1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * System Security Services Daemon. NSS client interface
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * Copyright (C) Simo Sorce 2011
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * This program is free software; you can redistribute it and/or modify
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * it under the terms of the GNU Lesser General Public License as
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * published by the Free Software Foundation; either version 2.1 of the
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * License, or (at your option) any later version.
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * This program is distributed in the hope that it will be useful,
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * but WITHOUT ANY WARRANTY; without even the implied warranty of
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce * GNU Lesser General Public License for more details.
287e76479d68db4134274d4a4fca5fe0fbc9a605Jan Cholasta * You should have received a copy of the GNU Lesser General Public License
287e76479d68db4134274d4a4fca5fe0fbc9a605Jan Cholasta * along with this program. If not, see <http://www.gnu.org/licenses/>.
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce/* PASSWD database NSS interface using mmap cache */
6a60e29468fc6b4043a4dc52d3aab73e8465db70Lukas Slebodnikstruct sss_cli_mc_ctx pw_mc_ctx = { UNINITIALIZED, -1, 0, NULL, 0, NULL, 0,
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorcestatic errno_t sss_nss_mc_parse_result(struct sss_mc_rec *rec,
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* additional checks before filling result*/
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* entry is now invalid */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* fill in glibc provided structs */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* copy in buffer */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* fill in passwd */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_str_ptr_from_buffer(&result->pw_name, &cookie,
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_str_ptr_from_buffer(&result->pw_passwd, &cookie,
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_str_ptr_from_buffer(&result->pw_gecos, &cookie,
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_str_ptr_from_buffer(&result->pw_dir, &cookie,
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_str_ptr_from_buffer(&result->pw_shell, &cookie,
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorceerrno_t sss_nss_mc_getpwnam(const char *name, size_t name_len,
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik const size_t strs_offset = offsetof(struct sss_mc_pwd_data, strs);
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik /* Get max size of data table. */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* hashes are calculated including the NULL terminator */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce hash = sss_nss_mc_hash(&pw_mc_ctx, name, name_len + 1);
080e1bfb72ed0e8d96e390d83ad35eaba79bd450René Genz /* If slot is not within the bounds of mmapped region and
e61044d99ce1e68057fda236f04a731f1f3f299aMichal Zidek * it's value is not MC_INVALID_VAL, then the cache is
080e1bfb72ed0e8d96e390d83ad35eaba79bd450René Genz * probably corrupted. */
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik while (MC_SLOT_WITHIN_BOUNDS(slot, data_size)) {
9d876108620931e0941a115adf60bfd8d67459d9Lukas Slebodnik /* free record from previous iteration */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_mc_get_record(&pw_mc_ctx, slot, &rec);
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* check record matches what we are searching for */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* if name hash does not match we can skip this immediately */
581de96fc30b7fe44070f17a8a73f3374d38d6ffLukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
8a5931bcc8e9034e4beb92fc9addf3f7fcf83fd6Michal Zidek /* Integrity check
8a5931bcc8e9034e4beb92fc9addf3f7fcf83fd6Michal Zidek * - data->name cannot point outside strings
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik * - all strings must be within copy of record
4382047490dd4f80b407cc1e618da048f13e5f8fSumit Bose * - record must not end outside data table
4382047490dd4f80b407cc1e618da048f13e5f8fSumit Bose * - rec_name is a zero-terminated string */
fd17e0925dbcafedb878ddf828a37743c115c9ddLukas Slebodnik || (uint8_t *) rec + rec->len > pw_mc_ctx.data_table + data_size) {
581de96fc30b7fe44070f17a8a73f3374d38d6ffLukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik if (!MC_SLOT_WITHIN_BOUNDS(slot, data_size)) {
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_mc_parse_result(rec, result, buffer, buflen);
6a60e29468fc6b4043a4dc52d3aab73e8465db70Lukas Slebodnik __sync_sub_and_fetch(&pw_mc_ctx.active_threads, 1);
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* hashes are calculated including the NULL terminator */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce hash = sss_nss_mc_hash(&pw_mc_ctx, uidstr, len+1);
080e1bfb72ed0e8d96e390d83ad35eaba79bd450René Genz /* If slot is not within the bounds of mmapped region and
e61044d99ce1e68057fda236f04a731f1f3f299aMichal Zidek * it's value is not MC_INVALID_VAL, then the cache is
080e1bfb72ed0e8d96e390d83ad35eaba79bd450René Genz * probably corrupted. */
13df7b9e400211c717284fb841c849ba034ed348Michal Zidek while (MC_SLOT_WITHIN_BOUNDS(slot, pw_mc_ctx.dt_size)) {
9d876108620931e0941a115adf60bfd8d67459d9Lukas Slebodnik /* free record from previous iteration */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_mc_get_record(&pw_mc_ctx, slot, &rec);
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* check record matches what we are searching for */
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce /* if uid hash does not match we can skip this immediately */
581de96fc30b7fe44070f17a8a73f3374d38d6ffLukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
581de96fc30b7fe44070f17a8a73f3374d38d6ffLukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
13df7b9e400211c717284fb841c849ba034ed348Michal Zidek if (!MC_SLOT_WITHIN_BOUNDS(slot, pw_mc_ctx.dt_size)) {
1171986bdc3011555c5b62a9d9ee9f7481f48cdcSimo Sorce ret = sss_nss_mc_parse_result(rec, result, buffer, buflen);