xref: /illumos-gate/usr/src/lib/libnsl/rpc/netnamer.c (revision 89fbfe0d2fbdaef52447ae1ca77634c69a3cf220)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 /*
27  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
28  */
29 /* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
30 /* All Rights Reserved */
31 /*
32  * Portions of this source code were derived from Berkeley
33  * 4.3 BSD under license from the Regents of the University of
34  * California.
35  */
36 /*
37  * ==== hack-attack:  possibly MT-safe but definitely not MT-hot.
38  * ==== turn this into a real switch frontend and backends
39  *
40  * Well, at least the API doesn't involve pointers-to-static.
41  */
42 
43 /*
44  * netname utility routines convert from netnames to unix names (uid, gid)
45  *
46  * This module is operating system dependent!
47  * What we define here will work with any unix system that has adopted
48  * the Sun NIS domain architecture.
49  */
50 
51 #undef NIS
52 #include "mt.h"
53 #include "rpc_mt.h"
54 #include <stdio.h>
55 #include <stdlib.h>
56 #include <unistd.h>
57 #include <alloca.h>
58 #include <sys/types.h>
59 #include <ctype.h>
60 #include <grp.h>
61 #include <pwd.h>
62 #include <string.h>
63 #include <syslog.h>
64 #include <sys/param.h>
65 #include <nsswitch.h>
66 #include <rpc/rpc.h>
67 #include <rpcsvc/nis.h>
68 #include <rpcsvc/ypclnt.h>
69 #include <nss_dbdefs.h>
70 
71 static const char    OPSYS[]	= "unix";
72 static const char    NETIDFILE[] = "/etc/netid";
73 static const char    NETID[]	= "netid.byname";
74 #define	OPSYS_LEN 4
75 
76 extern int _getgroupsbymember(const char *, gid_t[], int, int);
77 
78 /*
79  * the value for NOBODY_UID is set by the SVID. The following define also
80  * appears in netname.c
81  */
82 
83 #define	NOBODY_UID 60001
84 
85 /*
86  *	default publickey policy:
87  *		publickey: nis [NOTFOUND = return] files
88  */
89 
90 
91 /*		NSW_NOTSUCCESS  NSW_NOTFOUND   NSW_UNAVAIL    NSW_TRYAGAIN */
92 #define	DEF_ACTION {__NSW_RETURN, __NSW_RETURN, __NSW_CONTINUE, __NSW_CONTINUE}
93 
94 static struct __nsw_lookup lookup_files = {"files", DEF_ACTION, NULL, NULL},
95 		lookup_nis = {"nis", DEF_ACTION, NULL, &lookup_files};
96 static struct __nsw_switchconfig publickey_default =
97 			{0, "publickey", 2, &lookup_nis};
98 
99 static mutex_t serialize_netname_r = DEFAULTMUTEX;
100 
101 struct netid_userdata {
102 	uid_t	*uidp;
103 	gid_t	*gidp;
104 	int	*gidlenp;
105 	gid_t	*gidlist;
106 };
107 
108 static int
parse_uid(char * s,struct netid_userdata * argp)109 parse_uid(char *s, struct netid_userdata *argp)
110 {
111 	uid_t	u;
112 
113 	if (!s || !isdigit(*s)) {
114 		syslog(LOG_ERR,
115 		    "netname2user: expecting uid '%s'", s);
116 		return (__NSW_NOTFOUND); /* xxx need a better error */
117 	}
118 
119 	/* Fetch the uid */
120 	u = (uid_t)(atoi(s));
121 
122 	if (u == 0) {
123 		syslog(LOG_ERR, "netname2user: should not have uid 0");
124 		return (__NSW_NOTFOUND);
125 	}
126 	*(argp->uidp) = u;
127 	return (__NSW_SUCCESS);
128 }
129 
130 
131 /* parse a comma separated gid list */
132 static int
parse_gidlist(char * p,struct netid_userdata * argp)133 parse_gidlist(char *p, struct netid_userdata *argp)
134 {
135 	int len;
136 	gid_t	g;
137 
138 	if (!p || (!isdigit(*p))) {
139 		syslog(LOG_ERR,
140 		    "netname2user: missing group id list in '%s'.",
141 		    p);
142 		return (__NSW_NOTFOUND);
143 	}
144 
145 	g = (gid_t)(atoi(p));
146 	*(argp->gidp) = g;
147 
148 	len = 0;
149 	while (p = strchr(p, ','))
150 		argp->gidlist[len++] = (gid_t)atoi(++p);
151 	*(argp->gidlenp) = len;
152 	return (__NSW_SUCCESS);
153 }
154 
155 
156 /*
157  * parse_netid_str()
158  *
159  * Parse uid and group information from the passed string.
160  *
161  * The format of the string passed is
162  *	uid:gid,grp,grp, ...
163  *
164  */
165 static int
parse_netid_str(char * s,struct netid_userdata * argp)166 parse_netid_str(char *s, struct netid_userdata *argp)
167 {
168 	char	*p;
169 	int	err;
170 
171 	/* get uid */
172 	err = parse_uid(s, argp);
173 	if (err != __NSW_SUCCESS)
174 		return (err);
175 
176 	/* Now get the group list */
177 	p = strchr(s, ':');
178 	if (!p) {
179 		syslog(LOG_ERR,
180 		    "netname2user: missing group id list in '%s'", s);
181 		return (__NSW_NOTFOUND);
182 	}
183 	++p;			/* skip ':' */
184 	err = parse_gidlist(p, argp);
185 	return (err);
186 }
187 
188 /*
189  * netname2user_files()
190  *
191  * This routine fetches the netid information from the "files" nameservice.
192  * ie /etc/netid.
193  */
194 static int
netname2user_files(int * err,char * netname,struct netid_userdata * argp)195 netname2user_files(int *err, char *netname, struct netid_userdata *argp)
196 {
197 	char	buf[512];	/* one line from the file */
198 	char	*name;
199 	char	*value;
200 	char	*res;
201 	FILE	*fd;
202 
203 	fd = fopen(NETIDFILE, "rF");
204 	if (fd == NULL) {
205 		*err = __NSW_UNAVAIL;
206 		return (0);
207 	}
208 	/*
209 	 * for each line in the file parse it appropriately
210 	 * file format is :
211 	 *	netid	uid:grp,grp,grp # for users
212 	 *	netid	0:hostname	# for hosts
213 	 */
214 	while (!feof(fd)) {
215 		res = fgets(buf, 512, fd);
216 		if (res == NULL)
217 			break;
218 
219 		/* Skip comments and blank lines */
220 		if ((*res == '#') || (*res == '\n'))
221 			continue;
222 
223 		name = &(buf[0]);
224 		while (isspace(*name))
225 			name++;
226 		if (*name == '\0')	/* blank line continue */
227 			continue;
228 		value = name;		/* will contain the value eventually */
229 		while (!isspace(*value))
230 			value++;
231 		if (*value == '\0') {
232 			syslog(LOG_WARNING,
233 			    "netname2user: badly formatted line in %s.",
234 			    NETIDFILE);
235 			continue;
236 		}
237 		*value++ = '\0'; /* nul terminate the name */
238 
239 		if (strcasecmp(name, netname) == 0) {
240 			(void) fclose(fd);
241 			while (isspace(*value))
242 				value++;
243 			*err = parse_netid_str(value, argp);
244 			return (*err == __NSW_SUCCESS);
245 		}
246 	}
247 	(void) fclose(fd);
248 	*err = __NSW_NOTFOUND;
249 	return (0);
250 }
251 
252 /*
253  * netname2user_nis()
254  *
255  * This function reads the netid from the NIS (YP) nameservice.
256  */
257 static int
netname2user_nis(int * err,char * netname,struct netid_userdata * argp)258 netname2user_nis(int *err, char *netname, struct netid_userdata *argp)
259 {
260 	char *domain;
261 	int yperr;
262 	char *lookup;
263 	int len;
264 
265 	domain = strchr(netname, '@');
266 	if (!domain) {
267 		*err = __NSW_UNAVAIL;
268 		return (0);
269 	}
270 
271 	/* Point past the '@' character */
272 	domain++;
273 	lookup = NULL;
274 	yperr = yp_match(domain, (char *)NETID, netname, strlen(netname),
275 	    &lookup, &len);
276 	switch (yperr) {
277 		case 0:
278 			break; /* the successful case */
279 
280 		default :
281 			/*
282 			 *  XXX not sure about yp_match semantics.
283 			 * should err be set to NOTFOUND here?
284 			 */
285 			*err = __NSW_UNAVAIL;
286 			return (0);
287 	}
288 	if (lookup) {
289 		lookup[len] = '\0';
290 		*err = parse_netid_str(lookup, argp);
291 		free(lookup);
292 		return (*err == __NSW_SUCCESS);
293 	}
294 	*err = __NSW_NOTFOUND;
295 	return (0);
296 }
297 
298 /*
299  * Build the uid and gid from the netname for users in LDAP.
300  * There is no netid container in LDAP. For this we build
301  * the netname to user data dynamically from the passwd and
302  * group data. This works only for users in a single domain.
303  * This function is an interim solution until we support a
304  * netid container in LDAP which enables us to do netname2user
305  * resolution for multiple domains.
306  */
307 static int
netname2user_ldap(int * err,char * netname,struct netid_userdata * argp)308 netname2user_ldap(int *err, char *netname, struct netid_userdata *argp)
309 {
310 	char buf[NSS_LINELEN_PASSWD];
311 	char *p2, *lasts;
312 	struct passwd pw;
313 	uid_t uidnu;
314 	int ngroups = 0;
315 	int count;
316 	char pwbuf[NSS_LINELEN_PASSWD];
317 	int maxgrp = sysconf(_SC_NGROUPS_MAX);
318 	gid_t *groups = alloca(maxgrp * sizeof (gid_t));
319 
320 	if (strlcpy(buf, netname, NSS_LINELEN_PASSWD) >= NSS_LINELEN_PASSWD) {
321 		*err = __NSW_UNAVAIL;
322 		return (0);
323 	}
324 
325 	/* get the uid from the netname */
326 	if (strtok_r(buf, ".", &lasts) == NULL) {
327 		*err = __NSW_UNAVAIL;
328 		return (0);
329 	}
330 	if ((p2 = strtok_r(NULL, "@", &lasts)) == NULL) {
331 		*err = __NSW_UNAVAIL;
332 		return (0);
333 	}
334 	uidnu = atoi(p2);
335 
336 	/*
337 	 * check out the primary group and crosscheck the uid
338 	 * with the passwd data
339 	 */
340 	if ((getpwuid_r(uidnu, &pw, pwbuf, sizeof (pwbuf))) == NULL) {
341 		*err = __NSW_UNAVAIL;
342 		return (0);
343 	}
344 
345 	*(argp->uidp) = pw.pw_uid;
346 	*(argp->gidp) = pw.pw_gid;
347 
348 	/* search through all groups for membership */
349 
350 	groups[0] = pw.pw_gid;
351 
352 	ngroups = _getgroupsbymember(pw.pw_name, groups, maxgrp,
353 	    (pw.pw_gid <= MAXUID) ? 1 : 0);
354 
355 	if (ngroups < 0) {
356 		*err = __NSW_UNAVAIL;
357 		return (0);
358 	}
359 
360 	*(argp->gidlenp) = ngroups;
361 
362 	for (count = 0; count < ngroups; count++) {
363 		(argp->gidlist[count]) = groups[count];
364 	}
365 
366 	*err = __NSW_SUCCESS;
367 	return (1);
368 
369 }
370 
371 /*
372  * Convert network-name into unix credential
373  */
374 int
netname2user(const char * netname,uid_t * uidp,gid_t * gidp,int * gidlenp,gid_t * gidlist)375 netname2user(const char *netname, uid_t *uidp, gid_t *gidp, int *gidlenp,
376     gid_t *gidlist)
377 {
378 	struct __nsw_switchconfig *conf;
379 	struct __nsw_lookup *look;
380 	enum __nsw_parse_err perr;
381 	int needfree = 1, res;
382 	struct netid_userdata argp;
383 	int err;
384 
385 	/*
386 	 * Take care of the special case of nobody. Compare the netname
387 	 * to the string "nobody". If they are equal, return the SVID
388 	 * standard value for nobody.
389 	 */
390 
391 	if (strcmp(netname, "nobody") == 0) {
392 		*uidp = NOBODY_UID;
393 		*gidp = NOBODY_UID;
394 		*gidlenp = 0;
395 		return (1);
396 	}
397 
398 	/*
399 	 * First we do some generic sanity checks on the name we were
400 	 * passed. This lets us assume they are correct in the backends.
401 	 *
402 	 * NOTE: this code only recognizes names of the form :
403 	 *		unix.UID@domainname
404 	 */
405 	if (strncmp(netname, OPSYS, OPSYS_LEN) != 0)
406 		return (0);
407 	if (!isdigit(netname[OPSYS_LEN+1]))	/* check for uid string */
408 		return (0);
409 
410 	argp.uidp = uidp;
411 	argp.gidp = gidp;
412 	argp.gidlenp = gidlenp;
413 	argp.gidlist = gidlist;
414 	(void) mutex_lock(&serialize_netname_r);
415 
416 	conf = __nsw_getconfig("publickey", &perr);
417 	if (!conf) {
418 		conf = &publickey_default;
419 		needfree = 0;
420 	} else
421 		needfree = 1; /* free the config structure */
422 
423 	for (look = conf->lookups; look; look = look->next) {
424 		if (strcmp(look->service_name, "nis") == 0)
425 			res = netname2user_nis(&err, (char *)netname, &argp);
426 		else if (strcmp(look->service_name, "files") == 0)
427 			res = netname2user_files(&err, (char *)netname, &argp);
428 		else if (strcmp(look->service_name, "ldap") == 0)
429 			res = netname2user_ldap(&err, (char *)netname, &argp);
430 		else {
431 			syslog(LOG_INFO,
432 			    "netname2user: unknown nameservice for publickey"
433 			    "info '%s'\n", look->service_name);
434 			err = __NSW_UNAVAIL;
435 			res = 0;
436 		}
437 		switch (look->actions[err]) {
438 			case __NSW_CONTINUE :
439 				break;
440 			case __NSW_RETURN :
441 				if (needfree)
442 					(void) __nsw_freeconfig(conf);
443 				(void) mutex_unlock(&serialize_netname_r);
444 				return (res);
445 			default :
446 				syslog(LOG_ERR,
447 				    "netname2user: Unknown action for "
448 				    "nameservice '%s'", look->service_name);
449 		}
450 	}
451 	if (needfree)
452 		(void) __nsw_freeconfig(conf);
453 	(void) mutex_unlock(&serialize_netname_r);
454 	return (0);
455 }
456 
457 /*
458  * Convert network-name to hostname (fully qualified)
459  * NOTE: this code only recognizes names of the form :
460  *		unix.HOST@domainname
461  *
462  * This is very simple.  Since the netname is of the form:
463  *	unix.host@domainname
464  * We just construct the hostname using information from the domainname.
465  */
466 int
netname2host(const char * netname,char * hostname,const int hostlen)467 netname2host(const char *netname, char *hostname, const int hostlen)
468 {
469 	char *p, *domainname;
470 	int len, dlen;
471 
472 	if (!netname) {
473 		syslog(LOG_ERR, "netname2host: null netname");
474 		goto bad_exit;
475 	}
476 
477 	if (strncmp(netname, OPSYS, OPSYS_LEN) != 0)
478 		goto bad_netname;
479 	p = (char *)netname + OPSYS_LEN;	/* skip OPSYS part */
480 	if (*p != '.')
481 		goto bad_netname;
482 	++p;				/* skip '.' */
483 
484 	domainname = strchr(p, '@');	/* get domain name */
485 	if (domainname == 0)
486 		goto bad_netname;
487 
488 	len = domainname - p;		/* host sits between '.' and '@' */
489 	domainname++;			/* skip '@' sign */
490 
491 	if (len <= 0)
492 		goto bad_netname;
493 
494 	if (hostlen < len) {
495 		syslog(LOG_ERR,
496 		    "netname2host: insufficient space for hostname");
497 		goto bad_exit;
498 	}
499 
500 	if (isdigit(*p))		/* don't want uid here */
501 		goto bad_netname;
502 
503 	if (*p == '\0')			/* check for null hostname */
504 		goto bad_netname;
505 
506 	(void) strncpy(hostname, p, len);
507 
508 	/* make into fully qualified hostname by concatenating domain part */
509 	dlen = strlen(domainname);
510 	if (hostlen < (len + dlen + 2)) {
511 		syslog(LOG_ERR,
512 		    "netname2host: insufficient space for hostname");
513 		goto bad_exit;
514 	}
515 
516 	hostname[len] = '.';
517 	(void) strncpy(hostname+len+1, domainname, dlen);
518 	hostname[len+dlen+1] = '\0';
519 
520 	return (1);
521 
522 bad_netname:
523 	syslog(LOG_ERR, "netname2host: invalid host netname %s", netname);
524 
525 bad_exit:
526 	hostname[0] = '\0';
527 	return (0);
528 }
529