pam_sys/
types.rs

1// Copyright (C) 2015-2017 Florian Wilkens
2//
3// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
4// associated documentation files (the "Software"), to deal in the Software without restriction,
5// including without limitation the rights to use, copy, modify, merge, publish, distribute,
6// sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
7// furnished to do so, subject to the following conditions:
8//
9// The above copyright notice and this permission notice shall be included in all copies or substantial
10// portions of the Software.
11//
12// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
13// NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
14// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
15// OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
16// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
17
18//! Types defined by Linux-PAM
19//!
20//! This modules contains struct and enum definitions used by `pam-sys`.
21
22use libc::{c_char, c_int, c_void};
23
24use std::fmt::{Display, Error, Formatter};
25
26/// Type alias for the PAM "conversation function" used as part of the `PamConversation` struct
27pub type ConvClosure = (extern "C" fn(c_int,
28                                  *mut *mut PamMessage,
29                                  *mut *mut PamResponse,
30                                  *mut c_void)
31                                  -> c_int);
32
33/// Opaque struct internal to Linux-PAM
34///
35/// From `_pam_types.h`:
36///
37/// "This is a blind structure. Users aren't allowed to see
38/// inside a `pam_handle_t`, so we don't define struct `pam_handle` here.
39/// This is defined in a file private to the PAM library.
40/// (i.e., it's private to PAM service modules, too!)"
41pub enum PamHandle {}
42
43/// Message struct to transfer authentication data to the user
44///
45/// From `_pam_types.h`:
46///
47/// "Used to pass prompting text, error messages, or other informatory text to the user.
48/// This structure is allocated and freed by the PAM library (or loaded module)."
49#[repr(C)]
50#[derive(Clone, Copy, Debug)]
51pub struct PamMessage {
52    pub msg_style: c_int,
53    pub msg: *const c_char,
54}
55
56
57/// Response struct to transfer the user's response back to Linux-PAM
58///
59/// From `_pam_types.h`:
60///
61/// "Used to return the user's response to the PAM library.
62/// This structure is allocated by the application program,
63/// and free()'d by the Linux-PAM library (or calling module)."
64#[repr(C)]
65#[derive(Clone, Copy, Debug)]
66pub struct PamResponse {
67    pub resp: *mut c_char,
68    /// currently un-used, zero expected
69    pub resp_retcode: c_int,
70}
71
72/// Conversation structure containing the `converse` function and authentication data
73///
74/// From `_pam_types.h`:
75///
76/// "The actual conversation structure itself"
77#[repr(C)]
78pub struct PamConversation {
79    /* int (*conv)(int num_msg, const struct pam_message **msg,
80        struct pam_response **resp, void *appdata_ptr); */
81    pub conv: Option<ConvClosure>,
82    pub data_ptr: *mut c_void,
83}
84
85/// Special struct for the `PAM_XAUTHDATA` pam item
86///
87/// From `_pam_types.h`:
88///
89/// "Used by the `PAM_XAUTHDATA` pam item. Contains X authentication
90/// data used by modules to connect to the user's X display.
91/// Note: this structure is intentionally compatible with `xcb_auth_info_t`."
92#[repr(C)]
93#[derive(Clone, Copy, Debug)]
94pub struct PamXAuthData {
95    pub namelen: c_int,
96    pub name: *mut c_char,
97    pub datalen: c_int,
98    pub data: *mut c_char,
99}
100
101/// The Linux-PAM return values
102#[derive(Clone, Copy, Debug, PartialEq)]
103pub enum PamReturnCode {
104    /// Successful function return
105    SUCCESS = 0,
106
107    /// dlopen() failure when dynamically loading a service module
108    OPEN_ERR = 1,
109
110    /// Symbol not found
111    SYMBOL_ERR = 2,
112
113    /// Error in service module
114    SERVICE_ERR = 3,
115
116    /// System error
117    SYSTEM_ERR = 4,
118
119    /// Memory buffer error
120    BUF_ERR = 5,
121
122    /// Permission denied
123    PERM_DENIED = 6,
124
125    /// Authentication failure
126    AUTH_ERR = 7,
127
128    /// Can not access authentication data due to insufficient credentials
129    CRED_INSUFFICIENT = 8,
130
131    /// Underlying authentication service can not retrieve authentication information
132    AUTHINFO_UNAVAIL = 9,
133
134    /// User not known to the underlying authentication module
135    USER_UNKNOWN = 10,
136
137    /// An authentication service has maintained a retry count which has been reached.
138    /// No further retries should be attempted
139    MAXTRIES = 11,
140
141    /// New authentication token required.
142    /// This is normally returned if the machine security policies require
143    /// that the password should be changed beccause the password is NULL or it has aged
144    NEW_AUTHTOK_REQD = 12,
145
146    /// User account has expired
147    ACCT_EXPIRED = 13,
148
149    /// Can not make/remove an entry for the specified session
150    SESSION_ERR = 14,
151
152    /// Underlying authentication service can not retrieve user credentials unavailable
153    CRED_UNAVAIL = 15,
154
155    /// User credentials expired
156    CRED_EXPIRED = 16,
157
158    /// Failure setting user credentials
159    CRED_ERR = 17,
160
161    /// No module specific data is present
162    NO_MODULE_DATA = 18,
163
164    /// Conversation error
165    CONV_ERR = 19,
166
167    /// Authentication token manipulation error
168    AUTHTOK_ERR = 20,
169
170    /// Authentication information cannot be recovered
171    AUTHTOK_RECOVERY_ERR = 21,
172
173    /// Authentication token lock busy
174    AUTHTOK_LOCK_BUSY = 22,
175
176    /// Authentication token aging disabled
177    AUTHTOK_DISABLE_AGING = 23,
178
179    /// Preliminary check by password service
180    TRY_AGAIN = 24,
181
182    /// Ignore underlying account module regardless of whether
183    /// the control flag is required, optional, or sufficient
184    IGNORE = 25,
185
186    /// Critical error (?module fail now request)
187    AUTHTOK_EXPIRED = 27,
188
189    /// user's authentication token has expired
190    ABORT = 26,
191
192    /// module is not known
193    MODULE_UNKNOWN = 28,
194
195    /// Bad item passed to pam_*_item()
196    BAD_ITEM = 29,
197
198    /// conversation function is event driven and data is not available yet
199    CONV_AGAIN = 30,
200
201    /// please call this function again to complete authentication stack.
202    /// Before calling again, verify that conversation is completed
203    INCOMPLETE = 31,
204}
205
206impl Display for PamReturnCode {
207    fn fmt(&self, f: &mut Formatter) -> Result<(), Error> {
208        f.write_str(&format!("{:?} ({})", self, *self as i32))
209    }
210}
211
212impl From<i32> for PamReturnCode {
213    fn from(status: i32) -> PamReturnCode {
214        match status {
215            0 => PamReturnCode::SUCCESS,
216            1 => PamReturnCode::OPEN_ERR,
217            2 => PamReturnCode::SYMBOL_ERR,
218            3 => PamReturnCode::SERVICE_ERR,
219            4 => PamReturnCode::SYSTEM_ERR,
220            5 => PamReturnCode::BUF_ERR,
221            6 => PamReturnCode::PERM_DENIED,
222            7 => PamReturnCode::AUTH_ERR,
223            8 => PamReturnCode::CRED_INSUFFICIENT,
224            9 => PamReturnCode::AUTHINFO_UNAVAIL,
225            10 => PamReturnCode::USER_UNKNOWN,
226            11 => PamReturnCode::MAXTRIES,
227            12 => PamReturnCode::NEW_AUTHTOK_REQD,
228            13 => PamReturnCode::ACCT_EXPIRED,
229            14 => PamReturnCode::SESSION_ERR,
230            15 => PamReturnCode::CRED_UNAVAIL,
231            16 => PamReturnCode::CRED_EXPIRED,
232            17 => PamReturnCode::CRED_ERR,
233            18 => PamReturnCode::NO_MODULE_DATA,
234            19 => PamReturnCode::CONV_ERR,
235            20 => PamReturnCode::AUTHTOK_ERR,
236            21 => PamReturnCode::AUTHTOK_RECOVERY_ERR,
237            22 => PamReturnCode::AUTHTOK_LOCK_BUSY,
238            23 => PamReturnCode::AUTHTOK_DISABLE_AGING,
239            24 => PamReturnCode::TRY_AGAIN,
240            25 => PamReturnCode::IGNORE,
241            26 => PamReturnCode::ABORT,
242            27 => PamReturnCode::AUTHTOK_EXPIRED,
243            28 => PamReturnCode::MODULE_UNKNOWN,
244            29 => PamReturnCode::BAD_ITEM,
245            30 => PamReturnCode::CONV_AGAIN,
246            31 => PamReturnCode::INCOMPLETE,
247            _ => PamReturnCode::SYSTEM_ERR,
248        }
249    }
250}
251
252/// The Linux-PAM flags
253#[derive(Clone, Copy, Debug, PartialEq)]
254pub enum PamFlag {
255    /// Authentication service should not generate any messages
256    SILENT = 0x8000,
257
258    /// The authentication service should return AUTH_ERROR
259    /// if the user has a null authentication token
260    /// (used by pam_authenticate{,_secondary}())
261    DISALLOW_NULL_AUTHTOK = 0x0001,
262
263    /// Set user credentials for an authentication service
264    /// (used for pam_setcred())
265    ESTABLISH_CRED = 0x0002,
266
267    /// Delete user credentials associated with an authentication service
268    /// (used for pam_setcred())
269    DELETE_CRED = 0x0004,
270
271    /// Reinitialize user credentials
272    /// (used for pam_setcred())
273    REINITIALIZE_CRED = 0x0008,
274
275    /// Extend lifetime of user credentials
276    /// (used for pam_setcred())
277    REFRESH_CRED = 0x0010,
278
279    /// The password service should only update those passwords that have aged.
280    /// If this flag is not passed, the password service should update all passwords.
281    /// (used by pam_chauthtok)
282    CHANGE_EXPIRED_AUTHTOK = 0x0020,
283
284    NONE = 0x0000,
285}
286
287impl Display for PamFlag {
288    fn fmt(&self, f: &mut Formatter) -> Result<(), Error> {
289        f.write_str(&format!("{:?} ({})", self, *self as i32))
290    }
291}
292
293/// The Linux-PAM item types
294///
295/// These defines are used by `pam_set_item()` `and pam_get_item()`.
296/// Please check the spec which are allowed for use by applications
297/// and which are only allowed for use by modules.
298#[derive(Clone, Copy, Debug, PartialEq)]
299pub enum PamItemType {
300    /// The service name
301    SERVICE = 1,
302
303    /// The user name
304    USER = 2,
305
306    /// The tty name
307    TTY = 3,
308
309    /// The remote host name
310    RHOST = 4,
311
312    /// The pam_conv structure
313    CONV = 5,
314
315    /// The authentication token (password)
316    AUTHTOK = 6,
317
318    /// The old authentication token
319    OLDAUTHTOK = 7,
320
321    /// The remote user name
322    RUSER = 8,
323
324    /// the prompt for getting a username Linux-PAM extensions
325    USER_PROMPT = 9,
326
327    /// app supplied function to override failure delays
328    FAIL_DELAY = 10,
329
330    /// X display name
331    XDISPLAY = 11,
332
333    /// X server authentication data
334    XAUTHDATA = 12,
335
336    /// The type for pam_get_authtok
337    AUTHTOK_TYPE = 13,
338}
339
340impl Display for PamItemType {
341    fn fmt(&self, f: &mut Formatter) -> Result<(), Error> {
342        f.write_str(&format!("{:?} ({})", self, *self as i32))
343    }
344}
345
346/// The Linux-PAM message styles
347#[derive(Clone, Copy, Debug, PartialEq)]
348pub enum PamMessageStyle {
349    PROMPT_ECHO_OFF = 1,
350    PROMPT_ECHO_ON = 2,
351    ERROR_MSG = 3,
352    TEXT_INFO = 4,
353}
354
355impl Display for PamMessageStyle {
356    fn fmt(&self, f: &mut Formatter) -> Result<(), Error> {
357        f.write_str(&format!("{:?} ({})", self, *self as i32))
358    }
359}
360
361impl From<i32> for PamMessageStyle {
362    fn from(style: i32) -> PamMessageStyle {
363        match style {
364            1 => PamMessageStyle::PROMPT_ECHO_OFF,
365            2 => PamMessageStyle::PROMPT_ECHO_ON,
366            3 => PamMessageStyle::ERROR_MSG,
367            4 => PamMessageStyle::TEXT_INFO,
368            _ => PamMessageStyle::ERROR_MSG,
369        }
370    }
371}
pam_sys/types.rs

pam_sys/
types.rs
