1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 *
25 * getpwent.c
26 *
27 * lib/nsswitch/compat/getpwent.c -- name-service-switch backend for getpwnam()
28 * et al that does 4.x compatibility. It looks in /etc/passwd; if it finds
29 * passwd entries there that begin with "+" or "-", it consults other
30 * services. By default it uses NIS (YP), but the user can override this
31 * with a "passwd_compat" entry in /etc/nsswitch.conf, e.g.
32 * passwd_compat: ldap
33 *
34 * This code tries to produce the same results as the 4.x code, even when
35 * the latter seems ill thought-out (mostly in the handling of netgroups,
36 * "-", and the combination thereof). Bug-compatible, in other words.
37 * Though we do try to be more reasonable about the format of "+" and "-"
38 * entries here, i.e. you don't have to pad them with spurious colons and
39 * bogus uid/gid values.
40 *
41 * Caveats:
42 * - More than one source may be specified, with the usual switch semantics,
43 * but having multiple sources here is definitely odd.
44 * - People who recursively specify "compat" deserve what they get.
45 * - Entries that begin with "+@" or "-@" are interpreted using
46 * getnetgrent() and innetgr(), which use the "netgroup" entry in
47 * /etc/nsswitch.conf. If the sources for "passwd_compat" and "netgroup"
48 * differ, everything should work fine, but the semantics will be pretty
49 * confusing.
50 */
51
52 #include <pwd.h>
53 #include <shadow.h> /* For PASSWD (pathname to passwd file) */
54 #include <stdlib.h>
55 #include <strings.h>
56 #include "compat_common.h"
57
58 static DEFINE_NSS_DB_ROOT(db_root);
59
60 static void
_nss_initf_passwd_compat(p)61 _nss_initf_passwd_compat(p)
62 nss_db_params_t *p;
63 {
64 p->name = NSS_DBNAM_PASSWD;
65 p->config_name = NSS_DBNAM_PASSWD_COMPAT;
66 p->default_config = NSS_DEFCONF_PASSWD_COMPAT;
67 }
68
69 /*
70 * Validates passwd entry replacing uid/gid > MAXUID by ID_NOBODY.
71 */
72 int
validate_passwd_ids(char * line,int * linelenp,int buflen,int extra_chars)73 validate_passwd_ids(char *line, int *linelenp, int buflen, int extra_chars)
74 {
75 char *linep, *limit, *uidp, *gidp;
76 uid_t uid;
77 gid_t gid;
78 ulong_t uidl, gidl;
79 int olduidlen, oldgidlen, idlen;
80 int linelen = *linelenp, newlinelen;
81
82 if (linelen == 0 || *line == '+' || *line == '-')
83 return (NSS_STR_PARSE_SUCCESS);
84
85 linep = line;
86 limit = line + linelen;
87
88 while (linep < limit && *linep++ != ':') /* skip username */
89 continue;
90 while (linep < limit && *linep++ != ':') /* skip password */
91 continue;
92 if (linep == limit)
93 return (NSS_STR_PARSE_PARSE);
94
95 uidp = linep;
96 uidl = strtoul(uidp, (char **)&linep, 10); /* grab uid */
97 olduidlen = linep - uidp;
98 if (++linep >= limit || olduidlen == 0)
99 return (NSS_STR_PARSE_PARSE);
100
101 gidp = linep;
102 gidl = strtoul(gidp, (char **)&linep, 10); /* grab gid */
103 oldgidlen = linep - gidp;
104 if (linep >= limit || oldgidlen == 0)
105 return (NSS_STR_PARSE_PARSE);
106
107 if (uidl <= MAXUID && gidl <= MAXUID)
108 return (NSS_STR_PARSE_SUCCESS);
109 uid = (uidl > MAXUID) ? UID_NOBODY : (uid_t)uidl;
110 gid = (gidl > MAXUID) ? GID_NOBODY : (gid_t)gidl;
111
112 /* Check if we have enough space in the buffer */
113 idlen = snprintf(NULL, 0, "%u:%u", uid, gid);
114 newlinelen = linelen + idlen - olduidlen - oldgidlen - 1;
115 if (newlinelen + extra_chars > buflen)
116 return (NSS_STR_PARSE_ERANGE);
117
118 /* Replace ephemeral ids by ID_NOBODY */
119 (void) bcopy(linep, uidp + idlen, limit - linep + extra_chars);
120 (void) snprintf(uidp, idlen + 1, "%u:%u", uid, gid);
121 *(uidp + idlen) = ':'; /* restore : that was overwritten by snprintf */
122 *linelenp = newlinelen;
123 return (NSS_STR_PARSE_SUCCESS);
124 }
125
126 static const char *
get_pwname(argp)127 get_pwname(argp)
128 nss_XbyY_args_t *argp;
129 {
130 struct passwd *p = (struct passwd *)argp->returnval;
131
132 return (p->pw_name);
133 }
134
135 static int
check_pwname(argp)136 check_pwname(argp)
137 nss_XbyY_args_t *argp;
138 {
139 struct passwd *p = (struct passwd *)argp->returnval;
140
141 return (strcmp(p->pw_name, argp->key.name) == 0);
142 }
143
144 static nss_status_t
getbyname(be,a)145 getbyname(be, a)
146 compat_backend_ptr_t be;
147 void *a;
148 {
149 nss_XbyY_args_t *argp = (nss_XbyY_args_t *)a;
150
151 return (_nss_compat_XY_all(be, argp,
152 check_pwname, NSS_DBOP_PASSWD_BYNAME));
153 }
154
155 static int
check_pwuid(argp)156 check_pwuid(argp)
157 nss_XbyY_args_t *argp;
158 {
159 struct passwd *p = (struct passwd *)argp->returnval;
160
161 return (p->pw_uid == argp->key.uid);
162 }
163
164 static nss_status_t
getbyuid(be,a)165 getbyuid(be, a)
166 compat_backend_ptr_t be;
167 void *a;
168 {
169 nss_XbyY_args_t *argp = (nss_XbyY_args_t *)a;
170
171 if (argp->key.uid > MAXUID)
172 return (NSS_NOTFOUND);
173 return (_nss_compat_XY_all(be, argp,
174 check_pwuid, NSS_DBOP_PASSWD_BYUID));
175 }
176
177 /*ARGSUSED*/
178 static int
merge_pwents(be,argp,fields)179 merge_pwents(be, argp, fields)
180 compat_backend_ptr_t be;
181 nss_XbyY_args_t *argp;
182 const char **fields;
183 {
184 struct passwd *pw = (struct passwd *)argp->buf.result;
185 char *buf = malloc(NSS_LINELEN_PASSWD);
186 char *s;
187 int parsestat;
188 int len;
189 int buflen;
190
191 if (buf == 0) {
192 return (NSS_STR_PARSE_PARSE);
193 /* Really "out of memory", but PARSE_PARSE will have to do */
194 }
195 /*
196 * Don't allow overriding of
197 * - username
198 * - uid
199 * - gid
200 * That's what the SunOS 4.x code did; who are we to question it...
201 */
202 s = buf;
203 buflen = argp->buf.buflen;
204
205 if (fields[1] != 0)
206 len = snprintf(s, buflen, "%s:%s",
207 pw->pw_name, fields[1]);
208 else {
209 /* ====> Does this do the right thing? */
210 if (pw->pw_age != 0 && *pw->pw_age != '\0')
211 len = snprintf(s, buflen, "%s:%s,%s",
212 pw->pw_name, pw->pw_passwd, pw->pw_age);
213 else
214 len = snprintf(s, buflen, "%s:%s",
215 pw->pw_name, pw->pw_passwd);
216 }
217
218 if (len > buflen)
219 return (NSS_STR_PARSE_ERANGE);
220
221 s += len;
222 buflen -= len;
223 len = snprintf(s, buflen, ":%u:%u:%s:%s:%s",
224 pw->pw_uid,
225 pw->pw_gid,
226 fields[4] != 0 ? fields[4] : pw->pw_gecos,
227 fields[5] != 0 ? fields[5] : pw->pw_dir,
228 fields[6] != 0 ? fields[6] : pw->pw_shell);
229
230 if (len > buflen)
231 return (NSS_STR_PARSE_ERANGE);
232
233 s += len;
234 len = s - buf;
235
236 /*
237 * if asked, return the data in /etc file format
238 */
239 if (be->return_string_data == 1) {
240 /* reset the result ptr to the original value */
241 argp->buf.result = NULL;
242
243 if (len > argp->buf.buflen) {
244 parsestat = NSS_STR_PARSE_ERANGE;
245 } else {
246 (void) strncpy(argp->buf.buffer, buf, len);
247 argp->returnval = argp->buf.buffer;
248 argp->returnlen = len;
249 parsestat = NSS_SUCCESS;
250 }
251 } else {
252 parsestat = (*argp->str2ent)(buf, len,
253 argp->buf.result,
254 argp->buf.buffer,
255 argp->buf.buflen);
256 }
257 free(buf);
258 return (parsestat);
259 }
260
261 static compat_backend_op_t passwd_ops[] = {
262 _nss_compat_destr,
263 _nss_compat_endent,
264 _nss_compat_setent,
265 _nss_compat_getent,
266 getbyname,
267 getbyuid
268 };
269
270 /*ARGSUSED*/
271 nss_backend_t *
_nss_compat_passwd_constr(dummy1,dummy2,dummy3)272 _nss_compat_passwd_constr(dummy1, dummy2, dummy3)
273 const char *dummy1, *dummy2, *dummy3;
274 {
275 return (_nss_compat_constr(passwd_ops,
276 sizeof (passwd_ops) / sizeof (passwd_ops[0]),
277 PASSWD,
278 NSS_LINELEN_PASSWD,
279 &db_root,
280 _nss_initf_passwd_compat,
281 1,
282 get_pwname,
283 merge_pwents));
284 }
285