1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
#include <mysql/plugin_auth.h>
#include <string.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>
struct param {
unsigned char buf[10240], *ptr;
MYSQL_PLUGIN_VIO *vio;
};
static int conv(int n, const struct pam_message **msg,
struct pam_response **resp, void *data)
{
struct param *param = (struct param *)data;
unsigned char *end = param->buf + sizeof(param->buf) - 1;
int i;
*resp = 0;
for (i = 0; i < n; i++)
{
/* if there's a message - append it to the buffer */
if (msg[i]->msg)
{
int len = strlen(msg[i]->msg);
if (len > end - param->ptr)
len = end - param->ptr;
if (len > 0)
{
memcpy(param->ptr, msg[i]->msg, len);
param->ptr+= len;
*(param->ptr)++ = '\n';
}
}
/* if the message style is *_PROMPT_*, meaning PAM asks a question,
send the accumulated text to the client, read the reply */
if (msg[i]->msg_style == PAM_PROMPT_ECHO_OFF ||
msg[i]->msg_style == PAM_PROMPT_ECHO_ON)
{
int pkt_len;
unsigned char *pkt;
/* allocate the response array.
freeing it is the responsibility of the caller */
if (*resp == 0)
{
*resp = calloc(sizeof(struct pam_response), n);
if (*resp == 0)
return PAM_BUF_ERR;
}
/* dialog plugin interprets the first byte of the packet
as the magic number.
2 means "read the input with the echo enabled"
4 means "password-like input, echo disabled"
C'est la vie. */
param->buf[0] = msg[i]->msg_style == PAM_PROMPT_ECHO_ON ? 2 : 4;
if (param->vio->write_packet(param->vio, param->buf, param->ptr - param->buf - 1))
return PAM_CONV_ERR;
pkt_len = param->vio->read_packet(param->vio, &pkt);
if (pkt_len < 0)
return PAM_CONV_ERR;
/* allocate and copy the reply to the response array */
(*resp)[i].resp = strndup((char*)pkt, pkt_len);
param->ptr = param->buf + 1;
}
}
return PAM_SUCCESS;
}
#define DO(X) if ((status = (X)) != PAM_SUCCESS) goto end
static int pam_auth(MYSQL_PLUGIN_VIO *vio, MYSQL_SERVER_AUTH_INFO *info)
{
pam_handle_t *pamh = NULL;
int status;
const char *new_username;
struct param param;
struct pam_conv c = { &conv, ¶m };
/*
get the service name, as specified in
CREATE USER ... IDENTIFIED WITH pam_auth AS "service"
*/
const char *service = info->auth_string && info->auth_string[0]
? info->auth_string : "mysql";
param.ptr = param.buf + 1;
param.vio = vio;
DO( pam_start(service, info->user_name, &c, &pamh) );
DO( pam_authenticate (pamh, 0) );
DO( pam_acct_mgmt(pamh, 0) );
DO( pam_get_item(pamh, PAM_USER, (const void**)&new_username) );
if (new_username && strcmp(new_username, info->user_name))
strncpy(info->authenticated_as, new_username,
sizeof(info->authenticated_as));
end:
pam_end(pamh, status);
return status == PAM_SUCCESS ? CR_OK : CR_ERROR;
}
static struct st_mysql_auth pam_info =
{
MYSQL_AUTHENTICATION_INTERFACE_VERSION,
"dialog",
pam_auth
};
maria_declare_plugin(pam)
{
MYSQL_AUTHENTICATION_PLUGIN,
&pam_info,
"pam",
"Sergei Golubchik",
"PAM based authentication",
PLUGIN_LICENSE_GPL,
NULL,
NULL,
0x0100,
NULL,
NULL,
"1.0",
MariaDB_PLUGIN_MATURITY_BETA
}
maria_declare_plugin_end;
|
