From patchwork Mon Jul 6 19:03:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 39924 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 9566E38618F9; Mon, 6 Jul 2020 19:03:19 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 9566E38618F9 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1594062199; bh=SV71SXLc+Op9OrvWUk1wSJIu6aQw1xsspHirqZ4wSxo=; h=To:Subject:In-Reply-To:References:Date:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=EE+ZldlDRat9szI62jPIz6o9RE5BSoJa6AbFKRaJT9OxqitwEPAdQblAyHUoCdBtg OVSD60IFemBue96T4Wilhh750Sf8Crbsy/IfCzziSPUPM825GbjLnpuXv85Lg7OgVu H7l4+xe8ZyyFn6/BcGR0YXTkdKJqLoeByw7sZt0s= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) by sourceware.org (Postfix) with ESMTP id 300BA3858D37 for ; Mon, 6 Jul 2020 19:03:17 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 300BA3858D37 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-217-9A7C96F8Nr2wFkLmGVlW_A-1; Mon, 06 Jul 2020 15:03:15 -0400 X-MC-Unique: 9A7C96F8Nr2wFkLmGVlW_A-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 83DFC800FF2 for ; Mon, 6 Jul 2020 19:03:14 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-112-118.ams2.redhat.com [10.36.112.118]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 08F59108A1 for ; Mon, 6 Jul 2020 19:03:13 +0000 (UTC) To: libc-alpha@sourceware.org Subject: [PATCH 1/4] sunrpc: Turn clnt_sperrno into a libc_hidden_nolink_sunrpc symbol In-Reply-To: References: Message-Id: Date: Mon, 06 Jul 2020 21:03:12 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-12.6 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Florian Weimer via Libc-alpha From: Florian Weimer Reply-To: Florian Weimer Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" Before this change, the function had a default symbol version even without --enable-obsolete-rpc. --- sunrpc/clnt_perr.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sunrpc/clnt_perr.c b/sunrpc/clnt_perr.c index dd5b10688e..67499fd03f 100644 --- a/sunrpc/clnt_perr.c +++ b/sunrpc/clnt_perr.c @@ -257,7 +257,11 @@ clnt_sperrno (enum clnt_stat stat) } return _("RPC: (unknown error code)"); } +#ifdef EXPORT_RPC_SYMBOLS libc_hidden_def (clnt_sperrno) +#else +libc_hidden_nolink_sunrpc (clnt_sperrno, GLIBC_2_0) +#endif void clnt_perrno (enum clnt_stat num) From patchwork Mon Jul 6 19:03:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 39925 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id D72383857030; Mon, 6 Jul 2020 19:03:24 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D72383857030 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1594062204; bh=XsjrB+YZDYiFEvgQVz0iKV+mtYh8myJlfF1zaIjXXZ8=; h=To:Subject:In-Reply-To:References:Date:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=fIlHIXOn6hUIE89b1MgfEDZ8r6glMBm6NU7XHrpGoG5JlEDeeAV8QOZLFlId0tI7Y 2np9Lahq2xljPXOjsWpF68mraHPXYrQC+fVfKtGvl1k55LuQNKhRU/czLukp3YoxLq 2tAZJmXE/54neRbTYkzWtHNCm7ivXN2MytlnM1Ik= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) by sourceware.org (Postfix) with ESMTP id 2753A38618F6 for ; Mon, 6 Jul 2020 19:03:22 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 2753A38618F6 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-506-MmAMJ0isMRul-u2cGkXGIw-1; Mon, 06 Jul 2020 15:03:20 -0400 X-MC-Unique: MmAMJ0isMRul-u2cGkXGIw-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 5C1EF800FED for ; Mon, 6 Jul 2020 19:03:19 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-112-118.ams2.redhat.com [10.36.112.118]) by smtp.corp.redhat.com (Postfix) with ESMTPS id D69DF5F7D8 for ; Mon, 6 Jul 2020 19:03:18 +0000 (UTC) To: libc-alpha@sourceware.org Subject: [PATCH 2/4] sunrpc: Do not export key handling hooks by default In-Reply-To: References: Message-Id: Date: Mon, 06 Jul 2020 21:03:17 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-12.6 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Florian Weimer via Libc-alpha From: Florian Weimer Reply-To: Florian Weimer Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" __key_encryptsession_pk_LOCAL, __key_decryptsession_pk_LOCAL, __key_gendes_LOCAL had a default version symbol even without --enable-obsolete-rpc. --- sunrpc/key_call.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/sunrpc/key_call.c b/sunrpc/key_call.c index 9b8f9819c9..f13b0a7e4c 100644 --- a/sunrpc/key_call.c +++ b/sunrpc/key_call.c @@ -290,9 +290,20 @@ libc_hidden_nolink_sunrpc (key_get_conv, GLIBC_2_1) * implementations of these functions, and to call those in key_call(). */ -cryptkeyres *(*__key_encryptsession_pk_LOCAL) (uid_t, char *); -cryptkeyres *(*__key_decryptsession_pk_LOCAL) (uid_t, char *); -des_block *(*__key_gendes_LOCAL) (uid_t, char *); +cryptkeyres *(*__key_encryptsession_pk_LOCAL) (uid_t, char *) + __attribute__ ((nocommon)); +cryptkeyres *(*__key_decryptsession_pk_LOCAL) (uid_t, char *) + __attribute__ ((nocommon)); +des_block *(*__key_gendes_LOCAL) (uid_t, char *) __attribute__ ((nocommon)); +#ifdef SHARED +# ifndef EXPORT_RPC_SYMBOLS +compat_symbol (libc, __key_encryptsession_pk_LOCAL, + __key_encryptsession_pk_LOCAL, GLIBC_2_1); +compat_symbol (libc, __key_decryptsession_pk_LOCAL, + __key_decryptsession_pk_LOCAL, GLIBC_2_1); +compat_symbol (libc, __key_gendes_LOCAL, __key_gendes_LOCAL, GLIBC_2_1); +# endif +#endif #ifndef SO_PASSCRED static int From patchwork Mon Jul 6 19:03:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 39926 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 68B5C385700C; Mon, 6 Jul 2020 19:03:29 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 68B5C385700C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1594062209; bh=OtmDXPzqO9SDeLUfsN6nkLfunUiYBDwYZXEVv8sophU=; h=To:Subject:In-Reply-To:References:Date:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=Wf631QGorR+B1a7ytxaqip+qfKEO7Lbe5YLVjREKAM5TBR2bRwggFiT8a9Ie1S0KJ q4QmPXd/ddSFKxP0C8KgaWgFa1w+wP96GlE8AwNPjMCKhYCLCTHxWFSkjRIkx4bpS6 mLGi/W1W+TLV/FtEIekf699Hu54TYzPodaDMrvv0= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) by sourceware.org (Postfix) with ESMTP id 7FD3B3857C79 for ; Mon, 6 Jul 2020 19:03:27 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 7FD3B3857C79 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-293-QdzaJ3z1MiKwjVQOdb0_Hg-1; Mon, 06 Jul 2020 15:03:25 -0400 X-MC-Unique: QdzaJ3z1MiKwjVQOdb0_Hg-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id BCCF8461 for ; Mon, 6 Jul 2020 19:03:24 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-112-118.ams2.redhat.com [10.36.112.118]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 45D425BACD for ; Mon, 6 Jul 2020 19:03:24 +0000 (UTC) To: libc-alpha@sourceware.org Subject: [PATCH 3/4] sunrpc: Do not export getrpcport by default In-Reply-To: References: Message-Id: <881da15729e93f2b8a8a80c0386b5759a8093b30.1594062056.git.fweimer@redhat.com> Date: Mon, 06 Jul 2020 21:03:22 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-12.6 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Florian Weimer via Libc-alpha From: Florian Weimer Reply-To: Florian Weimer Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" This function looks like an NSS function, but is actually a wrapper around pmap_getport, so it should only be exported with --enable-obsolete-rpc. --- sunrpc/getrpcport.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sunrpc/getrpcport.c b/sunrpc/getrpcport.c index 7d4b23865f..5dd635735c 100644 --- a/sunrpc/getrpcport.c +++ b/sunrpc/getrpcport.c @@ -66,3 +66,8 @@ getrpcport (const char *host, u_long prognum, u_long versnum, u_int proto) return 0; return pmap_getport (&addr, prognum, versnum, proto); } +#ifdef SHARED +# ifndef EXPORT_RPC_SYMBOLS +compat_symbol (libc, getrpcport, getrpcport, GLIBC_2_0); +# endif +#endif From patchwork Mon Jul 6 19:03:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 39927 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 693C7385702B; Mon, 6 Jul 2020 19:03:59 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 693C7385702B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1594062239; bh=lL7NT/VT/SYpX+ybG0k9+Z1LrkjqRV/WymxG2W69pd4=; h=To:Subject:In-Reply-To:References:Date:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=qOokFZrgiLH+CTDwSVRY2shEFd3M9lEgIods4Rp7nPerGReFFr4oK+kzocTqlOc+l KAbyYN1DRDy+3+0LkgAbSUbogVfPFPijMIyWqHNCiu8ZKHt/mvNXHVDj94a++KqV7w 1HOLhepGC7gqb3uKBwm4hEUNM1gM935CyCohaEaU= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) by sourceware.org (Postfix) with ESMTP id 78665385702B for ; Mon, 6 Jul 2020 19:03:55 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 78665385702B Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-87-A2va8vhkNHawfabgzTkw4w-1; Mon, 06 Jul 2020 15:03:49 -0400 X-MC-Unique: A2va8vhkNHawfabgzTkw4w-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 555F71883624 for ; Mon, 6 Jul 2020 19:03:48 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-112-118.ams2.redhat.com [10.36.112.118]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2DC5A2B6F0 for ; Mon, 6 Jul 2020 19:03:47 +0000 (UTC) To: libc-alpha@sourceware.org Subject: [PATCH 4/4] nss: Remove cryptographic key support from nss_files, nss_nis, nss_nisplus In-Reply-To: References: Message-Id: Date: Mon, 06 Jul 2020 21:03:45 +0200 User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-12.6 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Florian Weimer via Libc-alpha From: Florian Weimer Reply-To: Florian Weimer Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" The interface has hard-coded buffer sizes and is therefore tied to DES. It also does not match current practice where different services on the same host use different key material. This change simplifies removal of the sunrpc code. --- NEWS | 6 + nis/Makefile | 2 +- nis/nss_nis/nis-publickey.c | 234 ---------------- nis/nss_nisplus/nisplus-publickey.c | 411 ---------------------------- nss/Makefile | 3 +- nss/nss_files/files-key.c | 113 -------- 6 files changed, 9 insertions(+), 760 deletions(-) delete mode 100644 nis/nss_nis/nis-publickey.c delete mode 100644 nis/nss_nisplus/nisplus-publickey.c delete mode 100644 nss/nss_files/files-key.c diff --git a/NEWS b/NEWS index 839934d649..05c274e53a 100644 --- a/NEWS +++ b/NEWS @@ -67,6 +67,12 @@ Deprecated and removed features, and other changes affecting compatibility: * ldconfig now defaults to the new format for ld.so.cache. glibc has already supported this format for almost 20 years. +* The "files", "nis" and "nisplus" NSS modules no longer supports the + "key" database (used for secure RPC). The contents of the + /etc/publickey file will be ignored, regardless of the settings in + /etc/nsswitch.conf. (This method of storing RPC keys only supported + the obsolete and insecure AUTH_DES flavor of secure RPC.) + Changes to build and runtime requirements: * powerpc64le requires GCC 7.4 or newer. This is required for supporting diff --git a/nis/Makefile b/nis/Makefile index 6ce2199459..9ad5e1db7a 100644 --- a/nis/Makefile +++ b/nis/Makefile @@ -36,7 +36,7 @@ headers := $(wildcard rpcsvc/*.[hx]) # These are the databases available for the nis (and perhaps later nisplus) # service. This must be a superset of the services in nss. databases = proto service hosts network grp pwd rpc ethers \ - spwd netgrp alias publickey + spwd netgrp alias # Specify rules for the nss_* modules. services := nis nisplus diff --git a/nis/nss_nis/nis-publickey.c b/nis/nss_nis/nis-publickey.c deleted file mode 100644 index adbc04bf2d..0000000000 --- a/nis/nss_nis/nis-publickey.c +++ /dev/null @@ -1,234 +0,0 @@ -/* Copyright (C) 1996-2020 Free Software Foundation, Inc. - This file is part of the GNU C Library. - Contributed by Thorsten Kukuk , 1996. - - The GNU C Library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - The GNU C Library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with the GNU C Library; if not, see - . */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "nss-nis.h" - -/* If we haven't found the entry, we give a SUCCESS and an empty key back. - Solaris docu says: sizeof (pkey) == HEXKEYBYTES + 1. -*/ -enum nss_status -_nss_nis_getpublickey (const char *netname, char *pkey, int *errnop) -{ - pkey[0] = 0; - - if (netname == NULL) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - - char *domain = strchr (netname, '@'); - if (domain == NULL) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - ++domain; - - char *result; - int len; - int yperr = yp_match (domain, "publickey.byname", netname, strlen (netname), - &result, &len); - - if (__glibc_unlikely (yperr != YPERR_SUCCESS)) - { - enum nss_status retval = yperr2nss (yperr); - - if (retval == NSS_STATUS_TRYAGAIN) - *errnop = errno; - return retval; - } - - if (result != NULL) - { - char *p = strchr (result, ':'); - if (p != NULL) - *p = 0; - strncpy (pkey, result, HEXKEYBYTES + 1); - pkey[HEXKEYBYTES] = '\0'; - free (result); - } - return NSS_STATUS_SUCCESS; -} - -enum nss_status -_nss_nis_getsecretkey (const char *netname, char *skey, char *passwd, - int *errnop) -{ - skey[0] = 0; - - if (netname == NULL || passwd == NULL) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - - char *domain = strchr (netname, '@'); - if (domain == NULL) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - ++domain; - - char *result; - int len; - int yperr = yp_match (domain, "publickey.byname", netname, strlen (netname), - &result, &len); - - if (__glibc_unlikely (yperr != YPERR_SUCCESS)) - { - enum nss_status retval = yperr2nss (yperr); - - if (retval == NSS_STATUS_TRYAGAIN) - *errnop = errno; - return retval; - } - - if (result != NULL) - { - char *p = strchr (result, ':'); - if (p != NULL) - { - char buf[2 * (HEXKEYBYTES + 1)]; - - ++p; - strncpy (buf, p, 2 * (HEXKEYBYTES + 1)); - buf[2 * HEXKEYBYTES + 1] = '\0'; - if (xdecrypt (buf, passwd) - && memcmp (buf, &(buf[HEXKEYBYTES]), KEYCHECKSUMSIZE) == 0) - { - buf[HEXKEYBYTES] = '\0'; - strcpy (skey, buf); - } - } - - free (result); - } - return NSS_STATUS_SUCCESS; -} - -/* Parse uid and group information from the passed string. - The format of the string passed is uid:gid,grp,grp, ... */ -static enum nss_status -parse_netid_str (const char *s, uid_t *uidp, gid_t *gidp, int *gidlenp, - gid_t *gidlist) -{ - char *p, *ep; - int gidlen; - - if (!s || !isdigit (*s)) - { - syslog (LOG_ERR, "netname2user: expecting uid '%s'", s); - return NSS_STATUS_NOTFOUND; /* XXX need a better error */ - } - - /* Fetch the uid */ - *uidp = strtoul (s, NULL, 10); - - if (*uidp == 0) - { - syslog (LOG_ERR, "netname2user: should not have uid 0"); - return NSS_STATUS_NOTFOUND; - } - - /* Now get the group list */ - p = strchr (s, ':'); - if (!p) - { - syslog (LOG_ERR, "netname2user: missing group id list in '%s'", s); - return NSS_STATUS_NOTFOUND; - } - ++p; /* skip ':' */ - if (!p || (!isdigit (*p))) - { - syslog (LOG_ERR, "netname2user: missing group id list in '%s'.", p); - return NSS_STATUS_NOTFOUND; - } - - *gidp = strtoul (p, &ep, 10); - - gidlen = 0; - - /* After strtoul() ep should point to the first invalid character. - This is the marker "," we search for the next value. */ - while (ep != NULL && *ep == ',') - { - ep++; - p = ep; - gidlist[gidlen++] = strtoul (p, &ep, 10); - } - - *gidlenp = gidlen; - - return NSS_STATUS_SUCCESS; -} - - -enum nss_status -_nss_nis_netname2user (char netname[MAXNETNAMELEN + 1], uid_t *uidp, - gid_t *gidp, int *gidlenp, gid_t *gidlist, int *errnop) -{ - char *domain = strchr (netname, '@'); - if (domain == NULL) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - - /* Point past the '@' character */ - ++domain; - char *lookup = NULL; - int len; - int yperr = yp_match (domain, "netid.byname", netname, strlen (netname), - &lookup, &len); - switch (yperr) - { - case YPERR_SUCCESS: - break; /* the successful case */ - case YPERR_DOMAIN: - case YPERR_KEY: - return NSS_STATUS_NOTFOUND; - case YPERR_MAP: - default: - return NSS_STATUS_UNAVAIL; - } - - if (lookup == NULL) - return NSS_STATUS_NOTFOUND; - - - lookup[len] = '\0'; - - enum nss_status err = parse_netid_str (lookup, uidp, gidp, gidlenp, gidlist); - - free (lookup); - - return err; -} diff --git a/nis/nss_nisplus/nisplus-publickey.c b/nis/nss_nisplus/nisplus-publickey.c deleted file mode 100644 index ebbb3dafb2..0000000000 --- a/nis/nss_nisplus/nisplus-publickey.c +++ /dev/null @@ -1,411 +0,0 @@ -/* Copyright (c) 1997-2020 Free Software Foundation, Inc. - This file is part of the GNU C Library. - Contributed by Thorsten Kukuk , 1997. - - The GNU C Library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - The GNU C Library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with the GNU C Library; if not, see - . */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -extern int xdecrypt (char *, char *); - -#include - -/* If we haven't found the entry, we give a SUCCESS and an empty key back. */ -enum nss_status -_nss_nisplus_getpublickey (const char *netname, char *pkey, int *errnop) -{ - nis_result *res; - enum nss_status retval; - char buf[NIS_MAXNAMELEN + 2]; - size_t slen; - char *domain, *cptr; - int len; - - pkey[0] = 0; - - if (netname == NULL) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - - domain = strchr (netname, '@'); - if (!domain) - return NSS_STATUS_UNAVAIL; - domain++; - - slen = snprintf (buf, NIS_MAXNAMELEN, - "[auth_name=%s,auth_type=DES],cred.org_dir.%s", - netname, domain); - - if (slen >= NIS_MAXNAMELEN) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - - if (buf[slen - 1] != '.') - { - buf[slen++] = '.'; - buf[slen] = '\0'; - } - - res = nis_list (buf, USE_DGRAM+NO_AUTHINFO+FOLLOW_LINKS+FOLLOW_PATH, - NULL, NULL); - - if (res == NULL) - { - *errnop = ENOMEM; - return NSS_STATUS_TRYAGAIN; - } - retval = niserr2nss (res->status); - - if (retval != NSS_STATUS_SUCCESS) - { - if (retval == NSS_STATUS_TRYAGAIN) - *errnop = errno; - if (res->status == NIS_NOTFOUND) - retval = NSS_STATUS_SUCCESS; - nis_freeresult (res); - return retval; - } - - if (NIS_RES_NUMOBJ (res) > 1) - { - /* - * More than one principal with same uid? - * something wrong with cred table. Should be unique - * Warn user and continue. - */ - syslog (LOG_ERR, _("DES entry for netname %s not unique\n"), netname); - nis_freeresult (res); - return NSS_STATUS_SUCCESS; - } - - len = ENTRY_LEN (NIS_RES_OBJECT (res), 3); - memcpy (pkey, ENTRY_VAL (NIS_RES_OBJECT (res),3), len); - pkey[len] = 0; - cptr = strchr (pkey, ':'); - if (cptr) - cptr[0] = '\0'; - nis_freeresult (res); - - return NSS_STATUS_SUCCESS; -} - - -enum nss_status -_nss_nisplus_getsecretkey (const char *netname, char *skey, char *passwd, - int *errnop) -{ - nis_result *res; - enum nss_status retval; - char buf[NIS_MAXNAMELEN + 2]; - size_t slen; - char *domain, *cptr; - int len; - - skey[0] = 0; - - if (netname == NULL) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - - domain = strchr (netname, '@'); - if (!domain) - return NSS_STATUS_UNAVAIL; - domain++; - - slen = snprintf (buf, NIS_MAXNAMELEN, - "[auth_name=%s,auth_type=DES],cred.org_dir.%s", - netname, domain); - - if (slen >= NIS_MAXNAMELEN) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - - if (buf[slen - 1] != '.') - { - buf[slen++] = '.'; - buf[slen] = '\0'; - } - - res = nis_list (buf, USE_DGRAM | NO_AUTHINFO | FOLLOW_LINKS | FOLLOW_PATH, - NULL, NULL); - - if (res == NULL) - { - *errnop = ENOMEM; - return NSS_STATUS_TRYAGAIN; - } - retval = niserr2nss (res->status); - - if (retval != NSS_STATUS_SUCCESS) - { - if (retval == NSS_STATUS_TRYAGAIN) - *errnop = errno; - nis_freeresult (res); - return retval; - } - - if (NIS_RES_NUMOBJ (res) > 1) - { - /* - * More than one principal with same uid? - * something wrong with cred table. Should be unique - * Warn user and continue. - */ - syslog (LOG_ERR, _("DES entry for netname %s not unique\n"), netname); - nis_freeresult (res); - return NSS_STATUS_SUCCESS; - } - - len = ENTRY_LEN (NIS_RES_OBJECT (res), 4); - memcpy (buf, ENTRY_VAL (NIS_RES_OBJECT (res), 4), len); - buf[len] = '\0'; - cptr = strchr (buf, ':'); - if (cptr) - cptr[0] = '\0'; - nis_freeresult (res); - - if (!xdecrypt (buf, passwd)) - return NSS_STATUS_SUCCESS; - - if (memcmp (buf, &(buf[HEXKEYBYTES]), KEYCHECKSUMSIZE) != 0) - return NSS_STATUS_SUCCESS; - - buf[HEXKEYBYTES] = 0; - strcpy (skey, buf); - - return NSS_STATUS_SUCCESS; -} - - -/* Parse information from the passed string. - The format of the string passed is gid,grp,grp, ... */ -static enum nss_status -parse_grp_str (const char *s, gid_t *gidp, int *gidlenp, gid_t *gidlist, - int *errnop) -{ - char *ep; - int gidlen; - - if (!s || (!isdigit (*s))) - { - syslog (LOG_ERR, _("netname2user: missing group id list in `%s'"), s); - return NSS_STATUS_NOTFOUND; - } - - *gidp = strtoul (s, &ep, 10); - - gidlen = 0; - - /* After strtoul() ep should point to the marker ',', which means - here starts a new value. - - The Sun man pages show that GIDLIST should contain at least NGRPS - elements. Limiting the number written by this value is the best - we can do. */ - while (ep != NULL && *ep == ',' && gidlen < NGRPS) - { - ep++; - s = ep; - gidlist[gidlen++] = strtoul (s, &ep, 10); - } - *gidlenp = gidlen; - - return NSS_STATUS_SUCCESS; -} - -enum nss_status -_nss_nisplus_netname2user (char netname[MAXNETNAMELEN + 1], uid_t *uidp, - gid_t *gidp, int *gidlenp, gid_t *gidlist, int *errnop) -{ - char *domain; - nis_result *res; - char sname[NIS_MAXNAMELEN + 2]; /* search criteria + table name */ - size_t slen; - char principal[NIS_MAXNAMELEN + 1]; - int len; - - /* 1. Get home domain of user. */ - domain = strchr (netname, '@'); - if (! domain) - return NSS_STATUS_UNAVAIL; - - ++domain; /* skip '@' */ - - /* 2. Get user's nisplus principal name. */ - slen = snprintf (sname, NIS_MAXNAMELEN, - "[auth_name=%s,auth_type=DES],cred.org_dir.%s", - netname, domain); - - if (slen >= NIS_MAXNAMELEN) - { - *errnop = EINVAL; - return NSS_STATUS_UNAVAIL; - } - - if (sname[slen - 1] != '.') - { - sname[slen++] = '.'; - sname[slen] = '\0'; - } - - /* must use authenticated call here */ - /* XXX but we cant, for now. XXX */ - res = nis_list (sname, USE_DGRAM+NO_AUTHINFO+FOLLOW_LINKS+FOLLOW_PATH, - NULL, NULL); - if (res == NULL) - { - *errnop = ENOMEM; - return NSS_STATUS_TRYAGAIN; - } - switch (res->status) - { - case NIS_SUCCESS: - case NIS_S_SUCCESS: - break; /* go and do something useful */ - case NIS_NOTFOUND: - case NIS_PARTIAL: - case NIS_NOSUCHNAME: - case NIS_NOSUCHTABLE: - nis_freeresult (res); - return NSS_STATUS_NOTFOUND; - case NIS_S_NOTFOUND: - case NIS_TRYAGAIN: - syslog (LOG_ERR, _("netname2user: (nis+ lookup): %s\n"), - nis_sperrno (res->status)); - nis_freeresult (res); - *errnop = errno; - return NSS_STATUS_TRYAGAIN; - default: - syslog (LOG_ERR, _("netname2user: (nis+ lookup): %s\n"), - nis_sperrno (res->status)); - nis_freeresult (res); - return NSS_STATUS_UNAVAIL; - } - - if (NIS_RES_NUMOBJ (res) > 1) - /* - * A netname belonging to more than one principal? - * Something wrong with cred table. should be unique. - * Warn user and continue. - */ - syslog (LOG_ALERT, - _("netname2user: DES entry for %s in directory %s not unique"), - netname, domain); - - len = ENTRY_LEN (NIS_RES_OBJECT (res), 0); - strncpy (principal, ENTRY_VAL (NIS_RES_OBJECT (res), 0), len); - principal[len] = '\0'; - nis_freeresult (res); - - if (principal[0] == '\0') - return NSS_STATUS_UNAVAIL; - - /* - * 3. Use principal name to look up uid/gid information in - * LOCAL entry in **local** cred table. - */ - domain = nis_local_directory (); - if (strlen (principal) + strlen (domain) + 45 > (size_t) NIS_MAXNAMELEN) - { - syslog (LOG_ERR, _("netname2user: principal name `%s' too long"), - principal); - return NSS_STATUS_UNAVAIL; - } - - slen = snprintf (sname, sizeof (sname), - "[cname=%s,auth_type=LOCAL],cred.org_dir.%s", - principal, domain); - - if (sname[slen - 1] != '.') - { - sname[slen++] = '.'; - sname[slen] = '\0'; - } - - /* must use authenticated call here */ - /* XXX but we cant, for now. XXX */ - res = nis_list (sname, USE_DGRAM+NO_AUTHINFO+FOLLOW_LINKS+FOLLOW_PATH, - NULL, NULL); - if (res == NULL) - { - *errnop = ENOMEM; - return NSS_STATUS_TRYAGAIN; - } - switch(res->status) - { - case NIS_NOTFOUND: - case NIS_PARTIAL: - case NIS_NOSUCHNAME: - case NIS_NOSUCHTABLE: - nis_freeresult (res); - return NSS_STATUS_NOTFOUND; - case NIS_S_NOTFOUND: - case NIS_TRYAGAIN: - syslog (LOG_ERR, _("netname2user: (nis+ lookup): %s\n"), - nis_sperrno (res->status)); - nis_freeresult (res); - *errnop = errno; - return NSS_STATUS_TRYAGAIN; - case NIS_SUCCESS: - case NIS_S_SUCCESS: - break; /* go and do something useful */ - default: - syslog (LOG_ERR, _("netname2user: (nis+ lookup): %s\n"), - nis_sperrno (res->status)); - nis_freeresult (res); - return NSS_STATUS_UNAVAIL; - } - - if (NIS_RES_NUMOBJ (res) > 1) - /* - * A principal can have more than one LOCAL entry? - * Something wrong with cred table. - * Warn user and continue. - */ - syslog (LOG_ALERT, - _("netname2user: LOCAL entry for %s in directory %s not unique"), - netname, domain); - /* Fetch the uid */ - *uidp = strtoul (ENTRY_VAL (NIS_RES_OBJECT (res), 2), NULL, 10); - - if (*uidp == 0) - { - syslog (LOG_ERR, _("netname2user: should not have uid 0")); - nis_freeresult (res); - return NSS_STATUS_NOTFOUND; - } - - parse_grp_str (ENTRY_VAL (NIS_RES_OBJECT (res), 3), - gidp, gidlenp, gidlist, errnop); - - nis_freeresult (res); - return NSS_STATUS_SUCCESS; -} diff --git a/nss/Makefile b/nss/Makefile index 97bab5bb75..cbb70167a9 100644 --- a/nss/Makefile +++ b/nss/Makefile @@ -93,7 +93,8 @@ subdir-dirs = $(services:%=nss_%) vpath %.c $(subdir-dirs) ../locale/programs ../intl -libnss_files-routines := $(addprefix files-,$(databases)) \ +libnss_files-routines := $(addprefix files-, \ + $(filter-out key, $(databases))) \ files-initgroups files-init libnss_db-dbs := $(addprefix db-,\ diff --git a/nss/nss_files/files-key.c b/nss/nss_files/files-key.c deleted file mode 100644 index cf0a7d9ad9..0000000000 --- a/nss/nss_files/files-key.c +++ /dev/null @@ -1,113 +0,0 @@ -/* Public key file parser in nss_files module. - Copyright (C) 1996-2020 Free Software Foundation, Inc. - This file is part of the GNU C Library. - - The GNU C Library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - The GNU C Library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with the GNU C Library; if not, see - . */ - -#include -#include -#include -#include -#include -#include -#include "nsswitch.h" - -NSS_DECLARE_MODULE_FUNCTIONS (files) - -#define DATAFILE "/etc/publickey" - - -static enum nss_status -search (const char *netname, char *result, int *errnop, int secret) -{ - FILE *stream = fopen (DATAFILE, "rce"); - if (stream == NULL) - return errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL; - - for (;;) - { - char buffer[HEXKEYBYTES * 2 + KEYCHECKSUMSIZE + MAXNETNAMELEN + 17]; - char *p; - char *save_ptr; - - buffer[sizeof (buffer) - 1] = '\xff'; - p = fgets_unlocked (buffer, sizeof (buffer), stream); - if (p == NULL) - { - /* End of file or read error. */ - *errnop = errno; - fclose (stream); - return NSS_STATUS_NOTFOUND; - } - else if (buffer[sizeof (buffer) - 1] != '\xff') - { - /* Invalid line in file? Skip remainder of line. */ - if (buffer[sizeof (buffer) - 2] != '\0') - while (getc_unlocked (stream) != '\n') - continue; - continue; - } - - /* Parse line. */ - p = __strtok_r (buffer, "# \t:\n", &save_ptr); - if (p == NULL) /* Skip empty and comment lines. */ - continue; - if (strcmp (p, netname) != 0) - continue; - - /* A hit! Find the field we want and return. */ - p = __strtok_r (NULL, ":\n", &save_ptr); - if (p == NULL) /* malformed line? */ - continue; - if (secret) - p = __strtok_r (NULL, ":\n", &save_ptr); - if (p == NULL) /* malformed line? */ - continue; - fclose (stream); - strcpy (result, p); - return NSS_STATUS_SUCCESS; - } -} - -enum nss_status -_nss_files_getpublickey (const char *netname, char *pkey, int *errnop) -{ - return search (netname, pkey, errnop, 0); -} - -enum nss_status -_nss_files_getsecretkey (const char *netname, char *skey, char *passwd, - int *errnop) -{ - enum nss_status status; - char buf[HEXKEYBYTES + KEYCHECKSUMSIZE + 16]; - - skey[0] = 0; - - status = search (netname, buf, errnop, 1); - if (status != NSS_STATUS_SUCCESS) - return status; - - if (!xdecrypt (buf, passwd)) - return NSS_STATUS_SUCCESS; - - if (memcmp (buf, &(buf[HEXKEYBYTES]), KEYCHECKSUMSIZE) != 0) - return NSS_STATUS_SUCCESS; - - buf[HEXKEYBYTES] = 0; - strcpy (skey, buf); - - return NSS_STATUS_SUCCESS; -}