dns - zygaena/hammerhead

root / base / usr / src / lib / nsswitch / dns
dns Plain Text 2317 lines 58.0 KB
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License, Version 1.0 only
# (the "License").  You may not use this file except in compliance
# with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright (c) 1991 - 1996, by Sun Microsystems, Inc.
# All rights reserved.
#

include     ../../../Makefile.master

FILES_SUBDIRS = $(MACH64)

all:		TARGET= all
clean:		TARGET= clean
clobber:	TARGET= clobber
install:	TARGET= install

.KEEP_STATE:

all clean clobber install: $(FILES_SUBDIRS)

$(FILES_SUBDIRS): FRC
	@cd $@; pwd; $(MAKE) $(TARGET)

FRC:
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# lib/nsswitch/dns/Makefile.com

LIBRARY =	libnss_dns.a
VERS =		.1

OBJECTS =	gethostent.o	\
		gethostent6.o	\
		dns_mt.o	\
		dns_common.o

# include common nsswitch library definitions.
include		../../Makefile.com

# install this library in the root filesystem
include ../../../Makefile.rootfs

DYNLIB1 =	nss_dns.so$(VERS)

COMPATLINKS=	usr/lib/$(DYNLIB1)
# Hammerhead: 64-bit only — COMPATLINKS64 must equal COMPATLINKS
# so the amd64/Makefile install rule creates the /usr/lib symlinks.
COMPATLINKS64=	$(COMPATLINKS)

$(ROOT)/usr/lib/$(DYNLIB1) : COMPATLINKTARGET=../../lib/$(DYNLIB1)

# Appropriate libresolv loaded at runtime. This is the default, to be dlopened
# if no libresolv was provided by the application.
CPPFLAGS +=	-DNSS_DNS_LIBRESOLV=\"libresolv.so.2\"


# Hammerhead: -ldl needed for dlopen/dlsym of libresolv at runtime
LDLIBS +=	-lnsl -lsocket -ldl

#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License, Version 1.0 only
# (the "License").  You may not use this file except in compliance
# with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

#

include		../Makefile.com
include		$(SRC)/lib/Makefile.lib.64

LIBS =		$(DYNLIB1)

include		../../Makefile.targ

install:	all $(ROOT64DYNLIB) $(ROOTCOMPATLINKS64)
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/*
 * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
 * Copyright 2023 Oxide Computer Company
 */

/*
 *	dns_common.c
 */

#include "dns_common.h"
#include <sys/types.h>
#include <sys/socket.h>
#include <ifaddrs.h>
#include <net/if.h>

#pragma weak	dn_expand
#pragma weak	res_ninit
#pragma weak	res_ndestroy
#pragma weak	res_nsearch
#pragma weak	res_nclose
#pragma weak	ns_get16
#pragma weak	ns_get32
#pragma weak	__ns_get16
#pragma weak	__ns_get32

#define	DNS_ALIASES	0
#define	DNS_ADDRLIST	1
#define	DNS_MAPDLIST	2

#ifndef	tolower
#define	tolower(c) ((c) >= 'A' && (c) <= 'Z' ? (c) | 0x20 : (c))
#endif

static int
dns_netdb_aliases(char **from_list, char **to_list, char **aliaspp, int type,
    int *count, int af_type)
{
	char		*fstr;
	int		cnt = 0;
	size_t		len;

	*count = 0;
	if ((char *)to_list >= *aliaspp)
		return (NSS_STR_PARSE_ERANGE);

	for (fstr = from_list[cnt]; fstr != NULL; fstr = from_list[cnt]) {
		if (type == DNS_ALIASES) {
			len = strlen(fstr) + 1;
		} else {
			len = (af_type == AF_INET) ? sizeof (struct in_addr) :
			    sizeof (struct in6_addr);
		}
		*aliaspp -= len;
		to_list[cnt] = *aliaspp;
		if (*aliaspp <= (char *)&to_list[cnt+1])
			return (NSS_STR_PARSE_ERANGE);
		if (type == DNS_MAPDLIST) {
			/* LINTED: E_BAD_PTR_CAST_ALIGN */
			struct in6_addr *addr6p = (struct in6_addr *)*aliaspp;

			(void) memset(addr6p, '\0', sizeof (struct in6_addr));
			(void) memcpy(&addr6p->s6_addr[12], fstr,
			    sizeof (struct in_addr));
			addr6p->s6_addr[10] = 0xffU;
			addr6p->s6_addr[11] = 0xffU;
			++cnt;
		} else {
			(void) memcpy (*aliaspp, fstr, len);
			++cnt;
		}
	}
	to_list[cnt] = NULL;

	*count = cnt;
	if (cnt == 0)
		return (NSS_STR_PARSE_PARSE);

	return (NSS_STR_PARSE_SUCCESS);
}


int
ent2result(struct hostent *he, nss_XbyY_args_t *argp, int af_type)
{
	char		*buffer, *limit;
	int		buflen = argp->buf.buflen;
	int		ret, count;
	size_t len;
	struct hostent	*host;
	struct in_addr	*addrp;
	struct in6_addr	*addrp6;

	limit = argp->buf.buffer + buflen;
	host = (struct hostent *)argp->buf.result;
	buffer = argp->buf.buffer;

	/* h_addrtype and h_length */
	host->h_addrtype = af_type;
	host->h_length = (af_type == AF_INET) ? sizeof (struct in_addr) :
	    sizeof (struct in6_addr);

	/* h_name */
	len = strlen(he->h_name) + 1;
	host->h_name = buffer;
	if (host->h_name + len >= limit)
		return (NSS_STR_PARSE_ERANGE);
	(void) memcpy(host->h_name, he->h_name, len);
	buffer += len;

	/* h_addr_list */
	if (af_type == AF_INET) {
		addrp = (struct in_addr *)ROUND_DOWN(limit, sizeof (*addrp));
		host->h_addr_list = (char **)ROUND_UP(buffer, sizeof (char **));
		ret = dns_netdb_aliases(he->h_addr_list, host->h_addr_list,
		    (char **)&addrp, DNS_ADDRLIST, &count, af_type);
		if (ret != NSS_STR_PARSE_SUCCESS)
			return (ret);
		/* h_aliases */
		host->h_aliases = host->h_addr_list + count + 1;
		ret = dns_netdb_aliases(he->h_aliases, host->h_aliases,
		    (char **)&addrp, DNS_ALIASES, &count, af_type);
	} else {
		addrp6 = (struct in6_addr *)ROUND_DOWN(limit, sizeof (*addrp6));
		host->h_addr_list = (char **)ROUND_UP(buffer, sizeof (char **));
		if (he->h_addrtype == AF_INET && af_type == AF_INET6) {
			ret = dns_netdb_aliases(he->h_addr_list,
			    host->h_addr_list, (char **)&addrp6,
			    DNS_MAPDLIST, &count, af_type);
		} else {
			ret = dns_netdb_aliases(he->h_addr_list,
			    host->h_addr_list, (char **)&addrp6,
			    DNS_ADDRLIST, &count, af_type);
		}
		if (ret != NSS_STR_PARSE_SUCCESS)
			return (ret);
		/* h_aliases */
		host->h_aliases = host->h_addr_list + count + 1;
		ret = dns_netdb_aliases(he->h_aliases, host->h_aliases,
		    (char **)&addrp6, DNS_ALIASES, &count, af_type);
	}
	if (ret == NSS_STR_PARSE_PARSE)
		ret = NSS_STR_PARSE_SUCCESS;

	return (ret);
}

/*
 * Convert the hostent structure into string in the following
 * format:
 *
 * IP-address official-host-name nicknames ...
 *
 * If more than one IP-addresses matches the official-host-name,
 * the above line will be followed by:
 * IP-address-1 official-host-name
 * IP-address-2 official-host-name
 * ...
 *
 * This is so that the str2hostent function in libnsl
 * can convert the string back to the original hostent
 * data.
 */
int
ent2str(struct hostent	*hp, nss_XbyY_args_t *ap, int af_type)
{
	char		**p;
	char		obuf[INET6_ADDRSTRLEN];
	void		*addr;
	struct in_addr	in4;
	int		af;
	int		n;
	const char	*res;
	char		**q;
	int		l = ap->buf.buflen;
	char		*s = ap->buf.buffer;

	/*
	 * for "hosts" lookup, we only want address type of
	 * AF_INET. For "ipnodes", we can have both AF_INET
	 * and AF_INET6.
	 */
	if (af_type == AF_INET && hp->h_addrtype != AF_INET)
		return (NSS_STR_PARSE_PARSE);

	for (p = hp->h_addr_list; *p != 0; p++) {

		if (p != hp->h_addr_list) {
			*s = '\n';
			s++;
			l--;
		}

		if (hp->h_addrtype == AF_INET6) {
			/* LINTED: E_BAD_PTR_CAST_ALIGN */
			if (IN6_IS_ADDR_V4MAPPED((struct in6_addr *)*p)) {
				/* LINTED: E_BAD_PTR_CAST_ALIGN */
				IN6_V4MAPPED_TO_INADDR((struct in6_addr *)*p,
				    &in4);
				af = AF_INET;
				addr = &in4;
			} else {
				af = AF_INET6;
				addr = *p;
			}
		} else {
			af = AF_INET;
			addr = *p;
		}
		res = inet_ntop(af, addr, obuf, sizeof (obuf));
		if (res == NULL)
			return (NSS_STR_PARSE_PARSE);

		if ((n = snprintf(s, l, "%s", res)) >= l)
			return (NSS_STR_PARSE_ERANGE);
		l -= n;
		s += n;
		if (hp->h_name != NULL && *hp->h_name != '\0') {
			if ((n = snprintf(s, l, " %s", hp->h_name)) >= l)
				return (NSS_STR_PARSE_ERANGE);
			l -= n;
			s += n;
		}
		if (p == hp->h_addr_list) {
			for (q = hp->h_aliases; q && *q; q++) {
				if ((n = snprintf(s, l, " %s", *q)) >= l)
					return (NSS_STR_PARSE_ERANGE);
				l -= n;
				s += n;
			}
		}
	}

	ap->returnlen = s - ap->buf.buffer;
	return (NSS_STR_PARSE_SUCCESS);
}

nss_backend_t *
_nss_dns_constr(dns_backend_op_t ops[], int n_ops)
{
	dns_backend_ptr_t	be;

	if ((be = (dns_backend_ptr_t)malloc(sizeof (*be))) == 0)
		return (0);

	be->ops = ops;
	be->n_ops = n_ops;
	return ((nss_backend_t *)be);
}

/*
 * name_is_alias(aliases_ptr, name_ptr)
 * Verify name matches an alias in the provided aliases list.
 *
 * Within DNS there should be only one canonical name, aliases should
 * all refer to the one canonical.  However alias chains do occur and
 * pre BIND 9 servers may also respond with multiple CNAMEs.  This
 * routine checks if a given name has been provided as a CNAME in the
 * response.  This assumes that the chains have been sent in-order.
 *
 * INPUT:
 *  aliases_ptr: space separated list of alias names.
 *  name_ptr: name to look for in aliases_ptr list.
 * RETURNS: NSS_SUCCESS or NSS_NOTFOUND
 *  NSS_SUCCESS indicates that the name is listed in the collected aliases.
 */
static nss_status_t
name_is_alias(char *aliases_ptr, char *name_ptr)
{
	char *host_ptr;
	/* Loop through alias string and compare it against host string. */
	while (*aliases_ptr != '\0') {
		host_ptr = name_ptr;

		/* Compare name with alias. */
		while (tolower(*host_ptr) == tolower(*aliases_ptr) &&
		    *host_ptr != '\0') {
			host_ptr++;
			aliases_ptr++;
		}

		/*
		 * If name was exhausted and the next character in the
		 * alias is either the end-of-string or space
		 * character then we have a match.
		 */
		if (*host_ptr == '\0' &&
		    (*aliases_ptr == '\0' || *aliases_ptr == ' ')) {
			return (NSS_SUCCESS);
		}

		/* Alias did not match, step over remainder of alias. */
		while (*aliases_ptr != ' ' && *aliases_ptr != '\0')
			aliases_ptr++;
		/* Step over separator character. */
		while (*aliases_ptr == ' ') aliases_ptr++;
	}
	return (NSS_NOTFOUND);
}

static int
_nss_has_interfaces(boolean_t *v4, boolean_t *v6)
{
	struct ifaddrs *ifp, *i;
	struct in_addr in4;
	struct in6_addr in6;
	const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;

	*v4 = *v6 = B_FALSE;

	if (getifaddrs(&ifp) != 0)
		return (-1);

	for (i = ifp; i != NULL; i = i->ifa_next) {
		if (i->ifa_flags & IFF_LOOPBACK)
			continue;
		if ((i->ifa_flags & IFF_UP) == 0)
			continue;

		if (i->ifa_addr->sa_family == AF_INET) {
			if (*v4 != B_FALSE)
				continue;

			if (((struct sockaddr_in *)i->ifa_addr)->
			    sin_addr.s_addr == INADDR_ANY)
				continue;
			*v4 = B_TRUE;
		}

		if (i->ifa_addr->sa_family == AF_INET6) {
			if (*v6 != B_FALSE)
				continue;

			if (memcmp(&in6addr_any,
			    &((struct sockaddr_in6 *)i->ifa_addr)->sin6_addr,
			    sizeof (struct in6_addr)) == 0)
				continue;
			*v6 = B_TRUE;
		}
	}

	freeifaddrs(ifp);
	return (0);
}

/*
 * nss_dns_gethost_withttl(void *buffer, size_t bufsize, int ipnode)
 *      nss2 get hosts/ipnodes with ttl backend DNS search engine.
 *
 * This API is given a pointer to a packed buffer, and the buffer size
 * It's job is to perform the appropriate res_nsearch, extract the
 * results and build a unmarshalled hosts/ipnodes result buffer.
 * Additionally in the extended results a nssuint_t ttl is placed.
 * This ttl is the lessor of the ttl's extracted from the result.
 *
 * RETURNS:  NSS_SUCCESS or NSS_ERROR
 *	If an NSS_ERROR result is returned, nscd is expected
 *	to resubmit the gethosts request using the old style
 *	nsswitch lookup format.
 */

nss_status_t
_nss_dns_gethost_withttl(void *buffer, size_t bufsize, int ipnode)
{
	/* nss buffer variables */
	nss_pheader_t	*pbuf = (nss_pheader_t *)buffer;
	nss_XbyY_args_t	arg;
	char		*dbname;
	int		dbop;
	nss_status_t	sret;
	size_t		bsize, blen;
	char		*bptr;
	/* resolver query variables */
	struct __res_state stat, *statp;	/* dns state block */
	union msg {
		uchar_t	buf[NS_MAXMSG];		/* max legal DNS answer size */
		HEADER	h;
	} resbuf;
	char aliases[NS_MAXMSG];		/* set of aliases */
	const char	*name;
	int		qtype;
	/* answer parsing variables */
	HEADER		*hp;
	uchar_t		*cp;	/* current location in message */
	uchar_t		*bom;	/* start of message */
	uchar_t		*eom;	/* end of message */
	uchar_t		*eor;	/* end of record */
	int		ancount, qdcount;
	int		type, class;
	nssuint_t	nttl, ttl, *pttl;	/* The purpose of this API */
	int		n, ret;
	const char	*np;
	/* temporary buffers */
	char		nbuf[INET6_ADDRSTRLEN];	/* address parser */
	char		host[MAXHOSTNAMELEN];	/* result host name */
	char		ans[MAXHOSTNAMELEN];	/* record name */
	char		aname[MAXHOSTNAMELEN];	/* alias result (C_NAME) */
	/* misc variables */
	int		af;
	char		*ap, *apc;
	int		hlen = 0, alen, iplen, len, isans;
	boolean_t	has_v4 = B_FALSE, has_v6 = B_FALSE;
	int		flags, family, pass2 = 0;

	statp = &stat;
	(void) memset(statp, '\0', sizeof (struct __res_state));
	if (res_ninit(statp) == -1) {
		return (NSS_ERROR);
	}

	ap = apc = (char *)aliases;
	alen = 0;
	ttl = (nssuint_t)0xFFFFFFF;		/* start w/max, find smaller */

	/* save space for ttl otherwise, why bother... */
	bsize = pbuf->data_len - sizeof (nssuint_t);
	bptr = (char *)buffer + pbuf->data_off;
	blen = 0;
	sret = nss_packed_getkey(buffer, bufsize, &dbname, &dbop, &arg);
	if (sret != NSS_SUCCESS) {
		res_ndestroy(statp);
		return (NSS_ERROR);
	}

	/*
	 * There may be flags set when we are handling ipnode. There are three
	 * different values for flags:
	 *
	 *  o AI_V4MAPPED
	 *  o AI_ALL
	 *  o AI_ADDRCONFIG
	 *
	 * The first two only have a meaning when af_family is ipv6. The latter
	 * means something in both cases. These flags are documented in
	 * getipnodebyname(3SOCKET), though the combinations leave a little
	 * something to be desired. It would be great if we could actually use
	 * getipnodebyname directly here since it already knows how to handle
	 * this kind of logic; however, we're not quite so lucky. Ideally we
	 * would add such an interface to libresolv.so.2 to handle this kind of
	 * thing, but that's rather painful as well. We'll summarize what has to
	 * happen below:
	 *
	 * AI_ALL is only meaningful when AI_V4MAPPED is also specified. Both
	 * are ignored if the family is not AF_INET6
	 *
	 * family == AF_INET, flags | AI_ADDRCONFIG
	 *  - lookup A records iff we have v4 plumbed
	 * family == AF_INET, !(flags | AI_ADDRCONFIG)
	 *  - lookup A records
	 * family == AF_INET6, flags == 0 || flags == AI_ALL
	 *  - lookup AAAA records
	 * family == AF_INET6, flags | AI_V4MAPPED
	 *  - lookup AAAA, if none, lookup A
	 * family == AF_INET6, flags | AI_ADDRCONFIG
	 *  - lookup AAAA records if ipv6
	 * family == AF_INET6, flags | AI_V4MAPPED && flags | AI_ALL
	 *  - lookup AAAA records, lookup A records
	 * family == AF_INET6, flags | AI_V4MAPPED && flags | AI_ADDRCONFIG
	 *  - lookup AAAA records if ipv6
	 *  - If no AAAA && ipv4 exists, lookup A
	 * family == AF_INET6, flags | AI_V4MAPPED && flags | AI_ADDRCONFIG &&
	 * flags | AI_ALL
	 *  - lookup AAAA records if ipv6
	 *  - loookup A records if ipv4
	 */
	if (ipnode) {
		/* initially only handle the simple cases */
		name = arg.key.ipnode.name;
		flags = arg.key.ipnode.flags;
		family = arg.key.ipnode.af_family;
		if (flags != 0) {
			/*
			 * Figure out our first pass. We'll determine if we need
			 * to do a second pass afterwards once we successfully
			 * finish our first pass.
			 */
			if ((flags & AI_ADDRCONFIG) != 0) {
				if (_nss_has_interfaces(&has_v4, &has_v6) !=
				    0) {
					res_ndestroy(statp);
					return (NSS_ERROR);
				}
				/* Impossible situations... */
				if (family == AF_INET && has_v4 == B_FALSE) {
					res_ndestroy(statp);
					return (NSS_NOTFOUND);
				}
				if (family == AF_INET6 && has_v6 == B_FALSE &&
				    !(flags & AI_V4MAPPED)) {
					res_ndestroy(statp);
					return (NSS_NOTFOUND);
				}
				if (family == AF_INET6 && has_v6)
					qtype = T_AAAA;
				if (family == AF_INET || (family == AF_INET6 &&
				    has_v6 == B_FALSE && flags & AI_V4MAPPED))
					qtype = T_A;
			} else {
				has_v4 = has_v6 = B_TRUE;
				if (family == AF_INET6)
					qtype = T_AAAA;
				else
					qtype = T_A;
			}
		} else {
			if (family == AF_INET6)
				qtype = T_AAAA;
			else
				qtype = T_A;
		}
	} else {
		name = arg.key.name;
		qtype = T_A;
	}

searchagain:
	ret = res_nsearch(statp, name, C_IN, qtype, resbuf.buf, NS_MAXMSG);
	if (ret == -1) {
		/*
		 * We want to continue on unless we got NO_RECOVERY. Otherwise,
		 * HOST_NOT_FOUND, TRY_AGAIN, and NO_DATA all suggest to me that
		 * we should keep going.
		 */
		if (statp->res_h_errno == NO_RECOVERY) {
			/* else lookup error - handle in general code */
			res_ndestroy(statp);
			return (NSS_ERROR);
		}

		/*
		 * We found something on our first pass. Make sure that we do
		 * not clobber this information. This ultimately means that we
		 * were successful.
		 */
		if (pass2 == 2)
			goto out;

		/*
		 * If we're on the second pass (eg. we need to check both for A
		 * and AAAA records), or we were only ever doing a search for
		 * one type of record and are not supposed to do a second pass,
		 * then we need to return that we couldn't find anything to the
		 * user.
		 */
		if (pass2 == 1 || flags == 0 || family == AF_INET ||
		    (family == AF_INET6 && !(flags & AI_V4MAPPED))) {
			pbuf->p_herrno = HOST_NOT_FOUND;
			pbuf->p_status = NSS_NOTFOUND;
			pbuf->data_len = 0;
			res_ndestroy(statp);
			return (NSS_NOTFOUND);
		}

		/*
		 * If we were only requested to search for flags on an IPv6
		 * interface or we have no IPv4 interface, we stick to only
		 * doing a single pass and bail now.
		 */
		if ((flags & AI_ADDRCONFIG) && !(flags & AI_ALL) &&
		    has_v4 == B_FALSE) {
			pbuf->p_herrno = HOST_NOT_FOUND;
			pbuf->p_status = NSS_NOTFOUND;
			pbuf->data_len = 0;
			res_ndestroy(statp);
			return (NSS_NOTFOUND);
		}
		qtype = T_A;
		flags = 0;
		pass2 = 1;
		goto searchagain;
	}

	cp = resbuf.buf;
	hp = (HEADER *)&resbuf.h;
	bom = cp;
	eom = cp + ret;

	ancount = ntohs(hp->ancount);
	qdcount = ntohs(hp->qdcount);
	cp += HFIXEDSZ;
	if (qdcount != 1) {
		res_ndestroy(statp);
		return (NSS_ERROR);
	}
	n = dn_expand(bom, eom, cp, host, MAXHOSTNAMELEN);
	if (n < 0) {
		res_ndestroy(statp);
		return (NSS_ERROR);
	} else
		hlen = strlen(host);
	/* no host name is an error, return */
	if (hlen <= 0) {
		res_ndestroy(statp);
		return (NSS_ERROR);
	}
	cp += n + QFIXEDSZ;
	if (cp > eom) {
		res_ndestroy(statp);
		return (NSS_ERROR);
	}
	while (ancount-- > 0 && cp < eom && blen < bsize) {
		n = dn_expand(bom, eom, cp, ans, MAXHOSTNAMELEN);
		if (n > 0) {
			/*
			 * Check that the expanded name is either the
			 * name we asked for or a learned alias.
			 */
			if ((isans = strncasecmp(host, ans, hlen)) != 0 &&
			    (alen == 0 || name_is_alias(aliases, ans)
			    == NSS_NOTFOUND)) {
				res_ndestroy(statp);
				return (NSS_ERROR);	/* spoof? */
			}
		}
		cp += n;
		/* bounds check */
		type = ns_get16(cp);			/* type */
		cp += INT16SZ;
		class = ns_get16(cp);			/* class */
		cp += INT16SZ;
		nttl = (nssuint_t)ns_get32(cp);		/* ttl in sec */
		if (nttl < ttl)
			ttl = nttl;
		cp += INT32SZ;
		n = ns_get16(cp);			/* len */
		cp += INT16SZ;
		if (class != C_IN) {
			cp += n;
			continue;
		}
		eor = cp + n;
		if (type == T_CNAME) {
			/*
			 * The name looked up is really an alias and the
			 * canonical name should be in the RDATA.
			 * A canonical name may have several aliases but an
			 * alias should only have one canonical name.
			 * However multiple CNAMEs and CNAME chains do exist!
			 *
			 * Just error out on attempted buffer overflow exploit,
			 * generic code will syslog.
			 *
			 */
			n = dn_expand(bom, eor, cp, aname, MAXHOSTNAMELEN);
			if (n > 0 && (len = strlen(aname)) > 0) {
				if (isans == 0) { /* host matched ans. */
					/*
					 * Append host to alias list.
					 */
					if (alen + hlen + 2 > NS_MAXMSG) {
						res_ndestroy(statp);
						return (NSS_ERROR);
					}
					*apc++ = ' ';
					alen++;
					(void) strlcpy(apc, host,
					    NS_MAXMSG - alen);
					alen += hlen;
					apc += hlen;
				}
				/*
				 * Overwrite host with canonical name.
				 */
				if (strlcpy(host, aname, MAXHOSTNAMELEN) >=
				    MAXHOSTNAMELEN) {
					res_ndestroy(statp);
					return (NSS_ERROR);
				}
				hlen = len;
			}
			cp += n;
			continue;
		}
		if (type != qtype) {
			cp += n;
			continue;
		}
		/* check data size */
		if ((type == T_A && n != INADDRSZ) ||
		    (type == T_AAAA && n != IN6ADDRSZ)) {
			cp += n;
			continue;
		}
		af = (type == T_A ? AF_INET : AF_INET6);
		np = inet_ntop(af, (void *)cp, nbuf, INET6_ADDRSTRLEN);
		if (np == NULL) {
			res_ndestroy(statp);
			return (NSS_ERROR);
		}
		cp += n;
		/* append IP host aliases to results */
		iplen = strlen(np);
		/* ip <SP> hostname [<SP>][aliases] */
		len = iplen + 2 + hlen + alen;
		if (alen > 0)
			len++;
		if (blen + len > bsize) {
			res_ndestroy(statp);
			return (NSS_ERROR);
		}
		(void) strlcpy(bptr, np, bsize - blen);
		blen += iplen;
		bptr += iplen;
		*bptr++ = ' ';
		blen++;
		(void) strlcpy(bptr, host, bsize - blen);
		blen += hlen;
		bptr += hlen;
		if (alen > 0) {
			*bptr++ = ' ';
			blen++;
			(void) strlcpy(bptr, ap, bsize - blen);
			blen += alen;
			bptr += alen;
		}
		*bptr++ = '\n';
		blen++;
	}

	/* Depending on our flags we may need to go back another time. */
	if (qtype == T_AAAA && family == AF_INET6 &&
	    ((flags & AI_V4MAPPED) != 0) && ((flags & AI_ALL) != 0) &&
	    has_v4 == B_TRUE) {
		qtype = T_A;
		pass2 = 2; /* Indicate that we found data this pass */
		goto searchagain;
	}

out:
	/* Presumably the buffer is now filled. */
	len = ROUND_UP(blen, sizeof (nssuint_t));
	/* still room? */
	if (len + sizeof (nssuint_t) > pbuf->data_len) {
		/* sigh, no, what happened? */
		res_ndestroy(statp);
		return (NSS_ERROR);
	}

	pbuf->ext_off = pbuf->data_off + len;
	pbuf->ext_len = sizeof (nssuint_t);
	pbuf->data_len = blen;
	pttl = (nssuint_t *)((void *)((char *)pbuf + pbuf->ext_off));
	*pttl = ttl;
	res_ndestroy(statp);
	return (NSS_SUCCESS);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Common code and structures used by name-service-switch "dns" backends.
 */

#ifndef _DNS_COMMON_H
#define	_DNS_COMMON_H

#include <stdio.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <strings.h>
#include <thread.h>
#include <arpa/inet.h>
#include <arpa/nameser.h>
#include <resolv.h>
#include <syslog.h>
#include <nsswitch.h>
#include <nss_common.h>
#include <nss_dbdefs.h>
#include <stdlib.h>
#include <signal.h>

#ifdef	__cplusplus
extern "C" {
#endif

typedef struct dns_backend *dns_backend_ptr_t;
typedef nss_status_t (*dns_backend_op_t)(dns_backend_ptr_t, void *);

struct dns_backend {
	dns_backend_op_t	*ops;
	nss_dbop_t		n_ops;
};

/* multithreaded libresolv2 related functions and variables */
extern void	(*set_no_hosts_fallback)(void);
extern void	(*unset_no_hosts_fallback)(void);
extern struct __res_state	*(*set_res_retry)();
extern int	(*enable_mt)();
extern int	(*disable_mt)();
extern int	*(*get_h_errno)();
extern int	(*override_retry)(int);
extern void	switch_resolver_setup(int *, sigset_t *, int *);
extern void	switch_resolver_reset(int, sigset_t, int);
extern mutex_t	one_lane;

extern int ent2result(struct hostent *, nss_XbyY_args_t *, int);
extern int ent2str(struct hostent *, nss_XbyY_args_t *, int);

nss_backend_t *_nss_dns_constr(dns_backend_op_t *, int);
extern	nss_status_t _herrno2nss(int);

nss_status_t _nss_dns_gethost_withttl(void *buf, size_t bufsize, int ipnode);
nss_status_t _nss_get_dns_hosts_name(dns_backend_ptr_t *, void **, size_t *);
nss_status_t _nss_get_dns_ipnodes_name(dns_backend_ptr_t *, void **, size_t *);

#ifdef	__cplusplus
}
#endif

#endif /* _DNS_COMMON_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * dns_mt.c
 *
 * This file contains all the MT related routines for the DNS backend.
 */

#include "dns_common.h"
#include <dlfcn.h>

/*
 * If the DNS name service switch routines are used in a binary that depends
 * on an older libresolv (libresolv.so.1, say), then having nss_dns.so.1 or
 * libnss_dns.a depend on a newer libresolv (libresolv.so.2) will cause
 * relocation problems. In particular, copy relocation of the _res structure
 * (which changes in size from libresolv.so.1 to libresolv.so.2) could
 * cause corruption, and result in a number of strange problems, including
 * core dumps. Hence, we check if a libresolv is already loaded.
 */

#pragma init(_nss_dns_init)
static void	_nss_dns_init(void);

extern struct hostent *res_gethostbyname(const char *);
#pragma weak	res_gethostbyname

#define		RES_SET_NO_HOSTS_FALLBACK	"__res_set_no_hosts_fallback"
extern void	__res_set_no_hosts_fallback(void);
#pragma weak	__res_set_no_hosts_fallback

#define		RES_UNSET_NO_HOSTS_FALLBACK	"__res_unset_no_hosts_fallback"
extern void	__res_unset_no_hosts_fallback(void);
#pragma weak	__res_unset_no_hosts_fallback

#define		RES_GET_RES	"__res_get_res"
extern struct __res_state	*__res_get_res(void);
#pragma weak	__res_get_res

#define		RES_ENABLE_MT			"__res_enable_mt"
extern int	__res_enable_mt(void);
#pragma weak	__res_enable_mt

#define		RES_DISABLE_MT			"__res_disable_mt"
extern int	__res_disable_mt(void);
#pragma weak	__res_disable_mt

#define		RES_GET_H_ERRNO			"__res_get_h_errno"
extern int	*__res_get_h_errno();
#pragma weak	__res_get_h_errno

#define		__H_ERRNO			"__h_errno"
extern int	*__h_errno(void);
#pragma weak	__h_errno

#define		RES_OVERRIDE_RETRY		"__res_override_retry"
extern int	__res_override_retry(int);
#pragma weak	__res_override_retry

static void	__fallback_set_no_hosts(void);
static int	*__fallback_h_errno(void);
static int	__fallback_override_retry(int);
static int	__is_mt_safe(void);

void	(*set_no_hosts_fallback)(void) = __fallback_set_no_hosts;
void	(*unset_no_hosts_fallback)(void) = __fallback_set_no_hosts;
struct __res_state	*(*set_res_retry)() = 0;
int	(*enable_mt)() = 0;
int	(*disable_mt)() = 0;
int	*(*get_h_errno)(void) = 0;
int	(*override_retry)(int) = 0;

/* Usually set from the Makefile */
#ifndef	NSS_DNS_LIBRESOLV
#define	NSS_DNS_LIBRESOLV	"libresolv.so.2"
#endif

/* From libresolv */
extern	int	h_errno;

mutex_t	one_lane = DEFAULTMUTEX;

void
_nss_dns_init(void)
{
	void		*reslib, (*f_void_ptr)();

	/* If no libresolv library, then load one */
	if (res_gethostbyname == 0) {
		if ((reslib =
		    dlopen(NSS_DNS_LIBRESOLV, RTLD_LAZY|RTLD_GLOBAL)) != 0) {
			/* Turn off /etc/hosts fall back in libresolv */
			if ((f_void_ptr = (void (*)(void))dlsym(reslib,
			    RES_SET_NO_HOSTS_FALLBACK)) != 0) {
				set_no_hosts_fallback = f_void_ptr;
			}
			if ((f_void_ptr = (void (*)(void))dlsym(reslib,
			    RES_SET_NO_HOSTS_FALLBACK)) != 0) {
				unset_no_hosts_fallback = f_void_ptr;
			}
			/* Set number of resolver retries */
			if ((override_retry = (int (*)(int))dlsym(reslib,
			    RES_OVERRIDE_RETRY)) == 0) {
				set_res_retry =
				    (struct __res_state *(*)(void))dlsym(reslib,
				    RES_GET_RES);
				override_retry = __fallback_override_retry;
			}
			/*
			 * Select h_errno retrieval function. A BIND 8.2.2
			 * libresolv.so.2 will have __h_errno, a BIND 8.1.2
			 * one will have __res_get_h_errno, and other
			 * versions may have nothing at all.
			 *
			 * Also try to bind to the relevant MT enable/disable
			 * functions which are also dependent on the version
			 * of the BIND libresolv.so.2 being used.
			 */
			if ((get_h_errno = (int *(*)(void))dlsym(reslib,
			    __H_ERRNO)) != 0) {
				/* BIND 8.2.2 libresolv.so.2 is MT safe. */
				enable_mt = __is_mt_safe;
				disable_mt = __is_mt_safe;
			} else {
				if ((get_h_errno =
				    (int *(*)(void))dlsym(reslib,
				    RES_GET_H_ERRNO)) == 0) {
					get_h_errno = __fallback_h_errno;
				}
				/*
				 * Pre-BIND 8.2.2 was not MT safe.  Try to
				 * bind the MT enable/disable functions.
				 */
				if ((enable_mt = (int (*)(void))dlsym(reslib,
				    RES_ENABLE_MT)) != 0 &&
				    (disable_mt = (int (*)(void))dlsym(reslib,
				    RES_DISABLE_MT)) == 0) {
					enable_mt = 0;
				}
			}
		}
	} else {
		/* Libresolv already loaded */
		if ((f_void_ptr = __res_set_no_hosts_fallback) != 0) {
			set_no_hosts_fallback = f_void_ptr;
		}
		if ((f_void_ptr = __res_unset_no_hosts_fallback) != 0) {
			unset_no_hosts_fallback = f_void_ptr;
		}
		if ((override_retry = __res_override_retry) == 0) {
			set_res_retry = __res_get_res;
			override_retry = __fallback_override_retry;
		}
		if ((get_h_errno = __h_errno) == 0 &&
		    (get_h_errno = __res_get_h_errno) == 0) {
			get_h_errno = __fallback_h_errno;
		}
		if (get_h_errno == __h_errno) {
			enable_mt = __is_mt_safe;
			disable_mt = __is_mt_safe;
		} else {
			if ((enable_mt = __res_enable_mt) != 0 &&
			    (disable_mt = __res_disable_mt) == 0) {
				enable_mt = 0;
			}
		}
	}
}


/*
 *
 * Integration of BIND 8.1.2 introduced two new Sun private functions,
 * __res_enable_mt() and __res_disable_mt(), that enabled and disabled
 * MT mode per-thread. These functions are in the private libresolv.so.2
 * interface, and intended for use by nss_dns.so.1.
 *
 * BIND 8.2.2 removed the need for those two functions.  As similar
 * functionality was provided in BIND further up the stack. However the
 * functions remain to satisfy any application that directly called upon
 * them.  Only, __res_enable_mt() was modified to return failure.
 * Indicated by a non-zero return value.  So that those unconventional
 * applications would not then presume that res_send() and friends are
 * MT-safe, when in fact they are not.
 *
 * To prevent nss_dns from locking inappropriately __is_mt_safe() is
 * called in place of __res_enable_mt() and __res_disable_mt() if BIND
 * 8.2.2 libresolv.so.2 being used.  __is_mt_safe() returns success
 * indicated by a return code of zero. Signifying that no locking is
 * necessary.
 *
 * MT applications making calls to gethostby*_r() or getipnodeby*()
 * linked to libresolv.so.1 or linked statically with pre-BIND 8.2.2
 * libresolv.a, doubtful as we don't ship a static version, would require
 * locking within the nsswitch back-end.  Hence the mechanism can not
 * simply be removed.
 *
 */
static int
__is_mt_safe(void) {
	return (0);
}


/*
 * Return pointer to the global h_errno variable
 */
static int *
__fallback_h_errno(void) {
	return (&h_errno);
}


/*
 * This function is called when the resolver library doesn't provide its
 * own function to establish an override retry. If we can get a pointer
 * to the per-thread _res (i.e., set_res_retry != 0), we set the retries
 * directly, and return the previous number of retries. Otherwise, there's
 * nothing to do.
 */
static int
__fallback_override_retry(int retry) {
	struct __res_state	*res;
	int			old_retry = 0;

	if (set_res_retry != 0) {
		res = set_res_retry();
		old_retry = res->retry;
		res->retry = retry;
	}
	return (old_retry);
}


static void
__fallback_set_no_hosts(void) {
}


/*
 * Common code to enable/disable MT mode, set/unset no-/etc/hosts fallback,
 * and to set the number of retries.
 */
void
switch_resolver_setup(int *mt_disabled, sigset_t *oldmask, int *old_retry) {

	/*
	 * Try to enable MT mode. If that isn't possible, mask signals,
	 * and mutex_lock.
	 */
	*mt_disabled = 1;
	if (enable_mt == 0 || (*mt_disabled = (*enable_mt)()) != 0) {
		sigset_t	newmask;
		(void) sigfillset(&newmask);
		(void) thr_sigsetmask(SIG_SETMASK, &newmask, oldmask);
		(void) mutex_lock(&one_lane);
	}

	/*
	 * Disable any fallback to /etc/hosts (or /etc/inet/ipnodes, when
	 * libresolv knows about that file).
	 */
	(*set_no_hosts_fallback)();

	/*
	 * The NS switch wants to handle retries on its own.
	 */
	*old_retry = (*override_retry)(1);
}


void
switch_resolver_reset(int mt_disabled, sigset_t oldmask, int old_retry) {

	if (mt_disabled) {
		(void) mutex_unlock(&one_lane);
		(void) thr_sigsetmask(SIG_SETMASK, &oldmask, NULL);
	} else {
		(void) (*disable_mt)();
	}

	(*unset_no_hosts_fallback)();

	(void) (*override_retry)(old_retry);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * gethostent.c
 *
 * In order to avoid duplicating libresolv code here, and since libresolv.so.2
 * provides res_-equivalents of the getXbyY and {set,get}Xent, lets call
 * re_gethostbyaddr() and so on from this file. Among other things, this
 * should help us avoid problems like the one described in bug 1264386,
 * where the internal getanswer() acquired new functionality in BIND 4.9.3,
 * but the local copy of getanswer() in this file wasn't updated, so that new
 * functionality wasn't available to the name service switch.
 */

#define	gethostbyaddr	res_gethostbyaddr
#define	gethostbyname	res_gethostbyname
#define	gethostbyname2	res_gethostbyname2
#define	sethostent	res_sethostent
#define	endhostent	res_endhostent

#include "dns_common.h"

extern char *inet_ntoa(struct in_addr in);

struct hostent *_gethostbyname(int *h_errnop, const char *name);
static struct hostent *_gethostbyaddr(int *h_errnop, const char *addr,
    int len, int type);
struct hostent *_nss_dns_gethostbyname2(int *h_errnop, const char *name);

#pragma weak	res_gethostbyname
#pragma weak	res_gethostbyname2
#pragma weak	res_gethostbyaddr
#pragma weak	res_sethostent
#pragma weak	res_endhostent

nss_backend_t *_nss_dns_constr(dns_backend_op_t ops[], int n_ops);
nss_status_t __nss_dns_getbyaddr(dns_backend_ptr_t, void *);

typedef union {
	long al;
	char ac;
} align;

/*
 * Internet Name Domain Server (DNS) only implementation.
 */
static struct hostent *
_gethostbyaddr(int *h_errnop, const char *addr, int len, int type)
{
	struct hostent	*hp;

	hp = gethostbyaddr(addr, len, type);
	*h_errnop = *get_h_errno();
	return (hp);
}

struct hostent *
_nss_dns_gethostbyname2(int *h_errnop, const char *name)
{
	struct hostent *hp;

	hp = gethostbyname2(name, AF_INET6);
	*h_errnop = *get_h_errno();
	return (hp);
}

struct hostent *
_gethostbyname(int *h_errnop, const char *name)
{
	struct hostent *hp;

	hp = gethostbyname(name);
	*h_errnop = *get_h_errno();
	return (hp);
}

static void
_sethostent(errp, stayopen)
	nss_status_t	*errp;
	int		stayopen;
{
	int	ret;

	ret = sethostent(stayopen);
	if (ret == 0)
		*errp = NSS_SUCCESS;
	else
		*errp = NSS_UNAVAIL;
}

static void
_endhostent(errp)
	nss_status_t	*errp;
{
	int	ret;

	ret = endhostent();
	if (ret == 0)
		*errp = NSS_SUCCESS;
	else
		*errp = NSS_UNAVAIL;
}


/*ARGSUSED*/
static nss_status_t
getbyname(be, a)
	dns_backend_ptr_t	be;
	void			*a;
{
	struct hostent	*he;
	nss_XbyY_args_t	*argp = (nss_XbyY_args_t *)a;
	int		ret, mt_disabled;
	int		old_retry;
	sigset_t	oldmask;

	switch_resolver_setup(&mt_disabled, &oldmask, &old_retry);

	he = _gethostbyname(&argp->h_errno, argp->key.name);
	if (he != NULL) {
		if (argp->buf.result == NULL) {
			/*
			 * if asked to return data in string,
			 * convert the hostent structure into
			 * string data
			 */
			ret = ent2str(he, a, AF_INET);
			if (ret == NSS_STR_PARSE_SUCCESS)
				argp->returnval = argp->buf.buffer;
		} else {
			ret = ent2result(he, a, AF_INET);
			if (ret == NSS_STR_PARSE_SUCCESS)
				argp->returnval = argp->buf.result;
		}

		if (ret != NSS_STR_PARSE_SUCCESS) {
			argp->h_errno = HOST_NOT_FOUND;
			if (ret == NSS_STR_PARSE_ERANGE) {
				argp->erange = 1;
			}
		}
	}

	switch_resolver_reset(mt_disabled, oldmask, old_retry);

	return (_herrno2nss(argp->h_errno));
}



/*ARGSUSED*/
static nss_status_t
getbyaddr(be, a)
	dns_backend_ptr_t	be;
	void			*a;
{
	return (__nss_dns_getbyaddr(be, a));
}


/*
 * Exposing a DNS backend specific interface so that it doesn't conflict
 * with other getbyaddr() routines from other switch backends.
 */
/*ARGSUSED*/
nss_status_t
__nss_dns_getbyaddr(be, a)
	dns_backend_ptr_t	be;
	void			*a;
{
	struct hostent	*he;
	nss_XbyY_args_t	*argp = (nss_XbyY_args_t *)a;
	int		ret, mt_disabled;
	struct in_addr	unmapv4;
	sigset_t	oldmask;
	int		af, addrlen;
	void		*addrp;
	int		old_retry;

	switch_resolver_setup(&mt_disabled, &oldmask, &old_retry);

	/* LINTED: E_BAD_PTR_CAST_ALIGN */
	if (IN6_IS_ADDR_V4MAPPED((struct in6_addr *)argp->key.hostaddr.addr)) {
		addrp = &unmapv4;
		addrlen = sizeof (unmapv4);
		af = AF_INET;
		(void) memcpy(addrp, &argp->key.hostaddr.addr[12], addrlen);
	} else {
		addrp = (void *)argp->key.hostaddr.addr;
		addrlen = argp->key.hostaddr.len;
		af = argp->key.hostaddr.type;
	}
	he = _gethostbyaddr(&argp->h_errno, addrp, addrlen, af);

	if (he != NULL) {
		/*
		 * if asked to return data in string, convert
		 * the hostent structure into string data
		 */
		if (argp->buf.result == NULL)
			ret = ent2str(he, a, argp->key.hostaddr.type);
		else
			ret = ent2result(he, a, argp->key.hostaddr.type);

		if (ret == NSS_STR_PARSE_SUCCESS) {
			if (argp->buf.result == NULL)
				argp->returnval = argp->buf.buffer;
			else
				argp->returnval = argp->buf.result;
		} else {
			argp->h_errno = HOST_NOT_FOUND;
			if (ret == NSS_STR_PARSE_ERANGE)
				argp->erange = 1;
		}
	}

	switch_resolver_reset(mt_disabled, oldmask, old_retry);

	return (_herrno2nss(argp->h_errno));
}


/*ARGSUSED*/
static nss_status_t
_nss_dns_getent(be, args)
	dns_backend_ptr_t	be;
	void			*args;
{
	return (NSS_UNAVAIL);
}


/*ARGSUSED*/
static nss_status_t
_nss_dns_setent(be, dummy)
	dns_backend_ptr_t	be;
	void			*dummy;
{
	nss_status_t	errp;

	sigset_t	oldmask, newmask;
	int		mt_disabled = 1;

	/*
	 * Try to enable MT; if not, we have to single-thread libresolv
	 * access
	 */
	if (enable_mt == 0 || (mt_disabled = (*enable_mt)()) != 0) {
		(void) sigfillset(&newmask);
		(void) thr_sigsetmask(SIG_SETMASK, &newmask, &oldmask);
		(void) mutex_lock(&one_lane);
	}

	_sethostent(&errp, 1);

	if (mt_disabled) {
		(void) mutex_unlock(&one_lane);
		(void) thr_sigsetmask(SIG_SETMASK, &oldmask, NULL);
	} else {
		(void) (*disable_mt)();
	}

	return (errp);
}


/*ARGSUSED*/
static nss_status_t
_nss_dns_endent(be, dummy)
	dns_backend_ptr_t	be;
	void			*dummy;
{
	nss_status_t	errp;

	sigset_t	oldmask, newmask;
	int		mt_disabled = 1;

	/*
	 * Try to enable MT; if not, we have to single-thread libresolv
	 * access
	 */
	if (enable_mt == 0 || (mt_disabled = (*enable_mt)()) != 0) {
		(void) sigfillset(&newmask);
		(void) thr_sigsetmask(SIG_SETMASK, &newmask, &oldmask);
		(void) mutex_lock(&one_lane);
	}

	_endhostent(&errp);

	if (mt_disabled) {
		(void) mutex_unlock(&one_lane);
		(void) thr_sigsetmask(SIG_SETMASK, &oldmask, NULL);
	} else {
		(void) (*disable_mt)();
	}

	return (errp);
}


/*ARGSUSED*/
static nss_status_t
_nss_dns_destr(be, dummy)
	dns_backend_ptr_t	be;
	void			*dummy;
{
	nss_status_t	errp;

	if (be != 0) {
		/* === Should change to invoke ops[ENDENT] ? */
		sigset_t	oldmask, newmask;
		int		mt_disabled = 1;

		if (enable_mt == 0 || (mt_disabled = (*enable_mt)()) != 0) {
			(void) sigfillset(&newmask);
			(void) thr_sigsetmask(SIG_SETMASK, &newmask, &oldmask);
			(void) mutex_lock(&one_lane);
		}

		_endhostent(&errp);

		if (mt_disabled) {
			(void) mutex_unlock(&one_lane);
			(void) thr_sigsetmask(SIG_SETMASK, &oldmask, NULL);
		} else {
			(void) (*disable_mt)();
		}

		free(be);
	}
	return (NSS_SUCCESS);   /* In case anyone is dumb enough to check */
}


static dns_backend_op_t host_ops[] = {
	_nss_dns_destr,
	_nss_dns_endent,
	_nss_dns_setent,
	_nss_dns_getent,
	getbyname,
	getbyaddr,
};

/*ARGSUSED*/
nss_backend_t *
_nss_dns_hosts_constr(dummy1, dummy2, dummy3)
	const char	*dummy1, *dummy2, *dummy3;
{
	return (_nss_dns_constr(host_ops,
		sizeof (host_ops) / sizeof (host_ops[0])));
}

/*
 * optional NSS2 packed backend gethostsbyname with ttl
 * entry point.
 *
 * Returns:
 *	NSS_SUCCESS - successful
 *	NSS_NOTFOUND - successful but nothing found
 *	NSS_ERROR - fallback to NSS backend lookup mode
 * If successful, buffer will be filled with valid data
 *
 */

/*ARGSUSED*/
nss_status_t
_nss_get_dns_hosts_name(dns_backend_ptr_t *be, void **bufp, size_t *sizep)
{
	return (_nss_dns_gethost_withttl(*bufp, *sizep, 0));
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * This is the DNS backend for IPv6 addresses.
 * getbyname() is a local routine, but getbyaddr() actually shares the
 * same codes as the one in gethostent.c.
 */

#define	endhostent	res_endhostent

#include <malloc.h>
#include <stddef.h>
#include <string.h>
#include "dns_common.h"

/*
 * If the DNS name service switch routines are used in a binary that depends
 * on an older libresolv (libresolv.so.1, say), then having nss_dns.so.1 or
 * libnss_dns.a depend on a newer libresolv (libresolv.so.2) will cause
 * relocation problems. In particular, copy relocation of the _res structure
 * (which changes in size from libresolv.so.1 to libresolv.so.2) could
 * cause corruption, and result in a number of strange problems, including
 * core dumps. Hence, we check if a libresolv is already loaded.
 */


#pragma weak	res_endhostent

extern struct hostent *_gethostbyname(int *, const char *);
extern struct hostent *_nss_dns_gethostbyname2(int *, const char *);

typedef union {
	long al;
	char ac;
} align;


static void
_endhostent(errp)
	nss_status_t	*errp;
{
	int	ret;

	ret = endhostent();
	if (ret == 0)
		*errp = NSS_SUCCESS;
	else
		*errp = NSS_UNAVAIL;
}


#ifdef	RNDUP
#undef	RNDUP
#endif
#define	RNDUP(x)	((1 + (((x)-1)/sizeof (void *))) * sizeof (void *))

#ifdef	PTROFF
#undef	PTROFF
#endif
#define	PTROFF(p, o)	(((o) == 0) ? 0 : (void *)((char *)(p) + (o)))


/*
 * Make a copy of h->h_name.
 */
static char *
cloneName(struct hostent *h, int *outerr) {

	char	*name;
	int	len;
	int	error, *errp;

	if (outerr)
		errp = outerr;
	else
		errp = &error;

	if (h == 0 || h->h_name == 0) {
		*errp = 0;
		return (0);
	}

	len = strlen(h->h_name);

	if ((name = malloc(len+1)) == 0) {
		*errp = 1;
		return (0);
	}

	(void) memcpy(name, h->h_name, len+1);

	*errp = 0;
	return (name);
}


/*
 * Copy the h->h_addr_list[] array to a new array, and append the
 * moreAddrs[] list. If h->h_addr_list[] contains IPv4 addresses,
 * convert them to v4 mapped IPv6 addresses.
 *
 * Note: The pointers to the addresses in the moreAddrs[] array are copied,
 *       but not the IP addresses themselves.
 */
static struct in6_addr **
cloneAddrList(struct hostent *h, struct in6_addr **moreAddrs, int *outerr) {

	struct in6_addr	**addrArray, *addrList;
	int		domap, addrlen, i, j, addrCount, moreAddrCount = 0;

	int	error, *errp;

	if (outerr)
		errp = outerr;
	else
		errp = &error;

	if (h == 0 || h->h_addr_list == 0) {
		*errp = 0;
		return (0);
	}

	/* Should we map v4 to IPv6 ? */
	domap = (h->h_length == sizeof (struct in_addr)) &&
		(h->h_addrtype == AF_INET);

	/* If mapping, make sure we allocate enough memory for addresses */
	addrlen = h->h_length;
	if (domap && addrlen < sizeof (struct in6_addr))
		addrlen = sizeof (struct in6_addr);

	for (addrCount = 0; h->h_addr_list[addrCount]; addrCount++);

	if (moreAddrs != 0) {
		for (moreAddrCount = 0; moreAddrs[moreAddrCount];
			moreAddrCount++);
	}

	if ((addrArray = malloc((addrCount+moreAddrCount+1)*sizeof (addrList) +
				addrCount*addrlen)) == 0) {
		*errp = 1;
		return (0);
	}

	addrList = PTROFF(addrArray, (addrCount+moreAddrCount+1) *
					sizeof (addrList));

	for (i = 0; i < addrCount; i++) {
		addrArray[i] = addrList;
		if (domap) {
			/* LINTED: E_BAD_PTR_CAST_ALIGN */
			IN6_INADDR_TO_V4MAPPED(
			(struct in_addr *)h->h_addr_list[i], addrArray[i]);
		} else {
			(void) memcpy(addrArray[i], h->h_addr_list[i],
				addrlen);
		}
		addrList = PTROFF(addrList, addrlen);
	}

	for (j = 0; j < moreAddrCount; j++, i++) {
		addrArray[i] = moreAddrs[j];
	}

	/* Last pointer should be NULL */
	addrArray[i] = 0;

	*errp = 0;
	return (addrArray);
}


/*
 * Create a new alias array that is is a copy of h->h_aliases[] plus
 * the aliases in mergeAliases[] which aren't duplicates of any alias
 * in h->h_aliases[].
 *
 * Note 1: Only the string pointers (NOT the strings) in the mergeAliases[]
 *         array are copied.
 *
 * Note 2: The duplicate aliases in mergeAliases[] are replaced by NULL
 *         pointers.
 */
static char **
cloneAliasList(struct hostent *h, char **mergeAliases, int *outerr) {

	char	**aliasArray, *aliasList;
	int	i, j, aliasCount, mergeAliasCount = 0, realMac = 0;
	int	stringSize = 0;
	int	error, *errp;

	if (outerr)
		errp = outerr;
	else
		errp = &error;


	if (h == 0 || h->h_aliases == 0) {
		*errp = 0;
		return (0);
	}

	for (aliasCount = 0; h->h_aliases[aliasCount]; aliasCount++) {
		stringSize += RNDUP(strlen(h->h_aliases[aliasCount])+1);
	}

	if (mergeAliases != 0) {
		for (; mergeAliases[mergeAliasCount]; mergeAliasCount++) {
			int	countThis = 1;
			/* Skip duplicates */
			for (j = 0; j < aliasCount; j++) {
				if (strcmp(mergeAliases[mergeAliasCount],
						h->h_aliases[j]) == 0) {
					countThis = 0;
					break;
				}
			}
			if (countThis)
				realMac++;
			else
				mergeAliases[mergeAliasCount] = 0;
		}
	}

	if ((aliasArray = malloc((aliasCount+realMac+1)*sizeof (char **)+
				stringSize)) == 0) {
		*errp = 1;
		return (0);
	}

	aliasList = PTROFF(aliasArray,
				(aliasCount+realMac+1)*sizeof (char **));
	for (i = 0; i < aliasCount; i++) {
		int	len = strlen(h->h_aliases[i]);
		aliasArray[i] = aliasList;
		(void) memcpy(aliasArray[i], h->h_aliases[i], len+1);
		aliasList = PTROFF(aliasList, RNDUP(len+1));
	}

	for (j = 0; j < mergeAliasCount; j++) {
		if (mergeAliases[j] != 0) {
			aliasArray[i++] = mergeAliases[j];
		}
	}

	aliasArray[i] = 0;

	*errp = 0;
	return (aliasArray);
}

/*ARGSUSED*/
static nss_status_t
getbyname(be, a)
	dns_backend_ptr_t	be;
	void			*a;
{
	struct hostent	*he = NULL;
	nss_XbyY_args_t	*argp = (nss_XbyY_args_t *)a;
	int		ret, mt_disabled;
	sigset_t	oldmask;
	int		converr = 0, gotv6 = 0;
	struct hostent	v6he;
	struct hostent	mhe;
	char		*v6Name = 0;
	struct in6_addr	**v6Addrs = 0, **mergeAddrs = 0;
	char		**v6Aliases = 0, **mergeAliases = 0;
	int		v6_h_errno;
	int		old_retry;
	int		af = argp->key.ipnode.af_family;
	int		flags = argp->key.ipnode.flags;

	switch_resolver_setup(&mt_disabled, &oldmask, &old_retry);

	/* Now get the AAAA records */
	if (af == AF_INET6)
		he = _nss_dns_gethostbyname2(&argp->h_errno,
					argp->key.ipnode.name);
	if (he != NULL) {
		/*
		 * pointer in "he" is part of a static pthread key in libresolv
		 * It should be treated as read only.
		 * So clone a copy first.
		 */
		v6Name = cloneName(he, &converr);
		if (converr) {
			argp->h_errno = HOST_NOT_FOUND;
			argp->erange = 1;
			switch_resolver_reset(mt_disabled, oldmask, old_retry);
			return (_herrno2nss(argp->h_errno));
		}
		v6Addrs = cloneAddrList(he, 0, &converr);
		if (converr) {
			if (v6Name != 0)
				free(v6Name);
			argp->h_errno = HOST_NOT_FOUND;
			argp->erange = 1;
			switch_resolver_reset(mt_disabled, oldmask, old_retry);
			return (_herrno2nss(argp->h_errno));
		}
		v6Aliases = cloneAliasList(he, 0, &converr);
		if (converr) {
			if (v6Name != 0)
				free(v6Name);
			if (v6Addrs != 0)
				free(v6Addrs);
			argp->h_errno = HOST_NOT_FOUND;
			argp->erange = 1;
			switch_resolver_reset(mt_disabled, oldmask, old_retry);
			return (_herrno2nss(argp->h_errno));
		}
		v6_h_errno = argp->h_errno;
		gotv6 = 1;
	}

	/*
	 * The conditions to search "A" records:
	 * 1. af is AF_INET
	 * 2. if af is AF_INET6
	 *    then flags are either
	 *	1) (AI_ALL | AI_V4MAPPED) or
	 *	2) AI_V4MAPPED and he == NULL
	 *	    (No V6 addresses found or no search for V6 at all)
	 */

	/* Get the A records, and store the information */
	if ((af == AF_INET) ||
	    ((af == AF_INET6) &&
		((flags & (AI_ALL | AI_V4MAPPED)) ||
		((flags & AI_V4MAPPED) && he == NULL))))
		he = _gethostbyname(&argp->h_errno, argp->key.ipnode.name);
	else
		he = NULL;

	/* Merge the results */
	if (he != NULL) {
		mhe = *he;
		mergeAddrs = cloneAddrList(he, v6Addrs, &converr);
		if (converr) {
			if (v6Name != 0)
				free(v6Name);
			if (v6Addrs != 0)
				free(v6Addrs);
			if (v6Aliases != 0)
				free(v6Aliases);
			argp->h_errno = HOST_NOT_FOUND;
			argp->erange = 1;
			switch_resolver_reset(mt_disabled, oldmask,
						old_retry);
			return (_herrno2nss(argp->h_errno));
		}
		mhe.h_addr_list = (char **)mergeAddrs;

		mergeAliases = cloneAliasList(he, v6Aliases, &converr);
		if (converr) {
			if (v6Name != 0)
				free(v6Name);
			if (v6Addrs != 0)
				free(v6Addrs);
			if (v6Aliases != 0)
				free(v6Aliases);
			if (mergeAddrs != 0)
				free(mergeAddrs);
			argp->h_errno = HOST_NOT_FOUND;
			argp->erange = 1;
			switch_resolver_reset(mt_disabled, oldmask,
						old_retry);
			return (_herrno2nss(argp->h_errno));
		}
		mhe.h_aliases = mergeAliases;

		/* reset h_length, h_addrtype */
		mhe.h_length = sizeof (struct in6_addr);
		mhe.h_addrtype = AF_INET6;
		he = &mhe;

	} else if (gotv6) {
		v6he.h_name = v6Name;
		v6he.h_length = sizeof (struct in6_addr);
		v6he.h_addrtype = AF_INET6;
		v6he.h_addr_list = (char **)v6Addrs;
		v6he.h_aliases = v6Aliases;
		he = &v6he;
		argp->h_errno = v6_h_errno;
	}

	if (he != NULL) {
		/*
		 * if asked to return data in string,
		 * convert the hostent structure into
		 * string data
		 */
		if (argp->buf.result == NULL) {
			ret = ent2str(he, a, AF_INET6);
			if (ret == NSS_STR_PARSE_SUCCESS)
				argp->returnval = argp->buf.buffer;
		} else {
			ret = ent2result(he, a, AF_INET6);
			if (ret == NSS_STR_PARSE_SUCCESS)
				argp->returnval = argp->buf.result;
		}

		if (ret != NSS_STR_PARSE_SUCCESS) {
			argp->h_errno = HOST_NOT_FOUND;
			if (ret == NSS_STR_PARSE_ERANGE) {
				argp->erange = 1;
			}
		}
	}

	if (v6Name != 0)
		free(v6Name);
	if (v6Addrs != 0)
		free(v6Addrs);
	if (v6Aliases != 0)
		free(v6Aliases);
	if (mergeAddrs != 0)
		free(mergeAddrs);
	if (mergeAliases != 0)
		free(mergeAliases);

	switch_resolver_reset(mt_disabled, oldmask, old_retry);

	return (_herrno2nss(argp->h_errno));
}


extern nss_status_t __nss_dns_getbyaddr(dns_backend_ptr_t, void *);

static nss_status_t
getbyaddr(be, a)
	dns_backend_ptr_t	be;
	void			*a;
{
	/* uses the same getbyaddr from IPv4 */
	return (__nss_dns_getbyaddr(be, a));
}


/*ARGSUSED*/
static nss_status_t
_nss_dns_getent(be, args)
	dns_backend_ptr_t	be;
	void			*args;
{
	return (NSS_UNAVAIL);
}


/*ARGSUSED*/
static nss_status_t
_nss_dns_setent(be, dummy)
	dns_backend_ptr_t	be;
	void			*dummy;
{
	/* XXXX not implemented at this point */
	return (NSS_UNAVAIL);
}


/*ARGSUSED*/
static nss_status_t
_nss_dns_endent(be, dummy)
	dns_backend_ptr_t	be;
	void			*dummy;
{
	/* XXXX not implemented at this point */
	return (NSS_UNAVAIL);
}


/*ARGSUSED*/
static nss_status_t
_nss_dns_destr(be, dummy)
	dns_backend_ptr_t	be;
	void			*dummy;
{
	nss_status_t	errp;

	if (be != 0) {
		/* === Should change to invoke ops[ENDENT] ? */
		sigset_t	oldmask, newmask;
		int		mt_disabled = 1;

		if (enable_mt == 0 || (mt_disabled = (*enable_mt)()) != 0) {
			(void) sigfillset(&newmask);
			(void) thr_sigsetmask(SIG_SETMASK, &newmask, &oldmask);
			(void) mutex_lock(&one_lane);
		}

		_endhostent(&errp);

		if (mt_disabled) {
			(void) mutex_unlock(&one_lane);
			(void) thr_sigsetmask(SIG_SETMASK, &oldmask, NULL);
		} else {
			(void) (*disable_mt)();
		}

		free(be);
	}
	return (NSS_SUCCESS);   /* In case anyone is dumb enough to check */
}



static dns_backend_op_t ipnodes_ops[] = {
	_nss_dns_destr,
	_nss_dns_endent,
	_nss_dns_setent,
	_nss_dns_getent,
	getbyname,
	getbyaddr,
};

/*ARGSUSED*/
nss_backend_t *
_nss_dns_ipnodes_constr(dummy1, dummy2, dummy3)
	const char	*dummy1, *dummy2, *dummy3;
{
	return (_nss_dns_constr(ipnodes_ops,
		sizeof (ipnodes_ops) / sizeof (ipnodes_ops[0])));
}

/*
 * optional NSS2 packed backend gethostsbyipnode with ttl
 * entry point.
 *
 * Returns:
 *	NSS_SUCCESS - successful
 *	NSS_NOTFOUND - successful but nothing found
 *	NSS_ERROR - fallback to NSS backend lookup mode
 * If successful, buffer will be filled with valid data
 *
 */

/*ARGSUSED*/
nss_status_t
_nss_get_dns_ipnodes_name(dns_backend_ptr_t *be, void **bufp, size_t *sizep)
{
	return (_nss_dns_gethost_withttl(*bufp, *sizep, 1));
}
#
# Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#

#
# MAPFILE HEADER START
#
# WARNING:  STOP NOW.  DO NOT MODIFY THIS FILE.
# Object versioning must comply with the rules detailed in
#
#	usr/src/lib/README.mapfiles
#
# You should not be making modifications here until you've read the most current
# copy of that file. If you need help, contact a gatekeeper for guidance.
#
# MAPFILE HEADER END
#

#
# Generic interface definition for usr/src/lib/nsswitch/dns.
#

$mapfile_version 2

SYMBOL_VERSION SUNWprivate_1.1 {
	global:
		_nss_dns_hosts_constr;
		_nss_dns_ipnodes_constr;
		_nss_get_dns_hosts_name;
		_nss_get_dns_ipnodes_name;
	local:
		*;
};