Various fixes + refacto

2020-07-05 15:15:51 +02:00
parent c67e54aead
commit 50b0fd1cb8
21 changed files with 390 additions and 196 deletions
@@ -26,8 +26,9 @@
 #include "database/Session.hpp"
 #include "utils/Exception.hpp"
 #include "utils/Logger.hpp"
-
-#include <security/pam_appl.h>
+#ifdef LMS_SUPPORT_PAM
+#include "pam/PAM.hpp"
+#endif

 namespace Auth {

@@ -41,101 +42,29 @@ PasswordService::PasswordService(std::size_t maxThrottlerEntries)
 {
 }

-#ifdef USEPAM
-static void
-delete_resp(int num_msg, pam_response *response)
+bool
+PasswordService::isAuthModeSupported(Database::User::AuthMode authMode) const
 {
-    if (response == nullptr)
-        return;
-    for (int i = 0; i < num_msg; i++) {
-        if (response[i].resp) {
-            /* clear before freeing -- might be a password */
-            bzero(response[i].resp, strlen(response[i].resp));
-            free(response[i].resp);
-            response[i].resp = nullptr;
-        }
-    }
-}
-
-struct pam_conv_data
-{
-	const char *username;
-	const char *password;
-};
-
-static
-int lms_conv(int num_msg, const pam_message** msgs, pam_response** resps, void* appdata_ptr)
-{
-	if(num_msg < 1)
-		return PAM_CONV_ERR;
-	if (!resps || !msgs || !appdata_ptr)
-		return PAM_CONV_ERR;
-	
-	pam_conv_data *data = static_cast<pam_conv_data*>( appdata_ptr );
-	pam_response  *response = new (std::nothrow) pam_response[num_msg];
-	if(!response)
-		return PAM_CONV_ERR;
-
-	for(int i = 0; i < num_msg; ++i)
+	switch (authMode)
 	{
-		response[i].resp_retcode = 0;
-		response[i].resp = 0;
-		switch (msgs[i]->msg_style) {
-		case PAM_PROMPT_ECHO_ON:
-			/* on memory allocation failure, auth fails */
-			response[i].resp = strdup(data->username);
-			break;
-		case PAM_PROMPT_ECHO_OFF:
-			response[i].resp = strdup(data->password);
-			break;
-		case PAM_ERROR_MSG:
-		case PAM_TEXT_INFO:
-		default:
-			delete_resp(i, response);
-			return PAM_CONV_ERR;
-		}
-	}
-	
-	*resps = response;
-	return PAM_SUCCESS;
-}
-#endif
+		case Database::User::AuthMode::Internal:
+			return true;

-static bool
-pamCheckUserPassword(const std::string& loginName, const std::string& password)
-{
-#ifdef USEPAM
-	pam_conv_data authdata{loginName.c_str(), password.c_str()};
-	pam_conv conv = { lms_conv, &authdata };
-	pam_handle_t *pamh;
-	bool authenticated{false};
-
-	/* Initialize PAM framework */
-	int err = pam_start("lms", loginName.c_str(), &conv, &pamh);
-	if (err != PAM_SUCCESS) {
-		return false;
-	}
-
-	err = pam_authenticate(pamh, 0);
-	if(err == PAM_SUCCESS) 
-	{
-		/* Make sure account and password are still valid */
-		err = pam_acct_mgmt(pamh, PAM_SILENT);
-		authenticated = err == PAM_SUCCESS;
-	}
-
-	(void) pam_end(pamh, 0);
-	return authenticated;
+		case Database::User::AuthMode::PAM:
+#ifdef LMS_SUPPORT_PAM
+			return true;
 #else
-	return false;
+			return false;
 #endif
+	}
+	return false;
 }

 static
 bool
 checkUserPassword(Database::Session& session, const std::string& loginName, const std::string& password)
 {
-	bool hasExternalAuth;
+	Database::User::AuthMode authMode;
 	Database::User::PasswordHash passwordHash;
 	{
 		auto transaction {session.createSharedTransaction()};
@@ -144,21 +73,28 @@ checkUserPassword(Database::Session& session, const std::string& loginName, cons
 		if (!user)
 			return false;

-		hasExternalAuth = user->hasExternalAuth();
+		authMode = user->getAuthMode();
 		passwordHash = user->getPasswordHash();
 	}

-	if (hasExternalAuth) 
+	switch (authMode)
 	{
-		return pamCheckUserPassword(loginName, password);
-	}
-	else
-	{
-		const Wt::Auth::BCryptHashFunction hashFunc {6};
-		return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
-	}
-}
+		case Database::User::AuthMode::Internal:
+		{
+			const Wt::Auth::BCryptHashFunction hashFunc {6}; // TODO parametrize this
+			return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
+		}

+		case Database::User::AuthMode::PAM:
+#ifdef LMS_SUPPORT_PAM
+			return PAM::checkUserPassword(loginName, password);
+#else
+			return false;
+#endif
+	}
+
+	return false;
+}

 PasswordService::PasswordCheckResult
 PasswordService::checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password)