17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
54ef27277Sgww  * Common Development and Distribution License (the "License").
64ef27277Sgww  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
22b9175c69SKenjiro Tsuji  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
237c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
26edd669a7SJohn Levon /*
27*1d276e0bSDan McDonald  * Copyright 2020, Joyent, Inc.
28edd669a7SJohn Levon  */
29edd669a7SJohn Levon 
307c478bd9Sstevel@tonic-gate #include <syslog.h>
317c478bd9Sstevel@tonic-gate #include <dlfcn.h>
327c478bd9Sstevel@tonic-gate #include <sys/types.h>
337c478bd9Sstevel@tonic-gate #include <sys/stat.h>
347c478bd9Sstevel@tonic-gate #include <stdlib.h>
357c478bd9Sstevel@tonic-gate #include <strings.h>
367c478bd9Sstevel@tonic-gate #include <malloc.h>
377c478bd9Sstevel@tonic-gate #include <unistd.h>
387c478bd9Sstevel@tonic-gate #include <fcntl.h>
397c478bd9Sstevel@tonic-gate #include <errno.h>
407c478bd9Sstevel@tonic-gate 
417c478bd9Sstevel@tonic-gate #include <security/pam_appl.h>
427c478bd9Sstevel@tonic-gate #include <security/pam_modules.h>
437c478bd9Sstevel@tonic-gate #include <sys/mman.h>
447c478bd9Sstevel@tonic-gate 
457c478bd9Sstevel@tonic-gate #include <libintl.h>
467c478bd9Sstevel@tonic-gate 
477c478bd9Sstevel@tonic-gate #include "pam_impl.h"
487c478bd9Sstevel@tonic-gate 
497c478bd9Sstevel@tonic-gate static char *pam_snames [PAM_NUM_MODULE_TYPES] = {
507c478bd9Sstevel@tonic-gate 	PAM_ACCOUNT_NAME,
517c478bd9Sstevel@tonic-gate 	PAM_AUTH_NAME,
527c478bd9Sstevel@tonic-gate 	PAM_PASSWORD_NAME,
537c478bd9Sstevel@tonic-gate 	PAM_SESSION_NAME
547c478bd9Sstevel@tonic-gate };
557c478bd9Sstevel@tonic-gate 
567c478bd9Sstevel@tonic-gate static char *pam_inames [PAM_MAX_ITEMS] = {
577c478bd9Sstevel@tonic-gate /* NONE */		NULL,
587c478bd9Sstevel@tonic-gate /* PAM_SERVICE */	"service",
597c478bd9Sstevel@tonic-gate /* PAM_USER */		"user",
607c478bd9Sstevel@tonic-gate /* PAM_TTY */		"tty",
61edd669a7SJohn Levon /* PAM_RHOST */		"rhost",
627c478bd9Sstevel@tonic-gate /* PAM_CONV */		"conv",
637c478bd9Sstevel@tonic-gate /* PAM_AUTHTOK */	"authtok",
647c478bd9Sstevel@tonic-gate /* PAM_OLDAUTHTOK */	"oldauthtok",
65edd669a7SJohn Levon /* PAM_RUSER */		"ruser",
667c478bd9Sstevel@tonic-gate /* PAM_USER_PROMPT */	"user_prompt",
677c478bd9Sstevel@tonic-gate /* PAM_REPOSITORY */	"repository",
687c478bd9Sstevel@tonic-gate /* PAM_RESOURCE */	"resource",
69edd669a7SJohn Levon /* PAM_AUSER */		"auser",
707c478bd9Sstevel@tonic-gate /* Undefined Items */
717c478bd9Sstevel@tonic-gate };
727c478bd9Sstevel@tonic-gate 
737c478bd9Sstevel@tonic-gate /*
747c478bd9Sstevel@tonic-gate  * This extra definition is needed in order to build this library
757c478bd9Sstevel@tonic-gate  * on pre-64-bit-aware systems.
767c478bd9Sstevel@tonic-gate  */
777c478bd9Sstevel@tonic-gate #if !defined(_LFS64_LARGEFILE)
787c478bd9Sstevel@tonic-gate #define	stat64	stat
797c478bd9Sstevel@tonic-gate #endif	/* !defined(_LFS64_LARGEFILE) */
807c478bd9Sstevel@tonic-gate 
817c478bd9Sstevel@tonic-gate /* functions to dynamically load modules */
827c478bd9Sstevel@tonic-gate static int	load_modules(pam_handle_t *, int, char *, pamtab_t *);
83edd669a7SJohn Levon static void	*open_module(pam_handle_t *, char *);
847c478bd9Sstevel@tonic-gate static int	load_function(void *, char *, int (**func)());
857c478bd9Sstevel@tonic-gate 
867c478bd9Sstevel@tonic-gate /* functions to read and store the pam.conf configuration file */
877c478bd9Sstevel@tonic-gate static int	open_pam_conf(struct pam_fh **, pam_handle_t *, char *);
887c478bd9Sstevel@tonic-gate static void	close_pam_conf(struct pam_fh *);
897c478bd9Sstevel@tonic-gate static int	read_pam_conf(pam_handle_t *, char *);
90edd669a7SJohn Levon static int	get_pam_conf_entry(struct pam_fh *, pam_handle_t *,
917c478bd9Sstevel@tonic-gate     pamtab_t **);
927c478bd9Sstevel@tonic-gate static char	*read_next_token(char **);
934ef27277Sgww static char	*nextline(struct pam_fh *, pam_handle_t *, int *);
947c478bd9Sstevel@tonic-gate static int	verify_pam_conf(pamtab_t *, char *);
957c478bd9Sstevel@tonic-gate 
967c478bd9Sstevel@tonic-gate /* functions to clean up and free memory */
977c478bd9Sstevel@tonic-gate static void	clean_up(pam_handle_t *);
987c478bd9Sstevel@tonic-gate static void	free_pamconf(pamtab_t *);
997c478bd9Sstevel@tonic-gate static void	free_pam_conf_info(pam_handle_t *);
1007c478bd9Sstevel@tonic-gate static void	free_env(env_list *);
1017c478bd9Sstevel@tonic-gate 
1027c478bd9Sstevel@tonic-gate /* convenience functions for I18N/L10N communication */
1037c478bd9Sstevel@tonic-gate 
1047c478bd9Sstevel@tonic-gate static void	free_resp(int, struct pam_response *);
1057c478bd9Sstevel@tonic-gate static int	do_conv(pam_handle_t *, int, int,
1067c478bd9Sstevel@tonic-gate     char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE], void *,
1077c478bd9Sstevel@tonic-gate     struct pam_response **);
1087c478bd9Sstevel@tonic-gate 
1097c478bd9Sstevel@tonic-gate static int	log_priority;	/* pam_trace syslog priority & facility */
1107c478bd9Sstevel@tonic-gate static int	pam_debug = 0;
1117c478bd9Sstevel@tonic-gate 
1127c478bd9Sstevel@tonic-gate static char *
pam_trace_iname(int item_type,char * iname_buf)1137c478bd9Sstevel@tonic-gate pam_trace_iname(int item_type, char *iname_buf)
1147c478bd9Sstevel@tonic-gate {
1157c478bd9Sstevel@tonic-gate 	char *name;
1167c478bd9Sstevel@tonic-gate 
1177c478bd9Sstevel@tonic-gate 	if (item_type <= 0 ||
1187c478bd9Sstevel@tonic-gate 	    item_type >= PAM_MAX_ITEMS ||
1197c478bd9Sstevel@tonic-gate 	    (name = pam_inames[item_type]) == NULL) {
1207c478bd9Sstevel@tonic-gate 		(void) sprintf(iname_buf, "%d", item_type);
1217c478bd9Sstevel@tonic-gate 		return (iname_buf);
1227c478bd9Sstevel@tonic-gate 	}
1237c478bd9Sstevel@tonic-gate 	return (name);
1247c478bd9Sstevel@tonic-gate }
1257c478bd9Sstevel@tonic-gate 
1267c478bd9Sstevel@tonic-gate static char *
pam_trace_fname(int flag)1277c478bd9Sstevel@tonic-gate pam_trace_fname(int flag)
1287c478bd9Sstevel@tonic-gate {
1297c478bd9Sstevel@tonic-gate 	if (flag & PAM_BINDING)
1307c478bd9Sstevel@tonic-gate 		return (PAM_BINDING_NAME);
1317c478bd9Sstevel@tonic-gate 	if (flag & PAM_INCLUDE)
1327c478bd9Sstevel@tonic-gate 		return (PAM_INCLUDE_NAME);
1337c478bd9Sstevel@tonic-gate 	if (flag & PAM_OPTIONAL)
1347c478bd9Sstevel@tonic-gate 		return (PAM_OPTIONAL_NAME);
1357c478bd9Sstevel@tonic-gate 	if (flag & PAM_REQUIRED)
1367c478bd9Sstevel@tonic-gate 		return (PAM_REQUIRED_NAME);
1377c478bd9Sstevel@tonic-gate 	if (flag & PAM_REQUISITE)
1387c478bd9Sstevel@tonic-gate 		return (PAM_REQUISITE_NAME);
1397c478bd9Sstevel@tonic-gate 	if (flag & PAM_SUFFICIENT)
1407c478bd9Sstevel@tonic-gate 		return (PAM_SUFFICIENT_NAME);
1417c478bd9Sstevel@tonic-gate 	return ("bad flag name");
1427c478bd9Sstevel@tonic-gate }
1437c478bd9Sstevel@tonic-gate 
1447c478bd9Sstevel@tonic-gate static char *
pam_trace_cname(pam_handle_t * pamh)1457c478bd9Sstevel@tonic-gate pam_trace_cname(pam_handle_t *pamh)
1467c478bd9Sstevel@tonic-gate {
1477c478bd9Sstevel@tonic-gate 	if (pamh->pam_conf_name[pamh->include_depth] == NULL)
1487c478bd9Sstevel@tonic-gate 		return ("NULL");
1497c478bd9Sstevel@tonic-gate 	return (pamh->pam_conf_name[pamh->include_depth]);
1507c478bd9Sstevel@tonic-gate }
1517c478bd9Sstevel@tonic-gate 
1527c478bd9Sstevel@tonic-gate #include <deflt.h>
1537c478bd9Sstevel@tonic-gate #include <stdarg.h>
1547c478bd9Sstevel@tonic-gate /*
1557c478bd9Sstevel@tonic-gate  * pam_settrace - setup configuration for pam tracing
1567c478bd9Sstevel@tonic-gate  *
1577c478bd9Sstevel@tonic-gate  * turn on PAM debug if "magic" file exists
1587c478bd9Sstevel@tonic-gate  * if exists (original), pam_debug = PAM_DEBUG_DEFAULT,
1597c478bd9Sstevel@tonic-gate  * log_priority = LOG_DEBUG(7) and log_facility = LOG_AUTH(4).
1607c478bd9Sstevel@tonic-gate  *
1617c478bd9Sstevel@tonic-gate  * if has contents, keywork=value pairs:
1627c478bd9Sstevel@tonic-gate  *
1637c478bd9Sstevel@tonic-gate  *	"log_priority=" 0-7, the pam_trace syslog priority to use
1647c478bd9Sstevel@tonic-gate  *		(see sys/syslog.h)
1657c478bd9Sstevel@tonic-gate  *	"log_facility=" 0-23, the pam_trace syslog facility to use
1667c478bd9Sstevel@tonic-gate  *		(see sys/syslog.h)
1677c478bd9Sstevel@tonic-gate  *	"debug_flags=" PAM_DEBUG_DEFAULT (0x0001), log traditional
1687c478bd9Sstevel@tonic-gate  *			(original) debugging.
1697c478bd9Sstevel@tonic-gate  *		Plus the logical or of:
1707c478bd9Sstevel@tonic-gate  *		    PAM_DEBUG_ITEM (0x0002), log item values and
1717c478bd9Sstevel@tonic-gate  *			pam_get_item.
1727c478bd9Sstevel@tonic-gate  *		    PAM_DEBUG_MODULE (0x0004), log module return status.
1737c478bd9Sstevel@tonic-gate  *		    PAM_DEBUG_CONF (0x0008), log pam.conf parsing.
1747c478bd9Sstevel@tonic-gate  *		    PAM_DEBUG_DATA (0x0010), get/set_data.
1757c478bd9Sstevel@tonic-gate  *		    PAM_DEBUG_CONV (0x0020), conversation/response.
1767c478bd9Sstevel@tonic-gate  *
1777c478bd9Sstevel@tonic-gate  *		    If compiled with DEBUG:
1787c478bd9Sstevel@tonic-gate  *		    PAM_DEBUG_AUTHTOK (0x8000), display AUTHTOK value if
1797c478bd9Sstevel@tonic-gate  *				PAM_DEBUG_ITEM is set and results from
1807c478bd9Sstevel@tonic-gate  *				PAM_PROMPT_ECHO_OFF responses.
1817c478bd9Sstevel@tonic-gate  *		    USE CAREFULLY, THIS EXPOSES THE USER'S PASSWORDS.
1827c478bd9Sstevel@tonic-gate  *
1837c478bd9Sstevel@tonic-gate  *		or set to 0 and off even if PAM_DEBUG file exists.
1847c478bd9Sstevel@tonic-gate  *
1857c478bd9Sstevel@tonic-gate  * Output has the general form:
1867c478bd9Sstevel@tonic-gate  * <whatever was set syslog> PAM[<pid>]: <interface>(<handle> and other info)
1877c478bd9Sstevel@tonic-gate  * <whatever was set syslog> PAM[<pid>]: details requested for <interface> call
1887c478bd9Sstevel@tonic-gate  *	Where:	<pid> is the process ID of the calling process.
1897c478bd9Sstevel@tonic-gate  *		<handle> is the Hex value of the pam_handle associated with the
1907c478bd9Sstevel@tonic-gate  *			call.
1917c478bd9Sstevel@tonic-gate  */
1927c478bd9Sstevel@tonic-gate 
1937c478bd9Sstevel@tonic-gate static void
pam_settrace()1947c478bd9Sstevel@tonic-gate pam_settrace()
1957c478bd9Sstevel@tonic-gate {
196b9175c69SKenjiro Tsuji 	void	*defp;
197b9175c69SKenjiro Tsuji 
198b9175c69SKenjiro Tsuji 	if ((defp = defopen_r(PAM_DEBUG)) != NULL) {
1997c478bd9Sstevel@tonic-gate 		char	*arg;
2007c478bd9Sstevel@tonic-gate 		int	code;
2017c478bd9Sstevel@tonic-gate 		int	facility = LOG_AUTH;
2027c478bd9Sstevel@tonic-gate 
2037c478bd9Sstevel@tonic-gate 		pam_debug = PAM_DEBUG_DEFAULT;
2047c478bd9Sstevel@tonic-gate 		log_priority = LOG_DEBUG;
2057c478bd9Sstevel@tonic-gate 
206b9175c69SKenjiro Tsuji 		(void) defcntl_r(DC_SETFLAGS, DC_CASE, defp);
207b9175c69SKenjiro Tsuji 		if ((arg = defread_r(LOG_PRIORITY, defp)) != NULL) {
2087c478bd9Sstevel@tonic-gate 			code = (int)strtol(arg, NULL, 10);
2097c478bd9Sstevel@tonic-gate 			if ((code & ~LOG_PRIMASK) == 0) {
2107c478bd9Sstevel@tonic-gate 				log_priority = code;
2117c478bd9Sstevel@tonic-gate 			}
2127c478bd9Sstevel@tonic-gate 		}
213b9175c69SKenjiro Tsuji 		if ((arg = defread_r(LOG_FACILITY, defp)) != NULL) {
2147c478bd9Sstevel@tonic-gate 			code = (int)strtol(arg, NULL, 10);
2157c478bd9Sstevel@tonic-gate 			if (code < LOG_NFACILITIES) {
2167c478bd9Sstevel@tonic-gate 				facility = code << 3;
2177c478bd9Sstevel@tonic-gate 			}
2187c478bd9Sstevel@tonic-gate 		}
219b9175c69SKenjiro Tsuji 		if ((arg = defread_r(DEBUG_FLAGS, defp)) != NULL) {
2207c478bd9Sstevel@tonic-gate 			pam_debug = (int)strtol(arg, NULL, 0);
2217c478bd9Sstevel@tonic-gate 		}
222b9175c69SKenjiro Tsuji 		defclose_r(defp);
2237c478bd9Sstevel@tonic-gate 
2247c478bd9Sstevel@tonic-gate 		log_priority |= facility;
2257c478bd9Sstevel@tonic-gate 	}
2267c478bd9Sstevel@tonic-gate }
2277c478bd9Sstevel@tonic-gate 
2287c478bd9Sstevel@tonic-gate /*
2297c478bd9Sstevel@tonic-gate  * pam_trace - logs tracing messages
2307c478bd9Sstevel@tonic-gate  *
2317c478bd9Sstevel@tonic-gate  *	flag = debug_flags from /etc/pam_debug
2327c478bd9Sstevel@tonic-gate  *	format and args = message to print (PAM[<pid>]: is prepended).
2337c478bd9Sstevel@tonic-gate  *
2347c478bd9Sstevel@tonic-gate  *	global log_priority = pam_trace syslog (log_priority | log_facility)
2357c478bd9Sstevel@tonic-gate  *		from /etc/pam_debug
2367c478bd9Sstevel@tonic-gate  */
2377c478bd9Sstevel@tonic-gate /*PRINTFLIKE2*/
2387c478bd9Sstevel@tonic-gate static void
pam_trace(int flag,char * format,...)2397c478bd9Sstevel@tonic-gate pam_trace(int flag, char *format, ...)
2407c478bd9Sstevel@tonic-gate {
2417c478bd9Sstevel@tonic-gate 	va_list args;
2427c478bd9Sstevel@tonic-gate 	char message[1024];
2437c478bd9Sstevel@tonic-gate 	int savemask;
2447c478bd9Sstevel@tonic-gate 
2457c478bd9Sstevel@tonic-gate 	if ((pam_debug & flag) == 0)
2467c478bd9Sstevel@tonic-gate 		return;
2477c478bd9Sstevel@tonic-gate 
2487c478bd9Sstevel@tonic-gate 	savemask = setlogmask(LOG_MASK(log_priority & LOG_PRIMASK));
2497c478bd9Sstevel@tonic-gate 	(void) snprintf(message, sizeof (message), "PAM[%ld]: %s",
2507c478bd9Sstevel@tonic-gate 	    (long)getpid(), format);
2517c478bd9Sstevel@tonic-gate 	va_start(args, format);
2527c478bd9Sstevel@tonic-gate 	(void) vsyslog(log_priority, message, args);
2537c478bd9Sstevel@tonic-gate 	va_end(args);
2547c478bd9Sstevel@tonic-gate 	(void) setlogmask(savemask);
2557c478bd9Sstevel@tonic-gate }
2567c478bd9Sstevel@tonic-gate 
2577c478bd9Sstevel@tonic-gate /*
2587c478bd9Sstevel@tonic-gate  * __pam_log - logs PAM syslog messages
2597c478bd9Sstevel@tonic-gate  *
2607c478bd9Sstevel@tonic-gate  *	priority = message priority
2617c478bd9Sstevel@tonic-gate  *	format and args = message to log
2627c478bd9Sstevel@tonic-gate  */
2637c478bd9Sstevel@tonic-gate /*PRINTFLIKE2*/
2647c478bd9Sstevel@tonic-gate void
__pam_log(int priority,const char * format,...)2657c478bd9Sstevel@tonic-gate __pam_log(int priority, const char *format, ...)
2667c478bd9Sstevel@tonic-gate {
2677c478bd9Sstevel@tonic-gate 	va_list args;
2687c478bd9Sstevel@tonic-gate 	int savemask = setlogmask(LOG_MASK(priority & LOG_PRIMASK));
2697c478bd9Sstevel@tonic-gate 
2707c478bd9Sstevel@tonic-gate 	va_start(args, format);
2717c478bd9Sstevel@tonic-gate 	(void) vsyslog(priority, format, args);
2727c478bd9Sstevel@tonic-gate 	va_end(args);
2737c478bd9Sstevel@tonic-gate 	(void) setlogmask(savemask);
2747c478bd9Sstevel@tonic-gate }
2757c478bd9Sstevel@tonic-gate 
2767c478bd9Sstevel@tonic-gate 
2777c478bd9Sstevel@tonic-gate /*
2787c478bd9Sstevel@tonic-gate  *			pam_XXXXX routines
2797c478bd9Sstevel@tonic-gate  *
2807c478bd9Sstevel@tonic-gate  *	These are the entry points to the authentication switch
2817c478bd9Sstevel@tonic-gate  */
2827c478bd9Sstevel@tonic-gate 
2837c478bd9Sstevel@tonic-gate /*
2847c478bd9Sstevel@tonic-gate  * pam_start		- initiate an authentication transaction and
2857c478bd9Sstevel@tonic-gate  *			  set parameter values to be used during the
2867c478bd9Sstevel@tonic-gate  *			  transaction
2877c478bd9Sstevel@tonic-gate  */
2887c478bd9Sstevel@tonic-gate 
2897c478bd9Sstevel@tonic-gate int
pam_start(const char * service,const char * user,const struct pam_conv * pam_conv,pam_handle_t ** pamh)2907c478bd9Sstevel@tonic-gate pam_start(const char *service, const char *user,
2917c478bd9Sstevel@tonic-gate     const struct pam_conv *pam_conv, pam_handle_t **pamh)
2927c478bd9Sstevel@tonic-gate {
2937c478bd9Sstevel@tonic-gate 	int	err;
2947c478bd9Sstevel@tonic-gate 
2951e08f0b8Sgww 	*pamh = calloc(1, sizeof (struct pam_handle));
2967c478bd9Sstevel@tonic-gate 
2977c478bd9Sstevel@tonic-gate 	pam_settrace();
2987c478bd9Sstevel@tonic-gate 	pam_trace(PAM_DEBUG_DEFAULT,
2997c478bd9Sstevel@tonic-gate 	    "pam_start(%s,%s,%p:%p) - debug = %x",
3007c478bd9Sstevel@tonic-gate 	    service ? service : "NULL", user ? user : "NULL", (void *)pam_conv,
3017c478bd9Sstevel@tonic-gate 	    (void *)*pamh, pam_debug);
3027c478bd9Sstevel@tonic-gate 
3037c478bd9Sstevel@tonic-gate 	if (*pamh == NULL)
3047c478bd9Sstevel@tonic-gate 		return (PAM_BUF_ERR);
3057c478bd9Sstevel@tonic-gate 
3067c478bd9Sstevel@tonic-gate 	(*pamh)->pam_inmodule = RO_OK;		/* OK to set RO items */
3077c478bd9Sstevel@tonic-gate 	if ((err = pam_set_item(*pamh, PAM_SERVICE, (void *)service))
3087c478bd9Sstevel@tonic-gate 	    != PAM_SUCCESS) {
3097c478bd9Sstevel@tonic-gate 		clean_up(*pamh);
3107c478bd9Sstevel@tonic-gate 		*pamh = NULL;
3117c478bd9Sstevel@tonic-gate 		return (err);
3127c478bd9Sstevel@tonic-gate 	}
3137c478bd9Sstevel@tonic-gate 
3147c478bd9Sstevel@tonic-gate 	if ((err = pam_set_item(*pamh, PAM_USER, (void *)user))
3157c478bd9Sstevel@tonic-gate 	    != PAM_SUCCESS) {
3167c478bd9Sstevel@tonic-gate 		clean_up(*pamh);
3177c478bd9Sstevel@tonic-gate 		*pamh = NULL;
3187c478bd9Sstevel@tonic-gate 		return (err);
3197c478bd9Sstevel@tonic-gate 	}
3207c478bd9Sstevel@tonic-gate 
3217c478bd9Sstevel@tonic-gate 	if ((err = pam_set_item(*pamh, PAM_CONV, (void *)pam_conv))
3227c478bd9Sstevel@tonic-gate 	    != PAM_SUCCESS) {
3237c478bd9Sstevel@tonic-gate 		clean_up(*pamh);
3247c478bd9Sstevel@tonic-gate 		*pamh = NULL;
3257c478bd9Sstevel@tonic-gate 		return (err);
3267c478bd9Sstevel@tonic-gate 	}
3277c478bd9Sstevel@tonic-gate 
3287c478bd9Sstevel@tonic-gate 	(*pamh)->pam_inmodule = RW_OK;
3297c478bd9Sstevel@tonic-gate 	return (PAM_SUCCESS);
3307c478bd9Sstevel@tonic-gate }
3317c478bd9Sstevel@tonic-gate 
3327c478bd9Sstevel@tonic-gate /*
3337c478bd9Sstevel@tonic-gate  * pam_end - terminate an authentication transaction
3347c478bd9Sstevel@tonic-gate  */
3357c478bd9Sstevel@tonic-gate 
3367c478bd9Sstevel@tonic-gate int
pam_end(pam_handle_t * pamh,int pam_status)3377c478bd9Sstevel@tonic-gate pam_end(pam_handle_t *pamh, int pam_status)
3387c478bd9Sstevel@tonic-gate {
3397c478bd9Sstevel@tonic-gate 	struct pam_module_data *psd, *p;
3407c478bd9Sstevel@tonic-gate 	fd_list *expired;
3417c478bd9Sstevel@tonic-gate 	fd_list *traverse;
3427c478bd9Sstevel@tonic-gate 	env_list *env_expired;
3437c478bd9Sstevel@tonic-gate 	env_list *env_traverse;
3447c478bd9Sstevel@tonic-gate 
3457c478bd9Sstevel@tonic-gate 	pam_trace(PAM_DEBUG_DEFAULT,
3467c478bd9Sstevel@tonic-gate 	    "pam_end(%p): status = %s", (void *)pamh,
3477c478bd9Sstevel@tonic-gate 	    pam_strerror(pamh, pam_status));
3487c478bd9Sstevel@tonic-gate 
3497c478bd9Sstevel@tonic-gate 	if (pamh == NULL)
3507c478bd9Sstevel@tonic-gate 		return (PAM_SYSTEM_ERR);
3517c478bd9Sstevel@tonic-gate 
3527c478bd9Sstevel@tonic-gate 	/* call the cleanup routines for module specific data */
3537c478bd9Sstevel@tonic-gate 
3547c478bd9Sstevel@tonic-gate 	psd = pamh->ssd;
3557c478bd9Sstevel@tonic-gate 	while (psd) {
3567c478bd9Sstevel@tonic-gate 		if (psd->cleanup) {
3577c478bd9Sstevel@tonic-gate 			psd->cleanup(pamh, psd->data, pam_status);
3587c478bd9Sstevel@tonic-gate 		}
3597c478bd9Sstevel@tonic-gate 		p = psd;
3607c478bd9Sstevel@tonic-gate 		psd = p->next;
3617c478bd9Sstevel@tonic-gate 		free(p->module_data_name);
3627c478bd9Sstevel@tonic-gate 		free(p);
3637c478bd9Sstevel@tonic-gate 	}
3647c478bd9Sstevel@tonic-gate 	pamh->ssd = NULL;
3657c478bd9Sstevel@tonic-gate 
3667c478bd9Sstevel@tonic-gate 	/* dlclose all module fds */
3677c478bd9Sstevel@tonic-gate 	traverse = pamh->fd;
3687c478bd9Sstevel@tonic-gate 	while (traverse) {
3697c478bd9Sstevel@tonic-gate 		expired = traverse;
3707c478bd9Sstevel@tonic-gate 		traverse = traverse->next;
3717c478bd9Sstevel@tonic-gate 		(void) dlclose(expired->mh);
3727c478bd9Sstevel@tonic-gate 		free(expired);
3737c478bd9Sstevel@tonic-gate 	}
3747c478bd9Sstevel@tonic-gate 	pamh->fd = 0;
3757c478bd9Sstevel@tonic-gate 
3767c478bd9Sstevel@tonic-gate 	/* remove all environment variables */
3777c478bd9Sstevel@tonic-gate 	env_traverse = pamh->pam_env;
3787c478bd9Sstevel@tonic-gate 	while (env_traverse) {
3797c478bd9Sstevel@tonic-gate 		env_expired = env_traverse;
3807c478bd9Sstevel@tonic-gate 		env_traverse = env_traverse->next;
3817c478bd9Sstevel@tonic-gate 		free_env(env_expired);
3827c478bd9Sstevel@tonic-gate 	}
3837c478bd9Sstevel@tonic-gate 
3847c478bd9Sstevel@tonic-gate 	clean_up(pamh);
3857c478bd9Sstevel@tonic-gate 	return (PAM_SUCCESS);
3867c478bd9Sstevel@tonic-gate }
3877c478bd9Sstevel@tonic-gate 
3887c478bd9Sstevel@tonic-gate /*
3897c478bd9Sstevel@tonic-gate  * pam_set_item		- set the value of a parameter that can be
3907c478bd9Sstevel@tonic-gate  *			  retrieved via a call to pam_get_item()
3917c478bd9Sstevel@tonic-gate  */
3927c478bd9Sstevel@tonic-gate 
3937c478bd9Sstevel@tonic-gate int
pam_set_item(pam_handle_t * pamh,int item_type,const void * item)3947c478bd9Sstevel@tonic-gate pam_set_item(pam_handle_t *pamh, int item_type, const void *item)
3957c478bd9Sstevel@tonic-gate {
3967c478bd9Sstevel@tonic-gate 	struct pam_item *pip;
3977c478bd9Sstevel@tonic-gate 	int	size;
3987c478bd9Sstevel@tonic-gate 	char	iname_buf[PAM_MAX_MSG_SIZE];
3997c478bd9Sstevel@tonic-gate 
4007c478bd9Sstevel@tonic-gate 	if (((pam_debug & PAM_DEBUG_ITEM) == 0) || (pamh == NULL)) {
4017c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_DEFAULT,
4027c478bd9Sstevel@tonic-gate 		    "pam_set_item(%p:%s)", (void *)pamh,
4037c478bd9Sstevel@tonic-gate 		    pam_trace_iname(item_type, iname_buf));
4047c478bd9Sstevel@tonic-gate 	}
4057c478bd9Sstevel@tonic-gate 
4067c478bd9Sstevel@tonic-gate 	if (pamh == NULL)
4077c478bd9Sstevel@tonic-gate 		return (PAM_SYSTEM_ERR);
4087c478bd9Sstevel@tonic-gate 
4097c478bd9Sstevel@tonic-gate 	/* check read only items */
4107c478bd9Sstevel@tonic-gate 	if ((item_type == PAM_SERVICE) && (pamh->pam_inmodule != RO_OK))
4117c478bd9Sstevel@tonic-gate 		return (PAM_PERM_DENIED);
4127c478bd9Sstevel@tonic-gate 
4137c478bd9Sstevel@tonic-gate 	/*
4147c478bd9Sstevel@tonic-gate 	 * Check that item_type is within valid range
4157c478bd9Sstevel@tonic-gate 	 */
4167c478bd9Sstevel@tonic-gate 
4177c478bd9Sstevel@tonic-gate 	if (item_type <= 0 || item_type >= PAM_MAX_ITEMS)
4187c478bd9Sstevel@tonic-gate 		return (PAM_SYMBOL_ERR);
4197c478bd9Sstevel@tonic-gate 
4207c478bd9Sstevel@tonic-gate 	pip = &(pamh->ps_item[item_type]);
4217c478bd9Sstevel@tonic-gate 
4227c478bd9Sstevel@tonic-gate 	switch (item_type) {
4237c478bd9Sstevel@tonic-gate 	case PAM_AUTHTOK:
4247c478bd9Sstevel@tonic-gate 	case PAM_OLDAUTHTOK:
4257c478bd9Sstevel@tonic-gate 		if (pip->pi_addr != NULL)
4267c478bd9Sstevel@tonic-gate 			(void) memset(pip->pi_addr, 0, pip->pi_size);
4277c478bd9Sstevel@tonic-gate 		/*FALLTHROUGH*/
4287c478bd9Sstevel@tonic-gate 	case PAM_SERVICE:
4297c478bd9Sstevel@tonic-gate 	case PAM_USER:
4307c478bd9Sstevel@tonic-gate 	case PAM_TTY:
4317c478bd9Sstevel@tonic-gate 	case PAM_RHOST:
4327c478bd9Sstevel@tonic-gate 	case PAM_RUSER:
4337c478bd9Sstevel@tonic-gate 	case PAM_USER_PROMPT:
4347c478bd9Sstevel@tonic-gate 	case PAM_RESOURCE:
435bf430c99Sgww 	case PAM_AUSER:
4367c478bd9Sstevel@tonic-gate 		if (pip->pi_addr != NULL) {
4377c478bd9Sstevel@tonic-gate 			free(pip->pi_addr);
4387c478bd9Sstevel@tonic-gate 		}
4397c478bd9Sstevel@tonic-gate 
4407c478bd9Sstevel@tonic-gate 		if (item == NULL) {
4417c478bd9Sstevel@tonic-gate 			pip->pi_addr = NULL;
4427c478bd9Sstevel@tonic-gate 			pip->pi_size = 0;
4437c478bd9Sstevel@tonic-gate 		} else {
4447c478bd9Sstevel@tonic-gate 			pip->pi_addr = strdup((char *)item);
4457c478bd9Sstevel@tonic-gate 			if (pip->pi_addr == NULL) {
4467c478bd9Sstevel@tonic-gate 				pip->pi_size = 0;
4477c478bd9Sstevel@tonic-gate 				return (PAM_BUF_ERR);
4487c478bd9Sstevel@tonic-gate 			}
4497c478bd9Sstevel@tonic-gate 			pip->pi_size = strlen(pip->pi_addr);
4507c478bd9Sstevel@tonic-gate 		}
4517c478bd9Sstevel@tonic-gate 		break;
4527c478bd9Sstevel@tonic-gate 	case PAM_CONV:
4537c478bd9Sstevel@tonic-gate 		if (pip->pi_addr != NULL)
4547c478bd9Sstevel@tonic-gate 			free(pip->pi_addr);
4557c478bd9Sstevel@tonic-gate 		size = sizeof (struct pam_conv);
4561e08f0b8Sgww 		if ((pip->pi_addr = calloc(1, size)) == NULL)
4577c478bd9Sstevel@tonic-gate 			return (PAM_BUF_ERR);
4587c478bd9Sstevel@tonic-gate 		if (item != NULL)
4597c478bd9Sstevel@tonic-gate 			(void) memcpy(pip->pi_addr, item, (unsigned int) size);
4607c478bd9Sstevel@tonic-gate 		else
4617c478bd9Sstevel@tonic-gate 			(void) memset(pip->pi_addr, 0, size);
4627c478bd9Sstevel@tonic-gate 		pip->pi_size = size;
4637c478bd9Sstevel@tonic-gate 		break;
4647c478bd9Sstevel@tonic-gate 	case PAM_REPOSITORY:
4657c478bd9Sstevel@tonic-gate 		if (pip->pi_addr != NULL) {
4667c478bd9Sstevel@tonic-gate 			pam_repository_t *auth_rep;
4677c478bd9Sstevel@tonic-gate 
4687c478bd9Sstevel@tonic-gate 			auth_rep = (pam_repository_t *)pip->pi_addr;
4697c478bd9Sstevel@tonic-gate 			if (auth_rep->type != NULL)
4707c478bd9Sstevel@tonic-gate 				free(auth_rep->type);
4717c478bd9Sstevel@tonic-gate 			if (auth_rep->scope != NULL)
4727c478bd9Sstevel@tonic-gate 				free(auth_rep->scope);
4737c478bd9Sstevel@tonic-gate 			free(auth_rep);
4747c478bd9Sstevel@tonic-gate 		}
4757c478bd9Sstevel@tonic-gate 		if (item != NULL) {
4767c478bd9Sstevel@tonic-gate 			pam_repository_t *s, *d;
4777c478bd9Sstevel@tonic-gate 
4787c478bd9Sstevel@tonic-gate 			size = sizeof (struct pam_repository);
4791e08f0b8Sgww 			pip->pi_addr = calloc(1, size);
4807c478bd9Sstevel@tonic-gate 			if (pip->pi_addr == NULL)
4817c478bd9Sstevel@tonic-gate 				return (PAM_BUF_ERR);
4827c478bd9Sstevel@tonic-gate 
4837c478bd9Sstevel@tonic-gate 			s = (struct pam_repository *)item;
4847c478bd9Sstevel@tonic-gate 			d = (struct pam_repository *)pip->pi_addr;
4857c478bd9Sstevel@tonic-gate 
4867c478bd9Sstevel@tonic-gate 			d->type = strdup(s->type);
4877c478bd9Sstevel@tonic-gate 			if (d->type == NULL)
4887c478bd9Sstevel@tonic-gate 				return (PAM_BUF_ERR);
4897c478bd9Sstevel@tonic-gate 			d->scope = malloc(s->scope_len);
4907c478bd9Sstevel@tonic-gate 			if (d->scope == NULL)
4917c478bd9Sstevel@tonic-gate 				return (PAM_BUF_ERR);
4927c478bd9Sstevel@tonic-gate 			(void) memcpy(d->scope, s->scope, s->scope_len);
4937c478bd9Sstevel@tonic-gate 			d->scope_len = s->scope_len;
4947c478bd9Sstevel@tonic-gate 		}
4957c478bd9Sstevel@tonic-gate 		pip->pi_size = size;
4967c478bd9Sstevel@tonic-gate 		break;
4977c478bd9Sstevel@tonic-gate 	default:
4987c478bd9Sstevel@tonic-gate 		return (PAM_SYMBOL_ERR);
4997c478bd9Sstevel@tonic-gate 	}
5007c478bd9Sstevel@tonic-gate 	switch (item_type) {
5017c478bd9Sstevel@tonic-gate 	case PAM_CONV:
5027c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%p",
5037c478bd9Sstevel@tonic-gate 		    (void *)pamh,
5047c478bd9Sstevel@tonic-gate 		    pam_trace_iname(item_type, iname_buf),
5057c478bd9Sstevel@tonic-gate 		    item ? (void *)((struct pam_conv *)item)->conv :
5067c478bd9Sstevel@tonic-gate 		    (void *)0);
5077c478bd9Sstevel@tonic-gate 		break;
5087c478bd9Sstevel@tonic-gate 	case PAM_REPOSITORY:
5097c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%s",
5107c478bd9Sstevel@tonic-gate 		    (void *)pamh,
5117c478bd9Sstevel@tonic-gate 		    pam_trace_iname(item_type, iname_buf),
5127c478bd9Sstevel@tonic-gate 		    item ? (((struct pam_repository *)item)->type ?
5137c478bd9Sstevel@tonic-gate 		    ((struct pam_repository *)item)->type : "NULL") :
5147c478bd9Sstevel@tonic-gate 		    "NULL");
5157c478bd9Sstevel@tonic-gate 		break;
5167c478bd9Sstevel@tonic-gate 	case PAM_AUTHTOK:
5177c478bd9Sstevel@tonic-gate 	case PAM_OLDAUTHTOK:
5187c478bd9Sstevel@tonic-gate #ifdef	DEBUG
5197c478bd9Sstevel@tonic-gate 		if (pam_debug & PAM_DEBUG_AUTHTOK)
5207c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_ITEM,
5217c478bd9Sstevel@tonic-gate 			    "pam_set_item(%p:%s)=%s", (void *)pamh,
5227c478bd9Sstevel@tonic-gate 			    pam_trace_iname(item_type, iname_buf),
5237c478bd9Sstevel@tonic-gate 			    item ? (char *)item : "NULL");
5247c478bd9Sstevel@tonic-gate 		else
5257c478bd9Sstevel@tonic-gate #endif	/* DEBUG */
5267c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_ITEM,
5277c478bd9Sstevel@tonic-gate 			    "pam_set_item(%p:%s)=%s", (void *)pamh,
5287c478bd9Sstevel@tonic-gate 			    pam_trace_iname(item_type, iname_buf),
5297c478bd9Sstevel@tonic-gate 			    item ? "********" : "NULL");
5307c478bd9Sstevel@tonic-gate 		break;
5317c478bd9Sstevel@tonic-gate 	default:
5327c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_ITEM, "pam_set_item(%p:%s)=%s",
5337c478bd9Sstevel@tonic-gate 		    (void *)pamh,
5347c478bd9Sstevel@tonic-gate 		    pam_trace_iname(item_type, iname_buf),
5357c478bd9Sstevel@tonic-gate 		    item ? (char *)item : "NULL");
5367c478bd9Sstevel@tonic-gate 	}
5377c478bd9Sstevel@tonic-gate 
5387c478bd9Sstevel@tonic-gate 	return (PAM_SUCCESS);
5397c478bd9Sstevel@tonic-gate }
5407c478bd9Sstevel@tonic-gate 
5417c478bd9Sstevel@tonic-gate /*
5427c478bd9Sstevel@tonic-gate  * pam_get_item		- read the value of a parameter specified in
5437c478bd9Sstevel@tonic-gate  *			  the call to pam_set_item()
5447c478bd9Sstevel@tonic-gate  */
5457c478bd9Sstevel@tonic-gate 
5467c478bd9Sstevel@tonic-gate int
pam_get_item(const pam_handle_t * pamh,int item_type,void ** item)5477c478bd9Sstevel@tonic-gate pam_get_item(const pam_handle_t *pamh, int item_type, void **item)
5487c478bd9Sstevel@tonic-gate {
5497c478bd9Sstevel@tonic-gate 	struct pam_item *pip;
5507c478bd9Sstevel@tonic-gate 	char	iname_buf[PAM_MAX_MSG_SIZE];
5517c478bd9Sstevel@tonic-gate 
5527c478bd9Sstevel@tonic-gate 	if (((pam_debug & PAM_DEBUG_ITEM) == 0) || (pamh == NULL)) {
5537c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)",
5547c478bd9Sstevel@tonic-gate 		    (void *)pamh, pam_trace_iname(item_type, iname_buf));
5557c478bd9Sstevel@tonic-gate 	}
5567c478bd9Sstevel@tonic-gate 
5577c478bd9Sstevel@tonic-gate 	if (pamh == NULL)
5587c478bd9Sstevel@tonic-gate 		return (PAM_SYSTEM_ERR);
5597c478bd9Sstevel@tonic-gate 
5607c478bd9Sstevel@tonic-gate 	if (item_type <= 0 || item_type >= PAM_MAX_ITEMS)
5617c478bd9Sstevel@tonic-gate 		return (PAM_SYMBOL_ERR);
5627c478bd9Sstevel@tonic-gate 
5637c478bd9Sstevel@tonic-gate 	if ((pamh->pam_inmodule != WO_OK) &&
5647c478bd9Sstevel@tonic-gate 	    ((item_type == PAM_AUTHTOK || item_type == PAM_OLDAUTHTOK))) {
5657c478bd9Sstevel@tonic-gate 		__pam_log(LOG_AUTH | LOG_NOTICE, "pam_get_item(%s) called from "
5667c478bd9Sstevel@tonic-gate 		    "a non module context",
5677c478bd9Sstevel@tonic-gate 		    pam_trace_iname(item_type, iname_buf));
5687c478bd9Sstevel@tonic-gate 		return (PAM_PERM_DENIED);
5697c478bd9Sstevel@tonic-gate 	}
5707c478bd9Sstevel@tonic-gate 
5717c478bd9Sstevel@tonic-gate 	pip = (struct pam_item *)&(pamh->ps_item[item_type]);
5727c478bd9Sstevel@tonic-gate 
5737c478bd9Sstevel@tonic-gate 	*item = pip->pi_addr;
5747c478bd9Sstevel@tonic-gate 	switch (item_type) {
5757c478bd9Sstevel@tonic-gate 	case PAM_CONV:
5767c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%p",
5777c478bd9Sstevel@tonic-gate 		    (void *)pamh,
5787c478bd9Sstevel@tonic-gate 		    pam_trace_iname(item_type, iname_buf),
5797c478bd9Sstevel@tonic-gate 		    (void *)((struct pam_conv *)*item)->conv);
5807c478bd9Sstevel@tonic-gate 		break;
5817c478bd9Sstevel@tonic-gate 	case PAM_REPOSITORY:
5827c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%s",
5837c478bd9Sstevel@tonic-gate 		    (void *)pamh,
5847c478bd9Sstevel@tonic-gate 		    pam_trace_iname(item_type, iname_buf),
5857c478bd9Sstevel@tonic-gate 		    *item ? (((struct pam_repository *)*item)->type ?
5867c478bd9Sstevel@tonic-gate 		    ((struct pam_repository *)*item)->type : "NULL") :
5877c478bd9Sstevel@tonic-gate 		    "NULL");
5887c478bd9Sstevel@tonic-gate 		break;
5897c478bd9Sstevel@tonic-gate 	case PAM_AUTHTOK:
5907c478bd9Sstevel@tonic-gate 	case PAM_OLDAUTHTOK:
5917c478bd9Sstevel@tonic-gate #ifdef	DEBUG
5927c478bd9Sstevel@tonic-gate 		if (pam_debug & PAM_DEBUG_AUTHTOK)
5937c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_ITEM,
5947c478bd9Sstevel@tonic-gate 			    "pam_get_item(%p:%s)=%s", (void *)pamh,
5957c478bd9Sstevel@tonic-gate 			    pam_trace_iname(item_type, iname_buf),
5967c478bd9Sstevel@tonic-gate 			    *item ? *(char **)item : "NULL");
5977c478bd9Sstevel@tonic-gate 		else
5987c478bd9Sstevel@tonic-gate #endif	/* DEBUG */
5997c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_ITEM,
6007c478bd9Sstevel@tonic-gate 			    "pam_get_item(%p:%s)=%s", (void *)pamh,
6017c478bd9Sstevel@tonic-gate 			    pam_trace_iname(item_type, iname_buf),
6027c478bd9Sstevel@tonic-gate 			    *item ? "********" : "NULL");
6037c478bd9Sstevel@tonic-gate 		break;
6047c478bd9Sstevel@tonic-gate 	default:
6057c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_ITEM, "pam_get_item(%p:%s)=%s",
6067c478bd9Sstevel@tonic-gate 		    (void *)pamh,
6077c478bd9Sstevel@tonic-gate 		    pam_trace_iname(item_type, iname_buf),
6087c478bd9Sstevel@tonic-gate 		    *item ? *(char **)item : "NULL");
6097c478bd9Sstevel@tonic-gate 	}
6107c478bd9Sstevel@tonic-gate 
6117c478bd9Sstevel@tonic-gate 	return (PAM_SUCCESS);
6127c478bd9Sstevel@tonic-gate }
6137c478bd9Sstevel@tonic-gate 
6147c478bd9Sstevel@tonic-gate /*
6157c478bd9Sstevel@tonic-gate  * parse_user_name         - process the user response: ignore
6167c478bd9Sstevel@tonic-gate  *                           '\t' or ' ' before or after a user name.
6177c478bd9Sstevel@tonic-gate  *                           user_input is a null terminated string.
6187c478bd9Sstevel@tonic-gate  *                           *ret_username will be the user name.
6197c478bd9Sstevel@tonic-gate  */
6207c478bd9Sstevel@tonic-gate 
6217c478bd9Sstevel@tonic-gate static int
parse_user_name(char * user_input,char ** ret_username)6227c478bd9Sstevel@tonic-gate parse_user_name(char *user_input, char **ret_username)
6237c478bd9Sstevel@tonic-gate {
6247c478bd9Sstevel@tonic-gate 	register char *ptr;
6257c478bd9Sstevel@tonic-gate 	register int index = 0;
6267c478bd9Sstevel@tonic-gate 	char username[PAM_MAX_RESP_SIZE];
6277c478bd9Sstevel@tonic-gate 
6287c478bd9Sstevel@tonic-gate 	/* Set the default value for *ret_username */
6297c478bd9Sstevel@tonic-gate 	*ret_username = NULL;
6307c478bd9Sstevel@tonic-gate 
6317c478bd9Sstevel@tonic-gate 	/*
6327c478bd9Sstevel@tonic-gate 	 * Set the initial value for username - this is a buffer holds
6337c478bd9Sstevel@tonic-gate 	 * the user name.
6347c478bd9Sstevel@tonic-gate 	 */
6357c478bd9Sstevel@tonic-gate 	bzero((void *)username, PAM_MAX_RESP_SIZE);
6367c478bd9Sstevel@tonic-gate 
6377c478bd9Sstevel@tonic-gate 	/*
6387c478bd9Sstevel@tonic-gate 	 * The user_input is guaranteed to be terminated by a null character.
6397c478bd9Sstevel@tonic-gate 	 */
6407c478bd9Sstevel@tonic-gate 	ptr = user_input;
6417c478bd9Sstevel@tonic-gate 
6427c478bd9Sstevel@tonic-gate 	/* Skip all the leading whitespaces if there are any. */
6437c478bd9Sstevel@tonic-gate 	while ((*ptr == ' ') || (*ptr == '\t'))
6447c478bd9Sstevel@tonic-gate 		ptr++;
6457c478bd9Sstevel@tonic-gate 
6467c478bd9Sstevel@tonic-gate 	if (*ptr == '\0') {
6477c478bd9Sstevel@tonic-gate 		/*
6487c478bd9Sstevel@tonic-gate 		 * We should never get here since the user_input we got
6497c478bd9Sstevel@tonic-gate 		 * in pam_get_user() is not all whitespaces nor just "\0".
6507c478bd9Sstevel@tonic-gate 		 */
6517c478bd9Sstevel@tonic-gate 		return (PAM_BUF_ERR);
6527c478bd9Sstevel@tonic-gate 	}
6537c478bd9Sstevel@tonic-gate 
6547c478bd9Sstevel@tonic-gate 	/*
6557c478bd9Sstevel@tonic-gate 	 * username will be the first string we get from user_input
6567c478bd9Sstevel@tonic-gate 	 * - we skip leading whitespaces and ignore trailing whitespaces
6577c478bd9Sstevel@tonic-gate 	 */
6587c478bd9Sstevel@tonic-gate 	while (*ptr != '\0') {
659*1d276e0bSDan McDonald 		if ((*ptr == ' ') || (*ptr == '\t') ||
660*1d276e0bSDan McDonald 		    (index >= PAM_MAX_RESP_SIZE)) {
6617c478bd9Sstevel@tonic-gate 			break;
662*1d276e0bSDan McDonald 		} else {
6637c478bd9Sstevel@tonic-gate 			username[index] = *ptr;
6647c478bd9Sstevel@tonic-gate 			index++;
6657c478bd9Sstevel@tonic-gate 			ptr++;
6667c478bd9Sstevel@tonic-gate 		}
6677c478bd9Sstevel@tonic-gate 	}
6687c478bd9Sstevel@tonic-gate 
6697c478bd9Sstevel@tonic-gate 	/* ret_username will be freed in pam_get_user(). */
670*1d276e0bSDan McDonald 	if (index >= PAM_MAX_RESP_SIZE ||
671*1d276e0bSDan McDonald 	    (*ret_username = strdup(username)) == NULL)
6727c478bd9Sstevel@tonic-gate 		return (PAM_BUF_ERR);
6737c478bd9Sstevel@tonic-gate 	return (PAM_SUCCESS);
6747c478bd9Sstevel@tonic-gate }
6757c478bd9Sstevel@tonic-gate 
6767c478bd9Sstevel@tonic-gate /*
6777c478bd9Sstevel@tonic-gate  * Get the value of PAM_USER. If not set, then use the convenience function
6787c478bd9Sstevel@tonic-gate  * to prompt for the user. Use prompt if specified, else use PAM_USER_PROMPT
6797c478bd9Sstevel@tonic-gate  * if it is set, else use default.
6807c478bd9Sstevel@tonic-gate  */
6817c478bd9Sstevel@tonic-gate #define	WHITESPACE	0
6827c478bd9Sstevel@tonic-gate #define	USERNAME	1
6837c478bd9Sstevel@tonic-gate 
6847c478bd9Sstevel@tonic-gate int
pam_get_user(pam_handle_t * pamh,char ** user,const char * prompt_override)6857c478bd9Sstevel@tonic-gate pam_get_user(pam_handle_t *pamh, char **user, const char *prompt_override)
6867c478bd9Sstevel@tonic-gate {
6877c478bd9Sstevel@tonic-gate 	int	status;
6887c478bd9Sstevel@tonic-gate 	char	*prompt = NULL;
6897c478bd9Sstevel@tonic-gate 	char    *real_username;
6907c478bd9Sstevel@tonic-gate 	struct pam_response *ret_resp = NULL;
6917c478bd9Sstevel@tonic-gate 	char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
6927c478bd9Sstevel@tonic-gate 
6937c478bd9Sstevel@tonic-gate 	pam_trace(PAM_DEBUG_DEFAULT,
6947c478bd9Sstevel@tonic-gate 	    "pam_get_user(%p, %p, %s)", (void *)pamh, (void *)*user,
6957c478bd9Sstevel@tonic-gate 	    prompt_override ? prompt_override : "NULL");
6967c478bd9Sstevel@tonic-gate 	if (pamh == NULL)
6977c478bd9Sstevel@tonic-gate 		return (PAM_SYSTEM_ERR);
6987c478bd9Sstevel@tonic-gate 
6997c478bd9Sstevel@tonic-gate 	if ((status = pam_get_item(pamh, PAM_USER, (void **)user))
7007c478bd9Sstevel@tonic-gate 	    != PAM_SUCCESS) {
7017c478bd9Sstevel@tonic-gate 		return (status);
7027c478bd9Sstevel@tonic-gate 	}
7037c478bd9Sstevel@tonic-gate 
7047c478bd9Sstevel@tonic-gate 	/* if the user is set, return it */
7057c478bd9Sstevel@tonic-gate 
7067c478bd9Sstevel@tonic-gate 	if (*user != NULL && *user[0] != '\0') {
7077c478bd9Sstevel@tonic-gate 		return (PAM_SUCCESS);
7087c478bd9Sstevel@tonic-gate 	}
7097c478bd9Sstevel@tonic-gate 
7107c478bd9Sstevel@tonic-gate 	/*
7117c478bd9Sstevel@tonic-gate 	 * if the module is requesting a special prompt, use it.
7127c478bd9Sstevel@tonic-gate 	 * else use PAM_USER_PROMPT.
7137c478bd9Sstevel@tonic-gate 	 */
7147c478bd9Sstevel@tonic-gate 
7157c478bd9Sstevel@tonic-gate 	if (prompt_override != NULL) {
7167c478bd9Sstevel@tonic-gate 		prompt = (char *)prompt_override;
7177c478bd9Sstevel@tonic-gate 	} else {
7187c478bd9Sstevel@tonic-gate 		status = pam_get_item(pamh, PAM_USER_PROMPT, (void**)&prompt);
7197c478bd9Sstevel@tonic-gate 		if (status != PAM_SUCCESS) {
7207c478bd9Sstevel@tonic-gate 			return (status);
7217c478bd9Sstevel@tonic-gate 		}
7227c478bd9Sstevel@tonic-gate 	}
7237c478bd9Sstevel@tonic-gate 
7247c478bd9Sstevel@tonic-gate 	/* if the prompt is not set, use default */
7257c478bd9Sstevel@tonic-gate 
7267c478bd9Sstevel@tonic-gate 	if (prompt == NULL || prompt[0] == '\0') {
7277c478bd9Sstevel@tonic-gate 		prompt = dgettext(TEXT_DOMAIN, "Please enter user name: ");
7287c478bd9Sstevel@tonic-gate 	}
7297c478bd9Sstevel@tonic-gate 
7307c478bd9Sstevel@tonic-gate 	/* prompt for the user */
7317c478bd9Sstevel@tonic-gate 
7327c478bd9Sstevel@tonic-gate 	(void) strncpy(messages[0], prompt, sizeof (messages[0]));
7337c478bd9Sstevel@tonic-gate 
7347c478bd9Sstevel@tonic-gate 	for (;;) {
7357c478bd9Sstevel@tonic-gate 		int state = WHITESPACE;
7367c478bd9Sstevel@tonic-gate 
7377c478bd9Sstevel@tonic-gate 		status = do_conv(pamh, PAM_PROMPT_ECHO_ON, 1, messages,
7387c478bd9Sstevel@tonic-gate 		    NULL, &ret_resp);
7397c478bd9Sstevel@tonic-gate 
7407c478bd9Sstevel@tonic-gate 		if (status != PAM_SUCCESS) {
7417c478bd9Sstevel@tonic-gate 			return (status);
7427c478bd9Sstevel@tonic-gate 		}
7437c478bd9Sstevel@tonic-gate 
7447c478bd9Sstevel@tonic-gate 		if (ret_resp->resp && ret_resp->resp[0] != '\0') {
7457c478bd9Sstevel@tonic-gate 			int len = strlen(ret_resp->resp);
7467c478bd9Sstevel@tonic-gate 			int i;
7477c478bd9Sstevel@tonic-gate 
7487c478bd9Sstevel@tonic-gate 			for (i = 0; i < len; i++) {
7497c478bd9Sstevel@tonic-gate 				if ((ret_resp->resp[i] != ' ') &&
7501e08f0b8Sgww 				    (ret_resp->resp[i] != '\t')) {
7517c478bd9Sstevel@tonic-gate 					state = USERNAME;
7527c478bd9Sstevel@tonic-gate 					break;
7537c478bd9Sstevel@tonic-gate 				}
7547c478bd9Sstevel@tonic-gate 			}
7557c478bd9Sstevel@tonic-gate 
7567c478bd9Sstevel@tonic-gate 			if (state == USERNAME)
7577c478bd9Sstevel@tonic-gate 				break;
7587c478bd9Sstevel@tonic-gate 		}
7591e08f0b8Sgww 		/* essentially empty response, try again */
7601e08f0b8Sgww 		free_resp(1, ret_resp);
7611e08f0b8Sgww 		ret_resp = NULL;
7627c478bd9Sstevel@tonic-gate 	}
7637c478bd9Sstevel@tonic-gate 
7647c478bd9Sstevel@tonic-gate 	/* set PAM_USER */
7657c478bd9Sstevel@tonic-gate 	/* Parse the user input to get the user name. */
7667c478bd9Sstevel@tonic-gate 	status = parse_user_name(ret_resp->resp, &real_username);
7677c478bd9Sstevel@tonic-gate 
7687c478bd9Sstevel@tonic-gate 	if (status != PAM_SUCCESS) {
7697c478bd9Sstevel@tonic-gate 		if (real_username != NULL)
7707c478bd9Sstevel@tonic-gate 			free(real_username);
7717c478bd9Sstevel@tonic-gate 		free_resp(1, ret_resp);
7727c478bd9Sstevel@tonic-gate 		return (status);
7737c478bd9Sstevel@tonic-gate 	}
7747c478bd9Sstevel@tonic-gate 
7757c478bd9Sstevel@tonic-gate 	status = pam_set_item(pamh, PAM_USER, real_username);
7767c478bd9Sstevel@tonic-gate 
7777c478bd9Sstevel@tonic-gate 	free(real_username);
7787c478bd9Sstevel@tonic-gate 
7797c478bd9Sstevel@tonic-gate 	free_resp(1, ret_resp);
7807c478bd9Sstevel@tonic-gate 	if (status != PAM_SUCCESS) {
7817c478bd9Sstevel@tonic-gate 		return (status);
7827c478bd9Sstevel@tonic-gate 	}
7837c478bd9Sstevel@tonic-gate 
7847c478bd9Sstevel@tonic-gate 	/*
7857c478bd9Sstevel@tonic-gate 	 * finally, get PAM_USER. We have to call pam_get_item to get
7867c478bd9Sstevel@tonic-gate 	 * the value of user because pam_set_item mallocs the memory.
7877c478bd9Sstevel@tonic-gate 	 */
7887c478bd9Sstevel@tonic-gate 
7897c478bd9Sstevel@tonic-gate 	status = pam_get_item(pamh, PAM_USER, (void**)user);
7907c478bd9Sstevel@tonic-gate 	return (status);
7917c478bd9Sstevel@tonic-gate }
7927c478bd9Sstevel@tonic-gate 
7937c478bd9Sstevel@tonic-gate /*
7947c478bd9Sstevel@tonic-gate  * Set module specific data
7957c478bd9Sstevel@tonic-gate  */
7967c478bd9Sstevel@tonic-gate 
7977c478bd9Sstevel@tonic-gate int
pam_set_data(pam_handle_t * pamh,const char * module_data_name,void * data,void (* cleanup)(pam_handle_t * pamh,void * data,int pam_end_status))7987c478bd9Sstevel@tonic-gate pam_set_data(pam_handle_t *pamh, const char *module_data_name, void *data,
7997c478bd9Sstevel@tonic-gate     void (*cleanup)(pam_handle_t *pamh, void *data, int pam_end_status))
8007c478bd9Sstevel@tonic-gate {
8017c478bd9Sstevel@tonic-gate 	struct pam_module_data *psd;
8027c478bd9Sstevel@tonic-gate 
8037c478bd9Sstevel@tonic-gate 	pam_trace(PAM_DEBUG_DATA,
8047c478bd9Sstevel@tonic-gate 	    "pam_set_data(%p:%s:%d)=%p", (void *)pamh,
805edd669a7SJohn Levon 	    (module_data_name != NULL) ? module_data_name : "NULL",
806edd669a7SJohn Levon 	    (pamh != NULL) ? pamh->pam_inmodule : -1, data);
8077c478bd9Sstevel@tonic-gate 	if (pamh == NULL || (pamh->pam_inmodule != WO_OK) ||
8087c478bd9Sstevel@tonic-gate 	    module_data_name == NULL) {
8097c478bd9Sstevel@tonic-gate 		return (PAM_SYSTEM_ERR);
8107c478bd9Sstevel@tonic-gate 	}
8117c478bd9Sstevel@tonic-gate 
8127c478bd9Sstevel@tonic-gate 	/* check if module data already exists */
8137c478bd9Sstevel@tonic-gate 
8147c478bd9Sstevel@tonic-gate 	for (psd = pamh->ssd; psd; psd = psd->next) {
8157c478bd9Sstevel@tonic-gate 		if (strcmp(psd->module_data_name, module_data_name) == 0) {
8167c478bd9Sstevel@tonic-gate 			/* clean up original data before setting the new data */
8177c478bd9Sstevel@tonic-gate 			if (psd->cleanup) {
8187c478bd9Sstevel@tonic-gate 				psd->cleanup(pamh, psd->data, PAM_SUCCESS);
8197c478bd9Sstevel@tonic-gate 			}
8207c478bd9Sstevel@tonic-gate 			psd->data = (void *)data;
8217c478bd9Sstevel@tonic-gate 			psd->cleanup = cleanup;
8227c478bd9Sstevel@tonic-gate 			return (PAM_SUCCESS);
8237c478bd9Sstevel@tonic-gate 		}
8247c478bd9Sstevel@tonic-gate 	}
8257c478bd9Sstevel@tonic-gate 
8267c478bd9Sstevel@tonic-gate 	psd = malloc(sizeof (struct pam_module_data));
8277c478bd9Sstevel@tonic-gate 	if (psd == NULL)
8287c478bd9Sstevel@tonic-gate 		return (PAM_BUF_ERR);
8297c478bd9Sstevel@tonic-gate 
8307c478bd9Sstevel@tonic-gate 	psd->module_data_name = strdup(module_data_name);
8317c478bd9Sstevel@tonic-gate 	if (psd->module_data_name == NULL) {
8327c478bd9Sstevel@tonic-gate 		free(psd);
8337c478bd9Sstevel@tonic-gate 		return (PAM_BUF_ERR);
8347c478bd9Sstevel@tonic-gate 	}
8357c478bd9Sstevel@tonic-gate 
8367c478bd9Sstevel@tonic-gate 	psd->data = (void *)data;
8377c478bd9Sstevel@tonic-gate 	psd->cleanup = cleanup;
8387c478bd9Sstevel@tonic-gate 	psd->next = pamh->ssd;
8397c478bd9Sstevel@tonic-gate 	pamh->ssd = psd;
8407c478bd9Sstevel@tonic-gate 	return (PAM_SUCCESS);
8417c478bd9Sstevel@tonic-gate }
8427c478bd9Sstevel@tonic-gate 
8437c478bd9Sstevel@tonic-gate /*
8447c478bd9Sstevel@tonic-gate  * get module specific data
8457c478bd9Sstevel@tonic-gate  */
8467c478bd9Sstevel@tonic-gate 
8477c478bd9Sstevel@tonic-gate int
pam_get_data(const pam_handle_t * pamh,const char * module_data_name,const void ** data)8487c478bd9Sstevel@tonic-gate pam_get_data(const pam_handle_t *pamh, const char *module_data_name,
8497c478bd9Sstevel@tonic-gate     const void **data)
8507c478bd9Sstevel@tonic-gate {
8517c478bd9Sstevel@tonic-gate 	struct pam_module_data *psd;
8527c478bd9Sstevel@tonic-gate 
8537c478bd9Sstevel@tonic-gate 	if (pamh == NULL || (pamh->pam_inmodule != WO_OK) ||
8547c478bd9Sstevel@tonic-gate 	    module_data_name == NULL) {
8557c478bd9Sstevel@tonic-gate 		pam_trace(PAM_DEBUG_DATA,
8567c478bd9Sstevel@tonic-gate 		    "pam_get_data(%p:%s:%d)=%p", (void *)pamh,
8577c478bd9Sstevel@tonic-gate 		    module_data_name ? module_data_name : "NULL",
8587c478bd9Sstevel@tonic-gate 		    pamh->pam_inmodule, *data);
8597c478bd9Sstevel@tonic-gate 		return (PAM_SYSTEM_ERR);
8607c478bd9Sstevel@tonic-gate 	}
8617c478bd9Sstevel@tonic-gate 
8627c478bd9Sstevel@tonic-gate 	for (psd = pamh->ssd; psd; psd = psd->next) {
8637c478bd9Sstevel@tonic-gate 		if (strcmp(psd->module_data_name, module_data_name) == 0) {
8647c478bd9Sstevel@tonic-gate 			*data = psd->data;
8657c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_DATA,
8667c478bd9Sstevel@tonic-gate 			    "pam_get_data(%p:%s)=%p", (void *)pamh,
8677c478bd9Sstevel@tonic-gate 			    module_data_name, *data);
8687c478bd9Sstevel@tonic-gate 			return (PAM_SUCCESS);
8697c478bd9Sstevel@tonic-gate 		}
8707c478bd9Sstevel@tonic-gate 	}
8717c478bd9Sstevel@tonic-gate 	pam_trace(PAM_DEBUG_DATA,
8727c478bd9Sstevel@tonic-gate 	    "pam_get_data(%p:%s)=%s", (void *)pamh, module_data_name,
8737c478bd9Sstevel@tonic-gate 	    "PAM_NO_MODULE_DATA");
8747c478bd9Sstevel@tonic-gate 
8757c478bd9Sstevel@tonic-gate 	return (PAM_NO_MODULE_DATA);
8767c478bd9Sstevel@tonic-gate }
8777c478bd9Sstevel@tonic-gate 
8787c478bd9Sstevel@tonic-gate /*
8797c478bd9Sstevel@tonic-gate  * PAM equivalent to strerror()
8807c478bd9Sstevel@tonic-gate  */
8817c478bd9Sstevel@tonic-gate /* ARGSUSED */
8827c478bd9Sstevel@tonic-gate const char *
pam_strerror(pam_handle_t * pamh,int errnum)8837c478bd9Sstevel@tonic-gate pam_strerror(pam_handle_t *pamh, int errnum)
8847c478bd9Sstevel@tonic-gate {
8857c478bd9Sstevel@tonic-gate 	switch (errnum) {
8867c478bd9Sstevel@tonic-gate 	case PAM_SUCCESS:
8877c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Success"));
8887c478bd9Sstevel@tonic-gate 	case PAM_OPEN_ERR:
8897c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Dlopen failure"));
8907c478bd9Sstevel@tonic-gate 	case PAM_SYMBOL_ERR:
8917c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Symbol not found"));
8927c478bd9Sstevel@tonic-gate 	case PAM_SERVICE_ERR:
8937c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
8947c478bd9Sstevel@tonic-gate 		    "Error in underlying service module"));
8957c478bd9Sstevel@tonic-gate 	case PAM_SYSTEM_ERR:
8967c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "System error"));
8977c478bd9Sstevel@tonic-gate 	case PAM_BUF_ERR:
8987c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Memory buffer error"));
8997c478bd9Sstevel@tonic-gate 	case PAM_CONV_ERR:
9007c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Conversation failure"));
9017c478bd9Sstevel@tonic-gate 	case PAM_PERM_DENIED:
9027c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Permission denied"));
9037c478bd9Sstevel@tonic-gate 	case PAM_MAXTRIES:
9047c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9057c478bd9Sstevel@tonic-gate 		    "Maximum number of attempts exceeded"));
9067c478bd9Sstevel@tonic-gate 	case PAM_AUTH_ERR:
9077c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Authentication failed"));
9087c478bd9Sstevel@tonic-gate 	case PAM_NEW_AUTHTOK_REQD:
9097c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Get new authentication token"));
9107c478bd9Sstevel@tonic-gate 	case PAM_CRED_INSUFFICIENT:
9117c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Insufficient credentials"));
9127c478bd9Sstevel@tonic-gate 	case PAM_AUTHINFO_UNAVAIL:
9137c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9147c478bd9Sstevel@tonic-gate 		    "Can not retrieve authentication info"));
9157c478bd9Sstevel@tonic-gate 	case PAM_USER_UNKNOWN:
9167c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "No account present for user"));
9177c478bd9Sstevel@tonic-gate 	case PAM_CRED_UNAVAIL:
9187c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9197c478bd9Sstevel@tonic-gate 		    "Can not retrieve user credentials"));
9207c478bd9Sstevel@tonic-gate 	case PAM_CRED_EXPIRED:
9217c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9227c478bd9Sstevel@tonic-gate 		    "User credentials have expired"));
9237c478bd9Sstevel@tonic-gate 	case PAM_CRED_ERR:
9247c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9257c478bd9Sstevel@tonic-gate 		    "Failure setting user credentials"));
9267c478bd9Sstevel@tonic-gate 	case PAM_ACCT_EXPIRED:
9277c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "User account has expired"));
9287c478bd9Sstevel@tonic-gate 	case PAM_AUTHTOK_EXPIRED:
9297c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "User password has expired"));
9307c478bd9Sstevel@tonic-gate 	case PAM_SESSION_ERR:
9317c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9327c478bd9Sstevel@tonic-gate 		    "Can not make/remove entry for session"));
9337c478bd9Sstevel@tonic-gate 	case PAM_AUTHTOK_ERR:
9347c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9357c478bd9Sstevel@tonic-gate 		    "Authentication token manipulation error"));
9367c478bd9Sstevel@tonic-gate 	case PAM_AUTHTOK_RECOVERY_ERR:
9377c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9387c478bd9Sstevel@tonic-gate 		    "Authentication token can not be recovered"));
9397c478bd9Sstevel@tonic-gate 	case PAM_AUTHTOK_LOCK_BUSY:
9407c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9417c478bd9Sstevel@tonic-gate 		    "Authentication token lock busy"));
9427c478bd9Sstevel@tonic-gate 	case PAM_AUTHTOK_DISABLE_AGING:
9437c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9447c478bd9Sstevel@tonic-gate 		    "Authentication token aging disabled"));
9457c478bd9Sstevel@tonic-gate 	case PAM_NO_MODULE_DATA:
9467c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9477c478bd9Sstevel@tonic-gate 		    "Module specific data not found"));
9487c478bd9Sstevel@tonic-gate 	case PAM_IGNORE:
9497c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Ignore module"));
9507c478bd9Sstevel@tonic-gate 	case PAM_ABORT:
9517c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "General PAM failure "));
9527c478bd9Sstevel@tonic-gate 	case PAM_TRY_AGAIN:
9537c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN,
9547c478bd9Sstevel@tonic-gate 		    "Unable to complete operation. Try again"));
9557c478bd9Sstevel@tonic-gate 	default:
9567c478bd9Sstevel@tonic-gate 		return (dgettext(TEXT_DOMAIN, "Unknown error"));
9577c478bd9Sstevel@tonic-gate 	}
9587c478bd9Sstevel@tonic-gate }
9597c478bd9Sstevel@tonic-gate 
9607c478bd9Sstevel@tonic-gate static void *
sm_name(int ind)9617c478bd9Sstevel@tonic-gate sm_name(int ind)
9627c478bd9Sstevel@tonic-gate {
9637c478bd9Sstevel@tonic-gate 	switch (ind) {
9647c478bd9Sstevel@tonic-gate 	case PAM_AUTHENTICATE:
9657c478bd9Sstevel@tonic-gate 		return (PAM_SM_AUTHENTICATE);
9667c478bd9Sstevel@tonic-gate 	case PAM_SETCRED:
9677c478bd9Sstevel@tonic-gate 		return (PAM_SM_SETCRED);
9687c478bd9Sstevel@tonic-gate 	case PAM_ACCT_MGMT:
9697c478bd9Sstevel@tonic-gate 		return (PAM_SM_ACCT_MGMT);
9707c478bd9Sstevel@tonic-gate 	case PAM_OPEN_SESSION:
9717c478bd9Sstevel@tonic-gate 		return (PAM_SM_OPEN_SESSION);
9727c478bd9Sstevel@tonic-gate 	case PAM_CLOSE_SESSION:
9737c478bd9Sstevel@tonic-gate 		return (PAM_SM_CLOSE_SESSION);
9747c478bd9Sstevel@tonic-gate 	case PAM_CHAUTHTOK:
9757c478bd9Sstevel@tonic-gate 		return (PAM_SM_CHAUTHTOK);
9767c478bd9Sstevel@tonic-gate 	}
9777c478bd9Sstevel@tonic-gate 	return (NULL);
9787c478bd9Sstevel@tonic-gate }
9797c478bd9Sstevel@tonic-gate 
9807c478bd9Sstevel@tonic-gate static int
func(pamtab_t * modulep,int ind)9817c478bd9Sstevel@tonic-gate (*func(pamtab_t *modulep, int ind))()
9827c478bd9Sstevel@tonic-gate {
9837c478bd9Sstevel@tonic-gate 	void	*funcp;
9847c478bd9Sstevel@tonic-gate 
9857c478bd9Sstevel@tonic-gate 	if ((funcp = modulep->function_ptr) == NULL)
9867c478bd9Sstevel@tonic-gate 		return (NULL);
9877c478bd9Sstevel@tonic-gate 
9887c478bd9Sstevel@tonic-gate 	switch (ind) {
9897c478bd9Sstevel@tonic-gate 	case PAM_AUTHENTICATE:
9907c478bd9Sstevel@tonic-gate 		return (((struct auth_module *)funcp)->pam_sm_authenticate);
9917c478bd9Sstevel@tonic-gate 	case PAM_SETCRED:
9927c478bd9Sstevel@tonic-gate 		return (((struct auth_module *)funcp)->pam_sm_setcred);
9937c478bd9Sstevel@tonic-gate 	case PAM_ACCT_MGMT:
9947c478bd9Sstevel@tonic-gate 		return (((struct account_module *)funcp)->pam_sm_acct_mgmt);
9957c478bd9Sstevel@tonic-gate 	case PAM_OPEN_SESSION:
9967c478bd9Sstevel@tonic-gate 		return (((struct session_module *)funcp)->pam_sm_open_session);
9977c478bd9Sstevel@tonic-gate 	case PAM_CLOSE_SESSION:
9987c478bd9Sstevel@tonic-gate 		return (((struct session_module *)funcp)->pam_sm_close_session);
9997c478bd9Sstevel@tonic-gate 	case PAM_CHAUTHTOK:
10007c478bd9Sstevel@tonic-gate 		return (((struct password_module *)funcp)->pam_sm_chauthtok);
10017c478bd9Sstevel@tonic-gate 	}
10027c478bd9Sstevel@tonic-gate 	return (NULL);
10037c478bd9Sstevel@tonic-gate }
10047c478bd9Sstevel@tonic-gate 
10057c478bd9Sstevel@tonic-gate /*
10067c478bd9Sstevel@tonic-gate  * Run through the PAM service module stack for the given module type.
10077c478bd9Sstevel@tonic-gate  */
10087c478bd9Sstevel@tonic-gate static int
run_stack(pam_handle_t * pamh,int flags,int type,int def_err,int ind,char * function_name)10097c478bd9Sstevel@tonic-gate run_stack(pam_handle_t *pamh, int flags, int type, int def_err, int ind,
10107c478bd9Sstevel@tonic-gate     char *function_name)
10117c478bd9Sstevel@tonic-gate {
10127c478bd9Sstevel@tonic-gate 	int	err = PAM_SYSTEM_ERR;  /* preset */
10137c478bd9Sstevel@tonic-gate 	int	optional_error = 0;
10147c478bd9Sstevel@tonic-gate 	int	required_error = 0;
10157c478bd9Sstevel@tonic-gate 	int	success = 0;
10167c478bd9Sstevel@tonic-gate 	pamtab_t *modulep;
10177c478bd9Sstevel@tonic-gate 	int	(*sm_func)();
10187c478bd9Sstevel@tonic-gate 
10197c478bd9Sstevel@tonic-gate 	if (pamh == NULL)
10207c478bd9Sstevel@tonic-gate 		return (PAM_SYSTEM_ERR);
10217c478bd9Sstevel@tonic-gate 
10227c478bd9Sstevel@tonic-gate 	/* read initial entries from pam.conf */
10237c478bd9Sstevel@tonic-gate 	if ((err = read_pam_conf(pamh, PAM_CONFIG)) != PAM_SUCCESS) {
10247c478bd9Sstevel@tonic-gate 		return (err);
10257c478bd9Sstevel@tonic-gate 	}
10267c478bd9Sstevel@tonic-gate 
10277c478bd9Sstevel@tonic-gate 	if ((modulep =
10287c478bd9Sstevel@tonic-gate 	    pamh->pam_conf_info[pamh->include_depth][type]) == NULL) {
10297c478bd9Sstevel@tonic-gate 		__pam_log(LOG_AUTH | LOG_ERR, "%s no initial module present",
10307c478bd9Sstevel@tonic-gate 		    pam_trace_cname(pamh));
10317c478bd9Sstevel@tonic-gate 		goto exit_return;
10327c478bd9Sstevel@tonic-gate 	}
10337c478bd9Sstevel@tonic-gate 
10347c478bd9Sstevel@tonic-gate 	pamh->pam_inmodule = WO_OK;	/* OK to get AUTHTOK */
10357c478bd9Sstevel@tonic-gate include:
10367c478bd9Sstevel@tonic-gate 	pam_trace(PAM_DEBUG_MODULE,
10377c478bd9Sstevel@tonic-gate 	    "[%d:%s]:run_stack:%s(%p, %x): %s", pamh->include_depth,
10387c478bd9Sstevel@tonic-gate 	    pam_trace_cname(pamh), function_name, (void *)pamh, flags,
10397c478bd9Sstevel@tonic-gate 	    modulep ? modulep->module_path : "NULL");
10407c478bd9Sstevel@tonic-gate 
10417c478bd9Sstevel@tonic-gate 	while (modulep != NULL) {
10427c478bd9Sstevel@tonic-gate 		if (modulep->pam_flag & PAM_INCLUDE) {
10437c478bd9Sstevel@tonic-gate 			/* save the return location */
10447c478bd9Sstevel@tonic-gate 			pamh->pam_conf_modulep[pamh->include_depth] =
10457c478bd9Sstevel@tonic-gate 			    modulep->next;
10467c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_MODULE,
10477c478bd9Sstevel@tonic-gate 			    "setting for include[%d:%p]",
10487c478bd9Sstevel@tonic-gate 			    pamh->include_depth, (void *)modulep->next);
10497c478bd9Sstevel@tonic-gate 			if (pamh->include_depth++ >= PAM_MAX_INCLUDE) {
10507c478bd9Sstevel@tonic-gate 				__pam_log(LOG_AUTH | LOG_ERR,
10517c478bd9Sstevel@tonic-gate 				    "run_stack: includes too deep %d "
10527c478bd9Sstevel@tonic-gate 				    "found trying to include %s from %s, %d "
10537c478bd9Sstevel@tonic-gate 				    "allowed", pamh->include_depth,
10547c478bd9Sstevel@tonic-gate 				    modulep->module_path, pamh->pam_conf_name
10557c478bd9Sstevel@tonic-gate 				    [PAM_MAX_INCLUDE] == NULL ? "NULL" :
10567c478bd9Sstevel@tonic-gate 				    pamh->pam_conf_name[PAM_MAX_INCLUDE],
10577c478bd9Sstevel@tonic-gate 				    PAM_MAX_INCLUDE);
10587c478bd9Sstevel@tonic-gate 				goto exit_return;
10597c478bd9Sstevel@tonic-gate 			}
10607c478bd9Sstevel@tonic-gate 			if ((err = read_pam_conf(pamh,
10617c478bd9Sstevel@tonic-gate 			    modulep->module_path)) != PAM_SUCCESS) {
10627c478bd9Sstevel@tonic-gate 				__pam_log(LOG_AUTH | LOG_ERR,
10637c478bd9Sstevel@tonic-gate 				    "run_stack[%d:%s]: can't read included "
10647c478bd9Sstevel@tonic-gate 				    "conf %s", pamh->include_depth,
10657c478bd9Sstevel@tonic-gate 				    pam_trace_cname(pamh),
10667c478bd9Sstevel@tonic-gate 				    modulep->module_path);
10677c478bd9Sstevel@tonic-gate 				goto exit_return;
10687c478bd9Sstevel@tonic-gate 			}
10697c478bd9Sstevel@tonic-gate 			if ((modulep = pamh->pam_conf_info
10707c478bd9Sstevel@tonic-gate 			    [pamh->include_depth][type]) == NULL) {
10717c478bd9Sstevel@tonic-gate 				__pam_log(LOG_AUTH | LOG_ERR,
10727c478bd9Sstevel@tonic-gate 				    "run_stack[%d:%s]: no include module "
10737c478bd9Sstevel@tonic-gate 				    "present %s", pamh->include_depth,
10747c478bd9Sstevel@tonic-gate 				    pam_trace_cname(pamh), function_name);
10757c478bd9Sstevel@tonic-gate 				goto exit_return;
10767c478bd9Sstevel@tonic-gate 			}
10777c478bd9Sstevel@tonic-gate 			if (modulep->pam_flag & PAM_INCLUDE) {
10787c478bd9Sstevel@tonic-gate 				/* first line another include */
10797c478bd9Sstevel@tonic-gate 				goto include;
10807c478bd9Sstevel@tonic-gate 			}
10817c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_DEFAULT, "include[%d:%s]"
10827c478bd9Sstevel@tonic-gate 			    "(%p, %s)=%s", pamh->include_depth,
10837c478bd9Sstevel@tonic-gate 			    pam_trace_cname(pamh), (void *)pamh,
10847c478bd9Sstevel@tonic-gate 			    function_name, modulep->module_path);
10857c478bd9Sstevel@tonic-gate 			if ((err = load_modules(pamh, type, sm_name(ind),
10867c478bd9Sstevel@tonic-gate 			    pamh->pam_conf_info
10877c478bd9Sstevel@tonic-gate 			    [pamh->include_depth][type])) != PAM_SUCCESS) {
10887c478bd9Sstevel@tonic-gate 				pam_trace(PAM_DEBUG_DEFAULT,
10897c478bd9Sstevel@tonic-gate 				    "[%d:%s]:%s(%p, %x): load_modules failed",
10907c478bd9Sstevel@tonic-gate 				    pamh->include_depth, pam_trace_cname(pamh),
10917c478bd9Sstevel@tonic-gate 				    function_name, (void *)pamh, flags);
10927c478bd9Sstevel@tonic-gate 				goto exit_return;
10937c478bd9Sstevel@tonic-gate 			}
10947c478bd9Sstevel@tonic-gate 			if ((modulep = pamh->pam_conf_info
10957c478bd9Sstevel@tonic-gate 			    [pamh->include_depth][type]) == NULL) {
10967c478bd9Sstevel@tonic-gate 				__pam_log(LOG_AUTH | LOG_ERR,
10977c478bd9Sstevel@tonic-gate 				    "%s no initial module present",
10987c478bd9Sstevel@tonic-gate 				    pam_trace_cname(pamh));
10997c478bd9Sstevel@tonic-gate 				goto exit_return;
11007c478bd9Sstevel@tonic-gate 			}
11017c478bd9Sstevel@tonic-gate 		} else if ((err = load_modules(pamh, type, sm_name(ind),
11027c478bd9Sstevel@tonic-gate 		    modulep)) != PAM_SUCCESS) {
11037c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_DEFAULT,
11047c478bd9Sstevel@tonic-gate 			    "[%d:%s]:%s(%p, %x): load_modules failed",
11057c478bd9Sstevel@tonic-gate 			    pamh->include_depth, pam_trace_cname(pamh),
11067c478bd9Sstevel@tonic-gate 			    function_name, (void *)pamh, flags);
11077c478bd9Sstevel@tonic-gate 			goto exit_return;
11087c478bd9Sstevel@tonic-gate 		}  /* PAM_INCLUDE */
11097c478bd9Sstevel@tonic-gate 		sm_func = func(modulep, ind);
11107c478bd9Sstevel@tonic-gate 		if (sm_func) {
11117c478bd9Sstevel@tonic-gate 			err = sm_func(pamh, flags, modulep->module_argc,
11127c478bd9Sstevel@tonic-gate 			    (const char **)modulep->module_argv);
11137c478bd9Sstevel@tonic-gate 
11147c478bd9Sstevel@tonic-gate 			pam_trace(PAM_DEBUG_MODULE,
11157c478bd9Sstevel@tonic-gate 			    "[%d:%s]:%s(%p, %x): %s returned %s",
11167c478bd9Sstevel@tonic-gate 			    pamh->include_depth, pam_trace_cname(pamh),
11177c478bd9Sstevel@tonic-gate 			    function_name, (void *)pamh, flags,
11187c478bd9Sstevel@tonic-gate 			    modulep->module_path, pam_strerror(pamh, err));
11197c478bd9Sstevel@tonic-gate 
11207c478bd9Sstevel@tonic-gate 			switch (err) {
11217c478bd9Sstevel@tonic-gate 			case PAM_IGNORE:
11227c478bd9Sstevel@tonic-gate 				/* do nothing */
11237c478bd9Sstevel@tonic-gate 				break;
11247c478bd9Sstevel@tonic-gate 			case PAM_SUCCESS:
11257c478bd9Sstevel@tonic-gate 				if ((modulep->pam_flag & PAM_SUFFI_BIND) &&
11267c478bd9Sstevel@tonic-gate 				    !required_error) {
11277c478bd9Sstevel@tonic-gate 					pamh->pam_inmodule = RW_OK;
11287c478bd9Sstevel@tonic-gate 					pam_trace(PAM_DEBUG_MODULE,
11297c478bd9Sstevel@tonic-gate 					    "[%d:%s]:%s(%p, %x): %s: success",
11307c478bd9Sstevel@tonic-gate 					    pamh->include_depth,
11317c478bd9Sstevel@tonic-gate 					    pam_trace_cname(pamh),
11327c478bd9Sstevel@tonic-gate 					    function_name, (void *)pamh, flags,
11337c478bd9Sstevel@tonic-gate 					    (modulep->pam_flag & PAM_BINDING) ?
11347c478bd9Sstevel@tonic-gate 					    PAM_BINDING_NAME :
11357c478bd9Sstevel@tonic-gate 					    PAM_SUFFICIENT_NAME);
11367c478bd9Sstevel@tonic-gate 					goto exit_return;
11377c478bd9Sstevel@tonic-gate 				}
11387c478bd9Sstevel@tonic-gate 				success = 1;
11397c478bd9Sstevel@tonic-gate 				break;
11407c478bd9Sstevel@tonic-gate 			case PAM_TRY_AGAIN:
11417c478bd9Sstevel@tonic-gate 				/*
11427c478bd9Sstevel@tonic-gate 				 * We need to return immediately, and
11437c478bd9Sstevel@tonic-gate 				 * we shouldn't reset the AUTHTOK item
11447c478bd9Sstevel@tonic-gate 				 * since it is not an error per-se.
11457c478bd9Sstevel@tonic-gate 				 */
11467c478bd9Sstevel@tonic-gate 				pamh->pam_inmodule = RW_OK;
11477c478bd9Sstevel@tonic-gate 				pam_trace(PAM_DEBUG_MODULE,
11487c478bd9Sstevel@tonic-gate 				    "[%d:%s]:%s(%p, %x): TRY_AGAIN: %s",
11497c478bd9Sstevel@tonic-gate 				    pamh->include_depth, pam_trace_cname(pamh),
11507c478bd9Sstevel@tonic-gate 				    function_name, (void *)pamh, flags,
11517c478bd9Sstevel@tonic-gate 				    pam_strerror(pamh, required_error ?
11527c478bd9Sstevel@tonic-gate 				    required_error : err));
11537c478bd9Sstevel@tonic-gate 				err = required_error ? required_error : err;
11547c478bd9Sstevel@tonic-gate 				goto exit_return;
11557c478bd9Sstevel@tonic-gate 			default:
11567c478bd9Sstevel@tonic-gate 				if (modulep->pam_flag & PAM_REQUISITE) {
11577c478bd9Sstevel@tonic-gate 					pamh->pam_inmodule = RW_OK;
11587c478bd9Sstevel@tonic-gate 					pam_trace(PAM_DEBUG_MODULE,
11597c478bd9Sstevel@tonic-gate 					    "[%d:%s]:%s(%p, %x): requisite: %s",
11607c478bd9Sstevel@tonic-gate 					    pamh->include_depth,
11617c478bd9Sstevel@tonic-gate 					    pam_trace_cname(pamh),
11627c478bd9Sstevel@tonic-gate 					    function_name, (void *)pamh, flags,
11637c478bd9Sstevel@tonic-gate 					    pam_strerror(pamh,
11647c478bd9Sstevel@tonic-gate 					    required_error ? required_error :
11657c478bd9Sstevel@tonic-gate 					    err));
11667c478bd9Sstevel@tonic-gate 					err = required_error ?
11677c478bd9Sstevel@tonic-gate 					    required_error : err;
11687c478bd9Sstevel@tonic-gate 					goto exit_return;
11697c478bd9Sstevel@tonic-gate 				} else if (modulep->pam_flag & PAM_REQRD_BIND) {
11707c478bd9Sstevel@tonic-gate 					if (!required_error)
11717c478bd9Sstevel@tonic-gate 						required_error = err;
11727c478bd9Sstevel@tonic-gate 				} else {
11737c478bd9Sstevel@tonic-gate 					if (!optional_error)
1174