ad/common/getpwnam.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <pwd.h>
#include <idmap.h>
#include <ctype.h>
#include "ad_common.h"

/* passwd attributes and filters */
#define _PWD_DN         "dn"
#define _PWD_SAN        "sAMAccountName"
#define _PWD_OBJSID     "objectSid"
#define _PWD_PRIMARYGROUPID "primaryGroupID"
#define _PWD_CN         "cn"
#define _PWD_HOMEDIRECTORY  "homedirectory"
#define _PWD_LOGINSHELL     "loginshell"
#define _PWD_OBJCLASS       "objectClass"

#define _F_GETPWNAM     "(sAMAccountName=%.*s)"
#define _F_GETPWUID     "(objectSid=%s)"

static const char *pwd_attrs[] = {
    _PWD_SAN,
    _PWD_OBJSID,
    _PWD_PRIMARYGROUPID,
    _PWD_CN,
    _PWD_HOMEDIRECTORY,
    _PWD_LOGINSHELL,
    _PWD_OBJCLASS,
    (char *)NULL
};

static int
update_buffer(ad_backend_ptr be, nss_XbyY_args_t *argp,
        const char *name, const char *domain,
        uid_t uid, gid_t gid, const char *gecos,
        const char *homedir, const char *shell)
{
    int buflen;
    char    *buffer;

    if (be->db_type == NSS_AD_DB_PASSWD_BYNAME) {
        /*
         * The canonical name obtained from AD lookup may not match
         * the case of the name (i.e. key) in the request. Therefore,
         * use the name from the request to construct the result.
         */
        buflen = snprintf(NULL, 0, "%s:%s:%u:%u:%s:%s:%s",
            argp->key.name, "x", uid, gid, gecos, homedir, shell) + 1;
    } else {
        if (domain == NULL)
            domain = WK_DOMAIN;
        buflen = snprintf(NULL, 0, "%s@%s:%s:%u:%u:%s:%s:%s",
            name, domain, "x", uid, gid, gecos, homedir, shell) + 1;
    }


    if (argp->buf.result != NULL) {
        buffer = be->buffer = malloc(buflen);
        if (be->buffer == NULL)
            return (-1);
        be->buflen = buflen;
    } else {
        if (buflen > argp->buf.buflen)
            return (-1);
        buflen = argp->buf.buflen;
        buffer = argp->buf.buffer;
    }

    if (be->db_type == NSS_AD_DB_PASSWD_BYNAME)
        (void) snprintf(buffer, buflen, "%s:%s:%u:%u:%s:%s:%s",
            argp->key.name, "x", uid, gid, gecos, homedir, shell);
    else
        (void) snprintf(buffer, buflen, "%s@%s:%s:%u:%u:%s:%s:%s",
            name, domain, "x", uid, gid, gecos, homedir, shell);
    return (0);
}


#define NET_SCHEME  "/net"

/*
 * 1) If the homeDirectory string is in UNC format then convert it into
 * a /net format. This needs to be revisited later but is fine for now
 * because Solaris does not support -hosts automount map for CIFS yet.
 *
 * 2) If homeDirectory contains ':' then return NULL because ':' is the
 * delimiter in passwd entries and may break apps that parse these entries.
 *
 * 3) For all other cases return the same string that was passed to
 * this function.
 */
static
char *
process_homedir(char *homedir)
{
    size_t  len, smb_len;
    char    *smb_homedir;
    int i, slash = 0;

    len = strlen(homedir);

    if (strchr(homedir, ':') != NULL)
        /*
         * Ignore paths that have colon ':' because ':' is a
         * delimiter for the passwd entry.
         */
        return (NULL);

    if (!(len > 1 && homedir[0] == '\\' && homedir[1] == '\\'))
        /* Keep homedir intact if not in UNC format */
        return (homedir);

    /*
     * Convert UNC string into /net format
     * Example: \\server\abc -> /net/server/abc
     */
    smb_len = len + 1 + sizeof (NET_SCHEME);
    if ((smb_homedir = calloc(1, smb_len)) == NULL)
        return (NULL);
    (void) strlcpy(smb_homedir, NET_SCHEME, smb_len);
    for (i = strlen(smb_homedir); *homedir != '\0'; homedir++) {
        if (*homedir == '\\') {
            /* Reduce double backslashes into one */
            if (slash)
                slash = 0;
            else {
                slash = 1;
                smb_homedir[i++] = '/';
            }
        } else {
            smb_homedir[i++] = *homedir;
            slash = 0;
        }
    }
    return (smb_homedir);
}

/*
 * _nss_ad_passwd2str is the data marshaling method for the passwd getXbyY
 * (e.g., getbyuid(), getbyname(), getpwent()) backend processes. This method is
 * called after a successful AD search has been performed. This method will
 * parse the AD search values into the file format.
 * e.g.
 *
 * blue@whale:x:123456:10:Blue Whale:/:
 *
 */
static int
_nss_ad_passwd2str(ad_backend_ptr be, nss_XbyY_args_t *argp)
{
    int         nss_result;
    adutils_result_t    *result = be->result;
    const adutils_entry_t   *entry;
    char            **sid_v, *ptr, **pgid_v, *end;
    ulong_t         tmp;
    uint32_t        urid, grid;
    uid_t           uid;
    gid_t           gid;
    idmap_stat      gstat;
    idmap_get_handle_t  *ig = NULL;
    char            **name_v, **dn_v, *domain = NULL;
    char            **gecos_v, **shell_v;
    char            **homedir_v = NULL, *homedir = NULL;
    char            *NULL_STR = "";

    if (result == NULL)
        return (NSS_STR_PARSE_PARSE);
    entry = adutils_getfirstentry(result);
    nss_result = NSS_STR_PARSE_PARSE;

    /* Create handles for idmap service */
    if (idmap_get_create(&ig) != 0)
        goto result_pwd2str;

    /* Get name */
    name_v = adutils_getattr(entry, _PWD_SAN);
    if (name_v == NULL || name_v[0] == NULL || *name_v[0] == '\0')
        goto result_pwd2str;

    /* Get domain */
    dn_v = adutils_getattr(entry, _PWD_DN);
    if (dn_v == NULL || dn_v[0] == NULL || *dn_v[0] == '\0')
        goto result_pwd2str;
    domain = adutils_dn2dns(dn_v[0]);

    /* Get objectSID (in text format) */
    sid_v = adutils_getattr(entry, _PWD_OBJSID);
    if (sid_v == NULL || sid_v[0] == NULL || *sid_v[0] == '\0')
        goto result_pwd2str;

    /* Break SID into prefix and rid */
    if ((ptr = strrchr(sid_v[0], '-')) == NULL)
        goto result_pwd2str;
    *ptr = '\0';
    end = ++ptr;
    tmp = strtoul(ptr, &end, 10);
    if (end == ptr || tmp > UINT32_MAX)
        goto result_pwd2str;
    urid = (uint32_t)tmp;

    /* We already have uid -- no need to call idmapd */
    if (be->db_type == NSS_AD_DB_PASSWD_BYUID)
        uid = argp->key.uid;
    else
        uid = be->uid;

    /* Get primaryGroupID */
    pgid_v = adutils_getattr(entry, _PWD_PRIMARYGROUPID);
    if (pgid_v == NULL || pgid_v[0] == NULL || *pgid_v[0] == '\0')
        /*
         * If primaryGroupID is not found then we request
         * a GID to be mapped to the given user's objectSID
         * (diagonal mapping) and use this GID as the primary
         * GID for the entry.
         */
        grid = urid;
    else {
        end = pgid_v[0];
        tmp = strtoul(pgid_v[0], &end, 10);
        if (end == pgid_v[0] || tmp > UINT32_MAX)
            goto result_pwd2str;
        grid = (uint32_t)tmp;
    }

    /* Map group SID to GID using idmap service */
    if (idmap_get_gidbysid(ig, sid_v[0], grid, 0, &gid, &gstat) != 0)
        goto result_pwd2str;
    if (idmap_get_mappings(ig) != 0 || gstat != 0) {
        RESET_ERRNO();
        goto result_pwd2str;
    }

    /* Get gecos, homedirectory and shell information if available */
    gecos_v = adutils_getattr(entry, _PWD_CN);
    if (gecos_v == NULL || gecos_v[0] == NULL || *gecos_v[0] == '\0')
        gecos_v = &NULL_STR;

    homedir_v = adutils_getattr(entry, _PWD_HOMEDIRECTORY);
    if (homedir_v == NULL || homedir_v[0] == NULL || *homedir_v[0] == '\0')
        homedir = NULL_STR;
    else if ((homedir = process_homedir(homedir_v[0])) == NULL)
        homedir = NULL_STR;

    shell_v = adutils_getattr(entry, _PWD_LOGINSHELL);
    if (shell_v == NULL || shell_v[0] == NULL || *shell_v[0] == '\0')
        shell_v = &NULL_STR;

    if (update_buffer(be, argp, name_v[0], domain, uid, gid,
        gecos_v[0], homedir, shell_v[0]) < 0)
        nss_result = NSS_STR_PARSE_ERANGE;
    else
        nss_result = NSS_STR_PARSE_SUCCESS;

result_pwd2str:
    idmap_get_destroy(ig);
    (void) adutils_freeresult(&be->result);
    free(domain);
    if (homedir != NULL_STR && homedir_v != NULL &&
        homedir != homedir_v[0])
        free(homedir);
    return ((int)nss_result);
}

/*
 * getbyname gets a passwd entry by winname. This function constructs an ldap
 * search filter using the name invocation parameter and the getpwnam search
 * filter defined. Once the filter is constructed, we search for a matching
 * entry and marshal the data results into struct passwd for the frontend
 * process. The function _nss_ad_passwd2ent performs the data marshaling.
 */

static nss_status_t
getbyname(ad_backend_ptr be, void *a)
{
    nss_XbyY_args_t *argp = (nss_XbyY_args_t *)a;
    char        *searchfilter;
    char        name[SEARCHFILTERLEN];
    char        *dname;
    int     filterlen, namelen;
    int     flag;
    nss_status_t    stat;
    idmap_stat  idmaprc;
    uid_t       uid;
    gid_t       gid;
    int     is_user, is_wuser, try_idmap;

    be->db_type = NSS_AD_DB_PASSWD_BYNAME;

    /* Sanitize name so that it can be used in our LDAP filter */
    if (_ldap_filter_name(name, argp->key.name, sizeof (name)) != 0)
        return ((nss_status_t)NSS_NOTFOUND);

    if ((dname = strchr(name, '@')) == NULL)
        return ((nss_status_t)NSS_NOTFOUND);

    *dname = '\0';
    dname++;

    /*
     * Map the given name to UID using idmap service. If idmap
     * call fails then this will save us doing AD discovery and
     * AD lookup here.
     */
    flag = (strcasecmp(dname, WK_DOMAIN) == 0) ?
        IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY : 0;
    is_wuser = -1;
    is_user = 1;
    if (idmap_get_w2u_mapping(NULL, NULL, name,
        dname, flag, &is_user, &is_wuser, &be->uid, NULL,
        NULL, NULL) != IDMAP_SUCCESS) {
        RESET_ERRNO();
        return ((nss_status_t)NSS_NOTFOUND);
    }

    /* If this is not a Well-Known SID then try AD lookup. */
    if (strcasecmp(dname, WK_DOMAIN) != 0) {
        /* Assemble filter using the given name */
        namelen = strlen(name);
        filterlen = snprintf(NULL, 0, _F_GETPWNAM, namelen, name) + 1;
        if ((searchfilter = (char *)malloc(filterlen)) == NULL)
            return ((nss_status_t)NSS_NOTFOUND);
        (void) snprintf(searchfilter, filterlen, _F_GETPWNAM,
            namelen, name);
        stat = _nss_ad_lookup(be, argp, _PASSWD, searchfilter,
            dname, &try_idmap);
        free(searchfilter);

        if (!try_idmap)
            return (stat);

    }

    /*
     * Either this is a Well-Known SID or AD lookup failed. Map
     * the given name to GID using idmap service and construct
     * the passwd entry.
     */
    is_wuser = -1;
    is_user = 0; /* Map name to primary gid */
    idmaprc = idmap_get_w2u_mapping(NULL, NULL, name, dname,
        flag, &is_user, &is_wuser, &gid, NULL, NULL, NULL);
    if (idmaprc != IDMAP_SUCCESS) {
        RESET_ERRNO();
        return ((nss_status_t)NSS_NOTFOUND);
    }

    /* Create passwd(4) style string */
    if (update_buffer(be, argp, name, dname,
        be->uid, gid, "", "", "") < 0)
        return ((nss_status_t)NSS_NOTFOUND);

    /* Marshall the data, sanitize the return status and return */
    stat = _nss_ad_marshall_data(be, argp);
    return (_nss_ad_sanitize_status(be, argp, stat));
}


/*
 * getbyuid gets a passwd entry by uid number. This function constructs an ldap
 * search filter using the uid invocation parameter and the getpwuid search
 * filter defined. Once the filter is constructed, we search for a matching
 * entry and marshal the data results into struct passwd for the frontend
 * process. The function _nss_ad_passwd2ent performs the data marshaling.
 */

static nss_status_t
getbyuid(ad_backend_ptr be, void *a)
{
    nss_XbyY_args_t     *argp = (nss_XbyY_args_t *)a;
    char            searchfilter[ADUTILS_MAXHEXBINSID + 14];
    char            *sidprefix = NULL;
    idmap_rid_t     rid;
    char            cbinsid[ADUTILS_MAXHEXBINSID + 1];
    char            *winname = NULL, *windomain = NULL;
    int         is_user, is_wuser;
    gid_t           gid;
    idmap_stat      idmaprc;
    int         ret, try_idmap;
    nss_status_t        stat;

    be->db_type = NSS_AD_DB_PASSWD_BYUID;

    stat = (nss_status_t)NSS_NOTFOUND;

    /* nss_ad does not support non ephemeral uids */
    if (argp->key.uid <= MAXUID)
        goto out;

    /* Map the given UID to a SID using the idmap service */
    if (idmap_get_u2w_mapping(&argp->key.uid, NULL, 0,
        1, NULL, &sidprefix, &rid, &winname, &windomain,
        NULL, NULL) != 0) {
        RESET_ERRNO();
        goto out;
    }

    /*
     * NULL winname implies a local SID or unresolvable SID both of
     * which cannot be used to generated passwd(4) entry
     */
    if (winname == NULL)
        goto out;

    /* If this is not a Well-Known SID try AD lookup */
    if (windomain != NULL && strcasecmp(windomain, WK_DOMAIN) != 0) {
        if (adutils_txtsid2hexbinsid(sidprefix, &rid,
            &cbinsid[0], sizeof (cbinsid)) != 0)
            goto out;

        ret = snprintf(searchfilter, sizeof (searchfilter),
            _F_GETPWUID, cbinsid);
        if (ret >= sizeof (searchfilter) || ret < 0)
            goto out;

        stat = _nss_ad_lookup(be, argp, _PASSWD, searchfilter,
            windomain, &try_idmap);

        if (!try_idmap)
            goto out;
    }

    /* Map winname to primary gid using idmap service */
    is_user = 0;
    is_wuser = -1;
    idmaprc = idmap_get_w2u_mapping(NULL, NULL,
        winname, windomain, 0, &is_user, &is_wuser, &gid,
        NULL, NULL, NULL);

    if (idmaprc != IDMAP_SUCCESS) {
        RESET_ERRNO();
        goto out;
    }

    /* Create passwd(4) style string */
    if (update_buffer(be, argp, winname, windomain,
        argp->key.uid, gid, "", "", "") < 0)
        goto out;

    /* Marshall the data, sanitize the return status and return */
    stat = _nss_ad_marshall_data(be, argp);
    stat = _nss_ad_sanitize_status(be, argp, stat);

out:
    idmap_free(sidprefix);
    idmap_free(winname);
    idmap_free(windomain);
    return (stat);
}

static ad_backend_op_t passwd_ops[] = {
    _nss_ad_destr,
    _nss_ad_endent,
    _nss_ad_setent,
    _nss_ad_getent,
    getbyname,
    getbyuid
};

/*
 * _nss_ad_passwd_constr is where life begins. This function calls the
 * generic AD constructor function to define and build the abstract
 * data types required to support AD operations.
 */

/*ARGSUSED0*/
nss_backend_t *
_nss_ad_passwd_constr(const char *dummy1, const char *dummy2,
            const char *dummy3)
{

    return ((nss_backend_t *)_nss_ad_constr(passwd_ops,
        sizeof (passwd_ops)/sizeof (passwd_ops[0]),
        _PASSWD, pwd_attrs, _nss_ad_passwd2str));
}