nis/nss_compat/compat-spwd.c

   1 /* Copyright (C) 1996-1999,2001-2006,2007,2011
   2         Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public
   8    License as published by the Free Software Foundation; either
   9    version 2.1 of the License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; if not, see
  18    <http://www.gnu.org/licenses/>.  */
  19
  20 #include <ctype.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <netdb.h>
  24 #include <nss.h>
  25 #include <nsswitch.h>
  26 #include <shadow.h>
  27 #include <stdio_ext.h>
  28 #include <string.h>
  29 #include <rpc/types.h>
  30 #include <rpcsvc/ypclnt.h>
  31 #include <bits/libc-lock.h>
  32 #include <kernel-features.h>
  33
  34 #include "netgroup.h"
  35
  36 static service_user *ni;
  37 static enum nss_status (*nss_setspent) (int stayopen);
  38 static enum nss_status (*nss_getspnam_r) (const char *name, struct spwd * sp,
  39                                           char *buffer, size_t buflen,
  40                                           int *errnop);
  41 static enum nss_status (*nss_getspent_r) (struct spwd * sp, char *buffer,
  42                                           size_t buflen, int *errnop);
  43 static enum nss_status (*nss_endspent) (void);
  44
  45 /* Get the declaration of the parser function.  */
  46 #define ENTNAME spent
  47 #define STRUCTURE spwd
  48 #define EXTERN_PARSER
  49 #include <nss/nss_files/files-parse.c>
  50
  51 /* Structure for remembering -@netgroup and -user members ... */
  52 #define BLACKLIST_INITIAL_SIZE 512
  53 #define BLACKLIST_INCREMENT 256
  54 struct blacklist_t
  55 {
  56   char *data;
  57   int current;
  58   int size;
  59 };
  60
  61 struct ent_t
  62 {
  63   bool netgroup;
  64   bool files;
  65   bool first;
  66   enum nss_status setent_status;
  67   FILE *stream;
  68   struct blacklist_t blacklist;
  69   struct spwd pwd;
  70   struct __netgrent netgrdata;
  71 };
  72 typedef struct ent_t ent_t;
  73
  74 static ent_t ext_ent = { false, true, false, NSS_STATUS_SUCCESS, NULL,
  75                          { NULL, 0, 0},
  76                          { NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
  77
  78 /* Protect global state against multiple changers.  */
  79 __libc_lock_define_initialized (static, lock)
  80
  81 /* Positive if O_CLOEXEC is supported, negative if it is not supported,
  82    zero if it is still undecided.  This variable is shared with the
  83    other compat functions.  */
  84 #ifdef __ASSUME_O_CLOEXEC
  85 # define __compat_have_cloexec 1
  86 #else
  87 # ifdef O_CLOEXEC
  88 extern int __compat_have_cloexec;
  89 # else
  90 #  define __compat_have_cloexec -1
  91 # endif
  92 #endif
  93
  94 /* Prototypes for local functions.  */
  95 static void blacklist_store_name (const char *, ent_t *);
  96 static int in_blacklist (const char *, int, ent_t *);
  97
  98 /* Initialize the NSS interface/functions. The calling function must
  99    hold the lock.  */
 100 static void
 101 init_nss_interface (void)
 102 {
 103   if (__nss_database_lookup ("shadow_compat", "passwd_compat",
 104                              "nis", &ni) >= 0)
 105     {
 106       nss_setspent = __nss_lookup_function (ni, "setspent");
 107       nss_getspnam_r = __nss_lookup_function (ni, "getspnam_r");
 108       nss_getspent_r = __nss_lookup_function (ni, "getspent_r");
 109       nss_endspent = __nss_lookup_function (ni, "endspent");
 110     }
 111 }
 112
 113 static void
 114 give_spwd_free (struct spwd *pwd)
 115 {
 116   free (pwd->sp_namp);
 117   free (pwd->sp_pwdp);
 118
 119   memset (pwd, '\0', sizeof (struct spwd));
 120   pwd->sp_warn = -1;
 121   pwd->sp_inact = -1;
 122   pwd->sp_expire = -1;
 123   pwd->sp_flag = ~0ul;
 124 }
 125
 126 static int
 127 spwd_need_buflen (struct spwd *pwd)
 128 {
 129   int len = 0;
 130
 131   if (pwd->sp_pwdp != NULL)
 132     len += strlen (pwd->sp_pwdp) + 1;
 133
 134   return len;
 135 }
 136
 137 static void
 138 copy_spwd_changes (struct spwd *dest, struct spwd *src,
 139                    char *buffer, size_t buflen)
 140 {
 141   if (src->sp_pwdp != NULL && strlen (src->sp_pwdp))
 142     {
 143       if (buffer == NULL)
 144         dest->sp_pwdp = strdup (src->sp_pwdp);
 145       else if (dest->sp_pwdp &&
 146                strlen (dest->sp_pwdp) >= strlen (src->sp_pwdp))
 147         strcpy (dest->sp_pwdp, src->sp_pwdp);
 148       else
 149         {
 150           dest->sp_pwdp = buffer;
 151           strcpy (dest->sp_pwdp, src->sp_pwdp);
 152           buffer += strlen (dest->sp_pwdp) + 1;
 153           buflen = buflen - (strlen (dest->sp_pwdp) + 1);
 154         }
 155     }
 156   if (src->sp_lstchg != 0)
 157     dest->sp_lstchg = src->sp_lstchg;
 158   if (src->sp_min != 0)
 159     dest->sp_min = src->sp_min;
 160   if (src->sp_max != 0)
 161     dest->sp_max = src->sp_max;
 162   if (src->sp_warn != -1)
 163     dest->sp_warn = src->sp_warn;
 164   if (src->sp_inact != -1)
 165     dest->sp_inact = src->sp_inact;
 166   if (src->sp_expire != -1)
 167     dest->sp_expire = src->sp_expire;
 168   if (src->sp_flag != ~0ul)
 169     dest->sp_flag = src->sp_flag;
 170 }
 171
 172 static enum nss_status
 173 internal_setspent (ent_t *ent, int stayopen)
 174 {
 175   enum nss_status status = NSS_STATUS_SUCCESS;
 176
 177   ent->first = ent->netgroup = 0;
 178   ent->files = true;
 179
 180   /* If something was left over free it.  */
 181   if (ent->netgroup)
 182     __internal_endnetgrent (&ent->netgrdata);
 183
 184   if (ent->blacklist.data != NULL)
 185     {
 186       ent->blacklist.current = 1;
 187       ent->blacklist.data[0] = '|';
 188       ent->blacklist.data[1] = '\0';
 189     }
 190   else
 191     ent->blacklist.current = 0;
 192
 193   if (ent->stream == NULL)
 194     {
 195       ent->stream = fopen ("/etc/shadow", "rme");
 196
 197       if (ent->stream == NULL)
 198         status = errno == EAGAIN ? NSS_STATUS_TRYAGAIN : NSS_STATUS_UNAVAIL;
 199       else
 200         {
 201           /* We have to make sure the file is  `closed on exec'.  */
 202           int result = 0;
 203
 204           if (__compat_have_cloexec <= 0)
 205             {
 206               int flags;
 207               result = flags = fcntl (fileno_unlocked (ent->stream), F_GETFD,
 208                                       0);
 209               if (result >= 0)
 210                 {
 211 #if defined O_CLOEXEC && !defined __ASSUME_O_CLOEXEC
 212                   if (__compat_have_cloexec == 0)
 213                     __compat_have_cloexec = (flags & FD_CLOEXEC) ? 1 : -1;
 214
 215                   if (__compat_have_cloexec < 0)
 216 #endif
 217                     {
 218                       flags |= FD_CLOEXEC;
 219                       result = fcntl (fileno_unlocked (ent->stream), F_SETFD,
 220                                       flags);
 221                     }
 222                 }
 223             }
 224
 225           if (result < 0)
 226             {
 227               /* Something went wrong.  Close the stream and return a
 228                  failure.  */
 229               fclose (ent->stream);
 230               ent->stream = NULL;
 231               status = NSS_STATUS_UNAVAIL;
 232             }
 233           else
 234             /* We take care of locking ourself.  */
 235             __fsetlocking (ent->stream, FSETLOCKING_BYCALLER);
 236         }
 237     }
 238   else
 239     rewind (ent->stream);
 240
 241   give_spwd_free (&ent->pwd);
 242
 243   if (status == NSS_STATUS_SUCCESS && nss_setspent)
 244     ent->setent_status = nss_setspent (stayopen);
 245
 246   return status;
 247 }
 248
 249
 250 enum nss_status
 251 _nss_compat_setspent (int stayopen)
 252 {
 253   enum nss_status result;
 254
 255   __libc_lock_lock (lock);
 256
 257   if (ni == NULL)
 258     init_nss_interface ();
 259
 260   result = internal_setspent (&ext_ent, stayopen);
 261
 262   __libc_lock_unlock (lock);
 263
 264   return result;
 265 }
 266
 267
 268 static enum nss_status
 269 internal_endspent (ent_t *ent)
 270 {
 271   if (nss_endspent)
 272     nss_endspent ();
 273
 274   if (ent->stream != NULL)
 275     {
 276       fclose (ent->stream);
 277       ent->stream = NULL;
 278     }
 279
 280   if (ent->netgroup)
 281     __internal_endnetgrent (&ent->netgrdata);
 282
 283   ent->first = ent->netgroup = false;
 284   ent->files = true;
 285
 286   if (ent->blacklist.data != NULL)
 287     {
 288       ent->blacklist.current = 1;
 289       ent->blacklist.data[0] = '|';
 290       ent->blacklist.data[1] = '\0';
 291     }
 292   else
 293     ent->blacklist.current = 0;
 294
 295   give_spwd_free (&ent->pwd);
 296
 297   return NSS_STATUS_SUCCESS;
 298 }
 299
 300 enum nss_status
 301 _nss_compat_endspent (void)
 302 {
 303   enum nss_status result;
 304
 305   __libc_lock_lock (lock);
 306
 307   result = internal_endspent (&ext_ent);
 308
 309   __libc_lock_unlock (lock);
 310
 311   return result;
 312 }
 313
 314
 315 static enum nss_status
 316 getspent_next_nss_netgr (const char *name, struct spwd *result, ent_t *ent,
 317                          char *group, char *buffer, size_t buflen,
 318                          int *errnop)
 319 {
 320   char *curdomain = NULL, *host, *user, *domain, *p2;
 321   size_t p2len;
 322
 323   if (!nss_getspnam_r)
 324     return NSS_STATUS_UNAVAIL;
 325
 326   /* If the setpwent call failed, say so.  */
 327   if (ent->setent_status != NSS_STATUS_SUCCESS)
 328     return ent->setent_status;
 329
 330   if (ent->first)
 331     {
 332       memset (&ent->netgrdata, 0, sizeof (struct __netgrent));
 333       __internal_setnetgrent (group, &ent->netgrdata);
 334       ent->first = false;
 335     }
 336
 337   while (1)
 338     {
 339       enum nss_status status;
 340
 341       status = __internal_getnetgrent_r (&host, &user, &domain,
 342                                          &ent->netgrdata, buffer, buflen,
 343                                          errnop);
 344       if (status != 1)
 345         {
 346           __internal_endnetgrent (&ent->netgrdata);
 347           ent->netgroup = false;
 348           give_spwd_free (&ent->pwd);
 349           return NSS_STATUS_RETURN;
 350         }
 351
 352       if (user == NULL || user[0] == '-')
 353         continue;
 354
 355       if (domain != NULL)
 356         {
 357           if (curdomain == NULL
 358               && yp_get_default_domain (&curdomain) != YPERR_SUCCESS)
 359             {
 360               __internal_endnetgrent (&ent->netgrdata);
 361               ent->netgroup = false;
 362               give_spwd_free (&ent->pwd);
 363               return NSS_STATUS_UNAVAIL;
 364             }
 365           if (strcmp (curdomain, domain) != 0)
 366             continue;
 367         }
 368
 369       /* If name != NULL, we are called from getpwnam */
 370       if (name != NULL)
 371         if (strcmp (user, name) != 0)
 372           continue;
 373
 374       p2len = spwd_need_buflen (&ent->pwd);
 375       if (p2len > buflen)
 376         {
 377           *errnop = ERANGE;
 378           return NSS_STATUS_TRYAGAIN;
 379         }
 380       p2 = buffer + (buflen - p2len);
 381       buflen -= p2len;
 382
 383       if (nss_getspnam_r (user, result, buffer, buflen, errnop) !=
 384           NSS_STATUS_SUCCESS)
 385         continue;
 386
 387       if (!in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 388         {
 389           /* Store the User in the blacklist for possible the "+" at the
 390              end of /etc/passwd */
 391           blacklist_store_name (result->sp_namp, ent);
 392           copy_spwd_changes (result, &ent->pwd, p2, p2len);
 393           break;
 394         }
 395     }
 396
 397   return NSS_STATUS_SUCCESS;
 398 }
 399
 400
 401 static enum nss_status
 402 getspent_next_nss (struct spwd *result, ent_t *ent,
 403                    char *buffer, size_t buflen, int *errnop)
 404 {
 405   enum nss_status status;
 406   char *p2;
 407   size_t p2len;
 408
 409   if (!nss_getspent_r)
 410     return NSS_STATUS_UNAVAIL;
 411
 412   p2len = spwd_need_buflen (&ent->pwd);
 413   if (p2len > buflen)
 414     {
 415       *errnop = ERANGE;
 416       return NSS_STATUS_TRYAGAIN;
 417     }
 418   p2 = buffer + (buflen - p2len);
 419   buflen -= p2len;
 420   do
 421     {
 422       if ((status = nss_getspent_r (result, buffer, buflen, errnop)) !=
 423           NSS_STATUS_SUCCESS)
 424         return status;
 425     }
 426   while (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent));
 427
 428   copy_spwd_changes (result, &ent->pwd, p2, p2len);
 429
 430   return NSS_STATUS_SUCCESS;
 431 }
 432
 433
 434 /* This function handle the +user entrys in /etc/shadow */
 435 static enum nss_status
 436 getspnam_plususer (const char *name, struct spwd *result, ent_t *ent,
 437                    char *buffer, size_t buflen, int *errnop)
 438 {
 439   if (!nss_getspnam_r)
 440     return NSS_STATUS_UNAVAIL;
 441
 442   struct spwd pwd;
 443   memset (&pwd, '\0', sizeof (struct spwd));
 444   pwd.sp_warn = -1;
 445   pwd.sp_inact = -1;
 446   pwd.sp_expire = -1;
 447   pwd.sp_flag = ~0ul;
 448
 449   copy_spwd_changes (&pwd, result, NULL, 0);
 450
 451   size_t plen = spwd_need_buflen (&pwd);
 452   if (plen > buflen)
 453     {
 454       *errnop = ERANGE;
 455       return NSS_STATUS_TRYAGAIN;
 456     }
 457   char *p = buffer + (buflen - plen);
 458   buflen -= plen;
 459
 460   enum nss_status status = nss_getspnam_r (name, result, buffer, buflen,
 461                                            errnop);
 462   if (status != NSS_STATUS_SUCCESS)
 463     return status;
 464
 465   if (in_blacklist (result->sp_namp, strlen (result->sp_namp), ent))
 466     return NSS_STATUS_NOTFOUND;
 467
 468   copy_spwd_changes (result, &pwd, p, plen);
 469   give_spwd_free (&pwd);
 470   /* We found the entry.  */
 471   return NSS_STATUS_SUCCESS;
 472 }
 473
 474
 475 static enum nss_status
 476 getspent_next_file (struct spwd *result, ent_t *ent,
 477                     char *buffer, size_t buflen, int *errnop)
 478 {
 479   struct parser_data *data = (void *) buffer;
 480   while (1)
 481     {
 482       fpos_t pos;
 483       int parse_res = 0;
 484       char *p;
 485
 486       do
 487         {
 488           /* We need at least 3 characters for one line.  */
 489           if (__builtin_expect (buflen < 3, 0))
 490             {
 491             erange:
 492               *errnop = ERANGE;
 493               return NSS_STATUS_TRYAGAIN;
 494             }
 495
 496           fgetpos (ent->stream, &pos);
 497           buffer[buflen - 1] = '\xff';
 498           p = fgets_unlocked (buffer, buflen, ent->stream);
 499           if (p == NULL && feof_unlocked (ent->stream))
 500             return NSS_STATUS_NOTFOUND;
 501
 502           if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 503             {
 504             erange_reset:
 505               fsetpos (ent->stream, &pos);
 506               goto erange;
 507             }
 508
 509           /* Skip leading blanks.  */
 510           while (isspace (*p))
 511             ++p;
 512         }
 513       while (*p == '\0' || *p == '#'    /* Ignore empty and comment lines.  */
 514              /* Parse the line.  If it is invalid, loop to
 515                 get the next line of the file to parse.  */
 516              || !(parse_res = _nss_files_parse_spent (p, result, data,
 517                                                       buflen, errnop)));
 518
 519       if (__builtin_expect (parse_res == -1, 0))
 520         /* The parser ran out of space.  */
 521         goto erange_reset;
 522
 523       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 524         /* This is a real entry.  */
 525         break;
 526
 527       /* -@netgroup */
 528       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 529           && result->sp_namp[2] != '\0')
 530         {
 531           /* XXX Do not use fixed length buffers.  */
 532           char buf2[1024];
 533           char *user, *host, *domain;
 534           struct __netgrent netgrdata;
 535
 536           bzero (&netgrdata, sizeof (struct __netgrent));
 537           __internal_setnetgrent (&result->sp_namp[2], &netgrdata);
 538           while (__internal_getnetgrent_r (&host, &user, &domain,
 539                                            &netgrdata, buf2, sizeof (buf2),
 540                                            errnop))
 541             {
 542               if (user != NULL && user[0] != '-')
 543                 blacklist_store_name (user, ent);
 544             }
 545           __internal_endnetgrent (&netgrdata);
 546           continue;
 547         }
 548
 549       /* +@netgroup */
 550       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 551           && result->sp_namp[2] != '\0')
 552         {
 553           int status;
 554
 555           ent->netgroup = true;
 556           ent->first = true;
 557           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 558
 559           status = getspent_next_nss_netgr (NULL, result, ent,
 560                                             &result->sp_namp[2],
 561                                             buffer, buflen, errnop);
 562           if (status == NSS_STATUS_RETURN)
 563             continue;
 564           else
 565             return status;
 566         }
 567
 568       /* -user */
 569       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 570           && result->sp_namp[1] != '@')
 571         {
 572           blacklist_store_name (&result->sp_namp[1], ent);
 573           continue;
 574         }
 575
 576       /* +user */
 577       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 578           && result->sp_namp[1] != '@')
 579         {
 580           size_t len = strlen (result->sp_namp);
 581           char buf[len];
 582           enum nss_status status;
 583
 584           /* Store the User in the blacklist for the "+" at the end of
 585              /etc/passwd */
 586           memcpy (buf, &result->sp_namp[1], len);
 587           status = getspnam_plususer (&result->sp_namp[1], result, ent,
 588                                       buffer, buflen, errnop);
 589           blacklist_store_name (buf, ent);
 590
 591           if (status == NSS_STATUS_SUCCESS)     /* We found the entry. */
 592             break;
 593           /* We couldn't parse the entry */
 594           else if (status == NSS_STATUS_RETURN
 595                    /* entry doesn't exist */
 596                    || status == NSS_STATUS_NOTFOUND)
 597             continue;
 598           else
 599             {
 600               if (status == NSS_STATUS_TRYAGAIN)
 601                 {
 602                   fsetpos (ent->stream, &pos);
 603                   *errnop = ERANGE;
 604                 }
 605               return status;
 606             }
 607         }
 608
 609       /* +:... */
 610       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 611         {
 612           ent->files = false;
 613           ent->first = true;
 614           copy_spwd_changes (&ent->pwd, result, NULL, 0);
 615
 616           return getspent_next_nss (result, ent, buffer, buflen, errnop);
 617         }
 618     }
 619
 620   return NSS_STATUS_SUCCESS;
 621 }
 622
 623
 624 static enum nss_status
 625 internal_getspent_r (struct spwd *pw, ent_t *ent,
 626                      char *buffer, size_t buflen, int *errnop)
 627 {
 628   if (ent->netgroup)
 629     {
 630       enum nss_status status;
 631
 632       /* We are searching members in a netgroup */
 633       /* Since this is not the first call, we don't need the group name */
 634       status = getspent_next_nss_netgr (NULL, pw, ent, NULL, buffer,
 635                                         buflen, errnop);
 636
 637       if (status == NSS_STATUS_RETURN)
 638         return getspent_next_file (pw, ent, buffer, buflen, errnop);
 639       else
 640         return status;
 641     }
 642   else if (ent->files)
 643     return getspent_next_file (pw, ent, buffer, buflen, errnop);
 644   else
 645     return getspent_next_nss (pw, ent, buffer, buflen, errnop);
 646 }
 647
 648
 649 enum nss_status
 650 _nss_compat_getspent_r (struct spwd *pwd, char *buffer, size_t buflen,
 651                         int *errnop)
 652 {
 653   enum nss_status result = NSS_STATUS_SUCCESS;
 654
 655   __libc_lock_lock (lock);
 656
 657   /* Be prepared that the setpwent function was not called before.  */
 658   if (ni == NULL)
 659     init_nss_interface ();
 660
 661   if (ext_ent.stream == NULL)
 662     result = internal_setspent (&ext_ent, 1);
 663
 664   if (result == NSS_STATUS_SUCCESS)
 665     result = internal_getspent_r (pwd, &ext_ent, buffer, buflen, errnop);
 666
 667   __libc_lock_unlock (lock);
 668
 669   return result;
 670 }
 671
 672
 673 /* Searches in /etc/passwd and the NIS/NIS+ map for a special user */
 674 static enum nss_status
 675 internal_getspnam_r (const char *name, struct spwd *result, ent_t *ent,
 676                      char *buffer, size_t buflen, int *errnop)
 677 {
 678   struct parser_data *data = (void *) buffer;
 679
 680   while (1)
 681     {
 682       fpos_t pos;
 683       char *p;
 684       int parse_res;
 685
 686       do
 687         {
 688           /* We need at least 3 characters for one line.  */
 689           if (__builtin_expect (buflen < 3, 0))
 690             {
 691             erange:
 692               *errnop = ERANGE;
 693               return NSS_STATUS_TRYAGAIN;
 694             }
 695
 696           fgetpos (ent->stream, &pos);
 697           buffer[buflen - 1] = '\xff';
 698           p = fgets_unlocked (buffer, buflen, ent->stream);
 699           if (p == NULL && feof_unlocked (ent->stream))
 700             return NSS_STATUS_NOTFOUND;
 701
 702           if (p == NULL || buffer[buflen - 1] != '\xff')
 703             {
 704             erange_reset:
 705               fsetpos (ent->stream, &pos);
 706               goto erange;
 707             }
 708
 709           /* Terminate the line for any case.  */
 710           buffer[buflen - 1] = '\0';
 711
 712           /* Skip leading blanks.  */
 713           while (isspace (*p))
 714             ++p;
 715         }
 716       while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines.  */
 717              /* Parse the line.  If it is invalid, loop to
 718                 get the next line of the file to parse.  */
 719              !(parse_res = _nss_files_parse_spent (p, result, data, buflen,
 720                                                    errnop)));
 721
 722       if (__builtin_expect (parse_res == -1, 0))
 723         /* The parser ran out of space.  */
 724         goto erange_reset;
 725
 726       /* This is a real entry.  */
 727       if (result->sp_namp[0] != '+' && result->sp_namp[0] != '-')
 728         {
 729           if (strcmp (result->sp_namp, name) == 0)
 730             return NSS_STATUS_SUCCESS;
 731           else
 732             continue;
 733         }
 734
 735       /* -@netgroup */
 736       /* If the loaded NSS module does not support this service, add
 737          all users from a +@netgroup entry to the blacklist, too.  */
 738       if (result->sp_namp[0] == '-' && result->sp_namp[1] == '@'
 739           && result->sp_namp[2] != '\0')
 740         {
 741           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 742             return NSS_STATUS_NOTFOUND;
 743           continue;
 744         }
 745
 746       /* +@netgroup */
 747       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '@'
 748           && result->sp_namp[2] != '\0')
 749         {
 750           enum nss_status status;
 751
 752           if (innetgr (&result->sp_namp[2], NULL, name, NULL))
 753             {
 754               status = getspnam_plususer (name, result, ent, buffer,
 755                                           buflen, errnop);
 756
 757               if (status == NSS_STATUS_RETURN)
 758                 continue;
 759
 760               return status;
 761             }
 762           continue;
 763         }
 764
 765       /* -user */
 766       if (result->sp_namp[0] == '-' && result->sp_namp[1] != '\0'
 767           && result->sp_namp[1] != '@')
 768         {
 769           if (strcmp (&result->sp_namp[1], name) == 0)
 770             return NSS_STATUS_NOTFOUND;
 771           else
 772             continue;
 773         }
 774
 775       /* +user */
 776       if (result->sp_namp[0] == '+' && result->sp_namp[1] != '\0'
 777           && result->sp_namp[1] != '@')
 778         {
 779           if (strcmp (name, &result->sp_namp[1]) == 0)
 780             {
 781               enum nss_status status;
 782
 783               status = getspnam_plususer (name, result, ent,
 784                                           buffer, buflen, errnop);
 785
 786               if (status == NSS_STATUS_RETURN)
 787                 /* We couldn't parse the entry */
 788                 return NSS_STATUS_NOTFOUND;
 789               else
 790                 return status;
 791             }
 792         }
 793
 794       /* +:... */
 795       if (result->sp_namp[0] == '+' && result->sp_namp[1] == '\0')
 796         {
 797           enum nss_status status;
 798
 799           status = getspnam_plususer (name, result, ent,
 800                                       buffer, buflen, errnop);
 801
 802           if (status == NSS_STATUS_SUCCESS)
 803             /* We found the entry. */
 804             break;
 805           else if (status == NSS_STATUS_RETURN)
 806             /* We couldn't parse the entry */
 807             return NSS_STATUS_NOTFOUND;
 808           else
 809             return status;
 810         }
 811     }
 812   return NSS_STATUS_SUCCESS;
 813 }
 814
 815
 816 enum nss_status
 817 _nss_compat_getspnam_r (const char *name, struct spwd *pwd,
 818                         char *buffer, size_t buflen, int *errnop)
 819 {
 820   enum nss_status result;
 821   ent_t ent = { false, true, false, NSS_STATUS_SUCCESS, NULL, { NULL, 0, 0},
 822                 { NULL, NULL, 0, 0, 0, 0, 0, 0, 0}};
 823
 824   if (name[0] == '-' || name[0] == '+')
 825     return NSS_STATUS_NOTFOUND;
 826
 827   __libc_lock_lock (lock);
 828
 829   if (ni == NULL)
 830     init_nss_interface ();
 831
 832   __libc_lock_unlock (lock);
 833
 834   result = internal_setspent (&ent, 0);
 835
 836   if (result == NSS_STATUS_SUCCESS)
 837     result = internal_getspnam_r (name, pwd, &ent, buffer, buflen, errnop);
 838
 839   internal_endspent (&ent);
 840
 841   return result;
 842 }
 843
 844
 845 /* Support routines for remembering -@netgroup and -user entries.
 846    The names are stored in a single string with `|' as separator. */
 847 static void
 848 blacklist_store_name (const char *name, ent_t *ent)
 849 {
 850   int namelen = strlen (name);
 851   char *tmp;
 852
 853   /* first call, setup cache */
 854   if (ent->blacklist.size == 0)
 855     {
 856       ent->blacklist.size = MAX (BLACKLIST_INITIAL_SIZE, 2 * namelen);
 857       ent->blacklist.data = malloc (ent->blacklist.size);
 858       if (ent->blacklist.data == NULL)
 859         return;
 860       ent->blacklist.data[0] = '|';
 861       ent->blacklist.data[1] = '\0';
 862       ent->blacklist.current = 1;
 863     }
 864   else
 865     {
 866       if (in_blacklist (name, namelen, ent))
 867         return;                 /* no duplicates */
 868
 869       if (ent->blacklist.current + namelen + 1 >= ent->blacklist.size)
 870         {
 871           ent->blacklist.size += MAX (BLACKLIST_INCREMENT, 2 * namelen);
 872           tmp = realloc (ent->blacklist.data, ent->blacklist.size);
 873           if (tmp == NULL)
 874             {
 875               free (ent->blacklist.data);
 876               ent->blacklist.size = 0;
 877               return;
 878             }
 879           ent->blacklist.data = tmp;
 880         }
 881     }
 882
 883   tmp = stpcpy (ent->blacklist.data + ent->blacklist.current, name);
 884   *tmp++ = '|';
 885   *tmp = '\0';
 886   ent->blacklist.current += namelen + 1;
 887
 888   return;
 889 }
 890
 891
 892 /* Returns TRUE if ent->blacklist contains name, else FALSE.  */
 893 static bool_t
 894 in_blacklist (const char *name, int namelen, ent_t *ent)
 895 {
 896   char buf[namelen + 3];
 897   char *cp;
 898
 899   if (ent->blacklist.data == NULL)
 900     return false;
 901
 902   buf[0] = '|';
 903   cp = stpcpy (&buf[1], name);
 904   *cp++ = '|';
 905   *cp = '\0';
 906   return strstr (ent->blacklist.data, buf) != NULL;
 907 }