megalock 0.1.0

X11 xlock replacement
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

use crate::{
    bindings::{
        pam_authenticate, pam_conv, pam_end, pam_handle_t, pam_message, pam_response, pam_set_item,
        pam_start, pam_strerror, PAM_CONV_ERR, PAM_PROMPT_ECHO_OFF, PAM_PROMPT_ECHO_ON,
        PAM_SUCCESS, PAM_USER, PAM_XDISPLAY,
    },
    const_string_ptr,
    utils::{get_display, get_username},
    wm::statics::PASSWORD,
};
use anyhow::{anyhow, Result};
use tracing::{debug, trace};

unsafe extern "C" fn conv_callback(
    num_msg: i32,
    msg: *mut *const pam_message,
    resp: *mut *mut pam_response,
    _appdata_ptr: *mut libc::c_void,
) -> i32 {
    trace!("PAM callback started");

    if num_msg == 0 {
        return PAM_CONV_ERR.try_into().unwrap();
    }

    let mut responses = Vec::new();

    let msg: Vec<*const pam_message> = Vec::from_raw_parts(
        msg,
        num_msg.try_into().unwrap(),
        num_msg.try_into().unwrap(),
    );

    for m in &msg {
        let style: u32 = unsafe { (**m).msg_style }.try_into().unwrap();

        if style != PAM_PROMPT_ECHO_ON && style != PAM_PROMPT_ECHO_OFF {
            responses.push(pam_response {
                resp_retcode: 0,
                resp: std::ptr::null_mut(),
            });
            continue;
        }

        trace!("Setting PAM password to {}", PASSWORD.lock().unwrap());

        let password = PASSWORD.lock().unwrap().as_bytes().to_vec();
        let s = std::ffi::CString::from_vec_unchecked(password);
        let response = pam_response {
            resp_retcode: 0,
            resp: s.as_c_str().as_ptr().cast_mut(),
        };
        responses.push(response);
        std::mem::forget(s);
    }

    std::mem::forget(msg);

    if !responses.is_empty() {
        *resp = responses.as_slice().as_ptr().cast_mut();
        std::mem::forget(responses);
    }

    trace!("PAM callback finished");

    PAM_SUCCESS.try_into().unwrap()
}

pub fn authenticate_password(name: &str) -> Result<()> {
    let conv = pam_conv {
        conv: Some(conv_callback),
        appdata_ptr: std::ptr::null_mut(),
    };

    let mut pam_handle: *mut pam_handle_t = std::ptr::null_mut();

    debug!("Authentication start for '{}'", get_username()?);

    let res = unsafe {
        pam_start(
            const_string_ptr!(name),
            std::ptr::null(),
            &conv,
            &mut pam_handle,
        )
    };
    if res != PAM_SUCCESS.try_into().unwrap() {
        return Err(anyhow!("PAM: {}", unsafe {
            std::ffi::CStr::from_ptr(pam_strerror(pam_handle, res)).to_str()
        }?));
    }

    if pam_handle.is_null() {
        return Err(anyhow!("PAM could not be initialized"));
    }

    let res = unsafe {
        pam_set_item(
            pam_handle,
            PAM_USER.try_into().unwrap(),
            const_string_ptr!(get_username()?),
        )
    };
    if res != PAM_SUCCESS.try_into().unwrap() {
        return Err(anyhow!("PAM: {}", unsafe {
            std::ffi::CStr::from_ptr(pam_strerror(pam_handle, res)).to_str()
        }?));
    }

    let res = unsafe {
        pam_set_item(
            pam_handle,
            PAM_XDISPLAY.try_into().unwrap(),
            const_string_ptr!(get_display()),
        )
    };
    if res != PAM_SUCCESS.try_into().unwrap() {
        return Err(anyhow!("PAM: {}", unsafe {
            std::ffi::CStr::from_ptr(pam_strerror(pam_handle, res)).to_str()
        }?));
    }

    trace!("authentication starting");
    let res = unsafe { pam_authenticate(pam_handle, 0) };
    trace!("authentication finished");

    let authenticated = res == PAM_SUCCESS.try_into().unwrap();

    if authenticated {
        debug!("Authentication successful.");
    } else {
        debug!("Authentication Denied: {} [{}]", res, unsafe {
            std::ffi::CStr::from_ptr(pam_strerror(pam_handle, res)).to_str()
        }?)
    }

    let res = unsafe { pam_end(pam_handle, res) };
    if res != PAM_SUCCESS.try_into().unwrap() {
        return Err(anyhow!("PAM: {}", res));
    }

    if !authenticated {
        return Err(anyhow!("Authentication Denied"));
    }

    trace!("authentication done");

    Ok(())
}