#!/usr/bin/perl
#
# $Id: migrate_passwd.pl,v 1.11 2001/08/13 08:54:26 lukeh Exp $
#
# Copyright (c) 1997 Luke Howard.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
# 3. All advertising materials mentioning features or use of this software
#    must display the following acknowledgement:
#        This product includes software developed by Luke Howard.
# 4. The name of the other may not be used to endorse or promote products
#    derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE LUKE HOWARD ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED.  IN NO EVENT SHALL LUKE HOWARD BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
#
# Password migration tool. Migrates /etc/shadow as well, if it exists.
#
# Thanks to Peter Jacob Slot <peter@vision.auk.dk>.
#
# UTF8 support and random tweaks by Jonas Smedegaard <dr@jones.dk>.

require 'migrate_common.ph';

$PROGRAM = "migrate_passwd.pl";
$NAMINGCONTEXT = &getsuffix($PROGRAM);

&parse_args();
&read_shadow_file();
&open_files();

while(<INFILE>)
{
	chop;
	next if /^#/;
	next if /^\+/;

	local($user, $pwd, $uid, $gid, $gecos, $homedir, $shell) = split(/:/);

	next if (int($IGNORE_UID_BELOW) and int($uid) < int($IGNORE_UID_BELOW));
	next if (int($IGNORE_UID_ABOVE) and int($uid) > int($IGNORE_UID_ABOVE));
	next if (int($IGNORE_GID_BELOW) and int($uid) < int($IGNORE_GID_BELOW));
	next if (int($IGNORE_GID_ABOVE) and int($uid) > int($IGNORE_GID_ABOVE));

		if ($USE_UTF8) {
	}

	if ($use_stdout) {
		&dump_user(STDOUT, $user, $pwd, $uid, $gid, $gecos, $homedir, $shell);
	} else {
		&dump_user(OUTFILE, $user, $pwd, $uid, $gid, $gecos, $homedir, $shell);
	}
}

sub dump_user
{
	local($HANDLE, $user, $pwd, $uid, $gid, $gecos, $homedir, $shell) = @_;
	local($name,$office,$wphone,$hphone)=split(/,/,$gecos);
	local($sn);	
	local($givenname);	
	local($cn);
	local(@tmp);

	if ($name) { $cn = $name; } else { $cn = $user; }

	$_ = $cn;
	@tmp = split(/\s+/);
	$sn = $tmp[$#tmp];
	pop(@tmp);
	$givenname=join(' ',@tmp);

	print $HANDLE "dn: uid=$user,$NAMINGCONTEXT\n";
	print $HANDLE "uid: $user\n";
	&print_utf8($HANDLE, "cn", $cn);

	if ($EXTENDED_SCHEMA) {
		if ($wphone) {
			&print_utf8($HANDLE, "telephonenumber", $wphone);
		}
		if ($office) {
			&print_utf8($HANDLE, "roomnumber", $office);
		}
		if ($hphone) {
			&print_utf8($HANDLE, "homephone", $hphone);
		}
		if ($givenname) {
			&print_utf8($HANDLE, "givenname", $givenname);
		}
		&print_utf8($HANDLE, "sn", $sn);
		if ($DEFAULT_MAIL_DOMAIN) {
			print $HANDLE "mail: $user\@$DEFAULT_MAIL_DOMAIN\n";
		}
		if ($DEFAULT_MAIL_HOST) {
			print $HANDLE "mailRoutingAddress: $user\@$DEFAULT_MAIL_HOST\n";
			print $HANDLE "mailHost: $DEFAULT_MAIL_HOST\n";
			print $HANDLE "objectClass: mailRecipient\n";
		}
		print $HANDLE "objectClass: person\n";
		print $HANDLE "objectClass: organizationalPerson\n";
		print $HANDLE "objectClass: inetOrgPerson\n";
	}

	print $HANDLE "objectClass: account\n";
	print $HANDLE "objectClass: posixAccount\n";
	print $HANDLE "objectClass: top\n";

	if ($DEFAULT_REALM) {
		print $HANDLE "objectClass: kerberosSecurityObject\n";
	}

	if ($shadowUsers{$user} ne "") {
		&dump_shadow_attributes($HANDLE, split(/:/, $shadowUsers{$user}));
	} else {
		print $HANDLE "userPassword: {crypt}$pwd\n";
	}

	if ($DEFAULT_REALM) {
		print $HANDLE "krbname: $user\@$DEFAULT_REALM\n";
	}

	if ($shell) {
		print $HANDLE "loginShell: $shell\n";
	}

	if ($uid ne "") {
		print $HANDLE "uidNumber: $uid\n";
	} else {
		print $HANDLE "uidNumber:\n";
	}

	if ($gid ne "") {
		print $HANDLE "gidNumber: $gid\n";
	} else {
		print $HANDLE "gidNumber:\n";
	}

	if ($homedir) {
		print $HANDLE "homeDirectory: $homedir\n";
	} else {
		print $HANDLE "homeDirectory:\n";
	}

	if ($gecos) {
# FIXME: Why does UTF8 encoding fail here? Too long? Restriction in nis schema?
#		&print_utf8($HANDLE, "gecos", $gecos);
		&print_7bit($HANDLE, "gecos", $gecos);
	}

	print $HANDLE "\n";
}

close(INFILE);
if (OUTFILE != STDOUT) { close(OUTFILE); }

sub read_shadow_file
{
	open(SHADOW, "/etc/shadow") || return;
	while(<SHADOW>) {
		chop;
		($shadowUser) = split(/:/, $_);
		$shadowUsers{$shadowUser} = $_;
	}
	close(SHADOW);
}

sub dump_shadow_attributes
{
	local($HANDLE, $user, $pwd, $lastchg, $min, $max, $warn, $inactive, $expire, $flag) = @_;

	print $HANDLE "objectClass: shadowAccount\n";
	if ($pwd) {
		print $HANDLE "userPassword: {crypt}$pwd\n";
	}
	if ($lastchg) {
		print $HANDLE "shadowLastChange: $lastchg\n";
	}
	if ($min) {
		print $HANDLE "shadowMin: $min\n";
	}
	if ($max) {
		print $HANDLE "shadowMax: $max\n";
	}
	if ($warn) {
		print $HANDLE "shadowWarning: $warn\n";
	}
	if ($inactive) {
		print $HANDLE "shadowInactive: $inactive\n";
	}
	if ($expire) {
		print $HANDLE "shadowExpire: $expire\n";
	}
	if ($flag) {
		print $HANDLE "shadowFlag: $flag\n";
	}
}

sub print_7bit
{
	local($HANDLE, $attribute, $content) = @_;

	for($content) {
		s//Ae/g;
		s//Ee/g;
		s//Ie/g;
		s//Oe/g;
		s//Ue/g;

		s//ae/g;
		s//ee/g;
		s//ie/g;
		s//oe/g;
		s//ue/g;
		s//ye/g;

		s//Ae/g;
		s//ae/g;
		s//Oe/g;
		s//oe/g;
		s//Aa/g;
		s//aa/g;
	}

	print $HANDLE "$attribute: $content\n";
}

sub print_utf8
{
# Regexp found on perl-unicode mailinglist in an email posted by
# Jarkko Hietaniemi <jhi@iki.fi>

	local($HANDLE, $attribute, $content) = @_;

	if ($USE_UTF8) {
#		print $HANDLE "$attribute\:: " . &encode_base64(pack("U0U*", unpack("C*", $content)), "") . "\n";
		for($content) {
			s/([\x80-\xFF])/chr(0xC0|ord($1)>>6).chr(0x80|ord($1)&0x3F)/eg;
		}
		print $HANDLE "$attribute\::" . &encode_base64($content, "") . "\n";
	} else {
		&print_7bit($HANDLE, "$attribute", "$content");
	}
}

sub encode_base64 ($;$)
# Found on openldap mailinglist in an email posted by
# Baruzzi Giovanni <giovanni.baruzzi@allianz-leben.de>

# Historically this module has been implemented as pure perl code.
# The XS implementation runs about 20 times faster, but the Perl
# code might be more portable, so it is still here.
{
	my $res = "";
	my $eol = $_[1];
	$eol = "\n" unless defined $eol;
	pos($_[0]) = 0; # ensure start at the beginning
	while ($_[0] =~ /(.{1,45})/gs) {
		$res .= substr(pack('u', $1), 1);
		chop($res);
	}
	$res =~ tr|` -_|AA-Za-z0-9+/|;               # `# help emacs
	# fix padding at the end
	my $padding = (3 - length($_[0]) % 3) % 3;
	$res =~ s/.{$padding}$/'=' x $padding/e if $padding;
	# break encoded string into lines of no more than 76 characters each
	if (length $eol) {
		$res =~ s/(.{1,76})/$1$eol/g;
	}
	$res;
}