Skip to content

Commit ee7e765

Browse files
justin-stephensonjustin-stephenson
committed
passkey: Add preflight operation
Also refactor PAM passkey child related operations
1 parent 65c1b51 commit ee7e765

File tree

10 files changed

+777
-297
lines changed

10 files changed

+777
-297
lines changed

‎Makefile.am‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1527,9 +1527,11 @@ sssd_pam_SOURCES = \
15271527
src/responder/pam/pam_prompting_config.c \
15281528
src/sss_client/pam_sss_prompt_config.c \
15291529
src/responder/pam/pam_helpers.c \
1530+
src/krb5_plugin/common/utils.c \
15301531
$(SSSD_RESPONDER_OBJ)
15311532
if BUILD_PASSKEY
1532-
sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c
1533+
sssd_pam_SOURCES += src/responder/pam/pamsrv_passkey.c \
1534+
src/krb5_plugin/passkey/passkey_utils.c
15331535
endif
15341536
sssd_pam_CFLAGS = \
15351537
$(AM_CFLAGS) \
@@ -1539,6 +1541,7 @@ sssd_pam_LDADD = \
15391541
$(LIBADD_DL) \
15401542
$(TDB_LIBS) \
15411543
$(SSSD_LIBS) \
1544+
$(JANSSON_LIBS) \
15421545
$(SELINUX_LIBS) \
15431546
$(PAM_LIBS) \
15441547
$(GSSAPI_KRB5_LIBS) \
@@ -2574,6 +2577,7 @@ pam_srv_tests_SOURCES = \
25742577
src/responder/pam/pamsrv_dp.c \
25752578
src/responder/pam/pam_prompting_config.c \
25762579
src/sss_client/pam_sss_prompt_config.c \
2580+
src/krb5_plugin/common/utils.c \
25772581
$(NULL)
25782582
pam_srv_tests_CFLAGS = \
25792583
-U SSSD_LIBEXEC_PATH -DSSSD_LIBEXEC_PATH=\"$(abs_builddir)\" \
@@ -2595,6 +2599,7 @@ pam_srv_tests_LDADD = \
25952599
$(PAM_LIBS) \
25962600
$(SSSD_LIBS) \
25972601
$(SSSD_INTERNAL_LTLIBS) \
2602+
$(JANSSON_LIBS) \
25982603
$(GSSAPI_KRB5_LIBS) \
25992604
libsss_test_common.la \
26002605
libsss_idmap.la \
@@ -2603,7 +2608,8 @@ pam_srv_tests_LDADD = \
26032608
libsss_sbus.la \
26042609
$(NULL)
26052610
if BUILD_PASSKEY
2606-
pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c
2611+
pam_srv_tests_SOURCES += src/responder/pam/pamsrv_passkey.c \
2612+
src/krb5_plugin/passkey/passkey_utils.c
26072613
endif # BUILD_PASSKEY
26082614

26092615
EXTRA_ssh_srv_tests_DEPENDENCIES = \

‎src/krb5_plugin/passkey/passkey.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ sss_passkey_message_encode_padata(const struct sss_passkey_message *data);
100100
struct sss_passkey_message *
101101
sss_passkey_message_decode_padata(krb5_pa_data *padata);
102102

103+
int
104+
sss_passkey_preflight_from_json(const char *json_str,
105+
int *_pin_required,
106+
int *_attempts);
107+
103108
krb5_pa_data **
104109
sss_passkey_message_encode_padata_array(const struct sss_passkey_message *data);
105110

‎src/krb5_plugin/passkey/passkey_utils.c‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,42 @@ sss_passkey_message_from_reply_json(enum sss_passkey_phase phase,
561561
return message;
562562
}
563563

564+
int
565+
sss_passkey_preflight_from_json(const char *json_str,
566+
int *_pin_required,
567+
int *_attempts)
568+
{
569+
json_t *jroot;
570+
json_error_t jret;
571+
int ret;
572+
int pin_required;
573+
int attempts;
574+
575+
jroot = json_loads(json_str, 0, &jret);
576+
if (jroot == NULL) {
577+
return ENOMEM;
578+
}
579+
580+
ret = json_unpack(jroot, "{s:b, s:i}",
581+
"pin_required", &pin_required,
582+
"attempts", &attempts);
583+
if (ret != 0) {
584+
ret = EINVAL;
585+
goto done;
586+
}
587+
588+
*_pin_required = pin_required;
589+
*_attempts = attempts;
590+
591+
ret = 0;
592+
done:
593+
if (jroot != NULL) {
594+
json_decref(jroot);
595+
}
596+
597+
return ret;
598+
}
599+
564600
char *
565601
sss_passkey_message_encode(const struct sss_passkey_message *data)
566602
{

‎src/responder/pam/pamsrv_cmd.c‎

Lines changed: 30 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1512,7 +1512,18 @@ void pam_reply(struct pam_auth_req *preq)
15121512
&& !pk_preauth_done
15131513
&& preq->passkey_data_exists
15141514
&& local_passkey_auth_allow) {
1515-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
1515+
if (pd->cmd == SSS_PAM_PREAUTH) {
1516+
/* execute passkey child preflight operation, in passkey_preflight_done()
1517+
* pam_reply is called */
1518+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, PAM_PASSKEY_OP_PREFLIGHT);
1519+
if (ret != EOK) {
1520+
DEBUG(SSSDBG_OP_FAILURE,
1521+
"Passkey child execute failed %s [%d].\n", sss_strerror(ret), ret);
1522+
goto done;
1523+
}
1524+
return;
1525+
}
1526+
15161527
pam_check_user_done(preq, ret);
15171528
return;
15181529
}
@@ -1897,6 +1908,9 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
18971908
struct pam_auth_req *preq;
18981909
struct pam_data *pd;
18991910
int ret;
1911+
#ifdef BUILD_PASSKEY
1912+
enum passkey_child_op passkey_op = PAM_PASSKEY_OP_INVALID;
1913+
#endif
19001914
struct pam_ctx *pctx =
19011915
talloc_get_type(cctx->rctx->pvt_ctx, struct pam_ctx);
19021916
struct tevent_req *req;
@@ -1978,11 +1992,14 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
19781992
if ((pd->cmd == SSS_PAM_AUTHENTICATE)) {
19791993
if (may_do_passkey_auth(pctx, pd)) {
19801994
if (sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY_KRB) {
1981-
ret = passkey_kerberos(pctx, preq->pd, preq);
1982-
goto done;
1995+
passkey_op = PAM_PASSKEY_OP_KERBEROS_AUTH;
19831996
} else if ((sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY) ||
19841997
(sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_EMPTY)) {
1985-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
1998+
passkey_op = PAM_PASSKEY_OP_LOCAL_AUTH;
1999+
}
2000+
2001+
if (passkey_op == PAM_PASSKEY_OP_KERBEROS_AUTH || passkey_op == PAM_PASSKEY_OP_LOCAL_AUTH) {
2002+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, passkey_op);
19862003
goto done;
19872004
}
19882005
}
@@ -2349,6 +2366,9 @@ static void pam_forwarder_cb(struct tevent_req *req)
23492366
struct cli_ctx *cctx = preq->cctx;
23502367
struct pam_data *pd;
23512368
errno_t ret = EOK;
2369+
#ifdef BUILD_PASSKEY
2370+
enum passkey_child_op passkey_op = PAM_PASSKEY_OP_INVALID;
2371+
#endif
23522372
struct pam_ctx *pctx =
23532373
talloc_get_type(preq->cctx->rctx->pvt_ctx, struct pam_ctx);
23542374

@@ -2398,11 +2418,14 @@ static void pam_forwarder_cb(struct tevent_req *req)
23982418
if ((pd->cmd == SSS_PAM_AUTHENTICATE)) {
23992419
if (may_do_passkey_auth(pctx, pd)) {
24002420
if (sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY_KRB) {
2401-
ret = passkey_kerberos(pctx, preq->pd, preq);
2402-
goto done;
2421+
passkey_op = PAM_PASSKEY_OP_KERBEROS_AUTH;
24032422
} else if ((sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_PASSKEY) ||
24042423
(sss_authtok_get_type(pd->authtok) == SSS_AUTHTOK_TYPE_EMPTY)) {
2405-
ret = passkey_local(cctx, cctx->ev, pctx, preq, pd);
2424+
passkey_op = PAM_PASSKEY_OP_LOCAL_AUTH;
2425+
}
2426+
2427+
if (passkey_op == PAM_PASSKEY_OP_KERBEROS_AUTH || passkey_op == PAM_PASSKEY_OP_LOCAL_AUTH) {
2428+
ret = passkey_child_execute(cctx, cctx, cctx->ev, preq, pctx, pd, passkey_op);
24062429
goto done;
24072430
}
24082431
}

0 commit comments

Comments
 (0)