Add a test for pam_get_item() argument type

This checks whether pam_get_item() takes a const void ** or void ** item
value argument and defines a PAM_ITEM_CONST macro that is const when it
should. This avoids some compiler warnings.

4 files changed, 41 insertions, 9 deletions

diff --git a/compat/pam_get_authtok.c b/compat/pam_get_authtok.c
index 9b8825b..d83ddbe 100644
--- a/compat/pam_get_authtok.c
+++ b/compat/pam_get_authtok.c
@@ -44,7 +44,7 @@ int pam_get_authtok(pam_handle_t *pamh, int item, const char **authtok,
   char retype_prompt[80];
   /* first try to see if the value is already on the stack */
   *authtok = NULL;
-  rc = pam_get_item(pamh, item, (const void **)authtok);
+  rc = pam_get_item(pamh, item, (PAM_ITEM_CONST void **)authtok);
   if ((rc == PAM_SUCCESS) && (*authtok != NULL))
     return PAM_SUCCESS;
   /* check what to prompt for and provide default prompt */
@@ -53,7 +53,7 @@ int pam_get_authtok(pam_handle_t *pamh, int item, const char **authtok,
     prompt = (prompt != NULL) ? prompt : "Old Password: ";
   else
   {
-    rc = pam_get_item(pamh, PAM_OLDAUTHTOK, (const void **)&oldauthtok);
+    rc = pam_get_item(pamh, PAM_OLDAUTHTOK, (PAM_ITEM_CONST void **)&oldauthtok);
     if ((rc == PAM_SUCCESS) && (oldauthtok != NULL))
     {
       prompt = (prompt != NULL) ? prompt : "New Password: ";
@@ -90,5 +90,5 @@ int pam_get_authtok(pam_handle_t *pamh, int item, const char **authtok,
   if (rc != PAM_SUCCESS)
     return rc;
   /* return token from the stack */
-  return pam_get_item(pamh, item, (const void **)authtok);
+  return pam_get_item(pamh, item, (PAM_ITEM_CONST void **)authtok);
 }
diff --git a/compat/pam_prompt.c b/compat/pam_prompt.c
index d2fd761..8a9a8a8 100644
--- a/compat/pam_prompt.c
+++ b/compat/pam_prompt.c
@@ -38,7 +38,7 @@ int pam_prompt(pam_handle_t *pamh, int style, char **response,
   struct pam_message msg, *pmsg;
   struct pam_response *resp;
   /* the the conversion function */
-  rc = pam_get_item(pamh, PAM_CONV, (const void **)&aconv);
+  rc = pam_get_item(pamh, PAM_CONV, (PAM_ITEM_CONST void **)&aconv);
   if (rc != PAM_SUCCESS)
     return rc;
   /* make the message string */
diff --git a/configure.ac b/configure.ac
index a8ee67c..a638f77 100644
--- a/configure.ac
+++ b/configure.ac
@@ -603,6 +603,38 @@ then
   AC_SUBST(pam_ldap_so_LDFLAGS)
   AC_SUBST(pam_ldap_so_LINK)
 
+  # check argument type of pam_get_item()
+  AC_CACHE_CHECK(
+      [argument type of pam_get_item],
+      nss_pam_ldapd_cv_pam_get_item_arg3_type,
+      [AC_COMPILE_IFELSE(
+          [AC_LANG_PROGRAM([[
+              #ifdef HAVE_SECURITY_PAM_APPL_H
+              #include <security/pam_appl.h>
+              #endif
+              #ifndef HAVE_PAM_PAM_MODULES_H
+              #include <security/pam_modules.h>
+              #ifdef HAVE_SECURITY_PAM_EXT_H
+              #include <security/pam_ext.h>
+              #endif
+              #else
+              #include <pam/pam_modules.h>
+              #endif
+              #ifdef HAVE_SECURITY_PAM_MODUTIL_H
+              #include <security/pam_modutil.h>
+              #endif
+              extern int pam_get_item(const pam_handle_t *pamh, int item_type, const void **item);
+              ]], [])],
+          [nss_pam_ldapd_cv_pam_get_item_arg3_type="const void **"],
+          [nss_pam_ldapd_cv_pam_get_item_arg3_type="void **"]) ])
+  PAM_ITEM_CONST=""
+  if test "$nss_pam_ldapd_cv_pam_get_item_arg3_type" = "const void **"
+  then
+    PAM_ITEM_CONST="const"
+  fi
+  AC_DEFINE_UNQUOTED(PAM_ITEM_CONST, [$PAM_ITEM_CONST],
+                     [Define to empty if pam_get_item() doesn't take `const` parameter.])
+
   # restore CFLAGS and LIBS
   CFLAGS="$pam_save_CFLAGS"
   LIBS="$pam_save_LIBS"
diff --git a/pam/pam.c b/pam/pam.c
index 36caf11..3068e2a 100644
--- a/pam/pam.c
+++ b/pam/pam.c
@@ -228,7 +228,7 @@ static int init(pam_handle_t *pamh, struct pld_cfg *cfg, struct pld_ctx **ctx,
   if (rc != PAM_SUCCESS)
     return rc;
   /* get service name */
-  rc = pam_get_item(pamh, PAM_SERVICE, (const void **)service);
+  rc = pam_get_item(pamh, PAM_SERVICE, (PAM_ITEM_CONST void **)service);
   if (rc != PAM_SUCCESS)
   {
     pam_syslog(pamh, LOG_ERR, "failed to get service name: %s",
@@ -236,9 +236,9 @@ static int init(pam_handle_t *pamh, struct pld_cfg *cfg, struct pld_ctx **ctx,
     return rc;
   }
   /* get more PAM information (ignore errors) */
-  pam_get_item(pamh, PAM_RUSER, (const void **)ruser);
-  pam_get_item(pamh, PAM_RHOST, (const void **)rhost);
-  pam_get_item(pamh, PAM_TTY, (const void **)tty);
+  pam_get_item(pamh, PAM_RUSER, (PAM_ITEM_CONST void **)ruser);
+  pam_get_item(pamh, PAM_RHOST, (PAM_ITEM_CONST void **)rhost);
+  pam_get_item(pamh, PAM_TTY, (PAM_ITEM_CONST void **)tty);
   return PAM_SUCCESS;
 }
 
@@ -746,7 +746,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
     return remap_pam_rc(resp.res, &cfg);
   }
   /* get the old password (from the previous call) */
-  rc = pam_get_item(pamh, PAM_OLDAUTHTOK, (const void **)&oldpassword);
+  rc = pam_get_item(pamh, PAM_OLDAUTHTOK, (PAM_ITEM_CONST void **)&oldpassword);
   if (rc != PAM_SUCCESS)
     return rc;
   /* prompt for new password */