3d7123c18ebbfc35e319135c7ee38422221610c3
[kai/samba.git] / source3 / auth / user_util.c
1 /*
2    Unix SMB/CIFS implementation.
3    Username handling
4    Copyright (C) Andrew Tridgell 1992-1998
5    Copyright (C) Jeremy Allison 1997-2001.
6    Copyright (C) Volker Lendecke 2006
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23
24 /*******************************************************************
25  Map a username from a dos name to a unix name by looking in the username
26  map. Note that this modifies the name in place.
27  This is the main function that should be called *once* on
28  any incoming or new username - in order to canonicalize the name.
29  This is being done to de-couple the case conversions from the user mapping
30  function. Previously, the map_username was being called
31  every time Get_Pwnam_alloc was called.
32  Returns True if username was changed, false otherwise.
33 ********************************************************************/
34
35 static char *last_from = NULL;
36 static char *last_to = NULL;
37
38 static const char *get_last_from(void)
39 {
40         if (!last_from) {
41                 return "";
42         }
43         return last_from;
44 }
45
46 static const char *get_last_to(void)
47 {
48         if (!last_to) {
49                 return "";
50         }
51         return last_to;
52 }
53
54 static bool set_last_from_to(const char *from, const char *to)
55 {
56         char *orig_from = last_from;
57         char *orig_to = last_to;
58
59         last_from = SMB_STRDUP(from);
60         last_to = SMB_STRDUP(to);
61
62         SAFE_FREE(orig_from);
63         SAFE_FREE(orig_to);
64
65         if (!last_from || !last_to) {
66                 SAFE_FREE(last_from);
67                 SAFE_FREE(last_to);
68                 return false;
69         }
70         return true;
71 }
72
73 static char *skip_space(char *s)
74 {
75         while (isspace((int)(*s))) {
76                 s += 1;
77         }
78         return s;
79 }
80
81 static bool fetch_map_from_gencache(fstring user)
82 {
83         char *key, *value;
84         bool found;
85
86         if (lp_username_map_cache_time() == 0) {
87                 return false;
88         }
89
90         key = talloc_asprintf_strupper_m(talloc_tos(), "USERNAME_MAP/%s",
91                                          user);
92         if (key == NULL) {
93                 return false;
94         }
95         found = gencache_get(key, &value, NULL);
96         TALLOC_FREE(key);
97         if (!found) {
98                 return false;
99         }
100         fstrcpy(user, value);
101         SAFE_FREE(value);
102         return true;
103 }
104
105 static void store_map_in_gencache(const char *from, const char *to)
106 {
107         char *key;
108         int cache_time = lp_username_map_cache_time();
109
110         if (cache_time == 0) {
111                 return;
112         }
113
114         key = talloc_asprintf_strupper_m(talloc_tos(), "USERNAME_MAP/%s",
115                                          from);
116         if (key == NULL) {
117                 return;
118         }
119         gencache_set(key, to, cache_time + time(NULL));
120         TALLOC_FREE(key);
121 }
122
123 /****************************************************************************
124  Check if a user is in a netgroup user list. If at first we don't succeed,
125  try lower case.
126 ****************************************************************************/
127
128 bool user_in_netgroup(const char *user, const char *ngname)
129 {
130 #ifdef HAVE_NETGROUP
131         static char *my_yp_domain = NULL;
132         fstring lowercase_user;
133
134         if (my_yp_domain == NULL) {
135                 yp_get_default_domain(&my_yp_domain);
136         }
137
138         if (my_yp_domain == NULL) {
139                 DEBUG(5,("Unable to get default yp domain, "
140                         "let's try without specifying it\n"));
141         }
142
143         DEBUG(5,("looking for user %s of domain %s in netgroup %s\n",
144                 user, my_yp_domain?my_yp_domain:"(ANY)", ngname));
145
146         if (innetgr(ngname, NULL, user, my_yp_domain)) {
147                 DEBUG(5,("user_in_netgroup: Found\n"));
148                 return true;
149         }
150
151         /*
152          * Ok, innetgr is case sensitive. Try once more with lowercase
153          * just in case. Attempt to fix #703. JRA.
154          */
155         fstrcpy(lowercase_user, user);
156         strlower_m(lowercase_user);
157
158         if (strcmp(user,lowercase_user) == 0) {
159                 /* user name was already lower case! */
160                 return false;
161         }
162
163         DEBUG(5,("looking for user %s of domain %s in netgroup %s\n",
164                 lowercase_user, my_yp_domain?my_yp_domain:"(ANY)", ngname));
165
166         if (innetgr(ngname, NULL, lowercase_user, my_yp_domain)) {
167                 DEBUG(5,("user_in_netgroup: Found\n"));
168                 return true;
169         }
170 #endif /* HAVE_NETGROUP */
171         return false;
172 }
173
174 /****************************************************************************
175  Check if a user is in a user list - can check combinations of UNIX
176  and netgroup lists.
177 ****************************************************************************/
178
179 bool user_in_list(const char *user,const char **list)
180 {
181         if (!list || !*list)
182                 return False;
183
184         DEBUG(10,("user_in_list: checking user %s in list\n", user));
185
186         while (*list) {
187
188                 DEBUG(10,("user_in_list: checking user |%s| against |%s|\n",
189                           user, *list));
190
191                 /*
192                  * Check raw username.
193                  */
194                 if (strequal(user, *list))
195                         return(True);
196
197                 /*
198                  * Now check to see if any combination
199                  * of UNIX and netgroups has been specified.
200                  */
201
202                 if(**list == '@') {
203                         /*
204                          * Old behaviour. Check netgroup list
205                          * followed by UNIX list.
206                          */
207                         if(user_in_netgroup(user, *list +1))
208                                 return True;
209                         if(user_in_group(user, *list +1))
210                                 return True;
211                 } else if (**list == '+') {
212
213                         if((*(*list +1)) == '&') {
214                                 /*
215                                  * Search UNIX list followed by netgroup.
216                                  */
217                                 if(user_in_group(user, *list +2))
218                                         return True;
219                                 if(user_in_netgroup(user, *list +2))
220                                         return True;
221
222                         } else {
223
224                                 /*
225                                  * Just search UNIX list.
226                                  */
227
228                                 if(user_in_group(user, *list +1))
229                                         return True;
230                         }
231
232                 } else if (**list == '&') {
233
234                         if(*(*list +1) == '+') {
235                                 /*
236                                  * Search netgroup list followed by UNIX list.
237                                  */
238                                 if(user_in_netgroup(user, *list +2))
239                                         return True;
240                                 if(user_in_group(user, *list +2))
241                                         return True;
242                         } else {
243                                 /*
244                                  * Just search netgroup list.
245                                  */
246                                 if(user_in_netgroup(user, *list +1))
247                                         return True;
248                         }
249                 }
250
251                 list++;
252         }
253         return(False);
254 }
255
256 bool map_username(fstring user)
257 {
258         XFILE *f;
259         char *mapfile = lp_username_map();
260         char *s;
261         char buf[512];
262         bool mapped_user = False;
263         char *cmd = lp_username_map_script();
264
265         if (!*user)
266                 return false;
267
268         if (strequal(user,get_last_to()))
269                 return false;
270
271         if (strequal(user,get_last_from())) {
272                 DEBUG(3,("Mapped user %s to %s\n",user,get_last_to()));
273                 fstrcpy(user,get_last_to());
274                 return true;
275         }
276
277         if (fetch_map_from_gencache(user)) {
278                 return true;
279         }
280
281         /* first try the username map script */
282
283         if ( *cmd ) {
284                 char **qlines;
285                 char *command = NULL;
286                 int numlines, ret, fd;
287
288                 command = talloc_asprintf(talloc_tos(),
289                                         "%s \"%s\"",
290                                         cmd,
291                                         user);
292                 if (!command) {
293                         return false;
294                 }
295
296                 DEBUG(10,("Running [%s]\n", command));
297                 ret = smbrun(command, &fd);
298                 DEBUGADD(10,("returned [%d]\n", ret));
299
300                 TALLOC_FREE(command);
301
302                 if ( ret != 0 ) {
303                         if (fd != -1)
304                                 close(fd);
305                         return False;
306                 }
307
308                 numlines = 0;
309                 qlines = fd_lines_load(fd, &numlines, 0, talloc_tos());
310                 DEBUGADD(10,("Lines returned = [%d]\n", numlines));
311                 close(fd);
312
313                 /* should be either no lines or a single line with the mapped username */
314
315                 if (numlines && qlines) {
316                         DEBUG(3,("Mapped user %s to %s\n", user, qlines[0] ));
317                         set_last_from_to(user, qlines[0]);
318                         store_map_in_gencache(user, qlines[0]);
319                         fstrcpy( user, qlines[0] );
320                 }
321
322                 TALLOC_FREE(qlines);
323
324                 return numlines != 0;
325         }
326
327         /* ok.  let's try the mapfile */
328         if (!*mapfile)
329                 return False;
330
331         f = x_fopen(mapfile,O_RDONLY, 0);
332         if (!f) {
333                 DEBUG(0,("can't open username map %s. Error %s\n",mapfile, strerror(errno) ));
334                 return False;
335         }
336
337         DEBUG(4,("Scanning username map %s\n",mapfile));
338
339         while((s=fgets_slash(buf,sizeof(buf),f))!=NULL) {
340                 char *unixname = s;
341                 char *dosname = strchr_m(unixname,'=');
342                 char **dosuserlist;
343                 bool return_if_mapped = False;
344
345                 if (!dosname)
346                         continue;
347
348                 *dosname++ = 0;
349
350                 unixname = skip_space(unixname);
351
352                 if ('!' == *unixname) {
353                         return_if_mapped = True;
354                         unixname = skip_space(unixname+1);
355                 }
356
357                 if (!*unixname || strchr_m("#;",*unixname))
358                         continue;
359
360                 {
361                         int l = strlen(unixname);
362                         while (l && isspace((int)unixname[l-1])) {
363                                 unixname[l-1] = 0;
364                                 l--;
365                         }
366                 }
367
368                 /* skip lines like 'user = ' */
369
370                 dosuserlist = str_list_make_v3(talloc_tos(), dosname, NULL);
371                 if (!dosuserlist) {
372                         DEBUG(0,("Bad username map entry.  Unable to build user list.  Ignoring.\n"));
373                         continue;
374                 }
375
376                 if (strchr_m(dosname,'*') ||
377                     user_in_list(user, (const char **)dosuserlist)) {
378                         DEBUG(3,("Mapped user %s to %s\n",user,unixname));
379                         mapped_user = True;
380
381                         set_last_from_to(user, unixname);
382                         store_map_in_gencache(user, unixname);
383                         fstrcpy( user, unixname );
384
385                         if ( return_if_mapped ) {
386                                 TALLOC_FREE(dosuserlist);
387                                 x_fclose(f);
388                                 return True;
389                         }
390                 }
391
392                 TALLOC_FREE(dosuserlist);
393         }
394
395         x_fclose(f);
396
397         /*
398          * Setup the last_from and last_to as an optimization so
399          * that we don't scan the file again for the same user.
400          */
401
402         set_last_from_to(user, user);
403         store_map_in_gencache(user, user);
404
405         return mapped_user;
406 }