getpwent.c revision 113992 
1/*-
2 * Copyright (c) 2003 Networks Associates Technology, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by
6 * Jacques A. Vidrine, Safeport Network Services, and Network
7 * Associates Laboratories, the Security Research Division of Network
8 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
9 * ("CBOSS"), as part of the DARPA CHATS research program.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in the
18 *    documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 */
33#include <sys/cdefs.h>
34__FBSDID("$FreeBSD: head/lib/libc/gen/getpwent.c 113992 2003-04-24 23:56:58Z nectar $");
35
36#include "namespace.h"
37#include <sys/param.h>
38#ifdef YP
39#include <rpc/rpc.h>
40#include <rpcsvc/yp_prot.h>
41#include <rpcsvc/ypclnt.h>
42#endif
43#include <arpa/inet.h>
44#include <errno.h>
45#include <fcntl.h>
46#ifdef HESIOD
47#include <hesiod.h>
48#endif
49#include <netdb.h>
50#include <nsswitch.h>
51#include <pthread.h>
52#include <pthread_np.h>
53#include <pwd.h>
54#include <stdlib.h>
55#include <stdio.h>
56#include <string.h>
57#include <syslog.h>
58#include <unistd.h>
59#include "un-namespace.h"
60#include <db.h>
61#include "libc_private.h"
62#include "pw_scan.h"
63#include "nss_tls.h"
64
65#ifndef CTASSERT
66#define CTASSERT(x)		_CTASSERT(x, __LINE__)
67#define _CTASSERT(x, y)		__CTASSERT(x, y)
68#define __CTASSERT(x, y)	typedef char __assert_ ## y [(x) ? 1 : -1]
69#endif
70
71/* Counter as stored in /etc/pwd.db */
72typedef	int		pwkeynum;
73
74CTASSERT(MAXLOGNAME > sizeof(uid_t));
75CTASSERT(MAXLOGNAME > sizeof(pwkeynum));
76
77enum constants {
78	PWD_STORAGE_INITIAL	= 1 << 10, /* 1 KByte */
79	PWD_STORAGE_MAX		= 1 << 20, /* 1 MByte */
80	SETPWENT		= 1,
81	ENDPWENT		= 2,
82	HESIOD_NAME_MAX		= 256
83};
84
85static const ns_src defaultsrc[] = {
86	{ NSSRC_COMPAT, NS_SUCCESS },
87	{ NULL, 0 }
88};
89
90int	__pw_match_entry(const char *, size_t, enum nss_lookup_type,
91	    const char *, uid_t);
92int	__pw_parse_entry(char *, size_t, struct passwd *, int, int *errnop);
93
94static	void	 pwd_init(struct passwd *);
95
96union key {
97	const char	*name;
98	uid_t		 uid;
99};
100
101static	struct passwd *getpw(int (*fn)(union key, struct passwd *, char *,
102		    size_t, struct passwd **), union key);
103static	int	 wrap_getpwnam_r(union key, struct passwd *, char *,
104		    size_t, struct passwd **);
105static	int	 wrap_getpwuid_r(union key, struct passwd *, char *, size_t,
106		    struct passwd **);
107static	int	 wrap_getpwent_r(union key, struct passwd *, char *, size_t,
108		    struct passwd **);
109
110static	int	 pwdb_match_entry_v3(char *, size_t, enum nss_lookup_type,
111		    const char *, uid_t);
112static	int	 pwdb_parse_entry_v3(char *, size_t, struct passwd *, int *);
113static	int	 pwdb_match_entry_v4(char *, size_t, enum nss_lookup_type,
114		    const char *, uid_t);
115static	int	 pwdb_parse_entry_v4(char *, size_t, struct passwd *, int *);
116
117
118struct {
119	int	(*match)(char *, size_t, enum nss_lookup_type, const char *,
120		    uid_t);
121	int	(*parse)(char *, size_t, struct passwd *, int *);
122} pwdb_versions[] = {
123	{ NULL, NULL },					/* version 0 */
124	{ NULL, NULL },					/* version 1 */
125	{ NULL, NULL },					/* version 2 */
126	{ pwdb_match_entry_v3, pwdb_parse_entry_v3 },	/* version 3 */
127	{ pwdb_match_entry_v4, pwdb_parse_entry_v4 },	/* version 4 */
128};
129
130
131struct files_state {
132	DB		*db;
133	pwkeynum	 keynum;
134	int		 stayopen;
135	int		 version;
136};
137static	void	files_endstate(void *);
138NSS_TLS_HANDLING(files);
139static	DB	*pwdbopen(int *);
140static	void	 files_endstate(void *);
141static	int	 files_setpwent(void *, void *, va_list);
142static	int	 files_passwd(void *, void *, va_list);
143
144
145#ifdef HESIOD
146struct dns_state {
147	long	counter;
148};
149static	void	dns_endstate(void *);
150NSS_TLS_HANDLING(dns);
151static	int	 dns_setpwent(void *, void *, va_list);
152static	int	 dns_passwd(void *, void *, va_list);
153#endif
154
155
156#ifdef YP
157struct nis_state {
158	char	 domain[MAXHOSTNAMELEN];
159	int	 done;
160	char	*key;
161	int	 keylen;
162};
163static	void	 nis_endstate(void *);
164NSS_TLS_HANDLING(nis);
165static	int	 nis_setpwent(void *, void *, va_list);
166static	int	 nis_passwd(void *, void *, va_list);
167static	int	 nis_map(char *, enum nss_lookup_type, char *, size_t, int *);
168static	int	 nis_adjunct(char *, const char *, char *, size_t);
169#endif
170
171
172struct compat_state {
173	DB		*db;
174	pwkeynum	 keynum;
175	int		 stayopen;
176	int		 version;
177	DB		*exclude;
178	struct passwd	 template;
179	char		*name;
180	enum _compat {
181		COMPAT_MODE_OFF = 0,
182		COMPAT_MODE_ALL,
183		COMPAT_MODE_NAME,
184		COMPAT_MODE_NETGROUP
185	}		 compat;
186};
187static	void	 compat_endstate(void *);
188NSS_TLS_HANDLING(compat);
189static	int	 compat_setpwent(void *, void *, va_list);
190static	int	 compat_passwd(void *, void *, va_list);
191static	void	 compat_clear_template(struct passwd *);
192static	int	 compat_set_template(struct passwd *, struct passwd *);
193static	int	 compat_use_template(struct passwd *, struct passwd *, char *,
194		    size_t);
195static	int	 compat_redispatch(struct compat_state *, enum nss_lookup_type,
196		    enum nss_lookup_type, const char *, const char *, uid_t,
197		    struct passwd *, char *, size_t, int *);
198void
199setpwent(void)
200{
201	static const ns_dtab dtab[] = {
202		{ NSSRC_FILES, files_setpwent, (void *)SETPWENT },
203#ifdef HESIOD
204		{ NSSRC_DNS, dns_setpwent, (void *)SETPWENT },
205#endif
206#ifdef YP
207		{ NSSRC_NIS, nis_setpwent, (void *)SETPWENT },
208#endif
209		{ NSSRC_COMPAT, compat_setpwent, (void *)SETPWENT },
210		{ NULL, NULL, NULL }
211	};
212	(void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "setpwent", defaultsrc, 0);
213}
214
215
216int
217setpassent(int stayopen)
218{
219	static const ns_dtab dtab[] = {
220		{ NSSRC_FILES, files_setpwent, (void *)SETPWENT },
221#ifdef HESIOD
222		{ NSSRC_DNS, dns_setpwent, (void *)SETPWENT },
223#endif
224#ifdef YP
225		{ NSSRC_NIS, nis_setpwent, (void *)SETPWENT },
226#endif
227		{ NSSRC_COMPAT, compat_setpwent, (void *)SETPWENT },
228		{ NULL, NULL, NULL }
229	};
230	(void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "setpwent", defaultsrc,
231	    stayopen);
232	return (1);
233}
234
235
236void
237endpwent(void)
238{
239	static const ns_dtab dtab[] = {
240		{ NSSRC_FILES, files_setpwent, (void *)ENDPWENT },
241#ifdef HESIOD
242		{ NSSRC_DNS, dns_setpwent, (void *)ENDPWENT },
243#endif
244#ifdef YP
245		{ NSSRC_NIS, nis_setpwent, (void *)ENDPWENT },
246#endif
247		{ NSSRC_COMPAT, compat_setpwent, (void *)ENDPWENT },
248		{ NULL, NULL, NULL }
249	};
250	(void)_nsdispatch(NULL, dtab, NSDB_PASSWD, "endpwent", defaultsrc);
251}
252
253
254int
255getpwent_r(struct passwd *pwd, char *buffer, size_t bufsize,
256    struct passwd **result)
257{
258	static const ns_dtab dtab[] = {
259		{ NSSRC_FILES, files_passwd, (void *)nss_lt_all },
260#ifdef HESIOD
261		{ NSSRC_DNS, dns_passwd, (void *)nss_lt_all },
262#endif
263#ifdef YP
264		{ NSSRC_NIS, nis_passwd, (void *)nss_lt_all },
265#endif
266		{ NSSRC_COMPAT, compat_passwd, (void *)nss_lt_all },
267		{ NULL, NULL, NULL }
268	};
269	int	rv, ret_errno;
270
271	pwd_init(pwd);
272	ret_errno = 0;
273	*result = NULL;
274	rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwent_r", defaultsrc,
275	    pwd, buffer, bufsize, &ret_errno);
276	if (rv == NS_SUCCESS)
277		return (0);
278	else
279		return (ret_errno);
280}
281
282
283int
284getpwnam_r(const char *name, struct passwd *pwd, char *buffer, size_t bufsize,
285    struct passwd **result)
286{
287	static const ns_dtab dtab[] = {
288		{ NSSRC_FILES, files_passwd, (void *)nss_lt_name },
289#ifdef HESIOD
290		{ NSSRC_DNS, dns_passwd, (void *)nss_lt_name },
291#endif
292#ifdef YP
293		{ NSSRC_NIS, nis_passwd, (void *)nss_lt_name },
294#endif
295		{ NSSRC_COMPAT, compat_passwd, (void *)nss_lt_name },
296		{ NULL, NULL, NULL }
297	};
298	int	rv, ret_errno;
299
300	pwd_init(pwd);
301	ret_errno = 0;
302	*result = NULL;
303	rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwnam_r", defaultsrc,
304	    name, pwd, buffer, bufsize, &ret_errno);
305	if (rv == NS_SUCCESS)
306		return (0);
307	else
308		return (ret_errno);
309}
310
311
312int
313getpwuid_r(uid_t uid, struct passwd *pwd, char *buffer, size_t bufsize,
314    struct passwd **result)
315{
316	static const ns_dtab dtab[] = {
317		{ NSSRC_FILES, files_passwd, (void *)nss_lt_id },
318#ifdef HESIOD
319		{ NSSRC_DNS, dns_passwd, (void *)nss_lt_id },
320#endif
321#ifdef YP
322		{ NSSRC_NIS, nis_passwd, (void *)nss_lt_id },
323#endif
324		{ NSSRC_COMPAT, compat_passwd, (void *)nss_lt_id },
325		{ NULL, NULL, NULL }
326	};
327	int	rv, ret_errno;
328
329	pwd_init(pwd);
330	ret_errno = 0;
331	*result = NULL;
332	rv = _nsdispatch(result, dtab, NSDB_PASSWD, "getpwuid_r", defaultsrc,
333	    uid, pwd, buffer, bufsize, &ret_errno);
334	if (rv == NS_SUCCESS)
335		return (0);
336	else
337		return (ret_errno);
338}
339
340
341static void
342pwd_init(struct passwd *pwd)
343{
344	static char nul[] = "";
345
346	memset(pwd, 0, sizeof(*pwd));
347	pwd->pw_uid = (uid_t)-1;  /* Considered least likely to lead to */
348	pwd->pw_gid = (gid_t)-1;  /* a security issue.                  */
349	pwd->pw_name = nul;
350	pwd->pw_passwd = nul;
351	pwd->pw_class = nul;
352	pwd->pw_gecos = nul;
353	pwd->pw_dir = nul;
354	pwd->pw_shell = nul;
355}
356
357
358static struct passwd	 pwd;
359static char		*pwd_storage;
360static size_t		 pwd_storage_size;
361
362
363static struct passwd *
364getpw(int (*fn)(union key, struct passwd *, char *, size_t, struct passwd **),
365    union key key)
366{
367	int		 rv;
368	struct passwd	*res;
369
370	if (pwd_storage == NULL) {
371		pwd_storage = malloc(PWD_STORAGE_INITIAL);
372		if (pwd_storage == NULL)
373			return (NULL);
374		pwd_storage_size = PWD_STORAGE_INITIAL;
375	}
376	do {
377		rv = fn(key, &pwd, pwd_storage, pwd_storage_size, &res);
378		if (res == NULL && rv == ERANGE) {
379			free(pwd_storage);
380			if ((pwd_storage_size << 1) > PWD_STORAGE_MAX) {
381				pwd_storage = NULL;
382				return (NULL);
383			}
384			pwd_storage_size <<= 1;
385			pwd_storage = malloc(pwd_storage_size);
386			if (pwd_storage == NULL)
387				return (NULL);
388		}
389	} while (res == NULL && rv == ERANGE);
390	return (res);
391}
392
393
394static int
395wrap_getpwnam_r(union key key, struct passwd *pwd, char *buffer,
396    size_t bufsize, struct passwd **res)
397{
398	return (getpwnam_r(key.name, pwd, buffer, bufsize, res));
399}
400
401
402static int
403wrap_getpwuid_r(union key key, struct passwd *pwd, char *buffer,
404    size_t bufsize, struct passwd **res)
405{
406	return (getpwuid_r(key.uid, pwd, buffer, bufsize, res));
407}
408
409
410static int
411wrap_getpwent_r(union key key __unused, struct passwd *pwd, char *buffer,
412    size_t bufsize, struct passwd **res)
413{
414	return (getpwent_r(pwd, buffer, bufsize, res));
415}
416
417
418struct passwd *
419getpwnam(const char *name)
420{
421	union key key;
422
423	key.name = name;
424	return (getpw(wrap_getpwnam_r, key));
425}
426
427
428struct passwd *
429getpwuid(uid_t uid)
430{
431	union key key;
432
433	key.uid = uid;
434	return (getpw(wrap_getpwuid_r, key));
435}
436
437
438struct passwd *
439getpwent(void)
440{
441	union key key;
442
443	key.uid = 0; /* not used */
444	return (getpw(wrap_getpwent_r, key));
445}
446
447
448/*
449 * files backend
450 */
451static DB *
452pwdbopen(int *version)
453{
454	DB	*res;
455	DBT	 key, entry;
456	int	 rv;
457
458	if (geteuid() != 0 ||
459	    (res = dbopen(_PATH_SMP_DB, O_RDONLY, 0, DB_HASH, NULL)) == NULL)
460		res = dbopen(_PATH_MP_DB, O_RDONLY, 0, DB_HASH, NULL);
461	if (res == NULL)
462		return (NULL);
463	key.data = _PWD_VERSION_KEY;
464	key.size = strlen(_PWD_VERSION_KEY);
465	rv = res->get(res, &key, &entry, 0);
466	if (rv == 0)
467		*version = *(unsigned char *)entry.data;
468	else
469		*version = 3;
470	if (*version < 3 ||
471	    *version >= sizeof(pwdb_versions)/sizeof(pwdb_versions[0])) {
472		syslog(LOG_CRIT, "Unsupported password database version %d",
473		    *version);
474		res->close(res);
475		res = NULL;
476	}
477	return (res);
478}
479
480
481static void
482files_endstate(void *p)
483{
484	DB	*db;
485
486	if (p == NULL)
487		return;
488	db = ((struct files_state *)p)->db;
489	if (db != NULL)
490		db->close(db);
491	free(p);
492}
493
494
495static int
496files_setpwent(void *retval, void *mdata, va_list ap)
497{
498	struct files_state	*st;
499	int			 rv, stayopen;
500
501	rv = files_getstate(&st);
502	if (rv != 0)
503		return (NS_UNAVAIL);
504	switch ((enum constants)mdata) {
505	case SETPWENT:
506		stayopen = va_arg(ap, int);
507		st->keynum = 0;
508		if (stayopen)
509			st->db = pwdbopen(&st->version);
510		st->stayopen = stayopen;
511		break;
512	case ENDPWENT:
513		if (st->db != NULL) {
514			(void)st->db->close(st->db);
515			st->db = NULL;
516		}
517		break;
518	default:
519		break;
520	}
521	return (NS_UNAVAIL);
522}
523
524
525static int
526files_passwd(void *retval, void *mdata, va_list ap)
527{
528	char			 keybuf[MAXLOGNAME + 1];
529	DBT			 key, entry;
530	struct files_state	*st;
531	enum nss_lookup_type	 how;
532	const char		*name;
533	struct passwd		*pwd;
534	char			*buffer;
535	size_t			 bufsize, namesize;
536	uid_t			 uid;
537	uint32_t		 store;
538	int			 rv, stayopen, *errnop;
539
540	name = NULL;
541	uid = (uid_t)-1;
542	how = (enum nss_lookup_type)mdata;
543	switch (how) {
544	case nss_lt_name:
545		name = va_arg(ap, const char *);
546		keybuf[0] = _PW_KEYBYNAME;
547		break;
548	case nss_lt_id:
549		uid = va_arg(ap, uid_t);
550		keybuf[0] = _PW_KEYBYUID;
551		break;
552	case nss_lt_all:
553		keybuf[0] = _PW_KEYBYNUM;
554		break;
555	default:
556		rv = NS_NOTFOUND;
557		goto fin;
558	}
559	pwd = va_arg(ap, struct passwd *);
560	buffer = va_arg(ap, char *);
561	bufsize = va_arg(ap, size_t);
562	errnop = va_arg(ap, int *);
563	*errnop = files_getstate(&st);
564	if (*errnop != 0)
565		return (NS_UNAVAIL);
566	if (how == nss_lt_all && st->keynum < 0) {
567		rv = NS_NOTFOUND;
568		goto fin;
569	}
570	if (st->db == NULL &&
571	    (st->db = pwdbopen(&st->version)) == NULL) {
572		*errnop = errno;
573		rv = NS_UNAVAIL;
574		goto fin;
575	}
576	if (how == nss_lt_all)
577		stayopen = 1;
578	else
579		stayopen = st->stayopen;
580	key.data = keybuf;
581	do {
582		switch (how) {
583		case nss_lt_name:
584			/* MAXLOGNAME includes NUL byte, but we do not
585			 * include the NUL byte in the key.
586			 */
587			namesize = strlcpy(&keybuf[1], name, sizeof(keybuf)-1);
588			if (namesize >= sizeof(keybuf)-1) {
589				*errnop = EINVAL;
590				rv = NS_NOTFOUND;
591				goto fin;
592			}
593			key.size = namesize + 1;
594			break;
595		case nss_lt_id:
596			if (st->version < _PWD_CURRENT_VERSION) {
597				memcpy(&keybuf[1], &uid, sizeof(uid));
598				key.size = sizeof(uid) + 1;
599			} else {
600				store = htonl(uid);
601				memcpy(&keybuf[1], &store, sizeof(store));
602				key.size = sizeof(store) + 1;
603			}
604			break;
605		case nss_lt_all:
606			st->keynum++;
607			if (st->version < _PWD_CURRENT_VERSION) {
608				memcpy(&keybuf[1], &st->keynum,
609				    sizeof(st->keynum));
610				key.size = sizeof(st->keynum) + 1;
611			} else {
612				store = htonl(st->keynum);
613				memcpy(&keybuf[1], &store, sizeof(store));
614				key.size = sizeof(store) + 1;
615			}
616			break;
617		}
618		keybuf[0] = _PW_VERSIONED(keybuf[0], st->version);
619		rv = st->db->get(st->db, &key, &entry, 0);
620		if (rv < 0 || rv > 1) { /* should never return > 1 */
621			*errnop = errno;
622			rv = NS_UNAVAIL;
623			goto fin;
624		} else if (rv == 1) {
625			if (how == nss_lt_all)
626				st->keynum = -1;
627			rv = NS_NOTFOUND;
628			goto fin;
629		}
630		rv = pwdb_versions[st->version].match(entry.data, entry.size,
631		    how, name, uid);
632		if (rv != NS_SUCCESS)
633			continue;
634		if (entry.size > bufsize) {
635			*errnop = ERANGE;
636			rv = NS_RETURN;
637			break;
638		}
639		memcpy(buffer, entry.data, entry.size);
640		rv = pwdb_versions[st->version].parse(buffer, entry.size, pwd,
641		    errnop);
642	} while (how == nss_lt_all && !(rv & NS_TERMINATE));
643fin:
644	if (!stayopen && st->db != NULL) {
645		(void)st->db->close(st->db);
646		st->db = NULL;
647	}
648	if (rv == NS_SUCCESS) {
649		pwd->pw_fields &= ~_PWF_SOURCE;
650		pwd->pw_fields |= _PWF_FILES;
651		if (retval != NULL)
652			*(struct passwd **)retval = pwd;
653	}
654	return (rv);
655}
656
657
658static int
659pwdb_match_entry_v3(char *entry, size_t entrysize, enum nss_lookup_type how,
660    const char *name, uid_t uid)
661{
662	const char	*p, *eom;
663	uid_t		 uid2;
664
665	eom = &entry[entrysize];
666	for (p = entry; p < eom; p++)
667		if (*p == '\0')
668			break;
669	if (*p != '\0')
670		return (NS_NOTFOUND);
671	if (how == nss_lt_all)
672		return (NS_SUCCESS);
673	if (how == nss_lt_name)
674		return (strcmp(name, entry) == 0 ? NS_SUCCESS : NS_NOTFOUND);
675	for (p++; p < eom; p++)
676		if (*p == '\0')
677			break;
678	if (*p != '\0' || (++p) + sizeof(uid) >= eom)
679		return (NS_NOTFOUND);
680	memcpy(&uid2, p, sizeof(uid2));
681	return (uid == uid2 ? NS_SUCCESS : NS_NOTFOUND);
682}
683
684
685static int
686pwdb_parse_entry_v3(char *buffer, size_t bufsize, struct passwd *pwd,
687    int *errnop)
688{
689	char		*p, *eom;
690	int32_t		 pw_change, pw_expire;
691
692	/* THIS CODE MUST MATCH THAT IN pwd_mkdb. */
693	p = buffer;
694	eom = &buffer[bufsize];
695#define STRING(field)	do {			\
696		(field) = p;			\
697		while (p < eom && *p != '\0')	\
698			p++;			\
699		if (p >= eom)			\
700			return (NS_NOTFOUND);	\
701		p++;				\
702	} while (0)
703#define SCALAR(field)	do {				\
704		if (p + sizeof(field) > eom)		\
705			return (NS_NOTFOUND);		\
706		memcpy(&(field), p, sizeof(field));	\
707		p += sizeof(field);			\
708	} while (0)
709	STRING(pwd->pw_name);
710	STRING(pwd->pw_passwd);
711	SCALAR(pwd->pw_uid);
712	SCALAR(pwd->pw_gid);
713	SCALAR(pw_change);
714	STRING(pwd->pw_class);
715	STRING(pwd->pw_gecos);
716	STRING(pwd->pw_dir);
717	STRING(pwd->pw_shell);
718	SCALAR(pw_expire);
719	SCALAR(pwd->pw_fields);
720#undef STRING
721#undef SCALAR
722	pwd->pw_change = pw_change;
723	pwd->pw_expire = pw_expire;
724	return (NS_SUCCESS);
725}
726
727
728static int
729pwdb_match_entry_v4(char *entry, size_t entrysize, enum nss_lookup_type how,
730    const char *name, uid_t uid)
731{
732	const char	*p, *eom;
733	uint32_t	 uid2;
734
735	eom = &entry[entrysize];
736	for (p = entry; p < eom; p++)
737		if (*p == '\0')
738			break;
739	if (*p != '\0')
740		return (NS_NOTFOUND);
741	if (how == nss_lt_all)
742		return (NS_SUCCESS);
743	if (how == nss_lt_name)
744		return (strcmp(name, entry) == 0 ? NS_SUCCESS : NS_NOTFOUND);
745	for (p++; p < eom; p++)
746		if (*p == '\0')
747			break;
748	if (*p != '\0' || (++p) + sizeof(uid) >= eom)
749		return (NS_NOTFOUND);
750	memcpy(&uid2, p, sizeof(uid2));
751	uid2 = ntohl(uid2);
752	return (uid == (uid_t)uid2 ? NS_SUCCESS : NS_NOTFOUND);
753}
754
755
756static int
757pwdb_parse_entry_v4(char *buffer, size_t bufsize, struct passwd *pwd,
758    int *errnop)
759{
760	char		*p, *eom;
761	uint32_t	 n;
762
763	/* THIS CODE MUST MATCH THAT IN pwd_mkdb. */
764	p = buffer;
765	eom = &buffer[bufsize];
766#define STRING(field)	do {			\
767		(field) = p;			\
768		while (p < eom && *p != '\0')	\
769			p++;			\
770		if (p >= eom)			\
771			return (NS_NOTFOUND);	\
772		p++;				\
773	} while (0)
774#define SCALAR(field)	do {				\
775		if (p + sizeof(n) > eom)		\
776			return (NS_NOTFOUND);		\
777		memcpy(&n, p, sizeof(n));		\
778		(field) = ntohl(n);			\
779		p += sizeof(n);				\
780	} while (0)
781	STRING(pwd->pw_name);
782	STRING(pwd->pw_passwd);
783	SCALAR(pwd->pw_uid);
784	SCALAR(pwd->pw_gid);
785	SCALAR(pwd->pw_change);
786	STRING(pwd->pw_class);
787	STRING(pwd->pw_gecos);
788	STRING(pwd->pw_dir);
789	STRING(pwd->pw_shell);
790	SCALAR(pwd->pw_expire);
791	SCALAR(pwd->pw_fields);
792#undef STRING
793#undef SCALAR
794	return (NS_SUCCESS);
795}
796
797
798#ifdef HESIOD
799/*
800 * dns backend
801 */
802static void
803dns_endstate(void *p)
804{
805	free(p);
806}
807
808
809static int
810dns_setpwent(void *retval, void *mdata, va_list ap)
811{
812	struct dns_state	*st;
813	int			 rv;
814
815	rv = dns_getstate(&st);
816	if (rv != 0)
817		return (NS_UNAVAIL);
818	st->counter = 0;
819	return (NS_UNAVAIL);
820}
821
822
823static int
824dns_passwd(void *retval, void *mdata, va_list ap)
825{
826	char			 buf[HESIOD_NAME_MAX];
827	struct dns_state	*st;
828	struct passwd		*pwd;
829	const char		*name, *label;
830	void			*ctx;
831	char			*buffer, **hes;
832	size_t			 bufsize, linesize;
833	uid_t			 uid;
834	enum nss_lookup_type	 how;
835	int			 rv, *errnop;
836
837	ctx = NULL;
838	hes = NULL;
839	name = NULL;
840	uid = (uid_t)-1;
841	how = (enum nss_lookup_type)mdata;
842	switch (how) {
843	case nss_lt_name:
844		name = va_arg(ap, const char *);
845		break;
846	case nss_lt_id:
847		uid = va_arg(ap, uid_t);
848		break;
849	case nss_lt_all:
850		break;
851	}
852	pwd     = va_arg(ap, struct passwd *);
853	buffer  = va_arg(ap, char *);
854	bufsize = va_arg(ap, size_t);
855	errnop  = va_arg(ap, int *);
856	*errnop = dns_getstate(&st);
857	if (*errnop != 0)
858		return (NS_UNAVAIL);
859	if (hesiod_init(&ctx) != 0) {
860		*errnop = errno;
861		rv = NS_UNAVAIL;
862		goto fin;
863	}
864	do {
865		rv = NS_NOTFOUND;
866		switch (how) {
867		case nss_lt_name:
868			label = name;
869			break;
870		case nss_lt_id:
871			if (snprintf(buf, sizeof(buf), "%lu",
872			    (unsigned long)uid) >= sizeof(buf))
873				goto fin;
874			label = buf;
875			break;
876		case nss_lt_all:
877			if (st->counter < 0)
878				goto fin;
879			if (snprintf(buf, sizeof(buf), "passwd-%ld",
880			    st->counter++) >= sizeof(buf))
881				goto fin;
882			label = buf;
883			break;
884		}
885		hes = hesiod_resolve(ctx, label,
886		    how == nss_lt_id ? "uid" : "passwd");
887		if (hes == NULL) {
888			if (how == nss_lt_all)
889				st->counter = -1;
890			if (errno != ENOENT)
891				*errnop = errno;
892			goto fin;
893		}
894		rv = __pw_match_entry(hes[0], strlen(hes[0]), how, name, uid);
895		if (rv != NS_SUCCESS) {
896			hesiod_free_list(ctx, hes);
897			hes = NULL;
898			continue;
899		}
900		linesize = strlcpy(buffer, hes[0], bufsize);
901		if (linesize >= bufsize) {
902			*errnop = ERANGE;
903			rv = NS_RETURN;
904			continue;
905		}
906		hesiod_free_list(ctx, hes);
907		hes = NULL;
908		rv = __pw_parse_entry(buffer, bufsize, pwd, 0, errnop);
909	} while (how == nss_lt_all && !(rv & NS_TERMINATE));
910fin:
911	if (hes != NULL)
912		hesiod_free_list(ctx, hes);
913	if (ctx != NULL)
914		hesiod_end(ctx);
915	if (rv == NS_SUCCESS) {
916		pwd->pw_fields &= ~_PWF_SOURCE;
917		pwd->pw_fields |= _PWF_HESIOD;
918		if (retval != NULL)
919			*(struct passwd **)retval = pwd;
920	}
921	return (rv);
922}
923#endif /* HESIOD */
924
925
926#ifdef YP
927/*
928 * nis backend
929 */
930static void
931nis_endstate(void *p)
932{
933	free(((struct nis_state *)p)->key);
934	free(p);
935}
936
937static int
938nis_map(char *domain, enum nss_lookup_type how, char *buffer, size_t bufsize,
939    int *master)
940{
941	int	rv, order;
942
943	*master = 0;
944	if (geteuid() == 0) {
945		if (snprintf(buffer, bufsize, "master.passwd.by%s",
946		    (how == nss_lt_id) ? "uid" : "name") >= bufsize)
947			return (NS_UNAVAIL);
948		rv = yp_order(domain, buffer, &order);
949		if (rv == 0) {
950			*master = 1;
951			return (NS_SUCCESS);
952		}
953	}
954	if (snprintf(buffer, bufsize, "passwd.by%s",
955	    (how == nss_lt_id) ? "uid" : "name") >= bufsize)
956		return (NS_UNAVAIL);
957	rv = yp_order(domain, buffer, &order);
958	if (rv == 0)
959		return (NS_SUCCESS);
960	return (NS_UNAVAIL);
961}
962
963
964static int
965nis_adjunct(char *domain, const char *name, char *buffer, size_t bufsize)
966{
967	int	 rv;
968	char	*result, *p, *q, *eor;
969	int	 resultlen;
970
971	result = NULL;
972	rv = yp_match(domain, "passwd.adjunct.byname", name, strlen(name),
973	    &result, &resultlen);
974	if (rv != 0)
975		rv = 1;
976	else {
977		eor = &result[resultlen];
978		p = memchr(result, ':', eor - result);
979		if (p != NULL && ++p < eor &&
980		    (q = memchr(p, ':', eor - p)) != NULL) {
981			if (q - p >= bufsize)
982				rv = -1;
983			else {
984				memcpy(buffer, p, q - p);
985				buffer[q - p] ='\0';
986			}
987		} else
988			rv = 1;
989	}
990	free(result);
991	return (rv);
992}
993
994
995static int
996nis_setpwent(void *retval, void *mdata, va_list ap)
997{
998	struct nis_state	*st;
999	int			 rv;
1000
1001	rv = nis_getstate(&st);
1002	if (rv != 0)
1003		return (NS_UNAVAIL);
1004	st->done = 0;
1005	free(st->key);
1006	st->key = NULL;
1007	return (NS_UNAVAIL);
1008}
1009
1010
1011static int
1012nis_passwd(void *retval, void *mdata, va_list ap)
1013{
1014	char		 map[YPMAXMAP];
1015	struct nis_state *st;
1016	struct passwd	*pwd;
1017	const char	*name;
1018	char		*buffer, *key, *result;
1019	size_t		 bufsize;
1020	uid_t		 uid;
1021	enum nss_lookup_type how;
1022	int		*errnop, keylen, resultlen, rv, master;
1023
1024	name = NULL;
1025	uid = (uid_t)-1;
1026	how = (enum nss_lookup_type)mdata;
1027	switch (how) {
1028	case nss_lt_name:
1029		name = va_arg(ap, const char *);
1030		break;
1031	case nss_lt_id:
1032		uid = va_arg(ap, uid_t);
1033		break;
1034	case nss_lt_all:
1035		break;
1036	}
1037	pwd     = va_arg(ap, struct passwd *);
1038	buffer  = va_arg(ap, char *);
1039	bufsize = va_arg(ap, size_t);
1040	errnop  = va_arg(ap, int *);
1041	*errnop = nis_getstate(&st);
1042	if (*errnop != 0)
1043		return (NS_UNAVAIL);
1044	if (st->domain[0] == '\0') {
1045		if (getdomainname(st->domain, sizeof(st->domain)) != 0) {
1046			*errnop = errno;
1047			return (NS_UNAVAIL);
1048		}
1049	}
1050	rv = nis_map(st->domain, how, map, sizeof(map), &master);
1051	if (rv != NS_SUCCESS)
1052		return (rv);
1053	result = NULL;
1054	do {
1055		rv = NS_NOTFOUND;
1056		switch (how) {
1057		case nss_lt_name:
1058			if (strlcpy(buffer, name, bufsize) >= bufsize)
1059				goto erange;
1060			break;
1061		case nss_lt_id:
1062			if (snprintf(buffer, bufsize, "%lu",
1063			    (unsigned long)uid) >= bufsize)
1064				goto erange;
1065			break;
1066		case nss_lt_all:
1067			if (st->done)
1068				goto fin;
1069			break;
1070		}
1071		result = NULL;
1072		if (how == nss_lt_all) {
1073			if (st->key == NULL)
1074				rv = yp_first(st->domain, map, &st->key,
1075				    &st->keylen, &result, &resultlen);
1076			else {
1077				key = st->key;
1078				keylen = st->keylen;
1079				st->key = NULL;
1080				rv = yp_next(st->domain, map, key, keylen,
1081				    &st->key, &st->keylen, &result,
1082				    &resultlen);
1083				free(key);
1084			}
1085			if (rv != 0) {
1086				free(result);
1087				free(st->key);
1088				st->key = NULL;
1089				if (rv == YPERR_NOMORE)
1090					st->done = 1;
1091				else
1092					rv = NS_UNAVAIL;
1093				goto fin;
1094			}
1095		} else {
1096			rv = yp_match(st->domain, map, buffer, strlen(buffer),
1097			    &result, &resultlen);
1098			if (rv == YPERR_KEY) {
1099				rv = NS_NOTFOUND;
1100				continue;
1101			} else if (rv != 0) {
1102				free(result);
1103				rv = NS_UNAVAIL;
1104				continue;
1105			}
1106		}
1107		if (resultlen >= bufsize)
1108			goto erange;
1109		memcpy(buffer, result, resultlen);
1110		buffer[resultlen] = '\0';
1111		free(result);
1112		rv = __pw_match_entry(buffer, resultlen, how, name, uid);
1113		if (rv == NS_SUCCESS)
1114			rv = __pw_parse_entry(buffer, resultlen, pwd, master,
1115			    errnop);
1116	} while (how == nss_lt_all && !(rv & NS_TERMINATE));
1117fin:
1118	if (rv == NS_SUCCESS) {
1119		if (strstr(pwd->pw_passwd, "##") != NULL) {
1120			rv = nis_adjunct(st->domain, name,
1121			    &buffer[resultlen+1], bufsize-resultlen-1);
1122			if (rv < 0)
1123				goto erange;
1124			else if (rv == 0)
1125				pwd->pw_passwd = &buffer[resultlen+1];
1126		}
1127		pwd->pw_fields &= ~_PWF_SOURCE;
1128		pwd->pw_fields |= _PWF_NIS;
1129		if (retval != NULL)
1130			*(struct passwd **)retval = pwd;
1131	}
1132	return (rv);
1133erange:
1134	*errnop = ERANGE;
1135	return (NS_RETURN);
1136}
1137#endif /* YP */
1138
1139
1140/*
1141 * compat backend
1142 */
1143static void
1144compat_clear_template(struct passwd *template)
1145{
1146
1147	free(template->pw_passwd);
1148	free(template->pw_gecos);
1149	free(template->pw_dir);
1150	free(template->pw_shell);
1151	memset(template, 0, sizeof(*template));
1152}
1153
1154
1155static int
1156compat_set_template(struct passwd *src, struct passwd *template)
1157{
1158
1159	compat_clear_template(template);
1160#ifdef PW_OVERRIDE_PASSWD
1161	if ((src->pw_fields & _PWF_PASSWD) &&
1162	    (template->pw_passwd = strdup(src->pw_passwd)) == NULL)
1163		goto enomem;
1164#endif
1165	if (src->pw_fields & _PWF_UID)
1166		template->pw_uid = src->pw_uid;
1167	if (src->pw_fields & _PWF_GID)
1168		template->pw_gid = src->pw_gid;
1169	if ((src->pw_fields & _PWF_GECOS) &&
1170	    (template->pw_gecos = strdup(src->pw_gecos)) == NULL)
1171		goto enomem;
1172	if ((src->pw_fields & _PWF_DIR) &&
1173	    (template->pw_dir = strdup(src->pw_dir)) == NULL)
1174		goto enomem;
1175	if ((src->pw_fields & _PWF_SHELL) &&
1176	    (template->pw_shell = strdup(src->pw_shell)) == NULL)
1177		goto enomem;
1178	template->pw_fields = src->pw_fields;
1179	return (0);
1180enomem:
1181	syslog(LOG_ERR, "getpwent memory allocation failure");
1182	return (-1);
1183}
1184
1185
1186static int
1187compat_use_template(struct passwd *pwd, struct passwd *template, char *buffer,
1188    size_t bufsize)
1189{
1190	struct passwd hold;
1191	char	*copy, *p, *q, *eob;
1192	size_t	 n;
1193
1194	/* We cannot know the layout of the password fields in `buffer',
1195	 * so we have to copy everything.
1196	 */
1197	if (template->pw_fields == 0) /* nothing to fill-in */
1198		return (0);
1199	n = 0;
1200	n += pwd->pw_name != NULL ? strlen(pwd->pw_name) + 1 : 0;
1201	n += pwd->pw_passwd != NULL ? strlen(pwd->pw_passwd) + 1 : 0;
1202	n += pwd->pw_class != NULL ? strlen(pwd->pw_class) + 1 : 0;
1203	n += pwd->pw_gecos != NULL ? strlen(pwd->pw_gecos) + 1 : 0;
1204	n += pwd->pw_dir != NULL ? strlen(pwd->pw_dir) + 1 : 0;
1205	n += pwd->pw_shell != NULL ? strlen(pwd->pw_shell) + 1 : 0;
1206	copy = malloc(n);
1207	if (copy == NULL) {
1208		syslog(LOG_ERR, "getpwent memory allocation failure");
1209		return (ENOMEM);
1210	}
1211	p = copy;
1212	eob = &copy[n];
1213#define COPY(field) do {				\
1214	if (pwd->field == NULL)				\
1215		hold.field = NULL;			\
1216	else {						\
1217		hold.field = p;				\
1218		p += strlcpy(p, pwd->field, eob-p) + 1;	\
1219	}						\
1220} while (0)
1221	COPY(pw_name);
1222	COPY(pw_passwd);
1223	COPY(pw_class);
1224	COPY(pw_gecos);
1225	COPY(pw_dir);
1226	COPY(pw_shell);
1227#undef COPY
1228	p = buffer;
1229	eob = &buffer[bufsize];
1230#define COPY(field, flag) do {						 \
1231	q = (template->pw_fields & flag) ? template->field : hold.field; \
1232	if (q == NULL)							 \
1233		pwd->field = NULL;					 \
1234	else {								 \
1235		pwd->field = p;						 \
1236		if ((n = strlcpy(p, q, eob-p)) >= eob-p) {		 \
1237			free(copy);					 \
1238			return (ERANGE);				 \
1239		}							 \
1240		p += n + 1;						 \
1241	}								 \
1242} while (0)
1243	COPY(pw_name, 0);
1244#ifdef PW_OVERRIDE_PASSWD
1245	COPY(pw_passwd, _PWF_PASSWD);
1246#else
1247	COPY(pw_passwd, 0);
1248#endif
1249	COPY(pw_class, 0);
1250	COPY(pw_gecos, _PWF_GECOS);
1251	COPY(pw_dir, _PWF_DIR);
1252	COPY(pw_shell, _PWF_SHELL);
1253#undef COPY
1254#define COPY(field, flag) do {			\
1255	if (template->pw_fields & flag)		\
1256		pwd->field = template->field;	\
1257} while (0)
1258	COPY(pw_uid, _PWF_UID);
1259	COPY(pw_gid, _PWF_GID);
1260#undef COPY
1261	free(copy);
1262	return (0);
1263}
1264
1265
1266static int
1267compat_exclude(const char *name, DB **db)
1268{
1269	DBT	key, data;
1270
1271	if (*db == NULL &&
1272	    (*db = dbopen(NULL, O_RDWR, 600, DB_HASH, 0)) == NULL)
1273		return (errno);
1274	key.size = strlen(name);
1275	key.data = (char *)name;
1276	data.size = 0;
1277	data.data = NULL;
1278
1279	if ((*db)->put(*db, &key, &data, 0) == -1)
1280		return (errno);
1281	return (0);
1282}
1283
1284
1285static int
1286compat_is_excluded(const char *name, DB *db)
1287{
1288	DBT	key, data;
1289
1290	if (db == NULL)
1291		return (0);
1292	key.size = strlen(name);
1293	key.data = (char *)name;
1294	return (db->get(db, &key, &data, 0) == 0);
1295}
1296
1297
1298static int
1299compat_redispatch(struct compat_state *st, enum nss_lookup_type how,
1300    enum nss_lookup_type lookup_how, const char *name, const char *lookup_name,
1301    uid_t uid, struct passwd *pwd, char *buffer, size_t bufsize, int *errnop)
1302{
1303	static const ns_src compatsrc[] = {
1304#ifdef YP
1305		{ NSSRC_NIS, NS_SUCCESS },
1306#endif
1307		{ NULL, 0 }
1308	};
1309	ns_dtab dtab[] = {
1310#ifdef YP
1311		{ NSSRC_NIS, nis_passwd, NULL },
1312#endif
1313#ifdef HESIOD
1314		{ NSSRC_DNS, dns_passwd, NULL },
1315#endif
1316		{ NULL, NULL, NULL }
1317	};
1318	void		*discard;
1319	int		 rv, e, i;
1320
1321	for (i = 0; i < sizeof(dtab)/sizeof(dtab[0]) - 1; i++)
1322		dtab[i].mdata = (void *)lookup_how;
1323more:
1324	pwd_init(pwd);
1325	switch (lookup_how) {
1326	case nss_lt_all:
1327		rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1328		    "getpwent_r", compatsrc, pwd, buffer, bufsize,
1329		    errnop);
1330		break;
1331	case nss_lt_id:
1332		rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1333		    "getpwuid_r", compatsrc, uid, pwd, buffer,
1334		    bufsize, errnop);
1335		break;
1336	case nss_lt_name:
1337		rv = _nsdispatch(&discard, dtab, NSDB_PASSWD_COMPAT,
1338		    "getpwnam_r", compatsrc, lookup_name, pwd, buffer,
1339		    bufsize, errnop);
1340		break;
1341	default:
1342		return (NS_UNAVAIL);
1343	}
1344	if (rv != NS_SUCCESS)
1345		return (rv);
1346	if (compat_is_excluded(pwd->pw_name, st->exclude)) {
1347		if (how == nss_lt_all)
1348			goto more;
1349		return (NS_NOTFOUND);
1350	}
1351	e = compat_use_template(pwd, &st->template, buffer, bufsize);
1352	if (e != 0) {
1353		*errnop = e;
1354		if (e == ERANGE)
1355			return (NS_RETURN);
1356		else
1357			return (NS_UNAVAIL);
1358	}
1359	switch (how) {
1360	case nss_lt_name:
1361		if (strcmp(name, pwd->pw_name) != 0)
1362			return (NS_NOTFOUND);
1363		break;
1364	case nss_lt_id:
1365		if (uid != pwd->pw_uid)
1366			return (NS_NOTFOUND);
1367		break;
1368	default:
1369		break;
1370	}
1371	return (NS_SUCCESS);
1372}
1373
1374
1375static void
1376compat_endstate(void *p)
1377{
1378	struct compat_state *st;
1379
1380	if (p == NULL)
1381		return;
1382	st = (struct compat_state *)p;
1383	if (st->db != NULL)
1384		st->db->close(st->db);
1385	if (st->exclude != NULL)
1386		st->exclude->close(st->exclude);
1387	compat_clear_template(&st->template);
1388	free(p);
1389}
1390
1391
1392static int
1393compat_setpwent(void *retval, void *mdata, va_list ap)
1394{
1395	struct compat_state	*st;
1396	int			 rv, stayopen;
1397
1398	rv = compat_getstate(&st);
1399	if (rv != 0)
1400		return (NS_UNAVAIL);
1401	switch ((enum constants)mdata) {
1402	case SETPWENT:
1403		stayopen = va_arg(ap, int);
1404		st->keynum = 0;
1405		if (stayopen)
1406			st->db = pwdbopen(&st->version);
1407		st->stayopen = stayopen;
1408		break;
1409	case ENDPWENT:
1410		if (st->db != NULL) {
1411			(void)st->db->close(st->db);
1412			st->db = NULL;
1413		}
1414		break;
1415	default:
1416		break;
1417	}
1418	return (NS_UNAVAIL);
1419}
1420
1421
1422static int
1423compat_passwd(void *retval, void *mdata, va_list ap)
1424{
1425	char			 keybuf[MAXLOGNAME + 1];
1426	DBT			 key, entry;
1427	struct compat_state	*st;
1428	enum nss_lookup_type	 how;
1429	const char		*name;
1430	struct passwd		*pwd;
1431	char			*buffer, *pw_name;
1432	char			*host, *user, *domain;
1433	size_t			 bufsize;
1434	uid_t			 uid;
1435	uint32_t		 store;
1436	int			 rv, from_compat, stayopen, *errnop;
1437
1438	from_compat = 0;
1439	name = NULL;
1440	uid = (uid_t)-1;
1441	how = (enum nss_lookup_type)mdata;
1442	switch (how) {
1443	case nss_lt_name:
1444		name = va_arg(ap, const char *);
1445		break;
1446	case nss_lt_id:
1447		uid = va_arg(ap, uid_t);
1448		break;
1449	case nss_lt_all:
1450		break;
1451	default:
1452		rv = NS_NOTFOUND;
1453		goto fin;
1454	}
1455	pwd = va_arg(ap, struct passwd *);
1456	buffer = va_arg(ap, char *);
1457	bufsize = va_arg(ap, size_t);
1458	errnop = va_arg(ap, int *);
1459	*errnop = compat_getstate(&st);
1460	if (*errnop != 0)
1461		return (NS_UNAVAIL);
1462	if (how == nss_lt_all && st->keynum < 0) {
1463		rv = NS_NOTFOUND;
1464		goto fin;
1465	}
1466	if (st->db == NULL &&
1467	    (st->db = pwdbopen(&st->version)) == NULL) {
1468		*errnop = errno;
1469		rv = NS_UNAVAIL;
1470		goto fin;
1471	}
1472	if (how == nss_lt_all) {
1473		if (st->keynum < 0) {
1474			rv = NS_NOTFOUND;
1475			goto fin;
1476		}
1477		stayopen = 1;
1478	} else {
1479		st->keynum = 0;
1480		stayopen = st->stayopen;
1481	}
1482docompat:
1483	rv = NS_NOTFOUND;
1484	switch (st->compat) {
1485	case COMPAT_MODE_ALL:
1486		rv = compat_redispatch(st, how, how, name, name, uid, pwd,
1487		    buffer, bufsize, errnop);
1488		if (rv != NS_SUCCESS)
1489			st->compat = COMPAT_MODE_OFF;
1490		break;
1491	case COMPAT_MODE_NETGROUP:
1492		/* XXX getnetgrent is not thread-safe. */
1493		do {
1494			rv = getnetgrent(&host, &user, &domain);
1495			if (rv == 0) {
1496				endnetgrent();
1497				st->compat = COMPAT_MODE_OFF;
1498				rv = NS_NOTFOUND;
1499				continue;
1500			} else if (user == NULL || user[0] == '\0')
1501				continue;
1502			rv = compat_redispatch(st, how, nss_lt_name, name,
1503			    user, uid, pwd, buffer, bufsize, errnop);
1504		} while (st->compat == COMPAT_MODE_NETGROUP &&
1505		    !(rv & NS_TERMINATE));
1506		break;
1507	case COMPAT_MODE_NAME:
1508		rv = compat_redispatch(st, how, nss_lt_name, name, st->name,
1509		    uid, pwd, buffer, bufsize, errnop);
1510		free(st->name);
1511		st->name = NULL;
1512		st->compat = COMPAT_MODE_OFF;
1513		break;
1514	default:
1515		break;
1516	}
1517	if (rv & NS_TERMINATE) {
1518		from_compat = 1;
1519		goto fin;
1520	}
1521	key.data = keybuf;
1522	rv = NS_NOTFOUND;
1523	while (st->keynum >= 0) {
1524		st->keynum++;
1525		if (st->version < _PWD_CURRENT_VERSION) {
1526			memcpy(&keybuf[1], &st->keynum, sizeof(st->keynum));
1527			key.size = sizeof(st->keynum) + 1;
1528		} else {
1529			store = htonl(st->keynum);
1530			memcpy(&keybuf[1], &store, sizeof(store));
1531			key.size = sizeof(store) + 1;
1532		}
1533		keybuf[0] = _PW_VERSIONED(_PW_KEYBYNUM, st->version);
1534		rv = st->db->get(st->db, &key, &entry, 0);
1535		if (rv < 0 || rv > 1) { /* should never return > 1 */
1536			*errnop = errno;
1537			rv = NS_UNAVAIL;
1538			goto fin;
1539		} else if (rv == 1) {
1540			st->keynum = -1;
1541			rv = NS_NOTFOUND;
1542			goto fin;
1543		}
1544		pw_name = (char *)entry.data;
1545		switch (pw_name[0]) {
1546		case '+':
1547			switch (pw_name[1]) {
1548			case '\0':
1549				st->compat = COMPAT_MODE_ALL;
1550				break;
1551			case '@':
1552				setnetgrent(&pw_name[2]);
1553				st->compat = COMPAT_MODE_NETGROUP;
1554				break;
1555			default:
1556				st->name = strdup(&pw_name[1]);
1557				if (st->name == NULL) {
1558					syslog(LOG_ERR,
1559					 "getpwent memory allocation failure");
1560					*errnop = ENOMEM;
1561					rv = NS_UNAVAIL;
1562					break;
1563				}
1564				st->compat = COMPAT_MODE_NAME;
1565			}
1566			if (entry.size > bufsize) {
1567				*errnop = ERANGE;
1568				rv = NS_RETURN;
1569				goto fin;
1570			}
1571			memcpy(buffer, entry.data, entry.size);
1572			rv = pwdb_versions[st->version].parse(buffer,
1573			    entry.size, pwd, errnop);
1574			if (rv != NS_SUCCESS)
1575				;
1576			else if (compat_set_template(pwd, &st->template) < 0) {
1577				*errnop = ENOMEM;
1578				rv = NS_UNAVAIL;
1579				goto fin;
1580			}
1581			goto docompat;
1582		case '-':
1583			switch (pw_name[1]) {
1584			case '\0':
1585				/* XXX Maybe syslog warning */
1586				continue;
1587			case '@':
1588				setnetgrent(&pw_name[2]);
1589				while (getnetgrent(&host, &user, &domain) !=
1590				    NULL) {
1591					if (user != NULL && user[0] != '\0')
1592						compat_exclude(user,
1593						    &st->exclude);
1594				}
1595				endnetgrent();
1596				continue;
1597			default:
1598				compat_exclude(&pw_name[1], &st->exclude);
1599				continue;
1600			}
1601			break;
1602		default:
1603			break;
1604		}
1605		if (compat_is_excluded((char *)entry.data, st->exclude))
1606			continue;
1607		rv = pwdb_versions[st->version].match(entry.data, entry.size,
1608		    how, name, uid);
1609		if (rv == NS_RETURN)
1610			break;
1611		else if (rv != NS_SUCCESS)
1612			continue;
1613		if (entry.size > bufsize) {
1614			*errnop = ERANGE;
1615			rv = NS_RETURN;
1616			break;
1617		}
1618		memcpy(buffer, entry.data, entry.size);
1619		rv = pwdb_versions[st->version].parse(buffer, entry.size, pwd,
1620		    errnop);
1621		if (rv & NS_TERMINATE)
1622			break;
1623	}
1624fin:
1625	if (!stayopen && st->db != NULL) {
1626		(void)st->db->close(st->db);
1627		st->db = NULL;
1628	}
1629	if (rv == NS_SUCCESS) {
1630		if (!from_compat) {
1631			pwd->pw_fields &= ~_PWF_SOURCE;
1632			pwd->pw_fields |= _PWF_FILES;
1633		}
1634		if (retval != NULL)
1635			*(struct passwd **)retval = pwd;
1636	}
1637	return (rv);
1638}
1639
1640
1641/*
1642 * common passwd line matching and parsing
1643 */
1644int
1645__pw_match_entry(const char *entry, size_t entrysize, enum nss_lookup_type how,
1646    const char *name, uid_t uid)
1647{
1648	const char	*p, *eom;
1649	char		*q;
1650	size_t		 len;
1651	unsigned long	 m;
1652
1653	eom = entry + entrysize;
1654	for (p = entry; p < eom; p++)
1655		if (*p == ':')
1656			break;
1657	if (*p != ':')
1658		return (NS_NOTFOUND);
1659	if (how == nss_lt_all)
1660		return (NS_SUCCESS);
1661	if (how == nss_lt_name) {
1662		len = strlen(name);
1663		if (len == (p - entry) && memcmp(name, entry, len) == 0)
1664			return (NS_SUCCESS);
1665		else
1666			return (NS_NOTFOUND);
1667	}
1668	for (p++; p < eom; p++)
1669		if (*p == ':')
1670			break;
1671	if (*p != ':')
1672		return (NS_NOTFOUND);
1673	m = strtoul(++p, &q, 10);
1674	if (q[0] != ':' || (uid_t)m != uid)
1675		return (NS_NOTFOUND);
1676	else
1677		return (NS_SUCCESS);
1678}
1679
1680
1681/* XXX buffer must be NUL-terminated.  errnop is not set correctly. */
1682int
1683__pw_parse_entry(char *buffer, size_t bufsize __unused, struct passwd *pwd,
1684    int master, int *errnop __unused)
1685{
1686
1687	if (__pw_scan(buffer, pwd, master ? _PWSCAN_MASTER : 0) == 0)
1688		return (NS_NOTFOUND);
1689	else
1690		return (NS_SUCCESS);
1691}
1692