diff options
author | Dag-Erling Smørgrav <des@FreeBSD.org> | 2023-06-13 16:04:22 +0000 |
---|---|---|
committer | Dag-Erling Smørgrav <des@FreeBSD.org> | 2023-12-13 16:08:13 +0000 |
commit | 5761f8a7de9fa0248e1d7e2be751de1c6d9aa973 (patch) | |
tree | 05579cf33450fe6619aca01a41eea7f227f791a1 /lib/libtacplus/taclib_private.h | |
parent | 96fabd5cbc32e3ddbe6ce926ee96ffe75ccbb153 (diff) |
libtacplus: Allow additional AV pairs to be configured.
* Replace hand-rolled input tokenizer with openpam_readlinev() which supports line continuations and has better quoting and escaping.
* Simplify string handling by merging struct clnt_str and struct srvr_str into just struct tac_str.
* Each server entry in the configuration file can now have up to 255 AV pairs which will be appended to the ones returned by the server in response to a successful authorization request.
This allows nss_tacplus(8) to be used with servers which do not provide identity information beyond confirming the existence of the user.
This adds a dependency on libpam, however libtacplus is currently only used by pam_tacplus(8) (which is already always used with libpam) and the very recently added nss_tacplus(8) (which is extremely niche). In the longer term it might be a good idea to split this out into a separate library.
MFC after: 1 week
Sponsored by: Klara, Inc.
Reviewed by: pauamma_gundo.com, markj
Differential Revision: https://reviews.freebsd.org/D40285
Relnotes: yes
(cherry picked from commit 21850106fdda5269bc881f0e62839dff3d9edf47)
Diffstat (limited to 'lib/libtacplus/taclib_private.h')
-rw-r--r-- | lib/libtacplus/taclib_private.h | 63 |
1 files changed, 30 insertions, 33 deletions
diff --git a/lib/libtacplus/taclib_private.h b/lib/libtacplus/taclib_private.h index 665616f1f200..43203b72f6ca 100644 --- a/lib/libtacplus/taclib_private.h +++ b/lib/libtacplus/taclib_private.h @@ -58,30 +58,8 @@ #define TAC_UNENCRYPTED 0x01 #define TAC_SINGLE_CONNECT 0x04 -struct tac_server { - struct sockaddr_in addr; /* Address of server */ - char *secret; /* Shared secret */ - int timeout; /* Timeout in seconds */ - int flags; -}; - -/* - * An optional string of bytes specified by the client for inclusion in - * a request. The data is always a dynamically allocated copy that - * belongs to the library. It is copied into the request packet just - * before sending the request. - */ -struct clnt_str { - void *data; - size_t len; -}; - -/* - * An optional string of bytes from a server response. The data resides - * in the response packet itself, and must not be freed. - */ -struct srvr_str { - const void *data; +struct tac_str { + char *data; size_t len; }; @@ -171,6 +149,15 @@ struct tac_msg { } u; }; +struct tac_server { + struct sockaddr_in addr; /* Address of server */ + char *secret; /* Shared secret */ + int timeout; /* Timeout in seconds */ + int flags; + unsigned int navs; + struct tac_str avs[MAXAVPAIRS]; +}; + struct tac_handle { int fd; /* Socket file descriptor */ struct tac_server servers[MAXSERVERS]; /* Servers to contact */ @@ -180,20 +167,30 @@ struct tac_handle { int last_seq_no; char errmsg[ERRSIZE]; /* Most recent error message */ - struct clnt_str user; - struct clnt_str port; - struct clnt_str rem_addr; - struct clnt_str data; - struct clnt_str user_msg; - struct clnt_str avs[MAXAVPAIRS]; + struct tac_str user; + struct tac_str port; + struct tac_str rem_addr; + struct tac_str data; + struct tac_str user_msg; + struct tac_str avs[MAXAVPAIRS]; struct tac_msg request; struct tac_msg response; int srvr_pos; /* Scan position in response body */ - struct srvr_str srvr_msg; - struct srvr_str srvr_data; - struct srvr_str srvr_avs[MAXAVPAIRS]; + unsigned int srvr_navs; + struct tac_str srvr_msg; + struct tac_str srvr_data; + struct tac_str srvr_avs[MAXAVPAIRS]; }; +#define is_alpha(ch) /* alphabetical */ \ + (((ch) >= 'A' && (ch) <= 'Z') || ((ch) >= 'a' && (ch) <= 'z')) +#define is_num(ch) /* numerical */ \ + ((ch) >= '0' && (ch) <= '9') +#define is_alnum(ch) /* alphanumerical */ \ + (is_alpha(ch) || is_num(ch)) +#define is_arg(ch) /* valid in an argument name */ \ + (is_alnum(ch) || (ch) == '_' || (ch) == '-') + #endif |