/var/yp/Makefile puts expired passwords in passwd map when
MERGE_PASSWD=true. Expired passwords should probably end up with an 'x'
instead so users are denied on machines without shadow capability.

tag 113082 - pending
tag 113082 + patch
thanks

This patch provides something like the requested functionality as an
optional extra but I'd rather not merge it without it being acked by
upstream since it's rather visible in the user interface.  Record the
patch in the BTS for now until upstream comes to a decision.

diff -rNu ypserv-2.13.orig/scripts/ypMakefile.in ypserv-2.13/scripts/ypMakefile.in
--- ypserv-2.13.orig/scripts/ypMakefile.in	2004-04-14 13:08:25.000000000 +0100
+++ ypserv-2.13/scripts/ypMakefile.in	2004-04-24 14:35:30.000000000 +0100
@@ -36,6 +36,11 @@
 # MERGE_PASSWD=true|false
 MERGE_PASSWD=true

+# When merging the passwd file with the shadow file should we include expired
+# passwords ?
+# EXPIRE_PASSWD=true|false
+EXPIRE_PASSWD=false
+
 # Should we merge the group file with the gshadow file ?
 # MERGE_GROUP=true|false
 MERGE_GROUP=true
@@ -282,10 +287,17 @@


 ifeq (x$(MERGE_PASSWD),xtrue)
+
+ifeq (x$(EXPIRE_PASSWD),xtrue)
+PASSWD_MERGE_TYPE=-P
+else
+PASSWD_MERGE_TYPE=-p
+endif
+
 passwd.byname: $(PASSWD) $(SHADOW) $(YPDIR)/Makefile
 	@echo "Updating $@..."
 	@$(UMASK); \
-	$(MERGER) -p $(PASSWD) $(SHADOW) | \
+	$(MERGER) $(PASSWD_MERGE_TYPE) $(PASSWD) $(SHADOW) | \
 	   $(AWK) -F: '!/^[-+#]/ { if ($$1 != "" && $$3 >= $(MINUID) ) \
 	   print $$1"\t"$$0 }' | $(DBLOAD) -i $(PASSWD) \
 		-o $(YPMAPDIR)/$@ - $@
@@ -294,7 +306,7 @@
 passwd.byuid: $(PASSWD) $(SHADOW) $(YPDIR)/Makefile
 	@echo "Updating $@..."
 	@$(UMASK); \
-	$(MERGER) -p $(PASSWD) $(SHADOW) | \
+	$(MERGER) $(PASSWD_MERGE_TYPE) $(PASSWD) $(SHADOW) | \
 	   $(AWK) -F: '!/^[-+#]/ { if ($$1 != "" && $$3 >= $(MINUID) ) \
 	   print $$3"\t"$$0 }' | $(DBLOAD) -i $(PASSWD) \
 		 -o $(YPMAPDIR)/$@ - $@
diff -rNu ypserv-2.13.orig/yphelper/yphelper.c ypserv-2.13/yphelper/yphelper.c
--- ypserv-2.13.orig/yphelper/yphelper.c	2003-06-13 13:09:19.000000000 +0100
+++ ypserv-2.13/yphelper/yphelper.c	2004-04-24 14:26:41.000000000 +0100
@@ -276,8 +276,30 @@
   exit (0);
 }

+#ifdef HAVE_GETSPNAM /* shadow password */
+static char *
+getspwd(struct spwd *spd, int do_expiry)
+{
+  int curday = time(NULL) / (60 * 60 * 24);
+
+  if (!do_expiry)
+    return spd->sp_pwdp;
+
+  if ((spd->sp_lstchg != 0 && spd->sp_max != -1 &&
+       spd->sp_inact != -1)
+      && curday > (spd->sp_lstchg + spd->sp_max +
+		   spd->sp_inact))
+    return "x";
+
+  if (spd->sp_expire != -1 && curday > spd->sp_expire)
+    return "x";
+
+  return spd->sp_pwdp;
+}
+#endif
+
 static void
-merge_passwd (char *passwd, char *shadow)
+merge_passwd (char *passwd, char *shadow, int do_expiry)
 {
   FILE *p_input, *s_input;
   struct passwd *pwd;
@@ -324,7 +346,9 @@
 	  if (spd != NULL)
 	    {
 	      if (strcmp (pwd->pw_name, spd->sp_namp) == 0)
-		pass = spd->sp_pwdp;
+		{
+		  pass = getspwd(spd, do_expiry);
+		}
 	    }
 	  if (pass == NULL)
 	    {
@@ -333,7 +357,7 @@
 		{
 		  if (strcmp (pwd->pw_name, spd->sp_namp) == 0)
 		    {
-		      pass = spd->sp_pwdp;
+		      pass = getspwd(spd, do_expiry);
 		      break;
 		    }
 		}
@@ -604,6 +628,7 @@
   char *map = NULL;
   int merge_pwd = 0;
   int merge_grp = 0;
+  int do_expiry = 0;

   while (1)
     {
@@ -616,6 +641,9 @@
 	  {"maps", required_argument, NULL, 'm'},
 	  {"merge_passwd", no_argument, NULL, 'p'},
 	  {"merge-passwd", no_argument, NULL, 'p'},
+	  {"merge_passwd", no_argument, NULL, 'p'},
+	  {"merge-passwd-expiry", no_argument, NULL, 'P'},
+	  {"merge_passwd_expiry", no_argument, NULL, 'P'},
 	  {"merge_group", no_argument, NULL, 'g'},
 	  {"merge-group", no_argument, NULL, 'g'},
 	  {"domainname", required_argument, NULL, 'd'},
@@ -624,7 +652,7 @@
 	  {NULL, 0, NULL, '\0'}
 	};

-      c = getopt_long (argc, argv, "d:hvm:pgi:", long_options, &option_index);
+      c = getopt_long (argc, argv, "d:hvm:pPgi:", long_options, &option_index);
       if (c == EOF)
         break;
       switch (c)
@@ -641,6 +669,10 @@
 	case 'p':
 	  merge_pwd = 1;
 	  break;
+	case 'P':
+	  merge_pwd = 1;
+	  do_expiry = 1;
+	  break;
 	case 'g':
 	  merge_grp = 1;
 	  break;
@@ -671,7 +703,7 @@
     print_maps (master, domainname);

   if (merge_pwd && argc == 2)
-    merge_passwd (argv[0], argv[1]);
+    merge_passwd (argv[0], argv[1], do_expiry);

   if (merge_grp && argc == 2)
     merge_group (argv[0], argv[1]);