/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright 2020 Tintri by DDN, Inc. All rights reserved.
 * Copyright 2025 RackTop Systems, Inc.
 */

/*
 * Sid manipulation (stubs).
 */

#include <sys/atomic.h>
#include <sys/avl.h>
#include <sys/cmn_err.h>
#include <sys/kmem.h>
#include <sys/mutex.h>
#include <sys/sid.h>
#include <sys/sysmacros.h>
#include <sys/systm.h>

#ifdef _KERNEL
#include <sys/kidmap.h>
#endif

#include <sys/idmap.h>
#include <util/qsort.h>

static kmutex_t sid_lock;
static avl_tree_t sid_tree;
static boolean_t sid_inited = B_FALSE;

static ksiddomain_t
*ksid_enterdomain(const char *dom)
{
	size_t len = strlen(dom) + 1;
	ksiddomain_t *res;

	ASSERT(MUTEX_HELD(&sid_lock));
	res = kmem_alloc(sizeof (ksiddomain_t), KM_SLEEP);
	res->kd_len = (uint_t)len;
	res->kd_name = kmem_alloc(len, KM_SLEEP);
	bcopy(dom, res->kd_name, len);

	res->kd_ref = 1;

	avl_add(&sid_tree, res);

	return (res);
}

void
ksid_hold(ksid_t *ks)
{
	if (ks->ks_domain != NULL)
		ksiddomain_hold(ks->ks_domain);
}

void
ksid_rele(ksid_t *ks)
{
	if (ks->ks_domain != NULL)
		ksiddomain_rele(ks->ks_domain);
}

void
ksiddomain_hold(ksiddomain_t *kd)
{
	atomic_inc_32(&kd->kd_ref);
}

void
ksiddomain_rele(ksiddomain_t *kd)
{
	if (atomic_dec_32_nv(&kd->kd_ref) == 0) {
		/*
		 * The kd reference can only be incremented from 0 when
		 * the sid_lock is held; so we lock and then check need to
		 * check for 0 again.
		 */
		mutex_enter(&sid_lock);
		if (kd->kd_ref == 0) {
			avl_remove(&sid_tree, kd);
			kmem_free(kd->kd_name, kd->kd_len);
			kmem_free(kd, sizeof (*kd));
		}
		mutex_exit(&sid_lock);
	}
}

void
ksidlist_hold(ksidlist_t *ksl)
{
	atomic_inc_32(&ksl->ksl_ref);
}

void
ksidlist_rele(ksidlist_t *ksl)
{
	if (atomic_dec_32_nv(&ksl->ksl_ref) == 0) {
		int i;

		if (ksl->ksl_sorted != NULL)
			kmem_free(ksl->ksl_sorted,
			    ksl->ksl_nsid * sizeof (ksid_t *));
		for (i = 0; i < ksl->ksl_nsid; i++)
			ksid_rele(&ksl->ksl_sids[i]);

		kmem_free(ksl, KSIDLIST_MEM(ksl->ksl_nsid));
	}
}

/*
 * Linear search is more efficient for 'small' arrays.
 * What's considered 'small' varies by system.
 * supgroupmember() uses 16; we make ours a variable for testing.
 */
int ksl_bin_search_cutoff = 16;

boolean_t
ksidlist_has_sid(ksidlist_t *ksl, const char *domain, uint32_t rid)
{
	int64_t hi, lo, m;
	int cmp;
	ksid_t *sids = ksl->ksl_sids; /* sorted by SID */

	lo = 0;
	hi = ksl->ksl_nsid - 1;

	if (hi < ksl_bin_search_cutoff) {
		for (; lo <= hi; lo++) {
			if (rid == sids[lo].ks_rid &&
			    strcmp(domain, ksid_getdomain(&sids[lo])) == 0)
				return (B_TRUE);
		}
		return (B_FALSE);
	}

	do {
		/* This is an overflow-safe version of m = (lo + hi) / 2 */
		m = (int64_t)((uint64_t)(lo + hi) >> 1);

		cmp = AVL_CMP(rid, sids[m].ks_rid);
		if (cmp == 0)
			cmp = strcmp(domain, ksid_getdomain(&sids[m]));

		if (cmp > 0)
			lo = m + 1;
		else if (cmp < 0)
			hi = m - 1;
		else
			return (B_TRUE);

	} while (lo <= hi);

	return (B_FALSE);
}

boolean_t
ksidlist_has_pid(ksidlist_t *ksl, uint32_t pid)
{
	int64_t hi, lo, m;
	int cmp;
	ksid_t **sidsp = ksl->ksl_sorted; /* sorted by posix ID */

	lo = 0;
	hi = ksl->ksl_nsid - 1;

	if (hi < ksl_bin_search_cutoff) {
		for (; lo <= hi; lo++) {
			if (pid == ksl->ksl_sids[lo].ks_id)
				return (B_TRUE);
		}
		return (B_FALSE);
	}

	do {
		/* This is an overflow-safe version of m = (lo + hi) / 2 */
		m = (int64_t)((uint64_t)(lo + hi) >> 1);

		cmp = AVL_CMP(pid, sidsp[m]->ks_id);

		if (cmp > 0)
			lo = m + 1;
		else if (cmp < 0)
			hi = m - 1;
		else
			return (B_TRUE);

	} while (lo <= hi);

	return (B_FALSE);
}

static int
ksid_cmp(const void *a, const void *b)
{
	const ksiddomain_t *ap = a;
	const ksiddomain_t *bp = b;
	int res;

	res = strcmp(ap->kd_name, bp->kd_name);

	return (AVL_ISIGN(res));
}

/*
 * Lookup the named domain in the AVL tree.
 * If no entry is found, add the domain to the AVL tree.
 * The domain is returned held and needs to be released
 * when done.
 */
ksiddomain_t
*ksid_lookupdomain(const char *dom)
{
	ksiddomain_t *res;
	ksiddomain_t tmpl;

	mutex_enter(&sid_lock);

	if (!sid_inited) {
		avl_create(&sid_tree, ksid_cmp, sizeof (ksiddomain_t),
		    offsetof(ksiddomain_t, kd_link));

		res = ksid_enterdomain(dom);
		sid_inited = B_TRUE;
		mutex_exit(&sid_lock);
		return (res);
	}

	tmpl.kd_name = (char *)dom;

	res = avl_find(&sid_tree, &tmpl, NULL);
	if (res == NULL) {
		res = ksid_enterdomain(dom);
	} else {
		ksiddomain_hold(res);
	}

	mutex_exit(&sid_lock);
	return (res);
}

const char *
ksid_getdomain(ksid_t *ks)
{
	return (ks->ks_domain->kd_name);
}

uint_t
ksid_getrid(ksid_t *ks)
{
	return (ks->ks_rid);
}

uid_t
ksid_getid(ksid_t *ks)
{
	return (ks->ks_id);
}

#ifdef _KERNEL
int
ksid_lookupbyuid(zone_t *zone, uid_t id, ksid_t *res)
{
	const char *sid_prefix;

	if (kidmap_getsidbyuid(zone, id, &sid_prefix, &res->ks_rid)
	    != IDMAP_SUCCESS)
		return (-1);

	res->ks_domain = ksid_lookupdomain(sid_prefix);

	res->ks_id = id;

	return (0);
}

int
ksid_lookupbygid(zone_t *zone, gid_t id, ksid_t *res)
{
	const char *sid_prefix;

	if (kidmap_getsidbygid(zone, id, &sid_prefix, &res->ks_rid)
	    != IDMAP_SUCCESS)
		return (-1);

	res->ks_domain = ksid_lookupdomain(sid_prefix);

	res->ks_id = id;

	return (0);
}
#endif

credsid_t *
kcrsid_alloc(void)
{
	credsid_t *kcr = kmem_zalloc(sizeof (*kcr), KM_SLEEP);
	kcr->kr_ref = 1;
	return (kcr);
}

/*
 * Returns a credsid_t with a refcount of 1.
 */
static credsid_t *
kcrsid_dup(credsid_t *org)
{
	credsid_t *new;
	ksid_index_t ki;

	if (org == NULL)
		return (kcrsid_alloc());
	if (org->kr_ref == 1)
		return (org);
	new = kcrsid_alloc();

	/* Copy, then update reference counts */
	*new = *org;
	new->kr_ref = 1;
	for (ki = 0; ki < KSID_COUNT; ki++)
		ksid_hold(&new->kr_sidx[ki]);

	if (new->kr_sidlist != NULL)
		ksidlist_hold(new->kr_sidlist);

	kcrsid_rele(org);
	return (new);
}

void
kcrsid_hold(credsid_t *kcr)
{
	atomic_inc_32(&kcr->kr_ref);
}

void
kcrsid_rele(credsid_t *kcr)
{
	if (atomic_dec_32_nv(&kcr->kr_ref) == 0) {
		ksid_index_t i;

		for (i = 0; i < KSID_COUNT; i++)
			ksid_rele(&kcr->kr_sidx[i]);

		if (kcr->kr_sidlist != NULL)
			ksidlist_rele(kcr->kr_sidlist);

		kmem_free(kcr, sizeof (*kcr));
	}
}

/*
 * Copy the SID credential into a previously allocated piece of memory.
 */
void
kcrsidcopy_to(const credsid_t *okcr, credsid_t *nkcr)
{
	int i;

	ASSERT(nkcr->kr_ref == 1);

	if (okcr == NULL)
		return;
	*nkcr = *okcr;
	for (i = 0; i < KSID_COUNT; i++)
		ksid_hold(&nkcr->kr_sidx[i]);
	if (nkcr->kr_sidlist != NULL)
		ksidlist_hold(nkcr->kr_sidlist);
	nkcr->kr_ref = 1;
}

static int
kcrsid_sidcount(const credsid_t *kcr)
{
	int cnt = 0;
	int i;

	if (kcr == NULL)
		return (0);

	for (i = 0; i < KSID_COUNT; i++)
		if (kcr->kr_sidx[i].ks_domain != NULL)
			cnt++;

	if (kcr->kr_sidlist != NULL)
		cnt += kcr->kr_sidlist->ksl_nsid;
	return (cnt);
}

/*
 * Argument needs to be a ksid_t with a properly held ks_domain reference.
 */
credsid_t *
kcrsid_setsid(credsid_t *okcr, ksid_t *ksp, ksid_index_t i)
{
	int ocnt = kcrsid_sidcount(okcr);
	credsid_t *nkcr;

	/*
	 * Unset the particular ksid; if there are no other SIDs or if this
	 * is the last SID, remove the auxilary data structure.
	 */
	if (ksp == NULL) {
		if (ocnt == 0 ||
		    (ocnt == 1 && okcr->kr_sidx[i].ks_domain != NULL)) {
			if (okcr != NULL)
				kcrsid_rele(okcr);
			return (NULL);
		}
	}
	nkcr = kcrsid_dup(okcr);
	ksid_rele(&nkcr->kr_sidx[i]);
	if (ksp == NULL)
		bzero(&nkcr->kr_sidx[i], sizeof (ksid_t));
	else
		nkcr->kr_sidx[i] = *ksp;

	return (nkcr);
}

static int
ksid_sid_cmp(const void *arg1, const void *arg2)
{
	ksid_t *sid1 = (ksid_t *)arg1;
	ksid_t *sid2 = (ksid_t *)arg2;
	int cmp = AVL_CMP(sid1->ks_rid, sid2->ks_rid);

	if (cmp == 0)
		cmp = AVL_ISIGN(strcmp(ksid_getdomain(sid1),
		    ksid_getdomain(sid2)));

	return (cmp);
}

static int
ksid_id_cmp(const void *arg1, const void *arg2)
{
	ksid_t *sid1 = *(ksid_t **)arg1;
	ksid_t *sid2 = *(ksid_t **)arg2;

	return (AVL_CMP(sid1->ks_id, sid2->ks_id));
}

/*
 * Argument needs to be a ksidlist_t with properly held ks_domain references
 * and a reference count taking the new reference into account.
 */
credsid_t *
kcrsid_setsidlist(credsid_t *okcr, ksidlist_t *ksl)
{
	int ocnt = kcrsid_sidcount(okcr);
	credsid_t *nkcr;
	int i;

	/*
	 * Unset the sidlist; if there are no further SIDs, remove the
	 * auxilary data structure.
	 */
	if (ksl == NULL) {
		if (ocnt == 0 || (okcr->kr_sidlist != NULL &&
		    ocnt == okcr->kr_sidlist->ksl_nsid)) {
			if (okcr != NULL)
				kcrsid_rele(okcr);
			return (NULL);
		}
	}
	/* This might return 'okcr' if the refcnt is 1 */
	nkcr = kcrsid_dup(okcr);
	if (nkcr->kr_sidlist != NULL)
		ksidlist_rele(nkcr->kr_sidlist);

	nkcr->kr_sidlist = ksl;

	/* sort the lists so that we can do binary search */
	if (ksl != NULL && ksl->ksl_sorted == NULL) {
		qsort(ksl->ksl_sids, ksl->ksl_nsid, sizeof (ksid_t),
		    ksid_sid_cmp);

		ksl->ksl_sorted = kmem_alloc(ksl->ksl_nsid * sizeof (ksid_t *),
		    KM_SLEEP);
		for (i = 0; i < ksl->ksl_nsid; i++)
			ksl->ksl_sorted[i] = &ksl->ksl_sids[i];
		qsort(ksl->ksl_sorted, ksl->ksl_nsid, sizeof (ksid_t *),
		    ksid_id_cmp);
	}

	return (nkcr);
}

ksidlist_t *
kcrsid_gidstosids(zone_t *zone, int ngrp, gid_t *grp)
{
	int i;
	ksidlist_t *list;
	int cnt;

	if (ngrp == 0)
		return (NULL);

	cnt = 0;
	list = kmem_zalloc(KSIDLIST_MEM(ngrp), KM_SLEEP);

	list->ksl_nsid = ngrp;
	list->ksl_ref = 1;

	for (i = 0; i < ngrp; i++) {
		if (grp[i] > MAXUID) {
			list->ksl_neid++;
#ifdef _KERNEL
			if (ksid_lookupbygid(zone,
			    grp[i], &list->ksl_sids[i]) != 0) {
				while (--i >= 0)
					ksid_rele(&list->ksl_sids[i]);
				cnt = 0;
				break;
			}
#endif
			cnt++;
		} else {
			list->ksl_sids[i].ks_id = grp[i];
		}
	}
	if (cnt == 0) {
		kmem_free(list, KSIDLIST_MEM(ngrp));
		return (NULL);
	}
	return (list);
}