1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 227a8a68f5SJulian Pullen * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23c5c4113dSnw * Use is subject to license terms. 24c5c4113dSnw */ 25c5c4113dSnw 26c5c4113dSnw /* 27c5c4113dSnw * Database related utility routines 28c5c4113dSnw */ 29c5c4113dSnw 30c5c4113dSnw #include <stdio.h> 31c5c4113dSnw #include <stdlib.h> 32c5c4113dSnw #include <string.h> 33c5c4113dSnw #include <errno.h> 34c5c4113dSnw #include <sys/types.h> 35c5c4113dSnw #include <sys/stat.h> 36c5c4113dSnw #include <rpc/rpc.h> 37c5c4113dSnw #include <sys/sid.h> 38c5c4113dSnw #include <time.h> 39c5c4113dSnw #include <pwd.h> 40c5c4113dSnw #include <grp.h> 4184decf41Sjp #include <pthread.h> 4284decf41Sjp #include <assert.h> 43cd37da74Snw #include <sys/u8_textprep.h> 44*8c155366SJordan Brown #include <alloca.h> 45c5c4113dSnw 46c5c4113dSnw #include "idmapd.h" 47c5c4113dSnw #include "adutils.h" 48c5c4113dSnw #include "string.h" 49c5c4113dSnw #include "idmap_priv.h" 50cd37da74Snw #include "schema.h" 51e8c27ec8Sbaban #include "nldaputils.h" 52c5c4113dSnw 5384decf41Sjp 54c5c4113dSnw static idmap_retcode sql_compile_n_step_once(sqlite *, char *, 55c5c4113dSnw sqlite_vm **, int *, int, const char ***); 56479ac375Sdm static idmap_retcode ad_lookup_one(lookup_state_t *, idmap_mapping *, 57479ac375Sdm idmap_id_res *); 58e8c27ec8Sbaban static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *); 59e8c27ec8Sbaban static idmap_retcode lookup_cache_name2sid(sqlite *, const char *, 60e8c27ec8Sbaban const char *, char **, char **, idmap_rid_t *, int *); 61e8c27ec8Sbaban 62c5c4113dSnw 63c5c4113dSnw #define EMPTY_NAME(name) (*name == 0 || strcmp(name, "\"\"") == 0) 64c5c4113dSnw 65c5c4113dSnw #define DO_NOT_ALLOC_NEW_ID_MAPPING(req)\ 66c5c4113dSnw (req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC) 67c5c4113dSnw 68c5c4113dSnw #define AVOID_NAMESERVICE(req)\ 69c5c4113dSnw (req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE) 70c5c4113dSnw 712b4a7802SBaban Kenkre #define ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)\ 722b4a7802SBaban Kenkre (req->flag & IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY) 732b4a7802SBaban Kenkre 74e8c27ec8Sbaban #define IS_EPHEMERAL(pid) (pid > INT32_MAX && pid != SENTINEL_PID) 75c5c4113dSnw 76c5c4113dSnw #define LOCALRID_MIN 1000 77c5c4113dSnw 78c5c4113dSnw 79c5c4113dSnw typedef enum init_db_option { 80c5c4113dSnw FAIL_IF_CORRUPT = 0, 81c5c4113dSnw REMOVE_IF_CORRUPT = 1 82c5c4113dSnw } init_db_option_t; 83c5c4113dSnw 84e8c27ec8Sbaban /* 85e8c27ec8Sbaban * Data structure to store well-known SIDs and 86e8c27ec8Sbaban * associated mappings (if any) 87e8c27ec8Sbaban */ 88e8c27ec8Sbaban typedef struct wksids_table { 89e8c27ec8Sbaban const char *sidprefix; 90e8c27ec8Sbaban uint32_t rid; 91e8c27ec8Sbaban const char *winname; 92e8c27ec8Sbaban int is_wuser; 93e8c27ec8Sbaban uid_t pid; 94e8c27ec8Sbaban int is_user; 95e8c27ec8Sbaban int direction; 96e8c27ec8Sbaban } wksids_table_t; 97e8c27ec8Sbaban 9884decf41Sjp /* 9984decf41Sjp * Thread specfic data to hold the database handles so that the 10084decf41Sjp * databaes are not opened and closed for every request. It also 10184decf41Sjp * contains the sqlite busy handler structure. 10284decf41Sjp */ 10384decf41Sjp 10484decf41Sjp struct idmap_busy { 10584decf41Sjp const char *name; 10684decf41Sjp const int *delays; 10784decf41Sjp int delay_size; 10884decf41Sjp int total; 10984decf41Sjp int sec; 11084decf41Sjp }; 11184decf41Sjp 11284decf41Sjp 11384decf41Sjp typedef struct idmap_tsd { 11484decf41Sjp sqlite *db_db; 11584decf41Sjp sqlite *cache_db; 11684decf41Sjp struct idmap_busy cache_busy; 11784decf41Sjp struct idmap_busy db_busy; 11884decf41Sjp } idmap_tsd_t; 11984decf41Sjp 12084decf41Sjp 12184decf41Sjp 12284decf41Sjp static const int cache_delay_table[] = 12384decf41Sjp { 1, 2, 5, 10, 15, 20, 25, 30, 35, 40, 12484decf41Sjp 50, 50, 60, 70, 80, 90, 100}; 12584decf41Sjp 12684decf41Sjp static const int db_delay_table[] = 12784decf41Sjp { 5, 10, 15, 20, 30, 40, 55, 70, 100}; 12884decf41Sjp 12984decf41Sjp 13084decf41Sjp static pthread_key_t idmap_tsd_key; 13184decf41Sjp 13284decf41Sjp void 13384decf41Sjp idmap_tsd_destroy(void *key) 13484decf41Sjp { 13584decf41Sjp 13684decf41Sjp idmap_tsd_t *tsd = (idmap_tsd_t *)key; 13784decf41Sjp if (tsd) { 13884decf41Sjp if (tsd->db_db) 13984decf41Sjp (void) sqlite_close(tsd->db_db); 14084decf41Sjp if (tsd->cache_db) 14184decf41Sjp (void) sqlite_close(tsd->cache_db); 14284decf41Sjp free(tsd); 14384decf41Sjp } 14484decf41Sjp } 14584decf41Sjp 14684decf41Sjp int 147cd37da74Snw idmap_init_tsd_key(void) 148cd37da74Snw { 14984decf41Sjp return (pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy)); 15084decf41Sjp } 15184decf41Sjp 15284decf41Sjp 15384decf41Sjp 15484decf41Sjp idmap_tsd_t * 15584decf41Sjp idmap_get_tsd(void) 15684decf41Sjp { 15784decf41Sjp idmap_tsd_t *tsd; 15884decf41Sjp 15984decf41Sjp if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) { 16084decf41Sjp /* No thread specific data so create it */ 16184decf41Sjp if ((tsd = malloc(sizeof (*tsd))) != NULL) { 16284decf41Sjp /* Initialize thread specific data */ 16384decf41Sjp (void) memset(tsd, 0, sizeof (*tsd)); 16484decf41Sjp /* save the trhread specific data */ 16584decf41Sjp if (pthread_setspecific(idmap_tsd_key, tsd) != 0) { 16684decf41Sjp /* Can't store key */ 16784decf41Sjp free(tsd); 16884decf41Sjp tsd = NULL; 16984decf41Sjp } 17084decf41Sjp } else { 17184decf41Sjp tsd = NULL; 17284decf41Sjp } 17384decf41Sjp } 17484decf41Sjp 17584decf41Sjp return (tsd); 17684decf41Sjp } 17784decf41Sjp 178cd37da74Snw /* 179cd37da74Snw * A simple wrapper around u8_textprep_str() that returns the Unicode 180cd37da74Snw * lower-case version of some string. The result must be freed. 181cd37da74Snw */ 182cd37da74Snw char * 183cd37da74Snw tolower_u8(const char *s) 184cd37da74Snw { 185cd37da74Snw char *res = NULL; 186cd37da74Snw char *outs; 187cd37da74Snw size_t inlen, outlen, inbytesleft, outbytesleft; 188cd37da74Snw int rc, err; 189cd37da74Snw 190cd37da74Snw /* 191cd37da74Snw * u8_textprep_str() does not allocate memory. The input and 192cd37da74Snw * output buffers may differ in size (though that would be more 193cd37da74Snw * likely when normalization is done). We have to loop over it... 194cd37da74Snw * 195cd37da74Snw * To improve the chances that we can avoid looping we add 10 196cd37da74Snw * bytes of output buffer room the first go around. 197cd37da74Snw */ 198cd37da74Snw inlen = inbytesleft = strlen(s); 199cd37da74Snw outlen = outbytesleft = inlen + 10; 200cd37da74Snw if ((res = malloc(outlen)) == NULL) 201cd37da74Snw return (NULL); 202cd37da74Snw outs = res; 203cd37da74Snw 204cd37da74Snw while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs, 205cd37da74Snw &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 && 206cd37da74Snw err == E2BIG) { 207cd37da74Snw if ((res = realloc(res, outlen + inbytesleft)) == NULL) 208cd37da74Snw return (NULL); 209cd37da74Snw /* adjust input/output buffer pointers */ 210cd37da74Snw s += (inlen - inbytesleft); 211cd37da74Snw outs = res + outlen - outbytesleft; 212cd37da74Snw /* adjust outbytesleft and outlen */ 213cd37da74Snw outlen += inbytesleft; 214cd37da74Snw outbytesleft += inbytesleft; 215cd37da74Snw } 216cd37da74Snw 217cd37da74Snw if (rc < 0) { 218cd37da74Snw free(res); 219cd37da74Snw res = NULL; 220cd37da74Snw return (NULL); 221cd37da74Snw } 222cd37da74Snw 223cd37da74Snw res[outlen - outbytesleft] = '\0'; 224cd37da74Snw 225cd37da74Snw return (res); 226cd37da74Snw } 227cd37da74Snw 228cd37da74Snw static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 229cd37da74Snw const char *while_doing); 230cd37da74Snw 231c5c4113dSnw 232c5c4113dSnw /* 233c5c4113dSnw * Initialize 'dbname' using 'sql' 234c5c4113dSnw */ 235cd37da74Snw static 236cd37da74Snw int 237cd37da74Snw init_db_instance(const char *dbname, int version, 238cd37da74Snw const char *detect_version_sql, char * const *sql, 239cd37da74Snw init_db_option_t opt, int *created, int *upgraded) 240c5c4113dSnw { 241cd37da74Snw int rc, curr_version; 242cd37da74Snw int tries = 1; 243cd37da74Snw int prio = LOG_NOTICE; 244c5c4113dSnw sqlite *db = NULL; 245cd37da74Snw char *errmsg = NULL; 246c5c4113dSnw 247cd37da74Snw *created = 0; 248cd37da74Snw *upgraded = 0; 249c5c4113dSnw 250cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 251cd37da74Snw tries = 3; 252c5c4113dSnw 253cd37da74Snw rinse_repeat: 254cd37da74Snw if (tries == 0) { 255cd37da74Snw idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname); 256cd37da74Snw return (-1); 257c5c4113dSnw } 258cd37da74Snw if (tries-- == 1) 259cd37da74Snw /* Last try, log errors */ 260cd37da74Snw prio = LOG_ERR; 261c5c4113dSnw 262cd37da74Snw db = sqlite_open(dbname, 0600, &errmsg); 263cd37da74Snw if (db == NULL) { 264cd37da74Snw idmapdlog(prio, "Error creating database %s (%s)", 265cd37da74Snw dbname, CHECK_NULL(errmsg)); 266cd37da74Snw sqlite_freemem(errmsg); 267cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 268cd37da74Snw (void) unlink(dbname); 269cd37da74Snw goto rinse_repeat; 270c5c4113dSnw } 271c5c4113dSnw 272cd37da74Snw sqlite_busy_timeout(db, 3000); 273c5c4113dSnw 274cd37da74Snw /* Detect current version of schema in the db, if any */ 275cd37da74Snw curr_version = 0; 276cd37da74Snw if (detect_version_sql != NULL) { 277cd37da74Snw char *end, **results; 278cd37da74Snw int nrow; 279cd37da74Snw 280cd37da74Snw #ifdef IDMAPD_DEBUG 281cd37da74Snw (void) fprintf(stderr, "Schema version detection SQL: %s\n", 282cd37da74Snw detect_version_sql); 283cd37da74Snw #endif /* IDMAPD_DEBUG */ 284cd37da74Snw rc = sqlite_get_table(db, detect_version_sql, &results, 285cd37da74Snw &nrow, NULL, &errmsg); 286cd37da74Snw if (rc != SQLITE_OK) { 287cd37da74Snw idmapdlog(prio, 288cd37da74Snw "Error detecting schema version of db %s (%s)", 289cd37da74Snw dbname, errmsg); 290cd37da74Snw sqlite_freemem(errmsg); 291cd37da74Snw sqlite_free_table(results); 292cd37da74Snw sqlite_close(db); 293cd37da74Snw return (-1); 294cd37da74Snw } 295cd37da74Snw if (nrow != 1) { 296cd37da74Snw idmapdlog(prio, 297cd37da74Snw "Error detecting schema version of db %s", dbname); 298cd37da74Snw sqlite_close(db); 299cd37da74Snw sqlite_free_table(results); 300cd37da74Snw return (-1); 301cd37da74Snw } 302cd37da74Snw curr_version = strtol(results[1], &end, 10); 303cd37da74Snw sqlite_free_table(results); 304c5c4113dSnw } 305c5c4113dSnw 306cd37da74Snw if (curr_version < 0) { 307cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 308cd37da74Snw (void) unlink(dbname); 309cd37da74Snw goto rinse_repeat; 310cd37da74Snw } 311cd37da74Snw 312cd37da74Snw if (curr_version == version) 313cd37da74Snw goto done; 314cd37da74Snw 315cd37da74Snw /* Install or upgrade schema */ 316cd37da74Snw #ifdef IDMAPD_DEBUG 317cd37da74Snw (void) fprintf(stderr, "Schema init/upgrade SQL: %s\n", 318cd37da74Snw sql[curr_version]); 319cd37da74Snw #endif /* IDMAPD_DEBUG */ 320cd37da74Snw rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname, 321cd37da74Snw (curr_version == 0) ? "installing schema" : "upgrading schema"); 322cd37da74Snw if (rc != 0) { 323cd37da74Snw idmapdlog(prio, "Error %s schema for db %s", dbname, 324cd37da74Snw (curr_version == 0) ? "installing schema" : 325cd37da74Snw "upgrading schema"); 326cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 327cd37da74Snw (void) unlink(dbname); 328cd37da74Snw goto rinse_repeat; 329c5c4113dSnw } 330c5c4113dSnw 331cd37da74Snw *upgraded = (curr_version > 0); 332cd37da74Snw *created = (curr_version == 0); 333cd37da74Snw 334cd37da74Snw done: 335c5c4113dSnw (void) sqlite_close(db); 336cd37da74Snw return (0); 337c5c4113dSnw } 338c5c4113dSnw 33984decf41Sjp 34084decf41Sjp /* 34184decf41Sjp * This is the SQLite database busy handler that retries the SQL 34284decf41Sjp * operation until it is successful. 34384decf41Sjp */ 34484decf41Sjp int 34584decf41Sjp /* LINTED E_FUNC_ARG_UNUSED */ 34684decf41Sjp idmap_sqlite_busy_handler(void *arg, const char *table_name, int count) 34784decf41Sjp { 34884decf41Sjp struct idmap_busy *busy = arg; 34984decf41Sjp int delay; 35084decf41Sjp struct timespec rqtp; 35184decf41Sjp 35284decf41Sjp if (count == 1) { 35384decf41Sjp busy->total = 0; 35484decf41Sjp busy->sec = 2; 35584decf41Sjp } 35684decf41Sjp if (busy->total > 1000 * busy->sec) { 3572b3ecdebSjp idmapdlog(LOG_DEBUG, 35884decf41Sjp "Thread %d waited %d sec for the %s database", 35984decf41Sjp pthread_self(), busy->sec, busy->name); 36084decf41Sjp busy->sec++; 36184decf41Sjp } 36284decf41Sjp 36384decf41Sjp if (count <= busy->delay_size) { 36484decf41Sjp delay = busy->delays[count-1]; 36584decf41Sjp } else { 36684decf41Sjp delay = busy->delays[busy->delay_size - 1]; 36784decf41Sjp } 36884decf41Sjp busy->total += delay; 36984decf41Sjp rqtp.tv_sec = 0; 37084decf41Sjp rqtp.tv_nsec = delay * (NANOSEC / MILLISEC); 37184decf41Sjp (void) nanosleep(&rqtp, NULL); 37284decf41Sjp return (1); 37384decf41Sjp } 37484decf41Sjp 37584decf41Sjp 376c5c4113dSnw /* 377c5c4113dSnw * Get the database handle 378c5c4113dSnw */ 379c5c4113dSnw idmap_retcode 380cd37da74Snw get_db_handle(sqlite **db) 381cd37da74Snw { 382cd37da74Snw char *errmsg; 383cd37da74Snw idmap_tsd_t *tsd; 384c5c4113dSnw 385c5c4113dSnw /* 38684decf41Sjp * Retrieve the db handle from thread-specific storage 387c5c4113dSnw * If none exists, open and store in thread-specific storage. 388c5c4113dSnw */ 38984decf41Sjp if ((tsd = idmap_get_tsd()) == NULL) { 390c5c4113dSnw idmapdlog(LOG_ERR, 391cd37da74Snw "Error getting thread specific data for %s", IDMAP_DBNAME); 39284decf41Sjp return (IDMAP_ERR_MEMORY); 393c5c4113dSnw } 39484decf41Sjp 39584decf41Sjp if (tsd->db_db == NULL) { 39684decf41Sjp tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg); 39784decf41Sjp if (tsd->db_db == NULL) { 398cd37da74Snw idmapdlog(LOG_ERR, "Error opening database %s (%s)", 399cd37da74Snw IDMAP_DBNAME, CHECK_NULL(errmsg)); 40084decf41Sjp sqlite_freemem(errmsg); 401cd37da74Snw return (IDMAP_ERR_DB); 40284decf41Sjp } 403cd37da74Snw 40484decf41Sjp tsd->db_busy.name = IDMAP_DBNAME; 40584decf41Sjp tsd->db_busy.delays = db_delay_table; 40684decf41Sjp tsd->db_busy.delay_size = sizeof (db_delay_table) / 40784decf41Sjp sizeof (int); 40884decf41Sjp sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler, 40984decf41Sjp &tsd->db_busy); 41084decf41Sjp } 41184decf41Sjp *db = tsd->db_db; 412c5c4113dSnw return (IDMAP_SUCCESS); 413c5c4113dSnw } 414c5c4113dSnw 415c5c4113dSnw /* 416c5c4113dSnw * Get the cache handle 417c5c4113dSnw */ 418c5c4113dSnw idmap_retcode 419cd37da74Snw get_cache_handle(sqlite **cache) 420cd37da74Snw { 421cd37da74Snw char *errmsg; 422cd37da74Snw idmap_tsd_t *tsd; 423c5c4113dSnw 424c5c4113dSnw /* 42584decf41Sjp * Retrieve the db handle from thread-specific storage 426c5c4113dSnw * If none exists, open and store in thread-specific storage. 427c5c4113dSnw */ 42884decf41Sjp if ((tsd = idmap_get_tsd()) == NULL) { 429cd37da74Snw idmapdlog(LOG_ERR, "Error getting thread specific data for %s", 430cd37da74Snw IDMAP_DBNAME); 43184decf41Sjp return (IDMAP_ERR_MEMORY); 432c5c4113dSnw } 43384decf41Sjp 43484decf41Sjp if (tsd->cache_db == NULL) { 43584decf41Sjp tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg); 43684decf41Sjp if (tsd->cache_db == NULL) { 437cd37da74Snw idmapdlog(LOG_ERR, "Error opening database %s (%s)", 438cd37da74Snw IDMAP_CACHENAME, CHECK_NULL(errmsg)); 43984decf41Sjp sqlite_freemem(errmsg); 440cd37da74Snw return (IDMAP_ERR_DB); 44184decf41Sjp } 442cd37da74Snw 44384decf41Sjp tsd->cache_busy.name = IDMAP_CACHENAME; 44484decf41Sjp tsd->cache_busy.delays = cache_delay_table; 44584decf41Sjp tsd->cache_busy.delay_size = sizeof (cache_delay_table) / 44684decf41Sjp sizeof (int); 44784decf41Sjp sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler, 44884decf41Sjp &tsd->cache_busy); 44984decf41Sjp } 45084decf41Sjp *cache = tsd->cache_db; 451c5c4113dSnw return (IDMAP_SUCCESS); 452c5c4113dSnw } 453c5c4113dSnw 454c5c4113dSnw /* 455c5c4113dSnw * Initialize cache and db 456c5c4113dSnw */ 457c5c4113dSnw int 458cd37da74Snw init_dbs() 459cd37da74Snw { 46048258c6bSjp char *sql[4]; 461cd37da74Snw int created, upgraded; 462cd37da74Snw 463c5c4113dSnw /* name-based mappings; probably OK to blow away in a pinch(?) */ 464cd37da74Snw sql[0] = DB_INSTALL_SQL; 465cd37da74Snw sql[1] = DB_UPGRADE_FROM_v1_SQL; 46648258c6bSjp sql[2] = NULL; 467cd37da74Snw 468cd37da74Snw if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql, 469cd37da74Snw FAIL_IF_CORRUPT, &created, &upgraded) < 0) 470c5c4113dSnw return (-1); 471c5c4113dSnw 472c5c4113dSnw /* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */ 473cd37da74Snw sql[0] = CACHE_INSTALL_SQL; 474cd37da74Snw sql[1] = CACHE_UPGRADE_FROM_v1_SQL; 47548258c6bSjp sql[2] = CACHE_UPGRADE_FROM_v2_SQL; 47648258c6bSjp sql[3] = NULL; 47748258c6bSjp 478cd37da74Snw if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL, 479cd37da74Snw sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0) 480c5c4113dSnw return (-1); 481c5c4113dSnw 482cd37da74Snw _idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0; 483cd37da74Snw 484c5c4113dSnw return (0); 485c5c4113dSnw } 486c5c4113dSnw 487c5c4113dSnw /* 488c5c4113dSnw * Finalize databases 489c5c4113dSnw */ 490c5c4113dSnw void 491cd37da74Snw fini_dbs() 492cd37da74Snw { 493c5c4113dSnw } 494c5c4113dSnw 495c5c4113dSnw /* 496e8c27ec8Sbaban * This table is a listing of status codes that will be returned to the 497c5c4113dSnw * client when a SQL command fails with the corresponding error message. 498c5c4113dSnw */ 499c5c4113dSnw static msg_table_t sqlmsgtable[] = { 50062c60062Sbaban {IDMAP_ERR_U2W_NAMERULE_CONFLICT, 501c5c4113dSnw "columns unixname, is_user, u2w_order are not unique"}, 50262c60062Sbaban {IDMAP_ERR_W2U_NAMERULE_CONFLICT, 503cd37da74Snw "columns winname, windomain, is_user, is_wuser, w2u_order are not" 504cd37da74Snw " unique"}, 505cd37da74Snw {IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"}, 506c5c4113dSnw {-1, NULL} 507c5c4113dSnw }; 508c5c4113dSnw 509c5c4113dSnw /* 510c5c4113dSnw * idmapd's version of string2stat to map SQLite messages to 511c5c4113dSnw * status codes 512c5c4113dSnw */ 513c5c4113dSnw idmap_retcode 514cd37da74Snw idmapd_string2stat(const char *msg) 515cd37da74Snw { 516c5c4113dSnw int i; 517c5c4113dSnw for (i = 0; sqlmsgtable[i].msg; i++) { 518c5c4113dSnw if (strcasecmp(sqlmsgtable[i].msg, msg) == 0) 519c5c4113dSnw return (sqlmsgtable[i].retcode); 520c5c4113dSnw } 521c5c4113dSnw return (IDMAP_ERR_OTHER); 522c5c4113dSnw } 523c5c4113dSnw 524cd37da74Snw /* 525cd37da74Snw * Executes some SQL in a transaction. 526cd37da74Snw * 527cd37da74Snw * Returns 0 on success, -1 if it failed but the rollback succeeded, -2 528cd37da74Snw * if the rollback failed. 529cd37da74Snw */ 530cd37da74Snw static 531cd37da74Snw int 532cd37da74Snw sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 533cd37da74Snw const char *while_doing) 534cd37da74Snw { 535cd37da74Snw char *errmsg = NULL; 536cd37da74Snw int rc; 537cd37da74Snw 538cd37da74Snw rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg); 539cd37da74Snw if (rc != SQLITE_OK) { 540cd37da74Snw idmapdlog(LOG_ERR, "Begin transaction failed (%s) " 541cd37da74Snw "while %s (%s)", errmsg, while_doing, dbname); 542cd37da74Snw sqlite_freemem(errmsg); 543cd37da74Snw return (-1); 544cd37da74Snw } 545cd37da74Snw 546cd37da74Snw rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 547cd37da74Snw if (rc != SQLITE_OK) { 548cd37da74Snw idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg, 549cd37da74Snw while_doing, dbname); 550cd37da74Snw sqlite_freemem(errmsg); 551cd37da74Snw errmsg = NULL; 552cd37da74Snw goto rollback; 553cd37da74Snw } 554cd37da74Snw 555cd37da74Snw rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg); 556cd37da74Snw if (rc == SQLITE_OK) { 557cd37da74Snw sqlite_freemem(errmsg); 558cd37da74Snw return (0); 559cd37da74Snw } 560cd37da74Snw 561cd37da74Snw idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)", 562cd37da74Snw errmsg, while_doing, dbname); 563cd37da74Snw sqlite_freemem(errmsg); 564cd37da74Snw errmsg = NULL; 565cd37da74Snw 566cd37da74Snw rollback: 567cd37da74Snw rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg); 568cd37da74Snw if (rc != SQLITE_OK) { 569cd37da74Snw idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)", 570cd37da74Snw errmsg, while_doing, dbname); 571cd37da74Snw sqlite_freemem(errmsg); 572cd37da74Snw return (-2); 573cd37da74Snw } 574cd37da74Snw sqlite_freemem(errmsg); 575cd37da74Snw 576cd37da74Snw return (-1); 577cd37da74Snw } 578cd37da74Snw 579c5c4113dSnw /* 580c5c4113dSnw * Execute the given SQL statment without using any callbacks 581c5c4113dSnw */ 582c5c4113dSnw idmap_retcode 58371590c90Snw sql_exec_no_cb(sqlite *db, const char *dbname, char *sql) 584cd37da74Snw { 585c5c4113dSnw char *errmsg = NULL; 58684decf41Sjp int r; 587c5c4113dSnw idmap_retcode retcode; 588c5c4113dSnw 58984decf41Sjp r = sqlite_exec(db, sql, NULL, NULL, &errmsg); 59084decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 591c5c4113dSnw 592c5c4113dSnw if (r != SQLITE_OK) { 59371590c90Snw idmapdlog(LOG_ERR, "Database error on %s while executing %s " 59471590c90Snw "(%s)", dbname, sql, CHECK_NULL(errmsg)); 59584decf41Sjp retcode = idmapd_string2stat(errmsg); 59662c60062Sbaban if (errmsg != NULL) 597c5c4113dSnw sqlite_freemem(errmsg); 598c5c4113dSnw return (retcode); 599c5c4113dSnw } 600c5c4113dSnw 601c5c4113dSnw return (IDMAP_SUCCESS); 602c5c4113dSnw } 603c5c4113dSnw 604c5c4113dSnw /* 605c5c4113dSnw * Generate expression that can be used in WHERE statements. 606c5c4113dSnw * Examples: 607c5c4113dSnw * <prefix> <col> <op> <value> <suffix> 608c5c4113dSnw * "" "unixuser" "=" "foo" "AND" 609c5c4113dSnw */ 610c5c4113dSnw idmap_retcode 611cd37da74Snw gen_sql_expr_from_rule(idmap_namerule *rule, char **out) 612cd37da74Snw { 613cd37da74Snw char *s_windomain = NULL, *s_winname = NULL; 614cd37da74Snw char *s_unixname = NULL; 615cd37da74Snw char *lower_winname; 616cd37da74Snw int retcode = IDMAP_SUCCESS; 617cd37da74Snw 618c5c4113dSnw if (out == NULL) 619c5c4113dSnw return (IDMAP_ERR_ARG); 620c5c4113dSnw 621c5c4113dSnw 622cd37da74Snw if (!EMPTY_STRING(rule->windomain)) { 623cd37da74Snw s_windomain = sqlite_mprintf("AND windomain = %Q ", 624cd37da74Snw rule->windomain); 625cd37da74Snw if (s_windomain == NULL) { 626cd37da74Snw retcode = IDMAP_ERR_MEMORY; 627cd37da74Snw goto out; 628cd37da74Snw } 629cd37da74Snw } 630c5c4113dSnw 631cd37da74Snw if (!EMPTY_STRING(rule->winname)) { 632cd37da74Snw if ((lower_winname = tolower_u8(rule->winname)) == NULL) 633cd37da74Snw lower_winname = rule->winname; 634cd37da74Snw s_winname = sqlite_mprintf( 635cd37da74Snw "AND winname = %Q AND is_wuser = %d ", 636cd37da74Snw lower_winname, rule->is_wuser ? 1 : 0); 637cd37da74Snw if (lower_winname != rule->winname) 638cd37da74Snw free(lower_winname); 639cd37da74Snw if (s_winname == NULL) { 640cd37da74Snw retcode = IDMAP_ERR_MEMORY; 641cd37da74Snw goto out; 642cd37da74Snw } 643cd37da74Snw } 644cd37da74Snw 645cd37da74Snw if (!EMPTY_STRING(rule->unixname)) { 646cd37da74Snw s_unixname = sqlite_mprintf( 647cd37da74Snw "AND unixname = %Q AND is_user = %d ", 648cd37da74Snw rule->unixname, rule->is_user ? 1 : 0); 649cd37da74Snw if (s_unixname == NULL) { 650cd37da74Snw retcode = IDMAP_ERR_MEMORY; 651cd37da74Snw goto out; 652cd37da74Snw } 653cd37da74Snw } 654cd37da74Snw 655cd37da74Snw *out = sqlite_mprintf("%s %s %s", 656cd37da74Snw s_windomain ? s_windomain : "", 657cd37da74Snw s_winname ? s_winname : "", 658cd37da74Snw s_unixname ? s_unixname : ""); 659cd37da74Snw 660cd37da74Snw if (*out == NULL) { 661cd37da74Snw retcode = IDMAP_ERR_MEMORY; 662cd37da74Snw idmapdlog(LOG_ERR, "Out of memory"); 663cd37da74Snw goto out; 664cd37da74Snw } 665cd37da74Snw 666cd37da74Snw out: 667cd37da74Snw if (s_windomain != NULL) 668cd37da74Snw sqlite_freemem(s_windomain); 669cd37da74Snw if (s_winname != NULL) 670cd37da74Snw sqlite_freemem(s_winname); 671cd37da74Snw if (s_unixname != NULL) 672cd37da74Snw sqlite_freemem(s_unixname); 673cd37da74Snw 674cd37da74Snw return (retcode); 675c5c4113dSnw } 676c5c4113dSnw 677cd37da74Snw 678cd37da74Snw 679c5c4113dSnw /* 680c5c4113dSnw * Generate and execute SQL statement for LIST RPC calls 681c5c4113dSnw */ 682c5c4113dSnw idmap_retcode 68371590c90Snw process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit, 68448258c6bSjp int flag, list_svc_cb cb, void *result) 685cd37da74Snw { 686c5c4113dSnw list_cb_data_t cb_data; 687c5c4113dSnw char *errmsg = NULL; 68884decf41Sjp int r; 689c5c4113dSnw idmap_retcode retcode = IDMAP_ERR_INTERNAL; 690c5c4113dSnw 691c5c4113dSnw (void) memset(&cb_data, 0, sizeof (cb_data)); 692c5c4113dSnw cb_data.result = result; 693c5c4113dSnw cb_data.limit = limit; 69448258c6bSjp cb_data.flag = flag; 695c5c4113dSnw 69684decf41Sjp 69784decf41Sjp r = sqlite_exec(db, sql, cb, &cb_data, &errmsg); 69884decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 69984decf41Sjp switch (r) { 70084decf41Sjp case SQLITE_OK: 70184decf41Sjp retcode = IDMAP_SUCCESS; 70284decf41Sjp break; 70384decf41Sjp 70484decf41Sjp default: 70584decf41Sjp retcode = IDMAP_ERR_INTERNAL; 70671590c90Snw idmapdlog(LOG_ERR, "Database error on %s while executing " 70771590c90Snw "%s (%s)", dbname, sql, CHECK_NULL(errmsg)); 70884decf41Sjp break; 709c5c4113dSnw } 71062c60062Sbaban if (errmsg != NULL) 711c5c4113dSnw sqlite_freemem(errmsg); 712c5c4113dSnw return (retcode); 713c5c4113dSnw } 714c5c4113dSnw 715c5c4113dSnw /* 716c5c4113dSnw * This routine is called by callbacks that process the results of 717c5c4113dSnw * LIST RPC calls to validate data and to allocate memory for 718c5c4113dSnw * the result array. 719c5c4113dSnw */ 720c5c4113dSnw idmap_retcode 721c5c4113dSnw validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv, 722cd37da74Snw int ncol, uchar_t **list, size_t valsize) 723cd37da74Snw { 724c5c4113dSnw size_t nsize; 725c5c4113dSnw void *tmplist; 726c5c4113dSnw 727c5c4113dSnw if (cb_data->limit > 0 && cb_data->next == cb_data->limit) 728c5c4113dSnw return (IDMAP_NEXT); 729c5c4113dSnw 730c5c4113dSnw if (argc < ncol || argv == NULL) { 731c5c4113dSnw idmapdlog(LOG_ERR, "Invalid data"); 732c5c4113dSnw return (IDMAP_ERR_INTERNAL); 733c5c4113dSnw } 734c5c4113dSnw 735c5c4113dSnw /* alloc in bulk to reduce number of reallocs */ 736c5c4113dSnw if (cb_data->next >= cb_data->len) { 737c5c4113dSnw nsize = (cb_data->len + SIZE_INCR) * valsize; 738c5c4113dSnw tmplist = realloc(*list, nsize); 739c5c4113dSnw if (tmplist == NULL) { 740c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 741c5c4113dSnw return (IDMAP_ERR_MEMORY); 742c5c4113dSnw } 743c5c4113dSnw *list = tmplist; 744c5c4113dSnw (void) memset(*list + (cb_data->len * valsize), 0, 745cd37da74Snw SIZE_INCR * valsize); 746c5c4113dSnw cb_data->len += SIZE_INCR; 747c5c4113dSnw } 748c5c4113dSnw return (IDMAP_SUCCESS); 749c5c4113dSnw } 750c5c4113dSnw 751cd37da74Snw static 752cd37da74Snw idmap_retcode 753c5c4113dSnw get_namerule_order(char *winname, char *windomain, char *unixname, 754cd37da74Snw int direction, int is_diagonal, int *w2u_order, int *u2w_order) 755cd37da74Snw { 756c5c4113dSnw *w2u_order = 0; 757c5c4113dSnw *u2w_order = 0; 758c5c4113dSnw 759c5c4113dSnw /* 760c5c4113dSnw * Windows to UNIX lookup order: 761c5c4113dSnw * 1. winname@domain (or winname) to "" 762c5c4113dSnw * 2. winname@domain (or winname) to unixname 763c5c4113dSnw * 3. winname@* to "" 764c5c4113dSnw * 4. winname@* to unixname 765c5c4113dSnw * 5. *@domain (or *) to * 766c5c4113dSnw * 6. *@domain (or *) to "" 767c5c4113dSnw * 7. *@domain (or *) to unixname 768c5c4113dSnw * 8. *@* to * 769c5c4113dSnw * 9. *@* to "" 770c5c4113dSnw * 10. *@* to unixname 771c5c4113dSnw * 772c5c4113dSnw * winname is a special case of winname@domain when domain is the 773c5c4113dSnw * default domain. Similarly * is a special case of *@domain when 774c5c4113dSnw * domain is the default domain. 775c5c4113dSnw * 776c5c4113dSnw * Note that "" has priority over specific names because "" inhibits 777c5c4113dSnw * mappings and traditionally deny rules always had higher priority. 778c5c4113dSnw */ 779651c0131Sbaban if (direction != IDMAP_DIRECTION_U2W) { 780651c0131Sbaban /* bi-directional or from windows to unix */ 781c5c4113dSnw if (winname == NULL) 782c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 783c5c4113dSnw else if (unixname == NULL) 784c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 785c5c4113dSnw else if (EMPTY_NAME(winname)) 786c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 787c5c4113dSnw else if (*winname == '*' && windomain && *windomain == '*') { 788c5c4113dSnw if (*unixname == '*') 789c5c4113dSnw *w2u_order = 8; 790c5c4113dSnw else if (EMPTY_NAME(unixname)) 791c5c4113dSnw *w2u_order = 9; 792c5c4113dSnw else /* unixname == name */ 793c5c4113dSnw *w2u_order = 10; 794c5c4113dSnw } else if (*winname == '*') { 795c5c4113dSnw if (*unixname == '*') 796c5c4113dSnw *w2u_order = 5; 797c5c4113dSnw else if (EMPTY_NAME(unixname)) 798c5c4113dSnw *w2u_order = 6; 799c5c4113dSnw else /* name */ 800c5c4113dSnw *w2u_order = 7; 80162c60062Sbaban } else if (windomain != NULL && *windomain == '*') { 802c5c4113dSnw /* winname == name */ 803c5c4113dSnw if (*unixname == '*') 804c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 805c5c4113dSnw else if (EMPTY_NAME(unixname)) 806c5c4113dSnw *w2u_order = 3; 807c5c4113dSnw else /* name */ 808c5c4113dSnw *w2u_order = 4; 809c5c4113dSnw } else { 810c5c4113dSnw /* winname == name && windomain == null or name */ 811c5c4113dSnw if (*unixname == '*') 812c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 813c5c4113dSnw else if (EMPTY_NAME(unixname)) 814c5c4113dSnw *w2u_order = 1; 815c5c4113dSnw else /* name */ 816c5c4113dSnw *w2u_order = 2; 817c5c4113dSnw } 818cd37da74Snw 819c5c4113dSnw } 820c5c4113dSnw 821c5c4113dSnw /* 822cd37da74Snw * 1. unixname to "", non-diagonal 823cd37da74Snw * 2. unixname to winname@domain (or winname), non-diagonal 824cd37da74Snw * 3. unixname to "", diagonal 825cd37da74Snw * 4. unixname to winname@domain (or winname), diagonal 826cd37da74Snw * 5. * to *@domain (or *), non-diagonal 827cd37da74Snw * 5. * to *@domain (or *), diagonal 828cd37da74Snw * 7. * to "" 829cd37da74Snw * 8. * to winname@domain (or winname) 830cd37da74Snw * 9. * to "", non-diagonal 831cd37da74Snw * 10. * to winname@domain (or winname), diagonal 832c5c4113dSnw */ 833651c0131Sbaban if (direction != IDMAP_DIRECTION_W2U) { 834cd37da74Snw int diagonal = is_diagonal ? 1 : 0; 835cd37da74Snw 836651c0131Sbaban /* bi-directional or from unix to windows */ 837c5c4113dSnw if (unixname == NULL || EMPTY_NAME(unixname)) 838c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 839c5c4113dSnw else if (winname == NULL) 840c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 84162c60062Sbaban else if (windomain != NULL && *windomain == '*') 842651c0131Sbaban return (IDMAP_ERR_U2W_NAMERULE); 843c5c4113dSnw else if (*unixname == '*') { 844c5c4113dSnw if (*winname == '*') 845cd37da74Snw *u2w_order = 5 + diagonal; 846c5c4113dSnw else if (EMPTY_NAME(winname)) 847cd37da74Snw *u2w_order = 7 + 2 * diagonal; 848c5c4113dSnw else 849cd37da74Snw *u2w_order = 8 + 2 * diagonal; 850c5c4113dSnw } else { 851c5c4113dSnw if (*winname == '*') 852c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 853c5c4113dSnw else if (EMPTY_NAME(winname)) 854cd37da74Snw *u2w_order = 1 + 2 * diagonal; 855c5c4113dSnw else 856cd37da74Snw *u2w_order = 2 + 2 * diagonal; 857c5c4113dSnw } 858c5c4113dSnw } 859c5c4113dSnw return (IDMAP_SUCCESS); 860c5c4113dSnw } 861c5c4113dSnw 862c5c4113dSnw /* 863c5c4113dSnw * Generate and execute SQL statement to add name-based mapping rule 864c5c4113dSnw */ 865c5c4113dSnw idmap_retcode 866cd37da74Snw add_namerule(sqlite *db, idmap_namerule *rule) 867cd37da74Snw { 868c5c4113dSnw char *sql = NULL; 869c5c4113dSnw idmap_stat retcode; 8708e228215Sdm char *dom = NULL; 871c5c4113dSnw int w2u_order, u2w_order; 872c5c4113dSnw char w2ubuf[11], u2wbuf[11]; 873c5c4113dSnw 8748e228215Sdm retcode = get_namerule_order(rule->winname, rule->windomain, 875cd37da74Snw rule->unixname, rule->direction, 876cd37da74Snw rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order); 877c5c4113dSnw if (retcode != IDMAP_SUCCESS) 878c5c4113dSnw goto out; 879c5c4113dSnw 880c5c4113dSnw if (w2u_order) 881c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order); 882c5c4113dSnw if (u2w_order) 883c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order); 884c5c4113dSnw 88562c60062Sbaban /* 88662c60062Sbaban * For the triggers on namerules table to work correctly: 88762c60062Sbaban * 1) Use NULL instead of 0 for w2u_order and u2w_order 88862c60062Sbaban * 2) Use "" instead of NULL for "no domain" 88962c60062Sbaban */ 890c5c4113dSnw 891e8c27ec8Sbaban if (!EMPTY_STRING(rule->windomain)) 8928e228215Sdm dom = rule->windomain; 893cd37da74Snw else if (lookup_wksids_name2sid(rule->winname, NULL, NULL, NULL, NULL) 89462c60062Sbaban == IDMAP_SUCCESS) { 89562c60062Sbaban /* well-known SIDs don't need domain */ 896c5c4113dSnw dom = ""; 89762c60062Sbaban } 89862c60062Sbaban 89962c60062Sbaban RDLOCK_CONFIG(); 90062c60062Sbaban if (dom == NULL) { 901c8e26105Sjp if (_idmapdstate.cfg->pgcfg.default_domain) 902c8e26105Sjp dom = _idmapdstate.cfg->pgcfg.default_domain; 90362c60062Sbaban else 90462c60062Sbaban dom = ""; 90562c60062Sbaban } 90684decf41Sjp sql = sqlite_mprintf("INSERT into namerules " 907cd37da74Snw "(is_user, is_wuser, windomain, winname_display, is_nt4, " 908cd37da74Snw "unixname, w2u_order, u2w_order) " 909cd37da74Snw "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);", 910cd37da74Snw rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom, 911cd37da74Snw rule->winname, rule->is_nt4 ? 1 : 0, rule->unixname, 912cd37da74Snw w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL); 913c5c4113dSnw UNLOCK_CONFIG(); 914c5c4113dSnw 915c5c4113dSnw if (sql == NULL) { 916c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 917c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 918c5c4113dSnw goto out; 919c5c4113dSnw } 920c5c4113dSnw 92171590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 922c5c4113dSnw 923c5c4113dSnw if (retcode == IDMAP_ERR_OTHER) 924c5c4113dSnw retcode = IDMAP_ERR_CFG; 925c5c4113dSnw 926c5c4113dSnw out: 92762c60062Sbaban if (sql != NULL) 928c5c4113dSnw sqlite_freemem(sql); 929c5c4113dSnw return (retcode); 930c5c4113dSnw } 931c5c4113dSnw 932c5c4113dSnw /* 933c5c4113dSnw * Flush name-based mapping rules 934c5c4113dSnw */ 935c5c4113dSnw idmap_retcode 936cd37da74Snw flush_namerules(sqlite *db) 937cd37da74Snw { 938c5c4113dSnw idmap_stat retcode; 939c5c4113dSnw 94071590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;"); 941c5c4113dSnw 942c5c4113dSnw return (retcode); 943c5c4113dSnw } 944c5c4113dSnw 945c5c4113dSnw /* 946c5c4113dSnw * Generate and execute SQL statement to remove a name-based mapping rule 947c5c4113dSnw */ 948c5c4113dSnw idmap_retcode 949cd37da74Snw rm_namerule(sqlite *db, idmap_namerule *rule) 950cd37da74Snw { 951c5c4113dSnw char *sql = NULL; 952c5c4113dSnw idmap_stat retcode; 953c5c4113dSnw char buf[80]; 954cd37da74Snw char *expr = NULL; 955c5c4113dSnw 9568e228215Sdm if (rule->direction < 0 && EMPTY_STRING(rule->windomain) && 9578e228215Sdm EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname)) 958c5c4113dSnw return (IDMAP_SUCCESS); 959c5c4113dSnw 960cd37da74Snw buf[0] = 0; 961cd37da74Snw 962cd37da74Snw if (rule->direction == IDMAP_DIRECTION_BI) 963c5c4113dSnw (void) snprintf(buf, sizeof (buf), "AND w2u_order > 0" 964cd37da74Snw " AND u2w_order > 0"); 965cd37da74Snw else if (rule->direction == IDMAP_DIRECTION_W2U) 966c5c4113dSnw (void) snprintf(buf, sizeof (buf), "AND w2u_order > 0" 967cd37da74Snw " AND (u2w_order = 0 OR u2w_order ISNULL)"); 968cd37da74Snw else if (rule->direction == IDMAP_DIRECTION_U2W) 969c5c4113dSnw (void) snprintf(buf, sizeof (buf), "AND u2w_order > 0" 970cd37da74Snw " AND (w2u_order = 0 OR w2u_order ISNULL)"); 971c5c4113dSnw 972cd37da74Snw retcode = gen_sql_expr_from_rule(rule, &expr); 973cd37da74Snw if (retcode != IDMAP_SUCCESS) 974cd37da74Snw goto out; 975c5c4113dSnw 976cd37da74Snw sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s %s;", expr, 977cd37da74Snw buf); 978c5c4113dSnw 979c5c4113dSnw if (sql == NULL) { 980c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 981c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 982c5c4113dSnw goto out; 983c5c4113dSnw } 984c5c4113dSnw 985cd37da74Snw 98671590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 987c5c4113dSnw 988c5c4113dSnw out: 989cd37da74Snw if (expr != NULL) 990cd37da74Snw sqlite_freemem(expr); 99162c60062Sbaban if (sql != NULL) 992c5c4113dSnw sqlite_freemem(sql); 993c5c4113dSnw return (retcode); 994c5c4113dSnw } 995c5c4113dSnw 996c5c4113dSnw /* 997c5c4113dSnw * Compile the given SQL query and step just once. 998c5c4113dSnw * 999c5c4113dSnw * Input: 1000c5c4113dSnw * db - db handle 1001c5c4113dSnw * sql - SQL statement 1002c5c4113dSnw * 1003c5c4113dSnw * Output: 1004c5c4113dSnw * vm - virtual SQL machine 1005c5c4113dSnw * ncol - number of columns in the result 1006c5c4113dSnw * values - column values 1007c5c4113dSnw * 1008c5c4113dSnw * Return values: 1009c5c4113dSnw * IDMAP_SUCCESS 1010c5c4113dSnw * IDMAP_ERR_NOTFOUND 1011c5c4113dSnw * IDMAP_ERR_INTERNAL 1012c5c4113dSnw */ 1013c5c4113dSnw 1014cd37da74Snw static 1015cd37da74Snw idmap_retcode 1016c5c4113dSnw sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol, 1017cd37da74Snw int reqcol, const char ***values) 1018cd37da74Snw { 1019c5c4113dSnw char *errmsg = NULL; 102084decf41Sjp int r; 1021c5c4113dSnw 102284decf41Sjp if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) { 1023cd37da74Snw idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1024cd37da74Snw CHECK_NULL(errmsg)); 1025c5c4113dSnw sqlite_freemem(errmsg); 1026c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1027c5c4113dSnw } 1028c5c4113dSnw 102984decf41Sjp r = sqlite_step(*vm, ncol, values, NULL); 103084decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 1031c5c4113dSnw 103284decf41Sjp if (r == SQLITE_ROW) { 103362c60062Sbaban if (ncol != NULL && *ncol < reqcol) { 1034c5c4113dSnw (void) sqlite_finalize(*vm, NULL); 1035c5c4113dSnw *vm = NULL; 1036c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1037c5c4113dSnw } 1038c5c4113dSnw /* Caller will call finalize after using the results */ 1039c5c4113dSnw return (IDMAP_SUCCESS); 1040c5c4113dSnw } else if (r == SQLITE_DONE) { 1041c5c4113dSnw (void) sqlite_finalize(*vm, NULL); 1042c5c4113dSnw *vm = NULL; 1043c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 1044c5c4113dSnw } 1045c5c4113dSnw 1046c5c4113dSnw (void) sqlite_finalize(*vm, &errmsg); 1047c5c4113dSnw *vm = NULL; 1048cd37da74Snw idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1049cd37da74Snw CHECK_NULL(errmsg)); 1050c5c4113dSnw sqlite_freemem(errmsg); 1051c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1052c5c4113dSnw } 1053c5c4113dSnw 1054e8c27ec8Sbaban /* 1055479ac375Sdm * Load config in the state. 1056e8c27ec8Sbaban * 1057479ac375Sdm * nm_siduid and nm_sidgid fields: 1058e8c27ec8Sbaban * state->nm_siduid represents mode used by sid2uid and uid2sid 1059e8c27ec8Sbaban * requests for directory-based name mappings. Similarly, 1060e8c27ec8Sbaban * state->nm_sidgid represents mode used by sid2gid and gid2sid 1061e8c27ec8Sbaban * requests. 1062e8c27ec8Sbaban * 1063e8c27ec8Sbaban * sid2uid/uid2sid: 1064e8c27ec8Sbaban * none -> ds_name_mapping_enabled != true 1065e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixuser_attr 1066e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr 1067e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixuser_attr 1068e8c27ec8Sbaban * 1069e8c27ec8Sbaban * sid2gid/gid2sid: 1070e8c27ec8Sbaban * none -> ds_name_mapping_enabled != true 1071e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixgroup_attr 1072e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr 1073e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr 1074e8c27ec8Sbaban */ 1075e8c27ec8Sbaban idmap_retcode 1076479ac375Sdm load_cfg_in_state(lookup_state_t *state) 1077e8c27ec8Sbaban { 1078e8c27ec8Sbaban state->nm_siduid = IDMAP_NM_NONE; 1079e8c27ec8Sbaban state->nm_sidgid = IDMAP_NM_NONE; 1080e8c27ec8Sbaban RDLOCK_CONFIG(); 1081479ac375Sdm 10824aa0a5e7Snw state->eph_map_unres_sids = 0; 10834aa0a5e7Snw if (_idmapdstate.cfg->pgcfg.eph_map_unres_sids) 10844aa0a5e7Snw state->eph_map_unres_sids = 1; 10854aa0a5e7Snw 1086479ac375Sdm if (_idmapdstate.cfg->pgcfg.default_domain != NULL) { 1087479ac375Sdm state->defdom = 1088479ac375Sdm strdup(_idmapdstate.cfg->pgcfg.default_domain); 1089479ac375Sdm if (state->defdom == NULL) { 1090479ac375Sdm UNLOCK_CONFIG(); 1091479ac375Sdm return (IDMAP_ERR_MEMORY); 1092479ac375Sdm } 1093479ac375Sdm } else { 1094479ac375Sdm UNLOCK_CONFIG(); 1095dc03a638Sdm return (IDMAP_SUCCESS); 1096479ac375Sdm } 10977a8a68f5SJulian Pullen if (!_idmapdstate.cfg->pgcfg.ds_name_mapping_enabled) { 1098e8c27ec8Sbaban UNLOCK_CONFIG(); 1099e8c27ec8Sbaban return (IDMAP_SUCCESS); 1100e8c27ec8Sbaban } 1101e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1102e8c27ec8Sbaban state->nm_siduid = 1103e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1104e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1105e8c27ec8Sbaban state->nm_sidgid = 1106e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1107e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1108e8c27ec8Sbaban } else { 1109e8c27ec8Sbaban state->nm_siduid = 1110e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1111e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE; 1112e8c27ec8Sbaban state->nm_sidgid = 1113e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1114e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE; 1115e8c27ec8Sbaban } 1116e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) { 1117e8c27ec8Sbaban state->ad_unixuser_attr = 1118e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr); 1119e8c27ec8Sbaban if (state->ad_unixuser_attr == NULL) { 1120e8c27ec8Sbaban UNLOCK_CONFIG(); 1121e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1122e8c27ec8Sbaban } 1123e8c27ec8Sbaban } 1124e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) { 1125e8c27ec8Sbaban state->ad_unixgroup_attr = 1126e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr); 1127e8c27ec8Sbaban if (state->ad_unixgroup_attr == NULL) { 1128e8c27ec8Sbaban UNLOCK_CONFIG(); 1129e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1130e8c27ec8Sbaban } 1131e8c27ec8Sbaban } 1132479ac375Sdm if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1133479ac375Sdm state->nldap_winname_attr = 1134479ac375Sdm strdup(_idmapdstate.cfg->pgcfg.nldap_winname_attr); 1135479ac375Sdm if (state->nldap_winname_attr == NULL) { 1136479ac375Sdm UNLOCK_CONFIG(); 1137479ac375Sdm return (IDMAP_ERR_MEMORY); 1138479ac375Sdm } 1139479ac375Sdm } 1140e8c27ec8Sbaban UNLOCK_CONFIG(); 1141e8c27ec8Sbaban return (IDMAP_SUCCESS); 1142e8c27ec8Sbaban } 1143e8c27ec8Sbaban 114448258c6bSjp /* 114548258c6bSjp * Set the rule with sepecified values. 114648258c6bSjp * All the strings are copied. 114748258c6bSjp */ 114848258c6bSjp static void 114948258c6bSjp idmap_namerule_set(idmap_namerule *rule, const char *windomain, 115048258c6bSjp const char *winname, const char *unixname, boolean_t is_user, 115148258c6bSjp boolean_t is_wuser, boolean_t is_nt4, int direction) 115248258c6bSjp { 115348258c6bSjp /* 115448258c6bSjp * Only update if they differ because we have to free 115548258c6bSjp * and duplicate the strings 115648258c6bSjp */ 115748258c6bSjp if (rule->windomain == NULL || windomain == NULL || 115848258c6bSjp strcmp(rule->windomain, windomain) != 0) { 115948258c6bSjp if (rule->windomain != NULL) { 116048258c6bSjp free(rule->windomain); 116148258c6bSjp rule->windomain = NULL; 116248258c6bSjp } 116348258c6bSjp if (windomain != NULL) 116448258c6bSjp rule->windomain = strdup(windomain); 116548258c6bSjp } 116648258c6bSjp 116748258c6bSjp if (rule->winname == NULL || winname == NULL || 116848258c6bSjp strcmp(rule->winname, winname) != 0) { 116948258c6bSjp if (rule->winname != NULL) { 117048258c6bSjp free(rule->winname); 117148258c6bSjp rule->winname = NULL; 117248258c6bSjp } 117348258c6bSjp if (winname != NULL) 117448258c6bSjp rule->winname = strdup(winname); 117548258c6bSjp } 117648258c6bSjp 117748258c6bSjp if (rule->unixname == NULL || unixname == NULL || 117848258c6bSjp strcmp(rule->unixname, unixname) != 0) { 117948258c6bSjp if (rule->unixname != NULL) { 118048258c6bSjp free(rule->unixname); 118148258c6bSjp rule->unixname = NULL; 118248258c6bSjp } 118348258c6bSjp if (unixname != NULL) 118448258c6bSjp rule->unixname = strdup(unixname); 118548258c6bSjp } 118648258c6bSjp 118748258c6bSjp rule->is_user = is_user; 118848258c6bSjp rule->is_wuser = is_wuser; 118948258c6bSjp rule->is_nt4 = is_nt4; 119048258c6bSjp rule->direction = direction; 119148258c6bSjp } 119248258c6bSjp 119348258c6bSjp 119462c60062Sbaban /* 119562c60062Sbaban * Table for well-known SIDs. 119662c60062Sbaban * 119762c60062Sbaban * Background: 119862c60062Sbaban * 119976b27f93Sbaban * Some of the well-known principals are stored under: 120062c60062Sbaban * cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain> 120162c60062Sbaban * They belong to objectClass "foreignSecurityPrincipal". They don't have 120262c60062Sbaban * "samAccountName" nor "userPrincipalName" attributes. Their names are 120362c60062Sbaban * available in "cn" and "name" attributes. Some of these principals have a 120462c60062Sbaban * second entry under CN=ForeignSecurityPrincipals,dc=<forestRootDomain> and 120562c60062Sbaban * these duplicate entries have the stringified SID in the "name" and "cn" 120662c60062Sbaban * attributes instead of the actual name. 120762c60062Sbaban * 120876b27f93Sbaban * Those of the form S-1-5-32-X are Builtin groups and are stored in the 120976b27f93Sbaban * cn=builtin container (except, Power Users which is not stored in AD) 121062c60062Sbaban * 121176b27f93Sbaban * These principals are and will remain constant. Therefore doing AD lookups 121276b27f93Sbaban * provides no benefit. Also, using hard-coded table (and thus avoiding AD 121376b27f93Sbaban * lookup) improves performance and avoids additional complexity in the 121476b27f93Sbaban * adutils.c code. Moreover these SIDs can be used when no Active Directory 121576b27f93Sbaban * is available (such as the CIFS server's "workgroup" mode). 121676b27f93Sbaban * 121776b27f93Sbaban * Notes: 121876b27f93Sbaban * 1. Currently we don't support localization of well-known SID names, 121962c60062Sbaban * unlike Windows. 122062c60062Sbaban * 122176b27f93Sbaban * 2. Other well-known SIDs i.e. S-1-5-<domain>-<w-k RID> are not stored 122276b27f93Sbaban * here. AD does have normal user/group objects for these objects and 122376b27f93Sbaban * can be looked up using the existing AD lookup code. 1224e8c27ec8Sbaban * 1225e8c27ec8Sbaban * 3. See comments above lookup_wksids_sid2pid() for more information 1226e8c27ec8Sbaban * on how we lookup the wksids table. 122762c60062Sbaban */ 122862c60062Sbaban static wksids_table_t wksids[] = { 1229e8c27ec8Sbaban {"S-1-0", 0, "Nobody", 0, SENTINEL_PID, -1, 1}, 1230e8c27ec8Sbaban {"S-1-1", 0, "Everyone", 0, SENTINEL_PID, -1, -1}, 1231e8c27ec8Sbaban {"S-1-3", 0, "Creator Owner", 1, IDMAP_WK_CREATOR_OWNER_UID, 1, 0}, 1232e8c27ec8Sbaban {"S-1-3", 1, "Creator Group", 0, IDMAP_WK_CREATOR_GROUP_GID, 0, 0}, 1233e8c27ec8Sbaban {"S-1-3", 2, "Creator Owner Server", 1, SENTINEL_PID, -1, -1}, 1234e8c27ec8Sbaban {"S-1-3", 3, "Creator Group Server", 0, SENTINEL_PID, -1, 1}, 1235e8c27ec8Sbaban {"S-1-3", 4, "Owner Rights", 0, SENTINEL_PID, -1, -1}, 1236e8c27ec8Sbaban {"S-1-5", 1, "Dialup", 0, SENTINEL_PID, -1, -1}, 1237e8c27ec8Sbaban {"S-1-5", 2, "Network", 0, SENTINEL_PID, -1, -1}, 1238e8c27ec8Sbaban {"S-1-5", 3, "Batch", 0, SENTINEL_PID, -1, -1}, 1239e8c27ec8Sbaban {"S-1-5", 4, "Interactive", 0, SENTINEL_PID, -1, -1}, 1240e8c27ec8Sbaban {"S-1-5", 6, "Service", 0, SENTINEL_PID, -1, -1}, 1241e8c27ec8Sbaban {"S-1-5", 7, "Anonymous Logon", 0, GID_NOBODY, 0, 0}, 1242e8c27ec8Sbaban {"S-1-5", 7, "Anonymous Logon", 0, UID_NOBODY, 1, 0}, 1243e8c27ec8Sbaban {"S-1-5", 8, "Proxy", 0, SENTINEL_PID, -1, -1}, 1244e8c27ec8Sbaban {"S-1-5", 9, "Enterprise Domain Controllers", 0, SENTINEL_PID, -1, -1}, 1245e8c27ec8Sbaban {"S-1-5", 10, "Self", 0, SENTINEL_PID, -1, -1}, 1246e8c27ec8Sbaban {"S-1-5", 11, "Authenticated Users", 0, SENTINEL_PID, -1, -1}, 1247e8c27ec8Sbaban {"S-1-5", 12, "Restricted Code", 0, SENTINEL_PID, -1, -1}, 1248e8c27ec8Sbaban {"S-1-5", 13, "Terminal Server User", 0, SENTINEL_PID, -1, -1}, 1249e8c27ec8Sbaban {"S-1-5", 14, "Remote Interactive Logon", 0, SENTINEL_PID, -1, -1}, 1250e8c27ec8Sbaban {"S-1-5", 15, "This Organization", 0, SENTINEL_PID, -1, -1}, 1251e8c27ec8Sbaban {"S-1-5", 17, "IUSR", 0, SENTINEL_PID, -1, -1}, 1252e8c27ec8Sbaban {"S-1-5", 18, "Local System", 0, IDMAP_WK_LOCAL_SYSTEM_GID, 0, 0}, 1253e8c27ec8Sbaban {"S-1-5", 19, "Local Service", 0, SENTINEL_PID, -1, -1}, 1254e8c27ec8Sbaban {"S-1-5", 20, "Network Service", 0, SENTINEL_PID, -1, -1}, 1255e8c27ec8Sbaban {"S-1-5", 1000, "Other Organization", 0, SENTINEL_PID, -1, -1}, 1256e8c27ec8Sbaban {"S-1-5-32", 544, "Administrators", 0, SENTINEL_PID, -1, -1}, 1257e8c27ec8Sbaban {"S-1-5-32", 545, "Users", 0, SENTINEL_PID, -1, -1}, 1258e8c27ec8Sbaban {"S-1-5-32", 546, "Guests", 0, SENTINEL_PID, -1, -1}, 1259e8c27ec8Sbaban {"S-1-5-32", 547, "Power Users", 0, SENTINEL_PID, -1, -1}, 1260e8c27ec8Sbaban {"S-1-5-32", 548, "Account Operators", 0, SENTINEL_PID, -1, -1}, 1261e8c27ec8Sbaban {"S-1-5-32", 549, "Server Operators", 0, SENTINEL_PID, -1, -1}, 1262e8c27ec8Sbaban {"S-1-5-32", 550, "Print Operators", 0, SENTINEL_PID, -1, -1}, 1263e8c27ec8Sbaban {"S-1-5-32", 551, "Backup Operators", 0, SENTINEL_PID, -1, -1}, 1264e8c27ec8Sbaban {"S-1-5-32", 552, "Replicator", 0, SENTINEL_PID, -1, -1}, 126576b27f93Sbaban {"S-1-5-32", 554, "Pre-Windows 2000 Compatible Access", 0, 1266e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 1267e8c27ec8Sbaban {"S-1-5-32", 555, "Remote Desktop Users", 0, SENTINEL_PID, -1, -1}, 126876b27f93Sbaban {"S-1-5-32", 556, "Network Configuration Operators", 0, 1269e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 127076b27f93Sbaban {"S-1-5-32", 557, "Incoming Forest Trust Builders", 0, 1271e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 1272e8c27ec8Sbaban {"S-1-5-32", 558, "Performance Monitor Users", 0, SENTINEL_PID, -1, -1}, 1273e8c27ec8Sbaban {"S-1-5-32", 559, "Performance Log Users", 0, SENTINEL_PID, -1, -1}, 127476b27f93Sbaban {"S-1-5-32", 560, "Windows Authorization Access Group", 0, 1275e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 127676b27f93Sbaban {"S-1-5-32", 561, "Terminal Server License Servers", 0, 1277e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 1278e8c27ec8Sbaban {"S-1-5-32", 561, "Distributed COM Users", 0, SENTINEL_PID, -1, -1}, 1279e8c27ec8Sbaban {"S-1-5-32", 568, "IIS_IUSRS", 0, SENTINEL_PID, -1, -1}, 1280e8c27ec8Sbaban {"S-1-5-32", 569, "Cryptographic Operators", 0, SENTINEL_PID, -1, -1}, 1281e8c27ec8Sbaban {"S-1-5-32", 573, "Event Log Readers", 0, SENTINEL_PID, -1, -1}, 128276b27f93Sbaban {"S-1-5-32", 574, "Certificate Service DCOM Access", 0, 1283e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 1284e8c27ec8Sbaban {"S-1-5-64", 21, "Digest Authentication", 0, SENTINEL_PID, -1, -1}, 1285e8c27ec8Sbaban {"S-1-5-64", 10, "NTLM Authentication", 0, SENTINEL_PID, -1, -1}, 1286e8c27ec8Sbaban {"S-1-5-64", 14, "SChannel Authentication", 0, SENTINEL_PID, -1, -1}, 1287e8c27ec8Sbaban {NULL, UINT32_MAX, NULL, -1, SENTINEL_PID, -1, -1} 1288c5c4113dSnw }; 1289c5c4113dSnw 1290e8c27ec8Sbaban /* 1291e8c27ec8Sbaban * Lookup well-known SIDs table either by winname or by SID. 1292e8c27ec8Sbaban * If the given winname or SID is a well-known SID then we set wksid 1293e8c27ec8Sbaban * variable and then proceed to see if the SID has a hard mapping to 1294e8c27ec8Sbaban * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to 1295e8c27ec8Sbaban * fixed ephemeral ids). If we find such mapping then we return 1296e8c27ec8Sbaban * success otherwise notfound. If a well-known SID is mapped to 1297e8c27ec8Sbaban * SENTINEL_PID and the direction field is set (bi-directional or 1298e8c27ec8Sbaban * win2unix) then we treat it as inhibited mapping and return no 1299e8c27ec8Sbaban * mapping (Ex. S-1-0-0). 1300e8c27ec8Sbaban */ 1301cd37da74Snw static 1302cd37da74Snw idmap_retcode 1303e8c27ec8Sbaban lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *wksid) 1304cd37da74Snw { 1305c5c4113dSnw int i; 130662c60062Sbaban 1307e8c27ec8Sbaban *wksid = 0; 130862c60062Sbaban 1309e8c27ec8Sbaban for (i = 0; wksids[i].sidprefix != NULL; i++) { 1310e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 1311e8c27ec8Sbaban if ((strcasecmp(wksids[i].sidprefix, 1312e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix) != 0) || 1313e8c27ec8Sbaban wksids[i].rid != req->id1.idmap_id_u.sid.rid) 1314e8c27ec8Sbaban /* this is not our SID */ 1315e8c27ec8Sbaban continue; 1316e8c27ec8Sbaban if (req->id1name == NULL) { 1317e8c27ec8Sbaban req->id1name = strdup(wksids[i].winname); 1318e8c27ec8Sbaban if (req->id1name == NULL) 1319e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1320c5c4113dSnw } 1321e8c27ec8Sbaban } else if (req->id1name != NULL) { 1322e8c27ec8Sbaban if (strcasecmp(wksids[i].winname, req->id1name) != 0) 1323e8c27ec8Sbaban /* this is not our winname */ 1324e8c27ec8Sbaban continue; 1325e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = 1326e8c27ec8Sbaban strdup(wksids[i].sidprefix); 1327e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL) 1328e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1329e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid = wksids[i].rid; 1330e8c27ec8Sbaban } 1331e8c27ec8Sbaban 1332e8c27ec8Sbaban *wksid = 1; 1333e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 1334e8c27ec8Sbaban 1335e8c27ec8Sbaban req->id1.idtype = (wksids[i].is_wuser) ? 1336e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 1337e8c27ec8Sbaban 1338e8c27ec8Sbaban if (wksids[i].pid == SENTINEL_PID) { 1339e8c27ec8Sbaban if (wksids[i].direction == IDMAP_DIRECTION_BI || 1340e8c27ec8Sbaban wksids[i].direction == IDMAP_DIRECTION_W2U) 1341e8c27ec8Sbaban /* Inhibited */ 1342e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 1343e8c27ec8Sbaban /* Not mapped */ 1344479ac375Sdm if (res->id.idtype == IDMAP_POSIXID) { 1345479ac375Sdm res->id.idtype = 1346479ac375Sdm (wksids[i].is_wuser) ? 1347479ac375Sdm IDMAP_UID : IDMAP_GID; 1348479ac375Sdm } 1349e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 1350e8c27ec8Sbaban } else if (wksids[i].direction == IDMAP_DIRECTION_U2W) 1351e8c27ec8Sbaban continue; 1352e8c27ec8Sbaban 1353e8c27ec8Sbaban switch (res->id.idtype) { 1354e8c27ec8Sbaban case IDMAP_UID: 1355e8c27ec8Sbaban if (wksids[i].is_user == 0) 1356e8c27ec8Sbaban continue; 1357e8c27ec8Sbaban res->id.idmap_id_u.uid = wksids[i].pid; 1358e8c27ec8Sbaban res->direction = wksids[i].direction; 1359fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID; 1360fc724630SAlan Wright res->info.src = IDMAP_MAP_SRC_HARD_CODED; 1361e8c27ec8Sbaban return (IDMAP_SUCCESS); 1362e8c27ec8Sbaban case IDMAP_GID: 1363e8c27ec8Sbaban if (wksids[i].is_user == 1) 1364e8c27ec8Sbaban continue; 1365e8c27ec8Sbaban res->id.idmap_id_u.gid = wksids[i].pid; 1366e8c27ec8Sbaban res->direction = wksids[i].direction; 1367fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID; 1368fc724630SAlan Wright res->info.src = IDMAP_MAP_SRC_HARD_CODED; 1369e8c27ec8Sbaban return (IDMAP_SUCCESS); 1370e8c27ec8Sbaban case IDMAP_POSIXID: 1371e8c27ec8Sbaban res->id.idmap_id_u.uid = wksids[i].pid; 1372e8c27ec8Sbaban res->id.idtype = (!wksids[i].is_user) ? 1373e8c27ec8Sbaban IDMAP_GID : IDMAP_UID; 1374e8c27ec8Sbaban res->direction = wksids[i].direction; 1375fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID; 1376fc724630SAlan Wright res->info.src = IDMAP_MAP_SRC_HARD_CODED; 1377e8c27ec8Sbaban return (IDMAP_SUCCESS); 1378e8c27ec8Sbaban default: 1379e8c27ec8Sbaban return (IDMAP_ERR_NOTSUPPORTED); 1380c5c4113dSnw } 1381c5c4113dSnw } 1382c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 1383c5c4113dSnw } 1384c5c4113dSnw 1385cd37da74Snw 1386cd37da74Snw static 1387cd37da74Snw idmap_retcode 1388cd37da74Snw lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user) 1389cd37da74Snw { 1390c5c4113dSnw int i; 1391e8c27ec8Sbaban if (req->id1.idmap_id_u.uid == SENTINEL_PID) 1392e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 139362c60062Sbaban for (i = 0; wksids[i].sidprefix != NULL; i++) { 139462c60062Sbaban if (wksids[i].pid == req->id1.idmap_id_u.uid && 139562c60062Sbaban wksids[i].is_user == is_user && 139662c60062Sbaban wksids[i].direction != IDMAP_DIRECTION_W2U) { 1397e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) { 1398e8c27ec8Sbaban res->id.idtype = (wksids[i].is_wuser) ? 1399e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 1400e8c27ec8Sbaban } 140162c60062Sbaban res->id.idmap_id_u.sid.rid = wksids[i].rid; 140262c60062Sbaban res->id.idmap_id_u.sid.prefix = 1403cd37da74Snw strdup(wksids[i].sidprefix); 140462c60062Sbaban if (res->id.idmap_id_u.sid.prefix == NULL) { 140562c60062Sbaban idmapdlog(LOG_ERR, "Out of memory"); 140662c60062Sbaban return (IDMAP_ERR_MEMORY); 140762c60062Sbaban } 140862c60062Sbaban res->direction = wksids[i].direction; 1409fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID; 1410fc724630SAlan Wright res->info.src = IDMAP_MAP_SRC_HARD_CODED; 141162c60062Sbaban return (IDMAP_SUCCESS); 141262c60062Sbaban } 141362c60062Sbaban } 141462c60062Sbaban return (IDMAP_ERR_NOTFOUND); 141562c60062Sbaban } 141662c60062Sbaban 1417cd37da74Snw idmap_retcode 1418cd37da74Snw lookup_wksids_name2sid(const char *name, char **canonname, char **sidprefix, 1419cd37da74Snw idmap_rid_t *rid, int *type) 1420cd37da74Snw { 1421479ac375Sdm int i; 1422479ac375Sdm 1423479ac375Sdm if ((strncasecmp(name, "BUILTIN\\", 8) == 0) || 1424479ac375Sdm (strncasecmp(name, "BUILTIN/", 8) == 0)) 1425479ac375Sdm name += 8; 1426479ac375Sdm 142762c60062Sbaban for (i = 0; wksids[i].sidprefix != NULL; i++) { 1428e8c27ec8Sbaban if (strcasecmp(wksids[i].winname, name) != 0) 1429e8c27ec8Sbaban continue; 1430e8c27ec8Sbaban if (sidprefix != NULL && 1431e8c27ec8Sbaban (*sidprefix = strdup(wksids[i].sidprefix)) == NULL) { 1432e8c27ec8Sbaban idmapdlog(LOG_ERR, "Out of memory"); 1433e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1434e8c27ec8Sbaban } 1435e8c27ec8Sbaban if (canonname != NULL && 1436e8c27ec8Sbaban (*canonname = strdup(wksids[i].winname)) == NULL) { 1437e8c27ec8Sbaban idmapdlog(LOG_ERR, "Out of memory"); 1438e8c27ec8Sbaban if (sidprefix != NULL) { 1439e8c27ec8Sbaban free(*sidprefix); 1440e8c27ec8Sbaban *sidprefix = NULL; 1441cd37da74Snw } 1442e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1443c5c4113dSnw } 1444e8c27ec8Sbaban if (type != NULL) 1445e8c27ec8Sbaban *type = (wksids[i].is_wuser) ? 1446e8c27ec8Sbaban _IDMAP_T_USER : _IDMAP_T_GROUP; 1447e8c27ec8Sbaban if (rid != NULL) 1448e8c27ec8Sbaban *rid = wksids[i].rid; 1449e8c27ec8Sbaban return (IDMAP_SUCCESS); 1450c5c4113dSnw } 1451c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 1452c5c4113dSnw } 1453c5c4113dSnw 1454cd37da74Snw static 1455cd37da74Snw idmap_retcode 1456cd37da74Snw lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1457cd37da74Snw { 1458c5c4113dSnw char *end; 1459c5c4113dSnw char *sql = NULL; 1460c5c4113dSnw const char **values; 1461c5c4113dSnw sqlite_vm *vm = NULL; 1462c5c4113dSnw int ncol, is_user; 1463c5c4113dSnw uid_t pid; 1464c5c4113dSnw time_t curtime, exp; 1465c5c4113dSnw idmap_retcode retcode; 1466042addd6Sbaban char *is_user_string, *lower_name; 1467c5c4113dSnw 1468c5c4113dSnw /* Current time */ 1469c5c4113dSnw errno = 0; 1470c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 1471cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1472cd37da74Snw strerror(errno)); 1473c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 1474c5c4113dSnw goto out; 1475c5c4113dSnw } 1476c5c4113dSnw 1477e8c27ec8Sbaban switch (res->id.idtype) { 1478cd37da74Snw case IDMAP_UID: 1479cd37da74Snw is_user_string = "1"; 1480cd37da74Snw break; 1481cd37da74Snw case IDMAP_GID: 1482cd37da74Snw is_user_string = "0"; 1483cd37da74Snw break; 1484cd37da74Snw case IDMAP_POSIXID: 1485cd37da74Snw /* the non-diagonal mapping */ 1486cd37da74Snw is_user_string = "is_wuser"; 1487cd37da74Snw break; 1488cd37da74Snw default: 1489cd37da74Snw retcode = IDMAP_ERR_NOTSUPPORTED; 1490cd37da74Snw goto out; 1491cd37da74Snw } 1492cd37da74Snw 1493c5c4113dSnw /* SQL to lookup the cache */ 149448258c6bSjp 1495e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 1496e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 149748258c6bSjp "unixname, u2w, is_wuser, " 149848258c6bSjp "map_type, map_dn, map_attr, map_value, " 149948258c6bSjp "map_windomain, map_winname, map_unixname, map_is_nt4 " 1500e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND " 1501e8c27ec8Sbaban "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 1502e8c27ec8Sbaban "(pid >= 2147483648 OR " 1503e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 1504e8c27ec8Sbaban "expiration > %d));", 1505e8c27ec8Sbaban is_user_string, req->id1.idmap_id_u.sid.prefix, 1506e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, curtime); 1507e8c27ec8Sbaban } else if (req->id1name != NULL) { 1508042addd6Sbaban if ((lower_name = tolower_u8(req->id1name)) == NULL) 1509042addd6Sbaban lower_name = req->id1name; 1510e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 151148258c6bSjp "unixname, u2w, is_wuser, " 151248258c6bSjp "map_type, map_dn, map_attr, map_value, " 151348258c6bSjp "map_windomain, map_winname, map_unixname, map_is_nt4 " 1514e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND " 1515e8c27ec8Sbaban "winname = %Q AND windomain = %Q AND w2u = 1 AND " 1516e8c27ec8Sbaban "(pid >= 2147483648 OR " 1517e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 1518e8c27ec8Sbaban "expiration > %d));", 151948258c6bSjp is_user_string, lower_name, req->id1domain, 152048258c6bSjp curtime); 1521042addd6Sbaban if (lower_name != req->id1name) 1522042addd6Sbaban free(lower_name); 1523e8c27ec8Sbaban } else { 1524e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 1525e8c27ec8Sbaban goto out; 1526e8c27ec8Sbaban } 1527c5c4113dSnw if (sql == NULL) { 1528c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1529c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1530c5c4113dSnw goto out; 1531c5c4113dSnw } 153248258c6bSjp retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 153348258c6bSjp 14, &values); 1534c5c4113dSnw sqlite_freemem(sql); 1535c5c4113dSnw 1536c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) { 1537c5c4113dSnw goto out; 1538c5c4113dSnw } else if (retcode == IDMAP_SUCCESS) { 1539c5c4113dSnw /* sanity checks */ 1540c5c4113dSnw if (values[0] == NULL || values[1] == NULL) { 1541c5c4113dSnw retcode = IDMAP_ERR_CACHE; 1542c5c4113dSnw goto out; 1543c5c4113dSnw } 1544c5c4113dSnw 1545c5c4113dSnw pid = strtoul(values[0], &end, 10); 1546e8c27ec8Sbaban is_user = strncmp(values[1], "0", 2) ? 1 : 0; 1547c5c4113dSnw 1548cd37da74Snw if (is_user) { 1549cd37da74Snw res->id.idtype = IDMAP_UID; 1550cd37da74Snw res->id.idmap_id_u.uid = pid; 1551cd37da74Snw } else { 1552cd37da74Snw res->id.idtype = IDMAP_GID; 1553cd37da74Snw res->id.idmap_id_u.gid = pid; 1554cd37da74Snw } 1555cd37da74Snw 1556c5c4113dSnw /* 1557c5c4113dSnw * We may have an expired ephemeral mapping. Consider 1558c5c4113dSnw * the expired entry as valid if we are not going to 1559c5c4113dSnw * perform name-based mapping. But do not renew the 1560c5c4113dSnw * expiration. 1561c5c4113dSnw * If we will be doing name-based mapping then store the 1562c5c4113dSnw * ephemeral pid in the result so that we can use it 1563c5c4113dSnw * if we end up doing dynamic mapping again. 1564c5c4113dSnw */ 1565c5c4113dSnw if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) && 1566cd37da74Snw !AVOID_NAMESERVICE(req) && 1567cd37da74Snw IS_EPHEMERAL(pid) && values[2] != NULL) { 1568cd37da74Snw exp = strtoll(values[2], &end, 10); 1569cd37da74Snw if (exp && exp <= curtime) { 1570cd37da74Snw /* Store the ephemeral pid */ 1571cd37da74Snw res->direction = IDMAP_DIRECTION_BI; 1572cd37da74Snw req->direction |= is_user 1573cd37da74Snw ? _IDMAP_F_EXP_EPH_UID 1574cd37da74Snw : _IDMAP_F_EXP_EPH_GID; 1575cd37da74Snw retcode = IDMAP_ERR_NOTFOUND; 1576c5c4113dSnw } 1577c5c4113dSnw } 1578c5c4113dSnw } 1579c5c4113dSnw 1580c5c4113dSnw out: 1581c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 158262c60062Sbaban if (values[4] != NULL) 1583c5c4113dSnw res->direction = 1584651c0131Sbaban (strtol(values[4], &end, 10) == 0)? 1585651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 1586c5c4113dSnw else 1587651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U; 1588c5c4113dSnw 158962c60062Sbaban if (values[3] != NULL) { 1590e8c27ec8Sbaban if (req->id2name != NULL) 1591e8c27ec8Sbaban free(req->id2name); 15928e228215Sdm req->id2name = strdup(values[3]); 15938e228215Sdm if (req->id2name == NULL) { 1594c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1595c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1596c5c4113dSnw } 1597c5c4113dSnw } 1598e8c27ec8Sbaban 1599e8c27ec8Sbaban req->id1.idtype = strncmp(values[5], "0", 2) ? 1600e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 160148258c6bSjp 160248258c6bSjp if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 160348258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 160448258c6bSjp res->info.how.map_type = strtoul(values[6], &end, 10); 160548258c6bSjp switch (res->info.how.map_type) { 160648258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 160748258c6bSjp res->info.how.idmap_how_u.ad.dn = 160848258c6bSjp strdup(values[7]); 160948258c6bSjp res->info.how.idmap_how_u.ad.attr = 161048258c6bSjp strdup(values[8]); 161148258c6bSjp res->info.how.idmap_how_u.ad.value = 161248258c6bSjp strdup(values[9]); 161348258c6bSjp break; 161448258c6bSjp 161548258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 161648258c6bSjp res->info.how.idmap_how_u.nldap.dn = 161748258c6bSjp strdup(values[7]); 161848258c6bSjp res->info.how.idmap_how_u.nldap.attr = 161948258c6bSjp strdup(values[8]); 162048258c6bSjp res->info.how.idmap_how_u.nldap.value = 162148258c6bSjp strdup(values[9]); 162248258c6bSjp break; 162348258c6bSjp 162448258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 162548258c6bSjp res->info.how.idmap_how_u.rule.windomain = 162648258c6bSjp strdup(values[10]); 162748258c6bSjp res->info.how.idmap_how_u.rule.winname = 162848258c6bSjp strdup(values[11]); 162948258c6bSjp res->info.how.idmap_how_u.rule.unixname = 163048258c6bSjp strdup(values[12]); 163148258c6bSjp res->info.how.idmap_how_u.rule.is_nt4 = 163248258c6bSjp strtoul(values[13], &end, 1); 163348258c6bSjp res->info.how.idmap_how_u.rule.is_user = 163448258c6bSjp is_user; 163548258c6bSjp res->info.how.idmap_how_u.rule.is_wuser = 163648258c6bSjp strtoul(values[5], &end, 1); 163748258c6bSjp break; 163848258c6bSjp 163948258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 164048258c6bSjp break; 164148258c6bSjp 164248258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 164348258c6bSjp break; 164448258c6bSjp 164548258c6bSjp case IDMAP_MAP_TYPE_KNOWN_SID: 164648258c6bSjp break; 164748258c6bSjp 164848258c6bSjp default: 164948258c6bSjp /* Unknow mapping type */ 165048258c6bSjp assert(FALSE); 165148258c6bSjp } 165248258c6bSjp } 1653c5c4113dSnw } 165462c60062Sbaban if (vm != NULL) 1655c5c4113dSnw (void) sqlite_finalize(vm, NULL); 1656c5c4113dSnw return (retcode); 1657c5c4113dSnw } 1658c5c4113dSnw 1659cd37da74Snw static 1660cd37da74Snw idmap_retcode 166162c60062Sbaban lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid, 1662cd37da74Snw char **name, char **domain, int *type) 1663cd37da74Snw { 1664c5c4113dSnw char *end; 1665c5c4113dSnw char *sql = NULL; 1666c5c4113dSnw const char **values; 1667c5c4113dSnw sqlite_vm *vm = NULL; 1668c5c4113dSnw int ncol; 1669c5c4113dSnw time_t curtime; 1670c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS; 1671c5c4113dSnw 1672c5c4113dSnw /* Get current time */ 1673c5c4113dSnw errno = 0; 1674c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 1675cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1676cd37da74Snw strerror(errno)); 1677c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 1678c5c4113dSnw goto out; 1679c5c4113dSnw } 1680c5c4113dSnw 1681c5c4113dSnw /* SQL to lookup the cache */ 1682cd37da74Snw sql = sqlite_mprintf("SELECT canon_name, domain, type " 1683cd37da74Snw "FROM name_cache WHERE " 1684cd37da74Snw "sidprefix = %Q AND rid = %u AND " 1685cd37da74Snw "(expiration = 0 OR expiration ISNULL OR " 1686cd37da74Snw "expiration > %d);", 1687cd37da74Snw sidprefix, rid, curtime); 1688c5c4113dSnw if (sql == NULL) { 1689c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1690c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1691c5c4113dSnw goto out; 1692c5c4113dSnw } 1693c5c4113dSnw retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values); 1694c5c4113dSnw sqlite_freemem(sql); 1695c5c4113dSnw 1696c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 169762c60062Sbaban if (type != NULL) { 1698c5c4113dSnw if (values[2] == NULL) { 1699c5c4113dSnw retcode = IDMAP_ERR_CACHE; 1700c5c4113dSnw goto out; 1701c5c4113dSnw } 1702c5c4113dSnw *type = strtol(values[2], &end, 10); 1703c5c4113dSnw } 1704c5c4113dSnw 170562c60062Sbaban if (name != NULL && values[0] != NULL) { 1706c5c4113dSnw if ((*name = strdup(values[0])) == NULL) { 1707c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1708c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1709c5c4113dSnw goto out; 1710c5c4113dSnw } 1711c5c4113dSnw } 1712c5c4113dSnw 171362c60062Sbaban if (domain != NULL && values[1] != NULL) { 1714c5c4113dSnw if ((*domain = strdup(values[1])) == NULL) { 171562c60062Sbaban if (name != NULL && *name) { 1716c5c4113dSnw free(*name); 1717c5c4113dSnw *name = NULL; 1718c5c4113dSnw } 1719c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1720c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1721c5c4113dSnw goto out; 1722c5c4113dSnw } 1723c5c4113dSnw } 1724c5c4113dSnw } 1725c5c4113dSnw 1726c5c4113dSnw out: 172762c60062Sbaban if (vm != NULL) 1728c5c4113dSnw (void) sqlite_finalize(vm, NULL); 1729c5c4113dSnw return (retcode); 1730c5c4113dSnw } 1731c5c4113dSnw 1732c5c4113dSnw /* 1733e8c27ec8Sbaban * Given SID, find winname using name_cache OR 1734e8c27ec8Sbaban * Given winname, find SID using name_cache. 1735e8c27ec8Sbaban * Used when mapping win to unix i.e. req->id1 is windows id and 1736e8c27ec8Sbaban * req->id2 is unix id 1737c5c4113dSnw */ 1738cd37da74Snw static 1739cd37da74Snw idmap_retcode 1740e8c27ec8Sbaban lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1741cd37da74Snw { 1742c5c4113dSnw int type = -1; 1743c5c4113dSnw idmap_retcode retcode; 1744e8c27ec8Sbaban char *sidprefix = NULL; 1745c5c4113dSnw idmap_rid_t rid; 1746c5c4113dSnw char *name = NULL, *domain = NULL; 1747c5c4113dSnw 1748e8c27ec8Sbaban /* Done if we've both sid and winname */ 1749e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL) 1750e8c27ec8Sbaban return (IDMAP_SUCCESS); 1751c5c4113dSnw 1752e8c27ec8Sbaban /* Lookup sid to winname */ 1753e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 1754e8c27ec8Sbaban retcode = lookup_cache_sid2name(cache, 1755e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix, 1756e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, &name, &domain, &type); 175762c60062Sbaban goto out; 1758e8c27ec8Sbaban } 175962c60062Sbaban 1760e8c27ec8Sbaban /* Lookup winame to sid */ 1761e8c27ec8Sbaban retcode = lookup_cache_name2sid(cache, req->id1name, req->id1domain, 1762e8c27ec8Sbaban &name, &sidprefix, &rid, &type); 1763c5c4113dSnw 1764c5c4113dSnw out: 1765e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 1766e8c27ec8Sbaban free(name); 1767e8c27ec8Sbaban free(domain); 1768e8c27ec8Sbaban free(sidprefix); 1769e8c27ec8Sbaban return (retcode); 1770e8c27ec8Sbaban } 1771e8c27ec8Sbaban 1772e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) { 1773e8c27ec8Sbaban res->id.idtype = (type == _IDMAP_T_USER) ? 1774e8c27ec8Sbaban IDMAP_UID : IDMAP_GID; 1775e8c27ec8Sbaban } 1776e8c27ec8Sbaban req->id1.idtype = (type == _IDMAP_T_USER) ? 1777e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 1778e8c27ec8Sbaban 1779e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 1780e8c27ec8Sbaban if (name != NULL) { 1781e8c27ec8Sbaban free(req->id1name); /* Free existing winname */ 1782e8c27ec8Sbaban req->id1name = name; /* and use canonical name instead */ 1783e8c27ec8Sbaban } 1784e8c27ec8Sbaban if (req->id1domain == NULL) 1785e8c27ec8Sbaban req->id1domain = domain; 1786e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL) { 1787e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = sidprefix; 1788e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid = rid; 1789c5c4113dSnw } 1790c5c4113dSnw return (retcode); 1791c5c4113dSnw } 1792c5c4113dSnw 17934d61c878SJulian Pullen 17944d61c878SJulian Pullen 17954d61c878SJulian Pullen static int 17964d61c878SJulian Pullen ad_lookup_batch_int(lookup_state_t *state, idmap_mapping_batch *batch, 17974d61c878SJulian Pullen idmap_ids_res *result, int index, int *num_processed) 1798cd37da74Snw { 1799c5c4113dSnw idmap_retcode retcode; 18004d61c878SJulian Pullen int i, num_queued, type, is_wuser, is_user; 18014d61c878SJulian Pullen int next_request; 1802e8c27ec8Sbaban int retries = 0, eunixtype; 1803e8c27ec8Sbaban char **unixname; 1804c5c4113dSnw idmap_mapping *req; 1805c5c4113dSnw idmap_id_res *res; 1806e8c27ec8Sbaban idmap_query_state_t *qs = NULL; 180748258c6bSjp idmap_how *how; 1808479ac375Sdm char **dn, **attr, **value; 1809e8c27ec8Sbaban 18104d61c878SJulian Pullen *num_processed = 0; 18114d61c878SJulian Pullen 1812e8c27ec8Sbaban /* 1813e8c27ec8Sbaban * Since req->id2.idtype is unused, we will use it here 1814e8c27ec8Sbaban * to retrieve the value of sid_type. But it needs to be 1815e8c27ec8Sbaban * reset to IDMAP_NONE before we return to prevent xdr 1816e8c27ec8Sbaban * from mis-interpreting req->id2 when it tries to free 1817e8c27ec8Sbaban * the input argument. Other option is to allocate an 1818e8c27ec8Sbaban * array of integers and use it instead for the batched 1819e8c27ec8Sbaban * call. But why un-necessarily allocate memory. That may 1820e8c27ec8Sbaban * be an option if req->id2.idtype cannot be re-used in 1821e8c27ec8Sbaban * future. 1822e8c27ec8Sbaban */ 1823c5c4113dSnw retry: 18244d61c878SJulian Pullen retcode = idmap_lookup_batch_start(_idmapdstate.ads[index], 18254d61c878SJulian Pullen state->ad_nqueries, &qs); 1826e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 18272b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 18282b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 18290dcc7149Snw goto retry; 1830349d5d8fSnw degrade_svc(1, "failed to create batch for AD lookup"); 18314d61c878SJulian Pullen goto out; 1832c5c4113dSnw } 18334d61c878SJulian Pullen num_queued = 0; 1834c5c4113dSnw 1835c8e26105Sjp restore_svc(); 1836c8e26105Sjp 18374d61c878SJulian Pullen if (index == 0) { 18384d61c878SJulian Pullen /* 18394d61c878SJulian Pullen * Directory based name mapping is only performed within the 18404d61c878SJulian Pullen * joined forest (index == 0). We don't trust other "trusted" 18414d61c878SJulian Pullen * forests to provide DS-based name mapping information because 18424d61c878SJulian Pullen * AD's definition of "cross-forest trust" does not encompass 18434d61c878SJulian Pullen * this sort of behavior. 18444d61c878SJulian Pullen */ 18454d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs, 18464d61c878SJulian Pullen state->ad_unixuser_attr, state->ad_unixgroup_attr); 18474d61c878SJulian Pullen } 1848e8c27ec8Sbaban 18494d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 1850c5c4113dSnw req = &batch->idmap_mapping_batch_val[i]; 1851c5c4113dSnw res = &result->ids.ids_val[i]; 185248258c6bSjp how = &res->info.how; 185348258c6bSjp 1854e8c27ec8Sbaban retcode = IDMAP_SUCCESS; 1855e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE; 1856c5c4113dSnw 18574d61c878SJulian Pullen /* Skip if not marked for this AD lookup */ 18584d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD) || 18594d61c878SJulian Pullen (req->direction & _IDMAP_F_LOOKUP_OTHER_AD)) 1860e8c27ec8Sbaban continue; 1861e8c27ec8Sbaban 186296c3a9a0Sbaban if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR) 1863e8c27ec8Sbaban continue; 1864e8c27ec8Sbaban 1865e8c27ec8Sbaban if (IS_REQUEST_SID(*req, 1)) { 1866e8c27ec8Sbaban 1867479ac375Sdm /* win2unix request: */ 1868e8c27ec8Sbaban 1869479ac375Sdm unixname = dn = attr = value = NULL; 1870e8c27ec8Sbaban eunixtype = _IDMAP_T_UNDEF; 1871e8c27ec8Sbaban if (req->id2name == NULL) { 1872e8c27ec8Sbaban if (res->id.idtype == IDMAP_UID && 1873e8c27ec8Sbaban AD_OR_MIXED(state->nm_siduid)) { 1874e8c27ec8Sbaban eunixtype = _IDMAP_T_USER; 1875e8c27ec8Sbaban unixname = &req->id2name; 1876e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GID && 1877e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) { 1878e8c27ec8Sbaban eunixtype = _IDMAP_T_GROUP; 1879e8c27ec8Sbaban unixname = &req->id2name; 1880e8c27ec8Sbaban } else if (AD_OR_MIXED(state->nm_siduid) || 1881e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) { 1882e8c27ec8Sbaban unixname = &req->id2name; 1883e8c27ec8Sbaban } 1884e8c27ec8Sbaban } 18854d61c878SJulian Pullen 1886479ac375Sdm if (unixname != NULL) { 1887479ac375Sdm /* 1888479ac375Sdm * Get how info for DS-based name 1889479ac375Sdm * mapping only if AD or MIXED 1890479ac375Sdm * mode is enabled. 1891479ac375Sdm */ 1892479ac375Sdm idmap_info_free(&res->info); 1893479ac375Sdm res->info.src = IDMAP_MAP_SRC_NEW; 1894479ac375Sdm how->map_type = IDMAP_MAP_TYPE_DS_AD; 1895479ac375Sdm dn = &how->idmap_how_u.ad.dn; 1896479ac375Sdm attr = &how->idmap_how_u.ad.attr; 1897479ac375Sdm value = &how->idmap_how_u.ad.value; 1898479ac375Sdm } 1899479ac375Sdm if (req->id1.idmap_id_u.sid.prefix != NULL) { 1900479ac375Sdm /* Lookup AD by SID */ 1901479ac375Sdm retcode = idmap_sid2name_batch_add1( 1902479ac375Sdm qs, req->id1.idmap_id_u.sid.prefix, 1903479ac375Sdm &req->id1.idmap_id_u.sid.rid, eunixtype, 1904479ac375Sdm dn, attr, value, 1905479ac375Sdm (req->id1name == NULL) ? 1906479ac375Sdm &req->id1name : NULL, 1907479ac375Sdm (req->id1domain == NULL) ? 1908479ac375Sdm &req->id1domain : NULL, 1909479ac375Sdm (int *)&req->id2.idtype, unixname, 1910479ac375Sdm &res->retcode); 19114d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 19124d61c878SJulian Pullen num_queued++; 1913479ac375Sdm } else { 1914479ac375Sdm /* Lookup AD by winname */ 1915479ac375Sdm assert(req->id1name != NULL); 1916479ac375Sdm retcode = idmap_name2sid_batch_add1( 1917479ac375Sdm qs, req->id1name, req->id1domain, 1918479ac375Sdm eunixtype, 1919479ac375Sdm dn, attr, value, 1920479ac375Sdm &req->id1name, 1921479ac375Sdm &req->id1.idmap_id_u.sid.prefix, 1922479ac375Sdm &req->id1.idmap_id_u.sid.rid, 1923479ac375Sdm (int *)&req->id2.idtype, unixname, 1924479ac375Sdm &res->retcode); 19254d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 19264d61c878SJulian Pullen num_queued++; 1927479ac375Sdm } 1928e8c27ec8Sbaban 1929e8c27ec8Sbaban } else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) { 1930479ac375Sdm 1931479ac375Sdm /* unix2win request: */ 1932e8c27ec8Sbaban 1933e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL && 1934e8c27ec8Sbaban req->id2name != NULL) { 19354d61c878SJulian Pullen /* Already have SID and winname. done */ 1936e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS; 1937e8c27ec8Sbaban continue; 1938e8c27ec8Sbaban } 1939c5c4113dSnw 1940e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL) { 1941e8c27ec8Sbaban /* 1942e8c27ec8Sbaban * SID but no winname -- lookup AD by 1943e8c27ec8Sbaban * SID to get winname. 1944479ac375Sdm * how info is not needed here because 1945479ac375Sdm * we are not retrieving unixname from 1946479ac375Sdm * AD. 1947e8c27ec8Sbaban */ 19484d61c878SJulian Pullen 1949e8c27ec8Sbaban retcode = idmap_sid2name_batch_add1( 1950e8c27ec8Sbaban qs, res->id.idmap_id_u.sid.prefix, 1951e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 195248258c6bSjp _IDMAP_T_UNDEF, 1953479ac375Sdm NULL, NULL, NULL, 195448258c6bSjp &req->id2name, 1955e8c27ec8Sbaban &req->id2domain, (int *)&req->id2.idtype, 1956e8c27ec8Sbaban NULL, &res->retcode); 19574d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 19584d61c878SJulian Pullen num_queued++; 1959e8c27ec8Sbaban } else if (req->id2name != NULL) { 1960e8c27ec8Sbaban /* 1961e8c27ec8Sbaban * winname but no SID -- lookup AD by 1962e8c27ec8Sbaban * winname to get SID. 1963479ac375Sdm * how info is not needed here because 1964479ac375Sdm * we are not retrieving unixname from 1965479ac375Sdm * AD. 1966e8c27ec8Sbaban */ 1967e8c27ec8Sbaban retcode = idmap_name2sid_batch_add1( 1968e8c27ec8Sbaban qs, req->id2name, req->id2domain, 196948258c6bSjp _IDMAP_T_UNDEF, 1970479ac375Sdm NULL, NULL, NULL, NULL, 1971e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix, 1972e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 1973e8c27ec8Sbaban (int *)&req->id2.idtype, NULL, 1974e8c27ec8Sbaban &res->retcode); 19754d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 19764d61c878SJulian Pullen num_queued++; 1977e8c27ec8Sbaban } else if (req->id1name != NULL) { 1978e8c27ec8Sbaban /* 19794d61c878SJulian Pullen * No SID and no winname but we've unixname. 19804d61c878SJulian Pullen * Lookup AD by unixname to get SID. 1981e8c27ec8Sbaban */ 1982e8c27ec8Sbaban is_user = (IS_REQUEST_UID(*req)) ? 1 : 0; 1983e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID) 1984e8c27ec8Sbaban is_wuser = 1; 1985e8c27ec8Sbaban else if (res->id.idtype == IDMAP_GSID) 1986e8c27ec8Sbaban is_wuser = 0; 1987e8c27ec8Sbaban else 1988e8c27ec8Sbaban is_wuser = is_user; 19894d61c878SJulian Pullen 1990479ac375Sdm idmap_info_free(&res->info); 199148258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 199248258c6bSjp how->map_type = IDMAP_MAP_TYPE_DS_AD; 1993e8c27ec8Sbaban retcode = idmap_unixname2sid_batch_add1( 1994e8c27ec8Sbaban qs, req->id1name, is_user, is_wuser, 199548258c6bSjp &how->idmap_how_u.ad.dn, 199648258c6bSjp &how->idmap_how_u.ad.attr, 199748258c6bSjp &how->idmap_how_u.ad.value, 1998e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix, 1999e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 2000e8c27ec8Sbaban &req->id2name, &req->id2domain, 2001e8c27ec8Sbaban (int *)&req->id2.idtype, &res->retcode); 20024d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 20034d61c878SJulian Pullen num_queued++; 2004e8c27ec8Sbaban } 2005e8c27ec8Sbaban } 20064d61c878SJulian Pullen 20074d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) { 20084d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD; 20094d61c878SJulian Pullen retcode = IDMAP_SUCCESS; 20104d61c878SJulian Pullen } else if (retcode != IDMAP_SUCCESS) { 2011e8c27ec8Sbaban idmap_lookup_release_batch(&qs); 20124d61c878SJulian Pullen num_queued = 0; 20134d61c878SJulian Pullen next_request = i + 1; 2014e8c27ec8Sbaban break; 2015c5c4113dSnw } 20164d61c878SJulian Pullen } /* End of for loop */ 2017c5c4113dSnw 201896c3a9a0Sbaban if (retcode == IDMAP_SUCCESS) { 201996c3a9a0Sbaban /* add keeps track if we added an entry to the batch */ 20204d61c878SJulian Pullen if (num_queued > 0) 202196c3a9a0Sbaban retcode = idmap_lookup_batch_end(&qs); 202296c3a9a0Sbaban else 202396c3a9a0Sbaban idmap_lookup_release_batch(&qs); 202496c3a9a0Sbaban } 2025c5c4113dSnw 20262b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 20272b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 2028e8c27ec8Sbaban goto retry; 2029e8c27ec8Sbaban else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 2030349d5d8fSnw degrade_svc(1, "some AD lookups timed out repeatedly"); 2031e8c27ec8Sbaban 20324d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) { 20334d61c878SJulian Pullen /* Mark any unproccessed requests for an other AD */ 20344d61c878SJulian Pullen for (i = next_request; i < batch->idmap_mapping_batch_len; 20354d61c878SJulian Pullen i++) { 20364d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 20374d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD; 20384d61c878SJulian Pullen 20394d61c878SJulian Pullen } 20404d61c878SJulian Pullen } 20414d61c878SJulian Pullen 2042e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 2043e8c27ec8Sbaban idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests"); 2044e8c27ec8Sbaban 2045e8c27ec8Sbaban out: 2046e8c27ec8Sbaban /* 2047e8c27ec8Sbaban * This loop does the following: 2048479ac375Sdm * 1. Reset _IDMAP_F_LOOKUP_AD flag from the request. 2049479ac375Sdm * 2. Reset req->id2.idtype to IDMAP_NONE 2050479ac375Sdm * 3. If batch_start or batch_add failed then set the status 2051479ac375Sdm * of each request marked for AD lookup to that error. 20524d61c878SJulian Pullen * 4. Evaluate the type of the AD object (i.e. user or group) 20534d61c878SJulian Pullen * and update the idtype in request. 2054e8c27ec8Sbaban */ 2055cd37da74Snw for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 2056cd37da74Snw req = &batch->idmap_mapping_batch_val[i]; 2057e8c27ec8Sbaban type = req->id2.idtype; 2058e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE; 20595e0794bcSbaban res = &result->ids.ids_val[i]; 206048258c6bSjp how = &res->info.how; 20614d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD) || 20624d61c878SJulian Pullen (req->direction & _IDMAP_F_LOOKUP_OTHER_AD)) 2063cd37da74Snw continue; 2064cd37da74Snw 20654d61c878SJulian Pullen /* Count number processed */ 20664d61c878SJulian Pullen (*num_processed)++; 20674d61c878SJulian Pullen 2068479ac375Sdm /* Reset AD lookup flag */ 2069479ac375Sdm req->direction &= ~(_IDMAP_F_LOOKUP_AD); 2070479ac375Sdm 2071479ac375Sdm /* 20724d61c878SJulian Pullen * If batch_start or batch_add failed then set the 20734d61c878SJulian Pullen * status of each request marked for AD lookup to 20744d61c878SJulian Pullen * that error. 2075479ac375Sdm */ 2076e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 2077e8c27ec8Sbaban res->retcode = retcode; 2078cd37da74Snw continue; 2079cd37da74Snw } 2080cd37da74Snw 208148258c6bSjp if (res->retcode == IDMAP_ERR_NOTFOUND) { 208248258c6bSjp /* Nothing found - remove the preset info */ 2083479ac375Sdm idmap_info_free(&res->info); 208448258c6bSjp } 208548258c6bSjp 2086e8c27ec8Sbaban if (IS_REQUEST_SID(*req, 1)) { 2087e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) 2088e8c27ec8Sbaban continue; 2089479ac375Sdm /* Evaluate result type */ 2090e8c27ec8Sbaban switch (type) { 2091e8c27ec8Sbaban case _IDMAP_T_USER: 2092e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) 2093e8c27ec8Sbaban res->id.idtype = IDMAP_UID; 2094e8c27ec8Sbaban req->id1.idtype = IDMAP_USID; 2095e8c27ec8Sbaban break; 20964d61c878SJulian Pullen 2097e8c27ec8Sbaban case _IDMAP_T_GROUP: 2098e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) 2099e8c27ec8Sbaban res->id.idtype = IDMAP_GID; 2100e8c27ec8Sbaban req->id1.idtype = IDMAP_GSID; 2101e8c27ec8Sbaban break; 21024d61c878SJulian Pullen 2103e8c27ec8Sbaban default: 2104e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID; 2105e8c27ec8Sbaban break; 2106e8c27ec8Sbaban } 2107479ac375Sdm if (res->retcode == IDMAP_SUCCESS && 2108479ac375Sdm req->id1name != NULL && 2109479ac375Sdm (req->id2name == NULL || 2110479ac375Sdm res->id.idmap_id_u.uid == SENTINEL_PID) && 2111479ac375Sdm NLDAP_MODE(res->id.idtype, state)) { 2112479ac375Sdm req->direction |= _IDMAP_F_LOOKUP_NLDAP; 2113479ac375Sdm state->nldap_nqueries++; 2114479ac375Sdm } 2115e8c27ec8Sbaban } else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) { 2116e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 2117e8c27ec8Sbaban if ((!(IDMAP_FATAL_ERROR(res->retcode))) && 2118e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix == NULL && 2119e8c27ec8Sbaban req->id2name == NULL && /* no winname */ 2120e8c27ec8Sbaban req->id1name != NULL) /* unixname */ 2121e8c27ec8Sbaban /* 21224d61c878SJulian Pullen * If AD lookup by unixname 21234d61c878SJulian Pullen * failed with non fatal error 21244d61c878SJulian Pullen * then clear the error (ie set 21254d61c878SJulian Pullen * res->retcode to success). 21264d61c878SJulian Pullen * This allows the next pass to 21274d61c878SJulian Pullen * process other mapping 2128479ac375Sdm * mechanisms for this request. 2129e8c27ec8Sbaban */ 2130e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS; 2131e8c27ec8Sbaban continue; 2132e8c27ec8Sbaban } 2133479ac375Sdm /* Evaluate result type */ 2134e8c27ec8Sbaban switch (type) { 2135e8c27ec8Sbaban case _IDMAP_T_USER: 2136e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2137e8c27ec8Sbaban res->id.idtype = IDMAP_USID; 2138e8c27ec8Sbaban break; 21394d61c878SJulian Pullen 2140e8c27ec8Sbaban case _IDMAP_T_GROUP: 2141e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2142e8c27ec8Sbaban res->id.idtype = IDMAP_GSID; 2143e8c27ec8Sbaban break; 21444d61c878SJulian Pullen 2145e8c27ec8Sbaban default: 2146e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID; 2147e8c27ec8Sbaban break; 2148e8c27ec8Sbaban } 2149e8c27ec8Sbaban } 2150e8c27ec8Sbaban } 2151c5c4113dSnw 21524d61c878SJulian Pullen return (retcode); 21534d61c878SJulian Pullen } 21544d61c878SJulian Pullen 21554d61c878SJulian Pullen 21564d61c878SJulian Pullen 21574d61c878SJulian Pullen /* 21584d61c878SJulian Pullen * Batch AD lookups 21594d61c878SJulian Pullen */ 21604d61c878SJulian Pullen idmap_retcode 21614d61c878SJulian Pullen ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch, 21624d61c878SJulian Pullen idmap_ids_res *result) 21634d61c878SJulian Pullen { 21644d61c878SJulian Pullen idmap_retcode retcode; 21654d61c878SJulian Pullen int i, j; 21664d61c878SJulian Pullen idmap_mapping *req; 21674d61c878SJulian Pullen idmap_id_res *res; 21684d61c878SJulian Pullen int num_queries; 21694d61c878SJulian Pullen int num_processed; 21704d61c878SJulian Pullen 21714d61c878SJulian Pullen if (state->ad_nqueries == 0) 21724d61c878SJulian Pullen return (IDMAP_SUCCESS); 21734d61c878SJulian Pullen 21744d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 21754d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 21764d61c878SJulian Pullen res = &result->ids.ids_val[i]; 21774d61c878SJulian Pullen 21784d61c878SJulian Pullen /* Skip if not marked for AD lookup or already in error. */ 21794d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD) || 21804d61c878SJulian Pullen res->retcode != IDMAP_SUCCESS) 21814d61c878SJulian Pullen continue; 21824d61c878SJulian Pullen 21834d61c878SJulian Pullen /* Init status */ 21844d61c878SJulian Pullen res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR; 21854d61c878SJulian Pullen } 21864d61c878SJulian Pullen 21874d61c878SJulian Pullen RDLOCK_CONFIG(); 21884d61c878SJulian Pullen num_queries = state->ad_nqueries; 21894d61c878SJulian Pullen if (_idmapdstate.num_ads > 0) { 21904d61c878SJulian Pullen for (i = 0; i < _idmapdstate.num_ads && num_queries > 0; i++) { 21914d61c878SJulian Pullen 21924d61c878SJulian Pullen retcode = ad_lookup_batch_int(state, batch, result, i, 21934d61c878SJulian Pullen &num_processed); 21944d61c878SJulian Pullen num_queries -= num_processed; 21954d61c878SJulian Pullen 21964d61c878SJulian Pullen if (num_queries > 0) { 21974d61c878SJulian Pullen for (j = 0; j < batch->idmap_mapping_batch_len; 21984d61c878SJulian Pullen j++) { 21994d61c878SJulian Pullen req = 22004d61c878SJulian Pullen &batch->idmap_mapping_batch_val[j]; 22014d61c878SJulian Pullen res = &result->ids.ids_val[j]; 22024d61c878SJulian Pullen if (!(req->direction & 22034d61c878SJulian Pullen _IDMAP_F_LOOKUP_AD)) 22044d61c878SJulian Pullen continue; 22054d61c878SJulian Pullen /* 22064d61c878SJulian Pullen * Reset the other AD lookup flag so 22074d61c878SJulian Pullen * that we can try the next AD 22084d61c878SJulian Pullen */ 22094d61c878SJulian Pullen req->direction &= 22104d61c878SJulian Pullen ~(_IDMAP_F_LOOKUP_OTHER_AD); 22114d61c878SJulian Pullen 22124d61c878SJulian Pullen if ((i + 1) >= _idmapdstate.num_ads) { 22134d61c878SJulian Pullen /* 22144d61c878SJulian Pullen * There are no more ADs to try 22154d61c878SJulian Pullen */ 22164d61c878SJulian Pullen req->direction &= 22174d61c878SJulian Pullen ~(_IDMAP_F_LOOKUP_AD); 22184d61c878SJulian Pullen res->retcode = 22194d61c878SJulian Pullen IDMAP_ERR_DOMAIN_NOTFOUND; 22204d61c878SJulian Pullen } 22214d61c878SJulian Pullen } 22224d61c878SJulian Pullen } 22234d61c878SJulian Pullen } 22244d61c878SJulian Pullen } else { 22254d61c878SJulian Pullen /* Case of no ADs */ 22264d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 22274d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 22284d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 22294d61c878SJulian Pullen res = &result->ids.ids_val[i]; 22304d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 22314d61c878SJulian Pullen continue; 22324d61c878SJulian Pullen req->direction &= ~(_IDMAP_F_LOOKUP_AD); 22334d61c878SJulian Pullen res->retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 22344d61c878SJulian Pullen } 22354d61c878SJulian Pullen } 22364d61c878SJulian Pullen UNLOCK_CONFIG(); 22374d61c878SJulian Pullen 2238e8c27ec8Sbaban /* AD lookups done. Reset state->ad_nqueries and return */ 2239e8c27ec8Sbaban state->ad_nqueries = 0; 2240c5c4113dSnw return (retcode); 2241c5c4113dSnw } 2242c5c4113dSnw 2243cd37da74Snw /* 2244cd37da74Snw * Convention when processing win2unix requests: 2245cd37da74Snw * 2246cd37da74Snw * Windows identity: 2247cd37da74Snw * req->id1name = 2248cd37da74Snw * winname if given otherwise winname found will be placed 2249cd37da74Snw * here. 2250cd37da74Snw * req->id1domain = 2251cd37da74Snw * windomain if given otherwise windomain found will be 2252cd37da74Snw * placed here. 2253cd37da74Snw * req->id1.idtype = 2254cd37da74Snw * Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll 2255cd37da74Snw * be set to IDMAP_USID/GSID depending upon whether the 2256cd37da74Snw * given SID is user or group respectively. The user/group-ness 2257cd37da74Snw * is determined either when looking up well-known SIDs table OR 2258479ac375Sdm * if the SID is found in namecache OR by ad_lookup_one() OR by 2259cd37da74Snw * ad_lookup_batch(). 2260cd37da74Snw * req->id1..sid.[prefix, rid] = 2261cd37da74Snw * SID if given otherwise SID found will be placed here. 2262cd37da74Snw * 2263cd37da74Snw * Unix identity: 2264cd37da74Snw * req->id2name = 2265cd37da74Snw * unixname found will be placed here. 2266cd37da74Snw * req->id2domain = 2267cd37da74Snw * NOT USED 2268cd37da74Snw * res->id.idtype = 2269cd37da74Snw * Target type initialized from req->id2.idtype. If 2270cd37da74Snw * it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found 2271cd37da74Snw * will be placed here. 2272cd37da74Snw * res->id..[uid or gid] = 2273cd37da74Snw * UID/GID found will be placed here. 2274cd37da74Snw * 2275cd37da74Snw * Others: 2276cd37da74Snw * res->retcode = 2277cd37da74Snw * Return status for this request will be placed here. 2278cd37da74Snw * res->direction = 2279cd37da74Snw * Direction found will be placed here. Direction 2280cd37da74Snw * meaning whether the resultant mapping is valid 2281cd37da74Snw * only from win2unix or bi-directional. 2282cd37da74Snw * req->direction = 2283cd37da74Snw * INTERNAL USE. Used by idmapd to set various 2284cd37da74Snw * flags (_IDMAP_F_xxxx) to aid in processing 2285cd37da74Snw * of the request. 2286cd37da74Snw * req->id2.idtype = 2287cd37da74Snw * INTERNAL USE. Initially this is the requested target 2288cd37da74Snw * type and is used to initialize res->id.idtype. 2289cd37da74Snw * ad_lookup_batch() uses this field temporarily to store 2290cd37da74Snw * sid_type obtained by the batched AD lookups and after 2291cd37da74Snw * use resets it to IDMAP_NONE to prevent xdr from 2292cd37da74Snw * mis-interpreting the contents of req->id2. 2293cd37da74Snw * req->id2..[uid or gid or sid] = 2294cd37da74Snw * NOT USED 2295cd37da74Snw */ 2296cd37da74Snw 2297cd37da74Snw /* 2298cd37da74Snw * This function does the following: 2299cd37da74Snw * 1. Lookup well-known SIDs table. 2300cd37da74Snw * 2. Check if the given SID is a local-SID and if so extract UID/GID from it. 2301cd37da74Snw * 3. Lookup cache. 2302cd37da74Snw * 4. Check if the client does not want new mapping to be allocated 2303cd37da74Snw * in which case this pass is the final pass. 2304cd37da74Snw * 5. Set AD lookup flag if it determines that the next stage needs 2305cd37da74Snw * to do AD lookup. 2306cd37da74Snw */ 2307c5c4113dSnw idmap_retcode 2308479ac375Sdm sid2pid_first_pass(lookup_state_t *state, idmap_mapping *req, 2309cd37da74Snw idmap_id_res *res) 2310cd37da74Snw { 2311c5c4113dSnw idmap_retcode retcode; 2312e8c27ec8Sbaban int wksid; 2313c5c4113dSnw 2314e8c27ec8Sbaban /* Initialize result */ 2315e8c27ec8Sbaban res->id.idtype = req->id2.idtype; 2316e8c27ec8Sbaban res->id.idmap_id_u.uid = SENTINEL_PID; 2317e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF; 2318e8c27ec8Sbaban wksid = 0; 2319c5c4113dSnw 2320cf5b5989Sdm if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) { 2321e8c27ec8Sbaban if (req->id1name == NULL) { 2322e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 2323e8c27ec8Sbaban goto out; 2324e8c27ec8Sbaban } 2325e8c27ec8Sbaban /* sanitize sidprefix */ 2326e8c27ec8Sbaban free(req->id1.idmap_id_u.sid.prefix); 2327e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = NULL; 2328c5c4113dSnw } 2329c5c4113dSnw 2330e8c27ec8Sbaban /* Lookup well-known SIDs table */ 2331e8c27ec8Sbaban retcode = lookup_wksids_sid2pid(req, res, &wksid); 2332c5c4113dSnw if (retcode != IDMAP_ERR_NOTFOUND) 2333c5c4113dSnw goto out; 2334c5c4113dSnw 2335e8c27ec8Sbaban if (!wksid) { 23362b4a7802SBaban Kenkre /* Check if this is a localsid */ 2337e8c27ec8Sbaban retcode = lookup_localsid2pid(req, res); 2338e8c27ec8Sbaban if (retcode != IDMAP_ERR_NOTFOUND) 2339e8c27ec8Sbaban goto out; 23402b4a7802SBaban Kenkre 23412b4a7802SBaban Kenkre if (ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)) { 23424d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 23432b4a7802SBaban Kenkre goto out; 23442b4a7802SBaban Kenkre } 2345e8c27ec8Sbaban } 2346e8c27ec8Sbaban 2347e8c27ec8Sbaban /* Lookup cache */ 2348479ac375Sdm retcode = lookup_cache_sid2pid(state->cache, req, res); 2349c5c4113dSnw if (retcode != IDMAP_ERR_NOTFOUND) 2350c5c4113dSnw goto out; 2351c5c4113dSnw 2352c5c4113dSnw if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) { 23534d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 2354c5c4113dSnw goto out; 2355c5c4113dSnw } 2356c5c4113dSnw 2357c5c4113dSnw /* 2358e8c27ec8Sbaban * Failed to find non-expired entry in cache. Next step is 2359e8c27ec8Sbaban * to determine if this request needs to be batched for AD lookup. 2360e8c27ec8Sbaban * 2361e8c27ec8Sbaban * At this point we have either sid or winname or both. If we don't 2362e8c27ec8Sbaban * have both then lookup name_cache for the sid or winname 2363e8c27ec8Sbaban * whichever is missing. If not found then this request will be 2364e8c27ec8Sbaban * batched for AD lookup. 2365c5c4113dSnw */ 2366479ac375Sdm retcode = lookup_name_cache(state->cache, req, res); 2367e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS && retcode != IDMAP_ERR_NOTFOUND) 2368e8c27ec8Sbaban goto out; 2369c5c4113dSnw 2370c5c4113dSnw /* 2371e8c27ec8Sbaban * Set the flag to indicate that we are not done yet so that 2372e8c27ec8Sbaban * subsequent passes considers this request for name-based 2373e8c27ec8Sbaban * mapping and ephemeral mapping. 2374c5c4113dSnw */ 2375e8c27ec8Sbaban state->sid2pid_done = FALSE; 2376e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE; 2377c5c4113dSnw 2378c5c4113dSnw /* 2379e8c27ec8Sbaban * Even if we have both sid and winname, we still may need to batch 2380e8c27ec8Sbaban * this request for AD lookup if we don't have unixname and 2381e8c27ec8Sbaban * directory-based name mapping (AD or mixed) is enabled. 2382e8c27ec8Sbaban * We avoid AD lookup for well-known SIDs because they don't have 2383e8c27ec8Sbaban * regular AD objects. 2384c5c4113dSnw */ 2385e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS || 2386e8c27ec8Sbaban (!wksid && req->id2name == NULL && 2387e8c27ec8Sbaban AD_OR_MIXED_MODE(res->id.idtype, state))) { 2388c5c4113dSnw retcode = IDMAP_SUCCESS; 2389e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD; 2390c5c4113dSnw state->ad_nqueries++; 2391479ac375Sdm } else if (NLDAP_MODE(res->id.idtype, state)) { 2392479ac375Sdm req->direction |= _IDMAP_F_LOOKUP_NLDAP; 2393479ac375Sdm state->nldap_nqueries++; 2394c5c4113dSnw } 2395c5c4113dSnw 2396c5c4113dSnw 2397c5c4113dSnw out: 2398c5c4113dSnw res->retcode = idmap_stat4prot(retcode); 2399e8c27ec8Sbaban /* 2400e8c27ec8Sbaban * If we are done and there was an error then set fallback pid 2401e8c27ec8Sbaban * in the result. 2402e8c27ec8Sbaban */ 2403e8c27ec8Sbaban if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) 2404e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY; 2405c5c4113dSnw return (retcode); 2406c5c4113dSnw } 2407c5c4113dSnw 2408c5c4113dSnw /* 2409c5c4113dSnw * Generate SID using the following convention 2410c5c4113dSnw * <machine-sid-prefix>-<1000 + uid> 2411c5c4113dSnw * <machine-sid-prefix>-<2^31 + gid> 2412c5c4113dSnw */ 2413cd37da74Snw static 2414cd37da74Snw idmap_retcode 241548258c6bSjp generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user, 241648258c6bSjp int fallback) 2417cd37da74Snw { 2418e8c27ec8Sbaban free(res->id.idmap_id_u.sid.prefix); 2419e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = NULL; 2420c5c4113dSnw 2421e8c27ec8Sbaban /* 2422e8c27ec8Sbaban * Diagonal mapping for localSIDs not supported because of the 2423e8c27ec8Sbaban * way we generate localSIDs. 2424e8c27ec8Sbaban */ 2425e8c27ec8Sbaban if (is_user && res->id.idtype == IDMAP_GSID) 2426e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 2427e8c27ec8Sbaban if (!is_user && res->id.idtype == IDMAP_USID) 2428e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 2429c5c4113dSnw 2430e8c27ec8Sbaban /* Skip 1000 UIDs */ 2431e8c27ec8Sbaban if (is_user && req->id1.idmap_id_u.uid > 2432e8c27ec8Sbaban (INT32_MAX - LOCALRID_MIN)) 2433e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 2434e8c27ec8Sbaban 2435e8c27ec8Sbaban RDLOCK_CONFIG(); 2436e8c27ec8Sbaban /* 2437e8c27ec8Sbaban * machine_sid is never NULL because if it is we won't be here. 2438e8c27ec8Sbaban * No need to assert because stdrup(NULL) will core anyways. 2439e8c27ec8Sbaban */ 2440e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = 2441e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.machine_sid); 2442e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix == NULL) { 2443e8c27ec8Sbaban UNLOCK_CONFIG(); 2444e8c27ec8Sbaban idmapdlog(LOG_ERR, "Out of memory"); 2445e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 2446c5c4113dSnw } 2447e8c27ec8Sbaban UNLOCK_CONFIG(); 2448e8c27ec8Sbaban res->id.idmap_id_u.sid.rid = 2449e8c27ec8Sbaban (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_MIN : 2450e8c27ec8Sbaban req->id1.idmap_id_u.gid + INT32_MAX + 1; 2451e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 2452e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2453e8c27ec8Sbaban res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 2454c5c4113dSnw 2455fc724630SAlan Wright if (!fallback) { 245648258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 245748258c6bSjp res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 245848258c6bSjp } 245948258c6bSjp 2460e8c27ec8Sbaban /* 2461e8c27ec8Sbaban * Don't update name_cache because local sids don't have 2462e8c27ec8Sbaban * valid windows names. 2463e8c27ec8Sbaban */ 2464e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 2465e8c27ec8Sbaban return (IDMAP_SUCCESS); 2466c5c4113dSnw } 2467c5c4113dSnw 2468cd37da74Snw static 2469cd37da74Snw idmap_retcode 2470cd37da74Snw lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res) 2471cd37da74Snw { 2472c5c4113dSnw char *sidprefix; 2473c5c4113dSnw uint32_t rid; 2474c5c4113dSnw int s; 2475c5c4113dSnw 2476c5c4113dSnw /* 2477c5c4113dSnw * If the sidprefix == localsid then UID = last RID - 1000 or 2478c5c4113dSnw * GID = last RID - 2^31. 2479c5c4113dSnw */ 2480e8c27ec8Sbaban if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL) 2481e8c27ec8Sbaban /* This means we are looking up by winname */ 2482e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2483c5c4113dSnw rid = req->id1.idmap_id_u.sid.rid; 2484c5c4113dSnw 2485c5c4113dSnw RDLOCK_CONFIG(); 2486cd37da74Snw s = (_idmapdstate.cfg->pgcfg.machine_sid) ? 2487cd37da74Snw strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1; 2488c5c4113dSnw UNLOCK_CONFIG(); 2489c5c4113dSnw 2490e8c27ec8Sbaban /* 2491e8c27ec8Sbaban * If the given sidprefix does not match machine_sid then this is 2492e8c27ec8Sbaban * not a local SID. 2493e8c27ec8Sbaban */ 2494e8c27ec8Sbaban if (s != 0) 2495e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2496e8c27ec8Sbaban 2497e8c27ec8Sbaban switch (res->id.idtype) { 2498e8c27ec8Sbaban case IDMAP_UID: 2499e8c27ec8Sbaban if (rid > INT32_MAX || rid < LOCALRID_MIN) 2500e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2501e8c27ec8Sbaban res->id.idmap_id_u.uid = rid - LOCALRID_MIN; 2502e8c27ec8Sbaban break; 2503e8c27ec8Sbaban case IDMAP_GID: 2504e8c27ec8Sbaban if (rid <= INT32_MAX) 2505e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2506e8c27ec8Sbaban res->id.idmap_id_u.gid = rid - INT32_MAX - 1; 2507e8c27ec8Sbaban break; 2508e8c27ec8Sbaban case IDMAP_POSIXID: 2509e8c27ec8Sbaban if (rid > INT32_MAX) { 2510c5c4113dSnw res->id.idmap_id_u.gid = rid - INT32_MAX - 1; 2511c5c4113dSnw res->id.idtype = IDMAP_GID; 2512e8c27ec8Sbaban } else if (rid < LOCALRID_MIN) { 2513e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2514e8c27ec8Sbaban } else { 2515e8c27ec8Sbaban res->id.idmap_id_u.uid = rid - LOCALRID_MIN; 2516e8c27ec8Sbaban res->id.idtype = IDMAP_UID; 2517c5c4113dSnw } 2518e8c27ec8Sbaban break; 2519e8c27ec8Sbaban default: 2520e8c27ec8Sbaban return (IDMAP_ERR_NOTSUPPORTED); 2521c5c4113dSnw } 2522fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 2523fc724630SAlan Wright res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 2524e8c27ec8Sbaban return (IDMAP_SUCCESS); 2525c5c4113dSnw } 2526c5c4113dSnw 2527e8c27ec8Sbaban /* 2528e8c27ec8Sbaban * Name service lookup by unixname to get pid 2529e8c27ec8Sbaban */ 2530cd37da74Snw static 2531cd37da74Snw idmap_retcode 2532e8c27ec8Sbaban ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id) 2533cd37da74Snw { 2534cd37da74Snw struct passwd pwd, *pwdp; 2535cd37da74Snw struct group grp, *grpp; 2536*8c155366SJordan Brown char *buf; 2537c5c4113dSnw int errnum; 2538c5c4113dSnw const char *me = "ns_lookup_byname"; 2539*8c155366SJordan Brown static size_t pwdbufsiz = 0; 2540*8c155366SJordan Brown static size_t grpbufsiz = 0; 2541c5c4113dSnw 2542e8c27ec8Sbaban switch (id->idtype) { 2543e8c27ec8Sbaban case IDMAP_UID: 2544*8c155366SJordan Brown if (pwdbufsiz == 0) 2545*8c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX); 2546*8c155366SJordan Brown buf = alloca(pwdbufsiz); 2547*8c155366SJordan Brown pwdp = getpwnam_r(name, &pwd, buf, pwdbufsiz); 2548e8c27ec8Sbaban if (pwdp == NULL && errno == 0 && lower_name != NULL && 2549cd37da74Snw name != lower_name && strcmp(name, lower_name) != 0) 2550*8c155366SJordan Brown pwdp = getpwnam_r(lower_name, &pwd, buf, pwdbufsiz); 2551cd37da74Snw if (pwdp == NULL) { 2552c5c4113dSnw errnum = errno; 2553c5c4113dSnw idmapdlog(LOG_WARNING, 2554cd37da74Snw "%s: getpwnam_r(%s) failed (%s).", 2555cd37da74Snw me, name, errnum ? strerror(errnum) : "not found"); 2556c5c4113dSnw if (errnum == 0) 2557c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 2558c5c4113dSnw else 2559c5c4113dSnw return (IDMAP_ERR_INTERNAL); 2560c5c4113dSnw } 2561e8c27ec8Sbaban id->idmap_id_u.uid = pwd.pw_uid; 2562e8c27ec8Sbaban break; 2563e8c27ec8Sbaban case IDMAP_GID: 2564*8c155366SJordan Brown if (grpbufsiz == 0) 2565*8c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX); 2566*8c155366SJordan Brown buf = alloca(grpbufsiz); 2567*8c155366SJordan Brown grpp = getgrnam_r(name, &grp, buf, grpbufsiz); 2568e8c27ec8Sbaban if (grpp == NULL && errno == 0 && lower_name != NULL && 2569cd37da74Snw name != lower_name && strcmp(name, lower_name) != 0) 2570*8c155366SJordan Brown grpp = getgrnam_r(lower_name, &grp, buf, grpbufsiz); 2571cd37da74Snw if (grpp == NULL) { 2572c5c4113dSnw errnum = errno; 2573c5c4113dSnw idmapdlog(LOG_WARNING, 2574cd37da74Snw "%s: getgrnam_r(%s) failed (%s).", 2575cd37da74Snw me, name, errnum ? strerror(errnum) : "not found"); 2576c5c4113dSnw if (errnum == 0) 2577c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 2578c5c4113dSnw else 2579c5c4113dSnw return (IDMAP_ERR_INTERNAL); 2580c5c4113dSnw } 2581e8c27ec8Sbaban id->idmap_id_u.gid = grp.gr_gid; 2582e8c27ec8Sbaban break; 2583e8c27ec8Sbaban default: 2584e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2585e8c27ec8Sbaban } 2586e8c27ec8Sbaban return (IDMAP_SUCCESS); 2587e8c27ec8Sbaban } 2588e8c27ec8Sbaban 2589e8c27ec8Sbaban 2590e8c27ec8Sbaban /* 2591e8c27ec8Sbaban * Name service lookup by pid to get unixname 2592e8c27ec8Sbaban */ 2593e8c27ec8Sbaban static 2594e8c27ec8Sbaban idmap_retcode 2595e8c27ec8Sbaban ns_lookup_bypid(uid_t pid, int is_user, char **unixname) 2596e8c27ec8Sbaban { 2597e8c27ec8Sbaban struct passwd pwd; 2598e8c27ec8Sbaban struct group grp; 2599*8c155366SJordan Brown char *buf; 2600e8c27ec8Sbaban int errnum; 2601e8c27ec8Sbaban const char *me = "ns_lookup_bypid"; 2602*8c155366SJordan Brown static size_t pwdbufsiz = 0; 2603*8c155366SJordan Brown static size_t grpbufsiz = 0; 2604e8c27ec8Sbaban 2605e8c27ec8Sbaban if (is_user) { 2606*8c155366SJordan Brown if (pwdbufsiz == 0) 2607*8c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX); 2608*8c155366SJordan Brown buf = alloca(pwdbufsiz); 2609e8c27ec8Sbaban errno = 0; 2610*8c155366SJordan Brown if (getpwuid_r(pid, &pwd, buf, pwdbufsiz) == NULL) { 2611e8c27ec8Sbaban errnum = errno; 2612e8c27ec8Sbaban idmapdlog(LOG_WARNING, 2613e8c27ec8Sbaban "%s: getpwuid_r(%u) failed (%s).", 2614e8c27ec8Sbaban me, pid, errnum ? strerror(errnum) : "not found"); 2615e8c27ec8Sbaban if (errnum == 0) 2616e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2617e8c27ec8Sbaban else 2618e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL); 2619e8c27ec8Sbaban } 2620e8c27ec8Sbaban *unixname = strdup(pwd.pw_name); 2621e8c27ec8Sbaban } else { 2622*8c155366SJordan Brown if (grpbufsiz == 0) 2623*8c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX); 2624*8c155366SJordan Brown buf = alloca(grpbufsiz); 2625e8c27ec8Sbaban errno = 0; 2626*8c155366SJordan Brown if (getgrgid_r(pid, &grp, buf, grpbufsiz) == NULL) { 2627e8c27ec8Sbaban errnum = errno; 2628e8c27ec8Sbaban idmapdlog(LOG_WARNING, 2629e8c27ec8Sbaban "%s: getgrgid_r(%u) failed (%s).", 2630e8c27ec8Sbaban me, pid, errnum ? strerror(errnum) : "not found"); 2631e8c27ec8Sbaban if (errnum == 0) 2632e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2633e8c27ec8Sbaban else 2634e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL); 2635e8c27ec8Sbaban } 2636e8c27ec8Sbaban *unixname = strdup(grp.gr_name); 2637c5c4113dSnw } 2638e8c27ec8Sbaban if (*unixname == NULL) 2639e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 2640c5c4113dSnw return (IDMAP_SUCCESS); 2641c5c4113dSnw } 2642c5c4113dSnw 2643c5c4113dSnw /* 2644c5c4113dSnw * Name-based mapping 2645c5c4113dSnw * 2646c5c4113dSnw * Case 1: If no rule matches do ephemeral 2647c5c4113dSnw * 2648c5c4113dSnw * Case 2: If rule matches and unixname is "" then return no mapping. 2649c5c4113dSnw * 2650c5c4113dSnw * Case 3: If rule matches and unixname is specified then lookup name 2651c5c4113dSnw * service using the unixname. If unixname not found then return no mapping. 2652c5c4113dSnw * 2653c5c4113dSnw * Case 4: If rule matches and unixname is * then lookup name service 2654c5c4113dSnw * using winname as the unixname. If unixname not found then process 2655c5c4113dSnw * other rules using the lookup order. If no other rule matches then do 2656c5c4113dSnw * ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4. 2657c5c4113dSnw * This allows us to specify a fallback unixname per _domain_ or no mapping 2658c5c4113dSnw * instead of the default behaviour of doing ephemeral mapping. 2659c5c4113dSnw * 2660c5c4113dSnw * Example 1: 2661c5c4113dSnw * *@sfbay == * 2662c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2663c5c4113dSnw * the name service then foo@sfbay will be mapped to an ephemeral id. 2664c5c4113dSnw * 2665c5c4113dSnw * Example 2: 2666c5c4113dSnw * *@sfbay == * 2667c5c4113dSnw * *@sfbay => guest 2668c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2669c5c4113dSnw * the name service then foo@sfbay will be mapped to guest. 2670c5c4113dSnw * 2671c5c4113dSnw * Example 3: 2672c5c4113dSnw * *@sfbay == * 2673c5c4113dSnw * *@sfbay => "" 2674c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2675c5c4113dSnw * the name service then we will return no mapping for foo@sfbay. 2676c5c4113dSnw * 2677c5c4113dSnw */ 2678cd37da74Snw static 2679cd37da74Snw idmap_retcode 2680479ac375Sdm name_based_mapping_sid2pid(lookup_state_t *state, 2681479ac375Sdm idmap_mapping *req, idmap_id_res *res) 2682cd37da74Snw { 2683cd37da74Snw const char *unixname, *windomain; 2684cd37da74Snw char *sql = NULL, *errmsg = NULL, *lower_winname = NULL; 2685c5c4113dSnw idmap_retcode retcode; 2686cd37da74Snw char *end, *lower_unixname, *winname; 2687c5c4113dSnw const char **values; 2688c5c4113dSnw sqlite_vm *vm = NULL; 2689cd37da74Snw int ncol, r, i, is_user, is_wuser; 269048258c6bSjp idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 269148258c6bSjp int direction; 2692c5c4113dSnw const char *me = "name_based_mapping_sid2pid"; 2693c5c4113dSnw 2694e8c27ec8Sbaban assert(req->id1name != NULL); /* We have winname */ 2695e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have unixname */ 2696e8c27ec8Sbaban 26978e228215Sdm winname = req->id1name; 26988e228215Sdm windomain = req->id1domain; 2699cd37da74Snw 2700cd37da74Snw switch (req->id1.idtype) { 2701cd37da74Snw case IDMAP_USID: 2702cd37da74Snw is_wuser = 1; 2703cd37da74Snw break; 2704cd37da74Snw case IDMAP_GSID: 2705cd37da74Snw is_wuser = 0; 2706cd37da74Snw break; 2707cd37da74Snw default: 2708e8c27ec8Sbaban idmapdlog(LOG_ERR, "%s: Unable to determine if the " 2709e8c27ec8Sbaban "given Windows id is user or group.", me); 2710cd37da74Snw return (IDMAP_ERR_INTERNAL); 2711cd37da74Snw } 2712cd37da74Snw 2713e8c27ec8Sbaban switch (res->id.idtype) { 2714cd37da74Snw case IDMAP_UID: 2715cd37da74Snw is_user = 1; 2716cd37da74Snw break; 2717cd37da74Snw case IDMAP_GID: 2718cd37da74Snw is_user = 0; 2719cd37da74Snw break; 2720cd37da74Snw case IDMAP_POSIXID: 2721cd37da74Snw is_user = is_wuser; 2722cd37da74Snw res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID; 2723cd37da74Snw break; 2724cd37da74Snw } 2725c5c4113dSnw 2726c5c4113dSnw i = 0; 2727479ac375Sdm if (windomain == NULL) 272862c60062Sbaban windomain = ""; 272982da9f60Sbaban else if (state->defdom != NULL && 273082da9f60Sbaban strcasecmp(state->defdom, windomain) == 0) 2731479ac375Sdm i = 1; 2732c5c4113dSnw 2733cd37da74Snw if ((lower_winname = tolower_u8(winname)) == NULL) 2734cd37da74Snw lower_winname = winname; /* hope for the best */ 2735c5c4113dSnw sql = sqlite_mprintf( 273648258c6bSjp "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 " 273748258c6bSjp "FROM namerules WHERE " 2738cd37da74Snw "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND " 2739cd37da74Snw "(winname = %Q OR winname = '*') AND " 2740cd37da74Snw "(windomain = %Q OR windomain = '*' %s) " 2741cd37da74Snw "ORDER BY w2u_order ASC;", 2742cd37da74Snw is_user, is_wuser, lower_winname, windomain, 2743cd37da74Snw i ? "OR windomain ISNULL OR windomain = ''" : ""); 2744c5c4113dSnw if (sql == NULL) { 2745c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 2746c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 2747c5c4113dSnw goto out; 2748c5c4113dSnw } 2749c5c4113dSnw 2750479ac375Sdm if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 2751c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 2752cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 2753cd37da74Snw CHECK_NULL(errmsg)); 2754c5c4113dSnw sqlite_freemem(errmsg); 2755c5c4113dSnw goto out; 2756c5c4113dSnw } 2757c5c4113dSnw 275848258c6bSjp for (;;) { 2759c5c4113dSnw r = sqlite_step(vm, &ncol, &values, NULL); 276084decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 2761c5c4113dSnw 276284decf41Sjp if (r == SQLITE_ROW) { 276348258c6bSjp if (ncol < 5) { 2764c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 2765c5c4113dSnw goto out; 2766c5c4113dSnw } 2767c5c4113dSnw if (values[0] == NULL) { 2768c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 2769c5c4113dSnw goto out; 2770c5c4113dSnw } 2771c5c4113dSnw 277248258c6bSjp if (values[1] != NULL) 277348258c6bSjp direction = 277448258c6bSjp (strtol(values[1], &end, 10) == 0)? 277548258c6bSjp IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 277648258c6bSjp else 277748258c6bSjp direction = IDMAP_DIRECTION_W2U; 277848258c6bSjp 2779c5c4113dSnw if (EMPTY_NAME(values[0])) { 278048258c6bSjp idmap_namerule_set(rule, values[3], values[2], 278148258c6bSjp values[0], is_wuser, is_user, 278248258c6bSjp strtol(values[4], &end, 10), 278348258c6bSjp direction); 2784c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 2785c5c4113dSnw goto out; 2786c5c4113dSnw } 278748258c6bSjp 278848258c6bSjp if (values[0][0] == '*') { 278948258c6bSjp unixname = winname; 279048258c6bSjp lower_unixname = lower_winname; 279148258c6bSjp } else { 279248258c6bSjp unixname = values[0]; 279348258c6bSjp lower_unixname = NULL; 279448258c6bSjp } 279548258c6bSjp 2796e8c27ec8Sbaban retcode = ns_lookup_byname(unixname, lower_unixname, 2797e8c27ec8Sbaban &res->id); 2798c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) { 279948258c6bSjp if (values[0][0] == '*') 2800c5c4113dSnw /* Case 4 */ 2801c5c4113dSnw continue; 280248258c6bSjp else { 2803c5c4113dSnw /* Case 3 */ 280448258c6bSjp idmap_namerule_set(rule, values[3], 280548258c6bSjp values[2], values[0], is_wuser, 280648258c6bSjp is_user, 280748258c6bSjp strtol(values[4], &end, 10), 280848258c6bSjp direction); 2809c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 281048258c6bSjp } 2811c5c4113dSnw } 2812c5c4113dSnw goto out; 2813c5c4113dSnw } else if (r == SQLITE_DONE) { 2814c5c4113dSnw retcode = IDMAP_ERR_NOTFOUND; 2815c5c4113dSnw goto out; 2816c5c4113dSnw } else { 2817c5c4113dSnw (void) sqlite_finalize(vm, &errmsg); 2818c5c4113dSnw vm = NULL; 2819cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 2820cd37da74Snw CHECK_NULL(errmsg)); 2821c5c4113dSnw sqlite_freemem(errmsg); 2822c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 2823c5c4113dSnw goto out; 2824c5c4113dSnw } 2825c5c4113dSnw } 2826c5c4113dSnw 2827c5c4113dSnw out: 282848258c6bSjp if (sql != NULL) 282948258c6bSjp sqlite_freemem(sql); 2830c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 283162c60062Sbaban if (values[1] != NULL) 2832c5c4113dSnw res->direction = 2833651c0131Sbaban (strtol(values[1], &end, 10) == 0)? 2834651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 2835c5c4113dSnw else 2836651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U; 283748258c6bSjp 28388e228215Sdm req->id2name = strdup(unixname); 2839479ac375Sdm if (req->id2name == NULL) { 2840479ac375Sdm retcode = IDMAP_ERR_MEMORY; 2841479ac375Sdm } 2842479ac375Sdm } 2843479ac375Sdm 2844479ac375Sdm if (retcode == IDMAP_SUCCESS) { 284548258c6bSjp idmap_namerule_set(rule, values[3], values[2], 284648258c6bSjp values[0], is_wuser, is_user, strtol(values[4], &end, 10), 284748258c6bSjp res->direction); 2848fc724630SAlan Wright } 2849fc724630SAlan Wright 2850fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) { 2851fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 285248258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 2853c5c4113dSnw } 2854479ac375Sdm 2855cd37da74Snw if (lower_winname != NULL && lower_winname != winname) 2856cd37da74Snw free(lower_winname); 285762c60062Sbaban if (vm != NULL) 2858c5c4113dSnw (void) sqlite_finalize(vm, NULL); 2859c5c4113dSnw return (retcode); 2860c5c4113dSnw } 2861c5c4113dSnw 2862c5c4113dSnw static 2863c5c4113dSnw int 2864c5c4113dSnw get_next_eph_uid(uid_t *next_uid) 2865c5c4113dSnw { 2866c5c4113dSnw uid_t uid; 2867c5c4113dSnw gid_t gid; 2868c5c4113dSnw int err; 2869c5c4113dSnw 2870c5c4113dSnw *next_uid = (uid_t)-1; 2871c5c4113dSnw uid = _idmapdstate.next_uid++; 2872c5c4113dSnw if (uid >= _idmapdstate.limit_uid) { 2873c5c4113dSnw if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0) 2874c5c4113dSnw return (err); 2875c5c4113dSnw 2876c5c4113dSnw _idmapdstate.limit_uid = uid + 8192; 2877c5c4113dSnw _idmapdstate.next_uid = uid; 2878c5c4113dSnw } 2879c5c4113dSnw *next_uid = uid; 2880c5c4113dSnw 2881c5c4113dSnw return (0); 2882c5c4113dSnw } 2883c5c4113dSnw 2884c5c4113dSnw static 2885c5c4113dSnw int 2886c5c4113dSnw get_next_eph_gid(gid_t *next_gid) 2887c5c4113dSnw { 2888c5c4113dSnw uid_t uid; 2889c5c4113dSnw gid_t gid; 2890c5c4113dSnw int err; 2891c5c4113dSnw 2892c5c4113dSnw *next_gid = (uid_t)-1; 2893c5c4113dSnw gid = _idmapdstate.next_gid++; 2894c5c4113dSnw if (gid >= _idmapdstate.limit_gid) { 2895c5c4113dSnw if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0) 2896c5c4113dSnw return (err); 2897c5c4113dSnw 2898c5c4113dSnw _idmapdstate.limit_gid = gid + 8192; 2899c5c4113dSnw _idmapdstate.next_gid = gid; 2900c5c4113dSnw } 2901c5c4113dSnw *next_gid = gid; 2902c5c4113dSnw 2903c5c4113dSnw return (0); 2904c5c4113dSnw } 2905c5c4113dSnw 290662c60062Sbaban static 290762c60062Sbaban int 2908cd37da74Snw gethash(const char *str, uint32_t num, uint_t htsize) 2909cd37da74Snw { 291062c60062Sbaban uint_t hval, i, len; 291162c60062Sbaban 291262c60062Sbaban if (str == NULL) 291362c60062Sbaban return (0); 291462c60062Sbaban for (len = strlen(str), hval = 0, i = 0; i < len; i++) { 291562c60062Sbaban hval += str[i]; 291662c60062Sbaban hval += (hval << 10); 291762c60062Sbaban hval ^= (hval >> 6); 291862c60062Sbaban } 291962c60062Sbaban for (str = (const char *)&num, i = 0; i < sizeof (num); i++) { 292062c60062Sbaban hval += str[i]; 292162c60062Sbaban hval += (hval << 10); 292262c60062Sbaban hval ^= (hval >> 6); 292362c60062Sbaban } 292462c60062Sbaban hval += (hval << 3); 292562c60062Sbaban hval ^= (hval >> 11); 292662c60062Sbaban hval += (hval << 15); 292762c60062Sbaban return (hval % htsize); 292862c60062Sbaban } 292962c60062Sbaban 293062c60062Sbaban static 293162c60062Sbaban int 293262c60062Sbaban get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid, 2933cd37da74Snw uid_t *pid) 2934cd37da74Snw { 293562c60062Sbaban uint_t next, key; 293662c60062Sbaban uint_t htsize = state->sid_history_size; 293762c60062Sbaban idmap_sid *sid; 293862c60062Sbaban 293962c60062Sbaban next = gethash(prefix, rid, htsize); 294062c60062Sbaban while (next != htsize) { 294162c60062Sbaban key = state->sid_history[next].key; 294262c60062Sbaban if (key == htsize) 294362c60062Sbaban return (0); 294462c60062Sbaban sid = &state->batch->idmap_mapping_batch_val[key].id1. 294562c60062Sbaban idmap_id_u.sid; 294662c60062Sbaban if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) { 294762c60062Sbaban *pid = state->result->ids.ids_val[key].id. 294862c60062Sbaban idmap_id_u.uid; 294962c60062Sbaban return (1); 295062c60062Sbaban } 295162c60062Sbaban next = state->sid_history[next].next; 295262c60062Sbaban } 295362c60062Sbaban return (0); 295462c60062Sbaban } 295562c60062Sbaban 295662c60062Sbaban static 295762c60062Sbaban void 2958cd37da74Snw add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid) 2959cd37da74Snw { 296062c60062Sbaban uint_t hash, next; 296162c60062Sbaban uint_t htsize = state->sid_history_size; 296262c60062Sbaban 296362c60062Sbaban hash = next = gethash(prefix, rid, htsize); 296462c60062Sbaban while (state->sid_history[next].key != htsize) { 296562c60062Sbaban next++; 296662c60062Sbaban next %= htsize; 296762c60062Sbaban } 296862c60062Sbaban state->sid_history[next].key = state->curpos; 296962c60062Sbaban if (hash == next) 297062c60062Sbaban return; 297162c60062Sbaban state->sid_history[next].next = state->sid_history[hash].next; 297262c60062Sbaban state->sid_history[hash].next = next; 297362c60062Sbaban } 2974c5c4113dSnw 2975e8c27ec8Sbaban void 2976e8c27ec8Sbaban cleanup_lookup_state(lookup_state_t *state) 2977e8c27ec8Sbaban { 2978e8c27ec8Sbaban free(state->sid_history); 2979e8c27ec8Sbaban free(state->ad_unixuser_attr); 2980e8c27ec8Sbaban free(state->ad_unixgroup_attr); 2981479ac375Sdm free(state->nldap_winname_attr); 2982479ac375Sdm free(state->defdom); 2983e8c27ec8Sbaban } 2984e8c27ec8Sbaban 2985c5c4113dSnw /* ARGSUSED */ 2986c5c4113dSnw static 2987c5c4113dSnw idmap_retcode 2988479ac375Sdm dynamic_ephemeral_mapping(lookup_state_t *state, 2989cd37da74Snw idmap_mapping *req, idmap_id_res *res) 2990cd37da74Snw { 2991c5c4113dSnw 2992c5c4113dSnw uid_t next_pid; 2993c5c4113dSnw 299462c60062Sbaban res->direction = IDMAP_DIRECTION_BI; 299562c60062Sbaban 299648258c6bSjp if (IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 299748258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 299848258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 299962c60062Sbaban return (IDMAP_SUCCESS); 300048258c6bSjp } 300162c60062Sbaban 300262c60062Sbaban if (state->sid_history != NULL && 300362c60062Sbaban get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix, 300462c60062Sbaban req->id1.idmap_id_u.sid.rid, &next_pid)) { 300562c60062Sbaban res->id.idmap_id_u.uid = next_pid; 300648258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 300748258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 300862c60062Sbaban return (IDMAP_SUCCESS); 300962c60062Sbaban } 301062c60062Sbaban 301162c60062Sbaban if (res->id.idtype == IDMAP_UID) { 3012c5c4113dSnw if (get_next_eph_uid(&next_pid) != 0) 3013c5c4113dSnw return (IDMAP_ERR_INTERNAL); 3014c5c4113dSnw res->id.idmap_id_u.uid = next_pid; 3015c5c4113dSnw } else { 3016c5c4113dSnw if (get_next_eph_gid(&next_pid) != 0) 3017c5c4113dSnw return (IDMAP_ERR_INTERNAL); 3018c5c4113dSnw res->id.idmap_id_u.gid = next_pid; 3019c5c4113dSnw } 3020c5c4113dSnw 302148258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 302248258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 302362c60062Sbaban if (state->sid_history != NULL) 302462c60062Sbaban add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix, 302562c60062Sbaban req->id1.idmap_id_u.sid.rid); 302662c60062Sbaban 3027c5c4113dSnw return (IDMAP_SUCCESS); 3028c5c4113dSnw } 3029c5c4113dSnw 3030c5c4113dSnw idmap_retcode 3031479ac375Sdm sid2pid_second_pass(lookup_state_t *state, 3032cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3033cd37da74Snw { 3034c5c4113dSnw idmap_retcode retcode; 3035c5c4113dSnw 3036c5c4113dSnw /* Check if second pass is needed */ 3037e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3038c5c4113dSnw return (res->retcode); 3039c5c4113dSnw 3040c5c4113dSnw /* Get status from previous pass */ 3041e8c27ec8Sbaban retcode = res->retcode; 30424aa0a5e7Snw if (retcode != IDMAP_SUCCESS && state->eph_map_unres_sids && 30434aa0a5e7Snw !EMPTY_STRING(req->id1.idmap_id_u.sid.prefix) && 30444aa0a5e7Snw EMPTY_STRING(req->id1name)) { 30454aa0a5e7Snw /* 30464aa0a5e7Snw * We are asked to map an unresolvable SID to a UID or 30474aa0a5e7Snw * GID, but, which? We'll treat all unresolvable SIDs 30484aa0a5e7Snw * as users unless the caller specified which of a UID 30494aa0a5e7Snw * or GID they want. 30504aa0a5e7Snw */ 3051a7c8bd9fSNicolas Williams if (req->id1.idtype == IDMAP_SID) 3052a7c8bd9fSNicolas Williams req->id1.idtype = IDMAP_USID; 30534aa0a5e7Snw if (res->id.idtype == IDMAP_POSIXID) 30544aa0a5e7Snw res->id.idtype = IDMAP_UID; 30554aa0a5e7Snw goto do_eph; 30564aa0a5e7Snw } 3057e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 3058e8c27ec8Sbaban goto out; 3059c5c4113dSnw 3060e8c27ec8Sbaban /* 3061e8c27ec8Sbaban * If directory-based name mapping is enabled then the unixname 3062e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode or 3063e8c27ec8Sbaban * mixed-mode) or from native LDAP object (nldap-mode) -- done. 3064e8c27ec8Sbaban */ 3065e8c27ec8Sbaban if (req->id2name != NULL) { 3066e8c27ec8Sbaban assert(res->id.idtype != IDMAP_POSIXID); 3067e8c27ec8Sbaban if (AD_MODE(res->id.idtype, state)) 3068e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 3069e8c27ec8Sbaban else if (NLDAP_MODE(res->id.idtype, state)) 3070e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 3071e8c27ec8Sbaban else if (MIXED_MODE(res->id.idtype, state)) 3072e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U; 3073c5c4113dSnw 3074e8c27ec8Sbaban /* 3075e8c27ec8Sbaban * Special case: (1) If the ad_unixuser_attr and 3076e8c27ec8Sbaban * ad_unixgroup_attr uses the same attribute 3077e8c27ec8Sbaban * name and (2) if this is a diagonal mapping 3078e8c27ec8Sbaban * request and (3) the unixname has been retrieved 3079e8c27ec8Sbaban * from the AD object -- then we ignore it and fallback 3080e8c27ec8Sbaban * to name-based mapping rules and ephemeral mapping 3081e8c27ec8Sbaban * 3082e8c27ec8Sbaban * Example: 3083e8c27ec8Sbaban * Properties: 3084e8c27ec8Sbaban * config/ad_unixuser_attr = "unixname" 3085e8c27ec8Sbaban * config/ad_unixgroup_attr = "unixname" 3086e8c27ec8Sbaban * AD user object: 3087e8c27ec8Sbaban * dn: cn=bob ... 3088e8c27ec8Sbaban * objectclass: user 3089e8c27ec8Sbaban * sam: bob 3090e8c27ec8Sbaban * unixname: bob1234 3091e8c27ec8Sbaban * AD group object: 3092e8c27ec8Sbaban * dn: cn=winadmins ... 3093e8c27ec8Sbaban * objectclass: group 3094e8c27ec8Sbaban * sam: winadmins 3095e8c27ec8Sbaban * unixname: unixadmins 3096e8c27ec8Sbaban * 3097e8c27ec8Sbaban * In this example whether "unixname" refers to a unixuser 3098e8c27ec8Sbaban * or unixgroup depends upon the AD object. 3099e8c27ec8Sbaban * 3100e8c27ec8Sbaban * $idmap show -c winname:bob gid 3101e8c27ec8Sbaban * AD lookup by "samAccountName=bob" for 3102e8c27ec8Sbaban * "ad_unixgroup_attr (i.e unixname)" for directory-based 3103e8c27ec8Sbaban * mapping would get "bob1234" which is not what we want. 3104e8c27ec8Sbaban * Now why not getgrnam_r("bob1234") and use it if it 3105e8c27ec8Sbaban * is indeed a unixgroup? That's because Unix can have 3106e8c27ec8Sbaban * users and groups with the same name and we clearly 3107e8c27ec8Sbaban * don't know the intention of the admin here. 3108e8c27ec8Sbaban * Therefore we ignore this and fallback to name-based 3109e8c27ec8Sbaban * mapping rules or ephemeral mapping. 3110e8c27ec8Sbaban */ 3111e8c27ec8Sbaban if ((AD_MODE(res->id.idtype, state) || 3112e8c27ec8Sbaban MIXED_MODE(res->id.idtype, state)) && 3113e8c27ec8Sbaban state->ad_unixuser_attr != NULL && 3114e8c27ec8Sbaban state->ad_unixgroup_attr != NULL && 3115e8c27ec8Sbaban strcasecmp(state->ad_unixuser_attr, 3116e8c27ec8Sbaban state->ad_unixgroup_attr) == 0 && 3117e8c27ec8Sbaban ((req->id1.idtype == IDMAP_USID && 3118e8c27ec8Sbaban res->id.idtype == IDMAP_GID) || 3119e8c27ec8Sbaban (req->id1.idtype == IDMAP_GSID && 3120e8c27ec8Sbaban res->id.idtype == IDMAP_UID))) { 3121e8c27ec8Sbaban free(req->id2name); 3122e8c27ec8Sbaban req->id2name = NULL; 3123e8c27ec8Sbaban res->id.idmap_id_u.uid = SENTINEL_PID; 3124e8c27ec8Sbaban /* fallback */ 3125e8c27ec8Sbaban } else { 3126e8c27ec8Sbaban if (res->id.idmap_id_u.uid == SENTINEL_PID) 3127e8c27ec8Sbaban retcode = ns_lookup_byname(req->id2name, 3128e8c27ec8Sbaban NULL, &res->id); 3129e8c27ec8Sbaban /* 3130479ac375Sdm * If ns_lookup_byname() fails that means the 3131479ac375Sdm * unixname (req->id2name), which was obtained 3132479ac375Sdm * from the AD object by directory-based mapping, 3133479ac375Sdm * is not a valid Unix user/group and therefore 3134479ac375Sdm * we return the error to the client instead of 3135479ac375Sdm * doing rule-based mapping or ephemeral mapping. 3136479ac375Sdm * This way the client can detect the issue. 3137e8c27ec8Sbaban */ 3138e8c27ec8Sbaban goto out; 3139c5c4113dSnw } 3140c5c4113dSnw } 3141c5c4113dSnw 314248258c6bSjp /* Free any mapping info from Directory based mapping */ 314348258c6bSjp if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 314448258c6bSjp idmap_info_free(&res->info); 314548258c6bSjp 3146e8c27ec8Sbaban /* 3147e8c27ec8Sbaban * If we don't have unixname then evaluate local name-based 3148e8c27ec8Sbaban * mapping rules. 3149e8c27ec8Sbaban */ 3150479ac375Sdm retcode = name_based_mapping_sid2pid(state, req, res); 3151e8c27ec8Sbaban if (retcode != IDMAP_ERR_NOTFOUND) 3152c5c4113dSnw goto out; 3153c5c4113dSnw 31544aa0a5e7Snw do_eph: 3155e8c27ec8Sbaban /* If not found, do ephemeral mapping */ 3156479ac375Sdm retcode = dynamic_ephemeral_mapping(state, req, res); 3157c5c4113dSnw 3158c5c4113dSnw out: 3159c5c4113dSnw res->retcode = idmap_stat4prot(retcode); 3160e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 3161e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 3162e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY; 3163e8c27ec8Sbaban } 3164e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction)) 3165e8c27ec8Sbaban state->sid2pid_done = FALSE; 3166c5c4113dSnw return (retcode); 3167c5c4113dSnw } 3168c5c4113dSnw 3169c5c4113dSnw idmap_retcode 3170479ac375Sdm update_cache_pid2sid(lookup_state_t *state, 3171cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3172cd37da74Snw { 3173c5c4113dSnw char *sql = NULL; 3174c5c4113dSnw idmap_retcode retcode; 317548258c6bSjp char *map_dn = NULL; 317648258c6bSjp char *map_attr = NULL; 317748258c6bSjp char *map_value = NULL; 317848258c6bSjp char *map_windomain = NULL; 317948258c6bSjp char *map_winname = NULL; 318048258c6bSjp char *map_unixname = NULL; 318148258c6bSjp int map_is_nt4 = FALSE; 3182c5c4113dSnw 3183c5c4113dSnw /* Check if we need to cache anything */ 3184e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3185c5c4113dSnw return (IDMAP_SUCCESS); 3186c5c4113dSnw 3187c5c4113dSnw /* We don't cache negative entries */ 3188c5c4113dSnw if (res->retcode != IDMAP_SUCCESS) 3189c5c4113dSnw return (IDMAP_SUCCESS); 3190c5c4113dSnw 3191e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF); 319248258c6bSjp assert(req->id1.idmap_id_u.uid != SENTINEL_PID); 319348258c6bSjp assert(res->id.idtype != IDMAP_SID); 319448258c6bSjp 319548258c6bSjp assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN); 319648258c6bSjp switch (res->info.how.map_type) { 319748258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 319848258c6bSjp map_dn = res->info.how.idmap_how_u.ad.dn; 319948258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 320048258c6bSjp map_value = res->info.how.idmap_how_u.ad.value; 320148258c6bSjp break; 320248258c6bSjp 320348258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 320448258c6bSjp map_dn = res->info.how.idmap_how_u.nldap.dn; 320548258c6bSjp map_attr = res->info.how.idmap_how_u.nldap.attr; 320648258c6bSjp map_value = res->info.how.idmap_how_u.nldap.value; 320748258c6bSjp break; 320848258c6bSjp 320948258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 321048258c6bSjp map_windomain = res->info.how.idmap_how_u.rule.windomain; 321148258c6bSjp map_winname = res->info.how.idmap_how_u.rule.winname; 321248258c6bSjp map_unixname = res->info.how.idmap_how_u.rule.unixname; 321348258c6bSjp map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 321448258c6bSjp break; 321548258c6bSjp 321648258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 321748258c6bSjp break; 321848258c6bSjp 321948258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 322048258c6bSjp break; 322148258c6bSjp 322248258c6bSjp default: 322348258c6bSjp /* Dont cache other mapping types */ 322448258c6bSjp assert(FALSE); 322548258c6bSjp } 3226e8c27ec8Sbaban 3227c5c4113dSnw /* 3228c5c4113dSnw * Using NULL for u2w instead of 0 so that our trigger allows 3229c5c4113dSnw * the same pid to be the destination in multiple entries 3230c5c4113dSnw */ 3231c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3232cd37da74Snw "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 323348258c6bSjp "is_user, is_wuser, expiration, w2u, u2w, " 323448258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 323548258c6bSjp "map_winname, map_unixname, map_is_nt4) " 3236cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 323748258c6bSjp "strftime('%%s','now') + 600, %q, 1, " 323848258c6bSjp "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ", 3239cd37da74Snw res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3240cd37da74Snw req->id2domain, req->id2name, req->id1.idmap_id_u.uid, 3241cd37da74Snw req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0, 3242e8c27ec8Sbaban (res->id.idtype == IDMAP_USID) ? 1 : 0, 324348258c6bSjp (res->direction == 0) ? "1" : NULL, 324448258c6bSjp res->info.how.map_type, map_dn, map_attr, map_value, 324548258c6bSjp map_windomain, map_winname, map_unixname, map_is_nt4); 3246c5c4113dSnw 3247c5c4113dSnw if (sql == NULL) { 3248c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3249c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3250c5c4113dSnw goto out; 3251c5c4113dSnw } 3252c5c4113dSnw 3253479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3254c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3255c5c4113dSnw goto out; 3256c5c4113dSnw 3257c5c4113dSnw state->pid2sid_done = FALSE; 3258c5c4113dSnw sqlite_freemem(sql); 3259c5c4113dSnw sql = NULL; 3260c5c4113dSnw 3261e8c27ec8Sbaban /* Check if we need to update namecache */ 3262e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3263c5c4113dSnw goto out; 3264c5c4113dSnw 32658e228215Sdm if (req->id2name == NULL) 3266c5c4113dSnw goto out; 3267c5c4113dSnw 3268c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3269cd37da74Snw "(sidprefix, rid, canon_name, domain, type, expiration) " 3270cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3271cd37da74Snw res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3272cd37da74Snw req->id2name, req->id2domain, 3273e8c27ec8Sbaban (res->id.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP); 3274c5c4113dSnw 3275c5c4113dSnw if (sql == NULL) { 3276c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3277c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3278c5c4113dSnw goto out; 3279c5c4113dSnw } 3280c5c4113dSnw 3281479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3282c5c4113dSnw 3283c5c4113dSnw out: 328448258c6bSjp if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO)) 328548258c6bSjp idmap_info_free(&res->info); 328662c60062Sbaban if (sql != NULL) 3287c5c4113dSnw sqlite_freemem(sql); 3288c5c4113dSnw return (retcode); 3289c5c4113dSnw } 3290c5c4113dSnw 3291c5c4113dSnw idmap_retcode 3292479ac375Sdm update_cache_sid2pid(lookup_state_t *state, 3293cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3294cd37da74Snw { 3295c5c4113dSnw char *sql = NULL; 3296c5c4113dSnw idmap_retcode retcode; 3297c5c4113dSnw int is_eph_user; 329848258c6bSjp char *map_dn = NULL; 329948258c6bSjp char *map_attr = NULL; 330048258c6bSjp char *map_value = NULL; 330148258c6bSjp char *map_windomain = NULL; 330248258c6bSjp char *map_winname = NULL; 330348258c6bSjp char *map_unixname = NULL; 330448258c6bSjp int map_is_nt4 = FALSE; 3305c5c4113dSnw 3306c5c4113dSnw /* Check if we need to cache anything */ 3307e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3308c5c4113dSnw return (IDMAP_SUCCESS); 3309c5c4113dSnw 3310c5c4113dSnw /* We don't cache negative entries */ 3311c5c4113dSnw if (res->retcode != IDMAP_SUCCESS) 3312c5c4113dSnw return (IDMAP_SUCCESS); 3313c5c4113dSnw 3314c5c4113dSnw if (req->direction & _IDMAP_F_EXP_EPH_UID) 3315c5c4113dSnw is_eph_user = 1; 3316c5c4113dSnw else if (req->direction & _IDMAP_F_EXP_EPH_GID) 3317c5c4113dSnw is_eph_user = 0; 3318c5c4113dSnw else 3319c5c4113dSnw is_eph_user = -1; 3320c5c4113dSnw 3321c5c4113dSnw if (is_eph_user >= 0 && !IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 3322c5c4113dSnw sql = sqlite_mprintf("UPDATE idmap_cache " 3323cd37da74Snw "SET w2u = 0 WHERE " 3324cd37da74Snw "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 3325cd37da74Snw "pid >= 2147483648 AND is_user = %d;", 3326cd37da74Snw req->id1.idmap_id_u.sid.prefix, 3327cd37da74Snw req->id1.idmap_id_u.sid.rid, 3328cd37da74Snw is_eph_user); 3329c5c4113dSnw if (sql == NULL) { 3330c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3331c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3332c5c4113dSnw goto out; 3333c5c4113dSnw } 3334c5c4113dSnw 3335479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3336c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3337c5c4113dSnw goto out; 3338c5c4113dSnw 3339c5c4113dSnw sqlite_freemem(sql); 3340c5c4113dSnw sql = NULL; 3341c5c4113dSnw } 3342c5c4113dSnw 3343e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF); 334448258c6bSjp assert(res->id.idmap_id_u.uid != SENTINEL_PID); 334548258c6bSjp 334648258c6bSjp switch (res->info.how.map_type) { 334748258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 334848258c6bSjp map_dn = res->info.how.idmap_how_u.ad.dn; 334948258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 335048258c6bSjp map_value = res->info.how.idmap_how_u.ad.value; 335148258c6bSjp break; 335248258c6bSjp 335348258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 335448258c6bSjp map_dn = res->info.how.idmap_how_u.nldap.dn; 335548258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 335648258c6bSjp map_value = res->info.how.idmap_how_u.nldap.value; 335748258c6bSjp break; 335848258c6bSjp 335948258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 336048258c6bSjp map_windomain = res->info.how.idmap_how_u.rule.windomain; 336148258c6bSjp map_winname = res->info.how.idmap_how_u.rule.winname; 336248258c6bSjp map_unixname = res->info.how.idmap_how_u.rule.unixname; 336348258c6bSjp map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 336448258c6bSjp break; 336548258c6bSjp 336648258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 336748258c6bSjp break; 336848258c6bSjp 336948258c6bSjp default: 337048258c6bSjp /* Dont cache other mapping types */ 337148258c6bSjp assert(FALSE); 337248258c6bSjp } 3373cd37da74Snw 3374c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3375cd37da74Snw "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 337648258c6bSjp "is_user, is_wuser, expiration, w2u, u2w, " 337748258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 337848258c6bSjp "map_winname, map_unixname, map_is_nt4) " 3379cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 338048258c6bSjp "strftime('%%s','now') + 600, 1, %q, " 338148258c6bSjp "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);", 3382cd37da74Snw req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3383e8c27ec8Sbaban (req->id1domain != NULL) ? req->id1domain : "", req->id1name, 3384e8c27ec8Sbaban res->id.idmap_id_u.uid, req->id2name, 3385e8c27ec8Sbaban (res->id.idtype == IDMAP_UID) ? 1 : 0, 3386cd37da74Snw (req->id1.idtype == IDMAP_USID) ? 1 : 0, 338748258c6bSjp (res->direction == 0) ? "1" : NULL, 338848258c6bSjp res->info.how.map_type, map_dn, map_attr, map_value, 338948258c6bSjp map_windomain, map_winname, map_unixname, map_is_nt4); 3390c5c4113dSnw 3391c5c4113dSnw if (sql == NULL) { 3392c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3393c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3394c5c4113dSnw goto out; 3395c5c4113dSnw } 3396c5c4113dSnw 3397479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3398c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3399c5c4113dSnw goto out; 3400c5c4113dSnw 3401c5c4113dSnw state->sid2pid_done = FALSE; 3402c5c4113dSnw sqlite_freemem(sql); 3403c5c4113dSnw sql = NULL; 3404c5c4113dSnw 3405e8c27ec8Sbaban /* Check if we need to update namecache */ 3406e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3407c5c4113dSnw goto out; 3408c5c4113dSnw 3409cf5b5989Sdm if (EMPTY_STRING(req->id1name)) 3410c5c4113dSnw goto out; 3411c5c4113dSnw 3412c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3413cd37da74Snw "(sidprefix, rid, canon_name, domain, type, expiration) " 3414cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3415cd37da74Snw req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3416cd37da74Snw req->id1name, req->id1domain, 3417cd37da74Snw (req->id1.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP); 3418c5c4113dSnw 3419c5c4113dSnw if (sql == NULL) { 3420c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3421c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3422c5c4113dSnw goto out; 3423c5c4113dSnw } 3424c5c4113dSnw 3425479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3426c5c4113dSnw 3427c5c4113dSnw out: 342848258c6bSjp if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO)) 342948258c6bSjp idmap_info_free(&res->info); 343048258c6bSjp 343162c60062Sbaban if (sql != NULL) 3432c5c4113dSnw sqlite_freemem(sql); 3433c5c4113dSnw return (retcode); 3434c5c4113dSnw } 3435c5c4113dSnw 3436cd37da74Snw static 3437cd37da74Snw idmap_retcode 3438c5c4113dSnw lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res, 3439cd37da74Snw int is_user, int getname) 3440cd37da74Snw { 3441c5c4113dSnw char *end; 3442c5c4113dSnw char *sql = NULL; 3443c5c4113dSnw const char **values; 3444c5c4113dSnw sqlite_vm *vm = NULL; 3445c5c4113dSnw int ncol; 3446c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS; 3447c5c4113dSnw time_t curtime; 3448e8c27ec8Sbaban idmap_id_type idtype; 3449c5c4113dSnw 3450c5c4113dSnw /* Current time */ 3451c5c4113dSnw errno = 0; 3452c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 3453cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 3454cd37da74Snw strerror(errno)); 3455c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3456c5c4113dSnw goto out; 3457c5c4113dSnw } 3458c5c4113dSnw 3459e8c27ec8Sbaban /* SQL to lookup the cache by pid or by unixname */ 3460e8c27ec8Sbaban if (req->id1.idmap_id_u.uid != SENTINEL_PID) { 346148258c6bSjp sql = sqlite_mprintf("SELECT sidprefix, rid, " 346248258c6bSjp "canon_winname, windomain, w2u, is_wuser, " 346348258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 346448258c6bSjp "map_winname, map_unixname, map_is_nt4 " 3465e8c27ec8Sbaban "FROM idmap_cache WHERE " 3466e8c27ec8Sbaban "pid = %u AND u2w = 1 AND is_user = %d AND " 3467e8c27ec8Sbaban "(pid >= 2147483648 OR " 3468e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 3469e8c27ec8Sbaban "expiration > %d));", 3470e8c27ec8Sbaban req->id1.idmap_id_u.uid, is_user, curtime); 3471e8c27ec8Sbaban } else if (req->id1name != NULL) { 347248258c6bSjp sql = sqlite_mprintf("SELECT sidprefix, rid, " 347348258c6bSjp "canon_winname, windomain, w2u, is_wuser, " 347448258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 347548258c6bSjp "map_winname, map_unixname, map_is_nt4 " 3476e8c27ec8Sbaban "FROM idmap_cache WHERE " 3477e8c27ec8Sbaban "unixname = %Q AND u2w = 1 AND is_user = %d AND " 3478e8c27ec8Sbaban "(pid >= 2147483648 OR " 3479e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 3480e8c27ec8Sbaban "expiration > %d));", 3481e8c27ec8Sbaban req->id1name, is_user, curtime); 348248258c6bSjp } else { 348348258c6bSjp retcode = IDMAP_ERR_ARG; 348448258c6bSjp goto out; 3485e8c27ec8Sbaban } 3486e8c27ec8Sbaban 3487c5c4113dSnw if (sql == NULL) { 3488c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3489c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3490c5c4113dSnw goto out; 3491c5c4113dSnw } 349248258c6bSjp retcode = sql_compile_n_step_once( 349348258c6bSjp cache, sql, &vm, &ncol, 14, &values); 3494c5c4113dSnw sqlite_freemem(sql); 3495c5c4113dSnw 3496c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) 3497c5c4113dSnw goto out; 3498c5c4113dSnw else if (retcode == IDMAP_SUCCESS) { 3499c5c4113dSnw /* sanity checks */ 3500c5c4113dSnw if (values[0] == NULL || values[1] == NULL) { 3501c5c4113dSnw retcode = IDMAP_ERR_CACHE; 3502c5c4113dSnw goto out; 3503c5c4113dSnw } 3504c5c4113dSnw 3505e8c27ec8Sbaban switch (res->id.idtype) { 3506c5c4113dSnw case IDMAP_SID: 3507cd37da74Snw case IDMAP_USID: 3508cd37da74Snw case IDMAP_GSID: 3509e8c27ec8Sbaban idtype = strtol(values[5], &end, 10) == 1 3510cd37da74Snw ? IDMAP_USID : IDMAP_GSID; 3511cd37da74Snw 3512e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID && 3513e8c27ec8Sbaban idtype != IDMAP_USID) { 3514cd37da74Snw retcode = IDMAP_ERR_NOTUSER; 3515cd37da74Snw goto out; 3516e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GSID && 3517e8c27ec8Sbaban idtype != IDMAP_GSID) { 3518cd37da74Snw retcode = IDMAP_ERR_NOTGROUP; 3519cd37da74Snw goto out; 3520cd37da74Snw } 3521e8c27ec8Sbaban res->id.idtype = idtype; 3522cd37da74Snw 3523c5c4113dSnw res->id.idmap_id_u.sid.rid = 3524cd37da74Snw strtoul(values[1], &end, 10); 3525c5c4113dSnw res->id.idmap_id_u.sid.prefix = strdup(values[0]); 3526c5c4113dSnw if (res->id.idmap_id_u.sid.prefix == NULL) { 3527c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3528c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3529c5c4113dSnw goto out; 3530c5c4113dSnw } 3531c5c4113dSnw 353262c60062Sbaban if (values[4] != NULL) 3533c5c4113dSnw res->direction = 3534651c0131Sbaban (strtol(values[4], &end, 10) == 0)? 3535651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 3536c5c4113dSnw else 3537651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W; 3538c5c4113dSnw 3539c5c4113dSnw if (getname == 0 || values[2] == NULL) 3540c5c4113dSnw break; 35418e228215Sdm req->id2name = strdup(values[2]); 35428e228215Sdm if (req->id2name == NULL) { 3543c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3544c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3545c5c4113dSnw goto out; 3546c5c4113dSnw } 3547c5c4113dSnw 3548c5c4113dSnw if (values[3] == NULL) 3549c5c4113dSnw break; 35508e228215Sdm req->id2domain = strdup(values[3]); 35518e228215Sdm if (req->id2domain == NULL) { 3552c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3553c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3554c5c4113dSnw goto out; 3555c5c4113dSnw } 3556cd37da74Snw 3557c5c4113dSnw break; 3558c5c4113dSnw default: 3559c5c4113dSnw retcode = IDMAP_ERR_NOTSUPPORTED; 3560c5c4113dSnw break; 3561c5c4113dSnw } 356248258c6bSjp if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 356348258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 356448258c6bSjp res->info.how.map_type = strtoul(values[6], &end, 10); 356548258c6bSjp switch (res->info.how.map_type) { 356648258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 356748258c6bSjp res->info.how.idmap_how_u.ad.dn = 356848258c6bSjp strdup(values[7]); 356948258c6bSjp res->info.how.idmap_how_u.ad.attr = 357048258c6bSjp strdup(values[8]); 357148258c6bSjp res->info.how.idmap_how_u.ad.value = 357248258c6bSjp strdup(values[9]); 357348258c6bSjp break; 357448258c6bSjp 357548258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 357648258c6bSjp res->info.how.idmap_how_u.nldap.dn = 357748258c6bSjp strdup(values[7]); 357848258c6bSjp res->info.how.idmap_how_u.nldap.attr = 357948258c6bSjp strdup(values[8]); 358048258c6bSjp res->info.how.idmap_how_u.nldap.value = 358148258c6bSjp strdup(values[9]); 358248258c6bSjp break; 358348258c6bSjp 358448258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 358548258c6bSjp res->info.how.idmap_how_u.rule.windomain = 358648258c6bSjp strdup(values[10]); 358748258c6bSjp res->info.how.idmap_how_u.rule.winname = 358848258c6bSjp strdup(values[11]); 358948258c6bSjp res->info.how.idmap_how_u.rule.unixname = 359048258c6bSjp strdup(values[12]); 359148258c6bSjp res->info.how.idmap_how_u.rule.is_nt4 = 359248258c6bSjp strtoul(values[13], &end, 10); 359348258c6bSjp res->info.how.idmap_how_u.rule.is_user = 359448258c6bSjp is_user; 359548258c6bSjp res->info.how.idmap_how_u.rule.is_wuser = 359648258c6bSjp strtol(values[5], &end, 10); 359748258c6bSjp break; 359848258c6bSjp 359948258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 360048258c6bSjp break; 360148258c6bSjp 360248258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 360348258c6bSjp break; 360448258c6bSjp 360548258c6bSjp case IDMAP_MAP_TYPE_KNOWN_SID: 360648258c6bSjp break; 360748258c6bSjp 360848258c6bSjp default: 360948258c6bSjp /* Unknow mapping type */ 361048258c6bSjp assert(FALSE); 361148258c6bSjp } 361248258c6bSjp } 3613c5c4113dSnw } 3614c5c4113dSnw 3615c5c4113dSnw out: 361662c60062Sbaban if (vm != NULL) 3617c5c4113dSnw (void) sqlite_finalize(vm, NULL); 3618c5c4113dSnw return (retcode); 3619c5c4113dSnw } 3620c5c4113dSnw 3621cd37da74Snw static 3622cd37da74Snw idmap_retcode 3623c5c4113dSnw lookup_cache_name2sid(sqlite *cache, const char *name, const char *domain, 3624cd37da74Snw char **canonname, char **sidprefix, idmap_rid_t *rid, int *type) 3625cd37da74Snw { 3626cd37da74Snw char *end, *lower_name; 3627c5c4113dSnw char *sql = NULL; 3628c5c4113dSnw const char **values; 3629c5c4113dSnw sqlite_vm *vm = NULL; 3630c5c4113dSnw int ncol; 3631c5c4113dSnw time_t curtime; 3632c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS; 3633c5c4113dSnw 3634c5c4113dSnw /* Get current time */ 3635c5c4113dSnw errno = 0; 3636c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 3637cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 3638cd37da74Snw strerror(errno)); 3639c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3640c5c4113dSnw goto out; 3641c5c4113dSnw } 3642c5c4113dSnw 3643c5c4113dSnw /* SQL to lookup the cache */ 3644cd37da74Snw if ((lower_name = tolower_u8(name)) == NULL) 3645cd37da74Snw lower_name = (char *)name; 3646cd37da74Snw sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name " 3647cd37da74Snw "FROM name_cache WHERE name = %Q AND domain = %Q AND " 3648cd37da74Snw "(expiration = 0 OR expiration ISNULL OR " 3649cd37da74Snw "expiration > %d);", lower_name, domain, curtime); 3650cd37da74Snw if (lower_name != name) 3651cd37da74Snw free(lower_name); 3652c5c4113dSnw if (sql == NULL) { 3653c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3654c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3655c5c4113dSnw goto out; 3656c5c4113dSnw } 3657cd37da74Snw retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values); 3658c5c4113dSnw sqlite_freemem(sql); 3659c5c4113dSnw 3660c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 366162c60062Sbaban if (type != NULL) { 3662c5c4113dSnw if (values[2] == NULL) { 3663c5c4113dSnw retcode = IDMAP_ERR_CACHE; 3664c5c4113dSnw goto out; 3665c5c4113dSnw } 3666c5c4113dSnw *type = strtol(values[2], &end, 10); 3667c5c4113dSnw } 3668c5c4113dSnw 3669e8c27ec8Sbaban if (values[0] == NULL || values[1] == NULL) { 3670e8c27ec8Sbaban retcode = IDMAP_ERR_CACHE; 3671e8c27ec8Sbaban goto out; 3672e8c27ec8Sbaban } 3673e8c27ec8Sbaban 3674cd37da74Snw if (canonname != NULL) { 3675cd37da74Snw assert(values[3] != NULL); 3676cd37da74Snw if ((*canonname = strdup(values[3])) == NULL) { 3677cd37da74Snw idmapdlog(LOG_ERR, "Out of memory"); 3678cd37da74Snw retcode = IDMAP_ERR_MEMORY; 3679cd37da74Snw goto out; 3680cd37da74Snw } 3681cd37da74Snw } 3682cd37da74Snw 3683c5c4113dSnw if ((*sidprefix = strdup(values[0])) == NULL) { 3684c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3685c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3686e8c27ec8Sbaban if (canonname != NULL) { 3687e8c27ec8Sbaban free(*canonname); 3688e8c27ec8Sbaban *canonname = NULL; 3689e8c27ec8Sbaban } 3690c5c4113dSnw goto out; 3691c5c4113dSnw } 3692c5c4113dSnw *rid = strtoul(values[1], &end, 10); 3693c5c4113dSnw } 3694c5c4113dSnw 3695c5c4113dSnw out: 369662c60062Sbaban if (vm != NULL) 3697c5c4113dSnw (void) sqlite_finalize(vm, NULL); 3698c5c4113dSnw return (retcode); 3699c5c4113dSnw } 3700c5c4113dSnw 3701cd37da74Snw static 3702cd37da74Snw idmap_retcode 3703e8c27ec8Sbaban ad_lookup_by_winname(lookup_state_t *state, 3704e8c27ec8Sbaban const char *name, const char *domain, int eunixtype, 370548258c6bSjp char **dn, char **attr, char **value, char **canonname, 370648258c6bSjp char **sidprefix, idmap_rid_t *rid, int *wintype, 370748258c6bSjp char **unixname) 3708cd37da74Snw { 37094d61c878SJulian Pullen int retries; 3710c5c4113dSnw idmap_query_state_t *qs = NULL; 3711c5c4113dSnw idmap_retcode rc, retcode; 37124d61c878SJulian Pullen int i; 37134d61c878SJulian Pullen int found_ad = 0; 3714c5c4113dSnw 37152b4a7802SBaban Kenkre RDLOCK_CONFIG(); 37164d61c878SJulian Pullen if (_idmapdstate.num_ads > 0) { 37174d61c878SJulian Pullen for (i = 0; i < _idmapdstate.num_ads && !found_ad; i++) { 37184d61c878SJulian Pullen retries = 0; 37194d61c878SJulian Pullen retry: 37204d61c878SJulian Pullen retcode = idmap_lookup_batch_start(_idmapdstate.ads[i], 37214d61c878SJulian Pullen 1, &qs); 37224d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) { 37234d61c878SJulian Pullen if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 37244d61c878SJulian Pullen retries++ < ADUTILS_DEF_NUM_RETRIES) 37254d61c878SJulian Pullen goto retry; 37264d61c878SJulian Pullen degrade_svc(1, "failed to create request for " 37274d61c878SJulian Pullen "AD lookup by winname"); 37284d61c878SJulian Pullen return (retcode); 37294d61c878SJulian Pullen } 3730c5c4113dSnw 37314d61c878SJulian Pullen restore_svc(); 3732c5c4113dSnw 37334d61c878SJulian Pullen if (state != NULL && i == 0) { 37344d61c878SJulian Pullen /* 37354d61c878SJulian Pullen * Directory based name mapping is only 37364d61c878SJulian Pullen * performed within the joined forest (i == 0). 37374d61c878SJulian Pullen * We don't trust other "trusted" forests to 37384d61c878SJulian Pullen * provide DS-based name mapping information 37394d61c878SJulian Pullen * because AD's definition of "cross-forest 37404d61c878SJulian Pullen * trust" does not encompass this sort of 37414d61c878SJulian Pullen * behavior. 37424d61c878SJulian Pullen */ 37434d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs, 37444d61c878SJulian Pullen state->ad_unixuser_attr, 37454d61c878SJulian Pullen state->ad_unixgroup_attr); 37464d61c878SJulian Pullen } 3747c5c4113dSnw 37484d61c878SJulian Pullen retcode = idmap_name2sid_batch_add1(qs, name, domain, 37494d61c878SJulian Pullen eunixtype, dn, attr, value, canonname, sidprefix, 37504d61c878SJulian Pullen rid, wintype, unixname, &rc); 37514d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) { 37524d61c878SJulian Pullen idmap_lookup_release_batch(&qs); 37534d61c878SJulian Pullen continue; 37544d61c878SJulian Pullen } 37554d61c878SJulian Pullen found_ad = 1; 37564d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) 37574d61c878SJulian Pullen idmap_lookup_release_batch(&qs); 37584d61c878SJulian Pullen else 37594d61c878SJulian Pullen retcode = idmap_lookup_batch_end(&qs); 37604d61c878SJulian Pullen 37614d61c878SJulian Pullen if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 37624d61c878SJulian Pullen retries++ < ADUTILS_DEF_NUM_RETRIES) 37634d61c878SJulian Pullen goto retry; 37644d61c878SJulian Pullen else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 37654d61c878SJulian Pullen degrade_svc(1, 37664d61c878SJulian Pullen "some AD lookups timed out repeatedly"); 37674d61c878SJulian Pullen } 37684d61c878SJulian Pullen } else { 37694d61c878SJulian Pullen /* No AD case */ 37704d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 37714d61c878SJulian Pullen } 37724d61c878SJulian Pullen UNLOCK_CONFIG(); 3773c5c4113dSnw 3774c5c4113dSnw if (retcode != IDMAP_SUCCESS) { 3775e8c27ec8Sbaban idmapdlog(LOG_NOTICE, "AD lookup by winname failed"); 3776c5c4113dSnw return (retcode); 3777e8c27ec8Sbaban } 3778e8c27ec8Sbaban return (rc); 3779c5c4113dSnw } 3780c5c4113dSnw 3781cd37da74Snw idmap_retcode 3782c5c4113dSnw lookup_name2sid(sqlite *cache, const char *name, const char *domain, 3783cd37da74Snw int *is_wuser, char **canonname, char **sidprefix, 3784479ac375Sdm idmap_rid_t *rid, idmap_mapping *req, int local_only) 3785cd37da74Snw { 3786c5c4113dSnw int type; 3787c5c4113dSnw idmap_retcode retcode; 3788c5c4113dSnw 3789cd37da74Snw *sidprefix = NULL; 3790e8c27ec8Sbaban if (canonname != NULL) 3791e8c27ec8Sbaban *canonname = NULL; 3792cd37da74Snw 3793e8c27ec8Sbaban /* Lookup well-known SIDs table */ 3794cd37da74Snw retcode = lookup_wksids_name2sid(name, canonname, sidprefix, rid, 3795cd37da74Snw &type); 379662c60062Sbaban if (retcode == IDMAP_SUCCESS) { 3797e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 379862c60062Sbaban goto out; 379962c60062Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) { 380062c60062Sbaban return (retcode); 380162c60062Sbaban } 380262c60062Sbaban 3803e8c27ec8Sbaban /* Lookup cache */ 3804cd37da74Snw retcode = lookup_cache_name2sid(cache, name, domain, canonname, 3805cd37da74Snw sidprefix, rid, &type); 3806e8c27ec8Sbaban if (retcode == IDMAP_SUCCESS) { 3807e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 3808e8c27ec8Sbaban goto out; 3809e8c27ec8Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) { 3810c5c4113dSnw return (retcode); 3811c5c4113dSnw } 3812c5c4113dSnw 3813479ac375Sdm /* 3814479ac375Sdm * The caller may be using this function to determine if this 3815479ac375Sdm * request needs to be marked for AD lookup or not 3816479ac375Sdm * (i.e. _IDMAP_F_LOOKUP_AD) and therefore may not want this 3817479ac375Sdm * function to AD lookup now. 3818479ac375Sdm */ 3819479ac375Sdm if (local_only) 3820479ac375Sdm return (retcode); 3821479ac375Sdm 3822e8c27ec8Sbaban /* Lookup AD */ 3823e8c27ec8Sbaban retcode = ad_lookup_by_winname(NULL, name, domain, _IDMAP_T_UNDEF, 382448258c6bSjp NULL, NULL, NULL, canonname, sidprefix, rid, &type, NULL); 3825e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 3826e8c27ec8Sbaban return (retcode); 3827e8c27ec8Sbaban 382862c60062Sbaban out: 3829c5c4113dSnw /* 3830c5c4113dSnw * Entry found (cache or Windows lookup) 3831cd37da74Snw * is_wuser is both input as well as output parameter 3832c5c4113dSnw */ 3833e8c27ec8Sbaban if (*is_wuser == 1 && type != _IDMAP_T_USER) 3834e8c27ec8Sbaban retcode = IDMAP_ERR_NOTUSER; 3835e8c27ec8Sbaban else if (*is_wuser == 0 && type != _IDMAP_T_GROUP) 3836e8c27ec8Sbaban retcode = IDMAP_ERR_NOTGROUP; 3837e8c27ec8Sbaban else if (*is_wuser == -1) { 3838c5c4113dSnw /* Caller wants to know if its user or group */ 3839c5c4113dSnw if (type == _IDMAP_T_USER) 3840cd37da74Snw *is_wuser = 1; 3841c5c4113dSnw else if (type == _IDMAP_T_GROUP) 3842cd37da74Snw *is_wuser = 0; 3843e8c27ec8Sbaban else 3844e8c27ec8Sbaban retcode = IDMAP_ERR_SID; 3845c5c4113dSnw } 3846c5c4113dSnw 3847e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 3848e8c27ec8Sbaban free(*sidprefix); 3849e8c27ec8Sbaban *sidprefix = NULL; 3850e8c27ec8Sbaban if (canonname != NULL) { 3851e8c27ec8Sbaban free(*canonname); 3852e8c27ec8Sbaban *canonname = NULL; 3853e8c27ec8Sbaban } 3854e8c27ec8Sbaban } 3855c5c4113dSnw return (retcode); 3856c5c4113dSnw } 3857c5c4113dSnw 3858cd37da74Snw static 3859cd37da74Snw idmap_retcode 3860479ac375Sdm name_based_mapping_pid2sid(lookup_state_t *state, const char *unixname, 3861cd37da74Snw int is_user, idmap_mapping *req, idmap_id_res *res) 3862cd37da74Snw { 3863c5c4113dSnw const char *winname, *windomain; 3864cd37da74Snw char *canonname; 3865c5c4113dSnw char *sql = NULL, *errmsg = NULL; 3866c5c4113dSnw idmap_retcode retcode; 3867c5c4113dSnw char *end; 3868c5c4113dSnw const char **values; 3869c5c4113dSnw sqlite_vm *vm = NULL; 387048258c6bSjp int ncol, r; 3871e8c27ec8Sbaban int is_wuser; 3872c5c4113dSnw const char *me = "name_based_mapping_pid2sid"; 387348258c6bSjp int non_wild_match = FALSE; 387448258c6bSjp idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 387548258c6bSjp int direction; 3876e8c27ec8Sbaban 3877e8c27ec8Sbaban assert(unixname != NULL); /* We have unixname */ 3878e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have winname */ 3879e8c27ec8Sbaban assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */ 3880c5c4113dSnw 3881c5c4113dSnw sql = sqlite_mprintf( 388248258c6bSjp "SELECT winname_display, windomain, w2u_order, " 388348258c6bSjp "is_wuser, unixname, is_nt4 " 388448258c6bSjp "FROM namerules WHERE " 3885cd37da74Snw "u2w_order > 0 AND is_user = %d AND " 3886cd37da74Snw "(unixname = %Q OR unixname = '*') " 3887cd37da74Snw "ORDER BY u2w_order ASC;", is_user, unixname); 3888c5c4113dSnw if (sql == NULL) { 3889c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3890c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3891c5c4113dSnw goto out; 3892c5c4113dSnw } 3893c5c4113dSnw 3894479ac375Sdm if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 3895c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3896cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3897cd37da74Snw CHECK_NULL(errmsg)); 3898c5c4113dSnw sqlite_freemem(errmsg); 3899c5c4113dSnw goto out; 3900c5c4113dSnw } 3901c5c4113dSnw 390248258c6bSjp for (;;) { 3903c5c4113dSnw r = sqlite_step(vm, &ncol, &values, NULL); 390484decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 390584decf41Sjp if (r == SQLITE_ROW) { 390648258c6bSjp if (ncol < 6) { 3907c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3908c5c4113dSnw goto out; 3909c5c4113dSnw } 3910c5c4113dSnw if (values[0] == NULL) { 3911c5c4113dSnw /* values [1] and [2] can be null */ 3912c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3913c5c4113dSnw goto out; 3914c5c4113dSnw } 391548258c6bSjp 391648258c6bSjp if (values[2] != NULL) 391748258c6bSjp direction = 391848258c6bSjp (strtol(values[2], &end, 10) == 0)? 391948258c6bSjp IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 392048258c6bSjp else 392148258c6bSjp direction = IDMAP_DIRECTION_U2W; 392248258c6bSjp 3923c5c4113dSnw if (EMPTY_NAME(values[0])) { 392448258c6bSjp idmap_namerule_set(rule, values[1], values[0], 392548258c6bSjp values[4], is_user, 392648258c6bSjp strtol(values[3], &end, 10), 392748258c6bSjp strtol(values[5], &end, 10), 392848258c6bSjp direction); 3929c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 3930c5c4113dSnw goto out; 3931c5c4113dSnw } 3932cd37da74Snw 3933cd37da74Snw if (values[0][0] == '*') { 393448258c6bSjp winname = unixname; 393548258c6bSjp if (non_wild_match) { 3936cd37da74Snw /* 393748258c6bSjp * There were non-wildcard rules 393848258c6bSjp * where the Windows identity doesn't 393948258c6bSjp * exist. Return no mapping. 3940cd37da74Snw */ 3941cd37da74Snw retcode = IDMAP_ERR_NOMAPPING; 3942cd37da74Snw goto out; 3943cd37da74Snw } 3944cd37da74Snw } else { 394548258c6bSjp /* Save first non-wild match rule */ 394648258c6bSjp if (!non_wild_match) { 394748258c6bSjp idmap_namerule_set(rule, values[1], 394848258c6bSjp values[0], values[4], 394948258c6bSjp is_user, 395048258c6bSjp strtol(values[3], &end, 10), 395148258c6bSjp strtol(values[5], &end, 10), 395248258c6bSjp direction); 395348258c6bSjp non_wild_match = TRUE; 395448258c6bSjp } 3955cd37da74Snw winname = values[0]; 3956cd37da74Snw } 395748258c6bSjp is_wuser = res->id.idtype == IDMAP_USID ? 1 395848258c6bSjp : res->id.idtype == IDMAP_GSID ? 0 395948258c6bSjp : -1; 396062c60062Sbaban if (values[1] != NULL) 3961c5c4113dSnw windomain = values[1]; 3962479ac375Sdm else if (state->defdom != NULL) 3963479ac375Sdm windomain = state->defdom; 3964c5c4113dSnw else { 3965cd37da74Snw idmapdlog(LOG_ERR, "%s: no domain", me); 3966c5c4113dSnw retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 3967c5c4113dSnw goto out; 3968c5c4113dSnw } 3969cd37da74Snw 3970479ac375Sdm retcode = lookup_name2sid(state->cache, 3971479ac375Sdm winname, windomain, 3972cd37da74Snw &is_wuser, &canonname, 3973cd37da74Snw &res->id.idmap_id_u.sid.prefix, 3974479ac375Sdm &res->id.idmap_id_u.sid.rid, req, 0); 3975e8c27ec8Sbaban 3976c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) { 3977cd37da74Snw continue; 3978c5c4113dSnw } 3979c5c4113dSnw goto out; 398048258c6bSjp 3981c5c4113dSnw } else if (r == SQLITE_DONE) { 398248258c6bSjp /* 398348258c6bSjp * If there were non-wildcard rules where 398448258c6bSjp * Windows identity doesn't exist 398548258c6bSjp * return no mapping. 398648258c6bSjp */ 398748258c6bSjp if (non_wild_match) 398848258c6bSjp retcode = IDMAP_ERR_NOMAPPING; 398948258c6bSjp else 399048258c6bSjp retcode = IDMAP_ERR_NOTFOUND; 3991c5c4113dSnw goto out; 3992c5c4113dSnw } else { 3993c5c4113dSnw (void) sqlite_finalize(vm, &errmsg); 3994c5c4113dSnw vm = NULL; 3995cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3996cd37da74Snw CHECK_NULL(errmsg)); 3997c5c4113dSnw sqlite_freemem(errmsg); 3998c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3999c5c4113dSnw goto out; 4000c5c4113dSnw } 4001c5c4113dSnw } 4002c5c4113dSnw 4003c5c4113dSnw out: 400462c60062Sbaban if (sql != NULL) 4005c5c4113dSnw sqlite_freemem(sql); 4006c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 4007cd37da74Snw res->id.idtype = is_wuser ? IDMAP_USID : IDMAP_GSID; 4008cd37da74Snw 400962c60062Sbaban if (values[2] != NULL) 4010c5c4113dSnw res->direction = 4011651c0131Sbaban (strtol(values[2], &end, 10) == 0)? 4012651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 4013c5c4113dSnw else 4014651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W; 40158e228215Sdm 4016cd37da74Snw req->id2name = canonname; 40178e228215Sdm if (req->id2name != NULL) { 4018479ac375Sdm req->id2domain = strdup(windomain); 4019479ac375Sdm if (req->id2domain == NULL) 4020479ac375Sdm retcode = IDMAP_ERR_MEMORY; 4021c5c4113dSnw } 4022479ac375Sdm } 4023479ac375Sdm 4024479ac375Sdm if (retcode == IDMAP_SUCCESS) { 402548258c6bSjp idmap_namerule_set(rule, values[1], values[0], values[4], 402648258c6bSjp is_user, strtol(values[3], &end, 10), 402748258c6bSjp strtol(values[5], &end, 10), 402848258c6bSjp rule->direction); 4029fc724630SAlan Wright } 4030fc724630SAlan Wright 4031fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) { 4032fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 403348258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 4034c5c4113dSnw } 4035fc724630SAlan Wright 403662c60062Sbaban if (vm != NULL) 4037c5c4113dSnw (void) sqlite_finalize(vm, NULL); 4038c5c4113dSnw return (retcode); 4039c5c4113dSnw } 4040c5c4113dSnw 4041cd37da74Snw /* 4042cd37da74Snw * Convention when processing unix2win requests: 4043cd37da74Snw * 4044cd37da74Snw * Unix identity: 4045cd37da74Snw * req->id1name = 4046cd37da74Snw * unixname if given otherwise unixname found will be placed 4047cd37da74Snw * here. 4048cd37da74Snw * req->id1domain = 4049cd37da74Snw * NOT USED 4050cd37da74Snw * req->id1.idtype = 4051cd37da74Snw * Given type (IDMAP_UID or IDMAP_GID) 4052cd37da74Snw * req->id1..[uid or gid] = 4053cd37da74Snw * UID/GID if given otherwise UID/GID found will be placed here. 4054cd37da74Snw * 4055cd37da74Snw * Windows identity: 4056cd37da74Snw * req->id2name = 4057cd37da74Snw * winname found will be placed here. 4058cd37da74Snw * req->id2domain = 4059cd37da74Snw * windomain found will be placed here. 4060cd37da74Snw * res->id.idtype = 4061cd37da74Snw * Target type initialized from req->id2.idtype. If 4062cd37da74Snw * it is IDMAP_SID then actual type (IDMAP_USID/GSID) found 4063cd37da74Snw * will be placed here. 4064cd37da74Snw * req->id..sid.[prefix, rid] = 4065cd37da74Snw * SID found will be placed here. 4066cd37da74Snw * 4067cd37da74Snw * Others: 4068cd37da74Snw * res->retcode = 4069cd37da74Snw * Return status for this request will be placed here. 4070cd37da74Snw * res->direction = 4071cd37da74Snw * Direction found will be placed here. Direction 4072cd37da74Snw * meaning whether the resultant mapping is valid 4073cd37da74Snw * only from unix2win or bi-directional. 4074cd37da74Snw * req->direction = 4075cd37da74Snw * INTERNAL USE. Used by idmapd to set various 4076cd37da74Snw * flags (_IDMAP_F_xxxx) to aid in processing 4077cd37da74Snw * of the request. 4078cd37da74Snw * req->id2.idtype = 4079cd37da74Snw * INTERNAL USE. Initially this is the requested target 4080cd37da74Snw * type and is used to initialize res->id.idtype. 4081cd37da74Snw * ad_lookup_batch() uses this field temporarily to store 4082cd37da74Snw * sid_type obtained by the batched AD lookups and after 4083cd37da74Snw * use resets it to IDMAP_NONE to prevent xdr from 4084cd37da74Snw * mis-interpreting the contents of req->id2. 4085cd37da74Snw * req->id2..[uid or gid or sid] = 4086cd37da74Snw * NOT USED 4087cd37da74Snw */ 4088cd37da74Snw 4089cd37da74Snw /* 4090cd37da74Snw * This function does the following: 4091cd37da74Snw * 1. Lookup well-known SIDs table. 4092cd37da74Snw * 2. Lookup cache. 4093cd37da74Snw * 3. Check if the client does not want new mapping to be allocated 4094cd37da74Snw * in which case this pass is the final pass. 4095e8c27ec8Sbaban * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs 4096e8c27ec8Sbaban * to do AD/NLDAP lookup. 4097cd37da74Snw */ 4098c5c4113dSnw idmap_retcode 4099479ac375Sdm pid2sid_first_pass(lookup_state_t *state, idmap_mapping *req, 4100479ac375Sdm idmap_id_res *res, int is_user, int getname) 4101cd37da74Snw { 4102e8c27ec8Sbaban idmap_retcode retcode; 4103e8c27ec8Sbaban bool_t gen_localsid_on_err = FALSE; 4104c5c4113dSnw 4105e8c27ec8Sbaban /* Initialize result */ 4106c5c4113dSnw res->id.idtype = req->id2.idtype; 4107e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF; 4108e8c27ec8Sbaban 4109e8c27ec8Sbaban if (req->id2.idmap_id_u.sid.prefix != NULL) { 4110e8c27ec8Sbaban /* sanitize sidprefix */ 4111e8c27ec8Sbaban free(req->id2.idmap_id_u.sid.prefix); 4112e8c27ec8Sbaban req->id2.idmap_id_u.sid.prefix = NULL; 4113e8c27ec8Sbaban } 4114c5c4113dSnw 411548258c6bSjp /* Find pid */ 411648258c6bSjp if (req->id1.idmap_id_u.uid == SENTINEL_PID) { 411748258c6bSjp if (ns_lookup_byname(req->id1name, NULL, &req->id1) 411848258c6bSjp != IDMAP_SUCCESS) { 411948258c6bSjp retcode = IDMAP_ERR_NOMAPPING; 412048258c6bSjp goto out; 412148258c6bSjp } 412248258c6bSjp } 412348258c6bSjp 4124e8c27ec8Sbaban /* Lookup well-known SIDs table */ 4125c5c4113dSnw retcode = lookup_wksids_pid2sid(req, res, is_user); 4126c5c4113dSnw if (retcode != IDMAP_ERR_NOTFOUND) 4127c5c4113dSnw goto out; 4128c5c4113dSnw 4129e8c27ec8Sbaban /* Lookup cache */ 4130479ac375Sdm retcode = lookup_cache_pid2sid(state->cache, req, res, is_user, 4131479ac375Sdm getname); 4132c5c4113dSnw if (retcode != IDMAP_ERR_NOTFOUND) 4133c5c4113dSnw goto out; 4134c5c4113dSnw 4135c5c4113dSnw /* Ephemeral ids cannot be allocated during pid2sid */ 4136c5c4113dSnw if (IS_EPHEMERAL(req->id1.idmap_id_u.uid)) { 413762c60062Sbaban retcode = IDMAP_ERR_NOMAPPING; 4138c5c4113dSnw goto out; 4139c5c4113dSnw } 4140c5c4113dSnw 414148258c6bSjp if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) { 41424d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 414348258c6bSjp goto out; 414448258c6bSjp } 414548258c6bSjp 414648258c6bSjp if (AVOID_NAMESERVICE(req)) { 4147e8c27ec8Sbaban gen_localsid_on_err = TRUE; 414862c60062Sbaban retcode = IDMAP_ERR_NOMAPPING; 4149c5c4113dSnw goto out; 4150c5c4113dSnw } 4151c5c4113dSnw 4152e8c27ec8Sbaban /* Set flags for the next stage */ 4153e8c27ec8Sbaban if (AD_MODE(req->id1.idtype, state)) { 4154e8c27ec8Sbaban /* 4155e8c27ec8Sbaban * If AD-based name mapping is enabled then the next stage 4156e8c27ec8Sbaban * will need to lookup AD using unixname to get the 4157e8c27ec8Sbaban * corresponding winname. 4158e8c27ec8Sbaban */ 4159e8c27ec8Sbaban if (req->id1name == NULL) { 4160e8c27ec8Sbaban /* Get unixname if only pid is given. */ 4161e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, 4162e8c27ec8Sbaban is_user, &req->id1name); 4163479ac375Sdm if (retcode != IDMAP_SUCCESS) { 4164479ac375Sdm gen_localsid_on_err = TRUE; 4165e8c27ec8Sbaban goto out; 4166479ac375Sdm } 4167c5c4113dSnw } 4168e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD; 4169e8c27ec8Sbaban state->ad_nqueries++; 4170e8c27ec8Sbaban } else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) { 4171e8c27ec8Sbaban /* 4172e8c27ec8Sbaban * If native LDAP or mixed mode is enabled for name mapping 4173e8c27ec8Sbaban * then the next stage will need to lookup native LDAP using 4174e8c27ec8Sbaban * unixname/pid to get the corresponding winname. 4175e8c27ec8Sbaban */ 4176e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_NLDAP; 4177e8c27ec8Sbaban state->nldap_nqueries++; 4178c5c4113dSnw } 4179c5c4113dSnw 4180e8c27ec8Sbaban /* 4181e8c27ec8Sbaban * Failed to find non-expired entry in cache. Set the flag to 4182e8c27ec8Sbaban * indicate that we are not done yet. 4183e8c27ec8Sbaban */ 4184e8c27ec8Sbaban state->pid2sid_done = FALSE; 4185e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE; 4186e8c27ec8Sbaban retcode = IDMAP_SUCCESS; 4187e8c27ec8Sbaban 4188e8c27ec8Sbaban out: 4189e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode); 4190e8c27ec8Sbaban if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) 4191e8c27ec8Sbaban if (gen_localsid_on_err == TRUE) 419248258c6bSjp (void) generate_localsid(req, res, is_user, TRUE); 4193e8c27ec8Sbaban return (retcode); 4194e8c27ec8Sbaban } 4195e8c27ec8Sbaban 4196e8c27ec8Sbaban idmap_retcode 4197479ac375Sdm pid2sid_second_pass(lookup_state_t *state, idmap_mapping *req, 4198479ac375Sdm idmap_id_res *res, int is_user) 4199e8c27ec8Sbaban { 4200e8c27ec8Sbaban bool_t gen_localsid_on_err = TRUE; 4201e8c27ec8Sbaban idmap_retcode retcode = IDMAP_SUCCESS; 4202e8c27ec8Sbaban 4203e8c27ec8Sbaban /* Check if second pass is needed */ 4204e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 4205e8c27ec8Sbaban return (res->retcode); 4206e8c27ec8Sbaban 4207e8c27ec8Sbaban /* Get status from previous pass */ 4208e8c27ec8Sbaban retcode = res->retcode; 4209e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4210c5c4113dSnw goto out; 4211c5c4113dSnw 4212c5c4113dSnw /* 4213e8c27ec8Sbaban * If directory-based name mapping is enabled then the winname 4214e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode) 4215479ac375Sdm * or from native LDAP object (nldap-mode or mixed-mode). 4216479ac375Sdm * Note that if we have winname but no SID then it's an error 4217479ac375Sdm * because this implies that the Native LDAP entry contains 4218479ac375Sdm * winname which does not exist and it's better that we return 4219479ac375Sdm * an error instead of doing rule-based mapping so that the user 4220479ac375Sdm * can detect the issue and take appropriate action. 4221c5c4113dSnw */ 4222479ac375Sdm if (req->id2name != NULL) { 4223479ac375Sdm /* Return notfound if we've winname but no SID. */ 4224479ac375Sdm if (res->id.idmap_id_u.sid.prefix == NULL) { 4225479ac375Sdm retcode = IDMAP_ERR_NOTFOUND; 4226479ac375Sdm goto out; 4227479ac375Sdm } 4228e8c27ec8Sbaban if (AD_MODE(req->id1.idtype, state)) 4229e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 4230e8c27ec8Sbaban else if (NLDAP_MODE(req->id1.idtype, state)) 4231e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 4232e8c27ec8Sbaban else if (MIXED_MODE(req->id1.idtype, state)) 4233e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U; 4234e8c27ec8Sbaban goto out; 4235479ac375Sdm } else if (res->id.idmap_id_u.sid.prefix != NULL) { 4236479ac375Sdm /* 4237479ac375Sdm * We've SID but no winname. This is fine because 4238479ac375Sdm * the caller may have only requested SID. 4239479ac375Sdm */ 4240479ac375Sdm goto out; 4241e8c27ec8Sbaban } 4242e8c27ec8Sbaban 4243479ac375Sdm /* Free any mapping info from Directory based mapping */ 4244479ac375Sdm if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 4245479ac375Sdm idmap_info_free(&res->info); 4246479ac375Sdm 4247e8c27ec8Sbaban if (req->id1name == NULL) { 4248e8c27ec8Sbaban /* Get unixname from name service */ 4249e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user, 4250e8c27ec8Sbaban &req->id1name); 4251e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4252e8c27ec8Sbaban goto out; 4253e8c27ec8Sbaban } else if (req->id1.idmap_id_u.uid == SENTINEL_PID) { 4254e8c27ec8Sbaban /* Get pid from name service */ 4255e8c27ec8Sbaban retcode = ns_lookup_byname(req->id1name, NULL, &req->id1); 4256e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 4257e8c27ec8Sbaban gen_localsid_on_err = FALSE; 4258e8c27ec8Sbaban goto out; 4259e8c27ec8Sbaban } 4260e8c27ec8Sbaban } 4261e8c27ec8Sbaban 4262e8c27ec8Sbaban /* Use unixname to evaluate local name-based mapping rules */ 4263479ac375Sdm retcode = name_based_mapping_pid2sid(state, req->id1name, is_user, 4264e8c27ec8Sbaban req, res); 4265e8c27ec8Sbaban if (retcode == IDMAP_ERR_NOTFOUND) { 426648258c6bSjp retcode = generate_localsid(req, res, is_user, FALSE); 4267e8c27ec8Sbaban gen_localsid_on_err = FALSE; 4268e8c27ec8Sbaban } 4269c5c4113dSnw 4270c5c4113dSnw out: 4271e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode); 4272e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 4273e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 4274479ac375Sdm free(req->id2name); 4275479ac375Sdm req->id2name = NULL; 4276479ac375Sdm free(req->id2domain); 4277479ac375Sdm req->id2domain = NULL; 4278e8c27ec8Sbaban if (gen_localsid_on_err == TRUE) 427948258c6bSjp (void) generate_localsid(req, res, is_user, TRUE); 4280479ac375Sdm else 4281479ac375Sdm res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 4282c5c4113dSnw } 4283e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction)) 4284c5c4113dSnw state->pid2sid_done = FALSE; 4285c5c4113dSnw return (retcode); 4286c5c4113dSnw } 4287c5c4113dSnw 4288cd37da74Snw static 4289cd37da74Snw int 4290651c0131Sbaban copy_mapping_request(idmap_mapping *mapping, idmap_mapping *request) 4291c5c4113dSnw { 4292651c0131Sbaban (void) memset(mapping, 0, sizeof (*mapping)); 4293651c0131Sbaban 4294c5c4113dSnw mapping->flag = request->flag; 4295e8c27ec8Sbaban mapping->direction = _IDMAP_F_DONE; 4296651c0131Sbaban mapping->id2.idtype = request->id2.idtype; 4297c5c4113dSnw 4298c5c4113dSnw mapping->id1.idtype = request->id1.idtype; 4299cd37da74Snw if (IS_REQUEST_SID(*request, 1)) { 4300c5c4113dSnw mapping->id1.idmap_id_u.sid.rid = 4301c5c4113dSnw request->id1.idmap_id_u.sid.rid; 4302651c0131Sbaban if (!EMPTY_STRING(request->id1.idmap_id_u.sid.prefix)) { 4303c5c4113dSnw mapping->id1.idmap_id_u.sid.prefix = 4304c5c4113dSnw strdup(request->id1.idmap_id_u.sid.prefix); 4305651c0131Sbaban if (mapping->id1.idmap_id_u.sid.prefix == NULL) 43068e228215Sdm goto errout; 4307651c0131Sbaban } 4308c5c4113dSnw } else { 4309c5c4113dSnw mapping->id1.idmap_id_u.uid = request->id1.idmap_id_u.uid; 4310c5c4113dSnw } 4311c5c4113dSnw 4312e8c27ec8Sbaban if (!EMPTY_STRING(request->id1domain)) { 4313e8c27ec8Sbaban mapping->id1domain = strdup(request->id1domain); 4314e8c27ec8Sbaban if (mapping->id1domain == NULL) 4315e8c27ec8Sbaban goto errout; 4316e8c27ec8Sbaban } 4317c5c4113dSnw 4318e8c27ec8Sbaban if (!EMPTY_STRING(request->id1name)) { 4319e8c27ec8Sbaban mapping->id1name = strdup(request->id1name); 4320e8c27ec8Sbaban if (mapping->id1name == NULL) 4321e8c27ec8Sbaban goto errout; 4322e8c27ec8Sbaban } 4323c5c4113dSnw 4324651c0131Sbaban /* We don't need the rest of the request i.e request->id2 */ 4325651c0131Sbaban return (0); 4326651c0131Sbaban 4327651c0131Sbaban errout: 43288e228215Sdm if (mapping->id1.idmap_id_u.sid.prefix != NULL) 4329651c0131Sbaban free(mapping->id1.idmap_id_u.sid.prefix); 43308e228215Sdm if (mapping->id1domain != NULL) 43318e228215Sdm free(mapping->id1domain); 43328e228215Sdm if (mapping->id1name != NULL) 43338e228215Sdm free(mapping->id1name); 4334651c0131Sbaban 4335651c0131Sbaban (void) memset(mapping, 0, sizeof (*mapping)); 4336651c0131Sbaban return (-1); 4337c5c4113dSnw } 4338c5c4113dSnw 4339c5c4113dSnw 4340c5c4113dSnw idmap_retcode 4341c5c4113dSnw get_w2u_mapping(sqlite *cache, sqlite *db, idmap_mapping *request, 4342cd37da74Snw idmap_mapping *mapping) 4343cd37da74Snw { 4344c5c4113dSnw idmap_id_res idres; 4345c5c4113dSnw lookup_state_t state; 4346dd5829d1Sbaban char *cp; 4347c5c4113dSnw idmap_retcode retcode; 4348c5c4113dSnw const char *winname, *windomain; 4349c5c4113dSnw 4350c5c4113dSnw (void) memset(&idres, 0, sizeof (idres)); 4351c5c4113dSnw (void) memset(&state, 0, sizeof (state)); 4352479ac375Sdm state.cache = cache; 4353479ac375Sdm state.db = db; 4354c5c4113dSnw 4355e8c27ec8Sbaban /* Get directory-based name mapping info */ 4356479ac375Sdm retcode = load_cfg_in_state(&state); 4357e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4358c5c4113dSnw goto out; 4359c5c4113dSnw 4360e8c27ec8Sbaban /* 4361e8c27ec8Sbaban * Copy data from "request" to "mapping". Note that 4362e8c27ec8Sbaban * empty strings are not copied from "request" to 4363e8c27ec8Sbaban * "mapping" and therefore the coresponding strings in 4364e8c27ec8Sbaban * "mapping" will be NULL. This eliminates having to 4365e8c27ec8Sbaban * check for empty strings henceforth. 4366e8c27ec8Sbaban */ 4367651c0131Sbaban if (copy_mapping_request(mapping, request) < 0) { 4368651c0131Sbaban retcode = IDMAP_ERR_MEMORY; 4369651c0131Sbaban goto out; 4370651c0131Sbaban } 4371c5c4113dSnw 43728e228215Sdm winname = mapping->id1name; 43738e228215Sdm windomain = mapping->id1domain; 4374c5c4113dSnw 4375e8c27ec8Sbaban if (winname == NULL && windomain != NULL) { 4376e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 4377e8c27ec8Sbaban goto out; 4378e8c27ec8Sbaban } 4379e8c27ec8Sbaban 4380e8c27ec8Sbaban /* Need atleast winname or sid to proceed */ 4381e8c27ec8Sbaban if (winname == NULL && mapping->id1.idmap_id_u.sid.prefix == NULL) { 4382c5c4113dSnw retcode = IDMAP_ERR_ARG; 4383c5c4113dSnw goto out; 4384c5c4113dSnw } 4385c5c4113dSnw 4386e8c27ec8Sbaban /* 4387e8c27ec8Sbaban * If domainname is not given but we have a fully qualified 4388e8c27ec8Sbaban * winname then extract the domainname from the winname, 4389e8c27ec8Sbaban * otherwise use the default_domain from the config 4390e8c27ec8Sbaban */ 4391e8c27ec8Sbaban if (winname != NULL && windomain == NULL) { 43928e228215Sdm retcode = IDMAP_SUCCESS; 4393dd5829d1Sbaban if ((cp = strchr(winname, '@')) != NULL) { 4394dd5829d1Sbaban *cp = '\0'; 43958e228215Sdm mapping->id1domain = strdup(cp + 1); 43968e228215Sdm if (mapping->id1domain == NULL) 43978e228215Sdm retcode = IDMAP_ERR_MEMORY; 4398e8c27ec8Sbaban } else if (lookup_wksids_name2sid(winname, NULL, NULL, NULL, 4399e8c27ec8Sbaban NULL) != IDMAP_SUCCESS) { 440082da9f60Sbaban if (state.defdom == NULL) { 440182da9f60Sbaban /* 440282da9f60Sbaban * We have a non-qualified winname which is 440382da9f60Sbaban * neither the name of a well-known SID nor 440482da9f60Sbaban * there is a default domain with which we can 440582da9f60Sbaban * qualify it. 440682da9f60Sbaban */ 440782da9f60Sbaban retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 440882da9f60Sbaban } else { 440982da9f60Sbaban mapping->id1domain = strdup(state.defdom); 441082da9f60Sbaban if (mapping->id1domain == NULL) 441182da9f60Sbaban retcode = IDMAP_ERR_MEMORY; 441282da9f60Sbaban } 44138e228215Sdm } 4414c5c4113dSnw if (retcode != IDMAP_SUCCESS) 4415c5c4113dSnw goto out; 4416c5c4113dSnw } 4417c5c4113dSnw 4418e8c27ec8Sbaban /* 4419e8c27ec8Sbaban * First pass looks up the well-known SIDs table and cache 4420e8c27ec8Sbaban * and handles localSIDs 4421e8c27ec8Sbaban */ 4422c5c4113dSnw state.sid2pid_done = TRUE; 4423479ac375Sdm retcode = sid2pid_first_pass(&state, mapping, &idres); 4424c5c4113dSnw if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE) 4425c5c4113dSnw goto out; 4426c5c4113dSnw 4427479ac375Sdm /* AD lookup */ 4428e8c27ec8Sbaban if (state.ad_nqueries > 0) { 4429479ac375Sdm retcode = ad_lookup_one(&state, mapping, &idres); 4430e8c27ec8Sbaban if (IDMAP_ERROR(retcode)) 4431e8c27ec8Sbaban goto out; 4432e8c27ec8Sbaban } 4433c5c4113dSnw 4434479ac375Sdm /* nldap lookup */ 4435479ac375Sdm if (state.nldap_nqueries > 0) { 4436479ac375Sdm retcode = nldap_lookup_one(&state, mapping, &idres); 4437479ac375Sdm if (IDMAP_FATAL_ERROR(retcode)) 4438e8c27ec8Sbaban goto out; 4439c5c4113dSnw } 4440c5c4113dSnw 4441e8c27ec8Sbaban /* Next pass performs name-based mapping and ephemeral mapping. */ 4442c5c4113dSnw state.sid2pid_done = TRUE; 4443479ac375Sdm retcode = sid2pid_second_pass(&state, mapping, &idres); 4444c5c4113dSnw if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE) 4445c5c4113dSnw goto out; 4446c5c4113dSnw 4447c5c4113dSnw /* Update cache */ 4448479ac375Sdm (void) update_cache_sid2pid(&state, mapping, &idres); 4449c5c4113dSnw 4450c5c4113dSnw out: 4451e8c27ec8Sbaban /* 4452e8c27ec8Sbaban * Note that "mapping" is returned to the client. Therefore 4453e8c27ec8Sbaban * copy whatever we have in "idres" to mapping->id2 and 4454e8c27ec8Sbaban * free idres. 4455e8c27ec8Sbaban */ 4456e8c27ec8Sbaban mapping->direction = idres.direction; 4457e8c27ec8Sbaban mapping->id2 = idres.id; 445848258c6bSjp if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO || 445948258c6bSjp retcode != IDMAP_SUCCESS) 446048258c6bSjp (void) idmap_info_mov(&mapping->info, &idres.info); 446148258c6bSjp else 446248258c6bSjp idmap_info_free(&idres.info); 4463e8c27ec8Sbaban (void) memset(&idres, 0, sizeof (idres)); 4464e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 446562c60062Sbaban mapping->id2.idmap_id_u.uid = UID_NOBODY; 4466c5c4113dSnw xdr_free(xdr_idmap_id_res, (caddr_t)&idres); 4467e8c27ec8Sbaban cleanup_lookup_state(&state); 4468c5c4113dSnw return (retcode); 4469c5c4113dSnw } 4470c5c4113dSnw 4471c5c4113dSnw idmap_retcode 4472c5c4113dSnw get_u2w_mapping(sqlite *cache, sqlite *db, idmap_mapping *request, 4473cd37da74Snw idmap_mapping *mapping, int is_user) 4474cd37da74Snw { 4475c5c4113dSnw idmap_id_res idres; 4476c5c4113dSnw lookup_state_t state; 4477c5c4113dSnw idmap_retcode retcode; 4478c5c4113dSnw 4479c5c4113dSnw /* 4480c5c4113dSnw * In order to re-use the pid2sid code, we convert 4481c5c4113dSnw * our input data into structs that are expected by 4482c5c4113dSnw * pid2sid_first_pass. 4483c5c4113dSnw */ 4484c5c4113dSnw 4485c5c4113dSnw (void) memset(&idres, 0, sizeof (idres)); 4486c5c4113dSnw (void) memset(&state, 0, sizeof (state)); 4487479ac375Sdm state.cache = cache; 4488479ac375Sdm state.db = db; 4489c5c4113dSnw 4490e8c27ec8Sbaban /* Get directory-based name mapping info */ 4491479ac375Sdm retcode = load_cfg_in_state(&state); 4492e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4493e8c27ec8Sbaban goto out; 4494e8c27ec8Sbaban 4495e8c27ec8Sbaban /* 4496e8c27ec8Sbaban * Copy data from "request" to "mapping". Note that 4497e8c27ec8Sbaban * empty strings are not copied from "request" to 4498e8c27ec8Sbaban * "mapping" and therefore the coresponding strings in 4499e8c27ec8Sbaban * "mapping" will be NULL. This eliminates having to 4500e8c27ec8Sbaban * check for empty strings henceforth. 4501e8c27ec8Sbaban */ 4502651c0131Sbaban if (copy_mapping_request(mapping, request) < 0) { 4503651c0131Sbaban retcode = IDMAP_ERR_MEMORY; 4504651c0131Sbaban goto out; 4505651c0131Sbaban } 4506c5c4113dSnw 4507e8c27ec8Sbaban /* 4508e8c27ec8Sbaban * For unix to windows mapping request, we need atleast a 4509e8c27ec8Sbaban * unixname or uid/gid to proceed 4510e8c27ec8Sbaban */ 4511e8c27ec8Sbaban if (mapping->id1name == NULL && 4512cf5b5989Sdm mapping->id1.idmap_id_u.uid == SENTINEL_PID) { 4513c5c4113dSnw retcode = IDMAP_ERR_ARG; 4514c5c4113dSnw goto out; 4515c5c4113dSnw } 4516c5c4113dSnw 4517e8c27ec8Sbaban /* First pass looks up cache and well-known SIDs */ 4518e8c27ec8Sbaban state.pid2sid_done = TRUE; 4519479ac375Sdm retcode = pid2sid_first_pass(&state, mapping, &idres, is_user, 1); 4520e8c27ec8Sbaban if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE) 4521e8c27ec8Sbaban goto out; 4522e8c27ec8Sbaban 4523479ac375Sdm /* nldap lookup */ 4524e8c27ec8Sbaban if (state.nldap_nqueries > 0) { 4525479ac375Sdm retcode = nldap_lookup_one(&state, mapping, &idres); 4526e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) 4527e8c27ec8Sbaban goto out; 4528479ac375Sdm } 4529e8c27ec8Sbaban 4530479ac375Sdm /* AD lookup */ 4531479ac375Sdm if (state.ad_nqueries > 0) { 4532479ac375Sdm retcode = ad_lookup_one(&state, mapping, &idres); 4533e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) 4534e8c27ec8Sbaban goto out; 4535c5c4113dSnw } 4536c5c4113dSnw 4537e8c27ec8Sbaban /* 4538e8c27ec8Sbaban * Next pass processes the result of the preceding passes/lookups. 4539e8c27ec8Sbaban * It returns if there's nothing more to be done otherwise it 4540e8c27ec8Sbaban * evaluates local name-based mapping rules 4541e8c27ec8Sbaban */ 4542c5c4113dSnw state.pid2sid_done = TRUE; 4543479ac375Sdm retcode = pid2sid_second_pass(&state, mapping, &idres, is_user); 4544c5c4113dSnw if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE) 4545c5c4113dSnw goto out; 4546c5c4113dSnw 4547c5c4113dSnw /* Update cache */ 4548479ac375Sdm (void) update_cache_pid2sid(&state, mapping, &idres); 4549c5c4113dSnw 4550c5c4113dSnw out: 4551e8c27ec8Sbaban /* 4552e8c27ec8Sbaban * Note that "mapping" is returned to the client. Therefore 4553e8c27ec8Sbaban * copy whatever we have in "idres" to mapping->id2 and 4554e8c27ec8Sbaban * free idres. 4555e8c27ec8Sbaban */ 4556c5c4113dSnw mapping->direction = idres.direction; 4557c5c4113dSnw mapping->id2 = idres.id; 455848258c6bSjp if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO || 455948258c6bSjp retcode != IDMAP_SUCCESS) 456048258c6bSjp (void) idmap_info_mov(&mapping->info, &idres.info); 456148258c6bSjp else 456248258c6bSjp idmap_info_free(&idres.info); 4563c5c4113dSnw (void) memset(&idres, 0, sizeof (idres)); 4564c5c4113dSnw xdr_free(xdr_idmap_id_res, (caddr_t)&idres); 4565e8c27ec8Sbaban cleanup_lookup_state(&state); 4566e8c27ec8Sbaban return (retcode); 4567e8c27ec8Sbaban } 4568e8c27ec8Sbaban 4569479ac375Sdm /*ARGSUSED*/ 4570e8c27ec8Sbaban static 4571e8c27ec8Sbaban idmap_retcode 4572479ac375Sdm ad_lookup_one(lookup_state_t *state, idmap_mapping *req, idmap_id_res *res) 4573e8c27ec8Sbaban { 4574479ac375Sdm idmap_mapping_batch batch; 4575479ac375Sdm idmap_ids_res result; 4576479ac375Sdm 4577479ac375Sdm batch.idmap_mapping_batch_len = 1; 4578479ac375Sdm batch.idmap_mapping_batch_val = req; 4579479ac375Sdm result.ids.ids_len = 1; 4580479ac375Sdm result.ids.ids_val = res; 4581479ac375Sdm return (ad_lookup_batch(state, &batch, &result)); 4582c5c4113dSnw } 4583