1c5c4113dSnw141292 /*
2c5c4113dSnw141292 * CDDL HEADER START
3c5c4113dSnw141292 *
4c5c4113dSnw141292 * The contents of this file are subject to the terms of the
5c5c4113dSnw141292 * Common Development and Distribution License (the "License").
6c5c4113dSnw141292 * You may not use this file except in compliance with the License.
7c5c4113dSnw141292 *
8c5c4113dSnw141292 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9c5c4113dSnw141292 * or http://www.opensolaris.org/os/licensing.
10c5c4113dSnw141292 * See the License for the specific language governing permissions
11c5c4113dSnw141292 * and limitations under the License.
12c5c4113dSnw141292 *
13c5c4113dSnw141292 * When distributing Covered Code, include this CDDL HEADER in each
14c5c4113dSnw141292 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15c5c4113dSnw141292 * If applicable, add the following below this CDDL HEADER, with the
16c5c4113dSnw141292 * fields enclosed by brackets "[]" replaced with your own identifying
17c5c4113dSnw141292 * information: Portions Copyright [yyyy] [name of copyright owner]
18c5c4113dSnw141292 *
19c5c4113dSnw141292 * CDDL HEADER END
20c5c4113dSnw141292 */
21c5c4113dSnw141292 /*
22148c5f43SAlan Wright * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23f4a94a44SGordon Ross * Copyright 2016 Nexenta Systems, Inc. All rights reserved.
24*e3d9e7f3SGordon Ross * Copyright 2022 RackTop Systems, Inc.
25c5c4113dSnw141292 */
26c5c4113dSnw141292
27c5c4113dSnw141292 /*
28c5c4113dSnw141292 * Database related utility routines
29c5c4113dSnw141292 */
30c5c4113dSnw141292
31c5c4113dSnw141292 #include <stdio.h>
32c5c4113dSnw141292 #include <stdlib.h>
33c5c4113dSnw141292 #include <string.h>
34c5c4113dSnw141292 #include <errno.h>
35c5c4113dSnw141292 #include <sys/types.h>
36c5c4113dSnw141292 #include <sys/stat.h>
37c5c4113dSnw141292 #include <rpc/rpc.h>
38c5c4113dSnw141292 #include <sys/sid.h>
39c5c4113dSnw141292 #include <time.h>
40c5c4113dSnw141292 #include <pwd.h>
41c5c4113dSnw141292 #include <grp.h>
4284decf41Sjp151216 #include <pthread.h>
4384decf41Sjp151216 #include <assert.h>
44cd37da74Snw141292 #include <sys/u8_textprep.h>
458c155366SJordan Brown #include <alloca.h>
46cb174861Sjoyce mcintosh #include <libuutil.h>
47148c5f43SAlan Wright #include <note.h>
48c5c4113dSnw141292
49c5c4113dSnw141292 #include "idmapd.h"
50c5c4113dSnw141292 #include "adutils.h"
51c5c4113dSnw141292 #include "string.h"
52c5c4113dSnw141292 #include "idmap_priv.h"
53cd37da74Snw141292 #include "schema.h"
54e8c27ec8Sbaban #include "nldaputils.h"
55148c5f43SAlan Wright #include "idmap_lsa.h"
56c5c4113dSnw141292
5784decf41Sjp151216
58c5c4113dSnw141292 static idmap_retcode sql_compile_n_step_once(sqlite *, char *,
59c5c4113dSnw141292 sqlite_vm **, int *, int, const char ***);
60e8c27ec8Sbaban static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *);
61e8c27ec8Sbaban static idmap_retcode lookup_cache_name2sid(sqlite *, const char *,
62148c5f43SAlan Wright const char *, char **, char **, idmap_rid_t *, idmap_id_type *);
63e8c27ec8Sbaban
64c5c4113dSnw141292 #define EMPTY_NAME(name) (*name == 0 || strcmp(name, "\"\"") == 0)
65c5c4113dSnw141292
66c5c4113dSnw141292 #define DO_NOT_ALLOC_NEW_ID_MAPPING(req)\
67c5c4113dSnw141292 (req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC)
68c5c4113dSnw141292
69c5c4113dSnw141292 #define AVOID_NAMESERVICE(req)\
70c5c4113dSnw141292 (req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE)
71c5c4113dSnw141292
722b4a7802SBaban Kenkre #define ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)\
732b4a7802SBaban Kenkre (req->flag & IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY)
742b4a7802SBaban Kenkre
75c5c4113dSnw141292 typedef enum init_db_option {
76c5c4113dSnw141292 FAIL_IF_CORRUPT = 0,
77c5c4113dSnw141292 REMOVE_IF_CORRUPT = 1
78c5c4113dSnw141292 } init_db_option_t;
79c5c4113dSnw141292
8084decf41Sjp151216 /*
8108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Thread specific data to hold the database handles so that the
8208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * databases are not opened and closed for every request. It also
8384decf41Sjp151216 * contains the sqlite busy handler structure.
8484decf41Sjp151216 */
8584decf41Sjp151216
8684decf41Sjp151216 struct idmap_busy {
8784decf41Sjp151216 const char *name;
8884decf41Sjp151216 const int *delays;
8984decf41Sjp151216 int delay_size;
9084decf41Sjp151216 int total;
9184decf41Sjp151216 int sec;
9284decf41Sjp151216 };
9384decf41Sjp151216
9484decf41Sjp151216
9584decf41Sjp151216 typedef struct idmap_tsd {
9684decf41Sjp151216 sqlite *db_db;
9784decf41Sjp151216 sqlite *cache_db;
9884decf41Sjp151216 struct idmap_busy cache_busy;
9984decf41Sjp151216 struct idmap_busy db_busy;
10084decf41Sjp151216 } idmap_tsd_t;
10184decf41Sjp151216
102e3f2c991SKeyur Desai /*
103e3f2c991SKeyur Desai * Flags to indicate how local the directory we're consulting is.
104e3f2c991SKeyur Desai * If neither is set, it means the directory belongs to a remote forest.
105e3f2c991SKeyur Desai */
106e3f2c991SKeyur Desai #define DOMAIN_IS_LOCAL 0x01
107e3f2c991SKeyur Desai #define FOREST_IS_LOCAL 0x02
10884decf41Sjp151216
10984decf41Sjp151216 static const int cache_delay_table[] =
11084decf41Sjp151216 { 1, 2, 5, 10, 15, 20, 25, 30, 35, 40,
11184decf41Sjp151216 50, 50, 60, 70, 80, 90, 100};
11284decf41Sjp151216
11384decf41Sjp151216 static const int db_delay_table[] =
11484decf41Sjp151216 { 5, 10, 15, 20, 30, 40, 55, 70, 100};
11584decf41Sjp151216
11684decf41Sjp151216
11784decf41Sjp151216 static pthread_key_t idmap_tsd_key;
11884decf41Sjp151216
11984decf41Sjp151216 void
idmap_tsd_destroy(void * key)12084decf41Sjp151216 idmap_tsd_destroy(void *key)
12184decf41Sjp151216 {
12284decf41Sjp151216
12384decf41Sjp151216 idmap_tsd_t *tsd = (idmap_tsd_t *)key;
12484decf41Sjp151216 if (tsd) {
12584decf41Sjp151216 if (tsd->db_db)
12684decf41Sjp151216 (void) sqlite_close(tsd->db_db);
12784decf41Sjp151216 if (tsd->cache_db)
12884decf41Sjp151216 (void) sqlite_close(tsd->cache_db);
12984decf41Sjp151216 free(tsd);
13084decf41Sjp151216 }
13184decf41Sjp151216 }
13284decf41Sjp151216
133148c5f43SAlan Wright void
idmap_init_tsd_key(void)134cd37da74Snw141292 idmap_init_tsd_key(void)
135cd37da74Snw141292 {
136148c5f43SAlan Wright int rc;
137148c5f43SAlan Wright
138148c5f43SAlan Wright rc = pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy);
139148c5f43SAlan Wright assert(rc == 0);
14084decf41Sjp151216 }
14184decf41Sjp151216
14284decf41Sjp151216
14384decf41Sjp151216
14484decf41Sjp151216 idmap_tsd_t *
idmap_get_tsd(void)14584decf41Sjp151216 idmap_get_tsd(void)
14684decf41Sjp151216 {
14784decf41Sjp151216 idmap_tsd_t *tsd;
14884decf41Sjp151216
14984decf41Sjp151216 if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) {
15084decf41Sjp151216 /* No thread specific data so create it */
15184decf41Sjp151216 if ((tsd = malloc(sizeof (*tsd))) != NULL) {
15284decf41Sjp151216 /* Initialize thread specific data */
15384decf41Sjp151216 (void) memset(tsd, 0, sizeof (*tsd));
15484decf41Sjp151216 /* save the trhread specific data */
15584decf41Sjp151216 if (pthread_setspecific(idmap_tsd_key, tsd) != 0) {
15684decf41Sjp151216 /* Can't store key */
15784decf41Sjp151216 free(tsd);
15884decf41Sjp151216 tsd = NULL;
15984decf41Sjp151216 }
16084decf41Sjp151216 } else {
16184decf41Sjp151216 tsd = NULL;
16284decf41Sjp151216 }
16384decf41Sjp151216 }
16484decf41Sjp151216
16584decf41Sjp151216 return (tsd);
16684decf41Sjp151216 }
16784decf41Sjp151216
168cd37da74Snw141292 /*
169cd37da74Snw141292 * A simple wrapper around u8_textprep_str() that returns the Unicode
170cd37da74Snw141292 * lower-case version of some string. The result must be freed.
171cd37da74Snw141292 */
172cd37da74Snw141292 char *
tolower_u8(const char * s)173cd37da74Snw141292 tolower_u8(const char *s)
174cd37da74Snw141292 {
175cd37da74Snw141292 char *res = NULL;
176cd37da74Snw141292 char *outs;
177cd37da74Snw141292 size_t inlen, outlen, inbytesleft, outbytesleft;
178cd37da74Snw141292 int rc, err;
179cd37da74Snw141292
180cd37da74Snw141292 /*
181cd37da74Snw141292 * u8_textprep_str() does not allocate memory. The input and
182cd37da74Snw141292 * output buffers may differ in size (though that would be more
183cd37da74Snw141292 * likely when normalization is done). We have to loop over it...
184cd37da74Snw141292 *
185cd37da74Snw141292 * To improve the chances that we can avoid looping we add 10
186cd37da74Snw141292 * bytes of output buffer room the first go around.
187cd37da74Snw141292 */
188cd37da74Snw141292 inlen = inbytesleft = strlen(s);
189cd37da74Snw141292 outlen = outbytesleft = inlen + 10;
190cd37da74Snw141292 if ((res = malloc(outlen)) == NULL)
191cd37da74Snw141292 return (NULL);
192cd37da74Snw141292 outs = res;
193cd37da74Snw141292
194cd37da74Snw141292 while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs,
195cd37da74Snw141292 &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 &&
196cd37da74Snw141292 err == E2BIG) {
197cd37da74Snw141292 if ((res = realloc(res, outlen + inbytesleft)) == NULL)
198cd37da74Snw141292 return (NULL);
199cd37da74Snw141292 /* adjust input/output buffer pointers */
200cd37da74Snw141292 s += (inlen - inbytesleft);
201cd37da74Snw141292 outs = res + outlen - outbytesleft;
202cd37da74Snw141292 /* adjust outbytesleft and outlen */
203cd37da74Snw141292 outlen += inbytesleft;
204cd37da74Snw141292 outbytesleft += inbytesleft;
205cd37da74Snw141292 }
206cd37da74Snw141292
207cd37da74Snw141292 if (rc < 0) {
208cd37da74Snw141292 free(res);
209cd37da74Snw141292 res = NULL;
210cd37da74Snw141292 return (NULL);
211cd37da74Snw141292 }
212cd37da74Snw141292
213cd37da74Snw141292 res[outlen - outbytesleft] = '\0';
214cd37da74Snw141292
215cd37da74Snw141292 return (res);
216cd37da74Snw141292 }
217cd37da74Snw141292
218cd37da74Snw141292 static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
219cd37da74Snw141292 const char *while_doing);
220cd37da74Snw141292
221c5c4113dSnw141292
222c5c4113dSnw141292 /*
223c5c4113dSnw141292 * Initialize 'dbname' using 'sql'
224c5c4113dSnw141292 */
225cd37da74Snw141292 static
226cd37da74Snw141292 int
init_db_instance(const char * dbname,int version,const char * detect_version_sql,char * const * sql,init_db_option_t opt,int * created,int * upgraded)227cd37da74Snw141292 init_db_instance(const char *dbname, int version,
228cd37da74Snw141292 const char *detect_version_sql, char * const *sql,
229cd37da74Snw141292 init_db_option_t opt, int *created, int *upgraded)
230c5c4113dSnw141292 {
231cd37da74Snw141292 int rc, curr_version;
232cd37da74Snw141292 int tries = 1;
233cd37da74Snw141292 int prio = LOG_NOTICE;
234c5c4113dSnw141292 sqlite *db = NULL;
235cd37da74Snw141292 char *errmsg = NULL;
236c5c4113dSnw141292
237cd37da74Snw141292 *created = 0;
238cd37da74Snw141292 *upgraded = 0;
239c5c4113dSnw141292
240cd37da74Snw141292 if (opt == REMOVE_IF_CORRUPT)
241cd37da74Snw141292 tries = 3;
242cd37da74Snw141292
243cd37da74Snw141292 rinse_repeat:
244cd37da74Snw141292 if (tries == 0) {
245cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname);
246c5c4113dSnw141292 return (-1);
247cd37da74Snw141292 }
248cd37da74Snw141292 if (tries-- == 1)
249cd37da74Snw141292 /* Last try, log errors */
250cd37da74Snw141292 prio = LOG_ERR;
251c5c4113dSnw141292
252cd37da74Snw141292 db = sqlite_open(dbname, 0600, &errmsg);
253cd37da74Snw141292 if (db == NULL) {
254cd37da74Snw141292 idmapdlog(prio, "Error creating database %s (%s)",
255cd37da74Snw141292 dbname, CHECK_NULL(errmsg));
256cd37da74Snw141292 sqlite_freemem(errmsg);
257cd37da74Snw141292 if (opt == REMOVE_IF_CORRUPT)
258c5c4113dSnw141292 (void) unlink(dbname);
259cd37da74Snw141292 goto rinse_repeat;
260c5c4113dSnw141292 }
261c5c4113dSnw141292
262c5c4113dSnw141292 sqlite_busy_timeout(db, 3000);
263cd37da74Snw141292
264cd37da74Snw141292 /* Detect current version of schema in the db, if any */
265cd37da74Snw141292 curr_version = 0;
266cd37da74Snw141292 if (detect_version_sql != NULL) {
267cd37da74Snw141292 char *end, **results;
268cd37da74Snw141292 int nrow;
269cd37da74Snw141292
270cd37da74Snw141292 #ifdef IDMAPD_DEBUG
271cd37da74Snw141292 (void) fprintf(stderr, "Schema version detection SQL: %s\n",
272cd37da74Snw141292 detect_version_sql);
273cd37da74Snw141292 #endif /* IDMAPD_DEBUG */
274cd37da74Snw141292 rc = sqlite_get_table(db, detect_version_sql, &results,
275cd37da74Snw141292 &nrow, NULL, &errmsg);
276cd37da74Snw141292 if (rc != SQLITE_OK) {
277cd37da74Snw141292 idmapdlog(prio,
278cd37da74Snw141292 "Error detecting schema version of db %s (%s)",
279cd37da74Snw141292 dbname, errmsg);
280cd37da74Snw141292 sqlite_freemem(errmsg);
281cd37da74Snw141292 sqlite_free_table(results);
282c5c4113dSnw141292 sqlite_close(db);
283cd37da74Snw141292 return (-1);
284cd37da74Snw141292 }
285cd37da74Snw141292 if (nrow != 1) {
286cd37da74Snw141292 idmapdlog(prio,
287cd37da74Snw141292 "Error detecting schema version of db %s", dbname);
288cd37da74Snw141292 sqlite_close(db);
289cd37da74Snw141292 sqlite_free_table(results);
290cd37da74Snw141292 return (-1);
291cd37da74Snw141292 }
292cd37da74Snw141292 curr_version = strtol(results[1], &end, 10);
293cd37da74Snw141292 sqlite_free_table(results);
294c5c4113dSnw141292 }
295c5c4113dSnw141292
296cd37da74Snw141292 if (curr_version < 0) {
297cd37da74Snw141292 if (opt == REMOVE_IF_CORRUPT)
298cd37da74Snw141292 (void) unlink(dbname);
299cd37da74Snw141292 goto rinse_repeat;
300c5c4113dSnw141292 }
301c5c4113dSnw141292
302cd37da74Snw141292 if (curr_version == version)
303cd37da74Snw141292 goto done;
304cd37da74Snw141292
305cd37da74Snw141292 /* Install or upgrade schema */
306cd37da74Snw141292 #ifdef IDMAPD_DEBUG
307cd37da74Snw141292 (void) fprintf(stderr, "Schema init/upgrade SQL: %s\n",
308cd37da74Snw141292 sql[curr_version]);
309cd37da74Snw141292 #endif /* IDMAPD_DEBUG */
310cd37da74Snw141292 rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname,
311cd37da74Snw141292 (curr_version == 0) ? "installing schema" : "upgrading schema");
312cd37da74Snw141292 if (rc != 0) {
313cd37da74Snw141292 idmapdlog(prio, "Error %s schema for db %s", dbname,
314cd37da74Snw141292 (curr_version == 0) ? "installing schema" :
315cd37da74Snw141292 "upgrading schema");
316cd37da74Snw141292 if (opt == REMOVE_IF_CORRUPT)
317cd37da74Snw141292 (void) unlink(dbname);
318cd37da74Snw141292 goto rinse_repeat;
319c5c4113dSnw141292 }
320c5c4113dSnw141292
321cd37da74Snw141292 *upgraded = (curr_version > 0);
322cd37da74Snw141292 *created = (curr_version == 0);
323cd37da74Snw141292
324cd37da74Snw141292 done:
325c5c4113dSnw141292 (void) sqlite_close(db);
326cd37da74Snw141292 return (0);
327c5c4113dSnw141292 }
328c5c4113dSnw141292
32984decf41Sjp151216
33084decf41Sjp151216 /*
33184decf41Sjp151216 * This is the SQLite database busy handler that retries the SQL
33284decf41Sjp151216 * operation until it is successful.
33384decf41Sjp151216 */
33484decf41Sjp151216 int
idmap_sqlite_busy_handler(void * arg,const char * table_name,int count)33584decf41Sjp151216 idmap_sqlite_busy_handler(void *arg, const char *table_name, int count)
33684decf41Sjp151216 {
33784decf41Sjp151216 struct idmap_busy *busy = arg;
33884decf41Sjp151216 int delay;
33984decf41Sjp151216 struct timespec rqtp;
34084decf41Sjp151216
34184decf41Sjp151216 if (count == 1) {
34284decf41Sjp151216 busy->total = 0;
34384decf41Sjp151216 busy->sec = 2;
34484decf41Sjp151216 }
34584decf41Sjp151216 if (busy->total > 1000 * busy->sec) {
3462b3ecdebSjp151216 idmapdlog(LOG_DEBUG,
34784decf41Sjp151216 "Thread %d waited %d sec for the %s database",
34884decf41Sjp151216 pthread_self(), busy->sec, busy->name);
34984decf41Sjp151216 busy->sec++;
35084decf41Sjp151216 }
35184decf41Sjp151216
35284decf41Sjp151216 if (count <= busy->delay_size) {
35384decf41Sjp151216 delay = busy->delays[count-1];
35484decf41Sjp151216 } else {
35584decf41Sjp151216 delay = busy->delays[busy->delay_size - 1];
35684decf41Sjp151216 }
35784decf41Sjp151216 busy->total += delay;
35884decf41Sjp151216 rqtp.tv_sec = 0;
35919449258SJosef 'Jeff' Sipek rqtp.tv_nsec = MSEC2NSEC(delay);
36084decf41Sjp151216 (void) nanosleep(&rqtp, NULL);
36184decf41Sjp151216 return (1);
36284decf41Sjp151216 }
36384decf41Sjp151216
36484decf41Sjp151216
365c5c4113dSnw141292 /*
366c5c4113dSnw141292 * Get the database handle
367c5c4113dSnw141292 */
368c5c4113dSnw141292 idmap_retcode
get_db_handle(sqlite ** db)369cd37da74Snw141292 get_db_handle(sqlite **db)
370cd37da74Snw141292 {
371c5c4113dSnw141292 char *errmsg;
37284decf41Sjp151216 idmap_tsd_t *tsd;
373c5c4113dSnw141292
374c5c4113dSnw141292 /*
37584decf41Sjp151216 * Retrieve the db handle from thread-specific storage
376c5c4113dSnw141292 * If none exists, open and store in thread-specific storage.
377c5c4113dSnw141292 */
37884decf41Sjp151216 if ((tsd = idmap_get_tsd()) == NULL) {
37984decf41Sjp151216 idmapdlog(LOG_ERR,
380cd37da74Snw141292 "Error getting thread specific data for %s", IDMAP_DBNAME);
38184decf41Sjp151216 return (IDMAP_ERR_MEMORY);
38284decf41Sjp151216 }
383c5c4113dSnw141292
38484decf41Sjp151216 if (tsd->db_db == NULL) {
38584decf41Sjp151216 tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg);
38684decf41Sjp151216 if (tsd->db_db == NULL) {
387cd37da74Snw141292 idmapdlog(LOG_ERR, "Error opening database %s (%s)",
388c5c4113dSnw141292 IDMAP_DBNAME, CHECK_NULL(errmsg));
389c5c4113dSnw141292 sqlite_freemem(errmsg);
390cd37da74Snw141292 return (IDMAP_ERR_DB);
391c5c4113dSnw141292 }
392cd37da74Snw141292
39384decf41Sjp151216 tsd->db_busy.name = IDMAP_DBNAME;
39484decf41Sjp151216 tsd->db_busy.delays = db_delay_table;
39584decf41Sjp151216 tsd->db_busy.delay_size = sizeof (db_delay_table) /
39684decf41Sjp151216 sizeof (int);
39784decf41Sjp151216 sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler,
39884decf41Sjp151216 &tsd->db_busy);
39984decf41Sjp151216 }
40084decf41Sjp151216 *db = tsd->db_db;
401c5c4113dSnw141292 return (IDMAP_SUCCESS);
402c5c4113dSnw141292 }
403c5c4113dSnw141292
404c5c4113dSnw141292 /*
405*e3d9e7f3SGordon Ross * Force next get_db_handle to reopen.
406*e3d9e7f3SGordon Ross * Called after DB errors.
407*e3d9e7f3SGordon Ross */
408*e3d9e7f3SGordon Ross void
kill_db_handle(sqlite * db)409*e3d9e7f3SGordon Ross kill_db_handle(sqlite *db)
410*e3d9e7f3SGordon Ross {
411*e3d9e7f3SGordon Ross idmap_tsd_t *tsd;
412*e3d9e7f3SGordon Ross sqlite *t;
413*e3d9e7f3SGordon Ross
414*e3d9e7f3SGordon Ross if (db == NULL)
415*e3d9e7f3SGordon Ross return;
416*e3d9e7f3SGordon Ross
417*e3d9e7f3SGordon Ross if ((tsd = idmap_get_tsd()) == NULL)
418*e3d9e7f3SGordon Ross return;
419*e3d9e7f3SGordon Ross
420*e3d9e7f3SGordon Ross if ((t = tsd->db_db) == NULL)
421*e3d9e7f3SGordon Ross return;
422*e3d9e7f3SGordon Ross assert(t == db);
423*e3d9e7f3SGordon Ross tsd->db_db = NULL;
424*e3d9e7f3SGordon Ross (void) sqlite_close(t);
425*e3d9e7f3SGordon Ross }
426*e3d9e7f3SGordon Ross
427*e3d9e7f3SGordon Ross /*
428c5c4113dSnw141292 * Get the cache handle
429c5c4113dSnw141292 */
430c5c4113dSnw141292 idmap_retcode
get_cache_handle(sqlite ** cache)431cd37da74Snw141292 get_cache_handle(sqlite **cache)
432cd37da74Snw141292 {
433c5c4113dSnw141292 char *errmsg;
43484decf41Sjp151216 idmap_tsd_t *tsd;
435c5c4113dSnw141292
436c5c4113dSnw141292 /*
43784decf41Sjp151216 * Retrieve the db handle from thread-specific storage
438c5c4113dSnw141292 * If none exists, open and store in thread-specific storage.
439c5c4113dSnw141292 */
44084decf41Sjp151216 if ((tsd = idmap_get_tsd()) == NULL) {
441cd37da74Snw141292 idmapdlog(LOG_ERR, "Error getting thread specific data for %s",
44284decf41Sjp151216 IDMAP_DBNAME);
44384decf41Sjp151216 return (IDMAP_ERR_MEMORY);
44484decf41Sjp151216 }
445c5c4113dSnw141292
44684decf41Sjp151216 if (tsd->cache_db == NULL) {
44784decf41Sjp151216 tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg);
44884decf41Sjp151216 if (tsd->cache_db == NULL) {
449cd37da74Snw141292 idmapdlog(LOG_ERR, "Error opening database %s (%s)",
450c5c4113dSnw141292 IDMAP_CACHENAME, CHECK_NULL(errmsg));
451c5c4113dSnw141292 sqlite_freemem(errmsg);
452cd37da74Snw141292 return (IDMAP_ERR_DB);
453c5c4113dSnw141292 }
454cd37da74Snw141292
45584decf41Sjp151216 tsd->cache_busy.name = IDMAP_CACHENAME;
45684decf41Sjp151216 tsd->cache_busy.delays = cache_delay_table;
45784decf41Sjp151216 tsd->cache_busy.delay_size = sizeof (cache_delay_table) /
45884decf41Sjp151216 sizeof (int);
45984decf41Sjp151216 sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler,
46084decf41Sjp151216 &tsd->cache_busy);
46184decf41Sjp151216 }
46284decf41Sjp151216 *cache = tsd->cache_db;
463c5c4113dSnw141292 return (IDMAP_SUCCESS);
464c5c4113dSnw141292 }
465c5c4113dSnw141292
466c5c4113dSnw141292 /*
467*e3d9e7f3SGordon Ross * Force next get_cache_handle to reopen.
468*e3d9e7f3SGordon Ross * Called after DB errors.
469*e3d9e7f3SGordon Ross */
470*e3d9e7f3SGordon Ross void
kill_cache_handle(sqlite * db)471*e3d9e7f3SGordon Ross kill_cache_handle(sqlite *db)
472*e3d9e7f3SGordon Ross {
473*e3d9e7f3SGordon Ross idmap_tsd_t *tsd;
474*e3d9e7f3SGordon Ross sqlite *t;
475*e3d9e7f3SGordon Ross
476*e3d9e7f3SGordon Ross if (db == NULL)
477*e3d9e7f3SGordon Ross return;
478*e3d9e7f3SGordon Ross
479*e3d9e7f3SGordon Ross if ((tsd = idmap_get_tsd()) == NULL)
480*e3d9e7f3SGordon Ross return;
481*e3d9e7f3SGordon Ross
482*e3d9e7f3SGordon Ross if ((t = tsd->cache_db) == NULL)
483*e3d9e7f3SGordon Ross return;
484*e3d9e7f3SGordon Ross assert(t == db);
485*e3d9e7f3SGordon Ross tsd->cache_db = NULL;
486*e3d9e7f3SGordon Ross (void) sqlite_close(t);
487*e3d9e7f3SGordon Ross }
488*e3d9e7f3SGordon Ross
489*e3d9e7f3SGordon Ross /*
490c5c4113dSnw141292 * Initialize cache and db
491c5c4113dSnw141292 */
492c5c4113dSnw141292 int
init_dbs(void)4939bf5f78fSMatt Barden init_dbs(void)
494cd37da74Snw141292 {
49548258c6bSjp151216 char *sql[4];
496cd37da74Snw141292 int created, upgraded;
497cd37da74Snw141292
498c5c4113dSnw141292 /* name-based mappings; probably OK to blow away in a pinch(?) */
499cd37da74Snw141292 sql[0] = DB_INSTALL_SQL;
500cd37da74Snw141292 sql[1] = DB_UPGRADE_FROM_v1_SQL;
50148258c6bSjp151216 sql[2] = NULL;
502cd37da74Snw141292
503cd37da74Snw141292 if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql,
504cd37da74Snw141292 FAIL_IF_CORRUPT, &created, &upgraded) < 0)
505c5c4113dSnw141292 return (-1);
506c5c4113dSnw141292
507c5c4113dSnw141292 /* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */
508cd37da74Snw141292 sql[0] = CACHE_INSTALL_SQL;
509cd37da74Snw141292 sql[1] = CACHE_UPGRADE_FROM_v1_SQL;
51048258c6bSjp151216 sql[2] = CACHE_UPGRADE_FROM_v2_SQL;
51148258c6bSjp151216 sql[3] = NULL;
51248258c6bSjp151216
513cd37da74Snw141292 if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL,
514cd37da74Snw141292 sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0)
515c5c4113dSnw141292 return (-1);
516c5c4113dSnw141292
517*e3d9e7f3SGordon Ross /*
518*e3d9e7f3SGordon Ross * TODO: If cache DB NOT created, get MAX PID for allocids(), eg.
519*e3d9e7f3SGordon Ross * sql = "SELECT MAX(pid) as max_pid FROM idmap_cache;"
520*e3d9e7f3SGordon Ross * sqlite_get_table(db, sql, &results, &nrow, NULL, &errmsg);
521*e3d9e7f3SGordon Ross *
522*e3d9e7f3SGordon Ross * However, the allocids() system call does not currently allow
523*e3d9e7f3SGordon Ross * for this kind of initialization. Until that's dealt with,
524*e3d9e7f3SGordon Ross * use of a persistent idmap cache DB cannot work.
525*e3d9e7f3SGordon Ross */
526*e3d9e7f3SGordon Ross
527*e3d9e7f3SGordon Ross /* This becomes the "flush" flag for allocids() */
528cd37da74Snw141292 _idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0;
529cd37da74Snw141292
530c5c4113dSnw141292 return (0);
531c5c4113dSnw141292 }
532c5c4113dSnw141292
533c5c4113dSnw141292 /*
534c5c4113dSnw141292 * Finalize databases
535c5c4113dSnw141292 */
536c5c4113dSnw141292 void
fini_dbs(void)5379bf5f78fSMatt Barden fini_dbs(void)
538cd37da74Snw141292 {
539c5c4113dSnw141292 }
540c5c4113dSnw141292
541c5c4113dSnw141292 /*
542e8c27ec8Sbaban * This table is a listing of status codes that will be returned to the
543c5c4113dSnw141292 * client when a SQL command fails with the corresponding error message.
544c5c4113dSnw141292 */
545c5c4113dSnw141292 static msg_table_t sqlmsgtable[] = {
54662c60062Sbaban {IDMAP_ERR_U2W_NAMERULE_CONFLICT,
547c5c4113dSnw141292 "columns unixname, is_user, u2w_order are not unique"},
54862c60062Sbaban {IDMAP_ERR_W2U_NAMERULE_CONFLICT,
549cd37da74Snw141292 "columns winname, windomain, is_user, is_wuser, w2u_order are not"
550cd37da74Snw141292 " unique"},
551cd37da74Snw141292 {IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"},
552c5c4113dSnw141292 {-1, NULL}
553c5c4113dSnw141292 };
554c5c4113dSnw141292
555c5c4113dSnw141292 /*
556c5c4113dSnw141292 * idmapd's version of string2stat to map SQLite messages to
557c5c4113dSnw141292 * status codes
558c5c4113dSnw141292 */
559c5c4113dSnw141292 idmap_retcode
idmapd_string2stat(const char * msg)560cd37da74Snw141292 idmapd_string2stat(const char *msg)
561cd37da74Snw141292 {
562c5c4113dSnw141292 int i;
563c5c4113dSnw141292 for (i = 0; sqlmsgtable[i].msg; i++) {
564c5c4113dSnw141292 if (strcasecmp(sqlmsgtable[i].msg, msg) == 0)
565c5c4113dSnw141292 return (sqlmsgtable[i].retcode);
566c5c4113dSnw141292 }
567c5c4113dSnw141292 return (IDMAP_ERR_OTHER);
568c5c4113dSnw141292 }
569c5c4113dSnw141292
570c5c4113dSnw141292 /*
571cd37da74Snw141292 * Executes some SQL in a transaction.
572cd37da74Snw141292 *
573cd37da74Snw141292 * Returns 0 on success, -1 if it failed but the rollback succeeded, -2
574cd37da74Snw141292 * if the rollback failed.
575cd37da74Snw141292 */
576cd37da74Snw141292 static
577cd37da74Snw141292 int
sql_exec_tran_no_cb(sqlite * db,char * sql,const char * dbname,const char * while_doing)578cd37da74Snw141292 sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
579cd37da74Snw141292 const char *while_doing)
580cd37da74Snw141292 {
581cd37da74Snw141292 char *errmsg = NULL;
582cd37da74Snw141292 int rc;
583cd37da74Snw141292
584cd37da74Snw141292 rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg);
585cd37da74Snw141292 if (rc != SQLITE_OK) {
586cd37da74Snw141292 idmapdlog(LOG_ERR, "Begin transaction failed (%s) "
587cd37da74Snw141292 "while %s (%s)", errmsg, while_doing, dbname);
588cd37da74Snw141292 sqlite_freemem(errmsg);
589cd37da74Snw141292 return (-1);
590cd37da74Snw141292 }
591cd37da74Snw141292
592cd37da74Snw141292 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg);
593cd37da74Snw141292 if (rc != SQLITE_OK) {
594cd37da74Snw141292 idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg,
595cd37da74Snw141292 while_doing, dbname);
596cd37da74Snw141292 sqlite_freemem(errmsg);
597cd37da74Snw141292 errmsg = NULL;
598cd37da74Snw141292 goto rollback;
599cd37da74Snw141292 }
600cd37da74Snw141292
601cd37da74Snw141292 rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg);
602cd37da74Snw141292 if (rc == SQLITE_OK) {
603cd37da74Snw141292 sqlite_freemem(errmsg);
604cd37da74Snw141292 return (0);
605cd37da74Snw141292 }
606cd37da74Snw141292
607cd37da74Snw141292 idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)",
608cd37da74Snw141292 errmsg, while_doing, dbname);
609cd37da74Snw141292 sqlite_freemem(errmsg);
610cd37da74Snw141292 errmsg = NULL;
611cd37da74Snw141292
612cd37da74Snw141292 rollback:
613cd37da74Snw141292 rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg);
614cd37da74Snw141292 if (rc != SQLITE_OK) {
615cd37da74Snw141292 idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)",
616cd37da74Snw141292 errmsg, while_doing, dbname);
617cd37da74Snw141292 sqlite_freemem(errmsg);
618cd37da74Snw141292 return (-2);
619cd37da74Snw141292 }
620cd37da74Snw141292 sqlite_freemem(errmsg);
621cd37da74Snw141292
622cd37da74Snw141292 return (-1);
623cd37da74Snw141292 }
624cd37da74Snw141292
625cd37da74Snw141292 /*
626c5c4113dSnw141292 * Execute the given SQL statment without using any callbacks
627c5c4113dSnw141292 */
628c5c4113dSnw141292 idmap_retcode
sql_exec_no_cb(sqlite * db,const char * dbname,char * sql)62971590c90Snw141292 sql_exec_no_cb(sqlite *db, const char *dbname, char *sql)
630cd37da74Snw141292 {
631c5c4113dSnw141292 char *errmsg = NULL;
63284decf41Sjp151216 int r;
633c5c4113dSnw141292 idmap_retcode retcode;
634c5c4113dSnw141292
635c5c4113dSnw141292 r = sqlite_exec(db, sql, NULL, NULL, &errmsg);
636c5c4113dSnw141292 if (r != SQLITE_OK) {
63771590c90Snw141292 idmapdlog(LOG_ERR, "Database error on %s while executing %s "
63871590c90Snw141292 "(%s)", dbname, sql, CHECK_NULL(errmsg));
639*e3d9e7f3SGordon Ross
640*e3d9e7f3SGordon Ross switch (r) {
641*e3d9e7f3SGordon Ross case SQLITE_BUSY:
642*e3d9e7f3SGordon Ross case SQLITE_LOCKED:
643*e3d9e7f3SGordon Ross assert(0);
644*e3d9e7f3SGordon Ross retcode = IDMAP_ERR_INTERNAL;
645*e3d9e7f3SGordon Ross break;
646*e3d9e7f3SGordon Ross
647*e3d9e7f3SGordon Ross case SQLITE_NOMEM:
648*e3d9e7f3SGordon Ross retcode = IDMAP_ERR_MEMORY;
649*e3d9e7f3SGordon Ross break;
650*e3d9e7f3SGordon Ross
651*e3d9e7f3SGordon Ross case SQLITE_FULL:
652*e3d9e7f3SGordon Ross retcode = IDMAP_ERR_DB;
653*e3d9e7f3SGordon Ross break;
654*e3d9e7f3SGordon Ross
655*e3d9e7f3SGordon Ross default:
656c5c4113dSnw141292 retcode = idmapd_string2stat(errmsg);
657*e3d9e7f3SGordon Ross break;
658*e3d9e7f3SGordon Ross }
659*e3d9e7f3SGordon Ross
66062c60062Sbaban if (errmsg != NULL)
661c5c4113dSnw141292 sqlite_freemem(errmsg);
662c5c4113dSnw141292 return (retcode);
663c5c4113dSnw141292 }
664c5c4113dSnw141292
665c5c4113dSnw141292 return (IDMAP_SUCCESS);
666c5c4113dSnw141292 }
667c5c4113dSnw141292
668c5c4113dSnw141292 /*
669c5c4113dSnw141292 * Generate expression that can be used in WHERE statements.
670c5c4113dSnw141292 * Examples:
671c5c4113dSnw141292 * <prefix> <col> <op> <value> <suffix>
672c5c4113dSnw141292 * "" "unixuser" "=" "foo" "AND"
673c5c4113dSnw141292 */
674c5c4113dSnw141292 idmap_retcode
gen_sql_expr_from_rule(idmap_namerule * rule,char ** out)675cd37da74Snw141292 gen_sql_expr_from_rule(idmap_namerule *rule, char **out)
676cd37da74Snw141292 {
677cd37da74Snw141292 char *s_windomain = NULL, *s_winname = NULL;
678cd37da74Snw141292 char *s_unixname = NULL;
679bbf6f00cSJordan Brown char *dir;
680cd37da74Snw141292 char *lower_winname;
681cd37da74Snw141292 int retcode = IDMAP_SUCCESS;
682cd37da74Snw141292
683c5c4113dSnw141292 if (out == NULL)
684c5c4113dSnw141292 return (IDMAP_ERR_ARG);
685c5c4113dSnw141292
686c5c4113dSnw141292
687cd37da74Snw141292 if (!EMPTY_STRING(rule->windomain)) {
688cd37da74Snw141292 s_windomain = sqlite_mprintf("AND windomain = %Q ",
689cd37da74Snw141292 rule->windomain);
690cd37da74Snw141292 if (s_windomain == NULL) {
691cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY;
692cd37da74Snw141292 goto out;
693c5c4113dSnw141292 }
694cd37da74Snw141292 }
695cd37da74Snw141292
696cd37da74Snw141292 if (!EMPTY_STRING(rule->winname)) {
697cd37da74Snw141292 if ((lower_winname = tolower_u8(rule->winname)) == NULL)
698cd37da74Snw141292 lower_winname = rule->winname;
699cd37da74Snw141292 s_winname = sqlite_mprintf(
700cd37da74Snw141292 "AND winname = %Q AND is_wuser = %d ",
701cd37da74Snw141292 lower_winname, rule->is_wuser ? 1 : 0);
702cd37da74Snw141292 if (lower_winname != rule->winname)
703cd37da74Snw141292 free(lower_winname);
704cd37da74Snw141292 if (s_winname == NULL) {
705cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY;
706cd37da74Snw141292 goto out;
707cd37da74Snw141292 }
708cd37da74Snw141292 }
709cd37da74Snw141292
710cd37da74Snw141292 if (!EMPTY_STRING(rule->unixname)) {
711cd37da74Snw141292 s_unixname = sqlite_mprintf(
712cd37da74Snw141292 "AND unixname = %Q AND is_user = %d ",
713cd37da74Snw141292 rule->unixname, rule->is_user ? 1 : 0);
714cd37da74Snw141292 if (s_unixname == NULL) {
715cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY;
716cd37da74Snw141292 goto out;
717cd37da74Snw141292 }
718cd37da74Snw141292 }
719cd37da74Snw141292
720bbf6f00cSJordan Brown switch (rule->direction) {
721bbf6f00cSJordan Brown case IDMAP_DIRECTION_BI:
722bbf6f00cSJordan Brown dir = "AND w2u_order > 0 AND u2w_order > 0";
723bbf6f00cSJordan Brown break;
724bbf6f00cSJordan Brown case IDMAP_DIRECTION_W2U:
725bbf6f00cSJordan Brown dir = "AND w2u_order > 0"
726bbf6f00cSJordan Brown " AND (u2w_order = 0 OR u2w_order ISNULL)";
727bbf6f00cSJordan Brown break;
728bbf6f00cSJordan Brown case IDMAP_DIRECTION_U2W:
729bbf6f00cSJordan Brown dir = "AND u2w_order > 0"
730bbf6f00cSJordan Brown " AND (w2u_order = 0 OR w2u_order ISNULL)";
731bbf6f00cSJordan Brown break;
732bbf6f00cSJordan Brown default:
733bbf6f00cSJordan Brown dir = "";
734bbf6f00cSJordan Brown break;
735bbf6f00cSJordan Brown }
736bbf6f00cSJordan Brown
737bbf6f00cSJordan Brown *out = sqlite_mprintf("%s %s %s %s",
738cd37da74Snw141292 s_windomain ? s_windomain : "",
739cd37da74Snw141292 s_winname ? s_winname : "",
740bbf6f00cSJordan Brown s_unixname ? s_unixname : "",
741bbf6f00cSJordan Brown dir);
742cd37da74Snw141292
743cd37da74Snw141292 if (*out == NULL) {
744cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY;
745cd37da74Snw141292 idmapdlog(LOG_ERR, "Out of memory");
746cd37da74Snw141292 goto out;
747cd37da74Snw141292 }
748cd37da74Snw141292
749cd37da74Snw141292 out:
750cd37da74Snw141292 if (s_windomain != NULL)
751cd37da74Snw141292 sqlite_freemem(s_windomain);
752cd37da74Snw141292 if (s_winname != NULL)
753cd37da74Snw141292 sqlite_freemem(s_winname);
754cd37da74Snw141292 if (s_unixname != NULL)
755cd37da74Snw141292 sqlite_freemem(s_unixname);
756cd37da74Snw141292
757cd37da74Snw141292 return (retcode);
758cd37da74Snw141292 }
759cd37da74Snw141292
760cd37da74Snw141292
761c5c4113dSnw141292
762c5c4113dSnw141292 /*
763c5c4113dSnw141292 * Generate and execute SQL statement for LIST RPC calls
764c5c4113dSnw141292 */
765c5c4113dSnw141292 idmap_retcode
process_list_svc_sql(sqlite * db,const char * dbname,char * sql,uint64_t limit,int flag,list_svc_cb cb,void * result)76671590c90Snw141292 process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit,
76748258c6bSjp151216 int flag, list_svc_cb cb, void *result)
768cd37da74Snw141292 {
769c5c4113dSnw141292 list_cb_data_t cb_data;
770c5c4113dSnw141292 char *errmsg = NULL;
77184decf41Sjp151216 int r;
772c5c4113dSnw141292 idmap_retcode retcode = IDMAP_ERR_INTERNAL;
773c5c4113dSnw141292
774c5c4113dSnw141292 (void) memset(&cb_data, 0, sizeof (cb_data));
775c5c4113dSnw141292 cb_data.result = result;
776c5c4113dSnw141292 cb_data.limit = limit;
77748258c6bSjp151216 cb_data.flag = flag;
778c5c4113dSnw141292
77984decf41Sjp151216
780c5c4113dSnw141292 r = sqlite_exec(db, sql, cb, &cb_data, &errmsg);
78184decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
782c5c4113dSnw141292 switch (r) {
783c5c4113dSnw141292 case SQLITE_OK:
784c5c4113dSnw141292 retcode = IDMAP_SUCCESS;
78584decf41Sjp151216 break;
78684decf41Sjp151216
787c5c4113dSnw141292 default:
788c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
78971590c90Snw141292 idmapdlog(LOG_ERR, "Database error on %s while executing "
79071590c90Snw141292 "%s (%s)", dbname, sql, CHECK_NULL(errmsg));
79184decf41Sjp151216 break;
792c5c4113dSnw141292 }
79362c60062Sbaban if (errmsg != NULL)
794c5c4113dSnw141292 sqlite_freemem(errmsg);
795c5c4113dSnw141292 return (retcode);
796c5c4113dSnw141292 }
797c5c4113dSnw141292
798c5c4113dSnw141292 /*
799c5c4113dSnw141292 * This routine is called by callbacks that process the results of
800c5c4113dSnw141292 * LIST RPC calls to validate data and to allocate memory for
801c5c4113dSnw141292 * the result array.
802c5c4113dSnw141292 */
803c5c4113dSnw141292 idmap_retcode
validate_list_cb_data(list_cb_data_t * cb_data,int argc,char ** argv,int ncol,uchar_t ** list,size_t valsize)804c5c4113dSnw141292 validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv,
805cd37da74Snw141292 int ncol, uchar_t **list, size_t valsize)
806cd37da74Snw141292 {
807c5c4113dSnw141292 size_t nsize;
808c5c4113dSnw141292 void *tmplist;
809c5c4113dSnw141292
810c5c4113dSnw141292 if (cb_data->limit > 0 && cb_data->next == cb_data->limit)
811c5c4113dSnw141292 return (IDMAP_NEXT);
812c5c4113dSnw141292
813c5c4113dSnw141292 if (argc < ncol || argv == NULL) {
814c5c4113dSnw141292 idmapdlog(LOG_ERR, "Invalid data");
815c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL);
816c5c4113dSnw141292 }
817c5c4113dSnw141292
818c5c4113dSnw141292 /* alloc in bulk to reduce number of reallocs */
819c5c4113dSnw141292 if (cb_data->next >= cb_data->len) {
820c5c4113dSnw141292 nsize = (cb_data->len + SIZE_INCR) * valsize;
821c5c4113dSnw141292 tmplist = realloc(*list, nsize);
822c5c4113dSnw141292 if (tmplist == NULL) {
823c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
824c5c4113dSnw141292 return (IDMAP_ERR_MEMORY);
825c5c4113dSnw141292 }
826c5c4113dSnw141292 *list = tmplist;
827c5c4113dSnw141292 (void) memset(*list + (cb_data->len * valsize), 0,
828c5c4113dSnw141292 SIZE_INCR * valsize);
829c5c4113dSnw141292 cb_data->len += SIZE_INCR;
830c5c4113dSnw141292 }
831c5c4113dSnw141292 return (IDMAP_SUCCESS);
832c5c4113dSnw141292 }
833c5c4113dSnw141292
834cd37da74Snw141292 static
835cd37da74Snw141292 idmap_retcode
get_namerule_order(char * winname,char * windomain,char * unixname,int direction,int is_diagonal,int * w2u_order,int * u2w_order)836c5c4113dSnw141292 get_namerule_order(char *winname, char *windomain, char *unixname,
837cd37da74Snw141292 int direction, int is_diagonal, int *w2u_order, int *u2w_order)
838cd37da74Snw141292 {
839c5c4113dSnw141292 *w2u_order = 0;
840c5c4113dSnw141292 *u2w_order = 0;
841c5c4113dSnw141292
842c5c4113dSnw141292 /*
843c5c4113dSnw141292 * Windows to UNIX lookup order:
844c5c4113dSnw141292 * 1. winname@domain (or winname) to ""
845c5c4113dSnw141292 * 2. winname@domain (or winname) to unixname
846c5c4113dSnw141292 * 3. winname@* to ""
847c5c4113dSnw141292 * 4. winname@* to unixname
848c5c4113dSnw141292 * 5. *@domain (or *) to *
849c5c4113dSnw141292 * 6. *@domain (or *) to ""
850c5c4113dSnw141292 * 7. *@domain (or *) to unixname
851c5c4113dSnw141292 * 8. *@* to *
852c5c4113dSnw141292 * 9. *@* to ""
853c5c4113dSnw141292 * 10. *@* to unixname
854c5c4113dSnw141292 *
855c5c4113dSnw141292 * winname is a special case of winname@domain when domain is the
856c5c4113dSnw141292 * default domain. Similarly * is a special case of *@domain when
857c5c4113dSnw141292 * domain is the default domain.
858c5c4113dSnw141292 *
859c5c4113dSnw141292 * Note that "" has priority over specific names because "" inhibits
860c5c4113dSnw141292 * mappings and traditionally deny rules always had higher priority.
861c5c4113dSnw141292 */
862651c0131Sbaban if (direction != IDMAP_DIRECTION_U2W) {
863651c0131Sbaban /* bi-directional or from windows to unix */
864c5c4113dSnw141292 if (winname == NULL)
865c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE);
866c5c4113dSnw141292 else if (unixname == NULL)
867c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE);
868c5c4113dSnw141292 else if (EMPTY_NAME(winname))
869c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE);
870c5c4113dSnw141292 else if (*winname == '*' && windomain && *windomain == '*') {
871c5c4113dSnw141292 if (*unixname == '*')
872c5c4113dSnw141292 *w2u_order = 8;
873c5c4113dSnw141292 else if (EMPTY_NAME(unixname))
874c5c4113dSnw141292 *w2u_order = 9;
875c5c4113dSnw141292 else /* unixname == name */
876c5c4113dSnw141292 *w2u_order = 10;
877c5c4113dSnw141292 } else if (*winname == '*') {
878c5c4113dSnw141292 if (*unixname == '*')
879c5c4113dSnw141292 *w2u_order = 5;
880c5c4113dSnw141292 else if (EMPTY_NAME(unixname))
881c5c4113dSnw141292 *w2u_order = 6;
882c5c4113dSnw141292 else /* name */
883c5c4113dSnw141292 *w2u_order = 7;
88462c60062Sbaban } else if (windomain != NULL && *windomain == '*') {
885c5c4113dSnw141292 /* winname == name */
886c5c4113dSnw141292 if (*unixname == '*')
887c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE);
888c5c4113dSnw141292 else if (EMPTY_NAME(unixname))
889c5c4113dSnw141292 *w2u_order = 3;
890c5c4113dSnw141292 else /* name */
891c5c4113dSnw141292 *w2u_order = 4;
892c5c4113dSnw141292 } else {
893c5c4113dSnw141292 /* winname == name && windomain == null or name */
894c5c4113dSnw141292 if (*unixname == '*')
895c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE);
896c5c4113dSnw141292 else if (EMPTY_NAME(unixname))
897c5c4113dSnw141292 *w2u_order = 1;
898c5c4113dSnw141292 else /* name */
899c5c4113dSnw141292 *w2u_order = 2;
900c5c4113dSnw141292 }
901cd37da74Snw141292
902c5c4113dSnw141292 }
903c5c4113dSnw141292
904c5c4113dSnw141292 /*
905cd37da74Snw141292 * 1. unixname to "", non-diagonal
906cd37da74Snw141292 * 2. unixname to winname@domain (or winname), non-diagonal
907cd37da74Snw141292 * 3. unixname to "", diagonal
908cd37da74Snw141292 * 4. unixname to winname@domain (or winname), diagonal
909cd37da74Snw141292 * 5. * to *@domain (or *), non-diagonal
910cd37da74Snw141292 * 5. * to *@domain (or *), diagonal
911cd37da74Snw141292 * 7. * to ""
912cd37da74Snw141292 * 8. * to winname@domain (or winname)
913cd37da74Snw141292 * 9. * to "", non-diagonal
914cd37da74Snw141292 * 10. * to winname@domain (or winname), diagonal
915c5c4113dSnw141292 */
916651c0131Sbaban if (direction != IDMAP_DIRECTION_W2U) {
917cd37da74Snw141292 int diagonal = is_diagonal ? 1 : 0;
918cd37da74Snw141292
919651c0131Sbaban /* bi-directional or from unix to windows */
920c5c4113dSnw141292 if (unixname == NULL || EMPTY_NAME(unixname))
921c5c4113dSnw141292 return (IDMAP_ERR_U2W_NAMERULE);
922c5c4113dSnw141292 else if (winname == NULL)
923c5c4113dSnw141292 return (IDMAP_ERR_U2W_NAMERULE);
92462c60062Sbaban else if (windomain != NULL && *windomain == '*')
925651c0131Sbaban return (IDMAP_ERR_U2W_NAMERULE);
926c5c4113dSnw141292 else if (*unixname == '*') {
927c5c4113dSnw141292 if (*winname == '*')
928cd37da74Snw141292 *u2w_order = 5 + diagonal;
929c5c4113dSnw141292 else if (EMPTY_NAME(winname))
930cd37da74Snw141292 *u2w_order = 7 + 2 * diagonal;
931c5c4113dSnw141292 else
932cd37da74Snw141292 *u2w_order = 8 + 2 * diagonal;
933c5c4113dSnw141292 } else {
934c5c4113dSnw141292 if (*winname == '*')
935c5c4113dSnw141292 return (IDMAP_ERR_U2W_NAMERULE);
936c5c4113dSnw141292 else if (EMPTY_NAME(winname))
937cd37da74Snw141292 *u2w_order = 1 + 2 * diagonal;
938c5c4113dSnw141292 else
939cd37da74Snw141292 *u2w_order = 2 + 2 * diagonal;
940c5c4113dSnw141292 }
941c5c4113dSnw141292 }
942c5c4113dSnw141292 return (IDMAP_SUCCESS);
943c5c4113dSnw141292 }
944c5c4113dSnw141292
945c5c4113dSnw141292 /*
946c5c4113dSnw141292 * Generate and execute SQL statement to add name-based mapping rule
947c5c4113dSnw141292 */
948c5c4113dSnw141292 idmap_retcode
add_namerule(sqlite * db,idmap_namerule * rule)949cd37da74Snw141292 add_namerule(sqlite *db, idmap_namerule *rule)
950cd37da74Snw141292 {
951c5c4113dSnw141292 char *sql = NULL;
952c5c4113dSnw141292 idmap_stat retcode;
9538e228215Sdm199847 char *dom = NULL;
95408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *name;
955c5c4113dSnw141292 int w2u_order, u2w_order;
956c5c4113dSnw141292 char w2ubuf[11], u2wbuf[11];
95708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canonname = NULL;
95808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canondomain = NULL;
959c5c4113dSnw141292
9608e228215Sdm199847 retcode = get_namerule_order(rule->winname, rule->windomain,
961cd37da74Snw141292 rule->unixname, rule->direction,
962cd37da74Snw141292 rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order);
963c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS)
964c5c4113dSnw141292 goto out;
965c5c4113dSnw141292
966c5c4113dSnw141292 if (w2u_order)
967c5c4113dSnw141292 (void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order);
968c5c4113dSnw141292 if (u2w_order)
969c5c4113dSnw141292 (void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order);
970c5c4113dSnw141292
97162c60062Sbaban /*
97262c60062Sbaban * For the triggers on namerules table to work correctly:
97362c60062Sbaban * 1) Use NULL instead of 0 for w2u_order and u2w_order
97462c60062Sbaban * 2) Use "" instead of NULL for "no domain"
97562c60062Sbaban */
97662c60062Sbaban
97708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name = rule->winname;
9788e228215Sdm199847 dom = rule->windomain;
979c5c4113dSnw141292
980c5c4113dSnw141292 RDLOCK_CONFIG();
98108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (lookup_wksids_name2sid(name, dom,
98208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States &canonname, &canondomain,
98308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States NULL, NULL, NULL) == IDMAP_SUCCESS) {
98408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name = canonname;
98508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = canondomain;
98608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else if (EMPTY_STRING(dom)) {
987c8e26105Sjp151216 if (_idmapdstate.cfg->pgcfg.default_domain)
988c8e26105Sjp151216 dom = _idmapdstate.cfg->pgcfg.default_domain;
989c5c4113dSnw141292 else
990c5c4113dSnw141292 dom = "";
99162c60062Sbaban }
99284decf41Sjp151216 sql = sqlite_mprintf("INSERT into namerules "
993cd37da74Snw141292 "(is_user, is_wuser, windomain, winname_display, is_nt4, "
994c5c4113dSnw141292 "unixname, w2u_order, u2w_order) "
995cd37da74Snw141292 "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);",
996cd37da74Snw141292 rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom,
99708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name, rule->is_nt4 ? 1 : 0, rule->unixname,
998cd37da74Snw141292 w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL);
999c5c4113dSnw141292 UNLOCK_CONFIG();
1000c5c4113dSnw141292
1001c5c4113dSnw141292 if (sql == NULL) {
1002c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
1003c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
1004c5c4113dSnw141292 goto out;
1005c5c4113dSnw141292 }
1006c5c4113dSnw141292
100771590c90Snw141292 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
1008c5c4113dSnw141292
1009c5c4113dSnw141292 if (retcode == IDMAP_ERR_OTHER)
1010c5c4113dSnw141292 retcode = IDMAP_ERR_CFG;
1011c5c4113dSnw141292
1012c5c4113dSnw141292 out:
101308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(canonname);
101408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(canondomain);
101562c60062Sbaban if (sql != NULL)
1016c5c4113dSnw141292 sqlite_freemem(sql);
1017c5c4113dSnw141292 return (retcode);
1018c5c4113dSnw141292 }
1019c5c4113dSnw141292
1020c5c4113dSnw141292 /*
1021c5c4113dSnw141292 * Flush name-based mapping rules
1022c5c4113dSnw141292 */
1023c5c4113dSnw141292 idmap_retcode
flush_namerules(sqlite * db)1024cd37da74Snw141292 flush_namerules(sqlite *db)
1025cd37da74Snw141292 {
1026c5c4113dSnw141292 idmap_stat retcode;
1027c5c4113dSnw141292
102871590c90Snw141292 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;");
1029c5c4113dSnw141292
1030c5c4113dSnw141292 return (retcode);
1031c5c4113dSnw141292 }
1032c5c4113dSnw141292
1033c5c4113dSnw141292 /*
1034c5c4113dSnw141292 * Generate and execute SQL statement to remove a name-based mapping rule
1035c5c4113dSnw141292 */
1036c5c4113dSnw141292 idmap_retcode
rm_namerule(sqlite * db,idmap_namerule * rule)1037cd37da74Snw141292 rm_namerule(sqlite *db, idmap_namerule *rule)
1038cd37da74Snw141292 {
1039c5c4113dSnw141292 char *sql = NULL;
1040c5c4113dSnw141292 idmap_stat retcode;
1041cd37da74Snw141292 char *expr = NULL;
1042c5c4113dSnw141292
10438e228215Sdm199847 if (rule->direction < 0 && EMPTY_STRING(rule->windomain) &&
10448e228215Sdm199847 EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname))
1045c5c4113dSnw141292 return (IDMAP_SUCCESS);
1046c5c4113dSnw141292
1047cd37da74Snw141292 retcode = gen_sql_expr_from_rule(rule, &expr);
1048cd37da74Snw141292 if (retcode != IDMAP_SUCCESS)
1049c5c4113dSnw141292 goto out;
1050c5c4113dSnw141292
1051bbf6f00cSJordan Brown sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s;", expr);
1052c5c4113dSnw141292
1053c5c4113dSnw141292 if (sql == NULL) {
1054c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
1055c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
1056c5c4113dSnw141292 goto out;
1057c5c4113dSnw141292 }
1058c5c4113dSnw141292
1059cd37da74Snw141292
106071590c90Snw141292 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
1061c5c4113dSnw141292
1062c5c4113dSnw141292 out:
1063cd37da74Snw141292 if (expr != NULL)
1064cd37da74Snw141292 sqlite_freemem(expr);
106562c60062Sbaban if (sql != NULL)
1066c5c4113dSnw141292 sqlite_freemem(sql);
1067c5c4113dSnw141292 return (retcode);
1068c5c4113dSnw141292 }
1069c5c4113dSnw141292
1070c5c4113dSnw141292 /*
1071c5c4113dSnw141292 * Compile the given SQL query and step just once.
1072c5c4113dSnw141292 *
1073c5c4113dSnw141292 * Input:
1074c5c4113dSnw141292 * db - db handle
1075c5c4113dSnw141292 * sql - SQL statement
1076c5c4113dSnw141292 *
1077c5c4113dSnw141292 * Output:
1078c5c4113dSnw141292 * vm - virtual SQL machine
1079c5c4113dSnw141292 * ncol - number of columns in the result
1080c5c4113dSnw141292 * values - column values
1081c5c4113dSnw141292 *
1082c5c4113dSnw141292 * Return values:
1083c5c4113dSnw141292 * IDMAP_SUCCESS
1084c5c4113dSnw141292 * IDMAP_ERR_NOTFOUND
1085c5c4113dSnw141292 * IDMAP_ERR_INTERNAL
1086c5c4113dSnw141292 */
1087c5c4113dSnw141292
1088cd37da74Snw141292 static
1089cd37da74Snw141292 idmap_retcode
sql_compile_n_step_once(sqlite * db,char * sql,sqlite_vm ** vm,int * ncol,int reqcol,const char *** values)1090c5c4113dSnw141292 sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol,
1091cd37da74Snw141292 int reqcol, const char ***values)
1092cd37da74Snw141292 {
1093c5c4113dSnw141292 char *errmsg = NULL;
109484decf41Sjp151216 int r;
1095c5c4113dSnw141292
109684decf41Sjp151216 if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) {
1097cd37da74Snw141292 idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1098cd37da74Snw141292 CHECK_NULL(errmsg));
1099c5c4113dSnw141292 sqlite_freemem(errmsg);
1100c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL);
1101c5c4113dSnw141292 }
1102c5c4113dSnw141292
1103c5c4113dSnw141292 r = sqlite_step(*vm, ncol, values, NULL);
110484decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
1105c5c4113dSnw141292
110684decf41Sjp151216 if (r == SQLITE_ROW) {
110762c60062Sbaban if (ncol != NULL && *ncol < reqcol) {
1108c5c4113dSnw141292 (void) sqlite_finalize(*vm, NULL);
1109c5c4113dSnw141292 *vm = NULL;
1110c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL);
1111c5c4113dSnw141292 }
1112c5c4113dSnw141292 /* Caller will call finalize after using the results */
1113c5c4113dSnw141292 return (IDMAP_SUCCESS);
1114c5c4113dSnw141292 } else if (r == SQLITE_DONE) {
1115c5c4113dSnw141292 (void) sqlite_finalize(*vm, NULL);
1116c5c4113dSnw141292 *vm = NULL;
1117c5c4113dSnw141292 return (IDMAP_ERR_NOTFOUND);
1118c5c4113dSnw141292 }
1119c5c4113dSnw141292
1120c5c4113dSnw141292 (void) sqlite_finalize(*vm, &errmsg);
1121c5c4113dSnw141292 *vm = NULL;
1122cd37da74Snw141292 idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1123cd37da74Snw141292 CHECK_NULL(errmsg));
1124c5c4113dSnw141292 sqlite_freemem(errmsg);
1125c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL);
1126c5c4113dSnw141292 }
1127c5c4113dSnw141292
112862c60062Sbaban /*
1129479ac375Sdm199847 * Load config in the state.
1130e8c27ec8Sbaban *
1131479ac375Sdm199847 * nm_siduid and nm_sidgid fields:
1132e8c27ec8Sbaban * state->nm_siduid represents mode used by sid2uid and uid2sid
1133e8c27ec8Sbaban * requests for directory-based name mappings. Similarly,
1134e8c27ec8Sbaban * state->nm_sidgid represents mode used by sid2gid and gid2sid
1135e8c27ec8Sbaban * requests.
1136e8c27ec8Sbaban *
1137e8c27ec8Sbaban * sid2uid/uid2sid:
1138e3f2c991SKeyur Desai * none -> directory_based_mapping != DIRECTORY_MAPPING_NAME
1139e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixuser_attr
1140e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr
1141e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixuser_attr
1142e8c27ec8Sbaban *
1143e8c27ec8Sbaban * sid2gid/gid2sid:
1144e3f2c991SKeyur Desai * none -> directory_based_mapping != DIRECTORY_MAPPING_NAME
1145e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixgroup_attr
1146e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr
1147e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr
1148e8c27ec8Sbaban */
1149e8c27ec8Sbaban idmap_retcode
load_cfg_in_state(lookup_state_t * state)1150479ac375Sdm199847 load_cfg_in_state(lookup_state_t *state)
1151e8c27ec8Sbaban {
1152e8c27ec8Sbaban state->nm_siduid = IDMAP_NM_NONE;
1153e8c27ec8Sbaban state->nm_sidgid = IDMAP_NM_NONE;
1154e8c27ec8Sbaban RDLOCK_CONFIG();
1155479ac375Sdm199847
11564aa0a5e7Snw141292 state->eph_map_unres_sids = 0;
11574aa0a5e7Snw141292 if (_idmapdstate.cfg->pgcfg.eph_map_unres_sids)
11584aa0a5e7Snw141292 state->eph_map_unres_sids = 1;
11594aa0a5e7Snw141292
116048cd229bSGordon Ross state->id_cache_timeout =
116148cd229bSGordon Ross _idmapdstate.cfg->pgcfg.id_cache_timeout;
116248cd229bSGordon Ross state->name_cache_timeout =
116348cd229bSGordon Ross _idmapdstate.cfg->pgcfg.name_cache_timeout;
116448cd229bSGordon Ross
1165e3f2c991SKeyur Desai state->directory_based_mapping =
1166e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.directory_based_mapping;
1167e3f2c991SKeyur Desai
1168479ac375Sdm199847 if (_idmapdstate.cfg->pgcfg.default_domain != NULL) {
1169479ac375Sdm199847 state->defdom =
1170479ac375Sdm199847 strdup(_idmapdstate.cfg->pgcfg.default_domain);
1171479ac375Sdm199847 if (state->defdom == NULL) {
1172479ac375Sdm199847 UNLOCK_CONFIG();
1173479ac375Sdm199847 return (IDMAP_ERR_MEMORY);
1174479ac375Sdm199847 }
1175479ac375Sdm199847 } else {
1176479ac375Sdm199847 UNLOCK_CONFIG();
1177dc03a638Sdm199847 return (IDMAP_SUCCESS);
1178479ac375Sdm199847 }
1179e3f2c991SKeyur Desai
1180e3f2c991SKeyur Desai if (_idmapdstate.cfg->pgcfg.directory_based_mapping !=
1181e3f2c991SKeyur Desai DIRECTORY_MAPPING_NAME) {
1182e8c27ec8Sbaban UNLOCK_CONFIG();
1183e8c27ec8Sbaban return (IDMAP_SUCCESS);
1184e8c27ec8Sbaban }
1185e3f2c991SKeyur Desai
1186e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1187e8c27ec8Sbaban state->nm_siduid =
1188e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1189e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1190e8c27ec8Sbaban state->nm_sidgid =
1191e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1192e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1193e8c27ec8Sbaban } else {
1194e8c27ec8Sbaban state->nm_siduid =
1195e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1196e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE;
1197e8c27ec8Sbaban state->nm_sidgid =
1198e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1199e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE;
1200e8c27ec8Sbaban }
1201e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) {
1202e8c27ec8Sbaban state->ad_unixuser_attr =
1203e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr);
1204e8c27ec8Sbaban if (state->ad_unixuser_attr == NULL) {
1205e8c27ec8Sbaban UNLOCK_CONFIG();
1206e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
1207e8c27ec8Sbaban }
1208e8c27ec8Sbaban }
1209e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) {
1210e8c27ec8Sbaban state->ad_unixgroup_attr =
1211e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr);
1212e8c27ec8Sbaban if (state->ad_unixgroup_attr == NULL) {
1213e8c27ec8Sbaban UNLOCK_CONFIG();
1214e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
1215e8c27ec8Sbaban }
1216e8c27ec8Sbaban }
1217479ac375Sdm199847 if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1218479ac375Sdm199847 state->nldap_winname_attr =
1219479ac375Sdm199847 strdup(_idmapdstate.cfg->pgcfg.nldap_winname_attr);
1220479ac375Sdm199847 if (state->nldap_winname_attr == NULL) {
1221479ac375Sdm199847 UNLOCK_CONFIG();
1222479ac375Sdm199847 return (IDMAP_ERR_MEMORY);
1223479ac375Sdm199847 }
1224479ac375Sdm199847 }
1225e8c27ec8Sbaban UNLOCK_CONFIG();
1226e8c27ec8Sbaban return (IDMAP_SUCCESS);
1227e8c27ec8Sbaban }
1228e8c27ec8Sbaban
1229e8c27ec8Sbaban /*
123008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Set the rule with specified values.
123148258c6bSjp151216 * All the strings are copied.
123248258c6bSjp151216 */
123348258c6bSjp151216 static void
idmap_namerule_set(idmap_namerule * rule,const char * windomain,const char * winname,const char * unixname,boolean_t is_user,boolean_t is_wuser,boolean_t is_nt4,int direction)123448258c6bSjp151216 idmap_namerule_set(idmap_namerule *rule, const char *windomain,
123548258c6bSjp151216 const char *winname, const char *unixname, boolean_t is_user,
123648258c6bSjp151216 boolean_t is_wuser, boolean_t is_nt4, int direction)
123748258c6bSjp151216 {
123848258c6bSjp151216 /*
123948258c6bSjp151216 * Only update if they differ because we have to free
124048258c6bSjp151216 * and duplicate the strings
124148258c6bSjp151216 */
124248258c6bSjp151216 if (rule->windomain == NULL || windomain == NULL ||
124348258c6bSjp151216 strcmp(rule->windomain, windomain) != 0) {
124448258c6bSjp151216 if (rule->windomain != NULL) {
124548258c6bSjp151216 free(rule->windomain);
124648258c6bSjp151216 rule->windomain = NULL;
124748258c6bSjp151216 }
124848258c6bSjp151216 if (windomain != NULL)
124948258c6bSjp151216 rule->windomain = strdup(windomain);
125048258c6bSjp151216 }
125148258c6bSjp151216
125248258c6bSjp151216 if (rule->winname == NULL || winname == NULL ||
125348258c6bSjp151216 strcmp(rule->winname, winname) != 0) {
125448258c6bSjp151216 if (rule->winname != NULL) {
125548258c6bSjp151216 free(rule->winname);
125648258c6bSjp151216 rule->winname = NULL;
125748258c6bSjp151216 }
125848258c6bSjp151216 if (winname != NULL)
125948258c6bSjp151216 rule->winname = strdup(winname);
126048258c6bSjp151216 }
126148258c6bSjp151216
126248258c6bSjp151216 if (rule->unixname == NULL || unixname == NULL ||
126348258c6bSjp151216 strcmp(rule->unixname, unixname) != 0) {
126448258c6bSjp151216 if (rule->unixname != NULL) {
126548258c6bSjp151216 free(rule->unixname);
126648258c6bSjp151216 rule->unixname = NULL;
126748258c6bSjp151216 }
126848258c6bSjp151216 if (unixname != NULL)
126948258c6bSjp151216 rule->unixname = strdup(unixname);
127048258c6bSjp151216 }
127148258c6bSjp151216
127248258c6bSjp151216 rule->is_user = is_user;
127348258c6bSjp151216 rule->is_wuser = is_wuser;
127448258c6bSjp151216 rule->is_nt4 = is_nt4;
127548258c6bSjp151216 rule->direction = direction;
127648258c6bSjp151216 }
127748258c6bSjp151216
1278e8c27ec8Sbaban /*
1279e8c27ec8Sbaban * Lookup well-known SIDs table either by winname or by SID.
128008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
128108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If the given winname or SID is a well-known SID then we set is_wksid
1282e8c27ec8Sbaban * variable and then proceed to see if the SID has a hard mapping to
1283e8c27ec8Sbaban * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to
128408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * fixed ephemeral ids). The direction flag indicates whether we have
128508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * a mapping; UNDEF indicates that we do not.
128608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
128708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we find a mapping then we return success, except for the
12889fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * special case of IDMAP_SENTINEL_PID which indicates an inhibited mapping.
128908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
129008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we find a matching entry, but no mapping, we supply SID, name, and type
129108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * information and return "not found". Higher layers will probably
129208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * do ephemeral mapping.
129308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
129408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we do not find a match, we return "not found" and leave the question
129508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * to higher layers.
1296e8c27ec8Sbaban */
1297cd37da74Snw141292 static
1298cd37da74Snw141292 idmap_retcode
lookup_wksids_sid2pid(idmap_mapping * req,idmap_id_res * res,int * is_wksid)129908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *is_wksid)
1300cd37da74Snw141292 {
130108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid;
130262c60062Sbaban
130308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *is_wksid = 0;
1304e8c27ec8Sbaban
130508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.sid.prefix != NULL ||
130608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name != NULL);
130708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1308e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) {
130908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_sid(req->id1.idmap_id_u.sid.prefix,
131008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.rid, res->id.idtype);
131108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
131208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_name(req->id1name, req->id1domain,
131308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype);
131408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
131508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL)
131608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND);
131708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
131808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Found matching entry. */
131908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
132008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in name if it was not already there. */
1321e8c27ec8Sbaban if (req->id1name == NULL) {
132208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name = strdup(wksid->winname);
1323e8c27ec8Sbaban if (req->id1name == NULL)
1324e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
1325e8c27ec8Sbaban }
132608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
132708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in SID if it was not already there */
132808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix == NULL) {
132908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) {
1330e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix =
133108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(wksid->sidprefix);
133208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
133308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
133408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.prefix =
133508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(_idmapdstate.cfg->pgcfg.machine_sid);
133608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
133708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
1338e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL)
1339e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
134008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.rid = wksid->rid;
1341e8c27ec8Sbaban }
1342e8c27ec8Sbaban
134308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in the canonical domain if not already there */
134408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1domain == NULL) {
134508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *dom;
134608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
134708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
1348fe1c642dSBill Krier if (wksid->domain != NULL)
134908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = wksid->domain;
1350fe1c642dSBill Krier else
135108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = _idmapdstate.hostname;
135208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1domain = strdup(dom);
135308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
135408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1domain == NULL)
135508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY);
135608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
135708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
135808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *is_wksid = 1;
1359e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
1360e8c27ec8Sbaban
136108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idtype = wksid->is_wuser ? IDMAP_USID : IDMAP_GSID;
1362e8c27ec8Sbaban
1363479ac375Sdm199847 if (res->id.idtype == IDMAP_POSIXID) {
136408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype = wksid->is_wuser ? IDMAP_UID : IDMAP_GID;
1365479ac375Sdm199847 }
136608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
136708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->direction == IDMAP_DIRECTION_UNDEF) {
136808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
136908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * We don't have a mapping
137008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * (But note that we may have supplied SID, name, or type
137108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * information.)
137208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
1373e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
137408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
137508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
137608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
137708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * We have an explicit mapping.
137808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
13799fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->pid == IDMAP_SENTINEL_PID) {
138008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
138108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * ... which is that mapping is inhibited.
138208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
138308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOMAPPING);
138408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
138562c60062Sbaban
1386e8c27ec8Sbaban switch (res->id.idtype) {
1387c5c4113dSnw141292 case IDMAP_UID:
138808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = wksid->pid;
138908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States break;
1390c5c4113dSnw141292 case IDMAP_GID:
139108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.gid = wksid->pid;
139208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States break;
1393c5c4113dSnw141292 default:
139408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* IDMAP_POSIXID is eliminated above */
1395c5c4113dSnw141292 return (IDMAP_ERR_NOTSUPPORTED);
1396c5c4113dSnw141292 }
139708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
139808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->direction = wksid->direction;
139908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID;
140008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.src = IDMAP_MAP_SRC_HARD_CODED;
140108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS);
1402c5c4113dSnw141292 }
1403c5c4113dSnw141292
1404cd37da74Snw141292
140508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
140608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Look for an entry mapping a PID to a SID.
140708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
140808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Note that direction=UNDEF entries do not specify a mapping,
14099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * and that IDMAP_SENTINEL_PID entries represent either an inhibited
141008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * mapping or an ephemeral mapping. We don't handle either here;
141108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * they are filtered out by find_wksid_by_pid.
141208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
1413cd37da74Snw141292 static
1414cd37da74Snw141292 idmap_retcode
lookup_wksids_pid2sid(idmap_mapping * req,idmap_id_res * res,int is_user)1415cd37da74Snw141292 lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user)
1416cd37da74Snw141292 {
141708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid;
141808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
141908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_pid(req->id1.idmap_id_u.uid, is_user);
142008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL)
1421e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
142208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1423e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) {
142408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype = wksid->is_wuser ? IDMAP_USID : IDMAP_GSID;
1425e8c27ec8Sbaban }
142608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.rid = wksid->rid;
142708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
142808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) {
1429c5c4113dSnw141292 res->id.idmap_id_u.sid.prefix =
143008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(wksid->sidprefix);
143108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
143208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
143308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.prefix =
143408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(_idmapdstate.cfg->pgcfg.machine_sid);
143508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
143608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
143708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1438c5c4113dSnw141292 if (res->id.idmap_id_u.sid.prefix == NULL) {
1439c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
1440c5c4113dSnw141292 return (IDMAP_ERR_MEMORY);
1441c5c4113dSnw141292 }
144208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1443fe1c642dSBill Krier /* Fill in name if it was not already there. */
1444fe1c642dSBill Krier if (req->id2name == NULL) {
1445fe1c642dSBill Krier req->id2name = strdup(wksid->winname);
1446fe1c642dSBill Krier if (req->id2name == NULL)
1447fe1c642dSBill Krier return (IDMAP_ERR_MEMORY);
1448fe1c642dSBill Krier }
1449fe1c642dSBill Krier
1450fe1c642dSBill Krier /* Fill in the canonical domain if not already there */
1451fe1c642dSBill Krier if (req->id2domain == NULL) {
1452fe1c642dSBill Krier const char *dom;
1453fe1c642dSBill Krier
1454fe1c642dSBill Krier RDLOCK_CONFIG();
1455fe1c642dSBill Krier if (wksid->domain != NULL)
1456fe1c642dSBill Krier dom = wksid->domain;
1457fe1c642dSBill Krier else
1458fe1c642dSBill Krier dom = _idmapdstate.hostname;
1459fe1c642dSBill Krier req->id2domain = strdup(dom);
1460fe1c642dSBill Krier UNLOCK_CONFIG();
1461fe1c642dSBill Krier if (req->id2domain == NULL)
1462fe1c642dSBill Krier return (IDMAP_ERR_MEMORY);
1463fe1c642dSBill Krier }
1464fe1c642dSBill Krier
146508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->direction = wksid->direction;
1466fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID;
146748258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_HARD_CODED;
1468c5c4113dSnw141292 return (IDMAP_SUCCESS);
1469c5c4113dSnw141292 }
147062c60062Sbaban
147108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
147208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Look up a name in the wksids list, matching name and, if supplied, domain,
147308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * and extract data.
147408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
147508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given:
147608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name
147708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name (or NULL)
147808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
147908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Return: Error code
148008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
148108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname canonical name (if canonname non-NULL) [1]
148208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canondomain canonical domain (if canondomain non-NULL) [1]
148308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix (if sidprefix non-NULL) [1]
148408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID (if rid non-NULL) [2]
148508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *type Type (if type non-NULL) [2]
148608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
148708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error
148808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [2] Undefined on error
148908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
1490cd37da74Snw141292 idmap_retcode
lookup_wksids_name2sid(const char * name,const char * domain,char ** canonname,char ** canondomain,char ** sidprefix,idmap_rid_t * rid,idmap_id_type * type)149108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_wksids_name2sid(
149208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *name,
149308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *domain,
149408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canonname,
149508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canondomain,
149608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **sidprefix,
149708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *rid,
1498148c5f43SAlan Wright idmap_id_type *type)
1499cd37da74Snw141292 {
150008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid;
1501479ac375Sdm199847
150208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL)
150308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL;
150408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL)
150508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
150608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL)
150708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL;
1508479ac375Sdm199847
150908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_name(name, domain, IDMAP_POSIXID);
151008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL)
151108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND);
151208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
151308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) {
151408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) {
151508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(wksid->sidprefix);
151608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
151708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
151808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(
151908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.cfg->pgcfg.machine_sid);
152008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
152162c60062Sbaban }
152208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*sidprefix == NULL)
152308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem;
152408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
152508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
152608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (rid != NULL)
152708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *rid = wksid->rid;
152808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
152908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
153008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = strdup(wksid->winname);
153108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canonname == NULL)
153208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem;
153308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
153408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
153508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) {
153608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->domain != NULL) {
153708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(wksid->domain);
153808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
153908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
154008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(_idmapdstate.hostname);
154108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
154208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
154308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canondomain == NULL)
154408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem;
154508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
154608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
154708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (type != NULL)
154808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *type = (wksid->is_wuser) ?
1549148c5f43SAlan Wright IDMAP_USID : IDMAP_GSID;
155008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
155108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS);
155208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
155308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States nomem:
1554cd37da74Snw141292 idmapdlog(LOG_ERR, "Out of memory");
155508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1556e8c27ec8Sbaban if (sidprefix != NULL) {
1557e8c27ec8Sbaban free(*sidprefix);
1558e8c27ec8Sbaban *sidprefix = NULL;
1559e8c27ec8Sbaban }
156008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
156108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
156208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname);
156308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
156408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
156508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
156608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) {
156708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canondomain);
156808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL;
156908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
157008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1571cd37da74Snw141292 return (IDMAP_ERR_MEMORY);
1572cd37da74Snw141292 }
1573c5c4113dSnw141292
1574cd37da74Snw141292 static
1575cd37da74Snw141292 idmap_retcode
lookup_cache_sid2pid(sqlite * cache,idmap_mapping * req,idmap_id_res * res)1576cd37da74Snw141292 lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1577cd37da74Snw141292 {
1578c5c4113dSnw141292 char *end;
1579c5c4113dSnw141292 char *sql = NULL;
1580c5c4113dSnw141292 const char **values;
1581c5c4113dSnw141292 sqlite_vm *vm = NULL;
1582c5c4113dSnw141292 int ncol, is_user;
1583c5c4113dSnw141292 uid_t pid;
1584c5c4113dSnw141292 time_t curtime, exp;
1585c5c4113dSnw141292 idmap_retcode retcode;
1586042addd6Sbaban char *is_user_string, *lower_name;
1587c5c4113dSnw141292
1588c5c4113dSnw141292 /* Current time */
1589c5c4113dSnw141292 errno = 0;
1590c5c4113dSnw141292 if ((curtime = time(NULL)) == (time_t)-1) {
1591cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1592c5c4113dSnw141292 strerror(errno));
1593c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
1594c5c4113dSnw141292 goto out;
1595c5c4113dSnw141292 }
1596c5c4113dSnw141292
1597e8c27ec8Sbaban switch (res->id.idtype) {
1598cd37da74Snw141292 case IDMAP_UID:
1599cd37da74Snw141292 is_user_string = "1";
1600cd37da74Snw141292 break;
1601cd37da74Snw141292 case IDMAP_GID:
1602cd37da74Snw141292 is_user_string = "0";
1603cd37da74Snw141292 break;
1604cd37da74Snw141292 case IDMAP_POSIXID:
1605cd37da74Snw141292 /* the non-diagonal mapping */
1606cd37da74Snw141292 is_user_string = "is_wuser";
1607cd37da74Snw141292 break;
1608cd37da74Snw141292 default:
1609cd37da74Snw141292 retcode = IDMAP_ERR_NOTSUPPORTED;
1610cd37da74Snw141292 goto out;
1611cd37da74Snw141292 }
1612cd37da74Snw141292
1613c5c4113dSnw141292 /* SQL to lookup the cache */
161448258c6bSjp151216
1615e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) {
1616e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
161748258c6bSjp151216 "unixname, u2w, is_wuser, "
161848258c6bSjp151216 "map_type, map_dn, map_attr, map_value, "
161948258c6bSjp151216 "map_windomain, map_winname, map_unixname, map_is_nt4 "
1620cd37da74Snw141292 "FROM idmap_cache WHERE is_user = %s AND "
1621c5c4113dSnw141292 "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
1622c5c4113dSnw141292 "(pid >= 2147483648 OR "
1623c5c4113dSnw141292 "(expiration = 0 OR expiration ISNULL OR "
1624c5c4113dSnw141292 "expiration > %d));",
1625e8c27ec8Sbaban is_user_string, req->id1.idmap_id_u.sid.prefix,
1626e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, curtime);
1627e8c27ec8Sbaban } else if (req->id1name != NULL) {
1628042addd6Sbaban if ((lower_name = tolower_u8(req->id1name)) == NULL)
1629042addd6Sbaban lower_name = req->id1name;
1630e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
163148258c6bSjp151216 "unixname, u2w, is_wuser, "
163248258c6bSjp151216 "map_type, map_dn, map_attr, map_value, "
163348258c6bSjp151216 "map_windomain, map_winname, map_unixname, map_is_nt4 "
1634e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND "
1635e8c27ec8Sbaban "winname = %Q AND windomain = %Q AND w2u = 1 AND "
1636e8c27ec8Sbaban "(pid >= 2147483648 OR "
1637e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR "
1638e8c27ec8Sbaban "expiration > %d));",
163948258c6bSjp151216 is_user_string, lower_name, req->id1domain,
164048258c6bSjp151216 curtime);
1641042addd6Sbaban if (lower_name != req->id1name)
1642042addd6Sbaban free(lower_name);
1643e8c27ec8Sbaban } else {
1644e8c27ec8Sbaban retcode = IDMAP_ERR_ARG;
1645e8c27ec8Sbaban goto out;
1646e8c27ec8Sbaban }
1647c5c4113dSnw141292 if (sql == NULL) {
1648c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
1649c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
1650c5c4113dSnw141292 goto out;
1651c5c4113dSnw141292 }
165248258c6bSjp151216 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol,
165348258c6bSjp151216 14, &values);
1654c5c4113dSnw141292 sqlite_freemem(sql);
1655c5c4113dSnw141292
1656c5c4113dSnw141292 if (retcode == IDMAP_ERR_NOTFOUND) {
1657c5c4113dSnw141292 goto out;
1658c5c4113dSnw141292 } else if (retcode == IDMAP_SUCCESS) {
1659c5c4113dSnw141292 /* sanity checks */
1660c5c4113dSnw141292 if (values[0] == NULL || values[1] == NULL) {
1661c5c4113dSnw141292 retcode = IDMAP_ERR_CACHE;
1662c5c4113dSnw141292 goto out;
1663c5c4113dSnw141292 }
1664c5c4113dSnw141292
1665c5c4113dSnw141292 pid = strtoul(values[0], &end, 10);
1666c5c4113dSnw141292 is_user = strncmp(values[1], "0", 2) ? 1 : 0;
1667c5c4113dSnw141292
1668cd37da74Snw141292 if (is_user) {
1669cd37da74Snw141292 res->id.idtype = IDMAP_UID;
1670cd37da74Snw141292 res->id.idmap_id_u.uid = pid;
1671cd37da74Snw141292 } else {
1672cd37da74Snw141292 res->id.idtype = IDMAP_GID;
1673cd37da74Snw141292 res->id.idmap_id_u.gid = pid;
1674cd37da74Snw141292 }
1675cd37da74Snw141292
1676c5c4113dSnw141292 /*
1677c5c4113dSnw141292 * We may have an expired ephemeral mapping. Consider
1678c5c4113dSnw141292 * the expired entry as valid if we are not going to
1679c5c4113dSnw141292 * perform name-based mapping. But do not renew the
1680c5c4113dSnw141292 * expiration.
1681c5c4113dSnw141292 * If we will be doing name-based mapping then store the
1682c5c4113dSnw141292 * ephemeral pid in the result so that we can use it
1683c5c4113dSnw141292 * if we end up doing dynamic mapping again.
1684c5c4113dSnw141292 */
1685c5c4113dSnw141292 if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) &&
1686cd37da74Snw141292 !AVOID_NAMESERVICE(req) &&
16879fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States IDMAP_ID_IS_EPHEMERAL(pid) && values[2] != NULL) {
1688c5c4113dSnw141292 exp = strtoll(values[2], &end, 10);
1689c5c4113dSnw141292 if (exp && exp <= curtime) {
1690c5c4113dSnw141292 /* Store the ephemeral pid */
1691651c0131Sbaban res->direction = IDMAP_DIRECTION_BI;
1692cd37da74Snw141292 req->direction |= is_user
1693cd37da74Snw141292 ? _IDMAP_F_EXP_EPH_UID
1694cd37da74Snw141292 : _IDMAP_F_EXP_EPH_GID;
1695c5c4113dSnw141292 retcode = IDMAP_ERR_NOTFOUND;
1696c5c4113dSnw141292 }
1697c5c4113dSnw141292 }
1698c5c4113dSnw141292 }
1699c5c4113dSnw141292
1700c5c4113dSnw141292 out:
1701c5c4113dSnw141292 if (retcode == IDMAP_SUCCESS) {
170262c60062Sbaban if (values[4] != NULL)
1703c5c4113dSnw141292 res->direction =
1704651c0131Sbaban (strtol(values[4], &end, 10) == 0)?
1705651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
1706c5c4113dSnw141292 else
1707651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U;
1708c5c4113dSnw141292
170962c60062Sbaban if (values[3] != NULL) {
1710e8c27ec8Sbaban if (req->id2name != NULL)
1711e8c27ec8Sbaban free(req->id2name);
17128e228215Sdm199847 req->id2name = strdup(values[3]);
17138e228215Sdm199847 if (req->id2name == NULL) {
1714c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
1715c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
1716c5c4113dSnw141292 }
1717c5c4113dSnw141292 }
1718e8c27ec8Sbaban
1719e8c27ec8Sbaban req->id1.idtype = strncmp(values[5], "0", 2) ?
1720e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID;
172148258c6bSjp151216
172248258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
172348258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_CACHE;
172448258c6bSjp151216 res->info.how.map_type = strtoul(values[6], &end, 10);
172548258c6bSjp151216 switch (res->info.how.map_type) {
172648258c6bSjp151216 case IDMAP_MAP_TYPE_DS_AD:
172748258c6bSjp151216 res->info.how.idmap_how_u.ad.dn =
172848258c6bSjp151216 strdup(values[7]);
172948258c6bSjp151216 res->info.how.idmap_how_u.ad.attr =
173048258c6bSjp151216 strdup(values[8]);
173148258c6bSjp151216 res->info.how.idmap_how_u.ad.value =
173248258c6bSjp151216 strdup(values[9]);
173348258c6bSjp151216 break;
173448258c6bSjp151216
173548258c6bSjp151216 case IDMAP_MAP_TYPE_DS_NLDAP:
173648258c6bSjp151216 res->info.how.idmap_how_u.nldap.dn =
173748258c6bSjp151216 strdup(values[7]);
173848258c6bSjp151216 res->info.how.idmap_how_u.nldap.attr =
173948258c6bSjp151216 strdup(values[8]);
174048258c6bSjp151216 res->info.how.idmap_how_u.nldap.value =
174148258c6bSjp151216 strdup(values[9]);
174248258c6bSjp151216 break;
174348258c6bSjp151216
174448258c6bSjp151216 case IDMAP_MAP_TYPE_RULE_BASED:
174548258c6bSjp151216 res->info.how.idmap_how_u.rule.windomain =
174648258c6bSjp151216 strdup(values[10]);
174748258c6bSjp151216 res->info.how.idmap_how_u.rule.winname =
174848258c6bSjp151216 strdup(values[11]);
174948258c6bSjp151216 res->info.how.idmap_how_u.rule.unixname =
175048258c6bSjp151216 strdup(values[12]);
175148258c6bSjp151216 res->info.how.idmap_how_u.rule.is_nt4 =
175248258c6bSjp151216 strtoul(values[13], &end, 1);
175348258c6bSjp151216 res->info.how.idmap_how_u.rule.is_user =
175448258c6bSjp151216 is_user;
175548258c6bSjp151216 res->info.how.idmap_how_u.rule.is_wuser =
175648258c6bSjp151216 strtoul(values[5], &end, 1);
175748258c6bSjp151216 break;
175848258c6bSjp151216
175948258c6bSjp151216 case IDMAP_MAP_TYPE_EPHEMERAL:
176048258c6bSjp151216 break;
176148258c6bSjp151216
176248258c6bSjp151216 case IDMAP_MAP_TYPE_LOCAL_SID:
176348258c6bSjp151216 break;
176448258c6bSjp151216
176548258c6bSjp151216 case IDMAP_MAP_TYPE_KNOWN_SID:
176648258c6bSjp151216 break;
176748258c6bSjp151216
1768e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU:
1769e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.dn =
1770e3f2c991SKeyur Desai strdup(values[7]);
1771e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.attr =
1772e3f2c991SKeyur Desai strdup(values[8]);
1773e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.value =
1774e3f2c991SKeyur Desai strdup(values[9]);
1775e3f2c991SKeyur Desai break;
1776e3f2c991SKeyur Desai
177748258c6bSjp151216 default:
1778e3f2c991SKeyur Desai /* Unknown mapping type */
177948258c6bSjp151216 assert(FALSE);
178048258c6bSjp151216 }
178148258c6bSjp151216 }
1782c5c4113dSnw141292 }
178362c60062Sbaban if (vm != NULL)
1784c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL);
1785c5c4113dSnw141292 return (retcode);
1786c5c4113dSnw141292 }
1787c5c4113dSnw141292
1788148c5f43SAlan Wright /*
1789148c5f43SAlan Wright * Previous versions used two enumerations for representing types.
1790148c5f43SAlan Wright * One of those has largely been eliminated, but was used in the
1791148c5f43SAlan Wright * name cache table and so during an upgrade might still be visible.
1792148c5f43SAlan Wright * In addition, the test suite prepopulates the cache with these values.
1793148c5f43SAlan Wright *
1794148c5f43SAlan Wright * This function translates those old values into the new values.
1795148c5f43SAlan Wright *
1796148c5f43SAlan Wright * This code deliberately does not use symbolic values for the legacy
1797148c5f43SAlan Wright * values. This is the *only* place where they should be used.
1798148c5f43SAlan Wright */
1799148c5f43SAlan Wright static
1800148c5f43SAlan Wright idmap_id_type
xlate_legacy_type(int type)1801148c5f43SAlan Wright xlate_legacy_type(int type)
1802148c5f43SAlan Wright {
1803148c5f43SAlan Wright switch (type) {
1804148c5f43SAlan Wright case -1004: /* _IDMAP_T_USER */
1805148c5f43SAlan Wright return (IDMAP_USID);
1806148c5f43SAlan Wright case -1005: /* _IDMAP_T_GROUP */
1807148c5f43SAlan Wright return (IDMAP_GSID);
1808148c5f43SAlan Wright default:
1809148c5f43SAlan Wright return (type);
1810148c5f43SAlan Wright }
1811148c5f43SAlan Wright NOTE(NOTREACHED)
1812148c5f43SAlan Wright }
1813148c5f43SAlan Wright
1814cd37da74Snw141292 static
1815cd37da74Snw141292 idmap_retcode
lookup_cache_sid2name(sqlite * cache,const char * sidprefix,idmap_rid_t rid,char ** canonname,char ** canondomain,idmap_id_type * type)181662c60062Sbaban lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid,
1817148c5f43SAlan Wright char **canonname, char **canondomain, idmap_id_type *type)
1818cd37da74Snw141292 {
1819c5c4113dSnw141292 char *end;
1820c5c4113dSnw141292 char *sql = NULL;
1821c5c4113dSnw141292 const char **values;
1822c5c4113dSnw141292 sqlite_vm *vm = NULL;
1823c5c4113dSnw141292 int ncol;
1824c5c4113dSnw141292 time_t curtime;
1825c5c4113dSnw141292 idmap_retcode retcode = IDMAP_SUCCESS;
1826c5c4113dSnw141292
1827c5c4113dSnw141292 /* Get current time */
1828c5c4113dSnw141292 errno = 0;
1829c5c4113dSnw141292 if ((curtime = time(NULL)) == (time_t)-1) {
1830cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1831c5c4113dSnw141292 strerror(errno));
1832c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
1833c5c4113dSnw141292 goto out;
1834c5c4113dSnw141292 }
1835c5c4113dSnw141292
1836c5c4113dSnw141292 /* SQL to lookup the cache */
1837cd37da74Snw141292 sql = sqlite_mprintf("SELECT canon_name, domain, type "
1838cd37da74Snw141292 "FROM name_cache WHERE "
1839c5c4113dSnw141292 "sidprefix = %Q AND rid = %u AND "
1840c5c4113dSnw141292 "(expiration = 0 OR expiration ISNULL OR "
1841c5c4113dSnw141292 "expiration > %d);",
1842c5c4113dSnw141292 sidprefix, rid, curtime);
1843c5c4113dSnw141292 if (sql == NULL) {
1844c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
1845c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
1846c5c4113dSnw141292 goto out;
1847c5c4113dSnw141292 }
1848c5c4113dSnw141292 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values);
1849c5c4113dSnw141292 sqlite_freemem(sql);
1850c5c4113dSnw141292
1851c5c4113dSnw141292 if (retcode == IDMAP_SUCCESS) {
185262c60062Sbaban if (type != NULL) {
1853c5c4113dSnw141292 if (values[2] == NULL) {
1854c5c4113dSnw141292 retcode = IDMAP_ERR_CACHE;
1855c5c4113dSnw141292 goto out;
1856c5c4113dSnw141292 }
1857148c5f43SAlan Wright *type = xlate_legacy_type(strtol(values[2], &end, 10));
1858c5c4113dSnw141292 }
1859c5c4113dSnw141292
186008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL && values[0] != NULL) {
186108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if ((*canonname = strdup(values[0])) == NULL) {
1862c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
1863c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
1864c5c4113dSnw141292 goto out;
1865c5c4113dSnw141292 }
1866c5c4113dSnw141292 }
1867c5c4113dSnw141292
186808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL && values[1] != NULL) {
186908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if ((*canondomain = strdup(values[1])) == NULL) {
187008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
187108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname);
187208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
1873c5c4113dSnw141292 }
1874c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
1875c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
1876c5c4113dSnw141292 goto out;
1877c5c4113dSnw141292 }
1878c5c4113dSnw141292 }
1879c5c4113dSnw141292 }
1880c5c4113dSnw141292
1881c5c4113dSnw141292 out:
188262c60062Sbaban if (vm != NULL)
1883c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL);
1884c5c4113dSnw141292 return (retcode);
1885c5c4113dSnw141292 }
1886c5c4113dSnw141292
1887c5c4113dSnw141292 /*
1888e8c27ec8Sbaban * Given SID, find winname using name_cache OR
1889e8c27ec8Sbaban * Given winname, find SID using name_cache.
1890e8c27ec8Sbaban * Used when mapping win to unix i.e. req->id1 is windows id and
1891e8c27ec8Sbaban * req->id2 is unix id
1892c5c4113dSnw141292 */
1893cd37da74Snw141292 static
1894cd37da74Snw141292 idmap_retcode
lookup_name_cache(sqlite * cache,idmap_mapping * req,idmap_id_res * res)1895e8c27ec8Sbaban lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1896cd37da74Snw141292 {
1897148c5f43SAlan Wright idmap_id_type type = -1;
1898c5c4113dSnw141292 idmap_retcode retcode;
1899e8c27ec8Sbaban char *sidprefix = NULL;
1900c5c4113dSnw141292 idmap_rid_t rid;
1901c5c4113dSnw141292 char *name = NULL, *domain = NULL;
1902c5c4113dSnw141292
1903e8c27ec8Sbaban /* Done if we've both sid and winname */
1904148c5f43SAlan Wright if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL) {
1905148c5f43SAlan Wright /* Don't bother TRACE()ing, too boring */
1906e8c27ec8Sbaban return (IDMAP_SUCCESS);
1907148c5f43SAlan Wright }
1908c5c4113dSnw141292
1909e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) {
191008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup sid to winname */
1911e8c27ec8Sbaban retcode = lookup_cache_sid2name(cache,
1912e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix,
1913e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, &name, &domain, &type);
191408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
191508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup winame to sid */
191608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = lookup_cache_name2sid(cache, req->id1name,
191708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1domain, &name, &sidprefix, &rid, &type);
1918e8c27ec8Sbaban }
191962c60062Sbaban
1920e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
1921148c5f43SAlan Wright if (retcode == IDMAP_ERR_NOTFOUND) {
1922148c5f43SAlan Wright TRACE(req, res, "Not found in name cache");
1923148c5f43SAlan Wright } else {
1924148c5f43SAlan Wright TRACE(req, res, "Name cache lookup error=%d", retcode);
1925148c5f43SAlan Wright }
1926c5c4113dSnw141292 free(name);
1927c5c4113dSnw141292 free(domain);
1928e8c27ec8Sbaban free(sidprefix);
1929e8c27ec8Sbaban return (retcode);
1930e8c27ec8Sbaban }
1931e8c27ec8Sbaban
1932148c5f43SAlan Wright req->id1.idtype = type;
1933e8c27ec8Sbaban
1934e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
193508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
193608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
193708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we found canonical names or domain, use them instead of
193808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * the existing values.
193908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
1940e8c27ec8Sbaban if (name != NULL) {
194108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(req->id1name);
194208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name = name;
1943e8c27ec8Sbaban }
194408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (domain != NULL) {
194508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(req->id1domain);
1946e8c27ec8Sbaban req->id1domain = domain;
194708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
194808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1949e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL) {
1950e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = sidprefix;
1951e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid = rid;
1952c5c4113dSnw141292 }
1953148c5f43SAlan Wright
1954148c5f43SAlan Wright TRACE(req, res, "Found in name cache");
1955c5c4113dSnw141292 return (retcode);
1956c5c4113dSnw141292 }
1957c5c4113dSnw141292
19584d61c878SJulian Pullen
19594d61c878SJulian Pullen
19604d61c878SJulian Pullen static int
ad_lookup_batch_int(lookup_state_t * state,idmap_mapping_batch * batch,idmap_ids_res * result,adutils_ad_t * dir,int how_local,int * num_processed)19614d61c878SJulian Pullen ad_lookup_batch_int(lookup_state_t *state, idmap_mapping_batch *batch,
1962e3f2c991SKeyur Desai idmap_ids_res *result, adutils_ad_t *dir, int how_local,
1963e3f2c991SKeyur Desai int *num_processed)
1964cd37da74Snw141292 {
1965c5c4113dSnw141292 idmap_retcode retcode;
1966e3f2c991SKeyur Desai int i, num_queued, is_wuser, is_user;
19674d61c878SJulian Pullen int next_request;
1968148c5f43SAlan Wright int retries = 0, esidtype;
1969e8c27ec8Sbaban char **unixname;
1970c5c4113dSnw141292 idmap_mapping *req;
1971c5c4113dSnw141292 idmap_id_res *res;
1972e8c27ec8Sbaban idmap_query_state_t *qs = NULL;
197348258c6bSjp151216 idmap_how *how;
1974479ac375Sdm199847 char **dn, **attr, **value;
1975e8c27ec8Sbaban
19764d61c878SJulian Pullen *num_processed = 0;
19774d61c878SJulian Pullen
1978e8c27ec8Sbaban /*
1979e8c27ec8Sbaban * Since req->id2.idtype is unused, we will use it here
1980e8c27ec8Sbaban * to retrieve the value of sid_type. But it needs to be
1981e8c27ec8Sbaban * reset to IDMAP_NONE before we return to prevent xdr
1982e8c27ec8Sbaban * from mis-interpreting req->id2 when it tries to free
1983e8c27ec8Sbaban * the input argument. Other option is to allocate an
1984e8c27ec8Sbaban * array of integers and use it instead for the batched
1985e8c27ec8Sbaban * call. But why un-necessarily allocate memory. That may
1986e8c27ec8Sbaban * be an option if req->id2.idtype cannot be re-used in
1987e8c27ec8Sbaban * future.
1988e3f2c991SKeyur Desai *
19899fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Similarly, we use req->id2.idmap_id_u.uid to return
19909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * uidNumber or gidNumber supplied by IDMU, and reset it
19919fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * back to IDMAP_SENTINEL_PID when we're done. Note that
19929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * the query always puts the result in req->id2.idmap_id_u.uid,
19939fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * not .gid.
1994e8c27ec8Sbaban */
1995c5c4113dSnw141292 retry:
1996e3f2c991SKeyur Desai retcode = idmap_lookup_batch_start(dir, state->ad_nqueries,
1997e3f2c991SKeyur Desai state->directory_based_mapping,
1998e3f2c991SKeyur Desai state->defdom,
1999e3f2c991SKeyur Desai &qs);
2000e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
20012b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
20022b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES)
20030dcc7149Snw141292 goto retry;
2004349d5d8fSnw141292 degrade_svc(1, "failed to create batch for AD lookup");
2005e8c27ec8Sbaban goto out;
2006c5c4113dSnw141292 }
20074d61c878SJulian Pullen num_queued = 0;
2008c5c4113dSnw141292
2009c8e26105Sjp151216 restore_svc();
2010c8e26105Sjp151216
2011e3f2c991SKeyur Desai if (how_local & FOREST_IS_LOCAL) {
20124d61c878SJulian Pullen /*
20134d61c878SJulian Pullen * Directory based name mapping is only performed within the
2014e3f2c991SKeyur Desai * joined forest. We don't trust other "trusted"
20154d61c878SJulian Pullen * forests to provide DS-based name mapping information because
20164d61c878SJulian Pullen * AD's definition of "cross-forest trust" does not encompass
20174d61c878SJulian Pullen * this sort of behavior.
20184d61c878SJulian Pullen */
20194d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs,
20204d61c878SJulian Pullen state->ad_unixuser_attr, state->ad_unixgroup_attr);
20214d61c878SJulian Pullen }
2022e8c27ec8Sbaban
20234d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
2024c5c4113dSnw141292 req = &batch->idmap_mapping_batch_val[i];
2025c5c4113dSnw141292 res = &result->ids.ids_val[i];
202648258c6bSjp151216 how = &res->info.how;
202748258c6bSjp151216
2028e8c27ec8Sbaban retcode = IDMAP_SUCCESS;
2029e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE;
20309fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States req->id2.idmap_id_u.uid = IDMAP_SENTINEL_PID;
2031c5c4113dSnw141292
2032e3f2c991SKeyur Desai /* Skip if no AD lookup required */
2033e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD))
2034e8c27ec8Sbaban continue;
2035e8c27ec8Sbaban
2036e3f2c991SKeyur Desai /* Skip if we've already tried and gotten a "not found" */
2037e3f2c991SKeyur Desai if (req->direction & _IDMAP_F_LOOKUP_OTHER_AD)
2038e3f2c991SKeyur Desai continue;
2039e3f2c991SKeyur Desai
2040e3f2c991SKeyur Desai /* Skip if we've already either succeeded or failed */
204196c3a9a0Sbaban if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR)
2042c5c4113dSnw141292 continue;
2043e8c27ec8Sbaban
2044148c5f43SAlan Wright if (IS_ID_SID(req->id1)) {
2045e8c27ec8Sbaban
2046479ac375Sdm199847 /* win2unix request: */
2047e8c27ec8Sbaban
2048e3f2c991SKeyur Desai posix_id_t *pid = NULL;
2049479ac375Sdm199847 unixname = dn = attr = value = NULL;
2050148c5f43SAlan Wright esidtype = IDMAP_SID;
2051e3f2c991SKeyur Desai if (state->directory_based_mapping ==
2052e3f2c991SKeyur Desai DIRECTORY_MAPPING_NAME &&
2053e3f2c991SKeyur Desai req->id2name == NULL) {
2054e8c27ec8Sbaban if (res->id.idtype == IDMAP_UID &&
2055e8c27ec8Sbaban AD_OR_MIXED(state->nm_siduid)) {
2056148c5f43SAlan Wright esidtype = IDMAP_USID;
2057e8c27ec8Sbaban unixname = &req->id2name;
2058e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GID &&
2059e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) {
2060148c5f43SAlan Wright esidtype = IDMAP_GSID;
2061e8c27ec8Sbaban unixname = &req->id2name;
2062e8c27ec8Sbaban } else if (AD_OR_MIXED(state->nm_siduid) ||
2063e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) {
2064e8c27ec8Sbaban unixname = &req->id2name;
2065e8c27ec8Sbaban }
20664d61c878SJulian Pullen
2067479ac375Sdm199847 if (unixname != NULL) {
2068479ac375Sdm199847 /*
2069479ac375Sdm199847 * Get how info for DS-based name
2070479ac375Sdm199847 * mapping only if AD or MIXED
2071479ac375Sdm199847 * mode is enabled.
2072479ac375Sdm199847 */
2073148c5f43SAlan Wright idmap_how_clear(&res->info.how);
207448258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW;
207548258c6bSjp151216 how->map_type = IDMAP_MAP_TYPE_DS_AD;
2076479ac375Sdm199847 dn = &how->idmap_how_u.ad.dn;
2077479ac375Sdm199847 attr = &how->idmap_how_u.ad.attr;
2078479ac375Sdm199847 value = &how->idmap_how_u.ad.value;
2079479ac375Sdm199847 }
2080e3f2c991SKeyur Desai } else if (state->directory_based_mapping ==
2081e3f2c991SKeyur Desai DIRECTORY_MAPPING_IDMU &&
2082e3f2c991SKeyur Desai (how_local & DOMAIN_IS_LOCAL)) {
2083e3f2c991SKeyur Desai /*
2084e3f2c991SKeyur Desai * Ensure that we only do IDMU processing
2085e3f2c991SKeyur Desai * when querying the domain we've joined.
2086e3f2c991SKeyur Desai */
2087e3f2c991SKeyur Desai pid = &req->id2.idmap_id_u.uid;
2088e3f2c991SKeyur Desai /*
2089e3f2c991SKeyur Desai * Get how info for IDMU based mapping.
2090e3f2c991SKeyur Desai */
2091148c5f43SAlan Wright idmap_how_clear(&res->info.how);
2092e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW;
2093e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_IDMU;
2094e3f2c991SKeyur Desai dn = &how->idmap_how_u.idmu.dn;
2095e3f2c991SKeyur Desai attr = &how->idmap_how_u.idmu.attr;
2096e3f2c991SKeyur Desai value = &how->idmap_how_u.idmu.value;
2097e3f2c991SKeyur Desai }
2098e3f2c991SKeyur Desai
2099479ac375Sdm199847 if (req->id1.idmap_id_u.sid.prefix != NULL) {
2100479ac375Sdm199847 /* Lookup AD by SID */
2101c5c4113dSnw141292 retcode = idmap_sid2name_batch_add1(
2102e8c27ec8Sbaban qs, req->id1.idmap_id_u.sid.prefix,
2103148c5f43SAlan Wright &req->id1.idmap_id_u.sid.rid, esidtype,
2104479ac375Sdm199847 dn, attr, value,
2105479ac375Sdm199847 (req->id1name == NULL) ?
2106479ac375Sdm199847 &req->id1name : NULL,
2107479ac375Sdm199847 (req->id1domain == NULL) ?
2108479ac375Sdm199847 &req->id1domain : NULL,
2109148c5f43SAlan Wright &req->id2.idtype, unixname,
2110e3f2c991SKeyur Desai pid,
2111479ac375Sdm199847 &res->retcode);
21124d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
21134d61c878SJulian Pullen num_queued++;
2114479ac375Sdm199847 } else {
2115479ac375Sdm199847 /* Lookup AD by winname */
2116479ac375Sdm199847 assert(req->id1name != NULL);
2117479ac375Sdm199847 retcode = idmap_name2sid_batch_add1(
2118479ac375Sdm199847 qs, req->id1name, req->id1domain,
2119148c5f43SAlan Wright esidtype,
2120479ac375Sdm199847 dn, attr, value,
2121479ac375Sdm199847 &req->id1name,
2122479ac375Sdm199847 &req->id1.idmap_id_u.sid.prefix,
2123479ac375Sdm199847 &req->id1.idmap_id_u.sid.rid,
2124148c5f43SAlan Wright &req->id2.idtype, unixname,
2125e3f2c991SKeyur Desai pid,
2126479ac375Sdm199847 &res->retcode);
21274d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
21284d61c878SJulian Pullen num_queued++;
2129479ac375Sdm199847 }
2130c5c4113dSnw141292
2131148c5f43SAlan Wright } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) {
2132479ac375Sdm199847
2133479ac375Sdm199847 /* unix2win request: */
2134e8c27ec8Sbaban
2135e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL &&
2136e8c27ec8Sbaban req->id2name != NULL) {
21374d61c878SJulian Pullen /* Already have SID and winname. done */
2138e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS;
2139e8c27ec8Sbaban continue;
2140c5c4113dSnw141292 }
2141c5c4113dSnw141292
2142e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL) {
2143cd37da74Snw141292 /*
2144e8c27ec8Sbaban * SID but no winname -- lookup AD by
2145e8c27ec8Sbaban * SID to get winname.
2146479ac375Sdm199847 * how info is not needed here because
2147479ac375Sdm199847 * we are not retrieving unixname from
2148479ac375Sdm199847 * AD.
2149cd37da74Snw141292 */
21504d61c878SJulian Pullen
2151e8c27ec8Sbaban retcode = idmap_sid2name_batch_add1(
2152e8c27ec8Sbaban qs, res->id.idmap_id_u.sid.prefix,
2153e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid,
2154148c5f43SAlan Wright IDMAP_POSIXID,
2155479ac375Sdm199847 NULL, NULL, NULL,
215648258c6bSjp151216 &req->id2name,
2157148c5f43SAlan Wright &req->id2domain, &req->id2.idtype,
2158e3f2c991SKeyur Desai NULL, NULL, &res->retcode);
21594d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
21604d61c878SJulian Pullen num_queued++;
2161e8c27ec8Sbaban } else if (req->id2name != NULL) {
2162e8c27ec8Sbaban /*
2163e8c27ec8Sbaban * winname but no SID -- lookup AD by
2164e8c27ec8Sbaban * winname to get SID.
2165479ac375Sdm199847 * how info is not needed here because
2166479ac375Sdm199847 * we are not retrieving unixname from
2167479ac375Sdm199847 * AD.
2168e8c27ec8Sbaban */
2169e8c27ec8Sbaban retcode = idmap_name2sid_batch_add1(
2170e8c27ec8Sbaban qs, req->id2name, req->id2domain,
2171148c5f43SAlan Wright IDMAP_POSIXID,
2172479ac375Sdm199847 NULL, NULL, NULL, NULL,
2173e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix,
2174e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid,
2175148c5f43SAlan Wright &req->id2.idtype, NULL,
2176e3f2c991SKeyur Desai NULL,
2177e8c27ec8Sbaban &res->retcode);
21784d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
21794d61c878SJulian Pullen num_queued++;
2180e3f2c991SKeyur Desai } else if (state->directory_based_mapping ==
2181e3f2c991SKeyur Desai DIRECTORY_MAPPING_IDMU &&
2182e3f2c991SKeyur Desai (how_local & DOMAIN_IS_LOCAL)) {
21839fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.uid !=
21849fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States IDMAP_SENTINEL_PID);
2185148c5f43SAlan Wright is_user = IS_ID_UID(req->id1);
2186e3f2c991SKeyur Desai if (res->id.idtype == IDMAP_USID)
2187e3f2c991SKeyur Desai is_wuser = 1;
2188e3f2c991SKeyur Desai else if (res->id.idtype == IDMAP_GSID)
2189e3f2c991SKeyur Desai is_wuser = 0;
2190e3f2c991SKeyur Desai else
2191e3f2c991SKeyur Desai is_wuser = is_user;
2192e3f2c991SKeyur Desai
2193e3f2c991SKeyur Desai /* IDMU can't do diagonal mappings */
2194e3f2c991SKeyur Desai if (is_user != is_wuser)
2195e3f2c991SKeyur Desai continue;
2196e3f2c991SKeyur Desai
2197148c5f43SAlan Wright idmap_how_clear(&res->info.how);
2198e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW;
2199e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_IDMU;
2200e3f2c991SKeyur Desai retcode = idmap_pid2sid_batch_add1(
2201e3f2c991SKeyur Desai qs, req->id1.idmap_id_u.uid, is_user,
2202e3f2c991SKeyur Desai &how->idmap_how_u.ad.dn,
2203e3f2c991SKeyur Desai &how->idmap_how_u.ad.attr,
2204e3f2c991SKeyur Desai &how->idmap_how_u.ad.value,
2205e3f2c991SKeyur Desai &res->id.idmap_id_u.sid.prefix,
2206e3f2c991SKeyur Desai &res->id.idmap_id_u.sid.rid,
2207e3f2c991SKeyur Desai &req->id2name, &req->id2domain,
2208148c5f43SAlan Wright &req->id2.idtype, &res->retcode);
2209e3f2c991SKeyur Desai if (retcode == IDMAP_SUCCESS)
2210e3f2c991SKeyur Desai num_queued++;
2211e8c27ec8Sbaban } else if (req->id1name != NULL) {
2212e8c27ec8Sbaban /*
22134d61c878SJulian Pullen * No SID and no winname but we've unixname.
22144d61c878SJulian Pullen * Lookup AD by unixname to get SID.
2215e8c27ec8Sbaban */
2216148c5f43SAlan Wright is_user = (IS_ID_UID(req->id1)) ? 1 : 0;
2217e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID)
2218e8c27ec8Sbaban is_wuser = 1;
2219e8c27ec8Sbaban else if (res->id.idtype == IDMAP_GSID)
2220e8c27ec8Sbaban is_wuser = 0;
2221e8c27ec8Sbaban else
2222e8c27ec8Sbaban is_wuser = is_user;
22234d61c878SJulian Pullen
2224148c5f43SAlan Wright idmap_how_clear(&res->info.how);
222548258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW;
222648258c6bSjp151216 how->map_type = IDMAP_MAP_TYPE_DS_AD;
2227e8c27ec8Sbaban retcode = idmap_unixname2sid_batch_add1(
2228e8c27ec8Sbaban qs, req->id1name, is_user, is_wuser,
222948258c6bSjp151216 &how->idmap_how_u.ad.dn,
223048258c6bSjp151216 &how->idmap_how_u.ad.attr,
223148258c6bSjp151216 &how->idmap_how_u.ad.value,
2232e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix,
2233e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid,
2234e8c27ec8Sbaban &req->id2name, &req->id2domain,
2235148c5f43SAlan Wright &req->id2.idtype, &res->retcode);
22364d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
22374d61c878SJulian Pullen num_queued++;
2238e8c27ec8Sbaban }
2239cd37da74Snw141292 }
2240cd37da74Snw141292
22414d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) {
22424d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD;
22434d61c878SJulian Pullen retcode = IDMAP_SUCCESS;
22444d61c878SJulian Pullen } else if (retcode != IDMAP_SUCCESS) {
22454d61c878SJulian Pullen break;
22464d61c878SJulian Pullen }
22474d61c878SJulian Pullen } /* End of for loop */
22484d61c878SJulian Pullen
224996c3a9a0Sbaban if (retcode == IDMAP_SUCCESS) {
225096c3a9a0Sbaban /* add keeps track if we added an entry to the batch */
22514d61c878SJulian Pullen if (num_queued > 0)
22520dcc7149Snw141292 retcode = idmap_lookup_batch_end(&qs);
225396c3a9a0Sbaban else
225496c3a9a0Sbaban idmap_lookup_release_batch(&qs);
2255e3f2c991SKeyur Desai } else {
2256e3f2c991SKeyur Desai idmap_lookup_release_batch(&qs);
2257e3f2c991SKeyur Desai num_queued = 0;
2258e3f2c991SKeyur Desai next_request = i + 1;
225996c3a9a0Sbaban }
2260cd37da74Snw141292
22612b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
22622b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES)
2263c5c4113dSnw141292 goto retry;
2264c8e26105Sjp151216 else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
2265349d5d8fSnw141292 degrade_svc(1, "some AD lookups timed out repeatedly");
2266c5c4113dSnw141292
22674d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) {
22684d61c878SJulian Pullen /* Mark any unproccessed requests for an other AD */
22694d61c878SJulian Pullen for (i = next_request; i < batch->idmap_mapping_batch_len;
22704d61c878SJulian Pullen i++) {
22714d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i];
22724d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD;
22734d61c878SJulian Pullen
22744d61c878SJulian Pullen }
22754d61c878SJulian Pullen }
22764d61c878SJulian Pullen
2277e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS)
2278e8c27ec8Sbaban idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests");
2279c5c4113dSnw141292
2280c5c4113dSnw141292 out:
2281e8c27ec8Sbaban /*
2282e8c27ec8Sbaban * This loop does the following:
2283479ac375Sdm199847 * 1. Reset _IDMAP_F_LOOKUP_AD flag from the request.
2284479ac375Sdm199847 * 2. Reset req->id2.idtype to IDMAP_NONE
2285479ac375Sdm199847 * 3. If batch_start or batch_add failed then set the status
2286479ac375Sdm199847 * of each request marked for AD lookup to that error.
22874d61c878SJulian Pullen * 4. Evaluate the type of the AD object (i.e. user or group)
22884d61c878SJulian Pullen * and update the idtype in request.
2289e8c27ec8Sbaban */
2290e8c27ec8Sbaban for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
2291148c5f43SAlan Wright idmap_id_type type;
2292e3f2c991SKeyur Desai uid_t posix_id;
2293e3f2c991SKeyur Desai
2294e8c27ec8Sbaban req = &batch->idmap_mapping_batch_val[i];
2295e8c27ec8Sbaban type = req->id2.idtype;
2296e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE;
2297e3f2c991SKeyur Desai posix_id = req->id2.idmap_id_u.uid;
22989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States req->id2.idmap_id_u.uid = IDMAP_SENTINEL_PID;
22995e0794bcSbaban res = &result->ids.ids_val[i];
2300e3f2c991SKeyur Desai
2301e3f2c991SKeyur Desai /*
2302e3f2c991SKeyur Desai * If it didn't need AD lookup, ignore it.
2303e3f2c991SKeyur Desai */
2304e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD))
2305e8c27ec8Sbaban continue;
2306e8c27ec8Sbaban
2307e3f2c991SKeyur Desai /*
2308e3f2c991SKeyur Desai * If we deferred it this time, reset for the next
2309e3f2c991SKeyur Desai * AD server.
2310e3f2c991SKeyur Desai */
2311e3f2c991SKeyur Desai if (req->direction & _IDMAP_F_LOOKUP_OTHER_AD) {
2312e3f2c991SKeyur Desai req->direction &= ~_IDMAP_F_LOOKUP_OTHER_AD;
2313e3f2c991SKeyur Desai continue;
2314e3f2c991SKeyur Desai }
2315e3f2c991SKeyur Desai
23164d61c878SJulian Pullen /* Count number processed */
23174d61c878SJulian Pullen (*num_processed)++;
23184d61c878SJulian Pullen
2319479ac375Sdm199847 /* Reset AD lookup flag */
2320479ac375Sdm199847 req->direction &= ~(_IDMAP_F_LOOKUP_AD);
2321479ac375Sdm199847
2322479ac375Sdm199847 /*
23234d61c878SJulian Pullen * If batch_start or batch_add failed then set the
23244d61c878SJulian Pullen * status of each request marked for AD lookup to
23254d61c878SJulian Pullen * that error.
2326479ac375Sdm199847 */
2327e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
2328e8c27ec8Sbaban res->retcode = retcode;
2329e8c27ec8Sbaban continue;
2330e8c27ec8Sbaban }
2331e8c27ec8Sbaban
233248258c6bSjp151216 if (res->retcode == IDMAP_ERR_NOTFOUND) {
233348258c6bSjp151216 /* Nothing found - remove the preset info */
2334148c5f43SAlan Wright idmap_how_clear(&res->info.how);
233548258c6bSjp151216 }
233648258c6bSjp151216
2337148c5f43SAlan Wright if (IS_ID_SID(req->id1)) {
2338cb174861Sjoyce mcintosh if (res->retcode == IDMAP_ERR_NOTFOUND) {
2339cb174861Sjoyce mcintosh TRACE(req, res, "Not found in AD");
2340e8c27ec8Sbaban continue;
2341cb174861Sjoyce mcintosh }
2342cb174861Sjoyce mcintosh if (res->retcode != IDMAP_SUCCESS) {
2343cb174861Sjoyce mcintosh TRACE(req, res, "AD lookup error=%d",
2344cb174861Sjoyce mcintosh res->retcode);
2345cb174861Sjoyce mcintosh continue;
2346cb174861Sjoyce mcintosh }
2347479ac375Sdm199847 /* Evaluate result type */
2348e8c27ec8Sbaban switch (type) {
2349148c5f43SAlan Wright case IDMAP_USID:
2350e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID)
2351e8c27ec8Sbaban res->id.idtype = IDMAP_UID;
2352e3f2c991SKeyur Desai /*
2353e3f2c991SKeyur Desai * We found a user. If we got information
2354e3f2c991SKeyur Desai * from IDMU and we were expecting a user,
2355e3f2c991SKeyur Desai * copy the id.
2356e3f2c991SKeyur Desai */
23579fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (posix_id != IDMAP_SENTINEL_PID &&
2358e3f2c991SKeyur Desai res->id.idtype == IDMAP_UID) {
2359e3f2c991SKeyur Desai res->id.idmap_id_u.uid = posix_id;
2360e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI;
2361e3f2c991SKeyur Desai res->info.how.map_type =
2362e3f2c991SKeyur Desai IDMAP_MAP_TYPE_IDMU;
2363e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW;
2364e3f2c991SKeyur Desai }
2365e8c27ec8Sbaban req->id1.idtype = IDMAP_USID;
2366e8c27ec8Sbaban break;
23674d61c878SJulian Pullen
2368148c5f43SAlan Wright case IDMAP_GSID:
2369e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID)
2370e8c27ec8Sbaban res->id.idtype = IDMAP_GID;
2371e3f2c991SKeyur Desai /*
2372e3f2c991SKeyur Desai * We found a group. If we got information
2373e3f2c991SKeyur Desai * from IDMU and we were expecting a group,
2374e3f2c991SKeyur Desai * copy the id.
2375e3f2c991SKeyur Desai */
23769fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (posix_id != IDMAP_SENTINEL_PID &&
2377e3f2c991SKeyur Desai res->id.idtype == IDMAP_GID) {
2378e3f2c991SKeyur Desai res->id.idmap_id_u.gid = posix_id;
2379e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI;
2380e3f2c991SKeyur Desai res->info.how.map_type =
2381e3f2c991SKeyur Desai IDMAP_MAP_TYPE_IDMU;
2382e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW;
2383e3f2c991SKeyur Desai }
2384e8c27ec8Sbaban req->id1.idtype = IDMAP_GSID;
2385e8c27ec8Sbaban break;
23864d61c878SJulian Pullen
2387e8c27ec8Sbaban default:
2388e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID;
2389e8c27ec8Sbaban break;
2390e8c27ec8Sbaban }
2391cb174861Sjoyce mcintosh TRACE(req, res, "Found in AD");
2392479ac375Sdm199847 if (res->retcode == IDMAP_SUCCESS &&
2393479ac375Sdm199847 req->id1name != NULL &&
2394479ac375Sdm199847 (req->id2name == NULL ||
23959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID) &&
2396479ac375Sdm199847 NLDAP_MODE(res->id.idtype, state)) {
2397479ac375Sdm199847 req->direction |= _IDMAP_F_LOOKUP_NLDAP;
2398479ac375Sdm199847 state->nldap_nqueries++;
2399479ac375Sdm199847 }
2400148c5f43SAlan Wright } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) {
2401e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) {
2402e8c27ec8Sbaban if ((!(IDMAP_FATAL_ERROR(res->retcode))) &&
2403e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix == NULL &&
2404cb174861Sjoyce mcintosh req->id2name == NULL) {
2405e8c27ec8Sbaban /*
2406e3f2c991SKeyur Desai * If AD lookup by unixname or pid
24074d61c878SJulian Pullen * failed with non fatal error
24084d61c878SJulian Pullen * then clear the error (ie set
24094d61c878SJulian Pullen * res->retcode to success).
24104d61c878SJulian Pullen * This allows the next pass to
24114d61c878SJulian Pullen * process other mapping
2412479ac375Sdm199847 * mechanisms for this request.
2413e8c27ec8Sbaban */
2414cb174861Sjoyce mcintosh if (res->retcode ==
2415cb174861Sjoyce mcintosh IDMAP_ERR_NOTFOUND) {
2416cb174861Sjoyce mcintosh /* This is not an error */
2417e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS;
2418cb174861Sjoyce mcintosh TRACE(req, res,
2419cb174861Sjoyce mcintosh "Not found in AD");
2420cb174861Sjoyce mcintosh } else {
2421cb174861Sjoyce mcintosh TRACE(req, res,
2422cb174861Sjoyce mcintosh "AD lookup error (ignored)");
2423cb174861Sjoyce mcintosh res->retcode = IDMAP_SUCCESS;
2424cb174861Sjoyce mcintosh }
2425cb174861Sjoyce mcintosh } else {
2426cb174861Sjoyce mcintosh TRACE(req, res, "AD lookup error");
2427cb174861Sjoyce mcintosh }
2428e8c27ec8Sbaban continue;
2429e8c27ec8Sbaban }
2430479ac375Sdm199847 /* Evaluate result type */
2431e8c27ec8Sbaban switch (type) {
2432148c5f43SAlan Wright case IDMAP_USID:
2433148c5f43SAlan Wright case IDMAP_GSID:
2434e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID)
2435148c5f43SAlan Wright res->id.idtype = type;
2436e8c27ec8Sbaban break;
24374d61c878SJulian Pullen
2438e8c27ec8Sbaban default:
2439e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID;
2440e8c27ec8Sbaban break;
2441e8c27ec8Sbaban }
2442cb174861Sjoyce mcintosh TRACE(req, res, "Found in AD");
2443e8c27ec8Sbaban }
2444e8c27ec8Sbaban }
2445e8c27ec8Sbaban
24464d61c878SJulian Pullen return (retcode);
24474d61c878SJulian Pullen }
24484d61c878SJulian Pullen
24494d61c878SJulian Pullen
24504d61c878SJulian Pullen
24514d61c878SJulian Pullen /*
24524d61c878SJulian Pullen * Batch AD lookups
24534d61c878SJulian Pullen */
24544d61c878SJulian Pullen idmap_retcode
ad_lookup_batch(lookup_state_t * state,idmap_mapping_batch * batch,idmap_ids_res * result)24554d61c878SJulian Pullen ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch,
24564d61c878SJulian Pullen idmap_ids_res *result)
24574d61c878SJulian Pullen {
24584d61c878SJulian Pullen idmap_retcode retcode;
24594d61c878SJulian Pullen int i, j;
24604d61c878SJulian Pullen idmap_mapping *req;
24614d61c878SJulian Pullen idmap_id_res *res;
24624d61c878SJulian Pullen int num_queries;
24634d61c878SJulian Pullen int num_processed;
24644d61c878SJulian Pullen
24654d61c878SJulian Pullen if (state->ad_nqueries == 0)
24664d61c878SJulian Pullen return (IDMAP_SUCCESS);
24674d61c878SJulian Pullen
24684d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
24694d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i];
24704d61c878SJulian Pullen res = &result->ids.ids_val[i];
24714d61c878SJulian Pullen
24724d61c878SJulian Pullen /* Skip if not marked for AD lookup or already in error. */
24734d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD) ||
24744d61c878SJulian Pullen res->retcode != IDMAP_SUCCESS)
24754d61c878SJulian Pullen continue;
24764d61c878SJulian Pullen
24774d61c878SJulian Pullen /* Init status */
24784d61c878SJulian Pullen res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR;
24794d61c878SJulian Pullen }
24804d61c878SJulian Pullen
24814d61c878SJulian Pullen RDLOCK_CONFIG();
24824d61c878SJulian Pullen num_queries = state->ad_nqueries;
24834d61c878SJulian Pullen
2484e3f2c991SKeyur Desai if (_idmapdstate.num_gcs == 0 && _idmapdstate.num_dcs == 0) {
24854d61c878SJulian Pullen /* Case of no ADs */
24864d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
24874d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
24884d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i];
24894d61c878SJulian Pullen res = &result->ids.ids_val[i];
24904d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD))
24914d61c878SJulian Pullen continue;
24924d61c878SJulian Pullen req->direction &= ~(_IDMAP_F_LOOKUP_AD);
24934d61c878SJulian Pullen res->retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
24944d61c878SJulian Pullen }
2495e3f2c991SKeyur Desai goto out;
24964d61c878SJulian Pullen }
2497e3f2c991SKeyur Desai
2498e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) {
2499e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_dcs && num_queries > 0; i++) {
2500e3f2c991SKeyur Desai
2501e3f2c991SKeyur Desai retcode = ad_lookup_batch_int(state, batch,
2502e3f2c991SKeyur Desai result, _idmapdstate.dcs[i],
2503e3f2c991SKeyur Desai i == 0 ? DOMAIN_IS_LOCAL|FOREST_IS_LOCAL : 0,
2504e3f2c991SKeyur Desai &num_processed);
2505e3f2c991SKeyur Desai num_queries -= num_processed;
2506e3f2c991SKeyur Desai
2507e3f2c991SKeyur Desai }
2508e3f2c991SKeyur Desai }
2509e3f2c991SKeyur Desai
2510e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_gcs && num_queries > 0; i++) {
2511e3f2c991SKeyur Desai
2512e3f2c991SKeyur Desai retcode = ad_lookup_batch_int(state, batch, result,
2513e3f2c991SKeyur Desai _idmapdstate.gcs[i],
2514e3f2c991SKeyur Desai i == 0 ? FOREST_IS_LOCAL : 0,
2515e3f2c991SKeyur Desai &num_processed);
2516e3f2c991SKeyur Desai num_queries -= num_processed;
2517e3f2c991SKeyur Desai
2518e3f2c991SKeyur Desai }
2519e3f2c991SKeyur Desai
2520e3f2c991SKeyur Desai /*
2521e3f2c991SKeyur Desai * There are no more ADs to try. Return errors for any
2522e3f2c991SKeyur Desai * remaining requests.
2523e3f2c991SKeyur Desai */
2524e3f2c991SKeyur Desai if (num_queries > 0) {
2525e3f2c991SKeyur Desai for (j = 0; j < batch->idmap_mapping_batch_len; j++) {
2526e3f2c991SKeyur Desai req = &batch->idmap_mapping_batch_val[j];
2527e3f2c991SKeyur Desai res = &result->ids.ids_val[j];
2528e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD))
2529e3f2c991SKeyur Desai continue;
2530e3f2c991SKeyur Desai req->direction &= ~(_IDMAP_F_LOOKUP_AD);
2531e3f2c991SKeyur Desai res->retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
2532e3f2c991SKeyur Desai }
2533e3f2c991SKeyur Desai }
2534e3f2c991SKeyur Desai
2535e3f2c991SKeyur Desai out:
25364d61c878SJulian Pullen UNLOCK_CONFIG();
25374d61c878SJulian Pullen
2538e8c27ec8Sbaban /* AD lookups done. Reset state->ad_nqueries and return */
2539e8c27ec8Sbaban state->ad_nqueries = 0;
2540c5c4113dSnw141292 return (retcode);
2541c5c4113dSnw141292 }
2542c5c4113dSnw141292
2543cd37da74Snw141292 /*
2544cd37da74Snw141292 * Convention when processing win2unix requests:
2545cd37da74Snw141292 *
2546cd37da74Snw141292 * Windows identity:
2547cd37da74Snw141292 * req->id1name =
2548cd37da74Snw141292 * winname if given otherwise winname found will be placed
2549cd37da74Snw141292 * here.
2550cd37da74Snw141292 * req->id1domain =
2551cd37da74Snw141292 * windomain if given otherwise windomain found will be
2552cd37da74Snw141292 * placed here.
2553cd37da74Snw141292 * req->id1.idtype =
2554cd37da74Snw141292 * Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll
2555cd37da74Snw141292 * be set to IDMAP_USID/GSID depending upon whether the
2556cd37da74Snw141292 * given SID is user or group respectively. The user/group-ness
2557cd37da74Snw141292 * is determined either when looking up well-known SIDs table OR
2558fe1c642dSBill Krier * if the SID is found in namecache OR by ad_lookup_batch().
2559cd37da74Snw141292 * req->id1..sid.[prefix, rid] =
2560cd37da74Snw141292 * SID if given otherwise SID found will be placed here.
2561cd37da74Snw141292 *
2562cd37da74Snw141292 * Unix identity:
2563cd37da74Snw141292 * req->id2name =
2564cd37da74Snw141292 * unixname found will be placed here.
2565cd37da74Snw141292 * req->id2domain =
2566cd37da74Snw141292 * NOT USED
2567cd37da74Snw141292 * res->id.idtype =
2568cd37da74Snw141292 * Target type initialized from req->id2.idtype. If
2569cd37da74Snw141292 * it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found
2570cd37da74Snw141292 * will be placed here.
2571cd37da74Snw141292 * res->id..[uid or gid] =
2572cd37da74Snw141292 * UID/GID found will be placed here.
2573cd37da74Snw141292 *
2574cd37da74Snw141292 * Others:
2575cd37da74Snw141292 * res->retcode =
2576cd37da74Snw141292 * Return status for this request will be placed here.
2577cd37da74Snw141292 * res->direction =
2578cd37da74Snw141292 * Direction found will be placed here. Direction
2579cd37da74Snw141292 * meaning whether the resultant mapping is valid
2580cd37da74Snw141292 * only from win2unix or bi-directional.
2581cd37da74Snw141292 * req->direction =
2582cd37da74Snw141292 * INTERNAL USE. Used by idmapd to set various
2583cd37da74Snw141292 * flags (_IDMAP_F_xxxx) to aid in processing
2584cd37da74Snw141292 * of the request.
2585cd37da74Snw141292 * req->id2.idtype =
2586cd37da74Snw141292 * INTERNAL USE. Initially this is the requested target
2587cd37da74Snw141292 * type and is used to initialize res->id.idtype.
2588cd37da74Snw141292 * ad_lookup_batch() uses this field temporarily to store
2589cd37da74Snw141292 * sid_type obtained by the batched AD lookups and after
2590cd37da74Snw141292 * use resets it to IDMAP_NONE to prevent xdr from
2591cd37da74Snw141292 * mis-interpreting the contents of req->id2.
2592e3f2c991SKeyur Desai * req->id2.idmap_id_u.uid =
2593e3f2c991SKeyur Desai * INTERNAL USE. If the AD lookup finds IDMU data
2594e3f2c991SKeyur Desai * (uidNumber or gidNumber, depending on the type of
2595e3f2c991SKeyur Desai * the entry), it's left here.
2596cd37da74Snw141292 */
2597cd37da74Snw141292
2598cd37da74Snw141292 /*
2599cd37da74Snw141292 * This function does the following:
2600cd37da74Snw141292 * 1. Lookup well-known SIDs table.
2601cd37da74Snw141292 * 2. Check if the given SID is a local-SID and if so extract UID/GID from it.
2602cd37da74Snw141292 * 3. Lookup cache.
2603cd37da74Snw141292 * 4. Check if the client does not want new mapping to be allocated
2604cd37da74Snw141292 * in which case this pass is the final pass.
2605cd37da74Snw141292 * 5. Set AD lookup flag if it determines that the next stage needs
2606cd37da74Snw141292 * to do AD lookup.
2607cd37da74Snw141292 */
2608c5c4113dSnw141292 idmap_retcode
sid2pid_first_pass(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)2609479ac375Sdm199847 sid2pid_first_pass(lookup_state_t *state, idmap_mapping *req,
2610cd37da74Snw141292 idmap_id_res *res)
2611cd37da74Snw141292 {
2612c5c4113dSnw141292 idmap_retcode retcode;
2613e8c27ec8Sbaban int wksid;
2614c5c4113dSnw141292
2615e8c27ec8Sbaban /* Initialize result */
2616e8c27ec8Sbaban res->id.idtype = req->id2.idtype;
26179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = IDMAP_SENTINEL_PID;
2618e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF;
2619e8c27ec8Sbaban wksid = 0;
2620c5c4113dSnw141292
2621cf5b5989Sdm199847 if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) {
2622fe1c642dSBill Krier /* They have to give us *something* to work with! */
2623e8c27ec8Sbaban if (req->id1name == NULL) {
2624e8c27ec8Sbaban retcode = IDMAP_ERR_ARG;
2625c5c4113dSnw141292 goto out;
2626c5c4113dSnw141292 }
2627fe1c642dSBill Krier
2628e8c27ec8Sbaban /* sanitize sidprefix */
2629e8c27ec8Sbaban free(req->id1.idmap_id_u.sid.prefix);
2630e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = NULL;
2631fe1c642dSBill Krier
2632fe1c642dSBill Krier /* Allow for a fully-qualified name in the "name" parameter */
2633fe1c642dSBill Krier if (req->id1domain == NULL) {
2634fe1c642dSBill Krier char *p;
2635fe1c642dSBill Krier p = strchr(req->id1name, '@');
2636fe1c642dSBill Krier if (p != NULL) {
2637fe1c642dSBill Krier char *q;
2638fe1c642dSBill Krier q = req->id1name;
2639cb174861Sjoyce mcintosh req->id1name = uu_strndup(q, p - req->id1name);
2640fe1c642dSBill Krier req->id1domain = strdup(p+1);
2641fe1c642dSBill Krier free(q);
2642fe1c642dSBill Krier if (req->id1name == NULL ||
2643fe1c642dSBill Krier req->id1domain == NULL) {
2644fe1c642dSBill Krier retcode = IDMAP_ERR_MEMORY;
2645fe1c642dSBill Krier goto out;
2646fe1c642dSBill Krier }
2647fe1c642dSBill Krier }
2648fe1c642dSBill Krier }
2649e8c27ec8Sbaban }
2650c5c4113dSnw141292
2651e8c27ec8Sbaban /* Lookup well-known SIDs table */
2652e8c27ec8Sbaban retcode = lookup_wksids_sid2pid(req, res, &wksid);
2653148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2654148c5f43SAlan Wright /* Found a well-known account with a hardwired mapping */
2655148c5f43SAlan Wright TRACE(req, res, "Hardwired mapping");
2656c5c4113dSnw141292 goto out;
2657148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
2658148c5f43SAlan Wright TRACE(req, res,
2659148c5f43SAlan Wright "Well-known account lookup failed, code %d", retcode);
2660148c5f43SAlan Wright goto out;
2661148c5f43SAlan Wright }
2662c5c4113dSnw141292
2663148c5f43SAlan Wright if (wksid) {
2664148c5f43SAlan Wright /* Found a well-known account, but no mapping */
2665148c5f43SAlan Wright TRACE(req, res, "Well-known account");
2666148c5f43SAlan Wright } else {
2667148c5f43SAlan Wright TRACE(req, res, "Not a well-known account");
2668148c5f43SAlan Wright
26692b4a7802SBaban Kenkre /* Check if this is a localsid */
2670e8c27ec8Sbaban retcode = lookup_localsid2pid(req, res);
2671148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2672148c5f43SAlan Wright TRACE(req, res, "Local SID");
2673e8c27ec8Sbaban goto out;
2674148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
2675148c5f43SAlan Wright TRACE(req, res,
2676148c5f43SAlan Wright "Local SID lookup error=%d", retcode);
2677148c5f43SAlan Wright goto out;
2678148c5f43SAlan Wright }
2679148c5f43SAlan Wright TRACE(req, res, "Not a local SID");
26802b4a7802SBaban Kenkre
26812b4a7802SBaban Kenkre if (ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)) {
26824d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED;
26832b4a7802SBaban Kenkre goto out;
26842b4a7802SBaban Kenkre }
2685e8c27ec8Sbaban }
2686e8c27ec8Sbaban
2687fe1c642dSBill Krier /*
2688fe1c642dSBill Krier * If this is a name-based request and we don't have a domain,
2689fe1c642dSBill Krier * use the default domain. Note that the well-known identity
2690fe1c642dSBill Krier * cases will have supplied a SID prefix already, and that we
2691fe1c642dSBill Krier * don't (yet?) support looking up a local user through a Windows
2692fe1c642dSBill Krier * style name.
2693fe1c642dSBill Krier */
2694fe1c642dSBill Krier if (req->id1.idmap_id_u.sid.prefix == NULL &&
2695fe1c642dSBill Krier req->id1name != NULL && req->id1domain == NULL) {
2696fe1c642dSBill Krier if (state->defdom == NULL) {
2697fe1c642dSBill Krier retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
2698fe1c642dSBill Krier goto out;
2699fe1c642dSBill Krier }
2700fe1c642dSBill Krier req->id1domain = strdup(state->defdom);
2701fe1c642dSBill Krier if (req->id1domain == NULL) {
2702fe1c642dSBill Krier retcode = IDMAP_ERR_MEMORY;
2703fe1c642dSBill Krier goto out;
2704fe1c642dSBill Krier }
2705148c5f43SAlan Wright TRACE(req, res, "Added default domain");
2706fe1c642dSBill Krier }
2707fe1c642dSBill Krier
2708e8c27ec8Sbaban /* Lookup cache */
2709479ac375Sdm199847 retcode = lookup_cache_sid2pid(state->cache, req, res);
2710148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2711148c5f43SAlan Wright TRACE(req, res, "Found in mapping cache");
2712c5c4113dSnw141292 goto out;
2713148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
2714148c5f43SAlan Wright TRACE(req, res, "Mapping cache lookup error=%d", retcode);
2715148c5f43SAlan Wright goto out;
2716148c5f43SAlan Wright }
2717148c5f43SAlan Wright TRACE(req, res, "Not found in mapping cache");
2718c5c4113dSnw141292
2719c5c4113dSnw141292 if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) {
27204d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED;
2721c5c4113dSnw141292 goto out;
2722c5c4113dSnw141292 }
2723c5c4113dSnw141292
2724c5c4113dSnw141292 /*
2725e8c27ec8Sbaban * Failed to find non-expired entry in cache. Next step is
2726e8c27ec8Sbaban * to determine if this request needs to be batched for AD lookup.
2727e8c27ec8Sbaban *
2728e8c27ec8Sbaban * At this point we have either sid or winname or both. If we don't
2729e8c27ec8Sbaban * have both then lookup name_cache for the sid or winname
2730e8c27ec8Sbaban * whichever is missing. If not found then this request will be
2731e8c27ec8Sbaban * batched for AD lookup.
2732e8c27ec8Sbaban */
2733479ac375Sdm199847 retcode = lookup_name_cache(state->cache, req, res);
2734148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2735148c5f43SAlan Wright if (res->id.idtype == IDMAP_POSIXID) {
2736148c5f43SAlan Wright if (req->id1.idtype == IDMAP_USID)
2737148c5f43SAlan Wright res->id.idtype = IDMAP_UID;
2738148c5f43SAlan Wright else
2739148c5f43SAlan Wright res->id.idtype = IDMAP_GID;
2740148c5f43SAlan Wright }
2741148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND)
2742e8c27ec8Sbaban goto out;
2743e8c27ec8Sbaban
2744148c5f43SAlan Wright if (_idmapdstate.cfg->pgcfg.use_lsa &&
2745148c5f43SAlan Wright _idmapdstate.cfg->pgcfg.domain_name != NULL) {
2746148c5f43SAlan Wright /*
2747148c5f43SAlan Wright * If we don't have both name and SID, try looking up the
2748148c5f43SAlan Wright * entry with LSA.
2749148c5f43SAlan Wright */
2750148c5f43SAlan Wright if (req->id1.idmap_id_u.sid.prefix != NULL &&
2751148c5f43SAlan Wright req->id1name == NULL) {
2752148c5f43SAlan Wright
2753148c5f43SAlan Wright retcode = lookup_lsa_by_sid(
2754148c5f43SAlan Wright req->id1.idmap_id_u.sid.prefix,
2755148c5f43SAlan Wright req->id1.idmap_id_u.sid.rid,
2756148c5f43SAlan Wright &req->id1name, &req->id1domain, &req->id1.idtype);
2757148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2758148c5f43SAlan Wright TRACE(req, res, "Found with LSA");
2759148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) {
2760148c5f43SAlan Wright TRACE(req, res, "Not found with LSA");
2761148c5f43SAlan Wright } else {
2762148c5f43SAlan Wright TRACE(req, res, "LSA error %d", retcode);
2763148c5f43SAlan Wright goto out;
2764148c5f43SAlan Wright }
2765148c5f43SAlan Wright
2766148c5f43SAlan Wright } else if (req->id1name != NULL &&
2767148c5f43SAlan Wright req->id1.idmap_id_u.sid.prefix == NULL) {
2768148c5f43SAlan Wright char *canonname;
2769148c5f43SAlan Wright char *canondomain;
2770148c5f43SAlan Wright
2771148c5f43SAlan Wright retcode = lookup_lsa_by_name(
2772148c5f43SAlan Wright req->id1name, req->id1domain,
2773148c5f43SAlan Wright &req->id1.idmap_id_u.sid.prefix,
2774148c5f43SAlan Wright &req->id1.idmap_id_u.sid.rid,
2775148c5f43SAlan Wright &canonname, &canondomain,
2776148c5f43SAlan Wright &req->id1.idtype);
2777148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2778148c5f43SAlan Wright free(req->id1name);
2779148c5f43SAlan Wright req->id1name = canonname;
2780148c5f43SAlan Wright free(req->id1domain);
2781148c5f43SAlan Wright req->id1domain = canondomain;
2782148c5f43SAlan Wright TRACE(req, res, "Found with LSA");
2783148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) {
2784148c5f43SAlan Wright TRACE(req, res, "Not found with LSA");
2785148c5f43SAlan Wright } else {
2786148c5f43SAlan Wright TRACE(req, res, "LSA error %d", retcode);
2787148c5f43SAlan Wright goto out;
2788148c5f43SAlan Wright }
2789148c5f43SAlan Wright }
2790148c5f43SAlan Wright }
2791148c5f43SAlan Wright
2792e8c27ec8Sbaban /*
2793e8c27ec8Sbaban * Set the flag to indicate that we are not done yet so that
2794e8c27ec8Sbaban * subsequent passes considers this request for name-based
2795e8c27ec8Sbaban * mapping and ephemeral mapping.
2796c5c4113dSnw141292 */
2797c5c4113dSnw141292 state->sid2pid_done = FALSE;
2798e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE;
2799c5c4113dSnw141292
2800c5c4113dSnw141292 /*
2801e8c27ec8Sbaban * Even if we have both sid and winname, we still may need to batch
2802e8c27ec8Sbaban * this request for AD lookup if we don't have unixname and
2803e8c27ec8Sbaban * directory-based name mapping (AD or mixed) is enabled.
2804e8c27ec8Sbaban * We avoid AD lookup for well-known SIDs because they don't have
2805e8c27ec8Sbaban * regular AD objects.
2806c5c4113dSnw141292 */
2807e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS ||
2808e8c27ec8Sbaban (!wksid && req->id2name == NULL &&
2809e3f2c991SKeyur Desai AD_OR_MIXED_MODE(res->id.idtype, state)) ||
28109fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States (!wksid && res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID &&
2811e3f2c991SKeyur Desai state->directory_based_mapping == DIRECTORY_MAPPING_IDMU)) {
2812c5c4113dSnw141292 retcode = IDMAP_SUCCESS;
2813e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD;
2814c5c4113dSnw141292 state->ad_nqueries++;
2815479ac375Sdm199847 } else if (NLDAP_MODE(res->id.idtype, state)) {
2816479ac375Sdm199847 req->direction |= _IDMAP_F_LOOKUP_NLDAP;
2817479ac375Sdm199847 state->nldap_nqueries++;
2818c5c4113dSnw141292 }
2819c5c4113dSnw141292
2820c5c4113dSnw141292
2821c5c4113dSnw141292 out:
2822c5c4113dSnw141292 res->retcode = idmap_stat4prot(retcode);
2823e8c27ec8Sbaban /*
2824e8c27ec8Sbaban * If we are done and there was an error then set fallback pid
2825e8c27ec8Sbaban * in the result.
2826e8c27ec8Sbaban */
2827e8c27ec8Sbaban if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS)
2828e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY;
2829c5c4113dSnw141292 return (retcode);
2830c5c4113dSnw141292 }
2831c5c4113dSnw141292
2832c5c4113dSnw141292 /*
2833c5c4113dSnw141292 * Generate SID using the following convention
2834c5c4113dSnw141292 * <machine-sid-prefix>-<1000 + uid>
2835c5c4113dSnw141292 * <machine-sid-prefix>-<2^31 + gid>
2836c5c4113dSnw141292 */
2837cd37da74Snw141292 static
2838cd37da74Snw141292 idmap_retcode
generate_localsid(idmap_mapping * req,idmap_id_res * res,int is_user,int fallback)283948258c6bSjp151216 generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user,
284048258c6bSjp151216 int fallback)
2841cd37da74Snw141292 {
2842e8c27ec8Sbaban free(res->id.idmap_id_u.sid.prefix);
2843e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = NULL;
2844e8c27ec8Sbaban
2845e8c27ec8Sbaban /*
2846e8c27ec8Sbaban * Diagonal mapping for localSIDs not supported because of the
2847e8c27ec8Sbaban * way we generate localSIDs.
2848e8c27ec8Sbaban */
2849e8c27ec8Sbaban if (is_user && res->id.idtype == IDMAP_GSID)
2850a0aa776eSAlan Wright return (IDMAP_ERR_NOTGROUP);
2851e8c27ec8Sbaban if (!is_user && res->id.idtype == IDMAP_USID)
2852a0aa776eSAlan Wright return (IDMAP_ERR_NOTUSER);
2853e8c27ec8Sbaban
2854c5c4113dSnw141292 /* Skip 1000 UIDs */
28551fcced4cSJordan Brown if (is_user &&
28561fcced4cSJordan Brown req->id1.idmap_id_u.uid + LOCALRID_UID_MIN > LOCALRID_UID_MAX)
285762c60062Sbaban return (IDMAP_ERR_NOMAPPING);
2858c5c4113dSnw141292
2859c5c4113dSnw141292 RDLOCK_CONFIG();
2860e8c27ec8Sbaban /*
2861e8c27ec8Sbaban * machine_sid is never NULL because if it is we won't be here.
2862148c5f43SAlan Wright * No need to assert because strdup(NULL) will core anyways.
2863e8c27ec8Sbaban */
2864c5c4113dSnw141292 res->id.idmap_id_u.sid.prefix =
2865c5c4113dSnw141292 strdup(_idmapdstate.cfg->pgcfg.machine_sid);
2866c5c4113dSnw141292 if (res->id.idmap_id_u.sid.prefix == NULL) {
2867c5c4113dSnw141292 UNLOCK_CONFIG();
2868c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
2869c5c4113dSnw141292 return (IDMAP_ERR_MEMORY);
2870c5c4113dSnw141292 }
2871c5c4113dSnw141292 UNLOCK_CONFIG();
2872c5c4113dSnw141292 res->id.idmap_id_u.sid.rid =
28731fcced4cSJordan Brown (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_UID_MIN :
28741fcced4cSJordan Brown req->id1.idmap_id_u.gid + LOCALRID_GID_MIN;
2875651c0131Sbaban res->direction = IDMAP_DIRECTION_BI;
2876e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID)
2877e8c27ec8Sbaban res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
2878c5c4113dSnw141292
2879fc724630SAlan Wright if (!fallback) {
288048258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID;
288148258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_ALGORITHMIC;
288248258c6bSjp151216 }
288348258c6bSjp151216
2884c5c4113dSnw141292 /*
2885c5c4113dSnw141292 * Don't update name_cache because local sids don't have
2886c5c4113dSnw141292 * valid windows names.
2887c5c4113dSnw141292 */
2888e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
2889947c7bc0Sbaban return (IDMAP_SUCCESS);
2890c5c4113dSnw141292 }
2891c5c4113dSnw141292
2892cd37da74Snw141292 static
2893cd37da74Snw141292 idmap_retcode
lookup_localsid2pid(idmap_mapping * req,idmap_id_res * res)2894cd37da74Snw141292 lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res)
2895cd37da74Snw141292 {
2896c5c4113dSnw141292 char *sidprefix;
2897c5c4113dSnw141292 uint32_t rid;
2898c5c4113dSnw141292 int s;
2899c5c4113dSnw141292
2900c5c4113dSnw141292 /*
2901c5c4113dSnw141292 * If the sidprefix == localsid then UID = last RID - 1000 or
2902c5c4113dSnw141292 * GID = last RID - 2^31.
2903c5c4113dSnw141292 */
2904e8c27ec8Sbaban if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL)
2905e8c27ec8Sbaban /* This means we are looking up by winname */
2906e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
2907c5c4113dSnw141292 rid = req->id1.idmap_id_u.sid.rid;
2908c5c4113dSnw141292
2909c5c4113dSnw141292 RDLOCK_CONFIG();
2910c5c4113dSnw141292 s = (_idmapdstate.cfg->pgcfg.machine_sid) ?
2911cd37da74Snw141292 strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1;
2912c5c4113dSnw141292 UNLOCK_CONFIG();
2913c5c4113dSnw141292
2914e8c27ec8Sbaban /*
2915e8c27ec8Sbaban * If the given sidprefix does not match machine_sid then this is
2916e8c27ec8Sbaban * not a local SID.
2917e8c27ec8Sbaban */
2918e8c27ec8Sbaban if (s != 0)
2919e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
2920e8c27ec8Sbaban
2921e8c27ec8Sbaban switch (res->id.idtype) {
2922c5c4113dSnw141292 case IDMAP_UID:
29231fcced4cSJordan Brown if (rid < LOCALRID_UID_MIN || rid > LOCALRID_UID_MAX)
2924e8c27ec8Sbaban return (IDMAP_ERR_ARG);
29251fcced4cSJordan Brown res->id.idmap_id_u.uid = rid - LOCALRID_UID_MIN;
2926c5c4113dSnw141292 break;
2927c5c4113dSnw141292 case IDMAP_GID:
29281fcced4cSJordan Brown if (rid < LOCALRID_GID_MIN)
2929e8c27ec8Sbaban return (IDMAP_ERR_ARG);
29301fcced4cSJordan Brown res->id.idmap_id_u.gid = rid - LOCALRID_GID_MIN;
2931c5c4113dSnw141292 break;
2932c5c4113dSnw141292 case IDMAP_POSIXID:
29331fcced4cSJordan Brown if (rid >= LOCALRID_GID_MIN) {
29341fcced4cSJordan Brown res->id.idmap_id_u.gid = rid - LOCALRID_GID_MIN;
2935c5c4113dSnw141292 res->id.idtype = IDMAP_GID;
29361fcced4cSJordan Brown } else if (rid >= LOCALRID_UID_MIN) {
29371fcced4cSJordan Brown res->id.idmap_id_u.uid = rid - LOCALRID_UID_MIN;
2938c5c4113dSnw141292 res->id.idtype = IDMAP_UID;
29391fcced4cSJordan Brown } else {
29401fcced4cSJordan Brown return (IDMAP_ERR_ARG);
2941c5c4113dSnw141292 }
2942c5c4113dSnw141292 break;
2943c5c4113dSnw141292 default:
2944c5c4113dSnw141292 return (IDMAP_ERR_NOTSUPPORTED);
2945c5c4113dSnw141292 }
294648258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID;
294748258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_ALGORITHMIC;
2948c5c4113dSnw141292 return (IDMAP_SUCCESS);
2949c5c4113dSnw141292 }
2950c5c4113dSnw141292
2951e8c27ec8Sbaban /*
2952e8c27ec8Sbaban * Name service lookup by unixname to get pid
2953e8c27ec8Sbaban */
2954cd37da74Snw141292 static
2955cd37da74Snw141292 idmap_retcode
ns_lookup_byname(const char * name,const char * lower_name,idmap_id * id)2956e8c27ec8Sbaban ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id)
2957cd37da74Snw141292 {
2958cd37da74Snw141292 struct passwd pwd, *pwdp;
2959cd37da74Snw141292 struct group grp, *grpp;
29608c155366SJordan Brown char *buf;
29618c155366SJordan Brown static size_t pwdbufsiz = 0;
29628c155366SJordan Brown static size_t grpbufsiz = 0;
2963c5c4113dSnw141292
2964e8c27ec8Sbaban switch (id->idtype) {
2965e8c27ec8Sbaban case IDMAP_UID:
29668c155366SJordan Brown if (pwdbufsiz == 0)
29678c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX);
29688c155366SJordan Brown buf = alloca(pwdbufsiz);
29698c155366SJordan Brown pwdp = getpwnam_r(name, &pwd, buf, pwdbufsiz);
2970e8c27ec8Sbaban if (pwdp == NULL && errno == 0 && lower_name != NULL &&
2971cd37da74Snw141292 name != lower_name && strcmp(name, lower_name) != 0)
29728c155366SJordan Brown pwdp = getpwnam_r(lower_name, &pwd, buf, pwdbufsiz);
2973cd37da74Snw141292 if (pwdp == NULL) {
2974bbf6f00cSJordan Brown if (errno == 0)
2975c5c4113dSnw141292 return (IDMAP_ERR_NOTFOUND);
2976c5c4113dSnw141292 else
2977c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL);
2978c5c4113dSnw141292 }
2979e8c27ec8Sbaban id->idmap_id_u.uid = pwd.pw_uid;
2980e8c27ec8Sbaban break;
2981e8c27ec8Sbaban case IDMAP_GID:
29828c155366SJordan Brown if (grpbufsiz == 0)
29838c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX);
29848c155366SJordan Brown buf = alloca(grpbufsiz);
29858c155366SJordan Brown grpp = getgrnam_r(name, &grp, buf, grpbufsiz);
2986e8c27ec8Sbaban if (grpp == NULL && errno == 0 && lower_name != NULL &&
2987cd37da74Snw141292 name != lower_name && strcmp(name, lower_name) != 0)
29888c155366SJordan Brown grpp = getgrnam_r(lower_name, &grp, buf, grpbufsiz);
2989cd37da74Snw141292 if (grpp == NULL) {
2990bbf6f00cSJordan Brown if (errno == 0)
2991c5c4113dSnw141292 return (IDMAP_ERR_NOTFOUND);
2992c5c4113dSnw141292 else
2993c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL);
2994c5c4113dSnw141292 }
2995e8c27ec8Sbaban id->idmap_id_u.gid = grp.gr_gid;
2996e8c27ec8Sbaban break;
2997e8c27ec8Sbaban default:
2998e8c27ec8Sbaban return (IDMAP_ERR_ARG);
2999c5c4113dSnw141292 }
3000c5c4113dSnw141292 return (IDMAP_SUCCESS);
3001c5c4113dSnw141292 }
3002c5c4113dSnw141292
3003e8c27ec8Sbaban
3004e8c27ec8Sbaban /*
3005e8c27ec8Sbaban * Name service lookup by pid to get unixname
3006e8c27ec8Sbaban */
3007e8c27ec8Sbaban static
3008e8c27ec8Sbaban idmap_retcode
ns_lookup_bypid(uid_t pid,int is_user,char ** unixname)3009e8c27ec8Sbaban ns_lookup_bypid(uid_t pid, int is_user, char **unixname)
3010e8c27ec8Sbaban {
3011e8c27ec8Sbaban struct passwd pwd;
3012e8c27ec8Sbaban struct group grp;
30138c155366SJordan Brown char *buf;
30148c155366SJordan Brown static size_t pwdbufsiz = 0;
30158c155366SJordan Brown static size_t grpbufsiz = 0;
3016e8c27ec8Sbaban
3017e8c27ec8Sbaban if (is_user) {
30188c155366SJordan Brown if (pwdbufsiz == 0)
30198c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX);
30208c155366SJordan Brown buf = alloca(pwdbufsiz);
3021e8c27ec8Sbaban errno = 0;
30228c155366SJordan Brown if (getpwuid_r(pid, &pwd, buf, pwdbufsiz) == NULL) {
3023bbf6f00cSJordan Brown if (errno == 0)
3024e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
3025e8c27ec8Sbaban else
3026e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL);
3027e8c27ec8Sbaban }
3028e8c27ec8Sbaban *unixname = strdup(pwd.pw_name);
3029e8c27ec8Sbaban } else {
30308c155366SJordan Brown if (grpbufsiz == 0)
30318c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX);
30328c155366SJordan Brown buf = alloca(grpbufsiz);
3033e8c27ec8Sbaban errno = 0;
30348c155366SJordan Brown if (getgrgid_r(pid, &grp, buf, grpbufsiz) == NULL) {
3035bbf6f00cSJordan Brown if (errno == 0)
3036e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
3037e8c27ec8Sbaban else
3038e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL);
3039e8c27ec8Sbaban }
3040e8c27ec8Sbaban *unixname = strdup(grp.gr_name);
3041e8c27ec8Sbaban }
3042e8c27ec8Sbaban if (*unixname == NULL)
3043e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
3044e8c27ec8Sbaban return (IDMAP_SUCCESS);
3045e8c27ec8Sbaban }
3046e8c27ec8Sbaban
3047c5c4113dSnw141292 /*
3048c5c4113dSnw141292 * Name-based mapping
3049c5c4113dSnw141292 *
3050c5c4113dSnw141292 * Case 1: If no rule matches do ephemeral
3051c5c4113dSnw141292 *
3052c5c4113dSnw141292 * Case 2: If rule matches and unixname is "" then return no mapping.
3053c5c4113dSnw141292 *
3054c5c4113dSnw141292 * Case 3: If rule matches and unixname is specified then lookup name
3055c5c4113dSnw141292 * service using the unixname. If unixname not found then return no mapping.
3056c5c4113dSnw141292 *
3057c5c4113dSnw141292 * Case 4: If rule matches and unixname is * then lookup name service
3058c5c4113dSnw141292 * using winname as the unixname. If unixname not found then process
3059c5c4113dSnw141292 * other rules using the lookup order. If no other rule matches then do
3060c5c4113dSnw141292 * ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4.
3061c5c4113dSnw141292 * This allows us to specify a fallback unixname per _domain_ or no mapping
3062c5c4113dSnw141292 * instead of the default behaviour of doing ephemeral mapping.
3063c5c4113dSnw141292 *
3064c5c4113dSnw141292 * Example 1:
3065c5c4113dSnw141292 * *@sfbay == *
3066c5c4113dSnw141292 * If looking up windows users foo@sfbay and foo does not exists in
3067c5c4113dSnw141292 * the name service then foo@sfbay will be mapped to an ephemeral id.
3068c5c4113dSnw141292 *
3069c5c4113dSnw141292 * Example 2:
3070c5c4113dSnw141292 * *@sfbay == *
3071c5c4113dSnw141292 * *@sfbay => guest
3072c5c4113dSnw141292 * If looking up windows users foo@sfbay and foo does not exists in
3073c5c4113dSnw141292 * the name service then foo@sfbay will be mapped to guest.
3074c5c4113dSnw141292 *
3075c5c4113dSnw141292 * Example 3:
3076c5c4113dSnw141292 * *@sfbay == *
3077c5c4113dSnw141292 * *@sfbay => ""
3078c5c4113dSnw141292 * If looking up windows users foo@sfbay and foo does not exists in
3079c5c4113dSnw141292 * the name service then we will return no mapping for foo@sfbay.
3080c5c4113dSnw141292 *
3081c5c4113dSnw141292 */
3082cd37da74Snw141292 static
3083cd37da74Snw141292 idmap_retcode
name_based_mapping_sid2pid(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3084479ac375Sdm199847 name_based_mapping_sid2pid(lookup_state_t *state,
3085479ac375Sdm199847 idmap_mapping *req, idmap_id_res *res)
3086cd37da74Snw141292 {
3087cd37da74Snw141292 const char *unixname, *windomain;
3088cd37da74Snw141292 char *sql = NULL, *errmsg = NULL, *lower_winname = NULL;
3089c5c4113dSnw141292 idmap_retcode retcode;
3090cd37da74Snw141292 char *end, *lower_unixname, *winname;
3091c5c4113dSnw141292 const char **values;
3092c5c4113dSnw141292 sqlite_vm *vm = NULL;
309308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int ncol, r, is_user, is_wuser;
309448258c6bSjp151216 idmap_namerule *rule = &res->info.how.idmap_how_u.rule;
309548258c6bSjp151216 int direction;
3096c5c4113dSnw141292 const char *me = "name_based_mapping_sid2pid";
3097c5c4113dSnw141292
3098e8c27ec8Sbaban assert(req->id1name != NULL); /* We have winname */
3099e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have unixname */
3100e8c27ec8Sbaban
31018e228215Sdm199847 winname = req->id1name;
31028e228215Sdm199847 windomain = req->id1domain;
3103cd37da74Snw141292
3104cd37da74Snw141292 switch (req->id1.idtype) {
3105cd37da74Snw141292 case IDMAP_USID:
3106cd37da74Snw141292 is_wuser = 1;
3107cd37da74Snw141292 break;
3108cd37da74Snw141292 case IDMAP_GSID:
3109cd37da74Snw141292 is_wuser = 0;
3110cd37da74Snw141292 break;
3111cd37da74Snw141292 default:
3112e8c27ec8Sbaban idmapdlog(LOG_ERR, "%s: Unable to determine if the "
3113e8c27ec8Sbaban "given Windows id is user or group.", me);
3114cd37da74Snw141292 return (IDMAP_ERR_INTERNAL);
3115cd37da74Snw141292 }
3116cd37da74Snw141292
3117e8c27ec8Sbaban switch (res->id.idtype) {
3118cd37da74Snw141292 case IDMAP_UID:
3119cd37da74Snw141292 is_user = 1;
3120cd37da74Snw141292 break;
3121cd37da74Snw141292 case IDMAP_GID:
3122cd37da74Snw141292 is_user = 0;
3123cd37da74Snw141292 break;
3124cd37da74Snw141292 case IDMAP_POSIXID:
3125cd37da74Snw141292 is_user = is_wuser;
3126cd37da74Snw141292 res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID;
3127cd37da74Snw141292 break;
3128cd37da74Snw141292 }
3129c5c4113dSnw141292
3130479ac375Sdm199847 if (windomain == NULL)
313162c60062Sbaban windomain = "";
3132c5c4113dSnw141292
3133cd37da74Snw141292 if ((lower_winname = tolower_u8(winname)) == NULL)
3134cd37da74Snw141292 lower_winname = winname; /* hope for the best */
3135c5c4113dSnw141292 sql = sqlite_mprintf(
313648258c6bSjp151216 "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 "
313748258c6bSjp151216 "FROM namerules WHERE "
3138cd37da74Snw141292 "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND "
3139c5c4113dSnw141292 "(winname = %Q OR winname = '*') AND "
314008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States "(windomain = %Q OR windomain = '*') "
3141c5c4113dSnw141292 "ORDER BY w2u_order ASC;",
314208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States is_user, is_wuser, lower_winname, windomain);
3143c5c4113dSnw141292 if (sql == NULL) {
3144c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
3145c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
3146c5c4113dSnw141292 goto out;
3147c5c4113dSnw141292 }
3148c5c4113dSnw141292
3149479ac375Sdm199847 if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
3150c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3151cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3152cd37da74Snw141292 CHECK_NULL(errmsg));
3153c5c4113dSnw141292 sqlite_freemem(errmsg);
3154c5c4113dSnw141292 goto out;
3155c5c4113dSnw141292 }
3156c5c4113dSnw141292
315784decf41Sjp151216 for (;;) {
3158c5c4113dSnw141292 r = sqlite_step(vm, &ncol, &values, NULL);
315984decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
3160c5c4113dSnw141292
316184decf41Sjp151216 if (r == SQLITE_ROW) {
316248258c6bSjp151216 if (ncol < 5) {
3163c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3164c5c4113dSnw141292 goto out;
3165c5c4113dSnw141292 }
3166148c5f43SAlan Wright
3167148c5f43SAlan Wright TRACE(req, res, "Matching rule: %s@%s -> %s",
3168148c5f43SAlan Wright values[2] == NULL ? "(null)" : values[2],
3169148c5f43SAlan Wright values[3] == NULL ? "(null)" : values[3],
3170148c5f43SAlan Wright values[0] == NULL ? "(null)" : values[0]);
3171148c5f43SAlan Wright
3172c5c4113dSnw141292 if (values[0] == NULL) {
3173c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3174c5c4113dSnw141292 goto out;
3175c5c4113dSnw141292 }
3176c5c4113dSnw141292
317748258c6bSjp151216 if (values[1] != NULL)
317848258c6bSjp151216 direction =
317948258c6bSjp151216 (strtol(values[1], &end, 10) == 0)?
318048258c6bSjp151216 IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
318148258c6bSjp151216 else
318248258c6bSjp151216 direction = IDMAP_DIRECTION_W2U;
318348258c6bSjp151216
3184c5c4113dSnw141292 if (EMPTY_NAME(values[0])) {
3185148c5f43SAlan Wright TRACE(req, res, "Mapping inhibited");
318648258c6bSjp151216 idmap_namerule_set(rule, values[3], values[2],
31879fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[0], is_user, is_wuser,
318848258c6bSjp151216 strtol(values[4], &end, 10),
318948258c6bSjp151216 direction);
3190c5c4113dSnw141292 retcode = IDMAP_ERR_NOMAPPING;
3191c5c4113dSnw141292 goto out;
3192c5c4113dSnw141292 }
319348258c6bSjp151216
319448258c6bSjp151216 if (values[0][0] == '*') {
319548258c6bSjp151216 unixname = winname;
319648258c6bSjp151216 lower_unixname = lower_winname;
319748258c6bSjp151216 } else {
319848258c6bSjp151216 unixname = values[0];
319948258c6bSjp151216 lower_unixname = NULL;
320048258c6bSjp151216 }
320148258c6bSjp151216
3202e8c27ec8Sbaban retcode = ns_lookup_byname(unixname, lower_unixname,
3203e8c27ec8Sbaban &res->id);
3204148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
3205148c5f43SAlan Wright break;
3206148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) {
3207148c5f43SAlan Wright if (values[0][0] == '*') {
3208148c5f43SAlan Wright TRACE(req, res,
3209148c5f43SAlan Wright "%s not found, continuing",
3210148c5f43SAlan Wright unixname);
3211c5c4113dSnw141292 /* Case 4 */
3212c5c4113dSnw141292 continue;
3213148c5f43SAlan Wright } else {
3214148c5f43SAlan Wright TRACE(req, res,
3215148c5f43SAlan Wright "%s not found, error", unixname);
3216c5c4113dSnw141292 /* Case 3 */
321748258c6bSjp151216 idmap_namerule_set(rule, values[3],
32189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[2], values[0], is_user,
32199fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States is_wuser,
322048258c6bSjp151216 strtol(values[4], &end, 10),
322148258c6bSjp151216 direction);
3222c5c4113dSnw141292 retcode = IDMAP_ERR_NOMAPPING;
3223c5c4113dSnw141292 }
3224148c5f43SAlan Wright } else {
3225148c5f43SAlan Wright TRACE(req, res, "Looking up %s error=%d",
3226148c5f43SAlan Wright unixname, retcode);
322748258c6bSjp151216 }
3228c5c4113dSnw141292 goto out;
3229c5c4113dSnw141292 } else if (r == SQLITE_DONE) {
3230cb174861Sjoyce mcintosh TRACE(req, res, "No matching rule");
3231c5c4113dSnw141292 retcode = IDMAP_ERR_NOTFOUND;
3232c5c4113dSnw141292 goto out;
3233c5c4113dSnw141292 } else {
3234c5c4113dSnw141292 (void) sqlite_finalize(vm, &errmsg);
3235c5c4113dSnw141292 vm = NULL;
3236cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3237cd37da74Snw141292 CHECK_NULL(errmsg));
3238c5c4113dSnw141292 sqlite_freemem(errmsg);
3239c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3240c5c4113dSnw141292 goto out;
3241c5c4113dSnw141292 }
3242c5c4113dSnw141292 }
3243c5c4113dSnw141292
3244148c5f43SAlan Wright /* Found */
3245148c5f43SAlan Wright
324662c60062Sbaban if (values[1] != NULL)
3247c5c4113dSnw141292 res->direction =
3248651c0131Sbaban (strtol(values[1], &end, 10) == 0)?
3249651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
3250c5c4113dSnw141292 else
3251651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U;
325248258c6bSjp151216
32538e228215Sdm199847 req->id2name = strdup(unixname);
3254479ac375Sdm199847 if (req->id2name == NULL) {
3255479ac375Sdm199847 retcode = IDMAP_ERR_MEMORY;
3256148c5f43SAlan Wright goto out;
3257479ac375Sdm199847 }
3258148c5f43SAlan Wright TRACE(req, res, "UNIX name found");
3259479ac375Sdm199847
326048258c6bSjp151216 idmap_namerule_set(rule, values[3], values[2],
32619fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[0], is_user, is_wuser, strtol(values[4], &end, 10),
326248258c6bSjp151216 res->direction);
3263148c5f43SAlan Wright
3264148c5f43SAlan Wright out:
3265148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS &&
3266148c5f43SAlan Wright retcode != IDMAP_ERR_NOTFOUND &&
3267148c5f43SAlan Wright retcode != IDMAP_ERR_NOMAPPING) {
3268148c5f43SAlan Wright TRACE(req, res, "Rule processing error, code=%d", retcode);
3269fc724630SAlan Wright }
3270fc724630SAlan Wright
3271148c5f43SAlan Wright if (sql != NULL)
3272148c5f43SAlan Wright sqlite_freemem(sql);
3273148c5f43SAlan Wright
3274fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) {
3275fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED;
327648258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW;
3277c5c4113dSnw141292 }
3278479ac375Sdm199847
3279cd37da74Snw141292 if (lower_winname != NULL && lower_winname != winname)
3280cd37da74Snw141292 free(lower_winname);
328162c60062Sbaban if (vm != NULL)
3282c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL);
3283c5c4113dSnw141292 return (retcode);
3284c5c4113dSnw141292 }
3285c5c4113dSnw141292
3286c5c4113dSnw141292 static
3287c5c4113dSnw141292 int
get_next_eph_uid(uid_t * next_uid)3288c5c4113dSnw141292 get_next_eph_uid(uid_t *next_uid)
3289c5c4113dSnw141292 {
3290c5c4113dSnw141292 uid_t uid;
3291c5c4113dSnw141292 gid_t gid;
3292c5c4113dSnw141292 int err;
3293c5c4113dSnw141292
3294c5c4113dSnw141292 *next_uid = (uid_t)-1;
3295c5c4113dSnw141292 uid = _idmapdstate.next_uid++;
3296c5c4113dSnw141292 if (uid >= _idmapdstate.limit_uid) {
3297c5c4113dSnw141292 if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0)
3298c5c4113dSnw141292 return (err);
3299c5c4113dSnw141292
3300c5c4113dSnw141292 _idmapdstate.limit_uid = uid + 8192;
3301c5c4113dSnw141292 _idmapdstate.next_uid = uid;
3302c5c4113dSnw141292 }
3303c5c4113dSnw141292 *next_uid = uid;
3304c5c4113dSnw141292
3305c5c4113dSnw141292 return (0);
3306c5c4113dSnw141292 }
3307c5c4113dSnw141292
3308c5c4113dSnw141292 static
3309c5c4113dSnw141292 int
get_next_eph_gid(gid_t * next_gid)3310c5c4113dSnw141292 get_next_eph_gid(gid_t *next_gid)
3311c5c4113dSnw141292 {
3312c5c4113dSnw141292 uid_t uid;
3313c5c4113dSnw141292 gid_t gid;
3314c5c4113dSnw141292 int err;
3315c5c4113dSnw141292
3316c5c4113dSnw141292 *next_gid = (uid_t)-1;
3317c5c4113dSnw141292 gid = _idmapdstate.next_gid++;
3318c5c4113dSnw141292 if (gid >= _idmapdstate.limit_gid) {
3319c5c4113dSnw141292 if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0)
3320c5c4113dSnw141292 return (err);
3321c5c4113dSnw141292
3322c5c4113dSnw141292 _idmapdstate.limit_gid = gid + 8192;
3323c5c4113dSnw141292 _idmapdstate.next_gid = gid;
3324c5c4113dSnw141292 }
3325c5c4113dSnw141292 *next_gid = gid;
3326c5c4113dSnw141292
3327c5c4113dSnw141292 return (0);
3328c5c4113dSnw141292 }
3329c5c4113dSnw141292
333062c60062Sbaban static
333162c60062Sbaban int
gethash(const char * str,uint32_t num,uint_t htsize)3332cd37da74Snw141292 gethash(const char *str, uint32_t num, uint_t htsize)
3333cd37da74Snw141292 {
333462c60062Sbaban uint_t hval, i, len;
333562c60062Sbaban
333662c60062Sbaban if (str == NULL)
333762c60062Sbaban return (0);
333862c60062Sbaban for (len = strlen(str), hval = 0, i = 0; i < len; i++) {
333962c60062Sbaban hval += str[i];
334062c60062Sbaban hval += (hval << 10);
334162c60062Sbaban hval ^= (hval >> 6);
334262c60062Sbaban }
334362c60062Sbaban for (str = (const char *)&num, i = 0; i < sizeof (num); i++) {
334462c60062Sbaban hval += str[i];
334562c60062Sbaban hval += (hval << 10);
334662c60062Sbaban hval ^= (hval >> 6);
334762c60062Sbaban }
334862c60062Sbaban hval += (hval << 3);
334962c60062Sbaban hval ^= (hval >> 11);
335062c60062Sbaban hval += (hval << 15);
335162c60062Sbaban return (hval % htsize);
335262c60062Sbaban }
335362c60062Sbaban
335462c60062Sbaban static
335562c60062Sbaban int
get_from_sid_history(lookup_state_t * state,const char * prefix,uint32_t rid,uid_t * pid)335662c60062Sbaban get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid,
3357cd37da74Snw141292 uid_t *pid)
3358cd37da74Snw141292 {
335962c60062Sbaban uint_t next, key;
336062c60062Sbaban uint_t htsize = state->sid_history_size;
336162c60062Sbaban idmap_sid *sid;
336262c60062Sbaban
336362c60062Sbaban next = gethash(prefix, rid, htsize);
336462c60062Sbaban while (next != htsize) {
336562c60062Sbaban key = state->sid_history[next].key;
336662c60062Sbaban if (key == htsize)
336762c60062Sbaban return (0);
336862c60062Sbaban sid = &state->batch->idmap_mapping_batch_val[key].id1.
336962c60062Sbaban idmap_id_u.sid;
337062c60062Sbaban if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) {
337162c60062Sbaban *pid = state->result->ids.ids_val[key].id.
337262c60062Sbaban idmap_id_u.uid;
337362c60062Sbaban return (1);
337462c60062Sbaban }
337562c60062Sbaban next = state->sid_history[next].next;
337662c60062Sbaban }
337762c60062Sbaban return (0);
337862c60062Sbaban }
337962c60062Sbaban
338062c60062Sbaban static
338162c60062Sbaban void
add_to_sid_history(lookup_state_t * state,const char * prefix,uint32_t rid)3382cd37da74Snw141292 add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid)
3383cd37da74Snw141292 {
338462c60062Sbaban uint_t hash, next;
338562c60062Sbaban uint_t htsize = state->sid_history_size;
338662c60062Sbaban
338762c60062Sbaban hash = next = gethash(prefix, rid, htsize);
338862c60062Sbaban while (state->sid_history[next].key != htsize) {
338962c60062Sbaban next++;
339062c60062Sbaban next %= htsize;
339162c60062Sbaban }
339262c60062Sbaban state->sid_history[next].key = state->curpos;
339362c60062Sbaban if (hash == next)
339462c60062Sbaban return;
339562c60062Sbaban state->sid_history[next].next = state->sid_history[hash].next;
339662c60062Sbaban state->sid_history[hash].next = next;
339762c60062Sbaban }
3398c5c4113dSnw141292
3399e8c27ec8Sbaban void
cleanup_lookup_state(lookup_state_t * state)3400e8c27ec8Sbaban cleanup_lookup_state(lookup_state_t *state)
3401e8c27ec8Sbaban {
3402e8c27ec8Sbaban free(state->sid_history);
3403e8c27ec8Sbaban free(state->ad_unixuser_attr);
3404e8c27ec8Sbaban free(state->ad_unixgroup_attr);
3405479ac375Sdm199847 free(state->nldap_winname_attr);
3406479ac375Sdm199847 free(state->defdom);
3407e8c27ec8Sbaban }
3408e8c27ec8Sbaban
3409c5c4113dSnw141292 /* ARGSUSED */
3410c5c4113dSnw141292 static
3411c5c4113dSnw141292 idmap_retcode
dynamic_ephemeral_mapping(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3412479ac375Sdm199847 dynamic_ephemeral_mapping(lookup_state_t *state,
3413cd37da74Snw141292 idmap_mapping *req, idmap_id_res *res)
3414cd37da74Snw141292 {
3415c5c4113dSnw141292
3416c5c4113dSnw141292 uid_t next_pid;
3417c5c4113dSnw141292
3418651c0131Sbaban res->direction = IDMAP_DIRECTION_BI;
341962c60062Sbaban
34209fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
342148258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
342248258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_CACHE;
342362c60062Sbaban return (IDMAP_SUCCESS);
342448258c6bSjp151216 }
342562c60062Sbaban
342662c60062Sbaban if (state->sid_history != NULL &&
342762c60062Sbaban get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix,
342862c60062Sbaban req->id1.idmap_id_u.sid.rid, &next_pid)) {
342962c60062Sbaban res->id.idmap_id_u.uid = next_pid;
343048258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
343148258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW;
343262c60062Sbaban return (IDMAP_SUCCESS);
343362c60062Sbaban }
343462c60062Sbaban
343562c60062Sbaban if (res->id.idtype == IDMAP_UID) {
3436c5c4113dSnw141292 if (get_next_eph_uid(&next_pid) != 0)
3437c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL);
3438c5c4113dSnw141292 res->id.idmap_id_u.uid = next_pid;
3439c5c4113dSnw141292 } else {
3440c5c4113dSnw141292 if (get_next_eph_gid(&next_pid) != 0)
3441c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL);
3442c5c4113dSnw141292 res->id.idmap_id_u.gid = next_pid;
3443c5c4113dSnw141292 }
3444c5c4113dSnw141292
344548258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
344648258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW;
344762c60062Sbaban if (state->sid_history != NULL)
344862c60062Sbaban add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix,
344962c60062Sbaban req->id1.idmap_id_u.sid.rid);
345062c60062Sbaban
3451c5c4113dSnw141292 return (IDMAP_SUCCESS);
3452c5c4113dSnw141292 }
3453c5c4113dSnw141292
3454c5c4113dSnw141292 idmap_retcode
sid2pid_second_pass(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3455479ac375Sdm199847 sid2pid_second_pass(lookup_state_t *state,
3456cd37da74Snw141292 idmap_mapping *req, idmap_id_res *res)
3457cd37da74Snw141292 {
3458c5c4113dSnw141292 idmap_retcode retcode;
3459148c5f43SAlan Wright idmap_retcode retcode2;
3460c5c4113dSnw141292
3461c5c4113dSnw141292 /* Check if second pass is needed */
3462e8c27ec8Sbaban if (ARE_WE_DONE(req->direction))
3463c5c4113dSnw141292 return (res->retcode);
3464c5c4113dSnw141292
3465c5c4113dSnw141292 /* Get status from previous pass */
3466e8c27ec8Sbaban retcode = res->retcode;
34674aa0a5e7Snw141292 if (retcode != IDMAP_SUCCESS && state->eph_map_unres_sids &&
34684aa0a5e7Snw141292 !EMPTY_STRING(req->id1.idmap_id_u.sid.prefix) &&
34694aa0a5e7Snw141292 EMPTY_STRING(req->id1name)) {
34704aa0a5e7Snw141292 /*
34714aa0a5e7Snw141292 * We are asked to map an unresolvable SID to a UID or
34724aa0a5e7Snw141292 * GID, but, which? We'll treat all unresolvable SIDs
34734aa0a5e7Snw141292 * as users unless the caller specified which of a UID
34744aa0a5e7Snw141292 * or GID they want.
34754aa0a5e7Snw141292 */
3476a7c8bd9fSNicolas Williams if (req->id1.idtype == IDMAP_SID)
3477a7c8bd9fSNicolas Williams req->id1.idtype = IDMAP_USID;
3478148c5f43SAlan Wright if (res->id.idtype == IDMAP_POSIXID) {
34794aa0a5e7Snw141292 res->id.idtype = IDMAP_UID;
3480148c5f43SAlan Wright TRACE(req, res, "Assume unresolvable SID is user");
3481148c5f43SAlan Wright } else if (res->id.idtype == IDMAP_UID) {
3482148c5f43SAlan Wright TRACE(req, res, "Must map unresolvable SID to user");
3483148c5f43SAlan Wright } else if (res->id.idtype == IDMAP_GID) {
3484148c5f43SAlan Wright TRACE(req, res, "Must map unresolvable SID to group");
3485148c5f43SAlan Wright }
34864aa0a5e7Snw141292 goto do_eph;
34874aa0a5e7Snw141292 }
3488e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS)
3489e8c27ec8Sbaban goto out;
3490c5c4113dSnw141292
3491e8c27ec8Sbaban /*
3492e3f2c991SKeyur Desai * There are two ways we might get here with a Posix ID:
3493e3f2c991SKeyur Desai * - It could be from an expired ephemeral cache entry.
3494e3f2c991SKeyur Desai * - It could be from IDMU.
3495e3f2c991SKeyur Desai * If it's from IDMU, we need to look up the name, for name-based
3496e3f2c991SKeyur Desai * requests and the cache.
3497e3f2c991SKeyur Desai */
34989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (!IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid) &&
34999fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID) {
3500e3f2c991SKeyur Desai if (req->id2name == NULL) {
3501e3f2c991SKeyur Desai /*
3502e3f2c991SKeyur Desai * If the lookup fails, go ahead anyway.
3503e3f2c991SKeyur Desai * The general UNIX rule is that it's OK to
3504e3f2c991SKeyur Desai * have a UID or GID that isn't in the
3505e3f2c991SKeyur Desai * name service.
3506e3f2c991SKeyur Desai */
3507148c5f43SAlan Wright retcode2 = ns_lookup_bypid(res->id.idmap_id_u.uid,
3508e3f2c991SKeyur Desai res->id.idtype == IDMAP_UID, &req->id2name);
3509148c5f43SAlan Wright if (IDMAP_ERROR(retcode2)) {
3510148c5f43SAlan Wright TRACE(req, res,
3511148c5f43SAlan Wright "Getting UNIX name, error=%d (ignored)",
3512148c5f43SAlan Wright retcode2);
3513148c5f43SAlan Wright } else {
3514148c5f43SAlan Wright TRACE(req, res, "Found UNIX name");
3515148c5f43SAlan Wright }
3516e3f2c991SKeyur Desai }
3517e3f2c991SKeyur Desai goto out;
3518e3f2c991SKeyur Desai }
3519e3f2c991SKeyur Desai
3520e3f2c991SKeyur Desai /*
3521e8c27ec8Sbaban * If directory-based name mapping is enabled then the unixname
3522e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode or
3523e8c27ec8Sbaban * mixed-mode) or from native LDAP object (nldap-mode) -- done.
3524e8c27ec8Sbaban */
3525e8c27ec8Sbaban if (req->id2name != NULL) {
3526e8c27ec8Sbaban assert(res->id.idtype != IDMAP_POSIXID);
3527e8c27ec8Sbaban if (AD_MODE(res->id.idtype, state))
3528e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
3529e8c27ec8Sbaban else if (NLDAP_MODE(res->id.idtype, state))
3530e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
3531e8c27ec8Sbaban else if (MIXED_MODE(res->id.idtype, state))
3532e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U;
3533c5c4113dSnw141292
3534e8c27ec8Sbaban /*
3535e8c27ec8Sbaban * Special case: (1) If the ad_unixuser_attr and
3536e8c27ec8Sbaban * ad_unixgroup_attr uses the same attribute
3537e8c27ec8Sbaban * name and (2) if this is a diagonal mapping
3538e8c27ec8Sbaban * request and (3) the unixname has been retrieved
3539e8c27ec8Sbaban * from the AD object -- then we ignore it and fallback
3540e8c27ec8Sbaban * to name-based mapping rules and ephemeral mapping
3541e8c27ec8Sbaban *
3542e8c27ec8Sbaban * Example:
3543e8c27ec8Sbaban * Properties:
3544e8c27ec8Sbaban * config/ad_unixuser_attr = "unixname"
3545e8c27ec8Sbaban * config/ad_unixgroup_attr = "unixname"
3546e8c27ec8Sbaban * AD user object:
3547e8c27ec8Sbaban * dn: cn=bob ...
3548e8c27ec8Sbaban * objectclass: user
3549e8c27ec8Sbaban * sam: bob
3550e8c27ec8Sbaban * unixname: bob1234
3551e8c27ec8Sbaban * AD group object:
3552e8c27ec8Sbaban * dn: cn=winadmins ...
3553e8c27ec8Sbaban * objectclass: group
3554e8c27ec8Sbaban * sam: winadmins
3555e8c27ec8Sbaban * unixname: unixadmins
3556e8c27ec8Sbaban *
3557e8c27ec8Sbaban * In this example whether "unixname" refers to a unixuser
3558e8c27ec8Sbaban * or unixgroup depends upon the AD object.
3559e8c27ec8Sbaban *
3560e8c27ec8Sbaban * $idmap show -c winname:bob gid
3561e8c27ec8Sbaban * AD lookup by "samAccountName=bob" for
3562e8c27ec8Sbaban * "ad_unixgroup_attr (i.e unixname)" for directory-based
3563e8c27ec8Sbaban * mapping would get "bob1234" which is not what we want.
3564e8c27ec8Sbaban * Now why not getgrnam_r("bob1234") and use it if it
3565e8c27ec8Sbaban * is indeed a unixgroup? That's because Unix can have
3566e8c27ec8Sbaban * users and groups with the same name and we clearly
3567e8c27ec8Sbaban * don't know the intention of the admin here.
3568e8c27ec8Sbaban * Therefore we ignore this and fallback to name-based
3569e8c27ec8Sbaban * mapping rules or ephemeral mapping.
3570e8c27ec8Sbaban */
3571e8c27ec8Sbaban if ((AD_MODE(res->id.idtype, state) ||
3572e8c27ec8Sbaban MIXED_MODE(res->id.idtype, state)) &&
3573e8c27ec8Sbaban state->ad_unixuser_attr != NULL &&
3574e8c27ec8Sbaban state->ad_unixgroup_attr != NULL &&
3575e8c27ec8Sbaban strcasecmp(state->ad_unixuser_attr,
3576e8c27ec8Sbaban state->ad_unixgroup_attr) == 0 &&
3577e8c27ec8Sbaban ((req->id1.idtype == IDMAP_USID &&
3578e8c27ec8Sbaban res->id.idtype == IDMAP_GID) ||
3579e8c27ec8Sbaban (req->id1.idtype == IDMAP_GSID &&
3580e8c27ec8Sbaban res->id.idtype == IDMAP_UID))) {
3581148c5f43SAlan Wright TRACE(req, res, "Ignoring UNIX name found in AD");
3582e8c27ec8Sbaban free(req->id2name);
3583e8c27ec8Sbaban req->id2name = NULL;
35849fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = IDMAP_SENTINEL_PID;
3585e8c27ec8Sbaban /* fallback */
3586e8c27ec8Sbaban } else {
3587148c5f43SAlan Wright if (res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID) {
3588e8c27ec8Sbaban retcode = ns_lookup_byname(req->id2name,
3589e8c27ec8Sbaban NULL, &res->id);
3590148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) {
3591e8c27ec8Sbaban /*
3592148c5f43SAlan Wright * If ns_lookup_byname() fails that
3593148c5f43SAlan Wright * means the unixname (req->id2name),
3594148c5f43SAlan Wright * which was obtained from the AD
3595148c5f43SAlan Wright * object by directory-based mapping,
3596148c5f43SAlan Wright * is not a valid Unix user/group and
3597148c5f43SAlan Wright * therefore we return the error to the
3598148c5f43SAlan Wright * client instead of doing rule-based
3599148c5f43SAlan Wright * mapping or ephemeral mapping. This
3600148c5f43SAlan Wright * way the client can detect the issue.
3601e8c27ec8Sbaban */
3602148c5f43SAlan Wright TRACE(req, res,
3603148c5f43SAlan Wright "UNIX lookup error=%d", retcode);
3604148c5f43SAlan Wright goto out;
3605148c5f43SAlan Wright }
3606148c5f43SAlan Wright TRACE(req, res, "UNIX lookup");
3607148c5f43SAlan Wright }
3608c5c4113dSnw141292 goto out;
3609c5c4113dSnw141292 }
3610e8c27ec8Sbaban }
3611c5c4113dSnw141292
361248258c6bSjp151216 /* Free any mapping info from Directory based mapping */
361348258c6bSjp151216 if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN)
3614148c5f43SAlan Wright idmap_how_clear(&res->info.how);
361548258c6bSjp151216
3616e8c27ec8Sbaban /*
3617e8c27ec8Sbaban * If we don't have unixname then evaluate local name-based
3618e8c27ec8Sbaban * mapping rules.
3619e8c27ec8Sbaban */
3620479ac375Sdm199847 retcode = name_based_mapping_sid2pid(state, req, res);
3621148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
3622148c5f43SAlan Wright TRACE(req, res, "Rule-based mapping");
3623e8c27ec8Sbaban goto out;
3624148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
3625148c5f43SAlan Wright TRACE(req, res, "Rule-based mapping error=%d", retcode);
3626148c5f43SAlan Wright goto out;
3627148c5f43SAlan Wright }
3628e8c27ec8Sbaban
36294aa0a5e7Snw141292 do_eph:
3630c5c4113dSnw141292 /* If not found, do ephemeral mapping */
3631479ac375Sdm199847 retcode = dynamic_ephemeral_mapping(state, req, res);
3632148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
3633148c5f43SAlan Wright TRACE(req, res, "Ephemeral mapping");
3634148c5f43SAlan Wright goto out;
3635148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
3636148c5f43SAlan Wright TRACE(req, res, "Ephemeral mapping error=%d", retcode);
3637148c5f43SAlan Wright goto out;
3638148c5f43SAlan Wright }
3639c5c4113dSnw141292
3640c5c4113dSnw141292 out:
3641c5c4113dSnw141292 res->retcode = idmap_stat4prot(retcode);
3642e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) {
3643e8c27ec8Sbaban req->direction = _IDMAP_F_DONE;
3644e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY;
3645e8c27ec8Sbaban }
3646e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction))
3647e8c27ec8Sbaban state->sid2pid_done = FALSE;
3648c5c4113dSnw141292 return (retcode);
3649c5c4113dSnw141292 }
3650c5c4113dSnw141292
3651c5c4113dSnw141292 idmap_retcode
update_cache_pid2sid(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3652479ac375Sdm199847 update_cache_pid2sid(lookup_state_t *state,
3653cd37da74Snw141292 idmap_mapping *req, idmap_id_res *res)
3654cd37da74Snw141292 {
3655c5c4113dSnw141292 char *sql = NULL;
3656c5c4113dSnw141292 idmap_retcode retcode;
3657148c5f43SAlan Wright idmap_retcode retcode2;
365848258c6bSjp151216 char *map_dn = NULL;
365948258c6bSjp151216 char *map_attr = NULL;
366048258c6bSjp151216 char *map_value = NULL;
366148258c6bSjp151216 char *map_windomain = NULL;
366248258c6bSjp151216 char *map_winname = NULL;
366348258c6bSjp151216 char *map_unixname = NULL;
366448258c6bSjp151216 int map_is_nt4 = FALSE;
3665c5c4113dSnw141292
3666c5c4113dSnw141292 /* Check if we need to cache anything */
3667e8c27ec8Sbaban if (ARE_WE_DONE(req->direction))
3668c5c4113dSnw141292 return (IDMAP_SUCCESS);
3669c5c4113dSnw141292
3670c5c4113dSnw141292 /* We don't cache negative entries */
3671c5c4113dSnw141292 if (res->retcode != IDMAP_SUCCESS)
3672c5c4113dSnw141292 return (IDMAP_SUCCESS);
3673c5c4113dSnw141292
3674e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF);
36759fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID);
367648258c6bSjp151216 assert(res->id.idtype != IDMAP_SID);
367748258c6bSjp151216
3678e3f2c991SKeyur Desai /*
3679e3f2c991SKeyur Desai * If we've gotten to this point and we *still* don't know the
3680e3f2c991SKeyur Desai * unixname, well, we'd like to have it now for the cache.
3681e3f2c991SKeyur Desai *
3682e3f2c991SKeyur Desai * If we truly always need it for the cache, we should probably
3683e3f2c991SKeyur Desai * look it up once at the beginning, rather than "at need" in
3684e3f2c991SKeyur Desai * several places as is now done. However, it's not really clear
3685e3f2c991SKeyur Desai * that we *do* need it in the cache; there's a decent argument
3686e3f2c991SKeyur Desai * that the cache should contain only SIDs and PIDs, so we'll
3687e3f2c991SKeyur Desai * leave our options open by doing it "at need" here too.
3688e3f2c991SKeyur Desai *
3689e3f2c991SKeyur Desai * If we can't find it... c'est la vie.
3690e3f2c991SKeyur Desai */
3691e3f2c991SKeyur Desai if (req->id1name == NULL) {
3692148c5f43SAlan Wright retcode2 = ns_lookup_bypid(req->id1.idmap_id_u.uid,
3693e3f2c991SKeyur Desai req->id1.idtype == IDMAP_UID, &req->id1name);
3694148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS)
3695148c5f43SAlan Wright TRACE(req, res, "Found UNIX name");
3696148c5f43SAlan Wright else
3697148c5f43SAlan Wright TRACE(req, res, "Getting UNIX name error=%d", retcode2);
3698e3f2c991SKeyur Desai }
3699e3f2c991SKeyur Desai
370048258c6bSjp151216 assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN);
370148258c6bSjp151216 switch (res->info.how.map_type) {
370248258c6bSjp151216 case IDMAP_MAP_TYPE_DS_AD:
370348258c6bSjp151216 map_dn = res->info.how.idmap_how_u.ad.dn;
370448258c6bSjp151216 map_attr = res->info.how.idmap_how_u.ad.attr;
370548258c6bSjp151216 map_value = res->info.how.idmap_how_u.ad.value;
370648258c6bSjp151216 break;
370748258c6bSjp151216
370848258c6bSjp151216 case IDMAP_MAP_TYPE_DS_NLDAP:
370948258c6bSjp151216 map_dn = res->info.how.idmap_how_u.nldap.dn;
371048258c6bSjp151216 map_attr = res->info.how.idmap_how_u.nldap.attr;
371148258c6bSjp151216 map_value = res->info.how.idmap_how_u.nldap.value;
371248258c6bSjp151216 break;
371348258c6bSjp151216
371448258c6bSjp151216 case IDMAP_MAP_TYPE_RULE_BASED:
371548258c6bSjp151216 map_windomain = res->info.how.idmap_how_u.rule.windomain;
371648258c6bSjp151216 map_winname = res->info.how.idmap_how_u.rule.winname;
371748258c6bSjp151216 map_unixname = res->info.how.idmap_how_u.rule.unixname;
371848258c6bSjp151216 map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4;
371948258c6bSjp151216 break;
372048258c6bSjp151216
372148258c6bSjp151216 case IDMAP_MAP_TYPE_EPHEMERAL:
372248258c6bSjp151216 break;
372348258c6bSjp151216
372448258c6bSjp151216 case IDMAP_MAP_TYPE_LOCAL_SID:
372548258c6bSjp151216 break;
372648258c6bSjp151216
3727e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU:
3728e3f2c991SKeyur Desai map_dn = res->info.how.idmap_how_u.idmu.dn;
3729e3f2c991SKeyur Desai map_attr = res->info.how.idmap_how_u.idmu.attr;
3730e3f2c991SKeyur Desai map_value = res->info.how.idmap_how_u.idmu.value;
3731e3f2c991SKeyur Desai break;
3732e3f2c991SKeyur Desai
373348258c6bSjp151216 default:
3734148c5f43SAlan Wright /* Don't cache other mapping types */
373548258c6bSjp151216 assert(FALSE);
373648258c6bSjp151216 }
3737e8c27ec8Sbaban
3738c5c4113dSnw141292 /*
3739c5c4113dSnw141292 * Using NULL for u2w instead of 0 so that our trigger allows
3740c5c4113dSnw141292 * the same pid to be the destination in multiple entries
3741c5c4113dSnw141292 */
3742c5c4113dSnw141292 sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
3743cd37da74Snw141292 "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
374448258c6bSjp151216 "is_user, is_wuser, expiration, w2u, u2w, "
374548258c6bSjp151216 "map_type, map_dn, map_attr, map_value, map_windomain, "
374648258c6bSjp151216 "map_winname, map_unixname, map_is_nt4) "
3747cd37da74Snw141292 "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
374848cd229bSGordon Ross "strftime('%%s','now') + %u, %q, 1, "
374948258c6bSjp151216 "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ",
3750cd37da74Snw141292 res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
3751cd37da74Snw141292 req->id2domain, req->id2name, req->id1.idmap_id_u.uid,
3752cd37da74Snw141292 req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0,
3753e8c27ec8Sbaban (res->id.idtype == IDMAP_USID) ? 1 : 0,
375448cd229bSGordon Ross state->id_cache_timeout,
375548258c6bSjp151216 (res->direction == 0) ? "1" : NULL,
375648258c6bSjp151216 res->info.how.map_type, map_dn, map_attr, map_value,
375748258c6bSjp151216 map_windomain, map_winname, map_unixname, map_is_nt4);
3758c5c4113dSnw141292
3759c5c4113dSnw141292 if (sql == NULL) {
3760c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3761c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
3762c5c4113dSnw141292 goto out;
3763c5c4113dSnw141292 }
3764c5c4113dSnw141292
3765479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3766c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS)
3767c5c4113dSnw141292 goto out;
3768c5c4113dSnw141292
3769c5c4113dSnw141292 state->pid2sid_done = FALSE;
3770c5c4113dSnw141292 sqlite_freemem(sql);
3771c5c4113dSnw141292 sql = NULL;
3772c5c4113dSnw141292
3773e8c27ec8Sbaban /* Check if we need to update namecache */
3774e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
3775c5c4113dSnw141292 goto out;
3776c5c4113dSnw141292
37778e228215Sdm199847 if (req->id2name == NULL)
3778c5c4113dSnw141292 goto out;
3779c5c4113dSnw141292
3780c5c4113dSnw141292 sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
3781cd37da74Snw141292 "(sidprefix, rid, canon_name, domain, type, expiration) "
378248cd229bSGordon Ross "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + %u); ",
3783cd37da74Snw141292 res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
3784cd37da74Snw141292 req->id2name, req->id2domain,
378548cd229bSGordon Ross res->id.idtype, state->name_cache_timeout);
3786c5c4113dSnw141292
3787c5c4113dSnw141292 if (sql == NULL) {
3788c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3789c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
3790c5c4113dSnw141292 goto out;
3791c5c4113dSnw141292 }
3792c5c4113dSnw141292
3793479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3794c5c4113dSnw141292
3795c5c4113dSnw141292 out:
379662c60062Sbaban if (sql != NULL)
3797c5c4113dSnw141292 sqlite_freemem(sql);
3798c5c4113dSnw141292 return (retcode);
3799c5c4113dSnw141292 }
3800c5c4113dSnw141292
3801c5c4113dSnw141292 idmap_retcode
update_cache_sid2pid(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3802479ac375Sdm199847 update_cache_sid2pid(lookup_state_t *state,
3803cd37da74Snw141292 idmap_mapping *req, idmap_id_res *res)
3804cd37da74Snw141292 {
3805c5c4113dSnw141292 char *sql = NULL;
3806c5c4113dSnw141292 idmap_retcode retcode;
3807c5c4113dSnw141292 int is_eph_user;
380848258c6bSjp151216 char *map_dn = NULL;
380948258c6bSjp151216 char *map_attr = NULL;
381048258c6bSjp151216 char *map_value = NULL;
381148258c6bSjp151216 char *map_windomain = NULL;
381248258c6bSjp151216 char *map_winname = NULL;
381348258c6bSjp151216 char *map_unixname = NULL;
381448258c6bSjp151216 int map_is_nt4 = FALSE;
3815c5c4113dSnw141292
3816c5c4113dSnw141292 /* Check if we need to cache anything */
3817e8c27ec8Sbaban if (ARE_WE_DONE(req->direction))
3818c5c4113dSnw141292 return (IDMAP_SUCCESS);
3819c5c4113dSnw141292
3820c5c4113dSnw141292 /* We don't cache negative entries */
3821c5c4113dSnw141292 if (res->retcode != IDMAP_SUCCESS)
3822c5c4113dSnw141292 return (IDMAP_SUCCESS);
3823c5c4113dSnw141292
3824c5c4113dSnw141292 if (req->direction & _IDMAP_F_EXP_EPH_UID)
3825c5c4113dSnw141292 is_eph_user = 1;
3826c5c4113dSnw141292 else if (req->direction & _IDMAP_F_EXP_EPH_GID)
3827c5c4113dSnw141292 is_eph_user = 0;
3828c5c4113dSnw141292 else
3829c5c4113dSnw141292 is_eph_user = -1;
3830c5c4113dSnw141292
38319fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (is_eph_user >= 0 &&
38329fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States !IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
3833c5c4113dSnw141292 sql = sqlite_mprintf("UPDATE idmap_cache "
3834c5c4113dSnw141292 "SET w2u = 0 WHERE "
3835c5c4113dSnw141292 "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
3836c5c4113dSnw141292 "pid >= 2147483648 AND is_user = %d;",
3837c5c4113dSnw141292 req->id1.idmap_id_u.sid.prefix,
3838c5c4113dSnw141292 req->id1.idmap_id_u.sid.rid,
3839c5c4113dSnw141292 is_eph_user);
3840c5c4113dSnw141292 if (sql == NULL) {
3841c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3842c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
3843c5c4113dSnw141292 goto out;
3844c5c4113dSnw141292 }
3845c5c4113dSnw141292
3846479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3847c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS)
3848c5c4113dSnw141292 goto out;
3849c5c4113dSnw141292
3850c5c4113dSnw141292 sqlite_freemem(sql);
3851c5c4113dSnw141292 sql = NULL;
3852c5c4113dSnw141292 }
3853c5c4113dSnw141292
3854e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF);
38559fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID);
385648258c6bSjp151216
385748258c6bSjp151216 switch (res->info.how.map_type) {
385848258c6bSjp151216 case IDMAP_MAP_TYPE_DS_AD:
385948258c6bSjp151216 map_dn = res->info.how.idmap_how_u.ad.dn;
386048258c6bSjp151216 map_attr = res->info.how.idmap_how_u.ad.attr;
386148258c6bSjp151216 map_value = res->info.how.idmap_how_u.ad.value;
386248258c6bSjp151216 break;
386348258c6bSjp151216
386448258c6bSjp151216 case IDMAP_MAP_TYPE_DS_NLDAP:
386548258c6bSjp151216 map_dn = res->info.how.idmap_how_u.nldap.dn;
386648258c6bSjp151216 map_attr = res->info.how.idmap_how_u.ad.attr;
386748258c6bSjp151216 map_value = res->info.how.idmap_how_u.nldap.value;
386848258c6bSjp151216 break;
386948258c6bSjp151216
387048258c6bSjp151216 case IDMAP_MAP_TYPE_RULE_BASED:
387148258c6bSjp151216 map_windomain = res->info.how.idmap_how_u.rule.windomain;
387248258c6bSjp151216 map_winname = res->info.how.idmap_how_u.rule.winname;
387348258c6bSjp151216 map_unixname = res->info.how.idmap_how_u.rule.unixname;
387448258c6bSjp151216 map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4;
387548258c6bSjp151216 break;
387648258c6bSjp151216
387748258c6bSjp151216 case IDMAP_MAP_TYPE_EPHEMERAL:
387848258c6bSjp151216 break;
387948258c6bSjp151216
3880e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU:
3881e3f2c991SKeyur Desai map_dn = res->info.how.idmap_how_u.idmu.dn;
3882e3f2c991SKeyur Desai map_attr = res->info.how.idmap_how_u.idmu.attr;
3883e3f2c991SKeyur Desai map_value = res->info.how.idmap_how_u.idmu.value;
3884e3f2c991SKeyur Desai break;
3885e3f2c991SKeyur Desai
388648258c6bSjp151216 default:
3887148c5f43SAlan Wright /* Don't cache other mapping types */
388848258c6bSjp151216 assert(FALSE);
388948258c6bSjp151216 }
3890cd37da74Snw141292
3891c5c4113dSnw141292 sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
3892cd37da74Snw141292 "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
389348258c6bSjp151216 "is_user, is_wuser, expiration, w2u, u2w, "
389448258c6bSjp151216 "map_type, map_dn, map_attr, map_value, map_windomain, "
389548258c6bSjp151216 "map_winname, map_unixname, map_is_nt4) "
3896cd37da74Snw141292 "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
389748cd229bSGordon Ross "strftime('%%s','now') + %u, 1, %q, "
389848258c6bSjp151216 "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);",
3899cd37da74Snw141292 req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
3900e8c27ec8Sbaban (req->id1domain != NULL) ? req->id1domain : "", req->id1name,
3901e8c27ec8Sbaban res->id.idmap_id_u.uid, req->id2name,
3902e8c27ec8Sbaban (res->id.idtype == IDMAP_UID) ? 1 : 0,
3903cd37da74Snw141292 (req->id1.idtype == IDMAP_USID) ? 1 : 0,
390448cd229bSGordon Ross state->id_cache_timeout,
390548258c6bSjp151216 (res->direction == 0) ? "1" : NULL,
390648258c6bSjp151216 res->info.how.map_type, map_dn, map_attr, map_value,
390748258c6bSjp151216 map_windomain, map_winname, map_unixname, map_is_nt4);
3908c5c4113dSnw141292
3909c5c4113dSnw141292 if (sql == NULL) {
3910c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3911c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
3912c5c4113dSnw141292 goto out;
3913c5c4113dSnw141292 }
3914c5c4113dSnw141292
3915479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3916c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS)
3917c5c4113dSnw141292 goto out;
3918c5c4113dSnw141292
3919c5c4113dSnw141292 state->sid2pid_done = FALSE;
3920c5c4113dSnw141292 sqlite_freemem(sql);
3921c5c4113dSnw141292 sql = NULL;
3922c5c4113dSnw141292
3923e8c27ec8Sbaban /* Check if we need to update namecache */
3924e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
3925c5c4113dSnw141292 goto out;
3926c5c4113dSnw141292
3927cf5b5989Sdm199847 if (EMPTY_STRING(req->id1name))
3928c5c4113dSnw141292 goto out;
3929c5c4113dSnw141292
3930c5c4113dSnw141292 sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
3931cd37da74Snw141292 "(sidprefix, rid, canon_name, domain, type, expiration) "
393248cd229bSGordon Ross "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + %u); ",
3933cd37da74Snw141292 req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
3934cd37da74Snw141292 req->id1name, req->id1domain,
393548cd229bSGordon Ross req->id1.idtype, state->name_cache_timeout);
3936c5c4113dSnw141292
3937c5c4113dSnw141292 if (sql == NULL) {
3938c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3939c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
3940c5c4113dSnw141292 goto out;
3941c5c4113dSnw141292 }
3942c5c4113dSnw141292
3943479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3944c5c4113dSnw141292
3945c5c4113dSnw141292 out:
394662c60062Sbaban if (sql != NULL)
3947c5c4113dSnw141292 sqlite_freemem(sql);
3948c5c4113dSnw141292 return (retcode);
3949c5c4113dSnw141292 }
3950c5c4113dSnw141292
3951cd37da74Snw141292 static
3952cd37da74Snw141292 idmap_retcode
lookup_cache_pid2sid(sqlite * cache,idmap_mapping * req,idmap_id_res * res,int is_user)3953c5c4113dSnw141292 lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res,
3954fe1c642dSBill Krier int is_user)
3955cd37da74Snw141292 {
3956c5c4113dSnw141292 char *end;
3957c5c4113dSnw141292 char *sql = NULL;
3958c5c4113dSnw141292 const char **values;
3959c5c4113dSnw141292 sqlite_vm *vm = NULL;
3960c5c4113dSnw141292 int ncol;
3961c5c4113dSnw141292 idmap_retcode retcode = IDMAP_SUCCESS;
3962c5c4113dSnw141292 time_t curtime;
3963e8c27ec8Sbaban idmap_id_type idtype;
3964c5c4113dSnw141292
3965c5c4113dSnw141292 /* Current time */
3966c5c4113dSnw141292 errno = 0;
3967c5c4113dSnw141292 if ((curtime = time(NULL)) == (time_t)-1) {
3968cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to get current time (%s)",
3969c5c4113dSnw141292 strerror(errno));
3970c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
3971c5c4113dSnw141292 goto out;
3972c5c4113dSnw141292 }
3973c5c4113dSnw141292
3974e8c27ec8Sbaban /* SQL to lookup the cache by pid or by unixname */
39759fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID) {
397648258c6bSjp151216 sql = sqlite_mprintf("SELECT sidprefix, rid, "
397748258c6bSjp151216 "canon_winname, windomain, w2u, is_wuser, "
397848258c6bSjp151216 "map_type, map_dn, map_attr, map_value, map_windomain, "
397948258c6bSjp151216 "map_winname, map_unixname, map_is_nt4 "
3980c5c4113dSnw141292 "FROM idmap_cache WHERE "
3981c5c4113dSnw141292 "pid = %u AND u2w = 1 AND is_user = %d AND "
3982c5c4113dSnw141292 "(pid >= 2147483648 OR "
3983c5c4113dSnw141292 "(expiration = 0 OR expiration ISNULL OR "
3984c5c4113dSnw141292 "expiration > %d));",
3985c5c4113dSnw141292 req->id1.idmap_id_u.uid, is_user, curtime);
3986e8c27ec8Sbaban } else if (req->id1name != NULL) {
398748258c6bSjp151216 sql = sqlite_mprintf("SELECT sidprefix, rid, "
398848258c6bSjp151216 "canon_winname, windomain, w2u, is_wuser, "
398948258c6bSjp151216 "map_type, map_dn, map_attr, map_value, map_windomain, "
399048258c6bSjp151216 "map_winname, map_unixname, map_is_nt4 "
3991e8c27ec8Sbaban "FROM idmap_cache WHERE "
3992e8c27ec8Sbaban "unixname = %Q AND u2w = 1 AND is_user = %d AND "
3993e8c27ec8Sbaban "(pid >= 2147483648 OR "
3994e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR "
3995e8c27ec8Sbaban "expiration > %d));",
3996e8c27ec8Sbaban req->id1name, is_user, curtime);
399748258c6bSjp151216 } else {
399848258c6bSjp151216 retcode = IDMAP_ERR_ARG;
399948258c6bSjp151216 goto out;
4000e8c27ec8Sbaban }
4001e8c27ec8Sbaban
4002c5c4113dSnw141292 if (sql == NULL) {
4003c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
4004c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
4005c5c4113dSnw141292 goto out;
4006c5c4113dSnw141292 }
400748258c6bSjp151216 retcode = sql_compile_n_step_once(
400848258c6bSjp151216 cache, sql, &vm, &ncol, 14, &values);
4009c5c4113dSnw141292 sqlite_freemem(sql);
4010c5c4113dSnw141292
4011c5c4113dSnw141292 if (retcode == IDMAP_ERR_NOTFOUND)
4012c5c4113dSnw141292 goto out;
4013c5c4113dSnw141292 else if (retcode == IDMAP_SUCCESS) {
4014c5c4113dSnw141292 /* sanity checks */
4015c5c4113dSnw141292 if (values[0] == NULL || values[1] == NULL) {
4016c5c4113dSnw141292 retcode = IDMAP_ERR_CACHE;
4017c5c4113dSnw141292 goto out;
4018c5c4113dSnw141292 }
4019c5c4113dSnw141292
4020e8c27ec8Sbaban switch (res->id.idtype) {
4021c5c4113dSnw141292 case IDMAP_SID:
4022cd37da74Snw141292 case IDMAP_USID:
4023cd37da74Snw141292 case IDMAP_GSID:
4024e8c27ec8Sbaban idtype = strtol(values[5], &end, 10) == 1
4025cd37da74Snw141292 ? IDMAP_USID : IDMAP_GSID;
4026cd37da74Snw141292
4027e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID &&
4028e8c27ec8Sbaban idtype != IDMAP_USID) {
4029cd37da74Snw141292 retcode = IDMAP_ERR_NOTUSER;
4030cd37da74Snw141292 goto out;
4031e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GSID &&
4032e8c27ec8Sbaban idtype != IDMAP_GSID) {
4033cd37da74Snw141292 retcode = IDMAP_ERR_NOTGROUP;
4034cd37da74Snw141292 goto out;
4035cd37da74Snw141292 }
4036e8c27ec8Sbaban res->id.idtype = idtype;
4037cd37da74Snw141292
4038c5c4113dSnw141292 res->id.idmap_id_u.sid.rid =
4039c5c4113dSnw141292 strtoul(values[1], &end, 10);
4040c5c4113dSnw141292 res->id.idmap_id_u.sid.prefix = strdup(values[0]);
4041c5c4113dSnw141292 if (res->id.idmap_id_u.sid.prefix == NULL) {
4042c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
4043c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
4044c5c4113dSnw141292 goto out;
4045c5c4113dSnw141292 }
4046c5c4113dSnw141292
404762c60062Sbaban if (values[4] != NULL)
4048c5c4113dSnw141292 res->direction =
4049651c0131Sbaban (strtol(values[4], &end, 10) == 0)?
4050651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
4051c5c4113dSnw141292 else
4052651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W;
4053c5c4113dSnw141292
4054fe1c642dSBill Krier if (values[2] == NULL)
4055c5c4113dSnw141292 break;
40568e228215Sdm199847 req->id2name = strdup(values[2]);
40578e228215Sdm199847 if (req->id2name == NULL) {
4058c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
4059c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
4060c5c4113dSnw141292 goto out;
4061c5c4113dSnw141292 }
4062c5c4113dSnw141292
4063c5c4113dSnw141292 if (values[3] == NULL)
4064c5c4113dSnw141292 break;
40658e228215Sdm199847 req->id2domain = strdup(values[3]);
40668e228215Sdm199847 if (req->id2domain == NULL) {
4067c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
4068c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
4069c5c4113dSnw141292 goto out;
4070c5c4113dSnw141292 }
4071cd37da74Snw141292
4072c5c4113dSnw141292 break;
4073c5c4113dSnw141292 default:
4074c5c4113dSnw141292 retcode = IDMAP_ERR_NOTSUPPORTED;
4075c5c4113dSnw141292 break;
4076c5c4113dSnw141292 }
407748258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
407848258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_CACHE;
407948258c6bSjp151216 res->info.how.map_type = strtoul(values[6], &end, 10);
408048258c6bSjp151216 switch (res->info.how.map_type) {
408148258c6bSjp151216 case IDMAP_MAP_TYPE_DS_AD:
408248258c6bSjp151216 res->info.how.idmap_how_u.ad.dn =
408348258c6bSjp151216 strdup(values[7]);
408448258c6bSjp151216 res->info.how.idmap_how_u.ad.attr =
408548258c6bSjp151216 strdup(values[8]);
408648258c6bSjp151216 res->info.how.idmap_how_u.ad.value =
408748258c6bSjp151216 strdup(values[9]);
408848258c6bSjp151216 break;
408948258c6bSjp151216
409048258c6bSjp151216 case IDMAP_MAP_TYPE_DS_NLDAP:
409148258c6bSjp151216 res->info.how.idmap_how_u.nldap.dn =
409248258c6bSjp151216 strdup(values[7]);
409348258c6bSjp151216 res->info.how.idmap_how_u.nldap.attr =
409448258c6bSjp151216 strdup(values[8]);
409548258c6bSjp151216 res->info.how.idmap_how_u.nldap.value =
409648258c6bSjp151216 strdup(values[9]);
409748258c6bSjp151216 break;
409848258c6bSjp151216
409948258c6bSjp151216 case IDMAP_MAP_TYPE_RULE_BASED:
410048258c6bSjp151216 res->info.how.idmap_how_u.rule.windomain =
410148258c6bSjp151216 strdup(values[10]);
410248258c6bSjp151216 res->info.how.idmap_how_u.rule.winname =
410348258c6bSjp151216 strdup(values[11]);
410448258c6bSjp151216 res->info.how.idmap_how_u.rule.unixname =
410548258c6bSjp151216 strdup(values[12]);
410648258c6bSjp151216 res->info.how.idmap_how_u.rule.is_nt4 =
410748258c6bSjp151216 strtoul(values[13], &end, 10);
410848258c6bSjp151216 res->info.how.idmap_how_u.rule.is_user =
410948258c6bSjp151216 is_user;
411048258c6bSjp151216 res->info.how.idmap_how_u.rule.is_wuser =
411148258c6bSjp151216 strtol(values[5], &end, 10);
411248258c6bSjp151216 break;
411348258c6bSjp151216
411448258c6bSjp151216 case IDMAP_MAP_TYPE_EPHEMERAL:
411548258c6bSjp151216 break;
411648258c6bSjp151216
411748258c6bSjp151216 case IDMAP_MAP_TYPE_LOCAL_SID:
411848258c6bSjp151216 break;
411948258c6bSjp151216
412048258c6bSjp151216 case IDMAP_MAP_TYPE_KNOWN_SID:
412148258c6bSjp151216 break;
412248258c6bSjp151216
4123e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU:
4124e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.dn =
4125e3f2c991SKeyur Desai strdup(values[7]);
4126e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.attr =
4127e3f2c991SKeyur Desai strdup(values[8]);
4128e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.value =
4129e3f2c991SKeyur Desai strdup(values[9]);
4130e3f2c991SKeyur Desai break;
4131e3f2c991SKeyur Desai
413248258c6bSjp151216 default:
4133e3f2c991SKeyur Desai /* Unknown mapping type */
413448258c6bSjp151216 assert(FALSE);
413548258c6bSjp151216 }
413648258c6bSjp151216 }
4137c5c4113dSnw141292 }
4138c5c4113dSnw141292
4139c5c4113dSnw141292 out:
414062c60062Sbaban if (vm != NULL)
4141c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL);
4142c5c4113dSnw141292 return (retcode);
4143c5c4113dSnw141292 }
4144c5c4113dSnw141292
414508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
414608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given:
414708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * cache sqlite handle
414808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name
414908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name
415008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
415108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Return: Error code
415208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
415308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname Canonical name (if canonname is non-NULL) [1]
415408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix [1]
415508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID
415608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *type Type of name
415708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
415808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error
415908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
4160cd37da74Snw141292 static
4161cd37da74Snw141292 idmap_retcode
lookup_cache_name2sid(sqlite * cache,const char * name,const char * domain,char ** canonname,char ** sidprefix,idmap_rid_t * rid,idmap_id_type * type)4162148c5f43SAlan Wright lookup_cache_name2sid(
4163148c5f43SAlan Wright sqlite *cache,
4164148c5f43SAlan Wright const char *name,
4165148c5f43SAlan Wright const char *domain,
4166148c5f43SAlan Wright char **canonname,
4167148c5f43SAlan Wright char **sidprefix,
4168148c5f43SAlan Wright idmap_rid_t *rid,
4169148c5f43SAlan Wright idmap_id_type *type)
4170cd37da74Snw141292 {
4171cd37da74Snw141292 char *end, *lower_name;
417208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *sql;
4173c5c4113dSnw141292 const char **values;
4174c5c4113dSnw141292 sqlite_vm *vm = NULL;
4175c5c4113dSnw141292 int ncol;
4176c5c4113dSnw141292 time_t curtime;
417708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode retcode;
417808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
417908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL;
418008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL)
418108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
4182c5c4113dSnw141292
4183c5c4113dSnw141292 /* Get current time */
4184c5c4113dSnw141292 errno = 0;
4185c5c4113dSnw141292 if ((curtime = time(NULL)) == (time_t)-1) {
4186cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to get current time (%s)",
4187c5c4113dSnw141292 strerror(errno));
4188c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
4189c5c4113dSnw141292 goto out;
4190c5c4113dSnw141292 }
4191c5c4113dSnw141292
4192c5c4113dSnw141292 /* SQL to lookup the cache */
4193cd37da74Snw141292 if ((lower_name = tolower_u8(name)) == NULL)
4194cd37da74Snw141292 lower_name = (char *)name;
4195cd37da74Snw141292 sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name "
4196cd37da74Snw141292 "FROM name_cache WHERE name = %Q AND domain = %Q AND "
4197c5c4113dSnw141292 "(expiration = 0 OR expiration ISNULL OR "
4198cd37da74Snw141292 "expiration > %d);", lower_name, domain, curtime);
4199cd37da74Snw141292 if (lower_name != name)
4200cd37da74Snw141292 free(lower_name);
4201c5c4113dSnw141292 if (sql == NULL) {
4202c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
4203c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
4204c5c4113dSnw141292 goto out;
4205c5c4113dSnw141292 }
4206cd37da74Snw141292 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values);
420708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
4208c5c4113dSnw141292 sqlite_freemem(sql);
4209c5c4113dSnw141292
421008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode != IDMAP_SUCCESS)
421108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out;
421208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
421362c60062Sbaban if (type != NULL) {
4214c5c4113dSnw141292 if (values[2] == NULL) {
4215c5c4113dSnw141292 retcode = IDMAP_ERR_CACHE;
4216c5c4113dSnw141292 goto out;
4217c5c4113dSnw141292 }
4218148c5f43SAlan Wright *type = xlate_legacy_type(strtol(values[2], &end, 10));
4219c5c4113dSnw141292 }
4220c5c4113dSnw141292
4221e8c27ec8Sbaban if (values[0] == NULL || values[1] == NULL) {
4222e8c27ec8Sbaban retcode = IDMAP_ERR_CACHE;
4223e8c27ec8Sbaban goto out;
4224e8c27ec8Sbaban }
4225e8c27ec8Sbaban
4226cd37da74Snw141292 if (canonname != NULL) {
4227cd37da74Snw141292 assert(values[3] != NULL);
422808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = strdup(values[3]);
422908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canonname == NULL) {
4230cd37da74Snw141292 idmapdlog(LOG_ERR, "Out of memory");
4231cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY;
4232cd37da74Snw141292 goto out;
4233cd37da74Snw141292 }
4234cd37da74Snw141292 }
4235cd37da74Snw141292
423608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(values[0]);
423708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*sidprefix == NULL) {
4238c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
4239c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
4240c5c4113dSnw141292 goto out;
4241c5c4113dSnw141292 }
4242c5c4113dSnw141292 *rid = strtoul(values[1], &end, 10);
424308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
424408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_SUCCESS;
4245c5c4113dSnw141292
4246c5c4113dSnw141292 out:
424762c60062Sbaban if (vm != NULL)
4248c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL);
424908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
425008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode != IDMAP_SUCCESS) {
425108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*sidprefix);
425208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL;
425308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
425408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname);
425508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
425608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
425708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
4258c5c4113dSnw141292 return (retcode);
4259c5c4113dSnw141292 }
4260c5c4113dSnw141292
4261cd37da74Snw141292 static
4262cd37da74Snw141292 idmap_retcode
ad_lookup_by_winname(lookup_state_t * state,const char * name,const char * domain,int esidtype,char ** dn,char ** attr,char ** value,char ** canonname,char ** sidprefix,idmap_rid_t * rid,idmap_id_type * wintype,char ** unixname)4263e8c27ec8Sbaban ad_lookup_by_winname(lookup_state_t *state,
4264148c5f43SAlan Wright const char *name, const char *domain, int esidtype,
426548258c6bSjp151216 char **dn, char **attr, char **value, char **canonname,
4266148c5f43SAlan Wright char **sidprefix, idmap_rid_t *rid, idmap_id_type *wintype,
426748258c6bSjp151216 char **unixname)
4268cd37da74Snw141292 {
42694d61c878SJulian Pullen int retries;
4270c5c4113dSnw141292 idmap_query_state_t *qs = NULL;
4271c5c4113dSnw141292 idmap_retcode rc, retcode;
42724d61c878SJulian Pullen int i;
42734d61c878SJulian Pullen int found_ad = 0;
4274c5c4113dSnw141292
42752b4a7802SBaban Kenkre RDLOCK_CONFIG();
4276e3f2c991SKeyur Desai if (_idmapdstate.num_gcs > 0) {
4277e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_gcs && !found_ad; i++) {
42784d61c878SJulian Pullen retries = 0;
42794d61c878SJulian Pullen retry:
4280e3f2c991SKeyur Desai retcode = idmap_lookup_batch_start(
4281e3f2c991SKeyur Desai _idmapdstate.gcs[i],
4282e3f2c991SKeyur Desai 1,
4283e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.directory_based_mapping,
4284e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.default_domain,
4285e3f2c991SKeyur Desai &qs);
4286e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
42872b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
42882b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES)
42890dcc7149Snw141292 goto retry;
42904d61c878SJulian Pullen degrade_svc(1, "failed to create request for "
42914d61c878SJulian Pullen "AD lookup by winname");
4292f4a94a44SGordon Ross UNLOCK_CONFIG();
4293e8c27ec8Sbaban return (retcode);
4294c5c4113dSnw141292 }
4295c5c4113dSnw141292
4296c8e26105Sjp151216 restore_svc();
4297c8e26105Sjp151216
42984d61c878SJulian Pullen if (state != NULL && i == 0) {
42994d61c878SJulian Pullen /*
43004d61c878SJulian Pullen * Directory based name mapping is only
43014d61c878SJulian Pullen * performed within the joined forest (i == 0).
43024d61c878SJulian Pullen * We don't trust other "trusted" forests to
43034d61c878SJulian Pullen * provide DS-based name mapping information
43044d61c878SJulian Pullen * because AD's definition of "cross-forest
43054d61c878SJulian Pullen * trust" does not encompass this sort of
43064d61c878SJulian Pullen * behavior.
43074d61c878SJulian Pullen */
43084d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs,
43094d61c878SJulian Pullen state->ad_unixuser_attr,
4310e8c27ec8Sbaban state->ad_unixgroup_attr);
43114d61c878SJulian Pullen }
4312c5c4113dSnw141292
43134d61c878SJulian Pullen retcode = idmap_name2sid_batch_add1(qs, name, domain,
4314148c5f43SAlan Wright esidtype, dn, attr, value, canonname, sidprefix,
4315e3f2c991SKeyur Desai rid, wintype, unixname, NULL, &rc);
43164d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) {
43174d61c878SJulian Pullen idmap_lookup_release_batch(&qs);
43184d61c878SJulian Pullen continue;
43194d61c878SJulian Pullen }
43204d61c878SJulian Pullen found_ad = 1;
4321e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS)
432284decf41Sjp151216 idmap_lookup_release_batch(&qs);
4323c5c4113dSnw141292 else
43240dcc7149Snw141292 retcode = idmap_lookup_batch_end(&qs);
4325c5c4113dSnw141292
43262b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
43272b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES)
4328c5c4113dSnw141292 goto retry;
4329c8e26105Sjp151216 else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
43304d61c878SJulian Pullen degrade_svc(1,
43314d61c878SJulian Pullen "some AD lookups timed out repeatedly");
43324d61c878SJulian Pullen }
43334d61c878SJulian Pullen } else {
43344d61c878SJulian Pullen /* No AD case */
43354d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
43364d61c878SJulian Pullen }
43374d61c878SJulian Pullen UNLOCK_CONFIG();
4338c5c4113dSnw141292
4339c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS) {
43409fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_NOTICE,
43419fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "AD lookup of winname %s@%s failed, error code %d",
43429fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States name == NULL ? "(null)" : name,
43439fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States domain == NULL ? "(null)" : domain,
43449fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States retcode);
4345c5c4113dSnw141292 return (retcode);
4346e8c27ec8Sbaban }
4347c5c4113dSnw141292 return (rc);
4348c5c4113dSnw141292 }
4349c5c4113dSnw141292
435008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
435108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given:
435208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * cache sqlite handle to cache
435308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name
435408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name
435508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * local_only if true, don't try AD lookups
435608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
435708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Returns: Error code
435808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
435908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname Canonical name (if non-NULL) [1]
436008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canondomain Canonical domain (if non-NULL) [1]
436108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix [1]
436208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID
436308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *req Request (direction is updated)
436408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
436508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error
436608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
4367cd37da74Snw141292 idmap_retcode
lookup_name2sid(sqlite * cache,const char * name,const char * domain,int want_wuser,char ** canonname,char ** canondomain,char ** sidprefix,idmap_rid_t * rid,idmap_id_type * type,idmap_mapping * req,int local_only)436808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_name2sid(
436908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States sqlite *cache,
437008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *name,
437108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *domain,
4372148c5f43SAlan Wright int want_wuser,
437308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canonname,
437408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canondomain,
437508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **sidprefix,
437608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *rid,
4377148c5f43SAlan Wright idmap_id_type *type,
437808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_mapping *req,
437908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int local_only)
4380cd37da74Snw141292 {
4381c5c4113dSnw141292 idmap_retcode retcode;
4382c5c4113dSnw141292
4383cd37da74Snw141292 *sidprefix = NULL;
4384e8c27ec8Sbaban if (canonname != NULL)
4385cd37da74Snw141292 *canonname = NULL;
438608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL)
438708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL;
4388cd37da74Snw141292
4389e8c27ec8Sbaban /* Lookup well-known SIDs table */
439008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = lookup_wksids_name2sid(name, domain, canonname, canondomain,
4391148c5f43SAlan Wright sidprefix, rid, type);
439262c60062Sbaban if (retcode == IDMAP_SUCCESS) {
4393e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
439462c60062Sbaban goto out;
439562c60062Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) {
439662c60062Sbaban return (retcode);
439762c60062Sbaban }
439862c60062Sbaban
4399e8c27ec8Sbaban /* Lookup cache */
4400cd37da74Snw141292 retcode = lookup_cache_name2sid(cache, name, domain, canonname,
4401148c5f43SAlan Wright sidprefix, rid, type);
4402e8c27ec8Sbaban if (retcode == IDMAP_SUCCESS) {
4403e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
4404e8c27ec8Sbaban goto out;
4405e8c27ec8Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) {
4406e8c27ec8Sbaban return (retcode);
4407e8c27ec8Sbaban }
4408e8c27ec8Sbaban
4409479ac375Sdm199847 /*
4410479ac375Sdm199847 * The caller may be using this function to determine if this
4411479ac375Sdm199847 * request needs to be marked for AD lookup or not
4412479ac375Sdm199847 * (i.e. _IDMAP_F_LOOKUP_AD) and therefore may not want this
4413479ac375Sdm199847 * function to AD lookup now.
4414479ac375Sdm199847 */
4415479ac375Sdm199847 if (local_only)
4416479ac375Sdm199847 return (retcode);
4417479ac375Sdm199847
4418148c5f43SAlan Wright if (_idmapdstate.cfg->pgcfg.use_lsa &&
4419148c5f43SAlan Wright _idmapdstate.cfg->pgcfg.domain_name != NULL &&
4420148c5f43SAlan Wright name != NULL && *sidprefix == NULL) {
4421148c5f43SAlan Wright retcode = lookup_lsa_by_name(name, domain,
4422148c5f43SAlan Wright sidprefix, rid,
4423148c5f43SAlan Wright canonname, canondomain,
4424148c5f43SAlan Wright type);
4425148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS)
4426148c5f43SAlan Wright goto out;
4427148c5f43SAlan Wright else if (retcode != IDMAP_ERR_NOTFOUND)
4428148c5f43SAlan Wright return (retcode);
4429148c5f43SAlan Wright }
4430148c5f43SAlan Wright
4431e8c27ec8Sbaban /* Lookup AD */
4432148c5f43SAlan Wright retcode = ad_lookup_by_winname(NULL, name, domain, IDMAP_POSIXID,
4433148c5f43SAlan Wright NULL, NULL, NULL, canonname, sidprefix, rid, type, NULL);
4434c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS)
4435c5c4113dSnw141292 return (retcode);
4436c5c4113dSnw141292
443762c60062Sbaban out:
4438c5c4113dSnw141292 /*
4439c5c4113dSnw141292 * Entry found (cache or Windows lookup)
4440c5c4113dSnw141292 */
4441148c5f43SAlan Wright if (want_wuser == 1 && *type != IDMAP_USID)
4442e8c27ec8Sbaban retcode = IDMAP_ERR_NOTUSER;
4443148c5f43SAlan Wright else if (want_wuser == 0 && *type != IDMAP_GSID)
4444e8c27ec8Sbaban retcode = IDMAP_ERR_NOTGROUP;
4445148c5f43SAlan Wright else if (want_wuser == -1) {
4446148c5f43SAlan Wright /*
4447148c5f43SAlan Wright * Caller wants to know if its user or group
4448148c5f43SAlan Wright * Verify that it's one or the other.
4449148c5f43SAlan Wright */
4450148c5f43SAlan Wright if (*type != IDMAP_USID && *type != IDMAP_GSID)
4451e8c27ec8Sbaban retcode = IDMAP_ERR_SID;
4452e8c27ec8Sbaban }
4453e8c27ec8Sbaban
445408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode == IDMAP_SUCCESS) {
445508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
445608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we were asked for a canonical domain and none
445708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * of the searches have provided one, assume it's the
445808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * supplied domain.
445908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
446008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL && *canondomain == NULL) {
446108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(domain);
446208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canondomain == NULL)
446308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_MEMORY;
446408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
446508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
4466e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
4467cd37da74Snw141292 free(*sidprefix);
4468cd37da74Snw141292 *sidprefix = NULL;
4469e8c27ec8Sbaban if (canonname != NULL) {
4470cd37da74Snw141292 free(*canonname);
4471cd37da74Snw141292 *canonname = NULL;
4472cd37da74Snw141292 }
447308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) {
447408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canondomain);
447508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL;
447608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
4477c5c4113dSnw141292 }
4478c5c4113dSnw141292 return (retcode);
4479c5c4113dSnw141292 }
4480c5c4113dSnw141292
4481cd37da74Snw141292 static
4482cd37da74Snw141292 idmap_retcode
name_based_mapping_pid2sid(lookup_state_t * state,const char * unixname,int is_user,idmap_mapping * req,idmap_id_res * res)4483479ac375Sdm199847 name_based_mapping_pid2sid(lookup_state_t *state, const char *unixname,
4484cd37da74Snw141292 int is_user, idmap_mapping *req, idmap_id_res *res)
4485cd37da74Snw141292 {
4486c5c4113dSnw141292 const char *winname, *windomain;
4487cd37da74Snw141292 char *canonname;
448808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canondomain;
4489c5c4113dSnw141292 char *sql = NULL, *errmsg = NULL;
4490c5c4113dSnw141292 idmap_retcode retcode;
4491c5c4113dSnw141292 char *end;
4492c5c4113dSnw141292 const char **values;
4493c5c4113dSnw141292 sqlite_vm *vm = NULL;
449448258c6bSjp151216 int ncol, r;
4495148c5f43SAlan Wright int want_wuser;
4496e8c27ec8Sbaban const char *me = "name_based_mapping_pid2sid";
449748258c6bSjp151216 idmap_namerule *rule = &res->info.how.idmap_how_u.rule;
449848258c6bSjp151216 int direction;
4499e8c27ec8Sbaban
4500e8c27ec8Sbaban assert(unixname != NULL); /* We have unixname */
4501e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have winname */
4502e8c27ec8Sbaban assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */
4503c5c4113dSnw141292
4504c5c4113dSnw141292 sql = sqlite_mprintf(
450548258c6bSjp151216 "SELECT winname_display, windomain, w2u_order, "
450648258c6bSjp151216 "is_wuser, unixname, is_nt4 "
450748258c6bSjp151216 "FROM namerules WHERE "
4508c5c4113dSnw141292 "u2w_order > 0 AND is_user = %d AND "
4509c5c4113dSnw141292 "(unixname = %Q OR unixname = '*') "
4510cd37da74Snw141292 "ORDER BY u2w_order ASC;", is_user, unixname);
4511c5c4113dSnw141292 if (sql == NULL) {
4512c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory");
4513c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY;
4514c5c4113dSnw141292 goto out;
4515c5c4113dSnw141292 }
4516c5c4113dSnw141292
4517479ac375Sdm199847 if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
4518c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
4519cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: database error (%s)", me,
4520cd37da74Snw141292 CHECK_NULL(errmsg));
4521c5c4113dSnw141292 sqlite_freemem(errmsg);
4522c5c4113dSnw141292 goto out;
4523c5c4113dSnw141292 }
4524c5c4113dSnw141292
452548258c6bSjp151216 for (;;) {
4526c5c4113dSnw141292 r = sqlite_step(vm, &ncol, &values, NULL);
452784decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
452884decf41Sjp151216 if (r == SQLITE_ROW) {
452948258c6bSjp151216 if (ncol < 6) {
4530c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
4531c5c4113dSnw141292 goto out;
4532c5c4113dSnw141292 }
4533148c5f43SAlan Wright
4534148c5f43SAlan Wright TRACE(req, res, "Matching rule: %s -> %s@%s",
4535148c5f43SAlan Wright values[4] == NULL ? "(null)" : values[4],
4536148c5f43SAlan Wright values[0] == NULL ? "(null)" : values[0],
4537148c5f43SAlan Wright values[1] == NULL ? "(null)" : values[1]);
4538148c5f43SAlan Wright
4539c5c4113dSnw141292 if (values[0] == NULL) {
4540c5c4113dSnw141292 /* values [1] and [2] can be null */
4541c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
4542c5c4113dSnw141292 goto out;
4543c5c4113dSnw141292 }
454448258c6bSjp151216
454548258c6bSjp151216 if (values[2] != NULL)
454648258c6bSjp151216 direction =
454748258c6bSjp151216 (strtol(values[2], &end, 10) == 0)?
454848258c6bSjp151216 IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
454948258c6bSjp151216 else
455048258c6bSjp151216 direction = IDMAP_DIRECTION_U2W;
455148258c6bSjp151216
4552c5c4113dSnw141292 if (EMPTY_NAME(values[0])) {
455348258c6bSjp151216 idmap_namerule_set(rule, values[1], values[0],
455448258c6bSjp151216 values[4], is_user,
455548258c6bSjp151216 strtol(values[3], &end, 10),
455648258c6bSjp151216 strtol(values[5], &end, 10),
455748258c6bSjp151216 direction);
4558148c5f43SAlan Wright TRACE(req, res, "Mapping inhibited");
4559c5c4113dSnw141292 retcode = IDMAP_ERR_NOMAPPING;
4560c5c4113dSnw141292 goto out;
4561c5c4113dSnw141292 }
4562cd37da74Snw141292
4563cd37da74Snw141292 if (values[0][0] == '*') {
456448258c6bSjp151216 winname = unixname;
4565cd37da74Snw141292 } else {
4566cd37da74Snw141292 winname = values[0];
4567cd37da74Snw141292 }
4568cb174861Sjoyce mcintosh
4569148c5f43SAlan Wright want_wuser = res->id.idtype == IDMAP_USID ? 1
457048258c6bSjp151216 : res->id.idtype == IDMAP_GSID ? 0
457148258c6bSjp151216 : -1;
457262c60062Sbaban if (values[1] != NULL)
4573c5c4113dSnw141292 windomain = values[1];
4574148c5f43SAlan Wright else if (state->defdom != NULL) {
4575479ac375Sdm199847 windomain = state->defdom;
4576148c5f43SAlan Wright TRACE(req, res,
4577148c5f43SAlan Wright "Added default domain %s to rule",
4578148c5f43SAlan Wright windomain);
4579148c5f43SAlan Wright } else {
4580cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: no domain", me);
4581148c5f43SAlan Wright TRACE(req, res,
4582148c5f43SAlan Wright "No domain in rule, and no default domain");
4583c5c4113dSnw141292 retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
4584c5c4113dSnw141292 goto out;
4585c5c4113dSnw141292 }
4586cd37da74Snw141292
4587479ac375Sdm199847 retcode = lookup_name2sid(state->cache,
4588479ac375Sdm199847 winname, windomain,
4589148c5f43SAlan Wright want_wuser, &canonname, &canondomain,
4590cd37da74Snw141292 &res->id.idmap_id_u.sid.prefix,
4591148c5f43SAlan Wright &res->id.idmap_id_u.sid.rid,
4592148c5f43SAlan Wright &res->id.idtype, req, 0);
4593e8c27ec8Sbaban
4594148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
4595148c5f43SAlan Wright break;
4596148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) {
4597cb174861Sjoyce mcintosh if (values[0][0] == '*') {
4598148c5f43SAlan Wright TRACE(req, res,
4599148c5f43SAlan Wright "%s@%s not found, continuing",
4600148c5f43SAlan Wright winname, windomain);
4601c5c4113dSnw141292 continue;
4602148c5f43SAlan Wright } else {
4603148c5f43SAlan Wright TRACE(req, res,
4604cb174861Sjoyce mcintosh "%s@%s not found",
4605cb174861Sjoyce mcintosh winname, windomain);
4606cb174861Sjoyce mcintosh retcode = IDMAP_ERR_NOMAPPING;
4607cb174861Sjoyce mcintosh }
4608cb174861Sjoyce mcintosh } else {
4609cb174861Sjoyce mcintosh TRACE(req, res,
4610148c5f43SAlan Wright "Looking up %s@%s error=%d",
4611148c5f43SAlan Wright winname, windomain, retcode);
4612c5c4113dSnw141292 }
4613148c5f43SAlan Wright
4614cb174861Sjoyce mcintosh idmap_namerule_set(rule, values[1],
4615cb174861Sjoyce mcintosh values[0], values[4], is_user,
4616cb174861Sjoyce mcintosh strtol(values[3], &end, 10),
4617cb174861Sjoyce mcintosh strtol(values[5], &end, 10),
4618cb174861Sjoyce mcintosh direction);
4619cb174861Sjoyce mcintosh
4620c5c4113dSnw141292 goto out;
462148258c6bSjp151216
4622c5c4113dSnw141292 } else if (r == SQLITE_DONE) {
4623cb174861Sjoyce mcintosh TRACE(req, res, "No matching rule");
4624c5c4113dSnw141292 retcode = IDMAP_ERR_NOTFOUND;
4625c5c4113dSnw141292 goto out;
4626c5c4113dSnw141292 } else {
4627c5c4113dSnw141292 (void) sqlite_finalize(vm, &errmsg);
4628c5c4113dSnw141292 vm = NULL;
4629cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: database error (%s)", me,
4630cd37da74Snw141292 CHECK_NULL(errmsg));
4631c5c4113dSnw141292 sqlite_freemem(errmsg);
4632c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL;
4633c5c4113dSnw141292 goto out;
4634c5c4113dSnw141292 }
4635c5c4113dSnw141292 }
4636c5c4113dSnw141292
463762c60062Sbaban if (values[2] != NULL)
4638c5c4113dSnw141292 res->direction =
4639651c0131Sbaban (strtol(values[2], &end, 10) == 0)?
4640651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
4641c5c4113dSnw141292 else
4642651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W;
46438e228215Sdm199847
4644cd37da74Snw141292 req->id2name = canonname;
464508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id2domain = canondomain;
4646479ac375Sdm199847
464748258c6bSjp151216 idmap_namerule_set(rule, values[1], values[0], values[4],
464848258c6bSjp151216 is_user, strtol(values[3], &end, 10),
464948258c6bSjp151216 strtol(values[5], &end, 10),
465048258c6bSjp151216 rule->direction);
4651148c5f43SAlan Wright TRACE(req, res, "Windows name found");
4652148c5f43SAlan Wright
4653148c5f43SAlan Wright out:
4654148c5f43SAlan Wright if (sql != NULL)
4655148c5f43SAlan Wright sqlite_freemem(sql);
4656fc724630SAlan Wright
4657fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) {
4658fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED;
465948258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW;
4660c5c4113dSnw141292 }
4661fc724630SAlan Wright
466262c60062Sbaban if (vm != NULL)
4663c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL);
4664c5c4113dSnw141292 return (retcode);
4665c5c4113dSnw141292 }
4666c5c4113dSnw141292
4667cd37da74Snw141292 /*
4668cd37da74Snw141292 * Convention when processing unix2win requests:
4669cd37da74Snw141292 *
4670cd37da74Snw141292 * Unix identity:
4671cd37da74Snw141292 * req->id1name =
4672cd37da74Snw141292 * unixname if given otherwise unixname found will be placed
4673cd37da74Snw141292 * here.
4674cd37da74Snw141292 * req->id1domain =
4675cd37da74Snw141292 * NOT USED
4676cd37da74Snw141292 * req->id1.idtype =
4677cd37da74Snw141292 * Given type (IDMAP_UID or IDMAP_GID)
4678cd37da74Snw141292 * req->id1..[uid or gid] =
4679cd37da74Snw141292 * UID/GID if given otherwise UID/GID found will be placed here.
4680cd37da74Snw141292 *
4681cd37da74Snw141292 * Windows identity:
4682cd37da74Snw141292 * req->id2name =
4683cd37da74Snw141292 * winname found will be placed here.
4684cd37da74Snw141292 * req->id2domain =
4685cd37da74Snw141292 * windomain found will be placed here.
4686cd37da74Snw141292 * res->id.idtype =
4687cd37da74Snw141292 * Target type initialized from req->id2.idtype. If
4688cd37da74Snw141292 * it is IDMAP_SID then actual type (IDMAP_USID/GSID) found
4689cd37da74Snw141292 * will be placed here.
4690cd37da74Snw141292 * req->id..sid.[prefix, rid] =
4691cd37da74Snw141292 * SID found will be placed here.
4692cd37da74Snw141292 *
4693cd37da74Snw141292 * Others:
4694cd37da74Snw141292 * res->retcode =
4695cd37da74Snw141292 * Return status for this request will be placed here.
4696cd37da74Snw141292 * res->direction =
4697cd37da74Snw141292 * Direction found will be placed here. Direction
4698cd37da74Snw141292 * meaning whether the resultant mapping is valid
4699cd37da74Snw141292 * only from unix2win or bi-directional.
4700cd37da74Snw141292 * req->direction =
4701cd37da74Snw141292 * INTERNAL USE. Used by idmapd to set various
4702cd37da74Snw141292 * flags (_IDMAP_F_xxxx) to aid in processing
4703cd37da74Snw141292 * of the request.
4704cd37da74Snw141292 * req->id2.idtype =
4705cd37da74Snw141292 * INTERNAL USE. Initially this is the requested target
4706cd37da74Snw141292 * type and is used to initialize res->id.idtype.
4707cd37da74Snw141292 * ad_lookup_batch() uses this field temporarily to store
4708cd37da74Snw141292 * sid_type obtained by the batched AD lookups and after
4709cd37da74Snw141292 * use resets it to IDMAP_NONE to prevent xdr from
4710cd37da74Snw141292 * mis-interpreting the contents of req->id2.
4711cd37da74Snw141292 * req->id2..[uid or gid or sid] =
4712cd37da74Snw141292 * NOT USED
4713cd37da74Snw141292 */
4714cd37da74Snw141292
4715cd37da74Snw141292 /*
4716cd37da74Snw141292 * This function does the following:
4717cd37da74Snw141292 * 1. Lookup well-known SIDs table.
4718cd37da74Snw141292 * 2. Lookup cache.
4719cd37da74Snw141292 * 3. Check if the client does not want new mapping to be allocated
4720cd37da74Snw141292 * in which case this pass is the final pass.
4721e8c27ec8Sbaban * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs
4722e8c27ec8Sbaban * to do AD/NLDAP lookup.
4723cd37da74Snw141292 */
4724c5c4113dSnw141292 idmap_retcode
pid2sid_first_pass(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res,int is_user)4725479ac375Sdm199847 pid2sid_first_pass(lookup_state_t *state, idmap_mapping *req,
4726fe1c642dSBill Krier idmap_id_res *res, int is_user)
4727cd37da74Snw141292 {
4728e8c27ec8Sbaban idmap_retcode retcode;
4729148c5f43SAlan Wright idmap_retcode retcode2;
4730e8c27ec8Sbaban bool_t gen_localsid_on_err = FALSE;
4731c5c4113dSnw141292
4732e8c27ec8Sbaban /* Initialize result */
4733c5c4113dSnw141292 res->id.idtype = req->id2.idtype;
4734e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF;
4735c5c4113dSnw141292
4736e8c27ec8Sbaban if (req->id2.idmap_id_u.sid.prefix != NULL) {
4737e8c27ec8Sbaban /* sanitize sidprefix */
4738e8c27ec8Sbaban free(req->id2.idmap_id_u.sid.prefix);
4739e8c27ec8Sbaban req->id2.idmap_id_u.sid.prefix = NULL;
4740e8c27ec8Sbaban }
4741e8c27ec8Sbaban
474248258c6bSjp151216 /* Find pid */
47439fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.uid == IDMAP_SENTINEL_PID) {
4744fe1c642dSBill Krier if (req->id1name == NULL) {
4745fe1c642dSBill Krier retcode = IDMAP_ERR_ARG;
4746fe1c642dSBill Krier goto out;
4747fe1c642dSBill Krier }
4748fe1c642dSBill Krier
4749148c5f43SAlan Wright retcode = ns_lookup_byname(req->id1name, NULL, &req->id1);
4750148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) {
4751148c5f43SAlan Wright TRACE(req, res, "Getting UNIX ID error=%d", retcode);
475248258c6bSjp151216 retcode = IDMAP_ERR_NOMAPPING;
475348258c6bSjp151216 goto out;
475448258c6bSjp151216 }
4755148c5f43SAlan Wright TRACE(req, res, "Found UNIX ID");
475648258c6bSjp151216 }
475748258c6bSjp151216
475808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup in well-known SIDs table */
4759c5c4113dSnw141292 retcode = lookup_wksids_pid2sid(req, res, is_user);
4760148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
4761148c5f43SAlan Wright TRACE(req, res, "Hardwired mapping");
4762c5c4113dSnw141292 goto out;
4763148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
4764148c5f43SAlan Wright TRACE(req, res,
4765148c5f43SAlan Wright "Well-known account lookup error=%d", retcode);
4766148c5f43SAlan Wright goto out;
4767148c5f43SAlan Wright }
4768c5c4113dSnw141292
476908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup in cache */
4770fe1c642dSBill Krier retcode = lookup_cache_pid2sid(state->cache, req, res, is_user);
4771148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
4772148c5f43SAlan Wright TRACE(req, res, "Found in mapping cache");
4773c5c4113dSnw141292 goto out;
4774148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
4775148c5f43SAlan Wright TRACE(req, res,
4776148c5f43SAlan Wright "Mapping cache lookup error=%d", retcode);
4777148c5f43SAlan Wright goto out;
4778148c5f43SAlan Wright }
4779148c5f43SAlan Wright TRACE(req, res, "Not found in mapping cache");
4780c5c4113dSnw141292
4781c5c4113dSnw141292 /* Ephemeral ids cannot be allocated during pid2sid */
47829fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (IDMAP_ID_IS_EPHEMERAL(req->id1.idmap_id_u.uid)) {
478362c60062Sbaban retcode = IDMAP_ERR_NOMAPPING;
4784148c5f43SAlan Wright TRACE(req, res, "Shouldn't have an ephemeral ID here");
4785c5c4113dSnw141292 goto out;
4786c5c4113dSnw141292 }
4787c5c4113dSnw141292
478848258c6bSjp151216 if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) {
47894d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED;
479048258c6bSjp151216 goto out;
479148258c6bSjp151216 }
479248258c6bSjp151216
479348258c6bSjp151216 if (AVOID_NAMESERVICE(req)) {
4794e8c27ec8Sbaban gen_localsid_on_err = TRUE;
479562c60062Sbaban retcode = IDMAP_ERR_NOMAPPING;
4796c5c4113dSnw141292 goto out;
4797c5c4113dSnw141292 }
4798c5c4113dSnw141292
4799e8c27ec8Sbaban /* Set flags for the next stage */
4800e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) {
4801e3f2c991SKeyur Desai req->direction |= _IDMAP_F_LOOKUP_AD;
4802e3f2c991SKeyur Desai state->ad_nqueries++;
4803e3f2c991SKeyur Desai } else if (AD_MODE(req->id1.idtype, state)) {
4804e8c27ec8Sbaban /*
4805e8c27ec8Sbaban * If AD-based name mapping is enabled then the next stage
4806e8c27ec8Sbaban * will need to lookup AD using unixname to get the
4807e8c27ec8Sbaban * corresponding winname.
4808e8c27ec8Sbaban */
4809e8c27ec8Sbaban if (req->id1name == NULL) {
4810e8c27ec8Sbaban /* Get unixname if only pid is given. */
4811e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid,
4812e8c27ec8Sbaban is_user, &req->id1name);
4813479ac375Sdm199847 if (retcode != IDMAP_SUCCESS) {
4814148c5f43SAlan Wright TRACE(req, res,
4815148c5f43SAlan Wright "Getting UNIX name error=%d", retcode);
4816479ac375Sdm199847 gen_localsid_on_err = TRUE;
4817e8c27ec8Sbaban goto out;
4818c5c4113dSnw141292 }
4819148c5f43SAlan Wright TRACE(req, res, "Found UNIX name");
4820479ac375Sdm199847 }
4821e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD;
4822e8c27ec8Sbaban state->ad_nqueries++;
4823e8c27ec8Sbaban } else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) {
4824e8c27ec8Sbaban /*
4825e8c27ec8Sbaban * If native LDAP or mixed mode is enabled for name mapping
4826e8c27ec8Sbaban * then the next stage will need to lookup native LDAP using
4827e8c27ec8Sbaban * unixname/pid to get the corresponding winname.
4828e8c27ec8Sbaban */
4829e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_NLDAP;
4830e8c27ec8Sbaban state->nldap_nqueries++;
4831c5c4113dSnw141292 }
4832c5c4113dSnw141292
4833e8c27ec8Sbaban /*
4834e8c27ec8Sbaban * Failed to find non-expired entry in cache. Set the flag to
4835e8c27ec8Sbaban * indicate that we are not done yet.
4836e8c27ec8Sbaban */
4837e8c27ec8Sbaban state->pid2sid_done = FALSE;
4838e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE;
4839e8c27ec8Sbaban retcode = IDMAP_SUCCESS;
4840e8c27ec8Sbaban
4841e8c27ec8Sbaban out:
4842e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode);
4843148c5f43SAlan Wright if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) {
4844148c5f43SAlan Wright if (gen_localsid_on_err == TRUE) {
4845148c5f43SAlan Wright retcode2 = generate_localsid(req, res, is_user, TRUE);
4846148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS)
4847148c5f43SAlan Wright TRACE(req, res, "Generate local SID");
4848148c5f43SAlan Wright else
4849148c5f43SAlan Wright TRACE(req, res,
4850148c5f43SAlan Wright "Generate local SID error=%d", retcode2);
4851148c5f43SAlan Wright }
4852148c5f43SAlan Wright }
4853e8c27ec8Sbaban return (retcode);
4854e8c27ec8Sbaban }
4855e8c27ec8Sbaban
4856e8c27ec8Sbaban idmap_retcode
pid2sid_second_pass(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res,int is_user)4857479ac375Sdm199847 pid2sid_second_pass(lookup_state_t *state, idmap_mapping *req,
4858479ac375Sdm199847 idmap_id_res *res, int is_user)
4859e8c27ec8Sbaban {
4860e8c27ec8Sbaban bool_t gen_localsid_on_err = TRUE;
4861e8c27ec8Sbaban idmap_retcode retcode = IDMAP_SUCCESS;
4862148c5f43SAlan Wright idmap_retcode retcode2;
4863e8c27ec8Sbaban
4864e8c27ec8Sbaban /* Check if second pass is needed */
4865e8c27ec8Sbaban if (ARE_WE_DONE(req->direction))
4866e8c27ec8Sbaban return (res->retcode);
4867e8c27ec8Sbaban
4868e8c27ec8Sbaban /* Get status from previous pass */
4869e8c27ec8Sbaban retcode = res->retcode;
4870e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS)
4871e8c27ec8Sbaban goto out;
4872e8c27ec8Sbaban
4873e8c27ec8Sbaban /*
4874e8c27ec8Sbaban * If directory-based name mapping is enabled then the winname
4875e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode)
4876479ac375Sdm199847 * or from native LDAP object (nldap-mode or mixed-mode).
4877479ac375Sdm199847 * Note that if we have winname but no SID then it's an error
4878479ac375Sdm199847 * because this implies that the Native LDAP entry contains
4879479ac375Sdm199847 * winname which does not exist and it's better that we return
4880479ac375Sdm199847 * an error instead of doing rule-based mapping so that the user
4881479ac375Sdm199847 * can detect the issue and take appropriate action.
4882e8c27ec8Sbaban */
4883479ac375Sdm199847 if (req->id2name != NULL) {
4884479ac375Sdm199847 /* Return notfound if we've winname but no SID. */
4885479ac375Sdm199847 if (res->id.idmap_id_u.sid.prefix == NULL) {
4886148c5f43SAlan Wright TRACE(req, res, "Windows name but no SID");
4887479ac375Sdm199847 retcode = IDMAP_ERR_NOTFOUND;
4888479ac375Sdm199847 goto out;
4889479ac375Sdm199847 }
4890e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU)
4891e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI;
4892e3f2c991SKeyur Desai else if (AD_MODE(req->id1.idtype, state))
4893e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
4894e8c27ec8Sbaban else if (NLDAP_MODE(req->id1.idtype, state))
4895e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
4896e8c27ec8Sbaban else if (MIXED_MODE(req->id1.idtype, state))
4897e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U;
4898e8c27ec8Sbaban goto out;
4899479ac375Sdm199847 } else if (res->id.idmap_id_u.sid.prefix != NULL) {
4900479ac375Sdm199847 /*
4901479ac375Sdm199847 * We've SID but no winname. This is fine because
4902479ac375Sdm199847 * the caller may have only requested SID.
4903479ac375Sdm199847 */
4904479ac375Sdm199847 goto out;
4905e8c27ec8Sbaban }
4906e8c27ec8Sbaban
4907479ac375Sdm199847 /* Free any mapping info from Directory based mapping */
4908479ac375Sdm199847 if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN)
4909148c5f43SAlan Wright idmap_how_clear(&res->info.how);
4910479ac375Sdm199847
4911e8c27ec8Sbaban if (req->id1name == NULL) {
4912e8c27ec8Sbaban /* Get unixname from name service */
4913e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user,
4914e8c27ec8Sbaban &req->id1name);
4915148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) {
4916148c5f43SAlan Wright TRACE(req, res,
4917148c5f43SAlan Wright "Getting UNIX name error=%d", retcode);
4918e8c27ec8Sbaban goto out;
4919148c5f43SAlan Wright }
4920148c5f43SAlan Wright TRACE(req, res, "Found UNIX name");
49219fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } else if (req->id1.idmap_id_u.uid == IDMAP_SENTINEL_PID) {
4922e8c27ec8Sbaban /* Get pid from name service */
4923e8c27ec8Sbaban retcode = ns_lookup_byname(req->id1name, NULL, &req->id1);
4924e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
4925148c5f43SAlan Wright TRACE(req, res,
4926148c5f43SAlan Wright "Getting UNIX ID error=%d", retcode);
4927e8c27ec8Sbaban gen_localsid_on_err = FALSE;
4928e8c27ec8Sbaban goto out;
4929e8c27ec8Sbaban }
4930148c5f43SAlan Wright TRACE(req, res, "Found UNIX ID");
4931e8c27ec8Sbaban }
4932e8c27ec8Sbaban
4933e8c27ec8Sbaban /* Use unixname to evaluate local name-based mapping rules */
4934479ac375Sdm199847 retcode = name_based_mapping_pid2sid(state, req->id1name, is_user,
4935c5c4113dSnw141292 req, res);
4936c5c4113dSnw141292 if (retcode == IDMAP_ERR_NOTFOUND) {
493748258c6bSjp151216 retcode = generate_localsid(req, res, is_user, FALSE);
4938148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
4939148c5f43SAlan Wright TRACE(req, res, "Generated local SID");
4940148c5f43SAlan Wright } else {
4941148c5f43SAlan Wright TRACE(req, res,
4942148c5f43SAlan Wright "Generating local SID error=%d", retcode);
4943148c5f43SAlan Wright }
4944e8c27ec8Sbaban gen_localsid_on_err = FALSE;
4945e8c27ec8Sbaban }
4946c5c4113dSnw141292
4947c5c4113dSnw141292 out:
4948c5c4113dSnw141292 res->retcode = idmap_stat4prot(retcode);
4949e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) {
4950e8c27ec8Sbaban req->direction = _IDMAP_F_DONE;
4951479ac375Sdm199847 free(req->id2name);
4952479ac375Sdm199847 req->id2name = NULL;
4953479ac375Sdm199847 free(req->id2domain);
4954479ac375Sdm199847 req->id2domain = NULL;
4955148c5f43SAlan Wright if (gen_localsid_on_err == TRUE) {
4956148c5f43SAlan Wright retcode2 = generate_localsid(req, res, is_user, TRUE);
4957148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS)
4958148c5f43SAlan Wright TRACE(req, res, "Generate local SID");
4959479ac375Sdm199847 else
4960148c5f43SAlan Wright TRACE(req, res,
4961148c5f43SAlan Wright "Generate local SID error=%d", retcode2);
4962148c5f43SAlan Wright } else {
4963479ac375Sdm199847 res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
4964e8c27ec8Sbaban }
4965148c5f43SAlan Wright }
4966e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction))
4967e8c27ec8Sbaban state->pid2sid_done = FALSE;
4968c5c4113dSnw141292 return (retcode);
4969c5c4113dSnw141292 }
49709fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49719fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode
idmap_cache_flush(idmap_flush_op op)49729fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_cache_flush(idmap_flush_op op)
49739fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States {
49749fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode rc;
49759fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sqlite *cache = NULL;
49769fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States char *sql1;
49779fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States char *sql2;
49789fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49799fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States switch (op) {
49809fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_FLUSH_EXPIRE:
49819fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql1 =
49829fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "UPDATE idmap_cache SET expiration=1 WHERE expiration>0;";
49839fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql2 =
49849fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "UPDATE name_cache SET expiration=1 WHERE expiration>0;";
49859fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States break;
49869fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49879fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_FLUSH_DELETE:
49889fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql1 = "DELETE FROM idmap_cache;";
49899fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql2 = "DELETE FROM name_cache;";
49909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States break;
49919fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States default:
49939fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_INTERNAL);
49949fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States }
49959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49969fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = get_cache_handle(&cache);
49979fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (rc != IDMAP_SUCCESS)
49989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc);
49999fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
50009fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States /*
50019fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Note that we flush the idmapd cache first, before the kernel
50029fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * cache. If we did it the other way 'round, a request could come
50039fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * in after the kernel cache flush and pull a soon-to-be-flushed
50049fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * idmapd cache entry back into the kernel cache. This way the
50059fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * worst that will happen is that a new entry will be added to
50069fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * the kernel cache and then immediately flushed.
50079fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States */
50089fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
50099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql1);
5010*e3d9e7f3SGordon Ross if (rc == IDMAP_SUCCESS)
50119fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql2);
5012*e3d9e7f3SGordon Ross if (rc == IDMAP_SUCCESS)
50139fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States (void) __idmap_flush_kcache();
5014*e3d9e7f3SGordon Ross
5015*e3d9e7f3SGordon Ross if (rc == IDMAP_ERR_DB)
5016*e3d9e7f3SGordon Ross kill_cache_handle(cache);
5017*e3d9e7f3SGordon Ross
50189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc);
50199fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States }
5020