1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 22*148c5f43SAlan Wright * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23c5c4113dSnw */ 24c5c4113dSnw 25c5c4113dSnw /* 26c5c4113dSnw * Database related utility routines 27c5c4113dSnw */ 28c5c4113dSnw 29c5c4113dSnw #include <stdio.h> 30c5c4113dSnw #include <stdlib.h> 31c5c4113dSnw #include <string.h> 32c5c4113dSnw #include <errno.h> 33c5c4113dSnw #include <sys/types.h> 34c5c4113dSnw #include <sys/stat.h> 35c5c4113dSnw #include <rpc/rpc.h> 36c5c4113dSnw #include <sys/sid.h> 37c5c4113dSnw #include <time.h> 38c5c4113dSnw #include <pwd.h> 39c5c4113dSnw #include <grp.h> 4084decf41Sjp #include <pthread.h> 4184decf41Sjp #include <assert.h> 42cd37da74Snw #include <sys/u8_textprep.h> 438c155366SJordan Brown #include <alloca.h> 44*148c5f43SAlan Wright #include <note.h> 45c5c4113dSnw 46c5c4113dSnw #include "idmapd.h" 47c5c4113dSnw #include "adutils.h" 48c5c4113dSnw #include "string.h" 49c5c4113dSnw #include "idmap_priv.h" 50cd37da74Snw #include "schema.h" 51e8c27ec8Sbaban #include "nldaputils.h" 52*148c5f43SAlan Wright #include "idmap_lsa.h" 53fe1c642dSBill Krier #include "miscutils.h" 54c5c4113dSnw 5584decf41Sjp 56c5c4113dSnw static idmap_retcode sql_compile_n_step_once(sqlite *, char *, 57c5c4113dSnw sqlite_vm **, int *, int, const char ***); 58e8c27ec8Sbaban static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *); 59e8c27ec8Sbaban static idmap_retcode lookup_cache_name2sid(sqlite *, const char *, 60*148c5f43SAlan Wright const char *, char **, char **, idmap_rid_t *, idmap_id_type *); 61e8c27ec8Sbaban 6208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States #define NELEM(a) (sizeof (a) / sizeof ((a)[0])) 63c5c4113dSnw 64c5c4113dSnw #define EMPTY_NAME(name) (*name == 0 || strcmp(name, "\"\"") == 0) 65c5c4113dSnw 66c5c4113dSnw #define DO_NOT_ALLOC_NEW_ID_MAPPING(req)\ 67c5c4113dSnw (req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC) 68c5c4113dSnw 69c5c4113dSnw #define AVOID_NAMESERVICE(req)\ 70c5c4113dSnw (req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE) 71c5c4113dSnw 722b4a7802SBaban Kenkre #define ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)\ 732b4a7802SBaban Kenkre (req->flag & IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY) 742b4a7802SBaban Kenkre 75c5c4113dSnw typedef enum init_db_option { 76c5c4113dSnw FAIL_IF_CORRUPT = 0, 77c5c4113dSnw REMOVE_IF_CORRUPT = 1 78c5c4113dSnw } init_db_option_t; 79c5c4113dSnw 8084decf41Sjp /* 8108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Thread specific data to hold the database handles so that the 8208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * databases are not opened and closed for every request. It also 8384decf41Sjp * contains the sqlite busy handler structure. 8484decf41Sjp */ 8584decf41Sjp 8684decf41Sjp struct idmap_busy { 8784decf41Sjp const char *name; 8884decf41Sjp const int *delays; 8984decf41Sjp int delay_size; 9084decf41Sjp int total; 9184decf41Sjp int sec; 9284decf41Sjp }; 9384decf41Sjp 9484decf41Sjp 9584decf41Sjp typedef struct idmap_tsd { 9684decf41Sjp sqlite *db_db; 9784decf41Sjp sqlite *cache_db; 9884decf41Sjp struct idmap_busy cache_busy; 9984decf41Sjp struct idmap_busy db_busy; 10084decf41Sjp } idmap_tsd_t; 10184decf41Sjp 102e3f2c991SKeyur Desai /* 103e3f2c991SKeyur Desai * Flags to indicate how local the directory we're consulting is. 104e3f2c991SKeyur Desai * If neither is set, it means the directory belongs to a remote forest. 105e3f2c991SKeyur Desai */ 106e3f2c991SKeyur Desai #define DOMAIN_IS_LOCAL 0x01 107e3f2c991SKeyur Desai #define FOREST_IS_LOCAL 0x02 10884decf41Sjp 10984decf41Sjp static const int cache_delay_table[] = 11084decf41Sjp { 1, 2, 5, 10, 15, 20, 25, 30, 35, 40, 11184decf41Sjp 50, 50, 60, 70, 80, 90, 100}; 11284decf41Sjp 11384decf41Sjp static const int db_delay_table[] = 11484decf41Sjp { 5, 10, 15, 20, 30, 40, 55, 70, 100}; 11584decf41Sjp 11684decf41Sjp 11784decf41Sjp static pthread_key_t idmap_tsd_key; 11884decf41Sjp 11984decf41Sjp void 12084decf41Sjp idmap_tsd_destroy(void *key) 12184decf41Sjp { 12284decf41Sjp 12384decf41Sjp idmap_tsd_t *tsd = (idmap_tsd_t *)key; 12484decf41Sjp if (tsd) { 12584decf41Sjp if (tsd->db_db) 12684decf41Sjp (void) sqlite_close(tsd->db_db); 12784decf41Sjp if (tsd->cache_db) 12884decf41Sjp (void) sqlite_close(tsd->cache_db); 12984decf41Sjp free(tsd); 13084decf41Sjp } 13184decf41Sjp } 13284decf41Sjp 133*148c5f43SAlan Wright void 134cd37da74Snw idmap_init_tsd_key(void) 135cd37da74Snw { 136*148c5f43SAlan Wright int rc; 137*148c5f43SAlan Wright 138*148c5f43SAlan Wright rc = pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy); 139*148c5f43SAlan Wright assert(rc == 0); 14084decf41Sjp } 14184decf41Sjp 14284decf41Sjp 14384decf41Sjp 14484decf41Sjp idmap_tsd_t * 14584decf41Sjp idmap_get_tsd(void) 14684decf41Sjp { 14784decf41Sjp idmap_tsd_t *tsd; 14884decf41Sjp 14984decf41Sjp if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) { 15084decf41Sjp /* No thread specific data so create it */ 15184decf41Sjp if ((tsd = malloc(sizeof (*tsd))) != NULL) { 15284decf41Sjp /* Initialize thread specific data */ 15384decf41Sjp (void) memset(tsd, 0, sizeof (*tsd)); 15484decf41Sjp /* save the trhread specific data */ 15584decf41Sjp if (pthread_setspecific(idmap_tsd_key, tsd) != 0) { 15684decf41Sjp /* Can't store key */ 15784decf41Sjp free(tsd); 15884decf41Sjp tsd = NULL; 15984decf41Sjp } 16084decf41Sjp } else { 16184decf41Sjp tsd = NULL; 16284decf41Sjp } 16384decf41Sjp } 16484decf41Sjp 16584decf41Sjp return (tsd); 16684decf41Sjp } 16784decf41Sjp 168cd37da74Snw /* 169cd37da74Snw * A simple wrapper around u8_textprep_str() that returns the Unicode 170cd37da74Snw * lower-case version of some string. The result must be freed. 171cd37da74Snw */ 172cd37da74Snw char * 173cd37da74Snw tolower_u8(const char *s) 174cd37da74Snw { 175cd37da74Snw char *res = NULL; 176cd37da74Snw char *outs; 177cd37da74Snw size_t inlen, outlen, inbytesleft, outbytesleft; 178cd37da74Snw int rc, err; 179cd37da74Snw 180cd37da74Snw /* 181cd37da74Snw * u8_textprep_str() does not allocate memory. The input and 182cd37da74Snw * output buffers may differ in size (though that would be more 183cd37da74Snw * likely when normalization is done). We have to loop over it... 184cd37da74Snw * 185cd37da74Snw * To improve the chances that we can avoid looping we add 10 186cd37da74Snw * bytes of output buffer room the first go around. 187cd37da74Snw */ 188cd37da74Snw inlen = inbytesleft = strlen(s); 189cd37da74Snw outlen = outbytesleft = inlen + 10; 190cd37da74Snw if ((res = malloc(outlen)) == NULL) 191cd37da74Snw return (NULL); 192cd37da74Snw outs = res; 193cd37da74Snw 194cd37da74Snw while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs, 195cd37da74Snw &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 && 196cd37da74Snw err == E2BIG) { 197cd37da74Snw if ((res = realloc(res, outlen + inbytesleft)) == NULL) 198cd37da74Snw return (NULL); 199cd37da74Snw /* adjust input/output buffer pointers */ 200cd37da74Snw s += (inlen - inbytesleft); 201cd37da74Snw outs = res + outlen - outbytesleft; 202cd37da74Snw /* adjust outbytesleft and outlen */ 203cd37da74Snw outlen += inbytesleft; 204cd37da74Snw outbytesleft += inbytesleft; 205cd37da74Snw } 206cd37da74Snw 207cd37da74Snw if (rc < 0) { 208cd37da74Snw free(res); 209cd37da74Snw res = NULL; 210cd37da74Snw return (NULL); 211cd37da74Snw } 212cd37da74Snw 213cd37da74Snw res[outlen - outbytesleft] = '\0'; 214cd37da74Snw 215cd37da74Snw return (res); 216cd37da74Snw } 217cd37da74Snw 218cd37da74Snw static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 219cd37da74Snw const char *while_doing); 220cd37da74Snw 221c5c4113dSnw 222c5c4113dSnw /* 223c5c4113dSnw * Initialize 'dbname' using 'sql' 224c5c4113dSnw */ 225cd37da74Snw static 226cd37da74Snw int 227cd37da74Snw init_db_instance(const char *dbname, int version, 228cd37da74Snw const char *detect_version_sql, char * const *sql, 229cd37da74Snw init_db_option_t opt, int *created, int *upgraded) 230c5c4113dSnw { 231cd37da74Snw int rc, curr_version; 232cd37da74Snw int tries = 1; 233cd37da74Snw int prio = LOG_NOTICE; 234c5c4113dSnw sqlite *db = NULL; 235cd37da74Snw char *errmsg = NULL; 236c5c4113dSnw 237cd37da74Snw *created = 0; 238cd37da74Snw *upgraded = 0; 239c5c4113dSnw 240cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 241cd37da74Snw tries = 3; 242c5c4113dSnw 243cd37da74Snw rinse_repeat: 244cd37da74Snw if (tries == 0) { 245cd37da74Snw idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname); 246cd37da74Snw return (-1); 247c5c4113dSnw } 248cd37da74Snw if (tries-- == 1) 249cd37da74Snw /* Last try, log errors */ 250cd37da74Snw prio = LOG_ERR; 251c5c4113dSnw 252cd37da74Snw db = sqlite_open(dbname, 0600, &errmsg); 253cd37da74Snw if (db == NULL) { 254cd37da74Snw idmapdlog(prio, "Error creating database %s (%s)", 255cd37da74Snw dbname, CHECK_NULL(errmsg)); 256cd37da74Snw sqlite_freemem(errmsg); 257cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 258cd37da74Snw (void) unlink(dbname); 259cd37da74Snw goto rinse_repeat; 260c5c4113dSnw } 261c5c4113dSnw 262cd37da74Snw sqlite_busy_timeout(db, 3000); 263c5c4113dSnw 264cd37da74Snw /* Detect current version of schema in the db, if any */ 265cd37da74Snw curr_version = 0; 266cd37da74Snw if (detect_version_sql != NULL) { 267cd37da74Snw char *end, **results; 268cd37da74Snw int nrow; 269cd37da74Snw 270cd37da74Snw #ifdef IDMAPD_DEBUG 271cd37da74Snw (void) fprintf(stderr, "Schema version detection SQL: %s\n", 272cd37da74Snw detect_version_sql); 273cd37da74Snw #endif /* IDMAPD_DEBUG */ 274cd37da74Snw rc = sqlite_get_table(db, detect_version_sql, &results, 275cd37da74Snw &nrow, NULL, &errmsg); 276cd37da74Snw if (rc != SQLITE_OK) { 277cd37da74Snw idmapdlog(prio, 278cd37da74Snw "Error detecting schema version of db %s (%s)", 279cd37da74Snw dbname, errmsg); 280cd37da74Snw sqlite_freemem(errmsg); 281cd37da74Snw sqlite_free_table(results); 282cd37da74Snw sqlite_close(db); 283cd37da74Snw return (-1); 284cd37da74Snw } 285cd37da74Snw if (nrow != 1) { 286cd37da74Snw idmapdlog(prio, 287cd37da74Snw "Error detecting schema version of db %s", dbname); 288cd37da74Snw sqlite_close(db); 289cd37da74Snw sqlite_free_table(results); 290cd37da74Snw return (-1); 291cd37da74Snw } 292cd37da74Snw curr_version = strtol(results[1], &end, 10); 293cd37da74Snw sqlite_free_table(results); 294c5c4113dSnw } 295c5c4113dSnw 296cd37da74Snw if (curr_version < 0) { 297cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 298cd37da74Snw (void) unlink(dbname); 299cd37da74Snw goto rinse_repeat; 300cd37da74Snw } 301cd37da74Snw 302cd37da74Snw if (curr_version == version) 303cd37da74Snw goto done; 304cd37da74Snw 305cd37da74Snw /* Install or upgrade schema */ 306cd37da74Snw #ifdef IDMAPD_DEBUG 307cd37da74Snw (void) fprintf(stderr, "Schema init/upgrade SQL: %s\n", 308cd37da74Snw sql[curr_version]); 309cd37da74Snw #endif /* IDMAPD_DEBUG */ 310cd37da74Snw rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname, 311cd37da74Snw (curr_version == 0) ? "installing schema" : "upgrading schema"); 312cd37da74Snw if (rc != 0) { 313cd37da74Snw idmapdlog(prio, "Error %s schema for db %s", dbname, 314cd37da74Snw (curr_version == 0) ? "installing schema" : 315cd37da74Snw "upgrading schema"); 316cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 317cd37da74Snw (void) unlink(dbname); 318cd37da74Snw goto rinse_repeat; 319c5c4113dSnw } 320c5c4113dSnw 321cd37da74Snw *upgraded = (curr_version > 0); 322cd37da74Snw *created = (curr_version == 0); 323cd37da74Snw 324cd37da74Snw done: 325c5c4113dSnw (void) sqlite_close(db); 326cd37da74Snw return (0); 327c5c4113dSnw } 328c5c4113dSnw 32984decf41Sjp 33084decf41Sjp /* 33184decf41Sjp * This is the SQLite database busy handler that retries the SQL 33284decf41Sjp * operation until it is successful. 33384decf41Sjp */ 33484decf41Sjp int 33584decf41Sjp /* LINTED E_FUNC_ARG_UNUSED */ 33684decf41Sjp idmap_sqlite_busy_handler(void *arg, const char *table_name, int count) 33784decf41Sjp { 33884decf41Sjp struct idmap_busy *busy = arg; 33984decf41Sjp int delay; 34084decf41Sjp struct timespec rqtp; 34184decf41Sjp 34284decf41Sjp if (count == 1) { 34384decf41Sjp busy->total = 0; 34484decf41Sjp busy->sec = 2; 34584decf41Sjp } 34684decf41Sjp if (busy->total > 1000 * busy->sec) { 3472b3ecdebSjp idmapdlog(LOG_DEBUG, 34884decf41Sjp "Thread %d waited %d sec for the %s database", 34984decf41Sjp pthread_self(), busy->sec, busy->name); 35084decf41Sjp busy->sec++; 35184decf41Sjp } 35284decf41Sjp 35384decf41Sjp if (count <= busy->delay_size) { 35484decf41Sjp delay = busy->delays[count-1]; 35584decf41Sjp } else { 35684decf41Sjp delay = busy->delays[busy->delay_size - 1]; 35784decf41Sjp } 35884decf41Sjp busy->total += delay; 35984decf41Sjp rqtp.tv_sec = 0; 36084decf41Sjp rqtp.tv_nsec = delay * (NANOSEC / MILLISEC); 36184decf41Sjp (void) nanosleep(&rqtp, NULL); 36284decf41Sjp return (1); 36384decf41Sjp } 36484decf41Sjp 36584decf41Sjp 366c5c4113dSnw /* 367c5c4113dSnw * Get the database handle 368c5c4113dSnw */ 369c5c4113dSnw idmap_retcode 370cd37da74Snw get_db_handle(sqlite **db) 371cd37da74Snw { 372cd37da74Snw char *errmsg; 373cd37da74Snw idmap_tsd_t *tsd; 374c5c4113dSnw 375c5c4113dSnw /* 37684decf41Sjp * Retrieve the db handle from thread-specific storage 377c5c4113dSnw * If none exists, open and store in thread-specific storage. 378c5c4113dSnw */ 37984decf41Sjp if ((tsd = idmap_get_tsd()) == NULL) { 380c5c4113dSnw idmapdlog(LOG_ERR, 381cd37da74Snw "Error getting thread specific data for %s", IDMAP_DBNAME); 38284decf41Sjp return (IDMAP_ERR_MEMORY); 383c5c4113dSnw } 38484decf41Sjp 38584decf41Sjp if (tsd->db_db == NULL) { 38684decf41Sjp tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg); 38784decf41Sjp if (tsd->db_db == NULL) { 388cd37da74Snw idmapdlog(LOG_ERR, "Error opening database %s (%s)", 389cd37da74Snw IDMAP_DBNAME, CHECK_NULL(errmsg)); 39084decf41Sjp sqlite_freemem(errmsg); 391cd37da74Snw return (IDMAP_ERR_DB); 39284decf41Sjp } 393cd37da74Snw 39484decf41Sjp tsd->db_busy.name = IDMAP_DBNAME; 39584decf41Sjp tsd->db_busy.delays = db_delay_table; 39684decf41Sjp tsd->db_busy.delay_size = sizeof (db_delay_table) / 39784decf41Sjp sizeof (int); 39884decf41Sjp sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler, 39984decf41Sjp &tsd->db_busy); 40084decf41Sjp } 40184decf41Sjp *db = tsd->db_db; 402c5c4113dSnw return (IDMAP_SUCCESS); 403c5c4113dSnw } 404c5c4113dSnw 405c5c4113dSnw /* 406c5c4113dSnw * Get the cache handle 407c5c4113dSnw */ 408c5c4113dSnw idmap_retcode 409cd37da74Snw get_cache_handle(sqlite **cache) 410cd37da74Snw { 411cd37da74Snw char *errmsg; 412cd37da74Snw idmap_tsd_t *tsd; 413c5c4113dSnw 414c5c4113dSnw /* 41584decf41Sjp * Retrieve the db handle from thread-specific storage 416c5c4113dSnw * If none exists, open and store in thread-specific storage. 417c5c4113dSnw */ 41884decf41Sjp if ((tsd = idmap_get_tsd()) == NULL) { 419cd37da74Snw idmapdlog(LOG_ERR, "Error getting thread specific data for %s", 420cd37da74Snw IDMAP_DBNAME); 42184decf41Sjp return (IDMAP_ERR_MEMORY); 422c5c4113dSnw } 42384decf41Sjp 42484decf41Sjp if (tsd->cache_db == NULL) { 42584decf41Sjp tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg); 42684decf41Sjp if (tsd->cache_db == NULL) { 427cd37da74Snw idmapdlog(LOG_ERR, "Error opening database %s (%s)", 428cd37da74Snw IDMAP_CACHENAME, CHECK_NULL(errmsg)); 42984decf41Sjp sqlite_freemem(errmsg); 430cd37da74Snw return (IDMAP_ERR_DB); 43184decf41Sjp } 432cd37da74Snw 43384decf41Sjp tsd->cache_busy.name = IDMAP_CACHENAME; 43484decf41Sjp tsd->cache_busy.delays = cache_delay_table; 43584decf41Sjp tsd->cache_busy.delay_size = sizeof (cache_delay_table) / 43684decf41Sjp sizeof (int); 43784decf41Sjp sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler, 43884decf41Sjp &tsd->cache_busy); 43984decf41Sjp } 44084decf41Sjp *cache = tsd->cache_db; 441c5c4113dSnw return (IDMAP_SUCCESS); 442c5c4113dSnw } 443c5c4113dSnw 444c5c4113dSnw /* 445c5c4113dSnw * Initialize cache and db 446c5c4113dSnw */ 447c5c4113dSnw int 448cd37da74Snw init_dbs() 449cd37da74Snw { 45048258c6bSjp char *sql[4]; 451cd37da74Snw int created, upgraded; 452cd37da74Snw 453c5c4113dSnw /* name-based mappings; probably OK to blow away in a pinch(?) */ 454cd37da74Snw sql[0] = DB_INSTALL_SQL; 455cd37da74Snw sql[1] = DB_UPGRADE_FROM_v1_SQL; 45648258c6bSjp sql[2] = NULL; 457cd37da74Snw 458cd37da74Snw if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql, 459cd37da74Snw FAIL_IF_CORRUPT, &created, &upgraded) < 0) 460c5c4113dSnw return (-1); 461c5c4113dSnw 462c5c4113dSnw /* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */ 463cd37da74Snw sql[0] = CACHE_INSTALL_SQL; 464cd37da74Snw sql[1] = CACHE_UPGRADE_FROM_v1_SQL; 46548258c6bSjp sql[2] = CACHE_UPGRADE_FROM_v2_SQL; 46648258c6bSjp sql[3] = NULL; 46748258c6bSjp 468cd37da74Snw if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL, 469cd37da74Snw sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0) 470c5c4113dSnw return (-1); 471c5c4113dSnw 472cd37da74Snw _idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0; 473cd37da74Snw 474c5c4113dSnw return (0); 475c5c4113dSnw } 476c5c4113dSnw 477c5c4113dSnw /* 478c5c4113dSnw * Finalize databases 479c5c4113dSnw */ 480c5c4113dSnw void 481cd37da74Snw fini_dbs() 482cd37da74Snw { 483c5c4113dSnw } 484c5c4113dSnw 485c5c4113dSnw /* 486e8c27ec8Sbaban * This table is a listing of status codes that will be returned to the 487c5c4113dSnw * client when a SQL command fails with the corresponding error message. 488c5c4113dSnw */ 489c5c4113dSnw static msg_table_t sqlmsgtable[] = { 49062c60062Sbaban {IDMAP_ERR_U2W_NAMERULE_CONFLICT, 491c5c4113dSnw "columns unixname, is_user, u2w_order are not unique"}, 49262c60062Sbaban {IDMAP_ERR_W2U_NAMERULE_CONFLICT, 493cd37da74Snw "columns winname, windomain, is_user, is_wuser, w2u_order are not" 494cd37da74Snw " unique"}, 495cd37da74Snw {IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"}, 496c5c4113dSnw {-1, NULL} 497c5c4113dSnw }; 498c5c4113dSnw 499c5c4113dSnw /* 500c5c4113dSnw * idmapd's version of string2stat to map SQLite messages to 501c5c4113dSnw * status codes 502c5c4113dSnw */ 503c5c4113dSnw idmap_retcode 504cd37da74Snw idmapd_string2stat(const char *msg) 505cd37da74Snw { 506c5c4113dSnw int i; 507c5c4113dSnw for (i = 0; sqlmsgtable[i].msg; i++) { 508c5c4113dSnw if (strcasecmp(sqlmsgtable[i].msg, msg) == 0) 509c5c4113dSnw return (sqlmsgtable[i].retcode); 510c5c4113dSnw } 511c5c4113dSnw return (IDMAP_ERR_OTHER); 512c5c4113dSnw } 513c5c4113dSnw 514cd37da74Snw /* 515cd37da74Snw * Executes some SQL in a transaction. 516cd37da74Snw * 517cd37da74Snw * Returns 0 on success, -1 if it failed but the rollback succeeded, -2 518cd37da74Snw * if the rollback failed. 519cd37da74Snw */ 520cd37da74Snw static 521cd37da74Snw int 522cd37da74Snw sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 523cd37da74Snw const char *while_doing) 524cd37da74Snw { 525cd37da74Snw char *errmsg = NULL; 526cd37da74Snw int rc; 527cd37da74Snw 528cd37da74Snw rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg); 529cd37da74Snw if (rc != SQLITE_OK) { 530cd37da74Snw idmapdlog(LOG_ERR, "Begin transaction failed (%s) " 531cd37da74Snw "while %s (%s)", errmsg, while_doing, dbname); 532cd37da74Snw sqlite_freemem(errmsg); 533cd37da74Snw return (-1); 534cd37da74Snw } 535cd37da74Snw 536cd37da74Snw rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 537cd37da74Snw if (rc != SQLITE_OK) { 538cd37da74Snw idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg, 539cd37da74Snw while_doing, dbname); 540cd37da74Snw sqlite_freemem(errmsg); 541cd37da74Snw errmsg = NULL; 542cd37da74Snw goto rollback; 543cd37da74Snw } 544cd37da74Snw 545cd37da74Snw rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg); 546cd37da74Snw if (rc == SQLITE_OK) { 547cd37da74Snw sqlite_freemem(errmsg); 548cd37da74Snw return (0); 549cd37da74Snw } 550cd37da74Snw 551cd37da74Snw idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)", 552cd37da74Snw errmsg, while_doing, dbname); 553cd37da74Snw sqlite_freemem(errmsg); 554cd37da74Snw errmsg = NULL; 555cd37da74Snw 556cd37da74Snw rollback: 557cd37da74Snw rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg); 558cd37da74Snw if (rc != SQLITE_OK) { 559cd37da74Snw idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)", 560cd37da74Snw errmsg, while_doing, dbname); 561cd37da74Snw sqlite_freemem(errmsg); 562cd37da74Snw return (-2); 563cd37da74Snw } 564cd37da74Snw sqlite_freemem(errmsg); 565cd37da74Snw 566cd37da74Snw return (-1); 567cd37da74Snw } 568cd37da74Snw 569c5c4113dSnw /* 570c5c4113dSnw * Execute the given SQL statment without using any callbacks 571c5c4113dSnw */ 572c5c4113dSnw idmap_retcode 57371590c90Snw sql_exec_no_cb(sqlite *db, const char *dbname, char *sql) 574cd37da74Snw { 575c5c4113dSnw char *errmsg = NULL; 57684decf41Sjp int r; 577c5c4113dSnw idmap_retcode retcode; 578c5c4113dSnw 57984decf41Sjp r = sqlite_exec(db, sql, NULL, NULL, &errmsg); 58084decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 581c5c4113dSnw 582c5c4113dSnw if (r != SQLITE_OK) { 58371590c90Snw idmapdlog(LOG_ERR, "Database error on %s while executing %s " 58471590c90Snw "(%s)", dbname, sql, CHECK_NULL(errmsg)); 58584decf41Sjp retcode = idmapd_string2stat(errmsg); 58662c60062Sbaban if (errmsg != NULL) 587c5c4113dSnw sqlite_freemem(errmsg); 588c5c4113dSnw return (retcode); 589c5c4113dSnw } 590c5c4113dSnw 591c5c4113dSnw return (IDMAP_SUCCESS); 592c5c4113dSnw } 593c5c4113dSnw 594c5c4113dSnw /* 595c5c4113dSnw * Generate expression that can be used in WHERE statements. 596c5c4113dSnw * Examples: 597c5c4113dSnw * <prefix> <col> <op> <value> <suffix> 598c5c4113dSnw * "" "unixuser" "=" "foo" "AND" 599c5c4113dSnw */ 600c5c4113dSnw idmap_retcode 601cd37da74Snw gen_sql_expr_from_rule(idmap_namerule *rule, char **out) 602cd37da74Snw { 603cd37da74Snw char *s_windomain = NULL, *s_winname = NULL; 604cd37da74Snw char *s_unixname = NULL; 605bbf6f00cSJordan Brown char *dir; 606cd37da74Snw char *lower_winname; 607cd37da74Snw int retcode = IDMAP_SUCCESS; 608cd37da74Snw 609c5c4113dSnw if (out == NULL) 610c5c4113dSnw return (IDMAP_ERR_ARG); 611c5c4113dSnw 612c5c4113dSnw 613cd37da74Snw if (!EMPTY_STRING(rule->windomain)) { 614cd37da74Snw s_windomain = sqlite_mprintf("AND windomain = %Q ", 615cd37da74Snw rule->windomain); 616cd37da74Snw if (s_windomain == NULL) { 617cd37da74Snw retcode = IDMAP_ERR_MEMORY; 618cd37da74Snw goto out; 619cd37da74Snw } 620cd37da74Snw } 621c5c4113dSnw 622cd37da74Snw if (!EMPTY_STRING(rule->winname)) { 623cd37da74Snw if ((lower_winname = tolower_u8(rule->winname)) == NULL) 624cd37da74Snw lower_winname = rule->winname; 625cd37da74Snw s_winname = sqlite_mprintf( 626cd37da74Snw "AND winname = %Q AND is_wuser = %d ", 627cd37da74Snw lower_winname, rule->is_wuser ? 1 : 0); 628cd37da74Snw if (lower_winname != rule->winname) 629cd37da74Snw free(lower_winname); 630cd37da74Snw if (s_winname == NULL) { 631cd37da74Snw retcode = IDMAP_ERR_MEMORY; 632cd37da74Snw goto out; 633cd37da74Snw } 634cd37da74Snw } 635cd37da74Snw 636cd37da74Snw if (!EMPTY_STRING(rule->unixname)) { 637cd37da74Snw s_unixname = sqlite_mprintf( 638cd37da74Snw "AND unixname = %Q AND is_user = %d ", 639cd37da74Snw rule->unixname, rule->is_user ? 1 : 0); 640cd37da74Snw if (s_unixname == NULL) { 641cd37da74Snw retcode = IDMAP_ERR_MEMORY; 642cd37da74Snw goto out; 643cd37da74Snw } 644cd37da74Snw } 645cd37da74Snw 646bbf6f00cSJordan Brown switch (rule->direction) { 647bbf6f00cSJordan Brown case IDMAP_DIRECTION_BI: 648bbf6f00cSJordan Brown dir = "AND w2u_order > 0 AND u2w_order > 0"; 649bbf6f00cSJordan Brown break; 650bbf6f00cSJordan Brown case IDMAP_DIRECTION_W2U: 651bbf6f00cSJordan Brown dir = "AND w2u_order > 0" 652bbf6f00cSJordan Brown " AND (u2w_order = 0 OR u2w_order ISNULL)"; 653bbf6f00cSJordan Brown break; 654bbf6f00cSJordan Brown case IDMAP_DIRECTION_U2W: 655bbf6f00cSJordan Brown dir = "AND u2w_order > 0" 656bbf6f00cSJordan Brown " AND (w2u_order = 0 OR w2u_order ISNULL)"; 657bbf6f00cSJordan Brown break; 658bbf6f00cSJordan Brown default: 659bbf6f00cSJordan Brown dir = ""; 660bbf6f00cSJordan Brown break; 661bbf6f00cSJordan Brown } 662bbf6f00cSJordan Brown 663bbf6f00cSJordan Brown *out = sqlite_mprintf("%s %s %s %s", 664cd37da74Snw s_windomain ? s_windomain : "", 665cd37da74Snw s_winname ? s_winname : "", 666bbf6f00cSJordan Brown s_unixname ? s_unixname : "", 667bbf6f00cSJordan Brown dir); 668cd37da74Snw 669cd37da74Snw if (*out == NULL) { 670cd37da74Snw retcode = IDMAP_ERR_MEMORY; 671cd37da74Snw idmapdlog(LOG_ERR, "Out of memory"); 672cd37da74Snw goto out; 673cd37da74Snw } 674cd37da74Snw 675cd37da74Snw out: 676cd37da74Snw if (s_windomain != NULL) 677cd37da74Snw sqlite_freemem(s_windomain); 678cd37da74Snw if (s_winname != NULL) 679cd37da74Snw sqlite_freemem(s_winname); 680cd37da74Snw if (s_unixname != NULL) 681cd37da74Snw sqlite_freemem(s_unixname); 682cd37da74Snw 683cd37da74Snw return (retcode); 684c5c4113dSnw } 685c5c4113dSnw 686cd37da74Snw 687cd37da74Snw 688c5c4113dSnw /* 689c5c4113dSnw * Generate and execute SQL statement for LIST RPC calls 690c5c4113dSnw */ 691c5c4113dSnw idmap_retcode 69271590c90Snw process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit, 69348258c6bSjp int flag, list_svc_cb cb, void *result) 694cd37da74Snw { 695c5c4113dSnw list_cb_data_t cb_data; 696c5c4113dSnw char *errmsg = NULL; 69784decf41Sjp int r; 698c5c4113dSnw idmap_retcode retcode = IDMAP_ERR_INTERNAL; 699c5c4113dSnw 700c5c4113dSnw (void) memset(&cb_data, 0, sizeof (cb_data)); 701c5c4113dSnw cb_data.result = result; 702c5c4113dSnw cb_data.limit = limit; 70348258c6bSjp cb_data.flag = flag; 704c5c4113dSnw 70584decf41Sjp 70684decf41Sjp r = sqlite_exec(db, sql, cb, &cb_data, &errmsg); 70784decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 70884decf41Sjp switch (r) { 70984decf41Sjp case SQLITE_OK: 71084decf41Sjp retcode = IDMAP_SUCCESS; 71184decf41Sjp break; 71284decf41Sjp 71384decf41Sjp default: 71484decf41Sjp retcode = IDMAP_ERR_INTERNAL; 71571590c90Snw idmapdlog(LOG_ERR, "Database error on %s while executing " 71671590c90Snw "%s (%s)", dbname, sql, CHECK_NULL(errmsg)); 71784decf41Sjp break; 718c5c4113dSnw } 71962c60062Sbaban if (errmsg != NULL) 720c5c4113dSnw sqlite_freemem(errmsg); 721c5c4113dSnw return (retcode); 722c5c4113dSnw } 723c5c4113dSnw 724c5c4113dSnw /* 725c5c4113dSnw * This routine is called by callbacks that process the results of 726c5c4113dSnw * LIST RPC calls to validate data and to allocate memory for 727c5c4113dSnw * the result array. 728c5c4113dSnw */ 729c5c4113dSnw idmap_retcode 730c5c4113dSnw validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv, 731cd37da74Snw int ncol, uchar_t **list, size_t valsize) 732cd37da74Snw { 733c5c4113dSnw size_t nsize; 734c5c4113dSnw void *tmplist; 735c5c4113dSnw 736c5c4113dSnw if (cb_data->limit > 0 && cb_data->next == cb_data->limit) 737c5c4113dSnw return (IDMAP_NEXT); 738c5c4113dSnw 739c5c4113dSnw if (argc < ncol || argv == NULL) { 740c5c4113dSnw idmapdlog(LOG_ERR, "Invalid data"); 741c5c4113dSnw return (IDMAP_ERR_INTERNAL); 742c5c4113dSnw } 743c5c4113dSnw 744c5c4113dSnw /* alloc in bulk to reduce number of reallocs */ 745c5c4113dSnw if (cb_data->next >= cb_data->len) { 746c5c4113dSnw nsize = (cb_data->len + SIZE_INCR) * valsize; 747c5c4113dSnw tmplist = realloc(*list, nsize); 748c5c4113dSnw if (tmplist == NULL) { 749c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 750c5c4113dSnw return (IDMAP_ERR_MEMORY); 751c5c4113dSnw } 752c5c4113dSnw *list = tmplist; 753c5c4113dSnw (void) memset(*list + (cb_data->len * valsize), 0, 754cd37da74Snw SIZE_INCR * valsize); 755c5c4113dSnw cb_data->len += SIZE_INCR; 756c5c4113dSnw } 757c5c4113dSnw return (IDMAP_SUCCESS); 758c5c4113dSnw } 759c5c4113dSnw 760cd37da74Snw static 761cd37da74Snw idmap_retcode 762c5c4113dSnw get_namerule_order(char *winname, char *windomain, char *unixname, 763cd37da74Snw int direction, int is_diagonal, int *w2u_order, int *u2w_order) 764cd37da74Snw { 765c5c4113dSnw *w2u_order = 0; 766c5c4113dSnw *u2w_order = 0; 767c5c4113dSnw 768c5c4113dSnw /* 769c5c4113dSnw * Windows to UNIX lookup order: 770c5c4113dSnw * 1. winname@domain (or winname) to "" 771c5c4113dSnw * 2. winname@domain (or winname) to unixname 772c5c4113dSnw * 3. winname@* to "" 773c5c4113dSnw * 4. winname@* to unixname 774c5c4113dSnw * 5. *@domain (or *) to * 775c5c4113dSnw * 6. *@domain (or *) to "" 776c5c4113dSnw * 7. *@domain (or *) to unixname 777c5c4113dSnw * 8. *@* to * 778c5c4113dSnw * 9. *@* to "" 779c5c4113dSnw * 10. *@* to unixname 780c5c4113dSnw * 781c5c4113dSnw * winname is a special case of winname@domain when domain is the 782c5c4113dSnw * default domain. Similarly * is a special case of *@domain when 783c5c4113dSnw * domain is the default domain. 784c5c4113dSnw * 785c5c4113dSnw * Note that "" has priority over specific names because "" inhibits 786c5c4113dSnw * mappings and traditionally deny rules always had higher priority. 787c5c4113dSnw */ 788651c0131Sbaban if (direction != IDMAP_DIRECTION_U2W) { 789651c0131Sbaban /* bi-directional or from windows to unix */ 790c5c4113dSnw if (winname == NULL) 791c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 792c5c4113dSnw else if (unixname == NULL) 793c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 794c5c4113dSnw else if (EMPTY_NAME(winname)) 795c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 796c5c4113dSnw else if (*winname == '*' && windomain && *windomain == '*') { 797c5c4113dSnw if (*unixname == '*') 798c5c4113dSnw *w2u_order = 8; 799c5c4113dSnw else if (EMPTY_NAME(unixname)) 800c5c4113dSnw *w2u_order = 9; 801c5c4113dSnw else /* unixname == name */ 802c5c4113dSnw *w2u_order = 10; 803c5c4113dSnw } else if (*winname == '*') { 804c5c4113dSnw if (*unixname == '*') 805c5c4113dSnw *w2u_order = 5; 806c5c4113dSnw else if (EMPTY_NAME(unixname)) 807c5c4113dSnw *w2u_order = 6; 808c5c4113dSnw else /* name */ 809c5c4113dSnw *w2u_order = 7; 81062c60062Sbaban } else if (windomain != NULL && *windomain == '*') { 811c5c4113dSnw /* winname == name */ 812c5c4113dSnw if (*unixname == '*') 813c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 814c5c4113dSnw else if (EMPTY_NAME(unixname)) 815c5c4113dSnw *w2u_order = 3; 816c5c4113dSnw else /* name */ 817c5c4113dSnw *w2u_order = 4; 818c5c4113dSnw } else { 819c5c4113dSnw /* winname == name && windomain == null or name */ 820c5c4113dSnw if (*unixname == '*') 821c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 822c5c4113dSnw else if (EMPTY_NAME(unixname)) 823c5c4113dSnw *w2u_order = 1; 824c5c4113dSnw else /* name */ 825c5c4113dSnw *w2u_order = 2; 826c5c4113dSnw } 827cd37da74Snw 828c5c4113dSnw } 829c5c4113dSnw 830c5c4113dSnw /* 831cd37da74Snw * 1. unixname to "", non-diagonal 832cd37da74Snw * 2. unixname to winname@domain (or winname), non-diagonal 833cd37da74Snw * 3. unixname to "", diagonal 834cd37da74Snw * 4. unixname to winname@domain (or winname), diagonal 835cd37da74Snw * 5. * to *@domain (or *), non-diagonal 836cd37da74Snw * 5. * to *@domain (or *), diagonal 837cd37da74Snw * 7. * to "" 838cd37da74Snw * 8. * to winname@domain (or winname) 839cd37da74Snw * 9. * to "", non-diagonal 840cd37da74Snw * 10. * to winname@domain (or winname), diagonal 841c5c4113dSnw */ 842651c0131Sbaban if (direction != IDMAP_DIRECTION_W2U) { 843cd37da74Snw int diagonal = is_diagonal ? 1 : 0; 844cd37da74Snw 845651c0131Sbaban /* bi-directional or from unix to windows */ 846c5c4113dSnw if (unixname == NULL || EMPTY_NAME(unixname)) 847c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 848c5c4113dSnw else if (winname == NULL) 849c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 85062c60062Sbaban else if (windomain != NULL && *windomain == '*') 851651c0131Sbaban return (IDMAP_ERR_U2W_NAMERULE); 852c5c4113dSnw else if (*unixname == '*') { 853c5c4113dSnw if (*winname == '*') 854cd37da74Snw *u2w_order = 5 + diagonal; 855c5c4113dSnw else if (EMPTY_NAME(winname)) 856cd37da74Snw *u2w_order = 7 + 2 * diagonal; 857c5c4113dSnw else 858cd37da74Snw *u2w_order = 8 + 2 * diagonal; 859c5c4113dSnw } else { 860c5c4113dSnw if (*winname == '*') 861c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 862c5c4113dSnw else if (EMPTY_NAME(winname)) 863cd37da74Snw *u2w_order = 1 + 2 * diagonal; 864c5c4113dSnw else 865cd37da74Snw *u2w_order = 2 + 2 * diagonal; 866c5c4113dSnw } 867c5c4113dSnw } 868c5c4113dSnw return (IDMAP_SUCCESS); 869c5c4113dSnw } 870c5c4113dSnw 871c5c4113dSnw /* 872c5c4113dSnw * Generate and execute SQL statement to add name-based mapping rule 873c5c4113dSnw */ 874c5c4113dSnw idmap_retcode 875cd37da74Snw add_namerule(sqlite *db, idmap_namerule *rule) 876cd37da74Snw { 877c5c4113dSnw char *sql = NULL; 878c5c4113dSnw idmap_stat retcode; 8798e228215Sdm char *dom = NULL; 88008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *name; 881c5c4113dSnw int w2u_order, u2w_order; 882c5c4113dSnw char w2ubuf[11], u2wbuf[11]; 88308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canonname = NULL; 88408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canondomain = NULL; 885c5c4113dSnw 8868e228215Sdm retcode = get_namerule_order(rule->winname, rule->windomain, 887cd37da74Snw rule->unixname, rule->direction, 888cd37da74Snw rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order); 889c5c4113dSnw if (retcode != IDMAP_SUCCESS) 890c5c4113dSnw goto out; 891c5c4113dSnw 892c5c4113dSnw if (w2u_order) 893c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order); 894c5c4113dSnw if (u2w_order) 895c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order); 896c5c4113dSnw 89762c60062Sbaban /* 89862c60062Sbaban * For the triggers on namerules table to work correctly: 89962c60062Sbaban * 1) Use NULL instead of 0 for w2u_order and u2w_order 90062c60062Sbaban * 2) Use "" instead of NULL for "no domain" 90162c60062Sbaban */ 902c5c4113dSnw 90308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name = rule->winname; 90408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = rule->windomain; 90562c60062Sbaban 90662c60062Sbaban RDLOCK_CONFIG(); 90708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (lookup_wksids_name2sid(name, dom, 90808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States &canonname, &canondomain, 90908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States NULL, NULL, NULL) == IDMAP_SUCCESS) { 91008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name = canonname; 91108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = canondomain; 91208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else if (EMPTY_STRING(dom)) { 913c8e26105Sjp if (_idmapdstate.cfg->pgcfg.default_domain) 914c8e26105Sjp dom = _idmapdstate.cfg->pgcfg.default_domain; 91562c60062Sbaban else 91662c60062Sbaban dom = ""; 91762c60062Sbaban } 91884decf41Sjp sql = sqlite_mprintf("INSERT into namerules " 919cd37da74Snw "(is_user, is_wuser, windomain, winname_display, is_nt4, " 920cd37da74Snw "unixname, w2u_order, u2w_order) " 921cd37da74Snw "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);", 922cd37da74Snw rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom, 92308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name, rule->is_nt4 ? 1 : 0, rule->unixname, 924cd37da74Snw w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL); 925c5c4113dSnw UNLOCK_CONFIG(); 926c5c4113dSnw 927c5c4113dSnw if (sql == NULL) { 928c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 929c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 930c5c4113dSnw goto out; 931c5c4113dSnw } 932c5c4113dSnw 93371590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 934c5c4113dSnw 935c5c4113dSnw if (retcode == IDMAP_ERR_OTHER) 936c5c4113dSnw retcode = IDMAP_ERR_CFG; 937c5c4113dSnw 938c5c4113dSnw out: 93908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(canonname); 94008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(canondomain); 94162c60062Sbaban if (sql != NULL) 942c5c4113dSnw sqlite_freemem(sql); 943c5c4113dSnw return (retcode); 944c5c4113dSnw } 945c5c4113dSnw 946c5c4113dSnw /* 947c5c4113dSnw * Flush name-based mapping rules 948c5c4113dSnw */ 949c5c4113dSnw idmap_retcode 950cd37da74Snw flush_namerules(sqlite *db) 951cd37da74Snw { 952c5c4113dSnw idmap_stat retcode; 953c5c4113dSnw 95471590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;"); 955c5c4113dSnw 956c5c4113dSnw return (retcode); 957c5c4113dSnw } 958c5c4113dSnw 959c5c4113dSnw /* 960c5c4113dSnw * Generate and execute SQL statement to remove a name-based mapping rule 961c5c4113dSnw */ 962c5c4113dSnw idmap_retcode 963cd37da74Snw rm_namerule(sqlite *db, idmap_namerule *rule) 964cd37da74Snw { 965c5c4113dSnw char *sql = NULL; 966c5c4113dSnw idmap_stat retcode; 967cd37da74Snw char *expr = NULL; 968c5c4113dSnw 9698e228215Sdm if (rule->direction < 0 && EMPTY_STRING(rule->windomain) && 9708e228215Sdm EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname)) 971c5c4113dSnw return (IDMAP_SUCCESS); 972c5c4113dSnw 973cd37da74Snw retcode = gen_sql_expr_from_rule(rule, &expr); 974cd37da74Snw if (retcode != IDMAP_SUCCESS) 975cd37da74Snw goto out; 976c5c4113dSnw 977bbf6f00cSJordan Brown sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s;", expr); 978c5c4113dSnw 979c5c4113dSnw if (sql == NULL) { 980c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 981c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 982c5c4113dSnw goto out; 983c5c4113dSnw } 984c5c4113dSnw 985cd37da74Snw 98671590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 987c5c4113dSnw 988c5c4113dSnw out: 989cd37da74Snw if (expr != NULL) 990cd37da74Snw sqlite_freemem(expr); 99162c60062Sbaban if (sql != NULL) 992c5c4113dSnw sqlite_freemem(sql); 993c5c4113dSnw return (retcode); 994c5c4113dSnw } 995c5c4113dSnw 996c5c4113dSnw /* 997c5c4113dSnw * Compile the given SQL query and step just once. 998c5c4113dSnw * 999c5c4113dSnw * Input: 1000c5c4113dSnw * db - db handle 1001c5c4113dSnw * sql - SQL statement 1002c5c4113dSnw * 1003c5c4113dSnw * Output: 1004c5c4113dSnw * vm - virtual SQL machine 1005c5c4113dSnw * ncol - number of columns in the result 1006c5c4113dSnw * values - column values 1007c5c4113dSnw * 1008c5c4113dSnw * Return values: 1009c5c4113dSnw * IDMAP_SUCCESS 1010c5c4113dSnw * IDMAP_ERR_NOTFOUND 1011c5c4113dSnw * IDMAP_ERR_INTERNAL 1012c5c4113dSnw */ 1013c5c4113dSnw 1014cd37da74Snw static 1015cd37da74Snw idmap_retcode 1016c5c4113dSnw sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol, 1017cd37da74Snw int reqcol, const char ***values) 1018cd37da74Snw { 1019c5c4113dSnw char *errmsg = NULL; 102084decf41Sjp int r; 1021c5c4113dSnw 102284decf41Sjp if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) { 1023cd37da74Snw idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1024cd37da74Snw CHECK_NULL(errmsg)); 1025c5c4113dSnw sqlite_freemem(errmsg); 1026c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1027c5c4113dSnw } 1028c5c4113dSnw 102984decf41Sjp r = sqlite_step(*vm, ncol, values, NULL); 103084decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 1031c5c4113dSnw 103284decf41Sjp if (r == SQLITE_ROW) { 103362c60062Sbaban if (ncol != NULL && *ncol < reqcol) { 1034c5c4113dSnw (void) sqlite_finalize(*vm, NULL); 1035c5c4113dSnw *vm = NULL; 1036c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1037c5c4113dSnw } 1038c5c4113dSnw /* Caller will call finalize after using the results */ 1039c5c4113dSnw return (IDMAP_SUCCESS); 1040c5c4113dSnw } else if (r == SQLITE_DONE) { 1041c5c4113dSnw (void) sqlite_finalize(*vm, NULL); 1042c5c4113dSnw *vm = NULL; 1043c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 1044c5c4113dSnw } 1045c5c4113dSnw 1046c5c4113dSnw (void) sqlite_finalize(*vm, &errmsg); 1047c5c4113dSnw *vm = NULL; 1048cd37da74Snw idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1049cd37da74Snw CHECK_NULL(errmsg)); 1050c5c4113dSnw sqlite_freemem(errmsg); 1051c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1052c5c4113dSnw } 1053c5c4113dSnw 1054e8c27ec8Sbaban /* 1055479ac375Sdm * Load config in the state. 1056e8c27ec8Sbaban * 1057479ac375Sdm * nm_siduid and nm_sidgid fields: 1058e8c27ec8Sbaban * state->nm_siduid represents mode used by sid2uid and uid2sid 1059e8c27ec8Sbaban * requests for directory-based name mappings. Similarly, 1060e8c27ec8Sbaban * state->nm_sidgid represents mode used by sid2gid and gid2sid 1061e8c27ec8Sbaban * requests. 1062e8c27ec8Sbaban * 1063e8c27ec8Sbaban * sid2uid/uid2sid: 1064e3f2c991SKeyur Desai * none -> directory_based_mapping != DIRECTORY_MAPPING_NAME 1065e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixuser_attr 1066e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr 1067e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixuser_attr 1068e8c27ec8Sbaban * 1069e8c27ec8Sbaban * sid2gid/gid2sid: 1070e3f2c991SKeyur Desai * none -> directory_based_mapping != DIRECTORY_MAPPING_NAME 1071e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixgroup_attr 1072e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr 1073e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr 1074e8c27ec8Sbaban */ 1075e8c27ec8Sbaban idmap_retcode 1076479ac375Sdm load_cfg_in_state(lookup_state_t *state) 1077e8c27ec8Sbaban { 1078e8c27ec8Sbaban state->nm_siduid = IDMAP_NM_NONE; 1079e8c27ec8Sbaban state->nm_sidgid = IDMAP_NM_NONE; 1080e8c27ec8Sbaban RDLOCK_CONFIG(); 1081479ac375Sdm 10824aa0a5e7Snw state->eph_map_unres_sids = 0; 10834aa0a5e7Snw if (_idmapdstate.cfg->pgcfg.eph_map_unres_sids) 10844aa0a5e7Snw state->eph_map_unres_sids = 1; 10854aa0a5e7Snw 1086e3f2c991SKeyur Desai state->directory_based_mapping = 1087e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.directory_based_mapping; 1088e3f2c991SKeyur Desai 1089479ac375Sdm if (_idmapdstate.cfg->pgcfg.default_domain != NULL) { 1090479ac375Sdm state->defdom = 1091479ac375Sdm strdup(_idmapdstate.cfg->pgcfg.default_domain); 1092479ac375Sdm if (state->defdom == NULL) { 1093479ac375Sdm UNLOCK_CONFIG(); 1094479ac375Sdm return (IDMAP_ERR_MEMORY); 1095479ac375Sdm } 1096479ac375Sdm } else { 1097479ac375Sdm UNLOCK_CONFIG(); 1098dc03a638Sdm return (IDMAP_SUCCESS); 1099479ac375Sdm } 1100e3f2c991SKeyur Desai 1101e3f2c991SKeyur Desai if (_idmapdstate.cfg->pgcfg.directory_based_mapping != 1102e3f2c991SKeyur Desai DIRECTORY_MAPPING_NAME) { 1103e8c27ec8Sbaban UNLOCK_CONFIG(); 1104e8c27ec8Sbaban return (IDMAP_SUCCESS); 1105e8c27ec8Sbaban } 1106e3f2c991SKeyur Desai 1107e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1108e8c27ec8Sbaban state->nm_siduid = 1109e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1110e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1111e8c27ec8Sbaban state->nm_sidgid = 1112e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1113e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1114e8c27ec8Sbaban } else { 1115e8c27ec8Sbaban state->nm_siduid = 1116e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1117e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE; 1118e8c27ec8Sbaban state->nm_sidgid = 1119e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1120e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE; 1121e8c27ec8Sbaban } 1122e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) { 1123e8c27ec8Sbaban state->ad_unixuser_attr = 1124e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr); 1125e8c27ec8Sbaban if (state->ad_unixuser_attr == NULL) { 1126e8c27ec8Sbaban UNLOCK_CONFIG(); 1127e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1128e8c27ec8Sbaban } 1129e8c27ec8Sbaban } 1130e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) { 1131e8c27ec8Sbaban state->ad_unixgroup_attr = 1132e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr); 1133e8c27ec8Sbaban if (state->ad_unixgroup_attr == NULL) { 1134e8c27ec8Sbaban UNLOCK_CONFIG(); 1135e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1136e8c27ec8Sbaban } 1137e8c27ec8Sbaban } 1138479ac375Sdm if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1139479ac375Sdm state->nldap_winname_attr = 1140479ac375Sdm strdup(_idmapdstate.cfg->pgcfg.nldap_winname_attr); 1141479ac375Sdm if (state->nldap_winname_attr == NULL) { 1142479ac375Sdm UNLOCK_CONFIG(); 1143479ac375Sdm return (IDMAP_ERR_MEMORY); 1144479ac375Sdm } 1145479ac375Sdm } 1146e8c27ec8Sbaban UNLOCK_CONFIG(); 1147e8c27ec8Sbaban return (IDMAP_SUCCESS); 1148e8c27ec8Sbaban } 1149e8c27ec8Sbaban 115048258c6bSjp /* 115108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Set the rule with specified values. 115248258c6bSjp * All the strings are copied. 115348258c6bSjp */ 115448258c6bSjp static void 115548258c6bSjp idmap_namerule_set(idmap_namerule *rule, const char *windomain, 115648258c6bSjp const char *winname, const char *unixname, boolean_t is_user, 115748258c6bSjp boolean_t is_wuser, boolean_t is_nt4, int direction) 115848258c6bSjp { 115948258c6bSjp /* 116048258c6bSjp * Only update if they differ because we have to free 116148258c6bSjp * and duplicate the strings 116248258c6bSjp */ 116348258c6bSjp if (rule->windomain == NULL || windomain == NULL || 116448258c6bSjp strcmp(rule->windomain, windomain) != 0) { 116548258c6bSjp if (rule->windomain != NULL) { 116648258c6bSjp free(rule->windomain); 116748258c6bSjp rule->windomain = NULL; 116848258c6bSjp } 116948258c6bSjp if (windomain != NULL) 117048258c6bSjp rule->windomain = strdup(windomain); 117148258c6bSjp } 117248258c6bSjp 117348258c6bSjp if (rule->winname == NULL || winname == NULL || 117448258c6bSjp strcmp(rule->winname, winname) != 0) { 117548258c6bSjp if (rule->winname != NULL) { 117648258c6bSjp free(rule->winname); 117748258c6bSjp rule->winname = NULL; 117848258c6bSjp } 117948258c6bSjp if (winname != NULL) 118048258c6bSjp rule->winname = strdup(winname); 118148258c6bSjp } 118248258c6bSjp 118348258c6bSjp if (rule->unixname == NULL || unixname == NULL || 118448258c6bSjp strcmp(rule->unixname, unixname) != 0) { 118548258c6bSjp if (rule->unixname != NULL) { 118648258c6bSjp free(rule->unixname); 118748258c6bSjp rule->unixname = NULL; 118848258c6bSjp } 118948258c6bSjp if (unixname != NULL) 119048258c6bSjp rule->unixname = strdup(unixname); 119148258c6bSjp } 119248258c6bSjp 119348258c6bSjp rule->is_user = is_user; 119448258c6bSjp rule->is_wuser = is_wuser; 119548258c6bSjp rule->is_nt4 = is_nt4; 119648258c6bSjp rule->direction = direction; 119748258c6bSjp } 119848258c6bSjp 1199e8c27ec8Sbaban /* 1200e8c27ec8Sbaban * Lookup well-known SIDs table either by winname or by SID. 120108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 120208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If the given winname or SID is a well-known SID then we set is_wksid 1203e8c27ec8Sbaban * variable and then proceed to see if the SID has a hard mapping to 1204e8c27ec8Sbaban * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to 120508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * fixed ephemeral ids). The direction flag indicates whether we have 120608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * a mapping; UNDEF indicates that we do not. 120708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 120808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we find a mapping then we return success, except for the 12099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * special case of IDMAP_SENTINEL_PID which indicates an inhibited mapping. 121008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 121108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we find a matching entry, but no mapping, we supply SID, name, and type 121208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * information and return "not found". Higher layers will probably 121308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * do ephemeral mapping. 121408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 121508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we do not find a match, we return "not found" and leave the question 121608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * to higher layers. 1217e8c27ec8Sbaban */ 1218cd37da74Snw static 1219cd37da74Snw idmap_retcode 122008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *is_wksid) 1221cd37da74Snw { 122208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid; 122362c60062Sbaban 122408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *is_wksid = 0; 122562c60062Sbaban 122608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.sid.prefix != NULL || 122708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name != NULL); 122808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 122908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix != NULL) { 123008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_sid(req->id1.idmap_id_u.sid.prefix, 123108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.rid, res->id.idtype); 123208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 123308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_name(req->id1name, req->id1domain, 123408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype); 123508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 123608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL) 123708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND); 123808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 123908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Found matching entry. */ 124008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 124108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in name if it was not already there. */ 124208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1name == NULL) { 124308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name = strdup(wksid->winname); 124408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1name == NULL) 124508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 124608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 124708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 124808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in SID if it was not already there */ 124908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix == NULL) { 125008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) { 125108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.prefix = 125208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(wksid->sidprefix); 125308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 125408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 1255e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = 125608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(_idmapdstate.cfg->pgcfg.machine_sid); 125708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 1258e8c27ec8Sbaban } 125908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix == NULL) 126008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 126108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.rid = wksid->rid; 126208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 1263e8c27ec8Sbaban 126408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in the canonical domain if not already there */ 126508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1domain == NULL) { 126608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *dom; 1267e8c27ec8Sbaban 126808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 1269fe1c642dSBill Krier if (wksid->domain != NULL) 127008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = wksid->domain; 1271fe1c642dSBill Krier else 127208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = _idmapdstate.hostname; 127308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1domain = strdup(dom); 127408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 127508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1domain == NULL) 127608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 127708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 1278e8c27ec8Sbaban 127908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *is_wksid = 1; 128008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 1281e8c27ec8Sbaban 128208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idtype = wksid->is_wuser ? IDMAP_USID : IDMAP_GSID; 128308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 128408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idtype == IDMAP_POSIXID) { 128508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype = wksid->is_wuser ? IDMAP_UID : IDMAP_GID; 1286c5c4113dSnw } 128708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 128808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->direction == IDMAP_DIRECTION_UNDEF) { 128908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 129008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * We don't have a mapping 129108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * (But note that we may have supplied SID, name, or type 129208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * information.) 129308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 129408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND); 129508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 129608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 129708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 129808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * We have an explicit mapping. 129908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 13009fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->pid == IDMAP_SENTINEL_PID) { 130108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 130208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * ... which is that mapping is inhibited. 130308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 130408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOMAPPING); 130508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 130608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 130708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States switch (res->id.idtype) { 130808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_UID: 130908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = wksid->pid; 131008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States break; 131108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_GID: 131208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.gid = wksid->pid; 131308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States break; 131408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States default: 131508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* IDMAP_POSIXID is eliminated above */ 131608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTSUPPORTED); 131708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 131808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 131908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->direction = wksid->direction; 132008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID; 132108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.src = IDMAP_MAP_SRC_HARD_CODED; 132208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS); 1323c5c4113dSnw } 1324c5c4113dSnw 1325cd37da74Snw 132608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 132708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Look for an entry mapping a PID to a SID. 132808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 132908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Note that direction=UNDEF entries do not specify a mapping, 13309fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * and that IDMAP_SENTINEL_PID entries represent either an inhibited 133108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * mapping or an ephemeral mapping. We don't handle either here; 133208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * they are filtered out by find_wksid_by_pid. 133308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 1334cd37da74Snw static 1335cd37da74Snw idmap_retcode 1336cd37da74Snw lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user) 1337cd37da74Snw { 133808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid; 133908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 134008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_pid(req->id1.idmap_id_u.uid, is_user); 134108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL) 1342e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 134308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 134408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idtype == IDMAP_SID) { 134508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype = wksid->is_wuser ? IDMAP_USID : IDMAP_GSID; 134608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 134708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.rid = wksid->rid; 134808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 134908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) { 135008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.prefix = 135108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(wksid->sidprefix); 135208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 135308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 135408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.prefix = 135508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(_idmapdstate.cfg->pgcfg.machine_sid); 135608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 135708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 135808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 135908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idmap_id_u.sid.prefix == NULL) { 136008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory"); 136108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 136262c60062Sbaban } 136308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 1364fe1c642dSBill Krier /* Fill in name if it was not already there. */ 1365fe1c642dSBill Krier if (req->id2name == NULL) { 1366fe1c642dSBill Krier req->id2name = strdup(wksid->winname); 1367fe1c642dSBill Krier if (req->id2name == NULL) 1368fe1c642dSBill Krier return (IDMAP_ERR_MEMORY); 1369fe1c642dSBill Krier } 1370fe1c642dSBill Krier 1371fe1c642dSBill Krier /* Fill in the canonical domain if not already there */ 1372fe1c642dSBill Krier if (req->id2domain == NULL) { 1373fe1c642dSBill Krier const char *dom; 1374fe1c642dSBill Krier 1375fe1c642dSBill Krier RDLOCK_CONFIG(); 1376fe1c642dSBill Krier if (wksid->domain != NULL) 1377fe1c642dSBill Krier dom = wksid->domain; 1378fe1c642dSBill Krier else 1379fe1c642dSBill Krier dom = _idmapdstate.hostname; 1380fe1c642dSBill Krier req->id2domain = strdup(dom); 1381fe1c642dSBill Krier UNLOCK_CONFIG(); 1382fe1c642dSBill Krier if (req->id2domain == NULL) 1383fe1c642dSBill Krier return (IDMAP_ERR_MEMORY); 1384fe1c642dSBill Krier } 1385fe1c642dSBill Krier 138608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->direction = wksid->direction; 138708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID; 138808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.src = IDMAP_MAP_SRC_HARD_CODED; 138908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS); 139062c60062Sbaban } 139162c60062Sbaban 139208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 139308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Look up a name in the wksids list, matching name and, if supplied, domain, 139408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * and extract data. 139508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 139608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given: 139708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name 139808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name (or NULL) 139908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 140008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Return: Error code 140108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 140208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname canonical name (if canonname non-NULL) [1] 140308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canondomain canonical domain (if canondomain non-NULL) [1] 140408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix (if sidprefix non-NULL) [1] 140508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID (if rid non-NULL) [2] 140608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *type Type (if type non-NULL) [2] 140708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 140808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error 140908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [2] Undefined on error 141008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 1411cd37da74Snw idmap_retcode 141208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_wksids_name2sid( 141308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *name, 141408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *domain, 141508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canonname, 141608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canondomain, 141708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **sidprefix, 141808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *rid, 1419*148c5f43SAlan Wright idmap_id_type *type) 1420cd37da74Snw { 142108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid; 1422479ac375Sdm 142308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) 142408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL; 142508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) 142608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 142708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) 142808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL; 1429479ac375Sdm 143008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_name(name, domain, IDMAP_POSIXID); 143108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL) 143208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND); 143308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 143408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) { 143508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) { 143608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(wksid->sidprefix); 143708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 143808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 143908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup( 144008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.cfg->pgcfg.machine_sid); 144108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 1442e8c27ec8Sbaban } 144308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*sidprefix == NULL) 144408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem; 144508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 144608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 144708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (rid != NULL) 144808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *rid = wksid->rid; 144908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 145008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 145108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = strdup(wksid->winname); 145208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canonname == NULL) 145308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem; 145408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 145508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 145608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) { 145708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->domain != NULL) { 145808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(wksid->domain); 145908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 146008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 146108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(_idmapdstate.hostname); 146208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 1463c5c4113dSnw } 146408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canondomain == NULL) 146508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem; 146608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 146708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 146808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (type != NULL) 146908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *type = (wksid->is_wuser) ? 1470*148c5f43SAlan Wright IDMAP_USID : IDMAP_GSID; 147108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 147208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS); 147308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 147408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States nomem: 147508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory"); 147608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 147708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) { 147808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*sidprefix); 147908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL; 1480c5c4113dSnw } 148108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 148208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 148308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname); 148408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 148508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 148608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 148708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) { 148808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canondomain); 148908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL; 149008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 149108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 149208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 1493c5c4113dSnw } 1494c5c4113dSnw 1495cd37da74Snw static 1496cd37da74Snw idmap_retcode 1497cd37da74Snw lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1498cd37da74Snw { 1499c5c4113dSnw char *end; 1500c5c4113dSnw char *sql = NULL; 1501c5c4113dSnw const char **values; 1502c5c4113dSnw sqlite_vm *vm = NULL; 1503c5c4113dSnw int ncol, is_user; 1504c5c4113dSnw uid_t pid; 1505c5c4113dSnw time_t curtime, exp; 1506c5c4113dSnw idmap_retcode retcode; 1507042addd6Sbaban char *is_user_string, *lower_name; 1508c5c4113dSnw 1509c5c4113dSnw /* Current time */ 1510c5c4113dSnw errno = 0; 1511c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 1512cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1513cd37da74Snw strerror(errno)); 1514c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 1515c5c4113dSnw goto out; 1516c5c4113dSnw } 1517c5c4113dSnw 1518e8c27ec8Sbaban switch (res->id.idtype) { 1519cd37da74Snw case IDMAP_UID: 1520cd37da74Snw is_user_string = "1"; 1521cd37da74Snw break; 1522cd37da74Snw case IDMAP_GID: 1523cd37da74Snw is_user_string = "0"; 1524cd37da74Snw break; 1525cd37da74Snw case IDMAP_POSIXID: 1526cd37da74Snw /* the non-diagonal mapping */ 1527cd37da74Snw is_user_string = "is_wuser"; 1528cd37da74Snw break; 1529cd37da74Snw default: 1530cd37da74Snw retcode = IDMAP_ERR_NOTSUPPORTED; 1531cd37da74Snw goto out; 1532cd37da74Snw } 1533cd37da74Snw 1534c5c4113dSnw /* SQL to lookup the cache */ 153548258c6bSjp 1536e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 1537e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 153848258c6bSjp "unixname, u2w, is_wuser, " 153948258c6bSjp "map_type, map_dn, map_attr, map_value, " 154048258c6bSjp "map_windomain, map_winname, map_unixname, map_is_nt4 " 1541e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND " 1542e8c27ec8Sbaban "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 1543e8c27ec8Sbaban "(pid >= 2147483648 OR " 1544e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 1545e8c27ec8Sbaban "expiration > %d));", 1546e8c27ec8Sbaban is_user_string, req->id1.idmap_id_u.sid.prefix, 1547e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, curtime); 1548e8c27ec8Sbaban } else if (req->id1name != NULL) { 1549042addd6Sbaban if ((lower_name = tolower_u8(req->id1name)) == NULL) 1550042addd6Sbaban lower_name = req->id1name; 1551e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 155248258c6bSjp "unixname, u2w, is_wuser, " 155348258c6bSjp "map_type, map_dn, map_attr, map_value, " 155448258c6bSjp "map_windomain, map_winname, map_unixname, map_is_nt4 " 1555e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND " 1556e8c27ec8Sbaban "winname = %Q AND windomain = %Q AND w2u = 1 AND " 1557e8c27ec8Sbaban "(pid >= 2147483648 OR " 1558e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 1559e8c27ec8Sbaban "expiration > %d));", 156048258c6bSjp is_user_string, lower_name, req->id1domain, 156148258c6bSjp curtime); 1562042addd6Sbaban if (lower_name != req->id1name) 1563042addd6Sbaban free(lower_name); 1564e8c27ec8Sbaban } else { 1565e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 1566e8c27ec8Sbaban goto out; 1567e8c27ec8Sbaban } 1568c5c4113dSnw if (sql == NULL) { 1569c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1570c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1571c5c4113dSnw goto out; 1572c5c4113dSnw } 157348258c6bSjp retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 157448258c6bSjp 14, &values); 1575c5c4113dSnw sqlite_freemem(sql); 1576c5c4113dSnw 1577c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) { 1578c5c4113dSnw goto out; 1579c5c4113dSnw } else if (retcode == IDMAP_SUCCESS) { 1580c5c4113dSnw /* sanity checks */ 1581c5c4113dSnw if (values[0] == NULL || values[1] == NULL) { 1582c5c4113dSnw retcode = IDMAP_ERR_CACHE; 1583c5c4113dSnw goto out; 1584c5c4113dSnw } 1585c5c4113dSnw 1586c5c4113dSnw pid = strtoul(values[0], &end, 10); 1587e8c27ec8Sbaban is_user = strncmp(values[1], "0", 2) ? 1 : 0; 1588c5c4113dSnw 1589cd37da74Snw if (is_user) { 1590cd37da74Snw res->id.idtype = IDMAP_UID; 1591cd37da74Snw res->id.idmap_id_u.uid = pid; 1592cd37da74Snw } else { 1593cd37da74Snw res->id.idtype = IDMAP_GID; 1594cd37da74Snw res->id.idmap_id_u.gid = pid; 1595cd37da74Snw } 1596cd37da74Snw 1597c5c4113dSnw /* 1598c5c4113dSnw * We may have an expired ephemeral mapping. Consider 1599c5c4113dSnw * the expired entry as valid if we are not going to 1600c5c4113dSnw * perform name-based mapping. But do not renew the 1601c5c4113dSnw * expiration. 1602c5c4113dSnw * If we will be doing name-based mapping then store the 1603c5c4113dSnw * ephemeral pid in the result so that we can use it 1604c5c4113dSnw * if we end up doing dynamic mapping again. 1605c5c4113dSnw */ 1606c5c4113dSnw if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) && 1607cd37da74Snw !AVOID_NAMESERVICE(req) && 16089fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States IDMAP_ID_IS_EPHEMERAL(pid) && values[2] != NULL) { 1609cd37da74Snw exp = strtoll(values[2], &end, 10); 1610cd37da74Snw if (exp && exp <= curtime) { 1611cd37da74Snw /* Store the ephemeral pid */ 1612cd37da74Snw res->direction = IDMAP_DIRECTION_BI; 1613cd37da74Snw req->direction |= is_user 1614cd37da74Snw ? _IDMAP_F_EXP_EPH_UID 1615cd37da74Snw : _IDMAP_F_EXP_EPH_GID; 1616cd37da74Snw retcode = IDMAP_ERR_NOTFOUND; 1617c5c4113dSnw } 1618c5c4113dSnw } 1619c5c4113dSnw } 1620c5c4113dSnw 1621c5c4113dSnw out: 1622c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 162362c60062Sbaban if (values[4] != NULL) 1624c5c4113dSnw res->direction = 1625651c0131Sbaban (strtol(values[4], &end, 10) == 0)? 1626651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 1627c5c4113dSnw else 1628651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U; 1629c5c4113dSnw 163062c60062Sbaban if (values[3] != NULL) { 1631e8c27ec8Sbaban if (req->id2name != NULL) 1632e8c27ec8Sbaban free(req->id2name); 16338e228215Sdm req->id2name = strdup(values[3]); 16348e228215Sdm if (req->id2name == NULL) { 1635c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1636c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1637c5c4113dSnw } 1638c5c4113dSnw } 1639e8c27ec8Sbaban 1640e8c27ec8Sbaban req->id1.idtype = strncmp(values[5], "0", 2) ? 1641e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 164248258c6bSjp 164348258c6bSjp if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 164448258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 164548258c6bSjp res->info.how.map_type = strtoul(values[6], &end, 10); 164648258c6bSjp switch (res->info.how.map_type) { 164748258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 164848258c6bSjp res->info.how.idmap_how_u.ad.dn = 164948258c6bSjp strdup(values[7]); 165048258c6bSjp res->info.how.idmap_how_u.ad.attr = 165148258c6bSjp strdup(values[8]); 165248258c6bSjp res->info.how.idmap_how_u.ad.value = 165348258c6bSjp strdup(values[9]); 165448258c6bSjp break; 165548258c6bSjp 165648258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 165748258c6bSjp res->info.how.idmap_how_u.nldap.dn = 165848258c6bSjp strdup(values[7]); 165948258c6bSjp res->info.how.idmap_how_u.nldap.attr = 166048258c6bSjp strdup(values[8]); 166148258c6bSjp res->info.how.idmap_how_u.nldap.value = 166248258c6bSjp strdup(values[9]); 166348258c6bSjp break; 166448258c6bSjp 166548258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 166648258c6bSjp res->info.how.idmap_how_u.rule.windomain = 166748258c6bSjp strdup(values[10]); 166848258c6bSjp res->info.how.idmap_how_u.rule.winname = 166948258c6bSjp strdup(values[11]); 167048258c6bSjp res->info.how.idmap_how_u.rule.unixname = 167148258c6bSjp strdup(values[12]); 167248258c6bSjp res->info.how.idmap_how_u.rule.is_nt4 = 167348258c6bSjp strtoul(values[13], &end, 1); 167448258c6bSjp res->info.how.idmap_how_u.rule.is_user = 167548258c6bSjp is_user; 167648258c6bSjp res->info.how.idmap_how_u.rule.is_wuser = 167748258c6bSjp strtoul(values[5], &end, 1); 167848258c6bSjp break; 167948258c6bSjp 168048258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 168148258c6bSjp break; 168248258c6bSjp 168348258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 168448258c6bSjp break; 168548258c6bSjp 168648258c6bSjp case IDMAP_MAP_TYPE_KNOWN_SID: 168748258c6bSjp break; 168848258c6bSjp 1689e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 1690e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.dn = 1691e3f2c991SKeyur Desai strdup(values[7]); 1692e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.attr = 1693e3f2c991SKeyur Desai strdup(values[8]); 1694e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.value = 1695e3f2c991SKeyur Desai strdup(values[9]); 1696e3f2c991SKeyur Desai break; 1697e3f2c991SKeyur Desai 169848258c6bSjp default: 1699e3f2c991SKeyur Desai /* Unknown mapping type */ 170048258c6bSjp assert(FALSE); 170148258c6bSjp } 170248258c6bSjp } 1703c5c4113dSnw } 170462c60062Sbaban if (vm != NULL) 1705c5c4113dSnw (void) sqlite_finalize(vm, NULL); 1706c5c4113dSnw return (retcode); 1707c5c4113dSnw } 1708c5c4113dSnw 1709*148c5f43SAlan Wright /* 1710*148c5f43SAlan Wright * Previous versions used two enumerations for representing types. 1711*148c5f43SAlan Wright * One of those has largely been eliminated, but was used in the 1712*148c5f43SAlan Wright * name cache table and so during an upgrade might still be visible. 1713*148c5f43SAlan Wright * In addition, the test suite prepopulates the cache with these values. 1714*148c5f43SAlan Wright * 1715*148c5f43SAlan Wright * This function translates those old values into the new values. 1716*148c5f43SAlan Wright * 1717*148c5f43SAlan Wright * This code deliberately does not use symbolic values for the legacy 1718*148c5f43SAlan Wright * values. This is the *only* place where they should be used. 1719*148c5f43SAlan Wright */ 1720*148c5f43SAlan Wright static 1721*148c5f43SAlan Wright idmap_id_type 1722*148c5f43SAlan Wright xlate_legacy_type(int type) 1723*148c5f43SAlan Wright { 1724*148c5f43SAlan Wright switch (type) { 1725*148c5f43SAlan Wright case -1004: /* _IDMAP_T_USER */ 1726*148c5f43SAlan Wright return (IDMAP_USID); 1727*148c5f43SAlan Wright case -1005: /* _IDMAP_T_GROUP */ 1728*148c5f43SAlan Wright return (IDMAP_GSID); 1729*148c5f43SAlan Wright default: 1730*148c5f43SAlan Wright return (type); 1731*148c5f43SAlan Wright } 1732*148c5f43SAlan Wright NOTE(NOTREACHED) 1733*148c5f43SAlan Wright } 1734*148c5f43SAlan Wright 1735cd37da74Snw static 1736cd37da74Snw idmap_retcode 173762c60062Sbaban lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid, 1738*148c5f43SAlan Wright char **canonname, char **canondomain, idmap_id_type *type) 1739cd37da74Snw { 1740c5c4113dSnw char *end; 1741c5c4113dSnw char *sql = NULL; 1742c5c4113dSnw const char **values; 1743c5c4113dSnw sqlite_vm *vm = NULL; 1744c5c4113dSnw int ncol; 1745c5c4113dSnw time_t curtime; 1746c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS; 1747c5c4113dSnw 1748c5c4113dSnw /* Get current time */ 1749c5c4113dSnw errno = 0; 1750c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 1751cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1752cd37da74Snw strerror(errno)); 1753c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 1754c5c4113dSnw goto out; 1755c5c4113dSnw } 1756c5c4113dSnw 1757c5c4113dSnw /* SQL to lookup the cache */ 1758cd37da74Snw sql = sqlite_mprintf("SELECT canon_name, domain, type " 1759cd37da74Snw "FROM name_cache WHERE " 1760cd37da74Snw "sidprefix = %Q AND rid = %u AND " 1761cd37da74Snw "(expiration = 0 OR expiration ISNULL OR " 1762cd37da74Snw "expiration > %d);", 1763cd37da74Snw sidprefix, rid, curtime); 1764c5c4113dSnw if (sql == NULL) { 1765c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1766c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1767c5c4113dSnw goto out; 1768c5c4113dSnw } 1769c5c4113dSnw retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values); 1770c5c4113dSnw sqlite_freemem(sql); 1771c5c4113dSnw 1772c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 177362c60062Sbaban if (type != NULL) { 1774c5c4113dSnw if (values[2] == NULL) { 1775c5c4113dSnw retcode = IDMAP_ERR_CACHE; 1776c5c4113dSnw goto out; 1777c5c4113dSnw } 1778*148c5f43SAlan Wright *type = xlate_legacy_type(strtol(values[2], &end, 10)); 1779c5c4113dSnw } 1780c5c4113dSnw 178108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL && values[0] != NULL) { 178208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if ((*canonname = strdup(values[0])) == NULL) { 1783c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1784c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1785c5c4113dSnw goto out; 1786c5c4113dSnw } 1787c5c4113dSnw } 1788c5c4113dSnw 178908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL && values[1] != NULL) { 179008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if ((*canondomain = strdup(values[1])) == NULL) { 179108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 179208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname); 179308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 1794c5c4113dSnw } 1795c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1796c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1797c5c4113dSnw goto out; 1798c5c4113dSnw } 1799c5c4113dSnw } 1800c5c4113dSnw } 1801c5c4113dSnw 1802c5c4113dSnw out: 180362c60062Sbaban if (vm != NULL) 1804c5c4113dSnw (void) sqlite_finalize(vm, NULL); 1805c5c4113dSnw return (retcode); 1806c5c4113dSnw } 1807c5c4113dSnw 1808c5c4113dSnw /* 1809e8c27ec8Sbaban * Given SID, find winname using name_cache OR 1810e8c27ec8Sbaban * Given winname, find SID using name_cache. 1811e8c27ec8Sbaban * Used when mapping win to unix i.e. req->id1 is windows id and 1812e8c27ec8Sbaban * req->id2 is unix id 1813c5c4113dSnw */ 1814cd37da74Snw static 1815cd37da74Snw idmap_retcode 1816e8c27ec8Sbaban lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1817cd37da74Snw { 1818*148c5f43SAlan Wright idmap_id_type type = -1; 1819c5c4113dSnw idmap_retcode retcode; 1820e8c27ec8Sbaban char *sidprefix = NULL; 1821c5c4113dSnw idmap_rid_t rid; 1822c5c4113dSnw char *name = NULL, *domain = NULL; 1823c5c4113dSnw 1824e8c27ec8Sbaban /* Done if we've both sid and winname */ 1825*148c5f43SAlan Wright if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL) { 1826*148c5f43SAlan Wright /* Don't bother TRACE()ing, too boring */ 1827e8c27ec8Sbaban return (IDMAP_SUCCESS); 1828*148c5f43SAlan Wright } 1829c5c4113dSnw 1830e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 183108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup sid to winname */ 1832e8c27ec8Sbaban retcode = lookup_cache_sid2name(cache, 1833e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix, 1834e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, &name, &domain, &type); 183508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 183608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup winame to sid */ 183708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = lookup_cache_name2sid(cache, req->id1name, 183808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1domain, &name, &sidprefix, &rid, &type); 1839e8c27ec8Sbaban } 184062c60062Sbaban 1841e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 1842*148c5f43SAlan Wright if (retcode == IDMAP_ERR_NOTFOUND) { 1843*148c5f43SAlan Wright TRACE(req, res, "Not found in name cache"); 1844*148c5f43SAlan Wright } else { 1845*148c5f43SAlan Wright TRACE(req, res, "Name cache lookup error=%d", retcode); 1846*148c5f43SAlan Wright } 1847e8c27ec8Sbaban free(name); 1848e8c27ec8Sbaban free(domain); 1849e8c27ec8Sbaban free(sidprefix); 1850e8c27ec8Sbaban return (retcode); 1851e8c27ec8Sbaban } 1852e8c27ec8Sbaban 1853*148c5f43SAlan Wright req->id1.idtype = type; 1854e8c27ec8Sbaban 1855e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 185608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 185708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 185808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we found canonical names or domain, use them instead of 185908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * the existing values. 186008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 1861e8c27ec8Sbaban if (name != NULL) { 186208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(req->id1name); 186308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name = name; 1864e8c27ec8Sbaban } 186508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (domain != NULL) { 186608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(req->id1domain); 1867e8c27ec8Sbaban req->id1domain = domain; 186808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 186908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 1870e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL) { 1871e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = sidprefix; 1872e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid = rid; 1873c5c4113dSnw } 1874*148c5f43SAlan Wright 1875*148c5f43SAlan Wright TRACE(req, res, "Found in name cache"); 1876c5c4113dSnw return (retcode); 1877c5c4113dSnw } 1878c5c4113dSnw 18794d61c878SJulian Pullen 18804d61c878SJulian Pullen 18814d61c878SJulian Pullen static int 18824d61c878SJulian Pullen ad_lookup_batch_int(lookup_state_t *state, idmap_mapping_batch *batch, 1883e3f2c991SKeyur Desai idmap_ids_res *result, adutils_ad_t *dir, int how_local, 1884e3f2c991SKeyur Desai int *num_processed) 1885cd37da74Snw { 1886c5c4113dSnw idmap_retcode retcode; 1887e3f2c991SKeyur Desai int i, num_queued, is_wuser, is_user; 18884d61c878SJulian Pullen int next_request; 1889*148c5f43SAlan Wright int retries = 0, esidtype; 1890e8c27ec8Sbaban char **unixname; 1891c5c4113dSnw idmap_mapping *req; 1892c5c4113dSnw idmap_id_res *res; 1893e8c27ec8Sbaban idmap_query_state_t *qs = NULL; 189448258c6bSjp idmap_how *how; 1895479ac375Sdm char **dn, **attr, **value; 1896e8c27ec8Sbaban 18974d61c878SJulian Pullen *num_processed = 0; 18984d61c878SJulian Pullen 1899e8c27ec8Sbaban /* 1900e8c27ec8Sbaban * Since req->id2.idtype is unused, we will use it here 1901e8c27ec8Sbaban * to retrieve the value of sid_type. But it needs to be 1902e8c27ec8Sbaban * reset to IDMAP_NONE before we return to prevent xdr 1903e8c27ec8Sbaban * from mis-interpreting req->id2 when it tries to free 1904e8c27ec8Sbaban * the input argument. Other option is to allocate an 1905e8c27ec8Sbaban * array of integers and use it instead for the batched 1906e8c27ec8Sbaban * call. But why un-necessarily allocate memory. That may 1907e8c27ec8Sbaban * be an option if req->id2.idtype cannot be re-used in 1908e8c27ec8Sbaban * future. 1909e3f2c991SKeyur Desai * 19109fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Similarly, we use req->id2.idmap_id_u.uid to return 19119fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * uidNumber or gidNumber supplied by IDMU, and reset it 19129fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * back to IDMAP_SENTINEL_PID when we're done. Note that 19139fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * the query always puts the result in req->id2.idmap_id_u.uid, 19149fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * not .gid. 1915e8c27ec8Sbaban */ 1916c5c4113dSnw retry: 1917e3f2c991SKeyur Desai retcode = idmap_lookup_batch_start(dir, state->ad_nqueries, 1918e3f2c991SKeyur Desai state->directory_based_mapping, 1919e3f2c991SKeyur Desai state->defdom, 1920e3f2c991SKeyur Desai &qs); 1921e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 19222b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 19232b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 19240dcc7149Snw goto retry; 1925349d5d8fSnw degrade_svc(1, "failed to create batch for AD lookup"); 19264d61c878SJulian Pullen goto out; 1927c5c4113dSnw } 19284d61c878SJulian Pullen num_queued = 0; 1929c5c4113dSnw 1930c8e26105Sjp restore_svc(); 1931c8e26105Sjp 1932e3f2c991SKeyur Desai if (how_local & FOREST_IS_LOCAL) { 19334d61c878SJulian Pullen /* 19344d61c878SJulian Pullen * Directory based name mapping is only performed within the 1935e3f2c991SKeyur Desai * joined forest. We don't trust other "trusted" 19364d61c878SJulian Pullen * forests to provide DS-based name mapping information because 19374d61c878SJulian Pullen * AD's definition of "cross-forest trust" does not encompass 19384d61c878SJulian Pullen * this sort of behavior. 19394d61c878SJulian Pullen */ 19404d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs, 19414d61c878SJulian Pullen state->ad_unixuser_attr, state->ad_unixgroup_attr); 19424d61c878SJulian Pullen } 1943e8c27ec8Sbaban 19444d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 1945c5c4113dSnw req = &batch->idmap_mapping_batch_val[i]; 1946c5c4113dSnw res = &result->ids.ids_val[i]; 194748258c6bSjp how = &res->info.how; 194848258c6bSjp 1949e8c27ec8Sbaban retcode = IDMAP_SUCCESS; 1950e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE; 19519fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States req->id2.idmap_id_u.uid = IDMAP_SENTINEL_PID; 1952c5c4113dSnw 1953e3f2c991SKeyur Desai /* Skip if no AD lookup required */ 1954e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 1955e3f2c991SKeyur Desai continue; 1956e3f2c991SKeyur Desai 1957e3f2c991SKeyur Desai /* Skip if we've already tried and gotten a "not found" */ 1958e3f2c991SKeyur Desai if (req->direction & _IDMAP_F_LOOKUP_OTHER_AD) 1959e8c27ec8Sbaban continue; 1960e8c27ec8Sbaban 1961e3f2c991SKeyur Desai /* Skip if we've already either succeeded or failed */ 196296c3a9a0Sbaban if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR) 1963e8c27ec8Sbaban continue; 1964e8c27ec8Sbaban 1965*148c5f43SAlan Wright if (IS_ID_SID(req->id1)) { 1966e8c27ec8Sbaban 1967479ac375Sdm /* win2unix request: */ 1968e8c27ec8Sbaban 1969e3f2c991SKeyur Desai posix_id_t *pid = NULL; 1970479ac375Sdm unixname = dn = attr = value = NULL; 1971*148c5f43SAlan Wright esidtype = IDMAP_SID; 1972e3f2c991SKeyur Desai if (state->directory_based_mapping == 1973e3f2c991SKeyur Desai DIRECTORY_MAPPING_NAME && 1974e3f2c991SKeyur Desai req->id2name == NULL) { 1975e8c27ec8Sbaban if (res->id.idtype == IDMAP_UID && 1976e8c27ec8Sbaban AD_OR_MIXED(state->nm_siduid)) { 1977*148c5f43SAlan Wright esidtype = IDMAP_USID; 1978e8c27ec8Sbaban unixname = &req->id2name; 1979e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GID && 1980e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) { 1981*148c5f43SAlan Wright esidtype = IDMAP_GSID; 1982e8c27ec8Sbaban unixname = &req->id2name; 1983e8c27ec8Sbaban } else if (AD_OR_MIXED(state->nm_siduid) || 1984e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) { 1985e8c27ec8Sbaban unixname = &req->id2name; 1986e8c27ec8Sbaban } 19874d61c878SJulian Pullen 1988e3f2c991SKeyur Desai if (unixname != NULL) { 1989e3f2c991SKeyur Desai /* 1990e3f2c991SKeyur Desai * Get how info for DS-based name 1991e3f2c991SKeyur Desai * mapping only if AD or MIXED 1992e3f2c991SKeyur Desai * mode is enabled. 1993e3f2c991SKeyur Desai */ 1994*148c5f43SAlan Wright idmap_how_clear(&res->info.how); 1995e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW; 1996e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_DS_AD; 1997e3f2c991SKeyur Desai dn = &how->idmap_how_u.ad.dn; 1998e3f2c991SKeyur Desai attr = &how->idmap_how_u.ad.attr; 1999e3f2c991SKeyur Desai value = &how->idmap_how_u.ad.value; 2000e3f2c991SKeyur Desai } 2001e3f2c991SKeyur Desai } else if (state->directory_based_mapping == 2002e3f2c991SKeyur Desai DIRECTORY_MAPPING_IDMU && 2003e3f2c991SKeyur Desai (how_local & DOMAIN_IS_LOCAL)) { 2004479ac375Sdm /* 2005e3f2c991SKeyur Desai * Ensure that we only do IDMU processing 2006e3f2c991SKeyur Desai * when querying the domain we've joined. 2007e3f2c991SKeyur Desai */ 2008e3f2c991SKeyur Desai pid = &req->id2.idmap_id_u.uid; 2009e3f2c991SKeyur Desai /* 2010e3f2c991SKeyur Desai * Get how info for IDMU based mapping. 2011479ac375Sdm */ 2012*148c5f43SAlan Wright idmap_how_clear(&res->info.how); 2013479ac375Sdm res->info.src = IDMAP_MAP_SRC_NEW; 2014e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_IDMU; 2015e3f2c991SKeyur Desai dn = &how->idmap_how_u.idmu.dn; 2016e3f2c991SKeyur Desai attr = &how->idmap_how_u.idmu.attr; 2017e3f2c991SKeyur Desai value = &how->idmap_how_u.idmu.value; 2018479ac375Sdm } 2019e3f2c991SKeyur Desai 2020479ac375Sdm if (req->id1.idmap_id_u.sid.prefix != NULL) { 2021479ac375Sdm /* Lookup AD by SID */ 2022479ac375Sdm retcode = idmap_sid2name_batch_add1( 2023479ac375Sdm qs, req->id1.idmap_id_u.sid.prefix, 2024*148c5f43SAlan Wright &req->id1.idmap_id_u.sid.rid, esidtype, 2025479ac375Sdm dn, attr, value, 2026479ac375Sdm (req->id1name == NULL) ? 2027479ac375Sdm &req->id1name : NULL, 2028479ac375Sdm (req->id1domain == NULL) ? 2029479ac375Sdm &req->id1domain : NULL, 2030*148c5f43SAlan Wright &req->id2.idtype, unixname, 2031e3f2c991SKeyur Desai pid, 2032479ac375Sdm &res->retcode); 20334d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 20344d61c878SJulian Pullen num_queued++; 2035479ac375Sdm } else { 2036479ac375Sdm /* Lookup AD by winname */ 2037479ac375Sdm assert(req->id1name != NULL); 2038479ac375Sdm retcode = idmap_name2sid_batch_add1( 2039479ac375Sdm qs, req->id1name, req->id1domain, 2040*148c5f43SAlan Wright esidtype, 2041479ac375Sdm dn, attr, value, 2042479ac375Sdm &req->id1name, 2043479ac375Sdm &req->id1.idmap_id_u.sid.prefix, 2044479ac375Sdm &req->id1.idmap_id_u.sid.rid, 2045*148c5f43SAlan Wright &req->id2.idtype, unixname, 2046e3f2c991SKeyur Desai pid, 2047479ac375Sdm &res->retcode); 20484d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 20494d61c878SJulian Pullen num_queued++; 2050479ac375Sdm } 2051e8c27ec8Sbaban 2052*148c5f43SAlan Wright } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) { 2053479ac375Sdm 2054479ac375Sdm /* unix2win request: */ 2055e8c27ec8Sbaban 2056e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL && 2057e8c27ec8Sbaban req->id2name != NULL) { 20584d61c878SJulian Pullen /* Already have SID and winname. done */ 2059e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS; 2060e8c27ec8Sbaban continue; 2061e8c27ec8Sbaban } 2062c5c4113dSnw 2063e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL) { 2064e8c27ec8Sbaban /* 2065e8c27ec8Sbaban * SID but no winname -- lookup AD by 2066e8c27ec8Sbaban * SID to get winname. 2067479ac375Sdm * how info is not needed here because 2068479ac375Sdm * we are not retrieving unixname from 2069479ac375Sdm * AD. 2070e8c27ec8Sbaban */ 20714d61c878SJulian Pullen 2072e8c27ec8Sbaban retcode = idmap_sid2name_batch_add1( 2073e8c27ec8Sbaban qs, res->id.idmap_id_u.sid.prefix, 2074e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 2075*148c5f43SAlan Wright IDMAP_POSIXID, 2076479ac375Sdm NULL, NULL, NULL, 207748258c6bSjp &req->id2name, 2078*148c5f43SAlan Wright &req->id2domain, &req->id2.idtype, 2079e3f2c991SKeyur Desai NULL, NULL, &res->retcode); 20804d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 20814d61c878SJulian Pullen num_queued++; 2082e8c27ec8Sbaban } else if (req->id2name != NULL) { 2083e8c27ec8Sbaban /* 2084e8c27ec8Sbaban * winname but no SID -- lookup AD by 2085e8c27ec8Sbaban * winname to get SID. 2086479ac375Sdm * how info is not needed here because 2087479ac375Sdm * we are not retrieving unixname from 2088479ac375Sdm * AD. 2089e8c27ec8Sbaban */ 2090e8c27ec8Sbaban retcode = idmap_name2sid_batch_add1( 2091e8c27ec8Sbaban qs, req->id2name, req->id2domain, 2092*148c5f43SAlan Wright IDMAP_POSIXID, 2093479ac375Sdm NULL, NULL, NULL, NULL, 2094e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix, 2095e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 2096*148c5f43SAlan Wright &req->id2.idtype, NULL, 2097e3f2c991SKeyur Desai NULL, 2098e8c27ec8Sbaban &res->retcode); 20994d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 21004d61c878SJulian Pullen num_queued++; 2101e3f2c991SKeyur Desai } else if (state->directory_based_mapping == 2102e3f2c991SKeyur Desai DIRECTORY_MAPPING_IDMU && 2103e3f2c991SKeyur Desai (how_local & DOMAIN_IS_LOCAL)) { 21049fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.uid != 21059fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States IDMAP_SENTINEL_PID); 2106*148c5f43SAlan Wright is_user = IS_ID_UID(req->id1); 2107e3f2c991SKeyur Desai if (res->id.idtype == IDMAP_USID) 2108e3f2c991SKeyur Desai is_wuser = 1; 2109e3f2c991SKeyur Desai else if (res->id.idtype == IDMAP_GSID) 2110e3f2c991SKeyur Desai is_wuser = 0; 2111e3f2c991SKeyur Desai else 2112e3f2c991SKeyur Desai is_wuser = is_user; 2113e3f2c991SKeyur Desai 2114e3f2c991SKeyur Desai /* IDMU can't do diagonal mappings */ 2115e3f2c991SKeyur Desai if (is_user != is_wuser) 2116e3f2c991SKeyur Desai continue; 2117e3f2c991SKeyur Desai 2118*148c5f43SAlan Wright idmap_how_clear(&res->info.how); 2119e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW; 2120e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_IDMU; 2121e3f2c991SKeyur Desai retcode = idmap_pid2sid_batch_add1( 2122e3f2c991SKeyur Desai qs, req->id1.idmap_id_u.uid, is_user, 2123e3f2c991SKeyur Desai &how->idmap_how_u.ad.dn, 2124e3f2c991SKeyur Desai &how->idmap_how_u.ad.attr, 2125e3f2c991SKeyur Desai &how->idmap_how_u.ad.value, 2126e3f2c991SKeyur Desai &res->id.idmap_id_u.sid.prefix, 2127e3f2c991SKeyur Desai &res->id.idmap_id_u.sid.rid, 2128e3f2c991SKeyur Desai &req->id2name, &req->id2domain, 2129*148c5f43SAlan Wright &req->id2.idtype, &res->retcode); 2130e3f2c991SKeyur Desai if (retcode == IDMAP_SUCCESS) 2131e3f2c991SKeyur Desai num_queued++; 2132e8c27ec8Sbaban } else if (req->id1name != NULL) { 2133e8c27ec8Sbaban /* 21344d61c878SJulian Pullen * No SID and no winname but we've unixname. 21354d61c878SJulian Pullen * Lookup AD by unixname to get SID. 2136e8c27ec8Sbaban */ 2137*148c5f43SAlan Wright is_user = (IS_ID_UID(req->id1)) ? 1 : 0; 2138e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID) 2139e8c27ec8Sbaban is_wuser = 1; 2140e8c27ec8Sbaban else if (res->id.idtype == IDMAP_GSID) 2141e8c27ec8Sbaban is_wuser = 0; 2142e8c27ec8Sbaban else 2143e8c27ec8Sbaban is_wuser = is_user; 21444d61c878SJulian Pullen 2145*148c5f43SAlan Wright idmap_how_clear(&res->info.how); 214648258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 214748258c6bSjp how->map_type = IDMAP_MAP_TYPE_DS_AD; 2148e8c27ec8Sbaban retcode = idmap_unixname2sid_batch_add1( 2149e8c27ec8Sbaban qs, req->id1name, is_user, is_wuser, 215048258c6bSjp &how->idmap_how_u.ad.dn, 215148258c6bSjp &how->idmap_how_u.ad.attr, 215248258c6bSjp &how->idmap_how_u.ad.value, 2153e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix, 2154e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 2155e8c27ec8Sbaban &req->id2name, &req->id2domain, 2156*148c5f43SAlan Wright &req->id2.idtype, &res->retcode); 21574d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 21584d61c878SJulian Pullen num_queued++; 2159e8c27ec8Sbaban } 2160e8c27ec8Sbaban } 21614d61c878SJulian Pullen 21624d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) { 21634d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD; 21644d61c878SJulian Pullen retcode = IDMAP_SUCCESS; 21654d61c878SJulian Pullen } else if (retcode != IDMAP_SUCCESS) { 2166e8c27ec8Sbaban break; 2167c5c4113dSnw } 21684d61c878SJulian Pullen } /* End of for loop */ 2169c5c4113dSnw 217096c3a9a0Sbaban if (retcode == IDMAP_SUCCESS) { 217196c3a9a0Sbaban /* add keeps track if we added an entry to the batch */ 21724d61c878SJulian Pullen if (num_queued > 0) 217396c3a9a0Sbaban retcode = idmap_lookup_batch_end(&qs); 217496c3a9a0Sbaban else 217596c3a9a0Sbaban idmap_lookup_release_batch(&qs); 2176e3f2c991SKeyur Desai } else { 2177e3f2c991SKeyur Desai idmap_lookup_release_batch(&qs); 2178e3f2c991SKeyur Desai num_queued = 0; 2179e3f2c991SKeyur Desai next_request = i + 1; 218096c3a9a0Sbaban } 2181c5c4113dSnw 21822b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 21832b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 2184e8c27ec8Sbaban goto retry; 2185e8c27ec8Sbaban else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 2186349d5d8fSnw degrade_svc(1, "some AD lookups timed out repeatedly"); 2187e8c27ec8Sbaban 21884d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) { 21894d61c878SJulian Pullen /* Mark any unproccessed requests for an other AD */ 21904d61c878SJulian Pullen for (i = next_request; i < batch->idmap_mapping_batch_len; 21914d61c878SJulian Pullen i++) { 21924d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 21934d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD; 21944d61c878SJulian Pullen 21954d61c878SJulian Pullen } 21964d61c878SJulian Pullen } 21974d61c878SJulian Pullen 2198e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 2199e8c27ec8Sbaban idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests"); 2200e8c27ec8Sbaban 2201e8c27ec8Sbaban out: 2202e8c27ec8Sbaban /* 2203e8c27ec8Sbaban * This loop does the following: 2204479ac375Sdm * 1. Reset _IDMAP_F_LOOKUP_AD flag from the request. 2205479ac375Sdm * 2. Reset req->id2.idtype to IDMAP_NONE 2206479ac375Sdm * 3. If batch_start or batch_add failed then set the status 2207479ac375Sdm * of each request marked for AD lookup to that error. 22084d61c878SJulian Pullen * 4. Evaluate the type of the AD object (i.e. user or group) 22094d61c878SJulian Pullen * and update the idtype in request. 2210e8c27ec8Sbaban */ 2211cd37da74Snw for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 2212*148c5f43SAlan Wright idmap_id_type type; 2213e3f2c991SKeyur Desai uid_t posix_id; 2214e3f2c991SKeyur Desai 2215cd37da74Snw req = &batch->idmap_mapping_batch_val[i]; 2216e8c27ec8Sbaban type = req->id2.idtype; 2217e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE; 2218e3f2c991SKeyur Desai posix_id = req->id2.idmap_id_u.uid; 22199fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States req->id2.idmap_id_u.uid = IDMAP_SENTINEL_PID; 22205e0794bcSbaban res = &result->ids.ids_val[i]; 2221e3f2c991SKeyur Desai 2222e3f2c991SKeyur Desai /* 2223e3f2c991SKeyur Desai * If it didn't need AD lookup, ignore it. 2224e3f2c991SKeyur Desai */ 2225e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 2226cd37da74Snw continue; 2227cd37da74Snw 2228e3f2c991SKeyur Desai /* 2229e3f2c991SKeyur Desai * If we deferred it this time, reset for the next 2230e3f2c991SKeyur Desai * AD server. 2231e3f2c991SKeyur Desai */ 2232e3f2c991SKeyur Desai if (req->direction & _IDMAP_F_LOOKUP_OTHER_AD) { 2233e3f2c991SKeyur Desai req->direction &= ~_IDMAP_F_LOOKUP_OTHER_AD; 2234e3f2c991SKeyur Desai continue; 2235e3f2c991SKeyur Desai } 2236e3f2c991SKeyur Desai 22374d61c878SJulian Pullen /* Count number processed */ 22384d61c878SJulian Pullen (*num_processed)++; 22394d61c878SJulian Pullen 2240479ac375Sdm /* Reset AD lookup flag */ 2241479ac375Sdm req->direction &= ~(_IDMAP_F_LOOKUP_AD); 2242479ac375Sdm 2243479ac375Sdm /* 22444d61c878SJulian Pullen * If batch_start or batch_add failed then set the 22454d61c878SJulian Pullen * status of each request marked for AD lookup to 22464d61c878SJulian Pullen * that error. 2247479ac375Sdm */ 2248e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 2249e8c27ec8Sbaban res->retcode = retcode; 2250cd37da74Snw continue; 2251cd37da74Snw } 2252cd37da74Snw 225348258c6bSjp if (res->retcode == IDMAP_ERR_NOTFOUND) { 225448258c6bSjp /* Nothing found - remove the preset info */ 2255*148c5f43SAlan Wright idmap_how_clear(&res->info.how); 225648258c6bSjp } 225748258c6bSjp 2258*148c5f43SAlan Wright if (IS_ID_SID(req->id1)) { 2259e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) 2260e8c27ec8Sbaban continue; 2261479ac375Sdm /* Evaluate result type */ 2262e8c27ec8Sbaban switch (type) { 2263*148c5f43SAlan Wright case IDMAP_USID: 2264e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) 2265e8c27ec8Sbaban res->id.idtype = IDMAP_UID; 2266e3f2c991SKeyur Desai /* 2267e3f2c991SKeyur Desai * We found a user. If we got information 2268e3f2c991SKeyur Desai * from IDMU and we were expecting a user, 2269e3f2c991SKeyur Desai * copy the id. 2270e3f2c991SKeyur Desai */ 22719fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (posix_id != IDMAP_SENTINEL_PID && 2272e3f2c991SKeyur Desai res->id.idtype == IDMAP_UID) { 2273e3f2c991SKeyur Desai res->id.idmap_id_u.uid = posix_id; 2274e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI; 2275e3f2c991SKeyur Desai res->info.how.map_type = 2276e3f2c991SKeyur Desai IDMAP_MAP_TYPE_IDMU; 2277e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW; 2278e3f2c991SKeyur Desai } 2279e8c27ec8Sbaban req->id1.idtype = IDMAP_USID; 2280e8c27ec8Sbaban break; 22814d61c878SJulian Pullen 2282*148c5f43SAlan Wright case IDMAP_GSID: 2283e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) 2284e8c27ec8Sbaban res->id.idtype = IDMAP_GID; 2285e3f2c991SKeyur Desai /* 2286e3f2c991SKeyur Desai * We found a group. If we got information 2287e3f2c991SKeyur Desai * from IDMU and we were expecting a group, 2288e3f2c991SKeyur Desai * copy the id. 2289e3f2c991SKeyur Desai */ 22909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (posix_id != IDMAP_SENTINEL_PID && 2291e3f2c991SKeyur Desai res->id.idtype == IDMAP_GID) { 2292e3f2c991SKeyur Desai res->id.idmap_id_u.gid = posix_id; 2293e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI; 2294e3f2c991SKeyur Desai res->info.how.map_type = 2295e3f2c991SKeyur Desai IDMAP_MAP_TYPE_IDMU; 2296e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW; 2297e3f2c991SKeyur Desai } 2298e8c27ec8Sbaban req->id1.idtype = IDMAP_GSID; 2299e8c27ec8Sbaban break; 23004d61c878SJulian Pullen 2301e8c27ec8Sbaban default: 2302e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID; 2303e8c27ec8Sbaban break; 2304e8c27ec8Sbaban } 2305479ac375Sdm if (res->retcode == IDMAP_SUCCESS && 2306479ac375Sdm req->id1name != NULL && 2307479ac375Sdm (req->id2name == NULL || 23089fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID) && 2309479ac375Sdm NLDAP_MODE(res->id.idtype, state)) { 2310479ac375Sdm req->direction |= _IDMAP_F_LOOKUP_NLDAP; 2311479ac375Sdm state->nldap_nqueries++; 2312479ac375Sdm } 2313*148c5f43SAlan Wright } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) { 2314e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 2315e8c27ec8Sbaban if ((!(IDMAP_FATAL_ERROR(res->retcode))) && 2316e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix == NULL && 2317e3f2c991SKeyur Desai req->id2name == NULL) /* no winname */ 2318e8c27ec8Sbaban /* 2319e3f2c991SKeyur Desai * If AD lookup by unixname or pid 23204d61c878SJulian Pullen * failed with non fatal error 23214d61c878SJulian Pullen * then clear the error (ie set 23224d61c878SJulian Pullen * res->retcode to success). 23234d61c878SJulian Pullen * This allows the next pass to 23244d61c878SJulian Pullen * process other mapping 2325479ac375Sdm * mechanisms for this request. 2326e8c27ec8Sbaban */ 2327e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS; 2328e8c27ec8Sbaban continue; 2329e8c27ec8Sbaban } 2330479ac375Sdm /* Evaluate result type */ 2331e8c27ec8Sbaban switch (type) { 2332*148c5f43SAlan Wright case IDMAP_USID: 2333*148c5f43SAlan Wright case IDMAP_GSID: 2334e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2335*148c5f43SAlan Wright res->id.idtype = type; 2336e8c27ec8Sbaban break; 23374d61c878SJulian Pullen 2338e8c27ec8Sbaban default: 2339e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID; 2340e8c27ec8Sbaban break; 2341e8c27ec8Sbaban } 2342e8c27ec8Sbaban } 2343e8c27ec8Sbaban } 2344c5c4113dSnw 23454d61c878SJulian Pullen return (retcode); 23464d61c878SJulian Pullen } 23474d61c878SJulian Pullen 23484d61c878SJulian Pullen 23494d61c878SJulian Pullen 23504d61c878SJulian Pullen /* 23514d61c878SJulian Pullen * Batch AD lookups 23524d61c878SJulian Pullen */ 23534d61c878SJulian Pullen idmap_retcode 23544d61c878SJulian Pullen ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch, 23554d61c878SJulian Pullen idmap_ids_res *result) 23564d61c878SJulian Pullen { 23574d61c878SJulian Pullen idmap_retcode retcode; 23584d61c878SJulian Pullen int i, j; 23594d61c878SJulian Pullen idmap_mapping *req; 23604d61c878SJulian Pullen idmap_id_res *res; 23614d61c878SJulian Pullen int num_queries; 23624d61c878SJulian Pullen int num_processed; 23634d61c878SJulian Pullen 23644d61c878SJulian Pullen if (state->ad_nqueries == 0) 23654d61c878SJulian Pullen return (IDMAP_SUCCESS); 23664d61c878SJulian Pullen 23674d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 23684d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 23694d61c878SJulian Pullen res = &result->ids.ids_val[i]; 23704d61c878SJulian Pullen 23714d61c878SJulian Pullen /* Skip if not marked for AD lookup or already in error. */ 23724d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD) || 23734d61c878SJulian Pullen res->retcode != IDMAP_SUCCESS) 23744d61c878SJulian Pullen continue; 23754d61c878SJulian Pullen 23764d61c878SJulian Pullen /* Init status */ 23774d61c878SJulian Pullen res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR; 23784d61c878SJulian Pullen } 23794d61c878SJulian Pullen 23804d61c878SJulian Pullen RDLOCK_CONFIG(); 23814d61c878SJulian Pullen num_queries = state->ad_nqueries; 23824d61c878SJulian Pullen 2383e3f2c991SKeyur Desai if (_idmapdstate.num_gcs == 0 && _idmapdstate.num_dcs == 0) { 23844d61c878SJulian Pullen /* Case of no ADs */ 23854d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 23864d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 23874d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 23884d61c878SJulian Pullen res = &result->ids.ids_val[i]; 23894d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 23904d61c878SJulian Pullen continue; 23914d61c878SJulian Pullen req->direction &= ~(_IDMAP_F_LOOKUP_AD); 23924d61c878SJulian Pullen res->retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 23934d61c878SJulian Pullen } 2394e3f2c991SKeyur Desai goto out; 23954d61c878SJulian Pullen } 2396e3f2c991SKeyur Desai 2397e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) { 2398e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_dcs && num_queries > 0; i++) { 2399e3f2c991SKeyur Desai 2400e3f2c991SKeyur Desai retcode = ad_lookup_batch_int(state, batch, 2401e3f2c991SKeyur Desai result, _idmapdstate.dcs[i], 2402e3f2c991SKeyur Desai i == 0 ? DOMAIN_IS_LOCAL|FOREST_IS_LOCAL : 0, 2403e3f2c991SKeyur Desai &num_processed); 2404e3f2c991SKeyur Desai num_queries -= num_processed; 2405e3f2c991SKeyur Desai 2406e3f2c991SKeyur Desai } 2407e3f2c991SKeyur Desai } 2408e3f2c991SKeyur Desai 2409e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_gcs && num_queries > 0; i++) { 2410e3f2c991SKeyur Desai 2411e3f2c991SKeyur Desai retcode = ad_lookup_batch_int(state, batch, result, 2412e3f2c991SKeyur Desai _idmapdstate.gcs[i], 2413e3f2c991SKeyur Desai i == 0 ? FOREST_IS_LOCAL : 0, 2414e3f2c991SKeyur Desai &num_processed); 2415e3f2c991SKeyur Desai num_queries -= num_processed; 2416e3f2c991SKeyur Desai 2417e3f2c991SKeyur Desai } 2418e3f2c991SKeyur Desai 2419e3f2c991SKeyur Desai /* 2420e3f2c991SKeyur Desai * There are no more ADs to try. Return errors for any 2421e3f2c991SKeyur Desai * remaining requests. 2422e3f2c991SKeyur Desai */ 2423e3f2c991SKeyur Desai if (num_queries > 0) { 2424e3f2c991SKeyur Desai for (j = 0; j < batch->idmap_mapping_batch_len; j++) { 2425e3f2c991SKeyur Desai req = &batch->idmap_mapping_batch_val[j]; 2426e3f2c991SKeyur Desai res = &result->ids.ids_val[j]; 2427e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 2428e3f2c991SKeyur Desai continue; 2429e3f2c991SKeyur Desai req->direction &= ~(_IDMAP_F_LOOKUP_AD); 2430e3f2c991SKeyur Desai res->retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 2431e3f2c991SKeyur Desai } 2432e3f2c991SKeyur Desai } 2433e3f2c991SKeyur Desai 2434e3f2c991SKeyur Desai out: 24354d61c878SJulian Pullen UNLOCK_CONFIG(); 24364d61c878SJulian Pullen 2437e8c27ec8Sbaban /* AD lookups done. Reset state->ad_nqueries and return */ 2438e8c27ec8Sbaban state->ad_nqueries = 0; 2439c5c4113dSnw return (retcode); 2440c5c4113dSnw } 2441c5c4113dSnw 2442cd37da74Snw /* 2443cd37da74Snw * Convention when processing win2unix requests: 2444cd37da74Snw * 2445cd37da74Snw * Windows identity: 2446cd37da74Snw * req->id1name = 2447cd37da74Snw * winname if given otherwise winname found will be placed 2448cd37da74Snw * here. 2449cd37da74Snw * req->id1domain = 2450cd37da74Snw * windomain if given otherwise windomain found will be 2451cd37da74Snw * placed here. 2452cd37da74Snw * req->id1.idtype = 2453cd37da74Snw * Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll 2454cd37da74Snw * be set to IDMAP_USID/GSID depending upon whether the 2455cd37da74Snw * given SID is user or group respectively. The user/group-ness 2456cd37da74Snw * is determined either when looking up well-known SIDs table OR 2457fe1c642dSBill Krier * if the SID is found in namecache OR by ad_lookup_batch(). 2458cd37da74Snw * req->id1..sid.[prefix, rid] = 2459cd37da74Snw * SID if given otherwise SID found will be placed here. 2460cd37da74Snw * 2461cd37da74Snw * Unix identity: 2462cd37da74Snw * req->id2name = 2463cd37da74Snw * unixname found will be placed here. 2464cd37da74Snw * req->id2domain = 2465cd37da74Snw * NOT USED 2466cd37da74Snw * res->id.idtype = 2467cd37da74Snw * Target type initialized from req->id2.idtype. If 2468cd37da74Snw * it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found 2469cd37da74Snw * will be placed here. 2470cd37da74Snw * res->id..[uid or gid] = 2471cd37da74Snw * UID/GID found will be placed here. 2472cd37da74Snw * 2473cd37da74Snw * Others: 2474cd37da74Snw * res->retcode = 2475cd37da74Snw * Return status for this request will be placed here. 2476cd37da74Snw * res->direction = 2477cd37da74Snw * Direction found will be placed here. Direction 2478cd37da74Snw * meaning whether the resultant mapping is valid 2479cd37da74Snw * only from win2unix or bi-directional. 2480cd37da74Snw * req->direction = 2481cd37da74Snw * INTERNAL USE. Used by idmapd to set various 2482cd37da74Snw * flags (_IDMAP_F_xxxx) to aid in processing 2483cd37da74Snw * of the request. 2484cd37da74Snw * req->id2.idtype = 2485cd37da74Snw * INTERNAL USE. Initially this is the requested target 2486cd37da74Snw * type and is used to initialize res->id.idtype. 2487cd37da74Snw * ad_lookup_batch() uses this field temporarily to store 2488cd37da74Snw * sid_type obtained by the batched AD lookups and after 2489cd37da74Snw * use resets it to IDMAP_NONE to prevent xdr from 2490cd37da74Snw * mis-interpreting the contents of req->id2. 2491e3f2c991SKeyur Desai * req->id2.idmap_id_u.uid = 2492e3f2c991SKeyur Desai * INTERNAL USE. If the AD lookup finds IDMU data 2493e3f2c991SKeyur Desai * (uidNumber or gidNumber, depending on the type of 2494e3f2c991SKeyur Desai * the entry), it's left here. 2495cd37da74Snw */ 2496cd37da74Snw 2497cd37da74Snw /* 2498cd37da74Snw * This function does the following: 2499cd37da74Snw * 1. Lookup well-known SIDs table. 2500cd37da74Snw * 2. Check if the given SID is a local-SID and if so extract UID/GID from it. 2501cd37da74Snw * 3. Lookup cache. 2502cd37da74Snw * 4. Check if the client does not want new mapping to be allocated 2503cd37da74Snw * in which case this pass is the final pass. 2504cd37da74Snw * 5. Set AD lookup flag if it determines that the next stage needs 2505cd37da74Snw * to do AD lookup. 2506cd37da74Snw */ 2507c5c4113dSnw idmap_retcode 2508479ac375Sdm sid2pid_first_pass(lookup_state_t *state, idmap_mapping *req, 2509cd37da74Snw idmap_id_res *res) 2510cd37da74Snw { 2511c5c4113dSnw idmap_retcode retcode; 2512e8c27ec8Sbaban int wksid; 2513c5c4113dSnw 2514e8c27ec8Sbaban /* Initialize result */ 2515e8c27ec8Sbaban res->id.idtype = req->id2.idtype; 25169fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = IDMAP_SENTINEL_PID; 2517e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF; 2518e8c27ec8Sbaban wksid = 0; 2519c5c4113dSnw 2520cf5b5989Sdm if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) { 2521fe1c642dSBill Krier /* They have to give us *something* to work with! */ 2522e8c27ec8Sbaban if (req->id1name == NULL) { 2523e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 2524e8c27ec8Sbaban goto out; 2525e8c27ec8Sbaban } 2526fe1c642dSBill Krier 2527e8c27ec8Sbaban /* sanitize sidprefix */ 2528e8c27ec8Sbaban free(req->id1.idmap_id_u.sid.prefix); 2529e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = NULL; 2530fe1c642dSBill Krier 2531fe1c642dSBill Krier /* Allow for a fully-qualified name in the "name" parameter */ 2532fe1c642dSBill Krier if (req->id1domain == NULL) { 2533fe1c642dSBill Krier char *p; 2534fe1c642dSBill Krier p = strchr(req->id1name, '@'); 2535fe1c642dSBill Krier if (p != NULL) { 2536fe1c642dSBill Krier char *q; 2537fe1c642dSBill Krier q = req->id1name; 2538fe1c642dSBill Krier req->id1name = strndup(q, p - req->id1name); 2539fe1c642dSBill Krier req->id1domain = strdup(p+1); 2540fe1c642dSBill Krier free(q); 2541fe1c642dSBill Krier if (req->id1name == NULL || 2542fe1c642dSBill Krier req->id1domain == NULL) { 2543fe1c642dSBill Krier retcode = IDMAP_ERR_MEMORY; 2544fe1c642dSBill Krier goto out; 2545fe1c642dSBill Krier } 2546fe1c642dSBill Krier } 2547fe1c642dSBill Krier } 2548c5c4113dSnw } 2549c5c4113dSnw 2550e8c27ec8Sbaban /* Lookup well-known SIDs table */ 2551e8c27ec8Sbaban retcode = lookup_wksids_sid2pid(req, res, &wksid); 2552*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2553*148c5f43SAlan Wright /* Found a well-known account with a hardwired mapping */ 2554*148c5f43SAlan Wright TRACE(req, res, "Hardwired mapping"); 2555*148c5f43SAlan Wright goto out; 2556*148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 2557*148c5f43SAlan Wright TRACE(req, res, 2558*148c5f43SAlan Wright "Well-known account lookup failed, code %d", retcode); 2559c5c4113dSnw goto out; 2560*148c5f43SAlan Wright } 2561*148c5f43SAlan Wright 2562*148c5f43SAlan Wright if (wksid) { 2563*148c5f43SAlan Wright /* Found a well-known account, but no mapping */ 2564*148c5f43SAlan Wright TRACE(req, res, "Well-known account"); 2565*148c5f43SAlan Wright } else { 2566*148c5f43SAlan Wright TRACE(req, res, "Not a well-known account"); 2567c5c4113dSnw 25682b4a7802SBaban Kenkre /* Check if this is a localsid */ 2569e8c27ec8Sbaban retcode = lookup_localsid2pid(req, res); 2570*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2571*148c5f43SAlan Wright TRACE(req, res, "Local SID"); 2572*148c5f43SAlan Wright goto out; 2573*148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 2574*148c5f43SAlan Wright TRACE(req, res, 2575*148c5f43SAlan Wright "Local SID lookup error=%d", retcode); 2576e8c27ec8Sbaban goto out; 2577*148c5f43SAlan Wright } 2578*148c5f43SAlan Wright TRACE(req, res, "Not a local SID"); 25792b4a7802SBaban Kenkre 25802b4a7802SBaban Kenkre if (ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)) { 25814d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 25822b4a7802SBaban Kenkre goto out; 25832b4a7802SBaban Kenkre } 2584e8c27ec8Sbaban } 2585e8c27ec8Sbaban 2586fe1c642dSBill Krier /* 2587fe1c642dSBill Krier * If this is a name-based request and we don't have a domain, 2588fe1c642dSBill Krier * use the default domain. Note that the well-known identity 2589fe1c642dSBill Krier * cases will have supplied a SID prefix already, and that we 2590fe1c642dSBill Krier * don't (yet?) support looking up a local user through a Windows 2591fe1c642dSBill Krier * style name. 2592fe1c642dSBill Krier */ 2593fe1c642dSBill Krier if (req->id1.idmap_id_u.sid.prefix == NULL && 2594fe1c642dSBill Krier req->id1name != NULL && req->id1domain == NULL) { 2595fe1c642dSBill Krier if (state->defdom == NULL) { 2596fe1c642dSBill Krier retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 2597fe1c642dSBill Krier goto out; 2598fe1c642dSBill Krier } 2599fe1c642dSBill Krier req->id1domain = strdup(state->defdom); 2600fe1c642dSBill Krier if (req->id1domain == NULL) { 2601fe1c642dSBill Krier retcode = IDMAP_ERR_MEMORY; 2602fe1c642dSBill Krier goto out; 2603fe1c642dSBill Krier } 2604*148c5f43SAlan Wright TRACE(req, res, "Added default domain"); 2605fe1c642dSBill Krier } 2606fe1c642dSBill Krier 2607e8c27ec8Sbaban /* Lookup cache */ 2608479ac375Sdm retcode = lookup_cache_sid2pid(state->cache, req, res); 2609*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2610*148c5f43SAlan Wright TRACE(req, res, "Found in mapping cache"); 2611c5c4113dSnw goto out; 2612*148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 2613*148c5f43SAlan Wright TRACE(req, res, "Mapping cache lookup error=%d", retcode); 2614*148c5f43SAlan Wright goto out; 2615*148c5f43SAlan Wright } 2616*148c5f43SAlan Wright TRACE(req, res, "Not found in mapping cache"); 2617c5c4113dSnw 2618c5c4113dSnw if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) { 26194d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 2620c5c4113dSnw goto out; 2621c5c4113dSnw } 2622c5c4113dSnw 2623c5c4113dSnw /* 2624e8c27ec8Sbaban * Failed to find non-expired entry in cache. Next step is 2625e8c27ec8Sbaban * to determine if this request needs to be batched for AD lookup. 2626e8c27ec8Sbaban * 2627e8c27ec8Sbaban * At this point we have either sid or winname or both. If we don't 2628e8c27ec8Sbaban * have both then lookup name_cache for the sid or winname 2629e8c27ec8Sbaban * whichever is missing. If not found then this request will be 2630e8c27ec8Sbaban * batched for AD lookup. 2631c5c4113dSnw */ 2632479ac375Sdm retcode = lookup_name_cache(state->cache, req, res); 2633*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2634*148c5f43SAlan Wright if (res->id.idtype == IDMAP_POSIXID) { 2635*148c5f43SAlan Wright if (req->id1.idtype == IDMAP_USID) 2636*148c5f43SAlan Wright res->id.idtype = IDMAP_UID; 2637*148c5f43SAlan Wright else 2638*148c5f43SAlan Wright res->id.idtype = IDMAP_GID; 2639*148c5f43SAlan Wright } 2640*148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) 2641e8c27ec8Sbaban goto out; 2642c5c4113dSnw 2643*148c5f43SAlan Wright if (_idmapdstate.cfg->pgcfg.use_lsa && 2644*148c5f43SAlan Wright _idmapdstate.cfg->pgcfg.domain_name != NULL) { 2645*148c5f43SAlan Wright /* 2646*148c5f43SAlan Wright * If we don't have both name and SID, try looking up the 2647*148c5f43SAlan Wright * entry with LSA. 2648*148c5f43SAlan Wright */ 2649*148c5f43SAlan Wright if (req->id1.idmap_id_u.sid.prefix != NULL && 2650*148c5f43SAlan Wright req->id1name == NULL) { 2651*148c5f43SAlan Wright 2652*148c5f43SAlan Wright retcode = lookup_lsa_by_sid( 2653*148c5f43SAlan Wright req->id1.idmap_id_u.sid.prefix, 2654*148c5f43SAlan Wright req->id1.idmap_id_u.sid.rid, 2655*148c5f43SAlan Wright &req->id1name, &req->id1domain, &req->id1.idtype); 2656*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2657*148c5f43SAlan Wright TRACE(req, res, "Found with LSA"); 2658*148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) { 2659*148c5f43SAlan Wright TRACE(req, res, "Not found with LSA"); 2660*148c5f43SAlan Wright } else { 2661*148c5f43SAlan Wright TRACE(req, res, "LSA error %d", retcode); 2662*148c5f43SAlan Wright goto out; 2663*148c5f43SAlan Wright } 2664*148c5f43SAlan Wright 2665*148c5f43SAlan Wright } else if (req->id1name != NULL && 2666*148c5f43SAlan Wright req->id1.idmap_id_u.sid.prefix == NULL) { 2667*148c5f43SAlan Wright char *canonname; 2668*148c5f43SAlan Wright char *canondomain; 2669*148c5f43SAlan Wright 2670*148c5f43SAlan Wright retcode = lookup_lsa_by_name( 2671*148c5f43SAlan Wright req->id1name, req->id1domain, 2672*148c5f43SAlan Wright &req->id1.idmap_id_u.sid.prefix, 2673*148c5f43SAlan Wright &req->id1.idmap_id_u.sid.rid, 2674*148c5f43SAlan Wright &canonname, &canondomain, 2675*148c5f43SAlan Wright &req->id1.idtype); 2676*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2677*148c5f43SAlan Wright free(req->id1name); 2678*148c5f43SAlan Wright req->id1name = canonname; 2679*148c5f43SAlan Wright free(req->id1domain); 2680*148c5f43SAlan Wright req->id1domain = canondomain; 2681*148c5f43SAlan Wright TRACE(req, res, "Found with LSA"); 2682*148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) { 2683*148c5f43SAlan Wright TRACE(req, res, "Not found with LSA"); 2684*148c5f43SAlan Wright } else { 2685*148c5f43SAlan Wright TRACE(req, res, "LSA error %d", retcode); 2686*148c5f43SAlan Wright goto out; 2687*148c5f43SAlan Wright } 2688*148c5f43SAlan Wright } 2689*148c5f43SAlan Wright } 2690*148c5f43SAlan Wright 2691c5c4113dSnw /* 2692e8c27ec8Sbaban * Set the flag to indicate that we are not done yet so that 2693e8c27ec8Sbaban * subsequent passes considers this request for name-based 2694e8c27ec8Sbaban * mapping and ephemeral mapping. 2695c5c4113dSnw */ 2696e8c27ec8Sbaban state->sid2pid_done = FALSE; 2697e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE; 2698c5c4113dSnw 2699c5c4113dSnw /* 2700e8c27ec8Sbaban * Even if we have both sid and winname, we still may need to batch 2701e8c27ec8Sbaban * this request for AD lookup if we don't have unixname and 2702e8c27ec8Sbaban * directory-based name mapping (AD or mixed) is enabled. 2703e8c27ec8Sbaban * We avoid AD lookup for well-known SIDs because they don't have 2704e8c27ec8Sbaban * regular AD objects. 2705c5c4113dSnw */ 2706e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS || 2707e8c27ec8Sbaban (!wksid && req->id2name == NULL && 2708e3f2c991SKeyur Desai AD_OR_MIXED_MODE(res->id.idtype, state)) || 27099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States (!wksid && res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID && 2710e3f2c991SKeyur Desai state->directory_based_mapping == DIRECTORY_MAPPING_IDMU)) { 2711c5c4113dSnw retcode = IDMAP_SUCCESS; 2712e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD; 2713c5c4113dSnw state->ad_nqueries++; 2714479ac375Sdm } else if (NLDAP_MODE(res->id.idtype, state)) { 2715479ac375Sdm req->direction |= _IDMAP_F_LOOKUP_NLDAP; 2716479ac375Sdm state->nldap_nqueries++; 2717c5c4113dSnw } 2718c5c4113dSnw 2719c5c4113dSnw 2720c5c4113dSnw out: 2721c5c4113dSnw res->retcode = idmap_stat4prot(retcode); 2722e8c27ec8Sbaban /* 2723e8c27ec8Sbaban * If we are done and there was an error then set fallback pid 2724e8c27ec8Sbaban * in the result. 2725e8c27ec8Sbaban */ 2726e8c27ec8Sbaban if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) 2727e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY; 2728c5c4113dSnw return (retcode); 2729c5c4113dSnw } 2730c5c4113dSnw 2731c5c4113dSnw /* 2732c5c4113dSnw * Generate SID using the following convention 2733c5c4113dSnw * <machine-sid-prefix>-<1000 + uid> 2734c5c4113dSnw * <machine-sid-prefix>-<2^31 + gid> 2735c5c4113dSnw */ 2736cd37da74Snw static 2737cd37da74Snw idmap_retcode 273848258c6bSjp generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user, 273948258c6bSjp int fallback) 2740cd37da74Snw { 2741e8c27ec8Sbaban free(res->id.idmap_id_u.sid.prefix); 2742e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = NULL; 2743c5c4113dSnw 2744e8c27ec8Sbaban /* 2745e8c27ec8Sbaban * Diagonal mapping for localSIDs not supported because of the 2746e8c27ec8Sbaban * way we generate localSIDs. 2747e8c27ec8Sbaban */ 2748e8c27ec8Sbaban if (is_user && res->id.idtype == IDMAP_GSID) 2749a0aa776eSAlan Wright return (IDMAP_ERR_NOTGROUP); 2750e8c27ec8Sbaban if (!is_user && res->id.idtype == IDMAP_USID) 2751a0aa776eSAlan Wright return (IDMAP_ERR_NOTUSER); 2752c5c4113dSnw 2753e8c27ec8Sbaban /* Skip 1000 UIDs */ 27541fcced4cSJordan Brown if (is_user && 27551fcced4cSJordan Brown req->id1.idmap_id_u.uid + LOCALRID_UID_MIN > LOCALRID_UID_MAX) 2756e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 2757e8c27ec8Sbaban 2758e8c27ec8Sbaban RDLOCK_CONFIG(); 2759e8c27ec8Sbaban /* 2760e8c27ec8Sbaban * machine_sid is never NULL because if it is we won't be here. 2761*148c5f43SAlan Wright * No need to assert because strdup(NULL) will core anyways. 2762e8c27ec8Sbaban */ 2763e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = 2764e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.machine_sid); 2765e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix == NULL) { 2766e8c27ec8Sbaban UNLOCK_CONFIG(); 2767e8c27ec8Sbaban idmapdlog(LOG_ERR, "Out of memory"); 2768e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 2769c5c4113dSnw } 2770e8c27ec8Sbaban UNLOCK_CONFIG(); 2771e8c27ec8Sbaban res->id.idmap_id_u.sid.rid = 27721fcced4cSJordan Brown (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_UID_MIN : 27731fcced4cSJordan Brown req->id1.idmap_id_u.gid + LOCALRID_GID_MIN; 2774e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 2775e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2776e8c27ec8Sbaban res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 2777c5c4113dSnw 2778fc724630SAlan Wright if (!fallback) { 277948258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 278048258c6bSjp res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 278148258c6bSjp } 278248258c6bSjp 2783e8c27ec8Sbaban /* 2784e8c27ec8Sbaban * Don't update name_cache because local sids don't have 2785e8c27ec8Sbaban * valid windows names. 2786e8c27ec8Sbaban */ 2787e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 2788e8c27ec8Sbaban return (IDMAP_SUCCESS); 2789c5c4113dSnw } 2790c5c4113dSnw 2791cd37da74Snw static 2792cd37da74Snw idmap_retcode 2793cd37da74Snw lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res) 2794cd37da74Snw { 2795c5c4113dSnw char *sidprefix; 2796c5c4113dSnw uint32_t rid; 2797c5c4113dSnw int s; 2798c5c4113dSnw 2799c5c4113dSnw /* 2800c5c4113dSnw * If the sidprefix == localsid then UID = last RID - 1000 or 2801c5c4113dSnw * GID = last RID - 2^31. 2802c5c4113dSnw */ 2803e8c27ec8Sbaban if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL) 2804e8c27ec8Sbaban /* This means we are looking up by winname */ 2805e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2806c5c4113dSnw rid = req->id1.idmap_id_u.sid.rid; 2807c5c4113dSnw 2808c5c4113dSnw RDLOCK_CONFIG(); 2809cd37da74Snw s = (_idmapdstate.cfg->pgcfg.machine_sid) ? 2810cd37da74Snw strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1; 2811c5c4113dSnw UNLOCK_CONFIG(); 2812c5c4113dSnw 2813e8c27ec8Sbaban /* 2814e8c27ec8Sbaban * If the given sidprefix does not match machine_sid then this is 2815e8c27ec8Sbaban * not a local SID. 2816e8c27ec8Sbaban */ 2817e8c27ec8Sbaban if (s != 0) 2818e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2819e8c27ec8Sbaban 2820e8c27ec8Sbaban switch (res->id.idtype) { 2821e8c27ec8Sbaban case IDMAP_UID: 28221fcced4cSJordan Brown if (rid < LOCALRID_UID_MIN || rid > LOCALRID_UID_MAX) 2823e8c27ec8Sbaban return (IDMAP_ERR_ARG); 28241fcced4cSJordan Brown res->id.idmap_id_u.uid = rid - LOCALRID_UID_MIN; 2825e8c27ec8Sbaban break; 2826e8c27ec8Sbaban case IDMAP_GID: 28271fcced4cSJordan Brown if (rid < LOCALRID_GID_MIN) 2828e8c27ec8Sbaban return (IDMAP_ERR_ARG); 28291fcced4cSJordan Brown res->id.idmap_id_u.gid = rid - LOCALRID_GID_MIN; 2830e8c27ec8Sbaban break; 2831e8c27ec8Sbaban case IDMAP_POSIXID: 28321fcced4cSJordan Brown if (rid >= LOCALRID_GID_MIN) { 28331fcced4cSJordan Brown res->id.idmap_id_u.gid = rid - LOCALRID_GID_MIN; 2834c5c4113dSnw res->id.idtype = IDMAP_GID; 28351fcced4cSJordan Brown } else if (rid >= LOCALRID_UID_MIN) { 28361fcced4cSJordan Brown res->id.idmap_id_u.uid = rid - LOCALRID_UID_MIN; 2837e8c27ec8Sbaban res->id.idtype = IDMAP_UID; 28381fcced4cSJordan Brown } else { 28391fcced4cSJordan Brown return (IDMAP_ERR_ARG); 2840c5c4113dSnw } 2841e8c27ec8Sbaban break; 2842e8c27ec8Sbaban default: 2843e8c27ec8Sbaban return (IDMAP_ERR_NOTSUPPORTED); 2844c5c4113dSnw } 2845fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 2846fc724630SAlan Wright res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 2847e8c27ec8Sbaban return (IDMAP_SUCCESS); 2848c5c4113dSnw } 2849c5c4113dSnw 2850e8c27ec8Sbaban /* 2851e8c27ec8Sbaban * Name service lookup by unixname to get pid 2852e8c27ec8Sbaban */ 2853cd37da74Snw static 2854cd37da74Snw idmap_retcode 2855e8c27ec8Sbaban ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id) 2856cd37da74Snw { 2857cd37da74Snw struct passwd pwd, *pwdp; 2858cd37da74Snw struct group grp, *grpp; 28598c155366SJordan Brown char *buf; 28608c155366SJordan Brown static size_t pwdbufsiz = 0; 28618c155366SJordan Brown static size_t grpbufsiz = 0; 2862c5c4113dSnw 2863e8c27ec8Sbaban switch (id->idtype) { 2864e8c27ec8Sbaban case IDMAP_UID: 28658c155366SJordan Brown if (pwdbufsiz == 0) 28668c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX); 28678c155366SJordan Brown buf = alloca(pwdbufsiz); 28688c155366SJordan Brown pwdp = getpwnam_r(name, &pwd, buf, pwdbufsiz); 2869e8c27ec8Sbaban if (pwdp == NULL && errno == 0 && lower_name != NULL && 2870cd37da74Snw name != lower_name && strcmp(name, lower_name) != 0) 28718c155366SJordan Brown pwdp = getpwnam_r(lower_name, &pwd, buf, pwdbufsiz); 2872cd37da74Snw if (pwdp == NULL) { 2873bbf6f00cSJordan Brown if (errno == 0) 2874c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 2875c5c4113dSnw else 2876c5c4113dSnw return (IDMAP_ERR_INTERNAL); 2877c5c4113dSnw } 2878e8c27ec8Sbaban id->idmap_id_u.uid = pwd.pw_uid; 2879e8c27ec8Sbaban break; 2880e8c27ec8Sbaban case IDMAP_GID: 28818c155366SJordan Brown if (grpbufsiz == 0) 28828c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX); 28838c155366SJordan Brown buf = alloca(grpbufsiz); 28848c155366SJordan Brown grpp = getgrnam_r(name, &grp, buf, grpbufsiz); 2885e8c27ec8Sbaban if (grpp == NULL && errno == 0 && lower_name != NULL && 2886cd37da74Snw name != lower_name && strcmp(name, lower_name) != 0) 28878c155366SJordan Brown grpp = getgrnam_r(lower_name, &grp, buf, grpbufsiz); 2888cd37da74Snw if (grpp == NULL) { 2889bbf6f00cSJordan Brown if (errno == 0) 2890c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 2891c5c4113dSnw else 2892c5c4113dSnw return (IDMAP_ERR_INTERNAL); 2893c5c4113dSnw } 2894e8c27ec8Sbaban id->idmap_id_u.gid = grp.gr_gid; 2895e8c27ec8Sbaban break; 2896e8c27ec8Sbaban default: 2897e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2898e8c27ec8Sbaban } 2899e8c27ec8Sbaban return (IDMAP_SUCCESS); 2900e8c27ec8Sbaban } 2901e8c27ec8Sbaban 2902e8c27ec8Sbaban 2903e8c27ec8Sbaban /* 2904e8c27ec8Sbaban * Name service lookup by pid to get unixname 2905e8c27ec8Sbaban */ 2906e8c27ec8Sbaban static 2907e8c27ec8Sbaban idmap_retcode 2908e8c27ec8Sbaban ns_lookup_bypid(uid_t pid, int is_user, char **unixname) 2909e8c27ec8Sbaban { 2910e8c27ec8Sbaban struct passwd pwd; 2911e8c27ec8Sbaban struct group grp; 29128c155366SJordan Brown char *buf; 29138c155366SJordan Brown static size_t pwdbufsiz = 0; 29148c155366SJordan Brown static size_t grpbufsiz = 0; 2915e8c27ec8Sbaban 2916e8c27ec8Sbaban if (is_user) { 29178c155366SJordan Brown if (pwdbufsiz == 0) 29188c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX); 29198c155366SJordan Brown buf = alloca(pwdbufsiz); 2920e8c27ec8Sbaban errno = 0; 29218c155366SJordan Brown if (getpwuid_r(pid, &pwd, buf, pwdbufsiz) == NULL) { 2922bbf6f00cSJordan Brown if (errno == 0) 2923e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2924e8c27ec8Sbaban else 2925e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL); 2926e8c27ec8Sbaban } 2927e8c27ec8Sbaban *unixname = strdup(pwd.pw_name); 2928e8c27ec8Sbaban } else { 29298c155366SJordan Brown if (grpbufsiz == 0) 29308c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX); 29318c155366SJordan Brown buf = alloca(grpbufsiz); 2932e8c27ec8Sbaban errno = 0; 29338c155366SJordan Brown if (getgrgid_r(pid, &grp, buf, grpbufsiz) == NULL) { 2934bbf6f00cSJordan Brown if (errno == 0) 2935e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2936e8c27ec8Sbaban else 2937e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL); 2938e8c27ec8Sbaban } 2939e8c27ec8Sbaban *unixname = strdup(grp.gr_name); 2940c5c4113dSnw } 2941e8c27ec8Sbaban if (*unixname == NULL) 2942e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 2943c5c4113dSnw return (IDMAP_SUCCESS); 2944c5c4113dSnw } 2945c5c4113dSnw 2946c5c4113dSnw /* 2947c5c4113dSnw * Name-based mapping 2948c5c4113dSnw * 2949c5c4113dSnw * Case 1: If no rule matches do ephemeral 2950c5c4113dSnw * 2951c5c4113dSnw * Case 2: If rule matches and unixname is "" then return no mapping. 2952c5c4113dSnw * 2953c5c4113dSnw * Case 3: If rule matches and unixname is specified then lookup name 2954c5c4113dSnw * service using the unixname. If unixname not found then return no mapping. 2955c5c4113dSnw * 2956c5c4113dSnw * Case 4: If rule matches and unixname is * then lookup name service 2957c5c4113dSnw * using winname as the unixname. If unixname not found then process 2958c5c4113dSnw * other rules using the lookup order. If no other rule matches then do 2959c5c4113dSnw * ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4. 2960c5c4113dSnw * This allows us to specify a fallback unixname per _domain_ or no mapping 2961c5c4113dSnw * instead of the default behaviour of doing ephemeral mapping. 2962c5c4113dSnw * 2963c5c4113dSnw * Example 1: 2964c5c4113dSnw * *@sfbay == * 2965c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2966c5c4113dSnw * the name service then foo@sfbay will be mapped to an ephemeral id. 2967c5c4113dSnw * 2968c5c4113dSnw * Example 2: 2969c5c4113dSnw * *@sfbay == * 2970c5c4113dSnw * *@sfbay => guest 2971c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2972c5c4113dSnw * the name service then foo@sfbay will be mapped to guest. 2973c5c4113dSnw * 2974c5c4113dSnw * Example 3: 2975c5c4113dSnw * *@sfbay == * 2976c5c4113dSnw * *@sfbay => "" 2977c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2978c5c4113dSnw * the name service then we will return no mapping for foo@sfbay. 2979c5c4113dSnw * 2980c5c4113dSnw */ 2981cd37da74Snw static 2982cd37da74Snw idmap_retcode 2983479ac375Sdm name_based_mapping_sid2pid(lookup_state_t *state, 2984479ac375Sdm idmap_mapping *req, idmap_id_res *res) 2985cd37da74Snw { 2986cd37da74Snw const char *unixname, *windomain; 2987cd37da74Snw char *sql = NULL, *errmsg = NULL, *lower_winname = NULL; 2988c5c4113dSnw idmap_retcode retcode; 2989cd37da74Snw char *end, *lower_unixname, *winname; 2990c5c4113dSnw const char **values; 2991c5c4113dSnw sqlite_vm *vm = NULL; 299208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int ncol, r, is_user, is_wuser; 299348258c6bSjp idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 299448258c6bSjp int direction; 2995c5c4113dSnw const char *me = "name_based_mapping_sid2pid"; 2996c5c4113dSnw 2997e8c27ec8Sbaban assert(req->id1name != NULL); /* We have winname */ 2998e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have unixname */ 2999e8c27ec8Sbaban 30008e228215Sdm winname = req->id1name; 30018e228215Sdm windomain = req->id1domain; 3002cd37da74Snw 3003cd37da74Snw switch (req->id1.idtype) { 3004cd37da74Snw case IDMAP_USID: 3005cd37da74Snw is_wuser = 1; 3006cd37da74Snw break; 3007cd37da74Snw case IDMAP_GSID: 3008cd37da74Snw is_wuser = 0; 3009cd37da74Snw break; 3010cd37da74Snw default: 3011e8c27ec8Sbaban idmapdlog(LOG_ERR, "%s: Unable to determine if the " 3012e8c27ec8Sbaban "given Windows id is user or group.", me); 3013cd37da74Snw return (IDMAP_ERR_INTERNAL); 3014cd37da74Snw } 3015cd37da74Snw 3016e8c27ec8Sbaban switch (res->id.idtype) { 3017cd37da74Snw case IDMAP_UID: 3018cd37da74Snw is_user = 1; 3019cd37da74Snw break; 3020cd37da74Snw case IDMAP_GID: 3021cd37da74Snw is_user = 0; 3022cd37da74Snw break; 3023cd37da74Snw case IDMAP_POSIXID: 3024cd37da74Snw is_user = is_wuser; 3025cd37da74Snw res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID; 3026cd37da74Snw break; 3027cd37da74Snw } 3028c5c4113dSnw 3029479ac375Sdm if (windomain == NULL) 303062c60062Sbaban windomain = ""; 3031c5c4113dSnw 3032cd37da74Snw if ((lower_winname = tolower_u8(winname)) == NULL) 3033cd37da74Snw lower_winname = winname; /* hope for the best */ 3034c5c4113dSnw sql = sqlite_mprintf( 303548258c6bSjp "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 " 303648258c6bSjp "FROM namerules WHERE " 3037cd37da74Snw "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND " 3038cd37da74Snw "(winname = %Q OR winname = '*') AND " 303908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States "(windomain = %Q OR windomain = '*') " 3040cd37da74Snw "ORDER BY w2u_order ASC;", 304108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States is_user, is_wuser, lower_winname, windomain); 3042c5c4113dSnw if (sql == NULL) { 3043c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3044c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3045c5c4113dSnw goto out; 3046c5c4113dSnw } 3047c5c4113dSnw 3048479ac375Sdm if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 3049c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3050cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3051cd37da74Snw CHECK_NULL(errmsg)); 3052c5c4113dSnw sqlite_freemem(errmsg); 3053c5c4113dSnw goto out; 3054c5c4113dSnw } 3055c5c4113dSnw 305648258c6bSjp for (;;) { 3057c5c4113dSnw r = sqlite_step(vm, &ncol, &values, NULL); 305884decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 3059c5c4113dSnw 306084decf41Sjp if (r == SQLITE_ROW) { 306148258c6bSjp if (ncol < 5) { 3062c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3063c5c4113dSnw goto out; 3064c5c4113dSnw } 3065*148c5f43SAlan Wright 3066*148c5f43SAlan Wright TRACE(req, res, "Matching rule: %s@%s -> %s", 3067*148c5f43SAlan Wright values[2] == NULL ? "(null)" : values[2], 3068*148c5f43SAlan Wright values[3] == NULL ? "(null)" : values[3], 3069*148c5f43SAlan Wright values[0] == NULL ? "(null)" : values[0]); 3070*148c5f43SAlan Wright 3071c5c4113dSnw if (values[0] == NULL) { 3072c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3073c5c4113dSnw goto out; 3074c5c4113dSnw } 3075c5c4113dSnw 307648258c6bSjp if (values[1] != NULL) 307748258c6bSjp direction = 307848258c6bSjp (strtol(values[1], &end, 10) == 0)? 307948258c6bSjp IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 308048258c6bSjp else 308148258c6bSjp direction = IDMAP_DIRECTION_W2U; 308248258c6bSjp 3083c5c4113dSnw if (EMPTY_NAME(values[0])) { 3084*148c5f43SAlan Wright TRACE(req, res, "Mapping inhibited"); 308548258c6bSjp idmap_namerule_set(rule, values[3], values[2], 30869fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[0], is_user, is_wuser, 308748258c6bSjp strtol(values[4], &end, 10), 308848258c6bSjp direction); 3089c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 3090c5c4113dSnw goto out; 3091c5c4113dSnw } 309248258c6bSjp 309348258c6bSjp if (values[0][0] == '*') { 309448258c6bSjp unixname = winname; 309548258c6bSjp lower_unixname = lower_winname; 309648258c6bSjp } else { 309748258c6bSjp unixname = values[0]; 309848258c6bSjp lower_unixname = NULL; 309948258c6bSjp } 310048258c6bSjp 3101e8c27ec8Sbaban retcode = ns_lookup_byname(unixname, lower_unixname, 3102e8c27ec8Sbaban &res->id); 3103*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 3104*148c5f43SAlan Wright break; 3105*148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) { 3106*148c5f43SAlan Wright if (values[0][0] == '*') { 3107*148c5f43SAlan Wright TRACE(req, res, 3108*148c5f43SAlan Wright "%s not found, continuing", 3109*148c5f43SAlan Wright unixname); 3110c5c4113dSnw /* Case 4 */ 3111c5c4113dSnw continue; 3112*148c5f43SAlan Wright } else { 3113*148c5f43SAlan Wright TRACE(req, res, 3114*148c5f43SAlan Wright "%s not found, error", unixname); 3115c5c4113dSnw /* Case 3 */ 311648258c6bSjp idmap_namerule_set(rule, values[3], 31179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[2], values[0], is_user, 31189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States is_wuser, 311948258c6bSjp strtol(values[4], &end, 10), 312048258c6bSjp direction); 3121c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 312248258c6bSjp } 3123*148c5f43SAlan Wright } else { 3124*148c5f43SAlan Wright TRACE(req, res, "Looking up %s error=%d", 3125*148c5f43SAlan Wright unixname, retcode); 3126c5c4113dSnw } 3127c5c4113dSnw goto out; 3128c5c4113dSnw } else if (r == SQLITE_DONE) { 3129c5c4113dSnw retcode = IDMAP_ERR_NOTFOUND; 3130c5c4113dSnw goto out; 3131c5c4113dSnw } else { 3132c5c4113dSnw (void) sqlite_finalize(vm, &errmsg); 3133c5c4113dSnw vm = NULL; 3134cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3135cd37da74Snw CHECK_NULL(errmsg)); 3136c5c4113dSnw sqlite_freemem(errmsg); 3137c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3138c5c4113dSnw goto out; 3139c5c4113dSnw } 3140c5c4113dSnw } 3141c5c4113dSnw 3142*148c5f43SAlan Wright /* Found */ 314348258c6bSjp 3144*148c5f43SAlan Wright if (values[1] != NULL) 3145*148c5f43SAlan Wright res->direction = 3146*148c5f43SAlan Wright (strtol(values[1], &end, 10) == 0)? 3147*148c5f43SAlan Wright IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 3148*148c5f43SAlan Wright else 3149*148c5f43SAlan Wright res->direction = IDMAP_DIRECTION_W2U; 3150*148c5f43SAlan Wright 3151*148c5f43SAlan Wright req->id2name = strdup(unixname); 3152*148c5f43SAlan Wright if (req->id2name == NULL) { 3153*148c5f43SAlan Wright retcode = IDMAP_ERR_MEMORY; 3154*148c5f43SAlan Wright goto out; 3155479ac375Sdm } 3156*148c5f43SAlan Wright TRACE(req, res, "UNIX name found"); 3157479ac375Sdm 3158*148c5f43SAlan Wright idmap_namerule_set(rule, values[3], values[2], 3159*148c5f43SAlan Wright values[0], is_user, is_wuser, strtol(values[4], &end, 10), 3160*148c5f43SAlan Wright res->direction); 3161*148c5f43SAlan Wright 3162*148c5f43SAlan Wright out: 3163*148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS && 3164*148c5f43SAlan Wright retcode != IDMAP_ERR_NOTFOUND && 3165*148c5f43SAlan Wright retcode != IDMAP_ERR_NOMAPPING) { 3166*148c5f43SAlan Wright TRACE(req, res, "Rule processing error, code=%d", retcode); 3167fc724630SAlan Wright } 3168fc724630SAlan Wright 3169*148c5f43SAlan Wright if (sql != NULL) 3170*148c5f43SAlan Wright sqlite_freemem(sql); 3171*148c5f43SAlan Wright 3172fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) { 3173fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 317448258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 3175c5c4113dSnw } 3176479ac375Sdm 3177cd37da74Snw if (lower_winname != NULL && lower_winname != winname) 3178cd37da74Snw free(lower_winname); 317962c60062Sbaban if (vm != NULL) 3180c5c4113dSnw (void) sqlite_finalize(vm, NULL); 3181c5c4113dSnw return (retcode); 3182c5c4113dSnw } 3183c5c4113dSnw 3184c5c4113dSnw static 3185c5c4113dSnw int 3186c5c4113dSnw get_next_eph_uid(uid_t *next_uid) 3187c5c4113dSnw { 3188c5c4113dSnw uid_t uid; 3189c5c4113dSnw gid_t gid; 3190c5c4113dSnw int err; 3191c5c4113dSnw 3192c5c4113dSnw *next_uid = (uid_t)-1; 3193c5c4113dSnw uid = _idmapdstate.next_uid++; 3194c5c4113dSnw if (uid >= _idmapdstate.limit_uid) { 3195c5c4113dSnw if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0) 3196c5c4113dSnw return (err); 3197c5c4113dSnw 3198c5c4113dSnw _idmapdstate.limit_uid = uid + 8192; 3199c5c4113dSnw _idmapdstate.next_uid = uid; 3200c5c4113dSnw } 3201c5c4113dSnw *next_uid = uid; 3202c5c4113dSnw 3203c5c4113dSnw return (0); 3204c5c4113dSnw } 3205c5c4113dSnw 3206c5c4113dSnw static 3207c5c4113dSnw int 3208c5c4113dSnw get_next_eph_gid(gid_t *next_gid) 3209c5c4113dSnw { 3210c5c4113dSnw uid_t uid; 3211c5c4113dSnw gid_t gid; 3212c5c4113dSnw int err; 3213c5c4113dSnw 3214c5c4113dSnw *next_gid = (uid_t)-1; 3215c5c4113dSnw gid = _idmapdstate.next_gid++; 3216c5c4113dSnw if (gid >= _idmapdstate.limit_gid) { 3217c5c4113dSnw if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0) 3218c5c4113dSnw return (err); 3219c5c4113dSnw 3220c5c4113dSnw _idmapdstate.limit_gid = gid + 8192; 3221c5c4113dSnw _idmapdstate.next_gid = gid; 3222c5c4113dSnw } 3223c5c4113dSnw *next_gid = gid; 3224c5c4113dSnw 3225c5c4113dSnw return (0); 3226c5c4113dSnw } 3227c5c4113dSnw 322862c60062Sbaban static 322962c60062Sbaban int 3230cd37da74Snw gethash(const char *str, uint32_t num, uint_t htsize) 3231cd37da74Snw { 323262c60062Sbaban uint_t hval, i, len; 323362c60062Sbaban 323462c60062Sbaban if (str == NULL) 323562c60062Sbaban return (0); 323662c60062Sbaban for (len = strlen(str), hval = 0, i = 0; i < len; i++) { 323762c60062Sbaban hval += str[i]; 323862c60062Sbaban hval += (hval << 10); 323962c60062Sbaban hval ^= (hval >> 6); 324062c60062Sbaban } 324162c60062Sbaban for (str = (const char *)&num, i = 0; i < sizeof (num); i++) { 324262c60062Sbaban hval += str[i]; 324362c60062Sbaban hval += (hval << 10); 324462c60062Sbaban hval ^= (hval >> 6); 324562c60062Sbaban } 324662c60062Sbaban hval += (hval << 3); 324762c60062Sbaban hval ^= (hval >> 11); 324862c60062Sbaban hval += (hval << 15); 324962c60062Sbaban return (hval % htsize); 325062c60062Sbaban } 325162c60062Sbaban 325262c60062Sbaban static 325362c60062Sbaban int 325462c60062Sbaban get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid, 3255cd37da74Snw uid_t *pid) 3256cd37da74Snw { 325762c60062Sbaban uint_t next, key; 325862c60062Sbaban uint_t htsize = state->sid_history_size; 325962c60062Sbaban idmap_sid *sid; 326062c60062Sbaban 326162c60062Sbaban next = gethash(prefix, rid, htsize); 326262c60062Sbaban while (next != htsize) { 326362c60062Sbaban key = state->sid_history[next].key; 326462c60062Sbaban if (key == htsize) 326562c60062Sbaban return (0); 326662c60062Sbaban sid = &state->batch->idmap_mapping_batch_val[key].id1. 326762c60062Sbaban idmap_id_u.sid; 326862c60062Sbaban if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) { 326962c60062Sbaban *pid = state->result->ids.ids_val[key].id. 327062c60062Sbaban idmap_id_u.uid; 327162c60062Sbaban return (1); 327262c60062Sbaban } 327362c60062Sbaban next = state->sid_history[next].next; 327462c60062Sbaban } 327562c60062Sbaban return (0); 327662c60062Sbaban } 327762c60062Sbaban 327862c60062Sbaban static 327962c60062Sbaban void 3280cd37da74Snw add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid) 3281cd37da74Snw { 328262c60062Sbaban uint_t hash, next; 328362c60062Sbaban uint_t htsize = state->sid_history_size; 328462c60062Sbaban 328562c60062Sbaban hash = next = gethash(prefix, rid, htsize); 328662c60062Sbaban while (state->sid_history[next].key != htsize) { 328762c60062Sbaban next++; 328862c60062Sbaban next %= htsize; 328962c60062Sbaban } 329062c60062Sbaban state->sid_history[next].key = state->curpos; 329162c60062Sbaban if (hash == next) 329262c60062Sbaban return; 329362c60062Sbaban state->sid_history[next].next = state->sid_history[hash].next; 329462c60062Sbaban state->sid_history[hash].next = next; 329562c60062Sbaban } 3296c5c4113dSnw 3297e8c27ec8Sbaban void 3298e8c27ec8Sbaban cleanup_lookup_state(lookup_state_t *state) 3299e8c27ec8Sbaban { 3300e8c27ec8Sbaban free(state->sid_history); 3301e8c27ec8Sbaban free(state->ad_unixuser_attr); 3302e8c27ec8Sbaban free(state->ad_unixgroup_attr); 3303479ac375Sdm free(state->nldap_winname_attr); 3304479ac375Sdm free(state->defdom); 3305e8c27ec8Sbaban } 3306e8c27ec8Sbaban 3307c5c4113dSnw /* ARGSUSED */ 3308c5c4113dSnw static 3309c5c4113dSnw idmap_retcode 3310479ac375Sdm dynamic_ephemeral_mapping(lookup_state_t *state, 3311cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3312cd37da74Snw { 3313c5c4113dSnw 3314c5c4113dSnw uid_t next_pid; 3315c5c4113dSnw 331662c60062Sbaban res->direction = IDMAP_DIRECTION_BI; 331762c60062Sbaban 33189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 331948258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 332048258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 332162c60062Sbaban return (IDMAP_SUCCESS); 332248258c6bSjp } 332362c60062Sbaban 332462c60062Sbaban if (state->sid_history != NULL && 332562c60062Sbaban get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix, 332662c60062Sbaban req->id1.idmap_id_u.sid.rid, &next_pid)) { 332762c60062Sbaban res->id.idmap_id_u.uid = next_pid; 332848258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 332948258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 333062c60062Sbaban return (IDMAP_SUCCESS); 333162c60062Sbaban } 333262c60062Sbaban 333362c60062Sbaban if (res->id.idtype == IDMAP_UID) { 3334c5c4113dSnw if (get_next_eph_uid(&next_pid) != 0) 3335c5c4113dSnw return (IDMAP_ERR_INTERNAL); 3336c5c4113dSnw res->id.idmap_id_u.uid = next_pid; 3337c5c4113dSnw } else { 3338c5c4113dSnw if (get_next_eph_gid(&next_pid) != 0) 3339c5c4113dSnw return (IDMAP_ERR_INTERNAL); 3340c5c4113dSnw res->id.idmap_id_u.gid = next_pid; 3341c5c4113dSnw } 3342c5c4113dSnw 334348258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 334448258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 334562c60062Sbaban if (state->sid_history != NULL) 334662c60062Sbaban add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix, 334762c60062Sbaban req->id1.idmap_id_u.sid.rid); 334862c60062Sbaban 3349c5c4113dSnw return (IDMAP_SUCCESS); 3350c5c4113dSnw } 3351c5c4113dSnw 3352c5c4113dSnw idmap_retcode 3353479ac375Sdm sid2pid_second_pass(lookup_state_t *state, 3354cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3355cd37da74Snw { 3356c5c4113dSnw idmap_retcode retcode; 3357*148c5f43SAlan Wright idmap_retcode retcode2; 3358c5c4113dSnw 3359c5c4113dSnw /* Check if second pass is needed */ 3360e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3361c5c4113dSnw return (res->retcode); 3362c5c4113dSnw 3363c5c4113dSnw /* Get status from previous pass */ 3364e8c27ec8Sbaban retcode = res->retcode; 33654aa0a5e7Snw if (retcode != IDMAP_SUCCESS && state->eph_map_unres_sids && 33664aa0a5e7Snw !EMPTY_STRING(req->id1.idmap_id_u.sid.prefix) && 33674aa0a5e7Snw EMPTY_STRING(req->id1name)) { 33684aa0a5e7Snw /* 33694aa0a5e7Snw * We are asked to map an unresolvable SID to a UID or 33704aa0a5e7Snw * GID, but, which? We'll treat all unresolvable SIDs 33714aa0a5e7Snw * as users unless the caller specified which of a UID 33724aa0a5e7Snw * or GID they want. 33734aa0a5e7Snw */ 3374a7c8bd9fSNicolas Williams if (req->id1.idtype == IDMAP_SID) 3375a7c8bd9fSNicolas Williams req->id1.idtype = IDMAP_USID; 3376*148c5f43SAlan Wright if (res->id.idtype == IDMAP_POSIXID) { 33774aa0a5e7Snw res->id.idtype = IDMAP_UID; 3378*148c5f43SAlan Wright TRACE(req, res, "Assume unresolvable SID is user"); 3379*148c5f43SAlan Wright } else if (res->id.idtype == IDMAP_UID) { 3380*148c5f43SAlan Wright TRACE(req, res, "Must map unresolvable SID to user"); 3381*148c5f43SAlan Wright } else if (res->id.idtype == IDMAP_GID) { 3382*148c5f43SAlan Wright TRACE(req, res, "Must map unresolvable SID to group"); 3383*148c5f43SAlan Wright } 33844aa0a5e7Snw goto do_eph; 33854aa0a5e7Snw } 3386e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 3387e8c27ec8Sbaban goto out; 3388c5c4113dSnw 3389e3f2c991SKeyur Desai /* 3390e3f2c991SKeyur Desai * There are two ways we might get here with a Posix ID: 3391e3f2c991SKeyur Desai * - It could be from an expired ephemeral cache entry. 3392e3f2c991SKeyur Desai * - It could be from IDMU. 3393e3f2c991SKeyur Desai * If it's from IDMU, we need to look up the name, for name-based 3394e3f2c991SKeyur Desai * requests and the cache. 3395e3f2c991SKeyur Desai */ 33969fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (!IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid) && 33979fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID) { 3398e3f2c991SKeyur Desai if (req->id2name == NULL) { 3399e3f2c991SKeyur Desai /* 3400e3f2c991SKeyur Desai * If the lookup fails, go ahead anyway. 3401e3f2c991SKeyur Desai * The general UNIX rule is that it's OK to 3402e3f2c991SKeyur Desai * have a UID or GID that isn't in the 3403e3f2c991SKeyur Desai * name service. 3404e3f2c991SKeyur Desai */ 3405*148c5f43SAlan Wright retcode2 = ns_lookup_bypid(res->id.idmap_id_u.uid, 3406e3f2c991SKeyur Desai res->id.idtype == IDMAP_UID, &req->id2name); 3407*148c5f43SAlan Wright if (IDMAP_ERROR(retcode2)) { 3408*148c5f43SAlan Wright TRACE(req, res, 3409*148c5f43SAlan Wright "Getting UNIX name, error=%d (ignored)", 3410*148c5f43SAlan Wright retcode2); 3411*148c5f43SAlan Wright } else { 3412*148c5f43SAlan Wright TRACE(req, res, "Found UNIX name"); 3413*148c5f43SAlan Wright } 3414e3f2c991SKeyur Desai } 3415e3f2c991SKeyur Desai goto out; 3416e3f2c991SKeyur Desai } 3417e3f2c991SKeyur Desai 3418e8c27ec8Sbaban /* 3419e8c27ec8Sbaban * If directory-based name mapping is enabled then the unixname 3420e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode or 3421e8c27ec8Sbaban * mixed-mode) or from native LDAP object (nldap-mode) -- done. 3422e8c27ec8Sbaban */ 3423e8c27ec8Sbaban if (req->id2name != NULL) { 3424e8c27ec8Sbaban assert(res->id.idtype != IDMAP_POSIXID); 3425e8c27ec8Sbaban if (AD_MODE(res->id.idtype, state)) 3426e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 3427e8c27ec8Sbaban else if (NLDAP_MODE(res->id.idtype, state)) 3428e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 3429e8c27ec8Sbaban else if (MIXED_MODE(res->id.idtype, state)) 3430e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U; 3431c5c4113dSnw 3432e8c27ec8Sbaban /* 3433e8c27ec8Sbaban * Special case: (1) If the ad_unixuser_attr and 3434e8c27ec8Sbaban * ad_unixgroup_attr uses the same attribute 3435e8c27ec8Sbaban * name and (2) if this is a diagonal mapping 3436e8c27ec8Sbaban * request and (3) the unixname has been retrieved 3437e8c27ec8Sbaban * from the AD object -- then we ignore it and fallback 3438e8c27ec8Sbaban * to name-based mapping rules and ephemeral mapping 3439e8c27ec8Sbaban * 3440e8c27ec8Sbaban * Example: 3441e8c27ec8Sbaban * Properties: 3442e8c27ec8Sbaban * config/ad_unixuser_attr = "unixname" 3443e8c27ec8Sbaban * config/ad_unixgroup_attr = "unixname" 3444e8c27ec8Sbaban * AD user object: 3445e8c27ec8Sbaban * dn: cn=bob ... 3446e8c27ec8Sbaban * objectclass: user 3447e8c27ec8Sbaban * sam: bob 3448e8c27ec8Sbaban * unixname: bob1234 3449e8c27ec8Sbaban * AD group object: 3450e8c27ec8Sbaban * dn: cn=winadmins ... 3451e8c27ec8Sbaban * objectclass: group 3452e8c27ec8Sbaban * sam: winadmins 3453e8c27ec8Sbaban * unixname: unixadmins 3454e8c27ec8Sbaban * 3455e8c27ec8Sbaban * In this example whether "unixname" refers to a unixuser 3456e8c27ec8Sbaban * or unixgroup depends upon the AD object. 3457e8c27ec8Sbaban * 3458e8c27ec8Sbaban * $idmap show -c winname:bob gid 3459e8c27ec8Sbaban * AD lookup by "samAccountName=bob" for 3460e8c27ec8Sbaban * "ad_unixgroup_attr (i.e unixname)" for directory-based 3461e8c27ec8Sbaban * mapping would get "bob1234" which is not what we want. 3462e8c27ec8Sbaban * Now why not getgrnam_r("bob1234") and use it if it 3463e8c27ec8Sbaban * is indeed a unixgroup? That's because Unix can have 3464e8c27ec8Sbaban * users and groups with the same name and we clearly 3465e8c27ec8Sbaban * don't know the intention of the admin here. 3466e8c27ec8Sbaban * Therefore we ignore this and fallback to name-based 3467e8c27ec8Sbaban * mapping rules or ephemeral mapping. 3468e8c27ec8Sbaban */ 3469e8c27ec8Sbaban if ((AD_MODE(res->id.idtype, state) || 3470e8c27ec8Sbaban MIXED_MODE(res->id.idtype, state)) && 3471e8c27ec8Sbaban state->ad_unixuser_attr != NULL && 3472e8c27ec8Sbaban state->ad_unixgroup_attr != NULL && 3473e8c27ec8Sbaban strcasecmp(state->ad_unixuser_attr, 3474e8c27ec8Sbaban state->ad_unixgroup_attr) == 0 && 3475e8c27ec8Sbaban ((req->id1.idtype == IDMAP_USID && 3476e8c27ec8Sbaban res->id.idtype == IDMAP_GID) || 3477e8c27ec8Sbaban (req->id1.idtype == IDMAP_GSID && 3478e8c27ec8Sbaban res->id.idtype == IDMAP_UID))) { 3479*148c5f43SAlan Wright TRACE(req, res, "Ignoring UNIX name found in AD"); 3480e8c27ec8Sbaban free(req->id2name); 3481e8c27ec8Sbaban req->id2name = NULL; 34829fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = IDMAP_SENTINEL_PID; 3483e8c27ec8Sbaban /* fallback */ 3484e8c27ec8Sbaban } else { 3485*148c5f43SAlan Wright if (res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID) { 3486e8c27ec8Sbaban retcode = ns_lookup_byname(req->id2name, 3487e8c27ec8Sbaban NULL, &res->id); 3488*148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) { 3489*148c5f43SAlan Wright /* 3490*148c5f43SAlan Wright * If ns_lookup_byname() fails that 3491*148c5f43SAlan Wright * means the unixname (req->id2name), 3492*148c5f43SAlan Wright * which was obtained from the AD 3493*148c5f43SAlan Wright * object by directory-based mapping, 3494*148c5f43SAlan Wright * is not a valid Unix user/group and 3495*148c5f43SAlan Wright * therefore we return the error to the 3496*148c5f43SAlan Wright * client instead of doing rule-based 3497*148c5f43SAlan Wright * mapping or ephemeral mapping. This 3498*148c5f43SAlan Wright * way the client can detect the issue. 3499*148c5f43SAlan Wright */ 3500*148c5f43SAlan Wright TRACE(req, res, 3501*148c5f43SAlan Wright "UNIX lookup error=%d", retcode); 3502*148c5f43SAlan Wright goto out; 3503*148c5f43SAlan Wright } 3504*148c5f43SAlan Wright TRACE(req, res, "UNIX lookup"); 3505*148c5f43SAlan Wright } 3506e8c27ec8Sbaban goto out; 3507c5c4113dSnw } 3508c5c4113dSnw } 3509c5c4113dSnw 351048258c6bSjp /* Free any mapping info from Directory based mapping */ 351148258c6bSjp if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 3512*148c5f43SAlan Wright idmap_how_clear(&res->info.how); 351348258c6bSjp 3514e8c27ec8Sbaban /* 3515e8c27ec8Sbaban * If we don't have unixname then evaluate local name-based 3516e8c27ec8Sbaban * mapping rules. 3517e8c27ec8Sbaban */ 3518479ac375Sdm retcode = name_based_mapping_sid2pid(state, req, res); 3519*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 3520*148c5f43SAlan Wright TRACE(req, res, "Rule-based mapping"); 3521c5c4113dSnw goto out; 3522*148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 3523*148c5f43SAlan Wright TRACE(req, res, "Rule-based mapping error=%d", retcode); 3524*148c5f43SAlan Wright goto out; 3525*148c5f43SAlan Wright } 3526*148c5f43SAlan Wright TRACE(req, res, "No matching rule"); 3527c5c4113dSnw 35284aa0a5e7Snw do_eph: 3529e8c27ec8Sbaban /* If not found, do ephemeral mapping */ 3530479ac375Sdm retcode = dynamic_ephemeral_mapping(state, req, res); 3531*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 3532*148c5f43SAlan Wright TRACE(req, res, "Ephemeral mapping"); 3533*148c5f43SAlan Wright goto out; 3534*148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 3535*148c5f43SAlan Wright TRACE(req, res, "Ephemeral mapping error=%d", retcode); 3536*148c5f43SAlan Wright goto out; 3537*148c5f43SAlan Wright } 3538c5c4113dSnw 3539c5c4113dSnw out: 3540c5c4113dSnw res->retcode = idmap_stat4prot(retcode); 3541e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 3542e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 3543e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY; 3544e8c27ec8Sbaban } 3545e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction)) 3546e8c27ec8Sbaban state->sid2pid_done = FALSE; 3547c5c4113dSnw return (retcode); 3548c5c4113dSnw } 3549c5c4113dSnw 3550c5c4113dSnw idmap_retcode 3551479ac375Sdm update_cache_pid2sid(lookup_state_t *state, 3552cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3553cd37da74Snw { 3554c5c4113dSnw char *sql = NULL; 3555c5c4113dSnw idmap_retcode retcode; 3556*148c5f43SAlan Wright idmap_retcode retcode2; 355748258c6bSjp char *map_dn = NULL; 355848258c6bSjp char *map_attr = NULL; 355948258c6bSjp char *map_value = NULL; 356048258c6bSjp char *map_windomain = NULL; 356148258c6bSjp char *map_winname = NULL; 356248258c6bSjp char *map_unixname = NULL; 356348258c6bSjp int map_is_nt4 = FALSE; 3564c5c4113dSnw 3565c5c4113dSnw /* Check if we need to cache anything */ 3566e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3567c5c4113dSnw return (IDMAP_SUCCESS); 3568c5c4113dSnw 3569c5c4113dSnw /* We don't cache negative entries */ 3570c5c4113dSnw if (res->retcode != IDMAP_SUCCESS) 3571c5c4113dSnw return (IDMAP_SUCCESS); 3572c5c4113dSnw 3573e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF); 35749fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID); 357548258c6bSjp assert(res->id.idtype != IDMAP_SID); 357648258c6bSjp 3577e3f2c991SKeyur Desai /* 3578e3f2c991SKeyur Desai * If we've gotten to this point and we *still* don't know the 3579e3f2c991SKeyur Desai * unixname, well, we'd like to have it now for the cache. 3580e3f2c991SKeyur Desai * 3581e3f2c991SKeyur Desai * If we truly always need it for the cache, we should probably 3582e3f2c991SKeyur Desai * look it up once at the beginning, rather than "at need" in 3583e3f2c991SKeyur Desai * several places as is now done. However, it's not really clear 3584e3f2c991SKeyur Desai * that we *do* need it in the cache; there's a decent argument 3585e3f2c991SKeyur Desai * that the cache should contain only SIDs and PIDs, so we'll 3586e3f2c991SKeyur Desai * leave our options open by doing it "at need" here too. 3587e3f2c991SKeyur Desai * 3588e3f2c991SKeyur Desai * If we can't find it... c'est la vie. 3589e3f2c991SKeyur Desai */ 3590e3f2c991SKeyur Desai if (req->id1name == NULL) { 3591*148c5f43SAlan Wright retcode2 = ns_lookup_bypid(req->id1.idmap_id_u.uid, 3592e3f2c991SKeyur Desai req->id1.idtype == IDMAP_UID, &req->id1name); 3593*148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS) 3594*148c5f43SAlan Wright TRACE(req, res, "Found UNIX name"); 3595*148c5f43SAlan Wright else 3596*148c5f43SAlan Wright TRACE(req, res, "Getting UNIX name error=%d", retcode2); 3597e3f2c991SKeyur Desai } 3598e3f2c991SKeyur Desai 359948258c6bSjp assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN); 360048258c6bSjp switch (res->info.how.map_type) { 360148258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 360248258c6bSjp map_dn = res->info.how.idmap_how_u.ad.dn; 360348258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 360448258c6bSjp map_value = res->info.how.idmap_how_u.ad.value; 360548258c6bSjp break; 360648258c6bSjp 360748258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 360848258c6bSjp map_dn = res->info.how.idmap_how_u.nldap.dn; 360948258c6bSjp map_attr = res->info.how.idmap_how_u.nldap.attr; 361048258c6bSjp map_value = res->info.how.idmap_how_u.nldap.value; 361148258c6bSjp break; 361248258c6bSjp 361348258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 361448258c6bSjp map_windomain = res->info.how.idmap_how_u.rule.windomain; 361548258c6bSjp map_winname = res->info.how.idmap_how_u.rule.winname; 361648258c6bSjp map_unixname = res->info.how.idmap_how_u.rule.unixname; 361748258c6bSjp map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 361848258c6bSjp break; 361948258c6bSjp 362048258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 362148258c6bSjp break; 362248258c6bSjp 362348258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 362448258c6bSjp break; 362548258c6bSjp 3626e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 3627e3f2c991SKeyur Desai map_dn = res->info.how.idmap_how_u.idmu.dn; 3628e3f2c991SKeyur Desai map_attr = res->info.how.idmap_how_u.idmu.attr; 3629e3f2c991SKeyur Desai map_value = res->info.how.idmap_how_u.idmu.value; 3630e3f2c991SKeyur Desai break; 3631e3f2c991SKeyur Desai 363248258c6bSjp default: 3633*148c5f43SAlan Wright /* Don't cache other mapping types */ 363448258c6bSjp assert(FALSE); 363548258c6bSjp } 3636e8c27ec8Sbaban 3637c5c4113dSnw /* 3638c5c4113dSnw * Using NULL for u2w instead of 0 so that our trigger allows 3639c5c4113dSnw * the same pid to be the destination in multiple entries 3640c5c4113dSnw */ 3641c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3642cd37da74Snw "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 364348258c6bSjp "is_user, is_wuser, expiration, w2u, u2w, " 364448258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 364548258c6bSjp "map_winname, map_unixname, map_is_nt4) " 3646cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 364748258c6bSjp "strftime('%%s','now') + 600, %q, 1, " 364848258c6bSjp "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ", 3649cd37da74Snw res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3650cd37da74Snw req->id2domain, req->id2name, req->id1.idmap_id_u.uid, 3651cd37da74Snw req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0, 3652e8c27ec8Sbaban (res->id.idtype == IDMAP_USID) ? 1 : 0, 365348258c6bSjp (res->direction == 0) ? "1" : NULL, 365448258c6bSjp res->info.how.map_type, map_dn, map_attr, map_value, 365548258c6bSjp map_windomain, map_winname, map_unixname, map_is_nt4); 3656c5c4113dSnw 3657c5c4113dSnw if (sql == NULL) { 3658c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3659c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3660c5c4113dSnw goto out; 3661c5c4113dSnw } 3662c5c4113dSnw 3663479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3664c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3665c5c4113dSnw goto out; 3666c5c4113dSnw 3667c5c4113dSnw state->pid2sid_done = FALSE; 3668c5c4113dSnw sqlite_freemem(sql); 3669c5c4113dSnw sql = NULL; 3670c5c4113dSnw 3671e8c27ec8Sbaban /* Check if we need to update namecache */ 3672e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3673c5c4113dSnw goto out; 3674c5c4113dSnw 36758e228215Sdm if (req->id2name == NULL) 3676c5c4113dSnw goto out; 3677c5c4113dSnw 3678c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3679cd37da74Snw "(sidprefix, rid, canon_name, domain, type, expiration) " 3680cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3681cd37da74Snw res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3682cd37da74Snw req->id2name, req->id2domain, 3683*148c5f43SAlan Wright res->id.idtype); 3684c5c4113dSnw 3685c5c4113dSnw if (sql == NULL) { 3686c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3687c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3688c5c4113dSnw goto out; 3689c5c4113dSnw } 3690c5c4113dSnw 3691479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3692c5c4113dSnw 3693c5c4113dSnw out: 369462c60062Sbaban if (sql != NULL) 3695c5c4113dSnw sqlite_freemem(sql); 3696c5c4113dSnw return (retcode); 3697c5c4113dSnw } 3698c5c4113dSnw 3699c5c4113dSnw idmap_retcode 3700479ac375Sdm update_cache_sid2pid(lookup_state_t *state, 3701cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3702cd37da74Snw { 3703c5c4113dSnw char *sql = NULL; 3704c5c4113dSnw idmap_retcode retcode; 3705c5c4113dSnw int is_eph_user; 370648258c6bSjp char *map_dn = NULL; 370748258c6bSjp char *map_attr = NULL; 370848258c6bSjp char *map_value = NULL; 370948258c6bSjp char *map_windomain = NULL; 371048258c6bSjp char *map_winname = NULL; 371148258c6bSjp char *map_unixname = NULL; 371248258c6bSjp int map_is_nt4 = FALSE; 3713c5c4113dSnw 3714c5c4113dSnw /* Check if we need to cache anything */ 3715e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3716c5c4113dSnw return (IDMAP_SUCCESS); 3717c5c4113dSnw 3718c5c4113dSnw /* We don't cache negative entries */ 3719c5c4113dSnw if (res->retcode != IDMAP_SUCCESS) 3720c5c4113dSnw return (IDMAP_SUCCESS); 3721c5c4113dSnw 3722c5c4113dSnw if (req->direction & _IDMAP_F_EXP_EPH_UID) 3723c5c4113dSnw is_eph_user = 1; 3724c5c4113dSnw else if (req->direction & _IDMAP_F_EXP_EPH_GID) 3725c5c4113dSnw is_eph_user = 0; 3726c5c4113dSnw else 3727c5c4113dSnw is_eph_user = -1; 3728c5c4113dSnw 37299fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (is_eph_user >= 0 && 37309fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States !IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 3731c5c4113dSnw sql = sqlite_mprintf("UPDATE idmap_cache " 3732cd37da74Snw "SET w2u = 0 WHERE " 3733cd37da74Snw "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 3734cd37da74Snw "pid >= 2147483648 AND is_user = %d;", 3735cd37da74Snw req->id1.idmap_id_u.sid.prefix, 3736cd37da74Snw req->id1.idmap_id_u.sid.rid, 3737cd37da74Snw is_eph_user); 3738c5c4113dSnw if (sql == NULL) { 3739c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3740c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3741c5c4113dSnw goto out; 3742c5c4113dSnw } 3743c5c4113dSnw 3744479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3745c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3746c5c4113dSnw goto out; 3747c5c4113dSnw 3748c5c4113dSnw sqlite_freemem(sql); 3749c5c4113dSnw sql = NULL; 3750c5c4113dSnw } 3751c5c4113dSnw 3752e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF); 37539fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID); 375448258c6bSjp 375548258c6bSjp switch (res->info.how.map_type) { 375648258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 375748258c6bSjp map_dn = res->info.how.idmap_how_u.ad.dn; 375848258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 375948258c6bSjp map_value = res->info.how.idmap_how_u.ad.value; 376048258c6bSjp break; 376148258c6bSjp 376248258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 376348258c6bSjp map_dn = res->info.how.idmap_how_u.nldap.dn; 376448258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 376548258c6bSjp map_value = res->info.how.idmap_how_u.nldap.value; 376648258c6bSjp break; 376748258c6bSjp 376848258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 376948258c6bSjp map_windomain = res->info.how.idmap_how_u.rule.windomain; 377048258c6bSjp map_winname = res->info.how.idmap_how_u.rule.winname; 377148258c6bSjp map_unixname = res->info.how.idmap_how_u.rule.unixname; 377248258c6bSjp map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 377348258c6bSjp break; 377448258c6bSjp 377548258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 377648258c6bSjp break; 377748258c6bSjp 3778e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 3779e3f2c991SKeyur Desai map_dn = res->info.how.idmap_how_u.idmu.dn; 3780e3f2c991SKeyur Desai map_attr = res->info.how.idmap_how_u.idmu.attr; 3781e3f2c991SKeyur Desai map_value = res->info.how.idmap_how_u.idmu.value; 3782e3f2c991SKeyur Desai break; 3783e3f2c991SKeyur Desai 378448258c6bSjp default: 3785*148c5f43SAlan Wright /* Don't cache other mapping types */ 378648258c6bSjp assert(FALSE); 378748258c6bSjp } 3788cd37da74Snw 3789c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3790cd37da74Snw "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 379148258c6bSjp "is_user, is_wuser, expiration, w2u, u2w, " 379248258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 379348258c6bSjp "map_winname, map_unixname, map_is_nt4) " 3794cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 379548258c6bSjp "strftime('%%s','now') + 600, 1, %q, " 379648258c6bSjp "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);", 3797cd37da74Snw req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3798e8c27ec8Sbaban (req->id1domain != NULL) ? req->id1domain : "", req->id1name, 3799e8c27ec8Sbaban res->id.idmap_id_u.uid, req->id2name, 3800e8c27ec8Sbaban (res->id.idtype == IDMAP_UID) ? 1 : 0, 3801cd37da74Snw (req->id1.idtype == IDMAP_USID) ? 1 : 0, 380248258c6bSjp (res->direction == 0) ? "1" : NULL, 380348258c6bSjp res->info.how.map_type, map_dn, map_attr, map_value, 380448258c6bSjp map_windomain, map_winname, map_unixname, map_is_nt4); 3805c5c4113dSnw 3806c5c4113dSnw if (sql == NULL) { 3807c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3808c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3809c5c4113dSnw goto out; 3810c5c4113dSnw } 3811c5c4113dSnw 3812479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3813c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3814c5c4113dSnw goto out; 3815c5c4113dSnw 3816c5c4113dSnw state->sid2pid_done = FALSE; 3817c5c4113dSnw sqlite_freemem(sql); 3818c5c4113dSnw sql = NULL; 3819c5c4113dSnw 3820e8c27ec8Sbaban /* Check if we need to update namecache */ 3821e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3822c5c4113dSnw goto out; 3823c5c4113dSnw 3824cf5b5989Sdm if (EMPTY_STRING(req->id1name)) 3825c5c4113dSnw goto out; 3826c5c4113dSnw 3827c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3828cd37da74Snw "(sidprefix, rid, canon_name, domain, type, expiration) " 3829cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3830cd37da74Snw req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3831cd37da74Snw req->id1name, req->id1domain, 3832*148c5f43SAlan Wright req->id1.idtype); 3833c5c4113dSnw 3834c5c4113dSnw if (sql == NULL) { 3835c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3836c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3837c5c4113dSnw goto out; 3838c5c4113dSnw } 3839c5c4113dSnw 3840479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3841c5c4113dSnw 3842c5c4113dSnw out: 384362c60062Sbaban if (sql != NULL) 3844c5c4113dSnw sqlite_freemem(sql); 3845c5c4113dSnw return (retcode); 3846c5c4113dSnw } 3847c5c4113dSnw 3848cd37da74Snw static 3849cd37da74Snw idmap_retcode 3850c5c4113dSnw lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res, 3851fe1c642dSBill Krier int is_user) 3852cd37da74Snw { 3853c5c4113dSnw char *end; 3854c5c4113dSnw char *sql = NULL; 3855c5c4113dSnw const char **values; 3856c5c4113dSnw sqlite_vm *vm = NULL; 3857c5c4113dSnw int ncol; 3858c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS; 3859c5c4113dSnw time_t curtime; 3860e8c27ec8Sbaban idmap_id_type idtype; 3861c5c4113dSnw 3862c5c4113dSnw /* Current time */ 3863c5c4113dSnw errno = 0; 3864c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 3865cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 3866cd37da74Snw strerror(errno)); 3867c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3868c5c4113dSnw goto out; 3869c5c4113dSnw } 3870c5c4113dSnw 3871e8c27ec8Sbaban /* SQL to lookup the cache by pid or by unixname */ 38729fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID) { 387348258c6bSjp sql = sqlite_mprintf("SELECT sidprefix, rid, " 387448258c6bSjp "canon_winname, windomain, w2u, is_wuser, " 387548258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 387648258c6bSjp "map_winname, map_unixname, map_is_nt4 " 3877e8c27ec8Sbaban "FROM idmap_cache WHERE " 3878e8c27ec8Sbaban "pid = %u AND u2w = 1 AND is_user = %d AND " 3879e8c27ec8Sbaban "(pid >= 2147483648 OR " 3880e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 3881e8c27ec8Sbaban "expiration > %d));", 3882e8c27ec8Sbaban req->id1.idmap_id_u.uid, is_user, curtime); 3883e8c27ec8Sbaban } else if (req->id1name != NULL) { 388448258c6bSjp sql = sqlite_mprintf("SELECT sidprefix, rid, " 388548258c6bSjp "canon_winname, windomain, w2u, is_wuser, " 388648258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 388748258c6bSjp "map_winname, map_unixname, map_is_nt4 " 3888e8c27ec8Sbaban "FROM idmap_cache WHERE " 3889e8c27ec8Sbaban "unixname = %Q AND u2w = 1 AND is_user = %d AND " 3890e8c27ec8Sbaban "(pid >= 2147483648 OR " 3891e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 3892e8c27ec8Sbaban "expiration > %d));", 3893e8c27ec8Sbaban req->id1name, is_user, curtime); 389448258c6bSjp } else { 389548258c6bSjp retcode = IDMAP_ERR_ARG; 389648258c6bSjp goto out; 3897e8c27ec8Sbaban } 3898e8c27ec8Sbaban 3899c5c4113dSnw if (sql == NULL) { 3900c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3901c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3902c5c4113dSnw goto out; 3903c5c4113dSnw } 390448258c6bSjp retcode = sql_compile_n_step_once( 390548258c6bSjp cache, sql, &vm, &ncol, 14, &values); 3906c5c4113dSnw sqlite_freemem(sql); 3907c5c4113dSnw 3908c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) 3909c5c4113dSnw goto out; 3910c5c4113dSnw else if (retcode == IDMAP_SUCCESS) { 3911c5c4113dSnw /* sanity checks */ 3912c5c4113dSnw if (values[0] == NULL || values[1] == NULL) { 3913c5c4113dSnw retcode = IDMAP_ERR_CACHE; 3914c5c4113dSnw goto out; 3915c5c4113dSnw } 3916c5c4113dSnw 3917e8c27ec8Sbaban switch (res->id.idtype) { 3918c5c4113dSnw case IDMAP_SID: 3919cd37da74Snw case IDMAP_USID: 3920cd37da74Snw case IDMAP_GSID: 3921e8c27ec8Sbaban idtype = strtol(values[5], &end, 10) == 1 3922cd37da74Snw ? IDMAP_USID : IDMAP_GSID; 3923cd37da74Snw 3924e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID && 3925e8c27ec8Sbaban idtype != IDMAP_USID) { 3926cd37da74Snw retcode = IDMAP_ERR_NOTUSER; 3927cd37da74Snw goto out; 3928e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GSID && 3929e8c27ec8Sbaban idtype != IDMAP_GSID) { 3930cd37da74Snw retcode = IDMAP_ERR_NOTGROUP; 3931cd37da74Snw goto out; 3932cd37da74Snw } 3933e8c27ec8Sbaban res->id.idtype = idtype; 3934cd37da74Snw 3935c5c4113dSnw res->id.idmap_id_u.sid.rid = 3936cd37da74Snw strtoul(values[1], &end, 10); 3937c5c4113dSnw res->id.idmap_id_u.sid.prefix = strdup(values[0]); 3938c5c4113dSnw if (res->id.idmap_id_u.sid.prefix == NULL) { 3939c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3940c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3941c5c4113dSnw goto out; 3942c5c4113dSnw } 3943c5c4113dSnw 394462c60062Sbaban if (values[4] != NULL) 3945c5c4113dSnw res->direction = 3946651c0131Sbaban (strtol(values[4], &end, 10) == 0)? 3947651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 3948c5c4113dSnw else 3949651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W; 3950c5c4113dSnw 3951fe1c642dSBill Krier if (values[2] == NULL) 3952c5c4113dSnw break; 39538e228215Sdm req->id2name = strdup(values[2]); 39548e228215Sdm if (req->id2name == NULL) { 3955c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3956c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3957c5c4113dSnw goto out; 3958c5c4113dSnw } 3959c5c4113dSnw 3960c5c4113dSnw if (values[3] == NULL) 3961c5c4113dSnw break; 39628e228215Sdm req->id2domain = strdup(values[3]); 39638e228215Sdm if (req->id2domain == NULL) { 3964c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3965c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3966c5c4113dSnw goto out; 3967c5c4113dSnw } 3968cd37da74Snw 3969c5c4113dSnw break; 3970c5c4113dSnw default: 3971c5c4113dSnw retcode = IDMAP_ERR_NOTSUPPORTED; 3972c5c4113dSnw break; 3973c5c4113dSnw } 397448258c6bSjp if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 397548258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 397648258c6bSjp res->info.how.map_type = strtoul(values[6], &end, 10); 397748258c6bSjp switch (res->info.how.map_type) { 397848258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 397948258c6bSjp res->info.how.idmap_how_u.ad.dn = 398048258c6bSjp strdup(values[7]); 398148258c6bSjp res->info.how.idmap_how_u.ad.attr = 398248258c6bSjp strdup(values[8]); 398348258c6bSjp res->info.how.idmap_how_u.ad.value = 398448258c6bSjp strdup(values[9]); 398548258c6bSjp break; 398648258c6bSjp 398748258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 398848258c6bSjp res->info.how.idmap_how_u.nldap.dn = 398948258c6bSjp strdup(values[7]); 399048258c6bSjp res->info.how.idmap_how_u.nldap.attr = 399148258c6bSjp strdup(values[8]); 399248258c6bSjp res->info.how.idmap_how_u.nldap.value = 399348258c6bSjp strdup(values[9]); 399448258c6bSjp break; 399548258c6bSjp 399648258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 399748258c6bSjp res->info.how.idmap_how_u.rule.windomain = 399848258c6bSjp strdup(values[10]); 399948258c6bSjp res->info.how.idmap_how_u.rule.winname = 400048258c6bSjp strdup(values[11]); 400148258c6bSjp res->info.how.idmap_how_u.rule.unixname = 400248258c6bSjp strdup(values[12]); 400348258c6bSjp res->info.how.idmap_how_u.rule.is_nt4 = 400448258c6bSjp strtoul(values[13], &end, 10); 400548258c6bSjp res->info.how.idmap_how_u.rule.is_user = 400648258c6bSjp is_user; 400748258c6bSjp res->info.how.idmap_how_u.rule.is_wuser = 400848258c6bSjp strtol(values[5], &end, 10); 400948258c6bSjp break; 401048258c6bSjp 401148258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 401248258c6bSjp break; 401348258c6bSjp 401448258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 401548258c6bSjp break; 401648258c6bSjp 401748258c6bSjp case IDMAP_MAP_TYPE_KNOWN_SID: 401848258c6bSjp break; 401948258c6bSjp 4020e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 4021e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.dn = 4022e3f2c991SKeyur Desai strdup(values[7]); 4023e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.attr = 4024e3f2c991SKeyur Desai strdup(values[8]); 4025e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.value = 4026e3f2c991SKeyur Desai strdup(values[9]); 4027e3f2c991SKeyur Desai break; 4028e3f2c991SKeyur Desai 402948258c6bSjp default: 4030e3f2c991SKeyur Desai /* Unknown mapping type */ 403148258c6bSjp assert(FALSE); 403248258c6bSjp } 403348258c6bSjp } 4034c5c4113dSnw } 4035c5c4113dSnw 4036c5c4113dSnw out: 403762c60062Sbaban if (vm != NULL) 4038c5c4113dSnw (void) sqlite_finalize(vm, NULL); 4039c5c4113dSnw return (retcode); 4040c5c4113dSnw } 4041c5c4113dSnw 404208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 404308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given: 404408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * cache sqlite handle 404508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name 404608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name 404708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 404808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Return: Error code 404908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 405008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname Canonical name (if canonname is non-NULL) [1] 405108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix [1] 405208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID 405308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *type Type of name 405408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 405508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error 405608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 4057cd37da74Snw static 4058cd37da74Snw idmap_retcode 4059*148c5f43SAlan Wright lookup_cache_name2sid( 4060*148c5f43SAlan Wright sqlite *cache, 4061*148c5f43SAlan Wright const char *name, 4062*148c5f43SAlan Wright const char *domain, 4063*148c5f43SAlan Wright char **canonname, 4064*148c5f43SAlan Wright char **sidprefix, 4065*148c5f43SAlan Wright idmap_rid_t *rid, 4066*148c5f43SAlan Wright idmap_id_type *type) 4067cd37da74Snw { 4068cd37da74Snw char *end, *lower_name; 406908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *sql; 4070c5c4113dSnw const char **values; 4071c5c4113dSnw sqlite_vm *vm = NULL; 4072c5c4113dSnw int ncol; 4073c5c4113dSnw time_t curtime; 407408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode retcode; 407508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 407608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL; 407708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) 407808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 4079c5c4113dSnw 4080c5c4113dSnw /* Get current time */ 4081c5c4113dSnw errno = 0; 4082c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 4083cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 4084cd37da74Snw strerror(errno)); 4085c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4086c5c4113dSnw goto out; 4087c5c4113dSnw } 4088c5c4113dSnw 4089c5c4113dSnw /* SQL to lookup the cache */ 4090cd37da74Snw if ((lower_name = tolower_u8(name)) == NULL) 4091cd37da74Snw lower_name = (char *)name; 4092cd37da74Snw sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name " 4093cd37da74Snw "FROM name_cache WHERE name = %Q AND domain = %Q AND " 4094cd37da74Snw "(expiration = 0 OR expiration ISNULL OR " 4095cd37da74Snw "expiration > %d);", lower_name, domain, curtime); 4096cd37da74Snw if (lower_name != name) 4097cd37da74Snw free(lower_name); 4098c5c4113dSnw if (sql == NULL) { 4099c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 4100c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 4101c5c4113dSnw goto out; 4102c5c4113dSnw } 4103cd37da74Snw retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values); 410408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 4105c5c4113dSnw sqlite_freemem(sql); 4106c5c4113dSnw 410708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode != IDMAP_SUCCESS) 410808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out; 4109c5c4113dSnw 411008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (type != NULL) { 411108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (values[2] == NULL) { 4112e8c27ec8Sbaban retcode = IDMAP_ERR_CACHE; 4113e8c27ec8Sbaban goto out; 4114e8c27ec8Sbaban } 4115*148c5f43SAlan Wright *type = xlate_legacy_type(strtol(values[2], &end, 10)); 411608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4117e8c27ec8Sbaban 411808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (values[0] == NULL || values[1] == NULL) { 411908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_CACHE; 412008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out; 412108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4122cd37da74Snw 412308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 412408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States assert(values[3] != NULL); 412508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = strdup(values[3]); 412608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canonname == NULL) { 4127c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 4128c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 4129c5c4113dSnw goto out; 4130c5c4113dSnw } 4131c5c4113dSnw } 4132c5c4113dSnw 413308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(values[0]); 413408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*sidprefix == NULL) { 413508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory"); 413608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_MEMORY; 413708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out; 413808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 413908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *rid = strtoul(values[1], &end, 10); 414008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 414108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_SUCCESS; 414208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 4143c5c4113dSnw out: 414462c60062Sbaban if (vm != NULL) 4145c5c4113dSnw (void) sqlite_finalize(vm, NULL); 414608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 414708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode != IDMAP_SUCCESS) { 414808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*sidprefix); 414908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL; 415008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 415108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname); 415208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 415308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 415408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4155c5c4113dSnw return (retcode); 4156c5c4113dSnw } 4157c5c4113dSnw 4158cd37da74Snw static 4159cd37da74Snw idmap_retcode 4160e8c27ec8Sbaban ad_lookup_by_winname(lookup_state_t *state, 4161*148c5f43SAlan Wright const char *name, const char *domain, int esidtype, 416248258c6bSjp char **dn, char **attr, char **value, char **canonname, 4163*148c5f43SAlan Wright char **sidprefix, idmap_rid_t *rid, idmap_id_type *wintype, 416448258c6bSjp char **unixname) 4165cd37da74Snw { 41664d61c878SJulian Pullen int retries; 4167c5c4113dSnw idmap_query_state_t *qs = NULL; 4168c5c4113dSnw idmap_retcode rc, retcode; 41694d61c878SJulian Pullen int i; 41704d61c878SJulian Pullen int found_ad = 0; 4171c5c4113dSnw 41722b4a7802SBaban Kenkre RDLOCK_CONFIG(); 4173e3f2c991SKeyur Desai if (_idmapdstate.num_gcs > 0) { 4174e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_gcs && !found_ad; i++) { 41754d61c878SJulian Pullen retries = 0; 41764d61c878SJulian Pullen retry: 4177e3f2c991SKeyur Desai retcode = idmap_lookup_batch_start( 4178e3f2c991SKeyur Desai _idmapdstate.gcs[i], 4179e3f2c991SKeyur Desai 1, 4180e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.directory_based_mapping, 4181e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.default_domain, 4182e3f2c991SKeyur Desai &qs); 41834d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) { 41844d61c878SJulian Pullen if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 41854d61c878SJulian Pullen retries++ < ADUTILS_DEF_NUM_RETRIES) 41864d61c878SJulian Pullen goto retry; 41874d61c878SJulian Pullen degrade_svc(1, "failed to create request for " 41884d61c878SJulian Pullen "AD lookup by winname"); 41894d61c878SJulian Pullen return (retcode); 41904d61c878SJulian Pullen } 4191c5c4113dSnw 41924d61c878SJulian Pullen restore_svc(); 4193c5c4113dSnw 41944d61c878SJulian Pullen if (state != NULL && i == 0) { 41954d61c878SJulian Pullen /* 41964d61c878SJulian Pullen * Directory based name mapping is only 41974d61c878SJulian Pullen * performed within the joined forest (i == 0). 41984d61c878SJulian Pullen * We don't trust other "trusted" forests to 41994d61c878SJulian Pullen * provide DS-based name mapping information 42004d61c878SJulian Pullen * because AD's definition of "cross-forest 42014d61c878SJulian Pullen * trust" does not encompass this sort of 42024d61c878SJulian Pullen * behavior. 42034d61c878SJulian Pullen */ 42044d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs, 42054d61c878SJulian Pullen state->ad_unixuser_attr, 42064d61c878SJulian Pullen state->ad_unixgroup_attr); 42074d61c878SJulian Pullen } 4208c5c4113dSnw 42094d61c878SJulian Pullen retcode = idmap_name2sid_batch_add1(qs, name, domain, 4210*148c5f43SAlan Wright esidtype, dn, attr, value, canonname, sidprefix, 4211e3f2c991SKeyur Desai rid, wintype, unixname, NULL, &rc); 42124d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) { 42134d61c878SJulian Pullen idmap_lookup_release_batch(&qs); 42144d61c878SJulian Pullen continue; 42154d61c878SJulian Pullen } 42164d61c878SJulian Pullen found_ad = 1; 42174d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) 42184d61c878SJulian Pullen idmap_lookup_release_batch(&qs); 42194d61c878SJulian Pullen else 42204d61c878SJulian Pullen retcode = idmap_lookup_batch_end(&qs); 42214d61c878SJulian Pullen 42224d61c878SJulian Pullen if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 42234d61c878SJulian Pullen retries++ < ADUTILS_DEF_NUM_RETRIES) 42244d61c878SJulian Pullen goto retry; 42254d61c878SJulian Pullen else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 42264d61c878SJulian Pullen degrade_svc(1, 42274d61c878SJulian Pullen "some AD lookups timed out repeatedly"); 42284d61c878SJulian Pullen } 42294d61c878SJulian Pullen } else { 42304d61c878SJulian Pullen /* No AD case */ 42314d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 42324d61c878SJulian Pullen } 42334d61c878SJulian Pullen UNLOCK_CONFIG(); 4234c5c4113dSnw 4235c5c4113dSnw if (retcode != IDMAP_SUCCESS) { 42369fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_NOTICE, 42379fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "AD lookup of winname %s@%s failed, error code %d", 42389fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States name == NULL ? "(null)" : name, 42399fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States domain == NULL ? "(null)" : domain, 42409fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States retcode); 4241c5c4113dSnw return (retcode); 4242e8c27ec8Sbaban } 4243e8c27ec8Sbaban return (rc); 4244c5c4113dSnw } 4245c5c4113dSnw 424608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 424708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given: 424808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * cache sqlite handle to cache 424908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name 425008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name 425108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * local_only if true, don't try AD lookups 425208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 425308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Returns: Error code 425408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 425508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname Canonical name (if non-NULL) [1] 425608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canondomain Canonical domain (if non-NULL) [1] 425708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix [1] 425808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID 425908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *req Request (direction is updated) 426008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 426108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error 426208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 4263cd37da74Snw idmap_retcode 426408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_name2sid( 426508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States sqlite *cache, 426608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *name, 426708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *domain, 4268*148c5f43SAlan Wright int want_wuser, 426908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canonname, 427008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canondomain, 427108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **sidprefix, 427208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *rid, 4273*148c5f43SAlan Wright idmap_id_type *type, 427408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_mapping *req, 427508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int local_only) 4276cd37da74Snw { 4277c5c4113dSnw idmap_retcode retcode; 4278c5c4113dSnw 4279cd37da74Snw *sidprefix = NULL; 4280e8c27ec8Sbaban if (canonname != NULL) 4281e8c27ec8Sbaban *canonname = NULL; 428208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) 428308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL; 4284cd37da74Snw 4285e8c27ec8Sbaban /* Lookup well-known SIDs table */ 428608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = lookup_wksids_name2sid(name, domain, canonname, canondomain, 4287*148c5f43SAlan Wright sidprefix, rid, type); 428862c60062Sbaban if (retcode == IDMAP_SUCCESS) { 4289e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 429062c60062Sbaban goto out; 429162c60062Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) { 429262c60062Sbaban return (retcode); 429362c60062Sbaban } 429462c60062Sbaban 4295e8c27ec8Sbaban /* Lookup cache */ 4296cd37da74Snw retcode = lookup_cache_name2sid(cache, name, domain, canonname, 4297*148c5f43SAlan Wright sidprefix, rid, type); 4298e8c27ec8Sbaban if (retcode == IDMAP_SUCCESS) { 4299e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 4300e8c27ec8Sbaban goto out; 4301e8c27ec8Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) { 4302c5c4113dSnw return (retcode); 4303c5c4113dSnw } 4304c5c4113dSnw 4305479ac375Sdm /* 4306479ac375Sdm * The caller may be using this function to determine if this 4307479ac375Sdm * request needs to be marked for AD lookup or not 4308479ac375Sdm * (i.e. _IDMAP_F_LOOKUP_AD) and therefore may not want this 4309479ac375Sdm * function to AD lookup now. 4310479ac375Sdm */ 4311479ac375Sdm if (local_only) 4312479ac375Sdm return (retcode); 4313479ac375Sdm 4314*148c5f43SAlan Wright if (_idmapdstate.cfg->pgcfg.use_lsa && 4315*148c5f43SAlan Wright _idmapdstate.cfg->pgcfg.domain_name != NULL && 4316*148c5f43SAlan Wright name != NULL && *sidprefix == NULL) { 4317*148c5f43SAlan Wright retcode = lookup_lsa_by_name(name, domain, 4318*148c5f43SAlan Wright sidprefix, rid, 4319*148c5f43SAlan Wright canonname, canondomain, 4320*148c5f43SAlan Wright type); 4321*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) 4322*148c5f43SAlan Wright goto out; 4323*148c5f43SAlan Wright else if (retcode != IDMAP_ERR_NOTFOUND) 4324*148c5f43SAlan Wright return (retcode); 4325*148c5f43SAlan Wright } 4326*148c5f43SAlan Wright 4327e8c27ec8Sbaban /* Lookup AD */ 4328*148c5f43SAlan Wright retcode = ad_lookup_by_winname(NULL, name, domain, IDMAP_POSIXID, 4329*148c5f43SAlan Wright NULL, NULL, NULL, canonname, sidprefix, rid, type, NULL); 4330e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4331e8c27ec8Sbaban return (retcode); 4332e8c27ec8Sbaban 433362c60062Sbaban out: 4334c5c4113dSnw /* 4335c5c4113dSnw * Entry found (cache or Windows lookup) 4336c5c4113dSnw */ 4337*148c5f43SAlan Wright if (want_wuser == 1 && *type != IDMAP_USID) 4338e8c27ec8Sbaban retcode = IDMAP_ERR_NOTUSER; 4339*148c5f43SAlan Wright else if (want_wuser == 0 && *type != IDMAP_GSID) 4340e8c27ec8Sbaban retcode = IDMAP_ERR_NOTGROUP; 4341*148c5f43SAlan Wright else if (want_wuser == -1) { 4342*148c5f43SAlan Wright /* 4343*148c5f43SAlan Wright * Caller wants to know if its user or group 4344*148c5f43SAlan Wright * Verify that it's one or the other. 4345*148c5f43SAlan Wright */ 4346*148c5f43SAlan Wright if (*type != IDMAP_USID && *type != IDMAP_GSID) 4347e8c27ec8Sbaban retcode = IDMAP_ERR_SID; 4348c5c4113dSnw } 4349c5c4113dSnw 435008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode == IDMAP_SUCCESS) { 435108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 435208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we were asked for a canonical domain and none 435308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * of the searches have provided one, assume it's the 435408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * supplied domain. 435508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 435608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL && *canondomain == NULL) { 435708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(domain); 435808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canondomain == NULL) 435908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_MEMORY; 436008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 436108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4362e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 4363e8c27ec8Sbaban free(*sidprefix); 4364e8c27ec8Sbaban *sidprefix = NULL; 4365e8c27ec8Sbaban if (canonname != NULL) { 4366e8c27ec8Sbaban free(*canonname); 4367e8c27ec8Sbaban *canonname = NULL; 4368e8c27ec8Sbaban } 436908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) { 437008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canondomain); 437108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL; 437208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4373e8c27ec8Sbaban } 4374c5c4113dSnw return (retcode); 4375c5c4113dSnw } 4376c5c4113dSnw 4377cd37da74Snw static 4378cd37da74Snw idmap_retcode 4379479ac375Sdm name_based_mapping_pid2sid(lookup_state_t *state, const char *unixname, 4380cd37da74Snw int is_user, idmap_mapping *req, idmap_id_res *res) 4381cd37da74Snw { 4382c5c4113dSnw const char *winname, *windomain; 4383cd37da74Snw char *canonname; 438408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canondomain; 4385c5c4113dSnw char *sql = NULL, *errmsg = NULL; 4386c5c4113dSnw idmap_retcode retcode; 4387c5c4113dSnw char *end; 4388c5c4113dSnw const char **values; 4389c5c4113dSnw sqlite_vm *vm = NULL; 439048258c6bSjp int ncol, r; 4391*148c5f43SAlan Wright int want_wuser; 4392c5c4113dSnw const char *me = "name_based_mapping_pid2sid"; 439348258c6bSjp int non_wild_match = FALSE; 439448258c6bSjp idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 439548258c6bSjp int direction; 4396e8c27ec8Sbaban 4397e8c27ec8Sbaban assert(unixname != NULL); /* We have unixname */ 4398e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have winname */ 4399e8c27ec8Sbaban assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */ 4400c5c4113dSnw 4401c5c4113dSnw sql = sqlite_mprintf( 440248258c6bSjp "SELECT winname_display, windomain, w2u_order, " 440348258c6bSjp "is_wuser, unixname, is_nt4 " 440448258c6bSjp "FROM namerules WHERE " 4405cd37da74Snw "u2w_order > 0 AND is_user = %d AND " 4406cd37da74Snw "(unixname = %Q OR unixname = '*') " 4407cd37da74Snw "ORDER BY u2w_order ASC;", is_user, unixname); 4408c5c4113dSnw if (sql == NULL) { 4409c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 4410c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 4411c5c4113dSnw goto out; 4412c5c4113dSnw } 4413c5c4113dSnw 4414479ac375Sdm if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 4415c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4416cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 4417cd37da74Snw CHECK_NULL(errmsg)); 4418c5c4113dSnw sqlite_freemem(errmsg); 4419c5c4113dSnw goto out; 4420c5c4113dSnw } 4421c5c4113dSnw 442248258c6bSjp for (;;) { 4423c5c4113dSnw r = sqlite_step(vm, &ncol, &values, NULL); 442484decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 442584decf41Sjp if (r == SQLITE_ROW) { 442648258c6bSjp if (ncol < 6) { 4427c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4428c5c4113dSnw goto out; 4429c5c4113dSnw } 4430*148c5f43SAlan Wright 4431*148c5f43SAlan Wright TRACE(req, res, "Matching rule: %s -> %s@%s", 4432*148c5f43SAlan Wright values[4] == NULL ? "(null)" : values[4], 4433*148c5f43SAlan Wright values[0] == NULL ? "(null)" : values[0], 4434*148c5f43SAlan Wright values[1] == NULL ? "(null)" : values[1]); 4435*148c5f43SAlan Wright 4436c5c4113dSnw if (values[0] == NULL) { 4437c5c4113dSnw /* values [1] and [2] can be null */ 4438c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4439c5c4113dSnw goto out; 4440c5c4113dSnw } 444148258c6bSjp 444248258c6bSjp if (values[2] != NULL) 444348258c6bSjp direction = 444448258c6bSjp (strtol(values[2], &end, 10) == 0)? 444548258c6bSjp IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 444648258c6bSjp else 444748258c6bSjp direction = IDMAP_DIRECTION_U2W; 444848258c6bSjp 4449c5c4113dSnw if (EMPTY_NAME(values[0])) { 445048258c6bSjp idmap_namerule_set(rule, values[1], values[0], 445148258c6bSjp values[4], is_user, 445248258c6bSjp strtol(values[3], &end, 10), 445348258c6bSjp strtol(values[5], &end, 10), 445448258c6bSjp direction); 4455*148c5f43SAlan Wright TRACE(req, res, "Mapping inhibited"); 4456c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 4457c5c4113dSnw goto out; 4458c5c4113dSnw } 4459cd37da74Snw 4460cd37da74Snw if (values[0][0] == '*') { 446148258c6bSjp winname = unixname; 446248258c6bSjp if (non_wild_match) { 4463cd37da74Snw /* 446448258c6bSjp * There were non-wildcard rules 446548258c6bSjp * where the Windows identity doesn't 446648258c6bSjp * exist. Return no mapping. 4467cd37da74Snw */ 4468cd37da74Snw retcode = IDMAP_ERR_NOMAPPING; 4469cd37da74Snw goto out; 4470cd37da74Snw } 4471cd37da74Snw } else { 447248258c6bSjp /* Save first non-wild match rule */ 447348258c6bSjp if (!non_wild_match) { 447448258c6bSjp idmap_namerule_set(rule, values[1], 447548258c6bSjp values[0], values[4], 447648258c6bSjp is_user, 447748258c6bSjp strtol(values[3], &end, 10), 447848258c6bSjp strtol(values[5], &end, 10), 447948258c6bSjp direction); 448048258c6bSjp non_wild_match = TRUE; 448148258c6bSjp } 4482cd37da74Snw winname = values[0]; 4483cd37da74Snw } 4484*148c5f43SAlan Wright want_wuser = res->id.idtype == IDMAP_USID ? 1 448548258c6bSjp : res->id.idtype == IDMAP_GSID ? 0 448648258c6bSjp : -1; 448762c60062Sbaban if (values[1] != NULL) 4488c5c4113dSnw windomain = values[1]; 4489*148c5f43SAlan Wright else if (state->defdom != NULL) { 4490479ac375Sdm windomain = state->defdom; 4491*148c5f43SAlan Wright TRACE(req, res, 4492*148c5f43SAlan Wright "Added default domain %s to rule", 4493*148c5f43SAlan Wright windomain); 4494*148c5f43SAlan Wright } else { 4495cd37da74Snw idmapdlog(LOG_ERR, "%s: no domain", me); 4496*148c5f43SAlan Wright TRACE(req, res, 4497*148c5f43SAlan Wright "No domain in rule, and no default domain"); 4498c5c4113dSnw retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 4499c5c4113dSnw goto out; 4500c5c4113dSnw } 4501cd37da74Snw 4502479ac375Sdm retcode = lookup_name2sid(state->cache, 4503479ac375Sdm winname, windomain, 4504*148c5f43SAlan Wright want_wuser, &canonname, &canondomain, 4505cd37da74Snw &res->id.idmap_id_u.sid.prefix, 4506*148c5f43SAlan Wright &res->id.idmap_id_u.sid.rid, 4507*148c5f43SAlan Wright &res->id.idtype, req, 0); 4508e8c27ec8Sbaban 4509*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 4510*148c5f43SAlan Wright break; 4511*148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) { 4512*148c5f43SAlan Wright TRACE(req, res, 4513*148c5f43SAlan Wright "%s@%s not found, continuing", 4514*148c5f43SAlan Wright winname, windomain); 4515cd37da74Snw continue; 4516*148c5f43SAlan Wright } else { 4517*148c5f43SAlan Wright TRACE(req, res, 4518*148c5f43SAlan Wright "Looking up %s@%s error=%d", 4519*148c5f43SAlan Wright winname, windomain, retcode); 4520c5c4113dSnw } 4521*148c5f43SAlan Wright 4522c5c4113dSnw goto out; 452348258c6bSjp 4524c5c4113dSnw } else if (r == SQLITE_DONE) { 452548258c6bSjp /* 452648258c6bSjp * If there were non-wildcard rules where 452748258c6bSjp * Windows identity doesn't exist 452848258c6bSjp * return no mapping. 452948258c6bSjp */ 453048258c6bSjp if (non_wild_match) 453148258c6bSjp retcode = IDMAP_ERR_NOMAPPING; 453248258c6bSjp else 453348258c6bSjp retcode = IDMAP_ERR_NOTFOUND; 4534c5c4113dSnw goto out; 4535c5c4113dSnw } else { 4536c5c4113dSnw (void) sqlite_finalize(vm, &errmsg); 4537c5c4113dSnw vm = NULL; 4538cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 4539cd37da74Snw CHECK_NULL(errmsg)); 4540c5c4113dSnw sqlite_freemem(errmsg); 4541c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4542c5c4113dSnw goto out; 4543c5c4113dSnw } 4544c5c4113dSnw } 4545c5c4113dSnw 4546*148c5f43SAlan Wright if (values[2] != NULL) 4547*148c5f43SAlan Wright res->direction = 4548*148c5f43SAlan Wright (strtol(values[2], &end, 10) == 0)? 4549*148c5f43SAlan Wright IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 4550*148c5f43SAlan Wright else 4551*148c5f43SAlan Wright res->direction = IDMAP_DIRECTION_U2W; 4552cd37da74Snw 4553*148c5f43SAlan Wright req->id2name = canonname; 4554*148c5f43SAlan Wright req->id2domain = canondomain; 45558e228215Sdm 4556*148c5f43SAlan Wright idmap_namerule_set(rule, values[1], values[0], values[4], 4557*148c5f43SAlan Wright is_user, strtol(values[3], &end, 10), 4558*148c5f43SAlan Wright strtol(values[5], &end, 10), 4559*148c5f43SAlan Wright rule->direction); 4560*148c5f43SAlan Wright TRACE(req, res, "Windows name found"); 4561479ac375Sdm 4562*148c5f43SAlan Wright out: 4563*148c5f43SAlan Wright if (sql != NULL) 4564*148c5f43SAlan Wright sqlite_freemem(sql); 4565fc724630SAlan Wright 4566fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) { 4567fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 456848258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 4569c5c4113dSnw } 4570fc724630SAlan Wright 457162c60062Sbaban if (vm != NULL) 4572c5c4113dSnw (void) sqlite_finalize(vm, NULL); 4573c5c4113dSnw return (retcode); 4574c5c4113dSnw } 4575c5c4113dSnw 4576cd37da74Snw /* 4577cd37da74Snw * Convention when processing unix2win requests: 4578cd37da74Snw * 4579cd37da74Snw * Unix identity: 4580cd37da74Snw * req->id1name = 4581cd37da74Snw * unixname if given otherwise unixname found will be placed 4582cd37da74Snw * here. 4583cd37da74Snw * req->id1domain = 4584cd37da74Snw * NOT USED 4585cd37da74Snw * req->id1.idtype = 4586cd37da74Snw * Given type (IDMAP_UID or IDMAP_GID) 4587cd37da74Snw * req->id1..[uid or gid] = 4588cd37da74Snw * UID/GID if given otherwise UID/GID found will be placed here. 4589cd37da74Snw * 4590cd37da74Snw * Windows identity: 4591cd37da74Snw * req->id2name = 4592cd37da74Snw * winname found will be placed here. 4593cd37da74Snw * req->id2domain = 4594cd37da74Snw * windomain found will be placed here. 4595cd37da74Snw * res->id.idtype = 4596cd37da74Snw * Target type initialized from req->id2.idtype. If 4597cd37da74Snw * it is IDMAP_SID then actual type (IDMAP_USID/GSID) found 4598cd37da74Snw * will be placed here. 4599cd37da74Snw * req->id..sid.[prefix, rid] = 4600cd37da74Snw * SID found will be placed here. 4601cd37da74Snw * 4602cd37da74Snw * Others: 4603cd37da74Snw * res->retcode = 4604cd37da74Snw * Return status for this request will be placed here. 4605cd37da74Snw * res->direction = 4606cd37da74Snw * Direction found will be placed here. Direction 4607cd37da74Snw * meaning whether the resultant mapping is valid 4608cd37da74Snw * only from unix2win or bi-directional. 4609cd37da74Snw * req->direction = 4610cd37da74Snw * INTERNAL USE. Used by idmapd to set various 4611cd37da74Snw * flags (_IDMAP_F_xxxx) to aid in processing 4612cd37da74Snw * of the request. 4613cd37da74Snw * req->id2.idtype = 4614cd37da74Snw * INTERNAL USE. Initially this is the requested target 4615cd37da74Snw * type and is used to initialize res->id.idtype. 4616cd37da74Snw * ad_lookup_batch() uses this field temporarily to store 4617cd37da74Snw * sid_type obtained by the batched AD lookups and after 4618cd37da74Snw * use resets it to IDMAP_NONE to prevent xdr from 4619cd37da74Snw * mis-interpreting the contents of req->id2. 4620cd37da74Snw * req->id2..[uid or gid or sid] = 4621cd37da74Snw * NOT USED 4622cd37da74Snw */ 4623cd37da74Snw 4624cd37da74Snw /* 4625cd37da74Snw * This function does the following: 4626cd37da74Snw * 1. Lookup well-known SIDs table. 4627cd37da74Snw * 2. Lookup cache. 4628cd37da74Snw * 3. Check if the client does not want new mapping to be allocated 4629cd37da74Snw * in which case this pass is the final pass. 4630e8c27ec8Sbaban * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs 4631e8c27ec8Sbaban * to do AD/NLDAP lookup. 4632cd37da74Snw */ 4633c5c4113dSnw idmap_retcode 4634479ac375Sdm pid2sid_first_pass(lookup_state_t *state, idmap_mapping *req, 4635fe1c642dSBill Krier idmap_id_res *res, int is_user) 4636cd37da74Snw { 4637e8c27ec8Sbaban idmap_retcode retcode; 4638*148c5f43SAlan Wright idmap_retcode retcode2; 4639e8c27ec8Sbaban bool_t gen_localsid_on_err = FALSE; 4640c5c4113dSnw 4641e8c27ec8Sbaban /* Initialize result */ 4642c5c4113dSnw res->id.idtype = req->id2.idtype; 4643e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF; 4644e8c27ec8Sbaban 4645e8c27ec8Sbaban if (req->id2.idmap_id_u.sid.prefix != NULL) { 4646e8c27ec8Sbaban /* sanitize sidprefix */ 4647e8c27ec8Sbaban free(req->id2.idmap_id_u.sid.prefix); 4648e8c27ec8Sbaban req->id2.idmap_id_u.sid.prefix = NULL; 4649e8c27ec8Sbaban } 4650c5c4113dSnw 465148258c6bSjp /* Find pid */ 46529fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.uid == IDMAP_SENTINEL_PID) { 4653fe1c642dSBill Krier if (req->id1name == NULL) { 4654fe1c642dSBill Krier retcode = IDMAP_ERR_ARG; 4655fe1c642dSBill Krier goto out; 4656fe1c642dSBill Krier } 4657fe1c642dSBill Krier 4658*148c5f43SAlan Wright retcode = ns_lookup_byname(req->id1name, NULL, &req->id1); 4659*148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) { 4660*148c5f43SAlan Wright TRACE(req, res, "Getting UNIX ID error=%d", retcode); 466148258c6bSjp retcode = IDMAP_ERR_NOMAPPING; 466248258c6bSjp goto out; 466348258c6bSjp } 4664*148c5f43SAlan Wright TRACE(req, res, "Found UNIX ID"); 466548258c6bSjp } 466648258c6bSjp 466708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup in well-known SIDs table */ 4668c5c4113dSnw retcode = lookup_wksids_pid2sid(req, res, is_user); 4669*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 4670*148c5f43SAlan Wright TRACE(req, res, "Hardwired mapping"); 4671*148c5f43SAlan Wright goto out; 4672*148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 4673*148c5f43SAlan Wright TRACE(req, res, 4674*148c5f43SAlan Wright "Well-known account lookup error=%d", retcode); 4675c5c4113dSnw goto out; 4676*148c5f43SAlan Wright } 4677c5c4113dSnw 467808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup in cache */ 4679fe1c642dSBill Krier retcode = lookup_cache_pid2sid(state->cache, req, res, is_user); 4680*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 4681*148c5f43SAlan Wright TRACE(req, res, "Found in mapping cache"); 4682*148c5f43SAlan Wright goto out; 4683*148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 4684*148c5f43SAlan Wright TRACE(req, res, 4685*148c5f43SAlan Wright "Mapping cache lookup error=%d", retcode); 4686c5c4113dSnw goto out; 4687*148c5f43SAlan Wright } 4688*148c5f43SAlan Wright TRACE(req, res, "Not found in mapping cache"); 4689c5c4113dSnw 4690c5c4113dSnw /* Ephemeral ids cannot be allocated during pid2sid */ 46919fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (IDMAP_ID_IS_EPHEMERAL(req->id1.idmap_id_u.uid)) { 469262c60062Sbaban retcode = IDMAP_ERR_NOMAPPING; 4693*148c5f43SAlan Wright TRACE(req, res, "Shouldn't have an ephemeral ID here"); 4694c5c4113dSnw goto out; 4695c5c4113dSnw } 4696c5c4113dSnw 469748258c6bSjp if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) { 46984d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 469948258c6bSjp goto out; 470048258c6bSjp } 470148258c6bSjp 470248258c6bSjp if (AVOID_NAMESERVICE(req)) { 4703e8c27ec8Sbaban gen_localsid_on_err = TRUE; 470462c60062Sbaban retcode = IDMAP_ERR_NOMAPPING; 4705c5c4113dSnw goto out; 4706c5c4113dSnw } 4707c5c4113dSnw 4708e8c27ec8Sbaban /* Set flags for the next stage */ 4709e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) { 4710e3f2c991SKeyur Desai req->direction |= _IDMAP_F_LOOKUP_AD; 4711e3f2c991SKeyur Desai state->ad_nqueries++; 4712e3f2c991SKeyur Desai } else if (AD_MODE(req->id1.idtype, state)) { 4713e8c27ec8Sbaban /* 4714e8c27ec8Sbaban * If AD-based name mapping is enabled then the next stage 4715e8c27ec8Sbaban * will need to lookup AD using unixname to get the 4716e8c27ec8Sbaban * corresponding winname. 4717e8c27ec8Sbaban */ 4718e8c27ec8Sbaban if (req->id1name == NULL) { 4719e8c27ec8Sbaban /* Get unixname if only pid is given. */ 4720e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, 4721e8c27ec8Sbaban is_user, &req->id1name); 4722479ac375Sdm if (retcode != IDMAP_SUCCESS) { 4723*148c5f43SAlan Wright TRACE(req, res, 4724*148c5f43SAlan Wright "Getting UNIX name error=%d", retcode); 4725479ac375Sdm gen_localsid_on_err = TRUE; 4726e8c27ec8Sbaban goto out; 4727479ac375Sdm } 4728*148c5f43SAlan Wright TRACE(req, res, "Found UNIX name"); 4729c5c4113dSnw } 4730e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD; 4731e8c27ec8Sbaban state->ad_nqueries++; 4732e8c27ec8Sbaban } else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) { 4733e8c27ec8Sbaban /* 4734e8c27ec8Sbaban * If native LDAP or mixed mode is enabled for name mapping 4735e8c27ec8Sbaban * then the next stage will need to lookup native LDAP using 4736e8c27ec8Sbaban * unixname/pid to get the corresponding winname. 4737e8c27ec8Sbaban */ 4738e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_NLDAP; 4739e8c27ec8Sbaban state->nldap_nqueries++; 4740c5c4113dSnw } 4741c5c4113dSnw 4742e8c27ec8Sbaban /* 4743e8c27ec8Sbaban * Failed to find non-expired entry in cache. Set the flag to 4744e8c27ec8Sbaban * indicate that we are not done yet. 4745e8c27ec8Sbaban */ 4746e8c27ec8Sbaban state->pid2sid_done = FALSE; 4747e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE; 4748e8c27ec8Sbaban retcode = IDMAP_SUCCESS; 4749e8c27ec8Sbaban 4750e8c27ec8Sbaban out: 4751e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode); 4752*148c5f43SAlan Wright if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) { 4753*148c5f43SAlan Wright if (gen_localsid_on_err == TRUE) { 4754*148c5f43SAlan Wright retcode2 = generate_localsid(req, res, is_user, TRUE); 4755*148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS) 4756*148c5f43SAlan Wright TRACE(req, res, "Generate local SID"); 4757*148c5f43SAlan Wright else 4758*148c5f43SAlan Wright TRACE(req, res, 4759*148c5f43SAlan Wright "Generate local SID error=%d", retcode2); 4760*148c5f43SAlan Wright } 4761*148c5f43SAlan Wright } 4762e8c27ec8Sbaban return (retcode); 4763e8c27ec8Sbaban } 4764e8c27ec8Sbaban 4765e8c27ec8Sbaban idmap_retcode 4766479ac375Sdm pid2sid_second_pass(lookup_state_t *state, idmap_mapping *req, 4767479ac375Sdm idmap_id_res *res, int is_user) 4768e8c27ec8Sbaban { 4769e8c27ec8Sbaban bool_t gen_localsid_on_err = TRUE; 4770e8c27ec8Sbaban idmap_retcode retcode = IDMAP_SUCCESS; 4771*148c5f43SAlan Wright idmap_retcode retcode2; 4772e8c27ec8Sbaban 4773e8c27ec8Sbaban /* Check if second pass is needed */ 4774e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 4775e8c27ec8Sbaban return (res->retcode); 4776e8c27ec8Sbaban 4777e8c27ec8Sbaban /* Get status from previous pass */ 4778e8c27ec8Sbaban retcode = res->retcode; 4779e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4780c5c4113dSnw goto out; 4781c5c4113dSnw 4782c5c4113dSnw /* 4783e8c27ec8Sbaban * If directory-based name mapping is enabled then the winname 4784e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode) 4785479ac375Sdm * or from native LDAP object (nldap-mode or mixed-mode). 4786479ac375Sdm * Note that if we have winname but no SID then it's an error 4787479ac375Sdm * because this implies that the Native LDAP entry contains 4788479ac375Sdm * winname which does not exist and it's better that we return 4789479ac375Sdm * an error instead of doing rule-based mapping so that the user 4790479ac375Sdm * can detect the issue and take appropriate action. 4791c5c4113dSnw */ 4792479ac375Sdm if (req->id2name != NULL) { 4793479ac375Sdm /* Return notfound if we've winname but no SID. */ 4794479ac375Sdm if (res->id.idmap_id_u.sid.prefix == NULL) { 4795*148c5f43SAlan Wright TRACE(req, res, "Windows name but no SID"); 4796479ac375Sdm retcode = IDMAP_ERR_NOTFOUND; 4797479ac375Sdm goto out; 4798479ac375Sdm } 4799e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) 4800e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI; 4801e3f2c991SKeyur Desai else if (AD_MODE(req->id1.idtype, state)) 4802e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 4803e8c27ec8Sbaban else if (NLDAP_MODE(req->id1.idtype, state)) 4804e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 4805e8c27ec8Sbaban else if (MIXED_MODE(req->id1.idtype, state)) 4806e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U; 4807e8c27ec8Sbaban goto out; 4808479ac375Sdm } else if (res->id.idmap_id_u.sid.prefix != NULL) { 4809479ac375Sdm /* 4810479ac375Sdm * We've SID but no winname. This is fine because 4811479ac375Sdm * the caller may have only requested SID. 4812479ac375Sdm */ 4813479ac375Sdm goto out; 4814e8c27ec8Sbaban } 4815e8c27ec8Sbaban 4816479ac375Sdm /* Free any mapping info from Directory based mapping */ 4817479ac375Sdm if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 4818*148c5f43SAlan Wright idmap_how_clear(&res->info.how); 4819479ac375Sdm 4820e8c27ec8Sbaban if (req->id1name == NULL) { 4821e8c27ec8Sbaban /* Get unixname from name service */ 4822e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user, 4823e8c27ec8Sbaban &req->id1name); 4824*148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) { 4825*148c5f43SAlan Wright TRACE(req, res, 4826*148c5f43SAlan Wright "Getting UNIX name error=%d", retcode); 4827e8c27ec8Sbaban goto out; 4828*148c5f43SAlan Wright } 4829*148c5f43SAlan Wright TRACE(req, res, "Found UNIX name"); 48309fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } else if (req->id1.idmap_id_u.uid == IDMAP_SENTINEL_PID) { 4831e8c27ec8Sbaban /* Get pid from name service */ 4832e8c27ec8Sbaban retcode = ns_lookup_byname(req->id1name, NULL, &req->id1); 4833e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 4834*148c5f43SAlan Wright TRACE(req, res, 4835*148c5f43SAlan Wright "Getting UNIX ID error=%d", retcode); 4836e8c27ec8Sbaban gen_localsid_on_err = FALSE; 4837e8c27ec8Sbaban goto out; 4838e8c27ec8Sbaban } 4839*148c5f43SAlan Wright TRACE(req, res, "Found UNIX ID"); 4840e8c27ec8Sbaban } 4841e8c27ec8Sbaban 4842e8c27ec8Sbaban /* Use unixname to evaluate local name-based mapping rules */ 4843479ac375Sdm retcode = name_based_mapping_pid2sid(state, req->id1name, is_user, 4844e8c27ec8Sbaban req, res); 4845e8c27ec8Sbaban if (retcode == IDMAP_ERR_NOTFOUND) { 484648258c6bSjp retcode = generate_localsid(req, res, is_user, FALSE); 4847*148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 4848*148c5f43SAlan Wright TRACE(req, res, "Generated local SID"); 4849*148c5f43SAlan Wright } else { 4850*148c5f43SAlan Wright TRACE(req, res, 4851*148c5f43SAlan Wright "Generating local SID error=%d", retcode); 4852*148c5f43SAlan Wright } 4853e8c27ec8Sbaban gen_localsid_on_err = FALSE; 4854e8c27ec8Sbaban } 4855c5c4113dSnw 4856c5c4113dSnw out: 4857e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode); 4858e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 4859e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 4860479ac375Sdm free(req->id2name); 4861479ac375Sdm req->id2name = NULL; 4862479ac375Sdm free(req->id2domain); 4863479ac375Sdm req->id2domain = NULL; 4864*148c5f43SAlan Wright if (gen_localsid_on_err == TRUE) { 4865*148c5f43SAlan Wright retcode2 = generate_localsid(req, res, is_user, TRUE); 4866*148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS) 4867*148c5f43SAlan Wright TRACE(req, res, "Generate local SID"); 4868*148c5f43SAlan Wright else 4869*148c5f43SAlan Wright TRACE(req, res, 4870*148c5f43SAlan Wright "Generate local SID error=%d", retcode2); 4871*148c5f43SAlan Wright } else { 4872479ac375Sdm res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 4873*148c5f43SAlan Wright } 4874c5c4113dSnw } 4875e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction)) 4876c5c4113dSnw state->pid2sid_done = FALSE; 4877c5c4113dSnw return (retcode); 4878c5c4113dSnw } 48799fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 48809fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode 48819fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_cache_flush(idmap_flush_op op) 48829fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States { 48839fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode rc; 48849fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sqlite *cache = NULL; 48859fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States char *sql1; 48869fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States char *sql2; 48879fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 48889fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States switch (op) { 48899fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_FLUSH_EXPIRE: 48909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql1 = 48919fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "UPDATE idmap_cache SET expiration=1 WHERE expiration>0;"; 48929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql2 = 48939fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "UPDATE name_cache SET expiration=1 WHERE expiration>0;"; 48949fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States break; 48959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 48969fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_FLUSH_DELETE: 48979fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql1 = "DELETE FROM idmap_cache;"; 48989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql2 = "DELETE FROM name_cache;"; 48999fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States break; 49009fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49019fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States default: 49029fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_INTERNAL); 49039fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 49049fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49059fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = get_cache_handle(&cache); 49069fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (rc != IDMAP_SUCCESS) 49079fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc); 49089fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States /* 49109fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Note that we flush the idmapd cache first, before the kernel 49119fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * cache. If we did it the other way 'round, a request could come 49129fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * in after the kernel cache flush and pull a soon-to-be-flushed 49139fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * idmapd cache entry back into the kernel cache. This way the 49149fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * worst that will happen is that a new entry will be added to 49159fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * the kernel cache and then immediately flushed. 49169fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States */ 49179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql1); 49199fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (rc != IDMAP_SUCCESS) 49209fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc); 49219fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49229fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql2); 49239fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49249fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States (void) __idmap_flush_kcache(); 49259fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc); 49269fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 4927