1 files changed, 63 insertions, 5 deletions

diff --git a/src/ctl.c b/src/ctl.c
index f9f2d76..20c16e1 100644
--- a/src/ctl.c
+++ b/src/ctl.c
@@ -19,2 +19,3 @@
 #include "xvasprintf.h"
+#include "identity.h"
 
@@ -24,2 +25,4 @@ struct control control;
 
+pies_identity_t identity;
+
 
@@ -109,2 +112,3 @@ struct ctlio;
 
+static void cmd_auth (struct ctlio *, size_t, char **);
 static void cmd_quit (struct ctlio *, size_t, char **);
@@ -131,2 +135,4 @@ struct ctlio_command
 static struct ctlio_command cmdtab[] = {
+  { "auth", "authenticate",
+    CTL_INITIAL_STATE, 3, 3, cmd_auth },
   { "noop", "no operation",
@@ -169,2 +175,4 @@ struct ctlio
 {
+  union pies_sockaddr_storage addr;
+  socklen_t addrlen;
   int state;
@@ -183,3 +191,4 @@ ctlio_create (void)
   io = xmalloc (sizeof (*io));
-  io->state = CTL_AUTHENTICATED_STATE; //FIXME CTL_INITIAL_STATE;
+  io->state = identity_provider_list
+                ? CTL_INITIAL_STATE : CTL_AUTHENTICATED_STATE;
   io->action = ACTION_CONT;
@@ -310,3 +319,2 @@ ctlio_initial_reply (struct ctlio *io)
   ctlio_printf (io, "220 %s", instance);
-  ctlio_printf (io, " <%s>", "foobarbaz");
   //FIXME: auth mechanisms
@@ -316,2 +324,47 @@ ctlio_initial_reply (struct ctlio *io)
 static void
+cmd_auth (struct ctlio *io, size_t argc, char **argv)
+{
+  struct grecs_list_entry *ep;
+  pies_identity_t id = pies_identity_create (argv[1]);
+  int auth = 0;
+  
+  for (ep = identity_provider_list->head; ep; ep = ep->next)
+    {
+      pies_identity_provider_t provider = ep->data;
+      char const *pname = pies_identity_provider_name (provider);
+
+      debug(1, ("trying %s...", pname));
+      if (pies_authenticate (provider, id, argv[2]) == 0)
+	{
+	  if (check_acl (control.id_acl,
+			 (struct sockaddr *)&io->addr, io->addrlen, id))
+	    {
+	      logmsg (LOG_AUTH, "%s authenticated via %s, but failed ACL check",
+		      argv[1], pname);
+	      auth = 0;
+	    }
+	  else
+	    {
+	      logmsg (LOG_AUTH, "%s authenticated via %s",
+		      argv[1], pname);
+	      auth = 1;
+	    }
+	  break;
+	}
+    }
+
+  if (auth)
+    {
+      ctlio_reply (io, "230", "authentication successful");
+      identity = id;
+      io->state = CTL_AUTHENTICATED_STATE;
+    }
+  else
+    {
+      pies_identity_destroy (id);
+      ctlio_reply (io, "531", "access denied");
+    }
+}
+
+static void
 cmd_noop (struct ctlio *io, size_t argc, char **argv)
@@ -349,4 +402,7 @@ cmd_help (struct ctlio *io, size_t argc, char **argv)
     {
-      ctlio_printf (io, "%-9s%s", cp->verb, cp->descr);
-      ctlio_eol (io);
+      if (cp->states & io->state)
+	{
+	  ctlio_printf (io, "%-9s%s", cp->verb, cp->descr);
+	  ctlio_eol (io);
+	}
     }
@@ -1002,3 +1058,3 @@ ctl_accept (int socket, void *data)
 
-  if (check_acl (control.acl, (struct sockaddr *)&addr, addrlen))
+  if (check_acl (control.conn_acl, (struct sockaddr *)&addr, addrlen, NULL))
     {
@@ -1010,2 +1066,4 @@ ctl_accept (int socket, void *data)
   io = ctlio_create ();
+  io->addr = addr;
+  io->addrlen = addrlen;
   ctlio_initial_reply (io);