nis/nss_nis/nis-pwd.c

   1 /* Copyright (C) 1996-1998,2001-2003,2006,2009 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, write to the Free
  17    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  18    02111-1307 USA.  */
  19
  20 #include <assert.h>
  21 #include <ctype.h>
  22 #include <errno.h>
  23 #include <nss.h>
  24 #include <pwd.h>
  25 #include <string.h>
  26 #include <bits/libc-lock.h>
  27 #include <rpcsvc/yp.h>
  28 #include <rpcsvc/ypclnt.h>
  29
  30 #include "nss-nis.h"
  31 #include <libnsl.h>
  32
  33 /* Get the declaration of the parser function.  */
  34 #define ENTNAME pwent
  35 #define STRUCTURE passwd
  36 #define EXTERN_PARSER
  37 #include <nss/nss_files/files-parse.c>
  38
  39 /* Protect global state against multiple changers */
  40 __libc_lock_define_initialized (static, lock)
  41
  42 static bool_t new_start = 1;
  43 static char *oldkey;
  44 static int oldkeylen;
  45 static intern_t intern;
  46
  47
  48 int
  49 _nis_saveit (int instatus, char *inkey, int inkeylen, char *inval,
  50              int invallen, char *indata)
  51 {
  52   intern_t *intern = (intern_t *) indata;
  53
  54   if (instatus != YP_TRUE)
  55     return 1;
  56
  57   if (inkey && inkeylen > 0 && inval && invallen > 0)
  58     {
  59       struct response_t *bucket = intern->next;
  60
  61       if (__builtin_expect (bucket == NULL, 0))
  62         {
  63 #define MINSIZE 4096 - 4 * sizeof (void *)
  64           const size_t minsize = MAX (MINSIZE, 2 * (invallen + 1));
  65           bucket = malloc (sizeof (struct response_t) + minsize);
  66           if (bucket == NULL)
  67             /* We have no error code for out of memory.  */
  68             return 1;
  69
  70           bucket->next = NULL;
  71           bucket->size = minsize;
  72           intern->start = intern->next = bucket;
  73           intern->offset = 0;
  74         }
  75       else if (__builtin_expect (invallen + 1 > bucket->size - intern->offset,
  76                                  0))
  77         {
  78           /* We need a new (larger) buffer.  */
  79           const size_t newsize = 2 * MAX (bucket->size, invallen + 1);
  80           struct response_t *newp = malloc (sizeof (struct response_t)
  81                                             + newsize);
  82           if (newp == NULL)
  83             /* We have no error code for out of memory.  */
  84             return 1;
  85
  86           /* Mark the old bucket as full.  */
  87           bucket->size = intern->offset;
  88
  89           newp->next = NULL;
  90           newp->size = newsize;
  91           bucket = intern->next = bucket->next = newp;
  92           intern->offset = 0;
  93         }
  94
  95       char *p = mempcpy (&bucket->mem[intern->offset], inval, invallen);
  96       if (__builtin_expect (p[-1] != '\0', 0))
  97         {
  98           *p = '\0';
  99           ++invallen;
 100         }
 101       intern->offset += invallen;
 102     }
 103
 104   return 0;
 105 }
 106
 107
 108 static void
 109 internal_nis_endpwent (void)
 110 {
 111   new_start = 1;
 112   if (oldkey != NULL)
 113     {
 114       free (oldkey);
 115       oldkey = NULL;
 116       oldkeylen = 0;
 117     }
 118
 119   struct response_t *curr = intern.start;
 120
 121   while (curr != NULL)
 122     {
 123       struct response_t *last = curr;
 124       curr = curr->next;
 125       free (last);
 126     }
 127
 128   intern.next = intern.start = NULL;
 129 }
 130
 131
 132 enum nss_status
 133 _nss_nis_endpwent (void)
 134 {
 135   __libc_lock_lock (lock);
 136
 137   internal_nis_endpwent ();
 138
 139   __libc_lock_unlock (lock);
 140
 141   return NSS_STATUS_SUCCESS;
 142 }
 143
 144
 145 enum nss_status
 146 internal_nis_setpwent (void)
 147 {
 148   /* We have to read all the data now.  */
 149   char *domain;
 150   if (__builtin_expect (yp_get_default_domain (&domain), 0))
 151     return NSS_STATUS_UNAVAIL;
 152
 153   struct ypall_callback ypcb;
 154
 155   ypcb.foreach = _nis_saveit;
 156   ypcb.data = (char *) &intern;
 157   enum nss_status status = yperr2nss (yp_all (domain, "passwd.byname", &ypcb));
 158
 159
 160   /* Mark the last buffer as full.  */
 161   if (intern.next != NULL)
 162     intern.next->size = intern.offset;
 163
 164   intern.next = intern.start;
 165   intern.offset = 0;
 166
 167   return status;
 168 }
 169
 170
 171 enum nss_status
 172 _nss_nis_setpwent (int stayopen)
 173 {
 174   enum nss_status result = NSS_STATUS_SUCCESS;
 175
 176   __libc_lock_lock (lock);
 177
 178   internal_nis_endpwent ();
 179
 180   if (_nsl_default_nss () & NSS_FLAG_SETENT_BATCH_READ)
 181     result = internal_nis_setpwent ();
 182
 183   __libc_lock_unlock (lock);
 184
 185   return result;
 186 }
 187
 188
 189 static enum nss_status
 190 internal_nis_getpwent_r (struct passwd *pwd, char *buffer, size_t buflen,
 191                          int *errnop)
 192 {
 193   /* If we read the entire database at setpwent time we just iterate
 194      over the data we have in memory.  */
 195   bool batch_read = intern.start != NULL;
 196
 197   char *domain = NULL;
 198   if (!batch_read && __builtin_expect (yp_get_default_domain (&domain), 0))
 199     return NSS_STATUS_UNAVAIL;
 200
 201   /* Get the next entry until we found a correct one. */
 202   int parse_res;
 203   do
 204     {
 205       char *result;
 206       char *outkey;
 207       int len;
 208       int keylen;
 209
 210       if (batch_read)
 211         {
 212           struct response_t *bucket;
 213
 214         handle_batch_read:
 215           bucket = intern.next;
 216
 217           if (__builtin_expect (intern.offset >= bucket->size, 0))
 218             {
 219               if (bucket->next == NULL)
 220                 return NSS_STATUS_NOTFOUND;
 221
 222               /* We look at all the content in the current bucket.  Go on
 223                  to the next.  */
 224               bucket = intern.next = bucket->next;
 225               intern.offset = 0;
 226             }
 227
 228           for (result = &bucket->mem[intern.offset]; isspace (*result);
 229                ++result)
 230             ++intern.offset;
 231
 232           len = strlen (result);
 233         }
 234       else
 235         {
 236           int yperr;
 237
 238           if (new_start)
 239             {
 240               /* Maybe we should read the database in one piece.  */
 241               if ((_nsl_default_nss () & NSS_FLAG_SETENT_BATCH_READ)
 242                   && internal_nis_setpwent () == NSS_STATUS_SUCCESS
 243                   && intern.start != NULL)
 244                 {
 245                   batch_read = true;
 246                   goto handle_batch_read;
 247                 }
 248
 249               yperr = yp_first (domain, "passwd.byname", &outkey, &keylen,
 250                                 &result, &len);
 251             }
 252           else
 253             yperr = yp_next (domain, "passwd.byname", oldkey, oldkeylen,
 254                              &outkey, &keylen, &result, &len);
 255
 256           if (__builtin_expect (yperr != YPERR_SUCCESS, 0))
 257             {
 258               enum nss_status retval = yperr2nss (yperr);
 259
 260               if (retval == NSS_STATUS_TRYAGAIN)
 261                 *errnop = errno;
 262               return retval;
 263             }
 264         }
 265
 266       /* Check for adjunct style secret passwords.  They can be
 267          recognized by a password starting with "##".  */
 268       char *p = strchr (result, ':');
 269       size_t namelen;
 270       char *result2;
 271       int len2;
 272       if (p != NULL     /* This better should be true in all cases.  */
 273           && p[1] == '#' && p[2] == '#'
 274           && (namelen = p - result,
 275               yp_match (domain, "passwd.adjunct.byname", result, namelen,
 276                         &result2, &len2)) == YPERR_SUCCESS)
 277         {
 278           /* We found a passwd.adjunct entry.  Merge encrypted
 279              password therein into original result.  */
 280           char *encrypted = strchr (result2, ':');
 281           char *endp;
 282           size_t restlen;
 283
 284           if (encrypted == NULL
 285               || (endp = strchr (++encrypted, ':')) == NULL
 286               || (p = strchr (p + 1, ':')) == NULL)
 287             {
 288               /* Invalid format of the entry.  This never should happen
 289                  unless the data from which the NIS table is generated is
 290                  wrong.  We simply ignore it.  */
 291               free (result2);
 292               goto non_adjunct;
 293             }
 294
 295           restlen = len - (p - result);
 296           if (__builtin_expect ((size_t) (namelen + (endp - encrypted)
 297                                           + restlen + 2) > buflen, 0))
 298             {
 299               free (result2);
 300               free (result);
 301               *errnop = ERANGE;
 302               return NSS_STATUS_TRYAGAIN;
 303             }
 304
 305           mempcpy (mempcpy (mempcpy (mempcpy (buffer, result, namelen),
 306                                      ":", 1),
 307                             encrypted, endp - encrypted),
 308                    p, restlen + 1);
 309           p = buffer;
 310
 311           free (result2);
 312         }
 313       else
 314         {
 315         non_adjunct:
 316           if (__builtin_expect ((size_t) (len + 1) > buflen, 0))
 317             {
 318               free (result);
 319               *errnop = ERANGE;
 320               return NSS_STATUS_TRYAGAIN;
 321             }
 322
 323           p = buffer;
 324           *((char *) mempcpy (buffer, result, len)) = '\0';
 325         }
 326
 327       while (isspace (*p))
 328         ++p;
 329       if (!batch_read)
 330         free (result);
 331
 332       parse_res = _nss_files_parse_pwent (p, pwd, (void *) buffer, buflen,
 333                                           errnop);
 334       if (__builtin_expect (parse_res == -1, 0))
 335         {
 336           if (!batch_read)
 337             free (outkey);
 338           *errnop = ERANGE;
 339           return NSS_STATUS_TRYAGAIN;
 340         }
 341
 342       if (batch_read)
 343         intern.offset += len + 1;
 344       else
 345         {
 346           free (oldkey);
 347           oldkey = outkey;
 348           oldkeylen = keylen;
 349           new_start = 0;
 350         }
 351     }
 352   while (parse_res < 1);
 353
 354   return NSS_STATUS_SUCCESS;
 355 }
 356
 357 enum nss_status
 358 _nss_nis_getpwent_r (struct passwd *result, char *buffer, size_t buflen,
 359                      int *errnop)
 360 {
 361   int status;
 362
 363   __libc_lock_lock (lock);
 364
 365   status = internal_nis_getpwent_r (result, buffer, buflen, errnop);
 366
 367   __libc_lock_unlock (lock);
 368
 369   return status;
 370 }
 371
 372 enum nss_status
 373 _nss_nis_getpwnam_r (const char *name, struct passwd *pwd,
 374                      char *buffer, size_t buflen, int *errnop)
 375 {
 376   if (name == NULL)
 377     {
 378       *errnop = EINVAL;
 379       return NSS_STATUS_UNAVAIL;
 380     }
 381
 382   char *domain;
 383   if (__builtin_expect (yp_get_default_domain (&domain), 0))
 384     return NSS_STATUS_UNAVAIL;
 385
 386   size_t namelen = strlen (name);
 387
 388   char *result;
 389   int len;
 390   int yperr = yp_match (domain, "passwd.byname", name, namelen, &result, &len);
 391
 392   if (__builtin_expect (yperr != YPERR_SUCCESS, 0))
 393     {
 394       enum nss_status retval = yperr2nss (yperr);
 395
 396       if (retval == NSS_STATUS_TRYAGAIN)
 397         *errnop = errno;
 398       return retval;
 399     }
 400
 401   /* Check for adjunct style secret passwords.  They can be recognized
 402      by a password starting with "##".  */
 403   char *result2;
 404   int len2;
 405   char *p = strchr (result, ':');
 406   if (p != NULL /* This better should be true in all cases.  */
 407       && p[1] == '#' && p[2] == '#'
 408       && yp_match (domain, "passwd.adjunct.byname", name, namelen,
 409                    &result2, &len2) == YPERR_SUCCESS)
 410     {
 411       /* We found a passwd.adjunct entry.  Merge encrypted password
 412          therein into original result.  */
 413       char *encrypted = strchr (result2, ':');
 414       char *endp;
 415
 416       if (encrypted == NULL
 417           || (endp = strchr (++encrypted, ':')) == NULL
 418           || (p = strchr (p + 1, ':')) == NULL)
 419         {
 420           /* Invalid format of the entry.  This never should happen
 421              unless the data from which the NIS table is generated is
 422              wrong.  We simply ignore it.  */
 423           free (result2);
 424           goto non_adjunct;
 425         }
 426
 427       size_t restlen = len - (p - result);
 428       if (__builtin_expect ((size_t) (namelen + (endp - encrypted)
 429                                       + restlen + 2) > buflen, 0))
 430         {
 431           free (result2);
 432           free (result);
 433           *errnop = ERANGE;
 434           return NSS_STATUS_TRYAGAIN;
 435         }
 436
 437       __mempcpy (__mempcpy (__mempcpy (__mempcpy (buffer, name, namelen),
 438                                        ":", 1),
 439                             encrypted, endp - encrypted),
 440                  p, restlen + 1);
 441       p = buffer;
 442
 443       free (result2);
 444     }
 445   else
 446     {
 447     non_adjunct:
 448       if (__builtin_expect ((size_t) (len + 1) > buflen, 0))
 449         {
 450           free (result);
 451           *errnop = ERANGE;
 452           return NSS_STATUS_TRYAGAIN;
 453         }
 454
 455       p = strncpy (buffer, result, len);
 456       buffer[len] = '\0';
 457     }
 458
 459   while (isspace (*p))
 460     ++p;
 461   free (result);
 462
 463   int parse_res = _nss_files_parse_pwent (p, pwd, (void *) buffer, buflen,
 464                                           errnop);
 465   if (__builtin_expect (parse_res < 1, 0))
 466     {
 467       if (parse_res == -1)
 468         return NSS_STATUS_TRYAGAIN;
 469       else
 470         return NSS_STATUS_NOTFOUND;
 471     }
 472   else
 473     return NSS_STATUS_SUCCESS;
 474 }
 475
 476 enum nss_status
 477 _nss_nis_getpwuid_r (uid_t uid, struct passwd *pwd,
 478                      char *buffer, size_t buflen, int *errnop)
 479 {
 480   char *domain;
 481   if (__builtin_expect (yp_get_default_domain (&domain), 0))
 482     return NSS_STATUS_UNAVAIL;
 483
 484   char buf[32];
 485   int nlen = snprintf (buf, sizeof (buf), "%lu", (unsigned long int) uid);
 486
 487   char *result;
 488   int len;
 489   int yperr = yp_match (domain, "passwd.byuid", buf, nlen, &result, &len);
 490
 491   if (__builtin_expect (yperr != YPERR_SUCCESS, 0))
 492     {
 493       enum nss_status retval = yperr2nss (yperr);
 494
 495       if (retval == NSS_STATUS_TRYAGAIN)
 496         *errnop = errno;
 497       return retval;
 498     }
 499
 500   /* Check for adjunct style secret passwords.  They can be recognized
 501      by a password starting with "##".  */
 502   char *result2;
 503   int len2;
 504   size_t namelen;
 505   char *p = strchr (result, ':');
 506   if (p != NULL /* This better should be true in all cases.  */
 507       && p[1] == '#' && p[2] == '#'
 508       && (namelen = p - result,
 509           yp_match (domain, "passwd.adjunct.byname", result, namelen,
 510                     &result2, &len2)) == YPERR_SUCCESS)
 511     {
 512       /* We found a passwd.adjunct entry.  Merge encrypted password
 513          therein into original result.  */
 514       char *encrypted = strchr (result2, ':');
 515       char *endp;
 516       size_t restlen;
 517
 518       if (encrypted == NULL
 519           || (endp = strchr (++encrypted, ':')) == NULL
 520           || (p = strchr (p + 1, ':')) == NULL)
 521         {
 522           /* Invalid format of the entry.  This never should happen
 523              unless the data from which the NIS table is generated is
 524              wrong.  We simply ignore it.  */
 525           free (result2);
 526           goto non_adjunct;
 527         }
 528
 529       restlen = len - (p - result);
 530       if (__builtin_expect ((size_t) (namelen + (endp - encrypted)
 531                                       + restlen + 2) > buflen, 0))
 532         {
 533           free (result2);
 534           free (result);
 535           *errnop = ERANGE;
 536           return NSS_STATUS_TRYAGAIN;
 537         }
 538
 539       __mempcpy (__mempcpy (__mempcpy (__mempcpy (buffer, result, namelen),
 540                                        ":", 1),
 541                             encrypted, endp - encrypted),
 542                  p, restlen + 1);
 543       p = buffer;
 544
 545       free (result2);
 546     }
 547   else
 548     {
 549     non_adjunct:
 550       if (__builtin_expect ((size_t) (len + 1) > buflen, 0))
 551         {
 552           free (result);
 553           *errnop = ERANGE;
 554           return NSS_STATUS_TRYAGAIN;
 555         }
 556
 557       p = strncpy (buffer, result, len);
 558       buffer[len] = '\0';
 559     }
 560
 561   while (isspace (*p))
 562     ++p;
 563   free (result);
 564
 565   int parse_res = _nss_files_parse_pwent (p, pwd, (void *) buffer, buflen,
 566                                           errnop);
 567   if (__builtin_expect (parse_res < 1, 0))
 568     {
 569       if (parse_res == -1)
 570         return NSS_STATUS_TRYAGAIN;
 571      else
 572        return NSS_STATUS_NOTFOUND;
 573     }
 574   else
 575     return NSS_STATUS_SUCCESS;
 576 }