debug

Author: bilelmoussaoui

pam/src/lib.rs

@@ -43,6 +43,9 @@ unsafe fn get_user(pamh: *mut pam_handle_t) -> Result<String, c_int> {
 /// Get the authentication token
 unsafe fn get_auth_token(pamh: *mut pam_handle_t) -> Result<Zeroizing<Vec<u8>>, c_int> {
     let mut authtok_ptr: *const c_char = std::ptr::null();
+
+    tracing::debug!("Before pam_get_item: authtok_ptr = {:p}", authtok_ptr);
+
     let ret = unsafe {
         ffi::pam_get_item(
             pamh,
@@ -51,17 +54,23 @@ unsafe fn get_auth_token(pamh: *mut pam_handle_t) -> Result<Zeroizing<Vec<u8>>,
         )
     };
 
+    tracing::debug!("After pam_get_item: ret = {}, authtok_ptr = {:p}", ret, authtok_ptr);
+
     if ret != PAM_SUCCESS {
+        tracing::debug!("pam_get_item returned error: {}", ret);
         return Err(ret);
     }
 
     if authtok_ptr.is_null() {
+        tracing::debug!("authtok_ptr is null after successful pam_get_item");
         return Err(PAM_SYSTEM_ERR);
     }
 
     let authtok_cstr = unsafe { CStr::from_ptr(authtok_ptr) };
     let authtok_bytes = authtok_cstr.to_bytes();
 
+    tracing::debug!("Read {} bytes from authtok_ptr", authtok_bytes.len());
+
     Ok(Zeroizing::new(authtok_bytes.to_vec()))
 }
 
@@ -229,11 +238,26 @@ pub extern "C" fn pam_sm_open_session(
     }
 
     let password = unsafe { &*(password_ptr as *const Zeroizing<Vec<u8>>) };
+    let hex_dump: String = password.iter().map(|b| format!("{:02x}", b)).collect::<Vec<_>>().join(" ");
     tracing::debug!(
-        "Retrieved stashed password of length {} bytes",
-        password.len()
+        "Retrieved stashed password of length {} bytes (hex: {})",
+        password.len(),
+        hex_dump
     );
 
+    // Also try to get PAM_AUTHTOK directly in session phase to compare
+    let session_token = unsafe { get_auth_token(pamh) };
+    if let Ok(token) = &session_token {
+        let token_hex: String = token.iter().map(|b| format!("{:02x}", b)).collect::<Vec<_>>().join(" ");
+        tracing::debug!(
+            "PAM_AUTHTOK in session phase: length {} bytes (hex: {})",
+            token.len(),
+            token_hex
+        );
+    } else {
+        tracing::debug!("PAM_AUTHTOK not available in session phase");
+    }
+
     // Get username and UID
     let username = match unsafe { get_user(pamh) } {
         Ok(user) => user,