nss/nss_compat/compat-spwd.c

   1 /* Copyright (C) 1996-2021 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <https://www.gnu.org/licenses/>.  */
  18
  19 #include <ctype.h>
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <netdb.h>
  23 #include <nss.h>
  24 #include <nsswitch.h>
  25 #include <shadow.h>
  26 #include <stdio_ext.h>
  27 #include <string.h>
  28 #include <libc-lock.h>
  29 #include <kernel-features.h>
  30 #include <nss_files.h>
  31
  32 #include "netgroup.h"
  33 #include "nisdomain.h"
  34
  35 NSS_DECLARE_MODULE_FUNCTIONS (compat)
  36
  37 static nss_action_list ni;
  38 static enum nss_status (*setspent_impl) (int stayopen);
  39 static enum nss_status (*getspnam_r_impl) (const char *name, struct spwd * sp,
  40                                            char *buffer, size_t buflen,
  41                                            int *errnop);
  42 static enum nss_status (*getspent_r_impl) (struct spwd * sp, char *buffer,
  43                                            size_t buflen, int *errnop);
  44 static enum nss_status (*endspent_impl) (void);
  45
  46 /* Get the declaration of the parser function.  */
  47 #define ENTNAME spent
  48 #define STRUCTURE spwd
  49 #define EXTERN_PARSER
  50 #include <nss/nss_files/files-parse.c>
  51
  52 /* Structure for remembering -@netgroup and -user members ... */
  53 #define BLACKLIST_INITIAL_SIZE 512
  54 #define BLACKLIST_INCREMENT 256
  55 struct blacklist_t
  56 {
  57   char *data;
  58   int current;
  59   int size;
  60 };
  61
  62 struct ent_t
  63 {
  64   bool netgroup;
  65   bool files;
  66   bool first;
  67   enum nss_status setent_status;
  68   FILE *stream;
  69   struct blacklist_t blacklist;
  70   struct spwd pwd;
  71   struct __netgrent netgrdata;
  72 };
  73 typedef struct ent_t ent_t;
  74
  75 static ent_t ext_ent = { false, true, false, NSS_STATUS_SUCCESS, NULL,
  76                          { NULL, 0, 0},
  77                          { NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
  78
  79 /* Protect global state against multiple changers.  */
  80 __libc_lock_define_initialized (static, lock)
  81
  82 /* Prototypes for local functions.  */
  83 static void blacklist_store_name (const char *, ent_t *);
  84 static bool in_blacklist (const char *, int, ent_t *);
  85
  86 /* Initialize the NSS interface/functions. The calling function must
  87    hold the lock.  */
  88 static void
  89 init_nss_interface (void)
  90 {
  91   if (__nss_database_get (nss_database_shadow_compat, &ni))
  92     {
  93       setspent_impl = __nss_lookup_function (ni, "setspent");
  94       getspnam_r_impl = __nss_lookup_function (ni, "getspnam_r");
  95       getspent_r_impl = __nss_lookup_function (ni, "getspent_r");
  96       endspent_impl = __nss_lookup_function (ni, "endspent");
  97     }
  98 }
  99
 100 static void
 101 give_spwd_free (struct spwd *pwd)
 102 {
 103   free (pwd->sp_namp);
 104   free (pwd->sp_pwdp);
 105
 106   memset (pwd, '\0', sizeof (struct spwd));
 107   pwd->sp_warn = -1;
 108   pwd->sp_inact = -1;
 109   pwd->sp_expire = -1;
 110   pwd->sp_flag = ~0ul;
 111 }
 112
 113 static int
 114 spwd_need_buflen (struct spwd *pwd)
 115 {
 116   int len = 0;
 117
 118   if (pwd->sp_pwdp != NULL)
 119     len += strlen (pwd->sp_pwdp) + 1;
 120
 121   return len;
 122 }
 123
 124 static void
 125 copy_spwd_changes (struct spwd *dest, struct spwd *src,
 126                    char *buffer, size_t buflen)
 127 {
 128   if (src->sp_pwdp != NULL && strlen (src->sp_pwdp))
 129     {
 130       if (buffer == NULL)
 131         dest->sp_pwdp = strdup (src->sp_pwdp);
 132       else if (dest->sp_pwdp
 133                && strlen (dest->sp_pwdp) >= strlen (src->sp_pwdp))
 134         strcpy (dest->sp_pwdp, src->sp_pwdp);
 135       else
 136         {
 137           dest->sp_pwdp = buffer;
 138           strcpy (dest->sp_pwdp, src->sp_pwdp);
 139           buffer += strlen (dest->sp_pwdp) + 1;
 140           buflen = buflen - (strlen (dest->sp_pwdp) + 1);
 141         }
 142     }
 143   if (src->sp_lstchg != 0)
 144     dest->sp_lstchg = src->sp_lstchg;
 145   if (src->sp_min != 0)
 146     dest->sp_min = src->sp_min;
 147   if (src->sp_max != 0)
 148     dest->sp_max = src->sp_max;
 149   if (src->sp_warn != -1)
 150     dest->sp_warn = src->sp_warn;
 151   if (src->sp_inact != -1)
 152     dest->sp_inact = src->sp_inact;
 153   if (src->sp_expire != -1)
 154     dest->sp_expire = src->sp_expire;
 155   if (src->sp_flag != ~0ul)
 156     dest->sp_flag = src->sp_flag;
 157 }
 158
 159 static enum nss_status
 160 internal_setspent (ent_t *ent, int stayopen, int needent)
 161 {
 162   enum nss_status status = NSS_STATUS_SUCCESS;
 163
 164   ent->first = ent->netgroup = 0;
 165   ent->files = true;
 166
 167   /* If something was left over free it.  */
 168   if (ent->netgroup)
 169     __internal_endnetgrent (&ent->netgrdata);
 170
 171   if (ent->blacklist.data != NULL)
 172     {
 173       ent->blacklist.current = 1;
 174       ent->blacklist.data[0] = '|';
 175       ent->blacklist.data[1] = '\0';
 176     }
 177   else
 178     ent->blacklist.current = 0;
 179
 180   if (ent->stream == NULL)
 181     {
 182       ent->stream = __nss_files_fopen ("/etc/shadow");
 183
 184       if (ent->stream == NULL)
 185         status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
 186     }
 187   else
 188     rewind (ent->stream);
 189
 190   give_spwd_free (&ent->pwd);
 191
 192   if (needent && status == NSS_STATUS_SUCCESS && setspent_impl)
 193     ent->setent_status = setspent_impl (stayopen);
 194
 195   return status;
 196 }
 197
 198
 199 enum nss_status
 200 _nss_compat_setspent (int stayopen)
 201 {
 202   enum nss_status result;
 203
 204   __libc_lock_lock (lock);
 205
 206   if (ni == NULL)
 207     init_nss_interface ();
 208
 209   result = internal_setspent (&ext_ent, stayopen, 1);
 210
 211   __libc_lock_unlock (lock);
 212
 213   return result;
 214 }
 215
 216
 217 static enum nss_status __attribute_warn_unused_result__
 218 internal_endspent (ent_t *ent)
 219 {
 220   if (ent->stream != NULL)
 221     {
 222       fclose (ent->stream);
 223       ent->stream = NULL;
 224     }
 225
 226   if (ent->netgroup)
 227     __internal_endnetgrent (&ent->netgrdata);
 228
 229   ent->first = ent->netgroup = false;
 230   ent->files = true;
 231
 232   if (ent->blacklist.data != NULL)
 233     {
 234       ent->blacklist.current = 1;
 235       ent->blacklist.data[0] = '|';
 236       ent->blacklist.data[1] = '\0';
 237     }
 238   else
 239     ent->blacklist.current = 0;
 240
 241   give_spwd_free (&ent->pwd);
 242
 243   return NSS_STATUS_SUCCESS;
 244 }
 245
 246 /* Like internal_endspent, but preserve errno in all cases.  */
 247 static void
 248 internal_endspent_noerror (ent_t *ent)
 249 {
 250   int saved_errno = errno;
 251   enum nss_status unused __attribute__ ((unused)) = internal_endspent (ent);
 252   __set_errno (saved_errno);
 253 }
 254
 255 enum nss_status
 256 _nss_compat_endspent (void)
 257 {
 258   enum nss_status result;
 259
 260   __libc_lock_lock (lock);
 261
 262   if (endspent_impl)
 263     endspent_impl ();
 264
 265   result = internal_endspent (&ext_ent);
 266
 267   __libc_lock_unlock (lock);
 268
 269   return result;
 270 }
 271
 272 static enum nss_status
 273 getspent_next_nss_netgr (const char *name, struct spwd *result, ent_t *ent,
 274                          char *group, char *buffer, size_t buflen,
 275                          int *errnop)
 276 {
 277   char *curdomain = NULL, *host, *user, *domain, *p2;
 278   size_t p2len;
 279
 280   if (!getspnam_r_impl)
 281     return NSS_STATUS_UNAVAIL;
 282
 283   /* If the setpwent call failed, say so.  */
 284   if (ent->setent_status != NSS_STATUS_SUCCESS)
 285     return ent->setent_status;
 286
 287   if (ent->first)
 288     {
 289       memset (&ent->netgrdata, 0, sizeof (struct __netgrent));
 290       __internal_setnetgrent (group, &ent->netgrdata);
 291       ent->first = false;
 292     }
 293
 294   while (1)
 295     {
 296       enum nss_status status;
 297
 298       status = __internal_getnetgrent_r (&host, &user, &domain,
 299                                          &ent->netgrdata, buffer, buflen,
 300                                          errnop);
 301       if (status != 1)
 302         {
 303           __internal_endnetgrent (&ent->netgrdata);
 304           ent->netgroup = false;
 305           give_spwd_free (&ent->pwd);
 306           return NSS_STATUS_RETURN;
 307         }
 308
 309       if (user == NULL || user[0] == '-')
 310         continue;
 311
 312       if (domain != NULL)
 313         {
 314           if (curdomain == NULL
 315               && __nss_get_default_domain (&curdomain) != 0)
 316             {
 317               __internal_endnetgrent (&ent->netgrdata);
 318               ent->netgroup = false;
 319               give_spwd_free (&ent->pwd);
 320               return NSS_STATUS_UNAVAIL;
 321             }
 322           if (strcmp (curdomain, domain) != 0)
 323             continue;
 324         }
 325
 326       /* If name != NULL, we are called from getpwnam */
 327       if (name != NULL)
 328         if (strcmp (user, name) != 0)
 329           continue;
 330
 331       p2len = spwd_need_buflen (&ent->pwd);
 332       if (p2len > buflen)
 333         {
 334           *errnop = ERANGE;
 335           return NSS_STATUS_TRYAGAIN;
 336         }
 337       p2 = buffer + (buflen - p2len);
 338       buflen -= p2len;
 339
 340       if (getspnam_r_impl (user, result, buffer, buflen, errnop)
 341           != NSS_STATUS_SUCCESS)
 342         continue;
 343
 344       if (!in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 345         {
 346           /* Store the User in the blacklist for possible the "+" at the
 347              end of /etc/passwd */
 348           blacklist_store_name (result->sp_namp, ent);
 349           copy_spwd_changes (result, &ent->pwd, p2, p2len);
 350           break;
 351         }
 352     }
 353
 354   return NSS_STATUS_SUCCESS;
 355 }
 356
 357
 358 static enum nss_status
 359 getspent_next_nss (struct spwd *result, ent_t *ent,
 360                    char *buffer, size_t buflen, int *errnop)
 361 {
 362   enum nss_status status;
 363   char *p2;
 364   size_t p2len;
 365
 366   if (!getspent_r_impl)
 367     return NSS_STATUS_UNAVAIL;
 368
 369   p2len = spwd_need_buflen (&ent->pwd);
 370   if (p2len > buflen)
 371     {
 372       *errnop = ERANGE;
 373       return NSS_STATUS_TRYAGAIN;
 374     }
 375   p2 = buffer + (buflen - p2len);
 376   buflen -= p2len;
 377   do
 378     {
 379       if ((status = getspent_r_impl (result, buffer, buflen, errnop))
 380           != NSS_STATUS_SUCCESS)
 381         return status;
 382     }
 383   while (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent));
 384
 385   copy_spwd_changes (result, &ent->pwd, p2, p2len);
 386
 387   return NSS_STATUS_SUCCESS;
 388 }
 389
 390
 391 /* This function handle the +user entrys in /etc/shadow */
 392 static enum nss_status
 393 getspnam_plususer (const char *name, struct spwd *result, ent_t *ent,
 394                    char *buffer, size_t buflen, int *errnop)
 395 {
 396   if (!getspnam_r_impl)
 397     return NSS_STATUS_UNAVAIL;
 398
 399   struct spwd pwd;
 400   memset (&pwd, '\0', sizeof (struct spwd));
 401   pwd.sp_warn = -1;
 402   pwd.sp_inact = -1;
 403   pwd.sp_expire = -1;
 404   pwd.sp_flag = ~0ul;
 405
 406   copy_spwd_changes (&pwd, result, NULL, 0);
 407
 408   size_t plen = spwd_need_buflen (&pwd);
 409   if (plen > buflen)
 410     {
 411       *errnop = ERANGE;
 412       return NSS_STATUS_TRYAGAIN;
 413     }
 414   char *p = buffer + (buflen - plen);
 415   buflen -= plen;
 416
 417   enum nss_status status = getspnam_r_impl (name, result, buffer, buflen,
 418                                             errnop);
 419   if (status != NSS_STATUS_SUCCESS)
 420     return status;
 421
 422   if (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 423     return NSS_STATUS_NOTFOUND;
 424
 425   copy_spwd_changes (result, &pwd, p, plen);
 426   give_spwd_free (&pwd);
 427   /* We found the entry.  */
 428   return NSS_STATUS_SUCCESS;
 429 }
 430
 431
 432 static enum nss_status
 433 getspent_next_file (struct spwd *result, ent_t *ent,
 434                     char *buffer, size_t buflen, int *errnop)
 435 {
 436   struct parser_data *data = (void *) buffer;
 437   while (1)
 438     {
 439       fpos_t pos;
 440       int parse_res = 0;
 441       char *p;
 442
 443       do
 444         {
 445           /* We need at least 3 characters for one line.  */
 446           if (__glibc_unlikely (buflen < 3))
 447             {
 448             erange:
 449               *errnop = ERANGE;
 450               return NSS_STATUS_TRYAGAIN;
 451             }
 452
 453           fgetpos (ent->stream, &pos);
 454           buffer[buflen - 1] = '\xff';
 455           p = fgets_unlocked (buffer, buflen, ent->stream);
 456           if (p == NULL && feof_unlocked (ent->stream))
 457             return NSS_STATUS_NOTFOUND;
 458
 459           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 460             {
 461             erange_reset:
 462               fsetpos (ent->stream, &pos);
 463               goto erange;
 464             }
 465
 466           /* Skip leading blanks.  */
 467           while (isspace (*p))
 468             ++p;
 469         }
 470       while (*p == '\0' || *p == '#'    /* Ignore empty and comment lines.  */
 471              /* Parse the line.  If it is invalid, loop to
 472                 get the next line of the file to parse.  */
 473              || !(parse_res = _nss_files_parse_spent (p, result, data,
 474                                                       buflen, errnop)));
 475
 476       if (__glibc_unlikely (parse_res == -1))
 477         /* The parser ran out of space.  */
 478         goto erange_reset;
 479
 480       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 481         /* This is a real entry.  */
 482         break;
 483
 484       /* -@netgroup */
 485       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 486           && result->sp_namp[2] != '\0')
 487         {
 488           /* XXX Do not use fixed length buffers.  */
 489           char buf2[1024];
 490           char *user, *host, *domain;
 491           struct __netgrent netgrdata;
 492
 493           memset (&netgrdata, 0, sizeof (struct __netgrent));
 494           __internal_setnetgrent (&result->sp_namp[2], &netgrdata);
 495           while (__internal_getnetgrent_r (&host, &user, &domain,
 496                                            &netgrdata, buf2, sizeof (buf2),
 497                                            errnop))
 498             {
 499               if (user != NULL && user[0] != '-')
 500                 blacklist_store_name (user, ent);
 501             }
 502           __internal_endnetgrent (&netgrdata);
 503           continue;
 504         }
 505
 506       /* +@netgroup */
 507       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 508           && result->sp_namp[2] != '\0')
 509         {
 510           int status;
 511
 512           ent->netgroup = true;
 513           ent->first = true;
 514           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 515
 516           status = getspent_next_nss_netgr (NULL, result, ent,
 517                                             &result->sp_namp[2],
 518                                             buffer, buflen, errnop);
 519           if (status == NSS_STATUS_RETURN)
 520             continue;
 521           else
 522             return status;
 523         }
 524
 525       /* -user */
 526       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 527           && result->sp_namp[1] != '@')
 528         {
 529           blacklist_store_name (&result->sp_namp[1], ent);
 530           continue;
 531         }
 532
 533       /* +user */
 534       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 535           && result->sp_namp[1] != '@')
 536         {
 537           size_t len = strlen (result->sp_namp);
 538           char buf[len];
 539           enum nss_status status;
 540
 541           /* Store the User in the blacklist for the "+" at the end of
 542              /etc/passwd */
 543           memcpy (buf, &result->sp_namp[1], len);
 544           status = getspnam_plususer (&result->sp_namp[1], result, ent,
 545                                       buffer, buflen, errnop);
 546           blacklist_store_name (buf, ent);
 547
 548           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
 549             break;
 550           /* We couldn't parse the entry */
 551           else if (status == NSS_STATUS_RETURN
 552                    /* entry doesn't exist */
 553                    || status == NSS_STATUS_NOTFOUND)
 554             continue;
 555           else
 556             {
 557               if (status == NSS_STATUS_TRYAGAIN)
 558                 {
 559                   fsetpos (ent->stream, &pos);
 560                   *errnop = ERANGE;
 561                 }
 562               return status;
 563             }
 564         }
 565
 566       /* +:... */
 567       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 568         {
 569           ent->files = false;
 570           ent->first = true;
 571           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 572
 573           return getspent_next_nss (result, ent, buffer, buflen, errnop);
 574         }
 575     }
 576
 577   return NSS_STATUS_SUCCESS;
 578 }
 579
 580
 581 static enum nss_status
 582 internal_getspent_r (struct spwd *pw, ent_t *ent,
 583                      char *buffer, size_t buflen, int *errnop)
 584 {
 585   if (ent->netgroup)
 586     {
 587       enum nss_status status;
 588
 589       /* We are searching members in a netgroup */
 590       /* Since this is not the first call, we don't need the group name */
 591       status = getspent_next_nss_netgr (NULL, pw, ent, NULL, buffer,
 592                                         buflen, errnop);
 593
 594       if (status == NSS_STATUS_RETURN)
 595         return getspent_next_file (pw, ent, buffer, buflen, errnop);
 596       else
 597         return status;
 598     }
 599   else if (ent->files)
 600     return getspent_next_file (pw, ent, buffer, buflen, errnop);
 601   else
 602     return getspent_next_nss (pw, ent, buffer, buflen, errnop);
 603 }
 604
 605
 606 enum nss_status
 607 _nss_compat_getspent_r (struct spwd *pwd, char *buffer, size_t buflen,
 608                         int *errnop)
 609 {
 610   enum nss_status result = NSS_STATUS_SUCCESS;
 611
 612   __libc_lock_lock (lock);
 613
 614   /* Be prepared that the setpwent function was not called before.  */
 615   if (ni == NULL)
 616     init_nss_interface ();
 617
 618   if (ext_ent.stream == NULL)
 619     result = internal_setspent (&ext_ent, 1, 1);
 620
 621   if (result == NSS_STATUS_SUCCESS)
 622     result = internal_getspent_r (pwd, &ext_ent, buffer, buflen, errnop);
 623
 624   __libc_lock_unlock (lock);
 625
 626   return result;
 627 }
 628
 629
 630 /* Searches in /etc/passwd and the NIS/NIS+ map for a special user */
 631 static enum nss_status
 632 internal_getspnam_r (const char *name, struct spwd *result, ent_t *ent,
 633                      char *buffer, size_t buflen, int *errnop)
 634 {
 635   struct parser_data *data = (void *) buffer;
 636
 637   while (1)
 638     {
 639       fpos_t pos;
 640       char *p;
 641       int parse_res;
 642
 643       do
 644         {
 645           /* We need at least 3 characters for one line.  */
 646           if (__glibc_unlikely (buflen < 3))
 647             {
 648             erange:
 649               *errnop = ERANGE;
 650               return NSS_STATUS_TRYAGAIN;
 651             }
 652
 653           fgetpos (ent->stream, &pos);
 654           buffer[buflen - 1] = '\xff';
 655           p = fgets_unlocked (buffer, buflen, ent->stream);
 656           if (p == NULL && feof_unlocked (ent->stream))
 657             return NSS_STATUS_NOTFOUND;
 658
 659           if (p == NULL || buffer[buflen - 1] != '\xff')
 660             {
 661             erange_reset:
 662               fsetpos (ent->stream, &pos);
 663               goto erange;
 664             }
 665
 666           /* Terminate the line for any case.  */
 667           buffer[buflen - 1] = '\0';
 668
 669           /* Skip leading blanks.  */
 670           while (isspace (*p))
 671             ++p;
 672         }
 673       while (*p == '\0' || *p == '#' /* Ignore empty and comment lines.  */
 674              /* Parse the line.  If it is invalid, loop to
 675                 get the next line of the file to parse.  */
 676              || !(parse_res = _nss_files_parse_spent (p, result, data, buflen,
 677                                                       errnop)));
 678
 679       if (__glibc_unlikely (parse_res == -1))
 680         /* The parser ran out of space.  */
 681         goto erange_reset;
 682
 683       /* This is a real entry.  */
 684       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 685         {
 686           if (strcmp (result->sp_namp, name) == 0)
 687             return NSS_STATUS_SUCCESS;
 688           else
 689             continue;
 690         }
 691
 692       /* -@netgroup */
 693       /* If the loaded NSS module does not support this service, add
 694          all users from a +@netgroup entry to the blacklist, too.  */
 695       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 696           && result->sp_namp[2] != '\0')
 697         {
 698           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 699             return NSS_STATUS_NOTFOUND;
 700           continue;
 701         }
 702
 703       /* +@netgroup */
 704       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 705           && result->sp_namp[2] != '\0')
 706         {
 707           enum nss_status status;
 708
 709           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 710             {
 711               status = getspnam_plususer (name, result, ent, buffer,
 712                                           buflen, errnop);
 713
 714               if (status == NSS_STATUS_RETURN)
 715                 continue;
 716
 717               return status;
 718             }
 719           continue;
 720         }
 721
 722       /* -user */
 723       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 724           && result->sp_namp[1] != '@')
 725         {
 726           if (strcmp (&result->sp_namp[1], name) == 0)
 727             return NSS_STATUS_NOTFOUND;
 728           else
 729             continue;
 730         }
 731
 732       /* +user */
 733       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 734           && result->sp_namp[1] != '@')
 735         {
 736           if (strcmp (name, &result->sp_namp[1]) == 0)
 737             {
 738               enum nss_status status;
 739
 740               status = getspnam_plususer (name, result, ent,
 741                                           buffer, buflen, errnop);
 742
 743               if (status == NSS_STATUS_RETURN)
 744                 /* We couldn't parse the entry */
 745                 return NSS_STATUS_NOTFOUND;
 746               else
 747                 return status;
 748             }
 749         }
 750
 751       /* +:... */
 752       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 753         {
 754           enum nss_status status;
 755
 756           status = getspnam_plususer (name, result, ent,
 757                                       buffer, buflen, errnop);
 758
 759           if (status == NSS_STATUS_SUCCESS)
 760             /* We found the entry. */
 761             break;
 762           else if (status == NSS_STATUS_RETURN)
 763             /* We couldn't parse the entry */
 764             return NSS_STATUS_NOTFOUND;
 765           else
 766             return status;
 767         }
 768     }
 769   return NSS_STATUS_SUCCESS;
 770 }
 771
 772
 773 enum nss_status
 774 _nss_compat_getspnam_r (const char *name, struct spwd *pwd,
 775                         char *buffer, size_t buflen, int *errnop)
 776 {
 777   enum nss_status result;
 778   ent_t ent = { false, true, false, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0},
 779                 { NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
 780
 781   if (name[0] == '-' || name[0] == '+')
 782     return NSS_STATUS_NOTFOUND;
 783
 784   __libc_lock_lock (lock);
 785
 786   if (ni == NULL)
 787     init_nss_interface ();
 788
 789   __libc_lock_unlock (lock);
 790
 791   result = internal_setspent (&ent, 0, 0);
 792
 793   if (result == NSS_STATUS_SUCCESS)
 794     result = internal_getspnam_r (name, pwd, &ent, buffer, buflen, errnop);
 795
 796   internal_endspent_noerror (&ent);
 797
 798   return result;
 799 }
 800
 801
 802 /* Support routines for remembering -@netgroup and -user entries.
 803    The names are stored in a single string with `|' as separator. */
 804 static void
 805 blacklist_store_name (const char *name, ent_t *ent)
 806 {
 807   int namelen = strlen (name);
 808   char *tmp;
 809
 810   /* first call, setup cache */
 811   if (ent->blacklist.size == 0)
 812     {
 813       ent->blacklist.size = MAX (BLACKLIST_INITIAL_SIZE, 2 * namelen);
 814       ent->blacklist.data = malloc (ent->blacklist.size);
 815       if (ent->blacklist.data == NULL)
 816         return;
 817       ent->blacklist.data[0] = '|';
 818       ent->blacklist.data[1] = '\0';
 819       ent->blacklist.current = 1;
 820     }
 821   else
 822     {
 823       if (in_blacklist (name, namelen, ent))
 824         return;                 /* no duplicates */
 825
 826       if (ent->blacklist.current + namelen + 1 >= ent->blacklist.size)
 827         {
 828           ent->blacklist.size += MAX (BLACKLIST_INCREMENT, 2 * namelen);
 829           tmp = realloc (ent->blacklist.data, ent->blacklist.size);
 830           if (tmp == NULL)
 831             {
 832               free (ent->blacklist.data);
 833               ent->blacklist.size = 0;
 834               return;
 835             }
 836           ent->blacklist.data = tmp;
 837         }
 838     }
 839
 840   tmp = stpcpy (ent->blacklist.data + ent->blacklist.current, name);
 841   *tmp++ = '|';
 842   *tmp = '\0';
 843   ent->blacklist.current += namelen + 1;
 844
 845   return;
 846 }
 847
 848
 849 /* Returns whether ent->blacklist contains name.  */
 850 static bool
 851 in_blacklist (const char *name, int namelen, ent_t *ent)
 852 {
 853   char buf[namelen + 3];
 854   char *cp;
 855
 856   if (ent->blacklist.data == NULL)
 857     return false;
 858
 859   buf[0] = '|';
 860   cp = stpcpy (&buf[1], name);
 861   *cp++ = '|';
 862   *cp = '\0';
 863   return strstr (ent->blacklist.data, buf) != NULL;
 864 }