1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
24 */
25
26#ifndef _IDMAPD_H
27#define	_IDMAPD_H
28
29#include <stdio.h>
30#include <stdlib.h>
31#include <stdarg.h>
32#include <rpc/rpc.h>
33#include <synch.h>
34#include <thread.h>
35#include <libintl.h>
36#include <strings.h>
37#include <sqlite-sys/sqlite.h>
38#include <syslog.h>
39#include <inttypes.h>
40#include <rpcsvc/idmap_prot.h>
41#include "adutils.h"
42#include "idmap_priv.h"
43#include "idmap_config.h"
44#include "libadutils.h"
45
46#ifdef __cplusplus
47extern "C" {
48#endif
49
50#define	CHECK_NULL(s)	(s != NULL ? s : "null")
51
52extern mutex_t _svcstate_lock;	/* lock for _rpcsvcstate, _rpcsvccount */
53
54typedef enum idmap_namemap_mode {
55	IDMAP_NM_NONE = 0,
56	IDMAP_NM_AD,
57	IDMAP_NM_NLDAP,
58	IDMAP_NM_MIXED
59} idmap_namemap_mode_t;
60
61/*
62 * Debugging output.
63 *
64 * There are some number of areas - configuration, mapping, discovery, et
65 * cetera - and for each area there is a verbosity level controlled through
66 * an SMF property.  The default is zero, and "debug/all" provides a master
67 * control allowing you to turn on all debugging output with one setting.
68 *
69 * A typical debugging output sequence would look like
70 *
71 * 	if (DBG(CONFIG, 2)) {
72 *		idmapdlog(LOG_DEBUG,
73 *		    "some message about config at verbosity 2");
74 *	}
75 */
76enum idmapd_debug {
77	IDMAPD_DEBUG_ALL = 0,
78	IDMAPD_DEBUG_CONFIG = 1,
79	IDMAPD_DEBUG_MAPPING = 2,
80	IDMAPD_DEBUG_DISC = 3,
81	IDMAPD_DEBUG_DNS = 4,
82	IDMAPD_DEBUG_LDAP = 5,
83	IDMAPD_DEBUG_MAX = 5
84};
85
86#define	DBG(type, lev)	\
87	(_idmapdstate.debug[IDMAPD_DEBUG_##type] >= (lev) || \
88	    _idmapdstate.debug[IDMAPD_DEBUG_ALL] >= (lev))
89
90/*
91 * Global state of idmapd daemon.
92 */
93typedef struct idmapd_state {
94	rwlock_t	rwlk_cfg;		/* config lock */
95	idmap_cfg_t	*cfg;			/* config */
96	bool_t		daemon_mode;
97	char		hostname[MAX_NAME_LEN];	/* my hostname */
98	uid_t		next_uid;
99	gid_t		next_gid;
100	uid_t		limit_uid;
101	gid_t		limit_gid;
102	int		new_eph_db;	/* was the ephem ID db [re-]created? */
103	int		num_gcs;
104	adutils_ad_t	**gcs;
105	int		num_dcs;
106	adutils_ad_t	**dcs;
107	mutex_t		addisc_lk;
108	cond_t		addisc_cv;
109	int		addisc_st;
110	int		debug[IDMAPD_DEBUG_MAX+1];
111} idmapd_state_t;
112extern idmapd_state_t	_idmapdstate;
113
114#define	ADDISC_ST_REQUESTED	1
115#define	ADDISC_ST_RUNNING	2
116
117#define	RDLOCK_CONFIG() \
118	(void) rw_rdlock(&_idmapdstate.rwlk_cfg);
119#define	WRLOCK_CONFIG() \
120	(void) rw_wrlock(&_idmapdstate.rwlk_cfg);
121#define	UNLOCK_CONFIG() \
122	(void) rw_unlock(&_idmapdstate.rwlk_cfg);
123
124typedef struct hashentry {
125	uint_t	key;
126	uint_t	next;
127} hashentry_t;
128
129typedef struct lookup_state {
130	bool_t			sid2pid_done;
131	bool_t			pid2sid_done;
132	int			ad_nqueries;
133	int			nldap_nqueries;
134	bool_t			eph_map_unres_sids;
135	int			directory_based_mapping;	/* enum */
136	uint_t			id_cache_timeout;
137	uint_t			name_cache_timeout;
138	uint_t			curpos;
139	hashentry_t		*sid_history;
140	uint_t			sid_history_size;
141	idmap_mapping_batch	*batch;
142	idmap_ids_res		*result;
143	idmap_namemap_mode_t	nm_siduid;
144	idmap_namemap_mode_t	nm_sidgid;
145	char			*ad_unixuser_attr;
146	char			*ad_unixgroup_attr;
147	char			*nldap_winname_attr;
148	char			*defdom;
149	sqlite			*cache;
150	sqlite			*db;
151} lookup_state_t;
152
153#define	NLDAP_OR_MIXED(nm) \
154	((nm) == IDMAP_NM_NLDAP || (nm) == IDMAP_NM_MIXED)
155#define	AD_OR_MIXED(nm) \
156	((nm) == IDMAP_NM_AD || (nm) == IDMAP_NM_MIXED)
157
158#define	PID_UID_OR_UNKNOWN(pidtype) \
159	((pidtype) == IDMAP_UID || (pidtype) == IDMAP_POSIXID)
160#define	PID_GID_OR_UNKNOWN(pidtype) \
161	((pidtype) == IDMAP_GID || (pidtype) == IDMAP_POSIXID)
162
163#define	NLDAP_OR_MIXED_MODE(pidtype, ls) \
164	(NLDAP_MODE(pidtype, ls) || MIXED_MODE(pidtype, ls))
165#define	AD_OR_MIXED_MODE(pidtype, ls)\
166	(AD_MODE(pidtype, ls) || MIXED_MODE(pidtype, ls))
167#define	NLDAP_MODE(pidtype, ls) \
168	((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_NLDAP) || \
169	(PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_NLDAP))
170#define	AD_MODE(pidtype, ls) \
171	((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_AD) || \
172	(PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_AD))
173#define	MIXED_MODE(pidtype, ls) \
174	((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_MIXED) || \
175	(PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_MIXED))
176
177
178typedef struct list_cb_data {
179	void		*result;
180	uint64_t	next;
181	uint64_t	len;
182	uint64_t	limit;
183	int		flag;
184} list_cb_data_t;
185
186typedef struct msg_table {
187	idmap_retcode	retcode;
188	const char	*msg;
189} msg_table_t;
190
191/*
192 * Data structure to store well-known SIDs and
193 * associated mappings (if any)
194 */
195typedef struct wksids_table {
196	const char	*sidprefix;
197	uint32_t	rid;
198	const char	*domain;
199	const char	*winname;
200	int		is_wuser;
201	posix_id_t	pid;
202	int		is_user;
203	int		direction;
204} wksids_table_t;
205
206#define	IDMAPD_SEARCH_TIMEOUT		3   /* seconds */
207#define	IDMAPD_LDAP_OPEN_TIMEOUT	1   /* secs; initial, w/ exp backoff */
208
209/*
210 * The following flags are used by idmapd while processing a
211 * given mapping request. Note that idmapd uses multiple passes to
212 * process the request and the flags are used to pass information
213 * about the state of the request between these passes.
214 */
215
216/* Initial state. Done. Reset all flags. Remaining passes can be skipped */
217#define	_IDMAP_F_DONE			0x00000000
218/* Set when subsequent passes are required */
219#define	_IDMAP_F_NOTDONE		0x00000001
220/* Don't update name_cache. (e.g. set when winname,SID found in name_cache) */
221#define	_IDMAP_F_DONT_UPDATE_NAMECACHE	0x00000002
222/* Batch this request for AD lookup */
223#define	_IDMAP_F_LOOKUP_AD		0x00000004
224/* Batch this request for nldap directory lookup */
225#define	_IDMAP_F_LOOKUP_NLDAP		0x00000008
226/*
227 * Expired ephemeral mapping found in cache when processing sid2uid request.
228 * Use it if the given SID cannot be mapped by name
229 */
230#define	_IDMAP_F_EXP_EPH_UID		0x00000010
231/* Same as above. Used for sid2gid request */
232#define	_IDMAP_F_EXP_EPH_GID		0x00000020
233/* This request is not valid for the current forest */
234#define	_IDMAP_F_LOOKUP_OTHER_AD	0x00000040
235
236
237/*
238 * Check if we are done. If so, subsequent passes can be skipped
239 * when processing a given mapping request.
240 */
241#define	ARE_WE_DONE(f)	((f & _IDMAP_F_NOTDONE) == 0)
242
243#define	SIZE_INCR	5
244#define	MAX_TRIES	5
245#define	IDMAP_DBDIR	"/var/idmap"
246#define	IDMAP_CACHEDIR	"/var/run/idmap"
247#define	IDMAP_DBNAME	IDMAP_DBDIR "/idmap.db"
248#define	IDMAP_CACHENAME	IDMAP_CACHEDIR "/idmap.db"
249
250#define	IS_ID_NONE(id)	\
251	((id).idtype == IDMAP_NONE)
252
253#define	IS_ID_SID(id)	\
254	((id).idtype == IDMAP_SID ||	\
255	(id).idtype == IDMAP_USID ||	\
256	(id).idtype == IDMAP_GSID)	\
257
258#define	IS_ID_UID(id)	\
259	((id).idtype == IDMAP_UID)
260
261#define	IS_ID_GID(id)	\
262	((id).idtype == IDMAP_GID)
263
264#define	IS_ID_POSIX(id)	\
265	((id).idtype == IDMAP_UID ||	\
266	(id).idtype == IDMAP_GID ||	\
267	(id).idtype == IDMAP_POSIXID)	\
268
269/*
270 * Local RID ranges
271 */
272#define	LOCALRID_UID_MIN	1000U
273#define	LOCALRID_UID_MAX	((uint32_t)INT32_MAX)
274#define	LOCALRID_GID_MIN	(((uint32_t)INT32_MAX) + 1)
275#define	LOCALRID_GID_MAX	UINT32_MAX
276
277/*
278 * Tracing.
279 *
280 * The tracing mechanism is intended to help the administrator understand
281 * why their mapping configuration is doing what it is.  Each interesting
282 * decision point during the mapping process calls TRACE() with the current
283 * request and response and a printf-style message.  The message, plus
284 * data from the request and the response, is logged to the service log
285 * (if debug/mapping is greater than zero) or reported to the caller
286 * (if IDMAP_REQ_FLG_TRACE was set in the request.  The primary consumer
287 * is the "-V" option to "idmap show".
288 *
289 * TRACING(req) says whether tracing is appropriate for the request, and
290 * is used to determine and record whether any request in a batch requested
291 * tracing, to control whether later code loops over the batch to do tracing
292 * for any of the requests.
293 *
294 * TRACE(req, res, fmt, ...) generates a trace entry if appropriate.
295 */
296#define	TRACING(req)	\
297	(DBG(MAPPING, 1) ||	\
298	((req)->flag & IDMAP_REQ_FLG_TRACE) != 0)
299#define	TRACE(req, res, ...)			\
300	((void)(TRACING(req) && trace(req, res, __VA_ARGS__)))
301extern int	trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...);
302
303typedef idmap_retcode (*update_list_res_cb)(void *, const char **, uint64_t);
304typedef int (*list_svc_cb)(void *, int, char **, char **);
305
306extern void	idmap_prog_1(struct svc_req *, register SVCXPRT *);
307extern void	idmapdlog(int, const char *, ...);
308extern int	init_mapping_system();
309extern void	fini_mapping_system();
310extern void	print_idmapdstate();
311extern int	create_directory(const char *, uid_t, gid_t);
312extern int	load_config();
313extern void	reload_ad();
314extern void	idmap_init_tsd_key(void);
315extern void	degrade_svc(int, const char *);
316extern void	restore_svc(void);
317extern void	notify_dc_changed(void);
318
319
320extern int		init_dbs();
321extern void		fini_dbs();
322extern idmap_retcode	get_db_handle(sqlite **);
323extern idmap_retcode	get_cache_handle(sqlite **);
324extern idmap_retcode	sql_exec_no_cb(sqlite *, const char *, char *);
325extern idmap_retcode	add_namerule(sqlite *, idmap_namerule *);
326extern idmap_retcode	rm_namerule(sqlite *, idmap_namerule *);
327extern idmap_retcode	flush_namerules(sqlite *);
328
329extern char 		*tolower_u8(const char *);
330
331extern idmap_retcode	gen_sql_expr_from_rule(idmap_namerule *, char **);
332extern idmap_retcode	validate_list_cb_data(list_cb_data_t *, int,
333				char **, int, uchar_t **, size_t);
334extern idmap_retcode	process_list_svc_sql(sqlite *, const char *, char *,
335				uint64_t, int, list_svc_cb, void *);
336extern idmap_retcode	sid2pid_first_pass(lookup_state_t *,
337				idmap_mapping *, idmap_id_res *);
338extern idmap_retcode	sid2pid_second_pass(lookup_state_t *,
339				idmap_mapping *, idmap_id_res *);
340extern idmap_retcode	pid2sid_first_pass(lookup_state_t *,
341				idmap_mapping *, idmap_id_res *, int);
342extern idmap_retcode	pid2sid_second_pass(lookup_state_t *,
343				idmap_mapping *, idmap_id_res *, int);
344extern idmap_retcode	update_cache_sid2pid(lookup_state_t *,
345				idmap_mapping *, idmap_id_res *);
346extern idmap_retcode	update_cache_pid2sid(lookup_state_t *,
347				idmap_mapping *, idmap_id_res *);
348extern idmap_retcode	get_u2w_mapping(sqlite *, sqlite *, idmap_mapping *,
349				idmap_mapping *, int);
350extern idmap_retcode	get_w2u_mapping(sqlite *, sqlite *, idmap_mapping *,
351				idmap_mapping *);
352extern idmap_retcode	load_cfg_in_state(lookup_state_t *);
353extern void		cleanup_lookup_state(lookup_state_t *);
354
355extern idmap_retcode	ad_lookup_batch(lookup_state_t *,
356				idmap_mapping_batch *, idmap_ids_res *);
357extern idmap_retcode	lookup_name2sid(sqlite *, const char *, const char *,
358				int, char **, char **, char **,
359				idmap_rid_t *, idmap_id_type *,
360				idmap_mapping *, int);
361extern idmap_retcode	lookup_wksids_name2sid(const char *, const char *,
362				char **, char **, char **, idmap_rid_t *,
363				idmap_id_type *);
364extern idmap_retcode	idmap_cache_flush(idmap_flush_op);
365
366extern const wksids_table_t *find_wksid_by_pid(posix_id_t pid, int is_user);
367extern const wksids_table_t *find_wksid_by_sid(const char *sid, int rid,
368    idmap_id_type type);
369extern const wksids_table_t *find_wksid_by_name(const char *name,
370    const char *domain, idmap_id_type type);
371extern const wksids_table_t *find_wk_by_sid(char *sid);
372
373#ifdef __cplusplus
374}
375#endif
376
377#endif /* _IDMAPD_H */
378