<commit_before>#include "myproxy_common.h"	/* all needed headers included here */

#if defined(HAVE_LIBPAM)
#include "auth_pam.h"
#endif

struct authorization_func {
   char * (*create_server_data) (void);
   char * (*create_client_data) (authorization_data_t *data, 
	                         void *extra_data, 
				 size_t extra_data_len,
				 size_t *client_data_len);
   int (*check_client) (authorization_data_t *client_auth_data,
			struct myproxy_creds *creds, /* o co zada */
			char *client_name, myproxy_server_context_t* config);
   author_method_t method;
   char *name; /* arbitrary ASCII string without a colon (':') */
};

static struct authorization_func * _find_func(author_method_t method);

static authorization_data_t * 
_find_data(author_method_t method, authorization_data_t **data);


/*
 * Implementation of password-based authorization
 */
char * 
auth_passwd_create_server_data(void)
{
   return strdup("Put your password for the Myproxy server");
}

char * 
auth_passwd_create_client_data(authorization_data_t *data, 
                               void *extra_data, size_t extra_data_len,
			       size_t *client_data_len)
{ 
   char *tmp;

   tmp = malloc(extra_data_len + 1);
   if (tmp == NULL)
      return NULL;
   memcpy(tmp, extra_data, extra_data_len);
   tmp[extra_data_len] = '\0';
   *client_data_len = extra_data_len + 1;
   return tmp;
}

int auth_passwd_check_client(authorization_data_t *client_auth_data,
                             struct myproxy_creds *creds, char *client_name,
			     myproxy_server_context_t* config)
{ 
   /* 1. Check whether the credentials are encrypted. */
   int encrypted = myproxy_creds_encrypted(creds);
   int empty_passphrase = (client_auth_data->client_data_len <= 0) ? 1 : 0;

   /* 2. Check whether the password the user gave matches the
    *    credential passphrase */
   int cred_passphrase_match = 0;
   if (encrypted)
   {
      if (client_auth_data->client_data_len >= MIN_PASS_PHRASE_LEN &&
	  client_auth_data->client_data != NULL &&
	  myproxy_creds_verify_passphrase(creds,
					  client_auth_data->client_data) == 1)
	 cred_passphrase_match = 1;
   }
   /* unencrypted --> passphrase matches if it is blank. */
   else 
      cred_passphrase_match = (client_auth_data->client_data_len <= 0) ? 1 : 0;
   
#if defined(HAVE_LIBPAM)

   /* Tangent: figure out PAM configuration. */
   char* pam_policy = config ? config->pam_policy : NULL;
   char* pam_id     = config ? config->pam_id : NULL;

   /* Default value is "disabled". */
   if (pam_policy == NULL) pam_policy = "disabled";

   int pam_required   = (strcmp(pam_policy, "required"  ) == 0 ? 1 : 0);
   int pam_sufficient = (strcmp(pam_policy, "sufficient") == 0 ? 1 : 0);
   int pam_disabled   = (strcmp(pam_policy, "disabled"  ) == 0 ? 1 : 0);

   /* Note: if pam_policy is not recognized, it will fall through to
    * the disabled case below, and a debug message will be printed. */

   /* 3. If the passphrase matches the credentials, and PAM config is
    *    "sufficient", then we're done, and we don't need to check
    *    PAM, as long as a passphrase was actually entered. */
   if (pam_sufficient && cred_passphrase_match && !empty_passphrase)
   {
      myproxy_debug("Passphrase matches credentials, and PAM config is \"%s\"; "
		    "authentication succeeds without checking PAM.", pam_policy);
      return 1;
   }

   /* 4. If PAM is "required", *always* check it, regardless of
    *    whether the credential passphrase matches, so that any
    *    logging, pausing, etc. can occur.  Also, if PAM is sufficient
    *    and we've gotten this far, it means that the credential
    *    passphrase is blank and therefore we need to check PAM. */
   else if (pam_required || pam_sufficient)
   {
      int pam_success = 0;
      if (pam_id == NULL) pam_id = "myproxy";
      myproxy_debug
	 ("Checking passphrase via PAM.  PAM policy: \"%s\"; PAM ID: \"%s\"\n",
	  pam_policy, pam_id);

      char* auth_pam_result = auth_pam(creds->username,
				       client_auth_data->client_data, pam_id, NULL);
      if (strcmp("OK", auth_pam_result) == 0)
	 pam_success = 1;
      else
	 verror_put_string("PAM authentication failed: %s",
			   auth_pam_result);
      if (auth_pam_result != NULL)
	 free(auth_pam_result);

      return pam_success;
   }

   /* 5. If PAM is disabled, check only the credential passphrase. */
   else
   {
      if (!pam_disabled)
	 myproxy_log("Unknown PAM policy: \"%s\"; not using PAM.\n", pam_policy);<commit_msg>sanity checks for null result from auth_pam()<commit_after>#include "myproxy_common.h"	/* all needed headers included here */

#if defined(HAVE_LIBPAM)
#include "auth_pam.h"
#endif

struct authorization_func {
   char * (*create_server_data) (void);
   char * (*create_client_data) (authorization_data_t *data, 
	                         void *extra_data, 
				 size_t extra_data_len,
				 size_t *client_data_len);
   int (*check_client) (authorization_data_t *client_auth_data,
			struct myproxy_creds *creds, /* o co zada */
			char *client_name, myproxy_server_context_t* config);
   author_method_t method;
   char *name; /* arbitrary ASCII string without a colon (':') */
};

static struct authorization_func * _find_func(author_method_t method);

static authorization_data_t * 
_find_data(author_method_t method, authorization_data_t **data);


/*
 * Implementation of password-based authorization
 */
char * 
auth_passwd_create_server_data(void)
{
   return strdup("Put your password for the Myproxy server");
}

char * 
auth_passwd_create_client_data(authorization_data_t *data, 
                               void *extra_data, size_t extra_data_len,
			       size_t *client_data_len)
{ 
   char *tmp;

   tmp = malloc(extra_data_len + 1);
   if (tmp == NULL)
      return NULL;
   memcpy(tmp, extra_data, extra_data_len);
   tmp[extra_data_len] = '\0';
   *client_data_len = extra_data_len + 1;
   return tmp;
}

int auth_passwd_check_client(authorization_data_t *client_auth_data,
                             struct myproxy_creds *creds, char *client_name,
			     myproxy_server_context_t* config)
{ 
   /* 1. Check whether the credentials are encrypted. */
   int encrypted = myproxy_creds_encrypted(creds);
   int empty_passphrase = (client_auth_data->client_data_len <= 0) ? 1 : 0;

   /* 2. Check whether the password the user gave matches the
    *    credential passphrase */
   int cred_passphrase_match = 0;
   if (encrypted)
   {
      if (client_auth_data->client_data_len >= MIN_PASS_PHRASE_LEN &&
	  client_auth_data->client_data != NULL &&
	  myproxy_creds_verify_passphrase(creds,
					  client_auth_data->client_data) == 1)
	 cred_passphrase_match = 1;
   }
   /* unencrypted --> passphrase matches if it is blank. */
   else 
      cred_passphrase_match = (client_auth_data->client_data_len <= 0) ? 1 : 0;
   
#if defined(HAVE_LIBPAM)

   /* Tangent: figure out PAM configuration. */
   char* pam_policy = config ? config->pam_policy : NULL;
   char* pam_id     = config ? config->pam_id : NULL;

   /* Default value is "disabled". */
   if (pam_policy == NULL) pam_policy = "disabled";

   int pam_required   = (strcmp(pam_policy, "required"  ) == 0 ? 1 : 0);
   int pam_sufficient = (strcmp(pam_policy, "sufficient") == 0 ? 1 : 0);
   int pam_disabled   = (strcmp(pam_policy, "disabled"  ) == 0 ? 1 : 0);

   /* Note: if pam_policy is not recognized, it will fall through to
    * the disabled case below, and a debug message will be printed. */

   /* 3. If the passphrase matches the credentials, and PAM config is
    *    "sufficient", then we're done, and we don't need to check
    *    PAM, as long as a passphrase was actually entered. */
   if (pam_sufficient && cred_passphrase_match && !empty_passphrase)
   {
      myproxy_debug("Passphrase matches credentials, and PAM config is \"%s\"; "
		    "authentication succeeds without checking PAM.", pam_policy);
      return 1;
   }

   /* 4. If PAM is "required", *always* check it, regardless of
    *    whether the credential passphrase matches, so that any
    *    logging, pausing, etc. can occur.  Also, if PAM is sufficient
    *    and we've gotten this far, it means that the credential
    *    passphrase is blank and therefore we need to check PAM. */
   else if (pam_required || pam_sufficient)
   {
      int pam_success = 0;
      if (pam_id == NULL) pam_id = "myproxy";
      myproxy_debug
	 ("Checking passphrase via PAM.  PAM policy: \"%s\"; PAM ID: \"%s\"\n",
	  pam_policy, pam_id);

      char* auth_pam_result = auth_pam(creds->username,
				       client_auth_data->client_data, pam_id, NULL);
      if (auth_pam_result && strcmp("OK", auth_pam_result) == 0) {
	 pam_success = 1;
      } else {
	 verror_put_string("PAM authentication failed");
	 if (auth_pam_result) verror_put_string(auth_pam_result);
      }
      if (auth_pam_result != NULL) {
	 free(auth_pam_result);
      }

      return pam_success;
   }

   /* 5. If PAM is disabled, check only the credential passphrase. */
   else
   {
      if (!pam_disabled) {
	 myproxy_log("Unknown PAM policy: \"%s\"; not using PAM.\n", pam_policy);
      }
{'fraction_non_alphanumeric': 0.10581662832730858, 'fraction_numerical': 0.006572461386789352, 'mean_word_length': 3.1996320147194113, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 25, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7284623', 'n_tokens_mistral': 3182, 'n_tokens_neox': 2968, 'n_words': 823}