This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see .
Also add information on how to contact you by electronic and paper mail.
If your software can interact with users remotely through a computer
network, you should also make sure that it provides a way for users to
get its source. For example, if your program is a web application, its
interface could display a "Source" link that leads users to an archive
of the code. There are many ways you could offer source, and different
solutions will be better for different programs; see section 13 for the
specific requirements.
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU AGPL, see
.
pam-python-1.0.7/pam-python.html 0000644 0002157 0001751 00000006014 13541422776 015516 0 ustar rstuart it
pam-python - write PAM modules in Python
Pam-python
Write PAM modules in Python
Pam-python is a PAM Module that runs the Python interpreter,
thus allowing PAM Modules to be written in Python.
Documentation
There is a
documentation page,
some examples, a
change log and a
README.txt.
The documentation page must be read in conjunction with the
PAM Module Writers Guide.
Copyright and License
Pam-python is copyright © 2007-2012,2014,2016,2019 Russell Stuart.
It is licensed under the GNU Affero General Public License.
This program is free software: you can redistribute it and/or modify it
under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or (at your
option) any later version.
The copyright holders grant you an additional permission under Section 7
of the GNU Affero General Public License, version 3, exempting you from
the requirement in Section 6 of the GNU General Public License, version 3,
to accompany Corresponding Source with Installation Information for the
Program or any work based on the Program. You are still required to
comply with all other Section 6 requirements to provide Corresponding
Source.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
Downloading, Feedback & Contributing
Development for pam-python is hosted on
Source forge:
Russell Stuart, 2014-May-29.
pam-python-1.0.7/examples/ 0000755 0002157 0001751 00000000000 13541422776 014351 5 ustar rstuart it pam-python-1.0.7/examples/pam_deny.py 0000644 0002157 0001751 00000000720 13541422776 016516 0 ustar rstuart it #
# Duplicates pam_deny.c
#
def pam_sm_authenticate(pamh, flags, argv):
return pamh.PAM_AUTH_ERR
def pam_sm_setcred(pamh, flags, argv):
return pamh.PAM_CRED_UNAVAIL
def pam_sm_acct_mgmt(pamh, flags, argv):
return pamh.PAM_ACCT_EXPIRED
def pam_sm_chauthtok(pamh, flags, argv):
return pamh.PAM_AUTHTOK_ERR
def pam_sm_open_session(pamh, flags, argv):
return pamh.PAM_SYSTEM_ERR
def pam_sm_close_session(pamh, flags, argv):
return pamh.PAM_SYSTEM_ERR
pam-python-1.0.7/examples/pam_nologin.py 0000644 0002157 0001751 00000004025 13541422776 017226 0 ustar rstuart it #
# Emulate what pam_nologin.c does.
#
import pwd
#
# Parse our command line.
#
def parse_args(pamh, argv):
#
# Parse the arguments.
#
nologin_file = "/etc/nologin"
retval_when_nofile = pamh.PAM_IGNORE
for arg in argv[1:]:
if arg.starts_with("file="):
nologin_file = arg[5:]
elif arg == "successok":
retval_when_nofile = pamh.PAM_SUCCESS
return nologin_file, retval_when_nofile
#
# Check the /etc/nologin file.
#
def check_nologin(pamh, nologin_file, retval_when_nofile):
#
# Get the user name.
#
try:
username = pamh.get_user()
except pamh.exception:
username = None
if username == None:
return pamh.PAM_USER_UNKNOWN
#
# Can we open the file?
#
try:
handle = file(nologin_file, "r")
except EnvironmentError:
return retval_when_nofile
#
# Print the message.
#
try:
try:
msg = handle.read()
except EnvironmentError:
return pamh.PAM_SYSTEM_ERR
finally:
handle.close()
#
# Read the user's password entry so we can check if he is root.
# Root can login regardless.
#
try:
pwent = pwd.getpwnam(username)
except KeyError:
retval = pamh.PAM_USER_UNKNOWN
msg_style = pamh.PAM_ERROR_MSG
else:
if pwent[2] == 0: # Is this root?
retval = pamh.PAM_SUCCESS
msg_style = pamh.PAM_TEXT_INFO
else:
retval = pamh.PAM_AUTH_ERR
msg_style = pamh.PAM_ERROR_MSG
#
# Display the message
#
try:
pamh.conversation(pamh.Message(msg_style, msg))
except pamh.exception:
return pamh.PAM_SYSTEM_ERR
return retval
#
# Entry points we handle.
#
def pam_sm_authenticate(pamh, flags, argv):
nologin_file, retval_when_nofile = parse_args(pamh, argv)
return check_nologin(pamh, nologin_file, retval_when_nofile)
def pam_sm_setcred(pamh, flags, argv):
nologin_file, retval_when_nofile = parse_args(pamh, argv)
return retval_when_nofile
def pam_sm_acct_mgmt(pamh, flags, argv):
nologin_file, retval_when_nofile = parse_args(pamh, argv)
return check_nologin(pamh, nologin_file, retval_when_nofile)
pam-python-1.0.7/examples/pam_permit.py 0000644 0002157 0001751 00000001140 13541422776 017054 0 ustar rstuart it #
# Duplicates pam_permit.c
#
DEFAULT_USER = "nobody"
def pam_sm_authenticate(pamh, flags, argv):
try:
user = pamh.get_user(None)
except pamh.exception, e:
return e.pam_result
if user == None:
pamh.user = DEFAULT_USER
return pamh.PAM_SUCCESS
def pam_sm_setcred(pamh, flags, argv):
return pamh.PAM_SUCCESS
def pam_sm_acct_mgmt(pamh, flags, argv):
return pamh.PAM_SUCCESS
def pam_sm_open_session(pamh, flags, argv):
return pamh.PAM_SUCCESS
def pam_sm_close_session(pamh, flags, argv):
return pamh.PAM_SUCCESS
def pam_sm_chauthtok(pamh, flags, argv):
return pamh.PAM_SUCCESS
pam-python-1.0.7/Makefile 0000644 0002157 0001751 00000001462 13541422776 014176 0 ustar rstuart it .PHONY: all
all: doc lib
.PHONY: lib
lib:
$(MAKE) --directory src
.PHONY: doc
doc:
$(MAKE) --directory doc
.PHONY: test
test:
$(MAKE) --directory src $@
.PHONY: clean-pam_python
clean-pam_python:
rm -rf pam_python
.PHONY: clean
clean: clean-pam_python
$(MAKE) --directory doc $@
$(MAKE) --directory src $@
.PHONY: install
install: install-doc install-lib
.PHONY: install-doc
install-doc: clean-pam_python
$(MAKE) --directory doc $@
.PHONY: install-lib
install-lib: clean-pam_python
$(MAKE) --directory src $@
RELEASE_SOURCES = \
ChangeLog.txt \
Makefile \
Makefile.release \
pam-python.html \
README.txt \
doc/pam_python.rst \
src/ctest.c \
src/Makefile \
src/pam_python.c \
src/setup.py \
src/test-pam_python.pam.in \
src/test.py
include Makefile.release
release-project-clean:: clean
pam-python-1.0.7/README.txt 0000644 0002157 0001751 00000004331 13541422776 014232 0 ustar rstuart it pam_python
==========
pam_python is a PAM module that runs the Python interpreter
and so allows PAM modules to be written in Python.
There is extensive documentation shipped as reStructured
text. The build system renders this in the standard Python
HTML documentation style.
All documentation is readable online at the home page:
http://pam-python.sourceforge.net/
Dependencies
------------
Python >= 2.6, http://www.python.org
pam >= 0.76, http://pam.sourceforge.net/
PyPAM (Debian package python-pam, needed for testing only)
Building and Installing
-----------------------
The build dependencies are:
- Python2 development system, http://www.python.org
- A POSIX system (make, unix shell, sed, etc).
- The PAM development libraries,
http://pam.sourceforge.net
In addition the unit test requires:
- sudo, http://www.sudo.ws/
- An account with root privileges.
- PyPAM (for testing only)
To build the re-distributable, in the directory containing
this file run:
make
To install, in the directory containing this file run:
make install
To run the test suite, in the directory containing this file run:
make test
License
-------
Copyright (c) 2007-2014,2016,2019 Russell Stuart.
This program is free software: you can redistribute it and/or modify it
under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or (at your
option) any later version.
The copyright holders grant you an additional permission under Section 7
of the GNU Affero General Public License, version 3, exempting you from
the requirement in Section 6 of the GNU General Public License, version 3,
to accompany Corresponding Source with Installation Information for the
Program or any work based on the Program. You are still required to
comply with all other Section 6 requirements to provide Corresponding
Source.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
--
Russell Stuart
2014-May-29
pam-python-1.0.7/src/ 0000755 0002157 0001751 00000000000 13541422776 013322 5 ustar rstuart it pam-python-1.0.7/src/test.py 0000644 0002157 0001751 00000046622 13541422776 014665 0 ustar rstuart it #!/usr/bin/python -W default
#
# This is the test script for libpython-pam. There aren't many stones
# left unturned.
#
# Best run from the Makefile using the target 'test'. To run manually:
# sudo ln -s $PWD/test-pam_python.pam /etc/pam.d
# python test.py
# sudo rm /etc/pam.d/test-pam_python.pam
#
import warnings; warnings.simplefilter('default')
import os
import sys
TEST_PAM_MODULE = "test-pam_python.pam"
TEST_PAM_USER = "root"
#
# A Fairly straight forward test harness.
#
def pam_sm_end(pamh):
return test(pam_sm_end, pamh, None, None)
def pam_sm_authenticate(pamh, flags, argv):
return test(pam_sm_authenticate, pamh, flags, argv)
def pam_sm_setcred(pamh, flags, argv):
return test(pam_sm_setcred, pamh, flags, argv)
def pam_sm_acct_mgmt(pamh, flags, argv):
return test(pam_sm_acct_mgmt, pamh, flags, argv)
def pam_sm_open_session(pamh, flags, argv):
return test(pam_sm_open_session, pamh, flags, argv)
def pam_sm_close_session(pamh, flags, argv):
return test(pam_sm_close_session, pamh, flags, argv)
def pam_sm_chauthtok(pamh, flags, argv):
return test(pam_sm_chauthtok, pamh, flags, argv)
def test(who, pamh, flags, argv):
import test
if not hasattr(test, "test_function"):# only true if not called via "main"
return pamh.PAM_SUCCESS # normally happens only if run by ctest
test_function = globals()[test.test_function.__name__]
return test_function(test.test_results, who, pamh, flags, argv)
def run_test(caller):
import test
test_name = caller.__name__[4:]
sys.stdout.write("Testing " + test_name + " ")
sys.stdout.flush()
test.test_results = []
test.test_function = globals()["test_" + test_name]
caller(test.test_results)
sys.stdout.write("OK\n")
def pam_conv(auth, query_list, userData=None):
return query_list
#
# Verify the results match.
#
def assert_results(expected_results, results):
for i in range(min(len(expected_results), len(results))):
assert expected_results[i] == results[i], (i, expected_results[i], results[i])
if len(expected_results) < len(results):
assert len(expected_results) == len(results), (i, results[len(expected_results)])
else:
assert len(expected_results) == len(results), (i, expected_results[len(results)])
#
# Test all the calls happen.
#
def test_basic_calls(results, who, pamh, flags, argv):
results.append((who.func_name, flags, argv))
return pamh.PAM_SUCCESS
def run_basic_calls(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
pam.acct_mgmt()
pam.chauthtok()
pam.open_session()
pam.close_session()
del pam
me = os.path.join(os.getcwd(), __file__)
expected_results = [
(pam_sm_authenticate.func_name, 0, [me]),
(pam_sm_acct_mgmt.func_name, 0, [me, 'arg1', 'arg2']),
(pam_sm_chauthtok.func_name, 16384, [me]),
(pam_sm_chauthtok.func_name, 8192, [me]),
(pam_sm_open_session.func_name, 0, [me]),
(pam_sm_close_session.func_name, 0, [me]),
(pam_sm_end.func_name, None, None)]
assert_results(expected_results, results)
#
# Test all the constants are defined.
#
PAM_CONSTANTS = {
#
# Constants defined in _pam_types.h. The item constants are omitted.
#
"PAM_SUCCESS": 0,
"PAM_OPEN_ERR": 1,
"PAM_SYMBOL_ERR": 2,
"PAM_SERVICE_ERR": 3,
"PAM_SYSTEM_ERR": 4,
"PAM_BUF_ERR": 5,
"PAM_PERM_DENIED": 6,
"PAM_AUTH_ERR": 7,
"PAM_CRED_INSUFFICIENT": 8,
"PAM_AUTHINFO_UNAVAIL": 9,
"PAM_USER_UNKNOWN": 10,
"PAM_MAXTRIES": 11,
"PAM_NEW_AUTHTOK_REQD": 12,
"PAM_ACCT_EXPIRED": 13,
"PAM_SESSION_ERR": 14,
"PAM_CRED_UNAVAIL": 15,
"PAM_CRED_EXPIRED": 16,
"PAM_CRED_ERR": 17,
"PAM_NO_MODULE_DATA": 18,
"PAM_CONV_ERR": 19,
"PAM_AUTHTOK_ERR": 20,
"PAM_AUTHTOK_RECOVER_ERR": 21,
"PAM_AUTHTOK_RECOVERY_ERR": 21,
"PAM_AUTHTOK_LOCK_BUSY": 22,
"PAM_AUTHTOK_DISABLE_AGING": 23,
"PAM_TRY_AGAIN": 24,
"PAM_IGNORE": 25,
"PAM_ABORT": 26,
"PAM_AUTHTOK_EXPIRED": 27,
"PAM_MODULE_UNKNOWN": 28,
"PAM_BAD_ITEM": 29,
"PAM_CONV_AGAIN": 30,
"PAM_INCOMPLETE": 31,
"PAM_SERVICE": 1,
"PAM_USER": 2,
"PAM_TTY": 3,
"PAM_RHOST": 4,
"PAM_CONV": 5,
"PAM_AUTHTOK": 6,
"PAM_OLDAUTHTOK": 7,
"PAM_RUSER": 8,
"PAM_USER_PROMPT": 9,
"PAM_FAIL_DELAY": 10,
"PAM_XDISPLAY": 11,
"PAM_XAUTHDATA": 12,
"PAM_AUTHTOK_TYPE": 13,
"PAM_SILENT": 0x8000,
"PAM_DISALLOW_NULL_AUTHTOK": 0x0001,
"PAM_ESTABLISH_CRED": 0x0002,
"PAM_DELETE_CRED": 0x0004,
"PAM_REINITIALIZE_CRED": 0x0008,
"PAM_REFRESH_CRED": 0x0010,
"PAM_CHANGE_EXPIRED_AUTHTOK": 0x0020,
"PAM_DATA_SILENT": 0x40000000,
"PAM_PROMPT_ECHO_OFF": 1,
"PAM_PROMPT_ECHO_ON": 2,
"PAM_ERROR_MSG": 3,
"PAM_TEXT_INFO": 4,
"PAM_RADIO_TYPE": 5,
"PAM_BINARY_PROMPT": 7,
"PAM_MAX_NUM_MSG": 32,
"PAM_MAX_MSG_SIZE": 512,
"PAM_MAX_RESP_SIZE": 512,
"_PAM_RETURN_VALUES": 32,
#
# Constants defined in pam_modules.h. The item constants are omitted.
#
"PAM_PRELIM_CHECK": 0x4000,
"PAM_UPDATE_AUTHTOK": 0x2000,
"PAM_DATA_REPLACE": 0x20000000,
}
def test_constants(results, who, pamh, flags, argv):
results.append(who.func_name)
if who != pam_sm_authenticate:
return pamh.PAM_SUCCESS
pam_constants = dict([
(var, getattr(pamh,var))
for var in dir(pamh)
if var.startswith("PAM_") or var.startswith("_PAM_")])
results.append(pam_constants)
try:
pamh.PAM_SUCCESS = 1
results.append("Opps, pamh.PAM_SUCCESS = 1 worked!")
except StandardError, e:
results.append("except: %s" % e)
return pamh.PAM_SUCCESS
def run_constants(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
pam.close_session()
del pam
assert results[0] == pam_sm_authenticate.func_name, (results[0], pam_sm_authenticate.func_name)
assert results[2] == "except: attribute 'PAM_SUCCESS' of 'PamHandle_type' objects is not writable", results[2]
assert results[3] == pam_sm_close_session.func_name, (results[3], pam_sm_close_session.func_name)
assert results[4] == pam_sm_end.func_name, (results[4], pam_sm_end.func_name)
consts = results[1]
for var in PAM_CONSTANTS.keys():
assert consts.has_key(var), var
assert consts[var] == PAM_CONSTANTS[var], (var, consts[var], PAM_CONSTANTS[var])
for var in consts.keys():
assert PAM_CONSTANTS.has_key(var), var
assert PAM_CONSTANTS[var] == consts[var], (var, PAM_CONSTANTS[var], consts[var])
assert len(results) == 5, len(results)
#
# Test the environment calls.
#
def test_environment(results, who, pamh, flags, argv):
results.append(who.func_name)
if who != pam_sm_acct_mgmt:
return pamh.PAM_SUCCESS
def test_exception(func):
try:
func()
return str(None)
except Exception, e:
return e.__class__.__name__ + ": " + str(e)
#
# A few things to test here. First that PamEnv_as_mapping works.
#
results.append(len(pamh.env))
results.append(pamh.env["x1"])
pamh.env["yy"] = "y"
results.append(pamh.env["yy"])
pamh.env["yy"] = "z"
results.append(pamh.env["yy"])
def t(): pamh.env["yy"] = 1
results.append(test_exception(t))
del pamh.env["yy"]
results.append(test_exception(lambda: pamh.env["yy"]))
results.append(test_exception(lambda: pamh.env[1]))
results.append(test_exception(lambda: pamh.env['a=']))
results.append(test_exception(lambda: pamh.env['']))
#
# Now the dict functions.
#
pamh.env["xx"] = "x"
results.append("not in" in pamh.env)
results.append("xx" in pamh.env)
results.append(pamh.env.has_key("not in"))
results.append(pamh.env.has_key("xx"))
results.append(test_exception(lambda: pamh.env.__getitem__("not in")))
results.append(pamh.env.get("not in"))
results.append(pamh.env.get("not in", "default"))
results.append(pamh.env.get("xx"))
results.append(pamh.env.get("xx", "default"))
del pamh.env["x1"]
results.append(pamh.env.items())
results.append(pamh.env.keys())
results.append(pamh.env.values())
return pamh.PAM_SUCCESS
def run_environment(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
pam.putenv("x1=1")
pam.putenv("x2=2")
pam.putenv("x3=3")
pam.acct_mgmt()
pam.close_session()
del pam
expected_results = [
pam_sm_authenticate.func_name, pam_sm_acct_mgmt.func_name,
3, '1', 'y', 'z',
'TypeError: PAM environment value must be a string',
"KeyError: 'yy'",
'TypeError: PAM environment key must be a string',
"ValueError: PAM environment key can't contain '='",
"ValueError: PAM environment key mustn't be 0 length",
False, True, False, True,
"KeyError: 'not in'",
None, 'default', 'x', 'x',
[('x2', '2'), ('x3', '3'), ('xx', 'x')],
['x2', 'x3', 'xx'],
['2', '3', 'x'],
pam_sm_close_session.func_name, pam_sm_end.func_name]
assert_results(expected_results, results)
#
# Test strerror().
#
def test_strerror(results, who, pamh, flags, argv):
results.append(who.func_name)
if who != pam_sm_authenticate:
return pamh.PAM_SUCCESS
results.extend([(e, pamh.strerror(e).lower()) for e in (0, 1, 30, 31)])
return pamh.PAM_SUCCESS
def run_strerror(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
del pam
expected_results = [
pam_sm_authenticate.func_name,
( 0, 'success'),
( 1, 'failed to load module'),
(30, 'conversation is waiting for event'),
(31, 'application needs to call libpam again'),
pam_sm_end.func_name]
assert_results(expected_results, results)
#
# Test items.
#
def test_items(results, who, pamh, flags, argv):
results.append(who.func_name)
if not who in (pam_sm_open_session, pam_sm_close_session):
return pamh.PAM_SUCCESS
items = {
"authtok": "authtok-module",
"authtok_type": "authtok_type-module",
"oldauthtok": "oldauthtok-module",
"rhost": "rhost-module",
"ruser": "ruser-module",
"tty": "tty-module",
"user_prompt": "user_prompt-module",
"user": "user-module",
"xdisplay": "xdisplay-module",
}
keys = items.keys()
keys.sort()
for key in keys:
results.append((key, getattr(pamh, key)))
value = items[key]
if value != None:
setattr(pamh, key, value)
try:
setattr(pamh, "tty", 1)
results.append("%r = %r" % (key, value))
except StandardError, e:
results.append("except: %s" % e)
results.append(pamh.get_user("a prompt"))
return pamh.PAM_SUCCESS
def run_items(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
items = {
2: "user",
3: "tty",
4: "rhost",
8: "ruser",
9: "user_prompt",
11: "xdisplay",
13: "authtok_type"}
items_list = items.keys()
items_list.sort()
for item in items_list:
pam.set_item(item, items[item])
pam.open_session()
pam.close_session()
del pam
expected_results = [
pam_sm_authenticate.func_name, pam_sm_open_session.func_name,
('authtok', None),
('authtok_type', 'authtok_type'),
('oldauthtok', None),
('rhost', 'rhost'),
('ruser', 'ruser'),
('tty', 'tty'),
('user', 'user'),
('user_prompt', 'user_prompt'),
('xdisplay', 'xdisplay'),
'except: PAM item PAM_TTY must be set to a string',
'user-module',
pam_sm_close_session.func_name,
('authtok', 'authtok-module'),
('authtok_type', 'authtok_type-module'),
('oldauthtok', 'oldauthtok-module'),
('rhost', 'rhost-module'),
('ruser', 'ruser-module'),
('tty', 'tty-module'),
('user', 'user-module'),
('user_prompt', 'user_prompt-module'),
('xdisplay', 'xdisplay-module'),
'except: PAM item PAM_TTY must be set to a string',
'user-module',
pam_sm_end.func_name]
assert_results(expected_results, results)
#
# Test the xauthdata item.
#
def test_xauthdata(results, who, pamh, flags, argv):
results.append(who.func_name)
if not who in (pam_sm_open_session, pam_sm_close_session):
return pamh.PAM_SUCCESS
xauthdata0 = pamh.XAuthData("name-module", "data-module")
pamh.xauthdata = xauthdata0
xauthdata1 = pamh.xauthdata
results.append('name=%r, data=%r' % (xauthdata1.name, xauthdata1.data))
try:
xauthdata2 = pamh.XAuthData(None, "x")
results.append('pamh.XAuthData(%r, %r)' % (xauthdata2.name, xauthdata2.data))
except TypeError, e:
results.append('except: %s' % e)
try:
xauthdata2 = pamh.XAuthData("x", 1)
results.append('pamh.XAuthData(%r, %r)' % (xauthdata2.name, xauthdata2.data))
except TypeError, e:
results.append('except: %s' % e)
class XA: pass
XA.name = "name-XA"
XA.data = "data-XA"
pamh.xauthdata = XA
xauthdata2 = pamh.xauthdata
results.append('name=%r, data=%r' % (xauthdata2.name, xauthdata2.data))
xa = XA()
xa.name = "name-xa"
xa.data = "data-xa"
pamh.xauthdata = xa
xauthdata4 = pamh.xauthdata
results.append('name=%r, data=%r' % (xauthdata4.name, xauthdata4.data))
return pamh.PAM_SUCCESS
def run_xauthdata(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
#
# The PAM module doesn't support XAUTHDATA, so check what we can from the
# module only.
#
pam.open_session()
pam.close_session()
del pam
expected_results = [
pam_sm_authenticate.func_name, pam_sm_open_session.func_name,
("name='name-module', data='data-module'"),
'except: XAuthData() argument 1 must be string, not None',
'except: XAuthData() argument 2 must be string, not int',
("name='name-XA', data='data-XA'"),
("name='name-xa', data='data-xa'"),
pam_sm_close_session.func_name,
("name='name-module', data='data-module'"),
'except: XAuthData() argument 1 must be string, not None',
'except: XAuthData() argument 2 must be string, not int',
("name='name-XA', data='data-XA'"),
("name='name-xa', data='data-xa'"),
pam_sm_end.func_name]
assert_results(expected_results, results)
#
# Test having no pam_sm_end.
#
def test_no_sm_end(results, who, pamh, flags, argv):
results.append(who.func_name)
global pam_sm_end
del pam_sm_end
return pamh.PAM_SUCCESS
def run_no_sm_end(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
del pam
expected_results = [pam_sm_authenticate.func_name]
assert_results(expected_results, results)
#
# Test the conversation mechanism.
#
def test_conv(results, who, pamh, flags, argv):
results.append(who.func_name)
if who == pam_sm_end:
return
#
# We must get rid of all references to pamh.Response objects. This instance
# of the test.py module is running inside of libpam_python. That shared
# library will be unloaded soon. Should a pamh.Response instance be
# dealloc'ed after it is unloaded the now non-existant dealloc function will
# be called, and a SIGSEGV will result. Normally instances would not leak,
# but with the trickery we are performing with fake import's here they will
# leak via the results variable unless we take special action.
#
def conv(convs):
responses = pamh.conversation(convs)
if type(responses) != type(()):
return (responses.resp, responses.resp_retcode)
return [(r.resp, r.resp_retcode) for r in responses]
if who == pam_sm_authenticate:
convs = [
pamh.Message(pamh.PAM_PROMPT_ECHO_OFF, "Prompt_echo_off"),
pamh.Message(pamh.PAM_PROMPT_ECHO_ON, "Prompt_echo_on"),
pamh.Message(pamh.PAM_ERROR_MSG, "Error_msg"),
pamh.Message(pamh.PAM_TEXT_INFO, "Text_info")]
if who == pam_sm_acct_mgmt:
convs = pamh.Message(pamh.PAM_PROMPT_ECHO_OFF, "single")
results.append(conv(convs))
return pamh.PAM_SUCCESS
def run_conv(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
pam.acct_mgmt()
del pam
expected_results = [
pam_sm_authenticate.func_name,
[('Prompt_echo_off', 1), ('Prompt_echo_on', 2), ('Error_msg', 3), ('Text_info', 4)],
pam_sm_acct_mgmt.func_name,
('single', 1),
pam_sm_end.func_name]
assert_results(expected_results, results)
#
# Test pam error returns.
#
def test_pamerr(results, who, pamh, flags, argv):
return results[-1]
def run_pamerr(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
for err in range(0, PAM._PAM_RETURN_VALUES):
results.append(err)
try:
pam.authenticate(0)
except PAM.error, e:
results[-1] = -e.args[1]
del pam
expected_results = [-r for r in range(PAM._PAM_RETURN_VALUES)]
expected_results[25] = -6
assert_results(expected_results, results)
#
# Test fail_delay.
#
def test_fail_delay(results, who, pamh, flags, argv):
pamh.fail_delay(10)
return pamh.PAM_SUCCESS
def run_fail_delay(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
del pam
#
# Test raising an exception.
#
def test_exceptions(results, who, pamh, flags, argv):
if who != pam_sm_end:
return pamh.PAM_SUCCESS
#
# Here we have use of a backdoor put into pam_python.c specifically
# for testing raising exceptions. Oddly, normally PAM should never
# return anything other than PAM_SUCCESS to anything pam_python.c
# calls.
#
debug_magic = 0x4567abcd
results.append(pamh._PAM_RETURN_VALUES)
for err in range(pamh._PAM_RETURN_VALUES):
try:
pamh.strerror(debug_magic + err)
results.append(err)
except pamh.exception, e:
results.append((-e.pam_result,))
return pamh.PAM_SUCCESS
def run_exceptions(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
del pam
expected_results = [results[0], 0]
expected_results += [(-r,) for r in range(1, results[0])]
assert_results(expected_results, results)
#
# Test absent entry point.
#
def test_absent(results, who, pamh, flags, argv):
results.append(who.func_name)
if who != pam_sm_authenticate:
return pamh.PAM_SUCCESS
global pam_sm_acct_mgmt; del pam_sm_acct_mgmt
global pam_sm_setcred; del pam_sm_setcred
global pam_sm_open_session; del pam_sm_open_session
global pam_sm_close_session; del pam_sm_close_session
global pam_sm_chauthtok; del pam_sm_chauthtok
return pamh.PAM_SUCCESS
def run_absent(results):
pam = PAM.pam()
pam.start(TEST_PAM_MODULE, TEST_PAM_USER, pam_conv)
pam.authenticate(0)
funcs = (
pam.acct_mgmt,
pam.setcred,
pam.open_session,
pam.close_session,
pam.chauthtok
)
for func in funcs:
try:
func(0)
exception = None
except Exception, e:
exception = e
results.append((exception.__class__.__name__, str(exception)))
del pam
expected_results = [
'pam_sm_authenticate',
('error', "('Symbol not found', 2)"),
('error', "('Symbol not found', 2)"),
('error', "('Symbol not found', 2)"),
('error', "('Symbol not found', 2)"),
('error', "('Symbol not found', 2)"),
]
assert_results(expected_results, results)
#
# Entry point.
#
def main(argv):
run_test(run_basic_calls)
run_test(run_constants)
run_test(run_environment)
run_test(run_strerror)
run_test(run_items)
run_test(run_xauthdata)
run_test(run_no_sm_end)
run_test(run_conv)
run_test(run_pamerr)
run_test(run_fail_delay)
run_test(run_exceptions)
run_test(run_absent)
#
# If run from Python run the test suite. Otherwse we are being used
# as a real PAM module presumable from ctest, so just make every call
# return success.
#
if __name__ == "__main__":
import PAM
main(sys.argv)
pam-python-1.0.7/src/Makefile 0000644 0002157 0001751 00000004042 13541422776 014762 0 ustar rstuart it all: ctest pam_python.so test-pam_python.pam
WARNINGS=-Wall -Wextra -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wsign-compare -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Werror
#WARNINGS=-Wunreachable-code # Gcc 4.1 .. 4.4 are too buggy to make this useful
LIBDIR ?= /lib/security
pam_python.so: pam_python.c setup.py Makefile
@rm -f "$@"
@[ ! -e build -o build/lib.*/$@ -nt setup.py -a build/lib.*/$@ -nt Makefile ] || rm -r build
CFLAGS="$(WARNINGS) -I/usr/local/lib/ " ./setup.py build
@#CFLAGS="-O0 $(WARNINGS)" ./setup.py build --debug
@#CFLAGS="-O0 $(WARNINGS)" Py_DEBUG=1 ./setup.py build --debug
ln -sf build/lib.*/$@ .
.PHONY: install install-lib
install: install-lib
install-lib:
mkdir -p $(DESTDIR)$(LIBDIR)
cp build/lib.*/pam_python.so $(DESTDIR)$(LIBDIR)
.PHONY: clean
clean:
rm -rf build ctest pam_python.so test-pam_python.pam test.pyc core
[ ! -e /etc/pam.d/test-pam_python.pam ] || { s=$$([ $$(id -u) = 0 ] || echo sudo); $$s rm -f /etc/pam.d/test-pam_python.pam; }
[ ! -e /etc/pam.d/test-pam_python-installed.pam ] || { s=$$([ $$(id -u) = 0 ] || echo sudo); $$s rm -f /etc/pam.d/test-pam_python-installed.pam; }
.PHONY: ctest
ctest: ctest.c Makefile
gcc -O0 $(WARNINGS) -g -o $@ ctest.c -lpam
test-pam_python.pam: test-pam_python.pam.in Makefile
sed "s,\\\$$PWD,$$(pwd),g" "$@.in" >"$@.tmp"
mv $@.tmp $@
/etc/pam.d/test-pam_python.pam: test-pam_python.pam
s=$$([ $$(id -u) = 0 ] || echo sudo); $$s ln -sf $$(pwd)/test-pam_python.pam /etc/pam.d
.PHONY: test
test: pam_python.so ctest /etc/pam.d/test-pam_python.pam
python test.py
./ctest
test-pam_python-installed.pam: test-pam_python.pam.in Makefile
sed "s,\\\$$PWD/pam-python.so,pam-python.so,;s,\\\$$PWD,$$(pwd),g" "$@.in" >"$@.tmp"
mv $@.tmp $@
/etc/pam.d/test-pam_python-installed.pam: test-pam_python-installed.pam
s=$$([ $$(id -u) = 0 ] || echo sudo); $$s ln -sf $$(pwd)/test-pam_python-installed.pam /etc/pam.d
.PHONY: installed-test
installed-test: ctest /etc/pam.d/test-pam_python-installed.pam
python test.py
./ctest
pam-python-1.0.7/src/ctest.c 0000644 0002157 0001751 00000007701 13541422776 014615 0 ustar rstuart it /*
* Best compiled & run using the Makefile target "test". To compile and run
* manually:
* gcc -O0 -g -Wall -o test -lpam test.c
* sudo ln -s $PWD/test-pam_python.pam /etc/pam.d
* ./ctest
* sudo rm /etc/pam.d/test-pam_python.pam
*/
#define _GNU_SOURCE
#ifdef __APPLE__
#include
#else
#include
#endif
#include
#include
#include
#include
#include
struct walk_info {
int libpam_python_seen;
int python_seen;
};
static int conv(
int num_msg, const struct pam_message** msg, struct pam_response** resp, void *appdata_ptr)
{
int i;
(void)appdata_ptr;
*resp = malloc(num_msg * sizeof(**resp));
for (i = 0; i < num_msg; i += 1)
{
(*resp)[i].resp = strdup((*msg)[i].msg);
(*resp)[i].resp_retcode = (*msg)[i].msg_style;
}
return 0;
}
static void call_pam(
int* exit_status, const char* who, pam_handle_t* pamh,
int (*func)(pam_handle_t*, int))
{
int pam_result = (*func)(pamh, 0);
if (pam_result == PAM_SUCCESS)
return;
fprintf(
stderr, "%s failed: %d %s\n",
who, pam_result, pam_strerror(pamh, pam_result));
*exit_status = 1;
}
#ifdef __APPLE__
static void walk_dlls(struct walk_info* walk_info)
{
int image_index;
walk_info->libpam_python_seen = 0;
walk_info->python_seen = 0;
for (image_index = 0; image_index < _dyld_image_count(); image_index += 1) {
const char* image_name = _dyld_get_image_name(image_index);
if (strstr(image_name, "/pam_python.so") != 0)
walk_info->libpam_python_seen = 1;
if (strstr(image_name, "/libpython") != 0)
walk_info->python_seen = 1;
}
}
#else
static int dl_walk(struct dl_phdr_info* info, size_t size, void* data)
{
struct walk_info* walk_info = data;
(void)size;
if (strstr(info->dlpi_name, "/pam_python.so") != 0)
walk_info->libpam_python_seen = 1;
if (strstr(info->dlpi_name, "/libpython") != 0)
walk_info->python_seen = 1;
return 0;
}
static void walk_dlls(struct walk_info* walk_info)
{
walk_info->libpam_python_seen = 0;
walk_info->python_seen = 0;
dl_iterate_phdr(dl_walk, walk_info);
}
#endif
int main(int argc, char **argv)
{
int exit_status;
struct pam_conv convstruct;
pam_handle_t* pamh;
struct walk_info walk_info_before;
struct walk_info walk_info_after;
(void)argc;
(void)argv;
if (access("/etc/pam.d/test-pam_python.pam", 0) != 0)
{
fprintf(
stderr,
"**WARNING**\n"
" This test requires ./test-pam_python.pam configuration to be\n"
" available to PAM But it doesn't appear to be in /etc/pam.d.\n"
);
}
printf("Testing calls from C");
fflush(stdout);
convstruct.conv = conv;
convstruct.appdata_ptr = 0;
if (pam_start("test-pam_python.pam", "", &convstruct, &pamh) == -1)
{
fprintf(stderr, "pam_start failed\n");
exit(1);
}
exit_status = 0;
call_pam(&exit_status, "pam_authenticate", pamh, pam_authenticate);
call_pam(&exit_status, "pam_chauthtok", pamh, pam_chauthtok);
call_pam(&exit_status, "pam_acct_mgmt", pamh, pam_acct_mgmt);
call_pam(&exit_status, "pam_open_session", pamh, pam_open_session);
call_pam(&exit_status, "pam_close_session", pamh, pam_close_session);
walk_dlls(&walk_info_before);
call_pam(&exit_status, "pam_end", pamh, pam_end);
if (exit_status == 0)
printf(" OK\n");
walk_dlls(&walk_info_after);
printf("Testing dll load/unload ");
if (!walk_info_before.libpam_python_seen)
{
fprintf(stderr, "It looks like pam_python.so wasn't loaded!\n");
exit_status = 1;
}
else if (!walk_info_before.python_seen)
{
fprintf(stderr, "It looks like libpythonX.Y.so wasn't loaded!\n");
exit_status = 1;
}
else if (walk_info_after.libpam_python_seen)
{
fprintf(stderr, "pam_python.so wasn't unloaded.\n");
exit_status = 1;
}
else if (walk_info_after.python_seen)
{
fprintf(stderr, "libpythonX.Y.so wasn't uloaded.\n");
exit_status = 1;
}
else
printf("OK\n");
return exit_status;
}
pam-python-1.0.7/src/setup.py 0000755 0002157 0001751 00000003154 13541422776 015042 0 ustar rstuart it #!/usr/bin/python -W default
import warnings; warnings.simplefilter('default')
import distutils.sysconfig
import os
import sys
try:
from setuptools import setup, Extension
except ImportError:
from distutils.core import setup, Extension
long_description = """\
Embeds the Python interpreter into PAM \
so PAM modules can be written in Python"""
classifiers = [
"Development Status :: 4 - Beta",
"Intended Audience :: Developers",
"License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
"Natural Language :: English",
"Operating System :: Unix",
"Programming Language :: C",
"Programming Language :: Python",
"Topic :: Software Development :: Libraries :: Python Modules",
"Topic :: System :: Systems Administration :: Authentication/Directory"]
if not os.environ.has_key("Py_DEBUG"):
Py_DEBUG = []
else:
Py_DEBUG = [('Py_DEBUG',1)]
libpython_so = distutils.sysconfig.get_config_var('INSTSONAME')
ext_modules = [
Extension(
"pam_python",
sources=["pam_python.c"],
include_dirs = [],
library_dirs=[],
define_macros=[('LIBPYTHON_SO','"'+libpython_so+'"')] + Py_DEBUG,
libraries=["pam","python%d.%d" % sys.version_info[:2]],
), ]
setup(
name="pam_python",
version="1.0.7",
description="Enabled PAM Modules to be written in Python",
keywords="pam,embed,authentication,security",
platforms="Unix",
long_description=long_description,
author="Russell Stuart",
author_email="russell-pampython@stuart.id.au",
url="http://pam-python.sourceforge.net/",
license="AGPL-3.0",
classifiers=classifiers,
ext_modules=ext_modules,
)
pam-python-1.0.7/src/test-pam_python.pam.in 0000644 0002157 0001751 00000000314 12345724561 017555 0 ustar rstuart it auth required $PWD/pam_python.so $PWD/test.py
account required $PWD/pam_python.so $PWD/test.py arg1 arg2
password required $PWD/pam_python.so $PWD/test.py
session required $PWD/pam_python.so $PWD/test.py
pam-python-1.0.7/src/pam_python.c 0000644 0002157 0001751 00000223473 13541422776 015657 0 ustar rstuart it /*
* Copyright (c) 2007-2012,2014,2016,2019 Russell Stuart
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published
* by the Free Software Foundation, either version 3 of the License, or (at
* your option) any later version.
*
* The copyright holders grant you an additional permission under Section 7
* of the GNU Affero General Public License, version 3, exempting you from
* the requirement in Section 6 of the GNU General Public License, version 3,
* to accompany Corresponding Source with Installation Information for the
* Program or any work based on the Program. You are still required to
* comply with all other Section 6 requirements to provide Corresponding
* Source.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see .
*/
#define PAM_SM_AUTH
#define PAM_SM_ACCOUNT
#define PAM_SM_SESSION
#define PAM_SM_PASSWORD
#include
#ifndef __APPLE__
#include
#include
#else
#include
#include
#define _PAM_RETURN_VALUES 30 // pam_types.h
#endif
#undef _POSIX_C_SOURCE
#include
#include
#include
#include
#include
#ifndef MODULE_NAME
#define MODULE_NAME "libpam_python"
#endif
#ifndef DEFAULT_SECURITY_DIR
#ifdef __APPLE__
#define DEFAULT_SECURITY_DIR "/usr/lib/pam/"
#else
#define DEFAULT_SECURITY_DIR "/lib/security/"
#endif
#endif
#define PAMHANDLE_NAME "PamHandle"
#define PAMHANDLEEXCEPTION_NAME "PamException"
#define arr_size(x) (sizeof(x) / sizeof(*(x)))
const char libpam_python_version[] = "1.0.3";
const char libpam_python_date[] = "2014-05-05";
#define PyCFunctionKwds_cast (PyCFunction)(Py_ssize_t)
/*
* Add typedef for Py_ssize_t if it you have an older python.
*/
#if (PY_VERSION_HEX < 0x02050000)
typedef int Py_ssize_t;
#endif
/*
* The python interpreter's shared library.
*/
static char libpython_so[] = LIBPYTHON_SO;
/*
* Initialise Python. How this should be done changed between versions.
*/
static void initialise_python(void)
{
#if PY_MAJOR_VERSION*100 + PY_MINOR_VERSION >= 204
Py_DontWriteBytecodeFlag = 1;
Py_IgnoreEnvironmentFlag = 1;
/* Py_IsolatedFlag = 1; Python3 only */
Py_NoSiteFlag = 1;
Py_NoUserSiteDirectory = 1;
Py_InitializeEx(0);
#else
size_t signum;
struct sigaction oldsigaction[NSIG];
for (signum = 0; signum < arr_size(oldsigaction); signum += 1)
sigaction(signum, 0, &oldsigaction[signum]);
Py_Initialize();
for (signum = 0; signum < arr_size(oldsigaction); signum += 1)
sigaction(signum, &oldsigaction[signum], 0);
#endif
}
/*
* The Py_XDECREF macro gives warnings. This function doesn't.
*/
static void py_xdecref(PyObject* object)
{
Py_XDECREF(object);
}
/*
* Generic traverse function for heap objects.
*/
static int generic_traverse(PyObject* self, visitproc visitor, void* arg)
{
PyMemberDef* member;
int member_visible;
PyObject* object;
int py_result;
PyObject** slot;
member = self->ob_type->tp_members;
if (member == 0)
return 0;
/*
* Loop for python visible and python non-visible members.
*/
for (member_visible = 0; member_visible < 2; member_visible += 1)
{
for (; member->name != 0; member += 1)
{
if (member->type != T_OBJECT && member->type != T_OBJECT_EX)
continue;
slot = (PyObject**)((char*)self + member->offset);
object = *slot;
if (object == 0)
continue;
py_result = visitor(object, arg);
if (py_result != 0)
return py_result;
}
member += 1;
}
return 0;
}
/*
* Clear all slots in the object.
*/
static void clear_slot(PyObject** slot)
{
PyObject* object;
object = *slot;
if (object != 0)
{
*slot = 0;
Py_DECREF(object);
}
}
static int generic_clear(PyObject* self)
{
PyMemberDef* member;
int member_visible;
member = self->ob_type->tp_members;
if (member == 0)
return 0;
/*
* Loop for python visible and python non-visible members.
*/
for (member_visible = 0; member_visible < 2; member_visible += 1)
{
for (; member->name != 0; member += 1)
{
if (member->type != T_OBJECT && member->type != T_OBJECT_EX)
continue;
clear_slot((PyObject**)((char*)self + member->offset));
}
member += 1;
}
return 0;
}
/*
* A dealloc for all our objects.
*/
static void generic_dealloc(PyObject* self)
{
PyTypeObject* type = self->ob_type;
if (PyObject_IS_GC(self))
PyObject_GC_UnTrack(self);
if (type->tp_clear != 0)
type->tp_clear(self);
type->tp_free(self);
}
/*
* The PamHandleObject - the object passed to all the python module's entry
* points.
*/
typedef struct
{
PyObject_HEAD /* The Python Object Header */
void* dlhandle; /* dlopen() handle */
PyObject* env; /* pamh.env */
PyObject* exception; /* pamh.exception */
char* libpam_version; /* pamh.libpam_version */
PyTypeObject* message; /* pamh.Message */
PyObject* module; /* The Python Pam Module */
pam_handle_t* pamh; /* The pam handle */
PyObject* print_exception;/* traceback.print_exception */
int py_initialized; /* True if Py_initialize() called */
PyTypeObject* response; /* pamh.Response */
PyObject* syslogFile; /* A (the) SyslogFile instance */
PyTypeObject* xauthdata; /* pamh.XAuthData */
} PamHandleObject;
/*
* Forward declarations.
*/
static int call_python_handler(
PyObject** result, PamHandleObject* pamHandle,
PyObject* handler_function, const char* handler_name,
int flags, int argc, const char** argv);
/*
* The SyslogfileObject. It emulates a Python file object (in that it has
* a write method). It prints to stuff passed to write() on syslog.
*/
#define SYSLOGFILE_NAME "SyslogFile"
typedef struct
{
PyObject_HEAD /* The Python Object Header */
char* buffer; /* Line buffer */
int size; /* Size of the buffer in bytes */
} SyslogFileObject;
/*
* Clear the SyslogFileObject for the garbage collector.
*/
static int SyslogFile_clear(PyObject* self)
{
SyslogFileObject* syslogFile = (SyslogFileObject*)self;
PyMem_Free(syslogFile->buffer);
syslogFile->buffer = 0;
syslogFile->size = 0;
return generic_clear(self);
}
/*
* Emulate python's file.write(), but write to syslog.
*/
static PyObject* SyslogFile_write(
PyObject* self, PyObject* args, PyObject* kwds)
{
SyslogFileObject* syslogFile = (SyslogFileObject*)self;
const char* c;
const char* data = 0;
int len;
const char* newline;
PyObject* result = 0;
static char* kwlist[] = {"data", NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, "s:write", kwlist, &data))
goto error_exit;
if (syslogFile->buffer == 0)
len = 0;
else
len = strlen(syslogFile->buffer);
len += strlen(data) + 1;
if (len > syslogFile->size)
{
const int new_size = len * 2;
syslogFile->buffer = PyMem_Realloc(syslogFile->buffer, new_size);
if (syslogFile->buffer == 0)
{
syslogFile->size = 0;
goto error_exit;
}
if (syslogFile->size == 0)
syslogFile->buffer[0] = '\0';
syslogFile->size = new_size;
}
strcat(syslogFile->buffer, data);
for (c = syslogFile->buffer; *c != '\0'; c = newline + 1) {
newline = strchr(c, '\n');
if (newline == 0)
break;
syslog(LOG_AUTHPRIV|LOG_ERR, "%.*s", (int)(newline - c), c);
}
if (c != syslogFile->buffer)
strcpy(syslogFile->buffer, c);
result = Py_None;
Py_INCREF(result);
error_exit:
return result;
}
/*
* Emulate python's file.flush(), but write to syslog.
*/
static void SyslogFile_flush(PyObject* self)
{
SyslogFileObject* syslogFile = (SyslogFileObject*)self;
if (syslogFile->buffer != 0 && syslogFile->buffer[0] != '\0')
{
syslog(LOG_AUTHPRIV|LOG_ERR, "%s", syslogFile->buffer);
syslogFile->buffer[0] = '\0';
}
}
static PyMethodDef SyslogFile_Methods[] =
{
{
"write",
PyCFunctionKwds_cast SyslogFile_write,
METH_VARARGS|METH_KEYWORDS,
0
},
{0,0,0,0} /* Sentinal */
};
/*
* Open syslog.
*/
static void syslog_open(const char* module_path)
{
openlog(module_path, LOG_CONS|LOG_PID, LOG_AUTHPRIV);
}
/*
* Close syslog.
*/
static void syslog_close(void)
{
closelog();
}
/*
* Type to translate a Python Exception to a PAM error.
*/
static int syslog_python2pam(PyObject* exception_type)
{
if (exception_type == PyExc_MemoryError)
return PAM_BUF_ERR;
return PAM_SERVICE_ERR;
}
/*
* Return the modules filename.
*/
static const char* get_module_path(PamHandleObject* pamHandle)
{
const char* result = PyModule_GetFilename(pamHandle->module);
if (result != 0)
return result;
return MODULE_NAME;
}
/*
* Print an exception to syslog.
*/
static int syslog_path_exception(const char* module_path, const char* errormsg)
{
PyObject* message = 0;
PyObject* name = 0;
PyObject* ptype = 0;
PyObject* ptraceback = 0;
PyObject* pvalue = 0;
int pam_result = 0;
PyObject* stype = 0;
const char* str_name = 0;
const char* str_message = 0;
PyErr_Fetch(&ptype, &pvalue, &ptraceback);
/*
* We don't have a PamHandleObject, so we can't print a full traceback.
* Just print the exception in some recognisable form, hopefully.
*/
syslog_open(module_path);
if (PyClass_Check(ptype))
stype = PyObject_GetAttrString(ptype, "__name__");
else
{
stype = ptype;
Py_INCREF(stype);
}
if (stype != 0)
{
name = PyObject_Str(stype);
if (name != 0)
str_name = PyString_AsString(name);
}
if (pvalue != 0)
{
message = PyObject_Str(pvalue);
if (message != 0)
str_message = PyString_AsString(message);
}
if (errormsg != 0 && str_name != 0 && str_message != 0)
{
syslog(
LOG_AUTHPRIV|LOG_ERR, "%s - %s: %s",
errormsg, str_name, str_message);
}
else if (str_name != 0 && str_message != 0)
syslog(LOG_AUTHPRIV|LOG_ERR, "%s: %s", str_name, str_message);
else if (errormsg != 0 && str_name != 0)
syslog(LOG_AUTHPRIV|LOG_ERR, "%s - %s", errormsg, str_name);
else if (errormsg != 0 && str_message != 0)
syslog(LOG_AUTHPRIV|LOG_ERR, "%s - %s", errormsg, str_message);
else if (errormsg != 0)
syslog(LOG_AUTHPRIV|LOG_ERR, "%s", errormsg);
else if (str_name != 0)
syslog(LOG_AUTHPRIV|LOG_ERR, "%s", str_name);
else if (str_message != 0)
syslog(LOG_AUTHPRIV|LOG_ERR, "%s", str_message);
pam_result = syslog_python2pam(ptype);
py_xdecref(message);
py_xdecref(name);
py_xdecref(ptraceback);
py_xdecref(ptype);
py_xdecref(pvalue);
py_xdecref(stype);
syslog_close();
return pam_result;
}
/*
* Print an exception to syslog, once we are initialised.
*/
static int syslog_exception(PamHandleObject* pamHandle, const char* errormsg)
{
return syslog_path_exception(get_module_path(pamHandle), errormsg);
}
/*
* Print an message to syslog.
*/
static int syslog_path_vmessage(
const char* module_path, const char* message, va_list ap)
{
syslog_open(module_path);
vsyslog(LOG_AUTHPRIV|LOG_ERR, message, ap);
syslog_close();
return PAM_SERVICE_ERR;
}
/*
* Print an message to syslog.
*/
static int syslog_path_message(
const char* module_path, const char* message, ...)
{
va_list ap;
int result;
va_start(ap, message);
result = syslog_path_vmessage(module_path, message, ap);
va_end(ap);
return result;
}
/*
* Print an message to syslog, once we are initialised.
*/
static int syslog_message(PamHandleObject* pamHandle, const char* message, ...)
{
va_list ap;
int result;
va_start(ap, message);
result = syslog_path_vmessage(get_module_path(pamHandle), message, ap);
va_end(ap);
return result;
}
/*
* Print a traceback to syslog.
*/
static int syslog_path_traceback(
const char* module_path, PamHandleObject* pamHandle)
{
PyObject* args = 0;
PyObject* ptraceback = 0;
PyObject* ptype = 0;
PyObject* pvalue = 0;
PyObject* py_resultobj = 0;
int pam_result;
PyErr_Fetch(&ptype, &pvalue, &ptraceback);
/*
* If there isn't a traceback just log the exception.
*/
if (ptraceback == 0)
{
PyErr_Restore(ptype, pvalue, ptraceback);
return syslog_path_exception(module_path, 0);
}
/*
* Bit messy, this. The easiest way to print a traceback is to use
* the traceback module, writing through a dummy file that actually
* outputs to syslog.
*/
syslog_open(module_path);
if (ptype == 0)
{
ptype = Py_None;
Py_INCREF(ptype);
}
if (pvalue == 0)
{
pvalue = Py_None;
Py_INCREF(pvalue);
}
args = Py_BuildValue(
"OOOOO", ptype, pvalue, ptraceback, Py_None, pamHandle->syslogFile);
if (args != 0)
{
py_resultobj = PyEval_CallObject(pamHandle->print_exception, args);
if (py_resultobj != 0)
SyslogFile_flush(pamHandle->syslogFile);
}
pam_result = syslog_python2pam(ptype);
py_xdecref(args);
py_xdecref(ptraceback);
py_xdecref(ptype);
py_xdecref(pvalue);
py_xdecref(py_resultobj);
syslog_close();
return pam_result;
}
/*
* Print an message to syslog, once we are initialised.
*/
static int syslog_traceback(PamHandleObject* pamHandle)
{
return syslog_path_traceback(get_module_path(pamHandle), pamHandle);
}
/*
* The PamMessage object - used in conversations.
*/
#define PAMMESSAGE_NAME "Message"
typedef struct
{
PyObject_HEAD /* The Python Object header */
int msg_style; /* struct pam_message.msg_style */
PyObject* msg; /* struct pam_message.msg */
} PamMessageObject;
static char PamMessage_doc[] =
MODULE_NAME "." PAMHANDLE_NAME "." PAMMESSAGE_NAME "(msg_style, msg)\n"
" Constructs an immutable object that can be passed to\n"
" " MODULE_NAME "." PAMHANDLE_NAME ".conversation(). The parameters are\n"
" assigned to readonly members of the same name. msg_style determines what\n"
" is done (eg prompt for input, write a message), and msg is the prompt or\n"
" message.";
static PyMemberDef PamMessage_members[] =
{
{
"msg_style",
T_INT,
offsetof(PamMessageObject, msg_style),
READONLY,
"What to do with the msg member, eg display it or use as a prompt.",
},
{
"msg",
T_OBJECT_EX,
offsetof(PamMessageObject, msg),
READONLY,
"The text to display to the user",
},
{0,0,0,0,0}, /* End of Python visible members */
{0,0,0,0,0} /* Sentinal */
};
static PyObject* PamMessage_new(
PyTypeObject* type, PyObject* args, PyObject* kwds)
{
int err;
PyObject* msg = 0;
int msg_style = 0;
PamMessageObject* pamMessage = 0;
PyObject* self = 0;
static char* kwlist[] = {"msg_style", "msg", 0};
err = PyArg_ParseTupleAndKeywords(
args, kwds, "iO!:Message", kwlist,
&msg_style, &PyString_Type, &msg);
if (!err)
goto error_exit;
pamMessage = (PamMessageObject*)type->tp_alloc(type, 0);
if (pamMessage == 0)
goto error_exit;
pamMessage->msg_style = msg_style;
pamMessage->msg = msg;
Py_INCREF(pamMessage->msg);
self = (PyObject*)pamMessage;
pamMessage = 0;
error_exit:
py_xdecref((PyObject*)pamMessage);
return self;
}
/*
* The PamResponse object - used in conversations.
*/
#define PAMRESPONSE_NAME "Response"
typedef struct
{
PyObject_HEAD /* The Python Object header */
PyObject* resp; /* struct pam_response.resp */
int resp_retcode; /* struct pam_response.resp_retcode */
} PamResponseObject;
static char PamResponse_doc[] =
MODULE_NAME "." PAMHANDLE_NAME "." PAMRESPONSE_NAME "(resp, resp_retcode)\n"
" Constructs an immutable object that is returned by\n"
" " MODULE_NAME "." PAMHANDLE_NAME ".conversation(). The parameters are\n"
" assigned to readonly members of the same name. resp is the response from\n"
" the user (if one was asked for), and resp_retcode says what it means.";
static PyMemberDef PamResponse_members[] =
{
{
"resp",
T_OBJECT_EX,
offsetof(PamResponseObject, resp),
READONLY,
"The response from the user.",
},
{
"resp_retcode",
T_INT,
offsetof(PamResponseObject, resp_retcode),
READONLY,
"The type of response.",
},
{0,0,0,0,0}, /* End of Python visible members */
{0,0,0,0,0} /* Sentinal */
};
static PyObject* PamResponse_new(
PyTypeObject* type, PyObject* args, PyObject* kwds)
{
int err;
PyObject* resp = 0;
int resp_retcode = 0;
PamResponseObject* pamResponse = 0;
PyObject* self = 0;
static char* kwlist[] = {"resp", "resp_retcode", 0};
err = PyArg_ParseTupleAndKeywords(
args, kwds, "Oi:Response", kwlist,
&resp, &resp_retcode);
if (!err)
goto error_exit;
if (resp != Py_None && !PyString_Check(resp))
{
PyErr_SetString(PyExc_TypeError, "resp must be a string or None");
goto error_exit;
}
pamResponse = (PamResponseObject*)type->tp_alloc(type, 0);
if (pamResponse == 0)
goto error_exit;
pamResponse->resp_retcode = resp_retcode;
pamResponse->resp = resp;
Py_INCREF(pamResponse->resp);
self = (PyObject*)pamResponse;
pamResponse = 0;
error_exit:
py_xdecref((PyObject*)pamResponse);
return self;
}
/*
* The PamXAuthData object - used by PAM_XAUTHDATA item.
*/
#define PAMXAUTHDATA_NAME "XAuthData"
typedef struct
{
PyObject_HEAD /* The Python Object header */
PyObject* name; /* struct pam_xauth_data.name */
PyObject* data; /* struct pam_xauth_data.data */
} PamXAuthDataObject;
static char PamXAuthData_doc[] =
MODULE_NAME "." PAMHANDLE_NAME "." PAMXAUTHDATA_NAME "(name, data)\n"
" Constructs an immutable object is returned by and can be passed to\n"
" the " MODULE_NAME ".xauthdata property. The parameters are\n"
" assigned to readonly members of the same name.";
static PyMemberDef PamXAuthData_members[] =
{
{
"data",
T_OBJECT_EX,
offsetof(PamXAuthDataObject, data),
READONLY,
"The value of the data item. A string or None.",
},
{
"name",
T_OBJECT_EX,
offsetof(PamXAuthDataObject, name),
READONLY,
"The name of the data item. A string or None.",
},
{0,0,0,0,0}, /* End of Python visible members */
{0,0,0,0,0} /* Sentinal */
};
static PyObject* PamXAuthData_new(
PyTypeObject* type, PyObject* args, PyObject* kwds)
{
int err;
PyObject* name = 0;
PyObject* data = 0;
PamXAuthDataObject* pamXAuthData = 0;
PyObject* self = 0;
static char* kwlist[] = {"name", "data", 0};
err = PyArg_ParseTupleAndKeywords(
args, kwds, "SS:XAuthData", kwlist,
&name, &data);
if (!err)
goto error_exit;
pamXAuthData = (PamXAuthDataObject*)type->tp_alloc(type, 0);
if (pamXAuthData == 0)
goto error_exit;
pamXAuthData->name = name;
Py_INCREF(pamXAuthData->name);
pamXAuthData->data = data;
Py_INCREF(pamXAuthData->data);
self = (PyObject*)pamXAuthData;
pamXAuthData = 0;
error_exit:
py_xdecref((PyObject*)pamXAuthData);
return self;
}
/*
* Check a PAM return value. If the function failed raise an exception
* and return -1.
*/
static int check_pam_result(PamHandleObject* pamHandle, int pam_result)
{
if (pam_result == PAM_SUCCESS)
return 0;
if (!PyErr_Occurred())
{
PyObject* ptype;
PyObject* pvalue;
PyObject* ptraceback;
PyObject* error_code = 0;
const char* error_string = pam_strerror(pamHandle->pamh, pam_result);
PyErr_SetString(pamHandle->exception, error_string);
PyErr_Fetch(&ptype, &pvalue, &ptraceback);
PyErr_NormalizeException(&ptype, &pvalue, &ptraceback);
error_code = PyInt_FromLong(pam_result);
if (error_code != NULL)
PyObject_SetAttrString(pvalue, "pam_result", error_code);
PyErr_Restore(ptype, pvalue, ptraceback);
py_xdecref(error_code);
}
return -1;
}
/*
* Python getters / setters are used to manipulate PAM's items.
*/
static PyObject* PamHandle_get_item(PyObject* self, int item_type)
{
PamHandleObject* pamHandle = (PamHandleObject*)self;
const char* value;
PyObject* result = 0;
int pam_result;
pam_result = pam_get_item(pamHandle->pamh, item_type, (const void**)&value);
if (check_pam_result(pamHandle, pam_result) == -1)
goto error_exit;
if (value != 0)
result = PyString_FromString(value);
else
{
result = Py_None;
Py_INCREF(result);
}
error_exit:
return result;
}
static int PamHandle_set_item(
PyObject* self, int item_type, char* item_name, PyObject* pyValue)
{
PamHandleObject* pamHandle = (PamHandleObject*)self;
int pam_result;
int result = -1;
char* value;
char error_message[64];
if (pyValue == Py_None)
value = 0;
else
{
value = PyString_AsString(pyValue);
if (value == 0)
{
snprintf(
error_message, sizeof(error_message),
"PAM item %s must be set to a string", item_name);
PyErr_SetString(PyExc_TypeError, error_message);
goto error_exit;
}
value = strdup(value);
if (value == 0)
{
PyErr_NoMemory();
goto error_exit;
}
}
pam_result = pam_set_item(pamHandle->pamh, item_type, value);
if (pam_result == PAM_SUCCESS)
value = 0;
result = check_pam_result(pamHandle, pam_result);
error_exit:
if (value != 0)
free(value);
return result;
}
/*
* The PAM Environment Object & its iterator.
*/
#define PAMENV_NAME "PamEnv"
typedef struct
{
PyObject_HEAD /* The Python Object header */
PamHandleObject* pamHandle; /* The PamHandle that owns us */
PyTypeObject* pamEnvIter_type;/* A class for our iterators */
} PamEnvObject;
static PyMemberDef PamEnv_Members[] =
{
{0,0,0,0,0}, /* End of Python visible members */
{
"Iter",
T_OBJECT_EX,
offsetof(PamEnvObject, pamEnvIter_type),
READONLY,
"Iterator class for " PAMENV_NAME
},
{0,0,0,0,0} /* Sentinel */
};
#define PAMENVITER_NAME "PamEnvIter"
typedef struct
{
PyObject_HEAD
PamEnvObject* env; /* The PamEnvObject we are iterating */
int pos; /* Nest position to return */
PyObject* (*get_entry)(const char* entry); /* What to return */
} PamEnvIterObject;
static PyMemberDef PamEnvIter_Members[] =
{
{0,0,0,0,0}, /* End of Python visible members */
{
"env",
T_OBJECT_EX,
offsetof(PamEnvIterObject, env),
READONLY,
"Dictionary to iterate"
},
{0,0,0,0,0} /* Sentinel */
};
/*
* Create a new iterator for a PamEnv.
*/
static PyObject* PamEnvIter_create(
PamEnvObject* pamEnv, PyObject* (*get_entry)(const char* entry))
{
PyTypeObject* type = pamEnv->pamEnvIter_type;
PamEnvIterObject* pamEnvIter;
PyObject* result = 0;
pamEnvIter = (PamEnvIterObject*)type->tp_alloc(type, 0);
if (pamEnvIter == 0)
goto error_exit;
pamEnvIter->env = pamEnv;
Py_INCREF(pamEnvIter->env);
pamEnvIter->get_entry = get_entry;
pamEnvIter->pos = 0;
result = (PyObject*)pamEnvIter;
Py_INCREF(result);
error_exit:
py_xdecref((PyObject*)pamEnvIter);
return result;
}
/*
* Return the next object in the iteration.
*/
static PyObject* PamEnvIter_iternext(PyObject* self)
{
PamEnvIterObject* pamEnvIter = (PamEnvIterObject*)self;
char** env;
int i;
PyObject* result;
if (pamEnvIter->env == 0)
goto error_exit;
env = pam_getenvlist(pamEnvIter->env->pamHandle->pamh);
if (env == 0)
goto error_exit;
for (i = 0; env[i] != 0 && i < pamEnvIter->pos; i += 1)
continue;
if (env[i] == 0)
goto error_exit;
result = pamEnvIter->get_entry(env[i]);
if (result == 0)
goto error_exit;
pamEnvIter->pos += 1;
return result;
error_exit:
clear_slot((PyObject**)&pamEnvIter->env);
return 0;
}
/*
* Return a python object for the key part.
*/
static PyObject* PamEnvIter_key_entry(const char* entry)
{
const char* equals;
equals = strchr(entry, '=');
if (equals == 0)
return PyString_FromString(entry);
return PyString_FromStringAndSize(entry, equals - entry);
}
/*
* Return a python object for the value part.
*/
static PyObject* PamEnvIter_value_entry(const char* entry)
{
const char* equals;
equals = strchr(entry, '=');
if (equals == 0)
return PyString_FromString("");
return PyString_FromString(equals + 1);
}
/*
* Return a python object entire item.
*/
static PyObject* PamEnvIter_item_entry(const char* entry)
{
PyObject* key = 0;
PyObject* result = 0;
PyObject* tuple = 0;
PyObject* value = 0;
key = PamEnvIter_key_entry(entry);
if (key == 0)
goto error_exit;
value = PamEnvIter_value_entry(entry);
if (key == 0)
goto error_exit;
tuple = PyTuple_New(2);
if (tuple == 0)
goto error_exit;
if (PyTuple_SetItem(tuple, 0, key) == -1)
goto error_exit;
key = 0; /* was stolen */
if (PyTuple_SetItem(tuple, 1, value) == -1)
goto error_exit;
value = 0; /* was stolen */
result = tuple;
tuple = 0;
error_exit:
py_xdecref(key);
py_xdecref(tuple);
py_xdecref(value);
return result;
}
/*
* Create an iterator.
*/
static PyObject* PamEnv_iter(PyObject* self)
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
return PamEnvIter_create(pamEnv, PamEnvIter_key_entry);
}
/*
* Get the value of a environment key.
*/
static const char* PamEnv_getkey(PyObject* key)
{
const char* result;
if (!PyString_Check(key))
{
PyErr_SetString(PyExc_TypeError, "PAM environment key must be a string");
return 0;
}
result = PyString_AS_STRING(key);
if (*result == '\0')
{
PyErr_SetString(
PyExc_ValueError,
"PAM environment key mustn't be 0 length");
return 0;
}
if (strchr(result, '=') != 0)
{
PyErr_SetString(PyExc_ValueError, "PAM environment key can't contain '='");
return 0;
}
return result;
}
/*
* Return the length.
*/
static Py_ssize_t PamEnv_mp_length(PyObject* self)
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
char** env;
int length;
env = pam_getenvlist(pamEnv->pamHandle->pamh);
if (env == 0)
return 0;
for (length = 0; env[length] != 0; length += 1)
continue;
return length;
}
/*
* Lookup a key returning its value.
*/
static PyObject* PamEnv_mp_subscript(PyObject* self, PyObject* key)
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
PyObject* result = 0;
const char* key_str;
const char* value;
key_str = PamEnv_getkey(key);
if (key_str == 0)
goto error_exit;
value = pam_getenv(pamEnv->pamHandle->pamh, key_str);
if (value == 0)
{
PyErr_SetString(PyExc_KeyError, key_str);
goto error_exit;
}
result = PyString_FromString(value);
error_exit:
return result;
}
/*
* Assign a value to a key, or delete it.
*/
static int PamEnv_mp_assign(PyObject* self, PyObject* key, PyObject* value)
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
char* value_str = 0;
int result = -1;
const char* key_str;
int pam_result;
key_str = PamEnv_getkey(key);
if (key_str == 0)
goto error_exit;
if (value == 0)
value_str = (char*)key_str;
else
{
if (!PyString_Check(value))
{
PyErr_SetString(
PyExc_TypeError, "PAM environment value must be a string");
goto error_exit;
}
value_str = malloc(PyString_Size(key) + 1 + PyString_Size(value) + 1);
if (value_str == 0)
{
PyErr_NoMemory();
goto error_exit;
}
strcat(strcat(strcpy(value_str, key_str), "="), PyString_AS_STRING(value));
}
pam_result = pam_putenv(pamEnv->pamHandle->pamh, value_str);
if (pam_result != PAM_SUCCESS) // PAM_BAD_ITEM in Linux = PAM_BUF_ERR,PAM_SYSTEM_ERR
{
PyErr_SetString(PyExc_KeyError, key_str);
goto error_exit;
}
if (check_pam_result(pamEnv->pamHandle, pam_result) == -1)
goto error_exit;
value_str = 0;
result = 0;
error_exit:
if (value_str != key_str && value_str != 0)
free(value_str);
return result;
}
static PyMappingMethods PamEnv_as_mapping =
{
PamEnv_mp_length, /* mp_length */
PamEnv_mp_subscript, /* mp_subscript */
PamEnv_mp_assign, /* mp_ass_subscript */
};
/*
* Check if a key is in the environment.
*/
static PyObject* PamEnv_has_key(
PyObject* self, PyObject* args, PyObject* kwds)
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
PyObject* key;
PyObject* result = 0;
const char* key_str;
const char* value_str;
static char* kwlist[] = {"key", NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, "O:has_key", kwlist, &key))
goto error_exit;
key_str = PamEnv_getkey(key);
if (key_str == 0)
goto error_exit;
value_str = pam_getenv(pamEnv->pamHandle->pamh, key_str);
result = value_str != 0 ? Py_True : Py_False;
Py_INCREF(result);
error_exit:
return result;
}
/*
* Lookup a key and return its value, throwing KeyError if the key
* doesn't exist.
*/
static PyObject* PamEnv_getitem(
PyObject* self, PyObject* args, PyObject* kwds)
{
PyObject* result = 0;
PyObject* key;
static char* kwlist[] = {"key", NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, "O:__getitem__", kwlist, &key))
goto error_exit;
result = PamEnv_mp_subscript(self, key);
error_exit:
return result;
}
/*
* Lookup a key and return its value, returning None or a default if it
* doesn't exist.
*/
static PyObject* PamEnv_get(
PyObject* self, PyObject* args, PyObject* kwds)
{
int err;
PamEnvObject* pamEnv = (PamEnvObject*)self;
PyObject* default_value = 0;
PyObject* result = 0;
PyObject* key;
const char* key_str;
const char* value_str;
static char* kwlist[] = {"key", "default", NULL};
err = PyArg_ParseTupleAndKeywords(
args, kwds, "O|O:get", kwlist,
&key, &default_value);
if (!err)
goto error_exit;
key_str = PamEnv_getkey(key);
if (key_str == 0)
goto error_exit;
value_str = pam_getenv(pamEnv->pamHandle->pamh, key_str);
if (value_str != 0)
result = PyString_FromString(value_str);
else
{
result = default_value != 0 ? default_value : Py_None;
Py_INCREF(result);
}
error_exit:
return result;
}
/*
* Return all objects in the environment as a sequence.
*/
static PyObject* PamEnv_as_sequence(
PyObject* self, PyObject* (*get_entry)(const char* entry))
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
PyObject* list = 0;
PyObject* result = 0;
PyObject* entry = 0;
char** env;
int i;
int length;
env = pam_getenvlist(pamEnv->pamHandle->pamh);
if (env == 0)
length = 0;
else
{
for (length = 0; env[length] != 0; length += 1)
continue;
}
list = PyList_New(length);
if (list == 0)
goto error_exit;
for (i = 0; env[i] != 0; i += 1)
{
entry = get_entry(env[i]);
if (entry == 0)
goto error_exit;
if (PyList_SetItem(list, i, entry) == -1)
goto error_exit;
entry = 0; /* was stolen */
}
result = list;
list = 0;
error_exit:
py_xdecref(list);
py_xdecref(entry);
return result;
}
/*
* Return all (key, value) pairs.
*/
static PyObject* PamEnv_items(
PyObject* self, PyObject* args, PyObject* kwds)
{
static char* kwlist[] = {NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, ":items", kwlist))
return 0;
return PamEnv_as_sequence(self, PamEnvIter_item_entry);
}
/*
* An iterator for all (key, value) pairs.
*/
static PyObject* PamEnv_iteritems(
PyObject* self, PyObject* args, PyObject* kwds)
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
static char* kwlist[] = {NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, ":iteritems", kwlist))
return 0;
return PamEnvIter_create(pamEnv, PamEnvIter_item_entry);
}
/*
* An iterator for the keys.
*/
static PyObject* PamEnv_iterkeys(
PyObject* self, PyObject* args, PyObject* kwds)
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
static char* kwlist[] = {NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, ":iterkeys", kwlist))
return 0;
return PamEnvIter_create(pamEnv, PamEnvIter_key_entry);
}
/*
* An iterator for the values.
*/
static PyObject* PamEnv_itervalues(
PyObject* self, PyObject* args, PyObject* kwds)
{
PamEnvObject* pamEnv = (PamEnvObject*)self;
static char* kwlist[] = {NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, ":itervalues", kwlist))
return 0;
return PamEnvIter_create(pamEnv, PamEnvIter_value_entry);
}
/*
* Return all keys.
*/
static PyObject* PamEnv_keys(
PyObject* self, PyObject* args, PyObject* kwds)
{
static char* kwlist[] = {NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, ":keys", kwlist))
return 0;
return PamEnv_as_sequence(self, PamEnvIter_key_entry);
}
/*
* Return all (key, value) pairs.
*/
static PyObject* PamEnv_values(
PyObject* self, PyObject* args, PyObject* kwds)
{
static char* kwlist[] = {NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, ":values", kwlist))
return 0;
return PamEnv_as_sequence(self, PamEnvIter_value_entry);
}
static PyMethodDef PamEnv_Methods[] =
{
{"__contains__", PyCFunctionKwds_cast PamEnv_has_key,METH_VARARGS|METH_KEYWORDS, 0},
{"__getitem__", PyCFunctionKwds_cast PamEnv_getitem,METH_VARARGS|METH_KEYWORDS, 0},
{"get", PyCFunctionKwds_cast PamEnv_get, METH_VARARGS|METH_KEYWORDS, 0},
{"has_key", PyCFunctionKwds_cast PamEnv_has_key,METH_VARARGS|METH_KEYWORDS, 0},
{"items", PyCFunctionKwds_cast PamEnv_items, METH_VARARGS|METH_KEYWORDS, 0},
{"iteritems", PyCFunctionKwds_cast PamEnv_iteritems,METH_VARARGS|METH_KEYWORDS, 0},
{"iterkeys", PyCFunctionKwds_cast PamEnv_iterkeys,METH_VARARGS|METH_KEYWORDS, 0},
{"itervalues", PyCFunctionKwds_cast PamEnv_itervalues,METH_VARARGS|METH_KEYWORDS, 0},
{"keys", PyCFunctionKwds_cast PamEnv_keys, METH_VARARGS|METH_KEYWORDS, 0},
{"values", PyCFunctionKwds_cast PamEnv_values, METH_VARARGS|METH_KEYWORDS, 0},
{0,0,0,0} /* Sentinel */
};
/*
* Python Getter's for the constants.
*/
#define DECLARE_CONSTANT_GET_VALUE(x, v) \
static PyObject* PamHandle_Constant_ ## x(PyObject* object, void* closure) { \
object = object; \
closure = closure; \
return PyLong_FromLong(v); \
}
#define DECLARE_CONSTANT_GET(x) \
static PyObject* PamHandle_Constant_ ## x(PyObject* object, void* closure) { \
object = object; \
closure = closure; \
return PyLong_FromLong(x); \
}
#ifdef HAVE_PAM_FAIL_DELAY
DECLARE_CONSTANT_GET_VALUE(HAVE_PAM_FAIL_DELAY, 1)
#else
DECLARE_CONSTANT_GET_VALUE(HAVE_PAM_FAIL_DELAY, 0)
#endif
DECLARE_CONSTANT_GET(PAM_ABORT)
DECLARE_CONSTANT_GET(PAM_ACCT_EXPIRED)
DECLARE_CONSTANT_GET(PAM_AUTH_ERR)
DECLARE_CONSTANT_GET(PAM_AUTHINFO_UNAVAIL)
DECLARE_CONSTANT_GET(PAM_AUTHTOK)
DECLARE_CONSTANT_GET(PAM_AUTHTOK_DISABLE_AGING)
DECLARE_CONSTANT_GET(PAM_AUTHTOK_ERR)
DECLARE_CONSTANT_GET(PAM_AUTHTOK_EXPIRED)
DECLARE_CONSTANT_GET(PAM_AUTHTOK_LOCK_BUSY)
#ifdef PAM_AUTHTOK_RECOVERY_ERR
DECLARE_CONSTANT_GET(PAM_AUTHTOK_RECOVERY_ERR)
#endif
#ifdef PAM_AUTHTOK_RECOVER_ERR
DECLARE_CONSTANT_GET(PAM_AUTHTOK_RECOVER_ERR)
#endif
#ifdef PAM_AUTHTOK_TYPE
DECLARE_CONSTANT_GET(PAM_AUTHTOK_TYPE)
#endif
#ifdef PAM_BAD_ITEM
DECLARE_CONSTANT_GET(PAM_BAD_ITEM)
#endif
#ifdef PAM_BINARY_PROMPT
DECLARE_CONSTANT_GET(PAM_BINARY_PROMPT)
#endif
DECLARE_CONSTANT_GET(PAM_BUF_ERR)
DECLARE_CONSTANT_GET(PAM_CHANGE_EXPIRED_AUTHTOK)
DECLARE_CONSTANT_GET(PAM_CONV)
#ifdef PAM_CONV_AGAIN
DECLARE_CONSTANT_GET(PAM_CONV_AGAIN)
#endif
DECLARE_CONSTANT_GET(PAM_CONV_ERR)
DECLARE_CONSTANT_GET(PAM_CRED_ERR)
DECLARE_CONSTANT_GET(PAM_CRED_EXPIRED)
DECLARE_CONSTANT_GET(PAM_CRED_INSUFFICIENT)
DECLARE_CONSTANT_GET(PAM_CRED_UNAVAIL)
#ifdef PAM_DATA_REPLACE
DECLARE_CONSTANT_GET(PAM_DATA_REPLACE)
#endif
#ifdef PAM_DATA_SILENT
DECLARE_CONSTANT_GET(PAM_DATA_SILENT)
#endif
DECLARE_CONSTANT_GET(PAM_DELETE_CRED)
DECLARE_CONSTANT_GET(PAM_DISALLOW_NULL_AUTHTOK)
DECLARE_CONSTANT_GET(PAM_ERROR_MSG)
DECLARE_CONSTANT_GET(PAM_ESTABLISH_CRED)
#ifdef PAM_FAIL_DELAY
DECLARE_CONSTANT_GET(PAM_FAIL_DELAY)
#endif
DECLARE_CONSTANT_GET(PAM_IGNORE)
#ifdef PAM_INCOMPLETE
DECLARE_CONSTANT_GET(PAM_INCOMPLETE)
#endif
DECLARE_CONSTANT_GET(PAM_MAX_MSG_SIZE)
DECLARE_CONSTANT_GET(PAM_MAX_NUM_MSG)
DECLARE_CONSTANT_GET(PAM_MAX_RESP_SIZE)
DECLARE_CONSTANT_GET(PAM_MAXTRIES)
DECLARE_CONSTANT_GET(PAM_MODULE_UNKNOWN)
DECLARE_CONSTANT_GET(PAM_NEW_AUTHTOK_REQD)
DECLARE_CONSTANT_GET(PAM_NO_MODULE_DATA)
DECLARE_CONSTANT_GET(PAM_OLDAUTHTOK)
DECLARE_CONSTANT_GET(PAM_OPEN_ERR)
DECLARE_CONSTANT_GET(PAM_PERM_DENIED)
DECLARE_CONSTANT_GET(PAM_PRELIM_CHECK)
DECLARE_CONSTANT_GET(PAM_PROMPT_ECHO_OFF)
DECLARE_CONSTANT_GET(PAM_PROMPT_ECHO_ON)
#ifdef PAM_RADIO_TYPE
DECLARE_CONSTANT_GET(PAM_RADIO_TYPE)
#endif
DECLARE_CONSTANT_GET(PAM_REFRESH_CRED)
DECLARE_CONSTANT_GET(PAM_REINITIALIZE_CRED)
DECLARE_CONSTANT_GET(_PAM_RETURN_VALUES)
DECLARE_CONSTANT_GET(PAM_RHOST)
DECLARE_CONSTANT_GET(PAM_RUSER)
DECLARE_CONSTANT_GET(PAM_SERVICE)
DECLARE_CONSTANT_GET(PAM_SERVICE_ERR)
DECLARE_CONSTANT_GET(PAM_SESSION_ERR)
DECLARE_CONSTANT_GET(PAM_SILENT)
DECLARE_CONSTANT_GET(PAM_SUCCESS)
DECLARE_CONSTANT_GET(PAM_SYMBOL_ERR)
DECLARE_CONSTANT_GET(PAM_SYSTEM_ERR)
DECLARE_CONSTANT_GET(PAM_TEXT_INFO)
DECLARE_CONSTANT_GET(PAM_TRY_AGAIN)
DECLARE_CONSTANT_GET(PAM_TTY)
DECLARE_CONSTANT_GET(PAM_UPDATE_AUTHTOK)
DECLARE_CONSTANT_GET(PAM_USER)
DECLARE_CONSTANT_GET(PAM_USER_PROMPT)
DECLARE_CONSTANT_GET(PAM_USER_UNKNOWN)
#ifdef PAM_XAUTHDATA
DECLARE_CONSTANT_GET(PAM_XAUTHDATA)
#endif
#ifdef PAM_XDISPLAY
DECLARE_CONSTANT_GET(PAM_XDISPLAY)
#endif
#define CONSTANT_GETSET(x) {#x, PamHandle_Constant_ ## x, 0, 0, 0}
#define MAKE_GETSET_ITEM(t) \
static PyObject* PamHandle_get_##t(PyObject* self, void* closure) \
{ \
closure = closure; \
return PamHandle_get_item(self, PAM_##t); \
} \
static int PamHandle_set_##t(PyObject* self, PyObject* pyValue, void* closure) \
{ \
closure = closure; \
return PamHandle_set_item(self, PAM_##t, "PAM_" #t, pyValue); \
}
MAKE_GETSET_ITEM(AUTHTOK)
#ifdef PAM_AUTHTOK_TYPE
MAKE_GETSET_ITEM(AUTHTOK_TYPE)
#endif
MAKE_GETSET_ITEM(OLDAUTHTOK)
MAKE_GETSET_ITEM(RHOST)
MAKE_GETSET_ITEM(RUSER)
MAKE_GETSET_ITEM(SERVICE)
MAKE_GETSET_ITEM(TTY)
MAKE_GETSET_ITEM(USER)
MAKE_GETSET_ITEM(USER_PROMPT)
#ifdef PAM_XDISPLAY
MAKE_GETSET_ITEM(XDISPLAY)
#endif
#ifdef PAM_XAUTHDATA
/*
* The PAM_XAUTHDATA item doesn't take strings like the rest of them.
* It wants a pam_xauth_data structure.
*/
static PyObject* PamHandle_get_XAUTHDATA(PyObject* self, void* closure)
{
PamHandleObject* pamHandle = (PamHandleObject*)self;
PyObject* newargs = 0;
PyObject* result = 0;
int pam_result;
struct pam_xauth_data* xauth_data = 0;
closure = closure;
pam_result = pam_get_item(
pamHandle->pamh, PAM_XAUTHDATA, (const void**)&xauth_data);
if (check_pam_result(pamHandle, pam_result) == -1)
goto error_exit;
if (xauth_data == 0)
{
result = Py_None;
Py_INCREF(result);
}
else
{
newargs = Py_BuildValue(
"s#s#",
xauth_data->name, xauth_data->namelen,
xauth_data->data, xauth_data->datalen);
if (newargs == 0)
goto error_exit;
result = pamHandle->xauthdata->tp_new(pamHandle->xauthdata, newargs, 0);
if (result == 0)
goto error_exit;
}
error_exit:
py_xdecref(newargs);
return result;
}
static int PamHandle_set_XAUTHDATA(
PyObject* self, PyObject* pyValue, void* closure)
{
PamHandleObject* pamHandle = (PamHandleObject*)self;
PyObject* name = 0;
PyObject* data = 0;
int result = -1;
const char* data_str;
const char* name_str;
int pam_result;
struct pam_xauth_data xauth_data;
closure = closure;
xauth_data.name = 0;
xauth_data.data = 0;
/*
* Get the name.
*/
name = PyObject_GetAttrString(pyValue, "name");
if (name == 0)
goto error_exit;
name_str = PyString_AsString(name);
if (name_str == 0)
{
PyErr_SetString(PyExc_TypeError, "xauthdata.name must be a string");
goto error_exit;
}
xauth_data.name = strdup(name_str);
if (xauth_data.name == 0)
{
PyErr_NoMemory();
goto error_exit;
}
xauth_data.namelen = PyString_GET_SIZE(name);
/*
* Get the data.
*/
data = PyObject_GetAttrString(pyValue, "data");
if (data == 0)
goto error_exit;
data_str = PyString_AsString(data);
if (data_str == 0)
{
PyErr_SetString(PyExc_TypeError, "xauthdata.data must be a string");
goto error_exit;
}
xauth_data.data = strdup(data_str);
if (xauth_data.data == 0)
{
PyErr_NoMemory();
goto error_exit;
}
xauth_data.datalen = PyString_GET_SIZE(data);
/*
* Set the item. If that worked PAM will have swallowed the strings inside
* of it, so we must not free them.
*/
pam_result = pam_set_item(pamHandle->pamh, PAM_XAUTHDATA, &xauth_data);
if (pam_result == PAM_SUCCESS)
{
xauth_data.name = 0;
xauth_data.data = 0;
}
result = check_pam_result(pamHandle, pam_result);
error_exit:
py_xdecref(data);
py_xdecref(name);
if (xauth_data.name != 0)
free(xauth_data.name);
if (xauth_data.data != 0)
free(xauth_data.data);
return result;
}
#endif
/*
* Getters and setters.
*/
static PyGetSetDef PamHandle_Getset[] =
{
/*
* Items.
*/
{"authtok", PamHandle_get_AUTHTOK, PamHandle_set_AUTHTOK, "Authentication token", 0},
#ifdef PAM_AUTHTOK_TYPE
{"authtok_type",PamHandle_get_AUTHTOK_TYPE,PamHandle_set_AUTHTOK_TYPE,"XXX in the \"New XXX password:\" prompt", 0},
#endif
{"oldauthtok", PamHandle_get_OLDAUTHTOK, PamHandle_set_OLDAUTHTOK, "Old authentication token", 0},
{"rhost", PamHandle_get_RHOST, PamHandle_set_RHOST, "Requesting host name", 0},
{"ruser", PamHandle_get_RUSER, PamHandle_set_RUSER, "Requesting user name", 0},
{"service", PamHandle_get_SERVICE, PamHandle_set_SERVICE, "Service (pam stack) name", 0},
{"tty", PamHandle_get_TTY, PamHandle_set_TTY, "Terminal name", 0},
{"user", PamHandle_get_USER, PamHandle_set_USER, "Authorized user name", 0},
{"user_prompt", PamHandle_get_USER_PROMPT, PamHandle_set_USER_PROMPT, "Prompt asking for users name", 0},
#ifdef PAM_XAUTHDATA
{"xauthdata", PamHandle_get_XAUTHDATA, PamHandle_set_XAUTHDATA, "The name of the X display ($DISPLAY)", 0},
#endif
#ifdef PAM_XDISPLAY
{"xdisplay", PamHandle_get_XDISPLAY, PamHandle_set_XDISPLAY, "The name of the X display ($DISPLAY)", 0},
#endif
/*
* Constants.
*/
CONSTANT_GETSET(HAVE_PAM_FAIL_DELAY),
CONSTANT_GETSET(PAM_ABORT),
CONSTANT_GETSET(PAM_ACCT_EXPIRED),
CONSTANT_GETSET(PAM_AUTH_ERR),
CONSTANT_GETSET(PAM_AUTHINFO_UNAVAIL),
CONSTANT_GETSET(PAM_AUTHTOK),
CONSTANT_GETSET(PAM_AUTHTOK_DISABLE_AGING),
CONSTANT_GETSET(PAM_AUTHTOK_ERR),
CONSTANT_GETSET(PAM_AUTHTOK_EXPIRED),
CONSTANT_GETSET(PAM_AUTHTOK_LOCK_BUSY),
#ifdef PAM_AUTHTOK_RECOVERY_ERR
CONSTANT_GETSET(PAM_AUTHTOK_RECOVERY_ERR),
#endif
#ifdef PAM_AUTHTOK_RECOVER_ERR
CONSTANT_GETSET(PAM_AUTHTOK_RECOVER_ERR),
#endif
#ifdef PAM_AUTHTOK_TYPE
CONSTANT_GETSET(PAM_AUTHTOK_TYPE),
#endif
#ifdef PAM_BAD_ITEM
CONSTANT_GETSET(PAM_BAD_ITEM),
#endif
#ifdef PAM_BINARY_PROMPT
CONSTANT_GETSET(PAM_BINARY_PROMPT),
#endif
CONSTANT_GETSET(PAM_BUF_ERR),
CONSTANT_GETSET(PAM_CHANGE_EXPIRED_AUTHTOK),
CONSTANT_GETSET(PAM_CONV),
#ifdef PAM_CONV_AGAIN
CONSTANT_GETSET(PAM_CONV_AGAIN),
#endif
CONSTANT_GETSET(PAM_CONV_ERR),
CONSTANT_GETSET(PAM_CRED_ERR),
CONSTANT_GETSET(PAM_CRED_EXPIRED),
CONSTANT_GETSET(PAM_CRED_INSUFFICIENT),
CONSTANT_GETSET(PAM_CRED_UNAVAIL),
#ifdef PAM_DATA_REPLACE
CONSTANT_GETSET(PAM_DATA_REPLACE),
#endif
#ifdef PAM_DATA_SILENT
CONSTANT_GETSET(PAM_DATA_SILENT),
#endif
CONSTANT_GETSET(PAM_DELETE_CRED),
CONSTANT_GETSET(PAM_DISALLOW_NULL_AUTHTOK),
CONSTANT_GETSET(PAM_ERROR_MSG),
CONSTANT_GETSET(PAM_ESTABLISH_CRED),
#ifdef PAM_FAIL_DELAY
CONSTANT_GETSET(PAM_FAIL_DELAY),
#endif
CONSTANT_GETSET(PAM_IGNORE),
#ifdef PAM_INCOMPLETE
CONSTANT_GETSET(PAM_INCOMPLETE),
#endif
CONSTANT_GETSET(PAM_MAX_MSG_SIZE),
CONSTANT_GETSET(PAM_MAX_NUM_MSG),
CONSTANT_GETSET(PAM_MAX_RESP_SIZE),
CONSTANT_GETSET(PAM_MAXTRIES),
CONSTANT_GETSET(PAM_MODULE_UNKNOWN),
CONSTANT_GETSET(PAM_NEW_AUTHTOK_REQD),
CONSTANT_GETSET(PAM_NO_MODULE_DATA),
CONSTANT_GETSET(PAM_OLDAUTHTOK),
CONSTANT_GETSET(PAM_OPEN_ERR),
CONSTANT_GETSET(PAM_PERM_DENIED),
CONSTANT_GETSET(PAM_PRELIM_CHECK),
CONSTANT_GETSET(PAM_PROMPT_ECHO_OFF),
CONSTANT_GETSET(PAM_PROMPT_ECHO_ON),
#ifdef PAM_RADIO_TYPE
CONSTANT_GETSET(PAM_RADIO_TYPE),
#endif
CONSTANT_GETSET(PAM_REFRESH_CRED),
CONSTANT_GETSET(PAM_REINITIALIZE_CRED),
CONSTANT_GETSET(_PAM_RETURN_VALUES),
CONSTANT_GETSET(PAM_RHOST),
CONSTANT_GETSET(PAM_RUSER),
CONSTANT_GETSET(PAM_SERVICE),
CONSTANT_GETSET(PAM_SERVICE_ERR),
CONSTANT_GETSET(PAM_SESSION_ERR),
CONSTANT_GETSET(PAM_SILENT),
CONSTANT_GETSET(PAM_SUCCESS),
CONSTANT_GETSET(PAM_SYMBOL_ERR),
CONSTANT_GETSET(PAM_SYSTEM_ERR),
CONSTANT_GETSET(PAM_TEXT_INFO),
CONSTANT_GETSET(PAM_TRY_AGAIN),
CONSTANT_GETSET(PAM_TTY),
CONSTANT_GETSET(PAM_UPDATE_AUTHTOK),
CONSTANT_GETSET(PAM_USER),
CONSTANT_GETSET(PAM_USER_PROMPT),
CONSTANT_GETSET(PAM_USER_UNKNOWN),
#ifdef PAM_XAUTHDATA
CONSTANT_GETSET(PAM_XAUTHDATA),
#endif
#ifdef PAM_XDISPLAY
CONSTANT_GETSET(PAM_XDISPLAY),
#endif
{0,0,0,0,0} /* Sentinel */
};
/*
* Convert a PamHandleObject.Message style object to a pam_message structure.
*/
static int PamHandle_conversation_2message(
struct pam_message* message, PyObject* object)
{
PyObject* msg = 0;
PyObject* msg_style = 0;
int result = -1;
msg_style = PyObject_GetAttrString(object, "msg_style");
if (msg_style == 0)
goto error_exit;
if (!PyInt_Check(msg_style) && !PyLong_Check(msg_style))
{
PyErr_SetString(PyExc_TypeError, "message.msg_style must be an int");
goto error_exit;
}
message->msg_style = PyInt_AsLong(msg_style);
msg = PyObject_GetAttrString(object, "msg");
if (msg == 0)
goto error_exit;
message->msg = PyString_AsString(msg);
if (message->msg == 0)
{
PyErr_SetString(PyExc_TypeError, "message.msg must be a string");
goto error_exit;
}
result = 0;
error_exit:
py_xdecref(msg);
py_xdecref(msg_style);
return result;
}
/*
* Convert a pam_response structure to a PamHandleObject.Response object.
*/
static PyObject* PamHandle_conversation_2response(
PamHandleObject* pamHandle, struct pam_response* pam_response)
{
PyObject* newargs;
PyObject* result = 0;
newargs = Py_BuildValue("si", pam_response->resp, pam_response->resp_retcode);
if (newargs == 0)
goto error_exit;
result = pamHandle->response->tp_new(pamHandle->response, newargs, 0);
if (result == 0)
goto error_exit;
error_exit:
py_xdecref(newargs);
return result;
}
/*
* Run a PAM "conversation".
*/
static PyObject* PamHandle_conversation(
PyObject* self, PyObject* args, PyObject* kwds)
{
int err;
PamHandleObject* pamHandle = (PamHandleObject*)self;
PyObject* prompts = 0;
PyObject* result_tuple = 0;
struct pam_message* message_array = 0;
struct pam_message** message_vector = 0;
struct pam_response* response_array = 0;
PyObject* result = 0;
PyObject* response = 0;
const struct pam_conv*conv;
int prompt_count;
int i;
int pam_result;
int prompts_is_sequence;
int py_result;
static char* kwlist[] = {"prompts", NULL};
err = PyArg_ParseTupleAndKeywords(
args, kwds, "O:conversation", kwlist,
&prompts);
if (!err)
goto error_exit;
pam_result = pam_get_item(pamHandle->pamh, PAM_CONV, (const void**)&conv);
if (check_pam_result(pamHandle, pam_result) == -1)
goto error_exit;
prompts_is_sequence = PySequence_Check(prompts);
if (!prompts_is_sequence)
prompt_count = 1;
else
{
prompt_count = PySequence_Size(prompts);
if (prompt_count == 0)
{
result = prompts;
Py_INCREF(result);
goto error_exit;
}
}
message_array = PyMem_Malloc(prompt_count * sizeof(*message_array));
if (message_array == 0)
{
PyErr_NoMemory();
goto error_exit;
}
if (!prompts_is_sequence)
{
py_result = PamHandle_conversation_2message(message_array, prompts);
if (py_result == -1)
goto error_exit;
}
else
{
for (i = 0; i < prompt_count; i += 1)
{
PyObject* message = PySequence_ITEM(prompts, i);
if (message == 0)
goto error_exit;
py_result = PamHandle_conversation_2message(&message_array[i], message);
Py_DECREF(message);
if (py_result == -1)
goto error_exit;
}
}
message_vector = PyMem_Malloc(prompt_count * sizeof(*message_vector));
if (message_vector == 0)
{
PyErr_NoMemory();
goto error_exit;
}
for (i = 0; i < prompt_count; i += 1)
message_vector[i] = &message_array[i];
pam_result = conv->conv(
prompt_count, (const struct pam_message**)message_vector,
&response_array, conv->appdata_ptr);
if (check_pam_result(pamHandle, pam_result) == -1)
goto error_exit;
if (!prompts_is_sequence)
result = PamHandle_conversation_2response(pamHandle, response_array);
else
{
result_tuple = PyTuple_New(prompt_count);
if (result_tuple == 0)
goto error_exit;
for (i = 0; i < prompt_count; i += 1)
{
response = PamHandle_conversation_2response(
pamHandle, &response_array[i]);
if (response == 0)
goto error_exit;
if (PyTuple_SetItem(result_tuple, i, response) == -1)
goto error_exit;
response = 0; /* was stolen */
}
result = result_tuple;
result_tuple = 0;
}
error_exit:
py_xdecref(response);
py_xdecref(result_tuple);
PyMem_Free(message_array);
PyMem_Free(message_vector);
if (response_array != 0)
free(response_array);
return result;
}
/*
* Set the fail delay.
*/
static PyObject* PamHandle_fail_delay(
PyObject* self, PyObject* args, PyObject* kwds)
{
int err;
int micro_sec = 0;
int pam_result;
PyObject* result = 0;
static char* kwlist[] = {"micro_sec", NULL};
err = PyArg_ParseTupleAndKeywords(
args, kwds, "i:fail_delay", kwlist,
µ_sec);
if (!err)
goto error_exit;
#ifndef HAVE_PAM_FAIL_DELAY
(void)self;
#else
{
PamHandleObject* pamHandle = (PamHandleObject*)self;
pam_result = pam_fail_delay(pamHandle->pamh, micro_sec);
if (check_pam_result(pamHandle, pam_result) == -1)
goto error_exit;
}
#endif
result = Py_None;
Py_INCREF(result);
error_exit:
return result;
}
/*
* Get the user's name, promping if it isn't known.
*/
static PyObject* PamHandle_get_user(
PyObject* self, PyObject* args, PyObject* kwds)
{
PamHandleObject* pamHandle = (PamHandleObject*)self;
char* prompt = 0;
PyObject* result = 0;
int pam_result;
const char* user = 0;
static char* kwlist[] = {"prompt", NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, "|z:get_user", kwlist, &prompt))
goto error_exit;
pam_result = pam_get_user(pamHandle->pamh, &user, prompt);
if (check_pam_result(pamHandle, pam_result) == -1)
goto error_exit;
if (user != 0)
result = PyString_FromString(user);
else
{
result = Py_None;
Py_INCREF(result);
}
if (result == 0)
goto error_exit;
error_exit:
return result;
}
/*
* Set a PAM environment variable.
*/
static PyObject* PamHandle_strerror(
PyObject* self, PyObject* args, PyObject* kwds)
{
PamHandleObject* pamHandle = (PamHandleObject*)self;
const char* err;
int errnum;
PyObject* result = 0;
const int debug_magic = 0x4567abcd;
static char* kwlist[] = {"errnum", NULL};
if (!PyArg_ParseTupleAndKeywords(args, kwds, "i:strerror", kwlist, &errnum))
goto error_exit;
/*
* A kludge so we can test exceptions.
*/
if (errnum >= debug_magic && errnum < debug_magic + _PAM_RETURN_VALUES)
{
if (check_pam_result(pamHandle, errnum - debug_magic) == -1)
goto error_exit;
}
err = pam_strerror(pamHandle->pamh, errnum);
if (err == 0)
{
result = Py_None;
Py_INCREF(result);
}
else
{
result = PyString_FromString(err);
if (result == 0)
goto error_exit;
}
error_exit:
return result;
}
static PyMethodDef PamHandle_Methods[] =
{
{
"conversation",
PyCFunctionKwds_cast PamHandle_conversation,
METH_VARARGS|METH_KEYWORDS,
MODULE_NAME "." PAMHANDLE_NAME "." "conversation(prompts)\n"
" Ask the application to issue the prompts to the user and return the\n"
" users responses. The 'prompts' can be one, or a list of\n"
" " MODULE_NAME "." PAMHANDLE_NAME "." PAMMESSAGE_NAME " objects. The return value is one,\n"
" or an array of " MODULE_NAME "." PAMHANDLE_NAME "." PAMRESPONSE_NAME " objects."
},
{
"fail_delay",
PyCFunctionKwds_cast PamHandle_fail_delay,
METH_VARARGS|METH_KEYWORDS,
MODULE_NAME "." PAMHANDLE_NAME "." "fail_delay(micro_sec)\n"
" Sets the amount of time a failed authenticate attempt should delay for\n"
" in micro seconds. This amount reset to 0 after every authenticate\n"
" attempt."
},
{
"get_user",
PyCFunctionKwds_cast PamHandle_get_user,
METH_VARARGS|METH_KEYWORDS,
MODULE_NAME "." PAMHANDLE_NAME "." "getuser([prompt])\n"
" If " PAMHANDLE_NAME ".user isn't None return it, otherwise ask the\n"
" application to display the string 'prompt' and enter the user name. The\n"
" user name (a string) is returned. It will be None if it isn't known."
},
{
"strerror",
PyCFunctionKwds_cast PamHandle_strerror,
METH_VARARGS|METH_KEYWORDS,
MODULE_NAME "." PAMHANDLE_NAME "." "strerror(errnum)\n"
" Return a string describing the pam error errnum."
},
{0,0,0,0} /* Sentinel */
};
static PyMemberDef PamHandle_Members[] =
{
{
"env",
T_OBJECT_EX,
offsetof(PamHandleObject, env),
READONLY,
"The PAM environment mapping."
},
{
"exception",
T_OBJECT_EX,
offsetof(PamHandleObject, exception),
READONLY,
"Exception raised when a call to PAM fails."
},
{
"libpam_version",
T_STRING,
offsetof(PamHandleObject, libpam_version),
READONLY,
"The runtime PAM version."
},
{
"Message",
T_OBJECT,
offsetof(PamHandleObject, message),
READONLY,
"Message class that can be passed to " MODULE_NAME "." PAMHANDLE_NAME ".conversation()"
},
{
"module",
T_OBJECT,
offsetof(PamHandleObject, module),
READONLY,
"The user module (ie you!)"
},
{
"pamh",
T_LONG,
offsetof(PamHandleObject, pamh),
READONLY,
"The PAM handle."
},
{
"py_initialized",
T_INT,
offsetof(PamHandleObject, py_initialized),
READONLY,
"True if Py_Initialize was called."
},
{
"Response",
T_OBJECT,
offsetof(PamHandleObject, response),
READONLY,
"Response class returned by " MODULE_NAME "." PAMHANDLE_NAME ".conversation()"
},
{
"XAuthData",
T_OBJECT,
offsetof(PamHandleObject, xauthdata),
READONLY,
"XAuthData class used by " MODULE_NAME "." PAMHANDLE_NAME ".xauthdata"
},
{0,0,0,0,0}, /* End of Python visible members */
{
"syslogFile",
T_OBJECT,
offsetof(PamHandleObject, syslogFile),
READONLY,
"File like object that writes to syslog"
},
{0,0,0,0,0} /* Sentinal */
};
static char PamHandle_Doc[] =
MODULE_NAME "." PAMHANDLE_NAME "\n"
" A an instance of this class makes the PAM API available to the Python\n"
" module. It is the first argument to every method PAM calls in the module.";
static int pypam_initialize_count = 0;
static void cleanup_pamHandle(pam_handle_t* pamh, void* data, int error_status)
{
PamHandleObject* pamHandle = (PamHandleObject*)data;
void* dlhandle = pamHandle->dlhandle;
PyObject* py_resultobj = 0;
PyObject* handler_function = 0;
int py_initialized;
static const char* handler_name = "pam_sm_end";
(void)pamh;
(void)error_status;
handler_function =
PyObject_GetAttrString(pamHandle->module, (char*)handler_name);
if (handler_function == 0)
PyErr_Restore(0, 0, 0);
else
{
call_python_handler(
&py_resultobj, pamHandle, handler_function,
handler_name, 0, 0, 0);
}
py_xdecref(py_resultobj);
py_xdecref(handler_function);
py_initialized = pamHandle->py_initialized;
Py_DECREF(pamHandle);
if (py_initialized)
{
pypam_initialize_count -= 1;
if (pypam_initialize_count == 0)
Py_Finalize();
}
dlclose(dlhandle);
}
/*
* Find the module, and load it if we haven't see it before. Returns
* PAM_SUCCESS if it worked, the PAM error code otherwise.
*/
static int load_user_module(
PyObject** user_module, PamHandleObject* pamHandle,
const char* module_path)
{
PyObject* builtins = 0;
PyObject* module_dict = 0;
FILE* module_fp = 0;
char* user_module_name = 0;
PyObject* py_resultobj = 0;
char* dot;
int pam_result;
int py_result;
/*
* Open the file.
*/
module_fp = fopen(module_path, "r");
if (module_fp == 0)
{
syslog_path_message(
module_path, "Can not open module: %s",
strerror(errno));
pam_result = PAM_OPEN_ERR;
goto error_exit;
}
/*
* Create the new module.
*/
user_module_name = strrchr(module_path, '/');
if (user_module_name == 0)
user_module_name = strdup(module_path);
else
user_module_name = strdup(user_module_name + 1);
if (user_module_name == 0)
{
syslog_path_message(MODULE_NAME, "out of memory");
pam_result = PAM_BUF_ERR;
goto error_exit;
}
dot = strrchr(user_module_name, '.');
if (dot != 0 && strcmp(dot, ".py") == 0)
*dot = '\0';
*user_module = PyModule_New(user_module_name);
if (*user_module == 0)
{
pam_result = syslog_path_exception(
module_path,
"PyModule_New(pamh.module.__file__) failed");
goto error_exit;
}
py_result =
PyModule_AddStringConstant(*user_module, "__file__", (char*)module_path);
if (py_result == -1)
{
pam_result = syslog_path_exception(
module_path,
"PyModule_AddStringConstant(pamh.module, '__file__', module_path) failed");
goto error_exit;
}
/*
* Add __builtins__.
*/
if (!PyObject_HasAttrString(*user_module , "__builtins__"))
{
builtins = PyEval_GetBuiltins();
Py_INCREF(builtins); /* is stolen */
if (PyModule_AddObject(*user_module, "__builtins__", builtins) == -1)
{
pam_result = syslog_path_exception(
module_path,
"PyModule_AddObject(pamh.module, '__builtins__', builtins) failed");
goto error_exit;
}
builtins = 0; /* was borrowed */
}
/*
* Call it.
*/
module_dict = PyModule_GetDict(*user_module);
py_resultobj = PyRun_FileExFlags(
module_fp, module_path, Py_file_input, module_dict, module_dict, 1, 0);
module_fp = 0; /* it was closed */
module_dict = 0; /* was borrowed */
/*
* If that didn't work there was an exception. Errk!
*/
if (py_resultobj == 0)
{
pam_result = syslog_path_traceback(module_path, pamHandle);
goto error_exit;
}
pam_result = PAM_SUCCESS;
error_exit:
py_xdecref(builtins);
py_xdecref(module_dict);
if (module_fp != 0)
fclose(module_fp);
if (user_module_name != 0)
free(user_module_name);
py_xdecref(py_resultobj);
return pam_result;
}
/*
* Create a new Python type on the heap. This differs from creating a static
* type in non-obvious ways.
*/
static PyTypeObject* newHeapType(
PyObject* module, /* Module declaring type (required) */
const char* name, /* tp_name (required) */
int basicsize, /* tp_basicsize (required) */
char* doc, /* tp_doc (optional) */
inquiry clear, /* tp_clear (optional) */
struct PyMethodDef* methods, /* tp_methods (optional) */
struct PyMemberDef* members, /* tp_members (optional) */
struct PyGetSetDef* getset, /* tp_getset (optional) */
newfunc new /* tp_new (optional) */
)
{
PyObject* pyName = 0;
PyTypeObject* result = 0;
PyTypeObject* type = 0;
pyName = PyString_FromString(name);
if (pyName == 0)
goto error_exit;
type = (PyTypeObject*)PyType_Type.tp_alloc(&PyType_Type, 0);
if (type == 0)
goto error_exit;
type->tp_flags = Py_TPFLAGS_DEFAULT|Py_TPFLAGS_HEAPTYPE|Py_TPFLAGS_HAVE_GC;
type->tp_basicsize = basicsize;
type->tp_dealloc = generic_dealloc;
if (doc != 0)
{
char *doc_string = PyMem_Malloc(strlen(doc)+1);
if (doc_string == 0)
{
PyErr_NoMemory();
goto error_exit;
}
strcpy(doc_string, doc);
type->tp_doc = doc_string;
}
type->tp_traverse = generic_traverse;
type->tp_clear = clear != 0 ? clear : generic_clear;
type->tp_methods = methods;
type->tp_members = members;
type->tp_getset = getset;
type->tp_name = PyString_AsString(pyName);
#if PY_VERSION_HEX < 0x02050000
((PyHeapTypeObject*)type)->name = pyName;
#else
((PyHeapTypeObject*)type)->ht_name = pyName;
#endif
pyName = 0;
PyType_Ready(type);
type->tp_new = new;
if (PyDict_SetItemString(type->tp_dict, "__module__", module) == -1)
goto error_exit;
result = type;
type = 0;
error_exit:
py_xdecref(pyName);
py_xdecref((PyObject*)type);
return result;
}
/*
* Create a type and return an instance of that type. The newly created
* type object is discarded.
*/
static PyObject* newSingletonObject(
PyObject* module, /* Module declaring type (required) */
const char* name, /* tp_name (required) */
int basicsize, /* tp_basicsize (required) */
char* doc, /* tp_doc (optional) */
inquiry clear, /* tp_clear (optional) */
struct PyMethodDef* methods, /* tp_methods (optional) */
struct PyMemberDef* members, /* tp_members (optional) */
struct PyGetSetDef* getset /* tp_getset (optional) */
)
{
PyObject* result = 0;
PyTypeObject* type = 0;
type = newHeapType(
module, name, basicsize, doc, clear, methods, members, getset, 0);
if (type != 0)
result = type->tp_alloc(type, 0);
py_xdecref((PyObject*)type);
return result;
}
/*
* Find the PamHandle object used by the pamh instance, creating one if it
* doesn't exist. Returns a pam_result, which will be PAM_SUCCESS if it
* works.
*/
static int get_pamHandle(
PamHandleObject** result, pam_handle_t* pamh, const char** argv)
{
void* dlhandle = 0;
int do_initialize;
char* module_dir;
char* module_path = 0;
char* module_data_name = 0;
PyObject* user_module = 0;
PamEnvObject* pamEnv = 0;
PamHandleObject* pamHandle = 0;
PyObject* pamHandle_module = 0;
SyslogFileObject* syslogFile = 0;
PyObject* tracebackModule = 0;
int pam_result;
/*
* Figure out where the module lives.
*/
if (argv == 0 || argv[0] == 0)
{
syslog_path_message(MODULE_NAME, "python module name not supplied");
pam_result = PAM_MODULE_UNKNOWN;
goto error_exit;
}
if (argv[0][0] == '/')
module_dir = "";
else
module_dir = DEFAULT_SECURITY_DIR;
module_path = malloc(strlen(module_dir) + strlen(argv[0]) + 1);
if (module_path == 0)
{
syslog_path_message(MODULE_NAME, "out of memory");
pam_result = PAM_BUF_ERR;
goto error_exit;
}
strcat(strcpy(module_path, module_dir), argv[0]);
/*
* See if we already exist.
*/
module_data_name = malloc(strlen(MODULE_NAME) + 1 + strlen(module_path) + 1);
if (module_data_name == 0)
{
syslog_path_message(MODULE_NAME, "out of memory");
pam_result = PAM_BUF_ERR;
goto error_exit;
}
strcat(strcat(strcpy(module_data_name, MODULE_NAME), "."), module_path);
pam_result = pam_get_data(pamh, module_data_name, (void*)result);
if (pam_result == PAM_SUCCESS)
{
(*result)->pamh = pamh;
Py_INCREF(*result);
goto error_exit;
}
/*
* Initialize Python if required.
*/
dlhandle = dlopen(libpython_so, RTLD_NOW|RTLD_GLOBAL);
if (dlhandle == 0)
{
pam_result = syslog_path_message(
module_path,
"Can't load python library %s: %s", libpython_so, dlerror());
goto error_exit;
}
do_initialize = pypam_initialize_count > 0 || !Py_IsInitialized();
if (do_initialize)
{
if (pypam_initialize_count == 0)
initialise_python();
pypam_initialize_count += 1;
}
/*
* Create a throw away module because heap types need one, apparently.
*/
pamHandle_module = PyModule_New((char*)module_data_name);
if (pamHandle_module == 0)
{
pam_result = syslog_path_exception(
module_path,
"PyModule_New(module_data_name) failed");
goto error_exit;
}
/*
* Create the type we use for our object.
*/
pamHandle = (PamHandleObject*)newSingletonObject(
pamHandle_module, /* __module__ */
PAMHANDLE_NAME "_type", /* tp_name */
sizeof(PamHandleObject), /* tp_basicsize */
PamHandle_Doc, /* tp_doc */
0, /* tp_clear */
PamHandle_Methods, /* tp_methods */
PamHandle_Members, /* tp_members */
PamHandle_Getset); /* tp_getset */
if (pamHandle == 0)
{
pam_result = syslog_path_exception(module_path, "Can't create pamh Object");
goto error_exit;
}
if (PyObject_IS_GC((PyObject*)pamHandle))
PyObject_GC_UnTrack(pamHandle); /* No refs are visible to python */
pamHandle->dlhandle = dlhandle;
dlhandle = 0;
pamHandle->libpam_version =
__STRING(__LINUX_PAM__) "." __STRING(__LINUX_PAM_MINOR__);
pamHandle->pamh = pamh;
pamHandle->py_initialized = do_initialize;
pamHandle->exception = PyErr_NewException(
PAMHANDLE_NAME "." PAMHANDLEEXCEPTION_NAME, PyExc_StandardError, NULL);
if (pamHandle->exception == NULL)
goto error_exit;
/*
* Create the object we use to handle the PAM environment.
*/
pamEnv = (PamEnvObject*)newSingletonObject(
pamHandle_module, /* __module__ */
PAMENV_NAME "_type", /* tp_name */
sizeof(PamEnvObject), /* tp_basicsize */
0, /* tp_doc */
0, /* tp_clear */
PamEnv_Methods, /* tp_methods */
PamEnv_Members, /* tp_members */
0); /* tp_getset */
if (pamEnv == 0)
{
pam_result = syslog_path_exception(module_path, "Can't create pamh.env");
goto error_exit;
}
pamEnv->ob_type->tp_as_mapping = &PamEnv_as_mapping;
pamEnv->ob_type->tp_iter = PamEnv_iter;
pamEnv->pamHandle = pamHandle;
pamEnv->pamEnvIter_type = newHeapType(
pamHandle_module, /* __module__ */
PAMENVITER_NAME "_type", /* tp_name */
sizeof(PamEnvIterObject), /* tp_basicsize */
0, /* tp_doc */
0, /* tp_clear */
0, /* tp_methods */
PamEnvIter_Members, /* tp_members */
0, /* tp_getset */
0); /* tp_new */
if (pamEnv->pamEnvIter_type == 0)
goto error_exit;
if (PyObject_IS_GC((PyObject*)pamEnv->pamEnvIter_type))
{
/*
* No refs are visible to python.
*/
PyObject_GC_UnTrack(pamEnv->pamEnvIter_type);
}
pamEnv->pamEnvIter_type->tp_iter = PyObject_SelfIter;
pamEnv->pamEnvIter_type->tp_iternext = PamEnvIter_iternext;
pamHandle->env = (PyObject*)pamEnv;
pamEnv = 0;
/*
* Create the type for the PamMessageObject.
*/
pamHandle->message = newHeapType(
pamHandle_module, /* __module__ */
PAMMESSAGE_NAME "_type", /* tp_name */
sizeof(PamMessageObject), /* tp_basicsize */
PamMessage_doc, /* tp_doc */
0, /* tp_clear */
0, /* tp_methods */
PamMessage_members, /* tp_members */
0, /* tp_getset */
PamMessage_new); /* tp_new */
if (pamHandle->message == 0)
{
pam_result = syslog_path_exception(
module_path, "Can't create pamh.Message");
goto error_exit;
}
/*
* Create the type for the PamResponseObject.
*/
pamHandle->response = newHeapType(
pamHandle_module, /* __module__ */
PAMRESPONSE_NAME "_type", /* tp_name */
sizeof(PamResponseObject), /* tp_basicsize */
PamResponse_doc, /* tp_doc */
0, /* tp_clear */
0, /* tp_methods */
PamResponse_members, /* tp_members */
0, /* tp_getset */
PamResponse_new); /* tp_new */
if (pamHandle->response == 0)
{
pam_result = syslog_path_exception(
module_path,
"Can't create pamh.Response");
goto error_exit;
}
/*
* Create the Syslogfile Type & Object.
*/
syslogFile = (SyslogFileObject*)newSingletonObject(
pamHandle_module, /* __module__ */
SYSLOGFILE_NAME "_type", /* tp_name */
sizeof(SyslogFileObject), /* tp_basicsize */
0, /* tp_doc */
SyslogFile_clear, /* tp_clear */
SyslogFile_Methods, /* tp_methods */
0, /* tp_members */
0); /* tp_getset */
if (syslogFile == 0)
{
pam_result = syslog_path_exception(
module_path,
"Can't create pamh.syslogFile");
goto error_exit;
}
syslogFile->buffer = 0;
syslogFile->size = 0;
pamHandle->syslogFile = (PyObject*)syslogFile;
syslogFile = 0;
/*
* The traceback object.
*/
tracebackModule = PyImport_ImportModule("traceback");
if (tracebackModule == 0)
{
pam_result = syslog_path_exception(
module_path,
"PyImport_ImportModule('traceback') failed");
goto error_exit;
}
pamHandle->print_exception =
PyObject_GetAttrString(tracebackModule, "print_exception");
if (pamHandle->print_exception == 0)
{
pam_result = syslog_path_exception(
module_path,
"PyObject_GetAttrString(traceback, 'print_exception') failed");
goto error_exit;
}
Py_INCREF(pamHandle->print_exception); /* Borrowed reference */
/*
* Create the type for the PamXAuthDataObject.
*/
pamHandle->xauthdata = newHeapType(
pamHandle_module, /* __module__ */
PAMXAUTHDATA_NAME "_type", /* tp_name */
sizeof(PamXAuthDataObject), /* tp_basicsize */
PamXAuthData_doc, /* tp_doc */
0, /* tp_clear */
0, /* tp_methods */
PamXAuthData_members, /* tp_members */
0, /* tp_getset */
PamXAuthData_new); /* tp_new */
if (pamHandle->xauthdata == 0)
{
pam_result = syslog_path_exception(
module_path, "Can't create pamh.XAuthData");
goto error_exit;
}
/*
* Now we have error reporting set up import the module.
*/
pam_result = load_user_module(&user_module, pamHandle, module_path);
if (pam_result != PAM_SUCCESS)
goto error_exit;
pamHandle->module = user_module;
Py_INCREF(pamHandle->module);
/*
* That worked. Save a reference to it.
*/
Py_INCREF(pamHandle);
pam_set_data(pamh, module_data_name, pamHandle, cleanup_pamHandle);
*result = pamHandle;
pamHandle = 0;
error_exit:
if (module_path != 0)
free(module_path);
if (module_data_name != 0)
free(module_data_name);
py_xdecref(user_module);
py_xdecref((PyObject*)pamEnv);
py_xdecref((PyObject*)pamHandle);
py_xdecref(pamHandle_module);
py_xdecref((PyObject*)syslogFile);
py_xdecref(tracebackModule);
return pam_result;
}
/*
* Call the python handler.
*/
static int call_python_handler(
PyObject** result, PamHandleObject* pamHandle,
PyObject* handler_function, const char* handler_name,
int flags, int argc, const char** argv)
{
PyObject* arg_object = 0;
PyObject* argv_object = 0;
PyObject* flags_object = 0;
PyObject* handler_args = 0;
PyObject* py_resultobj = 0;
int i;
int pam_result;
if (!PyCallable_Check(handler_function))
{
pam_result =
syslog_message(pamHandle, "%s isn't a function.", handler_name);
goto error_exit;
}
/*
* Set up the arguments for the python function. If we aren't passed
* argv then this is pam_sm_end() and it is only given pamh.
*/
if (argv == 0)
handler_args = Py_BuildValue("(O)", pamHandle);
else
{
flags_object = PyInt_FromLong(flags);
if (flags_object == 0)
{
pam_result = syslog_exception(pamHandle, "PyInt_FromLong(flags) failed");
goto error_exit;
}
argv_object = PyList_New(argc);
if (argv_object == 0)
{
pam_result = syslog_exception(pamHandle, "PyList_New(argc) failed");
goto error_exit;
}
for (i = 0; i < argc; i += 1)
{
arg_object = PyString_FromString(argv[i]);
if (arg_object == 0)
{
pam_result = syslog_exception(
pamHandle,
"PyString_FromString(argv[i]) failed");
goto error_exit;
}
PyList_SET_ITEM(argv_object, i, arg_object);
arg_object = 0; /* It was pinched by SET_ITEM */
}
handler_args =
Py_BuildValue("OOO", pamHandle, flags_object, argv_object);
}
if (handler_args == 0)
{
pam_result = syslog_exception(
pamHandle,
"handler_args = Py_BuildValue(...) failed");
goto error_exit;
}
/*
* Call the Python handler function.
*/
py_resultobj = PyEval_CallObject(handler_function, handler_args);
/*
* Did it throw an exception?
*/
if (py_resultobj == 0)
{
pam_result = syslog_traceback(pamHandle);
goto error_exit;
}
*result = py_resultobj;
py_resultobj = 0;
pam_result = PAM_SUCCESS;
error_exit:
py_xdecref(arg_object);
py_xdecref(argv_object);
py_xdecref(flags_object);
py_xdecref(handler_args);
py_xdecref(py_resultobj);
return pam_result;
}
/*
* Calls the Python method that will handle PAM's request to the module.
*/
static int call_handler(
const char* handler_name, pam_handle_t* pamh,
int flags, int argc, const char** argv)
{
PyObject* handler_function = 0;
PamHandleObject* pamHandle = 0;
PyObject* py_resultobj = 0;
int pam_result;
/*
* Initialise Python, and get a copy of our object.
*/
pam_result = get_pamHandle(&pamHandle, pamh, argv);
if (pam_result != PAM_SUCCESS)
goto error_exit;
/*
* See if the function we have to call has been defined.
*/
handler_function =
PyObject_GetAttrString(pamHandle->module, (char*)handler_name);
if (handler_function == 0)
{
syslog_message(pamHandle, "%s() isn't defined.", handler_name);
pam_result = PAM_SYMBOL_ERR;
goto error_exit;
}
pam_result = call_python_handler(
&py_resultobj, pamHandle, handler_function, handler_name,
flags, argc, argv);
if (pam_result != PAM_SUCCESS)
goto error_exit;
/*
* It must return an integer.
*/
if (!PyInt_Check(py_resultobj) && !PyLong_Check(py_resultobj))
{
pam_result = syslog_message(
pamHandle,
"%s() did not return an integer.", handler_name);
goto error_exit;
}
pam_result = PyInt_AsLong(py_resultobj);
error_exit:
py_xdecref(handler_function);
py_xdecref((PyObject*)pamHandle);
py_xdecref(py_resultobj);
return pam_result;
}
PAM_EXTERN int pam_sm_authenticate(
pam_handle_t* pamh, int flags, int argc, const char** argv)
{
return call_handler("pam_sm_authenticate", pamh, flags, argc, argv);
}
PAM_EXTERN int pam_sm_setcred(
pam_handle_t* pamh, int flags, int argc, const char** argv)
{
return call_handler("pam_sm_setcred", pamh, flags, argc, argv);
}
PAM_EXTERN int pam_sm_acct_mgmt(
pam_handle_t* pamh, int flags, int argc, const char** argv)
{
return call_handler("pam_sm_acct_mgmt", pamh, flags, argc, argv);
}
PAM_EXTERN int pam_sm_open_session(
pam_handle_t* pamh, int flags, int argc, const char** argv)
{
return call_handler("pam_sm_open_session", pamh, flags, argc, argv);
}
PAM_EXTERN int pam_sm_close_session(
pam_handle_t* pamh, int flags, int argc, const char** argv)
{
return call_handler("pam_sm_close_session", pamh, flags, argc, argv);
}
PAM_EXTERN int pam_sm_chauthtok(
pam_handle_t* pamh, int flags, int argc, const char** argv)
{
return call_handler("pam_sm_chauthtok", pamh, flags, argc, argv);
}
pam-python-1.0.7/ChangeLog.txt 0000644 0002157 0001751 00000002374 13540402767 015126 0 ustar rstuart it pam-python-1.0.7 Wed, 18 Sep 2019 20:23:54 +1000
Bug: Local root exploit.
pam-python-1.0.6 Sat, 27 Aug 2016 21:35:36 +1000
New: Update Makefile.release
New: OSX support.
Bug: Fix debian bug #833411.
pam-python-1.0.5 Fri, 19 Feb 2016 19:29:38 +1000
New: Update Makefile.release
Bug: Fix pam typeo in pam_accept.py. Thanks to André Caron
for the bug report.
pam-python-1.0.4 2014-05-04
New: Re-homed to sourceforge.
New: Move to the AGPL-3.0.
pam-python-1.0.3 2014-05-04
Bug: Make work with older versions of Python, courtesy of Thomas Kula.
Bug: Call dlerror() where appropriate, courtesy of David MacKenzie.
New: Linux-PAM-html has moved url's
pam-python-1.0.2 2012-04-05
Bug: Get rid of build crap in source distribution.
Bug: Fix doco grammar.
pam-python-1.0.1 2010-12-13
Bug: Build test suit so libraries are loaded as needed.
pam-python-1.0.0 2010-05-23
New: Documentation moved to Python 2.6 format, ie sphinx.
New: Added additional members for the new PAM items:
PAM_XDISPLAY, PAM_XAUTHTOK and PAM_AUTHTOK_TYPE.
New: Added the PamXAuthData class.
New: Added new PAM constants in PAM 1.1.1.
pam-python-0.1.1 2009-08-05
New: Made to work with Python 2.5.
pam-python-0.1.0 2007-12-05
New: Epoch.