xref: /titanic_50/usr/src/cmd/nscd/nscd_switch.c (revision 8c4f9701439555b41fbfe7848508f53b52166007)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <stdlib.h>	/* getenv() */
28 #include <assert.h>
29 #include <unistd.h>
30 #include <string.h>
31 #include <pthread.h>
32 #include <dlfcn.h>
33 #include <nss_dbdefs.h>
34 #include <exec_attr.h>
35 #include <gssapi/gssapi.h>
36 #include "nscd_door.h"
37 #include "nscd_switch.h"
38 #include "nscd_log.h"
39 #include "nscd_frontend.h"
40 
41 #pragma weak nss_search = _nss_search
42 #define	nss_search	_nss_search
43 
44 extern rwlock_t nscd_smf_service_state_lock;
45 
46 /* nscd id: main, forker, or child */
47 extern int _whoami;
48 
49 static int
50 retry_test(nss_status_t res, int n, struct __nsw_lookup_v1 *lkp)
51 {
52 	if (res != NSS_TRYAGAIN && res !=  NSS_NISSERVDNS_TRYAGAIN) {
53 		if (res == NSS_SUCCESS) {
54 			__NSW_UNPAUSE_ACTION(lkp->actions[__NSW_TRYAGAIN]);
55 			__NSW_UNPAUSE_ACTION(
56 			    lkp->actions[__NSW_NISSERVDNS_TRYAGAIN]);
57 		}
58 		return (0);
59 	}
60 
61 	if ((res == NSS_TRYAGAIN &&
62 	    lkp->actions[__NSW_TRYAGAIN] == __NSW_TRYAGAIN_FOREVER) ||
63 	    (res == NSS_NISSERVDNS_TRYAGAIN &&
64 	    lkp->actions[__NSW_NISSERVDNS_TRYAGAIN] == __NSW_TRYAGAIN_FOREVER))
65 		return (1);
66 
67 	if (res == NSS_TRYAGAIN &&
68 	    lkp->actions[__NSW_TRYAGAIN] == __NSW_TRYAGAIN_NTIMES)
69 		if (n <= lkp->max_retries)
70 			return (1);
71 		else {
72 			lkp->actions[__NSW_TRYAGAIN] = __NSW_TRYAGAIN_PAUSED;
73 			return (0);
74 		}
75 
76 	if (res == NSS_NISSERVDNS_TRYAGAIN &&
77 	    lkp->actions[__NSW_NISSERVDNS_TRYAGAIN] == __NSW_TRYAGAIN_NTIMES)
78 		if (n <= lkp->max_retries)
79 			return (1);
80 		else {
81 			lkp->actions[__NSW_NISSERVDNS_TRYAGAIN] =
82 			    __NSW_TRYAGAIN_PAUSED;
83 			return (0);
84 		}
85 
86 	return (0);
87 }
88 
89 static thread_key_t loopback_key = THR_ONCE_KEY;
90 typedef struct lb_key {
91 	int		srci;
92 	int		dbi;
93 	int		fnum;
94 	int		*lb_flagp;
95 } lb_key_t;
96 
97 static int
98 set_loopback_key(lb_key_t *key) {
99 
100 	int		rc;
101 
102 	rc = thr_keycreate_once(&loopback_key, NULL);
103 	/* set key if not already set */
104 	if (rc == 0 && pthread_getspecific(loopback_key) == NULL)
105 		rc = thr_setspecific(loopback_key, key);
106 
107 	return (rc);
108 }
109 
110 static lb_key_t *
111 get_loopback_key(void) {
112 
113 	char		*me = "get_loopback_key";
114 	lb_key_t	*k = NULL;
115 
116 	k = pthread_getspecific(loopback_key);
117 
118 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
119 	(me, "get loopback key, key = %p\n", k);
120 
121 	return (k);
122 }
123 
124 static void
125 clear_loopback_key(lb_key_t *key) {
126 
127 	char		*me = "clear_loopback_key";
128 
129 	if (loopback_key != THR_ONCE_KEY && key != NULL) {
130 		/*
131 		 * key->lb_flagp points to the location of the
132 		 * flag, check_flag, in the stack where it was
133 		 * first set; clearing the flag tells that
134 		 * stack the loopback error has been resolved
135 		 */
136 		*key->lb_flagp = 0;
137 		(void) thr_setspecific(loopback_key, NULL);
138 	}
139 
140 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
141 	(me, "key %p cleared\n", key);
142 }
143 
144 static thread_key_t initf_key = THR_ONCE_KEY;
145 
146 static int
147 set_initf_key(void *pbuf) {
148 
149 	int		rc;
150 
151 	rc = thr_keycreate_once(&initf_key, NULL);
152 	if (rc == 0)
153 		rc = thr_setspecific(initf_key, pbuf);
154 
155 	return (rc);
156 }
157 
158 static void *
159 get_initf_key(void) {
160 
161 	char		*me = "get_initf_key";
162 	void		*pbuf;
163 
164 	pbuf = pthread_getspecific(initf_key);
165 
166 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
167 	(me, "got initf pbuf, key = %p\n", pbuf);
168 
169 	return (pbuf);
170 }
171 
172 static void
173 clear_initf_key(void) {
174 
175 	char		*me = "clear_initf_key";
176 
177 	(void) thr_setspecific(initf_key, NULL);
178 
179 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
180 	(me, "initf pbuf cleared\n");
181 }
182 
183 /*
184  * Call the input initf function to extract the
185  * NSS front end parameters and examine them to
186  * determine if an NSS lookup is to be performed
187  * on a regular or a pseudo (called from compat
188  * backend) database. Then set the necessary
189  * parameters for later data structures creation
190  * and processing.
191  */
192 static nscd_rc_t
193 getparams(
194 	int			search_fnum,
195 	nss_db_initf_t		initf,
196 	nscd_nsw_params_t	*params)
197 {
198 
199 	nscd_rc_t	rc = NSCD_SUCCESS;
200 	nss_db_params_t	*p;
201 	int		j;
202 	char		*dbn;
203 	const char	*n;
204 	char		*me = "getparams";
205 
206 	p = &params->p;
207 	(void) memset(p, 0, sizeof (*p));
208 	(*initf)(p);
209 	params->dbi = -1;
210 	params->cfgdbi = -1;
211 	params->compati = -1;
212 	params->dnsi = -1;
213 
214 	/* map database name to index */
215 	n = p->name;
216 	for (j = 0; j < NSCD_NUM_DB; j++) {
217 		dbn = NSCD_NSW_DB_NAME(j);
218 		if (*n != *dbn)
219 			continue;
220 		if (strcmp(n, dbn) == 0) {
221 			params->dbi = j;
222 			if (*n != 'h' && *n != 'i' && *n != 's' && *n != 'a')
223 				break;
224 			if (strcmp(n, NSS_DBNAM_HOSTS) == 0 &&
225 			    search_fnum == NSS_DBOP_HOSTS_BYNAME)
226 				params->dnsi = 0;
227 			else if (strcmp(n, NSS_DBNAM_IPNODES) == 0 &&
228 			    search_fnum == NSS_DBOP_IPNODES_BYNAME)
229 				params->dnsi = 1;
230 			else if (strcmp(n, NSS_DBNAM_SHADOW) == 0)
231 				params->privdb = 1;
232 			break;
233 		}
234 	}
235 
236 	/*
237 	 * use the switch policy for passwd_compat or
238 	 * group_compat?
239 	 */
240 	if (p->config_name != NULL) {
241 
242 		n = p->config_name;
243 		for (j = 0; j < NSCD_NUM_DB; j++) {
244 			dbn = NSCD_NSW_DB_NAME(j);
245 			if (*n == *dbn) {
246 				if (strcmp(n, dbn) == 0) {
247 					params->cfgdbi = j;
248 					break;
249 				}
250 			}
251 		}
252 	}
253 
254 	/* map the database name to the pseudo database index */
255 	if (params->cfgdbi != -1) {
256 		if (strstr(p->config_name, "_compat") != NULL) {
257 			n = p->name;
258 			for (j = params->cfgdbi; j < NSCD_NUM_DB; j++) {
259 				dbn = NSCD_NSW_DB_NAME(j);
260 				if (*n == *dbn) {
261 					if (strcmp(n, dbn) == 0) {
262 						params->compati = j;
263 						break;
264 					}
265 				}
266 			}
267 		}
268 	}
269 
270 	/*
271 	 * if unsupported database, let caller determine what to do next
272 	 */
273 	if (params->dbi == -1) {
274 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
275 		(me, "unsupported database: %s\n", p->name);
276 		return (NSCD_CFG_UNSUPPORTED_SWITCH_DB);
277 	}
278 
279 	return (rc);
280 }
281 
282 static void
283 nscd_initf(nss_db_params_t	*p)
284 {
285 	nss_pheader_t		*pbuf;
286 	nssuint_t		off;
287 	nss_dbd_t		*pdbd;
288 	char			*me = "nscd_initf";
289 
290 	pbuf = (nss_pheader_t *)get_initf_key();
291 	if (pbuf == NULL) {
292 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
293 		(me, "ERROR: initf key not set\n");
294 		return;
295 	}
296 
297 	if (pbuf->dbd_len <= sizeof (nss_dbd_t)) {
298 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
299 		(me, "invalid db front params data ? dbd_len = %d\n",
300 		    pbuf->dbd_len);
301 		return;
302 	}
303 
304 	off = pbuf->dbd_off;
305 	pdbd = (nss_dbd_t *)((void *)((char *)pbuf + off));
306 
307 	p->name = (char *)pdbd + pdbd->o_name;
308 	p->config_name = (char *)pdbd + pdbd->o_config_name;
309 	p->default_config = (char *)pdbd + pdbd->o_default_config;
310 	p->flags = (enum nss_dbp_flags)pdbd->flags;
311 	(void) memcpy(&p->private, &pbuf->nscdpriv, sizeof (p->private));
312 
313 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
314 	(me, "db frontend params: name =%s, config_name = %s, "
315 	"default_config = %s, flags = %x\n", p->name,
316 	    (p->config_name && *p->config_name != '\0' ?
317 	    p->config_name : "<NOT SPECIFIED>"),
318 	    (p->default_config && *p->default_config != '\0' ?
319 	    p->default_config : "<NOT SPECIFIED>"),
320 	    p->flags);
321 }
322 
323 
324 static void
325 trace_result(
326 	int		dbi,
327 	int		srci,
328 	int		op,
329 	nss_status_t	res,
330 	nss_XbyY_args_t	*arg)
331 {
332 	char	*res_str;
333 	char	*src = "?";
334 	char	*db = "?";
335 	char	*data_str = "<NOT STRING FORMAT>";
336 	int	data_len = 0;
337 	char	*me = "trace_result";
338 
339 	switch (res) {
340 	case NSS_SUCCESS:
341 		res_str = "NSS_SUCCESS";
342 		break;
343 	case NSS_NOTFOUND:
344 		res_str = "NSS_NOTFOUND";
345 		break;
346 	case NSS_UNAVAIL:
347 		res_str = "NSS_UNAVAIL";
348 		break;
349 	case NSS_TRYAGAIN:
350 		res_str = "NSS_TRYAGAIN";
351 		break;
352 	case NSS_NISSERVDNS_TRYAGAIN:
353 		res_str = "NSS_NISSERVDNS_TRYAGAIN";
354 		break;
355 	default:
356 		res_str = "UNKNOWN STATUS";
357 		break;
358 	}
359 
360 	if (dbi != -1)
361 		db = NSCD_NSW_DB_NAME(dbi);
362 	if (srci != -1)
363 		src = NSCD_NSW_SRC_NAME(srci);
364 
365 	if (arg->buf.result == NULL) {
366 		data_str = arg->buf.buffer;
367 		data_len = arg->returnlen;
368 	}
369 
370 	if (res == NSS_SUCCESS) {
371 		_nscd_logit(me, "%s: database: %s, operation: %d, "
372 		    "source: %s returned >>%s<<, length = %d\n",
373 		    res_str, db, op, src, data_str, data_len);
374 		return;
375 	}
376 
377 	_nscd_logit(me, "%s: database: %s, operation: %d, source: %s, "
378 	    "erange= %d, herrno: %s (%d)\n",
379 	    res_str, db, op, src, arg->erange, hstrerror(arg->h_errno),
380 	    arg->h_errno);
381 }
382 
383 /*
384  * Determine if a request should be done locally in the getXbyY caller's
385  * process. Return none zero if yes, 0 otherwise. This should be called
386  * before the switch engine steps through the backends/sources.
387  * This function returns 1 if:
388  *   -- the database is exec_attr and the search_flag is GET_ALL
389  */
390 static int
391 try_local(
392 	int			dbi,
393 	void			*arg)
394 {
395 	struct nss_XbyY_args	*ap = (struct nss_XbyY_args *)arg;
396 	_priv_execattr		*ep;
397 	int			rc = 0;
398 	char			*me = "try_local";
399 
400 	if (strcmp(NSCD_NSW_DB_NAME(dbi), NSS_DBNAM_EXECATTR) == 0) {
401 		if ((ep = ap->key.attrp) != NULL && IS_GET_ALL(ep->search_flag))
402 			rc = 1;
403 	}
404 
405 	if (rc != 0) {
406 
407 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
408 		(me, "TRYLOCAL: exec_attr:GET_ALL\n");
409 	}
410 
411 	return (rc);
412 }
413 
414 /*
415  * Determine if a request should be done locally in the getXbyY caller's
416  * process. Return none zero if yes, 0 otherwise. This should be called
417  * before the switch engine invokes any backend.
418  * This function returns 1 if:
419  *   -- the database is shadow and the source is compat
420  */
421 static int
422 try_local2(
423 	int	dbi,
424 	int	srci)
425 {
426 	int	rc = 0;
427 	char	*me = "try_local2";
428 
429 	if (*NSCD_NSW_DB_NAME(dbi) == 's' &&
430 	    strcmp(NSCD_NSW_DB_NAME(dbi), NSS_DBNAM_SHADOW) == 0) {
431 		if (strcmp(NSCD_NSW_SRC_NAME(srci), "compat") == 0)
432 			rc = 1;
433 	}
434 
435 	if (rc != 0) {
436 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
437 		(me, "TRYLOCAL: database: shadow, source: %s\n",
438 		    NSCD_NSW_SRC_NAME(srci));
439 	}
440 
441 	return (rc);
442 }
443 
444 static nscd_rc_t
445 get_lib_func(void **handle, void **func, mutex_t *lock,
446 	char *lib, char *name, void **func_p)
447 {
448 	char	*me = "get_lib_func";
449 	void	*sym;
450 
451 	if (func_p != NULL && *handle != NULL && *func != NULL) {
452 		*func_p = *func;
453 		return (NSCD_SUCCESS);
454 	}
455 
456 	(void) mutex_lock(lock);
457 
458 	/* close the handle if requested */
459 	if (func_p == NULL) {
460 		if (*handle != NULL) {
461 			(void) dlclose(*handle);
462 			*handle = NULL;
463 			*func = NULL;
464 		}
465 		(void) mutex_unlock(lock);
466 		return (NSCD_SUCCESS);
467 	}
468 
469 	if (*handle != NULL && *func != NULL) {
470 		*func_p = *func;
471 		(void) mutex_unlock(lock);
472 		return (NSCD_SUCCESS);
473 	}
474 
475 	if (*handle == NULL) {
476 		*handle = dlopen(lib, RTLD_LAZY);
477 		if (*handle == NULL) {
478 			_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_ERROR)
479 			(me, "unable to dlopen %s\n", lib);
480 			(void) mutex_unlock(lock);
481 			return (NSCD_CFG_DLOPEN_ERROR);
482 		}
483 	}
484 
485 	if ((sym = dlsym(*handle, name)) == NULL) {
486 
487 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_ERROR)
488 		(me, "unable to find symbol %s:%s\n", lib, name);
489 		(void) mutex_unlock(lock);
490 		return (NSCD_CFG_DLSYM_ERROR);
491 	} else {
492 		*func_p = sym;
493 		*func = sym;
494 	}
495 
496 	(void) mutex_unlock(lock);
497 	return (NSCD_SUCCESS);
498 }
499 
500 static nscd_rc_t
501 get_libc_nss_search(void **func_p)
502 {
503 	static void	*handle = NULL;
504 	static void	*func = NULL;
505 	static mutex_t	lock = DEFAULTMUTEX;
506 
507 	return (get_lib_func(&handle, &func, &lock,
508 	    "libc.so", "nss_search", func_p));
509 }
510 
511 static nscd_rc_t
512 get_gss_func(void **func_p)
513 {
514 	static void	*handle = NULL;
515 	static void	*func = NULL;
516 	static mutex_t	lock = DEFAULTMUTEX;
517 
518 	return (get_lib_func(&handle, &func, &lock,
519 	    "libgss.so", "gss_inquire_cred", func_p));
520 }
521 
522 static nscd_rc_t
523 get_sldap_shadow_func(void **func_p)
524 {
525 	static void	*handle = NULL;
526 	static void	*func = NULL;
527 	static mutex_t	lock = DEFAULTMUTEX;
528 
529 	return (get_lib_func(&handle, &func, &lock,
530 	    "libsldap.so", "__ns_ldap_is_shadow_update_enabled",
531 	    func_p));
532 }
533 
534 /*
535  * get_dns_funcs returns pointers to gethostbyname functions in the
536  * dynamically loaded nss_dns & nss_mdns modules that return host
537  * lookup results along with the TTL value in the DNS resource
538  * records. The dnsi parameter indicates whether the lookup database
539  * is hosts(0) or ipnodes(1). The srcname parameter identifies the DNS
540  * module: dns/mdns and the function returns the address of the specific
541  * gethostbyname function in func_p variable.
542  */
543 static nscd_rc_t
544 get_dns_funcs(int dnsi, nss_status_t (**func_p)(), const char *srcname)
545 {
546 	int		si;
547 	void		**funcpp;
548 	static void	*handle[2] = { NULL, NULL };
549 	static mutex_t	func_lock[2] = { DEFAULTMUTEX, DEFAULTMUTEX };
550 	static void 	*func[2][2] = {{NULL, NULL}, {NULL, NULL}};
551 	static const char	*lib[2] = { "nss_dns.so.1", "nss_mdns.so.1" };
552 	static const char 	*func_name[2][2] =
553 		{{ "_nss_get_dns_hosts_name", "_nss_get_dns_ipnodes_name" },
554 		{ "_nss_get_mdns_hosts_name", "_nss_get_mdns_ipnodes_name" }};
555 
556 	/* source index: 0 = dns, 1 = mdns */
557 	if (strcmp(srcname, "dns") == 0)
558 		si = 0;
559 	else
560 		si = 1;
561 
562 	/*
563 	 * function index (func[si][dnsi]):
564 	 * [0,0] = dns/hosts, [0,1] = dns/ipnodes,
565 	 * [1,0] = mdns/hosts, [1,1] = mdns/ipnodes
566 	 */
567 
568 	if (dnsi < 0) { /* close handle */
569 		funcpp = NULL;
570 		(void) mutex_lock(&func_lock[si]);
571 		func[si][0] = NULL;
572 		func[si][1] = NULL;
573 		(void) mutex_unlock(&func_lock[si]);
574 	} else
575 		funcpp = (void **)func_p;
576 
577 	return (get_lib_func(&handle[si], &func[si][dnsi], &func_lock[si],
578 	    (char *)lib[si], (char *)func_name[si][dnsi], funcpp));
579 }
580 
581 static nss_status_t
582 search_dns_withttl(nscd_sw_return_t *swret, const char *srcname, int dnsi)
583 {
584 	nss_status_t	(*func)();
585 	nss_status_t	res = NSS_UNAVAIL;
586 	nscd_rc_t	rc;
587 
588 	swret->noarg = 0;
589 	if (strcmp(srcname, "dns") != 0 && strcmp(srcname, "mdns") != 0)
590 		return (NSS_ERROR);
591 
592 	rc = get_dns_funcs(dnsi, &func, srcname);
593 	if (rc == NSCD_SUCCESS) {
594 		/*
595 		 * data_len in the packed buf header may be changed
596 		 * by the dns or mdns backend, reset it just in
597 		 * case
598 		 */
599 		((nss_pheader_t *)swret->pbuf)->data_len =
600 		    swret->datalen;
601 		res = (func)(NULL, &swret->pbuf, &swret->pbufsiz);
602 	}
603 	return (res);
604 }
605 
606 /*
607  * Returns a flag to indicate if needs to fall back to the
608  * main nscd when a per-user lookup failed with rc NSS_NOTFOUND.
609  */
610 static int
611 set_fallback_flag(char *srcname, nss_status_t rc)
612 {
613 	char	*me = "set_fallback_flag";
614 	if (strcmp(srcname, "ldap") == 0 && rc == NSS_NOTFOUND) {
615 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
616 		(me, "NSS_NOTFOUND (ldap): fallback to main nscd "
617 		"may be needed\n");
618 		return (1);
619 	}
620 	return (0);
621 }
622 
623 nss_status_t
624 nss_search(nss_db_root_t *rootp, nss_db_initf_t initf, int search_fnum,
625 	void *search_args)
626 {
627 	char			*me = "nss_search";
628 	nss_status_t		res = NSS_UNAVAIL;
629 	nscd_nsw_state_t	*s = NULL;
630 	int			n_src;
631 	unsigned int		status_vec = 0;
632 	int			dbi, srci = -1;
633 	int			check_loopback = 0;
634 	int			state_thr = 0;
635 	lb_key_t		key, *k = NULL;
636 	nss_db_root_t		root_db;
637 	nscd_nsw_params_t	params;
638 	nscd_sw_return_t	*swret;
639 
640 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
641 	(me, "rootp = %p, initf = %p, search_fnum = %d, "
642 	    "search_args = %p\n", rootp, initf,
643 	    search_fnum, search_args);
644 
645 	NSCD_SW_STATS_G.lookup_request_received_g++;
646 	NSCD_SW_STATS_G.lookup_request_in_progress_g++;
647 	NSCD_SW_STATS_G.lookup_request_queued_g++;
648 
649 	/* determine db index, cfg db index, etc */
650 	if (getparams(search_fnum, initf, &params) ==
651 	    NSCD_CFG_UNSUPPORTED_SWITCH_DB) {
652 		/*
653 		 * if unsupported database and the request is from the
654 		 * the door, tell the door client to try it locally
655 		 */
656 		if (initf == nscd_initf) {
657 			res = NSS_TRYLOCAL;
658 			goto error_exit;
659 		} else { /* otherwise, let libc:nss_search() handle it */
660 			nss_status_t	(*func)();
661 
662 			if (get_libc_nss_search((void **)&func) ==
663 			    NSCD_SUCCESS)
664 				return ((func)(rootp, initf, search_fnum,
665 				    search_args));
666 			else
667 				goto error_exit;
668 		}
669 	}
670 	dbi = params.dbi;
671 
672 	/* get address of the switch engine return data area */
673 	if (initf == nscd_initf) {
674 		swret = (nscd_sw_return_t *)params.p.private;
675 		swret->srci = -1;
676 	} else {
677 		swret = NULL;
678 		params.dnsi = -1;
679 	}
680 
681 	/*
682 	 * for door request that should be processed by the client,
683 	 * send it back with status NSS_TRYLOCAL
684 	 */
685 	if (initf == nscd_initf && try_local(dbi, search_args) == 1) {
686 		res = NSS_TRYLOCAL;
687 		goto error_exit;
688 	}
689 
690 	NSCD_SW_STATS(dbi).lookup_request_received++;
691 	NSCD_SW_STATS(dbi).lookup_request_in_progress++;
692 	NSCD_SW_STATS(dbi).lookup_request_queued++;
693 
694 	/* if lookup not enabled, return NSS_UNAVAIL  */
695 	if (!(NSCD_SW_CFG_G.enable_lookup_g == nscd_true &&
696 	    NSCD_SW_CFG(dbi).enable_lookup == nscd_true)) {
697 
698 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
699 		(me, "lookup not enabled for %s\n", NSCD_NSW_DB_NAME(dbi));
700 
701 		goto error_exit;
702 	}
703 
704 	/* determine if loopback checking is configured */
705 	if (NSCD_SW_CFG_G.enable_loopback_checking_g == nscd_true &&
706 	    NSCD_SW_CFG(dbi).enable_loopback_checking == nscd_true) {
707 		check_loopback = 1;
708 
709 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
710 		(me, "loopback checking enabled for %s\n",
711 		    NSCD_NSW_DB_NAME(dbi));
712 	}
713 
714 	if (check_loopback) {
715 		k = get_loopback_key();
716 		if (k != NULL) {
717 			if (k->dbi != dbi || k->fnum != search_fnum) {
718 				clear_loopback_key(k);
719 				k = NULL;
720 			}
721 		}
722 	}
723 
724 	if (s == 0) {
725 		nscd_rc_t	rc;
726 
727 		if (check_loopback) {
728 			rc = _nscd_get_nsw_state_thread(&root_db, &params);
729 			state_thr = 1;
730 		} else
731 			rc = _nscd_get_nsw_state(&root_db, &params);
732 
733 		NSCD_SW_STATS_G.lookup_request_queued_g--;
734 		NSCD_SW_STATS(dbi).lookup_request_queued--;
735 
736 		if (rc != NSCD_SUCCESS)
737 				goto error_exit;
738 
739 		s = (nscd_nsw_state_t *)root_db.s;
740 	}
741 
742 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
743 	(me, "database = %s, config = >>%s<<\n", NSCD_NSW_DB_NAME(dbi),
744 	    (*s->nsw_cfg_p)->nsw_cfg_str);
745 
746 	for (n_src = 0;  n_src < s->max_src;  n_src++) {
747 		nss_backend_t		*be = NULL;
748 		nss_backend_op_t	funcp = NULL;
749 		struct __nsw_lookup_v1	*lkp;
750 		int			smf_state;
751 		int			n_loop = 0;
752 		int			max_retry = 10;
753 
754 		res = NSS_UNAVAIL;
755 
756 		if (n_src == 0)
757 			lkp = s->config->lookups;
758 		else
759 			lkp = lkp->next;
760 
761 		/* set the number of max. retries */
762 		if (lkp->actions[__NSW_TRYAGAIN] == __NSW_TRYAGAIN_NTIMES)
763 			max_retry = lkp->max_retries;
764 
765 		srci = (*s->nsw_cfg_p)->src_idx[n_src];
766 		if (swret != NULL)
767 			swret->srci = srci;
768 
769 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
770 		(me, "nsw source = %s\n", NSCD_NSW_SRC_NAME(srci));
771 
772 		/*
773 		 * If no privilege to look up, skip.
774 		 * 'files' requires PRIV_FILE_DAC_READ to read shadow(4) data,
775 		 * 'ldap' requires all zones privilege.
776 		 */
777 		if (params.privdb == 1 && swret != NULL) {
778 			boolean_t	(*is_shadow_update_enabled)();
779 			boolean_t	check_ldap_priv = B_FALSE;
780 
781 			if (strcmp(NSCD_NSW_SRC_NAME(srci), "ldap") == 0) {
782 				if (get_sldap_shadow_func(
783 				    (void **)&is_shadow_update_enabled) ==
784 				    NSCD_SUCCESS &&
785 				    is_shadow_update_enabled()) {
786 					check_ldap_priv = B_TRUE;
787 
788 					/*
789 					 * A peruser nscd doesn't have
790 					 * the privileges to lookup a
791 					 * private database, such as shadow,
792 					 * returns NSS_ALTRETRY to have the
793 					 * main nscd do the job.
794 					 */
795 					if (_whoami == NSCD_CHILD) {
796 						res = NSS_ALTRETRY;
797 						goto free_nsw_state;
798 					}
799 				}
800 			}
801 
802 			if ((strcmp(NSCD_NSW_SRC_NAME(srci), "files") == 0 &&
803 			    _nscd_check_client_priv(NSCD_READ_PRIV) != 0) ||
804 			    (check_ldap_priv &&
805 			    _nscd_check_client_priv(NSCD_ALL_PRIV) != 0)) {
806 				_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
807 				    NSCD_LOG_LEVEL_DEBUG)
808 				(me, "no privilege to look up, skip source\n");
809 
810 				goto next_src;
811 			}
812 		}
813 
814 		/* get state of the (backend) client service */
815 		smf_state = _nscd_get_smf_state(srci, dbi, 0);
816 
817 		/* stop if the source is one that should be TRYLOCAL */
818 		if (initf == nscd_initf &&	/* request is from the door */
819 		    (smf_state == NSCD_SVC_STATE_UNSUPPORTED_SRC ||
820 		    (smf_state == NSCD_SVC_STATE_FOREIGN_SRC &&
821 		    s->be_version_p[n_src] == NULL) ||
822 		    (params.privdb && try_local2(dbi, srci) == 1))) {
823 			_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
824 			(me, "returning TRYLOCAL ... \n");
825 			res = NSS_TRYLOCAL;
826 			goto free_nsw_state;
827 		}
828 
829 		if (check_loopback && k != NULL) {
830 
831 			if (k->srci == srci && k->dbi == dbi)
832 				if (k->fnum == search_fnum) {
833 
834 					_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
835 					    NSCD_LOG_LEVEL_DEBUG)
836 					(me, "loopback detected: "
837 					    "source = %s, database = %s "
838 					    "search fnum = %d\n",
839 					    NSCD_NSW_SRC_NAME(srci),
840 					    NSCD_NSW_DB_NAME(dbi), search_fnum);
841 
842 				NSCD_SW_STATS_G.loopback_nsw_db_skipped_g++;
843 				NSCD_SW_STATS(dbi).loopback_nsw_db_skipped++;
844 					continue;
845 				}
846 		}
847 
848 		be = s->be[n_src];
849 		if (be != NULL)
850 			funcp = NSS_LOOKUP_DBOP(be, search_fnum);
851 
852 		/* request could be from within nscd so check states again */
853 		if (be == NULL || (params.dnsi < 0 && (funcp == NULL ||
854 		    (smf_state != NSCD_SVC_STATE_UNINITED &&
855 		    smf_state != NSCD_SVC_STATE_UNSUPPORTED_SRC &&
856 		    smf_state != NSCD_SVC_STATE_FOREIGN_SRC &&
857 		    smf_state < SCF_STATE_ONLINE)))) {
858 
859 			_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
860 			    NSCD_LOG_LEVEL_DEBUG)
861 			(me, "unable to look up source %s: be = %p, "
862 			"smf state = %d, funcp = %p\n",
863 			    NSCD_NSW_SRC_NAME(srci), be, smf_state, funcp);
864 
865 			goto next_src;
866 		}
867 
868 		do {
869 			/*
870 			 * we can only retry max_retry times,
871 			 * otherwise threads may get stuck in this
872 			 * do-while loop forever
873 			 */
874 			if (n_loop > max_retry) {
875 				if (swret != NULL)
876 					res = NSS_TRYLOCAL;
877 				goto free_nsw_state;
878 			}
879 
880 			/*
881 			 * set up to prevent loopback
882 			 */
883 			if (check_loopback && k == NULL) {
884 				key.srci = srci;
885 				key.dbi = dbi;
886 				key.fnum = search_fnum;
887 				key.lb_flagp = &check_loopback;
888 				(void) set_loopback_key(&key);
889 				k = &key;
890 			}
891 
892 			_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
893 			    NSCD_LOG_LEVEL_DEBUG)
894 			(me, "looking up source = %s, loop# = %d \n",
895 			    NSCD_NSW_SRC_NAME(srci), n_loop);
896 
897 			/*
898 			 * search the backend, if hosts lookups,
899 			 * try to get the hosts data with ttl first
900 			 */
901 			if (params.dnsi >= 0) {
902 				res = search_dns_withttl(swret,
903 				    NSCD_NSW_SRC_NAME(srci), params.dnsi);
904 				/*
905 				 * if not able to get ttl, fall back
906 				 * to the regular backend call
907 				 */
908 				if (res == NSS_ERROR)
909 					res = (*funcp)(be, search_args);
910 				else {
911 					/*
912 					 * status/result are in the
913 					 * packed buffer, not
914 					 * search_args
915 					 */
916 					swret->noarg = 1;
917 				}
918 			} else
919 				res = (*funcp)(be, search_args);
920 			if (swret != NULL)
921 				swret->errnum = errno;
922 
923 			/*
924 			 * backend is not up, check and update the
925 			 * smf state table
926 			 */
927 			if (res == NSS_UNAVAIL)
928 				(void) _nscd_get_smf_state(srci, dbi, 1);
929 
930 			/*
931 			 * may need to fall back to use the main nscd
932 			 * if per-user lookup
933 			 */
934 			if (_whoami == NSCD_CHILD && swret != NULL)
935 				swret->fallback = set_fallback_flag(
936 				    NSCD_NSW_SRC_NAME(srci), res);
937 
938 			_NSCD_LOG_IF(NSCD_LOG_SWITCH_ENGINE,
939 			    NSCD_LOG_LEVEL_DEBUG) {
940 
941 				/*
942 				 * set up to trace the result/status
943 				 * of the dns/ttl lookup
944 				 */
945 				if (swret != NULL && swret->noarg == 1) {
946 					nss_pheader_t *phdr;
947 					struct nss_XbyY_args *arg;
948 					arg = (struct nss_XbyY_args *)
949 					    search_args;
950 					phdr = (nss_pheader_t *)swret->pbuf;
951 					arg->buf.buffer = (char *)phdr +
952 					    phdr->data_off;
953 					arg->returnlen = phdr->data_len;
954 					if (phdr->p_errno == ERANGE)
955 						arg->erange = 1;
956 					arg->h_errno = phdr->p_herrno;
957 				}
958 
959 				trace_result(dbi, srci, search_fnum, res,
960 				    (nss_XbyY_args_t *)search_args);
961 			}
962 
963 			n_loop++;
964 		} while (retry_test(res, n_loop, lkp));
965 
966 		next_src:
967 
968 		status_vec |= (1 << res);
969 
970 		if (__NSW_ACTION_V1(lkp, res) == __NSW_RETURN) {
971 			break;
972 		}
973 	}
974 
975 	free_nsw_state:
976 
977 	if (state_thr == 1)
978 		_nscd_put_nsw_state_thread(s);
979 	else
980 		_nscd_put_nsw_state(s);
981 	if (check_loopback && k != NULL)
982 		clear_loopback_key(k);
983 
984 	if (res != NSS_SUCCESS)
985 		goto error_exit;
986 
987 	NSCD_SW_STATS_G.lookup_request_succeeded_g++;
988 	NSCD_SW_STATS(dbi).lookup_request_succeeded++;
989 	NSCD_SW_STATS_G.lookup_request_in_progress_g--;
990 	NSCD_SW_STATS(dbi).lookup_request_in_progress--;
991 
992 	return (NSS_SUCCESS);
993 
994 	error_exit:
995 
996 	NSCD_SW_STATS_G.lookup_request_failed_g++;
997 	NSCD_SW_STATS_G.lookup_request_in_progress_g--;
998 	NSCD_SW_STATS(dbi).lookup_request_failed++;
999 	NSCD_SW_STATS(dbi).lookup_request_in_progress--;
1000 
1001 	return (res);
1002 }
1003 
1004 
1005 /* ===> get/set/endent */
1006 
1007 static void		nss_setent_u(nss_db_root_t *,
1008 				    nss_db_initf_t,
1009 				    nss_getent_t *);
1010 static nss_status_t	nss_getent_u(nss_db_root_t *,
1011 				    nss_db_initf_t,
1012 				    nss_getent_t *,
1013 				    void *);
1014 static void		nss_endent_u(nss_db_root_t *,
1015 				    nss_db_initf_t,
1016 				    nss_getent_t *);
1017 
1018 void
1019 nss_setent(nss_db_root_t *rootp, nss_db_initf_t initf,
1020 	nss_getent_t *contextpp)
1021 {
1022 	if (contextpp == 0)
1023 		return;
1024 	nss_setent_u(rootp, initf, contextpp);
1025 }
1026 
1027 nss_status_t
1028 nss_getent(nss_db_root_t *rootp, nss_db_initf_t initf, nss_getent_t *contextpp,
1029 	void *args)
1030 {
1031 	nss_status_t		status;
1032 
1033 	if (contextpp == 0) {
1034 		return (NSS_UNAVAIL);
1035 	}
1036 	status = nss_getent_u(rootp, initf, contextpp, args);
1037 	return (status);
1038 }
1039 
1040 void
1041 nss_endent(nss_db_root_t *rootp, nss_db_initf_t initf,
1042 	nss_getent_t *contextpp)
1043 {
1044 	if (contextpp == 0)
1045 		return;
1046 	nss_endent_u(rootp, initf, contextpp);
1047 }
1048 
1049 /*ARGSUSED*/
1050 static void
1051 end_iter_u(nss_db_root_t *rootp, struct nss_getent_context *contextp)
1052 {
1053 	nscd_getent_context_t	*ctx;
1054 	nscd_nsw_state_t	*s;
1055 	nss_backend_t		*be;
1056 	int			n_src;
1057 
1058 	ctx = (nscd_getent_context_t *)contextp;
1059 	s = ctx->nsw_state;
1060 	n_src = ctx->n_src;
1061 	be = ctx->be;
1062 
1063 	if (s != 0) {
1064 		if (n_src < s->max_src && be != 0) {
1065 			(void) NSS_INVOKE_DBOP(be, NSS_DBOP_ENDENT, 0);
1066 			ctx->be = 0;  /* Should be unnecessary, but hey */
1067 		}
1068 	}
1069 	ctx->n_src = 0;
1070 }
1071 
1072 static void
1073 nss_setent_u(nss_db_root_t *rootp, nss_db_initf_t initf,
1074 	nss_getent_t *contextpp)
1075 {
1076 	char			*me = "nss_setent_u";
1077 	nscd_nsw_state_t	*s;
1078 	nscd_getent_context_t	*contextp;
1079 	nscd_nsw_params_t	params;
1080 	nss_db_root_t		root;
1081 	nss_backend_t		*be;
1082 	int			n_src, i;
1083 	nscd_sw_return_t	*swret = NULL;
1084 
1085 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1086 	(me, "rootp = %p, initf = %p, contextpp = %p \n",
1087 	    rootp, initf, contextpp);
1088 
1089 	/*
1090 	 * Get the nsw db index via the initf function. If unsupported
1091 	 * database, no need to continue
1092 	 */
1093 	if (getparams(-1, initf, &params) == NSCD_CFG_UNSUPPORTED_SWITCH_DB)
1094 		return;
1095 
1096 	/* get address of the switch engine return data area */
1097 	if (initf == nscd_initf)
1098 		swret = (nscd_sw_return_t *)params.p.private;
1099 
1100 	/* if no privilege to look up, return */
1101 	if (params.privdb == 1 && swret != NULL &&
1102 	    _nscd_check_client_priv(NSCD_READ_PRIV) != 0) {
1103 
1104 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1105 		(me, "no privilege \n");
1106 		return;
1107 	}
1108 
1109 	if ((contextp = (nscd_getent_context_t *)contextpp->ctx) == 0) {
1110 		if ((_nscd_get_getent_ctx(contextpp, &params)) !=
1111 		    NSCD_SUCCESS) {
1112 			return;
1113 		}
1114 		contextp = (nscd_getent_context_t *)contextpp->ctx;
1115 	}
1116 	s = contextp->nsw_state;
1117 
1118 	if (s == 0) {
1119 		if (_nscd_get_nsw_state(&root, &params) !=
1120 		    NSCD_SUCCESS) {
1121 			return;
1122 		}
1123 		s = (nscd_nsw_state_t *)root.s;
1124 		contextp->nsw_state = s;
1125 
1126 	} else {
1127 		s	= contextp->nsw_state;
1128 		n_src	= contextp->n_src;
1129 		be	= contextp->be;
1130 		if (n_src == 0 && be != 0) {
1131 			/*
1132 			 * Optimization:  don't do endent, don't change
1133 			 *   backends, just do the setent.  Look Ma, no locks
1134 			 *   (nor any context that needs updating).
1135 			 */
1136 			(void) NSS_INVOKE_DBOP(be, NSS_DBOP_SETENT, 0);
1137 			return;
1138 		}
1139 		if (n_src < s->max_src && be != 0) {
1140 			(void) NSS_INVOKE_DBOP(be, NSS_DBOP_ENDENT, 0);
1141 			contextp->be = 0;	/* Play it safe */
1142 		}
1143 	}
1144 	for (n_src = 0, be = 0; n_src < s->max_src &&
1145 	    (be = s->be[n_src]) == 0; n_src++) {
1146 		;
1147 	}
1148 
1149 	contextp->n_src	= n_src;
1150 	contextp->be	= be;
1151 
1152 	if (be == 0) {
1153 		/* Things are broken enough that we can't do setent/getent */
1154 		nss_endent_u(rootp, initf, contextpp);
1155 		return;
1156 	}
1157 
1158 	/*
1159 	 * make sure all the backends are supported
1160 	 */
1161 	for (i = 0; i < s->max_src; i++) {
1162 		int	st, srci;
1163 
1164 		if (s->be[i] == NULL)
1165 			continue;
1166 
1167 		srci = (*s->nsw_cfg_p)->src_idx[i];
1168 		st = _nscd_get_smf_state(srci, params.dbi, 1);
1169 		if (st == NSCD_SVC_STATE_UNSUPPORTED_SRC ||
1170 		    (st == NSCD_SVC_STATE_FOREIGN_SRC &&
1171 		    s->be_version_p[i] == NULL && initf == nscd_initf) ||
1172 		    st == NSCD_SVC_STATE_UNINITED ||
1173 		    (params.privdb &&
1174 		    try_local2(params.dbi, srci) == 1)) {
1175 			nss_endent_u(rootp, initf, contextpp);
1176 
1177 			_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
1178 			    NSCD_LOG_LEVEL_DEBUG)
1179 			(me, "backend (%s) not available (state = %d)\n",
1180 			    NSCD_NSW_SRC_NAME(srci), st);
1181 
1182 			return;
1183 		}
1184 	}
1185 
1186 	(void) NSS_INVOKE_DBOP(be, NSS_DBOP_SETENT, 0);
1187 }
1188 
1189 nss_status_t
1190 nss_getent_u(nss_db_root_t *rootp, nss_db_initf_t initf,
1191 	nss_getent_t *contextpp, void *args)
1192 {
1193 	char			*me = "nss_getent_u";
1194 	nscd_nsw_state_t	*s;
1195 	nscd_getent_context_t	*contextp;
1196 	int			n_src;
1197 	nss_backend_t		*be;
1198 
1199 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1200 	(me, "rootp = %p, initf = %p, contextpp = %p, args = %p\n",
1201 	    rootp, initf, contextpp, args);
1202 
1203 	if ((contextp = (nscd_getent_context_t *)contextpp->ctx) == 0) {
1204 		nss_setent_u(rootp, initf, contextpp);
1205 		if ((contextp = (nscd_getent_context_t *)contextpp->ctx) == 0) {
1206 			/* Give up */
1207 			_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
1208 			    NSCD_LOG_LEVEL_ERROR)
1209 			(me, "not able to obtain getent context ... give up\n");
1210 
1211 			return (NSS_UNAVAIL);
1212 		}
1213 	}
1214 
1215 	s	= contextp->nsw_state;
1216 	n_src	= contextp->n_src;
1217 	be	= contextp->be;
1218 
1219 	if (s == 0) {
1220 		/*
1221 		 * We've done an end_iter() and haven't done nss_setent()
1222 		 * or nss_endent() since;  we should stick in this state
1223 		 * until the caller invokes one of those two routines.
1224 		 */
1225 		return (NSS_SUCCESS);
1226 	}
1227 
1228 	while (n_src < s->max_src) {
1229 		nss_status_t		res;
1230 		struct __nsw_lookup_v1	*lkp = NULL;
1231 		int			n;
1232 
1233 		/* get the nsw config for the current source */
1234 		lkp = s->config->lookups;
1235 		for (n = 0; n < n_src; n++)
1236 			lkp = lkp->next;
1237 
1238 		if (be == 0) {
1239 			/* If it's null it's a bug, but let's play safe */
1240 			res = NSS_UNAVAIL;
1241 		} else {
1242 			_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
1243 			    NSCD_LOG_LEVEL_DEBUG)
1244 			(me, "database: %s, backend: %s, nsswitch config: %s\n",
1245 			    NSCD_NSW_DB_NAME(s->dbi),
1246 			    lkp->service_name,
1247 			    (*s->nsw_cfg_p)->nsw_cfg_str);
1248 
1249 			res = NSS_INVOKE_DBOP(be, NSS_DBOP_GETENT, args);
1250 		}
1251 
1252 		if (__NSW_ACTION_V1(lkp, res) == __NSW_RETURN) {
1253 			if (res != __NSW_SUCCESS) {
1254 				end_iter_u(rootp,
1255 				    (struct nss_getent_context *)contextp);
1256 			}
1257 			return (res);
1258 		}
1259 		(void) NSS_INVOKE_DBOP(be, NSS_DBOP_ENDENT, 0);
1260 		do {
1261 			n_src++;
1262 		} while (n_src < s->max_src &&
1263 		    (be = s->be[n_src]) == 0);
1264 		if (be == 0) {
1265 			/*
1266 			 * This is the case where we failed to get the backend
1267 			 * for the last source. We exhausted all sources.
1268 			 */
1269 			nss_endent_u(rootp, initf, contextpp);
1270 			return (NSS_NOTFOUND);
1271 		}
1272 		contextp->n_src	= n_src;
1273 		contextp->be	= be;
1274 		(void) NSS_INVOKE_DBOP(be, NSS_DBOP_SETENT, 0);
1275 	}
1276 	/* Got to the end of the sources without finding another entry */
1277 	end_iter_u(rootp, (struct nss_getent_context *)contextp);
1278 	return (NSS_SUCCESS);
1279 	/* success is either a successful entry or end of the sources */
1280 }
1281 
1282 /*ARGSUSED*/
1283 void
1284 nss_endent_u(nss_db_root_t *rootp, nss_db_initf_t initf,
1285 	nss_getent_t *contextpp)
1286 {
1287 	char			*me = "nss_endent_u";
1288 	nscd_getent_context_t	*contextp;
1289 
1290 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1291 	(me, "rootp = %p, initf = %p, contextpp = %p \n",
1292 	    rootp, initf, contextpp);
1293 
1294 	if ((contextp = (nscd_getent_context_t *)contextpp->ctx) == 0) {
1295 		/* nss_endent() on an unused context is a no-op */
1296 		return;
1297 	}
1298 
1299 	if (_nscd_is_getent_ctx_in_use(contextp) == 0) {
1300 		end_iter_u(rootp, (struct nss_getent_context *)contextp);
1301 		_nscd_put_getent_ctx(contextp);
1302 		contextpp->ctx = NULL;
1303 	}
1304 }
1305 
1306 /*
1307  * _nss_db_state_destr() and nss_delete() do nothing in nscd
1308  * but is needed to make the caller (below nscd) happy
1309  */
1310 /*ARGSUSED*/
1311 void
1312 _nss_db_state_destr(struct nss_db_state *s)
1313 {
1314 	/* nsw state in nscd is always reused, so do nothing here */
1315 }
1316 
1317 /*ARGSUSED*/
1318 void
1319 nss_delete(nss_db_root_t *rootp)
1320 {
1321 	/*
1322 	 * the only resource kept tracked by the nss_db_root_t
1323 	 * is the nsw state which is always reused and no need
1324 	 * to be freed. So just return.
1325 	 */
1326 }
1327 
1328 /*
1329  * Start of nss_psearch/nss_psetent()/nss_pgetent()/nss_pendent()
1330  * buffers switch entry points
1331  */
1332 
1333 /*
1334  * nss_psearch opens a packed structure header, assembles a local
1335  * nss_XbyY_args_t structure and calls the local copy of nss_search.
1336  * The return data is assembled in "files native format" in the
1337  * return buffer location.  Status if packed back up with the buffer
1338  * and the whole wad is returned to the cache or the client.
1339  */
1340 
1341 void
1342 nss_psearch(void *buffer, size_t length)
1343 {
1344 	/* inputs */
1345 	nss_db_initf_t		initf;
1346 	int			dbop;
1347 	int			rc;
1348 	nss_XbyY_args_t		arg;
1349 	nss_status_t		status;
1350 	nscd_sw_return_t	swret = { 0 }, *swrp = &swret;
1351 	nss_pheader_t		*pbuf = (nss_pheader_t *)buffer;
1352 	char			*me = "nss_psearch";
1353 
1354 	if (buffer == NULL || length == 0) {
1355 		NSCD_RETURN_STATUS(pbuf, NSS_ERROR, EFAULT);
1356 	}
1357 
1358 	status = nss_packed_arg_init(buffer, length,
1359 	    NULL, &initf, &dbop, &arg);
1360 	if (status != NSS_SUCCESS) {
1361 		NSCD_RETURN_STATUS(pbuf, status, -1);
1362 	}
1363 
1364 	/*
1365 	 * pass the address of the return data area
1366 	 * for the switch engine to return its own data
1367 	 */
1368 	(void) memcpy(&pbuf->nscdpriv, &swrp, sizeof (swrp));
1369 	swret.pbuf = buffer;
1370 	swret.pbufsiz = length;
1371 	swret.datalen = pbuf->data_len;
1372 
1373 	/*
1374 	 * use the generic nscd_initf for all database lookups
1375 	 * (the TSD key is the pointer to the packed header)
1376 	 */
1377 	rc = set_initf_key(pbuf);
1378 	if (rc != 0) {
1379 		NSCD_RETURN_STATUS(pbuf, NSS_UNAVAIL, EINVAL);
1380 	}
1381 	initf = nscd_initf;
1382 
1383 	/* Perform local search and pack results into return buffer */
1384 	/* nscd's search ignores db_root */
1385 	status = nss_search(NULL, initf, dbop, &arg);
1386 
1387 	/*
1388 	 * If status is NSS_NOTFOUND and ldap also returned
1389 	 * NSS_NOTFOUND, it is possible that the user does
1390 	 * not have a credential, so check and see if
1391 	 * needs to return NSS_ALTRETRY to let the main
1392 	 * nscd get a chance to process the lookup
1393 	 */
1394 	if (swret.fallback == 1 && status == NSS_NOTFOUND) {
1395 		OM_uint32	(*func)();
1396 		OM_uint32	stat;
1397 		nscd_rc_t	rc;
1398 
1399 		rc = get_gss_func((void **)&func);
1400 		if (rc == NSCD_SUCCESS) {
1401 			if (func(&stat, GSS_C_NO_CREDENTIAL,
1402 			    NULL, NULL, NULL, NULL) != GSS_S_COMPLETE) {
1403 
1404 				_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
1405 				    NSCD_LOG_LEVEL_DEBUG)
1406 			(me, "NSS_ALTRETRY: fallback to main nscd needed\n");
1407 
1408 				status = NSS_ALTRETRY;
1409 			}
1410 		}
1411 	}
1412 
1413 	NSCD_SET_STATUS(pbuf, status, -1);
1414 	errno = swret.errnum;
1415 
1416 	/*
1417 	 * Move result/status from args to packed buffer only if
1418 	 * arg was being used and rc from the switch engine is not
1419 	 * NSS_TRYLOCAL.
1420 	 */
1421 	if (!swret.noarg && status != NSS_TRYLOCAL)
1422 		nss_packed_set_status(buffer, length, status,  &arg);
1423 
1424 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1425 	(me, "switch engine result: source is %s, status %d, "
1426 	"herrno is %d, errno is %s\n",
1427 	    (swret.srci != -1) ? NSCD_NSW_SRC_NAME(swret.srci) : "<NOTSET>",
1428 	    pbuf->p_status, pbuf->p_herrno, strerror(pbuf->p_errno));
1429 
1430 	/* clear the TSD key used by the generic initf */
1431 	clear_initf_key();
1432 	pbuf->nscdpriv = 0;
1433 }
1434 
1435 static void
1436 nscd_map_contextp(void *buffer, nss_getent_t *contextp,
1437     nssuint_t **cookie_num_p, nssuint_t **seqnum_p, int setent)
1438 {
1439 	nss_pheader_t		*pbuf = (nss_pheader_t *)buffer;
1440 	nssuint_t		off;
1441 	nscd_getent_context_t	*ctx;
1442 	char			*me = "nscd_map_contextp";
1443 	nscd_getent_p1_cookie_t	*cookie;
1444 
1445 	if (buffer == NULL) {
1446 		NSCD_RETURN_STATUS(pbuf, NSS_ERROR, EFAULT);
1447 	}
1448 
1449 	off = pbuf->key_off;
1450 	cookie = (nscd_getent_p1_cookie_t *)((void *)((char *)buffer + off));
1451 	if (seqnum_p != NULL)
1452 		*seqnum_p = &cookie->p1_seqnum;
1453 
1454 	/*
1455 	 * if called by nss_psetent, and the passed in cookie number
1456 	 * is NSCD_NEW_COOKIE, then there is no cookie yet, return a
1457 	 * pointer pointing to where the cookie number will be stored.
1458 	 * Also because there is no cookie to validate, just return
1459 	 * success.
1460 	 *
1461 	 * On the other hand, if a cookie number is passed in, we need
1462 	 * to validate the cookie number before returning.
1463 	 */
1464 	if (cookie_num_p != NULL)
1465 		*cookie_num_p = &cookie->p1_cookie_num;
1466 	if (setent == 1 && cookie->p1_cookie_num == NSCD_NEW_COOKIE) {
1467 			NSCD_RETURN_STATUS_SUCCESS(pbuf);
1468 	}
1469 
1470 	/*
1471 	 * If the sequence number and start time match nscd's p0 cookie,
1472 	 * then either setent was done twice in a row or this is the
1473 	 * first getent after the setent, return success as well.
1474 	 */
1475 	if (cookie->p1_seqnum == NSCD_P0_COOKIE_SEQNUM) {
1476 		nscd_getent_p0_cookie_t *p0c =
1477 		    (nscd_getent_p0_cookie_t *)cookie;
1478 		if (p0c->p0_time == _nscd_get_start_time())
1479 			NSCD_RETURN_STATUS_SUCCESS(pbuf);
1480 	}
1481 
1482 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1483 	(me, "cookie # = %lld,  sequence # = %lld\n",
1484 	    cookie->p1_cookie_num, cookie->p1_seqnum);
1485 
1486 	ctx = _nscd_is_getent_ctx(cookie->p1_cookie_num);
1487 
1488 	if (ctx == NULL) {
1489 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1490 		(me, "No matching context found (cookie number: %lld)\n",
1491 		    cookie->p1_cookie_num);
1492 
1493 		NSCD_RETURN_STATUS(pbuf, NSS_ERROR, EFAULT);
1494 	}
1495 
1496 	/* if not called by nss_psetent, verify sequence number */
1497 	if (setent != 1 && ctx->seq_num !=
1498 	    (nscd_seq_num_t)cookie->p1_seqnum) {
1499 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1500 		(me, "invalid sequence # (%lld)\n", cookie->p1_seqnum);
1501 
1502 		_nscd_free_ctx_if_aborted(ctx);
1503 		NSCD_RETURN_STATUS(pbuf, NSS_ERROR, EFAULT);
1504 	}
1505 
1506 	contextp->ctx = (struct nss_getent_context *)ctx;
1507 
1508 	NSCD_RETURN_STATUS_SUCCESS(pbuf);
1509 }
1510 
1511 void
1512 nss_psetent(void *buffer, size_t length, pid_t pid)
1513 {
1514 	nss_getent_t		context = { 0 };
1515 	nss_getent_t		*contextp = &context;
1516 	nssuint_t		*cookie_num_p;
1517 	nssuint_t		*seqnum_p;
1518 	nss_pheader_t		*pbuf = (nss_pheader_t *)buffer;
1519 	nscd_getent_p0_cookie_t *p0c;
1520 	char			*me = "nss_psetent";
1521 
1522 	if (buffer == NULL || length == 0) {
1523 		NSCD_RETURN_STATUS(pbuf, NSS_ERROR, EFAULT);
1524 	}
1525 
1526 	/*
1527 	 * If this is a per-user nscd, and the user does not have
1528 	 * the necessary credential, return NSS_TRYLOCAL, so the
1529 	 * setent/getent can be done locally in the process of the
1530 	 * setent call
1531 	 */
1532 	if (_whoami == NSCD_CHILD) {
1533 		OM_uint32	(*func)();
1534 		OM_uint32	stat;
1535 		nscd_rc_t	rc;
1536 
1537 		rc = get_gss_func((void **)&func);
1538 		if (rc == NSCD_SUCCESS) {
1539 			if (func(&stat, GSS_C_NO_CREDENTIAL,
1540 			    NULL, NULL, NULL, NULL) != GSS_S_COMPLETE) {
1541 
1542 				_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE,
1543 				    NSCD_LOG_LEVEL_DEBUG)
1544 			(me, "NSS_TRYLOCAL: fallback to caller process\n");
1545 				NSCD_RETURN_STATUS(pbuf, NSS_TRYLOCAL, 0);
1546 			}
1547 		}
1548 	}
1549 
1550 	/* check cookie number */
1551 	nscd_map_contextp(buffer, contextp, &cookie_num_p, &seqnum_p, 1);
1552 	if (NSCD_STATUS_IS_NOT_OK(pbuf))
1553 		return;
1554 
1555 	/* set cookie number and sequence number */
1556 	p0c = (nscd_getent_p0_cookie_t *)cookie_num_p;
1557 	if (contextp->ctx ==  NULL) {
1558 		/*
1559 		 * first setent (no existing getent context),
1560 		 * return a p0 cookie
1561 		 */
1562 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1563 		(me, "first setent, no getent context yet\n");
1564 	} else {
1565 		/*
1566 		 * doing setent on an existing getent context,
1567 		 * release resources allocated and return a
1568 		 * p0 cookie
1569 		 */
1570 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1571 		(me, "setent resetting sequence number = %lld\n",  *seqnum_p);
1572 
1573 		if (_nscd_is_getent_ctx_in_use((nscd_getent_context_t *)
1574 		    contextp->ctx) == 0) {
1575 			/*
1576 			 * context not in use, release the backend and
1577 			 * return the context to the pool
1578 			 */
1579 			end_iter_u(NULL, contextp->ctx);
1580 			_nscd_put_getent_ctx(
1581 			    (nscd_getent_context_t *)contextp->ctx);
1582 			contextp->ctx = NULL;
1583 		}
1584 	}
1585 
1586 	p0c->p0_pid = pid;
1587 	p0c->p0_time = _nscd_get_start_time();
1588 	p0c->p0_seqnum = NSCD_P0_COOKIE_SEQNUM;
1589 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1590 	(me, "returning a p0 cookie: pid = %ld, time = %ld, seq #= %llx\n",
1591 	    p0c->p0_pid, p0c->p0_time, p0c->p0_seqnum);
1592 
1593 	NSCD_RETURN_STATUS(pbuf, NSS_SUCCESS, 0);
1594 }
1595 
1596 static void
1597 delayed_setent(nss_pheader_t *pbuf, nss_db_initf_t initf,
1598 	nss_getent_t *contextp, nssuint_t *cookie_num_p,
1599 	nssuint_t *seqnum_p, pid_t pid)
1600 {
1601 	nscd_getent_context_t	*ctx;
1602 	nscd_sw_return_t	swret = { 0 }, *swrp = &swret;
1603 	char			*me = "delayed_setent";
1604 
1605 	/*
1606 	 * check credential
1607 	 */
1608 	_nscd_APP_check_cred(pbuf, &pid, "NSCD_DELAYED_SETENT",
1609 	    NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_ERROR);
1610 	if (NSCD_STATUS_IS_NOT_OK(pbuf)) {
1611 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1612 		(me, "invalid credential\n");
1613 		return;
1614 	}
1615 
1616 	/*
1617 	 * pass the packed header buffer pointer to nss_setent
1618 	 */
1619 	(void) memcpy(&pbuf->nscdpriv, &swrp, sizeof (swrp));
1620 	swret.pbuf = pbuf;
1621 
1622 	/* Perform local setent and set context */
1623 	nss_setent(NULL, initf, contextp);
1624 
1625 	/* insert cookie info into packed buffer header */
1626 	ctx = (nscd_getent_context_t *)contextp->ctx;
1627 	if (ctx != NULL) {
1628 		*cookie_num_p = ctx->cookie_num;
1629 		*seqnum_p = ctx->seq_num;
1630 		ctx->pid = pid;
1631 	} else {
1632 		/*
1633 		 * not able to allocate a getent context, the
1634 		 * client should try the enumeration locally
1635 		 */
1636 		*cookie_num_p = NSCD_LOCAL_COOKIE;
1637 		*seqnum_p = 0;
1638 
1639 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1640 		(me, "NSS_TRYLOCAL: cookie # = %lld,  sequence # = %lld\n",
1641 		    *cookie_num_p, *seqnum_p);
1642 		NSCD_RETURN_STATUS(pbuf, NSS_TRYLOCAL, 0);
1643 	}
1644 
1645 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1646 	(me, "NSS_SUCCESS: cookie # = %lld,  sequence # = %lld\n",
1647 	    ctx->cookie_num, ctx->seq_num);
1648 
1649 	NSCD_RETURN_STATUS(pbuf, NSS_SUCCESS, 0);
1650 }
1651 
1652 void
1653 nss_pgetent(void *buffer, size_t length)
1654 {
1655 	/* inputs */
1656 	nss_db_initf_t		initf;
1657 	nss_getent_t		context = { 0 };
1658 	nss_getent_t		*contextp = &context;
1659 	nss_XbyY_args_t		arg = { 0};
1660 	nss_status_t		status;
1661 	nssuint_t		*cookie_num_p;
1662 	nssuint_t		*seqnum_p;
1663 	nscd_getent_context_t	*ctx;
1664 	int			rc;
1665 	nss_pheader_t		*pbuf = (nss_pheader_t *)buffer;
1666 	char			*me = "nss_pgetent";
1667 
1668 	if (buffer == NULL || length == 0) {
1669 		NSCD_RETURN_STATUS(pbuf, NSS_ERROR, EFAULT);
1670 	}
1671 
1672 	/* verify the cookie passed in */
1673 	nscd_map_contextp(buffer, contextp, &cookie_num_p, &seqnum_p, 0);
1674 	if (NSCD_STATUS_IS_NOT_OK(pbuf))
1675 		return;
1676 
1677 	/*
1678 	 * use the generic nscd_initf for all the getent requests
1679 	 * (the TSD key is the pointer to the packed header)
1680 	 */
1681 	rc = set_initf_key(pbuf);
1682 	if (rc != 0) {
1683 		NSCD_RETURN_STATUS(pbuf, NSS_UNAVAIL, EINVAL);
1684 	}
1685 	initf = nscd_initf;
1686 
1687 	/* if no context yet, get one */
1688 	if (contextp->ctx ==  NULL) {
1689 		nscd_getent_p0_cookie_t *p0c =
1690 		    (nscd_getent_p0_cookie_t *)cookie_num_p;
1691 
1692 		delayed_setent(pbuf, initf, contextp, cookie_num_p,
1693 		    seqnum_p, p0c->p0_pid);
1694 		if (NSCD_STATUS_IS_NOT_OK(pbuf)) {
1695 			clear_initf_key();
1696 			return;
1697 		}
1698 	}
1699 
1700 	status = nss_packed_context_init(buffer, length,
1701 	    NULL, &initf, &contextp, &arg);
1702 	if (status != NSS_SUCCESS) {
1703 		clear_initf_key();
1704 		_nscd_free_ctx_if_aborted(
1705 		    (nscd_getent_context_t *)contextp->ctx);
1706 		NSCD_RETURN_STATUS(pbuf, status, -1);
1707 	}
1708 
1709 	/* Perform local search and pack results into return buffer */
1710 	status = nss_getent(NULL, initf, contextp, &arg);
1711 	NSCD_SET_STATUS(pbuf, status, -1);
1712 	nss_packed_set_status(buffer, length, status,  &arg);
1713 
1714 	/* increment sequence number in the buffer and nscd context */
1715 	if (status == NSS_SUCCESS) {
1716 		ctx = (nscd_getent_context_t *)contextp->ctx;
1717 		ctx->seq_num++;
1718 		*seqnum_p = ctx->seq_num;
1719 		*cookie_num_p = ctx->cookie_num;
1720 
1721 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1722 		(me, "getent OK, new sequence # = %lld, len = %lld,"
1723 		    " data = >>%s<<\n", *seqnum_p,
1724 		    pbuf->data_len, (char *)buffer + pbuf->data_off);
1725 
1726 		_nscd_free_ctx_if_aborted(ctx);
1727 	} else {
1728 		/* release the resources used */
1729 		ctx = (nscd_getent_context_t *)contextp->ctx;
1730 		if (ctx != NULL && _nscd_is_getent_ctx_in_use(ctx) == 0) {
1731 			_nscd_put_getent_ctx(ctx);
1732 			contextp->ctx = NULL;
1733 		}
1734 		_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1735 		(me, "getent failed, status = %d, sequence # = %lld\n",
1736 		    status, *seqnum_p);
1737 	}
1738 
1739 	/* clear the TSD key used by the generic initf */
1740 	clear_initf_key();
1741 }
1742 
1743 void
1744 nss_pendent(void *buffer, size_t length)
1745 {
1746 	nss_getent_t		context = { 0 };
1747 	nss_getent_t		*contextp = &context;
1748 	nssuint_t		*seqnum_p;
1749 	nssuint_t		*cookie_num_p;
1750 	nss_pheader_t		*pbuf = (nss_pheader_t *)buffer;
1751 	char			*me = "nss_pendent";
1752 
1753 	if (buffer == NULL || length == 0) {
1754 		NSCD_RETURN_STATUS(pbuf, NSS_ERROR, EFAULT);
1755 	}
1756 
1757 	/* map the contextp from the cookie information */
1758 	nscd_map_contextp(buffer, contextp, &cookie_num_p, &seqnum_p, 0);
1759 	if (NSCD_STATUS_IS_NOT_OK(pbuf))
1760 		return;
1761 
1762 	if (contextp->ctx == NULL)
1763 		return;
1764 
1765 	_NSCD_LOG(NSCD_LOG_SWITCH_ENGINE, NSCD_LOG_LEVEL_DEBUG)
1766 	(me, "endent, cookie = %lld, sequence # = %lld\n",
1767 	    *cookie_num_p, *seqnum_p);
1768 
1769 	/* Perform local endent and reset context */
1770 	nss_endent(NULL, NULL, contextp);
1771 
1772 	NSCD_RETURN_STATUS(pbuf, NSS_SUCCESS, 0);
1773 }
1774 
1775 /*ARGSUSED*/
1776 void
1777 nss_pdelete(void *buffer, size_t length)
1778 {
1779 	nss_pheader_t	*pbuf = (nss_pheader_t *)buffer;
1780 
1781 	/* unnecessary, kept for completeness */
1782 	NSCD_RETURN_STATUS_SUCCESS(pbuf);
1783 }
1784