2 * Copyright (c) 1995, 1996
3 * Bill Paul <wpaul@ctr.columbia.edu>. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Bill Paul.
16 * 4. Neither the name of the author nor the names of any co-contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * $FreeBSD: src/usr.sbin/rpc.yppasswdd/yppasswdd_server.c,v 1.16.2.2 2002/02/15 00:46:57 des Exp $
33 * $DragonFly: src/usr.sbin/rpc.yppasswdd/yppasswdd_server.c,v 1.7 2005/11/25 00:32:49 swildner Exp $
43 #include <sys/socket.h>
44 #include <netinet/in.h>
45 #include <arpa/inet.h>
52 #include <rpcsvc/yp.h>
53 #include <sys/types.h>
55 #include <sys/param.h>
56 #include <sys/fcntl.h>
57 struct dom_binding {};
58 #include <rpcsvc/ypclnt.h>
59 #include "yppasswdd_extern.h"
61 #include "yppasswd_private.h"
77 while (wait3(&st, WNOHANG, NULL) > 0) ;
79 pid = waitpid(pid, &pstat, 0);
87 install_reaper(int on)
90 signal(SIGCHLD, reaper);
92 signal(SIGCHLD, SIG_DFL);
97 static struct passwd yp_password;
100 copy_yp_pass(char *p, int x, int m)
105 yp_password.pw_fields = 0;
107 buf = (char *)realloc(buf, m + 10);
110 /* Turn all colons into NULLs */
111 while (strchr(s, ':')) {
112 s = (strchr(s, ':') + 1);
117 #define EXPAND(e) e = t; while ((*t++ = *p++));
118 EXPAND(yp_password.pw_name);
119 yp_password.pw_fields |= _PWF_NAME;
120 EXPAND(yp_password.pw_passwd);
121 yp_password.pw_fields |= _PWF_PASSWD;
122 yp_password.pw_uid = atoi(p);
123 p += (strlen(p) + 1);
124 yp_password.pw_fields |= _PWF_UID;
125 yp_password.pw_gid = atoi(p);
126 p += (strlen(p) + 1);
127 yp_password.pw_fields |= _PWF_GID;
129 EXPAND(yp_password.pw_class);
130 yp_password.pw_fields |= _PWF_CLASS;
131 yp_password.pw_change = atol(p);
132 p += (strlen(p) + 1);
133 yp_password.pw_fields |= _PWF_CHANGE;
134 yp_password.pw_expire = atol(p);
135 p += (strlen(p) + 1);
136 yp_password.pw_fields |= _PWF_EXPIRE;
138 EXPAND(yp_password.pw_gecos);
139 yp_password.pw_fields |= _PWF_GECOS;
140 EXPAND(yp_password.pw_dir);
141 yp_password.pw_fields |= _PWF_DIR;
142 EXPAND(yp_password.pw_shell);
143 yp_password.pw_fields |= _PWF_SHELL;
149 validchars(char *arg)
153 for (i = 0; i < strlen(arg); i++) {
154 if (iscntrl(arg[i])) {
155 yp_error("string contains a control character");
159 yp_error("string contains a colon");
162 /* Be evil: truncate strings with \n in them silently. */
163 if (arg[i] == '\n') {
172 validate_master(struct passwd *opw, struct x_master_passwd *npw)
175 if (npw->pw_name[0] == '+' || npw->pw_name[0] == '-') {
176 yp_error("client tried to modify an NIS entry");
180 if (validchars(npw->pw_shell)) {
181 yp_error("specified shell contains invalid characters");
185 if (validchars(npw->pw_gecos)) {
186 yp_error("specified gecos field contains invalid characters");
190 if (validchars(npw->pw_passwd)) {
191 yp_error("specified password contains invalid characters");
198 validate(struct passwd *opw, struct x_passwd *npw)
201 if (npw->pw_name[0] == '+' || npw->pw_name[0] == '-') {
202 yp_error("client tried to modify an NIS entry");
206 if (npw->pw_uid != opw->pw_uid) {
207 yp_error("UID mismatch: client says user %s has UID %d",
208 npw->pw_name, npw->pw_uid);
209 yp_error("database says user %s has UID %d", opw->pw_name,
214 if (npw->pw_gid != opw->pw_gid) {
215 yp_error("GID mismatch: client says user %s has GID %d",
216 npw->pw_name, npw->pw_gid);
217 yp_error("database says user %s has GID %d", opw->pw_name,
223 * Don't allow the user to shoot himself in the foot,
226 if (!ok_shell(npw->pw_shell)) {
227 yp_error("%s is not a valid shell", npw->pw_shell);
231 if (validchars(npw->pw_shell)) {
232 yp_error("specified shell contains invalid characters");
236 if (validchars(npw->pw_gecos)) {
237 yp_error("specified gecos field contains invalid characters");
241 if (validchars(npw->pw_passwd)) {
242 yp_error("specified password contains invalid characters");
250 * In order to have one rpc.yppasswdd support multiple domains,
251 * we have to cheat: we search each directory under /var/yp
252 * and try to match the user in each master.passwd.byname
253 * map that we find. If the user matches (username, uid and gid
254 * all agree), then we use that domain. If we match the user in
255 * more than one database, we must abort.
258 find_domain(struct x_passwd *pw)
263 char yp_mapdir[MAXPATHLEN + 2];
264 static char domain[YPMAXDOMAIN];
269 yp_error("performing multidomain lookup");
271 if ((dird = opendir(yp_dir)) == NULL) {
272 yp_error("opendir(%s) failed: %s", yp_dir, strerror(errno));
276 while ((dirp = readdir(dird)) != NULL) {
277 snprintf(yp_mapdir, sizeof(yp_mapdir), "%s/%s",
278 yp_dir, dirp->d_name);
279 if (stat(yp_mapdir, &statbuf) < 0) {
280 yp_error("stat(%s) failed: %s", yp_mapdir,
285 if (S_ISDIR(statbuf.st_mode)) {
286 tmp = (char *)dirp->d_name;
287 key.data = pw->pw_name;
288 key.size = strlen(pw->pw_name);
290 if (yp_get_record(tmp,"master.passwd.byname",
291 &key, &data, 0) != YP_TRUE) {
294 *(char *)(data.data + data.size) = '\0';
295 copy_yp_pass(data.data, 1, data.size);
296 if (yp_password.pw_uid == pw->pw_uid &&
297 yp_password.pw_gid == pw->pw_gid) {
299 snprintf(domain, YPMAXDOMAIN, "%s", tmp);
306 yp_error("found same user in two different domains");
309 return((char *)&domain);
313 update_inplace(struct passwd *pw, char *domain)
316 DBT key = { NULL, 0 };
317 DBT data = { NULL, 0 };
318 char pwbuf[YPMAXRECORD];
321 char *maps[] = { "master.passwd.byname", "master.passwd.byuid",
322 "passwd.byname", "passwd.byuid" };
324 char *formats[] = { "%s:%s:%d:%d:%s:%ld:%ld:%s:%s:%s",
325 "%s:%s:%d:%d:%s:%ld:%ld:%s:%s:%s",
326 "%s:%s:%d:%d:%s:%s:%s", "%s:%s:%d:%d:%s:%s:%s" };
328 char *yp_last = "YP_LAST_MODIFIED";
329 char yplastbuf[YPMAXRECORD];
331 snprintf(yplastbuf, sizeof(yplastbuf), "%lu", time(NULL));
333 for (i = 0; i < 4; i++) {
336 snprintf(keybuf, sizeof(keybuf), "%ld", pw->pw_uid);
337 key.data = (char *)&keybuf;
338 key.size = strlen(keybuf);
340 key.data = pw->pw_name;
341 key.size = strlen(pw->pw_name);
345 * XXX The passwd.byname and passwd.byuid maps come in
346 * two flavors: secure and insecure. The secure version
347 * has a '*' in the password field whereas the insecure one
348 * has a real crypted password. The maps will be insecure
349 * if they were built with 'unsecure = TRUE' enabled in
350 * /var/yp/Makefile, but we'd have no way of knowing if
351 * this has been done unless we were to try parsing the
352 * Makefile, which is a disgusting thought. Instead, we
353 * read the records from the maps, skip to the first ':'
354 * in them, and then look at the character immediately
355 * following it. If it's an '*' then the map is 'secure'
356 * and we must not insert a real password into the pw_passwd
357 * field. If it's not an '*', then we put the real crypted
360 if (yp_get_record(domain,maps[i],&key,&data,1) != YP_TRUE) {
361 yp_error("couldn't read %s/%s: %s", domain,
362 maps[i], strerror(errno));
366 if ((ptr = strchr(data.data, ':')) == NULL) {
367 yp_error("no colon in passwd record?!");
372 * XXX Supposing we have more than one user with the same
373 * UID? (Or more than one user with the same name?) We could
374 * end up modifying the wrong record if were not careful.
377 if (strncmp(data.data, pw->pw_name,
378 strlen(pw->pw_name))) {
379 yp_error("warning: found entry for UID %d "
380 "in map %s@%s with wrong name (%.*s)",
381 pw->pw_uid, maps[i], domain,
382 ptr - (char *)data.data, data.data);
383 yp_error("there may be more than one user "
384 "with the same UID - continuing");
389 * We're really being ultra-paranoid here.
390 * This is generally a 'can't happen' condition.
392 snprintf(pwbuf, sizeof(pwbuf), ":%d:%d:", pw->pw_uid,
394 if (!strstr(data.data, pwbuf)) {
395 yp_error("warning: found entry for user %s \
396 in map %s@%s with wrong UID", pw->pw_name, maps[i], domain);
397 yp_error("there may be more than one user \
398 with the same name - continuing");
404 snprintf(pwbuf, sizeof(pwbuf), formats[i],
405 pw->pw_name, pw->pw_passwd, pw->pw_uid,
406 pw->pw_gid, pw->pw_class, pw->pw_change,
407 pw->pw_expire, pw->pw_gecos, pw->pw_dir,
410 snprintf(pwbuf, sizeof(pwbuf), formats[i],
411 pw->pw_name, *(ptr+1) == '*' ? "*" : pw->pw_passwd,
412 pw->pw_uid, pw->pw_gid, pw->pw_gecos, pw->pw_dir,
416 #define FLAGS O_RDWR|O_CREAT
418 if ((dbp = yp_open_db_rw(domain, maps[i], FLAGS)) == NULL) {
419 yp_error("couldn't open %s/%s r/w: %s",domain,
420 maps[i],strerror(errno));
425 data.size = strlen(pwbuf);
427 if (yp_put_record(dbp, &key, &data, 1) != YP_TRUE) {
428 yp_error("failed to update record in %s/%s", domain,
435 key.size = strlen(yp_last);
436 data.data = (char *)&yplastbuf;
437 data.size = strlen(yplastbuf);
439 if (yp_put_record(dbp, &key, &data, 1) != YP_TRUE) {
440 yp_error("failed to update timestamp in %s/%s", domain,
455 static char path[MAXPATHLEN];
458 sprintf(path,"%s",passfile);
459 if ((p = strrchr(path, '/')))
463 strcpy(p, "yppwtmp.XXXXXX");
464 return(mktemp(path));
468 yppasswdproc_update_1_svc(yppasswd *argp, struct svc_req *rqstp)
471 struct sockaddr_in *rqhost;
476 int passwd_changed = 0;
477 int shell_changed = 0;
478 int gecos_changed = 0;
479 char *oldshell = NULL;
480 char *oldgecos = NULL;
482 char passfile_buf[MAXPATHLEN + 2];
483 char *domain = yppasswd_domain;
484 static struct sockaddr_in clntaddr;
485 static struct timeval t_saved, t_test;
488 * Normal user updates always use the 'default' master.passwd file.
491 passfile = passfile_default;
494 rqhost = svc_getcaller(rqstp->rq_xprt);
496 gettimeofday(&t_test, NULL);
497 if (!bcmp((char *)rqhost, (char *)&clntaddr,
498 sizeof(struct sockaddr_in)) &&
499 t_test.tv_sec > t_saved.tv_sec &&
500 t_test.tv_sec - t_saved.tv_sec < 300) {
502 bzero((char *)&clntaddr, sizeof(struct sockaddr_in));
503 bzero((char *)&t_saved, sizeof(struct timeval));
507 bcopy((char *)rqhost, (char *)&clntaddr, sizeof(struct sockaddr_in));
508 gettimeofday(&t_saved, NULL);
510 if (yp_access(resvport ? "master.passwd.byname" : NULL, rqstp)) {
511 yp_error("rejected update request from unauthorized host");
512 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
517 * Step one: find the user. (It's kinda pointless to
518 * proceed if the user doesn't exist.) We look for the
519 * user in the master.passwd.byname database, _NOT_ by
520 * using getpwent() and friends! We can't use getpwent()
521 * since the NIS master server is not guaranteed to be
522 * configured as an NIS client.
526 if ((domain = find_domain(&argp->newpw)) == NULL) {
527 yp_error("multidomain lookup failed - aborting update");
530 yp_error("updating user %s in domain %s",
531 argp->newpw.pw_name, domain);
534 key.data = argp->newpw.pw_name;
535 key.size = strlen(argp->newpw.pw_name);
537 if ((rval = yp_get_record(domain,"master.passwd.byname",
538 &key, &data, 0)) != YP_TRUE) {
539 if (rval == YP_NOKEY) {
540 yp_error("user %s not found in passwd database",
541 argp->newpw.pw_name);
543 yp_error("database access error: %s",
549 /* Nul terminate, please. */
550 *(char *)(data.data + data.size) = '\0';
552 copy_yp_pass(data.data, 1, data.size);
554 /* Step 2: check that the supplied oldpass is valid. */
556 if (strcmp(crypt(argp->oldpass, yp_password.pw_passwd),
557 yp_password.pw_passwd)) {
558 yp_error("rejected change attempt -- bad password");
559 yp_error("client address: %s username: %s",
560 inet_ntoa(rqhost->sin_addr),
561 argp->newpw.pw_name);
565 /* Step 3: validate the arguments passed to us by the client. */
567 if (validate(&yp_password, &argp->newpw)) {
568 yp_error("rejecting change attempt: bad arguments");
569 yp_error("client address: %s username: %s",
570 inet_ntoa(rqhost->sin_addr),
571 argp->newpw.pw_name);
572 svcerr_decode(rqstp->rq_xprt);
576 /* Step 4: update the user's passwd structure. */
578 if (!no_chsh && strcmp(argp->newpw.pw_shell, yp_password.pw_shell)) {
579 oldshell = yp_password.pw_shell;
580 yp_password.pw_shell = argp->newpw.pw_shell;
585 if (!no_chfn && strcmp(argp->newpw.pw_gecos, yp_password.pw_gecos)) {
586 oldgecos = yp_password.pw_gecos;
587 yp_password.pw_gecos = argp->newpw.pw_gecos;
591 if (strcmp(argp->newpw.pw_passwd, yp_password.pw_passwd)) {
592 yp_password.pw_passwd = argp->newpw.pw_passwd;
593 yp_password.pw_change = 0;
598 * If the caller specified a domain other than our 'default'
599 * domain, change the path to master.passwd accordingly.
602 if (strcmp(domain, yppasswd_domain)) {
603 snprintf(passfile_buf, sizeof(passfile_buf),
604 "%s/%s/master.passwd", yp_dir, domain);
605 passfile = (char *)&passfile_buf;
608 /* Step 5: make a new password file with the updated info. */
610 if ((pfd = pw_lock()) < 0) {
613 if ((tfd = pw_tmp()) < 0) {
617 if (pw_copy(pfd, tfd, &yp_password)) {
618 yp_error("failed to created updated password file -- \
619 cleaning up and bailing out");
624 passfile_hold = yp_mktmpnam();
625 rename(passfile, passfile_hold);
626 if (strcmp(passfile, _PATH_MASTERPASSWD)) {
627 rename(tempname, passfile);
629 if (pw_mkdb(argp->newpw.pw_name) < 0) {
630 yp_error("pwd_mkdb failed");
636 if ((rval = update_inplace(&yp_password, domain))) {
637 yp_error("inplace update failed -- rebuilding maps");
641 switch ((pid = fork())) {
643 if (inplace && !rval) {
644 execlp(MAP_UPDATE_PATH, MAP_UPDATE, passfile,
645 yppasswd_domain, "pushpw", NULL);
647 execlp(MAP_UPDATE_PATH, MAP_UPDATE, passfile,
648 yppasswd_domain, NULL);
650 yp_error("couldn't exec map update process: %s",
653 rename(passfile_hold, passfile);
657 yp_error("fork() failed: %s", strerror(errno));
659 rename(passfile_hold, passfile);
663 unlink(passfile_hold);
668 yp_error("update completed for user %s (uid %d):",
673 yp_error("password changed");
676 yp_error("gecos changed ('%s' -> '%s')",
677 oldgecos, argp->newpw.pw_gecos);
680 yp_error("shell changed ('%s' -> '%s')",
681 oldshell, argp->newpw.pw_shell);
690 struct cmsgcred cmcred;
694 * Note that this function performs a little less sanity checking
695 * than the last one. Since only the superuser is allowed to use it,
696 * it is assumed that the caller knows what he's doing.
699 yppasswdproc_update_master_1_svc(master_yppasswd *argp, struct svc_req *rqstp)
707 char passfile_buf[MAXPATHLEN + 2];
708 struct sockaddr_in *rqhost;
715 * NO AF_INET CONNETCIONS ALLOWED!
717 rqhost = svc_getcaller(rqstp->rq_xprt);
718 if (rqhost->sin_family != AF_UNIX) {
719 yp_error("Alert! %s/%d attempted to use superuser-only \
720 procedure!\n", inet_ntoa(rqhost->sin_addr), rqhost->sin_port);
721 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
725 transp = rqstp->rq_xprt;
727 if (transp->xp_verf.oa_length < sizeof(struct cmessage) ||
728 transp->xp_verf.oa_base == NULL ||
729 transp->xp_verf.oa_flavor != AUTH_UNIX) {
730 yp_error("caller didn't send proper credentials");
731 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
735 cm = (struct cmessage *)transp->xp_verf.oa_base;
736 if (cm->cmsg.cmsg_type != SCM_CREDS) {
737 yp_error("caller didn't send proper credentials");
738 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
742 if (cm->cmcred.cmcred_euid) {
743 yp_error("caller euid is %d, expecting 0 -- rejecting request",
744 cm->cmcred.cmcred_euid);
745 svcerr_auth(rqstp->rq_xprt, AUTH_BADCRED);
749 passfile = passfile_default;
751 key.data = argp->newpw.pw_name;
752 key.size = strlen(argp->newpw.pw_name);
755 * The superuser may add entries to the passwd maps if
756 * rpc.yppasswdd is started with the -a flag. Paranoia
757 * prevents me from allowing additions by default.
759 if ((rval = yp_get_record(argp->domain, "master.passwd.byname",
760 &key, &data, 0)) != YP_TRUE) {
761 if (rval == YP_NOKEY) {
762 yp_error("user %s not found in passwd database",
763 argp->newpw.pw_name);
765 yp_error("notice: adding user %s to \
766 master.passwd database for domain %s", argp->newpw.pw_name, argp->domain);
768 yp_error("restart rpc.yppasswdd with the -a flag to \
769 allow additions to be made to the password database");
771 yp_error("database access error: %s",
774 if (!allow_additions)
778 /* Nul terminate, please. */
779 *(char *)(data.data + data.size) = '\0';
781 copy_yp_pass(data.data, 1, data.size);
785 * Perform a small bit of sanity checking.
787 if (validate_master(rval == YP_TRUE ? &yp_password:NULL,&argp->newpw)){
788 yp_error("rejecting update attempt for %s: bad arguments",
789 argp->newpw.pw_name);
794 * If the caller specified a domain other than our 'default'
795 * domain, change the path to master.passwd accordingly.
798 if (strcmp(argp->domain, yppasswd_domain)) {
799 snprintf(passfile_buf, sizeof(passfile_buf),
800 "%s/%s/master.passwd", yp_dir, argp->domain);
801 passfile = (char *)&passfile_buf;
804 if ((pfd = pw_lock()) < 0) {
807 if ((tfd = pw_tmp()) < 0) {
811 if (pw_copy(pfd, tfd, (struct passwd *)&argp->newpw)) {
812 yp_error("failed to created updated password file -- \
813 cleaning up and bailing out");
818 passfile_hold = yp_mktmpnam();
819 rename(passfile, passfile_hold);
820 if (strcmp(passfile, _PATH_MASTERPASSWD)) {
821 rename(tempname, passfile);
823 if (pw_mkdb(argp->newpw.pw_name) < 0) {
824 yp_error("pwd_mkdb failed");
830 if ((rval = update_inplace((struct passwd *)&argp->newpw,
832 yp_error("inplace update failed -- rebuilding maps");
836 switch ((pid = fork())) {
838 if (inplace && !rval) {
839 execlp(MAP_UPDATE_PATH, MAP_UPDATE, passfile,
840 argp->domain, "pushpw", NULL);
842 execlp(MAP_UPDATE_PATH, MAP_UPDATE, passfile,
845 yp_error("couldn't exec map update process: %s",
848 rename(passfile_hold, passfile);
852 yp_error("fork() failed: %s", strerror(errno));
854 rename(passfile_hold, passfile);
858 unlink(passfile_hold);
862 yp_error("performed update of user %s (uid %d) domain %s",