/*
   netgroup.c - NSS lookup functions for netgroup entries

   Copyright (C) 2006 West Consulting
   Copyright (C) 2006-2015 Arthur de Jong
   Copyright (C) 2010 Symas Corporation

   This library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.

   This library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public
   License along with this library; if not, write to the Free Software
   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
   02110-1301 USA
*/

#include "config.h"

#include <stdlib.h>
#include <string.h>
#include <errno.h>

#include "prototypes.h"
#include "common.h"
#include "compat/attrs.h"
#include "common/set.h"

/* function for reading a single result entry */
static nss_status_t read_netgrent_line(TFILE *fp, struct __netgrent *result,
                                       char *buffer, size_t buflen, int *errnop)
{
  int32_t tmpint32;
  int type;
  size_t bufptr = 0;
  /* read netgroup type */
  READ_INT32(fp, type);
  if (type == NSLCD_NETGROUP_TYPE_NETGROUP)
  {
    /* the response is a reference to another netgroup */
    result->type = group_val;
    READ_BUF_STRING(fp, result->val.group);
    return NSS_STATUS_SUCCESS;
  }
  else if (type == NSLCD_NETGROUP_TYPE_TRIPLE)
  {
    /* the response is a host/user/domain triple */
    result->type = triple_val;
    /* read host and revert to NULL on empty string */
    READ_BUF_STRING(fp, result->val.triple.host);
#ifdef NSS_FLAVOUR_GLIBC
    if (result->val.triple.host[0] == '\0')
    {
      result->val.triple.host = NULL;
      bufptr--; /* free unused space */
    }
#endif /* NSS_FLAVOUR_GLIBC */
    /* read user and revert to NULL on empty string */
    READ_BUF_STRING(fp, result->val.triple.user);
#ifdef NSS_FLAVOUR_GLIBC
    if (result->val.triple.user[0] == '\0')
    {
      result->val.triple.user = NULL;
      bufptr--; /* free unused space */
    }
#endif /* NSS_FLAVOUR_GLIBC */
    /* read domain and revert to NULL on empty string */
    READ_BUF_STRING(fp, result->val.triple.domain);
#ifdef NSS_FLAVOUR_GLIBC
    if (result->val.triple.domain[0] == '\0')
    {
      result->val.triple.domain = NULL;
      bufptr--; /* free unused space */
    }
#endif /* NSS_FLAVOUR_GLIBC */
    return NSS_STATUS_SUCCESS;
  }
  else if (type == NSLCD_NETGROUP_TYPE_END)
    /* make NSS_NAME(getnetgrent_r)() indicate the end of the netgroup */
    return NSS_STATUS_RETURN;
  /* we got something unexpected */
  ERROR_OUT_NOSUCCESS(fp);
  return NSS_STATUS_UNAVAIL;
}

#ifdef NSS_FLAVOUR_GLIBC

/* thread-local file pointer to an ongoing request */
static TLS TFILE *netgrentfp;

/* start a request to get a netgroup by name */
nss_status_t NSS_NAME(setnetgrent)(const char *group,
                                   struct __netgrent UNUSED(*result))
{
  /* we cannot use NSS_SETENT() here because we have a parameter that is only
     available in this function */
  int32_t tmpint32;
  int errnocp;
  int *errnop = &errnocp;
  NSS_EXTRA_DEFS
  NSS_AVAILCHECK;
  /* check parameter */
  if ((group == NULL) || (group[0] == '\0'))
    return NSS_STATUS_UNAVAIL;
  /* open a new stream and write the request */
  NSLCD_REQUEST(netgrentfp, NSLCD_ACTION_NETGROUP_BYNAME,
                WRITE_STRING(netgrentfp, group));
  /* read response code */
  READ_RESPONSE_CODE(netgrentfp);
  SKIP_STRING(netgrentfp); /* netgroup name */
  return NSS_STATUS_SUCCESS;
}

/* get a single netgroup tuple from the stream */
nss_status_t NSS_NAME(getnetgrent_r)(struct __netgrent *result,
                                     char *buffer, size_t buflen, int *errnop)
{
  nss_status_t retv;
  NSS_EXTRA_DEFS;
  NSS_AVAILCHECK;
  NSS_BUFCHECK;
  /* check that we have a valid file descriptor */
  if (netgrentfp == NULL)
    return NSS_STATUS_UNAVAIL;
  /* prepare for buffer errors */
  tio_mark(netgrentfp);
  /* read a response */
  retv = read_netgrent_line(netgrentfp, result, buffer, buflen, errnop);
  /* check read result */
  if (retv == NSS_STATUS_TRYAGAIN)
  {
    /* if we have a full buffer try to reset the stream */
    if (tio_reset(netgrentfp))
    {
      /* reset failed, we close and give up with a permanent error
         because we cannot retry just the getent() call because it
         may not be only the first entry that failed */
      tio_close(netgrentfp);
      netgrentfp = NULL;
      *errnop = EINVAL;
      return NSS_STATUS_UNAVAIL;
    }
  }
  else if ((retv != NSS_STATUS_SUCCESS) && (retv != NSS_STATUS_RETURN))
    netgrentfp = NULL; /* file should be closed by now */
  return retv;
}

/* close the stream opened with setnetgrent() above */
nss_status_t NSS_NAME(endnetgrent)(struct __netgrent UNUSED(*result))
{
  NSS_ENDENT(netgrentfp);
}

#endif /* NSS_FLAVOUR_GLIBC */

#ifdef NSS_FLAVOUR_SOLARIS

/* this is the custom backend structure for the {set,get,end}ent() functions */
struct setnetgrent_backend {
  nss_backend_op_t *ops; /* function-pointer table */
  int n_ops;             /* number of function pointers */
  TFILE *fp;             /* the file pointer for {set,get,end}ent() functions */
  SET *seen_groups;      /* netgroups seen, for loop detection */
  SET *unseen_groups;    /* netgroups that need to be chased */
};

/* easy way to get sets from back-end */
#define NETGROUP_BE(be) ((struct setnetgrent_backend*)(be))

/* access arguments */
#define SETNETGRENT_ARGS(args) ((struct nss_setnetgrent_args *)(args))
#define GETNETGRENT_ARGS(args) ((struct nss_getnetgrent_args *)(args))
#define INNETGR_ARGS(ARGS)     ((struct nss_innetgr_args *)(args))

/* return a netgroup that has not been traversed (the caller should use
   free() to free it) */
static char *find_unseen_netgroup(struct setnetgrent_backend *be)
{
  char *group;
  while (1)
  {
    group = set_pop(be->unseen_groups);
    if (group == NULL)
      return NULL;
    if (!set_contains(be->seen_groups, group))
      return group;
    free(group);
  }
}

static nss_status_t start_netgroup_request(struct setnetgrent_backend *be,
                                           const char *group)
{
  /* we cannot use NSS_SETENT() here because we have a parameter that is only
     available in this function */
  int32_t tmpint32;
  int *errnop = &errno;
  /* check parameter */
  if ((group == NULL) || (group[0] == '\0'))
    return NSS_STATUS_UNAVAIL;
  set_add(be->seen_groups, group);
  /* open a new stream and write the request */
  NSLCD_REQUEST(NETGROUP_BE(be)->fp, NSLCD_ACTION_NETGROUP_BYNAME,
                WRITE_STRING(NETGROUP_BE(be)->fp, group));
  /* read response code */
  READ_RESPONSE_CODE(NETGROUP_BE(be)->fp);
  SKIP_STRING(NETGROUP_BE(be)->fp); /* netgroup name */
  return NSS_STATUS_SUCCESS;
}

static nss_status_t netgroup_setnetgrent_setnetgrent(nss_backend_t UNUSED(*be),
                                                     void UNUSED(*args))
{
  return NSS_STATUS_SUCCESS;
}

static nss_status_t netgroup_setnetgrent_getnetgrent(nss_backend_t *be,
                                                     void *args)
{
  struct __netgrent result;
  nss_status_t retv;
  /* check that we have a valid file descriptor */
  if (NETGROUP_BE(be)->fp == NULL)
    return NSS_STATUS_UNAVAIL;
  /* go over the result lines */
  while (1)
  {
    /* prepare for buffer errors */
    tio_mark(NETGROUP_BE(be)->fp);
    /* read single line from the netgroup information */
    retv = read_netgrent_line(NETGROUP_BE(be)->fp, &result, GETNETGRENT_ARGS(args)->buffer,
                              GETNETGRENT_ARGS(args)->buflen, &errno);
    /* check read result */
    if ((retv == NSS_STATUS_SUCCESS) && (result.type == group_val))
    {
      /* a netgroup nested within the current netgroup */
      set_add(NETGROUP_BE(be)->unseen_groups, result.val.group);
    }
    else if ((retv == NSS_STATUS_SUCCESS) && (result.type == triple_val))
    {
      /* a netgroup line we can return */
      GETNETGRENT_ARGS(args)->status = NSS_NETGR_FOUND;
      GETNETGRENT_ARGS(args)->retp[NSS_NETGR_MACHINE] = (char *)result.val.triple.host;
      GETNETGRENT_ARGS(args)->retp[NSS_NETGR_USER] = (char *)result.val.triple.user;
      GETNETGRENT_ARGS(args)->retp[NSS_NETGR_DOMAIN] = (char *)result.val.triple.domain;
      return NSS_STATUS_SUCCESS;
    }
    else if (retv == NSS_STATUS_TRYAGAIN)
    {
      /* we have a full buffer, try to reset the stream */
      if (tio_reset(NETGROUP_BE(be)->fp))
      {
        /* reset failed, we close and give up with a permanent error
           because we cannot retry just the getent() call because it
           may not be only the first entry that failed */
        tio_close(NETGROUP_BE(be)->fp);
        NETGROUP_BE(be)->fp = NULL;
        return NSS_STATUS_UNAVAIL;
      }
      GETNETGRENT_ARGS(args)->status = NSS_NETGR_NOMEM;
      return NSS_STATUS_TRYAGAIN;
    }
    else if (retv == NSS_STATUS_RETURN)
    {
      /* done with the current netgroup */
      tio_close(NETGROUP_BE(be)->fp);
      NETGROUP_BE(be)->fp = NULL;
      /* explore nested netgroups, if any */
      while (retv != NSS_STATUS_SUCCESS)
      {
        /* find a nested netgroup to pursue further */
        char *group = find_unseen_netgroup(NETGROUP_BE(be));
        if (group == NULL)
        {
          /* no more netgroups to explore */
          GETNETGRENT_ARGS(args)->status = NSS_NETGR_NO;
          return NSS_STATUS_SUCCESS;
        }
        /* start a new search with this netgroup */
        retv = start_netgroup_request(NETGROUP_BE(be), group);
        free(group);
      }
    }
    else
    {
      /* some error occurred when reading the line (stream should be closed by now) */
      NETGROUP_BE(be)->fp = NULL;
      GETNETGRENT_ARGS(args)->status = NSS_NETGR_NO;
      return retv;
    }
  }
}

static nss_status_t netgroup_setnetgrent_endnetgrent(nss_backend_t *be,
                                                     void UNUSED(*args))
{
  NSS_ENDENT(NETGROUP_BE(be)->fp);
}

static nss_status_t netgroup_setnetgrent_destructor(nss_backend_t *be,
                                                    void *UNUSED(args))
{
  struct setnetgrent_backend *ngbe = (struct setnetgrent_backend *)be;
  if (ngbe->fp != NULL)
    (void)tio_close(ngbe->fp);
  set_free(ngbe->seen_groups);
  set_free(ngbe->unseen_groups);
  free(ngbe);
  return NSS_STATUS_SUCCESS;
}

static nss_backend_op_t netgroup_setnetgrent_ops[] = {
  netgroup_setnetgrent_destructor,
  netgroup_setnetgrent_endnetgrent,
  netgroup_setnetgrent_setnetgrent,
  netgroup_setnetgrent_getnetgrent,
};

static nss_status_t netgroup_setnetgrent_constructor(nss_backend_t UNUSED(*be),
                                                     void *args)
{
  struct setnetgrent_backend *ngbe;
  nss_status_t retv;
  NSS_AVAILCHECK;
  SETNETGRENT_ARGS(args)->iterator = NULL; /* initialize */
  /* allocate a back-end specific to this request */
  ngbe = (struct setnetgrent_backend *)malloc(sizeof(struct setnetgrent_backend));
  if (ngbe == NULL)
    return NSS_STATUS_UNAVAIL;
  ngbe->ops = netgroup_setnetgrent_ops;
  ngbe->n_ops = sizeof(netgroup_setnetgrent_ops) / sizeof(nss_backend_op_t);
  ngbe->fp = NULL;
  ngbe->seen_groups = set_new();
  ngbe->unseen_groups = set_new();
  /* start the first search */
  retv = start_netgroup_request(ngbe, SETNETGRENT_ARGS(args)->netgroup);
  if (retv != NSS_STATUS_SUCCESS)
  {
    netgroup_setnetgrent_destructor((nss_backend_t *)ngbe, args);
    return retv;
  }
  /* return the new back-end */
  SETNETGRENT_ARGS(args)->iterator = (nss_backend_t *)ngbe;
  return NSS_STATUS_SUCCESS;
}

static nss_status_t netgroup_innetgr(nss_backend_t UNUSED(*be),
                                     void *args)
{
  unsigned int i;
  nss_status_t res = NSS_SUCCESS;
  struct nss_setnetgrent_args set_args;
  struct nss_getnetgrent_args get_args;
  const char *host = NULL, *user = NULL, *domain = NULL;
  /* get the host, user and domain arguments */
  if ((args == NULL) ||
      (INNETGR_ARGS(args)->arg[NSS_NETGR_MACHINE].argc > 1) ||
      (INNETGR_ARGS(args)->arg[NSS_NETGR_USER].argc > 1) ||
      (INNETGR_ARGS(args)->arg[NSS_NETGR_DOMAIN].argc > 1))
    return NSS_STATUS_UNAVAIL;
  if (INNETGR_ARGS(args)->arg[NSS_NETGR_MACHINE].argc == 1)
    host = INNETGR_ARGS(args)->arg[NSS_NETGR_MACHINE].argv[0];
  if (INNETGR_ARGS(args)->arg[NSS_NETGR_USER].argc == 1)
    user = INNETGR_ARGS(args)->arg[NSS_NETGR_USER].argv[0];
  if (INNETGR_ARGS(args)->arg[NSS_NETGR_DOMAIN].argc == 1)
    domain = INNETGR_ARGS(args)->arg[NSS_NETGR_DOMAIN].argv[0];
  /* go over the list of provided groups */
  INNETGR_ARGS(args)->status = NSS_NETGR_NO;
  for (i = 0; i < INNETGR_ARGS(args)->groups.argc; i++)
  {
    /* prepare calling {set,get,end}netgrent() */
    set_args.netgroup = INNETGR_ARGS(args)->groups.argv[i];
    res = netgroup_setnetgrent_constructor(NULL, &set_args);
    if (res != NSS_SUCCESS)
      break;
    /* we skip setnetgrent because it does nothing in our case */
    /* call getnetgrent until we find an error, no more or a match */
    while (1)
    {
      res = netgroup_setnetgrent_getnetgrent(set_args.iterator, &get_args);
      /* see if we have an error or are at the end of the results */
      if ((res != NSS_SUCCESS) || (get_args.status != NSS_NETGR_FOUND))
        break;
      /* see if we have a match */
      if (((host == NULL) || (strcmp(host, get_args.retp[NSS_NETGR_MACHINE]) == 0)) &&
          ((user == NULL) || (strcmp(user, get_args.retp[NSS_NETGR_USER]) == 0)) &&
          ((domain == NULL) || (strcmp(domain, get_args.retp[NSS_NETGR_DOMAIN]) == 0)))
      {
        INNETGR_ARGS(args)->status = NSS_NETGR_FOUND;
        break;
      }
    }
    (void)netgroup_setnetgrent_endnetgrent(set_args.iterator, NULL);
    (void)netgroup_setnetgrent_destructor(set_args.iterator, NULL);
    if (res != NSS_SUCCESS)
      break;
    /* check if we have a match */
    if (INNETGR_ARGS(args)->status == NSS_NETGR_FOUND)
      break;
  }
  return res;
}

static nss_backend_op_t netgroup_ops[] = {
  nss_ldap_destructor,
  NULL,
  NULL,
  NULL,
  netgroup_innetgr,
  netgroup_setnetgrent_constructor
};

nss_backend_t *NSS_NAME(netgroup_constr)(const char UNUSED(*db_name),
                                         const char UNUSED(*src_name),
                                         const char UNUSED(*cfg_args))
{
  return nss_ldap_constructor(netgroup_ops, sizeof(netgroup_ops));
}

#endif /* NSS_FLAVOUR_SOLARIS */