1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <sys/types.h>
28 #include <pwd.h>
29 #include <stdio.h>
30 #include <synch.h>
31 #include <sys/param.h>
32 #include <fcntl.h>
33 #include <unistd.h>
34 #include "ns_cache_door.h"
35 #include <door.h>
36 
37 #if defined(PIC) || defined(lint)
38 
39 /*
40  *
41  * Routines that actually performs the door call.
42  * Note that we cache a file descriptor.  We do
43  * the following to prevent disasters:
44  *
45  * 1) Never use 0,1 or 2; if we get this from the open
46  *    we dup it upwards.
47  *
48  * 2) Set the close on exec flags so descriptor remains available
49  *    to child processes.
50  *
51  * 3) Verify that the door is still the same one we had before
52  *    by using door_info on the client side.
53  *
54  *	Note that we never close the file descriptor if it isn't one
55  *	we allocated; we check this with door info.  The rather tricky
56  *	logic is designed to be fast in the normal case (fd is already
57  *	allocated and is ok) while handling the case where the application
58  *	closed it underneath us or where the nscd dies or re-execs itself
59  *	and we're a multi-threaded application.  Note that we cannot protect
60  *	the application if it closes the fd and it is multi-threaded.
61  *
62  *  int _cache_trydoorcall(void *dptr, int *bufsize, int *actualsize);
63  *
64  *      *dptr           IN: points to arg buffer OUT: points to results buffer
65  *      *bufsize        IN: overall size of buffer OUT: overall size of buffer
66  *      *actualsize     IN: size of call data OUT: size of return data
67  *
68  *  Note that *dptr may change if provided space as defined by *bufsize is
69  *  inadequate.  In this case the door call mmaps more space and places
70  *  the answer there and sets dptr to contain a pointer to the space, which
71  *  should be freed with munmap.
72  *
73  *  Returns 0 if the door call reached the server, -1 if contact was not made.
74  *
75  */
76 
77 extern int errno;
78 static mutex_t	_door_lock = DEFAULTMUTEX;
79 static	int 		doorfd = -1;
80 
81 /*
82  * This function does the first part: ensures a file descriptor is
83  * cached and usable.
84  */
85 int
__ns_ldap_trydoorcall_getfd()86 __ns_ldap_trydoorcall_getfd()
87 {
88 	static	door_info_t 	real_door;
89 	door_info_t 		my_door;
90 
91 	/*
92 	 * the first time in we try and open and validate the door.
93 	 * the validations are that the door must have been
94 	 * created with the name service door cookie and
95 	 * that the file attached to the door is owned by root
96 	 * and readonly by user, group and other.  If any of these
97 	 * validations fail we refuse to use the door.
98 	 */
99 
100 	(void) mutex_lock(&_door_lock);
101 
102 try_again:
103 
104 	if (doorfd == -1) {
105 
106 		int		tbc[3];
107 		int		i;
108 		if ((doorfd = open(LDAP_CACHE_DOOR, O_RDONLY, 0))
109 		    == -1) {
110 			(void) mutex_unlock(&_door_lock);
111 			return (NS_CACHE_NOSERVER);
112 		}
113 
114 		/*
115 		 * dup up the file descriptor if we have 0 - 2
116 		 * to avoid problems with shells stdin/out/err
117 		 */
118 		i = 0;
119 
120 		while (doorfd < 3) { /* we have a reserved fd */
121 			tbc[i++] = doorfd;
122 			if ((doorfd = dup(doorfd)) < 0) {
123 				while (i--)
124 					(void) close(tbc[i]);
125 				doorfd = -1;
126 				(void) mutex_unlock(&_door_lock);
127 				return (NS_CACHE_NOSERVER);
128 			}
129 		}
130 
131 		while (i--)
132 			(void) close(tbc[i]);
133 
134 		/*
135 		 * mark this door descriptor as close on exec
136 		 */
137 		(void) fcntl(doorfd, F_SETFD, FD_CLOEXEC);
138 		if (door_info(doorfd, &real_door) == -1 ||
139 		    (real_door.di_attributes & DOOR_REVOKED) ||
140 		    real_door.di_data != (uintptr_t)LDAP_CACHE_DOOR_COOKIE) {
141 			/*
142 			 * we should close doorfd because we just opened it
143 			 */
144 			(void) close(doorfd);
145 			doorfd = -1;
146 			(void) mutex_unlock(&_door_lock);
147 			return (NS_CACHE_NOSERVER);
148 		}
149 	} else {
150 		if (door_info(doorfd, &my_door) == -1 ||
151 		    my_door.di_data != (uintptr_t)LDAP_CACHE_DOOR_COOKIE ||
152 		    my_door.di_uniquifier != real_door.di_uniquifier) {
153 			/*
154 			 * don't close it -
155 			 * someone else has clobbered fd
156 			 */
157 			doorfd = -1;
158 			goto try_again;
159 		}
160 
161 		if (my_door.di_attributes & DOOR_REVOKED) {
162 			(void) close(doorfd);
163 			doorfd = -1;	/* try and restart connection */
164 			goto try_again;
165 		}
166 	}
167 
168 	(void) mutex_unlock(&_door_lock);
169 	return (NS_CACHE_SUCCESS);
170 }
171 
172 /*
173  * This function does the second part: sends a door request to
174  * the ldap_cachemgr daemon.
175  */
176 int
__ns_ldap_trydoorcall_send(ldap_data_t ** dptr,int * ndata,int * adata)177 __ns_ldap_trydoorcall_send(ldap_data_t **dptr, int *ndata, int *adata)
178 {
179 	door_arg_t		param;
180 
181 	param.rbuf = (char *)*dptr;
182 	param.rsize = *ndata;
183 	param.data_ptr = (char *)*dptr;
184 	param.data_size = *adata;
185 	param.desc_ptr = NULL;
186 	param.desc_num = 0;
187 	if (door_call(doorfd, &param) == -1) {
188 		return (NS_CACHE_NOSERVER);
189 	}
190 	*adata = (int)param.data_size;
191 	*ndata = (int)param.rsize;
192 	*dptr = (ldap_data_t *)param.data_ptr;
193 	if (*adata == 0 || *dptr == NULL) {
194 		return (NS_CACHE_NOSERVER);
195 	}
196 
197 	return ((*dptr)->ldap_ret.ldap_return_code);
198 }
199 
200 /*
201  * This function does part 1 and 2: makes sure a file descriptor is
202  * available and sends a door request to the ldap_cachemgr daemon.
203  */
204 int
__ns_ldap_trydoorcall(ldap_data_t ** dptr,int * ndata,int * adata)205 __ns_ldap_trydoorcall(ldap_data_t **dptr, int *ndata, int *adata)
206 {
207 	int rc;
208 
209 	if ((rc = __ns_ldap_trydoorcall_getfd()) == NS_CACHE_SUCCESS)
210 		return (__ns_ldap_trydoorcall_send(dptr, ndata, adata));
211 	else
212 		return (rc);
213 }
214 
215 void
__ns_ldap_doorfd_close()216 __ns_ldap_doorfd_close()
217 {
218 	(void) mutex_lock(&_door_lock);
219 	if (doorfd != -1) {
220 		(void) close(doorfd);
221 	}
222 	(void) mutex_unlock(&_door_lock);
223 }
224 
225 /*
226  *  routine to check if server is already running
227  */
228 
229 int
__ns_ldap_cache_ping()230 __ns_ldap_cache_ping()
231 {
232 	ldap_data_t data;
233 	ldap_data_t *dptr;
234 	int ndata;
235 	int adata;
236 
237 	data.ldap_call.ldap_callnumber = NULLCALL;
238 	ndata = sizeof (data);
239 	adata = sizeof (data);
240 	dptr = &data;
241 	return (__ns_ldap_trydoorcall(&dptr, &ndata, &adata));
242 }
243 
244 #endif /* PIC */
245