nis/nss_compat/compat-spwd.c

   1 /* Copyright (C) 1996-1999,2001-2005,2006 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, write to the Free
  17    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  18    02111-1307 USA.  */
  19
  20 #include <ctype.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <netdb.h>
  24 #include <nss.h>
  25 #include <nsswitch.h>
  26 #include <shadow.h>
  27 #include <stdio_ext.h>
  28 #include <string.h>
  29 #include <rpc/types.h>
  30 #include <rpcsvc/ypclnt.h>
  31 #include <bits/libc-lock.h>
  32
  33 #include "netgroup.h"
  34
  35 static service_user *ni;
  36 static enum nss_status (*nss_setspent) (int stayopen);
  37 static enum nss_status (*nss_getspnam_r) (const char *name, struct spwd * sp,
  38                                           char *buffer, size_t buflen,
  39                                           int *errnop);
  40 static enum nss_status (*nss_getspent_r) (struct spwd * sp, char *buffer,
  41                                           size_t buflen, int *errnop);
  42 static enum nss_status (*nss_endspent) (void);
  43
  44 /* Get the declaration of the parser function.  */
  45 #define ENTNAME spent
  46 #define STRUCTURE spwd
  47 #define EXTERN_PARSER
  48 #include <nss/nss_files/files-parse.c>
  49
  50 /* Structure for remembering -@netgroup and -user members ... */
  51 #define BLACKLIST_INITIAL_SIZE 512
  52 #define BLACKLIST_INCREMENT 256
  53 struct blacklist_t
  54 {
  55   char *data;
  56   int current;
  57   int size;
  58 };
  59
  60 struct ent_t
  61 {
  62   bool_t netgroup;
  63   bool_t files;
  64   bool_t first;
  65   FILE *stream;
  66   struct blacklist_t blacklist;
  67   struct spwd pwd;
  68   struct __netgrent netgrdata;
  69 };
  70 typedef struct ent_t ent_t;
  71
  72 static ent_t ext_ent = {0, TRUE, 0, NULL, {NULL, 0, 0},
  73                         {NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
  74
  75 /* Protect global state against multiple changers.  */
  76 __libc_lock_define_initialized (static, lock)
  77
  78 /* Prototypes for local functions.  */
  79 static void blacklist_store_name (const char *, ent_t *);
  80 static int in_blacklist (const char *, int, ent_t *);
  81
  82 /* Initialize the NSS interface/functions. The calling function must
  83    hold the lock.  */
  84 static void
  85 init_nss_interface (void)
  86 {
  87   if (__nss_database_lookup ("shadow_compat", "passwd_compat",
  88                              "nis", &ni) >= 0)
  89     {
  90       nss_setspent = __nss_lookup_function (ni, "setspent");
  91       nss_getspnam_r = __nss_lookup_function (ni, "getspnam_r");
  92       nss_getspent_r = __nss_lookup_function (ni, "getspent_r");
  93       nss_endspent = __nss_lookup_function (ni, "endspent");
  94     }
  95 }
  96
  97 static void
  98 give_spwd_free (struct spwd *pwd)
  99 {
 100   if (pwd->sp_namp != NULL)
 101     free (pwd->sp_namp);
 102   if (pwd->sp_pwdp != NULL)
 103     free (pwd->sp_pwdp);
 104
 105   memset (pwd, '\0', sizeof (struct spwd));
 106   pwd->sp_warn = -1;
 107   pwd->sp_inact = -1;
 108   pwd->sp_expire = -1;
 109   pwd->sp_flag = ~0ul;
 110 }
 111
 112 static int
 113 spwd_need_buflen (struct spwd *pwd)
 114 {
 115   int len = 0;
 116
 117   if (pwd->sp_pwdp != NULL)
 118     len += strlen (pwd->sp_pwdp) + 1;
 119
 120   return len;
 121 }
 122
 123 static void
 124 copy_spwd_changes (struct spwd *dest, struct spwd *src,
 125                    char *buffer, size_t buflen)
 126 {
 127   if (src->sp_pwdp != NULL && strlen (src->sp_pwdp))
 128     {
 129       if (buffer == NULL)
 130         dest->sp_pwdp = strdup (src->sp_pwdp);
 131       else if (dest->sp_pwdp &&
 132                strlen (dest->sp_pwdp) >= strlen (src->sp_pwdp))
 133         strcpy (dest->sp_pwdp, src->sp_pwdp);
 134       else
 135         {
 136           dest->sp_pwdp = buffer;
 137           strcpy (dest->sp_pwdp, src->sp_pwdp);
 138           buffer += strlen (dest->sp_pwdp) + 1;
 139           buflen = buflen - (strlen (dest->sp_pwdp) + 1);
 140         }
 141     }
 142   if (src->sp_lstchg != 0)
 143     dest->sp_lstchg = src->sp_lstchg;
 144   if (src->sp_min != 0)
 145     dest->sp_min = src->sp_min;
 146   if (src->sp_max != 0)
 147     dest->sp_max = src->sp_max;
 148   if (src->sp_warn != -1)
 149     dest->sp_warn = src->sp_warn;
 150   if (src->sp_inact != -1)
 151     dest->sp_inact = src->sp_inact;
 152   if (src->sp_expire != -1)
 153     dest->sp_expire = src->sp_expire;
 154   if (src->sp_flag != ~0ul)
 155     dest->sp_flag = src->sp_flag;
 156 }
 157
 158 static enum nss_status
 159 internal_setspent (ent_t *ent, int stayopen)
 160 {
 161   enum nss_status status = NSS_STATUS_SUCCESS;
 162
 163   ent->first = ent->netgroup = 0;
 164   ent->files = TRUE;
 165
 166   /* If something was left over free it.  */
 167   if (ent->netgroup)
 168     __internal_endnetgrent (&ent->netgrdata);
 169
 170   if (ent->blacklist.data != NULL)
 171     {
 172       ent->blacklist.current = 1;
 173       ent->blacklist.data[0] = '|';
 174       ent->blacklist.data[1] = '\0';
 175     }
 176   else
 177     ent->blacklist.current = 0;
 178
 179   if (ent->stream == NULL)
 180     {
 181       ent->stream = fopen ("/etc/shadow", "rm");
 182
 183       if (ent->stream == NULL)
 184         status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
 185       else
 186         {
 187           /* We have to make sure the file is  `closed on exec'.  */
 188           int result, flags;
 189
 190           result = flags = fcntl (fileno_unlocked (ent->stream), F_GETFD, 0);
 191           if (result >= 0)
 192             {
 193               flags |= FD_CLOEXEC;
 194               result = fcntl (fileno_unlocked (ent->stream), F_SETFD, flags);
 195             }
 196           if (result < 0)
 197             {
 198               /* Something went wrong.  Close the stream and return a
 199                  failure.  */
 200               fclose (ent->stream);
 201               ent->stream = NULL;
 202               status = NSS_STATUS_UNAVAIL;
 203             }
 204           else
 205             /* We take care of locking ourself.  */
 206             __fsetlocking (ent->stream, FSETLOCKING_BYCALLER);
 207         }
 208     }
 209   else
 210     rewind (ent->stream);
 211
 212   give_spwd_free (&ent->pwd);
 213
 214   if (status == NSS_STATUS_SUCCESS && nss_setspent)
 215     {
 216       status = nss_setspent (stayopen);
 217       if (status == NSS_STATUS_UNAVAIL)
 218         status = NSS_STATUS_SUCCESS;
 219     }
 220
 221   return status;
 222 }
 223
 224
 225 enum nss_status
 226 _nss_compat_setspent (int stayopen)
 227 {
 228   enum nss_status result;
 229
 230   __libc_lock_lock (lock);
 231
 232   if (ni == NULL)
 233     init_nss_interface ();
 234
 235   result = internal_setspent (&ext_ent, stayopen);
 236
 237   __libc_lock_unlock (lock);
 238
 239   return result;
 240 }
 241
 242
 243 static enum nss_status
 244 internal_endspent (ent_t *ent)
 245 {
 246   if (nss_endspent)
 247     nss_endspent ();
 248
 249   if (ent->stream != NULL)
 250     {
 251       fclose (ent->stream);
 252       ent->stream = NULL;
 253     }
 254
 255   if (ent->netgroup)
 256     __internal_endnetgrent (&ent->netgrdata);
 257
 258   ent->first = ent->netgroup = FALSE;
 259   ent->files = TRUE;
 260
 261   if (ent->blacklist.data != NULL)
 262     {
 263       ent->blacklist.current = 1;
 264       ent->blacklist.data[0] = '|';
 265       ent->blacklist.data[1] = '\0';
 266     }
 267   else
 268     ent->blacklist.current = 0;
 269
 270   give_spwd_free (&ent->pwd);
 271
 272   return NSS_STATUS_SUCCESS;
 273 }
 274
 275 enum nss_status
 276 _nss_compat_endspent (void)
 277 {
 278   enum nss_status result;
 279
 280   __libc_lock_lock (lock);
 281
 282   result = internal_endspent (&ext_ent);
 283
 284   __libc_lock_unlock (lock);
 285
 286   return result;
 287 }
 288
 289
 290 static enum nss_status
 291 getspent_next_nss_netgr (const char *name, struct spwd *result, ent_t *ent,
 292                          char *group, char *buffer, size_t buflen,
 293                          int *errnop)
 294 {
 295   char *curdomain, *host, *user, *domain, *p2;
 296   size_t p2len;
 297
 298   if (!nss_getspnam_r)
 299     return NSS_STATUS_UNAVAIL;
 300
 301   if (yp_get_default_domain (&curdomain) != YPERR_SUCCESS)
 302     {
 303       ent->netgroup = FALSE;
 304       ent->first = FALSE;
 305       give_spwd_free (&ent->pwd);
 306       return NSS_STATUS_UNAVAIL;
 307     }
 308
 309   if (ent->first == TRUE)
 310     {
 311       memset (&ent->netgrdata, 0, sizeof (struct __netgrent));
 312       __internal_setnetgrent (group, &ent->netgrdata);
 313       ent->first = FALSE;
 314     }
 315
 316   while (1)
 317     {
 318       char *saved_cursor;
 319       enum nss_status status;
 320
 321       saved_cursor = ent->netgrdata.cursor;
 322       status = __internal_getnetgrent_r (&host, &user, &domain,
 323                                          &ent->netgrdata, buffer, buflen,
 324                                          errnop);
 325       if (status != 1)
 326         {
 327           __internal_endnetgrent (&ent->netgrdata);
 328           ent->netgroup = FALSE;
 329           give_spwd_free (&ent->pwd);
 330           return NSS_STATUS_RETURN;
 331         }
 332
 333       if (user == NULL || user[0] == '-')
 334         continue;
 335
 336       if (domain != NULL && strcmp (curdomain, domain) != 0)
 337         continue;
 338
 339       /* If name != NULL, we are called from getpwnam */
 340       if (name != NULL)
 341         if (strcmp (user, name) != 0)
 342           continue;
 343
 344       p2len = spwd_need_buflen (&ent->pwd);
 345       if (p2len > buflen)
 346         {
 347           *errnop = ERANGE;
 348           return NSS_STATUS_TRYAGAIN;
 349         }
 350       p2 = buffer + (buflen - p2len);
 351       buflen -= p2len;
 352
 353       if (nss_getspnam_r (user, result, buffer, buflen, errnop) !=
 354           NSS_STATUS_SUCCESS)
 355         continue;
 356
 357       if (!in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 358         {
 359           /* Store the User in the blacklist for possible the "+" at the
 360              end of /etc/passwd */
 361           blacklist_store_name (result->sp_namp, ent);
 362           copy_spwd_changes (result, &ent->pwd, p2, p2len);
 363           break;
 364         }
 365     }
 366
 367   return NSS_STATUS_SUCCESS;
 368 }
 369
 370
 371 static enum nss_status
 372 getspent_next_nss (struct spwd *result, ent_t *ent,
 373                    char *buffer, size_t buflen, int *errnop)
 374 {
 375   enum nss_status status;
 376   char *p2;
 377   size_t p2len;
 378
 379   if (!nss_getspent_r)
 380     return NSS_STATUS_UNAVAIL;
 381
 382   p2len = spwd_need_buflen (&ent->pwd);
 383   if (p2len > buflen)
 384     {
 385       *errnop = ERANGE;
 386       return NSS_STATUS_TRYAGAIN;
 387     }
 388   p2 = buffer + (buflen - p2len);
 389   buflen -= p2len;
 390   do
 391     {
 392       if ((status = nss_getspent_r (result, buffer, buflen, errnop)) !=
 393           NSS_STATUS_SUCCESS)
 394         return status;
 395     }
 396   while (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent));
 397
 398   copy_spwd_changes (result, &ent->pwd, p2, p2len);
 399
 400   return NSS_STATUS_SUCCESS;
 401 }
 402
 403 /* This function handle the +user entrys in /etc/shadow */
 404 static enum nss_status
 405 getspnam_plususer (const char *name, struct spwd *result, ent_t *ent,
 406                    char *buffer, size_t buflen, int *errnop)
 407 {
 408   if (!nss_getspnam_r)
 409     return NSS_STATUS_UNAVAIL;
 410
 411   struct spwd pwd;
 412   memset (&pwd, '\0', sizeof (struct spwd));
 413   pwd.sp_warn = -1;
 414   pwd.sp_inact = -1;
 415   pwd.sp_expire = -1;
 416   pwd.sp_flag = ~0ul;
 417
 418   copy_spwd_changes (&pwd, result, NULL, 0);
 419
 420   size_t plen = spwd_need_buflen (&pwd);
 421   if (plen > buflen)
 422     {
 423       *errnop = ERANGE;
 424       return NSS_STATUS_TRYAGAIN;
 425     }
 426   char *p = buffer + (buflen - plen);
 427   buflen -= plen;
 428
 429   enum nss_status status = nss_getspnam_r (name, result, buffer, buflen,
 430                                            errnop);
 431   if (status != NSS_STATUS_SUCCESS)
 432     return status;
 433
 434   if (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 435     return NSS_STATUS_NOTFOUND;
 436
 437   copy_spwd_changes (result, &pwd, p, plen);
 438   give_spwd_free (&pwd);
 439   /* We found the entry.  */
 440   return NSS_STATUS_SUCCESS;
 441 }
 442
 443 static enum nss_status
 444 getspent_next_file (struct spwd *result, ent_t *ent,
 445                     char *buffer, size_t buflen, int *errnop)
 446 {
 447   struct parser_data *data = (void *) buffer;
 448   while (1)
 449     {
 450       fpos_t pos;
 451       int parse_res = 0;
 452       char *p;
 453
 454       do
 455         {
 456           /* We need at least 3 characters for one line.  */
 457           if (__builtin_expect (buflen < 3, 0))
 458             {
 459             erange:
 460               *errnop = ERANGE;
 461               return NSS_STATUS_TRYAGAIN;
 462             }
 463
 464           fgetpos (ent->stream, &pos);
 465           buffer[buflen - 1] = '\xff';
 466           p = fgets_unlocked (buffer, buflen, ent->stream);
 467           if (p == NULL && feof_unlocked (ent->stream))
 468             return NSS_STATUS_NOTFOUND;
 469
 470           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 471             {
 472             erange_reset:
 473               fsetpos (ent->stream, &pos);
 474               goto erange;
 475             }
 476
 477           /* Skip leading blanks.  */
 478           while (isspace (*p))
 479             ++p;
 480         }
 481       while (*p == '\0' || *p == '#'    /* Ignore empty and comment lines.  */
 482              /* Parse the line.  If it is invalid, loop to
 483                 get the next line of the file to parse.  */
 484              || !(parse_res = _nss_files_parse_spent (p, result, data,
 485                                                       buflen, errnop)));
 486
 487       if (__builtin_expect (parse_res == -1, 0))
 488         /* The parser ran out of space.  */
 489         goto erange_reset;
 490
 491       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 492         /* This is a real entry.  */
 493         break;
 494
 495       /* -@netgroup */
 496       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 497           && result->sp_namp[2] != '\0')
 498         {
 499           /* XXX Do not use fixed length buffers.  */
 500           char buf2[1024];
 501           char *user, *host, *domain;
 502           struct __netgrent netgrdata;
 503
 504           bzero (&netgrdata, sizeof (struct __netgrent));
 505           __internal_setnetgrent (&result->sp_namp[2], &netgrdata);
 506           while (__internal_getnetgrent_r (&host, &user, &domain,
 507                                            &netgrdata, buf2, sizeof (buf2),
 508                                            errnop))
 509             {
 510               if (user != NULL && user[0] != '-')
 511                 blacklist_store_name (user, ent);
 512             }
 513           __internal_endnetgrent (&netgrdata);
 514           continue;
 515         }
 516
 517       /* +@netgroup */
 518       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 519           && result->sp_namp[2] != '\0')
 520         {
 521           int status;
 522
 523           ent->netgroup = TRUE;
 524           ent->first = TRUE;
 525           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 526
 527           status = getspent_next_nss_netgr (NULL, result, ent,
 528                                             &result->sp_namp[2],
 529                                             buffer, buflen, errnop);
 530           if (status == NSS_STATUS_RETURN)
 531             continue;
 532           else
 533             return status;
 534         }
 535
 536       /* -user */
 537       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 538           && result->sp_namp[1] != '@')
 539         {
 540           blacklist_store_name (&result->sp_namp[1], ent);
 541           continue;
 542         }
 543
 544       /* +user */
 545       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 546           && result->sp_namp[1] != '@')
 547         {
 548           size_t len = strlen (result->sp_namp);
 549           char buf[len];
 550           enum nss_status status;
 551
 552           /* Store the User in the blacklist for the "+" at the end of
 553              /etc/passwd */
 554           memcpy (buf, &result->sp_namp[1], len);
 555           status = getspnam_plususer (&result->sp_namp[1], result, ent,
 556                                       buffer, buflen, errnop);
 557           blacklist_store_name (buf, ent);
 558
 559           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
 560             break;
 561           /* We couldn't parse the entry */
 562           else if (status == NSS_STATUS_RETURN
 563                    /* entry doesn't exist */
 564                    || status == NSS_STATUS_NOTFOUND)
 565             continue;
 566           else
 567             {
 568               if (status == NSS_STATUS_TRYAGAIN)
 569                 {
 570                   fsetpos (ent->stream, &pos);
 571                   *errnop = ERANGE;
 572                 }
 573               return status;
 574             }
 575         }
 576
 577       /* +:... */
 578       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 579         {
 580           ent->files = FALSE;
 581           ent->first = TRUE;
 582           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 583
 584           return getspent_next_nss (result, ent, buffer, buflen, errnop);
 585         }
 586     }
 587
 588   return NSS_STATUS_SUCCESS;
 589 }
 590
 591
 592 static enum nss_status
 593 internal_getspent_r (struct spwd *pw, ent_t *ent,
 594                      char *buffer, size_t buflen, int *errnop)
 595 {
 596   if (ent->netgroup)
 597     {
 598       enum nss_status status;
 599
 600       /* We are searching members in a netgroup */
 601       /* Since this is not the first call, we don't need the group name */
 602       status = getspent_next_nss_netgr (NULL, pw, ent, NULL, buffer,
 603                                         buflen, errnop);
 604
 605       if (status == NSS_STATUS_RETURN)
 606         return getspent_next_file (pw, ent, buffer, buflen, errnop);
 607       else
 608         return status;
 609     }
 610   else if (ent->files)
 611     return getspent_next_file (pw, ent, buffer, buflen, errnop);
 612   else
 613     return getspent_next_nss (pw, ent, buffer, buflen, errnop);
 614 }
 615
 616 enum nss_status
 617 _nss_compat_getspent_r (struct spwd *pwd, char *buffer, size_t buflen,
 618                         int *errnop)
 619 {
 620   enum nss_status result = NSS_STATUS_SUCCESS;
 621
 622   __libc_lock_lock (lock);
 623
 624   /* Be prepared that the setpwent function was not called before.  */
 625   if (ni == NULL)
 626     init_nss_interface ();
 627
 628   if (ext_ent.stream == NULL)
 629     result = internal_setspent (&ext_ent, 1);
 630
 631   if (result == NSS_STATUS_SUCCESS)
 632     result = internal_getspent_r (pwd, &ext_ent, buffer, buflen, errnop);
 633
 634   __libc_lock_unlock (lock);
 635
 636   return result;
 637 }
 638
 639 /* Searches in /etc/passwd and the NIS/NIS+ map for a special user */
 640 static enum nss_status
 641 internal_getspnam_r (const char *name, struct spwd *result, ent_t *ent,
 642                      char *buffer, size_t buflen, int *errnop)
 643 {
 644   struct parser_data *data = (void *) buffer;
 645
 646   while (1)
 647     {
 648       fpos_t pos;
 649       char *p;
 650       int parse_res;
 651
 652       do
 653         {
 654           /* We need at least 3 characters for one line.  */
 655           if (__builtin_expect (buflen < 3, 0))
 656             {
 657             erange:
 658               *errnop = ERANGE;
 659               return NSS_STATUS_TRYAGAIN;
 660             }
 661
 662           fgetpos (ent->stream, &pos);
 663           buffer[buflen - 1] = '\xff';
 664           p = fgets_unlocked (buffer, buflen, ent->stream);
 665           if (p == NULL && feof_unlocked (ent->stream))
 666             return NSS_STATUS_NOTFOUND;
 667
 668           if (p == NULL || buffer[buflen - 1] != '\xff')
 669             {
 670             erange_reset:
 671               fsetpos (ent->stream, &pos);
 672               goto erange;
 673             }
 674
 675           /* Terminate the line for any case.  */
 676           buffer[buflen - 1] = '\0';
 677
 678           /* Skip leading blanks.  */
 679           while (isspace (*p))
 680             ++p;
 681         }
 682       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines.  */
 683              /* Parse the line.  If it is invalid, loop to
 684                 get the next line of the file to parse.  */
 685              !(parse_res = _nss_files_parse_spent (p, result, data, buflen,
 686                                                    errnop)));
 687
 688       if (__builtin_expect (parse_res == -1, 0))
 689         /* The parser ran out of space.  */
 690         goto erange_reset;
 691
 692       /* This is a real entry.  */
 693       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 694         {
 695           if (strcmp (result->sp_namp, name) == 0)
 696             return NSS_STATUS_SUCCESS;
 697           else
 698             continue;
 699         }
 700
 701       /* -@netgroup */
 702       /* If the loaded NSS module does not support this service, add
 703          all users from a +@netgroup entry to the blacklist, too.  */
 704       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 705           && result->sp_namp[2] != '\0')
 706         {
 707           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 708             return NSS_STATUS_NOTFOUND;
 709           continue;
 710         }
 711
 712       /* +@netgroup */
 713       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 714           && result->sp_namp[2] != '\0')
 715         {
 716           enum nss_status status;
 717
 718           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 719             {
 720               status = getspnam_plususer (name, result, ent, buffer,
 721                                           buflen, errnop);
 722
 723               if (status == NSS_STATUS_RETURN)
 724                 continue;
 725
 726               return status;
 727             }
 728           continue;
 729         }
 730
 731       /* -user */
 732       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 733           && result->sp_namp[1] != '@')
 734         {
 735           if (strcmp (&result->sp_namp[1], name) == 0)
 736             return NSS_STATUS_NOTFOUND;
 737           else
 738             continue;
 739         }
 740
 741       /* +user */
 742       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 743           && result->sp_namp[1] != '@')
 744         {
 745           if (strcmp (name, &result->sp_namp[1]) == 0)
 746             {
 747               enum nss_status status;
 748
 749               status = getspnam_plususer (name, result, ent,
 750                                           buffer, buflen, errnop);
 751
 752               if (status == NSS_STATUS_RETURN)
 753                 /* We couldn't parse the entry */
 754                 return NSS_STATUS_NOTFOUND;
 755               else
 756                 return status;
 757             }
 758         }
 759
 760       /* +:... */
 761       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 762         {
 763           enum nss_status status;
 764
 765           status = getspnam_plususer (name, result, ent,
 766                                       buffer, buflen, errnop);
 767
 768           if (status == NSS_STATUS_SUCCESS)
 769             /* We found the entry. */
 770             break;
 771           else if (status == NSS_STATUS_RETURN)
 772             /* We couldn't parse the entry */
 773             return NSS_STATUS_NOTFOUND;
 774           else
 775             return status;
 776         }
 777     }
 778   return NSS_STATUS_SUCCESS;
 779 }
 780
 781 enum nss_status
 782 _nss_compat_getspnam_r (const char *name, struct spwd *pwd,
 783                         char *buffer, size_t buflen, int *errnop)
 784 {
 785   enum nss_status result;
 786   ent_t ent = {0, TRUE, 0, NULL, {NULL, 0, 0},
 787                {NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
 788
 789   if (name[0] == '-' || name[0] == '+')
 790     return NSS_STATUS_NOTFOUND;
 791
 792   __libc_lock_lock (lock);
 793
 794   if (ni == NULL)
 795     init_nss_interface ();
 796
 797   __libc_lock_unlock (lock);
 798
 799   result = internal_setspent (&ent, 0);
 800
 801   if (result == NSS_STATUS_SUCCESS)
 802     result = internal_getspnam_r (name, pwd, &ent, buffer, buflen, errnop);
 803
 804   internal_endspent (&ent);
 805
 806   return result;
 807 }
 808
 809 /* Support routines for remembering -@netgroup and -user entries.
 810    The names are stored in a single string with `|' as separator. */
 811 static void
 812 blacklist_store_name (const char *name, ent_t *ent)
 813 {
 814   int namelen = strlen (name);
 815   char *tmp;
 816
 817   /* first call, setup cache */
 818   if (ent->blacklist.size == 0)
 819     {
 820       ent->blacklist.size = MAX (BLACKLIST_INITIAL_SIZE, 2 * namelen);
 821       ent->blacklist.data = malloc (ent->blacklist.size);
 822       if (ent->blacklist.data == NULL)
 823         return;
 824       ent->blacklist.data[0] = '|';
 825       ent->blacklist.data[1] = '\0';
 826       ent->blacklist.current = 1;
 827     }
 828   else
 829     {
 830       if (in_blacklist (name, namelen, ent))
 831         return;                 /* no duplicates */
 832
 833       if (ent->blacklist.current + namelen + 1 >= ent->blacklist.size)
 834         {
 835           ent->blacklist.size += MAX (BLACKLIST_INCREMENT, 2 * namelen);
 836           tmp = realloc (ent->blacklist.data, ent->blacklist.size);
 837           if (tmp == NULL)
 838             {
 839               free (ent->blacklist.data);
 840               ent->blacklist.size = 0;
 841               return;
 842             }
 843           ent->blacklist.data = tmp;
 844         }
 845     }
 846
 847   tmp = stpcpy (ent->blacklist.data + ent->blacklist.current, name);
 848   *tmp++ = '|';
 849   *tmp = '\0';
 850   ent->blacklist.current += namelen + 1;
 851
 852   return;
 853 }
 854
 855 /* Returns TRUE if ent->blacklist contains name, else FALSE.  */
 856 static bool_t
 857 in_blacklist (const char *name, int namelen, ent_t *ent)
 858 {
 859   char buf[namelen + 3];
 860   char *cp;
 861
 862   if (ent->blacklist.data == NULL)
 863     return FALSE;
 864
 865   buf[0] = '|';
 866   cp = stpcpy (&buf[1], name);
 867   *cp++ = '|';
 868   *cp = '\0';
 869   return strstr (ent->blacklist.data, buf) != NULL;
 870 }