88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik/*
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * System Security Services Daemon. NSS client interface
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik *
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * Authors:
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * Lukas Slebodnik <lslebodn@redhat.com>
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik *
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * Copyright (C) 2015 Red Hat
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik *
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * This program is free software; you can redistribute it and/or modify
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * it under the terms of the GNU Lesser General Public License as
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * published by the Free Software Foundation; either version 2.1 of the
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * License, or (at your option) any later version.
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik *
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * This program is distributed in the hope that it will be useful,
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * but WITHOUT ANY WARRANTY; without even the implied warranty of
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * GNU Lesser General Public License for more details.
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik *
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * You should have received a copy of the GNU Lesser General Public License
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * along with this program. If not, see <http://www.gnu.org/licenses/>.
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik */
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik/* INITGROUPs database NSS interface using mmap cache */
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include <errno.h>
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include <stdio.h>
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include <string.h>
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include <stdlib.h>
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include <stddef.h>
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include <sys/mman.h>
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include <time.h>
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include "nss_mc.h"
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik#include "util/util_safealign.h"
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnikstruct sss_cli_mc_ctx initgr_mc_ctx = { UNINITIALIZED, -1, 0, NULL, 0, NULL, 0,
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik NULL, 0, 0 };
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnikstatic errno_t sss_nss_mc_parse_result(struct sss_mc_rec *rec,
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik long int *start, long int *size,
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik gid_t **groups, long int limit)
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik{
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik struct sss_mc_initgr_data *data;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik time_t expire;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik long int i;
39b31427e2d11ca318df11fd48db33a7cc610aa7Lukas Slebodnik uint32_t num_groups;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik long int max_ret;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* additional checks before filling result*/
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik expire = rec->expire;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik if (expire < time(NULL)) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* entry is now invalid */
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik return EINVAL;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik data = (struct sss_mc_initgr_data *)rec->data;
39b31427e2d11ca318df11fd48db33a7cc610aa7Lukas Slebodnik num_groups = data->num_groups;
39b31427e2d11ca318df11fd48db33a7cc610aa7Lukas Slebodnik max_ret = num_groups;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* check we have enough space in the buffer */
39b31427e2d11ca318df11fd48db33a7cc610aa7Lukas Slebodnik if ((*size - *start) < num_groups) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik long int newsize;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik gid_t *newgroups;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
39b31427e2d11ca318df11fd48db33a7cc610aa7Lukas Slebodnik newsize = *size + num_groups;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik if ((limit > 0) && (newsize > limit)) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik newsize = limit;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik max_ret = newsize - *start;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik newgroups = (gid_t *)realloc((*groups), newsize * sizeof(**groups));
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik if (!newgroups) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik return ENOMEM;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik *groups = newgroups;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik *size = newsize;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik for (i = 0; i < max_ret; i++) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik SAFEALIGN_COPY_UINT32(&(*groups)[*start], data->gids + i, NULL);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik *start += 1;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik return 0;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik}
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnikerrno_t sss_nss_mc_initgroups_dyn(const char *name, size_t name_len,
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik gid_t group, long int *start, long int *size,
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik gid_t **groups, long int limit)
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik{
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik struct sss_mc_rec *rec = NULL;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik struct sss_mc_initgr_data *data;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik char *rec_name;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik uint32_t hash;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik uint32_t slot;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik int ret;
225dc6914cdc8920b02a129b98ece1ed97b99c03Lukas Slebodnik const size_t data_offset = offsetof(struct sss_mc_initgr_data, gids);
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik size_t data_size;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik ret = sss_nss_mc_get_ctx("initgroups", &initgr_mc_ctx);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik if (ret) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik return ret;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik /* Get max size of data table. */
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik data_size = initgr_mc_ctx.dt_size;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* hashes are calculated including the NULL terminator */
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik hash = sss_nss_mc_hash(&initgr_mc_ctx, name, name_len + 1);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik slot = initgr_mc_ctx.hash_table[hash];
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* If slot is not within the bounds of mmaped region and
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * it's value is not MC_INVALID_VAL, then the cache is
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik * probbably corrupted. */
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik while (MC_SLOT_WITHIN_BOUNDS(slot, data_size)) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* free record from previous iteration */
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik free(rec);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik rec = NULL;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik ret = sss_nss_mc_get_record(&initgr_mc_ctx, slot, &rec);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik if (ret) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik goto done;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* check record matches what we are searching for */
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik if (hash != rec->hash1) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* if name hash does not match we can skip this immediately */
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik continue;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik data = (struct sss_mc_initgr_data *)rec->data;
225dc6914cdc8920b02a129b98ece1ed97b99c03Lukas Slebodnik rec_name = (char *)data + data->name;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik /* Integrity check
225dc6914cdc8920b02a129b98ece1ed97b99c03Lukas Slebodnik * - name_len cannot be longer than all strings or data
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik * - all data must be within copy of record
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik * - size of record must be lower that data table size
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik * - data->strs cannot point outside strings */
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik if (name_len > data->strs_len
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik || data->strs_len > data->data_len
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik || data->data_len > rec->len
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik || rec->len > data_size
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik || (data->strs + name_len) > (data_offset + data->data_len)) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik ret = ENOENT;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik goto done;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik if (strcmp(name, rec_name) == 0) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik break;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik slot = sss_nss_mc_next_slot_with_hash(rec, hash);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
ba847347cade817ee927397d82c952b51b0dcb2bLukas Slebodnik if (!MC_SLOT_WITHIN_BOUNDS(slot, data_size)) {
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik ret = ENOENT;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik goto done;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik }
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik ret = sss_nss_mc_parse_result(rec, start, size, groups, limit);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnikdone:
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik free(rec);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik __sync_sub_and_fetch(&initgr_mc_ctx.active_threads, 1);
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik return ret;
88e68607e474ab2ce46c562753ef2e988516d1e9Lukas Slebodnik}