nis/nss_compat/compat-pwd.c

   1 /* Copyright (C) 1996-1999,2001-2006,2007,2011
   2         Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, write to the Free
  18    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  19    02111-1307 USA.  */
  20
  21 #include <ctype.h>
  22 #include <errno.h>
  23 #include <fcntl.h>
  24 #include <netdb.h>
  25 #include <nss.h>
  26 #include <nsswitch.h>
  27 #include <pwd.h>
  28 #include <stdio_ext.h>
  29 #include <string.h>
  30 #include <rpc/types.h>
  31 #include <rpcsvc/ypclnt.h>
  32 #include <bits/libc-lock.h>
  33 #include <kernel-features.h>
  34
  35 #include "netgroup.h"
  36
  37 static service_user *ni;
  38 static enum nss_status (*nss_setpwent) (int stayopen);
  39 static enum nss_status (*nss_getpwnam_r) (const char *name,
  40                                           struct passwd * pwd, char *buffer,
  41                                           size_t buflen, int *errnop);
  42 static enum nss_status (*nss_getpwuid_r) (uid_t uid, struct passwd * pwd,
  43                                           char *buffer, size_t buflen,
  44                                           int *errnop);
  45 static enum nss_status (*nss_getpwent_r) (struct passwd * pwd, char *buffer,
  46                                           size_t buflen, int *errnop);
  47 static enum nss_status (*nss_endpwent) (void);
  48
  49 /* Get the declaration of the parser function.  */
  50 #define ENTNAME pwent
  51 #define STRUCTURE passwd
  52 #define EXTERN_PARSER
  53 #include <nss/nss_files/files-parse.c>
  54
  55 /* Structure for remembering -@netgroup and -user members ... */
  56 #define BLACKLIST_INITIAL_SIZE 512
  57 #define BLACKLIST_INCREMENT 256
  58 struct blacklist_t
  59 {
  60   char *data;
  61   int current;
  62   int size;
  63 };
  64
  65 struct ent_t
  66 {
  67   bool netgroup;
  68   bool first;
  69   bool files;
  70   enum nss_status setent_status;
  71   FILE *stream;
  72   struct blacklist_t blacklist;
  73   struct passwd pwd;
  74   struct __netgrent netgrdata;
  75 };
  76 typedef struct ent_t ent_t;
  77
  78 static ent_t ext_ent = { false, false, true, NSS_STATUS_SUCCESS, NULL,
  79                          { NULL, 0, 0 },
  80                          { NULL, NULL, 0, 0, NULL, NULL, NULL }};
  81
  82 /* Protect global state against multiple changers.  */
  83 __libc_lock_define_initialized (static, lock)
  84
  85 /* Positive if O_CLOEXEC is supported, negative if it is not supported,
  86    zero if it is still undecided.  This variable is shared with the
  87    other compat functions.  */
  88 #ifdef __ASSUME_O_CLOEXEC
  89 # define __compat_have_cloexec 1
  90 #else
  91 # ifdef O_CLOEXEC
  92 extern int __compat_have_cloexec;
  93 # else
  94 #  define __compat_have_cloexec -1
  95 # endif
  96 #endif
  97
  98 /* Prototypes for local functions.  */
  99 static void blacklist_store_name (const char *, ent_t *);
 100 static int in_blacklist (const char *, int, ent_t *);
 101
 102 /* Initialize the NSS interface/functions. The calling function must
 103    hold the lock.  */
 104 static void
 105 init_nss_interface (void)
 106 {
 107   if (__nss_database_lookup ("passwd_compat", NULL, "nis", &ni) >= 0)
 108     {
 109       nss_setpwent = __nss_lookup_function (ni, "setpwent");
 110       nss_getpwnam_r = __nss_lookup_function (ni, "getpwnam_r");
 111       nss_getpwuid_r = __nss_lookup_function (ni, "getpwuid_r");
 112       nss_getpwent_r = __nss_lookup_function (ni, "getpwent_r");
 113       nss_endpwent = __nss_lookup_function (ni, "endpwent");
 114     }
 115 }
 116
 117 static void
 118 give_pwd_free (struct passwd *pwd)
 119 {
 120   free (pwd->pw_name);
 121   free (pwd->pw_passwd);
 122   free (pwd->pw_gecos);
 123   free (pwd->pw_dir);
 124   free (pwd->pw_shell);
 125
 126   memset (pwd, '\0', sizeof (struct passwd));
 127 }
 128
 129 static size_t
 130 pwd_need_buflen (struct passwd *pwd)
 131 {
 132   size_t len = 0;
 133
 134   if (pwd->pw_passwd != NULL)
 135     len += strlen (pwd->pw_passwd) + 1;
 136
 137   if (pwd->pw_gecos != NULL)
 138     len += strlen (pwd->pw_gecos) + 1;
 139
 140   if (pwd->pw_dir != NULL)
 141     len += strlen (pwd->pw_dir) + 1;
 142
 143   if (pwd->pw_shell != NULL)
 144     len += strlen (pwd->pw_shell) + 1;
 145
 146   return len;
 147 }
 148
 149 static void
 150 copy_pwd_changes (struct passwd *dest, struct passwd *src,
 151                   char *buffer, size_t buflen)
 152 {
 153   if (src->pw_passwd != NULL && strlen (src->pw_passwd))
 154     {
 155       if (buffer == NULL)
 156         dest->pw_passwd = strdup (src->pw_passwd);
 157       else if (dest->pw_passwd &&
 158                strlen (dest->pw_passwd) >= strlen (src->pw_passwd))
 159         strcpy (dest->pw_passwd, src->pw_passwd);
 160       else
 161         {
 162           dest->pw_passwd = buffer;
 163           strcpy (dest->pw_passwd, src->pw_passwd);
 164           buffer += strlen (dest->pw_passwd) + 1;
 165           buflen = buflen - (strlen (dest->pw_passwd) + 1);
 166         }
 167     }
 168
 169   if (src->pw_gecos != NULL && strlen (src->pw_gecos))
 170     {
 171       if (buffer == NULL)
 172         dest->pw_gecos = strdup (src->pw_gecos);
 173       else if (dest->pw_gecos &&
 174                strlen (dest->pw_gecos) >= strlen (src->pw_gecos))
 175         strcpy (dest->pw_gecos, src->pw_gecos);
 176       else
 177         {
 178           dest->pw_gecos = buffer;
 179           strcpy (dest->pw_gecos, src->pw_gecos);
 180           buffer += strlen (dest->pw_gecos) + 1;
 181           buflen = buflen - (strlen (dest->pw_gecos) + 1);
 182         }
 183     }
 184   if (src->pw_dir != NULL && strlen (src->pw_dir))
 185     {
 186       if (buffer == NULL)
 187         dest->pw_dir = strdup (src->pw_dir);
 188       else if (dest->pw_dir && strlen (dest->pw_dir) >= strlen (src->pw_dir))
 189         strcpy (dest->pw_dir, src->pw_dir);
 190       else
 191         {
 192           dest->pw_dir = buffer;
 193           strcpy (dest->pw_dir, src->pw_dir);
 194           buffer += strlen (dest->pw_dir) + 1;
 195           buflen = buflen - (strlen (dest->pw_dir) + 1);
 196         }
 197     }
 198
 199   if (src->pw_shell != NULL && strlen (src->pw_shell))
 200     {
 201       if (buffer == NULL)
 202         dest->pw_shell = strdup (src->pw_shell);
 203       else if (dest->pw_shell &&
 204                strlen (dest->pw_shell) >= strlen (src->pw_shell))
 205         strcpy (dest->pw_shell, src->pw_shell);
 206       else
 207         {
 208           dest->pw_shell = buffer;
 209           strcpy (dest->pw_shell, src->pw_shell);
 210           buffer += strlen (dest->pw_shell) + 1;
 211           buflen = buflen - (strlen (dest->pw_shell) + 1);
 212         }
 213     }
 214 }
 215
 216 static enum nss_status
 217 internal_setpwent (ent_t *ent, int stayopen, int needent)
 218 {
 219   enum nss_status status = NSS_STATUS_SUCCESS;
 220
 221   ent->first = ent->netgroup = false;
 222   ent->files = true;
 223   ent->setent_status = NSS_STATUS_SUCCESS;
 224
 225   /* If something was left over free it.  */
 226   if (ent->netgroup)
 227     __internal_endnetgrent (&ent->netgrdata);
 228
 229   if (ent->blacklist.data != NULL)
 230     {
 231       ent->blacklist.current = 1;
 232       ent->blacklist.data[0] = '|';
 233       ent->blacklist.data[1] = '\0';
 234     }
 235   else
 236     ent->blacklist.current = 0;
 237
 238   if (ent->stream == NULL)
 239     {
 240       ent->stream = fopen ("/etc/passwd", "rme");
 241
 242       if (ent->stream == NULL)
 243         status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
 244       else
 245         {
 246           /* We have to make sure the file is  `closed on exec'.  */
 247           int result = 0;
 248
 249           if (__compat_have_cloexec <= 0)
 250             {
 251               int flags;
 252               result = flags = fcntl (fileno_unlocked (ent->stream), F_GETFD,
 253                                       0);
 254               if (result >= 0)
 255                 {
 256 #if defined O_CLOEXEC && !defined __ASSUME_O_CLOEXEC
 257                   if (__compat_have_cloexec == 0)
 258                     __compat_have_cloexec = (flags & FD_CLOEXEC) ? 1 : -1;
 259
 260                   if (__compat_have_cloexec < 0)
 261 #endif
 262                     {
 263                       flags |= FD_CLOEXEC;
 264                       result = fcntl (fileno_unlocked (ent->stream), F_SETFD,
 265                                       flags);
 266                     }
 267                 }
 268             }
 269
 270           if (result < 0)
 271             {
 272               /* Something went wrong.  Close the stream and return a
 273                  failure.  */
 274               fclose (ent->stream);
 275               ent->stream = NULL;
 276               status = NSS_STATUS_UNAVAIL;
 277             }
 278           else
 279             /* We take care of locking ourself.  */
 280             __fsetlocking (ent->stream, FSETLOCKING_BYCALLER);
 281         }
 282     }
 283   else
 284     rewind (ent->stream);
 285
 286   give_pwd_free (&ent->pwd);
 287
 288   if (needent && status == NSS_STATUS_SUCCESS && nss_setpwent)
 289     ent->setent_status = nss_setpwent (stayopen);
 290
 291   return status;
 292 }
 293
 294
 295 enum nss_status
 296 _nss_compat_setpwent (int stayopen)
 297 {
 298   enum nss_status result;
 299
 300   __libc_lock_lock (lock);
 301
 302   if (ni == NULL)
 303     init_nss_interface ();
 304
 305   result = internal_setpwent (&ext_ent, stayopen, 1);
 306
 307   __libc_lock_unlock (lock);
 308
 309   return result;
 310 }
 311
 312
 313 static enum nss_status
 314 internal_endpwent (ent_t *ent)
 315 {
 316   if (nss_endpwent)
 317     nss_endpwent ();
 318
 319   if (ent->stream != NULL)
 320     {
 321       fclose (ent->stream);
 322       ent->stream = NULL;
 323     }
 324
 325   if (ent->netgroup)
 326     __internal_endnetgrent (&ent->netgrdata);
 327
 328   ent->first = ent->netgroup = false;
 329
 330   if (ent->blacklist.data != NULL)
 331     {
 332       ent->blacklist.current = 1;
 333       ent->blacklist.data[0] = '|';
 334       ent->blacklist.data[1] = '\0';
 335     }
 336   else
 337     ent->blacklist.current = 0;
 338
 339   give_pwd_free (&ent->pwd);
 340
 341   return NSS_STATUS_SUCCESS;
 342 }
 343
 344 enum nss_status
 345 _nss_compat_endpwent (void)
 346 {
 347   enum nss_status result;
 348
 349   __libc_lock_lock (lock);
 350
 351   result = internal_endpwent (&ext_ent);
 352
 353   __libc_lock_unlock (lock);
 354
 355   return result;
 356 }
 357
 358
 359 static enum nss_status
 360 getpwent_next_nss_netgr (const char *name, struct passwd *result, ent_t *ent,
 361                          char *group, char *buffer, size_t buflen,
 362                          int *errnop)
 363 {
 364   char *curdomain = NULL, *host, *user, *domain, *p2;
 365   int status;
 366   size_t p2len;
 367
 368   /* Leave function if NSS module does not support getpwnam_r,
 369      we need this function here.  */
 370   if (!nss_getpwnam_r)
 371     return NSS_STATUS_UNAVAIL;
 372
 373   if (ent->first)
 374     {
 375       memset (&ent->netgrdata, 0, sizeof (struct __netgrent));
 376       __internal_setnetgrent (group, &ent->netgrdata);
 377       ent->first = false;
 378     }
 379
 380   while (1)
 381     {
 382       status = __internal_getnetgrent_r (&host, &user, &domain,
 383                                          &ent->netgrdata, buffer, buflen,
 384                                          errnop);
 385       if (status != 1)
 386         {
 387           __internal_endnetgrent (&ent->netgrdata);
 388           ent->netgroup = 0;
 389           give_pwd_free (&ent->pwd);
 390           return NSS_STATUS_RETURN;
 391         }
 392
 393       if (user == NULL || user[0] == '-')
 394         continue;
 395
 396       if (domain != NULL)
 397         {
 398           if (curdomain == NULL
 399               && yp_get_default_domain (&curdomain) != YPERR_SUCCESS)
 400             {
 401               __internal_endnetgrent (&ent->netgrdata);
 402               ent->netgroup = false;
 403               give_pwd_free (&ent->pwd);
 404               return NSS_STATUS_UNAVAIL;
 405             }
 406           if (strcmp (curdomain, domain) != 0)
 407             continue;
 408         }
 409
 410       /* If name != NULL, we are called from getpwnam.  */
 411       if (name != NULL)
 412         if (strcmp (user, name) != 0)
 413           continue;
 414
 415       p2len = pwd_need_buflen (&ent->pwd);
 416       if (p2len > buflen)
 417         {
 418           *errnop = ERANGE;
 419           return NSS_STATUS_TRYAGAIN;
 420         }
 421       p2 = buffer + (buflen - p2len);
 422       buflen -= p2len;
 423
 424       if (nss_getpwnam_r (user, result, buffer, buflen, errnop) !=
 425           NSS_STATUS_SUCCESS)
 426         continue;
 427
 428       if (!in_blacklist (result->pw_name, strlen (result->pw_name), ent))
 429         {
 430           /* Store the User in the blacklist for possible the "+" at the
 431              end of /etc/passwd */
 432           blacklist_store_name (result->pw_name, ent);
 433           copy_pwd_changes (result, &ent->pwd, p2, p2len);
 434           break;
 435         }
 436     }
 437
 438   return NSS_STATUS_SUCCESS;
 439 }
 440
 441 /* get the next user from NSS  (+ entry) */
 442 static enum nss_status
 443 getpwent_next_nss (struct passwd *result, ent_t *ent, char *buffer,
 444                    size_t buflen, int *errnop)
 445 {
 446   enum nss_status status;
 447   char *p2;
 448   size_t p2len;
 449
 450   /* Return if NSS module does not support getpwent_r.  */
 451   if (!nss_getpwent_r)
 452     return NSS_STATUS_UNAVAIL;
 453
 454   /* If the setpwent call failed, say so.  */
 455   if (ent->setent_status != NSS_STATUS_SUCCESS)
 456     return ent->setent_status;
 457
 458   p2len = pwd_need_buflen (&ent->pwd);
 459   if (p2len > buflen)
 460     {
 461       *errnop = ERANGE;
 462       return NSS_STATUS_TRYAGAIN;
 463     }
 464   p2 = buffer + (buflen - p2len);
 465   buflen -= p2len;
 466
 467   if (ent->first)
 468     ent->first = false;
 469
 470   do
 471     {
 472       if ((status = nss_getpwent_r (result, buffer, buflen, errnop)) !=
 473           NSS_STATUS_SUCCESS)
 474         return status;
 475     }
 476   while (in_blacklist (result->pw_name, strlen (result->pw_name), ent));
 477
 478   copy_pwd_changes (result, &ent->pwd, p2, p2len);
 479
 480   return NSS_STATUS_SUCCESS;
 481 }
 482
 483 /* This function handle the +user entrys in /etc/passwd */
 484 static enum nss_status
 485 getpwnam_plususer (const char *name, struct passwd *result, ent_t *ent,
 486                    char *buffer, size_t buflen, int *errnop)
 487 {
 488   if (!nss_getpwnam_r)
 489     return NSS_STATUS_UNAVAIL;
 490
 491   struct passwd pwd;
 492   memset (&pwd, '\0', sizeof (struct passwd));
 493
 494   copy_pwd_changes (&pwd, result, NULL, 0);
 495
 496   size_t plen = pwd_need_buflen (&pwd);
 497   if (plen > buflen)
 498     {
 499       *errnop = ERANGE;
 500       return NSS_STATUS_TRYAGAIN;
 501     }
 502   char *p = buffer + (buflen - plen);
 503   buflen -= plen;
 504
 505   enum nss_status status = nss_getpwnam_r (name, result, buffer, buflen,
 506                                            errnop);
 507   if (status != NSS_STATUS_SUCCESS)
 508     return status;
 509
 510   if (in_blacklist (result->pw_name, strlen (result->pw_name), ent))
 511     return NSS_STATUS_NOTFOUND;
 512
 513   copy_pwd_changes (result, &pwd, p, plen);
 514   give_pwd_free (&pwd);
 515   /* We found the entry.  */
 516   return NSS_STATUS_SUCCESS;
 517 }
 518
 519 static enum nss_status
 520 getpwent_next_file (struct passwd *result, ent_t *ent,
 521                     char *buffer, size_t buflen, int *errnop)
 522 {
 523   struct parser_data *data = (void *) buffer;
 524   while (1)
 525     {
 526       fpos_t pos;
 527       char *p;
 528       int parse_res;
 529
 530       do
 531         {
 532           /* We need at least 3 characters for one line.  */
 533           if (__builtin_expect (buflen < 3, 0))
 534             {
 535             erange:
 536               *errnop = ERANGE;
 537               return NSS_STATUS_TRYAGAIN;
 538             }
 539
 540           fgetpos (ent->stream, &pos);
 541           buffer[buflen - 1] = '\xff';
 542           p = fgets_unlocked (buffer, buflen, ent->stream);
 543           if (p == NULL && feof_unlocked (ent->stream))
 544             return NSS_STATUS_NOTFOUND;
 545
 546           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 547             {
 548             erange_reset:
 549               fsetpos (ent->stream, &pos);
 550               goto erange;
 551             }
 552
 553           /* Terminate the line for any case.  */
 554           buffer[buflen - 1] = '\0';
 555
 556           /* Skip leading blanks.  */
 557           while (isspace (*p))
 558             ++p;
 559         }
 560       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines.  */
 561              /* Parse the line.  If it is invalid, loop to
 562                 get the next line of the file to parse.  */
 563              !(parse_res = _nss_files_parse_pwent (p, result, data, buflen,
 564                                                    errnop)));
 565
 566       if (__builtin_expect (parse_res == -1, 0))
 567         /* The parser ran out of space.  */
 568         goto erange_reset;
 569
 570       if (result->pw_name[0] != '+' && result->pw_name[0] != '-')
 571         /* This is a real entry.  */
 572         break;
 573
 574       /* -@netgroup */
 575       if (result->pw_name[0] == '-' && result->pw_name[1] == '@'
 576           && result->pw_name[2] != '\0')
 577         {
 578           /* XXX Do not use fixed length buffer.  */
 579           char buf2[1024];
 580           char *user, *host, *domain;
 581           struct __netgrent netgrdata;
 582
 583           bzero (&netgrdata, sizeof (struct __netgrent));
 584           __internal_setnetgrent (&result->pw_name[2], &netgrdata);
 585           while (__internal_getnetgrent_r (&host, &user, &domain, &netgrdata,
 586                                            buf2, sizeof (buf2), errnop))
 587             {
 588               if (user != NULL && user[0] != '-')
 589                 blacklist_store_name (user, ent);
 590             }
 591           __internal_endnetgrent (&netgrdata);
 592           continue;
 593         }
 594
 595       /* +@netgroup */
 596       if (result->pw_name[0] == '+' && result->pw_name[1] == '@'
 597           && result->pw_name[2] != '\0')
 598         {
 599           enum nss_status status;
 600
 601           ent->netgroup = true;
 602           ent->first = true;
 603           copy_pwd_changes (&ent->pwd, result, NULL, 0);
 604
 605           status = getpwent_next_nss_netgr (NULL, result, ent,
 606                                             &result->pw_name[2],
 607                                             buffer, buflen, errnop);
 608           if (status == NSS_STATUS_RETURN)
 609             continue;
 610           else
 611             return status;
 612         }
 613
 614       /* -user */
 615       if (result->pw_name[0] == '-' && result->pw_name[1] != '\0'
 616           && result->pw_name[1] != '@')
 617         {
 618           blacklist_store_name (&result->pw_name[1], ent);
 619           continue;
 620         }
 621
 622       /* +user */
 623       if (result->pw_name[0] == '+' && result->pw_name[1] != '\0'
 624           && result->pw_name[1] != '@')
 625         {
 626           size_t len = strlen (result->pw_name);
 627           char buf[len];
 628           enum nss_status status;
 629
 630           /* Store the User in the blacklist for the "+" at the end of
 631              /etc/passwd */
 632           memcpy (buf, &result->pw_name[1], len);
 633           status = getpwnam_plususer (&result->pw_name[1], result, ent,
 634                                       buffer, buflen, errnop);
 635           blacklist_store_name (buf, ent);
 636
 637           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
 638             break;
 639           else if (status == NSS_STATUS_RETURN  /* We couldn't parse the entry */
 640                    || status == NSS_STATUS_NOTFOUND)    /* entry doesn't exist */
 641             continue;
 642           else
 643             {
 644               if (status == NSS_STATUS_TRYAGAIN)
 645                 {
 646                   /* The parser ran out of space */
 647                   fsetpos (ent->stream, &pos);
 648                   *errnop = ERANGE;
 649                 }
 650               return status;
 651             }
 652         }
 653
 654       /* +:... */
 655       if (result->pw_name[0] == '+' && result->pw_name[1] == '\0')
 656         {
 657           ent->files = false;
 658           ent->first = true;
 659           copy_pwd_changes (&ent->pwd, result, NULL, 0);
 660
 661           return getpwent_next_nss (result, ent, buffer, buflen, errnop);
 662         }
 663     }
 664
 665   return NSS_STATUS_SUCCESS;
 666 }
 667
 668
 669 static enum nss_status
 670 internal_getpwent_r (struct passwd *pw, ent_t *ent, char *buffer,
 671                      size_t buflen, int *errnop)
 672 {
 673   if (ent->netgroup)
 674     {
 675       enum nss_status status;
 676
 677       /* We are searching members in a netgroup */
 678       /* Since this is not the first call, we don't need the group name */
 679       status = getpwent_next_nss_netgr (NULL, pw, ent, NULL, buffer, buflen,
 680                                         errnop);
 681       if (status == NSS_STATUS_RETURN)
 682         return getpwent_next_file (pw, ent, buffer, buflen, errnop);
 683       else
 684         return status;
 685     }
 686   else if (ent->files)
 687     return getpwent_next_file (pw, ent, buffer, buflen, errnop);
 688   else
 689     return getpwent_next_nss (pw, ent, buffer, buflen, errnop);
 690
 691 }
 692
 693 enum nss_status
 694 _nss_compat_getpwent_r (struct passwd *pwd, char *buffer, size_t buflen,
 695                         int *errnop)
 696 {
 697   enum nss_status result = NSS_STATUS_SUCCESS;
 698
 699   __libc_lock_lock (lock);
 700
 701   /* Be prepared that the setpwent function was not called before.  */
 702   if (ni == NULL)
 703     init_nss_interface ();
 704
 705   if (ext_ent.stream == NULL)
 706     result = internal_setpwent (&ext_ent, 1, 1);
 707
 708   if (result == NSS_STATUS_SUCCESS)
 709     result = internal_getpwent_r (pwd, &ext_ent, buffer, buflen, errnop);
 710
 711   __libc_lock_unlock (lock);
 712
 713   return result;
 714 }
 715
 716 /* Searches in /etc/passwd and the NIS/NIS+ map for a special user */
 717 static enum nss_status
 718 internal_getpwnam_r (const char *name, struct passwd *result, ent_t *ent,
 719                      char *buffer, size_t buflen, int *errnop)
 720 {
 721   struct parser_data *data = (void *) buffer;
 722
 723   while (1)
 724     {
 725       fpos_t pos;
 726       char *p;
 727       int parse_res;
 728
 729       do
 730         {
 731           /* We need at least 3 characters for one line.  */
 732           if (__builtin_expect (buflen < 3, 0))
 733             {
 734             erange:
 735               *errnop = ERANGE;
 736               return NSS_STATUS_TRYAGAIN;
 737             }
 738
 739           fgetpos (ent->stream, &pos);
 740           buffer[buflen - 1] = '\xff';
 741           p = fgets_unlocked (buffer, buflen, ent->stream);
 742           if (p == NULL && feof_unlocked (ent->stream))
 743             {
 744               return NSS_STATUS_NOTFOUND;
 745             }
 746           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 747             {
 748             erange_reset:
 749               fsetpos (ent->stream, &pos);
 750               goto erange;
 751             }
 752
 753           /* Terminate the line for any case.  */
 754           buffer[buflen - 1] = '\0';
 755
 756           /* Skip leading blanks.  */
 757           while (isspace (*p))
 758             ++p;
 759         }
 760       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines.  */
 761              /* Parse the line.  If it is invalid, loop to
 762                 get the next line of the file to parse.  */
 763              !(parse_res = _nss_files_parse_pwent (p, result, data, buflen,
 764                                                    errnop)));
 765
 766       if (__builtin_expect (parse_res == -1, 0))
 767         /* The parser ran out of space.  */
 768         goto erange_reset;
 769
 770       /* This is a real entry.  */
 771       if (result->pw_name[0] != '+' && result->pw_name[0] != '-')
 772         {
 773           if (strcmp (result->pw_name, name) == 0)
 774             return NSS_STATUS_SUCCESS;
 775           else
 776             continue;
 777         }
 778
 779       /* -@netgroup */
 780       if (result->pw_name[0] == '-' && result->pw_name[1] == '@'
 781           && result->pw_name[2] != '\0')
 782         {
 783           if (innetgr (&result->pw_name[2], NULL, name, NULL))
 784             return NSS_STATUS_NOTFOUND;
 785           continue;
 786         }
 787
 788       /* +@netgroup */
 789       if (result->pw_name[0] == '+' && result->pw_name[1] == '@'
 790           && result->pw_name[2] != '\0')
 791         {
 792           enum nss_status status;
 793
 794           if (innetgr (&result->pw_name[2], NULL, name, NULL))
 795             {
 796               status = getpwnam_plususer (name, result, ent, buffer,
 797                                           buflen, errnop);
 798
 799               if (status == NSS_STATUS_RETURN)
 800                 continue;
 801
 802               return status;
 803             }
 804           continue;
 805         }
 806
 807       /* -user */
 808       if (result->pw_name[0] == '-' && result->pw_name[1] != '\0'
 809           && result->pw_name[1] != '@')
 810         {
 811           if (strcmp (&result->pw_name[1], name) == 0)
 812             return NSS_STATUS_NOTFOUND;
 813           else
 814             continue;
 815         }
 816
 817       /* +user */
 818       if (result->pw_name[0] == '+' && result->pw_name[1] != '\0'
 819           && result->pw_name[1] != '@')
 820         {
 821           if (strcmp (name, &result->pw_name[1]) == 0)
 822             {
 823               enum nss_status status;
 824
 825               status = getpwnam_plususer (name, result, ent, buffer, buflen,
 826                                           errnop);
 827               if (status == NSS_STATUS_RETURN)
 828                 /* We couldn't parse the entry */
 829                 return NSS_STATUS_NOTFOUND;
 830               else
 831                 return status;
 832             }
 833         }
 834
 835       /* +:... */
 836       if (result->pw_name[0] == '+' && result->pw_name[1] == '\0')
 837         {
 838           enum nss_status status;
 839
 840           status = getpwnam_plususer (name, result, ent,
 841                                       buffer, buflen, errnop);
 842           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
 843             break;
 844           else if (status == NSS_STATUS_RETURN) /* We couldn't parse the entry */
 845             return NSS_STATUS_NOTFOUND;
 846           else
 847             return status;
 848         }
 849     }
 850   return NSS_STATUS_SUCCESS;
 851 }
 852
 853 enum nss_status
 854 _nss_compat_getpwnam_r (const char *name, struct passwd *pwd,
 855                         char *buffer, size_t buflen, int *errnop)
 856 {
 857   enum nss_status result;
 858   ent_t ent = { false, false, true, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0 },
 859                 { NULL, NULL, 0, 0, NULL, NULL, NULL }};
 860
 861   if (name[0] == '-' || name[0] == '+')
 862     return NSS_STATUS_NOTFOUND;
 863
 864   __libc_lock_lock (lock);
 865
 866   if (ni == NULL)
 867     init_nss_interface ();
 868
 869   __libc_lock_unlock (lock);
 870
 871   result = internal_setpwent (&ent, 0, 0);
 872
 873   if (result == NSS_STATUS_SUCCESS)
 874     result = internal_getpwnam_r (name, pwd, &ent, buffer, buflen, errnop);
 875
 876   internal_endpwent (&ent);
 877
 878   return result;
 879 }
 880
 881 /* This function handle the + entry in /etc/passwd for getpwuid */
 882 static enum nss_status
 883 getpwuid_plususer (uid_t uid, struct passwd *result, char *buffer,
 884                    size_t buflen, int *errnop)
 885 {
 886   struct passwd pwd;
 887   char *p;
 888   size_t plen;
 889
 890   if (!nss_getpwuid_r)
 891     return NSS_STATUS_UNAVAIL;
 892
 893   memset (&pwd, '\0', sizeof (struct passwd));
 894
 895   copy_pwd_changes (&pwd, result, NULL, 0);
 896
 897   plen = pwd_need_buflen (&pwd);
 898   if (plen > buflen)
 899     {
 900       *errnop = ERANGE;
 901       return NSS_STATUS_TRYAGAIN;
 902     }
 903   p = buffer + (buflen - plen);
 904   buflen -= plen;
 905
 906   if (nss_getpwuid_r (uid, result, buffer, buflen, errnop) ==
 907       NSS_STATUS_SUCCESS)
 908     {
 909       copy_pwd_changes (result, &pwd, p, plen);
 910       give_pwd_free (&pwd);
 911       /* We found the entry.  */
 912       return NSS_STATUS_SUCCESS;
 913     }
 914   else
 915     {
 916       /* Give buffer the old len back */
 917       buflen += plen;
 918       give_pwd_free (&pwd);
 919     }
 920   return NSS_STATUS_RETURN;
 921 }
 922
 923 /* Searches in /etc/passwd and the NSS subsystem for a special user id */
 924 static enum nss_status
 925 internal_getpwuid_r (uid_t uid, struct passwd *result, ent_t *ent,
 926                      char *buffer, size_t buflen, int *errnop)
 927 {
 928   struct parser_data *data = (void *) buffer;
 929
 930   while (1)
 931     {
 932       fpos_t pos;
 933       char *p;
 934       int parse_res;
 935
 936       do
 937         {
 938           /* We need at least 3 characters for one line.  */
 939           if (__builtin_expect (buflen < 3, 0))
 940             {
 941             erange:
 942               *errnop = ERANGE;
 943               return NSS_STATUS_TRYAGAIN;
 944             }
 945
 946           fgetpos (ent->stream, &pos);
 947           buffer[buflen - 1] = '\xff';
 948           p = fgets_unlocked (buffer, buflen, ent->stream);
 949           if (p == NULL && feof_unlocked (ent->stream))
 950             return NSS_STATUS_NOTFOUND;
 951
 952           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 953             {
 954             erange_reset:
 955               fsetpos (ent->stream, &pos);
 956               goto erange;
 957             }
 958
 959           /* Terminate the line for any case.  */
 960           buffer[buflen - 1] = '\0';
 961
 962           /* Skip leading blanks.  */
 963           while (isspace (*p))
 964             ++p;
 965         }
 966       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines.  */
 967              /* Parse the line.  If it is invalid, loop to
 968                 get the next line of the file to parse.  */
 969              !(parse_res = _nss_files_parse_pwent (p, result, data, buflen,
 970                                                    errnop)));
 971
 972       if (__builtin_expect (parse_res == -1, 0))
 973         /* The parser ran out of space.  */
 974         goto erange_reset;
 975
 976       /* This is a real entry.  */
 977       if (result->pw_name[0] != '+' && result->pw_name[0] != '-')
 978         {
 979           if (result->pw_uid == uid)
 980             return NSS_STATUS_SUCCESS;
 981           else
 982             continue;
 983         }
 984
 985       /* -@netgroup */
 986       if (result->pw_name[0] == '-' && result->pw_name[1] == '@'
 987           && result->pw_name[2] != '\0')
 988         {
 989           /* -1, because we remove first two character of pw_name.  */
 990           size_t len = strlen (result->pw_name) - 1;
 991           char buf[len];
 992           enum nss_status status;
 993
 994           memcpy (buf, &result->pw_name[2], len);
 995
 996           status = getpwuid_plususer (uid, result, buffer, buflen, errnop);
 997           if (status == NSS_STATUS_SUCCESS &&
 998               innetgr (buf, NULL, result->pw_name, NULL))
 999             return NSS_STATUS_NOTFOUND;
1000
1001           continue;
1002         }
1003
1004       /* +@netgroup */
1005       if (result->pw_name[0] == '+' && result->pw_name[1] == '@'
1006           && result->pw_name[2] != '\0')
1007         {
1008           /* -1, because we remove first two characters of pw_name.  */
1009           size_t len = strlen (result->pw_name) - 1;
1010           char buf[len];
1011           enum nss_status status;
1012
1013           memcpy (buf, &result->pw_name[2], len);
1014
1015           status = getpwuid_plususer (uid, result, buffer, buflen, errnop);
1016
1017           if (status == NSS_STATUS_RETURN)
1018             continue;
1019
1020           if (status == NSS_STATUS_SUCCESS)
1021             {
1022               if (innetgr (buf, NULL, result->pw_name, NULL))
1023                 return NSS_STATUS_SUCCESS;
1024             }
1025           else if (status == NSS_STATUS_RETURN) /* We couldn't parse the entry */
1026             return NSS_STATUS_NOTFOUND;
1027           else
1028             return status;
1029
1030           continue;
1031         }
1032
1033       /* -user */
1034       if (result->pw_name[0] == '-' && result->pw_name[1] != '\0'
1035           && result->pw_name[1] != '@')
1036         {
1037           size_t len = strlen (result->pw_name);
1038           char buf[len];
1039           enum nss_status status;
1040
1041           memcpy (buf, &result->pw_name[1], len);
1042
1043           status = getpwuid_plususer (uid, result, buffer, buflen, errnop);
1044           if (status == NSS_STATUS_SUCCESS &&
1045               innetgr (buf, NULL, result->pw_name, NULL))
1046             return NSS_STATUS_NOTFOUND;
1047           continue;
1048         }
1049
1050       /* +user */
1051       if (result->pw_name[0] == '+' && result->pw_name[1] != '\0'
1052           && result->pw_name[1] != '@')
1053         {
1054           size_t len = strlen (result->pw_name);
1055           char buf[len];
1056           enum nss_status status;
1057
1058           memcpy (buf, &result->pw_name[1], len);
1059
1060           status = getpwuid_plususer (uid, result, buffer, buflen, errnop);
1061
1062           if (status == NSS_STATUS_RETURN)
1063             continue;
1064
1065           if (status == NSS_STATUS_SUCCESS)
1066             {
1067               if (strcmp (buf, result->pw_name) == 0)
1068                 return NSS_STATUS_SUCCESS;
1069             }
1070           else if (status == NSS_STATUS_RETURN) /* We couldn't parse the entry */
1071             return NSS_STATUS_NOTFOUND;
1072           else
1073             return status;
1074
1075           continue;
1076         }
1077
1078       /* +:... */
1079       if (result->pw_name[0] == '+' && result->pw_name[1] == '\0')
1080         {
1081           enum nss_status status;
1082
1083           status = getpwuid_plususer (uid, result, buffer, buflen, errnop);
1084           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
1085             break;
1086           else if (status == NSS_STATUS_RETURN) /* We couldn't parse the entry */
1087             return NSS_STATUS_NOTFOUND;
1088           else
1089             return status;
1090         }
1091     }
1092   return NSS_STATUS_SUCCESS;
1093 }
1094
1095 enum nss_status
1096 _nss_compat_getpwuid_r (uid_t uid, struct passwd *pwd,
1097                         char *buffer, size_t buflen, int *errnop)
1098 {
1099   enum nss_status result;
1100   ent_t ent = { false, false, true, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0 },
1101                 { NULL, NULL, 0, 0, NULL, NULL, NULL }};
1102
1103   __libc_lock_lock (lock);
1104
1105   if (ni == NULL)
1106     init_nss_interface ();
1107
1108   __libc_lock_unlock (lock);
1109
1110   result = internal_setpwent (&ent, 0, 0);
1111
1112   if (result == NSS_STATUS_SUCCESS)
1113     result = internal_getpwuid_r (uid, pwd, &ent, buffer, buflen, errnop);
1114
1115   internal_endpwent (&ent);
1116
1117   return result;
1118 }
1119
1120
1121 /* Support routines for remembering -@netgroup and -user entries.
1122    The names are stored in a single string with `|' as separator. */
1123 static void
1124 blacklist_store_name (const char *name, ent_t *ent)
1125 {
1126   int namelen = strlen (name);
1127   char *tmp;
1128
1129   /* first call, setup cache */
1130   if (ent->blacklist.size == 0)
1131     {
1132       ent->blacklist.size = MAX (BLACKLIST_INITIAL_SIZE, 2 * namelen);
1133       ent->blacklist.data = malloc (ent->blacklist.size);
1134       if (ent->blacklist.data == NULL)
1135         return;
1136       ent->blacklist.data[0] = '|';
1137       ent->blacklist.data[1] = '\0';
1138       ent->blacklist.current = 1;
1139     }
1140   else
1141     {
1142       if (in_blacklist (name, namelen, ent))
1143         return;                 /* no duplicates */
1144
1145       if (ent->blacklist.current + namelen + 1 >= ent->blacklist.size)
1146         {
1147           ent->blacklist.size += MAX (BLACKLIST_INCREMENT, 2 * namelen);
1148           tmp = realloc (ent->blacklist.data, ent->blacklist.size);
1149           if (tmp == NULL)
1150             {
1151               free (ent->blacklist.data);
1152               ent->blacklist.size = 0;
1153               return;
1154             }
1155           ent->blacklist.data = tmp;
1156         }
1157     }
1158
1159   tmp = stpcpy (ent->blacklist.data + ent->blacklist.current, name);
1160   *tmp++ = '|';
1161   *tmp = '\0';
1162   ent->blacklist.current += namelen + 1;
1163
1164   return;
1165 }
1166
1167 /* Returns TRUE if ent->blacklist contains name, else FALSE.  */
1168 static bool_t
1169 in_blacklist (const char *name, int namelen, ent_t *ent)
1170 {
1171   char buf[namelen + 3];
1172   char *cp;
1173
1174   if (ent->blacklist.data == NULL)
1175     return FALSE;
1176
1177   buf[0] = '|';
1178   cp = stpcpy (&buf[1], name);
1179   *cp++ = '|';
1180   *cp = '\0';
1181   return strstr (ent->blacklist.data, buf) != NULL;
1182 }