (RD_LEN))) #define DEFAULT_AUTHFILE_DIR_VAR "XDG_CONFIG_HOME" #define DEFAULT_AUTHFILE "/Yubico/u2f_keys" +#define DEFAULT_AUTHFILE_SSH "/id_ecdsa_sk" +#define DEFAULT_AUTHFILE_DIR "/.config" +#define DEFAULT_AUTHFILE_DIR_SSH "/.ssh" #define DEFAULT_AUTHPENDING_FILE_PATH "/var/run/user/%d/pam-u2f-authpending" #define DEFAULT_PROMPT "Insert your U2F device, then press ENTER." #define DEFAULT_CUE "Please touch the device." #define DEFAULT_ORIGIN_PREFIX "pam://" +#define SSH_ORIGIN "ssh:" #define DEBUG_STR "debug(pam_u2f): %s:%d (%s): " #if defined(DEBUG_PAM) #define D(file, ...) _debug(file, __FILE__, __LINE__, __func__, __VA_ARGS__) #else -#define D(file, ...) ((void)0) +#define D(file, ...) ((void) 0) #endif /* DEBUG_PAM */ typedef struct { unsigned max_devs; - const char *client_key; int manual; int debug; int nouserok; @@ -42,6 +45,7 @@ typedef struct { int userpresence; int userverification; int pinverification; + int sshformat; const char *auth_file; const char *authpending_file; const char *origin; @@ -60,8 +64,7 @@ typedef struct { int old_format; } device_t; -int get_devices_from_authfile(const char *authfile, const char *username, - unsigned max_devs, int verbose, FILE *debug_file, +int get_devices_from_authfile(const cfg_t *cfg, const char *username, device_t *devices, unsigned *n_devs); void free_devices(device_t *devices, const unsigned n_devs); @@ -70,8 +73,16 @@ int do_authentication(const cfg_t *cfg, const device_t *devices, int do_manual_authentication(const cfg_t *cfg, const device_t *devices, const unsigned n_devs, pam_handle_t *pamh); char *converse(pam_handle_t *pamh, int echocode, const char *prompt); -void _debug(FILE *, const char *, int, const char *, const char *, ...); int random_bytes(void *, size_t); +int cose_type(const char *, int *); +const char *cose_string(int); + +#ifdef __GNUC__ +void _debug(FILE *, const char *, int, const char *, const char *, ...) + __attribute__((__format__(printf, 5, 6))); +#else +void _debug(FILE *, const char *, int, const char *, const char *, ...); +#endif /* __GNUC__ */ #if !defined(HAVE_EXPLICIT_BZERO) void explicit_bzero(void *, size_t); |
