xref: /illumos-gate/usr/src/cmd/idmap/idmapd/directory_provider_nsswitch.c (revision 6a634c9d)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * Retrieve directory information for standard UNIX users/groups.
 * (NB:  not just from files, but all nsswitch sources.)
 */

#include <pwd.h>
#include <grp.h>
#include <malloc.h>
#include <string.h>
#include <stdlib.h>
#include <netdb.h>
#include <libuutil.h>
#include <note.h>
#include <errno.h>
#include "idmapd.h"
#include "directory.h"
#include "directory_private.h"
#include <rpcsvc/idmap_prot.h>
#include "directory_server_impl.h"
#include "sidutil.h"

static directory_error_t machine_sid_dav(directory_values_rpc *lvals,
    unsigned int rid);
static directory_error_t directory_provider_nsswitch_populate(
    directory_entry_rpc *pent, struct passwd *pwd, struct group *grp,
    idmap_utf8str_list *attrs);

/*
 * Retrieve information by name.
 * Called indirectly through the directory_provider_static structure.
 */
static
directory_error_t
directory_provider_nsswitch_get(
    directory_entry_rpc *del,
    idmap_utf8str_list *ids,
    idmap_utf8str types,
    idmap_utf8str_list *attrs)
{
	int i;

	RDLOCK_CONFIG();

	/* 6835280 spurious lint error if the strlen is in the declaration */
	int host_name_len = strlen(_idmapdstate.hostname);
	char my_host_name[host_name_len + 1];
	(void) strcpy(my_host_name, _idmapdstate.hostname);

	/* We use len later, so this is not merely a workaround for 6835280 */
	int machine_sid_len = strlen(_idmapdstate.cfg->pgcfg.machine_sid);
	char my_machine_sid[machine_sid_len + 1];
	(void) strcpy(my_machine_sid, _idmapdstate.cfg->pgcfg.machine_sid);

	UNLOCK_CONFIG();

	for (i = 0; i < ids->idmap_utf8str_list_len; i++) {
		struct passwd *pwd = NULL;
		struct group *grp = NULL;
		directory_error_t de;
		int type;

		/*
		 * Extract the type for this particular ID.
		 * Advance to the next type, if it's there, else keep
		 * using this type until we run out of IDs.
		 */
		type = *types;
		if (*(types+1) != '\0')
			types++;

		/*
		 * If this entry has already been handled, one way or another,
		 * skip it.
		 */
		if (del[i].status != DIRECTORY_NOT_FOUND)
			continue;

		char *id = ids->idmap_utf8str_list_val[i];

		if (type == DIRECTORY_ID_SID[0]) {
			/*
			 * Is it our SID?
			 * Check whether the first part matches, then a "-",
			 * then a single RID.
			 */
			if (strncasecmp(id, my_machine_sid, machine_sid_len) !=
			    0)
				continue;
			if (id[machine_sid_len] != '-')
				continue;
			char *p;
			uint32_t rid =
			    strtoul(id + machine_sid_len + 1, &p, 10);
			if (*p != '\0')
				continue;

			if (rid < LOCALRID_UID_MIN) {
				/* Builtin, not handled here */
				continue;
			}

			if (rid <= LOCALRID_UID_MAX) {
				/* User */
				errno = 0;
				pwd = getpwuid(rid - LOCALRID_UID_MIN);
				if (pwd == NULL) {
					if (errno == 0)		/* Not found */
						continue;
					char buf[40];
					int err = errno;
					(void) snprintf(buf, sizeof (buf),
					    "%d", err);
					directory_entry_set_error(&del[i],
					    directory_error("errno.getpwuid",
					    "getpwuid: %2 (%1)",
					    buf, strerror(err), NULL));
					continue;
				}
			} else if (rid >= LOCALRID_GID_MIN &&
			    rid <= LOCALRID_GID_MAX) {
				/* Group */
				errno = 0;
				grp = getgrgid(rid - LOCALRID_GID_MIN);
				if (grp == NULL) {
					if (errno == 0)		/* Not found */
						continue;
					char buf[40];
					int err = errno;
					(void) snprintf(buf, sizeof (buf),
					    "%d", err);
					directory_entry_set_error(&del[i],
					    directory_error("errno.getgrgid",
					    "getgrgid: %2 (%1)",
					    buf, strerror(err), NULL));
					continue;
				}
			} else
				continue;

		} else {
			int id_len = strlen(id);
			char name[id_len + 1];
			char domain[id_len + 1];

			split_name(name, domain, id);

			if (domain[0] != '\0') {
				if (!domain_eq(domain, my_host_name))
					continue;
			}

			/*
			 * If the caller has requested user or group
			 * information specifically, we only set one of
			 * pwd or grp.
			 * If the caller has requested either type, we try
			 * both in the hopes of getting one.
			 * Note that directory_provider_nsswitch_populate
			 * considers it to be an error if both are set.
			 */
			if (type != DIRECTORY_ID_GROUP[0]) {
				/* prep for not found / error case */
				errno = 0;

				pwd = getpwnam(name);
				if (pwd == NULL && errno != 0) {
					char buf[40];
					int err = errno;
					(void) snprintf(buf, sizeof (buf),
					    "%d", err);
					directory_entry_set_error(&del[i],
					    directory_error("errno.getpwnam",
					    "getpwnam: %2 (%1)",
					    buf, strerror(err), NULL));
					continue;
				}
			}

			if (type != DIRECTORY_ID_USER[0]) {
				/* prep for not found / error case */
				errno = 0;

				grp = getgrnam(name);
				if (grp == NULL && errno != 0) {
					char buf[40];
					int err = errno;
					(void) snprintf(buf, sizeof (buf),
					    "%d", err);
					directory_entry_set_error(&del[i],
					    directory_error("errno.getgrnam",
					    "getgrnam: %2 (%1)",
					    buf, strerror(err), NULL));
					continue;
				}
			}
		}

		/*
		 * Didn't find it, don't populate the structure.
		 * Another provider might populate it.
		 */
		if (pwd == NULL && grp == NULL)
			continue;

		de = directory_provider_nsswitch_populate(&del[i], pwd, grp,
		    attrs);
		if (de != NULL) {
			directory_entry_set_error(&del[i], de);
			de = NULL;
			continue;
		}
	}

	return (NULL);
}

/*
 * Given a pwd structure or a grp structure, and a list of attributes that
 * were requested, populate the structure to return to the caller.
 */
static
directory_error_t
directory_provider_nsswitch_populate(
    directory_entry_rpc *pent,
    struct passwd *pwd,
    struct group *grp,
    idmap_utf8str_list *attrs)
{
	int j;
	directory_values_rpc *llvals;
	int nattrs;

	/*
	 * If it wasn't for this case, everything would be a lot simpler.
	 * UNIX allows users and groups with the same name.  Windows doesn't.
	 */
	if (pwd != NULL && grp != NULL) {
		return directory_error("Ambiguous.Name",
		    "Ambiguous name, is both a user and a group",
		    NULL);
	}

	nattrs = attrs->idmap_utf8str_list_len;

	llvals = calloc(nattrs, sizeof (directory_values_rpc));
	if (llvals == NULL)
		goto nomem;

	pent->directory_entry_rpc_u.attrs.attrs_val = llvals;
	pent->directory_entry_rpc_u.attrs.attrs_len = nattrs;
	pent->status = DIRECTORY_FOUND;

	for (j = 0; j < nattrs; j++) {
		directory_values_rpc *val;
		char *a;
		directory_error_t de;

		/*
		 * We're going to refer to these a lot, so make a shorthand
		 * copy.
		 */
		a = attrs->idmap_utf8str_list_val[j];
		val = &llvals[j];

		/*
		 * Start by assuming no errors and that we don't have
		 * the information
		 */
		val->found = FALSE;
		de = NULL;

		if (pwd != NULL) {
			/*
			 * Handle attributes for user entries.
			 */
			if (uu_strcaseeq(a, "cn")) {
				const char *p = pwd->pw_name;
				de = str_list_dav(val, &p, 1);
			} else if (uu_strcaseeq(a, "objectClass")) {
				static const char *objectClasses[] = {
					"top",
					"posixAccount",
				};
				de = str_list_dav(val, objectClasses,
				    UU_NELEM(objectClasses));
			} else if (uu_strcaseeq(a, "gidNumber")) {
				de = uint_list_dav(val, &pwd->pw_gid, 1);
			} else if (uu_strcaseeq(a, "objectSid")) {
				de = machine_sid_dav(val,
				    pwd->pw_uid + LOCALRID_UID_MIN);
			} else if (uu_strcaseeq(a, "displayName")) {
				const char *p = pwd->pw_gecos;
				de = str_list_dav(val, &p, 1);
			} else if (uu_strcaseeq(a, "distinguishedName")) {
				char *dn;
				RDLOCK_CONFIG();
				(void) asprintf(&dn,
				    "uid=%s,ou=people,dc=%s",
				    pwd->pw_name, _idmapdstate.hostname);
				UNLOCK_CONFIG();
				if (dn == NULL)
					goto nomem;
				const char *cdn = dn;
				de = str_list_dav(val, &cdn, 1);
				free(dn);
			} else if (uu_strcaseeq(a, "uid")) {
				const char *p = pwd->pw_name;
				de = str_list_dav(val, &p, 1);
			} else if (uu_strcaseeq(a, "uidNumber")) {
				de = uint_list_dav(val, &pwd->pw_uid, 1);
			} else if (uu_strcaseeq(a, "gecos")) {
				const char *p = pwd->pw_gecos;
				de = str_list_dav(val, &p, 1);
			} else if (uu_strcaseeq(a, "homeDirectory")) {
				const char *p = pwd->pw_dir;
				de = str_list_dav(val, &p, 1);
			} else if (uu_strcaseeq(a, "loginShell")) {
				const char *p = pwd->pw_shell;
				de = str_list_dav(val, &p, 1);
			} else if (uu_strcaseeq(a, "x-sun-canonicalName")) {
				char *canon;
				RDLOCK_CONFIG();
				(void) asprintf(&canon, "%s@%s",
				    pwd->pw_name, _idmapdstate.hostname);
				UNLOCK_CONFIG();
				if (canon == NULL)
					goto nomem;
				const char *ccanon = canon;
				de = str_list_dav(val, &ccanon, 1);
				free(canon);
			} else if (uu_strcaseeq(a, "x-sun-provider")) {
				const char *provider = "UNIX-passwd";
				de = str_list_dav(val, &provider, 1);
			}
		} else if (grp != NULL)  {
			/*
			 * Handle attributes for group entries.
			 */
			if (uu_strcaseeq(a, "cn")) {
				const char *p = grp->gr_name;
				de = str_list_dav(val, &p, 1);
			} else if (uu_strcaseeq(a, "objectClass")) {
				static const char *objectClasses[] = {
					"top",
					"posixGroup",
				};
				de = str_list_dav(val, objectClasses,
				    UU_NELEM(objectClasses));
			} else if (uu_strcaseeq(a, "gidNumber")) {
				de = uint_list_dav(val, &grp->gr_gid, 1);
			} else if (uu_strcaseeq(a, "objectSid")) {
				de = machine_sid_dav(val,
				    grp->gr_gid + LOCALRID_GID_MIN);
			} else if (uu_strcaseeq(a, "displayName")) {
				const char *p = grp->gr_name;
				de = str_list_dav(val, &p, 1);
			} else if (uu_strcaseeq(a, "distinguishedName")) {
				char *dn;
				RDLOCK_CONFIG();
				(void) asprintf(&dn,
				    "cn=%s,ou=group,dc=%s",
				    grp->gr_name, _idmapdstate.hostname);
				UNLOCK_CONFIG();
				if (dn == NULL)
					goto nomem;
				const char *cdn = dn;
				de = str_list_dav(val, &cdn, 1);
				free(dn);
			} else if (uu_strcaseeq(a, "memberUid")) {
				/*
				 * NEEDSWORK:  There is probably a non-cast
				 * way to do this, but I don't immediately
				 * see it.
				 */
				const char * const *members =
				    (const char * const *)grp->gr_mem;
				de = str_list_dav(val, members, 0);
			} else if (uu_strcaseeq(a, "x-sun-canonicalName")) {
				char *canon;
				RDLOCK_CONFIG();
				(void) asprintf(&canon, "%s@%s",
				    grp->gr_name, _idmapdstate.hostname);
				UNLOCK_CONFIG();
				if (canon == NULL)
					goto nomem;
				const char *ccanon = canon;
				de = str_list_dav(val, &ccanon, 1);
				free(canon);
			} else if (uu_strcaseeq(a, "x-sun-provider")) {
				const char *provider = "UNIX-group";
				de = str_list_dav(val, &provider, 1);
			}
		}

		if (de != NULL)
			return (de);
	}

	return (NULL);

nomem:
	return (directory_error("ENOMEM.users",
	    "No memory allocating return value for user lookup", NULL));
}

/*
 * Populate a directory attribute value with a SID based on our machine SID
 * and the specified RID.
 *
 * It's a bit perverse that we must take a text-format SID and turn it into
 * a binary-format SID, only to have the caller probably turn it back into
 * text format, but SIDs are carried across LDAP in binary format.
 */
static
directory_error_t
machine_sid_dav(directory_values_rpc *lvals, unsigned int rid)
{
	sid_t *sid;
	directory_error_t de;

	RDLOCK_CONFIG();
	int len = strlen(_idmapdstate.cfg->pgcfg.machine_sid);
	char buf[len + 100];	/* 100 is enough space for any RID */
	(void) snprintf(buf, sizeof (buf), "%s-%u",
	    _idmapdstate.cfg->pgcfg.machine_sid, rid);
	UNLOCK_CONFIG();

	sid = sid_fromstr(buf);
	if (sid == NULL)
		goto nomem;

	sid_to_le(sid);

	de = bin_list_dav(lvals, sid, 1, sid_len(sid));
	sid_free(sid);
	return (de);

nomem:
	return (directory_error("ENOMEM.machine_sid_dav",
	    "Out of memory allocating return value for lookup", NULL));
}

struct directory_provider_static directory_provider_nsswitch = {
	"files",
	directory_provider_nsswitch_get,
};