xref: /titanic_51/usr/src/cmd/idmap/idmapd/idmapd.h (revision 7b209c2cc5ea45251aba06dcc6181d3f23da807a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef _IDMAPD_H
27 #define	_IDMAPD_H
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <syslog.h>
34 #include <stdarg.h>
35 #include <rpc/rpc.h>
36 #include <synch.h>
37 #include <thread.h>
38 #include <libintl.h>
39 #include <strings.h>
40 #include <sqlite/sqlite.h>
41 #include <inttypes.h>
42 #include "idmap_prot.h"
43 #include "adutils.h"
44 #include "idmap_config.h"
45 
46 #ifdef __cplusplus
47 extern "C" {
48 #endif
49 
50 /* States a server can be in wrt request */
51 #define	_IDLE	0
52 #define	_SERVED	1
53 
54 #define	CHECK_NULL(s)	(s?s:"null")
55 
56 #define	SENTINEL_PID	UINT32_MAX
57 
58 extern int _rpcsvcstate;	/* set when a request is serviced */
59 extern int _rpcsvccount;	/* number of requests being serviced */
60 extern mutex_t _svcstate_lock;	/* lock for _rpcsvcstate, _rpcsvccount */
61 
62 typedef enum idmap_namemap_mode {
63 	IDMAP_NM_NONE = 0,
64 	IDMAP_NM_AD,
65 	IDMAP_NM_NLDAP,
66 	IDMAP_NM_MIXED
67 } idmap_namemap_mode_t;
68 
69 /*
70  * Global state of idmapd daemon.
71  */
72 #define	IDMAP_MAX_NAME_LEN	512
73 typedef struct idmapd_state {
74 	rwlock_t	rwlk_cfg;		/* config lock */
75 	idmap_cfg_t	*cfg;			/* config */
76 	bool_t		daemon_mode;
77 	bool_t		debug_mode;
78 	char		hostname[MAX_NAME_LEN];	/* my hostname */
79 	uid_t		next_uid;
80 	gid_t		next_gid;
81 	uid_t		limit_uid;
82 	gid_t		limit_gid;
83 	int		new_eph_db;	/* was the ephem ID db [re-]created? */
84 	ad_t		*ad;
85 } idmapd_state_t;
86 extern idmapd_state_t	_idmapdstate;
87 
88 #define	RDLOCK_CONFIG() \
89 	(void) rw_rdlock(&_idmapdstate.rwlk_cfg);
90 #define	WRLOCK_CONFIG() \
91 	(void) rw_wrlock(&_idmapdstate.rwlk_cfg);
92 #define	UNLOCK_CONFIG() \
93 	(void) rw_unlock(&_idmapdstate.rwlk_cfg);
94 
95 typedef struct hashentry {
96 	uint_t	key;
97 	uint_t	next;
98 } hashentry_t;
99 
100 typedef struct lookup_state {
101 	bool_t			sid2pid_done;
102 	bool_t			pid2sid_done;
103 	int			ad_nqueries;
104 	int			nldap_nqueries;
105 	uint_t			curpos;
106 	hashentry_t		*sid_history;
107 	uint_t			sid_history_size;
108 	idmap_mapping_batch	*batch;
109 	idmap_ids_res		*result;
110 	idmap_namemap_mode_t	nm_siduid;
111 	idmap_namemap_mode_t	nm_sidgid;
112 	char			*ad_unixuser_attr;
113 	char			*ad_unixgroup_attr;
114 } lookup_state_t;
115 
116 #define	NLDAP_OR_MIXED(nm) \
117 	(nm == IDMAP_NM_NLDAP || nm == IDMAP_NM_MIXED)
118 #define	AD_OR_MIXED(nm) \
119 	(nm == IDMAP_NM_AD || nm == IDMAP_NM_MIXED)
120 
121 #define	NLDAP_OR_MIXED_MODE(pidtype, ls) \
122 	((pidtype == IDMAP_UID && NLDAP_OR_MIXED(ls->nm_siduid)) || \
123 	(pidtype == IDMAP_GID && NLDAP_OR_MIXED(ls->nm_sidgid)))
124 #define	AD_OR_MIXED_MODE(pidtype, ls)\
125 	((pidtype == IDMAP_UID && AD_OR_MIXED(ls->nm_siduid)) || \
126 	(pidtype == IDMAP_GID && AD_OR_MIXED(ls->nm_sidgid)))
127 #define	NLDAP_MODE(pidtype, ls) \
128 	((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_NLDAP) || \
129 	(pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_NLDAP))
130 #define	AD_MODE(pidtype, ls) \
131 	((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_AD) || \
132 	(pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_AD))
133 #define	MIXED_MODE(pidtype, ls) \
134 	((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_MIXED) || \
135 	(pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_MIXED))
136 
137 
138 typedef struct list_cb_data {
139 	void		*result;
140 	uint64_t	next;
141 	uint64_t	len;
142 	uint64_t	limit;
143 } list_cb_data_t;
144 
145 typedef struct msg_table {
146 	idmap_retcode	retcode;
147 	const char	*msg;
148 } msg_table_t;
149 
150 #define	IDMAPD_SEARCH_TIMEOUT		3   /* seconds */
151 #define	IDMAPD_LDAP_OPEN_TIMEOUT	1   /* secs; initial, w/ exp backoff */
152 
153 /*
154  * The following flags are used by idmapd while processing a
155  * given mapping request. Note that idmapd uses multiple passes to
156  * process the request and the flags are used to pass information
157  * about the state of the request between these passes.
158  */
159 
160 /* Initial state. Done. Reset all flags. Remaining passes can be skipped */
161 #define	_IDMAP_F_DONE			0x00000000
162 /* Set when subsequent passes are required */
163 #define	_IDMAP_F_NOTDONE		0x00000001
164 /* Don't update name_cache. (e.g. set when winname,SID found in name_cache) */
165 #define	_IDMAP_F_DONT_UPDATE_NAMECACHE	0x00000002
166 /* Batch this request for AD lookup */
167 #define	_IDMAP_F_LOOKUP_AD		0x00000004
168 /* Batch this request for nldap directory lookup */
169 #define	_IDMAP_F_LOOKUP_NLDAP		0x00000008
170 /*
171  * Expired ephemeral mapping found in cache when processing sid2uid request.
172  * Use it if the given SID cannot be mapped by name
173  */
174 #define	_IDMAP_F_EXP_EPH_UID		0x00000010
175 /* Same as above. Used for sid2gid request */
176 #define	_IDMAP_F_EXP_EPH_GID		0x00000020
177 
178 /*
179  * Check if we are done. If so, subsequent passes can be skipped
180  * when processing a given mapping request.
181  */
182 #define	ARE_WE_DONE(f)	((f & _IDMAP_F_NOTDONE) == 0)
183 
184 #define	SIZE_INCR	5
185 #define	MAX_TRIES	5
186 #define	IDMAP_DBDIR	"/var/idmap"
187 #define	IDMAP_CACHEDIR	"/var/run/idmap"
188 #define	IDMAP_DBNAME	IDMAP_DBDIR "/idmap.db"
189 #define	IDMAP_CACHENAME	IDMAP_CACHEDIR "/idmap.db"
190 
191 #define	EMPTY_STRING(str)	(str == NULL || *str == 0)
192 
193 #define	IS_BATCH_SID(batch, i) \
194 	(batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_SID ||	\
195 	batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_USID ||	\
196 	batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GSID)
197 
198 #define	IS_BATCH_UID(batch, i) \
199 	(batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_UID)
200 
201 #define	IS_BATCH_GID(batch, i) \
202 	(batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GID)
203 
204 #define	IS_REQUEST_SID(req, n) \
205 	((req).id##n.idtype == IDMAP_SID ||	\
206 	(req).id##n.idtype == IDMAP_USID ||	\
207 	(req).id##n.idtype == IDMAP_GSID)	\
208 
209 
210 #define	IS_REQUEST_UID(request) \
211 	((request).id1.idtype == IDMAP_UID)
212 
213 #define	IS_REQUEST_GID(request) \
214 	((request).id1.idtype == IDMAP_GID)
215 
216 typedef idmap_retcode (*update_list_res_cb)(void *, const char **, uint64_t);
217 typedef int (*list_svc_cb)(void *, int, char **, char **);
218 
219 extern void	idmap_prog_1(struct svc_req *, register SVCXPRT *);
220 extern void	idmapdlog(int, const char *, ...);
221 extern int	init_mapping_system();
222 extern void	fini_mapping_system();
223 extern void	print_idmapdstate();
224 extern int	create_directory(const char *, uid_t, gid_t);
225 extern int	load_config();
226 extern int	reload_ad();
227 extern int	idmap_init_tsd_key(void);
228 extern void	degrade_svc(const char *);
229 extern void	restore_svc(void);
230 
231 
232 extern int		init_dbs();
233 extern void		fini_dbs();
234 extern idmap_retcode	get_db_handle(sqlite **);
235 extern idmap_retcode	get_cache_handle(sqlite **);
236 extern idmap_retcode	sql_exec_no_cb(sqlite *, const char *, char *);
237 extern idmap_retcode	add_namerule(sqlite *, idmap_namerule *);
238 extern idmap_retcode	rm_namerule(sqlite *, idmap_namerule *);
239 extern idmap_retcode	flush_namerules(sqlite *);
240 
241 extern char 		*tolower_u8(const char *);
242 
243 extern idmap_retcode	gen_sql_expr_from_rule(idmap_namerule *, char **);
244 extern idmap_retcode	validate_list_cb_data(list_cb_data_t *, int,
245 				char **, int, uchar_t **, size_t);
246 extern idmap_retcode	process_list_svc_sql(sqlite *, const char *, char *,
247 				uint64_t, list_svc_cb, void *);
248 extern idmap_retcode	sid2pid_first_pass(lookup_state_t *, sqlite *,
249 				idmap_mapping *, idmap_id_res *);
250 extern idmap_retcode	sid2pid_second_pass(lookup_state_t *, sqlite *,
251 				sqlite *, idmap_mapping *, idmap_id_res *);
252 extern idmap_retcode	pid2sid_first_pass(lookup_state_t *, sqlite *,
253 				idmap_mapping *, idmap_id_res *, int, int);
254 extern idmap_retcode	pid2sid_second_pass(lookup_state_t *, sqlite *,
255 				sqlite *, idmap_mapping *, idmap_id_res *, int);
256 extern idmap_retcode	update_cache_sid2pid(lookup_state_t *, sqlite *,
257 				idmap_mapping *, idmap_id_res *);
258 extern idmap_retcode	update_cache_pid2sid(lookup_state_t *, sqlite *,
259 				idmap_mapping *, idmap_id_res *);
260 extern idmap_retcode	get_u2w_mapping(sqlite *, sqlite *, idmap_mapping *,
261 				idmap_mapping *, int);
262 extern idmap_retcode	get_w2u_mapping(sqlite *, sqlite *, idmap_mapping *,
263 				idmap_mapping *);
264 extern idmap_retcode	get_ds_namemap_type(lookup_state_t *);
265 extern void		cleanup_lookup_state(lookup_state_t *);
266 
267 extern idmap_retcode	ad_lookup_batch(lookup_state_t *,
268 				idmap_mapping_batch *, idmap_ids_res *);
269 
270 
271 #ifdef __cplusplus
272 }
273 #endif
274 
275 #endif /* _IDMAPD_H */
276