usr/src/cmd/idmap/idmapd/idmapd.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  23  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
  24  */
  25
  26 #ifndef _IDMAPD_H
  27 #define _IDMAPD_H
  28
  29 #include <stdio.h>
  30 #include <stdlib.h>
  31 #include <stdarg.h>
  32 #include <rpc/rpc.h>
  33 #include <synch.h>
  34 #include <thread.h>
  35 #include <libintl.h>
  36 #include <strings.h>
  37 #include <sqlite-sys/sqlite.h>
  38 #include <syslog.h>
  39 #include <inttypes.h>
  40 #include <rpcsvc/idmap_prot.h>
  41 #include "adutils.h"
  42 #include "idmap_priv.h"
  43 #include "idmap_config.h"
  44 #include "libadutils.h"
  45
  46 #ifdef __cplusplus
  47 extern "C" {
  48 #endif
  49
  50 #define CHECK_NULL(s)   (s != NULL ? s : "null")
  51
  52 extern mutex_t _svcstate_lock;  /* lock for _rpcsvcstate, _rpcsvccount */
  53
  54 typedef enum idmap_namemap_mode {
  55         IDMAP_NM_NONE = 0,
  56         IDMAP_NM_AD,
  57         IDMAP_NM_NLDAP,
  58         IDMAP_NM_MIXED
  59 } idmap_namemap_mode_t;
  60
  61 /*
  62  * Debugging output.
  63  *
  64  * There are some number of areas - configuration, mapping, discovery, et
  65  * cetera - and for each area there is a verbosity level controlled through
  66  * an SMF property.  The default is zero, and "debug/all" provides a master
  67  * control allowing you to turn on all debugging output with one setting.
  68  *
  69  * A typical debugging output sequence would look like
  70  *
  71  *      if (DBG(CONFIG, 2)) {
  72  *              idmapdlog(LOG_DEBUG,
  73  *                  "some message about config at verbosity 2");
  74  *      }
  75  */
  76 enum idmapd_debug {
  77         IDMAPD_DEBUG_ALL = 0,
  78         IDMAPD_DEBUG_CONFIG = 1,
  79         IDMAPD_DEBUG_MAPPING = 2,
  80         IDMAPD_DEBUG_DISC = 3,
  81         IDMAPD_DEBUG_DNS = 4,
  82         IDMAPD_DEBUG_LDAP = 5,
  83         IDMAPD_DEBUG_MAX = 5
  84 };
  85
  86 #define DBG(type, lev)  \
  87         (_idmapdstate.debug[IDMAPD_DEBUG_##type] >= (lev) || \
  88             _idmapdstate.debug[IDMAPD_DEBUG_ALL] >= (lev))
  89
  90 /*
  91  * Global state of idmapd daemon.
  92  */
  93 typedef struct idmapd_state {
  94         rwlock_t        rwlk_cfg;               /* config lock */
  95         idmap_cfg_t     *cfg;                   /* config */
  96         bool_t          daemon_mode;
  97         char            hostname[MAX_NAME_LEN]; /* my hostname */
  98         uid_t           next_uid;
  99         gid_t           next_gid;
 100         uid_t           limit_uid;
 101         gid_t           limit_gid;
 102         int             new_eph_db;     /* was the ephem ID db [re-]created? */
 103         int             num_gcs;
 104         adutils_ad_t    **gcs;
 105         int             num_dcs;
 106         adutils_ad_t    **dcs;
 107         mutex_t         addisc_lk;
 108         cond_t          addisc_cv;
 109         int             addisc_st;
 110         int             debug[IDMAPD_DEBUG_MAX+1];
 111 } idmapd_state_t;
 112 extern idmapd_state_t   _idmapdstate;
 113
 114 #define ADDISC_ST_REQUESTED     1
 115 #define ADDISC_ST_RUNNING       2
 116
 117 #define RDLOCK_CONFIG() \
 118         (void) rw_rdlock(&_idmapdstate.rwlk_cfg);
 119 #define WRLOCK_CONFIG() \
 120         (void) rw_wrlock(&_idmapdstate.rwlk_cfg);
 121 #define UNLOCK_CONFIG() \
 122         (void) rw_unlock(&_idmapdstate.rwlk_cfg);
 123
 124 typedef struct hashentry {
 125         uint_t  key;
 126         uint_t  next;
 127 } hashentry_t;
 128
 129 typedef struct lookup_state {
 130         bool_t                  sid2pid_done;
 131         bool_t                  pid2sid_done;
 132         int                     ad_nqueries;
 133         int                     nldap_nqueries;
 134         bool_t                  eph_map_unres_sids;
 135         int                     directory_based_mapping;        /* enum */
 136         uint_t                  id_cache_timeout;
 137         uint_t                  name_cache_timeout;
 138         uint_t                  curpos;
 139         hashentry_t             *sid_history;
 140         uint_t                  sid_history_size;
 141         idmap_mapping_batch     *batch;
 142         idmap_ids_res           *result;
 143         idmap_namemap_mode_t    nm_siduid;
 144         idmap_namemap_mode_t    nm_sidgid;
 145         char                    *ad_unixuser_attr;
 146         char                    *ad_unixgroup_attr;
 147         char                    *nldap_winname_attr;
 148         char                    *defdom;
 149         sqlite                  *cache;
 150         sqlite                  *db;
 151 } lookup_state_t;
 152
 153 #define NLDAP_OR_MIXED(nm) \
 154         ((nm) == IDMAP_NM_NLDAP || (nm) == IDMAP_NM_MIXED)
 155 #define AD_OR_MIXED(nm) \
 156         ((nm) == IDMAP_NM_AD || (nm) == IDMAP_NM_MIXED)
 157
 158 #define PID_UID_OR_UNKNOWN(pidtype) \
 159         ((pidtype) == IDMAP_UID || (pidtype) == IDMAP_POSIXID)
 160 #define PID_GID_OR_UNKNOWN(pidtype) \
 161         ((pidtype) == IDMAP_GID || (pidtype) == IDMAP_POSIXID)
 162
 163 #define NLDAP_OR_MIXED_MODE(pidtype, ls) \
 164         (NLDAP_MODE(pidtype, ls) || MIXED_MODE(pidtype, ls))
 165 #define AD_OR_MIXED_MODE(pidtype, ls)\
 166         (AD_MODE(pidtype, ls) || MIXED_MODE(pidtype, ls))
 167 #define NLDAP_MODE(pidtype, ls) \
 168         ((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_NLDAP) || \
 169         (PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_NLDAP))
 170 #define AD_MODE(pidtype, ls) \
 171         ((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_AD) || \
 172         (PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_AD))
 173 #define MIXED_MODE(pidtype, ls) \
 174         ((PID_UID_OR_UNKNOWN(pidtype) && (ls)->nm_siduid == IDMAP_NM_MIXED) || \
 175         (PID_GID_OR_UNKNOWN(pidtype) && (ls)->nm_sidgid == IDMAP_NM_MIXED))
 176
 177
 178 typedef struct list_cb_data {
 179         void            *result;
 180         uint64_t        next;
 181         uint64_t        len;
 182         uint64_t        limit;
 183         int             flag;
 184 } list_cb_data_t;
 185
 186 typedef struct msg_table {
 187         idmap_retcode   retcode;
 188         const char      *msg;
 189 } msg_table_t;
 190
 191 /*
 192  * Data structure to store well-known SIDs and
 193  * associated mappings (if any)
 194  */
 195 typedef struct wksids_table {
 196         const char      *sidprefix;
 197         uint32_t        rid;
 198         const char      *domain;
 199         const char      *winname;
 200         int             is_wuser;
 201         posix_id_t      pid;
 202         int             is_user;
 203         int             direction;
 204 } wksids_table_t;
 205
 206 #define IDMAPD_SEARCH_TIMEOUT           3   /* seconds */
 207 #define IDMAPD_LDAP_OPEN_TIMEOUT        1   /* secs; initial, w/ exp backoff */
 208
 209 /*
 210  * The following flags are used by idmapd while processing a
 211  * given mapping request. Note that idmapd uses multiple passes to
 212  * process the request and the flags are used to pass information
 213  * about the state of the request between these passes.
 214  */
 215
 216 /* Initial state. Done. Reset all flags. Remaining passes can be skipped */
 217 #define _IDMAP_F_DONE                   0x00000000
 218 /* Set when subsequent passes are required */
 219 #define _IDMAP_F_NOTDONE                0x00000001
 220 /* Don't update name_cache. (e.g. set when winname,SID found in name_cache) */
 221 #define _IDMAP_F_DONT_UPDATE_NAMECACHE  0x00000002
 222 /* Batch this request for AD lookup */
 223 #define _IDMAP_F_LOOKUP_AD              0x00000004
 224 /* Batch this request for nldap directory lookup */
 225 #define _IDMAP_F_LOOKUP_NLDAP           0x00000008
 226 /*
 227  * Expired ephemeral mapping found in cache when processing sid2uid request.
 228  * Use it if the given SID cannot be mapped by name
 229  */
 230 #define _IDMAP_F_EXP_EPH_UID            0x00000010
 231 /* Same as above. Used for sid2gid request */
 232 #define _IDMAP_F_EXP_EPH_GID            0x00000020
 233 /* This request is not valid for the current forest */
 234 #define _IDMAP_F_LOOKUP_OTHER_AD        0x00000040
 235
 236
 237 /*
 238  * Check if we are done. If so, subsequent passes can be skipped
 239  * when processing a given mapping request.
 240  */
 241 #define ARE_WE_DONE(f)  ((f & _IDMAP_F_NOTDONE) == 0)
 242
 243 #define SIZE_INCR       5
 244 #define MAX_TRIES       5
 245 #define IDMAP_DBDIR     "/var/idmap"
 246 #define IDMAP_CACHEDIR  "/var/run/idmap"
 247 #define IDMAP_DBNAME    IDMAP_DBDIR "/idmap.db"
 248 #define IDMAP_CACHENAME IDMAP_CACHEDIR "/idmap.db"
 249
 250 #define IS_ID_NONE(id)  \
 251         ((id).idtype == IDMAP_NONE)
 252
 253 #define IS_ID_SID(id)   \
 254         ((id).idtype == IDMAP_SID ||    \
 255         (id).idtype == IDMAP_USID ||    \
 256         (id).idtype == IDMAP_GSID)      \
 257
 258 #define IS_ID_UID(id)   \
 259         ((id).idtype == IDMAP_UID)
 260
 261 #define IS_ID_GID(id)   \
 262         ((id).idtype == IDMAP_GID)
 263
 264 #define IS_ID_POSIX(id) \
 265         ((id).idtype == IDMAP_UID ||    \
 266         (id).idtype == IDMAP_GID ||     \
 267         (id).idtype == IDMAP_POSIXID)   \
 268
 269 /*
 270  * Local RID ranges
 271  */
 272 #define LOCALRID_UID_MIN        1000U
 273 #define LOCALRID_UID_MAX        ((uint32_t)INT32_MAX)
 274 #define LOCALRID_GID_MIN        (((uint32_t)INT32_MAX) + 1)
 275 #define LOCALRID_GID_MAX        UINT32_MAX
 276
 277 /*
 278  * Tracing.
 279  *
 280  * The tracing mechanism is intended to help the administrator understand
 281  * why their mapping configuration is doing what it is.  Each interesting
 282  * decision point during the mapping process calls TRACE() with the current
 283  * request and response and a printf-style message.  The message, plus
 284  * data from the request and the response, is logged to the service log
 285  * (if debug/mapping is greater than zero) or reported to the caller
 286  * (if IDMAP_REQ_FLG_TRACE was set in the request.  The primary consumer
 287  * is the "-V" option to "idmap show".
 288  *
 289  * TRACING(req) says whether tracing is appropriate for the request, and
 290  * is used to determine and record whether any request in a batch requested
 291  * tracing, to control whether later code loops over the batch to do tracing
 292  * for any of the requests.
 293  *
 294  * TRACE(req, res, fmt, ...) generates a trace entry if appropriate.
 295  */
 296 #define TRACING(req)    \
 297         (DBG(MAPPING, 1) ||     \
 298         ((req)->flag & IDMAP_REQ_FLG_TRACE) != 0)
 299 #define TRACE(req, res, ...)                    \
 300         ((void)(TRACING(req) && trace(req, res, __VA_ARGS__)))
 301 extern int      trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...);
 302
 303 typedef idmap_retcode (*update_list_res_cb)(void *, const char **, uint64_t);
 304 typedef int (*list_svc_cb)(void *, int, char **, char **);
 305
 306 extern void     idmap_prog_1(struct svc_req *, register SVCXPRT *);
 307 extern void     idmapdlog(int, const char *, ...);
 308 extern int      init_mapping_system();
 309 extern void     fini_mapping_system();
 310 extern void     print_idmapdstate();
 311 extern int      create_directory(const char *, uid_t, gid_t);
 312 extern int      load_config();
 313 extern void     reload_ad();
 314 extern void     idmap_init_tsd_key(void);
 315 extern void     degrade_svc(int, const char *);
 316 extern void     restore_svc(void);
 317 extern void     notify_dc_changed(void);
 318
 319
 320 extern int              init_dbs();
 321 extern void             fini_dbs();
 322 extern idmap_retcode    get_db_handle(sqlite **);
 323 extern idmap_retcode    get_cache_handle(sqlite **);
 324 extern idmap_retcode    sql_exec_no_cb(sqlite *, const char *, char *);
 325 extern idmap_retcode    add_namerule(sqlite *, idmap_namerule *);
 326 extern idmap_retcode    rm_namerule(sqlite *, idmap_namerule *);
 327 extern idmap_retcode    flush_namerules(sqlite *);
 328
 329 extern char             *tolower_u8(const char *);
 330
 331 extern idmap_retcode    gen_sql_expr_from_rule(idmap_namerule *, char **);
 332 extern idmap_retcode    validate_list_cb_data(list_cb_data_t *, int,
 333                                 char **, int, uchar_t **, size_t);
 334 extern idmap_retcode    process_list_svc_sql(sqlite *, const char *, char *,
 335                                 uint64_t, int, list_svc_cb, void *);
 336 extern idmap_retcode    sid2pid_first_pass(lookup_state_t *,
 337                                 idmap_mapping *, idmap_id_res *);
 338 extern idmap_retcode    sid2pid_second_pass(lookup_state_t *,
 339                                 idmap_mapping *, idmap_id_res *);
 340 extern idmap_retcode    pid2sid_first_pass(lookup_state_t *,
 341                                 idmap_mapping *, idmap_id_res *, int);
 342 extern idmap_retcode    pid2sid_second_pass(lookup_state_t *,
 343                                 idmap_mapping *, idmap_id_res *, int);
 344 extern idmap_retcode    update_cache_sid2pid(lookup_state_t *,
 345                                 idmap_mapping *, idmap_id_res *);
 346 extern idmap_retcode    update_cache_pid2sid(lookup_state_t *,
 347                                 idmap_mapping *, idmap_id_res *);
 348 extern idmap_retcode    get_u2w_mapping(sqlite *, sqlite *, idmap_mapping *,
 349                                 idmap_mapping *, int);
 350 extern idmap_retcode    get_w2u_mapping(sqlite *, sqlite *, idmap_mapping *,
 351                                 idmap_mapping *);
 352 extern idmap_retcode    load_cfg_in_state(lookup_state_t *);
 353 extern void             cleanup_lookup_state(lookup_state_t *);
 354
 355 extern idmap_retcode    ad_lookup_batch(lookup_state_t *,
 356                                 idmap_mapping_batch *, idmap_ids_res *);
 357 extern idmap_retcode    lookup_name2sid(sqlite *, const char *, const char *,
 358                                 int, char **, char **, char **,
 359                                 idmap_rid_t *, idmap_id_type *,
 360                                 idmap_mapping *, int);
 361 extern idmap_retcode    lookup_wksids_name2sid(const char *, const char *,
 362                                 char **, char **, char **, idmap_rid_t *,
 363                                 idmap_id_type *);
 364 extern idmap_retcode    idmap_cache_flush(idmap_flush_op);
 365
 366 extern const wksids_table_t *find_wksid_by_pid(posix_id_t pid, int is_user);
 367 extern const wksids_table_t *find_wksid_by_sid(const char *sid, int rid,
 368     idmap_id_type type);
 369 extern const wksids_table_t *find_wksid_by_name(const char *name,
 370     const char *domain, idmap_id_type type);
 371 extern const wksids_table_t *find_wk_by_sid(char *sid);
 372
 373 #ifdef __cplusplus
 374 }
 375 #endif
 376
 377 #endif /* _IDMAPD_H */