Catch up with OpenPAM's latest OATH changes:

Add an oath_mode(3) function which translates from mode names to numbers.

 Consistently use UINT_MAX, not -1, to indicate an invalid response.

 Change the meaning of the window parameter to always indicate the number
 of codes to check *in addition* to the current code.  Note that for TOTP,
 the window goes in both directions; a window of 1 means to check the
 current code plus the previous and next.

include/cryb/oath.h

@@ -44,6 +44,8 @@ char *oath_key_to_uri(const struct oath_key *);
 
 struct oath_key *oath_key_dummy(enum oath_mode, enum oath_hash, unsigned int);
 
+enum oath_mode oath_mode(const char *);
+
 unsigned int oath_hotp(const uint8_t *, size_t, uint64_t, unsigned int);
 unsigned int oath_hotp_current(struct oath_key *);
 int oath_hotp_match(struct oath_key *, unsigned int, int);

lib/oath/oath_hotp.c

@@ -29,6 +29,7 @@
 
 #include "cryb/impl.h"
 
+#include <limits.h>
 #include <stdint.h>
 #include <string.h>
 
@@ -89,11 +90,11 @@ oath_hotp_current(struct oath_key *k)
 	unsigned int code;
 
 	if (k == NULL)
-		return (-1);
+		return (UINT_MAX);
 	if (k->mode != om_hotp)
-		return (-1);
+		return (UINT_MAX);
 	if (k->counter == UINT64_MAX)
-		return (-1);
+		return (UINT_MAX);
 	code = oath_hotp(k->key, k->keylen, k->counter, k->digits);
 	k->counter += 1;
 	return (code);
@@ -111,13 +112,13 @@ oath_hotp_match(struct oath_key *k, unsigned int response, int window)
 
 	if (k == NULL)
 		return (-1);
-	if (window < 1)
+	if (window < 0)
 		return (-1);
 	if (k->mode != om_hotp)
 		return (-1);
-	if (k->counter >= UINT64_MAX - window)
+	if (k->counter >= UINT64_MAX - window - 1)
 		return (-1);
-	for (int i = 0; i < window; ++i) {
+	for (int i = 0; i <= window; ++i) {
 		code = oath_hotp(k->key, k->keylen, k->counter + i, k->digits);
 		if (code == response && !k->dummy) {
 			k->counter = k->counter + i;

lib/oath/oath_mode.c

@@ -0,0 +1,70 @@
+/*-
+ * Copyright (c) 2014 The University of Oslo
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <strings.h>
+
+#include <security/oath.h>
+
+static const char *oath_mode_names[om_max] = {
+	[om_hotp] = "hotp",
+	[om_totp] = "totp",
+};
+
+/*
+ * OATH
+ *
+ * Converts a mode name to the corresponding enum value
+ */
+
+enum oath_mode
+oath_mode(const char *str)
+{
+	enum oath_mode om;
+
+	for (om = 0; om < om_max; ++om) {
+		if (oath_mode_names[om] != NULL &&
+		    strcasecmp(oath_mode_names[om], str) == 0) {
+			return (om);
+		}
+	}
+	return (om_undef);
+}
+
+/**
+ * The =oath_mode function returns the =enum oath_mode value that
+ * corresponds to the specified string.
+ *
+ * AUTHOR UIO
+ */

lib/oath/oath_totp.c

@@ -29,6 +29,7 @@
 
 #include "cryb/impl.h"
 
+#include <limits.h>
 #include <stdint.h>
 #include <string.h>
 #include <time.h>
@@ -53,11 +54,11 @@ oath_totp_current(const struct oath_key *k)
 	uint64_t seq;
 
 	if (k == NULL)
-		return (-1);
+		return (UINT_MAX);
 	if (k->mode != om_totp)
-		return (-1);
+		return (UINT_MAX);
 	if (k->timestep == 0)
-		return (-1);
+		return (UINT_MAX);
 	seq = time(NULL) / k->timestep;
 	code = oath_hotp(k->key, k->keylen, seq, k->digits);
 	return (code);
@@ -76,7 +77,7 @@ oath_totp_match(struct oath_key *k, unsigned int response, int window)
 
 	if (k == NULL)
 		return (-1);
-	if (window < 1)
+	if (window < 0)
 		return (-1);
 	if (k->mode != om_totp)
 		return (-1);