xref: /illumos-gate/usr/src/lib/nsswitch/ldap/common/ldap_common.c (revision 6a9f1673)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
 */

#include "ldap_common.h"
#include <malloc.h>
#include <synch.h>
#include <syslog.h>
#include <rpcsvc/ypclnt.h>
#include <rpcsvc/yp_prot.h>
#include <thread.h>
#include <ctype.h>
#include <stdlib.h>
#include <signal.h>
#include <sys/stat.h>

/* getent attributes filters */
#define	_F_GETALIASENT		"(objectClass=rfc822MailGroup)"
#define	_F_GETAUTHNAME		"(objectClass=SolarisAuthAttr)"
#define	_F_GETAUUSERNAME	"(objectClass=SolarisAuditUser)"
#define	_F_GETEXECNAME		"(objectClass=SolarisExecAttr)"
#define	_F_GETGRENT		"(objectClass=posixGroup)"
#define	_F_GETHOSTENT		"(objectClass=ipHost)"
#define	_F_GETNETENT		"(objectClass=ipNetwork)"
#define	_F_GETPROFNAME \
"(&(objectClass=SolarisProfAttr)(!(SolarisKernelSecurityPolicy=*)))"
#define	_F_GETPROTOENT		"(objectClass=ipProtocol)"
#define	_F_GETPWENT		"(objectClass=posixAccount)"
#define	_F_GETPRINTERENT	"(objectClass=sunPrinter)"
#define	_F_GETRPCENT		"(objectClass=oncRpc)"
#define	_F_GETSERVENT		"(objectClass=ipService)"
#define	_F_GETSPENT		"(objectclass=shadowAccount)"
#define	_F_GETUSERNAME		"(objectClass=SolarisUserAttr)"
#define	_F_GETPROJENT		"(objectClass=SolarisProject)"
#define	_F_GETTNRHDB		"(objectClass=ipTnetHost)"
#define	_F_GETTNRHTP		"(&(objectClass=ipTnetTemplate)"\
				"(SolarisAttrKeyValue=*))"
#define	_F_GETENT_SSD		"(%s)"

/* getent sort attributes */
#define	_A_UID			"uid"
#define	_A_GIDNUMBER		"gidnumber"
#define	_A_CN			"cn"
#define	_A_IPNETWORKNUM		"ipnetworknumber"
#define	_A_PROJECTNAM		"SolarisProjectName"
#define	_A_IPTNETNUM		"ipTnetNumber"
#define	_A_IPTNETTMPLNAM	"ipTnetTemplateName"

static struct gettablefilter {
	char *tablename;
	char *tablefilter;
	char *sortattr;
} gettablefilterent[] = {
	{(char *)_PASSWD,	(char *)_F_GETPWENT,	(char *)_A_UID},
	{(char *)_SHADOW,	(char *)_F_GETSPENT,	(char *)_A_UID},
	{(char *)_GROUP,	(char *)_F_GETGRENT,	(char *)_A_GIDNUMBER},
	{(char *)_HOSTS,	(char *)_F_GETHOSTENT,	(char *)_A_CN},
	{(char *)_NETWORKS,	(char *)_F_GETNETENT,
						(char *)_A_IPNETWORKNUM},
	{(char *)_PROTOCOLS,	(char *)_F_GETPROTOENT,	(char *)_A_CN},
	{(char *)_RPC,		(char *)_F_GETRPCENT,	(char *)_A_CN},
	{(char *)_ALIASES,	(char *)_F_GETALIASENT,	(char *)_A_CN},
	{(char *)_SERVICES,	(char *)_F_GETSERVENT,	(char *)_A_CN},
	{(char *)_AUUSER,	(char *)_F_GETAUUSERNAME,
							(char *)_A_UID},
	{(char *)_AUTHATTR,	(char *)_F_GETAUTHNAME,	(char *)_A_CN},
	{(char *)_EXECATTR,	(char *)_F_GETEXECNAME,	(char *)_A_CN},
	{(char *)_PROFATTR,	(char *)_F_GETPROFNAME,	(char *)_A_CN},
	{(char *)_USERATTR,	(char *)_F_GETUSERNAME,	(char *)_A_UID},
	{(char *)_PROJECT,	(char *)_F_GETPROJENT,	(char *)_A_PROJECTNAM},
	{(char *)_PRINTERS,	(char *)_F_GETPRINTERENT, (char *)_A_CN},
	{(char *)_TNRHDB,	(char *)_F_GETTNRHDB,	(char *)_A_IPTNETNUM},
	{(char *)_TNRHTP,	(char *)_F_GETTNRHTP,
						(char *)_A_IPTNETTMPLNAM},
	{(char *)NULL,		(char *)NULL,		(char *)NULL}
};


nss_status_t
switch_err(int rc, ns_ldap_error_t *error)
{
	switch (rc) {
	case NS_LDAP_SUCCESS:
		return (NSS_SUCCESS);

	case NS_LDAP_NOTFOUND:
		errno = 0;
		return (NSS_NOTFOUND);

	case NS_LDAP_PARTIAL:
		return (NSS_TRYAGAIN);

	case NS_LDAP_INTERNAL:
		if (error && (error->status == LDAP_SERVER_DOWN ||
		    error->status == LDAP_TIMEOUT))
			return (NSS_TRYAGAIN);
		else
			return (NSS_UNAVAIL);

	default:
		return (NSS_UNAVAIL);
	}
}
/* ARGSUSED */
nss_status_t
_nss_ldap_lookup(ldap_backend_ptr be, nss_XbyY_args_t *argp,
    char *database, char *searchfilter, char *domain,
    int (*init_filter_cb)(const ns_ldap_search_desc_t *desc,
    char **realfilter, const void *userdata),
    const void *userdata)
{
	int		callbackstat = 0;
	ns_ldap_error_t	*error = NULL;
	int		rc;

#ifdef	DEBUG
	(void) fprintf(stdout, "\n[ldap_common.c: _nss_ldap_lookup]\n");
	(void) fprintf(stdout, "\tsearchfilter: %s\n", searchfilter);
	(void) fprintf(stdout,
	    "\tuserdata: %s\n", userdata ? userdata : "NULL");
	(void) fprintf(stdout, "\tdatabase: %s\n", database);
#endif	/* DEBUG */

	(void) __ns_ldap_freeResult(&be->result);

	if ((rc = __ns_ldap_list(database, searchfilter, init_filter_cb,
	    be->attrs, NULL, 0, &be->result, &error, NULL,
	    userdata)) != NS_LDAP_SUCCESS) {
		argp->returnval = 0;
		rc = switch_err(rc, error);
		(void) __ns_ldap_freeError(&error);

		return (rc);
	}
		(void) __ns_ldap_freeError(&error);
	/* callback function */
	if ((callbackstat =
	    be->ldapobj2str(be, argp)) != NSS_STR_PARSE_SUCCESS) {
		goto error_out;
	}

	/*
	 * publickey does not have a front end marshaller and expects
	 * a string to be returned in NSS.
	 * No need to convert file format -> struct.
	 *
	 */
	if (be->db_type == NSS_LDAP_DB_PUBLICKEY) {
		argp->returnval = argp->buf.buffer;
		argp->returnlen = strlen(argp->buf.buffer);
		be->db_type = NSS_LDAP_DB_NONE;
		return (NSS_SUCCESS);
	}
	/*
	 *  Assume the switch engine wants the returned data in the file
	 *  format when argp->buf.result == NULL.
	 *  The front-end marshaller str2ether(ethers) uses
	 *  ent (argp->buf.result) and buffer (argp->buf.buffer)
	 *  for different purpose so ethers has to be treated differently.
	 */
	if (argp->buf.result != NULL ||
	    be->db_type == NSS_LDAP_DB_ETHERS) {
		/* file format -> struct */
		if (argp->str2ent == NULL) {
			callbackstat = NSS_STR_PARSE_PARSE;
			goto error_out;
		}

		callbackstat = (*argp->str2ent)(be->buffer,
		    be->buflen,
		    argp->buf.result,
		    argp->buf.buffer,
		    argp->buf.buflen);
		if (callbackstat == NSS_STR_PARSE_SUCCESS) {
			if (be->db_type == NSS_LDAP_DB_ETHERS &&
			    argp->buf.buffer != NULL) {
				argp->returnval = argp->buf.buffer;
				argp->returnlen = strlen(argp->buf.buffer);
			} else {
				argp->returnval = argp->buf.result;
				argp->returnlen = 1; /* irrelevant */
			}
			if (be->buffer != NULL) {
				free(be->buffer);
				be->buffer = NULL;
				be->buflen = 0;
				be->db_type = NSS_LDAP_DB_NONE;
			}
			return ((nss_status_t)NSS_SUCCESS);
		}
	} else {
			/* return file format in argp->buf.buffer */
			argp->returnval = argp->buf.buffer;
			argp->returnlen = strlen(argp->buf.buffer);
			return ((nss_status_t)NSS_SUCCESS);
	}

error_out:
	if (be->buffer != NULL) {
		free(be->buffer);
		be->buffer = NULL;
		be->buflen = 0;
		be->db_type = NSS_LDAP_DB_NONE;
	}
	/* error */
	if (callbackstat == NSS_STR_PARSE_PARSE) {
		argp->returnval = 0;
		return ((nss_status_t)NSS_NOTFOUND);
	}
	if (callbackstat == NSS_STR_PARSE_ERANGE) {
		argp->erange = 1;
		return ((nss_status_t)NSS_NOTFOUND);
	}
	if (callbackstat == NSS_STR_PARSE_NO_ADDR) {
		/* No IPV4 address is found */
		argp->h_errno = HOST_NOT_FOUND;
		return ((nss_status_t)NSS_NOTFOUND);
	}
	return ((nss_status_t)NSS_UNAVAIL);
}

/*
 *  This function is similar to _nss_ldap_lookup except it does not
 *  do a callback.  It is only used by getnetgrent.c
 */

/* ARGSUSED */
nss_status_t
_nss_ldap_nocb_lookup(ldap_backend_ptr be, nss_XbyY_args_t *argp,
    char *database, char *searchfilter, const char * const *attrs,
    int (*init_filter_cb)(const ns_ldap_search_desc_t *desc,
    char **realfilter, const void *userdata),
    const void *userdata)
{
	ns_ldap_error_t	*error = NULL;
	int		rc;

	if (attrs == NULL)
		attrs = be->attrs;

#ifdef	DEBUG
	(void) fprintf(stdout, "\n[ldap_common.c: _nss_ldap_nocb_lookup]\n");
	(void) fprintf(stdout, "\tsearchfilter: %s\n", searchfilter);
	(void) fprintf(stdout, "\tdatabase: %s\n", database);
	(void) fprintf(stdout,
	    "\tuserdata: %s\n", userdata ? userdata : "NULL");
#endif	/* DEBUG */

	(void) __ns_ldap_freeResult(&be->result);

	if ((rc = __ns_ldap_list(database, searchfilter, init_filter_cb,
	    attrs, NULL, 0, &be->result, &error, NULL,
	    userdata)) != NS_LDAP_SUCCESS) {
		if (argp != NULL)
			argp->returnval = 0;
		rc = switch_err(rc, error);
		(void) __ns_ldap_freeError(&error);
		return (rc);
	}

	return ((nss_status_t)NSS_SUCCESS);
}


/*
 *
 */

void
_clean_ldap_backend(ldap_backend_ptr be)
{
	ns_ldap_error_t *error;

#ifdef	DEBUG
	(void) fprintf(stdout, "\n[ldap_common.c: _clean_ldap_backend]\n");
#endif	/* DEBUG */

	if (be->tablename != NULL)
		free(be->tablename);
	if (be->result != NULL)
		(void) __ns_ldap_freeResult(&be->result);
	if (be->enumcookie != NULL)
		(void) __ns_ldap_endEntry(&be->enumcookie, &error);
	if (be->services_cookie != NULL)
		_nss_services_cookie_free((void **)&be->services_cookie);
	if (be->toglue != NULL) {
		free(be->toglue);
		be->toglue = NULL;
	}
	if (be->buffer != NULL) {
		free(be->buffer);
		be->buffer = NULL;
	}
	free(be);
}


/*
 * _nss_ldap_destr will free all smalloc'ed variable strings and structures
 * before exiting this nsswitch shared backend library. This function is
 * called before returning control back to nsswitch.
 */

/*ARGSUSED1*/
nss_status_t
_nss_ldap_destr(ldap_backend_ptr be, void *a)
{

#ifdef DEBUG
	(void) fprintf(stdout, "\n[ldap_common.c: _nss_ldap_destr]\n");
#endif /* DEBUG */

	(void) _clean_ldap_backend(be);

	return ((nss_status_t)NSS_SUCCESS);
}


/*
 * _nss_ldap_setent called before _nss_ldap_getent. This function is
 * required by POSIX.
 */

nss_status_t
_nss_ldap_setent(ldap_backend_ptr be, void *a)
{
	struct gettablefilter	*gtf;

#ifdef DEBUG
	(void) fprintf(stdout, "\n[ldap_common.c: _nss_ldap_setent]\n");
#endif /* DEBUG */

	if (be->setcalled == 1)
		(void) _nss_ldap_endent(be, a);
	be->filter = NULL;
	be->sortattr = NULL;
	for (gtf = gettablefilterent; gtf->tablename != (char *)NULL; gtf++) {
		if (strcmp(gtf->tablename, be->tablename))
			continue;
		be->filter = (char *)gtf->tablefilter;
		be->sortattr = (char *)gtf->sortattr;
		break;
	}

	be->setcalled = 1;
	be->enumcookie = NULL;
	be->result = NULL;
	be->services_cookie = NULL;
	be->buffer = NULL;
	return ((nss_status_t)NSS_SUCCESS);
}


/*
 * _nss_ldap_endent called after _nss_ldap_getent. This function is
 * required by POSIX.
 */

/*ARGSUSED1*/
nss_status_t
_nss_ldap_endent(ldap_backend_ptr be, void *a)
{
	ns_ldap_error_t	*error = NULL;

#ifdef DEBUG
	(void) fprintf(stdout, "\n[ldap_common.c: _nss_ldap_endent]\n");
#endif /* DEBUG */

	be->setcalled = 0;
	be->filter = NULL;
	be->sortattr = NULL;
	if (be->enumcookie != NULL) {
		(void) __ns_ldap_endEntry(&be->enumcookie, &error);
		(void) __ns_ldap_freeError(&error);
	}
	if (be->result != NULL) {
		(void) __ns_ldap_freeResult(&be->result);
	}
	if (be->services_cookie != NULL) {
		_nss_services_cookie_free((void **)&be->services_cookie);
	}
	if (be->buffer != NULL) {
		free(be->buffer);
		be->buffer = NULL;
	}

	return ((nss_status_t)NSS_SUCCESS);
}


/*
 *
 */

nss_status_t
_nss_ldap_getent(ldap_backend_ptr be, void *a)
{
	nss_XbyY_args_t	*argp = (nss_XbyY_args_t *)a;
	ns_ldap_error_t	*error = NULL;
	int		parsestat = 0;
	int		retcode = 0;

#ifdef	DEBUG
	(void) fprintf(stdout, "\n[ldap_common.c: _nss_ldap_getent]\n");
#endif	/* DEBUG */

	if (be->setcalled == 0)
		(void) _nss_ldap_setent(be, a);

next_entry:
	if (be->enumcookie == NULL) {
		retcode = __ns_ldap_firstEntry(be->tablename,
		    be->filter, be->sortattr, _merge_SSD_filter, be->attrs,
		    NULL, 0, &be->enumcookie,
		    &be->result, &error, _F_GETENT_SSD);
	} else {
		if (be->services_cookie == NULL) {
			retcode = __ns_ldap_nextEntry(be->enumcookie,
			    &be->result, &error);
		}
	}
	if (retcode != NS_LDAP_SUCCESS) {
		retcode = switch_err(retcode, error);
		(void) __ns_ldap_freeError(&error);
		(void) _nss_ldap_endent(be, a);
		return (retcode);
	}

	if (be->result == NULL) {
		parsestat = NSS_STR_PARSE_NO_RESULT;
		goto error_out;
	}
	/* ns_ldap_entry_t -> file format */
	if ((parsestat = be->ldapobj2str(be, argp))
	    == NSS_STR_PARSE_SUCCESS) {
		if (argp->buf.result != NULL) {
			/* file format -> struct */
			if (argp->str2ent == NULL) {
				parsestat = NSS_STR_PARSE_NO_RESULT;
				goto error_out;
			}
			parsestat = (*argp->str2ent)(be->buffer,
			    be->buflen,
			    argp->buf.result,
			    argp->buf.buffer,
			    argp->buf.buflen);
			if (parsestat == NSS_STR_PARSE_SUCCESS) {
				if (be->buffer != NULL) {
					free(be->buffer);
					be->buffer = NULL;
					be->buflen = 0;
				}
				be->result = NULL;
				argp->returnval = argp->buf.result;
				argp->returnlen = 1; /* irrevelant */
				return ((nss_status_t)NSS_SUCCESS);
			}
		} else {
			/*
			 * nscd is not caching the enumerated
			 * entries. This code path would be dormant.
			 * Keep this path for the future references.
			 */
			argp->returnval = argp->buf.buffer;
			argp->returnlen =
			    strlen(argp->buf.buffer) + 1;
		}
	}
error_out:
	if (be->buffer != NULL) {
		free(be->buffer);
		be->buffer = NULL;
		be->buflen = 0;
	}
	be->result = NULL;
	if (parsestat == NSS_STR_PARSE_NO_RESULT) {
		argp->returnval = 0;
		(void) _nss_ldap_endent(be, a);
		return ((nss_status_t)NSS_NOTFOUND);
	}

	if (parsestat == NSS_STR_PARSE_ERANGE) {
		argp->erange = 1;
		(void) _nss_ldap_endent(be, a);
		return ((nss_status_t)NSS_NOTFOUND);
	}
	if (parsestat == NSS_STR_PARSE_NO_ADDR)
		/*
		 * No IPV4 address is found in the current entry.
		 * It indicates that the entry contains IPV6 addresses
		 * only. Instead of calling _nss_ldap_endent to
		 * terminate, get next entry to continue enumeration.
		 * If it returned NSS_NOTFOUND here,
		 * gethostent() would return NULL
		 * and the enumeration would stop prematurely.
		 */
		goto next_entry;

	if (parsestat == NSS_STR_PARSE_PARSE)
		/*
		 * There has been a parse error. Most likely some
		 * mandatory attributes are missing. Ignore the error
		 * and get the next entry. If we returned an error the
		 * enumeration would stop prematurely.
		 */
		goto next_entry;

	return ((nss_status_t)NSS_SUCCESS);
}


/*
 *
 */

nss_backend_t *
_nss_ldap_constr(ldap_backend_op_t ops[], int nops, char *tablename,
    const char **attrs, fnf ldapobj2str)
{
	ldap_backend_ptr	be;

#ifdef	DEBUG
	(void) fprintf(stdout, "\n[ldap_common.c: _nss_ldap_constr]\n");
#endif	/* DEBUG */

	if ((be = (ldap_backend_ptr) calloc(1, sizeof (*be))) == 0)
		return (0);
	be->ops = ops;
	be->nops = (nss_dbop_t)nops;
	be->tablename = (char *)strdup(tablename);
	be->attrs = attrs;
	be->ldapobj2str = ldapobj2str;

	return ((nss_backend_t *)be);
}


/*
 *
 */
int
chophostdomain(char *string, char *host, char *domain)
{
	char	*dot;

	if (string == NULL)
		return (-1);

	if ((dot = strchr(string, '.')) == NULL) {
		return (0);
	}
	*dot = '\0';
	(void) strcpy(host, string);
	(void) strcpy(domain, ++dot);

	return (0);
}


/*
 *
 */
int
propersubdomain(char *domain, char *subdomain)
{
	int	domainlen, subdomainlen;

	/* sanity check */
	if (domain == NULL || subdomain == NULL)
		return (-1);

	domainlen = strlen(domain);
	subdomainlen = strlen(subdomain);

	/* is afterdot a substring of domain? */
	if ((strncasecmp(domain, subdomain, subdomainlen)) != 0)
		return (-1);

	if (domainlen == subdomainlen)
		return (1);

	if (subdomainlen > domainlen)
		return (-1);

	if (*(domain + subdomainlen) != '.')
		return (-1);

	return (1);
}