1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2014 Nexenta Systems, Inc. All rights reserved. 24 * Copyright 2022 RackTop Systems, Inc. 25 * Copyright 2025 Bill Sommerfeld 26 */ 27 28 #ifndef _IDMAPD_H 29 #define _IDMAPD_H 30 31 #include <stdio.h> 32 #include <stdlib.h> 33 #include <stdarg.h> 34 #include <rpc/rpc.h> 35 #include <synch.h> 36 #include <thread.h> 37 #include <libintl.h> 38 #include <strings.h> 39 #include <sqlite-sys/sqlite.h> 40 #include <syslog.h> 41 #include <inttypes.h> 42 #include <rpcsvc/idmap_prot.h> 43 #include "adutils.h" 44 #include "idmap_priv.h" 45 #include "idmap_config.h" 46 #include "libadutils.h" 47 48 #ifdef __cplusplus 49 extern "C" { 50 #endif 51 52 #define CHECK_NULL(s) (s != NULL ? s : "null") 53 54 extern mutex_t _svcstate_lock; /* lock for _rpcsvcstate, _rpcsvccount */ 55 56 typedef enum idmap_namemap_mode { 57 IDMAP_NM_NONE = 0, 58 IDMAP_NM_AD, 59 IDMAP_NM_NLDAP, 60 IDMAP_NM_MIXED 61 } idmap_namemap_mode_t; 62 63 /* 64 * Debugging output. 65 * 66 * There are some number of areas - configuration, mapping, discovery, et 67 * cetera - and for each area there is a verbosity level controlled through 68 * an SMF property. The default is zero, and "debug/all" provides a master 69 * control allowing you to turn on all debugging output with one setting. 70 * 71 * A typical debugging output sequence would look like 72 * 73 * if (DBG(CONFIG, 2)) { 74 * idmapdlog(LOG_DEBUG, 75 * "some message about config at verbosity 2"); 76 * } 77 */ 78 enum idmapd_debug { 79 IDMAPD_DEBUG_ALL = 0, 80 IDMAPD_DEBUG_CONFIG = 1, 81 IDMAPD_DEBUG_MAPPING = 2, 82 IDMAPD_DEBUG_DISC = 3, 83 IDMAPD_DEBUG_DNS = 4, 84 IDMAPD_DEBUG_LDAP = 5, 85 IDMAPD_DEBUG_MAX = 5 86 }; 87 88 #define DBG(type, lev) \ 89 (_idmapdstate.debug[IDMAPD_DEBUG_##type] >= (lev) || \ 90 _idmapdstate.debug[IDMAPD_DEBUG_ALL] >= (lev)) 91 92 /* 93 * Global state of idmapd daemon. 94 */ 95 typedef struct idmapd_state { 96 rwlock_t rwlk_cfg; /* config lock */ 97 idmap_cfg_t *cfg; /* config */ 98 bool_t daemon_mode; 99 char hostname[MAX_NAME_LEN]; /* my hostname */ 100 pthread_mutex_t id_lock; /* id allocator lock */ 101 uid_t next_uid; 102 gid_t next_gid; 103 uid_t limit_uid; 104 gid_t limit_gid; 105 int new_eph_db; /* was the ephem ID db [re-]created? */ 106 int num_gcs; 107 adutils_ad_t **gcs; 108 int num_dcs; 109 adutils_ad_t **dcs; 110 mutex_t addisc_lk; 111 cond_t addisc_cv; 112 int addisc_st; 113 int debug[IDMAPD_DEBUG_MAX+1]; 114 } idmapd_state_t; 115 extern idmapd_state_t _idmapdstate; 116 117 #define ADDISC_ST_REQUESTED 1 118 #define ADDISC_ST_RUNNING 2 119 120 #define RDLOCK_CONFIG() \ 121 (void) rw_rdlock(&_idmapdstate.rwlk_cfg); 122 #define WRLOCK_CONFIG() \ 123 (void) rw_wrlock(&_idmapdstate.rwlk_cfg); 124 #define UNLOCK_CONFIG() \ 125 (void) rw_unlock(&_idmapdstate.rwlk_cfg); 126 127 typedef struct hashentry { 128 uint_t key; 129 uint_t next; 130 } hashentry_t; 131 132 typedef struct lookup_state { 133 bool_t sid2pid_done; 134 bool_t pid2sid_done; 135 int ad_nqueries; 136 int nldap_nqueries; 137 bool_t eph_map_unres_sids; 138 int directory_based_mapping; /* enum */ 139 uint_t id_cache_timeout; 140 uint_t name_cache_timeout; 141 uint_t curpos; 142 hashentry_t *sid_history; 143 uint_t sid_history_size; 144 idmap_mapping_batch *batch; 145 idmap_ids_res *result; 146 idmap_namemap_mode_t nm_siduid; 147 idmap_namemap_mode_t nm_sidgid; 148 char *ad_unixuser_attr; 149 char *ad_unixgroup_attr; 150 char *nldap_winname_attr; 151 char *defdom; 152 sqlite *cache; 153 sqlite *db; 154 } lookup_state_t; 155 156 #define NLDAP_OR_MIXED(nm) \ 157 ((nm) == IDMAP_NM_NLDAP || (nm) == IDMAP_NM_MIXED) 158 #define AD_OR_MIXED(nm) \ 159 ((nm) == IDMAP_NM_AD || (nm) == IDMAP_NM_MIXED) 160 161 #define PID_UID_OR_UNKNOWN(pidtype) \ 162 ((pidtype) == IDMAP_UID || (pidtype) == IDMAP_POSIXID) 163 #define PID_GID_OR_UNKNOWN(pidtype) \ 164 ((pidtype) == IDMAP_GID || (pidtype) == IDMAP_POSIXID) 165 166 #define NLDAP_OR_MIXED_MODE(pidtype, ls) \ 167 (NLDAP_MODE(pidtype, ls) || MIXED_MODE(pidtype, ls)) 168 #define AD_OR_MIXED_MODE(pidtype, ls)\ 169 (AD_MODE(pidtype, ls) || MIXED_MODE(pidtype, ls)) 170 #define NLDAP_MODE(pidtype, ls) \ 171 ((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_NLDAP) || \ 172 (PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_NLDAP)) 173 #define AD_MODE(pidtype, ls) \ 174 ((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_AD) || \ 175 (PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_AD)) 176 #define MIXED_MODE(pidtype, ls) \ 177 ((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_MIXED) || \ 178 (PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_MIXED)) 179 180 181 typedef struct list_cb_data { 182 void *result; 183 uint64_t next; 184 uint64_t len; 185 uint64_t limit; 186 int flag; 187 } list_cb_data_t; 188 189 typedef struct msg_table { 190 idmap_retcode retcode; 191 const char *msg; 192 } msg_table_t; 193 194 /* 195 * Data structure to store well-known SIDs and 196 * associated mappings (if any) 197 */ 198 typedef struct wksids_table { 199 const char *sidprefix; 200 uint32_t rid; 201 const char *domain; 202 const char *winname; 203 int is_wuser; 204 posix_id_t pid; 205 int is_user; 206 int direction; 207 } wksids_table_t; 208 209 #define IDMAPD_SEARCH_TIMEOUT 3 /* seconds */ 210 #define IDMAPD_LDAP_OPEN_TIMEOUT 1 /* secs; initial, w/ exp backoff */ 211 212 /* 213 * The following flags are used by idmapd while processing a 214 * given mapping request. Note that idmapd uses multiple passes to 215 * process the request and the flags are used to pass information 216 * about the state of the request between these passes. 217 */ 218 219 /* Initial state. Done. Reset all flags. Remaining passes can be skipped */ 220 #define _IDMAP_F_DONE 0x00000000 221 /* Set when subsequent passes are required */ 222 #define _IDMAP_F_NOTDONE 0x00000001 223 /* Don't update name_cache. (e.g. set when winname,SID found in name_cache) */ 224 #define _IDMAP_F_DONT_UPDATE_NAMECACHE 0x00000002 225 /* Batch this request for AD lookup */ 226 #define _IDMAP_F_LOOKUP_AD 0x00000004 227 /* Batch this request for nldap directory lookup */ 228 #define _IDMAP_F_LOOKUP_NLDAP 0x00000008 229 /* 230 * Expired ephemeral mapping found in cache when processing sid2uid request. 231 * Use it if the given SID cannot be mapped by name 232 */ 233 #define _IDMAP_F_EXP_EPH_UID 0x00000010 234 /* Same as above. Used for sid2gid request */ 235 #define _IDMAP_F_EXP_EPH_GID 0x00000020 236 /* This request is not valid for the current forest */ 237 #define _IDMAP_F_LOOKUP_OTHER_AD 0x00000040 238 239 240 /* 241 * Check if we are done. If so, subsequent passes can be skipped 242 * when processing a given mapping request. 243 */ 244 #define ARE_WE_DONE(f) ((f & _IDMAP_F_NOTDONE) == 0) 245 246 #define SIZE_INCR 5 247 #define MAX_TRIES 5 248 #define IDMAP_DBDIR "/var/idmap" 249 #define IDMAP_CACHEDIR "/var/run/idmap" 250 #define IDMAP_DBNAME IDMAP_DBDIR "/idmap.db" 251 #define IDMAP_CACHENAME IDMAP_CACHEDIR "/cache.db" 252 253 #define IS_ID_NONE(id) \ 254 ((id).idtype == IDMAP_NONE) 255 256 #define IS_ID_SID(id) \ 257 ((id).idtype == IDMAP_SID || \ 258 (id).idtype == IDMAP_USID || \ 259 (id).idtype == IDMAP_GSID) \ 260 261 #define IS_ID_UID(id) \ 262 ((id).idtype == IDMAP_UID) 263 264 #define IS_ID_GID(id) \ 265 ((id).idtype == IDMAP_GID) 266 267 #define IS_ID_POSIX(id) \ 268 ((id).idtype == IDMAP_UID || \ 269 (id).idtype == IDMAP_GID || \ 270 (id).idtype == IDMAP_POSIXID) \ 271 272 /* 273 * Local RID ranges 274 */ 275 #define LOCALRID_UID_MIN 1000U 276 #define LOCALRID_UID_MAX ((uint32_t)INT32_MAX) 277 #define LOCALRID_GID_MIN (((uint32_t)INT32_MAX) + 1) 278 #define LOCALRID_GID_MAX UINT32_MAX 279 280 /* 281 * Tracing. 282 * 283 * The tracing mechanism is intended to help the administrator understand 284 * why their mapping configuration is doing what it is. Each interesting 285 * decision point during the mapping process calls TRACE() with the current 286 * request and response and a printf-style message. The message, plus 287 * data from the request and the response, is logged to the service log 288 * (if debug/mapping is greater than zero) or reported to the caller 289 * (if IDMAP_REQ_FLG_TRACE was set in the request. The primary consumer 290 * is the "-V" option to "idmap show". 291 * 292 * TRACING(req) says whether tracing is appropriate for the request, and 293 * is used to determine and record whether any request in a batch requested 294 * tracing, to control whether later code loops over the batch to do tracing 295 * for any of the requests. 296 * 297 * TRACE(req, res, fmt, ...) generates a trace entry if appropriate. 298 */ 299 #define TRACING(req) \ 300 (DBG(MAPPING, 1) || \ 301 ((req)->flag & IDMAP_REQ_FLG_TRACE) != 0) 302 #define TRACE(req, res, ...) \ 303 ((void)(TRACING(req) && trace(req, res, __VA_ARGS__))) 304 extern int trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...); 305 306 typedef idmap_retcode (*update_list_res_cb)(void *, const char **, uint64_t); 307 typedef int (*list_svc_cb)(void *, int, char **, char **); 308 309 extern void idmap_prog_1(struct svc_req *, register SVCXPRT *); 310 extern void idmapdlog(int, const char *, ...); 311 extern int init_mapping_system(void); 312 extern void fini_mapping_system(void); 313 extern void print_idmapdstate(void); 314 extern int create_directory(const char *, uid_t, gid_t); 315 extern int load_config(void); 316 extern void reload_gcs(void); 317 extern void reload_dcs(void); 318 extern void idmap_init_tsd_key(void); 319 extern void degrade_svc(int, const char *); 320 extern void restore_svc(void); 321 extern void notify_dc_changed(void); 322 323 324 extern int init_dbs(void); 325 extern void fini_dbs(void); 326 extern idmap_retcode get_db_handle(sqlite **); 327 extern idmap_retcode get_cache_handle(sqlite **); 328 extern void kill_db_handle(sqlite *); 329 extern void kill_cache_handle(sqlite *); 330 extern idmap_retcode sql_exec_no_cb(sqlite *, const char *, char *); 331 extern idmap_retcode add_namerule(sqlite *, idmap_namerule *); 332 extern idmap_retcode rm_namerule(sqlite *, idmap_namerule *); 333 extern idmap_retcode flush_namerules(sqlite *); 334 335 extern char *tolower_u8(const char *); 336 337 extern idmap_retcode gen_sql_expr_from_rule(idmap_namerule *, char **); 338 extern idmap_retcode validate_list_cb_data(list_cb_data_t *, int, 339 char **, int, uchar_t **, size_t); 340 extern idmap_retcode process_list_svc_sql(sqlite *, const char *, char *, 341 uint64_t, int, list_svc_cb, void *); 342 extern idmap_retcode sid2pid_first_pass(lookup_state_t *, 343 idmap_mapping *, idmap_id_res *); 344 extern idmap_retcode sid2pid_second_pass(lookup_state_t *, 345 idmap_mapping *, idmap_id_res *); 346 extern idmap_retcode pid2sid_first_pass(lookup_state_t *, 347 idmap_mapping *, idmap_id_res *, int); 348 extern idmap_retcode pid2sid_second_pass(lookup_state_t *, 349 idmap_mapping *, idmap_id_res *, int); 350 extern idmap_retcode update_cache_sid2pid(lookup_state_t *, 351 idmap_mapping *, idmap_id_res *); 352 extern idmap_retcode update_cache_pid2sid(lookup_state_t *, 353 idmap_mapping *, idmap_id_res *); 354 extern idmap_retcode get_u2w_mapping(sqlite *, sqlite *, idmap_mapping *, 355 idmap_mapping *, int); 356 extern idmap_retcode get_w2u_mapping(sqlite *, sqlite *, idmap_mapping *, 357 idmap_mapping *); 358 extern idmap_retcode load_cfg_in_state(lookup_state_t *); 359 extern void cleanup_lookup_state(lookup_state_t *); 360 361 extern idmap_retcode ad_lookup_batch(lookup_state_t *, 362 idmap_mapping_batch *, idmap_ids_res *); 363 extern idmap_retcode lookup_name2sid(sqlite *, const char *, const char *, 364 int, char **, char **, char **, 365 idmap_rid_t *, idmap_id_type *, 366 idmap_mapping *, int); 367 extern idmap_retcode lookup_wksids_name2sid(const char *, const char *, 368 char **, char **, char **, idmap_rid_t *, 369 idmap_id_type *); 370 extern idmap_retcode idmap_cache_flush(idmap_flush_op); 371 372 extern const wksids_table_t *find_wksid_by_pid(posix_id_t pid, int is_user); 373 extern const wksids_table_t *find_wksid_by_sid(const char *sid, int rid, 374 idmap_id_type type); 375 extern const wksids_table_t *find_wksid_by_name(const char *name, 376 const char *domain, idmap_id_type type); 377 extern const wksids_table_t *find_wk_by_sid(char *sid); 378 379 #ifdef __cplusplus 380 } 381 #endif 382 383 #endif /* _IDMAPD_H */ 384