lib/nss_wrapper/nss_wrapper.c

   1 /*
   2  * Copyright (C) Stefan Metzmacher 2007 <metze@samba.org>
   3  * Copyright (C) Guenther Deschner 2009 <gd@samba.org>
   4  * Copyright (C) Andreas Schneider 2013 <asn@samba.org>
   5  *
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the author nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "config.h"
  37
  38 #include <pthread.h>
  39
  40 #include <sys/types.h>
  41 #include <sys/stat.h>
  42 #include <sys/socket.h>
  43 #include <errno.h>
  44 #include <fcntl.h>
  45 #include <stdarg.h>
  46 #include <stdbool.h>
  47 #include <stddef.h>
  48 #include <stdio.h>
  49 #include <stdint.h>
  50 #include <stdlib.h>
  51 #include <string.h>
  52 #include <unistd.h>
  53 #include <ctype.h>
  54
  55 #include <netinet/in.h>
  56
  57 #include <search.h>
  58 #include <assert.h>
  59
  60 /*
  61  * Defining _POSIX_PTHREAD_SEMANTICS before including pwd.h and grp.h  gives us
  62  * the posix getpwnam_r(), getpwuid_r(), getgrnam_r and getgrgid_r calls on
  63  * Solaris
  64  */
  65 #ifndef _POSIX_PTHREAD_SEMANTICS
  66 #define _POSIX_PTHREAD_SEMANTICS
  67 #endif
  68
  69 #include <pwd.h>
  70 #include <grp.h>
  71 #ifdef HAVE_SHADOW_H
  72 #include <shadow.h>
  73 #endif /* HAVE_SHADOW_H */
  74
  75 #include <netdb.h>
  76 #include <arpa/inet.h>
  77 #include <netinet/in.h>
  78
  79 #include <dlfcn.h>
  80
  81 #if defined(HAVE_NSS_H)
  82 /* Linux and BSD */
  83 #include <nss.h>
  84
  85 typedef enum nss_status NSS_STATUS;
  86 #elif defined(HAVE_NSS_COMMON_H)
  87 /* Solaris */
  88 #include <nss_common.h>
  89 #include <nss_dbdefs.h>
  90 #include <nsswitch.h>
  91
  92 typedef nss_status_t NSS_STATUS;
  93
  94 # define NSS_STATUS_SUCCESS     NSS_SUCCESS
  95 # define NSS_STATUS_NOTFOUND    NSS_NOTFOUND
  96 # define NSS_STATUS_UNAVAIL     NSS_UNAVAIL
  97 # define NSS_STATUS_TRYAGAIN    NSS_TRYAGAIN
  98 #else
  99 # error "No nsswitch support detected"
 100 #endif
 101
 102 #ifndef PTR_DIFF
 103 #define PTR_DIFF(p1, p2) ((ptrdiff_t)(((const char *)(p1)) - (const char *)(p2)))
 104 #endif
 105
 106 #ifndef _PUBLIC_
 107 #define _PUBLIC_
 108 #endif
 109
 110 #ifndef EAI_NODATA
 111 #define EAI_NODATA EAI_NONAME
 112 #endif
 113
 114 #ifndef EAI_ADDRFAMILY
 115 #define EAI_ADDRFAMILY EAI_FAMILY
 116 #endif
 117
 118 #ifndef __STRING
 119 #define __STRING(x)    #x
 120 #endif
 121
 122 #ifndef __STRINGSTRING
 123 #define __STRINGSTRING(x) __STRING(x)
 124 #endif
 125
 126 #ifndef __LINESTR__
 127 #define __LINESTR__ __STRINGSTRING(__LINE__)
 128 #endif
 129
 130 #ifndef __location__
 131 #define __location__ __FILE__ ":" __LINESTR__
 132 #endif
 133
 134 #ifndef DNS_NAME_MAX
 135 #define DNS_NAME_MAX 255
 136 #endif
 137
 138 /* GCC have printf type attribute check. */
 139 #ifdef HAVE_ATTRIBUTE_PRINTF_FORMAT
 140 #define PRINTF_ATTRIBUTE(a,b) __attribute__ ((__format__ (__printf__, a, b)))
 141 #else
 142 #define PRINTF_ATTRIBUTE(a,b)
 143 #endif /* HAVE_ATTRIBUTE_PRINTF_FORMAT */
 144
 145 #ifdef HAVE_DESTRUCTOR_ATTRIBUTE
 146 #define DESTRUCTOR_ATTRIBUTE __attribute__ ((destructor))
 147 #else
 148 #define DESTRUCTOR_ATTRIBUTE
 149 #endif /* HAVE_DESTRUCTOR_ATTRIBUTE */
 150
 151 #define ZERO_STRUCTP(x) do { if ((x) != NULL) memset((char *)(x), 0, sizeof(*(x))); } while(0)
 152
 153 #ifndef SAFE_FREE
 154 #define SAFE_FREE(x) do { if ((x) != NULL) {free(x); (x)=NULL;} } while(0)
 155 #endif
 156
 157 #ifdef HAVE_IPV6
 158 #define NWRAP_INET_ADDRSTRLEN INET6_ADDRSTRLEN
 159 #else
 160 #define NWRAP_INET_ADDRSTRLEN INET_ADDRSTRLEN
 161 #endif
 162
 163 #define NWRAP_LOCK(m) do { \
 164         pthread_mutex_lock(&( m ## _mutex)); \
 165 } while(0)
 166
 167 #define NWRAP_UNLOCK(m) do { \
 168         pthread_mutex_unlock(&( m ## _mutex)); \
 169 } while(0)
 170
 171
 172 static bool nwrap_initialized = false;
 173 static pthread_mutex_t nwrap_initialized_mutex = PTHREAD_MUTEX_INITIALIZER;
 174
 175 /* The mutex or accessing the id */
 176 static pthread_mutex_t nwrap_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 177 static pthread_mutex_t nwrap_gr_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 178 static pthread_mutex_t nwrap_he_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 179 static pthread_mutex_t nwrap_pw_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 180 static pthread_mutex_t nwrap_sp_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 181
 182 /* Add new global locks here please */
 183 /* Also don't forget to add locks to
 184  * nwrap_init() function.
 185  */
 186 # define NWRAP_LOCK_ALL do { \
 187         NWRAP_LOCK(nwrap_initialized); \
 188         NWRAP_LOCK(nwrap_global); \
 189         NWRAP_LOCK(nwrap_gr_global); \
 190         NWRAP_LOCK(nwrap_he_global); \
 191         NWRAP_LOCK(nwrap_pw_global); \
 192         NWRAP_LOCK(nwrap_sp_global); \
 193 } while (0);
 194
 195 # define NWRAP_UNLOCK_ALL do {\
 196         NWRAP_UNLOCK(nwrap_sp_global); \
 197         NWRAP_UNLOCK(nwrap_pw_global); \
 198         NWRAP_UNLOCK(nwrap_he_global); \
 199         NWRAP_UNLOCK(nwrap_gr_global); \
 200         NWRAP_UNLOCK(nwrap_global); \
 201         NWRAP_UNLOCK(nwrap_initialized); \
 202 } while (0);
 203
 204 static void nwrap_thread_prepare(void)
 205 {
 206         NWRAP_LOCK_ALL;
 207 }
 208
 209 static void nwrap_thread_parent(void)
 210 {
 211         NWRAP_UNLOCK_ALL;
 212 }
 213
 214 static void nwrap_thread_child(void)
 215 {
 216         NWRAP_UNLOCK_ALL;
 217 }
 218
 219 enum nwrap_dbglvl_e {
 220         NWRAP_LOG_ERROR = 0,
 221         NWRAP_LOG_WARN,
 222         NWRAP_LOG_DEBUG,
 223         NWRAP_LOG_TRACE
 224 };
 225
 226 #ifdef NDEBUG
 227 # define NWRAP_LOG(...)
 228 #else
 229
 230 static void nwrap_log(enum nwrap_dbglvl_e dbglvl, const char *func, const char *format, ...) PRINTF_ATTRIBUTE(3, 4);
 231 # define NWRAP_LOG(dbglvl, ...) nwrap_log((dbglvl), __func__, __VA_ARGS__)
 232
 233 static void nwrap_log(enum nwrap_dbglvl_e dbglvl,
 234                       const char *func,
 235                       const char *format, ...)
 236 {
 237         char buffer[1024];
 238         va_list va;
 239         const char *d;
 240         unsigned int lvl = 0;
 241         int pid = getpid();
 242
 243         d = getenv("NSS_WRAPPER_DEBUGLEVEL");
 244         if (d != NULL) {
 245                 lvl = atoi(d);
 246         }
 247
 248         va_start(va, format);
 249         vsnprintf(buffer, sizeof(buffer), format, va);
 250         va_end(va);
 251
 252         if (lvl >= dbglvl) {
 253                 switch (dbglvl) {
 254                         case NWRAP_LOG_ERROR:
 255                                 fprintf(stderr,
 256                                         "NWRAP_ERROR(%d) - %s: %s\n",
 257                                         pid, func, buffer);
 258                                 break;
 259                         case NWRAP_LOG_WARN:
 260                                 fprintf(stderr,
 261                                         "NWRAP_WARN(%d) - %s: %s\n",
 262                                         pid, func, buffer);
 263                                 break;
 264                         case NWRAP_LOG_DEBUG:
 265                                 fprintf(stderr,
 266                                         "NWRAP_DEBUG(%d) - %s: %s\n",
 267                                         pid, func, buffer);
 268                                 break;
 269                         case NWRAP_LOG_TRACE:
 270                                 fprintf(stderr,
 271                                         "NWRAP_TRACE(%d) - %s: %s\n",
 272                                         pid, func, buffer);
 273                                 break;
 274                 }
 275         }
 276 }
 277 #endif /* NDEBUG NWRAP_LOG */
 278
 279 struct nwrap_libc_fns {
 280         struct passwd *(*_libc_getpwnam)(const char *name);
 281         int (*_libc_getpwnam_r)(const char *name, struct passwd *pwd,
 282                        char *buf, size_t buflen, struct passwd **result);
 283         struct passwd *(*_libc_getpwuid)(uid_t uid);
 284         int (*_libc_getpwuid_r)(uid_t uid, struct passwd *pwd, char *buf, size_t buflen, struct passwd **result);
 285         void (*_libc_setpwent)(void);
 286         struct passwd *(*_libc_getpwent)(void);
 287 #ifdef HAVE_SOLARIS_GETPWENT_R
 288         struct passwd *(*_libc_getpwent_r)(struct passwd *pwbuf, char *buf, size_t buflen);
 289 #else
 290         int (*_libc_getpwent_r)(struct passwd *pwbuf, char *buf, size_t buflen, struct passwd **pwbufp);
 291 #endif
 292         void (*_libc_endpwent)(void);
 293         int (*_libc_initgroups)(const char *user, gid_t gid);
 294         struct group *(*_libc_getgrnam)(const char *name);
 295         int (*_libc_getgrnam_r)(const char *name, struct group *grp, char *buf, size_t buflen, struct group **result);
 296         struct group *(*_libc_getgrgid)(gid_t gid);
 297         int (*_libc_getgrgid_r)(gid_t gid, struct group *grp, char *buf, size_t buflen, struct group **result);
 298         void (*_libc_setgrent)(void);
 299         struct group *(*_libc_getgrent)(void);
 300 #ifdef HAVE_SOLARIS_GETGRENT_R
 301         struct group *(*_libc_getgrent_r)(struct group *group, char *buf, size_t buflen);
 302 #else
 303         int (*_libc_getgrent_r)(struct group *group, char *buf, size_t buflen, struct group **result);
 304 #endif
 305         void (*_libc_endgrent)(void);
 306         int (*_libc_getgrouplist)(const char *user, gid_t group, gid_t *groups, int *ngroups);
 307
 308         void (*_libc_sethostent)(int stayopen);
 309         struct hostent *(*_libc_gethostent)(void);
 310         void (*_libc_endhostent)(void);
 311
 312         struct hostent *(*_libc_gethostbyname)(const char *name);
 313 #ifdef HAVE_GETHOSTBYNAME2 /* GNU extension */
 314         struct hostent *(*_libc_gethostbyname2)(const char *name, int af);
 315 #endif
 316         struct hostent *(*_libc_gethostbyaddr)(const void *addr, socklen_t len, int type);
 317
 318         int (*_libc_getaddrinfo)(const char *node, const char *service,
 319                                  const struct addrinfo *hints,
 320                                  struct addrinfo **res);
 321         int (*_libc_getnameinfo)(const struct sockaddr *sa, socklen_t salen,
 322                                  char *host, size_t hostlen,
 323                                  char *serv, size_t servlen,
 324                                  int flags);
 325         int (*_libc_gethostname)(char *name, size_t len);
 326 #ifdef HAVE_GETHOSTBYNAME_R
 327         int (*_libc_gethostbyname_r)(const char *name,
 328                                      struct hostent *ret,
 329                                      char *buf, size_t buflen,
 330                                      struct hostent **result, int *h_errnop);
 331 #endif
 332 #ifdef HAVE_GETHOSTBYADDR_R
 333         int (*_libc_gethostbyaddr_r)(const void *addr, socklen_t len, int type,
 334                                      struct hostent *ret,
 335                                      char *buf, size_t buflen,
 336                                      struct hostent **result, int *h_errnop);
 337 #endif
 338 };
 339
 340 struct nwrap_module_nss_fns {
 341         NSS_STATUS (*_nss_getpwnam_r)(const char *name, struct passwd *result, char *buffer,
 342                                       size_t buflen, int *errnop);
 343         NSS_STATUS (*_nss_getpwuid_r)(uid_t uid, struct passwd *result, char *buffer,
 344                                       size_t buflen, int *errnop);
 345         NSS_STATUS (*_nss_setpwent)(void);
 346         NSS_STATUS (*_nss_getpwent_r)(struct passwd *result, char *buffer,
 347                                       size_t buflen, int *errnop);
 348         NSS_STATUS (*_nss_endpwent)(void);
 349         NSS_STATUS (*_nss_initgroups)(const char *user, gid_t group, long int *start,
 350                                       long int *size, gid_t **groups, long int limit, int *errnop);
 351         NSS_STATUS (*_nss_getgrnam_r)(const char *name, struct group *result, char *buffer,
 352                                       size_t buflen, int *errnop);
 353         NSS_STATUS (*_nss_getgrgid_r)(gid_t gid, struct group *result, char *buffer,
 354                                       size_t buflen, int *errnop);
 355         NSS_STATUS (*_nss_setgrent)(void);
 356         NSS_STATUS (*_nss_getgrent_r)(struct group *result, char *buffer,
 357                                       size_t buflen, int *errnop);
 358         NSS_STATUS (*_nss_endgrent)(void);
 359 };
 360
 361 struct nwrap_backend {
 362         const char *name;
 363         const char *so_path;
 364         void *so_handle;
 365         struct nwrap_ops *ops;
 366         struct nwrap_module_nss_fns *fns;
 367 };
 368
 369 struct nwrap_ops {
 370         struct passwd * (*nw_getpwnam)(struct nwrap_backend *b,
 371                                        const char *name);
 372         int             (*nw_getpwnam_r)(struct nwrap_backend *b,
 373                                          const char *name, struct passwd *pwdst,
 374                                          char *buf, size_t buflen, struct passwd **pwdstp);
 375         struct passwd * (*nw_getpwuid)(struct nwrap_backend *b,
 376                                        uid_t uid);
 377         int             (*nw_getpwuid_r)(struct nwrap_backend *b,
 378                                          uid_t uid, struct passwd *pwdst,
 379                                          char *buf, size_t buflen, struct passwd **pwdstp);
 380         void            (*nw_setpwent)(struct nwrap_backend *b);
 381         struct passwd * (*nw_getpwent)(struct nwrap_backend *b);
 382         int             (*nw_getpwent_r)(struct nwrap_backend *b,
 383                                          struct passwd *pwdst, char *buf,
 384                                          size_t buflen, struct passwd **pwdstp);
 385         void            (*nw_endpwent)(struct nwrap_backend *b);
 386         int             (*nw_initgroups)(struct nwrap_backend *b,
 387                                          const char *user, gid_t group);
 388         struct group *  (*nw_getgrnam)(struct nwrap_backend *b,
 389                                        const char *name);
 390         int             (*nw_getgrnam_r)(struct nwrap_backend *b,
 391                                          const char *name, struct group *grdst,
 392                                          char *buf, size_t buflen, struct group **grdstp);
 393         struct group *  (*nw_getgrgid)(struct nwrap_backend *b,
 394                                        gid_t gid);
 395         int             (*nw_getgrgid_r)(struct nwrap_backend *b,
 396                                          gid_t gid, struct group *grdst,
 397                                          char *buf, size_t buflen, struct group **grdstp);
 398         void            (*nw_setgrent)(struct nwrap_backend *b);
 399         struct group *  (*nw_getgrent)(struct nwrap_backend *b);
 400         int             (*nw_getgrent_r)(struct nwrap_backend *b,
 401                                          struct group *grdst, char *buf,
 402                                          size_t buflen, struct group **grdstp);
 403         void            (*nw_endgrent)(struct nwrap_backend *b);
 404 };
 405
 406 /* Public prototypes */
 407
 408 bool nss_wrapper_enabled(void);
 409 bool nss_wrapper_shadow_enabled(void);
 410 bool nss_wrapper_hosts_enabled(void);
 411
 412 /* prototypes for files backend */
 413
 414
 415 static struct passwd *nwrap_files_getpwnam(struct nwrap_backend *b,
 416                                            const char *name);
 417 static int nwrap_files_getpwnam_r(struct nwrap_backend *b,
 418                                   const char *name, struct passwd *pwdst,
 419                                   char *buf, size_t buflen, struct passwd **pwdstp);
 420 static struct passwd *nwrap_files_getpwuid(struct nwrap_backend *b,
 421                                            uid_t uid);
 422 static int nwrap_files_getpwuid_r(struct nwrap_backend *b,
 423                                   uid_t uid, struct passwd *pwdst,
 424                                   char *buf, size_t buflen, struct passwd **pwdstp);
 425 static void nwrap_files_setpwent(struct nwrap_backend *b);
 426 static struct passwd *nwrap_files_getpwent(struct nwrap_backend *b);
 427 static int nwrap_files_getpwent_r(struct nwrap_backend *b,
 428                                   struct passwd *pwdst, char *buf,
 429                                   size_t buflen, struct passwd **pwdstp);
 430 static void nwrap_files_endpwent(struct nwrap_backend *b);
 431 static int nwrap_files_initgroups(struct nwrap_backend *b,
 432                                   const char *user, gid_t group);
 433 static struct group *nwrap_files_getgrnam(struct nwrap_backend *b,
 434                                           const char *name);
 435 static int nwrap_files_getgrnam_r(struct nwrap_backend *b,
 436                                   const char *name, struct group *grdst,
 437                                   char *buf, size_t buflen, struct group **grdstp);
 438 static struct group *nwrap_files_getgrgid(struct nwrap_backend *b,
 439                                           gid_t gid);
 440 static int nwrap_files_getgrgid_r(struct nwrap_backend *b,
 441                                   gid_t gid, struct group *grdst,
 442                                   char *buf, size_t buflen, struct group **grdstp);
 443 static void nwrap_files_setgrent(struct nwrap_backend *b);
 444 static struct group *nwrap_files_getgrent(struct nwrap_backend *b);
 445 static int nwrap_files_getgrent_r(struct nwrap_backend *b,
 446                                   struct group *grdst, char *buf,
 447                                   size_t buflen, struct group **grdstp);
 448 static void nwrap_files_endgrent(struct nwrap_backend *b);
 449
 450 /* prototypes for module backend */
 451
 452 static struct passwd *nwrap_module_getpwent(struct nwrap_backend *b);
 453 static int nwrap_module_getpwent_r(struct nwrap_backend *b,
 454                                    struct passwd *pwdst, char *buf,
 455                                    size_t buflen, struct passwd **pwdstp);
 456 static struct passwd *nwrap_module_getpwnam(struct nwrap_backend *b,
 457                                             const char *name);
 458 static int nwrap_module_getpwnam_r(struct nwrap_backend *b,
 459                                    const char *name, struct passwd *pwdst,
 460                                    char *buf, size_t buflen, struct passwd **pwdstp);
 461 static struct passwd *nwrap_module_getpwuid(struct nwrap_backend *b,
 462                                             uid_t uid);
 463 static int nwrap_module_getpwuid_r(struct nwrap_backend *b,
 464                                    uid_t uid, struct passwd *pwdst,
 465                                    char *buf, size_t buflen, struct passwd **pwdstp);
 466 static void nwrap_module_setpwent(struct nwrap_backend *b);
 467 static void nwrap_module_endpwent(struct nwrap_backend *b);
 468 static struct group *nwrap_module_getgrent(struct nwrap_backend *b);
 469 static int nwrap_module_getgrent_r(struct nwrap_backend *b,
 470                                    struct group *grdst, char *buf,
 471                                    size_t buflen, struct group **grdstp);
 472 static struct group *nwrap_module_getgrnam(struct nwrap_backend *b,
 473                                            const char *name);
 474 static int nwrap_module_getgrnam_r(struct nwrap_backend *b,
 475                                    const char *name, struct group *grdst,
 476                                    char *buf, size_t buflen, struct group **grdstp);
 477 static struct group *nwrap_module_getgrgid(struct nwrap_backend *b,
 478                                            gid_t gid);
 479 static int nwrap_module_getgrgid_r(struct nwrap_backend *b,
 480                                    gid_t gid, struct group *grdst,
 481                                    char *buf, size_t buflen, struct group **grdstp);
 482 static void nwrap_module_setgrent(struct nwrap_backend *b);
 483 static void nwrap_module_endgrent(struct nwrap_backend *b);
 484 static int nwrap_module_initgroups(struct nwrap_backend *b,
 485                                    const char *user, gid_t group);
 486
 487 struct nwrap_ops nwrap_files_ops = {
 488         .nw_getpwnam    = nwrap_files_getpwnam,
 489         .nw_getpwnam_r  = nwrap_files_getpwnam_r,
 490         .nw_getpwuid    = nwrap_files_getpwuid,
 491         .nw_getpwuid_r  = nwrap_files_getpwuid_r,
 492         .nw_setpwent    = nwrap_files_setpwent,
 493         .nw_getpwent    = nwrap_files_getpwent,
 494         .nw_getpwent_r  = nwrap_files_getpwent_r,
 495         .nw_endpwent    = nwrap_files_endpwent,
 496         .nw_initgroups  = nwrap_files_initgroups,
 497         .nw_getgrnam    = nwrap_files_getgrnam,
 498         .nw_getgrnam_r  = nwrap_files_getgrnam_r,
 499         .nw_getgrgid    = nwrap_files_getgrgid,
 500         .nw_getgrgid_r  = nwrap_files_getgrgid_r,
 501         .nw_setgrent    = nwrap_files_setgrent,
 502         .nw_getgrent    = nwrap_files_getgrent,
 503         .nw_getgrent_r  = nwrap_files_getgrent_r,
 504         .nw_endgrent    = nwrap_files_endgrent,
 505 };
 506
 507 struct nwrap_ops nwrap_module_ops = {
 508         .nw_getpwnam    = nwrap_module_getpwnam,
 509         .nw_getpwnam_r  = nwrap_module_getpwnam_r,
 510         .nw_getpwuid    = nwrap_module_getpwuid,
 511         .nw_getpwuid_r  = nwrap_module_getpwuid_r,
 512         .nw_setpwent    = nwrap_module_setpwent,
 513         .nw_getpwent    = nwrap_module_getpwent,
 514         .nw_getpwent_r  = nwrap_module_getpwent_r,
 515         .nw_endpwent    = nwrap_module_endpwent,
 516         .nw_initgroups  = nwrap_module_initgroups,
 517         .nw_getgrnam    = nwrap_module_getgrnam,
 518         .nw_getgrnam_r  = nwrap_module_getgrnam_r,
 519         .nw_getgrgid    = nwrap_module_getgrgid,
 520         .nw_getgrgid_r  = nwrap_module_getgrgid_r,
 521         .nw_setgrent    = nwrap_module_setgrent,
 522         .nw_getgrent    = nwrap_module_getgrent,
 523         .nw_getgrent_r  = nwrap_module_getgrent_r,
 524         .nw_endgrent    = nwrap_module_endgrent,
 525 };
 526
 527 struct nwrap_libc {
 528         void *handle;
 529         void *nsl_handle;
 530         void *sock_handle;
 531         struct nwrap_libc_fns *fns;
 532 };
 533
 534 struct nwrap_main {
 535         int num_backends;
 536         struct nwrap_backend *backends;
 537         struct nwrap_libc *libc;
 538 };
 539
 540 static struct nwrap_main *nwrap_main_global;
 541 static struct nwrap_main __nwrap_main_global;
 542
 543 /*
 544  * PROTOTYPES
 545  */
 546 static int nwrap_convert_he_ai(const struct hostent *he,
 547                                unsigned short port,
 548                                const struct addrinfo *hints,
 549                                struct addrinfo **pai,
 550                                bool skip_canonname);
 551
 552 /*
 553  * VECTORS
 554  */
 555
 556 #define DEFAULT_VECTOR_CAPACITY 16
 557
 558 struct nwrap_vector {
 559         void **items;
 560         size_t count;
 561         size_t capacity;
 562 };
 563
 564 /* Macro returns pointer to first element of vector->items array.
 565  *
 566  * nwrap_vector is used as a memory backend which take care of
 567  * memory allocations and other stuff like memory growing.
 568  * nwrap_vectors should not be considered as some abstract structures.
 569  * On this level, vectors are more handy than direct realloc/malloc
 570  * calls.
 571  *
 572  * nwrap_vector->items is array inside nwrap_vector which can be
 573  * directly pointed by libc structure assembled by cwrap itself.
 574  *
 575  * EXAMPLE:
 576  *
 577  * 1) struct hostent contains char **h_addr_list element.
 578  * 2) nwrap_vector holds array of pointers to addresses.
 579  *    It's easier to use vector to store results of
 580  *    file parsing etc.
 581  *
 582  * Now, pretend that cwrap assembled struct hostent and
 583  * we need to set h_addr_list to point to nwrap_vector.
 584  * Idea behind is to shield users from internal nwrap_vector
 585  * implementation.
 586  * (Yes, not fully - array terminated by NULL is needed because
 587  * it's result expected by libc function caller.)
 588  *
 589  *
 590  * CODE EXAMPLE:
 591  *
 592  * struct hostent he;
 593  * struct nwrap_vector *vector = malloc(sizeof(struct nwrap_vector));
 594  * ... don't care about failed allocation now ...
 595  *
 596  * ... fill nwrap vector ...
 597  *
 598  * struct hostent he;
 599  * he.h_addr_list = nwrap_vector_head(vector);
 600  *
 601  */
 602 #define nwrap_vector_head(vect) ((void *)((vect)->items))
 603
 604 #define nwrap_vector_foreach(item, vect, iter) \
 605         for (iter = 0, (item) = (vect).items == NULL ? NULL : (vect).items[0]; \
 606              item != NULL; \
 607              (item) = (vect).items[++iter])
 608
 609 #define nwrap_vector_is_initialized(vector) ((vector)->items != NULL)
 610
 611 static inline bool nwrap_vector_init(struct nwrap_vector *const vector)
 612 {
 613         if (vector == NULL) {
 614                 return false;
 615         }
 616
 617         /* count is initialized by ZERO_STRUCTP */
 618         ZERO_STRUCTP(vector);
 619         vector->items = malloc(sizeof(void *) * (DEFAULT_VECTOR_CAPACITY + 1));
 620         if (vector->items == NULL) {
 621                 return false;
 622         }
 623         vector->capacity = DEFAULT_VECTOR_CAPACITY;
 624         memset(vector->items, '\0', sizeof(void *) * (DEFAULT_VECTOR_CAPACITY + 1));
 625
 626         return true;
 627 }
 628
 629 static bool nwrap_vector_add_item(struct nwrap_vector *vector, void *const item)
 630 {
 631         assert (vector != NULL);
 632
 633         if (vector->items == NULL) {
 634                 nwrap_vector_init(vector);
 635         }
 636
 637         if (vector->count == vector->capacity) {
 638                 /* Items array _MUST_ be NULL terminated because it's passed
 639                  * as result to caller which expect NULL terminated array from libc.
 640                  */
 641                 void **items = realloc(vector->items, sizeof(void *) * ((vector->capacity * 2) + 1));
 642                 if (items == NULL) {
 643                         return false;
 644                 }
 645                 vector->items = items;
 646
 647                 /* Don't count ending NULL to capacity */
 648                 vector->capacity *= 2;
 649         }
 650
 651         vector->items[vector->count] = item;
 652
 653         vector->count += 1;
 654         vector->items[vector->count] = NULL;
 655
 656         return true;
 657 }
 658
 659 static bool nwrap_vector_merge(struct nwrap_vector *dst,
 660                                struct nwrap_vector *src)
 661 {
 662         void **dst_items = NULL;
 663         size_t count;
 664
 665         if (src->count == 0) {
 666                 return true;
 667         }
 668
 669         count = dst->count + src->count;
 670
 671         /* We don't need reallocation if we have enough capacity. */
 672         if (src->count > (dst->capacity - dst->count)) {
 673                 dst_items = (void **)realloc(dst->items, (count + 1) * sizeof(void *));
 674                 if (dst_items == NULL) {
 675                         return false;
 676                 }
 677                 dst->items = dst_items;
 678                 dst->capacity = count;
 679         }
 680
 681         memcpy((void *)(((long *)dst->items) + dst->count),
 682                src->items,
 683                src->count * sizeof(void *));
 684         dst->count = count;
 685
 686         return true;
 687 }
 688
 689 struct nwrap_cache {
 690         const char *path;
 691         int fd;
 692         FILE *fp;
 693         struct stat st;
 694         void *private_data;
 695
 696         struct nwrap_vector lines;
 697
 698         bool (*parse_line)(struct nwrap_cache *, char *line);
 699         void (*unload)(struct nwrap_cache *);
 700 };
 701
 702 /* passwd */
 703 struct nwrap_pw {
 704         struct nwrap_cache *cache;
 705
 706         struct passwd *list;
 707         int num;
 708         int idx;
 709 };
 710
 711 struct nwrap_cache __nwrap_cache_pw;
 712 struct nwrap_pw nwrap_pw_global;
 713
 714 static bool nwrap_pw_parse_line(struct nwrap_cache *nwrap, char *line);
 715 static void nwrap_pw_unload(struct nwrap_cache *nwrap);
 716
 717 /* shadow */
 718 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
 719 struct nwrap_sp {
 720         struct nwrap_cache *cache;
 721
 722         struct spwd *list;
 723         int num;
 724         int idx;
 725 };
 726
 727 struct nwrap_cache __nwrap_cache_sp;
 728 struct nwrap_sp nwrap_sp_global;
 729
 730 static bool nwrap_sp_parse_line(struct nwrap_cache *nwrap, char *line);
 731 static void nwrap_sp_unload(struct nwrap_cache *nwrap);
 732 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
 733
 734 /* group */
 735 struct nwrap_gr {
 736         struct nwrap_cache *cache;
 737
 738         struct group *list;
 739         int num;
 740         int idx;
 741 };
 742
 743 struct nwrap_cache __nwrap_cache_gr;
 744 struct nwrap_gr nwrap_gr_global;
 745
 746 /* hosts */
 747 static bool nwrap_he_parse_line(struct nwrap_cache *nwrap, char *line);
 748 static void nwrap_he_unload(struct nwrap_cache *nwrap);
 749
 750 struct nwrap_addrdata {
 751         unsigned char host_addr[16]; /* IPv4 or IPv6 address */
 752 };
 753
 754 static size_t max_hostents = 100;
 755
 756 struct nwrap_entdata {
 757         struct nwrap_addrdata addr;
 758         struct hostent ht;
 759
 760         struct nwrap_vector nwrap_addrdata;
 761
 762         ssize_t aliases_count;
 763 };
 764
 765 struct nwrap_entlist {
 766         struct nwrap_entlist *next;
 767         struct nwrap_entdata *ed;
 768 };
 769
 770 struct nwrap_he {
 771         struct nwrap_cache *cache;
 772
 773         struct nwrap_vector entries;
 774
 775         int num;
 776         int idx;
 777 };
 778
 779 static struct nwrap_cache __nwrap_cache_he;
 780 static struct nwrap_he nwrap_he_global;
 781
 782
 783 /*********************************************************
 784  * NWRAP PROTOTYPES
 785  *********************************************************/
 786
 787 static void nwrap_init(void);
 788 static bool nwrap_gr_parse_line(struct nwrap_cache *nwrap, char *line);
 789 static void nwrap_gr_unload(struct nwrap_cache *nwrap);
 790 void nwrap_destructor(void) DESTRUCTOR_ATTRIBUTE;
 791
 792 /*********************************************************
 793  * NWRAP LIBC LOADER FUNCTIONS
 794  *********************************************************/
 795
 796 enum nwrap_lib {
 797     NWRAP_LIBC,
 798     NWRAP_LIBNSL,
 799     NWRAP_LIBSOCKET,
 800 };
 801
 802 #ifndef NDEBUG
 803 static const char *nwrap_str_lib(enum nwrap_lib lib)
 804 {
 805         switch (lib) {
 806         case NWRAP_LIBC:
 807                 return "libc";
 808         case NWRAP_LIBNSL:
 809                 return "libnsl";
 810         case NWRAP_LIBSOCKET:
 811                 return "libsocket";
 812         }
 813
 814         /* Compiler would warn us about unhandled enum value if we get here */
 815         return "unknown";
 816 }
 817 #endif
 818
 819 static void *nwrap_load_lib_handle(enum nwrap_lib lib)
 820 {
 821         int flags = RTLD_LAZY;
 822         void *handle = NULL;
 823         int i;
 824
 825 #ifdef RTLD_DEEPBIND
 826         flags |= RTLD_DEEPBIND;
 827 #endif
 828
 829         switch (lib) {
 830         case NWRAP_LIBNSL:
 831 #ifdef HAVE_LIBNSL
 832                 handle = nwrap_main_global->libc->nsl_handle;
 833                 if (handle == NULL) {
 834                         for (i = 10; i >= 0; i--) {
 835                                 char soname[256] = {0};
 836
 837                                 snprintf(soname, sizeof(soname), "libnsl.so.%d", i);
 838                                 handle = dlopen(soname, flags);
 839                                 if (handle != NULL) {
 840                                         break;
 841                                 }
 842                         }
 843
 844                         nwrap_main_global->libc->nsl_handle = handle;
 845                 }
 846                 break;
 847 #endif
 848                 /* FALL TROUGH */
 849         case NWRAP_LIBSOCKET:
 850 #ifdef HAVE_LIBSOCKET
 851                 handle = nwrap_main_global->libc->sock_handle;
 852                 if (handle == NULL) {
 853                         for (i = 10; i >= 0; i--) {
 854                                 char soname[256] = {0};
 855
 856                                 snprintf(soname, sizeof(soname), "libsocket.so.%d", i);
 857                                 handle = dlopen(soname, flags);
 858                                 if (handle != NULL) {
 859                                         break;
 860                                 }
 861                         }
 862
 863                         nwrap_main_global->libc->sock_handle = handle;
 864                 }
 865                 break;
 866 #endif
 867                 /* FALL TROUGH */
 868         case NWRAP_LIBC:
 869                 handle = nwrap_main_global->libc->handle;
 870                 if (handle == NULL) {
 871                         for (i = 10; i >= 0; i--) {
 872                                 char soname[256] = {0};
 873
 874                                 snprintf(soname, sizeof(soname), "libc.so.%d", i);
 875                                 handle = dlopen(soname, flags);
 876                                 if (handle != NULL) {
 877                                         break;
 878                                 }
 879                         }
 880
 881                         nwrap_main_global->libc->handle = handle;
 882                 }
 883                 break;
 884         }
 885
 886         if (handle == NULL) {
 887 #ifdef RTLD_NEXT
 888                 handle = nwrap_main_global->libc->handle
 889                        = nwrap_main_global->libc->sock_handle
 890                        = nwrap_main_global->libc->nsl_handle
 891                        = RTLD_NEXT;
 892 #else
 893                 NWRAP_LOG(NWRAP_LOG_ERROR,
 894                           "Failed to dlopen library: %s\n",
 895                           dlerror());
 896                 exit(-1);
 897 #endif
 898         }
 899
 900         return handle;
 901 }
 902
 903 static void *_nwrap_load_lib_function(enum nwrap_lib lib, const char *fn_name)
 904 {
 905         void *handle;
 906         void *func;
 907
 908         nwrap_init();
 909
 910         handle = nwrap_load_lib_handle(lib);
 911
 912         func = dlsym(handle, fn_name);
 913         if (func == NULL) {
 914                 NWRAP_LOG(NWRAP_LOG_ERROR,
 915                                 "Failed to find %s: %s\n",
 916                                 fn_name, dlerror());
 917                 exit(-1);
 918         }
 919
 920         NWRAP_LOG(NWRAP_LOG_TRACE,
 921                         "Loaded %s from %s",
 922                         fn_name, nwrap_str_lib(lib));
 923         return func;
 924 }
 925
 926 #define nwrap_load_lib_function(lib, fn_name) \
 927         if (nwrap_main_global->libc->fns->_libc_##fn_name == NULL) { \
 928                 *(void **) (&nwrap_main_global->libc->fns->_libc_##fn_name) = \
 929                         _nwrap_load_lib_function(lib, #fn_name); \
 930         }
 931
 932 /* INTERNAL HELPER FUNCTIONS */
 933 static void nwrap_lines_unload(struct nwrap_cache *const nwrap)
 934 {
 935         size_t p;
 936         void *item;
 937         nwrap_vector_foreach(item, nwrap->lines, p) {
 938                 /* Maybe some vectors were merged ... */
 939                 SAFE_FREE(item);
 940         }
 941         SAFE_FREE(nwrap->lines.items);
 942         ZERO_STRUCTP(&nwrap->lines);
 943 }
 944
 945 /*
 946  * IMPORTANT
 947  *
 948  * Functions expeciall from libc need to be loaded individually, you can't load
 949  * all at once or gdb will segfault at startup. The same applies to valgrind and
 950  * has probably something todo with with the linker.
 951  * So we need load each function at the point it is called the first time.
 952  */
 953 static struct passwd *libc_getpwnam(const char *name)
 954 {
 955         nwrap_load_lib_function(NWRAP_LIBC, getpwnam);
 956
 957         return nwrap_main_global->libc->fns->_libc_getpwnam(name);
 958 }
 959
 960 #ifdef HAVE_GETPWNAM_R
 961 static int libc_getpwnam_r(const char *name,
 962                            struct passwd *pwd,
 963                            char *buf,
 964                            size_t buflen,
 965                            struct passwd **result)
 966 {
 967 #ifdef HAVE___POSIX_GETPWNAM_R
 968         if (nwrap_main_global->libc->fns->_libc_getpwnam_r == NULL) {
 969                 *(void **) (&nwrap_main_global->libc->fns->_libc_getpwnam_r) =
 970                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getpwnam_r");
 971         }
 972 #else
 973         nwrap_load_lib_function(NWRAP_LIBC, getpwnam_r);
 974 #endif
 975
 976         return nwrap_main_global->libc->fns->_libc_getpwnam_r(name,
 977                                                               pwd,
 978                                                               buf,
 979                                                               buflen,
 980                                                               result);
 981 }
 982 #endif
 983
 984 static struct passwd *libc_getpwuid(uid_t uid)
 985 {
 986         nwrap_load_lib_function(NWRAP_LIBC, getpwuid);
 987
 988         return nwrap_main_global->libc->fns->_libc_getpwuid(uid);
 989 }
 990
 991 #ifdef HAVE_GETPWUID_R
 992 static int libc_getpwuid_r(uid_t uid,
 993                            struct passwd *pwd,
 994                            char *buf,
 995                            size_t buflen,
 996                            struct passwd **result)
 997 {
 998 #ifdef HAVE___POSIX_GETPWUID_R
 999         if (nwrap_main_global->libc->fns->_libc_getpwuid_r == NULL) {
1000                 *(void **) (&nwrap_main_global->libc->fns->_libc_getpwuid_r) =
1001                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getpwuid_r");
1002         }
1003 #else
1004         nwrap_load_lib_function(NWRAP_LIBC, getpwuid_r);
1005 #endif
1006
1007         return nwrap_main_global->libc->fns->_libc_getpwuid_r(uid,
1008                                                               pwd,
1009                                                               buf,
1010                                                               buflen,
1011                                                               result);
1012 }
1013 #endif
1014
1015 static inline void str_tolower(char *dst, char *src)
1016 {
1017         register char *src_tmp = src;
1018         register char *dst_tmp = dst;
1019
1020         while (*src_tmp != '\0') {
1021                 *dst_tmp = tolower(*src_tmp);
1022                 ++src_tmp;
1023                 ++dst_tmp;
1024         }
1025 }
1026
1027 static bool str_tolower_copy(char **dst_name, const char *const src_name)
1028 {
1029         char *h_name_lower;
1030
1031         if ((dst_name == NULL) || (src_name == NULL)) {
1032                 return false;
1033         }
1034
1035         h_name_lower = strdup(src_name);
1036         if (h_name_lower == NULL) {
1037                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Out of memory while strdup");
1038                 return false;
1039         }
1040
1041         str_tolower(h_name_lower, h_name_lower);
1042         *dst_name = h_name_lower;
1043         return true;
1044 }
1045
1046 static void libc_setpwent(void)
1047 {
1048         nwrap_load_lib_function(NWRAP_LIBC, setpwent);
1049
1050         nwrap_main_global->libc->fns->_libc_setpwent();
1051 }
1052
1053 static struct passwd *libc_getpwent(void)
1054 {
1055         nwrap_load_lib_function(NWRAP_LIBC, getpwent);
1056
1057         return nwrap_main_global->libc->fns->_libc_getpwent();
1058 }
1059
1060 #ifdef HAVE_SOLARIS_GETPWENT_R
1061 static struct passwd *libc_getpwent_r(struct passwd *pwdst,
1062                                       char *buf,
1063                                       int buflen)
1064 {
1065         nwrap_load_lib_function(NWRAP_LIBC, getpwent_r);
1066
1067         return nwrap_main_global->libc->fns->_libc_getpwent_r(pwdst,
1068                                                               buf,
1069                                                               buflen);
1070 }
1071 #else /* HAVE_SOLARIS_GETPWENT_R */
1072 static int libc_getpwent_r(struct passwd *pwdst,
1073                            char *buf,
1074                            size_t buflen,
1075                            struct passwd **pwdstp)
1076 {
1077         nwrap_load_lib_function(NWRAP_LIBC, getpwent_r);
1078
1079         return nwrap_main_global->libc->fns->_libc_getpwent_r(pwdst,
1080                                                               buf,
1081                                                               buflen,
1082                                                               pwdstp);
1083 }
1084 #endif /* HAVE_SOLARIS_GETPWENT_R */
1085
1086 static void libc_endpwent(void)
1087 {
1088         nwrap_load_lib_function(NWRAP_LIBC, endpwent);
1089
1090         nwrap_main_global->libc->fns->_libc_endpwent();
1091 }
1092
1093 static int libc_initgroups(const char *user, gid_t gid)
1094 {
1095         nwrap_load_lib_function(NWRAP_LIBC, initgroups);
1096
1097         return nwrap_main_global->libc->fns->_libc_initgroups(user, gid);
1098 }
1099
1100 static struct group *libc_getgrnam(const char *name)
1101 {
1102         nwrap_load_lib_function(NWRAP_LIBC, getgrnam);
1103
1104         return nwrap_main_global->libc->fns->_libc_getgrnam(name);
1105 }
1106
1107 #ifdef HAVE_GETGRNAM_R
1108 static int libc_getgrnam_r(const char *name,
1109                            struct group *grp,
1110                            char *buf,
1111                            size_t buflen,
1112                            struct group **result)
1113 {
1114 #ifdef HAVE___POSIX_GETGRNAM_R
1115         if (nwrap_main_global->libc->fns->_libc_getgrnam_r == NULL) {
1116                 *(void **) (&nwrap_main_global->libc->fns->_libc_getgrnam_r) =
1117                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getgrnam_r");
1118         }
1119 #else
1120         nwrap_load_lib_function(NWRAP_LIBC, getgrnam_r);
1121 #endif
1122
1123         return nwrap_main_global->libc->fns->_libc_getgrnam_r(name,
1124                                                               grp,
1125                                                               buf,
1126                                                               buflen,
1127                                                               result);
1128 }
1129 #endif
1130
1131 static struct group *libc_getgrgid(gid_t gid)
1132 {
1133         nwrap_load_lib_function(NWRAP_LIBC, getgrgid);
1134
1135         return nwrap_main_global->libc->fns->_libc_getgrgid(gid);
1136 }
1137
1138 #ifdef HAVE_GETGRGID_R
1139 static int libc_getgrgid_r(gid_t gid,
1140                            struct group *grp,
1141                            char *buf,
1142                            size_t buflen,
1143                            struct group **result)
1144 {
1145 #ifdef HAVE___POSIX_GETGRGID_R
1146         if (nwrap_main_global->libc->fns->_libc_getgrgid_r == NULL) {
1147                 *(void **) (&nwrap_main_global->libc->fns->_libc_getgrgid_r) =
1148                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getgrgid_r");
1149         }
1150 #else
1151         nwrap_load_lib_function(NWRAP_LIBC, getgrgid_r);
1152 #endif
1153
1154         return nwrap_main_global->libc->fns->_libc_getgrgid_r(gid,
1155                                                               grp,
1156                                                               buf,
1157                                                               buflen,
1158                                                               result);
1159 }
1160 #endif
1161
1162 static void libc_setgrent(void)
1163 {
1164         nwrap_load_lib_function(NWRAP_LIBC, setgrent);
1165
1166         nwrap_main_global->libc->fns->_libc_setgrent();
1167 }
1168
1169 static struct group *libc_getgrent(void)
1170 {
1171         nwrap_load_lib_function(NWRAP_LIBC, getgrent);
1172
1173         return nwrap_main_global->libc->fns->_libc_getgrent();
1174 }
1175
1176 #ifdef HAVE_GETGRENT_R
1177 #ifdef HAVE_SOLARIS_GETGRENT_R
1178 static struct group *libc_getgrent_r(struct group *group,
1179                                      char *buf,
1180                                      size_t buflen)
1181 {
1182         nwrap_load_lib_function(NWRAP_LIBC, getgrent_r);
1183
1184         return nwrap_main_global->libc->fns->_libc_getgrent_r(group,
1185                                                               buf,
1186                                                               buflen);
1187 }
1188 #else /* !HAVE_SOLARIS_GETGRENT_R */
1189 static int libc_getgrent_r(struct group *group,
1190                            char *buf,
1191                            size_t buflen,
1192                            struct group **result)
1193 {
1194         nwrap_load_lib_function(NWRAP_LIBC, getgrent_r);
1195
1196         return nwrap_main_global->libc->fns->_libc_getgrent_r(group,
1197                                                               buf,
1198                                                               buflen,
1199                                                               result);
1200 }
1201 #endif /* HAVE_SOLARIS_GETGRENT_R */
1202 #endif /* HAVE_GETGRENT_R */
1203
1204 static void libc_endgrent(void)
1205 {
1206         nwrap_load_lib_function(NWRAP_LIBC, endgrent);
1207
1208         nwrap_main_global->libc->fns->_libc_endgrent();
1209 }
1210
1211 #ifdef HAVE_GETGROUPLIST
1212 static int libc_getgrouplist(const char *user,
1213                              gid_t group,
1214                              gid_t *groups,
1215                              int *ngroups)
1216 {
1217         nwrap_load_lib_function(NWRAP_LIBC, getgrouplist);
1218
1219         return nwrap_main_global->libc->fns->_libc_getgrouplist(user,
1220                                                                 group,
1221                                                                 groups,
1222                                                                 ngroups);
1223 }
1224 #endif
1225
1226 static void libc_sethostent(int stayopen)
1227 {
1228         nwrap_load_lib_function(NWRAP_LIBNSL, sethostent);
1229
1230         nwrap_main_global->libc->fns->_libc_sethostent(stayopen);
1231 }
1232
1233 static struct hostent *libc_gethostent(void)
1234 {
1235         nwrap_load_lib_function(NWRAP_LIBNSL, gethostent);
1236
1237         return nwrap_main_global->libc->fns->_libc_gethostent();
1238 }
1239
1240 static void libc_endhostent(void)
1241 {
1242         nwrap_load_lib_function(NWRAP_LIBNSL, endhostent);
1243
1244         nwrap_main_global->libc->fns->_libc_endhostent();
1245 }
1246
1247 static struct hostent *libc_gethostbyname(const char *name)
1248 {
1249         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname);
1250
1251         return nwrap_main_global->libc->fns->_libc_gethostbyname(name);
1252 }
1253
1254 #ifdef HAVE_GETHOSTBYNAME2 /* GNU extension */
1255 static struct hostent *libc_gethostbyname2(const char *name, int af)
1256 {
1257         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname2);
1258
1259         return nwrap_main_global->libc->fns->_libc_gethostbyname2(name, af);
1260 }
1261 #endif
1262
1263 static struct hostent *libc_gethostbyaddr(const void *addr,
1264                                           socklen_t len,
1265                                           int type)
1266 {
1267         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyaddr);
1268
1269         return nwrap_main_global->libc->fns->_libc_gethostbyaddr(addr,
1270                                                                  len,
1271                                                                  type);
1272 }
1273
1274 static int libc_gethostname(char *name, size_t len)
1275 {
1276         nwrap_load_lib_function(NWRAP_LIBNSL, gethostname);
1277
1278         return nwrap_main_global->libc->fns->_libc_gethostname(name, len);
1279 }
1280
1281 #ifdef HAVE_GETHOSTBYNAME_R
1282 static int libc_gethostbyname_r(const char *name,
1283                                 struct hostent *ret,
1284                                 char *buf,
1285                                 size_t buflen,
1286                                 struct hostent **result,
1287                                 int *h_errnop)
1288 {
1289         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname_r);
1290
1291         return nwrap_main_global->libc->fns->_libc_gethostbyname_r(name,
1292                                                                    ret,
1293                                                                    buf,
1294                                                                    buflen,
1295                                                                    result,
1296                                                                    h_errnop);
1297 }
1298 #endif
1299
1300 #ifdef HAVE_GETHOSTBYADDR_R
1301 static int libc_gethostbyaddr_r(const void *addr,
1302                                 socklen_t len,
1303                                 int type,
1304                                 struct hostent *ret,
1305                                 char *buf,
1306                                 size_t buflen,
1307                                 struct hostent **result,
1308                                 int *h_errnop)
1309 {
1310         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyaddr_r);
1311
1312         return nwrap_main_global->libc->fns->_libc_gethostbyaddr_r(addr,
1313                                                                    len,
1314                                                                    type,
1315                                                                    ret,
1316                                                                    buf,
1317                                                                    buflen,
1318                                                                    result,
1319                                                                    h_errnop);
1320 }
1321 #endif
1322
1323 static int libc_getaddrinfo(const char *node,
1324                             const char *service,
1325                             const struct addrinfo *hints,
1326                             struct addrinfo **res)
1327 {
1328         nwrap_load_lib_function(NWRAP_LIBSOCKET, getaddrinfo);
1329
1330         return nwrap_main_global->libc->fns->_libc_getaddrinfo(node,
1331                                                                service,
1332                                                                hints,
1333                                                                res);
1334 }
1335
1336 static int libc_getnameinfo(const struct sockaddr *sa,
1337                             socklen_t salen,
1338                             char *host,
1339                             size_t hostlen,
1340                             char *serv,
1341                             size_t servlen,
1342                             int flags)
1343 {
1344         nwrap_load_lib_function(NWRAP_LIBSOCKET, getnameinfo);
1345
1346         return nwrap_main_global->libc->fns->_libc_getnameinfo(sa,
1347                                                                salen,
1348                                                                host,
1349                                                                hostlen,
1350                                                                serv,
1351                                                                servlen,
1352                                                                flags);
1353 }
1354
1355 /*********************************************************
1356  * NWRAP NSS MODULE LOADER FUNCTIONS
1357  *********************************************************/
1358
1359 static void *nwrap_load_module_fn(struct nwrap_backend *b,
1360                                   const char *fn_name)
1361 {
1362         void *res;
1363         char *s;
1364
1365         if (!b->so_handle) {
1366                 NWRAP_LOG(NWRAP_LOG_ERROR, "No handle");
1367                 return NULL;
1368         }
1369
1370         if (asprintf(&s, "_nss_%s_%s", b->name, fn_name) == -1) {
1371                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
1372                 return NULL;
1373         }
1374
1375         res = dlsym(b->so_handle, s);
1376         if (!res) {
1377                 NWRAP_LOG(NWRAP_LOG_ERROR,
1378                           "Cannot find function %s in %s",
1379                           s, b->so_path);
1380         }
1381         SAFE_FREE(s);
1382         return res;
1383 }
1384
1385 static struct nwrap_module_nss_fns *nwrap_load_module_fns(struct nwrap_backend *b)
1386 {
1387         struct nwrap_module_nss_fns *fns;
1388
1389         if (!b->so_handle) {
1390                 return NULL;
1391         }
1392
1393         fns = (struct nwrap_module_nss_fns *)malloc(sizeof(struct nwrap_module_nss_fns));
1394         if (!fns) {
1395                 return NULL;
1396         }
1397
1398         *(void **)(&fns->_nss_getpwnam_r) =
1399                 nwrap_load_module_fn(b, "getpwnam_r");
1400         *(void **)(&fns->_nss_getpwuid_r) =
1401                 nwrap_load_module_fn(b, "getpwuid_r");
1402         *(void **)(&fns->_nss_setpwent) =
1403                 nwrap_load_module_fn(b, "setpwent");
1404         *(void **)(&fns->_nss_getpwent_r) =
1405                 nwrap_load_module_fn(b, "getpwent_r");
1406         *(void **)(&fns->_nss_endpwent) =
1407                 nwrap_load_module_fn(b, "endpwent");
1408         *(void **)(&fns->_nss_initgroups) =
1409                 nwrap_load_module_fn(b, "initgroups_dyn");
1410         *(void **)(&fns->_nss_getgrnam_r) =
1411                 nwrap_load_module_fn(b, "getgrnam_r");
1412         *(void **)(&fns->_nss_getgrgid_r)=
1413                 nwrap_load_module_fn(b, "getgrgid_r");
1414         *(void **)(&fns->_nss_setgrent) =
1415                 nwrap_load_module_fn(b, "setgrent");
1416         *(void **)(&fns->_nss_getgrent_r) =
1417                 nwrap_load_module_fn(b, "getgrent_r");
1418         *(void **)(&fns->_nss_endgrent) =
1419                 nwrap_load_module_fn(b, "endgrent");
1420
1421         return fns;
1422 }
1423
1424 static void *nwrap_load_module(const char *so_path)
1425 {
1426         void *h;
1427
1428         if (!so_path || !strlen(so_path)) {
1429                 return NULL;
1430         }
1431
1432         h = dlopen(so_path, RTLD_LAZY);
1433         if (!h) {
1434                 NWRAP_LOG(NWRAP_LOG_ERROR,
1435                           "Cannot open shared library %s",
1436                           so_path);
1437                 return NULL;
1438         }
1439
1440         return h;
1441 }
1442
1443 static bool nwrap_module_init(const char *name,
1444                               struct nwrap_ops *ops,
1445                               const char *so_path,
1446                               int *num_backends,
1447                               struct nwrap_backend **backends)
1448 {
1449         struct nwrap_backend *b;
1450
1451         *backends = (struct nwrap_backend *)realloc(*backends,
1452                 sizeof(struct nwrap_backend) * ((*num_backends) + 1));
1453         if (!*backends) {
1454                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
1455                 return false;
1456         }
1457
1458         b = &((*backends)[*num_backends]);
1459
1460         b->name = name;
1461         b->ops = ops;
1462         b->so_path = so_path;
1463
1464         if (so_path != NULL) {
1465                 b->so_handle = nwrap_load_module(so_path);
1466                 b->fns = nwrap_load_module_fns(b);
1467                 if (b->fns == NULL) {
1468                         return false;
1469                 }
1470         } else {
1471                 b->so_handle = NULL;
1472                 b->fns = NULL;
1473         }
1474
1475         (*num_backends)++;
1476
1477         return true;
1478 }
1479
1480 static void nwrap_libc_init(struct nwrap_main *r)
1481 {
1482         r->libc = malloc(sizeof(struct nwrap_libc));
1483         if (r->libc == NULL) {
1484                 printf("Failed to allocate memory for libc");
1485                 exit(-1);
1486         }
1487         ZERO_STRUCTP(r->libc);
1488
1489         r->libc->fns = malloc(sizeof(struct nwrap_libc_fns));
1490         if (r->libc->fns == NULL) {
1491                 printf("Failed to allocate memory for libc functions");
1492                 exit(-1);
1493         }
1494         ZERO_STRUCTP(r->libc->fns);
1495 }
1496
1497 static void nwrap_backend_init(struct nwrap_main *r)
1498 {
1499         const char *module_so_path = getenv("NSS_WRAPPER_MODULE_SO_PATH");
1500         const char *module_fn_name = getenv("NSS_WRAPPER_MODULE_FN_PREFIX");
1501
1502         r->num_backends = 0;
1503         r->backends = NULL;
1504
1505         if (!nwrap_module_init("files", &nwrap_files_ops, NULL,
1506                                &r->num_backends,
1507                                &r->backends)) {
1508                 NWRAP_LOG(NWRAP_LOG_ERROR,
1509                           "Failed to initialize 'files' backend");
1510                 return;
1511         }
1512
1513         if (module_so_path != NULL &&
1514             module_so_path[0] != '\0' &&
1515             module_fn_name != NULL &&
1516             module_fn_name[0] != '\0') {
1517                 if (!nwrap_module_init(module_fn_name,
1518                                        &nwrap_module_ops,
1519                                        module_so_path,
1520                                        &r->num_backends,
1521                                        &r->backends)) {
1522                         NWRAP_LOG(NWRAP_LOG_ERROR,
1523                                   "Failed to initialize '%s' backend",
1524                                   module_fn_name);
1525                         return;
1526                 }
1527         }
1528 }
1529
1530 static void nwrap_init(void)
1531 {
1532         const char *env;
1533         char *endptr;
1534         size_t max_hostents_tmp;
1535
1536         NWRAP_LOCK(nwrap_initialized);
1537         if (nwrap_initialized) {
1538                 NWRAP_UNLOCK(nwrap_initialized);
1539                 return;
1540         }
1541
1542         /*
1543          * Still holding nwrap_initialized lock here.
1544          * We don't use NWRAP_(UN)LOCK_ALL macros here because we
1545          * want to avoid overhead when other threads do their job.
1546          */
1547         NWRAP_LOCK(nwrap_global);
1548         NWRAP_LOCK(nwrap_gr_global);
1549         NWRAP_LOCK(nwrap_he_global);
1550         NWRAP_LOCK(nwrap_pw_global);
1551         NWRAP_LOCK(nwrap_sp_global);
1552
1553         nwrap_initialized = true;
1554
1555         /* Initialize pthread_atfork handlers */
1556         pthread_atfork(&nwrap_thread_prepare, &nwrap_thread_parent,
1557                        &nwrap_thread_child);
1558
1559         env = getenv("NSS_WRAPPER_MAX_HOSTENTS");
1560         if (env != NULL) {
1561                 max_hostents_tmp = (size_t)strtol(env, &endptr, 10);
1562                 if (((env != '\0') && (endptr == '\0')) ||
1563                     (max_hostents_tmp == 0)) {
1564                         NWRAP_LOG(NWRAP_LOG_DEBUG,
1565                                   "Error parsing NSS_WRAPPER_MAX_HOSTENTS "
1566                                   "value or value is too small. "
1567                                   "Using default value: %lu.",
1568                                   (unsigned long)max_hostents);
1569                 } else {
1570                         max_hostents = max_hostents_tmp;
1571                 }
1572         }
1573         /* Initialize hash table */
1574         NWRAP_LOG(NWRAP_LOG_DEBUG,
1575                   "Initializing hash table of size %lu items.",
1576                   (unsigned long)max_hostents);
1577         if (hcreate(max_hostents) == 0) {
1578                 NWRAP_LOG(NWRAP_LOG_ERROR,
1579                           "Failed to initialize hash table");
1580                 goto done;
1581         }
1582
1583         nwrap_main_global = &__nwrap_main_global;
1584
1585         nwrap_libc_init(nwrap_main_global);
1586
1587         nwrap_backend_init(nwrap_main_global);
1588
1589         /* passwd */
1590         nwrap_pw_global.cache = &__nwrap_cache_pw;
1591
1592         nwrap_pw_global.cache->path = getenv("NSS_WRAPPER_PASSWD");
1593         nwrap_pw_global.cache->fp = NULL;
1594         nwrap_pw_global.cache->fd = -1;
1595         nwrap_pw_global.cache->private_data = &nwrap_pw_global;
1596         nwrap_pw_global.cache->parse_line = nwrap_pw_parse_line;
1597         nwrap_pw_global.cache->unload = nwrap_pw_unload;
1598
1599         /* shadow */
1600 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
1601         nwrap_sp_global.cache = &__nwrap_cache_sp;
1602
1603         nwrap_sp_global.cache->path = getenv("NSS_WRAPPER_SHADOW");
1604         nwrap_sp_global.cache->fp = NULL;
1605         nwrap_sp_global.cache->fd = -1;
1606         nwrap_sp_global.cache->private_data = &nwrap_sp_global;
1607         nwrap_sp_global.cache->parse_line = nwrap_sp_parse_line;
1608         nwrap_sp_global.cache->unload = nwrap_sp_unload;
1609 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
1610
1611         /* group */
1612         nwrap_gr_global.cache = &__nwrap_cache_gr;
1613
1614         nwrap_gr_global.cache->path = getenv("NSS_WRAPPER_GROUP");
1615         nwrap_gr_global.cache->fp = NULL;
1616         nwrap_gr_global.cache->fd = -1;
1617         nwrap_gr_global.cache->private_data = &nwrap_gr_global;
1618         nwrap_gr_global.cache->parse_line = nwrap_gr_parse_line;
1619         nwrap_gr_global.cache->unload = nwrap_gr_unload;
1620
1621         /* hosts */
1622         nwrap_he_global.cache = &__nwrap_cache_he;
1623
1624         nwrap_he_global.cache->path = getenv("NSS_WRAPPER_HOSTS");
1625         nwrap_he_global.cache->fp = NULL;
1626         nwrap_he_global.cache->fd = -1;
1627         nwrap_he_global.cache->private_data = &nwrap_he_global;
1628         nwrap_he_global.cache->parse_line = nwrap_he_parse_line;
1629         nwrap_he_global.cache->unload = nwrap_he_unload;
1630
1631 done:
1632         /* We hold all locks here so we can use NWRAP_UNLOCK_ALL. */
1633         NWRAP_UNLOCK_ALL;
1634 }
1635
1636 bool nss_wrapper_enabled(void)
1637 {
1638         nwrap_init();
1639
1640         if (nwrap_pw_global.cache->path == NULL ||
1641             nwrap_pw_global.cache->path[0] == '\0') {
1642                 return false;
1643         }
1644         if (nwrap_gr_global.cache->path == NULL ||
1645             nwrap_gr_global.cache->path[0] == '\0') {
1646                 return false;
1647         }
1648
1649         return true;
1650 }
1651
1652 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
1653 bool nss_wrapper_shadow_enabled(void)
1654 {
1655         nwrap_init();
1656
1657         if (nwrap_sp_global.cache->path == NULL ||
1658             nwrap_sp_global.cache->path[0] == '\0') {
1659                 return false;
1660         }
1661
1662         return true;
1663 }
1664 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
1665
1666 bool nss_wrapper_hosts_enabled(void)
1667 {
1668         nwrap_init();
1669
1670         if (nwrap_he_global.cache->path == NULL ||
1671             nwrap_he_global.cache->path[0] == '\0') {
1672                 return false;
1673         }
1674
1675         return true;
1676 }
1677
1678 static bool nwrap_hostname_enabled(void)
1679 {
1680         nwrap_init();
1681
1682         if (getenv("NSS_WRAPPER_HOSTNAME") == NULL) {
1683                 return false;
1684         }
1685
1686         return true;
1687 }
1688
1689 static bool nwrap_parse_file(struct nwrap_cache *nwrap)
1690 {
1691         char *line = NULL;
1692         ssize_t n;
1693         /* Unused but getline needs it */
1694         size_t len;
1695         bool ok;
1696
1697         if (nwrap->st.st_size == 0) {
1698                 NWRAP_LOG(NWRAP_LOG_DEBUG, "size == 0");
1699                 return true;
1700         }
1701
1702         /* Support for 32-bit system I guess */
1703         if (nwrap->st.st_size > INT32_MAX) {
1704                 NWRAP_LOG(NWRAP_LOG_ERROR,
1705                           "Size[%u] larger than INT32_MAX",
1706                           (unsigned)nwrap->st.st_size);
1707                 return false;
1708         }
1709
1710         rewind(nwrap->fp);
1711
1712         do {
1713                 n = getline(&line, &len, nwrap->fp);
1714                 if (n < 0) {
1715                         SAFE_FREE(line);
1716                         if (feof(nwrap->fp)) {
1717                                 break;
1718                         }
1719
1720                         NWRAP_LOG(NWRAP_LOG_ERROR,
1721                                   "Unable to read line from file: %s",
1722                                   nwrap->path);
1723                         return false;
1724                 }
1725
1726                 if (line[n - 1] == '\n') {
1727                         line[n - 1] = '\0';
1728                 }
1729
1730                 if (line[0] == '\0') {
1731                         SAFE_FREE(line);
1732                         continue;
1733                 }
1734
1735                 ok = nwrap->parse_line(nwrap, line);
1736                 if (!ok) {
1737                         NWRAP_LOG(NWRAP_LOG_ERROR,
1738                                   "Unable to parse line file: %s",
1739                                   line);
1740                         SAFE_FREE(line);
1741                         return false;
1742                 }
1743
1744                 /* Line is parsed without issues so add it to list */
1745                 ok = nwrap_vector_add_item(&(nwrap->lines), (void *const) line);
1746                 if (!ok) {
1747                         NWRAP_LOG(NWRAP_LOG_ERROR,
1748                                   "Unable to add line to vector");
1749                         return false;
1750                 }
1751
1752                 /* This forces getline to allocate new memory for line. */
1753                 line = NULL;
1754         } while (!feof(nwrap->fp));
1755
1756         return true;
1757 }
1758
1759 static void nwrap_files_cache_unload(struct nwrap_cache *nwrap)
1760 {
1761         nwrap->unload(nwrap);
1762
1763         nwrap_lines_unload(nwrap);
1764 }
1765
1766 static bool nwrap_files_cache_reload(struct nwrap_cache *nwrap)
1767 {
1768         struct stat st;
1769         int ret;
1770         bool ok;
1771         bool retried = false;
1772
1773         assert(nwrap != NULL);
1774
1775 reopen:
1776         if (nwrap->fd < 0) {
1777                 nwrap->fp = fopen(nwrap->path, "re");
1778                 if (nwrap->fp == NULL) {
1779                         nwrap->fd = -1;
1780                         NWRAP_LOG(NWRAP_LOG_ERROR,
1781                                   "Unable to open '%s' readonly %d:%s",
1782                                   nwrap->path, nwrap->fd,
1783                                   strerror(errno));
1784                         return false;
1785
1786                 }
1787                 nwrap->fd = fileno(nwrap->fp);
1788                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Open '%s'", nwrap->path);
1789         }
1790
1791         ret = fstat(nwrap->fd, &st);
1792         if (ret != 0) {
1793                 NWRAP_LOG(NWRAP_LOG_ERROR,
1794                           "fstat(%s) - %d:%s",
1795                           nwrap->path,
1796                           ret,
1797                           strerror(errno));
1798                 fclose(nwrap->fp);
1799                 nwrap->fp = NULL;
1800                 nwrap->fd = -1;
1801                 return false;
1802         }
1803
1804         if (retried == false && st.st_nlink == 0) {
1805                 /* maybe someone has replaced the file... */
1806                 NWRAP_LOG(NWRAP_LOG_TRACE,
1807                           "st_nlink == 0, reopen %s",
1808                           nwrap->path);
1809                 retried = true;
1810                 memset(&nwrap->st, 0, sizeof(nwrap->st));
1811                 fclose(nwrap->fp);
1812                 nwrap->fp = NULL;
1813                 nwrap->fd = -1;
1814                 goto reopen;
1815         }
1816
1817         if (st.st_mtime == nwrap->st.st_mtime) {
1818                 NWRAP_LOG(NWRAP_LOG_TRACE,
1819                           "st_mtime[%u] hasn't changed, skip reload",
1820                           (unsigned)st.st_mtime);
1821                 return true;
1822         }
1823
1824         NWRAP_LOG(NWRAP_LOG_TRACE,
1825                   "st_mtime has changed [%u] => [%u], start reload",
1826                   (unsigned)st.st_mtime,
1827                   (unsigned)nwrap->st.st_mtime);
1828
1829         nwrap->st = st;
1830
1831         nwrap_files_cache_unload(nwrap);
1832
1833         ok = nwrap_parse_file(nwrap);
1834         if (!ok) {
1835                 NWRAP_LOG(NWRAP_LOG_ERROR, "Failed to reload %s", nwrap->path);
1836                 nwrap_files_cache_unload(nwrap);
1837                 return false;
1838         }
1839
1840         NWRAP_LOG(NWRAP_LOG_TRACE, "Reloaded %s", nwrap->path);
1841         return true;
1842 }
1843
1844 /*
1845  * the caller has to call nwrap_unload() on failure
1846  */
1847 static bool nwrap_pw_parse_line(struct nwrap_cache *nwrap, char *line)
1848 {
1849         struct nwrap_pw *nwrap_pw;
1850         char *c;
1851         char *p;
1852         char *e;
1853         struct passwd *pw;
1854         size_t list_size;
1855
1856         nwrap_pw = (struct nwrap_pw *)nwrap->private_data;
1857
1858         list_size = sizeof(*nwrap_pw->list) * (nwrap_pw->num+1);
1859         pw = (struct passwd *)realloc(nwrap_pw->list, list_size);
1860         if (!pw) {
1861                 NWRAP_LOG(NWRAP_LOG_ERROR,
1862                           "realloc(%u) failed",
1863                           (unsigned)list_size);
1864                 return false;
1865         }
1866         nwrap_pw->list = pw;
1867
1868         pw = &nwrap_pw->list[nwrap_pw->num];
1869
1870         c = line;
1871
1872         /* name */
1873         p = strchr(c, ':');
1874         if (!p) {
1875                 NWRAP_LOG(NWRAP_LOG_ERROR,
1876                           "Invalid line[%s]: '%s'",
1877                           line,
1878                           c);
1879                 return false;
1880         }
1881         *p = '\0';
1882         p++;
1883         pw->pw_name = c;
1884         c = p;
1885
1886         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]\n", pw->pw_name);
1887
1888         /* password */
1889         p = strchr(c, ':');
1890         if (!p) {
1891                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1892                 return false;
1893         }
1894         *p = '\0';
1895         p++;
1896         pw->pw_passwd = c;
1897         c = p;
1898
1899         NWRAP_LOG(NWRAP_LOG_TRACE, "password[%s]\n", pw->pw_passwd);
1900
1901         /* uid */
1902         p = strchr(c, ':');
1903         if (!p) {
1904                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1905                 return false;
1906         }
1907         *p = '\0';
1908         p++;
1909         e = NULL;
1910         pw->pw_uid = (uid_t)strtoul(c, &e, 10);
1911         if (c == e) {
1912                 NWRAP_LOG(NWRAP_LOG_ERROR,
1913                           "Invalid line[%s]: '%s' - %s",
1914                           line, c, strerror(errno));
1915                 return false;
1916         }
1917         if (e == NULL) {
1918                 NWRAP_LOG(NWRAP_LOG_ERROR,
1919                           "Invalid line[%s]: '%s' - %s",
1920                           line, c, strerror(errno));
1921                 return false;
1922         }
1923         if (e[0] != '\0') {
1924                 NWRAP_LOG(NWRAP_LOG_ERROR,
1925                           "Invalid line[%s]: '%s' - %s",
1926                           line, c, strerror(errno));
1927                 return false;
1928         }
1929         c = p;
1930
1931         NWRAP_LOG(NWRAP_LOG_TRACE, "uid[%u]", pw->pw_uid);
1932
1933         /* gid */
1934         p = strchr(c, ':');
1935         if (!p) {
1936                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1937                 return false;
1938         }
1939         *p = '\0';
1940         p++;
1941         e = NULL;
1942         pw->pw_gid = (gid_t)strtoul(c, &e, 10);
1943         if (c == e) {
1944                 NWRAP_LOG(NWRAP_LOG_ERROR,
1945                           "Invalid line[%s]: '%s' - %s",
1946                           line, c, strerror(errno));
1947                 return false;
1948         }
1949         if (e == NULL) {
1950                 NWRAP_LOG(NWRAP_LOG_ERROR,
1951                           "Invalid line[%s]: '%s' - %s",
1952                           line, c, strerror(errno));
1953                 return false;
1954         }
1955         if (e[0] != '\0') {
1956                 NWRAP_LOG(NWRAP_LOG_ERROR,
1957                           "Invalid line[%s]: '%s' - %s",
1958                           line, c, strerror(errno));
1959                 return false;
1960         }
1961         c = p;
1962
1963         NWRAP_LOG(NWRAP_LOG_TRACE, "gid[%u]\n", pw->pw_gid);
1964
1965         /* gecos */
1966         p = strchr(c, ':');
1967         if (!p) {
1968                 NWRAP_LOG(NWRAP_LOG_ERROR, "invalid line[%s]: '%s'", line, c);
1969                 return false;
1970         }
1971         *p = '\0';
1972         p++;
1973         pw->pw_gecos = c;
1974         c = p;
1975
1976         NWRAP_LOG(NWRAP_LOG_TRACE, "gecos[%s]", pw->pw_gecos);
1977
1978         /* dir */
1979         p = strchr(c, ':');
1980         if (!p) {
1981                 NWRAP_LOG(NWRAP_LOG_ERROR, "'%s'", c);
1982                 return false;
1983         }
1984         *p = '\0';
1985         p++;
1986         pw->pw_dir = c;
1987         c = p;
1988
1989         NWRAP_LOG(NWRAP_LOG_TRACE, "dir[%s]", pw->pw_dir);
1990
1991         /* shell */
1992         pw->pw_shell = c;
1993         NWRAP_LOG(NWRAP_LOG_TRACE, "shell[%s]", pw->pw_shell);
1994
1995         NWRAP_LOG(NWRAP_LOG_DEBUG,
1996                   "Added user[%s:%s:%u:%u:%s:%s:%s]",
1997                   pw->pw_name, pw->pw_passwd,
1998                   pw->pw_uid, pw->pw_gid,
1999                   pw->pw_gecos, pw->pw_dir, pw->pw_shell);
2000
2001         nwrap_pw->num++;
2002         return true;
2003 }
2004
2005 static void nwrap_pw_unload(struct nwrap_cache *nwrap)
2006 {
2007         struct nwrap_pw *nwrap_pw;
2008         nwrap_pw = (struct nwrap_pw *)nwrap->private_data;
2009
2010         SAFE_FREE(nwrap_pw->list);
2011         nwrap_pw->num = 0;
2012         nwrap_pw->idx = 0;
2013 }
2014
2015 static int nwrap_pw_copy_r(const struct passwd *src, struct passwd *dst,
2016                            char *buf, size_t buflen, struct passwd **dstp)
2017 {
2018         char *first;
2019         char *last;
2020         off_t ofs;
2021
2022         first = src->pw_name;
2023
2024         last = src->pw_shell;
2025         while (*last) last++;
2026
2027         ofs = PTR_DIFF(last + 1, first);
2028
2029         if (ofs > (off_t) buflen) {
2030                 return ERANGE;
2031         }
2032
2033         memcpy(buf, first, ofs);
2034
2035         ofs = PTR_DIFF(src->pw_name, first);
2036         dst->pw_name = buf + ofs;
2037         ofs = PTR_DIFF(src->pw_passwd, first);
2038         dst->pw_passwd = buf + ofs;
2039         dst->pw_uid = src->pw_uid;
2040         dst->pw_gid = src->pw_gid;
2041         ofs = PTR_DIFF(src->pw_gecos, first);
2042         dst->pw_gecos = buf + ofs;
2043         ofs = PTR_DIFF(src->pw_dir, first);
2044         dst->pw_dir = buf + ofs;
2045         ofs = PTR_DIFF(src->pw_shell, first);
2046         dst->pw_shell = buf + ofs;
2047
2048         if (dstp) {
2049                 *dstp = dst;
2050         }
2051
2052         return 0;
2053 }
2054
2055 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
2056 static bool nwrap_sp_parse_line(struct nwrap_cache *nwrap, char *line)
2057 {
2058         struct nwrap_sp *nwrap_sp;
2059         struct spwd *sp;
2060         size_t list_size;
2061         char *c;
2062         char *e;
2063         char *p;
2064
2065         nwrap_sp = (struct nwrap_sp *)nwrap->private_data;
2066
2067         list_size = sizeof(*nwrap_sp->list) * (nwrap_sp->num+1);
2068         sp = (struct spwd *)realloc(nwrap_sp->list, list_size);
2069         if (sp == NULL) {
2070                 NWRAP_LOG(NWRAP_LOG_ERROR,
2071                           "realloc(%u) failed",
2072                           (unsigned)list_size);
2073                 return false;
2074         }
2075         nwrap_sp->list = sp;
2076
2077         sp = &nwrap_sp->list[nwrap_sp->num];
2078
2079         c = line;
2080
2081         /* name */
2082         p = strchr(c, ':');
2083         if (p == NULL) {
2084                 NWRAP_LOG(NWRAP_LOG_ERROR,
2085                           "name -- Invalid line[%s]: '%s'",
2086                           line,
2087                           c);
2088                 return false;
2089         }
2090         *p = '\0';
2091         p++;
2092         sp->sp_namp = c;
2093         c = p;
2094
2095         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]\n", sp->sp_namp);
2096
2097         /* pwd */
2098         p = strchr(c, ':');
2099         if (p == NULL) {
2100                 NWRAP_LOG(NWRAP_LOG_ERROR,
2101                           "pwd -- Invalid line[%s]: '%s'",
2102                           line,
2103                           c);
2104                 return false;
2105         }
2106         *p = '\0';
2107         p++;
2108         sp->sp_pwdp = c;
2109         c = p;
2110
2111         /* lstchg (long) */
2112         if (c[0] == ':') {
2113                 sp->sp_lstchg = -1;
2114                 p++;
2115         } else {
2116                 p = strchr(c, ':');
2117                 if (p == NULL) {
2118                         NWRAP_LOG(NWRAP_LOG_ERROR,
2119                                   "lstchg -- Invalid line[%s]: '%s'",
2120                                   line,
2121                                   c);
2122                         return false;
2123                 }
2124                 *p = '\0';
2125                 p++;
2126                 sp->sp_lstchg = strtol(c, &e, 10);
2127                 if (c == e) {
2128                         NWRAP_LOG(NWRAP_LOG_ERROR,
2129                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2130                                   line, c, strerror(errno));
2131                         return false;
2132                 }
2133                 if (e == NULL) {
2134                         NWRAP_LOG(NWRAP_LOG_ERROR,
2135                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2136                                   line, c, strerror(errno));
2137                         return false;
2138                 }
2139                 if (e[0] != '\0') {
2140                         NWRAP_LOG(NWRAP_LOG_ERROR,
2141                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2142                                   line, c, strerror(errno));
2143                         return false;
2144                 }
2145         }
2146         c = p;
2147
2148         /* min (long) */
2149         if (c[0] == ':') {
2150                 sp->sp_min = -1;
2151                 p++;
2152         } else {
2153                 p = strchr(c, ':');
2154                 if (p == NULL) {
2155                         NWRAP_LOG(NWRAP_LOG_ERROR,
2156                                   "min -- Invalid line[%s]: '%s'",
2157                                   line,
2158                                   c);
2159                         return false;
2160                 }
2161                 *p = '\0';
2162                 p++;
2163                 sp->sp_min = strtol(c, &e, 10);
2164                 if (c == e) {
2165                         NWRAP_LOG(NWRAP_LOG_ERROR,
2166                                   "min -- Invalid line[%s]: '%s' - %s",
2167                                   line, c, strerror(errno));
2168                         return false;
2169                 }
2170                 if (e == NULL) {
2171                         NWRAP_LOG(NWRAP_LOG_ERROR,
2172                                   "min -- Invalid line[%s]: '%s' - %s",
2173                                   line, c, strerror(errno));
2174                         return false;
2175                 }
2176                 if (e[0] != '\0') {
2177                         NWRAP_LOG(NWRAP_LOG_ERROR,
2178                                   "min -- Invalid line[%s]: '%s' - %s",
2179                                   line, c, strerror(errno));
2180                         return false;
2181                 }
2182         }
2183         c = p;
2184
2185         /* max (long) */
2186         if (c[0] == ':') {
2187                 sp->sp_max = -1;
2188                 p++;
2189         } else {
2190                 p = strchr(c, ':');
2191                 if (p == NULL) {
2192                         NWRAP_LOG(NWRAP_LOG_ERROR,
2193                                   "max -- Invalid line[%s]: '%s'",
2194                                   line,
2195                                   c);
2196                         return false;
2197                 }
2198                 *p = '\0';
2199                 p++;
2200                 sp->sp_max = strtol(c, &e, 10);
2201                 if (c == e) {
2202                         NWRAP_LOG(NWRAP_LOG_ERROR,
2203                                   "max -- Invalid line[%s]: '%s' - %s",
2204                                   line, c, strerror(errno));
2205                         return false;
2206                 }
2207                 if (e == NULL) {
2208                         NWRAP_LOG(NWRAP_LOG_ERROR,
2209                                   "max -- Invalid line[%s]: '%s' - %s",
2210                                   line, c, strerror(errno));
2211                         return false;
2212                 }
2213                 if (e[0] != '\0') {
2214                         NWRAP_LOG(NWRAP_LOG_ERROR,
2215                                   "max -- Invalid line[%s]: '%s' - %s",
2216                                   line, c, strerror(errno));
2217                         return false;
2218                 }
2219         }
2220         c = p;
2221
2222         /* warn (long) */
2223         if (c[0] == ':') {
2224                 sp->sp_warn = -1;
2225                 p++;
2226         } else {
2227                 p = strchr(c, ':');
2228                 if (p == NULL) {
2229                         NWRAP_LOG(NWRAP_LOG_ERROR,
2230                                   "warn -- Invalid line[%s]: '%s'",
2231                                   line,
2232                                   c);
2233                         return false;
2234                 }
2235                 *p = '\0';
2236                 p++;
2237                 sp->sp_warn = strtol(c, &e, 10);
2238                 if (c == e) {
2239                         NWRAP_LOG(NWRAP_LOG_ERROR,
2240                                   "warn -- Invalid line[%s]: '%s' - %s",
2241                                   line, c, strerror(errno));
2242                         return false;
2243                 }
2244                 if (e == NULL) {
2245                         NWRAP_LOG(NWRAP_LOG_ERROR,
2246                                   "warn -- Invalid line[%s]: '%s' - %s",
2247                                   line, c, strerror(errno));
2248                         return false;
2249                 }
2250                 if (e[0] != '\0') {
2251                         NWRAP_LOG(NWRAP_LOG_ERROR,
2252                                   "warn -- Invalid line[%s]: '%s' - %s",
2253                                   line, c, strerror(errno));
2254                         return false;
2255                 }
2256         }
2257         c = p;
2258
2259         /* inact (long) */
2260         if (c[0] == ':') {
2261                 sp->sp_inact = -1;
2262                 p++;
2263         } else {
2264                 p = strchr(c, ':');
2265                 if (p == NULL) {
2266                         NWRAP_LOG(NWRAP_LOG_ERROR,
2267                                   "inact -- Invalid line[%s]: '%s'",
2268                                   line,
2269                                   c);
2270                         return false;
2271                 }
2272                 *p = '\0';
2273                 p++;
2274                 sp->sp_inact = strtol(c, &e, 10);
2275                 if (c == e) {
2276                         NWRAP_LOG(NWRAP_LOG_ERROR,
2277                                   "inact -- Invalid line[%s]: '%s' - %s",
2278                                   line, c, strerror(errno));
2279                         return false;
2280                 }
2281                 if (e == NULL) {
2282                         NWRAP_LOG(NWRAP_LOG_ERROR,
2283                                   "inact -- Invalid line[%s]: '%s' - %s",
2284                                   line, c, strerror(errno));
2285                         return false;
2286                 }
2287                 if (e[0] != '\0') {
2288                         NWRAP_LOG(NWRAP_LOG_ERROR,
2289                                   "inact -- Invalid line[%s]: '%s' - %s",
2290                                   line, c, strerror(errno));
2291                         return false;
2292                 }
2293         }
2294         c = p;
2295
2296         /* expire (long) */
2297         if (c[0] == ':') {
2298                 sp->sp_expire = -1;
2299                 p++;
2300         } else {
2301                 p = strchr(c, ':');
2302                 if (p == NULL) {
2303                         NWRAP_LOG(NWRAP_LOG_ERROR,
2304                                   "expire -- Invalid line[%s]: '%s'",
2305                                   line,
2306                                   c);
2307                         return false;
2308                 }
2309                 *p = '\0';
2310                 p++;
2311                 sp->sp_expire = strtol(c, &e, 10);
2312                 if (c == e) {
2313                         NWRAP_LOG(NWRAP_LOG_ERROR,
2314                                   "expire -- Invalid line[%s]: '%s' - %s",
2315                                   line, c, strerror(errno));
2316                         return false;
2317                 }
2318                 if (e == NULL) {
2319                         NWRAP_LOG(NWRAP_LOG_ERROR,
2320                                   "expire -- Invalid line[%s]: '%s' - %s",
2321                                   line, c, strerror(errno));
2322                         return false;
2323                 }
2324                 if (e[0] != '\0') {
2325                         NWRAP_LOG(NWRAP_LOG_ERROR,
2326                                   "expire -- Invalid line[%s]: '%s' - %s",
2327                                   line, c, strerror(errno));
2328                         return false;
2329                 }
2330         }
2331         c = p;
2332
2333         nwrap_sp->num++;
2334         return true;
2335 }
2336
2337 static void nwrap_sp_unload(struct nwrap_cache *nwrap)
2338 {
2339         struct nwrap_sp *nwrap_sp;
2340         nwrap_sp = (struct nwrap_sp *)nwrap->private_data;
2341
2342         SAFE_FREE(nwrap_sp->list);
2343         nwrap_sp->num = 0;
2344         nwrap_sp->idx = 0;
2345 }
2346 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
2347
2348 /*
2349  * the caller has to call nwrap_unload() on failure
2350  */
2351 static bool nwrap_gr_parse_line(struct nwrap_cache *nwrap, char *line)
2352 {
2353         struct nwrap_gr *nwrap_gr;
2354         char *c;
2355         char *p;
2356         char *e;
2357         struct group *gr;
2358         size_t list_size;
2359         unsigned nummem;
2360
2361         nwrap_gr = (struct nwrap_gr *)nwrap->private_data;
2362
2363         list_size = sizeof(*nwrap_gr->list) * (nwrap_gr->num+1);
2364         gr = (struct group *)realloc(nwrap_gr->list, list_size);
2365         if (!gr) {
2366                 NWRAP_LOG(NWRAP_LOG_ERROR, "realloc failed");
2367                 return false;
2368         }
2369         nwrap_gr->list = gr;
2370
2371         gr = &nwrap_gr->list[nwrap_gr->num];
2372
2373         c = line;
2374
2375         /* name */
2376         p = strchr(c, ':');
2377         if (!p) {
2378                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2379                 return false;
2380         }
2381         *p = '\0';
2382         p++;
2383         gr->gr_name = c;
2384         c = p;
2385
2386         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]", gr->gr_name);
2387
2388         /* password */
2389         p = strchr(c, ':');
2390         if (!p) {
2391                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2392                 return false;
2393         }
2394         *p = '\0';
2395         p++;
2396         gr->gr_passwd = c;
2397         c = p;
2398
2399         NWRAP_LOG(NWRAP_LOG_TRACE, "password[%s]", gr->gr_passwd);
2400
2401         /* gid */
2402         p = strchr(c, ':');
2403         if (!p) {
2404                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2405                 return false;
2406         }
2407         *p = '\0';
2408         p++;
2409         e = NULL;
2410         gr->gr_gid = (gid_t)strtoul(c, &e, 10);
2411         if (c == e) {
2412                 NWRAP_LOG(NWRAP_LOG_ERROR,
2413                           "Invalid line[%s]: '%s' - %s",
2414                           line, c, strerror(errno));
2415                 return false;
2416         }
2417         if (e == NULL) {
2418                 NWRAP_LOG(NWRAP_LOG_ERROR,
2419                           "Invalid line[%s]: '%s' - %s",
2420                           line, c, strerror(errno));
2421                 return false;
2422         }
2423         if (e[0] != '\0') {
2424                 NWRAP_LOG(NWRAP_LOG_ERROR,
2425                           "Invalid line[%s]: '%s' - %s",
2426                           line, c, strerror(errno));
2427                 return false;
2428         }
2429         c = p;
2430
2431         NWRAP_LOG(NWRAP_LOG_TRACE, "gid[%u]", gr->gr_gid);
2432
2433         /* members */
2434         gr->gr_mem = (char **)malloc(sizeof(char *));
2435         if (!gr->gr_mem) {
2436                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
2437                 return false;
2438         }
2439         gr->gr_mem[0] = NULL;
2440
2441         for(nummem=0; p; nummem++) {
2442                 char **m;
2443                 size_t m_size;
2444                 c = p;
2445                 p = strchr(c, ',');
2446                 if (p) {
2447                         *p = '\0';
2448                         p++;
2449                 }
2450
2451                 if (strlen(c) == 0) {
2452                         break;
2453                 }
2454
2455                 m_size = sizeof(char *) * (nummem+2);
2456                 m = (char **)realloc(gr->gr_mem, m_size);
2457                 if (!m) {
2458                         NWRAP_LOG(NWRAP_LOG_ERROR,
2459                                   "realloc(%zd) failed",
2460                                   m_size);
2461                         return false;
2462                 }
2463                 gr->gr_mem = m;
2464                 gr->gr_mem[nummem] = c;
2465                 gr->gr_mem[nummem+1] = NULL;
2466
2467                 NWRAP_LOG(NWRAP_LOG_TRACE,
2468                           "member[%u]: '%s'",
2469                           nummem, gr->gr_mem[nummem]);
2470         }
2471
2472         NWRAP_LOG(NWRAP_LOG_DEBUG,
2473                   "Added group[%s:%s:%u:] with %u members",
2474                   gr->gr_name, gr->gr_passwd, gr->gr_gid, nummem);
2475
2476         nwrap_gr->num++;
2477         return true;
2478 }
2479
2480 static void nwrap_gr_unload(struct nwrap_cache *nwrap)
2481 {
2482         int i;
2483         struct nwrap_gr *nwrap_gr;
2484         nwrap_gr = (struct nwrap_gr *)nwrap->private_data;
2485
2486         if (nwrap_gr->list) {
2487                 for (i=0; i < nwrap_gr->num; i++) {
2488                         SAFE_FREE(nwrap_gr->list[i].gr_mem);
2489                 }
2490                 SAFE_FREE(nwrap_gr->list);
2491         }
2492
2493         nwrap_gr->num = 0;
2494         nwrap_gr->idx = 0;
2495 }
2496
2497 static int nwrap_gr_copy_r(const struct group *src, struct group *dst,
2498                            char *buf, size_t buflen, struct group **dstp)
2499 {
2500         char *first;
2501         char **lastm;
2502         char *last = NULL;
2503         off_t ofsb;
2504         off_t ofsm;
2505         off_t ofs;
2506         unsigned i;
2507
2508         first = src->gr_name;
2509
2510         lastm = src->gr_mem;
2511         while (*lastm) {
2512                 last = *lastm;
2513                 lastm++;
2514         }
2515
2516         if (last == NULL) {
2517                 last = src->gr_passwd;
2518         }
2519         while (*last) last++;
2520
2521         ofsb = PTR_DIFF(last + 1, first);
2522         ofsm = PTR_DIFF(lastm + 1, src->gr_mem);
2523
2524         if ((ofsb + ofsm) > (off_t) buflen) {
2525                 return ERANGE;
2526         }
2527
2528         memcpy(buf, first, ofsb);
2529         memcpy(buf + ofsb, src->gr_mem, ofsm);
2530
2531         ofs = PTR_DIFF(src->gr_name, first);
2532         dst->gr_name = buf + ofs;
2533         ofs = PTR_DIFF(src->gr_passwd, first);
2534         dst->gr_passwd = buf + ofs;
2535         dst->gr_gid = src->gr_gid;
2536
2537         dst->gr_mem = (char **)(buf + ofsb);
2538         for (i=0; src->gr_mem[i]; i++) {
2539                 ofs = PTR_DIFF(src->gr_mem[i], first);
2540                 dst->gr_mem[i] = buf + ofs;
2541         }
2542
2543         if (dstp) {
2544                 *dstp = dst;
2545         }
2546
2547         return 0;
2548 }
2549
2550 static struct nwrap_entlist *nwrap_entlist_init(struct nwrap_entdata *ed)
2551 {
2552         struct nwrap_entlist *el;
2553
2554         if (ed == NULL) {
2555                 NWRAP_LOG(NWRAP_LOG_ERROR,
2556                           "entry is NULL, can't create list item");
2557                 return NULL;
2558         }
2559
2560         el = (struct nwrap_entlist *)malloc(sizeof(struct nwrap_entlist));
2561         if (el == NULL) {
2562                 NWRAP_LOG(NWRAP_LOG_ERROR, "malloc failed");
2563                 return NULL;
2564         }
2565
2566         el->next = NULL;
2567         el->ed = ed;
2568
2569         return el;
2570 }
2571
2572 static bool nwrap_ed_inventarize_add_new(char *const h_name,
2573                                          struct nwrap_entdata *const ed)
2574 {
2575         ENTRY e;
2576         ENTRY *p;
2577         struct nwrap_entlist *el;
2578
2579         if (h_name == NULL) {
2580                 NWRAP_LOG(NWRAP_LOG_ERROR, "h_name NULL - can't add");
2581                 return false;
2582         }
2583
2584         el = nwrap_entlist_init(ed);
2585         if (el == NULL) {
2586                 return false;
2587         }
2588
2589         e.key = h_name;
2590         e.data = (void *)el;
2591
2592         p = hsearch(e, ENTER);
2593         if (p == NULL) {
2594                 NWRAP_LOG(NWRAP_LOG_ERROR, "Hash table is full!");
2595                 return false;
2596         }
2597
2598         return true;
2599 }
2600
2601 static bool nwrap_ed_inventarize_add_to_existing(struct nwrap_entdata *const ed,
2602                                                  struct nwrap_entlist *const el)
2603 {
2604         struct nwrap_entlist *cursor;
2605         struct nwrap_entlist *el_new;
2606
2607         if (el == NULL) {
2608                 NWRAP_LOG(NWRAP_LOG_ERROR, "list is NULL, can not add");
2609                 return false;
2610         }
2611
2612
2613         for (cursor = el; cursor->next != NULL; cursor = cursor->next)
2614         {
2615                 if (cursor->ed == ed) {
2616                         return false;
2617                 }
2618         }
2619
2620         if (cursor->ed == ed) {
2621                 return false;
2622         }
2623
2624         el_new = nwrap_entlist_init(ed);
2625         if (el_new == NULL) {
2626                 return false;
2627         }
2628
2629         cursor->next = el_new;
2630         return true;
2631 }
2632
2633 static bool nwrap_ed_inventarize(char *const name,
2634                                  struct nwrap_entdata *const ed)
2635 {
2636         ENTRY e;
2637         ENTRY *p;
2638         bool ok;
2639
2640         e.key = name;
2641         e.data = NULL;
2642
2643         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching name: %s", e.key);
2644
2645         p = hsearch(e, FIND);
2646         if (p == NULL) {
2647                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found. Adding...", name);
2648                 ok = nwrap_ed_inventarize_add_new(name, ed);
2649         } else {
2650                 struct nwrap_entlist *el = (struct nwrap_entlist *)p->data;
2651
2652                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s found. Add record to list.", name);
2653                 ok = nwrap_ed_inventarize_add_to_existing(ed, el);
2654         }
2655
2656         return ok;
2657 }
2658
2659 static bool nwrap_add_hname(struct nwrap_entdata *const ed)
2660 {
2661         char *const h_name = (char *const)(ed->ht.h_name);
2662         unsigned i;
2663         bool ok;
2664
2665         ok = nwrap_ed_inventarize(h_name, ed);
2666         if (!ok) {
2667                 return false;
2668         }
2669
2670         if (ed->ht.h_aliases == NULL) {
2671                 return true;
2672         }
2673
2674         /* Itemize aliases */
2675         for (i = 0; ed->ht.h_aliases[i] != NULL; ++i) {
2676                 char *h_name_alias;
2677
2678                 h_name_alias = ed->ht.h_aliases[i];
2679
2680                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Add alias: %s", h_name_alias);
2681
2682                 if (!nwrap_ed_inventarize(h_name_alias, ed)) {
2683                         NWRAP_LOG(NWRAP_LOG_ERROR,
2684                                   "Unable to add alias: %s", h_name_alias);
2685                         return false;
2686                 }
2687         }
2688
2689         return true;
2690 }
2691
2692 static bool nwrap_he_parse_line(struct nwrap_cache *nwrap, char *line)
2693 {
2694         struct nwrap_he *nwrap_he = (struct nwrap_he *)nwrap->private_data;
2695         bool do_aliases = true;
2696         ssize_t aliases_count = 0;
2697         char *p;
2698         char *i;
2699         char *n;
2700
2701         char *ip;
2702         bool ok;
2703
2704         struct nwrap_entdata *ed = (struct nwrap_entdata *)
2705                                    malloc(sizeof(struct nwrap_entdata));
2706         if (ed == NULL) {
2707                 NWRAP_LOG(NWRAP_LOG_ERROR,
2708                           "Unable to allocate memory for nwrap_entdata");
2709                 return false;
2710         }
2711         ZERO_STRUCTP(ed);
2712
2713         i = line;
2714
2715         /*
2716          * IP
2717          */
2718
2719         /* Walk to first char */
2720         for (p = i; *p != '.' && *p != ':' && !isxdigit((int) *p); p++) {
2721                 if (*p == '\0') {
2722                         NWRAP_LOG(NWRAP_LOG_ERROR,
2723                                   "Invalid line[%s]: '%s'",
2724                                   line, i);
2725                         free(ed);
2726                         return false;
2727                 }
2728         }
2729
2730         for (i = p; !isspace((int)*p); p++) {
2731                 if (*p == '\0') {
2732                         NWRAP_LOG(NWRAP_LOG_ERROR,
2733                                   "Invalid line[%s]: '%s'",
2734                                   line, i);
2735                         free(ed);
2736                         return false;
2737                 }
2738         }
2739
2740         *p = '\0';
2741
2742         if (inet_pton(AF_INET, i, ed->addr.host_addr)) {
2743                 ed->ht.h_addrtype = AF_INET;
2744                 ed->ht.h_length = 4;
2745 #ifdef HAVE_IPV6
2746         } else if (inet_pton(AF_INET6, i, ed->addr.host_addr)) {
2747                 ed->ht.h_addrtype = AF_INET6;
2748                 ed->ht.h_length = 16;
2749 #endif
2750         } else {
2751                 NWRAP_LOG(NWRAP_LOG_ERROR,
2752                           "Invalid line[%s]: '%s'",
2753                           line, i);
2754
2755                 free(ed);
2756                 return false;
2757         }
2758         ip = i;
2759
2760         ok = nwrap_vector_add_item(&(ed->nwrap_addrdata),
2761                                    (void *const)ed->addr.host_addr);
2762         if (!ok) {
2763                 NWRAP_LOG(NWRAP_LOG_ERROR, "Unable to add addrdata to vector");
2764                 free(ed);
2765                 return false;
2766         }
2767         ed->ht.h_addr_list = nwrap_vector_head(&ed->nwrap_addrdata);
2768
2769         p++;
2770
2771         /*
2772          * FQDN
2773          */
2774
2775         /* Walk to first char */
2776         for (n = p; *p != '_' && !isalnum((int) *p); p++) {
2777                 if (*p == '\0') {
2778                         NWRAP_LOG(NWRAP_LOG_ERROR,
2779                                   "Invalid line[%s]: '%s'",
2780                                   line, n);
2781
2782                         free(ed);
2783                         return false;
2784                 }
2785         }
2786
2787         for (n = p; !isspace((int)*p); p++) {
2788                 if (*p == '\0') {
2789                         do_aliases = false;
2790                         break;
2791                 }
2792         }
2793
2794         *p = '\0';
2795
2796         /* Convert to lowercase. This operate on same memory region */
2797         str_tolower(n, n);
2798         ed->ht.h_name = n;
2799
2800         /* glib's getent always dereferences he->h_aliases */
2801         ed->ht.h_aliases = malloc(sizeof(char *));
2802         if (ed->ht.h_aliases == NULL) {
2803                 free(ed);
2804                 return false;
2805         }
2806         ed->ht.h_aliases[0] = NULL;
2807
2808         /*
2809          * Aliases
2810          */
2811         while (do_aliases) {
2812                 char **aliases;
2813                 char *a;
2814
2815                 p++;
2816
2817                 /* Walk to first char */
2818                 for (a = p; *p != '_' && !isalnum((int) *p); p++) {
2819                         if (*p == '\0') {
2820                                 do_aliases = false;
2821                                 break;
2822                         }
2823                 }
2824                 /* Only trailing spaces are left */
2825                 if (!do_aliases) {
2826                         break;
2827                 }
2828
2829                 for (a = p; !isspace((int)*p); p++) {
2830                         if (*p == '\0') {
2831                                 do_aliases = false;
2832                                 break;
2833                         }
2834                 }
2835
2836                 *p = '\0';
2837
2838                 aliases = realloc(ed->ht.h_aliases, sizeof(char *) * (aliases_count + 2));
2839                 if (aliases == NULL) {
2840                         free(ed);
2841                         return false;
2842                 }
2843                 ed->ht.h_aliases = aliases;
2844
2845                 str_tolower(a, a);
2846                 aliases[aliases_count] = a;
2847                 aliases[aliases_count + 1] = NULL;
2848
2849                 aliases_count += 1;
2850         }
2851
2852         ok = nwrap_vector_add_item(&(nwrap_he->entries), (void *const)ed);
2853         if (!ok) {
2854                 NWRAP_LOG(NWRAP_LOG_ERROR, "Unable to add entry to vector");
2855                 free(ed);
2856                 return false;
2857         }
2858
2859         ed->aliases_count = aliases_count;
2860         /* Inventarize item */
2861         ok = nwrap_add_hname(ed);
2862         if (!ok) {
2863                 return false;
2864         }
2865
2866         ok = nwrap_ed_inventarize(ip, ed);
2867         if (!ok) {
2868                 return false;
2869         }
2870
2871         nwrap_he->num++;
2872         return true;
2873 }
2874
2875 static void nwrap_he_unload(struct nwrap_cache *nwrap)
2876 {
2877         struct nwrap_he *nwrap_he =
2878                 (struct nwrap_he *)nwrap->private_data;
2879         struct nwrap_entdata *ed;
2880         size_t i;
2881
2882         nwrap_vector_foreach (ed, nwrap_he->entries, i)
2883         {
2884                 SAFE_FREE(ed->nwrap_addrdata.items);
2885                 SAFE_FREE(ed->ht.h_aliases);
2886                 SAFE_FREE(ed);
2887         }
2888         SAFE_FREE(nwrap_he->entries.items);
2889         nwrap_he->entries.count = nwrap_he->entries.capacity = 0;
2890
2891         nwrap_he->num = 0;
2892         nwrap_he->idx = 0;
2893 }
2894
2895
2896 /* user functions */
2897 static struct passwd *nwrap_files_getpwnam(struct nwrap_backend *b,
2898                                            const char *name)
2899 {
2900         int i;
2901         bool ok;
2902
2903         (void) b; /* unused */
2904
2905         NWRAP_LOG(NWRAP_LOG_DEBUG, "Lookup user %s in files", name);
2906
2907         ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
2908         if (!ok) {
2909                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
2910                 return NULL;
2911         }
2912
2913         for (i=0; i<nwrap_pw_global.num; i++) {
2914                 if (strcmp(nwrap_pw_global.list[i].pw_name, name) == 0) {
2915                         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] found", name);
2916                         return &nwrap_pw_global.list[i];
2917                 }
2918                 NWRAP_LOG(NWRAP_LOG_DEBUG,
2919                           "user[%s] does not match [%s]",
2920                           name,
2921                           nwrap_pw_global.list[i].pw_name);
2922         }
2923
2924         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] not found\n", name);
2925
2926         errno = ENOENT;
2927         return NULL;
2928 }
2929
2930 static int nwrap_files_getpwnam_r(struct nwrap_backend *b,
2931                                   const char *name, struct passwd *pwdst,
2932                                   char *buf, size_t buflen, struct passwd **pwdstp)
2933 {
2934         struct passwd *pw;
2935
2936         pw = nwrap_files_getpwnam(b, name);
2937         if (!pw) {
2938                 if (errno == 0) {
2939                         return ENOENT;
2940                 }
2941                 return errno;
2942         }
2943
2944         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
2945 }
2946
2947 static struct passwd *nwrap_files_getpwuid(struct nwrap_backend *b,
2948                                            uid_t uid)
2949 {
2950         int i;
2951         bool ok;
2952
2953         (void) b; /* unused */
2954
2955         ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
2956         if (!ok) {
2957                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
2958                 return NULL;
2959         }
2960
2961         for (i=0; i<nwrap_pw_global.num; i++) {
2962                 if (nwrap_pw_global.list[i].pw_uid == uid) {
2963                         NWRAP_LOG(NWRAP_LOG_DEBUG, "uid[%u] found", uid);
2964                         return &nwrap_pw_global.list[i];
2965                 }
2966                 NWRAP_LOG(NWRAP_LOG_DEBUG,
2967                           "uid[%u] does not match [%u]",
2968                           uid,
2969                           nwrap_pw_global.list[i].pw_uid);
2970         }
2971
2972         NWRAP_LOG(NWRAP_LOG_DEBUG, "uid[%u] not found\n", uid);
2973
2974         errno = ENOENT;
2975         return NULL;
2976 }
2977
2978 static int nwrap_files_getpwuid_r(struct nwrap_backend *b,
2979                                   uid_t uid, struct passwd *pwdst,
2980                                   char *buf, size_t buflen, struct passwd **pwdstp)
2981 {
2982         struct passwd *pw;
2983
2984         pw = nwrap_files_getpwuid(b, uid);
2985         if (!pw) {
2986                 if (errno == 0) {
2987                         return ENOENT;
2988                 }
2989                 return errno;
2990         }
2991
2992         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
2993 }
2994
2995 /* user enum functions */
2996 static void nwrap_files_setpwent(struct nwrap_backend *b)
2997 {
2998         (void) b; /* unused */
2999
3000         nwrap_pw_global.idx = 0;
3001 }
3002
3003 static struct passwd *nwrap_files_getpwent(struct nwrap_backend *b)
3004 {
3005         struct passwd *pw;
3006
3007         (void) b; /* unused */
3008
3009         if (nwrap_pw_global.idx == 0) {
3010                 bool ok;
3011                 ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
3012                 if (!ok) {
3013                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
3014                         return NULL;
3015                 }
3016         }
3017
3018         if (nwrap_pw_global.idx >= nwrap_pw_global.num) {
3019                 errno = ENOENT;
3020                 return NULL;
3021         }
3022
3023         pw = &nwrap_pw_global.list[nwrap_pw_global.idx++];
3024
3025         NWRAP_LOG(NWRAP_LOG_DEBUG,
3026                   "return user[%s] uid[%u]",
3027                   pw->pw_name, pw->pw_uid);
3028
3029         return pw;
3030 }
3031
3032 static int nwrap_files_getpwent_r(struct nwrap_backend *b,
3033                                   struct passwd *pwdst, char *buf,
3034                                   size_t buflen, struct passwd **pwdstp)
3035 {
3036         struct passwd *pw;
3037
3038         pw = nwrap_files_getpwent(b);
3039         if (!pw) {
3040                 if (errno == 0) {
3041                         return ENOENT;
3042                 }
3043                 return errno;
3044         }
3045
3046         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
3047 }
3048
3049 static void nwrap_files_endpwent(struct nwrap_backend *b)
3050 {
3051         (void) b; /* unused */
3052
3053         nwrap_pw_global.idx = 0;
3054 }
3055
3056 /* shadow */
3057
3058 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
3059
3060 #ifdef HAVE_SETSPENT
3061 static void nwrap_files_setspent(void)
3062 {
3063         nwrap_sp_global.idx = 0;
3064 }
3065
3066 static struct spwd *nwrap_files_getspent(void)
3067 {
3068         struct spwd *sp;
3069
3070         if (nwrap_sp_global.idx == 0) {
3071                 bool ok;
3072
3073                 ok = nwrap_files_cache_reload(nwrap_sp_global.cache);
3074                 if (!ok) {
3075                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading shadow file");
3076                         return NULL;
3077                 }
3078         }
3079
3080         if (nwrap_sp_global.idx >= nwrap_sp_global.num) {
3081                 errno = ENOENT;
3082                 return NULL;
3083         }
3084
3085         sp = &nwrap_sp_global.list[nwrap_sp_global.idx++];
3086
3087         NWRAP_LOG(NWRAP_LOG_DEBUG,
3088                   "return user[%s]",
3089                   sp->sp_namp);
3090
3091         return sp;
3092 }
3093
3094 static void nwrap_files_endspent(void)
3095 {
3096         nwrap_sp_global.idx = 0;
3097 }
3098 #endif /* HAVE_SETSPENT */
3099
3100 static struct spwd *nwrap_files_getspnam(const char *name)
3101 {
3102         int i;
3103         bool ok;
3104
3105         NWRAP_LOG(NWRAP_LOG_DEBUG, "Lookup user %s in files", name);
3106
3107         ok = nwrap_files_cache_reload(nwrap_sp_global.cache);
3108         if (!ok) {
3109                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading shadow file");
3110                 return NULL;
3111         }
3112
3113         for (i=0; i<nwrap_sp_global.num; i++) {
3114                 if (strcmp(nwrap_sp_global.list[i].sp_namp, name) == 0) {
3115                         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] found", name);
3116                         return &nwrap_sp_global.list[i];
3117                 }
3118                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3119                           "user[%s] does not match [%s]",
3120                           name,
3121                           nwrap_sp_global.list[i].sp_namp);
3122         }
3123
3124         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] not found\n", name);
3125
3126         errno = ENOENT;
3127         return NULL;
3128 }
3129 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
3130
3131 /* misc functions */
3132 static int nwrap_files_initgroups(struct nwrap_backend *b,
3133                                   const char *user,
3134                                   gid_t group)
3135 {
3136         struct group *grp;
3137         gid_t *groups;
3138         int size = 1;
3139         int rc;
3140
3141         groups = (gid_t *)malloc(size * sizeof(gid_t));
3142         if (groups == NULL) {
3143                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
3144                 errno = ENOMEM;
3145                 return -1;
3146         }
3147         groups[0] = group;
3148
3149         nwrap_files_setgrent(b);
3150         while ((grp = nwrap_files_getgrent(b)) != NULL) {
3151                 int i = 0;
3152
3153                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3154                           "Inspecting %s for group membership",
3155                           grp->gr_name);
3156
3157                 for (i=0; grp->gr_mem && grp->gr_mem[i] != NULL; i++) {
3158                         if (group != grp->gr_gid &&
3159                             (strcmp(user, grp->gr_mem[i]) == 0)) {
3160                                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3161                                           "%s is member of %s",
3162                                           user,
3163                                           grp->gr_name);
3164
3165                                 groups = (gid_t *)realloc(groups,
3166                                                           (size + 1) * sizeof(gid_t));
3167                                 if (groups == NULL) {
3168                                         NWRAP_LOG(NWRAP_LOG_ERROR,
3169                                                   "Out of memory");
3170                                         errno = ENOMEM;
3171                                         return -1;
3172                                 }
3173
3174                                 groups[size] = grp->gr_gid;
3175                                 size++;
3176                         }
3177                 }
3178         }
3179
3180         nwrap_files_endgrent(b);
3181
3182         NWRAP_LOG(NWRAP_LOG_DEBUG,
3183                   "%s is member of %d groups",
3184                   user, size);
3185
3186         /* This really only works if uid_wrapper is loaded */
3187         rc = setgroups(size, groups);
3188
3189         free(groups);
3190
3191         return rc;
3192 }
3193
3194 /* group functions */
3195 static struct group *nwrap_files_getgrnam(struct nwrap_backend *b,
3196                                           const char *name)
3197 {
3198         int i;
3199         bool ok;
3200
3201         (void) b; /* unused */
3202
3203         ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3204         if (!ok) {
3205                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3206                 return NULL;
3207         }
3208
3209         for (i=0; i<nwrap_gr_global.num; i++) {
3210                 if (strcmp(nwrap_gr_global.list[i].gr_name, name) == 0) {
3211                         NWRAP_LOG(NWRAP_LOG_DEBUG, "group[%s] found", name);
3212                         return &nwrap_gr_global.list[i];
3213                 }
3214                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3215                           "group[%s] does not match [%s]",
3216                           name,
3217                           nwrap_gr_global.list[i].gr_name);
3218         }
3219
3220         NWRAP_LOG(NWRAP_LOG_DEBUG, "group[%s] not found", name);
3221
3222         errno = ENOENT;
3223         return NULL;
3224 }
3225
3226 static int nwrap_files_getgrnam_r(struct nwrap_backend *b,
3227                                   const char *name, struct group *grdst,
3228                                   char *buf, size_t buflen, struct group **grdstp)
3229 {
3230         struct group *gr;
3231
3232         gr = nwrap_files_getgrnam(b, name);
3233         if (!gr) {
3234                 if (errno == 0) {
3235                         return ENOENT;
3236                 }
3237                 return errno;
3238         }
3239
3240         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3241 }
3242
3243 static struct group *nwrap_files_getgrgid(struct nwrap_backend *b,
3244                                           gid_t gid)
3245 {
3246         int i;
3247         bool ok;
3248
3249         (void) b; /* unused */
3250
3251         ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3252         if (!ok) {
3253                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3254                 return NULL;
3255         }
3256
3257         for (i=0; i<nwrap_gr_global.num; i++) {
3258                 if (nwrap_gr_global.list[i].gr_gid == gid) {
3259                         NWRAP_LOG(NWRAP_LOG_DEBUG, "gid[%u] found", gid);
3260                         return &nwrap_gr_global.list[i];
3261                 }
3262                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3263                           "gid[%u] does not match [%u]",
3264                           gid,
3265                           nwrap_gr_global.list[i].gr_gid);
3266         }
3267
3268         NWRAP_LOG(NWRAP_LOG_DEBUG, "gid[%u] not found", gid);
3269
3270         errno = ENOENT;
3271         return NULL;
3272 }
3273
3274 static int nwrap_files_getgrgid_r(struct nwrap_backend *b,
3275                                   gid_t gid, struct group *grdst,
3276                                   char *buf, size_t buflen, struct group **grdstp)
3277 {
3278         struct group *gr;
3279
3280         gr = nwrap_files_getgrgid(b, gid);
3281         if (!gr) {
3282                 if (errno == 0) {
3283                         return ENOENT;
3284                 }
3285                 return errno;
3286         }
3287
3288         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3289 }
3290
3291 /* group enum functions */
3292 static void nwrap_files_setgrent(struct nwrap_backend *b)
3293 {
3294         (void) b; /* unused */
3295
3296         nwrap_gr_global.idx = 0;
3297 }
3298
3299 static struct group *nwrap_files_getgrent(struct nwrap_backend *b)
3300 {
3301         struct group *gr;
3302
3303         (void) b; /* unused */
3304
3305         if (nwrap_gr_global.idx == 0) {
3306                 bool ok;
3307
3308                 ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3309                 if (!ok) {
3310                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3311                         return NULL;
3312                 }
3313         }
3314
3315         if (nwrap_gr_global.idx >= nwrap_gr_global.num) {
3316                 errno = ENOENT;
3317                 return NULL;
3318         }
3319
3320         gr = &nwrap_gr_global.list[nwrap_gr_global.idx++];
3321
3322         NWRAP_LOG(NWRAP_LOG_DEBUG,
3323                   "return group[%s] gid[%u]",
3324                   gr->gr_name, gr->gr_gid);
3325
3326         return gr;
3327 }
3328
3329 static int nwrap_files_getgrent_r(struct nwrap_backend *b,
3330                                   struct group *grdst, char *buf,
3331                                   size_t buflen, struct group **grdstp)
3332 {
3333         struct group *gr;
3334
3335         gr = nwrap_files_getgrent(b);
3336         if (!gr) {
3337                 if (errno == 0) {
3338                         return ENOENT;
3339                 }
3340                 return errno;
3341         }
3342
3343         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3344 }
3345
3346 static void nwrap_files_endgrent(struct nwrap_backend *b)
3347 {
3348         (void) b; /* unused */
3349
3350         nwrap_gr_global.idx = 0;
3351 }
3352
3353 /* hosts functions */
3354 static int nwrap_files_gethostbyname(const char *name, int af,
3355                                      struct hostent *result,
3356                                      struct nwrap_vector *addr_list)
3357 {
3358         struct nwrap_entlist *el;
3359         struct hostent *he;
3360         char *h_name_lower;
3361         ENTRY e;
3362         ENTRY *e_p;
3363         char canon_name[DNS_NAME_MAX] = { 0 };
3364         size_t name_len;
3365         bool he_found = false;
3366         bool ok;
3367
3368         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3369         if (!ok) {
3370                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3371                 goto no_ent;
3372         }
3373
3374         name_len = strlen(name);
3375         if (name_len < sizeof(canon_name) && name[name_len - 1] == '.') {
3376                 strncpy(canon_name, name, name_len - 1);
3377                 name = canon_name;
3378         }
3379
3380         if (!str_tolower_copy(&h_name_lower, name)) {
3381                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3382                           "Out of memory while converting to lower case");
3383                 goto no_ent;
3384         }
3385
3386         /* Look at hash table for element */
3387         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching for name: %s", h_name_lower);
3388         e.key = h_name_lower;
3389         e.data = NULL;
3390         e_p = hsearch(e, FIND);
3391         if (e_p == NULL) {
3392                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found.", h_name_lower);
3393                 SAFE_FREE(h_name_lower);
3394                 goto no_ent;
3395         }
3396         SAFE_FREE(h_name_lower);
3397
3398         /* Always cleanup vector and results */
3399         if (!nwrap_vector_is_initialized(addr_list)) {
3400                 if (!nwrap_vector_init(addr_list)) {
3401                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3402                                   "Unable to initialize memory for addr_list vector");
3403                         goto no_ent;
3404                 }
3405         } else {
3406                 /* When vector is initialized data are valid no more.
3407                  * Quick way how to free vector is: */
3408                 addr_list->count = 0;
3409         }
3410
3411         /* Iterate through results */
3412         for (el = (struct nwrap_entlist *)e_p->data; el != NULL; el = el->next)
3413         {
3414                 he = &(el->ed->ht);
3415
3416                 /* Filter by address familiy if provided */
3417                 if (af != AF_UNSPEC && he->h_addrtype != af) {
3418                         continue;
3419                 }
3420
3421                 /*
3422                  * GLIBC HACK?
3423                  * glibc doesn't return ipv6 addresses when AF_UNSPEC is used
3424                  */
3425                 if (af == AF_UNSPEC && he->h_addrtype != AF_INET) {
3426                         continue;
3427                 }
3428
3429                 if (!he_found) {
3430                         memcpy(result, he, sizeof(struct hostent));
3431                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3432                                   "Name found. Returning record for %s",
3433                                   he->h_name);
3434                         he_found = true;
3435                 }
3436                 nwrap_vector_merge(addr_list, &el->ed->nwrap_addrdata);
3437                 result->h_addr_list = nwrap_vector_head(addr_list);
3438         }
3439
3440         if (he_found) {
3441                 return 0;
3442         }
3443         NWRAP_LOG(NWRAP_LOG_DEBUG,
3444                   "Name found in database. No records matches type.");
3445
3446 no_ent:
3447         errno = ENOENT;
3448         return -1;
3449 }
3450
3451 #ifdef HAVE_GETHOSTBYNAME_R
3452 static int nwrap_gethostbyname_r(const char *name,
3453                                  struct hostent *ret,
3454                                  char *buf, size_t buflen,
3455                                  struct hostent **result, int *h_errnop)
3456 {
3457         struct nwrap_vector *addr_list = malloc(sizeof(struct nwrap_vector));
3458         int rc;
3459
3460         if (addr_list == NULL) {
3461                 NWRAP_LOG(NWRAP_LOG_ERROR,
3462                           "Unable to allocate memory for address list");
3463                 errno = ENOENT;
3464                 return -1;
3465         }
3466
3467         ZERO_STRUCTP(addr_list);
3468
3469         rc = nwrap_files_gethostbyname(name, AF_UNSPEC, ret, addr_list);
3470         if (rc == -1) {
3471                 *h_errnop = h_errno;
3472                 if (addr_list->items != NULL) {
3473                         free(addr_list->items);
3474                 }
3475                 SAFE_FREE(addr_list);
3476                 errno = ENOENT;
3477                 return -1;
3478         }
3479
3480         if (buflen < (addr_list->count * sizeof(void *))) {
3481                 SAFE_FREE(addr_list->items);
3482                 SAFE_FREE(addr_list);
3483                 return ERANGE;
3484         }
3485
3486         /* Copy all to user provided buffer and change
3487          * pointers in returned structure.
3488          * +1 is for ending NULL pointer. */
3489         memcpy(buf, addr_list->items, (addr_list->count + 1) * sizeof(void *));
3490
3491         free(addr_list->items);
3492         free(addr_list);
3493
3494         ret->h_addr_list = (char **)buf;
3495         *result = ret;
3496         return 0;
3497 }
3498
3499 int gethostbyname_r(const char *name,
3500                     struct hostent *ret,
3501                     char *buf, size_t buflen,
3502                     struct hostent **result, int *h_errnop)
3503 {
3504         if (!nss_wrapper_hosts_enabled()) {
3505                 return libc_gethostbyname_r(name,
3506                                             ret,
3507                                             buf,
3508                                             buflen,
3509                                             result,
3510                                             h_errnop);
3511         }
3512
3513         return nwrap_gethostbyname_r(name, ret, buf, buflen, result, h_errnop);
3514 }
3515 #endif
3516
3517 static int nwrap_files_getaddrinfo(const char *name,
3518                                    unsigned short port,
3519                                    const struct addrinfo *hints,
3520                                    struct addrinfo **ai)
3521 {
3522         struct nwrap_entlist *el;
3523         struct hostent *he;
3524         struct addrinfo *ai_head = NULL;
3525         struct addrinfo *ai_cur = NULL;
3526         char *h_name_lower;
3527         size_t name_len;
3528         char canon_name[DNS_NAME_MAX] = { 0 };
3529         bool skip_canonname = false;
3530         ENTRY e = {
3531                 .key = NULL,
3532         };
3533         ENTRY *e_p = NULL;
3534         int rc;
3535         bool ok;
3536
3537         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3538         if (!ok) {
3539                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3540                 return EAI_SYSTEM;
3541         }
3542
3543         name_len = strlen(name);
3544         if (name_len < DNS_NAME_MAX && name[name_len - 1] == '.') {
3545                 strncpy(canon_name, name, name_len - 1);
3546                 name = canon_name;
3547         }
3548
3549         if (!str_tolower_copy(&h_name_lower, name)) {
3550                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3551                           "Out of memory while converting to lower case");
3552                 return EAI_MEMORY;
3553         }
3554
3555         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching for name: %s", h_name_lower);
3556         e.key = h_name_lower;
3557         e.data = NULL;
3558         e_p = hsearch(e, FIND);
3559         if (e_p == NULL) {
3560                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found.", h_name_lower);
3561                 SAFE_FREE(h_name_lower);
3562                 errno = ENOENT;
3563                 return EAI_NONAME;
3564         }
3565         NWRAP_LOG(NWRAP_LOG_DEBUG, "Name: %s found.", h_name_lower);
3566         SAFE_FREE(h_name_lower);
3567
3568         rc = EAI_NONAME;
3569         for (el = (struct nwrap_entlist *)e_p->data; el != NULL; el = el->next)
3570         {
3571                 int rc2;
3572                 struct addrinfo *ai_new = NULL;
3573
3574                 he = &(el->ed->ht);
3575
3576                 if (hints->ai_family != AF_UNSPEC &&
3577                     he->h_addrtype != hints->ai_family)
3578                 {
3579                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3580                                   "Entry found but with wrong AF - "
3581                                   "remembering EAI_ADDRINFO.");
3582                         rc = EAI_ADDRFAMILY;
3583                         continue;
3584                 }
3585
3586                 /* Function allocates memory and returns it in ai. */
3587                 rc2 = nwrap_convert_he_ai(he,
3588                                          port,
3589                                          hints,
3590                                          &ai_new,
3591                                          skip_canonname);
3592                 if (rc2 != 0) {
3593                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error converting he to ai");
3594                         if (ai_head != NULL) {
3595                                 freeaddrinfo(ai_head);
3596                         }
3597                         return rc2;
3598                 }
3599                 skip_canonname = true;
3600
3601                 if (ai_head == NULL) {
3602                         ai_head = ai_new;
3603                 }
3604                 if (ai_cur != NULL) {
3605                         ai_cur->ai_next = ai_new;
3606                 }
3607                 ai_cur = ai_new;
3608         }
3609
3610         if (ai_head != NULL) {
3611                 rc = 0;
3612         }
3613
3614         *ai = ai_head;
3615
3616         return rc;
3617 }
3618
3619 static struct hostent *nwrap_files_gethostbyaddr(const void *addr,
3620                                                  socklen_t len, int type)
3621 {
3622         struct hostent *he;
3623         char ip[NWRAP_INET_ADDRSTRLEN] = {0};
3624         struct nwrap_entdata *ed;
3625         const char *a;
3626         size_t i;
3627         bool ok;
3628
3629         (void) len; /* unused */
3630
3631         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3632         if (!ok) {
3633                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3634                 return NULL;
3635         }
3636
3637         a = inet_ntop(type, addr, ip, sizeof(ip));
3638         if (a == NULL) {
3639                 errno = EINVAL;
3640                 return NULL;
3641         }
3642
3643         nwrap_vector_foreach(ed, nwrap_he_global.entries, i)
3644         {
3645                 he = &(ed->ht);
3646                 if (he->h_addrtype != type) {
3647                         continue;
3648                 }
3649
3650                 if (memcmp(addr, he->h_addr_list[0], he->h_length) == 0) {
3651                         return he;
3652                 }
3653         }
3654
3655         errno = ENOENT;
3656         return NULL;
3657 }
3658
3659 #ifdef HAVE_GETHOSTBYADDR_R
3660 static int nwrap_gethostbyaddr_r(const void *addr, socklen_t len, int type,
3661                                  struct hostent *ret,
3662                                  char *buf, size_t buflen,
3663                                  struct hostent **result, int *h_errnop)
3664 {
3665         *result = nwrap_files_gethostbyaddr(addr, len, type);
3666         if (*result != NULL) {
3667                 memset(buf, '\0', buflen);
3668                 *ret = **result;
3669                 return 0;
3670         } else {
3671                 *h_errnop = h_errno;
3672                 return -1;
3673         }
3674 }
3675
3676 int gethostbyaddr_r(const void *addr, socklen_t len, int type,
3677                     struct hostent *ret,
3678                     char *buf, size_t buflen,
3679                     struct hostent **result, int *h_errnop)
3680 {
3681         if (!nss_wrapper_hosts_enabled()) {
3682                 return libc_gethostbyaddr_r(addr,
3683                                             len,
3684                                             type,
3685                                             ret,
3686                                             buf,
3687                                             buflen,
3688                                             result,
3689                                             h_errnop);
3690         }
3691
3692         return nwrap_gethostbyaddr_r(addr, len, type, ret, buf, buflen, result, h_errnop);
3693 }
3694 #endif
3695
3696 /* hosts enum functions */
3697 static void nwrap_files_sethostent(void)
3698 {
3699         nwrap_he_global.idx = 0;
3700 }
3701
3702 static struct hostent *nwrap_files_gethostent(void)
3703 {
3704         struct hostent *he;
3705
3706         if (nwrap_he_global.idx == 0) {
3707                 bool ok;
3708
3709                 ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3710                 if (!ok) {
3711                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading hosts file");
3712                         return NULL;
3713                 }
3714         }
3715
3716         if (nwrap_he_global.idx >= nwrap_he_global.num) {
3717                 errno = ENOENT;
3718                 return NULL;
3719         }
3720
3721         he = &((struct nwrap_entdata *)nwrap_he_global.entries.items[nwrap_he_global.idx++])->ht;
3722
3723         NWRAP_LOG(NWRAP_LOG_DEBUG, "return hosts[%s]", he->h_name);
3724
3725         return he;
3726 }
3727
3728 static void nwrap_files_endhostent(void)
3729 {
3730         nwrap_he_global.idx = 0;
3731 }
3732
3733 /*
3734  * module backend
3735  */
3736
3737
3738 static struct passwd *nwrap_module_getpwnam(struct nwrap_backend *b,
3739                                             const char *name)
3740 {
3741         static struct passwd pwd;
3742         static char buf[1000];
3743         NSS_STATUS status;
3744
3745         if (!b->fns->_nss_getpwnam_r) {
3746                 return NULL;
3747         }
3748
3749         status = b->fns->_nss_getpwnam_r(name, &pwd, buf, sizeof(buf), &errno);
3750         if (status == NSS_STATUS_NOTFOUND) {
3751                 return NULL;
3752         }
3753         if (status != NSS_STATUS_SUCCESS) {
3754                 return NULL;
3755         }
3756
3757         return &pwd;
3758 }
3759
3760 static int nwrap_module_getpwnam_r(struct nwrap_backend *b,
3761                                    const char *name, struct passwd *pwdst,
3762                                    char *buf, size_t buflen, struct passwd **pwdstp)
3763 {
3764         int ret;
3765
3766         (void) b; /* unused */
3767         (void) pwdst; /* unused */
3768         (void) pwdstp; /* unused */
3769
3770         if (!b->fns->_nss_getpwnam_r) {
3771                 return NSS_STATUS_NOTFOUND;
3772         }
3773
3774         ret = b->fns->_nss_getpwnam_r(name, pwdst, buf, buflen, &errno);
3775         switch (ret) {
3776         case NSS_STATUS_SUCCESS:
3777                 return 0;
3778         case NSS_STATUS_NOTFOUND:
3779                 if (errno != 0) {
3780                         return errno;
3781                 }
3782                 return ENOENT;
3783         case NSS_STATUS_TRYAGAIN:
3784                 if (errno != 0) {
3785                         return errno;
3786                 }
3787                 return ERANGE;
3788         default:
3789                 if (errno != 0) {
3790                         return errno;
3791                 }
3792                 return ret;
3793         }
3794 }
3795
3796 static struct passwd *nwrap_module_getpwuid(struct nwrap_backend *b,
3797                                             uid_t uid)
3798 {
3799         static struct passwd pwd;
3800         static char buf[1000];
3801         NSS_STATUS status;
3802
3803         if (!b->fns->_nss_getpwuid_r) {
3804                 return NULL;
3805         }
3806
3807         status = b->fns->_nss_getpwuid_r(uid, &pwd, buf, sizeof(buf), &errno);
3808         if (status == NSS_STATUS_NOTFOUND) {
3809                 return NULL;
3810         }
3811         if (status != NSS_STATUS_SUCCESS) {
3812                 return NULL;
3813         }
3814         return &pwd;
3815 }
3816
3817 static int nwrap_module_getpwuid_r(struct nwrap_backend *b,
3818                                    uid_t uid, struct passwd *pwdst,
3819                                    char *buf, size_t buflen, struct passwd **pwdstp)
3820 {
3821         int ret;
3822
3823         (void) pwdstp; /* unused */
3824
3825         if (!b->fns->_nss_getpwuid_r) {
3826                 return ENOENT;
3827         }
3828
3829         ret = b->fns->_nss_getpwuid_r(uid, pwdst, buf, buflen, &errno);
3830         switch (ret) {
3831         case NSS_STATUS_SUCCESS:
3832                 return 0;
3833         case NSS_STATUS_NOTFOUND:
3834                 if (errno != 0) {
3835                         return errno;
3836                 }
3837                 return ENOENT;
3838         case NSS_STATUS_TRYAGAIN:
3839                 if (errno != 0) {
3840                         return errno;
3841                 }
3842                 return ERANGE;
3843         default:
3844                 if (errno != 0) {
3845                         return errno;
3846                 }
3847                 return ret;
3848         }
3849 }
3850
3851 static void nwrap_module_setpwent(struct nwrap_backend *b)
3852 {
3853         if (!b->fns->_nss_setpwent) {
3854                 return;
3855         }
3856
3857         b->fns->_nss_setpwent();
3858 }
3859
3860 static struct passwd *nwrap_module_getpwent(struct nwrap_backend *b)
3861 {
3862         static struct passwd pwd;
3863         static char buf[1000];
3864         NSS_STATUS status;
3865
3866         if (!b->fns->_nss_getpwent_r) {
3867                 return NULL;
3868         }
3869
3870         status = b->fns->_nss_getpwent_r(&pwd, buf, sizeof(buf), &errno);
3871         if (status == NSS_STATUS_NOTFOUND) {
3872                 return NULL;
3873         }
3874         if (status != NSS_STATUS_SUCCESS) {
3875                 return NULL;
3876         }
3877         return &pwd;
3878 }
3879
3880 static int nwrap_module_getpwent_r(struct nwrap_backend *b,
3881                                    struct passwd *pwdst, char *buf,
3882                                    size_t buflen, struct passwd **pwdstp)
3883 {
3884         int ret;
3885
3886         (void) pwdstp; /* unused */
3887
3888         if (!b->fns->_nss_getpwent_r) {
3889                 return ENOENT;
3890         }
3891
3892         ret = b->fns->_nss_getpwent_r(pwdst, buf, buflen, &errno);
3893         switch (ret) {
3894         case NSS_STATUS_SUCCESS:
3895                 return 0;
3896         case NSS_STATUS_NOTFOUND:
3897                 if (errno != 0) {
3898                         return errno;
3899                 }
3900                 return ENOENT;
3901         case NSS_STATUS_TRYAGAIN:
3902                 if (errno != 0) {
3903                         return errno;
3904                 }
3905                 return ERANGE;
3906         default:
3907                 if (errno != 0) {
3908                         return errno;
3909                 }
3910                 return ret;
3911         }
3912 }
3913
3914 static void nwrap_module_endpwent(struct nwrap_backend *b)
3915 {
3916         if (!b->fns->_nss_endpwent) {
3917                 return;
3918         }
3919
3920         b->fns->_nss_endpwent();
3921 }
3922
3923 static int nwrap_module_initgroups(struct nwrap_backend *b,
3924                                    const char *user, gid_t group)
3925 {
3926         gid_t *groups;
3927         long int start;
3928         long int size;
3929
3930         if (!b->fns->_nss_initgroups) {
3931                 return NSS_STATUS_UNAVAIL;
3932         }
3933
3934         return b->fns->_nss_initgroups(user, group, &start, &size, &groups, 0, &errno);
3935 }
3936
3937 static struct group *nwrap_module_getgrnam(struct nwrap_backend *b,
3938                                            const char *name)
3939 {
3940         static struct group grp;
3941         static char *buf;
3942         static int buflen = 1000;
3943         NSS_STATUS status;
3944
3945         if (!b->fns->_nss_getgrnam_r) {
3946                 return NULL;
3947         }
3948
3949         if (!buf) {
3950                 buf = (char *)malloc(buflen);
3951         }
3952 again:
3953         status = b->fns->_nss_getgrnam_r(name, &grp, buf, buflen, &errno);
3954         if (status == NSS_STATUS_TRYAGAIN) {
3955                 buflen *= 2;
3956                 buf = (char *)realloc(buf, buflen);
3957                 if (!buf) {
3958                         return NULL;
3959                 }
3960                 goto again;
3961         }
3962         if (status == NSS_STATUS_NOTFOUND) {
3963                 SAFE_FREE(buf);
3964                 return NULL;
3965         }
3966         if (status != NSS_STATUS_SUCCESS) {
3967                 SAFE_FREE(buf);
3968                 return NULL;
3969         }
3970         return &grp;
3971 }
3972
3973 static int nwrap_module_getgrnam_r(struct nwrap_backend *b,
3974                                    const char *name, struct group *grdst,
3975                                    char *buf, size_t buflen, struct group **grdstp)
3976 {
3977         int ret;
3978
3979         (void) grdstp; /* unused */
3980
3981         if (!b->fns->_nss_getgrnam_r) {
3982                 return ENOENT;
3983         }
3984
3985         ret = b->fns->_nss_getgrnam_r(name, grdst, buf, buflen, &errno);
3986         switch (ret) {
3987         case NSS_STATUS_SUCCESS:
3988                 return 0;
3989         case NSS_STATUS_NOTFOUND:
3990                 if (errno != 0) {
3991                         return errno;
3992                 }
3993                 return ENOENT;
3994         case NSS_STATUS_TRYAGAIN:
3995                 if (errno != 0) {
3996                         return errno;
3997                 }
3998                 return ERANGE;
3999         default:
4000                 if (errno != 0) {
4001                         return errno;
4002                 }
4003                 return ret;
4004         }
4005 }
4006
4007 static struct group *nwrap_module_getgrgid(struct nwrap_backend *b,
4008                                            gid_t gid)
4009 {
4010         static struct group grp;
4011         static char *buf;
4012         static int buflen = 1000;
4013         NSS_STATUS status;
4014
4015         if (!b->fns->_nss_getgrgid_r) {
4016                 return NULL;
4017         }
4018
4019         if (!buf) {
4020                 buf = (char *)malloc(buflen);
4021         }
4022
4023 again:
4024         status = b->fns->_nss_getgrgid_r(gid, &grp, buf, buflen, &errno);
4025         if (status == NSS_STATUS_TRYAGAIN) {
4026                 buflen *= 2;
4027                 buf = (char *)realloc(buf, buflen);
4028                 if (!buf) {
4029                         return NULL;
4030                 }
4031                 goto again;
4032         }
4033         if (status == NSS_STATUS_NOTFOUND) {
4034                 SAFE_FREE(buf);
4035                 return NULL;
4036         }
4037         if (status != NSS_STATUS_SUCCESS) {
4038                 SAFE_FREE(buf);
4039                 return NULL;
4040         }
4041         return &grp;
4042 }
4043
4044 static int nwrap_module_getgrgid_r(struct nwrap_backend *b,
4045                                    gid_t gid, struct group *grdst,
4046                                    char *buf, size_t buflen, struct group **grdstp)
4047 {
4048         int ret;
4049
4050         (void) grdstp; /* unused */
4051
4052         if (!b->fns->_nss_getgrgid_r) {
4053                 return ENOENT;
4054         }
4055
4056         ret = b->fns->_nss_getgrgid_r(gid, grdst, buf, buflen, &errno);
4057         switch (ret) {
4058         case NSS_STATUS_SUCCESS:
4059                 return 0;
4060         case NSS_STATUS_NOTFOUND:
4061                 if (errno != 0) {
4062                         return errno;
4063                 }
4064                 return ENOENT;
4065         case NSS_STATUS_TRYAGAIN:
4066                 if (errno != 0) {
4067                         return errno;
4068                 }
4069                 return ERANGE;
4070         default:
4071                 if (errno != 0) {
4072                         return errno;
4073                 }
4074                 return ret;
4075         }
4076 }
4077
4078 static void nwrap_module_setgrent(struct nwrap_backend *b)
4079 {
4080         if (!b->fns->_nss_setgrent) {
4081                 return;
4082         }
4083
4084         b->fns->_nss_setgrent();
4085 }
4086
4087 static struct group *nwrap_module_getgrent(struct nwrap_backend *b)
4088 {
4089         static struct group grp;
4090         static char *buf;
4091         static int buflen = 1024;
4092         NSS_STATUS status;
4093
4094         if (!b->fns->_nss_getgrent_r) {
4095                 return NULL;
4096         }
4097
4098         if (!buf) {
4099                 buf = (char *)malloc(buflen);
4100         }
4101
4102 again:
4103         status = b->fns->_nss_getgrent_r(&grp, buf, buflen, &errno);
4104         if (status == NSS_STATUS_TRYAGAIN) {
4105                 buflen *= 2;
4106                 buf = (char *)realloc(buf, buflen);
4107                 if (!buf) {
4108                         return NULL;
4109                 }
4110                 goto again;
4111         }
4112         if (status == NSS_STATUS_NOTFOUND) {
4113                 SAFE_FREE(buf);
4114                 return NULL;
4115         }
4116         if (status != NSS_STATUS_SUCCESS) {
4117                 SAFE_FREE(buf);
4118                 return NULL;
4119         }
4120         return &grp;
4121 }
4122
4123 static int nwrap_module_getgrent_r(struct nwrap_backend *b,
4124                                    struct group *grdst, char *buf,
4125                                    size_t buflen, struct group **grdstp)
4126 {
4127         int ret;
4128
4129         (void) grdstp; /* unused */
4130
4131         if (!b->fns->_nss_getgrent_r) {
4132                 return ENOENT;
4133         }
4134
4135         ret = b->fns->_nss_getgrent_r(grdst, buf, buflen, &errno);
4136         switch (ret) {
4137         case NSS_STATUS_SUCCESS:
4138                 return 0;
4139         case NSS_STATUS_NOTFOUND:
4140                 if (errno != 0) {
4141                         return errno;
4142                 }
4143                 return ENOENT;
4144         case NSS_STATUS_TRYAGAIN:
4145                 if (errno != 0) {
4146                         return errno;
4147                 }
4148                 return ERANGE;
4149         default:
4150                 if (errno != 0) {
4151                         return errno;
4152                 }
4153                 return ret;
4154         }
4155 }
4156
4157 static void nwrap_module_endgrent(struct nwrap_backend *b)
4158 {
4159         if (!b->fns->_nss_endgrent) {
4160                 return;
4161         }
4162
4163         b->fns->_nss_endgrent();
4164 }
4165
4166 /****************************************************************************
4167  *   GETPWNAM
4168  ***************************************************************************/
4169
4170 static struct passwd *nwrap_getpwnam(const char *name)
4171 {
4172         int i;
4173         struct passwd *pwd;
4174
4175         for (i=0; i < nwrap_main_global->num_backends; i++) {
4176                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4177                 pwd = b->ops->nw_getpwnam(b, name);
4178                 if (pwd) {
4179                         return pwd;
4180                 }
4181         }
4182
4183         return NULL;
4184 }
4185
4186 struct passwd *getpwnam(const char *name)
4187 {
4188         if (!nss_wrapper_enabled()) {
4189                 return libc_getpwnam(name);
4190         }
4191
4192         return nwrap_getpwnam(name);
4193 }
4194
4195 /****************************************************************************
4196  *   GETPWNAM_R
4197  ***************************************************************************/
4198
4199 static int nwrap_getpwnam_r(const char *name, struct passwd *pwdst,
4200                             char *buf, size_t buflen, struct passwd **pwdstp)
4201 {
4202         int i,ret;
4203
4204         for (i=0; i < nwrap_main_global->num_backends; i++) {
4205                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4206                 ret = b->ops->nw_getpwnam_r(b, name, pwdst, buf, buflen, pwdstp);
4207                 if (ret == ENOENT) {
4208                         continue;
4209                 }
4210                 return ret;
4211         }
4212
4213         return ENOENT;
4214 }
4215
4216 #ifdef HAVE_GETPWNAM_R
4217 # ifdef HAVE_SOLARIS_GETPWNAM_R
4218 int getpwnam_r(const char *name, struct passwd *pwdst,
4219                char *buf, int buflen, struct passwd **pwdstp)
4220 # else /* HAVE_SOLARIS_GETPWNAM_R */
4221 int getpwnam_r(const char *name, struct passwd *pwdst,
4222                char *buf, size_t buflen, struct passwd **pwdstp)
4223 # endif /* HAVE_SOLARIS_GETPWNAM_R */
4224 {
4225         if (!nss_wrapper_enabled()) {
4226                 return libc_getpwnam_r(name, pwdst, buf, buflen, pwdstp);
4227         }
4228
4229         return nwrap_getpwnam_r(name, pwdst, buf, buflen, pwdstp);
4230 }
4231 #endif
4232
4233 /****************************************************************************
4234  *   GETPWUID
4235  ***************************************************************************/
4236
4237 static struct passwd *nwrap_getpwuid(uid_t uid)
4238 {
4239         int i;
4240         struct passwd *pwd;
4241
4242         for (i=0; i < nwrap_main_global->num_backends; i++) {
4243                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4244                 pwd = b->ops->nw_getpwuid(b, uid);
4245                 if (pwd) {
4246                         return pwd;
4247                 }
4248         }
4249
4250         return NULL;
4251 }
4252
4253 struct passwd *getpwuid(uid_t uid)
4254 {
4255         if (!nss_wrapper_enabled()) {
4256                 return libc_getpwuid(uid);
4257         }
4258
4259         return nwrap_getpwuid(uid);
4260 }
4261
4262 /****************************************************************************
4263  *   GETPWUID_R
4264  ***************************************************************************/
4265
4266 static int nwrap_getpwuid_r(uid_t uid, struct passwd *pwdst,
4267                             char *buf, size_t buflen, struct passwd **pwdstp)
4268 {
4269         int i,ret;
4270
4271         for (i=0; i < nwrap_main_global->num_backends; i++) {
4272                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4273                 ret = b->ops->nw_getpwuid_r(b, uid, pwdst, buf, buflen, pwdstp);
4274                 if (ret == ENOENT) {
4275                         continue;
4276                 }
4277                 return ret;
4278         }
4279
4280         return ENOENT;
4281 }
4282
4283 #ifdef HAVE_SOLARIS_GETPWUID_R
4284 int getpwuid_r(uid_t uid, struct passwd *pwdst,
4285                char *buf, int buflen, struct passwd **pwdstp)
4286 #else
4287 int getpwuid_r(uid_t uid, struct passwd *pwdst,
4288                char *buf, size_t buflen, struct passwd **pwdstp)
4289 #endif
4290 {
4291         if (!nss_wrapper_enabled()) {
4292                 return libc_getpwuid_r(uid, pwdst, buf, buflen, pwdstp);
4293         }
4294
4295         return nwrap_getpwuid_r(uid, pwdst, buf, buflen, pwdstp);
4296 }
4297
4298 /****************************************************************************
4299  *   SETPWENT
4300  ***************************************************************************/
4301
4302 static void nwrap_setpwent(void)
4303 {
4304         int i;
4305
4306         for (i=0; i < nwrap_main_global->num_backends; i++) {
4307                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4308                 b->ops->nw_setpwent(b);
4309         }
4310 }
4311
4312 void setpwent(void)
4313 {
4314         if (!nss_wrapper_enabled()) {
4315                 libc_setpwent();
4316                 return;
4317         }
4318
4319         nwrap_setpwent();
4320 }
4321
4322 /****************************************************************************
4323  *   GETPWENT
4324  ***************************************************************************/
4325
4326 static struct passwd *nwrap_getpwent(void)
4327 {
4328         int i;
4329         struct passwd *pwd;
4330
4331         for (i=0; i < nwrap_main_global->num_backends; i++) {
4332                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4333                 pwd = b->ops->nw_getpwent(b);
4334                 if (pwd) {
4335                         return pwd;
4336                 }
4337         }
4338
4339         return NULL;
4340 }
4341
4342 struct passwd *getpwent(void)
4343 {
4344         if (!nss_wrapper_enabled()) {
4345                 return libc_getpwent();
4346         }
4347
4348         return nwrap_getpwent();
4349 }
4350
4351 /****************************************************************************
4352  *   GETPWENT_R
4353  ***************************************************************************/
4354
4355 static int nwrap_getpwent_r(struct passwd *pwdst, char *buf,
4356                             size_t buflen, struct passwd **pwdstp)
4357 {
4358         int i,ret;
4359
4360         for (i=0; i < nwrap_main_global->num_backends; i++) {
4361                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4362                 ret = b->ops->nw_getpwent_r(b, pwdst, buf, buflen, pwdstp);
4363                 if (ret == ENOENT) {
4364                         continue;
4365                 }
4366                 return ret;
4367         }
4368
4369         return ENOENT;
4370 }
4371
4372 #ifdef HAVE_SOLARIS_GETPWENT_R
4373 struct passwd *getpwent_r(struct passwd *pwdst, char *buf, int buflen)
4374 {
4375         struct passwd *pwdstp = NULL;
4376         int rc;
4377
4378         if (!nss_wrapper_enabled()) {
4379                 return libc_getpwent_r(pwdst, buf, buflen);
4380         }
4381         rc = nwrap_getpwent_r(pwdst, buf, buflen, &pwdstp);
4382         if (rc < 0) {
4383                 return NULL;
4384         }
4385
4386         return pwdstp;
4387 }
4388 #else /* HAVE_SOLARIS_GETPWENT_R */
4389 int getpwent_r(struct passwd *pwdst, char *buf,
4390                size_t buflen, struct passwd **pwdstp)
4391 {
4392         if (!nss_wrapper_enabled()) {
4393                 return libc_getpwent_r(pwdst, buf, buflen, pwdstp);
4394         }
4395
4396         return nwrap_getpwent_r(pwdst, buf, buflen, pwdstp);
4397 }
4398 #endif /* HAVE_SOLARIS_GETPWENT_R */
4399
4400 /****************************************************************************
4401  *   ENDPWENT
4402  ***************************************************************************/
4403
4404 static void nwrap_endpwent(void)
4405 {
4406         int i;
4407
4408         for (i=0; i < nwrap_main_global->num_backends; i++) {
4409                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4410                 b->ops->nw_endpwent(b);
4411         }
4412 }
4413
4414 void endpwent(void)
4415 {
4416         if (!nss_wrapper_enabled()) {
4417                 libc_endpwent();
4418                 return;
4419         }
4420
4421         nwrap_endpwent();
4422 }
4423
4424 /****************************************************************************
4425  *   INITGROUPS
4426  ***************************************************************************/
4427
4428 static int nwrap_initgroups(const char *user, gid_t group)
4429 {
4430         int i;
4431
4432         for (i=0; i < nwrap_main_global->num_backends; i++) {
4433                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4434                 int rc;
4435
4436                 rc = b->ops->nw_initgroups(b, user, group);
4437                 if (rc == 0) {
4438                         return 0;
4439                 }
4440         }
4441
4442         errno = ENOENT;
4443         return -1;
4444 }
4445
4446 int initgroups(const char *user, gid_t group)
4447 {
4448         if (!nss_wrapper_enabled()) {
4449                 return libc_initgroups(user, group);
4450         }
4451
4452         return nwrap_initgroups(user, group);
4453 }
4454
4455 /****************************************************************************
4456  *   GETGRNAM
4457  ***************************************************************************/
4458
4459 static struct group *nwrap_getgrnam(const char *name)
4460 {
4461         int i;
4462         struct group *grp;
4463
4464         for (i=0; i < nwrap_main_global->num_backends; i++) {
4465                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4466                 grp = b->ops->nw_getgrnam(b, name);
4467                 if (grp) {
4468                         return grp;
4469                 }
4470         }
4471
4472         return NULL;
4473 }
4474
4475 struct group *getgrnam(const char *name)
4476 {
4477         if (!nss_wrapper_enabled()) {
4478                 return libc_getgrnam(name);
4479         }
4480
4481         return nwrap_getgrnam(name);
4482 }
4483
4484 /****************************************************************************
4485  *   GETGRNAM_R
4486  ***************************************************************************/
4487
4488 static int nwrap_getgrnam_r(const char *name, struct group *grdst,
4489                             char *buf, size_t buflen, struct group **grdstp)
4490 {
4491         int i, ret;
4492
4493         for (i=0; i < nwrap_main_global->num_backends; i++) {
4494                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4495                 ret = b->ops->nw_getgrnam_r(b, name, grdst, buf, buflen, grdstp);
4496                 if (ret == ENOENT) {
4497                         continue;
4498                 }
4499                 return ret;
4500         }
4501
4502         return ENOENT;
4503 }
4504
4505 #ifdef HAVE_GETGRNAM_R
4506 # ifdef HAVE_SOLARIS_GETGRNAM_R
4507 int getgrnam_r(const char *name, struct group *grp,
4508                 char *buf, int buflen, struct group **pgrp)
4509 # else /* HAVE_SOLARIS_GETGRNAM_R */
4510 int getgrnam_r(const char *name, struct group *grp,
4511                char *buf, size_t buflen, struct group **pgrp)
4512 # endif /* HAVE_SOLARIS_GETGRNAM_R */
4513 {
4514         if (!nss_wrapper_enabled()) {
4515                 return libc_getgrnam_r(name,
4516                                        grp,
4517                                        buf,
4518                                        buflen,
4519                                        pgrp);
4520         }
4521
4522         return nwrap_getgrnam_r(name, grp, buf, buflen, pgrp);
4523 }
4524 #endif /* HAVE_GETGRNAM_R */
4525
4526 /****************************************************************************
4527  *   GETGRGID
4528  ***************************************************************************/
4529
4530 static struct group *nwrap_getgrgid(gid_t gid)
4531 {
4532         int i;
4533         struct group *grp;
4534
4535         for (i=0; i < nwrap_main_global->num_backends; i++) {
4536                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4537                 grp = b->ops->nw_getgrgid(b, gid);
4538                 if (grp) {
4539                         return grp;
4540                 }
4541         }
4542
4543         return NULL;
4544 }
4545
4546 struct group *getgrgid(gid_t gid)
4547 {
4548         if (!nss_wrapper_enabled()) {
4549                 return libc_getgrgid(gid);
4550         }
4551
4552         return nwrap_getgrgid(gid);
4553 }
4554
4555 /****************************************************************************
4556  *   GETGRGID_R
4557  ***************************************************************************/
4558
4559 static int nwrap_getgrgid_r(gid_t gid, struct group *grdst,
4560                             char *buf, size_t buflen, struct group **grdstp)
4561 {
4562         int i,ret;
4563
4564         for (i=0; i < nwrap_main_global->num_backends; i++) {
4565                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4566                 ret = b->ops->nw_getgrgid_r(b, gid, grdst, buf, buflen, grdstp);
4567                 if (ret == ENOENT) {
4568                         continue;
4569                 }
4570                 return ret;
4571         }
4572
4573         return ENOENT;
4574 }
4575
4576 #ifdef HAVE_GETGRGID_R
4577 # ifdef HAVE_SOLARIS_GETGRGID_R
4578 int getgrgid_r(gid_t gid, struct group *grdst,
4579                char *buf, int buflen, struct group **grdstp)
4580 # else /* HAVE_SOLARIS_GETGRGID_R */
4581 int getgrgid_r(gid_t gid, struct group *grdst,
4582                char *buf, size_t buflen, struct group **grdstp)
4583 # endif /* HAVE_SOLARIS_GETGRGID_R */
4584 {
4585         if (!nss_wrapper_enabled()) {
4586                 return libc_getgrgid_r(gid, grdst, buf, buflen, grdstp);
4587         }
4588
4589         return nwrap_getgrgid_r(gid, grdst, buf, buflen, grdstp);
4590 }
4591 #endif
4592
4593 /****************************************************************************
4594  *   SETGRENT
4595  ***************************************************************************/
4596
4597 static void nwrap_setgrent(void)
4598 {
4599         int i;
4600
4601         for (i=0; i < nwrap_main_global->num_backends; i++) {
4602                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4603                 b->ops->nw_setgrent(b);
4604         }
4605 }
4606
4607 #ifdef HAVE_BSD_SETGRENT
4608 int setgrent(void)
4609 #else
4610 void setgrent(void)
4611 #endif
4612 {
4613         if (!nss_wrapper_enabled()) {
4614                 libc_setgrent();
4615                 goto out;
4616         }
4617
4618         nwrap_setgrent();
4619
4620 out:
4621 #ifdef HAVE_BSD_SETGRENT
4622         return 0;
4623 #else
4624         return;
4625 #endif
4626 }
4627
4628 /****************************************************************************
4629  *   GETGRENT
4630  ***************************************************************************/
4631
4632 static struct group *nwrap_getgrent(void)
4633 {
4634         int i;
4635         struct group *grp;
4636
4637         for (i=0; i < nwrap_main_global->num_backends; i++) {
4638                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4639                 grp = b->ops->nw_getgrent(b);
4640                 if (grp) {
4641                         return grp;
4642                 }
4643         }
4644
4645         return NULL;
4646 }
4647
4648 struct group *getgrent(void)
4649 {
4650         if (!nss_wrapper_enabled()) {
4651                 return libc_getgrent();
4652         }
4653
4654         return nwrap_getgrent();
4655 }
4656
4657 /****************************************************************************
4658  *   GETGRENT_R
4659  ***************************************************************************/
4660
4661 static int nwrap_getgrent_r(struct group *grdst, char *buf,
4662                             size_t buflen, struct group **grdstp)
4663 {
4664         int i,ret;
4665
4666         for (i=0; i < nwrap_main_global->num_backends; i++) {
4667                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4668                 ret = b->ops->nw_getgrent_r(b, grdst, buf, buflen, grdstp);
4669                 if (ret == ENOENT) {
4670                         continue;
4671                 }
4672                 return ret;
4673         }
4674
4675         return ENOENT;
4676 }
4677
4678 #ifdef HAVE_SOLARIS_GETGRENT_R
4679 struct group *getgrent_r(struct group *src, char *buf, int buflen)
4680 {
4681         struct group *grdstp = NULL;
4682         int rc;
4683
4684         if (!nss_wrapper_enabled()) {
4685                 return libc_getgrent_r(src, buf, buflen);
4686         }
4687
4688         rc = nwrap_getgrent_r(src, buf, buflen, &grdstp);
4689         if (rc < 0) {
4690                 return NULL;
4691         }
4692
4693         return grdstp;
4694 }
4695 #else /* HAVE_SOLARIS_GETGRENT_R */
4696 int getgrent_r(struct group *src, char *buf,
4697                size_t buflen, struct group **grdstp)
4698 {
4699         if (!nss_wrapper_enabled()) {
4700                 return libc_getgrent_r(src, buf, buflen, grdstp);
4701         }
4702
4703         return nwrap_getgrent_r(src, buf, buflen, grdstp);
4704 }
4705 #endif /* HAVE_SOLARIS_GETGRENT_R */
4706
4707 /****************************************************************************
4708  *   ENDGRENT
4709  ***************************************************************************/
4710
4711 static void nwrap_endgrent(void)
4712 {
4713         int i;
4714
4715         for (i=0; i < nwrap_main_global->num_backends; i++) {
4716                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4717                 b->ops->nw_endgrent(b);
4718         }
4719 }
4720
4721 void endgrent(void)
4722 {
4723         if (!nss_wrapper_enabled()) {
4724                 libc_endgrent();
4725                 return;
4726         }
4727
4728         nwrap_endgrent();
4729 }
4730
4731 /****************************************************************************
4732  *   GETGROUPLIST
4733  ***************************************************************************/
4734
4735 #ifdef HAVE_GETGROUPLIST
4736 static int nwrap_getgrouplist(const char *user, gid_t group,
4737                               gid_t *groups, int *ngroups)
4738 {
4739         struct group *grp;
4740         gid_t *groups_tmp;
4741         int count = 1;
4742
4743         NWRAP_LOG(NWRAP_LOG_DEBUG, "getgrouplist called for %s", user);
4744
4745         groups_tmp = (gid_t *)malloc(count * sizeof(gid_t));
4746         if (!groups_tmp) {
4747                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
4748                 errno = ENOMEM;
4749                 return -1;
4750         }
4751         groups_tmp[0] = group;
4752
4753         nwrap_setgrent();
4754         while ((grp = nwrap_getgrent()) != NULL) {
4755                 int i = 0;
4756
4757                 NWRAP_LOG(NWRAP_LOG_DEBUG,
4758                           "Inspecting %s for group membership",
4759                           grp->gr_name);
4760
4761                 for (i=0; grp->gr_mem && grp->gr_mem[i] != NULL; i++) {
4762
4763                         if (group != grp->gr_gid &&
4764                             (strcmp(user, grp->gr_mem[i]) == 0)) {
4765
4766                                 NWRAP_LOG(NWRAP_LOG_DEBUG,
4767                                           "%s is member of %s",
4768                                           user,
4769                                           grp->gr_name);
4770
4771                                 groups_tmp = (gid_t *)realloc(groups_tmp, (count + 1) * sizeof(gid_t));
4772                                 if (!groups_tmp) {
4773                                         NWRAP_LOG(NWRAP_LOG_ERROR,
4774                                                   "Out of memory");
4775                                         errno = ENOMEM;
4776                                         return -1;
4777                                 }
4778                                 groups_tmp[count] = grp->gr_gid;
4779
4780                                 count++;
4781                         }
4782                 }
4783         }
4784
4785         nwrap_endgrent();
4786
4787         NWRAP_LOG(NWRAP_LOG_DEBUG,
4788                   "%s is member of %d groups",
4789                   user, *ngroups);
4790
4791         if (*ngroups < count) {
4792                 *ngroups = count;
4793                 free(groups_tmp);
4794                 return -1;
4795         }
4796
4797         *ngroups = count;
4798         memcpy(groups, groups_tmp, count * sizeof(gid_t));
4799         free(groups_tmp);
4800
4801         return count;
4802 }
4803
4804 int getgrouplist(const char *user, gid_t group, gid_t *groups, int *ngroups)
4805 {
4806         if (!nss_wrapper_enabled()) {
4807                 return libc_getgrouplist(user, group, groups, ngroups);
4808         }
4809
4810         return nwrap_getgrouplist(user, group, groups, ngroups);
4811 }
4812 #endif
4813
4814 /**********************************************************
4815  * SHADOW
4816  **********************************************************/
4817
4818 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
4819
4820 #ifdef HAVE_SETSPENT
4821 static void nwrap_setspent(void)
4822 {
4823         nwrap_files_setspent();
4824 }
4825
4826 void setspent(void)
4827 {
4828         if (!nss_wrapper_shadow_enabled()) {
4829                 return;
4830         }
4831
4832         nwrap_setspent();
4833 }
4834
4835 static struct spwd *nwrap_getspent(void)
4836 {
4837         return nwrap_files_getspent();
4838 }
4839
4840 struct spwd *getspent(void)
4841 {
4842         if (!nss_wrapper_shadow_enabled()) {
4843                 return NULL;
4844         }
4845
4846         return nwrap_getspent();
4847 }
4848
4849 static void nwrap_endspent(void)
4850 {
4851         nwrap_files_endspent();
4852 }
4853
4854 void endspent(void)
4855 {
4856         if (!nss_wrapper_shadow_enabled()) {
4857                 return;
4858         }
4859
4860         nwrap_endspent();
4861 }
4862 #endif /* HAVE_SETSPENT */
4863
4864 static struct spwd *nwrap_getspnam(const char *name)
4865 {
4866         return nwrap_files_getspnam(name);
4867 }
4868
4869 struct spwd *getspnam(const char *name)
4870 {
4871         if (!nss_wrapper_shadow_enabled()) {
4872                 return NULL;
4873         }
4874
4875         return nwrap_getspnam(name);
4876 }
4877
4878 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
4879
4880 /**********************************************************
4881  * NETDB
4882  **********************************************************/
4883
4884 static void nwrap_sethostent(int stayopen) {
4885         (void) stayopen; /* ignored */
4886
4887         nwrap_files_sethostent();
4888 }
4889
4890 #ifdef HAVE_SOLARIS_SETHOSTENT
4891 int sethostent(int stayopen)
4892 {
4893         if (!nss_wrapper_hosts_enabled()) {
4894                 libc_sethostent(stayopen);
4895                 return 0;
4896         }
4897
4898         nwrap_sethostent(stayopen);
4899
4900         return 0;
4901 }
4902 #else /* HAVE_SOLARIS_SETHOSTENT */
4903 void sethostent(int stayopen)
4904 {
4905         if (!nss_wrapper_hosts_enabled()) {
4906                 libc_sethostent(stayopen);
4907                 return;
4908         }
4909
4910         nwrap_sethostent(stayopen);
4911 }
4912 #endif /* HAVE_SOLARIS_SETHOSTENT */
4913
4914 static struct hostent *nwrap_gethostent(void)
4915 {
4916         return nwrap_files_gethostent();
4917 }
4918
4919 struct hostent *gethostent(void) {
4920         if (!nss_wrapper_hosts_enabled()) {
4921                 return libc_gethostent();
4922         }
4923
4924         return nwrap_gethostent();
4925 }
4926
4927 static void nwrap_endhostent(void) {
4928         nwrap_files_endhostent();
4929 }
4930
4931 #ifdef HAVE_SOLARIS_ENDHOSTENT
4932 int endhostent(void)
4933 {
4934         if (!nss_wrapper_hosts_enabled()) {
4935                 libc_endhostent();
4936                 return 0;
4937         }
4938
4939         nwrap_endhostent();
4940
4941         return 0;
4942 }
4943 #else /* HAVE_SOLARIS_ENDHOSTENT */
4944 void endhostent(void)
4945 {
4946         if (!nss_wrapper_hosts_enabled()) {
4947                 libc_endhostent();
4948                 return;
4949         }
4950
4951         nwrap_endhostent();
4952 }
4953 #endif /* HAVE_SOLARIS_ENDHOSTENT */
4954
4955 #ifdef BSD
4956 /* BSD implementation stores data in thread local storage but GLIBC does not */
4957 static __thread struct hostent user_he;
4958 static __thread struct nwrap_vector user_addrlist;
4959 #else
4960 static struct hostent user_he;
4961 static struct nwrap_vector user_addrlist;
4962 #endif /* BSD */
4963 static struct hostent *nwrap_gethostbyname(const char *name)
4964 {
4965         if (nwrap_files_gethostbyname(name, AF_UNSPEC, &user_he, &user_addrlist) == -1) {
4966                 return NULL;
4967         }
4968         return &user_he;
4969 }
4970
4971 struct hostent *gethostbyname(const char *name)
4972 {
4973         if (!nss_wrapper_hosts_enabled()) {
4974                 return libc_gethostbyname(name);
4975         }
4976
4977         return nwrap_gethostbyname(name);
4978 }
4979
4980 /* This is a GNU extension - Also can be found on BSD systems */
4981 #ifdef HAVE_GETHOSTBYNAME2
4982 #ifdef BSD
4983 /* BSD implementation stores data in  thread local storage but GLIBC not */
4984 static __thread struct hostent user_he2;
4985 static __thread struct nwrap_vector user_addrlist2;
4986 #else
4987 static struct hostent user_he2;
4988 static struct nwrap_vector user_addrlist2;
4989 #endif /* BSD */
4990 static struct hostent *nwrap_gethostbyname2(const char *name, int af)
4991 {
4992         if (nwrap_files_gethostbyname(name, af, &user_he2, &user_addrlist2) == -1) {
4993                 return NULL;
4994         }
4995         return &user_he2;
4996 }
4997
4998 struct hostent *gethostbyname2(const char *name, int af)
4999 {
5000         if (!nss_wrapper_hosts_enabled()) {
5001                 return libc_gethostbyname2(name, af);
5002         }
5003
5004         return nwrap_gethostbyname2(name, af);
5005 }
5006 #endif
5007
5008 static struct hostent *nwrap_gethostbyaddr(const void *addr,
5009                                            socklen_t len, int type)
5010 {
5011         return nwrap_files_gethostbyaddr(addr, len, type);
5012 }
5013
5014 struct hostent *gethostbyaddr(const void *addr,
5015                               socklen_t len, int type)
5016 {
5017         if (!nss_wrapper_hosts_enabled()) {
5018                 return libc_gethostbyaddr(addr, len, type);
5019         }
5020
5021         return nwrap_gethostbyaddr(addr, len, type);
5022 }
5023
5024 static const struct addrinfo default_hints =
5025 {
5026         .ai_flags = AI_ADDRCONFIG|AI_V4MAPPED,
5027         .ai_family = AF_UNSPEC,
5028         .ai_socktype = 0,
5029         .ai_protocol = 0,
5030         .ai_addrlen = 0,
5031         .ai_addr = NULL,
5032         .ai_canonname = NULL,
5033         .ai_next = NULL
5034 };
5035
5036 static int nwrap_convert_he_ai(const struct hostent *he,
5037                                unsigned short port,
5038                                const struct addrinfo *hints,
5039                                struct addrinfo **pai,
5040                                bool skip_canonname)
5041 {
5042         struct addrinfo *ai;
5043         socklen_t socklen;
5044
5045         if (he == NULL) {
5046                 return EAI_MEMORY;
5047         }
5048
5049         switch (he->h_addrtype) {
5050                 case AF_INET:
5051                         socklen = sizeof(struct sockaddr_in);
5052                         break;
5053 #ifdef HAVE_IPV6
5054                 case AF_INET6:
5055                         socklen = sizeof(struct sockaddr_in6);
5056                         break;
5057 #endif
5058                 default:
5059                         return EAI_FAMILY;
5060         }
5061
5062         ai = (struct addrinfo *)malloc(sizeof(struct addrinfo) + socklen);
5063         if (ai == NULL) {
5064                 return EAI_MEMORY;
5065         }
5066
5067         ai->ai_flags = hints->ai_flags;
5068         ai->ai_family = he->h_addrtype;
5069         ai->ai_socktype = hints->ai_socktype;
5070         ai->ai_protocol = hints->ai_protocol;
5071         ai->ai_canonname = NULL;
5072
5073         if (ai->ai_socktype == 0) {
5074                 ai->ai_socktype = SOCK_DGRAM;
5075         }
5076         if (ai->ai_protocol == 0) {
5077                 if (ai->ai_socktype == SOCK_DGRAM) {
5078                         ai->ai_protocol = IPPROTO_UDP;
5079                 } else if (ai->ai_socktype == SOCK_STREAM) {
5080                         ai->ai_protocol = IPPROTO_TCP;
5081                 }
5082         }
5083
5084         ai->ai_addrlen = socklen;
5085         ai->ai_addr = (void *)(ai + 1);
5086
5087 #ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
5088         ai->ai_addr->sa_len = socklen;
5089 #endif
5090         ai->ai_addr->sa_family = he->h_addrtype;
5091
5092         switch (he->h_addrtype) {
5093                 case AF_INET:
5094                 {
5095                         struct sockaddr_in *sinp =
5096                                 (struct sockaddr_in *) ai->ai_addr;
5097
5098                         memset(sinp, 0, sizeof(struct sockaddr_in));
5099
5100                         sinp->sin_port = htons(port);
5101                         sinp->sin_family = AF_INET;
5102
5103                         memset (sinp->sin_zero, '\0', sizeof (sinp->sin_zero));
5104                         memcpy(&sinp->sin_addr, he->h_addr_list[0], he->h_length);
5105
5106                 }
5107                 break;
5108 #ifdef HAVE_IPV6
5109                 case AF_INET6:
5110                 {
5111                         struct sockaddr_in6 *sin6p =
5112                                 (struct sockaddr_in6 *) ai->ai_addr;
5113
5114                         memset(sin6p, 0, sizeof(struct sockaddr_in6));
5115
5116                         sin6p->sin6_port = htons(port);
5117                         sin6p->sin6_family = AF_INET6;
5118
5119                         memcpy(&sin6p->sin6_addr,
5120                                he->h_addr_list[0],
5121                                he->h_length);
5122                 }
5123                 break;
5124 #endif
5125         }
5126
5127         ai->ai_next = NULL;
5128
5129         if (he->h_name && !skip_canonname) {
5130                 ai->ai_canonname = strdup(he->h_name);
5131                 if (ai->ai_canonname == NULL) {
5132                         freeaddrinfo(ai);
5133                         return EAI_MEMORY;
5134                 }
5135         }
5136
5137         *pai = ai;
5138         return 0;
5139 }
5140
5141 static int nwrap_getaddrinfo(const char *node,
5142                              const char *service,
5143                              const struct addrinfo *hints,
5144                              struct addrinfo **res)
5145 {
5146         struct addrinfo *ai = NULL;
5147         unsigned short port = 0;
5148         struct {
5149                 int family;
5150                 union {
5151                         struct in_addr v4;
5152 #ifdef HAVE_IPV6
5153                         struct in6_addr v6;
5154                 } in;
5155 #endif
5156         } addr = {
5157                 .family = AF_UNSPEC,
5158         };
5159         int rc;
5160
5161         if (node == NULL && service == NULL) {
5162                 return EAI_NONAME;
5163         }
5164
5165         if (hints == NULL) {
5166                 hints = &default_hints;
5167         }
5168
5169         /* EAI_BADFLAGS
5170               hints.ai_flags   contains   invalid  flags;  or,  hints.ai_flags
5171               included AI_CANONNAME and name was NULL.
5172         */
5173         if ((hints->ai_flags & AI_CANONNAME) && (node == NULL)) {
5174                 return EAI_BADFLAGS;
5175         }
5176
5177         /* If no node has been specified, let glibc deal with it */
5178         if (node == NULL) {
5179                 int ret;
5180                 struct addrinfo *p = NULL;
5181
5182                 ret = libc_getaddrinfo(node, service, hints, &p);
5183
5184                 if (ret == 0) {
5185                         *res = p;
5186                 }
5187                 return ret;
5188         }
5189
5190         if (service != NULL && service[0] != '\0') {
5191                 const char *proto = NULL;
5192                 struct servent *s;
5193                 char *end_ptr;
5194                 long sl;
5195
5196                 errno = 0;
5197                 sl = strtol(service, &end_ptr, 10);
5198
5199                 if (*end_ptr == '\0') {
5200                         port = sl;
5201                         goto valid_port;
5202                 } else if (hints->ai_flags & AI_NUMERICSERV) {
5203                         return EAI_NONAME;
5204                 }
5205
5206                 if (hints->ai_protocol != 0) {
5207                         struct protoent *pent;
5208
5209                         pent = getprotobynumber(hints->ai_protocol);
5210                         if (pent != NULL) {
5211                                 proto = pent->p_name;
5212                         }
5213                 }
5214
5215                 s = getservbyname(service, proto);
5216                 if (s == NULL) {
5217                         return EAI_NONAME;
5218                 }
5219                 port = ntohs(s->s_port);
5220         }
5221
5222 valid_port:
5223
5224         rc = inet_pton(AF_INET, node, &addr.in.v4);
5225         if (rc == 1) {
5226                 addr.family = AF_INET;
5227         }
5228 #ifdef HAVE_IPV6
5229         if (addr.family == AF_UNSPEC) {
5230                 rc = inet_pton(AF_INET6, node, &addr.in.v6);
5231                 if (rc == 1) {
5232                         addr.family = AF_INET6;
5233                 }
5234         }
5235 #endif
5236
5237         if (addr.family == AF_UNSPEC) {
5238                if (hints->ai_flags & AI_NUMERICHOST) {
5239                         return EAI_NONAME;
5240                 }
5241         } else if ((hints->ai_family != AF_UNSPEC) &&
5242                    (hints->ai_family != addr.family))
5243         {
5244                 return EAI_ADDRFAMILY;
5245         }
5246
5247         rc = nwrap_files_getaddrinfo(node, port, hints, &ai);
5248         if (rc != 0) {
5249                 int ret;
5250                 struct addrinfo *p = NULL;
5251
5252                 ret = libc_getaddrinfo(node, service, hints, &p);
5253
5254                 if (ret == 0) {
5255                         /*
5256                          * nwrap_files_getaddrinfo failed, but libc was
5257                          * successful -- use the result from libc.
5258                          */
5259                         *res = p;
5260                         return 0;
5261                 }
5262
5263                 return rc;
5264         }
5265
5266         /*
5267          * If the socktype was not specified, duplicate
5268          * each ai returned, so that we have variants for
5269          * both UDP and TCP.
5270          */
5271         if (hints->ai_socktype == 0) {
5272                 struct addrinfo *ai_cur;
5273
5274                 /* freeaddrinfo() frees ai_canonname and ai so allocate them */
5275                 for (ai_cur = ai; ai_cur != NULL; ai_cur = ai_cur->ai_next) {
5276                         struct addrinfo *ai_new;
5277
5278                         /* duplicate the current entry */
5279
5280                         ai_new = malloc(sizeof(struct addrinfo));
5281                         if (ai_new == NULL) {
5282                                 freeaddrinfo(ai);
5283                                 return EAI_MEMORY;
5284                         }
5285
5286                         memcpy(ai_new, ai_cur, sizeof(struct addrinfo));
5287                         ai_new->ai_next = NULL;
5288
5289                         /* We need a deep copy or freeaddrinfo() will blow up */
5290                         if (ai_cur->ai_canonname != NULL) {
5291                                 ai_new->ai_canonname =
5292                                         strdup(ai_cur->ai_canonname);
5293                         }
5294
5295                         if (ai_cur->ai_socktype == SOCK_DGRAM) {
5296                                 ai_new->ai_socktype = SOCK_STREAM;
5297                         } else if (ai_cur->ai_socktype == SOCK_STREAM) {
5298                                 ai_new->ai_socktype = SOCK_DGRAM;
5299                         }
5300                         if (ai_cur->ai_protocol == IPPROTO_TCP) {
5301                                 ai_new->ai_protocol = IPPROTO_UDP;
5302                         } else if (ai_cur->ai_protocol == IPPROTO_UDP) {
5303                                 ai_new->ai_protocol = IPPROTO_TCP;
5304                         }
5305
5306                         /* now insert the new entry */
5307
5308                         ai_new->ai_next = ai_cur->ai_next;
5309                         ai_cur->ai_next = ai_new;
5310
5311                         /* and move on (don't duplicate the new entry) */
5312
5313                         ai_cur = ai_new;
5314                 }
5315         }
5316
5317         *res = ai;
5318
5319         return 0;
5320 }
5321
5322 int getaddrinfo(const char *node, const char *service,
5323                 const struct addrinfo *hints,
5324                 struct addrinfo **res)
5325 {
5326         if (!nss_wrapper_hosts_enabled()) {
5327                 return libc_getaddrinfo(node, service, hints, res);
5328         }
5329
5330         return nwrap_getaddrinfo(node, service, hints, res);
5331 }
5332
5333 static int nwrap_getnameinfo(const struct sockaddr *sa, socklen_t salen,
5334                              char *host, size_t hostlen,
5335                              char *serv, size_t servlen,
5336                              int flags)
5337 {
5338         struct hostent *he;
5339         struct servent *service;
5340         const char *proto;
5341         const void *addr;
5342         socklen_t addrlen;
5343         uint16_t port;
5344         sa_family_t type;
5345
5346         if (sa == NULL || salen < sizeof(sa_family_t)) {
5347                 return EAI_FAMILY;
5348         }
5349
5350         if ((flags & NI_NAMEREQD) && host == NULL && serv == NULL) {
5351                 return EAI_NONAME;
5352         }
5353
5354         type = sa->sa_family;
5355         switch (type) {
5356         case AF_INET:
5357                 if (salen < sizeof(struct sockaddr_in))
5358                         return EAI_FAMILY;
5359                 addr = &((const struct sockaddr_in *)sa)->sin_addr;
5360                 addrlen = sizeof(((const struct sockaddr_in *)sa)->sin_addr);
5361                 port = ntohs(((const struct sockaddr_in *)sa)->sin_port);
5362                 break;
5363 #ifdef HAVE_IPV6
5364         case AF_INET6:
5365                 if (salen < sizeof(struct sockaddr_in6))
5366                         return EAI_FAMILY;
5367                 addr = &((const struct sockaddr_in6 *)sa)->sin6_addr;
5368                 addrlen = sizeof(((const struct sockaddr_in6 *)sa)->sin6_addr);
5369                 port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port);
5370                 break;
5371 #endif
5372         default:
5373                 return EAI_FAMILY;
5374         }
5375
5376         if (host != NULL) {
5377                 he = NULL;
5378                 if ((flags & NI_NUMERICHOST) == 0) {
5379                         he = nwrap_files_gethostbyaddr(addr, addrlen, type);
5380                         if ((flags & NI_NAMEREQD) && (he == NULL || he->h_name == NULL))
5381                                 return EAI_NONAME;
5382                 }
5383                 if (he != NULL && he->h_name != NULL) {
5384                         if (strlen(he->h_name) >= hostlen)
5385                                 return EAI_OVERFLOW;
5386                         strcpy(host, he->h_name);
5387                         if (flags & NI_NOFQDN)
5388                                 host[strcspn(host, ".")] = '\0';
5389                 } else {
5390                         if (inet_ntop(type, addr, host, hostlen) == NULL)
5391                                 return (errno == ENOSPC) ? EAI_OVERFLOW : EAI_FAIL;
5392                 }
5393         }
5394
5395         if (serv != NULL) {
5396                 service = NULL;
5397                 if ((flags & NI_NUMERICSERV) == 0) {
5398                         proto = (flags & NI_DGRAM) ? "udp" : "tcp";
5399                         service = getservbyport(htons(port), proto);
5400                 }
5401                 if (service != NULL) {
5402                         if (strlen(service->s_name) >= servlen)
5403                                 return EAI_OVERFLOW;
5404                         strcpy(serv, service->s_name);
5405                 } else {
5406                         if (snprintf(serv, servlen, "%u", port) >= (int) servlen)
5407                                 return EAI_OVERFLOW;
5408                 }
5409         }
5410
5411         return 0;
5412 }
5413
5414 #ifdef HAVE_LINUX_GETNAMEINFO
5415 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5416                 char *host, socklen_t hostlen,
5417                 char *serv, socklen_t servlen,
5418                 int flags)
5419 #elif defined(HAVE_LINUX_GETNAMEINFO_UNSIGNED)
5420 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5421                 char *host, socklen_t hostlen,
5422                 char *serv, socklen_t servlen,
5423                 unsigned int flags)
5424 #else
5425 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5426                 char *host, size_t hostlen,
5427                 char *serv, size_t servlen,
5428                 int flags)
5429 #endif
5430 {
5431         if (!nss_wrapper_hosts_enabled()) {
5432                 return libc_getnameinfo(sa, salen, host, hostlen, serv, servlen, flags);
5433         }
5434
5435         return nwrap_getnameinfo(sa, salen, host, hostlen, serv, servlen, flags);
5436 }
5437
5438 static int nwrap_gethostname(char *name, size_t len)
5439 {
5440         const char *hostname = getenv("NSS_WRAPPER_HOSTNAME");
5441
5442         if (strlen(hostname) >= len) {
5443                 errno = ENAMETOOLONG;
5444                 return -1;
5445         }
5446         snprintf(name, len, "%s", hostname);
5447
5448         return 0;
5449 }
5450
5451 #ifdef HAVE_SOLARIS_GETHOSTNAME
5452 int gethostname(char *name, int len)
5453 #else /* HAVE_SOLARIS_GETHOSTNAME */
5454 int gethostname(char *name, size_t len)
5455 #endif /* HAVE_SOLARIS_GETHOSTNAME */
5456 {
5457         if (!nwrap_hostname_enabled()) {
5458                 return libc_gethostname(name, len);
5459         }
5460
5461         return nwrap_gethostname(name, len);
5462 }
5463
5464 /****************************
5465  * DESTRUCTOR
5466  ***************************/
5467
5468 /*
5469  * This function is called when the library is unloaded and makes sure that
5470  * sockets get closed and the unix file for the socket are unlinked.
5471  */
5472 void nwrap_destructor(void)
5473 {
5474         int i;
5475
5476         NWRAP_LOCK_ALL;
5477         if (nwrap_main_global != NULL) {
5478                 struct nwrap_main *m = nwrap_main_global;
5479
5480                 /* libc */
5481                 SAFE_FREE(m->libc->fns);
5482                 if (m->libc->handle != NULL) {
5483                         dlclose(m->libc->handle);
5484                 }
5485                 if (m->libc->nsl_handle != NULL) {
5486                         dlclose(m->libc->nsl_handle);
5487                 }
5488                 if (m->libc->sock_handle != NULL) {
5489                         dlclose(m->libc->sock_handle);
5490                 }
5491                 SAFE_FREE(m->libc);
5492
5493                 /* backends */
5494                 for (i = 0; i < m->num_backends; i++) {
5495                         struct nwrap_backend *b = &(m->backends[i]);
5496
5497                         if (b->so_handle != NULL) {
5498                                 dlclose(b->so_handle);
5499                         }
5500                         SAFE_FREE(b->fns);
5501                 }
5502                 SAFE_FREE(m->backends);
5503         }
5504
5505         if (nwrap_pw_global.cache != NULL) {
5506                 struct nwrap_cache *c = nwrap_pw_global.cache;
5507
5508                 nwrap_files_cache_unload(c);
5509                 if (c->fd >= 0) {
5510                         fclose(c->fp);
5511                         c->fd = -1;
5512                 }
5513
5514                 SAFE_FREE(nwrap_pw_global.list);
5515                 nwrap_pw_global.num = 0;
5516         }
5517
5518         if (nwrap_gr_global.cache != NULL) {
5519                 struct nwrap_cache *c = nwrap_gr_global.cache;
5520
5521                 nwrap_files_cache_unload(c);
5522                 if (c->fd >= 0) {
5523                         fclose(c->fp);
5524                         c->fd = -1;
5525                 }
5526
5527                 SAFE_FREE(nwrap_gr_global.list);
5528                 nwrap_pw_global.num = 0;
5529         }
5530
5531         if (nwrap_he_global.cache != NULL) {
5532                 struct nwrap_cache *c = nwrap_he_global.cache;
5533
5534                 nwrap_files_cache_unload(c);
5535                 if (c->fd >= 0) {
5536                         fclose(c->fp);
5537                         c->fd = -1;
5538                 }
5539
5540                 nwrap_he_global.num = 0;
5541         }
5542
5543         hdestroy();
5544         NWRAP_UNLOCK_ALL;
5545 }