nis/nss_compat/compat-grp.c

   1 /* Copyright (C) 1996-2017 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1996.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <http://www.gnu.org/licenses/>.  */
  18
  19 #include <ctype.h>
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <grp.h>
  23 #include <nss.h>
  24 #include <nsswitch.h>
  25 #include <stdio_ext.h>
  26 #include <string.h>
  27 #include <rpc/types.h>
  28 #include <libc-lock.h>
  29 #include <kernel-features.h>
  30
  31 static service_user *ni;
  32 static enum nss_status (*nss_setgrent) (int stayopen);
  33 static enum nss_status (*nss_getgrnam_r) (const char *name,
  34                                           struct group * grp, char *buffer,
  35                                           size_t buflen, int *errnop);
  36 static enum nss_status (*nss_getgrgid_r) (gid_t gid, struct group * grp,
  37                                           char *buffer, size_t buflen,
  38                                           int *errnop);
  39 static enum nss_status (*nss_getgrent_r) (struct group * grp, char *buffer,
  40                                           size_t buflen, int *errnop);
  41 static enum nss_status (*nss_endgrent) (void);
  42
  43 /* Get the declaration of the parser function.  */
  44 #define ENTNAME grent
  45 #define STRUCTURE group
  46 #define EXTERN_PARSER
  47 #include <nss/nss_files/files-parse.c>
  48
  49 /* Structure for remembering -group members ... */
  50 #define BLACKLIST_INITIAL_SIZE 512
  51 #define BLACKLIST_INCREMENT 256
  52 struct blacklist_t
  53 {
  54   char *data;
  55   int current;
  56   int size;
  57 };
  58
  59 struct ent_t
  60 {
  61   bool_t files;
  62   enum nss_status setent_status;
  63   FILE *stream;
  64   struct blacklist_t blacklist;
  65 };
  66 typedef struct ent_t ent_t;
  67
  68 static ent_t ext_ent = { TRUE, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0 }};
  69
  70 /* Protect global state against multiple changers.  */
  71 __libc_lock_define_initialized (static, lock)
  72
  73 /* Prototypes for local functions.  */
  74 static void blacklist_store_name (const char *, ent_t *);
  75 static int in_blacklist (const char *, int, ent_t *);
  76
  77 /* Initialize the NSS interface/functions. The calling function must
  78    hold the lock.  */
  79 static void
  80 init_nss_interface (void)
  81 {
  82   if (__nss_database_lookup ("group_compat", NULL, "nis", &ni) >= 0)
  83     {
  84       nss_setgrent = __nss_lookup_function (ni, "setgrent");
  85       nss_getgrnam_r = __nss_lookup_function (ni, "getgrnam_r");
  86       nss_getgrgid_r = __nss_lookup_function (ni, "getgrgid_r");
  87       nss_getgrent_r = __nss_lookup_function (ni, "getgrent_r");
  88       nss_endgrent = __nss_lookup_function (ni, "endgrent");
  89     }
  90 }
  91
  92 static enum nss_status
  93 internal_setgrent (ent_t *ent, int stayopen, int needent)
  94 {
  95   enum nss_status status = NSS_STATUS_SUCCESS;
  96
  97   ent->files = TRUE;
  98
  99   if (ent->blacklist.data != NULL)
 100     {
 101       ent->blacklist.current = 1;
 102       ent->blacklist.data[0] = '|';
 103       ent->blacklist.data[1] = '\0';
 104     }
 105   else
 106     ent->blacklist.current = 0;
 107
 108   if (ent->stream == NULL)
 109     {
 110       ent->stream = fopen ("/etc/group", "rme");
 111
 112       if (ent->stream == NULL)
 113         status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
 114       else
 115         /* We take care of locking ourself.  */
 116         __fsetlocking (ent->stream, FSETLOCKING_BYCALLER);
 117     }
 118   else
 119     rewind (ent->stream);
 120
 121   if (needent && status == NSS_STATUS_SUCCESS && nss_setgrent)
 122     ent->setent_status = nss_setgrent (stayopen);
 123
 124   return status;
 125 }
 126
 127
 128 enum nss_status
 129 _nss_compat_setgrent (int stayopen)
 130 {
 131   enum nss_status result;
 132
 133   __libc_lock_lock (lock);
 134
 135   if (ni == NULL)
 136     init_nss_interface ();
 137
 138   result = internal_setgrent (&ext_ent, stayopen, 1);
 139
 140   __libc_lock_unlock (lock);
 141
 142   return result;
 143 }
 144
 145
 146 static enum nss_status
 147 internal_endgrent (ent_t *ent)
 148 {
 149   if (ent->stream != NULL)
 150     {
 151       fclose (ent->stream);
 152       ent->stream = NULL;
 153     }
 154
 155   if (ent->blacklist.data != NULL)
 156     {
 157       ent->blacklist.current = 1;
 158       ent->blacklist.data[0] = '|';
 159       ent->blacklist.data[1] = '\0';
 160     }
 161   else
 162     ent->blacklist.current = 0;
 163
 164   return NSS_STATUS_SUCCESS;
 165 }
 166
 167 enum nss_status
 168 _nss_compat_endgrent (void)
 169 {
 170   enum nss_status result;
 171
 172   __libc_lock_lock (lock);
 173
 174   if (nss_endgrent)
 175     nss_endgrent ();
 176
 177   result = internal_endgrent (&ext_ent);
 178
 179   __libc_lock_unlock (lock);
 180
 181   return result;
 182 }
 183
 184 /* get the next group from NSS  (+ entry) */
 185 static enum nss_status
 186 getgrent_next_nss (struct group *result, ent_t *ent, char *buffer,
 187                    size_t buflen, int *errnop)
 188 {
 189   if (!nss_getgrent_r)
 190     return NSS_STATUS_UNAVAIL;
 191
 192   /* If the setgrent call failed, say so.  */
 193   if (ent->setent_status != NSS_STATUS_SUCCESS)
 194     return ent->setent_status;
 195
 196   do
 197     {
 198       enum nss_status status;
 199
 200       if ((status = nss_getgrent_r (result, buffer, buflen, errnop)) !=
 201           NSS_STATUS_SUCCESS)
 202         return status;
 203     }
 204   while (in_blacklist (result->gr_name, strlen (result->gr_name), ent));
 205
 206   return NSS_STATUS_SUCCESS;
 207 }
 208
 209 /* This function handle the +group entrys in /etc/group */
 210 static enum nss_status
 211 getgrnam_plusgroup (const char *name, struct group *result, ent_t *ent,
 212                     char *buffer, size_t buflen, int *errnop)
 213 {
 214   if (!nss_getgrnam_r)
 215     return NSS_STATUS_UNAVAIL;
 216
 217   enum nss_status status = nss_getgrnam_r (name, result, buffer, buflen,
 218                                            errnop);
 219   if (status != NSS_STATUS_SUCCESS)
 220     return status;
 221
 222   if (in_blacklist (result->gr_name, strlen (result->gr_name), ent))
 223     return NSS_STATUS_NOTFOUND;
 224
 225   /* We found the entry.  */
 226   return NSS_STATUS_SUCCESS;
 227 }
 228
 229 static enum nss_status
 230 getgrent_next_file (struct group *result, ent_t *ent,
 231                     char *buffer, size_t buflen, int *errnop)
 232 {
 233   struct parser_data *data = (void *) buffer;
 234   while (1)
 235     {
 236       fpos_t pos;
 237       int parse_res = 0;
 238       char *p;
 239
 240       do
 241         {
 242           /* We need at least 3 characters for one line.  */
 243           if (__glibc_unlikely (buflen < 3))
 244             {
 245             erange:
 246               *errnop = ERANGE;
 247               return NSS_STATUS_TRYAGAIN;
 248             }
 249
 250           fgetpos (ent->stream, &pos);
 251           buffer[buflen - 1] = '\xff';
 252           p = fgets_unlocked (buffer, buflen, ent->stream);
 253           if (p == NULL && feof_unlocked (ent->stream))
 254             return NSS_STATUS_NOTFOUND;
 255
 256           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 257             {
 258             erange_reset:
 259               fsetpos (ent->stream, &pos);
 260               goto erange;
 261             }
 262
 263           /* Terminate the line for any case.  */
 264           buffer[buflen - 1] = '\0';
 265
 266           /* Skip leading blanks.  */
 267           while (isspace (*p))
 268             ++p;
 269         }
 270       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines. */
 271              /* Parse the line.  If it is invalid, loop to
 272                 get the next line of the file to parse.  */
 273              !(parse_res = _nss_files_parse_grent (p, result, data, buflen,
 274                                                    errnop)));
 275
 276       if (__glibc_unlikely (parse_res == -1))
 277         /* The parser ran out of space.  */
 278         goto erange_reset;
 279
 280       if (result->gr_name[0] != '+' && result->gr_name[0] != '-')
 281         /* This is a real entry.  */
 282         break;
 283
 284       /* -group */
 285       if (result->gr_name[0] == '-' && result->gr_name[1] != '\0'
 286           && result->gr_name[1] != '@')
 287         {
 288           blacklist_store_name (&result->gr_name[1], ent);
 289           continue;
 290         }
 291
 292       /* +group */
 293       if (result->gr_name[0] == '+' && result->gr_name[1] != '\0'
 294           && result->gr_name[1] != '@')
 295         {
 296           size_t len = strlen (result->gr_name);
 297           char buf[len];
 298           enum nss_status status;
 299
 300           /* Store the group in the blacklist for the "+" at the end of
 301              /etc/group */
 302           memcpy (buf, &result->gr_name[1], len);
 303           status = getgrnam_plusgroup (&result->gr_name[1], result, ent,
 304                                        buffer, buflen, errnop);
 305           blacklist_store_name (buf, ent);
 306           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
 307             break;
 308           else if (status == NSS_STATUS_RETURN /* We couldn't parse the entry*/
 309                    || status == NSS_STATUS_NOTFOUND)    /* No group in NIS */
 310             continue;
 311           else
 312             {
 313               if (status == NSS_STATUS_TRYAGAIN)
 314                 /* The parser ran out of space.  */
 315                 goto erange_reset;
 316
 317               return status;
 318             }
 319         }
 320
 321       /* +:... */
 322       if (result->gr_name[0] == '+' && result->gr_name[1] == '\0')
 323         {
 324           ent->files = FALSE;
 325
 326           return getgrent_next_nss (result, ent, buffer, buflen, errnop);
 327         }
 328     }
 329
 330   return NSS_STATUS_SUCCESS;
 331 }
 332
 333
 334 enum nss_status
 335 _nss_compat_getgrent_r (struct group *grp, char *buffer, size_t buflen,
 336                         int *errnop)
 337 {
 338   enum nss_status result = NSS_STATUS_SUCCESS;
 339
 340   __libc_lock_lock (lock);
 341
 342   /* Be prepared that the setgrent function was not called before.  */
 343   if (ni == NULL)
 344     init_nss_interface ();
 345
 346   if (ext_ent.stream == NULL)
 347     result = internal_setgrent (&ext_ent, 1, 1);
 348
 349   if (result == NSS_STATUS_SUCCESS)
 350     {
 351       if (ext_ent.files)
 352         result = getgrent_next_file (grp, &ext_ent, buffer, buflen, errnop);
 353       else
 354         result = getgrent_next_nss (grp, &ext_ent, buffer, buflen, errnop);
 355     }
 356   __libc_lock_unlock (lock);
 357
 358   return result;
 359 }
 360
 361 /* Searches in /etc/group and the NIS/NIS+ map for a special group */
 362 static enum nss_status
 363 internal_getgrnam_r (const char *name, struct group *result, ent_t *ent,
 364                      char *buffer, size_t buflen, int *errnop)
 365 {
 366   struct parser_data *data = (void *) buffer;
 367   while (1)
 368     {
 369       fpos_t pos;
 370       int parse_res = 0;
 371       char *p;
 372
 373       do
 374         {
 375           /* We need at least 3 characters for one line.  */
 376           if (__glibc_unlikely (buflen < 3))
 377             {
 378             erange:
 379               *errnop = ERANGE;
 380               return NSS_STATUS_TRYAGAIN;
 381             }
 382
 383           fgetpos (ent->stream, &pos);
 384           buffer[buflen - 1] = '\xff';
 385           p = fgets_unlocked (buffer, buflen, ent->stream);
 386           if (p == NULL && feof_unlocked (ent->stream))
 387             return NSS_STATUS_NOTFOUND;
 388
 389           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 390             {
 391             erange_reset:
 392               fsetpos (ent->stream, &pos);
 393               goto erange;
 394             }
 395
 396           /* Terminate the line for any case.  */
 397           buffer[buflen - 1] = '\0';
 398
 399           /* Skip leading blanks.  */
 400           while (isspace (*p))
 401             ++p;
 402         }
 403       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines. */
 404              /* Parse the line.  If it is invalid, loop to
 405                 get the next line of the file to parse.  */
 406              !(parse_res = _nss_files_parse_grent (p, result, data, buflen,
 407                                                    errnop)));
 408
 409       if (__glibc_unlikely (parse_res == -1))
 410         /* The parser ran out of space.  */
 411         goto erange_reset;
 412
 413       /* This is a real entry.  */
 414       if (result->gr_name[0] != '+' && result->gr_name[0] != '-')
 415         {
 416           if (strcmp (result->gr_name, name) == 0)
 417             return NSS_STATUS_SUCCESS;
 418           else
 419             continue;
 420         }
 421
 422       /* -group */
 423       if (result->gr_name[0] == '-' && result->gr_name[1] != '\0')
 424         {
 425           if (strcmp (&result->gr_name[1], name) == 0)
 426             return NSS_STATUS_NOTFOUND;
 427           else
 428             continue;
 429         }
 430
 431       /* +group */
 432       if (result->gr_name[0] == '+' && result->gr_name[1] != '\0')
 433         {
 434           if (strcmp (name, &result->gr_name[1]) == 0)
 435             {
 436               enum nss_status status;
 437
 438               status = getgrnam_plusgroup (name, result, ent,
 439                                            buffer, buflen, errnop);
 440               if (status == NSS_STATUS_RETURN)
 441                 /* We couldn't parse the entry */
 442                 continue;
 443               else
 444                 return status;
 445             }
 446         }
 447       /* +:... */
 448       if (result->gr_name[0] == '+' && result->gr_name[1] == '\0')
 449         {
 450           enum nss_status status;
 451
 452           status = getgrnam_plusgroup (name, result, ent,
 453                                        buffer, buflen, errnop);
 454           if (status == NSS_STATUS_RETURN)
 455             /* We couldn't parse the entry */
 456             continue;
 457           else
 458             return status;
 459         }
 460     }
 461
 462   return NSS_STATUS_SUCCESS;
 463 }
 464
 465 enum nss_status
 466 _nss_compat_getgrnam_r (const char *name, struct group *grp,
 467                         char *buffer, size_t buflen, int *errnop)
 468 {
 469   ent_t ent = { TRUE, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0 }};
 470   enum nss_status result;
 471
 472   if (name[0] == '-' || name[0] == '+')
 473     return NSS_STATUS_NOTFOUND;
 474
 475   __libc_lock_lock (lock);
 476
 477   if (ni == NULL)
 478     init_nss_interface ();
 479
 480   __libc_lock_unlock (lock);
 481
 482   result = internal_setgrent (&ent, 0, 0);
 483
 484   if (result == NSS_STATUS_SUCCESS)
 485     result = internal_getgrnam_r (name, grp, &ent, buffer, buflen, errnop);
 486
 487   internal_endgrent (&ent);
 488
 489   return result;
 490 }
 491
 492 /* Searches in /etc/group and the NIS/NIS+ map for a special group id */
 493 static enum nss_status
 494 internal_getgrgid_r (gid_t gid, struct group *result, ent_t *ent,
 495                      char *buffer, size_t buflen, int *errnop)
 496 {
 497   struct parser_data *data = (void *) buffer;
 498   while (1)
 499     {
 500       fpos_t pos;
 501       int parse_res = 0;
 502       char *p;
 503
 504       do
 505         {
 506           /* We need at least 3 characters for one line.  */
 507           if (__glibc_unlikely (buflen < 3))
 508             {
 509             erange:
 510               *errnop = ERANGE;
 511               return NSS_STATUS_TRYAGAIN;
 512             }
 513
 514           fgetpos (ent->stream, &pos);
 515           buffer[buflen - 1] = '\xff';
 516           p = fgets_unlocked (buffer, buflen, ent->stream);
 517           if (p == NULL && feof_unlocked (ent->stream))
 518             return NSS_STATUS_NOTFOUND;
 519
 520           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 521             {
 522             erange_reset:
 523               fsetpos (ent->stream, &pos);
 524               goto erange;
 525             }
 526
 527           /* Terminate the line for any case.  */
 528           buffer[buflen - 1] = '\0';
 529
 530           /* Skip leading blanks.  */
 531           while (isspace (*p))
 532             ++p;
 533         }
 534       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines. */
 535              /* Parse the line.  If it is invalid, loop to
 536                 get the next line of the file to parse.  */
 537              !(parse_res = _nss_files_parse_grent (p, result, data, buflen,
 538                                                    errnop)));
 539
 540       if (__glibc_unlikely (parse_res == -1))
 541         /* The parser ran out of space.  */
 542         goto erange_reset;
 543
 544       /* This is a real entry.  */
 545       if (result->gr_name[0] != '+' && result->gr_name[0] != '-')
 546         {
 547           if (result->gr_gid == gid)
 548             return NSS_STATUS_SUCCESS;
 549           else
 550             continue;
 551         }
 552
 553       /* -group */
 554       if (result->gr_name[0] == '-' && result->gr_name[1] != '\0')
 555         {
 556           blacklist_store_name (&result->gr_name[1], ent);
 557           continue;
 558         }
 559
 560       /* +group */
 561       if (result->gr_name[0] == '+' && result->gr_name[1] != '\0')
 562         {
 563           /* Yes, no +1, see the memcpy call below.  */
 564           size_t len = strlen (result->gr_name);
 565           char buf[len];
 566           enum nss_status status;
 567
 568           /* Store the group in the blacklist for the "+" at the end of
 569              /etc/group */
 570           memcpy (buf, &result->gr_name[1], len);
 571           status = getgrnam_plusgroup (&result->gr_name[1], result, ent,
 572                                        buffer, buflen, errnop);
 573           blacklist_store_name (buf, ent);
 574           if (status == NSS_STATUS_SUCCESS && result->gr_gid == gid)
 575             break;
 576           else
 577             continue;
 578         }
 579       /* +:... */
 580       if (result->gr_name[0] == '+' && result->gr_name[1] == '\0')
 581         {
 582           if (!nss_getgrgid_r)
 583             return NSS_STATUS_UNAVAIL;
 584
 585           enum nss_status status = nss_getgrgid_r (gid, result, buffer, buflen,
 586                                                    errnop);
 587           if (status == NSS_STATUS_RETURN) /* We couldn't parse the entry */
 588             return NSS_STATUS_NOTFOUND;
 589           else
 590             return status;
 591         }
 592     }
 593
 594   return NSS_STATUS_SUCCESS;
 595 }
 596
 597 enum nss_status
 598 _nss_compat_getgrgid_r (gid_t gid, struct group *grp,
 599                         char *buffer, size_t buflen, int *errnop)
 600 {
 601   ent_t ent = { TRUE, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0 }};
 602   enum nss_status result;
 603
 604   __libc_lock_lock (lock);
 605
 606   if (ni == NULL)
 607     init_nss_interface ();
 608
 609   __libc_lock_unlock (lock);
 610
 611   result = internal_setgrent (&ent, 0, 0);
 612
 613   if (result == NSS_STATUS_SUCCESS)
 614     result = internal_getgrgid_r (gid, grp, &ent, buffer, buflen, errnop);
 615
 616   internal_endgrent (&ent);
 617
 618   return result;
 619 }
 620
 621
 622 /* Support routines for remembering -@netgroup and -user entries.
 623    The names are stored in a single string with `|' as separator. */
 624 static void
 625 blacklist_store_name (const char *name, ent_t *ent)
 626 {
 627   int namelen = strlen (name);
 628   char *tmp;
 629
 630   /* first call, setup cache */
 631   if (ent->blacklist.size == 0)
 632     {
 633       ent->blacklist.size = MAX (BLACKLIST_INITIAL_SIZE, 2 * namelen);
 634       ent->blacklist.data = malloc (ent->blacklist.size);
 635       if (ent->blacklist.data == NULL)
 636         return;
 637       ent->blacklist.data[0] = '|';
 638       ent->blacklist.data[1] = '\0';
 639       ent->blacklist.current = 1;
 640     }
 641   else
 642     {
 643       if (in_blacklist (name, namelen, ent))
 644         return;                 /* no duplicates */
 645
 646       if (ent->blacklist.current + namelen + 1 >= ent->blacklist.size)
 647         {
 648           ent->blacklist.size += MAX (BLACKLIST_INCREMENT, 2 * namelen);
 649           tmp = realloc (ent->blacklist.data, ent->blacklist.size);
 650           if (tmp == NULL)
 651             {
 652               free (ent->blacklist.data);
 653               ent->blacklist.size = 0;
 654               return;
 655             }
 656           ent->blacklist.data = tmp;
 657         }
 658     }
 659
 660   tmp = stpcpy (ent->blacklist.data + ent->blacklist.current, name);
 661   *tmp++ = '|';
 662   *tmp = '\0';
 663   ent->blacklist.current += namelen + 1;
 664
 665   return;
 666 }
 667
 668 /* returns TRUE if ent->blacklist contains name, else FALSE */
 669 static bool_t
 670 in_blacklist (const char *name, int namelen, ent_t *ent)
 671 {
 672   char buf[namelen + 3];
 673   char *cp;
 674
 675   if (ent->blacklist.data == NULL)
 676     return FALSE;
 677
 678   buf[0] = '|';
 679   cp = stpcpy (&buf[1], name);
 680   *cp++ = '|';
 681   *cp = '\0';
 682   return strstr (ent->blacklist.data, buf) != NULL;
 683 }