1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 22148c5f43SAlan Wright * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23c5c4113dSnw */ 24c5c4113dSnw 25c5c4113dSnw /* 26c5c4113dSnw * Database related utility routines 27c5c4113dSnw */ 28c5c4113dSnw 29c5c4113dSnw #include <stdio.h> 30c5c4113dSnw #include <stdlib.h> 31c5c4113dSnw #include <string.h> 32c5c4113dSnw #include <errno.h> 33c5c4113dSnw #include <sys/types.h> 34c5c4113dSnw #include <sys/stat.h> 35c5c4113dSnw #include <rpc/rpc.h> 36c5c4113dSnw #include <sys/sid.h> 37c5c4113dSnw #include <time.h> 38c5c4113dSnw #include <pwd.h> 39c5c4113dSnw #include <grp.h> 4084decf41Sjp #include <pthread.h> 4184decf41Sjp #include <assert.h> 42cd37da74Snw #include <sys/u8_textprep.h> 438c155366SJordan Brown #include <alloca.h> 44*cb174861Sjoyce mcintosh #include <libuutil.h> 45148c5f43SAlan Wright #include <note.h> 46c5c4113dSnw 47c5c4113dSnw #include "idmapd.h" 48c5c4113dSnw #include "adutils.h" 49c5c4113dSnw #include "string.h" 50c5c4113dSnw #include "idmap_priv.h" 51cd37da74Snw #include "schema.h" 52e8c27ec8Sbaban #include "nldaputils.h" 53148c5f43SAlan Wright #include "idmap_lsa.h" 54c5c4113dSnw 5584decf41Sjp 56c5c4113dSnw static idmap_retcode sql_compile_n_step_once(sqlite *, char *, 57c5c4113dSnw sqlite_vm **, int *, int, const char ***); 58e8c27ec8Sbaban static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *); 59e8c27ec8Sbaban static idmap_retcode lookup_cache_name2sid(sqlite *, const char *, 60148c5f43SAlan Wright const char *, char **, char **, idmap_rid_t *, idmap_id_type *); 61e8c27ec8Sbaban 62c5c4113dSnw #define EMPTY_NAME(name) (*name == 0 || strcmp(name, "\"\"") == 0) 63c5c4113dSnw 64c5c4113dSnw #define DO_NOT_ALLOC_NEW_ID_MAPPING(req)\ 65c5c4113dSnw (req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC) 66c5c4113dSnw 67c5c4113dSnw #define AVOID_NAMESERVICE(req)\ 68c5c4113dSnw (req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE) 69c5c4113dSnw 702b4a7802SBaban Kenkre #define ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)\ 712b4a7802SBaban Kenkre (req->flag & IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY) 722b4a7802SBaban Kenkre 73c5c4113dSnw typedef enum init_db_option { 74c5c4113dSnw FAIL_IF_CORRUPT = 0, 75c5c4113dSnw REMOVE_IF_CORRUPT = 1 76c5c4113dSnw } init_db_option_t; 77c5c4113dSnw 7884decf41Sjp /* 7908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Thread specific data to hold the database handles so that the 8008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * databases are not opened and closed for every request. It also 8184decf41Sjp * contains the sqlite busy handler structure. 8284decf41Sjp */ 8384decf41Sjp 8484decf41Sjp struct idmap_busy { 8584decf41Sjp const char *name; 8684decf41Sjp const int *delays; 8784decf41Sjp int delay_size; 8884decf41Sjp int total; 8984decf41Sjp int sec; 9084decf41Sjp }; 9184decf41Sjp 9284decf41Sjp 9384decf41Sjp typedef struct idmap_tsd { 9484decf41Sjp sqlite *db_db; 9584decf41Sjp sqlite *cache_db; 9684decf41Sjp struct idmap_busy cache_busy; 9784decf41Sjp struct idmap_busy db_busy; 9884decf41Sjp } idmap_tsd_t; 9984decf41Sjp 100e3f2c991SKeyur Desai /* 101e3f2c991SKeyur Desai * Flags to indicate how local the directory we're consulting is. 102e3f2c991SKeyur Desai * If neither is set, it means the directory belongs to a remote forest. 103e3f2c991SKeyur Desai */ 104e3f2c991SKeyur Desai #define DOMAIN_IS_LOCAL 0x01 105e3f2c991SKeyur Desai #define FOREST_IS_LOCAL 0x02 10684decf41Sjp 10784decf41Sjp static const int cache_delay_table[] = 10884decf41Sjp { 1, 2, 5, 10, 15, 20, 25, 30, 35, 40, 10984decf41Sjp 50, 50, 60, 70, 80, 90, 100}; 11084decf41Sjp 11184decf41Sjp static const int db_delay_table[] = 11284decf41Sjp { 5, 10, 15, 20, 30, 40, 55, 70, 100}; 11384decf41Sjp 11484decf41Sjp 11584decf41Sjp static pthread_key_t idmap_tsd_key; 11684decf41Sjp 11784decf41Sjp void 11884decf41Sjp idmap_tsd_destroy(void *key) 11984decf41Sjp { 12084decf41Sjp 12184decf41Sjp idmap_tsd_t *tsd = (idmap_tsd_t *)key; 12284decf41Sjp if (tsd) { 12384decf41Sjp if (tsd->db_db) 12484decf41Sjp (void) sqlite_close(tsd->db_db); 12584decf41Sjp if (tsd->cache_db) 12684decf41Sjp (void) sqlite_close(tsd->cache_db); 12784decf41Sjp free(tsd); 12884decf41Sjp } 12984decf41Sjp } 13084decf41Sjp 131148c5f43SAlan Wright void 132cd37da74Snw idmap_init_tsd_key(void) 133cd37da74Snw { 134148c5f43SAlan Wright int rc; 135148c5f43SAlan Wright 136148c5f43SAlan Wright rc = pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy); 137148c5f43SAlan Wright assert(rc == 0); 13884decf41Sjp } 13984decf41Sjp 14084decf41Sjp 14184decf41Sjp 14284decf41Sjp idmap_tsd_t * 14384decf41Sjp idmap_get_tsd(void) 14484decf41Sjp { 14584decf41Sjp idmap_tsd_t *tsd; 14684decf41Sjp 14784decf41Sjp if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) { 14884decf41Sjp /* No thread specific data so create it */ 14984decf41Sjp if ((tsd = malloc(sizeof (*tsd))) != NULL) { 15084decf41Sjp /* Initialize thread specific data */ 15184decf41Sjp (void) memset(tsd, 0, sizeof (*tsd)); 15284decf41Sjp /* save the trhread specific data */ 15384decf41Sjp if (pthread_setspecific(idmap_tsd_key, tsd) != 0) { 15484decf41Sjp /* Can't store key */ 15584decf41Sjp free(tsd); 15684decf41Sjp tsd = NULL; 15784decf41Sjp } 15884decf41Sjp } else { 15984decf41Sjp tsd = NULL; 16084decf41Sjp } 16184decf41Sjp } 16284decf41Sjp 16384decf41Sjp return (tsd); 16484decf41Sjp } 16584decf41Sjp 166cd37da74Snw /* 167cd37da74Snw * A simple wrapper around u8_textprep_str() that returns the Unicode 168cd37da74Snw * lower-case version of some string. The result must be freed. 169cd37da74Snw */ 170cd37da74Snw char * 171cd37da74Snw tolower_u8(const char *s) 172cd37da74Snw { 173cd37da74Snw char *res = NULL; 174cd37da74Snw char *outs; 175cd37da74Snw size_t inlen, outlen, inbytesleft, outbytesleft; 176cd37da74Snw int rc, err; 177cd37da74Snw 178cd37da74Snw /* 179cd37da74Snw * u8_textprep_str() does not allocate memory. The input and 180cd37da74Snw * output buffers may differ in size (though that would be more 181cd37da74Snw * likely when normalization is done). We have to loop over it... 182cd37da74Snw * 183cd37da74Snw * To improve the chances that we can avoid looping we add 10 184cd37da74Snw * bytes of output buffer room the first go around. 185cd37da74Snw */ 186cd37da74Snw inlen = inbytesleft = strlen(s); 187cd37da74Snw outlen = outbytesleft = inlen + 10; 188cd37da74Snw if ((res = malloc(outlen)) == NULL) 189cd37da74Snw return (NULL); 190cd37da74Snw outs = res; 191cd37da74Snw 192cd37da74Snw while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs, 193cd37da74Snw &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 && 194cd37da74Snw err == E2BIG) { 195cd37da74Snw if ((res = realloc(res, outlen + inbytesleft)) == NULL) 196cd37da74Snw return (NULL); 197cd37da74Snw /* adjust input/output buffer pointers */ 198cd37da74Snw s += (inlen - inbytesleft); 199cd37da74Snw outs = res + outlen - outbytesleft; 200cd37da74Snw /* adjust outbytesleft and outlen */ 201cd37da74Snw outlen += inbytesleft; 202cd37da74Snw outbytesleft += inbytesleft; 203cd37da74Snw } 204cd37da74Snw 205cd37da74Snw if (rc < 0) { 206cd37da74Snw free(res); 207cd37da74Snw res = NULL; 208cd37da74Snw return (NULL); 209cd37da74Snw } 210cd37da74Snw 211cd37da74Snw res[outlen - outbytesleft] = '\0'; 212cd37da74Snw 213cd37da74Snw return (res); 214cd37da74Snw } 215cd37da74Snw 216cd37da74Snw static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 217cd37da74Snw const char *while_doing); 218cd37da74Snw 219c5c4113dSnw 220c5c4113dSnw /* 221c5c4113dSnw * Initialize 'dbname' using 'sql' 222c5c4113dSnw */ 223cd37da74Snw static 224cd37da74Snw int 225cd37da74Snw init_db_instance(const char *dbname, int version, 226cd37da74Snw const char *detect_version_sql, char * const *sql, 227cd37da74Snw init_db_option_t opt, int *created, int *upgraded) 228c5c4113dSnw { 229cd37da74Snw int rc, curr_version; 230cd37da74Snw int tries = 1; 231cd37da74Snw int prio = LOG_NOTICE; 232c5c4113dSnw sqlite *db = NULL; 233cd37da74Snw char *errmsg = NULL; 234c5c4113dSnw 235cd37da74Snw *created = 0; 236cd37da74Snw *upgraded = 0; 237c5c4113dSnw 238cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 239cd37da74Snw tries = 3; 240c5c4113dSnw 241cd37da74Snw rinse_repeat: 242cd37da74Snw if (tries == 0) { 243cd37da74Snw idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname); 244cd37da74Snw return (-1); 245c5c4113dSnw } 246cd37da74Snw if (tries-- == 1) 247cd37da74Snw /* Last try, log errors */ 248cd37da74Snw prio = LOG_ERR; 249c5c4113dSnw 250cd37da74Snw db = sqlite_open(dbname, 0600, &errmsg); 251cd37da74Snw if (db == NULL) { 252cd37da74Snw idmapdlog(prio, "Error creating database %s (%s)", 253cd37da74Snw dbname, CHECK_NULL(errmsg)); 254cd37da74Snw sqlite_freemem(errmsg); 255cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 256cd37da74Snw (void) unlink(dbname); 257cd37da74Snw goto rinse_repeat; 258c5c4113dSnw } 259c5c4113dSnw 260cd37da74Snw sqlite_busy_timeout(db, 3000); 261c5c4113dSnw 262cd37da74Snw /* Detect current version of schema in the db, if any */ 263cd37da74Snw curr_version = 0; 264cd37da74Snw if (detect_version_sql != NULL) { 265cd37da74Snw char *end, **results; 266cd37da74Snw int nrow; 267cd37da74Snw 268cd37da74Snw #ifdef IDMAPD_DEBUG 269cd37da74Snw (void) fprintf(stderr, "Schema version detection SQL: %s\n", 270cd37da74Snw detect_version_sql); 271cd37da74Snw #endif /* IDMAPD_DEBUG */ 272cd37da74Snw rc = sqlite_get_table(db, detect_version_sql, &results, 273cd37da74Snw &nrow, NULL, &errmsg); 274cd37da74Snw if (rc != SQLITE_OK) { 275cd37da74Snw idmapdlog(prio, 276cd37da74Snw "Error detecting schema version of db %s (%s)", 277cd37da74Snw dbname, errmsg); 278cd37da74Snw sqlite_freemem(errmsg); 279cd37da74Snw sqlite_free_table(results); 280cd37da74Snw sqlite_close(db); 281cd37da74Snw return (-1); 282cd37da74Snw } 283cd37da74Snw if (nrow != 1) { 284cd37da74Snw idmapdlog(prio, 285cd37da74Snw "Error detecting schema version of db %s", dbname); 286cd37da74Snw sqlite_close(db); 287cd37da74Snw sqlite_free_table(results); 288cd37da74Snw return (-1); 289cd37da74Snw } 290cd37da74Snw curr_version = strtol(results[1], &end, 10); 291cd37da74Snw sqlite_free_table(results); 292c5c4113dSnw } 293c5c4113dSnw 294cd37da74Snw if (curr_version < 0) { 295cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 296cd37da74Snw (void) unlink(dbname); 297cd37da74Snw goto rinse_repeat; 298cd37da74Snw } 299cd37da74Snw 300cd37da74Snw if (curr_version == version) 301cd37da74Snw goto done; 302cd37da74Snw 303cd37da74Snw /* Install or upgrade schema */ 304cd37da74Snw #ifdef IDMAPD_DEBUG 305cd37da74Snw (void) fprintf(stderr, "Schema init/upgrade SQL: %s\n", 306cd37da74Snw sql[curr_version]); 307cd37da74Snw #endif /* IDMAPD_DEBUG */ 308cd37da74Snw rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname, 309cd37da74Snw (curr_version == 0) ? "installing schema" : "upgrading schema"); 310cd37da74Snw if (rc != 0) { 311cd37da74Snw idmapdlog(prio, "Error %s schema for db %s", dbname, 312cd37da74Snw (curr_version == 0) ? "installing schema" : 313cd37da74Snw "upgrading schema"); 314cd37da74Snw if (opt == REMOVE_IF_CORRUPT) 315cd37da74Snw (void) unlink(dbname); 316cd37da74Snw goto rinse_repeat; 317c5c4113dSnw } 318c5c4113dSnw 319cd37da74Snw *upgraded = (curr_version > 0); 320cd37da74Snw *created = (curr_version == 0); 321cd37da74Snw 322cd37da74Snw done: 323c5c4113dSnw (void) sqlite_close(db); 324cd37da74Snw return (0); 325c5c4113dSnw } 326c5c4113dSnw 32784decf41Sjp 32884decf41Sjp /* 32984decf41Sjp * This is the SQLite database busy handler that retries the SQL 33084decf41Sjp * operation until it is successful. 33184decf41Sjp */ 33284decf41Sjp int 33384decf41Sjp /* LINTED E_FUNC_ARG_UNUSED */ 33484decf41Sjp idmap_sqlite_busy_handler(void *arg, const char *table_name, int count) 33584decf41Sjp { 33684decf41Sjp struct idmap_busy *busy = arg; 33784decf41Sjp int delay; 33884decf41Sjp struct timespec rqtp; 33984decf41Sjp 34084decf41Sjp if (count == 1) { 34184decf41Sjp busy->total = 0; 34284decf41Sjp busy->sec = 2; 34384decf41Sjp } 34484decf41Sjp if (busy->total > 1000 * busy->sec) { 3452b3ecdebSjp idmapdlog(LOG_DEBUG, 34684decf41Sjp "Thread %d waited %d sec for the %s database", 34784decf41Sjp pthread_self(), busy->sec, busy->name); 34884decf41Sjp busy->sec++; 34984decf41Sjp } 35084decf41Sjp 35184decf41Sjp if (count <= busy->delay_size) { 35284decf41Sjp delay = busy->delays[count-1]; 35384decf41Sjp } else { 35484decf41Sjp delay = busy->delays[busy->delay_size - 1]; 35584decf41Sjp } 35684decf41Sjp busy->total += delay; 35784decf41Sjp rqtp.tv_sec = 0; 35884decf41Sjp rqtp.tv_nsec = delay * (NANOSEC / MILLISEC); 35984decf41Sjp (void) nanosleep(&rqtp, NULL); 36084decf41Sjp return (1); 36184decf41Sjp } 36284decf41Sjp 36384decf41Sjp 364c5c4113dSnw /* 365c5c4113dSnw * Get the database handle 366c5c4113dSnw */ 367c5c4113dSnw idmap_retcode 368cd37da74Snw get_db_handle(sqlite **db) 369cd37da74Snw { 370cd37da74Snw char *errmsg; 371cd37da74Snw idmap_tsd_t *tsd; 372c5c4113dSnw 373c5c4113dSnw /* 37484decf41Sjp * Retrieve the db handle from thread-specific storage 375c5c4113dSnw * If none exists, open and store in thread-specific storage. 376c5c4113dSnw */ 37784decf41Sjp if ((tsd = idmap_get_tsd()) == NULL) { 378c5c4113dSnw idmapdlog(LOG_ERR, 379cd37da74Snw "Error getting thread specific data for %s", IDMAP_DBNAME); 38084decf41Sjp return (IDMAP_ERR_MEMORY); 381c5c4113dSnw } 38284decf41Sjp 38384decf41Sjp if (tsd->db_db == NULL) { 38484decf41Sjp tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg); 38584decf41Sjp if (tsd->db_db == NULL) { 386cd37da74Snw idmapdlog(LOG_ERR, "Error opening database %s (%s)", 387cd37da74Snw IDMAP_DBNAME, CHECK_NULL(errmsg)); 38884decf41Sjp sqlite_freemem(errmsg); 389cd37da74Snw return (IDMAP_ERR_DB); 39084decf41Sjp } 391cd37da74Snw 39284decf41Sjp tsd->db_busy.name = IDMAP_DBNAME; 39384decf41Sjp tsd->db_busy.delays = db_delay_table; 39484decf41Sjp tsd->db_busy.delay_size = sizeof (db_delay_table) / 39584decf41Sjp sizeof (int); 39684decf41Sjp sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler, 39784decf41Sjp &tsd->db_busy); 39884decf41Sjp } 39984decf41Sjp *db = tsd->db_db; 400c5c4113dSnw return (IDMAP_SUCCESS); 401c5c4113dSnw } 402c5c4113dSnw 403c5c4113dSnw /* 404c5c4113dSnw * Get the cache handle 405c5c4113dSnw */ 406c5c4113dSnw idmap_retcode 407cd37da74Snw get_cache_handle(sqlite **cache) 408cd37da74Snw { 409cd37da74Snw char *errmsg; 410cd37da74Snw idmap_tsd_t *tsd; 411c5c4113dSnw 412c5c4113dSnw /* 41384decf41Sjp * Retrieve the db handle from thread-specific storage 414c5c4113dSnw * If none exists, open and store in thread-specific storage. 415c5c4113dSnw */ 41684decf41Sjp if ((tsd = idmap_get_tsd()) == NULL) { 417cd37da74Snw idmapdlog(LOG_ERR, "Error getting thread specific data for %s", 418cd37da74Snw IDMAP_DBNAME); 41984decf41Sjp return (IDMAP_ERR_MEMORY); 420c5c4113dSnw } 42184decf41Sjp 42284decf41Sjp if (tsd->cache_db == NULL) { 42384decf41Sjp tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg); 42484decf41Sjp if (tsd->cache_db == NULL) { 425cd37da74Snw idmapdlog(LOG_ERR, "Error opening database %s (%s)", 426cd37da74Snw IDMAP_CACHENAME, CHECK_NULL(errmsg)); 42784decf41Sjp sqlite_freemem(errmsg); 428cd37da74Snw return (IDMAP_ERR_DB); 42984decf41Sjp } 430cd37da74Snw 43184decf41Sjp tsd->cache_busy.name = IDMAP_CACHENAME; 43284decf41Sjp tsd->cache_busy.delays = cache_delay_table; 43384decf41Sjp tsd->cache_busy.delay_size = sizeof (cache_delay_table) / 43484decf41Sjp sizeof (int); 43584decf41Sjp sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler, 43684decf41Sjp &tsd->cache_busy); 43784decf41Sjp } 43884decf41Sjp *cache = tsd->cache_db; 439c5c4113dSnw return (IDMAP_SUCCESS); 440c5c4113dSnw } 441c5c4113dSnw 442c5c4113dSnw /* 443c5c4113dSnw * Initialize cache and db 444c5c4113dSnw */ 445c5c4113dSnw int 446cd37da74Snw init_dbs() 447cd37da74Snw { 44848258c6bSjp char *sql[4]; 449cd37da74Snw int created, upgraded; 450cd37da74Snw 451c5c4113dSnw /* name-based mappings; probably OK to blow away in a pinch(?) */ 452cd37da74Snw sql[0] = DB_INSTALL_SQL; 453cd37da74Snw sql[1] = DB_UPGRADE_FROM_v1_SQL; 45448258c6bSjp sql[2] = NULL; 455cd37da74Snw 456cd37da74Snw if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql, 457cd37da74Snw FAIL_IF_CORRUPT, &created, &upgraded) < 0) 458c5c4113dSnw return (-1); 459c5c4113dSnw 460c5c4113dSnw /* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */ 461cd37da74Snw sql[0] = CACHE_INSTALL_SQL; 462cd37da74Snw sql[1] = CACHE_UPGRADE_FROM_v1_SQL; 46348258c6bSjp sql[2] = CACHE_UPGRADE_FROM_v2_SQL; 46448258c6bSjp sql[3] = NULL; 46548258c6bSjp 466cd37da74Snw if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL, 467cd37da74Snw sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0) 468c5c4113dSnw return (-1); 469c5c4113dSnw 470cd37da74Snw _idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0; 471cd37da74Snw 472c5c4113dSnw return (0); 473c5c4113dSnw } 474c5c4113dSnw 475c5c4113dSnw /* 476c5c4113dSnw * Finalize databases 477c5c4113dSnw */ 478c5c4113dSnw void 479cd37da74Snw fini_dbs() 480cd37da74Snw { 481c5c4113dSnw } 482c5c4113dSnw 483c5c4113dSnw /* 484e8c27ec8Sbaban * This table is a listing of status codes that will be returned to the 485c5c4113dSnw * client when a SQL command fails with the corresponding error message. 486c5c4113dSnw */ 487c5c4113dSnw static msg_table_t sqlmsgtable[] = { 48862c60062Sbaban {IDMAP_ERR_U2W_NAMERULE_CONFLICT, 489c5c4113dSnw "columns unixname, is_user, u2w_order are not unique"}, 49062c60062Sbaban {IDMAP_ERR_W2U_NAMERULE_CONFLICT, 491cd37da74Snw "columns winname, windomain, is_user, is_wuser, w2u_order are not" 492cd37da74Snw " unique"}, 493cd37da74Snw {IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"}, 494c5c4113dSnw {-1, NULL} 495c5c4113dSnw }; 496c5c4113dSnw 497c5c4113dSnw /* 498c5c4113dSnw * idmapd's version of string2stat to map SQLite messages to 499c5c4113dSnw * status codes 500c5c4113dSnw */ 501c5c4113dSnw idmap_retcode 502cd37da74Snw idmapd_string2stat(const char *msg) 503cd37da74Snw { 504c5c4113dSnw int i; 505c5c4113dSnw for (i = 0; sqlmsgtable[i].msg; i++) { 506c5c4113dSnw if (strcasecmp(sqlmsgtable[i].msg, msg) == 0) 507c5c4113dSnw return (sqlmsgtable[i].retcode); 508c5c4113dSnw } 509c5c4113dSnw return (IDMAP_ERR_OTHER); 510c5c4113dSnw } 511c5c4113dSnw 512cd37da74Snw /* 513cd37da74Snw * Executes some SQL in a transaction. 514cd37da74Snw * 515cd37da74Snw * Returns 0 on success, -1 if it failed but the rollback succeeded, -2 516cd37da74Snw * if the rollback failed. 517cd37da74Snw */ 518cd37da74Snw static 519cd37da74Snw int 520cd37da74Snw sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 521cd37da74Snw const char *while_doing) 522cd37da74Snw { 523cd37da74Snw char *errmsg = NULL; 524cd37da74Snw int rc; 525cd37da74Snw 526cd37da74Snw rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg); 527cd37da74Snw if (rc != SQLITE_OK) { 528cd37da74Snw idmapdlog(LOG_ERR, "Begin transaction failed (%s) " 529cd37da74Snw "while %s (%s)", errmsg, while_doing, dbname); 530cd37da74Snw sqlite_freemem(errmsg); 531cd37da74Snw return (-1); 532cd37da74Snw } 533cd37da74Snw 534cd37da74Snw rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 535cd37da74Snw if (rc != SQLITE_OK) { 536cd37da74Snw idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg, 537cd37da74Snw while_doing, dbname); 538cd37da74Snw sqlite_freemem(errmsg); 539cd37da74Snw errmsg = NULL; 540cd37da74Snw goto rollback; 541cd37da74Snw } 542cd37da74Snw 543cd37da74Snw rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg); 544cd37da74Snw if (rc == SQLITE_OK) { 545cd37da74Snw sqlite_freemem(errmsg); 546cd37da74Snw return (0); 547cd37da74Snw } 548cd37da74Snw 549cd37da74Snw idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)", 550cd37da74Snw errmsg, while_doing, dbname); 551cd37da74Snw sqlite_freemem(errmsg); 552cd37da74Snw errmsg = NULL; 553cd37da74Snw 554cd37da74Snw rollback: 555cd37da74Snw rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg); 556cd37da74Snw if (rc != SQLITE_OK) { 557cd37da74Snw idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)", 558cd37da74Snw errmsg, while_doing, dbname); 559cd37da74Snw sqlite_freemem(errmsg); 560cd37da74Snw return (-2); 561cd37da74Snw } 562cd37da74Snw sqlite_freemem(errmsg); 563cd37da74Snw 564cd37da74Snw return (-1); 565cd37da74Snw } 566cd37da74Snw 567c5c4113dSnw /* 568c5c4113dSnw * Execute the given SQL statment without using any callbacks 569c5c4113dSnw */ 570c5c4113dSnw idmap_retcode 57171590c90Snw sql_exec_no_cb(sqlite *db, const char *dbname, char *sql) 572cd37da74Snw { 573c5c4113dSnw char *errmsg = NULL; 57484decf41Sjp int r; 575c5c4113dSnw idmap_retcode retcode; 576c5c4113dSnw 57784decf41Sjp r = sqlite_exec(db, sql, NULL, NULL, &errmsg); 57884decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 579c5c4113dSnw 580c5c4113dSnw if (r != SQLITE_OK) { 58171590c90Snw idmapdlog(LOG_ERR, "Database error on %s while executing %s " 58271590c90Snw "(%s)", dbname, sql, CHECK_NULL(errmsg)); 58384decf41Sjp retcode = idmapd_string2stat(errmsg); 58462c60062Sbaban if (errmsg != NULL) 585c5c4113dSnw sqlite_freemem(errmsg); 586c5c4113dSnw return (retcode); 587c5c4113dSnw } 588c5c4113dSnw 589c5c4113dSnw return (IDMAP_SUCCESS); 590c5c4113dSnw } 591c5c4113dSnw 592c5c4113dSnw /* 593c5c4113dSnw * Generate expression that can be used in WHERE statements. 594c5c4113dSnw * Examples: 595c5c4113dSnw * <prefix> <col> <op> <value> <suffix> 596c5c4113dSnw * "" "unixuser" "=" "foo" "AND" 597c5c4113dSnw */ 598c5c4113dSnw idmap_retcode 599cd37da74Snw gen_sql_expr_from_rule(idmap_namerule *rule, char **out) 600cd37da74Snw { 601cd37da74Snw char *s_windomain = NULL, *s_winname = NULL; 602cd37da74Snw char *s_unixname = NULL; 603bbf6f00cSJordan Brown char *dir; 604cd37da74Snw char *lower_winname; 605cd37da74Snw int retcode = IDMAP_SUCCESS; 606cd37da74Snw 607c5c4113dSnw if (out == NULL) 608c5c4113dSnw return (IDMAP_ERR_ARG); 609c5c4113dSnw 610c5c4113dSnw 611cd37da74Snw if (!EMPTY_STRING(rule->windomain)) { 612cd37da74Snw s_windomain = sqlite_mprintf("AND windomain = %Q ", 613cd37da74Snw rule->windomain); 614cd37da74Snw if (s_windomain == NULL) { 615cd37da74Snw retcode = IDMAP_ERR_MEMORY; 616cd37da74Snw goto out; 617cd37da74Snw } 618cd37da74Snw } 619c5c4113dSnw 620cd37da74Snw if (!EMPTY_STRING(rule->winname)) { 621cd37da74Snw if ((lower_winname = tolower_u8(rule->winname)) == NULL) 622cd37da74Snw lower_winname = rule->winname; 623cd37da74Snw s_winname = sqlite_mprintf( 624cd37da74Snw "AND winname = %Q AND is_wuser = %d ", 625cd37da74Snw lower_winname, rule->is_wuser ? 1 : 0); 626cd37da74Snw if (lower_winname != rule->winname) 627cd37da74Snw free(lower_winname); 628cd37da74Snw if (s_winname == NULL) { 629cd37da74Snw retcode = IDMAP_ERR_MEMORY; 630cd37da74Snw goto out; 631cd37da74Snw } 632cd37da74Snw } 633cd37da74Snw 634cd37da74Snw if (!EMPTY_STRING(rule->unixname)) { 635cd37da74Snw s_unixname = sqlite_mprintf( 636cd37da74Snw "AND unixname = %Q AND is_user = %d ", 637cd37da74Snw rule->unixname, rule->is_user ? 1 : 0); 638cd37da74Snw if (s_unixname == NULL) { 639cd37da74Snw retcode = IDMAP_ERR_MEMORY; 640cd37da74Snw goto out; 641cd37da74Snw } 642cd37da74Snw } 643cd37da74Snw 644bbf6f00cSJordan Brown switch (rule->direction) { 645bbf6f00cSJordan Brown case IDMAP_DIRECTION_BI: 646bbf6f00cSJordan Brown dir = "AND w2u_order > 0 AND u2w_order > 0"; 647bbf6f00cSJordan Brown break; 648bbf6f00cSJordan Brown case IDMAP_DIRECTION_W2U: 649bbf6f00cSJordan Brown dir = "AND w2u_order > 0" 650bbf6f00cSJordan Brown " AND (u2w_order = 0 OR u2w_order ISNULL)"; 651bbf6f00cSJordan Brown break; 652bbf6f00cSJordan Brown case IDMAP_DIRECTION_U2W: 653bbf6f00cSJordan Brown dir = "AND u2w_order > 0" 654bbf6f00cSJordan Brown " AND (w2u_order = 0 OR w2u_order ISNULL)"; 655bbf6f00cSJordan Brown break; 656bbf6f00cSJordan Brown default: 657bbf6f00cSJordan Brown dir = ""; 658bbf6f00cSJordan Brown break; 659bbf6f00cSJordan Brown } 660bbf6f00cSJordan Brown 661bbf6f00cSJordan Brown *out = sqlite_mprintf("%s %s %s %s", 662cd37da74Snw s_windomain ? s_windomain : "", 663cd37da74Snw s_winname ? s_winname : "", 664bbf6f00cSJordan Brown s_unixname ? s_unixname : "", 665bbf6f00cSJordan Brown dir); 666cd37da74Snw 667cd37da74Snw if (*out == NULL) { 668cd37da74Snw retcode = IDMAP_ERR_MEMORY; 669cd37da74Snw idmapdlog(LOG_ERR, "Out of memory"); 670cd37da74Snw goto out; 671cd37da74Snw } 672cd37da74Snw 673cd37da74Snw out: 674cd37da74Snw if (s_windomain != NULL) 675cd37da74Snw sqlite_freemem(s_windomain); 676cd37da74Snw if (s_winname != NULL) 677cd37da74Snw sqlite_freemem(s_winname); 678cd37da74Snw if (s_unixname != NULL) 679cd37da74Snw sqlite_freemem(s_unixname); 680cd37da74Snw 681cd37da74Snw return (retcode); 682c5c4113dSnw } 683c5c4113dSnw 684cd37da74Snw 685cd37da74Snw 686c5c4113dSnw /* 687c5c4113dSnw * Generate and execute SQL statement for LIST RPC calls 688c5c4113dSnw */ 689c5c4113dSnw idmap_retcode 69071590c90Snw process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit, 69148258c6bSjp int flag, list_svc_cb cb, void *result) 692cd37da74Snw { 693c5c4113dSnw list_cb_data_t cb_data; 694c5c4113dSnw char *errmsg = NULL; 69584decf41Sjp int r; 696c5c4113dSnw idmap_retcode retcode = IDMAP_ERR_INTERNAL; 697c5c4113dSnw 698c5c4113dSnw (void) memset(&cb_data, 0, sizeof (cb_data)); 699c5c4113dSnw cb_data.result = result; 700c5c4113dSnw cb_data.limit = limit; 70148258c6bSjp cb_data.flag = flag; 702c5c4113dSnw 70384decf41Sjp 70484decf41Sjp r = sqlite_exec(db, sql, cb, &cb_data, &errmsg); 70584decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 70684decf41Sjp switch (r) { 70784decf41Sjp case SQLITE_OK: 70884decf41Sjp retcode = IDMAP_SUCCESS; 70984decf41Sjp break; 71084decf41Sjp 71184decf41Sjp default: 71284decf41Sjp retcode = IDMAP_ERR_INTERNAL; 71371590c90Snw idmapdlog(LOG_ERR, "Database error on %s while executing " 71471590c90Snw "%s (%s)", dbname, sql, CHECK_NULL(errmsg)); 71584decf41Sjp break; 716c5c4113dSnw } 71762c60062Sbaban if (errmsg != NULL) 718c5c4113dSnw sqlite_freemem(errmsg); 719c5c4113dSnw return (retcode); 720c5c4113dSnw } 721c5c4113dSnw 722c5c4113dSnw /* 723c5c4113dSnw * This routine is called by callbacks that process the results of 724c5c4113dSnw * LIST RPC calls to validate data and to allocate memory for 725c5c4113dSnw * the result array. 726c5c4113dSnw */ 727c5c4113dSnw idmap_retcode 728c5c4113dSnw validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv, 729cd37da74Snw int ncol, uchar_t **list, size_t valsize) 730cd37da74Snw { 731c5c4113dSnw size_t nsize; 732c5c4113dSnw void *tmplist; 733c5c4113dSnw 734c5c4113dSnw if (cb_data->limit > 0 && cb_data->next == cb_data->limit) 735c5c4113dSnw return (IDMAP_NEXT); 736c5c4113dSnw 737c5c4113dSnw if (argc < ncol || argv == NULL) { 738c5c4113dSnw idmapdlog(LOG_ERR, "Invalid data"); 739c5c4113dSnw return (IDMAP_ERR_INTERNAL); 740c5c4113dSnw } 741c5c4113dSnw 742c5c4113dSnw /* alloc in bulk to reduce number of reallocs */ 743c5c4113dSnw if (cb_data->next >= cb_data->len) { 744c5c4113dSnw nsize = (cb_data->len + SIZE_INCR) * valsize; 745c5c4113dSnw tmplist = realloc(*list, nsize); 746c5c4113dSnw if (tmplist == NULL) { 747c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 748c5c4113dSnw return (IDMAP_ERR_MEMORY); 749c5c4113dSnw } 750c5c4113dSnw *list = tmplist; 751c5c4113dSnw (void) memset(*list + (cb_data->len * valsize), 0, 752cd37da74Snw SIZE_INCR * valsize); 753c5c4113dSnw cb_data->len += SIZE_INCR; 754c5c4113dSnw } 755c5c4113dSnw return (IDMAP_SUCCESS); 756c5c4113dSnw } 757c5c4113dSnw 758cd37da74Snw static 759cd37da74Snw idmap_retcode 760c5c4113dSnw get_namerule_order(char *winname, char *windomain, char *unixname, 761cd37da74Snw int direction, int is_diagonal, int *w2u_order, int *u2w_order) 762cd37da74Snw { 763c5c4113dSnw *w2u_order = 0; 764c5c4113dSnw *u2w_order = 0; 765c5c4113dSnw 766c5c4113dSnw /* 767c5c4113dSnw * Windows to UNIX lookup order: 768c5c4113dSnw * 1. winname@domain (or winname) to "" 769c5c4113dSnw * 2. winname@domain (or winname) to unixname 770c5c4113dSnw * 3. winname@* to "" 771c5c4113dSnw * 4. winname@* to unixname 772c5c4113dSnw * 5. *@domain (or *) to * 773c5c4113dSnw * 6. *@domain (or *) to "" 774c5c4113dSnw * 7. *@domain (or *) to unixname 775c5c4113dSnw * 8. *@* to * 776c5c4113dSnw * 9. *@* to "" 777c5c4113dSnw * 10. *@* to unixname 778c5c4113dSnw * 779c5c4113dSnw * winname is a special case of winname@domain when domain is the 780c5c4113dSnw * default domain. Similarly * is a special case of *@domain when 781c5c4113dSnw * domain is the default domain. 782c5c4113dSnw * 783c5c4113dSnw * Note that "" has priority over specific names because "" inhibits 784c5c4113dSnw * mappings and traditionally deny rules always had higher priority. 785c5c4113dSnw */ 786651c0131Sbaban if (direction != IDMAP_DIRECTION_U2W) { 787651c0131Sbaban /* bi-directional or from windows to unix */ 788c5c4113dSnw if (winname == NULL) 789c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 790c5c4113dSnw else if (unixname == NULL) 791c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 792c5c4113dSnw else if (EMPTY_NAME(winname)) 793c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 794c5c4113dSnw else if (*winname == '*' && windomain && *windomain == '*') { 795c5c4113dSnw if (*unixname == '*') 796c5c4113dSnw *w2u_order = 8; 797c5c4113dSnw else if (EMPTY_NAME(unixname)) 798c5c4113dSnw *w2u_order = 9; 799c5c4113dSnw else /* unixname == name */ 800c5c4113dSnw *w2u_order = 10; 801c5c4113dSnw } else if (*winname == '*') { 802c5c4113dSnw if (*unixname == '*') 803c5c4113dSnw *w2u_order = 5; 804c5c4113dSnw else if (EMPTY_NAME(unixname)) 805c5c4113dSnw *w2u_order = 6; 806c5c4113dSnw else /* name */ 807c5c4113dSnw *w2u_order = 7; 80862c60062Sbaban } else if (windomain != NULL && *windomain == '*') { 809c5c4113dSnw /* winname == name */ 810c5c4113dSnw if (*unixname == '*') 811c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 812c5c4113dSnw else if (EMPTY_NAME(unixname)) 813c5c4113dSnw *w2u_order = 3; 814c5c4113dSnw else /* name */ 815c5c4113dSnw *w2u_order = 4; 816c5c4113dSnw } else { 817c5c4113dSnw /* winname == name && windomain == null or name */ 818c5c4113dSnw if (*unixname == '*') 819c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE); 820c5c4113dSnw else if (EMPTY_NAME(unixname)) 821c5c4113dSnw *w2u_order = 1; 822c5c4113dSnw else /* name */ 823c5c4113dSnw *w2u_order = 2; 824c5c4113dSnw } 825cd37da74Snw 826c5c4113dSnw } 827c5c4113dSnw 828c5c4113dSnw /* 829cd37da74Snw * 1. unixname to "", non-diagonal 830cd37da74Snw * 2. unixname to winname@domain (or winname), non-diagonal 831cd37da74Snw * 3. unixname to "", diagonal 832cd37da74Snw * 4. unixname to winname@domain (or winname), diagonal 833cd37da74Snw * 5. * to *@domain (or *), non-diagonal 834cd37da74Snw * 5. * to *@domain (or *), diagonal 835cd37da74Snw * 7. * to "" 836cd37da74Snw * 8. * to winname@domain (or winname) 837cd37da74Snw * 9. * to "", non-diagonal 838cd37da74Snw * 10. * to winname@domain (or winname), diagonal 839c5c4113dSnw */ 840651c0131Sbaban if (direction != IDMAP_DIRECTION_W2U) { 841cd37da74Snw int diagonal = is_diagonal ? 1 : 0; 842cd37da74Snw 843651c0131Sbaban /* bi-directional or from unix to windows */ 844c5c4113dSnw if (unixname == NULL || EMPTY_NAME(unixname)) 845c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 846c5c4113dSnw else if (winname == NULL) 847c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 84862c60062Sbaban else if (windomain != NULL && *windomain == '*') 849651c0131Sbaban return (IDMAP_ERR_U2W_NAMERULE); 850c5c4113dSnw else if (*unixname == '*') { 851c5c4113dSnw if (*winname == '*') 852cd37da74Snw *u2w_order = 5 + diagonal; 853c5c4113dSnw else if (EMPTY_NAME(winname)) 854cd37da74Snw *u2w_order = 7 + 2 * diagonal; 855c5c4113dSnw else 856cd37da74Snw *u2w_order = 8 + 2 * diagonal; 857c5c4113dSnw } else { 858c5c4113dSnw if (*winname == '*') 859c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE); 860c5c4113dSnw else if (EMPTY_NAME(winname)) 861cd37da74Snw *u2w_order = 1 + 2 * diagonal; 862c5c4113dSnw else 863cd37da74Snw *u2w_order = 2 + 2 * diagonal; 864c5c4113dSnw } 865c5c4113dSnw } 866c5c4113dSnw return (IDMAP_SUCCESS); 867c5c4113dSnw } 868c5c4113dSnw 869c5c4113dSnw /* 870c5c4113dSnw * Generate and execute SQL statement to add name-based mapping rule 871c5c4113dSnw */ 872c5c4113dSnw idmap_retcode 873cd37da74Snw add_namerule(sqlite *db, idmap_namerule *rule) 874cd37da74Snw { 875c5c4113dSnw char *sql = NULL; 876c5c4113dSnw idmap_stat retcode; 8778e228215Sdm char *dom = NULL; 87808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *name; 879c5c4113dSnw int w2u_order, u2w_order; 880c5c4113dSnw char w2ubuf[11], u2wbuf[11]; 88108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canonname = NULL; 88208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canondomain = NULL; 883c5c4113dSnw 8848e228215Sdm retcode = get_namerule_order(rule->winname, rule->windomain, 885cd37da74Snw rule->unixname, rule->direction, 886cd37da74Snw rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order); 887c5c4113dSnw if (retcode != IDMAP_SUCCESS) 888c5c4113dSnw goto out; 889c5c4113dSnw 890c5c4113dSnw if (w2u_order) 891c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order); 892c5c4113dSnw if (u2w_order) 893c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order); 894c5c4113dSnw 89562c60062Sbaban /* 89662c60062Sbaban * For the triggers on namerules table to work correctly: 89762c60062Sbaban * 1) Use NULL instead of 0 for w2u_order and u2w_order 89862c60062Sbaban * 2) Use "" instead of NULL for "no domain" 89962c60062Sbaban */ 900c5c4113dSnw 90108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name = rule->winname; 90208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = rule->windomain; 90362c60062Sbaban 90462c60062Sbaban RDLOCK_CONFIG(); 90508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (lookup_wksids_name2sid(name, dom, 90608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States &canonname, &canondomain, 90708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States NULL, NULL, NULL) == IDMAP_SUCCESS) { 90808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name = canonname; 90908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = canondomain; 91008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else if (EMPTY_STRING(dom)) { 911c8e26105Sjp if (_idmapdstate.cfg->pgcfg.default_domain) 912c8e26105Sjp dom = _idmapdstate.cfg->pgcfg.default_domain; 91362c60062Sbaban else 91462c60062Sbaban dom = ""; 91562c60062Sbaban } 91684decf41Sjp sql = sqlite_mprintf("INSERT into namerules " 917cd37da74Snw "(is_user, is_wuser, windomain, winname_display, is_nt4, " 918cd37da74Snw "unixname, w2u_order, u2w_order) " 919cd37da74Snw "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);", 920cd37da74Snw rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom, 92108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name, rule->is_nt4 ? 1 : 0, rule->unixname, 922cd37da74Snw w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL); 923c5c4113dSnw UNLOCK_CONFIG(); 924c5c4113dSnw 925c5c4113dSnw if (sql == NULL) { 926c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 927c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 928c5c4113dSnw goto out; 929c5c4113dSnw } 930c5c4113dSnw 93171590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 932c5c4113dSnw 933c5c4113dSnw if (retcode == IDMAP_ERR_OTHER) 934c5c4113dSnw retcode = IDMAP_ERR_CFG; 935c5c4113dSnw 936c5c4113dSnw out: 93708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(canonname); 93808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(canondomain); 93962c60062Sbaban if (sql != NULL) 940c5c4113dSnw sqlite_freemem(sql); 941c5c4113dSnw return (retcode); 942c5c4113dSnw } 943c5c4113dSnw 944c5c4113dSnw /* 945c5c4113dSnw * Flush name-based mapping rules 946c5c4113dSnw */ 947c5c4113dSnw idmap_retcode 948cd37da74Snw flush_namerules(sqlite *db) 949cd37da74Snw { 950c5c4113dSnw idmap_stat retcode; 951c5c4113dSnw 95271590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;"); 953c5c4113dSnw 954c5c4113dSnw return (retcode); 955c5c4113dSnw } 956c5c4113dSnw 957c5c4113dSnw /* 958c5c4113dSnw * Generate and execute SQL statement to remove a name-based mapping rule 959c5c4113dSnw */ 960c5c4113dSnw idmap_retcode 961cd37da74Snw rm_namerule(sqlite *db, idmap_namerule *rule) 962cd37da74Snw { 963c5c4113dSnw char *sql = NULL; 964c5c4113dSnw idmap_stat retcode; 965cd37da74Snw char *expr = NULL; 966c5c4113dSnw 9678e228215Sdm if (rule->direction < 0 && EMPTY_STRING(rule->windomain) && 9688e228215Sdm EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname)) 969c5c4113dSnw return (IDMAP_SUCCESS); 970c5c4113dSnw 971cd37da74Snw retcode = gen_sql_expr_from_rule(rule, &expr); 972cd37da74Snw if (retcode != IDMAP_SUCCESS) 973cd37da74Snw goto out; 974c5c4113dSnw 975bbf6f00cSJordan Brown sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s;", expr); 976c5c4113dSnw 977c5c4113dSnw if (sql == NULL) { 978c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 979c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 980c5c4113dSnw goto out; 981c5c4113dSnw } 982c5c4113dSnw 983cd37da74Snw 98471590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 985c5c4113dSnw 986c5c4113dSnw out: 987cd37da74Snw if (expr != NULL) 988cd37da74Snw sqlite_freemem(expr); 98962c60062Sbaban if (sql != NULL) 990c5c4113dSnw sqlite_freemem(sql); 991c5c4113dSnw return (retcode); 992c5c4113dSnw } 993c5c4113dSnw 994c5c4113dSnw /* 995c5c4113dSnw * Compile the given SQL query and step just once. 996c5c4113dSnw * 997c5c4113dSnw * Input: 998c5c4113dSnw * db - db handle 999c5c4113dSnw * sql - SQL statement 1000c5c4113dSnw * 1001c5c4113dSnw * Output: 1002c5c4113dSnw * vm - virtual SQL machine 1003c5c4113dSnw * ncol - number of columns in the result 1004c5c4113dSnw * values - column values 1005c5c4113dSnw * 1006c5c4113dSnw * Return values: 1007c5c4113dSnw * IDMAP_SUCCESS 1008c5c4113dSnw * IDMAP_ERR_NOTFOUND 1009c5c4113dSnw * IDMAP_ERR_INTERNAL 1010c5c4113dSnw */ 1011c5c4113dSnw 1012cd37da74Snw static 1013cd37da74Snw idmap_retcode 1014c5c4113dSnw sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol, 1015cd37da74Snw int reqcol, const char ***values) 1016cd37da74Snw { 1017c5c4113dSnw char *errmsg = NULL; 101884decf41Sjp int r; 1019c5c4113dSnw 102084decf41Sjp if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) { 1021cd37da74Snw idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1022cd37da74Snw CHECK_NULL(errmsg)); 1023c5c4113dSnw sqlite_freemem(errmsg); 1024c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1025c5c4113dSnw } 1026c5c4113dSnw 102784decf41Sjp r = sqlite_step(*vm, ncol, values, NULL); 102884decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 1029c5c4113dSnw 103084decf41Sjp if (r == SQLITE_ROW) { 103162c60062Sbaban if (ncol != NULL && *ncol < reqcol) { 1032c5c4113dSnw (void) sqlite_finalize(*vm, NULL); 1033c5c4113dSnw *vm = NULL; 1034c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1035c5c4113dSnw } 1036c5c4113dSnw /* Caller will call finalize after using the results */ 1037c5c4113dSnw return (IDMAP_SUCCESS); 1038c5c4113dSnw } else if (r == SQLITE_DONE) { 1039c5c4113dSnw (void) sqlite_finalize(*vm, NULL); 1040c5c4113dSnw *vm = NULL; 1041c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 1042c5c4113dSnw } 1043c5c4113dSnw 1044c5c4113dSnw (void) sqlite_finalize(*vm, &errmsg); 1045c5c4113dSnw *vm = NULL; 1046cd37da74Snw idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1047cd37da74Snw CHECK_NULL(errmsg)); 1048c5c4113dSnw sqlite_freemem(errmsg); 1049c5c4113dSnw return (IDMAP_ERR_INTERNAL); 1050c5c4113dSnw } 1051c5c4113dSnw 1052e8c27ec8Sbaban /* 1053479ac375Sdm * Load config in the state. 1054e8c27ec8Sbaban * 1055479ac375Sdm * nm_siduid and nm_sidgid fields: 1056e8c27ec8Sbaban * state->nm_siduid represents mode used by sid2uid and uid2sid 1057e8c27ec8Sbaban * requests for directory-based name mappings. Similarly, 1058e8c27ec8Sbaban * state->nm_sidgid represents mode used by sid2gid and gid2sid 1059e8c27ec8Sbaban * requests. 1060e8c27ec8Sbaban * 1061e8c27ec8Sbaban * sid2uid/uid2sid: 1062e3f2c991SKeyur Desai * none -> directory_based_mapping != DIRECTORY_MAPPING_NAME 1063e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixuser_attr 1064e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr 1065e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixuser_attr 1066e8c27ec8Sbaban * 1067e8c27ec8Sbaban * sid2gid/gid2sid: 1068e3f2c991SKeyur Desai * none -> directory_based_mapping != DIRECTORY_MAPPING_NAME 1069e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixgroup_attr 1070e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr 1071e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr 1072e8c27ec8Sbaban */ 1073e8c27ec8Sbaban idmap_retcode 1074479ac375Sdm load_cfg_in_state(lookup_state_t *state) 1075e8c27ec8Sbaban { 1076e8c27ec8Sbaban state->nm_siduid = IDMAP_NM_NONE; 1077e8c27ec8Sbaban state->nm_sidgid = IDMAP_NM_NONE; 1078e8c27ec8Sbaban RDLOCK_CONFIG(); 1079479ac375Sdm 10804aa0a5e7Snw state->eph_map_unres_sids = 0; 10814aa0a5e7Snw if (_idmapdstate.cfg->pgcfg.eph_map_unres_sids) 10824aa0a5e7Snw state->eph_map_unres_sids = 1; 10834aa0a5e7Snw 1084e3f2c991SKeyur Desai state->directory_based_mapping = 1085e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.directory_based_mapping; 1086e3f2c991SKeyur Desai 1087479ac375Sdm if (_idmapdstate.cfg->pgcfg.default_domain != NULL) { 1088479ac375Sdm state->defdom = 1089479ac375Sdm strdup(_idmapdstate.cfg->pgcfg.default_domain); 1090479ac375Sdm if (state->defdom == NULL) { 1091479ac375Sdm UNLOCK_CONFIG(); 1092479ac375Sdm return (IDMAP_ERR_MEMORY); 1093479ac375Sdm } 1094479ac375Sdm } else { 1095479ac375Sdm UNLOCK_CONFIG(); 1096dc03a638Sdm return (IDMAP_SUCCESS); 1097479ac375Sdm } 1098e3f2c991SKeyur Desai 1099e3f2c991SKeyur Desai if (_idmapdstate.cfg->pgcfg.directory_based_mapping != 1100e3f2c991SKeyur Desai DIRECTORY_MAPPING_NAME) { 1101e8c27ec8Sbaban UNLOCK_CONFIG(); 1102e8c27ec8Sbaban return (IDMAP_SUCCESS); 1103e8c27ec8Sbaban } 1104e3f2c991SKeyur Desai 1105e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1106e8c27ec8Sbaban state->nm_siduid = 1107e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1108e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1109e8c27ec8Sbaban state->nm_sidgid = 1110e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1111e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1112e8c27ec8Sbaban } else { 1113e8c27ec8Sbaban state->nm_siduid = 1114e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1115e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE; 1116e8c27ec8Sbaban state->nm_sidgid = 1117e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1118e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE; 1119e8c27ec8Sbaban } 1120e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) { 1121e8c27ec8Sbaban state->ad_unixuser_attr = 1122e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr); 1123e8c27ec8Sbaban if (state->ad_unixuser_attr == NULL) { 1124e8c27ec8Sbaban UNLOCK_CONFIG(); 1125e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1126e8c27ec8Sbaban } 1127e8c27ec8Sbaban } 1128e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) { 1129e8c27ec8Sbaban state->ad_unixgroup_attr = 1130e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr); 1131e8c27ec8Sbaban if (state->ad_unixgroup_attr == NULL) { 1132e8c27ec8Sbaban UNLOCK_CONFIG(); 1133e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1134e8c27ec8Sbaban } 1135e8c27ec8Sbaban } 1136479ac375Sdm if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1137479ac375Sdm state->nldap_winname_attr = 1138479ac375Sdm strdup(_idmapdstate.cfg->pgcfg.nldap_winname_attr); 1139479ac375Sdm if (state->nldap_winname_attr == NULL) { 1140479ac375Sdm UNLOCK_CONFIG(); 1141479ac375Sdm return (IDMAP_ERR_MEMORY); 1142479ac375Sdm } 1143479ac375Sdm } 1144e8c27ec8Sbaban UNLOCK_CONFIG(); 1145e8c27ec8Sbaban return (IDMAP_SUCCESS); 1146e8c27ec8Sbaban } 1147e8c27ec8Sbaban 114848258c6bSjp /* 114908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Set the rule with specified values. 115048258c6bSjp * All the strings are copied. 115148258c6bSjp */ 115248258c6bSjp static void 115348258c6bSjp idmap_namerule_set(idmap_namerule *rule, const char *windomain, 115448258c6bSjp const char *winname, const char *unixname, boolean_t is_user, 115548258c6bSjp boolean_t is_wuser, boolean_t is_nt4, int direction) 115648258c6bSjp { 115748258c6bSjp /* 115848258c6bSjp * Only update if they differ because we have to free 115948258c6bSjp * and duplicate the strings 116048258c6bSjp */ 116148258c6bSjp if (rule->windomain == NULL || windomain == NULL || 116248258c6bSjp strcmp(rule->windomain, windomain) != 0) { 116348258c6bSjp if (rule->windomain != NULL) { 116448258c6bSjp free(rule->windomain); 116548258c6bSjp rule->windomain = NULL; 116648258c6bSjp } 116748258c6bSjp if (windomain != NULL) 116848258c6bSjp rule->windomain = strdup(windomain); 116948258c6bSjp } 117048258c6bSjp 117148258c6bSjp if (rule->winname == NULL || winname == NULL || 117248258c6bSjp strcmp(rule->winname, winname) != 0) { 117348258c6bSjp if (rule->winname != NULL) { 117448258c6bSjp free(rule->winname); 117548258c6bSjp rule->winname = NULL; 117648258c6bSjp } 117748258c6bSjp if (winname != NULL) 117848258c6bSjp rule->winname = strdup(winname); 117948258c6bSjp } 118048258c6bSjp 118148258c6bSjp if (rule->unixname == NULL || unixname == NULL || 118248258c6bSjp strcmp(rule->unixname, unixname) != 0) { 118348258c6bSjp if (rule->unixname != NULL) { 118448258c6bSjp free(rule->unixname); 118548258c6bSjp rule->unixname = NULL; 118648258c6bSjp } 118748258c6bSjp if (unixname != NULL) 118848258c6bSjp rule->unixname = strdup(unixname); 118948258c6bSjp } 119048258c6bSjp 119148258c6bSjp rule->is_user = is_user; 119248258c6bSjp rule->is_wuser = is_wuser; 119348258c6bSjp rule->is_nt4 = is_nt4; 119448258c6bSjp rule->direction = direction; 119548258c6bSjp } 119648258c6bSjp 1197e8c27ec8Sbaban /* 1198e8c27ec8Sbaban * Lookup well-known SIDs table either by winname or by SID. 119908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 120008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If the given winname or SID is a well-known SID then we set is_wksid 1201e8c27ec8Sbaban * variable and then proceed to see if the SID has a hard mapping to 1202e8c27ec8Sbaban * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to 120308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * fixed ephemeral ids). The direction flag indicates whether we have 120408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * a mapping; UNDEF indicates that we do not. 120508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 120608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we find a mapping then we return success, except for the 12079fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * special case of IDMAP_SENTINEL_PID which indicates an inhibited mapping. 120808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 120908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we find a matching entry, but no mapping, we supply SID, name, and type 121008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * information and return "not found". Higher layers will probably 121108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * do ephemeral mapping. 121208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 121308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we do not find a match, we return "not found" and leave the question 121408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * to higher layers. 1215e8c27ec8Sbaban */ 1216cd37da74Snw static 1217cd37da74Snw idmap_retcode 121808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *is_wksid) 1219cd37da74Snw { 122008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid; 122162c60062Sbaban 122208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *is_wksid = 0; 122362c60062Sbaban 122408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.sid.prefix != NULL || 122508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name != NULL); 122608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 122708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix != NULL) { 122808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_sid(req->id1.idmap_id_u.sid.prefix, 122908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.rid, res->id.idtype); 123008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 123108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_name(req->id1name, req->id1domain, 123208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype); 123308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 123408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL) 123508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND); 123608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 123708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Found matching entry. */ 123808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 123908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in name if it was not already there. */ 124008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1name == NULL) { 124108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name = strdup(wksid->winname); 124208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1name == NULL) 124308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 124408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 124508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 124608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in SID if it was not already there */ 124708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix == NULL) { 124808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) { 124908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.prefix = 125008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(wksid->sidprefix); 125108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 125208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 1253e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = 125408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(_idmapdstate.cfg->pgcfg.machine_sid); 125508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 1256e8c27ec8Sbaban } 125708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix == NULL) 125808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 125908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.rid = wksid->rid; 126008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 1261e8c27ec8Sbaban 126208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in the canonical domain if not already there */ 126308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1domain == NULL) { 126408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *dom; 1265e8c27ec8Sbaban 126608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 1267fe1c642dSBill Krier if (wksid->domain != NULL) 126808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = wksid->domain; 1269fe1c642dSBill Krier else 127008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = _idmapdstate.hostname; 127108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1domain = strdup(dom); 127208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 127308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1domain == NULL) 127408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 127508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 1276e8c27ec8Sbaban 127708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *is_wksid = 1; 127808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 1279e8c27ec8Sbaban 128008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idtype = wksid->is_wuser ? IDMAP_USID : IDMAP_GSID; 128108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 128208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idtype == IDMAP_POSIXID) { 128308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype = wksid->is_wuser ? IDMAP_UID : IDMAP_GID; 1284c5c4113dSnw } 128508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 128608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->direction == IDMAP_DIRECTION_UNDEF) { 128708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 128808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * We don't have a mapping 128908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * (But note that we may have supplied SID, name, or type 129008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * information.) 129108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 129208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND); 129308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 129408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 129508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 129608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * We have an explicit mapping. 129708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 12989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->pid == IDMAP_SENTINEL_PID) { 129908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 130008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * ... which is that mapping is inhibited. 130108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 130208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOMAPPING); 130308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 130408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 130508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States switch (res->id.idtype) { 130608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_UID: 130708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = wksid->pid; 130808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States break; 130908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_GID: 131008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.gid = wksid->pid; 131108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States break; 131208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States default: 131308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* IDMAP_POSIXID is eliminated above */ 131408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTSUPPORTED); 131508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 131608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 131708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->direction = wksid->direction; 131808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID; 131908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.src = IDMAP_MAP_SRC_HARD_CODED; 132008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS); 1321c5c4113dSnw } 1322c5c4113dSnw 1323cd37da74Snw 132408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 132508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Look for an entry mapping a PID to a SID. 132608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 132708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Note that direction=UNDEF entries do not specify a mapping, 13289fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * and that IDMAP_SENTINEL_PID entries represent either an inhibited 132908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * mapping or an ephemeral mapping. We don't handle either here; 133008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * they are filtered out by find_wksid_by_pid. 133108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 1332cd37da74Snw static 1333cd37da74Snw idmap_retcode 1334cd37da74Snw lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user) 1335cd37da74Snw { 133608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid; 133708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 133808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_pid(req->id1.idmap_id_u.uid, is_user); 133908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL) 1340e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 134108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 134208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idtype == IDMAP_SID) { 134308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype = wksid->is_wuser ? IDMAP_USID : IDMAP_GSID; 134408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 134508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.rid = wksid->rid; 134608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 134708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) { 134808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.prefix = 134908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(wksid->sidprefix); 135008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 135108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 135208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.prefix = 135308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(_idmapdstate.cfg->pgcfg.machine_sid); 135408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 135508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 135608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 135708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idmap_id_u.sid.prefix == NULL) { 135808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory"); 135908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 136062c60062Sbaban } 136108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 1362fe1c642dSBill Krier /* Fill in name if it was not already there. */ 1363fe1c642dSBill Krier if (req->id2name == NULL) { 1364fe1c642dSBill Krier req->id2name = strdup(wksid->winname); 1365fe1c642dSBill Krier if (req->id2name == NULL) 1366fe1c642dSBill Krier return (IDMAP_ERR_MEMORY); 1367fe1c642dSBill Krier } 1368fe1c642dSBill Krier 1369fe1c642dSBill Krier /* Fill in the canonical domain if not already there */ 1370fe1c642dSBill Krier if (req->id2domain == NULL) { 1371fe1c642dSBill Krier const char *dom; 1372fe1c642dSBill Krier 1373fe1c642dSBill Krier RDLOCK_CONFIG(); 1374fe1c642dSBill Krier if (wksid->domain != NULL) 1375fe1c642dSBill Krier dom = wksid->domain; 1376fe1c642dSBill Krier else 1377fe1c642dSBill Krier dom = _idmapdstate.hostname; 1378fe1c642dSBill Krier req->id2domain = strdup(dom); 1379fe1c642dSBill Krier UNLOCK_CONFIG(); 1380fe1c642dSBill Krier if (req->id2domain == NULL) 1381fe1c642dSBill Krier return (IDMAP_ERR_MEMORY); 1382fe1c642dSBill Krier } 1383fe1c642dSBill Krier 138408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->direction = wksid->direction; 138508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID; 138608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.src = IDMAP_MAP_SRC_HARD_CODED; 138708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS); 138862c60062Sbaban } 138962c60062Sbaban 139008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 139108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Look up a name in the wksids list, matching name and, if supplied, domain, 139208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * and extract data. 139308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 139408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given: 139508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name 139608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name (or NULL) 139708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 139808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Return: Error code 139908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 140008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname canonical name (if canonname non-NULL) [1] 140108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canondomain canonical domain (if canondomain non-NULL) [1] 140208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix (if sidprefix non-NULL) [1] 140308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID (if rid non-NULL) [2] 140408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *type Type (if type non-NULL) [2] 140508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 140608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error 140708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [2] Undefined on error 140808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 1409cd37da74Snw idmap_retcode 141008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_wksids_name2sid( 141108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *name, 141208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *domain, 141308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canonname, 141408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canondomain, 141508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **sidprefix, 141608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *rid, 1417148c5f43SAlan Wright idmap_id_type *type) 1418cd37da74Snw { 141908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid; 1420479ac375Sdm 142108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) 142208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL; 142308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) 142408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 142508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) 142608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL; 1427479ac375Sdm 142808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_name(name, domain, IDMAP_POSIXID); 142908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL) 143008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND); 143108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 143208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) { 143308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) { 143408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(wksid->sidprefix); 143508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 143608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 143708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup( 143808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.cfg->pgcfg.machine_sid); 143908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 1440e8c27ec8Sbaban } 144108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*sidprefix == NULL) 144208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem; 144308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 144408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 144508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (rid != NULL) 144608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *rid = wksid->rid; 144708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 144808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 144908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = strdup(wksid->winname); 145008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canonname == NULL) 145108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem; 145208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 145308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 145408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) { 145508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->domain != NULL) { 145608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(wksid->domain); 145708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 145808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG(); 145908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(_idmapdstate.hostname); 146008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG(); 1461c5c4113dSnw } 146208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canondomain == NULL) 146308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem; 146408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 146508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 146608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (type != NULL) 146708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *type = (wksid->is_wuser) ? 1468148c5f43SAlan Wright IDMAP_USID : IDMAP_GSID; 146908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 147008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS); 147108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 147208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States nomem: 147308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory"); 147408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 147508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) { 147608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*sidprefix); 147708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL; 1478c5c4113dSnw } 147908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 148008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 148108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname); 148208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 148308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 148408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 148508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) { 148608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canondomain); 148708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL; 148808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 148908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 149008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY); 1491c5c4113dSnw } 1492c5c4113dSnw 1493cd37da74Snw static 1494cd37da74Snw idmap_retcode 1495cd37da74Snw lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1496cd37da74Snw { 1497c5c4113dSnw char *end; 1498c5c4113dSnw char *sql = NULL; 1499c5c4113dSnw const char **values; 1500c5c4113dSnw sqlite_vm *vm = NULL; 1501c5c4113dSnw int ncol, is_user; 1502c5c4113dSnw uid_t pid; 1503c5c4113dSnw time_t curtime, exp; 1504c5c4113dSnw idmap_retcode retcode; 1505042addd6Sbaban char *is_user_string, *lower_name; 1506c5c4113dSnw 1507c5c4113dSnw /* Current time */ 1508c5c4113dSnw errno = 0; 1509c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 1510cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1511cd37da74Snw strerror(errno)); 1512c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 1513c5c4113dSnw goto out; 1514c5c4113dSnw } 1515c5c4113dSnw 1516e8c27ec8Sbaban switch (res->id.idtype) { 1517cd37da74Snw case IDMAP_UID: 1518cd37da74Snw is_user_string = "1"; 1519cd37da74Snw break; 1520cd37da74Snw case IDMAP_GID: 1521cd37da74Snw is_user_string = "0"; 1522cd37da74Snw break; 1523cd37da74Snw case IDMAP_POSIXID: 1524cd37da74Snw /* the non-diagonal mapping */ 1525cd37da74Snw is_user_string = "is_wuser"; 1526cd37da74Snw break; 1527cd37da74Snw default: 1528cd37da74Snw retcode = IDMAP_ERR_NOTSUPPORTED; 1529cd37da74Snw goto out; 1530cd37da74Snw } 1531cd37da74Snw 1532c5c4113dSnw /* SQL to lookup the cache */ 153348258c6bSjp 1534e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 1535e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 153648258c6bSjp "unixname, u2w, is_wuser, " 153748258c6bSjp "map_type, map_dn, map_attr, map_value, " 153848258c6bSjp "map_windomain, map_winname, map_unixname, map_is_nt4 " 1539e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND " 1540e8c27ec8Sbaban "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 1541e8c27ec8Sbaban "(pid >= 2147483648 OR " 1542e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 1543e8c27ec8Sbaban "expiration > %d));", 1544e8c27ec8Sbaban is_user_string, req->id1.idmap_id_u.sid.prefix, 1545e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, curtime); 1546e8c27ec8Sbaban } else if (req->id1name != NULL) { 1547042addd6Sbaban if ((lower_name = tolower_u8(req->id1name)) == NULL) 1548042addd6Sbaban lower_name = req->id1name; 1549e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 155048258c6bSjp "unixname, u2w, is_wuser, " 155148258c6bSjp "map_type, map_dn, map_attr, map_value, " 155248258c6bSjp "map_windomain, map_winname, map_unixname, map_is_nt4 " 1553e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND " 1554e8c27ec8Sbaban "winname = %Q AND windomain = %Q AND w2u = 1 AND " 1555e8c27ec8Sbaban "(pid >= 2147483648 OR " 1556e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 1557e8c27ec8Sbaban "expiration > %d));", 155848258c6bSjp is_user_string, lower_name, req->id1domain, 155948258c6bSjp curtime); 1560042addd6Sbaban if (lower_name != req->id1name) 1561042addd6Sbaban free(lower_name); 1562e8c27ec8Sbaban } else { 1563e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 1564e8c27ec8Sbaban goto out; 1565e8c27ec8Sbaban } 1566c5c4113dSnw if (sql == NULL) { 1567c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1568c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1569c5c4113dSnw goto out; 1570c5c4113dSnw } 157148258c6bSjp retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 157248258c6bSjp 14, &values); 1573c5c4113dSnw sqlite_freemem(sql); 1574c5c4113dSnw 1575c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) { 1576c5c4113dSnw goto out; 1577c5c4113dSnw } else if (retcode == IDMAP_SUCCESS) { 1578c5c4113dSnw /* sanity checks */ 1579c5c4113dSnw if (values[0] == NULL || values[1] == NULL) { 1580c5c4113dSnw retcode = IDMAP_ERR_CACHE; 1581c5c4113dSnw goto out; 1582c5c4113dSnw } 1583c5c4113dSnw 1584c5c4113dSnw pid = strtoul(values[0], &end, 10); 1585e8c27ec8Sbaban is_user = strncmp(values[1], "0", 2) ? 1 : 0; 1586c5c4113dSnw 1587cd37da74Snw if (is_user) { 1588cd37da74Snw res->id.idtype = IDMAP_UID; 1589cd37da74Snw res->id.idmap_id_u.uid = pid; 1590cd37da74Snw } else { 1591cd37da74Snw res->id.idtype = IDMAP_GID; 1592cd37da74Snw res->id.idmap_id_u.gid = pid; 1593cd37da74Snw } 1594cd37da74Snw 1595c5c4113dSnw /* 1596c5c4113dSnw * We may have an expired ephemeral mapping. Consider 1597c5c4113dSnw * the expired entry as valid if we are not going to 1598c5c4113dSnw * perform name-based mapping. But do not renew the 1599c5c4113dSnw * expiration. 1600c5c4113dSnw * If we will be doing name-based mapping then store the 1601c5c4113dSnw * ephemeral pid in the result so that we can use it 1602c5c4113dSnw * if we end up doing dynamic mapping again. 1603c5c4113dSnw */ 1604c5c4113dSnw if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) && 1605cd37da74Snw !AVOID_NAMESERVICE(req) && 16069fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States IDMAP_ID_IS_EPHEMERAL(pid) && values[2] != NULL) { 1607cd37da74Snw exp = strtoll(values[2], &end, 10); 1608cd37da74Snw if (exp && exp <= curtime) { 1609cd37da74Snw /* Store the ephemeral pid */ 1610cd37da74Snw res->direction = IDMAP_DIRECTION_BI; 1611cd37da74Snw req->direction |= is_user 1612cd37da74Snw ? _IDMAP_F_EXP_EPH_UID 1613cd37da74Snw : _IDMAP_F_EXP_EPH_GID; 1614cd37da74Snw retcode = IDMAP_ERR_NOTFOUND; 1615c5c4113dSnw } 1616c5c4113dSnw } 1617c5c4113dSnw } 1618c5c4113dSnw 1619c5c4113dSnw out: 1620c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 162162c60062Sbaban if (values[4] != NULL) 1622c5c4113dSnw res->direction = 1623651c0131Sbaban (strtol(values[4], &end, 10) == 0)? 1624651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 1625c5c4113dSnw else 1626651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U; 1627c5c4113dSnw 162862c60062Sbaban if (values[3] != NULL) { 1629e8c27ec8Sbaban if (req->id2name != NULL) 1630e8c27ec8Sbaban free(req->id2name); 16318e228215Sdm req->id2name = strdup(values[3]); 16328e228215Sdm if (req->id2name == NULL) { 1633c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1634c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1635c5c4113dSnw } 1636c5c4113dSnw } 1637e8c27ec8Sbaban 1638e8c27ec8Sbaban req->id1.idtype = strncmp(values[5], "0", 2) ? 1639e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 164048258c6bSjp 164148258c6bSjp if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 164248258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 164348258c6bSjp res->info.how.map_type = strtoul(values[6], &end, 10); 164448258c6bSjp switch (res->info.how.map_type) { 164548258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 164648258c6bSjp res->info.how.idmap_how_u.ad.dn = 164748258c6bSjp strdup(values[7]); 164848258c6bSjp res->info.how.idmap_how_u.ad.attr = 164948258c6bSjp strdup(values[8]); 165048258c6bSjp res->info.how.idmap_how_u.ad.value = 165148258c6bSjp strdup(values[9]); 165248258c6bSjp break; 165348258c6bSjp 165448258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 165548258c6bSjp res->info.how.idmap_how_u.nldap.dn = 165648258c6bSjp strdup(values[7]); 165748258c6bSjp res->info.how.idmap_how_u.nldap.attr = 165848258c6bSjp strdup(values[8]); 165948258c6bSjp res->info.how.idmap_how_u.nldap.value = 166048258c6bSjp strdup(values[9]); 166148258c6bSjp break; 166248258c6bSjp 166348258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 166448258c6bSjp res->info.how.idmap_how_u.rule.windomain = 166548258c6bSjp strdup(values[10]); 166648258c6bSjp res->info.how.idmap_how_u.rule.winname = 166748258c6bSjp strdup(values[11]); 166848258c6bSjp res->info.how.idmap_how_u.rule.unixname = 166948258c6bSjp strdup(values[12]); 167048258c6bSjp res->info.how.idmap_how_u.rule.is_nt4 = 167148258c6bSjp strtoul(values[13], &end, 1); 167248258c6bSjp res->info.how.idmap_how_u.rule.is_user = 167348258c6bSjp is_user; 167448258c6bSjp res->info.how.idmap_how_u.rule.is_wuser = 167548258c6bSjp strtoul(values[5], &end, 1); 167648258c6bSjp break; 167748258c6bSjp 167848258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 167948258c6bSjp break; 168048258c6bSjp 168148258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 168248258c6bSjp break; 168348258c6bSjp 168448258c6bSjp case IDMAP_MAP_TYPE_KNOWN_SID: 168548258c6bSjp break; 168648258c6bSjp 1687e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 1688e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.dn = 1689e3f2c991SKeyur Desai strdup(values[7]); 1690e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.attr = 1691e3f2c991SKeyur Desai strdup(values[8]); 1692e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.value = 1693e3f2c991SKeyur Desai strdup(values[9]); 1694e3f2c991SKeyur Desai break; 1695e3f2c991SKeyur Desai 169648258c6bSjp default: 1697e3f2c991SKeyur Desai /* Unknown mapping type */ 169848258c6bSjp assert(FALSE); 169948258c6bSjp } 170048258c6bSjp } 1701c5c4113dSnw } 170262c60062Sbaban if (vm != NULL) 1703c5c4113dSnw (void) sqlite_finalize(vm, NULL); 1704c5c4113dSnw return (retcode); 1705c5c4113dSnw } 1706c5c4113dSnw 1707148c5f43SAlan Wright /* 1708148c5f43SAlan Wright * Previous versions used two enumerations for representing types. 1709148c5f43SAlan Wright * One of those has largely been eliminated, but was used in the 1710148c5f43SAlan Wright * name cache table and so during an upgrade might still be visible. 1711148c5f43SAlan Wright * In addition, the test suite prepopulates the cache with these values. 1712148c5f43SAlan Wright * 1713148c5f43SAlan Wright * This function translates those old values into the new values. 1714148c5f43SAlan Wright * 1715148c5f43SAlan Wright * This code deliberately does not use symbolic values for the legacy 1716148c5f43SAlan Wright * values. This is the *only* place where they should be used. 1717148c5f43SAlan Wright */ 1718148c5f43SAlan Wright static 1719148c5f43SAlan Wright idmap_id_type 1720148c5f43SAlan Wright xlate_legacy_type(int type) 1721148c5f43SAlan Wright { 1722148c5f43SAlan Wright switch (type) { 1723148c5f43SAlan Wright case -1004: /* _IDMAP_T_USER */ 1724148c5f43SAlan Wright return (IDMAP_USID); 1725148c5f43SAlan Wright case -1005: /* _IDMAP_T_GROUP */ 1726148c5f43SAlan Wright return (IDMAP_GSID); 1727148c5f43SAlan Wright default: 1728148c5f43SAlan Wright return (type); 1729148c5f43SAlan Wright } 1730148c5f43SAlan Wright NOTE(NOTREACHED) 1731148c5f43SAlan Wright } 1732148c5f43SAlan Wright 1733cd37da74Snw static 1734cd37da74Snw idmap_retcode 173562c60062Sbaban lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid, 1736148c5f43SAlan Wright char **canonname, char **canondomain, idmap_id_type *type) 1737cd37da74Snw { 1738c5c4113dSnw char *end; 1739c5c4113dSnw char *sql = NULL; 1740c5c4113dSnw const char **values; 1741c5c4113dSnw sqlite_vm *vm = NULL; 1742c5c4113dSnw int ncol; 1743c5c4113dSnw time_t curtime; 1744c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS; 1745c5c4113dSnw 1746c5c4113dSnw /* Get current time */ 1747c5c4113dSnw errno = 0; 1748c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 1749cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1750cd37da74Snw strerror(errno)); 1751c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 1752c5c4113dSnw goto out; 1753c5c4113dSnw } 1754c5c4113dSnw 1755c5c4113dSnw /* SQL to lookup the cache */ 1756cd37da74Snw sql = sqlite_mprintf("SELECT canon_name, domain, type " 1757cd37da74Snw "FROM name_cache WHERE " 1758cd37da74Snw "sidprefix = %Q AND rid = %u AND " 1759cd37da74Snw "(expiration = 0 OR expiration ISNULL OR " 1760cd37da74Snw "expiration > %d);", 1761cd37da74Snw sidprefix, rid, curtime); 1762c5c4113dSnw if (sql == NULL) { 1763c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1764c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1765c5c4113dSnw goto out; 1766c5c4113dSnw } 1767c5c4113dSnw retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values); 1768c5c4113dSnw sqlite_freemem(sql); 1769c5c4113dSnw 1770c5c4113dSnw if (retcode == IDMAP_SUCCESS) { 177162c60062Sbaban if (type != NULL) { 1772c5c4113dSnw if (values[2] == NULL) { 1773c5c4113dSnw retcode = IDMAP_ERR_CACHE; 1774c5c4113dSnw goto out; 1775c5c4113dSnw } 1776148c5f43SAlan Wright *type = xlate_legacy_type(strtol(values[2], &end, 10)); 1777c5c4113dSnw } 1778c5c4113dSnw 177908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL && values[0] != NULL) { 178008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if ((*canonname = strdup(values[0])) == NULL) { 1781c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1782c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1783c5c4113dSnw goto out; 1784c5c4113dSnw } 1785c5c4113dSnw } 1786c5c4113dSnw 178708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL && values[1] != NULL) { 178808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if ((*canondomain = strdup(values[1])) == NULL) { 178908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 179008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname); 179108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 1792c5c4113dSnw } 1793c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 1794c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 1795c5c4113dSnw goto out; 1796c5c4113dSnw } 1797c5c4113dSnw } 1798c5c4113dSnw } 1799c5c4113dSnw 1800c5c4113dSnw out: 180162c60062Sbaban if (vm != NULL) 1802c5c4113dSnw (void) sqlite_finalize(vm, NULL); 1803c5c4113dSnw return (retcode); 1804c5c4113dSnw } 1805c5c4113dSnw 1806c5c4113dSnw /* 1807e8c27ec8Sbaban * Given SID, find winname using name_cache OR 1808e8c27ec8Sbaban * Given winname, find SID using name_cache. 1809e8c27ec8Sbaban * Used when mapping win to unix i.e. req->id1 is windows id and 1810e8c27ec8Sbaban * req->id2 is unix id 1811c5c4113dSnw */ 1812cd37da74Snw static 1813cd37da74Snw idmap_retcode 1814e8c27ec8Sbaban lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1815cd37da74Snw { 1816148c5f43SAlan Wright idmap_id_type type = -1; 1817c5c4113dSnw idmap_retcode retcode; 1818e8c27ec8Sbaban char *sidprefix = NULL; 1819c5c4113dSnw idmap_rid_t rid; 1820c5c4113dSnw char *name = NULL, *domain = NULL; 1821c5c4113dSnw 1822e8c27ec8Sbaban /* Done if we've both sid and winname */ 1823148c5f43SAlan Wright if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL) { 1824148c5f43SAlan Wright /* Don't bother TRACE()ing, too boring */ 1825e8c27ec8Sbaban return (IDMAP_SUCCESS); 1826148c5f43SAlan Wright } 1827c5c4113dSnw 1828e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 182908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup sid to winname */ 1830e8c27ec8Sbaban retcode = lookup_cache_sid2name(cache, 1831e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix, 1832e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, &name, &domain, &type); 183308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else { 183408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup winame to sid */ 183508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = lookup_cache_name2sid(cache, req->id1name, 183608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1domain, &name, &sidprefix, &rid, &type); 1837e8c27ec8Sbaban } 183862c60062Sbaban 1839e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 1840148c5f43SAlan Wright if (retcode == IDMAP_ERR_NOTFOUND) { 1841148c5f43SAlan Wright TRACE(req, res, "Not found in name cache"); 1842148c5f43SAlan Wright } else { 1843148c5f43SAlan Wright TRACE(req, res, "Name cache lookup error=%d", retcode); 1844148c5f43SAlan Wright } 1845e8c27ec8Sbaban free(name); 1846e8c27ec8Sbaban free(domain); 1847e8c27ec8Sbaban free(sidprefix); 1848e8c27ec8Sbaban return (retcode); 1849e8c27ec8Sbaban } 1850e8c27ec8Sbaban 1851148c5f43SAlan Wright req->id1.idtype = type; 1852e8c27ec8Sbaban 1853e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 185408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 185508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 185608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we found canonical names or domain, use them instead of 185708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * the existing values. 185808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 1859e8c27ec8Sbaban if (name != NULL) { 186008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(req->id1name); 186108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name = name; 1862e8c27ec8Sbaban } 186308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (domain != NULL) { 186408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(req->id1domain); 1865e8c27ec8Sbaban req->id1domain = domain; 186608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 186708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 1868e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL) { 1869e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = sidprefix; 1870e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid = rid; 1871c5c4113dSnw } 1872148c5f43SAlan Wright 1873148c5f43SAlan Wright TRACE(req, res, "Found in name cache"); 1874c5c4113dSnw return (retcode); 1875c5c4113dSnw } 1876c5c4113dSnw 18774d61c878SJulian Pullen 18784d61c878SJulian Pullen 18794d61c878SJulian Pullen static int 18804d61c878SJulian Pullen ad_lookup_batch_int(lookup_state_t *state, idmap_mapping_batch *batch, 1881e3f2c991SKeyur Desai idmap_ids_res *result, adutils_ad_t *dir, int how_local, 1882e3f2c991SKeyur Desai int *num_processed) 1883cd37da74Snw { 1884c5c4113dSnw idmap_retcode retcode; 1885e3f2c991SKeyur Desai int i, num_queued, is_wuser, is_user; 18864d61c878SJulian Pullen int next_request; 1887148c5f43SAlan Wright int retries = 0, esidtype; 1888e8c27ec8Sbaban char **unixname; 1889c5c4113dSnw idmap_mapping *req; 1890c5c4113dSnw idmap_id_res *res; 1891e8c27ec8Sbaban idmap_query_state_t *qs = NULL; 189248258c6bSjp idmap_how *how; 1893479ac375Sdm char **dn, **attr, **value; 1894e8c27ec8Sbaban 18954d61c878SJulian Pullen *num_processed = 0; 18964d61c878SJulian Pullen 1897e8c27ec8Sbaban /* 1898e8c27ec8Sbaban * Since req->id2.idtype is unused, we will use it here 1899e8c27ec8Sbaban * to retrieve the value of sid_type. But it needs to be 1900e8c27ec8Sbaban * reset to IDMAP_NONE before we return to prevent xdr 1901e8c27ec8Sbaban * from mis-interpreting req->id2 when it tries to free 1902e8c27ec8Sbaban * the input argument. Other option is to allocate an 1903e8c27ec8Sbaban * array of integers and use it instead for the batched 1904e8c27ec8Sbaban * call. But why un-necessarily allocate memory. That may 1905e8c27ec8Sbaban * be an option if req->id2.idtype cannot be re-used in 1906e8c27ec8Sbaban * future. 1907e3f2c991SKeyur Desai * 19089fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Similarly, we use req->id2.idmap_id_u.uid to return 19099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * uidNumber or gidNumber supplied by IDMU, and reset it 19109fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * back to IDMAP_SENTINEL_PID when we're done. Note that 19119fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * the query always puts the result in req->id2.idmap_id_u.uid, 19129fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * not .gid. 1913e8c27ec8Sbaban */ 1914c5c4113dSnw retry: 1915e3f2c991SKeyur Desai retcode = idmap_lookup_batch_start(dir, state->ad_nqueries, 1916e3f2c991SKeyur Desai state->directory_based_mapping, 1917e3f2c991SKeyur Desai state->defdom, 1918e3f2c991SKeyur Desai &qs); 1919e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 19202b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 19212b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 19220dcc7149Snw goto retry; 1923349d5d8fSnw degrade_svc(1, "failed to create batch for AD lookup"); 19244d61c878SJulian Pullen goto out; 1925c5c4113dSnw } 19264d61c878SJulian Pullen num_queued = 0; 1927c5c4113dSnw 1928c8e26105Sjp restore_svc(); 1929c8e26105Sjp 1930e3f2c991SKeyur Desai if (how_local & FOREST_IS_LOCAL) { 19314d61c878SJulian Pullen /* 19324d61c878SJulian Pullen * Directory based name mapping is only performed within the 1933e3f2c991SKeyur Desai * joined forest. We don't trust other "trusted" 19344d61c878SJulian Pullen * forests to provide DS-based name mapping information because 19354d61c878SJulian Pullen * AD's definition of "cross-forest trust" does not encompass 19364d61c878SJulian Pullen * this sort of behavior. 19374d61c878SJulian Pullen */ 19384d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs, 19394d61c878SJulian Pullen state->ad_unixuser_attr, state->ad_unixgroup_attr); 19404d61c878SJulian Pullen } 1941e8c27ec8Sbaban 19424d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 1943c5c4113dSnw req = &batch->idmap_mapping_batch_val[i]; 1944c5c4113dSnw res = &result->ids.ids_val[i]; 194548258c6bSjp how = &res->info.how; 194648258c6bSjp 1947e8c27ec8Sbaban retcode = IDMAP_SUCCESS; 1948e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE; 19499fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States req->id2.idmap_id_u.uid = IDMAP_SENTINEL_PID; 1950c5c4113dSnw 1951e3f2c991SKeyur Desai /* Skip if no AD lookup required */ 1952e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 1953e3f2c991SKeyur Desai continue; 1954e3f2c991SKeyur Desai 1955e3f2c991SKeyur Desai /* Skip if we've already tried and gotten a "not found" */ 1956e3f2c991SKeyur Desai if (req->direction & _IDMAP_F_LOOKUP_OTHER_AD) 1957e8c27ec8Sbaban continue; 1958e8c27ec8Sbaban 1959e3f2c991SKeyur Desai /* Skip if we've already either succeeded or failed */ 196096c3a9a0Sbaban if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR) 1961e8c27ec8Sbaban continue; 1962e8c27ec8Sbaban 1963148c5f43SAlan Wright if (IS_ID_SID(req->id1)) { 1964e8c27ec8Sbaban 1965479ac375Sdm /* win2unix request: */ 1966e8c27ec8Sbaban 1967e3f2c991SKeyur Desai posix_id_t *pid = NULL; 1968479ac375Sdm unixname = dn = attr = value = NULL; 1969148c5f43SAlan Wright esidtype = IDMAP_SID; 1970e3f2c991SKeyur Desai if (state->directory_based_mapping == 1971e3f2c991SKeyur Desai DIRECTORY_MAPPING_NAME && 1972e3f2c991SKeyur Desai req->id2name == NULL) { 1973e8c27ec8Sbaban if (res->id.idtype == IDMAP_UID && 1974e8c27ec8Sbaban AD_OR_MIXED(state->nm_siduid)) { 1975148c5f43SAlan Wright esidtype = IDMAP_USID; 1976e8c27ec8Sbaban unixname = &req->id2name; 1977e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GID && 1978e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) { 1979148c5f43SAlan Wright esidtype = IDMAP_GSID; 1980e8c27ec8Sbaban unixname = &req->id2name; 1981e8c27ec8Sbaban } else if (AD_OR_MIXED(state->nm_siduid) || 1982e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) { 1983e8c27ec8Sbaban unixname = &req->id2name; 1984e8c27ec8Sbaban } 19854d61c878SJulian Pullen 1986e3f2c991SKeyur Desai if (unixname != NULL) { 1987e3f2c991SKeyur Desai /* 1988e3f2c991SKeyur Desai * Get how info for DS-based name 1989e3f2c991SKeyur Desai * mapping only if AD or MIXED 1990e3f2c991SKeyur Desai * mode is enabled. 1991e3f2c991SKeyur Desai */ 1992148c5f43SAlan Wright idmap_how_clear(&res->info.how); 1993e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW; 1994e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_DS_AD; 1995e3f2c991SKeyur Desai dn = &how->idmap_how_u.ad.dn; 1996e3f2c991SKeyur Desai attr = &how->idmap_how_u.ad.attr; 1997e3f2c991SKeyur Desai value = &how->idmap_how_u.ad.value; 1998e3f2c991SKeyur Desai } 1999e3f2c991SKeyur Desai } else if (state->directory_based_mapping == 2000e3f2c991SKeyur Desai DIRECTORY_MAPPING_IDMU && 2001e3f2c991SKeyur Desai (how_local & DOMAIN_IS_LOCAL)) { 2002479ac375Sdm /* 2003e3f2c991SKeyur Desai * Ensure that we only do IDMU processing 2004e3f2c991SKeyur Desai * when querying the domain we've joined. 2005e3f2c991SKeyur Desai */ 2006e3f2c991SKeyur Desai pid = &req->id2.idmap_id_u.uid; 2007e3f2c991SKeyur Desai /* 2008e3f2c991SKeyur Desai * Get how info for IDMU based mapping. 2009479ac375Sdm */ 2010148c5f43SAlan Wright idmap_how_clear(&res->info.how); 2011479ac375Sdm res->info.src = IDMAP_MAP_SRC_NEW; 2012e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_IDMU; 2013e3f2c991SKeyur Desai dn = &how->idmap_how_u.idmu.dn; 2014e3f2c991SKeyur Desai attr = &how->idmap_how_u.idmu.attr; 2015e3f2c991SKeyur Desai value = &how->idmap_how_u.idmu.value; 2016479ac375Sdm } 2017e3f2c991SKeyur Desai 2018479ac375Sdm if (req->id1.idmap_id_u.sid.prefix != NULL) { 2019479ac375Sdm /* Lookup AD by SID */ 2020479ac375Sdm retcode = idmap_sid2name_batch_add1( 2021479ac375Sdm qs, req->id1.idmap_id_u.sid.prefix, 2022148c5f43SAlan Wright &req->id1.idmap_id_u.sid.rid, esidtype, 2023479ac375Sdm dn, attr, value, 2024479ac375Sdm (req->id1name == NULL) ? 2025479ac375Sdm &req->id1name : NULL, 2026479ac375Sdm (req->id1domain == NULL) ? 2027479ac375Sdm &req->id1domain : NULL, 2028148c5f43SAlan Wright &req->id2.idtype, unixname, 2029e3f2c991SKeyur Desai pid, 2030479ac375Sdm &res->retcode); 20314d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 20324d61c878SJulian Pullen num_queued++; 2033479ac375Sdm } else { 2034479ac375Sdm /* Lookup AD by winname */ 2035479ac375Sdm assert(req->id1name != NULL); 2036479ac375Sdm retcode = idmap_name2sid_batch_add1( 2037479ac375Sdm qs, req->id1name, req->id1domain, 2038148c5f43SAlan Wright esidtype, 2039479ac375Sdm dn, attr, value, 2040479ac375Sdm &req->id1name, 2041479ac375Sdm &req->id1.idmap_id_u.sid.prefix, 2042479ac375Sdm &req->id1.idmap_id_u.sid.rid, 2043148c5f43SAlan Wright &req->id2.idtype, unixname, 2044e3f2c991SKeyur Desai pid, 2045479ac375Sdm &res->retcode); 20464d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 20474d61c878SJulian Pullen num_queued++; 2048479ac375Sdm } 2049e8c27ec8Sbaban 2050148c5f43SAlan Wright } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) { 2051479ac375Sdm 2052479ac375Sdm /* unix2win request: */ 2053e8c27ec8Sbaban 2054e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL && 2055e8c27ec8Sbaban req->id2name != NULL) { 20564d61c878SJulian Pullen /* Already have SID and winname. done */ 2057e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS; 2058e8c27ec8Sbaban continue; 2059e8c27ec8Sbaban } 2060c5c4113dSnw 2061e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL) { 2062e8c27ec8Sbaban /* 2063e8c27ec8Sbaban * SID but no winname -- lookup AD by 2064e8c27ec8Sbaban * SID to get winname. 2065479ac375Sdm * how info is not needed here because 2066479ac375Sdm * we are not retrieving unixname from 2067479ac375Sdm * AD. 2068e8c27ec8Sbaban */ 20694d61c878SJulian Pullen 2070e8c27ec8Sbaban retcode = idmap_sid2name_batch_add1( 2071e8c27ec8Sbaban qs, res->id.idmap_id_u.sid.prefix, 2072e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 2073148c5f43SAlan Wright IDMAP_POSIXID, 2074479ac375Sdm NULL, NULL, NULL, 207548258c6bSjp &req->id2name, 2076148c5f43SAlan Wright &req->id2domain, &req->id2.idtype, 2077e3f2c991SKeyur Desai NULL, NULL, &res->retcode); 20784d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 20794d61c878SJulian Pullen num_queued++; 2080e8c27ec8Sbaban } else if (req->id2name != NULL) { 2081e8c27ec8Sbaban /* 2082e8c27ec8Sbaban * winname but no SID -- lookup AD by 2083e8c27ec8Sbaban * winname to get SID. 2084479ac375Sdm * how info is not needed here because 2085479ac375Sdm * we are not retrieving unixname from 2086479ac375Sdm * AD. 2087e8c27ec8Sbaban */ 2088e8c27ec8Sbaban retcode = idmap_name2sid_batch_add1( 2089e8c27ec8Sbaban qs, req->id2name, req->id2domain, 2090148c5f43SAlan Wright IDMAP_POSIXID, 2091479ac375Sdm NULL, NULL, NULL, NULL, 2092e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix, 2093e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 2094148c5f43SAlan Wright &req->id2.idtype, NULL, 2095e3f2c991SKeyur Desai NULL, 2096e8c27ec8Sbaban &res->retcode); 20974d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 20984d61c878SJulian Pullen num_queued++; 2099e3f2c991SKeyur Desai } else if (state->directory_based_mapping == 2100e3f2c991SKeyur Desai DIRECTORY_MAPPING_IDMU && 2101e3f2c991SKeyur Desai (how_local & DOMAIN_IS_LOCAL)) { 21029fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.uid != 21039fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States IDMAP_SENTINEL_PID); 2104148c5f43SAlan Wright is_user = IS_ID_UID(req->id1); 2105e3f2c991SKeyur Desai if (res->id.idtype == IDMAP_USID) 2106e3f2c991SKeyur Desai is_wuser = 1; 2107e3f2c991SKeyur Desai else if (res->id.idtype == IDMAP_GSID) 2108e3f2c991SKeyur Desai is_wuser = 0; 2109e3f2c991SKeyur Desai else 2110e3f2c991SKeyur Desai is_wuser = is_user; 2111e3f2c991SKeyur Desai 2112e3f2c991SKeyur Desai /* IDMU can't do diagonal mappings */ 2113e3f2c991SKeyur Desai if (is_user != is_wuser) 2114e3f2c991SKeyur Desai continue; 2115e3f2c991SKeyur Desai 2116148c5f43SAlan Wright idmap_how_clear(&res->info.how); 2117e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW; 2118e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_IDMU; 2119e3f2c991SKeyur Desai retcode = idmap_pid2sid_batch_add1( 2120e3f2c991SKeyur Desai qs, req->id1.idmap_id_u.uid, is_user, 2121e3f2c991SKeyur Desai &how->idmap_how_u.ad.dn, 2122e3f2c991SKeyur Desai &how->idmap_how_u.ad.attr, 2123e3f2c991SKeyur Desai &how->idmap_how_u.ad.value, 2124e3f2c991SKeyur Desai &res->id.idmap_id_u.sid.prefix, 2125e3f2c991SKeyur Desai &res->id.idmap_id_u.sid.rid, 2126e3f2c991SKeyur Desai &req->id2name, &req->id2domain, 2127148c5f43SAlan Wright &req->id2.idtype, &res->retcode); 2128e3f2c991SKeyur Desai if (retcode == IDMAP_SUCCESS) 2129e3f2c991SKeyur Desai num_queued++; 2130e8c27ec8Sbaban } else if (req->id1name != NULL) { 2131e8c27ec8Sbaban /* 21324d61c878SJulian Pullen * No SID and no winname but we've unixname. 21334d61c878SJulian Pullen * Lookup AD by unixname to get SID. 2134e8c27ec8Sbaban */ 2135148c5f43SAlan Wright is_user = (IS_ID_UID(req->id1)) ? 1 : 0; 2136e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID) 2137e8c27ec8Sbaban is_wuser = 1; 2138e8c27ec8Sbaban else if (res->id.idtype == IDMAP_GSID) 2139e8c27ec8Sbaban is_wuser = 0; 2140e8c27ec8Sbaban else 2141e8c27ec8Sbaban is_wuser = is_user; 21424d61c878SJulian Pullen 2143148c5f43SAlan Wright idmap_how_clear(&res->info.how); 214448258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 214548258c6bSjp how->map_type = IDMAP_MAP_TYPE_DS_AD; 2146e8c27ec8Sbaban retcode = idmap_unixname2sid_batch_add1( 2147e8c27ec8Sbaban qs, req->id1name, is_user, is_wuser, 214848258c6bSjp &how->idmap_how_u.ad.dn, 214948258c6bSjp &how->idmap_how_u.ad.attr, 215048258c6bSjp &how->idmap_how_u.ad.value, 2151e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix, 2152e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 2153e8c27ec8Sbaban &req->id2name, &req->id2domain, 2154148c5f43SAlan Wright &req->id2.idtype, &res->retcode); 21554d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS) 21564d61c878SJulian Pullen num_queued++; 2157e8c27ec8Sbaban } 2158e8c27ec8Sbaban } 21594d61c878SJulian Pullen 21604d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) { 21614d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD; 21624d61c878SJulian Pullen retcode = IDMAP_SUCCESS; 21634d61c878SJulian Pullen } else if (retcode != IDMAP_SUCCESS) { 2164e8c27ec8Sbaban break; 2165c5c4113dSnw } 21664d61c878SJulian Pullen } /* End of for loop */ 2167c5c4113dSnw 216896c3a9a0Sbaban if (retcode == IDMAP_SUCCESS) { 216996c3a9a0Sbaban /* add keeps track if we added an entry to the batch */ 21704d61c878SJulian Pullen if (num_queued > 0) 217196c3a9a0Sbaban retcode = idmap_lookup_batch_end(&qs); 217296c3a9a0Sbaban else 217396c3a9a0Sbaban idmap_lookup_release_batch(&qs); 2174e3f2c991SKeyur Desai } else { 2175e3f2c991SKeyur Desai idmap_lookup_release_batch(&qs); 2176e3f2c991SKeyur Desai num_queued = 0; 2177e3f2c991SKeyur Desai next_request = i + 1; 217896c3a9a0Sbaban } 2179c5c4113dSnw 21802b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 21812b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 2182e8c27ec8Sbaban goto retry; 2183e8c27ec8Sbaban else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 2184349d5d8fSnw degrade_svc(1, "some AD lookups timed out repeatedly"); 2185e8c27ec8Sbaban 21864d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) { 21874d61c878SJulian Pullen /* Mark any unproccessed requests for an other AD */ 21884d61c878SJulian Pullen for (i = next_request; i < batch->idmap_mapping_batch_len; 21894d61c878SJulian Pullen i++) { 21904d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 21914d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD; 21924d61c878SJulian Pullen 21934d61c878SJulian Pullen } 21944d61c878SJulian Pullen } 21954d61c878SJulian Pullen 2196e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 2197e8c27ec8Sbaban idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests"); 2198e8c27ec8Sbaban 2199e8c27ec8Sbaban out: 2200e8c27ec8Sbaban /* 2201e8c27ec8Sbaban * This loop does the following: 2202479ac375Sdm * 1. Reset _IDMAP_F_LOOKUP_AD flag from the request. 2203479ac375Sdm * 2. Reset req->id2.idtype to IDMAP_NONE 2204479ac375Sdm * 3. If batch_start or batch_add failed then set the status 2205479ac375Sdm * of each request marked for AD lookup to that error. 22064d61c878SJulian Pullen * 4. Evaluate the type of the AD object (i.e. user or group) 22074d61c878SJulian Pullen * and update the idtype in request. 2208e8c27ec8Sbaban */ 2209cd37da74Snw for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 2210148c5f43SAlan Wright idmap_id_type type; 2211e3f2c991SKeyur Desai uid_t posix_id; 2212e3f2c991SKeyur Desai 2213cd37da74Snw req = &batch->idmap_mapping_batch_val[i]; 2214e8c27ec8Sbaban type = req->id2.idtype; 2215e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE; 2216e3f2c991SKeyur Desai posix_id = req->id2.idmap_id_u.uid; 22179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States req->id2.idmap_id_u.uid = IDMAP_SENTINEL_PID; 22185e0794bcSbaban res = &result->ids.ids_val[i]; 2219e3f2c991SKeyur Desai 2220e3f2c991SKeyur Desai /* 2221e3f2c991SKeyur Desai * If it didn't need AD lookup, ignore it. 2222e3f2c991SKeyur Desai */ 2223e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 2224cd37da74Snw continue; 2225cd37da74Snw 2226e3f2c991SKeyur Desai /* 2227e3f2c991SKeyur Desai * If we deferred it this time, reset for the next 2228e3f2c991SKeyur Desai * AD server. 2229e3f2c991SKeyur Desai */ 2230e3f2c991SKeyur Desai if (req->direction & _IDMAP_F_LOOKUP_OTHER_AD) { 2231e3f2c991SKeyur Desai req->direction &= ~_IDMAP_F_LOOKUP_OTHER_AD; 2232e3f2c991SKeyur Desai continue; 2233e3f2c991SKeyur Desai } 2234e3f2c991SKeyur Desai 22354d61c878SJulian Pullen /* Count number processed */ 22364d61c878SJulian Pullen (*num_processed)++; 22374d61c878SJulian Pullen 2238479ac375Sdm /* Reset AD lookup flag */ 2239479ac375Sdm req->direction &= ~(_IDMAP_F_LOOKUP_AD); 2240479ac375Sdm 2241479ac375Sdm /* 22424d61c878SJulian Pullen * If batch_start or batch_add failed then set the 22434d61c878SJulian Pullen * status of each request marked for AD lookup to 22444d61c878SJulian Pullen * that error. 2245479ac375Sdm */ 2246e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 2247e8c27ec8Sbaban res->retcode = retcode; 2248cd37da74Snw continue; 2249cd37da74Snw } 2250cd37da74Snw 225148258c6bSjp if (res->retcode == IDMAP_ERR_NOTFOUND) { 225248258c6bSjp /* Nothing found - remove the preset info */ 2253148c5f43SAlan Wright idmap_how_clear(&res->info.how); 225448258c6bSjp } 225548258c6bSjp 2256148c5f43SAlan Wright if (IS_ID_SID(req->id1)) { 2257*cb174861Sjoyce mcintosh if (res->retcode == IDMAP_ERR_NOTFOUND) { 2258*cb174861Sjoyce mcintosh TRACE(req, res, "Not found in AD"); 2259*cb174861Sjoyce mcintosh continue; 2260*cb174861Sjoyce mcintosh } 2261*cb174861Sjoyce mcintosh if (res->retcode != IDMAP_SUCCESS) { 2262*cb174861Sjoyce mcintosh TRACE(req, res, "AD lookup error=%d", 2263*cb174861Sjoyce mcintosh res->retcode); 2264e8c27ec8Sbaban continue; 2265*cb174861Sjoyce mcintosh } 2266479ac375Sdm /* Evaluate result type */ 2267e8c27ec8Sbaban switch (type) { 2268148c5f43SAlan Wright case IDMAP_USID: 2269e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) 2270e8c27ec8Sbaban res->id.idtype = IDMAP_UID; 2271e3f2c991SKeyur Desai /* 2272e3f2c991SKeyur Desai * We found a user. If we got information 2273e3f2c991SKeyur Desai * from IDMU and we were expecting a user, 2274e3f2c991SKeyur Desai * copy the id. 2275e3f2c991SKeyur Desai */ 22769fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (posix_id != IDMAP_SENTINEL_PID && 2277e3f2c991SKeyur Desai res->id.idtype == IDMAP_UID) { 2278e3f2c991SKeyur Desai res->id.idmap_id_u.uid = posix_id; 2279e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI; 2280e3f2c991SKeyur Desai res->info.how.map_type = 2281e3f2c991SKeyur Desai IDMAP_MAP_TYPE_IDMU; 2282e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW; 2283e3f2c991SKeyur Desai } 2284e8c27ec8Sbaban req->id1.idtype = IDMAP_USID; 2285e8c27ec8Sbaban break; 22864d61c878SJulian Pullen 2287148c5f43SAlan Wright case IDMAP_GSID: 2288e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) 2289e8c27ec8Sbaban res->id.idtype = IDMAP_GID; 2290e3f2c991SKeyur Desai /* 2291e3f2c991SKeyur Desai * We found a group. If we got information 2292e3f2c991SKeyur Desai * from IDMU and we were expecting a group, 2293e3f2c991SKeyur Desai * copy the id. 2294e3f2c991SKeyur Desai */ 22959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (posix_id != IDMAP_SENTINEL_PID && 2296e3f2c991SKeyur Desai res->id.idtype == IDMAP_GID) { 2297e3f2c991SKeyur Desai res->id.idmap_id_u.gid = posix_id; 2298e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI; 2299e3f2c991SKeyur Desai res->info.how.map_type = 2300e3f2c991SKeyur Desai IDMAP_MAP_TYPE_IDMU; 2301e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW; 2302e3f2c991SKeyur Desai } 2303e8c27ec8Sbaban req->id1.idtype = IDMAP_GSID; 2304e8c27ec8Sbaban break; 23054d61c878SJulian Pullen 2306e8c27ec8Sbaban default: 2307e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID; 2308e8c27ec8Sbaban break; 2309e8c27ec8Sbaban } 2310*cb174861Sjoyce mcintosh TRACE(req, res, "Found in AD"); 2311479ac375Sdm if (res->retcode == IDMAP_SUCCESS && 2312479ac375Sdm req->id1name != NULL && 2313479ac375Sdm (req->id2name == NULL || 23149fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID) && 2315479ac375Sdm NLDAP_MODE(res->id.idtype, state)) { 2316479ac375Sdm req->direction |= _IDMAP_F_LOOKUP_NLDAP; 2317479ac375Sdm state->nldap_nqueries++; 2318479ac375Sdm } 2319148c5f43SAlan Wright } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) { 2320e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 2321e8c27ec8Sbaban if ((!(IDMAP_FATAL_ERROR(res->retcode))) && 2322e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix == NULL && 2323*cb174861Sjoyce mcintosh req->id2name == NULL) { 2324e8c27ec8Sbaban /* 2325e3f2c991SKeyur Desai * If AD lookup by unixname or pid 23264d61c878SJulian Pullen * failed with non fatal error 23274d61c878SJulian Pullen * then clear the error (ie set 23284d61c878SJulian Pullen * res->retcode to success). 23294d61c878SJulian Pullen * This allows the next pass to 23304d61c878SJulian Pullen * process other mapping 2331479ac375Sdm * mechanisms for this request. 2332e8c27ec8Sbaban */ 2333*cb174861Sjoyce mcintosh if (res->retcode == 2334*cb174861Sjoyce mcintosh IDMAP_ERR_NOTFOUND) { 2335*cb174861Sjoyce mcintosh /* This is not an error */ 2336*cb174861Sjoyce mcintosh res->retcode = IDMAP_SUCCESS; 2337*cb174861Sjoyce mcintosh TRACE(req, res, 2338*cb174861Sjoyce mcintosh "Not found in AD"); 2339*cb174861Sjoyce mcintosh } else { 2340*cb174861Sjoyce mcintosh TRACE(req, res, 2341*cb174861Sjoyce mcintosh "AD lookup error (ignored)"); 2342*cb174861Sjoyce mcintosh res->retcode = IDMAP_SUCCESS; 2343*cb174861Sjoyce mcintosh } 2344*cb174861Sjoyce mcintosh } else { 2345*cb174861Sjoyce mcintosh TRACE(req, res, "AD lookup error"); 2346*cb174861Sjoyce mcintosh } 2347e8c27ec8Sbaban continue; 2348e8c27ec8Sbaban } 2349479ac375Sdm /* Evaluate result type */ 2350e8c27ec8Sbaban switch (type) { 2351148c5f43SAlan Wright case IDMAP_USID: 2352148c5f43SAlan Wright case IDMAP_GSID: 2353e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2354148c5f43SAlan Wright res->id.idtype = type; 2355e8c27ec8Sbaban break; 23564d61c878SJulian Pullen 2357e8c27ec8Sbaban default: 2358e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID; 2359e8c27ec8Sbaban break; 2360e8c27ec8Sbaban } 2361*cb174861Sjoyce mcintosh TRACE(req, res, "Found in AD"); 2362e8c27ec8Sbaban } 2363e8c27ec8Sbaban } 2364c5c4113dSnw 23654d61c878SJulian Pullen return (retcode); 23664d61c878SJulian Pullen } 23674d61c878SJulian Pullen 23684d61c878SJulian Pullen 23694d61c878SJulian Pullen 23704d61c878SJulian Pullen /* 23714d61c878SJulian Pullen * Batch AD lookups 23724d61c878SJulian Pullen */ 23734d61c878SJulian Pullen idmap_retcode 23744d61c878SJulian Pullen ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch, 23754d61c878SJulian Pullen idmap_ids_res *result) 23764d61c878SJulian Pullen { 23774d61c878SJulian Pullen idmap_retcode retcode; 23784d61c878SJulian Pullen int i, j; 23794d61c878SJulian Pullen idmap_mapping *req; 23804d61c878SJulian Pullen idmap_id_res *res; 23814d61c878SJulian Pullen int num_queries; 23824d61c878SJulian Pullen int num_processed; 23834d61c878SJulian Pullen 23844d61c878SJulian Pullen if (state->ad_nqueries == 0) 23854d61c878SJulian Pullen return (IDMAP_SUCCESS); 23864d61c878SJulian Pullen 23874d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 23884d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 23894d61c878SJulian Pullen res = &result->ids.ids_val[i]; 23904d61c878SJulian Pullen 23914d61c878SJulian Pullen /* Skip if not marked for AD lookup or already in error. */ 23924d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD) || 23934d61c878SJulian Pullen res->retcode != IDMAP_SUCCESS) 23944d61c878SJulian Pullen continue; 23954d61c878SJulian Pullen 23964d61c878SJulian Pullen /* Init status */ 23974d61c878SJulian Pullen res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR; 23984d61c878SJulian Pullen } 23994d61c878SJulian Pullen 24004d61c878SJulian Pullen RDLOCK_CONFIG(); 24014d61c878SJulian Pullen num_queries = state->ad_nqueries; 24024d61c878SJulian Pullen 2403e3f2c991SKeyur Desai if (_idmapdstate.num_gcs == 0 && _idmapdstate.num_dcs == 0) { 24044d61c878SJulian Pullen /* Case of no ADs */ 24054d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 24064d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 24074d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i]; 24084d61c878SJulian Pullen res = &result->ids.ids_val[i]; 24094d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 24104d61c878SJulian Pullen continue; 24114d61c878SJulian Pullen req->direction &= ~(_IDMAP_F_LOOKUP_AD); 24124d61c878SJulian Pullen res->retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 24134d61c878SJulian Pullen } 2414e3f2c991SKeyur Desai goto out; 24154d61c878SJulian Pullen } 2416e3f2c991SKeyur Desai 2417e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) { 2418e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_dcs && num_queries > 0; i++) { 2419e3f2c991SKeyur Desai 2420e3f2c991SKeyur Desai retcode = ad_lookup_batch_int(state, batch, 2421e3f2c991SKeyur Desai result, _idmapdstate.dcs[i], 2422e3f2c991SKeyur Desai i == 0 ? DOMAIN_IS_LOCAL|FOREST_IS_LOCAL : 0, 2423e3f2c991SKeyur Desai &num_processed); 2424e3f2c991SKeyur Desai num_queries -= num_processed; 2425e3f2c991SKeyur Desai 2426e3f2c991SKeyur Desai } 2427e3f2c991SKeyur Desai } 2428e3f2c991SKeyur Desai 2429e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_gcs && num_queries > 0; i++) { 2430e3f2c991SKeyur Desai 2431e3f2c991SKeyur Desai retcode = ad_lookup_batch_int(state, batch, result, 2432e3f2c991SKeyur Desai _idmapdstate.gcs[i], 2433e3f2c991SKeyur Desai i == 0 ? FOREST_IS_LOCAL : 0, 2434e3f2c991SKeyur Desai &num_processed); 2435e3f2c991SKeyur Desai num_queries -= num_processed; 2436e3f2c991SKeyur Desai 2437e3f2c991SKeyur Desai } 2438e3f2c991SKeyur Desai 2439e3f2c991SKeyur Desai /* 2440e3f2c991SKeyur Desai * There are no more ADs to try. Return errors for any 2441e3f2c991SKeyur Desai * remaining requests. 2442e3f2c991SKeyur Desai */ 2443e3f2c991SKeyur Desai if (num_queries > 0) { 2444e3f2c991SKeyur Desai for (j = 0; j < batch->idmap_mapping_batch_len; j++) { 2445e3f2c991SKeyur Desai req = &batch->idmap_mapping_batch_val[j]; 2446e3f2c991SKeyur Desai res = &result->ids.ids_val[j]; 2447e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 2448e3f2c991SKeyur Desai continue; 2449e3f2c991SKeyur Desai req->direction &= ~(_IDMAP_F_LOOKUP_AD); 2450e3f2c991SKeyur Desai res->retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 2451e3f2c991SKeyur Desai } 2452e3f2c991SKeyur Desai } 2453e3f2c991SKeyur Desai 2454e3f2c991SKeyur Desai out: 24554d61c878SJulian Pullen UNLOCK_CONFIG(); 24564d61c878SJulian Pullen 2457e8c27ec8Sbaban /* AD lookups done. Reset state->ad_nqueries and return */ 2458e8c27ec8Sbaban state->ad_nqueries = 0; 2459c5c4113dSnw return (retcode); 2460c5c4113dSnw } 2461c5c4113dSnw 2462cd37da74Snw /* 2463cd37da74Snw * Convention when processing win2unix requests: 2464cd37da74Snw * 2465cd37da74Snw * Windows identity: 2466cd37da74Snw * req->id1name = 2467cd37da74Snw * winname if given otherwise winname found will be placed 2468cd37da74Snw * here. 2469cd37da74Snw * req->id1domain = 2470cd37da74Snw * windomain if given otherwise windomain found will be 2471cd37da74Snw * placed here. 2472cd37da74Snw * req->id1.idtype = 2473cd37da74Snw * Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll 2474cd37da74Snw * be set to IDMAP_USID/GSID depending upon whether the 2475cd37da74Snw * given SID is user or group respectively. The user/group-ness 2476cd37da74Snw * is determined either when looking up well-known SIDs table OR 2477fe1c642dSBill Krier * if the SID is found in namecache OR by ad_lookup_batch(). 2478cd37da74Snw * req->id1..sid.[prefix, rid] = 2479cd37da74Snw * SID if given otherwise SID found will be placed here. 2480cd37da74Snw * 2481cd37da74Snw * Unix identity: 2482cd37da74Snw * req->id2name = 2483cd37da74Snw * unixname found will be placed here. 2484cd37da74Snw * req->id2domain = 2485cd37da74Snw * NOT USED 2486cd37da74Snw * res->id.idtype = 2487cd37da74Snw * Target type initialized from req->id2.idtype. If 2488cd37da74Snw * it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found 2489cd37da74Snw * will be placed here. 2490cd37da74Snw * res->id..[uid or gid] = 2491cd37da74Snw * UID/GID found will be placed here. 2492cd37da74Snw * 2493cd37da74Snw * Others: 2494cd37da74Snw * res->retcode = 2495cd37da74Snw * Return status for this request will be placed here. 2496cd37da74Snw * res->direction = 2497cd37da74Snw * Direction found will be placed here. Direction 2498cd37da74Snw * meaning whether the resultant mapping is valid 2499cd37da74Snw * only from win2unix or bi-directional. 2500cd37da74Snw * req->direction = 2501cd37da74Snw * INTERNAL USE. Used by idmapd to set various 2502cd37da74Snw * flags (_IDMAP_F_xxxx) to aid in processing 2503cd37da74Snw * of the request. 2504cd37da74Snw * req->id2.idtype = 2505cd37da74Snw * INTERNAL USE. Initially this is the requested target 2506cd37da74Snw * type and is used to initialize res->id.idtype. 2507cd37da74Snw * ad_lookup_batch() uses this field temporarily to store 2508cd37da74Snw * sid_type obtained by the batched AD lookups and after 2509cd37da74Snw * use resets it to IDMAP_NONE to prevent xdr from 2510cd37da74Snw * mis-interpreting the contents of req->id2. 2511e3f2c991SKeyur Desai * req->id2.idmap_id_u.uid = 2512e3f2c991SKeyur Desai * INTERNAL USE. If the AD lookup finds IDMU data 2513e3f2c991SKeyur Desai * (uidNumber or gidNumber, depending on the type of 2514e3f2c991SKeyur Desai * the entry), it's left here. 2515cd37da74Snw */ 2516cd37da74Snw 2517cd37da74Snw /* 2518cd37da74Snw * This function does the following: 2519cd37da74Snw * 1. Lookup well-known SIDs table. 2520cd37da74Snw * 2. Check if the given SID is a local-SID and if so extract UID/GID from it. 2521cd37da74Snw * 3. Lookup cache. 2522cd37da74Snw * 4. Check if the client does not want new mapping to be allocated 2523cd37da74Snw * in which case this pass is the final pass. 2524cd37da74Snw * 5. Set AD lookup flag if it determines that the next stage needs 2525cd37da74Snw * to do AD lookup. 2526cd37da74Snw */ 2527c5c4113dSnw idmap_retcode 2528479ac375Sdm sid2pid_first_pass(lookup_state_t *state, idmap_mapping *req, 2529cd37da74Snw idmap_id_res *res) 2530cd37da74Snw { 2531c5c4113dSnw idmap_retcode retcode; 2532e8c27ec8Sbaban int wksid; 2533c5c4113dSnw 2534e8c27ec8Sbaban /* Initialize result */ 2535e8c27ec8Sbaban res->id.idtype = req->id2.idtype; 25369fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = IDMAP_SENTINEL_PID; 2537e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF; 2538e8c27ec8Sbaban wksid = 0; 2539c5c4113dSnw 2540cf5b5989Sdm if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) { 2541fe1c642dSBill Krier /* They have to give us *something* to work with! */ 2542e8c27ec8Sbaban if (req->id1name == NULL) { 2543e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 2544e8c27ec8Sbaban goto out; 2545e8c27ec8Sbaban } 2546fe1c642dSBill Krier 2547e8c27ec8Sbaban /* sanitize sidprefix */ 2548e8c27ec8Sbaban free(req->id1.idmap_id_u.sid.prefix); 2549e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = NULL; 2550fe1c642dSBill Krier 2551fe1c642dSBill Krier /* Allow for a fully-qualified name in the "name" parameter */ 2552fe1c642dSBill Krier if (req->id1domain == NULL) { 2553fe1c642dSBill Krier char *p; 2554fe1c642dSBill Krier p = strchr(req->id1name, '@'); 2555fe1c642dSBill Krier if (p != NULL) { 2556fe1c642dSBill Krier char *q; 2557fe1c642dSBill Krier q = req->id1name; 2558*cb174861Sjoyce mcintosh req->id1name = uu_strndup(q, p - req->id1name); 2559fe1c642dSBill Krier req->id1domain = strdup(p+1); 2560fe1c642dSBill Krier free(q); 2561fe1c642dSBill Krier if (req->id1name == NULL || 2562fe1c642dSBill Krier req->id1domain == NULL) { 2563fe1c642dSBill Krier retcode = IDMAP_ERR_MEMORY; 2564fe1c642dSBill Krier goto out; 2565fe1c642dSBill Krier } 2566fe1c642dSBill Krier } 2567fe1c642dSBill Krier } 2568c5c4113dSnw } 2569c5c4113dSnw 2570e8c27ec8Sbaban /* Lookup well-known SIDs table */ 2571e8c27ec8Sbaban retcode = lookup_wksids_sid2pid(req, res, &wksid); 2572148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2573148c5f43SAlan Wright /* Found a well-known account with a hardwired mapping */ 2574148c5f43SAlan Wright TRACE(req, res, "Hardwired mapping"); 2575148c5f43SAlan Wright goto out; 2576148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 2577148c5f43SAlan Wright TRACE(req, res, 2578148c5f43SAlan Wright "Well-known account lookup failed, code %d", retcode); 2579c5c4113dSnw goto out; 2580148c5f43SAlan Wright } 2581148c5f43SAlan Wright 2582148c5f43SAlan Wright if (wksid) { 2583148c5f43SAlan Wright /* Found a well-known account, but no mapping */ 2584148c5f43SAlan Wright TRACE(req, res, "Well-known account"); 2585148c5f43SAlan Wright } else { 2586148c5f43SAlan Wright TRACE(req, res, "Not a well-known account"); 2587c5c4113dSnw 25882b4a7802SBaban Kenkre /* Check if this is a localsid */ 2589e8c27ec8Sbaban retcode = lookup_localsid2pid(req, res); 2590148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2591148c5f43SAlan Wright TRACE(req, res, "Local SID"); 2592148c5f43SAlan Wright goto out; 2593148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 2594148c5f43SAlan Wright TRACE(req, res, 2595148c5f43SAlan Wright "Local SID lookup error=%d", retcode); 2596e8c27ec8Sbaban goto out; 2597148c5f43SAlan Wright } 2598148c5f43SAlan Wright TRACE(req, res, "Not a local SID"); 25992b4a7802SBaban Kenkre 26002b4a7802SBaban Kenkre if (ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)) { 26014d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 26022b4a7802SBaban Kenkre goto out; 26032b4a7802SBaban Kenkre } 2604e8c27ec8Sbaban } 2605e8c27ec8Sbaban 2606fe1c642dSBill Krier /* 2607fe1c642dSBill Krier * If this is a name-based request and we don't have a domain, 2608fe1c642dSBill Krier * use the default domain. Note that the well-known identity 2609fe1c642dSBill Krier * cases will have supplied a SID prefix already, and that we 2610fe1c642dSBill Krier * don't (yet?) support looking up a local user through a Windows 2611fe1c642dSBill Krier * style name. 2612fe1c642dSBill Krier */ 2613fe1c642dSBill Krier if (req->id1.idmap_id_u.sid.prefix == NULL && 2614fe1c642dSBill Krier req->id1name != NULL && req->id1domain == NULL) { 2615fe1c642dSBill Krier if (state->defdom == NULL) { 2616fe1c642dSBill Krier retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 2617fe1c642dSBill Krier goto out; 2618fe1c642dSBill Krier } 2619fe1c642dSBill Krier req->id1domain = strdup(state->defdom); 2620fe1c642dSBill Krier if (req->id1domain == NULL) { 2621fe1c642dSBill Krier retcode = IDMAP_ERR_MEMORY; 2622fe1c642dSBill Krier goto out; 2623fe1c642dSBill Krier } 2624148c5f43SAlan Wright TRACE(req, res, "Added default domain"); 2625fe1c642dSBill Krier } 2626fe1c642dSBill Krier 2627e8c27ec8Sbaban /* Lookup cache */ 2628479ac375Sdm retcode = lookup_cache_sid2pid(state->cache, req, res); 2629148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2630148c5f43SAlan Wright TRACE(req, res, "Found in mapping cache"); 2631c5c4113dSnw goto out; 2632148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 2633148c5f43SAlan Wright TRACE(req, res, "Mapping cache lookup error=%d", retcode); 2634148c5f43SAlan Wright goto out; 2635148c5f43SAlan Wright } 2636148c5f43SAlan Wright TRACE(req, res, "Not found in mapping cache"); 2637c5c4113dSnw 2638c5c4113dSnw if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) { 26394d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 2640c5c4113dSnw goto out; 2641c5c4113dSnw } 2642c5c4113dSnw 2643c5c4113dSnw /* 2644e8c27ec8Sbaban * Failed to find non-expired entry in cache. Next step is 2645e8c27ec8Sbaban * to determine if this request needs to be batched for AD lookup. 2646e8c27ec8Sbaban * 2647e8c27ec8Sbaban * At this point we have either sid or winname or both. If we don't 2648e8c27ec8Sbaban * have both then lookup name_cache for the sid or winname 2649e8c27ec8Sbaban * whichever is missing. If not found then this request will be 2650e8c27ec8Sbaban * batched for AD lookup. 2651c5c4113dSnw */ 2652479ac375Sdm retcode = lookup_name_cache(state->cache, req, res); 2653148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2654148c5f43SAlan Wright if (res->id.idtype == IDMAP_POSIXID) { 2655148c5f43SAlan Wright if (req->id1.idtype == IDMAP_USID) 2656148c5f43SAlan Wright res->id.idtype = IDMAP_UID; 2657148c5f43SAlan Wright else 2658148c5f43SAlan Wright res->id.idtype = IDMAP_GID; 2659148c5f43SAlan Wright } 2660148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) 2661e8c27ec8Sbaban goto out; 2662c5c4113dSnw 2663148c5f43SAlan Wright if (_idmapdstate.cfg->pgcfg.use_lsa && 2664148c5f43SAlan Wright _idmapdstate.cfg->pgcfg.domain_name != NULL) { 2665148c5f43SAlan Wright /* 2666148c5f43SAlan Wright * If we don't have both name and SID, try looking up the 2667148c5f43SAlan Wright * entry with LSA. 2668148c5f43SAlan Wright */ 2669148c5f43SAlan Wright if (req->id1.idmap_id_u.sid.prefix != NULL && 2670148c5f43SAlan Wright req->id1name == NULL) { 2671148c5f43SAlan Wright 2672148c5f43SAlan Wright retcode = lookup_lsa_by_sid( 2673148c5f43SAlan Wright req->id1.idmap_id_u.sid.prefix, 2674148c5f43SAlan Wright req->id1.idmap_id_u.sid.rid, 2675148c5f43SAlan Wright &req->id1name, &req->id1domain, &req->id1.idtype); 2676148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2677148c5f43SAlan Wright TRACE(req, res, "Found with LSA"); 2678148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) { 2679148c5f43SAlan Wright TRACE(req, res, "Not found with LSA"); 2680148c5f43SAlan Wright } else { 2681148c5f43SAlan Wright TRACE(req, res, "LSA error %d", retcode); 2682148c5f43SAlan Wright goto out; 2683148c5f43SAlan Wright } 2684148c5f43SAlan Wright 2685148c5f43SAlan Wright } else if (req->id1name != NULL && 2686148c5f43SAlan Wright req->id1.idmap_id_u.sid.prefix == NULL) { 2687148c5f43SAlan Wright char *canonname; 2688148c5f43SAlan Wright char *canondomain; 2689148c5f43SAlan Wright 2690148c5f43SAlan Wright retcode = lookup_lsa_by_name( 2691148c5f43SAlan Wright req->id1name, req->id1domain, 2692148c5f43SAlan Wright &req->id1.idmap_id_u.sid.prefix, 2693148c5f43SAlan Wright &req->id1.idmap_id_u.sid.rid, 2694148c5f43SAlan Wright &canonname, &canondomain, 2695148c5f43SAlan Wright &req->id1.idtype); 2696148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 2697148c5f43SAlan Wright free(req->id1name); 2698148c5f43SAlan Wright req->id1name = canonname; 2699148c5f43SAlan Wright free(req->id1domain); 2700148c5f43SAlan Wright req->id1domain = canondomain; 2701148c5f43SAlan Wright TRACE(req, res, "Found with LSA"); 2702148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) { 2703148c5f43SAlan Wright TRACE(req, res, "Not found with LSA"); 2704148c5f43SAlan Wright } else { 2705148c5f43SAlan Wright TRACE(req, res, "LSA error %d", retcode); 2706148c5f43SAlan Wright goto out; 2707148c5f43SAlan Wright } 2708148c5f43SAlan Wright } 2709148c5f43SAlan Wright } 2710148c5f43SAlan Wright 2711c5c4113dSnw /* 2712e8c27ec8Sbaban * Set the flag to indicate that we are not done yet so that 2713e8c27ec8Sbaban * subsequent passes considers this request for name-based 2714e8c27ec8Sbaban * mapping and ephemeral mapping. 2715c5c4113dSnw */ 2716e8c27ec8Sbaban state->sid2pid_done = FALSE; 2717e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE; 2718c5c4113dSnw 2719c5c4113dSnw /* 2720e8c27ec8Sbaban * Even if we have both sid and winname, we still may need to batch 2721e8c27ec8Sbaban * this request for AD lookup if we don't have unixname and 2722e8c27ec8Sbaban * directory-based name mapping (AD or mixed) is enabled. 2723e8c27ec8Sbaban * We avoid AD lookup for well-known SIDs because they don't have 2724e8c27ec8Sbaban * regular AD objects. 2725c5c4113dSnw */ 2726e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS || 2727e8c27ec8Sbaban (!wksid && req->id2name == NULL && 2728e3f2c991SKeyur Desai AD_OR_MIXED_MODE(res->id.idtype, state)) || 27299fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States (!wksid && res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID && 2730e3f2c991SKeyur Desai state->directory_based_mapping == DIRECTORY_MAPPING_IDMU)) { 2731c5c4113dSnw retcode = IDMAP_SUCCESS; 2732e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD; 2733c5c4113dSnw state->ad_nqueries++; 2734479ac375Sdm } else if (NLDAP_MODE(res->id.idtype, state)) { 2735479ac375Sdm req->direction |= _IDMAP_F_LOOKUP_NLDAP; 2736479ac375Sdm state->nldap_nqueries++; 2737c5c4113dSnw } 2738c5c4113dSnw 2739c5c4113dSnw 2740c5c4113dSnw out: 2741c5c4113dSnw res->retcode = idmap_stat4prot(retcode); 2742e8c27ec8Sbaban /* 2743e8c27ec8Sbaban * If we are done and there was an error then set fallback pid 2744e8c27ec8Sbaban * in the result. 2745e8c27ec8Sbaban */ 2746e8c27ec8Sbaban if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) 2747e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY; 2748c5c4113dSnw return (retcode); 2749c5c4113dSnw } 2750c5c4113dSnw 2751c5c4113dSnw /* 2752c5c4113dSnw * Generate SID using the following convention 2753c5c4113dSnw * <machine-sid-prefix>-<1000 + uid> 2754c5c4113dSnw * <machine-sid-prefix>-<2^31 + gid> 2755c5c4113dSnw */ 2756cd37da74Snw static 2757cd37da74Snw idmap_retcode 275848258c6bSjp generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user, 275948258c6bSjp int fallback) 2760cd37da74Snw { 2761e8c27ec8Sbaban free(res->id.idmap_id_u.sid.prefix); 2762e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = NULL; 2763c5c4113dSnw 2764e8c27ec8Sbaban /* 2765e8c27ec8Sbaban * Diagonal mapping for localSIDs not supported because of the 2766e8c27ec8Sbaban * way we generate localSIDs. 2767e8c27ec8Sbaban */ 2768e8c27ec8Sbaban if (is_user && res->id.idtype == IDMAP_GSID) 2769a0aa776eSAlan Wright return (IDMAP_ERR_NOTGROUP); 2770e8c27ec8Sbaban if (!is_user && res->id.idtype == IDMAP_USID) 2771a0aa776eSAlan Wright return (IDMAP_ERR_NOTUSER); 2772c5c4113dSnw 2773e8c27ec8Sbaban /* Skip 1000 UIDs */ 27741fcced4cSJordan Brown if (is_user && 27751fcced4cSJordan Brown req->id1.idmap_id_u.uid + LOCALRID_UID_MIN > LOCALRID_UID_MAX) 2776e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 2777e8c27ec8Sbaban 2778e8c27ec8Sbaban RDLOCK_CONFIG(); 2779e8c27ec8Sbaban /* 2780e8c27ec8Sbaban * machine_sid is never NULL because if it is we won't be here. 2781148c5f43SAlan Wright * No need to assert because strdup(NULL) will core anyways. 2782e8c27ec8Sbaban */ 2783e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = 2784e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.machine_sid); 2785e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix == NULL) { 2786e8c27ec8Sbaban UNLOCK_CONFIG(); 2787e8c27ec8Sbaban idmapdlog(LOG_ERR, "Out of memory"); 2788e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 2789c5c4113dSnw } 2790e8c27ec8Sbaban UNLOCK_CONFIG(); 2791e8c27ec8Sbaban res->id.idmap_id_u.sid.rid = 27921fcced4cSJordan Brown (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_UID_MIN : 27931fcced4cSJordan Brown req->id1.idmap_id_u.gid + LOCALRID_GID_MIN; 2794e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 2795e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2796e8c27ec8Sbaban res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 2797c5c4113dSnw 2798fc724630SAlan Wright if (!fallback) { 279948258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 280048258c6bSjp res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 280148258c6bSjp } 280248258c6bSjp 2803e8c27ec8Sbaban /* 2804e8c27ec8Sbaban * Don't update name_cache because local sids don't have 2805e8c27ec8Sbaban * valid windows names. 2806e8c27ec8Sbaban */ 2807e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 2808e8c27ec8Sbaban return (IDMAP_SUCCESS); 2809c5c4113dSnw } 2810c5c4113dSnw 2811cd37da74Snw static 2812cd37da74Snw idmap_retcode 2813cd37da74Snw lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res) 2814cd37da74Snw { 2815c5c4113dSnw char *sidprefix; 2816c5c4113dSnw uint32_t rid; 2817c5c4113dSnw int s; 2818c5c4113dSnw 2819c5c4113dSnw /* 2820c5c4113dSnw * If the sidprefix == localsid then UID = last RID - 1000 or 2821c5c4113dSnw * GID = last RID - 2^31. 2822c5c4113dSnw */ 2823e8c27ec8Sbaban if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL) 2824e8c27ec8Sbaban /* This means we are looking up by winname */ 2825e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2826c5c4113dSnw rid = req->id1.idmap_id_u.sid.rid; 2827c5c4113dSnw 2828c5c4113dSnw RDLOCK_CONFIG(); 2829cd37da74Snw s = (_idmapdstate.cfg->pgcfg.machine_sid) ? 2830cd37da74Snw strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1; 2831c5c4113dSnw UNLOCK_CONFIG(); 2832c5c4113dSnw 2833e8c27ec8Sbaban /* 2834e8c27ec8Sbaban * If the given sidprefix does not match machine_sid then this is 2835e8c27ec8Sbaban * not a local SID. 2836e8c27ec8Sbaban */ 2837e8c27ec8Sbaban if (s != 0) 2838e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2839e8c27ec8Sbaban 2840e8c27ec8Sbaban switch (res->id.idtype) { 2841e8c27ec8Sbaban case IDMAP_UID: 28421fcced4cSJordan Brown if (rid < LOCALRID_UID_MIN || rid > LOCALRID_UID_MAX) 2843e8c27ec8Sbaban return (IDMAP_ERR_ARG); 28441fcced4cSJordan Brown res->id.idmap_id_u.uid = rid - LOCALRID_UID_MIN; 2845e8c27ec8Sbaban break; 2846e8c27ec8Sbaban case IDMAP_GID: 28471fcced4cSJordan Brown if (rid < LOCALRID_GID_MIN) 2848e8c27ec8Sbaban return (IDMAP_ERR_ARG); 28491fcced4cSJordan Brown res->id.idmap_id_u.gid = rid - LOCALRID_GID_MIN; 2850e8c27ec8Sbaban break; 2851e8c27ec8Sbaban case IDMAP_POSIXID: 28521fcced4cSJordan Brown if (rid >= LOCALRID_GID_MIN) { 28531fcced4cSJordan Brown res->id.idmap_id_u.gid = rid - LOCALRID_GID_MIN; 2854c5c4113dSnw res->id.idtype = IDMAP_GID; 28551fcced4cSJordan Brown } else if (rid >= LOCALRID_UID_MIN) { 28561fcced4cSJordan Brown res->id.idmap_id_u.uid = rid - LOCALRID_UID_MIN; 2857e8c27ec8Sbaban res->id.idtype = IDMAP_UID; 28581fcced4cSJordan Brown } else { 28591fcced4cSJordan Brown return (IDMAP_ERR_ARG); 2860c5c4113dSnw } 2861e8c27ec8Sbaban break; 2862e8c27ec8Sbaban default: 2863e8c27ec8Sbaban return (IDMAP_ERR_NOTSUPPORTED); 2864c5c4113dSnw } 2865fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 2866fc724630SAlan Wright res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 2867e8c27ec8Sbaban return (IDMAP_SUCCESS); 2868c5c4113dSnw } 2869c5c4113dSnw 2870e8c27ec8Sbaban /* 2871e8c27ec8Sbaban * Name service lookup by unixname to get pid 2872e8c27ec8Sbaban */ 2873cd37da74Snw static 2874cd37da74Snw idmap_retcode 2875e8c27ec8Sbaban ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id) 2876cd37da74Snw { 2877cd37da74Snw struct passwd pwd, *pwdp; 2878cd37da74Snw struct group grp, *grpp; 28798c155366SJordan Brown char *buf; 28808c155366SJordan Brown static size_t pwdbufsiz = 0; 28818c155366SJordan Brown static size_t grpbufsiz = 0; 2882c5c4113dSnw 2883e8c27ec8Sbaban switch (id->idtype) { 2884e8c27ec8Sbaban case IDMAP_UID: 28858c155366SJordan Brown if (pwdbufsiz == 0) 28868c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX); 28878c155366SJordan Brown buf = alloca(pwdbufsiz); 28888c155366SJordan Brown pwdp = getpwnam_r(name, &pwd, buf, pwdbufsiz); 2889e8c27ec8Sbaban if (pwdp == NULL && errno == 0 && lower_name != NULL && 2890cd37da74Snw name != lower_name && strcmp(name, lower_name) != 0) 28918c155366SJordan Brown pwdp = getpwnam_r(lower_name, &pwd, buf, pwdbufsiz); 2892cd37da74Snw if (pwdp == NULL) { 2893bbf6f00cSJordan Brown if (errno == 0) 2894c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 2895c5c4113dSnw else 2896c5c4113dSnw return (IDMAP_ERR_INTERNAL); 2897c5c4113dSnw } 2898e8c27ec8Sbaban id->idmap_id_u.uid = pwd.pw_uid; 2899e8c27ec8Sbaban break; 2900e8c27ec8Sbaban case IDMAP_GID: 29018c155366SJordan Brown if (grpbufsiz == 0) 29028c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX); 29038c155366SJordan Brown buf = alloca(grpbufsiz); 29048c155366SJordan Brown grpp = getgrnam_r(name, &grp, buf, grpbufsiz); 2905e8c27ec8Sbaban if (grpp == NULL && errno == 0 && lower_name != NULL && 2906cd37da74Snw name != lower_name && strcmp(name, lower_name) != 0) 29078c155366SJordan Brown grpp = getgrnam_r(lower_name, &grp, buf, grpbufsiz); 2908cd37da74Snw if (grpp == NULL) { 2909bbf6f00cSJordan Brown if (errno == 0) 2910c5c4113dSnw return (IDMAP_ERR_NOTFOUND); 2911c5c4113dSnw else 2912c5c4113dSnw return (IDMAP_ERR_INTERNAL); 2913c5c4113dSnw } 2914e8c27ec8Sbaban id->idmap_id_u.gid = grp.gr_gid; 2915e8c27ec8Sbaban break; 2916e8c27ec8Sbaban default: 2917e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2918e8c27ec8Sbaban } 2919e8c27ec8Sbaban return (IDMAP_SUCCESS); 2920e8c27ec8Sbaban } 2921e8c27ec8Sbaban 2922e8c27ec8Sbaban 2923e8c27ec8Sbaban /* 2924e8c27ec8Sbaban * Name service lookup by pid to get unixname 2925e8c27ec8Sbaban */ 2926e8c27ec8Sbaban static 2927e8c27ec8Sbaban idmap_retcode 2928e8c27ec8Sbaban ns_lookup_bypid(uid_t pid, int is_user, char **unixname) 2929e8c27ec8Sbaban { 2930e8c27ec8Sbaban struct passwd pwd; 2931e8c27ec8Sbaban struct group grp; 29328c155366SJordan Brown char *buf; 29338c155366SJordan Brown static size_t pwdbufsiz = 0; 29348c155366SJordan Brown static size_t grpbufsiz = 0; 2935e8c27ec8Sbaban 2936e8c27ec8Sbaban if (is_user) { 29378c155366SJordan Brown if (pwdbufsiz == 0) 29388c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX); 29398c155366SJordan Brown buf = alloca(pwdbufsiz); 2940e8c27ec8Sbaban errno = 0; 29418c155366SJordan Brown if (getpwuid_r(pid, &pwd, buf, pwdbufsiz) == NULL) { 2942bbf6f00cSJordan Brown if (errno == 0) 2943e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2944e8c27ec8Sbaban else 2945e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL); 2946e8c27ec8Sbaban } 2947e8c27ec8Sbaban *unixname = strdup(pwd.pw_name); 2948e8c27ec8Sbaban } else { 29498c155366SJordan Brown if (grpbufsiz == 0) 29508c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX); 29518c155366SJordan Brown buf = alloca(grpbufsiz); 2952e8c27ec8Sbaban errno = 0; 29538c155366SJordan Brown if (getgrgid_r(pid, &grp, buf, grpbufsiz) == NULL) { 2954bbf6f00cSJordan Brown if (errno == 0) 2955e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2956e8c27ec8Sbaban else 2957e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL); 2958e8c27ec8Sbaban } 2959e8c27ec8Sbaban *unixname = strdup(grp.gr_name); 2960c5c4113dSnw } 2961e8c27ec8Sbaban if (*unixname == NULL) 2962e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 2963c5c4113dSnw return (IDMAP_SUCCESS); 2964c5c4113dSnw } 2965c5c4113dSnw 2966c5c4113dSnw /* 2967c5c4113dSnw * Name-based mapping 2968c5c4113dSnw * 2969c5c4113dSnw * Case 1: If no rule matches do ephemeral 2970c5c4113dSnw * 2971c5c4113dSnw * Case 2: If rule matches and unixname is "" then return no mapping. 2972c5c4113dSnw * 2973c5c4113dSnw * Case 3: If rule matches and unixname is specified then lookup name 2974c5c4113dSnw * service using the unixname. If unixname not found then return no mapping. 2975c5c4113dSnw * 2976c5c4113dSnw * Case 4: If rule matches and unixname is * then lookup name service 2977c5c4113dSnw * using winname as the unixname. If unixname not found then process 2978c5c4113dSnw * other rules using the lookup order. If no other rule matches then do 2979c5c4113dSnw * ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4. 2980c5c4113dSnw * This allows us to specify a fallback unixname per _domain_ or no mapping 2981c5c4113dSnw * instead of the default behaviour of doing ephemeral mapping. 2982c5c4113dSnw * 2983c5c4113dSnw * Example 1: 2984c5c4113dSnw * *@sfbay == * 2985c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2986c5c4113dSnw * the name service then foo@sfbay will be mapped to an ephemeral id. 2987c5c4113dSnw * 2988c5c4113dSnw * Example 2: 2989c5c4113dSnw * *@sfbay == * 2990c5c4113dSnw * *@sfbay => guest 2991c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2992c5c4113dSnw * the name service then foo@sfbay will be mapped to guest. 2993c5c4113dSnw * 2994c5c4113dSnw * Example 3: 2995c5c4113dSnw * *@sfbay == * 2996c5c4113dSnw * *@sfbay => "" 2997c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in 2998c5c4113dSnw * the name service then we will return no mapping for foo@sfbay. 2999c5c4113dSnw * 3000c5c4113dSnw */ 3001cd37da74Snw static 3002cd37da74Snw idmap_retcode 3003479ac375Sdm name_based_mapping_sid2pid(lookup_state_t *state, 3004479ac375Sdm idmap_mapping *req, idmap_id_res *res) 3005cd37da74Snw { 3006cd37da74Snw const char *unixname, *windomain; 3007cd37da74Snw char *sql = NULL, *errmsg = NULL, *lower_winname = NULL; 3008c5c4113dSnw idmap_retcode retcode; 3009cd37da74Snw char *end, *lower_unixname, *winname; 3010c5c4113dSnw const char **values; 3011c5c4113dSnw sqlite_vm *vm = NULL; 301208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int ncol, r, is_user, is_wuser; 301348258c6bSjp idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 301448258c6bSjp int direction; 3015c5c4113dSnw const char *me = "name_based_mapping_sid2pid"; 3016c5c4113dSnw 3017e8c27ec8Sbaban assert(req->id1name != NULL); /* We have winname */ 3018e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have unixname */ 3019e8c27ec8Sbaban 30208e228215Sdm winname = req->id1name; 30218e228215Sdm windomain = req->id1domain; 3022cd37da74Snw 3023cd37da74Snw switch (req->id1.idtype) { 3024cd37da74Snw case IDMAP_USID: 3025cd37da74Snw is_wuser = 1; 3026cd37da74Snw break; 3027cd37da74Snw case IDMAP_GSID: 3028cd37da74Snw is_wuser = 0; 3029cd37da74Snw break; 3030cd37da74Snw default: 3031e8c27ec8Sbaban idmapdlog(LOG_ERR, "%s: Unable to determine if the " 3032e8c27ec8Sbaban "given Windows id is user or group.", me); 3033cd37da74Snw return (IDMAP_ERR_INTERNAL); 3034cd37da74Snw } 3035cd37da74Snw 3036e8c27ec8Sbaban switch (res->id.idtype) { 3037cd37da74Snw case IDMAP_UID: 3038cd37da74Snw is_user = 1; 3039cd37da74Snw break; 3040cd37da74Snw case IDMAP_GID: 3041cd37da74Snw is_user = 0; 3042cd37da74Snw break; 3043cd37da74Snw case IDMAP_POSIXID: 3044cd37da74Snw is_user = is_wuser; 3045cd37da74Snw res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID; 3046cd37da74Snw break; 3047cd37da74Snw } 3048c5c4113dSnw 3049479ac375Sdm if (windomain == NULL) 305062c60062Sbaban windomain = ""; 3051c5c4113dSnw 3052cd37da74Snw if ((lower_winname = tolower_u8(winname)) == NULL) 3053cd37da74Snw lower_winname = winname; /* hope for the best */ 3054c5c4113dSnw sql = sqlite_mprintf( 305548258c6bSjp "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 " 305648258c6bSjp "FROM namerules WHERE " 3057cd37da74Snw "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND " 3058cd37da74Snw "(winname = %Q OR winname = '*') AND " 305908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States "(windomain = %Q OR windomain = '*') " 3060cd37da74Snw "ORDER BY w2u_order ASC;", 306108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States is_user, is_wuser, lower_winname, windomain); 3062c5c4113dSnw if (sql == NULL) { 3063c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3064c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3065c5c4113dSnw goto out; 3066c5c4113dSnw } 3067c5c4113dSnw 3068479ac375Sdm if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 3069c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3070cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3071cd37da74Snw CHECK_NULL(errmsg)); 3072c5c4113dSnw sqlite_freemem(errmsg); 3073c5c4113dSnw goto out; 3074c5c4113dSnw } 3075c5c4113dSnw 307648258c6bSjp for (;;) { 3077c5c4113dSnw r = sqlite_step(vm, &ncol, &values, NULL); 307884decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 3079c5c4113dSnw 308084decf41Sjp if (r == SQLITE_ROW) { 308148258c6bSjp if (ncol < 5) { 3082c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3083c5c4113dSnw goto out; 3084c5c4113dSnw } 3085148c5f43SAlan Wright 3086148c5f43SAlan Wright TRACE(req, res, "Matching rule: %s@%s -> %s", 3087148c5f43SAlan Wright values[2] == NULL ? "(null)" : values[2], 3088148c5f43SAlan Wright values[3] == NULL ? "(null)" : values[3], 3089148c5f43SAlan Wright values[0] == NULL ? "(null)" : values[0]); 3090148c5f43SAlan Wright 3091c5c4113dSnw if (values[0] == NULL) { 3092c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3093c5c4113dSnw goto out; 3094c5c4113dSnw } 3095c5c4113dSnw 309648258c6bSjp if (values[1] != NULL) 309748258c6bSjp direction = 309848258c6bSjp (strtol(values[1], &end, 10) == 0)? 309948258c6bSjp IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 310048258c6bSjp else 310148258c6bSjp direction = IDMAP_DIRECTION_W2U; 310248258c6bSjp 3103c5c4113dSnw if (EMPTY_NAME(values[0])) { 3104148c5f43SAlan Wright TRACE(req, res, "Mapping inhibited"); 310548258c6bSjp idmap_namerule_set(rule, values[3], values[2], 31069fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[0], is_user, is_wuser, 310748258c6bSjp strtol(values[4], &end, 10), 310848258c6bSjp direction); 3109c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 3110c5c4113dSnw goto out; 3111c5c4113dSnw } 311248258c6bSjp 311348258c6bSjp if (values[0][0] == '*') { 311448258c6bSjp unixname = winname; 311548258c6bSjp lower_unixname = lower_winname; 311648258c6bSjp } else { 311748258c6bSjp unixname = values[0]; 311848258c6bSjp lower_unixname = NULL; 311948258c6bSjp } 312048258c6bSjp 3121e8c27ec8Sbaban retcode = ns_lookup_byname(unixname, lower_unixname, 3122e8c27ec8Sbaban &res->id); 3123148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 3124148c5f43SAlan Wright break; 3125148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) { 3126148c5f43SAlan Wright if (values[0][0] == '*') { 3127148c5f43SAlan Wright TRACE(req, res, 3128148c5f43SAlan Wright "%s not found, continuing", 3129148c5f43SAlan Wright unixname); 3130c5c4113dSnw /* Case 4 */ 3131c5c4113dSnw continue; 3132148c5f43SAlan Wright } else { 3133148c5f43SAlan Wright TRACE(req, res, 3134148c5f43SAlan Wright "%s not found, error", unixname); 3135c5c4113dSnw /* Case 3 */ 313648258c6bSjp idmap_namerule_set(rule, values[3], 31379fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[2], values[0], is_user, 31389fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States is_wuser, 313948258c6bSjp strtol(values[4], &end, 10), 314048258c6bSjp direction); 3141c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 314248258c6bSjp } 3143148c5f43SAlan Wright } else { 3144148c5f43SAlan Wright TRACE(req, res, "Looking up %s error=%d", 3145148c5f43SAlan Wright unixname, retcode); 3146c5c4113dSnw } 3147c5c4113dSnw goto out; 3148c5c4113dSnw } else if (r == SQLITE_DONE) { 3149*cb174861Sjoyce mcintosh TRACE(req, res, "No matching rule"); 3150c5c4113dSnw retcode = IDMAP_ERR_NOTFOUND; 3151c5c4113dSnw goto out; 3152c5c4113dSnw } else { 3153c5c4113dSnw (void) sqlite_finalize(vm, &errmsg); 3154c5c4113dSnw vm = NULL; 3155cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3156cd37da74Snw CHECK_NULL(errmsg)); 3157c5c4113dSnw sqlite_freemem(errmsg); 3158c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3159c5c4113dSnw goto out; 3160c5c4113dSnw } 3161c5c4113dSnw } 3162c5c4113dSnw 3163148c5f43SAlan Wright /* Found */ 316448258c6bSjp 3165148c5f43SAlan Wright if (values[1] != NULL) 3166148c5f43SAlan Wright res->direction = 3167148c5f43SAlan Wright (strtol(values[1], &end, 10) == 0)? 3168148c5f43SAlan Wright IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 3169148c5f43SAlan Wright else 3170148c5f43SAlan Wright res->direction = IDMAP_DIRECTION_W2U; 3171148c5f43SAlan Wright 3172148c5f43SAlan Wright req->id2name = strdup(unixname); 3173148c5f43SAlan Wright if (req->id2name == NULL) { 3174148c5f43SAlan Wright retcode = IDMAP_ERR_MEMORY; 3175148c5f43SAlan Wright goto out; 3176479ac375Sdm } 3177148c5f43SAlan Wright TRACE(req, res, "UNIX name found"); 3178479ac375Sdm 3179148c5f43SAlan Wright idmap_namerule_set(rule, values[3], values[2], 3180148c5f43SAlan Wright values[0], is_user, is_wuser, strtol(values[4], &end, 10), 3181148c5f43SAlan Wright res->direction); 3182148c5f43SAlan Wright 3183148c5f43SAlan Wright out: 3184148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS && 3185148c5f43SAlan Wright retcode != IDMAP_ERR_NOTFOUND && 3186148c5f43SAlan Wright retcode != IDMAP_ERR_NOMAPPING) { 3187148c5f43SAlan Wright TRACE(req, res, "Rule processing error, code=%d", retcode); 3188fc724630SAlan Wright } 3189fc724630SAlan Wright 3190148c5f43SAlan Wright if (sql != NULL) 3191148c5f43SAlan Wright sqlite_freemem(sql); 3192148c5f43SAlan Wright 3193fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) { 3194fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 319548258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 3196c5c4113dSnw } 3197479ac375Sdm 3198cd37da74Snw if (lower_winname != NULL && lower_winname != winname) 3199cd37da74Snw free(lower_winname); 320062c60062Sbaban if (vm != NULL) 3201c5c4113dSnw (void) sqlite_finalize(vm, NULL); 3202c5c4113dSnw return (retcode); 3203c5c4113dSnw } 3204c5c4113dSnw 3205c5c4113dSnw static 3206c5c4113dSnw int 3207c5c4113dSnw get_next_eph_uid(uid_t *next_uid) 3208c5c4113dSnw { 3209c5c4113dSnw uid_t uid; 3210c5c4113dSnw gid_t gid; 3211c5c4113dSnw int err; 3212c5c4113dSnw 3213c5c4113dSnw *next_uid = (uid_t)-1; 3214c5c4113dSnw uid = _idmapdstate.next_uid++; 3215c5c4113dSnw if (uid >= _idmapdstate.limit_uid) { 3216c5c4113dSnw if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0) 3217c5c4113dSnw return (err); 3218c5c4113dSnw 3219c5c4113dSnw _idmapdstate.limit_uid = uid + 8192; 3220c5c4113dSnw _idmapdstate.next_uid = uid; 3221c5c4113dSnw } 3222c5c4113dSnw *next_uid = uid; 3223c5c4113dSnw 3224c5c4113dSnw return (0); 3225c5c4113dSnw } 3226c5c4113dSnw 3227c5c4113dSnw static 3228c5c4113dSnw int 3229c5c4113dSnw get_next_eph_gid(gid_t *next_gid) 3230c5c4113dSnw { 3231c5c4113dSnw uid_t uid; 3232c5c4113dSnw gid_t gid; 3233c5c4113dSnw int err; 3234c5c4113dSnw 3235c5c4113dSnw *next_gid = (uid_t)-1; 3236c5c4113dSnw gid = _idmapdstate.next_gid++; 3237c5c4113dSnw if (gid >= _idmapdstate.limit_gid) { 3238c5c4113dSnw if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0) 3239c5c4113dSnw return (err); 3240c5c4113dSnw 3241c5c4113dSnw _idmapdstate.limit_gid = gid + 8192; 3242c5c4113dSnw _idmapdstate.next_gid = gid; 3243c5c4113dSnw } 3244c5c4113dSnw *next_gid = gid; 3245c5c4113dSnw 3246c5c4113dSnw return (0); 3247c5c4113dSnw } 3248c5c4113dSnw 324962c60062Sbaban static 325062c60062Sbaban int 3251cd37da74Snw gethash(const char *str, uint32_t num, uint_t htsize) 3252cd37da74Snw { 325362c60062Sbaban uint_t hval, i, len; 325462c60062Sbaban 325562c60062Sbaban if (str == NULL) 325662c60062Sbaban return (0); 325762c60062Sbaban for (len = strlen(str), hval = 0, i = 0; i < len; i++) { 325862c60062Sbaban hval += str[i]; 325962c60062Sbaban hval += (hval << 10); 326062c60062Sbaban hval ^= (hval >> 6); 326162c60062Sbaban } 326262c60062Sbaban for (str = (const char *)&num, i = 0; i < sizeof (num); i++) { 326362c60062Sbaban hval += str[i]; 326462c60062Sbaban hval += (hval << 10); 326562c60062Sbaban hval ^= (hval >> 6); 326662c60062Sbaban } 326762c60062Sbaban hval += (hval << 3); 326862c60062Sbaban hval ^= (hval >> 11); 326962c60062Sbaban hval += (hval << 15); 327062c60062Sbaban return (hval % htsize); 327162c60062Sbaban } 327262c60062Sbaban 327362c60062Sbaban static 327462c60062Sbaban int 327562c60062Sbaban get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid, 3276cd37da74Snw uid_t *pid) 3277cd37da74Snw { 327862c60062Sbaban uint_t next, key; 327962c60062Sbaban uint_t htsize = state->sid_history_size; 328062c60062Sbaban idmap_sid *sid; 328162c60062Sbaban 328262c60062Sbaban next = gethash(prefix, rid, htsize); 328362c60062Sbaban while (next != htsize) { 328462c60062Sbaban key = state->sid_history[next].key; 328562c60062Sbaban if (key == htsize) 328662c60062Sbaban return (0); 328762c60062Sbaban sid = &state->batch->idmap_mapping_batch_val[key].id1. 328862c60062Sbaban idmap_id_u.sid; 328962c60062Sbaban if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) { 329062c60062Sbaban *pid = state->result->ids.ids_val[key].id. 329162c60062Sbaban idmap_id_u.uid; 329262c60062Sbaban return (1); 329362c60062Sbaban } 329462c60062Sbaban next = state->sid_history[next].next; 329562c60062Sbaban } 329662c60062Sbaban return (0); 329762c60062Sbaban } 329862c60062Sbaban 329962c60062Sbaban static 330062c60062Sbaban void 3301cd37da74Snw add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid) 3302cd37da74Snw { 330362c60062Sbaban uint_t hash, next; 330462c60062Sbaban uint_t htsize = state->sid_history_size; 330562c60062Sbaban 330662c60062Sbaban hash = next = gethash(prefix, rid, htsize); 330762c60062Sbaban while (state->sid_history[next].key != htsize) { 330862c60062Sbaban next++; 330962c60062Sbaban next %= htsize; 331062c60062Sbaban } 331162c60062Sbaban state->sid_history[next].key = state->curpos; 331262c60062Sbaban if (hash == next) 331362c60062Sbaban return; 331462c60062Sbaban state->sid_history[next].next = state->sid_history[hash].next; 331562c60062Sbaban state->sid_history[hash].next = next; 331662c60062Sbaban } 3317c5c4113dSnw 3318e8c27ec8Sbaban void 3319e8c27ec8Sbaban cleanup_lookup_state(lookup_state_t *state) 3320e8c27ec8Sbaban { 3321e8c27ec8Sbaban free(state->sid_history); 3322e8c27ec8Sbaban free(state->ad_unixuser_attr); 3323e8c27ec8Sbaban free(state->ad_unixgroup_attr); 3324479ac375Sdm free(state->nldap_winname_attr); 3325479ac375Sdm free(state->defdom); 3326e8c27ec8Sbaban } 3327e8c27ec8Sbaban 3328c5c4113dSnw /* ARGSUSED */ 3329c5c4113dSnw static 3330c5c4113dSnw idmap_retcode 3331479ac375Sdm dynamic_ephemeral_mapping(lookup_state_t *state, 3332cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3333cd37da74Snw { 3334c5c4113dSnw 3335c5c4113dSnw uid_t next_pid; 3336c5c4113dSnw 333762c60062Sbaban res->direction = IDMAP_DIRECTION_BI; 333862c60062Sbaban 33399fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 334048258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 334148258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 334262c60062Sbaban return (IDMAP_SUCCESS); 334348258c6bSjp } 334462c60062Sbaban 334562c60062Sbaban if (state->sid_history != NULL && 334662c60062Sbaban get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix, 334762c60062Sbaban req->id1.idmap_id_u.sid.rid, &next_pid)) { 334862c60062Sbaban res->id.idmap_id_u.uid = next_pid; 334948258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 335048258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 335162c60062Sbaban return (IDMAP_SUCCESS); 335262c60062Sbaban } 335362c60062Sbaban 335462c60062Sbaban if (res->id.idtype == IDMAP_UID) { 3355c5c4113dSnw if (get_next_eph_uid(&next_pid) != 0) 3356c5c4113dSnw return (IDMAP_ERR_INTERNAL); 3357c5c4113dSnw res->id.idmap_id_u.uid = next_pid; 3358c5c4113dSnw } else { 3359c5c4113dSnw if (get_next_eph_gid(&next_pid) != 0) 3360c5c4113dSnw return (IDMAP_ERR_INTERNAL); 3361c5c4113dSnw res->id.idmap_id_u.gid = next_pid; 3362c5c4113dSnw } 3363c5c4113dSnw 336448258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 336548258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 336662c60062Sbaban if (state->sid_history != NULL) 336762c60062Sbaban add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix, 336862c60062Sbaban req->id1.idmap_id_u.sid.rid); 336962c60062Sbaban 3370c5c4113dSnw return (IDMAP_SUCCESS); 3371c5c4113dSnw } 3372c5c4113dSnw 3373c5c4113dSnw idmap_retcode 3374479ac375Sdm sid2pid_second_pass(lookup_state_t *state, 3375cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3376cd37da74Snw { 3377c5c4113dSnw idmap_retcode retcode; 3378148c5f43SAlan Wright idmap_retcode retcode2; 3379c5c4113dSnw 3380c5c4113dSnw /* Check if second pass is needed */ 3381e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3382c5c4113dSnw return (res->retcode); 3383c5c4113dSnw 3384c5c4113dSnw /* Get status from previous pass */ 3385e8c27ec8Sbaban retcode = res->retcode; 33864aa0a5e7Snw if (retcode != IDMAP_SUCCESS && state->eph_map_unres_sids && 33874aa0a5e7Snw !EMPTY_STRING(req->id1.idmap_id_u.sid.prefix) && 33884aa0a5e7Snw EMPTY_STRING(req->id1name)) { 33894aa0a5e7Snw /* 33904aa0a5e7Snw * We are asked to map an unresolvable SID to a UID or 33914aa0a5e7Snw * GID, but, which? We'll treat all unresolvable SIDs 33924aa0a5e7Snw * as users unless the caller specified which of a UID 33934aa0a5e7Snw * or GID they want. 33944aa0a5e7Snw */ 3395a7c8bd9fSNicolas Williams if (req->id1.idtype == IDMAP_SID) 3396a7c8bd9fSNicolas Williams req->id1.idtype = IDMAP_USID; 3397148c5f43SAlan Wright if (res->id.idtype == IDMAP_POSIXID) { 33984aa0a5e7Snw res->id.idtype = IDMAP_UID; 3399148c5f43SAlan Wright TRACE(req, res, "Assume unresolvable SID is user"); 3400148c5f43SAlan Wright } else if (res->id.idtype == IDMAP_UID) { 3401148c5f43SAlan Wright TRACE(req, res, "Must map unresolvable SID to user"); 3402148c5f43SAlan Wright } else if (res->id.idtype == IDMAP_GID) { 3403148c5f43SAlan Wright TRACE(req, res, "Must map unresolvable SID to group"); 3404148c5f43SAlan Wright } 34054aa0a5e7Snw goto do_eph; 34064aa0a5e7Snw } 3407e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 3408e8c27ec8Sbaban goto out; 3409c5c4113dSnw 3410e3f2c991SKeyur Desai /* 3411e3f2c991SKeyur Desai * There are two ways we might get here with a Posix ID: 3412e3f2c991SKeyur Desai * - It could be from an expired ephemeral cache entry. 3413e3f2c991SKeyur Desai * - It could be from IDMU. 3414e3f2c991SKeyur Desai * If it's from IDMU, we need to look up the name, for name-based 3415e3f2c991SKeyur Desai * requests and the cache. 3416e3f2c991SKeyur Desai */ 34179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (!IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid) && 34189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID) { 3419e3f2c991SKeyur Desai if (req->id2name == NULL) { 3420e3f2c991SKeyur Desai /* 3421e3f2c991SKeyur Desai * If the lookup fails, go ahead anyway. 3422e3f2c991SKeyur Desai * The general UNIX rule is that it's OK to 3423e3f2c991SKeyur Desai * have a UID or GID that isn't in the 3424e3f2c991SKeyur Desai * name service. 3425e3f2c991SKeyur Desai */ 3426148c5f43SAlan Wright retcode2 = ns_lookup_bypid(res->id.idmap_id_u.uid, 3427e3f2c991SKeyur Desai res->id.idtype == IDMAP_UID, &req->id2name); 3428148c5f43SAlan Wright if (IDMAP_ERROR(retcode2)) { 3429148c5f43SAlan Wright TRACE(req, res, 3430148c5f43SAlan Wright "Getting UNIX name, error=%d (ignored)", 3431148c5f43SAlan Wright retcode2); 3432148c5f43SAlan Wright } else { 3433148c5f43SAlan Wright TRACE(req, res, "Found UNIX name"); 3434148c5f43SAlan Wright } 3435e3f2c991SKeyur Desai } 3436e3f2c991SKeyur Desai goto out; 3437e3f2c991SKeyur Desai } 3438e3f2c991SKeyur Desai 3439e8c27ec8Sbaban /* 3440e8c27ec8Sbaban * If directory-based name mapping is enabled then the unixname 3441e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode or 3442e8c27ec8Sbaban * mixed-mode) or from native LDAP object (nldap-mode) -- done. 3443e8c27ec8Sbaban */ 3444e8c27ec8Sbaban if (req->id2name != NULL) { 3445e8c27ec8Sbaban assert(res->id.idtype != IDMAP_POSIXID); 3446e8c27ec8Sbaban if (AD_MODE(res->id.idtype, state)) 3447e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 3448e8c27ec8Sbaban else if (NLDAP_MODE(res->id.idtype, state)) 3449e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 3450e8c27ec8Sbaban else if (MIXED_MODE(res->id.idtype, state)) 3451e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U; 3452c5c4113dSnw 3453e8c27ec8Sbaban /* 3454e8c27ec8Sbaban * Special case: (1) If the ad_unixuser_attr and 3455e8c27ec8Sbaban * ad_unixgroup_attr uses the same attribute 3456e8c27ec8Sbaban * name and (2) if this is a diagonal mapping 3457e8c27ec8Sbaban * request and (3) the unixname has been retrieved 3458e8c27ec8Sbaban * from the AD object -- then we ignore it and fallback 3459e8c27ec8Sbaban * to name-based mapping rules and ephemeral mapping 3460e8c27ec8Sbaban * 3461e8c27ec8Sbaban * Example: 3462e8c27ec8Sbaban * Properties: 3463e8c27ec8Sbaban * config/ad_unixuser_attr = "unixname" 3464e8c27ec8Sbaban * config/ad_unixgroup_attr = "unixname" 3465e8c27ec8Sbaban * AD user object: 3466e8c27ec8Sbaban * dn: cn=bob ... 3467e8c27ec8Sbaban * objectclass: user 3468e8c27ec8Sbaban * sam: bob 3469e8c27ec8Sbaban * unixname: bob1234 3470e8c27ec8Sbaban * AD group object: 3471e8c27ec8Sbaban * dn: cn=winadmins ... 3472e8c27ec8Sbaban * objectclass: group 3473e8c27ec8Sbaban * sam: winadmins 3474e8c27ec8Sbaban * unixname: unixadmins 3475e8c27ec8Sbaban * 3476e8c27ec8Sbaban * In this example whether "unixname" refers to a unixuser 3477e8c27ec8Sbaban * or unixgroup depends upon the AD object. 3478e8c27ec8Sbaban * 3479e8c27ec8Sbaban * $idmap show -c winname:bob gid 3480e8c27ec8Sbaban * AD lookup by "samAccountName=bob" for 3481e8c27ec8Sbaban * "ad_unixgroup_attr (i.e unixname)" for directory-based 3482e8c27ec8Sbaban * mapping would get "bob1234" which is not what we want. 3483e8c27ec8Sbaban * Now why not getgrnam_r("bob1234") and use it if it 3484e8c27ec8Sbaban * is indeed a unixgroup? That's because Unix can have 3485e8c27ec8Sbaban * users and groups with the same name and we clearly 3486e8c27ec8Sbaban * don't know the intention of the admin here. 3487e8c27ec8Sbaban * Therefore we ignore this and fallback to name-based 3488e8c27ec8Sbaban * mapping rules or ephemeral mapping. 3489e8c27ec8Sbaban */ 3490e8c27ec8Sbaban if ((AD_MODE(res->id.idtype, state) || 3491e8c27ec8Sbaban MIXED_MODE(res->id.idtype, state)) && 3492e8c27ec8Sbaban state->ad_unixuser_attr != NULL && 3493e8c27ec8Sbaban state->ad_unixgroup_attr != NULL && 3494e8c27ec8Sbaban strcasecmp(state->ad_unixuser_attr, 3495e8c27ec8Sbaban state->ad_unixgroup_attr) == 0 && 3496e8c27ec8Sbaban ((req->id1.idtype == IDMAP_USID && 3497e8c27ec8Sbaban res->id.idtype == IDMAP_GID) || 3498e8c27ec8Sbaban (req->id1.idtype == IDMAP_GSID && 3499e8c27ec8Sbaban res->id.idtype == IDMAP_UID))) { 3500148c5f43SAlan Wright TRACE(req, res, "Ignoring UNIX name found in AD"); 3501e8c27ec8Sbaban free(req->id2name); 3502e8c27ec8Sbaban req->id2name = NULL; 35039fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = IDMAP_SENTINEL_PID; 3504e8c27ec8Sbaban /* fallback */ 3505e8c27ec8Sbaban } else { 3506148c5f43SAlan Wright if (res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID) { 3507e8c27ec8Sbaban retcode = ns_lookup_byname(req->id2name, 3508e8c27ec8Sbaban NULL, &res->id); 3509148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) { 3510148c5f43SAlan Wright /* 3511148c5f43SAlan Wright * If ns_lookup_byname() fails that 3512148c5f43SAlan Wright * means the unixname (req->id2name), 3513148c5f43SAlan Wright * which was obtained from the AD 3514148c5f43SAlan Wright * object by directory-based mapping, 3515148c5f43SAlan Wright * is not a valid Unix user/group and 3516148c5f43SAlan Wright * therefore we return the error to the 3517148c5f43SAlan Wright * client instead of doing rule-based 3518148c5f43SAlan Wright * mapping or ephemeral mapping. This 3519148c5f43SAlan Wright * way the client can detect the issue. 3520148c5f43SAlan Wright */ 3521148c5f43SAlan Wright TRACE(req, res, 3522148c5f43SAlan Wright "UNIX lookup error=%d", retcode); 3523148c5f43SAlan Wright goto out; 3524148c5f43SAlan Wright } 3525148c5f43SAlan Wright TRACE(req, res, "UNIX lookup"); 3526148c5f43SAlan Wright } 3527e8c27ec8Sbaban goto out; 3528c5c4113dSnw } 3529c5c4113dSnw } 3530c5c4113dSnw 353148258c6bSjp /* Free any mapping info from Directory based mapping */ 353248258c6bSjp if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 3533148c5f43SAlan Wright idmap_how_clear(&res->info.how); 353448258c6bSjp 3535e8c27ec8Sbaban /* 3536e8c27ec8Sbaban * If we don't have unixname then evaluate local name-based 3537e8c27ec8Sbaban * mapping rules. 3538e8c27ec8Sbaban */ 3539479ac375Sdm retcode = name_based_mapping_sid2pid(state, req, res); 3540148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 3541148c5f43SAlan Wright TRACE(req, res, "Rule-based mapping"); 3542c5c4113dSnw goto out; 3543148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 3544148c5f43SAlan Wright TRACE(req, res, "Rule-based mapping error=%d", retcode); 3545148c5f43SAlan Wright goto out; 3546148c5f43SAlan Wright } 3547c5c4113dSnw 35484aa0a5e7Snw do_eph: 3549e8c27ec8Sbaban /* If not found, do ephemeral mapping */ 3550479ac375Sdm retcode = dynamic_ephemeral_mapping(state, req, res); 3551148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 3552148c5f43SAlan Wright TRACE(req, res, "Ephemeral mapping"); 3553148c5f43SAlan Wright goto out; 3554148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 3555148c5f43SAlan Wright TRACE(req, res, "Ephemeral mapping error=%d", retcode); 3556148c5f43SAlan Wright goto out; 3557148c5f43SAlan Wright } 3558c5c4113dSnw 3559c5c4113dSnw out: 3560c5c4113dSnw res->retcode = idmap_stat4prot(retcode); 3561e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 3562e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 3563e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY; 3564e8c27ec8Sbaban } 3565e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction)) 3566e8c27ec8Sbaban state->sid2pid_done = FALSE; 3567c5c4113dSnw return (retcode); 3568c5c4113dSnw } 3569c5c4113dSnw 3570c5c4113dSnw idmap_retcode 3571479ac375Sdm update_cache_pid2sid(lookup_state_t *state, 3572cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3573cd37da74Snw { 3574c5c4113dSnw char *sql = NULL; 3575c5c4113dSnw idmap_retcode retcode; 3576148c5f43SAlan Wright idmap_retcode retcode2; 357748258c6bSjp char *map_dn = NULL; 357848258c6bSjp char *map_attr = NULL; 357948258c6bSjp char *map_value = NULL; 358048258c6bSjp char *map_windomain = NULL; 358148258c6bSjp char *map_winname = NULL; 358248258c6bSjp char *map_unixname = NULL; 358348258c6bSjp int map_is_nt4 = FALSE; 3584c5c4113dSnw 3585c5c4113dSnw /* Check if we need to cache anything */ 3586e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3587c5c4113dSnw return (IDMAP_SUCCESS); 3588c5c4113dSnw 3589c5c4113dSnw /* We don't cache negative entries */ 3590c5c4113dSnw if (res->retcode != IDMAP_SUCCESS) 3591c5c4113dSnw return (IDMAP_SUCCESS); 3592c5c4113dSnw 3593e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF); 35949fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID); 359548258c6bSjp assert(res->id.idtype != IDMAP_SID); 359648258c6bSjp 3597e3f2c991SKeyur Desai /* 3598e3f2c991SKeyur Desai * If we've gotten to this point and we *still* don't know the 3599e3f2c991SKeyur Desai * unixname, well, we'd like to have it now for the cache. 3600e3f2c991SKeyur Desai * 3601e3f2c991SKeyur Desai * If we truly always need it for the cache, we should probably 3602e3f2c991SKeyur Desai * look it up once at the beginning, rather than "at need" in 3603e3f2c991SKeyur Desai * several places as is now done. However, it's not really clear 3604e3f2c991SKeyur Desai * that we *do* need it in the cache; there's a decent argument 3605e3f2c991SKeyur Desai * that the cache should contain only SIDs and PIDs, so we'll 3606e3f2c991SKeyur Desai * leave our options open by doing it "at need" here too. 3607e3f2c991SKeyur Desai * 3608e3f2c991SKeyur Desai * If we can't find it... c'est la vie. 3609e3f2c991SKeyur Desai */ 3610e3f2c991SKeyur Desai if (req->id1name == NULL) { 3611148c5f43SAlan Wright retcode2 = ns_lookup_bypid(req->id1.idmap_id_u.uid, 3612e3f2c991SKeyur Desai req->id1.idtype == IDMAP_UID, &req->id1name); 3613148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS) 3614148c5f43SAlan Wright TRACE(req, res, "Found UNIX name"); 3615148c5f43SAlan Wright else 3616148c5f43SAlan Wright TRACE(req, res, "Getting UNIX name error=%d", retcode2); 3617e3f2c991SKeyur Desai } 3618e3f2c991SKeyur Desai 361948258c6bSjp assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN); 362048258c6bSjp switch (res->info.how.map_type) { 362148258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 362248258c6bSjp map_dn = res->info.how.idmap_how_u.ad.dn; 362348258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 362448258c6bSjp map_value = res->info.how.idmap_how_u.ad.value; 362548258c6bSjp break; 362648258c6bSjp 362748258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 362848258c6bSjp map_dn = res->info.how.idmap_how_u.nldap.dn; 362948258c6bSjp map_attr = res->info.how.idmap_how_u.nldap.attr; 363048258c6bSjp map_value = res->info.how.idmap_how_u.nldap.value; 363148258c6bSjp break; 363248258c6bSjp 363348258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 363448258c6bSjp map_windomain = res->info.how.idmap_how_u.rule.windomain; 363548258c6bSjp map_winname = res->info.how.idmap_how_u.rule.winname; 363648258c6bSjp map_unixname = res->info.how.idmap_how_u.rule.unixname; 363748258c6bSjp map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 363848258c6bSjp break; 363948258c6bSjp 364048258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 364148258c6bSjp break; 364248258c6bSjp 364348258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 364448258c6bSjp break; 364548258c6bSjp 3646e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 3647e3f2c991SKeyur Desai map_dn = res->info.how.idmap_how_u.idmu.dn; 3648e3f2c991SKeyur Desai map_attr = res->info.how.idmap_how_u.idmu.attr; 3649e3f2c991SKeyur Desai map_value = res->info.how.idmap_how_u.idmu.value; 3650e3f2c991SKeyur Desai break; 3651e3f2c991SKeyur Desai 365248258c6bSjp default: 3653148c5f43SAlan Wright /* Don't cache other mapping types */ 365448258c6bSjp assert(FALSE); 365548258c6bSjp } 3656e8c27ec8Sbaban 3657c5c4113dSnw /* 3658c5c4113dSnw * Using NULL for u2w instead of 0 so that our trigger allows 3659c5c4113dSnw * the same pid to be the destination in multiple entries 3660c5c4113dSnw */ 3661c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3662cd37da74Snw "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 366348258c6bSjp "is_user, is_wuser, expiration, w2u, u2w, " 366448258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 366548258c6bSjp "map_winname, map_unixname, map_is_nt4) " 3666cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 366748258c6bSjp "strftime('%%s','now') + 600, %q, 1, " 366848258c6bSjp "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ", 3669cd37da74Snw res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3670cd37da74Snw req->id2domain, req->id2name, req->id1.idmap_id_u.uid, 3671cd37da74Snw req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0, 3672e8c27ec8Sbaban (res->id.idtype == IDMAP_USID) ? 1 : 0, 367348258c6bSjp (res->direction == 0) ? "1" : NULL, 367448258c6bSjp res->info.how.map_type, map_dn, map_attr, map_value, 367548258c6bSjp map_windomain, map_winname, map_unixname, map_is_nt4); 3676c5c4113dSnw 3677c5c4113dSnw if (sql == NULL) { 3678c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3679c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3680c5c4113dSnw goto out; 3681c5c4113dSnw } 3682c5c4113dSnw 3683479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3684c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3685c5c4113dSnw goto out; 3686c5c4113dSnw 3687c5c4113dSnw state->pid2sid_done = FALSE; 3688c5c4113dSnw sqlite_freemem(sql); 3689c5c4113dSnw sql = NULL; 3690c5c4113dSnw 3691e8c27ec8Sbaban /* Check if we need to update namecache */ 3692e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3693c5c4113dSnw goto out; 3694c5c4113dSnw 36958e228215Sdm if (req->id2name == NULL) 3696c5c4113dSnw goto out; 3697c5c4113dSnw 3698c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3699cd37da74Snw "(sidprefix, rid, canon_name, domain, type, expiration) " 3700cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3701cd37da74Snw res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3702cd37da74Snw req->id2name, req->id2domain, 3703148c5f43SAlan Wright res->id.idtype); 3704c5c4113dSnw 3705c5c4113dSnw if (sql == NULL) { 3706c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3707c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3708c5c4113dSnw goto out; 3709c5c4113dSnw } 3710c5c4113dSnw 3711479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3712c5c4113dSnw 3713c5c4113dSnw out: 371462c60062Sbaban if (sql != NULL) 3715c5c4113dSnw sqlite_freemem(sql); 3716c5c4113dSnw return (retcode); 3717c5c4113dSnw } 3718c5c4113dSnw 3719c5c4113dSnw idmap_retcode 3720479ac375Sdm update_cache_sid2pid(lookup_state_t *state, 3721cd37da74Snw idmap_mapping *req, idmap_id_res *res) 3722cd37da74Snw { 3723c5c4113dSnw char *sql = NULL; 3724c5c4113dSnw idmap_retcode retcode; 3725c5c4113dSnw int is_eph_user; 372648258c6bSjp char *map_dn = NULL; 372748258c6bSjp char *map_attr = NULL; 372848258c6bSjp char *map_value = NULL; 372948258c6bSjp char *map_windomain = NULL; 373048258c6bSjp char *map_winname = NULL; 373148258c6bSjp char *map_unixname = NULL; 373248258c6bSjp int map_is_nt4 = FALSE; 3733c5c4113dSnw 3734c5c4113dSnw /* Check if we need to cache anything */ 3735e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3736c5c4113dSnw return (IDMAP_SUCCESS); 3737c5c4113dSnw 3738c5c4113dSnw /* We don't cache negative entries */ 3739c5c4113dSnw if (res->retcode != IDMAP_SUCCESS) 3740c5c4113dSnw return (IDMAP_SUCCESS); 3741c5c4113dSnw 3742c5c4113dSnw if (req->direction & _IDMAP_F_EXP_EPH_UID) 3743c5c4113dSnw is_eph_user = 1; 3744c5c4113dSnw else if (req->direction & _IDMAP_F_EXP_EPH_GID) 3745c5c4113dSnw is_eph_user = 0; 3746c5c4113dSnw else 3747c5c4113dSnw is_eph_user = -1; 3748c5c4113dSnw 37499fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (is_eph_user >= 0 && 37509fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States !IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 3751c5c4113dSnw sql = sqlite_mprintf("UPDATE idmap_cache " 3752cd37da74Snw "SET w2u = 0 WHERE " 3753cd37da74Snw "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 3754cd37da74Snw "pid >= 2147483648 AND is_user = %d;", 3755cd37da74Snw req->id1.idmap_id_u.sid.prefix, 3756cd37da74Snw req->id1.idmap_id_u.sid.rid, 3757cd37da74Snw is_eph_user); 3758c5c4113dSnw if (sql == NULL) { 3759c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3760c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3761c5c4113dSnw goto out; 3762c5c4113dSnw } 3763c5c4113dSnw 3764479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3765c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3766c5c4113dSnw goto out; 3767c5c4113dSnw 3768c5c4113dSnw sqlite_freemem(sql); 3769c5c4113dSnw sql = NULL; 3770c5c4113dSnw } 3771c5c4113dSnw 3772e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF); 37739fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID); 377448258c6bSjp 377548258c6bSjp switch (res->info.how.map_type) { 377648258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 377748258c6bSjp map_dn = res->info.how.idmap_how_u.ad.dn; 377848258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 377948258c6bSjp map_value = res->info.how.idmap_how_u.ad.value; 378048258c6bSjp break; 378148258c6bSjp 378248258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 378348258c6bSjp map_dn = res->info.how.idmap_how_u.nldap.dn; 378448258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr; 378548258c6bSjp map_value = res->info.how.idmap_how_u.nldap.value; 378648258c6bSjp break; 378748258c6bSjp 378848258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 378948258c6bSjp map_windomain = res->info.how.idmap_how_u.rule.windomain; 379048258c6bSjp map_winname = res->info.how.idmap_how_u.rule.winname; 379148258c6bSjp map_unixname = res->info.how.idmap_how_u.rule.unixname; 379248258c6bSjp map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 379348258c6bSjp break; 379448258c6bSjp 379548258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 379648258c6bSjp break; 379748258c6bSjp 3798e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 3799e3f2c991SKeyur Desai map_dn = res->info.how.idmap_how_u.idmu.dn; 3800e3f2c991SKeyur Desai map_attr = res->info.how.idmap_how_u.idmu.attr; 3801e3f2c991SKeyur Desai map_value = res->info.how.idmap_how_u.idmu.value; 3802e3f2c991SKeyur Desai break; 3803e3f2c991SKeyur Desai 380448258c6bSjp default: 3805148c5f43SAlan Wright /* Don't cache other mapping types */ 380648258c6bSjp assert(FALSE); 380748258c6bSjp } 3808cd37da74Snw 3809c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3810cd37da74Snw "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 381148258c6bSjp "is_user, is_wuser, expiration, w2u, u2w, " 381248258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 381348258c6bSjp "map_winname, map_unixname, map_is_nt4) " 3814cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 381548258c6bSjp "strftime('%%s','now') + 600, 1, %q, " 381648258c6bSjp "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);", 3817cd37da74Snw req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3818e8c27ec8Sbaban (req->id1domain != NULL) ? req->id1domain : "", req->id1name, 3819e8c27ec8Sbaban res->id.idmap_id_u.uid, req->id2name, 3820e8c27ec8Sbaban (res->id.idtype == IDMAP_UID) ? 1 : 0, 3821cd37da74Snw (req->id1.idtype == IDMAP_USID) ? 1 : 0, 382248258c6bSjp (res->direction == 0) ? "1" : NULL, 382348258c6bSjp res->info.how.map_type, map_dn, map_attr, map_value, 382448258c6bSjp map_windomain, map_winname, map_unixname, map_is_nt4); 3825c5c4113dSnw 3826c5c4113dSnw if (sql == NULL) { 3827c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3828c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3829c5c4113dSnw goto out; 3830c5c4113dSnw } 3831c5c4113dSnw 3832479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3833c5c4113dSnw if (retcode != IDMAP_SUCCESS) 3834c5c4113dSnw goto out; 3835c5c4113dSnw 3836c5c4113dSnw state->sid2pid_done = FALSE; 3837c5c4113dSnw sqlite_freemem(sql); 3838c5c4113dSnw sql = NULL; 3839c5c4113dSnw 3840e8c27ec8Sbaban /* Check if we need to update namecache */ 3841e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3842c5c4113dSnw goto out; 3843c5c4113dSnw 3844cf5b5989Sdm if (EMPTY_STRING(req->id1name)) 3845c5c4113dSnw goto out; 3846c5c4113dSnw 3847c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3848cd37da74Snw "(sidprefix, rid, canon_name, domain, type, expiration) " 3849cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3850cd37da74Snw req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3851cd37da74Snw req->id1name, req->id1domain, 3852148c5f43SAlan Wright req->id1.idtype); 3853c5c4113dSnw 3854c5c4113dSnw if (sql == NULL) { 3855c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3856c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3857c5c4113dSnw goto out; 3858c5c4113dSnw } 3859c5c4113dSnw 3860479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3861c5c4113dSnw 3862c5c4113dSnw out: 386362c60062Sbaban if (sql != NULL) 3864c5c4113dSnw sqlite_freemem(sql); 3865c5c4113dSnw return (retcode); 3866c5c4113dSnw } 3867c5c4113dSnw 3868cd37da74Snw static 3869cd37da74Snw idmap_retcode 3870c5c4113dSnw lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res, 3871fe1c642dSBill Krier int is_user) 3872cd37da74Snw { 3873c5c4113dSnw char *end; 3874c5c4113dSnw char *sql = NULL; 3875c5c4113dSnw const char **values; 3876c5c4113dSnw sqlite_vm *vm = NULL; 3877c5c4113dSnw int ncol; 3878c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS; 3879c5c4113dSnw time_t curtime; 3880e8c27ec8Sbaban idmap_id_type idtype; 3881c5c4113dSnw 3882c5c4113dSnw /* Current time */ 3883c5c4113dSnw errno = 0; 3884c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 3885cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 3886cd37da74Snw strerror(errno)); 3887c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 3888c5c4113dSnw goto out; 3889c5c4113dSnw } 3890c5c4113dSnw 3891e8c27ec8Sbaban /* SQL to lookup the cache by pid or by unixname */ 38929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID) { 389348258c6bSjp sql = sqlite_mprintf("SELECT sidprefix, rid, " 389448258c6bSjp "canon_winname, windomain, w2u, is_wuser, " 389548258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 389648258c6bSjp "map_winname, map_unixname, map_is_nt4 " 3897e8c27ec8Sbaban "FROM idmap_cache WHERE " 3898e8c27ec8Sbaban "pid = %u AND u2w = 1 AND is_user = %d AND " 3899e8c27ec8Sbaban "(pid >= 2147483648 OR " 3900e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 3901e8c27ec8Sbaban "expiration > %d));", 3902e8c27ec8Sbaban req->id1.idmap_id_u.uid, is_user, curtime); 3903e8c27ec8Sbaban } else if (req->id1name != NULL) { 390448258c6bSjp sql = sqlite_mprintf("SELECT sidprefix, rid, " 390548258c6bSjp "canon_winname, windomain, w2u, is_wuser, " 390648258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 390748258c6bSjp "map_winname, map_unixname, map_is_nt4 " 3908e8c27ec8Sbaban "FROM idmap_cache WHERE " 3909e8c27ec8Sbaban "unixname = %Q AND u2w = 1 AND is_user = %d AND " 3910e8c27ec8Sbaban "(pid >= 2147483648 OR " 3911e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 3912e8c27ec8Sbaban "expiration > %d));", 3913e8c27ec8Sbaban req->id1name, is_user, curtime); 391448258c6bSjp } else { 391548258c6bSjp retcode = IDMAP_ERR_ARG; 391648258c6bSjp goto out; 3917e8c27ec8Sbaban } 3918e8c27ec8Sbaban 3919c5c4113dSnw if (sql == NULL) { 3920c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3921c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3922c5c4113dSnw goto out; 3923c5c4113dSnw } 392448258c6bSjp retcode = sql_compile_n_step_once( 392548258c6bSjp cache, sql, &vm, &ncol, 14, &values); 3926c5c4113dSnw sqlite_freemem(sql); 3927c5c4113dSnw 3928c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) 3929c5c4113dSnw goto out; 3930c5c4113dSnw else if (retcode == IDMAP_SUCCESS) { 3931c5c4113dSnw /* sanity checks */ 3932c5c4113dSnw if (values[0] == NULL || values[1] == NULL) { 3933c5c4113dSnw retcode = IDMAP_ERR_CACHE; 3934c5c4113dSnw goto out; 3935c5c4113dSnw } 3936c5c4113dSnw 3937e8c27ec8Sbaban switch (res->id.idtype) { 3938c5c4113dSnw case IDMAP_SID: 3939cd37da74Snw case IDMAP_USID: 3940cd37da74Snw case IDMAP_GSID: 3941e8c27ec8Sbaban idtype = strtol(values[5], &end, 10) == 1 3942cd37da74Snw ? IDMAP_USID : IDMAP_GSID; 3943cd37da74Snw 3944e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID && 3945e8c27ec8Sbaban idtype != IDMAP_USID) { 3946cd37da74Snw retcode = IDMAP_ERR_NOTUSER; 3947cd37da74Snw goto out; 3948e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GSID && 3949e8c27ec8Sbaban idtype != IDMAP_GSID) { 3950cd37da74Snw retcode = IDMAP_ERR_NOTGROUP; 3951cd37da74Snw goto out; 3952cd37da74Snw } 3953e8c27ec8Sbaban res->id.idtype = idtype; 3954cd37da74Snw 3955c5c4113dSnw res->id.idmap_id_u.sid.rid = 3956cd37da74Snw strtoul(values[1], &end, 10); 3957c5c4113dSnw res->id.idmap_id_u.sid.prefix = strdup(values[0]); 3958c5c4113dSnw if (res->id.idmap_id_u.sid.prefix == NULL) { 3959c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3960c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3961c5c4113dSnw goto out; 3962c5c4113dSnw } 3963c5c4113dSnw 396462c60062Sbaban if (values[4] != NULL) 3965c5c4113dSnw res->direction = 3966651c0131Sbaban (strtol(values[4], &end, 10) == 0)? 3967651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 3968c5c4113dSnw else 3969651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W; 3970c5c4113dSnw 3971fe1c642dSBill Krier if (values[2] == NULL) 3972c5c4113dSnw break; 39738e228215Sdm req->id2name = strdup(values[2]); 39748e228215Sdm if (req->id2name == NULL) { 3975c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3976c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3977c5c4113dSnw goto out; 3978c5c4113dSnw } 3979c5c4113dSnw 3980c5c4113dSnw if (values[3] == NULL) 3981c5c4113dSnw break; 39828e228215Sdm req->id2domain = strdup(values[3]); 39838e228215Sdm if (req->id2domain == NULL) { 3984c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 3985c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 3986c5c4113dSnw goto out; 3987c5c4113dSnw } 3988cd37da74Snw 3989c5c4113dSnw break; 3990c5c4113dSnw default: 3991c5c4113dSnw retcode = IDMAP_ERR_NOTSUPPORTED; 3992c5c4113dSnw break; 3993c5c4113dSnw } 399448258c6bSjp if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 399548258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE; 399648258c6bSjp res->info.how.map_type = strtoul(values[6], &end, 10); 399748258c6bSjp switch (res->info.how.map_type) { 399848258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 399948258c6bSjp res->info.how.idmap_how_u.ad.dn = 400048258c6bSjp strdup(values[7]); 400148258c6bSjp res->info.how.idmap_how_u.ad.attr = 400248258c6bSjp strdup(values[8]); 400348258c6bSjp res->info.how.idmap_how_u.ad.value = 400448258c6bSjp strdup(values[9]); 400548258c6bSjp break; 400648258c6bSjp 400748258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 400848258c6bSjp res->info.how.idmap_how_u.nldap.dn = 400948258c6bSjp strdup(values[7]); 401048258c6bSjp res->info.how.idmap_how_u.nldap.attr = 401148258c6bSjp strdup(values[8]); 401248258c6bSjp res->info.how.idmap_how_u.nldap.value = 401348258c6bSjp strdup(values[9]); 401448258c6bSjp break; 401548258c6bSjp 401648258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 401748258c6bSjp res->info.how.idmap_how_u.rule.windomain = 401848258c6bSjp strdup(values[10]); 401948258c6bSjp res->info.how.idmap_how_u.rule.winname = 402048258c6bSjp strdup(values[11]); 402148258c6bSjp res->info.how.idmap_how_u.rule.unixname = 402248258c6bSjp strdup(values[12]); 402348258c6bSjp res->info.how.idmap_how_u.rule.is_nt4 = 402448258c6bSjp strtoul(values[13], &end, 10); 402548258c6bSjp res->info.how.idmap_how_u.rule.is_user = 402648258c6bSjp is_user; 402748258c6bSjp res->info.how.idmap_how_u.rule.is_wuser = 402848258c6bSjp strtol(values[5], &end, 10); 402948258c6bSjp break; 403048258c6bSjp 403148258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 403248258c6bSjp break; 403348258c6bSjp 403448258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 403548258c6bSjp break; 403648258c6bSjp 403748258c6bSjp case IDMAP_MAP_TYPE_KNOWN_SID: 403848258c6bSjp break; 403948258c6bSjp 4040e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 4041e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.dn = 4042e3f2c991SKeyur Desai strdup(values[7]); 4043e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.attr = 4044e3f2c991SKeyur Desai strdup(values[8]); 4045e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.value = 4046e3f2c991SKeyur Desai strdup(values[9]); 4047e3f2c991SKeyur Desai break; 4048e3f2c991SKeyur Desai 404948258c6bSjp default: 4050e3f2c991SKeyur Desai /* Unknown mapping type */ 405148258c6bSjp assert(FALSE); 405248258c6bSjp } 405348258c6bSjp } 4054c5c4113dSnw } 4055c5c4113dSnw 4056c5c4113dSnw out: 405762c60062Sbaban if (vm != NULL) 4058c5c4113dSnw (void) sqlite_finalize(vm, NULL); 4059c5c4113dSnw return (retcode); 4060c5c4113dSnw } 4061c5c4113dSnw 406208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 406308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given: 406408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * cache sqlite handle 406508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name 406608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name 406708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 406808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Return: Error code 406908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 407008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname Canonical name (if canonname is non-NULL) [1] 407108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix [1] 407208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID 407308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *type Type of name 407408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 407508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error 407608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 4077cd37da74Snw static 4078cd37da74Snw idmap_retcode 4079148c5f43SAlan Wright lookup_cache_name2sid( 4080148c5f43SAlan Wright sqlite *cache, 4081148c5f43SAlan Wright const char *name, 4082148c5f43SAlan Wright const char *domain, 4083148c5f43SAlan Wright char **canonname, 4084148c5f43SAlan Wright char **sidprefix, 4085148c5f43SAlan Wright idmap_rid_t *rid, 4086148c5f43SAlan Wright idmap_id_type *type) 4087cd37da74Snw { 4088cd37da74Snw char *end, *lower_name; 408908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *sql; 4090c5c4113dSnw const char **values; 4091c5c4113dSnw sqlite_vm *vm = NULL; 4092c5c4113dSnw int ncol; 4093c5c4113dSnw time_t curtime; 409408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode retcode; 409508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 409608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL; 409708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) 409808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 4099c5c4113dSnw 4100c5c4113dSnw /* Get current time */ 4101c5c4113dSnw errno = 0; 4102c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) { 4103cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)", 4104cd37da74Snw strerror(errno)); 4105c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4106c5c4113dSnw goto out; 4107c5c4113dSnw } 4108c5c4113dSnw 4109c5c4113dSnw /* SQL to lookup the cache */ 4110cd37da74Snw if ((lower_name = tolower_u8(name)) == NULL) 4111cd37da74Snw lower_name = (char *)name; 4112cd37da74Snw sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name " 4113cd37da74Snw "FROM name_cache WHERE name = %Q AND domain = %Q AND " 4114cd37da74Snw "(expiration = 0 OR expiration ISNULL OR " 4115cd37da74Snw "expiration > %d);", lower_name, domain, curtime); 4116cd37da74Snw if (lower_name != name) 4117cd37da74Snw free(lower_name); 4118c5c4113dSnw if (sql == NULL) { 4119c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 4120c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 4121c5c4113dSnw goto out; 4122c5c4113dSnw } 4123cd37da74Snw retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values); 412408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 4125c5c4113dSnw sqlite_freemem(sql); 4126c5c4113dSnw 412708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode != IDMAP_SUCCESS) 412808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out; 4129c5c4113dSnw 413008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (type != NULL) { 413108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (values[2] == NULL) { 4132e8c27ec8Sbaban retcode = IDMAP_ERR_CACHE; 4133e8c27ec8Sbaban goto out; 4134e8c27ec8Sbaban } 4135148c5f43SAlan Wright *type = xlate_legacy_type(strtol(values[2], &end, 10)); 413608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4137e8c27ec8Sbaban 413808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (values[0] == NULL || values[1] == NULL) { 413908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_CACHE; 414008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out; 414108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4142cd37da74Snw 414308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 414408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States assert(values[3] != NULL); 414508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = strdup(values[3]); 414608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canonname == NULL) { 4147c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 4148c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 4149c5c4113dSnw goto out; 4150c5c4113dSnw } 4151c5c4113dSnw } 4152c5c4113dSnw 415308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(values[0]); 415408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*sidprefix == NULL) { 415508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory"); 415608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_MEMORY; 415708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out; 415808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 415908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *rid = strtoul(values[1], &end, 10); 416008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 416108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_SUCCESS; 416208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 4163c5c4113dSnw out: 416462c60062Sbaban if (vm != NULL) 4165c5c4113dSnw (void) sqlite_finalize(vm, NULL); 416608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States 416708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode != IDMAP_SUCCESS) { 416808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*sidprefix); 416908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL; 417008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) { 417108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname); 417208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL; 417308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 417408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4175c5c4113dSnw return (retcode); 4176c5c4113dSnw } 4177c5c4113dSnw 4178cd37da74Snw static 4179cd37da74Snw idmap_retcode 4180e8c27ec8Sbaban ad_lookup_by_winname(lookup_state_t *state, 4181148c5f43SAlan Wright const char *name, const char *domain, int esidtype, 418248258c6bSjp char **dn, char **attr, char **value, char **canonname, 4183148c5f43SAlan Wright char **sidprefix, idmap_rid_t *rid, idmap_id_type *wintype, 418448258c6bSjp char **unixname) 4185cd37da74Snw { 41864d61c878SJulian Pullen int retries; 4187c5c4113dSnw idmap_query_state_t *qs = NULL; 4188c5c4113dSnw idmap_retcode rc, retcode; 41894d61c878SJulian Pullen int i; 41904d61c878SJulian Pullen int found_ad = 0; 4191c5c4113dSnw 41922b4a7802SBaban Kenkre RDLOCK_CONFIG(); 4193e3f2c991SKeyur Desai if (_idmapdstate.num_gcs > 0) { 4194e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_gcs && !found_ad; i++) { 41954d61c878SJulian Pullen retries = 0; 41964d61c878SJulian Pullen retry: 4197e3f2c991SKeyur Desai retcode = idmap_lookup_batch_start( 4198e3f2c991SKeyur Desai _idmapdstate.gcs[i], 4199e3f2c991SKeyur Desai 1, 4200e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.directory_based_mapping, 4201e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.default_domain, 4202e3f2c991SKeyur Desai &qs); 42034d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) { 42044d61c878SJulian Pullen if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 42054d61c878SJulian Pullen retries++ < ADUTILS_DEF_NUM_RETRIES) 42064d61c878SJulian Pullen goto retry; 42074d61c878SJulian Pullen degrade_svc(1, "failed to create request for " 42084d61c878SJulian Pullen "AD lookup by winname"); 42094d61c878SJulian Pullen return (retcode); 42104d61c878SJulian Pullen } 4211c5c4113dSnw 42124d61c878SJulian Pullen restore_svc(); 4213c5c4113dSnw 42144d61c878SJulian Pullen if (state != NULL && i == 0) { 42154d61c878SJulian Pullen /* 42164d61c878SJulian Pullen * Directory based name mapping is only 42174d61c878SJulian Pullen * performed within the joined forest (i == 0). 42184d61c878SJulian Pullen * We don't trust other "trusted" forests to 42194d61c878SJulian Pullen * provide DS-based name mapping information 42204d61c878SJulian Pullen * because AD's definition of "cross-forest 42214d61c878SJulian Pullen * trust" does not encompass this sort of 42224d61c878SJulian Pullen * behavior. 42234d61c878SJulian Pullen */ 42244d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs, 42254d61c878SJulian Pullen state->ad_unixuser_attr, 42264d61c878SJulian Pullen state->ad_unixgroup_attr); 42274d61c878SJulian Pullen } 4228c5c4113dSnw 42294d61c878SJulian Pullen retcode = idmap_name2sid_batch_add1(qs, name, domain, 4230148c5f43SAlan Wright esidtype, dn, attr, value, canonname, sidprefix, 4231e3f2c991SKeyur Desai rid, wintype, unixname, NULL, &rc); 42324d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) { 42334d61c878SJulian Pullen idmap_lookup_release_batch(&qs); 42344d61c878SJulian Pullen continue; 42354d61c878SJulian Pullen } 42364d61c878SJulian Pullen found_ad = 1; 42374d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) 42384d61c878SJulian Pullen idmap_lookup_release_batch(&qs); 42394d61c878SJulian Pullen else 42404d61c878SJulian Pullen retcode = idmap_lookup_batch_end(&qs); 42414d61c878SJulian Pullen 42424d61c878SJulian Pullen if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 42434d61c878SJulian Pullen retries++ < ADUTILS_DEF_NUM_RETRIES) 42444d61c878SJulian Pullen goto retry; 42454d61c878SJulian Pullen else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 42464d61c878SJulian Pullen degrade_svc(1, 42474d61c878SJulian Pullen "some AD lookups timed out repeatedly"); 42484d61c878SJulian Pullen } 42494d61c878SJulian Pullen } else { 42504d61c878SJulian Pullen /* No AD case */ 42514d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY; 42524d61c878SJulian Pullen } 42534d61c878SJulian Pullen UNLOCK_CONFIG(); 4254c5c4113dSnw 4255c5c4113dSnw if (retcode != IDMAP_SUCCESS) { 42569fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_NOTICE, 42579fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "AD lookup of winname %s@%s failed, error code %d", 42589fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States name == NULL ? "(null)" : name, 42599fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States domain == NULL ? "(null)" : domain, 42609fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States retcode); 4261c5c4113dSnw return (retcode); 4262e8c27ec8Sbaban } 4263e8c27ec8Sbaban return (rc); 4264c5c4113dSnw } 4265c5c4113dSnw 426608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 426708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given: 426808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * cache sqlite handle to cache 426908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name 427008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name 427108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * local_only if true, don't try AD lookups 427208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 427308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Returns: Error code 427408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 427508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname Canonical name (if non-NULL) [1] 427608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canondomain Canonical domain (if non-NULL) [1] 427708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix [1] 427808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID 427908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *req Request (direction is updated) 428008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * 428108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error 428208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 4283cd37da74Snw idmap_retcode 428408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_name2sid( 428508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States sqlite *cache, 428608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *name, 428708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *domain, 4288148c5f43SAlan Wright int want_wuser, 428908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canonname, 429008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canondomain, 429108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **sidprefix, 429208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *rid, 4293148c5f43SAlan Wright idmap_id_type *type, 429408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_mapping *req, 429508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int local_only) 4296cd37da74Snw { 4297c5c4113dSnw idmap_retcode retcode; 4298c5c4113dSnw 4299cd37da74Snw *sidprefix = NULL; 4300e8c27ec8Sbaban if (canonname != NULL) 4301e8c27ec8Sbaban *canonname = NULL; 430208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) 430308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL; 4304cd37da74Snw 4305e8c27ec8Sbaban /* Lookup well-known SIDs table */ 430608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = lookup_wksids_name2sid(name, domain, canonname, canondomain, 4307148c5f43SAlan Wright sidprefix, rid, type); 430862c60062Sbaban if (retcode == IDMAP_SUCCESS) { 4309e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 431062c60062Sbaban goto out; 431162c60062Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) { 431262c60062Sbaban return (retcode); 431362c60062Sbaban } 431462c60062Sbaban 4315e8c27ec8Sbaban /* Lookup cache */ 4316cd37da74Snw retcode = lookup_cache_name2sid(cache, name, domain, canonname, 4317148c5f43SAlan Wright sidprefix, rid, type); 4318e8c27ec8Sbaban if (retcode == IDMAP_SUCCESS) { 4319e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 4320e8c27ec8Sbaban goto out; 4321e8c27ec8Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) { 4322c5c4113dSnw return (retcode); 4323c5c4113dSnw } 4324c5c4113dSnw 4325479ac375Sdm /* 4326479ac375Sdm * The caller may be using this function to determine if this 4327479ac375Sdm * request needs to be marked for AD lookup or not 4328479ac375Sdm * (i.e. _IDMAP_F_LOOKUP_AD) and therefore may not want this 4329479ac375Sdm * function to AD lookup now. 4330479ac375Sdm */ 4331479ac375Sdm if (local_only) 4332479ac375Sdm return (retcode); 4333479ac375Sdm 4334148c5f43SAlan Wright if (_idmapdstate.cfg->pgcfg.use_lsa && 4335148c5f43SAlan Wright _idmapdstate.cfg->pgcfg.domain_name != NULL && 4336148c5f43SAlan Wright name != NULL && *sidprefix == NULL) { 4337148c5f43SAlan Wright retcode = lookup_lsa_by_name(name, domain, 4338148c5f43SAlan Wright sidprefix, rid, 4339148c5f43SAlan Wright canonname, canondomain, 4340148c5f43SAlan Wright type); 4341148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) 4342148c5f43SAlan Wright goto out; 4343148c5f43SAlan Wright else if (retcode != IDMAP_ERR_NOTFOUND) 4344148c5f43SAlan Wright return (retcode); 4345148c5f43SAlan Wright } 4346148c5f43SAlan Wright 4347e8c27ec8Sbaban /* Lookup AD */ 4348148c5f43SAlan Wright retcode = ad_lookup_by_winname(NULL, name, domain, IDMAP_POSIXID, 4349148c5f43SAlan Wright NULL, NULL, NULL, canonname, sidprefix, rid, type, NULL); 4350e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4351e8c27ec8Sbaban return (retcode); 4352e8c27ec8Sbaban 435362c60062Sbaban out: 4354c5c4113dSnw /* 4355c5c4113dSnw * Entry found (cache or Windows lookup) 4356c5c4113dSnw */ 4357148c5f43SAlan Wright if (want_wuser == 1 && *type != IDMAP_USID) 4358e8c27ec8Sbaban retcode = IDMAP_ERR_NOTUSER; 4359148c5f43SAlan Wright else if (want_wuser == 0 && *type != IDMAP_GSID) 4360e8c27ec8Sbaban retcode = IDMAP_ERR_NOTGROUP; 4361148c5f43SAlan Wright else if (want_wuser == -1) { 4362148c5f43SAlan Wright /* 4363148c5f43SAlan Wright * Caller wants to know if its user or group 4364148c5f43SAlan Wright * Verify that it's one or the other. 4365148c5f43SAlan Wright */ 4366148c5f43SAlan Wright if (*type != IDMAP_USID && *type != IDMAP_GSID) 4367e8c27ec8Sbaban retcode = IDMAP_ERR_SID; 4368c5c4113dSnw } 4369c5c4113dSnw 437008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode == IDMAP_SUCCESS) { 437108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* 437208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we were asked for a canonical domain and none 437308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * of the searches have provided one, assume it's the 437408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * supplied domain. 437508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */ 437608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL && *canondomain == NULL) { 437708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(domain); 437808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canondomain == NULL) 437908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_MEMORY; 438008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 438108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4382e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 4383e8c27ec8Sbaban free(*sidprefix); 4384e8c27ec8Sbaban *sidprefix = NULL; 4385e8c27ec8Sbaban if (canonname != NULL) { 4386e8c27ec8Sbaban free(*canonname); 4387e8c27ec8Sbaban *canonname = NULL; 4388e8c27ec8Sbaban } 438908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) { 439008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canondomain); 439108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL; 439208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } 4393e8c27ec8Sbaban } 4394c5c4113dSnw return (retcode); 4395c5c4113dSnw } 4396c5c4113dSnw 4397cd37da74Snw static 4398cd37da74Snw idmap_retcode 4399479ac375Sdm name_based_mapping_pid2sid(lookup_state_t *state, const char *unixname, 4400cd37da74Snw int is_user, idmap_mapping *req, idmap_id_res *res) 4401cd37da74Snw { 4402c5c4113dSnw const char *winname, *windomain; 4403cd37da74Snw char *canonname; 440408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canondomain; 4405c5c4113dSnw char *sql = NULL, *errmsg = NULL; 4406c5c4113dSnw idmap_retcode retcode; 4407c5c4113dSnw char *end; 4408c5c4113dSnw const char **values; 4409c5c4113dSnw sqlite_vm *vm = NULL; 441048258c6bSjp int ncol, r; 4411148c5f43SAlan Wright int want_wuser; 4412c5c4113dSnw const char *me = "name_based_mapping_pid2sid"; 441348258c6bSjp idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 441448258c6bSjp int direction; 4415e8c27ec8Sbaban 4416e8c27ec8Sbaban assert(unixname != NULL); /* We have unixname */ 4417e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have winname */ 4418e8c27ec8Sbaban assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */ 4419c5c4113dSnw 4420c5c4113dSnw sql = sqlite_mprintf( 442148258c6bSjp "SELECT winname_display, windomain, w2u_order, " 442248258c6bSjp "is_wuser, unixname, is_nt4 " 442348258c6bSjp "FROM namerules WHERE " 4424cd37da74Snw "u2w_order > 0 AND is_user = %d AND " 4425cd37da74Snw "(unixname = %Q OR unixname = '*') " 4426cd37da74Snw "ORDER BY u2w_order ASC;", is_user, unixname); 4427c5c4113dSnw if (sql == NULL) { 4428c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 4429c5c4113dSnw retcode = IDMAP_ERR_MEMORY; 4430c5c4113dSnw goto out; 4431c5c4113dSnw } 4432c5c4113dSnw 4433479ac375Sdm if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 4434c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4435cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 4436cd37da74Snw CHECK_NULL(errmsg)); 4437c5c4113dSnw sqlite_freemem(errmsg); 4438c5c4113dSnw goto out; 4439c5c4113dSnw } 4440c5c4113dSnw 444148258c6bSjp for (;;) { 4442c5c4113dSnw r = sqlite_step(vm, &ncol, &values, NULL); 444384decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 444484decf41Sjp if (r == SQLITE_ROW) { 444548258c6bSjp if (ncol < 6) { 4446c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4447c5c4113dSnw goto out; 4448c5c4113dSnw } 4449148c5f43SAlan Wright 4450148c5f43SAlan Wright TRACE(req, res, "Matching rule: %s -> %s@%s", 4451148c5f43SAlan Wright values[4] == NULL ? "(null)" : values[4], 4452148c5f43SAlan Wright values[0] == NULL ? "(null)" : values[0], 4453148c5f43SAlan Wright values[1] == NULL ? "(null)" : values[1]); 4454148c5f43SAlan Wright 4455c5c4113dSnw if (values[0] == NULL) { 4456c5c4113dSnw /* values [1] and [2] can be null */ 4457c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4458c5c4113dSnw goto out; 4459c5c4113dSnw } 446048258c6bSjp 446148258c6bSjp if (values[2] != NULL) 446248258c6bSjp direction = 446348258c6bSjp (strtol(values[2], &end, 10) == 0)? 446448258c6bSjp IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 446548258c6bSjp else 446648258c6bSjp direction = IDMAP_DIRECTION_U2W; 446748258c6bSjp 4468c5c4113dSnw if (EMPTY_NAME(values[0])) { 446948258c6bSjp idmap_namerule_set(rule, values[1], values[0], 447048258c6bSjp values[4], is_user, 447148258c6bSjp strtol(values[3], &end, 10), 447248258c6bSjp strtol(values[5], &end, 10), 447348258c6bSjp direction); 4474148c5f43SAlan Wright TRACE(req, res, "Mapping inhibited"); 4475c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING; 4476c5c4113dSnw goto out; 4477c5c4113dSnw } 4478cd37da74Snw 4479cd37da74Snw if (values[0][0] == '*') { 448048258c6bSjp winname = unixname; 4481cd37da74Snw } else { 4482cd37da74Snw winname = values[0]; 4483cd37da74Snw } 4484*cb174861Sjoyce mcintosh 4485148c5f43SAlan Wright want_wuser = res->id.idtype == IDMAP_USID ? 1 448648258c6bSjp : res->id.idtype == IDMAP_GSID ? 0 448748258c6bSjp : -1; 448862c60062Sbaban if (values[1] != NULL) 4489c5c4113dSnw windomain = values[1]; 4490148c5f43SAlan Wright else if (state->defdom != NULL) { 4491479ac375Sdm windomain = state->defdom; 4492148c5f43SAlan Wright TRACE(req, res, 4493148c5f43SAlan Wright "Added default domain %s to rule", 4494148c5f43SAlan Wright windomain); 4495148c5f43SAlan Wright } else { 4496cd37da74Snw idmapdlog(LOG_ERR, "%s: no domain", me); 4497148c5f43SAlan Wright TRACE(req, res, 4498148c5f43SAlan Wright "No domain in rule, and no default domain"); 4499c5c4113dSnw retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 4500c5c4113dSnw goto out; 4501c5c4113dSnw } 4502cd37da74Snw 4503479ac375Sdm retcode = lookup_name2sid(state->cache, 4504479ac375Sdm winname, windomain, 4505148c5f43SAlan Wright want_wuser, &canonname, &canondomain, 4506cd37da74Snw &res->id.idmap_id_u.sid.prefix, 4507148c5f43SAlan Wright &res->id.idmap_id_u.sid.rid, 4508148c5f43SAlan Wright &res->id.idtype, req, 0); 4509e8c27ec8Sbaban 4510148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 4511148c5f43SAlan Wright break; 4512148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) { 4513*cb174861Sjoyce mcintosh if (values[0][0] == '*') { 4514*cb174861Sjoyce mcintosh TRACE(req, res, 4515*cb174861Sjoyce mcintosh "%s@%s not found, continuing", 4516*cb174861Sjoyce mcintosh winname, windomain); 4517*cb174861Sjoyce mcintosh continue; 4518*cb174861Sjoyce mcintosh } else { 4519*cb174861Sjoyce mcintosh TRACE(req, res, 4520*cb174861Sjoyce mcintosh "%s@%s not found", 4521*cb174861Sjoyce mcintosh winname, windomain); 4522*cb174861Sjoyce mcintosh retcode = IDMAP_ERR_NOMAPPING; 4523*cb174861Sjoyce mcintosh } 4524148c5f43SAlan Wright } else { 4525148c5f43SAlan Wright TRACE(req, res, 4526148c5f43SAlan Wright "Looking up %s@%s error=%d", 4527148c5f43SAlan Wright winname, windomain, retcode); 4528c5c4113dSnw } 4529148c5f43SAlan Wright 4530*cb174861Sjoyce mcintosh idmap_namerule_set(rule, values[1], 4531*cb174861Sjoyce mcintosh values[0], values[4], is_user, 4532*cb174861Sjoyce mcintosh strtol(values[3], &end, 10), 4533*cb174861Sjoyce mcintosh strtol(values[5], &end, 10), 4534*cb174861Sjoyce mcintosh direction); 4535*cb174861Sjoyce mcintosh 4536c5c4113dSnw goto out; 453748258c6bSjp 4538c5c4113dSnw } else if (r == SQLITE_DONE) { 4539*cb174861Sjoyce mcintosh TRACE(req, res, "No matching rule"); 4540*cb174861Sjoyce mcintosh retcode = IDMAP_ERR_NOTFOUND; 4541c5c4113dSnw goto out; 4542c5c4113dSnw } else { 4543c5c4113dSnw (void) sqlite_finalize(vm, &errmsg); 4544c5c4113dSnw vm = NULL; 4545cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me, 4546cd37da74Snw CHECK_NULL(errmsg)); 4547c5c4113dSnw sqlite_freemem(errmsg); 4548c5c4113dSnw retcode = IDMAP_ERR_INTERNAL; 4549c5c4113dSnw goto out; 4550c5c4113dSnw } 4551c5c4113dSnw } 4552c5c4113dSnw 4553148c5f43SAlan Wright if (values[2] != NULL) 4554148c5f43SAlan Wright res->direction = 4555148c5f43SAlan Wright (strtol(values[2], &end, 10) == 0)? 4556148c5f43SAlan Wright IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 4557148c5f43SAlan Wright else 4558148c5f43SAlan Wright res->direction = IDMAP_DIRECTION_U2W; 4559cd37da74Snw 4560148c5f43SAlan Wright req->id2name = canonname; 4561148c5f43SAlan Wright req->id2domain = canondomain; 45628e228215Sdm 4563148c5f43SAlan Wright idmap_namerule_set(rule, values[1], values[0], values[4], 4564148c5f43SAlan Wright is_user, strtol(values[3], &end, 10), 4565148c5f43SAlan Wright strtol(values[5], &end, 10), 4566148c5f43SAlan Wright rule->direction); 4567148c5f43SAlan Wright TRACE(req, res, "Windows name found"); 4568479ac375Sdm 4569148c5f43SAlan Wright out: 4570148c5f43SAlan Wright if (sql != NULL) 4571148c5f43SAlan Wright sqlite_freemem(sql); 4572fc724630SAlan Wright 4573fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) { 4574fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 457548258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW; 4576c5c4113dSnw } 4577fc724630SAlan Wright 457862c60062Sbaban if (vm != NULL) 4579c5c4113dSnw (void) sqlite_finalize(vm, NULL); 4580c5c4113dSnw return (retcode); 4581c5c4113dSnw } 4582c5c4113dSnw 4583cd37da74Snw /* 4584cd37da74Snw * Convention when processing unix2win requests: 4585cd37da74Snw * 4586cd37da74Snw * Unix identity: 4587cd37da74Snw * req->id1name = 4588cd37da74Snw * unixname if given otherwise unixname found will be placed 4589cd37da74Snw * here. 4590cd37da74Snw * req->id1domain = 4591cd37da74Snw * NOT USED 4592cd37da74Snw * req->id1.idtype = 4593cd37da74Snw * Given type (IDMAP_UID or IDMAP_GID) 4594cd37da74Snw * req->id1..[uid or gid] = 4595cd37da74Snw * UID/GID if given otherwise UID/GID found will be placed here. 4596cd37da74Snw * 4597cd37da74Snw * Windows identity: 4598cd37da74Snw * req->id2name = 4599cd37da74Snw * winname found will be placed here. 4600cd37da74Snw * req->id2domain = 4601cd37da74Snw * windomain found will be placed here. 4602cd37da74Snw * res->id.idtype = 4603cd37da74Snw * Target type initialized from req->id2.idtype. If 4604cd37da74Snw * it is IDMAP_SID then actual type (IDMAP_USID/GSID) found 4605cd37da74Snw * will be placed here. 4606cd37da74Snw * req->id..sid.[prefix, rid] = 4607cd37da74Snw * SID found will be placed here. 4608cd37da74Snw * 4609cd37da74Snw * Others: 4610cd37da74Snw * res->retcode = 4611cd37da74Snw * Return status for this request will be placed here. 4612cd37da74Snw * res->direction = 4613cd37da74Snw * Direction found will be placed here. Direction 4614cd37da74Snw * meaning whether the resultant mapping is valid 4615cd37da74Snw * only from unix2win or bi-directional. 4616cd37da74Snw * req->direction = 4617cd37da74Snw * INTERNAL USE. Used by idmapd to set various 4618cd37da74Snw * flags (_IDMAP_F_xxxx) to aid in processing 4619cd37da74Snw * of the request. 4620cd37da74Snw * req->id2.idtype = 4621cd37da74Snw * INTERNAL USE. Initially this is the requested target 4622cd37da74Snw * type and is used to initialize res->id.idtype. 4623cd37da74Snw * ad_lookup_batch() uses this field temporarily to store 4624cd37da74Snw * sid_type obtained by the batched AD lookups and after 4625cd37da74Snw * use resets it to IDMAP_NONE to prevent xdr from 4626cd37da74Snw * mis-interpreting the contents of req->id2. 4627cd37da74Snw * req->id2..[uid or gid or sid] = 4628cd37da74Snw * NOT USED 4629cd37da74Snw */ 4630cd37da74Snw 4631cd37da74Snw /* 4632cd37da74Snw * This function does the following: 4633cd37da74Snw * 1. Lookup well-known SIDs table. 4634cd37da74Snw * 2. Lookup cache. 4635cd37da74Snw * 3. Check if the client does not want new mapping to be allocated 4636cd37da74Snw * in which case this pass is the final pass. 4637e8c27ec8Sbaban * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs 4638e8c27ec8Sbaban * to do AD/NLDAP lookup. 4639cd37da74Snw */ 4640c5c4113dSnw idmap_retcode 4641479ac375Sdm pid2sid_first_pass(lookup_state_t *state, idmap_mapping *req, 4642fe1c642dSBill Krier idmap_id_res *res, int is_user) 4643cd37da74Snw { 4644e8c27ec8Sbaban idmap_retcode retcode; 4645148c5f43SAlan Wright idmap_retcode retcode2; 4646e8c27ec8Sbaban bool_t gen_localsid_on_err = FALSE; 4647c5c4113dSnw 4648e8c27ec8Sbaban /* Initialize result */ 4649c5c4113dSnw res->id.idtype = req->id2.idtype; 4650e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF; 4651e8c27ec8Sbaban 4652e8c27ec8Sbaban if (req->id2.idmap_id_u.sid.prefix != NULL) { 4653e8c27ec8Sbaban /* sanitize sidprefix */ 4654e8c27ec8Sbaban free(req->id2.idmap_id_u.sid.prefix); 4655e8c27ec8Sbaban req->id2.idmap_id_u.sid.prefix = NULL; 4656e8c27ec8Sbaban } 4657c5c4113dSnw 465848258c6bSjp /* Find pid */ 46599fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.uid == IDMAP_SENTINEL_PID) { 4660fe1c642dSBill Krier if (req->id1name == NULL) { 4661fe1c642dSBill Krier retcode = IDMAP_ERR_ARG; 4662fe1c642dSBill Krier goto out; 4663fe1c642dSBill Krier } 4664fe1c642dSBill Krier 4665148c5f43SAlan Wright retcode = ns_lookup_byname(req->id1name, NULL, &req->id1); 4666148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) { 4667148c5f43SAlan Wright TRACE(req, res, "Getting UNIX ID error=%d", retcode); 466848258c6bSjp retcode = IDMAP_ERR_NOMAPPING; 466948258c6bSjp goto out; 467048258c6bSjp } 4671148c5f43SAlan Wright TRACE(req, res, "Found UNIX ID"); 467248258c6bSjp } 467348258c6bSjp 467408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup in well-known SIDs table */ 4675c5c4113dSnw retcode = lookup_wksids_pid2sid(req, res, is_user); 4676148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 4677148c5f43SAlan Wright TRACE(req, res, "Hardwired mapping"); 4678148c5f43SAlan Wright goto out; 4679148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 4680148c5f43SAlan Wright TRACE(req, res, 4681148c5f43SAlan Wright "Well-known account lookup error=%d", retcode); 4682c5c4113dSnw goto out; 4683148c5f43SAlan Wright } 4684c5c4113dSnw 468508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup in cache */ 4686fe1c642dSBill Krier retcode = lookup_cache_pid2sid(state->cache, req, res, is_user); 4687148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 4688148c5f43SAlan Wright TRACE(req, res, "Found in mapping cache"); 4689148c5f43SAlan Wright goto out; 4690148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) { 4691148c5f43SAlan Wright TRACE(req, res, 4692148c5f43SAlan Wright "Mapping cache lookup error=%d", retcode); 4693c5c4113dSnw goto out; 4694148c5f43SAlan Wright } 4695148c5f43SAlan Wright TRACE(req, res, "Not found in mapping cache"); 4696c5c4113dSnw 4697c5c4113dSnw /* Ephemeral ids cannot be allocated during pid2sid */ 46989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (IDMAP_ID_IS_EPHEMERAL(req->id1.idmap_id_u.uid)) { 469962c60062Sbaban retcode = IDMAP_ERR_NOMAPPING; 4700148c5f43SAlan Wright TRACE(req, res, "Shouldn't have an ephemeral ID here"); 4701c5c4113dSnw goto out; 4702c5c4113dSnw } 4703c5c4113dSnw 470448258c6bSjp if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) { 47054d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED; 470648258c6bSjp goto out; 470748258c6bSjp } 470848258c6bSjp 470948258c6bSjp if (AVOID_NAMESERVICE(req)) { 4710e8c27ec8Sbaban gen_localsid_on_err = TRUE; 471162c60062Sbaban retcode = IDMAP_ERR_NOMAPPING; 4712c5c4113dSnw goto out; 4713c5c4113dSnw } 4714c5c4113dSnw 4715e8c27ec8Sbaban /* Set flags for the next stage */ 4716e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) { 4717e3f2c991SKeyur Desai req->direction |= _IDMAP_F_LOOKUP_AD; 4718e3f2c991SKeyur Desai state->ad_nqueries++; 4719e3f2c991SKeyur Desai } else if (AD_MODE(req->id1.idtype, state)) { 4720e8c27ec8Sbaban /* 4721e8c27ec8Sbaban * If AD-based name mapping is enabled then the next stage 4722e8c27ec8Sbaban * will need to lookup AD using unixname to get the 4723e8c27ec8Sbaban * corresponding winname. 4724e8c27ec8Sbaban */ 4725e8c27ec8Sbaban if (req->id1name == NULL) { 4726e8c27ec8Sbaban /* Get unixname if only pid is given. */ 4727e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, 4728e8c27ec8Sbaban is_user, &req->id1name); 4729479ac375Sdm if (retcode != IDMAP_SUCCESS) { 4730148c5f43SAlan Wright TRACE(req, res, 4731148c5f43SAlan Wright "Getting UNIX name error=%d", retcode); 4732479ac375Sdm gen_localsid_on_err = TRUE; 4733e8c27ec8Sbaban goto out; 4734479ac375Sdm } 4735148c5f43SAlan Wright TRACE(req, res, "Found UNIX name"); 4736c5c4113dSnw } 4737e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD; 4738e8c27ec8Sbaban state->ad_nqueries++; 4739e8c27ec8Sbaban } else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) { 4740e8c27ec8Sbaban /* 4741e8c27ec8Sbaban * If native LDAP or mixed mode is enabled for name mapping 4742e8c27ec8Sbaban * then the next stage will need to lookup native LDAP using 4743e8c27ec8Sbaban * unixname/pid to get the corresponding winname. 4744e8c27ec8Sbaban */ 4745e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_NLDAP; 4746e8c27ec8Sbaban state->nldap_nqueries++; 4747c5c4113dSnw } 4748c5c4113dSnw 4749e8c27ec8Sbaban /* 4750e8c27ec8Sbaban * Failed to find non-expired entry in cache. Set the flag to 4751e8c27ec8Sbaban * indicate that we are not done yet. 4752e8c27ec8Sbaban */ 4753e8c27ec8Sbaban state->pid2sid_done = FALSE; 4754e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE; 4755e8c27ec8Sbaban retcode = IDMAP_SUCCESS; 4756e8c27ec8Sbaban 4757e8c27ec8Sbaban out: 4758e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode); 4759148c5f43SAlan Wright if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) { 4760148c5f43SAlan Wright if (gen_localsid_on_err == TRUE) { 4761148c5f43SAlan Wright retcode2 = generate_localsid(req, res, is_user, TRUE); 4762148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS) 4763148c5f43SAlan Wright TRACE(req, res, "Generate local SID"); 4764148c5f43SAlan Wright else 4765148c5f43SAlan Wright TRACE(req, res, 4766148c5f43SAlan Wright "Generate local SID error=%d", retcode2); 4767148c5f43SAlan Wright } 4768148c5f43SAlan Wright } 4769e8c27ec8Sbaban return (retcode); 4770e8c27ec8Sbaban } 4771e8c27ec8Sbaban 4772e8c27ec8Sbaban idmap_retcode 4773479ac375Sdm pid2sid_second_pass(lookup_state_t *state, idmap_mapping *req, 4774479ac375Sdm idmap_id_res *res, int is_user) 4775e8c27ec8Sbaban { 4776e8c27ec8Sbaban bool_t gen_localsid_on_err = TRUE; 4777e8c27ec8Sbaban idmap_retcode retcode = IDMAP_SUCCESS; 4778148c5f43SAlan Wright idmap_retcode retcode2; 4779e8c27ec8Sbaban 4780e8c27ec8Sbaban /* Check if second pass is needed */ 4781e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 4782e8c27ec8Sbaban return (res->retcode); 4783e8c27ec8Sbaban 4784e8c27ec8Sbaban /* Get status from previous pass */ 4785e8c27ec8Sbaban retcode = res->retcode; 4786e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4787c5c4113dSnw goto out; 4788c5c4113dSnw 4789c5c4113dSnw /* 4790e8c27ec8Sbaban * If directory-based name mapping is enabled then the winname 4791e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode) 4792479ac375Sdm * or from native LDAP object (nldap-mode or mixed-mode). 4793479ac375Sdm * Note that if we have winname but no SID then it's an error 4794479ac375Sdm * because this implies that the Native LDAP entry contains 4795479ac375Sdm * winname which does not exist and it's better that we return 4796479ac375Sdm * an error instead of doing rule-based mapping so that the user 4797479ac375Sdm * can detect the issue and take appropriate action. 4798c5c4113dSnw */ 4799479ac375Sdm if (req->id2name != NULL) { 4800479ac375Sdm /* Return notfound if we've winname but no SID. */ 4801479ac375Sdm if (res->id.idmap_id_u.sid.prefix == NULL) { 4802148c5f43SAlan Wright TRACE(req, res, "Windows name but no SID"); 4803479ac375Sdm retcode = IDMAP_ERR_NOTFOUND; 4804479ac375Sdm goto out; 4805479ac375Sdm } 4806e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) 4807e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI; 4808e3f2c991SKeyur Desai else if (AD_MODE(req->id1.idtype, state)) 4809e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 4810e8c27ec8Sbaban else if (NLDAP_MODE(req->id1.idtype, state)) 4811e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 4812e8c27ec8Sbaban else if (MIXED_MODE(req->id1.idtype, state)) 4813e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U; 4814e8c27ec8Sbaban goto out; 4815479ac375Sdm } else if (res->id.idmap_id_u.sid.prefix != NULL) { 4816479ac375Sdm /* 4817479ac375Sdm * We've SID but no winname. This is fine because 4818479ac375Sdm * the caller may have only requested SID. 4819479ac375Sdm */ 4820479ac375Sdm goto out; 4821e8c27ec8Sbaban } 4822e8c27ec8Sbaban 4823479ac375Sdm /* Free any mapping info from Directory based mapping */ 4824479ac375Sdm if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 4825148c5f43SAlan Wright idmap_how_clear(&res->info.how); 4826479ac375Sdm 4827e8c27ec8Sbaban if (req->id1name == NULL) { 4828e8c27ec8Sbaban /* Get unixname from name service */ 4829e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user, 4830e8c27ec8Sbaban &req->id1name); 4831148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) { 4832148c5f43SAlan Wright TRACE(req, res, 4833148c5f43SAlan Wright "Getting UNIX name error=%d", retcode); 4834e8c27ec8Sbaban goto out; 4835148c5f43SAlan Wright } 4836148c5f43SAlan Wright TRACE(req, res, "Found UNIX name"); 48379fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } else if (req->id1.idmap_id_u.uid == IDMAP_SENTINEL_PID) { 4838e8c27ec8Sbaban /* Get pid from name service */ 4839e8c27ec8Sbaban retcode = ns_lookup_byname(req->id1name, NULL, &req->id1); 4840e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 4841148c5f43SAlan Wright TRACE(req, res, 4842148c5f43SAlan Wright "Getting UNIX ID error=%d", retcode); 4843e8c27ec8Sbaban gen_localsid_on_err = FALSE; 4844e8c27ec8Sbaban goto out; 4845e8c27ec8Sbaban } 4846148c5f43SAlan Wright TRACE(req, res, "Found UNIX ID"); 4847e8c27ec8Sbaban } 4848e8c27ec8Sbaban 4849e8c27ec8Sbaban /* Use unixname to evaluate local name-based mapping rules */ 4850479ac375Sdm retcode = name_based_mapping_pid2sid(state, req->id1name, is_user, 4851e8c27ec8Sbaban req, res); 4852e8c27ec8Sbaban if (retcode == IDMAP_ERR_NOTFOUND) { 485348258c6bSjp retcode = generate_localsid(req, res, is_user, FALSE); 4854148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) { 4855148c5f43SAlan Wright TRACE(req, res, "Generated local SID"); 4856148c5f43SAlan Wright } else { 4857148c5f43SAlan Wright TRACE(req, res, 4858148c5f43SAlan Wright "Generating local SID error=%d", retcode); 4859148c5f43SAlan Wright } 4860e8c27ec8Sbaban gen_localsid_on_err = FALSE; 4861e8c27ec8Sbaban } 4862c5c4113dSnw 4863c5c4113dSnw out: 4864e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode); 4865e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 4866e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 4867479ac375Sdm free(req->id2name); 4868479ac375Sdm req->id2name = NULL; 4869479ac375Sdm free(req->id2domain); 4870479ac375Sdm req->id2domain = NULL; 4871148c5f43SAlan Wright if (gen_localsid_on_err == TRUE) { 4872148c5f43SAlan Wright retcode2 = generate_localsid(req, res, is_user, TRUE); 4873148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS) 4874148c5f43SAlan Wright TRACE(req, res, "Generate local SID"); 4875148c5f43SAlan Wright else 4876148c5f43SAlan Wright TRACE(req, res, 4877148c5f43SAlan Wright "Generate local SID error=%d", retcode2); 4878148c5f43SAlan Wright } else { 4879479ac375Sdm res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 4880148c5f43SAlan Wright } 4881c5c4113dSnw } 4882e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction)) 4883c5c4113dSnw state->pid2sid_done = FALSE; 4884c5c4113dSnw return (retcode); 4885c5c4113dSnw } 48869fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 48879fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode 48889fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_cache_flush(idmap_flush_op op) 48899fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States { 48909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode rc; 48919fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sqlite *cache = NULL; 48929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States char *sql1; 48939fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States char *sql2; 48949fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 48959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States switch (op) { 48969fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_FLUSH_EXPIRE: 48979fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql1 = 48989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "UPDATE idmap_cache SET expiration=1 WHERE expiration>0;"; 48999fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql2 = 49009fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "UPDATE name_cache SET expiration=1 WHERE expiration>0;"; 49019fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States break; 49029fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49039fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_FLUSH_DELETE: 49049fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql1 = "DELETE FROM idmap_cache;"; 49059fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql2 = "DELETE FROM name_cache;"; 49069fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States break; 49079fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49089fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States default: 49099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_INTERNAL); 49109fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 49119fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49129fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = get_cache_handle(&cache); 49139fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (rc != IDMAP_SUCCESS) 49149fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc); 49159fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49169fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States /* 49179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Note that we flush the idmapd cache first, before the kernel 49189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * cache. If we did it the other way 'round, a request could come 49199fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * in after the kernel cache flush and pull a soon-to-be-flushed 49209fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * idmapd cache entry back into the kernel cache. This way the 49219fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * worst that will happen is that a new entry will be added to 49229fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * the kernel cache and then immediately flushed. 49239fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States */ 49249fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49259fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql1); 49269fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (rc != IDMAP_SUCCESS) 49279fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc); 49289fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49299fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql2); 49309fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 49319fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States (void) __idmap_flush_kcache(); 49329fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc); 49339fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 4934