added test subcommand

src/lib.rs

@@ -1,149 +1,7 @@
 #[macro_use]
 extern crate pamsm;
 extern crate ctap_hmac as ctap;
-use ctap::{get_assertion_devices, FidoAssertionRequestBuilder, FidoDevice, FidoErrorKind};
-use pamsm::{Pam, PamError, PamFlag, PamServiceModule};
-use rand::Rng;
-use regex::Regex;
-use std::collections::HashMap;
-use std::fs::File;
-use std::io::{prelude::*, BufReader};
-use std::path::Path;
-use std::time::{Duration, SystemTime};
-
-struct PamFido2;
-
-struct Settings {
-    pub device_timeout: Duration,
-    pub user_credentials: Vec<(String, String)>,
-}
-
-impl Default for Settings {
-    fn default() -> Self {
-        Settings {
-   device_timeout: Duration::from_secs(15),
-   user_credentials: vec![("091566e43802c5a29971c1e08d7865d959af862cc28af22dacf413ac26b90f6dea7d1ac491d9d3712c63f7b8d6cfadf86d057d099d382246dbe9c87f133ed167881b65030000".into(),".*".into())],
-  }
-    }
-}
-
-impl Settings {
-    pub fn from_args(args: Vec<String>) -> Self {
-        let args = args
-            .into_iter()
-            .filter_map(|arg| {
-                let mut parts = arg.split("=");
-                parts
-                    .by_ref()
-                    .next()
-                    .map(|key| (key.to_string(), parts.collect::<Vec<_>>().join("=")))
-            })
-            .collect::<HashMap<String, String>>();
-        let mut settings = Settings::load(
-            args.get("authfile")
-                .map(AsRef::as_ref)
-                .unwrap_or("/etc/fido2_pam.conf"),
-        );
-        let timeout = args
-            .get("timeout")
-            .map(|t| {
-                t.parse::<u64>()
-                    .expect("invalid config timeout is supposed to be an int")
-            })
-            .map(Duration::from_secs);
-        if let Some(timeout) = timeout {
-            settings.device_timeout = timeout;
-        };
-        settings
-    }
-    pub fn load(path: impl AsRef<Path>) -> Settings {
-        let mut creds = Vec::new();
-        let file = File::open(path.as_ref()).unwrap();
-        let reader = BufReader::new(file);
-
-        for line in reader.lines() {
-            let line = line.unwrap();
-            let mut parts = line.split(":");
-            if let Some(user) = parts.by_ref().next() {
-                creds.push((
-                    (&parts.collect::<Vec<_>>()[..].join(":")).to_string(),
-                    user.to_string(),
-                ));
-            }
-        }
-
-        Settings {
-            user_credentials: creds,
-            ..Default::default()
-        }
-    }
-
-    pub fn get_credentials(&self, user: &str) -> Vec<ctap::FidoCredential> {
-        let mut creds = Vec::new();
-        for (cred, pattern) in self.user_credentials.iter() {
-            let re = Regex::new(&pattern).expect(&["Invalid regex pattern:", &pattern].join(" "));
-            if re.is_match(user) {
-                let mut parts = cred.split(":");
-                //TODO: use expect
-                let id = parts.by_ref().next().unwrap();
-                let key = parts.by_ref().next().unwrap();
-                creds.push(ctap::FidoCredential {
-                    id: hex::decode(id).unwrap(),
-                    public_key: hex::decode(key).ok(),
-                });
-            }
-        }
-        creds
-    }
-}
-
-impl PamServiceModule for PamFido2 {
-    fn authenticate(self: &Self, pamh: Pam, _: PamFlag, args: Vec<String>) -> PamError {
-        let settings = Settings::from_args(args);
-        let begin = SystemTime::now();
-        let challenge = rand::thread_rng().gen::<[u8; 32]>();
-        let credentials = settings.get_credentials(
-            &pamh
-                .get_cached_user()
-                .ok()
-                .map(|name| name.unwrap().to_str().unwrap().to_string())
-                .expect("Faied to get username"),
-        );
-        if credentials.is_empty() {
-            return PamError::AUTH_ERR;
-        }
-        let slice = credentials.iter().collect::<Vec<_>>();
-        let request = FidoAssertionRequestBuilder::default()
-            .rp_id("fido2pam")
-            .client_data_hash(&challenge[..])
-            .credentials(&slice[..])
-            .build()
-            .unwrap();
-        loop {
-            let mut devices = match ctap::get_devices() {
-                Ok(devices) => devices
-                    .filter_map(|handle| FidoDevice::new(&handle).ok())
-                    .collect::<Vec<_>>(),
-                Err(_) => return PamError::AUTH_ERR,
-            };
-            match get_assertion_devices(&request, devices.iter_mut()) {
-                Ok(_) => return PamError::SUCCESS,
-                Err(_) if begin.elapsed().unwrap() > settings.device_timeout => {
-                    return PamError::AUTH_ERR
-                }
-                Err(e) if e.kind() == FidoErrorKind::DeviceUnsupported => continue,
-                Err(e) => eprintln!("{:?}", e),
-            }
-        }
-    }
-}
+mod pamfido2;
 
+use pamfido2::PamFido2;
 pamsm_init!(Box::new(PamFido2));
-
-#[cfg(test)]
-mod tests {
-    #[test]
-    fn it_works() {
-        assert_eq!(2 + 2, 4);
-    }
-}