1 | /* Copyright (C) 1998-2017 Free Software Foundation, Inc. |
2 | This file is part of the GNU C Library. |
3 | Contributed by Thorsten Kukuk <kukuk@uni-paderborn.de>, 1998. |
4 | |
5 | The GNU C Library is free software; you can redistribute it and/or |
6 | modify it under the terms of the GNU Lesser General Public |
7 | License as published by the Free Software Foundation; either |
8 | version 2.1 of the License, or (at your option) any later version. |
9 | |
10 | The GNU C Library is distributed in the hope that it will be useful, |
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
13 | Lesser General Public License for more details. |
14 | |
15 | You should have received a copy of the GNU Lesser General Public |
16 | License along with the GNU C Library; if not, see |
17 | <http://www.gnu.org/licenses/>. */ |
18 | |
19 | #include <alloca.h> |
20 | #include <assert.h> |
21 | #include <errno.h> |
22 | #include <grp.h> |
23 | #include <stdint.h> |
24 | #include <stdio.h> |
25 | #include <stdlib.h> |
26 | #include <string.h> |
27 | #include <unistd.h> |
28 | #include <sys/mman.h> |
29 | #include <sys/socket.h> |
30 | #include <sys/uio.h> |
31 | #include <sys/un.h> |
32 | #include <not-cancel.h> |
33 | #include <_itoa.h> |
34 | #include <scratch_buffer.h> |
35 | |
36 | #include "nscd-client.h" |
37 | #include "nscd_proto.h" |
38 | |
39 | int __nss_not_use_nscd_group; |
40 | |
41 | static int nscd_getgr_r (const char *key, size_t keylen, request_type type, |
42 | struct group *resultbuf, char *buffer, |
43 | size_t buflen, struct group **result) |
44 | internal_function; |
45 | |
46 | |
47 | int |
48 | __nscd_getgrnam_r (const char *name, struct group *resultbuf, char *buffer, |
49 | size_t buflen, struct group **result) |
50 | { |
51 | return nscd_getgr_r (name, strlen (name) + 1, GETGRBYNAME, resultbuf, |
52 | buffer, buflen, result); |
53 | } |
54 | |
55 | |
56 | int |
57 | __nscd_getgrgid_r (gid_t gid, struct group *resultbuf, char *buffer, |
58 | size_t buflen, struct group **result) |
59 | { |
60 | char buf[3 * sizeof (gid_t)]; |
61 | buf[sizeof (buf) - 1] = '\0'; |
62 | char *cp = _itoa_word (gid, buf + sizeof (buf) - 1, 10, 0); |
63 | |
64 | return nscd_getgr_r (cp, buf + sizeof (buf) - cp, GETGRBYGID, resultbuf, |
65 | buffer, buflen, result); |
66 | } |
67 | |
68 | |
69 | libc_locked_map_ptr (,__gr_map_handle) attribute_hidden; |
70 | /* Note that we only free the structure if necessary. The memory |
71 | mapping is not removed since it is not visible to the malloc |
72 | handling. */ |
73 | libc_freeres_fn (gr_map_free) |
74 | { |
75 | if (__gr_map_handle.mapped != NO_MAPPING) |
76 | { |
77 | void *p = __gr_map_handle.mapped; |
78 | __gr_map_handle.mapped = NO_MAPPING; |
79 | free (p); |
80 | } |
81 | } |
82 | |
83 | |
84 | static int |
85 | internal_function |
86 | nscd_getgr_r (const char *key, size_t keylen, request_type type, |
87 | struct group *resultbuf, char *buffer, size_t buflen, |
88 | struct group **result) |
89 | { |
90 | int gc_cycle; |
91 | int nretries = 0; |
92 | const uint32_t *len = NULL; |
93 | struct scratch_buffer lenbuf; |
94 | scratch_buffer_init (&lenbuf); |
95 | |
96 | /* If the mapping is available, try to search there instead of |
97 | communicating with the nscd. */ |
98 | struct mapped_database *mapped = __nscd_get_map_ref (GETFDGR, "group" , |
99 | &__gr_map_handle, |
100 | &gc_cycle); |
101 | retry:; |
102 | const char *gr_name = NULL; |
103 | size_t gr_name_len = 0; |
104 | int retval = -1; |
105 | const char *recend = (const char *) ~UINTMAX_C (0); |
106 | gr_response_header gr_resp; |
107 | |
108 | if (mapped != NO_MAPPING) |
109 | { |
110 | struct datahead *found = __nscd_cache_search (type, key, keylen, mapped, |
111 | sizeof gr_resp); |
112 | if (found != NULL) |
113 | { |
114 | len = (const uint32_t *) (&found->data[0].grdata + 1); |
115 | gr_resp = found->data[0].grdata; |
116 | gr_name = ((const char *) len |
117 | + gr_resp.gr_mem_cnt * sizeof (uint32_t)); |
118 | gr_name_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len; |
119 | recend = (const char *) found->data + found->recsize; |
120 | /* Now check if we can trust gr_resp fields. If GC is |
121 | in progress, it can contain anything. */ |
122 | if (mapped->head->gc_cycle != gc_cycle) |
123 | { |
124 | retval = -2; |
125 | goto out; |
126 | } |
127 | |
128 | /* The alignment is always sufficient, unless GC is in progress. */ |
129 | assert (((uintptr_t) len & (__alignof__ (*len) - 1)) == 0); |
130 | } |
131 | } |
132 | |
133 | int sock = -1; |
134 | if (gr_name == NULL) |
135 | { |
136 | sock = __nscd_open_socket (key, keylen, type, &gr_resp, |
137 | sizeof (gr_resp)); |
138 | if (sock == -1) |
139 | { |
140 | __nss_not_use_nscd_group = 1; |
141 | goto out; |
142 | } |
143 | } |
144 | |
145 | /* No value found so far. */ |
146 | *result = NULL; |
147 | |
148 | if (__glibc_unlikely (gr_resp.found == -1)) |
149 | { |
150 | /* The daemon does not cache this database. */ |
151 | __nss_not_use_nscd_group = 1; |
152 | goto out_close; |
153 | } |
154 | |
155 | if (gr_resp.found == 1) |
156 | { |
157 | struct iovec vec[2]; |
158 | char *p = buffer; |
159 | size_t total_len; |
160 | uintptr_t align; |
161 | nscd_ssize_t cnt; |
162 | |
163 | /* Now allocate the buffer the array for the group members. We must |
164 | align the pointer. */ |
165 | align = ((__alignof__ (char *) - (p - ((char *) 0))) |
166 | & (__alignof__ (char *) - 1)); |
167 | total_len = (align + (1 + gr_resp.gr_mem_cnt) * sizeof (char *) |
168 | + gr_resp.gr_name_len + gr_resp.gr_passwd_len); |
169 | if (__glibc_unlikely (buflen < total_len)) |
170 | { |
171 | no_room: |
172 | __set_errno (ERANGE); |
173 | retval = ERANGE; |
174 | goto out_close; |
175 | } |
176 | buflen -= total_len; |
177 | |
178 | p += align; |
179 | resultbuf->gr_mem = (char **) p; |
180 | p += (1 + gr_resp.gr_mem_cnt) * sizeof (char *); |
181 | |
182 | /* Set pointers for strings. */ |
183 | resultbuf->gr_name = p; |
184 | p += gr_resp.gr_name_len; |
185 | resultbuf->gr_passwd = p; |
186 | p += gr_resp.gr_passwd_len; |
187 | |
188 | /* Fill in what we know now. */ |
189 | resultbuf->gr_gid = gr_resp.gr_gid; |
190 | |
191 | /* Read the length information, group name, and password. */ |
192 | if (gr_name == NULL) |
193 | { |
194 | /* Handle a simple, usual case: no group members. */ |
195 | if (__glibc_likely (gr_resp.gr_mem_cnt == 0)) |
196 | { |
197 | size_t n = gr_resp.gr_name_len + gr_resp.gr_passwd_len; |
198 | if (__builtin_expect (__readall (sock, resultbuf->gr_name, n) |
199 | != (ssize_t) n, 0)) |
200 | goto out_close; |
201 | } |
202 | else |
203 | { |
204 | /* Allocate array to store lengths. */ |
205 | if (!scratch_buffer_set_array_size |
206 | (&lenbuf, gr_resp.gr_mem_cnt, sizeof (uint32_t))) |
207 | goto out_close; |
208 | len = lenbuf.data; |
209 | |
210 | vec[0].iov_base = (void *) len; |
211 | vec[0].iov_len = gr_resp.gr_mem_cnt * sizeof (uint32_t); |
212 | vec[1].iov_base = resultbuf->gr_name; |
213 | vec[1].iov_len = gr_resp.gr_name_len + gr_resp.gr_passwd_len; |
214 | total_len = vec[0].iov_len + vec[1].iov_len; |
215 | |
216 | /* Get this data. */ |
217 | size_t n = __readvall (sock, vec, 2); |
218 | if (__glibc_unlikely (n != total_len)) |
219 | goto out_close; |
220 | } |
221 | } |
222 | else |
223 | /* We already have the data. Just copy the group name and |
224 | password. */ |
225 | memcpy (resultbuf->gr_name, gr_name, |
226 | gr_resp.gr_name_len + gr_resp.gr_passwd_len); |
227 | |
228 | /* Clear the terminating entry. */ |
229 | resultbuf->gr_mem[gr_resp.gr_mem_cnt] = NULL; |
230 | |
231 | /* Prepare reading the group members. */ |
232 | total_len = 0; |
233 | for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt) |
234 | { |
235 | resultbuf->gr_mem[cnt] = p; |
236 | total_len += len[cnt]; |
237 | p += len[cnt]; |
238 | } |
239 | |
240 | if (__glibc_unlikely (gr_name + gr_name_len + total_len > recend)) |
241 | { |
242 | /* len array might contain garbage during nscd GC cycle, |
243 | retry rather than fail in that case. */ |
244 | if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle) |
245 | retval = -2; |
246 | goto out_close; |
247 | } |
248 | if (__glibc_unlikely (total_len > buflen)) |
249 | { |
250 | /* len array might contain garbage during nscd GC cycle, |
251 | retry rather than fail in that case. */ |
252 | if (gr_name != NULL && mapped->head->gc_cycle != gc_cycle) |
253 | { |
254 | retval = -2; |
255 | goto out_close; |
256 | } |
257 | else |
258 | goto no_room; |
259 | } |
260 | |
261 | retval = 0; |
262 | |
263 | /* If there are no group members TOTAL_LEN is zero. */ |
264 | if (gr_name == NULL) |
265 | { |
266 | if (total_len > 0 |
267 | && __builtin_expect (__readall (sock, resultbuf->gr_mem[0], |
268 | total_len) != total_len, 0)) |
269 | { |
270 | /* The `errno' to some value != ERANGE. */ |
271 | __set_errno (ENOENT); |
272 | retval = ENOENT; |
273 | } |
274 | else |
275 | *result = resultbuf; |
276 | } |
277 | else |
278 | { |
279 | /* Copy the group member names. */ |
280 | memcpy (resultbuf->gr_mem[0], gr_name + gr_name_len, total_len); |
281 | |
282 | /* Try to detect corrupt databases. */ |
283 | if (resultbuf->gr_name[gr_name_len - 1] != '\0' |
284 | || resultbuf->gr_passwd[gr_resp.gr_passwd_len - 1] != '\0' |
285 | || ({for (cnt = 0; cnt < gr_resp.gr_mem_cnt; ++cnt) |
286 | if (resultbuf->gr_mem[cnt][len[cnt] - 1] != '\0') |
287 | break; |
288 | cnt < gr_resp.gr_mem_cnt; })) |
289 | { |
290 | /* We cannot use the database. */ |
291 | retval = mapped->head->gc_cycle != gc_cycle ? -2 : -1; |
292 | goto out_close; |
293 | } |
294 | |
295 | *result = resultbuf; |
296 | } |
297 | } |
298 | else |
299 | { |
300 | /* Set errno to 0 to indicate no error, just no found record. */ |
301 | __set_errno (0); |
302 | /* Even though we have not found anything, the result is zero. */ |
303 | retval = 0; |
304 | } |
305 | |
306 | out_close: |
307 | if (sock != -1) |
308 | close_not_cancel_no_status (sock); |
309 | out: |
310 | if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0) |
311 | { |
312 | /* When we come here this means there has been a GC cycle while we |
313 | were looking for the data. This means the data might have been |
314 | inconsistent. Retry if possible. */ |
315 | if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1) |
316 | { |
317 | /* nscd is just running gc now. Disable using the mapping. */ |
318 | if (atomic_decrement_val (&mapped->counter) == 0) |
319 | __nscd_unmap (mapped); |
320 | mapped = NO_MAPPING; |
321 | } |
322 | |
323 | if (retval != -1) |
324 | goto retry; |
325 | } |
326 | |
327 | scratch_buffer_free (&lenbuf); |
328 | |
329 | return retval; |
330 | } |
331 | |