nis/nss_nisplus/nisplus-publickey.c

   1 /* Copyright (c) 1997, 1999 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1997.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, write to the Free
  17    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  18    02111-1307 USA.  */
  19
  20 #include <nss.h>
  21 #include <ctype.h>
  22 #include <errno.h>
  23 #include <stdio.h>
  24 #include <string.h>
  25 #include <libintl.h>
  26 #include <syslog.h>
  27 #include <rpc/rpc.h>
  28 #include <rpcsvc/nis.h>
  29 #include <rpc/key_prot.h>
  30 extern int xdecrypt (char *, char *);
  31
  32 #include <nss-nisplus.h>
  33
  34 /* If we haven't found the entry, we give a SUCCESS and an empty key back. */
  35 enum nss_status
  36 _nss_nisplus_getpublickey (const char *netname, char *pkey, int *errnop)
  37 {
  38   nis_result *res;
  39   enum nss_status retval;
  40   char buf[NIS_MAXNAMELEN+2];
  41   size_t slen;
  42   char *domain, *cptr;
  43   int len;
  44
  45   pkey[0] = 0;
  46
  47   if (netname == NULL)
  48     {
  49       *errnop = EINVAL;
  50       return NSS_STATUS_UNAVAIL;
  51     }
  52
  53   domain = strchr (netname, '@');
  54   if (!domain)
  55     return NSS_STATUS_UNAVAIL;
  56   domain++;
  57
  58   slen = snprintf (buf, NIS_MAXNAMELEN,
  59                    "[auth_name=%s,auth_type=DES],cred.org_dir.%s",
  60                    netname, domain);
  61
  62   if (slen >= NIS_MAXNAMELEN)
  63     {
  64       *errnop = EINVAL;
  65       return NSS_STATUS_UNAVAIL;
  66     }
  67
  68   if (buf[slen - 1] != '.')
  69     {
  70       buf[slen++] = '.';
  71       buf[slen] = '\0';
  72     }
  73
  74   res = nis_list (buf, USE_DGRAM+NO_AUTHINFO+FOLLOW_LINKS+FOLLOW_PATH,
  75                   NULL, NULL);
  76
  77   retval = niserr2nss (res->status);
  78
  79   if (retval != NSS_STATUS_SUCCESS)
  80     {
  81       if (retval == NSS_STATUS_TRYAGAIN)
  82         *errnop = errno;
  83       if (res->status == NIS_NOTFOUND)
  84         retval = NSS_STATUS_SUCCESS;
  85       nis_freeresult (res);
  86       return retval;
  87     }
  88
  89   if (res->objects.objects_len > 1)
  90     {
  91       /*
  92        * More than one principal with same uid?
  93        * something wrong with cred table. Should be unique
  94        * Warn user and continue.
  95        */
  96       printf (_("DES entry for netname %s not unique\n"), netname);
  97       nis_freeresult (res);
  98       return NSS_STATUS_SUCCESS;
  99     }
 100
 101   len = ENTRY_LEN (res->objects.objects_val, 3);
 102   memcpy (pkey, ENTRY_VAL (res->objects.objects_val,3), len);
 103   pkey[len] = 0;
 104   cptr = strchr (pkey, ':');
 105   if (cptr)
 106     cptr[0] = '\0';
 107   nis_freeresult (res);
 108
 109   return NSS_STATUS_SUCCESS;
 110 }
 111
 112 enum nss_status
 113 _nss_nisplus_getsecretkey (const char *netname, char *skey, char *passwd,
 114                            int *errnop)
 115 {
 116   nis_result *res;
 117   enum nss_status retval;
 118   char buf[NIS_MAXNAMELEN+2];
 119   size_t slen;
 120   char *domain, *cptr;
 121   int len;
 122
 123   skey[0] = 0;
 124
 125   if (netname == NULL)
 126     {
 127       *errnop = EINVAL;
 128       return NSS_STATUS_UNAVAIL;
 129     }
 130
 131   domain = strchr (netname, '@');
 132   if (!domain)
 133     return NSS_STATUS_UNAVAIL;
 134   domain++;
 135
 136   slen = snprintf (buf, NIS_MAXNAMELEN,
 137                    "[auth_name=%s,auth_type=DES],cred.org_dir.%s",
 138                    netname, domain);
 139
 140   if (slen >= NIS_MAXNAMELEN)
 141     {
 142       *errnop = EINVAL;
 143       return NSS_STATUS_UNAVAIL;
 144     }
 145
 146   if (buf[slen - 1] != '.')
 147     {
 148       buf[slen++] = '.';
 149       buf[slen] = '\0';
 150     }
 151
 152   res = nis_list (buf, USE_DGRAM+NO_AUTHINFO+FOLLOW_LINKS+FOLLOW_PATH,
 153                   NULL, NULL);
 154
 155   retval = niserr2nss (res->status);
 156
 157   if (retval != NSS_STATUS_SUCCESS)
 158     {
 159       if (retval == NSS_STATUS_TRYAGAIN)
 160         *errnop = errno;
 161       nis_freeresult (res);
 162       return retval;
 163     }
 164
 165   if (res->objects.objects_len > 1)
 166     {
 167       /*
 168        * More than one principal with same uid?
 169        * something wrong with cred table. Should be unique
 170        * Warn user and continue.
 171        */
 172       printf (_("DES entry for netname %s not unique\n"), netname);
 173       nis_freeresult (res);
 174       return NSS_STATUS_SUCCESS;
 175     }
 176
 177   len = ENTRY_LEN (res->objects.objects_val, 4);
 178   memcpy (buf, ENTRY_VAL (res->objects.objects_val,4), len);
 179   buf[len] = '\0';
 180   cptr = strchr (buf, ':');
 181   if (cptr)
 182     cptr[0] = '\0';
 183   nis_freeresult (res);
 184
 185   if (!xdecrypt (buf, passwd))
 186     return NSS_STATUS_SUCCESS;
 187
 188   if (memcmp (buf, &(buf[HEXKEYBYTES]), KEYCHECKSUMSIZE) != 0)
 189     return NSS_STATUS_SUCCESS;
 190
 191   buf[HEXKEYBYTES] = 0;
 192   strcpy (skey, buf);
 193
 194   return NSS_STATUS_SUCCESS;
 195 }
 196
 197 /* Parse information from the passed string.
 198    The format of the string passed is gid,grp,grp, ...  */
 199 static enum nss_status
 200 parse_grp_str (const char *s, gid_t *gidp, int *gidlenp, gid_t *gidlist,
 201                int *errnop)
 202 {
 203   int gidlen;
 204
 205   if (!s || (!isdigit (*s)))
 206     {
 207       syslog (LOG_ERR, _("netname2user: missing group id list in `%s'."), s);
 208       return NSS_STATUS_NOTFOUND;
 209     }
 210
 211   *gidp = atoi (s);
 212
 213   gidlen = 0;
 214
 215   while ((s = strchr (s, ',')) != NULL)
 216     {
 217       s++;
 218       gidlist[gidlen++] = atoi (s);
 219     }
 220   *gidlenp = gidlen;
 221
 222   return NSS_STATUS_SUCCESS;
 223 }
 224
 225 enum nss_status
 226 _nss_nisplus_netname2user (char netname[MAXNETNAMELEN + 1], uid_t *uidp,
 227                        gid_t *gidp, int *gidlenp, gid_t *gidlist, int *errnop)
 228 {
 229   char *domain;
 230   nis_result *res;
 231   char sname[NIS_MAXNAMELEN+2]; /*  search criteria + table name */
 232   size_t slen;
 233   char principal[NIS_MAXNAMELEN+1];
 234   int len;
 235
 236   /* 1.  Get home domain of user. */
 237   domain = strchr (netname, '@');
 238   if (! domain)
 239     return NSS_STATUS_UNAVAIL;
 240
 241   ++domain;  /* skip '@' */
 242
 243   /* 2.  Get user's nisplus principal name.  */
 244   if ((strlen (netname) + strlen (domain)+45) >
 245       (size_t) NIS_MAXNAMELEN)
 246     return NSS_STATUS_UNAVAIL;
 247
 248   slen = snprintf (sname, NIS_MAXNAMELEN,
 249                    "[auth_name=%s,auth_type=DES],cred.org_dir.%s",
 250                    netname, domain);
 251
 252   if (slen >= NIS_MAXNAMELEN)
 253     {
 254       *errnop = EINVAL;
 255       return NSS_STATUS_UNAVAIL;
 256     }
 257
 258   if (sname[slen - 1] != '.')
 259     {
 260       sname[slen++] = '.';
 261       sname[slen] = '\0';
 262     }
 263
 264   /* must use authenticated call here */
 265   /* XXX but we cant, for now. XXX */
 266   res = nis_list (sname, USE_DGRAM+NO_AUTHINFO+FOLLOW_LINKS+FOLLOW_PATH,
 267                   NULL, NULL);
 268   switch (res->status)
 269     {
 270     case NIS_SUCCESS:
 271     case NIS_S_SUCCESS:
 272       break;   /* go and do something useful */
 273     case NIS_NOTFOUND:
 274     case NIS_PARTIAL:
 275     case NIS_NOSUCHNAME:
 276     case NIS_NOSUCHTABLE:
 277       nis_freeresult (res);
 278       return NSS_STATUS_NOTFOUND;
 279     case NIS_S_NOTFOUND:
 280     case NIS_TRYAGAIN:
 281       syslog (LOG_ERR, _("netname2user: (nis+ lookup): %s\n"),
 282               nis_sperrno (res->status));
 283       nis_freeresult (res);
 284       *errnop = errno;
 285       return NSS_STATUS_TRYAGAIN;
 286     default:
 287       syslog (LOG_ERR, _("netname2user: (nis+ lookup): %s\n"),
 288               nis_sperrno (res->status));
 289       nis_freeresult (res);
 290       return NSS_STATUS_UNAVAIL;
 291     }
 292
 293   if (res->objects.objects_len > 1)
 294     /*
 295      * A netname belonging to more than one principal?
 296      * Something wrong with cred table. should be unique.
 297      * Warn user and continue.
 298      */
 299     syslog (LOG_ALERT,
 300             _("netname2user: DES entry for %s in directory %s not unique"),
 301             netname, domain);
 302
 303   len = ENTRY_LEN (res->objects.objects_val, 0);
 304   strncpy (principal, ENTRY_VAL (res->objects.objects_val, 0), len);
 305   principal[len] = '\0';
 306   nis_freeresult (res);
 307
 308   if (principal[0] == '\0')
 309     return NSS_STATUS_UNAVAIL;
 310
 311   /*
 312    * 3.  Use principal name to look up uid/gid information in
 313    *     LOCAL entry in **local** cred table.
 314    */
 315   domain = nis_local_directory ();
 316   if ((strlen (principal) + strlen (domain) + 45) > (size_t) NIS_MAXNAMELEN)
 317     {
 318       syslog (LOG_ERR, _("netname2user: principal name `%s' too long"),
 319               principal);
 320       return NSS_STATUS_UNAVAIL;
 321     }
 322
 323   slen = sprintf (sname, "[cname=%s,auth_type=LOCAL],cred.org_dir.%s",
 324                   principal, domain);
 325
 326   if (sname[slen - 1] != '.')
 327     {
 328       sname[slen++] = '.';
 329       sname[slen] = '\0';
 330     }
 331
 332   /* must use authenticated call here */
 333   /* XXX but we cant, for now. XXX */
 334   res = nis_list (sname, USE_DGRAM+NO_AUTHINFO+FOLLOW_LINKS+FOLLOW_PATH,
 335                   NULL, NULL);
 336   switch(res->status)
 337     {
 338     case NIS_NOTFOUND:
 339     case NIS_PARTIAL:
 340     case NIS_NOSUCHNAME:
 341     case NIS_NOSUCHTABLE:
 342       nis_freeresult (res);
 343       return NSS_STATUS_NOTFOUND;
 344     case NIS_S_NOTFOUND:
 345     case NIS_TRYAGAIN:
 346       syslog (LOG_ERR, _("netname2user: (nis+ lookup): %s\n"),
 347               nis_sperrno (res->status));
 348       nis_freeresult (res);
 349       *errnop = errno;
 350       return NSS_STATUS_TRYAGAIN;
 351     case NIS_SUCCESS:
 352     case NIS_S_SUCCESS:
 353       break;   /* go and do something useful */
 354     default:
 355       syslog (LOG_ERR, _("netname2user: (nis+ lookup): %s\n"),
 356               nis_sperrno (res->status));
 357       nis_freeresult (res);
 358       return NSS_STATUS_UNAVAIL;
 359     }
 360
 361   if (res->objects.objects_len > 1)
 362     /*
 363      * A principal can have more than one LOCAL entry?
 364      * Something wrong with cred table.
 365      * Warn user and continue.
 366      */
 367     syslog (LOG_ALERT,
 368             _("netname2user: LOCAL entry for %s in directory %s not unique"),
 369             netname, domain);
 370   /* Fetch the uid */
 371   *uidp = atoi (ENTRY_VAL (res->objects.objects_val, 2));
 372
 373   if (*uidp == 0)
 374     {
 375       syslog (LOG_ERR, _("netname2user: should not have uid 0"));
 376       return NSS_STATUS_NOTFOUND;
 377     }
 378
 379   parse_grp_str (ENTRY_VAL (res->objects.objects_val, 3),
 380                  gidp, gidlenp, gidlist, errnop);
 381
 382   nis_freeresult (res);
 383   return NSS_STATUS_SUCCESS;
 384 }