1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _IDMAPD_H 27 #define _IDMAPD_H 28 29 #include <stdio.h> 30 #include <stdlib.h> 31 #include <stdarg.h> 32 #include <rpc/rpc.h> 33 #include <synch.h> 34 #include <thread.h> 35 #include <libintl.h> 36 #include <strings.h> 37 #include <sqlite/sqlite.h> 38 #include <syslog.h> 39 #include <inttypes.h> 40 #include <rpcsvc/idmap_prot.h> 41 #include "adutils.h" 42 #include "idmap_priv.h" 43 #include "idmap_config.h" 44 #include "libadutils.h" 45 46 #ifdef __cplusplus 47 extern "C" { 48 #endif 49 50 #define CHECK_NULL(s) (s != NULL ? s : "null") 51 52 extern mutex_t _svcstate_lock; /* lock for _rpcsvcstate, _rpcsvccount */ 53 54 typedef enum idmap_namemap_mode { 55 IDMAP_NM_NONE = 0, 56 IDMAP_NM_AD, 57 IDMAP_NM_NLDAP, 58 IDMAP_NM_MIXED 59 } idmap_namemap_mode_t; 60 61 /* 62 * Global state of idmapd daemon. 63 */ 64 typedef struct idmapd_state { 65 rwlock_t rwlk_cfg; /* config lock */ 66 idmap_cfg_t *cfg; /* config */ 67 bool_t daemon_mode; 68 bool_t debug_mode; 69 char hostname[MAX_NAME_LEN]; /* my hostname */ 70 uid_t next_uid; 71 gid_t next_gid; 72 uid_t limit_uid; 73 gid_t limit_gid; 74 int new_eph_db; /* was the ephem ID db [re-]created? */ 75 int num_gcs; 76 adutils_ad_t **gcs; 77 int num_dcs; 78 adutils_ad_t **dcs; 79 } idmapd_state_t; 80 extern idmapd_state_t _idmapdstate; 81 82 #define RDLOCK_CONFIG() \ 83 (void) rw_rdlock(&_idmapdstate.rwlk_cfg); 84 #define WRLOCK_CONFIG() \ 85 (void) rw_wrlock(&_idmapdstate.rwlk_cfg); 86 #define UNLOCK_CONFIG() \ 87 (void) rw_unlock(&_idmapdstate.rwlk_cfg); 88 89 typedef struct hashentry { 90 uint_t key; 91 uint_t next; 92 } hashentry_t; 93 94 typedef struct lookup_state { 95 bool_t sid2pid_done; 96 bool_t pid2sid_done; 97 int ad_nqueries; 98 int nldap_nqueries; 99 bool_t eph_map_unres_sids; 100 int directory_based_mapping; /* enum */ 101 uint_t curpos; 102 hashentry_t *sid_history; 103 uint_t sid_history_size; 104 idmap_mapping_batch *batch; 105 idmap_ids_res *result; 106 idmap_namemap_mode_t nm_siduid; 107 idmap_namemap_mode_t nm_sidgid; 108 char *ad_unixuser_attr; 109 char *ad_unixgroup_attr; 110 char *nldap_winname_attr; 111 char *defdom; 112 sqlite *cache; 113 sqlite *db; 114 } lookup_state_t; 115 116 #define NLDAP_OR_MIXED(nm) \ 117 (nm == IDMAP_NM_NLDAP || nm == IDMAP_NM_MIXED) 118 #define AD_OR_MIXED(nm) \ 119 (nm == IDMAP_NM_AD || nm == IDMAP_NM_MIXED) 120 121 #define NLDAP_OR_MIXED_MODE(pidtype, ls) \ 122 ((pidtype == IDMAP_UID && NLDAP_OR_MIXED(ls->nm_siduid)) || \ 123 (pidtype == IDMAP_GID && NLDAP_OR_MIXED(ls->nm_sidgid))) 124 #define AD_OR_MIXED_MODE(pidtype, ls)\ 125 ((pidtype == IDMAP_UID && AD_OR_MIXED(ls->nm_siduid)) || \ 126 (pidtype == IDMAP_GID && AD_OR_MIXED(ls->nm_sidgid))) 127 #define NLDAP_MODE(pidtype, ls) \ 128 ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_NLDAP) || \ 129 (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_NLDAP)) 130 #define AD_MODE(pidtype, ls) \ 131 ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_AD) || \ 132 (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_AD)) 133 #define MIXED_MODE(pidtype, ls) \ 134 ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_MIXED) || \ 135 (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_MIXED)) 136 137 138 typedef struct list_cb_data { 139 void *result; 140 uint64_t next; 141 uint64_t len; 142 uint64_t limit; 143 int flag; 144 } list_cb_data_t; 145 146 typedef struct msg_table { 147 idmap_retcode retcode; 148 const char *msg; 149 } msg_table_t; 150 151 /* 152 * Data structure to store well-known SIDs and 153 * associated mappings (if any) 154 */ 155 typedef struct wksids_table { 156 const char *sidprefix; 157 uint32_t rid; 158 const char *domain; 159 const char *winname; 160 int is_wuser; 161 posix_id_t pid; 162 int is_user; 163 int direction; 164 } wksids_table_t; 165 166 #define IDMAPD_SEARCH_TIMEOUT 3 /* seconds */ 167 #define IDMAPD_LDAP_OPEN_TIMEOUT 1 /* secs; initial, w/ exp backoff */ 168 169 /* 170 * The following flags are used by idmapd while processing a 171 * given mapping request. Note that idmapd uses multiple passes to 172 * process the request and the flags are used to pass information 173 * about the state of the request between these passes. 174 */ 175 176 /* Initial state. Done. Reset all flags. Remaining passes can be skipped */ 177 #define _IDMAP_F_DONE 0x00000000 178 /* Set when subsequent passes are required */ 179 #define _IDMAP_F_NOTDONE 0x00000001 180 /* Don't update name_cache. (e.g. set when winname,SID found in name_cache) */ 181 #define _IDMAP_F_DONT_UPDATE_NAMECACHE 0x00000002 182 /* Batch this request for AD lookup */ 183 #define _IDMAP_F_LOOKUP_AD 0x00000004 184 /* Batch this request for nldap directory lookup */ 185 #define _IDMAP_F_LOOKUP_NLDAP 0x00000008 186 /* 187 * Expired ephemeral mapping found in cache when processing sid2uid request. 188 * Use it if the given SID cannot be mapped by name 189 */ 190 #define _IDMAP_F_EXP_EPH_UID 0x00000010 191 /* Same as above. Used for sid2gid request */ 192 #define _IDMAP_F_EXP_EPH_GID 0x00000020 193 /* This request is not valid for the current forest */ 194 #define _IDMAP_F_LOOKUP_OTHER_AD 0x00000040 195 196 197 /* 198 * Check if we are done. If so, subsequent passes can be skipped 199 * when processing a given mapping request. 200 */ 201 #define ARE_WE_DONE(f) ((f & _IDMAP_F_NOTDONE) == 0) 202 203 #define SIZE_INCR 5 204 #define MAX_TRIES 5 205 #define IDMAP_DBDIR "/var/idmap" 206 #define IDMAP_CACHEDIR "/var/run/idmap" 207 #define IDMAP_DBNAME IDMAP_DBDIR "/idmap.db" 208 #define IDMAP_CACHENAME IDMAP_CACHEDIR "/idmap.db" 209 210 #define IS_BATCH_SID(batch, i) \ 211 (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_SID || \ 212 batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_USID || \ 213 batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GSID) 214 215 #define IS_BATCH_UID(batch, i) \ 216 (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_UID) 217 218 #define IS_BATCH_GID(batch, i) \ 219 (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GID) 220 221 #define IS_ID_SID(id) \ 222 ((id).idtype == IDMAP_SID || \ 223 (id).idtype == IDMAP_USID || \ 224 (id).idtype == IDMAP_GSID) \ 225 226 #define IS_REQUEST_SID(req, n) IS_ID_SID((req).id##n) 227 228 229 #define IS_REQUEST_UID(request) \ 230 ((request).id1.idtype == IDMAP_UID) 231 232 #define IS_REQUEST_GID(request) \ 233 ((request).id1.idtype == IDMAP_GID) 234 235 /* 236 * Local RID ranges 237 */ 238 #define LOCALRID_UID_MIN 1000U 239 #define LOCALRID_UID_MAX ((uint32_t)INT32_MAX) 240 #define LOCALRID_GID_MIN (((uint32_t)INT32_MAX) + 1) 241 #define LOCALRID_GID_MAX UINT32_MAX 242 243 typedef idmap_retcode (*update_list_res_cb)(void *, const char **, uint64_t); 244 typedef int (*list_svc_cb)(void *, int, char **, char **); 245 246 extern void idmap_prog_1(struct svc_req *, register SVCXPRT *); 247 extern void idmapdlog(int, const char *, ...); 248 extern int init_mapping_system(); 249 extern void fini_mapping_system(); 250 extern void print_idmapdstate(); 251 extern int create_directory(const char *, uid_t, gid_t); 252 extern int load_config(); 253 extern void reload_ad(); 254 extern int idmap_init_tsd_key(void); 255 extern void degrade_svc(int, const char *); 256 extern void restore_svc(void); 257 258 259 extern int init_dbs(); 260 extern void fini_dbs(); 261 extern idmap_retcode get_db_handle(sqlite **); 262 extern idmap_retcode get_cache_handle(sqlite **); 263 extern idmap_retcode sql_exec_no_cb(sqlite *, const char *, char *); 264 extern idmap_retcode add_namerule(sqlite *, idmap_namerule *); 265 extern idmap_retcode rm_namerule(sqlite *, idmap_namerule *); 266 extern idmap_retcode flush_namerules(sqlite *); 267 268 extern char *tolower_u8(const char *); 269 270 extern idmap_retcode gen_sql_expr_from_rule(idmap_namerule *, char **); 271 extern idmap_retcode validate_list_cb_data(list_cb_data_t *, int, 272 char **, int, uchar_t **, size_t); 273 extern idmap_retcode process_list_svc_sql(sqlite *, const char *, char *, 274 uint64_t, int, list_svc_cb, void *); 275 extern idmap_retcode sid2pid_first_pass(lookup_state_t *, 276 idmap_mapping *, idmap_id_res *); 277 extern idmap_retcode sid2pid_second_pass(lookup_state_t *, 278 idmap_mapping *, idmap_id_res *); 279 extern idmap_retcode pid2sid_first_pass(lookup_state_t *, 280 idmap_mapping *, idmap_id_res *, int); 281 extern idmap_retcode pid2sid_second_pass(lookup_state_t *, 282 idmap_mapping *, idmap_id_res *, int); 283 extern idmap_retcode update_cache_sid2pid(lookup_state_t *, 284 idmap_mapping *, idmap_id_res *); 285 extern idmap_retcode update_cache_pid2sid(lookup_state_t *, 286 idmap_mapping *, idmap_id_res *); 287 extern idmap_retcode get_u2w_mapping(sqlite *, sqlite *, idmap_mapping *, 288 idmap_mapping *, int); 289 extern idmap_retcode get_w2u_mapping(sqlite *, sqlite *, idmap_mapping *, 290 idmap_mapping *); 291 extern idmap_retcode load_cfg_in_state(lookup_state_t *); 292 extern void cleanup_lookup_state(lookup_state_t *); 293 294 extern idmap_retcode ad_lookup_batch(lookup_state_t *, 295 idmap_mapping_batch *, idmap_ids_res *); 296 extern idmap_retcode lookup_name2sid(sqlite *, const char *, const char *, 297 int *, char **, char **, char **, 298 idmap_rid_t *, idmap_mapping *, int); 299 extern idmap_retcode lookup_wksids_name2sid(const char *, const char *, 300 char **, char **, char **, idmap_rid_t *, 301 int *); 302 extern idmap_retcode idmap_cache_flush(idmap_flush_op); 303 304 extern void idmap_log_stderr(int); 305 extern void idmap_log_syslog(boolean_t); 306 extern void idmap_log_degraded(boolean_t); 307 308 extern const wksids_table_t *find_wksid_by_pid(posix_id_t pid, int is_user); 309 extern const wksids_table_t *find_wksid_by_sid(const char *sid, int rid, 310 int type); 311 extern const wksids_table_t *find_wksid_by_name(const char *name, 312 const char *domain, int type); 313 extern const wksids_table_t *find_wk_by_sid(char *sid); 314 315 #ifdef __cplusplus 316 } 317 #endif 318 319 #endif /* _IDMAPD_H */ 320