src/nss_wrapper.c

   1 /*
   2  * Copyright (C) Stefan Metzmacher 2007 <metze@samba.org>
   3  * Copyright (C) Guenther Deschner 2009 <gd@samba.org>
   4  * Copyright (C) Andreas Schneider 2013 <asn@samba.org>
   5  *
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the author nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "config.h"
  37
  38 #include <pthread.h>
  39
  40 #include <sys/types.h>
  41 #include <sys/stat.h>
  42 #include <sys/socket.h>
  43 #include <errno.h>
  44 #include <fcntl.h>
  45 #include <stdarg.h>
  46 #include <stdbool.h>
  47 #include <stddef.h>
  48 #include <stdio.h>
  49 #include <stdint.h>
  50 #include <stdlib.h>
  51 #include <string.h>
  52 #include <unistd.h>
  53 #include <ctype.h>
  54
  55 #include <search.h>
  56 #include <assert.h>
  57
  58 /*
  59  * Defining _POSIX_PTHREAD_SEMANTICS before including pwd.h and grp.h  gives us
  60  * the posix getpwnam_r(), getpwuid_r(), getgrnam_r and getgrgid_r calls on
  61  * Solaris
  62  */
  63 #ifndef _POSIX_PTHREAD_SEMANTICS
  64 #define _POSIX_PTHREAD_SEMANTICS
  65 #endif
  66
  67 #include <pwd.h>
  68 #include <grp.h>
  69 #ifdef HAVE_SHADOW_H
  70 #include <shadow.h>
  71 #endif /* HAVE_SHADOW_H */
  72
  73 #include <netdb.h>
  74 #include <arpa/inet.h>
  75 #include <netinet/in.h>
  76
  77 #include <dlfcn.h>
  78
  79 #if defined(HAVE_NSS_H)
  80 /* Linux and BSD */
  81 #include <nss.h>
  82
  83 typedef enum nss_status NSS_STATUS;
  84 #elif defined(HAVE_NSS_COMMON_H)
  85 /* Solaris */
  86 #include <nss_common.h>
  87 #include <nss_dbdefs.h>
  88 #include <nsswitch.h>
  89
  90 typedef nss_status_t NSS_STATUS;
  91
  92 # define NSS_STATUS_SUCCESS     NSS_SUCCESS
  93 # define NSS_STATUS_NOTFOUND    NSS_NOTFOUND
  94 # define NSS_STATUS_UNAVAIL     NSS_UNAVAIL
  95 # define NSS_STATUS_TRYAGAIN    NSS_TRYAGAIN
  96 #else
  97 # error "No nsswitch support detected"
  98 #endif
  99
 100 #ifndef PTR_DIFF
 101 #define PTR_DIFF(p1, p2) ((ptrdiff_t)(((const char *)(p1)) - (const char *)(p2)))
 102 #endif
 103
 104 #ifndef _PUBLIC_
 105 #define _PUBLIC_
 106 #endif
 107
 108 #ifndef EAI_NODATA
 109 #define EAI_NODATA EAI_NONAME
 110 #endif
 111
 112 #ifndef EAI_ADDRFAMILY
 113 #define EAI_ADDRFAMILY EAI_FAMILY
 114 #endif
 115
 116 #ifndef __STRING
 117 #define __STRING(x)    #x
 118 #endif
 119
 120 #ifndef __STRINGSTRING
 121 #define __STRINGSTRING(x) __STRING(x)
 122 #endif
 123
 124 #ifndef __LINESTR__
 125 #define __LINESTR__ __STRINGSTRING(__LINE__)
 126 #endif
 127
 128 #ifndef __location__
 129 #define __location__ __FILE__ ":" __LINESTR__
 130 #endif
 131
 132 #ifndef DNS_NAME_MAX
 133 #define DNS_NAME_MAX 255
 134 #endif
 135
 136 /* GCC have printf type attribute check. */
 137 #ifdef HAVE_ATTRIBUTE_PRINTF_FORMAT
 138 #define PRINTF_ATTRIBUTE(a,b) __attribute__ ((__format__ (__printf__, a, b)))
 139 #else
 140 #define PRINTF_ATTRIBUTE(a,b)
 141 #endif /* HAVE_ATTRIBUTE_PRINTF_FORMAT */
 142
 143 #ifdef HAVE_DESTRUCTOR_ATTRIBUTE
 144 #define DESTRUCTOR_ATTRIBUTE __attribute__ ((destructor))
 145 #else
 146 #define DESTRUCTOR_ATTRIBUTE
 147 #endif /* HAVE_DESTRUCTOR_ATTRIBUTE */
 148
 149 #define ZERO_STRUCTP(x) do { if ((x) != NULL) memset((char *)(x), 0, sizeof(*(x))); } while(0)
 150
 151 #ifndef SAFE_FREE
 152 #define SAFE_FREE(x) do { if ((x) != NULL) {free(x); (x)=NULL;} } while(0)
 153 #endif
 154
 155 #ifdef HAVE_IPV6
 156 #define NWRAP_INET_ADDRSTRLEN INET6_ADDRSTRLEN
 157 #else
 158 #define NWRAP_INET_ADDRSTRLEN INET_ADDRSTRLEN
 159 #endif
 160
 161 #define NWRAP_LOCK(m) do { \
 162         pthread_mutex_lock(&( m ## _mutex)); \
 163 } while(0)
 164
 165 #define NWRAP_UNLOCK(m) do { \
 166         pthread_mutex_unlock(&( m ## _mutex)); \
 167 } while(0)
 168
 169
 170 static bool nwrap_initialized = false;
 171 static pthread_mutex_t nwrap_initialized_mutex = PTHREAD_MUTEX_INITIALIZER;
 172
 173 /* The mutex or accessing the id */
 174 static pthread_mutex_t nwrap_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 175 static pthread_mutex_t nwrap_gr_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 176 static pthread_mutex_t nwrap_he_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 177 static pthread_mutex_t nwrap_pw_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 178 static pthread_mutex_t nwrap_sp_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 179
 180 /* Add new global locks here please */
 181 /* Also don't forget to add locks to
 182  * nwrap_init() function.
 183  */
 184 # define NWRAP_LOCK_ALL do { \
 185         NWRAP_LOCK(nwrap_initialized); \
 186         NWRAP_LOCK(nwrap_global); \
 187         NWRAP_LOCK(nwrap_gr_global); \
 188         NWRAP_LOCK(nwrap_he_global); \
 189         NWRAP_LOCK(nwrap_pw_global); \
 190         NWRAP_LOCK(nwrap_sp_global); \
 191 } while (0);
 192
 193 # define NWRAP_UNLOCK_ALL do {\
 194         NWRAP_UNLOCK(nwrap_sp_global); \
 195         NWRAP_UNLOCK(nwrap_pw_global); \
 196         NWRAP_UNLOCK(nwrap_he_global); \
 197         NWRAP_UNLOCK(nwrap_gr_global); \
 198         NWRAP_UNLOCK(nwrap_global); \
 199         NWRAP_UNLOCK(nwrap_initialized); \
 200 } while (0);
 201
 202 static void nwrap_thread_prepare(void)
 203 {
 204         NWRAP_LOCK_ALL;
 205 }
 206
 207 static void nwrap_thread_parent(void)
 208 {
 209         NWRAP_UNLOCK_ALL;
 210 }
 211
 212 static void nwrap_thread_child(void)
 213 {
 214         NWRAP_UNLOCK_ALL;
 215 }
 216
 217 enum nwrap_dbglvl_e {
 218         NWRAP_LOG_ERROR = 0,
 219         NWRAP_LOG_WARN,
 220         NWRAP_LOG_DEBUG,
 221         NWRAP_LOG_TRACE
 222 };
 223
 224 #ifdef NDEBUG
 225 # define NWRAP_LOG(...)
 226 #else
 227
 228 static void nwrap_log(enum nwrap_dbglvl_e dbglvl, const char *func, const char *format, ...) PRINTF_ATTRIBUTE(3, 4);
 229 # define NWRAP_LOG(dbglvl, ...) nwrap_log((dbglvl), __func__, __VA_ARGS__)
 230
 231 static void nwrap_log(enum nwrap_dbglvl_e dbglvl,
 232                       const char *func,
 233                       const char *format, ...)
 234 {
 235         char buffer[1024];
 236         va_list va;
 237         const char *d;
 238         unsigned int lvl = 0;
 239         int pid = getpid();
 240
 241         d = getenv("NSS_WRAPPER_DEBUGLEVEL");
 242         if (d != NULL) {
 243                 lvl = atoi(d);
 244         }
 245
 246         va_start(va, format);
 247         vsnprintf(buffer, sizeof(buffer), format, va);
 248         va_end(va);
 249
 250         if (lvl >= dbglvl) {
 251                 switch (dbglvl) {
 252                         case NWRAP_LOG_ERROR:
 253                                 fprintf(stderr,
 254                                         "NWRAP_ERROR(%d) - %s: %s\n",
 255                                         pid, func, buffer);
 256                                 break;
 257                         case NWRAP_LOG_WARN:
 258                                 fprintf(stderr,
 259                                         "NWRAP_WARN(%d) - %s: %s\n",
 260                                         pid, func, buffer);
 261                                 break;
 262                         case NWRAP_LOG_DEBUG:
 263                                 fprintf(stderr,
 264                                         "NWRAP_DEBUG(%d) - %s: %s\n",
 265                                         pid, func, buffer);
 266                                 break;
 267                         case NWRAP_LOG_TRACE:
 268                                 fprintf(stderr,
 269                                         "NWRAP_TRACE(%d) - %s: %s\n",
 270                                         pid, func, buffer);
 271                                 break;
 272                 }
 273         }
 274 }
 275 #endif /* NDEBUG NWRAP_LOG */
 276
 277 struct nwrap_libc_fns {
 278         struct passwd *(*_libc_getpwnam)(const char *name);
 279         int (*_libc_getpwnam_r)(const char *name, struct passwd *pwd,
 280                        char *buf, size_t buflen, struct passwd **result);
 281         struct passwd *(*_libc_getpwuid)(uid_t uid);
 282         int (*_libc_getpwuid_r)(uid_t uid, struct passwd *pwd, char *buf, size_t buflen, struct passwd **result);
 283         void (*_libc_setpwent)(void);
 284         struct passwd *(*_libc_getpwent)(void);
 285 #ifdef HAVE_SOLARIS_GETPWENT_R
 286         struct passwd *(*_libc_getpwent_r)(struct passwd *pwbuf, char *buf, size_t buflen);
 287 #else
 288         int (*_libc_getpwent_r)(struct passwd *pwbuf, char *buf, size_t buflen, struct passwd **pwbufp);
 289 #endif
 290         void (*_libc_endpwent)(void);
 291         int (*_libc_initgroups)(const char *user, gid_t gid);
 292         struct group *(*_libc_getgrnam)(const char *name);
 293         int (*_libc_getgrnam_r)(const char *name, struct group *grp, char *buf, size_t buflen, struct group **result);
 294         struct group *(*_libc_getgrgid)(gid_t gid);
 295         int (*_libc_getgrgid_r)(gid_t gid, struct group *grp, char *buf, size_t buflen, struct group **result);
 296         void (*_libc_setgrent)(void);
 297         struct group *(*_libc_getgrent)(void);
 298 #ifdef HAVE_SOLARIS_GETGRENT_R
 299         struct group *(*_libc_getgrent_r)(struct group *group, char *buf, size_t buflen);
 300 #else
 301         int (*_libc_getgrent_r)(struct group *group, char *buf, size_t buflen, struct group **result);
 302 #endif
 303         void (*_libc_endgrent)(void);
 304         int (*_libc_getgrouplist)(const char *user, gid_t group, gid_t *groups, int *ngroups);
 305
 306         void (*_libc_sethostent)(int stayopen);
 307         struct hostent *(*_libc_gethostent)(void);
 308         void (*_libc_endhostent)(void);
 309
 310         struct hostent *(*_libc_gethostbyname)(const char *name);
 311 #ifdef HAVE_GETHOSTBYNAME2 /* GNU extension */
 312         struct hostent *(*_libc_gethostbyname2)(const char *name, int af);
 313 #endif
 314         struct hostent *(*_libc_gethostbyaddr)(const void *addr, socklen_t len, int type);
 315
 316         int (*_libc_getaddrinfo)(const char *node, const char *service,
 317                                  const struct addrinfo *hints,
 318                                  struct addrinfo **res);
 319         int (*_libc_getnameinfo)(const struct sockaddr *sa, socklen_t salen,
 320                                  char *host, size_t hostlen,
 321                                  char *serv, size_t servlen,
 322                                  int flags);
 323         int (*_libc_gethostname)(char *name, size_t len);
 324 #ifdef HAVE_GETHOSTBYNAME_R
 325         int (*_libc_gethostbyname_r)(const char *name,
 326                                      struct hostent *ret,
 327                                      char *buf, size_t buflen,
 328                                      struct hostent **result, int *h_errnop);
 329 #endif
 330 #ifdef HAVE_GETHOSTBYADDR_R
 331         int (*_libc_gethostbyaddr_r)(const void *addr, socklen_t len, int type,
 332                                      struct hostent *ret,
 333                                      char *buf, size_t buflen,
 334                                      struct hostent **result, int *h_errnop);
 335 #endif
 336 };
 337
 338 struct nwrap_module_nss_fns {
 339         NSS_STATUS (*_nss_getpwnam_r)(const char *name, struct passwd *result, char *buffer,
 340                                       size_t buflen, int *errnop);
 341         NSS_STATUS (*_nss_getpwuid_r)(uid_t uid, struct passwd *result, char *buffer,
 342                                       size_t buflen, int *errnop);
 343         NSS_STATUS (*_nss_setpwent)(void);
 344         NSS_STATUS (*_nss_getpwent_r)(struct passwd *result, char *buffer,
 345                                       size_t buflen, int *errnop);
 346         NSS_STATUS (*_nss_endpwent)(void);
 347         NSS_STATUS (*_nss_initgroups)(const char *user, gid_t group, long int *start,
 348                                       long int *size, gid_t **groups, long int limit, int *errnop);
 349         NSS_STATUS (*_nss_getgrnam_r)(const char *name, struct group *result, char *buffer,
 350                                       size_t buflen, int *errnop);
 351         NSS_STATUS (*_nss_getgrgid_r)(gid_t gid, struct group *result, char *buffer,
 352                                       size_t buflen, int *errnop);
 353         NSS_STATUS (*_nss_setgrent)(void);
 354         NSS_STATUS (*_nss_getgrent_r)(struct group *result, char *buffer,
 355                                       size_t buflen, int *errnop);
 356         NSS_STATUS (*_nss_endgrent)(void);
 357 };
 358
 359 struct nwrap_backend {
 360         const char *name;
 361         const char *so_path;
 362         void *so_handle;
 363         struct nwrap_ops *ops;
 364         struct nwrap_module_nss_fns *fns;
 365 };
 366
 367 struct nwrap_ops {
 368         struct passwd * (*nw_getpwnam)(struct nwrap_backend *b,
 369                                        const char *name);
 370         int             (*nw_getpwnam_r)(struct nwrap_backend *b,
 371                                          const char *name, struct passwd *pwdst,
 372                                          char *buf, size_t buflen, struct passwd **pwdstp);
 373         struct passwd * (*nw_getpwuid)(struct nwrap_backend *b,
 374                                        uid_t uid);
 375         int             (*nw_getpwuid_r)(struct nwrap_backend *b,
 376                                          uid_t uid, struct passwd *pwdst,
 377                                          char *buf, size_t buflen, struct passwd **pwdstp);
 378         void            (*nw_setpwent)(struct nwrap_backend *b);
 379         struct passwd * (*nw_getpwent)(struct nwrap_backend *b);
 380         int             (*nw_getpwent_r)(struct nwrap_backend *b,
 381                                          struct passwd *pwdst, char *buf,
 382                                          size_t buflen, struct passwd **pwdstp);
 383         void            (*nw_endpwent)(struct nwrap_backend *b);
 384         int             (*nw_initgroups)(struct nwrap_backend *b,
 385                                          const char *user, gid_t group);
 386         struct group *  (*nw_getgrnam)(struct nwrap_backend *b,
 387                                        const char *name);
 388         int             (*nw_getgrnam_r)(struct nwrap_backend *b,
 389                                          const char *name, struct group *grdst,
 390                                          char *buf, size_t buflen, struct group **grdstp);
 391         struct group *  (*nw_getgrgid)(struct nwrap_backend *b,
 392                                        gid_t gid);
 393         int             (*nw_getgrgid_r)(struct nwrap_backend *b,
 394                                          gid_t gid, struct group *grdst,
 395                                          char *buf, size_t buflen, struct group **grdstp);
 396         void            (*nw_setgrent)(struct nwrap_backend *b);
 397         struct group *  (*nw_getgrent)(struct nwrap_backend *b);
 398         int             (*nw_getgrent_r)(struct nwrap_backend *b,
 399                                          struct group *grdst, char *buf,
 400                                          size_t buflen, struct group **grdstp);
 401         void            (*nw_endgrent)(struct nwrap_backend *b);
 402 };
 403
 404 /* Public prototypes */
 405
 406 bool nss_wrapper_enabled(void);
 407 bool nss_wrapper_shadow_enabled(void);
 408 bool nss_wrapper_hosts_enabled(void);
 409
 410 /* prototypes for files backend */
 411
 412
 413 static struct passwd *nwrap_files_getpwnam(struct nwrap_backend *b,
 414                                            const char *name);
 415 static int nwrap_files_getpwnam_r(struct nwrap_backend *b,
 416                                   const char *name, struct passwd *pwdst,
 417                                   char *buf, size_t buflen, struct passwd **pwdstp);
 418 static struct passwd *nwrap_files_getpwuid(struct nwrap_backend *b,
 419                                            uid_t uid);
 420 static int nwrap_files_getpwuid_r(struct nwrap_backend *b,
 421                                   uid_t uid, struct passwd *pwdst,
 422                                   char *buf, size_t buflen, struct passwd **pwdstp);
 423 static void nwrap_files_setpwent(struct nwrap_backend *b);
 424 static struct passwd *nwrap_files_getpwent(struct nwrap_backend *b);
 425 static int nwrap_files_getpwent_r(struct nwrap_backend *b,
 426                                   struct passwd *pwdst, char *buf,
 427                                   size_t buflen, struct passwd **pwdstp);
 428 static void nwrap_files_endpwent(struct nwrap_backend *b);
 429 static int nwrap_files_initgroups(struct nwrap_backend *b,
 430                                   const char *user, gid_t group);
 431 static struct group *nwrap_files_getgrnam(struct nwrap_backend *b,
 432                                           const char *name);
 433 static int nwrap_files_getgrnam_r(struct nwrap_backend *b,
 434                                   const char *name, struct group *grdst,
 435                                   char *buf, size_t buflen, struct group **grdstp);
 436 static struct group *nwrap_files_getgrgid(struct nwrap_backend *b,
 437                                           gid_t gid);
 438 static int nwrap_files_getgrgid_r(struct nwrap_backend *b,
 439                                   gid_t gid, struct group *grdst,
 440                                   char *buf, size_t buflen, struct group **grdstp);
 441 static void nwrap_files_setgrent(struct nwrap_backend *b);
 442 static struct group *nwrap_files_getgrent(struct nwrap_backend *b);
 443 static int nwrap_files_getgrent_r(struct nwrap_backend *b,
 444                                   struct group *grdst, char *buf,
 445                                   size_t buflen, struct group **grdstp);
 446 static void nwrap_files_endgrent(struct nwrap_backend *b);
 447
 448 /* prototypes for module backend */
 449
 450 static struct passwd *nwrap_module_getpwent(struct nwrap_backend *b);
 451 static int nwrap_module_getpwent_r(struct nwrap_backend *b,
 452                                    struct passwd *pwdst, char *buf,
 453                                    size_t buflen, struct passwd **pwdstp);
 454 static struct passwd *nwrap_module_getpwnam(struct nwrap_backend *b,
 455                                             const char *name);
 456 static int nwrap_module_getpwnam_r(struct nwrap_backend *b,
 457                                    const char *name, struct passwd *pwdst,
 458                                    char *buf, size_t buflen, struct passwd **pwdstp);
 459 static struct passwd *nwrap_module_getpwuid(struct nwrap_backend *b,
 460                                             uid_t uid);
 461 static int nwrap_module_getpwuid_r(struct nwrap_backend *b,
 462                                    uid_t uid, struct passwd *pwdst,
 463                                    char *buf, size_t buflen, struct passwd **pwdstp);
 464 static void nwrap_module_setpwent(struct nwrap_backend *b);
 465 static void nwrap_module_endpwent(struct nwrap_backend *b);
 466 static struct group *nwrap_module_getgrent(struct nwrap_backend *b);
 467 static int nwrap_module_getgrent_r(struct nwrap_backend *b,
 468                                    struct group *grdst, char *buf,
 469                                    size_t buflen, struct group **grdstp);
 470 static struct group *nwrap_module_getgrnam(struct nwrap_backend *b,
 471                                            const char *name);
 472 static int nwrap_module_getgrnam_r(struct nwrap_backend *b,
 473                                    const char *name, struct group *grdst,
 474                                    char *buf, size_t buflen, struct group **grdstp);
 475 static struct group *nwrap_module_getgrgid(struct nwrap_backend *b,
 476                                            gid_t gid);
 477 static int nwrap_module_getgrgid_r(struct nwrap_backend *b,
 478                                    gid_t gid, struct group *grdst,
 479                                    char *buf, size_t buflen, struct group **grdstp);
 480 static void nwrap_module_setgrent(struct nwrap_backend *b);
 481 static void nwrap_module_endgrent(struct nwrap_backend *b);
 482 static int nwrap_module_initgroups(struct nwrap_backend *b,
 483                                    const char *user, gid_t group);
 484
 485 struct nwrap_ops nwrap_files_ops = {
 486         .nw_getpwnam    = nwrap_files_getpwnam,
 487         .nw_getpwnam_r  = nwrap_files_getpwnam_r,
 488         .nw_getpwuid    = nwrap_files_getpwuid,
 489         .nw_getpwuid_r  = nwrap_files_getpwuid_r,
 490         .nw_setpwent    = nwrap_files_setpwent,
 491         .nw_getpwent    = nwrap_files_getpwent,
 492         .nw_getpwent_r  = nwrap_files_getpwent_r,
 493         .nw_endpwent    = nwrap_files_endpwent,
 494         .nw_initgroups  = nwrap_files_initgroups,
 495         .nw_getgrnam    = nwrap_files_getgrnam,
 496         .nw_getgrnam_r  = nwrap_files_getgrnam_r,
 497         .nw_getgrgid    = nwrap_files_getgrgid,
 498         .nw_getgrgid_r  = nwrap_files_getgrgid_r,
 499         .nw_setgrent    = nwrap_files_setgrent,
 500         .nw_getgrent    = nwrap_files_getgrent,
 501         .nw_getgrent_r  = nwrap_files_getgrent_r,
 502         .nw_endgrent    = nwrap_files_endgrent,
 503 };
 504
 505 struct nwrap_ops nwrap_module_ops = {
 506         .nw_getpwnam    = nwrap_module_getpwnam,
 507         .nw_getpwnam_r  = nwrap_module_getpwnam_r,
 508         .nw_getpwuid    = nwrap_module_getpwuid,
 509         .nw_getpwuid_r  = nwrap_module_getpwuid_r,
 510         .nw_setpwent    = nwrap_module_setpwent,
 511         .nw_getpwent    = nwrap_module_getpwent,
 512         .nw_getpwent_r  = nwrap_module_getpwent_r,
 513         .nw_endpwent    = nwrap_module_endpwent,
 514         .nw_initgroups  = nwrap_module_initgroups,
 515         .nw_getgrnam    = nwrap_module_getgrnam,
 516         .nw_getgrnam_r  = nwrap_module_getgrnam_r,
 517         .nw_getgrgid    = nwrap_module_getgrgid,
 518         .nw_getgrgid_r  = nwrap_module_getgrgid_r,
 519         .nw_setgrent    = nwrap_module_setgrent,
 520         .nw_getgrent    = nwrap_module_getgrent,
 521         .nw_getgrent_r  = nwrap_module_getgrent_r,
 522         .nw_endgrent    = nwrap_module_endgrent,
 523 };
 524
 525 struct nwrap_libc {
 526         void *handle;
 527         void *nsl_handle;
 528         void *sock_handle;
 529         struct nwrap_libc_fns *fns;
 530 };
 531
 532 struct nwrap_main {
 533         int num_backends;
 534         struct nwrap_backend *backends;
 535         struct nwrap_libc *libc;
 536 };
 537
 538 static struct nwrap_main *nwrap_main_global;
 539 static struct nwrap_main __nwrap_main_global;
 540
 541 /*
 542  * PROTOTYPES
 543  */
 544 static int nwrap_convert_he_ai(const struct hostent *he,
 545                                unsigned short port,
 546                                const struct addrinfo *hints,
 547                                struct addrinfo **pai,
 548                                bool skip_canonname);
 549
 550 /*
 551  * VECTORS
 552  */
 553
 554 #define DEFAULT_VECTOR_CAPACITY 16
 555
 556 struct nwrap_vector {
 557         void **items;
 558         size_t count;
 559         size_t capacity;
 560 };
 561
 562 /* Macro returns pointer to first element of vector->items array.
 563  *
 564  * nwrap_vector is used as a memory backend which take care of
 565  * memory allocations and other stuff like memory growing.
 566  * nwrap_vectors should not be considered as some abstract structures.
 567  * On this level, vectors are more handy than direct realloc/malloc
 568  * calls.
 569  *
 570  * nwrap_vector->items is array inside nwrap_vector which can be
 571  * directly pointed by libc structure assembled by cwrap itself.
 572  *
 573  * EXAMPLE:
 574  *
 575  * 1) struct hostent contains char **h_addr_list element.
 576  * 2) nwrap_vector holds array of pointers to addresses.
 577  *    It's easier to use vector to store results of
 578  *    file parsing etc.
 579  *
 580  * Now, pretend that cwrap assembled struct hostent and
 581  * we need to set h_addr_list to point to nwrap_vector.
 582  * Idea behind is to shield users from internal nwrap_vector
 583  * implementation.
 584  * (Yes, not fully - array terminated by NULL is needed because
 585  * it's result expected by libc function caller.)
 586  *
 587  *
 588  * CODE EXAMPLE:
 589  *
 590  * struct hostent he;
 591  * struct nwrap_vector *vector = malloc(sizeof(struct nwrap_vector));
 592  * ... don't care about failed allocation now ...
 593  *
 594  * ... fill nwrap vector ...
 595  *
 596  * struct hostent he;
 597  * he.h_addr_list = nwrap_vector_head(vector);
 598  *
 599  */
 600 #define nwrap_vector_head(vect) ((void *)((vect)->items))
 601
 602 #define nwrap_vector_foreach(item, vect, iter) \
 603         for (iter = 0, (item) = (vect).items == NULL ? NULL : (vect).items[0]; \
 604              item != NULL; \
 605              (item) = (vect).items[++iter])
 606
 607 #define nwrap_vector_is_initialized(vector) ((vector)->items != NULL)
 608
 609 static inline bool nwrap_vector_init(struct nwrap_vector *const vector)
 610 {
 611         if (vector == NULL) {
 612                 return false;
 613         }
 614
 615         /* count is initialized by ZERO_STRUCTP */
 616         ZERO_STRUCTP(vector);
 617         vector->items = malloc(sizeof(void *) * (DEFAULT_VECTOR_CAPACITY + 1));
 618         if (vector->items == NULL) {
 619                 return false;
 620         }
 621         vector->capacity = DEFAULT_VECTOR_CAPACITY;
 622         memset(vector->items, '\0', sizeof(void *) * (DEFAULT_VECTOR_CAPACITY + 1));
 623
 624         return true;
 625 }
 626
 627 static bool nwrap_vector_add_item(struct nwrap_vector *vector, void *const item)
 628 {
 629         assert (vector != NULL);
 630
 631         if (vector->items == NULL) {
 632                 nwrap_vector_init(vector);
 633         }
 634
 635         if (vector->count == vector->capacity) {
 636                 /* Items array _MUST_ be NULL terminated because it's passed
 637                  * as result to caller which expect NULL terminated array from libc.
 638                  */
 639                 void **items = realloc(vector->items, sizeof(void *) * ((vector->capacity * 2) + 1));
 640                 if (items == NULL) {
 641                         return false;
 642                 }
 643                 vector->items = items;
 644
 645                 /* Don't count ending NULL to capacity */
 646                 vector->capacity *= 2;
 647         }
 648
 649         vector->items[vector->count] = item;
 650
 651         vector->count += 1;
 652         vector->items[vector->count] = NULL;
 653
 654         return true;
 655 }
 656
 657 static bool nwrap_vector_merge(struct nwrap_vector *dst,
 658                                struct nwrap_vector *src)
 659 {
 660         void **dst_items = NULL;
 661         size_t count;
 662
 663         if (src->count == 0) {
 664                 return true;
 665         }
 666
 667         count = dst->count + src->count;
 668
 669         /* We don't need reallocation if we have enough capacity. */
 670         if (src->count > (dst->capacity - dst->count)) {
 671                 dst_items = (void **)realloc(dst->items, (count + 1) * sizeof(void *));
 672                 if (dst_items == NULL) {
 673                         return false;
 674                 }
 675                 dst->items = dst_items;
 676                 dst->capacity = count;
 677         }
 678
 679         memcpy((void *)(((long *)dst->items) + dst->count),
 680                src->items,
 681                src->count * sizeof(void *));
 682         dst->count = count;
 683
 684         return true;
 685 }
 686
 687 struct nwrap_cache {
 688         const char *path;
 689         int fd;
 690         FILE *fp;
 691         struct stat st;
 692         void *private_data;
 693
 694         struct nwrap_vector lines;
 695
 696         bool (*parse_line)(struct nwrap_cache *, char *line);
 697         void (*unload)(struct nwrap_cache *);
 698 };
 699
 700 /* passwd */
 701 struct nwrap_pw {
 702         struct nwrap_cache *cache;
 703
 704         struct passwd *list;
 705         int num;
 706         int idx;
 707 };
 708
 709 struct nwrap_cache __nwrap_cache_pw;
 710 struct nwrap_pw nwrap_pw_global;
 711
 712 static bool nwrap_pw_parse_line(struct nwrap_cache *nwrap, char *line);
 713 static void nwrap_pw_unload(struct nwrap_cache *nwrap);
 714
 715 /* shadow */
 716 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
 717 struct nwrap_sp {
 718         struct nwrap_cache *cache;
 719
 720         struct spwd *list;
 721         int num;
 722         int idx;
 723 };
 724
 725 struct nwrap_cache __nwrap_cache_sp;
 726 struct nwrap_sp nwrap_sp_global;
 727
 728 static bool nwrap_sp_parse_line(struct nwrap_cache *nwrap, char *line);
 729 static void nwrap_sp_unload(struct nwrap_cache *nwrap);
 730 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
 731
 732 /* group */
 733 struct nwrap_gr {
 734         struct nwrap_cache *cache;
 735
 736         struct group *list;
 737         int num;
 738         int idx;
 739 };
 740
 741 struct nwrap_cache __nwrap_cache_gr;
 742 struct nwrap_gr nwrap_gr_global;
 743
 744 /* hosts */
 745 static bool nwrap_he_parse_line(struct nwrap_cache *nwrap, char *line);
 746 static void nwrap_he_unload(struct nwrap_cache *nwrap);
 747
 748 struct nwrap_addrdata {
 749         unsigned char host_addr[16]; /* IPv4 or IPv6 address */
 750 };
 751
 752 static size_t max_hostents = 100;
 753
 754 struct nwrap_entdata {
 755         struct nwrap_addrdata addr;
 756         struct hostent ht;
 757
 758         struct nwrap_vector nwrap_addrdata;
 759
 760         ssize_t aliases_count;
 761 };
 762
 763 struct nwrap_entlist {
 764         struct nwrap_entlist *next;
 765         struct nwrap_entdata *ed;
 766 };
 767
 768 struct nwrap_he {
 769         struct nwrap_cache *cache;
 770
 771         struct nwrap_entdata *list;
 772         struct nwrap_vector entdata;
 773
 774         int num;
 775         int idx;
 776 };
 777
 778 static struct nwrap_cache __nwrap_cache_he;
 779 static struct nwrap_he nwrap_he_global;
 780
 781
 782 /*********************************************************
 783  * NWRAP PROTOTYPES
 784  *********************************************************/
 785
 786 static void nwrap_init(void);
 787 static bool nwrap_gr_parse_line(struct nwrap_cache *nwrap, char *line);
 788 static void nwrap_gr_unload(struct nwrap_cache *nwrap);
 789 void nwrap_destructor(void) DESTRUCTOR_ATTRIBUTE;
 790
 791 /*********************************************************
 792  * NWRAP LIBC LOADER FUNCTIONS
 793  *********************************************************/
 794
 795 enum nwrap_lib {
 796     NWRAP_LIBC,
 797     NWRAP_LIBNSL,
 798     NWRAP_LIBSOCKET,
 799 };
 800
 801 #ifndef NDEBUG
 802 static const char *nwrap_str_lib(enum nwrap_lib lib)
 803 {
 804         switch (lib) {
 805         case NWRAP_LIBC:
 806                 return "libc";
 807         case NWRAP_LIBNSL:
 808                 return "libnsl";
 809         case NWRAP_LIBSOCKET:
 810                 return "libsocket";
 811         }
 812
 813         /* Compiler would warn us about unhandled enum value if we get here */
 814         return "unknown";
 815 }
 816 #endif
 817
 818 static void *nwrap_load_lib_handle(enum nwrap_lib lib)
 819 {
 820         int flags = RTLD_LAZY;
 821         void *handle = NULL;
 822         int i;
 823
 824 #ifdef RTLD_DEEPBIND
 825         flags |= RTLD_DEEPBIND;
 826 #endif
 827
 828         switch (lib) {
 829         case NWRAP_LIBNSL:
 830 #ifdef HAVE_LIBNSL
 831                 handle = nwrap_main_global->libc->nsl_handle;
 832                 if (handle == NULL) {
 833                         for (i = 10; i >= 0; i--) {
 834                                 char soname[256] = {0};
 835
 836                                 snprintf(soname, sizeof(soname), "libnsl.so.%d", i);
 837                                 handle = dlopen(soname, flags);
 838                                 if (handle != NULL) {
 839                                         break;
 840                                 }
 841                         }
 842
 843                         nwrap_main_global->libc->nsl_handle = handle;
 844                 }
 845                 break;
 846 #endif
 847                 /* FALL TROUGH */
 848         case NWRAP_LIBSOCKET:
 849 #ifdef HAVE_LIBSOCKET
 850                 handle = nwrap_main_global->libc->sock_handle;
 851                 if (handle == NULL) {
 852                         for (i = 10; i >= 0; i--) {
 853                                 char soname[256] = {0};
 854
 855                                 snprintf(soname, sizeof(soname), "libsocket.so.%d", i);
 856                                 handle = dlopen(soname, flags);
 857                                 if (handle != NULL) {
 858                                         break;
 859                                 }
 860                         }
 861
 862                         nwrap_main_global->libc->sock_handle = handle;
 863                 }
 864                 break;
 865 #endif
 866                 /* FALL TROUGH */
 867         case NWRAP_LIBC:
 868                 handle = nwrap_main_global->libc->handle;
 869                 if (handle == NULL) {
 870                         for (i = 10; i >= 0; i--) {
 871                                 char soname[256] = {0};
 872
 873                                 snprintf(soname, sizeof(soname), "libc.so.%d", i);
 874                                 handle = dlopen(soname, flags);
 875                                 if (handle != NULL) {
 876                                         break;
 877                                 }
 878                         }
 879
 880                         nwrap_main_global->libc->handle = handle;
 881                 }
 882                 break;
 883         }
 884
 885         if (handle == NULL) {
 886 #ifdef RTLD_NEXT
 887                 handle = nwrap_main_global->libc->handle
 888                        = nwrap_main_global->libc->sock_handle
 889                        = nwrap_main_global->libc->nsl_handle
 890                        = RTLD_NEXT;
 891 #else
 892                 NWRAP_LOG(NWRAP_LOG_ERROR,
 893                           "Failed to dlopen library: %s\n",
 894                           dlerror());
 895                 exit(-1);
 896 #endif
 897         }
 898
 899         return handle;
 900 }
 901
 902 static void *_nwrap_load_lib_function(enum nwrap_lib lib, const char *fn_name)
 903 {
 904         void *handle;
 905         void *func;
 906
 907         nwrap_init();
 908
 909         handle = nwrap_load_lib_handle(lib);
 910
 911         func = dlsym(handle, fn_name);
 912         if (func == NULL) {
 913                 NWRAP_LOG(NWRAP_LOG_ERROR,
 914                                 "Failed to find %s: %s\n",
 915                                 fn_name, dlerror());
 916                 exit(-1);
 917         }
 918
 919         NWRAP_LOG(NWRAP_LOG_TRACE,
 920                         "Loaded %s from %s",
 921                         fn_name, nwrap_str_lib(lib));
 922         return func;
 923 }
 924
 925 #define nwrap_load_lib_function(lib, fn_name) \
 926         if (nwrap_main_global->libc->fns->_libc_##fn_name == NULL) { \
 927                 *(void **) (&nwrap_main_global->libc->fns->_libc_##fn_name) = \
 928                         _nwrap_load_lib_function(lib, #fn_name); \
 929         }
 930
 931 /* INTERNAL HELPER FUNCTIONS */
 932 static void nwrap_lines_unload(struct nwrap_cache *const nwrap)
 933 {
 934         size_t p;
 935         void *item;
 936         nwrap_vector_foreach(item, nwrap->lines, p) {
 937                 /* Maybe some vectors were merged ... */
 938                 SAFE_FREE(item);
 939         }
 940         SAFE_FREE(nwrap->lines.items);
 941         ZERO_STRUCTP(&nwrap->lines);
 942 }
 943
 944 /*
 945  * IMPORTANT
 946  *
 947  * Functions expeciall from libc need to be loaded individually, you can't load
 948  * all at once or gdb will segfault at startup. The same applies to valgrind and
 949  * has probably something todo with with the linker.
 950  * So we need load each function at the point it is called the first time.
 951  */
 952 static struct passwd *libc_getpwnam(const char *name)
 953 {
 954         nwrap_load_lib_function(NWRAP_LIBC, getpwnam);
 955
 956         return nwrap_main_global->libc->fns->_libc_getpwnam(name);
 957 }
 958
 959 #ifdef HAVE_GETPWNAM_R
 960 static int libc_getpwnam_r(const char *name,
 961                            struct passwd *pwd,
 962                            char *buf,
 963                            size_t buflen,
 964                            struct passwd **result)
 965 {
 966 #ifdef HAVE___POSIX_GETPWNAM_R
 967         if (nwrap_main_global->libc->fns->_libc_getpwnam_r == NULL) {
 968                 *(void **) (&nwrap_main_global->libc->fns->_libc_getpwnam_r) =
 969                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getpwnam_r");
 970         }
 971 #else
 972         nwrap_load_lib_function(NWRAP_LIBC, getpwnam_r);
 973 #endif
 974
 975         return nwrap_main_global->libc->fns->_libc_getpwnam_r(name,
 976                                                               pwd,
 977                                                               buf,
 978                                                               buflen,
 979                                                               result);
 980 }
 981 #endif
 982
 983 static struct passwd *libc_getpwuid(uid_t uid)
 984 {
 985         nwrap_load_lib_function(NWRAP_LIBC, getpwuid);
 986
 987         return nwrap_main_global->libc->fns->_libc_getpwuid(uid);
 988 }
 989
 990 #ifdef HAVE_GETPWUID_R
 991 static int libc_getpwuid_r(uid_t uid,
 992                            struct passwd *pwd,
 993                            char *buf,
 994                            size_t buflen,
 995                            struct passwd **result)
 996 {
 997 #ifdef HAVE___POSIX_GETPWUID_R
 998         if (nwrap_main_global->libc->fns->_libc_getpwuid_r == NULL) {
 999                 *(void **) (&nwrap_main_global->libc->fns->_libc_getpwuid_r) =
1000                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getpwuid_r");
1001         }
1002 #else
1003         nwrap_load_lib_function(NWRAP_LIBC, getpwuid_r);
1004 #endif
1005
1006         return nwrap_main_global->libc->fns->_libc_getpwuid_r(uid,
1007                                                               pwd,
1008                                                               buf,
1009                                                               buflen,
1010                                                               result);
1011 }
1012 #endif
1013
1014 static inline void str_tolower(char *dst, char *src)
1015 {
1016         register char *src_tmp = src;
1017         register char *dst_tmp = dst;
1018
1019         while (*src_tmp != '\0') {
1020                 *dst_tmp = tolower(*src_tmp);
1021                 ++src_tmp;
1022                 ++dst_tmp;
1023         }
1024 }
1025
1026 static bool str_tolower_copy(char **dst_name, const char *const src_name)
1027 {
1028         char *h_name_lower;
1029
1030         if ((dst_name == NULL) || (src_name == NULL)) {
1031                 return false;
1032         }
1033
1034         h_name_lower = strdup(src_name);
1035         if (h_name_lower == NULL) {
1036                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Out of memory while strdup");
1037                 return false;
1038         }
1039
1040         str_tolower(h_name_lower, h_name_lower);
1041         *dst_name = h_name_lower;
1042         return true;
1043 }
1044
1045 static void libc_setpwent(void)
1046 {
1047         nwrap_load_lib_function(NWRAP_LIBC, setpwent);
1048
1049         nwrap_main_global->libc->fns->_libc_setpwent();
1050 }
1051
1052 static struct passwd *libc_getpwent(void)
1053 {
1054         nwrap_load_lib_function(NWRAP_LIBC, getpwent);
1055
1056         return nwrap_main_global->libc->fns->_libc_getpwent();
1057 }
1058
1059 #ifdef HAVE_SOLARIS_GETPWENT_R
1060 static struct passwd *libc_getpwent_r(struct passwd *pwdst,
1061                                       char *buf,
1062                                       int buflen)
1063 {
1064         nwrap_load_lib_function(NWRAP_LIBC, getpwent_r);
1065
1066         return nwrap_main_global->libc->fns->_libc_getpwent_r(pwdst,
1067                                                               buf,
1068                                                               buflen);
1069 }
1070 #else /* HAVE_SOLARIS_GETPWENT_R */
1071 static int libc_getpwent_r(struct passwd *pwdst,
1072                            char *buf,
1073                            size_t buflen,
1074                            struct passwd **pwdstp)
1075 {
1076         nwrap_load_lib_function(NWRAP_LIBC, getpwent_r);
1077
1078         return nwrap_main_global->libc->fns->_libc_getpwent_r(pwdst,
1079                                                               buf,
1080                                                               buflen,
1081                                                               pwdstp);
1082 }
1083 #endif /* HAVE_SOLARIS_GETPWENT_R */
1084
1085 static void libc_endpwent(void)
1086 {
1087         nwrap_load_lib_function(NWRAP_LIBC, endpwent);
1088
1089         nwrap_main_global->libc->fns->_libc_endpwent();
1090 }
1091
1092 static int libc_initgroups(const char *user, gid_t gid)
1093 {
1094         nwrap_load_lib_function(NWRAP_LIBC, initgroups);
1095
1096         return nwrap_main_global->libc->fns->_libc_initgroups(user, gid);
1097 }
1098
1099 static struct group *libc_getgrnam(const char *name)
1100 {
1101         nwrap_load_lib_function(NWRAP_LIBC, getgrnam);
1102
1103         return nwrap_main_global->libc->fns->_libc_getgrnam(name);
1104 }
1105
1106 #ifdef HAVE_GETGRNAM_R
1107 static int libc_getgrnam_r(const char *name,
1108                            struct group *grp,
1109                            char *buf,
1110                            size_t buflen,
1111                            struct group **result)
1112 {
1113 #ifdef HAVE___POSIX_GETGRNAM_R
1114         if (nwrap_main_global->libc->fns->_libc_getgrnam_r == NULL) {
1115                 *(void **) (&nwrap_main_global->libc->fns->_libc_getgrnam_r) =
1116                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getgrnam_r");
1117         }
1118 #else
1119         nwrap_load_lib_function(NWRAP_LIBC, getgrnam_r);
1120 #endif
1121
1122         return nwrap_main_global->libc->fns->_libc_getgrnam_r(name,
1123                                                               grp,
1124                                                               buf,
1125                                                               buflen,
1126                                                               result);
1127 }
1128 #endif
1129
1130 static struct group *libc_getgrgid(gid_t gid)
1131 {
1132         nwrap_load_lib_function(NWRAP_LIBC, getgrgid);
1133
1134         return nwrap_main_global->libc->fns->_libc_getgrgid(gid);
1135 }
1136
1137 #ifdef HAVE_GETGRGID_R
1138 static int libc_getgrgid_r(gid_t gid,
1139                            struct group *grp,
1140                            char *buf,
1141                            size_t buflen,
1142                            struct group **result)
1143 {
1144 #ifdef HAVE___POSIX_GETGRGID_R
1145         if (nwrap_main_global->libc->fns->_libc_getgrgid_r == NULL) {
1146                 *(void **) (&nwrap_main_global->libc->fns->_libc_getgrgid_r) =
1147                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getgrgid_r");
1148         }
1149 #else
1150         nwrap_load_lib_function(NWRAP_LIBC, getgrgid_r);
1151 #endif
1152
1153         return nwrap_main_global->libc->fns->_libc_getgrgid_r(gid,
1154                                                               grp,
1155                                                               buf,
1156                                                               buflen,
1157                                                               result);
1158 }
1159 #endif
1160
1161 static void libc_setgrent(void)
1162 {
1163         nwrap_load_lib_function(NWRAP_LIBC, setgrent);
1164
1165         nwrap_main_global->libc->fns->_libc_setgrent();
1166 }
1167
1168 static struct group *libc_getgrent(void)
1169 {
1170         nwrap_load_lib_function(NWRAP_LIBC, getgrent);
1171
1172         return nwrap_main_global->libc->fns->_libc_getgrent();
1173 }
1174
1175 #ifdef HAVE_GETGRENT_R
1176 #ifdef HAVE_SOLARIS_GETGRENT_R
1177 static struct group *libc_getgrent_r(struct group *group,
1178                                      char *buf,
1179                                      size_t buflen)
1180 {
1181         nwrap_load_lib_function(NWRAP_LIBC, getgrent_r);
1182
1183         return nwrap_main_global->libc->fns->_libc_getgrent_r(group,
1184                                                               buf,
1185                                                               buflen);
1186 }
1187 #else /* !HAVE_SOLARIS_GETGRENT_R */
1188 static int libc_getgrent_r(struct group *group,
1189                            char *buf,
1190                            size_t buflen,
1191                            struct group **result)
1192 {
1193         nwrap_load_lib_function(NWRAP_LIBC, getgrent_r);
1194
1195         return nwrap_main_global->libc->fns->_libc_getgrent_r(group,
1196                                                               buf,
1197                                                               buflen,
1198                                                               result);
1199 }
1200 #endif /* HAVE_SOLARIS_GETGRENT_R */
1201 #endif /* HAVE_GETGRENT_R */
1202
1203 static void libc_endgrent(void)
1204 {
1205         nwrap_load_lib_function(NWRAP_LIBC, endgrent);
1206
1207         nwrap_main_global->libc->fns->_libc_endgrent();
1208 }
1209
1210 #ifdef HAVE_GETGROUPLIST
1211 static int libc_getgrouplist(const char *user,
1212                              gid_t group,
1213                              gid_t *groups,
1214                              int *ngroups)
1215 {
1216         nwrap_load_lib_function(NWRAP_LIBC, getgrouplist);
1217
1218         return nwrap_main_global->libc->fns->_libc_getgrouplist(user,
1219                                                                 group,
1220                                                                 groups,
1221                                                                 ngroups);
1222 }
1223 #endif
1224
1225 static void libc_sethostent(int stayopen)
1226 {
1227         nwrap_load_lib_function(NWRAP_LIBNSL, sethostent);
1228
1229         nwrap_main_global->libc->fns->_libc_sethostent(stayopen);
1230 }
1231
1232 static struct hostent *libc_gethostent(void)
1233 {
1234         nwrap_load_lib_function(NWRAP_LIBNSL, gethostent);
1235
1236         return nwrap_main_global->libc->fns->_libc_gethostent();
1237 }
1238
1239 static void libc_endhostent(void)
1240 {
1241         nwrap_load_lib_function(NWRAP_LIBNSL, endhostent);
1242
1243         nwrap_main_global->libc->fns->_libc_endhostent();
1244 }
1245
1246 static struct hostent *libc_gethostbyname(const char *name)
1247 {
1248         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname);
1249
1250         return nwrap_main_global->libc->fns->_libc_gethostbyname(name);
1251 }
1252
1253 #ifdef HAVE_GETHOSTBYNAME2 /* GNU extension */
1254 static struct hostent *libc_gethostbyname2(const char *name, int af)
1255 {
1256         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname2);
1257
1258         return nwrap_main_global->libc->fns->_libc_gethostbyname2(name, af);
1259 }
1260 #endif
1261
1262 static struct hostent *libc_gethostbyaddr(const void *addr,
1263                                           socklen_t len,
1264                                           int type)
1265 {
1266         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyaddr);
1267
1268         return nwrap_main_global->libc->fns->_libc_gethostbyaddr(addr,
1269                                                                  len,
1270                                                                  type);
1271 }
1272
1273 static int libc_gethostname(char *name, size_t len)
1274 {
1275         nwrap_load_lib_function(NWRAP_LIBNSL, gethostname);
1276
1277         return nwrap_main_global->libc->fns->_libc_gethostname(name, len);
1278 }
1279
1280 #ifdef HAVE_GETHOSTBYNAME_R
1281 static int libc_gethostbyname_r(const char *name,
1282                                 struct hostent *ret,
1283                                 char *buf,
1284                                 size_t buflen,
1285                                 struct hostent **result,
1286                                 int *h_errnop)
1287 {
1288         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname_r);
1289
1290         return nwrap_main_global->libc->fns->_libc_gethostbyname_r(name,
1291                                                                    ret,
1292                                                                    buf,
1293                                                                    buflen,
1294                                                                    result,
1295                                                                    h_errnop);
1296 }
1297 #endif
1298
1299 #ifdef HAVE_GETHOSTBYADDR_R
1300 static int libc_gethostbyaddr_r(const void *addr,
1301                                 socklen_t len,
1302                                 int type,
1303                                 struct hostent *ret,
1304                                 char *buf,
1305                                 size_t buflen,
1306                                 struct hostent **result,
1307                                 int *h_errnop)
1308 {
1309         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyaddr_r);
1310
1311         return nwrap_main_global->libc->fns->_libc_gethostbyaddr_r(addr,
1312                                                                    len,
1313                                                                    type,
1314                                                                    ret,
1315                                                                    buf,
1316                                                                    buflen,
1317                                                                    result,
1318                                                                    h_errnop);
1319 }
1320 #endif
1321
1322 static int libc_getaddrinfo(const char *node,
1323                             const char *service,
1324                             const struct addrinfo *hints,
1325                             struct addrinfo **res)
1326 {
1327         nwrap_load_lib_function(NWRAP_LIBSOCKET, getaddrinfo);
1328
1329         return nwrap_main_global->libc->fns->_libc_getaddrinfo(node,
1330                                                                service,
1331                                                                hints,
1332                                                                res);
1333 }
1334
1335 static int libc_getnameinfo(const struct sockaddr *sa,
1336                             socklen_t salen,
1337                             char *host,
1338                             size_t hostlen,
1339                             char *serv,
1340                             size_t servlen,
1341                             int flags)
1342 {
1343         nwrap_load_lib_function(NWRAP_LIBSOCKET, getnameinfo);
1344
1345         return nwrap_main_global->libc->fns->_libc_getnameinfo(sa,
1346                                                                salen,
1347                                                                host,
1348                                                                hostlen,
1349                                                                serv,
1350                                                                servlen,
1351                                                                flags);
1352 }
1353
1354 /*********************************************************
1355  * NWRAP NSS MODULE LOADER FUNCTIONS
1356  *********************************************************/
1357
1358 static void *nwrap_load_module_fn(struct nwrap_backend *b,
1359                                   const char *fn_name)
1360 {
1361         void *res;
1362         char *s;
1363
1364         if (!b->so_handle) {
1365                 NWRAP_LOG(NWRAP_LOG_ERROR, "No handle");
1366                 return NULL;
1367         }
1368
1369         if (asprintf(&s, "_nss_%s_%s", b->name, fn_name) == -1) {
1370                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
1371                 return NULL;
1372         }
1373
1374         res = dlsym(b->so_handle, s);
1375         if (!res) {
1376                 NWRAP_LOG(NWRAP_LOG_ERROR,
1377                           "Cannot find function %s in %s",
1378                           s, b->so_path);
1379         }
1380         SAFE_FREE(s);
1381         return res;
1382 }
1383
1384 static struct nwrap_module_nss_fns *nwrap_load_module_fns(struct nwrap_backend *b)
1385 {
1386         struct nwrap_module_nss_fns *fns;
1387
1388         if (!b->so_handle) {
1389                 return NULL;
1390         }
1391
1392         fns = (struct nwrap_module_nss_fns *)malloc(sizeof(struct nwrap_module_nss_fns));
1393         if (!fns) {
1394                 return NULL;
1395         }
1396
1397         *(void **)(&fns->_nss_getpwnam_r) =
1398                 nwrap_load_module_fn(b, "getpwnam_r");
1399         *(void **)(&fns->_nss_getpwuid_r) =
1400                 nwrap_load_module_fn(b, "getpwuid_r");
1401         *(void **)(&fns->_nss_setpwent) =
1402                 nwrap_load_module_fn(b, "setpwent");
1403         *(void **)(&fns->_nss_getpwent_r) =
1404                 nwrap_load_module_fn(b, "getpwent_r");
1405         *(void **)(&fns->_nss_endpwent) =
1406                 nwrap_load_module_fn(b, "endpwent");
1407         *(void **)(&fns->_nss_initgroups) =
1408                 nwrap_load_module_fn(b, "initgroups_dyn");
1409         *(void **)(&fns->_nss_getgrnam_r) =
1410                 nwrap_load_module_fn(b, "getgrnam_r");
1411         *(void **)(&fns->_nss_getgrgid_r)=
1412                 nwrap_load_module_fn(b, "getgrgid_r");
1413         *(void **)(&fns->_nss_setgrent) =
1414                 nwrap_load_module_fn(b, "setgrent");
1415         *(void **)(&fns->_nss_getgrent_r) =
1416                 nwrap_load_module_fn(b, "getgrent_r");
1417         *(void **)(&fns->_nss_endgrent) =
1418                 nwrap_load_module_fn(b, "endgrent");
1419
1420         return fns;
1421 }
1422
1423 static void *nwrap_load_module(const char *so_path)
1424 {
1425         void *h;
1426
1427         if (!so_path || !strlen(so_path)) {
1428                 return NULL;
1429         }
1430
1431         h = dlopen(so_path, RTLD_LAZY);
1432         if (!h) {
1433                 NWRAP_LOG(NWRAP_LOG_ERROR,
1434                           "Cannot open shared library %s",
1435                           so_path);
1436                 return NULL;
1437         }
1438
1439         return h;
1440 }
1441
1442 static bool nwrap_module_init(const char *name,
1443                               struct nwrap_ops *ops,
1444                               const char *so_path,
1445                               int *num_backends,
1446                               struct nwrap_backend **backends)
1447 {
1448         struct nwrap_backend *b;
1449
1450         *backends = (struct nwrap_backend *)realloc(*backends,
1451                 sizeof(struct nwrap_backend) * ((*num_backends) + 1));
1452         if (!*backends) {
1453                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
1454                 return false;
1455         }
1456
1457         b = &((*backends)[*num_backends]);
1458
1459         b->name = name;
1460         b->ops = ops;
1461         b->so_path = so_path;
1462
1463         if (so_path != NULL) {
1464                 b->so_handle = nwrap_load_module(so_path);
1465                 b->fns = nwrap_load_module_fns(b);
1466                 if (b->fns == NULL) {
1467                         return false;
1468                 }
1469         } else {
1470                 b->so_handle = NULL;
1471                 b->fns = NULL;
1472         }
1473
1474         (*num_backends)++;
1475
1476         return true;
1477 }
1478
1479 static void nwrap_libc_init(struct nwrap_main *r)
1480 {
1481         r->libc = malloc(sizeof(struct nwrap_libc));
1482         if (r->libc == NULL) {
1483                 printf("Failed to allocate memory for libc");
1484                 exit(-1);
1485         }
1486         ZERO_STRUCTP(r->libc);
1487
1488         r->libc->fns = malloc(sizeof(struct nwrap_libc_fns));
1489         if (r->libc->fns == NULL) {
1490                 printf("Failed to allocate memory for libc functions");
1491                 exit(-1);
1492         }
1493         ZERO_STRUCTP(r->libc->fns);
1494 }
1495
1496 static void nwrap_backend_init(struct nwrap_main *r)
1497 {
1498         const char *module_so_path = getenv("NSS_WRAPPER_MODULE_SO_PATH");
1499         const char *module_fn_name = getenv("NSS_WRAPPER_MODULE_FN_PREFIX");
1500
1501         r->num_backends = 0;
1502         r->backends = NULL;
1503
1504         if (!nwrap_module_init("files", &nwrap_files_ops, NULL,
1505                                &r->num_backends,
1506                                &r->backends)) {
1507                 NWRAP_LOG(NWRAP_LOG_ERROR,
1508                           "Failed to initialize 'files' backend");
1509                 return;
1510         }
1511
1512         if (module_so_path != NULL &&
1513             module_so_path[0] != '\0' &&
1514             module_fn_name != NULL &&
1515             module_fn_name[0] != '\0') {
1516                 if (!nwrap_module_init(module_fn_name,
1517                                        &nwrap_module_ops,
1518                                        module_so_path,
1519                                        &r->num_backends,
1520                                        &r->backends)) {
1521                         NWRAP_LOG(NWRAP_LOG_ERROR,
1522                                   "Failed to initialize '%s' backend",
1523                                   module_fn_name);
1524                         return;
1525                 }
1526         }
1527 }
1528
1529 static void nwrap_init(void)
1530 {
1531         const char *env;
1532         char *endptr;
1533         size_t max_hostents_tmp;
1534
1535         NWRAP_LOCK(nwrap_initialized);
1536         if (nwrap_initialized) {
1537                 NWRAP_UNLOCK(nwrap_initialized);
1538                 return;
1539         }
1540
1541         /*
1542          * Still holding nwrap_initialized lock here.
1543          * We don't use NWRAP_(UN)LOCK_ALL macros here because we
1544          * want to avoid overhead when other threads do their job.
1545          */
1546         NWRAP_LOCK(nwrap_global);
1547         NWRAP_LOCK(nwrap_gr_global);
1548         NWRAP_LOCK(nwrap_he_global);
1549         NWRAP_LOCK(nwrap_pw_global);
1550         NWRAP_LOCK(nwrap_sp_global);
1551
1552         nwrap_initialized = true;
1553
1554         /* Initialize pthread_atfork handlers */
1555         pthread_atfork(&nwrap_thread_prepare, &nwrap_thread_parent,
1556                        &nwrap_thread_child);
1557
1558         env = getenv("NSS_WRAPPER_MAX_HOSTENTS");
1559         if (env != NULL) {
1560                 max_hostents_tmp = (size_t)strtol(env, &endptr, 10);
1561                 if (((env != '\0') && (endptr == '\0')) ||
1562                     (max_hostents_tmp == 0)) {
1563                         NWRAP_LOG(NWRAP_LOG_DEBUG,
1564                                   "Error parsing NSS_WRAPPER_MAX_HOSTENTS "
1565                                   "value or value is too small. "
1566                                   "Using default value: %lu.",
1567                                   max_hostents);
1568                 } else {
1569                         max_hostents = max_hostents_tmp;
1570                 }
1571         }
1572         /* Initialize hash table */
1573         NWRAP_LOG(NWRAP_LOG_DEBUG,
1574                   "Initializing hash table of size %lu items.", max_hostents);
1575         if (hcreate(max_hostents) == 0) {
1576                 NWRAP_LOG(NWRAP_LOG_ERROR,
1577                           "Failed to initialize hash table");
1578                 goto done;
1579         }
1580
1581         nwrap_main_global = &__nwrap_main_global;
1582
1583         nwrap_libc_init(nwrap_main_global);
1584
1585         nwrap_backend_init(nwrap_main_global);
1586
1587         /* passwd */
1588         nwrap_pw_global.cache = &__nwrap_cache_pw;
1589
1590         nwrap_pw_global.cache->path = getenv("NSS_WRAPPER_PASSWD");
1591         nwrap_pw_global.cache->fp = NULL;
1592         nwrap_pw_global.cache->fd = -1;
1593         nwrap_pw_global.cache->private_data = &nwrap_pw_global;
1594         nwrap_pw_global.cache->parse_line = nwrap_pw_parse_line;
1595         nwrap_pw_global.cache->unload = nwrap_pw_unload;
1596
1597         /* shadow */
1598 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
1599         nwrap_sp_global.cache = &__nwrap_cache_sp;
1600
1601         nwrap_sp_global.cache->path = getenv("NSS_WRAPPER_SHADOW");
1602         nwrap_sp_global.cache->fp = NULL;
1603         nwrap_sp_global.cache->fd = -1;
1604         nwrap_sp_global.cache->private_data = &nwrap_sp_global;
1605         nwrap_sp_global.cache->parse_line = nwrap_sp_parse_line;
1606         nwrap_sp_global.cache->unload = nwrap_sp_unload;
1607 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
1608
1609         /* group */
1610         nwrap_gr_global.cache = &__nwrap_cache_gr;
1611
1612         nwrap_gr_global.cache->path = getenv("NSS_WRAPPER_GROUP");
1613         nwrap_gr_global.cache->fp = NULL;
1614         nwrap_gr_global.cache->fd = -1;
1615         nwrap_gr_global.cache->private_data = &nwrap_gr_global;
1616         nwrap_gr_global.cache->parse_line = nwrap_gr_parse_line;
1617         nwrap_gr_global.cache->unload = nwrap_gr_unload;
1618
1619         /* hosts */
1620         nwrap_he_global.cache = &__nwrap_cache_he;
1621
1622         nwrap_he_global.cache->path = getenv("NSS_WRAPPER_HOSTS");
1623         nwrap_he_global.cache->fp = NULL;
1624         nwrap_he_global.cache->fd = -1;
1625         nwrap_he_global.cache->private_data = &nwrap_he_global;
1626         nwrap_he_global.cache->parse_line = nwrap_he_parse_line;
1627         nwrap_he_global.cache->unload = nwrap_he_unload;
1628
1629 done:
1630         /* We hold all locks here so we can use NWRAP_UNLOCK_ALL. */
1631         NWRAP_UNLOCK_ALL;
1632 }
1633
1634 bool nss_wrapper_enabled(void)
1635 {
1636         nwrap_init();
1637
1638         if (nwrap_pw_global.cache->path == NULL ||
1639             nwrap_pw_global.cache->path[0] == '\0') {
1640                 return false;
1641         }
1642         if (nwrap_gr_global.cache->path == NULL ||
1643             nwrap_gr_global.cache->path[0] == '\0') {
1644                 return false;
1645         }
1646
1647         return true;
1648 }
1649
1650 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
1651 bool nss_wrapper_shadow_enabled(void)
1652 {
1653         nwrap_init();
1654
1655         if (nwrap_sp_global.cache->path == NULL ||
1656             nwrap_sp_global.cache->path[0] == '\0') {
1657                 return false;
1658         }
1659
1660         return true;
1661 }
1662 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
1663
1664 bool nss_wrapper_hosts_enabled(void)
1665 {
1666         nwrap_init();
1667
1668         if (nwrap_he_global.cache->path == NULL ||
1669             nwrap_he_global.cache->path[0] == '\0') {
1670                 return false;
1671         }
1672
1673         return true;
1674 }
1675
1676 static bool nwrap_hostname_enabled(void)
1677 {
1678         nwrap_init();
1679
1680         if (getenv("NSS_WRAPPER_HOSTNAME") == NULL) {
1681                 return false;
1682         }
1683
1684         return true;
1685 }
1686
1687 static bool nwrap_parse_file(struct nwrap_cache *nwrap)
1688 {
1689         char *line = NULL;
1690         ssize_t n;
1691         /* Unused but getline needs it */
1692         size_t len;
1693         bool ok;
1694
1695         if (nwrap->st.st_size == 0) {
1696                 NWRAP_LOG(NWRAP_LOG_DEBUG, "size == 0");
1697                 return true;
1698         }
1699
1700         /* Support for 32-bit system I guess */
1701         if (nwrap->st.st_size > INT32_MAX) {
1702                 NWRAP_LOG(NWRAP_LOG_ERROR,
1703                           "Size[%u] larger than INT32_MAX",
1704                           (unsigned)nwrap->st.st_size);
1705                 return false;
1706         }
1707
1708         rewind(nwrap->fp);
1709
1710         do {
1711                 n = getline(&line, &len, nwrap->fp);
1712                 if (n < 0) {
1713                         SAFE_FREE(line);
1714                         if (feof(nwrap->fp)) {
1715                                 break;
1716                         }
1717
1718                         NWRAP_LOG(NWRAP_LOG_ERROR,
1719                                   "Unable to read line from file: %s",
1720                                   nwrap->path);
1721                         return false;
1722                 }
1723
1724                 if (line[n - 1] == '\n') {
1725                         line[n - 1] = '\0';
1726                 }
1727
1728                 if (line[0] == '\0') {
1729                         SAFE_FREE(line);
1730                         continue;
1731                 }
1732
1733                 ok = nwrap->parse_line(nwrap, line);
1734                 if (!ok) {
1735                         NWRAP_LOG(NWRAP_LOG_ERROR,
1736                                   "Unable to parse line file: %s",
1737                                   line);
1738                         SAFE_FREE(line);
1739                         return false;
1740                 }
1741
1742                 /* Line is parsed without issues so add it to list */
1743                 ok = nwrap_vector_add_item(&(nwrap->lines), (void *const) line);
1744                 if (!ok) {
1745                         NWRAP_LOG(NWRAP_LOG_ERROR,
1746                                   "Unable to add line to vector");
1747                         return false;
1748                 }
1749
1750                 /* This forces getline to allocate new memory for line. */
1751                 line = NULL;
1752         } while (!feof(nwrap->fp));
1753
1754         return true;
1755 }
1756
1757 static void nwrap_files_cache_unload(struct nwrap_cache *nwrap)
1758 {
1759         nwrap->unload(nwrap);
1760
1761         nwrap_lines_unload(nwrap);
1762 }
1763
1764 static bool nwrap_files_cache_reload(struct nwrap_cache *nwrap)
1765 {
1766         struct stat st;
1767         int ret;
1768         bool ok;
1769         bool retried = false;
1770
1771         assert(nwrap != NULL);
1772
1773 reopen:
1774         if (nwrap->fd < 0) {
1775                 nwrap->fp = fopen(nwrap->path, "re");
1776                 if (nwrap->fp == NULL) {
1777                         nwrap->fd = -1;
1778                         NWRAP_LOG(NWRAP_LOG_ERROR,
1779                                   "Unable to open '%s' readonly %d:%s",
1780                                   nwrap->path, nwrap->fd,
1781                                   strerror(errno));
1782                         return false;
1783
1784                 }
1785                 nwrap->fd = fileno(nwrap->fp);
1786                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Open '%s'", nwrap->path);
1787         }
1788
1789         ret = fstat(nwrap->fd, &st);
1790         if (ret != 0) {
1791                 NWRAP_LOG(NWRAP_LOG_ERROR,
1792                           "fstat(%s) - %d:%s",
1793                           nwrap->path,
1794                           ret,
1795                           strerror(errno));
1796                 fclose(nwrap->fp);
1797                 nwrap->fp = NULL;
1798                 nwrap->fd = -1;
1799                 return false;
1800         }
1801
1802         if (retried == false && st.st_nlink == 0) {
1803                 /* maybe someone has replaced the file... */
1804                 NWRAP_LOG(NWRAP_LOG_TRACE,
1805                           "st_nlink == 0, reopen %s",
1806                           nwrap->path);
1807                 retried = true;
1808                 memset(&nwrap->st, 0, sizeof(nwrap->st));
1809                 fclose(nwrap->fp);
1810                 nwrap->fp = NULL;
1811                 nwrap->fd = -1;
1812                 goto reopen;
1813         }
1814
1815         if (st.st_mtime == nwrap->st.st_mtime) {
1816                 NWRAP_LOG(NWRAP_LOG_TRACE,
1817                           "st_mtime[%u] hasn't changed, skip reload",
1818                           (unsigned)st.st_mtime);
1819                 return true;
1820         }
1821
1822         NWRAP_LOG(NWRAP_LOG_TRACE,
1823                   "st_mtime has changed [%u] => [%u], start reload",
1824                   (unsigned)st.st_mtime,
1825                   (unsigned)nwrap->st.st_mtime);
1826
1827         nwrap->st = st;
1828
1829         nwrap_files_cache_unload(nwrap);
1830
1831         ok = nwrap_parse_file(nwrap);
1832         if (!ok) {
1833                 NWRAP_LOG(NWRAP_LOG_ERROR, "Failed to reload %s", nwrap->path);
1834                 nwrap_files_cache_unload(nwrap);
1835                 return false;
1836         }
1837
1838         NWRAP_LOG(NWRAP_LOG_TRACE, "Reloaded %s", nwrap->path);
1839         return true;
1840 }
1841
1842 /*
1843  * the caller has to call nwrap_unload() on failure
1844  */
1845 static bool nwrap_pw_parse_line(struct nwrap_cache *nwrap, char *line)
1846 {
1847         struct nwrap_pw *nwrap_pw;
1848         char *c;
1849         char *p;
1850         char *e;
1851         struct passwd *pw;
1852         size_t list_size;
1853
1854         nwrap_pw = (struct nwrap_pw *)nwrap->private_data;
1855
1856         list_size = sizeof(*nwrap_pw->list) * (nwrap_pw->num+1);
1857         pw = (struct passwd *)realloc(nwrap_pw->list, list_size);
1858         if (!pw) {
1859                 NWRAP_LOG(NWRAP_LOG_ERROR,
1860                           "realloc(%u) failed",
1861                           (unsigned)list_size);
1862                 return false;
1863         }
1864         nwrap_pw->list = pw;
1865
1866         pw = &nwrap_pw->list[nwrap_pw->num];
1867
1868         c = line;
1869
1870         /* name */
1871         p = strchr(c, ':');
1872         if (!p) {
1873                 NWRAP_LOG(NWRAP_LOG_ERROR,
1874                           "Invalid line[%s]: '%s'",
1875                           line,
1876                           c);
1877                 return false;
1878         }
1879         *p = '\0';
1880         p++;
1881         pw->pw_name = c;
1882         c = p;
1883
1884         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]\n", pw->pw_name);
1885
1886         /* password */
1887         p = strchr(c, ':');
1888         if (!p) {
1889                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1890                 return false;
1891         }
1892         *p = '\0';
1893         p++;
1894         pw->pw_passwd = c;
1895         c = p;
1896
1897         NWRAP_LOG(NWRAP_LOG_TRACE, "password[%s]\n", pw->pw_passwd);
1898
1899         /* uid */
1900         p = strchr(c, ':');
1901         if (!p) {
1902                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1903                 return false;
1904         }
1905         *p = '\0';
1906         p++;
1907         e = NULL;
1908         pw->pw_uid = (uid_t)strtoul(c, &e, 10);
1909         if (c == e) {
1910                 NWRAP_LOG(NWRAP_LOG_ERROR,
1911                           "Invalid line[%s]: '%s' - %s",
1912                           line, c, strerror(errno));
1913                 return false;
1914         }
1915         if (e == NULL) {
1916                 NWRAP_LOG(NWRAP_LOG_ERROR,
1917                           "Invalid line[%s]: '%s' - %s",
1918                           line, c, strerror(errno));
1919                 return false;
1920         }
1921         if (e[0] != '\0') {
1922                 NWRAP_LOG(NWRAP_LOG_ERROR,
1923                           "Invalid line[%s]: '%s' - %s",
1924                           line, c, strerror(errno));
1925                 return false;
1926         }
1927         c = p;
1928
1929         NWRAP_LOG(NWRAP_LOG_TRACE, "uid[%u]", pw->pw_uid);
1930
1931         /* gid */
1932         p = strchr(c, ':');
1933         if (!p) {
1934                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1935                 return false;
1936         }
1937         *p = '\0';
1938         p++;
1939         e = NULL;
1940         pw->pw_gid = (gid_t)strtoul(c, &e, 10);
1941         if (c == e) {
1942                 NWRAP_LOG(NWRAP_LOG_ERROR,
1943                           "Invalid line[%s]: '%s' - %s",
1944                           line, c, strerror(errno));
1945                 return false;
1946         }
1947         if (e == NULL) {
1948                 NWRAP_LOG(NWRAP_LOG_ERROR,
1949                           "Invalid line[%s]: '%s' - %s",
1950                           line, c, strerror(errno));
1951                 return false;
1952         }
1953         if (e[0] != '\0') {
1954                 NWRAP_LOG(NWRAP_LOG_ERROR,
1955                           "Invalid line[%s]: '%s' - %s",
1956                           line, c, strerror(errno));
1957                 return false;
1958         }
1959         c = p;
1960
1961         NWRAP_LOG(NWRAP_LOG_TRACE, "gid[%u]\n", pw->pw_gid);
1962
1963         /* gecos */
1964         p = strchr(c, ':');
1965         if (!p) {
1966                 NWRAP_LOG(NWRAP_LOG_ERROR, "invalid line[%s]: '%s'", line, c);
1967                 return false;
1968         }
1969         *p = '\0';
1970         p++;
1971         pw->pw_gecos = c;
1972         c = p;
1973
1974         NWRAP_LOG(NWRAP_LOG_TRACE, "gecos[%s]", pw->pw_gecos);
1975
1976         /* dir */
1977         p = strchr(c, ':');
1978         if (!p) {
1979                 NWRAP_LOG(NWRAP_LOG_ERROR, "'%s'", c);
1980                 return false;
1981         }
1982         *p = '\0';
1983         p++;
1984         pw->pw_dir = c;
1985         c = p;
1986
1987         NWRAP_LOG(NWRAP_LOG_TRACE, "dir[%s]", pw->pw_dir);
1988
1989         /* shell */
1990         pw->pw_shell = c;
1991         NWRAP_LOG(NWRAP_LOG_TRACE, "shell[%s]", pw->pw_shell);
1992
1993         NWRAP_LOG(NWRAP_LOG_DEBUG,
1994                   "Added user[%s:%s:%u:%u:%s:%s:%s]",
1995                   pw->pw_name, pw->pw_passwd,
1996                   pw->pw_uid, pw->pw_gid,
1997                   pw->pw_gecos, pw->pw_dir, pw->pw_shell);
1998
1999         nwrap_pw->num++;
2000         return true;
2001 }
2002
2003 static void nwrap_pw_unload(struct nwrap_cache *nwrap)
2004 {
2005         struct nwrap_pw *nwrap_pw;
2006         nwrap_pw = (struct nwrap_pw *)nwrap->private_data;
2007
2008         SAFE_FREE(nwrap_pw->list);
2009         nwrap_pw->num = 0;
2010         nwrap_pw->idx = 0;
2011 }
2012
2013 static int nwrap_pw_copy_r(const struct passwd *src, struct passwd *dst,
2014                            char *buf, size_t buflen, struct passwd **dstp)
2015 {
2016         char *first;
2017         char *last;
2018         off_t ofs;
2019
2020         first = src->pw_name;
2021
2022         last = src->pw_shell;
2023         while (*last) last++;
2024
2025         ofs = PTR_DIFF(last + 1, first);
2026
2027         if (ofs > (off_t) buflen) {
2028                 return ERANGE;
2029         }
2030
2031         memcpy(buf, first, ofs);
2032
2033         ofs = PTR_DIFF(src->pw_name, first);
2034         dst->pw_name = buf + ofs;
2035         ofs = PTR_DIFF(src->pw_passwd, first);
2036         dst->pw_passwd = buf + ofs;
2037         dst->pw_uid = src->pw_uid;
2038         dst->pw_gid = src->pw_gid;
2039         ofs = PTR_DIFF(src->pw_gecos, first);
2040         dst->pw_gecos = buf + ofs;
2041         ofs = PTR_DIFF(src->pw_dir, first);
2042         dst->pw_dir = buf + ofs;
2043         ofs = PTR_DIFF(src->pw_shell, first);
2044         dst->pw_shell = buf + ofs;
2045
2046         if (dstp) {
2047                 *dstp = dst;
2048         }
2049
2050         return 0;
2051 }
2052
2053 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
2054 static bool nwrap_sp_parse_line(struct nwrap_cache *nwrap, char *line)
2055 {
2056         struct nwrap_sp *nwrap_sp;
2057         struct spwd *sp;
2058         size_t list_size;
2059         char *c;
2060         char *e;
2061         char *p;
2062
2063         nwrap_sp = (struct nwrap_sp *)nwrap->private_data;
2064
2065         list_size = sizeof(*nwrap_sp->list) * (nwrap_sp->num+1);
2066         sp = (struct spwd *)realloc(nwrap_sp->list, list_size);
2067         if (sp == NULL) {
2068                 NWRAP_LOG(NWRAP_LOG_ERROR,
2069                           "realloc(%u) failed",
2070                           (unsigned)list_size);
2071                 return false;
2072         }
2073         nwrap_sp->list = sp;
2074
2075         sp = &nwrap_sp->list[nwrap_sp->num];
2076
2077         c = line;
2078
2079         /* name */
2080         p = strchr(c, ':');
2081         if (p == NULL) {
2082                 NWRAP_LOG(NWRAP_LOG_ERROR,
2083                           "name -- Invalid line[%s]: '%s'",
2084                           line,
2085                           c);
2086                 return false;
2087         }
2088         *p = '\0';
2089         p++;
2090         sp->sp_namp = c;
2091         c = p;
2092
2093         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]\n", sp->sp_namp);
2094
2095         /* pwd */
2096         p = strchr(c, ':');
2097         if (p == NULL) {
2098                 NWRAP_LOG(NWRAP_LOG_ERROR,
2099                           "pwd -- Invalid line[%s]: '%s'",
2100                           line,
2101                           c);
2102                 return false;
2103         }
2104         *p = '\0';
2105         p++;
2106         sp->sp_pwdp = c;
2107         c = p;
2108
2109         /* lstchg (long) */
2110         if (c[0] == ':') {
2111                 sp->sp_lstchg = -1;
2112                 p++;
2113         } else {
2114                 p = strchr(c, ':');
2115                 if (p == NULL) {
2116                         NWRAP_LOG(NWRAP_LOG_ERROR,
2117                                   "lstchg -- Invalid line[%s]: '%s'",
2118                                   line,
2119                                   c);
2120                         return false;
2121                 }
2122                 *p = '\0';
2123                 p++;
2124                 sp->sp_lstchg = strtol(c, &e, 10);
2125                 if (c == e) {
2126                         NWRAP_LOG(NWRAP_LOG_ERROR,
2127                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2128                                   line, c, strerror(errno));
2129                         return false;
2130                 }
2131                 if (e == NULL) {
2132                         NWRAP_LOG(NWRAP_LOG_ERROR,
2133                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2134                                   line, c, strerror(errno));
2135                         return false;
2136                 }
2137                 if (e[0] != '\0') {
2138                         NWRAP_LOG(NWRAP_LOG_ERROR,
2139                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2140                                   line, c, strerror(errno));
2141                         return false;
2142                 }
2143         }
2144         c = p;
2145
2146         /* min (long) */
2147         if (c[0] == ':') {
2148                 sp->sp_min = -1;
2149                 p++;
2150         } else {
2151                 p = strchr(c, ':');
2152                 if (p == NULL) {
2153                         NWRAP_LOG(NWRAP_LOG_ERROR,
2154                                   "min -- Invalid line[%s]: '%s'",
2155                                   line,
2156                                   c);
2157                         return false;
2158                 }
2159                 *p = '\0';
2160                 p++;
2161                 sp->sp_min = strtol(c, &e, 10);
2162                 if (c == e) {
2163                         NWRAP_LOG(NWRAP_LOG_ERROR,
2164                                   "min -- Invalid line[%s]: '%s' - %s",
2165                                   line, c, strerror(errno));
2166                         return false;
2167                 }
2168                 if (e == NULL) {
2169                         NWRAP_LOG(NWRAP_LOG_ERROR,
2170                                   "min -- Invalid line[%s]: '%s' - %s",
2171                                   line, c, strerror(errno));
2172                         return false;
2173                 }
2174                 if (e[0] != '\0') {
2175                         NWRAP_LOG(NWRAP_LOG_ERROR,
2176                                   "min -- Invalid line[%s]: '%s' - %s",
2177                                   line, c, strerror(errno));
2178                         return false;
2179                 }
2180         }
2181         c = p;
2182
2183         /* max (long) */
2184         if (c[0] == ':') {
2185                 sp->sp_max = -1;
2186                 p++;
2187         } else {
2188                 p = strchr(c, ':');
2189                 if (p == NULL) {
2190                         NWRAP_LOG(NWRAP_LOG_ERROR,
2191                                   "max -- Invalid line[%s]: '%s'",
2192                                   line,
2193                                   c);
2194                         return false;
2195                 }
2196                 *p = '\0';
2197                 p++;
2198                 sp->sp_max = strtol(c, &e, 10);
2199                 if (c == e) {
2200                         NWRAP_LOG(NWRAP_LOG_ERROR,
2201                                   "max -- Invalid line[%s]: '%s' - %s",
2202                                   line, c, strerror(errno));
2203                         return false;
2204                 }
2205                 if (e == NULL) {
2206                         NWRAP_LOG(NWRAP_LOG_ERROR,
2207                                   "max -- Invalid line[%s]: '%s' - %s",
2208                                   line, c, strerror(errno));
2209                         return false;
2210                 }
2211                 if (e[0] != '\0') {
2212                         NWRAP_LOG(NWRAP_LOG_ERROR,
2213                                   "max -- Invalid line[%s]: '%s' - %s",
2214                                   line, c, strerror(errno));
2215                         return false;
2216                 }
2217         }
2218         c = p;
2219
2220         /* warn (long) */
2221         if (c[0] == ':') {
2222                 sp->sp_warn = -1;
2223                 p++;
2224         } else {
2225                 p = strchr(c, ':');
2226                 if (p == NULL) {
2227                         NWRAP_LOG(NWRAP_LOG_ERROR,
2228                                   "warn -- Invalid line[%s]: '%s'",
2229                                   line,
2230                                   c);
2231                         return false;
2232                 }
2233                 *p = '\0';
2234                 p++;
2235                 sp->sp_warn = strtol(c, &e, 10);
2236                 if (c == e) {
2237                         NWRAP_LOG(NWRAP_LOG_ERROR,
2238                                   "warn -- Invalid line[%s]: '%s' - %s",
2239                                   line, c, strerror(errno));
2240                         return false;
2241                 }
2242                 if (e == NULL) {
2243                         NWRAP_LOG(NWRAP_LOG_ERROR,
2244                                   "warn -- Invalid line[%s]: '%s' - %s",
2245                                   line, c, strerror(errno));
2246                         return false;
2247                 }
2248                 if (e[0] != '\0') {
2249                         NWRAP_LOG(NWRAP_LOG_ERROR,
2250                                   "warn -- Invalid line[%s]: '%s' - %s",
2251                                   line, c, strerror(errno));
2252                         return false;
2253                 }
2254         }
2255         c = p;
2256
2257         /* inact (long) */
2258         if (c[0] == ':') {
2259                 sp->sp_inact = -1;
2260                 p++;
2261         } else {
2262                 p = strchr(c, ':');
2263                 if (p == NULL) {
2264                         NWRAP_LOG(NWRAP_LOG_ERROR,
2265                                   "inact -- Invalid line[%s]: '%s'",
2266                                   line,
2267                                   c);
2268                         return false;
2269                 }
2270                 *p = '\0';
2271                 p++;
2272                 sp->sp_inact = strtol(c, &e, 10);
2273                 if (c == e) {
2274                         NWRAP_LOG(NWRAP_LOG_ERROR,
2275                                   "inact -- Invalid line[%s]: '%s' - %s",
2276                                   line, c, strerror(errno));
2277                         return false;
2278                 }
2279                 if (e == NULL) {
2280                         NWRAP_LOG(NWRAP_LOG_ERROR,
2281                                   "inact -- Invalid line[%s]: '%s' - %s",
2282                                   line, c, strerror(errno));
2283                         return false;
2284                 }
2285                 if (e[0] != '\0') {
2286                         NWRAP_LOG(NWRAP_LOG_ERROR,
2287                                   "inact -- Invalid line[%s]: '%s' - %s",
2288                                   line, c, strerror(errno));
2289                         return false;
2290                 }
2291         }
2292         c = p;
2293
2294         /* expire (long) */
2295         if (c[0] == ':') {
2296                 sp->sp_expire = -1;
2297                 p++;
2298         } else {
2299                 p = strchr(c, ':');
2300                 if (p == NULL) {
2301                         NWRAP_LOG(NWRAP_LOG_ERROR,
2302                                   "expire -- Invalid line[%s]: '%s'",
2303                                   line,
2304                                   c);
2305                         return false;
2306                 }
2307                 *p = '\0';
2308                 p++;
2309                 sp->sp_expire = strtol(c, &e, 10);
2310                 if (c == e) {
2311                         NWRAP_LOG(NWRAP_LOG_ERROR,
2312                                   "expire -- Invalid line[%s]: '%s' - %s",
2313                                   line, c, strerror(errno));
2314                         return false;
2315                 }
2316                 if (e == NULL) {
2317                         NWRAP_LOG(NWRAP_LOG_ERROR,
2318                                   "expire -- Invalid line[%s]: '%s' - %s",
2319                                   line, c, strerror(errno));
2320                         return false;
2321                 }
2322                 if (e[0] != '\0') {
2323                         NWRAP_LOG(NWRAP_LOG_ERROR,
2324                                   "expire -- Invalid line[%s]: '%s' - %s",
2325                                   line, c, strerror(errno));
2326                         return false;
2327                 }
2328         }
2329         c = p;
2330
2331         nwrap_sp->num++;
2332         return true;
2333 }
2334
2335 static void nwrap_sp_unload(struct nwrap_cache *nwrap)
2336 {
2337         struct nwrap_sp *nwrap_sp;
2338         nwrap_sp = (struct nwrap_sp *)nwrap->private_data;
2339
2340         SAFE_FREE(nwrap_sp->list);
2341         nwrap_sp->num = 0;
2342         nwrap_sp->idx = 0;
2343 }
2344 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
2345
2346 /*
2347  * the caller has to call nwrap_unload() on failure
2348  */
2349 static bool nwrap_gr_parse_line(struct nwrap_cache *nwrap, char *line)
2350 {
2351         struct nwrap_gr *nwrap_gr;
2352         char *c;
2353         char *p;
2354         char *e;
2355         struct group *gr;
2356         size_t list_size;
2357         unsigned nummem;
2358
2359         nwrap_gr = (struct nwrap_gr *)nwrap->private_data;
2360
2361         list_size = sizeof(*nwrap_gr->list) * (nwrap_gr->num+1);
2362         gr = (struct group *)realloc(nwrap_gr->list, list_size);
2363         if (!gr) {
2364                 NWRAP_LOG(NWRAP_LOG_ERROR, "realloc failed");
2365                 return false;
2366         }
2367         nwrap_gr->list = gr;
2368
2369         gr = &nwrap_gr->list[nwrap_gr->num];
2370
2371         c = line;
2372
2373         /* name */
2374         p = strchr(c, ':');
2375         if (!p) {
2376                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2377                 return false;
2378         }
2379         *p = '\0';
2380         p++;
2381         gr->gr_name = c;
2382         c = p;
2383
2384         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]", gr->gr_name);
2385
2386         /* password */
2387         p = strchr(c, ':');
2388         if (!p) {
2389                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2390                 return false;
2391         }
2392         *p = '\0';
2393         p++;
2394         gr->gr_passwd = c;
2395         c = p;
2396
2397         NWRAP_LOG(NWRAP_LOG_TRACE, "password[%s]", gr->gr_passwd);
2398
2399         /* gid */
2400         p = strchr(c, ':');
2401         if (!p) {
2402                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2403                 return false;
2404         }
2405         *p = '\0';
2406         p++;
2407         e = NULL;
2408         gr->gr_gid = (gid_t)strtoul(c, &e, 10);
2409         if (c == e) {
2410                 NWRAP_LOG(NWRAP_LOG_ERROR,
2411                           "Invalid line[%s]: '%s' - %s",
2412                           line, c, strerror(errno));
2413                 return false;
2414         }
2415         if (e == NULL) {
2416                 NWRAP_LOG(NWRAP_LOG_ERROR,
2417                           "Invalid line[%s]: '%s' - %s",
2418                           line, c, strerror(errno));
2419                 return false;
2420         }
2421         if (e[0] != '\0') {
2422                 NWRAP_LOG(NWRAP_LOG_ERROR,
2423                           "Invalid line[%s]: '%s' - %s",
2424                           line, c, strerror(errno));
2425                 return false;
2426         }
2427         c = p;
2428
2429         NWRAP_LOG(NWRAP_LOG_TRACE, "gid[%u]", gr->gr_gid);
2430
2431         /* members */
2432         gr->gr_mem = (char **)malloc(sizeof(char *));
2433         if (!gr->gr_mem) {
2434                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
2435                 return false;
2436         }
2437         gr->gr_mem[0] = NULL;
2438
2439         for(nummem=0; p; nummem++) {
2440                 char **m;
2441                 size_t m_size;
2442                 c = p;
2443                 p = strchr(c, ',');
2444                 if (p) {
2445                         *p = '\0';
2446                         p++;
2447                 }
2448
2449                 if (strlen(c) == 0) {
2450                         break;
2451                 }
2452
2453                 m_size = sizeof(char *) * (nummem+2);
2454                 m = (char **)realloc(gr->gr_mem, m_size);
2455                 if (!m) {
2456                         NWRAP_LOG(NWRAP_LOG_ERROR,
2457                                   "realloc(%zd) failed",
2458                                   m_size);
2459                         return false;
2460                 }
2461                 gr->gr_mem = m;
2462                 gr->gr_mem[nummem] = c;
2463                 gr->gr_mem[nummem+1] = NULL;
2464
2465                 NWRAP_LOG(NWRAP_LOG_TRACE,
2466                           "member[%u]: '%s'",
2467                           nummem, gr->gr_mem[nummem]);
2468         }
2469
2470         NWRAP_LOG(NWRAP_LOG_DEBUG,
2471                   "Added group[%s:%s:%u:] with %u members",
2472                   gr->gr_name, gr->gr_passwd, gr->gr_gid, nummem);
2473
2474         nwrap_gr->num++;
2475         return true;
2476 }
2477
2478 static void nwrap_gr_unload(struct nwrap_cache *nwrap)
2479 {
2480         int i;
2481         struct nwrap_gr *nwrap_gr;
2482         nwrap_gr = (struct nwrap_gr *)nwrap->private_data;
2483
2484         if (nwrap_gr->list) {
2485                 for (i=0; i < nwrap_gr->num; i++) {
2486                         SAFE_FREE(nwrap_gr->list[i].gr_mem);
2487                 }
2488                 SAFE_FREE(nwrap_gr->list);
2489         }
2490
2491         nwrap_gr->num = 0;
2492         nwrap_gr->idx = 0;
2493 }
2494
2495 static int nwrap_gr_copy_r(const struct group *src, struct group *dst,
2496                            char *buf, size_t buflen, struct group **dstp)
2497 {
2498         char *first;
2499         char **lastm;
2500         char *last = NULL;
2501         off_t ofsb;
2502         off_t ofsm;
2503         off_t ofs;
2504         unsigned i;
2505
2506         first = src->gr_name;
2507
2508         lastm = src->gr_mem;
2509         while (*lastm) {
2510                 last = *lastm;
2511                 lastm++;
2512         }
2513
2514         if (last == NULL) {
2515                 last = src->gr_passwd;
2516         }
2517         while (*last) last++;
2518
2519         ofsb = PTR_DIFF(last + 1, first);
2520         ofsm = PTR_DIFF(lastm + 1, src->gr_mem);
2521
2522         if ((ofsb + ofsm) > (off_t) buflen) {
2523                 return ERANGE;
2524         }
2525
2526         memcpy(buf, first, ofsb);
2527         memcpy(buf + ofsb, src->gr_mem, ofsm);
2528
2529         ofs = PTR_DIFF(src->gr_name, first);
2530         dst->gr_name = buf + ofs;
2531         ofs = PTR_DIFF(src->gr_passwd, first);
2532         dst->gr_passwd = buf + ofs;
2533         dst->gr_gid = src->gr_gid;
2534
2535         dst->gr_mem = (char **)(buf + ofsb);
2536         for (i=0; src->gr_mem[i]; i++) {
2537                 ofs = PTR_DIFF(src->gr_mem[i], first);
2538                 dst->gr_mem[i] = buf + ofs;
2539         }
2540
2541         if (dstp) {
2542                 *dstp = dst;
2543         }
2544
2545         return 0;
2546 }
2547
2548 static struct nwrap_entlist *nwrap_entlist_init(struct nwrap_entdata *ed)
2549 {
2550         struct nwrap_entlist *el;
2551
2552         if (ed == NULL) {
2553                 NWRAP_LOG(NWRAP_LOG_ERROR,
2554                           "entry is NULL, can't create list item");
2555                 return NULL;
2556         }
2557
2558         el = (struct nwrap_entlist *)malloc(sizeof(struct nwrap_entlist));
2559         if (el == NULL) {
2560                 NWRAP_LOG(NWRAP_LOG_ERROR, "malloc failed");
2561                 return NULL;
2562         }
2563
2564         el->next = NULL;
2565         el->ed = ed;
2566
2567         return el;
2568 }
2569
2570 static bool nwrap_add_ai(char *const ip_addr, struct nwrap_entdata *const ed)
2571 {
2572         ENTRY e;
2573         ENTRY *p;
2574         struct nwrap_entlist *el;
2575
2576         if (ip_addr == NULL) {
2577                 NWRAP_LOG(NWRAP_LOG_ERROR, "ip_addr NULL - can't add");
2578                 return false;
2579         }
2580
2581         el = nwrap_entlist_init(ed);
2582         if (el == NULL) {
2583                 return false;
2584         }
2585
2586         e.key = ip_addr;
2587         e.data = el;
2588
2589         p = hsearch(e, ENTER);
2590         if (p == NULL) {
2591                 NWRAP_LOG(NWRAP_LOG_ERROR, "Hash table is full");
2592                 return false;
2593         }
2594
2595         return true;
2596 }
2597
2598
2599 static bool nwrap_add_hname_add_new(char *const h_name,
2600                                     struct nwrap_entdata *const ed)
2601 {
2602         ENTRY e;
2603         ENTRY *p;
2604         struct nwrap_entlist *el;
2605
2606         if (h_name == NULL) {
2607                 NWRAP_LOG(NWRAP_LOG_ERROR, "h_name NULL - can't add");
2608                 return false;
2609         }
2610
2611         el = nwrap_entlist_init(ed);
2612         if (el == NULL) {
2613                 return false;
2614         }
2615
2616         e.key = h_name;
2617         e.data = (void *)el;
2618
2619         p = hsearch(e, ENTER);
2620         if (p == NULL) {
2621                 NWRAP_LOG(NWRAP_LOG_ERROR, "Hash table is full!");
2622                 return false;
2623         }
2624
2625         return true;
2626 }
2627
2628 static bool nwrap_add_hname_add_to_existing(struct nwrap_entdata *const ed,
2629                                             struct nwrap_entlist *const el)
2630 {
2631         struct nwrap_entlist *cursor;
2632         struct nwrap_entlist *el_new;
2633
2634         if (el == NULL) {
2635                 NWRAP_LOG(NWRAP_LOG_ERROR, "list is NULL, can not add");
2636                 return false;
2637         }
2638
2639         el_new = nwrap_entlist_init(ed);
2640         if (el_new == NULL) {
2641                 return false;
2642         }
2643
2644         for (cursor = el; cursor->next != NULL; cursor = cursor->next)
2645         {
2646                 if (cursor->ed == ed) {
2647                         free(el_new);
2648                         return false;
2649                 }
2650         }
2651
2652         if (cursor->ed == ed) {
2653                 free(el_new);
2654                 return false;
2655         }
2656
2657         cursor->next = el_new;
2658         return true;
2659 }
2660
2661 static bool nwrap_add_hname_alias(char *const h_name_a,
2662                                   struct nwrap_entdata *const ed)
2663 {
2664         ENTRY e;
2665         ENTRY *p;
2666         bool ok;
2667
2668         e.key = h_name_a;
2669         e.data = NULL;
2670         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching name: %s", e.key);
2671         p = hsearch(e, FIND);
2672         if (p == NULL) {
2673                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found. Adding...", h_name_a);
2674                 ok = nwrap_add_hname_add_new(h_name_a, ed);
2675         } else {
2676                 struct nwrap_entlist *el = (struct nwrap_entlist *)p->data;
2677
2678                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s found. Add record to list.", h_name_a);
2679                 ok = nwrap_add_hname_add_to_existing(ed, el);
2680         }
2681
2682         return ok;
2683 }
2684
2685 static bool nwrap_add_hname(struct nwrap_entdata *const ed)
2686 {
2687         char *const h_name = (char *const)(ed->ht.h_name);
2688         ENTRY e;
2689         ENTRY *p;
2690         unsigned i;
2691         bool ok;
2692
2693         e.key = h_name;
2694         e.data = NULL;
2695         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching name: %s", e.key);
2696         p = hsearch(e, FIND);
2697         if (p == NULL) {
2698                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found. Adding...", h_name);
2699                 ok = nwrap_add_hname_add_new(h_name, ed);
2700         } else {
2701                 struct nwrap_entlist *el = (struct nwrap_entlist *)p->data;
2702
2703                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s found. Add record to list.", h_name);
2704                 ok = nwrap_add_hname_add_to_existing(ed, el);
2705         }
2706
2707         if (!ok) {
2708                 return false;
2709         }
2710
2711         if (ed->ht.h_aliases == NULL) {
2712                 return true;
2713         }
2714
2715         /* Itemize aliases */
2716         for (i = 0; ed->ht.h_aliases[i] != NULL; ++i) {
2717                 char *h_name_alias;
2718
2719                 h_name_alias = ed->ht.h_aliases[i];
2720
2721                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Add alias: %s", h_name_alias);
2722
2723                 if (!nwrap_add_hname_alias(h_name_alias, ed)) {
2724                         NWRAP_LOG(NWRAP_LOG_ERROR,
2725                                   "Unable to add alias: %s", h_name_alias);
2726                         return false;
2727                 }
2728         }
2729
2730         return true;
2731 }
2732
2733 static bool nwrap_he_parse_line(struct nwrap_cache *nwrap, char *line)
2734 {
2735         struct nwrap_he *nwrap_he = (struct nwrap_he *)nwrap->private_data;
2736         bool do_aliases = true;
2737         ssize_t aliases_count = 0;
2738         char *p;
2739         char *i;
2740         char *n;
2741
2742         char *ip;
2743         bool ok;
2744
2745         struct nwrap_entdata *ed = (struct nwrap_entdata *)
2746                                    malloc(sizeof(struct nwrap_entdata));
2747         if (ed == NULL) {
2748                 NWRAP_LOG(NWRAP_LOG_ERROR,
2749                           "Unable to allocate memory for nwrap_entdata");
2750                 return false;
2751         }
2752         ZERO_STRUCTP(ed);
2753
2754         i = line;
2755
2756         /*
2757          * IP
2758          */
2759
2760         /* Walk to first char */
2761         for (p = i; *p != '.' && *p != ':' && !isxdigit((int) *p); p++) {
2762                 if (*p == '\0') {
2763                         NWRAP_LOG(NWRAP_LOG_ERROR,
2764                                   "Invalid line[%s]: '%s'",
2765                                   line, i);
2766                         free(ed);
2767                         return false;
2768                 }
2769         }
2770
2771         for (i = p; !isspace((int)*p); p++) {
2772                 if (*p == '\0') {
2773                         NWRAP_LOG(NWRAP_LOG_ERROR,
2774                                   "Invalid line[%s]: '%s'",
2775                                   line, i);
2776                         free(ed);
2777                         return false;
2778                 }
2779         }
2780
2781         *p = '\0';
2782
2783         if (inet_pton(AF_INET, i, ed->addr.host_addr)) {
2784                 ed->ht.h_addrtype = AF_INET;
2785                 ed->ht.h_length = 4;
2786 #ifdef HAVE_IPV6
2787         } else if (inet_pton(AF_INET6, i, ed->addr.host_addr)) {
2788                 ed->ht.h_addrtype = AF_INET6;
2789                 ed->ht.h_length = 16;
2790 #endif
2791         } else {
2792                 NWRAP_LOG(NWRAP_LOG_ERROR,
2793                           "Invalid line[%s]: '%s'",
2794                           line, i);
2795
2796                 free(ed);
2797                 return false;
2798         }
2799         ip = i;
2800
2801         nwrap_vector_add_item(&(ed->nwrap_addrdata),
2802                               (void *const)ed->addr.host_addr);
2803         ed->ht.h_addr_list = nwrap_vector_head(&ed->nwrap_addrdata);
2804
2805         p++;
2806
2807         /*
2808          * FQDN
2809          */
2810
2811         /* Walk to first char */
2812         for (n = p; *p != '_' && !isalnum((int) *p); p++) {
2813                 if (*p == '\0') {
2814                         NWRAP_LOG(NWRAP_LOG_ERROR,
2815                                   "Invalid line[%s]: '%s'",
2816                                   line, n);
2817
2818                         free(ed);
2819                         return false;
2820                 }
2821         }
2822
2823         for (n = p; !isspace((int)*p); p++) {
2824                 if (*p == '\0') {
2825                         do_aliases = false;
2826                         break;
2827                 }
2828         }
2829
2830         *p = '\0';
2831
2832         /* Convert to lowercase. This operate on same memory region */
2833         str_tolower(n, n);
2834         ed->ht.h_name = n;
2835
2836         /* glib's getent always dereferences he->h_aliases */
2837         ed->ht.h_aliases = malloc(sizeof(char *));
2838         if (ed->ht.h_aliases == NULL) {
2839                 free(ed);
2840                 return false;
2841         }
2842         ed->ht.h_aliases[0] = NULL;
2843
2844         /*
2845          * Aliases
2846          */
2847         while (do_aliases) {
2848                 char **aliases;
2849                 char *a;
2850
2851                 p++;
2852
2853                 /* Walk to first char */
2854                 for (a = p; *p != '_' && !isalnum((int) *p); p++) {
2855                         if (*p == '\0') {
2856                                 do_aliases = false;
2857                                 break;
2858                         }
2859                 }
2860                 /* Only trailing spaces are left */
2861                 if (!do_aliases) {
2862                         break;
2863                 }
2864
2865                 for (a = p; !isspace((int)*p); p++) {
2866                         if (*p == '\0') {
2867                                 do_aliases = false;
2868                                 break;
2869                         }
2870                 }
2871
2872                 *p = '\0';
2873
2874                 aliases = realloc(ed->ht.h_aliases, sizeof(char *) * (aliases_count + 2));
2875                 if (aliases == NULL) {
2876                         free(ed);
2877                         return false;
2878                 }
2879                 ed->ht.h_aliases = aliases;
2880
2881                 str_tolower(a, a);
2882                 aliases[aliases_count] = a;
2883                 aliases[aliases_count + 1] = NULL;
2884
2885                 aliases_count += 1;
2886         }
2887
2888         nwrap_vector_add_item(&(nwrap_he->entdata), (void *const)ed);
2889
2890         ed->aliases_count = aliases_count;
2891         /* Inventarize item */
2892         ok = nwrap_add_hname(ed);
2893         if (!ok) {
2894                 return false;
2895         }
2896
2897         ok = nwrap_add_ai(ip, ed);
2898         if (!ok) {
2899                 return false;
2900         }
2901
2902         nwrap_he->num++;
2903         return true;
2904 }
2905
2906 static void nwrap_he_unload(struct nwrap_cache *nwrap)
2907 {
2908         struct nwrap_he *nwrap_he =
2909                 (struct nwrap_he *)nwrap->private_data;
2910         struct nwrap_entdata *ed;
2911         size_t i;
2912
2913         nwrap_vector_foreach (ed, nwrap_he->entdata, i)
2914         {
2915                 SAFE_FREE(ed->nwrap_addrdata.items);
2916                 SAFE_FREE(ed->ht.h_aliases);
2917                 SAFE_FREE(ed);
2918         }
2919         SAFE_FREE(nwrap_he->entdata.items);
2920         nwrap_he->entdata.count = nwrap_he->entdata.capacity = 0;
2921
2922         nwrap_he->num = 0;
2923         nwrap_he->idx = 0;
2924 }
2925
2926
2927 /* user functions */
2928 static struct passwd *nwrap_files_getpwnam(struct nwrap_backend *b,
2929                                            const char *name)
2930 {
2931         int i;
2932         bool ok;
2933
2934         (void) b; /* unused */
2935
2936         NWRAP_LOG(NWRAP_LOG_DEBUG, "Lookup user %s in files", name);
2937
2938         ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
2939         if (!ok) {
2940                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
2941                 return NULL;
2942         }
2943
2944         for (i=0; i<nwrap_pw_global.num; i++) {
2945                 if (strcmp(nwrap_pw_global.list[i].pw_name, name) == 0) {
2946                         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] found", name);
2947                         return &nwrap_pw_global.list[i];
2948                 }
2949                 NWRAP_LOG(NWRAP_LOG_DEBUG,
2950                           "user[%s] does not match [%s]",
2951                           name,
2952                           nwrap_pw_global.list[i].pw_name);
2953         }
2954
2955         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] not found\n", name);
2956
2957         errno = ENOENT;
2958         return NULL;
2959 }
2960
2961 static int nwrap_files_getpwnam_r(struct nwrap_backend *b,
2962                                   const char *name, struct passwd *pwdst,
2963                                   char *buf, size_t buflen, struct passwd **pwdstp)
2964 {
2965         struct passwd *pw;
2966
2967         pw = nwrap_files_getpwnam(b, name);
2968         if (!pw) {
2969                 if (errno == 0) {
2970                         return ENOENT;
2971                 }
2972                 return errno;
2973         }
2974
2975         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
2976 }
2977
2978 static struct passwd *nwrap_files_getpwuid(struct nwrap_backend *b,
2979                                            uid_t uid)
2980 {
2981         int i;
2982         bool ok;
2983
2984         (void) b; /* unused */
2985
2986         ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
2987         if (!ok) {
2988                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
2989                 return NULL;
2990         }
2991
2992         for (i=0; i<nwrap_pw_global.num; i++) {
2993                 if (nwrap_pw_global.list[i].pw_uid == uid) {
2994                         NWRAP_LOG(NWRAP_LOG_DEBUG, "uid[%u] found", uid);
2995                         return &nwrap_pw_global.list[i];
2996                 }
2997                 NWRAP_LOG(NWRAP_LOG_DEBUG,
2998                           "uid[%u] does not match [%u]",
2999                           uid,
3000                           nwrap_pw_global.list[i].pw_uid);
3001         }
3002
3003         NWRAP_LOG(NWRAP_LOG_DEBUG, "uid[%u] not found\n", uid);
3004
3005         errno = ENOENT;
3006         return NULL;
3007 }
3008
3009 static int nwrap_files_getpwuid_r(struct nwrap_backend *b,
3010                                   uid_t uid, struct passwd *pwdst,
3011                                   char *buf, size_t buflen, struct passwd **pwdstp)
3012 {
3013         struct passwd *pw;
3014
3015         pw = nwrap_files_getpwuid(b, uid);
3016         if (!pw) {
3017                 if (errno == 0) {
3018                         return ENOENT;
3019                 }
3020                 return errno;
3021         }
3022
3023         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
3024 }
3025
3026 /* user enum functions */
3027 static void nwrap_files_setpwent(struct nwrap_backend *b)
3028 {
3029         (void) b; /* unused */
3030
3031         nwrap_pw_global.idx = 0;
3032 }
3033
3034 static struct passwd *nwrap_files_getpwent(struct nwrap_backend *b)
3035 {
3036         struct passwd *pw;
3037
3038         (void) b; /* unused */
3039
3040         if (nwrap_pw_global.idx == 0) {
3041                 bool ok;
3042                 ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
3043                 if (!ok) {
3044                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
3045                         return NULL;
3046                 }
3047         }
3048
3049         if (nwrap_pw_global.idx >= nwrap_pw_global.num) {
3050                 errno = ENOENT;
3051                 return NULL;
3052         }
3053
3054         pw = &nwrap_pw_global.list[nwrap_pw_global.idx++];
3055
3056         NWRAP_LOG(NWRAP_LOG_DEBUG,
3057                   "return user[%s] uid[%u]",
3058                   pw->pw_name, pw->pw_uid);
3059
3060         return pw;
3061 }
3062
3063 static int nwrap_files_getpwent_r(struct nwrap_backend *b,
3064                                   struct passwd *pwdst, char *buf,
3065                                   size_t buflen, struct passwd **pwdstp)
3066 {
3067         struct passwd *pw;
3068
3069         pw = nwrap_files_getpwent(b);
3070         if (!pw) {
3071                 if (errno == 0) {
3072                         return ENOENT;
3073                 }
3074                 return errno;
3075         }
3076
3077         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
3078 }
3079
3080 static void nwrap_files_endpwent(struct nwrap_backend *b)
3081 {
3082         (void) b; /* unused */
3083
3084         nwrap_pw_global.idx = 0;
3085 }
3086
3087 /* shadow */
3088
3089 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
3090
3091 #ifdef HAVE_SETSPENT
3092 static void nwrap_files_setspent(void)
3093 {
3094         nwrap_sp_global.idx = 0;
3095 }
3096
3097 static struct spwd *nwrap_files_getspent(void)
3098 {
3099         struct spwd *sp;
3100
3101         if (nwrap_sp_global.idx == 0) {
3102                 bool ok;
3103
3104                 ok = nwrap_files_cache_reload(nwrap_sp_global.cache);
3105                 if (!ok) {
3106                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading shadow file");
3107                         return NULL;
3108                 }
3109         }
3110
3111         if (nwrap_sp_global.idx >= nwrap_sp_global.num) {
3112                 errno = ENOENT;
3113                 return NULL;
3114         }
3115
3116         sp = &nwrap_sp_global.list[nwrap_sp_global.idx++];
3117
3118         NWRAP_LOG(NWRAP_LOG_DEBUG,
3119                   "return user[%s]",
3120                   sp->sp_namp);
3121
3122         return sp;
3123 }
3124
3125 static void nwrap_files_endspent(void)
3126 {
3127         nwrap_sp_global.idx = 0;
3128 }
3129 #endif /* HAVE_SETSPENT */
3130
3131 static struct spwd *nwrap_files_getspnam(const char *name)
3132 {
3133         int i;
3134         bool ok;
3135
3136         NWRAP_LOG(NWRAP_LOG_DEBUG, "Lookup user %s in files", name);
3137
3138         ok = nwrap_files_cache_reload(nwrap_sp_global.cache);
3139         if (!ok) {
3140                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading shadow file");
3141                 return NULL;
3142         }
3143
3144         for (i=0; i<nwrap_sp_global.num; i++) {
3145                 if (strcmp(nwrap_sp_global.list[i].sp_namp, name) == 0) {
3146                         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] found", name);
3147                         return &nwrap_sp_global.list[i];
3148                 }
3149                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3150                           "user[%s] does not match [%s]",
3151                           name,
3152                           nwrap_sp_global.list[i].sp_namp);
3153         }
3154
3155         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] not found\n", name);
3156
3157         errno = ENOENT;
3158         return NULL;
3159 }
3160 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
3161
3162 /* misc functions */
3163 static int nwrap_files_initgroups(struct nwrap_backend *b,
3164                                   const char *user,
3165                                   gid_t group)
3166 {
3167         struct group *grp;
3168         gid_t *groups;
3169         int size = 1;
3170         int rc;
3171
3172         groups = (gid_t *)malloc(size * sizeof(gid_t));
3173         if (groups == NULL) {
3174                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
3175                 errno = ENOMEM;
3176                 return -1;
3177         }
3178         groups[0] = group;
3179
3180         nwrap_files_setgrent(b);
3181         while ((grp = nwrap_files_getgrent(b)) != NULL) {
3182                 int i = 0;
3183
3184                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3185                           "Inspecting %s for group membership",
3186                           grp->gr_name);
3187
3188                 for (i=0; grp->gr_mem && grp->gr_mem[i] != NULL; i++) {
3189                         if (group != grp->gr_gid &&
3190                             (strcmp(user, grp->gr_mem[i]) == 0)) {
3191                                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3192                                           "%s is member of %s",
3193                                           user,
3194                                           grp->gr_name);
3195
3196                                 groups = (gid_t *)realloc(groups,
3197                                                           (size + 1) * sizeof(gid_t));
3198                                 if (groups == NULL) {
3199                                         NWRAP_LOG(NWRAP_LOG_ERROR,
3200                                                   "Out of memory");
3201                                         errno = ENOMEM;
3202                                         return -1;
3203                                 }
3204
3205                                 groups[size] = grp->gr_gid;
3206                                 size++;
3207                         }
3208                 }
3209         }
3210
3211         nwrap_files_endgrent(b);
3212
3213         NWRAP_LOG(NWRAP_LOG_DEBUG,
3214                   "%s is member of %d groups",
3215                   user, size);
3216
3217         /* This really only works if uid_wrapper is loaded */
3218         rc = setgroups(size, groups);
3219
3220         free(groups);
3221
3222         return rc;
3223 }
3224
3225 /* group functions */
3226 static struct group *nwrap_files_getgrnam(struct nwrap_backend *b,
3227                                           const char *name)
3228 {
3229         int i;
3230         bool ok;
3231
3232         (void) b; /* unused */
3233
3234         ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3235         if (!ok) {
3236                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3237                 return NULL;
3238         }
3239
3240         for (i=0; i<nwrap_gr_global.num; i++) {
3241                 if (strcmp(nwrap_gr_global.list[i].gr_name, name) == 0) {
3242                         NWRAP_LOG(NWRAP_LOG_DEBUG, "group[%s] found", name);
3243                         return &nwrap_gr_global.list[i];
3244                 }
3245                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3246                           "group[%s] does not match [%s]",
3247                           name,
3248                           nwrap_gr_global.list[i].gr_name);
3249         }
3250
3251         NWRAP_LOG(NWRAP_LOG_DEBUG, "group[%s] not found", name);
3252
3253         errno = ENOENT;
3254         return NULL;
3255 }
3256
3257 static int nwrap_files_getgrnam_r(struct nwrap_backend *b,
3258                                   const char *name, struct group *grdst,
3259                                   char *buf, size_t buflen, struct group **grdstp)
3260 {
3261         struct group *gr;
3262
3263         gr = nwrap_files_getgrnam(b, name);
3264         if (!gr) {
3265                 if (errno == 0) {
3266                         return ENOENT;
3267                 }
3268                 return errno;
3269         }
3270
3271         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3272 }
3273
3274 static struct group *nwrap_files_getgrgid(struct nwrap_backend *b,
3275                                           gid_t gid)
3276 {
3277         int i;
3278         bool ok;
3279
3280         (void) b; /* unused */
3281
3282         ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3283         if (!ok) {
3284                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3285                 return NULL;
3286         }
3287
3288         for (i=0; i<nwrap_gr_global.num; i++) {
3289                 if (nwrap_gr_global.list[i].gr_gid == gid) {
3290                         NWRAP_LOG(NWRAP_LOG_DEBUG, "gid[%u] found", gid);
3291                         return &nwrap_gr_global.list[i];
3292                 }
3293                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3294                           "gid[%u] does not match [%u]",
3295                           gid,
3296                           nwrap_gr_global.list[i].gr_gid);
3297         }
3298
3299         NWRAP_LOG(NWRAP_LOG_DEBUG, "gid[%u] not found", gid);
3300
3301         errno = ENOENT;
3302         return NULL;
3303 }
3304
3305 static int nwrap_files_getgrgid_r(struct nwrap_backend *b,
3306                                   gid_t gid, struct group *grdst,
3307                                   char *buf, size_t buflen, struct group **grdstp)
3308 {
3309         struct group *gr;
3310
3311         gr = nwrap_files_getgrgid(b, gid);
3312         if (!gr) {
3313                 if (errno == 0) {
3314                         return ENOENT;
3315                 }
3316                 return errno;
3317         }
3318
3319         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3320 }
3321
3322 /* group enum functions */
3323 static void nwrap_files_setgrent(struct nwrap_backend *b)
3324 {
3325         (void) b; /* unused */
3326
3327         nwrap_gr_global.idx = 0;
3328 }
3329
3330 static struct group *nwrap_files_getgrent(struct nwrap_backend *b)
3331 {
3332         struct group *gr;
3333
3334         (void) b; /* unused */
3335
3336         if (nwrap_gr_global.idx == 0) {
3337                 bool ok;
3338
3339                 ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3340                 if (!ok) {
3341                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3342                         return NULL;
3343                 }
3344         }
3345
3346         if (nwrap_gr_global.idx >= nwrap_gr_global.num) {
3347                 errno = ENOENT;
3348                 return NULL;
3349         }
3350
3351         gr = &nwrap_gr_global.list[nwrap_gr_global.idx++];
3352
3353         NWRAP_LOG(NWRAP_LOG_DEBUG,
3354                   "return group[%s] gid[%u]",
3355                   gr->gr_name, gr->gr_gid);
3356
3357         return gr;
3358 }
3359
3360 static int nwrap_files_getgrent_r(struct nwrap_backend *b,
3361                                   struct group *grdst, char *buf,
3362                                   size_t buflen, struct group **grdstp)
3363 {
3364         struct group *gr;
3365
3366         gr = nwrap_files_getgrent(b);
3367         if (!gr) {
3368                 if (errno == 0) {
3369                         return ENOENT;
3370                 }
3371                 return errno;
3372         }
3373
3374         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3375 }
3376
3377 static void nwrap_files_endgrent(struct nwrap_backend *b)
3378 {
3379         (void) b; /* unused */
3380
3381         nwrap_gr_global.idx = 0;
3382 }
3383
3384 /* hosts functions */
3385 static int nwrap_files_gethostbyname(const char *name, int af,
3386                                      struct hostent *result,
3387                                      struct nwrap_vector *addr_list)
3388 {
3389         struct nwrap_entlist *el;
3390         struct hostent *he;
3391         char *h_name_lower;
3392         ENTRY e;
3393         ENTRY *e_p;
3394         char canon_name[DNS_NAME_MAX] = { 0 };
3395         size_t name_len;
3396         bool he_found = false;
3397         bool ok;
3398
3399         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3400         if (!ok) {
3401                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3402                 goto no_ent;
3403         }
3404
3405         name_len = strlen(name);
3406         if (name_len < sizeof(canon_name) && name[name_len - 1] == '.') {
3407                 strncpy(canon_name, name, name_len - 1);
3408                 name = canon_name;
3409         }
3410
3411         if (!str_tolower_copy(&h_name_lower, name)) {
3412                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3413                           "Out of memory while converting to lower case");
3414                 goto no_ent;
3415         }
3416
3417         /* Look at hash table for element */
3418         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching for name: %s", h_name_lower);
3419         e.key = h_name_lower;
3420         e.data = NULL;
3421         e_p = hsearch(e, FIND);
3422         if (e_p == NULL) {
3423                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found.", h_name_lower);
3424                 SAFE_FREE(h_name_lower);
3425                 goto no_ent;
3426         }
3427         SAFE_FREE(h_name_lower);
3428
3429         /* Always cleanup vector and results */
3430         if (!nwrap_vector_is_initialized(addr_list)) {
3431                 if (!nwrap_vector_init(addr_list)) {
3432                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3433                                   "Unable to initialize memory for addr_list vector");
3434                         goto no_ent;
3435                 }
3436         } else {
3437                 /* When vector is initialized data are valid no more.
3438                  * Quick way how to free vector is: */
3439                 addr_list->count = 0;
3440         }
3441
3442         /* Iterate through results */
3443         for (el = (struct nwrap_entlist *)e_p->data; el != NULL; el = el->next)
3444         {
3445                 he = &(el->ed->ht);
3446
3447                 /* Filter by address familiy if provided */
3448                 if (af != AF_UNSPEC && he->h_addrtype != af) {
3449                         continue;
3450                 }
3451
3452                 /*
3453                  * GLIBC HACK?
3454                  * glibc doesn't return ipv6 addresses when AF_UNSPEC is used
3455                  */
3456                 if (af == AF_UNSPEC && he->h_addrtype != AF_INET) {
3457                         continue;
3458                 }
3459
3460                 if (!he_found) {
3461                         memcpy(result, he, sizeof(struct hostent));
3462                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3463                                   "Name found. Returning record for %s",
3464                                   he->h_name);
3465                         he_found = true;
3466                 }
3467                 nwrap_vector_merge(addr_list, &el->ed->nwrap_addrdata);
3468                 result->h_addr_list = nwrap_vector_head(addr_list);
3469         }
3470
3471         if (he_found) {
3472                 return 0;
3473         }
3474         NWRAP_LOG(NWRAP_LOG_DEBUG,
3475                   "Name found in database. No records matches type.");
3476
3477 no_ent:
3478         errno = ENOENT;
3479         return -1;
3480 }
3481
3482 #ifdef HAVE_GETHOSTBYNAME_R
3483 static int nwrap_gethostbyname_r(const char *name,
3484                                  struct hostent *ret,
3485                                  char *buf, size_t buflen,
3486                                  struct hostent **result, int *h_errnop)
3487 {
3488         struct nwrap_vector *addr_list = malloc(sizeof(struct nwrap_vector));
3489         int rc;
3490
3491         if (addr_list == NULL) {
3492                 NWRAP_LOG(NWRAP_LOG_ERROR,
3493                           "Unable to allocate memory for address list");
3494                 errno = ENOENT;
3495                 return -1;
3496         }
3497
3498         ZERO_STRUCTP(addr_list);
3499
3500         rc = nwrap_files_gethostbyname(name, AF_UNSPEC, ret, addr_list);
3501         if (rc == -1) {
3502                 *h_errnop = h_errno;
3503                 if (addr_list->items != NULL) {
3504                         free(addr_list->items);
3505                 }
3506                 SAFE_FREE(addr_list);
3507                 errno = ENOENT;
3508                 return -1;
3509         }
3510
3511         if (buflen < (addr_list->count * sizeof(void *))) {
3512                 SAFE_FREE(addr_list->items);
3513                 SAFE_FREE(addr_list);
3514                 return ERANGE;
3515         }
3516
3517         /* Copy all to user provided buffer and change
3518          * pointers in returned structure.
3519          * +1 is for ending NULL pointer. */
3520         memcpy(buf, addr_list->items, (addr_list->count + 1) * sizeof(void *));
3521
3522         free(addr_list->items);
3523         free(addr_list);
3524
3525         ret->h_addr_list = (char **)buf;
3526         *result = ret;
3527         return 0;
3528 }
3529
3530 int gethostbyname_r(const char *name,
3531                     struct hostent *ret,
3532                     char *buf, size_t buflen,
3533                     struct hostent **result, int *h_errnop)
3534 {
3535         if (!nss_wrapper_hosts_enabled()) {
3536                 return libc_gethostbyname_r(name,
3537                                             ret,
3538                                             buf,
3539                                             buflen,
3540                                             result,
3541                                             h_errnop);
3542         }
3543
3544         return nwrap_gethostbyname_r(name, ret, buf, buflen, result, h_errnop);
3545 }
3546 #endif
3547
3548 static int nwrap_files_getaddrinfo(const char *name,
3549                                    unsigned short port,
3550                                    const struct addrinfo *hints,
3551                                    struct addrinfo **ai,
3552                                    struct addrinfo **ai_tail)
3553 {
3554         struct nwrap_entlist *el;
3555         struct hostent *he;
3556         struct addrinfo *_ai = NULL;
3557         struct addrinfo *ai_head = NULL;
3558         struct addrinfo *ai_prev = NULL;
3559         char *h_name_lower;
3560         size_t name_len;
3561         char canon_name[DNS_NAME_MAX] = { 0 };
3562         bool skip_canonname = false;
3563         ENTRY e = { 0 };
3564         ENTRY *e_p = NULL;
3565         int rc;
3566         bool ok;
3567
3568         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3569         if (!ok) {
3570                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3571                 return EAI_SYSTEM;
3572         }
3573
3574         name_len = strlen(name);
3575         if (name_len < DNS_NAME_MAX && name[name_len - 1] == '.') {
3576                 strncpy(canon_name, name, name_len - 1);
3577                 name = canon_name;
3578         }
3579
3580         if (!str_tolower_copy(&h_name_lower, name)) {
3581                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3582                           "Out of memory while converting to lower case");
3583                 return EAI_MEMORY;
3584         }
3585
3586         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching for name: %s", h_name_lower);
3587         e.key = h_name_lower;
3588         e.data = NULL;
3589         e_p = hsearch(e, FIND);
3590         if (e_p == NULL) {
3591                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found.", h_name_lower);
3592                 SAFE_FREE(h_name_lower);
3593                 errno = ENOENT;
3594                 return EAI_NONAME;
3595         }
3596         NWRAP_LOG(NWRAP_LOG_DEBUG, "Name: %s found.", h_name_lower);
3597         SAFE_FREE(h_name_lower);
3598
3599         rc = EAI_NONAME;
3600         for (el = (struct nwrap_entlist *)e_p->data; el != NULL; el = el->next)
3601         {
3602                 int rc2;
3603
3604                 he = &(el->ed->ht);
3605
3606                 if (hints->ai_family != AF_UNSPEC &&
3607                     he->h_addrtype != hints->ai_family)
3608                 {
3609                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3610                                   "Entry found but with wrong AF - "
3611                                   "remembering EAI_ADDRINFO.");
3612                         rc = EAI_ADDRFAMILY;
3613                         continue;
3614                 }
3615
3616                 /* Function allocates memory and returns it in ai. */
3617                 rc2 = nwrap_convert_he_ai(he,
3618                                          port,
3619                                          hints,
3620                                          &_ai,
3621                                          skip_canonname);
3622                 if (rc2 != 0) {
3623                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error converting he to ai");
3624                         return rc2;
3625                 }
3626                 skip_canonname = true;
3627
3628                 if (ai_head == NULL) {
3629                         ai_head = _ai;
3630                 }
3631                 if (ai_prev != NULL) {
3632                         ai_prev->ai_next = _ai;
3633                 }
3634                 ai_prev = _ai;
3635         }
3636
3637         if (ai_head != NULL) {
3638                 rc = 0;
3639         }
3640
3641         *ai = ai_head;
3642         *ai_tail = _ai;
3643
3644         return rc;
3645 }
3646
3647 static struct hostent *nwrap_files_gethostbyaddr(const void *addr,
3648                                                  socklen_t len, int type)
3649 {
3650         struct hostent *he;
3651         char ip[NWRAP_INET_ADDRSTRLEN] = {0};
3652         struct nwrap_entdata *ed;
3653         const char *a;
3654         size_t i;
3655         bool ok;
3656
3657         (void) len; /* unused */
3658
3659         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3660         if (!ok) {
3661                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3662                 return NULL;
3663         }
3664
3665         a = inet_ntop(type, addr, ip, sizeof(ip));
3666         if (a == NULL) {
3667                 errno = EINVAL;
3668                 return NULL;
3669         }
3670
3671         nwrap_vector_foreach(ed, nwrap_he_global.entdata, i)
3672         {
3673                 he = &(ed->ht);
3674                 if (he->h_addrtype != type) {
3675                         continue;
3676                 }
3677
3678                 if (memcmp(addr, he->h_addr_list[0], he->h_length) == 0) {
3679                         return he;
3680                 }
3681         }
3682
3683         errno = ENOENT;
3684         return NULL;
3685 }
3686
3687 #ifdef HAVE_GETHOSTBYADDR_R
3688 static int nwrap_gethostbyaddr_r(const void *addr, socklen_t len, int type,
3689                                  struct hostent *ret,
3690                                  char *buf, size_t buflen,
3691                                  struct hostent **result, int *h_errnop)
3692 {
3693         *result = nwrap_files_gethostbyaddr(addr, len, type);
3694         if (*result != NULL) {
3695                 memset(buf, '\0', buflen);
3696                 *ret = **result;
3697                 return 0;
3698         } else {
3699                 *h_errnop = h_errno;
3700                 return -1;
3701         }
3702 }
3703
3704 int gethostbyaddr_r(const void *addr, socklen_t len, int type,
3705                     struct hostent *ret,
3706                     char *buf, size_t buflen,
3707                     struct hostent **result, int *h_errnop)
3708 {
3709         if (!nss_wrapper_hosts_enabled()) {
3710                 return libc_gethostbyaddr_r(addr,
3711                                             len,
3712                                             type,
3713                                             ret,
3714                                             buf,
3715                                             buflen,
3716                                             result,
3717                                             h_errnop);
3718         }
3719
3720         return nwrap_gethostbyaddr_r(addr, len, type, ret, buf, buflen, result, h_errnop);
3721 }
3722 #endif
3723
3724 /* hosts enum functions */
3725 static void nwrap_files_sethostent(void)
3726 {
3727         nwrap_he_global.idx = 0;
3728 }
3729
3730 static struct hostent *nwrap_files_gethostent(void)
3731 {
3732         struct hostent *he;
3733
3734         if (nwrap_he_global.idx == 0) {
3735                 bool ok;
3736
3737                 ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3738                 if (!ok) {
3739                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading hosts file");
3740                         return NULL;
3741                 }
3742         }
3743
3744         if (nwrap_he_global.idx >= nwrap_he_global.num) {
3745                 errno = ENOENT;
3746                 return NULL;
3747         }
3748
3749         he = &((struct nwrap_entdata *)nwrap_he_global.entdata.items[nwrap_he_global.idx++])->ht;
3750
3751         NWRAP_LOG(NWRAP_LOG_DEBUG, "return hosts[%s]", he->h_name);
3752
3753         return he;
3754 }
3755
3756 static void nwrap_files_endhostent(void)
3757 {
3758         nwrap_he_global.idx = 0;
3759 }
3760
3761 /*
3762  * module backend
3763  */
3764
3765
3766 static struct passwd *nwrap_module_getpwnam(struct nwrap_backend *b,
3767                                             const char *name)
3768 {
3769         static struct passwd pwd;
3770         static char buf[1000];
3771         NSS_STATUS status;
3772
3773         if (!b->fns->_nss_getpwnam_r) {
3774                 return NULL;
3775         }
3776
3777         status = b->fns->_nss_getpwnam_r(name, &pwd, buf, sizeof(buf), &errno);
3778         if (status == NSS_STATUS_NOTFOUND) {
3779                 return NULL;
3780         }
3781         if (status != NSS_STATUS_SUCCESS) {
3782                 return NULL;
3783         }
3784
3785         return &pwd;
3786 }
3787
3788 static int nwrap_module_getpwnam_r(struct nwrap_backend *b,
3789                                    const char *name, struct passwd *pwdst,
3790                                    char *buf, size_t buflen, struct passwd **pwdstp)
3791 {
3792         int ret;
3793
3794         (void) b; /* unused */
3795         (void) pwdst; /* unused */
3796         (void) pwdstp; /* unused */
3797
3798         if (!b->fns->_nss_getpwnam_r) {
3799                 return NSS_STATUS_NOTFOUND;
3800         }
3801
3802         ret = b->fns->_nss_getpwnam_r(name, pwdst, buf, buflen, &errno);
3803         switch (ret) {
3804         case NSS_STATUS_SUCCESS:
3805                 return 0;
3806         case NSS_STATUS_NOTFOUND:
3807                 if (errno != 0) {
3808                         return errno;
3809                 }
3810                 return ENOENT;
3811         case NSS_STATUS_TRYAGAIN:
3812                 if (errno != 0) {
3813                         return errno;
3814                 }
3815                 return ERANGE;
3816         default:
3817                 if (errno != 0) {
3818                         return errno;
3819                 }
3820                 return ret;
3821         }
3822 }
3823
3824 static struct passwd *nwrap_module_getpwuid(struct nwrap_backend *b,
3825                                             uid_t uid)
3826 {
3827         static struct passwd pwd;
3828         static char buf[1000];
3829         NSS_STATUS status;
3830
3831         if (!b->fns->_nss_getpwuid_r) {
3832                 return NULL;
3833         }
3834
3835         status = b->fns->_nss_getpwuid_r(uid, &pwd, buf, sizeof(buf), &errno);
3836         if (status == NSS_STATUS_NOTFOUND) {
3837                 return NULL;
3838         }
3839         if (status != NSS_STATUS_SUCCESS) {
3840                 return NULL;
3841         }
3842         return &pwd;
3843 }
3844
3845 static int nwrap_module_getpwuid_r(struct nwrap_backend *b,
3846                                    uid_t uid, struct passwd *pwdst,
3847                                    char *buf, size_t buflen, struct passwd **pwdstp)
3848 {
3849         int ret;
3850
3851         (void) pwdstp; /* unused */
3852
3853         if (!b->fns->_nss_getpwuid_r) {
3854                 return ENOENT;
3855         }
3856
3857         ret = b->fns->_nss_getpwuid_r(uid, pwdst, buf, buflen, &errno);
3858         switch (ret) {
3859         case NSS_STATUS_SUCCESS:
3860                 return 0;
3861         case NSS_STATUS_NOTFOUND:
3862                 if (errno != 0) {
3863                         return errno;
3864                 }
3865                 return ENOENT;
3866         case NSS_STATUS_TRYAGAIN:
3867                 if (errno != 0) {
3868                         return errno;
3869                 }
3870                 return ERANGE;
3871         default:
3872                 if (errno != 0) {
3873                         return errno;
3874                 }
3875                 return ret;
3876         }
3877 }
3878
3879 static void nwrap_module_setpwent(struct nwrap_backend *b)
3880 {
3881         if (!b->fns->_nss_setpwent) {
3882                 return;
3883         }
3884
3885         b->fns->_nss_setpwent();
3886 }
3887
3888 static struct passwd *nwrap_module_getpwent(struct nwrap_backend *b)
3889 {
3890         static struct passwd pwd;
3891         static char buf[1000];
3892         NSS_STATUS status;
3893
3894         if (!b->fns->_nss_getpwent_r) {
3895                 return NULL;
3896         }
3897
3898         status = b->fns->_nss_getpwent_r(&pwd, buf, sizeof(buf), &errno);
3899         if (status == NSS_STATUS_NOTFOUND) {
3900                 return NULL;
3901         }
3902         if (status != NSS_STATUS_SUCCESS) {
3903                 return NULL;
3904         }
3905         return &pwd;
3906 }
3907
3908 static int nwrap_module_getpwent_r(struct nwrap_backend *b,
3909                                    struct passwd *pwdst, char *buf,
3910                                    size_t buflen, struct passwd **pwdstp)
3911 {
3912         int ret;
3913
3914         (void) pwdstp; /* unused */
3915
3916         if (!b->fns->_nss_getpwent_r) {
3917                 return ENOENT;
3918         }
3919
3920         ret = b->fns->_nss_getpwent_r(pwdst, buf, buflen, &errno);
3921         switch (ret) {
3922         case NSS_STATUS_SUCCESS:
3923                 return 0;
3924         case NSS_STATUS_NOTFOUND:
3925                 if (errno != 0) {
3926                         return errno;
3927                 }
3928                 return ENOENT;
3929         case NSS_STATUS_TRYAGAIN:
3930                 if (errno != 0) {
3931                         return errno;
3932                 }
3933                 return ERANGE;
3934         default:
3935                 if (errno != 0) {
3936                         return errno;
3937                 }
3938                 return ret;
3939         }
3940 }
3941
3942 static void nwrap_module_endpwent(struct nwrap_backend *b)
3943 {
3944         if (!b->fns->_nss_endpwent) {
3945                 return;
3946         }
3947
3948         b->fns->_nss_endpwent();
3949 }
3950
3951 static int nwrap_module_initgroups(struct nwrap_backend *b,
3952                                    const char *user, gid_t group)
3953 {
3954         gid_t *groups;
3955         long int start;
3956         long int size;
3957
3958         if (!b->fns->_nss_initgroups) {
3959                 return NSS_STATUS_UNAVAIL;
3960         }
3961
3962         return b->fns->_nss_initgroups(user, group, &start, &size, &groups, 0, &errno);
3963 }
3964
3965 static struct group *nwrap_module_getgrnam(struct nwrap_backend *b,
3966                                            const char *name)
3967 {
3968         static struct group grp;
3969         static char *buf;
3970         static int buflen = 1000;
3971         NSS_STATUS status;
3972
3973         if (!b->fns->_nss_getgrnam_r) {
3974                 return NULL;
3975         }
3976
3977         if (!buf) {
3978                 buf = (char *)malloc(buflen);
3979         }
3980 again:
3981         status = b->fns->_nss_getgrnam_r(name, &grp, buf, buflen, &errno);
3982         if (status == NSS_STATUS_TRYAGAIN) {
3983                 buflen *= 2;
3984                 buf = (char *)realloc(buf, buflen);
3985                 if (!buf) {
3986                         return NULL;
3987                 }
3988                 goto again;
3989         }
3990         if (status == NSS_STATUS_NOTFOUND) {
3991                 SAFE_FREE(buf);
3992                 return NULL;
3993         }
3994         if (status != NSS_STATUS_SUCCESS) {
3995                 SAFE_FREE(buf);
3996                 return NULL;
3997         }
3998         return &grp;
3999 }
4000
4001 static int nwrap_module_getgrnam_r(struct nwrap_backend *b,
4002                                    const char *name, struct group *grdst,
4003                                    char *buf, size_t buflen, struct group **grdstp)
4004 {
4005         int ret;
4006
4007         (void) grdstp; /* unused */
4008
4009         if (!b->fns->_nss_getgrnam_r) {
4010                 return ENOENT;
4011         }
4012
4013         ret = b->fns->_nss_getgrnam_r(name, grdst, buf, buflen, &errno);
4014         switch (ret) {
4015         case NSS_STATUS_SUCCESS:
4016                 return 0;
4017         case NSS_STATUS_NOTFOUND:
4018                 if (errno != 0) {
4019                         return errno;
4020                 }
4021                 return ENOENT;
4022         case NSS_STATUS_TRYAGAIN:
4023                 if (errno != 0) {
4024                         return errno;
4025                 }
4026                 return ERANGE;
4027         default:
4028                 if (errno != 0) {
4029                         return errno;
4030                 }
4031                 return ret;
4032         }
4033 }
4034
4035 static struct group *nwrap_module_getgrgid(struct nwrap_backend *b,
4036                                            gid_t gid)
4037 {
4038         static struct group grp;
4039         static char *buf;
4040         static int buflen = 1000;
4041         NSS_STATUS status;
4042
4043         if (!b->fns->_nss_getgrgid_r) {
4044                 return NULL;
4045         }
4046
4047         if (!buf) {
4048                 buf = (char *)malloc(buflen);
4049         }
4050
4051 again:
4052         status = b->fns->_nss_getgrgid_r(gid, &grp, buf, buflen, &errno);
4053         if (status == NSS_STATUS_TRYAGAIN) {
4054                 buflen *= 2;
4055                 buf = (char *)realloc(buf, buflen);
4056                 if (!buf) {
4057                         return NULL;
4058                 }
4059                 goto again;
4060         }
4061         if (status == NSS_STATUS_NOTFOUND) {
4062                 SAFE_FREE(buf);
4063                 return NULL;
4064         }
4065         if (status != NSS_STATUS_SUCCESS) {
4066                 SAFE_FREE(buf);
4067                 return NULL;
4068         }
4069         return &grp;
4070 }
4071
4072 static int nwrap_module_getgrgid_r(struct nwrap_backend *b,
4073                                    gid_t gid, struct group *grdst,
4074                                    char *buf, size_t buflen, struct group **grdstp)
4075 {
4076         int ret;
4077
4078         (void) grdstp; /* unused */
4079
4080         if (!b->fns->_nss_getgrgid_r) {
4081                 return ENOENT;
4082         }
4083
4084         ret = b->fns->_nss_getgrgid_r(gid, grdst, buf, buflen, &errno);
4085         switch (ret) {
4086         case NSS_STATUS_SUCCESS:
4087                 return 0;
4088         case NSS_STATUS_NOTFOUND:
4089                 if (errno != 0) {
4090                         return errno;
4091                 }
4092                 return ENOENT;
4093         case NSS_STATUS_TRYAGAIN:
4094                 if (errno != 0) {
4095                         return errno;
4096                 }
4097                 return ERANGE;
4098         default:
4099                 if (errno != 0) {
4100                         return errno;
4101                 }
4102                 return ret;
4103         }
4104 }
4105
4106 static void nwrap_module_setgrent(struct nwrap_backend *b)
4107 {
4108         if (!b->fns->_nss_setgrent) {
4109                 return;
4110         }
4111
4112         b->fns->_nss_setgrent();
4113 }
4114
4115 static struct group *nwrap_module_getgrent(struct nwrap_backend *b)
4116 {
4117         static struct group grp;
4118         static char *buf;
4119         static int buflen = 1024;
4120         NSS_STATUS status;
4121
4122         if (!b->fns->_nss_getgrent_r) {
4123                 return NULL;
4124         }
4125
4126         if (!buf) {
4127                 buf = (char *)malloc(buflen);
4128         }
4129
4130 again:
4131         status = b->fns->_nss_getgrent_r(&grp, buf, buflen, &errno);
4132         if (status == NSS_STATUS_TRYAGAIN) {
4133                 buflen *= 2;
4134                 buf = (char *)realloc(buf, buflen);
4135                 if (!buf) {
4136                         return NULL;
4137                 }
4138                 goto again;
4139         }
4140         if (status == NSS_STATUS_NOTFOUND) {
4141                 SAFE_FREE(buf);
4142                 return NULL;
4143         }
4144         if (status != NSS_STATUS_SUCCESS) {
4145                 SAFE_FREE(buf);
4146                 return NULL;
4147         }
4148         return &grp;
4149 }
4150
4151 static int nwrap_module_getgrent_r(struct nwrap_backend *b,
4152                                    struct group *grdst, char *buf,
4153                                    size_t buflen, struct group **grdstp)
4154 {
4155         int ret;
4156
4157         (void) grdstp; /* unused */
4158
4159         if (!b->fns->_nss_getgrent_r) {
4160                 return ENOENT;
4161         }
4162
4163         ret = b->fns->_nss_getgrent_r(grdst, buf, buflen, &errno);
4164         switch (ret) {
4165         case NSS_STATUS_SUCCESS:
4166                 return 0;
4167         case NSS_STATUS_NOTFOUND:
4168                 if (errno != 0) {
4169                         return errno;
4170                 }
4171                 return ENOENT;
4172         case NSS_STATUS_TRYAGAIN:
4173                 if (errno != 0) {
4174                         return errno;
4175                 }
4176                 return ERANGE;
4177         default:
4178                 if (errno != 0) {
4179                         return errno;
4180                 }
4181                 return ret;
4182         }
4183 }
4184
4185 static void nwrap_module_endgrent(struct nwrap_backend *b)
4186 {
4187         if (!b->fns->_nss_endgrent) {
4188                 return;
4189         }
4190
4191         b->fns->_nss_endgrent();
4192 }
4193
4194 /****************************************************************************
4195  *   GETPWNAM
4196  ***************************************************************************/
4197
4198 static struct passwd *nwrap_getpwnam(const char *name)
4199 {
4200         int i;
4201         struct passwd *pwd;
4202
4203         for (i=0; i < nwrap_main_global->num_backends; i++) {
4204                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4205                 pwd = b->ops->nw_getpwnam(b, name);
4206                 if (pwd) {
4207                         return pwd;
4208                 }
4209         }
4210
4211         return NULL;
4212 }
4213
4214 struct passwd *getpwnam(const char *name)
4215 {
4216         if (!nss_wrapper_enabled()) {
4217                 return libc_getpwnam(name);
4218         }
4219
4220         return nwrap_getpwnam(name);
4221 }
4222
4223 /****************************************************************************
4224  *   GETPWNAM_R
4225  ***************************************************************************/
4226
4227 static int nwrap_getpwnam_r(const char *name, struct passwd *pwdst,
4228                             char *buf, size_t buflen, struct passwd **pwdstp)
4229 {
4230         int i,ret;
4231
4232         for (i=0; i < nwrap_main_global->num_backends; i++) {
4233                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4234                 ret = b->ops->nw_getpwnam_r(b, name, pwdst, buf, buflen, pwdstp);
4235                 if (ret == ENOENT) {
4236                         continue;
4237                 }
4238                 return ret;
4239         }
4240
4241         return ENOENT;
4242 }
4243
4244 #ifdef HAVE_GETPWNAM_R
4245 # ifdef HAVE_SOLARIS_GETPWNAM_R
4246 int getpwnam_r(const char *name, struct passwd *pwdst,
4247                char *buf, int buflen, struct passwd **pwdstp)
4248 # else /* HAVE_SOLARIS_GETPWNAM_R */
4249 int getpwnam_r(const char *name, struct passwd *pwdst,
4250                char *buf, size_t buflen, struct passwd **pwdstp)
4251 # endif /* HAVE_SOLARIS_GETPWNAM_R */
4252 {
4253         if (!nss_wrapper_enabled()) {
4254                 return libc_getpwnam_r(name, pwdst, buf, buflen, pwdstp);
4255         }
4256
4257         return nwrap_getpwnam_r(name, pwdst, buf, buflen, pwdstp);
4258 }
4259 #endif
4260
4261 /****************************************************************************
4262  *   GETPWUID
4263  ***************************************************************************/
4264
4265 static struct passwd *nwrap_getpwuid(uid_t uid)
4266 {
4267         int i;
4268         struct passwd *pwd;
4269
4270         for (i=0; i < nwrap_main_global->num_backends; i++) {
4271                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4272                 pwd = b->ops->nw_getpwuid(b, uid);
4273                 if (pwd) {
4274                         return pwd;
4275                 }
4276         }
4277
4278         return NULL;
4279 }
4280
4281 struct passwd *getpwuid(uid_t uid)
4282 {
4283         if (!nss_wrapper_enabled()) {
4284                 return libc_getpwuid(uid);
4285         }
4286
4287         return nwrap_getpwuid(uid);
4288 }
4289
4290 /****************************************************************************
4291  *   GETPWUID_R
4292  ***************************************************************************/
4293
4294 static int nwrap_getpwuid_r(uid_t uid, struct passwd *pwdst,
4295                             char *buf, size_t buflen, struct passwd **pwdstp)
4296 {
4297         int i,ret;
4298
4299         for (i=0; i < nwrap_main_global->num_backends; i++) {
4300                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4301                 ret = b->ops->nw_getpwuid_r(b, uid, pwdst, buf, buflen, pwdstp);
4302                 if (ret == ENOENT) {
4303                         continue;
4304                 }
4305                 return ret;
4306         }
4307
4308         return ENOENT;
4309 }
4310
4311 #ifdef HAVE_SOLARIS_GETPWUID_R
4312 int getpwuid_r(uid_t uid, struct passwd *pwdst,
4313                char *buf, int buflen, struct passwd **pwdstp)
4314 #else
4315 int getpwuid_r(uid_t uid, struct passwd *pwdst,
4316                char *buf, size_t buflen, struct passwd **pwdstp)
4317 #endif
4318 {
4319         if (!nss_wrapper_enabled()) {
4320                 return libc_getpwuid_r(uid, pwdst, buf, buflen, pwdstp);
4321         }
4322
4323         return nwrap_getpwuid_r(uid, pwdst, buf, buflen, pwdstp);
4324 }
4325
4326 /****************************************************************************
4327  *   SETPWENT
4328  ***************************************************************************/
4329
4330 static void nwrap_setpwent(void)
4331 {
4332         int i;
4333
4334         for (i=0; i < nwrap_main_global->num_backends; i++) {
4335                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4336                 b->ops->nw_setpwent(b);
4337         }
4338 }
4339
4340 void setpwent(void)
4341 {
4342         if (!nss_wrapper_enabled()) {
4343                 libc_setpwent();
4344                 return;
4345         }
4346
4347         nwrap_setpwent();
4348 }
4349
4350 /****************************************************************************
4351  *   GETPWENT
4352  ***************************************************************************/
4353
4354 static struct passwd *nwrap_getpwent(void)
4355 {
4356         int i;
4357         struct passwd *pwd;
4358
4359         for (i=0; i < nwrap_main_global->num_backends; i++) {
4360                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4361                 pwd = b->ops->nw_getpwent(b);
4362                 if (pwd) {
4363                         return pwd;
4364                 }
4365         }
4366
4367         return NULL;
4368 }
4369
4370 struct passwd *getpwent(void)
4371 {
4372         if (!nss_wrapper_enabled()) {
4373                 return libc_getpwent();
4374         }
4375
4376         return nwrap_getpwent();
4377 }
4378
4379 /****************************************************************************
4380  *   GETPWENT_R
4381  ***************************************************************************/
4382
4383 static int nwrap_getpwent_r(struct passwd *pwdst, char *buf,
4384                             size_t buflen, struct passwd **pwdstp)
4385 {
4386         int i,ret;
4387
4388         for (i=0; i < nwrap_main_global->num_backends; i++) {
4389                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4390                 ret = b->ops->nw_getpwent_r(b, pwdst, buf, buflen, pwdstp);
4391                 if (ret == ENOENT) {
4392                         continue;
4393                 }
4394                 return ret;
4395         }
4396
4397         return ENOENT;
4398 }
4399
4400 #ifdef HAVE_SOLARIS_GETPWENT_R
4401 struct passwd *getpwent_r(struct passwd *pwdst, char *buf, int buflen)
4402 {
4403         struct passwd *pwdstp = NULL;
4404         int rc;
4405
4406         if (!nss_wrapper_enabled()) {
4407                 return libc_getpwent_r(pwdst, buf, buflen);
4408         }
4409         rc = nwrap_getpwent_r(pwdst, buf, buflen, &pwdstp);
4410         if (rc < 0) {
4411                 return NULL;
4412         }
4413
4414         return pwdstp;
4415 }
4416 #else /* HAVE_SOLARIS_GETPWENT_R */
4417 int getpwent_r(struct passwd *pwdst, char *buf,
4418                size_t buflen, struct passwd **pwdstp)
4419 {
4420         if (!nss_wrapper_enabled()) {
4421                 return libc_getpwent_r(pwdst, buf, buflen, pwdstp);
4422         }
4423
4424         return nwrap_getpwent_r(pwdst, buf, buflen, pwdstp);
4425 }
4426 #endif /* HAVE_SOLARIS_GETPWENT_R */
4427
4428 /****************************************************************************
4429  *   ENDPWENT
4430  ***************************************************************************/
4431
4432 static void nwrap_endpwent(void)
4433 {
4434         int i;
4435
4436         for (i=0; i < nwrap_main_global->num_backends; i++) {
4437                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4438                 b->ops->nw_endpwent(b);
4439         }
4440 }
4441
4442 void endpwent(void)
4443 {
4444         if (!nss_wrapper_enabled()) {
4445                 libc_endpwent();
4446                 return;
4447         }
4448
4449         nwrap_endpwent();
4450 }
4451
4452 /****************************************************************************
4453  *   INITGROUPS
4454  ***************************************************************************/
4455
4456 static int nwrap_initgroups(const char *user, gid_t group)
4457 {
4458         int i;
4459
4460         for (i=0; i < nwrap_main_global->num_backends; i++) {
4461                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4462                 int rc;
4463
4464                 rc = b->ops->nw_initgroups(b, user, group);
4465                 if (rc == 0) {
4466                         return 0;
4467                 }
4468         }
4469
4470         errno = ENOENT;
4471         return -1;
4472 }
4473
4474 int initgroups(const char *user, gid_t group)
4475 {
4476         if (!nss_wrapper_enabled()) {
4477                 return libc_initgroups(user, group);
4478         }
4479
4480         return nwrap_initgroups(user, group);
4481 }
4482
4483 /****************************************************************************
4484  *   GETGRNAM
4485  ***************************************************************************/
4486
4487 static struct group *nwrap_getgrnam(const char *name)
4488 {
4489         int i;
4490         struct group *grp;
4491
4492         for (i=0; i < nwrap_main_global->num_backends; i++) {
4493                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4494                 grp = b->ops->nw_getgrnam(b, name);
4495                 if (grp) {
4496                         return grp;
4497                 }
4498         }
4499
4500         return NULL;
4501 }
4502
4503 struct group *getgrnam(const char *name)
4504 {
4505         if (!nss_wrapper_enabled()) {
4506                 return libc_getgrnam(name);
4507         }
4508
4509         return nwrap_getgrnam(name);
4510 }
4511
4512 /****************************************************************************
4513  *   GETGRNAM_R
4514  ***************************************************************************/
4515
4516 static int nwrap_getgrnam_r(const char *name, struct group *grdst,
4517                             char *buf, size_t buflen, struct group **grdstp)
4518 {
4519         int i, ret;
4520
4521         for (i=0; i < nwrap_main_global->num_backends; i++) {
4522                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4523                 ret = b->ops->nw_getgrnam_r(b, name, grdst, buf, buflen, grdstp);
4524                 if (ret == ENOENT) {
4525                         continue;
4526                 }
4527                 return ret;
4528         }
4529
4530         return ENOENT;
4531 }
4532
4533 #ifdef HAVE_GETGRNAM_R
4534 # ifdef HAVE_SOLARIS_GETGRNAM_R
4535 int getgrnam_r(const char *name, struct group *grp,
4536                 char *buf, int buflen, struct group **pgrp)
4537 # else /* HAVE_SOLARIS_GETGRNAM_R */
4538 int getgrnam_r(const char *name, struct group *grp,
4539                char *buf, size_t buflen, struct group **pgrp)
4540 # endif /* HAVE_SOLARIS_GETGRNAM_R */
4541 {
4542         if (!nss_wrapper_enabled()) {
4543                 return libc_getgrnam_r(name,
4544                                        grp,
4545                                        buf,
4546                                        buflen,
4547                                        pgrp);
4548         }
4549
4550         return nwrap_getgrnam_r(name, grp, buf, buflen, pgrp);
4551 }
4552 #endif /* HAVE_GETGRNAM_R */
4553
4554 /****************************************************************************
4555  *   GETGRGID
4556  ***************************************************************************/
4557
4558 static struct group *nwrap_getgrgid(gid_t gid)
4559 {
4560         int i;
4561         struct group *grp;
4562
4563         for (i=0; i < nwrap_main_global->num_backends; i++) {
4564                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4565                 grp = b->ops->nw_getgrgid(b, gid);
4566                 if (grp) {
4567                         return grp;
4568                 }
4569         }
4570
4571         return NULL;
4572 }
4573
4574 struct group *getgrgid(gid_t gid)
4575 {
4576         if (!nss_wrapper_enabled()) {
4577                 return libc_getgrgid(gid);
4578         }
4579
4580         return nwrap_getgrgid(gid);
4581 }
4582
4583 /****************************************************************************
4584  *   GETGRGID_R
4585  ***************************************************************************/
4586
4587 static int nwrap_getgrgid_r(gid_t gid, struct group *grdst,
4588                             char *buf, size_t buflen, struct group **grdstp)
4589 {
4590         int i,ret;
4591
4592         for (i=0; i < nwrap_main_global->num_backends; i++) {
4593                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4594                 ret = b->ops->nw_getgrgid_r(b, gid, grdst, buf, buflen, grdstp);
4595                 if (ret == ENOENT) {
4596                         continue;
4597                 }
4598                 return ret;
4599         }
4600
4601         return ENOENT;
4602 }
4603
4604 #ifdef HAVE_GETGRGID_R
4605 # ifdef HAVE_SOLARIS_GETGRGID_R
4606 int getgrgid_r(gid_t gid, struct group *grdst,
4607                char *buf, int buflen, struct group **grdstp)
4608 # else /* HAVE_SOLARIS_GETGRGID_R */
4609 int getgrgid_r(gid_t gid, struct group *grdst,
4610                char *buf, size_t buflen, struct group **grdstp)
4611 # endif /* HAVE_SOLARIS_GETGRGID_R */
4612 {
4613         if (!nss_wrapper_enabled()) {
4614                 return libc_getgrgid_r(gid, grdst, buf, buflen, grdstp);
4615         }
4616
4617         return nwrap_getgrgid_r(gid, grdst, buf, buflen, grdstp);
4618 }
4619 #endif
4620
4621 /****************************************************************************
4622  *   SETGRENT
4623  ***************************************************************************/
4624
4625 static void nwrap_setgrent(void)
4626 {
4627         int i;
4628
4629         for (i=0; i < nwrap_main_global->num_backends; i++) {
4630                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4631                 b->ops->nw_setgrent(b);
4632         }
4633 }
4634
4635 #ifdef HAVE_BSD_SETGRENT
4636 int setgrent(void)
4637 #else
4638 void setgrent(void)
4639 #endif
4640 {
4641         if (!nss_wrapper_enabled()) {
4642                 libc_setgrent();
4643                 goto out;
4644         }
4645
4646         nwrap_setgrent();
4647
4648 out:
4649 #ifdef HAVE_BSD_SETGRENT
4650         return 0;
4651 #else
4652         return;
4653 #endif
4654 }
4655
4656 /****************************************************************************
4657  *   GETGRENT
4658  ***************************************************************************/
4659
4660 static struct group *nwrap_getgrent(void)
4661 {
4662         int i;
4663         struct group *grp;
4664
4665         for (i=0; i < nwrap_main_global->num_backends; i++) {
4666                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4667                 grp = b->ops->nw_getgrent(b);
4668                 if (grp) {
4669                         return grp;
4670                 }
4671         }
4672
4673         return NULL;
4674 }
4675
4676 struct group *getgrent(void)
4677 {
4678         if (!nss_wrapper_enabled()) {
4679                 return libc_getgrent();
4680         }
4681
4682         return nwrap_getgrent();
4683 }
4684
4685 /****************************************************************************
4686  *   GETGRENT_R
4687  ***************************************************************************/
4688
4689 static int nwrap_getgrent_r(struct group *grdst, char *buf,
4690                             size_t buflen, struct group **grdstp)
4691 {
4692         int i,ret;
4693
4694         for (i=0; i < nwrap_main_global->num_backends; i++) {
4695                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4696                 ret = b->ops->nw_getgrent_r(b, grdst, buf, buflen, grdstp);
4697                 if (ret == ENOENT) {
4698                         continue;
4699                 }
4700                 return ret;
4701         }
4702
4703         return ENOENT;
4704 }
4705
4706 #ifdef HAVE_SOLARIS_GETGRENT_R
4707 struct group *getgrent_r(struct group *src, char *buf, int buflen)
4708 {
4709         struct group *grdstp = NULL;
4710         int rc;
4711
4712         if (!nss_wrapper_enabled()) {
4713                 return libc_getgrent_r(src, buf, buflen);
4714         }
4715
4716         rc = nwrap_getgrent_r(src, buf, buflen, &grdstp);
4717         if (rc < 0) {
4718                 return NULL;
4719         }
4720
4721         return grdstp;
4722 }
4723 #else /* HAVE_SOLARIS_GETGRENT_R */
4724 int getgrent_r(struct group *src, char *buf,
4725                size_t buflen, struct group **grdstp)
4726 {
4727         if (!nss_wrapper_enabled()) {
4728                 return libc_getgrent_r(src, buf, buflen, grdstp);
4729         }
4730
4731         return nwrap_getgrent_r(src, buf, buflen, grdstp);
4732 }
4733 #endif /* HAVE_SOLARIS_GETGRENT_R */
4734
4735 /****************************************************************************
4736  *   ENDGRENT
4737  ***************************************************************************/
4738
4739 static void nwrap_endgrent(void)
4740 {
4741         int i;
4742
4743         for (i=0; i < nwrap_main_global->num_backends; i++) {
4744                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4745                 b->ops->nw_endgrent(b);
4746         }
4747 }
4748
4749 void endgrent(void)
4750 {
4751         if (!nss_wrapper_enabled()) {
4752                 libc_endgrent();
4753                 return;
4754         }
4755
4756         nwrap_endgrent();
4757 }
4758
4759 /****************************************************************************
4760  *   GETGROUPLIST
4761  ***************************************************************************/
4762
4763 #ifdef HAVE_GETGROUPLIST
4764 static int nwrap_getgrouplist(const char *user, gid_t group,
4765                               gid_t *groups, int *ngroups)
4766 {
4767         struct group *grp;
4768         gid_t *groups_tmp;
4769         int count = 1;
4770
4771         NWRAP_LOG(NWRAP_LOG_DEBUG, "getgrouplist called for %s", user);
4772
4773         groups_tmp = (gid_t *)malloc(count * sizeof(gid_t));
4774         if (!groups_tmp) {
4775                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
4776                 errno = ENOMEM;
4777                 return -1;
4778         }
4779         groups_tmp[0] = group;
4780
4781         nwrap_setgrent();
4782         while ((grp = nwrap_getgrent()) != NULL) {
4783                 int i = 0;
4784
4785                 NWRAP_LOG(NWRAP_LOG_DEBUG,
4786                           "Inspecting %s for group membership",
4787                           grp->gr_name);
4788
4789                 for (i=0; grp->gr_mem && grp->gr_mem[i] != NULL; i++) {
4790
4791                         if (group != grp->gr_gid &&
4792                             (strcmp(user, grp->gr_mem[i]) == 0)) {
4793
4794                                 NWRAP_LOG(NWRAP_LOG_DEBUG,
4795                                           "%s is member of %s",
4796                                           user,
4797                                           grp->gr_name);
4798
4799                                 groups_tmp = (gid_t *)realloc(groups_tmp, (count + 1) * sizeof(gid_t));
4800                                 if (!groups_tmp) {
4801                                         NWRAP_LOG(NWRAP_LOG_ERROR,
4802                                                   "Out of memory");
4803                                         errno = ENOMEM;
4804                                         return -1;
4805                                 }
4806                                 groups_tmp[count] = grp->gr_gid;
4807
4808                                 count++;
4809                         }
4810                 }
4811         }
4812
4813         nwrap_endgrent();
4814
4815         NWRAP_LOG(NWRAP_LOG_DEBUG,
4816                   "%s is member of %d groups",
4817                   user, *ngroups);
4818
4819         if (*ngroups < count) {
4820                 *ngroups = count;
4821                 free(groups_tmp);
4822                 return -1;
4823         }
4824
4825         *ngroups = count;
4826         memcpy(groups, groups_tmp, count * sizeof(gid_t));
4827         free(groups_tmp);
4828
4829         return count;
4830 }
4831
4832 int getgrouplist(const char *user, gid_t group, gid_t *groups, int *ngroups)
4833 {
4834         if (!nss_wrapper_enabled()) {
4835                 return libc_getgrouplist(user, group, groups, ngroups);
4836         }
4837
4838         return nwrap_getgrouplist(user, group, groups, ngroups);
4839 }
4840 #endif
4841
4842 /**********************************************************
4843  * SHADOW
4844  **********************************************************/
4845
4846 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
4847
4848 #ifdef HAVE_SETSPENT
4849 static void nwrap_setspent(void)
4850 {
4851         nwrap_files_setspent();
4852 }
4853
4854 void setspent(void)
4855 {
4856         if (!nss_wrapper_shadow_enabled()) {
4857                 return;
4858         }
4859
4860         nwrap_setspent();
4861 }
4862
4863 static struct spwd *nwrap_getspent(void)
4864 {
4865         return nwrap_files_getspent();
4866 }
4867
4868 struct spwd *getspent(void)
4869 {
4870         if (!nss_wrapper_shadow_enabled()) {
4871                 return NULL;
4872         }
4873
4874         return nwrap_getspent();
4875 }
4876
4877 static void nwrap_endspent(void)
4878 {
4879         nwrap_files_endspent();
4880 }
4881
4882 void endspent(void)
4883 {
4884         if (!nss_wrapper_shadow_enabled()) {
4885                 return;
4886         }
4887
4888         nwrap_endspent();
4889 }
4890 #endif /* HAVE_SETSPENT */
4891
4892 static struct spwd *nwrap_getspnam(const char *name)
4893 {
4894         return nwrap_files_getspnam(name);
4895 }
4896
4897 struct spwd *getspnam(const char *name)
4898 {
4899         if (!nss_wrapper_shadow_enabled()) {
4900                 return NULL;
4901         }
4902
4903         return nwrap_getspnam(name);
4904 }
4905
4906 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
4907
4908 /**********************************************************
4909  * NETDB
4910  **********************************************************/
4911
4912 static void nwrap_sethostent(int stayopen) {
4913         (void) stayopen; /* ignored */
4914
4915         nwrap_files_sethostent();
4916 }
4917
4918 #ifdef HAVE_SOLARIS_SETHOSTENT
4919 int sethostent(int stayopen)
4920 {
4921         if (!nss_wrapper_hosts_enabled()) {
4922                 libc_sethostent(stayopen);
4923                 return 0;
4924         }
4925
4926         nwrap_sethostent(stayopen);
4927
4928         return 0;
4929 }
4930 #else /* HAVE_SOLARIS_SETHOSTENT */
4931 void sethostent(int stayopen)
4932 {
4933         if (!nss_wrapper_hosts_enabled()) {
4934                 libc_sethostent(stayopen);
4935                 return;
4936         }
4937
4938         nwrap_sethostent(stayopen);
4939 }
4940 #endif /* HAVE_SOLARIS_SETHOSTENT */
4941
4942 static struct hostent *nwrap_gethostent(void)
4943 {
4944         return nwrap_files_gethostent();
4945 }
4946
4947 struct hostent *gethostent(void) {
4948         if (!nss_wrapper_hosts_enabled()) {
4949                 return libc_gethostent();
4950         }
4951
4952         return nwrap_gethostent();
4953 }
4954
4955 static void nwrap_endhostent(void) {
4956         nwrap_files_endhostent();
4957 }
4958
4959 #ifdef HAVE_SOLARIS_ENDHOSTENT
4960 int endhostent(void)
4961 {
4962         if (!nss_wrapper_hosts_enabled()) {
4963                 libc_endhostent();
4964                 return 0;
4965         }
4966
4967         nwrap_endhostent();
4968
4969         return 0;
4970 }
4971 #else /* HAVE_SOLARIS_ENDHOSTENT */
4972 void endhostent(void)
4973 {
4974         if (!nss_wrapper_hosts_enabled()) {
4975                 libc_endhostent();
4976                 return;
4977         }
4978
4979         nwrap_endhostent();
4980 }
4981 #endif /* HAVE_SOLARIS_ENDHOSTENT */
4982
4983 #ifdef BSD
4984 /* BSD implementation stores data in thread local storage but GLIBC does not */
4985 static __thread struct hostent user_he;
4986 static __thread struct nwrap_vector user_addrlist;
4987 #else
4988 static struct hostent user_he;
4989 static struct nwrap_vector user_addrlist;
4990 #endif /* BSD */
4991 static struct hostent *nwrap_gethostbyname(const char *name)
4992 {
4993         if (nwrap_files_gethostbyname(name, AF_UNSPEC, &user_he, &user_addrlist) == -1) {
4994                 return NULL;
4995         }
4996         return &user_he;
4997 }
4998
4999 struct hostent *gethostbyname(const char *name)
5000 {
5001         if (!nss_wrapper_hosts_enabled()) {
5002                 return libc_gethostbyname(name);
5003         }
5004
5005         return nwrap_gethostbyname(name);
5006 }
5007
5008 /* This is a GNU extension - Also can be found on BSD systems */
5009 #ifdef HAVE_GETHOSTBYNAME2
5010 #ifdef BSD
5011 /* BSD implementation stores data in  thread local storage but GLIBC not */
5012 static __thread struct hostent user_he2;
5013 static __thread struct nwrap_vector user_addrlist2;
5014 #else
5015 static struct hostent user_he2;
5016 static struct nwrap_vector user_addrlist2;
5017 #endif /* BSD */
5018 static struct hostent *nwrap_gethostbyname2(const char *name, int af)
5019 {
5020         if (nwrap_files_gethostbyname(name, af, &user_he2, &user_addrlist2) == -1) {
5021                 return NULL;
5022         }
5023         return &user_he2;
5024 }
5025
5026 struct hostent *gethostbyname2(const char *name, int af)
5027 {
5028         if (!nss_wrapper_hosts_enabled()) {
5029                 return libc_gethostbyname2(name, af);
5030         }
5031
5032         return nwrap_gethostbyname2(name, af);
5033 }
5034 #endif
5035
5036 static struct hostent *nwrap_gethostbyaddr(const void *addr,
5037                                            socklen_t len, int type)
5038 {
5039         return nwrap_files_gethostbyaddr(addr, len, type);
5040 }
5041
5042 struct hostent *gethostbyaddr(const void *addr,
5043                               socklen_t len, int type)
5044 {
5045         if (!nss_wrapper_hosts_enabled()) {
5046                 return libc_gethostbyaddr(addr, len, type);
5047         }
5048
5049         return nwrap_gethostbyaddr(addr, len, type);
5050 }
5051
5052 static const struct addrinfo default_hints =
5053 {
5054         .ai_flags = AI_ADDRCONFIG|AI_V4MAPPED,
5055         .ai_family = AF_UNSPEC,
5056         .ai_socktype = 0,
5057         .ai_protocol = 0,
5058         .ai_addrlen = 0,
5059         .ai_addr = NULL,
5060         .ai_canonname = NULL,
5061         .ai_next = NULL
5062 };
5063
5064 static int nwrap_convert_he_ai(const struct hostent *he,
5065                                unsigned short port,
5066                                const struct addrinfo *hints,
5067                                struct addrinfo **pai,
5068                                bool skip_canonname)
5069 {
5070         struct addrinfo *ai;
5071         socklen_t socklen;
5072
5073         if (he == NULL) {
5074                 return EAI_MEMORY;
5075         }
5076
5077         switch (he->h_addrtype) {
5078                 case AF_INET:
5079                         socklen = sizeof(struct sockaddr_in);
5080                         break;
5081 #ifdef HAVE_IPV6
5082                 case AF_INET6:
5083                         socklen = sizeof(struct sockaddr_in6);
5084                         break;
5085 #endif
5086                 default:
5087                         return EAI_FAMILY;
5088         }
5089
5090         ai = (struct addrinfo *)malloc(sizeof(struct addrinfo) + socklen);
5091         if (ai == NULL) {
5092                 return EAI_MEMORY;
5093         }
5094
5095         ai->ai_flags = 0;
5096         ai->ai_family = he->h_addrtype;
5097         ai->ai_socktype = hints->ai_socktype;
5098         ai->ai_protocol = hints->ai_protocol;
5099         ai->ai_canonname = NULL;
5100
5101         ai->ai_addrlen = socklen;
5102         ai->ai_addr = (void *)(ai + 1);
5103
5104 #ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
5105         ai->ai_addr->sa_len = socklen;
5106 #endif
5107         ai->ai_addr->sa_family = he->h_addrtype;
5108
5109         switch (he->h_addrtype) {
5110                 case AF_INET:
5111                 {
5112                         struct sockaddr_in *sinp =
5113                                 (struct sockaddr_in *) ai->ai_addr;
5114
5115                         memset(sinp, 0, sizeof(struct sockaddr_in));
5116
5117                         sinp->sin_port = htons(port);
5118                         sinp->sin_family = AF_INET;
5119
5120                         memset (sinp->sin_zero, '\0', sizeof (sinp->sin_zero));
5121                         memcpy(&sinp->sin_addr, he->h_addr_list[0], he->h_length);
5122
5123                 }
5124                 break;
5125 #ifdef HAVE_IPV6
5126                 case AF_INET6:
5127                 {
5128                         struct sockaddr_in6 *sin6p =
5129                                 (struct sockaddr_in6 *) ai->ai_addr;
5130
5131                         memset(sin6p, 0, sizeof(struct sockaddr_in6));
5132
5133                         sin6p->sin6_port = htons(port);
5134                         sin6p->sin6_family = AF_INET6;
5135
5136                         memcpy(&sin6p->sin6_addr,
5137                                he->h_addr_list[0],
5138                                he->h_length);
5139                 }
5140                 break;
5141 #endif
5142         }
5143
5144         ai->ai_next = NULL;
5145
5146         if (he->h_name && !skip_canonname) {
5147                 ai->ai_canonname = strdup(he->h_name);
5148                 if (ai->ai_canonname == NULL) {
5149                         freeaddrinfo(ai);
5150                         return EAI_MEMORY;
5151                 }
5152         }
5153
5154         *pai = ai;
5155         return 0;
5156 }
5157
5158 static int nwrap_getaddrinfo(const char *node,
5159                              const char *service,
5160                              const struct addrinfo *hints,
5161                              struct addrinfo **res)
5162 {
5163         struct addrinfo *ai = NULL;
5164         struct addrinfo *ai_tail;
5165         unsigned short port = 0;
5166         struct {
5167                 int family;
5168                 union {
5169                         struct in_addr v4;
5170 #ifdef HAVE_IPV6
5171                         struct in6_addr v6;
5172                 } in;
5173 #endif
5174         } addr = {
5175                 .family = AF_UNSPEC,
5176         };
5177         int rc;
5178
5179         if (node == NULL && service == NULL) {
5180                 return EAI_NONAME;
5181         }
5182
5183         if (hints == NULL) {
5184                 hints = &default_hints;
5185         }
5186
5187         /* EAI_BADFLAGS
5188               hints.ai_flags   contains   invalid  flags;  or,  hints.ai_flags
5189               included AI_CANONNAME and name was NULL.
5190         */
5191         if ((hints->ai_flags & AI_CANONNAME) && (node == NULL)) {
5192                 return EAI_BADFLAGS;
5193         }
5194
5195         /* If no node has been specified, let glibc deal with it */
5196         if (node == NULL) {
5197                 int ret;
5198                 struct addrinfo *p = NULL;
5199
5200                 ret = libc_getaddrinfo(node, service, hints, &p);
5201
5202                 if (ret == 0) {
5203                         *res = p;
5204                 }
5205                 return ret;
5206         }
5207
5208         if (service != NULL && service[0] != '\0') {
5209                 const char *proto = NULL;
5210                 struct servent *s;
5211                 char *end_ptr;
5212                 long sl;
5213
5214                 errno = 0;
5215                 sl = strtol(service, &end_ptr, 10);
5216
5217                 if (*end_ptr == '\0') {
5218                         port = sl;
5219                         goto valid_port;
5220                 } else if (hints->ai_flags & AI_NUMERICSERV) {
5221                         return EAI_NONAME;
5222                 }
5223
5224                 if (hints->ai_protocol != 0) {
5225                         struct protoent *pent;
5226
5227                         pent = getprotobynumber(hints->ai_protocol);
5228                         if (pent != NULL) {
5229                                 proto = pent->p_name;
5230                         }
5231                 }
5232
5233                 s = getservbyname(service, proto);
5234                 if (s == NULL) {
5235                         return EAI_NONAME;
5236                 }
5237                 port = ntohs(s->s_port);
5238         }
5239
5240 valid_port:
5241
5242         rc = inet_pton(AF_INET, node, &addr.in.v4);
5243         if (rc == 1) {
5244                 addr.family = AF_INET;
5245         }
5246 #ifdef HAVE_IPV6
5247         if (addr.family == AF_UNSPEC) {
5248                 rc = inet_pton(AF_INET6, node, &addr.in.v6);
5249                 if (rc == 1) {
5250                         addr.family = AF_INET6;
5251                 }
5252         }
5253 #endif
5254
5255         if ((addr.family != AF_UNSPEC) &&
5256             (hints->ai_family != AF_UNSPEC) &&
5257             (hints->ai_family != addr.family))
5258         {
5259                 return EAI_ADDRFAMILY;
5260         }
5261
5262         rc = nwrap_files_getaddrinfo(node, port, hints, &ai, &ai_tail);
5263         if (rc != 0) {
5264                 int ret;
5265                 struct addrinfo *p = NULL;
5266
5267                 ret = libc_getaddrinfo(node, service, hints, &p);
5268
5269                 if (ret == 0) {
5270                         /*
5271                          * nwrap_files_getaddrinfo failed, but libc was
5272                          * successful -- use the result from libc.
5273                          */
5274                         *res = p;
5275                         return 0;
5276                 }
5277
5278                 return rc;
5279         }
5280
5281         if (ai->ai_flags == 0) {
5282                 ai->ai_flags = hints->ai_flags;
5283         }
5284         if (ai->ai_socktype == 0) {
5285                 ai->ai_socktype = SOCK_DGRAM;
5286         }
5287         if (ai->ai_protocol == 0 && ai->ai_socktype == SOCK_DGRAM) {
5288                 ai->ai_protocol = 17; /* UDP */
5289         } else if (ai->ai_protocol == 0 && ai->ai_socktype == SOCK_STREAM) {
5290                 ai->ai_protocol = 6; /* TCP */
5291         }
5292
5293         if (hints->ai_socktype == 0) {
5294                 /* Add second ai */
5295                 struct addrinfo *ai_head = ai;
5296                 struct addrinfo *ai_tmp;
5297                 struct addrinfo *ai_new_tail = ai_tail;
5298
5299                 /* Add at least one more struct */
5300                 do {
5301                         /* CHECKS! */
5302                         ai_tmp = malloc(sizeof(struct addrinfo));
5303                         memcpy(ai_tmp, ai_head, sizeof(struct addrinfo));
5304                         ai_tmp->ai_next = NULL;
5305
5306                         /* We need a deep copy or freeaddrinfo() will blow up */
5307                         if (ai_head->ai_canonname != NULL) {
5308                                 ai_tmp->ai_canonname =
5309                                         strdup(ai_head->ai_canonname);
5310                         }
5311                         /* ai_head should point inside hints. */
5312                         ai_tmp->ai_addr = ai_head->ai_addr;
5313
5314                         if (ai_head->ai_flags == 0) {
5315                                 ai_tmp->ai_flags = hints->ai_flags;
5316                         }
5317                         if (ai_head->ai_socktype == SOCK_DGRAM) {
5318                                 ai_tmp->ai_socktype = SOCK_STREAM;
5319                         } else if (ai_head->ai_socktype == SOCK_STREAM) {
5320                                 ai_tmp->ai_socktype = SOCK_DGRAM;
5321                         }
5322                         if (ai_head->ai_socktype == SOCK_DGRAM) {
5323                                 ai_tmp->ai_protocol = 17; /* UDP */
5324                         } else if (ai_head->ai_socktype == SOCK_STREAM) {
5325                                 ai_tmp->ai_protocol = 6; /* TCP */
5326                         }
5327                         ai_new_tail->ai_next = ai_tmp;
5328                         ai_new_tail = ai_tmp;
5329
5330                         if (ai_head == ai_tail) {
5331                                 break;
5332                         }
5333                         ai_head = ai_head->ai_next;
5334                 } while (1);
5335         }
5336
5337         *res = ai;
5338
5339         return 0;
5340 }
5341
5342 int getaddrinfo(const char *node, const char *service,
5343                 const struct addrinfo *hints,
5344                 struct addrinfo **res)
5345 {
5346         if (!nss_wrapper_hosts_enabled()) {
5347                 return libc_getaddrinfo(node, service, hints, res);
5348         }
5349
5350         return nwrap_getaddrinfo(node, service, hints, res);
5351 }
5352
5353 static int nwrap_getnameinfo(const struct sockaddr *sa, socklen_t salen,
5354                              char *host, size_t hostlen,
5355                              char *serv, size_t servlen,
5356                              int flags)
5357 {
5358         struct hostent *he;
5359         struct servent *service;
5360         const char *proto;
5361         const void *addr;
5362         socklen_t addrlen;
5363         uint16_t port;
5364         sa_family_t type;
5365
5366         if (sa == NULL || salen < sizeof(sa_family_t)) {
5367                 return EAI_FAMILY;
5368         }
5369
5370         if ((flags & NI_NAMEREQD) && host == NULL && serv == NULL) {
5371                 return EAI_NONAME;
5372         }
5373
5374         type = sa->sa_family;
5375         switch (type) {
5376         case AF_INET:
5377                 if (salen < sizeof(struct sockaddr_in))
5378                         return EAI_FAMILY;
5379                 addr = &((const struct sockaddr_in *)sa)->sin_addr;
5380                 addrlen = sizeof(((const struct sockaddr_in *)sa)->sin_addr);
5381                 port = ntohs(((const struct sockaddr_in *)sa)->sin_port);
5382                 break;
5383 #ifdef HAVE_IPV6
5384         case AF_INET6:
5385                 if (salen < sizeof(struct sockaddr_in6))
5386                         return EAI_FAMILY;
5387                 addr = &((const struct sockaddr_in6 *)sa)->sin6_addr;
5388                 addrlen = sizeof(((const struct sockaddr_in6 *)sa)->sin6_addr);
5389                 port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port);
5390                 break;
5391 #endif
5392         default:
5393                 return EAI_FAMILY;
5394         }
5395
5396         if (host != NULL) {
5397                 he = NULL;
5398                 if ((flags & NI_NUMERICHOST) == 0) {
5399                         he = nwrap_files_gethostbyaddr(addr, addrlen, type);
5400                         if ((flags & NI_NAMEREQD) && (he == NULL || he->h_name == NULL))
5401                                 return EAI_NONAME;
5402                 }
5403                 if (he != NULL && he->h_name != NULL) {
5404                         if (strlen(he->h_name) >= hostlen)
5405                                 return EAI_OVERFLOW;
5406                         strcpy(host, he->h_name);
5407                         if (flags & NI_NOFQDN)
5408                                 host[strcspn(host, ".")] = '\0';
5409                 } else {
5410                         if (inet_ntop(type, addr, host, hostlen) == NULL)
5411                                 return (errno == ENOSPC) ? EAI_OVERFLOW : EAI_FAIL;
5412                 }
5413         }
5414
5415         if (serv != NULL) {
5416                 service = NULL;
5417                 if ((flags & NI_NUMERICSERV) == 0) {
5418                         proto = (flags & NI_DGRAM) ? "udp" : "tcp";
5419                         service = getservbyport(htons(port), proto);
5420                 }
5421                 if (service != NULL) {
5422                         if (strlen(service->s_name) >= servlen)
5423                                 return EAI_OVERFLOW;
5424                         strcpy(serv, service->s_name);
5425                 } else {
5426                         if (snprintf(serv, servlen, "%u", port) >= (int) servlen)
5427                                 return EAI_OVERFLOW;
5428                 }
5429         }
5430
5431         return 0;
5432 }
5433
5434 #ifdef HAVE_LINUX_GETNAMEINFO
5435 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5436                 char *host, socklen_t hostlen,
5437                 char *serv, socklen_t servlen,
5438                 int flags)
5439 #elif defined(HAVE_LINUX_GETNAMEINFO_UNSIGNED)
5440 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5441                 char *host, socklen_t hostlen,
5442                 char *serv, socklen_t servlen,
5443                 unsigned int flags)
5444 #else
5445 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5446                 char *host, size_t hostlen,
5447                 char *serv, size_t servlen,
5448                 int flags)
5449 #endif
5450 {
5451         if (!nss_wrapper_hosts_enabled()) {
5452                 return libc_getnameinfo(sa, salen, host, hostlen, serv, servlen, flags);
5453         }
5454
5455         return nwrap_getnameinfo(sa, salen, host, hostlen, serv, servlen, flags);
5456 }
5457
5458 static int nwrap_gethostname(char *name, size_t len)
5459 {
5460         const char *hostname = getenv("NSS_WRAPPER_HOSTNAME");
5461
5462         if (strlen(hostname) >= len) {
5463                 errno = ENAMETOOLONG;
5464                 return -1;
5465         }
5466         snprintf(name, len, "%s", hostname);
5467
5468         return 0;
5469 }
5470
5471 #ifdef HAVE_SOLARIS_GETHOSTNAME
5472 int gethostname(char *name, int len)
5473 #else /* HAVE_SOLARIS_GETHOSTNAME */
5474 int gethostname(char *name, size_t len)
5475 #endif /* HAVE_SOLARIS_GETHOSTNAME */
5476 {
5477         if (!nwrap_hostname_enabled()) {
5478                 return libc_gethostname(name, len);
5479         }
5480
5481         return nwrap_gethostname(name, len);
5482 }
5483
5484 /****************************
5485  * DESTRUCTOR
5486  ***************************/
5487
5488 /*
5489  * This function is called when the library is unloaded and makes sure that
5490  * sockets get closed and the unix file for the socket are unlinked.
5491  */
5492 void nwrap_destructor(void)
5493 {
5494         int i;
5495
5496         NWRAP_LOCK_ALL;
5497         if (nwrap_main_global != NULL) {
5498                 struct nwrap_main *m = nwrap_main_global;
5499
5500                 /* libc */
5501                 SAFE_FREE(m->libc->fns);
5502                 if (m->libc->handle != NULL) {
5503                         dlclose(m->libc->handle);
5504                 }
5505                 if (m->libc->nsl_handle != NULL) {
5506                         dlclose(m->libc->nsl_handle);
5507                 }
5508                 if (m->libc->sock_handle != NULL) {
5509                         dlclose(m->libc->sock_handle);
5510                 }
5511                 SAFE_FREE(m->libc);
5512
5513                 /* backends */
5514                 for (i = 0; i < m->num_backends; i++) {
5515                         struct nwrap_backend *b = &(m->backends[i]);
5516
5517                         if (b->so_handle != NULL) {
5518                                 dlclose(b->so_handle);
5519                         }
5520                         SAFE_FREE(b->fns);
5521                 }
5522                 SAFE_FREE(m->backends);
5523         }
5524
5525         if (nwrap_pw_global.cache != NULL) {
5526                 struct nwrap_cache *c = nwrap_pw_global.cache;
5527
5528                 nwrap_files_cache_unload(c);
5529                 if (c->fd >= 0) {
5530                         fclose(c->fp);
5531                         c->fd = -1;
5532                 }
5533
5534                 SAFE_FREE(nwrap_pw_global.list);
5535                 nwrap_pw_global.num = 0;
5536         }
5537
5538         if (nwrap_gr_global.cache != NULL) {
5539                 struct nwrap_cache *c = nwrap_gr_global.cache;
5540
5541                 nwrap_files_cache_unload(c);
5542                 if (c->fd >= 0) {
5543                         fclose(c->fp);
5544                         c->fd = -1;
5545                 }
5546
5547                 SAFE_FREE(nwrap_gr_global.list);
5548                 nwrap_pw_global.num = 0;
5549         }
5550
5551         if (nwrap_he_global.cache != NULL) {
5552                 struct nwrap_cache *c = nwrap_he_global.cache;
5553
5554                 nwrap_files_cache_unload(c);
5555                 if (c->fd >= 0) {
5556                         fclose(c->fp);
5557                         c->fd = -1;
5558                 }
5559
5560                 nwrap_he_global.num = 0;
5561         }
5562
5563         hdestroy();
5564         NWRAP_UNLOCK_ALL;
5565 }