nscd/nscd_getgr_r.c

   1 /* Copyright (C) 1998-2014 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@uni-paderborn.de>, 1998.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <http://www.gnu.org/licenses/>.  */
  18
  19 #include <alloca.h>
  20 #include <assert.h>
  21 #include <errno.h>
  22 #include <grp.h>
  23 #include <stdint.h>
  24 #include <stdio.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27 #include <unistd.h>
  28 #include <sys/mman.h>
  29 #include <sys/socket.h>
  30 #include <sys/uio.h>
  31 #include <sys/un.h>
  32 #include <not-cancel.h>
  33 #include <_itoa.h>
  34
  35 #include "nscd-client.h"
  36 #include "nscd_proto.h"
  37
  38 int __nss_not_use_nscd_group;
  39
  40 static int nscd_getgr_r (const char *key, size_t keylen, request_type type,
  41                          struct group *resultbuf, char *buffer,
  42                          size_t buflen, struct group **result)
  43      internal_function;
  44
  45
  46 int
  47 __nscd_getgrnam_r (const char *name, struct group *resultbuf, char *buffer,
  48                    size_t buflen, struct group **result)
  49 {
  50   return nscd_getgr_r (name, strlen (name) + 1, GETGRBYNAME, resultbuf,
  51                        buffer, buflen, result);
  52 }
  53
  54
  55 int
  56 __nscd_getgrgid_r (gid_t gid, struct group *resultbuf, char *buffer,
  57                    size_t buflen, struct group **result)
  58 {
  59   char buf[3 * sizeof (gid_t)];
  60   buf[sizeof (buf) - 1] = '\0';
  61   char *cp = _itoa_word (gid, buf + sizeof (buf) - 1, 10, 0);
  62
  63   return nscd_getgr_r (cp, buf + sizeof (buf) - cp, GETGRBYGID, resultbuf,
  64                        buffer, buflen, result);
  65 }
  66
  67
  68 libc_locked_map_ptr (,__gr_map_handle) attribute_hidden;
  69 /* Note that we only free the structure if necessary.  The memory
  70    mapping is not removed since it is not visible to the malloc
  71    handling.  */
  72 libc_freeres_fn (gr_map_free)
  73 {
  74   if (__gr_map_handle.mapped != NO_MAPPING)
  75     {
  76       void *p = __gr_map_handle.mapped;
  77       __gr_map_handle.mapped = NO_MAPPING;
  78       free (p);
  79     }
  80 }
  81
  82
  83 static int
  84 internal_function
  85 nscd_getgr_r (const char *key, size_t keylen, request_type type,
  86               struct group *resultbuf, char *buffer, size_t buflen,
  87               struct group **result)
  88 {
  89   int gc_cycle;
  90   int nretries = 0;
  91   const uint32_t *len = NULL;
  92   size_t lensize = 0;
  93
  94   /* If the mapping is available, try to search there instead of
  95      communicating with the nscd.  */
  96   struct mapped_database *mapped = __nscd_get_map_ref (GETFDGR, "group",
  97                                                        &__gr_map_handle,
  98                                                        &gc_cycle);
  99  retry:;
 100   const char *gr_name = NULL;
 101   size_t gr_name_len = 0;
 102   int retval = -1;
 103   const char *recend = (const char *) ~UINTMAX_C (0);
 104   gr_response_header gr_resp;
 105
 106   if (mapped != NO_MAPPING)
 107     {
 108       struct datahead *found = __nscd_cache_search (type, key, keylen, mapped,
 109                                                     sizeof gr_resp);
 110       if (found != NULL)
 111         {
 112           len = (const uint32_t *) (&found->data[0].grdata + 1);
 113           gr_resp = found->data[0].grdata;
 114           gr_name = ((const char *) len
 115                      + gr_resp.gr_mem_cnt * sizeof (uint32_t));
 116           gr_name_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
 117           recend = (const char *) found->data + found->recsize;
 118           /* Now check if we can trust gr_resp fields.  If GC is
 119              in progress, it can contain anything.  */
 120           if (mapped->head->gc_cycle != gc_cycle)
 121             {
 122               retval = -2;
 123               goto out;
 124             }
 125
 126           /* The alignment is always sufficient, unless GC is in progress.  */
 127           assert (((uintptr_t) len & (__alignof__ (*len) - 1)) == 0);
 128         }
 129     }
 130
 131   int sock = -1;
 132   if (gr_name == NULL)
 133     {
 134       sock = __nscd_open_socket (key, keylen, type, &gr_resp,
 135                                  sizeof (gr_resp));
 136       if (sock == -1)
 137         {
 138           __nss_not_use_nscd_group = 1;
 139           goto out;
 140         }
 141     }
 142
 143   /* No value found so far.  */
 144   *result = NULL;
 145
 146   if (__glibc_unlikely (gr_resp.found == -1))
 147     {
 148       /* The daemon does not cache this database.  */
 149       __nss_not_use_nscd_group = 1;
 150       goto out_close;
 151     }
 152
 153   if (gr_resp.found == 1)
 154     {
 155       struct iovec vec[2];
 156       char *p = buffer;
 157       size_t total_len;
 158       uintptr_t align;
 159       nscd_ssize_t cnt;
 160
 161       /* Now allocate the buffer the array for the group members.  We must
 162          align the pointer.  */
 163       align = ((__alignof__ (char *) - (p - ((char *) 0)))
 164                & (__alignof__ (char *) - 1));
 165       total_len = (align + (1 + gr_resp.gr_mem_cnt) * sizeof (char *)
 166                    + gr_resp.gr_name_len + gr_resp.gr_passwd_len);
 167       if (__glibc_unlikely (buflen < total_len))
 168         {
 169         no_room:
 170           __set_errno (ERANGE);
 171           retval = ERANGE;
 172           goto out_close;
 173         }
 174       buflen -= total_len;
 175
 176       p += align;
 177       resultbuf->gr_mem = (char **) p;
 178       p += (1 + gr_resp.gr_mem_cnt) * sizeof (char *);
 179
 180       /* Set pointers for strings.  */
 181       resultbuf->gr_name = p;
 182       p += gr_resp.gr_name_len;
 183       resultbuf->gr_passwd = p;
 184       p += gr_resp.gr_passwd_len;
 185
 186       /* Fill in what we know now.  */
 187       resultbuf->gr_gid = gr_resp.gr_gid;
 188
 189       /* Read the length information, group name, and password.  */
 190       if (gr_name == NULL)
 191         {
 192           /* Handle a simple, usual case: no group members.  */
 193           if (__glibc_likely (gr_resp.gr_mem_cnt == 0))
 194             {
 195               size_t n = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
 196               if (__builtin_expect (__readall (sock, resultbuf->gr_name, n)
 197                                     != (ssize_t) n, 0))
 198                 goto out_close;
 199             }
 200           else
 201             {
 202               /* Allocate array to store lengths.  */
 203               if (lensize == 0)
 204                 {
 205                   lensize = gr_resp.gr_mem_cnt * sizeof (uint32_t);
 206                   len = (uint32_t *) alloca (lensize);
 207                 }
 208               else if (gr_resp.gr_mem_cnt * sizeof (uint32_t) > lensize)
 209                 len = extend_alloca (len, lensize,
 210                                      gr_resp.gr_mem_cnt * sizeof (uint32_t));
 211
 212               vec[0].iov_base = (void *) len;
 213               vec[0].iov_len = gr_resp.gr_mem_cnt * sizeof (uint32_t);
 214               vec[1].iov_base = resultbuf->gr_name;
 215               vec[1].iov_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
 216               total_len = vec[0].iov_len + vec[1].iov_len;
 217
 218               /* Get this data.  */
 219               size_t n = __readvall (sock, vec, 2);
 220               if (__glibc_unlikely (n != total_len))
 221                 goto out_close;
 222             }
 223         }
 224       else
 225         /* We already have the data.  Just copy the group name and
 226            password.  */
 227         memcpy (resultbuf->gr_name, gr_name,
 228                 gr_resp.gr_name_len + gr_resp.gr_passwd_len);
 229
 230       /* Clear the terminating entry.  */
 231       resultbuf->gr_mem[gr_resp.gr_mem_cnt] = NULL;
 232
 233       /* Prepare reading the group members.  */
 234       total_len = 0;
 235       for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt)
 236         {
 237           resultbuf->gr_mem[cnt] = p;
 238           total_len += len[cnt];
 239           p += len[cnt];
 240         }
 241
 242       if (__glibc_unlikely (gr_name + gr_name_len + total_len > recend))
 243         {
 244           /* len array might contain garbage during nscd GC cycle,
 245              retry rather than fail in that case.  */
 246           if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle)
 247             retval = -2;
 248           goto out_close;
 249         }
 250       if (__glibc_unlikely (total_len > buflen))
 251         {
 252           /* len array might contain garbage during nscd GC cycle,
 253              retry rather than fail in that case.  */
 254           if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle)
 255             {
 256               retval = -2;
 257               goto out_close;
 258             }
 259           else
 260             goto no_room;
 261         }
 262
 263       retval = 0;
 264
 265       /* If there are no group members TOTAL_LEN is zero.  */
 266       if (gr_name == NULL)
 267         {
 268           if (total_len > 0
 269               && __builtin_expect (__readall (sock, resultbuf->gr_mem[0],
 270                                               total_len) != total_len, 0))
 271             {
 272               /* The `errno' to some value != ERANGE.  */
 273               __set_errno (ENOENT);
 274               retval = ENOENT;
 275             }
 276           else
 277             *result = resultbuf;
 278         }
 279       else
 280         {
 281           /* Copy the group member names.  */
 282           memcpy (resultbuf->gr_mem[0], gr_name + gr_name_len, total_len);
 283
 284           /* Try to detect corrupt databases.  */
 285           if (resultbuf->gr_name[gr_name_len - 1] != '\0'
 286               || resultbuf->gr_passwd[gr_resp.gr_passwd_len - 1] != '\0'
 287               || ({for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt)
 288                     if (resultbuf->gr_mem[cnt][len[cnt] - 1] != '\0')
 289                       break;
 290                   cnt < gr_resp.gr_mem_cnt; }))
 291             {
 292               /* We cannot use the database.  */
 293               retval = mapped->head->gc_cycle != gc_cycle ? -2 : -1;
 294               goto out_close;
 295             }
 296
 297           *result = resultbuf;
 298         }
 299     }
 300   else
 301     {
 302       /* Set errno to 0 to indicate no error, just no found record.  */
 303       __set_errno (0);
 304       /* Even though we have not found anything, the result is zero.  */
 305       retval = 0;
 306     }
 307
 308  out_close:
 309   if (sock != -1)
 310     close_not_cancel_no_status (sock);
 311  out:
 312   if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
 313     {
 314       /* When we come here this means there has been a GC cycle while we
 315          were looking for the data.  This means the data might have been
 316          inconsistent.  Retry if possible.  */
 317       if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
 318         {
 319           /* nscd is just running gc now.  Disable using the mapping.  */
 320           if (atomic_decrement_val (&mapped->counter) == 0)
 321             __nscd_unmap (mapped);
 322           mapped = NO_MAPPING;
 323         }
 324
 325       if (retval != -1)
 326         goto retry;
 327     }
 328
 329   return retval;
 330 }