{
    auth_session_t *as;

    as = auth_usercheck(name, style, type, password);

    return (as != NULL ? auth_close(as) : 0);
}

{
    auth_session_t *as;

    if ((as = calloc(1, sizeof(auth_session_t))) != NULL) {
        as->service = defservice;
        as->fd = -1;
    }

    return (as);
}

{
    char namebuf[LOGIN_NAME_MAX + 1 + NAME_MAX + 1];
    char pwbuf[_PW_BUF_LEN];
    auth_session_t *as;
    login_cap_t *lc;
    struct passwd pwstore, *pwd = NULL;
    char *slash;

    if (!_auth_validuser(name))
        return (NULL);
    if (strlcpy(namebuf, name, sizeof(namebuf)) >= sizeof(namebuf))
        return (NULL);
    name = namebuf;

    /*
     ,* Split up user:style names if we were not given a style
     ,*/
    if (style == NULL && (style = strchr(name, ':')) != NULL)
        ,*style++ = '\0';

    /*
     ,* Cope with user/instance.  We are only using this to get
     ,* the class so it is okay if we strip a /root instance
     ,* The actual login script will pay attention to the instance.
     ,*/
    getpwnam_r(name, &pwstore, pwbuf, sizeof(pwbuf), &pwd);
    if (pwd == NULL) {
        if ((slash = strchr(name, '/')) != NULL) {
            ,*slash = '\0';
            getpwnam_r(name, &pwstore, pwbuf, sizeof(pwbuf), &pwd);
            ,*slash = '/';
        }
    }
    if ((lc = login_getclass(pwd ? pwd->pw_class : NULL)) == NULL)
        return (NULL);

    if ((style = login_getstyle(lc, style, type)) == NULL) {
        login_close(lc);
        return (NULL);
    }

    if (password) {
        if ((as = auth_open()) == NULL) {
            login_close(lc);
            return (NULL);
        }
        auth_setitem(as, AUTHV_SERVICE, "response");
        auth_setdata(as, "", 1);
        auth_setdata(as, password, strlen(password) + 1);
        explicit_bzero(password, strlen(password));
    } else
        as = NULL;
    as = auth_verify(as, style, name, lc->lc_class, (char *)NULL);
    login_close(lc);
    return (as);
}

{
    va_list ap;
    char path[PATH_MAX];

    if ((name == NULL || style == NULL) && as == NULL)
        return (NULL);

    if (as == NULL && (as = auth_open()) == NULL)
        return (NULL);
    auth_setstate(as, 0);

    if (style != NULL && auth_setitem(as, AUTHV_STYLE, style) < 0)
        return (as);

    if (name != NULL && auth_setitem(as, AUTHV_NAME, name) < 0)
        return (as);

    style = auth_getitem(as, AUTHV_STYLE);
    name = auth_getitem(as, AUTHV_NAME);
    if (!_auth_validuser(name))
        return (as);

    snprintf(path, sizeof(path), _PATH_AUTHPROG "%s", style);
    va_start(ap, name);
    auth_set_va_list(as, ap);
    auth_call(as, path, auth_getitem(as, AUTHV_STYLE), "-s",
        auth_getitem(as, AUTHV_SERVICE), "--", name, (char *)NULL);
    va_end(ap);
    return (as);
}

{
    char *line;
    struct authdata *data;
    struct authopts *opt;
    pid_t pid;
    int status;
    int okay;
    int pfd[2];
    int argc;
    char *argv[64];		/* 64 args should be more than enough */
#define	Nargc	(sizeof(argv)/sizeof(argv[0]))

    va_start(as->ap0, path);

    argc = 0;
    if ((argv[argc] = _auth_next_arg(as)) != NULL)
        ++argc;

    if (as->fd != -1) {
        argv[argc++] = "-v";
        argv[argc++] = "fd=4";		/* AUTH_FD, see below */
    }
    /* XXX - fail if out of space in argv */
    for (opt = as->optlist; opt != NULL; opt = opt->next) {
        if (argc < Nargc - 2) {
            argv[argc++] = "-v";
            argv[argc++] = opt->opt;
        } else {
            syslog(LOG_ERR, "too many authentication options");
            goto fail;
        }
    }
    while (argc < Nargc - 1 && (argv[argc] = _auth_next_arg(as)))
        ++argc;

    if (argc >= Nargc - 1 && _auth_next_arg(as)) {
        if (memcmp(&nilap, &(as->ap0), sizeof(nilap)) != 0) {
            va_end(as->ap0);
            explicit_bzero(&(as->ap0), sizeof(as->ap0));
        }
        if (memcmp(&nilap, &(as->ap), sizeof(nilap)) != 0) {
            va_end(as->ap);
            explicit_bzero(&(as->ap), sizeof(as->ap));
        }
        syslog(LOG_ERR, "too many arguments");
        goto fail;
    }

    argv[argc] = NULL;

    if (socketpair(PF_LOCAL, SOCK_STREAM, 0, pfd) == -1) {
        syslog(LOG_ERR, "unable to create backchannel %m");
        warnx("internal resource failure");
        goto fail;
    }

    switch (pid = fork()) {
    case -1:
        syslog(LOG_ERR, "%s: %m", path);
        warnx("internal resource failure");
        close(pfd[0]);
        close(pfd[1]);
        goto fail;
    case 0:
#define	COMM_FD	3
#define	AUTH_FD	4
        if (dup2(pfd[1], COMM_FD) == -1)
            err(1, "dup of backchannel");
        if (as->fd != -1) {
            if (dup2(as->fd, AUTH_FD) == -1)
                err(1, "dup of auth fd");
            closefrom(AUTH_FD + 1);
        } else
            closefrom(COMM_FD + 1);
        execve(path, argv, auth_environ);
        syslog(LOG_ERR, "%s: %m", path);
        err(1, "%s", path);
    default:
        close(pfd[1]);
        if (as->fd != -1) {
            close(as->fd);		/* so child has only ref */
            as->fd = -1;
        }
        while ((data = as->data) != NULL) {
            as->data = data->next;
            if (data->len > 0) {
                write(pfd[0], data->ptr, data->len);
                explicit_bzero(data->ptr, data->len);
            }
            free(data);
        }
        as->index = 0;
        _auth_spool(as, pfd[0]);
        close(pfd[0]);
        do {
            if (waitpid(pid, &status, 0) != -1) {
                if (!WIFEXITED(status))
                    goto fail;
                break;
            }
            /*
             ,* could get ECHILD if it was waited for by
             ,* another thread or from a signal handler
             ,*/
        } while (errno == EINTR);
    }

    /*
     ,* Now scan the spooled data
     ,* It is easier to wait for all the data before starting
     ,* to scan it.
     ,*/
        for (line = as->spool; line < as->spool + as->index;) {
        if (!strncasecmp(line, BI_REJECT, sizeof(BI_REJECT)-1)) {
            line += sizeof(BI_REJECT) - 1;
            if (!*line || *line == ' ' || *line == '\t') {
                while (*line == ' ' || *line == '\t')
                    ++line;
                if (!strcasecmp(line, "silent")) {
                    as->state = AUTH_SILENT;
                    break;
                }
                if (!strcasecmp(line, "challenge")) {
                    as->state  = AUTH_CHALLENGE;
                    break;
                }
                if (!strcasecmp(line, "expired")) {
                    as->state  = AUTH_EXPIRED;
                    break;
                }
                if (!strcasecmp(line, "pwexpired")) {
                    as->state  = AUTH_PWEXPIRED;
                    break;
                }
            }
            break;
        } else if (!strncasecmp(line, BI_AUTH, sizeof(BI_AUTH)-1)) {
            line += sizeof(BI_AUTH) - 1;
            if (!*line || *line == ' ' || *line == '\t') {
                while (*line == ' ' || *line == '\t')
                    ++line;
                if (*line == '\0')
                    as->state |= AUTH_OKAY;
                else if (!strcasecmp(line, "root"))
                    as->state |= AUTH_ROOTOKAY;
                else if (!strcasecmp(line, "secure"))
                    as->state |= AUTH_SECURE;
            }
        } else if (!strncasecmp(line, BI_REMOVE, sizeof(BI_REMOVE)-1)) {
            line += sizeof(BI_REMOVE) - 1;
            while (*line == ' ' || *line == '\t')
                ++line;
            if (*line)
                _add_rmlist(as, line);
        }
        while (*line++)
            ;
    }

    if (WEXITSTATUS(status))
        as->state &= ~AUTH_ALLOW;

    okay = as->state & AUTH_ALLOW;

    if (!okay)
        auth_clrenv(as);

    if (0) {
fail:
        auth_clrenv(as);
        as->state = 0;
        okay = -1;
    }

    while ((data = as->data) != NULL) {
        as->data = data->next;
        free(data);
    }

    if (memcmp(&nilap, &(as->ap0), sizeof(nilap)) != 0) {
        va_end(as->ap0);
        explicit_bzero(&(as->ap0), sizeof(as->ap0));
    }

    if (memcmp(&nilap, &(as->ap), sizeof(nilap)) != 0) {
        va_end(as->ap);
        explicit_bzero(&(as->ap), sizeof(as->ap));
    }
    return (okay);
}

{
    struct rmfiles *rm;
    struct authopts *opt;
    struct authdata *data;
    int s;

    /*
     ,* Save our return value
     ,*/
    s = as->state & AUTH_ALLOW;

    if (s == 0)
        as->index = 0;

    auth_setenv(as);


    /*
     ,* Clean out the rmlist and remove specified files if the
     ,* authentication failed
     ,*/
    while ((rm = as->rmlist) != NULL) {
        as->rmlist = rm->next;
        if (s == 0)
            unlink(rm->file);
        free(rm);
    }

    /*
     ,* Clean out the opt list
     ,*/
    while ((opt = as->optlist) != NULL) {
        as->optlist = opt->next;
        free(opt);
    }

    /*
     ,* Clean out data
     ,*/
    while ((data = as->data) != NULL) {
        if (as->data->len)
            explicit_bzero(as->data->ptr, as->data->len);
        as->data = data->next;
        free(data);
    }

    if (as->pwd != NULL) {
        explicit_bzero(as->pwd->pw_passwd, strlen(as->pwd->pw_passwd));
        free(as->pwd);
        as->pwd = NULL;
    }

    /*
     ,* Clean up random variables
     ,*/
    if (as->service && as->service != defservice)
        free(as->service);
    free(as->challenge);
    free(as->class);
    free(as->style);
    free(as->name);

    free(as);
    return (s);
}

{
    char namebuf[LOGIN_NAME_MAX + 1 + NAME_MAX + 1];
    auth_session_t *as;
    login_cap_t *lc;
    struct passwd pwstore, *pwd = NULL;
    char *slash, pwbuf[_PW_BUF_LEN];

    if (!_auth_validuser(name))
        return (NULL);
    if (strlen(name) >= sizeof(namebuf))
        return (NULL);
    strlcpy(namebuf, name, sizeof namebuf);
    name = namebuf;

    /*
     ,* Split up user:style names if we were not given a style
     ,*/
    if (style == NULL && (style = strchr(name, ':')) != NULL)
        ,*style++ = '\0';

    /*
     ,* Cope with user/instance.  We are only using this to get
     ,* the class so it is okay if we strip a /root instance
     ,* The actual login script will pay attention to the instance.
     ,*/
    getpwnam_r(name, &pwstore, pwbuf, sizeof(pwbuf), &pwd);
    if (pwd == NULL) {
        if ((slash = strchr(name, '/')) != NULL) {
            ,*slash = '\0';
            getpwnam_r(name, &pwstore, pwbuf, sizeof(pwbuf), &pwd);
            ,*slash = '/';
        }
    }
    if ((lc = login_getclass(pwd ? pwd->pw_class : NULL)) == NULL)
        return (NULL);

    if ((style = login_getstyle(lc, style, type)) == NULL ||
        (as = auth_open()) == NULL) {
        login_close(lc);
        return (NULL);
    }
    if (auth_setitem(as, AUTHV_STYLE, style) < 0 ||
        auth_setitem(as, AUTHV_NAME, name) < 0 ||
        auth_setitem(as, AUTHV_CLASS, lc->lc_class) < 0) {
        auth_close(as);
        login_close(lc);
        return (NULL);
    }
    login_close(lc);
    ,*challengep = auth_challenge(as);
    return (as);
}

{
    char path[PATH_MAX];
    int len;

    if (as == NULL || as->style == NULL || as->name == NULL ||
        !_auth_validuser(as->name))
        return (NULL);

    len = snprintf(path, sizeof(path), _PATH_AUTHPROG "%s", as->style);
    if (len < 0 || len >= sizeof(path))
        return (NULL);

    as->state = 0;

    free(as->challenge);
    as->challenge = NULL;

    auth_call(as, path, as->style, "-s", "challenge", "--", as->name,
        as->class, (char *)NULL);
    if (as->state & AUTH_CHALLENGE)
        as->challenge = auth_getvalue(as, "challenge");
    as->state = 0;
    as->index = 0;	/* toss our data */
    return (as->challenge);
}

{
    char path[PATH_MAX];
    char *style, *name, *challenge, *class;
    int len;

    if (as == NULL)
        return (0);

    auth_setstate(as, 0);

    if ((style = auth_getitem(as, AUTHV_STYLE)) == NULL ||
        (name = auth_getitem(as, AUTHV_NAME)) == NULL ||
        !_auth_validuser(name)) {
        if (more == 0)
            return (auth_close(as));
        return(0);
    }

    len = snprintf(path, sizeof(path), _PATH_AUTHPROG "%s", style);
    if (len < 0 || len >= sizeof(path)) {
        if (more == 0)
            return (auth_close(as));
        return (0);
    }

    challenge = auth_getitem(as, AUTHV_CHALLENGE);
    class = auth_getitem(as, AUTHV_CLASS);

    if (challenge)
        auth_setdata(as, challenge, strlen(challenge) + 1);
    else
        auth_setdata(as, "", 1);
    if (response) {
        auth_setdata(as, response, strlen(response) + 1);
        explicit_bzero(response, strlen(response));
    } else
        auth_setdata(as, "", 1);

    auth_call(as, path, style, "-s", "response", "--", name,
              class, (char *)NULL);

    /*
     * If they authenticated then make sure they did not expire
     */
    if (auth_getstate(as) & AUTH_ALLOW)
        auth_check_expire(as);
    if (more == 0)
        return (auth_close(as));
    return (auth_getstate(as) & AUTH_ALLOW);
}

{
    int close_on_exit, close_lc_on_exit, len;
    struct passwd pwstore, *pwd;
    char *approve, *s, path[PATH_MAX], pwbuf[_PW_BUF_LEN];

    pwd = NULL;
    close_on_exit = as == NULL;
    close_lc_on_exit = lc == NULL;

    if (as != NULL && name == NULL)
        name = auth_getitem(as, AUTHV_NAME);

    if (as != NULL)
        pwd = auth_getpwd(as);

    if (pwd == NULL) {
        if (name != NULL) {
            if (!_auth_validuser(name)) {
                warnx("cannot approve who we don't recognize");
                return (0);
            }
            getpwnam_r(name, &pwstore, pwbuf, sizeof(pwbuf), &pwd);
        } else {
            getpwuid_r(getuid(), &pwstore, pwbuf, sizeof(pwbuf),
                &pwd);
            if (pwd == NULL) {
                syslog(LOG_ERR, "no such user id %u", getuid());
                warnx("cannot approve who we don't recognize");
                return (0);
            }
            name = pwd->pw_name;
        }
    }

    if (name == NULL)
        name = pwd->pw_name;

    if (lc == NULL) {
        if (strlen(name) >= PATH_MAX) {
            syslog(LOG_ERR, "username to login %.*s...",
                PATH_MAX, name);
            warnx("username too long");
            return (0);
        }
        if (pwd == NULL && (approve = strchr(name, '.')) != NULL) {
            strlcpy(path, name, sizeof path);
            path[approve - name] = '\0';
            getpwnam_r(name, &pwstore, pwbuf, sizeof(pwbuf), &pwd);
        }
        lc = login_getclass(pwd ? pwd->pw_class : NULL);
        if (lc == NULL) {
            warnx("unable to classify user");
            return (0);
        }
    }

    if (!type)
        type = LOGIN_DEFSERVICE;
    else {
        if (strncmp(type, "approve-", 8) == 0)
            type += 8;

        len = snprintf(path, sizeof(path), "approve-%s", type);
        if (len < 0 || len >= sizeof(path)) {
            if (close_lc_on_exit)
                login_close(lc);
            syslog(LOG_ERR, "approval path too long %.*s...",
                PATH_MAX, type);
            warnx("approval script path too long");
            return (0);
        }
    }

    if ((approve = login_getcapstr(lc, s = path, NULL, NULL)) == NULL)
        approve = login_getcapstr(lc, s = "approve", NULL, NULL);

    if (approve && approve[0] != '/') {
        if (close_lc_on_exit)
            login_close(lc);
        syslog(LOG_ERR, "Invalid %s script: %s", s, approve);
        warnx("invalid path to approval script");
        free(approve);
        return (0);
    }

    if (as == NULL && (as = auth_open()) == NULL) {
        if (close_lc_on_exit)
            login_close(lc);
        syslog(LOG_ERR, "%m");
        warn(NULL);
        free(approve);
        return (0);
    }

    auth_setstate(as, AUTH_OKAY);
    if (auth_setitem(as, AUTHV_NAME, name) < 0) {
        syslog(LOG_ERR, "%m");
        warn(NULL);
        goto out;
    }
    if (auth_check_expire(as) < 0)	/* is this account expired */
        goto out;
    if (_auth_checknologin(lc,
        auth_getitem(as, AUTHV_INTERACTIVE) != NULL)) {
        auth_setstate(as, (auth_getstate(as) & ~AUTH_ALLOW));
        goto out;
    }
    if (login_getcapbool(lc, "requirehome", 0) && pwd && pwd->pw_dir &&
        pwd->pw_dir[0]) {
        struct stat sb;

        if (stat(pwd->pw_dir, &sb) == -1 || !S_ISDIR(sb.st_mode) ||
            (pwd->pw_uid && sb.st_uid == pwd->pw_uid &&
            (sb.st_mode & S_IXUSR) == 0)) {
            auth_setstate(as, (auth_getstate(as) & ~AUTH_ALLOW));
            goto out;
        }
    }
    if (approve)
        auth_call(as, approve, strrchr(approve, '/') + 1, "--", name,
            lc->lc_class, type, (char *)NULL);

out:
    free(approve);
    if (close_lc_on_exit)
        login_close(lc);

    if (close_on_exit)
        return (auth_close(as));
    return (auth_getstate(as) & AUTH_ALLOW);
}

{
    if (as->pwd == NULL && auth_setpwd(as, NULL) < 0) {
        as->state &= ~AUTH_ALLOW;
        as->state |= AUTH_EXPIRED;	/* XXX */
        return (-1);
    }

    if (as->pwd == NULL)
        return (0);

    if (as->pwd && (quad_t)as->pwd->pw_expire != 0) {
        if (as->now.tv_sec == 0)
            WRAP(gettimeofday)(&as->now, NULL);
        if ((quad_t)as->now.tv_sec >= (quad_t)as->pwd->pw_expire) {
            as->state &= ~AUTH_ALLOW;
            as->state |= AUTH_EXPIRED;
        }
        if ((quad_t)as->now.tv_sec == (quad_t)as->pwd->pw_expire)
            return (-1);
        return ((quad_t)as->pwd->pw_expire - (quad_t)as->now.tv_sec);
    }
    return (0);
}

{
    if (as->pwd == NULL && auth_setpwd(as, NULL) < 0) {
        as->state &= ~AUTH_ALLOW;
        as->state |= AUTH_PWEXPIRED;	/* XXX */
        return (-1);
    }

    if (as->pwd == NULL)
        return (0);

    if (as->pwd && (quad_t)as->pwd->pw_change) {
        if (as->now.tv_sec == 0)
            WRAP(gettimeofday)(&as->now, NULL);
        if (as->now.tv_sec >= (quad_t)as->pwd->pw_change) {
            as->state &= ~AUTH_ALLOW;
            as->state |= AUTH_PWEXPIRED;
        }
        if ((quad_t)as->now.tv_sec == (quad_t)as->pwd->pw_change)
            return (-1);
        return ((quad_t)as->pwd->pw_change - (quad_t)as->now.tv_sec);
    }
    return (0);
}

{
    if (_auth_checknologin(lc, 1))
        exit(1);
}

{
    int fd, nchars;
    char tbuf[8192];

    if ((fd = open(file, O_RDONLY, 0)) == -1)
        return (0);
    while ((nchars = read(fd, tbuf, sizeof(tbuf))) > 0)
        (void)write(fileno(stdout), tbuf, nchars);
    (void)close(fd);
    return (1);
}

{
	char *big, *p;

	big = malloc(strlen(value) * 4 + 1);
	if (big == NULL)
		return (NULL);
	/*
	 ,* XXX - There should be a more standardized
	 ,* routine for doing this sort of thing.
	 ,*/
	for (p = big; *value; ++value) {
		switch (*value) {
		case '\r':
			,*p++ = '\\';
			,*p++ = 'r';
			break;
		case '\n':
			,*p++ = '\\';
			,*p++ = 'n';
			break;
		case '\\':
			,*p++ = '\\';
			,*p++ = *value;
			break;
		case '\t':
		case ' ':
			if (p == big)
				,*p++ = '\\';
			,*p++ = *value;
			break;
		default:
			if (!isprint((unsigned char)*value)) {
				,*p++ = '\\';
				,*p++ = ((*value >> 6) & 0x3) + '0';
				,*p++ = ((*value >> 3) & 0x7) + '0';
				,*p++ = ((*value     ) & 0x7) + '0';
			} else
				,*p++ = *value;
			break;
		}
	}
	,*p = '\0';
	return (big);
}

{
    /* User name must be specified and may not start with a '-'. */
    if (*name == '\0' || *name == '-') {
        syslog(LOG_ERR, "invalid user name %s", name);
        return 0;
    }
    return 1;
}

{
    struct stat sb;
    char *nologin;
    int mustfree;

    if (login_getcapbool(lc, "ignorenologin", 0))
        return (0);

    /*
     ,* If we fail to get the nologin file due to a database error,
     ,* assume there should have been one...
     ,*/
    nologin = login_getcapstr(lc, "nologin", "", NULL);
    mustfree = nologin && *nologin != '\0';
    if (nologin == NULL)
        goto print_nologin;

    /* First try the nologin file specified in login.conf. */
    if (*nologin != '\0' && stat(nologin, &sb) == 0)
        goto print_nologin;
    if (mustfree) {
        free(nologin);
        mustfree = 0;
    }

    /* If that doesn't exist try _PATH_NOLOGIN. */
    if (stat(_PATH_NOLOGIN, &sb) == 0) {
        nologin = _PATH_NOLOGIN;
        goto print_nologin;
    }

    /* Couldn't stat any nologin files, must be OK to login. */
    return (0);

print_nologin:
    if (print) {
        if (!nologin || *nologin == '\0' || auth_cat(nologin) == 0) {
            puts("Logins are not allowed at this time.");
            fflush(stdout);
        }
    }
    if (mustfree)
        free(nologin);
    return (-1);
}