2 * SPDX-License-Identifier: BSD-2-Clause
4 * Copyright (c) 2003 Networks Associates Technology, Inc.
7 * This software was developed for the FreeBSD Project by
8 * Jacques A. Vidrine, Safeport Network Services, and Network
9 * Associates Laboratories, the Security Research Division of Network
10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
11 * ("CBOSS"), as part of the DARPA CHATS research program.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 #include "namespace.h"
36 #include <sys/param.h>
39 #include <rpcsvc/yp_prot.h>
40 #include <rpcsvc/ypclnt.h>
42 #include <arpa/inet.h>
51 #include <pthread_np.h>
58 #include "un-namespace.h"
60 #include "libc_private.h"
68 #define CTASSERT(x) _CTASSERT(x, __LINE__)
69 #define _CTASSERT(x, y) __CTASSERT(x, y)
70 #define __CTASSERT(x, y) typedef char __assert_ ## y [(x) ? 1 : -1]
73 /* Counter as stored in /etc/pwd.db */
76 CTASSERT(MAXLOGNAME > sizeof(uid_t));
77 CTASSERT(MAXLOGNAME > sizeof(pwkeynum));
80 PWD_STORAGE_INITIAL = 1 << 10, /* 1 KByte */
81 PWD_STORAGE_MAX = 1 << 20, /* 1 MByte */
87 static const ns_src defaultsrc[] = {
88 { NSSRC_COMPAT, NS_SUCCESS },
92 int __pw_match_entry(const char *, size_t, enum nss_lookup_type,
94 int __pw_parse_entry(char *, size_t, struct passwd *, int, int *errnop);
101 static struct passwd *getpw(int (*fn)(union key, struct passwd *, char *,
102 size_t, struct passwd **), union key);
103 static int wrap_getpwnam_r(union key, struct passwd *, char *,
104 size_t, struct passwd **);
105 static int wrap_getpwuid_r(union key, struct passwd *, char *, size_t,
107 static int wrap_getpwent_r(union key, struct passwd *, char *, size_t,
110 static int pwdb_match_entry_v3(char *, size_t, enum nss_lookup_type,
111 const char *, uid_t);
112 static int pwdb_parse_entry_v3(char *, size_t, struct passwd *, int *);
113 static int pwdb_match_entry_v4(char *, size_t, enum nss_lookup_type,
114 const char *, uid_t);
115 static int pwdb_parse_entry_v4(char *, size_t, struct passwd *, int *);
119 int (*match)(char *, size_t, enum nss_lookup_type, const char *,
121 int (*parse)(char *, size_t, struct passwd *, int *);
122 } pwdb_versions[] = {
123 { NULL, NULL }, /* version 0 */
124 { NULL, NULL }, /* version 1 */
125 { NULL, NULL }, /* version 2 */
126 { pwdb_match_entry_v3, pwdb_parse_entry_v3 }, /* version 3 */
127 { pwdb_match_entry_v4, pwdb_parse_entry_v4 }, /* version 4 */
137 static void files_endstate(void *);
138 NSS_TLS_HANDLING(files);
139 static DB *pwdbopen(int *);
140 static void files_endstate(void *);
141 static int files_setpwent(void *, void *, va_list);
142 static int files_passwd(void *, void *, va_list);
149 static void dns_endstate(void *);
150 NSS_TLS_HANDLING(dns);
151 static int dns_setpwent(void *, void *, va_list);
152 static int dns_passwd(void *, void *, va_list);
158 char domain[MAXHOSTNAMELEN];
163 static void nis_endstate(void *);
164 NSS_TLS_HANDLING(nis);
165 static int nis_setpwent(void *, void *, va_list);
166 static int nis_passwd(void *, void *, va_list);
167 static int nis_map(char *, enum nss_lookup_type, char *, size_t, int *);
168 static int nis_adjunct(char *, const char *, char *, size_t);
172 struct compat_state {
178 struct passwd template;
187 static void compat_endstate(void *);
188 NSS_TLS_HANDLING(compat);
189 static int compat_setpwent(void *, void *, va_list);
190 static int compat_passwd(void *, void *, va_list);
191 static void compat_clear_template(struct passwd *);
192 static int compat_set_template(struct passwd *, struct passwd *);
193 static int compat_use_template(struct passwd *, struct passwd *, char *,
195 static int compat_redispatch(struct compat_state *, enum nss_lookup_type,
196 enum nss_lookup_type, const char *, const char *, uid_t,
197 struct passwd *, char *, size_t, int *);
200 static int pwd_id_func(char *, size_t *, va_list ap, void *);
201 static int pwd_marshal_func(char *, size_t *, void *, va_list, void *);
202 static int pwd_unmarshal_func(char *, size_t, void *, va_list, void *);
205 pwd_id_func(char *buffer, size_t *buffer_size, va_list ap, void *cache_mdata)
209 size_t size, desired_size;
210 int res = NS_UNAVAIL;
211 enum nss_lookup_type lookup_type;
213 lookup_type = (enum nss_lookup_type)(uintptr_t)cache_mdata;
214 switch (lookup_type) {
216 name = va_arg(ap, char *);
218 desired_size = sizeof(enum nss_lookup_type) + size + 1;
219 if (desired_size > *buffer_size) {
224 memcpy(buffer, &lookup_type, sizeof(enum nss_lookup_type));
225 memcpy(buffer + sizeof(enum nss_lookup_type), name, size + 1);
230 uid = va_arg(ap, uid_t);
231 desired_size = sizeof(enum nss_lookup_type) + sizeof(uid_t);
232 if (desired_size > *buffer_size) {
237 memcpy(buffer, &lookup_type, sizeof(enum nss_lookup_type));
238 memcpy(buffer + sizeof(enum nss_lookup_type), &uid,
244 /* should be unreachable */
249 *buffer_size = desired_size;
254 pwd_marshal_func(char *buffer, size_t *buffer_size, void *retval, va_list ap,
260 char *orig_buf __unused;
261 size_t orig_buf_size __unused;
263 struct passwd new_pwd;
264 size_t desired_size, size;
267 switch ((enum nss_lookup_type)(uintptr_t)cache_mdata) {
269 name = va_arg(ap, char *);
272 uid = va_arg(ap, uid_t);
277 /* should be unreachable */
281 pwd = va_arg(ap, struct passwd *);
282 orig_buf = va_arg(ap, char *);
283 orig_buf_size = va_arg(ap, size_t);
285 desired_size = sizeof(struct passwd) + sizeof(char *) +
286 strlen(pwd->pw_name) + 1;
287 if (pwd->pw_passwd != NULL)
288 desired_size += strlen(pwd->pw_passwd) + 1;
289 if (pwd->pw_class != NULL)
290 desired_size += strlen(pwd->pw_class) + 1;
291 if (pwd->pw_gecos != NULL)
292 desired_size += strlen(pwd->pw_gecos) + 1;
293 if (pwd->pw_dir != NULL)
294 desired_size += strlen(pwd->pw_dir) + 1;
295 if (pwd->pw_shell != NULL)
296 desired_size += strlen(pwd->pw_shell) + 1;
298 if (*buffer_size < desired_size) {
299 /* this assignment is here for future use */
300 *buffer_size = desired_size;
304 memcpy(&new_pwd, pwd, sizeof(struct passwd));
305 memset(buffer, 0, desired_size);
307 *buffer_size = desired_size;
308 p = buffer + sizeof(struct passwd) + sizeof(char *);
309 memcpy(buffer + sizeof(struct passwd), &p, sizeof(char *));
311 if (new_pwd.pw_name != NULL) {
312 size = strlen(new_pwd.pw_name);
313 memcpy(p, new_pwd.pw_name, size);
318 if (new_pwd.pw_passwd != NULL) {
319 size = strlen(new_pwd.pw_passwd);
320 memcpy(p, new_pwd.pw_passwd, size);
321 new_pwd.pw_passwd = p;
325 if (new_pwd.pw_class != NULL) {
326 size = strlen(new_pwd.pw_class);
327 memcpy(p, new_pwd.pw_class, size);
328 new_pwd.pw_class = p;
332 if (new_pwd.pw_gecos != NULL) {
333 size = strlen(new_pwd.pw_gecos);
334 memcpy(p, new_pwd.pw_gecos, size);
335 new_pwd.pw_gecos = p;
339 if (new_pwd.pw_dir != NULL) {
340 size = strlen(new_pwd.pw_dir);
341 memcpy(p, new_pwd.pw_dir, size);
346 if (new_pwd.pw_shell != NULL) {
347 size = strlen(new_pwd.pw_shell);
348 memcpy(p, new_pwd.pw_shell, size);
349 new_pwd.pw_shell = p;
353 memcpy(buffer, &new_pwd, sizeof(struct passwd));
358 pwd_unmarshal_func(char *buffer, size_t buffer_size, void *retval, va_list ap,
365 size_t orig_buf_size;
370 switch ((enum nss_lookup_type)(uintptr_t)cache_mdata) {
372 name = va_arg(ap, char *);
375 uid = va_arg(ap, uid_t);
380 /* should be unreachable */
384 pwd = va_arg(ap, struct passwd *);
385 orig_buf = va_arg(ap, char *);
386 orig_buf_size = va_arg(ap, size_t);
387 ret_errno = va_arg(ap, int *);
389 if (orig_buf_size + sizeof(struct passwd) + sizeof(char *) <
393 } else if (buffer_size < sizeof(struct passwd) + sizeof(char *)) {
395 * nscd(8) sometimes returns buffer_size=1 for nonexistent
399 return (NS_NOTFOUND);
402 memcpy(pwd, buffer, sizeof(struct passwd));
403 memcpy(&p, buffer + sizeof(struct passwd), sizeof(char *));
404 memcpy(orig_buf, buffer + sizeof(struct passwd) + sizeof(char *),
405 buffer_size - sizeof(struct passwd) - sizeof(char *));
407 NS_APPLY_OFFSET(pwd->pw_name, orig_buf, p, char *);
408 NS_APPLY_OFFSET(pwd->pw_passwd, orig_buf, p, char *);
409 NS_APPLY_OFFSET(pwd->pw_class, orig_buf, p, char *);
410 NS_APPLY_OFFSET(pwd->pw_gecos, orig_buf, p, char *);
411 NS_APPLY_OFFSET(pwd->pw_dir, orig_buf, p, char *);
412 NS_APPLY_OFFSET(pwd->pw_shell, orig_buf, p, char *);
415 *((struct passwd **)retval) = pwd;
420 NSS_MP_CACHE_HANDLING(passwd);
421 #endif /* NS_CACHING */
427 static const nss_cache_info cache_info = NS_MP_CACHE_INFO_INITIALIZER(
428 passwd, (void *)nss_lt_all,
432 static const ns_dtab dtab[] = {
433 { NSSRC_FILES, files_setpwent, (void *)SETPWENT },
435 { NSSRC_DNS, dns_setpwent, (void *)SETPWENT },
438 { NSSRC_NIS, nis_setpwent, (void *)SETPWENT },
440 { NSSRC_COMPAT, compat_setpwent, (void *)SETPWENT },
442 NS_CACHE_CB(&cache_info)
446 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "setpwent", defaultsrc, 0);
451 setpassent(int stayopen)
454 static const nss_cache_info cache_info = NS_MP_CACHE_INFO_INITIALIZER(
455 passwd, (void *)nss_lt_all,
459 static const ns_dtab dtab[] = {
460 { NSSRC_FILES, files_setpwent, (void *)SETPWENT },
462 { NSSRC_DNS, dns_setpwent, (void *)SETPWENT },
465 { NSSRC_NIS, nis_setpwent, (void *)SETPWENT },
467 { NSSRC_COMPAT, compat_setpwent, (void *)SETPWENT },
469 NS_CACHE_CB(&cache_info)
473 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "setpwent", defaultsrc,
483 static const nss_cache_info cache_info = NS_MP_CACHE_INFO_INITIALIZER(
484 passwd, (void *)nss_lt_all,
488 static const ns_dtab dtab[] = {
489 { NSSRC_FILES, files_setpwent, (void *)ENDPWENT },
491 { NSSRC_DNS, dns_setpwent, (void *)ENDPWENT },
494 { NSSRC_NIS, nis_setpwent, (void *)ENDPWENT },
496 { NSSRC_COMPAT, compat_setpwent, (void *)ENDPWENT },
498 NS_CACHE_CB(&cache_info)
502 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "endpwent", defaultsrc);
507 getpwent_r(struct passwd *pwd, char *buffer, size_t bufsize,
508 struct passwd **result)
511 static const nss_cache_info cache_info = NS_MP_CACHE_INFO_INITIALIZER(
512 passwd, (void *)nss_lt_all,
513 pwd_marshal_func, pwd_unmarshal_func);
516 static const ns_dtab dtab[] = {
517 { NSSRC_FILES, files_passwd, (void *)nss_lt_all },
519 { NSSRC_DNS, dns_passwd, (void *)nss_lt_all },
522 { NSSRC_NIS, nis_passwd, (void *)nss_lt_all },
524 { NSSRC_COMPAT, compat_passwd, (void *)nss_lt_all },
526 NS_CACHE_CB(&cache_info)
535 rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwent_r", defaultsrc,
536 pwd, buffer, bufsize, &ret_errno);
537 if (rv == NS_SUCCESS)
545 getpwnam_r(const char *name, struct passwd *pwd, char *buffer, size_t bufsize,
546 struct passwd **result)
549 static const nss_cache_info cache_info =
550 NS_COMMON_CACHE_INFO_INITIALIZER(
551 passwd, (void *)nss_lt_name,
552 pwd_id_func, pwd_marshal_func, pwd_unmarshal_func);
555 static const ns_dtab dtab[] = {
556 { NSSRC_FILES, files_passwd, (void *)nss_lt_name },
558 { NSSRC_DNS, dns_passwd, (void *)nss_lt_name },
561 { NSSRC_NIS, nis_passwd, (void *)nss_lt_name },
563 { NSSRC_COMPAT, compat_passwd, (void *)nss_lt_name },
565 NS_CACHE_CB(&cache_info)
574 rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwnam_r", defaultsrc,
575 name, pwd, buffer, bufsize, &ret_errno);
576 if (rv == NS_SUCCESS)
584 getpwuid_r(uid_t uid, struct passwd *pwd, char *buffer, size_t bufsize,
585 struct passwd **result)
588 static const nss_cache_info cache_info =
589 NS_COMMON_CACHE_INFO_INITIALIZER(
590 passwd, (void *)nss_lt_id,
591 pwd_id_func, pwd_marshal_func, pwd_unmarshal_func);
594 static const ns_dtab dtab[] = {
595 { NSSRC_FILES, files_passwd, (void *)nss_lt_id },
597 { NSSRC_DNS, dns_passwd, (void *)nss_lt_id },
600 { NSSRC_NIS, nis_passwd, (void *)nss_lt_id },
602 { NSSRC_COMPAT, compat_passwd, (void *)nss_lt_id },
604 NS_CACHE_CB(&cache_info)
613 rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwuid_r", defaultsrc,
614 uid, pwd, buffer, bufsize, &ret_errno);
615 if (rv == NS_SUCCESS)
622 static struct passwd pwd;
623 static char *pwd_storage;
624 static size_t pwd_storage_size;
627 static struct passwd *
628 getpw(int (*fn)(union key, struct passwd *, char *, size_t, struct passwd **),
634 if (pwd_storage == NULL) {
635 pwd_storage = malloc(PWD_STORAGE_INITIAL);
636 if (pwd_storage == NULL)
638 pwd_storage_size = PWD_STORAGE_INITIAL;
641 rv = fn(key, &pwd, pwd_storage, pwd_storage_size, &res);
642 if (res == NULL && rv == ERANGE) {
644 if ((pwd_storage_size << 1) > PWD_STORAGE_MAX) {
649 pwd_storage_size <<= 1;
650 pwd_storage = malloc(pwd_storage_size);
651 if (pwd_storage == NULL)
654 } while (res == NULL && rv == ERANGE);
662 wrap_getpwnam_r(union key key, struct passwd *pwd, char *buffer,
663 size_t bufsize, struct passwd **res)
665 return (getpwnam_r(key.name, pwd, buffer, bufsize, res));
670 wrap_getpwuid_r(union key key, struct passwd *pwd, char *buffer,
671 size_t bufsize, struct passwd **res)
673 return (getpwuid_r(key.uid, pwd, buffer, bufsize, res));
678 wrap_getpwent_r(union key key __unused, struct passwd *pwd, char *buffer,
679 size_t bufsize, struct passwd **res)
681 return (getpwent_r(pwd, buffer, bufsize, res));
686 getpwnam(const char *name)
691 return (getpw(wrap_getpwnam_r, key));
701 return (getpw(wrap_getpwuid_r, key));
710 key.uid = 0; /* not used */
711 return (getpw(wrap_getpwent_r, key));
719 pwdbopen(int *version)
725 if (geteuid() != 0 ||
726 (res = dbopen(_PATH_SMP_DB, O_RDONLY, 0, DB_HASH, NULL)) == NULL)
727 res = dbopen(_PATH_MP_DB, O_RDONLY, 0, DB_HASH, NULL);
730 key.data = _PWD_VERSION_KEY;
731 key.size = strlen(_PWD_VERSION_KEY);
732 rv = res->get(res, &key, &entry, 0);
734 *version = *(unsigned char *)entry.data;
738 *version >= nitems(pwdb_versions)) {
739 syslog(LOG_CRIT, "Unsupported password database version %d",
749 files_endstate(void *p)
755 db = ((struct files_state *)p)->db;
763 files_setpwent(void *retval, void *mdata, va_list ap)
765 struct files_state *st;
768 rv = files_getstate(&st);
771 switch ((enum constants)(uintptr_t)mdata) {
773 stayopen = va_arg(ap, int);
776 st->db = pwdbopen(&st->version);
777 st->stayopen = stayopen;
780 if (st->db != NULL) {
781 (void)st->db->close(st->db);
793 files_passwd(void *retval, void *mdata, va_list ap)
795 char keybuf[MAXLOGNAME + 1];
797 struct files_state *st;
798 enum nss_lookup_type how;
802 size_t bufsize, namesize;
805 int rv, stayopen = 0, *errnop;
809 how = (enum nss_lookup_type)(uintptr_t)mdata;
812 name = va_arg(ap, const char *);
813 keybuf[0] = _PW_KEYBYNAME;
816 uid = va_arg(ap, uid_t);
817 keybuf[0] = _PW_KEYBYUID;
820 keybuf[0] = _PW_KEYBYNUM;
826 pwd = va_arg(ap, struct passwd *);
827 buffer = va_arg(ap, char *);
828 bufsize = va_arg(ap, size_t);
829 errnop = va_arg(ap, int *);
830 *errnop = files_getstate(&st);
833 if (how == nss_lt_all && st->keynum < 0) {
837 if (st->db == NULL &&
838 (st->db = pwdbopen(&st->version)) == NULL) {
843 if (how == nss_lt_all)
846 stayopen = st->stayopen;
851 /* MAXLOGNAME includes NUL byte, but we do not
852 * include the NUL byte in the key.
854 namesize = strlcpy(&keybuf[1], name, sizeof(keybuf)-1);
855 if (namesize >= sizeof(keybuf)-1) {
860 key.size = namesize + 1;
863 if (st->version < _PWD_CURRENT_VERSION) {
864 memcpy(&keybuf[1], &uid, sizeof(uid));
865 key.size = sizeof(uid) + 1;
868 memcpy(&keybuf[1], &store, sizeof(store));
869 key.size = sizeof(store) + 1;
874 if (st->version < _PWD_CURRENT_VERSION) {
875 memcpy(&keybuf[1], &st->keynum,
877 key.size = sizeof(st->keynum) + 1;
879 store = htonl(st->keynum);
880 memcpy(&keybuf[1], &store, sizeof(store));
881 key.size = sizeof(store) + 1;
885 keybuf[0] = _PW_VERSIONED(keybuf[0], st->version);
886 rv = st->db->get(st->db, &key, &entry, 0);
887 if (rv < 0 || rv > 1) { /* should never return > 1 */
891 } else if (rv == 1) {
892 if (how == nss_lt_all)
897 rv = pwdb_versions[st->version].match(entry.data, entry.size,
899 if (rv != NS_SUCCESS)
901 if (entry.size > bufsize) {
906 memcpy(buffer, entry.data, entry.size);
907 rv = pwdb_versions[st->version].parse(buffer, entry.size, pwd,
909 } while (how == nss_lt_all && !(rv & NS_TERMINATE));
911 if (st->db != NULL && !stayopen) {
912 (void)st->db->close(st->db);
915 if (rv == NS_SUCCESS) {
916 pwd->pw_fields &= ~_PWF_SOURCE;
917 pwd->pw_fields |= _PWF_FILES;
919 *(struct passwd **)retval = pwd;
926 pwdb_match_entry_v3(char *entry, size_t entrysize, enum nss_lookup_type how,
927 const char *name, uid_t uid)
932 eom = &entry[entrysize];
933 for (p = entry; p < eom; p++)
937 return (NS_NOTFOUND);
938 if (how == nss_lt_all)
940 if (how == nss_lt_name)
941 return (strcmp(name, entry) == 0 ? NS_SUCCESS : NS_NOTFOUND);
942 for (p++; p < eom; p++)
945 if (*p != '\0' || (++p) + sizeof(uid) >= eom)
946 return (NS_NOTFOUND);
947 memcpy(&uid2, p, sizeof(uid2));
948 return (uid == uid2 ? NS_SUCCESS : NS_NOTFOUND);
953 pwdb_parse_entry_v3(char *buffer, size_t bufsize, struct passwd *pwd,
957 int32_t pw_change, pw_expire;
959 /* THIS CODE MUST MATCH THAT IN pwd_mkdb. */
961 eom = &buffer[bufsize];
962 #define STRING(field) do { \
964 while (p < eom && *p != '\0') \
967 return (NS_NOTFOUND); \
970 #define SCALAR(field) do { \
971 if (p + sizeof(field) > eom) \
972 return (NS_NOTFOUND); \
973 memcpy(&(field), p, sizeof(field)); \
974 p += sizeof(field); \
976 STRING(pwd->pw_name);
977 STRING(pwd->pw_passwd);
981 STRING(pwd->pw_class);
982 STRING(pwd->pw_gecos);
984 STRING(pwd->pw_shell);
986 SCALAR(pwd->pw_fields);
989 pwd->pw_change = pw_change;
990 pwd->pw_expire = pw_expire;
996 pwdb_match_entry_v4(char *entry, size_t entrysize, enum nss_lookup_type how,
997 const char *name, uid_t uid)
1002 eom = &entry[entrysize];
1003 for (p = entry; p < eom; p++)
1007 return (NS_NOTFOUND);
1008 if (how == nss_lt_all)
1009 return (NS_SUCCESS);
1010 if (how == nss_lt_name)
1011 return (strcmp(name, entry) == 0 ? NS_SUCCESS : NS_NOTFOUND);
1012 for (p++; p < eom; p++)
1015 if (*p != '\0' || (++p) + sizeof(uid) >= eom)
1016 return (NS_NOTFOUND);
1017 memcpy(&uid2, p, sizeof(uid2));
1019 return (uid == (uid_t)uid2 ? NS_SUCCESS : NS_NOTFOUND);
1024 pwdb_parse_entry_v4(char *buffer, size_t bufsize, struct passwd *pwd,
1030 /* THIS CODE MUST MATCH THAT IN pwd_mkdb. */
1032 eom = &buffer[bufsize];
1033 #define STRING(field) do { \
1035 while (p < eom && *p != '\0') \
1038 return (NS_NOTFOUND); \
1041 #define SCALAR(field) do { \
1042 if (p + sizeof(n) > eom) \
1043 return (NS_NOTFOUND); \
1044 memcpy(&n, p, sizeof(n)); \
1045 (field) = ntohl(n); \
1048 STRING(pwd->pw_name);
1049 STRING(pwd->pw_passwd);
1050 SCALAR(pwd->pw_uid);
1051 SCALAR(pwd->pw_gid);
1052 SCALAR(pwd->pw_change);
1053 STRING(pwd->pw_class);
1054 STRING(pwd->pw_gecos);
1055 STRING(pwd->pw_dir);
1056 STRING(pwd->pw_shell);
1057 SCALAR(pwd->pw_expire);
1058 SCALAR(pwd->pw_fields);
1061 return (NS_SUCCESS);
1070 dns_endstate(void *p)
1077 dns_setpwent(void *retval, void *mdata, va_list ap)
1079 struct dns_state *st;
1082 rv = dns_getstate(&st);
1084 return (NS_UNAVAIL);
1086 return (NS_UNAVAIL);
1091 dns_passwd(void *retval, void *mdata, va_list ap)
1093 char buf[HESIOD_NAME_MAX];
1094 struct dns_state *st;
1096 const char *name, *label;
1098 char *buffer, **hes;
1099 size_t bufsize, linesize;
1101 enum nss_lookup_type how;
1108 how = (enum nss_lookup_type)(uintptr_t)mdata;
1111 name = va_arg(ap, const char *);
1114 uid = va_arg(ap, uid_t);
1119 pwd = va_arg(ap, struct passwd *);
1120 buffer = va_arg(ap, char *);
1121 bufsize = va_arg(ap, size_t);
1122 errnop = va_arg(ap, int *);
1123 *errnop = dns_getstate(&st);
1125 return (NS_UNAVAIL);
1126 if (hesiod_init(&ctx) != 0) {
1138 if (snprintf(buf, sizeof(buf), "%lu",
1139 (unsigned long)uid) >= sizeof(buf))
1144 if (st->counter < 0)
1146 if (snprintf(buf, sizeof(buf), "passwd-%ld",
1147 st->counter++) >= sizeof(buf))
1152 hes = hesiod_resolve(ctx, label,
1153 how == nss_lt_id ? "uid" : "passwd");
1155 if (how == nss_lt_all)
1157 if (errno != ENOENT)
1161 rv = __pw_match_entry(hes[0], strlen(hes[0]), how, name, uid);
1162 if (rv != NS_SUCCESS) {
1163 hesiod_free_list(ctx, hes);
1167 linesize = strlcpy(buffer, hes[0], bufsize);
1168 if (linesize >= bufsize) {
1173 hesiod_free_list(ctx, hes);
1175 rv = __pw_parse_entry(buffer, bufsize, pwd, 0, errnop);
1176 } while (how == nss_lt_all && !(rv & NS_TERMINATE));
1179 hesiod_free_list(ctx, hes);
1182 if (rv == NS_SUCCESS) {
1183 pwd->pw_fields &= ~_PWF_SOURCE;
1184 pwd->pw_fields |= _PWF_HESIOD;
1186 *(struct passwd **)retval = pwd;
1198 nis_endstate(void *p)
1200 free(((struct nis_state *)p)->key);
1205 * Test for the presence of special FreeBSD-specific master.passwd.by*
1206 * maps. We do this using yp_order(). If it fails, then either the server
1207 * doesn't have the map, or the YPPROC_ORDER procedure isn't supported by
1208 * the server (Sun NIS+ servers in YP compat mode behave this way). If
1209 * the master.passwd.by* maps don't exist, then let the lookup routine try
1210 * the regular passwd.by* maps instead. If the lookup routine fails, it
1211 * can return an error as needed.
1214 nis_map(char *domain, enum nss_lookup_type how, char *buffer, size_t bufsize,
1220 if (geteuid() == 0) {
1221 if (snprintf(buffer, bufsize, "master.passwd.by%s",
1222 (how == nss_lt_id) ? "uid" : "name") >= bufsize)
1223 return (NS_UNAVAIL);
1224 rv = yp_order(domain, buffer, &order);
1227 return (NS_SUCCESS);
1231 if (snprintf(buffer, bufsize, "passwd.by%s",
1232 (how == nss_lt_id) ? "uid" : "name") >= bufsize)
1233 return (NS_UNAVAIL);
1235 return (NS_SUCCESS);
1240 nis_adjunct(char *domain, const char *name, char *buffer, size_t bufsize)
1243 char *result, *p, *q, *eor;
1247 rv = yp_match(domain, "passwd.adjunct.byname", name, strlen(name),
1248 &result, &resultlen);
1252 eor = &result[resultlen];
1253 p = memchr(result, ':', eor - result);
1254 if (p != NULL && ++p < eor &&
1255 (q = memchr(p, ':', eor - p)) != NULL) {
1256 if (q - p >= bufsize)
1259 memcpy(buffer, p, q - p);
1260 buffer[q - p] ='\0';
1271 nis_setpwent(void *retval, void *mdata, va_list ap)
1273 struct nis_state *st;
1276 rv = nis_getstate(&st);
1278 return (NS_UNAVAIL);
1282 return (NS_UNAVAIL);
1287 nis_passwd(void *retval, void *mdata, va_list ap)
1290 struct nis_state *st;
1293 char *buffer, *key, *result;
1296 enum nss_lookup_type how;
1297 int *errnop, keylen, resultlen, rv, master;
1301 how = (enum nss_lookup_type)(uintptr_t)mdata;
1304 name = va_arg(ap, const char *);
1307 uid = va_arg(ap, uid_t);
1312 pwd = va_arg(ap, struct passwd *);
1313 buffer = va_arg(ap, char *);
1314 bufsize = va_arg(ap, size_t);
1315 errnop = va_arg(ap, int *);
1316 *errnop = nis_getstate(&st);
1318 return (NS_UNAVAIL);
1319 if (st->domain[0] == '\0') {
1320 if (getdomainname(st->domain, sizeof(st->domain)) != 0) {
1322 return (NS_UNAVAIL);
1325 rv = nis_map(st->domain, how, map, sizeof(map), &master);
1326 if (rv != NS_SUCCESS)
1333 if (strlcpy(buffer, name, bufsize) >= bufsize)
1337 if (snprintf(buffer, bufsize, "%lu",
1338 (unsigned long)uid) >= bufsize)
1347 if (how == nss_lt_all) {
1348 if (st->key == NULL)
1349 rv = yp_first(st->domain, map, &st->key,
1350 &st->keylen, &result, &resultlen);
1353 keylen = st->keylen;
1355 rv = yp_next(st->domain, map, key, keylen,
1356 &st->key, &st->keylen, &result,
1364 if (rv == YPERR_NOMORE)
1371 rv = yp_match(st->domain, map, buffer, strlen(buffer),
1372 &result, &resultlen);
1373 if (rv == YPERR_KEY) {
1376 } else if (rv != 0) {
1382 if (resultlen >= bufsize) {
1386 memcpy(buffer, result, resultlen);
1387 buffer[resultlen] = '\0';
1389 rv = __pw_match_entry(buffer, resultlen, how, name, uid);
1390 if (rv == NS_SUCCESS)
1391 rv = __pw_parse_entry(buffer, resultlen, pwd, master,
1393 } while (how == nss_lt_all && !(rv & NS_TERMINATE));
1395 if (rv == NS_SUCCESS) {
1396 if (strstr(pwd->pw_passwd, "##") != NULL) {
1397 rv = nis_adjunct(st->domain, pwd->pw_name,
1398 &buffer[resultlen+1], bufsize-resultlen-1);
1402 pwd->pw_passwd = &buffer[resultlen+1];
1404 pwd->pw_fields &= ~_PWF_SOURCE;
1405 pwd->pw_fields |= _PWF_NIS;
1407 *(struct passwd **)retval = pwd;
1422 compat_clear_template(struct passwd *template)
1425 free(template->pw_passwd);
1426 free(template->pw_gecos);
1427 free(template->pw_dir);
1428 free(template->pw_shell);
1429 memset(template, 0, sizeof(*template));
1434 compat_set_template(struct passwd *src, struct passwd *template)
1437 compat_clear_template(template);
1438 #ifdef PW_OVERRIDE_PASSWD
1439 if ((src->pw_fields & _PWF_PASSWD) &&
1440 (template->pw_passwd = strdup(src->pw_passwd)) == NULL)
1443 if (src->pw_fields & _PWF_UID)
1444 template->pw_uid = src->pw_uid;
1445 if (src->pw_fields & _PWF_GID)
1446 template->pw_gid = src->pw_gid;
1447 if ((src->pw_fields & _PWF_GECOS) &&
1448 (template->pw_gecos = strdup(src->pw_gecos)) == NULL)
1450 if ((src->pw_fields & _PWF_DIR) &&
1451 (template->pw_dir = strdup(src->pw_dir)) == NULL)
1453 if ((src->pw_fields & _PWF_SHELL) &&
1454 (template->pw_shell = strdup(src->pw_shell)) == NULL)
1456 template->pw_fields = src->pw_fields;
1459 syslog(LOG_ERR, "getpwent memory allocation failure");
1465 compat_use_template(struct passwd *pwd, struct passwd *template, char *buffer,
1469 char *copy, *p, *q, *eob;
1472 /* We cannot know the layout of the password fields in `buffer',
1473 * so we have to copy everything.
1475 if (template->pw_fields == 0) /* nothing to fill-in */
1478 n += pwd->pw_name != NULL ? strlen(pwd->pw_name) + 1 : 0;
1479 n += pwd->pw_passwd != NULL ? strlen(pwd->pw_passwd) + 1 : 0;
1480 n += pwd->pw_class != NULL ? strlen(pwd->pw_class) + 1 : 0;
1481 n += pwd->pw_gecos != NULL ? strlen(pwd->pw_gecos) + 1 : 0;
1482 n += pwd->pw_dir != NULL ? strlen(pwd->pw_dir) + 1 : 0;
1483 n += pwd->pw_shell != NULL ? strlen(pwd->pw_shell) + 1 : 0;
1486 syslog(LOG_ERR, "getpwent memory allocation failure");
1491 #define COPY(field) do { \
1492 if (pwd->field == NULL) \
1493 hold.field = NULL; \
1496 p += strlcpy(p, pwd->field, eob-p) + 1; \
1507 eob = &buffer[bufsize];
1508 #define COPY(field, flag) do { \
1509 q = (template->pw_fields & flag) ? template->field : hold.field; \
1511 pwd->field = NULL; \
1514 if ((n = strlcpy(p, q, eob-p)) >= eob-p) { \
1522 #ifdef PW_OVERRIDE_PASSWD
1523 COPY(pw_passwd, _PWF_PASSWD);
1528 COPY(pw_gecos, _PWF_GECOS);
1529 COPY(pw_dir, _PWF_DIR);
1530 COPY(pw_shell, _PWF_SHELL);
1532 #define COPY(field, flag) do { \
1533 if (template->pw_fields & flag) \
1534 pwd->field = template->field; \
1536 COPY(pw_uid, _PWF_UID);
1537 COPY(pw_gid, _PWF_GID);
1545 compat_exclude(const char *name, DB **db)
1550 (*db = dbopen(NULL, O_RDWR, 600, DB_HASH, 0)) == NULL)
1552 key.size = strlen(name);
1553 key.data = (char *)name;
1557 if ((*db)->put(*db, &key, &data, 0) == -1)
1564 compat_is_excluded(const char *name, DB *db)
1570 key.size = strlen(name);
1571 key.data = (char *)name;
1572 return (db->get(db, &key, &data, 0) == 0);
1577 compat_redispatch(struct compat_state *st, enum nss_lookup_type how,
1578 enum nss_lookup_type lookup_how, const char *name, const char *lookup_name,
1579 uid_t uid, struct passwd *pwd, char *buffer, size_t bufsize, int *errnop)
1581 static const ns_src compatsrc[] = {
1583 { NSSRC_NIS, NS_SUCCESS },
1589 { NSSRC_NIS, nis_passwd, NULL },
1592 { NSSRC_DNS, dns_passwd, NULL },
1594 { NULL, NULL, NULL }
1599 for (i = 0; i < (int)(nitems(dtab) - 1); i++)
1600 dtab[i].mdata = (void *)lookup_how;
1603 switch (lookup_how) {
1605 rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1606 "getpwent_r", compatsrc, pwd, buffer, bufsize,
1610 rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1611 "getpwuid_r", compatsrc, uid, pwd, buffer,
1615 rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1616 "getpwnam_r", compatsrc, lookup_name, pwd, buffer,
1620 return (NS_UNAVAIL);
1622 if (rv != NS_SUCCESS)
1624 if (compat_is_excluded(pwd->pw_name, st->exclude)) {
1625 if (how == nss_lt_all)
1627 return (NS_NOTFOUND);
1629 e = compat_use_template(pwd, &st->template, buffer, bufsize);
1635 return (NS_UNAVAIL);
1639 if (strcmp(name, pwd->pw_name) != 0)
1640 return (NS_NOTFOUND);
1643 if (uid != pwd->pw_uid)
1644 return (NS_NOTFOUND);
1649 return (NS_SUCCESS);
1654 compat_endstate(void *p)
1656 struct compat_state *st;
1660 st = (struct compat_state *)p;
1662 st->db->close(st->db);
1663 if (st->exclude != NULL)
1664 st->exclude->close(st->exclude);
1665 compat_clear_template(&st->template);
1671 compat_setpwent(void *retval, void *mdata, va_list ap)
1673 static const ns_src compatsrc[] = {
1675 { NSSRC_NIS, NS_SUCCESS },
1681 { NSSRC_NIS, nis_setpwent, NULL },
1684 { NSSRC_DNS, dns_setpwent, NULL },
1686 { NULL, NULL, NULL }
1688 struct compat_state *st;
1691 #define set_setent(x, y) do { \
1693 for (i = 0; i < (int)(nitems(x) - 1); i++) \
1694 x[i].mdata = (void *)y; \
1697 rv = compat_getstate(&st);
1699 return (NS_UNAVAIL);
1700 switch ((enum constants)(uintptr_t)mdata) {
1702 stayopen = va_arg(ap, int);
1705 st->db = pwdbopen(&st->version);
1706 st->stayopen = stayopen;
1707 set_setent(dtab, mdata);
1708 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD_COMPAT, "setpwent",
1712 if (st->db != NULL) {
1713 (void)st->db->close(st->db);
1716 set_setent(dtab, mdata);
1717 (void)_nsdispatch(NULL, dtab, NSDB_PASSWD_COMPAT, "endpwent",
1723 return (NS_UNAVAIL);
1729 compat_passwd(void *retval, void *mdata, va_list ap)
1731 char keybuf[MAXLOGNAME + 1];
1734 struct compat_state *st;
1735 enum nss_lookup_type how;
1738 char *buffer, *pw_name;
1739 char *host, *user, *domain;
1743 int rv, from_compat, stayopen, *errnop;
1748 how = (enum nss_lookup_type)(uintptr_t)mdata;
1751 name = va_arg(ap, const char *);
1754 uid = va_arg(ap, uid_t);
1762 pwd = va_arg(ap, struct passwd *);
1763 buffer = va_arg(ap, char *);
1764 bufsize = va_arg(ap, size_t);
1765 errnop = va_arg(ap, int *);
1766 *errnop = compat_getstate(&st);
1768 return (NS_UNAVAIL);
1769 if (how == nss_lt_all && st->keynum < 0) {
1773 if (st->db == NULL &&
1774 (st->db = pwdbopen(&st->version)) == NULL) {
1779 if (how == nss_lt_all) {
1780 if (st->keynum < 0) {
1784 keynum = st->keynum;
1788 stayopen = st->stayopen;
1792 switch (st->compat) {
1793 case COMPAT_MODE_ALL:
1794 rv = compat_redispatch(st, how, how, name, name, uid, pwd,
1795 buffer, bufsize, errnop);
1796 if (rv != NS_SUCCESS)
1797 st->compat = COMPAT_MODE_OFF;
1799 case COMPAT_MODE_NETGROUP:
1800 /* XXX getnetgrent is not thread-safe. */
1802 rv = getnetgrent(&host, &user, &domain);
1805 st->compat = COMPAT_MODE_OFF;
1808 } else if (user == NULL || user[0] == '\0')
1810 rv = compat_redispatch(st, how, nss_lt_name, name,
1811 user, uid, pwd, buffer, bufsize, errnop);
1812 } while (st->compat == COMPAT_MODE_NETGROUP &&
1813 !(rv & NS_TERMINATE));
1815 case COMPAT_MODE_NAME:
1816 rv = compat_redispatch(st, how, nss_lt_name, name, st->name,
1817 uid, pwd, buffer, bufsize, errnop);
1820 st->compat = COMPAT_MODE_OFF;
1825 if (rv & NS_TERMINATE) {
1831 while (keynum >= 0) {
1833 if (st->version < _PWD_CURRENT_VERSION) {
1834 memcpy(&keybuf[1], &keynum, sizeof(keynum));
1835 key.size = sizeof(keynum) + 1;
1837 store = htonl(keynum);
1838 memcpy(&keybuf[1], &store, sizeof(store));
1839 key.size = sizeof(store) + 1;
1841 keybuf[0] = _PW_VERSIONED(_PW_KEYBYNUM, st->version);
1842 rv = st->db->get(st->db, &key, &entry, 0);
1843 if (rv < 0 || rv > 1) { /* should never return > 1 */
1847 } else if (rv == 1) {
1852 pw_name = (char *)entry.data;
1853 switch (pw_name[0]) {
1855 switch (pw_name[1]) {
1857 st->compat = COMPAT_MODE_ALL;
1860 setnetgrent(&pw_name[2]);
1861 st->compat = COMPAT_MODE_NETGROUP;
1864 st->name = strdup(&pw_name[1]);
1865 if (st->name == NULL) {
1867 "getpwent memory allocation failure");
1872 st->compat = COMPAT_MODE_NAME;
1874 if (entry.size > bufsize) {
1879 memcpy(buffer, entry.data, entry.size);
1880 rv = pwdb_versions[st->version].parse(buffer,
1881 entry.size, pwd, errnop);
1882 if (rv != NS_SUCCESS)
1884 else if (compat_set_template(pwd, &st->template) < 0) {
1891 switch (pw_name[1]) {
1893 /* XXX Maybe syslog warning */
1896 setnetgrent(&pw_name[2]);
1897 while (getnetgrent(&host, &user, &domain) !=
1899 if (user != NULL && user[0] != '\0')
1900 compat_exclude(user,
1906 compat_exclude(&pw_name[1], &st->exclude);
1913 if (compat_is_excluded((char *)entry.data, st->exclude))
1915 rv = pwdb_versions[st->version].match(entry.data, entry.size,
1917 if (rv == NS_RETURN)
1919 else if (rv != NS_SUCCESS)
1921 if (entry.size > bufsize) {
1926 memcpy(buffer, entry.data, entry.size);
1927 rv = pwdb_versions[st->version].parse(buffer, entry.size, pwd,
1929 if (rv & NS_TERMINATE)
1933 if (how == nss_lt_all)
1934 st->keynum = keynum;
1935 if (st->db != NULL && !stayopen) {
1936 (void)st->db->close(st->db);
1939 if (rv == NS_SUCCESS) {
1941 pwd->pw_fields &= ~_PWF_SOURCE;
1942 pwd->pw_fields |= _PWF_FILES;
1945 *(struct passwd **)retval = pwd;
1952 * common passwd line matching and parsing
1955 __pw_match_entry(const char *entry, size_t entrysize, enum nss_lookup_type how,
1956 const char *name, uid_t uid)
1958 const char *p, *eom;
1963 eom = entry + entrysize;
1964 for (p = entry; p < eom; p++)
1968 return (NS_NOTFOUND);
1969 if (how == nss_lt_all)
1970 return (NS_SUCCESS);
1971 if (how == nss_lt_name) {
1973 if (len == (p - entry) && memcmp(name, entry, len) == 0)
1974 return (NS_SUCCESS);
1976 return (NS_NOTFOUND);
1978 for (p++; p < eom; p++)
1982 return (NS_NOTFOUND);
1983 m = strtoul(++p, &q, 10);
1984 if (q[0] != ':' || (uid_t)m != uid)
1985 return (NS_NOTFOUND);
1987 return (NS_SUCCESS);
1991 /* XXX buffer must be NUL-terminated. errnop is not set correctly. */
1993 __pw_parse_entry(char *buffer, size_t bufsize __unused, struct passwd *pwd,
1994 int master, int *errnop __unused)
1997 if (__pw_scan(buffer, pwd, master ? _PWSCAN_MASTER : 0) == 0)
1998 return (NS_NOTFOUND);
2000 return (NS_SUCCESS);