aboutsummaryrefslogtreecommitdiff
path: root/lib/libtacplus/taclib_private.h
diff options
context:
space:
mode:
authorDag-Erling Smørgrav <des@FreeBSD.org>2023-06-13 16:04:22 +0000
committerDag-Erling Smørgrav <des@FreeBSD.org>2023-12-13 16:08:13 +0000
commit5761f8a7de9fa0248e1d7e2be751de1c6d9aa973 (patch)
tree05579cf33450fe6619aca01a41eea7f227f791a1 /lib/libtacplus/taclib_private.h
parent96fabd5cbc32e3ddbe6ce926ee96ffe75ccbb153 (diff)
libtacplus: Allow additional AV pairs to be configured.
* Replace hand-rolled input tokenizer with openpam_readlinev() which supports line continuations and has better quoting and escaping. * Simplify string handling by merging struct clnt_str and struct srvr_str into just struct tac_str. * Each server entry in the configuration file can now have up to 255 AV pairs which will be appended to the ones returned by the server in response to a successful authorization request. This allows nss_tacplus(8) to be used with servers which do not provide identity information beyond confirming the existence of the user. This adds a dependency on libpam, however libtacplus is currently only used by pam_tacplus(8) (which is already always used with libpam) and the very recently added nss_tacplus(8) (which is extremely niche). In the longer term it might be a good idea to split this out into a separate library. MFC after: 1 week Sponsored by: Klara, Inc. Reviewed by: pauamma_gundo.com, markj Differential Revision: https://reviews.freebsd.org/D40285 Relnotes: yes (cherry picked from commit 21850106fdda5269bc881f0e62839dff3d9edf47)
Diffstat (limited to 'lib/libtacplus/taclib_private.h')
-rw-r--r--lib/libtacplus/taclib_private.h63
1 files changed, 30 insertions, 33 deletions
diff --git a/lib/libtacplus/taclib_private.h b/lib/libtacplus/taclib_private.h
index 665616f1f200..43203b72f6ca 100644
--- a/lib/libtacplus/taclib_private.h
+++ b/lib/libtacplus/taclib_private.h
@@ -58,30 +58,8 @@
#define TAC_UNENCRYPTED 0x01
#define TAC_SINGLE_CONNECT 0x04
-struct tac_server {
- struct sockaddr_in addr; /* Address of server */
- char *secret; /* Shared secret */
- int timeout; /* Timeout in seconds */
- int flags;
-};
-
-/*
- * An optional string of bytes specified by the client for inclusion in
- * a request. The data is always a dynamically allocated copy that
- * belongs to the library. It is copied into the request packet just
- * before sending the request.
- */
-struct clnt_str {
- void *data;
- size_t len;
-};
-
-/*
- * An optional string of bytes from a server response. The data resides
- * in the response packet itself, and must not be freed.
- */
-struct srvr_str {
- const void *data;
+struct tac_str {
+ char *data;
size_t len;
};
@@ -171,6 +149,15 @@ struct tac_msg {
} u;
};
+struct tac_server {
+ struct sockaddr_in addr; /* Address of server */
+ char *secret; /* Shared secret */
+ int timeout; /* Timeout in seconds */
+ int flags;
+ unsigned int navs;
+ struct tac_str avs[MAXAVPAIRS];
+};
+
struct tac_handle {
int fd; /* Socket file descriptor */
struct tac_server servers[MAXSERVERS]; /* Servers to contact */
@@ -180,20 +167,30 @@ struct tac_handle {
int last_seq_no;
char errmsg[ERRSIZE]; /* Most recent error message */
- struct clnt_str user;
- struct clnt_str port;
- struct clnt_str rem_addr;
- struct clnt_str data;
- struct clnt_str user_msg;
- struct clnt_str avs[MAXAVPAIRS];
+ struct tac_str user;
+ struct tac_str port;
+ struct tac_str rem_addr;
+ struct tac_str data;
+ struct tac_str user_msg;
+ struct tac_str avs[MAXAVPAIRS];
struct tac_msg request;
struct tac_msg response;
int srvr_pos; /* Scan position in response body */
- struct srvr_str srvr_msg;
- struct srvr_str srvr_data;
- struct srvr_str srvr_avs[MAXAVPAIRS];
+ unsigned int srvr_navs;
+ struct tac_str srvr_msg;
+ struct tac_str srvr_data;
+ struct tac_str srvr_avs[MAXAVPAIRS];
};
+#define is_alpha(ch) /* alphabetical */ \
+ (((ch) >= 'A' && (ch) <= 'Z') || ((ch) >= 'a' && (ch) <= 'z'))
+#define is_num(ch) /* numerical */ \
+ ((ch) >= '0' && (ch) <= '9')
+#define is_alnum(ch) /* alphanumerical */ \
+ (is_alpha(ch) || is_num(ch))
+#define is_arg(ch) /* valid in an argument name */ \
+ (is_alnum(ch) || (ch) == '_' || (ch) == '-')
+
#endif