1148c5f43SAlan Wright /*
2148c5f43SAlan Wright  * CDDL HEADER START
3148c5f43SAlan Wright  *
4148c5f43SAlan Wright  * The contents of this file are subject to the terms of the
5148c5f43SAlan Wright  * Common Development and Distribution License (the "License").
6148c5f43SAlan Wright  * You may not use this file except in compliance with the License.
7148c5f43SAlan Wright  *
8148c5f43SAlan Wright  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9148c5f43SAlan Wright  * or http://www.opensolaris.org/os/licensing.
10148c5f43SAlan Wright  * See the License for the specific language governing permissions
11148c5f43SAlan Wright  * and limitations under the License.
12148c5f43SAlan Wright  *
13148c5f43SAlan Wright  * When distributing Covered Code, include this CDDL HEADER in each
14148c5f43SAlan Wright  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15148c5f43SAlan Wright  * If applicable, add the following below this CDDL HEADER, with the
16148c5f43SAlan Wright  * fields enclosed by brackets "[]" replaced with your own identifying
17148c5f43SAlan Wright  * information: Portions Copyright [yyyy] [name of copyright owner]
18148c5f43SAlan Wright  *
19148c5f43SAlan Wright  * CDDL HEADER END
20148c5f43SAlan Wright  */
21148c5f43SAlan Wright 
22148c5f43SAlan Wright /*
23148c5f43SAlan Wright  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24*dafb549fSGordon Ross  * Copyright 2019 Nexenta Systems, Inc.  All rights reserved.
25148c5f43SAlan Wright  */
26148c5f43SAlan Wright 
27148c5f43SAlan Wright /*
28148c5f43SAlan Wright  * LSA lookups
29148c5f43SAlan Wright  */
30148c5f43SAlan Wright 
31148c5f43SAlan Wright #include <stdio.h>
32148c5f43SAlan Wright #include <note.h>
33148c5f43SAlan Wright #include <assert.h>
34148c5f43SAlan Wright 
35148c5f43SAlan Wright #include "idmapd.h"
36148c5f43SAlan Wright #include "libsmb.h"
37148c5f43SAlan Wright 
38148c5f43SAlan Wright idmap_retcode
idmap_lsa_xlate_sid_type(const lsa_account_t * acct,idmap_id_type * ret_type)39148c5f43SAlan Wright idmap_lsa_xlate_sid_type(const lsa_account_t *acct, idmap_id_type *ret_type)
40148c5f43SAlan Wright {
41148c5f43SAlan Wright 	switch (acct->a_sidtype) {
42148c5f43SAlan Wright 	case SidTypeUser:
43148c5f43SAlan Wright 	case SidTypeComputer:
44148c5f43SAlan Wright 	case SidTypeDomain:
45148c5f43SAlan Wright 	case SidTypeDeletedAccount:
46148c5f43SAlan Wright 	case SidTypeUnknown:
47148c5f43SAlan Wright 	case SidTypeLabel:
48148c5f43SAlan Wright 		*ret_type = IDMAP_USID;
49148c5f43SAlan Wright 		return (IDMAP_SUCCESS);
50148c5f43SAlan Wright 	case SidTypeGroup:
51148c5f43SAlan Wright 	case SidTypeAlias:
52148c5f43SAlan Wright 	case SidTypeWellKnownGroup:
53148c5f43SAlan Wright 		*ret_type = IDMAP_GSID;
54148c5f43SAlan Wright 		return (IDMAP_SUCCESS);
55148c5f43SAlan Wright 	case SidTypeNull:
56148c5f43SAlan Wright 	case SidTypeInvalid:
57148c5f43SAlan Wright 	default:
58148c5f43SAlan Wright 		idmapdlog(LOG_WARNING,
59148c5f43SAlan Wright 		    "LSA lookup:  bad type %d for %s@%s",
60148c5f43SAlan Wright 		    acct->a_sidtype, acct->a_name, acct->a_domain);
61148c5f43SAlan Wright 		return (IDMAP_ERR_OTHER);
62148c5f43SAlan Wright 	}
63148c5f43SAlan Wright 	NOTE(NOTREACHED)
64148c5f43SAlan Wright }
65148c5f43SAlan Wright 
66148c5f43SAlan Wright /* Given SID, look up name and type */
67148c5f43SAlan Wright idmap_retcode
lookup_lsa_by_sid(const char * sidprefix,uint32_t rid,char ** ret_name,char ** ret_domain,idmap_id_type * ret_type)68148c5f43SAlan Wright lookup_lsa_by_sid(
69148c5f43SAlan Wright     const char *sidprefix,
70148c5f43SAlan Wright     uint32_t rid,
71148c5f43SAlan Wright     char **ret_name,
72148c5f43SAlan Wright     char **ret_domain,
73148c5f43SAlan Wright     idmap_id_type *ret_type)
74148c5f43SAlan Wright {
75148c5f43SAlan Wright 	lsa_account_t acct;
76148c5f43SAlan Wright 	char sid[SMB_SID_STRSZ + 1];
77148c5f43SAlan Wright 	idmap_retcode ret;
78148c5f43SAlan Wright 	int rc;
79148c5f43SAlan Wright 
80148c5f43SAlan Wright 	(void) memset(&acct, 0, sizeof (acct));
81148c5f43SAlan Wright 	*ret_name = NULL;
82148c5f43SAlan Wright 	*ret_domain = NULL;
83148c5f43SAlan Wright 
84148c5f43SAlan Wright 	(void) snprintf(sid, sizeof (sid), "%s-%u", sidprefix, rid);
85148c5f43SAlan Wright 
86*dafb549fSGordon Ross 	rc = smb_lookup_lsid(sid, &acct);
87148c5f43SAlan Wright 	if (rc != 0) {
88*dafb549fSGordon Ross 		idmapdlog(LOG_ERR, "Error: SMB lookup SID failed.");
89148c5f43SAlan Wright 		idmapdlog(LOG_ERR,
90148c5f43SAlan Wright 		    "Check SMB service (svc:/network/smb/server).");
91148c5f43SAlan Wright 		idmapdlog(LOG_ERR,
92148c5f43SAlan Wright 		    "Check connectivity to Active Directory.");
93148c5f43SAlan Wright 
94148c5f43SAlan Wright 		ret = IDMAP_ERR_OTHER;
95148c5f43SAlan Wright 		goto out;
96148c5f43SAlan Wright 	}
97148c5f43SAlan Wright 	if (acct.a_status == NT_STATUS_NONE_MAPPED) {
98148c5f43SAlan Wright 		ret = IDMAP_ERR_NOTFOUND;
99148c5f43SAlan Wright 		goto out;
100148c5f43SAlan Wright 	}
101148c5f43SAlan Wright 	if (acct.a_status != NT_STATUS_SUCCESS) {
102148c5f43SAlan Wright 		idmapdlog(LOG_WARNING,
103*dafb549fSGordon Ross 		    "Warning:  SMB lookup SID(%s) failed (0x%x)",
104148c5f43SAlan Wright 		    sid, acct.a_status);
105148c5f43SAlan Wright 		/* Fail soft */
106148c5f43SAlan Wright 		ret = IDMAP_ERR_NOTFOUND;
107148c5f43SAlan Wright 		goto out;
108148c5f43SAlan Wright 	}
109148c5f43SAlan Wright 
110148c5f43SAlan Wright 	ret = idmap_lsa_xlate_sid_type(&acct, ret_type);
111148c5f43SAlan Wright 	if (ret != IDMAP_SUCCESS)
112148c5f43SAlan Wright 		goto out;
113148c5f43SAlan Wright 
114148c5f43SAlan Wright 	*ret_name = strdup(acct.a_name);
115148c5f43SAlan Wright 	if (*ret_name == NULL) {
116148c5f43SAlan Wright 		ret = IDMAP_ERR_MEMORY;
117148c5f43SAlan Wright 		goto out;
118148c5f43SAlan Wright 	}
119148c5f43SAlan Wright 
120148c5f43SAlan Wright 	*ret_domain = strdup(acct.a_domain);
121148c5f43SAlan Wright 	if (*ret_domain == NULL) {
122148c5f43SAlan Wright 		ret = IDMAP_ERR_MEMORY;
123148c5f43SAlan Wright 		goto out;
124148c5f43SAlan Wright 	}
125148c5f43SAlan Wright 
126148c5f43SAlan Wright 	ret = IDMAP_SUCCESS;
127148c5f43SAlan Wright 
128148c5f43SAlan Wright out:
129148c5f43SAlan Wright 	if (ret != IDMAP_SUCCESS) {
130148c5f43SAlan Wright 		free(*ret_name);
131148c5f43SAlan Wright 		*ret_name = NULL;
132148c5f43SAlan Wright 		free(*ret_domain);
133148c5f43SAlan Wright 		*ret_domain = NULL;
134148c5f43SAlan Wright 	}
135148c5f43SAlan Wright 	return (ret);
136148c5f43SAlan Wright }
137148c5f43SAlan Wright 
138148c5f43SAlan Wright /* Given name and optional domain, look up SID, type, and canonical name */
139148c5f43SAlan Wright idmap_retcode
lookup_lsa_by_name(const char * name,const char * domain,char ** ret_sidprefix,uint32_t * ret_rid,char ** ret_name,char ** ret_domain,idmap_id_type * ret_type)140148c5f43SAlan Wright lookup_lsa_by_name(
141148c5f43SAlan Wright     const char *name,
142