17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5cb5caa98Sdjl * Common Development and Distribution License (the "License").
6cb5caa98Sdjl * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22dd1104fbSMichen Chang * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
237c478bd9Sstevel@tonic-gate * Use is subject to license terms.
24*fea136a0SMatt Barden * Copyright 2019 Nexenta Systems, Inc.
257c478bd9Sstevel@tonic-gate */
267c478bd9Sstevel@tonic-gate
277c478bd9Sstevel@tonic-gate /*
287c478bd9Sstevel@tonic-gate * Simple doors ldap cache daemon
297c478bd9Sstevel@tonic-gate */
307c478bd9Sstevel@tonic-gate
317c478bd9Sstevel@tonic-gate #include <stdio.h>
327c478bd9Sstevel@tonic-gate #include <stdlib.h>
337c478bd9Sstevel@tonic-gate #include <signal.h>
347c478bd9Sstevel@tonic-gate #include <door.h>
357c478bd9Sstevel@tonic-gate #include <time.h>
367c478bd9Sstevel@tonic-gate #include <string.h>
377ddae043Siz #include <strings.h>
387c478bd9Sstevel@tonic-gate #include <libintl.h>
397c478bd9Sstevel@tonic-gate #include <sys/stat.h>
407c478bd9Sstevel@tonic-gate #include <sys/time.h>
417c478bd9Sstevel@tonic-gate #include <sys/wait.h>
427c478bd9Sstevel@tonic-gate #include <stdlib.h>
437c478bd9Sstevel@tonic-gate #include <errno.h>
447c478bd9Sstevel@tonic-gate #include <pthread.h>
457c478bd9Sstevel@tonic-gate #include <thread.h>
467c478bd9Sstevel@tonic-gate #include <stdarg.h>
477c478bd9Sstevel@tonic-gate #include <fcntl.h>
487c478bd9Sstevel@tonic-gate #include <assert.h>
497c478bd9Sstevel@tonic-gate #include <unistd.h>
507c478bd9Sstevel@tonic-gate #include <memory.h>
517c478bd9Sstevel@tonic-gate #include <sys/types.h>
527c478bd9Sstevel@tonic-gate #include <syslog.h>
537c478bd9Sstevel@tonic-gate #include <locale.h> /* LC_ALL */
547ddae043Siz
557ddae043Siz #include <alloca.h>
567ddae043Siz #include <ucontext.h>
57dd1104fbSMichen Chang #include <stddef.h> /* offsetof */
58dd1104fbSMichen Chang #include <priv.h>
597ddae043Siz
608142c2b2Schinlong #include "getxby_door.h"
617c478bd9Sstevel@tonic-gate #include "cachemgr.h"
627c478bd9Sstevel@tonic-gate
637c478bd9Sstevel@tonic-gate static void detachfromtty();
647c478bd9Sstevel@tonic-gate admin_t current_admin;
657c478bd9Sstevel@tonic-gate static int will_become_server;
667c478bd9Sstevel@tonic-gate
677c478bd9Sstevel@tonic-gate static void switcher(void *cookie, char *argp, size_t arg_size,
687c478bd9Sstevel@tonic-gate door_desc_t *dp, uint_t n_desc);
697c478bd9Sstevel@tonic-gate static void usage(char *s);
707c478bd9Sstevel@tonic-gate static int cachemgr_set_lf(admin_t *ptr, char *logfile);
717c478bd9Sstevel@tonic-gate static int client_getadmin(admin_t *ptr);
727ddae043Siz static int setadmin(ldap_call_t *ptr);
737c478bd9Sstevel@tonic-gate static int client_setadmin(admin_t *ptr);
747c478bd9Sstevel@tonic-gate static int client_showstats(admin_t *ptr);
758142c2b2Schinlong static int is_root(int free_uc, char *dc_str, ucred_t **uc);
76b57459abSJulian Pullen int is_root_or_all_privs(char *dc_str, ucred_t **ucp);
77dd1104fbSMichen Chang static void admin_modify(LineBuf *config_info, ldap_call_t *in);
787c478bd9Sstevel@tonic-gate
797c478bd9Sstevel@tonic-gate #ifdef SLP
807c478bd9Sstevel@tonic-gate int use_slp = 0;
817c478bd9Sstevel@tonic-gate static unsigned int refresh = 10800; /* dynamic discovery interval */
827c478bd9Sstevel@tonic-gate #endif /* SLP */
837c478bd9Sstevel@tonic-gate
847c478bd9Sstevel@tonic-gate static ldap_stat_t *
getcacheptr(char * s)857c478bd9Sstevel@tonic-gate getcacheptr(char *s)
867c478bd9Sstevel@tonic-gate {
877c478bd9Sstevel@tonic-gate static const char *caches[1] = {"ldap"};
887c478bd9Sstevel@tonic-gate
897c478bd9Sstevel@tonic-gate if (strncmp(caches[0], s, strlen(caches[0])) == 0)
907c478bd9Sstevel@tonic-gate return (¤t_admin.ldap_stat);
917c478bd9Sstevel@tonic-gate
927c478bd9Sstevel@tonic-gate return (NULL);
937c478bd9Sstevel@tonic-gate }
947c478bd9Sstevel@tonic-gate
957c478bd9Sstevel@tonic-gate char *
getcacheopt(char * s)967c478bd9Sstevel@tonic-gate getcacheopt(char *s)
977c478bd9Sstevel@tonic-gate {
987c478bd9Sstevel@tonic-gate while (*s && *s != ',')
997c478bd9Sstevel@tonic-gate s++;
1007c478bd9Sstevel@tonic-gate return ((*s == ',') ? (s + 1) : NULL);
1017c478bd9Sstevel@tonic-gate }
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate /*
1047c478bd9Sstevel@tonic-gate * This is here to prevent the ldap_cachemgr becomes
1057c478bd9Sstevel@tonic-gate * daemonlized to early to soon during boot time.
1067c478bd9Sstevel@tonic-gate * This causes problems during boot when automounter
1077c478bd9Sstevel@tonic-gate * and others try to use libsldap before ldap_cachemgr
1087c478bd9Sstevel@tonic-gate * finishes walking the server list.
1097c478bd9Sstevel@tonic-gate */
1107c478bd9Sstevel@tonic-gate static void
sig_ok_to_exit(int signo)1117c478bd9Sstevel@tonic-gate sig_ok_to_exit(int signo)
1127c478bd9Sstevel@tonic-gate {
1137c478bd9Sstevel@tonic-gate if (signo == SIGUSR1) {
1147c478bd9Sstevel@tonic-gate logit("sig_ok_to_exit(): parent exiting...\n");
1157c478bd9Sstevel@tonic-gate exit(0);
1167c478bd9Sstevel@tonic-gate } else {
1177c478bd9Sstevel@tonic-gate logit("sig_ok_to_exit(): invalid signal(%d) received.\n",
1187ddae043Siz signo);
1197c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("ldap_cachemgr: "
1207ddae043Siz "invalid signal(%d) received."), signo);
1217c478bd9Sstevel@tonic-gate exit(1);
1227c478bd9Sstevel@tonic-gate }
1237c478bd9Sstevel@tonic-gate }
1247c478bd9Sstevel@tonic-gate #define LDAP_TABLES 1 /* ldap */
1257c478bd9Sstevel@tonic-gate #define TABLE_THREADS 10
1267c478bd9Sstevel@tonic-gate #define COMMON_THREADS 20
1277c478bd9Sstevel@tonic-gate #define CACHE_MISS_THREADS (COMMON_THREADS + LDAP_TABLES * TABLE_THREADS)
1287c478bd9Sstevel@tonic-gate #define CACHE_HIT_THREADS 20
129e1dd0a2fSth /*
130e1dd0a2fSth * There is only one thread handling GETSTATUSCHANGE START from main nscd
131e1dd0a2fSth * most of time. But it could happen that a main nscd is restarted, old main
132e1dd0a2fSth * nscd's handling thread is still alive when new main nscd starts and sends
133e1dd0a2fSth * START, or old main dies. STOP is not sent in both cases.
134e1dd0a2fSth * The main nscd requires 2 threads to handle START and STOP. So max number
135e1dd0a2fSth * of change threads is set to 4.
136e1dd0a2fSth */
137e1dd0a2fSth #define MAX_CHG_THREADS 4
138e1dd0a2fSth #define MAX_SERVER_THREADS (CACHE_HIT_THREADS + CACHE_MISS_THREADS + \
139e1dd0a2fSth MAX_CHG_THREADS)
1407c478bd9Sstevel@tonic-gate
1417c478bd9Sstevel@tonic-gate static sema_t common_sema;
1427c478bd9Sstevel@tonic-gate static sema_t ldap_sema;
1437c478bd9Sstevel@tonic-gate static thread_key_t lookup_state_key;
144e1dd0a2fSth static int chg_threads_num = 0;
145e1dd0a2fSth static mutex_t chg_threads_num_lock = DEFAULTMUTEX;
1467c478bd9Sstevel@tonic-gate
1477c478bd9Sstevel@tonic-gate static void
initialize_lookup_clearance()1487c478bd9Sstevel@tonic-gate initialize_lookup_clearance()
1497c478bd9Sstevel@tonic-gate {
1507c478bd9Sstevel@tonic-gate (void) thr_keycreate(&lookup_state_key, NULL);
1517c478bd9Sstevel@tonic-gate (void) sema_init(&common_sema, COMMON_THREADS, USYNC_THREAD, 0);
1527c478bd9Sstevel@tonic-gate (void) sema_init(&ldap_sema, TABLE_THREADS, USYNC_THREAD, 0);
1537c478bd9Sstevel@tonic-gate }
1547c478bd9Sstevel@tonic-gate
1557c478bd9Sstevel@tonic-gate int
get_clearance(int callnumber)1567c478bd9Sstevel@tonic-gate get_clearance(int callnumber)
1577c478bd9Sstevel@tonic-gate {
1587c478bd9Sstevel@tonic-gate sema_t *table_sema = NULL;
1597c478bd9Sstevel@tonic-gate char *tab;
1607c478bd9Sstevel@tonic-gate
1617c478bd9Sstevel@tonic-gate if (sema_trywait(&common_sema) == 0) {
1627c478bd9Sstevel@tonic-gate (void) thr_setspecific(lookup_state_key, NULL);
1637c478bd9Sstevel@tonic-gate return (0);
1647c478bd9Sstevel@tonic-gate }
1657c478bd9Sstevel@tonic-gate
1667c478bd9Sstevel@tonic-gate switch (callnumber) {
1677c478bd9Sstevel@tonic-gate case GETLDAPCONFIG:
1687c478bd9Sstevel@tonic-gate tab = "ldap";
1697c478bd9Sstevel@tonic-gate table_sema = &ldap_sema;
1707c478bd9Sstevel@tonic-gate break;
1717c478bd9Sstevel@tonic-gate default:
1727c478bd9Sstevel@tonic-gate logit("Internal Error: get_clearance\n");
1737c478bd9Sstevel@tonic-gate break;
1747c478bd9Sstevel@tonic-gate }
1757c478bd9Sstevel@tonic-gate
1767c478bd9Sstevel@tonic-gate if (sema_trywait(table_sema) == 0) {
1777c478bd9Sstevel@tonic-gate (void) thr_setspecific(lookup_state_key, (void*)1);
1787c478bd9Sstevel@tonic-gate return (0);
1797c478bd9Sstevel@tonic-gate }
1807c478bd9Sstevel@tonic-gate
1817c478bd9Sstevel@tonic-gate if (current_admin.debug_level >= DBG_CANT_FIND) {
1827c478bd9Sstevel@tonic-gate logit("get_clearance: throttling load for %s table\n", tab);
1837c478bd9Sstevel@tonic-gate }
1847c478bd9Sstevel@tonic-gate
1857c478bd9Sstevel@tonic-gate return (-1);
1867c478bd9Sstevel@tonic-gate }
1877c478bd9Sstevel@tonic-gate
1887c478bd9Sstevel@tonic-gate int
release_clearance(int callnumber)1897c478bd9Sstevel@tonic-gate release_clearance(int callnumber)
1907c478bd9Sstevel@tonic-gate {
1917c478bd9Sstevel@tonic-gate int which;
1927c478bd9Sstevel@tonic-gate sema_t *table_sema = NULL;
1937c478bd9Sstevel@tonic-gate
1947c478bd9Sstevel@tonic-gate (void) thr_getspecific(lookup_state_key, (void**)&which);
1957c478bd9Sstevel@tonic-gate if (which == 0) /* from common pool */ {
1967c478bd9Sstevel@tonic-gate (void) sema_post(&common_sema);
1977c478bd9Sstevel@tonic-gate return (0);
1987c478bd9Sstevel@tonic-gate }
1997c478bd9Sstevel@tonic-gate
2007c478bd9Sstevel@tonic-gate switch (callnumber) {
2017c478bd9Sstevel@tonic-gate case GETLDAPCONFIG:
2027c478bd9Sstevel@tonic-gate table_sema = &ldap_sema;
2037c478bd9Sstevel@tonic-gate break;
2047c478bd9Sstevel@tonic-gate default:
2057c478bd9Sstevel@tonic-gate logit("Internal Error: release_clearance\n");
2067c478bd9Sstevel@tonic-gate break;
2077c478bd9Sstevel@tonic-gate }
2087c478bd9Sstevel@tonic-gate (void) sema_post(table_sema);
2097c478bd9Sstevel@tonic-gate
2107c478bd9Sstevel@tonic-gate return (0);
2117c478bd9Sstevel@tonic-gate }
2127c478bd9Sstevel@tonic-gate
2137c478bd9Sstevel@tonic-gate
2147c478bd9Sstevel@tonic-gate static mutex_t create_lock;
2157c478bd9Sstevel@tonic-gate static int num_servers = 0;
2167c478bd9Sstevel@tonic-gate static thread_key_t server_key;
2177c478bd9Sstevel@tonic-gate
2187c478bd9Sstevel@tonic-gate
2197c478bd9Sstevel@tonic-gate /*
2207c478bd9Sstevel@tonic-gate * Bind a TSD value to a server thread. This enables the destructor to
2217c478bd9Sstevel@tonic-gate * be called if/when this thread exits. This would be a programming error,
2227c478bd9Sstevel@tonic-gate * but better safe than sorry.
2237c478bd9Sstevel@tonic-gate */
2247c478bd9Sstevel@tonic-gate
2257c478bd9Sstevel@tonic-gate /*ARGSUSED*/
2267c478bd9Sstevel@tonic-gate static void *
server_tsd_bind(void * arg)2277c478bd9Sstevel@tonic-gate server_tsd_bind(void *arg)
2287c478bd9Sstevel@tonic-gate {
229*fea136a0SMatt Barden static void *value = "NON-NULL TSD";
2307c478bd9Sstevel@tonic-gate
2317c478bd9Sstevel@tonic-gate /*
2327c478bd9Sstevel@tonic-gate * disable cancellation to prevent hangs when server
2337c478bd9Sstevel@tonic-gate * threads disappear
2347c478bd9Sstevel@tonic-gate */
235*fea136a0SMatt Barden (void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
2367c478bd9Sstevel@tonic-gate (void) thr_setspecific(server_key, value);
237cb5caa98Sdjl (void) door_return(NULL, 0, NULL, 0);
2387c478bd9Sstevel@tonic-gate
2397c478bd9Sstevel@tonic-gate return (value);
2407c478bd9Sstevel@tonic-gate }
2417c478bd9Sstevel@tonic-gate
2427c478bd9Sstevel@tonic-gate /*
2437c478bd9Sstevel@tonic-gate * Server threads are created here.
2447c478bd9Sstevel@tonic-gate */
2457c478bd9Sstevel@tonic-gate
2467c478bd9Sstevel@tonic-gate /*ARGSUSED*/
2477c478bd9Sstevel@tonic-gate static void
server_create(door_info_t * dip)2487c478bd9Sstevel@tonic-gate server_create(door_info_t *dip)
2497c478bd9Sstevel@tonic-gate {
2507c478bd9Sstevel@tonic-gate (void) mutex_lock(&create_lock);
2517c478bd9Sstevel@tonic-gate if (++num_servers > MAX_SERVER_THREADS) {
2527c478bd9Sstevel@tonic-gate num_servers--;
2537c478bd9Sstevel@tonic-gate (void) mutex_unlock(&create_lock);
2547c478bd9Sstevel@tonic-gate return;
2557c478bd9Sstevel@tonic-gate }
2567c478bd9Sstevel@tonic-gate (void) mutex_unlock(&create_lock);
2577c478bd9Sstevel@tonic-gate (void) thr_create(NULL, 0, server_tsd_bind, NULL,
2587ddae043Siz THR_BOUND|THR_DETACHED, NULL);
2597c478bd9Sstevel@tonic-gate }
2607c478bd9Sstevel@tonic-gate
2617c478bd9Sstevel@tonic-gate /*
2627c478bd9Sstevel@tonic-gate * Server thread are destroyed here
2637c478bd9Sstevel@tonic-gate */
2647c478bd9Sstevel@tonic-gate
2657c478bd9Sstevel@tonic-gate /*ARGSUSED*/
2667c478bd9Sstevel@tonic-gate static void
server_destroy(void * arg)2677c478bd9Sstevel@tonic-gate server_destroy(void *arg)
2687c478bd9Sstevel@tonic-gate {
2697c478bd9Sstevel@tonic-gate (void) mutex_lock(&create_lock);
2707c478bd9Sstevel@tonic-gate num_servers--;
2717c478bd9Sstevel@tonic-gate (void) mutex_unlock(&create_lock);
272*fea136a0SMatt Barden (void) thr_setspecific(server_key, NULL);
2737c478bd9Sstevel@tonic-gate }
2747c478bd9Sstevel@tonic-gate
275d67944fbSScott Rotondo static void client_killserver();
276d67944fbSScott Rotondo
277a506a34cSth int
main(int argc,char ** argv)2787c478bd9Sstevel@tonic-gate main(int argc, char ** argv)
2797c478bd9Sstevel@tonic-gate {
2807c478bd9Sstevel@tonic-gate int did;
2817c478bd9Sstevel@tonic-gate int opt;
2827c478bd9Sstevel@tonic-gate int errflg = 0;
2837c478bd9Sstevel@tonic-gate int showstats = 0;
2847c478bd9Sstevel@tonic-gate int doset = 0;
2857c478bd9Sstevel@tonic-gate int dofg = 0;
2867c478bd9Sstevel@tonic-gate struct stat buf;
2877c478bd9Sstevel@tonic-gate sigset_t myset;
2887c478bd9Sstevel@tonic-gate struct sigaction sighupaction;
2897c478bd9Sstevel@tonic-gate int debug_level = 0;
2907c478bd9Sstevel@tonic-gate
2917c478bd9Sstevel@tonic-gate /* setup for localization */
2927c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, "");
2937c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN);
2947c478bd9Sstevel@tonic-gate
2957c478bd9Sstevel@tonic-gate openlog("ldap_cachemgr", LOG_PID, LOG_DAEMON);
2967c478bd9Sstevel@tonic-gate
2977c478bd9Sstevel@tonic-gate if (chdir(NSLDAPDIRECTORY) < 0) {
2987c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("chdir(\"%s\") failed: %s\n"),
2997ddae043Siz NSLDAPDIRECTORY, strerror(errno));
3007c478bd9Sstevel@tonic-gate exit(1);
3017c478bd9Sstevel@tonic-gate }
3027c478bd9Sstevel@tonic-gate
3037c478bd9Sstevel@tonic-gate /*
3047c478bd9Sstevel@tonic-gate * Correctly set file mode creation mask, so to make the new files
3057c478bd9Sstevel@tonic-gate * created for door calls being readable by all.
3067c478bd9Sstevel@tonic-gate */
3077c478bd9Sstevel@tonic-gate (void) umask(0);
3087c478bd9Sstevel@tonic-gate
3097c478bd9Sstevel@tonic-gate /*
3107c478bd9Sstevel@tonic-gate * Special case non-root user here - he/she/they/it can just print
3117c478bd9Sstevel@tonic-gate * stats
3127c478bd9Sstevel@tonic-gate */
3137c478bd9Sstevel@tonic-gate
3147c478bd9Sstevel@tonic-gate if (geteuid()) {
3157c478bd9Sstevel@tonic-gate if (argc != 2 || strcmp(argv[1], "-g")) {
3167c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
3177c478bd9Sstevel@tonic-gate gettext("Must be root to use any option "
3187c478bd9Sstevel@tonic-gate "other than -g.\n\n"));
3197c478bd9Sstevel@tonic-gate usage(argv[0]);
3207c478bd9Sstevel@tonic-gate }
3217c478bd9Sstevel@tonic-gate
322e1dd0a2fSth if ((__ns_ldap_cache_ping() != NS_CACHE_SUCCESS) ||
3237c478bd9Sstevel@tonic-gate (client_getadmin(¤t_admin) != 0)) {
3247c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
3257ddae043Siz gettext("%s doesn't appear to be running.\n"),
3267ddae043Siz argv[0]);
3277c478bd9Sstevel@tonic-gate exit(1);
3287c478bd9Sstevel@tonic-gate }
3297c478bd9Sstevel@tonic-gate (void) client_showstats(¤t_admin);
3307c478bd9Sstevel@tonic-gate exit(0);
3317c478bd9Sstevel@tonic-gate }
3327c478bd9Sstevel@tonic-gate
3337c478bd9Sstevel@tonic-gate
3347c478bd9Sstevel@tonic-gate
3357c478bd9Sstevel@tonic-gate /*
3367c478bd9Sstevel@tonic-gate * Determine if there is already a daemon running
3377c478bd9Sstevel@tonic-gate */
3387c478bd9Sstevel@tonic-gate
339e1dd0a2fSth will_become_server = (__ns_ldap_cache_ping() != NS_CACHE_SUCCESS);
3407c478bd9Sstevel@tonic-gate
3417c478bd9Sstevel@tonic-gate /*
3427c478bd9Sstevel@tonic-gate * load normal config file
3437c478bd9Sstevel@tonic-gate */
3447c478bd9Sstevel@tonic-gate
3457c478bd9Sstevel@tonic-gate if (will_become_server) {
3467c478bd9Sstevel@tonic-gate static const ldap_stat_t defaults = {
3477c478bd9Sstevel@tonic-gate 0, /* stat */
3487c478bd9Sstevel@tonic-gate DEFAULTTTL}; /* ttl */
3497c478bd9Sstevel@tonic-gate
3507c478bd9Sstevel@tonic-gate current_admin.ldap_stat = defaults;
3517c478bd9Sstevel@tonic-gate (void) strcpy(current_admin.logfile, LOGFILE);
3527c478bd9Sstevel@tonic-gate } else {
3537c478bd9Sstevel@tonic-gate if (client_getadmin(¤t_admin)) {
3547c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Cannot contact %s "
3557ddae043Siz "properly(?)\n"), argv[0]);
3567c478bd9Sstevel@tonic-gate exit(1);
3577c478bd9Sstevel@tonic-gate }
3587c478bd9Sstevel@tonic-gate }
3597c478bd9Sstevel@tonic-gate
3607c478bd9Sstevel@tonic-gate #ifndef SLP
3617c478bd9Sstevel@tonic-gate while ((opt = getopt(argc, argv, "fKgl:r:d:")) != EOF) {
3627c478bd9Sstevel@tonic-gate #else
3637c478bd9Sstevel@tonic-gate while ((opt = getopt(argc, argv, "fKgs:l:r:d:")) != EOF) {
3647c478bd9Sstevel@tonic-gate #endif /* SLP */
3657c478bd9Sstevel@tonic-gate ldap_stat_t *cache;
3667c478bd9Sstevel@tonic-gate
3677c478bd9Sstevel@tonic-gate switch (opt) {
3687c478bd9Sstevel@tonic-gate case 'K':
3697c478bd9Sstevel@tonic-gate client_killserver();
3707c478bd9Sstevel@tonic-gate exit(0);
3717c478bd9Sstevel@tonic-gate break;
3727c478bd9Sstevel@tonic-gate case 'g':
3737c478bd9Sstevel@tonic-gate showstats++;
3747c478bd9Sstevel@tonic-gate break;
3757c478bd9Sstevel@tonic-gate case 'f':
3767c478bd9Sstevel@tonic-gate dofg++;
3777c478bd9Sstevel@tonic-gate break;
3787c478bd9Sstevel@tonic-gate case 'r':
3797c478bd9Sstevel@tonic-gate doset++;
3807c478bd9Sstevel@tonic-gate cache = getcacheptr("ldap");
3817c478bd9Sstevel@tonic-gate if (!optarg) {
3827c478bd9Sstevel@tonic-gate errflg++;
3837c478bd9Sstevel@tonic-gate break;
3847c478bd9Sstevel@tonic-gate }
3857c478bd9Sstevel@tonic-gate cache->ldap_ttl = atoi(optarg);
3867c478bd9Sstevel@tonic-gate break;
3877c478bd9Sstevel@tonic-gate case 'l':
3887c478bd9Sstevel@tonic-gate doset++;
3897c478bd9Sstevel@tonic-gate (void) strlcpy(current_admin.logfile,
3907ddae043Siz optarg, sizeof (current_admin.logfile));
3917c478bd9Sstevel@tonic-gate break;
3927c478bd9Sstevel@tonic-gate case 'd':
3937c478bd9Sstevel@tonic-gate doset++;
3947c478bd9Sstevel@tonic-gate debug_level = atoi(optarg);
3957c478bd9Sstevel@tonic-gate break;
3967c478bd9Sstevel@tonic-gate #ifdef SLP
3977c478bd9Sstevel@tonic-gate case 's': /* undocumented: use dynamic (SLP) config */
3987c478bd9Sstevel@tonic-gate use_slp = 1;
3997c478bd9Sstevel@tonic-gate break;
4007c478bd9Sstevel@tonic-gate #endif /* SLP */
4017c478bd9Sstevel@tonic-gate default:
4027c478bd9Sstevel@tonic-gate errflg++;
4037c478bd9Sstevel@tonic-gate break;
4047c478bd9Sstevel@tonic-gate }
4057c478bd9Sstevel@tonic-gate }
4067c478bd9Sstevel@tonic-gate
4077c478bd9Sstevel@tonic-gate if (errflg)
4087ddae043Siz usage(argv[0]);
4097c478bd9Sstevel@tonic-gate
4107c478bd9Sstevel@tonic-gate /*
4117c478bd9Sstevel@tonic-gate * will not show statistics if no daemon running
4127c478bd9Sstevel@tonic-gate */
4137c478bd9Sstevel@tonic-gate if (will_become_server && showstats) {
4147c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
4157ddae043Siz gettext("%s doesn't appear to be running.\n"),
4167ddae043Siz argv[0]);
4177c478bd9Sstevel@tonic-gate exit(1);
4187c478bd9Sstevel@tonic-gate }
4197c478bd9Sstevel@tonic-gate
4207c478bd9Sstevel@tonic-gate if (!will_become_server) {
4217c478bd9Sstevel@tonic-gate if (showstats) {
4227c478bd9Sstevel@tonic-gate (void) client_showstats(¤t_admin);
4237c478bd9Sstevel@tonic-gate }
4247c478bd9Sstevel@tonic-gate if (doset) {
4257c478bd9Sstevel@tonic-gate current_admin.debug_level = debug_level;
4267c478bd9Sstevel@tonic-gate if (client_setadmin(¤t_admin) < 0) {
4277c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
4287ddae043Siz gettext("Error during admin call\n"));
4297c478bd9Sstevel@tonic-gate exit(1);
4307c478bd9Sstevel@tonic-gate }
4317c478bd9Sstevel@tonic-gate }
4327c478bd9Sstevel@tonic-gate if (!showstats && !doset) {
4337c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
4347c478bd9Sstevel@tonic-gate gettext("%s already running....use '%s "
4357ddae043Siz "-K' to stop\n"), argv[0], argv[0]);
4367c478bd9Sstevel@tonic-gate }
4377c478bd9Sstevel@tonic-gate exit(0);
4387c478bd9Sstevel@tonic-gate }
4397c478bd9Sstevel@tonic-gate
4407c478bd9Sstevel@tonic-gate /*
4417c478bd9Sstevel@tonic-gate * daemon from here on
4427c478bd9Sstevel@tonic-gate */
4437c478bd9Sstevel@tonic-gate
4447c478bd9Sstevel@tonic-gate if (debug_level) {
4457c478bd9Sstevel@tonic-gate /*
4467c478bd9Sstevel@tonic-gate * we're debugging...
4477c478bd9Sstevel@tonic-gate */
4487c478bd9Sstevel@tonic-gate if (strlen(current_admin.logfile) == 0)
4497c478bd9Sstevel@tonic-gate /*
4507c478bd9Sstevel@tonic-gate * no specified log file
4517c478bd9Sstevel@tonic-gate */
4527c478bd9Sstevel@tonic-gate (void) strcpy(current_admin.logfile, LOGFILE);
453eb28af62SToomas Soome (void) cachemgr_set_lf(¤t_admin, current_admin.logfile);
4547c478bd9Sstevel@tonic-gate /*
4557c478bd9Sstevel@tonic-gate * validate the range of debug level number
4567c478bd9Sstevel@tonic-gate * and set the number to current_admin.debug_level
4577c478bd9Sstevel@tonic-gate */
4587c478bd9Sstevel@tonic-gate if (cachemgr_set_dl(¤t_admin, debug_level) < 0) {
4597c478bd9Sstevel@tonic-gate /*
4607c478bd9Sstevel@tonic-gate * print error messages to the screen
4617c478bd9Sstevel@tonic-gate * cachemgr_set_dl prints msgs to cachemgr.log
4627c478bd9Sstevel@tonic-gate * only
4637c478bd9Sstevel@tonic-gate */
4647c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
4657c478bd9Sstevel@tonic-gate gettext("Incorrect Debug Level: %d\n"
4667c478bd9Sstevel@tonic-gate "It should be between %d and %d\n"),
4677ddae043Siz debug_level, DBG_OFF, MAXDEBUG);
4687c478bd9Sstevel@tonic-gate exit(-1);
4697c478bd9Sstevel@tonic-gate }
4707c478bd9Sstevel@tonic-gate } else {
4717c478bd9Sstevel@tonic-gate if (strlen(current_admin.logfile) == 0)
4727c478bd9Sstevel@tonic-gate (void) strcpy(current_admin.logfile, "/dev/null");
473eb28af62SToomas Soome (void) cachemgr_set_lf(¤t_admin, current_admin.logfile);
4747c478bd9Sstevel@tonic-gate }
4757c478bd9Sstevel@tonic-gate
4767c478bd9Sstevel@tonic-gate if (dofg == 0)
4777c478bd9Sstevel@tonic-gate detachfromtty(argv[0]);
4787c478bd9Sstevel@tonic-gate
4797c478bd9Sstevel@tonic-gate /*
4807c478bd9Sstevel@tonic-gate * perform some initialization
4817c478bd9Sstevel@tonic-gate */
4827c478bd9Sstevel@tonic-gate
4837c478bd9Sstevel@tonic-gate initialize_lookup_clearance();
4847c478bd9Sstevel@tonic-gate
4857c478bd9Sstevel@tonic-gate if (getldap_init() != 0)
4867c478bd9Sstevel@tonic-gate exit(-1);
4877c478bd9Sstevel@tonic-gate
4887c478bd9Sstevel@tonic-gate /*
4897c478bd9Sstevel@tonic-gate * Establish our own server thread pool
4907c478bd9Sstevel@tonic-gate */
4917c478bd9Sstevel@tonic-gate
492cb5caa98Sdjl (void) door_server_create(server_create);
4937c478bd9Sstevel@tonic-gate if (thr_keycreate(&server_key, server_destroy) != 0) {
4947c478bd9Sstevel@tonic-gate logit("thr_keycreate() call failed\n");
4957c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
4967ddae043Siz gettext("ldap_cachemgr: thr_keycreate() call failed"));
4977c478bd9Sstevel@tonic-gate perror("thr_keycreate");
4987c478bd9Sstevel@tonic-gate exit(-1);
4997c478bd9Sstevel@tonic-gate }
5007c478bd9Sstevel@tonic-gate
5017c478bd9Sstevel@tonic-gate /*
5027c478bd9Sstevel@tonic-gate * Create a door
5037c478bd9Sstevel@tonic-gate */
5047c478bd9Sstevel@tonic-gate
5057c478bd9Sstevel@tonic-gate if ((did = door_create(switcher, LDAP_CACHE_DOOR_COOKIE,
5067c478bd9Sstevel@tonic-gate DOOR_UNREF | DOOR_REFUSE_DESC | DOOR_NO_CANCEL)) < 0) {
5077c478bd9Sstevel@tonic-gate logit("door_create() call failed\n");
5087c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext(
5097ddae043Siz "ldap_cachemgr: door_create() call failed"));
5107c478bd9Sstevel@tonic-gate perror("door_create");
5117c478bd9Sstevel@tonic-gate exit(-1);
5127c478bd9Sstevel@tonic-gate }
5137c478bd9Sstevel@tonic-gate
5147c478bd9Sstevel@tonic-gate /*
5157c478bd9Sstevel@tonic-gate * bind to file system
5167c478bd9Sstevel@tonic-gate */
5177c478bd9Sstevel@tonic-gate
5187c478bd9Sstevel@tonic-gate if (stat(LDAP_CACHE_DOOR, &buf) < 0) {
5197c478bd9Sstevel@tonic-gate int newfd;
5207c478bd9Sstevel@tonic-gate
5217c478bd9Sstevel@tonic-gate if ((newfd = creat(LDAP_CACHE_DOOR, 0444)) < 0) {
5227c478bd9Sstevel@tonic-gate logit("Cannot create %s:%s\n",
5237ddae043Siz LDAP_CACHE_DOOR,
5247ddae043Siz strerror(errno));
5257c478bd9Sstevel@tonic-gate exit(1);
5267c478bd9Sstevel@tonic-gate }
5277c478bd9Sstevel@tonic-gate (void) close(newfd);
5287c478bd9Sstevel@tonic-gate }
5297c478bd9Sstevel@tonic-gate
5307c478bd9Sstevel@tonic-gate if (fattach(did, LDAP_CACHE_DOOR) < 0) {
5317c478bd9Sstevel@tonic-gate if ((errno != EBUSY) ||
5327c478bd9Sstevel@tonic-gate (fdetach(LDAP_CACHE_DOOR) < 0) ||
5337c478bd9Sstevel@tonic-gate (fattach(did, LDAP_CACHE_DOOR) < 0)) {
5347c478bd9Sstevel@tonic-gate logit("fattach() call failed\n");
5357c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext(
5367ddae043Siz "ldap_cachemgr: fattach() call failed"));
5377c478bd9Sstevel@tonic-gate perror("fattach");
5387c478bd9Sstevel@tonic-gate exit(2);
5397c478bd9Sstevel@tonic-gate }
5407c478bd9Sstevel@tonic-gate }
5417c478bd9Sstevel@tonic-gate
5427c478bd9Sstevel@tonic-gate /* catch SIGHUP revalid signals */
5437c478bd9Sstevel@tonic-gate sighupaction.sa_handler = getldap_revalidate;
5447c478bd9Sstevel@tonic-gate sighupaction.sa_flags = 0;
5457c478bd9Sstevel@tonic-gate (void) sigemptyset(&sighupaction.sa_mask);
5467c478bd9Sstevel@tonic-gate (void) sigemptyset(&myset);
5477c478bd9Sstevel@tonic-gate (void) sigaddset(&myset, SIGHUP);
5487c478bd9Sstevel@tonic-gate
5497c478bd9Sstevel@tonic-gate if (sigaction(SIGHUP, &sighupaction, NULL) < 0) {
5507c478bd9Sstevel@tonic-gate logit("sigaction() call failed\n");
5517c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
5527ddae043Siz gettext("ldap_cachemgr: sigaction() call failed"));
5537c478bd9Sstevel@tonic-gate perror("sigaction");
5547c478bd9Sstevel@tonic-gate exit(1);
5557c478bd9Sstevel@tonic-gate }
5567c478bd9Sstevel@tonic-gate
5577c478bd9Sstevel@tonic-gate if (thr_sigsetmask(SIG_BLOCK, &myset, NULL) < 0) {
5587c478bd9Sstevel@tonic-gate logit("thr_sigsetmask() call failed\n");
5597c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
5607ddae043Siz gettext("ldap_cachemgr: thr_sigsetmask() call failed"));
5617c478bd9Sstevel@tonic-gate perror("thr_sigsetmask");
5627c478bd9Sstevel@tonic-gate exit(1);
5637c478bd9Sstevel@tonic-gate }
5647c478bd9Sstevel@tonic-gate
5657c478bd9Sstevel@tonic-gate /*
5667c478bd9Sstevel@tonic-gate * kick off revalidate threads only if ttl != 0
5677c478bd9Sstevel@tonic-gate */
5687c478bd9Sstevel@tonic-gate
569e1dd0a2fSth if (thr_create(NULL, 0, (void *(*)(void*))getldap_refresh,
570e1dd0a2fSth NULL, 0, NULL) != 0) {
5717c478bd9Sstevel@tonic-gate logit("thr_create() call failed\n");
5727c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
5737ddae043Siz gettext("ldap_cachemgr: thr_create() call failed"));
5747c478bd9Sstevel@tonic-gate perror("thr_create");
5757c478bd9Sstevel@tonic-gate exit(1);
5767c478bd9Sstevel@tonic-gate }
5777c478bd9Sstevel@tonic-gate
5787c478bd9Sstevel@tonic-gate /*
5797c478bd9Sstevel@tonic-gate * kick off the thread which refreshes the server info
5807c478bd9Sstevel@tonic-gate */
5817c478bd9Sstevel@tonic-gate
582e1dd0a2fSth if (thr_create(NULL, 0, (void *(*)(void*))getldap_serverInfo_refresh,
583e1dd0a2fSth NULL, 0, NULL) != 0) {
5847c478bd9Sstevel@tonic-gate logit("thr_create() call failed\n");
5857c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
5867ddae043Siz gettext("ldap_cachemgr: thr_create() call failed"));
5877c478bd9Sstevel@tonic-gate perror("thr_create");
5887c478bd9Sstevel@tonic-gate exit(1);
5897c478bd9Sstevel@tonic-gate }
5907c478bd9Sstevel@tonic-gate
591e1dd0a2fSth /*
592e1dd0a2fSth * kick off the thread which cleans up waiting threads for
593e1dd0a2fSth * GETSTATUSCHANGE
594e1dd0a2fSth */
595e1dd0a2fSth
596e1dd0a2fSth if (thr_create(NULL, 0, chg_cleanup_waiting_threads,
597e1dd0a2fSth NULL, 0, NULL) != 0) {
598e1dd0a2fSth logit("thr_create() chg_cleanup_waiting_threads call failed\n");
599e1dd0a2fSth syslog(LOG_ERR,
600e1dd0a2fSth gettext("ldap_cachemgr: thr_create() "
601e1dd0a2fSth "chg_cleanup_waiting_threads call failed"));
602e1dd0a2fSth exit(1);
603e1dd0a2fSth }
604e1dd0a2fSth
6057c478bd9Sstevel@tonic-gate #ifdef SLP
6067c478bd9Sstevel@tonic-gate if (use_slp) {
6077c478bd9Sstevel@tonic-gate /* kick off SLP discovery thread */
608e1dd0a2fSth if (thr_create(NULL, 0, (void *(*)(void *))discover,
6097ddae043Siz (void *)&refresh, 0, NULL) != 0) {
6107c478bd9Sstevel@tonic-gate logit("thr_create() call failed\n");
6117c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("ldap_cachemgr: thr_create() "
6127ddae043Siz "call failed"));
6137c478bd9Sstevel@tonic-gate perror("thr_create");
6147c478bd9Sstevel@tonic-gate exit(1);
6157c478bd9Sstevel@tonic-gate }
6167c478bd9Sstevel@tonic-gate }
6177c478bd9Sstevel@tonic-gate #endif /* SLP */
6187c478bd9Sstevel@tonic-gate
6197c478bd9Sstevel@tonic-gate if (thr_sigsetmask(SIG_UNBLOCK, &myset, NULL) < 0) {
6207c478bd9Sstevel@tonic-gate logit("thr_sigsetmask() call failed\n");
6217c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
6227ddae043Siz gettext("ldap_cachemgr: the_sigsetmask() call failed"));
6237c478bd9Sstevel@tonic-gate perror("thr_sigsetmask");
6247c478bd9Sstevel@tonic-gate exit(1);
6257c478bd9Sstevel@tonic-gate }
6267c478bd9Sstevel@tonic-gate
6277c478bd9Sstevel@tonic-gate /*CONSTCOND*/
6287c478bd9Sstevel@tonic-gate while (1) {
6297c478bd9Sstevel@tonic-gate (void) pause();
6307c478bd9Sstevel@tonic-gate }
631cb5caa98Sdjl /* NOTREACHED */
632cb5caa98Sdjl /*LINTED E_FUNC_HAS_NO_RETURN_STMT*/
6337c478bd9Sstevel@tonic-gate }
6347c478bd9Sstevel@tonic-gate
6357c478bd9Sstevel@tonic-gate
6367ddae043Siz /*
6377ddae043Siz * Before calling the alloca() function we have to be sure that we won't get
6387ddae043Siz * beyond the stack. Since we don't know the precise layout of the stack,
6397ddae043Siz * the address of an automatic of the function gives us a rough idea, plus/minus
6407ddae043Siz * a bit. We also need a bit more of stackspace after the call to be able
6417ddae043Siz * to call further functions. Even something as simple as making a system call
6427ddae043Siz * from within this function can take ~100 Bytes of stackspace.
6437ddae043Siz */
6447ddae043Siz #define SAFETY_BUFFER 32 * 1024 /* 32KB */
6457ddae043Siz
6467ddae043Siz static
6477ddae043Siz size_t
6487ddae043Siz get_data_size(LineBuf *config_info, int *err_code)
6497ddae043Siz {
6507ddae043Siz size_t configSize = sizeof (ldap_return_t);
6517ddae043Siz dataunion *buf = NULL; /* For the 'sizeof' purpose */
6527ddae043Siz
6537ddae043Siz if (config_info->str != NULL &&
6547ddae043Siz config_info->len >= sizeof (buf->data.ldap_ret.ldap_u.config)) {
6557ddae043Siz configSize = sizeof (buf->space) +
6567ddae043Siz config_info->len -
6577ddae043Siz sizeof (buf->data.ldap_ret.ldap_u.config);
6587ddae043Siz
6597ddae043Siz if (!stack_inbounds((char *)&buf -
6607ddae043Siz (configSize + SAFETY_BUFFER))) {
6617ddae043Siz /*
6627ddae043Siz * We do not have enough space on the stack
6637ddae043Siz * to accomodate the whole DUAProfile
6647ddae043Siz */
6657ddae043Siz logit("The DUAProfile is too big. There is not enough "
6667ddae043Siz "space to process it. Ignoring it.\n");
6677ddae043Siz syslog(LOG_ERR, gettext("ldap_cachemgr: The DUAProfile "
6687ddae043Siz "is too big. There is not enough space "
6697ddae043Siz "to process it. Ignoring it."));
6707ddae043Siz
671e1dd0a2fSth *err_code = NS_CACHE_SERVERERROR;
6727ddae043Siz
6737ddae043Siz free(config_info->str);
6747ddae043Siz config_info->str = NULL;
6757ddae043Siz config_info->len = 0;
6767ddae043Siz configSize = sizeof (ldap_return_t);
6777ddae043Siz }
6787ddae043Siz }
6797ddae043Siz
6807ddae043Siz return (configSize);
6817ddae043Siz }
6827ddae043Siz
6837c478bd9Sstevel@tonic-gate /*ARGSUSED*/
6847c478bd9Sstevel@tonic-gate static void
6857c478bd9Sstevel@tonic-gate switcher(void *cookie, char *argp, size_t arg_size,
6867c478bd9Sstevel@tonic-gate door_desc_t *dp, uint_t n_desc)
6877c478bd9Sstevel@tonic-gate {
6887ddae043Siz #define GETSIZE 1000
6897ddae043Siz #define ALLOCATE 1001
6907ddae043Siz
6917c478bd9Sstevel@tonic-gate ldap_call_t *ptr = (ldap_call_t *)argp;
6928142c2b2Schinlong ucred_t *uc = NULL;
6937c478bd9Sstevel@tonic-gate
6947ddae043Siz LineBuf configInfo;
6957ddae043Siz dataunion *buf = NULL;
696e1dd0a2fSth
6977ddae043Siz /*
6987ddae043Siz * By default the size of a buffer to be passed down to a client
6997ddae043Siz * is equal to the size of the ldap_return_t structure. We need
7007ddae043Siz * a bigger buffer in a few cases.
7017ddae043Siz */
7027ddae043Siz size_t configSize = sizeof (ldap_return_t);
7038142c2b2Schinlong int ldapErrno = 0, state, callnumber;
7047ddae043Siz struct {
7057ddae043Siz void *begin;
7067ddae043Siz size_t size;
7077ddae043Siz uint8_t destroy;
7087ddae043Siz } dataSource;
7097ddae043Siz
7107c478bd9Sstevel@tonic-gate if (argp == DOOR_UNREF_DATA) {
7117c478bd9Sstevel@tonic-gate logit("Door Slam... invalid door param\n");
7127c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("ldap_cachemgr: Door Slam... "
7137ddae043Siz "invalid door param"));
7147c478bd9Sstevel@tonic-gate (void) printf(gettext("Door Slam... invalid door param\n"));
7157c478bd9Sstevel@tonic-gate exit(0);
7167c478bd9Sstevel@tonic-gate }
7177c478bd9Sstevel@tonic-gate
7187c478bd9Sstevel@tonic-gate if (ptr == NULL) { /* empty door call */
7197c478bd9Sstevel@tonic-gate (void) door_return(NULL, 0, 0, 0); /* return the favor */
7207c478bd9Sstevel@tonic-gate }
7217c478bd9Sstevel@tonic-gate
7227ddae043Siz bzero(&dataSource, sizeof (dataSource));
7237ddae043Siz
7247ddae043Siz /*
7257ddae043Siz * We presume that sizeof (ldap_return_t) bytes are always available
7267ddae043Siz * on the stack
7277ddae043Siz */
7288142c2b2Schinlong callnumber = ptr->ldap_callnumber;
7297ddae043Siz
7308142c2b2Schinlong switch (callnumber) {
7317ddae043Siz case NULLCALL:
7327ddae043Siz /*
7337ddae043Siz * Just a 'ping'. Use the default size
7347ddae043Siz * of the buffer and set the
7357ddae043Siz * 'OK' error code.
7367ddae043Siz */
7377ddae043Siz state = ALLOCATE;
7387c478bd9Sstevel@tonic-gate break;
7397ddae043Siz case GETLDAPCONFIG:
7407ddae043Siz /*
7417ddae043Siz * Get the current LDAP configuration.
7427ddae043Siz * Since this is dynamic data and its size can exceed
7437ddae043Siz * the size of ldap_return_t, the next step will
744b57459abSJulian Pullen * calculate how much space exactly is required.
7457ddae043Siz */
7467ddae043Siz getldap_lookup(&configInfo, ptr);
7477ddae043Siz
748b57459abSJulian Pullen state = GETSIZE;
749b57459abSJulian Pullen break;
750b57459abSJulian Pullen case GETADMINCRED:
751b57459abSJulian Pullen /*
752b57459abSJulian Pullen * Get the current Admin Credentials (DN and password).
753b57459abSJulian Pullen * Since this is dynamic data and its size can exceed
754b57459abSJulian Pullen * the size of ldap_return_t, the next step will
755b57459abSJulian Pullen * calculate how much space exactly is required.
756b57459abSJulian Pullen */
757b57459abSJulian Pullen getldap_admincred(&configInfo, ptr);
758b57459abSJulian Pullen
7597ddae043Siz state = GETSIZE;
7607ddae043Siz break;
7617ddae043Siz case GETLDAPSERVER:
7627ddae043Siz /*
7637ddae043Siz * Get the root DSE for a next server in the list.
7647ddae043Siz * Since this is dynamic data and its size can exceed
7657ddae043Siz * the size of ldap_return_t, the next step will
766b57459abSJulian Pullen * calculate how much space exactly is required.
7677ddae043Siz */
7687ddae043Siz getldap_getserver(&configInfo, ptr);
7697ddae043Siz
7707ddae043Siz state = GETSIZE;
7717ddae043Siz break;
7727ddae043Siz case GETCACHESTAT:
7737ddae043Siz /*
7747ddae043Siz * Get the cache stattistics.
7757ddae043Siz * Since this is dynamic data and its size can exceed
7767ddae043Siz * the size of ldap_return_t, the next step will
7777ddae043Siz * calculate how much space exactly is required.
7787ddae043Siz */
7797ddae043Siz getldap_get_cacheStat(&configInfo);
7807ddae043Siz
7817ddae043Siz state = GETSIZE;
7827ddae043Siz break;
7837ddae043Siz case GETADMIN:
7847ddae043Siz /*
7857ddae043Siz * Get current configuration and statistics.
7867ddae043Siz * The size of the statistics structure is less then
7877ddae043Siz * sizeof (ldap_return_t). So specify the source
7887ddae043Siz * where to take the info and proceed with the memory
7897ddae043Siz * allocation.
7907ddae043Siz */
7917ddae043Siz state = ALLOCATE;
7927ddae043Siz
7937ddae043Siz if (ldapErrno == 0) {
7947ddae043Siz dataSource.begin = ¤t_admin;
7957ddae043Siz dataSource.size = sizeof (current_admin);
7967ddae043Siz dataSource.destroy = 0;
7977ddae043Siz }
7988142c2b2Schinlong break;
7998142c2b2Schinlong case KILLSERVER:
8008142c2b2Schinlong /*
8018142c2b2Schinlong * Process the request and proceed with the default
8028142c2b2Schinlong * buffer allocation.
8038142c2b2Schinlong */
8048142c2b2Schinlong if (is_root(1, "KILLSERVER", &uc))
8058142c2b2Schinlong exit(0);
8067ddae043Siz
8078142c2b2Schinlong ldapErrno = -1;
8088142c2b2Schinlong state = ALLOCATE;
8097ddae043Siz break;
8107ddae043Siz case SETADMIN:
8117ddae043Siz /*
8127ddae043Siz * Process the request and proceed with the default
8137ddae043Siz * buffer allocation.
8147ddae043Siz */
8158142c2b2Schinlong if (is_root(1, "SETADMIN", &uc))
8168142c2b2Schinlong ldapErrno = setadmin(ptr);
8178142c2b2Schinlong else
8187ddae043Siz ldapErrno = -1;
8197ddae043Siz
8207ddae043Siz state = ALLOCATE;
8217ddae043Siz break;
8227ddae043Siz case GETCACHE:
8237ddae043Siz /*
8247ddae043Siz * Get the cache stattistics.
8257ddae043Siz * Since this is dynamic data and its size can exceed
8267ddae043Siz * the size of ldap_return_t, the next step will
8277ddae043Siz * calculate how much space exactly is required.
8287ddae043Siz */
8297ddae043Siz getldap_get_cacheData(&configInfo, ptr);
8307ddae043Siz
8317ddae043Siz state = GETSIZE;
8327ddae043Siz break;
8337ddae043Siz case SETCACHE:
8347ddae043Siz /*
8357ddae043Siz * Process the request and proceed with the default
8367ddae043Siz * buffer allocation.
8377ddae043Siz */
8388142c2b2Schinlong if (is_root(0, "SETCACHE", &uc) &&
839e1dd0a2fSth is_called_from_nscd(ucred_getpid(uc))) {
8408142c2b2Schinlong ldapErrno = getldap_set_cacheData(ptr);
8418142c2b2Schinlong current_admin.ldap_stat.ldap_numbercalls++;
8428142c2b2Schinlong } else
8438142c2b2Schinlong ldapErrno = -1;
8447ddae043Siz
8458142c2b2Schinlong if (uc != NULL)
8468142c2b2Schinlong ucred_free(uc);
8477ddae043Siz state = ALLOCATE;
8487ddae043Siz break;
849dd1104fbSMichen Chang case ADMINMODIFY:
850dd1104fbSMichen Chang admin_modify(&configInfo, ptr);
851dd1104fbSMichen Chang
852dd1104fbSMichen Chang state = GETSIZE;
853dd1104fbSMichen Chang break;
854e1dd0a2fSth case GETSTATUSCHANGE:
855e1dd0a2fSth /*
856e1dd0a2fSth * Process the request and proceed with the default
857e1dd0a2fSth * buffer allocation.
858e1dd0a2fSth */
859e1dd0a2fSth (void) mutex_lock(&chg_threads_num_lock);
860e1dd0a2fSth chg_threads_num++;
861e1dd0a2fSth if (chg_threads_num > MAX_CHG_THREADS) {
862e1dd0a2fSth chg_threads_num--;
863e1dd0a2fSth (void) mutex_unlock(&chg_threads_num_lock);
864e1dd0a2fSth ldapErrno = CHG_EXCEED_MAX_THREADS;
865e1dd0a2fSth state = ALLOCATE;
866e1dd0a2fSth break;
867e1dd0a2fSth }
868e1dd0a2fSth (void) mutex_unlock(&chg_threads_num_lock);
869e1dd0a2fSth
870e1dd0a2fSth if (is_root(0, "GETSTATUSCHANGE", &uc) &&
871e1dd0a2fSth is_called_from_nscd(ucred_getpid(uc))) {
872e1dd0a2fSth ldapErrno = chg_get_statusChange(
873e1dd0a2fSth &configInfo, ptr, ucred_getpid(uc));
874e1dd0a2fSth state = GETSIZE;
875e1dd0a2fSth } else {
876e1dd0a2fSth ldapErrno = -1;
877e1dd0a2fSth state = ALLOCATE;
878e1dd0a2fSth }
879e1dd0a2fSth if (uc != NULL)
880e1dd0a2fSth ucred_free(uc);
881e1dd0a2fSth
882e1dd0a2fSth (void) mutex_lock(&chg_threads_num_lock);
883e1dd0a2fSth chg_threads_num--;
884e1dd0a2fSth (void) mutex_unlock(&chg_threads_num_lock);
885e1dd0a2fSth break;
8867ddae043Siz default:
8877ddae043Siz /*
8887ddae043Siz * This means an unknown request type. Proceed with
8897ddae043Siz * the default buffer allocation.
8907ddae043Siz */
8917ddae043Siz logit("Unknown ldap service door call op %d\n",
8927ddae043Siz ptr->ldap_callnumber);
8937ddae043Siz ldapErrno = -99;
8947ddae043Siz
8957ddae043Siz state = ALLOCATE;
8967ddae043Siz break;
8978142c2b2Schinlong }
8988142c2b2Schinlong
8998142c2b2Schinlong switch (state) {
9007ddae043Siz case GETSIZE:
9017ddae043Siz /*
9027ddae043Siz * This stage calculates how much data will be
9037ddae043Siz * passed down to the client, checks if there is
9047ddae043Siz * enough space on the stack to accommodate the data,
9057ddae043Siz * increases the value of the configSize variable
9067ddae043Siz * if necessary and specifies the data source.
9077ddae043Siz * In case of any error occurred ldapErrno will be set
9087ddae043Siz * appropriately.
9097ddae043Siz */
9107ddae043Siz if (configInfo.str == NULL) {
9117ddae043Siz ldapErrno = -1;
9127ddae043Siz }
9137ddae043Siz
9147ddae043Siz configSize = get_data_size(&configInfo, &ldapErrno);
9157ddae043Siz
9167ddae043Siz if (ldapErrno == 0) {
9177ddae043Siz dataSource.begin = configInfo.str;
9187ddae043Siz dataSource.size = configInfo.len;
9197ddae043Siz dataSource.destroy = 1;
9207ddae043Siz }
9217ddae043Siz
9227ddae043Siz current_admin.ldap_stat.ldap_numbercalls++;
9238142c2b2Schinlong /* FALLTHRU */
9247ddae043Siz case ALLOCATE:
9257ddae043Siz /*
9267ddae043Siz * Allocate a buffer of the calculated (or default) size
9277ddae043Siz * and proceed with populating it with data.
9287ddae043Siz */
9297ddae043Siz buf = (dataunion *) alloca(configSize);
9307ddae043Siz
9317ddae043Siz /*
9327ddae043Siz * Set a return code and, if a data source is specified,
9337ddae043Siz * copy data from the source to the buffer.
9347ddae043Siz */
9357ddae043Siz buf->data.ldap_ret.ldap_errno = ldapErrno;
9367ddae043Siz buf->data.ldap_ret.ldap_return_code = ldapErrno;
9377ddae043Siz buf->data.ldap_ret.ldap_bufferbytesused = configSize;
9387ddae043Siz
9397ddae043Siz if (dataSource.begin != NULL) {
9407ddae043Siz (void) memcpy(buf->data.ldap_ret.ldap_u.config,
9417ddae043Siz dataSource.begin,
9427ddae043Siz dataSource.size);
9437ddae043Siz if (dataSource.destroy) {
9447ddae043Siz free(dataSource.begin);
9457ddae043Siz }
9467ddae043Siz }
9477ddae043Siz
9487c478bd9Sstevel@tonic-gate }
9497ddae043Siz (void) door_return((char *)&buf->data,
9507ddae043Siz buf->data.ldap_ret.ldap_bufferbytesused,
9517ddae043Siz NULL,
9527ddae043Siz 0);
9537ddae043Siz #undef GETSIZE
9547ddae043Siz #undef ALLOCATE
9557c478bd9Sstevel@tonic-gate }
9567c478bd9Sstevel@tonic-gate
9577c478bd9Sstevel@tonic-gate static void
9587c478bd9Sstevel@tonic-gate usage(char *s)
9597c478bd9Sstevel@tonic-gate {
9607c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
9617ddae043Siz gettext("Usage: %s [-d debug_level] [-l logfilename]\n"), s);
9627c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(" [-K] "
9637ddae043Siz "[-r revalidate_interval] "));
9647c478bd9Sstevel@tonic-gate #ifndef SLP
9657c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(" [-g]\n"));
9667c478bd9Sstevel@tonic-gate #else
9677c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(" [-g] [-s]\n"));
9687c478bd9Sstevel@tonic-gate #endif /* SLP */
9697c478bd9Sstevel@tonic-gate exit(1);
9707c478bd9Sstevel@tonic-gate }
9717c478bd9Sstevel@tonic-gate
9727c478bd9Sstevel@tonic-gate
9737c478bd9Sstevel@tonic-gate static int logfd = -1;
9747c478bd9Sstevel@tonic-gate
9757c478bd9Sstevel@tonic-gate static int
9767c478bd9Sstevel@tonic-gate cachemgr_set_lf(admin_t *ptr, char *logfile)
9777c478bd9Sstevel@tonic-gate {
9787c478bd9Sstevel@tonic-gate int newlogfd;
9797c478bd9Sstevel@tonic-gate
9807c478bd9Sstevel@tonic-gate /*
9817c478bd9Sstevel@tonic-gate * we don't really want to try and open the log file
9827c478bd9Sstevel@tonic-gate * /dev/null since that will fail w/ our security fixes
9837c478bd9Sstevel@tonic-gate */
9847c478bd9Sstevel@tonic-gate
9857c478bd9Sstevel@tonic-gate if (logfile == NULL || *logfile == 0) {
9867c478bd9Sstevel@tonic-gate /*EMPTY*/;
9877c478bd9Sstevel@tonic-gate } else if (strcmp(logfile, "/dev/null") == 0) {
9887c478bd9Sstevel@tonic-gate (void) strcpy(current_admin.logfile, "/dev/null");
9897c478bd9Sstevel@tonic-gate (void) close(logfd);
9907c478bd9Sstevel@tonic-gate logfd = -1;
9917c478bd9Sstevel@tonic-gate } else {
9927c478bd9Sstevel@tonic-gate if ((newlogfd =
9937ddae043Siz open(logfile, O_EXCL|O_WRONLY|O_CREAT, 0644)) < 0) {
9947c478bd9Sstevel@tonic-gate /*
9957c478bd9Sstevel@tonic-gate * File already exists... now we need to get cute
9967c478bd9Sstevel@tonic-gate * since opening a file in a world-writeable directory
9977c478bd9Sstevel@tonic-gate * safely is hard = it could be a hard link or a
9987c478bd9Sstevel@tonic-gate * symbolic link to a system file.
9997c478bd9Sstevel@tonic-gate *
10007c478bd9Sstevel@tonic-gate */
10017c478bd9Sstevel@tonic-gate struct stat before;
10027c478bd9Sstevel@tonic-gate
10037c478bd9Sstevel@tonic-gate if (lstat(logfile, &before) < 0) {
10047c478bd9Sstevel@tonic-gate logit("Cannot open new logfile \"%s\": %sn",
10057ddae043Siz logfile, strerror(errno));
10067c478bd9Sstevel@tonic-gate return (-1);
10077c478bd9Sstevel@tonic-gate }
10087c478bd9Sstevel@tonic-gate if (S_ISREG(before.st_mode) && /* no symbolic links */
10097c478bd9Sstevel@tonic-gate (before.st_nlink == 1) && /* no hard links */
10107c478bd9Sstevel@tonic-gate (before.st_uid == 0)) { /* owned by root */
10117c478bd9Sstevel@tonic-gate if ((newlogfd =
10127c478bd9Sstevel@tonic-gate open(logfile,
10137c478bd9Sstevel@tonic-gate O_APPEND|O_WRONLY, 0644)) < 0) {
10147c478bd9Sstevel@tonic-gate logit("Cannot open new logfile "
10157ddae043Siz "\"%s\": %s\n",
10167ddae043Siz logfile, strerror(errno));
10177c478bd9Sstevel@tonic-gate return (-1);
10187c478bd9Sstevel@tonic-gate }
10197c478bd9Sstevel@tonic-gate } else {
10207c478bd9Sstevel@tonic-gate logit("Cannot use specified logfile "
10217c478bd9Sstevel@tonic-gate "\"%s\": file is/has links or isn't "
10227c478bd9Sstevel@tonic-gate "owned by root\n", logfile);
10237c478bd9Sstevel@tonic-gate return (-1);
10247c478bd9Sstevel@tonic-gate }
10257c478bd9Sstevel@tonic-gate }
10267c478bd9Sstevel@tonic-gate (void) strlcpy(ptr->logfile, logfile, sizeof (ptr->logfile));
10277c478bd9Sstevel@tonic-gate (void) close(logfd);
10287c478bd9Sstevel@tonic-gate logfd = newlogfd;
10297c478bd9Sstevel@tonic-gate logit("Starting ldap_cachemgr, logfile %s\n", logfile);
10307c478bd9Sstevel@tonic-gate }
10317c478bd9Sstevel@tonic-gate return (0);
10327c478bd9Sstevel@tonic-gate }
10337c478bd9Sstevel@tonic-gate
10347c478bd9Sstevel@tonic-gate /*PRINTFLIKE1*/
10357c478bd9Sstevel@tonic-gate void
10367c478bd9Sstevel@tonic-gate logit(char *format, ...)
10377c478bd9Sstevel@tonic-gate {
10387c478bd9Sstevel@tonic-gate static mutex_t loglock;
10397c478bd9Sstevel@tonic-gate struct timeval tv;
10407c478bd9Sstevel@tonic-gate char buffer[BUFSIZ];
10417c478bd9Sstevel@tonic-gate va_list ap;
10427c478bd9Sstevel@tonic-gate
10437c478bd9Sstevel@tonic-gate va_start(ap, format);
10447c478bd9Sstevel@tonic-gate
10457c478bd9Sstevel@tonic-gate if (logfd >= 0) {
10467c478bd9Sstevel@tonic-gate int safechars;
10477c478bd9Sstevel@tonic-gate
10487c478bd9Sstevel@tonic-gate (void) gettimeofday(&tv, NULL);
10497c478bd9Sstevel@tonic-gate (void) ctime_r(&tv.tv_sec, buffer, BUFSIZ);
10507c478bd9Sstevel@tonic-gate (void) snprintf(buffer+19, BUFSIZE, ".%.4ld ",
10517ddae043Siz tv.tv_usec/100);
10527c478bd9Sstevel@tonic-gate safechars = sizeof (buffer) - 30;
10537c478bd9Sstevel@tonic-gate if (vsnprintf(buffer+25, safechars, format, ap) > safechars)
10547c478bd9Sstevel@tonic-gate (void) strcat(buffer, "...\n");
10557c478bd9Sstevel@tonic-gate (void) mutex_lock(&loglock);
10567c478bd9Sstevel@tonic-gate (void) write(logfd, buffer, strlen(buffer));
10577c478bd9Sstevel@tonic-gate (void) mutex_unlock(&loglock);
10587c478bd9Sstevel@tonic-gate }
10597c478bd9Sstevel@tonic-gate va_end(ap);
10607c478bd9Sstevel@tonic-gate }
10617c478bd9Sstevel@tonic-gate
10627c478bd9Sstevel@tonic-gate
10637c478bd9Sstevel@tonic-gate static int
10647c478bd9Sstevel@tonic-gate client_getadmin(admin_t *ptr)
10657c478bd9Sstevel@tonic-gate {
10667c478bd9Sstevel@tonic-gate dataunion u;
10677c478bd9Sstevel@tonic-gate ldap_data_t *dptr;
10687c478bd9Sstevel@tonic-gate int ndata;
10697c478bd9Sstevel@tonic-gate int adata;
10707c478bd9Sstevel@tonic-gate
10717c478bd9Sstevel@tonic-gate u.data.ldap_call.ldap_callnumber = GETADMIN;
10727c478bd9Sstevel@tonic-gate ndata = sizeof (u);
10737c478bd9Sstevel@tonic-gate adata = sizeof (u.data);
10747c478bd9Sstevel@tonic-gate dptr = &u.data;
10757c478bd9Sstevel@tonic-gate
1076e1dd0a2fSth if (__ns_ldap_trydoorcall(&dptr, &ndata, &adata) != NS_CACHE_SUCCESS) {
10777c478bd9Sstevel@tonic-gate return (-1);
10787c478bd9Sstevel@tonic-gate }
10797c478bd9Sstevel@tonic-gate (void) memcpy(ptr, dptr->ldap_ret.ldap_u.buff, sizeof (*ptr));
10807c478bd9Sstevel@tonic-gate
10817c478bd9Sstevel@tonic-gate return (0);
10827c478bd9Sstevel@tonic-gate }
10837c478bd9Sstevel@tonic-gate
10847c478bd9Sstevel@tonic-gate
10857c478bd9Sstevel@tonic-gate static int
10867ddae043Siz setadmin(ldap_call_t *ptr)
10877c478bd9Sstevel@tonic-gate {
10887c478bd9Sstevel@tonic-gate admin_t *new;
10897c478bd9Sstevel@tonic-gate
10907c478bd9Sstevel@tonic-gate new = (admin_t *)ptr->ldap_u.domainname;
10917c478bd9Sstevel@tonic-gate
10927c478bd9Sstevel@tonic-gate /*
10937c478bd9Sstevel@tonic-gate * global admin stuff
10947c478bd9Sstevel@tonic-gate */
10957c478bd9Sstevel@tonic-gate
10967c478bd9Sstevel@tonic-gate if ((cachemgr_set_lf(¤t_admin, new->logfile) < 0) ||
10977c478bd9Sstevel@tonic-gate cachemgr_set_dl(¤t_admin, new->debug_level) < 0) {
10987c478bd9Sstevel@tonic-gate return (-1);
10997c478bd9Sstevel@tonic-gate }
11007c478bd9Sstevel@tonic-gate
11017c478bd9Sstevel@tonic-gate if (cachemgr_set_ttl(¤t_admin.ldap_stat,
11027ddae043Siz "ldap",
11037ddae043Siz new->ldap_stat.ldap_ttl) < 0) {
11047c478bd9Sstevel@tonic-gate return (-1);
11057c478bd9Sstevel@tonic-gate }
11067c478bd9Sstevel@tonic-gate
11077c478bd9Sstevel@tonic-gate return (0);
11087c478bd9Sstevel@tonic-gate }
11097c478bd9Sstevel@tonic-gate
11107c478bd9Sstevel@tonic-gate
11117c478bd9Sstevel@tonic-gate static void
11127c478bd9Sstevel@tonic-gate client_killserver()
11137c478bd9Sstevel@tonic-gate {
11147c478bd9Sstevel@tonic-gate dataunion u;
11157c478bd9Sstevel@tonic-gate ldap_data_t *dptr;
11167c478bd9Sstevel@tonic-gate int ndata;
11177c478bd9Sstevel@tonic-gate int adata;
11187c478bd9Sstevel@tonic-gate
11197c478bd9Sstevel@tonic-gate u.data.ldap_call.ldap_callnumber = KILLSERVER;
11207c478bd9Sstevel@tonic-gate ndata = sizeof (u);
11217c478bd9Sstevel@tonic-gate adata = sizeof (ldap_call_t);
11227c478bd9Sstevel@tonic-gate dptr = &u.data;
11237c478bd9Sstevel@tonic-gate
11247c478bd9Sstevel@tonic-gate __ns_ldap_trydoorcall(&dptr, &ndata, &adata);
11257c478bd9Sstevel@tonic-gate }
11267c478bd9Sstevel@tonic-gate
11277c478bd9Sstevel@tonic-gate
11287c478bd9Sstevel@tonic-gate static int
11297c478bd9Sstevel@tonic-gate client_setadmin(admin_t *ptr)
11307c478bd9Sstevel@tonic-gate {
11317c478bd9Sstevel@tonic-gate dataunion u;
11327c478bd9Sstevel@tonic-gate ldap_data_t *dptr;
11337c478bd9Sstevel@tonic-gate int ndata;
11347c478bd9Sstevel@tonic-gate int adata;
11357c478bd9Sstevel@tonic-gate
11367c478bd9Sstevel@tonic-gate u.data.ldap_call.ldap_callnumber = SETADMIN;
11377c478bd9Sstevel@tonic-gate (void) memcpy(u.data.ldap_call.ldap_u.domainname, ptr, sizeof (*ptr));
11387c478bd9Sstevel@tonic-gate ndata = sizeof (u);
11397c478bd9Sstevel@tonic-gate adata = sizeof (*ptr);
11407c478bd9Sstevel@tonic-gate dptr = &u.data;
11417c478bd9Sstevel@tonic-gate
1142e1dd0a2fSth if (__ns_ldap_trydoorcall(&dptr, &ndata, &adata) != NS_CACHE_SUCCESS) {
11437c478bd9Sstevel@tonic-gate return (-1);
11447c478bd9Sstevel@tonic-gate }
11457c478bd9Sstevel@tonic-gate
11467c478bd9Sstevel@tonic-gate return (0);
11477c478bd9Sstevel@tonic-gate }
11487c478bd9Sstevel@tonic-gate
11497c478bd9Sstevel@tonic-gate static int
11507c478bd9Sstevel@tonic-gate client_showstats(admin_t *ptr)
11517c478bd9Sstevel@tonic-gate {
11527c478bd9Sstevel@tonic-gate dataunion u;
11537c478bd9Sstevel@tonic-gate ldap_data_t *dptr;
11547c478bd9Sstevel@tonic-gate int ndata;
11557c478bd9Sstevel@tonic-gate int adata;
11567c478bd9Sstevel@tonic-gate char *rbuf, *sptr, *rest;
11577c478bd9Sstevel@tonic-gate
11587c478bd9Sstevel@tonic-gate /*
11597c478bd9Sstevel@tonic-gate * print admin data
11607c478bd9Sstevel@tonic-gate */
11617c478bd9Sstevel@tonic-gate (void) printf(gettext("\ncachemgr configuration:\n"));
11627c478bd9Sstevel@tonic-gate (void) printf(gettext("server debug level %10d\n"), ptr->debug_level);
11637c478bd9Sstevel@tonic-gate (void) printf(gettext("server log file\t\"%s\"\n"), ptr->logfile);
11647c478bd9Sstevel@tonic-gate (void) printf(gettext("number of calls to ldapcachemgr %10d\n"),
11657ddae043Siz ptr->ldap_stat.ldap_numbercalls);
11667c478bd9Sstevel@tonic-gate
11677c478bd9Sstevel@tonic-gate /*
11687c478bd9Sstevel@tonic-gate * get cache data statistics
11697c478bd9Sstevel@tonic-gate */
11707c478bd9Sstevel@tonic-gate u.data.ldap_call.ldap_callnumber = GETCACHESTAT;
11717c478bd9Sstevel@tonic-gate ndata = sizeof (u);
11727c478bd9Sstevel@tonic-gate adata = sizeof (ldap_call_t);
11737c478bd9Sstevel@tonic-gate dptr = &u.data;
11747c478bd9Sstevel@tonic-gate
1175e1dd0a2fSth if (__ns_ldap_trydoorcall(&dptr, &ndata, &adata) != NS_CACHE_SUCCESS) {
11767c478bd9Sstevel@tonic-gate (void) printf(
11777ddae043Siz gettext("\nCache data statistics not available!\n"));
11787c478bd9Sstevel@tonic-gate return (0);
11797c478bd9Sstevel@tonic-gate }
11807c478bd9Sstevel@tonic-gate
11817c478bd9Sstevel@tonic-gate /*
11827c478bd9Sstevel@tonic-gate * print cache data statistics line by line
11837c478bd9Sstevel@tonic-gate */
11847c478bd9Sstevel@tonic-gate (void) printf(gettext("\ncachemgr cache data statistics:\n"));
11857c478bd9Sstevel@tonic-gate rbuf = dptr->ldap_ret.ldap_u.buff;
11867c478bd9Sstevel@tonic-gate sptr = strtok_r(rbuf, DOORLINESEP, &rest);
11877c478bd9Sstevel@tonic-gate for (;;) {
11887c478bd9Sstevel@tonic-gate (void) printf("%s\n", sptr);
11897c478bd9Sstevel@tonic-gate sptr = strtok_r(NULL, DOORLINESEP, &rest);
11907c478bd9Sstevel@tonic-gate if (sptr == NULL)
11917c478bd9Sstevel@tonic-gate break;
11927c478bd9Sstevel@tonic-gate }
11937c478bd9Sstevel@tonic-gate return (0);
11947c478bd9Sstevel@tonic-gate }
11957c478bd9Sstevel@tonic-gate
11967c478bd9Sstevel@tonic-gate
11977c478bd9Sstevel@tonic-gate /*
11987c478bd9Sstevel@tonic-gate * detach from tty
11997c478bd9Sstevel@tonic-gate */
12007c478bd9Sstevel@tonic-gate static void
12017c478bd9Sstevel@tonic-gate detachfromtty(char *pgm)
12027c478bd9Sstevel@tonic-gate {
1203*fea136a0SMatt Barden int status;
12047c478bd9Sstevel@tonic-gate pid_t pid, wret;
12057c478bd9Sstevel@tonic-gate
12067c478bd9Sstevel@tonic-gate (void) close(0);
12077c478bd9Sstevel@tonic-gate (void) close(1);
12087c478bd9Sstevel@tonic-gate /*
12097c478bd9Sstevel@tonic-gate * Block the SIGUSR1 signal
12107c478bd9Sstevel@tonic-gate * just in case that the child
12117c478bd9Sstevel@tonic-gate * process may run faster than
12127c478bd9Sstevel@tonic-gate * the parent process and
12137c478bd9Sstevel@tonic-gate * send this signal before
12147c478bd9Sstevel@tonic-gate * the signal handler is ready
12157c478bd9Sstevel@tonic-gate * in the parent process.
12167c478bd9Sstevel@tonic-gate * This error will cause the parent
12177c478bd9Sstevel@tonic-gate * to exit with the User Signal 1
12187c478bd9Sstevel@tonic-gate * exit code (144).
12197c478bd9Sstevel@tonic-gate */
12207c478bd9Sstevel@tonic-gate (void) sighold(SIGUSR1);
12217c478bd9Sstevel@tonic-gate pid = fork1();
12227c478bd9Sstevel@tonic-gate switch (pid) {
12237c478bd9Sstevel@tonic-gate case (pid_t)-1:
12247c478bd9Sstevel@tonic-gate logit("detachfromtty(): fork1() call failed\n");
12257c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
12267ddae043Siz gettext("%s: fork1() call failed.\n"),
12277ddae043Siz pgm);
12287c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
12297ddae043Siz gettext("ldap_cachemgr: fork1() call failed."));
12307c478bd9Sstevel@tonic-gate exit(1);
12317c478bd9Sstevel@tonic-gate break;
12327c478bd9Sstevel@tonic-gate case 0:
12337c478bd9Sstevel@tonic-gate /*
12347c478bd9Sstevel@tonic-gate * child process does not
12357c478bd9Sstevel@tonic-gate * need to worry about
12367c478bd9Sstevel@tonic-gate * the SIGUSR1 signal
12377c478bd9Sstevel@tonic-gate */
12387c478bd9Sstevel@tonic-gate (void) sigrelse(SIGUSR1);
12397c478bd9Sstevel@tonic-gate (void) close(2);
12407c478bd9Sstevel@tonic-gate break;
12417c478bd9Sstevel@tonic-gate default:
12427c478bd9Sstevel@tonic-gate /*
12437c478bd9Sstevel@tonic-gate * Wait forever until the child process
12447c478bd9Sstevel@tonic-gate * has exited, or has signalled that at
12457c478bd9Sstevel@tonic-gate * least one server in the server list
12467c478bd9Sstevel@tonic-gate * is up.
12477c478bd9Sstevel@tonic-gate */
12487c478bd9Sstevel@tonic-gate if (signal(SIGUSR1, sig_ok_to_exit) == SIG_ERR) {
12497c478bd9Sstevel@tonic-gate logit("detachfromtty(): "
12507ddae043Siz "can't set up signal handler to "
12517ddae043Siz " catch SIGUSR1.\n");
12527c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
12537ddae043Siz gettext("%s: signal() call failed.\n"),
12547ddae043Siz pgm);
12557c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("ldap_cachemgr: "
12567ddae043Siz "can't set up signal handler to "
12577ddae043Siz " catch SIGUSR1."));
12587c478bd9Sstevel@tonic-gate exit(1);
12597c478bd9Sstevel@tonic-gate }
12607c478bd9Sstevel@tonic-gate
12617c478bd9Sstevel@tonic-gate /*
12627c478bd9Sstevel@tonic-gate * now unblock the SIGUSR1 signal
12637c478bd9Sstevel@tonic-gate * to handle the pending or
12647c478bd9Sstevel@tonic-gate * soon to arrive SIGUSR1 signal
12657c478bd9Sstevel@tonic-gate */
12667c478bd9Sstevel@tonic-gate (void) sigrelse(SIGUSR1);
12677c478bd9Sstevel@tonic-gate wret = waitpid(pid, &status, 0);
12687c478bd9Sstevel@tonic-gate
12697c478bd9Sstevel@tonic-gate if (wret == -1) {
12707c478bd9Sstevel@tonic-gate logit("detachfromtty(): "
12717ddae043Siz "waitpid() call failed\n");
12727c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
12737ddae043Siz gettext("%s: waitpid() call failed.\n"),
12747ddae043Siz pgm);
12757c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
12767ddae043Siz gettext("ldap_cachemgr: waitpid() "
12777ddae043Siz "call failed."));
12787c478bd9Sstevel@tonic-gate exit(1);
12797c478bd9Sstevel@tonic-gate }
12807c478bd9Sstevel@tonic-gate if (wret != pid) {
12817c478bd9Sstevel@tonic-gate logit("detachfromtty(): "
12827ddae043Siz "waitpid() returned %ld when "
12837ddae043Siz "child pid was %ld\n",
12847ddae043Siz wret, pid);
12857c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
12867ddae043Siz gettext(
12877ddae043Siz "%s: waitpid() returned %ld when "
12887ddae043Siz "child pid was %ld.\n"),
12897ddae043Siz pgm, wret, pid);
12907c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
12917ddae043Siz gettext("ldap_cachemgr: waitpid() "
12927ddae043Siz "returned different "
12937ddae043Siz "child pid."));
12947c478bd9Sstevel@tonic-gate exit(1);
12957c478bd9Sstevel@tonic-gate }
12967c478bd9Sstevel@tonic-gate
12977c478bd9Sstevel@tonic-gate /* evaluate return status */
12987c478bd9Sstevel@tonic-gate if (WIFEXITED(status)) {
12997c478bd9Sstevel@tonic-gate if (WEXITSTATUS(status) == 0) {
13007c478bd9Sstevel@tonic-gate exit(0);
13017c478bd9Sstevel@tonic-gate }
13027c478bd9Sstevel@tonic-gate logit("detachfromtty(): "
13037ddae043Siz "child failed (rc = %d).\n",
13047ddae043Siz WEXITSTATUS(status));
13057c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
13067ddae043Siz gettext("%s: failed. Please see "
13077ddae043Siz "syslog for details.\n"),
13087ddae043Siz pgm);
13097c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
13107ddae043Siz gettext("ldap_cachemgr: failed "
13117ddae043Siz "(rc = %d)."),
13127ddae043Siz WEXITSTATUS(status));
13137c478bd9Sstevel@tonic-gate } else if (WIFSIGNALED(status)) {
13147c478bd9Sstevel@tonic-gate logit("detachfromtty(): "
13157ddae043Siz "child terminated by signal %d.\n",
13167ddae043Siz WTERMSIG(status));
13177c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
13187c478bd9Sstevel@tonic-gate gettext("%s: terminated by signal %d.\n"),
13197ddae043Siz pgm, WTERMSIG(status));
13207c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
13217ddae043Siz gettext("ldap_cachemgr: terminated by "
13227ddae043Siz "signal %d.\n"),
13237ddae043Siz WTERMSIG(status));
13247c478bd9Sstevel@tonic-gate } else if (WCOREDUMP(status)) {
13257c478bd9Sstevel@tonic-gate logit("detachfromtty(): child core dumped.\n"),
13267ddae043Siz (void) fprintf(stderr,
13277ddae043Siz gettext("%s: core dumped.\n"),
13287ddae043Siz pgm);
13297c478bd9Sstevel@tonic-gate syslog(LOG_ERR,
13307ddae043Siz gettext("ldap_cachemgr: "
13317ddae043Siz "core dumped.\n"));
13327c478bd9Sstevel@tonic-gate }
13337c478bd9Sstevel@tonic-gate
13347c478bd9Sstevel@tonic-gate exit(1);
13357c478bd9Sstevel@tonic-gate }
13367c478bd9Sstevel@tonic-gate (void) setsid();
13377c478bd9Sstevel@tonic-gate if (open("/dev/null", O_RDWR, 0) != -1) {
13387c478bd9Sstevel@tonic-gate (void) dup(0);
13397c478bd9Sstevel@tonic-gate (void) dup(0);
13407c478bd9Sstevel@tonic-gate }
13417c478bd9Sstevel@tonic-gate }
13428142c2b2Schinlong
13438142c2b2Schinlong /*
13448142c2b2Schinlong * Check if the door client's euid is 0
13458142c2b2Schinlong *
13468142c2b2Schinlong * We could check for some privilege or re-design the interfaces that
13478142c2b2Schinlong * lead to is_root() being called so that we rely on SMF and RBAC, but
13488142c2b2Schinlong * we need this check only for dealing with undocumented-but-possibly-
13498142c2b2Schinlong * used interfaces. Anything beyond checking for euid == 0 here would
13508142c2b2Schinlong * be overkill considering that those are undocumented interfaces.
13518142c2b2Schinlong *
13528142c2b2Schinlong * If free_uc is 0, the caller is responsible for freeing *ucp.
13538142c2b2Schinlong *
13548142c2b2Schinlong * return - 0 euid != 0
13558142c2b2Schinlong * 1 euid == 0
13568142c2b2Schinlong */
13578142c2b2Schinlong static int
13588142c2b2Schinlong is_root(int free_uc, char *dc_str, ucred_t **ucp)
13598142c2b2Schinlong {
13608142c2b2Schinlong int rc;
13618142c2b2Schinlong
13628142c2b2Schinlong if (door_ucred(ucp) != 0) {
13638142c2b2Schinlong rc = errno;
13648142c2b2Schinlong logit("door_ucred() call failed %s\n", strerror(rc));
13658142c2b2Schinlong syslog(LOG_ERR, gettext("ldap_cachemgr: door_ucred() call %s "
13668142c2b2Schinlong "failed %s"), strerror(rc));
13678142c2b2Schinlong return (0);
13688142c2b2Schinlong }
13698142c2b2Schinlong
13708142c2b2Schinlong
13718142c2b2Schinlong if (ucred_geteuid(*ucp) != 0) {
13728142c2b2Schinlong
13738142c2b2Schinlong if (current_admin.debug_level >= DBG_CANT_FIND)
13748142c2b2Schinlong logit("%s call failed(cred): caller pid %ld, uid %u, "
1375dd1104fbSMichen Chang "euid %u (if uid or euid is %u, it may be "
1376dd1104fbSMichen Chang "unavailable)\n", dc_str, ucred_getpid(*ucp),
1377dd1104fbSMichen Chang ucred_getruid(*ucp), ucred_geteuid(*ucp), -1);
13788142c2b2Schinlong
13798142c2b2Schinlong rc = 0;
13808142c2b2Schinlong } else {
13818142c2b2Schinlong
13828142c2b2Schinlong if (current_admin.debug_level >= DBG_ALL)
1383dd1104fbSMichen Chang logit("received %s call from pid %ld, uid %u, euid %u "
1384dd1104fbSMichen Chang "(if uid or euid is %u, it may be unavailable)\n",
1385dd1104fbSMichen Chang dc_str, ucred_getpid(*ucp), ucred_getruid(*ucp),
1386dd1104fbSMichen Chang ucred_geteuid(*ucp), -1);
13878142c2b2Schinlong rc = 1;
13888142c2b2Schinlong }
13898142c2b2Schinlong
13908142c2b2Schinlong if (free_uc)
13918142c2b2Schinlong ucred_free(*ucp);
13928142c2b2Schinlong
13938142c2b2Schinlong return (rc);
13948142c2b2Schinlong }
13958142c2b2Schinlong
13968142c2b2Schinlong /*
13978142c2b2Schinlong * Check if pid is nscd
13988142c2b2Schinlong *
13998142c2b2Schinlong * Input: pid - process id of the door client that calls ldap_cachemgr
14008142c2b2Schinlong *
14018142c2b2Schinlong * Return: 0 - No
14028142c2b2Schinlong * 1 - Yes
14038142c2b2Schinlong */
14048142c2b2Schinlong
1405e1dd0a2fSth int
1406e1dd0a2fSth is_called_from_nscd(pid_t pid)
14078142c2b2Schinlong {
14088142c2b2Schinlong static mutex_t _door_lock = DEFAULTMUTEX;
14098142c2b2Schinlong static int doorfd = -1;
14108142c2b2Schinlong int match;
1411eb28af62SToomas Soome door_info_t my_door;
14128142c2b2Schinlong
14138142c2b2Schinlong /*
14148142c2b2Schinlong * the first time in we try and open and validate the door.
14158142c2b2Schinlong * the validations are that the door must have been
14168142c2b2Schinlong * created with the door cookie and
14178142c2b2Schinlong * that the file attached to the door is owned by root
14188142c2b2Schinlong * and readonly by user, group and other. If any of these
14198142c2b2Schinlong * validations fail we refuse to use the door.
14208142c2b2Schinlong */
14218142c2b2Schinlong
14228142c2b2Schinlong (void) mutex_lock(&_door_lock);
14238142c2b2Schinlong
14248142c2b2Schinlong try_again:
14258142c2b2Schinlong
14268142c2b2Schinlong if (doorfd == -1) {
14278142c2b2Schinlong
14288142c2b2Schinlong if ((doorfd = open(NAME_SERVICE_DOOR, O_RDONLY, 0))
14298142c2b2Schinlong == -1) {
14308142c2b2Schinlong (void) mutex_unlock(&_door_lock);
14318142c2b2Schinlong return (0);
14328142c2b2Schinlong }
14338142c2b2Schinlong
14348142c2b2Schinlong if (door_info(doorfd, &my_door) == -1 ||
14358142c2b2Schinlong (my_door.di_attributes & DOOR_REVOKED) ||
14368142c2b2Schinlong my_door.di_data != (uintptr_t)NAME_SERVICE_DOOR_COOKIE) {
14378142c2b2Schinlong /*
14388142c2b2Schinlong * we should close doorfd because we just opened it
14398142c2b2Schinlong */
14408142c2b2Schinlong (void) close(doorfd);
14418142c2b2Schinlong doorfd = -1;
14428142c2b2Schinlong (void) mutex_unlock(&_door_lock);
14438142c2b2Schinlong return (0);
14448142c2b2Schinlong }
14458142c2b2Schinlong } else {
14468142c2b2Schinlong /*
14478142c2b2Schinlong * doorfd is cached. Double check just in case
14488142c2b2Schinlong * the door server is restarted or is down.
14498142c2b2Schinlong */
14508142c2b2Schinlong if (door_info(doorfd, &my_door) == -1 ||
14518142c2b2Schinlong my_door.di_data != (uintptr_t)NAME_SERVICE_DOOR_COOKIE) {
14528142c2b2Schinlong /*
14538142c2b2Schinlong * don't close it -
14548142c2b2Schinlong * someone else has clobbered fd
14558142c2b2Schinlong */
14568142c2b2Schinlong doorfd = -1;
14578142c2b2Schinlong goto try_again;
14588142c2b2Schinlong }
14598142c2b2Schinlong
14608142c2b2Schinlong if (my_door.di_attributes & DOOR_REVOKED) {
14618142c2b2Schinlong (void) close(doorfd);
14628142c2b2Schinlong doorfd = -1; /* try and restart connection */
14638142c2b2Schinlong goto try_again;
14648142c2b2Schinlong }
14658142c2b2Schinlong }
14668142c2b2Schinlong
14678142c2b2Schinlong /*
14688142c2b2Schinlong * door descriptor exists and is valid
14698142c2b2Schinlong */
14708142c2b2Schinlong if (pid == my_door.di_target)
14718142c2b2Schinlong match = 1;
14728142c2b2Schinlong else
14738142c2b2Schinlong match = 0;
14748142c2b2Schinlong
14758142c2b2Schinlong (void) mutex_unlock(&_door_lock);
14768142c2b2Schinlong
14778142c2b2Schinlong return (match);
14788142c2b2Schinlong
14798142c2b2Schinlong }
1480dd1104fbSMichen Chang
1481dd1104fbSMichen Chang /*
1482dd1104fbSMichen Chang * new_attr(name, value)
1483dd1104fbSMichen Chang *
1484dd1104fbSMichen Chang * create a new LDAP attribute to be sent to the server
1485dd1104fbSMichen Chang */
1486dd1104fbSMichen Chang static ns_ldap_attr_t *
1487dd1104fbSMichen Chang new_attr(char *name, char *value)
1488dd1104fbSMichen Chang {
1489dd1104fbSMichen Chang ns_ldap_attr_t *tmp;
1490dd1104fbSMichen Chang
1491dd1104fbSMichen Chang tmp = malloc(sizeof (*tmp));
1492dd1104fbSMichen Chang if (tmp != NULL) {
1493dd1104fbSMichen Chang tmp->attrname = name;
1494dd1104fbSMichen Chang tmp->attrvalue = (char **)calloc(2, sizeof (char *));
1495dd1104fbSMichen Chang if (tmp->attrvalue == NULL) {
1496dd1104fbSMichen Chang free(tmp);
1497dd1104fbSMichen Chang return (NULL);
1498dd1104fbSMichen Chang }
1499dd1104fbSMichen Chang tmp->attrvalue[0] = value;
1500dd1104fbSMichen Chang tmp->value_count = 1;
1501dd1104fbSMichen Chang }
1502dd1104fbSMichen Chang
1503dd1104fbSMichen Chang return (tmp);
1504dd1104fbSMichen Chang }
1505dd1104fbSMichen Chang
1506dd1104fbSMichen Chang /*
1507dd1104fbSMichen Chang * Convert the flatten ldap attributes in a ns_ldap_attr_t back
1508dd1104fbSMichen Chang * to an ns_ldap_attr_t array.
1509dd1104fbSMichen Chang *
1510dd1104fbSMichen Chang * strlist->ldap_offsets[] contains offsets to strings:
1511dd1104fbSMichen Chang * "dn", <dn value>, <attr 1>, <attrval 1>, ... <attr n>, <attrval n>
1512dd1104fbSMichen Chang * where n is (strlist->ldap_count/2 -1).
1513dd1104fbSMichen Chang * The output ns_ldap_attr_t array has a size of (strlist->ldap_count/2)
1514dd1104fbSMichen Chang * the first (strlist->ldap_count/2 -1) contains all the attribute data,
1515dd1104fbSMichen Chang * the last one is a NULL pointer. DN will be extracted out and pointed
1516dd1104fbSMichen Chang * to by *dn.
1517dd1104fbSMichen Chang */
1518dd1104fbSMichen Chang static ns_ldap_attr_t **
1519dd1104fbSMichen Chang str2attrs(ldap_strlist_t *strlist, char **dn)
1520dd1104fbSMichen Chang {
1521dd1104fbSMichen Chang int c;
1522dd1104fbSMichen Chang int i;
1523dd1104fbSMichen Chang int j;
1524dd1104fbSMichen Chang ns_ldap_attr_t **ret;
1525dd1104fbSMichen Chang
1526dd1104fbSMichen Chang c = strlist->ldap_count;
1527dd1104fbSMichen Chang ret = calloc(c/2, sizeof (ns_ldap_attr_t *));
1528dd1104fbSMichen Chang if (ret == NULL)
1529dd1104fbSMichen Chang return (NULL);
1530dd1104fbSMichen Chang *dn = (char *)strlist + strlist->ldap_offsets[1];
1531dd1104fbSMichen Chang
1532dd1104fbSMichen Chang /*
1533dd1104fbSMichen Chang * skip the first 'dn'/<dn value> pair, for all other attr type/value
1534dd1104fbSMichen Chang * pairs, get pointers to the attr type (offset [i]) and attr value
1535dd1104fbSMichen Chang * (offset [i+1]) and put in ns_ldap_attr_t at ret[j]
1536dd1104fbSMichen Chang */
1537dd1104fbSMichen Chang for (i = 2, j = 0; i < c; i = i + 2, j++) {
1538dd1104fbSMichen Chang ret[j] = new_attr((char *)strlist + strlist->ldap_offsets[i],
1539dd1104fbSMichen Chang (char *)strlist + strlist->ldap_offsets[i + 1]);
1540dd1104fbSMichen Chang }
1541dd1104fbSMichen Chang return (ret);
1542dd1104fbSMichen Chang }
1543dd1104fbSMichen Chang
1544dd1104fbSMichen Chang static int
1545dd1104fbSMichen Chang get_admin_dn(ns_cred_t *credp, int *status, ns_ldap_error_t **errorp)
1546dd1104fbSMichen Chang {
1547dd1104fbSMichen Chang void **paramVal = NULL;
1548dd1104fbSMichen Chang int rc;
1549dd1104fbSMichen Chang
1550dd1104fbSMichen Chang /* get bind DN for shadow update */
1551dd1104fbSMichen Chang rc = __ns_ldap_getParam(NS_LDAP_ADMIN_BINDDN_P,
1552dd1104fbSMichen Chang ¶mVal, errorp);
1553dd1104fbSMichen Chang if (rc != NS_LDAP_SUCCESS)
1554dd1104fbSMichen Chang return (rc);
1555dd1104fbSMichen Chang
1556dd1104fbSMichen Chang if (paramVal == NULL || *paramVal == NULL) {
1557dd1104fbSMichen Chang rc = NS_LDAP_CONFIG;
1558dd1104fbSMichen Chang *status = NS_CONFIG_NOTALLOW;
1559dd1104fbSMichen Chang if (paramVal != NULL)
1560dd1104fbSMichen Chang (void) __ns_ldap_freeParam(¶mVal);
1561dd1104fbSMichen Chang return (rc);
1562dd1104fbSMichen Chang }
1563dd1104fbSMichen Chang credp->cred.unix_cred.userID = strdup((char *)*paramVal);
1564dd1104fbSMichen Chang (void) __ns_ldap_freeParam(¶mVal);
1565dd1104fbSMichen Chang if (credp->cred.unix_cred.userID == NULL)
1566dd1104fbSMichen Chang return (NS_LDAP_MEMORY);
1567dd1104fbSMichen Chang
1568dd1104fbSMichen Chang return (NS_LDAP_SUCCESS);
1569dd1104fbSMichen Chang }
1570dd1104fbSMichen Chang
1571dd1104fbSMichen Chang /*
1572dd1104fbSMichen Chang * admin_modify() does a privileged modify within the ldap_cachemgr daemon
1573dd1104fbSMichen Chang * process using the admin DN/password configured with parameters
1574dd1104fbSMichen Chang * NS_LDAP_ADMIN_BINDDN and NS_LDAP_ADMIN_BINDPASSWD. It will only
1575dd1104fbSMichen Chang * be done if NS_LDAP_ENABLE_SHADOW_UPDATE is set to TRUE.
1576dd1104fbSMichen Chang *
1577dd1104fbSMichen Chang * The input ldap_call_t (*in) contains LDAP shadowAccount attributes to
1578dd1104fbSMichen Chang * be modified. The data is a flatten ns_ldap_attr_t arrary stored in
1579dd1104fbSMichen Chang * the strlist element of the input ldap_call_t.
1580dd1104fbSMichen Chang * The output will be in LineBuf (*config_info), an ldap_admin_mod_result_t
1581dd1104fbSMichen Chang * structure that contains error code, error status, and error message.
1582dd1104fbSMichen Chang */
1583dd1104fbSMichen Chang static void
1584dd1104fbSMichen Chang admin_modify(LineBuf *config_info, ldap_call_t *in)
1585dd1104fbSMichen Chang {
1586dd1104fbSMichen Chang int rc = NS_LDAP_SUCCESS;
1587dd1104fbSMichen Chang int authstried = 0;
1588dd1104fbSMichen Chang int shadow_enabled = 0;
1589dd1104fbSMichen Chang char *dn = NULL;
1590dd1104fbSMichen Chang char **certpath = NULL;
1591dd1104fbSMichen Chang char **enable_shadow = NULL;
1592dd1104fbSMichen Chang ns_auth_t **app;
1593dd1104fbSMichen Chang ns_auth_t **authpp = NULL;
1594dd1104fbSMichen Chang ns_auth_t *authp = NULL;
1595dd1104fbSMichen Chang ns_cred_t *credp = NULL;
1596dd1104fbSMichen Chang char buffer[MAXERROR];
1597dd1104fbSMichen Chang const int rlen = offsetof(ldap_admin_mod_result_t, msg);
1598dd1104fbSMichen Chang int mlen = 0;
1599dd1104fbSMichen Chang const int msgmax = MAXERROR - rlen;
1600dd1104fbSMichen Chang int status = 0;
1601dd1104fbSMichen Chang ucred_t *uc = NULL;
1602dd1104fbSMichen Chang ldap_strlist_t *strlist;
1603dd1104fbSMichen Chang ns_ldap_attr_t **attrs = NULL;
1604dd1104fbSMichen Chang ns_ldap_error_t *error = NULL;
1605dd1104fbSMichen Chang ldap_admin_mod_result_t *result;
1606dd1104fbSMichen Chang
1607dd1104fbSMichen Chang (void) memset((char *)config_info, 0, sizeof (LineBuf));
1608dd1104fbSMichen Chang
1609dd1104fbSMichen Chang /* only root or an ALL privs user can do admin modify */
1610dd1104fbSMichen Chang if (is_root_or_all_privs("ADMINMODIFY", &uc) == 0) {
1611dd1104fbSMichen Chang mlen = snprintf(buffer, msgmax, "%s",
1612dd1104fbSMichen Chang gettext("shadow update by a non-root and no ALL privilege "
1613dd1104fbSMichen Chang "user not allowed"));
1614dd1104fbSMichen Chang rc = NS_LDAP_CONFIG;
1615dd1104fbSMichen Chang goto out;
1616dd1104fbSMichen Chang }
1617dd1104fbSMichen Chang
1618dd1104fbSMichen Chang /* check to see if shadow update is enabled */
1619dd1104fbSMichen Chang rc = __ns_ldap_getParam(NS_LDAP_ENABLE_SHADOW_UPDATE_P,
1620dd1104fbSMichen Chang (void ***)&enable_shadow, &error);
1621dd1104fbSMichen Chang if (rc != NS_LDAP_SUCCESS)
1622dd1104fbSMichen Chang goto out;
1623dd1104fbSMichen Chang if (enable_shadow != NULL && *enable_shadow != NULL) {
1624dd1104fbSMichen Chang shadow_enabled = (*(int *)enable_shadow[0] ==
1625dd1104fbSMichen Chang NS_LDAP_ENABLE_SHADOW_UPDATE_TRUE);
1626dd1104fbSMichen Chang }
1627dd1104fbSMichen Chang if (enable_shadow != NULL)
1628dd1104fbSMichen Chang (void) __ns_ldap_freeParam((void ***)&enable_shadow);
1629dd1104fbSMichen Chang if (shadow_enabled == 0) {
1630dd1104fbSMichen Chang rc = NS_LDAP_CONFIG;
1631dd1104fbSMichen Chang status = NS_CONFIG_NOTALLOW;
1632dd1104fbSMichen Chang mlen = snprintf(buffer, msgmax, "%s",
1633dd1104fbSMichen Chang gettext("shadow update not enabled"));
1634dd1104fbSMichen Chang goto out;
1635dd1104fbSMichen Chang }
1636dd1104fbSMichen Chang
1637dd1104fbSMichen Chang /* convert attributes in string buffer into an ldap attribute array */
1638dd1104fbSMichen Chang strlist = &in->ldap_u.strlist;
1639dd1104fbSMichen Chang attrs = str2attrs(strlist, &dn);
1640dd1104fbSMichen Chang if (attrs == NULL || *attrs == NULL || dn == NULL || *dn == '\0') {
1641dd1104fbSMichen Chang rc = NS_LDAP_INVALID_PARAM;
1642dd1104fbSMichen Chang goto out;
1643dd1104fbSMichen Chang }
1644dd1104fbSMichen Chang
1645dd1104fbSMichen Chang if ((credp = (ns_cred_t *)calloc(1, sizeof (ns_cred_t))) == NULL) {
1646dd1104fbSMichen Chang rc = NS_LDAP_MEMORY;
1647dd1104fbSMichen Chang goto out;
1648dd1104fbSMichen Chang }
1649dd1104fbSMichen Chang
1650dd1104fbSMichen Chang /* get host certificate path, if one is configured */
1651dd1104fbSMichen Chang rc = __ns_ldap_getParam(NS_LDAP_HOST_CERTPATH_P,
1652dd1104fbSMichen Chang (void ***)&certpath, &error);
1653dd1104fbSMichen Chang if (rc != NS_LDAP_SUCCESS)
1654dd1104fbSMichen Chang goto out;
1655dd1104fbSMichen Chang if (certpath != NULL && *certpath != NULL) {
1656dd1104fbSMichen Chang credp->hostcertpath = strdup(*certpath);
1657dd1104fbSMichen Chang if (credp->hostcertpath == NULL)
1658dd1104fbSMichen Chang rc = NS_LDAP_MEMORY;
1659dd1104fbSMichen Chang }
1660dd1104fbSMichen Chang if (certpath != NULL)
1661dd1104fbSMichen Chang (void) __ns_ldap_freeParam((void ***)&certpath);
1662dd1104fbSMichen Chang if (rc != NS_LDAP_SUCCESS)
1663dd1104fbSMichen Chang goto out;
1664dd1104fbSMichen Chang
1665dd1104fbSMichen Chang /* Load the service specific authentication method */
1666dd1104fbSMichen Chang rc = __ns_ldap_getServiceAuthMethods("passwd-cmd", &authpp,
1667dd1104fbSMichen Chang &error);
1668dd1104fbSMichen Chang if (rc != NS_LDAP_SUCCESS) {
1669dd1104fbSMichen Chang if (credp->hostcertpath != NULL)
1670dd1104fbSMichen Chang free(credp->hostcertpath);
1671dd1104fbSMichen Chang goto out;
1672dd1104fbSMichen Chang }
1673dd1104fbSMichen Chang
1674dd1104fbSMichen Chang /*
1675dd1104fbSMichen Chang * if authpp is null, there is no serviceAuthenticationMethod
1676dd1104fbSMichen Chang * try default authenticationMethod
1677dd1104fbSMichen Chang */
1678dd1104fbSMichen Chang if (authpp == NULL) {
1679dd1104fbSMichen Chang rc = __ns_ldap_getParam(NS_LDAP_AUTH_P, (void ***)&authpp,
1680dd1104fbSMichen Chang &error);
1681dd1104fbSMichen Chang if (rc != NS_LDAP_SUCCESS)
1682dd1104fbSMichen Chang goto out;
1683dd1104fbSMichen Chang }
1684dd1104fbSMichen Chang
1685dd1104fbSMichen Chang /*
1686dd1104fbSMichen Chang * if authpp is still null, then can not authenticate, syslog
1687dd1104fbSMichen Chang * error message and return error
1688dd1104fbSMichen Chang */
1689dd1104fbSMichen Chang if (authpp == NULL) {
1690dd1104fbSMichen Chang rc = NS_LDAP_CONFIG;
1691dd1104fbSMichen Chang mlen = snprintf(buffer, msgmax, "%s",
1692dd1104fbSMichen Chang gettext("No legal LDAP authentication method configured"));
1693dd1104fbSMichen Chang goto out;
1694dd1104fbSMichen Chang }
1695dd1104fbSMichen Chang
1696dd1104fbSMichen Chang /*
1697dd1104fbSMichen Chang * Walk the array and try all authentication methods in order except
1698dd1104fbSMichen Chang * for "none".
1699dd1104fbSMichen Chang */
1700dd1104fbSMichen Chang for (app = authpp; *app; app++) {
1701dd1104fbSMichen Chang authp = *app;
1702dd1104fbSMichen Chang if (authp->type == NS_LDAP_AUTH_NONE)
1703dd1104fbSMichen Chang continue;
1704dd1104fbSMichen Chang authstried++;
1705dd1104fbSMichen Chang credp->auth.type = authp->type;
1706dd1104fbSMichen Chang credp->auth.tlstype = authp->tlstype;
1707dd1104fbSMichen Chang credp->auth.saslmech = authp->saslmech;
1708dd1104fbSMichen Chang credp->auth.saslopt = authp->saslopt;
1709dd1104fbSMichen Chang
1710dd1104fbSMichen Chang /*
1711dd1104fbSMichen Chang * For GSSAPI, host credential will be used. No admin
1712dd1104fbSMichen Chang * DN is needed. For other authentication methods,
1713dd1104fbSMichen Chang * we need to set admin.
1714dd1104fbSMichen Chang */
1715dd1104fbSMichen Chang if (credp->auth.saslmech != NS_LDAP_SASL_GSSAPI) {
1716dd1104fbSMichen Chang if ((rc = get_admin_dn(credp, &status,
1717dd1104fbSMichen Chang &error)) != NS_LDAP_SUCCESS) {
1718dd1104fbSMichen Chang if (error != NULL)
1719dd1104fbSMichen Chang goto out;
1720dd1104fbSMichen Chang if (status == NS_CONFIG_NOTALLOW) {
1721dd1104fbSMichen Chang mlen = snprintf(buffer, msgmax, "%s",
1722dd1104fbSMichen Chang gettext("Admin bind DN not "
1723dd1104fbSMichen Chang "configured"));
1724dd1104fbSMichen Chang goto out;
1725dd1104fbSMichen Chang }
1726dd1104fbSMichen Chang }
1727dd1104fbSMichen Chang }
1728dd1104fbSMichen Chang
1729dd1104fbSMichen Chang rc = __ns_ldap_repAttr(NS_ADMIN_SHADOW_UPDATE, dn,
1730dd1104fbSMichen Chang (const ns_ldap_attr_t * const *)attrs,
1731dd1104fbSMichen Chang credp, 0, &error);
1732dd1104fbSMichen Chang if (rc == NS_LDAP_SUCCESS)
1733dd1104fbSMichen Chang goto out;
1734dd1104fbSMichen Chang
1735dd1104fbSMichen Chang /*
1736dd1104fbSMichen Chang * Other errors might need to be added to this list, for
1737dd1104fbSMichen Chang * the current supported mechanisms this is sufficient.
1738dd1104fbSMichen Chang */
1739dd1104fbSMichen Chang if (rc == NS_LDAP_INTERNAL &&
1740dd1104fbSMichen Chang error->pwd_mgmt.status == NS_PASSWD_GOOD &&
1741dd1104fbSMichen Chang (error->status == LDAP_INAPPROPRIATE_AUTH ||
1742dd1104fbSMichen Chang error->status == LDAP_INVALID_CREDENTIALS))
1743dd1104fbSMichen Chang goto out;
1744dd1104fbSMichen Chang
1745dd1104fbSMichen Chang /*
1746dd1104fbSMichen Chang * If there is error related to password policy,
1747dd1104fbSMichen Chang * return it to caller.
1748dd1104fbSMichen Chang */
1749dd1104fbSMichen Chang if (rc == NS_LDAP_INTERNAL &&
1750dd1104fbSMichen Chang error->pwd_mgmt.status != NS_PASSWD_GOOD) {
1751dd1104fbSMichen Chang rc = NS_LDAP_CONFIG;
1752dd1104fbSMichen Chang status = NS_CONFIG_NOTALLOW;
1753dd1104fbSMichen Chang (void) __ns_ldap_freeError(&error);
1754dd1104fbSMichen Chang mlen = snprintf(buffer, msgmax, "%s",
1755dd1104fbSMichen Chang gettext("update failed due to "
1756dd1104fbSMichen Chang "password policy on server (%d)"),
1757dd1104fbSMichen Chang error->pwd_mgmt.status);
1758dd1104fbSMichen Chang goto out;
1759dd1104fbSMichen Chang }
1760dd1104fbSMichen Chang
1761dd1104fbSMichen Chang /* we don't really care about the error, just clean it up */
1762dd1104fbSMichen Chang if (error)
1763dd1104fbSMichen Chang (void) __ns_ldap_freeError(&error);
1764dd1104fbSMichen Chang }
1765dd1104fbSMichen Chang if (authstried == 0) {
1766dd1104fbSMichen Chang rc = NS_LDAP_CONFIG;
1767dd1104fbSMichen Chang mlen = snprintf(buffer, msgmax, "%s",
1768dd1104fbSMichen Chang gettext("No legal LDAP authentication method configured"));
1769dd1104fbSMichen Chang goto out;
1770dd1104fbSMichen Chang }
1771dd1104fbSMichen Chang
1772dd1104fbSMichen Chang rc = NS_LDAP_OP_FAILED;
1773dd1104fbSMichen Chang
1774dd1104fbSMichen Chang out:
1775dd1104fbSMichen Chang if (credp != NULL)
1776dd1104fbSMichen Chang (void) __ns_ldap_freeCred(&credp);
1777dd1104fbSMichen Chang
1778dd1104fbSMichen Chang if (authpp != NULL)
1779dd1104fbSMichen Chang (void) __ns_ldap_freeParam((void ***)&authpp);
1780dd1104fbSMichen Chang
1781dd1104fbSMichen Chang if (error != NULL) {
1782dd1104fbSMichen Chang mlen = snprintf(buffer, msgmax, "%s", error->message);
1783dd1104fbSMichen Chang status = error->status;
1784dd1104fbSMichen Chang (void) __ns_ldap_freeError(&error);
1785dd1104fbSMichen Chang }
1786dd1104fbSMichen Chang
1787dd1104fbSMichen Chang if (attrs != NULL) {
1788dd1104fbSMichen Chang int i;
1789dd1104fbSMichen Chang for (i = 0; attrs[i]; i++) {
1790dd1104fbSMichen Chang free(attrs[i]->attrvalue);
1791dd1104fbSMichen Chang free(attrs[i]);
1792dd1104fbSMichen Chang }
1793dd1104fbSMichen Chang }
1794dd1104fbSMichen Chang
1795dd1104fbSMichen Chang config_info->len = rlen + mlen + 1;
1796dd1104fbSMichen Chang config_info->str = malloc(config_info->len);
1797dd1104fbSMichen Chang if (config_info->str == NULL) {
1798dd1104fbSMichen Chang config_info->len = 0;
1799dd1104fbSMichen Chang return;
1800dd1104fbSMichen Chang }
1801dd1104fbSMichen Chang result = (ldap_admin_mod_result_t *)config_info->str;
1802dd1104fbSMichen Chang result->ns_err = rc;
1803dd1104fbSMichen Chang result->status = status;
1804dd1104fbSMichen Chang if (mlen != 0) {
1805dd1104fbSMichen Chang result->msg_size = mlen + 1;
1806dd1104fbSMichen Chang (void) strcpy(config_info->str + rlen, buffer);
1807dd1104fbSMichen Chang }
1808dd1104fbSMichen Chang }
1809dd1104fbSMichen Chang
1810dd1104fbSMichen Chang /*
1811dd1104fbSMichen Chang * Check to see if the door client's euid is 0 or if it has ALL zone privilege.
1812dd1104fbSMichen Chang * return - 0 No or error
1813dd1104fbSMichen Chang * 1 Yes
1814dd1104fbSMichen Chang */
1815b57459abSJulian Pullen int
1816dd1104fbSMichen Chang is_root_or_all_privs(char *dc_str, ucred_t **ucp)
1817dd1104fbSMichen Chang {
1818dd1104fbSMichen Chang const priv_set_t *ps; /* door client */
1819dd1104fbSMichen Chang priv_set_t *zs; /* zone */
1820dd1104fbSMichen Chang int rc = 0;
1821dd1104fbSMichen Chang
1822dd1104fbSMichen Chang *ucp = NULL;
1823dd1104fbSMichen Chang
1824dd1104fbSMichen Chang /* no more to do if door client's euid is 0 */
1825dd1104fbSMichen Chang if (is_root(0, dc_str, ucp) == 1) {
1826dd1104fbSMichen Chang ucred_free(*ucp);
1827dd1104fbSMichen Chang return (1);
1828dd1104fbSMichen Chang }
1829dd1104fbSMichen Chang
1830dd1104fbSMichen Chang /* error if couldn't get the ucred_t */
1831dd1104fbSMichen Chang if (*ucp == NULL)
1832dd1104fbSMichen Chang return (0);
1833dd1104fbSMichen Chang
1834dd1104fbSMichen Chang if ((ps = ucred_getprivset(*ucp, PRIV_EFFECTIVE)) != NULL) {
1835dd1104fbSMichen Chang zs = priv_str_to_set("zone", ",", NULL);
1836dd1104fbSMichen Chang if (priv_isequalset(ps, zs))
1837dd1104fbSMichen Chang rc = 1; /* has all zone privs */
1838dd1104fbSMichen Chang else {
1839dd1104fbSMichen Chang if (current_admin.debug_level >= DBG_CANT_FIND)
1840dd1104fbSMichen Chang logit("%s call failed (no all zone privs): "
1841dd1104fbSMichen Chang "caller pid %ld, uid %u, euid %u "
1842dd1104fbSMichen Chang "(if uid or euid is %u, it may "
1843dd1104fbSMichen Chang "be unavailable)\n", dc_str,
1844dd1104fbSMichen Chang ucred_getpid(*ucp), ucred_getruid(*ucp),
1845dd1104fbSMichen Chang ucred_geteuid(*ucp), -1);
1846dd1104fbSMichen Chang }
1847dd1104fbSMichen Chang priv_freeset(zs);
1848dd1104fbSMichen Chang }
1849dd1104fbSMichen Chang
1850dd1104fbSMichen Chang ucred_free(*ucp);
1851dd1104fbSMichen Chang return (rc);
1852dd1104fbSMichen Chang }
1853