ldap/common/getnetgrent.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */


#include <syslog.h>
#include "ldap_common.h"

/* netgroup attributes filters */
#define _N_TRIPLE       "nisnetgrouptriple"
#define _N_MEMBER       "membernisnetgroup"

#define PRINT_VAL(a)        (((a).argc == 0) || ((a).argv == NULL) || \
                    ((a).argv[0] == NULL)) ? "*" : (a).argv[0]
#define ISNULL(a)       (a == NULL ? "<NULL>" : a)
#define MAX_DOMAIN_LEN      1024
#define MAX_TRIPLE_LEN      (MAXHOSTNAMELEN + LOGNAME_MAX + \
                    MAX_DOMAIN_LEN + 5)

#define _F_SETMEMBER        "(&(objectClass=nisNetGroup)(cn=%s))"
#define _F_SETMEMBER_SSD    "(&(%%s)(cn=%s))"

#define N_HASH      257
#define COMMA       ','

static const char *netgrent_attrs[] = {
    _N_TRIPLE,
    _N_MEMBER,
    (char *)NULL
};

typedef struct netgroup_name {
    char *name;
    struct netgroup_name *next;
    struct netgroup_name *next_hash;
} netgroup_name_t;

typedef struct {
    netgroup_name_t *hash_list[N_HASH];
    netgroup_name_t *to_do;
    netgroup_name_t *done;
} netgroup_table_t;

typedef struct {
    ns_ldap_result_t *results;
    ns_ldap_entry_t *entry;
    char **attrs;
    char *netgroup;
    netgroup_table_t tab;
} getnetgrent_cookie_t;

typedef struct {
    struct nss_innetgr_args *ia;
    const char *ssd_filter;
    const char *netgrname;
    const char *membername;
    netgroup_table_t tab;
} innetgr_cookie_t;

typedef unsigned int hash_t;

static hash_t
get_hash(const char *s)
{
    unsigned int sum = 0;
    unsigned int i;

    for (i = 0; s[i] != '\0'; i++)
        sum += ((unsigned char *)s)[i];

    return ((sum + i) % N_HASH);
}

/*
 * Adds a name to the netgroup table
 *
 * Returns
 *  0 if successfully added or already present
 *  -1 if memory allocation error or NULL netgroup_table_t
 *         from caller.
 */

static int
add_netgroup_name(const char *name, netgroup_table_t *tab)
{
    hash_t      h;
    netgroup_name_t *ng;
    netgroup_name_t *ng_new;

    if (tab == NULL) {
        /*
         * Should never happen. But if it does,
         * that's an error condition.
         */
        return (-1);
    }
    if (name == NULL || *name == '\0') {
        /* no name to add means success */
        return (0);
    }

    h = get_hash(name);
    ng = tab->hash_list[h];

    while (ng != NULL) {
        if (strcmp(name, ng->name) == 0)
            break;
        ng = ng->next_hash;
    }

    if (ng == NULL) {
        ng_new = (netgroup_name_t *)
            calloc(1, sizeof (netgroup_name_t));
        if (ng_new == NULL)
            return (-1);
        ng_new->name = strdup(name);
        if (ng_new->name == NULL) {
            free(ng_new);
            return (-1);
        }
        ng_new->next_hash = tab->hash_list[h];
        tab->hash_list[h] = ng_new;
        ng_new->next = tab->to_do;
        tab->to_do = ng_new;
    }
    return (0);
}

static netgroup_name_t *
get_next_netgroup(netgroup_table_t *tab)
{
    netgroup_name_t *ng;

    if (tab == NULL)
        return (NULL);

    ng = tab->to_do;
    if (ng != NULL) {
        tab->to_do = ng->next;
        ng->next = tab->done;
        tab->done = ng;
    }
    return (ng);
}

static void
free_netgroup_table(netgroup_table_t *tab)
{
    netgroup_name_t *ng, *next;

    if (tab == NULL)
        return;

    for (ng = tab->to_do; ng != NULL; ng = next) {
        if (ng->name != NULL)
            free(ng->name);
        next = ng->next;
        free(ng);
    }

    for (ng = tab->done; ng != NULL; ng = next) {
        if (ng->name != NULL)
            free(ng->name);
        next = ng->next;
        free(ng);
    }
    (void) memset(tab, 0, sizeof (*tab));
}

/*
 * domain comparing routine
 *  n1: See if n1 is n2 or an ancestor of it
 *  n2: (in string terms, n1 is a suffix of n2)
 * Returns ZERO for success, -1 for failure.
 */
static int
domcmp(const char *n1, const char *n2)
{
#define PASS    0
#define FAIL    -1

    size_t      l1, l2;

    if ((n1 == NULL) || (n2 == NULL))
        return (FAIL);

    l1 = strlen(n1);
    l2 = strlen(n2);

    /* Turn a blind eye to the presence or absence of trailing periods */
    if (l1 != 0 && n1[l1 - 1] == '.') {
        --l1;
    }
    if (l2 != 0 && n2[l2 - 1] == '.') {
        --l2;
    }
    if (l1 > l2) {      /* Can't be a suffix */
        return (FAIL);
    } else if (l1 == 0) {   /* Trivially a suffix; */
                /* (do we want this case?) */
        return (PASS);
    }
    /* So 0 < l1 <= l2 */
    if (l1 < l2 && n2[l2 - l1 - 1] != '.') {
        return (FAIL);
    }
    if (strncasecmp(n1, &n2[l2 - l1], l1) == 0) {
        return (PASS);
    } else {
        return (FAIL);
    }
}

static int
split_triple(char *triple, char **hostname, char **username, char **domain)
{
    int i, syntax_err;
    char    *splittriple[3];
    char    *p = triple;

#ifdef  DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: split_triple]\n");
#endif  /* DEBUG */

    if (triple == NULL)
        return (-1);

    p++;
    syntax_err = 0;
    for (i = 0; i < 3; i++) {
        char    *start;
        char    *limit;
        const char  *terminators = ",) \t";

        if (i == 2) {
            /* Don't allow comma */
            terminators++;
        }
        while (isspace(*p)) {
            p++;
        }
        start = p;
        limit = strpbrk(start, terminators);
        if (limit == 0) {
            syntax_err++;
            break;
        }
        p = limit;
        while (isspace(*p)) {
            p++;
        }
        if (*p == terminators[0]) {
            /*
             * Successfully parsed this name and
             * the separator after it (comma or
             * right paren); leave p ready for
             * next parse.
             */
            p++;
            if (start == limit) {
                /* Wildcard */
                splittriple[i] = NULL;
            } else {
                *limit = '\0';
                splittriple[i] = start;
            }
        } else {
            syntax_err++;
            break;
        }
    }

    if (syntax_err != 0)
        return (-1);

    *hostname = splittriple[0];
    *username = splittriple[1];
    *domain = splittriple[2];

    return (0);
}

/*
 * Test membership in triple
 *  return 0 = no match
 *  return 1 = match
 */

static int
match_triple_entry(struct nss_innetgr_args *ia, const ns_ldap_entry_t *entry)
{
    int ndomains;
    char    **pdomains;
    int nhost;
    char    **phost;
    int nusers;
    char    **pusers;
    char    **attr;
    char    triple[MAX_TRIPLE_LEN];
    char    *tuser, *thost, *tdomain;
    int i;
    char    *current, *limit;
    int pulen, phlen;
    char    *pusers0, *phost0;

    nhost = ia->arg[NSS_NETGR_MACHINE].argc;
    phost = (char **)ia->arg[NSS_NETGR_MACHINE].argv;
    if (phost == NULL || *phost == NULL) {
        nhost = 0;
    } else {
        phost0 = phost[0];
        phlen = strlen(phost0);
#ifdef DEBUG
        syslog(LOG_DEBUG, "nss_ldap: match_triple_entry: "
            "entering with host: %s", phost0 ? phost0 : "");
#endif
    }
    nusers = ia->arg[NSS_NETGR_USER].argc;
    pusers = (char **)ia->arg[NSS_NETGR_USER].argv;
    if (pusers == NULL || *pusers == NULL) {
        nusers = 0;
    } else {
        pusers0 = pusers[0];
        pulen = strlen(pusers0);
#ifdef DEBUG
        syslog(LOG_DEBUG, "nss_ldap: match_triple_entry: "
            "entering with user: %s", pusers0 ? pusers0 : "");
#endif
    }
    ndomains = ia->arg[NSS_NETGR_DOMAIN].argc;
    pdomains = (char **)ia->arg[NSS_NETGR_DOMAIN].argv;
    if (pdomains == NULL || *pdomains == NULL)
        ndomains = 0;
#ifdef DEBUG
    else
        syslog(LOG_DEBUG, "nss_ldap: match_triple_entry: "
            "entering with domain: %s", pdomains[0] ? pdomains[0] : "");
#endif

    attr = __ns_ldap_getAttr(entry, _N_TRIPLE);
    if (attr == NULL || *attr == NULL)
        return (0);

#ifdef DEBUG
    syslog(LOG_DEBUG, "nss_ldap: match_triple_entry: "
        "(nusers: %d, nhost:%d, ndomains: %d)",
        nusers, nhost, ndomains);
#endif

    /* Special cases for speedup */
    if (nusers == 1 && nhost == 0 && ndomains == 0) {
        /* Special case for finding a single user in a netgroup */
        for (; *attr; attr++) {
            /* jump to first comma and check next character */
            current = *attr;
#ifdef DEBUG
            syslog(LOG_DEBUG, "nss_ldap: match_triple_entry: "
                "current is: %s", current);
#endif
            if ((current = strchr(current, COMMA)) == NULL)
                continue;
            current++;

            /* skip whitespaces */
            while (isspace(*current))
                current++;

            /* if user part is null, then treat as wildcard */
            if (*current == COMMA)
                return (1);

            /* compare first character */
            if (*pusers0 != *current)
                continue;

            /* limit username to COMMA */
            if ((limit = strchr(current, COMMA)) == NULL)
                continue;
            *limit = '\0';

            /* remove blanks before COMMA */
            if ((limit = strpbrk(current, " \t")) != NULL)
                *limit = '\0';

            /* compare size of username */
            if (pulen != strlen(current)) {
                continue;
            }

            /* do actual compare */
            if (strncmp(pusers0, current, pulen) == 0) {
                return (1);
            } else {
                continue;
            }
        }
    } else if (nusers == 0 && nhost == 1 && ndomains == 0) {
        /* Special case for finding a single host in a netgroup */
        for (; *attr; attr++) {

            /* jump to first character and check */
            current = *attr;
#ifdef DEBUG
            syslog(LOG_DEBUG, "nss_ldap: match_triple_entry: "
                "current is: %s", current);
#endif
            current++;

            /* skip whitespaces */
            while (isspace(*current))
                current++;

            /* if host part is null, then treat as wildcard */
            if (*current == COMMA)
                return (1);

            /* limit hostname to COMMA */
            if ((limit = strchr(current, COMMA)) == NULL)
                continue;
            *limit = '\0';

            /* remove blanks before COMMA */
            if ((limit = strpbrk(current, " \t")) != NULL)
                *limit = '\0';

            /* compare size of hostname */
            if (phlen != strlen(current)) {
                continue;
            }

            /* do actual compare */
            if (strncasecmp(phost0, current, phlen) == 0) {
                return (1);
            } else {
                continue;
            }
        }
    } else {
        for (; *attr; attr++) {
            if (strlcpy(triple, *attr,
                sizeof (triple)) >= sizeof (triple))
                continue;
#ifdef DEBUG
            syslog(LOG_DEBUG, "nss_ldap: match_triple_entry: "
                "triple is: %s", triple);
#endif
            if (split_triple(triple, &thost, &tuser, &tdomain) != 0)
                continue;
            if (thost != NULL && *thost != '\0' && nhost != 0) {
                for (i = 0; i < nhost; i++)
                    if (strcasecmp(thost, phost[i]) == 0)
                        break;
                if (i == nhost)
                    continue;
            }
            if (tuser != NULL && *tuser != '\0' && nusers != 0) {
                for (i = 0; i < nusers; i++)
                    if (strcmp(tuser, pusers[i]) == 0)
                        break;
                if (i == nusers)
                    continue;
            }
            if (tdomain != NULL && *tdomain != '\0' &&
                ndomains != 0) {
                for (i = 0; i < ndomains; i++)
                    if (domcmp(tdomain, pdomains[i]) == 0)
                        break;
                if (i == ndomains)
                    continue;
            }
            return (1);
        }
    }

    return (0);
}

static int
match_triple(struct nss_innetgr_args *ia, ns_ldap_result_t *result)
{
    ns_ldap_entry_t *entry;

    for (entry = result->entry; entry != NULL; entry = entry->next)
        if (match_triple_entry(ia, entry) == 1)
            return (1);

    return (0);
}

static int
add_netgroup_member_entry(ns_ldap_entry_t *entry, netgroup_table_t *tab)
{
    char        **attrs;
    char        **a;

    attrs = __ns_ldap_getAttr(entry, _N_MEMBER);
    if (attrs == NULL || *attrs == NULL)
        return (0);

    for (a = attrs; *a != NULL; a++) {}

    do {
        a--;
        if (add_netgroup_name(*a, tab) != 0)
            return (-1);
    } while (a > attrs);
    return (0);
}

static int
add_netgroup_member(ns_ldap_result_t *result, netgroup_table_t *tab)
{
    ns_ldap_entry_t *entry;
    int     ret = 0;

    for (entry = result->entry; entry != NULL; entry = entry->next) {
        ret = add_netgroup_member_entry(entry, tab);
        if (ret != 0)
            break;
    }
    return (ret);
}

/*
 * top_down_search checks only checks the netgroup specified in netgrname
 */
static nss_status_t
top_down_search(struct nss_innetgr_args *ia, char *netgrname)
{
    char            searchfilter[SEARCHFILTERLEN];
    char            name[SEARCHFILTERLEN];
    char            userdata[SEARCHFILTERLEN];
    ns_ldap_result_t    *result = NULL;
    ns_ldap_error_t     *error = NULL;
    int         rc;
    nss_status_t        status = NSS_NOTFOUND;
    nss_status_t        status1;
    netgroup_table_t    tab;
    netgroup_name_t     *ng;
    int         ret;

    (void) memset(&tab, 0, sizeof (tab));

    if (add_netgroup_name(netgrname, &tab) != 0)
        return ((nss_status_t)NSS_NOTFOUND);

    while ((ng = get_next_netgroup(&tab)) != NULL) {
#ifdef DEBUG
        syslog(LOG_DEBUG, "nss_ldap: top_down_search: netgroup  loop "
            "(ng->name: %s)", ng->name ? ng->name : "null !");
#endif
        if (_ldap_filter_name(name, ng->name, sizeof (name)) != 0)
            break;
        ret = snprintf(searchfilter, sizeof (searchfilter),
            _F_SETMEMBER, name);
        if (ret >= sizeof (searchfilter) || ret < 0)
            break;

        ret = snprintf(userdata, sizeof (userdata), _F_SETMEMBER_SSD,
            name);
        if (ret >= sizeof (userdata) || ret < 0)
            break;

        /* searching for current netgroup name entry */
        rc = __ns_ldap_list(_NETGROUP, searchfilter,
            _merge_SSD_filter, netgrent_attrs, NULL, 0, &result,
            &error, NULL, userdata);

        if (error != NULL) {
            status1 = switch_err(rc, error);
            if (status1 == NSS_TRYAGAIN) {
                (void) __ns_ldap_freeError(&error);
                free_netgroup_table(&tab);
                return (status1);
            }
        }

        (void) __ns_ldap_freeError(&error);
        if (rc == NS_LDAP_SUCCESS) {
            if (match_triple(ia, result) == 1) {
                /* We found a match */
                ia->status = NSS_NETGR_FOUND;
                status = NSS_SUCCESS;
#ifdef DEBUG
                syslog(LOG_DEBUG, "nss_ldap: top_down_search: "
                    "found match");
#endif
                break;
            }

            /*
             * No match found. Check for membernisnetgroup
             * in result and if yes, start again with those.
             */
            rc = add_netgroup_member(result, &tab);
            if (rc != 0)
                break;
        } else if (rc != NS_LDAP_NOTFOUND) {
            break;
        }
        (void) __ns_ldap_freeResult(&result);
    }

    (void) __ns_ldap_freeResult(&result);
    free_netgroup_table(&tab);
    return (status);
}

/*
 * __netgr_in checks only checks the netgroup specified in ngroup
 */
static nss_status_t
__netgr_in(void *a, char *netgrname)
{
    struct nss_innetgr_args *ia = (struct nss_innetgr_args *)a;
    nss_status_t        status = NSS_NOTFOUND;

#ifdef DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: netgr_in]\n");
    (void) fprintf(stdout, "\tmachine: argc[%d]='%s' user: "
        "argc[%d]='%s',\n\tdomain:argc[%d]='%s' "
        "netgroup: argc[%d]='%s'\n",
        NSS_NETGR_MACHINE,
        PRINT_VAL(ia->arg[NSS_NETGR_MACHINE]),
        NSS_NETGR_USER,
        PRINT_VAL(ia->arg[NSS_NETGR_USER]),
        NSS_NETGR_DOMAIN,
        PRINT_VAL(ia->arg[NSS_NETGR_DOMAIN]),
        NSS_NETGR_N,
        PRINT_VAL(ia->arg[NSS_NETGR_N]));
    (void) fprintf(stdout, "\tgroups='%s'\n", netgrname);
#endif  /* DEBUG */

    ia->status = NSS_NETGR_NO;

    if (netgrname == NULL)
        return (status);

    return (top_down_search(ia, netgrname));
}

/*ARGSUSED0*/
static nss_status_t
netgr_in(ldap_backend_ptr be, void *a)
{
    struct nss_innetgr_args *ia = (struct nss_innetgr_args *)a;
    int i;
    nss_status_t    rc = (nss_status_t)NSS_NOTFOUND;

    ia->status = NSS_NETGR_NO;
    for (i = 0; i < ia->groups.argc; i++) {
        rc = __netgr_in(a, ia->groups.argv[i]);
        if (ia->status == NSS_NETGR_FOUND)
            return (NSS_SUCCESS);
    }
    return (rc);
}

/*
 *
 */

static nss_status_t
getnetgr_ldap_setent(ldap_backend_ptr be, void *a)
{
    const char  *netgroup = (const char *) a;
    getnetgrent_cookie_t    *cookie;

#ifdef  DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: getnetgr_ldap_setent]\n");
#endif  /* DEBUG */

    cookie = (getnetgrent_cookie_t *)be->netgroup_cookie;
    if (cookie != NULL && cookie->netgroup != NULL) {
        /* is this another set on the same netgroup */
        if (strcmp(cookie->netgroup, netgroup) == 0)
            return ((nss_status_t)NSS_SUCCESS);
    }

    return (NSS_NOTFOUND);
}

static void
free_getnetgrent_cookie(getnetgrent_cookie_t **cookie)
{
    getnetgrent_cookie_t *p = *cookie;

#ifdef DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: free_getnetgrent_cookie]\n");
#endif  /* DEBUG */

    if (p == NULL)
        return;

    (void) __ns_ldap_freeResult(&p->results);
    free_netgroup_table(&p->tab);
    free(p->netgroup);
    free(p);
    *cookie = NULL;
}

/*ARGSUSED1*/
static nss_status_t
getnetgr_ldap_endent(ldap_backend_ptr be, void *a)
{

#ifdef  DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: getnetgr_ldap_endent]\n");
#endif  /* DEBUG */

    free_getnetgrent_cookie((getnetgrent_cookie_t **)&be->netgroup_cookie);

    return ((nss_status_t)NSS_NOTFOUND);
}


/*ARGSUSED1*/
static nss_status_t
getnetgr_ldap_destr(ldap_backend_ptr be, void *a)
{

#ifdef  DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: getnetgr_ldap_destr]\n");
#endif  /* DEBUG */

    free_getnetgrent_cookie((getnetgrent_cookie_t **)&be->netgroup_cookie);
    free(be);

    return ((nss_status_t)NSS_NOTFOUND);
}


static nss_status_t
getnetgr_ldap_getent(ldap_backend_ptr be, void *a)
{
    struct nss_getnetgrent_args *args;
    getnetgrent_cookie_t    *p;
    char            searchfilter[SEARCHFILTERLEN];
    char            userdata[SEARCHFILTERLEN];
    char            name[SEARCHFILTERLEN];
    int         rc;
    ns_ldap_result_t    *result = NULL;
    ns_ldap_error_t     *error = NULL;
    char            **attrs;
    char            *hostname, *username, *domain;
    char            *buffer;
    nss_status_t        status = NSS_SUCCESS;
    netgroup_name_t     *ng;
    int         ret;

#ifdef  DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: getnetgr_ldap_getent]\n");
#endif  /* DEBUG */

    args = (struct nss_getnetgrent_args *)a;

    args->status = NSS_NETGR_NO;

    p = (getnetgrent_cookie_t *)be->netgroup_cookie;
    if (p == NULL)
        return ((nss_status_t)NSS_SUCCESS);

    for (;;) {
        /*
         * Search through each netgroup consecutively: only search
         * next netgroup when results from previous netgroup are
         * processed.
         * Needed for nested netgroup (memberNisNetgroup attributes).
         */
        if (p->results == NULL) {
            if ((ng = get_next_netgroup(&p->tab)) != NULL) {
                if (_ldap_filter_name(name, ng->name,
                    sizeof (name)) != 0)
                    break;

                ret = snprintf(searchfilter,
                    sizeof (searchfilter),
                    _F_SETMEMBER, name);
                if (ret >= sizeof (searchfilter) || ret < 0)
                    break;

#ifdef DEBUG
                syslog(LOG_DEBUG, "nss_ldap: "
                    "getnetgr_ldap_getent: "
                    "netgroup name: %s", name);
#endif
                ret = snprintf(userdata, sizeof (userdata),
                    _F_SETMEMBER_SSD, name);
                if (ret >= sizeof (userdata) || ret < 0)
                    break;

                result = NULL;
                rc = __ns_ldap_list(_NETGROUP, searchfilter,
                    _merge_SSD_filter, netgrent_attrs, NULL,
                    0, &result, &error, NULL, userdata);
                (void) __ns_ldap_freeError(&error);

                if (rc == NS_LDAP_SUCCESS && result != NULL) {
                    p->results = result;
                } else {
#ifdef DEBUG
                    syslog(LOG_DEBUG, "nss_ldap: "
                        "getnetgr_ldap_getent: "
                        "__ns_ldap_list() returned %d "
                        "(result: 0x%x)", rc, result);
#endif
                    /*
                     * Will exit when no more netgroup
                     * to search and no more p->results
                     * to process.
                     */
                    (void) __ns_ldap_freeResult(&result);
                }
            } else { /* no more netgroup to process */
                /*
                 * If no more results to process, and since
                 * there's no more netgroup to process either,
                 * then it's time to break and exit the for
                 * loop.
                 */
#ifdef DEBUG
                syslog(LOG_DEBUG, "nss_ldap: "
                    "getnetgr_ldap_getent: no more netgroup "
                    "to process, p->results: 0x%x",
                    p->results);
#endif
                if (p->results == NULL)
                    break;
            }
        }
        if (p->results == NULL)
            continue;

        if (p->entry == NULL)
            p->entry = p->results->entry;

        if (p->entry == NULL)
            continue;

        if (p->attrs == NULL) {
            attrs = __ns_ldap_getAttr(p->entry, _N_TRIPLE);
            if (attrs != NULL && *attrs != NULL)
                p->attrs = attrs;
        }

        if (p->attrs != NULL) {
            attrs = p->attrs;
            buffer = args->buffer;

            if (strlcpy(buffer, *attrs, args->buflen) >=
                args->buflen) {
                status = NSS_STR_PARSE_ERANGE;
                break;
            }

            rc = split_triple(buffer, &hostname, &username,
                &domain);
            attrs++;
            if (attrs != NULL && *attrs != NULL)
                p->attrs = attrs;
            else
                p->attrs = NULL;
            if (rc == 0) {
                args->retp[NSS_NETGR_MACHINE] = hostname;
                args->retp[NSS_NETGR_USER] = username;
                args->retp[NSS_NETGR_DOMAIN] = domain;
                args->status = NSS_NETGR_FOUND;
#ifdef DEBUG
                syslog(LOG_DEBUG, "nss_ldap: "
                    "getnetgr_ldap_getent: found triple "
                    "(%s, %s, %s), 0x%x to process",
                    hostname ? hostname : "",
                    username ? username : "",
                    domain ? domain : "",
                    p->attrs);
#endif
                if (p->attrs != NULL)
                    break;
            }
        }

        if (p->attrs == NULL) {
            rc = add_netgroup_member_entry(p->entry, &p->tab);
            if (rc != 0) {
                args->status = NSS_NETGR_NO;
                break;
            }

            p->entry = p->entry->next;
            if (p->entry == NULL)
                (void) __ns_ldap_freeResult(&p->results);
            if (args->status == NSS_NETGR_FOUND)
                break;
        }
    }

    return (status);
}

static ldap_backend_op_t getnetgroup_ops[] = {
    getnetgr_ldap_destr,
    getnetgr_ldap_endent,
    getnetgr_ldap_setent,
    getnetgr_ldap_getent,
};

/*
 *
 */

static nss_status_t
netgr_set(ldap_backend_ptr be, void *a)
{
    struct nss_setnetgrent_args *args =
        (struct nss_setnetgrent_args *)a;
    ldap_backend_ptr        get_be;
    getnetgrent_cookie_t        *p;

#ifdef DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: netgr_set]\n");
    (void) fprintf(stdout,
        "\targs->netgroup: %s\n", ISNULL(args->netgroup));
#endif /* DEBUG */

    if (args->netgroup == NULL)
        return ((nss_status_t)NSS_NOTFOUND);

    free_getnetgrent_cookie((getnetgrent_cookie_t **)&be->netgroup_cookie);
    p = (getnetgrent_cookie_t *)calloc(1, sizeof (getnetgrent_cookie_t));
    if (p == NULL)
        return ((nss_status_t)NSS_NOTFOUND);
    p->netgroup = strdup(args->netgroup);
    if (p->netgroup == NULL) {
        free(p);
        return ((nss_status_t)NSS_NOTFOUND);
    }
    if (add_netgroup_name(args->netgroup, &p->tab) == -1) {
        free_getnetgrent_cookie(&p);
        return ((nss_status_t)NSS_NOTFOUND);
    }

    /* now allocate and return iteration backend structure */
    if ((get_be = (ldap_backend_ptr)malloc(sizeof (*get_be))) == NULL)
        return (NSS_UNAVAIL);
    get_be->ops = getnetgroup_ops;
    get_be->nops = sizeof (getnetgroup_ops) / sizeof (getnetgroup_ops[0]);
    get_be->tablename = NULL;
    get_be->attrs = netgrent_attrs;
    get_be->result = NULL;
    get_be->ldapobj2str = NULL;
    get_be->setcalled = 1;
    get_be->filter = NULL;
    get_be->toglue = NULL;
    get_be->enumcookie = NULL;
    get_be->netgroup_cookie = p;
    args->iterator = (nss_backend_t *)get_be;

    (void) __ns_ldap_freeResult(&be->result);

    return (NSS_SUCCESS);
}


/*ARGSUSED1*/
static nss_status_t
netgr_ldap_destr(ldap_backend_ptr be, void *a)
{

#ifdef  DEBUG
    (void) fprintf(stdout, "\n[getnetgrent.c: netgr_ldap_destr]\n");
#endif  /* DEBUG */

    (void) _clean_ldap_backend(be);

    return ((nss_status_t)NSS_NOTFOUND);
}


static ldap_backend_op_t netgroup_ops[] = {
    netgr_ldap_destr,
    0,
    0,
    0,
    netgr_in,       /*  innetgr()   */
    netgr_set       /*  setnetgrent()   */
};


/*
 * _nss_ldap_netgroup_constr is where life begins. This function calls the
 * generic ldap constructor function to define and build the abstract data
 * types required to support ldap operations.
 */

/*ARGSUSED0*/
nss_backend_t *
_nss_ldap_netgroup_constr(const char *dummy1, const char *dummy2,
            const char *dummy3)
{

#ifdef  DEBUG
    (void) fprintf(stdout,
        "\n[getnetgrent.c: _nss_ldap_netgroup_constr]\n");
#endif  /* DEBUG */

    return ((nss_backend_t *)_nss_ldap_constr(netgroup_ops,
        sizeof (netgroup_ops)/sizeof (netgroup_ops[0]), _NETGROUP,
        netgrent_attrs, NULL));
}