rename

Cargo.lock

@@ -292,19 +292,6 @@ dependencies = [
  "synstructure 0.12.1 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
-[[package]]
-name = "fido2_pam"
-version = "0.1.0"
-dependencies = [
- "ctap_hmac 0.3.0 (git+https://git.shimun.net/shimun/ctap?rev=1a8e83d81efa3ae2cd4d764ddbae72c95a5af3e1)",
- "ctrlc 3.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
- "hex 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
- "pamsm 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
- "rand 0.7.2 (registry+https://github.com/rust-lang/crates.io-index)",
- "regex 1.3.1 (registry+https://github.com/rust-lang/crates.io-index)",
- "structopt 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)",
-]
-
 [[package]]
 name = "fnv"
 version = "1.0.6"
@@ -414,6 +401,19 @@ dependencies = [
  "autocfg 0.1.7 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
+[[package]]
+name = "pam_fido2"
+version = "0.2.2"
+dependencies = [
+ "ctap_hmac 0.3.0 (git+https://git.shimun.net/shimun/ctap?rev=1a8e83d81efa3ae2cd4d764ddbae72c95a5af3e1)",
+ "ctrlc 3.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
+ "hex 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "pamsm 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.7.2 (registry+https://github.com/rust-lang/crates.io-index)",
+ "regex 1.3.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ "structopt 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
 [[package]]
 name = "pamsm"
 version = "0.2.0"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
-name = "fido2_pam"
+name = "pam_fido2"
-version = "0.2.1"
+version = "0.2.2"
 authors = ["shimun <shimun@shimun.net>"]
 edition = "2018"
 
@@ -12,12 +12,12 @@ path = "src/lib.rs"
 crate-type = ["cdylib"]
 
 [[bin]]
-name = "fido2-pam-credential"
+name = "pam_fido2-credential"
 path = "src/main.rs"
 
 
 [dependencies]
-ctap_hmac = { git = "https://git.shimun.net/shimun/ctap", branch = "assert_multiple", features = ["request_multiple"] }
+ctap_hmac = { git = "https://git.shimun.net/shimun/ctap", rev = "1a8e83d81efa3ae2cd4d764ddbae72c95a5af3e1", features = ["assert_devices"] }
 pamsm = "0.2.0"
 regex = "1.3.1"
 rand = "0.7.2"

src/lib.rs

@@ -1,12 +1,14 @@
 #[macro_use]
 extern crate pamsm;
 extern crate ctap_hmac as ctap;
-use ctap::{get_assertion_devices, FidoAssertionRequestBuilder, FidoDevice};
+use ctap::{get_assertion_devices, FidoAssertionRequestBuilder, FidoDevice, FidoErrorKind};
 use pamsm::{Pam, PamError, PamFlag, PamServiceModule};
 use rand::Rng;
 use regex::Regex;
+use std::collections::HashMap;
 use std::fs::File;
-use std::io::{self, prelude::*, BufReader};
+use std::io::{prelude::*, BufReader};
+use std::path::Path;
 use std::time::{Duration, SystemTime};
 
 struct PamFido2;
@@ -26,26 +28,50 @@ impl Default for Settings {
 }
 
 impl Settings {
-    pub fn load() -> Settings {
+    pub fn from_args(args: Vec<String>) -> Self {
+        let args = args
+            .into_iter()
+            .filter_map(|arg| {
+                let mut parts = arg.split("=");
+                parts
+                    .by_ref()
+                    .next()
+                    .map(|key| (key.to_string(), parts.collect::<Vec<_>>().join("=")))
+            })
+            .collect::<HashMap<String, String>>();
+        let mut settings = Settings::load(
+            args.get("authfile")
+                .map(AsRef::as_ref)
+                .unwrap_or("/etc/fido2_pam.conf"),
+        );
+        let timeout = args
+            .get("timeout")
+            .map(|t| {
+                t.parse::<u64>()
+                    .expect("invalid config timeout is supposed to be an int")
+            })
+            .map(Duration::from_secs);
+        if let Some(timeout) = timeout {
+            settings.device_timeout = timeout;
+        };
+        settings
+    }
+    pub fn load(path: impl AsRef<Path>) -> Settings {
         let mut creds = Vec::new();
-        for path in &["./pam_fido2.conf", "/etc/pam_fido2.conf"] {
+        let file = File::open(path.as_ref()).unwrap();
-            let file = match File::open(&path) {
+        let reader = BufReader::new(file);
-                Ok(file) => file,
-                _ => continue,
-            };
-            let reader = BufReader::new(file);
 
-            for line in reader.lines() {
+        for line in reader.lines() {
-                let line = line.unwrap();
+            let line = line.unwrap();
-                let mut parts = line.split(":");
+            let mut parts = line.split(":");
-                if let Some(user) = parts.by_ref().next() {
+            if let Some(user) = parts.by_ref().next() {
-                    creds.push((
+                creds.push((
-                        (&parts.collect::<Vec<_>>()[..].join(":")).to_string(),
+                    (&parts.collect::<Vec<_>>()[..].join(":")).to_string(),
-                        user.to_string(),
+                    user.to_string(),
-                    ));
+                ));
-                }
             }
         }
+
         Settings {
             user_credentials: creds,
             ..Default::default()
@@ -71,15 +97,9 @@ impl Settings {
     }
 }
 
-impl PamFido2 {
-    fn settings(&self) -> Settings {
-        Settings::load()
-    }
-}
-
 impl PamServiceModule for PamFido2 {
-    fn authenticate(self: &Self, pamh: Pam, _: PamFlag, _args: Vec<String>) -> PamError {
+    fn authenticate(self: &Self, pamh: Pam, _: PamFlag, args: Vec<String>) -> PamError {
-        let settings = self.settings();
+        let settings = Settings::from_args(args);
         let begin = SystemTime::now();
         let challenge = rand::thread_rng().gen::<[u8; 32]>();
         let credentials = settings.get_credentials(
@@ -111,6 +131,7 @@ impl PamServiceModule for PamFido2 {
                 Err(_) if begin.elapsed().unwrap() > settings.device_timeout => {
                     return PamError::AUTH_ERR
                 }
+                Err(e) if e.kind() == FidoErrorKind::DeviceUnsupported => continue,
                 Err(e) => eprintln!("{:?}", e),
             }
         }