1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 22*1fcced4cSJordan Brown * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23c5c4113dSnw * Use is subject to license terms. 24c5c4113dSnw */ 25c5c4113dSnw 26c5c4113dSnw 27c5c4113dSnw /* 28c5c4113dSnw * Service routines 29c5c4113dSnw */ 30c5c4113dSnw 31c5c4113dSnw #include "idmapd.h" 32c5c4113dSnw #include "idmap_priv.h" 33e8c27ec8Sbaban #include "nldaputils.h" 34c5c4113dSnw #include <signal.h> 35c5c4113dSnw #include <thread.h> 36c5c4113dSnw #include <string.h> 37c5c4113dSnw #include <strings.h> 38c5c4113dSnw #include <errno.h> 39c5c4113dSnw #include <assert.h> 40c5c4113dSnw #include <sys/types.h> 41c5c4113dSnw #include <sys/stat.h> 42c5c4113dSnw #include <ucred.h> 43c5c4113dSnw #include <pwd.h> 44c5c4113dSnw #include <auth_attr.h> 45c5c4113dSnw #include <secdb.h> 460dcc7149Snw #include <sys/u8_textprep.h> 47*1fcced4cSJordan Brown #include <note.h> 48c5c4113dSnw 49c5c4113dSnw #define _VALIDATE_LIST_CB_DATA(col, val, siz)\ 50c5c4113dSnw retcode = validate_list_cb_data(cb_data, argc, argv, col,\ 51c5c4113dSnw (uchar_t **)val, siz);\ 52c5c4113dSnw if (retcode == IDMAP_NEXT) {\ 53c5c4113dSnw result->retcode = IDMAP_NEXT;\ 54c5c4113dSnw return (0);\ 55c5c4113dSnw } else if (retcode < 0) {\ 56c5c4113dSnw result->retcode = retcode;\ 57c5c4113dSnw return (1);\ 58c5c4113dSnw } 59c5c4113dSnw 6048258c6bSjp #define PROCESS_LIST_SVC_SQL(rcode, db, dbname, sql, limit, flag, cb, res, len)\ 6148258c6bSjp rcode = process_list_svc_sql(db, dbname, sql, limit, flag, cb, res);\ 62c5c4113dSnw if (rcode == IDMAP_ERR_BUSY)\ 63c5c4113dSnw res->retcode = IDMAP_ERR_BUSY;\ 64c5c4113dSnw else if (rcode == IDMAP_SUCCESS && len == 0)\ 65c5c4113dSnw res->retcode = IDMAP_ERR_NOTFOUND; 66c5c4113dSnw 67c5c4113dSnw 688e228215Sdm #define STRDUP_OR_FAIL(to, from) \ 698e228215Sdm if ((from) == NULL) \ 708e228215Sdm to = NULL; \ 718e228215Sdm else { \ 728e228215Sdm if ((to = strdup(from)) == NULL) \ 738e228215Sdm return (1); \ 748e228215Sdm } 758e228215Sdm 76479ac375Sdm #define STRDUP_CHECK(to, from) \ 77479ac375Sdm if ((from) != NULL) { \ 78479ac375Sdm to = strdup(from); \ 79479ac375Sdm if (to == NULL) { \ 80479ac375Sdm result->retcode = IDMAP_ERR_MEMORY; \ 81479ac375Sdm goto out; \ 82479ac375Sdm } \ 83479ac375Sdm } 84479ac375Sdm 85c5c4113dSnw /* ARGSUSED */ 86c5c4113dSnw bool_t 87cd37da74Snw idmap_null_1_svc(void *result, struct svc_req *rqstp) 88cd37da74Snw { 89c5c4113dSnw return (TRUE); 90c5c4113dSnw } 91c5c4113dSnw 92334e3463Sbaban /* 93334e3463Sbaban * RPC layer allocates empty strings to replace NULL char *. 94334e3463Sbaban * This utility function frees these empty strings. 95334e3463Sbaban */ 96e8c27ec8Sbaban static 97e8c27ec8Sbaban void 98334e3463Sbaban sanitize_mapping_request(idmap_mapping *req) 99334e3463Sbaban { 100334e3463Sbaban free(req->id1name); 101334e3463Sbaban req->id1name = NULL; 102334e3463Sbaban free(req->id1domain); 103334e3463Sbaban req->id1domain = NULL; 104334e3463Sbaban free(req->id2name); 105334e3463Sbaban req->id2name = NULL; 106334e3463Sbaban free(req->id2domain); 107334e3463Sbaban req->id2domain = NULL; 108e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 109334e3463Sbaban } 110334e3463Sbaban 1110dcc7149Snw static 1120dcc7149Snw int 1130dcc7149Snw validate_mapped_id_by_name_req(idmap_mapping *req) 1140dcc7149Snw { 1150dcc7149Snw int e; 1160dcc7149Snw 1170dcc7149Snw if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) 1180dcc7149Snw return (IDMAP_SUCCESS); 1190dcc7149Snw 1200dcc7149Snw if (IS_REQUEST_SID(*req, 1)) { 1210dcc7149Snw if (!EMPTY_STRING(req->id1name) && 1220dcc7149Snw u8_validate(req->id1name, strlen(req->id1name), 1230dcc7149Snw NULL, U8_VALIDATE_ENTIRE, &e) < 0) 1240dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1250dcc7149Snw if (!EMPTY_STRING(req->id1domain) && 1260dcc7149Snw u8_validate(req->id1domain, strlen(req->id1domain), 1270dcc7149Snw NULL, U8_VALIDATE_ENTIRE, &e) < 0) 1280dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1290dcc7149Snw } 1300dcc7149Snw 1310dcc7149Snw return (IDMAP_SUCCESS); 1320dcc7149Snw } 1330dcc7149Snw 1340dcc7149Snw static 1350dcc7149Snw int 1360dcc7149Snw validate_rule(idmap_namerule *rule) 1370dcc7149Snw { 1380dcc7149Snw int e; 1390dcc7149Snw 1400dcc7149Snw if (!EMPTY_STRING(rule->winname) && 1410dcc7149Snw u8_validate(rule->winname, strlen(rule->winname), 1420dcc7149Snw NULL, U8_VALIDATE_ENTIRE, &e) < 0) 1430dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1440dcc7149Snw 1450dcc7149Snw if (!EMPTY_STRING(rule->windomain) && 1460dcc7149Snw u8_validate(rule->windomain, strlen(rule->windomain), 1470dcc7149Snw NULL, U8_VALIDATE_ENTIRE, &e) < 0) 1480dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1490dcc7149Snw 1500dcc7149Snw return (IDMAP_SUCCESS); 1510dcc7149Snw 1520dcc7149Snw } 1530dcc7149Snw 1540dcc7149Snw static 1550dcc7149Snw bool_t 1560dcc7149Snw validate_rules(idmap_update_batch *batch) 1570dcc7149Snw { 1580dcc7149Snw idmap_update_op *up; 1590dcc7149Snw int i; 1600dcc7149Snw 1610dcc7149Snw for (i = 0; i < batch->idmap_update_batch_len; i++) { 1620dcc7149Snw up = &(batch->idmap_update_batch_val[i]); 1630dcc7149Snw if (validate_rule(&(up->idmap_update_op_u.rule)) 1640dcc7149Snw != IDMAP_SUCCESS) 1650dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1660dcc7149Snw } 1670dcc7149Snw 1680dcc7149Snw return (IDMAP_SUCCESS); 1690dcc7149Snw } 1700dcc7149Snw 171c5c4113dSnw /* ARGSUSED */ 172c5c4113dSnw bool_t 173c5c4113dSnw idmap_get_mapped_ids_1_svc(idmap_mapping_batch batch, 174cd37da74Snw idmap_ids_res *result, struct svc_req *rqstp) 175cd37da74Snw { 176c5c4113dSnw sqlite *cache = NULL, *db = NULL; 177c5c4113dSnw lookup_state_t state; 178e8c27ec8Sbaban idmap_retcode retcode; 17962c60062Sbaban uint_t i; 180c5c4113dSnw 181c5c4113dSnw /* Init */ 182c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 183c5c4113dSnw (void) memset(&state, 0, sizeof (state)); 184c5c4113dSnw 185c5c4113dSnw /* Return success if nothing was requested */ 186c5c4113dSnw if (batch.idmap_mapping_batch_len < 1) 187c5c4113dSnw goto out; 188c5c4113dSnw 189c5c4113dSnw /* Get cache handle */ 190c5c4113dSnw result->retcode = get_cache_handle(&cache); 191c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 192c5c4113dSnw goto out; 193479ac375Sdm state.cache = cache; 194c5c4113dSnw 195c5c4113dSnw /* Get db handle */ 196c5c4113dSnw result->retcode = get_db_handle(&db); 197c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 198c5c4113dSnw goto out; 199479ac375Sdm state.db = db; 200c5c4113dSnw 201c5c4113dSnw /* Allocate result array */ 202c5c4113dSnw result->ids.ids_val = calloc(batch.idmap_mapping_batch_len, 203cd37da74Snw sizeof (idmap_id_res)); 204c5c4113dSnw if (result->ids.ids_val == NULL) { 205c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 206c5c4113dSnw result->retcode = IDMAP_ERR_MEMORY; 207c5c4113dSnw goto out; 208c5c4113dSnw } 209c5c4113dSnw result->ids.ids_len = batch.idmap_mapping_batch_len; 210c5c4113dSnw 21162c60062Sbaban /* Allocate hash table to check for duplicate sids */ 21262c60062Sbaban state.sid_history = calloc(batch.idmap_mapping_batch_len, 213cd37da74Snw sizeof (*state.sid_history)); 21462c60062Sbaban if (state.sid_history == NULL) { 21562c60062Sbaban idmapdlog(LOG_ERR, "Out of memory"); 21662c60062Sbaban result->retcode = IDMAP_ERR_MEMORY; 21762c60062Sbaban goto out; 21862c60062Sbaban } 21962c60062Sbaban state.sid_history_size = batch.idmap_mapping_batch_len; 22062c60062Sbaban for (i = 0; i < state.sid_history_size; i++) { 22162c60062Sbaban state.sid_history[i].key = state.sid_history_size; 22262c60062Sbaban state.sid_history[i].next = state.sid_history_size; 22362c60062Sbaban } 22462c60062Sbaban state.batch = &batch; 22562c60062Sbaban state.result = result; 22662c60062Sbaban 227e8c27ec8Sbaban /* Get directory-based name mapping info */ 228479ac375Sdm result->retcode = load_cfg_in_state(&state); 229e8c27ec8Sbaban if (result->retcode != IDMAP_SUCCESS) 230e8c27ec8Sbaban goto out; 231e8c27ec8Sbaban 232c5c4113dSnw /* Init our 'done' flags */ 233c5c4113dSnw state.sid2pid_done = state.pid2sid_done = TRUE; 234c5c4113dSnw 235c5c4113dSnw /* First stage */ 236c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 23762c60062Sbaban state.curpos = i; 238334e3463Sbaban (void) sanitize_mapping_request( 239334e3463Sbaban &batch.idmap_mapping_batch_val[i]); 240c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 241c5c4113dSnw retcode = sid2pid_first_pass( 242cd37da74Snw &state, 243cd37da74Snw &batch.idmap_mapping_batch_val[i], 244cd37da74Snw &result->ids.ids_val[i]); 245c5c4113dSnw } else if (IS_BATCH_UID(batch, i)) { 246c5c4113dSnw retcode = pid2sid_first_pass( 247cd37da74Snw &state, 248cd37da74Snw &batch.idmap_mapping_batch_val[i], 249cd37da74Snw &result->ids.ids_val[i], 1, 0); 250c5c4113dSnw } else if (IS_BATCH_GID(batch, i)) { 251c5c4113dSnw retcode = pid2sid_first_pass( 252cd37da74Snw &state, 253cd37da74Snw &batch.idmap_mapping_batch_val[i], 254cd37da74Snw &result->ids.ids_val[i], 0, 0); 255c5c4113dSnw } else { 256c5c4113dSnw result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE; 257c5c4113dSnw continue; 258c5c4113dSnw } 259c5c4113dSnw if (IDMAP_FATAL_ERROR(retcode)) { 260c5c4113dSnw result->retcode = retcode; 261c5c4113dSnw goto out; 262c5c4113dSnw } 263c5c4113dSnw } 264c5c4113dSnw 265c5c4113dSnw /* Check if we are done */ 266c5c4113dSnw if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 267c5c4113dSnw goto out; 268c5c4113dSnw 269e8c27ec8Sbaban /* 270e8c27ec8Sbaban * native LDAP lookups: 271479ac375Sdm * pid2sid: 272479ac375Sdm * - nldap or mixed mode. Lookup nldap by pid or unixname to get 273479ac375Sdm * winname. 274479ac375Sdm * sid2pid: 275479ac375Sdm * - nldap mode. Got winname and sid (either given or found in 276479ac375Sdm * name_cache). Lookup nldap by winname to get pid and 277479ac375Sdm * unixname. 278e8c27ec8Sbaban */ 279e8c27ec8Sbaban if (state.nldap_nqueries) { 280e8c27ec8Sbaban retcode = nldap_lookup_batch(&state, &batch, result); 281e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 282e8c27ec8Sbaban result->retcode = retcode; 283e8c27ec8Sbaban goto out; 284e8c27ec8Sbaban } 285e8c27ec8Sbaban } 286e8c27ec8Sbaban 287e8c27ec8Sbaban /* 288e8c27ec8Sbaban * AD lookups: 289479ac375Sdm * pid2sid: 290479ac375Sdm * - nldap or mixed mode. Got winname from nldap lookup. 291479ac375Sdm * winname2sid could not be resolved locally. Lookup AD 292479ac375Sdm * by winname to get sid. 293479ac375Sdm * - ad mode. Got unixname. Lookup AD by unixname to get 294479ac375Sdm * winname and sid. 295479ac375Sdm * sid2pid: 296479ac375Sdm * - ad or mixed mode. Lookup AD by sid or winname to get 297479ac375Sdm * winname, sid and unixname. 298479ac375Sdm * - any mode. Got either sid or winname but not both. Lookup 299479ac375Sdm * AD by sid or winname to get winname, sid. 300e8c27ec8Sbaban */ 301c5c4113dSnw if (state.ad_nqueries) { 302e8c27ec8Sbaban retcode = ad_lookup_batch(&state, &batch, result); 303e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 304e8c27ec8Sbaban result->retcode = retcode; 305e8c27ec8Sbaban goto out; 306e8c27ec8Sbaban } 307e8c27ec8Sbaban } 308e8c27ec8Sbaban 309e8c27ec8Sbaban /* 310e8c27ec8Sbaban * native LDAP lookups: 311479ac375Sdm * sid2pid: 312479ac375Sdm * - nldap mode. Got winname and sid from AD lookup. Lookup nldap 313479ac375Sdm * by winname to get pid and unixname. 314e8c27ec8Sbaban */ 315e8c27ec8Sbaban if (state.nldap_nqueries) { 316e8c27ec8Sbaban retcode = nldap_lookup_batch(&state, &batch, result); 317e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 318e8c27ec8Sbaban result->retcode = retcode; 319c5c4113dSnw goto out; 320c5c4113dSnw } 321e8c27ec8Sbaban } 322c5c4113dSnw 323e8c27ec8Sbaban /* Reset 'done' flags */ 324e8c27ec8Sbaban state.sid2pid_done = state.pid2sid_done = TRUE; 325c5c4113dSnw 326c5c4113dSnw /* Second stage */ 327c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 32862c60062Sbaban state.curpos = i; 329c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 330c5c4113dSnw retcode = sid2pid_second_pass( 331cd37da74Snw &state, 332cd37da74Snw &batch.idmap_mapping_batch_val[i], 333cd37da74Snw &result->ids.ids_val[i]); 334e8c27ec8Sbaban } else if (IS_BATCH_UID(batch, i)) { 335e8c27ec8Sbaban retcode = pid2sid_second_pass( 336e8c27ec8Sbaban &state, 337e8c27ec8Sbaban &batch.idmap_mapping_batch_val[i], 338e8c27ec8Sbaban &result->ids.ids_val[i], 1); 339e8c27ec8Sbaban } else if (IS_BATCH_GID(batch, i)) { 340e8c27ec8Sbaban retcode = pid2sid_second_pass( 341e8c27ec8Sbaban &state, 342e8c27ec8Sbaban &batch.idmap_mapping_batch_val[i], 343e8c27ec8Sbaban &result->ids.ids_val[i], 0); 344e8c27ec8Sbaban } else { 345e8c27ec8Sbaban /* First stage has already set the error */ 346e8c27ec8Sbaban continue; 347e8c27ec8Sbaban } 348e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 349e8c27ec8Sbaban result->retcode = retcode; 350e8c27ec8Sbaban goto out; 351c5c4113dSnw } 352c5c4113dSnw } 353c5c4113dSnw 354c5c4113dSnw /* Check if we are done */ 355c5c4113dSnw if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 356c5c4113dSnw goto out; 357c5c4113dSnw 358c5c4113dSnw /* Reset our 'done' flags */ 359c5c4113dSnw state.sid2pid_done = state.pid2sid_done = TRUE; 360c5c4113dSnw 361c5c4113dSnw /* Update cache in a single transaction */ 36271590c90Snw if (sql_exec_no_cb(cache, IDMAP_CACHENAME, "BEGIN TRANSACTION;") 36371590c90Snw != IDMAP_SUCCESS) 364c5c4113dSnw goto out; 365c5c4113dSnw 366c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 36762c60062Sbaban state.curpos = i; 368c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 369c5c4113dSnw (void) update_cache_sid2pid( 370cd37da74Snw &state, 371cd37da74Snw &batch.idmap_mapping_batch_val[i], 372cd37da74Snw &result->ids.ids_val[i]); 373c5c4113dSnw } else if ((IS_BATCH_UID(batch, i)) || 374cd37da74Snw (IS_BATCH_GID(batch, i))) { 375c5c4113dSnw (void) update_cache_pid2sid( 376cd37da74Snw &state, 377cd37da74Snw &batch.idmap_mapping_batch_val[i], 378cd37da74Snw &result->ids.ids_val[i]); 379c5c4113dSnw } 380c5c4113dSnw } 381c5c4113dSnw 382da6c28aaSamw /* Commit if we have at least one successful update */ 383c5c4113dSnw if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE) 38471590c90Snw (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 38571590c90Snw "COMMIT TRANSACTION;"); 386c5c4113dSnw else 38771590c90Snw (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 38871590c90Snw "END TRANSACTION;"); 389c5c4113dSnw 390c5c4113dSnw out: 391e8c27ec8Sbaban cleanup_lookup_state(&state); 392c5c4113dSnw if (IDMAP_ERROR(result->retcode)) { 393c5c4113dSnw xdr_free(xdr_idmap_ids_res, (caddr_t)result); 394c5c4113dSnw result->ids.ids_len = 0; 395c5c4113dSnw result->ids.ids_val = NULL; 396c5c4113dSnw } 397c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 398c5c4113dSnw return (TRUE); 399c5c4113dSnw } 400c5c4113dSnw 401c5c4113dSnw 402c5c4113dSnw /* ARGSUSED */ 403cd37da74Snw static 404cd37da74Snw int 405cd37da74Snw list_mappings_cb(void *parg, int argc, char **argv, char **colnames) 406cd37da74Snw { 407c5c4113dSnw list_cb_data_t *cb_data; 408c5c4113dSnw char *str; 409c5c4113dSnw idmap_mappings_res *result; 410c5c4113dSnw idmap_retcode retcode; 411c5c4113dSnw int w2u, u2w; 412c5c4113dSnw char *end; 413cd37da74Snw static int validated_column_names = 0; 41448258c6bSjp idmap_how *how; 41548258c6bSjp 41648258c6bSjp cb_data = (list_cb_data_t *)parg; 417cd37da74Snw 418cd37da74Snw if (!validated_column_names) { 419cd37da74Snw assert(strcmp(colnames[0], "rowid") == 0); 420cd37da74Snw assert(strcmp(colnames[1], "sidprefix") == 0); 421cd37da74Snw assert(strcmp(colnames[2], "rid") == 0); 422cd37da74Snw assert(strcmp(colnames[3], "pid") == 0); 423cd37da74Snw assert(strcmp(colnames[4], "w2u") == 0); 424cd37da74Snw assert(strcmp(colnames[5], "u2w") == 0); 425cd37da74Snw assert(strcmp(colnames[6], "windomain") == 0); 426cd37da74Snw assert(strcmp(colnames[7], "canon_winname") == 0); 427cd37da74Snw assert(strcmp(colnames[8], "unixname") == 0); 428cd37da74Snw assert(strcmp(colnames[9], "is_user") == 0); 429cd37da74Snw assert(strcmp(colnames[10], "is_wuser") == 0); 43048258c6bSjp assert(strcmp(colnames[11], "map_type") == 0); 43148258c6bSjp assert(strcmp(colnames[12], "map_dn") == 0); 43248258c6bSjp assert(strcmp(colnames[13], "map_attr") == 0); 43348258c6bSjp assert(strcmp(colnames[14], "map_value") == 0); 43448258c6bSjp assert(strcmp(colnames[15], "map_windomain") == 0); 43548258c6bSjp assert(strcmp(colnames[16], "map_winname") == 0); 43648258c6bSjp assert(strcmp(colnames[17], "map_unixname") == 0); 43748258c6bSjp assert(strcmp(colnames[18], "map_is_nt4") == 0); 438cd37da74Snw validated_column_names = 1; 439cd37da74Snw } 440cd37da74Snw 441c5c4113dSnw result = (idmap_mappings_res *)cb_data->result; 442c5c4113dSnw 44348258c6bSjp _VALIDATE_LIST_CB_DATA(19, &result->mappings.mappings_val, 444cd37da74Snw sizeof (idmap_mapping)); 445c5c4113dSnw 446c5c4113dSnw result->mappings.mappings_len++; 447c5c4113dSnw 448c5c4113dSnw if ((str = strdup(argv[1])) == NULL) 449c5c4113dSnw return (1); 450c5c4113dSnw result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix = 451cd37da74Snw str; 452c5c4113dSnw result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid = 453cd37da74Snw strtoul(argv[2], &end, 10); 454cd37da74Snw result->mappings.mappings_val[cb_data->next].id1.idtype = 455cd37da74Snw strtol(argv[10], &end, 10) ? IDMAP_USID : IDMAP_GSID; 456c5c4113dSnw 457c5c4113dSnw result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid = 458cd37da74Snw strtoul(argv[3], &end, 10); 459cd37da74Snw result->mappings.mappings_val[cb_data->next].id2.idtype = 460cd37da74Snw strtol(argv[9], &end, 10) ? IDMAP_UID : IDMAP_GID; 461c5c4113dSnw 462cd37da74Snw w2u = argv[4] ? strtol(argv[4], &end, 10) : 0; 463cd37da74Snw u2w = argv[5] ? strtol(argv[5], &end, 10) : 0; 464c5c4113dSnw 465c5c4113dSnw if (w2u > 0 && u2w == 0) 466651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 467651c0131Sbaban IDMAP_DIRECTION_W2U; 468c5c4113dSnw else if (w2u == 0 && u2w > 0) 469651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 470651c0131Sbaban IDMAP_DIRECTION_U2W; 471c5c4113dSnw else 472651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 473651c0131Sbaban IDMAP_DIRECTION_BI; 474c5c4113dSnw 4758e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1domain, 4768e228215Sdm argv[6]); 477c5c4113dSnw 4788e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1name, 4798e228215Sdm argv[7]); 4808e228215Sdm 4818e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id2name, 4828e228215Sdm argv[8]); 483c5c4113dSnw 48448258c6bSjp if (cb_data->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 48548258c6bSjp how = &result->mappings.mappings_val[cb_data->next].info.how; 48648258c6bSjp how->map_type = strtoul(argv[11], &end, 10); 48748258c6bSjp switch (how->map_type) { 48848258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 48948258c6bSjp how->idmap_how_u.ad.dn = 49048258c6bSjp strdup(argv[12]); 49148258c6bSjp how->idmap_how_u.ad.attr = 49248258c6bSjp strdup(argv[13]); 49348258c6bSjp how->idmap_how_u.ad.value = 49448258c6bSjp strdup(argv[14]); 49548258c6bSjp break; 49648258c6bSjp 49748258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 49848258c6bSjp how->idmap_how_u.nldap.dn = 49948258c6bSjp strdup(argv[12]); 50048258c6bSjp how->idmap_how_u.nldap.attr = 50148258c6bSjp strdup(argv[13]); 50248258c6bSjp how->idmap_how_u.nldap.value = 50348258c6bSjp strdup(argv[14]); 50448258c6bSjp break; 50548258c6bSjp 50648258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 50748258c6bSjp how->idmap_how_u.rule.windomain = 50848258c6bSjp strdup(argv[15]); 50948258c6bSjp how->idmap_how_u.rule.winname = 51048258c6bSjp strdup(argv[16]); 51148258c6bSjp how->idmap_how_u.rule.unixname = 51248258c6bSjp strdup(argv[17]); 51348258c6bSjp how->idmap_how_u.rule.is_nt4 = 51448258c6bSjp strtoul(argv[18], &end, 10); 51548258c6bSjp how->idmap_how_u.rule.is_user = 51648258c6bSjp strtol(argv[9], &end, 10); 51748258c6bSjp how->idmap_how_u.rule.is_wuser = 51848258c6bSjp strtol(argv[10], &end, 10); 51948258c6bSjp break; 52048258c6bSjp 52148258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 52248258c6bSjp break; 52348258c6bSjp 52448258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 52548258c6bSjp break; 52648258c6bSjp 52748258c6bSjp default: 52848258c6bSjp /* Unknow mapping type */ 52948258c6bSjp assert(FALSE); 53048258c6bSjp } 53148258c6bSjp 53248258c6bSjp } 533c5c4113dSnw 534c5c4113dSnw result->lastrowid = strtoll(argv[0], &end, 10); 535c5c4113dSnw cb_data->next++; 536c5c4113dSnw result->retcode = IDMAP_SUCCESS; 537c5c4113dSnw return (0); 538c5c4113dSnw } 539c5c4113dSnw 540c5c4113dSnw 541c5c4113dSnw /* ARGSUSED */ 542c5c4113dSnw bool_t 54348258c6bSjp idmap_list_mappings_1_svc(int64_t lastrowid, uint64_t limit, int32_t flag, 544cd37da74Snw idmap_mappings_res *result, struct svc_req *rqstp) 545cd37da74Snw { 546c5c4113dSnw sqlite *cache = NULL; 547c5c4113dSnw char lbuf[30], rbuf[30]; 548c5c4113dSnw uint64_t maxlimit; 549c5c4113dSnw idmap_retcode retcode; 550c5c4113dSnw char *sql = NULL; 55148258c6bSjp time_t curtime; 552c5c4113dSnw 553c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 554c5c4113dSnw lbuf[0] = rbuf[0] = 0; 555c5c4113dSnw 55648258c6bSjp /* Current time */ 55748258c6bSjp errno = 0; 55848258c6bSjp if ((curtime = time(NULL)) == (time_t)-1) { 55948258c6bSjp idmapdlog(LOG_ERR, "Failed to get current time (%s)", 56048258c6bSjp strerror(errno)); 56148258c6bSjp retcode = IDMAP_ERR_INTERNAL; 56248258c6bSjp goto out; 56348258c6bSjp } 56448258c6bSjp 565c5c4113dSnw RDLOCK_CONFIG(); 566c5c4113dSnw maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 567c5c4113dSnw UNLOCK_CONFIG(); 568c5c4113dSnw 569c5c4113dSnw /* Get cache handle */ 570c5c4113dSnw result->retcode = get_cache_handle(&cache); 571c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 572c5c4113dSnw goto out; 573c5c4113dSnw 574c5c4113dSnw result->retcode = IDMAP_ERR_INTERNAL; 575c5c4113dSnw 576c5c4113dSnw /* Create LIMIT expression. */ 577c5c4113dSnw if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 578c5c4113dSnw limit = maxlimit; 579c5c4113dSnw if (limit > 0) 580c5c4113dSnw (void) snprintf(lbuf, sizeof (lbuf), 581cd37da74Snw "LIMIT %" PRIu64, limit + 1ULL); 582c5c4113dSnw 583c5c4113dSnw (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 584c5c4113dSnw 585c5c4113dSnw /* 586c5c4113dSnw * Combine all the above into a giant SELECT statement that 587c5c4113dSnw * will return the requested mappings 588c5c4113dSnw */ 58948258c6bSjp 59048258c6bSjp sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, " 59148258c6bSjp "u2w, windomain, canon_winname, unixname, is_user, is_wuser, " 59248258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 59348258c6bSjp "map_winname, map_unixname, map_is_nt4 " 59448258c6bSjp "FROM idmap_cache WHERE %s AND " 59548258c6bSjp "(pid >= 2147483648 OR (expiration = 0 OR " 59648258c6bSjp "expiration ISNULL OR expiration > %d)) " 59748258c6bSjp "%s;", 59848258c6bSjp rbuf, curtime, lbuf); 599c5c4113dSnw if (sql == NULL) { 600479ac375Sdm result->retcode = IDMAP_ERR_MEMORY; 601c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 602c5c4113dSnw goto out; 603c5c4113dSnw } 604c5c4113dSnw 605c5c4113dSnw /* Execute the SQL statement and update the return buffer */ 60671590c90Snw PROCESS_LIST_SVC_SQL(retcode, cache, IDMAP_CACHENAME, sql, limit, 60748258c6bSjp flag, list_mappings_cb, result, result->mappings.mappings_len); 608c5c4113dSnw 609c5c4113dSnw out: 610c5c4113dSnw if (sql) 611c5c4113dSnw sqlite_freemem(sql); 612c5c4113dSnw if (IDMAP_ERROR(result->retcode)) 613c5c4113dSnw (void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 614c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 615c5c4113dSnw return (TRUE); 616c5c4113dSnw } 617c5c4113dSnw 618c5c4113dSnw 619c5c4113dSnw /* ARGSUSED */ 620cd37da74Snw static 621cd37da74Snw int 622cd37da74Snw list_namerules_cb(void *parg, int argc, char **argv, char **colnames) 623cd37da74Snw { 624c5c4113dSnw list_cb_data_t *cb_data; 625c5c4113dSnw idmap_namerules_res *result; 626c5c4113dSnw idmap_retcode retcode; 627c5c4113dSnw int w2u_order, u2w_order; 628c5c4113dSnw char *end; 629cd37da74Snw static int validated_column_names = 0; 630cd37da74Snw 631cd37da74Snw if (!validated_column_names) { 632cd37da74Snw assert(strcmp(colnames[0], "rowid") == 0); 633cd37da74Snw assert(strcmp(colnames[1], "is_user") == 0); 634cd37da74Snw assert(strcmp(colnames[2], "is_wuser") == 0); 635cd37da74Snw assert(strcmp(colnames[3], "windomain") == 0); 636cd37da74Snw assert(strcmp(colnames[4], "winname_display") == 0); 637cd37da74Snw assert(strcmp(colnames[5], "is_nt4") == 0); 638cd37da74Snw assert(strcmp(colnames[6], "unixname") == 0); 639cd37da74Snw assert(strcmp(colnames[7], "w2u_order") == 0); 640cd37da74Snw assert(strcmp(colnames[8], "u2w_order") == 0); 641cd37da74Snw validated_column_names = 1; 642cd37da74Snw } 643c5c4113dSnw 644c5c4113dSnw cb_data = (list_cb_data_t *)parg; 645c5c4113dSnw result = (idmap_namerules_res *)cb_data->result; 646c5c4113dSnw 647cd37da74Snw _VALIDATE_LIST_CB_DATA(9, &result->rules.rules_val, 648cd37da74Snw sizeof (idmap_namerule)); 649c5c4113dSnw 650c5c4113dSnw result->rules.rules_len++; 651c5c4113dSnw 652c5c4113dSnw result->rules.rules_val[cb_data->next].is_user = 653cd37da74Snw strtol(argv[1], &end, 10); 654cd37da74Snw 655cd37da74Snw result->rules.rules_val[cb_data->next].is_wuser = 656cd37da74Snw strtol(argv[2], &end, 10); 657c5c4113dSnw 6588e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].windomain, 659cd37da74Snw argv[3]); 660c5c4113dSnw 6618e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].winname, 662cd37da74Snw argv[4]); 663c5c4113dSnw 664c5c4113dSnw result->rules.rules_val[cb_data->next].is_nt4 = 665cd37da74Snw strtol(argv[5], &end, 10); 666c5c4113dSnw 6678e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].unixname, 668cd37da74Snw argv[6]); 669c5c4113dSnw 670cd37da74Snw w2u_order = argv[7] ? strtol(argv[7], &end, 10) : 0; 671cd37da74Snw u2w_order = argv[8] ? strtol(argv[8], &end, 10) : 0; 672c5c4113dSnw 673c5c4113dSnw if (w2u_order > 0 && u2w_order == 0) 674651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 675651c0131Sbaban IDMAP_DIRECTION_W2U; 676c5c4113dSnw else if (w2u_order == 0 && u2w_order > 0) 677651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 678651c0131Sbaban IDMAP_DIRECTION_U2W; 679c5c4113dSnw else 680651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 681651c0131Sbaban IDMAP_DIRECTION_BI; 682c5c4113dSnw 683c5c4113dSnw result->lastrowid = strtoll(argv[0], &end, 10); 684c5c4113dSnw cb_data->next++; 685c5c4113dSnw result->retcode = IDMAP_SUCCESS; 686c5c4113dSnw return (0); 687c5c4113dSnw } 688c5c4113dSnw 689c5c4113dSnw 690c5c4113dSnw /* ARGSUSED */ 691c5c4113dSnw bool_t 692c5c4113dSnw idmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid, 693c5c4113dSnw uint64_t limit, idmap_namerules_res *result, 694cd37da74Snw struct svc_req *rqstp) 695cd37da74Snw { 696c5c4113dSnw 697c5c4113dSnw sqlite *db = NULL; 698c5c4113dSnw char w2ubuf[15], u2wbuf[15]; 699c5c4113dSnw char lbuf[30], rbuf[30]; 700c5c4113dSnw char *sql = NULL; 701cd37da74Snw char *expr = NULL; 702c5c4113dSnw uint64_t maxlimit; 703c5c4113dSnw idmap_retcode retcode; 704c5c4113dSnw 705c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 706c5c4113dSnw lbuf[0] = rbuf[0] = 0; 707c5c4113dSnw 7080dcc7149Snw result->retcode = validate_rule(&rule); 7090dcc7149Snw if (result->retcode != IDMAP_SUCCESS) 7100dcc7149Snw goto out; 7110dcc7149Snw 712c5c4113dSnw RDLOCK_CONFIG(); 713c5c4113dSnw maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 714c5c4113dSnw UNLOCK_CONFIG(); 715c5c4113dSnw 716c5c4113dSnw /* Get db handle */ 717c5c4113dSnw result->retcode = get_db_handle(&db); 718c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 719c5c4113dSnw goto out; 720c5c4113dSnw 721c5c4113dSnw result->retcode = IDMAP_ERR_INTERNAL; 722c5c4113dSnw 723cd37da74Snw w2ubuf[0] = u2wbuf[0] = 0; 724cd37da74Snw if (rule.direction == IDMAP_DIRECTION_BI) { 725c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 726c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 727651c0131Sbaban } else if (rule.direction == IDMAP_DIRECTION_W2U) { 728c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 729c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), 730cd37da74Snw "AND (u2w_order = 0 OR u2w_order ISNULL)"); 731651c0131Sbaban } else if (rule.direction == IDMAP_DIRECTION_U2W) { 732c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), 733cd37da74Snw "AND (w2u_order = 0 OR w2u_order ISNULL)"); 734c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 735c5c4113dSnw } 736c5c4113dSnw 7370dcc7149Snw result->retcode = gen_sql_expr_from_rule(&rule, &expr); 7380dcc7149Snw if (result->retcode != IDMAP_SUCCESS) 739cd37da74Snw goto out; 740c5c4113dSnw 741c5c4113dSnw /* Create LIMIT expression. */ 742c5c4113dSnw if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 743c5c4113dSnw limit = maxlimit; 744c5c4113dSnw if (limit > 0) 745c5c4113dSnw (void) snprintf(lbuf, sizeof (lbuf), 746cd37da74Snw "LIMIT %" PRIu64, limit + 1ULL); 747c5c4113dSnw 748c5c4113dSnw (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 749c5c4113dSnw 750c5c4113dSnw /* 751c5c4113dSnw * Combine all the above into a giant SELECT statement that 752c5c4113dSnw * will return the requested rules 753c5c4113dSnw */ 754cd37da74Snw sql = sqlite_mprintf("SELECT rowid, is_user, is_wuser, windomain, " 755cd37da74Snw "winname_display, is_nt4, unixname, w2u_order, u2w_order " 756cd37da74Snw "FROM namerules WHERE " 757cd37da74Snw " %s %s %s %s %s;", 758cd37da74Snw rbuf, expr, w2ubuf, u2wbuf, lbuf); 759cd37da74Snw 760c5c4113dSnw if (sql == NULL) { 761479ac375Sdm result->retcode = IDMAP_ERR_MEMORY; 762c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 763c5c4113dSnw goto out; 764c5c4113dSnw } 765c5c4113dSnw 766c5c4113dSnw /* Execute the SQL statement and update the return buffer */ 76771590c90Snw PROCESS_LIST_SVC_SQL(retcode, db, IDMAP_DBNAME, sql, limit, 76848258c6bSjp 0, list_namerules_cb, result, result->rules.rules_len); 769c5c4113dSnw 770c5c4113dSnw out: 771cd37da74Snw if (expr) 772cd37da74Snw sqlite_freemem(expr); 773c5c4113dSnw if (sql) 774c5c4113dSnw sqlite_freemem(sql); 775c5c4113dSnw if (IDMAP_ERROR(result->retcode)) 776c5c4113dSnw (void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result); 777c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 778c5c4113dSnw return (TRUE); 779c5c4113dSnw } 780c5c4113dSnw 781c5c4113dSnw #define IDMAP_RULES_AUTH "solaris.admin.idmap.rules" 782c5c4113dSnw static int 783cd37da74Snw verify_rules_auth(struct svc_req *rqstp) 784cd37da74Snw { 785c5c4113dSnw ucred_t *uc = NULL; 786c5c4113dSnw uid_t uid; 787c5c4113dSnw char buf[1024]; 788c5c4113dSnw struct passwd pwd; 789c5c4113dSnw 790c5c4113dSnw if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) { 79171590c90Snw idmapdlog(LOG_ERR, "svc_getcallerucred failed during " 79271590c90Snw "authorization (%s)", strerror(errno)); 793c5c4113dSnw return (-1); 794c5c4113dSnw } 795c5c4113dSnw 796c5c4113dSnw uid = ucred_geteuid(uc); 797c5c4113dSnw if (uid == (uid_t)-1) { 79871590c90Snw idmapdlog(LOG_ERR, "ucred_geteuid failed during " 79971590c90Snw "authorization (%s)", strerror(errno)); 800c5c4113dSnw ucred_free(uc); 801c5c4113dSnw return (-1); 802c5c4113dSnw } 803c5c4113dSnw 804c5c4113dSnw if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) { 80571590c90Snw idmapdlog(LOG_ERR, "getpwuid_r(%u) failed during " 80671590c90Snw "authorization (%s)", uid, strerror(errno)); 807c5c4113dSnw ucred_free(uc); 808c5c4113dSnw return (-1); 809c5c4113dSnw } 810c5c4113dSnw 811c5c4113dSnw if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) { 81271590c90Snw idmapdlog(LOG_INFO, "%s is not authorized (%s)", 81371590c90Snw pwd.pw_name, IDMAP_RULES_AUTH); 814c5c4113dSnw ucred_free(uc); 815c5c4113dSnw return (-1); 816c5c4113dSnw } 817c5c4113dSnw 818c5c4113dSnw ucred_free(uc); 819c5c4113dSnw return (1); 820c5c4113dSnw } 821c5c4113dSnw 8228e228215Sdm /* 8238e228215Sdm * Meaning of the return values is the following: For retcode == 8248e228215Sdm * IDMAP_SUCCESS, everything went OK and error_index is 8258e228215Sdm * undefined. Otherwise, error_index >=0 shows the failed batch 8268e228215Sdm * element. errro_index == -1 indicates failure at the beginning, 8278e228215Sdm * error_index == -2 at the end. 8288e228215Sdm */ 8298e228215Sdm 830c5c4113dSnw /* ARGSUSED */ 831c5c4113dSnw bool_t 8328e228215Sdm idmap_update_1_svc(idmap_update_batch batch, idmap_update_res *res, 833cd37da74Snw struct svc_req *rqstp) 834cd37da74Snw { 835c5c4113dSnw sqlite *db = NULL; 836c5c4113dSnw idmap_update_op *up; 837c5c4113dSnw int i; 83884decf41Sjp int trans = FALSE; 839c5c4113dSnw 8408e228215Sdm res->error_index = -1; 8418e228215Sdm (void) memset(&res->error_rule, 0, sizeof (res->error_rule)); 8428e228215Sdm (void) memset(&res->conflict_rule, 0, sizeof (res->conflict_rule)); 8438e228215Sdm 844c5c4113dSnw if (verify_rules_auth(rqstp) < 0) { 8458e228215Sdm res->retcode = IDMAP_ERR_PERMISSION_DENIED; 846c5c4113dSnw goto out; 847c5c4113dSnw } 848c5c4113dSnw 849c5c4113dSnw if (batch.idmap_update_batch_len == 0 || 850cd37da74Snw batch.idmap_update_batch_val == NULL) { 8518e228215Sdm res->retcode = IDMAP_SUCCESS; 852c5c4113dSnw goto out; 853c5c4113dSnw } 854c5c4113dSnw 8550dcc7149Snw res->retcode = validate_rules(&batch); 8560dcc7149Snw if (res->retcode != IDMAP_SUCCESS) 8570dcc7149Snw goto out; 8580dcc7149Snw 859c5c4113dSnw /* Get db handle */ 8608e228215Sdm res->retcode = get_db_handle(&db); 8618e228215Sdm if (res->retcode != IDMAP_SUCCESS) 862c5c4113dSnw goto out; 863c5c4113dSnw 86471590c90Snw res->retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "BEGIN TRANSACTION;"); 8658e228215Sdm if (res->retcode != IDMAP_SUCCESS) 866c5c4113dSnw goto out; 86784decf41Sjp trans = TRUE; 868c5c4113dSnw 869c5c4113dSnw for (i = 0; i < batch.idmap_update_batch_len; i++) { 870c5c4113dSnw up = &batch.idmap_update_batch_val[i]; 871c5c4113dSnw switch (up->opnum) { 872c5c4113dSnw case OP_NONE: 8738e228215Sdm res->retcode = IDMAP_SUCCESS; 874c5c4113dSnw break; 875c5c4113dSnw case OP_ADD_NAMERULE: 8768e228215Sdm res->retcode = add_namerule(db, 877cd37da74Snw &up->idmap_update_op_u.rule); 878c5c4113dSnw break; 879c5c4113dSnw case OP_RM_NAMERULE: 8808e228215Sdm res->retcode = rm_namerule(db, 881cd37da74Snw &up->idmap_update_op_u.rule); 882c5c4113dSnw break; 883c5c4113dSnw case OP_FLUSH_NAMERULES: 884cd37da74Snw res->retcode = flush_namerules(db); 885c5c4113dSnw break; 886c5c4113dSnw default: 8878e228215Sdm res->retcode = IDMAP_ERR_NOTSUPPORTED; 8888e228215Sdm break; 889c5c4113dSnw }; 890c5c4113dSnw 8918e228215Sdm if (res->retcode != IDMAP_SUCCESS) { 8928e228215Sdm res->error_index = i; 8938e228215Sdm if (up->opnum == OP_ADD_NAMERULE || 8948e228215Sdm up->opnum == OP_RM_NAMERULE) { 8958e228215Sdm idmap_stat r2 = 8968e228215Sdm idmap_namerule_cpy(&res->error_rule, 897cd37da74Snw &up->idmap_update_op_u.rule); 8988e228215Sdm if (r2 != IDMAP_SUCCESS) 8998e228215Sdm res->retcode = r2; 9008e228215Sdm } 901c5c4113dSnw goto out; 9028e228215Sdm } 903c5c4113dSnw } 904c5c4113dSnw 905c5c4113dSnw out: 90684decf41Sjp if (trans) { 9078e228215Sdm if (res->retcode == IDMAP_SUCCESS) { 9088e228215Sdm res->retcode = 90971590c90Snw sql_exec_no_cb(db, IDMAP_DBNAME, 91071590c90Snw "COMMIT TRANSACTION;"); 9118e228215Sdm if (res->retcode != IDMAP_SUCCESS) 9128e228215Sdm res->error_index = -2; 9138e228215Sdm } 91484decf41Sjp else 91571590c90Snw (void) sql_exec_no_cb(db, IDMAP_DBNAME, 91671590c90Snw "ROLLBACK TRANSACTION;"); 917c5c4113dSnw } 9188e228215Sdm 9198e228215Sdm res->retcode = idmap_stat4prot(res->retcode); 9208e228215Sdm 921c5c4113dSnw return (TRUE); 922c5c4113dSnw } 923c5c4113dSnw 924c5c4113dSnw 925c5c4113dSnw /* ARGSUSED */ 926c5c4113dSnw bool_t 927c5c4113dSnw idmap_get_mapped_id_by_name_1_svc(idmap_mapping request, 928cd37da74Snw idmap_mappings_res *result, struct svc_req *rqstp) 929cd37da74Snw { 930c5c4113dSnw sqlite *cache = NULL, *db = NULL; 931c5c4113dSnw 932c5c4113dSnw /* Init */ 933c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 934c5c4113dSnw 9350dcc7149Snw result->retcode = validate_mapped_id_by_name_req(&request); 9360dcc7149Snw if (result->retcode != IDMAP_SUCCESS) 9370dcc7149Snw goto out; 9380dcc7149Snw 939c5c4113dSnw /* Get cache handle */ 940c5c4113dSnw result->retcode = get_cache_handle(&cache); 941c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 942c5c4113dSnw goto out; 943c5c4113dSnw 944c5c4113dSnw /* Get db handle */ 945c5c4113dSnw result->retcode = get_db_handle(&db); 946c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 947c5c4113dSnw goto out; 948c5c4113dSnw 949c5c4113dSnw /* Allocate result */ 950c5c4113dSnw result->mappings.mappings_val = calloc(1, sizeof (idmap_mapping)); 951c5c4113dSnw if (result->mappings.mappings_val == NULL) { 952c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 953c5c4113dSnw result->retcode = IDMAP_ERR_MEMORY; 954c5c4113dSnw goto out; 955c5c4113dSnw } 956c5c4113dSnw result->mappings.mappings_len = 1; 957c5c4113dSnw 958cd37da74Snw 959cd37da74Snw if (IS_REQUEST_SID(request, 1)) { 960c5c4113dSnw result->retcode = get_w2u_mapping( 961cd37da74Snw cache, 962cd37da74Snw db, 963cd37da74Snw &request, 964cd37da74Snw result->mappings.mappings_val); 965c5c4113dSnw } else if (IS_REQUEST_UID(request)) { 966c5c4113dSnw result->retcode = get_u2w_mapping( 967cd37da74Snw cache, 968cd37da74Snw db, 969cd37da74Snw &request, 970cd37da74Snw result->mappings.mappings_val, 971cd37da74Snw 1); 972c5c4113dSnw } else if (IS_REQUEST_GID(request)) { 973c5c4113dSnw result->retcode = get_u2w_mapping( 974cd37da74Snw cache, 975cd37da74Snw db, 976cd37da74Snw &request, 977cd37da74Snw result->mappings.mappings_val, 978cd37da74Snw 0); 979c5c4113dSnw } else { 980c5c4113dSnw result->retcode = IDMAP_ERR_IDTYPE; 981c5c4113dSnw } 982c5c4113dSnw 983c5c4113dSnw out: 984c5c4113dSnw if (IDMAP_FATAL_ERROR(result->retcode)) { 985c5c4113dSnw xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 986c5c4113dSnw result->mappings.mappings_len = 0; 987c5c4113dSnw result->mappings.mappings_val = NULL; 988c5c4113dSnw } 989c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 990c5c4113dSnw return (TRUE); 991c5c4113dSnw } 992c5c4113dSnw 993479ac375Sdm /* ARGSUSED */ 994479ac375Sdm bool_t 995479ac375Sdm idmap_get_prop_1_svc(idmap_prop_type request, 996479ac375Sdm idmap_prop_res *result, struct svc_req *rqstp) 997479ac375Sdm { 998479ac375Sdm idmap_pg_config_t *pgcfg; 999479ac375Sdm 1000479ac375Sdm /* Init */ 1001479ac375Sdm (void) memset(result, 0, sizeof (*result)); 1002479ac375Sdm result->retcode = IDMAP_SUCCESS; 1003479ac375Sdm result->value.prop = request; 1004479ac375Sdm 1005479ac375Sdm RDLOCK_CONFIG(); 1006479ac375Sdm 1007479ac375Sdm /* Just shortcuts: */ 1008479ac375Sdm pgcfg = &_idmapdstate.cfg->pgcfg; 10094d61c878SJulian Pullen 1010479ac375Sdm 1011479ac375Sdm switch (request) { 1012479ac375Sdm case PROP_LIST_SIZE_LIMIT: 1013479ac375Sdm result->value.idmap_prop_val_u.intval = pgcfg->list_size_limit; 1014479ac375Sdm result->auto_discovered = FALSE; 1015479ac375Sdm break; 1016479ac375Sdm case PROP_DEFAULT_DOMAIN: 1017479ac375Sdm result->auto_discovered = FALSE; 1018479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1019479ac375Sdm pgcfg->default_domain); 1020479ac375Sdm break; 1021479ac375Sdm case PROP_DOMAIN_NAME: 1022479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1023479ac375Sdm pgcfg->domain_name); 1024479ac375Sdm result->auto_discovered = 10254d61c878SJulian Pullen pgcfg->domain_name_auto_disc; 1026479ac375Sdm break; 1027479ac375Sdm case PROP_MACHINE_SID: 1028479ac375Sdm result->auto_discovered = FALSE; 1029479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1030479ac375Sdm pgcfg->machine_sid); 1031479ac375Sdm break; 1032479ac375Sdm case PROP_DOMAIN_CONTROLLER: 1033479ac375Sdm if (pgcfg->domain_controller != NULL) { 1034479ac375Sdm (void) memcpy(&result->value.idmap_prop_val_u.dsval, 1035479ac375Sdm pgcfg->domain_controller, 1036479ac375Sdm sizeof (idmap_ad_disc_ds_t)); 1037479ac375Sdm } 10384d61c878SJulian Pullen result->auto_discovered = pgcfg->domain_controller_auto_disc; 1039479ac375Sdm break; 1040479ac375Sdm case PROP_FOREST_NAME: 1041479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1042479ac375Sdm pgcfg->forest_name); 10434d61c878SJulian Pullen result->auto_discovered = pgcfg->forest_name_auto_disc; 1044479ac375Sdm break; 1045479ac375Sdm case PROP_SITE_NAME: 1046479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1047479ac375Sdm pgcfg->site_name); 10484d61c878SJulian Pullen result->auto_discovered = pgcfg->site_name_auto_disc; 1049479ac375Sdm break; 1050479ac375Sdm case PROP_GLOBAL_CATALOG: 1051479ac375Sdm if (pgcfg->global_catalog != NULL) { 1052479ac375Sdm (void) memcpy(&result->value.idmap_prop_val_u.dsval, 1053479ac375Sdm pgcfg->global_catalog, sizeof (idmap_ad_disc_ds_t)); 1054479ac375Sdm } 10554d61c878SJulian Pullen result->auto_discovered = pgcfg->global_catalog_auto_disc; 1056479ac375Sdm break; 1057479ac375Sdm case PROP_AD_UNIXUSER_ATTR: 1058479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1059479ac375Sdm pgcfg->ad_unixuser_attr); 1060479ac375Sdm result->auto_discovered = FALSE; 1061479ac375Sdm break; 1062479ac375Sdm case PROP_AD_UNIXGROUP_ATTR: 1063479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1064479ac375Sdm pgcfg->ad_unixgroup_attr); 1065479ac375Sdm result->auto_discovered = FALSE; 1066479ac375Sdm break; 1067479ac375Sdm case PROP_NLDAP_WINNAME_ATTR: 1068479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1069479ac375Sdm pgcfg->nldap_winname_attr); 1070479ac375Sdm result->auto_discovered = FALSE; 1071479ac375Sdm break; 1072479ac375Sdm case PROP_DS_NAME_MAPPING_ENABLED: 1073479ac375Sdm result->value.idmap_prop_val_u.boolval = 1074479ac375Sdm pgcfg->ds_name_mapping_enabled; 1075479ac375Sdm result->auto_discovered = FALSE; 1076479ac375Sdm break; 1077479ac375Sdm default: 1078479ac375Sdm result->retcode = IDMAP_ERR_PROP_UNKNOWN; 1079479ac375Sdm break; 1080479ac375Sdm } 1081479ac375Sdm 1082479ac375Sdm out: 1083479ac375Sdm UNLOCK_CONFIG(); 1084479ac375Sdm if (IDMAP_FATAL_ERROR(result->retcode)) { 1085479ac375Sdm xdr_free(xdr_idmap_prop_res, (caddr_t)result); 1086479ac375Sdm result->value.prop = PROP_UNKNOWN; 1087479ac375Sdm } 1088479ac375Sdm result->retcode = idmap_stat4prot(result->retcode); 1089479ac375Sdm return (TRUE); 1090479ac375Sdm } 1091479ac375Sdm 1092c5c4113dSnw 1093c5c4113dSnw /* ARGSUSED */ 1094c5c4113dSnw int 1095c5c4113dSnw idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, 1096cd37da74Snw caddr_t result) 1097cd37da74Snw { 1098c5c4113dSnw (void) xdr_free(xdr_result, result); 1099c5c4113dSnw return (TRUE); 1100c5c4113dSnw } 1101*1fcced4cSJordan Brown 1102*1fcced4cSJordan Brown /* 1103*1fcced4cSJordan Brown * This function is called by rpc_svc.c when it encounters an error. 1104*1fcced4cSJordan Brown */ 1105*1fcced4cSJordan Brown NOTE(PRINTFLIKE(1)) 1106*1fcced4cSJordan Brown void 1107*1fcced4cSJordan Brown idmap_rpc_msgout(const char *fmt, ...) 1108*1fcced4cSJordan Brown { 1109*1fcced4cSJordan Brown va_list va; 1110*1fcced4cSJordan Brown char buf[1000]; 1111*1fcced4cSJordan Brown 1112*1fcced4cSJordan Brown va_start(va, fmt); 1113*1fcced4cSJordan Brown (void) vsnprintf(buf, sizeof (buf), fmt, va); 1114*1fcced4cSJordan Brown va_end(va); 1115*1fcced4cSJordan Brown 1116*1fcced4cSJordan Brown idmapdlog(LOG_ERR, "idmap RPC: %s", buf); 1117*1fcced4cSJordan Brown } 1118