10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * System Security Services Daemon. NSS client interface
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * Copyright (C) Simo Sorce 2011
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * This program is free software; you can redistribute it and/or modify
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * it under the terms of the GNU Lesser General Public License as
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * published by the Free Software Foundation; either version 2.1 of the
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * License, or (at your option) any later version.
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * This program is distributed in the hope that it will be useful,
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * but WITHOUT ANY WARRANTY; without even the implied warranty of
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce * GNU Lesser General Public License for more details.
287e76479d68db4134274d4a4fca5fe0fbc9a605Jan Cholasta * You should have received a copy of the GNU Lesser General Public License
287e76479d68db4134274d4a4fca5fe0fbc9a605Jan Cholasta * along with this program. If not, see <http://www.gnu.org/licenses/>.
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce/* GROUP database NSS interface using mmap cache */
6a60e29468fc6b4043a4dc52d3aab73e8465db70Lukas Slebodnikstruct sss_cli_mc_ctx gr_mc_ctx = { UNINITIALIZED, -1, 0, NULL, 0, NULL, 0,
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorcestatic errno_t sss_nss_mc_parse_result(struct sss_mc_rec *rec,
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* additional checks before filling result*/
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* entry is now invalid */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* fill in glibc provided structs */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* copy in buffer */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* fill in group */
8bf65dbab8703697c85b033beb5c189fce17b036Michal Zidek /* The address &buffer[0] must be aligned to sizeof(char *) */
8bf65dbab8703697c85b033beb5c189fce17b036Michal Zidek /* The buffer is not properly aligned. */
90ac46f71068d131391492360a8553bdd005b5a7Michal Zidek result->gr_mem = DISCARD_ALIGN(buffer, char **);
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce ret = sss_nss_str_ptr_from_buffer(&result->gr_name, &cookie,
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce ret = sss_nss_str_ptr_from_buffer(&result->gr_passwd, &cookie,
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce ret = sss_nss_str_ptr_from_buffer(&result->gr_mem[i], &cookie,
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorceerrno_t sss_nss_mc_getgrnam(const char *name, size_t name_len,
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik const size_t strs_offset = offsetof(struct sss_mc_grp_data, strs);
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik /* Get max size of data table. */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* hashes are calculated including the NULL terminator */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce hash = sss_nss_mc_hash(&gr_mc_ctx, name, name_len + 1);
080e1bfb72ed0e8d96e390d83ad35eaba79bd450René Genz /* If slot is not within the bounds of mmapped region and
e61044d99ce1e68057fda236f04a731f1f3f299aMichal Zidek * it's value is not MC_INVALID_VAL, then the cache is
080e1bfb72ed0e8d96e390d83ad35eaba79bd450René Genz * probably corrupted. */
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik while (MC_SLOT_WITHIN_BOUNDS(slot, data_size)) {
9d876108620931e0941a115adf60bfd8d67459d9Lukas Slebodnik /* free record from previous iteration */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce ret = sss_nss_mc_get_record(&gr_mc_ctx, slot, &rec);
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* check record matches what we are searching for */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* if name hash does not match we can skip this immediately */
581de96fc30b7fe44070f17a8a73f3374d38d6ffLukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
8a5931bcc8e9034e4beb92fc9addf3f7fcf83fd6Michal Zidek /* Integrity check
8a5931bcc8e9034e4beb92fc9addf3f7fcf83fd6Michal Zidek * - data->name cannot point outside strings
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik * - all strings must be within copy of record
4382047490dd4f80b407cc1e618da048f13e5f8fSumit Bose * - record must not end outside data table
4382047490dd4f80b407cc1e618da048f13e5f8fSumit Bose * - rec_name is a zero-terminated string */
fd17e0925dbcafedb878ddf828a37743c115c9ddLukas Slebodnik || (uint8_t *) rec + rec->len > gr_mc_ctx.data_table + data_size) {
581de96fc30b7fe44070f17a8a73f3374d38d6ffLukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik if (!MC_SLOT_WITHIN_BOUNDS(slot, data_size)) {
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce ret = sss_nss_mc_parse_result(rec, result, buffer, buflen);
6a60e29468fc6b4043a4dc52d3aab73e8465db70Lukas Slebodnik __sync_sub_and_fetch(&gr_mc_ctx.active_threads, 1);
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* hashes are calculated including the NULL terminator */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce hash = sss_nss_mc_hash(&gr_mc_ctx, gidstr, len+1);
080e1bfb72ed0e8d96e390d83ad35eaba79bd450René Genz /* If slot is not within the bounds of mmapped region and
e61044d99ce1e68057fda236f04a731f1f3f299aMichal Zidek * it's value is not MC_INVALID_VAL, then the cache is
080e1bfb72ed0e8d96e390d83ad35eaba79bd450René Genz * probably corrupted. */
13df7b9e400211c717284fb841c849ba034ed348Michal Zidek while (MC_SLOT_WITHIN_BOUNDS(slot, gr_mc_ctx.dt_size)) {
9d876108620931e0941a115adf60bfd8d67459d9Lukas Slebodnik /* free record from previous iteration */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce ret = sss_nss_mc_get_record(&gr_mc_ctx, slot, &rec);
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* check record matches what we are searching for */
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce /* if uid hash does not match we can skip this immediately */
581de96fc30b7fe44070f17a8a73f3374d38d6ffLukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
581de96fc30b7fe44070f17a8a73f3374d38d6ffLukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
13df7b9e400211c717284fb841c849ba034ed348Michal Zidek if (!MC_SLOT_WITHIN_BOUNDS(slot, gr_mc_ctx.dt_size)) {
10eae23e2483733d4ca3c21f15b5bdb3f04c9839Simo Sorce ret = sss_nss_mc_parse_result(rec, result, buffer, buflen);