]> git.ipfire.org Git - thirdparty/glibc.git/blame - nscd/nscd_gethst_r.c
Fix infinite loop in nscd when netgroup is empty (bz #16365)
[thirdparty/glibc.git] / nscd / nscd_gethst_r.c
CommitLineData
d4697bc9 1/* Copyright (C) 1998-2014 Free Software Foundation, Inc.
67479a70
UD
2 This file is part of the GNU C Library.
3 Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
4
5 The GNU C Library is free software; you can redistribute it and/or
41bdb6e2
AJ
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
67479a70
UD
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
41bdb6e2 13 Lesser General Public License for more details.
67479a70 14
41bdb6e2 15 You should have received a copy of the GNU Lesser General Public
59ba27a6
PE
16 License along with the GNU C Library; if not, see
17 <http://www.gnu.org/licenses/>. */
67479a70
UD
18
19#include <errno.h>
67479a70
UD
20#include <resolv.h>
21#include <stdio.h>
67479a70 22#include <string.h>
e054f494 23#include <stdint.h>
67479a70 24#include <arpa/nameser.h>
40c38b6c 25#include <not-cancel.h>
67479a70 26
3f804c95 27#include "nscd-client.h"
67479a70
UD
28#include "nscd_proto.h"
29
30int __nss_not_use_nscd_hosts;
31
32static int nscd_gethst_r (const char *key, size_t keylen, request_type type,
33 struct hostent *resultbuf, char *buffer,
261eada2
UD
34 size_t buflen, struct hostent **result,
35 int *h_errnop) internal_function;
67479a70
UD
36
37
38int
39__nscd_gethostbyname_r (const char *name, struct hostent *resultbuf,
261eada2
UD
40 char *buffer, size_t buflen, struct hostent **result,
41 int *h_errnop)
67479a70
UD
42{
43 request_type reqtype;
44
45 reqtype = (_res.options & RES_USE_INET6) ? GETHOSTBYNAMEv6 : GETHOSTBYNAME;
46
47 return nscd_gethst_r (name, strlen (name) + 1, reqtype, resultbuf,
261eada2 48 buffer, buflen, result, h_errnop);
67479a70
UD
49}
50
51
52int
53__nscd_gethostbyname2_r (const char *name, int af, struct hostent *resultbuf,
261eada2
UD
54 char *buffer, size_t buflen, struct hostent **result,
55 int *h_errnop)
67479a70
UD
56{
57 request_type reqtype;
58
59 reqtype = af == AF_INET6 ? GETHOSTBYNAMEv6 : GETHOSTBYNAME;
60
61 return nscd_gethst_r (name, strlen (name) + 1, reqtype, resultbuf,
261eada2 62 buffer, buflen, result, h_errnop);
67479a70
UD
63}
64
65
66int
9d4d69b8 67__nscd_gethostbyaddr_r (const void *addr, socklen_t len, int type,
67479a70 68 struct hostent *resultbuf, char *buffer, size_t buflen,
261eada2 69 struct hostent **result, int *h_errnop)
67479a70
UD
70{
71 request_type reqtype;
72
73 if (!((len == INADDRSZ && type == AF_INET)
74 || (len == IN6ADDRSZ && type == AF_INET6)))
75 /* LEN and TYPE do not match. */
1670698f 76 return -1;
67479a70
UD
77
78 reqtype = type == AF_INET6 ? GETHOSTBYADDRv6 : GETHOSTBYADDR;
79
261eada2 80 return nscd_gethst_r (addr, len, reqtype, resultbuf, buffer, buflen, result,
67479a70
UD
81 h_errnop);
82}
83
84
6f8a7dff 85libc_locked_map_ptr (, __hst_map_handle) attribute_hidden;
c207f23b
UD
86/* Note that we only free the structure if necessary. The memory
87 mapping is not removed since it is not visible to the malloc
88 handling. */
ed2ced8a 89libc_freeres_fn (hst_map_free)
67479a70 90{
ed2ced8a
UD
91 if (__hst_map_handle.mapped != NO_MAPPING)
92 {
93 void *p = __hst_map_handle.mapped;
94 __hst_map_handle.mapped = NO_MAPPING;
95 free (p);
96 }
67479a70
UD
97}
98
99
3a2c0242
UD
100uint32_t
101__nscd_get_nl_timestamp (void)
102{
509072a0 103 uint32_t retval;
3a2c0242
UD
104 if (__nss_not_use_nscd_hosts != 0)
105 return 0;
106
509072a0
AJ
107 /* __nscd_get_mapping can change hst_map_handle.mapped to NO_MAPPING.
108 However, __nscd_get_mapping assumes the prior value was not NO_MAPPING.
109 Thus we have to acquire the lock to prevent this thread from changing
110 hst_map_handle.mapped to NO_MAPPING while another thread is inside
111 __nscd_get_mapping. */
112 if (!__nscd_acquire_maplock (&__hst_map_handle))
113 return 0;
114
3a2c0242
UD
115 struct mapped_database *map = __hst_map_handle.mapped;
116
117 if (map == NULL
118 || (map != NO_MAPPING
119 && map->head->nscd_certainly_running == 0
120 && map->head->timestamp + MAPPING_TIMEOUT < time (NULL)))
121 map = __nscd_get_mapping (GETFDHST, "hosts", &__hst_map_handle.mapped);
122
123 if (map == NO_MAPPING)
509072a0
AJ
124 retval = 0;
125 else
126 retval = map->head->extra_data[NSCD_HST_IDX_CONF_TIMESTAMP];
127
128 /* Release the lock. */
129 __hst_map_handle.lock = 0;
3a2c0242 130
509072a0 131 return retval;
3a2c0242
UD
132}
133
134
50e481ce
UD
135int __nss_have_localdomain attribute_hidden;
136
67479a70 137static int
813f4f4d 138internal_function
67479a70
UD
139nscd_gethst_r (const char *key, size_t keylen, request_type type,
140 struct hostent *resultbuf, char *buffer, size_t buflen,
261eada2 141 struct hostent **result, int *h_errnop)
67479a70 142{
50e481ce
UD
143 if (__builtin_expect (__nss_have_localdomain >= 0, 0))
144 {
145 if (__nss_have_localdomain == 0)
146 __nss_have_localdomain = getenv ("LOCALDOMAIN") != NULL ? 1 : -1;
147 if (__nss_have_localdomain > 0)
148 {
149 __nss_not_use_nscd_hosts = 1;
150 return -1;
151 }
152 }
153
0891f970
UD
154 int gc_cycle;
155 int nretries = 0;
156
157 /* If the mapping is available, try to search there instead of
158 communicating with the nscd. */
159 struct mapped_database *mapped;
ed2ced8a
UD
160 mapped = __nscd_get_map_ref (GETFDHST, "hosts", &__hst_map_handle,
161 &gc_cycle);
0891f970
UD
162
163 retry:;
c207f23b
UD
164 const char *h_name = NULL;
165 const uint32_t *aliases_len = NULL;
166 const char *addr_list = NULL;
167 size_t addr_list_len = 0;
168 int retval = -1;
c207f23b
UD
169 const char *recend = (const char *) ~UINTMAX_C (0);
170 int sock = -1;
1a77d37f 171 hst_response_header hst_resp;
af38d7ce 172 if (mapped != NO_MAPPING)
67479a70 173 {
1a77d37f 174 /* No const qualifier, as it can change during garbage collection. */
cfe1fc10
JJ
175 struct datahead *found = __nscd_cache_search (type, key, keylen, mapped,
176 sizeof hst_resp);
c207f23b
UD
177 if (found != NULL)
178 {
1a77d37f
JJ
179 h_name = (char *) (&found->data[0].hstdata + 1);
180 hst_resp = found->data[0].hstdata;
181 aliases_len = (uint32_t *) (h_name + hst_resp.h_name_len);
c207f23b 182 addr_list = ((char *) aliases_len
1a77d37f
JJ
183 + hst_resp.h_aliases_cnt * sizeof (uint32_t));
184 addr_list_len = hst_resp.h_addr_list_cnt * INADDRSZ;
185 recend = (const char *) found->data + found->recsize;
186 /* Now check if we can trust hst_resp fields. If GC is
187 in progress, it can contain anything. */
188 if (mapped->head->gc_cycle != gc_cycle)
189 {
190 retval = -2;
191 goto out;
192 }
c207f23b
UD
193
194#ifndef _STRING_ARCH_unaligned
195 /* The aliases_len array in the mapped database might very
196 well be unaligned. We will access it word-wise so on
197 platforms which do not tolerate unaligned accesses we
198 need to make an aligned copy. */
199 if (((uintptr_t) aliases_len & (__alignof__ (*aliases_len) - 1))
200 != 0)
201 {
1a77d37f 202 uint32_t *tmp = alloca (hst_resp.h_aliases_cnt
c207f23b
UD
203 * sizeof (uint32_t));
204 aliases_len = memcpy (tmp, aliases_len,
1a77d37f 205 hst_resp.h_aliases_cnt
c207f23b
UD
206 * sizeof (uint32_t));
207 }
208#endif
209 if (type != GETHOSTBYADDR && type != GETHOSTBYNAME)
210 {
1a77d37f 211 if (hst_resp.h_length == INADDRSZ)
c207f23b 212 addr_list += addr_list_len;
1a77d37f 213 addr_list_len = hst_resp.h_addr_list_cnt * IN6ADDRSZ;
c207f23b 214 }
c207f23b
UD
215 if (__builtin_expect ((const char *) addr_list + addr_list_len
216 > recend, 0))
1a77d37f 217 goto out;
c207f23b
UD
218 }
219 }
220
1a77d37f 221 if (h_name == NULL)
c207f23b 222 {
1a77d37f
JJ
223 sock = __nscd_open_socket (key, keylen, type, &hst_resp,
224 sizeof (hst_resp));
c207f23b
UD
225 if (sock == -1)
226 {
227 __nss_not_use_nscd_hosts = 1;
4a4a65f2 228 goto out;
c207f23b 229 }
67479a70
UD
230 }
231
16aac663
UD
232 /* No value found so far. */
233 *result = NULL;
234
1a77d37f 235 if (__builtin_expect (hst_resp.found == -1, 0))
67479a70
UD
236 {
237 /* The daemon does not cache this database. */
67479a70 238 __nss_not_use_nscd_hosts = 1;
c207f23b 239 goto out_close;
67479a70
UD
240 }
241
1a77d37f 242 if (hst_resp.found == 1)
67479a70 243 {
67479a70 244 char *cp = buffer;
3810076f
UD
245 uintptr_t align1;
246 uintptr_t align2;
67479a70
UD
247 size_t total_len;
248 ssize_t cnt;
249 char *ignore;
250 int n;
251
49c091e5 252 /* A first check whether the buffer is sufficiently large is possible. */
67479a70 253 /* Now allocate the buffer the array for the group members. We must
3810076f
UD
254 align the pointer and the base of the h_addr_list pointers. */
255 align1 = ((__alignof__ (char *) - (cp - ((char *) 0)))
256 & (__alignof__ (char *) - 1));
1a77d37f 257 align2 = ((__alignof__ (char *) - ((cp + align1 + hst_resp.h_name_len)
3810076f
UD
258 - ((char *) 0)))
259 & (__alignof__ (char *) - 1));
1a77d37f
JJ
260 if (buflen < (align1 + hst_resp.h_name_len + align2
261 + ((hst_resp.h_aliases_cnt + hst_resp.h_addr_list_cnt
c207f23b 262 + 2)
67479a70 263 * sizeof (char *))
1a77d37f
JJ
264 + hst_resp.h_addr_list_cnt * (type == AF_INET
265 ? INADDRSZ : IN6ADDRSZ)))
67479a70
UD
266 {
267 no_room:
4379b403 268 *h_errnop = NETDB_INTERNAL;
67479a70 269 __set_errno (ERANGE);
261eada2 270 retval = ERANGE;
c207f23b 271 goto out_close;
67479a70 272 }
3810076f 273 cp += align1;
67479a70
UD
274
275 /* Prepare the result as far as we can. */
276 resultbuf->h_aliases = (char **) cp;
1a77d37f 277 cp += (hst_resp.h_aliases_cnt + 1) * sizeof (char *);
67479a70 278 resultbuf->h_addr_list = (char **) cp;
1a77d37f 279 cp += (hst_resp.h_addr_list_cnt + 1) * sizeof (char *);
67479a70
UD
280
281 resultbuf->h_name = cp;
1a77d37f 282 cp += hst_resp.h_name_len + align2;
67479a70 283
67479a70
UD
284 if (type == GETHOSTBYADDR || type == GETHOSTBYNAME)
285 {
67479a70
UD
286 resultbuf->h_addrtype = AF_INET;
287 resultbuf->h_length = INADDRSZ;
67479a70
UD
288 }
289 else
290 {
c207f23b
UD
291 resultbuf->h_addrtype = AF_INET6;
292 resultbuf->h_length = IN6ADDRSZ;
293 }
1a77d37f 294 for (cnt = 0; cnt < hst_resp.h_addr_list_cnt; ++cnt)
c207f23b
UD
295 {
296 resultbuf->h_addr_list[cnt] = cp;
297 cp += resultbuf->h_length;
298 }
299 resultbuf->h_addr_list[cnt] = NULL;
67479a70 300
c207f23b
UD
301 if (h_name == NULL)
302 {
4a4a65f2
UD
303 struct iovec vec[4];
304
c207f23b 305 vec[0].iov_base = resultbuf->h_name;
1a77d37f
JJ
306 vec[0].iov_len = hst_resp.h_name_len;
307 total_len = hst_resp.h_name_len;
c207f23b 308 n = 1;
67479a70 309
1a77d37f 310 if (hst_resp.h_aliases_cnt > 0)
c207f23b 311 {
1a77d37f 312 aliases_len = alloca (hst_resp.h_aliases_cnt
c207f23b
UD
313 * sizeof (uint32_t));
314 vec[n].iov_base = (void *) aliases_len;
1a77d37f 315 vec[n].iov_len = hst_resp.h_aliases_cnt * sizeof (uint32_t);
67479a70 316
1a77d37f 317 total_len += hst_resp.h_aliases_cnt * sizeof (uint32_t);
c207f23b
UD
318 ++n;
319 }
67479a70 320
c207f23b 321 if (type == GETHOSTBYADDR || type == GETHOSTBYNAME)
67479a70 322 {
c207f23b 323 vec[n].iov_base = resultbuf->h_addr_list[0];
1a77d37f 324 vec[n].iov_len = hst_resp.h_addr_list_cnt * INADDRSZ;
c207f23b 325
1a77d37f 326 total_len += hst_resp.h_addr_list_cnt * INADDRSZ;
c207f23b
UD
327
328 ++n;
67479a70 329 }
c207f23b
UD
330 else
331 {
1a77d37f 332 if (hst_resp.h_length == INADDRSZ)
c207f23b 333 {
1a77d37f 334 ignore = alloca (hst_resp.h_addr_list_cnt * INADDRSZ);
c207f23b 335 vec[n].iov_base = ignore;
1a77d37f 336 vec[n].iov_len = hst_resp.h_addr_list_cnt * INADDRSZ;
67479a70 337
1a77d37f 338 total_len += hst_resp.h_addr_list_cnt * INADDRSZ;
67479a70 339
c207f23b
UD
340 ++n;
341 }
67479a70 342
c207f23b 343 vec[n].iov_base = resultbuf->h_addr_list[0];
1a77d37f 344 vec[n].iov_len = hst_resp.h_addr_list_cnt * IN6ADDRSZ;
67479a70 345
1a77d37f 346 total_len += hst_resp.h_addr_list_cnt * IN6ADDRSZ;
c207f23b
UD
347
348 ++n;
349 }
350
d2dc7d84 351 if ((size_t) __readvall (sock, vec, n) != total_len)
c207f23b
UD
352 goto out_close;
353 }
354 else
355 {
1a77d37f 356 memcpy (resultbuf->h_name, h_name, hst_resp.h_name_len);
c207f23b
UD
357 memcpy (resultbuf->h_addr_list[0], addr_list, addr_list_len);
358 }
67479a70
UD
359
360 /* Now we also can read the aliases. */
361 total_len = 0;
1a77d37f 362 for (cnt = 0; cnt < hst_resp.h_aliases_cnt; ++cnt)
67479a70
UD
363 {
364 resultbuf->h_aliases[cnt] = cp;
365 cp += aliases_len[cnt];
366 total_len += aliases_len[cnt];
367 }
368 resultbuf->h_aliases[cnt] = NULL;
369
c207f23b
UD
370 if (__builtin_expect ((const char *) addr_list + addr_list_len
371 + total_len > recend, 0))
1a77d37f
JJ
372 {
373 /* aliases_len array might contain garbage during nscd GC cycle,
374 retry rather than fail in that case. */
375 if (addr_list != NULL && mapped->head->gc_cycle != gc_cycle)
376 retval = -2;
377 goto out_close;
378 }
67479a70 379 /* See whether this would exceed the buffer capacity. */
c207f23b 380 if (__builtin_expect (cp > buffer + buflen, 0))
1a77d37f
JJ
381 {
382 /* aliases_len array might contain garbage during nscd GC cycle,
383 retry rather than fail in that case. */
384 if (addr_list != NULL && mapped->head->gc_cycle != gc_cycle)
385 {
386 retval = -2;
387 goto out_close;
388 }
389 goto no_room;
390 }
67479a70
UD
391
392 /* And finally read the aliases. */
c207f23b
UD
393 if (addr_list == NULL)
394 {
74ac0a89
UD
395 if (total_len == 0
396 || ((size_t) __readall (sock, resultbuf->h_aliases[0], total_len)
397 == total_len))
c207f23b
UD
398 {
399 retval = 0;
400 *result = resultbuf;
401 }
402 }
403 else
261eada2 404 {
c207f23b
UD
405 memcpy (resultbuf->h_aliases[0],
406 (const char *) addr_list + addr_list_len, total_len);
407
5429ff76 408 /* Try to detect corrupt databases. */
1a77d37f
JJ
409 if (resultbuf->h_name[hst_resp.h_name_len - 1] != '\0'
410 || ({for (cnt = 0; cnt < hst_resp.h_aliases_cnt; ++cnt)
5429ff76
UD
411 if (resultbuf->h_aliases[cnt][aliases_len[cnt] - 1]
412 != '\0')
413 break;
1a77d37f
JJ
414 cnt < hst_resp.h_aliases_cnt; }))
415 {
416 /* We cannot use the database. */
417 if (mapped->head->gc_cycle != gc_cycle)
418 retval = -2;
419 goto out_close;
420 }
5429ff76 421
261eada2
UD
422 retval = 0;
423 *result = resultbuf;
424 }
67479a70
UD
425 }
426 else
427 {
428 /* Store the error number. */
1a77d37f 429 *h_errnop = hst_resp.error;
67479a70 430
cfca0aa3
UD
431 /* Set errno to 0 to indicate no error, just no found record. */
432 __set_errno (0);
261eada2
UD
433 /* Even though we have not found anything, the result is zero. */
434 retval = 0;
67479a70 435 }
12c80513 436
c207f23b
UD
437 out_close:
438 if (sock != -1)
439 close_not_cancel_no_status (sock);
12c80513 440 out:
1a77d37f 441 if (__nscd_drop_map_ref (mapped, &gc_cycle) != 0)
0891f970
UD
442 {
443 /* When we come here this means there has been a GC cycle while we
444 were looking for the data. This means the data might have been
445 inconsistent. Retry if possible. */
1a77d37f 446 if ((gc_cycle & 1) != 0 || ++nretries == 5 || retval == -1)
0891f970
UD
447 {
448 /* nscd is just running gc now. Disable using the mapping. */
1a77d37f
JJ
449 if (atomic_decrement_val (&mapped->counter) == 0)
450 __nscd_unmap (mapped);
0891f970
UD
451 mapped = NO_MAPPING;
452 }
453
1a77d37f
JJ
454 if (retval != -1)
455 goto retry;
0891f970 456 }
12c80513 457
261eada2 458 return retval;
67479a70 459}