1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _IDMAPD_H 27 #define _IDMAPD_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 #include <stdio.h> 32 #include <stdlib.h> 33 #include <syslog.h> 34 #include <stdarg.h> 35 #include <rpc/rpc.h> 36 #include <synch.h> 37 #include <thread.h> 38 #include <libintl.h> 39 #include <strings.h> 40 #include <sqlite/sqlite.h> 41 #include <inttypes.h> 42 #include "idmap_prot.h" 43 #include "adutils.h" 44 #include "idmap_config.h" 45 46 #ifdef __cplusplus 47 extern "C" { 48 #endif 49 50 /* States a server can be in wrt request */ 51 #define _IDLE 0 52 #define _SERVED 1 53 54 #define CHECK_NULL(s) (s?s:"null") 55 56 #define SENTINEL_PID UINT32_MAX 57 58 extern int _rpcsvcstate; /* set when a request is serviced */ 59 extern int _rpcsvccount; /* number of requests being serviced */ 60 extern mutex_t _svcstate_lock; /* lock for _rpcsvcstate, _rpcsvccount */ 61 62 typedef enum idmap_namemap_mode { 63 IDMAP_NM_NONE = 0, 64 IDMAP_NM_AD, 65 IDMAP_NM_NLDAP, 66 IDMAP_NM_MIXED 67 } idmap_namemap_mode_t; 68 69 /* 70 * Global state of idmapd daemon. 71 */ 72 #define IDMAP_MAX_NAME_LEN 512 73 typedef struct idmapd_state { 74 rwlock_t rwlk_cfg; /* config lock */ 75 idmap_cfg_t *cfg; /* config */ 76 bool_t daemon_mode; /* daemon mode? yes/no */ 77 char hostname[MAX_NAME_LEN]; /* my hostname */ 78 uid_t next_uid; 79 gid_t next_gid; 80 uid_t limit_uid; 81 gid_t limit_gid; 82 int new_eph_db; /* was the ephem ID db [re-]created? */ 83 ad_t *ad; 84 } idmapd_state_t; 85 extern idmapd_state_t _idmapdstate; 86 87 #define RDLOCK_CONFIG() \ 88 (void) rw_rdlock(&_idmapdstate.rwlk_cfg); 89 #define WRLOCK_CONFIG() \ 90 (void) rw_wrlock(&_idmapdstate.rwlk_cfg); 91 #define UNLOCK_CONFIG() \ 92 (void) rw_unlock(&_idmapdstate.rwlk_cfg); 93 94 typedef struct hashentry { 95 uint_t key; 96 uint_t next; 97 } hashentry_t; 98 99 typedef struct lookup_state { 100 bool_t sid2pid_done; 101 bool_t pid2sid_done; 102 int ad_nqueries; 103 int nldap_nqueries; 104 uint_t curpos; 105 hashentry_t *sid_history; 106 uint_t sid_history_size; 107 idmap_mapping_batch *batch; 108 idmap_ids_res *result; 109 idmap_namemap_mode_t nm_siduid; 110 idmap_namemap_mode_t nm_sidgid; 111 char *ad_unixuser_attr; 112 char *ad_unixgroup_attr; 113 } lookup_state_t; 114 115 #define NLDAP_OR_MIXED(nm) \ 116 (nm == IDMAP_NM_NLDAP || nm == IDMAP_NM_MIXED) 117 #define AD_OR_MIXED(nm) \ 118 (nm == IDMAP_NM_AD || nm == IDMAP_NM_MIXED) 119 120 #define NLDAP_OR_MIXED_MODE(pidtype, ls) \ 121 ((pidtype == IDMAP_UID && NLDAP_OR_MIXED(ls->nm_siduid)) || \ 122 (pidtype == IDMAP_GID && NLDAP_OR_MIXED(ls->nm_sidgid))) 123 #define AD_OR_MIXED_MODE(pidtype, ls)\ 124 ((pidtype == IDMAP_UID && AD_OR_MIXED(ls->nm_siduid)) || \ 125 (pidtype == IDMAP_GID && AD_OR_MIXED(ls->nm_sidgid))) 126 #define NLDAP_MODE(pidtype, ls) \ 127 ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_NLDAP) || \ 128 (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_NLDAP)) 129 #define AD_MODE(pidtype, ls) \ 130 ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_AD) || \ 131 (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_AD)) 132 #define MIXED_MODE(pidtype, ls) \ 133 ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_MIXED) || \ 134 (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_MIXED)) 135 136 137 typedef struct list_cb_data { 138 void *result; 139 uint64_t next; 140 uint64_t len; 141 uint64_t limit; 142 } list_cb_data_t; 143 144 typedef struct msg_table { 145 idmap_retcode retcode; 146 const char *msg; 147 } msg_table_t; 148 149 #define IDMAPD_SEARCH_TIMEOUT 3 /* seconds */ 150 #define IDMAPD_LDAP_OPEN_TIMEOUT 1 /* secs; initial, w/ exp backoff */ 151 152 /* 153 * The following flags are used by idmapd while processing a 154 * given mapping request. Note that idmapd uses multiple passes to 155 * process the request and the flags are used to pass information 156 * about the state of the request between these passes. 157 */ 158 159 /* Initial state. Done. Reset all flags. Remaining passes can be skipped */ 160 #define _IDMAP_F_DONE 0x00000000 161 /* Set when subsequent passes are required */ 162 #define _IDMAP_F_NOTDONE 0x00000001 163 /* Don't update name_cache. (e.g. set when winname,SID found in name_cache) */ 164 #define _IDMAP_F_DONT_UPDATE_NAMECACHE 0x00000002 165 /* Batch this request for AD lookup */ 166 #define _IDMAP_F_LOOKUP_AD 0x00000004 167 /* Batch this request for nldap directory lookup */ 168 #define _IDMAP_F_LOOKUP_NLDAP 0x00000008 169 /* 170 * Expired ephemeral mapping found in cache when processing sid2uid request. 171 * Use it if the given SID cannot be mapped by name 172 */ 173 #define _IDMAP_F_EXP_EPH_UID 0x00000010 174 /* Same as above. Used for sid2gid request */ 175 #define _IDMAP_F_EXP_EPH_GID 0x00000020 176 177 /* 178 * Check if we are done. If so, subsequent passes can be skipped 179 * when processing a given mapping request. 180 */ 181 #define ARE_WE_DONE(f) ((f & _IDMAP_F_NOTDONE) == 0) 182 183 #define SIZE_INCR 5 184 #define MAX_TRIES 5 185 #define IDMAP_DBDIR "/var/idmap" 186 #define IDMAP_CACHEDIR "/var/run/idmap" 187 #define IDMAP_DBNAME IDMAP_DBDIR "/idmap.db" 188 #define IDMAP_CACHENAME IDMAP_CACHEDIR "/idmap.db" 189 #define IDMAP_CACHENAME IDMAP_CACHEDIR "/idmap.db" 190 191 #define EMPTY_STRING(str) (str == NULL || *str == 0) 192 193 #define IS_BATCH_SID(batch, i) \ 194 (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_SID || \ 195 batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_USID || \ 196 batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GSID) 197 198 #define IS_BATCH_UID(batch, i) \ 199 (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_UID) 200 201 #define IS_BATCH_GID(batch, i) \ 202 (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GID) 203 204 #define IS_REQUEST_SID(req, n) \ 205 ((req).id##n.idtype == IDMAP_SID || \ 206 (req).id##n.idtype == IDMAP_USID || \ 207 (req).id##n.idtype == IDMAP_GSID) \ 208 209 210 #define IS_REQUEST_UID(request) \ 211 ((request).id1.idtype == IDMAP_UID) 212 213 #define IS_REQUEST_GID(request) \ 214 ((request).id1.idtype == IDMAP_GID) 215 216 typedef idmap_retcode (*update_list_res_cb)(void *, const char **, uint64_t); 217 typedef int (*list_svc_cb)(void *, int, char **, char **); 218 219 extern void idmap_prog_1(struct svc_req *, register SVCXPRT *); 220 extern void idmapdlog(int, const char *, ...); 221 extern int init_mapping_system(); 222 extern void fini_mapping_system(); 223 extern void print_idmapdstate(); 224 extern int create_directory(const char *, uid_t, gid_t); 225 extern int load_config(); 226 extern int reload_ad(); 227 extern int idmap_init_tsd_key(void); 228 extern void degrade_svc(const char *); 229 extern void restore_svc(void); 230 231 232 extern int init_dbs(); 233 extern void fini_dbs(); 234 extern idmap_retcode get_db_handle(sqlite **); 235 extern idmap_retcode get_cache_handle(sqlite **); 236 extern idmap_retcode sql_exec_no_cb(sqlite *, char *); 237 extern idmap_retcode add_namerule(sqlite *, idmap_namerule *); 238 extern idmap_retcode rm_namerule(sqlite *, idmap_namerule *); 239 extern idmap_retcode flush_namerules(sqlite *); 240 241 extern char *tolower_u8(const char *); 242 243 extern idmap_retcode gen_sql_expr_from_rule(idmap_namerule *, char **); 244 extern idmap_retcode validate_list_cb_data(list_cb_data_t *, int, 245 char **, int, uchar_t **, size_t); 246 extern idmap_retcode process_list_svc_sql(sqlite *, char *, uint64_t, 247 list_svc_cb, void *); 248 extern idmap_retcode sid2pid_first_pass(lookup_state_t *, sqlite *, 249 idmap_mapping *, idmap_id_res *); 250 extern idmap_retcode sid2pid_second_pass(lookup_state_t *, sqlite *, 251 sqlite *, idmap_mapping *, idmap_id_res *); 252 extern idmap_retcode pid2sid_first_pass(lookup_state_t *, sqlite *, 253 idmap_mapping *, idmap_id_res *, int, int); 254 extern idmap_retcode pid2sid_second_pass(lookup_state_t *, sqlite *, 255 sqlite *, idmap_mapping *, idmap_id_res *, int); 256 extern idmap_retcode update_cache_sid2pid(lookup_state_t *, sqlite *, 257 idmap_mapping *, idmap_id_res *); 258 extern idmap_retcode update_cache_pid2sid(lookup_state_t *, sqlite *, 259 idmap_mapping *, idmap_id_res *); 260 extern idmap_retcode get_u2w_mapping(sqlite *, sqlite *, idmap_mapping *, 261 idmap_mapping *, int); 262 extern idmap_retcode get_w2u_mapping(sqlite *, sqlite *, idmap_mapping *, 263 idmap_mapping *); 264 extern idmap_retcode get_ds_namemap_type(lookup_state_t *); 265 extern void cleanup_lookup_state(lookup_state_t *); 266 267 extern idmap_retcode ad_lookup_batch(lookup_state_t *, 268 idmap_mapping_batch *, idmap_ids_res *); 269 270 271 #ifdef __cplusplus 272 } 273 #endif 274 275 #endif /* _IDMAPD_H */ 276