nis/nss_compat/compat-spwd.c

   1 /* Copyright (C) 1996-2017 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <http://www.gnu.org/licenses/>.  */
  18
  19 #include <ctype.h>
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <netdb.h>
  23 #include <nss.h>
  24 #include <nsswitch.h>
  25 #include <shadow.h>
  26 #include <stdio_ext.h>
  27 #include <string.h>
  28 #include <rpc/types.h>
  29 #include <rpcsvc/ypclnt.h>
  30 #include <libc-lock.h>
  31 #include <kernel-features.h>
  32
  33 #include "netgroup.h"
  34
  35 static service_user *ni;
  36 static enum nss_status (*nss_setspent) (int stayopen);
  37 static enum nss_status (*nss_getspnam_r) (const char *name, struct spwd * sp,
  38                                           char *buffer, size_t buflen,
  39                                           int *errnop);
  40 static enum nss_status (*nss_getspent_r) (struct spwd * sp, char *buffer,
  41                                           size_t buflen, int *errnop);
  42 static enum nss_status (*nss_endspent) (void);
  43
  44 /* Get the declaration of the parser function.  */
  45 #define ENTNAME spent
  46 #define STRUCTURE spwd
  47 #define EXTERN_PARSER
  48 #include <nss/nss_files/files-parse.c>
  49
  50 /* Structure for remembering -@netgroup and -user members ... */
  51 #define BLACKLIST_INITIAL_SIZE 512
  52 #define BLACKLIST_INCREMENT 256
  53 struct blacklist_t
  54 {
  55   char *data;
  56   int current;
  57   int size;
  58 };
  59
  60 struct ent_t
  61 {
  62   bool netgroup;
  63   bool files;
  64   bool first;
  65   enum nss_status setent_status;
  66   FILE *stream;
  67   struct blacklist_t blacklist;
  68   struct spwd pwd;
  69   struct __netgrent netgrdata;
  70 };
  71 typedef struct ent_t ent_t;
  72
  73 static ent_t ext_ent = { false, true, false, NSS_STATUS_SUCCESS, NULL,
  74                          { NULL, 0, 0},
  75                          { NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
  76
  77 /* Protect global state against multiple changers.  */
  78 __libc_lock_define_initialized (static, lock)
  79
  80 /* Prototypes for local functions.  */
  81 static void blacklist_store_name (const char *, ent_t *);
  82 static int in_blacklist (const char *, int, ent_t *);
  83
  84 /* Initialize the NSS interface/functions. The calling function must
  85    hold the lock.  */
  86 static void
  87 init_nss_interface (void)
  88 {
  89   if (__nss_database_lookup ("shadow_compat", "passwd_compat",
  90                              "nis", &ni) >= 0)
  91     {
  92       nss_setspent = __nss_lookup_function (ni, "setspent");
  93       nss_getspnam_r = __nss_lookup_function (ni, "getspnam_r");
  94       nss_getspent_r = __nss_lookup_function (ni, "getspent_r");
  95       nss_endspent = __nss_lookup_function (ni, "endspent");
  96     }
  97 }
  98
  99 static void
 100 give_spwd_free (struct spwd *pwd)
 101 {
 102   free (pwd->sp_namp);
 103   free (pwd->sp_pwdp);
 104
 105   memset (pwd, '\0', sizeof (struct spwd));
 106   pwd->sp_warn = -1;
 107   pwd->sp_inact = -1;
 108   pwd->sp_expire = -1;
 109   pwd->sp_flag = ~0ul;
 110 }
 111
 112 static int
 113 spwd_need_buflen (struct spwd *pwd)
 114 {
 115   int len = 0;
 116
 117   if (pwd->sp_pwdp != NULL)
 118     len += strlen (pwd->sp_pwdp) + 1;
 119
 120   return len;
 121 }
 122
 123 static void
 124 copy_spwd_changes (struct spwd *dest, struct spwd *src,
 125                    char *buffer, size_t buflen)
 126 {
 127   if (src->sp_pwdp != NULL && strlen (src->sp_pwdp))
 128     {
 129       if (buffer == NULL)
 130         dest->sp_pwdp = strdup (src->sp_pwdp);
 131       else if (dest->sp_pwdp &&
 132                strlen (dest->sp_pwdp) >= strlen (src->sp_pwdp))
 133         strcpy (dest->sp_pwdp, src->sp_pwdp);
 134       else
 135         {
 136           dest->sp_pwdp = buffer;
 137           strcpy (dest->sp_pwdp, src->sp_pwdp);
 138           buffer += strlen (dest->sp_pwdp) + 1;
 139           buflen = buflen - (strlen (dest->sp_pwdp) + 1);
 140         }
 141     }
 142   if (src->sp_lstchg != 0)
 143     dest->sp_lstchg = src->sp_lstchg;
 144   if (src->sp_min != 0)
 145     dest->sp_min = src->sp_min;
 146   if (src->sp_max != 0)
 147     dest->sp_max = src->sp_max;
 148   if (src->sp_warn != -1)
 149     dest->sp_warn = src->sp_warn;
 150   if (src->sp_inact != -1)
 151     dest->sp_inact = src->sp_inact;
 152   if (src->sp_expire != -1)
 153     dest->sp_expire = src->sp_expire;
 154   if (src->sp_flag != ~0ul)
 155     dest->sp_flag = src->sp_flag;
 156 }
 157
 158 static enum nss_status
 159 internal_setspent (ent_t *ent, int stayopen, int needent)
 160 {
 161   enum nss_status status = NSS_STATUS_SUCCESS;
 162
 163   ent->first = ent->netgroup = 0;
 164   ent->files = true;
 165
 166   /* If something was left over free it.  */
 167   if (ent->netgroup)
 168     __internal_endnetgrent (&ent->netgrdata);
 169
 170   if (ent->blacklist.data != NULL)
 171     {
 172       ent->blacklist.current = 1;
 173       ent->blacklist.data[0] = '|';
 174       ent->blacklist.data[1] = '\0';
 175     }
 176   else
 177     ent->blacklist.current = 0;
 178
 179   if (ent->stream == NULL)
 180     {
 181       ent->stream = fopen ("/etc/shadow", "rme");
 182
 183       if (ent->stream == NULL)
 184         status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
 185       else
 186         /* We take care of locking ourself.  */
 187         __fsetlocking (ent->stream, FSETLOCKING_BYCALLER);
 188     }
 189   else
 190     rewind (ent->stream);
 191
 192   give_spwd_free (&ent->pwd);
 193
 194   if (needent && status == NSS_STATUS_SUCCESS && nss_setspent)
 195     ent->setent_status = nss_setspent (stayopen);
 196
 197   return status;
 198 }
 199
 200
 201 enum nss_status
 202 _nss_compat_setspent (int stayopen)
 203 {
 204   enum nss_status result;
 205
 206   __libc_lock_lock (lock);
 207
 208   if (ni == NULL)
 209     init_nss_interface ();
 210
 211   result = internal_setspent (&ext_ent, stayopen, 1);
 212
 213   __libc_lock_unlock (lock);
 214
 215   return result;
 216 }
 217
 218
 219 static enum nss_status
 220 internal_endspent (ent_t *ent)
 221 {
 222   if (ent->stream != NULL)
 223     {
 224       fclose (ent->stream);
 225       ent->stream = NULL;
 226     }
 227
 228   if (ent->netgroup)
 229     __internal_endnetgrent (&ent->netgrdata);
 230
 231   ent->first = ent->netgroup = false;
 232   ent->files = true;
 233
 234   if (ent->blacklist.data != NULL)
 235     {
 236       ent->blacklist.current = 1;
 237       ent->blacklist.data[0] = '|';
 238       ent->blacklist.data[1] = '\0';
 239     }
 240   else
 241     ent->blacklist.current = 0;
 242
 243   give_spwd_free (&ent->pwd);
 244
 245   return NSS_STATUS_SUCCESS;
 246 }
 247
 248 enum nss_status
 249 _nss_compat_endspent (void)
 250 {
 251   enum nss_status result;
 252
 253   __libc_lock_lock (lock);
 254
 255   if (nss_endspent)
 256     nss_endspent ();
 257
 258   result = internal_endspent (&ext_ent);
 259
 260   __libc_lock_unlock (lock);
 261
 262   return result;
 263 }
 264
 265
 266 static enum nss_status
 267 getspent_next_nss_netgr (const char *name, struct spwd *result, ent_t *ent,
 268                          char *group, char *buffer, size_t buflen,
 269                          int *errnop)
 270 {
 271   char *curdomain = NULL, *host, *user, *domain, *p2;
 272   size_t p2len;
 273
 274   if (!nss_getspnam_r)
 275     return NSS_STATUS_UNAVAIL;
 276
 277   /* If the setpwent call failed, say so.  */
 278   if (ent->setent_status != NSS_STATUS_SUCCESS)
 279     return ent->setent_status;
 280
 281   if (ent->first)
 282     {
 283       memset (&ent->netgrdata, 0, sizeof (struct __netgrent));
 284       __internal_setnetgrent (group, &ent->netgrdata);
 285       ent->first = false;
 286     }
 287
 288   while (1)
 289     {
 290       enum nss_status status;
 291
 292       status = __internal_getnetgrent_r (&host, &user, &domain,
 293                                          &ent->netgrdata, buffer, buflen,
 294                                          errnop);
 295       if (status != 1)
 296         {
 297           __internal_endnetgrent (&ent->netgrdata);
 298           ent->netgroup = false;
 299           give_spwd_free (&ent->pwd);
 300           return NSS_STATUS_RETURN;
 301         }
 302
 303       if (user == NULL || user[0] == '-')
 304         continue;
 305
 306       if (domain != NULL)
 307         {
 308           if (curdomain == NULL
 309               && yp_get_default_domain (&curdomain) != YPERR_SUCCESS)
 310             {
 311               __internal_endnetgrent (&ent->netgrdata);
 312               ent->netgroup = false;
 313               give_spwd_free (&ent->pwd);
 314               return NSS_STATUS_UNAVAIL;
 315             }
 316           if (strcmp (curdomain, domain) != 0)
 317             continue;
 318         }
 319
 320       /* If name != NULL, we are called from getpwnam */
 321       if (name != NULL)
 322         if (strcmp (user, name) != 0)
 323           continue;
 324
 325       p2len = spwd_need_buflen (&ent->pwd);
 326       if (p2len > buflen)
 327         {
 328           *errnop = ERANGE;
 329           return NSS_STATUS_TRYAGAIN;
 330         }
 331       p2 = buffer + (buflen - p2len);
 332       buflen -= p2len;
 333
 334       if (nss_getspnam_r (user, result, buffer, buflen, errnop) !=
 335           NSS_STATUS_SUCCESS)
 336         continue;
 337
 338       if (!in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 339         {
 340           /* Store the User in the blacklist for possible the "+" at the
 341              end of /etc/passwd */
 342           blacklist_store_name (result->sp_namp, ent);
 343           copy_spwd_changes (result, &ent->pwd, p2, p2len);
 344           break;
 345         }
 346     }
 347
 348   return NSS_STATUS_SUCCESS;
 349 }
 350
 351
 352 static enum nss_status
 353 getspent_next_nss (struct spwd *result, ent_t *ent,
 354                    char *buffer, size_t buflen, int *errnop)
 355 {
 356   enum nss_status status;
 357   char *p2;
 358   size_t p2len;
 359
 360   if (!nss_getspent_r)
 361     return NSS_STATUS_UNAVAIL;
 362
 363   p2len = spwd_need_buflen (&ent->pwd);
 364   if (p2len > buflen)
 365     {
 366       *errnop = ERANGE;
 367       return NSS_STATUS_TRYAGAIN;
 368     }
 369   p2 = buffer + (buflen - p2len);
 370   buflen -= p2len;
 371   do
 372     {
 373       if ((status = nss_getspent_r (result, buffer, buflen, errnop)) !=
 374           NSS_STATUS_SUCCESS)
 375         return status;
 376     }
 377   while (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent));
 378
 379   copy_spwd_changes (result, &ent->pwd, p2, p2len);
 380
 381   return NSS_STATUS_SUCCESS;
 382 }
 383
 384
 385 /* This function handle the +user entrys in /etc/shadow */
 386 static enum nss_status
 387 getspnam_plususer (const char *name, struct spwd *result, ent_t *ent,
 388                    char *buffer, size_t buflen, int *errnop)
 389 {
 390   if (!nss_getspnam_r)
 391     return NSS_STATUS_UNAVAIL;
 392
 393   struct spwd pwd;
 394   memset (&pwd, '\0', sizeof (struct spwd));
 395   pwd.sp_warn = -1;
 396   pwd.sp_inact = -1;
 397   pwd.sp_expire = -1;
 398   pwd.sp_flag = ~0ul;
 399
 400   copy_spwd_changes (&pwd, result, NULL, 0);
 401
 402   size_t plen = spwd_need_buflen (&pwd);
 403   if (plen > buflen)
 404     {
 405       *errnop = ERANGE;
 406       return NSS_STATUS_TRYAGAIN;
 407     }
 408   char *p = buffer + (buflen - plen);
 409   buflen -= plen;
 410
 411   enum nss_status status = nss_getspnam_r (name, result, buffer, buflen,
 412                                            errnop);
 413   if (status != NSS_STATUS_SUCCESS)
 414     return status;
 415
 416   if (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 417     return NSS_STATUS_NOTFOUND;
 418
 419   copy_spwd_changes (result, &pwd, p, plen);
 420   give_spwd_free (&pwd);
 421   /* We found the entry.  */
 422   return NSS_STATUS_SUCCESS;
 423 }
 424
 425
 426 static enum nss_status
 427 getspent_next_file (struct spwd *result, ent_t *ent,
 428                     char *buffer, size_t buflen, int *errnop)
 429 {
 430   struct parser_data *data = (void *) buffer;
 431   while (1)
 432     {
 433       fpos_t pos;
 434       int parse_res = 0;
 435       char *p;
 436
 437       do
 438         {
 439           /* We need at least 3 characters for one line.  */
 440           if (__glibc_unlikely (buflen < 3))
 441             {
 442             erange:
 443               *errnop = ERANGE;
 444               return NSS_STATUS_TRYAGAIN;
 445             }
 446
 447           fgetpos (ent->stream, &pos);
 448           buffer[buflen - 1] = '\xff';
 449           p = fgets_unlocked (buffer, buflen, ent->stream);
 450           if (p == NULL && feof_unlocked (ent->stream))
 451             return NSS_STATUS_NOTFOUND;
 452
 453           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 454             {
 455             erange_reset:
 456               fsetpos (ent->stream, &pos);
 457               goto erange;
 458             }
 459
 460           /* Skip leading blanks.  */
 461           while (isspace (*p))
 462             ++p;
 463         }
 464       while (*p == '\0' || *p == '#'    /* Ignore empty and comment lines.  */
 465              /* Parse the line.  If it is invalid, loop to
 466                 get the next line of the file to parse.  */
 467              || !(parse_res = _nss_files_parse_spent (p, result, data,
 468                                                       buflen, errnop)));
 469
 470       if (__glibc_unlikely (parse_res == -1))
 471         /* The parser ran out of space.  */
 472         goto erange_reset;
 473
 474       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 475         /* This is a real entry.  */
 476         break;
 477
 478       /* -@netgroup */
 479       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 480           && result->sp_namp[2] != '\0')
 481         {
 482           /* XXX Do not use fixed length buffers.  */
 483           char buf2[1024];
 484           char *user, *host, *domain;
 485           struct __netgrent netgrdata;
 486
 487           memset (&netgrdata, 0, sizeof (struct __netgrent));
 488           __internal_setnetgrent (&result->sp_namp[2], &netgrdata);
 489           while (__internal_getnetgrent_r (&host, &user, &domain,
 490                                            &netgrdata, buf2, sizeof (buf2),
 491                                            errnop))
 492             {
 493               if (user != NULL && user[0] != '-')
 494                 blacklist_store_name (user, ent);
 495             }
 496           __internal_endnetgrent (&netgrdata);
 497           continue;
 498         }
 499
 500       /* +@netgroup */
 501       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 502           && result->sp_namp[2] != '\0')
 503         {
 504           int status;
 505
 506           ent->netgroup = true;
 507           ent->first = true;
 508           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 509
 510           status = getspent_next_nss_netgr (NULL, result, ent,
 511                                             &result->sp_namp[2],
 512                                             buffer, buflen, errnop);
 513           if (status == NSS_STATUS_RETURN)
 514             continue;
 515           else
 516             return status;
 517         }
 518
 519       /* -user */
 520       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 521           && result->sp_namp[1] != '@')
 522         {
 523           blacklist_store_name (&result->sp_namp[1], ent);
 524           continue;
 525         }
 526
 527       /* +user */
 528       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 529           && result->sp_namp[1] != '@')
 530         {
 531           size_t len = strlen (result->sp_namp);
 532           char buf[len];
 533           enum nss_status status;
 534
 535           /* Store the User in the blacklist for the "+" at the end of
 536              /etc/passwd */
 537           memcpy (buf, &result->sp_namp[1], len);
 538           status = getspnam_plususer (&result->sp_namp[1], result, ent,
 539                                       buffer, buflen, errnop);
 540           blacklist_store_name (buf, ent);
 541
 542           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
 543             break;
 544           /* We couldn't parse the entry */
 545           else if (status == NSS_STATUS_RETURN
 546                    /* entry doesn't exist */
 547                    || status == NSS_STATUS_NOTFOUND)
 548             continue;
 549           else
 550             {
 551               if (status == NSS_STATUS_TRYAGAIN)
 552                 {
 553                   fsetpos (ent->stream, &pos);
 554                   *errnop = ERANGE;
 555                 }
 556               return status;
 557             }
 558         }
 559
 560       /* +:... */
 561       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 562         {
 563           ent->files = false;
 564           ent->first = true;
 565           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 566
 567           return getspent_next_nss (result, ent, buffer, buflen, errnop);
 568         }
 569     }
 570
 571   return NSS_STATUS_SUCCESS;
 572 }
 573
 574
 575 static enum nss_status
 576 internal_getspent_r (struct spwd *pw, ent_t *ent,
 577                      char *buffer, size_t buflen, int *errnop)
 578 {
 579   if (ent->netgroup)
 580     {
 581       enum nss_status status;
 582
 583       /* We are searching members in a netgroup */
 584       /* Since this is not the first call, we don't need the group name */
 585       status = getspent_next_nss_netgr (NULL, pw, ent, NULL, buffer,
 586                                         buflen, errnop);
 587
 588       if (status == NSS_STATUS_RETURN)
 589         return getspent_next_file (pw, ent, buffer, buflen, errnop);
 590       else
 591         return status;
 592     }
 593   else if (ent->files)
 594     return getspent_next_file (pw, ent, buffer, buflen, errnop);
 595   else
 596     return getspent_next_nss (pw, ent, buffer, buflen, errnop);
 597 }
 598
 599
 600 enum nss_status
 601 _nss_compat_getspent_r (struct spwd *pwd, char *buffer, size_t buflen,
 602                         int *errnop)
 603 {
 604   enum nss_status result = NSS_STATUS_SUCCESS;
 605
 606   __libc_lock_lock (lock);
 607
 608   /* Be prepared that the setpwent function was not called before.  */
 609   if (ni == NULL)
 610     init_nss_interface ();
 611
 612   if (ext_ent.stream == NULL)
 613     result = internal_setspent (&ext_ent, 1, 1);
 614
 615   if (result == NSS_STATUS_SUCCESS)
 616     result = internal_getspent_r (pwd, &ext_ent, buffer, buflen, errnop);
 617
 618   __libc_lock_unlock (lock);
 619
 620   return result;
 621 }
 622
 623
 624 /* Searches in /etc/passwd and the NIS/NIS+ map for a special user */
 625 static enum nss_status
 626 internal_getspnam_r (const char *name, struct spwd *result, ent_t *ent,
 627                      char *buffer, size_t buflen, int *errnop)
 628 {
 629   struct parser_data *data = (void *) buffer;
 630
 631   while (1)
 632     {
 633       fpos_t pos;
 634       char *p;
 635       int parse_res;
 636
 637       do
 638         {
 639           /* We need at least 3 characters for one line.  */
 640           if (__glibc_unlikely (buflen < 3))
 641             {
 642             erange:
 643               *errnop = ERANGE;
 644               return NSS_STATUS_TRYAGAIN;
 645             }
 646
 647           fgetpos (ent->stream, &pos);
 648           buffer[buflen - 1] = '\xff';
 649           p = fgets_unlocked (buffer, buflen, ent->stream);
 650           if (p == NULL && feof_unlocked (ent->stream))
 651             return NSS_STATUS_NOTFOUND;
 652
 653           if (p == NULL || buffer[buflen - 1] != '\xff')
 654             {
 655             erange_reset:
 656               fsetpos (ent->stream, &pos);
 657               goto erange;
 658             }
 659
 660           /* Terminate the line for any case.  */
 661           buffer[buflen - 1] = '\0';
 662
 663           /* Skip leading blanks.  */
 664           while (isspace (*p))
 665             ++p;
 666         }
 667       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines.  */
 668              /* Parse the line.  If it is invalid, loop to
 669                 get the next line of the file to parse.  */
 670              !(parse_res = _nss_files_parse_spent (p, result, data, buflen,
 671                                                    errnop)));
 672
 673       if (__glibc_unlikely (parse_res == -1))
 674         /* The parser ran out of space.  */
 675         goto erange_reset;
 676
 677       /* This is a real entry.  */
 678       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 679         {
 680           if (strcmp (result->sp_namp, name) == 0)
 681             return NSS_STATUS_SUCCESS;
 682           else
 683             continue;
 684         }
 685
 686       /* -@netgroup */
 687       /* If the loaded NSS module does not support this service, add
 688          all users from a +@netgroup entry to the blacklist, too.  */
 689       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 690           && result->sp_namp[2] != '\0')
 691         {
 692           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 693             return NSS_STATUS_NOTFOUND;
 694           continue;
 695         }
 696
 697       /* +@netgroup */
 698       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 699           && result->sp_namp[2] != '\0')
 700         {
 701           enum nss_status status;
 702
 703           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 704             {
 705               status = getspnam_plususer (name, result, ent, buffer,
 706                                           buflen, errnop);
 707
 708               if (status == NSS_STATUS_RETURN)
 709                 continue;
 710
 711               return status;
 712             }
 713           continue;
 714         }
 715
 716       /* -user */
 717       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 718           && result->sp_namp[1] != '@')
 719         {
 720           if (strcmp (&result->sp_namp[1], name) == 0)
 721             return NSS_STATUS_NOTFOUND;
 722           else
 723             continue;
 724         }
 725
 726       /* +user */
 727       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 728           && result->sp_namp[1] != '@')
 729         {
 730           if (strcmp (name, &result->sp_namp[1]) == 0)
 731             {
 732               enum nss_status status;
 733
 734               status = getspnam_plususer (name, result, ent,
 735                                           buffer, buflen, errnop);
 736
 737               if (status == NSS_STATUS_RETURN)
 738                 /* We couldn't parse the entry */
 739                 return NSS_STATUS_NOTFOUND;
 740               else
 741                 return status;
 742             }
 743         }
 744
 745       /* +:... */
 746       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 747         {
 748           enum nss_status status;
 749
 750           status = getspnam_plususer (name, result, ent,
 751                                       buffer, buflen, errnop);
 752
 753           if (status == NSS_STATUS_SUCCESS)
 754             /* We found the entry. */
 755             break;
 756           else if (status == NSS_STATUS_RETURN)
 757             /* We couldn't parse the entry */
 758             return NSS_STATUS_NOTFOUND;
 759           else
 760             return status;
 761         }
 762     }
 763   return NSS_STATUS_SUCCESS;
 764 }
 765
 766
 767 enum nss_status
 768 _nss_compat_getspnam_r (const char *name, struct spwd *pwd,
 769                         char *buffer, size_t buflen, int *errnop)
 770 {
 771   enum nss_status result;
 772   ent_t ent = { false, true, false, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0},
 773                 { NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
 774
 775   if (name[0] == '-' || name[0] == '+')
 776     return NSS_STATUS_NOTFOUND;
 777
 778   __libc_lock_lock (lock);
 779
 780   if (ni == NULL)
 781     init_nss_interface ();
 782
 783   __libc_lock_unlock (lock);
 784
 785   result = internal_setspent (&ent, 0, 0);
 786
 787   if (result == NSS_STATUS_SUCCESS)
 788     result = internal_getspnam_r (name, pwd, &ent, buffer, buflen, errnop);
 789
 790   internal_endspent (&ent);
 791
 792   return result;
 793 }
 794
 795
 796 /* Support routines for remembering -@netgroup and -user entries.
 797    The names are stored in a single string with `|' as separator. */
 798 static void
 799 blacklist_store_name (const char *name, ent_t *ent)
 800 {
 801   int namelen = strlen (name);
 802   char *tmp;
 803
 804   /* first call, setup cache */
 805   if (ent->blacklist.size == 0)
 806     {
 807       ent->blacklist.size = MAX (BLACKLIST_INITIAL_SIZE, 2 * namelen);
 808       ent->blacklist.data = malloc (ent->blacklist.size);
 809       if (ent->blacklist.data == NULL)
 810         return;
 811       ent->blacklist.data[0] = '|';
 812       ent->blacklist.data[1] = '\0';
 813       ent->blacklist.current = 1;
 814     }
 815   else
 816     {
 817       if (in_blacklist (name, namelen, ent))
 818         return;                 /* no duplicates */
 819
 820       if (ent->blacklist.current + namelen + 1 >= ent->blacklist.size)
 821         {
 822           ent->blacklist.size += MAX (BLACKLIST_INCREMENT, 2 * namelen);
 823           tmp = realloc (ent->blacklist.data, ent->blacklist.size);
 824           if (tmp == NULL)
 825             {
 826               free (ent->blacklist.data);
 827               ent->blacklist.size = 0;
 828               return;
 829             }
 830           ent->blacklist.data = tmp;
 831         }
 832     }
 833
 834   tmp = stpcpy (ent->blacklist.data + ent->blacklist.current, name);
 835   *tmp++ = '|';
 836   *tmp = '\0';
 837   ent->blacklist.current += namelen + 1;
 838
 839   return;
 840 }
 841
 842
 843 /* Returns TRUE if ent->blacklist contains name, else FALSE.  */
 844 static bool_t
 845 in_blacklist (const char *name, int namelen, ent_t *ent)
 846 {
 847   char buf[namelen + 3];
 848   char *cp;
 849
 850   if (ent->blacklist.data == NULL)
 851     return false;
 852
 853   buf[0] = '|';
 854   cp = stpcpy (&buf[1], name);
 855   *cp++ = '|';
 856   *cp = '\0';
 857   return strstr (ent->blacklist.data, buf) != NULL;
 858 }