From: Anders Kaseorg <andersk@mit.edu>
Date: Mon, 28 Jul 2008 04:22:14 +0000 (-0400)
Subject: Replace recursive nss calls with explicit iteration over the nss chain.
X-Git-Tag: 1.7~2
X-Git-Url: http://andersk.mit.edu/gitweb/nss_nonlocal.git/commitdiff_plain/30fb395784b5c721de8a3c208ad16093fb2f00c2

Replace recursive nss calls with explicit iteration over the nss chain.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---

diff --git a/nonlocal-group.c b/nonlocal-group.c
index 532dd73..a09c0c3 100644
--- a/nonlocal-group.c
+++ b/nonlocal-group.c
@@ -60,10 +60,17 @@ nss_group_nonlocal_database(void)
 enum nss_status
 check_nonlocal_gid(const char *user, gid_t gid, int *errnop)
 {
-    enum nss_status status = NSS_STATUS_SUCCESS;
+    static const char *fct_name = "getgrgid_r";
+    static service_user *startp = NULL;
+    static void *fct_start = NULL;
+    enum nss_status status;
+    service_user *nip;
+    union {
+	enum nss_status (*l)(gid_t gid, struct group *grp,
+			     char *buffer, size_t buflen, int *errnop);
+	void *ptr;
+    } fct;
     struct group gbuf;
-    struct group *gbufp = &gbuf;
-    int ret;
     int old_errno = errno;
     int buflen = MAGIC_LOCAL_GR_BUFLEN;
     char *buf = malloc(buflen);
@@ -72,26 +79,46 @@ check_nonlocal_gid(const char *user, gid_t gid, int *errnop)
 	errno = old_errno;
 	return NSS_STATUS_TRYAGAIN;
     }
-    ret = getgrgid_r(gid, gbufp, buf, buflen, &gbufp);
-    if (ret != 0) {
-	*errnop = old_errno;
-	status = NSS_STATUS_TRYAGAIN;
-    } else if (gbufp != NULL) {
+
+    if (fct_start == NULL &&
+	__nss_group_lookup(&startp, fct_name, &fct_start) != 0) {
+	free(buf);
+	return NSS_STATUS_UNAVAIL;
+    }
+    nip = startp;
+    fct.ptr = fct_start;
+    do {
+	status = DL_CALL_FCT(fct.l, (gid, &gbuf, buf, buflen, errnop));
+	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
+	    break;
+    } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0);
+
+    if (status == NSS_STATUS_SUCCESS) {
 	syslog(LOG_WARNING, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user);
 	status = NSS_STATUS_NOTFOUND;
+    } else if (status != NSS_STATUS_TRYAGAIN) {
+	status = NSS_STATUS_SUCCESS;
     }
+
     free(buf);
-    errno = old_errno;
     return status;
 }
 
 enum nss_status
 get_local_group(const char *name, struct group *grp, char *buffer, size_t buflen, int *errnop)
 {
-    enum nss_status status = NSS_STATUS_NOTFOUND;
+    static const char *fct_name = "getgrnam_r";
+    static service_user *startp = NULL;
+    static void *fct_start = NULL;
+    enum nss_status status;
+    service_user *nip;
+    union {
+	enum nss_status (*l)(const char *name, struct group *grp,
+			     char *buffer, size_t buflen, int *errnop);
+	void *ptr;
+    } fct;
     struct group gbuf;
-    struct group *gbufp = &gbuf;
-    int ret, n;
+    int n;
     int old_errno = errno;
     int len = MAGIC_LOCAL_GR_BUFLEN;
     char *buf = malloc(len);
@@ -100,14 +127,22 @@ get_local_group(const char *name, struct group *grp, char *buffer, size_t buflen
 	errno = old_errno;
 	return NSS_STATUS_TRYAGAIN;
     }
-    ret = getgrnam_r(name, gbufp, buf, len, &gbufp);
-    if (ret != 0) {
-	*errnop = old_errno;
-	status = NSS_STATUS_TRYAGAIN;
-    } else if (gbufp != NULL) {
-	status = NSS_STATUS_SUCCESS;
 
-	n = snprintf(buffer, buflen, "%s", gbufp->gr_name);
+    if (fct_start == NULL &&
+	__nss_group_lookup(&startp, fct_name, &fct_start) != 0) {
+	free(buf);
+	return NSS_STATUS_UNAVAIL;
+    }
+    nip = startp;
+    fct.ptr = fct_start;
+    do {
+	status = DL_CALL_FCT(fct.l, (name, &gbuf, buf, buflen, errnop));
+	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
+	    break;
+    } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0);
+
+    if (status == NSS_STATUS_SUCCESS) {
+	n = snprintf(buffer, buflen, "%s", gbuf.gr_name);
 	if (n < 0 || n >= buflen) {
 	    *errnop = ERANGE;
 	    status = NSS_STATUS_TRYAGAIN;
@@ -117,7 +152,7 @@ get_local_group(const char *name, struct group *grp, char *buffer, size_t buflen
 	buffer += n;
 	buflen -= n;
 
-	n = snprintf(buffer, buflen, "%s", gbufp->gr_passwd);
+	n = snprintf(buffer, buflen, "%s", gbuf.gr_passwd);
 	if (n < 0 || n >= buflen) {
 	    *errnop = ERANGE;
 	    status = NSS_STATUS_TRYAGAIN;
@@ -127,7 +162,7 @@ get_local_group(const char *name, struct group *grp, char *buffer, size_t buflen
 	buffer += n;
 	buflen -= n;
 
-	grp->gr_gid = gbufp->gr_gid;
+	grp->gr_gid = gbuf.gr_gid;
 
 	if (buflen < sizeof(void *)) {
 	    *errnop = ERANGE;
@@ -138,9 +173,9 @@ get_local_group(const char *name, struct group *grp, char *buffer, size_t buflen
 	buffer += sizeof(void *);
 	buflen -= sizeof(void *);
     }
+
  get_local_group_done:
     free(buf);
-    errno = old_errno;
     return status;
 }
 
@@ -400,7 +435,6 @@ _nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start,
 	    gid = nonlocal_users_group.gr_gid;
 	} else if (status == NSS_STATUS_TRYAGAIN) {
 	    free(buffer);
-	    errno = old_errno;
 	    return status;
 	} else {
 	    syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!",
@@ -438,8 +472,6 @@ _nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start,
 	}
     }
 
-    errno = old_errno;
-
     if (is_local)
 	return NSS_STATUS_SUCCESS;
 
diff --git a/nonlocal-passwd.c b/nonlocal-passwd.c
index 6d70ea2..2810e16 100644
--- a/nonlocal-passwd.c
+++ b/nonlocal-passwd.c
@@ -60,10 +60,17 @@ nss_passwd_nonlocal_database(void)
 enum nss_status
 check_nonlocal_uid(const char *user, uid_t uid, int *errnop)
 {
-    enum nss_status status = NSS_STATUS_SUCCESS;
+    static const char *fct_name = "getpwuid_r";
+    static service_user *startp = NULL;
+    static void *fct_start = NULL;
+    enum nss_status status;
+    service_user *nip;
+    union {
+	enum nss_status (*l)(uid_t uid, struct passwd *pwd,
+			     char *buffer, size_t buflen, int *errnop);
+	void *ptr;
+    } fct;
     struct passwd pwbuf;
-    struct passwd *pwbufp = &pwbuf;
-    int ret;
     int old_errno = errno;
     int buflen = MAGIC_LOCAL_PW_BUFLEN;
     char *buf = malloc(buflen);
@@ -72,26 +79,45 @@ check_nonlocal_uid(const char *user, uid_t uid, int *errnop)
 	errno = old_errno;
 	return NSS_STATUS_TRYAGAIN;
     }
-    ret = getpwuid_r(uid, pwbufp, buf, buflen, &pwbufp);
-    if (ret != 0) {
-	*errnop = errno;
-	status = NSS_STATUS_TRYAGAIN;
-    } else if (pwbufp != NULL) {
+
+    if (fct_start == NULL &&
+	__nss_passwd_lookup(&startp, fct_name, &fct_start) != 0) {
+	free(buf);
+	return NSS_STATUS_UNAVAIL;
+    }
+    nip = startp;
+    fct.ptr = fct_start;
+    do {
+	status = DL_CALL_FCT(fct.l, (uid, &pwbuf, buf, buflen, errnop));
+	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
+	    break;
+    } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0);
+
+    if (status == NSS_STATUS_SUCCESS) {
 	syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name);
 	status = NSS_STATUS_NOTFOUND;
+    } else if (status != NSS_STATUS_TRYAGAIN) {
+	status = NSS_STATUS_SUCCESS;
     }
+
     free(buf);
-    errno = old_errno;
     return status;
 }
 
 enum nss_status
 check_nonlocal_user(const char *user, int *errnop)
 {
-    enum nss_status status = NSS_STATUS_SUCCESS;
+    static const char *fct_name = "getpwnam_r";
+    static service_user *startp = NULL;
+    static void *fct_start = NULL;
+    enum nss_status status;
+    service_user *nip;
+    union {
+	enum nss_status (*l)(const char *name, struct passwd *pwd,
+			     char *buffer, size_t buflen, int *errnop);
+	void *ptr;
+    } fct;
     struct passwd pwbuf;
-    struct passwd *pwbufp = &pwbuf;
-    int ret;
     int old_errno = errno;
     int buflen = MAGIC_LOCAL_PW_BUFLEN;
     char *buf = malloc(buflen);
@@ -100,15 +126,26 @@ check_nonlocal_user(const char *user, int *errnop)
 	errno = old_errno;
 	return NSS_STATUS_TRYAGAIN;
     }
-    ret = getpwnam_r(user, pwbufp, buf, buflen, &pwbufp);
-    if (ret != 0) {
-	*errnop = errno;
-	status = NSS_STATUS_TRYAGAIN;
-    } else if (pwbufp != NULL) {
-	status = NSS_STATUS_NOTFOUND;
+
+    if (fct_start == NULL &&
+	__nss_passwd_lookup(&startp, fct_name, &fct_start) != 0) {
+	free(buf);
+	return NSS_STATUS_UNAVAIL;
     }
+    nip = startp;
+    fct.ptr = fct_start;
+    do {
+	status = DL_CALL_FCT(fct.l, (user, &pwbuf, buf, buflen, errnop));
+	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
+	    break;
+    } while (__nss_next(&nip, fct_name, &fct.ptr, status, 0) == 0);
+
+    if (status == NSS_STATUS_SUCCESS)
+	status = NSS_STATUS_NOTFOUND;
+    else if (status != NSS_STATUS_TRYAGAIN)
+	status = NSS_STATUS_SUCCESS;
+
     free(buf);
-    errno = old_errno;
     return status;
 }
 
diff --git a/nsswitch-internal.h b/nsswitch-internal.h
index 3d064a8..4a2e91d 100644
--- a/nsswitch-internal.h
+++ b/nsswitch-internal.h
@@ -25,4 +25,10 @@ extern int __nss_database_lookup (const char *database,
 				  const char *defconfig, service_user **ni);
 extern void *__nss_lookup_function (service_user *ni, const char *fct_name);
 
+/* glibc/nss/XXX-lookup.c */
+extern int __nss_passwd_lookup (service_user **ni, const char *fct_name,
+				void **fctp) internal_function;
+extern int __nss_group_lookup (service_user **ni, const char *fct_name,
+			        void **fctp) internal_function;
+
 #endif /* NSSWITCH_INTERNAL_H */