 @@ -1,386 +1,387 @@
-/*	$NetBSD: pam_lastlog.c,v 1.14 2012/01/03 19:02:55 christos Exp $	*/
+/*	$NetBSD: pam_lastlog.c,v 1.15 2014/01/07 02:07:43 joerg Exp $	*/
 /*-
  * Copyright (c) 1980, 1987, 1988, 1991, 1993, 1994
  *	The Regents of the University of California.  All rights reserved.
  * Copyright (c) 2001 Mark R V Murray
  * All rights reserved.
  * Copyright (c) 2001 Networks Associates Technology, Inc.
  * All rights reserved.
  * Copyright (c) 2004 Joe R. Doupnik
  * All rights reserved.
+ *
  * Portions of this software were developed for the FreeBSD Project by
  * ThinkSec AS and NAI Labs, the Security Research Division of Network
  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
  * ("CBOSS"), as part of the DARPA CHATS research program.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. The name of the author may not be used to endorse or promote
  *    products derived from this software without specific prior written
  *    permission.
  * 4. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
+ *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #ifdef __FreeBSD__
 __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_lastlog/pam_lastlog.c,v 1.20 2004/01/26 19:28:37 des Exp $");
 #else
-__RCSID("$NetBSD: pam_lastlog.c,v 1.14 2012/01/03 19:02:55 christos Exp $");
+__RCSID("$NetBSD: pam_lastlog.c,v 1.15 2014/01/07 02:07:43 joerg Exp $");
 #endif
 #include <sys/param.h>
 #include <fcntl.h>
 #include <util.h>
 #include <paths.h>
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <syslog.h>
 #include <errno.h>
 #include <time.h>
 #include <unistd.h>
 #include <stdarg.h>
 #ifdef LOGIN_CAP
 #include <login_cap.h>
 #endif
 #define PAM_SM_SESSION
 #include <security/pam_appl.h>
 #include <security/pam_modules.h>
 #include <security/pam_mod_misc.h>
 #ifdef SUPPORT_UTMP
 #include <utmp.h>
 static void doutmp(const char *, const char *, const char *,
     const struct timeval *);
 static void dolastlog(pam_handle_t *, int, const struct passwd *, const char *,
     const char *, const struct timeval *);
 #endif
 #ifdef SUPPORT_UTMPX
 #include <utmpx.h>
 static void doutmpx(const char *, const char *, const char *,
     const struct sockaddr_storage *ss, const struct timeval *);
 static void dolastlogx(pam_handle_t *, int, const struct passwd *, const char *,
     const char *, const struct sockaddr_storage *ss, const struct timeval *);
 #endif
 #if defined(SUPPORT_UTMPX) || defined(SUPPORT_UTMP)
 static void domsg(pam_handle_t *, time_t, const char *, size_t, const char *,
     size_t);
 #endif
 __printflike(2, 3)
 static void
 logit(int level, const char *fmt, ...)
+{
 	va_list ap;
 	struct syslog_data data = SYSLOG_DATA_INIT;
 	openlog_r("pam_lastlog", LOG_PID, LOG_AUTHPRIV, &data);
 	va_start(ap, fmt);
 	vsyslog_r(level, &data, fmt, ap);
 	va_end(ap);
 	closelog_r(&data);
+}
 PAM_EXTERN int
 pam_sm_open_session(pam_handle_t *pamh, int flags,
     int argc __unused, const char *argv[] __unused)
+{
 	struct passwd *pwd, pwres;
 	struct timeval now;
 	const char *user, *rhost, *tty, *nuser;
 	const void *vrhost, *vtty, *vss, *vnuser;
 	const struct sockaddr_storage *ss;
 	int pam_err;
 	char pwbuf[1024];
 #ifdef LOGIN_CAP
 	login_cap_t *lc;
 #endif
 	pam_err = pam_get_user(pamh, &user, NULL);
 	if (pam_err != PAM_SUCCESS)
 		return pam_err;
 	if (user == NULL ||
 	    getpwnam_r(user, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
 	    pwd == NULL)
 		return PAM_SERVICE_ERR;
 	PAM_LOG("Got user: %s", user);
 	pam_err = pam_get_item(pamh, PAM_RHOST, &vrhost);
 	if (pam_err != PAM_SUCCESS)
 		goto err;
 	rhost = (const char *)vrhost;
 	pam_err = pam_get_item(pamh, PAM_SOCKADDR, &vss);
 	if (pam_err != PAM_SUCCESS)
 		goto err;
 	ss = (const struct sockaddr_storage *)vss;
 	pam_err = pam_get_item(pamh, PAM_TTY, &vtty);
 	if (pam_err != PAM_SUCCESS)
 		goto err;
 	tty = (const char *)vtty;
 	if (tty == NULL) {
 		pam_err = PAM_SERVICE_ERR;
 		goto err;
+	}
 	if (pam_get_item(pamh, PAM_NUSER, &vnuser) != PAM_SUCCESS)
 		nuser = NULL;
 	else
 		nuser = (const char *)vnuser;
 	if (strncmp(tty, _PATH_DEV, strlen(_PATH_DEV)) == 0)
 		tty = tty + strlen(_PATH_DEV);
 	if (*tty == '\0') {
 		pam_err = PAM_SERVICE_ERR;
 		goto err;
+	}
 	(void)gettimeofday(&now, NULL);
 	if (openpam_get_option(pamh, "no_nested") == NULL || nuser == NULL) {
 		int quiet;
 		if ((flags & PAM_SILENT) != 0)
 			quiet = 1;
 		else {
 #ifdef LOGIN_CAP
 			lc = login_getpwclass(pwd);
 			quiet = login_getcapbool(lc, "hushlogin", 0);
 			login_close(lc);
 #else
 			quiet = 0;
 #endif
+		}
 #ifdef SUPPORT_UTMPX
 		doutmpx(user, rhost, tty, ss, &now);
 		dolastlogx(pamh, quiet, pwd, rhost, tty, ss, &now);
 		quiet = 1;
 #endif
 #ifdef SUPPORT_UTMP
 		doutmp(user, rhost, tty, &now);
 		dolastlog(pamh, quiet, pwd, rhost, tty, &now);
 #endif
+	}
 err:
 	if (openpam_get_option(pamh, "no_fail"))
 		return PAM_SUCCESS;
 	return pam_err;
+}
 PAM_EXTERN int
 pam_sm_close_session(pam_handle_t *pamh __unused, int flags __unused,
     int argc __unused, const char *argv[] __unused)
+{
 	const void *vtty, *vnuser;
 	const char *tty, *nuser;
 	if (pam_get_item(pamh, PAM_NUSER, &vnuser) != PAM_SUCCESS)
 		nuser = NULL;
 	else
 		nuser = (const char *)vnuser;
 	pam_get_item(pamh, PAM_TTY, &vtty);
 	if (vtty == NULL)
 		return PAM_SERVICE_ERR;
 	tty = (const char *)vtty;
 	if (strncmp(tty, _PATH_DEV, strlen(_PATH_DEV)) == 0)
 		tty = tty + strlen(_PATH_DEV);
 	if (*tty == '\0')
 		return PAM_SERVICE_ERR;
 	if (openpam_get_option(pamh, "no_nested") == NULL || nuser == NULL) {
 #ifdef SUPPORT_UTMPX
 		if (logoutx(tty, 0, DEAD_PROCESS))
 			logwtmpx(tty, "", "", 0, DEAD_PROCESS);
 		else
 			logit(LOG_NOTICE, "%s(): no utmpx record for %s",
 			    __func__, tty);
 #endif
 #ifdef SUPPORT_UTMP
 		if (logout(tty))
 			logwtmp(tty, "", "");
 		else
 			logit(LOG_NOTICE, "%s(): no utmp record for %s",
 			    __func__, tty);
 #endif
+	}
         return PAM_SUCCESS;
+}
 #if defined(SUPPORT_UTMPX) || defined(SUPPORT_UTMP)
 static void
 domsg(pam_handle_t *pamh, time_t t, const char *host, size_t hsize,
     const char *line, size_t lsize)
+{
 	char buf[MAXHOSTNAMELEN + 32], *promptresp = NULL;
 	int pam_err;
 	if (*host) {
 		(void)snprintf(buf, sizeof(buf), "from %.*s ",
 		    (int)hsize, host);
 		host = buf;
+	}
 	pam_err = pam_prompt(pamh, PAM_TEXT_INFO, &promptresp,
 	    "Last login: %.24s %son %.*s\n", ctime(&t), host, (int)lsize, line);
 	if (pam_err == PAM_SUCCESS && promptresp)
 		free(promptresp);
+}
 #endif
 #ifdef SUPPORT_UTMPX
 static void
 doutmpx(const char *username, const char *hostname, const char *tty,
     const struct sockaddr_storage *ss, const struct timeval *now)
+{
 	struct utmpx utmpx;
 	const char *t;
 	memset((void *)&utmpx, 0, sizeof(utmpx));
 	utmpx.ut_tv = *now;
 	(void)strncpy(utmpx.ut_name, username, sizeof(utmpx.ut_name));
 	if (hostname) {
 		(void)strncpy(utmpx.ut_host, hostname, sizeof(utmpx.ut_host));
 		if (ss)
 			utmpx.ut_ss = *ss;
+	}
 	(void)strncpy(utmpx.ut_line, tty, sizeof(utmpx.ut_line));
 	utmpx.ut_type = USER_PROCESS;
 	utmpx.ut_pid = getpid();
 	t = tty + strlen(tty);
 	if ((size_t)(t - tty) >= sizeof(utmpx.ut_id)) {
 		(void)strncpy(utmpx.ut_id, t - sizeof(utmpx.ut_id),
 		    sizeof(utmpx.ut_id));
 	} else {
 		(void)strncpy(utmpx.ut_id, tty, sizeof(utmpx.ut_id));
+	}
 	if (pututxline(&utmpx) == NULL)
 		logit(LOG_NOTICE, "Cannot update utmpx: %s", strerror(errno));
 	endutxent();
 	if (updwtmpx(_PATH_WTMPX, &utmpx) != 0)
 		logit(LOG_NOTICE, "Cannot update wtmpx: %s", strerror(errno));
+}
 static void
 dolastlogx(pam_handle_t *pamh, int quiet, const struct passwd *pwd,
     const char *hostname, const char *tty, const struct sockaddr_storage *ss,
     const struct timeval *now)
+{
 	struct lastlogx ll;
 	if (!quiet) {
 	    if (getlastlogx(_PATH_LASTLOGX, pwd->pw_uid, &ll) != NULL)
 		    domsg(pamh, (time_t)ll.ll_tv.tv_sec, ll.ll_host,
 			sizeof(ll.ll_host), ll.ll_line,
 			sizeof(ll.ll_line));
+	}
 	ll.ll_tv = *now;
 	(void)strncpy(ll.ll_line, tty, sizeof(ll.ll_line));
 	if (hostname)
 		(void)strncpy(ll.ll_host, hostname, sizeof(ll.ll_host));
 	else
 		(void)memset(ll.ll_host, 0, sizeof(ll.ll_host));
 	if (ss)
 		ll.ll_ss = *ss;
 	else
 		(void)memset(&ll.ll_ss, 0, sizeof(ll.ll_ss));
 	if (updlastlogx(_PATH_LASTLOGX, pwd->pw_uid, &ll) != 0)
 		logit(LOG_NOTICE, "Cannot update lastlogx: %s", strerror(errno));
 	PAM_LOG("Login recorded in %s", _PATH_LASTLOGX);
+}
 #endif
 #ifdef SUPPORT_UTMP
 static void
 doutmp(const char *username, const char *hostname, const char *tty,
     const struct timeval *now)
+{
 	struct utmp utmp;
 	(void)memset((void *)&utmp, 0, sizeof(utmp));
 	utmp.ut_time = now->tv_sec;
 	(void)strncpy(utmp.ut_name, username, sizeof(utmp.ut_name));
 	if (hostname)
 		(void)strncpy(utmp.ut_host, hostname, sizeof(utmp.ut_host));
 	(void)strncpy(utmp.ut_line, tty, sizeof(utmp.ut_line));
 	login(&utmp);
+}
 static void
 dolastlog(pam_handle_t *pamh, int quiet, const struct passwd *pwd,
     const char *hostname, const char *tty, const struct timeval *now)
+{
 	struct lastlog ll;
 	int fd;
 	if ((fd = open(_PATH_LASTLOG, O_RDWR, 0)) == -1) {
 		logit(LOG_NOTICE, "Cannot open `%s': %s", _PATH_LASTLOG,
 		    strerror(errno));
 		return;
+	}
 	(void)lseek(fd, (off_t)(pwd->pw_uid * sizeof(ll)), SEEK_SET);
 	if (!quiet) {
 		if (read(fd, (char *)&ll, sizeof(ll)) == sizeof(ll) &&
 		    ll.ll_time != 0)
 			domsg(pamh, ll.ll_time, ll.ll_host,
 			    sizeof(ll.ll_host), ll.ll_line,
 			    sizeof(ll.ll_line));
 		(void)lseek(fd, (off_t)(pwd->pw_uid * sizeof(ll)), SEEK_SET);
+	}
 	ll.ll_time = now->tv_sec;
 	(void)strncpy(ll.ll_line, tty, sizeof(ll.ll_line));
 	if (hostname)
 		(void)strncpy(ll.ll_host, hostname, sizeof(ll.ll_host));
 	else
 		(void)memset(ll.ll_host, 0, sizeof(ll.ll_host));
 	(void)write(fd, &ll, sizeof(ll));
 	(void)close(fd);
 	PAM_LOG("Login recorded in %s", _PATH_LASTLOG);
+}
 #endif
 PAM_MODULE_ENTRY("pam_lastlog");

 @@ -1,253 +1,254 @@
-/*	$NetBSD: login_access.c,v 1.7 2013/12/29 22:54:58 christos Exp $	*/
+/*	$NetBSD: login_access.c,v 1.8 2014/01/07 02:07:43 joerg Exp $	*/
 /*
  * This module implements a simple but effective form of login access
  * control based on login names and on host (or domain) names, internet
  * addresses (or network numbers), or on terminal line names in case of
  * non-networked logins. Diagnostics are reported through syslog(3).
+ *
  * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
  */
 #if 0
 #ifndef lint
 static char sccsid[] = "%Z% %M% %I% %E% %U%";
 #endif
 #endif
 #include <sys/cdefs.h>
 #ifdef __FreeBSD__
 __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_login_access/login_access.c,v 1.12 2004/03/05 08:10:18 markm Exp $");
 #else
-__RCSID("$NetBSD: login_access.c,v 1.7 2013/12/29 22:54:58 christos Exp $");
+__RCSID("$NetBSD: login_access.c,v 1.8 2014/01/07 02:07:43 joerg Exp $");
 #endif
 #include <sys/types.h>
 #include <ctype.h>
 #include <errno.h>
 #include <grp.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <syslog.h>
 #include <unistd.h>
 #include <stdarg.h>
 #include "pam_login_access.h"
 #define _PATH_LOGACCESS		"/etc/login.access"
  /* Delimiters for fields and for lists of users, ttys or hosts. */
 static char fs[] = ":";			/* field separator */
 static char sep[] = ", \t";		/* list-element separator */
  /* Constants to be used in assignments only, not in comparisons... */
 #define YES             1
 #define NO              0
 static int	from_match(const char *, const char *);
 static int	list_match(char *, const char *,
 				int (*)(const char *, const char *));
 static int	netgroup_match(const char *, const char *, const char *);
 static int	string_match(const char *, const char *);
 static int	user_match(const char *, const char *);
 /* login_access - match username/group and host/tty with access control file */
 __printflike(2, 3)
 static void
 logit(int level, const char *fmt, ...)
+{
 	va_list ap;
 	struct syslog_data data = SYSLOG_DATA_INIT;
 	openlog_r("pam_login_access", LOG_PID, LOG_AUTHPRIV, &data);
 	va_start(ap, fmt);
 	vsyslog_r(level, &data, fmt, ap);
 	va_end(ap);
 	closelog_r(&data);
+}
 int
 login_access(const char *user, const char *from)
+{
     FILE   *fp;
     char    line[BUFSIZ];
     char   *perm;			/* becomes permission field */
     char   *users;			/* becomes list of login names */
     char   *froms;			/* becomes list of terminals or hosts */
     int     match = NO;
     size_t  end;
     int     lineno = 0;			/* for diagnostics */
     /*
      * Process the table one line at a time and stop at the first match.
      * Blank lines and lines that begin with a '#' character are ignored.
      * Non-comment lines are broken at the ':' character. All fields are
      * mandatory. The first field should be a "+" or "-" character. A
      * non-existing table means no access control.
      */
     if ((fp = fopen(_PATH_LOGACCESS, "r")) != NULL) {
 	while (!match && fgets(line, sizeof(line), fp)) {
 	    lineno++;
 	    if ((end = strlen(line)) == 0 || line[end - 1] != '\n') {
 		logit(LOG_ERR, "%s: line %d: missing newline or line too long",
 		       _PATH_LOGACCESS, lineno);
 		continue;
+	    }
 	    if (line[0] == '#')
 		continue;			/* comment line */
 	    while (end > 0 && isspace((unsigned char)line[end - 1]))
 		end--;
 	    line[end] = 0;			/* strip trailing whitespace */
 	    if (line[0] == 0)			/* skip blank lines */
 		continue;
 	    if (!(perm = strtok(line, fs))
 		|| !(users = strtok((char *) 0, fs))
 		|| !(froms = strtok((char *) 0, fs))
 		|| strtok((char *) 0, fs)) {
 		logit(LOG_ERR, "%s: line %d: bad field count", _PATH_LOGACCESS,
 		       lineno);
 		continue;
+	    }
 	    if (perm[0] != '+' && perm[0] != '-') {
 		logit(LOG_ERR, "%s: line %d: bad first field", _PATH_LOGACCESS,
 		       lineno);
 		continue;
+	    }
 	    match = (list_match(froms, from, from_match)
 		     && list_match(users, user, user_match));
+	}
 	(void) fclose(fp);
     } else if (errno != ENOENT) {
 	logit(LOG_ERR, "cannot open %s: %s", _PATH_LOGACCESS, strerror(errno));
+    }
     return (match == 0 || (line[0] == '+'));
+}
 /* list_match - match an item against a list of tokens with exceptions */
 static int
 list_match(char *list, const char *item,
     int (*match_fn)(const char *, const char *))
+{
     char   *tok;
     int     match = NO;
     /*
      * Process tokens one at a time. We have exhausted all possible matches
      * when we reach an "EXCEPT" token or the end of the list. If we do find
      * a match, look for an "EXCEPT" list and recurse to determine whether
      * the match is affected by any exceptions.
      */
     for (tok = strtok(list, sep); tok != 0; tok = strtok((char *) 0, sep)) {
 	if (strcasecmp(tok, "EXCEPT") == 0)	/* EXCEPT: give up */
 	    break;
 	if ((match = (*match_fn)(tok, item)) != 0)	/* YES */
 	    break;
+    }
     /* Process exceptions to matches. */
     if (match != NO) {
 	while ((tok = strtok((char *) 0, sep)) && strcasecmp(tok, "EXCEPT"))
 	     /* VOID */ ;
 	if (tok == 0 || list_match((char *) 0, item, match_fn) == NO)
 	    return (match);
+    }
     return (NO);
+}
 /* netgroup_match - match group against machine or user */
 static int
 netgroup_match(const char *group __unused,
     const char *machine __unused, const char *user __unused)
+{
     logit(LOG_ERR, "NIS netgroup support not configured");
     return 0;
+}
 /* user_match - match a username against one token */
 static int
 user_match(const char *tok, const char *string)
+{
     struct group grres, *group;
     char grbuf[1024];
     int     i;
     /*
      * If a token has the magic value "ALL" the match always succeeds.
      * Otherwise, return YES if the token fully matches the username, or if
      * the token is a group that contains the username.
      */
     if (tok[0] == '@') {			/* netgroup */
 	return (netgroup_match(tok + 1, (char *) 0, string));
     } else if (string_match(tok, string)) {	/* ALL or exact match */
 	return (YES);
     } else if (getgrnam_r(tok, &grres, grbuf, sizeof(grbuf), &group) == 0 &&
 	group != NULL) {/* try group membership */
 	for (i = 0; group->gr_mem[i]; i++)
 	    if (strcasecmp(string, group->gr_mem[i]) == 0)
 		return (YES);
+    }
     return (NO);
+}
 /* from_match - match a host or tty against a list of tokens */
 static int
 from_match(const char *tok, const char *string)
+{
     size_t     tok_len;
     size_t     str_len;
     /*
      * If a token has the magic value "ALL" the match always succeeds. Return
      * YES if the token fully matches the string. If the token is a domain
      * name, return YES if it matches the last fields of the string. If the
      * token has the magic value "LOCAL", return YES if the string does not
      * contain a "." character. If the token is a network number, return YES
      * if it matches the head of the string.
      */
     if (tok[0] == '@') {			/* netgroup */
 	return (netgroup_match(tok + 1, string, (char *) 0));
     } else if (string_match(tok, string)) {	/* ALL or exact match */
 	return (YES);
     } else if (tok[0] == '.') {			/* domain: match last fields */
 	if ((str_len = strlen(string)) > (tok_len = strlen(tok))
 	    && strcasecmp(tok, string + str_len - tok_len) == 0)
 	    return (YES);
     } else if (strcasecmp(tok, "LOCAL") == 0) {	/* local: no dots */
 	if (strchr(string, '.') == 0)
 	    return (YES);
     } else if (tok[(tok_len = strlen(tok)) - 1] == '.'	/* network */
 	       && strncmp(tok, string, tok_len) == 0) {
 	return (YES);
+    }
     return (NO);
+}
 /* string_match - match a string against one token */
 static int
 string_match(const char *tok, const char *string)
+{
     /*
      * If the token has the magic value "ALL" the match always succeeds.
      * Otherwise, return YES if the token fully matches the string.
      */
     if (strcasecmp(tok, "ALL") == 0) {		/* all: always matches */
 	return (YES);
     } else if (strcasecmp(tok, string) == 0) {	/* try exact match */
 	return (YES);
+    }
     return (NO);
+}

 @@ -1,388 +1,389 @@
-/*	$NetBSD: pam_radius.c,v 1.7 2006/11/03 18:55:40 christos Exp $	*/
+/*	$NetBSD: pam_radius.c,v 1.8 2014/01/07 02:07:43 joerg Exp $	*/
 /*-
  * Copyright 1998 Juniper Networks, Inc.
  * All rights reserved.
  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
  * All rights reserved.
+ *
  * Portions of this software were developed for the FreeBSD Project by
  * ThinkSec AS and NAI Labs, the Security Research Division of Network
  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
  * ("CBOSS"), as part of the DARPA CHATS research program.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. The name of the author may not be used to endorse or promote
  *    products derived from this software without specific prior written
  *    permission.
+ *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #ifdef __FreeBSD__
 __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_radius/pam_radius.c,v 1.22 2004/06/25 12:32:45 kan Exp $");
 #else
-__RCSID("$NetBSD: pam_radius.c,v 1.7 2006/11/03 18:55:40 christos Exp $");
+__RCSID("$NetBSD: pam_radius.c,v 1.8 2014/01/07 02:07:43 joerg Exp $");
 #endif
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netdb.h>
 #include <pwd.h>
 #include <radlib.h>
 #include <stdlib.h>
 #include <string.h>
 #include <syslog.h>
 #include <unistd.h>
 #include <stdarg.h>
 #define PAM_SM_AUTH
 #include <security/pam_appl.h>
 #include <security/pam_modules.h>
 #include <security/pam_mod_misc.h>
 #define PAM_OPT_CONF		"conf"
 #define PAM_OPT_TEMPLATE_USER	"template_user"
 #define PAM_OPT_NAS_ID		"nas_id"
 #define PAM_OPT_NAS_IPADDR	"nas_ipaddr"
 #define	MAX_CHALLENGE_MSGS	10
 #define	PASSWORD_PROMPT		"RADIUS Password:"
 static int	 build_access_request(struct rad_handle *, const char *,
 		    const char *, const char *, const char *, const void *,
 		    size_t);
 static int	 do_accept(pam_handle_t *, struct rad_handle *);
 static int	 do_challenge(pam_handle_t *, struct rad_handle *,
 		    const char *);
 __printflike(2, 3)
 static void
 logit(int level, const char *fmt, ...)
+{
 	va_list ap;
 	struct syslog_data data = SYSLOG_DATA_INIT;
 	openlog_r("pam_radius", LOG_PID, LOG_AUTHPRIV, &data);
 	va_start(ap, fmt);
 	vsyslog_r(level, &data, fmt, ap);
 	va_end(ap);
 	closelog_r(&data);
+}
 /*
  * Construct an access request, but don't send it.  Returns 0 on success,
  * -1 on failure.
  */
 static int
 build_access_request(struct rad_handle *radh, const char *user,
     const char *pass, const char *nas_id, const char *nas_ipaddr,
     const void *state, size_t state_len)
+{
 	int error;
 	char host[MAXHOSTNAMELEN];
 	struct sockaddr_in *haddr;
 	struct addrinfo hints;
 	struct addrinfo *res;
 	if (rad_create_request(radh, RAD_ACCESS_REQUEST) == -1) {
 		logit(LOG_CRIT, "rad_create_request: %s", rad_strerror(radh));
 		return (-1);
+	}
 	if (nas_id == NULL ||
 	    (nas_ipaddr != NULL && strlen(nas_ipaddr) == 0)) {
 		if (gethostname(host, sizeof host) != -1) {
 			if (nas_id == NULL)
 				nas_id = host;
 			if (nas_ipaddr != NULL && strlen(nas_ipaddr) == 0)
 				nas_ipaddr = host;
+		}
+	}
 	if ((user != NULL &&
 	    rad_put_string(radh, RAD_USER_NAME, user) == -1) ||
 	    (pass != NULL &&
 	    rad_put_string(radh, RAD_USER_PASSWORD, pass) == -1) ||
 	    (nas_id != NULL &&
 	    rad_put_string(radh, RAD_NAS_IDENTIFIER, nas_id) == -1)) {
 		logit(LOG_CRIT, "rad_put_string: %s", rad_strerror(radh));
 		return (-1);
+	}
 	if (nas_ipaddr != NULL) {
 		memset(&hints, 0, sizeof(hints));
 		hints.ai_family = PF_INET;
 		if (getaddrinfo(nas_ipaddr, NULL, &hints, &res) == 0 &&
 		    res != NULL) {
 			haddr = (struct sockaddr_in *)res->ai_addr;
 			error = rad_put_addr(radh, RAD_NAS_IP_ADDRESS,
 			    haddr->sin_addr);
 			freeaddrinfo(res);
 			if (error == -1) {
 				logit(LOG_CRIT, "rad_put_addr: %s",
 				    rad_strerror(radh));
 				return (-1);
+			}
+		}
+	}
 	if (state != NULL && rad_put_attr(radh, RAD_STATE, state,
 	    state_len) == -1) {
 		logit(LOG_CRIT, "rad_put_attr: %s", rad_strerror(radh));
 		return (-1);
+	}
 	if (rad_put_int(radh, RAD_SERVICE_TYPE, RAD_AUTHENTICATE_ONLY) == -1) {
 		logit(LOG_CRIT, "rad_put_int: %s", rad_strerror(radh));
 		return (-1);
+	}
 	return (0);
+}
 static int
 do_accept(pam_handle_t *pamh, struct rad_handle *radh)
+{
 	int attrtype;
 	const void *attrval;
 	size_t attrlen;
 	char *s;
 	while ((attrtype = rad_get_attr(radh, &attrval, &attrlen)) > 0) {
 		if (attrtype == RAD_USER_NAME) {
 			s = rad_cvt_string(attrval, attrlen);
 			if (s == NULL) {
 				logit(LOG_CRIT,
 				    "rad_cvt_string: out of memory");
 				return (-1);
+			}
 			pam_set_item(pamh, PAM_USER, s);
 			free(s);
+		}
+	}
 	if (attrtype == -1) {
 		logit(LOG_CRIT, "rad_get_attr: %s", rad_strerror(radh));
 		return (-1);
+	}
 	return (0);
+}
 static int
 do_challenge(pam_handle_t *pamh, struct rad_handle *radh, const char *user)
+{
 	int retval;
 	int attrtype;
 	const void *attrval;
 	size_t attrlen;
 	const void *state;
 	size_t statelen;
 	struct pam_message msgs[MAX_CHALLENGE_MSGS];
 	const struct pam_message *msg_ptrs[MAX_CHALLENGE_MSGS];
 	struct pam_response *resp;
 	int num_msgs;
 	const void *item;
 	const struct pam_conv *conv;
 	state = NULL;
 	statelen = 0;
 	num_msgs = 0;
 	while ((attrtype = rad_get_attr(radh, &attrval, &attrlen)) > 0) {
 		switch (attrtype) {
 		case RAD_STATE:
 			state = attrval;
 			statelen = attrlen;
 			break;
 		case RAD_REPLY_MESSAGE:
 			if (num_msgs >= MAX_CHALLENGE_MSGS) {
 				logit(LOG_CRIT,
 				    "Too many RADIUS challenge messages");
 				return (PAM_SERVICE_ERR);
+			}
 			msgs[num_msgs].msg = rad_cvt_string(attrval, attrlen);
 			if (msgs[num_msgs].msg == NULL) {
 				logit(LOG_CRIT,
 				    "rad_cvt_string: out of memory");
 				return (PAM_SERVICE_ERR);
+			}
 			msgs[num_msgs].msg_style = PAM_TEXT_INFO;
 			msg_ptrs[num_msgs] = &msgs[num_msgs];
 			num_msgs++;
 			break;
+		}
+	}
 	if (attrtype == -1) {
 		logit(LOG_CRIT, "rad_get_attr: %s", rad_strerror(radh));
 		return (PAM_SERVICE_ERR);
+	}
 	if (num_msgs == 0) {
 		msgs[num_msgs].msg = strdup("(null RADIUS challenge): ");
 		if (msgs[num_msgs].msg == NULL) {
 			logit(LOG_CRIT, "Out of memory");
 			return (PAM_SERVICE_ERR);
+		}
 		msgs[num_msgs].msg_style = PAM_TEXT_INFO;
 		msg_ptrs[num_msgs] = &msgs[num_msgs];
 		num_msgs++;
+	}
 	msgs[num_msgs-1].msg_style = PAM_PROMPT_ECHO_ON;
 	if ((retval = pam_get_item(pamh, PAM_CONV, &item)) != PAM_SUCCESS) {
 		logit(LOG_CRIT, "do_challenge: cannot get PAM_CONV");
 		return (retval);
+	}
 	conv = (const struct pam_conv *)item;
 	if ((retval = conv->conv(num_msgs, msg_ptrs, &resp,
 	    conv->appdata_ptr)) != PAM_SUCCESS)
 		return (retval);
 	if (build_access_request(radh, user, resp[num_msgs-1].resp, NULL,
 	    NULL, state, statelen) == -1)
 		return (PAM_SERVICE_ERR);
 	memset(resp[num_msgs-1].resp, 0, strlen(resp[num_msgs-1].resp));
 	free(resp[num_msgs-1].resp);
 	free(resp);
 	while (num_msgs > 0)
 		free(msgs[--num_msgs].msg);
 	return (PAM_SUCCESS);
+}
 PAM_EXTERN int
 pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
     int argc __unused, const char *argv[] __unused)
+{
 	struct rad_handle *radh;
 	const char *user, *pass;
 	const void *tmpuser;
 	struct passwd *pwd, pwres;
 	char pwbuf[1024];
 	const char *conf_file, *template_user, *nas_id, *nas_ipaddr;
 	int retval;
 	int e;
 	conf_file = openpam_get_option(pamh, PAM_OPT_CONF);
 	template_user = openpam_get_option(pamh, PAM_OPT_TEMPLATE_USER);
 	nas_id = openpam_get_option(pamh, PAM_OPT_NAS_ID);
 	nas_ipaddr = openpam_get_option(pamh, PAM_OPT_NAS_IPADDR);
 	retval = pam_get_user(pamh, &user, NULL);
 	if (retval != PAM_SUCCESS)
 		return (retval);
 	PAM_LOG("Got user: %s", user);
 	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, PASSWORD_PROMPT);
 	if (retval != PAM_SUCCESS)
 		return (retval);
 	PAM_LOG("Got password");
 	radh = rad_open();
 	if (radh == NULL) {
 		logit(LOG_CRIT, "rad_open failed");
 		return (PAM_SERVICE_ERR);
+	}
 	PAM_LOG("Radius opened");
 	if (rad_config(radh, conf_file) == -1) {
 		logit(LOG_ALERT, "rad_config: %s", rad_strerror(radh));
 		rad_close(radh);
 		return (PAM_SERVICE_ERR);
+	}
 	PAM_LOG("Radius config file read");
 	if (build_access_request(radh, user, pass, nas_id, nas_ipaddr, NULL,
 ) == -1) {
 		rad_close(radh);
 		return (PAM_SERVICE_ERR);
+	}
 	PAM_LOG("Radius build access done");
 	for (;;) {
 		switch (rad_send_request(radh)) {
 		case RAD_ACCESS_ACCEPT:
 			e = do_accept(pamh, radh);
 			rad_close(radh);
 			if (e == -1)
 				return (PAM_SERVICE_ERR);
 			if (template_user != NULL) {
 				PAM_LOG("Trying template user: %s",
 				    template_user);
 				/*
 				 * If the given user name doesn't exist in
 				 * the local password database, change it
 				 * to the value given in the "template_user"
 				 * option.
 				 */
 				retval = pam_get_item(pamh, PAM_USER, &tmpuser);
 				if (retval != PAM_SUCCESS)
 					return (retval);
 				if (getpwnam_r(tmpuser, &pwres, pwbuf,
 					       sizeof(pwbuf), &pwd) != 0 ||
 				    pwd == NULL) {
 					pam_set_item(pamh, PAM_USER,
 					    template_user);
 					PAM_LOG("Using template user");
+				}
+			}
 			return (PAM_SUCCESS);
 		case RAD_ACCESS_REJECT:
 			rad_close(radh);
 			PAM_VERBOSE_ERROR("Radius rejection");
 			return (PAM_AUTH_ERR);
 		case RAD_ACCESS_CHALLENGE:
 			retval = do_challenge(pamh, radh, user);
 			if (retval != PAM_SUCCESS) {
 				rad_close(radh);
 				return (retval);
+			}
 			break;
 		case -1:
 			logit(LOG_CRIT, "rad_send_request: %s",
 			    rad_strerror(radh));
 			rad_close(radh);
 			PAM_VERBOSE_ERROR("Radius failure");
 			return (PAM_AUTHINFO_UNAVAIL);
 		default:
 			logit(LOG_CRIT,
 			    "rad_send_request: unexpected return value");
 			rad_close(radh);
 			PAM_VERBOSE_ERROR("Radius error");
 			return (PAM_SERVICE_ERR);
+		}
+	}
+}
 PAM_EXTERN int
 pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
     int argc __unused, const char *argv[] __unused)
+{
 	return (PAM_SUCCESS);
+}
 PAM_MODULE_ENTRY("pam_radius");