xref: /freebsd/lib/libutil/login_cap.c (revision 94cf9da03c17f6ae69c4839c43d61f96b3215622)
168bbf3adSDavid Nugent /*-
268bbf3adSDavid Nugent  * Copyright (c) 1996 by
368bbf3adSDavid Nugent  * Sean Eric Fagan <sef@kithrup.com>
468bbf3adSDavid Nugent  * David Nugent <davidn@blaze.net.au>
568bbf3adSDavid Nugent  * All rights reserved.
668bbf3adSDavid Nugent  *
756c04344SDavid Nugent  * Portions copyright (c) 1995,1997
856c04344SDavid Nugent  * Berkeley Software Design, Inc.
956c04344SDavid Nugent  * All rights reserved.
1056c04344SDavid Nugent  *
1168bbf3adSDavid Nugent  * Redistribution and use in source and binary forms, with or without
1268bbf3adSDavid Nugent  * modification, is permitted provided that the following conditions
1368bbf3adSDavid Nugent  * are met:
1468bbf3adSDavid Nugent  * 1. Redistributions of source code must retain the above copyright
1568bbf3adSDavid Nugent  *    notice immediately at the beginning of the file, without modification,
1668bbf3adSDavid Nugent  *    this list of conditions, and the following disclaimer.
1768bbf3adSDavid Nugent  * 2. Redistributions in binary form must reproduce the above copyright
1868bbf3adSDavid Nugent  *    notice, this list of conditions and the following disclaimer in the
1968bbf3adSDavid Nugent  *    documentation and/or other materials provided with the distribution.
2068bbf3adSDavid Nugent  * 3. This work was done expressly for inclusion into FreeBSD.  Other use
2168bbf3adSDavid Nugent  *    is permitted provided this notation is included.
2268bbf3adSDavid Nugent  * 4. Absolutely no warranty of function or purpose is made by the authors.
2368bbf3adSDavid Nugent  * 5. Modifications may be freely made to this file providing the above
2468bbf3adSDavid Nugent  *    conditions are met.
2568bbf3adSDavid Nugent  *
2668bbf3adSDavid Nugent  * Low-level routines relating to the user capabilities database
2768bbf3adSDavid Nugent  */
2868bbf3adSDavid Nugent 
298719c58fSMatthew Dillon #include <sys/cdefs.h>
308719c58fSMatthew Dillon __FBSDID("$FreeBSD$");
318719c58fSMatthew Dillon 
3268bbf3adSDavid Nugent #include <sys/types.h>
3368bbf3adSDavid Nugent #include <sys/time.h>
3468bbf3adSDavid Nugent #include <sys/resource.h>
3568bbf3adSDavid Nugent #include <sys/param.h>
360ebec5d3SMark Murray #include <errno.h>
370ebec5d3SMark Murray #include <fcntl.h>
3856c04344SDavid Nugent #include <libutil.h>
3968bbf3adSDavid Nugent #include <login_cap.h>
400ebec5d3SMark Murray #include <pwd.h>
410ebec5d3SMark Murray #include <stdio.h>
420ebec5d3SMark Murray #include <stdlib.h>
430ebec5d3SMark Murray #include <string.h>
440ebec5d3SMark Murray #include <syslog.h>
450ebec5d3SMark Murray #include <unistd.h>
4668bbf3adSDavid Nugent 
4756c04344SDavid Nugent /*
4856c04344SDavid Nugent  * allocstr()
4956c04344SDavid Nugent  * Manage a single static pointer for handling a local char* buffer,
5056c04344SDavid Nugent  * resizing as necessary to contain the string.
5156c04344SDavid Nugent  *
5256c04344SDavid Nugent  * allocarray()
5356c04344SDavid Nugent  * Manage a static array for handling a group of strings, resizing
5456c04344SDavid Nugent  * when necessary.
5556c04344SDavid Nugent  */
5668bbf3adSDavid Nugent 
5768bbf3adSDavid Nugent static int lc_object_count = 0;
5868bbf3adSDavid Nugent 
5968bbf3adSDavid Nugent static size_t internal_stringsz = 0;
6068bbf3adSDavid Nugent static char * internal_string = NULL;
6168bbf3adSDavid Nugent static size_t internal_arraysz = 0;
62547fa0d9SMark Murray static const char ** internal_array = NULL;
6368bbf3adSDavid Nugent 
6468bbf3adSDavid Nugent static char *
65547fa0d9SMark Murray allocstr(const char *str)
6668bbf3adSDavid Nugent {
6768bbf3adSDavid Nugent     char    *p;
6856c04344SDavid Nugent 
6968bbf3adSDavid Nugent     size_t sz = strlen(str) + 1;	/* realloc() only if necessary */
7068bbf3adSDavid Nugent     if (sz <= internal_stringsz)
711c594de5SDavid Nugent 	p = strcpy(internal_string, str);
7268bbf3adSDavid Nugent     else if ((p = realloc(internal_string, sz)) != NULL) {
7368bbf3adSDavid Nugent 	internal_stringsz = sz;
7468bbf3adSDavid Nugent 	internal_string = strcpy(p, str);
7568bbf3adSDavid Nugent     }
7668bbf3adSDavid Nugent     return p;
7768bbf3adSDavid Nugent }
7868bbf3adSDavid Nugent 
7956c04344SDavid Nugent 
80547fa0d9SMark Murray static const char **
8168bbf3adSDavid Nugent allocarray(size_t sz)
8268bbf3adSDavid Nugent {
83547fa0d9SMark Murray     static const char    **p;
8456c04344SDavid Nugent 
8568bbf3adSDavid Nugent     if (sz <= internal_arraysz)
8668bbf3adSDavid Nugent 	p = internal_array;
8768bbf3adSDavid Nugent     else if ((p = realloc(internal_array, sz * sizeof(char*))) != NULL) {
8868bbf3adSDavid Nugent 	internal_arraysz = sz;
8968bbf3adSDavid Nugent 	internal_array = p;
9068bbf3adSDavid Nugent     }
9168bbf3adSDavid Nugent     return p;
9268bbf3adSDavid Nugent }
9368bbf3adSDavid Nugent 
9468bbf3adSDavid Nugent 
9568bbf3adSDavid Nugent /*
9668bbf3adSDavid Nugent  * arrayize()
979a01d32bSJeroen Ruigrok van der Werven  * Turn a simple string <str> separated by any of
9868bbf3adSDavid Nugent  * the set of <chars> into an array.  The last element
9968bbf3adSDavid Nugent  * of the array will be NULL, as is proper.
10068bbf3adSDavid Nugent  * Free using freearraystr()
10168bbf3adSDavid Nugent  */
10268bbf3adSDavid Nugent 
103547fa0d9SMark Murray static const char **
104547fa0d9SMark Murray arrayize(const char *str, const char *chars, int *size)
10568bbf3adSDavid Nugent {
10668bbf3adSDavid Nugent     int	    i;
10705bcd1d0SPeter Wemm     char *ptr;
10805bcd1d0SPeter Wemm     const char *cptr;
109547fa0d9SMark Murray     const char **res = NULL;
11068bbf3adSDavid Nugent 
11156c04344SDavid Nugent     /* count the sub-strings */
11205bcd1d0SPeter Wemm     for (i = 0, cptr = str; *cptr; i++) {
11305bcd1d0SPeter Wemm 	int count = strcspn(cptr, chars);
11405bcd1d0SPeter Wemm 	cptr += count;
11505bcd1d0SPeter Wemm 	if (*cptr)
11605bcd1d0SPeter Wemm 	    ++cptr;
11768bbf3adSDavid Nugent     }
11868bbf3adSDavid Nugent 
11956c04344SDavid Nugent     /* alloc the array */
12056c04344SDavid Nugent     if ((ptr = allocstr(str)) != NULL) {
12156c04344SDavid Nugent 	if ((res = allocarray(++i)) == NULL)
12205bcd1d0SPeter Wemm 	    free((void *)(uintptr_t)(const void *)str);
12356c04344SDavid Nugent 	else {
12456c04344SDavid Nugent 	    /* now split the string */
1255f3a7367SDavid Nugent 	    i = 0;
12656c04344SDavid Nugent 	    while (*ptr) {
12768bbf3adSDavid Nugent 		int count = strcspn(ptr, chars);
12856c04344SDavid Nugent 		res[i++] = ptr;
12968bbf3adSDavid Nugent 		ptr += count;
13068bbf3adSDavid Nugent 		if (*ptr)
13168bbf3adSDavid Nugent 		    *ptr++ = '\0';
13268bbf3adSDavid Nugent 	    }
13356c04344SDavid Nugent 	    res[i] = NULL;
13468bbf3adSDavid Nugent 	}
13556c04344SDavid Nugent     }
13656c04344SDavid Nugent 
13768bbf3adSDavid Nugent     if (size)
13868bbf3adSDavid Nugent 	*size = i;
13956c04344SDavid Nugent 
14068bbf3adSDavid Nugent     return res;
14168bbf3adSDavid Nugent }
14268bbf3adSDavid Nugent 
14356c04344SDavid Nugent 
14468bbf3adSDavid Nugent /*
14568bbf3adSDavid Nugent  * login_close()
14668bbf3adSDavid Nugent  * Frees up all resources relating to a login class
14768bbf3adSDavid Nugent  *
14868bbf3adSDavid Nugent  */
14968bbf3adSDavid Nugent 
15068bbf3adSDavid Nugent void
15168bbf3adSDavid Nugent login_close(login_cap_t * lc)
15268bbf3adSDavid Nugent {
15368bbf3adSDavid Nugent     if (lc) {
15468bbf3adSDavid Nugent 	free(lc->lc_style);
15568bbf3adSDavid Nugent 	free(lc->lc_class);
1563f81737fSTim Vanderhoek 	free(lc->lc_cap);
15768bbf3adSDavid Nugent 	free(lc);
15868bbf3adSDavid Nugent 	if (--lc_object_count == 0) {
15968bbf3adSDavid Nugent 	    free(internal_string);
1602955fda4SDavid Nugent 	    free(internal_array);
16168bbf3adSDavid Nugent 	    internal_array = NULL;
16251706563SDavid Nugent 	    internal_arraysz = 0;
16368bbf3adSDavid Nugent 	    internal_string = NULL;
16451706563SDavid Nugent 	    internal_stringsz = 0;
16568bbf3adSDavid Nugent 	    cgetclose();
16668bbf3adSDavid Nugent 	}
16768bbf3adSDavid Nugent     }
16868bbf3adSDavid Nugent }
16968bbf3adSDavid Nugent 
17068bbf3adSDavid Nugent 
17168bbf3adSDavid Nugent /*
17268bbf3adSDavid Nugent  * login_getclassbyname() get the login class by its name.
17368bbf3adSDavid Nugent  * If the name given is NULL or empty, the default class
17468bbf3adSDavid Nugent  * LOGIN_DEFCLASS (ie. "default") is fetched. If the
17594cf9da0SDiomidis Spinellis  * 'pwd' argument is non-NULL and contains an non-NULL
17694cf9da0SDiomidis Spinellis  * dir entry, then the file _FILE_LOGIN_CONF is picked
17794cf9da0SDiomidis Spinellis  * up from that directory and used before the system
17894cf9da0SDiomidis Spinellis  * login database.
17968bbf3adSDavid Nugent  * Return a filled-out login_cap_t structure, including
18068bbf3adSDavid Nugent  * class name, and the capability record buffer.
18168bbf3adSDavid Nugent  */
18268bbf3adSDavid Nugent 
18368bbf3adSDavid Nugent login_cap_t *
18456c04344SDavid Nugent login_getclassbyname(char const *name, const struct passwd *pwd)
18568bbf3adSDavid Nugent {
18656c04344SDavid Nugent     login_cap_t	*lc;
18768bbf3adSDavid Nugent 
18856c04344SDavid Nugent     if ((lc = malloc(sizeof(login_cap_t))) != NULL) {
189e36b245cSAndrey A. Chernov 	int         r, me, i = 0;
1908a2deaa1SAndrey A. Chernov 	uid_t euid = 0;
1918a2deaa1SAndrey A. Chernov 	gid_t egid = 0;
19256c04344SDavid Nugent 	const char  *msg = NULL;
193e36b245cSAndrey A. Chernov 	const char  *dir;
19468bbf3adSDavid Nugent 	char	    userpath[MAXPATHLEN];
19556c04344SDavid Nugent 
19605bcd1d0SPeter Wemm 	static char *login_dbarray[] = { NULL, NULL, NULL };
19768bbf3adSDavid Nugent 
198e36b245cSAndrey A. Chernov 	me = (name != NULL && strcmp(name, LOGIN_MECLASS) == 0);
199e36b245cSAndrey A. Chernov 	dir = (!me || pwd == NULL) ? NULL : pwd->pw_dir;
2008df8b73fSRobert Watson 	/*
2018df8b73fSRobert Watson 	 * Switch to user mode before checking/reading its ~/.login_conf
2028df8b73fSRobert Watson 	 * - some NFSes have root read access disabled.
2038df8b73fSRobert Watson 	 *
2048df8b73fSRobert Watson 	 * XXX: This fails to configure additional groups.
2058df8b73fSRobert Watson 	 */
2068a2deaa1SAndrey A. Chernov 	if (dir) {
207ae702574SAndrey A. Chernov 	    euid = geteuid();
208ae702574SAndrey A. Chernov 	    egid = getegid();
209ae702574SAndrey A. Chernov 	    (void)setegid(pwd->pw_gid);
210ae702574SAndrey A. Chernov 	    (void)seteuid(pwd->pw_uid);
2118a2deaa1SAndrey A. Chernov 	}
212ae702574SAndrey A. Chernov 
21356c04344SDavid Nugent 	if (dir && snprintf(userpath, MAXPATHLEN, "%s/%s", dir,
21456c04344SDavid Nugent 			    _FILE_LOGIN_CONF) < MAXPATHLEN) {
21556c04344SDavid Nugent 	    login_dbarray[i] = userpath;
21656c04344SDavid Nugent 	    if (_secure_path(userpath, pwd->pw_uid, pwd->pw_gid) != -1)
21756c04344SDavid Nugent 		i++;		/* only use 'secure' data */
21856c04344SDavid Nugent 	}
21956c04344SDavid Nugent 	if (_secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
22068bbf3adSDavid Nugent 	    login_dbarray[i++] = _PATH_LOGIN_CONF;
22168bbf3adSDavid Nugent 	login_dbarray[i] = NULL;
22268bbf3adSDavid Nugent 
22356c04344SDavid Nugent 	memset(lc, 0, sizeof(login_cap_t));
22468bbf3adSDavid Nugent 	lc->lc_cap = lc->lc_class = lc->lc_style = NULL;
22568bbf3adSDavid Nugent 
22656c04344SDavid Nugent 	if (name == NULL || *name == '\0')
22756c04344SDavid Nugent 	    name = LOGIN_DEFCLASS;
22868bbf3adSDavid Nugent 
229547fa0d9SMark Murray 	switch (cgetent(&lc->lc_cap, login_dbarray, name)) {
23056c04344SDavid Nugent 	case -1:		/* Failed, entry does not exist */
231e36b245cSAndrey A. Chernov 	    if (me)
23256c04344SDavid Nugent 		break;	/* Don't retry default on 'me' */
23356c04344SDavid Nugent 	    if (i == 0)
23456c04344SDavid Nugent 	        r = -1;
23556c04344SDavid Nugent 	    else if ((r = open(login_dbarray[0], O_RDONLY)) >= 0)
23656c04344SDavid Nugent 	        close(r);
23756c04344SDavid Nugent 	    /*
23856c04344SDavid Nugent 	     * If there's at least one login class database,
23956c04344SDavid Nugent 	     * and we aren't searching for a default class
24056c04344SDavid Nugent 	     * then complain about a non-existent class.
24156c04344SDavid Nugent 	     */
24256c04344SDavid Nugent 	    if (r >= 0 || strcmp(name, LOGIN_DEFCLASS) != 0)
24356c04344SDavid Nugent 		syslog(LOG_ERR, "login_getclass: unknown class '%s'", name);
24456c04344SDavid Nugent 	    /* fall-back to default class */
24556c04344SDavid Nugent 	    name = LOGIN_DEFCLASS;
24656c04344SDavid Nugent 	    msg = "%s: no default/fallback class '%s'";
247547fa0d9SMark Murray 	    if (cgetent(&lc->lc_cap, login_dbarray, name) != 0 && r >= 0)
24856c04344SDavid Nugent 		break;
2497fed38d0SPhilippe Charnier 	    /* FALLTHROUGH - just return system defaults */
25056c04344SDavid Nugent 	case 0:		/* success! */
25156c04344SDavid Nugent 	    if ((lc->lc_class = strdup(name)) != NULL) {
2528a2deaa1SAndrey A. Chernov 		if (dir) {
253ae702574SAndrey A. Chernov 		    (void)seteuid(euid);
254ae702574SAndrey A. Chernov 		    (void)setegid(egid);
2558a2deaa1SAndrey A. Chernov 		}
25656c04344SDavid Nugent 		++lc_object_count;
25768bbf3adSDavid Nugent 		return lc;
25868bbf3adSDavid Nugent 	    }
25956c04344SDavid Nugent 	    msg = "%s: strdup: %m";
26056c04344SDavid Nugent 	    break;
26156c04344SDavid Nugent 	case -2:
26256c04344SDavid Nugent 	    msg = "%s: retrieving class information: %m";
26356c04344SDavid Nugent 	    break;
26456c04344SDavid Nugent 	case -3:
26556c04344SDavid Nugent 	    msg = "%s: 'tc=' reference loop '%s'";
26656c04344SDavid Nugent 	    break;
26756c04344SDavid Nugent 	case 1:
26856c04344SDavid Nugent 	    msg = "couldn't resolve 'tc=' reference in '%s'";
26956c04344SDavid Nugent 	    break;
27056c04344SDavid Nugent 	default:
27156c04344SDavid Nugent 	    msg = "%s: unexpected cgetent() error '%s': %m";
27256c04344SDavid Nugent 	    break;
27356c04344SDavid Nugent 	}
2748a2deaa1SAndrey A. Chernov 	if (dir) {
275ae702574SAndrey A. Chernov 	    (void)seteuid(euid);
276ae702574SAndrey A. Chernov 	    (void)setegid(egid);
2778a2deaa1SAndrey A. Chernov 	}
27856c04344SDavid Nugent 	if (msg != NULL)
27956c04344SDavid Nugent 	    syslog(LOG_ERR, msg, "login_getclass", name);
28056c04344SDavid Nugent 	free(lc);
28156c04344SDavid Nugent     }
28268bbf3adSDavid Nugent 
28356c04344SDavid Nugent     return NULL;
28456c04344SDavid Nugent }
28556c04344SDavid Nugent 
28656c04344SDavid Nugent 
28756c04344SDavid Nugent 
28856c04344SDavid Nugent /*
28956c04344SDavid Nugent  * login_getclass()
29056c04344SDavid Nugent  * Get the login class for the system (only) login class database.
29156c04344SDavid Nugent  * Return a filled-out login_cap_t structure, including
29256c04344SDavid Nugent  * class name, and the capability record buffer.
29356c04344SDavid Nugent  */
29456c04344SDavid Nugent 
29556c04344SDavid Nugent login_cap_t *
29656c04344SDavid Nugent login_getclass(const char *cls)
29756c04344SDavid Nugent {
29856c04344SDavid Nugent     return login_getclassbyname(cls, NULL);
29956c04344SDavid Nugent }
30068bbf3adSDavid Nugent 
30168bbf3adSDavid Nugent 
30268bbf3adSDavid Nugent /*
30368bbf3adSDavid Nugent  * login_getclass()
30468bbf3adSDavid Nugent  * Get the login class for a given password entry from
30568bbf3adSDavid Nugent  * the system (only) login class database.
30668bbf3adSDavid Nugent  * If the password entry's class field is not set, or
30768bbf3adSDavid Nugent  * the class specified does not exist, then use the
30868bbf3adSDavid Nugent  * default of LOGIN_DEFCLASS (ie. "default").
30968bbf3adSDavid Nugent  * Return a filled-out login_cap_t structure, including
31068bbf3adSDavid Nugent  * class name, and the capability record buffer.
31168bbf3adSDavid Nugent  */
31268bbf3adSDavid Nugent 
31368bbf3adSDavid Nugent login_cap_t *
31456c04344SDavid Nugent login_getpwclass(const struct passwd *pwd)
31568bbf3adSDavid Nugent {
31656c04344SDavid Nugent     const char	*cls = NULL;
31756c04344SDavid Nugent 
3181c594de5SDavid Nugent     if (pwd != NULL) {
31956c04344SDavid Nugent 	cls = pwd->pw_class;
32056c04344SDavid Nugent 	if (cls == NULL || *cls == '\0')
32156c04344SDavid Nugent 	    cls = (pwd->pw_uid == 0) ? LOGIN_DEFROOTCLASS : LOGIN_DEFCLASS;
3222dc7d862SDavid Nugent     }
32356c04344SDavid Nugent     return login_getclassbyname(cls, pwd);
32468bbf3adSDavid Nugent }
32568bbf3adSDavid Nugent 
32668bbf3adSDavid Nugent 
32768bbf3adSDavid Nugent /*
32868bbf3adSDavid Nugent  * login_getuserclass()
32968bbf3adSDavid Nugent  * Get the login class for a given password entry, allowing user
33068bbf3adSDavid Nugent  * overrides via ~/.login_conf.
33168bbf3adSDavid Nugent  */
33268bbf3adSDavid Nugent 
33368bbf3adSDavid Nugent login_cap_t *
33468bbf3adSDavid Nugent login_getuserclass(const struct passwd *pwd)
33568bbf3adSDavid Nugent {
33656c04344SDavid Nugent     return login_getclassbyname(LOGIN_MECLASS, pwd);
33768bbf3adSDavid Nugent }
33868bbf3adSDavid Nugent 
33968bbf3adSDavid Nugent 
34068bbf3adSDavid Nugent 
34168bbf3adSDavid Nugent /*
34268bbf3adSDavid Nugent  * login_getcapstr()
34368bbf3adSDavid Nugent  * Given a login_cap entry, and a capability name, return the
34468bbf3adSDavid Nugent  * value defined for that capability, a defualt if not found, or
34568bbf3adSDavid Nugent  * an error string on error.
34668bbf3adSDavid Nugent  */
34768bbf3adSDavid Nugent 
348b00ba4ccSRuslan Ermilov const char *
349b00ba4ccSRuslan Ermilov login_getcapstr(login_cap_t *lc, const char *cap, const char *def, const char *error)
35068bbf3adSDavid Nugent {
35168bbf3adSDavid Nugent     char    *res;
35268bbf3adSDavid Nugent     int	    ret;
35368bbf3adSDavid Nugent 
35468bbf3adSDavid Nugent     if (lc == NULL || cap == NULL || lc->lc_cap == NULL || *cap == '\0')
35568bbf3adSDavid Nugent 	return def;
35668bbf3adSDavid Nugent 
357547fa0d9SMark Murray     if ((ret = cgetstr(lc->lc_cap, cap, &res)) == -1)
35868bbf3adSDavid Nugent 	return def;
35956c04344SDavid Nugent     return (ret >= 0) ? res : error;
36068bbf3adSDavid Nugent }
36168bbf3adSDavid Nugent 
36268bbf3adSDavid Nugent 
36368bbf3adSDavid Nugent /*
36468bbf3adSDavid Nugent  * login_getcaplist()
36568bbf3adSDavid Nugent  * Given a login_cap entry, and a capability name, return the
36668bbf3adSDavid Nugent  * value defined for that capability split into an array of
36768bbf3adSDavid Nugent  * strings.
36868bbf3adSDavid Nugent  */
36968bbf3adSDavid Nugent 
370547fa0d9SMark Murray const char **
37168bbf3adSDavid Nugent login_getcaplist(login_cap_t *lc, const char *cap, const char *chars)
37268bbf3adSDavid Nugent {
373547fa0d9SMark Murray     const char *lstring;
37468bbf3adSDavid Nugent 
37568bbf3adSDavid Nugent     if (chars == NULL)
376f01e3989SDavid Nugent 	chars = ", \t";
377547fa0d9SMark Murray     if ((lstring = login_getcapstr(lc, cap, NULL, NULL)) != NULL)
37868bbf3adSDavid Nugent 	return arrayize(lstring, chars, NULL);
37968bbf3adSDavid Nugent     return NULL;
38068bbf3adSDavid Nugent }
38168bbf3adSDavid Nugent 
38268bbf3adSDavid Nugent 
38368bbf3adSDavid Nugent /*
38468bbf3adSDavid Nugent  * login_getpath()
38568bbf3adSDavid Nugent  * From the login_cap_t <lc>, get the capability <cap> which is
38668bbf3adSDavid Nugent  * formatted as either a space or comma delimited list of paths
38768bbf3adSDavid Nugent  * and append them all into a string and separate by semicolons.
38868bbf3adSDavid Nugent  * If there is an error of any kind, return <error>.
38968bbf3adSDavid Nugent  */
39068bbf3adSDavid Nugent 
391b00ba4ccSRuslan Ermilov const char *
392b00ba4ccSRuslan Ermilov login_getpath(login_cap_t *lc, const char *cap, const char *error)
39368bbf3adSDavid Nugent {
394b00ba4ccSRuslan Ermilov     const char *str;
395547fa0d9SMark Murray     char *ptr;
396547fa0d9SMark Murray     int count;
39768bbf3adSDavid Nugent 
398547fa0d9SMark Murray     str = login_getcapstr(lc, cap, NULL, NULL);
399547fa0d9SMark Murray     if (str == NULL)
400547fa0d9SMark Murray 	return error;
401547fa0d9SMark Murray     ptr = __DECONST(char *, str); /* XXXX Yes, very dodgy */
40268bbf3adSDavid Nugent     while (*ptr) {
403547fa0d9SMark Murray 	count = strcspn(ptr, ", \t");
40468bbf3adSDavid Nugent 	ptr += count;
40568bbf3adSDavid Nugent 	if (*ptr)
40668bbf3adSDavid Nugent 	    *ptr++ = ':';
40768bbf3adSDavid Nugent     }
40868bbf3adSDavid Nugent     return str;
40968bbf3adSDavid Nugent }
41068bbf3adSDavid Nugent 
41168bbf3adSDavid Nugent 
41256c04344SDavid Nugent static int
41356c04344SDavid Nugent isinfinite(const char *s)
41456c04344SDavid Nugent {
41556c04344SDavid Nugent     static const char *infs[] = {
41656c04344SDavid Nugent 	"infinity",
41756c04344SDavid Nugent 	"inf",
41856c04344SDavid Nugent 	"unlimited",
41956c04344SDavid Nugent 	"unlimit",
42056c04344SDavid Nugent 	"-1",
42156c04344SDavid Nugent 	NULL
42256c04344SDavid Nugent     };
42356c04344SDavid Nugent     const char **i = &infs[0];
42456c04344SDavid Nugent 
42556c04344SDavid Nugent     while (*i != NULL) {
42656c04344SDavid Nugent 	if (strcasecmp(s, *i) == 0)
42756c04344SDavid Nugent 	    return 1;
42856c04344SDavid Nugent 	++i;
42956c04344SDavid Nugent     }
43056c04344SDavid Nugent     return 0;
43156c04344SDavid Nugent }
43256c04344SDavid Nugent 
43356c04344SDavid Nugent 
43456c04344SDavid Nugent static u_quad_t
43556c04344SDavid Nugent rmultiply(u_quad_t n1, u_quad_t n2)
43656c04344SDavid Nugent {
43756c04344SDavid Nugent     u_quad_t	m, r;
43856c04344SDavid Nugent     int		b1, b2;
43956c04344SDavid Nugent 
44056c04344SDavid Nugent     static int bpw = 0;
44156c04344SDavid Nugent 
44256c04344SDavid Nugent     /* Handle simple cases */
44356c04344SDavid Nugent     if (n1 == 0 || n2 == 0)
44456c04344SDavid Nugent 	return 0;
44556c04344SDavid Nugent     if (n1 == 1)
44656c04344SDavid Nugent 	return n2;
44756c04344SDavid Nugent     if (n2 == 1)
44856c04344SDavid Nugent 	return n1;
44956c04344SDavid Nugent 
45056c04344SDavid Nugent     /*
45156c04344SDavid Nugent      * sizeof() returns number of bytes needed for storage.
45256c04344SDavid Nugent      * This may be different from the actual number of useful bits.
45356c04344SDavid Nugent      */
45456c04344SDavid Nugent     if (!bpw) {
45556c04344SDavid Nugent 	bpw = sizeof(u_quad_t) * 8;
45656c04344SDavid Nugent 	while (((u_quad_t)1 << (bpw-1)) == 0)
45756c04344SDavid Nugent 	    --bpw;
45856c04344SDavid Nugent     }
45956c04344SDavid Nugent 
46056c04344SDavid Nugent     /*
46156c04344SDavid Nugent      * First check the magnitude of each number. If the sum of the
46256c04344SDavid Nugent      * magnatude is way to high, reject the number. (If this test
46356c04344SDavid Nugent      * is not done then the first multiply below may overflow.)
46456c04344SDavid Nugent      */
46556c04344SDavid Nugent     for (b1 = bpw; (((u_quad_t)1 << (b1-1)) & n1) == 0; --b1)
46656c04344SDavid Nugent 	;
46756c04344SDavid Nugent     for (b2 = bpw; (((u_quad_t)1 << (b2-1)) & n2) == 0; --b2)
46856c04344SDavid Nugent 	;
46956c04344SDavid Nugent     if (b1 + b2 - 2 > bpw) {
47056c04344SDavid Nugent 	errno = ERANGE;
47156c04344SDavid Nugent 	return (UQUAD_MAX);
47256c04344SDavid Nugent     }
47356c04344SDavid Nugent 
47456c04344SDavid Nugent     /*
47556c04344SDavid Nugent      * Decompose the multiplication to be:
47656c04344SDavid Nugent      * h1 = n1 & ~1
47756c04344SDavid Nugent      * h2 = n2 & ~1
47856c04344SDavid Nugent      * l1 = n1 & 1
47956c04344SDavid Nugent      * l2 = n2 & 1
48056c04344SDavid Nugent      * (h1 + l1) * (h2 + l2)
48156c04344SDavid Nugent      * (h1 * h2) + (h1 * l2) + (l1 * h2) + (l1 * l2)
48256c04344SDavid Nugent      *
48356c04344SDavid Nugent      * Since h1 && h2 do not have the low bit set, we can then say:
48456c04344SDavid Nugent      *
48556c04344SDavid Nugent      * (h1>>1 * h2>>1 * 4) + ...
48656c04344SDavid Nugent      *
48756c04344SDavid Nugent      * So if (h1>>1 * h2>>1) > (1<<(bpw - 2)) then the result will
48856c04344SDavid Nugent      * overflow.
48956c04344SDavid Nugent      *
49056c04344SDavid Nugent      * Finally, if MAX - ((h1 * l2) + (l1 * h2) + (l1 * l2)) < (h1*h2)
49156c04344SDavid Nugent      * then adding in residual amout will cause an overflow.
49256c04344SDavid Nugent      */
49356c04344SDavid Nugent 
49456c04344SDavid Nugent     m = (n1 >> 1) * (n2 >> 1);
49556c04344SDavid Nugent     if (m >= ((u_quad_t)1 << (bpw-2))) {
49656c04344SDavid Nugent 	errno = ERANGE;
49756c04344SDavid Nugent 	return (UQUAD_MAX);
49856c04344SDavid Nugent     }
49956c04344SDavid Nugent     m *= 4;
50056c04344SDavid Nugent 
50156c04344SDavid Nugent     r = (n1 & n2 & 1)
50256c04344SDavid Nugent 	+ (n2 & 1) * (n1 & ~(u_quad_t)1)
50356c04344SDavid Nugent 	+ (n1 & 1) * (n2 & ~(u_quad_t)1);
50456c04344SDavid Nugent 
50556c04344SDavid Nugent     if ((u_quad_t)(m + r) < m) {
50656c04344SDavid Nugent 	errno = ERANGE;
50756c04344SDavid Nugent 	return (UQUAD_MAX);
50856c04344SDavid Nugent     }
50956c04344SDavid Nugent     m += r;
51056c04344SDavid Nugent 
51156c04344SDavid Nugent     return (m);
51256c04344SDavid Nugent }
51356c04344SDavid Nugent 
51456c04344SDavid Nugent 
51568bbf3adSDavid Nugent /*
51668bbf3adSDavid Nugent  * login_getcaptime()
51768bbf3adSDavid Nugent  * From the login_cap_t <lc>, get the capability <cap>, which is
51868bbf3adSDavid Nugent  * formatted as a time (e.g., "<cap>=10h3m2s").  If <cap> is not
51968bbf3adSDavid Nugent  * present in <lc>, return <def>; if there is an error of some kind,
52068bbf3adSDavid Nugent  * return <error>.
52168bbf3adSDavid Nugent  */
52268bbf3adSDavid Nugent 
52368bbf3adSDavid Nugent rlim_t
52468bbf3adSDavid Nugent login_getcaptime(login_cap_t *lc, const char *cap, rlim_t def, rlim_t error)
52568bbf3adSDavid Nugent {
52656c04344SDavid Nugent     char    *res, *ep, *oval;
52756c04344SDavid Nugent     int	    r;
52851706563SDavid Nugent     rlim_t  tot;
52968bbf3adSDavid Nugent 
53068bbf3adSDavid Nugent     errno = 0;
53168bbf3adSDavid Nugent     if (lc == NULL || lc->lc_cap == NULL)
53268bbf3adSDavid Nugent 	return def;
53368bbf3adSDavid Nugent 
53468bbf3adSDavid Nugent     /*
53568bbf3adSDavid Nugent      * Look for <cap> in lc_cap.
53668bbf3adSDavid Nugent      * If it's not there (-1), return <def>.
53768bbf3adSDavid Nugent      * If there's an error, return <error>.
53868bbf3adSDavid Nugent      */
53968bbf3adSDavid Nugent 
540547fa0d9SMark Murray     if ((r = cgetstr(lc->lc_cap, cap, &res)) == -1)
54168bbf3adSDavid Nugent 	return def;
54256c04344SDavid Nugent     else if (r < 0) {
54356c04344SDavid Nugent 	errno = ERANGE;
54468bbf3adSDavid Nugent 	return error;
54556c04344SDavid Nugent     }
54668bbf3adSDavid Nugent 
54756c04344SDavid Nugent     /* "inf" and "infinity" are special cases */
54856c04344SDavid Nugent     if (isinfinite(res))
54968bbf3adSDavid Nugent 	return RLIM_INFINITY;
55068bbf3adSDavid Nugent 
55168bbf3adSDavid Nugent     /*
55268bbf3adSDavid Nugent      * Now go through the string, turning something like 1h2m3s into
55368bbf3adSDavid Nugent      * an integral value.  Whee.
55468bbf3adSDavid Nugent      */
55568bbf3adSDavid Nugent 
55668bbf3adSDavid Nugent     errno = 0;
55751706563SDavid Nugent     tot = 0;
55856c04344SDavid Nugent     oval = res;
55968bbf3adSDavid Nugent     while (*res) {
56056c04344SDavid Nugent 	rlim_t tim = strtoq(res, &ep, 0);
56156c04344SDavid Nugent 	rlim_t mult = 1;
56256c04344SDavid Nugent 
56356c04344SDavid Nugent 	if (ep == NULL || ep == res || errno != 0) {
56456c04344SDavid Nugent 	invalid:
56556c04344SDavid Nugent 	    syslog(LOG_WARNING, "login_getcaptime: class '%s' bad value %s=%s",
56656c04344SDavid Nugent 		   lc->lc_class, cap, oval);
56756c04344SDavid Nugent 	    errno = ERANGE;
56868bbf3adSDavid Nugent 	    return error;
56968bbf3adSDavid Nugent 	}
57068bbf3adSDavid Nugent 	/* Look for suffixes */
57168bbf3adSDavid Nugent 	switch (*ep++) {
57268bbf3adSDavid Nugent 	case 0:
57356c04344SDavid Nugent 	    ep--;
57456c04344SDavid Nugent 	    break;	/* end of string */
57568bbf3adSDavid Nugent 	case 's': case 'S':	/* seconds */
57668bbf3adSDavid Nugent 	    break;
57768bbf3adSDavid Nugent 	case 'm': case 'M':	/* minutes */
57856c04344SDavid Nugent 	    mult = 60;
57968bbf3adSDavid Nugent 	    break;
58068bbf3adSDavid Nugent 	case 'h': case 'H':	/* hours */
58156c04344SDavid Nugent 	    mult = 60L * 60L;
58268bbf3adSDavid Nugent 	    break;
58368bbf3adSDavid Nugent 	case 'd': case 'D':	/* days */
58456c04344SDavid Nugent 	    mult = 60L * 60L * 24L;
58568bbf3adSDavid Nugent 	    break;
58668bbf3adSDavid Nugent 	case 'w': case 'W':	/* weeks */
58756c04344SDavid Nugent 	    mult = 60L * 60L * 24L * 7L;
588c2043f40SDavid Nugent 	    break;
58956c04344SDavid Nugent 	case 'y': case 'Y':	/* 365-day years */
59056c04344SDavid Nugent 	    mult = 60L * 60L * 24L * 365L;
591c2043f40SDavid Nugent 	    break;
59268bbf3adSDavid Nugent 	default:
59356c04344SDavid Nugent 	    goto invalid;
59468bbf3adSDavid Nugent 	}
59568bbf3adSDavid Nugent 	res = ep;
59656c04344SDavid Nugent 	tot += rmultiply(tim, mult);
59756c04344SDavid Nugent 	if (errno)
59856c04344SDavid Nugent 	    goto invalid;
59968bbf3adSDavid Nugent     }
60056c04344SDavid Nugent 
60168bbf3adSDavid Nugent     return tot;
60268bbf3adSDavid Nugent }
60368bbf3adSDavid Nugent 
60468bbf3adSDavid Nugent 
60568bbf3adSDavid Nugent /*
60668bbf3adSDavid Nugent  * login_getcapnum()
60768bbf3adSDavid Nugent  * From the login_cap_t <lc>, extract the numerical value <cap>.
60868bbf3adSDavid Nugent  * If it is not present, return <def> for a default, and return
60968bbf3adSDavid Nugent  * <error> if there is an error.
61068bbf3adSDavid Nugent  * Like login_getcaptime(), only it only converts to a number, not
61168bbf3adSDavid Nugent  * to a time; "infinity" and "inf" are 'special.'
61268bbf3adSDavid Nugent  */
61368bbf3adSDavid Nugent 
61468bbf3adSDavid Nugent rlim_t
61568bbf3adSDavid Nugent login_getcapnum(login_cap_t *lc, const char *cap, rlim_t def, rlim_t error)
61668bbf3adSDavid Nugent {
61768bbf3adSDavid Nugent     char    *ep, *res;
61856c04344SDavid Nugent     int	    r;
61968bbf3adSDavid Nugent     rlim_t  val;
62068bbf3adSDavid Nugent 
62168bbf3adSDavid Nugent     if (lc == NULL || lc->lc_cap == NULL)
62268bbf3adSDavid Nugent 	return def;
62368bbf3adSDavid Nugent 
62468bbf3adSDavid Nugent     /*
62568bbf3adSDavid Nugent      * For BSDI compatibility, try for the tag=<val> first
62668bbf3adSDavid Nugent      */
627547fa0d9SMark Murray     if ((r = cgetstr(lc->lc_cap, cap, &res)) == -1) {
62868bbf3adSDavid Nugent 	long	lval;
62956c04344SDavid Nugent 	/* string capability not present, so try for tag#<val> as numeric */
630547fa0d9SMark Murray 	if ((r = cgetnum(lc->lc_cap, cap, &lval)) == -1)
63168bbf3adSDavid Nugent 	    return def; /* Not there, so return default */
63256c04344SDavid Nugent 	else if (r >= 0)
63368bbf3adSDavid Nugent 	    return (rlim_t)lval;
63468bbf3adSDavid Nugent     }
63568bbf3adSDavid Nugent 
63656c04344SDavid Nugent     if (r < 0) {
63756c04344SDavid Nugent 	errno = ERANGE;
63856c04344SDavid Nugent 	return error;
63956c04344SDavid Nugent     }
64056c04344SDavid Nugent 
64156c04344SDavid Nugent     if (isinfinite(res))
64268bbf3adSDavid Nugent 	return RLIM_INFINITY;
64368bbf3adSDavid Nugent 
64468bbf3adSDavid Nugent     errno = 0;
64556c04344SDavid Nugent     val = strtoq(res, &ep, 0);
64656c04344SDavid Nugent     if (ep == NULL || ep == res || errno != 0) {
64756c04344SDavid Nugent 	syslog(LOG_WARNING, "login_getcapnum: class '%s' bad value %s=%s",
64856c04344SDavid Nugent 	       lc->lc_class, cap, res);
64956c04344SDavid Nugent 	errno = ERANGE;
65068bbf3adSDavid Nugent 	return error;
65156c04344SDavid Nugent     }
65256c04344SDavid Nugent 
65368bbf3adSDavid Nugent     return val;
65468bbf3adSDavid Nugent }
65568bbf3adSDavid Nugent 
65668bbf3adSDavid Nugent 
65756c04344SDavid Nugent 
65868bbf3adSDavid Nugent /*
65968bbf3adSDavid Nugent  * login_getcapsize()
66068bbf3adSDavid Nugent  * From the login_cap_t <lc>, extract the capability <cap>, which is
66168bbf3adSDavid Nugent  * formatted as a size (e.g., "<cap>=10M"); it can also be "infinity".
66268bbf3adSDavid Nugent  * If not present, return <def>, or <error> if there is an error of
66368bbf3adSDavid Nugent  * some sort.
66468bbf3adSDavid Nugent  */
66568bbf3adSDavid Nugent 
66668bbf3adSDavid Nugent rlim_t
66756c04344SDavid Nugent login_getcapsize(login_cap_t *lc, const char *cap, rlim_t def, rlim_t error)
66856c04344SDavid Nugent {
66956c04344SDavid Nugent     char    *ep, *res, *oval;
67056c04344SDavid Nugent     int	    r;
67156c04344SDavid Nugent     rlim_t  tot;
67268bbf3adSDavid Nugent 
67368bbf3adSDavid Nugent     if (lc == NULL || lc->lc_cap == NULL)
67468bbf3adSDavid Nugent 	return def;
67568bbf3adSDavid Nugent 
676547fa0d9SMark Murray     if ((r = cgetstr(lc->lc_cap, cap, &res)) == -1)
67768bbf3adSDavid Nugent 	return def;
67856c04344SDavid Nugent     else if (r < 0) {
67956c04344SDavid Nugent 	errno = ERANGE;
68068bbf3adSDavid Nugent 	return error;
68156c04344SDavid Nugent     }
68268bbf3adSDavid Nugent 
68356c04344SDavid Nugent     if (isinfinite(res))
68465f50b7fSAndrey A. Chernov 	return RLIM_INFINITY;
68565f50b7fSAndrey A. Chernov 
68668bbf3adSDavid Nugent     errno = 0;
68751706563SDavid Nugent     tot = 0;
68856c04344SDavid Nugent     oval = res;
68951706563SDavid Nugent     while (*res) {
69056c04344SDavid Nugent 	rlim_t siz = strtoq(res, &ep, 0);
69156c04344SDavid Nugent 	rlim_t mult = 1;
69256c04344SDavid Nugent 
69356c04344SDavid Nugent 	if (ep == NULL || ep == res || errno != 0) {
69456c04344SDavid Nugent 	invalid:
69556c04344SDavid Nugent 	    syslog(LOG_WARNING, "login_getcapsize: class '%s' bad value %s=%s",
69656c04344SDavid Nugent 		   lc->lc_class, cap, oval);
69756c04344SDavid Nugent 	    errno = ERANGE;
69868bbf3adSDavid Nugent 	    return error;
69956c04344SDavid Nugent 	}
700f9074e29SDavid Nugent 	switch (*ep++) {
70168bbf3adSDavid Nugent 	case 0:	/* end of string */
70251706563SDavid Nugent 	    ep--;
70351706563SDavid Nugent 	    break;
70468bbf3adSDavid Nugent 	case 'b': case 'B':	/* 512-byte blocks */
70556c04344SDavid Nugent 	    mult = 512;
70656c04344SDavid Nugent 	    break;
70768bbf3adSDavid Nugent 	case 'k': case 'K':	/* 1024-byte Kilobytes */
70856c04344SDavid Nugent 	    mult = 1024;
70956c04344SDavid Nugent 	    break;
71068bbf3adSDavid Nugent 	case 'm': case 'M':	/* 1024-k kbytes */
71156c04344SDavid Nugent 	    mult = 1024 * 1024;
71256c04344SDavid Nugent 	    break;
71368bbf3adSDavid Nugent 	case 'g': case 'G':	/* 1Gbyte */
71456c04344SDavid Nugent 	    mult = 1024 * 1024 * 1024;
71556c04344SDavid Nugent 	    break;
71668bbf3adSDavid Nugent 	case 't': case 'T':	/* 1TBte */
71756c04344SDavid Nugent 	    mult = 1024LL * 1024LL * 1024LL * 1024LL;
71856c04344SDavid Nugent 	    break;
71968bbf3adSDavid Nugent 	default:
72056c04344SDavid Nugent 	    goto invalid;
72168bbf3adSDavid Nugent 	}
722f9074e29SDavid Nugent 	res = ep;
72356c04344SDavid Nugent 	tot += rmultiply(siz, mult);
72456c04344SDavid Nugent 	if (errno)
72556c04344SDavid Nugent 	    goto invalid;
72651706563SDavid Nugent     }
72756c04344SDavid Nugent 
72851706563SDavid Nugent     return tot;
72968bbf3adSDavid Nugent }
73068bbf3adSDavid Nugent 
73168bbf3adSDavid Nugent 
73268bbf3adSDavid Nugent /*
73368bbf3adSDavid Nugent  * login_getcapbool()
73468bbf3adSDavid Nugent  * From the login_cap_t <lc>, check for the existance of the capability
73568bbf3adSDavid Nugent  * of <cap>.  Return <def> if <lc>->lc_cap is NULL, otherwise return
73668bbf3adSDavid Nugent  * the whether or not <cap> exists there.
73768bbf3adSDavid Nugent  */
73868bbf3adSDavid Nugent 
73968bbf3adSDavid Nugent int
74068bbf3adSDavid Nugent login_getcapbool(login_cap_t *lc, const char *cap, int def)
74168bbf3adSDavid Nugent {
74268bbf3adSDavid Nugent     if (lc == NULL || lc->lc_cap == NULL)
74368bbf3adSDavid Nugent 	return def;
744547fa0d9SMark Murray     return (cgetcap(lc->lc_cap, cap, ':') != NULL);
74568bbf3adSDavid Nugent }
74668bbf3adSDavid Nugent 
74768bbf3adSDavid Nugent 
74868bbf3adSDavid Nugent /*
74968bbf3adSDavid Nugent  * login_getstyle()
75068bbf3adSDavid Nugent  * Given a login_cap entry <lc>, and optionally a type of auth <auth>,
75168bbf3adSDavid Nugent  * and optionally a style <style>, find the style that best suits these
75268bbf3adSDavid Nugent  * rules:
75368bbf3adSDavid Nugent  *	1.  If <auth> is non-null, look for an "auth-<auth>=" string
75468bbf3adSDavid Nugent  *	in the capability; if not present, default to "auth=".
75568bbf3adSDavid Nugent  *	2.  If there is no auth list found from (1), default to
75668bbf3adSDavid Nugent  *	"passwd" as an authorization list.
75768bbf3adSDavid Nugent  *	3.  If <style> is non-null, look for <style> in the list of
75868bbf3adSDavid Nugent  *	authorization methods found from (2); if <style> is NULL, default
75968bbf3adSDavid Nugent  *	to LOGIN_DEFSTYLE ("passwd").
76068bbf3adSDavid Nugent  *	4.  If the chosen style is found in the chosen list of authorization
76168bbf3adSDavid Nugent  *	methods, return that; otherwise, return NULL.
76268bbf3adSDavid Nugent  * E.g.:
76368bbf3adSDavid Nugent  *     login_getstyle(lc, NULL, "ftp");
76468bbf3adSDavid Nugent  *     login_getstyle(lc, "login", NULL);
76568bbf3adSDavid Nugent  *     login_getstyle(lc, "skey", "network");
76668bbf3adSDavid Nugent  */
76768bbf3adSDavid Nugent 
768b00ba4ccSRuslan Ermilov const char *
769b00ba4ccSRuslan Ermilov login_getstyle(login_cap_t *lc, const char *style, const char *auth)
77068bbf3adSDavid Nugent {
77168bbf3adSDavid Nugent     int	    i;
772547fa0d9SMark Murray     const char **authtypes = NULL;
77368bbf3adSDavid Nugent     char    *auths= NULL;
77468bbf3adSDavid Nugent     char    realauth[64];
77568bbf3adSDavid Nugent 
776547fa0d9SMark Murray     static const char *defauthtypes[] = { LOGIN_DEFSTYLE, NULL };
77768bbf3adSDavid Nugent 
77856c04344SDavid Nugent     if (auth != NULL && *auth != '\0') {
779547fa0d9SMark Murray 	if (snprintf(realauth, sizeof realauth, "auth-%s", auth) < (int)sizeof(realauth))
78068bbf3adSDavid Nugent 	    authtypes = login_getcaplist(lc, realauth, NULL);
78156c04344SDavid Nugent     }
78268bbf3adSDavid Nugent 
78368bbf3adSDavid Nugent     if (authtypes == NULL)
78468bbf3adSDavid Nugent 	authtypes = login_getcaplist(lc, "auth", NULL);
78568bbf3adSDavid Nugent 
78668bbf3adSDavid Nugent     if (authtypes == NULL)
78768bbf3adSDavid Nugent 	authtypes = defauthtypes;
78868bbf3adSDavid Nugent 
78968bbf3adSDavid Nugent     /*
7909a01d32bSJeroen Ruigrok van der Werven      * We have at least one authtype now; auths is a comma-separated
79168bbf3adSDavid Nugent      * (or space-separated) list of authentication types.  We have to
79268bbf3adSDavid Nugent      * convert from this to an array of char*'s; authtypes then gets this.
79368bbf3adSDavid Nugent      */
79468bbf3adSDavid Nugent     i = 0;
79568bbf3adSDavid Nugent     if (style != NULL && *style != '\0') {
79668bbf3adSDavid Nugent 	while (authtypes[i] != NULL && strcmp(style, authtypes[i]) != 0)
79768bbf3adSDavid Nugent 	    i++;
79868bbf3adSDavid Nugent     }
79956c04344SDavid Nugent 
80068bbf3adSDavid Nugent     lc->lc_style = NULL;
80168bbf3adSDavid Nugent     if (authtypes[i] != NULL && (auths = strdup(authtypes[i])) != NULL)
80268bbf3adSDavid Nugent 	lc->lc_style = auths;
80368bbf3adSDavid Nugent 
80456c04344SDavid Nugent     if (lc->lc_style != NULL)
80556c04344SDavid Nugent 	lc->lc_style = strdup(lc->lc_style);
80656c04344SDavid Nugent 
80768bbf3adSDavid Nugent     return lc->lc_style;
80868bbf3adSDavid Nugent }
809