Implement authentication on control socket.

* Makefile.am (SUBDIRS): Add src.
* configure.ac: Check for crypt.h and PAM
Build ident/Makefile
* grecs: Update.

* ident/Makefile.am: New file.
* ident/ident.c: New file.
* ident/ident.h: New file.
* ident/identity.h: New file.
* ident/pam.c: New file.
* ident/provider.c: New file.
* ident/system.c: New file.

* lib/Makefile.am: Add arraymember.c
* lib/arraymember.c: New file.
* lib/libpies.h (is_array_member): New proto.

* src/Makefile.am (LDADD): Add libident.a and @PAM_LIBS@
* src/acl.c (acl_entry): Remove groups. Add new members:
names and name_match.
(pies_acl_create): Deep copy the locus.
Set free_entry function for the list.
(pies_acl_free): Free locus.
(_parse_from): Set free_entry function for the list.
(_parse_group): Parse the "user" construct.
(parse_acl_line): Deep copy the locus.
Allow for null value.
(acl_keywords): Update docstrings.
(_acl_check): Rewrite identity checks.
* src/acl.h (acl_input)<user,groups>: Remove.
<identity>: New member.
(pies_acl_free): New proto.
* src/ctl.c (identity): New global.
(cmdtab): New command: auth
(ctlio) <addr,addrlen>: New members.
(ctlio_create): Start from authenticated state
only if no identity_providers are configured.
(cmd_auth): New function.
(cmd_help): Print only commands that are available
in the current state.
(ctl_accept): Initialize io->addr and io->addrlen.
* src/inetd-bi.c: Change call to check_acl
* src/pies.c: Include identity.h
(control_keywords): New statement "identity-acl"
(pies_keywords): New statement "identity-provider"
(config_init): Register identity mechanisms.
(config_parse): New function.
(config_help): Print help on identity-provider
statements.
(main): Use config_parse to parse grecs-style configurations.
* src/pies.h: Include identity.h
(check_acl): Change argument list.  All callers changed.
(control): Remove acl. Add conn_acl and id_acl instead.
* src/progman.c (check_acl): Change argument list.  Take
identity as the 3rd argument.

1 files changed, 137 insertions, 0 deletions

diff --git a/ident/system.c b/ident/system.c
new file mode 100644
index 0000000..bde667c
--- /dev/null
+++ b/ident/system.c
@@ -0,0 +1,137 @@
+/* This file is part of GNU Pies.
+   Copyright (C) 2015 Sergey Poznyakoff
+
+   GNU Pies is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3, or (at your option)
+   any later version.
+
+   GNU Pies is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with GNU Pies.  If not, see <http://www.gnu.org/licenses/>. */
+
+#include "ident.h"
+#include <sys/types.h>
+#include <pwd.h>
+#include <grp.h>
+#include <unistd.h>
+#include <string.h>
+#include <time.h>
+#if defined(HAVE_CRYPT_H)
+# include <crypt.h>
+#endif
+#if defined(HAVE_SHADOW_H)
+# include <shadow.h>
+#endif
+
+struct system_identity_data
+{
+  gid_t gid;
+};
+
+static int
+system_authenticate (pies_identity_provider_t pr, pies_identity_t id,
+		     char const *passwd)
+{
+  struct passwd *pwd;
+  char *encrypted_pass = NULL;
+  
+  pwd = getpwnam (id->username);
+  if (!pwd)
+    return -1;
+
+  encrypted_pass = pwd->pw_passwd;
+  
+#if defined(HAVE_SHADOW_H)
+  {
+    struct spwd *sp;
+    if ((sp = getspnam (id->username)) != NULL)
+      {
+	if (sp->sp_expire > 0 && time (NULL) > sp->sp_expire * 86400)
+	  return -1;
+	encrypted_pass = sp->sp_pwdp;
+      }
+  }
+#endif
+
+  if (strcmp (crypt (passwd, encrypted_pass), encrypted_pass) == 0)
+    {
+      struct system_identity_data *data = xmalloc (sizeof (*data));
+      data->gid = pwd->pw_gid;
+      id->data = data;
+      return 0;
+    }
+  return -1;
+}
+
+static int
+system_is_group_member (pies_identity_provider_t provider,
+			pies_identity_t id, char * const * groups)
+{
+  struct system_identity_data *data = id->data;
+  struct group *gr;
+  int result = 0;
+  
+  setgrent ();
+  while ((gr = getgrent ()))
+    {
+      char **p;
+
+      if (!is_array_member (groups, gr->gr_name))
+	continue;
+      
+      if (gr->gr_gid == data->gid)
+	{
+	  result = 1;
+	  break;
+	}
+      
+      for (p = gr->gr_mem; *p; p++)
+	if (strcmp (*p, id->username) == 0)
+	  {
+	    result = 1;
+	    break;
+	  }
+    }
+  endgrent ();
+  return result;
+}
+
+static void
+system_destroy_identity (pies_identity_provider_t p, pies_identity_t id)
+{
+  if (id->data)
+    free (id->data);
+}
+
+static void
+confhelp (void)
+{
+  static struct grecs_keyword kw[] = {
+    { "type", "'system", "Set mechanism type", grecs_type_null },
+    { NULL }
+  };
+
+  static struct grecs_keyword top[] = {
+    { "identity-provider", "name: string",
+      "Configuration for system identity provider",
+      grecs_type_section, GRECS_INAC, NULL, 0, NULL, NULL,
+      kw },
+    { NULL }
+  };
+  grecs_print_statement_array (top, 1, 0, stdout);
+}
+
+struct pies_identity_mechanism system_identity_mechanism = {
+  "system",
+  system_authenticate,  
+  system_is_group_member,
+  system_destroy_identity,
+  NULL,
+  confhelp
+};
+