libtacplus: Allow additional AV pairs to be configured.

* Replace hand-rolled input tokenizer with openpam_readlinev() which supports line continuations and has better quoting and escaping.
* Simplify string handling by merging struct clnt_str and struct srvr_str into just struct tac_str.
* Each server entry in the configuration file can now have up to 255 AV pairs which will be appended to the ones returned by the server in response to a successful authorization request.

This allows nss_tacplus(8) to be used with servers which do not provide identity information beyond confirming the existence of the user.

This adds a dependency on libpam, however libtacplus is currently only used by pam_tacplus(8) (which is already always used with libpam) and the very recently added nss_tacplus(8) (which is extremely niche).  In the longer term it might be a good idea to split this out into a separate library.

MFC after:	1 week
Sponsored by:	Klara, Inc.
Reviewed by:	pauamma_gundo.com, markj
Differential Revision:	https://reviews.freebsd.org/D40285
Relnotes:	yes

(cherry picked from commit 21850106fdda5269bc881f0e62839dff3d9edf47)

1 files changed, 30 insertions, 33 deletions

diff --git a/lib/libtacplus/taclib_private.h b/lib/libtacplus/taclib_private.h
index 665616f1f200..43203b72f6ca 100644
--- a/lib/libtacplus/taclib_private.h
+++ b/lib/libtacplus/taclib_private.h
@@ -58,30 +58,8 @@
 #define TAC_UNENCRYPTED		0x01
 #define TAC_SINGLE_CONNECT	0x04
 
-struct tac_server {
-	struct sockaddr_in addr;	/* Address of server */
-	char		*secret;	/* Shared secret */
-	int		 timeout;	/* Timeout in seconds */
-	int		 flags;
-};
-
-/*
- * An optional string of bytes specified by the client for inclusion in
- * a request.  The data is always a dynamically allocated copy that
- * belongs to the library.  It is copied into the request packet just
- * before sending the request.
- */
-struct clnt_str {
-	void		*data;
-	size_t		 len;
-};
-
-/*
- * An optional string of bytes from a server response.  The data resides
- * in the response packet itself, and must not be freed.
- */
-struct srvr_str {
-	const void	*data;
+struct tac_str {
+	char		*data;
 	size_t		 len;
 };
 
@@ -171,6 +149,15 @@ struct tac_msg {
 	} u;
 };
 
+struct tac_server {
+	struct sockaddr_in addr;	/* Address of server */
+	char		*secret;	/* Shared secret */
+	int		 timeout;	/* Timeout in seconds */
+	int		 flags;
+	unsigned int	 navs;
+	struct tac_str	 avs[MAXAVPAIRS];
+};
+
 struct tac_handle {
 	int		 fd;		/* Socket file descriptor */
 	struct tac_server servers[MAXSERVERS];	/* Servers to contact */
@@ -180,20 +167,30 @@ struct tac_handle {
 	int		 last_seq_no;
 	char		 errmsg[ERRSIZE];	/* Most recent error message */
 
-	struct clnt_str	 user;
-	struct clnt_str	 port;
-	struct clnt_str	 rem_addr;
-	struct clnt_str	 data;
-	struct clnt_str	 user_msg;
-	struct clnt_str  avs[MAXAVPAIRS];
+	struct tac_str	 user;
+	struct tac_str	 port;
+	struct tac_str	 rem_addr;
+	struct tac_str	 data;
+	struct tac_str	 user_msg;
+	struct tac_str	 avs[MAXAVPAIRS];
 
 	struct tac_msg	 request;
 	struct tac_msg	 response;
 
 	int		 srvr_pos;	/* Scan position in response body */
-	struct srvr_str	 srvr_msg;
-	struct srvr_str	 srvr_data;
-	struct srvr_str  srvr_avs[MAXAVPAIRS];
+	unsigned int	 srvr_navs;
+	struct tac_str	 srvr_msg;
+	struct tac_str	 srvr_data;
+	struct tac_str	 srvr_avs[MAXAVPAIRS];
 };
 
+#define is_alpha(ch) /* alphabetical */					\
+	(((ch) >= 'A' && (ch) <= 'Z') || ((ch) >= 'a' && (ch) <= 'z'))
+#define is_num(ch) /* numerical */					\
+	((ch) >= '0' && (ch) <= '9')
+#define is_alnum(ch) /* alphanumerical */				\
+	(is_alpha(ch) || is_num(ch))
+#define is_arg(ch) /* valid in an argument name */			\
+	(is_alnum(ch) || (ch) == '_' || (ch) == '-')
+
 #endif