1 /* 2 * Copyright (c) 1992, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from software contributed to Berkeley by 6 * Rick Macklem at The University of Guelph. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)getnetgrent.c 8.2 (Berkeley) 4/27/95 33 * $FreeBSD: src/lib/libc/gen/getnetgrent.c,v 1.35 2007/01/09 00:27:54 imp Exp $ 34 */ 35 36 #include <ctype.h> 37 #include <netdb.h> 38 #include <stdio.h> 39 #include <stdlib.h> 40 #include <string.h> 41 #include <unistd.h> 42 43 #ifdef YP 44 /* 45 * Notes: 46 * We want to be able to use NIS netgroups properly while retaining 47 * the ability to use a local /etc/netgroup file. Unfortunately, you 48 * can't really do both at the same time - at least, not efficiently. 49 * NetBSD deals with this problem by creating a netgroup database 50 * using Berkeley DB (just like the password database) that allows 51 * for lookups using netgroup, netgroup.byuser or netgroup.byhost 52 * searches. This is a neat idea, but I don't have time to implement 53 * something like that now. (I think ultimately it would be nice 54 * if we DB-fied the group and netgroup stuff all in one shot, but 55 * for now I'm satisfied just to have something that works well 56 * without requiring massive code changes.) 57 * 58 * Therefore, to still permit the use of the local file and maintain 59 * optimum NIS performance, we allow for the following conditions: 60 * 61 * - If /etc/netgroup does not exist and NIS is turned on, we use 62 * NIS netgroups only. 63 * 64 * - If /etc/netgroup exists but is empty, we use NIS netgroups 65 * only. 66 * 67 * - If /etc/netgroup exists and contains _only_ a '+', we use 68 * NIS netgroups only. 69 * 70 * - If /etc/netgroup exists, contains locally defined netgroups 71 * and a '+', we use a mixture of NIS and the local entries. 72 * This method should return the same NIS data as just using 73 * NIS alone, but it will be slower if the NIS netgroup database 74 * is large (innetgr() in particular will suffer since extra 75 * processing has to be done in order to determine memberships 76 * using just the raw netgroup data). 77 * 78 * - If /etc/netgroup exists and contains only locally defined 79 * netgroup entries, we use just those local entries and ignore 80 * NIS (this is the original, pre-NIS behavior). 81 */ 82 83 #include <rpc/rpc.h> 84 #include <rpcsvc/yp_prot.h> 85 #include <rpcsvc/ypclnt.h> 86 #include <sys/types.h> 87 #include <sys/stat.h> 88 #include <sys/param.h> 89 #include <sys/errno.h> 90 static char *_netgr_yp_domain; 91 int _use_only_yp; 92 static int _netgr_yp_enabled; 93 static int _yp_innetgr; 94 #endif 95 96 #ifndef _PATH_NETGROUP 97 #define _PATH_NETGROUP "/etc/netgroup" 98 #endif 99 100 /* 101 * Static Variables and functions used by setnetgrent(), getnetgrent() and 102 * endnetgrent(). 103 * There are two linked lists: 104 * - linelist is just used by setnetgrent() to parse the net group file via. 105 * parse_netgrp() 106 * - netgrp is the list of entries for the current netgroup 107 */ 108 struct linelist { 109 struct linelist *l_next; /* Chain ptr. */ 110 int l_parsed; /* Flag for cycles */ 111 char *l_groupname; /* Name of netgroup */ 112 char *l_line; /* Netgroup entrie(s) to be parsed */ 113 }; 114 115 struct netgrp { 116 struct netgrp *ng_next; /* Chain ptr */ 117 char *ng_str[3]; /* Field pointers, see below */ 118 }; 119 #define NG_HOST 0 /* Host name */ 120 #define NG_USER 1 /* User name */ 121 #define NG_DOM 2 /* and Domain name */ 122 123 static struct linelist *linehead = NULL; 124 static struct netgrp *nextgrp = NULL; 125 static struct { 126 struct netgrp *gr; 127 char *grname; 128 } grouphead = { 129 NULL, 130 NULL, 131 }; 132 static FILE *netf = NULL; 133 134 static int parse_netgrp(const char *); 135 static struct linelist *read_for_group(const char *); 136 137 #define LINSIZ 1024 /* Length of netgroup file line */ 138 139 /* 140 * setnetgrent() 141 * Parse the netgroup file looking for the netgroup and build the list 142 * of netgrp structures. Let parse_netgrp() and read_for_group() do 143 * most of the work. 144 */ 145 void 146 setnetgrent(const char *group) 147 { 148 #ifdef YP 149 struct stat _yp_statp; 150 char _yp_plus; 151 #endif 152 153 /* Sanity check */ 154 155 if (group == NULL || !strlen(group)) 156 return; 157 158 if (grouphead.gr == NULL || 159 strcmp(group, grouphead.grname)) { 160 endnetgrent(); 161 #ifdef YP 162 /* Presumed guilty until proven innocent. */ 163 _use_only_yp = 0; 164 /* 165 * If /etc/netgroup doesn't exist or is empty, 166 * use NIS exclusively. 167 */ 168 if (((stat(_PATH_NETGROUP, &_yp_statp) < 0) && 169 errno == ENOENT) || _yp_statp.st_size == 0) 170 _use_only_yp = _netgr_yp_enabled = 1; 171 if ((netf = fopen(_PATH_NETGROUP,"r")) != NULL ||_use_only_yp){ 172 /* 173 * Icky: grab the first character of the netgroup file 174 * and turn on NIS if it's a '+'. rewind the stream 175 * afterwards so we don't goof up read_for_group() later. 176 */ 177 if (netf) { 178 fscanf(netf, "%c", &_yp_plus); 179 rewind(netf); 180 if (_yp_plus == '+') 181 _use_only_yp = _netgr_yp_enabled = 1; 182 } 183 /* 184 * If we were called specifically for an innetgr() 185 * lookup and we're in NIS-only mode, short-circuit 186 * parse_netgroup() and cut directly to the chase. 187 */ 188 if (_use_only_yp && _yp_innetgr) { 189 /* dohw! */ 190 if (netf != NULL) 191 fclose(netf); 192 return; 193 } 194 #else 195 if ((netf = fopen(_PATH_NETGROUP, "r"))) { 196 #endif 197 if (parse_netgrp(group)) 198 endnetgrent(); 199 else { 200 grouphead.grname = (char *) 201 malloc(strlen(group) + 1); 202 strcpy(grouphead.grname, group); 203 } 204 if (netf) 205 fclose(netf); 206 } 207 } 208 nextgrp = grouphead.gr; 209 } 210 211 /* 212 * Get the next netgroup off the list. 213 */ 214 int 215 getnetgrent(char **hostp, char **userp, char **domp) 216 { 217 #ifdef YP 218 _yp_innetgr = 0; 219 #endif 220 221 if (nextgrp) { 222 *hostp = nextgrp->ng_str[NG_HOST]; 223 *userp = nextgrp->ng_str[NG_USER]; 224 *domp = nextgrp->ng_str[NG_DOM]; 225 nextgrp = nextgrp->ng_next; 226 return (1); 227 } 228 return (0); 229 } 230 231 /* 232 * endnetgrent() - cleanup 233 */ 234 void 235 endnetgrent(void) 236 { 237 struct linelist *lp, *olp; 238 struct netgrp *gp, *ogp; 239 240 lp = linehead; 241 while (lp) { 242 olp = lp; 243 lp = lp->l_next; 244 free(olp->l_groupname); 245 free(olp->l_line); 246 free((char *)olp); 247 } 248 linehead = NULL; 249 if (grouphead.grname) { 250 free(grouphead.grname); 251 grouphead.grname = NULL; 252 } 253 gp = grouphead.gr; 254 while (gp) { 255 ogp = gp; 256 gp = gp->ng_next; 257 if (ogp->ng_str[NG_HOST]) 258 free(ogp->ng_str[NG_HOST]); 259 if (ogp->ng_str[NG_USER]) 260 free(ogp->ng_str[NG_USER]); 261 if (ogp->ng_str[NG_DOM]) 262 free(ogp->ng_str[NG_DOM]); 263 free((char *)ogp); 264 } 265 grouphead.gr = NULL; 266 nextgrp = NULL; 267 #ifdef YP 268 _netgr_yp_enabled = 0; 269 #endif 270 } 271 272 #ifdef YP 273 static int 274 _listmatch(const char *list, const char *group, int len) 275 { 276 const char *ptr = list; 277 const char *cptr; 278 int glen = strlen(group); 279 280 /* skip possible leading whitespace */ 281 while(isspace((unsigned char)*ptr)) 282 ptr++; 283 284 while (ptr < list + len) { 285 cptr = ptr; 286 while(*ptr != ',' && *ptr != '\0' && !isspace((unsigned char)*ptr)) 287 ptr++; 288 if (strncmp(cptr, group, glen) == 0 && glen == (ptr - cptr)) 289 return(1); 290 while(*ptr == ',' || isspace((unsigned char)*ptr)) 291 ptr++; 292 } 293 294 return(0); 295 } 296 297 static int 298 _revnetgr_lookup(char *lookupdom, char *map, const char *str, 299 const char *dom, const char *group) 300 { 301 int y, rv, rot; 302 char key[MAXHOSTNAMELEN]; 303 char *result; 304 int resultlen; 305 306 for (rot = 0; ; rot++) { 307 switch (rot) { 308 case(0): snprintf(key, MAXHOSTNAMELEN, "%s.%s", 309 str, dom?dom:lookupdom); 310 break; 311 case(1): snprintf(key, MAXHOSTNAMELEN, "%s.*", 312 str); 313 break; 314 case(2): snprintf(key, MAXHOSTNAMELEN, "*.%s", 315 dom?dom:lookupdom); 316 break; 317 case(3): snprintf(key, MAXHOSTNAMELEN, "*.*"); 318 break; 319 default: return(0); 320 } 321 y = yp_match(lookupdom, map, key, strlen(key), &result, 322 &resultlen); 323 if (y == 0) { 324 rv = _listmatch(result, group, resultlen); 325 free(result); 326 if (rv) return(1); 327 } else if (y != YPERR_KEY) { 328 /* 329 * If we get an error other than 'no 330 * such key in map' then something is 331 * wrong and we should stop the search. 332 */ 333 return(-1); 334 } 335 } 336 } 337 #endif 338 339 /* 340 * Search for a match in a netgroup. 341 */ 342 int 343 innetgr(const char *group, const char *host, const char *user, const char *dom) 344 { 345 char *hst, *usr, *dm; 346 /* Sanity check */ 347 348 if (group == NULL || !strlen(group)) 349 return (0); 350 351 #ifdef YP 352 _yp_innetgr = 1; 353 #endif 354 setnetgrent(group); 355 #ifdef YP 356 _yp_innetgr = 0; 357 /* 358 * If we're in NIS-only mode, do the search using 359 * NIS 'reverse netgroup' lookups. 360 * 361 * What happens with 'reverse netgroup' lookups: 362 * 363 * 1) try 'reverse netgroup' lookup 364 * 1.a) if host is specified and user is null: 365 * look in netgroup.byhost 366 * (try host.domain, host.*, *.domain or *.*) 367 * if found, return yes 368 * 1.b) if user is specified and host is null: 369 * look in netgroup.byuser 370 * (try host.domain, host.*, *.domain or *.*) 371 * if found, return yes 372 * 1.c) if both host and user are specified, 373 * don't do 'reverse netgroup' lookup. It won't work. 374 * 1.d) if neither host ane user are specified (why?!?) 375 * don't do 'reverse netgroup' lookup either. 376 * 2) if domain is specified and 'reverse lookup' is done: 377 * 'reverse lookup' was authoritative. bye bye. 378 * 3) otherwise, too bad, try it the slow way. 379 */ 380 if (_use_only_yp && (host == NULL) != (user == NULL)) { 381 int ret; 382 if(yp_get_default_domain(&_netgr_yp_domain)) 383 return(0); 384 ret = _revnetgr_lookup(_netgr_yp_domain, 385 host?"netgroup.byhost":"netgroup.byuser", 386 host?host:user, dom, group); 387 if (ret == 1) 388 return(1); 389 else if (ret == 0 && dom != NULL) 390 return(0); 391 } 392 393 setnetgrent(group); 394 #endif /* YP */ 395 396 while (getnetgrent(&hst, &usr, &dm)) 397 if ((host == NULL || hst == NULL || !strcmp(host, hst)) && 398 (user == NULL || usr == NULL || !strcmp(user, usr)) && 399 ( dom == NULL || dm == NULL || !strcmp(dom, dm))) { 400 endnetgrent(); 401 return (1); 402 } 403 endnetgrent(); 404 return (0); 405 } 406 407 /* 408 * Parse the netgroup file setting up the linked lists. 409 */ 410 static int 411 parse_netgrp(const char *group) 412 { 413 char *spos, *epos; 414 int len, strpos; 415 #ifdef DEBUG 416 int fields; 417 #endif 418 char *pos, *gpos; 419 struct netgrp *grp; 420 struct linelist *lp = linehead; 421 422 /* 423 * First, see if the line has already been read in. 424 */ 425 while (lp) { 426 if (!strcmp(group, lp->l_groupname)) 427 break; 428 lp = lp->l_next; 429 } 430 if (lp == NULL && 431 (lp = read_for_group(group)) == NULL) 432 return (1); 433 if (lp->l_parsed) { 434 #ifdef DEBUG 435 /* 436 * This error message is largely superflous since the 437 * code handles the error condition successfully, and 438 * spewing it out from inside libc can actually hose 439 * certain programs. 440 */ 441 fprintf(stderr, "Cycle in netgroup %s\n", lp->l_groupname); 442 #endif 443 return (1); 444 } else 445 lp->l_parsed = 1; 446 pos = lp->l_line; 447 /* Watch for null pointer dereferences, dammit! */ 448 while (pos != NULL && *pos != '\0') { 449 if (*pos == '(') { 450 grp = (struct netgrp *)malloc(sizeof (struct netgrp)); 451 bzero((char *)grp, sizeof (struct netgrp)); 452 grp->ng_next = grouphead.gr; 453 grouphead.gr = grp; 454 pos++; 455 gpos = strsep(&pos, ")"); 456 #ifdef DEBUG 457 fields = 0; 458 #endif 459 for (strpos = 0; strpos < 3; strpos++) { 460 if ((spos = strsep(&gpos, ","))) { 461 #ifdef DEBUG 462 fields++; 463 #endif 464 while (*spos == ' ' || *spos == '\t') 465 spos++; 466 if ((epos = strpbrk(spos, " \t"))) { 467 *epos = '\0'; 468 len = epos - spos; 469 } else 470 len = strlen(spos); 471 if (len > 0) { 472 grp->ng_str[strpos] = (char *) 473 malloc(len + 1); 474 bcopy(spos, grp->ng_str[strpos], 475 len + 1); 476 } 477 } else { 478 /* 479 * All other systems I've tested 480 * return NULL for empty netgroup 481 * fields. It's up to user programs 482 * to handle the NULLs appropriately. 483 */ 484 grp->ng_str[strpos] = NULL; 485 } 486 } 487 #ifdef DEBUG 488 /* 489 * Note: on other platforms, malformed netgroup 490 * entries are not normally flagged. While we 491 * can catch bad entries and report them, we should 492 * stay silent by default for compatibility's sake. 493 */ 494 if (fields < 3) 495 fprintf(stderr, "Bad entry (%s%s%s%s%s) in netgroup \"%s\"\n", 496 grp->ng_str[NG_HOST] == NULL ? "" : grp->ng_str[NG_HOST], 497 grp->ng_str[NG_USER] == NULL ? "" : ",", 498 grp->ng_str[NG_USER] == NULL ? "" : grp->ng_str[NG_USER], 499 grp->ng_str[NG_DOM] == NULL ? "" : ",", 500 grp->ng_str[NG_DOM] == NULL ? "" : grp->ng_str[NG_DOM], 501 lp->l_groupname); 502 #endif 503 } else { 504 spos = strsep(&pos, ", \t"); 505 if (parse_netgrp(spos)) 506 continue; 507 } 508 if (pos == NULL) 509 break; 510 while (*pos == ' ' || *pos == ',' || *pos == '\t') 511 pos++; 512 } 513 return (0); 514 } 515 516 /* 517 * Read the netgroup file and save lines until the line for the netgroup 518 * is found. Return 1 if eof is encountered. 519 */ 520 static struct linelist * 521 read_for_group(const char *group) 522 { 523 char *pos, *spos, *linep = NULL, *olinep = NULL; 524 int len, olen; 525 int cont; 526 struct linelist *lp; 527 char line[LINSIZ + 2]; 528 #ifdef YP 529 char *result; 530 int resultlen; 531 532 while (_netgr_yp_enabled || fgets(line, LINSIZ, netf) != NULL) { 533 if (_netgr_yp_enabled) { 534 if(!_netgr_yp_domain) 535 if(yp_get_default_domain(&_netgr_yp_domain)) 536 continue; 537 if (yp_match(_netgr_yp_domain, "netgroup", group, 538 strlen(group), &result, &resultlen)) { 539 free(result); 540 if (_use_only_yp) 541 return (NULL); 542 else { 543 _netgr_yp_enabled = 0; 544 continue; 545 } 546 } 547 snprintf(line, LINSIZ, "%s %s", group, result); 548 free(result); 549 } 550 #else 551 while (fgets(line, LINSIZ, netf) != NULL) { 552 #endif 553 pos = (char *)&line; 554 #ifdef YP 555 if (*pos == '+') { 556 _netgr_yp_enabled = 1; 557 continue; 558 } 559 #endif 560 if (*pos == '#') 561 continue; 562 while (*pos == ' ' || *pos == '\t') 563 pos++; 564 spos = pos; 565 while (*pos != ' ' && *pos != '\t' && *pos != '\n' && 566 *pos != '\0') 567 pos++; 568 len = pos - spos; 569 while (*pos == ' ' || *pos == '\t') 570 pos++; 571 if (*pos != '\n' && *pos != '\0') { 572 lp = (struct linelist *)malloc(sizeof (*lp)); 573 lp->l_parsed = 0; 574 lp->l_groupname = (char *)malloc(len + 1); 575 bcopy(spos, lp->l_groupname, len); 576 *(lp->l_groupname + len) = '\0'; 577 len = strlen(pos); 578 olen = 0; 579 580 /* 581 * Loop around handling line continuations. 582 */ 583 do { 584 if (*(pos + len - 1) == '\n') 585 len--; 586 if (*(pos + len - 1) == '\\') { 587 len--; 588 cont = 1; 589 } else 590 cont = 0; 591 if (len > 0) { 592 linep = (char *)malloc(olen + len + 1); 593 if (olen > 0) { 594 bcopy(olinep, linep, olen); 595 free(olinep); 596 } 597 bcopy(pos, linep + olen, len); 598 olen += len; 599 *(linep + olen) = '\0'; 600 olinep = linep; 601 } 602 if (cont) { 603 if (fgets(line, LINSIZ, netf)) { 604 pos = line; 605 len = strlen(pos); 606 } else 607 cont = 0; 608 } 609 } while (cont); 610 lp->l_line = linep; 611 lp->l_next = linehead; 612 linehead = lp; 613 614 /* 615 * If this is the one we wanted, we are done. 616 */ 617 if (!strcmp(lp->l_groupname, group)) 618 return (lp); 619 } 620 } 621 #ifdef YP 622 /* 623 * Yucky. The recursive nature of this whole mess might require 624 * us to make more than one pass through the netgroup file. 625 * This might be best left outside the #ifdef YP, but YP is 626 * defined by default anyway, so I'll leave it like this 627 * until I know better. 628 */ 629 rewind(netf); 630 #endif 631 return (NULL); 632 } 633