/* Portions of this file are subject to the following copyright(s).  See

 * the Net-SNMP's COPYING file for more details and other copyrights

 * that may apply:

 */

/*

 * Portions of this file are copyrighted by:

 * Copyright © 2003 Sun Microsystems, Inc. All rights reserved.

 * Use is subject to license terms specified in the COPYING file

 * distributed with the Net-SNMP package.

 *

 * Portions of this file are copyrighted by:

 * Copyright (c) 2016 VMware, Inc. All rights reserved.

 * Use is subject to license terms specified in the COPYING file

 * distributed with the Net-SNMP package.

 */

/*

 * vacm.c

 *

 * SNMPv3 View-based Access Control Model

 */

#include <net-snmp/net-snmp-config.h>

#ifdef HAVE_STDLIB_H

#include <stdlib.h>

#endif

#ifdef HAVE_STRING_H

#include <string.h>

#else

#include <strings.h>

#endif

#ifdef HAVE_UNISTD_H

#include <unistd.h>

#endif

#include <sys/types.h>

#include <stdio.h>

#ifdef TIME_WITH_SYS_TIME

# include <sys/time.h>

# include <time.h>

#else

# ifdef HAVE_SYS_TIME_H

#  include <sys/time.h>

# else

#  include <time.h>

# endif

#endif

#ifdef HAVE_NETINET_IN_H

#include <netinet/in.h>

#endif

#include <ctype.h>

#include <net-snmp/types.h>

#include <net-snmp/output_api.h>

#include <net-snmp/config_api.h>

#include <net-snmp/library/snmp.h>

#include <net-snmp/library/snmp-tc.h>

#include <net-snmp/library/snmp_api.h>

#include <net-snmp/library/system.h> /* strlcpy() */

#include <net-snmp/library/tools.h>

#include <net-snmp/library/vacm.h>

static struct vacm_viewEntry *viewList = NULL, *viewScanPtr = NULL;

static struct vacm_accessEntry *accessList = NULL, *accessScanPtr = NULL;

static struct vacm_groupEntry *groupList = NULL, *groupScanPtr = NULL;

/*

 * Macro to extend view masks with 1 bits when shorter than subtree lengths

 * REF: vacmViewTreeFamilyMask [RFC3415], snmpNotifyFilterMask [RFC3413]

 */

#define VIEW_MASK(viewPtr, idx, mask) \

    ((idx >= viewPtr->viewMaskLen) ? mask : (viewPtr->viewMask[idx] & mask))

/**

 * Initializes the VACM code.

 * Specifically:

 *  - adds a set of enums mapping view numbers to human readable names

 */

void

init_vacm(void)

{

    /* views for access via get/set/send-notifications */

    se_add_pair_to_slist(VACM_VIEW_ENUM_NAME, strdup("read"),

                         VACM_VIEW_READ);

    se_add_pair_to_slist(VACM_VIEW_ENUM_NAME, strdup("write"),

                         VACM_VIEW_WRITE);

    se_add_pair_to_slist(VACM_VIEW_ENUM_NAME, strdup("notify"),

                         VACM_VIEW_NOTIFY);

    /* views for permissions when receiving notifications */

    se_add_pair_to_slist(VACM_VIEW_ENUM_NAME, strdup("log"),

                         VACM_VIEW_LOG);

    se_add_pair_to_slist(VACM_VIEW_ENUM_NAME, strdup("execute"),

                         VACM_VIEW_EXECUTE);

    se_add_pair_to_slist(VACM_VIEW_ENUM_NAME, strdup("net"),

                         VACM_VIEW_NET);

}

void

vacm_save(const char *token, const char *type)

{

    struct vacm_viewEntry *vptr;

    struct vacm_accessEntry *aptr;

    struct vacm_groupEntry *gptr;

    int i;

    for (vptr = viewList; vptr != NULL; vptr = vptr->next) {

        if (vptr->viewStorageType == ST_NONVOLATILE)

            vacm_save_view(vptr, token, type);

    }

    for (aptr = accessList; aptr != NULL; aptr = aptr->next) {

        if (aptr->storageType == ST_NONVOLATILE) {

            /* Store the standard views (if set) */

            if ( aptr->views[VACM_VIEW_READ  ][0] ||

                 aptr->views[VACM_VIEW_WRITE ][0] ||

                 aptr->views[VACM_VIEW_NOTIFY][0] )

                vacm_save_access(aptr, token, type);

            /* Store any other (valid) access views */

            for ( i=VACM_VIEW_NOTIFY+1; i<VACM_MAX_VIEWS; i++ ) {

                if ( aptr->views[i][0] )

                    vacm_save_auth_access(aptr, token, type, i);

            }

        }

    }

    for (gptr = groupList; gptr != NULL; gptr = gptr->next) {

        if (gptr->storageType == ST_NONVOLATILE)

            vacm_save_group(gptr, token, type);

    }

}

/*

 * vacm_save_view(): saves a view entry to the persistent cache 

 */

void

vacm_save_view(struct vacm_viewEntry *view, const char *token,

               const char *type)

{

    char            line[4096];

    char           *cptr;

    memset(line, 0, sizeof(line));

    snprintf(line, sizeof(line), "%s%s %d %d %d ", token, "View",

            view->viewStatus, view->viewStorageType, view->viewType);

    line[ sizeof(line)-1 ] = 0;

    cptr = &line[strlen(line)]; /* the NULL */

    cptr =

        read_config_save_octet_string(cptr, (u_char *) view->viewName + 1,

                                      view->viewName[0]);

    *cptr++ = ' ';

    cptr =

        read_config_save_objid(cptr, view->viewSubtree+1,

                                     view->viewSubtreeLen-1);

    *cptr++ = ' ';

    cptr = read_config_save_octet_string(cptr, (u_char *) view->viewMask,

                                         view->viewMaskLen);

    read_config_store(type, line);

}

void

vacm_parse_config_view(const char *token, const char *line)

{

    struct vacm_viewEntry view;

    struct vacm_viewEntry *vptr;

    char           *viewName = (char *) &view.viewName;

    oid            *viewSubtree = (oid *) & view.viewSubtree;

    u_char         *viewMask;

    size_t          len;

    view.viewStatus = atoi(line);

    line = skip_token_const(line);

    if (!line) {

        config_perror("incomplete line");

        return;

    }

    view.viewStorageType = atoi(line);

    line = skip_token_const(line);

    if (!line) {

        config_perror("incomplete line");

        return;

    }

    view.viewType = atoi(line);

    line = skip_token_const(line);

    len = sizeof(view.viewName);

    line =

        read_config_read_octet_string(line, (u_char **) & viewName, &len);

    view.viewSubtreeLen = MAX_OID_LEN + 1;

    line =

        read_config_read_objid_const(line, (oid **) & viewSubtree,

                               &view.viewSubtreeLen);

    vptr =

        vacm_createViewEntry(view.viewName, view.viewSubtree,

                             view.viewSubtreeLen);

    if (!vptr) {

        return;

    }

    vptr->viewStatus = view.viewStatus;

    vptr->viewStorageType = view.viewStorageType;

    vptr->viewType = view.viewType;

    viewMask = vptr->viewMask;

    vptr->viewMaskLen = sizeof(vptr->viewMask);

    line =

        read_config_read_octet_string(line, &viewMask, &vptr->viewMaskLen);

}

/*

 * vacm_save_access(): saves an access entry to the persistent cache 

 */

void

vacm_save_access(struct vacm_accessEntry *access_entry, const char *token,

                 const char *type)

{

    char            line[4096];

    char           *cptr;

    memset(line, 0, sizeof(line));

    snprintf(line, sizeof(line), "%s%s %d %d %d %d %d ",

            token, "Access", access_entry->status,

            access_entry->storageType, access_entry->securityModel,

            access_entry->securityLevel, access_entry->contextMatch);

    line[ sizeof(line)-1 ] = 0;

    cptr = &line[strlen(line)]; /* the NULL */

    cptr =

        read_config_save_octet_string(cptr,

                                      (u_char *) access_entry->groupName + 1,

                                      access_entry->groupName[0] + 1);

    *cptr++ = ' ';

    cptr =

        read_config_save_octet_string(cptr,

                                      (u_char *) access_entry->contextPrefix + 1,

                                      access_entry->contextPrefix[0] + 1);

    *cptr++ = ' ';

    cptr = read_config_save_octet_string(cptr, (u_char *) access_entry->views[VACM_VIEW_READ],

                                         strlen(access_entry->views[VACM_VIEW_READ]) + 1);

    *cptr++ = ' ';

    cptr =

        read_config_save_octet_string(cptr, (u_char *) access_entry->views[VACM_VIEW_WRITE],

                                      strlen(access_entry->views[VACM_VIEW_WRITE]) + 1);

    *cptr++ = ' ';

    cptr =

        read_config_save_octet_string(cptr, (u_char *) access_entry->views[VACM_VIEW_NOTIFY],

                                      strlen(access_entry->views[VACM_VIEW_NOTIFY]) + 1);

    read_config_store(type, line);

}

void

vacm_save_auth_access(struct vacm_accessEntry *access_entry,

                      const char *token, const char *type, int authtype)

{

    char            line[4096];

    char           *cptr;

    memset(line, 0, sizeof(line));

    snprintf(line, sizeof(line), "%s%s %d %d %d %d %d ",

            token, "AuthAccess", access_entry->status,

            access_entry->storageType, access_entry->securityModel,

            access_entry->securityLevel, access_entry->contextMatch);

    line[ sizeof(line)-1 ] = 0;

    cptr = &line[strlen(line)]; /* the NULL */

    cptr =

        read_config_save_octet_string(cptr,

                                      (u_char *) access_entry->groupName + 1,

                                      access_entry->groupName[0] + 1);

    *cptr++ = ' ';

    cptr =

        read_config_save_octet_string(cptr,

                                      (u_char *) access_entry->contextPrefix + 1,

                                      access_entry->contextPrefix[0] + 1);

    snprintf(cptr, sizeof(line)-(cptr-line), " %d ", authtype);

    while ( *cptr )

        cptr++;

    *cptr++ = ' ';

    cptr = read_config_save_octet_string(cptr,

                               (u_char *)access_entry->views[authtype],

                                  strlen(access_entry->views[authtype]) + 1);

    read_config_store(type, line);

}

char *

_vacm_parse_config_access_common(struct vacm_accessEntry **aptr,

                                 const char *line)

{

    struct vacm_accessEntry access;

    char           *cPrefix = (char *) &access.contextPrefix;

    char           *gName   = (char *) &access.groupName;

    size_t          len;

    access.status = atoi(line);

    line = skip_token_const(line);

    if (!line) {

        config_perror("incomplete line");

        return NULL;

    }

    access.storageType = atoi(line);

    line = skip_token_const(line);

    if (!line) {

        config_perror("incomplete line");

        return NULL;

    }

    access.securityModel = atoi(line);

    line = skip_token_const(line);

    if (!line) {

        config_perror("incomplete line");

        return NULL;

    }

    access.securityLevel = atoi(line);

    line = skip_token_const(line);

    if (!line) {

        config_perror("incomplete line");

        return NULL;

    }

    access.contextMatch = atoi(line);

    line = skip_token_const(line);

    len  = sizeof(access.groupName);

    line = read_config_read_octet_string(line, (u_char **) &gName,   &len);

    len  = sizeof(access.contextPrefix);

    line = read_config_read_octet_string(line, (u_char **) &cPrefix, &len);

    *aptr = vacm_getAccessEntry(access.groupName,

                                  access.contextPrefix,

                                  access.securityModel,

                                  access.securityLevel);

    if (!*aptr)

        *aptr = vacm_createAccessEntry(access.groupName,

                                  access.contextPrefix,

                                  access.securityModel,

                                  access.securityLevel);

    if (!*aptr)

        return NULL;

    (*aptr)->status = access.status;

    (*aptr)->storageType   = access.storageType;

    (*aptr)->securityModel = access.securityModel;

    (*aptr)->securityLevel = access.securityLevel;

    (*aptr)->contextMatch  = access.contextMatch;

    return NETSNMP_REMOVE_CONST(char *, line);

}

void

vacm_parse_config_access(const char *token, const char *line)

{

    struct vacm_accessEntry *aptr;

    char           *readView, *writeView, *notifyView;

    size_t          len;

    line = _vacm_parse_config_access_common(&aptr, line);

    if (!line)

        return;

    readView = (char *) aptr->views[VACM_VIEW_READ];

    len = sizeof(aptr->views[VACM_VIEW_READ]);

    line =

        read_config_read_octet_string(line, (u_char **) & readView, &len);

    writeView = (char *) aptr->views[VACM_VIEW_WRITE];

    len = sizeof(aptr->views[VACM_VIEW_WRITE]);

    line =

        read_config_read_octet_string(line, (u_char **) & writeView, &len);

    notifyView = (char *) aptr->views[VACM_VIEW_NOTIFY];

    len = sizeof(aptr->views[VACM_VIEW_NOTIFY]);

    line =

        read_config_read_octet_string(line, (u_char **) & notifyView,

                                      &len);

}

void

vacm_parse_config_auth_access(const char *token, const char *line)

{

    struct vacm_accessEntry *aptr;

    int             authtype;

    char           *view;

    size_t          len;

    line = _vacm_parse_config_access_common(&aptr, line);

    if (!line)

        return;

    authtype = atoi(line);

    if (authtype < 0 || authtype >= VACM_MAX_VIEWS) {

        config_perror("invalid authtype");

        return;

    }

    line = skip_token_const(line);

    view = (char *) aptr->views[authtype];

    len  = sizeof(aptr->views[authtype]);

    line = read_config_read_octet_string(line, (u_char **) & view, &len);

}

/*

 * vacm_save_group(): saves a group entry to the persistent cache 

 */

void

vacm_save_group(struct vacm_groupEntry *group_entry, const char *token,

                const char *type)

{

    char            line[4096];

    char           *cptr;

    memset(line, 0, sizeof(line));

    snprintf(line, sizeof(line), "%s%s %d %d %d ",

            token, "Group", group_entry->status,

            group_entry->storageType, group_entry->securityModel);

    line[ sizeof(line)-1 ] = 0;

    cptr = &line[strlen(line)]; /* the NULL */

    cptr =

        read_config_save_octet_string(cptr,

                                      (u_char *) group_entry->securityName + 1,

                                      group_entry->securityName[0] + 1);

    *cptr++ = ' ';

    cptr = read_config_save_octet_string(cptr, (u_char *) group_entry->groupName,

                                         strlen(group_entry->groupName) + 1);

    read_config_store(type, line);

}

void

vacm_parse_config_group(const char *token, const char *line)

{

    struct vacm_groupEntry group;

    struct vacm_groupEntry *gptr;

    char           *securityName = (char *) &group.securityName;

    char           *groupName;

    size_t          len;

    group.status = atoi(line);

    line = skip_token_const(line);

    if (!line) {

        config_perror("incomplete line");

        return;

    }

    group.storageType = atoi(line);

    line = skip_token_const(line);

    if (!line) {

        config_perror("incomplete line");

        return;

    }

    group.securityModel = atoi(line);

    line = skip_token_const(line);

    len = sizeof(group.securityName);

    line =

        read_config_read_octet_string(line, (u_char **) & securityName,

                                      &len);

    gptr = vacm_createGroupEntry(group.securityModel, group.securityName);

    if (!gptr)

        return;

    gptr->status = group.status;

    gptr->storageType = group.storageType;

    groupName = (char *) gptr->groupName;

    len = sizeof(group.groupName);

    line =

        read_config_read_octet_string(line, (u_char **) & groupName, &len);

}

struct vacm_viewEntry *

netsnmp_view_get(struct vacm_viewEntry *head, const char *viewName,

                  oid * viewSubtree, size_t viewSubtreeLen, int mode)

{

    struct vacm_viewEntry *vp, *vpret = NULL;

    char            view[VACMSTRINGLEN];

    int             found, glen;

    int count=0;

    glen = (int) strlen(viewName);

    if (glen < 0 || glen > VACM_MAX_STRING)

        return NULL;

    view[0] = glen;

    strlcpy(view + 1, viewName, sizeof(view) - 1);

    for (vp = head; vp; vp = vp->next) {

        if (!memcmp(view, vp->viewName, glen + 1)

            && viewSubtreeLen >= (vp->viewSubtreeLen - 1)) {

            int             mask = 0x80;

            unsigned int    oidpos, maskpos = 0;

            found = 1;

            for (oidpos = 0;

                 found && oidpos < vp->viewSubtreeLen - 1;

                 oidpos++) {

                if (mode==VACM_MODE_IGNORE_MASK || (VIEW_MASK(vp, maskpos, mask) != 0)) {

                    if (viewSubtree[oidpos] !=

                        vp->viewSubtree[oidpos + 1])

                        found = 0;

                }

                if (mask == 1) {

                    mask = 0x80;

                    maskpos++;

                } else

                    mask >>= 1;

            }

            if (found) {

                /*

                 * match successful, keep this node if its longer than

                 * the previous or (equal and lexicographically greater

                 * than the previous). 

                 */

                count++;

                if (mode == VACM_MODE_CHECK_SUBTREE) {

                    vpret = vp;

                } else if (vpret == NULL

                           || vp->viewSubtreeLen > vpret->viewSubtreeLen

                           || (vp->viewSubtreeLen == vpret->viewSubtreeLen

                               && snmp_oid_compare(vp->viewSubtree + 1,

                                                   vp->viewSubtreeLen - 1,

                                                   vpret->viewSubtree + 1,

                                                   vpret->viewSubtreeLen - 1) >

                               0)) {

                    vpret = vp;

                }

            }

        }

    }

    DEBUGMSGTL(("vacm:getView", ", %s\n", (vpret) ? "found" : "none"));

    if (mode == VACM_MODE_CHECK_SUBTREE && count > 1) {

        return NULL;

    }

    return vpret;

}

/*******************************************************************o-o******

 * netsnmp_view_exists

 *

 * Check to see if a view with the given name exists.

 *

 * Parameters:

 *    viewName           - Name of view to check

 *

 * Returns 0 if the view does not exist. Otherwise, it returns the number

 *         of OID rows for the given name.

 */

int

netsnmp_view_exists(struct vacm_viewEntry *head, const char *viewName)

{

    struct vacm_viewEntry *vp;

    char                   view[VACMSTRINGLEN];

    int                    len, count = 0;

    len = (int) strlen(viewName);

    if (len < 0 || len > VACM_MAX_STRING)

        return 0;

    view[0] = len;

    strcpy(view + 1, viewName);

    DEBUGMSGTL(("9:vacm:view_exists", "checking %s\n", viewName));

    for (vp = head; vp; vp = vp->next) {

        if (memcmp(view, vp->viewName, len + 1) == 0)

            ++count;

    }

    return count;

}

/*******************************************************************o-o******

 * vacm_checkSubtree

 *

 * Check to see if everything within a subtree is in view, not in view,

 * or possibly both.

 *

 * Parameters:

 *   *viewName           - Name of view to check

 *   *viewSubtree        - OID of subtree

 *    viewSubtreeLen     - length of subtree OID

 *      

 * Returns:

 *   VACM_SUCCESS          The OID is included in the view.

 *   VACM_NOTINVIEW        If no entry in the view list includes the

 *                         provided OID, or the OID is explicitly excluded

 *                         from the view. 

 *   VACM_SUBTREE_UNKNOWN  The entire subtree has both allowed and disallowed

 *                         portions.

 */

int

netsnmp_view_subtree_check(struct vacm_viewEntry *head, const char *viewName,

                           oid * viewSubtree, size_t viewSubtreeLen)

{

    struct vacm_viewEntry *vp, *vpShorter = NULL, *vpLonger = NULL;

    char            view[VACMSTRINGLEN];

    int             found, glen;

    glen = (int) strlen(viewName);

    if (glen < 0 || glen > VACM_MAX_STRING)

        return VACM_NOTINVIEW;

    view[0] = glen;

    strlcpy(view + 1, viewName, sizeof(view) - 1);

    DEBUGMSGTL(("9:vacm:checkSubtree", "view %s\n", viewName));

    for (vp = head; vp; vp = vp->next) {

        if (!memcmp(view, vp->viewName, glen + 1)) {

            /*

             * If the subtree defined in the view is shorter than or equal

             * to the subtree we are comparing, then it might envelop the

             * subtree we are comparing against.

             */

            if (viewSubtreeLen >= (vp->viewSubtreeLen - 1)) {

                int             mask = 0x80;

                unsigned int    oidpos, maskpos = 0;

                found = 1;

                /*

                 * check the mask

                 */

                for (oidpos = 0;

                     found && oidpos < vp->viewSubtreeLen - 1;

                     oidpos++) {

                    if (VIEW_MASK(vp, maskpos, mask) != 0) {

                        if (viewSubtree[oidpos] !=

                            vp->viewSubtree[oidpos + 1])

                            found = 0;

                    }

                    if (mask == 1) {

                        mask = 0x80;

                        maskpos++;

                    } else

                        mask >>= 1;

                }

                if (found) {

                    /*

                     * match successful, keep this node if it's longer than

                     * the previous or (equal and lexicographically greater

                     * than the previous). 

                     */

                    DEBUGMSGTL(("9:vacm:checkSubtree", " %s matched?\n", vp->viewName));

                    if (vpShorter == NULL

                        || vp->viewSubtreeLen > vpShorter->viewSubtreeLen

                        || (vp->viewSubtreeLen == vpShorter->viewSubtreeLen

                           && snmp_oid_compare(vp->viewSubtree + 1,

                                               vp->viewSubtreeLen - 1,

                                               vpShorter->viewSubtree + 1,

                                               vpShorter->viewSubtreeLen - 1) >

                                   0)) {

                        vpShorter = vp;

                    }

                }

            }

            /*

             * If the subtree defined in the view is longer than the

             * subtree we are comparing, then it might ambiguate our

             * response.

             */

            else {

                int             mask = 0x80;

                unsigned int    oidpos, maskpos = 0;

                found = 1;

                /*

                 * check the mask up to the length of the provided subtree

                 */

                for (oidpos = 0;

                     found && oidpos < viewSubtreeLen;

                     oidpos++) {

                    if (VIEW_MASK(vp, maskpos, mask) != 0) {

                        if (viewSubtree[oidpos] !=

                            vp->viewSubtree[oidpos + 1])

                            found = 0;

                    }

                    if (mask == 1) {

                        mask = 0x80;

                        maskpos++;

                    } else

                        mask >>= 1;

                }

                if (found) {

                    /*

                     * match successful.  If we already found a match

                     * with a different view type, then parts of the subtree 

                     * are included and others are excluded, so return UNKNOWN.

                     */

                    DEBUGMSGTL(("9:vacm:checkSubtree", " %s matched?\n", vp->viewName));

                    if (vpLonger != NULL

                        && (vpLonger->viewType != vp->viewType)) {

                        DEBUGMSGTL(("vacm:checkSubtree", ", %s\n", "unknown"));

                        return VACM_SUBTREE_UNKNOWN;

                    }

                    else if (vpLonger == NULL) {

                        vpLonger = vp;

                    }

                }

            }

        }

    }

    DEBUGMSGTL(("9:vacm:checkSubtree", " %s matched\n", viewName));

    /*

     * If we found a matching view subtree with a longer OID than the provided

     * OID, check to see if its type is consistent with any matching view

     * subtree we may have found with a shorter OID than the provided OID.

     *

     * The view type of the longer OID is inconsistent with the shorter OID in

     * either of these two cases:

     *  1) No matching shorter OID was found and the view type of the longer

     *     OID is INCLUDE.

     *  2) A matching shorter ID was found and its view type doesn't match

     *     the view type of the longer OID.

     */

    if (vpLonger != NULL) {

        if ((!vpShorter && vpLonger->viewType != SNMP_VIEW_EXCLUDED)

            || (vpShorter && vpLonger->viewType != vpShorter->viewType)) {

            DEBUGMSGTL(("vacm:checkSubtree", ", %s\n", "unknown"));

            return VACM_SUBTREE_UNKNOWN;

        }

    }

    if (vpShorter && vpShorter->viewType != SNMP_VIEW_EXCLUDED) {

        DEBUGMSGTL(("vacm:checkSubtree", ", %s\n", "included"));

        return VACM_SUCCESS;

    }

    DEBUGMSGTL(("vacm:checkSubtree", ", %s\n", "excluded"));

    return VACM_NOTINVIEW;

}

void

vacm_scanViewInit(void)

{

    viewScanPtr = viewList;

}

struct vacm_viewEntry *

vacm_scanViewNext(void)

{

    struct vacm_viewEntry *returnval = viewScanPtr;

    if (viewScanPtr)

        viewScanPtr = viewScanPtr->next;

    return returnval;

}

struct vacm_viewEntry *

netsnmp_view_create(struct vacm_viewEntry **head, const char *viewName,

                     oid * viewSubtree, size_t viewSubtreeLen)

{

    struct vacm_viewEntry *vp, *lp, *op = NULL;

    int             cmp, cmp2, glen;

    glen = (int) strlen(viewName);

    if (glen < 0 || glen > VACM_MAX_STRING || viewSubtreeLen > MAX_OID_LEN)

        return NULL;

    vp = calloc(1, sizeof(struct vacm_viewEntry));

    if (vp == NULL)

        return NULL;

    vp->reserved = calloc(1, sizeof(struct vacm_viewEntry));

    if (vp->reserved == NULL) {

        free(vp);

        return NULL;

    }

    vp->viewName[0] = glen;

    strlcpy(vp->viewName + 1, viewName, sizeof(vp->viewName) - 1);

    vp->viewSubtree[0] = viewSubtreeLen;

    memcpy(vp->viewSubtree + 1, viewSubtree, viewSubtreeLen * sizeof(oid));

    vp->viewSubtreeLen = viewSubtreeLen + 1;

    lp = *head;

    while (lp) {

        cmp = memcmp(lp->viewName, vp->viewName, glen + 1);

        cmp2 = snmp_oid_compare(lp->viewSubtree, lp->viewSubtreeLen,

                                vp->viewSubtree, vp->viewSubtreeLen);

        if (cmp == 0 && cmp2 > 0)

            break;

        if (cmp > 0)

            break;

        op = lp;

        lp = lp->next;

    }

    vp->next = lp;

    if (op)

        op->next = vp;

    else

        *head = vp;

    return vp;

}

void

netsnmp_view_destroy(struct vacm_viewEntry **head, const char *viewName,

                      oid * viewSubtree, size_t viewSubtreeLen)

{

    struct vacm_viewEntry *vp, *lastvp = NULL;

    if ((*head) && !strcmp((*head)->viewName + 1, viewName)

        && (*head)->viewSubtreeLen == viewSubtreeLen

        && !memcmp((char *) (*head)->viewSubtree, (char *) viewSubtree,

                   viewSubtreeLen * sizeof(oid))) {

        vp = (*head);

        (*head) = (*head)->next;

    } else {

        for (vp = (*head); vp; vp = vp->next) {

            if (!strcmp(vp->viewName + 1, viewName)

                && vp->viewSubtreeLen == viewSubtreeLen

                && !memcmp((char *) vp->viewSubtree, (char *) viewSubtree,

                           viewSubtreeLen * sizeof(oid)))

                break;

            lastvp = vp;

        }

        if (!vp || !lastvp)

            return;

        lastvp->next = vp->next;

    }

    if (vp->reserved)

        free(vp->reserved);

    free(vp);

    return;

}

void

netsnmp_view_clear(struct vacm_viewEntry **head)

{

    struct vacm_viewEntry *vp;

    while ((vp = (*head))) {

        (*head) = vp->next;

        if (vp->reserved)

            free(vp->reserved);

        free(vp);

    }

}

struct vacm_groupEntry *

vacm_getGroupEntry(int securityModel, const char *securityName)

{

    struct vacm_groupEntry *vp;

    char            secname[VACMSTRINGLEN];

    int             glen;

    glen = (int) strlen(securityName);

    if (glen < 0 || glen > VACM_MAX_STRING)

        return NULL;

    secname[0] = glen;

    strlcpy(secname + 1, securityName, sizeof(secname) - 1);

    for (vp = groupList; vp; vp = vp->next) {

        if ((securityModel == vp->securityModel

             || vp->securityModel == SNMP_SEC_MODEL_ANY)

            && !memcmp(vp->securityName, secname, glen + 1))

            return vp;

    }

    return NULL;

}

void

vacm_scanGroupInit(void)

{

    groupScanPtr = groupList;

}

struct vacm_groupEntry *

vacm_scanGroupNext(void)

{

    struct vacm_groupEntry *returnval = groupScanPtr;

    if (groupScanPtr)

        groupScanPtr = groupScanPtr->next;

    return returnval;

}

struct vacm_groupEntry *

vacm_createGroupEntry(int securityModel, const char *securityName)

{

    struct vacm_groupEntry *gp, *lg, *og;

    int             cmp, glen;

    glen = (int) strlen(securityName);

    if (glen < 0 || glen > VACM_MAX_STRING)

        return NULL;

    gp = calloc(1, sizeof(struct vacm_groupEntry));

    if (gp == NULL)

        return NULL;

    gp->reserved = calloc(1, sizeof(struct vacm_groupEntry));

    if (gp->reserved == NULL) {

        free(gp);

        return NULL;

    }