nis/nss_compat/compat-spwd.c

   1 /* Copyright (C) 1996-1999,2001-2005,2006 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, write to the Free
  17    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  18    02111-1307 USA.  */
  19
  20 #include <ctype.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <netdb.h>
  24 #include <nss.h>
  25 #include <nsswitch.h>
  26 #include <shadow.h>
  27 #include <stdio_ext.h>
  28 #include <string.h>
  29 #include <rpc/types.h>
  30 #include <rpcsvc/ypclnt.h>
  31 #include <bits/libc-lock.h>
  32
  33 #include "netgroup.h"
  34
  35 static service_user *ni;
  36 static enum nss_status (*nss_setspent) (int stayopen);
  37 static enum nss_status (*nss_getspnam_r) (const char *name, struct spwd * sp,
  38                                           char *buffer, size_t buflen,
  39                                           int *errnop);
  40 static enum nss_status (*nss_getspent_r) (struct spwd * sp, char *buffer,
  41                                           size_t buflen, int *errnop);
  42 static enum nss_status (*nss_endspent) (void);
  43
  44 /* Get the declaration of the parser function.  */
  45 #define ENTNAME spent
  46 #define STRUCTURE spwd
  47 #define EXTERN_PARSER
  48 #include <nss/nss_files/files-parse.c>
  49
  50 /* Structure for remembering -@netgroup and -user members ... */
  51 #define BLACKLIST_INITIAL_SIZE 512
  52 #define BLACKLIST_INCREMENT 256
  53 struct blacklist_t
  54 {
  55   char *data;
  56   int current;
  57   int size;
  58 };
  59
  60 struct ent_t
  61 {
  62   bool netgroup;
  63   bool files;
  64   bool first;
  65   enum nss_status setent_status;
  66   FILE *stream;
  67   struct blacklist_t blacklist;
  68   struct spwd pwd;
  69   struct __netgrent netgrdata;
  70 };
  71 typedef struct ent_t ent_t;
  72
  73 static ent_t ext_ent = { false, true, false, NSS_STATUS_SUCCESS, NULL,
  74                          { NULL, 0, 0},
  75                          { NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
  76
  77 /* Protect global state against multiple changers.  */
  78 __libc_lock_define_initialized (static, lock)
  79
  80 /* Prototypes for local functions.  */
  81 static void blacklist_store_name (const char *, ent_t *);
  82 static int in_blacklist (const char *, int, ent_t *);
  83
  84 /* Initialize the NSS interface/functions. The calling function must
  85    hold the lock.  */
  86 static void
  87 init_nss_interface (void)
  88 {
  89   if (__nss_database_lookup ("shadow_compat", "passwd_compat",
  90                              "nis", &ni) >= 0)
  91     {
  92       nss_setspent = __nss_lookup_function (ni, "setspent");
  93       nss_getspnam_r = __nss_lookup_function (ni, "getspnam_r");
  94       nss_getspent_r = __nss_lookup_function (ni, "getspent_r");
  95       nss_endspent = __nss_lookup_function (ni, "endspent");
  96     }
  97 }
  98
  99 static void
 100 give_spwd_free (struct spwd *pwd)
 101 {
 102   if (pwd->sp_namp != NULL)
 103     free (pwd->sp_namp);
 104   if (pwd->sp_pwdp != NULL)
 105     free (pwd->sp_pwdp);
 106
 107   memset (pwd, '\0', sizeof (struct spwd));
 108   pwd->sp_warn = -1;
 109   pwd->sp_inact = -1;
 110   pwd->sp_expire = -1;
 111   pwd->sp_flag = ~0ul;
 112 }
 113
 114 static int
 115 spwd_need_buflen (struct spwd *pwd)
 116 {
 117   int len = 0;
 118
 119   if (pwd->sp_pwdp != NULL)
 120     len += strlen (pwd->sp_pwdp) + 1;
 121
 122   return len;
 123 }
 124
 125 static void
 126 copy_spwd_changes (struct spwd *dest, struct spwd *src,
 127                    char *buffer, size_t buflen)
 128 {
 129   if (src->sp_pwdp != NULL && strlen (src->sp_pwdp))
 130     {
 131       if (buffer == NULL)
 132         dest->sp_pwdp = strdup (src->sp_pwdp);
 133       else if (dest->sp_pwdp &&
 134                strlen (dest->sp_pwdp) >= strlen (src->sp_pwdp))
 135         strcpy (dest->sp_pwdp, src->sp_pwdp);
 136       else
 137         {
 138           dest->sp_pwdp = buffer;
 139           strcpy (dest->sp_pwdp, src->sp_pwdp);
 140           buffer += strlen (dest->sp_pwdp) + 1;
 141           buflen = buflen - (strlen (dest->sp_pwdp) + 1);
 142         }
 143     }
 144   if (src->sp_lstchg != 0)
 145     dest->sp_lstchg = src->sp_lstchg;
 146   if (src->sp_min != 0)
 147     dest->sp_min = src->sp_min;
 148   if (src->sp_max != 0)
 149     dest->sp_max = src->sp_max;
 150   if (src->sp_warn != -1)
 151     dest->sp_warn = src->sp_warn;
 152   if (src->sp_inact != -1)
 153     dest->sp_inact = src->sp_inact;
 154   if (src->sp_expire != -1)
 155     dest->sp_expire = src->sp_expire;
 156   if (src->sp_flag != ~0ul)
 157     dest->sp_flag = src->sp_flag;
 158 }
 159
 160 static enum nss_status
 161 internal_setspent (ent_t *ent, int stayopen)
 162 {
 163   enum nss_status status = NSS_STATUS_SUCCESS;
 164
 165   ent->first = ent->netgroup = 0;
 166   ent->files = true;
 167
 168   /* If something was left over free it.  */
 169   if (ent->netgroup)
 170     __internal_endnetgrent (&ent->netgrdata);
 171
 172   if (ent->blacklist.data != NULL)
 173     {
 174       ent->blacklist.current = 1;
 175       ent->blacklist.data[0] = '|';
 176       ent->blacklist.data[1] = '\0';
 177     }
 178   else
 179     ent->blacklist.current = 0;
 180
 181   if (ent->stream == NULL)
 182     {
 183       ent->stream = fopen ("/etc/shadow", "rm");
 184
 185       if (ent->stream == NULL)
 186         status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
 187       else
 188         {
 189           /* We have to make sure the file is  `closed on exec'.  */
 190           int result, flags;
 191
 192           result = flags = fcntl (fileno_unlocked (ent->stream), F_GETFD, 0);
 193           if (result >= 0)
 194             {
 195               flags |= FD_CLOEXEC;
 196               result = fcntl (fileno_unlocked (ent->stream), F_SETFD, flags);
 197             }
 198           if (result < 0)
 199             {
 200               /* Something went wrong.  Close the stream and return a
 201                  failure.  */
 202               fclose (ent->stream);
 203               ent->stream = NULL;
 204               status = NSS_STATUS_UNAVAIL;
 205             }
 206           else
 207             /* We take care of locking ourself.  */
 208             __fsetlocking (ent->stream, FSETLOCKING_BYCALLER);
 209         }
 210     }
 211   else
 212     rewind (ent->stream);
 213
 214   give_spwd_free (&ent->pwd);
 215
 216   if (status == NSS_STATUS_SUCCESS && nss_setspent)
 217     ent->setent_status = nss_setspent (stayopen);
 218
 219   return status;
 220 }
 221
 222
 223 enum nss_status
 224 _nss_compat_setspent (int stayopen)
 225 {
 226   enum nss_status result;
 227
 228   __libc_lock_lock (lock);
 229
 230   if (ni == NULL)
 231     init_nss_interface ();
 232
 233   result = internal_setspent (&ext_ent, stayopen);
 234
 235   __libc_lock_unlock (lock);
 236
 237   return result;
 238 }
 239
 240
 241 static enum nss_status
 242 internal_endspent (ent_t *ent)
 243 {
 244   if (nss_endspent)
 245     nss_endspent ();
 246
 247   if (ent->stream != NULL)
 248     {
 249       fclose (ent->stream);
 250       ent->stream = NULL;
 251     }
 252
 253   if (ent->netgroup)
 254     __internal_endnetgrent (&ent->netgrdata);
 255
 256   ent->first = ent->netgroup = false;
 257   ent->files = true;
 258
 259   if (ent->blacklist.data != NULL)
 260     {
 261       ent->blacklist.current = 1;
 262       ent->blacklist.data[0] = '|';
 263       ent->blacklist.data[1] = '\0';
 264     }
 265   else
 266     ent->blacklist.current = 0;
 267
 268   give_spwd_free (&ent->pwd);
 269
 270   return NSS_STATUS_SUCCESS;
 271 }
 272
 273 enum nss_status
 274 _nss_compat_endspent (void)
 275 {
 276   enum nss_status result;
 277
 278   __libc_lock_lock (lock);
 279
 280   result = internal_endspent (&ext_ent);
 281
 282   __libc_lock_unlock (lock);
 283
 284   return result;
 285 }
 286
 287
 288 static enum nss_status
 289 getspent_next_nss_netgr (const char *name, struct spwd *result, ent_t *ent,
 290                          char *group, char *buffer, size_t buflen,
 291                          int *errnop)
 292 {
 293   char *curdomain, *host, *user, *domain, *p2;
 294   size_t p2len;
 295
 296   if (!nss_getspnam_r)
 297     return NSS_STATUS_UNAVAIL;
 298
 299   /* If the setpwent call failed, say so.  */
 300   if (ent->setent_status != NSS_STATUS_SUCCESS)
 301     return ent->setent_status;
 302
 303   if (yp_get_default_domain (&curdomain) != YPERR_SUCCESS)
 304     {
 305       ent->netgroup = false;
 306       ent->first = false;
 307       give_spwd_free (&ent->pwd);
 308       return NSS_STATUS_UNAVAIL;
 309     }
 310
 311   if (ent->first == true)
 312     {
 313       memset (&ent->netgrdata, 0, sizeof (struct __netgrent));
 314       __internal_setnetgrent (group, &ent->netgrdata);
 315       ent->first = false;
 316     }
 317
 318   while (1)
 319     {
 320       char *saved_cursor;
 321       enum nss_status status;
 322
 323       saved_cursor = ent->netgrdata.cursor;
 324       status = __internal_getnetgrent_r (&host, &user, &domain,
 325                                          &ent->netgrdata, buffer, buflen,
 326                                          errnop);
 327       if (status != 1)
 328         {
 329           __internal_endnetgrent (&ent->netgrdata);
 330           ent->netgroup = false;
 331           give_spwd_free (&ent->pwd);
 332           return NSS_STATUS_RETURN;
 333         }
 334
 335       if (user == NULL || user[0] == '-')
 336         continue;
 337
 338       if (domain != NULL && strcmp (curdomain, domain) != 0)
 339         continue;
 340
 341       /* If name != NULL, we are called from getpwnam */
 342       if (name != NULL)
 343         if (strcmp (user, name) != 0)
 344           continue;
 345
 346       p2len = spwd_need_buflen (&ent->pwd);
 347       if (p2len > buflen)
 348         {
 349           *errnop = ERANGE;
 350           return NSS_STATUS_TRYAGAIN;
 351         }
 352       p2 = buffer + (buflen - p2len);
 353       buflen -= p2len;
 354
 355       if (nss_getspnam_r (user, result, buffer, buflen, errnop) !=
 356           NSS_STATUS_SUCCESS)
 357         continue;
 358
 359       if (!in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 360         {
 361           /* Store the User in the blacklist for possible the "+" at the
 362              end of /etc/passwd */
 363           blacklist_store_name (result->sp_namp, ent);
 364           copy_spwd_changes (result, &ent->pwd, p2, p2len);
 365           break;
 366         }
 367     }
 368
 369   return NSS_STATUS_SUCCESS;
 370 }
 371
 372
 373 static enum nss_status
 374 getspent_next_nss (struct spwd *result, ent_t *ent,
 375                    char *buffer, size_t buflen, int *errnop)
 376 {
 377   enum nss_status status;
 378   char *p2;
 379   size_t p2len;
 380
 381   if (!nss_getspent_r)
 382     return NSS_STATUS_UNAVAIL;
 383
 384   p2len = spwd_need_buflen (&ent->pwd);
 385   if (p2len > buflen)
 386     {
 387       *errnop = ERANGE;
 388       return NSS_STATUS_TRYAGAIN;
 389     }
 390   p2 = buffer + (buflen - p2len);
 391   buflen -= p2len;
 392   do
 393     {
 394       if ((status = nss_getspent_r (result, buffer, buflen, errnop)) !=
 395           NSS_STATUS_SUCCESS)
 396         return status;
 397     }
 398   while (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent));
 399
 400   copy_spwd_changes (result, &ent->pwd, p2, p2len);
 401
 402   return NSS_STATUS_SUCCESS;
 403 }
 404
 405
 406 /* This function handle the +user entrys in /etc/shadow */
 407 static enum nss_status
 408 getspnam_plususer (const char *name, struct spwd *result, ent_t *ent,
 409                    char *buffer, size_t buflen, int *errnop)
 410 {
 411   if (!nss_getspnam_r)
 412     return NSS_STATUS_UNAVAIL;
 413
 414   struct spwd pwd;
 415   memset (&pwd, '\0', sizeof (struct spwd));
 416   pwd.sp_warn = -1;
 417   pwd.sp_inact = -1;
 418   pwd.sp_expire = -1;
 419   pwd.sp_flag = ~0ul;
 420
 421   copy_spwd_changes (&pwd, result, NULL, 0);
 422
 423   size_t plen = spwd_need_buflen (&pwd);
 424   if (plen > buflen)
 425     {
 426       *errnop = ERANGE;
 427       return NSS_STATUS_TRYAGAIN;
 428     }
 429   char *p = buffer + (buflen - plen);
 430   buflen -= plen;
 431
 432   enum nss_status status = nss_getspnam_r (name, result, buffer, buflen,
 433                                            errnop);
 434   if (status != NSS_STATUS_SUCCESS)
 435     return status;
 436
 437   if (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 438     return NSS_STATUS_NOTFOUND;
 439
 440   copy_spwd_changes (result, &pwd, p, plen);
 441   give_spwd_free (&pwd);
 442   /* We found the entry.  */
 443   return NSS_STATUS_SUCCESS;
 444 }
 445
 446
 447 static enum nss_status
 448 getspent_next_file (struct spwd *result, ent_t *ent,
 449                     char *buffer, size_t buflen, int *errnop)
 450 {
 451   struct parser_data *data = (void *) buffer;
 452   while (1)
 453     {
 454       fpos_t pos;
 455       int parse_res = 0;
 456       char *p;
 457
 458       do
 459         {
 460           /* We need at least 3 characters for one line.  */
 461           if (__builtin_expect (buflen < 3, 0))
 462             {
 463             erange:
 464               *errnop = ERANGE;
 465               return NSS_STATUS_TRYAGAIN;
 466             }
 467
 468           fgetpos (ent->stream, &pos);
 469           buffer[buflen - 1] = '\xff';
 470           p = fgets_unlocked (buffer, buflen, ent->stream);
 471           if (p == NULL && feof_unlocked (ent->stream))
 472             return NSS_STATUS_NOTFOUND;
 473
 474           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 475             {
 476             erange_reset:
 477               fsetpos (ent->stream, &pos);
 478               goto erange;
 479             }
 480
 481           /* Skip leading blanks.  */
 482           while (isspace (*p))
 483             ++p;
 484         }
 485       while (*p == '\0' || *p == '#'    /* Ignore empty and comment lines.  */
 486              /* Parse the line.  If it is invalid, loop to
 487                 get the next line of the file to parse.  */
 488              || !(parse_res = _nss_files_parse_spent (p, result, data,
 489                                                       buflen, errnop)));
 490
 491       if (__builtin_expect (parse_res == -1, 0))
 492         /* The parser ran out of space.  */
 493         goto erange_reset;
 494
 495       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 496         /* This is a real entry.  */
 497         break;
 498
 499       /* -@netgroup */
 500       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 501           && result->sp_namp[2] != '\0')
 502         {
 503           /* XXX Do not use fixed length buffers.  */
 504           char buf2[1024];
 505           char *user, *host, *domain;
 506           struct __netgrent netgrdata;
 507
 508           bzero (&netgrdata, sizeof (struct __netgrent));
 509           __internal_setnetgrent (&result->sp_namp[2], &netgrdata);
 510           while (__internal_getnetgrent_r (&host, &user, &domain,
 511                                            &netgrdata, buf2, sizeof (buf2),
 512                                            errnop))
 513             {
 514               if (user != NULL && user[0] != '-')
 515                 blacklist_store_name (user, ent);
 516             }
 517           __internal_endnetgrent (&netgrdata);
 518           continue;
 519         }
 520
 521       /* +@netgroup */
 522       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 523           && result->sp_namp[2] != '\0')
 524         {
 525           int status;
 526
 527           ent->netgroup = true;
 528           ent->first = true;
 529           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 530
 531           status = getspent_next_nss_netgr (NULL, result, ent,
 532                                             &result->sp_namp[2],
 533                                             buffer, buflen, errnop);
 534           if (status == NSS_STATUS_RETURN)
 535             continue;
 536           else
 537             return status;
 538         }
 539
 540       /* -user */
 541       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 542           && result->sp_namp[1] != '@')
 543         {
 544           blacklist_store_name (&result->sp_namp[1], ent);
 545           continue;
 546         }
 547
 548       /* +user */
 549       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 550           && result->sp_namp[1] != '@')
 551         {
 552           size_t len = strlen (result->sp_namp);
 553           char buf[len];
 554           enum nss_status status;
 555
 556           /* Store the User in the blacklist for the "+" at the end of
 557              /etc/passwd */
 558           memcpy (buf, &result->sp_namp[1], len);
 559           status = getspnam_plususer (&result->sp_namp[1], result, ent,
 560                                       buffer, buflen, errnop);
 561           blacklist_store_name (buf, ent);
 562
 563           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
 564             break;
 565           /* We couldn't parse the entry */
 566           else if (status == NSS_STATUS_RETURN
 567                    /* entry doesn't exist */
 568                    || status == NSS_STATUS_NOTFOUND)
 569             continue;
 570           else
 571             {
 572               if (status == NSS_STATUS_TRYAGAIN)
 573                 {
 574                   fsetpos (ent->stream, &pos);
 575                   *errnop = ERANGE;
 576                 }
 577               return status;
 578             }
 579         }
 580
 581       /* +:... */
 582       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 583         {
 584           ent->files = false;
 585           ent->first = true;
 586           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 587
 588           return getspent_next_nss (result, ent, buffer, buflen, errnop);
 589         }
 590     }
 591
 592   return NSS_STATUS_SUCCESS;
 593 }
 594
 595
 596 static enum nss_status
 597 internal_getspent_r (struct spwd *pw, ent_t *ent,
 598                      char *buffer, size_t buflen, int *errnop)
 599 {
 600   if (ent->netgroup)
 601     {
 602       enum nss_status status;
 603
 604       /* We are searching members in a netgroup */
 605       /* Since this is not the first call, we don't need the group name */
 606       status = getspent_next_nss_netgr (NULL, pw, ent, NULL, buffer,
 607                                         buflen, errnop);
 608
 609       if (status == NSS_STATUS_RETURN)
 610         return getspent_next_file (pw, ent, buffer, buflen, errnop);
 611       else
 612         return status;
 613     }
 614   else if (ent->files)
 615     return getspent_next_file (pw, ent, buffer, buflen, errnop);
 616   else
 617     return getspent_next_nss (pw, ent, buffer, buflen, errnop);
 618 }
 619
 620
 621 enum nss_status
 622 _nss_compat_getspent_r (struct spwd *pwd, char *buffer, size_t buflen,
 623                         int *errnop)
 624 {
 625   enum nss_status result = NSS_STATUS_SUCCESS;
 626
 627   __libc_lock_lock (lock);
 628
 629   /* Be prepared that the setpwent function was not called before.  */
 630   if (ni == NULL)
 631     init_nss_interface ();
 632
 633   if (ext_ent.stream == NULL)
 634     result = internal_setspent (&ext_ent, 1);
 635
 636   if (result == NSS_STATUS_SUCCESS)
 637     result = internal_getspent_r (pwd, &ext_ent, buffer, buflen, errnop);
 638
 639   __libc_lock_unlock (lock);
 640
 641   return result;
 642 }
 643
 644
 645 /* Searches in /etc/passwd and the NIS/NIS+ map for a special user */
 646 static enum nss_status
 647 internal_getspnam_r (const char *name, struct spwd *result, ent_t *ent,
 648                      char *buffer, size_t buflen, int *errnop)
 649 {
 650   struct parser_data *data = (void *) buffer;
 651
 652   while (1)
 653     {
 654       fpos_t pos;
 655       char *p;
 656       int parse_res;
 657
 658       do
 659         {
 660           /* We need at least 3 characters for one line.  */
 661           if (__builtin_expect (buflen < 3, 0))
 662             {
 663             erange:
 664               *errnop = ERANGE;
 665               return NSS_STATUS_TRYAGAIN;
 666             }
 667
 668           fgetpos (ent->stream, &pos);
 669           buffer[buflen - 1] = '\xff';
 670           p = fgets_unlocked (buffer, buflen, ent->stream);
 671           if (p == NULL && feof_unlocked (ent->stream))
 672             return NSS_STATUS_NOTFOUND;
 673
 674           if (p == NULL || buffer[buflen - 1] != '\xff')
 675             {
 676             erange_reset:
 677               fsetpos (ent->stream, &pos);
 678               goto erange;
 679             }
 680
 681           /* Terminate the line for any case.  */
 682           buffer[buflen - 1] = '\0';
 683
 684           /* Skip leading blanks.  */
 685           while (isspace (*p))
 686             ++p;
 687         }
 688       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines.  */
 689              /* Parse the line.  If it is invalid, loop to
 690                 get the next line of the file to parse.  */
 691              !(parse_res = _nss_files_parse_spent (p, result, data, buflen,
 692                                                    errnop)));
 693
 694       if (__builtin_expect (parse_res == -1, 0))
 695         /* The parser ran out of space.  */
 696         goto erange_reset;
 697
 698       /* This is a real entry.  */
 699       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 700         {
 701           if (strcmp (result->sp_namp, name) == 0)
 702             return NSS_STATUS_SUCCESS;
 703           else
 704             continue;
 705         }
 706
 707       /* -@netgroup */
 708       /* If the loaded NSS module does not support this service, add
 709          all users from a +@netgroup entry to the blacklist, too.  */
 710       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 711           && result->sp_namp[2] != '\0')
 712         {
 713           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 714             return NSS_STATUS_NOTFOUND;
 715           continue;
 716         }
 717
 718       /* +@netgroup */
 719       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 720           && result->sp_namp[2] != '\0')
 721         {
 722           enum nss_status status;
 723
 724           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 725             {
 726               status = getspnam_plususer (name, result, ent, buffer,
 727                                           buflen, errnop);
 728
 729               if (status == NSS_STATUS_RETURN)
 730                 continue;
 731
 732               return status;
 733             }
 734           continue;
 735         }
 736
 737       /* -user */
 738       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 739           && result->sp_namp[1] != '@')
 740         {
 741           if (strcmp (&result->sp_namp[1], name) == 0)
 742             return NSS_STATUS_NOTFOUND;
 743           else
 744             continue;
 745         }
 746
 747       /* +user */
 748       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 749           && result->sp_namp[1] != '@')
 750         {
 751           if (strcmp (name, &result->sp_namp[1]) == 0)
 752             {
 753               enum nss_status status;
 754
 755               status = getspnam_plususer (name, result, ent,
 756                                           buffer, buflen, errnop);
 757
 758               if (status == NSS_STATUS_RETURN)
 759                 /* We couldn't parse the entry */
 760                 return NSS_STATUS_NOTFOUND;
 761               else
 762                 return status;
 763             }
 764         }
 765
 766       /* +:... */
 767       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 768         {
 769           enum nss_status status;
 770
 771           status = getspnam_plususer (name, result, ent,
 772                                       buffer, buflen, errnop);
 773
 774           if (status == NSS_STATUS_SUCCESS)
 775             /* We found the entry. */
 776             break;
 777           else if (status == NSS_STATUS_RETURN)
 778             /* We couldn't parse the entry */
 779             return NSS_STATUS_NOTFOUND;
 780           else
 781             return status;
 782         }
 783     }
 784   return NSS_STATUS_SUCCESS;
 785 }
 786
 787
 788 enum nss_status
 789 _nss_compat_getspnam_r (const char *name, struct spwd *pwd,
 790                         char *buffer, size_t buflen, int *errnop)
 791 {
 792   enum nss_status result;
 793   ent_t ent = { false, true, false, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0},
 794                 { NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
 795
 796   if (name[0] == '-' || name[0] == '+')
 797     return NSS_STATUS_NOTFOUND;
 798
 799   __libc_lock_lock (lock);
 800
 801   if (ni == NULL)
 802     init_nss_interface ();
 803
 804   __libc_lock_unlock (lock);
 805
 806   result = internal_setspent (&ent, 0);
 807
 808   if (result == NSS_STATUS_SUCCESS)
 809     result = internal_getspnam_r (name, pwd, &ent, buffer, buflen, errnop);
 810
 811   internal_endspent (&ent);
 812
 813   return result;
 814 }
 815
 816
 817 /* Support routines for remembering -@netgroup and -user entries.
 818    The names are stored in a single string with `|' as separator. */
 819 static void
 820 blacklist_store_name (const char *name, ent_t *ent)
 821 {
 822   int namelen = strlen (name);
 823   char *tmp;
 824
 825   /* first call, setup cache */
 826   if (ent->blacklist.size == 0)
 827     {
 828       ent->blacklist.size = MAX (BLACKLIST_INITIAL_SIZE, 2 * namelen);
 829       ent->blacklist.data = malloc (ent->blacklist.size);
 830       if (ent->blacklist.data == NULL)
 831         return;
 832       ent->blacklist.data[0] = '|';
 833       ent->blacklist.data[1] = '\0';
 834       ent->blacklist.current = 1;
 835     }
 836   else
 837     {
 838       if (in_blacklist (name, namelen, ent))
 839         return;                 /* no duplicates */
 840
 841       if (ent->blacklist.current + namelen + 1 >= ent->blacklist.size)
 842         {
 843           ent->blacklist.size += MAX (BLACKLIST_INCREMENT, 2 * namelen);
 844           tmp = realloc (ent->blacklist.data, ent->blacklist.size);
 845           if (tmp == NULL)
 846             {
 847               free (ent->blacklist.data);
 848               ent->blacklist.size = 0;
 849               return;
 850             }
 851           ent->blacklist.data = tmp;
 852         }
 853     }
 854
 855   tmp = stpcpy (ent->blacklist.data + ent->blacklist.current, name);
 856   *tmp++ = '|';
 857   *tmp = '\0';
 858   ent->blacklist.current += namelen + 1;
 859
 860   return;
 861 }
 862
 863
 864 /* Returns TRUE if ent->blacklist contains name, else FALSE.  */
 865 static bool_t
 866 in_blacklist (const char *name, int namelen, ent_t *ent)
 867 {
 868   char buf[namelen + 3];
 869   char *cp;
 870
 871   if (ent->blacklist.data == NULL)
 872     return false;
 873
 874   buf[0] = '|';
 875   cp = stpcpy (&buf[1], name);
 876   *cp++ = '|';
 877   *cp = '\0';
 878   return strstr (ent->blacklist.data, buf) != NULL;
 879 }