getent 命令

碰到一个同事问，/etc/hosts 里面添加的hostname ，为什么使用nslookup 查询不到。
我也不知道怎么回答，只能胡乱回答说nslookup 和dig 都是查询DNS server， 而不是查询本地的/etc/hosts 文件。
你可以ping 自己设置的hostname ，只要能ping 通就行了，默认/etc/nsswitch.conf  里面一般都会配配置 file,DNS,NIS.

# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: compat
group: compat
shadow: compat
gshadow: files

hosts: files myhostname mdns4_minimal [NOTFOUND=return] dns
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files

netgroup: nis

怎么感觉看得不是很明白呢。

apt-get install "glibc-doc-reference" "info"
info libc "Name Service Switch"

To fulfill the first goal above the ABI of the modules will be
described below. For getting the implementation of a new service right
it is important to understand how the functions in the modules get
called. They are in no way designed to be used by the programmer
directly. Instead the programmer should only use the documented and
standardized functions to access the databases.

The databases available in the NSS are

'aliases'
     Mail aliases
'ethers'
     Ethernet numbers,
'group'
     Groups of users, *note Group Database::.
'hosts'
     Host names and numbers, *note Host Names::.
'netgroup'
     Network wide list of host and users, *note Netgroup Database::.
'networks'
     Network names and numbers, *note Networks Database::.
'protocols'
     Network protocols, *note Protocols Database::.
'passwd'
     User passwords, *note User Database::.
'rpc'
     Remote procedure call names and numbers,
'services'
     Network services, *note Services Database::.
'shadow'
     Shadow user passwords,

There will be some more added later ('automount', 'bootparams',
'netmasks', and 'publickey').

基本上明白了怎么用getent ,getent + 这里列的每个database 都可以试试。 getent protocols , getent services, getent rpc.

root@kali:~# getent hosts kobe
127.0.0.1       localhost kobe
root@kali:~# getent shadow root
root:$6$RzxFAkm7$YARWPy0rwwkw1tEddHOjJ5OLhdNikknB4Noi85DbyInA220zyPqI0bQqY7TzPtVieBeBK8U7CyqE7ZLkbVqG1/:16759:0:99999:7:::

getent 这个命令挺好玩，可以多man看看。
最后strace 了一下，看的一头雾水，本来对系统调用就不是很熟。猜测是create了UDP的socket, poll对FD轮询, 对FD 3 先sendto 了堆字符串，然后又从FD 3这里receive 字符串。

socket(PF_INET, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
poll([{fd=3, events=POLLOUT}], 1, 0) = 1 ([{fd=3, revents=POLLOUT}])
sendto(3, "h\221\1\0\0\1\0\0\0\0\0\0\4kobe\0\0\34\0\1", 22, MSG_NOSIGNAL, NULL, 0) = 22
poll([{fd=3, events=POLLIN}], 1, 5000) = 1 ([{fd=3, revents=POLLIN}])
ioctl(3, FIONREAD, [97]) = 0
recvfrom(3, "h\221\201\203\0\1\0\0\0\1\0\0\4kobe\0\0\34\0\1\0\0\6\0\1\0\0\7\6\0"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, [16]) = 97
close(3) = 0
stat("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=97, ...}) = 0
stat("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=97, ...}) = 0
open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=222, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f72fc77c000
read(3, "127.0.0.1\tlocalhost kobe\n127.0.1"..., 4096) = 222
read(3, "", 4096) = 0