Commit Graph

113 Commits

Author SHA1 Message Date
Bill Paul
3948edc24c Another tweak/speedup pass:
- Fix buffer overflow problem once and for all: do away with the buffer
  copies to 'user' prior to calling _scancaches() and just pass a pointer
  to the buffer returned by yp_match()/yp_first()/yp_next()/whatever.
  (We turn the first ':' to a NUL first so strcmp() works, then change it
  back later. Submitted by Bill Fenner <fenner@parc.xerox.com> and
  tweaked slightly by me.

- Give _pw_breakout_yp() the 'more elegant solution' I promised way back when.
  Eliminate several copies to static buffers and replace them with just
  one copy. (The buffer returned by the NIS functions is at most
  YPMAXRECORD bytes long, so we should only need one static buffer of
  the same length (plus 2 for paranoia's sake).)

- Also in _pw_breakout_yp(): always set pw.pw_passwd to the username
  obtained via NIS regardless of what pw_fields says: usernames cannot
  be overridden so we have no choice but to use the name returned by
  NIS.

- _Again_ in _pw_breakout_yp(): before doing anything else, check that
  the first character of the NIS-returned buffer is not a '+' or '-'.
  If it is, drop the entry. (#define EXTRA_PARANOIA 1 :)

- Probe for the master.passwd.* maps once during __initdb() instead
  of doing it each time _getyppass() or _nextyppass() is called.

- Don't copy the NIS data buffers to static memory in _getyppass()
  and _nextyppass(): this is done in _pw_breakout_yp() now.

- Test against phkmalloc and phkmalloc/2 (TNG!) to make sure we're
  free()ing the yp buffers sanely.

- Put _havemaster(), _getyppass() and nextyppass() prototypes under
  #ifdef YP. (Somehow they ended up on the wrong side of the #endif.)

- Remove unused variable ___yp_only.
1995-10-11 21:35:08 +00:00
Bill Paul
eb6c139019 Some NIS bug stomping:
- In some cases, we don't properly resolve _all_ possible group memberships.
  If a user is a member of both local and NIS groups, we sometimes lose some
  of the membership info from NIS. (Reported by: Thorsten Kukuk
  <kukuk@uni-paderborn.de>)

- Make NIS +groupname overrides actually work the way the SunOS group(5)
  man page says they should (make them work for all cases: getgrent(),
  getgrnam() and getgrgid()).

- When not compiled with -DYP, grscan() should ignore entries that
  begin with a '+'. When compiled _with_ -DYP, grscan() should ignore
  +groupname entries that don't refer to real NIS groups.

- Remove redundant redeclaration of fgets(), strsep() and index() inside
  grscan(). We already #include all the right header files for these.

Note: -groupname exclusion as specified in the Sun documentation still
isn't supported. This'll be a 2.2 addition. Right now I just want this
stuff to work.
1995-10-06 21:29:01 +00:00
Peter Wemm
11e67a9f2e Fix the problem that I aroused with the last commit..
What was happening, is if syslogd was not running, syslog() would do
a strcat("\r\n") on a non-null-terminated buffer, and write it to the console.

This meant that sometimes extra characters could be written to the console
during boot, depending on the stack contents.

This totally avoids the potential problem by using writev() like the rest
of the does, and avoid modifying the buffer after the trouble we've gone to
to carefully protect it.

This is actually a trivial fix, in spite of the long commit message.. :-)
It only appeared during boot and shutdown with syslogd stopped.
1995-10-05 00:11:15 +00:00
Peter Wemm
fcc3b6999e Make ttyname() use posix-style tcgetattr() to check to see that it's
running on a tty.  (Same as isatty()) The old-style TIOCGETP ioctl
wouldn't fly if the kernel didn't have COMPAT_43.
Submitted by:	Carl Fongheiser <cmf@netins.net>
1995-09-22 17:01:28 +00:00
Peter Wemm
7c8e2aa48c Fix security bugs with a "new approach", using stdio's powerful buffer
control hooks.
It is similar to an unrolled multi-part snprintf(), in that a "FILE *" is
attached to a string buffer.  There is also an optimisation for the case
where the syslog format string does not contain %m, which should improve
performance of "informational" logging, like from ftpd.
1995-09-15 13:53:39 +00:00
Bill Paul
400b841301 getgrent.c: adjust _nextypgroup() slightly so that it continues processing
the group map after encountering a badly formatted entry.

getpwent.c: same as above for _nextyppass(), and also turn a couple of
sprintf()s into snprintf()s to avoid potential buffer overruns. (The
other day I nearly went mad because of a username in my NIS database
that's actually 9 characters long instead of 8. Stuffing a 9-character
username into an 8-character buffer can do some strange things.)

(This reminds me: I hope somebody's planning to fix the buffer overrun
security hole in syslog(3) before 2.1 ships.)
1995-09-05 19:52:59 +00:00
Bill Paul
d454389cc2 getpwent.c: turn the code that checks the override caches into a
seperate function to avoid duplication. Also fix getpwent() a
small bit to properly handle the case where the magic NIS '+'
entry appears before the end of the password file.

getgrent.c: be a little more SunOS-ish. Make it look like the NIS
group map is 'inserted' at the the point(s) where the magic NIS '+'
entry/entries appear.

getgrent: fix a file descriptor leak: remember to close the netgroup
file after we determine that we're using NIS-only innetgr() lookups.
1995-09-02 04:08:55 +00:00
Andrey A. Chernov
85b3ab5887 National date/time representation in syslog logfiles looks ugly,
change strftime to ctime. Logfiles must have default (english) date/time
representation for access/view from various places.
1995-08-29 13:21:53 +00:00
Bill Paul
22397ec3c3 Fix _listmatch() so that it doesn't fall off the end of the list string. 1995-08-08 02:51:16 +00:00
Bill Paul
1e890b056a Just when you thought it was safe...
- getnetgrent.c: address some NIS compatibility problems. We really need
to use the netgroup.byuser and netgroup.byhost maps to speed up innetgr()
when using NIS. Also, change the NIS interaction in the following way:

If /etc/netgroup does not exist or is empty (or contains only the
NIS '+' token), we now use NIS exclusively. This lets us use the
'reverse netgroup' maps and is more or less the behavior of other
platforms.

If /etc/netgroup exists and contains local netgroup data (but no '+').
we use only lthe local stuff and ignore NIS.

If /etc/netgroup exists and contains both local data and the '+',
we use the local data nd the netgroup map as a single combined
database (which, unfortunately, can be slow when the netgroup
database is large). This is what we have been doing up until now.

Head off a potential NULL pointer dereference in the old innetgr()
matching code.

Also fix the way the NIS netgroup map is incorporated into things:
adding the '+' is supposed to make it seem as though the netgroup
database is 'inserted' wherever the '+' is placed. We didn't quite
do it that way before.

(The NetBSD people apparently use a real, honest-to-gosh, netgroup.db
database that works just like the password database. This is
actually a neat idea since netgroups is the sort of thing that
can really benefit from having multi-key search capability,
particularly since reverse lookups require more than a trivial
amount of processing. Should we do something like this too?)

- netgroup.5: document all this stuff.

- rcmd.c: some sleuthing with some test programs linked with my own
version of innetgr() has revealed that SunOS always passes the NIS
domain name to innetgr() in the 'domain' argument. We might as well
do the same (if YP is defined).

- ether_addr.c: also fix the NIS interaction so that placing the
'+' token in the /etc/ethers file makes it seem like the NIS
ethers data is 'inserted' at that point. (Chances are nobody will
notice the effect of this change, which is just te way I like it. :)
1995-08-07 03:42:14 +00:00
Garrett Wollman
21271a8c7a Don't depend on bogusly-installed <tzfile.h>. 1995-08-05 20:25:24 +00:00
Mike Pritchard
a9680d7112 Null terminate all strings returned by the dummy uname() routine,
and make sure that the version string is somewhat sane.  This
closes out PR#462.

Reviewed by: Bruce Evans
1995-07-31 10:10:02 +00:00
Bruce Evans
52a69cb00b Fix the synopsis of signal() again. Now it is uglier but correct.
(Declarations of signal that don't use typedefs can't be formatted
in the standard man page form.)
1995-07-16 09:41:03 +00:00
Bill Paul
6c0828a6c6 Do the same sanity checking in _pw_breakout_yp() that we do in
_gr_breakout_yp(): if we encounter a NULL pointer generated as the
result of a badly formatted NIS passwd entry (e.g. missing fields),
we punt and return an error code, thereby silently skipping the
bad entry.
1995-06-26 16:04:57 +00:00
Bill Paul
e0ee807b3d Fix for a potential problem reported by a user I bumped into on IRC
last night:

_gr_breakout_yp() doesn't check for badly formatted NIS group entries.
For example, a bogus entry like this:

bootp::user1,user2,user3

will lead to a null pointer dereference and a SEGV (note that the GID
field is missing -- this results in one of the strsep(&result, ":")
returning NULL). The symtpom of this problem is programs dumping
core left and right the moment you add a + entry to /etc/group.
Note that while this is similar to an earlier bug, it's caused by a
different set of circumstances.

The fix is to check for the NULL pointers and have _gr_breakout_yp()
punt and return a failure code if it catches one. This is more or
less the behavior of SunOS: if a bad NIS group entry is encountered,
it's silently ignored. I don't think our standard (non-NIS) group
parsing code behaves the same way. It doesn't crash though, so I'm
citing the 'it ain't broken, don't fix it' rule and leaving it alone.

I'll probably have to add similar checks to _pw_breakout_yp() in
getpwent.c to ward off the same problems. It's rare that bad NIS
map entries like this occur, but we should handle them gracefully
when they do.
1995-06-26 14:59:46 +00:00
Bill Paul
dbf973c0c7 Fixes for PR #508 and #509 ('botched 'Bad netgroup' error message' and
'cycle in netgroup check too greedy').

PR #508 is apparently due to an inconsistency in the way the 4.4BSD
netgroup code deals with bad netgroups. When 4.4BSD code encounters
a badly formed netgroup entry (e.g. (somehost,-somedomain), which,
because of the missing comma between the '-' and 'somedomain,' has
only 2 fields instead of 3), it generates an error message and
then bails out without doing any more processing on the netgroup
containing the bad entry. Conversely, every other *NIX in the world
that usees netgroups just tries to parse the entry as best it can
and then silently continues on its way.

The result is that two bad things happen: 1) we ignore other valid entries
within the netgroup containing the bogus entry, which prevents
us from interoperating with other systems that don't behave this way,
and 2) by printing an error to stderr from inside libc, we hose certain
programs, in this case rlogind. In the problem report, Bill Fenner
noted that the 'B' from 'Bad' was missing, and that rlogind exited
immediately after generating the error. The missing 'B' is apparently
not caused by any problem in getnetgrent.c; more likely it's getting
swallowed up by rlogind somehow, and the error message itself causes
rlogind to become confused. I was able to duplicate this problem and
discovered that running a simple test program on my FreeBSD system
resulted in a properly formatted (if confusing) error, whereas triggering
the error by trying to rlogin to the machine yielded the missing 'B'
problem.

Anyway, the fixes for this are as follows:

- The error message has been reformatted so that it prints out more useful
  information (e.g. Bad entry (somehost,-somedomain) in netgroup "foo").
  We check for NULL entries so that we don't print '(null)' anymore too. :)

- Rearranged things in parse_netgrp()  so that we make a best guess at
  what bad entries are supposed to look like and then continue processing
  instead of bailing out.

- Even though the error message has been cleaned up, it's wrapped inside
  a #ifdef DEBUG. This way we match the behavior of other systems. Since we
  now handle the error condition better anyway, this error message becomes
  less important.

PR #507 is another case of inconsistency. The code that handles
duplicate/circular netgroup entries isn't really 'too greedy; -- it's
just too noisy. If you have a netgroup containing duplicate entries,
the code actually does the right thing, but it also generates an error
message. As with the 'Bad netgroup' message, spewing this out from
inside libc can also hose certain programs (like rlogind). Again, no
other system generates an error message in this case.

The only change here is to hide the error message inside an #ifdef DEBUG.
Like the other message, it's largely superfluous since the code handles
the condition correctly.

Note that PR #510 (+@netgroup host matching in /etc/hosts.equiv) is still
being investigated. I haven't been able to duplicate it myself, and I
strongly suspect it to be a configuration problem of some kind. However,
I'm leaving all three PRs open until I get 510 resolved just for the
sake of paranoia.
1995-06-23 14:47:54 +00:00
Jeffrey Hsu
e78bad2371 Don't cast void functions to void.
Obtained from: NetBSD commit by jtc on June 16, 1995.
1995-06-20 18:31:16 +00:00
Bill Paul
85e8f5bee2 Make _havemaster() use yp_first() (again) instead of yp_order() to
ward off possible NIS+ evil. (I might be overly paranoid with this,
but it doesn't hurt, so...)
1995-06-17 04:00:02 +00:00
Rodney W. Grimes
d3628763db Merge RELENG_2_0_5 into HEAD 1995-06-11 19:33:05 +00:00
Rodney W. Grimes
6c06b4e2aa Remove trailing whitespace. 1995-05-30 05:51:47 +00:00
Rodney W. Grimes
709e8f9ae1 Remove trailing whitespace. 1995-05-30 03:57:47 +00:00
Andrey A. Chernov
4f5129899a Parse ^? now, our termcap use it and some termcaps from other
systems use it too
1995-05-14 22:29:13 +00:00
Andrey A. Chernov
ff17906bc9 Fix bracket error for LogMask
Submitted by: Ruslan Belkin <rus@home2.UA.net>
1995-05-02 17:46:30 +00:00
Joerg Wunsch
85c30cfa12 Added function and man page for ftok(3), used in conjunction with
the so-called "System V IPC".

Submitted by:	jbeukema@HK.Super.Net (John Beukema)
Obtained from:  Th. Lockert <tholo@sigmasoft.com>, via NetBSD
1995-05-01 08:53:21 +00:00
Bill Paul
04adcdacbf Small fix for the following problems:
- If you take the wheel entry out of /etc/group and turn on NIS,
the '+:*::' line is incorrectly flagged as the entry for wheel (the
empty gid section is translated to 0), hence getgrgid() returns '+'
as the name of the group instead of 'wheel.'

- Using just '+:' as the 'turn on NIS' switch in /etc/group makes
getgrgid() dump core because of a null pointer dereference. (Last
time I was in here, I foolishly assumed that fixing the core dump
problems with getgrnam() and getgrent() would fix getgrgid() too.
Silly me.)
1995-04-29 17:14:50 +00:00
Bill Paul
243ae8c754 in _freecaches(): strdup() allocates us memory -- remember to free it. 1995-04-22 17:28:04 +00:00
Bruce Evans
55e2b2c608 Fix bugs in opendir():
- it succeeded on non-directories (see POSIX 5.1.2.4).
- it hung on (non-open) named pipes.
- it leaked memory if the second malloc() failed.
- it didn't preserve errno across errors in close().
1995-04-21 15:23:27 +00:00
Bill Paul
8efe1172e2 Head off potential core dump in _havemaster() (we don't need to free any
memory here: the underlying YP routines handle this one for us).
1995-04-15 03:11:55 +00:00
Bill Paul
c98fda6ec8 Better conformance to SunOS behavior: if we can't match a user to one
of the plus or minus lists at all, reject him. This lets you create
a +@netgroup list of users that you want to admit and reject everybody
else. If you end your +@netgroup list with the wildcard line
(+:::::::::) then you'll have a +@netgroup list that remaps the
specified people but leaves people not in any netgroup unaffected.
1995-04-14 14:56:28 +00:00
Garrett Wollman
3688be0eeb Add err_set_file() and err_set_exit() functions to make it possible for
programs which use err(3) to work nicely in a wider range of environments
(e.g., dialog).
1995-04-13 18:04:11 +00:00
Andrey A. Chernov
929fb7fedd Add missing header reference 1995-04-09 04:59:40 +00:00
Joerg Wunsch
d108492508 The man page setmode(3) declares `void setmode' when it should be
declared `void *setmode'.

Submitted by:	kargl@troutmask.apl.washington.edu
1995-04-05 22:56:45 +00:00
Bill Paul
958f4e365d getpwent.c: fix problem with emacs dumping core when NIS is enabled. Also
add #includes for YP headers when compiling with -DYP to avoid some implicit
declarations.

getgrent.c & getnetgrent.c: add some #includes to avoid implicit declarations
of YP functions.
1995-04-04 05:36:16 +00:00
Andrey A. Chernov
3437da9391 Clear IGNPAR in cfmakeraw() instead of set it. 1995-03-29 19:28:35 +00:00
Bill Paul
b38bb6d374 Use yp_order() instead of yp_first() in _havemaster() to check for the
presence of the master.passwd.byname map, and remember to free the
returned order value before exiting.
1995-03-27 20:46:40 +00:00
Poul-Henning Kamp
e169c6670b scandir(3) didn't transfer d_type, and d_ino is called d_fileno now. 1995-03-25 07:39:02 +00:00
Bill Paul
f05daed916 Add calls to endgrent() and endnetgrent() to the end of _createcaches(). 1995-03-25 00:30:35 +00:00
Bill Paul
0ffe27f544 Make sanity checks saner: don't let setnetgrent() or innetgr() swallow
any bogus arguments.
1995-03-24 20:42:28 +00:00
Andrey A. Chernov
bee5b8efe8 Change strtok() to strsep(), using strtok() can cause memory corruption
if user program use it too in the same time.
1995-03-24 16:33:44 +00:00
Bill Paul
828447008a Yikes! Fix stupid mistake I made in last commit that made getpwent() ignore
local password entries when YP was enabled. (How the heck did that
get by me!?)
1995-03-24 08:01:01 +00:00
Bill Paul
d34ef3d62b As per Justin T. Gibbs's request, agument the +@netgroup/-@netgroup
remapping mechanism in the following manner: if given an entry +@foo
and there is no netgroup named 'foo,' try searching for a regular
user group called 'foo' and build the cache using the members of
group 'foo' instead. If both a netgroup 'foo' and a user group 'foo'
exist, the 'foo' netgroup takes precedence, since we're primarily
interested in netgroup matching anyway.

This allows access control schemes based on ordinary user groups
(which are also available via NIS) rather than netgroups, since
netgroups on some systems are limited in really brain-damaged ways.
1995-03-24 05:46:47 +00:00
Bill Paul
62a771700f Don't let setnetgrent() operate on a null or empty group name: it can
tickle a bug in ypserv and make a serious mess of things.
1995-03-23 22:21:16 +00:00
Bill Paul
353fefe325 Very important sanity checks: today I clobbered all four NIS servers on
my network because setnetgrent() was trying to do a lookup on group "".
It seems that an attempt to do a yp_match() (and possible yp_next())
on a null or empty key causes Sun's ypserv in SunOS 4.1.3 to exit
suddenly (and without warning). Our ypserv behaves badly in this
situation too, thoush it doesn't appear to crash. In any event, getpwent,
getnetgrent and yp_match() and yp_next() are now extra careful not to
accidentally pass on null or empty arguments.

Also made a small change to getpwent.c to allow +::::::::: wildcarding,
which I had disabled previously.
1995-03-23 22:18:00 +00:00
Bill Paul
5f115c9d15 Lots of fixes/improvements in the +user substitution handling:
- Have the +@netgroup/-@netgroup caches handle the +user/-user cases too.
- Clean up getpwent() to take advantage of the improved +user/-user handling.
1995-03-23 17:33:19 +00:00
Bill Paul
89395683ea Small cleanups:
- Prepend a '_' to a couple of things
- Make sure YP is enabled in _createcaches()
- Remove a couple of unused/uneeded variables from _createcaches()
1995-03-23 04:04:01 +00:00
Bill Paul
9531ca9353 Phew! Done at last: getpwent now understands +@netgroup/-@netgroup directives
in addition to the existing NIS substitutions. I may tweak this a bit in
the future, but the important stuff is all here.
1995-03-23 00:59:15 +00:00
Bill Paul
8516cd0fa5 Use better/stronger/faster NIS lookup code: by using yp_match() instead of
the yp_first()/yp_next() combo, we let the database code in ypserv do some
of the work for us.
1995-03-21 19:47:12 +00:00
Bill Paul
e80307946b Whoops: expanding netgroups that reference multiple netgroups doesn't
work because parse_netgrp() doesn't recurse properly. Fixed by
changing

if (parse_netgrp(spos))
	return(1);
to

if (parse_netgrp(spos))
	continue;

inside parse_netgrp(). (Lucky for me I happen to have a fairly complex
'live' netgroup database to test this stuff with.)
1995-03-19 22:19:52 +00:00
Bill Paul
409495f6c7 Two major changes:
- Added support for reading netgroups from NIS/YP in addition to the
local /etc/netgroups file. (Note that SunOS and many other systems only
support reading netgroups via NIS, which is a bit odd.)

- Fix Evil Null Pointer Dereferences From Hell (tm) that caused
parse_netgrp() to SEGV when expanding netgroups that include
references to other netgroups. Funny how nobody else noticed this.

This is the first step in implimenting +@netgroup substitution in
getpwent.c and any other places that could use it and don't already
support it (which is probably everywhere).
1995-03-19 06:16:03 +00:00
Bill Paul
89047c9c7c Fix 'putting +: in /etc/group causes many programs to dump core' bug
by heading off possible null pointer dereferences in grscan(). Also
change getgrnam() slightly to properly handle the change: if grscan()
returns an rval of 1 and leaves a '+' in the gr_name field and YP is
enabled, poll the YP group.byname map before giving up. This should
insure that we make every effort to find a match in the local and
YP group databases before bailing out.
1995-03-18 05:03:10 +00:00