Juli 2010 - ngIRCd GIT Updates

Alexander Barton : Mark some variables as "unused" to prevent compiler warnings
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 41034950d9cb6bdfc14abe99bf080058189d8933 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=41034950… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 16:50:00 2010 +0200 Mark some variables as "unused" to prevent compiler warnings Some variables are only used when compiling with IDENT or PAM support or when the debug code is enabled. Mark them as "unused" so that gcc doesn't generate warnings when neither of these options is enabled. --- src/ngircd/client.c | 2 +- src/ngircd/log.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/ngircd/client.c b/src/ngircd/client.c index 8402499..96d40d2 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -363,7 +363,7 @@ Client_SetUser( CLIENT *Client, const char *User, bool Idented ) * @param User User name to set. */ GLOBAL void -Client_SetOrigUser(CLIENT *Client, const char *User) { +Client_SetOrigUser(CLIENT UNUSED *Client, const char UNUSED *User) { assert(Client != NULL); assert(User != NULL); diff --git a/src/ngircd/log.c b/src/ngircd/log.c index c8dbdd3..0cfe3b7 100644 --- a/src/ngircd/log.c +++ b/src/ngircd/log.c @@ -264,7 +264,7 @@ va_dcl GLOBAL void -Log_Init_Subprocess(char *Name) +Log_Init_Subprocess(char UNUSED *Name) { #ifdef SYSLOG openlog( PACKAGE_NAME, LOG_CONS|LOG_PID, LOG_LOCAL5 ); @@ -277,7 +277,7 @@ Log_Init_Subprocess(char *Name) GLOBAL void -Log_Exit_Subprocess(char *Name) +Log_Exit_Subprocess(char UNUSED *Name) { #ifdef DEBUG Log_Subprocess(LOG_DEBUG, "%s sub-process %ld done.",

1 0

Alexander Barton : Set NoPAM= yes in configuration files used for the testsuite
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 6faf44bc6daf1b8d2e01c08ab15d234aa23ced59 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=6faf44bc… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 16:48:24 2010 +0200 Set NoPAM=yes in configuration files used for the testsuite --- src/testsuite/ngircd-test1.conf | 1 + src/testsuite/ngircd-test2.conf | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/testsuite/ngircd-test1.conf b/src/testsuite/ngircd-test1.conf index 51a57fb..25ec842 100644 --- a/src/testsuite/ngircd-test1.conf +++ b/src/testsuite/ngircd-test1.conf @@ -11,6 +11,7 @@ OperCanUseMode = yes MaxJoins = 4 NoIdent = yes + NoPAM = yes [Operator] Name = TestOp diff --git a/src/testsuite/ngircd-test2.conf b/src/testsuite/ngircd-test2.conf index e6d1696..0805b4e 100644 --- a/src/testsuite/ngircd-test2.conf +++ b/src/testsuite/ngircd-test2.conf @@ -11,6 +11,7 @@ OperCanUseMode = yes MaxJoins = 4 NoIdent = yes + NoPAM = yes [Operator] Name = TestOp

1 0

Alexander Barton : New configuration option "NoPAM" to disable PAM
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: f369177617a0f54e34a1af6fa44d1d1e3f953aeb URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=f3691776… Author: Alexander Barton <alex(a)barton.de> Date: Tue Jul 13 15:10:35 2010 +0200 New configuration option "NoPAM" to disable PAM When the "NoPAM" configuration option is set and ngIRCd is compiled with support for PAM, ngIRCd will not call any PAM functions: all connection attemps without password will succeed instead and all connection attemps with password will fail. If ngIRCd is compiled without PAM support, this option is a dummy option and nothing changes: the global server password will still be in effect. --- doc/sample-ngircd.conf | 3 +++ man/ngircd.conf.5.tmpl | 6 ++++++ src/ngircd/conf.c | 7 +++++++ src/ngircd/conf.h | 3 +++ src/ngircd/irc-login.c | 5 ++++- 5 files changed, 23 insertions(+), 1 deletions(-) diff --git a/doc/sample-ngircd.conf b/doc/sample-ngircd.conf index daa0801..645d1b8 100644 --- a/doc/sample-ngircd.conf +++ b/doc/sample-ngircd.conf @@ -135,6 +135,9 @@ # with support for it. ;NoIdent = no + # Don't use PAM, even if ngIRCd has been compiled with support for it. + ;NoPAM = no + # try to connect to other irc servers using ipv4 and ipv6, if possible ;ConnectIPv6 = yes ;ConnectIPv4 = yes diff --git a/man/ngircd.conf.5.tmpl b/man/ngircd.conf.5.tmpl index 46e0308..ad88871 100644 --- a/man/ngircd.conf.5.tmpl +++ b/man/ngircd.conf.5.tmpl @@ -210,6 +210,12 @@ If ngIRCd is compiled with IDENT support this can be used to disable IDENT lookups at run time. Default: no. .TP +\fBNoPAM\fR +If ngIRCd is compiled with PAM support this can be used to disable all calls +to the PAM library at runtime; all users connecting without password are +allowed to connect, all passwords given will fail. +Default: no. +.TP \fBConnectIPv4\fR Set this to no if you do not want ngIRCd to connect to other IRC servers using IPv4. This allows usage of ngIRCd in IPv6-only setups. diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c index f78eaee..834a1da 100644 --- a/src/ngircd/conf.c +++ b/src/ngircd/conf.c @@ -331,6 +331,7 @@ Conf_Test( void ) printf(" PredefChannelsOnly = %s\n", yesno_to_str(Conf_PredefChannelsOnly)); printf(" NoDNS = %s\n", yesno_to_str(Conf_NoDNS)); printf(" NoIdent = %s\n", yesno_to_str(Conf_NoIdent)); + printf(" NoPAM = %s\n", yesno_to_str(Conf_NoPAM)); #ifdef WANT_IPV6 printf(" ConnectIPv4 = %s\n", yesno_to_str(Conf_ConnectIPv6)); @@ -580,6 +581,7 @@ Set_Defaults(bool InitServers) Conf_ConnectRetry = 60; Conf_NoDNS = false; Conf_NoIdent = false; + Conf_NoPAM = false; Conf_Oper_Count = 0; Conf_Channel_Count = 0; @@ -986,6 +988,11 @@ Handle_GLOBAL( int Line, char *Var, char *Arg ) #endif return; } + if(strcasecmp(Var, "NoPAM") == 0) { + /* don't use PAM library to authenticate users */ + Conf_NoPAM = Check_ArgIsTrue(Arg); + return; + } #ifdef WANT_IPV6 /* the default setting for all the WANT_IPV6 special options is 'true' */ if( strcasecmp( Var, "ConnectIPv6" ) == 0 ) { diff --git a/src/ngircd/conf.h b/src/ngircd/conf.h index 8e397fa..74abc1d 100644 --- a/src/ngircd/conf.h +++ b/src/ngircd/conf.h @@ -152,6 +152,9 @@ GLOBAL bool Conf_NoDNS; /* Disable IDENT lookups, even when compiled with support for it */ GLOBAL bool Conf_NoIdent; +/* Disable all usage of PAM, even when compiled with support for it */ +GLOBAL bool Conf_NoPAM; + /* * try to connect to remote systems using the ipv6 protocol, * if they have an ipv6 address? (default yes) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 10e2df8..0789540 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -787,7 +787,10 @@ Hello_User(CLIENT * Client) /* Sub process */ signal(SIGTERM, Proc_GenericSignalHandler); Log_Init_Subprocess("Auth"); - result = PAM_Authenticate(Client); + if (Conf_NoPAM) { + result = (Client_Password(Client)[0] == '\0'); + } else + result = PAM_Authenticate(Client); write(pipefd[1], &result, sizeof(result)); Log_Exit_Subprocess("Auth"); exit(0);

1 0

Alexander Barton : io.c: Include conn.h when using the select() API
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 37ee0a331394d990e514a1a7b2b52ecb879b9701 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=37ee0a33… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:24:45 2010 +0200 io.c: Include conn.h when using the select() API --- src/ngircd/io.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/ngircd/io.c b/src/ngircd/io.c index e811e81..cb2b55a 100644 --- a/src/ngircd/io.c +++ b/src/ngircd/io.c @@ -105,6 +105,7 @@ static bool io_event_change_devpoll(int fd, short what); #ifdef IO_USE_SELECT #include "defines.h" /* for conn.h */ #include "proc.h" /* for PROC_STAT (needed by conf.h) */ +#include "conn.h" /* for CONN_ID (needed by conf.h) */ #include "conf.h" /* for Conf_MaxConnections */ static fd_set readers;

1 0

Alexander Barton : Use correct preprocessor syntax when testing for PAM and IDENTAUTH
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 03457135b727fc39bb6601b8fb434db2680edc82 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=03457135… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:22:48 2010 +0200 Use correct preprocessor syntax when testing for PAM and IDENTAUTH --- src/ngircd/client.c | 2 +- src/ngircd/client.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ngircd/client.c b/src/ngircd/client.c index 44123ea..8402499 100644 --- a/src/ngircd/client.c +++ b/src/ngircd/client.c @@ -367,7 +367,7 @@ Client_SetOrigUser(CLIENT *Client, const char *User) { assert(Client != NULL); assert(User != NULL); -#ifdef PAM & IDENTAUTH +#if defined(PAM) && defined(IDENTAUTH) strlcpy(Client->orig_user, User, sizeof(Client->orig_user)); #endif } /* Client_SetOrigUser */ diff --git a/src/ngircd/client.h b/src/ngircd/client.h index 352ddf3..bd000a5 100644 --- a/src/ngircd/client.h +++ b/src/ngircd/client.h @@ -43,7 +43,7 @@ typedef struct _CLIENT char pwd[CLIENT_PASS_LEN]; /* password received of the client */ char host[CLIENT_HOST_LEN]; /* hostname of the client */ char user[CLIENT_USER_LEN]; /* user name ("login") */ -#ifdef PAM & IDENTAUTH +#if defined(PAM) && defined(IDENTAUTH) char orig_user[CLIENT_USER_LEN];/* user name supplied by USER command */ #endif char info[CLIENT_INFO_LEN]; /* long user name (user) / info text (server) */

1 0

Alexander Barton : Make sure signal.h is #include'd when needed
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 28424d013d4909a7d5a2501537ad39ae74873724 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=28424d01… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:22:19 2010 +0200 Make sure signal.h is #include'd when needed --- src/ngircd/irc-login.c | 1 + src/ngircd/resolve.c | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index b6cda6f..10e2df8 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -20,6 +20,7 @@ #include <stdlib.h> #include <string.h> #include <strings.h> +#include <signal.h> #include <unistd.h> #include "ngircd.h" diff --git a/src/ngircd/resolve.c b/src/ngircd/resolve.c index d121b0a..808ce53 100644 --- a/src/ngircd/resolve.c +++ b/src/ngircd/resolve.c @@ -23,6 +23,7 @@ #include <sys/socket.h> #include <netinet/in.h> #include <netdb.h> +#include <signal.h> #ifdef IDENTAUTH #ifdef HAVE_IDENT_H

1 0

Alexander Barton : Initial documentation for using PAM with ngIRCd
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 583c50476bee24a8da9459163b609ac80353e63e URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=583c5047… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 13:07:07 2010 +0200 Initial documentation for using PAM with ngIRCd --- doc/PAM.txt | 36 ++++++++++++++++++++++++++++++++++++ 1 files changed, 36 insertions(+), 0 deletions(-) diff --git a/doc/PAM.txt b/doc/PAM.txt new file mode 100644 index 0000000..64bbc7b --- /dev/null +++ b/doc/PAM.txt @@ -0,0 +1,36 @@ + + ngIRCd - Next Generation IRC Server + + (c)2001-2010 Alexander Barton, + alex(a)barton.de, http://www.barton.de/ + + ngIRCd is free software and published under the + terms of the GNU General Public License. + + -- PAM.txt -- + + +ngIRCd can optionally be compiled to use PAM, the Pluggable Authentication +Modules library, for user authentication. When compiled with PAM support, +ngIRCd will authenticate all users connecting to the daemon using the +configured PAM modules in an asynchronous child process. + +To enable PAM, you have to pass the command line parameter "--with-pam" to +the "configure" script. Please see the PAM documentation ("man 7 pam") for +details and information about configuring PAM and its individual modules. + +A very simple -- and quite useless ;-) -- example would be: + + /etc/pam.d/ngircd: + auth required pam_debug.so + +Here the "pam_debug" module will be called each time a client connects to +the ngIRCd and has sent its PASS, NICK, and USER commands. + +Please note ONE VERY IMPORTANT THING: + +All the PAM modules are executed with the privileges of the user ngIRCd +is running as. Therefore a lot of PAM modules aren't working as expected, +because they need root privileges ("pam_unix", for example)! +Only PAM modules not(!) requiring root privileges (such as "pam_pgsql", +"pam_mysql", "pam_opendirectory" ...) can be used in conjunction with ngIRCd.

1 0

Alexander Barton : Implement asynchronous user authentication using PAM
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 808d4f6e85c13ff231321de76f9b356ec13110d4 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=808d4f6e… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:56:33 2010 +0200 Implement asynchronous user authentication using PAM For each client connection a child process is forked which handles the actual PAM authentication and reports the result back to the master process using a pipe for communication. While the PAM authentication is in process the daemon does not block. --- src/ngircd/irc-login.c | 108 +++++++++++++++++++++++++++++++++++++++++++++--- 1 files changed, 102 insertions(+), 6 deletions(-) diff --git a/src/ngircd/irc-login.c b/src/ngircd/irc-login.c index 906b669..b6cda6f 100644 --- a/src/ngircd/irc-login.c +++ b/src/ngircd/irc-login.c @@ -20,13 +20,16 @@ #include <stdlib.h> #include <string.h> #include <strings.h> +#include <unistd.h> #include "ngircd.h" #include "conn-func.h" #include "conf.h" #include "channel.h" +#include "io.h" #include "log.h" #include "messages.h" +#include "pam.h" #include "parse.h" #include "irc.h" #include "irc-info.h" @@ -37,11 +40,17 @@ static bool Hello_User PARAMS(( CLIENT *Client )); +static bool Hello_User_PostAuth PARAMS(( CLIENT *Client )); static void Kill_Nick PARAMS(( char *Nick, char *Reason )); static void Introduce_Client PARAMS((CLIENT *To, CLIENT *Client, int Type)); +static void Reject_Client PARAMS((CLIENT *Client)); + static void cb_introduceClient PARAMS((CLIENT *Client, CLIENT *Prefix, void *i)); +#ifdef PAM +static void cb_Read_Auth_Result PARAMS((int r_fd, UNUSED short events)); +#endif /** * Handler for the IRC command "PASS". @@ -760,18 +769,105 @@ IRC_PONG(CLIENT *Client, REQUEST *Req) static bool Hello_User(CLIENT * Client) { +#ifdef PAM + int pipefd[2], result; + CONN_ID conn; + pid_t pid; + + assert(Client != NULL); + conn = Client_Conn(Client); + + pid = Proc_Fork(Conn_GetProcStat(conn), pipefd, cb_Read_Auth_Result); + if (pid > 0) { + LogDebug("Authenticator for connection %d created (PID %d).", + conn, pid); + return CONNECTED; + } else { + /* Sub process */ + signal(SIGTERM, Proc_GenericSignalHandler); + Log_Init_Subprocess("Auth"); + result = PAM_Authenticate(Client); + write(pipefd[1], &result, sizeof(result)); + Log_Exit_Subprocess("Auth"); + exit(0); + } +#else assert(Client != NULL); - /* Check password ... */ + /* Check global server password ... */ if (strcmp(Client_Password(Client), Conf_ServerPwd) != 0) { /* Bad password! */ - Log(LOG_ERR, - "Client \"%s\" rejected (connection %d): Bad password!", - Client_Mask(Client), Client_Conn(Client)); - Conn_Close(Client_Conn(Client), NULL, "Bad password", true); + Reject_Client(Client); return DISCONNECTED; } + return Hello_User_PostAuth(Client); +#endif +} + +#ifdef PAM + +/** + * Read result of the authenticatior sub-process from pipe + */ +static void +cb_Read_Auth_Result(int r_fd, UNUSED short events) +{ + CONN_ID conn; + CLIENT *client; + int result; + size_t len; + PROC_STAT *proc; + + LogDebug("Auth: Got callback on fd %d, events %d", r_fd, events); + conn = Conn_GetFromProc(r_fd); + if (conn == NONE) { + /* Ops, none found? Probably the connection has already + * been closed!? We'll ignore that ... */ + io_close(r_fd); + LogDebug("Auth: Got callback for unknown connection!?"); + return; + } + proc = Conn_GetProcStat(conn); + client = Conn_GetClient(conn); + + /* Read result from pipe */ + len = Proc_Read(proc, &result, sizeof(result)); + if (len == 0) + return; + + /* Make sure authenticator sub-process is dead now ... */ + Proc_Kill(proc); + + if (len != sizeof(result)) { + Log(LOG_CRIT, "Auth: Got malformed result!"); + Reject_Client(client); + return; + } + + if (result == true) + (void)Hello_User_PostAuth(client); + else + Reject_Client(client); +} + +#endif + + +static void +Reject_Client(CLIENT *Client) +{ + Log(LOG_ERR, + "User \"%s\" rejected (connection %d): Access denied!", + Client_Mask(Client), Client_Conn(Client)); + Conn_Close(Client_Conn(Client), NULL, + "Access denied! Bad password?", true); +} + + +static bool +Hello_User_PostAuth(CLIENT *Client) +{ Introduce_Client(NULL, Client, CLIENT_USER); if (!IRC_WriteStrClient @@ -805,7 +901,7 @@ Hello_User(CLIENT * Client) IRC_SetPenalty(Client, 1); return CONNECTED; -} /* Hello_User */ +} static void

1 0

Alexander Barton : Add new pam.{c|h} module to Xcode project
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: fb4b5acfb8871c43e34dc2aa9c354a86f14f9293 URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=fb4b5acf… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:54:01 2010 +0200 Add new pam.{c|h} module to Xcode project Adjust Xcode project and Mac OS X static config.h header to use PAM. --- contrib/MacOSX/config.h | 12 +++++++++++- contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj | 10 ++++++++++ 2 files changed, 21 insertions(+), 1 deletions(-) diff --git a/contrib/MacOSX/config.h b/contrib/MacOSX/config.h index 66465e2..72c8875 100644 --- a/contrib/MacOSX/config.h +++ b/contrib/MacOSX/config.h @@ -1,6 +1,6 @@ /* * ngIRCd -- The Next Generation IRC Daemon - * Copyright (c)2001-2009 Alexander Barton (alex(a)barton.de) + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -51,6 +51,9 @@ /* Define if IPV6 protocol should be enabled */ #define WANT_IPV6 1 +/* Define if PAM should be used */ +#define PAM 1 + /* -- Supported features -- */ /* Define if SSP C support is enabled. */ @@ -105,4 +108,11 @@ #define HAVE_DNSSERVICEREGISTRATIONCREATE 1 #endif +#ifdef PAM +/* Define to 1 if you have the `pam_authenticate' function. */ +#define HAVE_PAM_AUTHENTICATE 1 +/* Define to 1 if you have the <pam/pam_appl.h> header file. */ +#define HAVE_PAM_PAM_APPL_H 1 +#endif + /* -eof- */ diff --git a/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj b/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj index d36d25b..d3a7617 100644 --- a/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj +++ b/contrib/MacOSX/ngIRCd.xcodeproj/project.pbxproj @@ -7,6 +7,8 @@ objects = { /* Begin PBXBuildFile section */ + FA2D564A11EA158B00D37A35 /* pam.c in Sources */ = {isa = PBXBuildFile; fileRef = FA2D564911EA158B00D37A35 /* pam.c */; }; + FA2D567B11EA1AB300D37A35 /* libpam.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = FA2D567A11EA1AB300D37A35 /* libpam.dylib */; }; FA322D350CEF74B1001761B3 /* array.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CD90CEF74B1001761B3 /* array.c */; }; FA322D360CEF74B1001761B3 /* channel.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CDB0CEF74B1001761B3 /* channel.c */; }; FA322D370CEF74B1001761B3 /* client.c in Sources */ = {isa = PBXBuildFile; fileRef = FA322CDD0CEF74B1001761B3 /* client.c */; }; @@ -56,6 +58,9 @@ /* Begin PBXFileReference section */ FA1A6BBC0D6857BB00AA8F71 /* misc-test.e */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = "misc-test.e"; sourceTree = "<group>"; }; FA1A6BBD0D6857D900AA8F71 /* who-test.e */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = "who-test.e"; sourceTree = "<group>"; }; + FA2D564811EA158B00D37A35 /* pam.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = pam.h; sourceTree = "<group>"; }; + FA2D564911EA158B00D37A35 /* pam.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = pam.c; sourceTree = "<group>"; }; + FA2D567A11EA1AB300D37A35 /* libpam.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libpam.dylib; path = usr/lib/libpam.dylib; sourceTree = SDKROOT; }; FA322BBA0CEF72E4001761B3 /* ngIRCd */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = ngIRCd; sourceTree = BUILT_PRODUCTS_DIR; }; FA322CD60CEF74B1001761B3 /* Makefile.am */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = text; path = Makefile.am; sourceTree = "<group>"; }; FA322CD90CEF74B1001761B3 /* array.c */ = {isa = PBXFileReference; fileEncoding = 5; lastKnownFileType = sourcecode.c.c; path = array.c; sourceTree = "<group>"; }; @@ -231,6 +236,7 @@ buildActionMask = 2147483647; files = ( FA322DC10CEF77CB001761B3 /* libz.dylib in Frameworks */, + FA2D567B11EA1AB300D37A35 /* libpam.dylib in Frameworks */, ); runOnlyForDeploymentPostprocessing = 0; }; @@ -257,6 +263,7 @@ FA322D630CEF750F001761B3 /* Makefile.am */, 1AB674ADFE9D54B511CA2CBB /* Products */, FA322DC00CEF77CB001761B3 /* libz.dylib */, + FA2D567A11EA1AB300D37A35 /* libpam.dylib */, ); name = ngIRCd; sourceTree = "<group>"; @@ -348,6 +355,8 @@ FA322D0B0CEF74B1001761B3 /* rendezvous.h */, FA322D0C0CEF74B1001761B3 /* resolve.c */, FA322D0D0CEF74B1001761B3 /* resolve.h */, + FA2D564811EA158B00D37A35 /* pam.h */, + FA2D564911EA158B00D37A35 /* pam.c */, ); path = ngircd; sourceTree = "<group>"; @@ -688,6 +697,7 @@ FAA3D27B0F139CDC00B2447E /* conn-ssl.c in Sources */, FA85178C0FA061EC006A1F5A /* op.c in Sources */, FA99428C10E82A27007F27ED /* proc.c in Sources */, + FA2D564A11EA158B00D37A35 /* pam.c in Sources */, ); runOnlyForDeploymentPostprocessing = 0; };

1 0

Alexander Barton : Add pam.{c|h} to project and implement PAM_Authenticate( ) function
by alex＠arthur.barton.de 14 Jul '10

14 Jul '10

Module: ngircd.git Branch: master Commit: 77870ddf2d87ddf222d87b58cb9afdf0609d49dd URL: http://ngircd.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git&a=commit;h=77870ddf… Author: Alexander Barton <alex(a)barton.de> Date: Mon Jul 12 12:53:08 2010 +0200 Add pam.{c|h} to project and implement PAM_Authenticate() function --- src/ngircd/Makefile.am | 4 +- src/ngircd/pam.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++++ src/ngircd/pam.h | 25 +++++++++ 3 files changed, 166 insertions(+), 2 deletions(-) diff --git a/src/ngircd/Makefile.am b/src/ngircd/Makefile.am index 2bce292..4c9d9fa 100644 --- a/src/ngircd/Makefile.am +++ b/src/ngircd/Makefile.am @@ -21,7 +21,7 @@ sbin_PROGRAMS = ngircd ngircd_SOURCES = ngircd.c array.c channel.c client.c conf.c conn.c conn-func.c \ conn-ssl.c conn-zip.c hash.c io.c irc.c irc-channel.c irc-info.c irc-login.c \ irc-mode.c irc-op.c irc-oper.c irc-server.c irc-write.c lists.c log.c \ - match.c op.c numeric.c parse.c proc.c rendezvous.c resolve.c + match.c op.c numeric.c pam.c parse.c proc.c rendezvous.c resolve.c ngircd_LDFLAGS = -L../portab -L../tool -L../ipaddr @@ -30,7 +30,7 @@ ngircd_LDADD = -lngportab -lngtool -lngipaddr noinst_HEADERS = ngircd.h array.h channel.h client.h conf.h conf-ssl.h conn.h \ conn-func.h conn-ssl.h conn-zip.h hash.h io.h irc.h irc-channel.h \ irc-info.h irc-login.h irc-mode.h irc-op.h irc-oper.h irc-server.h \ - irc-write.h lists.h log.h match.h numeric.h op.h parse.h proc.h \ + irc-write.h lists.h log.h match.h numeric.h op.h pam.h parse.h proc.h \ rendezvous.h resolve.h defines.h messages.h clean-local: diff --git a/src/ngircd/pam.c b/src/ngircd/pam.c new file mode 100644 index 0000000..e6d25bc --- /dev/null +++ b/src/ngircd/pam.c @@ -0,0 +1,139 @@ +/* + * ngIRCd -- The Next Generation IRC Daemon + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * Please read the file COPYING, README and AUTHORS for more information. + * + * PAM User Authentification + */ + +#include "portab.h" + +#ifdef PAM + +#include "imp.h" +#include <assert.h> + +#include "defines.h" +#include "log.h" +#include "conn.h" +#include "client.h" + +#include <stdlib.h> +#include <string.h> + +#ifdef HAVE_SECURITY_PAM_APPL_H +#include <security/pam_appl.h> +#endif + +#ifdef HAVE_PAM_PAM_APPL_H +#include <pam/pam_appl.h> +#endif + +#include "exp.h" +#include "pam.h" + +static char *password; + +/** + * PAM "conversation function". + * This is a callback function used by the PAM library to get the password. + * Please see the PAM documentation for details :-) + */ +static int +password_conversation(int num_msg, const struct pam_message **msg, + struct pam_response **resp, void *appdata_ptr) { + LogDebug("PAM: conv(%d, %d, '%s', '%s')", + num_msg, msg[0]->msg_style, msg[0]->msg, appdata_ptr); + + /* Can we deal with this request? */ + if (num_msg != 1 || msg[0]->msg_style != PAM_PROMPT_ECHO_OFF) { + Log(LOG_ERR, "PAM: Unexpected PAM conversation '%d:%s'!", + msg[0]->msg_style, msg[0]->msg); + return PAM_CONV_ERR; + } + + if (!appdata_ptr) { + /* Sometimes appdata_ptr gets lost!? */ + appdata_ptr = password; + } + + /* Duplicate password ("application data") for the PAM library */ + *resp = calloc(num_msg, sizeof(struct pam_response)); + if (!*resp) { + Log(LOG_ERR, "PAM: Out of memory!"); + return PAM_CONV_ERR; + } + + (*resp)[0].resp = strdup((char *)appdata_ptr); + (*resp)[0].resp_retcode = 0; + + return ((*resp)[0].resp ? PAM_SUCCESS : PAM_CONV_ERR); +} + +/** + * PAM "conversation" structure. + */ +static struct pam_conv conv = { + &password_conversation, + NULL +}; + +/** + * Authenticate a connectiong client using PAM. + * @param Client The client to authenticate. + * @return true when authentication succeeded, false otherwise. + */ +GLOBAL bool +PAM_Authenticate(CLIENT *Client) { + pam_handle_t *pam; + int retval = PAM_SUCCESS; + + LogDebug("PAM: Authenticate \"%s\" (%s) ...", + Client_OrigUser(Client), Client_Mask(Client)); + + /* Set supplied client password */ + if (password) + free(password); + password = strdup(Client_Password(Client)); + conv.appdata_ptr = password; + + /* Initialize PAM */ + retval = pam_start("ngircd", Client_OrigUser(Client), &conv, &pam); + if (retval != PAM_SUCCESS) { + Log(LOG_ERR, "PAM: Failed to create authenticator! (%d)", retval); + return false; + } + + pam_set_item(pam, PAM_RUSER, Client_User(Client)); + pam_set_item(pam, PAM_RHOST, Client_Hostname(Client)); +#ifdef HAVE_PAM_FAIL_DELAY + pam_fail_delay(pam, 0); +#endif + + /* PAM authentication ... */ + retval = pam_authenticate(pam, 0); + + /* Success? */ + if (retval == PAM_SUCCESS) + Log(LOG_INFO, "PAM: Authenticated \"%s\" (%s).", + Client_OrigUser(Client), Client_Mask(Client)); + else + Log(LOG_ERR, "PAM: Error on \"%s\" (%s): %s", + Client_OrigUser(Client), Client_Mask(Client), + pam_strerror(pam, retval)); + + /* Free PAM structures */ + if (pam_end(pam, retval) != PAM_SUCCESS) + Log(LOG_ERR, "PAM: Failed to release authenticator!"); + + return (retval == PAM_SUCCESS); +} + +#endif /* PAM */ + +/* -eof- */ diff --git a/src/ngircd/pam.h b/src/ngircd/pam.h new file mode 100644 index 0000000..74b838d --- /dev/null +++ b/src/ngircd/pam.h @@ -0,0 +1,25 @@ +/* + * ngIRCd -- The Next Generation IRC Daemon + * Copyright (c)2001-2010 Alexander Barton (alex(a)barton.de) + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * Please read the file COPYING, README and AUTHORS for more information. + * + * PAM User Authentification (header) + */ + +#ifdef PAM + +#ifndef __pam_h__ +#define __pam_h__ + +GLOBAL bool PAM_Authenticate PARAMS((CLIENT *Client)); + +#endif /* __pam_h__ */ + +#endif /* PAM */ + +/* -eof- */

1 0