src/nss_wrapper.c

   1 /*
   2  * Copyright (C) Stefan Metzmacher 2007 <metze@samba.org>
   3  * Copyright (C) Guenther Deschner 2009 <gd@samba.org>
   4  * Copyright (C) Andreas Schneider 2013 <asn@samba.org>
   5  *
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the author nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "config.h"
  37
  38 #include <pthread.h>
  39
  40 #include <sys/types.h>
  41 #include <sys/stat.h>
  42 #include <sys/socket.h>
  43 #include <errno.h>
  44 #include <fcntl.h>
  45 #include <stdarg.h>
  46 #include <stdbool.h>
  47 #include <stddef.h>
  48 #include <stdio.h>
  49 #include <stdint.h>
  50 #include <stdlib.h>
  51 #include <string.h>
  52 #include <unistd.h>
  53 #include <ctype.h>
  54
  55 #include <netinet/in.h>
  56
  57 #include <search.h>
  58 #include <assert.h>
  59
  60 /*
  61  * Defining _POSIX_PTHREAD_SEMANTICS before including pwd.h and grp.h  gives us
  62  * the posix getpwnam_r(), getpwuid_r(), getgrnam_r and getgrgid_r calls on
  63  * Solaris
  64  */
  65 #ifndef _POSIX_PTHREAD_SEMANTICS
  66 #define _POSIX_PTHREAD_SEMANTICS
  67 #endif
  68
  69 #include <pwd.h>
  70 #include <grp.h>
  71 #ifdef HAVE_SHADOW_H
  72 #include <shadow.h>
  73 #endif /* HAVE_SHADOW_H */
  74
  75 #include <netdb.h>
  76 #include <arpa/inet.h>
  77 #include <netinet/in.h>
  78
  79 #include <dlfcn.h>
  80
  81 #if defined(HAVE_NSS_H)
  82 /* Linux and BSD */
  83 #include <nss.h>
  84
  85 typedef enum nss_status NSS_STATUS;
  86 #elif defined(HAVE_NSS_COMMON_H)
  87 /* Solaris */
  88 #include <nss_common.h>
  89 #include <nss_dbdefs.h>
  90 #include <nsswitch.h>
  91
  92 typedef nss_status_t NSS_STATUS;
  93
  94 # define NSS_STATUS_SUCCESS     NSS_SUCCESS
  95 # define NSS_STATUS_NOTFOUND    NSS_NOTFOUND
  96 # define NSS_STATUS_UNAVAIL     NSS_UNAVAIL
  97 # define NSS_STATUS_TRYAGAIN    NSS_TRYAGAIN
  98 #else
  99 # error "No nsswitch support detected"
 100 #endif
 101
 102 #ifndef PTR_DIFF
 103 #define PTR_DIFF(p1, p2) ((ptrdiff_t)(((const char *)(p1)) - (const char *)(p2)))
 104 #endif
 105
 106 #ifndef _PUBLIC_
 107 #define _PUBLIC_
 108 #endif
 109
 110 #ifndef EAI_NODATA
 111 #define EAI_NODATA EAI_NONAME
 112 #endif
 113
 114 #ifndef EAI_ADDRFAMILY
 115 #define EAI_ADDRFAMILY EAI_FAMILY
 116 #endif
 117
 118 #ifndef __STRING
 119 #define __STRING(x)    #x
 120 #endif
 121
 122 #ifndef __STRINGSTRING
 123 #define __STRINGSTRING(x) __STRING(x)
 124 #endif
 125
 126 #ifndef __LINESTR__
 127 #define __LINESTR__ __STRINGSTRING(__LINE__)
 128 #endif
 129
 130 #ifndef __location__
 131 #define __location__ __FILE__ ":" __LINESTR__
 132 #endif
 133
 134 #ifndef DNS_NAME_MAX
 135 #define DNS_NAME_MAX 255
 136 #endif
 137
 138 /* GCC have printf type attribute check. */
 139 #ifdef HAVE_ATTRIBUTE_PRINTF_FORMAT
 140 #define PRINTF_ATTRIBUTE(a,b) __attribute__ ((__format__ (__printf__, a, b)))
 141 #else
 142 #define PRINTF_ATTRIBUTE(a,b)
 143 #endif /* HAVE_ATTRIBUTE_PRINTF_FORMAT */
 144
 145 #ifdef HAVE_DESTRUCTOR_ATTRIBUTE
 146 #define DESTRUCTOR_ATTRIBUTE __attribute__ ((destructor))
 147 #else
 148 #define DESTRUCTOR_ATTRIBUTE
 149 #endif /* HAVE_DESTRUCTOR_ATTRIBUTE */
 150
 151 #define ZERO_STRUCTP(x) do { if ((x) != NULL) memset((char *)(x), 0, sizeof(*(x))); } while(0)
 152
 153 #ifndef SAFE_FREE
 154 #define SAFE_FREE(x) do { if ((x) != NULL) {free(x); (x)=NULL;} } while(0)
 155 #endif
 156
 157 #ifdef HAVE_IPV6
 158 #define NWRAP_INET_ADDRSTRLEN INET6_ADDRSTRLEN
 159 #else
 160 #define NWRAP_INET_ADDRSTRLEN INET_ADDRSTRLEN
 161 #endif
 162
 163 #define NWRAP_LOCK(m) do { \
 164         pthread_mutex_lock(&( m ## _mutex)); \
 165 } while(0)
 166
 167 #define NWRAP_UNLOCK(m) do { \
 168         pthread_mutex_unlock(&( m ## _mutex)); \
 169 } while(0)
 170
 171
 172 static bool nwrap_initialized = false;
 173 static pthread_mutex_t nwrap_initialized_mutex = PTHREAD_MUTEX_INITIALIZER;
 174
 175 /* The mutex or accessing the id */
 176 static pthread_mutex_t nwrap_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 177 static pthread_mutex_t nwrap_gr_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 178 static pthread_mutex_t nwrap_he_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 179 static pthread_mutex_t nwrap_pw_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 180 static pthread_mutex_t nwrap_sp_global_mutex = PTHREAD_MUTEX_INITIALIZER;
 181
 182 /* Add new global locks here please */
 183 /* Also don't forget to add locks to
 184  * nwrap_init() function.
 185  */
 186 # define NWRAP_LOCK_ALL do { \
 187         NWRAP_LOCK(nwrap_initialized); \
 188         NWRAP_LOCK(nwrap_global); \
 189         NWRAP_LOCK(nwrap_gr_global); \
 190         NWRAP_LOCK(nwrap_he_global); \
 191         NWRAP_LOCK(nwrap_pw_global); \
 192         NWRAP_LOCK(nwrap_sp_global); \
 193 } while (0);
 194
 195 # define NWRAP_UNLOCK_ALL do {\
 196         NWRAP_UNLOCK(nwrap_sp_global); \
 197         NWRAP_UNLOCK(nwrap_pw_global); \
 198         NWRAP_UNLOCK(nwrap_he_global); \
 199         NWRAP_UNLOCK(nwrap_gr_global); \
 200         NWRAP_UNLOCK(nwrap_global); \
 201         NWRAP_UNLOCK(nwrap_initialized); \
 202 } while (0);
 203
 204 static void nwrap_thread_prepare(void)
 205 {
 206         NWRAP_LOCK_ALL;
 207 }
 208
 209 static void nwrap_thread_parent(void)
 210 {
 211         NWRAP_UNLOCK_ALL;
 212 }
 213
 214 static void nwrap_thread_child(void)
 215 {
 216         NWRAP_UNLOCK_ALL;
 217 }
 218
 219 enum nwrap_dbglvl_e {
 220         NWRAP_LOG_ERROR = 0,
 221         NWRAP_LOG_WARN,
 222         NWRAP_LOG_DEBUG,
 223         NWRAP_LOG_TRACE
 224 };
 225
 226 #ifdef NDEBUG
 227 # define NWRAP_LOG(...)
 228 #else
 229
 230 static void nwrap_log(enum nwrap_dbglvl_e dbglvl, const char *func, const char *format, ...) PRINTF_ATTRIBUTE(3, 4);
 231 # define NWRAP_LOG(dbglvl, ...) nwrap_log((dbglvl), __func__, __VA_ARGS__)
 232
 233 static void nwrap_log(enum nwrap_dbglvl_e dbglvl,
 234                       const char *func,
 235                       const char *format, ...)
 236 {
 237         char buffer[1024];
 238         va_list va;
 239         const char *d;
 240         unsigned int lvl = 0;
 241         int pid = getpid();
 242
 243         d = getenv("NSS_WRAPPER_DEBUGLEVEL");
 244         if (d != NULL) {
 245                 lvl = atoi(d);
 246         }
 247
 248         va_start(va, format);
 249         vsnprintf(buffer, sizeof(buffer), format, va);
 250         va_end(va);
 251
 252         if (lvl >= dbglvl) {
 253                 switch (dbglvl) {
 254                         case NWRAP_LOG_ERROR:
 255                                 fprintf(stderr,
 256                                         "NWRAP_ERROR(%d) - %s: %s\n",
 257                                         pid, func, buffer);
 258                                 break;
 259                         case NWRAP_LOG_WARN:
 260                                 fprintf(stderr,
 261                                         "NWRAP_WARN(%d) - %s: %s\n",
 262                                         pid, func, buffer);
 263                                 break;
 264                         case NWRAP_LOG_DEBUG:
 265                                 fprintf(stderr,
 266                                         "NWRAP_DEBUG(%d) - %s: %s\n",
 267                                         pid, func, buffer);
 268                                 break;
 269                         case NWRAP_LOG_TRACE:
 270                                 fprintf(stderr,
 271                                         "NWRAP_TRACE(%d) - %s: %s\n",
 272                                         pid, func, buffer);
 273                                 break;
 274                 }
 275         }
 276 }
 277 #endif /* NDEBUG NWRAP_LOG */
 278
 279 struct nwrap_libc_fns {
 280         struct passwd *(*_libc_getpwnam)(const char *name);
 281         int (*_libc_getpwnam_r)(const char *name, struct passwd *pwd,
 282                        char *buf, size_t buflen, struct passwd **result);
 283         struct passwd *(*_libc_getpwuid)(uid_t uid);
 284         int (*_libc_getpwuid_r)(uid_t uid, struct passwd *pwd, char *buf, size_t buflen, struct passwd **result);
 285         void (*_libc_setpwent)(void);
 286         struct passwd *(*_libc_getpwent)(void);
 287 #ifdef HAVE_SOLARIS_GETPWENT_R
 288         struct passwd *(*_libc_getpwent_r)(struct passwd *pwbuf, char *buf, size_t buflen);
 289 #else
 290         int (*_libc_getpwent_r)(struct passwd *pwbuf, char *buf, size_t buflen, struct passwd **pwbufp);
 291 #endif
 292         void (*_libc_endpwent)(void);
 293         int (*_libc_initgroups)(const char *user, gid_t gid);
 294         struct group *(*_libc_getgrnam)(const char *name);
 295         int (*_libc_getgrnam_r)(const char *name, struct group *grp, char *buf, size_t buflen, struct group **result);
 296         struct group *(*_libc_getgrgid)(gid_t gid);
 297         int (*_libc_getgrgid_r)(gid_t gid, struct group *grp, char *buf, size_t buflen, struct group **result);
 298         void (*_libc_setgrent)(void);
 299         struct group *(*_libc_getgrent)(void);
 300 #ifdef HAVE_SOLARIS_GETGRENT_R
 301         struct group *(*_libc_getgrent_r)(struct group *group, char *buf, size_t buflen);
 302 #else
 303         int (*_libc_getgrent_r)(struct group *group, char *buf, size_t buflen, struct group **result);
 304 #endif
 305         void (*_libc_endgrent)(void);
 306         int (*_libc_getgrouplist)(const char *user, gid_t group, gid_t *groups, int *ngroups);
 307
 308         void (*_libc_sethostent)(int stayopen);
 309         struct hostent *(*_libc_gethostent)(void);
 310         void (*_libc_endhostent)(void);
 311
 312         struct hostent *(*_libc_gethostbyname)(const char *name);
 313 #ifdef HAVE_GETHOSTBYNAME2 /* GNU extension */
 314         struct hostent *(*_libc_gethostbyname2)(const char *name, int af);
 315 #endif
 316         struct hostent *(*_libc_gethostbyaddr)(const void *addr, socklen_t len, int type);
 317
 318         int (*_libc_getaddrinfo)(const char *node, const char *service,
 319                                  const struct addrinfo *hints,
 320                                  struct addrinfo **res);
 321         int (*_libc_getnameinfo)(const struct sockaddr *sa, socklen_t salen,
 322                                  char *host, size_t hostlen,
 323                                  char *serv, size_t servlen,
 324                                  int flags);
 325         int (*_libc_gethostname)(char *name, size_t len);
 326 #ifdef HAVE_GETHOSTBYNAME_R
 327         int (*_libc_gethostbyname_r)(const char *name,
 328                                      struct hostent *ret,
 329                                      char *buf, size_t buflen,
 330                                      struct hostent **result, int *h_errnop);
 331 #endif
 332 #ifdef HAVE_GETHOSTBYADDR_R
 333         int (*_libc_gethostbyaddr_r)(const void *addr, socklen_t len, int type,
 334                                      struct hostent *ret,
 335                                      char *buf, size_t buflen,
 336                                      struct hostent **result, int *h_errnop);
 337 #endif
 338 };
 339
 340 struct nwrap_module_nss_fns {
 341         NSS_STATUS (*_nss_getpwnam_r)(const char *name, struct passwd *result, char *buffer,
 342                                       size_t buflen, int *errnop);
 343         NSS_STATUS (*_nss_getpwuid_r)(uid_t uid, struct passwd *result, char *buffer,
 344                                       size_t buflen, int *errnop);
 345         NSS_STATUS (*_nss_setpwent)(void);
 346         NSS_STATUS (*_nss_getpwent_r)(struct passwd *result, char *buffer,
 347                                       size_t buflen, int *errnop);
 348         NSS_STATUS (*_nss_endpwent)(void);
 349         NSS_STATUS (*_nss_initgroups)(const char *user, gid_t group, long int *start,
 350                                       long int *size, gid_t **groups, long int limit, int *errnop);
 351         NSS_STATUS (*_nss_getgrnam_r)(const char *name, struct group *result, char *buffer,
 352                                       size_t buflen, int *errnop);
 353         NSS_STATUS (*_nss_getgrgid_r)(gid_t gid, struct group *result, char *buffer,
 354                                       size_t buflen, int *errnop);
 355         NSS_STATUS (*_nss_setgrent)(void);
 356         NSS_STATUS (*_nss_getgrent_r)(struct group *result, char *buffer,
 357                                       size_t buflen, int *errnop);
 358         NSS_STATUS (*_nss_endgrent)(void);
 359 };
 360
 361 struct nwrap_backend {
 362         const char *name;
 363         const char *so_path;
 364         void *so_handle;
 365         struct nwrap_ops *ops;
 366         struct nwrap_module_nss_fns *fns;
 367 };
 368
 369 struct nwrap_ops {
 370         struct passwd * (*nw_getpwnam)(struct nwrap_backend *b,
 371                                        const char *name);
 372         int             (*nw_getpwnam_r)(struct nwrap_backend *b,
 373                                          const char *name, struct passwd *pwdst,
 374                                          char *buf, size_t buflen, struct passwd **pwdstp);
 375         struct passwd * (*nw_getpwuid)(struct nwrap_backend *b,
 376                                        uid_t uid);
 377         int             (*nw_getpwuid_r)(struct nwrap_backend *b,
 378                                          uid_t uid, struct passwd *pwdst,
 379                                          char *buf, size_t buflen, struct passwd **pwdstp);
 380         void            (*nw_setpwent)(struct nwrap_backend *b);
 381         struct passwd * (*nw_getpwent)(struct nwrap_backend *b);
 382         int             (*nw_getpwent_r)(struct nwrap_backend *b,
 383                                          struct passwd *pwdst, char *buf,
 384                                          size_t buflen, struct passwd **pwdstp);
 385         void            (*nw_endpwent)(struct nwrap_backend *b);
 386         int             (*nw_initgroups)(struct nwrap_backend *b,
 387                                          const char *user, gid_t group);
 388         struct group *  (*nw_getgrnam)(struct nwrap_backend *b,
 389                                        const char *name);
 390         int             (*nw_getgrnam_r)(struct nwrap_backend *b,
 391                                          const char *name, struct group *grdst,
 392                                          char *buf, size_t buflen, struct group **grdstp);
 393         struct group *  (*nw_getgrgid)(struct nwrap_backend *b,
 394                                        gid_t gid);
 395         int             (*nw_getgrgid_r)(struct nwrap_backend *b,
 396                                          gid_t gid, struct group *grdst,
 397                                          char *buf, size_t buflen, struct group **grdstp);
 398         void            (*nw_setgrent)(struct nwrap_backend *b);
 399         struct group *  (*nw_getgrent)(struct nwrap_backend *b);
 400         int             (*nw_getgrent_r)(struct nwrap_backend *b,
 401                                          struct group *grdst, char *buf,
 402                                          size_t buflen, struct group **grdstp);
 403         void            (*nw_endgrent)(struct nwrap_backend *b);
 404 };
 405
 406 /* Public prototypes */
 407
 408 bool nss_wrapper_enabled(void);
 409 bool nss_wrapper_shadow_enabled(void);
 410 bool nss_wrapper_hosts_enabled(void);
 411
 412 /* prototypes for files backend */
 413
 414
 415 static struct passwd *nwrap_files_getpwnam(struct nwrap_backend *b,
 416                                            const char *name);
 417 static int nwrap_files_getpwnam_r(struct nwrap_backend *b,
 418                                   const char *name, struct passwd *pwdst,
 419                                   char *buf, size_t buflen, struct passwd **pwdstp);
 420 static struct passwd *nwrap_files_getpwuid(struct nwrap_backend *b,
 421                                            uid_t uid);
 422 static int nwrap_files_getpwuid_r(struct nwrap_backend *b,
 423                                   uid_t uid, struct passwd *pwdst,
 424                                   char *buf, size_t buflen, struct passwd **pwdstp);
 425 static void nwrap_files_setpwent(struct nwrap_backend *b);
 426 static struct passwd *nwrap_files_getpwent(struct nwrap_backend *b);
 427 static int nwrap_files_getpwent_r(struct nwrap_backend *b,
 428                                   struct passwd *pwdst, char *buf,
 429                                   size_t buflen, struct passwd **pwdstp);
 430 static void nwrap_files_endpwent(struct nwrap_backend *b);
 431 static int nwrap_files_initgroups(struct nwrap_backend *b,
 432                                   const char *user, gid_t group);
 433 static struct group *nwrap_files_getgrnam(struct nwrap_backend *b,
 434                                           const char *name);
 435 static int nwrap_files_getgrnam_r(struct nwrap_backend *b,
 436                                   const char *name, struct group *grdst,
 437                                   char *buf, size_t buflen, struct group **grdstp);
 438 static struct group *nwrap_files_getgrgid(struct nwrap_backend *b,
 439                                           gid_t gid);
 440 static int nwrap_files_getgrgid_r(struct nwrap_backend *b,
 441                                   gid_t gid, struct group *grdst,
 442                                   char *buf, size_t buflen, struct group **grdstp);
 443 static void nwrap_files_setgrent(struct nwrap_backend *b);
 444 static struct group *nwrap_files_getgrent(struct nwrap_backend *b);
 445 static int nwrap_files_getgrent_r(struct nwrap_backend *b,
 446                                   struct group *grdst, char *buf,
 447                                   size_t buflen, struct group **grdstp);
 448 static void nwrap_files_endgrent(struct nwrap_backend *b);
 449
 450 /* prototypes for module backend */
 451
 452 static struct passwd *nwrap_module_getpwent(struct nwrap_backend *b);
 453 static int nwrap_module_getpwent_r(struct nwrap_backend *b,
 454                                    struct passwd *pwdst, char *buf,
 455                                    size_t buflen, struct passwd **pwdstp);
 456 static struct passwd *nwrap_module_getpwnam(struct nwrap_backend *b,
 457                                             const char *name);
 458 static int nwrap_module_getpwnam_r(struct nwrap_backend *b,
 459                                    const char *name, struct passwd *pwdst,
 460                                    char *buf, size_t buflen, struct passwd **pwdstp);
 461 static struct passwd *nwrap_module_getpwuid(struct nwrap_backend *b,
 462                                             uid_t uid);
 463 static int nwrap_module_getpwuid_r(struct nwrap_backend *b,
 464                                    uid_t uid, struct passwd *pwdst,
 465                                    char *buf, size_t buflen, struct passwd **pwdstp);
 466 static void nwrap_module_setpwent(struct nwrap_backend *b);
 467 static void nwrap_module_endpwent(struct nwrap_backend *b);
 468 static struct group *nwrap_module_getgrent(struct nwrap_backend *b);
 469 static int nwrap_module_getgrent_r(struct nwrap_backend *b,
 470                                    struct group *grdst, char *buf,
 471                                    size_t buflen, struct group **grdstp);
 472 static struct group *nwrap_module_getgrnam(struct nwrap_backend *b,
 473                                            const char *name);
 474 static int nwrap_module_getgrnam_r(struct nwrap_backend *b,
 475                                    const char *name, struct group *grdst,
 476                                    char *buf, size_t buflen, struct group **grdstp);
 477 static struct group *nwrap_module_getgrgid(struct nwrap_backend *b,
 478                                            gid_t gid);
 479 static int nwrap_module_getgrgid_r(struct nwrap_backend *b,
 480                                    gid_t gid, struct group *grdst,
 481                                    char *buf, size_t buflen, struct group **grdstp);
 482 static void nwrap_module_setgrent(struct nwrap_backend *b);
 483 static void nwrap_module_endgrent(struct nwrap_backend *b);
 484 static int nwrap_module_initgroups(struct nwrap_backend *b,
 485                                    const char *user, gid_t group);
 486
 487 struct nwrap_ops nwrap_files_ops = {
 488         .nw_getpwnam    = nwrap_files_getpwnam,
 489         .nw_getpwnam_r  = nwrap_files_getpwnam_r,
 490         .nw_getpwuid    = nwrap_files_getpwuid,
 491         .nw_getpwuid_r  = nwrap_files_getpwuid_r,
 492         .nw_setpwent    = nwrap_files_setpwent,
 493         .nw_getpwent    = nwrap_files_getpwent,
 494         .nw_getpwent_r  = nwrap_files_getpwent_r,
 495         .nw_endpwent    = nwrap_files_endpwent,
 496         .nw_initgroups  = nwrap_files_initgroups,
 497         .nw_getgrnam    = nwrap_files_getgrnam,
 498         .nw_getgrnam_r  = nwrap_files_getgrnam_r,
 499         .nw_getgrgid    = nwrap_files_getgrgid,
 500         .nw_getgrgid_r  = nwrap_files_getgrgid_r,
 501         .nw_setgrent    = nwrap_files_setgrent,
 502         .nw_getgrent    = nwrap_files_getgrent,
 503         .nw_getgrent_r  = nwrap_files_getgrent_r,
 504         .nw_endgrent    = nwrap_files_endgrent,
 505 };
 506
 507 struct nwrap_ops nwrap_module_ops = {
 508         .nw_getpwnam    = nwrap_module_getpwnam,
 509         .nw_getpwnam_r  = nwrap_module_getpwnam_r,
 510         .nw_getpwuid    = nwrap_module_getpwuid,
 511         .nw_getpwuid_r  = nwrap_module_getpwuid_r,
 512         .nw_setpwent    = nwrap_module_setpwent,
 513         .nw_getpwent    = nwrap_module_getpwent,
 514         .nw_getpwent_r  = nwrap_module_getpwent_r,
 515         .nw_endpwent    = nwrap_module_endpwent,
 516         .nw_initgroups  = nwrap_module_initgroups,
 517         .nw_getgrnam    = nwrap_module_getgrnam,
 518         .nw_getgrnam_r  = nwrap_module_getgrnam_r,
 519         .nw_getgrgid    = nwrap_module_getgrgid,
 520         .nw_getgrgid_r  = nwrap_module_getgrgid_r,
 521         .nw_setgrent    = nwrap_module_setgrent,
 522         .nw_getgrent    = nwrap_module_getgrent,
 523         .nw_getgrent_r  = nwrap_module_getgrent_r,
 524         .nw_endgrent    = nwrap_module_endgrent,
 525 };
 526
 527 struct nwrap_libc {
 528         void *handle;
 529         void *nsl_handle;
 530         void *sock_handle;
 531         struct nwrap_libc_fns *fns;
 532 };
 533
 534 struct nwrap_main {
 535         int num_backends;
 536         struct nwrap_backend *backends;
 537         struct nwrap_libc *libc;
 538 };
 539
 540 static struct nwrap_main *nwrap_main_global;
 541 static struct nwrap_main __nwrap_main_global;
 542
 543 /*
 544  * PROTOTYPES
 545  */
 546 static int nwrap_convert_he_ai(const struct hostent *he,
 547                                unsigned short port,
 548                                const struct addrinfo *hints,
 549                                struct addrinfo **pai,
 550                                bool skip_canonname);
 551
 552 /*
 553  * VECTORS
 554  */
 555
 556 #define DEFAULT_VECTOR_CAPACITY 16
 557
 558 struct nwrap_vector {
 559         void **items;
 560         size_t count;
 561         size_t capacity;
 562 };
 563
 564 /* Macro returns pointer to first element of vector->items array.
 565  *
 566  * nwrap_vector is used as a memory backend which take care of
 567  * memory allocations and other stuff like memory growing.
 568  * nwrap_vectors should not be considered as some abstract structures.
 569  * On this level, vectors are more handy than direct realloc/malloc
 570  * calls.
 571  *
 572  * nwrap_vector->items is array inside nwrap_vector which can be
 573  * directly pointed by libc structure assembled by cwrap itself.
 574  *
 575  * EXAMPLE:
 576  *
 577  * 1) struct hostent contains char **h_addr_list element.
 578  * 2) nwrap_vector holds array of pointers to addresses.
 579  *    It's easier to use vector to store results of
 580  *    file parsing etc.
 581  *
 582  * Now, pretend that cwrap assembled struct hostent and
 583  * we need to set h_addr_list to point to nwrap_vector.
 584  * Idea behind is to shield users from internal nwrap_vector
 585  * implementation.
 586  * (Yes, not fully - array terminated by NULL is needed because
 587  * it's result expected by libc function caller.)
 588  *
 589  *
 590  * CODE EXAMPLE:
 591  *
 592  * struct hostent he;
 593  * struct nwrap_vector *vector = malloc(sizeof(struct nwrap_vector));
 594  * ... don't care about failed allocation now ...
 595  *
 596  * ... fill nwrap vector ...
 597  *
 598  * struct hostent he;
 599  * he.h_addr_list = nwrap_vector_head(vector);
 600  *
 601  */
 602 #define nwrap_vector_head(vect) ((void *)((vect)->items))
 603
 604 #define nwrap_vector_foreach(item, vect, iter) \
 605         for (iter = 0, (item) = (vect).items == NULL ? NULL : (vect).items[0]; \
 606              item != NULL; \
 607              (item) = (vect).items[++iter])
 608
 609 #define nwrap_vector_is_initialized(vector) ((vector)->items != NULL)
 610
 611 static inline bool nwrap_vector_init(struct nwrap_vector *const vector)
 612 {
 613         if (vector == NULL) {
 614                 return false;
 615         }
 616
 617         /* count is initialized by ZERO_STRUCTP */
 618         ZERO_STRUCTP(vector);
 619         vector->items = malloc(sizeof(void *) * (DEFAULT_VECTOR_CAPACITY + 1));
 620         if (vector->items == NULL) {
 621                 return false;
 622         }
 623         vector->capacity = DEFAULT_VECTOR_CAPACITY;
 624         memset(vector->items, '\0', sizeof(void *) * (DEFAULT_VECTOR_CAPACITY + 1));
 625
 626         return true;
 627 }
 628
 629 static bool nwrap_vector_add_item(struct nwrap_vector *vector, void *const item)
 630 {
 631         assert (vector != NULL);
 632
 633         if (vector->items == NULL) {
 634                 nwrap_vector_init(vector);
 635         }
 636
 637         if (vector->count == vector->capacity) {
 638                 /* Items array _MUST_ be NULL terminated because it's passed
 639                  * as result to caller which expect NULL terminated array from libc.
 640                  */
 641                 void **items = realloc(vector->items, sizeof(void *) * ((vector->capacity * 2) + 1));
 642                 if (items == NULL) {
 643                         return false;
 644                 }
 645                 vector->items = items;
 646
 647                 /* Don't count ending NULL to capacity */
 648                 vector->capacity *= 2;
 649         }
 650
 651         vector->items[vector->count] = item;
 652
 653         vector->count += 1;
 654         vector->items[vector->count] = NULL;
 655
 656         return true;
 657 }
 658
 659 static bool nwrap_vector_merge(struct nwrap_vector *dst,
 660                                struct nwrap_vector *src)
 661 {
 662         void **dst_items = NULL;
 663         size_t count;
 664
 665         if (src->count == 0) {
 666                 return true;
 667         }
 668
 669         count = dst->count + src->count;
 670
 671         /* We don't need reallocation if we have enough capacity. */
 672         if (src->count > (dst->capacity - dst->count)) {
 673                 dst_items = (void **)realloc(dst->items, (count + 1) * sizeof(void *));
 674                 if (dst_items == NULL) {
 675                         return false;
 676                 }
 677                 dst->items = dst_items;
 678                 dst->capacity = count;
 679         }
 680
 681         memcpy((void *)(((long *)dst->items) + dst->count),
 682                src->items,
 683                src->count * sizeof(void *));
 684         dst->count = count;
 685
 686         return true;
 687 }
 688
 689 struct nwrap_cache {
 690         const char *path;
 691         int fd;
 692         FILE *fp;
 693         struct stat st;
 694         void *private_data;
 695
 696         struct nwrap_vector lines;
 697
 698         bool (*parse_line)(struct nwrap_cache *, char *line);
 699         void (*unload)(struct nwrap_cache *);
 700 };
 701
 702 /* passwd */
 703 struct nwrap_pw {
 704         struct nwrap_cache *cache;
 705
 706         struct passwd *list;
 707         int num;
 708         int idx;
 709 };
 710
 711 struct nwrap_cache __nwrap_cache_pw;
 712 struct nwrap_pw nwrap_pw_global;
 713
 714 static bool nwrap_pw_parse_line(struct nwrap_cache *nwrap, char *line);
 715 static void nwrap_pw_unload(struct nwrap_cache *nwrap);
 716
 717 /* shadow */
 718 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
 719 struct nwrap_sp {
 720         struct nwrap_cache *cache;
 721
 722         struct spwd *list;
 723         int num;
 724         int idx;
 725 };
 726
 727 struct nwrap_cache __nwrap_cache_sp;
 728 struct nwrap_sp nwrap_sp_global;
 729
 730 static bool nwrap_sp_parse_line(struct nwrap_cache *nwrap, char *line);
 731 static void nwrap_sp_unload(struct nwrap_cache *nwrap);
 732 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
 733
 734 /* group */
 735 struct nwrap_gr {
 736         struct nwrap_cache *cache;
 737
 738         struct group *list;
 739         int num;
 740         int idx;
 741 };
 742
 743 struct nwrap_cache __nwrap_cache_gr;
 744 struct nwrap_gr nwrap_gr_global;
 745
 746 /* hosts */
 747 static bool nwrap_he_parse_line(struct nwrap_cache *nwrap, char *line);
 748 static void nwrap_he_unload(struct nwrap_cache *nwrap);
 749
 750 struct nwrap_addrdata {
 751         unsigned char host_addr[16]; /* IPv4 or IPv6 address */
 752 };
 753
 754 static size_t max_hostents = 100;
 755
 756 struct nwrap_entdata {
 757         struct nwrap_addrdata addr;
 758         struct hostent ht;
 759
 760         struct nwrap_vector nwrap_addrdata;
 761
 762         ssize_t aliases_count;
 763 };
 764
 765 struct nwrap_entlist {
 766         struct nwrap_entlist *next;
 767         struct nwrap_entdata *ed;
 768 };
 769
 770 struct nwrap_he {
 771         struct nwrap_cache *cache;
 772
 773         struct nwrap_entdata *list;
 774         struct nwrap_vector entdata;
 775
 776         int num;
 777         int idx;
 778 };
 779
 780 static struct nwrap_cache __nwrap_cache_he;
 781 static struct nwrap_he nwrap_he_global;
 782
 783
 784 /*********************************************************
 785  * NWRAP PROTOTYPES
 786  *********************************************************/
 787
 788 static void nwrap_init(void);
 789 static bool nwrap_gr_parse_line(struct nwrap_cache *nwrap, char *line);
 790 static void nwrap_gr_unload(struct nwrap_cache *nwrap);
 791 void nwrap_destructor(void) DESTRUCTOR_ATTRIBUTE;
 792
 793 /*********************************************************
 794  * NWRAP LIBC LOADER FUNCTIONS
 795  *********************************************************/
 796
 797 enum nwrap_lib {
 798     NWRAP_LIBC,
 799     NWRAP_LIBNSL,
 800     NWRAP_LIBSOCKET,
 801 };
 802
 803 #ifndef NDEBUG
 804 static const char *nwrap_str_lib(enum nwrap_lib lib)
 805 {
 806         switch (lib) {
 807         case NWRAP_LIBC:
 808                 return "libc";
 809         case NWRAP_LIBNSL:
 810                 return "libnsl";
 811         case NWRAP_LIBSOCKET:
 812                 return "libsocket";
 813         }
 814
 815         /* Compiler would warn us about unhandled enum value if we get here */
 816         return "unknown";
 817 }
 818 #endif
 819
 820 static void *nwrap_load_lib_handle(enum nwrap_lib lib)
 821 {
 822         int flags = RTLD_LAZY;
 823         void *handle = NULL;
 824         int i;
 825
 826 #ifdef RTLD_DEEPBIND
 827         flags |= RTLD_DEEPBIND;
 828 #endif
 829
 830         switch (lib) {
 831         case NWRAP_LIBNSL:
 832 #ifdef HAVE_LIBNSL
 833                 handle = nwrap_main_global->libc->nsl_handle;
 834                 if (handle == NULL) {
 835                         for (i = 10; i >= 0; i--) {
 836                                 char soname[256] = {0};
 837
 838                                 snprintf(soname, sizeof(soname), "libnsl.so.%d", i);
 839                                 handle = dlopen(soname, flags);
 840                                 if (handle != NULL) {
 841                                         break;
 842                                 }
 843                         }
 844
 845                         nwrap_main_global->libc->nsl_handle = handle;
 846                 }
 847                 break;
 848 #endif
 849                 /* FALL TROUGH */
 850         case NWRAP_LIBSOCKET:
 851 #ifdef HAVE_LIBSOCKET
 852                 handle = nwrap_main_global->libc->sock_handle;
 853                 if (handle == NULL) {
 854                         for (i = 10; i >= 0; i--) {
 855                                 char soname[256] = {0};
 856
 857                                 snprintf(soname, sizeof(soname), "libsocket.so.%d", i);
 858                                 handle = dlopen(soname, flags);
 859                                 if (handle != NULL) {
 860                                         break;
 861                                 }
 862                         }
 863
 864                         nwrap_main_global->libc->sock_handle = handle;
 865                 }
 866                 break;
 867 #endif
 868                 /* FALL TROUGH */
 869         case NWRAP_LIBC:
 870                 handle = nwrap_main_global->libc->handle;
 871                 if (handle == NULL) {
 872                         for (i = 10; i >= 0; i--) {
 873                                 char soname[256] = {0};
 874
 875                                 snprintf(soname, sizeof(soname), "libc.so.%d", i);
 876                                 handle = dlopen(soname, flags);
 877                                 if (handle != NULL) {
 878                                         break;
 879                                 }
 880                         }
 881
 882                         nwrap_main_global->libc->handle = handle;
 883                 }
 884                 break;
 885         }
 886
 887         if (handle == NULL) {
 888 #ifdef RTLD_NEXT
 889                 handle = nwrap_main_global->libc->handle
 890                        = nwrap_main_global->libc->sock_handle
 891                        = nwrap_main_global->libc->nsl_handle
 892                        = RTLD_NEXT;
 893 #else
 894                 NWRAP_LOG(NWRAP_LOG_ERROR,
 895                           "Failed to dlopen library: %s\n",
 896                           dlerror());
 897                 exit(-1);
 898 #endif
 899         }
 900
 901         return handle;
 902 }
 903
 904 static void *_nwrap_load_lib_function(enum nwrap_lib lib, const char *fn_name)
 905 {
 906         void *handle;
 907         void *func;
 908
 909         nwrap_init();
 910
 911         handle = nwrap_load_lib_handle(lib);
 912
 913         func = dlsym(handle, fn_name);
 914         if (func == NULL) {
 915                 NWRAP_LOG(NWRAP_LOG_ERROR,
 916                                 "Failed to find %s: %s\n",
 917                                 fn_name, dlerror());
 918                 exit(-1);
 919         }
 920
 921         NWRAP_LOG(NWRAP_LOG_TRACE,
 922                         "Loaded %s from %s",
 923                         fn_name, nwrap_str_lib(lib));
 924         return func;
 925 }
 926
 927 #define nwrap_load_lib_function(lib, fn_name) \
 928         if (nwrap_main_global->libc->fns->_libc_##fn_name == NULL) { \
 929                 *(void **) (&nwrap_main_global->libc->fns->_libc_##fn_name) = \
 930                         _nwrap_load_lib_function(lib, #fn_name); \
 931         }
 932
 933 /* INTERNAL HELPER FUNCTIONS */
 934 static void nwrap_lines_unload(struct nwrap_cache *const nwrap)
 935 {
 936         size_t p;
 937         void *item;
 938         nwrap_vector_foreach(item, nwrap->lines, p) {
 939                 /* Maybe some vectors were merged ... */
 940                 SAFE_FREE(item);
 941         }
 942         SAFE_FREE(nwrap->lines.items);
 943         ZERO_STRUCTP(&nwrap->lines);
 944 }
 945
 946 /*
 947  * IMPORTANT
 948  *
 949  * Functions expeciall from libc need to be loaded individually, you can't load
 950  * all at once or gdb will segfault at startup. The same applies to valgrind and
 951  * has probably something todo with with the linker.
 952  * So we need load each function at the point it is called the first time.
 953  */
 954 static struct passwd *libc_getpwnam(const char *name)
 955 {
 956         nwrap_load_lib_function(NWRAP_LIBC, getpwnam);
 957
 958         return nwrap_main_global->libc->fns->_libc_getpwnam(name);
 959 }
 960
 961 #ifdef HAVE_GETPWNAM_R
 962 static int libc_getpwnam_r(const char *name,
 963                            struct passwd *pwd,
 964                            char *buf,
 965                            size_t buflen,
 966                            struct passwd **result)
 967 {
 968 #ifdef HAVE___POSIX_GETPWNAM_R
 969         if (nwrap_main_global->libc->fns->_libc_getpwnam_r == NULL) {
 970                 *(void **) (&nwrap_main_global->libc->fns->_libc_getpwnam_r) =
 971                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getpwnam_r");
 972         }
 973 #else
 974         nwrap_load_lib_function(NWRAP_LIBC, getpwnam_r);
 975 #endif
 976
 977         return nwrap_main_global->libc->fns->_libc_getpwnam_r(name,
 978                                                               pwd,
 979                                                               buf,
 980                                                               buflen,
 981                                                               result);
 982 }
 983 #endif
 984
 985 static struct passwd *libc_getpwuid(uid_t uid)
 986 {
 987         nwrap_load_lib_function(NWRAP_LIBC, getpwuid);
 988
 989         return nwrap_main_global->libc->fns->_libc_getpwuid(uid);
 990 }
 991
 992 #ifdef HAVE_GETPWUID_R
 993 static int libc_getpwuid_r(uid_t uid,
 994                            struct passwd *pwd,
 995                            char *buf,
 996                            size_t buflen,
 997                            struct passwd **result)
 998 {
 999 #ifdef HAVE___POSIX_GETPWUID_R
1000         if (nwrap_main_global->libc->fns->_libc_getpwuid_r == NULL) {
1001                 *(void **) (&nwrap_main_global->libc->fns->_libc_getpwuid_r) =
1002                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getpwuid_r");
1003         }
1004 #else
1005         nwrap_load_lib_function(NWRAP_LIBC, getpwuid_r);
1006 #endif
1007
1008         return nwrap_main_global->libc->fns->_libc_getpwuid_r(uid,
1009                                                               pwd,
1010                                                               buf,
1011                                                               buflen,
1012                                                               result);
1013 }
1014 #endif
1015
1016 static inline void str_tolower(char *dst, char *src)
1017 {
1018         register char *src_tmp = src;
1019         register char *dst_tmp = dst;
1020
1021         while (*src_tmp != '\0') {
1022                 *dst_tmp = tolower(*src_tmp);
1023                 ++src_tmp;
1024                 ++dst_tmp;
1025         }
1026 }
1027
1028 static bool str_tolower_copy(char **dst_name, const char *const src_name)
1029 {
1030         char *h_name_lower;
1031
1032         if ((dst_name == NULL) || (src_name == NULL)) {
1033                 return false;
1034         }
1035
1036         h_name_lower = strdup(src_name);
1037         if (h_name_lower == NULL) {
1038                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Out of memory while strdup");
1039                 return false;
1040         }
1041
1042         str_tolower(h_name_lower, h_name_lower);
1043         *dst_name = h_name_lower;
1044         return true;
1045 }
1046
1047 static void libc_setpwent(void)
1048 {
1049         nwrap_load_lib_function(NWRAP_LIBC, setpwent);
1050
1051         nwrap_main_global->libc->fns->_libc_setpwent();
1052 }
1053
1054 static struct passwd *libc_getpwent(void)
1055 {
1056         nwrap_load_lib_function(NWRAP_LIBC, getpwent);
1057
1058         return nwrap_main_global->libc->fns->_libc_getpwent();
1059 }
1060
1061 #ifdef HAVE_SOLARIS_GETPWENT_R
1062 static struct passwd *libc_getpwent_r(struct passwd *pwdst,
1063                                       char *buf,
1064                                       int buflen)
1065 {
1066         nwrap_load_lib_function(NWRAP_LIBC, getpwent_r);
1067
1068         return nwrap_main_global->libc->fns->_libc_getpwent_r(pwdst,
1069                                                               buf,
1070                                                               buflen);
1071 }
1072 #else /* HAVE_SOLARIS_GETPWENT_R */
1073 static int libc_getpwent_r(struct passwd *pwdst,
1074                            char *buf,
1075                            size_t buflen,
1076                            struct passwd **pwdstp)
1077 {
1078         nwrap_load_lib_function(NWRAP_LIBC, getpwent_r);
1079
1080         return nwrap_main_global->libc->fns->_libc_getpwent_r(pwdst,
1081                                                               buf,
1082                                                               buflen,
1083                                                               pwdstp);
1084 }
1085 #endif /* HAVE_SOLARIS_GETPWENT_R */
1086
1087 static void libc_endpwent(void)
1088 {
1089         nwrap_load_lib_function(NWRAP_LIBC, endpwent);
1090
1091         nwrap_main_global->libc->fns->_libc_endpwent();
1092 }
1093
1094 static int libc_initgroups(const char *user, gid_t gid)
1095 {
1096         nwrap_load_lib_function(NWRAP_LIBC, initgroups);
1097
1098         return nwrap_main_global->libc->fns->_libc_initgroups(user, gid);
1099 }
1100
1101 static struct group *libc_getgrnam(const char *name)
1102 {
1103         nwrap_load_lib_function(NWRAP_LIBC, getgrnam);
1104
1105         return nwrap_main_global->libc->fns->_libc_getgrnam(name);
1106 }
1107
1108 #ifdef HAVE_GETGRNAM_R
1109 static int libc_getgrnam_r(const char *name,
1110                            struct group *grp,
1111                            char *buf,
1112                            size_t buflen,
1113                            struct group **result)
1114 {
1115 #ifdef HAVE___POSIX_GETGRNAM_R
1116         if (nwrap_main_global->libc->fns->_libc_getgrnam_r == NULL) {
1117                 *(void **) (&nwrap_main_global->libc->fns->_libc_getgrnam_r) =
1118                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getgrnam_r");
1119         }
1120 #else
1121         nwrap_load_lib_function(NWRAP_LIBC, getgrnam_r);
1122 #endif
1123
1124         return nwrap_main_global->libc->fns->_libc_getgrnam_r(name,
1125                                                               grp,
1126                                                               buf,
1127                                                               buflen,
1128                                                               result);
1129 }
1130 #endif
1131
1132 static struct group *libc_getgrgid(gid_t gid)
1133 {
1134         nwrap_load_lib_function(NWRAP_LIBC, getgrgid);
1135
1136         return nwrap_main_global->libc->fns->_libc_getgrgid(gid);
1137 }
1138
1139 #ifdef HAVE_GETGRGID_R
1140 static int libc_getgrgid_r(gid_t gid,
1141                            struct group *grp,
1142                            char *buf,
1143                            size_t buflen,
1144                            struct group **result)
1145 {
1146 #ifdef HAVE___POSIX_GETGRGID_R
1147         if (nwrap_main_global->libc->fns->_libc_getgrgid_r == NULL) {
1148                 *(void **) (&nwrap_main_global->libc->fns->_libc_getgrgid_r) =
1149                         _nwrap_load_lib_function(NWRAP_LIBC, "__posix_getgrgid_r");
1150         }
1151 #else
1152         nwrap_load_lib_function(NWRAP_LIBC, getgrgid_r);
1153 #endif
1154
1155         return nwrap_main_global->libc->fns->_libc_getgrgid_r(gid,
1156                                                               grp,
1157                                                               buf,
1158                                                               buflen,
1159                                                               result);
1160 }
1161 #endif
1162
1163 static void libc_setgrent(void)
1164 {
1165         nwrap_load_lib_function(NWRAP_LIBC, setgrent);
1166
1167         nwrap_main_global->libc->fns->_libc_setgrent();
1168 }
1169
1170 static struct group *libc_getgrent(void)
1171 {
1172         nwrap_load_lib_function(NWRAP_LIBC, getgrent);
1173
1174         return nwrap_main_global->libc->fns->_libc_getgrent();
1175 }
1176
1177 #ifdef HAVE_GETGRENT_R
1178 #ifdef HAVE_SOLARIS_GETGRENT_R
1179 static struct group *libc_getgrent_r(struct group *group,
1180                                      char *buf,
1181                                      size_t buflen)
1182 {
1183         nwrap_load_lib_function(NWRAP_LIBC, getgrent_r);
1184
1185         return nwrap_main_global->libc->fns->_libc_getgrent_r(group,
1186                                                               buf,
1187                                                               buflen);
1188 }
1189 #else /* !HAVE_SOLARIS_GETGRENT_R */
1190 static int libc_getgrent_r(struct group *group,
1191                            char *buf,
1192                            size_t buflen,
1193                            struct group **result)
1194 {
1195         nwrap_load_lib_function(NWRAP_LIBC, getgrent_r);
1196
1197         return nwrap_main_global->libc->fns->_libc_getgrent_r(group,
1198                                                               buf,
1199                                                               buflen,
1200                                                               result);
1201 }
1202 #endif /* HAVE_SOLARIS_GETGRENT_R */
1203 #endif /* HAVE_GETGRENT_R */
1204
1205 static void libc_endgrent(void)
1206 {
1207         nwrap_load_lib_function(NWRAP_LIBC, endgrent);
1208
1209         nwrap_main_global->libc->fns->_libc_endgrent();
1210 }
1211
1212 #ifdef HAVE_GETGROUPLIST
1213 static int libc_getgrouplist(const char *user,
1214                              gid_t group,
1215                              gid_t *groups,
1216                              int *ngroups)
1217 {
1218         nwrap_load_lib_function(NWRAP_LIBC, getgrouplist);
1219
1220         return nwrap_main_global->libc->fns->_libc_getgrouplist(user,
1221                                                                 group,
1222                                                                 groups,
1223                                                                 ngroups);
1224 }
1225 #endif
1226
1227 static void libc_sethostent(int stayopen)
1228 {
1229         nwrap_load_lib_function(NWRAP_LIBNSL, sethostent);
1230
1231         nwrap_main_global->libc->fns->_libc_sethostent(stayopen);
1232 }
1233
1234 static struct hostent *libc_gethostent(void)
1235 {
1236         nwrap_load_lib_function(NWRAP_LIBNSL, gethostent);
1237
1238         return nwrap_main_global->libc->fns->_libc_gethostent();
1239 }
1240
1241 static void libc_endhostent(void)
1242 {
1243         nwrap_load_lib_function(NWRAP_LIBNSL, endhostent);
1244
1245         nwrap_main_global->libc->fns->_libc_endhostent();
1246 }
1247
1248 static struct hostent *libc_gethostbyname(const char *name)
1249 {
1250         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname);
1251
1252         return nwrap_main_global->libc->fns->_libc_gethostbyname(name);
1253 }
1254
1255 #ifdef HAVE_GETHOSTBYNAME2 /* GNU extension */
1256 static struct hostent *libc_gethostbyname2(const char *name, int af)
1257 {
1258         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname2);
1259
1260         return nwrap_main_global->libc->fns->_libc_gethostbyname2(name, af);
1261 }
1262 #endif
1263
1264 static struct hostent *libc_gethostbyaddr(const void *addr,
1265                                           socklen_t len,
1266                                           int type)
1267 {
1268         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyaddr);
1269
1270         return nwrap_main_global->libc->fns->_libc_gethostbyaddr(addr,
1271                                                                  len,
1272                                                                  type);
1273 }
1274
1275 static int libc_gethostname(char *name, size_t len)
1276 {
1277         nwrap_load_lib_function(NWRAP_LIBNSL, gethostname);
1278
1279         return nwrap_main_global->libc->fns->_libc_gethostname(name, len);
1280 }
1281
1282 #ifdef HAVE_GETHOSTBYNAME_R
1283 static int libc_gethostbyname_r(const char *name,
1284                                 struct hostent *ret,
1285                                 char *buf,
1286                                 size_t buflen,
1287                                 struct hostent **result,
1288                                 int *h_errnop)
1289 {
1290         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname_r);
1291
1292         return nwrap_main_global->libc->fns->_libc_gethostbyname_r(name,
1293                                                                    ret,
1294                                                                    buf,
1295                                                                    buflen,
1296                                                                    result,
1297                                                                    h_errnop);
1298 }
1299 #endif
1300
1301 #ifdef HAVE_GETHOSTBYADDR_R
1302 static int libc_gethostbyaddr_r(const void *addr,
1303                                 socklen_t len,
1304                                 int type,
1305                                 struct hostent *ret,
1306                                 char *buf,
1307                                 size_t buflen,
1308                                 struct hostent **result,
1309                                 int *h_errnop)
1310 {
1311         nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyaddr_r);
1312
1313         return nwrap_main_global->libc->fns->_libc_gethostbyaddr_r(addr,
1314                                                                    len,
1315                                                                    type,
1316                                                                    ret,
1317                                                                    buf,
1318                                                                    buflen,
1319                                                                    result,
1320                                                                    h_errnop);
1321 }
1322 #endif
1323
1324 static int libc_getaddrinfo(const char *node,
1325                             const char *service,
1326                             const struct addrinfo *hints,
1327                             struct addrinfo **res)
1328 {
1329         nwrap_load_lib_function(NWRAP_LIBSOCKET, getaddrinfo);
1330
1331         return nwrap_main_global->libc->fns->_libc_getaddrinfo(node,
1332                                                                service,
1333                                                                hints,
1334                                                                res);
1335 }
1336
1337 static int libc_getnameinfo(const struct sockaddr *sa,
1338                             socklen_t salen,
1339                             char *host,
1340                             size_t hostlen,
1341                             char *serv,
1342                             size_t servlen,
1343                             int flags)
1344 {
1345         nwrap_load_lib_function(NWRAP_LIBSOCKET, getnameinfo);
1346
1347         return nwrap_main_global->libc->fns->_libc_getnameinfo(sa,
1348                                                                salen,
1349                                                                host,
1350                                                                hostlen,
1351                                                                serv,
1352                                                                servlen,
1353                                                                flags);
1354 }
1355
1356 /*********************************************************
1357  * NWRAP NSS MODULE LOADER FUNCTIONS
1358  *********************************************************/
1359
1360 static void *nwrap_load_module_fn(struct nwrap_backend *b,
1361                                   const char *fn_name)
1362 {
1363         void *res;
1364         char *s;
1365
1366         if (!b->so_handle) {
1367                 NWRAP_LOG(NWRAP_LOG_ERROR, "No handle");
1368                 return NULL;
1369         }
1370
1371         if (asprintf(&s, "_nss_%s_%s", b->name, fn_name) == -1) {
1372                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
1373                 return NULL;
1374         }
1375
1376         res = dlsym(b->so_handle, s);
1377         if (!res) {
1378                 NWRAP_LOG(NWRAP_LOG_ERROR,
1379                           "Cannot find function %s in %s",
1380                           s, b->so_path);
1381         }
1382         SAFE_FREE(s);
1383         return res;
1384 }
1385
1386 static struct nwrap_module_nss_fns *nwrap_load_module_fns(struct nwrap_backend *b)
1387 {
1388         struct nwrap_module_nss_fns *fns;
1389
1390         if (!b->so_handle) {
1391                 return NULL;
1392         }
1393
1394         fns = (struct nwrap_module_nss_fns *)malloc(sizeof(struct nwrap_module_nss_fns));
1395         if (!fns) {
1396                 return NULL;
1397         }
1398
1399         *(void **)(&fns->_nss_getpwnam_r) =
1400                 nwrap_load_module_fn(b, "getpwnam_r");
1401         *(void **)(&fns->_nss_getpwuid_r) =
1402                 nwrap_load_module_fn(b, "getpwuid_r");
1403         *(void **)(&fns->_nss_setpwent) =
1404                 nwrap_load_module_fn(b, "setpwent");
1405         *(void **)(&fns->_nss_getpwent_r) =
1406                 nwrap_load_module_fn(b, "getpwent_r");
1407         *(void **)(&fns->_nss_endpwent) =
1408                 nwrap_load_module_fn(b, "endpwent");
1409         *(void **)(&fns->_nss_initgroups) =
1410                 nwrap_load_module_fn(b, "initgroups_dyn");
1411         *(void **)(&fns->_nss_getgrnam_r) =
1412                 nwrap_load_module_fn(b, "getgrnam_r");
1413         *(void **)(&fns->_nss_getgrgid_r)=
1414                 nwrap_load_module_fn(b, "getgrgid_r");
1415         *(void **)(&fns->_nss_setgrent) =
1416                 nwrap_load_module_fn(b, "setgrent");
1417         *(void **)(&fns->_nss_getgrent_r) =
1418                 nwrap_load_module_fn(b, "getgrent_r");
1419         *(void **)(&fns->_nss_endgrent) =
1420                 nwrap_load_module_fn(b, "endgrent");
1421
1422         return fns;
1423 }
1424
1425 static void *nwrap_load_module(const char *so_path)
1426 {
1427         void *h;
1428
1429         if (!so_path || !strlen(so_path)) {
1430                 return NULL;
1431         }
1432
1433         h = dlopen(so_path, RTLD_LAZY);
1434         if (!h) {
1435                 NWRAP_LOG(NWRAP_LOG_ERROR,
1436                           "Cannot open shared library %s",
1437                           so_path);
1438                 return NULL;
1439         }
1440
1441         return h;
1442 }
1443
1444 static bool nwrap_module_init(const char *name,
1445                               struct nwrap_ops *ops,
1446                               const char *so_path,
1447                               int *num_backends,
1448                               struct nwrap_backend **backends)
1449 {
1450         struct nwrap_backend *b;
1451
1452         *backends = (struct nwrap_backend *)realloc(*backends,
1453                 sizeof(struct nwrap_backend) * ((*num_backends) + 1));
1454         if (!*backends) {
1455                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
1456                 return false;
1457         }
1458
1459         b = &((*backends)[*num_backends]);
1460
1461         b->name = name;
1462         b->ops = ops;
1463         b->so_path = so_path;
1464
1465         if (so_path != NULL) {
1466                 b->so_handle = nwrap_load_module(so_path);
1467                 b->fns = nwrap_load_module_fns(b);
1468                 if (b->fns == NULL) {
1469                         return false;
1470                 }
1471         } else {
1472                 b->so_handle = NULL;
1473                 b->fns = NULL;
1474         }
1475
1476         (*num_backends)++;
1477
1478         return true;
1479 }
1480
1481 static void nwrap_libc_init(struct nwrap_main *r)
1482 {
1483         r->libc = malloc(sizeof(struct nwrap_libc));
1484         if (r->libc == NULL) {
1485                 printf("Failed to allocate memory for libc");
1486                 exit(-1);
1487         }
1488         ZERO_STRUCTP(r->libc);
1489
1490         r->libc->fns = malloc(sizeof(struct nwrap_libc_fns));
1491         if (r->libc->fns == NULL) {
1492                 printf("Failed to allocate memory for libc functions");
1493                 exit(-1);
1494         }
1495         ZERO_STRUCTP(r->libc->fns);
1496 }
1497
1498 static void nwrap_backend_init(struct nwrap_main *r)
1499 {
1500         const char *module_so_path = getenv("NSS_WRAPPER_MODULE_SO_PATH");
1501         const char *module_fn_name = getenv("NSS_WRAPPER_MODULE_FN_PREFIX");
1502
1503         r->num_backends = 0;
1504         r->backends = NULL;
1505
1506         if (!nwrap_module_init("files", &nwrap_files_ops, NULL,
1507                                &r->num_backends,
1508                                &r->backends)) {
1509                 NWRAP_LOG(NWRAP_LOG_ERROR,
1510                           "Failed to initialize 'files' backend");
1511                 return;
1512         }
1513
1514         if (module_so_path != NULL &&
1515             module_so_path[0] != '\0' &&
1516             module_fn_name != NULL &&
1517             module_fn_name[0] != '\0') {
1518                 if (!nwrap_module_init(module_fn_name,
1519                                        &nwrap_module_ops,
1520                                        module_so_path,
1521                                        &r->num_backends,
1522                                        &r->backends)) {
1523                         NWRAP_LOG(NWRAP_LOG_ERROR,
1524                                   "Failed to initialize '%s' backend",
1525                                   module_fn_name);
1526                         return;
1527                 }
1528         }
1529 }
1530
1531 static void nwrap_init(void)
1532 {
1533         const char *env;
1534         char *endptr;
1535         size_t max_hostents_tmp;
1536
1537         NWRAP_LOCK(nwrap_initialized);
1538         if (nwrap_initialized) {
1539                 NWRAP_UNLOCK(nwrap_initialized);
1540                 return;
1541         }
1542
1543         /*
1544          * Still holding nwrap_initialized lock here.
1545          * We don't use NWRAP_(UN)LOCK_ALL macros here because we
1546          * want to avoid overhead when other threads do their job.
1547          */
1548         NWRAP_LOCK(nwrap_global);
1549         NWRAP_LOCK(nwrap_gr_global);
1550         NWRAP_LOCK(nwrap_he_global);
1551         NWRAP_LOCK(nwrap_pw_global);
1552         NWRAP_LOCK(nwrap_sp_global);
1553
1554         nwrap_initialized = true;
1555
1556         /* Initialize pthread_atfork handlers */
1557         pthread_atfork(&nwrap_thread_prepare, &nwrap_thread_parent,
1558                        &nwrap_thread_child);
1559
1560         env = getenv("NSS_WRAPPER_MAX_HOSTENTS");
1561         if (env != NULL) {
1562                 max_hostents_tmp = (size_t)strtol(env, &endptr, 10);
1563                 if (((env != '\0') && (endptr == '\0')) ||
1564                     (max_hostents_tmp == 0)) {
1565                         NWRAP_LOG(NWRAP_LOG_DEBUG,
1566                                   "Error parsing NSS_WRAPPER_MAX_HOSTENTS "
1567                                   "value or value is too small. "
1568                                   "Using default value: %lu.",
1569                                   max_hostents);
1570                 } else {
1571                         max_hostents = max_hostents_tmp;
1572                 }
1573         }
1574         /* Initialize hash table */
1575         NWRAP_LOG(NWRAP_LOG_DEBUG,
1576                   "Initializing hash table of size %lu items.", max_hostents);
1577         if (hcreate(max_hostents) == 0) {
1578                 NWRAP_LOG(NWRAP_LOG_ERROR,
1579                           "Failed to initialize hash table");
1580                 goto done;
1581         }
1582
1583         nwrap_main_global = &__nwrap_main_global;
1584
1585         nwrap_libc_init(nwrap_main_global);
1586
1587         nwrap_backend_init(nwrap_main_global);
1588
1589         /* passwd */
1590         nwrap_pw_global.cache = &__nwrap_cache_pw;
1591
1592         nwrap_pw_global.cache->path = getenv("NSS_WRAPPER_PASSWD");
1593         nwrap_pw_global.cache->fp = NULL;
1594         nwrap_pw_global.cache->fd = -1;
1595         nwrap_pw_global.cache->private_data = &nwrap_pw_global;
1596         nwrap_pw_global.cache->parse_line = nwrap_pw_parse_line;
1597         nwrap_pw_global.cache->unload = nwrap_pw_unload;
1598
1599         /* shadow */
1600 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
1601         nwrap_sp_global.cache = &__nwrap_cache_sp;
1602
1603         nwrap_sp_global.cache->path = getenv("NSS_WRAPPER_SHADOW");
1604         nwrap_sp_global.cache->fp = NULL;
1605         nwrap_sp_global.cache->fd = -1;
1606         nwrap_sp_global.cache->private_data = &nwrap_sp_global;
1607         nwrap_sp_global.cache->parse_line = nwrap_sp_parse_line;
1608         nwrap_sp_global.cache->unload = nwrap_sp_unload;
1609 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
1610
1611         /* group */
1612         nwrap_gr_global.cache = &__nwrap_cache_gr;
1613
1614         nwrap_gr_global.cache->path = getenv("NSS_WRAPPER_GROUP");
1615         nwrap_gr_global.cache->fp = NULL;
1616         nwrap_gr_global.cache->fd = -1;
1617         nwrap_gr_global.cache->private_data = &nwrap_gr_global;
1618         nwrap_gr_global.cache->parse_line = nwrap_gr_parse_line;
1619         nwrap_gr_global.cache->unload = nwrap_gr_unload;
1620
1621         /* hosts */
1622         nwrap_he_global.cache = &__nwrap_cache_he;
1623
1624         nwrap_he_global.cache->path = getenv("NSS_WRAPPER_HOSTS");
1625         nwrap_he_global.cache->fp = NULL;
1626         nwrap_he_global.cache->fd = -1;
1627         nwrap_he_global.cache->private_data = &nwrap_he_global;
1628         nwrap_he_global.cache->parse_line = nwrap_he_parse_line;
1629         nwrap_he_global.cache->unload = nwrap_he_unload;
1630
1631 done:
1632         /* We hold all locks here so we can use NWRAP_UNLOCK_ALL. */
1633         NWRAP_UNLOCK_ALL;
1634 }
1635
1636 bool nss_wrapper_enabled(void)
1637 {
1638         nwrap_init();
1639
1640         if (nwrap_pw_global.cache->path == NULL ||
1641             nwrap_pw_global.cache->path[0] == '\0') {
1642                 return false;
1643         }
1644         if (nwrap_gr_global.cache->path == NULL ||
1645             nwrap_gr_global.cache->path[0] == '\0') {
1646                 return false;
1647         }
1648
1649         return true;
1650 }
1651
1652 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
1653 bool nss_wrapper_shadow_enabled(void)
1654 {
1655         nwrap_init();
1656
1657         if (nwrap_sp_global.cache->path == NULL ||
1658             nwrap_sp_global.cache->path[0] == '\0') {
1659                 return false;
1660         }
1661
1662         return true;
1663 }
1664 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
1665
1666 bool nss_wrapper_hosts_enabled(void)
1667 {
1668         nwrap_init();
1669
1670         if (nwrap_he_global.cache->path == NULL ||
1671             nwrap_he_global.cache->path[0] == '\0') {
1672                 return false;
1673         }
1674
1675         return true;
1676 }
1677
1678 static bool nwrap_hostname_enabled(void)
1679 {
1680         nwrap_init();
1681
1682         if (getenv("NSS_WRAPPER_HOSTNAME") == NULL) {
1683                 return false;
1684         }
1685
1686         return true;
1687 }
1688
1689 static bool nwrap_parse_file(struct nwrap_cache *nwrap)
1690 {
1691         char *line = NULL;
1692         ssize_t n;
1693         /* Unused but getline needs it */
1694         size_t len;
1695         bool ok;
1696
1697         if (nwrap->st.st_size == 0) {
1698                 NWRAP_LOG(NWRAP_LOG_DEBUG, "size == 0");
1699                 return true;
1700         }
1701
1702         /* Support for 32-bit system I guess */
1703         if (nwrap->st.st_size > INT32_MAX) {
1704                 NWRAP_LOG(NWRAP_LOG_ERROR,
1705                           "Size[%u] larger than INT32_MAX",
1706                           (unsigned)nwrap->st.st_size);
1707                 return false;
1708         }
1709
1710         rewind(nwrap->fp);
1711
1712         do {
1713                 n = getline(&line, &len, nwrap->fp);
1714                 if (n < 0) {
1715                         SAFE_FREE(line);
1716                         if (feof(nwrap->fp)) {
1717                                 break;
1718                         }
1719
1720                         NWRAP_LOG(NWRAP_LOG_ERROR,
1721                                   "Unable to read line from file: %s",
1722                                   nwrap->path);
1723                         return false;
1724                 }
1725
1726                 if (line[n - 1] == '\n') {
1727                         line[n - 1] = '\0';
1728                 }
1729
1730                 if (line[0] == '\0') {
1731                         SAFE_FREE(line);
1732                         continue;
1733                 }
1734
1735                 ok = nwrap->parse_line(nwrap, line);
1736                 if (!ok) {
1737                         NWRAP_LOG(NWRAP_LOG_ERROR,
1738                                   "Unable to parse line file: %s",
1739                                   line);
1740                         SAFE_FREE(line);
1741                         return false;
1742                 }
1743
1744                 /* Line is parsed without issues so add it to list */
1745                 ok = nwrap_vector_add_item(&(nwrap->lines), (void *const) line);
1746                 if (!ok) {
1747                         NWRAP_LOG(NWRAP_LOG_ERROR,
1748                                   "Unable to add line to vector");
1749                         return false;
1750                 }
1751
1752                 /* This forces getline to allocate new memory for line. */
1753                 line = NULL;
1754         } while (!feof(nwrap->fp));
1755
1756         return true;
1757 }
1758
1759 static void nwrap_files_cache_unload(struct nwrap_cache *nwrap)
1760 {
1761         nwrap->unload(nwrap);
1762
1763         nwrap_lines_unload(nwrap);
1764 }
1765
1766 static bool nwrap_files_cache_reload(struct nwrap_cache *nwrap)
1767 {
1768         struct stat st;
1769         int ret;
1770         bool ok;
1771         bool retried = false;
1772
1773         assert(nwrap != NULL);
1774
1775 reopen:
1776         if (nwrap->fd < 0) {
1777                 nwrap->fp = fopen(nwrap->path, "re");
1778                 if (nwrap->fp == NULL) {
1779                         nwrap->fd = -1;
1780                         NWRAP_LOG(NWRAP_LOG_ERROR,
1781                                   "Unable to open '%s' readonly %d:%s",
1782                                   nwrap->path, nwrap->fd,
1783                                   strerror(errno));
1784                         return false;
1785
1786                 }
1787                 nwrap->fd = fileno(nwrap->fp);
1788                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Open '%s'", nwrap->path);
1789         }
1790
1791         ret = fstat(nwrap->fd, &st);
1792         if (ret != 0) {
1793                 NWRAP_LOG(NWRAP_LOG_ERROR,
1794                           "fstat(%s) - %d:%s",
1795                           nwrap->path,
1796                           ret,
1797                           strerror(errno));
1798                 fclose(nwrap->fp);
1799                 nwrap->fp = NULL;
1800                 nwrap->fd = -1;
1801                 return false;
1802         }
1803
1804         if (retried == false && st.st_nlink == 0) {
1805                 /* maybe someone has replaced the file... */
1806                 NWRAP_LOG(NWRAP_LOG_TRACE,
1807                           "st_nlink == 0, reopen %s",
1808                           nwrap->path);
1809                 retried = true;
1810                 memset(&nwrap->st, 0, sizeof(nwrap->st));
1811                 fclose(nwrap->fp);
1812                 nwrap->fp = NULL;
1813                 nwrap->fd = -1;
1814                 goto reopen;
1815         }
1816
1817         if (st.st_mtime == nwrap->st.st_mtime) {
1818                 NWRAP_LOG(NWRAP_LOG_TRACE,
1819                           "st_mtime[%u] hasn't changed, skip reload",
1820                           (unsigned)st.st_mtime);
1821                 return true;
1822         }
1823
1824         NWRAP_LOG(NWRAP_LOG_TRACE,
1825                   "st_mtime has changed [%u] => [%u], start reload",
1826                   (unsigned)st.st_mtime,
1827                   (unsigned)nwrap->st.st_mtime);
1828
1829         nwrap->st = st;
1830
1831         nwrap_files_cache_unload(nwrap);
1832
1833         ok = nwrap_parse_file(nwrap);
1834         if (!ok) {
1835                 NWRAP_LOG(NWRAP_LOG_ERROR, "Failed to reload %s", nwrap->path);
1836                 nwrap_files_cache_unload(nwrap);
1837                 return false;
1838         }
1839
1840         NWRAP_LOG(NWRAP_LOG_TRACE, "Reloaded %s", nwrap->path);
1841         return true;
1842 }
1843
1844 /*
1845  * the caller has to call nwrap_unload() on failure
1846  */
1847 static bool nwrap_pw_parse_line(struct nwrap_cache *nwrap, char *line)
1848 {
1849         struct nwrap_pw *nwrap_pw;
1850         char *c;
1851         char *p;
1852         char *e;
1853         struct passwd *pw;
1854         size_t list_size;
1855
1856         nwrap_pw = (struct nwrap_pw *)nwrap->private_data;
1857
1858         list_size = sizeof(*nwrap_pw->list) * (nwrap_pw->num+1);
1859         pw = (struct passwd *)realloc(nwrap_pw->list, list_size);
1860         if (!pw) {
1861                 NWRAP_LOG(NWRAP_LOG_ERROR,
1862                           "realloc(%u) failed",
1863                           (unsigned)list_size);
1864                 return false;
1865         }
1866         nwrap_pw->list = pw;
1867
1868         pw = &nwrap_pw->list[nwrap_pw->num];
1869
1870         c = line;
1871
1872         /* name */
1873         p = strchr(c, ':');
1874         if (!p) {
1875                 NWRAP_LOG(NWRAP_LOG_ERROR,
1876                           "Invalid line[%s]: '%s'",
1877                           line,
1878                           c);
1879                 return false;
1880         }
1881         *p = '\0';
1882         p++;
1883         pw->pw_name = c;
1884         c = p;
1885
1886         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]\n", pw->pw_name);
1887
1888         /* password */
1889         p = strchr(c, ':');
1890         if (!p) {
1891                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1892                 return false;
1893         }
1894         *p = '\0';
1895         p++;
1896         pw->pw_passwd = c;
1897         c = p;
1898
1899         NWRAP_LOG(NWRAP_LOG_TRACE, "password[%s]\n", pw->pw_passwd);
1900
1901         /* uid */
1902         p = strchr(c, ':');
1903         if (!p) {
1904                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1905                 return false;
1906         }
1907         *p = '\0';
1908         p++;
1909         e = NULL;
1910         pw->pw_uid = (uid_t)strtoul(c, &e, 10);
1911         if (c == e) {
1912                 NWRAP_LOG(NWRAP_LOG_ERROR,
1913                           "Invalid line[%s]: '%s' - %s",
1914                           line, c, strerror(errno));
1915                 return false;
1916         }
1917         if (e == NULL) {
1918                 NWRAP_LOG(NWRAP_LOG_ERROR,
1919                           "Invalid line[%s]: '%s' - %s",
1920                           line, c, strerror(errno));
1921                 return false;
1922         }
1923         if (e[0] != '\0') {
1924                 NWRAP_LOG(NWRAP_LOG_ERROR,
1925                           "Invalid line[%s]: '%s' - %s",
1926                           line, c, strerror(errno));
1927                 return false;
1928         }
1929         c = p;
1930
1931         NWRAP_LOG(NWRAP_LOG_TRACE, "uid[%u]", pw->pw_uid);
1932
1933         /* gid */
1934         p = strchr(c, ':');
1935         if (!p) {
1936                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
1937                 return false;
1938         }
1939         *p = '\0';
1940         p++;
1941         e = NULL;
1942         pw->pw_gid = (gid_t)strtoul(c, &e, 10);
1943         if (c == e) {
1944                 NWRAP_LOG(NWRAP_LOG_ERROR,
1945                           "Invalid line[%s]: '%s' - %s",
1946                           line, c, strerror(errno));
1947                 return false;
1948         }
1949         if (e == NULL) {
1950                 NWRAP_LOG(NWRAP_LOG_ERROR,
1951                           "Invalid line[%s]: '%s' - %s",
1952                           line, c, strerror(errno));
1953                 return false;
1954         }
1955         if (e[0] != '\0') {
1956                 NWRAP_LOG(NWRAP_LOG_ERROR,
1957                           "Invalid line[%s]: '%s' - %s",
1958                           line, c, strerror(errno));
1959                 return false;
1960         }
1961         c = p;
1962
1963         NWRAP_LOG(NWRAP_LOG_TRACE, "gid[%u]\n", pw->pw_gid);
1964
1965         /* gecos */
1966         p = strchr(c, ':');
1967         if (!p) {
1968                 NWRAP_LOG(NWRAP_LOG_ERROR, "invalid line[%s]: '%s'", line, c);
1969                 return false;
1970         }
1971         *p = '\0';
1972         p++;
1973         pw->pw_gecos = c;
1974         c = p;
1975
1976         NWRAP_LOG(NWRAP_LOG_TRACE, "gecos[%s]", pw->pw_gecos);
1977
1978         /* dir */
1979         p = strchr(c, ':');
1980         if (!p) {
1981                 NWRAP_LOG(NWRAP_LOG_ERROR, "'%s'", c);
1982                 return false;
1983         }
1984         *p = '\0';
1985         p++;
1986         pw->pw_dir = c;
1987         c = p;
1988
1989         NWRAP_LOG(NWRAP_LOG_TRACE, "dir[%s]", pw->pw_dir);
1990
1991         /* shell */
1992         pw->pw_shell = c;
1993         NWRAP_LOG(NWRAP_LOG_TRACE, "shell[%s]", pw->pw_shell);
1994
1995         NWRAP_LOG(NWRAP_LOG_DEBUG,
1996                   "Added user[%s:%s:%u:%u:%s:%s:%s]",
1997                   pw->pw_name, pw->pw_passwd,
1998                   pw->pw_uid, pw->pw_gid,
1999                   pw->pw_gecos, pw->pw_dir, pw->pw_shell);
2000
2001         nwrap_pw->num++;
2002         return true;
2003 }
2004
2005 static void nwrap_pw_unload(struct nwrap_cache *nwrap)
2006 {
2007         struct nwrap_pw *nwrap_pw;
2008         nwrap_pw = (struct nwrap_pw *)nwrap->private_data;
2009
2010         SAFE_FREE(nwrap_pw->list);
2011         nwrap_pw->num = 0;
2012         nwrap_pw->idx = 0;
2013 }
2014
2015 static int nwrap_pw_copy_r(const struct passwd *src, struct passwd *dst,
2016                            char *buf, size_t buflen, struct passwd **dstp)
2017 {
2018         char *first;
2019         char *last;
2020         off_t ofs;
2021
2022         first = src->pw_name;
2023
2024         last = src->pw_shell;
2025         while (*last) last++;
2026
2027         ofs = PTR_DIFF(last + 1, first);
2028
2029         if (ofs > (off_t) buflen) {
2030                 return ERANGE;
2031         }
2032
2033         memcpy(buf, first, ofs);
2034
2035         ofs = PTR_DIFF(src->pw_name, first);
2036         dst->pw_name = buf + ofs;
2037         ofs = PTR_DIFF(src->pw_passwd, first);
2038         dst->pw_passwd = buf + ofs;
2039         dst->pw_uid = src->pw_uid;
2040         dst->pw_gid = src->pw_gid;
2041         ofs = PTR_DIFF(src->pw_gecos, first);
2042         dst->pw_gecos = buf + ofs;
2043         ofs = PTR_DIFF(src->pw_dir, first);
2044         dst->pw_dir = buf + ofs;
2045         ofs = PTR_DIFF(src->pw_shell, first);
2046         dst->pw_shell = buf + ofs;
2047
2048         if (dstp) {
2049                 *dstp = dst;
2050         }
2051
2052         return 0;
2053 }
2054
2055 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
2056 static bool nwrap_sp_parse_line(struct nwrap_cache *nwrap, char *line)
2057 {
2058         struct nwrap_sp *nwrap_sp;
2059         struct spwd *sp;
2060         size_t list_size;
2061         char *c;
2062         char *e;
2063         char *p;
2064
2065         nwrap_sp = (struct nwrap_sp *)nwrap->private_data;
2066
2067         list_size = sizeof(*nwrap_sp->list) * (nwrap_sp->num+1);
2068         sp = (struct spwd *)realloc(nwrap_sp->list, list_size);
2069         if (sp == NULL) {
2070                 NWRAP_LOG(NWRAP_LOG_ERROR,
2071                           "realloc(%u) failed",
2072                           (unsigned)list_size);
2073                 return false;
2074         }
2075         nwrap_sp->list = sp;
2076
2077         sp = &nwrap_sp->list[nwrap_sp->num];
2078
2079         c = line;
2080
2081         /* name */
2082         p = strchr(c, ':');
2083         if (p == NULL) {
2084                 NWRAP_LOG(NWRAP_LOG_ERROR,
2085                           "name -- Invalid line[%s]: '%s'",
2086                           line,
2087                           c);
2088                 return false;
2089         }
2090         *p = '\0';
2091         p++;
2092         sp->sp_namp = c;
2093         c = p;
2094
2095         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]\n", sp->sp_namp);
2096
2097         /* pwd */
2098         p = strchr(c, ':');
2099         if (p == NULL) {
2100                 NWRAP_LOG(NWRAP_LOG_ERROR,
2101                           "pwd -- Invalid line[%s]: '%s'",
2102                           line,
2103                           c);
2104                 return false;
2105         }
2106         *p = '\0';
2107         p++;
2108         sp->sp_pwdp = c;
2109         c = p;
2110
2111         /* lstchg (long) */
2112         if (c[0] == ':') {
2113                 sp->sp_lstchg = -1;
2114                 p++;
2115         } else {
2116                 p = strchr(c, ':');
2117                 if (p == NULL) {
2118                         NWRAP_LOG(NWRAP_LOG_ERROR,
2119                                   "lstchg -- Invalid line[%s]: '%s'",
2120                                   line,
2121                                   c);
2122                         return false;
2123                 }
2124                 *p = '\0';
2125                 p++;
2126                 sp->sp_lstchg = strtol(c, &e, 10);
2127                 if (c == e) {
2128                         NWRAP_LOG(NWRAP_LOG_ERROR,
2129                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2130                                   line, c, strerror(errno));
2131                         return false;
2132                 }
2133                 if (e == NULL) {
2134                         NWRAP_LOG(NWRAP_LOG_ERROR,
2135                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2136                                   line, c, strerror(errno));
2137                         return false;
2138                 }
2139                 if (e[0] != '\0') {
2140                         NWRAP_LOG(NWRAP_LOG_ERROR,
2141                                   "lstchg -- Invalid line[%s]: '%s' - %s",
2142                                   line, c, strerror(errno));
2143                         return false;
2144                 }
2145         }
2146         c = p;
2147
2148         /* min (long) */
2149         if (c[0] == ':') {
2150                 sp->sp_min = -1;
2151                 p++;
2152         } else {
2153                 p = strchr(c, ':');
2154                 if (p == NULL) {
2155                         NWRAP_LOG(NWRAP_LOG_ERROR,
2156                                   "min -- Invalid line[%s]: '%s'",
2157                                   line,
2158                                   c);
2159                         return false;
2160                 }
2161                 *p = '\0';
2162                 p++;
2163                 sp->sp_min = strtol(c, &e, 10);
2164                 if (c == e) {
2165                         NWRAP_LOG(NWRAP_LOG_ERROR,
2166                                   "min -- Invalid line[%s]: '%s' - %s",
2167                                   line, c, strerror(errno));
2168                         return false;
2169                 }
2170                 if (e == NULL) {
2171                         NWRAP_LOG(NWRAP_LOG_ERROR,
2172                                   "min -- Invalid line[%s]: '%s' - %s",
2173                                   line, c, strerror(errno));
2174                         return false;
2175                 }
2176                 if (e[0] != '\0') {
2177                         NWRAP_LOG(NWRAP_LOG_ERROR,
2178                                   "min -- Invalid line[%s]: '%s' - %s",
2179                                   line, c, strerror(errno));
2180                         return false;
2181                 }
2182         }
2183         c = p;
2184
2185         /* max (long) */
2186         if (c[0] == ':') {
2187                 sp->sp_max = -1;
2188                 p++;
2189         } else {
2190                 p = strchr(c, ':');
2191                 if (p == NULL) {
2192                         NWRAP_LOG(NWRAP_LOG_ERROR,
2193                                   "max -- Invalid line[%s]: '%s'",
2194                                   line,
2195                                   c);
2196                         return false;
2197                 }
2198                 *p = '\0';
2199                 p++;
2200                 sp->sp_max = strtol(c, &e, 10);
2201                 if (c == e) {
2202                         NWRAP_LOG(NWRAP_LOG_ERROR,
2203                                   "max -- Invalid line[%s]: '%s' - %s",
2204                                   line, c, strerror(errno));
2205                         return false;
2206                 }
2207                 if (e == NULL) {
2208                         NWRAP_LOG(NWRAP_LOG_ERROR,
2209                                   "max -- Invalid line[%s]: '%s' - %s",
2210                                   line, c, strerror(errno));
2211                         return false;
2212                 }
2213                 if (e[0] != '\0') {
2214                         NWRAP_LOG(NWRAP_LOG_ERROR,
2215                                   "max -- Invalid line[%s]: '%s' - %s",
2216                                   line, c, strerror(errno));
2217                         return false;
2218                 }
2219         }
2220         c = p;
2221
2222         /* warn (long) */
2223         if (c[0] == ':') {
2224                 sp->sp_warn = -1;
2225                 p++;
2226         } else {
2227                 p = strchr(c, ':');
2228                 if (p == NULL) {
2229                         NWRAP_LOG(NWRAP_LOG_ERROR,
2230                                   "warn -- Invalid line[%s]: '%s'",
2231                                   line,
2232                                   c);
2233                         return false;
2234                 }
2235                 *p = '\0';
2236                 p++;
2237                 sp->sp_warn = strtol(c, &e, 10);
2238                 if (c == e) {
2239                         NWRAP_LOG(NWRAP_LOG_ERROR,
2240                                   "warn -- Invalid line[%s]: '%s' - %s",
2241                                   line, c, strerror(errno));
2242                         return false;
2243                 }
2244                 if (e == NULL) {
2245                         NWRAP_LOG(NWRAP_LOG_ERROR,
2246                                   "warn -- Invalid line[%s]: '%s' - %s",
2247                                   line, c, strerror(errno));
2248                         return false;
2249                 }
2250                 if (e[0] != '\0') {
2251                         NWRAP_LOG(NWRAP_LOG_ERROR,
2252                                   "warn -- Invalid line[%s]: '%s' - %s",
2253                                   line, c, strerror(errno));
2254                         return false;
2255                 }
2256         }
2257         c = p;
2258
2259         /* inact (long) */
2260         if (c[0] == ':') {
2261                 sp->sp_inact = -1;
2262                 p++;
2263         } else {
2264                 p = strchr(c, ':');
2265                 if (p == NULL) {
2266                         NWRAP_LOG(NWRAP_LOG_ERROR,
2267                                   "inact -- Invalid line[%s]: '%s'",
2268                                   line,
2269                                   c);
2270                         return false;
2271                 }
2272                 *p = '\0';
2273                 p++;
2274                 sp->sp_inact = strtol(c, &e, 10);
2275                 if (c == e) {
2276                         NWRAP_LOG(NWRAP_LOG_ERROR,
2277                                   "inact -- Invalid line[%s]: '%s' - %s",
2278                                   line, c, strerror(errno));
2279                         return false;
2280                 }
2281                 if (e == NULL) {
2282                         NWRAP_LOG(NWRAP_LOG_ERROR,
2283                                   "inact -- Invalid line[%s]: '%s' - %s",
2284                                   line, c, strerror(errno));
2285                         return false;
2286                 }
2287                 if (e[0] != '\0') {
2288                         NWRAP_LOG(NWRAP_LOG_ERROR,
2289                                   "inact -- Invalid line[%s]: '%s' - %s",
2290                                   line, c, strerror(errno));
2291                         return false;
2292                 }
2293         }
2294         c = p;
2295
2296         /* expire (long) */
2297         if (c[0] == ':') {
2298                 sp->sp_expire = -1;
2299                 p++;
2300         } else {
2301                 p = strchr(c, ':');
2302                 if (p == NULL) {
2303                         NWRAP_LOG(NWRAP_LOG_ERROR,
2304                                   "expire -- Invalid line[%s]: '%s'",
2305                                   line,
2306                                   c);
2307                         return false;
2308                 }
2309                 *p = '\0';
2310                 p++;
2311                 sp->sp_expire = strtol(c, &e, 10);
2312                 if (c == e) {
2313                         NWRAP_LOG(NWRAP_LOG_ERROR,
2314                                   "expire -- Invalid line[%s]: '%s' - %s",
2315                                   line, c, strerror(errno));
2316                         return false;
2317                 }
2318                 if (e == NULL) {
2319                         NWRAP_LOG(NWRAP_LOG_ERROR,
2320                                   "expire -- Invalid line[%s]: '%s' - %s",
2321                                   line, c, strerror(errno));
2322                         return false;
2323                 }
2324                 if (e[0] != '\0') {
2325                         NWRAP_LOG(NWRAP_LOG_ERROR,
2326                                   "expire -- Invalid line[%s]: '%s' - %s",
2327                                   line, c, strerror(errno));
2328                         return false;
2329                 }
2330         }
2331         c = p;
2332
2333         nwrap_sp->num++;
2334         return true;
2335 }
2336
2337 static void nwrap_sp_unload(struct nwrap_cache *nwrap)
2338 {
2339         struct nwrap_sp *nwrap_sp;
2340         nwrap_sp = (struct nwrap_sp *)nwrap->private_data;
2341
2342         SAFE_FREE(nwrap_sp->list);
2343         nwrap_sp->num = 0;
2344         nwrap_sp->idx = 0;
2345 }
2346 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
2347
2348 /*
2349  * the caller has to call nwrap_unload() on failure
2350  */
2351 static bool nwrap_gr_parse_line(struct nwrap_cache *nwrap, char *line)
2352 {
2353         struct nwrap_gr *nwrap_gr;
2354         char *c;
2355         char *p;
2356         char *e;
2357         struct group *gr;
2358         size_t list_size;
2359         unsigned nummem;
2360
2361         nwrap_gr = (struct nwrap_gr *)nwrap->private_data;
2362
2363         list_size = sizeof(*nwrap_gr->list) * (nwrap_gr->num+1);
2364         gr = (struct group *)realloc(nwrap_gr->list, list_size);
2365         if (!gr) {
2366                 NWRAP_LOG(NWRAP_LOG_ERROR, "realloc failed");
2367                 return false;
2368         }
2369         nwrap_gr->list = gr;
2370
2371         gr = &nwrap_gr->list[nwrap_gr->num];
2372
2373         c = line;
2374
2375         /* name */
2376         p = strchr(c, ':');
2377         if (!p) {
2378                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2379                 return false;
2380         }
2381         *p = '\0';
2382         p++;
2383         gr->gr_name = c;
2384         c = p;
2385
2386         NWRAP_LOG(NWRAP_LOG_TRACE, "name[%s]", gr->gr_name);
2387
2388         /* password */
2389         p = strchr(c, ':');
2390         if (!p) {
2391                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2392                 return false;
2393         }
2394         *p = '\0';
2395         p++;
2396         gr->gr_passwd = c;
2397         c = p;
2398
2399         NWRAP_LOG(NWRAP_LOG_TRACE, "password[%s]", gr->gr_passwd);
2400
2401         /* gid */
2402         p = strchr(c, ':');
2403         if (!p) {
2404                 NWRAP_LOG(NWRAP_LOG_ERROR, "Invalid line[%s]: '%s'", line, c);
2405                 return false;
2406         }
2407         *p = '\0';
2408         p++;
2409         e = NULL;
2410         gr->gr_gid = (gid_t)strtoul(c, &e, 10);
2411         if (c == e) {
2412                 NWRAP_LOG(NWRAP_LOG_ERROR,
2413                           "Invalid line[%s]: '%s' - %s",
2414                           line, c, strerror(errno));
2415                 return false;
2416         }
2417         if (e == NULL) {
2418                 NWRAP_LOG(NWRAP_LOG_ERROR,
2419                           "Invalid line[%s]: '%s' - %s",
2420                           line, c, strerror(errno));
2421                 return false;
2422         }
2423         if (e[0] != '\0') {
2424                 NWRAP_LOG(NWRAP_LOG_ERROR,
2425                           "Invalid line[%s]: '%s' - %s",
2426                           line, c, strerror(errno));
2427                 return false;
2428         }
2429         c = p;
2430
2431         NWRAP_LOG(NWRAP_LOG_TRACE, "gid[%u]", gr->gr_gid);
2432
2433         /* members */
2434         gr->gr_mem = (char **)malloc(sizeof(char *));
2435         if (!gr->gr_mem) {
2436                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
2437                 return false;
2438         }
2439         gr->gr_mem[0] = NULL;
2440
2441         for(nummem=0; p; nummem++) {
2442                 char **m;
2443                 size_t m_size;
2444                 c = p;
2445                 p = strchr(c, ',');
2446                 if (p) {
2447                         *p = '\0';
2448                         p++;
2449                 }
2450
2451                 if (strlen(c) == 0) {
2452                         break;
2453                 }
2454
2455                 m_size = sizeof(char *) * (nummem+2);
2456                 m = (char **)realloc(gr->gr_mem, m_size);
2457                 if (!m) {
2458                         NWRAP_LOG(NWRAP_LOG_ERROR,
2459                                   "realloc(%zd) failed",
2460                                   m_size);
2461                         return false;
2462                 }
2463                 gr->gr_mem = m;
2464                 gr->gr_mem[nummem] = c;
2465                 gr->gr_mem[nummem+1] = NULL;
2466
2467                 NWRAP_LOG(NWRAP_LOG_TRACE,
2468                           "member[%u]: '%s'",
2469                           nummem, gr->gr_mem[nummem]);
2470         }
2471
2472         NWRAP_LOG(NWRAP_LOG_DEBUG,
2473                   "Added group[%s:%s:%u:] with %u members",
2474                   gr->gr_name, gr->gr_passwd, gr->gr_gid, nummem);
2475
2476         nwrap_gr->num++;
2477         return true;
2478 }
2479
2480 static void nwrap_gr_unload(struct nwrap_cache *nwrap)
2481 {
2482         int i;
2483         struct nwrap_gr *nwrap_gr;
2484         nwrap_gr = (struct nwrap_gr *)nwrap->private_data;
2485
2486         if (nwrap_gr->list) {
2487                 for (i=0; i < nwrap_gr->num; i++) {
2488                         SAFE_FREE(nwrap_gr->list[i].gr_mem);
2489                 }
2490                 SAFE_FREE(nwrap_gr->list);
2491         }
2492
2493         nwrap_gr->num = 0;
2494         nwrap_gr->idx = 0;
2495 }
2496
2497 static int nwrap_gr_copy_r(const struct group *src, struct group *dst,
2498                            char *buf, size_t buflen, struct group **dstp)
2499 {
2500         char *first;
2501         char **lastm;
2502         char *last = NULL;
2503         off_t ofsb;
2504         off_t ofsm;
2505         off_t ofs;
2506         unsigned i;
2507
2508         first = src->gr_name;
2509
2510         lastm = src->gr_mem;
2511         while (*lastm) {
2512                 last = *lastm;
2513                 lastm++;
2514         }
2515
2516         if (last == NULL) {
2517                 last = src->gr_passwd;
2518         }
2519         while (*last) last++;
2520
2521         ofsb = PTR_DIFF(last + 1, first);
2522         ofsm = PTR_DIFF(lastm + 1, src->gr_mem);
2523
2524         if ((ofsb + ofsm) > (off_t) buflen) {
2525                 return ERANGE;
2526         }
2527
2528         memcpy(buf, first, ofsb);
2529         memcpy(buf + ofsb, src->gr_mem, ofsm);
2530
2531         ofs = PTR_DIFF(src->gr_name, first);
2532         dst->gr_name = buf + ofs;
2533         ofs = PTR_DIFF(src->gr_passwd, first);
2534         dst->gr_passwd = buf + ofs;
2535         dst->gr_gid = src->gr_gid;
2536
2537         dst->gr_mem = (char **)(buf + ofsb);
2538         for (i=0; src->gr_mem[i]; i++) {
2539                 ofs = PTR_DIFF(src->gr_mem[i], first);
2540                 dst->gr_mem[i] = buf + ofs;
2541         }
2542
2543         if (dstp) {
2544                 *dstp = dst;
2545         }
2546
2547         return 0;
2548 }
2549
2550 static struct nwrap_entlist *nwrap_entlist_init(struct nwrap_entdata *ed)
2551 {
2552         struct nwrap_entlist *el;
2553
2554         if (ed == NULL) {
2555                 NWRAP_LOG(NWRAP_LOG_ERROR,
2556                           "entry is NULL, can't create list item");
2557                 return NULL;
2558         }
2559
2560         el = (struct nwrap_entlist *)malloc(sizeof(struct nwrap_entlist));
2561         if (el == NULL) {
2562                 NWRAP_LOG(NWRAP_LOG_ERROR, "malloc failed");
2563                 return NULL;
2564         }
2565
2566         el->next = NULL;
2567         el->ed = ed;
2568
2569         return el;
2570 }
2571
2572 static bool nwrap_ed_inventarize_add_new(char *const h_name,
2573                                          struct nwrap_entdata *const ed)
2574 {
2575         ENTRY e;
2576         ENTRY *p;
2577         struct nwrap_entlist *el;
2578
2579         if (h_name == NULL) {
2580                 NWRAP_LOG(NWRAP_LOG_ERROR, "h_name NULL - can't add");
2581                 return false;
2582         }
2583
2584         el = nwrap_entlist_init(ed);
2585         if (el == NULL) {
2586                 return false;
2587         }
2588
2589         e.key = h_name;
2590         e.data = (void *)el;
2591
2592         p = hsearch(e, ENTER);
2593         if (p == NULL) {
2594                 NWRAP_LOG(NWRAP_LOG_ERROR, "Hash table is full!");
2595                 return false;
2596         }
2597
2598         return true;
2599 }
2600
2601 static bool nwrap_ed_inventarize_add_to_existing(struct nwrap_entdata *const ed,
2602                                                  struct nwrap_entlist *const el)
2603 {
2604         struct nwrap_entlist *cursor;
2605         struct nwrap_entlist *el_new;
2606
2607         if (el == NULL) {
2608                 NWRAP_LOG(NWRAP_LOG_ERROR, "list is NULL, can not add");
2609                 return false;
2610         }
2611
2612         el_new = nwrap_entlist_init(ed);
2613         if (el_new == NULL) {
2614                 return false;
2615         }
2616
2617         for (cursor = el; cursor->next != NULL; cursor = cursor->next)
2618         {
2619                 if (cursor->ed == ed) {
2620                         free(el_new);
2621                         return false;
2622                 }
2623         }
2624
2625         if (cursor->ed == ed) {
2626                 free(el_new);
2627                 return false;
2628         }
2629
2630         cursor->next = el_new;
2631         return true;
2632 }
2633
2634 static bool nwrap_ed_inventarize(char *const name,
2635                                  struct nwrap_entdata *const ed)
2636 {
2637         ENTRY e;
2638         ENTRY *p;
2639         bool ok;
2640
2641         e.key = name;
2642         e.data = NULL;
2643
2644         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching name: %s", e.key);
2645
2646         p = hsearch(e, FIND);
2647         if (p == NULL) {
2648                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found. Adding...", name);
2649                 ok = nwrap_ed_inventarize_add_new(name, ed);
2650         } else {
2651                 struct nwrap_entlist *el = (struct nwrap_entlist *)p->data;
2652
2653                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s found. Add record to list.", name);
2654                 ok = nwrap_ed_inventarize_add_to_existing(ed, el);
2655         }
2656
2657         return ok;
2658 }
2659
2660 static bool nwrap_add_hname(struct nwrap_entdata *const ed)
2661 {
2662         char *const h_name = (char *const)(ed->ht.h_name);
2663         unsigned i;
2664         bool ok;
2665
2666         ok = nwrap_ed_inventarize(h_name, ed);
2667         if (!ok) {
2668                 return false;
2669         }
2670
2671         if (ed->ht.h_aliases == NULL) {
2672                 return true;
2673         }
2674
2675         /* Itemize aliases */
2676         for (i = 0; ed->ht.h_aliases[i] != NULL; ++i) {
2677                 char *h_name_alias;
2678
2679                 h_name_alias = ed->ht.h_aliases[i];
2680
2681                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Add alias: %s", h_name_alias);
2682
2683                 if (!nwrap_ed_inventarize(h_name_alias, ed)) {
2684                         NWRAP_LOG(NWRAP_LOG_ERROR,
2685                                   "Unable to add alias: %s", h_name_alias);
2686                         return false;
2687                 }
2688         }
2689
2690         return true;
2691 }
2692
2693 static bool nwrap_he_parse_line(struct nwrap_cache *nwrap, char *line)
2694 {
2695         struct nwrap_he *nwrap_he = (struct nwrap_he *)nwrap->private_data;
2696         bool do_aliases = true;
2697         ssize_t aliases_count = 0;
2698         char *p;
2699         char *i;
2700         char *n;
2701
2702         char *ip;
2703         bool ok;
2704
2705         struct nwrap_entdata *ed = (struct nwrap_entdata *)
2706                                    malloc(sizeof(struct nwrap_entdata));
2707         if (ed == NULL) {
2708                 NWRAP_LOG(NWRAP_LOG_ERROR,
2709                           "Unable to allocate memory for nwrap_entdata");
2710                 return false;
2711         }
2712         ZERO_STRUCTP(ed);
2713
2714         i = line;
2715
2716         /*
2717          * IP
2718          */
2719
2720         /* Walk to first char */
2721         for (p = i; *p != '.' && *p != ':' && !isxdigit((int) *p); p++) {
2722                 if (*p == '\0') {
2723                         NWRAP_LOG(NWRAP_LOG_ERROR,
2724                                   "Invalid line[%s]: '%s'",
2725                                   line, i);
2726                         free(ed);
2727                         return false;
2728                 }
2729         }
2730
2731         for (i = p; !isspace((int)*p); p++) {
2732                 if (*p == '\0') {
2733                         NWRAP_LOG(NWRAP_LOG_ERROR,
2734                                   "Invalid line[%s]: '%s'",
2735                                   line, i);
2736                         free(ed);
2737                         return false;
2738                 }
2739         }
2740
2741         *p = '\0';
2742
2743         if (inet_pton(AF_INET, i, ed->addr.host_addr)) {
2744                 ed->ht.h_addrtype = AF_INET;
2745                 ed->ht.h_length = 4;
2746 #ifdef HAVE_IPV6
2747         } else if (inet_pton(AF_INET6, i, ed->addr.host_addr)) {
2748                 ed->ht.h_addrtype = AF_INET6;
2749                 ed->ht.h_length = 16;
2750 #endif
2751         } else {
2752                 NWRAP_LOG(NWRAP_LOG_ERROR,
2753                           "Invalid line[%s]: '%s'",
2754                           line, i);
2755
2756                 free(ed);
2757                 return false;
2758         }
2759         ip = i;
2760
2761         nwrap_vector_add_item(&(ed->nwrap_addrdata),
2762                               (void *const)ed->addr.host_addr);
2763         ed->ht.h_addr_list = nwrap_vector_head(&ed->nwrap_addrdata);
2764
2765         p++;
2766
2767         /*
2768          * FQDN
2769          */
2770
2771         /* Walk to first char */
2772         for (n = p; *p != '_' && !isalnum((int) *p); p++) {
2773                 if (*p == '\0') {
2774                         NWRAP_LOG(NWRAP_LOG_ERROR,
2775                                   "Invalid line[%s]: '%s'",
2776                                   line, n);
2777
2778                         free(ed);
2779                         return false;
2780                 }
2781         }
2782
2783         for (n = p; !isspace((int)*p); p++) {
2784                 if (*p == '\0') {
2785                         do_aliases = false;
2786                         break;
2787                 }
2788         }
2789
2790         *p = '\0';
2791
2792         /* Convert to lowercase. This operate on same memory region */
2793         str_tolower(n, n);
2794         ed->ht.h_name = n;
2795
2796         /* glib's getent always dereferences he->h_aliases */
2797         ed->ht.h_aliases = malloc(sizeof(char *));
2798         if (ed->ht.h_aliases == NULL) {
2799                 free(ed);
2800                 return false;
2801         }
2802         ed->ht.h_aliases[0] = NULL;
2803
2804         /*
2805          * Aliases
2806          */
2807         while (do_aliases) {
2808                 char **aliases;
2809                 char *a;
2810
2811                 p++;
2812
2813                 /* Walk to first char */
2814                 for (a = p; *p != '_' && !isalnum((int) *p); p++) {
2815                         if (*p == '\0') {
2816                                 do_aliases = false;
2817                                 break;
2818                         }
2819                 }
2820                 /* Only trailing spaces are left */
2821                 if (!do_aliases) {
2822                         break;
2823                 }
2824
2825                 for (a = p; !isspace((int)*p); p++) {
2826                         if (*p == '\0') {
2827                                 do_aliases = false;
2828                                 break;
2829                         }
2830                 }
2831
2832                 *p = '\0';
2833
2834                 aliases = realloc(ed->ht.h_aliases, sizeof(char *) * (aliases_count + 2));
2835                 if (aliases == NULL) {
2836                         free(ed);
2837                         return false;
2838                 }
2839                 ed->ht.h_aliases = aliases;
2840
2841                 str_tolower(a, a);
2842                 aliases[aliases_count] = a;
2843                 aliases[aliases_count + 1] = NULL;
2844
2845                 aliases_count += 1;
2846         }
2847
2848         nwrap_vector_add_item(&(nwrap_he->entdata), (void *const)ed);
2849
2850         ed->aliases_count = aliases_count;
2851         /* Inventarize item */
2852         ok = nwrap_add_hname(ed);
2853         if (!ok) {
2854                 return false;
2855         }
2856
2857         ok = nwrap_ed_inventarize(ip, ed);
2858         if (!ok) {
2859                 return false;
2860         }
2861
2862         nwrap_he->num++;
2863         return true;
2864 }
2865
2866 static void nwrap_he_unload(struct nwrap_cache *nwrap)
2867 {
2868         struct nwrap_he *nwrap_he =
2869                 (struct nwrap_he *)nwrap->private_data;
2870         struct nwrap_entdata *ed;
2871         size_t i;
2872
2873         nwrap_vector_foreach (ed, nwrap_he->entdata, i)
2874         {
2875                 SAFE_FREE(ed->nwrap_addrdata.items);
2876                 SAFE_FREE(ed->ht.h_aliases);
2877                 SAFE_FREE(ed);
2878         }
2879         SAFE_FREE(nwrap_he->entdata.items);
2880         nwrap_he->entdata.count = nwrap_he->entdata.capacity = 0;
2881
2882         nwrap_he->num = 0;
2883         nwrap_he->idx = 0;
2884 }
2885
2886
2887 /* user functions */
2888 static struct passwd *nwrap_files_getpwnam(struct nwrap_backend *b,
2889                                            const char *name)
2890 {
2891         int i;
2892         bool ok;
2893
2894         (void) b; /* unused */
2895
2896         NWRAP_LOG(NWRAP_LOG_DEBUG, "Lookup user %s in files", name);
2897
2898         ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
2899         if (!ok) {
2900                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
2901                 return NULL;
2902         }
2903
2904         for (i=0; i<nwrap_pw_global.num; i++) {
2905                 if (strcmp(nwrap_pw_global.list[i].pw_name, name) == 0) {
2906                         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] found", name);
2907                         return &nwrap_pw_global.list[i];
2908                 }
2909                 NWRAP_LOG(NWRAP_LOG_DEBUG,
2910                           "user[%s] does not match [%s]",
2911                           name,
2912                           nwrap_pw_global.list[i].pw_name);
2913         }
2914
2915         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] not found\n", name);
2916
2917         errno = ENOENT;
2918         return NULL;
2919 }
2920
2921 static int nwrap_files_getpwnam_r(struct nwrap_backend *b,
2922                                   const char *name, struct passwd *pwdst,
2923                                   char *buf, size_t buflen, struct passwd **pwdstp)
2924 {
2925         struct passwd *pw;
2926
2927         pw = nwrap_files_getpwnam(b, name);
2928         if (!pw) {
2929                 if (errno == 0) {
2930                         return ENOENT;
2931                 }
2932                 return errno;
2933         }
2934
2935         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
2936 }
2937
2938 static struct passwd *nwrap_files_getpwuid(struct nwrap_backend *b,
2939                                            uid_t uid)
2940 {
2941         int i;
2942         bool ok;
2943
2944         (void) b; /* unused */
2945
2946         ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
2947         if (!ok) {
2948                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
2949                 return NULL;
2950         }
2951
2952         for (i=0; i<nwrap_pw_global.num; i++) {
2953                 if (nwrap_pw_global.list[i].pw_uid == uid) {
2954                         NWRAP_LOG(NWRAP_LOG_DEBUG, "uid[%u] found", uid);
2955                         return &nwrap_pw_global.list[i];
2956                 }
2957                 NWRAP_LOG(NWRAP_LOG_DEBUG,
2958                           "uid[%u] does not match [%u]",
2959                           uid,
2960                           nwrap_pw_global.list[i].pw_uid);
2961         }
2962
2963         NWRAP_LOG(NWRAP_LOG_DEBUG, "uid[%u] not found\n", uid);
2964
2965         errno = ENOENT;
2966         return NULL;
2967 }
2968
2969 static int nwrap_files_getpwuid_r(struct nwrap_backend *b,
2970                                   uid_t uid, struct passwd *pwdst,
2971                                   char *buf, size_t buflen, struct passwd **pwdstp)
2972 {
2973         struct passwd *pw;
2974
2975         pw = nwrap_files_getpwuid(b, uid);
2976         if (!pw) {
2977                 if (errno == 0) {
2978                         return ENOENT;
2979                 }
2980                 return errno;
2981         }
2982
2983         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
2984 }
2985
2986 /* user enum functions */
2987 static void nwrap_files_setpwent(struct nwrap_backend *b)
2988 {
2989         (void) b; /* unused */
2990
2991         nwrap_pw_global.idx = 0;
2992 }
2993
2994 static struct passwd *nwrap_files_getpwent(struct nwrap_backend *b)
2995 {
2996         struct passwd *pw;
2997
2998         (void) b; /* unused */
2999
3000         if (nwrap_pw_global.idx == 0) {
3001                 bool ok;
3002                 ok = nwrap_files_cache_reload(nwrap_pw_global.cache);
3003                 if (!ok) {
3004                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading passwd file");
3005                         return NULL;
3006                 }
3007         }
3008
3009         if (nwrap_pw_global.idx >= nwrap_pw_global.num) {
3010                 errno = ENOENT;
3011                 return NULL;
3012         }
3013
3014         pw = &nwrap_pw_global.list[nwrap_pw_global.idx++];
3015
3016         NWRAP_LOG(NWRAP_LOG_DEBUG,
3017                   "return user[%s] uid[%u]",
3018                   pw->pw_name, pw->pw_uid);
3019
3020         return pw;
3021 }
3022
3023 static int nwrap_files_getpwent_r(struct nwrap_backend *b,
3024                                   struct passwd *pwdst, char *buf,
3025                                   size_t buflen, struct passwd **pwdstp)
3026 {
3027         struct passwd *pw;
3028
3029         pw = nwrap_files_getpwent(b);
3030         if (!pw) {
3031                 if (errno == 0) {
3032                         return ENOENT;
3033                 }
3034                 return errno;
3035         }
3036
3037         return nwrap_pw_copy_r(pw, pwdst, buf, buflen, pwdstp);
3038 }
3039
3040 static void nwrap_files_endpwent(struct nwrap_backend *b)
3041 {
3042         (void) b; /* unused */
3043
3044         nwrap_pw_global.idx = 0;
3045 }
3046
3047 /* shadow */
3048
3049 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
3050
3051 #ifdef HAVE_SETSPENT
3052 static void nwrap_files_setspent(void)
3053 {
3054         nwrap_sp_global.idx = 0;
3055 }
3056
3057 static struct spwd *nwrap_files_getspent(void)
3058 {
3059         struct spwd *sp;
3060
3061         if (nwrap_sp_global.idx == 0) {
3062                 bool ok;
3063
3064                 ok = nwrap_files_cache_reload(nwrap_sp_global.cache);
3065                 if (!ok) {
3066                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading shadow file");
3067                         return NULL;
3068                 }
3069         }
3070
3071         if (nwrap_sp_global.idx >= nwrap_sp_global.num) {
3072                 errno = ENOENT;
3073                 return NULL;
3074         }
3075
3076         sp = &nwrap_sp_global.list[nwrap_sp_global.idx++];
3077
3078         NWRAP_LOG(NWRAP_LOG_DEBUG,
3079                   "return user[%s]",
3080                   sp->sp_namp);
3081
3082         return sp;
3083 }
3084
3085 static void nwrap_files_endspent(void)
3086 {
3087         nwrap_sp_global.idx = 0;
3088 }
3089 #endif /* HAVE_SETSPENT */
3090
3091 static struct spwd *nwrap_files_getspnam(const char *name)
3092 {
3093         int i;
3094         bool ok;
3095
3096         NWRAP_LOG(NWRAP_LOG_DEBUG, "Lookup user %s in files", name);
3097
3098         ok = nwrap_files_cache_reload(nwrap_sp_global.cache);
3099         if (!ok) {
3100                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading shadow file");
3101                 return NULL;
3102         }
3103
3104         for (i=0; i<nwrap_sp_global.num; i++) {
3105                 if (strcmp(nwrap_sp_global.list[i].sp_namp, name) == 0) {
3106                         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] found", name);
3107                         return &nwrap_sp_global.list[i];
3108                 }
3109                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3110                           "user[%s] does not match [%s]",
3111                           name,
3112                           nwrap_sp_global.list[i].sp_namp);
3113         }
3114
3115         NWRAP_LOG(NWRAP_LOG_DEBUG, "user[%s] not found\n", name);
3116
3117         errno = ENOENT;
3118         return NULL;
3119 }
3120 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
3121
3122 /* misc functions */
3123 static int nwrap_files_initgroups(struct nwrap_backend *b,
3124                                   const char *user,
3125                                   gid_t group)
3126 {
3127         struct group *grp;
3128         gid_t *groups;
3129         int size = 1;
3130         int rc;
3131
3132         groups = (gid_t *)malloc(size * sizeof(gid_t));
3133         if (groups == NULL) {
3134                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
3135                 errno = ENOMEM;
3136                 return -1;
3137         }
3138         groups[0] = group;
3139
3140         nwrap_files_setgrent(b);
3141         while ((grp = nwrap_files_getgrent(b)) != NULL) {
3142                 int i = 0;
3143
3144                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3145                           "Inspecting %s for group membership",
3146                           grp->gr_name);
3147
3148                 for (i=0; grp->gr_mem && grp->gr_mem[i] != NULL; i++) {
3149                         if (group != grp->gr_gid &&
3150                             (strcmp(user, grp->gr_mem[i]) == 0)) {
3151                                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3152                                           "%s is member of %s",
3153                                           user,
3154                                           grp->gr_name);
3155
3156                                 groups = (gid_t *)realloc(groups,
3157                                                           (size + 1) * sizeof(gid_t));
3158                                 if (groups == NULL) {
3159                                         NWRAP_LOG(NWRAP_LOG_ERROR,
3160                                                   "Out of memory");
3161                                         errno = ENOMEM;
3162                                         return -1;
3163                                 }
3164
3165                                 groups[size] = grp->gr_gid;
3166                                 size++;
3167                         }
3168                 }
3169         }
3170
3171         nwrap_files_endgrent(b);
3172
3173         NWRAP_LOG(NWRAP_LOG_DEBUG,
3174                   "%s is member of %d groups",
3175                   user, size);
3176
3177         /* This really only works if uid_wrapper is loaded */
3178         rc = setgroups(size, groups);
3179
3180         free(groups);
3181
3182         return rc;
3183 }
3184
3185 /* group functions */
3186 static struct group *nwrap_files_getgrnam(struct nwrap_backend *b,
3187                                           const char *name)
3188 {
3189         int i;
3190         bool ok;
3191
3192         (void) b; /* unused */
3193
3194         ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3195         if (!ok) {
3196                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3197                 return NULL;
3198         }
3199
3200         for (i=0; i<nwrap_gr_global.num; i++) {
3201                 if (strcmp(nwrap_gr_global.list[i].gr_name, name) == 0) {
3202                         NWRAP_LOG(NWRAP_LOG_DEBUG, "group[%s] found", name);
3203                         return &nwrap_gr_global.list[i];
3204                 }
3205                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3206                           "group[%s] does not match [%s]",
3207                           name,
3208                           nwrap_gr_global.list[i].gr_name);
3209         }
3210
3211         NWRAP_LOG(NWRAP_LOG_DEBUG, "group[%s] not found", name);
3212
3213         errno = ENOENT;
3214         return NULL;
3215 }
3216
3217 static int nwrap_files_getgrnam_r(struct nwrap_backend *b,
3218                                   const char *name, struct group *grdst,
3219                                   char *buf, size_t buflen, struct group **grdstp)
3220 {
3221         struct group *gr;
3222
3223         gr = nwrap_files_getgrnam(b, name);
3224         if (!gr) {
3225                 if (errno == 0) {
3226                         return ENOENT;
3227                 }
3228                 return errno;
3229         }
3230
3231         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3232 }
3233
3234 static struct group *nwrap_files_getgrgid(struct nwrap_backend *b,
3235                                           gid_t gid)
3236 {
3237         int i;
3238         bool ok;
3239
3240         (void) b; /* unused */
3241
3242         ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3243         if (!ok) {
3244                 NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3245                 return NULL;
3246         }
3247
3248         for (i=0; i<nwrap_gr_global.num; i++) {
3249                 if (nwrap_gr_global.list[i].gr_gid == gid) {
3250                         NWRAP_LOG(NWRAP_LOG_DEBUG, "gid[%u] found", gid);
3251                         return &nwrap_gr_global.list[i];
3252                 }
3253                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3254                           "gid[%u] does not match [%u]",
3255                           gid,
3256                           nwrap_gr_global.list[i].gr_gid);
3257         }
3258
3259         NWRAP_LOG(NWRAP_LOG_DEBUG, "gid[%u] not found", gid);
3260
3261         errno = ENOENT;
3262         return NULL;
3263 }
3264
3265 static int nwrap_files_getgrgid_r(struct nwrap_backend *b,
3266                                   gid_t gid, struct group *grdst,
3267                                   char *buf, size_t buflen, struct group **grdstp)
3268 {
3269         struct group *gr;
3270
3271         gr = nwrap_files_getgrgid(b, gid);
3272         if (!gr) {
3273                 if (errno == 0) {
3274                         return ENOENT;
3275                 }
3276                 return errno;
3277         }
3278
3279         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3280 }
3281
3282 /* group enum functions */
3283 static void nwrap_files_setgrent(struct nwrap_backend *b)
3284 {
3285         (void) b; /* unused */
3286
3287         nwrap_gr_global.idx = 0;
3288 }
3289
3290 static struct group *nwrap_files_getgrent(struct nwrap_backend *b)
3291 {
3292         struct group *gr;
3293
3294         (void) b; /* unused */
3295
3296         if (nwrap_gr_global.idx == 0) {
3297                 bool ok;
3298
3299                 ok = nwrap_files_cache_reload(nwrap_gr_global.cache);
3300                 if (!ok) {
3301                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading group file");
3302                         return NULL;
3303                 }
3304         }
3305
3306         if (nwrap_gr_global.idx >= nwrap_gr_global.num) {
3307                 errno = ENOENT;
3308                 return NULL;
3309         }
3310
3311         gr = &nwrap_gr_global.list[nwrap_gr_global.idx++];
3312
3313         NWRAP_LOG(NWRAP_LOG_DEBUG,
3314                   "return group[%s] gid[%u]",
3315                   gr->gr_name, gr->gr_gid);
3316
3317         return gr;
3318 }
3319
3320 static int nwrap_files_getgrent_r(struct nwrap_backend *b,
3321                                   struct group *grdst, char *buf,
3322                                   size_t buflen, struct group **grdstp)
3323 {
3324         struct group *gr;
3325
3326         gr = nwrap_files_getgrent(b);
3327         if (!gr) {
3328                 if (errno == 0) {
3329                         return ENOENT;
3330                 }
3331                 return errno;
3332         }
3333
3334         return nwrap_gr_copy_r(gr, grdst, buf, buflen, grdstp);
3335 }
3336
3337 static void nwrap_files_endgrent(struct nwrap_backend *b)
3338 {
3339         (void) b; /* unused */
3340
3341         nwrap_gr_global.idx = 0;
3342 }
3343
3344 /* hosts functions */
3345 static int nwrap_files_gethostbyname(const char *name, int af,
3346                                      struct hostent *result,
3347                                      struct nwrap_vector *addr_list)
3348 {
3349         struct nwrap_entlist *el;
3350         struct hostent *he;
3351         char *h_name_lower;
3352         ENTRY e;
3353         ENTRY *e_p;
3354         char canon_name[DNS_NAME_MAX] = { 0 };
3355         size_t name_len;
3356         bool he_found = false;
3357         bool ok;
3358
3359         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3360         if (!ok) {
3361                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3362                 goto no_ent;
3363         }
3364
3365         name_len = strlen(name);
3366         if (name_len < sizeof(canon_name) && name[name_len - 1] == '.') {
3367                 strncpy(canon_name, name, name_len - 1);
3368                 name = canon_name;
3369         }
3370
3371         if (!str_tolower_copy(&h_name_lower, name)) {
3372                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3373                           "Out of memory while converting to lower case");
3374                 goto no_ent;
3375         }
3376
3377         /* Look at hash table for element */
3378         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching for name: %s", h_name_lower);
3379         e.key = h_name_lower;
3380         e.data = NULL;
3381         e_p = hsearch(e, FIND);
3382         if (e_p == NULL) {
3383                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found.", h_name_lower);
3384                 SAFE_FREE(h_name_lower);
3385                 goto no_ent;
3386         }
3387         SAFE_FREE(h_name_lower);
3388
3389         /* Always cleanup vector and results */
3390         if (!nwrap_vector_is_initialized(addr_list)) {
3391                 if (!nwrap_vector_init(addr_list)) {
3392                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3393                                   "Unable to initialize memory for addr_list vector");
3394                         goto no_ent;
3395                 }
3396         } else {
3397                 /* When vector is initialized data are valid no more.
3398                  * Quick way how to free vector is: */
3399                 addr_list->count = 0;
3400         }
3401
3402         /* Iterate through results */
3403         for (el = (struct nwrap_entlist *)e_p->data; el != NULL; el = el->next)
3404         {
3405                 he = &(el->ed->ht);
3406
3407                 /* Filter by address familiy if provided */
3408                 if (af != AF_UNSPEC && he->h_addrtype != af) {
3409                         continue;
3410                 }
3411
3412                 /*
3413                  * GLIBC HACK?
3414                  * glibc doesn't return ipv6 addresses when AF_UNSPEC is used
3415                  */
3416                 if (af == AF_UNSPEC && he->h_addrtype != AF_INET) {
3417                         continue;
3418                 }
3419
3420                 if (!he_found) {
3421                         memcpy(result, he, sizeof(struct hostent));
3422                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3423                                   "Name found. Returning record for %s",
3424                                   he->h_name);
3425                         he_found = true;
3426                 }
3427                 nwrap_vector_merge(addr_list, &el->ed->nwrap_addrdata);
3428                 result->h_addr_list = nwrap_vector_head(addr_list);
3429         }
3430
3431         if (he_found) {
3432                 return 0;
3433         }
3434         NWRAP_LOG(NWRAP_LOG_DEBUG,
3435                   "Name found in database. No records matches type.");
3436
3437 no_ent:
3438         errno = ENOENT;
3439         return -1;
3440 }
3441
3442 #ifdef HAVE_GETHOSTBYNAME_R
3443 static int nwrap_gethostbyname_r(const char *name,
3444                                  struct hostent *ret,
3445                                  char *buf, size_t buflen,
3446                                  struct hostent **result, int *h_errnop)
3447 {
3448         struct nwrap_vector *addr_list = malloc(sizeof(struct nwrap_vector));
3449         int rc;
3450
3451         if (addr_list == NULL) {
3452                 NWRAP_LOG(NWRAP_LOG_ERROR,
3453                           "Unable to allocate memory for address list");
3454                 errno = ENOENT;
3455                 return -1;
3456         }
3457
3458         ZERO_STRUCTP(addr_list);
3459
3460         rc = nwrap_files_gethostbyname(name, AF_UNSPEC, ret, addr_list);
3461         if (rc == -1) {
3462                 *h_errnop = h_errno;
3463                 if (addr_list->items != NULL) {
3464                         free(addr_list->items);
3465                 }
3466                 SAFE_FREE(addr_list);
3467                 errno = ENOENT;
3468                 return -1;
3469         }
3470
3471         if (buflen < (addr_list->count * sizeof(void *))) {
3472                 SAFE_FREE(addr_list->items);
3473                 SAFE_FREE(addr_list);
3474                 return ERANGE;
3475         }
3476
3477         /* Copy all to user provided buffer and change
3478          * pointers in returned structure.
3479          * +1 is for ending NULL pointer. */
3480         memcpy(buf, addr_list->items, (addr_list->count + 1) * sizeof(void *));
3481
3482         free(addr_list->items);
3483         free(addr_list);
3484
3485         ret->h_addr_list = (char **)buf;
3486         *result = ret;
3487         return 0;
3488 }
3489
3490 int gethostbyname_r(const char *name,
3491                     struct hostent *ret,
3492                     char *buf, size_t buflen,
3493                     struct hostent **result, int *h_errnop)
3494 {
3495         if (!nss_wrapper_hosts_enabled()) {
3496                 return libc_gethostbyname_r(name,
3497                                             ret,
3498                                             buf,
3499                                             buflen,
3500                                             result,
3501                                             h_errnop);
3502         }
3503
3504         return nwrap_gethostbyname_r(name, ret, buf, buflen, result, h_errnop);
3505 }
3506 #endif
3507
3508 static int nwrap_files_getaddrinfo(const char *name,
3509                                    unsigned short port,
3510                                    const struct addrinfo *hints,
3511                                    struct addrinfo **ai)
3512 {
3513         struct nwrap_entlist *el;
3514         struct hostent *he;
3515         struct addrinfo *ai_head = NULL;
3516         struct addrinfo *ai_cur = NULL;
3517         char *h_name_lower;
3518         size_t name_len;
3519         char canon_name[DNS_NAME_MAX] = { 0 };
3520         bool skip_canonname = false;
3521         ENTRY e = { 0 };
3522         ENTRY *e_p = NULL;
3523         int rc;
3524         bool ok;
3525
3526         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3527         if (!ok) {
3528                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3529                 return EAI_SYSTEM;
3530         }
3531
3532         name_len = strlen(name);
3533         if (name_len < DNS_NAME_MAX && name[name_len - 1] == '.') {
3534                 strncpy(canon_name, name, name_len - 1);
3535                 name = canon_name;
3536         }
3537
3538         if (!str_tolower_copy(&h_name_lower, name)) {
3539                 NWRAP_LOG(NWRAP_LOG_DEBUG,
3540                           "Out of memory while converting to lower case");
3541                 return EAI_MEMORY;
3542         }
3543
3544         NWRAP_LOG(NWRAP_LOG_DEBUG, "Searching for name: %s", h_name_lower);
3545         e.key = h_name_lower;
3546         e.data = NULL;
3547         e_p = hsearch(e, FIND);
3548         if (e_p == NULL) {
3549                 NWRAP_LOG(NWRAP_LOG_DEBUG, "Name %s not found.", h_name_lower);
3550                 SAFE_FREE(h_name_lower);
3551                 errno = ENOENT;
3552                 return EAI_NONAME;
3553         }
3554         NWRAP_LOG(NWRAP_LOG_DEBUG, "Name: %s found.", h_name_lower);
3555         SAFE_FREE(h_name_lower);
3556
3557         rc = EAI_NONAME;
3558         for (el = (struct nwrap_entlist *)e_p->data; el != NULL; el = el->next)
3559         {
3560                 int rc2;
3561                 struct addrinfo *ai_new = NULL;
3562
3563                 he = &(el->ed->ht);
3564
3565                 if (hints->ai_family != AF_UNSPEC &&
3566                     he->h_addrtype != hints->ai_family)
3567                 {
3568                         NWRAP_LOG(NWRAP_LOG_DEBUG,
3569                                   "Entry found but with wrong AF - "
3570                                   "remembering EAI_ADDRINFO.");
3571                         rc = EAI_ADDRFAMILY;
3572                         continue;
3573                 }
3574
3575                 /* Function allocates memory and returns it in ai. */
3576                 rc2 = nwrap_convert_he_ai(he,
3577                                          port,
3578                                          hints,
3579                                          &ai_new,
3580                                          skip_canonname);
3581                 if (rc2 != 0) {
3582                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error converting he to ai");
3583                         if (ai_head != NULL) {
3584                                 freeaddrinfo(ai_head);
3585                         }
3586                         return rc2;
3587                 }
3588                 skip_canonname = true;
3589
3590                 if (ai_head == NULL) {
3591                         ai_head = ai_new;
3592                 }
3593                 if (ai_cur != NULL) {
3594                         ai_cur->ai_next = ai_new;
3595                 }
3596                 ai_cur = ai_new;
3597         }
3598
3599         if (ai_head != NULL) {
3600                 rc = 0;
3601         }
3602
3603         *ai = ai_head;
3604
3605         return rc;
3606 }
3607
3608 static struct hostent *nwrap_files_gethostbyaddr(const void *addr,
3609                                                  socklen_t len, int type)
3610 {
3611         struct hostent *he;
3612         char ip[NWRAP_INET_ADDRSTRLEN] = {0};
3613         struct nwrap_entdata *ed;
3614         const char *a;
3615         size_t i;
3616         bool ok;
3617
3618         (void) len; /* unused */
3619
3620         ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3621         if (!ok) {
3622                 NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file");
3623                 return NULL;
3624         }
3625
3626         a = inet_ntop(type, addr, ip, sizeof(ip));
3627         if (a == NULL) {
3628                 errno = EINVAL;
3629                 return NULL;
3630         }
3631
3632         nwrap_vector_foreach(ed, nwrap_he_global.entdata, i)
3633         {
3634                 he = &(ed->ht);
3635                 if (he->h_addrtype != type) {
3636                         continue;
3637                 }
3638
3639                 if (memcmp(addr, he->h_addr_list[0], he->h_length) == 0) {
3640                         return he;
3641                 }
3642         }
3643
3644         errno = ENOENT;
3645         return NULL;
3646 }
3647
3648 #ifdef HAVE_GETHOSTBYADDR_R
3649 static int nwrap_gethostbyaddr_r(const void *addr, socklen_t len, int type,
3650                                  struct hostent *ret,
3651                                  char *buf, size_t buflen,
3652                                  struct hostent **result, int *h_errnop)
3653 {
3654         *result = nwrap_files_gethostbyaddr(addr, len, type);
3655         if (*result != NULL) {
3656                 memset(buf, '\0', buflen);
3657                 *ret = **result;
3658                 return 0;
3659         } else {
3660                 *h_errnop = h_errno;
3661                 return -1;
3662         }
3663 }
3664
3665 int gethostbyaddr_r(const void *addr, socklen_t len, int type,
3666                     struct hostent *ret,
3667                     char *buf, size_t buflen,
3668                     struct hostent **result, int *h_errnop)
3669 {
3670         if (!nss_wrapper_hosts_enabled()) {
3671                 return libc_gethostbyaddr_r(addr,
3672                                             len,
3673                                             type,
3674                                             ret,
3675                                             buf,
3676                                             buflen,
3677                                             result,
3678                                             h_errnop);
3679         }
3680
3681         return nwrap_gethostbyaddr_r(addr, len, type, ret, buf, buflen, result, h_errnop);
3682 }
3683 #endif
3684
3685 /* hosts enum functions */
3686 static void nwrap_files_sethostent(void)
3687 {
3688         nwrap_he_global.idx = 0;
3689 }
3690
3691 static struct hostent *nwrap_files_gethostent(void)
3692 {
3693         struct hostent *he;
3694
3695         if (nwrap_he_global.idx == 0) {
3696                 bool ok;
3697
3698                 ok = nwrap_files_cache_reload(nwrap_he_global.cache);
3699                 if (!ok) {
3700                         NWRAP_LOG(NWRAP_LOG_ERROR, "Error loading hosts file");
3701                         return NULL;
3702                 }
3703         }
3704
3705         if (nwrap_he_global.idx >= nwrap_he_global.num) {
3706                 errno = ENOENT;
3707                 return NULL;
3708         }
3709
3710         he = &((struct nwrap_entdata *)nwrap_he_global.entdata.items[nwrap_he_global.idx++])->ht;
3711
3712         NWRAP_LOG(NWRAP_LOG_DEBUG, "return hosts[%s]", he->h_name);
3713
3714         return he;
3715 }
3716
3717 static void nwrap_files_endhostent(void)
3718 {
3719         nwrap_he_global.idx = 0;
3720 }
3721
3722 /*
3723  * module backend
3724  */
3725
3726
3727 static struct passwd *nwrap_module_getpwnam(struct nwrap_backend *b,
3728                                             const char *name)
3729 {
3730         static struct passwd pwd;
3731         static char buf[1000];
3732         NSS_STATUS status;
3733
3734         if (!b->fns->_nss_getpwnam_r) {
3735                 return NULL;
3736         }
3737
3738         status = b->fns->_nss_getpwnam_r(name, &pwd, buf, sizeof(buf), &errno);
3739         if (status == NSS_STATUS_NOTFOUND) {
3740                 return NULL;
3741         }
3742         if (status != NSS_STATUS_SUCCESS) {
3743                 return NULL;
3744         }
3745
3746         return &pwd;
3747 }
3748
3749 static int nwrap_module_getpwnam_r(struct nwrap_backend *b,
3750                                    const char *name, struct passwd *pwdst,
3751                                    char *buf, size_t buflen, struct passwd **pwdstp)
3752 {
3753         int ret;
3754
3755         (void) b; /* unused */
3756         (void) pwdst; /* unused */
3757         (void) pwdstp; /* unused */
3758
3759         if (!b->fns->_nss_getpwnam_r) {
3760                 return NSS_STATUS_NOTFOUND;
3761         }
3762
3763         ret = b->fns->_nss_getpwnam_r(name, pwdst, buf, buflen, &errno);
3764         switch (ret) {
3765         case NSS_STATUS_SUCCESS:
3766                 return 0;
3767         case NSS_STATUS_NOTFOUND:
3768                 if (errno != 0) {
3769                         return errno;
3770                 }
3771                 return ENOENT;
3772         case NSS_STATUS_TRYAGAIN:
3773                 if (errno != 0) {
3774                         return errno;
3775                 }
3776                 return ERANGE;
3777         default:
3778                 if (errno != 0) {
3779                         return errno;
3780                 }
3781                 return ret;
3782         }
3783 }
3784
3785 static struct passwd *nwrap_module_getpwuid(struct nwrap_backend *b,
3786                                             uid_t uid)
3787 {
3788         static struct passwd pwd;
3789         static char buf[1000];
3790         NSS_STATUS status;
3791
3792         if (!b->fns->_nss_getpwuid_r) {
3793                 return NULL;
3794         }
3795
3796         status = b->fns->_nss_getpwuid_r(uid, &pwd, buf, sizeof(buf), &errno);
3797         if (status == NSS_STATUS_NOTFOUND) {
3798                 return NULL;
3799         }
3800         if (status != NSS_STATUS_SUCCESS) {
3801                 return NULL;
3802         }
3803         return &pwd;
3804 }
3805
3806 static int nwrap_module_getpwuid_r(struct nwrap_backend *b,
3807                                    uid_t uid, struct passwd *pwdst,
3808                                    char *buf, size_t buflen, struct passwd **pwdstp)
3809 {
3810         int ret;
3811
3812         (void) pwdstp; /* unused */
3813
3814         if (!b->fns->_nss_getpwuid_r) {
3815                 return ENOENT;
3816         }
3817
3818         ret = b->fns->_nss_getpwuid_r(uid, pwdst, buf, buflen, &errno);
3819         switch (ret) {
3820         case NSS_STATUS_SUCCESS:
3821                 return 0;
3822         case NSS_STATUS_NOTFOUND:
3823                 if (errno != 0) {
3824                         return errno;
3825                 }
3826                 return ENOENT;
3827         case NSS_STATUS_TRYAGAIN:
3828                 if (errno != 0) {
3829                         return errno;
3830                 }
3831                 return ERANGE;
3832         default:
3833                 if (errno != 0) {
3834                         return errno;
3835                 }
3836                 return ret;
3837         }
3838 }
3839
3840 static void nwrap_module_setpwent(struct nwrap_backend *b)
3841 {
3842         if (!b->fns->_nss_setpwent) {
3843                 return;
3844         }
3845
3846         b->fns->_nss_setpwent();
3847 }
3848
3849 static struct passwd *nwrap_module_getpwent(struct nwrap_backend *b)
3850 {
3851         static struct passwd pwd;
3852         static char buf[1000];
3853         NSS_STATUS status;
3854
3855         if (!b->fns->_nss_getpwent_r) {
3856                 return NULL;
3857         }
3858
3859         status = b->fns->_nss_getpwent_r(&pwd, buf, sizeof(buf), &errno);
3860         if (status == NSS_STATUS_NOTFOUND) {
3861                 return NULL;
3862         }
3863         if (status != NSS_STATUS_SUCCESS) {
3864                 return NULL;
3865         }
3866         return &pwd;
3867 }
3868
3869 static int nwrap_module_getpwent_r(struct nwrap_backend *b,
3870                                    struct passwd *pwdst, char *buf,
3871                                    size_t buflen, struct passwd **pwdstp)
3872 {
3873         int ret;
3874
3875         (void) pwdstp; /* unused */
3876
3877         if (!b->fns->_nss_getpwent_r) {
3878                 return ENOENT;
3879         }
3880
3881         ret = b->fns->_nss_getpwent_r(pwdst, buf, buflen, &errno);
3882         switch (ret) {
3883         case NSS_STATUS_SUCCESS:
3884                 return 0;
3885         case NSS_STATUS_NOTFOUND:
3886                 if (errno != 0) {
3887                         return errno;
3888                 }
3889                 return ENOENT;
3890         case NSS_STATUS_TRYAGAIN:
3891                 if (errno != 0) {
3892                         return errno;
3893                 }
3894                 return ERANGE;
3895         default:
3896                 if (errno != 0) {
3897                         return errno;
3898                 }
3899                 return ret;
3900         }
3901 }
3902
3903 static void nwrap_module_endpwent(struct nwrap_backend *b)
3904 {
3905         if (!b->fns->_nss_endpwent) {
3906                 return;
3907         }
3908
3909         b->fns->_nss_endpwent();
3910 }
3911
3912 static int nwrap_module_initgroups(struct nwrap_backend *b,
3913                                    const char *user, gid_t group)
3914 {
3915         gid_t *groups;
3916         long int start;
3917         long int size;
3918
3919         if (!b->fns->_nss_initgroups) {
3920                 return NSS_STATUS_UNAVAIL;
3921         }
3922
3923         return b->fns->_nss_initgroups(user, group, &start, &size, &groups, 0, &errno);
3924 }
3925
3926 static struct group *nwrap_module_getgrnam(struct nwrap_backend *b,
3927                                            const char *name)
3928 {
3929         static struct group grp;
3930         static char *buf;
3931         static int buflen = 1000;
3932         NSS_STATUS status;
3933
3934         if (!b->fns->_nss_getgrnam_r) {
3935                 return NULL;
3936         }
3937
3938         if (!buf) {
3939                 buf = (char *)malloc(buflen);
3940         }
3941 again:
3942         status = b->fns->_nss_getgrnam_r(name, &grp, buf, buflen, &errno);
3943         if (status == NSS_STATUS_TRYAGAIN) {
3944                 buflen *= 2;
3945                 buf = (char *)realloc(buf, buflen);
3946                 if (!buf) {
3947                         return NULL;
3948                 }
3949                 goto again;
3950         }
3951         if (status == NSS_STATUS_NOTFOUND) {
3952                 SAFE_FREE(buf);
3953                 return NULL;
3954         }
3955         if (status != NSS_STATUS_SUCCESS) {
3956                 SAFE_FREE(buf);
3957                 return NULL;
3958         }
3959         return &grp;
3960 }
3961
3962 static int nwrap_module_getgrnam_r(struct nwrap_backend *b,
3963                                    const char *name, struct group *grdst,
3964                                    char *buf, size_t buflen, struct group **grdstp)
3965 {
3966         int ret;
3967
3968         (void) grdstp; /* unused */
3969
3970         if (!b->fns->_nss_getgrnam_r) {
3971                 return ENOENT;
3972         }
3973
3974         ret = b->fns->_nss_getgrnam_r(name, grdst, buf, buflen, &errno);
3975         switch (ret) {
3976         case NSS_STATUS_SUCCESS:
3977                 return 0;
3978         case NSS_STATUS_NOTFOUND:
3979                 if (errno != 0) {
3980                         return errno;
3981                 }
3982                 return ENOENT;
3983         case NSS_STATUS_TRYAGAIN:
3984                 if (errno != 0) {
3985                         return errno;
3986                 }
3987                 return ERANGE;
3988         default:
3989                 if (errno != 0) {
3990                         return errno;
3991                 }
3992                 return ret;
3993         }
3994 }
3995
3996 static struct group *nwrap_module_getgrgid(struct nwrap_backend *b,
3997                                            gid_t gid)
3998 {
3999         static struct group grp;
4000         static char *buf;
4001         static int buflen = 1000;
4002         NSS_STATUS status;
4003
4004         if (!b->fns->_nss_getgrgid_r) {
4005                 return NULL;
4006         }
4007
4008         if (!buf) {
4009                 buf = (char *)malloc(buflen);
4010         }
4011
4012 again:
4013         status = b->fns->_nss_getgrgid_r(gid, &grp, buf, buflen, &errno);
4014         if (status == NSS_STATUS_TRYAGAIN) {
4015                 buflen *= 2;
4016                 buf = (char *)realloc(buf, buflen);
4017                 if (!buf) {
4018                         return NULL;
4019                 }
4020                 goto again;
4021         }
4022         if (status == NSS_STATUS_NOTFOUND) {
4023                 SAFE_FREE(buf);
4024                 return NULL;
4025         }
4026         if (status != NSS_STATUS_SUCCESS) {
4027                 SAFE_FREE(buf);
4028                 return NULL;
4029         }
4030         return &grp;
4031 }
4032
4033 static int nwrap_module_getgrgid_r(struct nwrap_backend *b,
4034                                    gid_t gid, struct group *grdst,
4035                                    char *buf, size_t buflen, struct group **grdstp)
4036 {
4037         int ret;
4038
4039         (void) grdstp; /* unused */
4040
4041         if (!b->fns->_nss_getgrgid_r) {
4042                 return ENOENT;
4043         }
4044
4045         ret = b->fns->_nss_getgrgid_r(gid, grdst, buf, buflen, &errno);
4046         switch (ret) {
4047         case NSS_STATUS_SUCCESS:
4048                 return 0;
4049         case NSS_STATUS_NOTFOUND:
4050                 if (errno != 0) {
4051                         return errno;
4052                 }
4053                 return ENOENT;
4054         case NSS_STATUS_TRYAGAIN:
4055                 if (errno != 0) {
4056                         return errno;
4057                 }
4058                 return ERANGE;
4059         default:
4060                 if (errno != 0) {
4061                         return errno;
4062                 }
4063                 return ret;
4064         }
4065 }
4066
4067 static void nwrap_module_setgrent(struct nwrap_backend *b)
4068 {
4069         if (!b->fns->_nss_setgrent) {
4070                 return;
4071         }
4072
4073         b->fns->_nss_setgrent();
4074 }
4075
4076 static struct group *nwrap_module_getgrent(struct nwrap_backend *b)
4077 {
4078         static struct group grp;
4079         static char *buf;
4080         static int buflen = 1024;
4081         NSS_STATUS status;
4082
4083         if (!b->fns->_nss_getgrent_r) {
4084                 return NULL;
4085         }
4086
4087         if (!buf) {
4088                 buf = (char *)malloc(buflen);
4089         }
4090
4091 again:
4092         status = b->fns->_nss_getgrent_r(&grp, buf, buflen, &errno);
4093         if (status == NSS_STATUS_TRYAGAIN) {
4094                 buflen *= 2;
4095                 buf = (char *)realloc(buf, buflen);
4096                 if (!buf) {
4097                         return NULL;
4098                 }
4099                 goto again;
4100         }
4101         if (status == NSS_STATUS_NOTFOUND) {
4102                 SAFE_FREE(buf);
4103                 return NULL;
4104         }
4105         if (status != NSS_STATUS_SUCCESS) {
4106                 SAFE_FREE(buf);
4107                 return NULL;
4108         }
4109         return &grp;
4110 }
4111
4112 static int nwrap_module_getgrent_r(struct nwrap_backend *b,
4113                                    struct group *grdst, char *buf,
4114                                    size_t buflen, struct group **grdstp)
4115 {
4116         int ret;
4117
4118         (void) grdstp; /* unused */
4119
4120         if (!b->fns->_nss_getgrent_r) {
4121                 return ENOENT;
4122         }
4123
4124         ret = b->fns->_nss_getgrent_r(grdst, buf, buflen, &errno);
4125         switch (ret) {
4126         case NSS_STATUS_SUCCESS:
4127                 return 0;
4128         case NSS_STATUS_NOTFOUND:
4129                 if (errno != 0) {
4130                         return errno;
4131                 }
4132                 return ENOENT;
4133         case NSS_STATUS_TRYAGAIN:
4134                 if (errno != 0) {
4135                         return errno;
4136                 }
4137                 return ERANGE;
4138         default:
4139                 if (errno != 0) {
4140                         return errno;
4141                 }
4142                 return ret;
4143         }
4144 }
4145
4146 static void nwrap_module_endgrent(struct nwrap_backend *b)
4147 {
4148         if (!b->fns->_nss_endgrent) {
4149                 return;
4150         }
4151
4152         b->fns->_nss_endgrent();
4153 }
4154
4155 /****************************************************************************
4156  *   GETPWNAM
4157  ***************************************************************************/
4158
4159 static struct passwd *nwrap_getpwnam(const char *name)
4160 {
4161         int i;
4162         struct passwd *pwd;
4163
4164         for (i=0; i < nwrap_main_global->num_backends; i++) {
4165                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4166                 pwd = b->ops->nw_getpwnam(b, name);
4167                 if (pwd) {
4168                         return pwd;
4169                 }
4170         }
4171
4172         return NULL;
4173 }
4174
4175 struct passwd *getpwnam(const char *name)
4176 {
4177         if (!nss_wrapper_enabled()) {
4178                 return libc_getpwnam(name);
4179         }
4180
4181         return nwrap_getpwnam(name);
4182 }
4183
4184 /****************************************************************************
4185  *   GETPWNAM_R
4186  ***************************************************************************/
4187
4188 static int nwrap_getpwnam_r(const char *name, struct passwd *pwdst,
4189                             char *buf, size_t buflen, struct passwd **pwdstp)
4190 {
4191         int i,ret;
4192
4193         for (i=0; i < nwrap_main_global->num_backends; i++) {
4194                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4195                 ret = b->ops->nw_getpwnam_r(b, name, pwdst, buf, buflen, pwdstp);
4196                 if (ret == ENOENT) {
4197                         continue;
4198                 }
4199                 return ret;
4200         }
4201
4202         return ENOENT;
4203 }
4204
4205 #ifdef HAVE_GETPWNAM_R
4206 # ifdef HAVE_SOLARIS_GETPWNAM_R
4207 int getpwnam_r(const char *name, struct passwd *pwdst,
4208                char *buf, int buflen, struct passwd **pwdstp)
4209 # else /* HAVE_SOLARIS_GETPWNAM_R */
4210 int getpwnam_r(const char *name, struct passwd *pwdst,
4211                char *buf, size_t buflen, struct passwd **pwdstp)
4212 # endif /* HAVE_SOLARIS_GETPWNAM_R */
4213 {
4214         if (!nss_wrapper_enabled()) {
4215                 return libc_getpwnam_r(name, pwdst, buf, buflen, pwdstp);
4216         }
4217
4218         return nwrap_getpwnam_r(name, pwdst, buf, buflen, pwdstp);
4219 }
4220 #endif
4221
4222 /****************************************************************************
4223  *   GETPWUID
4224  ***************************************************************************/
4225
4226 static struct passwd *nwrap_getpwuid(uid_t uid)
4227 {
4228         int i;
4229         struct passwd *pwd;
4230
4231         for (i=0; i < nwrap_main_global->num_backends; i++) {
4232                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4233                 pwd = b->ops->nw_getpwuid(b, uid);
4234                 if (pwd) {
4235                         return pwd;
4236                 }
4237         }
4238
4239         return NULL;
4240 }
4241
4242 struct passwd *getpwuid(uid_t uid)
4243 {
4244         if (!nss_wrapper_enabled()) {
4245                 return libc_getpwuid(uid);
4246         }
4247
4248         return nwrap_getpwuid(uid);
4249 }
4250
4251 /****************************************************************************
4252  *   GETPWUID_R
4253  ***************************************************************************/
4254
4255 static int nwrap_getpwuid_r(uid_t uid, struct passwd *pwdst,
4256                             char *buf, size_t buflen, struct passwd **pwdstp)
4257 {
4258         int i,ret;
4259
4260         for (i=0; i < nwrap_main_global->num_backends; i++) {
4261                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4262                 ret = b->ops->nw_getpwuid_r(b, uid, pwdst, buf, buflen, pwdstp);
4263                 if (ret == ENOENT) {
4264                         continue;
4265                 }
4266                 return ret;
4267         }
4268
4269         return ENOENT;
4270 }
4271
4272 #ifdef HAVE_SOLARIS_GETPWUID_R
4273 int getpwuid_r(uid_t uid, struct passwd *pwdst,
4274                char *buf, int buflen, struct passwd **pwdstp)
4275 #else
4276 int getpwuid_r(uid_t uid, struct passwd *pwdst,
4277                char *buf, size_t buflen, struct passwd **pwdstp)
4278 #endif
4279 {
4280         if (!nss_wrapper_enabled()) {
4281                 return libc_getpwuid_r(uid, pwdst, buf, buflen, pwdstp);
4282         }
4283
4284         return nwrap_getpwuid_r(uid, pwdst, buf, buflen, pwdstp);
4285 }
4286
4287 /****************************************************************************
4288  *   SETPWENT
4289  ***************************************************************************/
4290
4291 static void nwrap_setpwent(void)
4292 {
4293         int i;
4294
4295         for (i=0; i < nwrap_main_global->num_backends; i++) {
4296                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4297                 b->ops->nw_setpwent(b);
4298         }
4299 }
4300
4301 void setpwent(void)
4302 {
4303         if (!nss_wrapper_enabled()) {
4304                 libc_setpwent();
4305                 return;
4306         }
4307
4308         nwrap_setpwent();
4309 }
4310
4311 /****************************************************************************
4312  *   GETPWENT
4313  ***************************************************************************/
4314
4315 static struct passwd *nwrap_getpwent(void)
4316 {
4317         int i;
4318         struct passwd *pwd;
4319
4320         for (i=0; i < nwrap_main_global->num_backends; i++) {
4321                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4322                 pwd = b->ops->nw_getpwent(b);
4323                 if (pwd) {
4324                         return pwd;
4325                 }
4326         }
4327
4328         return NULL;
4329 }
4330
4331 struct passwd *getpwent(void)
4332 {
4333         if (!nss_wrapper_enabled()) {
4334                 return libc_getpwent();
4335         }
4336
4337         return nwrap_getpwent();
4338 }
4339
4340 /****************************************************************************
4341  *   GETPWENT_R
4342  ***************************************************************************/
4343
4344 static int nwrap_getpwent_r(struct passwd *pwdst, char *buf,
4345                             size_t buflen, struct passwd **pwdstp)
4346 {
4347         int i,ret;
4348
4349         for (i=0; i < nwrap_main_global->num_backends; i++) {
4350                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4351                 ret = b->ops->nw_getpwent_r(b, pwdst, buf, buflen, pwdstp);
4352                 if (ret == ENOENT) {
4353                         continue;
4354                 }
4355                 return ret;
4356         }
4357
4358         return ENOENT;
4359 }
4360
4361 #ifdef HAVE_SOLARIS_GETPWENT_R
4362 struct passwd *getpwent_r(struct passwd *pwdst, char *buf, int buflen)
4363 {
4364         struct passwd *pwdstp = NULL;
4365         int rc;
4366
4367         if (!nss_wrapper_enabled()) {
4368                 return libc_getpwent_r(pwdst, buf, buflen);
4369         }
4370         rc = nwrap_getpwent_r(pwdst, buf, buflen, &pwdstp);
4371         if (rc < 0) {
4372                 return NULL;
4373         }
4374
4375         return pwdstp;
4376 }
4377 #else /* HAVE_SOLARIS_GETPWENT_R */
4378 int getpwent_r(struct passwd *pwdst, char *buf,
4379                size_t buflen, struct passwd **pwdstp)
4380 {
4381         if (!nss_wrapper_enabled()) {
4382                 return libc_getpwent_r(pwdst, buf, buflen, pwdstp);
4383         }
4384
4385         return nwrap_getpwent_r(pwdst, buf, buflen, pwdstp);
4386 }
4387 #endif /* HAVE_SOLARIS_GETPWENT_R */
4388
4389 /****************************************************************************
4390  *   ENDPWENT
4391  ***************************************************************************/
4392
4393 static void nwrap_endpwent(void)
4394 {
4395         int i;
4396
4397         for (i=0; i < nwrap_main_global->num_backends; i++) {
4398                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4399                 b->ops->nw_endpwent(b);
4400         }
4401 }
4402
4403 void endpwent(void)
4404 {
4405         if (!nss_wrapper_enabled()) {
4406                 libc_endpwent();
4407                 return;
4408         }
4409
4410         nwrap_endpwent();
4411 }
4412
4413 /****************************************************************************
4414  *   INITGROUPS
4415  ***************************************************************************/
4416
4417 static int nwrap_initgroups(const char *user, gid_t group)
4418 {
4419         int i;
4420
4421         for (i=0; i < nwrap_main_global->num_backends; i++) {
4422                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4423                 int rc;
4424
4425                 rc = b->ops->nw_initgroups(b, user, group);
4426                 if (rc == 0) {
4427                         return 0;
4428                 }
4429         }
4430
4431         errno = ENOENT;
4432         return -1;
4433 }
4434
4435 int initgroups(const char *user, gid_t group)
4436 {
4437         if (!nss_wrapper_enabled()) {
4438                 return libc_initgroups(user, group);
4439         }
4440
4441         return nwrap_initgroups(user, group);
4442 }
4443
4444 /****************************************************************************
4445  *   GETGRNAM
4446  ***************************************************************************/
4447
4448 static struct group *nwrap_getgrnam(const char *name)
4449 {
4450         int i;
4451         struct group *grp;
4452
4453         for (i=0; i < nwrap_main_global->num_backends; i++) {
4454                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4455                 grp = b->ops->nw_getgrnam(b, name);
4456                 if (grp) {
4457                         return grp;
4458                 }
4459         }
4460
4461         return NULL;
4462 }
4463
4464 struct group *getgrnam(const char *name)
4465 {
4466         if (!nss_wrapper_enabled()) {
4467                 return libc_getgrnam(name);
4468         }
4469
4470         return nwrap_getgrnam(name);
4471 }
4472
4473 /****************************************************************************
4474  *   GETGRNAM_R
4475  ***************************************************************************/
4476
4477 static int nwrap_getgrnam_r(const char *name, struct group *grdst,
4478                             char *buf, size_t buflen, struct group **grdstp)
4479 {
4480         int i, ret;
4481
4482         for (i=0; i < nwrap_main_global->num_backends; i++) {
4483                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4484                 ret = b->ops->nw_getgrnam_r(b, name, grdst, buf, buflen, grdstp);
4485                 if (ret == ENOENT) {
4486                         continue;
4487                 }
4488                 return ret;
4489         }
4490
4491         return ENOENT;
4492 }
4493
4494 #ifdef HAVE_GETGRNAM_R
4495 # ifdef HAVE_SOLARIS_GETGRNAM_R
4496 int getgrnam_r(const char *name, struct group *grp,
4497                 char *buf, int buflen, struct group **pgrp)
4498 # else /* HAVE_SOLARIS_GETGRNAM_R */
4499 int getgrnam_r(const char *name, struct group *grp,
4500                char *buf, size_t buflen, struct group **pgrp)
4501 # endif /* HAVE_SOLARIS_GETGRNAM_R */
4502 {
4503         if (!nss_wrapper_enabled()) {
4504                 return libc_getgrnam_r(name,
4505                                        grp,
4506                                        buf,
4507                                        buflen,
4508                                        pgrp);
4509         }
4510
4511         return nwrap_getgrnam_r(name, grp, buf, buflen, pgrp);
4512 }
4513 #endif /* HAVE_GETGRNAM_R */
4514
4515 /****************************************************************************
4516  *   GETGRGID
4517  ***************************************************************************/
4518
4519 static struct group *nwrap_getgrgid(gid_t gid)
4520 {
4521         int i;
4522         struct group *grp;
4523
4524         for (i=0; i < nwrap_main_global->num_backends; i++) {
4525                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4526                 grp = b->ops->nw_getgrgid(b, gid);
4527                 if (grp) {
4528                         return grp;
4529                 }
4530         }
4531
4532         return NULL;
4533 }
4534
4535 struct group *getgrgid(gid_t gid)
4536 {
4537         if (!nss_wrapper_enabled()) {
4538                 return libc_getgrgid(gid);
4539         }
4540
4541         return nwrap_getgrgid(gid);
4542 }
4543
4544 /****************************************************************************
4545  *   GETGRGID_R
4546  ***************************************************************************/
4547
4548 static int nwrap_getgrgid_r(gid_t gid, struct group *grdst,
4549                             char *buf, size_t buflen, struct group **grdstp)
4550 {
4551         int i,ret;
4552
4553         for (i=0; i < nwrap_main_global->num_backends; i++) {
4554                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4555                 ret = b->ops->nw_getgrgid_r(b, gid, grdst, buf, buflen, grdstp);
4556                 if (ret == ENOENT) {
4557                         continue;
4558                 }
4559                 return ret;
4560         }
4561
4562         return ENOENT;
4563 }
4564
4565 #ifdef HAVE_GETGRGID_R
4566 # ifdef HAVE_SOLARIS_GETGRGID_R
4567 int getgrgid_r(gid_t gid, struct group *grdst,
4568                char *buf, int buflen, struct group **grdstp)
4569 # else /* HAVE_SOLARIS_GETGRGID_R */
4570 int getgrgid_r(gid_t gid, struct group *grdst,
4571                char *buf, size_t buflen, struct group **grdstp)
4572 # endif /* HAVE_SOLARIS_GETGRGID_R */
4573 {
4574         if (!nss_wrapper_enabled()) {
4575                 return libc_getgrgid_r(gid, grdst, buf, buflen, grdstp);
4576         }
4577
4578         return nwrap_getgrgid_r(gid, grdst, buf, buflen, grdstp);
4579 }
4580 #endif
4581
4582 /****************************************************************************
4583  *   SETGRENT
4584  ***************************************************************************/
4585
4586 static void nwrap_setgrent(void)
4587 {
4588         int i;
4589
4590         for (i=0; i < nwrap_main_global->num_backends; i++) {
4591                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4592                 b->ops->nw_setgrent(b);
4593         }
4594 }
4595
4596 #ifdef HAVE_BSD_SETGRENT
4597 int setgrent(void)
4598 #else
4599 void setgrent(void)
4600 #endif
4601 {
4602         if (!nss_wrapper_enabled()) {
4603                 libc_setgrent();
4604                 goto out;
4605         }
4606
4607         nwrap_setgrent();
4608
4609 out:
4610 #ifdef HAVE_BSD_SETGRENT
4611         return 0;
4612 #else
4613         return;
4614 #endif
4615 }
4616
4617 /****************************************************************************
4618  *   GETGRENT
4619  ***************************************************************************/
4620
4621 static struct group *nwrap_getgrent(void)
4622 {
4623         int i;
4624         struct group *grp;
4625
4626         for (i=0; i < nwrap_main_global->num_backends; i++) {
4627                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4628                 grp = b->ops->nw_getgrent(b);
4629                 if (grp) {
4630                         return grp;
4631                 }
4632         }
4633
4634         return NULL;
4635 }
4636
4637 struct group *getgrent(void)
4638 {
4639         if (!nss_wrapper_enabled()) {
4640                 return libc_getgrent();
4641         }
4642
4643         return nwrap_getgrent();
4644 }
4645
4646 /****************************************************************************
4647  *   GETGRENT_R
4648  ***************************************************************************/
4649
4650 static int nwrap_getgrent_r(struct group *grdst, char *buf,
4651                             size_t buflen, struct group **grdstp)
4652 {
4653         int i,ret;
4654
4655         for (i=0; i < nwrap_main_global->num_backends; i++) {
4656                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4657                 ret = b->ops->nw_getgrent_r(b, grdst, buf, buflen, grdstp);
4658                 if (ret == ENOENT) {
4659                         continue;
4660                 }
4661                 return ret;
4662         }
4663
4664         return ENOENT;
4665 }
4666
4667 #ifdef HAVE_SOLARIS_GETGRENT_R
4668 struct group *getgrent_r(struct group *src, char *buf, int buflen)
4669 {
4670         struct group *grdstp = NULL;
4671         int rc;
4672
4673         if (!nss_wrapper_enabled()) {
4674                 return libc_getgrent_r(src, buf, buflen);
4675         }
4676
4677         rc = nwrap_getgrent_r(src, buf, buflen, &grdstp);
4678         if (rc < 0) {
4679                 return NULL;
4680         }
4681
4682         return grdstp;
4683 }
4684 #else /* HAVE_SOLARIS_GETGRENT_R */
4685 int getgrent_r(struct group *src, char *buf,
4686                size_t buflen, struct group **grdstp)
4687 {
4688         if (!nss_wrapper_enabled()) {
4689                 return libc_getgrent_r(src, buf, buflen, grdstp);
4690         }
4691
4692         return nwrap_getgrent_r(src, buf, buflen, grdstp);
4693 }
4694 #endif /* HAVE_SOLARIS_GETGRENT_R */
4695
4696 /****************************************************************************
4697  *   ENDGRENT
4698  ***************************************************************************/
4699
4700 static void nwrap_endgrent(void)
4701 {
4702         int i;
4703
4704         for (i=0; i < nwrap_main_global->num_backends; i++) {
4705                 struct nwrap_backend *b = &nwrap_main_global->backends[i];
4706                 b->ops->nw_endgrent(b);
4707         }
4708 }
4709
4710 void endgrent(void)
4711 {
4712         if (!nss_wrapper_enabled()) {
4713                 libc_endgrent();
4714                 return;
4715         }
4716
4717         nwrap_endgrent();
4718 }
4719
4720 /****************************************************************************
4721  *   GETGROUPLIST
4722  ***************************************************************************/
4723
4724 #ifdef HAVE_GETGROUPLIST
4725 static int nwrap_getgrouplist(const char *user, gid_t group,
4726                               gid_t *groups, int *ngroups)
4727 {
4728         struct group *grp;
4729         gid_t *groups_tmp;
4730         int count = 1;
4731
4732         NWRAP_LOG(NWRAP_LOG_DEBUG, "getgrouplist called for %s", user);
4733
4734         groups_tmp = (gid_t *)malloc(count * sizeof(gid_t));
4735         if (!groups_tmp) {
4736                 NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory");
4737                 errno = ENOMEM;
4738                 return -1;
4739         }
4740         groups_tmp[0] = group;
4741
4742         nwrap_setgrent();
4743         while ((grp = nwrap_getgrent()) != NULL) {
4744                 int i = 0;
4745
4746                 NWRAP_LOG(NWRAP_LOG_DEBUG,
4747                           "Inspecting %s for group membership",
4748                           grp->gr_name);
4749
4750                 for (i=0; grp->gr_mem && grp->gr_mem[i] != NULL; i++) {
4751
4752                         if (group != grp->gr_gid &&
4753                             (strcmp(user, grp->gr_mem[i]) == 0)) {
4754
4755                                 NWRAP_LOG(NWRAP_LOG_DEBUG,
4756                                           "%s is member of %s",
4757                                           user,
4758                                           grp->gr_name);
4759
4760                                 groups_tmp = (gid_t *)realloc(groups_tmp, (count + 1) * sizeof(gid_t));
4761                                 if (!groups_tmp) {
4762                                         NWRAP_LOG(NWRAP_LOG_ERROR,
4763                                                   "Out of memory");
4764                                         errno = ENOMEM;
4765                                         return -1;
4766                                 }
4767                                 groups_tmp[count] = grp->gr_gid;
4768
4769                                 count++;
4770                         }
4771                 }
4772         }
4773
4774         nwrap_endgrent();
4775
4776         NWRAP_LOG(NWRAP_LOG_DEBUG,
4777                   "%s is member of %d groups",
4778                   user, *ngroups);
4779
4780         if (*ngroups < count) {
4781                 *ngroups = count;
4782                 free(groups_tmp);
4783                 return -1;
4784         }
4785
4786         *ngroups = count;
4787         memcpy(groups, groups_tmp, count * sizeof(gid_t));
4788         free(groups_tmp);
4789
4790         return count;
4791 }
4792
4793 int getgrouplist(const char *user, gid_t group, gid_t *groups, int *ngroups)
4794 {
4795         if (!nss_wrapper_enabled()) {
4796                 return libc_getgrouplist(user, group, groups, ngroups);
4797         }
4798
4799         return nwrap_getgrouplist(user, group, groups, ngroups);
4800 }
4801 #endif
4802
4803 /**********************************************************
4804  * SHADOW
4805  **********************************************************/
4806
4807 #if defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM)
4808
4809 #ifdef HAVE_SETSPENT
4810 static void nwrap_setspent(void)
4811 {
4812         nwrap_files_setspent();
4813 }
4814
4815 void setspent(void)
4816 {
4817         if (!nss_wrapper_shadow_enabled()) {
4818                 return;
4819         }
4820
4821         nwrap_setspent();
4822 }
4823
4824 static struct spwd *nwrap_getspent(void)
4825 {
4826         return nwrap_files_getspent();
4827 }
4828
4829 struct spwd *getspent(void)
4830 {
4831         if (!nss_wrapper_shadow_enabled()) {
4832                 return NULL;
4833         }
4834
4835         return nwrap_getspent();
4836 }
4837
4838 static void nwrap_endspent(void)
4839 {
4840         nwrap_files_endspent();
4841 }
4842
4843 void endspent(void)
4844 {
4845         if (!nss_wrapper_shadow_enabled()) {
4846                 return;
4847         }
4848
4849         nwrap_endspent();
4850 }
4851 #endif /* HAVE_SETSPENT */
4852
4853 static struct spwd *nwrap_getspnam(const char *name)
4854 {
4855         return nwrap_files_getspnam(name);
4856 }
4857
4858 struct spwd *getspnam(const char *name)
4859 {
4860         if (!nss_wrapper_shadow_enabled()) {
4861                 return NULL;
4862         }
4863
4864         return nwrap_getspnam(name);
4865 }
4866
4867 #endif /* defined(HAVE_SHADOW_H) && defined(HAVE_GETSPNAM) */
4868
4869 /**********************************************************
4870  * NETDB
4871  **********************************************************/
4872
4873 static void nwrap_sethostent(int stayopen) {
4874         (void) stayopen; /* ignored */
4875
4876         nwrap_files_sethostent();
4877 }
4878
4879 #ifdef HAVE_SOLARIS_SETHOSTENT
4880 int sethostent(int stayopen)
4881 {
4882         if (!nss_wrapper_hosts_enabled()) {
4883                 libc_sethostent(stayopen);
4884                 return 0;
4885         }
4886
4887         nwrap_sethostent(stayopen);
4888
4889         return 0;
4890 }
4891 #else /* HAVE_SOLARIS_SETHOSTENT */
4892 void sethostent(int stayopen)
4893 {
4894         if (!nss_wrapper_hosts_enabled()) {
4895                 libc_sethostent(stayopen);
4896                 return;
4897         }
4898
4899         nwrap_sethostent(stayopen);
4900 }
4901 #endif /* HAVE_SOLARIS_SETHOSTENT */
4902
4903 static struct hostent *nwrap_gethostent(void)
4904 {
4905         return nwrap_files_gethostent();
4906 }
4907
4908 struct hostent *gethostent(void) {
4909         if (!nss_wrapper_hosts_enabled()) {
4910                 return libc_gethostent();
4911         }
4912
4913         return nwrap_gethostent();
4914 }
4915
4916 static void nwrap_endhostent(void) {
4917         nwrap_files_endhostent();
4918 }
4919
4920 #ifdef HAVE_SOLARIS_ENDHOSTENT
4921 int endhostent(void)
4922 {
4923         if (!nss_wrapper_hosts_enabled()) {
4924                 libc_endhostent();
4925                 return 0;
4926         }
4927
4928         nwrap_endhostent();
4929
4930         return 0;
4931 }
4932 #else /* HAVE_SOLARIS_ENDHOSTENT */
4933 void endhostent(void)
4934 {
4935         if (!nss_wrapper_hosts_enabled()) {
4936                 libc_endhostent();
4937                 return;
4938         }
4939
4940         nwrap_endhostent();
4941 }
4942 #endif /* HAVE_SOLARIS_ENDHOSTENT */
4943
4944 #ifdef BSD
4945 /* BSD implementation stores data in thread local storage but GLIBC does not */
4946 static __thread struct hostent user_he;
4947 static __thread struct nwrap_vector user_addrlist;
4948 #else
4949 static struct hostent user_he;
4950 static struct nwrap_vector user_addrlist;
4951 #endif /* BSD */
4952 static struct hostent *nwrap_gethostbyname(const char *name)
4953 {
4954         if (nwrap_files_gethostbyname(name, AF_UNSPEC, &user_he, &user_addrlist) == -1) {
4955                 return NULL;
4956         }
4957         return &user_he;
4958 }
4959
4960 struct hostent *gethostbyname(const char *name)
4961 {
4962         if (!nss_wrapper_hosts_enabled()) {
4963                 return libc_gethostbyname(name);
4964         }
4965
4966         return nwrap_gethostbyname(name);
4967 }
4968
4969 /* This is a GNU extension - Also can be found on BSD systems */
4970 #ifdef HAVE_GETHOSTBYNAME2
4971 #ifdef BSD
4972 /* BSD implementation stores data in  thread local storage but GLIBC not */
4973 static __thread struct hostent user_he2;
4974 static __thread struct nwrap_vector user_addrlist2;
4975 #else
4976 static struct hostent user_he2;
4977 static struct nwrap_vector user_addrlist2;
4978 #endif /* BSD */
4979 static struct hostent *nwrap_gethostbyname2(const char *name, int af)
4980 {
4981         if (nwrap_files_gethostbyname(name, af, &user_he2, &user_addrlist2) == -1) {
4982                 return NULL;
4983         }
4984         return &user_he2;
4985 }
4986
4987 struct hostent *gethostbyname2(const char *name, int af)
4988 {
4989         if (!nss_wrapper_hosts_enabled()) {
4990                 return libc_gethostbyname2(name, af);
4991         }
4992
4993         return nwrap_gethostbyname2(name, af);
4994 }
4995 #endif
4996
4997 static struct hostent *nwrap_gethostbyaddr(const void *addr,
4998                                            socklen_t len, int type)
4999 {
5000         return nwrap_files_gethostbyaddr(addr, len, type);
5001 }
5002
5003 struct hostent *gethostbyaddr(const void *addr,
5004                               socklen_t len, int type)
5005 {
5006         if (!nss_wrapper_hosts_enabled()) {
5007                 return libc_gethostbyaddr(addr, len, type);
5008         }
5009
5010         return nwrap_gethostbyaddr(addr, len, type);
5011 }
5012
5013 static const struct addrinfo default_hints =
5014 {
5015         .ai_flags = AI_ADDRCONFIG|AI_V4MAPPED,
5016         .ai_family = AF_UNSPEC,
5017         .ai_socktype = 0,
5018         .ai_protocol = 0,
5019         .ai_addrlen = 0,
5020         .ai_addr = NULL,
5021         .ai_canonname = NULL,
5022         .ai_next = NULL
5023 };
5024
5025 static int nwrap_convert_he_ai(const struct hostent *he,
5026                                unsigned short port,
5027                                const struct addrinfo *hints,
5028                                struct addrinfo **pai,
5029                                bool skip_canonname)
5030 {
5031         struct addrinfo *ai;
5032         socklen_t socklen;
5033
5034         if (he == NULL) {
5035                 return EAI_MEMORY;
5036         }
5037
5038         switch (he->h_addrtype) {
5039                 case AF_INET:
5040                         socklen = sizeof(struct sockaddr_in);
5041                         break;
5042 #ifdef HAVE_IPV6
5043                 case AF_INET6:
5044                         socklen = sizeof(struct sockaddr_in6);
5045                         break;
5046 #endif
5047                 default:
5048                         return EAI_FAMILY;
5049         }
5050
5051         ai = (struct addrinfo *)malloc(sizeof(struct addrinfo) + socklen);
5052         if (ai == NULL) {
5053                 return EAI_MEMORY;
5054         }
5055
5056         ai->ai_flags = hints->ai_flags;
5057         ai->ai_family = he->h_addrtype;
5058         ai->ai_socktype = hints->ai_socktype;
5059         ai->ai_protocol = hints->ai_protocol;
5060         ai->ai_canonname = NULL;
5061
5062         if (ai->ai_socktype == 0) {
5063                 ai->ai_socktype = SOCK_DGRAM;
5064         }
5065         if (ai->ai_protocol == 0) {
5066                 if (ai->ai_socktype == SOCK_DGRAM) {
5067                         ai->ai_protocol = IPPROTO_UDP;
5068                 } else if (ai->ai_socktype == SOCK_STREAM) {
5069                         ai->ai_protocol = IPPROTO_TCP;
5070                 }
5071         }
5072
5073         ai->ai_addrlen = socklen;
5074         ai->ai_addr = (void *)(ai + 1);
5075
5076 #ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
5077         ai->ai_addr->sa_len = socklen;
5078 #endif
5079         ai->ai_addr->sa_family = he->h_addrtype;
5080
5081         switch (he->h_addrtype) {
5082                 case AF_INET:
5083                 {
5084                         struct sockaddr_in *sinp =
5085                                 (struct sockaddr_in *) ai->ai_addr;
5086
5087                         memset(sinp, 0, sizeof(struct sockaddr_in));
5088
5089                         sinp->sin_port = htons(port);
5090                         sinp->sin_family = AF_INET;
5091
5092                         memset (sinp->sin_zero, '\0', sizeof (sinp->sin_zero));
5093                         memcpy(&sinp->sin_addr, he->h_addr_list[0], he->h_length);
5094
5095                 }
5096                 break;
5097 #ifdef HAVE_IPV6
5098                 case AF_INET6:
5099                 {
5100                         struct sockaddr_in6 *sin6p =
5101                                 (struct sockaddr_in6 *) ai->ai_addr;
5102
5103                         memset(sin6p, 0, sizeof(struct sockaddr_in6));
5104
5105                         sin6p->sin6_port = htons(port);
5106                         sin6p->sin6_family = AF_INET6;
5107
5108                         memcpy(&sin6p->sin6_addr,
5109                                he->h_addr_list[0],
5110                                he->h_length);
5111                 }
5112                 break;
5113 #endif
5114         }
5115
5116         ai->ai_next = NULL;
5117
5118         if (he->h_name && !skip_canonname) {
5119                 ai->ai_canonname = strdup(he->h_name);
5120                 if (ai->ai_canonname == NULL) {
5121                         freeaddrinfo(ai);
5122                         return EAI_MEMORY;
5123                 }
5124         }
5125
5126         *pai = ai;
5127         return 0;
5128 }
5129
5130 static int nwrap_getaddrinfo(const char *node,
5131                              const char *service,
5132                              const struct addrinfo *hints,
5133                              struct addrinfo **res)
5134 {
5135         struct addrinfo *ai = NULL;
5136         unsigned short port = 0;
5137         struct {
5138                 int family;
5139                 union {
5140                         struct in_addr v4;
5141 #ifdef HAVE_IPV6
5142                         struct in6_addr v6;
5143                 } in;
5144 #endif
5145         } addr = {
5146                 .family = AF_UNSPEC,
5147         };
5148         int rc;
5149
5150         if (node == NULL && service == NULL) {
5151                 return EAI_NONAME;
5152         }
5153
5154         if (hints == NULL) {
5155                 hints = &default_hints;
5156         }
5157
5158         /* EAI_BADFLAGS
5159               hints.ai_flags   contains   invalid  flags;  or,  hints.ai_flags
5160               included AI_CANONNAME and name was NULL.
5161         */
5162         if ((hints->ai_flags & AI_CANONNAME) && (node == NULL)) {
5163                 return EAI_BADFLAGS;
5164         }
5165
5166         /* If no node has been specified, let glibc deal with it */
5167         if (node == NULL) {
5168                 int ret;
5169                 struct addrinfo *p = NULL;
5170
5171                 ret = libc_getaddrinfo(node, service, hints, &p);
5172
5173                 if (ret == 0) {
5174                         *res = p;
5175                 }
5176                 return ret;
5177         }
5178
5179         if (service != NULL && service[0] != '\0') {
5180                 const char *proto = NULL;
5181                 struct servent *s;
5182                 char *end_ptr;
5183                 long sl;
5184
5185                 errno = 0;
5186                 sl = strtol(service, &end_ptr, 10);
5187
5188                 if (*end_ptr == '\0') {
5189                         port = sl;
5190                         goto valid_port;
5191                 } else if (hints->ai_flags & AI_NUMERICSERV) {
5192                         return EAI_NONAME;
5193                 }
5194
5195                 if (hints->ai_protocol != 0) {
5196                         struct protoent *pent;
5197
5198                         pent = getprotobynumber(hints->ai_protocol);
5199                         if (pent != NULL) {
5200                                 proto = pent->p_name;
5201                         }
5202                 }
5203
5204                 s = getservbyname(service, proto);
5205                 if (s == NULL) {
5206                         return EAI_NONAME;
5207                 }
5208                 port = ntohs(s->s_port);
5209         }
5210
5211 valid_port:
5212
5213         rc = inet_pton(AF_INET, node, &addr.in.v4);
5214         if (rc == 1) {
5215                 addr.family = AF_INET;
5216         }
5217 #ifdef HAVE_IPV6
5218         if (addr.family == AF_UNSPEC) {
5219                 rc = inet_pton(AF_INET6, node, &addr.in.v6);
5220                 if (rc == 1) {
5221                         addr.family = AF_INET6;
5222                 }
5223         }
5224 #endif
5225
5226         if (addr.family == AF_UNSPEC) {
5227                if (hints->ai_flags & AI_NUMERICHOST) {
5228                         return EAI_NONAME;
5229                 }
5230         } else if ((hints->ai_family != AF_UNSPEC) &&
5231                    (hints->ai_family != addr.family))
5232         {
5233                 return EAI_ADDRFAMILY;
5234         }
5235
5236         rc = nwrap_files_getaddrinfo(node, port, hints, &ai);
5237         if (rc != 0) {
5238                 int ret;
5239                 struct addrinfo *p = NULL;
5240
5241                 ret = libc_getaddrinfo(node, service, hints, &p);
5242
5243                 if (ret == 0) {
5244                         /*
5245                          * nwrap_files_getaddrinfo failed, but libc was
5246                          * successful -- use the result from libc.
5247                          */
5248                         *res = p;
5249                         return 0;
5250                 }
5251
5252                 return rc;
5253         }
5254
5255         /*
5256          * If the socktype was not specified, duplicate
5257          * each ai returned, so that we have variants for
5258          * both UDP and TCP.
5259          */
5260         if (hints->ai_socktype == 0) {
5261                 struct addrinfo *ai_cur;
5262
5263                 /* freeaddrinfo() frees ai_canonname and ai so allocate them */
5264                 for (ai_cur = ai; ai_cur != NULL; ai_cur = ai_cur->ai_next) {
5265                         struct addrinfo *ai_new;
5266
5267                         /* duplicate the current entry */
5268
5269                         ai_new = malloc(sizeof(struct addrinfo));
5270                         if (ai_new == NULL) {
5271                                 freeaddrinfo(ai);
5272                                 return EAI_MEMORY;
5273                         }
5274
5275                         memcpy(ai_new, ai_cur, sizeof(struct addrinfo));
5276                         ai_new->ai_next = NULL;
5277
5278                         /* We need a deep copy or freeaddrinfo() will blow up */
5279                         if (ai_cur->ai_canonname != NULL) {
5280                                 ai_new->ai_canonname =
5281                                         strdup(ai_cur->ai_canonname);
5282                         }
5283
5284                         if (ai_cur->ai_socktype == SOCK_DGRAM) {
5285                                 ai_new->ai_socktype = SOCK_STREAM;
5286                         } else if (ai_cur->ai_socktype == SOCK_STREAM) {
5287                                 ai_new->ai_socktype = SOCK_DGRAM;
5288                         }
5289                         if (ai_cur->ai_protocol == IPPROTO_TCP) {
5290                                 ai_new->ai_protocol = IPPROTO_UDP;
5291                         } else if (ai_cur->ai_protocol == IPPROTO_UDP) {
5292                                 ai_new->ai_protocol = IPPROTO_TCP;
5293                         }
5294
5295                         /* now insert the new entry */
5296
5297                         ai_new->ai_next = ai_cur->ai_next;
5298                         ai_cur->ai_next = ai_new;
5299
5300                         /* and move on (don't duplicate the new entry) */
5301
5302                         ai_cur = ai_new;
5303                 }
5304         }
5305
5306         *res = ai;
5307
5308         return 0;
5309 }
5310
5311 int getaddrinfo(const char *node, const char *service,
5312                 const struct addrinfo *hints,
5313                 struct addrinfo **res)
5314 {
5315         if (!nss_wrapper_hosts_enabled()) {
5316                 return libc_getaddrinfo(node, service, hints, res);
5317         }
5318
5319         return nwrap_getaddrinfo(node, service, hints, res);
5320 }
5321
5322 static int nwrap_getnameinfo(const struct sockaddr *sa, socklen_t salen,
5323                              char *host, size_t hostlen,
5324                              char *serv, size_t servlen,
5325                              int flags)
5326 {
5327         struct hostent *he;
5328         struct servent *service;
5329         const char *proto;
5330         const void *addr;
5331         socklen_t addrlen;
5332         uint16_t port;
5333         sa_family_t type;
5334
5335         if (sa == NULL || salen < sizeof(sa_family_t)) {
5336                 return EAI_FAMILY;
5337         }
5338
5339         if ((flags & NI_NAMEREQD) && host == NULL && serv == NULL) {
5340                 return EAI_NONAME;
5341         }
5342
5343         type = sa->sa_family;
5344         switch (type) {
5345         case AF_INET:
5346                 if (salen < sizeof(struct sockaddr_in))
5347                         return EAI_FAMILY;
5348                 addr = &((const struct sockaddr_in *)sa)->sin_addr;
5349                 addrlen = sizeof(((const struct sockaddr_in *)sa)->sin_addr);
5350                 port = ntohs(((const struct sockaddr_in *)sa)->sin_port);
5351                 break;
5352 #ifdef HAVE_IPV6
5353         case AF_INET6:
5354                 if (salen < sizeof(struct sockaddr_in6))
5355                         return EAI_FAMILY;
5356                 addr = &((const struct sockaddr_in6 *)sa)->sin6_addr;
5357                 addrlen = sizeof(((const struct sockaddr_in6 *)sa)->sin6_addr);
5358                 port = ntohs(((const struct sockaddr_in6 *)sa)->sin6_port);
5359                 break;
5360 #endif
5361         default:
5362                 return EAI_FAMILY;
5363         }
5364
5365         if (host != NULL) {
5366                 he = NULL;
5367                 if ((flags & NI_NUMERICHOST) == 0) {
5368                         he = nwrap_files_gethostbyaddr(addr, addrlen, type);
5369                         if ((flags & NI_NAMEREQD) && (he == NULL || he->h_name == NULL))
5370                                 return EAI_NONAME;
5371                 }
5372                 if (he != NULL && he->h_name != NULL) {
5373                         if (strlen(he->h_name) >= hostlen)
5374                                 return EAI_OVERFLOW;
5375                         strcpy(host, he->h_name);
5376                         if (flags & NI_NOFQDN)
5377                                 host[strcspn(host, ".")] = '\0';
5378                 } else {
5379                         if (inet_ntop(type, addr, host, hostlen) == NULL)
5380                                 return (errno == ENOSPC) ? EAI_OVERFLOW : EAI_FAIL;
5381                 }
5382         }
5383
5384         if (serv != NULL) {
5385                 service = NULL;
5386                 if ((flags & NI_NUMERICSERV) == 0) {
5387                         proto = (flags & NI_DGRAM) ? "udp" : "tcp";
5388                         service = getservbyport(htons(port), proto);
5389                 }
5390                 if (service != NULL) {
5391                         if (strlen(service->s_name) >= servlen)
5392                                 return EAI_OVERFLOW;
5393                         strcpy(serv, service->s_name);
5394                 } else {
5395                         if (snprintf(serv, servlen, "%u", port) >= (int) servlen)
5396                                 return EAI_OVERFLOW;
5397                 }
5398         }
5399
5400         return 0;
5401 }
5402
5403 #ifdef HAVE_LINUX_GETNAMEINFO
5404 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5405                 char *host, socklen_t hostlen,
5406                 char *serv, socklen_t servlen,
5407                 int flags)
5408 #elif defined(HAVE_LINUX_GETNAMEINFO_UNSIGNED)
5409 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5410                 char *host, socklen_t hostlen,
5411                 char *serv, socklen_t servlen,
5412                 unsigned int flags)
5413 #else
5414 int getnameinfo(const struct sockaddr *sa, socklen_t salen,
5415                 char *host, size_t hostlen,
5416                 char *serv, size_t servlen,
5417                 int flags)
5418 #endif
5419 {
5420         if (!nss_wrapper_hosts_enabled()) {
5421                 return libc_getnameinfo(sa, salen, host, hostlen, serv, servlen, flags);
5422         }
5423
5424         return nwrap_getnameinfo(sa, salen, host, hostlen, serv, servlen, flags);
5425 }
5426
5427 static int nwrap_gethostname(char *name, size_t len)
5428 {
5429         const char *hostname = getenv("NSS_WRAPPER_HOSTNAME");
5430
5431         if (strlen(hostname) >= len) {
5432                 errno = ENAMETOOLONG;
5433                 return -1;
5434         }
5435         snprintf(name, len, "%s", hostname);
5436
5437         return 0;
5438 }
5439
5440 #ifdef HAVE_SOLARIS_GETHOSTNAME
5441 int gethostname(char *name, int len)
5442 #else /* HAVE_SOLARIS_GETHOSTNAME */
5443 int gethostname(char *name, size_t len)
5444 #endif /* HAVE_SOLARIS_GETHOSTNAME */
5445 {
5446         if (!nwrap_hostname_enabled()) {
5447                 return libc_gethostname(name, len);
5448         }
5449
5450         return nwrap_gethostname(name, len);
5451 }
5452
5453 /****************************
5454  * DESTRUCTOR
5455  ***************************/
5456
5457 /*
5458  * This function is called when the library is unloaded and makes sure that
5459  * sockets get closed and the unix file for the socket are unlinked.
5460  */
5461 void nwrap_destructor(void)
5462 {
5463         int i;
5464
5465         NWRAP_LOCK_ALL;
5466         if (nwrap_main_global != NULL) {
5467                 struct nwrap_main *m = nwrap_main_global;
5468
5469                 /* libc */
5470                 SAFE_FREE(m->libc->fns);
5471                 if (m->libc->handle != NULL) {
5472                         dlclose(m->libc->handle);
5473                 }
5474                 if (m->libc->nsl_handle != NULL) {
5475                         dlclose(m->libc->nsl_handle);
5476                 }
5477                 if (m->libc->sock_handle != NULL) {
5478                         dlclose(m->libc->sock_handle);
5479                 }
5480                 SAFE_FREE(m->libc);
5481
5482                 /* backends */
5483                 for (i = 0; i < m->num_backends; i++) {
5484                         struct nwrap_backend *b = &(m->backends[i]);
5485
5486                         if (b->so_handle != NULL) {
5487                                 dlclose(b->so_handle);
5488                         }
5489                         SAFE_FREE(b->fns);
5490                 }
5491                 SAFE_FREE(m->backends);
5492         }
5493
5494         if (nwrap_pw_global.cache != NULL) {
5495                 struct nwrap_cache *c = nwrap_pw_global.cache;
5496
5497                 nwrap_files_cache_unload(c);
5498                 if (c->fd >= 0) {
5499                         fclose(c->fp);
5500                         c->fd = -1;
5501                 }
5502
5503                 SAFE_FREE(nwrap_pw_global.list);
5504                 nwrap_pw_global.num = 0;
5505         }
5506
5507         if (nwrap_gr_global.cache != NULL) {
5508                 struct nwrap_cache *c = nwrap_gr_global.cache;
5509
5510                 nwrap_files_cache_unload(c);
5511                 if (c->fd >= 0) {
5512                         fclose(c->fp);
5513                         c->fd = -1;
5514                 }
5515
5516                 SAFE_FREE(nwrap_gr_global.list);
5517                 nwrap_pw_global.num = 0;
5518         }
5519
5520         if (nwrap_he_global.cache != NULL) {
5521                 struct nwrap_cache *c = nwrap_he_global.cache;
5522
5523                 nwrap_files_cache_unload(c);
5524                 if (c->fd >= 0) {
5525                         fclose(c->fp);
5526                         c->fd = -1;
5527                 }
5528
5529                 nwrap_he_global.num = 0;
5530         }
5531
5532         hdestroy();
5533         NWRAP_UNLOCK_ALL;
5534 }