#31: Support multiple devices per user

doc/pam_usb.conf

@@ -22,6 +22,13 @@ See https://github.com/mcdope/pam_usb/wiki/Configuration
 						<volume_uuid>6F6B-42FC</volume_uuid>
 						<option name="probe_timeout">10</option>
 				</device>
+				<device id="MySecondDevice">
+						<vendor>Commodore</vendor>
+						<model>REU</model>
+						<serial>CMDKXXXXXXXXXXXXXXXX</serial>
+						<volume_uuid>6F6B-00FF</volume_uuid>
+						<option name="probe_timeout">10</option>
+				</device>
 				-->
 		</devices>
 
@@ -38,6 +45,7 @@ See https://github.com/mcdope/pam_usb/wiki/Configuration
 						removal:
 						<user id="scox">
 								<device>MyDevice</device>
+								<device>MySecondDevice</device>
 								<option name="quiet">true</option>
 								<agent event="lock">
 									<cmd>gnome-screensaver-command -\-lock</cmd>

src/conf.c

@@ -84,36 +84,39 @@
 	xmlDoc *doc,
 	const char *property,
 	char *store,
-	size_t size
+	size_t size,
+	char *deviceId
 )
 {
 	char *xpath = NULL;
 	size_t xpath_len;
 	int retval;
 
-	xpath_len = strlen(CONF_DEVICE_XPATH) + strlen(opts->device.name) + strlen(property) + 1;
+	xpath_len = strlen(CONF_DEVICE_XPATH) + strlen(deviceId) + strlen(property) + 1;
 	xpath = xmalloc(xpath_len);
 	memset(xpath, 0x00, xpath_len);
-	snprintf(xpath, xpath_len, CONF_DEVICE_XPATH, opts->device.name, property);
+	snprintf(xpath, xpath_len, CONF_DEVICE_XPATH, deviceId, property);
 	retval = pusb_xpath_get_string(doc, xpath, store, size);
 	xfree(xpath);
 	return (retval);
 }
 
 static int pusb_conf_parse_device(
 	t_pusb_options *opts,
-	xmlDoc *doc
+	xmlDoc *doc,
+	int deviceIndex,
+	char *deviceId
 )
 {
-	pusb_conf_device_get_property(opts, doc, "vendor", opts->device.vendor, sizeof(opts->device.vendor));
-	pusb_conf_device_get_property(opts, doc, "model", opts->device.model, sizeof(opts->device.model));
+	pusb_conf_device_get_property(opts, doc, "vendor", opts->device_list[deviceIndex].vendor, sizeof(opts->device_list[deviceIndex].vendor), deviceId);
+	pusb_conf_device_get_property(opts, doc, "model", opts->device_list[deviceIndex].model, sizeof(opts->device_list[deviceIndex].model), deviceId);
 
-	if (!pusb_conf_device_get_property(opts, doc, "serial", opts->device.serial, sizeof(opts->device.serial))) 
+	if (!pusb_conf_device_get_property(opts, doc, "serial", opts->device_list[deviceIndex].serial, sizeof(opts->device_list[deviceIndex].serial), deviceId))
 	{
 		return (0);
 	}
 
-	pusb_conf_device_get_property(opts, doc, "volume_uuid", opts->device.volume_uuid, sizeof(opts->device.volume_uuid));
+	pusb_conf_device_get_property(opts, doc, "volume_uuid", opts->device_list[deviceIndex].volume_uuid, sizeof(opts->device_list[deviceIndex].volume_uuid), deviceId);
 	return (1);
 }
 
@@ -169,26 +172,67 @@
 		return (0);
 	}
 	snprintf(device_xpath, sizeof(device_xpath), CONF_USER_XPATH, user, "device");
-	retval = pusb_xpath_get_string(
+
+	char *device_list[10] = { 
+		xmalloc(128), xmalloc(128), xmalloc(128), xmalloc(128), xmalloc(128), 
+		xmalloc(128), xmalloc(128), xmalloc(128), xmalloc(128), xmalloc(128) 
+	};
+	for (int currentDevice = 0; currentDevice < 10; currentDevice++)
+	{
+		memset(device_list[currentDevice], 0x0, 128);
+	}
+	retval = pusb_xpath_get_string_list(
 		doc,
 		device_xpath,
-		opts->device.name,
+		device_list,
 		sizeof(opts->device.name)
 	);
-	if (!retval || !pusb_conf_parse_device(opts, doc))
+
+	if (!retval)
 	{
-		log_error("No authentication device configured for user \"%s\".\n", user);
+		log_error("No authentication device(s) configured for user \"%s\".\n", user);
 		xmlFreeDoc(doc);
 		xmlCleanupParser();
+
+		for (int currentDevice = 0; currentDevice < 10; currentDevice++)
+		{
+			xfree(device_list[currentDevice]);
+		}
 		return (0);
 	}
+
+	for (int currentDevice = 0; currentDevice < 10; currentDevice++)
+	{
+		log_error("DBG: currentDevice: %d, strnlen: %d, value: %s\n", currentDevice, (int) strnlen(device_list[currentDevice], 128), device_list[currentDevice]);
+		if (device_list[currentDevice] == NULL || strnlen(device_list[currentDevice], 128) == 0)
+		{
+			continue;
+		}
+
+		strncpy(opts->device_list[currentDevice].name, device_list[currentDevice], strnlen(device_list[currentDevice], 128));
+		pusb_conf_parse_device(opts, doc, currentDevice, device_list[currentDevice]);
+		log_error("DBG: found device\n");
+		log_error("DBG:     name: %s\n", opts->device_list[currentDevice].name);
+		log_error("DBG:     vendor: %s\n", opts->device_list[currentDevice].vendor);
+	}
+
 	if (!pusb_conf_parse_options(opts, doc, user, service))
 	{
 		xmlFreeDoc(doc);
 		xmlCleanupParser();
+
+		for (int currentDevice = 0; currentDevice < 10; currentDevice++)
+		{
+			xfree(device_list[currentDevice]);
+		}
 		return (0);
 	}
 	xmlFreeDoc(doc);
 	xmlCleanupParser();
+
+	for (int currentDevice = 0; currentDevice < 10; currentDevice++)
+	{
+		xfree(device_list[currentDevice]);
+	}
 	return (1);
 }

src/conf.h

@@ -57,6 +57,7 @@ typedef struct		pusb_options
 	char			system_pad_directory[PATH_MAX];
 	char			device_pad_directory[PATH_MAX];
 	t_pusb_device	device;
+	t_pusb_device	device_list[10];
 }					t_pusb_options;
 
 struct		s_opt_list

src/device.c

@@ -35,29 +35,43 @@
 	UDisksObject *object = NULL;
 	UDisksDrive *drive = NULL;
 
-	log_debug("Searching for \"%s\" in the hardware database...\n", opts->device.name);
-
-	for (i = 0; i < g_list_length(objects); ++i)
+	for (int currentDevice = 0; currentDevice < 10; currentDevice++)
 	{
-		object = UDISKS_OBJECT(g_list_nth(objects, i)->data);
-		if (udisks_object_peek_drive(object))
+		if (strcmp(opts->device_list[currentDevice].name, "") == 0)
 		{
-			drive = udisks_object_get_drive(object);
-			retval = strcmp(udisks_drive_get_serial(drive), opts->device.serial) == 0;
-
-			if (strcmp(opts->device.vendor, "Generic") != 0) 
-			{
-				retval = retval && strcmp(udisks_drive_get_vendor(drive), opts->device.vendor) == 0;
-			}
+			continue;
+		}
+
+		log_error("Searching for \"%s\" in the hardware database...\n", opts->device_list[currentDevice].name);
 
-			if (strcmp(opts->device.model, "Generic") != 0) 
+		for (i = 0; i < g_list_length(objects); ++i)
+		{
+			object = UDISKS_OBJECT(g_list_nth(objects, i)->data);
+			if (udisks_object_peek_drive(object))
 			{
-				retval = retval && strcmp(udisks_drive_get_model(drive), opts->device.model) == 0;
-			}
-
-			g_object_unref(drive);
-			if (retval) {
-				break;
+				drive = udisks_object_get_drive(object);
+				retval = strcmp(udisks_drive_get_serial(drive), opts->device_list[currentDevice].serial) == 0;
+
+				if (strcmp(opts->device_list[currentDevice].vendor, "Generic") != 0)
+				{
+					retval = retval && strcmp(udisks_drive_get_vendor(drive), opts->device_list[currentDevice].vendor) == 0;
+				}
+
+				if (strcmp(opts->device_list[currentDevice].model, "Generic") != 0)
+				{
+					retval = retval && strcmp(udisks_drive_get_model(drive), opts->device_list[currentDevice].model) == 0;
+				}
+
+				g_object_unref(drive);
+				if (retval) {
+					strcpy(opts->device.name, opts->device_list[currentDevice].name);
+					strcpy(opts->device.vendor, opts->device_list[currentDevice].vendor, sizeof(opts->device_list[currentDevice].vendor));
+					strcpy(opts->device.model, opts->device_list[currentDevice].model, sizeof(opts->device_list[currentDevice].model));
+					strcpy(opts->device.serial, opts->device_list[currentDevice].serial, sizeof(opts->device_list[currentDevice].serial));
+					strcpy(opts->device.volume_uuid, opts->device_list[currentDevice].volume_uuid, sizeof(opts->device_list[currentDevice].volume_uuid));
+					currentDevice = 11;
+					break;
+				}
 			}
 		}
 	}
@@ -68,7 +82,7 @@
 	}
 	else 
 	{
-		log_error("Authentication device \"%s\" is not connected.\n", opts->device.name);
+		log_error("None of the configured authentication devices is connected.\n");
 	}
 
 	g_list_foreach(objects, (GFunc) g_object_unref, NULL);

src/xpath.c

@@ -128,6 +128,47 @@ int pusb_xpath_get_string(
 	return (1);
 }
 
+int pusb_xpath_get_string_list(
+	xmlDocPtr doc,
+	const char *path,
+	char *values[],
+	size_t size
+)
+{
+	xmlXPathObject *result = NULL;
+	xmlNode *node = NULL;
+	xmlChar *result_string = NULL;
+
+	if (!(result = pusb_xpath_match(doc, path)))
+	{
+		return (0);
+	}
+
+	log_error("DBG: Found %d devices for user\n", result->nodesetval->nodeNr);
+	for (int currentResult = 0; currentResult < result->nodesetval->nodeNr; currentResult++)
+	{
+		log_error("DBG: result %d\n", currentResult);
+		node = result->nodesetval->nodeTab[currentResult]->xmlChildrenNode;
+		result_string = xmlNodeListGetString(doc, node, 1);
+		if (!result_string || strcmp("", (char *) result_string) == 0)
+		{
+			log_debug("Empty value for %s\n", path);
+			continue;
+		}
+		if (!pusb_xpath_strip_string(values[currentResult], (char *)result_string, size))
+		{
+			log_debug("Result for %s (%s) is too long (max: %d)\n", path, (const char *)result_string, size);
+			continue;
+		}
+
+		log_error("DBG: Found device %s\n", result_string);
+	}
+
+	xmlFree(result_string);
+	xmlXPathFreeObject(result);
+	return (1);
+}
+
 int pusb_xpath_get_string_from(
 	xmlDocPtr doc,
 	const char *base,

src/xpath.h

@@ -20,6 +20,7 @@
 # include <libxml/parser.h>
 
 int pusb_xpath_get_string(xmlDocPtr doc, const char *path, char *value, size_t size);
+int pusb_xpath_get_string_list(xmlDocPtr doc, const char *path, char *value[], size_t size);
 int pusb_xpath_get_string_from(xmlDocPtr doc, const char *base, const char *path, char *value, size_t size);
 int pusb_xpath_get_bool(xmlDocPtr doc, const char *path, int *value);
 int pusb_xpath_get_bool_from(xmlDocPtr doc, const char *base, const char *path, int *value);

tests/can-actually-be-used/create-image.sh

@@ -3,3 +3,4 @@
 set -e
 
 fallocate -l 16M virtual_usb.img
+fallocate -l 16M virtual_usb_alt.img

tests/can-actually-be-used/mount-image.sh

@@ -3,7 +3,7 @@
 set -e
 
 # Load module with image
-sudo modprobe g_mass_storage file=./virtual_usb.img stall=0 removable=y iSerialNumber=1234567890
+sudo modprobe g_mass_storage file=./virtual_usb.img stall=0 removable=y iSerialNumber=1234567890 iProduct=FirstStick
 echo "Info: sleeping 5s to ensure kernel picks up our new device..."
 sleep 5
 
@@ -18,4 +18,3 @@ sudo mkfs.vfat "/dev/"$CREATED_DEVICE"1"
 # Create mountpoint and mount fake stick
 mkdir -p /tmp/fakestick
 sudo mount -t vfat "/dev/"$CREATED_DEVICE"1" /tmp/fakestick -o rw,umask=0000
-

tests/can-actually-be-used/run-tests.sh

@@ -9,6 +9,6 @@ rm -rf /home/`whoami`/.pamusb
 ./test-conf-detects-device.sh && \
 ./test-conf-adds-device.sh && \
 ./test-conf-adds-user.sh && \
-./test-conf-doesnt-add-user-twice.sh && \
+./test-conf-doesnt-add-user-twice-but-adds-a-second-device.sh && \
 ./test-check-verify-created-config.sh && \
 ./test-agent-properly-triggers.sh

tests/can-actually-be-used/test-check-verify-created-config.sh

@@ -1,4 +1,4 @@
 #!/usr/bin/bash
 
 echo -e "Test:\t\t\tpamusb-check verifies the config previous tests created / reports granted"
-pamusb-check `whoami` 2>&1 && echo -e "Result:\t\t\tPASSED!" || exit 1
+pamusb-check --debug `whoami` && echo -e "Result:\t\t\tPASSED!" || exit 1

tests/can-actually-be-used/test-conf-adds-device.sh

@@ -1,4 +1,4 @@
 #!/usr/bin/bash
 echo -e "Test:\t\t\tpamusb-conf properly add device(s)"
 echo -en "pamusb-conf output:\t" # to fake the unhideable python output as expected output :P
-sudo pamusb-conf --add-device=test --device=0 --volume=0 --yes | grep "Done" && cat /etc/security/pam_usb.conf | grep "File-Stor Gadget" > /dev/null && echo -e "Result:\t\t\tPASSED!" || exit 1
+sudo pamusb-conf --add-device=test --device=0 --volume=0 --yes | grep "Done" && cat /etc/security/pam_usb.conf | grep "1234567890" > /dev/null && echo -e "Result:\t\t\tPASSED!" || exit 1

tests/can-actually-be-used/test-conf-doesnt-add-user-twice-but-adds-a-second-device.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/bash
+
+echo -e "Test:\t\t\tpamusb-conf doesn't add user(s) twice, but it adds a second device for an existing user"
+
+# "unplug" virtual usb
+sync && sync && sync
+sudo umount /tmp/fakestick
+sudo modprobe -r g_mass_storage || exit 1
+sleep 10
+
+# "plug" another virtual usb
+sudo modprobe g_mass_storage file=./virtual_usb.img stall=0 removable=y iSerialNumber=1234567891 iProduct=SecondStick || exit 1
+sleep 10
+CREATED_DEVICE=$(lsblk | grep 16M | awk '{ print $1 }')
+sudo mount -t vfat "/dev/"$CREATED_DEVICE"1" /tmp/fakestick -o rw,umask=0000
+
+echo -en "pamusb-conf --add-device output:\t" # to fake the unhideable python output as expected output :P
+sudo pamusb-conf --add-device=test2 --device=0 --volume=0 --yes | grep "Done" && cat /etc/security/pam_usb.conf | grep "1234567891" > /dev/null && echo -e "Result:\t\t\tPASSED!" || exit 1
+
+echo -en "pamusb-conf --add-user output:\t" # to fake the unhideable python output as expected output :P
+sudo pamusb-conf --add-user=`whoami` --device=1 --yes | grep "Done" && cat /etc/security/pam_usb.conf | grep "<device>test2</device>" > /dev/null && echo -e "Result:\t\t\tPASSED!" || exit 1

tools/pamusb-agent

@@ -209,6 +209,7 @@ def userDeviceThread(user):
 			}
 		)
 
+	# @todo: adjust for multiple devices here
 	deviceName = user.find('device').text.strip()
 
 	devices = doc.findall("devices/device")