1/* Copyright (C) 1998-2016 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
3 Contributed by Thorsten Kukuk <kukuk@uni-paderborn.de>, 1998.
4
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
14
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <http://www.gnu.org/licenses/>. */
18
19#include <alloca.h>
20#include <assert.h>
21#include <errno.h>
22#include <grp.h>
23#include <stdint.h>
24#include <stdio.h>
25#include <stdlib.h>
26#include <string.h>
27#include <unistd.h>
28#include <sys/mman.h>
29#include <sys/socket.h>
30#include <sys/uio.h>
31#include <sys/un.h>
32#include <not-cancel.h>
33#include <_itoa.h>
34#include <scratch_buffer.h>
35
36#include "nscd-client.h"
37#include "nscd_proto.h"
38
39int __nss_not_use_nscd_group;
40
41static int nscd_getgr_r (const char *key, size_t keylen, request_type type,
42 struct group *resultbuf, char *buffer,
43 size_t buflen, struct group **result)
44 internal_function;
45
46
47int
48__nscd_getgrnam_r (const char *name, struct group *resultbuf, char *buffer,
49 size_t buflen, struct group **result)
50{
51 return nscd_getgr_r (name, strlen (name) + 1, GETGRBYNAME, resultbuf,
52 buffer, buflen, result);
53}
54
55
56int
57__nscd_getgrgid_r (gid_t gid, struct group *resultbuf, char *buffer,
58 size_t buflen, struct group **result)
59{
60 char buf[3 * sizeof (gid_t)];
61 buf[sizeof (buf) - 1] = '\0';
62 char *cp = _itoa_word (gid, buf + sizeof (buf) - 1, 10, 0);
63
64 return nscd_getgr_r (cp, buf + sizeof (buf) - cp, GETGRBYGID, resultbuf,
65 buffer, buflen, result);
66}
67
68
69libc_locked_map_ptr (,__gr_map_handle) attribute_hidden;
70/* Note that we only free the structure if necessary. The memory
71 mapping is not removed since it is not visible to the malloc
72 handling. */
73libc_freeres_fn (gr_map_free)
74{
75 if (__gr_map_handle.mapped != NO_MAPPING)
76 {
77 void *p = __gr_map_handle.mapped;
78 __gr_map_handle.mapped = NO_MAPPING;
79 free (p);
80 }
81}
82
83
84static int
85internal_function
86nscd_getgr_r (const char *key, size_t keylen, request_type type,
87 struct group *resultbuf, char *buffer, size_t buflen,
88 struct group **result)
89{
90 int gc_cycle;
91 int nretries = 0;
92 const uint32_t *len = NULL;
93 struct scratch_buffer lenbuf;
94 scratch_buffer_init (&lenbuf);
95
96 /* If the mapping is available, try to search there instead of
97 communicating with the nscd. */
98 struct mapped_database *mapped = __nscd_get_map_ref (GETFDGR, "group",
99 &__gr_map_handle,
100 &gc_cycle);
101 retry:;
102 const char *gr_name = NULL;
103 size_t gr_name_len = 0;
104 int retval = -1;
105 const char *recend = (const char *) ~UINTMAX_C (0);
106 gr_response_header gr_resp;
107
108 if (mapped != NO_MAPPING)
109 {
110 struct datahead *found = __nscd_cache_search (type, key, keylen, mapped,
111 sizeof gr_resp);
112 if (found != NULL)
113 {
114 len = (const uint32_t *) (&found->data[0].grdata + 1);
115 gr_resp = found->data[0].grdata;
116 gr_name = ((const char *) len
117 + gr_resp.gr_mem_cnt * sizeof (uint32_t));
118 gr_name_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
119 recend = (const char *) found->data + found->recsize;
120 /* Now check if we can trust gr_resp fields. If GC is
121 in progress, it can contain anything. */
122 if (mapped->head->gc_cycle != gc_cycle)
123 {
124 retval = -2;
125 goto out;
126 }
127
128 /* The alignment is always sufficient, unless GC is in progress. */
129 assert (((uintptr_t) len & (__alignof__ (*len) - 1)) == 0);
130 }
131 }
132
133 int sock = -1;
134 if (gr_name == NULL)
135 {
136 sock = __nscd_open_socket (key, keylen, type, &gr_resp,
137 sizeof (gr_resp));
138 if (sock == -1)
139 {
140 __nss_not_use_nscd_group = 1;
141 goto out;
142 }
143 }
144
145 /* No value found so far. */
146 *result = NULL;
147
148 if (__glibc_unlikely (gr_resp.found == -1))
149 {
150 /* The daemon does not cache this database. */
151 __nss_not_use_nscd_group = 1;
152 goto out_close;
153 }
154
155 if (gr_resp.found == 1)
156 {
157 struct iovec vec[2];
158 char *p = buffer;
159 size_t total_len;
160 uintptr_t align;
161 nscd_ssize_t cnt;
162
163 /* Now allocate the buffer the array for the group members. We must
164 align the pointer. */
165 align = ((__alignof__ (char *) - (p - ((char *) 0)))
166 & (__alignof__ (char *) - 1));
167 total_len = (align + (1 + gr_resp.gr_mem_cnt) * sizeof (char *)
168 + gr_resp.gr_name_len + gr_resp.gr_passwd_len);
169 if (__glibc_unlikely (buflen < total_len))
170 {
171 no_room:
172 __set_errno (ERANGE);
173 retval = ERANGE;
174 goto out_close;
175 }
176 buflen -= total_len;
177
178 p += align;
179 resultbuf->gr_mem = (char **) p;
180 p += (1 + gr_resp.gr_mem_cnt) * sizeof (char *);
181
182 /* Set pointers for strings. */
183 resultbuf->gr_name = p;
184 p += gr_resp.gr_name_len;
185 resultbuf->gr_passwd = p;
186 p += gr_resp.gr_passwd_len;
187
188 /* Fill in what we know now. */
189 resultbuf->gr_gid = gr_resp.gr_gid;
190
191 /* Read the length information, group name, and password. */
192 if (gr_name == NULL)
193 {
194 /* Handle a simple, usual case: no group members. */
195 if (__glibc_likely (gr_resp.gr_mem_cnt == 0))
196 {
197 size_t n = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
198 if (__builtin_expect (__readall (sock, resultbuf->gr_name, n)
199 != (ssize_t) n, 0))
200 goto out_close;
201 }
202 else
203 {
204 /* Allocate array to store lengths. */
205 if (!scratch_buffer_set_array_size
206 (&lenbuf, gr_resp.gr_mem_cnt, sizeof (uint32_t)))
207 goto out_close;
208 len = lenbuf.data;
209
210 vec[0].iov_base = (void *) len;
211 vec[0].iov_len = gr_resp.gr_mem_cnt * sizeof (uint32_t);
212 vec[1].iov_base = resultbuf->gr_name;
213 vec[1].iov_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len;
214 total_len = vec[0].iov_len + vec[1].iov_len;
215
216 /* Get this data. */
217 size_t n = __readvall (sock, vec, 2);
218 if (__glibc_unlikely (n != total_len))
219 goto out_close;
220 }
221 }
222 else
223 /* We already have the data. Just copy the group name and
224 password. */
225 memcpy (resultbuf->gr_name, gr_name,
226 gr_resp.gr_name_len + gr_resp.gr_passwd_len);
227
228 /* Clear the terminating entry. */
229 resultbuf->gr_mem[gr_resp.gr_mem_cnt] = NULL;
230
231 /* Prepare reading the group members. */
232 total_len = 0;
233 for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt)
234 {
235 resultbuf->gr_mem[cnt] = p;
236 total_len += len[cnt];
237 p += len[cnt];
238 }
239
240 if (__glibc_unlikely (gr_name + gr_name_len + total_len > recend))
241 {
242 /* len array might contain garbage during nscd GC cycle,
243 retry rather than fail in that case. */
244 if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle)
245 retval = -2;
246 goto out_close;
247 }
248 if (__glibc_unlikely (total_len > buflen))
249 {
250 /* len array might contain garbage during nscd GC cycle,
251 retry rather than fail in that case. */
252 if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle)
253 {
254 retval = -2;
255 goto out_close;
256 }
257 else
258 goto no_room;
259 }
260
261 retval = 0;
262
263 /* If there are no group members TOTAL_LEN is zero. */
264 if (gr_name == NULL)
265 {
266 if (total_len > 0
267 && __builtin_expect (__readall (sock, resultbuf->gr_mem[0],
268 total_len) != total_len, 0))
269 {
270 /* The `errno' to some value != ERANGE. */
271 __set_errno (ENOENT);
272 retval = ENOENT;
273 }
274 else
275 *result = resultbuf;
276 }
277 else
278 {
279 /* Copy the group member names. */
280 memcpy (resultbuf->gr_mem[0], gr_name + gr_name_len, total_len);
281
282 /* Try to detect corrupt databases. */
283 if (resultbuf->gr_name[gr_name_len - 1] != '\0'
284 || resultbuf->gr_passwd[gr_resp.gr_passwd_len - 1] != '\0'
285 || ({for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt)
286 if (resultbuf->gr_mem[cnt][len[cnt] - 1] != '\0')
287 break;
288 cnt < gr_resp.gr_mem_cnt; }))
289 {
290 /* We cannot use the database. */
291 retval = mapped->head->gc_cycle != gc_cycle ? -2 : -1;
292 goto out_close;
293 }
294
295 *result = resultbuf;
296 }
297 }
298 else
299 {
300 /* Set errno to 0 to indicate no error, just no found record. */
301 __set_errno (0);
302 /* Even though we have not found anything, the result is zero. */
303 retval = 0;
304 }
305
306 out_close:
307 if (sock != -1)
308 close_not_cancel_no_status (sock);
309 out:
310 if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
311 {
312 /* When we come here this means there has been a GC cycle while we
313 were looking for the data. This means the data might have been
314 inconsistent. Retry if possible. */
315 if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
316 {
317 /* nscd is just running gc now. Disable using the mapping. */
318 if (atomic_decrement_val (&mapped->counter) == 0)
319 __nscd_unmap (mapped);
320 mapped = NO_MAPPING;
321 }
322
323 if (retval != -1)
324 goto retry;
325 }
326
327 scratch_buffer_free (&lenbuf);
328
329 return retval;
330}
331