nss: Fix invalid enum nss_status return values. The upstream glibc test nss/bug17079 covers several cases where the NSS infrastructure passes invalid pointers to NSS plugins. The plugins should return correct results for the invalid values e.g. ERANGE, but it should do so by setting *errnop to the error and returning NSS_STATUS_TRYAGAIN. This commit fixes the group, netgroup, passwd and service handling code to correctly return ERANGE in *errnop and NSS_TATUS_TRYAGAIN in the case of invalid buffer (NULL) or zero sized buffer length. This fixes the nss/bug17079 regression test when run in a test configuration with sss enabled for any of the above mentioned services. Upstream glibc bug: Bug 22530 - FAIL: nss/bug17079 due to _nss_sss_getpwuid_r https://sourceware.org/bugzilla/show_bug.cgi?id=22530 Merges: https://pagure.io/SSSD/sssd/pull-request/3561 Signed-off-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Florian Weimer <fweimer@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

sss_client: Use SAFEALIGN_COPY_<type> macros where appropriate. resolves: https://fedorahosted.org/sssd/ticket/1359

NSS: Add sss_readrep_copy_string There were many places in the client code where we were duplicating a loop to copy data in from the response buffer. This patch turns those loops into a function for easier maintenance and easier-to-read *readrep() routines.

NSS: Validate input string lengths Also fixes a return value bug where we were returning errno error codes instead of nss_status codes. Fixes https://fedorahosted.org/sssd/ticket/1135

sss_client: make code thread-safe Add mutexes around nss operations and serialize them. This is necessary because nss operations may have global state. For pam it is sufficient to protect socket operations instead. As pam functions use only the provided pam handler. Fixes: https://fedorahosted.org/sssd/ticket/640

Avoid a global variable in netgroup client. The structure which is used to store the result also provides elements to store a context for the netgroup enumeration call.

Add handling of nested netgroups to nss client

Return NSS_STATUS_RETURN instead of NSS_STATUS_NOTFOUND NSS_STATUS_RETURN needs to be returned to glibc otherwise nested groups are not resolved by glibc.

Add support for netgroups to NSS sss_client