xref: /illumos-gate/usr/src/cmd/idmap/idmapd/idmapd.h (revision b3700b07)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
24  */
25 
26 #ifndef _IDMAPD_H
27 #define	_IDMAPD_H
28 
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <stdarg.h>
32 #include <rpc/rpc.h>
33 #include <synch.h>
34 #include <thread.h>
35 #include <libintl.h>
36 #include <strings.h>
37 #include <sqlite-sys/sqlite.h>
38 #include <syslog.h>
39 #include <inttypes.h>
40 #include <rpcsvc/idmap_prot.h>
41 #include "adutils.h"
42 #include "idmap_priv.h"
43 #include "idmap_config.h"
44 #include "libadutils.h"
45 
46 #ifdef __cplusplus
47 extern "C" {
48 #endif
49 
50 #define	CHECK_NULL(s)	(s != NULL ? s : "null")
51 
52 extern mutex_t _svcstate_lock;	/* lock for _rpcsvcstate, _rpcsvccount */
53 
54 typedef enum idmap_namemap_mode {
55 	IDMAP_NM_NONE = 0,
56 	IDMAP_NM_AD,
57 	IDMAP_NM_NLDAP,
58 	IDMAP_NM_MIXED
59 } idmap_namemap_mode_t;
60 
61 /*
62  * Debugging output.
63  *
64  * There are some number of areas - configuration, mapping, discovery, et
65  * cetera - and for each area there is a verbosity level controlled through
66  * an SMF property.  The default is zero, and "debug/all" provides a master
67  * control allowing you to turn on all debugging output with one setting.
68  *
69  * A typical debugging output sequence would look like
70  *
71  * 	if (DBG(CONFIG, 2)) {
72  *		idmapdlog(LOG_DEBUG,
73  *		    "some message about config at verbosity 2");
74  *	}
75  */
76 enum idmapd_debug {
77 	IDMAPD_DEBUG_ALL = 0,
78 	IDMAPD_DEBUG_CONFIG = 1,
79 	IDMAPD_DEBUG_MAPPING = 2,
80 	IDMAPD_DEBUG_DISC = 3,
81 	IDMAPD_DEBUG_DNS = 4,
82 	IDMAPD_DEBUG_LDAP = 5,
83 	IDMAPD_DEBUG_MAX = 5
84 };
85 
86 #define	DBG(type, lev)	\
87 	(_idmapdstate.debug[IDMAPD_DEBUG_##type] >= (lev) || \
88 	    _idmapdstate.debug[IDMAPD_DEBUG_ALL] >= (lev))
89 
90 /*
91  * Global state of idmapd daemon.
92  */
93 typedef struct idmapd_state {
94 	rwlock_t	rwlk_cfg;		/* config lock */
95 	idmap_cfg_t	*cfg;			/* config */
96 	bool_t		daemon_mode;
97 	char		hostname[MAX_NAME_LEN];	/* my hostname */
98 	uid_t		next_uid;
99 	gid_t		next_gid;
100 	uid_t		limit_uid;
101 	gid_t		limit_gid;
102 	int		new_eph_db;	/* was the ephem ID db [re-]created? */
103 	int		num_gcs;
104 	adutils_ad_t	**gcs;
105 	int		num_dcs;
106 	adutils_ad_t	**dcs;
107 	mutex_t		addisc_lk;
108 	cond_t		addisc_cv;
109 	int		addisc_st;
110 	int		debug[IDMAPD_DEBUG_MAX+1];
111 } idmapd_state_t;
112 extern idmapd_state_t	_idmapdstate;
113 
114 #define	ADDISC_ST_REQUESTED	1
115 #define	ADDISC_ST_RUNNING	2
116 
117 #define	RDLOCK_CONFIG() \
118 	(void) rw_rdlock(&_idmapdstate.rwlk_cfg);
119 #define	WRLOCK_CONFIG() \
120 	(void) rw_wrlock(&_idmapdstate.rwlk_cfg);
121 #define	UNLOCK_CONFIG() \
122 	(void) rw_unlock(&_idmapdstate.rwlk_cfg);
123 
124 typedef struct hashentry {
125 	uint_t	key;
126 	uint_t	next;
127 } hashentry_t;
128 
129 typedef struct lookup_state {
130 	bool_t			sid2pid_done;
131 	bool_t			pid2sid_done;
132 	int			ad_nqueries;
133 	int			nldap_nqueries;
134 	bool_t			eph_map_unres_sids;
135 	int			directory_based_mapping;	/* enum */
136 	uint_t			id_cache_timeout;
137 	uint_t			name_cache_timeout;
138 	uint_t			curpos;
139 	hashentry_t		*sid_history;
140 	uint_t			sid_history_size;
141 	idmap_mapping_batch	*batch;
142 	idmap_ids_res		*result;
143 	idmap_namemap_mode_t	nm_siduid;
144 	idmap_namemap_mode_t	nm_sidgid;
145 	char			*ad_unixuser_attr;
146 	char			*ad_unixgroup_attr;
147 	char			*nldap_winname_attr;
148 	char			*defdom;
149 	sqlite			*cache;
150 	sqlite			*db;
151 } lookup_state_t;
152 
153 #define	NLDAP_OR_MIXED(nm) \
154 	((nm) == IDMAP_NM_NLDAP || (nm) == IDMAP_NM_MIXED)
155 #define	AD_OR_MIXED(nm) \
156 	((nm) == IDMAP_NM_AD || (nm) == IDMAP_NM_MIXED)
157 
158 #define	PID_UID_OR_UNKNOWN(pidtype) \
159 	((pidtype) == IDMAP_UID || (pidtype) == IDMAP_POSIXID)
160 #define	PID_GID_OR_UNKNOWN(pidtype) \
161 	((pidtype) == IDMAP_GID || (pidtype) == IDMAP_POSIXID)
162 
163 #define	NLDAP_OR_MIXED_MODE(pidtype, ls) \
164 	(NLDAP_MODE(pidtype, ls) || MIXED_MODE(pidtype, ls))
165 #define	AD_OR_MIXED_MODE(pidtype, ls)\
166 	(AD_MODE(pidtype, ls) || MIXED_MODE(pidtype, ls))
167 #define	NLDAP_MODE(pidtype, ls) \
168 	((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_NLDAP) || \
169 	(PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_NLDAP))
170 #define	AD_MODE(pidtype, ls) \
171 	((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_AD) || \
172 	(PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_AD))
173 #define	MIXED_MODE(pidtype, ls) \
174 	((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_MIXED) || \
175 	(PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_MIXED))
176 
177 
178 typedef struct list_cb_data {
179 	void		*result;
180 	uint64_t	next;
181 	uint64_t	len;
182 	uint64_t	limit;
183 	int		flag;
184 } list_cb_data_t;
185 
186 typedef struct msg_table {
187 	idmap_retcode	retcode;
188 	const char	*msg;
189 } msg_table_t;
190 
191 /*
192  * Data structure to store well-known SIDs and
193  * associated mappings (if any)
194  */
195 typedef struct wksids_table {
196 	const char	*sidprefix;
197 	uint32_t	rid;
198 	const char	*domain;
199 	const char	*winname;
200 	int		is_wuser;
201 	posix_id_t	pid;
202 	int		is_user;
203 	int		direction;
204 } wksids_table_t;
205 
206 #define	IDMAPD_SEARCH_TIMEOUT		3   /* seconds */
207 #define	IDMAPD_LDAP_OPEN_TIMEOUT	1   /* secs; initial, w/ exp backoff */
208 
209 /*
210  * The following flags are used by idmapd while processing a
211  * given mapping request. Note that idmapd uses multiple passes to
212  * process the request and the flags are used to pass information
213  * about the state of the request between these passes.
214  */
215 
216 /* Initial state. Done. Reset all flags. Remaining passes can be skipped */
217 #define	_IDMAP_F_DONE			0x00000000
218 /* Set when subsequent passes are required */
219 #define	_IDMAP_F_NOTDONE		0x00000001
220 /* Don't update name_cache. (e.g. set when winname,SID found in name_cache) */
221 #define	_IDMAP_F_DONT_UPDATE_NAMECACHE	0x00000002
222 /* Batch this request for AD lookup */
223 #define	_IDMAP_F_LOOKUP_AD		0x00000004
224 /* Batch this request for nldap directory lookup */
225 #define	_IDMAP_F_LOOKUP_NLDAP		0x00000008
226 /*
227  * Expired ephemeral mapping found in cache when processing sid2uid request.
228  * Use it if the given SID cannot be mapped by name
229  */
230 #define	_IDMAP_F_EXP_EPH_UID		0x00000010
231 /* Same as above. Used for sid2gid request */
232 #define	_IDMAP_F_EXP_EPH_GID		0x00000020
233 /* This request is not valid for the current forest */
234 #define	_IDMAP_F_LOOKUP_OTHER_AD	0x00000040
235 
236 
237 /*
238  * Check if we are done. If so, subsequent passes can be skipped
239  * when processing a given mapping request.
240  */
241 #define	ARE_WE_DONE(f)	((f & _IDMAP_F_NOTDONE) == 0)
242 
243 #define	SIZE_INCR	5
244 #define	MAX_TRIES	5
245 #define	IDMAP_DBDIR	"/var/idmap"
246 #define	IDMAP_CACHEDIR	"/var/run/idmap"
247 #define	IDMAP_DBNAME	IDMAP_DBDIR "/idmap.db"
248 #define	IDMAP_CACHENAME	IDMAP_CACHEDIR "/idmap.db"
249 
250 #define	IS_ID_NONE(id)	\
251 	((id).idtype == IDMAP_NONE)
252 
253 #define	IS_ID_SID(id)	\
254 	((id).idtype == IDMAP_SID ||	\
255 	(id).idtype == IDMAP_USID ||	\
256 	(id).idtype == IDMAP_GSID)	\
257 
258 #define	IS_ID_UID(id)	\
259 	((id).idtype == IDMAP_UID)
260 
261 #define	IS_ID_GID(id)	\
262 	((id).idtype == IDMAP_GID)
263 
264 #define	IS_ID_POSIX(id)	\
265 	((id).idtype == IDMAP_UID ||	\
266 	(id).idtype == IDMAP_GID ||	\
267 	(id).idtype == IDMAP_POSIXID)	\
268 
269 /*
270  * Local RID ranges
271  */
272 #define	LOCALRID_UID_MIN	1000U
273 #define	LOCALRID_UID_MAX	((uint32_t)INT32_MAX)
274 #define	LOCALRID_GID_MIN	(((uint32_t)INT32_MAX) + 1)
275 #define	LOCALRID_GID_MAX	UINT32_MAX
276 
277 /*
278  * Tracing.
279  *
280  * The tracing mechanism is intended to help the administrator understand
281  * why their mapping configuration is doing what it is.  Each interesting
282  * decision point during the mapping process calls TRACE() with the current
283  * request and response and a printf-style message.  The message, plus
284  * data from the request and the response, is logged to the service log
285  * (if debug/mapping is greater than zero) or reported to the caller
286  * (if IDMAP_REQ_FLG_TRACE was set in the request.  The primary consumer
287  * is the "-V" option to "idmap show".
288  *
289  * TRACING(req) says whether tracing is appropriate for the request, and
290  * is used to determine and record whether any request in a batch requested
291  * tracing, to control whether later code loops over the batch to do tracing
292  * for any of the requests.
293  *
294  * TRACE(req, res, fmt, ...) generates a trace entry if appropriate.
295  */
296 #define	TRACING(req)	\
297 	(DBG(MAPPING, 1) ||	\
298 	((req)->flag & IDMAP_REQ_FLG_TRACE) != 0)
299 #define	TRACE(req, res, ...)			\
300 	((void)(TRACING(req) && trace(req, res, __VA_ARGS__)))
301 extern int	trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...);
302 
303 typedef idmap_retcode (*update_list_res_cb)(void *, const char **, uint64_t);
304 typedef int (*list_svc_cb)(void *, int, char **, char **);
305 
306 extern void	idmap_prog_1(struct svc_req *, register SVCXPRT *);
307 extern void	idmapdlog(int, const char *, ...);
308 extern int	init_mapping_system();
309 extern void	fini_mapping_system();
310 extern void	print_idmapdstate();
311 extern int	create_directory(const char *, uid_t, gid_t);
312 extern int	load_config();
313 extern void	reload_ad();
314 extern void	idmap_init_tsd_key(void);
315 extern void	degrade_svc(int, const char *);
316 extern void	restore_svc(void);
317 extern void	notify_dc_changed(void);
318 
319 
320 extern int		init_dbs();
321 extern void		fini_dbs();
322 extern idmap_retcode	get_db_handle(sqlite **);
323 extern idmap_retcode	get_cache_handle(sqlite **);
324 extern idmap_retcode	sql_exec_no_cb(sqlite *, const char *, char *);
325 extern idmap_retcode	add_namerule(sqlite *, idmap_namerule *);
326 extern idmap_retcode	rm_namerule(sqlite *, idmap_namerule *);
327 extern idmap_retcode	flush_namerules(sqlite *);
328 
329 extern char 		*tolower_u8(const char *);
330 
331 extern idmap_retcode	gen_sql_expr_from_rule(idmap_namerule *, char **);
332 extern idmap_retcode	validate_list_cb_data(list_cb_data_t *, int,
333 				char **, int, uchar_t **, size_t);
334 extern idmap_retcode	process_list_svc_sql(sqlite *, const char *, char *,
335 				uint64_t, int, list_svc_cb, void *);
336 extern idmap_retcode	sid2pid_first_pass(lookup_state_t *,
337 				idmap_mapping *, idmap_id_res *);
338 extern idmap_retcode	sid2pid_second_pass(lookup_state_t *,
339 				idmap_mapping *, idmap_id_res *);
340 extern idmap_retcode	pid2sid_first_pass(lookup_state_t *,
341 				idmap_mapping *, idmap_id_res *, int);
342 extern idmap_retcode	pid2sid_second_pass(lookup_state_t *,
343 				idmap_mapping *, idmap_id_res *, int);
344 extern idmap_retcode	update_cache_sid2pid(lookup_state_t *,
345 				idmap_mapping *, idmap_id_res *);
346 extern idmap_retcode	update_cache_pid2sid(lookup_state_t *,
347 				idmap_mapping *, idmap_id_res *);
348 extern idmap_retcode	get_u2w_mapping(sqlite *, sqlite *, idmap_mapping *,
349 				idmap_mapping *, int);
350 extern idmap_retcode	get_w2u_mapping(sqlite *, sqlite *, idmap_mapping *,
351 				idmap_mapping *);
352 extern idmap_retcode	load_cfg_in_state(lookup_state_t *);
353 extern void		cleanup_lookup_state(lookup_state_t *);
354 
355 extern idmap_retcode	ad_lookup_batch(lookup_state_t *,
356 				idmap_mapping_batch *, idmap_ids_res *);
357 extern idmap_retcode	lookup_name2sid(sqlite *, const char *, const char *,
358 				int, char **, char **, char **,
359 				idmap_rid_t *, idmap_id_type *,
360 				idmap_mapping *, int);
361 extern idmap_retcode	lookup_wksids_name2sid(const char *, const char *,
362 				char **, char **, char **, idmap_rid_t *,
363 				idmap_id_type *);
364 extern idmap_retcode	idmap_cache_flush(idmap_flush_op);
365 
366 extern const wksids_table_t *find_wksid_by_pid(posix_id_t pid, int is_user);
367 extern const wksids_table_t *find_wksid_by_sid(const char *sid, int rid,
368     idmap_id_type type);
369 extern const wksids_table_t *find_wksid_by_name(const char *name,
370     const char *domain, idmap_id_type type);
371 extern const wksids_table_t *find_wk_by_sid(char *sid);
372 
373 #ifdef __cplusplus
374 }
375 #endif
376 
377 #endif /* _IDMAPD_H */
378