1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 227a8a68f5SJulian Pullen * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23c5c4113dSnw * Use is subject to license terms. 24c5c4113dSnw */ 25c5c4113dSnw 26c5c4113dSnw #ifndef _IDMAPD_H 27c5c4113dSnw #define _IDMAPD_H 28c5c4113dSnw 29c5c4113dSnw #include <stdio.h> 30c5c4113dSnw #include <stdlib.h> 31c5c4113dSnw #include <stdarg.h> 32c5c4113dSnw #include <rpc/rpc.h> 33c5c4113dSnw #include <synch.h> 34c5c4113dSnw #include <thread.h> 35c5c4113dSnw #include <libintl.h> 36c5c4113dSnw #include <strings.h> 37c5c4113dSnw #include <sqlite/sqlite.h> 387a8a68f5SJulian Pullen #include <syslog.h> 39c5c4113dSnw #include <inttypes.h> 40*9b214d32SJordan Brown #include <rpcsvc/idmap_prot.h> 41c5c4113dSnw #include "adutils.h" 427a8a68f5SJulian Pullen #include "idmap_priv.h" 43c5c4113dSnw #include "idmap_config.h" 442b4a7802SBaban Kenkre #include "libadutils.h" 45c5c4113dSnw 46c5c4113dSnw #ifdef __cplusplus 47c5c4113dSnw extern "C" { 48c5c4113dSnw #endif 49c5c4113dSnw 50c5c4113dSnw /* States a server can be in wrt request */ 51c5c4113dSnw #define _IDLE 0 52c5c4113dSnw #define _SERVED 1 53c5c4113dSnw 54c5c4113dSnw #define SENTINEL_PID UINT32_MAX 55479ac375Sdm #define CHECK_NULL(s) (s != NULL ? s : "null") 56c5c4113dSnw 57c5c4113dSnw extern int _rpcsvcstate; /* set when a request is serviced */ 58c5c4113dSnw extern int _rpcsvccount; /* number of requests being serviced */ 59c5c4113dSnw extern mutex_t _svcstate_lock; /* lock for _rpcsvcstate, _rpcsvccount */ 60c5c4113dSnw 61e8c27ec8Sbaban typedef enum idmap_namemap_mode { 62e8c27ec8Sbaban IDMAP_NM_NONE = 0, 63e8c27ec8Sbaban IDMAP_NM_AD, 64e8c27ec8Sbaban IDMAP_NM_NLDAP, 65e8c27ec8Sbaban IDMAP_NM_MIXED 66e8c27ec8Sbaban } idmap_namemap_mode_t; 67e8c27ec8Sbaban 68c5c4113dSnw /* 69c5c4113dSnw * Global state of idmapd daemon. 70c5c4113dSnw */ 71c5c4113dSnw #define IDMAP_MAX_NAME_LEN 512 72c5c4113dSnw typedef struct idmapd_state { 73c5c4113dSnw rwlock_t rwlk_cfg; /* config lock */ 74c5c4113dSnw idmap_cfg_t *cfg; /* config */ 7571590c90Snw bool_t daemon_mode; 7671590c90Snw bool_t debug_mode; 77c5c4113dSnw char hostname[MAX_NAME_LEN]; /* my hostname */ 78c5c4113dSnw uid_t next_uid; 79c5c4113dSnw gid_t next_gid; 80c5c4113dSnw uid_t limit_uid; 81c5c4113dSnw gid_t limit_gid; 82c5c4113dSnw int new_eph_db; /* was the ephem ID db [re-]created? */ 834aa0a5e7Snw bool_t eph_map_unres_sids; 844d61c878SJulian Pullen int num_ads; 854d61c878SJulian Pullen adutils_ad_t **ads; 86c5c4113dSnw } idmapd_state_t; 87c5c4113dSnw extern idmapd_state_t _idmapdstate; 88c5c4113dSnw 89c5c4113dSnw #define RDLOCK_CONFIG() \ 90c5c4113dSnw (void) rw_rdlock(&_idmapdstate.rwlk_cfg); 91c5c4113dSnw #define WRLOCK_CONFIG() \ 92c5c4113dSnw (void) rw_wrlock(&_idmapdstate.rwlk_cfg); 93c5c4113dSnw #define UNLOCK_CONFIG() \ 94c5c4113dSnw (void) rw_unlock(&_idmapdstate.rwlk_cfg); 95c5c4113dSnw 9662c60062Sbaban typedef struct hashentry { 9762c60062Sbaban uint_t key; 9862c60062Sbaban uint_t next; 9962c60062Sbaban } hashentry_t; 10062c60062Sbaban 101c5c4113dSnw typedef struct lookup_state { 102c5c4113dSnw bool_t sid2pid_done; 103c5c4113dSnw bool_t pid2sid_done; 104c5c4113dSnw int ad_nqueries; 105e8c27ec8Sbaban int nldap_nqueries; 1064aa0a5e7Snw bool_t eph_map_unres_sids; 10762c60062Sbaban uint_t curpos; 10862c60062Sbaban hashentry_t *sid_history; 10962c60062Sbaban uint_t sid_history_size; 11062c60062Sbaban idmap_mapping_batch *batch; 11162c60062Sbaban idmap_ids_res *result; 112e8c27ec8Sbaban idmap_namemap_mode_t nm_siduid; 113e8c27ec8Sbaban idmap_namemap_mode_t nm_sidgid; 114e8c27ec8Sbaban char *ad_unixuser_attr; 115e8c27ec8Sbaban char *ad_unixgroup_attr; 116479ac375Sdm char *nldap_winname_attr; 117479ac375Sdm char *defdom; 118479ac375Sdm sqlite *cache; 119479ac375Sdm sqlite *db; 120c5c4113dSnw } lookup_state_t; 121c5c4113dSnw 122e8c27ec8Sbaban #define NLDAP_OR_MIXED(nm) \ 123e8c27ec8Sbaban (nm == IDMAP_NM_NLDAP || nm == IDMAP_NM_MIXED) 124e8c27ec8Sbaban #define AD_OR_MIXED(nm) \ 125e8c27ec8Sbaban (nm == IDMAP_NM_AD || nm == IDMAP_NM_MIXED) 126e8c27ec8Sbaban 127e8c27ec8Sbaban #define NLDAP_OR_MIXED_MODE(pidtype, ls) \ 128e8c27ec8Sbaban ((pidtype == IDMAP_UID && NLDAP_OR_MIXED(ls->nm_siduid)) || \ 129e8c27ec8Sbaban (pidtype == IDMAP_GID && NLDAP_OR_MIXED(ls->nm_sidgid))) 130e8c27ec8Sbaban #define AD_OR_MIXED_MODE(pidtype, ls)\ 131e8c27ec8Sbaban ((pidtype == IDMAP_UID && AD_OR_MIXED(ls->nm_siduid)) || \ 132e8c27ec8Sbaban (pidtype == IDMAP_GID && AD_OR_MIXED(ls->nm_sidgid))) 133e8c27ec8Sbaban #define NLDAP_MODE(pidtype, ls) \ 134e8c27ec8Sbaban ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_NLDAP) || \ 135e8c27ec8Sbaban (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_NLDAP)) 136e8c27ec8Sbaban #define AD_MODE(pidtype, ls) \ 137e8c27ec8Sbaban ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_AD) || \ 138e8c27ec8Sbaban (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_AD)) 139e8c27ec8Sbaban #define MIXED_MODE(pidtype, ls) \ 140e8c27ec8Sbaban ((pidtype == IDMAP_UID && ls->nm_siduid == IDMAP_NM_MIXED) || \ 141e8c27ec8Sbaban (pidtype == IDMAP_GID && ls->nm_sidgid == IDMAP_NM_MIXED)) 142e8c27ec8Sbaban 143e8c27ec8Sbaban 144c5c4113dSnw typedef struct list_cb_data { 145c5c4113dSnw void *result; 146c5c4113dSnw uint64_t next; 147c5c4113dSnw uint64_t len; 148c5c4113dSnw uint64_t limit; 14948258c6bSjp int flag; 150c5c4113dSnw } list_cb_data_t; 151c5c4113dSnw 152c5c4113dSnw typedef struct msg_table { 153c5c4113dSnw idmap_retcode retcode; 154c5c4113dSnw const char *msg; 155c5c4113dSnw } msg_table_t; 156c5c4113dSnw 1570dcc7149Snw #define IDMAPD_SEARCH_TIMEOUT 3 /* seconds */ 1580dcc7149Snw #define IDMAPD_LDAP_OPEN_TIMEOUT 1 /* secs; initial, w/ exp backoff */ 1590dcc7149Snw 16062c60062Sbaban /* 161e8c27ec8Sbaban * The following flags are used by idmapd while processing a 162e8c27ec8Sbaban * given mapping request. Note that idmapd uses multiple passes to 163e8c27ec8Sbaban * process the request and the flags are used to pass information 164e8c27ec8Sbaban * about the state of the request between these passes. 165e8c27ec8Sbaban */ 166e8c27ec8Sbaban 167e8c27ec8Sbaban /* Initial state. Done. Reset all flags. Remaining passes can be skipped */ 168e8c27ec8Sbaban #define _IDMAP_F_DONE 0x00000000 169e8c27ec8Sbaban /* Set when subsequent passes are required */ 170e8c27ec8Sbaban #define _IDMAP_F_NOTDONE 0x00000001 171e8c27ec8Sbaban /* Don't update name_cache. (e.g. set when winname,SID found in name_cache) */ 172e8c27ec8Sbaban #define _IDMAP_F_DONT_UPDATE_NAMECACHE 0x00000002 173e8c27ec8Sbaban /* Batch this request for AD lookup */ 174e8c27ec8Sbaban #define _IDMAP_F_LOOKUP_AD 0x00000004 175e8c27ec8Sbaban /* Batch this request for nldap directory lookup */ 176e8c27ec8Sbaban #define _IDMAP_F_LOOKUP_NLDAP 0x00000008 177e8c27ec8Sbaban /* 178e8c27ec8Sbaban * Expired ephemeral mapping found in cache when processing sid2uid request. 179e8c27ec8Sbaban * Use it if the given SID cannot be mapped by name 180e8c27ec8Sbaban */ 181e8c27ec8Sbaban #define _IDMAP_F_EXP_EPH_UID 0x00000010 182e8c27ec8Sbaban /* Same as above. Used for sid2gid request */ 183e8c27ec8Sbaban #define _IDMAP_F_EXP_EPH_GID 0x00000020 1844d61c878SJulian Pullen /* This request is not valid for the current forest */ 1854d61c878SJulian Pullen #define _IDMAP_F_LOOKUP_OTHER_AD 0x00000040 1864d61c878SJulian Pullen 187e8c27ec8Sbaban 188e8c27ec8Sbaban /* 189e8c27ec8Sbaban * Check if we are done. If so, subsequent passes can be skipped 190e8c27ec8Sbaban * when processing a given mapping request. 19162c60062Sbaban */ 192e8c27ec8Sbaban #define ARE_WE_DONE(f) ((f & _IDMAP_F_NOTDONE) == 0) 193c5c4113dSnw 194c5c4113dSnw #define SIZE_INCR 5 195c5c4113dSnw #define MAX_TRIES 5 196c5c4113dSnw #define IDMAP_DBDIR "/var/idmap" 197c5c4113dSnw #define IDMAP_CACHEDIR "/var/run/idmap" 198c5c4113dSnw #define IDMAP_DBNAME IDMAP_DBDIR "/idmap.db" 199c5c4113dSnw #define IDMAP_CACHENAME IDMAP_CACHEDIR "/idmap.db" 2008e228215Sdm 201cd37da74Snw #define IS_BATCH_SID(batch, i) \ 202cd37da74Snw (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_SID || \ 203cd37da74Snw batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_USID || \ 204cd37da74Snw batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GSID) 205cd37da74Snw 206cd37da74Snw #define IS_BATCH_UID(batch, i) \ 2070dcc7149Snw (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_UID) 208cd37da74Snw 209cd37da74Snw #define IS_BATCH_GID(batch, i) \ 2100dcc7149Snw (batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GID) 211cd37da74Snw 212cd37da74Snw #define IS_REQUEST_SID(req, n) \ 213cd37da74Snw ((req).id##n.idtype == IDMAP_SID || \ 214cd37da74Snw (req).id##n.idtype == IDMAP_USID || \ 215cd37da74Snw (req).id##n.idtype == IDMAP_GSID) \ 216cd37da74Snw 217cd37da74Snw 218cd37da74Snw #define IS_REQUEST_UID(request) \ 2190dcc7149Snw ((request).id1.idtype == IDMAP_UID) 220cd37da74Snw 221cd37da74Snw #define IS_REQUEST_GID(request) \ 2220dcc7149Snw ((request).id1.idtype == IDMAP_GID) 223cd37da74Snw 224c5c4113dSnw typedef idmap_retcode (*update_list_res_cb)(void *, const char **, uint64_t); 225c5c4113dSnw typedef int (*list_svc_cb)(void *, int, char **, char **); 226c5c4113dSnw 227c5c4113dSnw extern void idmap_prog_1(struct svc_req *, register SVCXPRT *); 228c5c4113dSnw extern void idmapdlog(int, const char *, ...); 229c5c4113dSnw extern int init_mapping_system(); 230c5c4113dSnw extern void fini_mapping_system(); 231c5c4113dSnw extern void print_idmapdstate(); 232c5c4113dSnw extern int create_directory(const char *, uid_t, gid_t); 233c5c4113dSnw extern int load_config(); 234349d5d8fSnw extern void reload_ad(); 23584decf41Sjp extern int idmap_init_tsd_key(void); 236349d5d8fSnw extern void degrade_svc(int, const char *); 237c8e26105Sjp extern void restore_svc(void); 238c5c4113dSnw 239c5c4113dSnw 240c5c4113dSnw extern int init_dbs(); 241c5c4113dSnw extern void fini_dbs(); 242c5c4113dSnw extern idmap_retcode get_db_handle(sqlite **); 243c5c4113dSnw extern idmap_retcode get_cache_handle(sqlite **); 24471590c90Snw extern idmap_retcode sql_exec_no_cb(sqlite *, const char *, char *); 245c5c4113dSnw extern idmap_retcode add_namerule(sqlite *, idmap_namerule *); 246c5c4113dSnw extern idmap_retcode rm_namerule(sqlite *, idmap_namerule *); 247cd37da74Snw extern idmap_retcode flush_namerules(sqlite *); 248cd37da74Snw 249cd37da74Snw extern char *tolower_u8(const char *); 250c5c4113dSnw 251cd37da74Snw extern idmap_retcode gen_sql_expr_from_rule(idmap_namerule *, char **); 252c5c4113dSnw extern idmap_retcode validate_list_cb_data(list_cb_data_t *, int, 253c5c4113dSnw char **, int, uchar_t **, size_t); 25471590c90Snw extern idmap_retcode process_list_svc_sql(sqlite *, const char *, char *, 25548258c6bSjp uint64_t, int, list_svc_cb, void *); 256479ac375Sdm extern idmap_retcode sid2pid_first_pass(lookup_state_t *, 257479ac375Sdm idmap_mapping *, idmap_id_res *); 258479ac375Sdm extern idmap_retcode sid2pid_second_pass(lookup_state_t *, 259c5c4113dSnw idmap_mapping *, idmap_id_res *); 260479ac375Sdm extern idmap_retcode pid2sid_first_pass(lookup_state_t *, 261e8c27ec8Sbaban idmap_mapping *, idmap_id_res *, int, int); 262479ac375Sdm extern idmap_retcode pid2sid_second_pass(lookup_state_t *, 263479ac375Sdm idmap_mapping *, idmap_id_res *, int); 264479ac375Sdm extern idmap_retcode update_cache_sid2pid(lookup_state_t *, 265c5c4113dSnw idmap_mapping *, idmap_id_res *); 266479ac375Sdm extern idmap_retcode update_cache_pid2sid(lookup_state_t *, 267c5c4113dSnw idmap_mapping *, idmap_id_res *); 268c5c4113dSnw extern idmap_retcode get_u2w_mapping(sqlite *, sqlite *, idmap_mapping *, 269c5c4113dSnw idmap_mapping *, int); 270c5c4113dSnw extern idmap_retcode get_w2u_mapping(sqlite *, sqlite *, idmap_mapping *, 271c5c4113dSnw idmap_mapping *); 272479ac375Sdm extern idmap_retcode load_cfg_in_state(lookup_state_t *); 273e8c27ec8Sbaban extern void cleanup_lookup_state(lookup_state_t *); 274c5c4113dSnw 275e8c27ec8Sbaban extern idmap_retcode ad_lookup_batch(lookup_state_t *, 276c5c4113dSnw idmap_mapping_batch *, idmap_ids_res *); 277479ac375Sdm extern idmap_retcode lookup_name2sid(sqlite *, const char *, const char *, 27808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int *, char **, char **, char **, 27908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *, idmap_mapping *, int); 28008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States extern idmap_retcode lookup_wksids_name2sid(const char *, const char *, 28108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **, char **, char **, idmap_rid_t *, 28208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int *); 283c5c4113dSnw 2847a8a68f5SJulian Pullen 2857a8a68f5SJulian Pullen extern void idmap_log_stderr(int); 2867a8a68f5SJulian Pullen extern void idmap_log_syslog(boolean_t); 2877a8a68f5SJulian Pullen extern void idmap_log_degraded(boolean_t); 2887a8a68f5SJulian Pullen 289c5c4113dSnw #ifdef __cplusplus 290c5c4113dSnw } 291c5c4113dSnw #endif 292c5c4113dSnw 293c5c4113dSnw #endif /* _IDMAPD_H */ 294