Skip to content

Commit 927859b

Browse files
justin-stephensonjustin-stephenson
committed
passkey: Add preflight operation
Also refactor PAM passkey child related operations
1 parent b34e924 commit 927859b

File tree

11 files changed

+792
-298
lines changed

11 files changed

+792
-298
lines changed

‎Makefile.am‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1527,9 +1527,11 @@ sssd_pam_SOURCES = \
15271527
src/responder/pam/pam_prompting_config.c \
15281528
src/sss_client/pam_sss_prompt_config.c \
15291529
src/responder/pam/pam_helpers.c \
1530+
src/krb5_plugin/common/utils.c \
15301531
$(SSSD_RESPONDER_OBJ)
15311532
if BUILD_PASSKEY
1532-
sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c
1533+
sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c \
1534+
src/krb5_plugin/passkey/passkey_utils.c
15331535
endif
15341536
sssd_pam_CFLAGS = \
15351537
$(AM_CFLAGS) \
@@ -1539,6 +1541,7 @@ sssd_pam_LDADD = \
15391541
$(LIBADD_DL) \
15401542
$(TDB_LIBS) \
15411543
$(SSSD_LIBS) \
1544+
$(JANSSON_LIBS) \
15421545
$(SELINUX_LIBS) \
15431546
$(PAM_LIBS) \
15441547
$(GSSAPI_KRB5_LIBS) \
@@ -2574,6 +2577,7 @@ pam_srv_tests_SOURCES = \
25742577
src/responder/pam/pamsrv_dp.c \
25752578
src/responder/pam/pam_prompting_config.c \
25762579
src/sss_client/pam_sss_prompt_config.c \
2580+
src/krb5_plugin/common/utils.c \
25772581
$(NULL)
25782582
pam_srv_tests_CFLAGS = \
25792583
-U SSSD_LIBEXEC_PATH -DSSSD_LIBEXEC_PATH=\"$(abs_builddir)\" \
@@ -2595,6 +2599,7 @@ pam_srv_tests_LDADD = \
25952599
$(PAM_LIBS) \
25962600
$(SSSD_LIBS) \
25972601
$(SSSD_INTERNAL_LTLIBS) \
2602+
$(JANSSON_LIBS) \
25982603
$(GSSAPI_KRB5_LIBS) \
25992604
libsss_test_common.la \
26002605
libsss_idmap.la \
@@ -2603,7 +2608,8 @@ pam_srv_tests_LDADD = \
26032608
libsss_sbus.la \
26042609
$(NULL)
26052610
if BUILD_PASSKEY
2606-
pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c
2611+
pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c \
2612+
src/krb5_plugin/passkey/passkey_utils.c
26072613
endif # BUILD_PASSKEY
26082614

26092615
EXTRA_ssh_srv_tests_DEPENDENCIES = \

‎src/krb5_plugin/passkey/passkey.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ sss_passkey_message_encode_padata(const struct sss_passkey_message *data);
100100
struct sss_passkey_message *
101101
sss_passkey_message_decode_padata(krb5_pa_data *padata);
102102

103+
int
104+
sss_passkey_preflight_from_json(const char *json_str,
105+
int *_pin_required,
106+
int *_attempts);
107+
103108
krb5_pa_data **
104109
sss_passkey_message_encode_padata_array(const struct sss_passkey_message *data);
105110

‎src/krb5_plugin/passkey/passkey_utils.c‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,42 @@ sss_passkey_message_from_reply_json(enum sss_passkey_phase phase,
561561
return message;
562562
}
563563

564+
int
565+
sss_passkey_preflight_from_json(const char *json_str,
566+
int *_pin_required,
567+
int *_attempts)
568+
{
569+
json_t *jroot;
570+
json_error_t jret;
571+
int ret;
572+
int pin_required;
573+
int attempts;
574+
575+
jroot = json_loads(json_str, 0, &jret);
576+
if (jroot == NULL) {
577+
return ENOMEM;
578+
}
579+
580+
ret = json_unpack(jroot, "{s:b, s:i}",
581+
"pin_required", &pin_required,
582+
"attempts", &attempts);
583+
if (ret != 0) {
584+
ret = EINVAL;
585+
goto done;
586+
}
587+
588+
*_pin_required = pin_required;
589+
*_attempts = attempts;
590+
591+
ret = 0;
592+
done:
593+
if (jroot != NULL) {
594+
json_decref(jroot);
595+
}
596+
597+
return ret;
598+
}
599+
564600
char *
565601
sss_passkey_message_encode(const struct sss_passkey_message *data)
566602
{

‎src/responder/pam/pamsrv.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ struct pam_auth_req {
106106
bool initial_cert_auth_successful;
107107

108108
bool passkey_data_exists;
109+
struct pam_preflight_data *pam_pf_data;
109110
uint32_t client_id_num;
110111
};
111112

‎src/responder/pam/pamsrv_cmd.c‎

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1269,6 +1269,16 @@ void pam_reply(struct pam_auth_req *preq)
12691269
local_sc_auth_allow ? "True" : "False",
12701270
local_passkey_auth_allow ? "True" : "False");
12711271

1272+
/* Passkey preflight data */
1273+
if (preq->pam_pf_data == NULL) {
1274+
preq->pam_pf_data = talloc_zero(preq, struct pam_preflight_data);
1275+
if (preq->pam_pf_data == NULL) {
1276+
DEBUG(SSSDBG_CRIT_FAILURE, "pam_pf_data == NULL\n");
1277+
ret = ENOMEM;
1278+
goto done;
1279+
}
1280+
}
1281+
12721282
if (pd->cmd == SSS_PAM_AUTHENTICATE
12731283
&& !preq->cert_auth_local
12741284
&& (pd->pam_status == PAM_AUTHINFO_UNAVAIL
@@ -1512,8 +1522,14 @@ void pam_reply(struct pam_auth_req *preq)
15121522
&& !pk_preauth_done
15131523
&& preq->passkey_data_exists
15141524
&& local_passkey_auth_allow) {
1515-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
1516-
pam_check_user_done(preq, ret);
1525+
/* First execute passkey child preflight operation, once completed another call to pam_reply() *
1526+
* is made with preq->pam_pf_data->obtained set to true */
1527+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, PAM_PASSKEY_OP_PREFLIGHT);
1528+
if (ret != EOK) {
1529+
DEBUG(SSSDBG_OP_FAILURE,
1530+
"Passkey child execute failed %s [%d].\n", sss_strerror(ret), ret);
1531+
goto done;
1532+
}
15171533
return;
15181534
}
15191535
#endif /* BUILD_PASSKEY */
@@ -1897,6 +1913,9 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
18971913
struct pam_auth_req *preq;
18981914
struct pam_data *pd;
18991915
int ret;
1916+
#ifdef BUILD_PASSKEY
1917+
enum passkey_child_op passkey_op = PAM_PASSKEY_OP_INVALID;
1918+
#endif
19001919
struct pam_ctx *pctx =
19011920
talloc_get_type(cctx->rctx->pvt_ctx, struct pam_ctx);
19021921
struct tevent_req *req;
@@ -1978,11 +1997,14 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
19781997
if ((pd->cmd == SSS_PAM_AUTHENTICATE)) {
19791998
if (may_do_passkey_auth(pctx, pd)) {
19801999
if (sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY_KRB) {
1981-
ret = passkey_kerberos(pctx, preq->pd, preq);
1982-
goto done;
2000+
passkey_op = PAM_PASSKEY_OP_KERBEROS_AUTH;
19832001
} else if ((sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY) ||
19842002
(sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_EMPTY)) {
1985-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
2003+
passkey_op = PAM_PASSKEY_OP_LOCAL_AUTH;
2004+
}
2005+
2006+
if (passkey_op == PAM_PASSKEY_OP_KERBEROS_AUTH || passkey_op == PAM_PASSKEY_OP_LOCAL_AUTH) {
2007+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, passkey_op);
19862008
goto done;
19872009
}
19882010
}
@@ -2349,6 +2371,9 @@ static void pam_forwarder_cb(struct tevent_req *req)
23492371
struct cli_ctx *cctx = preq->cctx;
23502372
struct pam_data *pd;
23512373
errno_t ret = EOK;
2374+
#ifdef BUILD_PASSKEY
2375+
enum passkey_child_op passkey_op = PAM_PASSKEY_OP_INVALID;
2376+
#endif
23522377
struct pam_ctx *pctx =
23532378
talloc_get_type(preq->cctx->rctx->pvt_ctx, struct pam_ctx);
23542379

@@ -2398,11 +2423,14 @@ static void pam_forwarder_cb(struct tevent_req *req)
23982423
if ((pd->cmd == SSS_PAM_AUTHENTICATE)) {
23992424
if (may_do_passkey_auth(pctx, pd)) {
24002425
if (sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY_KRB) {
2401-
ret = passkey_kerberos(pctx, preq->pd, preq);
2402-
goto done;
2426+
passkey_op = PAM_PASSKEY_OP_KERBEROS_AUTH;
24032427
} else if ((sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY) ||
24042428
(sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_EMPTY)) {
2405-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
2429+
passkey_op = PAM_PASSKEY_OP_LOCAL_AUTH;
2430+
}
2431+
2432+
if (passkey_op == PAM_PASSKEY_OP_KERBEROS_AUTH || passkey_op == PAM_PASSKEY_OP_LOCAL_AUTH) {
2433+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, passkey_op);
24062434
goto done;
24072435
}
24082436
}

0 commit comments

Comments
 (0)