/* Copyright (C) 1998-2018 Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Thorsten Kukuk <kukuk@uni-paderborn.de>, 1998.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<http://www.gnu.org/licenses/>. */
#include <alloca.h>
#include <assert.h>
#include <errno.h>
#include <grp.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <sys/un.h>
#include <not-cancel.h>
#include <_itoa.h>
#include <scratch_buffer.h>
#include "nscd-client.h"
#include "nscd_proto.h"
int __nss_not_use_nscd_group;
static int nscd_getgr_r (const char *key, size_t keylen, request_type type,
struct group *resultbuf, char *buffer,
size_t buflen, struct group **result);
int
__nscd_getgrnam_r (const char *name, struct group *resultbuf, char *buffer,
size_t buflen, struct group **result)
{
return nscd_getgr_r (name, strlen (name) + 1, GETGRBYNAME, resultbuf,
buffer, buflen, result);
}
int
__nscd_getgrgid_r (gid_t gid, struct group *resultbuf, char *buffer,
size_t buflen, struct group **result)
{
char buf[3 * sizeof (gid_t)];
buf[sizeof (buf) - 1] = '\0';
char *cp = _itoa_word (gid, buf + sizeof (buf) - 1, 10, 0);
return nscd_getgr_r (cp, buf + sizeof (buf) - cp, GETGRBYGID, resultbuf,
buffer, buflen, result);
}
libc_locked_map_ptr (,__gr_map_handle) attribute_hidden;
/* Note that we only free the structure if necessary. The memory
mapping is not removed since it is not visible to the malloc
handling. */
libc_freeres_fn (gr_map_free)
{
if (__gr_map_handle.mapped != NO_MAPPING)
{
void *p = __gr_map_handle.mapped;
__gr_map_handle.mapped = NO_MAPPING;
free (p);
}
}
static int
nscd_getgr_r (const char *key, size_t keylen, request_type type,
struct group *resultbuf, char *buffer, size_t buflen,
struct group **result)
{
int gc_cycle;
int nretries = 0;
const uint32_t *len = NULL;
struct scratch_buffer lenbuf;
scratch_buffer_init (&lenbuf);
/* If the mapping is available, try to search there instead of
communicating with the nscd. */
struct mapped_database *mapped = __nscd_get_map_ref (GETFDGR, "group",
&__gr_map_handle,
&gc_cycle);
retry:;
const char *gr_name = NULL;
size_t gr_name_len = 0;
int retval = -1;
const char *recend = (const char *) ~UINTMAX_C (0);
gr_response_header gr_resp;
if (mapped != NO_MAPPING)
{
struct datahead *found = __nscd_cache_search (type, key, keylen, mapped,
sizeof gr_resp);
if (found != NULL)
{
len = (const uint32_t *) (&found->data[0].grdata + 1);
gr_resp = found->data[0].grdata;
gr_name = ((const char *) len
+ gr_resp.gr_mem_cnt * sizeof (uint32_t));
gr_name_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
recend = (const char *) found->data + found->recsize;
/* Now check if we can trust gr_resp fields. If GC is
in progress, it can contain anything. */
if (mapped->head->gc_cycle != gc_cycle)
{
retval = -2;
goto out;
}
/* The alignment is always sufficient, unless GC is in progress. */
assert (((uintptr_t) len & (__alignof__ (*len) - 1)) == 0);
}
}
int sock = -1;
if (gr_name == NULL)
{
sock = __nscd_open_socket (key, keylen, type, &gr_resp,
sizeof (gr_resp));
if (sock == -1)
{
__nss_not_use_nscd_group = 1;
goto out;
}
}
/* No value found so far. */
*result = NULL;
if (__glibc_unlikely (gr_resp.found == -1))
{
/* The daemon does not cache this database. */
__nss_not_use_nscd_group = 1;
goto out_close;
}
if (gr_resp.found == 1)
{
struct iovec vec[2];
char *p = buffer;
size_t total_len;
uintptr_t align;
nscd_ssize_t cnt;
/* Now allocate the buffer the array for the group members. We must
align the pointer. */
align = ((__alignof__ (char *) - (p - ((char *) 0)))
& (__alignof__ (char *) - 1));
total_len = (align + (1 + gr_resp.gr_mem_cnt) * sizeof (char *)
+ gr_resp.gr_name_len + gr_resp.gr_passwd_len);
if (__glibc_unlikely (buflen < total_len))
{
no_room:
__set_errno (ERANGE);
retval = ERANGE;
goto out_close;
}
buflen -= total_len;
p += align;
resultbuf->gr_mem = (char **) p;
p += (1 + gr_resp.gr_mem_cnt) * sizeof (char *);
/* Set pointers for strings. */
resultbuf->gr_name = p;
p += gr_resp.gr_name_len;
resultbuf->gr_passwd = p;
p += gr_resp.gr_passwd_len;
/* Fill in what we know now. */
resultbuf->gr_gid = gr_resp.gr_gid;
/* Read the length information, group name, and password. */
if (gr_name == NULL)
{
/* Handle a simple, usual case: no group members. */
if (__glibc_likely (gr_resp.gr_mem_cnt == 0))
{
size_t n = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
if (__builtin_expect (__readall (sock, resultbuf->gr_name, n)
!= (ssize_t) n, 0))
goto out_close;
}
else
{
/* Allocate array to store lengths. */
if (!scratch_buffer_set_array_size
(&lenbuf, gr_resp.gr_mem_cnt, sizeof (uint32_t)))
goto out_close;
len = lenbuf.data;
vec[0].iov_base = (void *) len;
vec[0].iov_len = gr_resp.gr_mem_cnt * sizeof (uint32_t);
vec[1].iov_base = resultbuf->gr_name;
vec[1].iov_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
total_len = vec[0].iov_len + vec[1].iov_len;
/* Get this data. */
size_t n = __readvall (sock, vec, 2);
if (__glibc_unlikely (n != total_len))
goto out_close;
}
}
else
/* We already have the data. Just copy the group name and
password. */
memcpy (resultbuf->gr_name, gr_name,
gr_resp.gr_name_len + gr_resp.gr_passwd_len);
/* Clear the terminating entry. */
resultbuf->gr_mem[gr_resp.gr_mem_cnt] = NULL;
/* Prepare reading the group members. */
total_len = 0;
for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt)
{
resultbuf->gr_mem[cnt] = p;
total_len += len[cnt];
p += len[cnt];
}
if (__glibc_unlikely (gr_name + gr_name_len + total_len > recend))
{
/* len array might contain garbage during nscd GC cycle,
retry rather than fail in that case. */
if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle)
retval = -2;
goto out_close;
}
if (__glibc_unlikely (total_len > buflen))
{
/* len array might contain garbage during nscd GC cycle,
retry rather than fail in that case. */
if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle)
{
retval = -2;
goto out_close;
}
else
goto no_room;
}
retval = 0;
/* If there are no group members TOTAL_LEN is zero. */
if (gr_name == NULL)
{
if (total_len > 0
&& __builtin_expect (__readall (sock, resultbuf->gr_mem[0],
total_len) != total_len, 0))
{
/* The `errno' to some value != ERANGE. */
__set_errno (ENOENT);
retval = ENOENT;
}
else
*result = resultbuf;
}
else
{
/* Copy the group member names. */
memcpy (resultbuf->gr_mem[0], gr_name + gr_name_len, total_len);
/* Try to detect corrupt databases. */
if (resultbuf->gr_name[gr_name_len - 1] != '\0'
|| resultbuf->gr_passwd[gr_resp.gr_passwd_len - 1] != '\0'
|| ({for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt)
if (resultbuf->gr_mem[cnt][len[cnt] - 1] != '\0')
break;
cnt < gr_resp.gr_mem_cnt; }))
{
/* We cannot use the database. */
retval = mapped->head->gc_cycle != gc_cycle ? -2 : -1;
goto out_close;
}
*result = resultbuf;
}
}
else
{
/* Set errno to 0 to indicate no error, just no found record. */
__set_errno (0);
/* Even though we have not found anything, the result is zero. */
retval = 0;
}
out_close:
if (sock != -1)
__close_nocancel_nostatus (sock);
out:
if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
{
/* When we come here this means there has been a GC cycle while we
were looking for the data. This means the data might have been
inconsistent. Retry if possible. */
if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
{
/* nscd is just running gc now. Disable using the mapping. */
if (atomic_decrement_val (&mapped->counter) == 0)
__nscd_unmap (mapped);
mapped = NO_MAPPING;
}
if (retval != -1)
goto retry;
}
scratch_buffer_free (&lenbuf);
return retval;
}