pam_unix: Use pam_get_authtok() instead of direct pam_prompt() calls.

We have to drop support for not_set_pass option which is not much useful
anyway. Instead we get proper support for authtok_type option.

* modules/pam_unix/pam_unix.8.xml: Removed not_set_pass option, added authtok_ty
pe
option.
* modules/pam_unix/pam_unix_auth.c (pam_sm_authenticate): Replace _unix_read_pas
sword()
call with equivalent pam_get_authtok() call.
* modules/pam_unix/pam_unix_passwd.c (pam_sm_chauthtok): Likewise and also drop
support for not_set_pass.
* modules/pam_unix/support.c (_unix_read_password): Remove.
* modules/pam_unix/support.h: Remove UNIX_NOT_SET_PASS add UNIX_AUTHTOK_TYPE.

1 files changed, 0 insertions, 154 deletions

diff --git a/modules/pam_unix/support.c b/modules/pam_unix/support.c
index 0fd1dba4..fc8595e9 100644
--- a/modules/pam_unix/support.c
+++ b/modules/pam_unix/support.c
@@ -853,160 +853,6 @@ cleanup:
 	return retval;
 }
 
-/*
- * obtain a password from the user
- */
-
-int _unix_read_password(pam_handle_t * pamh
-			,unsigned int ctrl
-			,const char *comment
-			,const char *prompt1
-			,const char *prompt2
-			,const char *data_name
-			,const void **pass)
-{
-	int authtok_flag;
-	int retval = PAM_SUCCESS;
-	char *token;
-
-	D(("called"));
-
-	/*
-	 * make sure nothing inappropriate gets returned
-	 */
-
-	*pass = token = NULL;
-
-	/*
-	 * which authentication token are we getting?
-	 */
-
-	authtok_flag = on(UNIX__OLD_PASSWD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
-
-	/*
-	 * should we obtain the password from a PAM item ?
-	 */
-
-	if (on(UNIX_TRY_FIRST_PASS, ctrl) || on(UNIX_USE_FIRST_PASS, ctrl)) {
-		retval = pam_get_item(pamh, authtok_flag, pass);
-		if (retval != PAM_SUCCESS) {
-			/* very strange. */
-			pam_syslog(pamh, LOG_ALERT,
-				 "pam_get_item returned error to unix-read-password"
-			    );
-			return retval;
-		} else if (*pass != NULL) {	/* we have a password! */
-			return PAM_SUCCESS;
-		} else if (on(UNIX_USE_AUTHTOK, ctrl)
-			   && off(UNIX__OLD_PASSWD, ctrl)) {
-			return PAM_AUTHTOK_ERR;
-		} else if (on(UNIX_USE_FIRST_PASS, ctrl)) {
-			return PAM_AUTHTOK_RECOVERY_ERR;	  /* didn't work */
-		}
-	}
-	/*
-	 * getting here implies we will have to get the password from the
-	 * user directly.
-	 */
-
-	{
-		int replies=1;
-		char *resp[2] = { NULL, NULL };
-
-		if (comment != NULL && off(UNIX__QUIET, ctrl)) {
-			retval = pam_info(pamh, "%s", comment);
-		}
-
-		if (retval == PAM_SUCCESS) {
-			retval = pam_prompt(pamh, PAM_PROMPT_ECHO_OFF,
-			    &resp[0], "%s", prompt1);
-
-			if (retval == PAM_SUCCESS && prompt2 != NULL) {
-				retval = pam_prompt(pamh, PAM_PROMPT_ECHO_OFF,
-				    &resp[1], "%s", prompt2);
-				++replies;
-			}
-		}
-
-		if (resp[0] != NULL && resp[replies-1] != NULL) {
-			/* interpret the response */
-
-			if (retval == PAM_SUCCESS) {	/* a good conversation */
-
-				token = resp[0];
-				if (token != NULL) {
-					if (replies == 2) {
-						/* verify that password entered correctly */
-						if (strcmp(token, resp[replies - 1])) {
-							/* mistyped */
-							retval = PAM_AUTHTOK_RECOVERY_ERR;
-							_make_remark(pamh, ctrl,
-							    PAM_ERROR_MSG, MISTYPED_PASS);
-						}
-					}
-				} else {
-					pam_syslog(pamh, LOG_NOTICE,
-						    "could not recover authentication token");
-				}
-
-			}
-
-		} else {
-			retval = (retval == PAM_SUCCESS)
-			    ? PAM_AUTHTOK_RECOVERY_ERR : retval;
-		}
-
-		resp[0] = NULL;
-		if (replies > 1)
-			_pam_delete(resp[1]);
-	}
-
-	if (retval != PAM_SUCCESS) {
-		_pam_delete(token);
-
-		if (on(UNIX_DEBUG, ctrl))
-			pam_syslog(pamh, LOG_DEBUG,
-			         "unable to obtain a password");
-		return retval;
-	}
-	/* 'token' is the entered password */
-
-	if (off(UNIX_NOT_SET_PASS, ctrl)) {
-
-		/* we store this password as an item */
-
-		retval = pam_set_item(pamh, authtok_flag, token);
-		_pam_delete(token);	/* clean it up */
-		if (retval != PAM_SUCCESS
-		    || (retval = pam_get_item(pamh, authtok_flag, pass))
-		    != PAM_SUCCESS) {
-
-			*pass = NULL;
-			pam_syslog(pamh, LOG_CRIT, "error manipulating password");
-			return retval;
-
-		}
-	} else {
-		/*
-		 * then store it as data specific to this module. pam_end()
-		 * will arrange to clean it up.
-		 */
-
-		retval = pam_set_data(pamh, data_name, (void *) token, _cleanup);
-		if (retval != PAM_SUCCESS) {
-			pam_syslog(pamh, LOG_CRIT,
-			         "error manipulating password data [%s]",
-				 pam_strerror(pamh, retval));
-			_pam_delete(token);
-			return retval;
-		}
-		*pass = token;
-		token = NULL;	/* break link to password */
-	}
-
-	return PAM_SUCCESS;
-}
-
 /* ****************************************************************** *
  * Copyright (c) Jan Rêkorajski 1999.
  * Copyright (c) Andrew G. Morgan 1996-8.