/* Get the next group from NSS (+ entry). If the NSS module supports
initgroups_dyn, get all entries at once. */
static enum nss_status
getgrent_next_nss (ent_t *ent, char *buffer, size_t buflen, const char *user,
gid_t group, long int *start, long int *size,
gid_t **groupsp, long int limit, int *errnop)
{
enum nss_status status;
struct group grpbuf;
/* if this module does not support getgrent_r and initgroups_dyn,
abort. We cannot find the needed group entries. */
if (nss_getgrent_r == NULL && nss_initgroups_dyn == NULL)
return NSS_STATUS_UNAVAIL;
/* Try nss_initgroups_dyn if supported. We also need getgrgid_r.
If this function is not supported, step through the whole group
database with getgrent_r. */
if (nss_initgroups_dyn && nss_getgrgid_r)
{
long int mystart = 0;
long int mysize = limit <= 0 ? *size : limit;
gid_t *mygroups = malloc (mysize * sizeof (gid_t));
if (mygroups == NULL)
return NSS_STATUS_TRYAGAIN;
/* For every gid in the list we get from the NSS module,
get the whole group entry. We need to do this, since we
need the group name to check if it is in the blacklist.
In worst case, this is as twice as slow as stepping with
getgrent_r through the whole group database. But for large
group databases this is faster, since the user can only be
in a limited number of groups. */
if (nss_initgroups_dyn (user, group, &mystart, &mysize, &mygroups,
limit, errnop) == NSS_STATUS_SUCCESS)
{
/* A temporary buffer. We use the normal buffer, until we find
an entry, for which this buffer is to small. In this case, we
overwrite the pointer with one to a bigger buffer. */
char *tmpbuf = buffer;
size_t tmplen = buflen;
int i;
for (i = 0; i < mystart; i++)
{
while ((status = nss_getgrgid_r (mygroups[i], &grpbuf, tmpbuf,
tmplen,
errnop)) == NSS_STATUS_TRYAGAIN
&& *errnop == ERANGE)
if (tmpbuf == buffer)
{
tmplen *= 2;
tmpbuf = __alloca (tmplen);
}
else
tmpbuf = extend_alloca (tmpbuf, tmplen, 2 * tmplen);
if (!in_blacklist (grpbuf.gr_name,
strlen (grpbuf.gr_name), ent))
check_and_add_group (user, group, start, size, groupsp,
limit, &grpbuf);
}
free (mygroups);
return NSS_STATUS_NOTFOUND;
}
free (mygroups);
}
/* If we come here, the NSS module does not support initgroups_dyn
and we have to step through the whole list ourself. */
do
{
if ((status = nss_getgrent_r (&grpbuf, buffer, buflen, errnop)) !=
NSS_STATUS_SUCCESS)
return status;
}
while (in_blacklist (grpbuf.gr_name, strlen (grpbuf.gr_name), ent));
check_and_add_group (user, group, start, size, groupsp, limit, &grpbuf);
return NSS_STATUS_SUCCESS;
}
static enum nss_status
internal_getgrent_r (ent_t *ent, char *buffer, size_t buflen, const char *user,
gid_t group, long int *start, long int *size,
gid_t **groupsp, long int limit, int *errnop)
{
struct parser_data *data = (void *) buffer;
struct group grpbuf;
if (!ent->files)
return getgrent_next_nss (ent, buffer, buflen, user, group,
start, size, groupsp, limit, errnop);
while (1)
{
fpos_t pos;
int parse_res = 0;
char *p;
do
{
/* We need at least 3 characters for one line. */
if (__builtin_expect (buflen < 3, 0))
{
erange:
*errnop = ERANGE;
return NSS_STATUS_TRYAGAIN;
}
fgetpos (ent->stream, &pos);
buffer[buflen - 1] = '\xff';
p = fgets_unlocked (buffer, buflen, ent->stream);
if (p == NULL && feof_unlocked (ent->stream))
return NSS_STATUS_NOTFOUND;
if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
{
erange_reset:
fsetpos (ent->stream, &pos);
goto erange;
}
/* Terminate the line for any case. */
buffer[buflen - 1] = '\0';
/* Skip leading blanks. */
while (isspace (*p))
++p;
}
while (*p == '\0' || *p == '#' || /* Ignore empty and comment lines. */
/* Parse the line. If it is invalid, loop to
get the next line of the file to parse. */
!(parse_res = _nss_files_parse_grent (p, &grpbuf, data, buflen,
errnop)));
if (__builtin_expect (parse_res == -1, 0))
/* The parser ran out of space. */
goto erange_reset;
if (grpbuf.gr_name[0] != '+' && grpbuf.gr_name[0] != '-')
/* This is a real entry. */
break;
/* -group */
if (grpbuf.gr_name[0] == '-' && grpbuf.gr_name[1] != '\0'
&& grpbuf.gr_name[1] != '@')
{
blacklist_store_name (&grpbuf.gr_name[1], ent);
continue;
}
/* +group */
if (grpbuf.gr_name[0] == '+' && grpbuf.gr_name[1] != '\0'
&& grpbuf.gr_name[1] != '@')
{
if (in_blacklist (&grpbuf.gr_name[1],
strlen (&grpbuf.gr_name[1]), ent))
continue;
/* Store the group in the blacklist for the "+" at the end of
/etc/group */
blacklist_store_name (&grpbuf.gr_name[1], ent);
if (nss_getgrnam_r == NULL)
return NSS_STATUS_UNAVAIL;
else if (nss_getgrnam_r (&grpbuf.gr_name[1], &grpbuf, buffer,
buflen, errnop) != NSS_STATUS_SUCCESS)
continue;
check_and_add_group (user, group, start, size, groupsp,
limit, &grpbuf);
return NSS_STATUS_SUCCESS;
}
/* +:... */
if (grpbuf.gr_name[0] == '+' && grpbuf.gr_name[1] == '\0')
{
ent->files = FALSE;
return getgrent_next_nss (ent, buffer, buflen, user, group,
start, size, groupsp, limit, errnop);
}
}
check_and_add_group (user, group, start, size, groupsp, limit, &grpbuf);
return NSS_STATUS_SUCCESS;
}
/* Get the next group from NSS (+ entry). If the NSS module supports
initgroups_dyn, get all entries at once. */
static enum nss_status
getgrent_next_nss (ent_t *ent, char *buffer, size_t buflen, const char *user,
gid_t group, long int *start, long int *size,
gid_t **groupsp, long int limit, int *errnop)
{
enum nss_status status;
struct group grpbuf;
/* Try nss_initgroups_dyn if supported. We also need getgrgid_r.
If this function is not supported, step through the whole group
database with getgrent_r. */
if (! ent->skip_initgroups_dyn)
{
long int mystart = 0;
long int mysize = limit <= 0 ? *size : limit;
gid_t *mygroups = malloc (mysize * sizeof (gid_t));
if (mygroups == NULL)
return NSS_STATUS_TRYAGAIN;
/* For every gid in the list we get from the NSS module,
get the whole group entry. We need to do this, since we
need the group name to check if it is in the blacklist.
In worst case, this is as twice as slow as stepping with
getgrent_r through the whole group database. But for large
group databases this is faster, since the user can only be
in a limited number of groups. */
if (nss_initgroups_dyn (user, group, &mystart, &mysize, &mygroups,
limit, errnop) == NSS_STATUS_SUCCESS)
{
status = NSS_STATUS_NOTFOUND;
/* If there is no blacklist we can trust the underlying
initgroups implementation. */
if (ent->blacklist.current <= 1)
for (int i = 0; i < mystart; i++)
add_group (start, size, groupsp, limit, mygroups[i]);
else
{
/* A temporary buffer. We use the normal buffer, until we find
an entry, for which this buffer is to small. In this case, we
overwrite the pointer with one to a bigger buffer. */
char *tmpbuf = buffer;
size_t tmplen = buflen;
bool use_malloc = false;
for (int i = 0; i < mystart; i++)
{
while ((status = nss_getgrgid_r (mygroups[i], &grpbuf,
tmpbuf, tmplen, errnop))
== NSS_STATUS_TRYAGAIN
&& *errnop == ERANGE)
{
if (__libc_use_alloca (tmplen * 2))
{
if (tmpbuf == buffer)
{
tmplen *= 2;
tmpbuf = __alloca (tmplen);
}
else
tmpbuf = extend_alloca (tmpbuf, tmplen, tmplen * 2);
}
else
{
tmplen *= 2;
char *newbuf = realloc (use_malloc ? tmpbuf : NULL, tmplen);
if (newbuf == NULL)
{
status = NSS_STATUS_TRYAGAIN;
goto done;
}
use_malloc = true;
tmpbuf = newbuf;
}
}
if (__builtin_expect (status != NSS_STATUS_NOTFOUND, 1))
{
if (__builtin_expect (status != NSS_STATUS_SUCCESS, 0))
goto done;
if (!in_blacklist (grpbuf.gr_name,
strlen (grpbuf.gr_name), ent)
&& check_and_add_group (user, group, start, size,
groupsp, limit, &grpbuf))
{
if (nss_setgrent != NULL)
{
nss_setgrent (1);
ent->need_endgrent = true;
}
ent->skip_initgroups_dyn = true;
goto iter;
}
}
}
status = NSS_STATUS_NOTFOUND;
done:
if (use_malloc)
free (tmpbuf);
}
free (mygroups);
return status;
}
free (mygroups);
}
/* If we come here, the NSS module does not support initgroups_dyn
or we were confronted with a split group. In these cases we have
to step through the whole list ourself. */
iter:
do
{
if ((status = nss_getgrent_r (&grpbuf, buffer, buflen, errnop)) !=
NSS_STATUS_SUCCESS)
break;
}
while (in_blacklist (grpbuf.gr_name, strlen (grpbuf.gr_name), ent));
if (status == NSS_STATUS_SUCCESS)
check_and_add_group (user, group, start, size, groupsp, limit, &grpbuf);
return status;
}
