1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * netgroup.c 24*0Sstevel@tonic-gate * 25*0Sstevel@tonic-gate * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 26*0Sstevel@tonic-gate * Use is subject to license terms. 27*0Sstevel@tonic-gate */ 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 30*0Sstevel@tonic-gate 31*0Sstevel@tonic-gate #include <stdio.h> 32*0Sstevel@tonic-gate #include <stdlib.h> 33*0Sstevel@tonic-gate #include <sys/types.h> 34*0Sstevel@tonic-gate #include <string.h> 35*0Sstevel@tonic-gate #include <syslog.h> 36*0Sstevel@tonic-gate #include <sys/param.h> 37*0Sstevel@tonic-gate #include <rpc/rpc.h> 38*0Sstevel@tonic-gate #include <sys/stat.h> 39*0Sstevel@tonic-gate #include <netconfig.h> 40*0Sstevel@tonic-gate #include <netdir.h> 41*0Sstevel@tonic-gate #include <sys/file.h> 42*0Sstevel@tonic-gate #include <sys/time.h> 43*0Sstevel@tonic-gate #include <sys/errno.h> 44*0Sstevel@tonic-gate #include <sys/resource.h> 45*0Sstevel@tonic-gate #include <rpcsvc/mount.h> 46*0Sstevel@tonic-gate #include <sys/pathconf.h> 47*0Sstevel@tonic-gate #include <sys/systeminfo.h> 48*0Sstevel@tonic-gate #include <sys/utsname.h> 49*0Sstevel@tonic-gate #include <signal.h> 50*0Sstevel@tonic-gate #include <locale.h> 51*0Sstevel@tonic-gate #include <unistd.h> 52*0Sstevel@tonic-gate #include <thread.h> 53*0Sstevel@tonic-gate #include "../lib/sharetab.h" 54*0Sstevel@tonic-gate #include "mountd.h" 55*0Sstevel@tonic-gate 56*0Sstevel@tonic-gate struct cache_entry { 57*0Sstevel@tonic-gate char *cache_host; 58*0Sstevel@tonic-gate time_t cache_time; 59*0Sstevel@tonic-gate int cache_belong; 60*0Sstevel@tonic-gate char **cache_grl; 61*0Sstevel@tonic-gate int cache_grc; 62*0Sstevel@tonic-gate struct cache_entry *cache_next; 63*0Sstevel@tonic-gate }; 64*0Sstevel@tonic-gate 65*0Sstevel@tonic-gate static struct cache_entry *cache_head; 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate #define VALID_TIME 60 /* seconds */ 68*0Sstevel@tonic-gate 69*0Sstevel@tonic-gate static rwlock_t cache_lock; /* protect the cache chain */ 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate static void cache_free(struct cache_entry *entry); 72*0Sstevel@tonic-gate static int cache_check(char *host, char **grl, int grc, int *belong); 73*0Sstevel@tonic-gate static void cache_enter(char *host, char **grl, int grc, int belong); 74*0Sstevel@tonic-gate 75*0Sstevel@tonic-gate 76*0Sstevel@tonic-gate void 77*0Sstevel@tonic-gate netgroup_init() 78*0Sstevel@tonic-gate { 79*0Sstevel@tonic-gate (void) rwlock_init(&cache_lock, USYNC_THREAD, NULL); 80*0Sstevel@tonic-gate } 81*0Sstevel@tonic-gate 82*0Sstevel@tonic-gate /* 83*0Sstevel@tonic-gate * Check whether any of the hostnames in clnames are 84*0Sstevel@tonic-gate * members (or non-members) of the netgroups in glist. 85*0Sstevel@tonic-gate * Since the innetgr lookup is rather expensive, the 86*0Sstevel@tonic-gate * result is cached. The cached entry is valid only 87*0Sstevel@tonic-gate * for VALID_TIME seconds. This works well because 88*0Sstevel@tonic-gate * typically these lookups occur in clusters when 89*0Sstevel@tonic-gate * a client is mounting. 90*0Sstevel@tonic-gate * 91*0Sstevel@tonic-gate * Note that this routine establishes a host membership 92*0Sstevel@tonic-gate * in a list of netgroups - we've no idea just which 93*0Sstevel@tonic-gate * netgroup in the list it is a member of. 94*0Sstevel@tonic-gate * 95*0Sstevel@tonic-gate * glist is a character array containing grc strings 96*0Sstevel@tonic-gate * representing netgroup names (optionally prefixed 97*0Sstevel@tonic-gate * with '-'). Each string is ended with '\0' and 98*0Sstevel@tonic-gate * followed immediately by the next string. 99*0Sstevel@tonic-gate */ 100*0Sstevel@tonic-gate int 101*0Sstevel@tonic-gate netgroup_check(struct nd_hostservlist *clnames, char *glist, int grc) 102*0Sstevel@tonic-gate { 103*0Sstevel@tonic-gate char **grl; 104*0Sstevel@tonic-gate char *gr; 105*0Sstevel@tonic-gate int nhosts = clnames->h_cnt; 106*0Sstevel@tonic-gate char *host0, *host; 107*0Sstevel@tonic-gate int i, j, n; 108*0Sstevel@tonic-gate int response; 109*0Sstevel@tonic-gate int belong = 0; 110*0Sstevel@tonic-gate static char *domain; 111*0Sstevel@tonic-gate 112*0Sstevel@tonic-gate if (domain == NULL) { 113*0Sstevel@tonic-gate int ssize; 114*0Sstevel@tonic-gate 115*0Sstevel@tonic-gate domain = exmalloc(SYS_NMLN); 116*0Sstevel@tonic-gate ssize = sysinfo(SI_SRPC_DOMAIN, domain, SYS_NMLN); 117*0Sstevel@tonic-gate if (ssize > SYS_NMLN) { 118*0Sstevel@tonic-gate free(domain); 119*0Sstevel@tonic-gate domain = exmalloc(ssize); 120*0Sstevel@tonic-gate ssize = sysinfo(SI_SRPC_DOMAIN, domain, ssize); 121*0Sstevel@tonic-gate } 122*0Sstevel@tonic-gate /* Check for error in syscall or NULL domain name */ 123*0Sstevel@tonic-gate if (ssize <= 1) { 124*0Sstevel@tonic-gate syslog(LOG_ERR, "No default domain set"); 125*0Sstevel@tonic-gate return (0); 126*0Sstevel@tonic-gate } 127*0Sstevel@tonic-gate } 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate grl = calloc(grc, sizeof (char *)); 130*0Sstevel@tonic-gate if (grl == NULL) 131*0Sstevel@tonic-gate return (0); 132*0Sstevel@tonic-gate 133*0Sstevel@tonic-gate for (i = 0, gr = glist; i < grc && !belong; ) { 134*0Sstevel@tonic-gate /* 135*0Sstevel@tonic-gate * If the netgroup name has a '-' prepended 136*0Sstevel@tonic-gate * then a match of this name implies a failure 137*0Sstevel@tonic-gate * instead of success. 138*0Sstevel@tonic-gate */ 139*0Sstevel@tonic-gate response = (*gr != '-') ? 1 : 0; 140*0Sstevel@tonic-gate 141*0Sstevel@tonic-gate /* 142*0Sstevel@tonic-gate * Subsequent names with or without a '-' (but no mix) 143*0Sstevel@tonic-gate * can be grouped together for a single check. 144*0Sstevel@tonic-gate */ 145*0Sstevel@tonic-gate for (n = 0; i < grc; i++, n++, gr += strlen(gr) + 1) { 146*0Sstevel@tonic-gate if (response && *gr == '-' || !response && *gr != '-') 147*0Sstevel@tonic-gate break; 148*0Sstevel@tonic-gate 149*0Sstevel@tonic-gate grl[n] = response ? gr : gr + 1; 150*0Sstevel@tonic-gate } 151*0Sstevel@tonic-gate 152*0Sstevel@tonic-gate host0 = clnames->h_hostservs[0].h_host; 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate /* 155*0Sstevel@tonic-gate * If not in cache check the netgroup for each 156*0Sstevel@tonic-gate * of the hosts names (usually just one). 157*0Sstevel@tonic-gate * Enter the result into the cache. 158*0Sstevel@tonic-gate */ 159*0Sstevel@tonic-gate if (!cache_check(host0, grl, n, &belong)) { 160*0Sstevel@tonic-gate for (j = 0; j < nhosts && !belong; j++) { 161*0Sstevel@tonic-gate host = clnames->h_hostservs[j].h_host; 162*0Sstevel@tonic-gate 163*0Sstevel@tonic-gate if (__multi_innetgr(n, grl, 164*0Sstevel@tonic-gate 1, &host, 165*0Sstevel@tonic-gate 0, NULL, 166*0Sstevel@tonic-gate 1, &domain)) 167*0Sstevel@tonic-gate belong = 1; 168*0Sstevel@tonic-gate } 169*0Sstevel@tonic-gate 170*0Sstevel@tonic-gate cache_enter(host0, grl, n, belong); 171*0Sstevel@tonic-gate } 172*0Sstevel@tonic-gate } 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gate free(grl); 175*0Sstevel@tonic-gate return (belong ? response : 0); 176*0Sstevel@tonic-gate } 177*0Sstevel@tonic-gate 178*0Sstevel@tonic-gate /* 179*0Sstevel@tonic-gate * Free a cache entry and all entries 180*0Sstevel@tonic-gate * further down the chain since they 181*0Sstevel@tonic-gate * will also be expired. 182*0Sstevel@tonic-gate */ 183*0Sstevel@tonic-gate static void 184*0Sstevel@tonic-gate cache_free(struct cache_entry *entry) 185*0Sstevel@tonic-gate { 186*0Sstevel@tonic-gate struct cache_entry *ce, *next; 187*0Sstevel@tonic-gate int i; 188*0Sstevel@tonic-gate 189*0Sstevel@tonic-gate for (ce = entry; ce; ce = next) { 190*0Sstevel@tonic-gate if (ce->cache_host) 191*0Sstevel@tonic-gate free(ce->cache_host); 192*0Sstevel@tonic-gate for (i = 0; i < ce->cache_grc; i++) 193*0Sstevel@tonic-gate if (ce->cache_grl[i]) 194*0Sstevel@tonic-gate free(ce->cache_grl[i]); 195*0Sstevel@tonic-gate if (ce->cache_grl) 196*0Sstevel@tonic-gate free(ce->cache_grl); 197*0Sstevel@tonic-gate next = ce->cache_next; 198*0Sstevel@tonic-gate free(ce); 199*0Sstevel@tonic-gate } 200*0Sstevel@tonic-gate } 201*0Sstevel@tonic-gate 202*0Sstevel@tonic-gate /* 203*0Sstevel@tonic-gate * Search the entries in the cache chain looking 204*0Sstevel@tonic-gate * for an entry with a matching hostname and group 205*0Sstevel@tonic-gate * list. If a match is found then return the "belong" 206*0Sstevel@tonic-gate * value which may be 1 or 0 depending on whether the 207*0Sstevel@tonic-gate * client is a member of the list or not. This is 208*0Sstevel@tonic-gate * both a positive and negative cache. 209*0Sstevel@tonic-gate * 210*0Sstevel@tonic-gate * Cache entries have a validity of VALID_TIME seconds. 211*0Sstevel@tonic-gate * If we find an expired entry then blow away the entry 212*0Sstevel@tonic-gate * and the rest of the chain since entries further down 213*0Sstevel@tonic-gate * the chain will be expired too because we always add 214*0Sstevel@tonic-gate * new entries to the head of the chain. 215*0Sstevel@tonic-gate */ 216*0Sstevel@tonic-gate static int 217*0Sstevel@tonic-gate cache_check(char *host, char **grl, int grc, int *belong) 218*0Sstevel@tonic-gate { 219*0Sstevel@tonic-gate struct cache_entry *ce, *prev; 220*0Sstevel@tonic-gate time_t timenow = time(NULL); 221*0Sstevel@tonic-gate int i; 222*0Sstevel@tonic-gate 223*0Sstevel@tonic-gate (void) rw_rdlock(&cache_lock); 224*0Sstevel@tonic-gate 225*0Sstevel@tonic-gate for (ce = cache_head; ce; ce = ce->cache_next) { 226*0Sstevel@tonic-gate 227*0Sstevel@tonic-gate /* 228*0Sstevel@tonic-gate * If we find a stale entry, there can't 229*0Sstevel@tonic-gate * be any valid entries from here on. 230*0Sstevel@tonic-gate * Acquire a write lock, search the chain again 231*0Sstevel@tonic-gate * and delete the stale entry and all following 232*0Sstevel@tonic-gate * entries. 233*0Sstevel@tonic-gate */ 234*0Sstevel@tonic-gate if (timenow > ce->cache_time) { 235*0Sstevel@tonic-gate (void) rw_unlock(&cache_lock); 236*0Sstevel@tonic-gate (void) rw_wrlock(&cache_lock); 237*0Sstevel@tonic-gate 238*0Sstevel@tonic-gate for (prev = NULL, ce = cache_head; ce; 239*0Sstevel@tonic-gate prev = ce, ce = ce->cache_next) 240*0Sstevel@tonic-gate if (timenow > ce->cache_time) 241*0Sstevel@tonic-gate break; 242*0Sstevel@tonic-gate 243*0Sstevel@tonic-gate if (ce != NULL) { 244*0Sstevel@tonic-gate if (prev) 245*0Sstevel@tonic-gate prev->cache_next = NULL; 246*0Sstevel@tonic-gate else 247*0Sstevel@tonic-gate cache_head = NULL; 248*0Sstevel@tonic-gate 249*0Sstevel@tonic-gate cache_free(ce); 250*0Sstevel@tonic-gate } 251*0Sstevel@tonic-gate (void) rw_unlock(&cache_lock); 252*0Sstevel@tonic-gate 253*0Sstevel@tonic-gate return (0); 254*0Sstevel@tonic-gate } 255*0Sstevel@tonic-gate if (ce->cache_grc != grc) 256*0Sstevel@tonic-gate continue; /* no match */ 257*0Sstevel@tonic-gate 258*0Sstevel@tonic-gate if (strcasecmp(host, ce->cache_host) != 0) 259*0Sstevel@tonic-gate continue; /* no match */ 260*0Sstevel@tonic-gate 261*0Sstevel@tonic-gate for (i = 0; i < grc; i++) 262*0Sstevel@tonic-gate if (strcasecmp(ce->cache_grl[i], grl[i]) != 0) 263*0Sstevel@tonic-gate break; /* no match */ 264*0Sstevel@tonic-gate if (i < grc) 265*0Sstevel@tonic-gate continue; 266*0Sstevel@tonic-gate 267*0Sstevel@tonic-gate *belong = ce->cache_belong; 268*0Sstevel@tonic-gate (void) rw_unlock(&cache_lock); 269*0Sstevel@tonic-gate 270*0Sstevel@tonic-gate return (1); 271*0Sstevel@tonic-gate } 272*0Sstevel@tonic-gate 273*0Sstevel@tonic-gate (void) rw_unlock(&cache_lock); 274*0Sstevel@tonic-gate 275*0Sstevel@tonic-gate return (0); 276*0Sstevel@tonic-gate } 277*0Sstevel@tonic-gate 278*0Sstevel@tonic-gate /* 279*0Sstevel@tonic-gate * Put a new entry in the cache chain by 280*0Sstevel@tonic-gate * prepending it to the front. 281*0Sstevel@tonic-gate * If there isn't enough memory then just give up. 282*0Sstevel@tonic-gate */ 283*0Sstevel@tonic-gate static void 284*0Sstevel@tonic-gate cache_enter(char *host, char **grl, int grc, int belong) 285*0Sstevel@tonic-gate { 286*0Sstevel@tonic-gate struct cache_entry *entry; 287*0Sstevel@tonic-gate int i; 288*0Sstevel@tonic-gate 289*0Sstevel@tonic-gate entry = malloc(sizeof (*entry)); 290*0Sstevel@tonic-gate if (entry == NULL) 291*0Sstevel@tonic-gate return; 292*0Sstevel@tonic-gate 293*0Sstevel@tonic-gate (void) memset((caddr_t)entry, 0, sizeof (*entry)); 294*0Sstevel@tonic-gate entry->cache_host = strdup(host); 295*0Sstevel@tonic-gate if (entry->cache_host == NULL) { 296*0Sstevel@tonic-gate cache_free(entry); 297*0Sstevel@tonic-gate return; 298*0Sstevel@tonic-gate } 299*0Sstevel@tonic-gate 300*0Sstevel@tonic-gate entry->cache_time = time(NULL) + VALID_TIME; 301*0Sstevel@tonic-gate entry->cache_belong = belong; 302*0Sstevel@tonic-gate entry->cache_grl = malloc(grc * sizeof (char *)); 303*0Sstevel@tonic-gate if (entry->cache_grl == NULL) { 304*0Sstevel@tonic-gate cache_free(entry); 305*0Sstevel@tonic-gate return; 306*0Sstevel@tonic-gate } 307*0Sstevel@tonic-gate 308*0Sstevel@tonic-gate for (i = 0; i < grc; i++) { 309*0Sstevel@tonic-gate entry->cache_grl[i] = strdup(grl[i]); 310*0Sstevel@tonic-gate if (entry->cache_grl[i] == NULL) { 311*0Sstevel@tonic-gate entry->cache_grc = i; 312*0Sstevel@tonic-gate cache_free(entry); 313*0Sstevel@tonic-gate return; 314*0Sstevel@tonic-gate } 315*0Sstevel@tonic-gate } 316*0Sstevel@tonic-gate 317*0Sstevel@tonic-gate entry->cache_grc = grc; 318*0Sstevel@tonic-gate 319*0Sstevel@tonic-gate (void) rw_wrlock(&cache_lock); 320*0Sstevel@tonic-gate entry->cache_next = cache_head; 321*0Sstevel@tonic-gate cache_head = entry; 322*0Sstevel@tonic-gate (void) rw_unlock(&cache_lock); 323*0Sstevel@tonic-gate } 324*0Sstevel@tonic-gate 325*0Sstevel@tonic-gate /* 326*0Sstevel@tonic-gate * Full cache flush 327*0Sstevel@tonic-gate */ 328*0Sstevel@tonic-gate void 329*0Sstevel@tonic-gate netgrp_cache_flush(void) 330*0Sstevel@tonic-gate { 331*0Sstevel@tonic-gate (void) rw_wrlock(&cache_lock); 332*0Sstevel@tonic-gate cache_free(cache_head); 333*0Sstevel@tonic-gate cache_head = NULL; 334*0Sstevel@tonic-gate (void) rw_unlock(&cache_lock); 335*0Sstevel@tonic-gate } 336