2 * Copyright (c) 2003 Networks Associates Technology, Inc.
5 * This software was developed for the FreeBSD Project by
6 * Jacques A. Vidrine, Safeport Network Services, and Network
7 * Associates Laboratories, the Security Research Division of Network
8 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
9 * ("CBOSS"), as part of the DARPA CHATS research program.
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
36 #include "namespace.h"
37 #include <sys/param.h>
40 #include <rpcsvc/yp_prot.h>
41 #include <rpcsvc/ypclnt.h>
43 #include <arpa/inet.h>
52 #include <pthread_np.h>
59 #include "un-namespace.h"
61 #include "libc_private.h"
69 #define CTASSERT(x) _CTASSERT(x, __LINE__)
70 #define _CTASSERT(x, y) __CTASSERT(x, y)
71 #define __CTASSERT(x, y) typedef char __assert_ ## y [(x) ? 1 : -1]
74 /* Counter as stored in /etc/pwd.db */
77 CTASSERT(MAXLOGNAME > sizeof(uid_t));
78 CTASSERT(MAXLOGNAME > sizeof(pwkeynum));
81 PWD_STORAGE_INITIAL = 1 << 10, /* 1 KByte */
82 PWD_STORAGE_MAX = 1 << 20, /* 1 MByte */
88 static const ns_src defaultsrc[] = {
89 { NSSRC_COMPAT, NS_SUCCESS },
93 int __pw_match_entry(const char *, size_t, enum nss_lookup_type,
95 int __pw_parse_entry(char *, size_t, struct passwd *, int, int *errnop);
97 static void pwd_init(struct passwd *);
104 static struct passwd *getpw(int (*fn)(union key, struct passwd *, char *,
105 size_t, struct passwd **), union key);
106 static int wrap_getpwnam_r(union key, struct passwd *, char *,
107 size_t, struct passwd **);
108 static int wrap_getpwuid_r(union key, struct passwd *, char *, size_t,
110 static int wrap_getpwent_r(union key, struct passwd *, char *, size_t,
113 static int pwdb_match_entry_v3(char *, size_t, enum nss_lookup_type,
114 const char *, uid_t);
115 static int pwdb_parse_entry_v3(char *, size_t, struct passwd *, int *);
116 static int pwdb_match_entry_v4(char *, size_t, enum nss_lookup_type,
117 const char *, uid_t);
118 static int pwdb_parse_entry_v4(char *, size_t, struct passwd *, int *);
122 int (*match)(char *, size_t, enum nss_lookup_type, const char *,
124 int (*parse)(char *, size_t, struct passwd *, int *);
125 } pwdb_versions[] = {
126 { NULL, NULL }, /* version 0 */
127 { NULL, NULL }, /* version 1 */
128 { NULL, NULL }, /* version 2 */
129 { pwdb_match_entry_v3, pwdb_parse_entry_v3 }, /* version 3 */
130 { pwdb_match_entry_v4, pwdb_parse_entry_v4 }, /* version 4 */
140 static void files_endstate(void *);
141 NSS_TLS_HANDLING(files);
142 static DB *pwdbopen(int *);
143 static void files_endstate(void *);
144 static int files_setpwent(void *, void *, va_list);
145 static int files_passwd(void *, void *, va_list);
152 static void dns_endstate(void *);
153 NSS_TLS_HANDLING(dns);
154 static int dns_setpwent(void *, void *, va_list);
155 static int dns_passwd(void *, void *, va_list);
161 char domain[MAXHOSTNAMELEN];
166 static void nis_endstate(void *);
167 NSS_TLS_HANDLING(nis);
168 static int nis_setpwent(void *, void *, va_list);
169 static int nis_passwd(void *, void *, va_list);
170 static int nis_map(char *, enum nss_lookup_type, char *, size_t, int *);
171 static int nis_adjunct(char *, const char *, char *, size_t);
175 struct compat_state {
181 struct passwd template;
190 static void compat_endstate(void *);
191 NSS_TLS_HANDLING(compat);
192 static int compat_setpwent(void *, void *, va_list);
193 static int compat_passwd(void *, void *, va_list);
194 static void compat_clear_template(struct passwd *);
195 static int compat_set_template(struct passwd *, struct passwd *);
196 static int compat_use_template(struct passwd *, struct passwd *, char *,
198 static int compat_redispatch(struct compat_state *, enum nss_lookup_type,
199 enum nss_lookup_type, const char *, const char *, uid_t,
200 struct passwd *, char *, size_t, int *);
203 static int pwd_id_func(char *, size_t *, va_list ap, void *);
204 static int pwd_marshal_func(char *, size_t *, void *, va_list, void *);
205 static int pwd_unmarshal_func(char *, size_t, void *, va_list, void *);
208 pwd_id_func(char *buffer, size_t *buffer_size, va_list ap, void *cache_mdata)
212 size_t size, desired_size;
213 int res = NS_UNAVAIL;
214 enum nss_lookup_type lookup_type;
216 lookup_type = (enum nss_lookup_type)cache_mdata;
217 switch (lookup_type) {
219 name = va_arg(ap, char *);
221 desired_size = sizeof(enum nss_lookup_type) + size + 1;
222 if (desired_size > *buffer_size) {
227 memcpy(buffer, &lookup_type, sizeof(enum nss_lookup_type));
228 memcpy(buffer + sizeof(enum nss_lookup_type), name, size + 1);
233 uid = va_arg(ap, uid_t);
234 desired_size = sizeof(enum nss_lookup_type) + sizeof(uid_t);
235 if (desired_size > *buffer_size) {
240 memcpy(buffer, &lookup_type, sizeof(enum nss_lookup_type));
241 memcpy(buffer + sizeof(enum nss_lookup_type), &uid,
247 /* should be unreachable */
252 *buffer_size = desired_size;
257 pwd_marshal_func(char *buffer, size_t *buffer_size, void *retval, va_list ap,
264 size_t orig_buf_size;
266 struct passwd new_pwd;
267 size_t desired_size, size;
270 switch ((enum nss_lookup_type)cache_mdata) {
272 name = va_arg(ap, char *);
275 uid = va_arg(ap, uid_t);
280 /* should be unreachable */
284 pwd = va_arg(ap, struct passwd *);
285 orig_buf = va_arg(ap, char *);
286 orig_buf_size = va_arg(ap, size_t);
288 desired_size = sizeof(struct passwd) + sizeof(char *) +
289 strlen(pwd->pw_name) + 1;
290 if (pwd->pw_passwd != NULL)
291 desired_size += strlen(pwd->pw_passwd) + 1;
292 if (pwd->pw_class != NULL)
293 desired_size += strlen(pwd->pw_class) + 1;
294 if (pwd->pw_gecos != NULL)
295 desired_size += strlen(pwd->pw_gecos) + 1;
296 if (pwd->pw_dir != NULL)
297 desired_size += strlen(pwd->pw_dir) + 1;
298 if (pwd->pw_shell != NULL)
299 desired_size += strlen(pwd->pw_shell) + 1;
301 if (*buffer_size < desired_size) {
302 /* this assignment is here for future use */
303 *buffer_size = desired_size;
307 memcpy(&new_pwd, pwd, sizeof(struct passwd));
308 memset(buffer, 0, desired_size);
310 *buffer_size = desired_size;
311 p = buffer + sizeof(struct passwd) + sizeof(char *);
312 memcpy(buffer + sizeof(struct passwd), &p, sizeof(char *));
314 if (new_pwd.pw_name != NULL) {
315 size = strlen(new_pwd.pw_name);
316 memcpy(p, new_pwd.pw_name, size);
321 if (new_pwd.pw_passwd != NULL) {
322 size = strlen(new_pwd.pw_passwd);
323 memcpy(p, new_pwd.pw_passwd, size);
324 new_pwd.pw_passwd = p;
328 if (new_pwd.pw_class != NULL) {
329 size = strlen(new_pwd.pw_class);
330 memcpy(p, new_pwd.pw_class, size);
331 new_pwd.pw_class = p;
335 if (new_pwd.pw_gecos != NULL) {
336 size = strlen(new_pwd.pw_gecos);
337 memcpy(p, new_pwd.pw_gecos, size);
338 new_pwd.pw_gecos = p;
342 if (new_pwd.pw_dir != NULL) {
343 size = strlen(new_pwd.pw_dir);
344 memcpy(p, new_pwd.pw_dir, size);
349 if (new_pwd.pw_shell != NULL) {
350 size = strlen(new_pwd.pw_shell);
351 memcpy(p, new_pwd.pw_shell, size);
352 new_pwd.pw_shell = p;
356 memcpy(buffer, &new_pwd, sizeof(struct passwd));
361 pwd_unmarshal_func(char *buffer, size_t buffer_size, void *retval, va_list ap,
368 size_t orig_buf_size;
373 switch ((enum nss_lookup_type)cache_mdata) {
375 name = va_arg(ap, char *);
378 uid = va_arg(ap, uid_t);
383 /* should be unreachable */
387 pwd = va_arg(ap, struct passwd *);
388 orig_buf = va_arg(ap, char *);
389 orig_buf_size = va_arg(ap, size_t);
390 ret_errno = va_arg(ap, int *);
393 buffer_size - sizeof(struct passwd) - sizeof(char *)) {
398 memcpy(pwd, buffer, sizeof(struct passwd));
399 memcpy(&p, buffer + sizeof(struct passwd), sizeof(char *));
400 memcpy(orig_buf, buffer + sizeof(struct passwd) + sizeof(char *),
401 buffer_size - sizeof(struct passwd) - sizeof(char *));
403 NS_APPLY_OFFSET(pwd->pw_name, orig_buf, p, char *);
404 NS_APPLY_OFFSET(pwd->pw_passwd, orig_buf, p, char *);
405 NS_APPLY_OFFSET(pwd->pw_class, orig_buf, p, char *);
406 NS_APPLY_OFFSET(pwd->pw_gecos, orig_buf, p, char *);
407 NS_APPLY_OFFSET(pwd->pw_dir, orig_buf, p, char *);
408 NS_APPLY_OFFSET(pwd->pw_shell, orig_buf, p, char *);
411 *((struct passwd **)retval) = pwd;
416 NSS_MP_CACHE_HANDLING(passwd);
417 #endif /* NS_CACHING */
423 static const nss_cache_info cache_info = NS_MP_CACHE_INFO_INITIALIZER(
424 passwd, (void *)nss_lt_all,
428 static const ns_dtab dtab[] = {
429 { NSSRC_FILES, files_setpwent, (void *)SETPWENT },
431 { NSSRC_DNS, dns_setpwent, (void *)SETPWENT },
434 { NSSRC_NIS, nis_setpwent, (void *)SETPWENT },
436 { NSSRC_COMPAT, compat_setpwent, (void *)SETPWENT },
438 NS_CACHE_CB(&cache_info)
442 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "setpwent", defaultsrc, 0);
447 setpassent(int stayopen)
450 static const nss_cache_info cache_info = NS_MP_CACHE_INFO_INITIALIZER(
451 passwd, (void *)nss_lt_all,
455 static const ns_dtab dtab[] = {
456 { NSSRC_FILES, files_setpwent, (void *)SETPWENT },
458 { NSSRC_DNS, dns_setpwent, (void *)SETPWENT },
461 { NSSRC_NIS, nis_setpwent, (void *)SETPWENT },
463 { NSSRC_COMPAT, compat_setpwent, (void *)SETPWENT },
465 NS_CACHE_CB(&cache_info)
469 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "setpwent", defaultsrc,
479 static const nss_cache_info cache_info = NS_MP_CACHE_INFO_INITIALIZER(
480 passwd, (void *)nss_lt_all,
484 static const ns_dtab dtab[] = {
485 { NSSRC_FILES, files_setpwent, (void *)ENDPWENT },
487 { NSSRC_DNS, dns_setpwent, (void *)ENDPWENT },
490 { NSSRC_NIS, nis_setpwent, (void *)ENDPWENT },
492 { NSSRC_COMPAT, compat_setpwent, (void *)ENDPWENT },
494 NS_CACHE_CB(&cache_info)
498 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "endpwent", defaultsrc);
503 getpwent_r(struct passwd *pwd, char *buffer, size_t bufsize,
504 struct passwd **result)
507 static const nss_cache_info cache_info = NS_MP_CACHE_INFO_INITIALIZER(
508 passwd, (void *)nss_lt_all,
509 pwd_marshal_func, pwd_unmarshal_func);
512 static const ns_dtab dtab[] = {
513 { NSSRC_FILES, files_passwd, (void *)nss_lt_all },
515 { NSSRC_DNS, dns_passwd, (void *)nss_lt_all },
518 { NSSRC_NIS, nis_passwd, (void *)nss_lt_all },
520 { NSSRC_COMPAT, compat_passwd, (void *)nss_lt_all },
522 NS_CACHE_CB(&cache_info)
531 rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwent_r", defaultsrc,
532 pwd, buffer, bufsize, &ret_errno);
533 if (rv == NS_SUCCESS)
541 getpwnam_r(const char *name, struct passwd *pwd, char *buffer, size_t bufsize,
542 struct passwd **result)
545 static const nss_cache_info cache_info =
546 NS_COMMON_CACHE_INFO_INITIALIZER(
547 passwd, (void *)nss_lt_name,
548 pwd_id_func, pwd_marshal_func, pwd_unmarshal_func);
551 static const ns_dtab dtab[] = {
552 { NSSRC_FILES, files_passwd, (void *)nss_lt_name },
554 { NSSRC_DNS, dns_passwd, (void *)nss_lt_name },
557 { NSSRC_NIS, nis_passwd, (void *)nss_lt_name },
559 { NSSRC_COMPAT, compat_passwd, (void *)nss_lt_name },
561 NS_CACHE_CB(&cache_info)
570 rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwnam_r", defaultsrc,
571 name, pwd, buffer, bufsize, &ret_errno);
572 if (rv == NS_SUCCESS)
580 getpwuid_r(uid_t uid, struct passwd *pwd, char *buffer, size_t bufsize,
581 struct passwd **result)
584 static const nss_cache_info cache_info =
585 NS_COMMON_CACHE_INFO_INITIALIZER(
586 passwd, (void *)nss_lt_id,
587 pwd_id_func, pwd_marshal_func, pwd_unmarshal_func);
590 static const ns_dtab dtab[] = {
591 { NSSRC_FILES, files_passwd, (void *)nss_lt_id },
593 { NSSRC_DNS, dns_passwd, (void *)nss_lt_id },
596 { NSSRC_NIS, nis_passwd, (void *)nss_lt_id },
598 { NSSRC_COMPAT, compat_passwd, (void *)nss_lt_id },
600 NS_CACHE_CB(&cache_info)
609 rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwuid_r", defaultsrc,
610 uid, pwd, buffer, bufsize, &ret_errno);
611 if (rv == NS_SUCCESS)
619 pwd_init(struct passwd *pwd)
621 static char nul[] = "";
623 memset(pwd, 0, sizeof(*pwd));
624 pwd->pw_uid = (uid_t)-1; /* Considered least likely to lead to */
625 pwd->pw_gid = (gid_t)-1; /* a security issue. */
627 pwd->pw_passwd = nul;
635 static struct passwd pwd;
636 static char *pwd_storage;
637 static size_t pwd_storage_size;
640 static struct passwd *
641 getpw(int (*fn)(union key, struct passwd *, char *, size_t, struct passwd **),
647 if (pwd_storage == NULL) {
648 pwd_storage = malloc(PWD_STORAGE_INITIAL);
649 if (pwd_storage == NULL)
651 pwd_storage_size = PWD_STORAGE_INITIAL;
654 rv = fn(key, &pwd, pwd_storage, pwd_storage_size, &res);
655 if (res == NULL && rv == ERANGE) {
657 if ((pwd_storage_size << 1) > PWD_STORAGE_MAX) {
662 pwd_storage_size <<= 1;
663 pwd_storage = malloc(pwd_storage_size);
664 if (pwd_storage == NULL)
667 } while (res == NULL && rv == ERANGE);
675 wrap_getpwnam_r(union key key, struct passwd *pwd, char *buffer,
676 size_t bufsize, struct passwd **res)
678 return (getpwnam_r(key.name, pwd, buffer, bufsize, res));
683 wrap_getpwuid_r(union key key, struct passwd *pwd, char *buffer,
684 size_t bufsize, struct passwd **res)
686 return (getpwuid_r(key.uid, pwd, buffer, bufsize, res));
691 wrap_getpwent_r(union key key __unused, struct passwd *pwd, char *buffer,
692 size_t bufsize, struct passwd **res)
694 return (getpwent_r(pwd, buffer, bufsize, res));
699 getpwnam(const char *name)
704 return (getpw(wrap_getpwnam_r, key));
714 return (getpw(wrap_getpwuid_r, key));
723 key.uid = 0; /* not used */
724 return (getpw(wrap_getpwent_r, key));
732 pwdbopen(int *version)
738 if (geteuid() != 0 ||
739 (res = dbopen(_PATH_SMP_DB, O_RDONLY, 0, DB_HASH, NULL)) == NULL)
740 res = dbopen(_PATH_MP_DB, O_RDONLY, 0, DB_HASH, NULL);
743 key.data = _PWD_VERSION_KEY;
744 key.size = strlen(_PWD_VERSION_KEY);
745 rv = res->get(res, &key, &entry, 0);
747 *version = *(unsigned char *)entry.data;
751 *version >= sizeof(pwdb_versions)/sizeof(pwdb_versions[0])) {
752 syslog(LOG_CRIT, "Unsupported password database version %d",
762 files_endstate(void *p)
768 db = ((struct files_state *)p)->db;
776 files_setpwent(void *retval, void *mdata, va_list ap)
778 struct files_state *st;
781 rv = files_getstate(&st);
784 switch ((enum constants)mdata) {
786 stayopen = va_arg(ap, int);
789 st->db = pwdbopen(&st->version);
790 st->stayopen = stayopen;
793 if (st->db != NULL) {
794 (void)st->db->close(st->db);
806 files_passwd(void *retval, void *mdata, va_list ap)
808 char keybuf[MAXLOGNAME + 1];
810 struct files_state *st;
811 enum nss_lookup_type how;
815 size_t bufsize, namesize;
818 int rv, stayopen, *errnop;
822 how = (enum nss_lookup_type)mdata;
825 name = va_arg(ap, const char *);
826 keybuf[0] = _PW_KEYBYNAME;
829 uid = va_arg(ap, uid_t);
830 keybuf[0] = _PW_KEYBYUID;
833 keybuf[0] = _PW_KEYBYNUM;
839 pwd = va_arg(ap, struct passwd *);
840 buffer = va_arg(ap, char *);
841 bufsize = va_arg(ap, size_t);
842 errnop = va_arg(ap, int *);
843 *errnop = files_getstate(&st);
846 if (how == nss_lt_all && st->keynum < 0) {
850 if (st->db == NULL &&
851 (st->db = pwdbopen(&st->version)) == NULL) {
856 if (how == nss_lt_all)
859 stayopen = st->stayopen;
864 /* MAXLOGNAME includes NUL byte, but we do not
865 * include the NUL byte in the key.
867 namesize = strlcpy(&keybuf[1], name, sizeof(keybuf)-1);
868 if (namesize >= sizeof(keybuf)-1) {
873 key.size = namesize + 1;
876 if (st->version < _PWD_CURRENT_VERSION) {
877 memcpy(&keybuf[1], &uid, sizeof(uid));
878 key.size = sizeof(uid) + 1;
881 memcpy(&keybuf[1], &store, sizeof(store));
882 key.size = sizeof(store) + 1;
887 if (st->version < _PWD_CURRENT_VERSION) {
888 memcpy(&keybuf[1], &st->keynum,
890 key.size = sizeof(st->keynum) + 1;
892 store = htonl(st->keynum);
893 memcpy(&keybuf[1], &store, sizeof(store));
894 key.size = sizeof(store) + 1;
898 keybuf[0] = _PW_VERSIONED(keybuf[0], st->version);
899 rv = st->db->get(st->db, &key, &entry, 0);
900 if (rv < 0 || rv > 1) { /* should never return > 1 */
904 } else if (rv == 1) {
905 if (how == nss_lt_all)
910 rv = pwdb_versions[st->version].match(entry.data, entry.size,
912 if (rv != NS_SUCCESS)
914 if (entry.size > bufsize) {
919 memcpy(buffer, entry.data, entry.size);
920 rv = pwdb_versions[st->version].parse(buffer, entry.size, pwd,
922 } while (how == nss_lt_all && !(rv & NS_TERMINATE));
924 if (!stayopen && st->db != NULL) {
925 (void)st->db->close(st->db);
928 if (rv == NS_SUCCESS) {
929 pwd->pw_fields &= ~_PWF_SOURCE;
930 pwd->pw_fields |= _PWF_FILES;
932 *(struct passwd **)retval = pwd;
939 pwdb_match_entry_v3(char *entry, size_t entrysize, enum nss_lookup_type how,
940 const char *name, uid_t uid)
945 eom = &entry[entrysize];
946 for (p = entry; p < eom; p++)
950 return (NS_NOTFOUND);
951 if (how == nss_lt_all)
953 if (how == nss_lt_name)
954 return (strcmp(name, entry) == 0 ? NS_SUCCESS : NS_NOTFOUND);
955 for (p++; p < eom; p++)
958 if (*p != '\0' || (++p) + sizeof(uid) >= eom)
959 return (NS_NOTFOUND);
960 memcpy(&uid2, p, sizeof(uid2));
961 return (uid == uid2 ? NS_SUCCESS : NS_NOTFOUND);
966 pwdb_parse_entry_v3(char *buffer, size_t bufsize, struct passwd *pwd,
970 int32_t pw_change, pw_expire;
972 /* THIS CODE MUST MATCH THAT IN pwd_mkdb. */
974 eom = &buffer[bufsize];
975 #define STRING(field) do { \
977 while (p < eom && *p != '\0') \
980 return (NS_NOTFOUND); \
983 #define SCALAR(field) do { \
984 if (p + sizeof(field) > eom) \
985 return (NS_NOTFOUND); \
986 memcpy(&(field), p, sizeof(field)); \
987 p += sizeof(field); \
989 STRING(pwd->pw_name);
990 STRING(pwd->pw_passwd);
994 STRING(pwd->pw_class);
995 STRING(pwd->pw_gecos);
997 STRING(pwd->pw_shell);
999 SCALAR(pwd->pw_fields);
1002 pwd->pw_change = pw_change;
1003 pwd->pw_expire = pw_expire;
1004 return (NS_SUCCESS);
1009 pwdb_match_entry_v4(char *entry, size_t entrysize, enum nss_lookup_type how,
1010 const char *name, uid_t uid)
1012 const char *p, *eom;
1015 eom = &entry[entrysize];
1016 for (p = entry; p < eom; p++)
1020 return (NS_NOTFOUND);
1021 if (how == nss_lt_all)
1022 return (NS_SUCCESS);
1023 if (how == nss_lt_name)
1024 return (strcmp(name, entry) == 0 ? NS_SUCCESS : NS_NOTFOUND);
1025 for (p++; p < eom; p++)
1028 if (*p != '\0' || (++p) + sizeof(uid) >= eom)
1029 return (NS_NOTFOUND);
1030 memcpy(&uid2, p, sizeof(uid2));
1032 return (uid == (uid_t)uid2 ? NS_SUCCESS : NS_NOTFOUND);
1037 pwdb_parse_entry_v4(char *buffer, size_t bufsize, struct passwd *pwd,
1043 /* THIS CODE MUST MATCH THAT IN pwd_mkdb. */
1045 eom = &buffer[bufsize];
1046 #define STRING(field) do { \
1048 while (p < eom && *p != '\0') \
1051 return (NS_NOTFOUND); \
1054 #define SCALAR(field) do { \
1055 if (p + sizeof(n) > eom) \
1056 return (NS_NOTFOUND); \
1057 memcpy(&n, p, sizeof(n)); \
1058 (field) = ntohl(n); \
1061 STRING(pwd->pw_name);
1062 STRING(pwd->pw_passwd);
1063 SCALAR(pwd->pw_uid);
1064 SCALAR(pwd->pw_gid);
1065 SCALAR(pwd->pw_change);
1066 STRING(pwd->pw_class);
1067 STRING(pwd->pw_gecos);
1068 STRING(pwd->pw_dir);
1069 STRING(pwd->pw_shell);
1070 SCALAR(pwd->pw_expire);
1071 SCALAR(pwd->pw_fields);
1074 return (NS_SUCCESS);
1083 dns_endstate(void *p)
1090 dns_setpwent(void *retval, void *mdata, va_list ap)
1092 struct dns_state *st;
1095 rv = dns_getstate(&st);
1097 return (NS_UNAVAIL);
1099 return (NS_UNAVAIL);
1104 dns_passwd(void *retval, void *mdata, va_list ap)
1106 char buf[HESIOD_NAME_MAX];
1107 struct dns_state *st;
1109 const char *name, *label;
1111 char *buffer, **hes;
1112 size_t bufsize, linesize;
1114 enum nss_lookup_type how;
1121 how = (enum nss_lookup_type)mdata;
1124 name = va_arg(ap, const char *);
1127 uid = va_arg(ap, uid_t);
1132 pwd = va_arg(ap, struct passwd *);
1133 buffer = va_arg(ap, char *);
1134 bufsize = va_arg(ap, size_t);
1135 errnop = va_arg(ap, int *);
1136 *errnop = dns_getstate(&st);
1138 return (NS_UNAVAIL);
1139 if (hesiod_init(&ctx) != 0) {
1151 if (snprintf(buf, sizeof(buf), "%lu",
1152 (unsigned long)uid) >= sizeof(buf))
1157 if (st->counter < 0)
1159 if (snprintf(buf, sizeof(buf), "passwd-%ld",
1160 st->counter++) >= sizeof(buf))
1165 hes = hesiod_resolve(ctx, label,
1166 how == nss_lt_id ? "uid" : "passwd");
1168 if (how == nss_lt_all)
1170 if (errno != ENOENT)
1174 rv = __pw_match_entry(hes[0], strlen(hes[0]), how, name, uid);
1175 if (rv != NS_SUCCESS) {
1176 hesiod_free_list(ctx, hes);
1180 linesize = strlcpy(buffer, hes[0], bufsize);
1181 if (linesize >= bufsize) {
1186 hesiod_free_list(ctx, hes);
1188 rv = __pw_parse_entry(buffer, bufsize, pwd, 0, errnop);
1189 } while (how == nss_lt_all && !(rv & NS_TERMINATE));
1192 hesiod_free_list(ctx, hes);
1195 if (rv == NS_SUCCESS) {
1196 pwd->pw_fields &= ~_PWF_SOURCE;
1197 pwd->pw_fields |= _PWF_HESIOD;
1199 *(struct passwd **)retval = pwd;
1211 nis_endstate(void *p)
1213 free(((struct nis_state *)p)->key);
1218 * Test for the presence of special FreeBSD-specific master.passwd.by*
1219 * maps. We do this using yp_order(). If it fails, then either the server
1220 * doesn't have the map, or the YPPROC_ORDER procedure isn't supported by
1221 * the server (Sun NIS+ servers in YP compat mode behave this way). If
1222 * the master.passwd.by* maps don't exist, then let the lookup routine try
1223 * the regular passwd.by* maps instead. If the lookup routine fails, it
1224 * can return an error as needed.
1227 nis_map(char *domain, enum nss_lookup_type how, char *buffer, size_t bufsize,
1233 if (geteuid() == 0) {
1234 if (snprintf(buffer, bufsize, "master.passwd.by%s",
1235 (how == nss_lt_id) ? "uid" : "name") >= bufsize)
1236 return (NS_UNAVAIL);
1237 rv = yp_order(domain, buffer, &order);
1240 return (NS_SUCCESS);
1244 if (snprintf(buffer, bufsize, "passwd.by%s",
1245 (how == nss_lt_id) ? "uid" : "name") >= bufsize)
1246 return (NS_UNAVAIL);
1248 return (NS_SUCCESS);
1253 nis_adjunct(char *domain, const char *name, char *buffer, size_t bufsize)
1256 char *result, *p, *q, *eor;
1260 rv = yp_match(domain, "passwd.adjunct.byname", name, strlen(name),
1261 &result, &resultlen);
1265 eor = &result[resultlen];
1266 p = memchr(result, ':', eor - result);
1267 if (p != NULL && ++p < eor &&
1268 (q = memchr(p, ':', eor - p)) != NULL) {
1269 if (q - p >= bufsize)
1272 memcpy(buffer, p, q - p);
1273 buffer[q - p] ='\0';
1284 nis_setpwent(void *retval, void *mdata, va_list ap)
1286 struct nis_state *st;
1289 rv = nis_getstate(&st);
1291 return (NS_UNAVAIL);
1295 return (NS_UNAVAIL);
1300 nis_passwd(void *retval, void *mdata, va_list ap)
1303 struct nis_state *st;
1306 char *buffer, *key, *result;
1309 enum nss_lookup_type how;
1310 int *errnop, keylen, resultlen, rv, master;
1314 how = (enum nss_lookup_type)mdata;
1317 name = va_arg(ap, const char *);
1320 uid = va_arg(ap, uid_t);
1325 pwd = va_arg(ap, struct passwd *);
1326 buffer = va_arg(ap, char *);
1327 bufsize = va_arg(ap, size_t);
1328 errnop = va_arg(ap, int *);
1329 *errnop = nis_getstate(&st);
1331 return (NS_UNAVAIL);
1332 if (st->domain[0] == '\0') {
1333 if (getdomainname(st->domain, sizeof(st->domain)) != 0) {
1335 return (NS_UNAVAIL);
1338 rv = nis_map(st->domain, how, map, sizeof(map), &master);
1339 if (rv != NS_SUCCESS)
1346 if (strlcpy(buffer, name, bufsize) >= bufsize)
1350 if (snprintf(buffer, bufsize, "%lu",
1351 (unsigned long)uid) >= bufsize)
1360 if (how == nss_lt_all) {
1361 if (st->key == NULL)
1362 rv = yp_first(st->domain, map, &st->key,
1363 &st->keylen, &result, &resultlen);
1366 keylen = st->keylen;
1368 rv = yp_next(st->domain, map, key, keylen,
1369 &st->key, &st->keylen, &result,
1377 if (rv == YPERR_NOMORE)
1384 rv = yp_match(st->domain, map, buffer, strlen(buffer),
1385 &result, &resultlen);
1386 if (rv == YPERR_KEY) {
1389 } else if (rv != 0) {
1395 if (resultlen >= bufsize)
1397 memcpy(buffer, result, resultlen);
1398 buffer[resultlen] = '\0';
1400 rv = __pw_match_entry(buffer, resultlen, how, name, uid);
1401 if (rv == NS_SUCCESS)
1402 rv = __pw_parse_entry(buffer, resultlen, pwd, master,
1404 } while (how == nss_lt_all && !(rv & NS_TERMINATE));
1406 if (rv == NS_SUCCESS) {
1407 if (strstr(pwd->pw_passwd, "##") != NULL) {
1408 rv = nis_adjunct(st->domain, pwd->pw_name,
1409 &buffer[resultlen+1], bufsize-resultlen-1);
1413 pwd->pw_passwd = &buffer[resultlen+1];
1415 pwd->pw_fields &= ~_PWF_SOURCE;
1416 pwd->pw_fields |= _PWF_NIS;
1418 *(struct passwd **)retval = pwd;
1433 compat_clear_template(struct passwd *template)
1436 free(template->pw_passwd);
1437 free(template->pw_gecos);
1438 free(template->pw_dir);
1439 free(template->pw_shell);
1440 memset(template, 0, sizeof(*template));
1445 compat_set_template(struct passwd *src, struct passwd *template)
1448 compat_clear_template(template);
1449 #ifdef PW_OVERRIDE_PASSWD
1450 if ((src->pw_fields & _PWF_PASSWD) &&
1451 (template->pw_passwd = strdup(src->pw_passwd)) == NULL)
1454 if (src->pw_fields & _PWF_UID)
1455 template->pw_uid = src->pw_uid;
1456 if (src->pw_fields & _PWF_GID)
1457 template->pw_gid = src->pw_gid;
1458 if ((src->pw_fields & _PWF_GECOS) &&
1459 (template->pw_gecos = strdup(src->pw_gecos)) == NULL)
1461 if ((src->pw_fields & _PWF_DIR) &&
1462 (template->pw_dir = strdup(src->pw_dir)) == NULL)
1464 if ((src->pw_fields & _PWF_SHELL) &&
1465 (template->pw_shell = strdup(src->pw_shell)) == NULL)
1467 template->pw_fields = src->pw_fields;
1470 syslog(LOG_ERR, "getpwent memory allocation failure");
1476 compat_use_template(struct passwd *pwd, struct passwd *template, char *buffer,
1480 char *copy, *p, *q, *eob;
1483 /* We cannot know the layout of the password fields in `buffer',
1484 * so we have to copy everything.
1486 if (template->pw_fields == 0) /* nothing to fill-in */
1489 n += pwd->pw_name != NULL ? strlen(pwd->pw_name) + 1 : 0;
1490 n += pwd->pw_passwd != NULL ? strlen(pwd->pw_passwd) + 1 : 0;
1491 n += pwd->pw_class != NULL ? strlen(pwd->pw_class) + 1 : 0;
1492 n += pwd->pw_gecos != NULL ? strlen(pwd->pw_gecos) + 1 : 0;
1493 n += pwd->pw_dir != NULL ? strlen(pwd->pw_dir) + 1 : 0;
1494 n += pwd->pw_shell != NULL ? strlen(pwd->pw_shell) + 1 : 0;
1497 syslog(LOG_ERR, "getpwent memory allocation failure");
1502 #define COPY(field) do { \
1503 if (pwd->field == NULL) \
1504 hold.field = NULL; \
1507 p += strlcpy(p, pwd->field, eob-p) + 1; \
1518 eob = &buffer[bufsize];
1519 #define COPY(field, flag) do { \
1520 q = (template->pw_fields & flag) ? template->field : hold.field; \
1522 pwd->field = NULL; \
1525 if ((n = strlcpy(p, q, eob-p)) >= eob-p) { \
1533 #ifdef PW_OVERRIDE_PASSWD
1534 COPY(pw_passwd, _PWF_PASSWD);
1539 COPY(pw_gecos, _PWF_GECOS);
1540 COPY(pw_dir, _PWF_DIR);
1541 COPY(pw_shell, _PWF_SHELL);
1543 #define COPY(field, flag) do { \
1544 if (template->pw_fields & flag) \
1545 pwd->field = template->field; \
1547 COPY(pw_uid, _PWF_UID);
1548 COPY(pw_gid, _PWF_GID);
1556 compat_exclude(const char *name, DB **db)
1561 (*db = dbopen(NULL, O_RDWR, 600, DB_HASH, 0)) == NULL)
1563 key.size = strlen(name);
1564 key.data = (char *)name;
1568 if ((*db)->put(*db, &key, &data, 0) == -1)
1575 compat_is_excluded(const char *name, DB *db)
1581 key.size = strlen(name);
1582 key.data = (char *)name;
1583 return (db->get(db, &key, &data, 0) == 0);
1588 compat_redispatch(struct compat_state *st, enum nss_lookup_type how,
1589 enum nss_lookup_type lookup_how, const char *name, const char *lookup_name,
1590 uid_t uid, struct passwd *pwd, char *buffer, size_t bufsize, int *errnop)
1592 static const ns_src compatsrc[] = {
1594 { NSSRC_NIS, NS_SUCCESS },
1600 { NSSRC_NIS, nis_passwd, NULL },
1603 { NSSRC_DNS, dns_passwd, NULL },
1605 { NULL, NULL, NULL }
1610 for (i = 0; i < sizeof(dtab)/sizeof(dtab[0]) - 1; i++)
1611 dtab[i].mdata = (void *)lookup_how;
1614 switch (lookup_how) {
1616 rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1617 "getpwent_r", compatsrc, pwd, buffer, bufsize,
1621 rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1622 "getpwuid_r", compatsrc, uid, pwd, buffer,
1626 rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1627 "getpwnam_r", compatsrc, lookup_name, pwd, buffer,
1631 return (NS_UNAVAIL);
1633 if (rv != NS_SUCCESS)
1635 if (compat_is_excluded(pwd->pw_name, st->exclude)) {
1636 if (how == nss_lt_all)
1638 return (NS_NOTFOUND);
1640 e = compat_use_template(pwd, &st->template, buffer, bufsize);
1646 return (NS_UNAVAIL);
1650 if (strcmp(name, pwd->pw_name) != 0)
1651 return (NS_NOTFOUND);
1654 if (uid != pwd->pw_uid)
1655 return (NS_NOTFOUND);
1660 return (NS_SUCCESS);
1665 compat_endstate(void *p)
1667 struct compat_state *st;
1671 st = (struct compat_state *)p;
1673 st->db->close(st->db);
1674 if (st->exclude != NULL)
1675 st->exclude->close(st->exclude);
1676 compat_clear_template(&st->template);
1682 compat_setpwent(void *retval, void *mdata, va_list ap)
1684 static const ns_src compatsrc[] = {
1686 { NSSRC_NIS, NS_SUCCESS },
1692 { NSSRC_NIS, nis_setpwent, NULL },
1695 { NSSRC_DNS, dns_setpwent, NULL },
1697 { NULL, NULL, NULL }
1699 struct compat_state *st;
1702 #define set_setent(x, y) do { \
1705 for (i = 0; i < (sizeof(x)/sizeof(x[0])) - 1; i++) \
1706 x[i].mdata = (void *)y; \
1709 rv = compat_getstate(&st);
1711 return (NS_UNAVAIL);
1712 switch ((enum constants)mdata) {
1714 stayopen = va_arg(ap, int);
1717 st->db = pwdbopen(&st->version);
1718 st->stayopen = stayopen;
1719 set_setent(dtab, mdata);
1720 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD_COMPAT, "setpwent",
1724 if (st->db != NULL) {
1725 (void)st->db->close(st->db);
1728 set_setent(dtab, mdata);
1729 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD_COMPAT, "endpwent",
1735 return (NS_UNAVAIL);
1741 compat_passwd(void *retval, void *mdata, va_list ap)
1743 char keybuf[MAXLOGNAME + 1];
1745 struct compat_state *st;
1746 enum nss_lookup_type how;
1749 char *buffer, *pw_name;
1750 char *host, *user, *domain;
1754 int rv, from_compat, stayopen, *errnop;
1759 how = (enum nss_lookup_type)mdata;
1762 name = va_arg(ap, const char *);
1765 uid = va_arg(ap, uid_t);
1773 pwd = va_arg(ap, struct passwd *);
1774 buffer = va_arg(ap, char *);
1775 bufsize = va_arg(ap, size_t);
1776 errnop = va_arg(ap, int *);
1777 *errnop = compat_getstate(&st);
1779 return (NS_UNAVAIL);
1780 if (how == nss_lt_all && st->keynum < 0) {
1784 if (st->db == NULL &&
1785 (st->db = pwdbopen(&st->version)) == NULL) {
1790 if (how == nss_lt_all) {
1791 if (st->keynum < 0) {
1798 stayopen = st->stayopen;
1802 switch (st->compat) {
1803 case COMPAT_MODE_ALL:
1804 rv = compat_redispatch(st, how, how, name, name, uid, pwd,
1805 buffer, bufsize, errnop);
1806 if (rv != NS_SUCCESS)
1807 st->compat = COMPAT_MODE_OFF;
1809 case COMPAT_MODE_NETGROUP:
1810 /* XXX getnetgrent is not thread-safe. */
1812 rv = getnetgrent(&host, &user, &domain);
1815 st->compat = COMPAT_MODE_OFF;
1818 } else if (user == NULL || user[0] == '\0')
1820 rv = compat_redispatch(st, how, nss_lt_name, name,
1821 user, uid, pwd, buffer, bufsize, errnop);
1822 } while (st->compat == COMPAT_MODE_NETGROUP &&
1823 !(rv & NS_TERMINATE));
1825 case COMPAT_MODE_NAME:
1826 rv = compat_redispatch(st, how, nss_lt_name, name, st->name,
1827 uid, pwd, buffer, bufsize, errnop);
1830 st->compat = COMPAT_MODE_OFF;
1835 if (rv & NS_TERMINATE) {
1841 while (st->keynum >= 0) {
1843 if (st->version < _PWD_CURRENT_VERSION) {
1844 memcpy(&keybuf[1], &st->keynum, sizeof(st->keynum));
1845 key.size = sizeof(st->keynum) + 1;
1847 store = htonl(st->keynum);
1848 memcpy(&keybuf[1], &store, sizeof(store));
1849 key.size = sizeof(store) + 1;
1851 keybuf[0] = _PW_VERSIONED(_PW_KEYBYNUM, st->version);
1852 rv = st->db->get(st->db, &key, &entry, 0);
1853 if (rv < 0 || rv > 1) { /* should never return > 1 */
1857 } else if (rv == 1) {
1862 pw_name = (char *)entry.data;
1863 switch (pw_name[0]) {
1865 switch (pw_name[1]) {
1867 st->compat = COMPAT_MODE_ALL;
1870 setnetgrent(&pw_name[2]);
1871 st->compat = COMPAT_MODE_NETGROUP;
1874 st->name = strdup(&pw_name[1]);
1875 if (st->name == NULL) {
1877 "getpwent memory allocation failure");
1882 st->compat = COMPAT_MODE_NAME;
1884 if (entry.size > bufsize) {
1889 memcpy(buffer, entry.data, entry.size);
1890 rv = pwdb_versions[st->version].parse(buffer,
1891 entry.size, pwd, errnop);
1892 if (rv != NS_SUCCESS)
1894 else if (compat_set_template(pwd, &st->template) < 0) {
1901 switch (pw_name[1]) {
1903 /* XXX Maybe syslog warning */
1906 setnetgrent(&pw_name[2]);
1907 while (getnetgrent(&host, &user, &domain) !=
1909 if (user != NULL && user[0] != '\0')
1910 compat_exclude(user,
1916 compat_exclude(&pw_name[1], &st->exclude);
1923 if (compat_is_excluded((char *)entry.data, st->exclude))
1925 rv = pwdb_versions[st->version].match(entry.data, entry.size,
1927 if (rv == NS_RETURN)
1929 else if (rv != NS_SUCCESS)
1931 if (entry.size > bufsize) {
1936 memcpy(buffer, entry.data, entry.size);
1937 rv = pwdb_versions[st->version].parse(buffer, entry.size, pwd,
1939 if (rv & NS_TERMINATE)
1943 if (!stayopen && st->db != NULL) {
1944 (void)st->db->close(st->db);
1947 if (rv == NS_SUCCESS) {
1949 pwd->pw_fields &= ~_PWF_SOURCE;
1950 pwd->pw_fields |= _PWF_FILES;
1953 *(struct passwd **)retval = pwd;
1960 * common passwd line matching and parsing
1963 __pw_match_entry(const char *entry, size_t entrysize, enum nss_lookup_type how,
1964 const char *name, uid_t uid)
1966 const char *p, *eom;
1971 eom = entry + entrysize;
1972 for (p = entry; p < eom; p++)
1976 return (NS_NOTFOUND);
1977 if (how == nss_lt_all)
1978 return (NS_SUCCESS);
1979 if (how == nss_lt_name) {
1981 if (len == (p - entry) && memcmp(name, entry, len) == 0)
1982 return (NS_SUCCESS);
1984 return (NS_NOTFOUND);
1986 for (p++; p < eom; p++)
1990 return (NS_NOTFOUND);
1991 m = strtoul(++p, &q, 10);
1992 if (q[0] != ':' || (uid_t)m != uid)
1993 return (NS_NOTFOUND);
1995 return (NS_SUCCESS);
1999 /* XXX buffer must be NUL-terminated. errnop is not set correctly. */
2001 __pw_parse_entry(char *buffer, size_t bufsize __unused, struct passwd *pwd,
2002 int master, int *errnop __unused)
2005 if (__pw_scan(buffer, pwd, master ? _PWSCAN_MASTER : 0) == 0)
2006 return (NS_NOTFOUND);
2008 return (NS_SUCCESS);