Skip to content

Commit 1135643

Browse files
justin-stephensonjustin-stephenson
committed
passkey: Add preflight operation
Also refactor PAM passkey child related operations
1 parent 35a2810 commit 1135643

File tree

11 files changed

+788
-298
lines changed

11 files changed

+788
-298
lines changed

‎Makefile.am‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1523,9 +1523,11 @@ sssd_pam_SOURCES = \
15231523
src/responder/pam/pam_prompting_config.c \
15241524
src/sss_client/pam_sss_prompt_config.c \
15251525
src/responder/pam/pam_helpers.c \
1526+
src/krb5_plugin/common/utils.c \
15261527
$(SSSD_RESPONDER_OBJ)
15271528
if BUILD_PASSKEY
1528-
sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c
1529+
sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c \
1530+
src/krb5_plugin/passkey/passkey_utils.c
15291531
endif
15301532
sssd_pam_CFLAGS = \
15311533
$(AM_CFLAGS) \
@@ -1535,6 +1537,7 @@ sssd_pam_LDADD = \
15351537
$(LIBADD_DL) \
15361538
$(TDB_LIBS) \
15371539
$(SSSD_LIBS) \
1540+
$(JANSSON_LIBS) \
15381541
$(SELINUX_LIBS) \
15391542
$(PAM_LIBS) \
15401543
$(GSSAPI_KRB5_LIBS) \
@@ -2570,6 +2573,7 @@ pam_srv_tests_SOURCES = \
25702573
src/responder/pam/pamsrv_dp.c \
25712574
src/responder/pam/pam_prompting_config.c \
25722575
src/sss_client/pam_sss_prompt_config.c \
2576+
src/krb5_plugin/common/utils.c \
25732577
$(NULL)
25742578
pam_srv_tests_CFLAGS = \
25752579
-U SSSD_LIBEXEC_PATH -DSSSD_LIBEXEC_PATH=\"$(abs_builddir)\" \
@@ -2591,6 +2595,7 @@ pam_srv_tests_LDADD = \
25912595
$(PAM_LIBS) \
25922596
$(SSSD_LIBS) \
25932597
$(SSSD_INTERNAL_LTLIBS) \
2598+
$(JANSSON_LIBS) \
25942599
$(GSSAPI_KRB5_LIBS) \
25952600
libsss_test_common.la \
25962601
libsss_idmap.la \
@@ -2599,7 +2604,8 @@ pam_srv_tests_LDADD = \
25992604
libsss_sbus.la \
26002605
$(NULL)
26012606
if BUILD_PASSKEY
2602-
pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c
2607+
pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c \
2608+
src/krb5_plugin/passkey/passkey_utils.c
26032609
endif # BUILD_PASSKEY
26042610

26052611
EXTRA_ssh_srv_tests_DEPENDENCIES = \

‎src/krb5_plugin/passkey/passkey.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#define _PASSKEY_H_
2323

2424
#include <stdlib.h>
25+
#include <stdbool.h>
2526
#include <krb5/preauth_plugin.h>
2627

2728
#ifndef discard_const
@@ -100,6 +101,11 @@ sss_passkey_message_encode_padata(const struct sss_passkey_message *data);
100101
struct sss_passkey_message *
101102
sss_passkey_message_decode_padata(krb5_pa_data *padata);
102103

104+
int
105+
sss_passkey_preflight_from_json(const char *json_str,
106+
bool *_pin_required,
107+
int *_attempts);
108+
103109
krb5_pa_data **
104110
sss_passkey_message_encode_padata_array(const struct sss_passkey_message *data);
105111

‎src/krb5_plugin/passkey/passkey_utils.c‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
#include <stdint.h>
2525
#include <stdio.h>
2626
#include <stdlib.h>
27+
#include <stdbool.h>
2728
#include <string.h>
2829
#include <jansson.h>
2930
#include <arpa/inet.h>
@@ -561,6 +562,42 @@ sss_passkey_message_from_reply_json(enum sss_passkey_phase phase,
561562
return message;
562563
}
563564

565+
int
566+
sss_passkey_preflight_from_json(const char *json_str,
567+
bool *_pin_required,
568+
int *_attempts)
569+
{
570+
json_t *jroot;
571+
json_error_t jret;
572+
int ret;
573+
bool pin_required;
574+
int attempts;
575+
576+
jroot = json_loads(json_str, 0, &jret);
577+
if (jroot == NULL) {
578+
return ENOMEM;
579+
}
580+
581+
ret = json_unpack(jroot, "{s:b, s:i}",
582+
"pin_required", &pin_required,
583+
"attempts", &attempts);
584+
if (ret != 0) {
585+
ret = EINVAL;
586+
goto done;
587+
}
588+
589+
*_pin_required = pin_required;
590+
*_attempts = attempts;
591+
592+
ret = 0;
593+
done:
594+
if (jroot != NULL) {
595+
json_decref(jroot);
596+
}
597+
598+
return ret;
599+
}
600+
564601
char *
565602
sss_passkey_message_encode(const struct sss_passkey_message *data)
566603
{

‎src/responder/pam/pamsrv.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ struct pam_auth_req {
106106
bool initial_cert_auth_successful;
107107

108108
bool passkey_data_exists;
109+
struct pam_preflight_data *pam_pf_data;
109110
uint32_t client_id_num;
110111
};
111112

‎src/responder/pam/pamsrv_cmd.c‎

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1270,6 +1270,16 @@ void pam_reply(struct pam_auth_req *preq)
12701270
local_sc_auth_allow ? "True" : "False",
12711271
local_passkey_auth_allow ? "True" : "False");
12721272

1273+
/* Passkey preflight data */
1274+
if (preq->pam_pf_data == NULL) {
1275+
preq->pam_pf_data = talloc_zero(preq, struct pam_preflight_data);
1276+
if (preq->pam_pf_data == NULL) {
1277+
DEBUG(SSSDBG_CRIT_FAILURE, "pam_pf_data == NULL\n");
1278+
ret = ENOMEM;
1279+
goto done;
1280+
}
1281+
}
1282+
12731283
if (pd->cmd == SSS_PAM_AUTHENTICATE
12741284
&& !preq->cert_auth_local
12751285
&& (pd->pam_status == PAM_AUTHINFO_UNAVAIL
@@ -1513,8 +1523,14 @@ void pam_reply(struct pam_auth_req *preq)
15131523
&& !pk_preauth_done
15141524
&& preq->passkey_data_exists
15151525
&& local_passkey_auth_allow) {
1516-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
1517-
pam_check_user_done(preq, ret);
1526+
/* First execute passkey child preflight operation, once completed another call to pam_reply() *
1527+
* is made with preq->pam_pf_data->obtained set to true */
1528+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, PAM_PASSKEY_OP_PREFLIGHT);
1529+
if (ret != EOK) {
1530+
DEBUG(SSSDBG_OP_FAILURE,
1531+
"Passkey child execute failed %s [%d].\n", sss_strerror(ret), ret);
1532+
goto done;
1533+
}
15181534
return;
15191535
}
15201536
#endif /* BUILD_PASSKEY */
@@ -1898,6 +1914,9 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
18981914
struct pam_auth_req *preq;
18991915
struct pam_data *pd;
19001916
int ret;
1917+
#ifdef BUILD_PASSKEY
1918+
enum passkey_child_op passkey_op = PAM_PASSKEY_OP_INVALID;
1919+
#endif
19011920
struct pam_ctx *pctx =
19021921
talloc_get_type(cctx->rctx->pvt_ctx, struct pam_ctx);
19031922
struct tevent_req *req;
@@ -1979,11 +1998,14 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
19791998
if ((pd->cmd == SSS_PAM_AUTHENTICATE)) {
19801999
if (may_do_passkey_auth(pctx, pd)) {
19812000
if (sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY_KRB) {
1982-
ret = passkey_kerberos(pctx, preq->pd, preq);
1983-
goto done;
2001+
passkey_op = PAM_PASSKEY_OP_KERBEROS_AUTH;
19842002
} else if ((sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY) ||
19852003
(sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_EMPTY)) {
1986-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
2004+
passkey_op = PAM_PASSKEY_OP_LOCAL_AUTH;
2005+
}
2006+
2007+
if (passkey_op == PAM_PASSKEY_OP_KERBEROS_AUTH || passkey_op == PAM_PASSKEY_OP_LOCAL_AUTH) {
2008+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, passkey_op);
19872009
goto done;
19882010
}
19892011
}
@@ -2350,6 +2372,9 @@ static void pam_forwarder_cb(struct tevent_req *req)
23502372
struct cli_ctx *cctx = preq->cctx;
23512373
struct pam_data *pd;
23522374
errno_t ret = EOK;
2375+
#ifdef BUILD_PASSKEY
2376+
enum passkey_child_op passkey_op = PAM_PASSKEY_OP_INVALID;
2377+
#endif
23532378
struct pam_ctx *pctx =
23542379
talloc_get_type(preq->cctx->rctx->pvt_ctx, struct pam_ctx);
23552380

@@ -2399,11 +2424,14 @@ static void pam_forwarder_cb(struct tevent_req *req)
23992424
if ((pd->cmd == SSS_PAM_AUTHENTICATE)) {
24002425
if (may_do_passkey_auth(pctx, pd)) {
24012426
if (sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY_KRB) {
2402-
ret = passkey_kerberos(pctx, preq->pd, preq);
2403-
goto done;
2427+
passkey_op = PAM_PASSKEY_OP_KERBEROS_AUTH;
24042428
} else if ((sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY) ||
24052429
(sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_EMPTY)) {
2406-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
2430+
passkey_op = PAM_PASSKEY_OP_LOCAL_AUTH;
2431+
}
2432+
2433+
if (passkey_op == PAM_PASSKEY_OP_KERBEROS_AUTH || passkey_op == PAM_PASSKEY_OP_LOCAL_AUTH) {
2434+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, passkey_op);
24072435
goto done;
24082436
}
24092437
}

0 commit comments

Comments
 (0)