tests/unit/test_xaprintf.c: Fix test by using streq() instead of strcmp(3)

Fixes: 423fd652b563 (2025-06-03; "lib/string/sprintf/, tests/unit/: Transform x[v]asprintf() into x[v]aprintf()")
Closes: <https://github.com/shadow-maint/shadow/issues/1279>
Reported-by: Timo Gurr <timo.gurr@gmail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

Release 4.18.0

Signed-off-by: Serge Hallyn <serge@hallyn.com>

Pre-release 4.18.0-rc2

Let's do one quick prerelease before we release 4.18 tomorrow.

Signed-off-by: Serge Hallyn <serge@hallyn.com>

contrib/: Burn it all

Closes: <https://github.com/shadow-maint/shadow/issues/1273>
Cc: Chris Hofstaedtler <zeha@debian.org>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

man/: wfix usermod inactive

man/: wfix usermod expiredate

man/: wfix useradd expiredate

man/: wfix useradd inactive

man: Update doc style of passwd man page

man: Update doc style in shadow man page

man/: wfix

man: Update chage -d -E options

Pre-release 4.18.0-rc1

Signed-off-by: Serge Hallyn <serge@hallyn.com>

configure: Fix typo

The test was about lastlog, not subids

Fixes: 1bdcfa8d3710 (2023-07-15; "lastlog: stop building by default")

lib/defines.h: PATH_MAX/MAXHOSTNAMELEN: define when not set by OS

E.g. GNU/Hurd does not define such limitations. Let "defines.h"
provide some good-enough value.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

lib/: Use xastrsep2ls() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strtok/: xastrsep2ls(): Add function

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/sgetgrent.c: list(): Explicitly free(3) at the start of the function

This makes it clear we wipe anything that was in the buffer.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strtok/: astrsep2ls(): Add function

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Use STRSEP2ARR() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Use strsep2arr() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/port.c: getportent(): Use STRSEP2ARR() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/port.c: Use STRSEP2LS() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/list.c: Use strsep2ls() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strtok/: strsep2ls(), STRSEP2LS(): Add APIs

This API set implements another usual loop around strsep(3).

This one implements a loop where we are interested in an arbitrary
number of fields.  For that, a NULL terminator is added at the end.
That is commonly referred to as "list".

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strtok/: strsep2arr(), STRSEP2ARR(): Add APIs

This API set implements the usual loop around strsep(3).

This one implements a loop where we are interested in an exact number of
fields.  I'll add another API set, strsep2ls() and STRSEP2LS(), which
will add a NULL terminator, for arbitrary numbers of fields.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/newusers.c: Fix off-by-one benign bug in array declaration

This array is only ever used as an array of 7.

alx@devuan:/srv/alx/src/shadow/shadow/master$ sed_rm_ccomments()
{
        perl -p -e 's%/\*.*?\*/%%g' \
        |sed -E '\%/\*%, \%\*/% {\%(\*/|/\*)%!d}' \
        |sed -E '\%/\*% {s%/\*.*%%; n; s%.*\*/%%;}' \
        |sed -E '\%/\*% {s%/\*.*%%; n; s%.*\*/%%;}' \
        |sed 's%//.*%%';
}
alx@devuan:/srv/alx/src/shadow/shadow/master$ cat src/newusers.c | grepc main | sed_rm_ccomments | grep -nT 'n\?fields\(\[.*]\)\?'
                  4: char *fields[8];
                  5: int nfields;
                 59: for (cp = buf, nfields = 0; nfields < 7; nfields++) {
                 60: fields[nfields] = strsep(&cp, ":");
                 64: if (nfields != 6) {
                 72: pw = pw_locate (fields[0]);
                 74: if (NULL == pw && getpwnam(fields[0]) != NULL) {
                 77:  Prog, fields[0]);
                 81: if (NULL == pw && get_user_id(fields[2], &uid) != 0) {
                 91:     && (add_group (fields[0], fields[3], &gid, uid) != 0)) {
                101:     && (add_user (fields[0], uid, gid) != 0)) {
                110: pw = pw_locate (fields[0]);
                114:          Prog, line, fields[0], pw_dbname ());
                132: usernames[nusers-1] = xstrdup(fields[0]);
                133: passwords[nusers-1] = xstrdup(fields[1]);
                135: if (add_passwd (&newpw, fields[1]) != 0) {
                141: if (!streq(fields[4], "")) {
                142: newpw.pw_gecos = fields[4];
                145: if (!streq(fields[5], "")) {
                146: newpw.pw_dir = fields[5];
                149: if (!streq(fields[6], "")) {
                150: newpw.pw_shell = fields[6];
                153: if (   !streq(fields[5], "")
                195: if (is_sub_uid && want_subuids() && !local_sub_uid_assigned(fields[0])) {
                205: if (sub_uid_add(fields[0], sub_uid_start, sub_uid_count) == 0)
                216: if (is_sub_gid && want_subgids() && !local_sub_gid_assigned(fields[0])) {
                225: if (sub_gid_add(fields[0], sub_gid_start, sub_gid_count) == 0) {
alx@devuan:/srv/alx/src/shadow/shadow/master$ cat src/newusers.c | grepc main | sed_rm_ccomments | grep -nTo 'n\?fields\(\[.*]\)\?'
                  4: fields[8]
                  5: nfields
                 59: nfields
                 59: nfields
                 59: nfields
                 60: fields[nfields]
                 64: nfields
                 72: fields[0]
                 74: fields[0]
                 77: fields[0]
                 81: fields[2]
                 91: fields[0], fields[3]
                101: fields[0]
                110: fields[0]
                114: fields[0]
                132: fields[0]
                133: fields[1]
                135: fields[1]
                141: fields[4]
                142: fields[4]
                145: fields[5]
                146: fields[5]
                149: fields[6]
                150: fields[6]
                153: fields[5]
                195: fields[0]
                205: fields[0]
                216: fields[0]
                225: fields[0]

Fixes: 45c6603cc86c (2007-10-07; "[svn-upgrade] Integrating new upstream version, shadow (19990709)")
Link: <https://github.com/shadow-maint/shadow/pull/1155#discussion_r2132261260>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/get_pid.c: pid_t is a signed integer

Print it with "%d".

Acked-by: Lukas Slebodnik <lslebodn@fedoraproject.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/get_pid.c: Use PATH_MAX instead of a magic number

Acked-by: Lukas Slebodnik <lslebodn@fedoraproject.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/tcbfuncs.c: shadowtcb_path_rel(): Centralize error handling

All these 3 branches have a compatible return value, which we can check
at once after the branches.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/tcbfuncs.c: shadowtcb_path_rel(): Use strdup(3) instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Remove unnecessary variables

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Use xaprintf() instead of xasprintf()

This makes some temporary variables unnecessary.  They'll be removed in
the next commit.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/sprintf/, tests/unit/: Transform x[v]asprintf() into x[v]aprintf()

Wrap [v]aprintf() instead of [v]asprintf(3).

Repurpose x[v]asprintf()'s tests to test x[v]aprintf().

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Use vaprintf() instead of vasprintf(3)

lib/, src/: Use aprintf() instead of asprintf(3)

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/tcbfuncs.c: Split conditionals

This is in preparation for the next commit.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/sprintf/: [v]aprintf(): Add functions

These functions are just like [v]asprintf(3), but simpler.

They return the newly allocated memory, which allows us to use the
[[gnu::malloc(free)]] attribute, which enhances static analysis.
They also omit the length, which we don't care about at all.

As a curiosity, Plan9 seems to provide this same API, under the name
smprint(3).

Link: <https://9fans.github.io/plan9port/man/man3/print.html>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/fs/mkstemp/: mkostemp(): Split API from fmkomstemp()

This reduces the complexity of fmkomstemp().

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/fs/mkstemp/, src/: fmkomstemp(): Move function to separate file

And make it inline.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/getdef.c: Use countof() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Move macros to "typetraits.h"

The macros that remain in "must_be.h" really belong in "typetraits.h".
Move them there, and remove "must_be.h".

Signed-off-by: Alejandro Colomar <alx@kernel.org>

autogen.sh, lib/: Replace must_be_array() by -Werror=sizeof-pointer-div

The error works as well as the magic macro, and we get cleaner code.
Plus, very soon we'll get the countof() operator from GCC 16 and
Clang 21, which doesn't even need this diagnostic to work safely.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/sizeof.h: Define SIZEOF_ARRAY() in terms of countof()

This will allow us to eventually get rid of must_be_array(), once
we make sure countof() is safe.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/, tests/: Use the standard countof() instead of our NITEMS()

countof() is the name blessed by the C Committee for ISO C2y.
Use it if available, and define it if not.

countof() will be provided by GCC 16 and Clang 21.

This is mostly a scripted change:

$ grep -rl NITEMS | xargs sed -i s/NITEMS/countof/;

Apart from the scripted changes, I've adjusted white-space alignment,
and of course the definition at "lib/sizeof.h".

Link: <https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3550.pdf#subsubsection.0.6.5.4.5>
Link: <https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3550.pdf#section.0.7.21>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/fields.c: valid_field(): Clarify comments

And apply minor style changes.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/fields.c: valid_field(): Use strchriscntrl() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/fields.c: valid_field(): Use strisprint() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/fields.c: valid_field(): Return early on error

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/fields.c: valid_field(): Remove useless check

We only call this function with a string literal, and it makes little
sense to pass something else.  Let's simplify.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/fields.*: valid_field: Make sure that $2 is a string literal

and thus, nonnull.

Suggested-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Move prototypes of "lib/fields.c" to "lib/fields.h"

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/ctype/strchrisascii/: strchriscntrl(): Add function

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/ctype/strisascii/: strisprint(): Add function

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/nss.c: Use !strcaseprefix() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

contrib/, lib/: Use strcaseprefix() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strcmp/: strcaseprefix(): Add API

Signed-off-by: Alejandro Colomar <alx@kernel.org>

tests/: test chage last changed date

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

tests/: test chage expiration date

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

tests/: implement binding for `chage`

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

tests/: test useradd expiration date

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

tests/: test usermod expiration date

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

lib/strtoday.c: Actually return a date from get_date()

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Move get_date() to lib/strtoday.c

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/strtoday.c: strtoday(): Remove obsolete comment

get_date() doesn't treat "" as a date anymore, so the comment is
obsolete.  We still need the code, though, as for example usermod(8)
uses an empty string as a synonym for -1.

Link: <https://github.com/shadow-maint/shadow/pull/1217#issuecomment-2668174079>
Reported-by: Chris Hofstaedtler <zeha@debian.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/strtoday.c: strtoday(): Attempt parsing with str2sl() directly

If it fails, let's fall back to get_date().

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/getdate.c: Use strptime(3) to simplify

The following trick:

t = 0;
gmtime_r(&t, &tm);

is a clever way to clear the tm(3type) structure, and set it to use UTC.

We need to set it to set UTC with this trick, because strptime(3)
doesn't set the timezone.  I (Alex) tried previously using

bzero(&tm, sizeof(tm));
strptime("UTC", "%Z", &tm);

but glibc ignores the timezone, and musl (at least I tried in an Alpine
container) seems to report an error.

The idea to use gmtime_r(3) was from lanodan.

Link: <https://inbox.sourceware.org/libc-alpha/Z_LqUgildoq33vI-@cloudsdale.the-delta.net.eu.org/T/#u>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Rich Felker <dalias@libc.org>
Co-authored-by: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Signed-off-by: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: get_date(): Remove unused parameter

And rename the remaining parameter.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Fix indentation and alignment

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/getdate.*: Reimplement in pure C

This removes all yacc(1) code from this project.  Add copyright and
license, since there remains nothing of the original code.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: sget*ent(): Remove unnecessary 'static', and rename variable

For consistency, use 'fields[]' in all these functions,
and don't make it unnecessarily 'static'.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/sgetpwent.c: sgetpwent(): Trim the trailing '\n'

Just like the other sget*ent() functions do.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Rename local variable

Call it 'dup', which reminds that it's a strdup(3)d string.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Remove arbitrary limitation by calling strdup(3)

This makes these APIs more consistent with the ones for groups,
which strdup(3) memory as necessary.

It also makes the code simpler.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Simplify by calling strdup(3)

While at it, rename the function parameter.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Use strtolower() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/ctype/strtoascii/: strtolower(): Add API

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/atoi/str2i/, *: Simplify implementations

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/atoi/a2i/: Simplify these macros by calling a2i()

I applied a similar patch in liba2i, where I've tested it.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac: Remove unused check for futimes(3)

Reported-by: Chris Hofstaedtler <zeha@debian.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

configure.ac, contrib/, src/: Remove dead code

Both glibc and musl provide getusershell(3).  It's an API from 4.3BSD,
according to the manual page, so let's assume it exists everywhere that
we would care, even if it's not in POSIX.

Reported-by: Chris Hofstaedtler <zeha@debian.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, configure.ac, po/: Remove dead file <lib/shadow.c>

We didn't even have prototypes for these APIs since long ago, when the
prototypes were removed, but misteriously the implementations remained.

Both glibc and musl provide getspnam(3), so this file was effectively
being ignored by the compiler.  Just remove it.

Also remove the check for getspnam, which isn't used elsewhere.

Fixes: 0ee095abd8db (2007-10-07; "[svn-upgrade] Integrating new upstream version, shadow (4.0.7)")
Closes: <https://github.com/shadow-maint/shadow/issues/1228>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strdup/strndupa.h: STRNDUPA(): Simplify implementation

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strdup/strndupa.h: strndupa(3): Add macro

musl doesn't provide strndupa(3).

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Treat strpbrk(3)'s return value as a boolean

with the meaning "a character was found".

strpbrk(3) is just like strchr(3), but searches for multiple characters.
Both functions have a boolean-like return value, which evaluates to true
if a character was found.

A better name for strpbrk(3) would have been strchrs().

Signed-off-by: Alejandro Colomar <alx@kernel.org>

src/: Simplify, using strpbrk(3)

Checking a boolean (actually, a boolean-like pointer) is more readable
than comparing against a length.

This removes the only uses of strcspn(3) in this project.

strpbrk(3) is a simpler call, even though it has a weird name.  It's
just like strchr(3) but searches for several characters.  I'd have named
it strchrs().

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Use strprefix() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Use !strprefix() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/: Use strprefix() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/env.c: sanitize_env(): Use !strprefix() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Use strprefix() instead of its pattern

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Use s=strprefix(s,p)?:s instead of its pattern

This skips an optional prefix.

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/string/strcmp/: strprefix(): Add API

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/, src/: Reduce scope of local variables

Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/sizeof.h: Make sure STRLEN() only accepts string literals

Link: <https://stackoverflow.com/a/79369560/6872717>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

tests/: extend basic groupdel tests

Add additional check for gshadow entry.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

tests/: extend basic groupmod test

Add additional check for gshadow entry.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

tests/: extend basic groupadd test

Add additional check for gshadow entry.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

tests/: extend basic userdel test

Add additional checks for shadow and gshadow entries.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>

tests/: extend basic usermod test

Add additional checks for shadow and gshadow entries.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Dan Lavu <dlavu@redhat.com>