Skip to content

Commit 496c4e9

Browse files
justin-stephensonjustin-stephenson
committed
passkey: Add preflight operation
Also refactor PAM passkey child related operations
1 parent a7d1e9a commit 496c4e9

File tree

10 files changed

+777
-297
lines changed

10 files changed

+777
-297
lines changed

‎Makefile.am‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1516,9 +1516,11 @@ sssd_pam_SOURCES = \
15161516
src/responder/pam/pam_prompting_config.c \
15171517
src/sss_client/pam_sss_prompt_config.c \
15181518
src/responder/pam/pam_helpers.c \
1519+
src/krb5_plugin/common/utils.c \
15191520
$(SSSD_RESPONDER_OBJ)
15201521
if BUILD_PASSKEY
1521-
sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c
1522+
sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c \
1523+
src/krb5_plugin/passkey/passkey_utils.c
15221524
endif
15231525
sssd_pam_CFLAGS = \
15241526
$(AM_CFLAGS) \
@@ -1528,6 +1530,7 @@ sssd_pam_LDADD = \
15281530
$(LIBADD_DL) \
15291531
$(TDB_LIBS) \
15301532
$(SSSD_LIBS) \
1533+
$(JANSSON_LIBS) \
15311534
$(SELINUX_LIBS) \
15321535
$(PAM_LIBS) \
15331536
$(GSSAPI_KRB5_LIBS) \
@@ -2563,6 +2566,7 @@ pam_srv_tests_SOURCES = \
25632566
src/responder/pam/pamsrv_dp.c \
25642567
src/responder/pam/pam_prompting_config.c \
25652568
src/sss_client/pam_sss_prompt_config.c \
2569+
src/krb5_plugin/common/utils.c \
25662570
$(NULL)
25672571
pam_srv_tests_CFLAGS = \
25682572
-U SSSD_LIBEXEC_PATH -DSSSD_LIBEXEC_PATH=\"$(abs_builddir)\" \
@@ -2584,6 +2588,7 @@ pam_srv_tests_LDADD = \
25842588
$(PAM_LIBS) \
25852589
$(SSSD_LIBS) \
25862590
$(SSSD_INTERNAL_LTLIBS) \
2591+
$(JANSSON_LIBS) \
25872592
$(GSSAPI_KRB5_LIBS) \
25882593
libsss_test_common.la \
25892594
libsss_idmap.la \
@@ -2592,7 +2597,8 @@ pam_srv_tests_LDADD = \
25922597
libsss_sbus.la \
25932598
$(NULL)
25942599
if BUILD_PASSKEY
2595-
pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c
2600+
pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c \
2601+
src/krb5_plugin/passkey/passkey_utils.c
25962602
endif # BUILD_PASSKEY
25972603

25982604
EXTRA_ssh_srv_tests_DEPENDENCIES = \

‎src/krb5_plugin/passkey/passkey.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ sss_passkey_message_encode_padata(const struct sss_passkey_message *data);
100100
struct sss_passkey_message *
101101
sss_passkey_message_decode_padata(krb5_pa_data *padata);
102102

103+
int
104+
sss_passkey_preflight_from_json(const char *json_str,
105+
int *_pin_required,
106+
int *_attempts);
107+
103108
krb5_pa_data **
104109
sss_passkey_message_encode_padata_array(const struct sss_passkey_message *data);
105110

‎src/krb5_plugin/passkey/passkey_utils.c‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,42 @@ sss_passkey_message_from_reply_json(enum sss_passkey_phase phase,
561561
return message;
562562
}
563563

564+
int
565+
sss_passkey_preflight_from_json(const char *json_str,
566+
int *_pin_required,
567+
int *_attempts)
568+
{
569+
json_t *jroot;
570+
json_error_t jret;
571+
int ret;
572+
int pin_required;
573+
int attempts;
574+
575+
jroot = json_loads(json_str, 0, &jret);
576+
if (jroot == NULL) {
577+
return ENOMEM;
578+
}
579+
580+
ret = json_unpack(jroot, "{s:b, s:i}",
581+
"pin_required", &pin_required,
582+
"attempts", &attempts);
583+
if (ret != 0) {
584+
ret = EINVAL;
585+
goto done;
586+
}
587+
588+
*_pin_required = pin_required;
589+
*_attempts = attempts;
590+
591+
ret = 0;
592+
done:
593+
if (jroot != NULL) {
594+
json_decref(jroot);
595+
}
596+
597+
return ret;
598+
}
599+
564600
char *
565601
sss_passkey_message_encode(const struct sss_passkey_message *data)
566602
{

‎src/responder/pam/pamsrv_cmd.c‎

Lines changed: 30 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1512,7 +1512,18 @@ void pam_reply(struct pam_auth_req *preq)
15121512
&& !pk_preauth_done
15131513
&& preq->passkey_data_exists
15141514
&& local_passkey_auth_allow) {
1515-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
1515+
if (pd->cmd == SSS_PAM_PREAUTH) {
1516+
/* execute passkey child preflight operation, in passkey_preflight_done()
1517+
* pam_reply is called */
1518+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, PAM_PASSKEY_OP_PREFLIGHT);
1519+
if (ret != EOK) {
1520+
DEBUG(SSSDBG_OP_FAILURE,
1521+
"Passkey child execute failed %s [%d].\n", sss_strerror(ret), ret);
1522+
goto done;
1523+
}
1524+
return;
1525+
}
1526+
15161527
pam_check_user_done(preq, ret);
15171528
return;
15181529
}
@@ -1897,6 +1908,9 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
18971908
struct pam_auth_req *preq;
18981909
struct pam_data *pd;
18991910
int ret;
1911+
#ifdef BUILD_PASSKEY
1912+
enum passkey_child_op passkey_op = PAM_PASSKEY_OP_INVALID;
1913+
#endif
19001914
struct pam_ctx *pctx =
19011915
talloc_get_type(cctx->rctx->pvt_ctx, struct pam_ctx);
19021916
struct tevent_req *req;
@@ -1978,11 +1992,14 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
19781992
if ((pd->cmd == SSS_PAM_AUTHENTICATE)) {
19791993
if (may_do_passkey_auth(pctx, pd)) {
19801994
if (sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY_KRB) {
1981-
ret = passkey_kerberos(pctx, preq->pd, preq);
1982-
goto done;
1995+
passkey_op = PAM_PASSKEY_OP_KERBEROS_AUTH;
19831996
} else if ((sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY) ||
19841997
(sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_EMPTY)) {
1985-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
1998+
passkey_op = PAM_PASSKEY_OP_LOCAL_AUTH;
1999+
}
2000+
2001+
if (passkey_op == PAM_PASSKEY_OP_KERBEROS_AUTH || passkey_op == PAM_PASSKEY_OP_LOCAL_AUTH) {
2002+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, passkey_op);
19862003
goto done;
19872004
}
19882005
}
@@ -2349,6 +2366,9 @@ static void pam_forwarder_cb(struct tevent_req *req)
23492366
struct cli_ctx *cctx = preq->cctx;
23502367
struct pam_data *pd;
23512368
errno_t ret = EOK;
2369+
#ifdef BUILD_PASSKEY
2370+
enum passkey_child_op passkey_op = PAM_PASSKEY_OP_INVALID;
2371+
#endif
23522372
struct pam_ctx *pctx =
23532373
talloc_get_type(preq->cctx->rctx->pvt_ctx, struct pam_ctx);
23542374

@@ -2398,11 +2418,14 @@ static void pam_forwarder_cb(struct tevent_req *req)
23982418
if ((pd->cmd == SSS_PAM_AUTHENTICATE)) {
23992419
if (may_do_passkey_auth(pctx, pd)) {
24002420
if (sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY_KRB) {
2401-
ret = passkey_kerberos(pctx, preq->pd, preq);
2402-
goto done;
2421+
passkey_op = PAM_PASSKEY_OP_KERBEROS_AUTH;
24032422
} else if ((sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY) ||
24042423
(sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_EMPTY)) {
2405-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
2424+
passkey_op = PAM_PASSKEY_OP_LOCAL_AUTH;
2425+
}
2426+
2427+
if (passkey_op == PAM_PASSKEY_OP_KERBEROS_AUTH || passkey_op == PAM_PASSKEY_OP_LOCAL_AUTH) {
2428+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, passkey_op);
24062429
goto done;
24072430
}
24082431
}

0 commit comments

Comments
 (0)