1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 22*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23c5c4113dSnw * Use is subject to license terms. 24c5c4113dSnw */ 25c5c4113dSnw 26c5c4113dSnw 27c5c4113dSnw /* 28c5c4113dSnw * Service routines 29c5c4113dSnw */ 30c5c4113dSnw 31c5c4113dSnw #include "idmapd.h" 32c5c4113dSnw #include "idmap_priv.h" 33e8c27ec8Sbaban #include "nldaputils.h" 34c5c4113dSnw #include <signal.h> 35c5c4113dSnw #include <thread.h> 36c5c4113dSnw #include <string.h> 37c5c4113dSnw #include <strings.h> 38c5c4113dSnw #include <errno.h> 39c5c4113dSnw #include <assert.h> 40c5c4113dSnw #include <sys/types.h> 41c5c4113dSnw #include <sys/stat.h> 42*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States #include <sys/sid.h> 43c5c4113dSnw #include <ucred.h> 44c5c4113dSnw #include <pwd.h> 45c5c4113dSnw #include <auth_attr.h> 46c5c4113dSnw #include <secdb.h> 470dcc7149Snw #include <sys/u8_textprep.h> 481fcced4cSJordan Brown #include <note.h> 49c5c4113dSnw 50c5c4113dSnw #define _VALIDATE_LIST_CB_DATA(col, val, siz)\ 51c5c4113dSnw retcode = validate_list_cb_data(cb_data, argc, argv, col,\ 52c5c4113dSnw (uchar_t **)val, siz);\ 53c5c4113dSnw if (retcode == IDMAP_NEXT) {\ 54c5c4113dSnw result->retcode = IDMAP_NEXT;\ 55c5c4113dSnw return (0);\ 56c5c4113dSnw } else if (retcode < 0) {\ 57c5c4113dSnw result->retcode = retcode;\ 58c5c4113dSnw return (1);\ 59c5c4113dSnw } 60c5c4113dSnw 6148258c6bSjp #define PROCESS_LIST_SVC_SQL(rcode, db, dbname, sql, limit, flag, cb, res, len)\ 6248258c6bSjp rcode = process_list_svc_sql(db, dbname, sql, limit, flag, cb, res);\ 63c5c4113dSnw if (rcode == IDMAP_ERR_BUSY)\ 64c5c4113dSnw res->retcode = IDMAP_ERR_BUSY;\ 65c5c4113dSnw else if (rcode == IDMAP_SUCCESS && len == 0)\ 66c5c4113dSnw res->retcode = IDMAP_ERR_NOTFOUND; 67c5c4113dSnw 68c5c4113dSnw 698e228215Sdm #define STRDUP_OR_FAIL(to, from) \ 708e228215Sdm if ((from) == NULL) \ 718e228215Sdm to = NULL; \ 728e228215Sdm else { \ 738e228215Sdm if ((to = strdup(from)) == NULL) \ 748e228215Sdm return (1); \ 758e228215Sdm } 768e228215Sdm 77479ac375Sdm #define STRDUP_CHECK(to, from) \ 78479ac375Sdm if ((from) != NULL) { \ 79479ac375Sdm to = strdup(from); \ 80479ac375Sdm if (to == NULL) { \ 81479ac375Sdm result->retcode = IDMAP_ERR_MEMORY; \ 82479ac375Sdm goto out; \ 83479ac375Sdm } \ 84479ac375Sdm } 85479ac375Sdm 86c5c4113dSnw /* ARGSUSED */ 87c5c4113dSnw bool_t 88cd37da74Snw idmap_null_1_svc(void *result, struct svc_req *rqstp) 89cd37da74Snw { 90c5c4113dSnw return (TRUE); 91c5c4113dSnw } 92c5c4113dSnw 93334e3463Sbaban /* 94334e3463Sbaban * RPC layer allocates empty strings to replace NULL char *. 95334e3463Sbaban * This utility function frees these empty strings. 96334e3463Sbaban */ 97e8c27ec8Sbaban static 98e8c27ec8Sbaban void 99334e3463Sbaban sanitize_mapping_request(idmap_mapping *req) 100334e3463Sbaban { 101fe1c642dSBill Krier if (EMPTY_STRING(req->id1name)) { 102fe1c642dSBill Krier free(req->id1name); 103fe1c642dSBill Krier req->id1name = NULL; 104fe1c642dSBill Krier } 105fe1c642dSBill Krier if (EMPTY_STRING(req->id1domain)) { 106fe1c642dSBill Krier free(req->id1domain); 107fe1c642dSBill Krier req->id1domain = NULL; 108fe1c642dSBill Krier } 109fe1c642dSBill Krier if (EMPTY_STRING(req->id2name)) { 110fe1c642dSBill Krier free(req->id2name); 111fe1c642dSBill Krier req->id2name = NULL; 112fe1c642dSBill Krier } 113fe1c642dSBill Krier if (EMPTY_STRING(req->id2domain)) { 114fe1c642dSBill Krier free(req->id2domain); 115fe1c642dSBill Krier req->id2domain = NULL; 116fe1c642dSBill Krier } 117e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 118334e3463Sbaban } 119334e3463Sbaban 1200dcc7149Snw static 1210dcc7149Snw int 1220dcc7149Snw validate_mapped_id_by_name_req(idmap_mapping *req) 1230dcc7149Snw { 1240dcc7149Snw int e; 1250dcc7149Snw 1260dcc7149Snw if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) 1270dcc7149Snw return (IDMAP_SUCCESS); 1280dcc7149Snw 1290dcc7149Snw if (IS_REQUEST_SID(*req, 1)) { 1300dcc7149Snw if (!EMPTY_STRING(req->id1name) && 1310dcc7149Snw u8_validate(req->id1name, strlen(req->id1name), 1320dcc7149Snw NULL, U8_VALIDATE_ENTIRE, &e) < 0) 1330dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1340dcc7149Snw if (!EMPTY_STRING(req->id1domain) && 1350dcc7149Snw u8_validate(req->id1domain, strlen(req->id1domain), 1360dcc7149Snw NULL, U8_VALIDATE_ENTIRE, &e) < 0) 1370dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1380dcc7149Snw } 1390dcc7149Snw 1400dcc7149Snw return (IDMAP_SUCCESS); 1410dcc7149Snw } 1420dcc7149Snw 1430dcc7149Snw static 1440dcc7149Snw int 1450dcc7149Snw validate_rule(idmap_namerule *rule) 1460dcc7149Snw { 1470dcc7149Snw int e; 1480dcc7149Snw 1490dcc7149Snw if (!EMPTY_STRING(rule->winname) && 1500dcc7149Snw u8_validate(rule->winname, strlen(rule->winname), 1510dcc7149Snw NULL, U8_VALIDATE_ENTIRE, &e) < 0) 1520dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1530dcc7149Snw 1540dcc7149Snw if (!EMPTY_STRING(rule->windomain) && 1550dcc7149Snw u8_validate(rule->windomain, strlen(rule->windomain), 1560dcc7149Snw NULL, U8_VALIDATE_ENTIRE, &e) < 0) 1570dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1580dcc7149Snw 1590dcc7149Snw return (IDMAP_SUCCESS); 1600dcc7149Snw 1610dcc7149Snw } 1620dcc7149Snw 1630dcc7149Snw static 1640dcc7149Snw bool_t 1650dcc7149Snw validate_rules(idmap_update_batch *batch) 1660dcc7149Snw { 1670dcc7149Snw idmap_update_op *up; 1680dcc7149Snw int i; 1690dcc7149Snw 1700dcc7149Snw for (i = 0; i < batch->idmap_update_batch_len; i++) { 1710dcc7149Snw up = &(batch->idmap_update_batch_val[i]); 1720dcc7149Snw if (validate_rule(&(up->idmap_update_op_u.rule)) 1730dcc7149Snw != IDMAP_SUCCESS) 1740dcc7149Snw return (IDMAP_ERR_BAD_UTF8); 1750dcc7149Snw } 1760dcc7149Snw 1770dcc7149Snw return (IDMAP_SUCCESS); 1780dcc7149Snw } 1790dcc7149Snw 180c5c4113dSnw /* ARGSUSED */ 181c5c4113dSnw bool_t 182c5c4113dSnw idmap_get_mapped_ids_1_svc(idmap_mapping_batch batch, 183cd37da74Snw idmap_ids_res *result, struct svc_req *rqstp) 184cd37da74Snw { 185c5c4113dSnw sqlite *cache = NULL, *db = NULL; 186c5c4113dSnw lookup_state_t state; 187e8c27ec8Sbaban idmap_retcode retcode; 18862c60062Sbaban uint_t i; 189c5c4113dSnw 190c5c4113dSnw /* Init */ 191c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 192c5c4113dSnw (void) memset(&state, 0, sizeof (state)); 193c5c4113dSnw 194c5c4113dSnw /* Return success if nothing was requested */ 195c5c4113dSnw if (batch.idmap_mapping_batch_len < 1) 196c5c4113dSnw goto out; 197c5c4113dSnw 198c5c4113dSnw /* Get cache handle */ 199c5c4113dSnw result->retcode = get_cache_handle(&cache); 200c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 201c5c4113dSnw goto out; 202479ac375Sdm state.cache = cache; 203c5c4113dSnw 204c5c4113dSnw /* Get db handle */ 205c5c4113dSnw result->retcode = get_db_handle(&db); 206c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 207c5c4113dSnw goto out; 208479ac375Sdm state.db = db; 209c5c4113dSnw 210c5c4113dSnw /* Allocate result array */ 211c5c4113dSnw result->ids.ids_val = calloc(batch.idmap_mapping_batch_len, 212cd37da74Snw sizeof (idmap_id_res)); 213c5c4113dSnw if (result->ids.ids_val == NULL) { 214c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 215c5c4113dSnw result->retcode = IDMAP_ERR_MEMORY; 216c5c4113dSnw goto out; 217c5c4113dSnw } 218c5c4113dSnw result->ids.ids_len = batch.idmap_mapping_batch_len; 219c5c4113dSnw 22062c60062Sbaban /* Allocate hash table to check for duplicate sids */ 22162c60062Sbaban state.sid_history = calloc(batch.idmap_mapping_batch_len, 222cd37da74Snw sizeof (*state.sid_history)); 22362c60062Sbaban if (state.sid_history == NULL) { 22462c60062Sbaban idmapdlog(LOG_ERR, "Out of memory"); 22562c60062Sbaban result->retcode = IDMAP_ERR_MEMORY; 22662c60062Sbaban goto out; 22762c60062Sbaban } 22862c60062Sbaban state.sid_history_size = batch.idmap_mapping_batch_len; 22962c60062Sbaban for (i = 0; i < state.sid_history_size; i++) { 23062c60062Sbaban state.sid_history[i].key = state.sid_history_size; 23162c60062Sbaban state.sid_history[i].next = state.sid_history_size; 23262c60062Sbaban } 23362c60062Sbaban state.batch = &batch; 23462c60062Sbaban state.result = result; 23562c60062Sbaban 236e8c27ec8Sbaban /* Get directory-based name mapping info */ 237479ac375Sdm result->retcode = load_cfg_in_state(&state); 238e8c27ec8Sbaban if (result->retcode != IDMAP_SUCCESS) 239e8c27ec8Sbaban goto out; 240e8c27ec8Sbaban 241c5c4113dSnw /* Init our 'done' flags */ 242c5c4113dSnw state.sid2pid_done = state.pid2sid_done = TRUE; 243c5c4113dSnw 244c5c4113dSnw /* First stage */ 245c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 24662c60062Sbaban state.curpos = i; 247334e3463Sbaban (void) sanitize_mapping_request( 248334e3463Sbaban &batch.idmap_mapping_batch_val[i]); 249c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 250c5c4113dSnw retcode = sid2pid_first_pass( 251cd37da74Snw &state, 252cd37da74Snw &batch.idmap_mapping_batch_val[i], 253cd37da74Snw &result->ids.ids_val[i]); 254c5c4113dSnw } else if (IS_BATCH_UID(batch, i)) { 255c5c4113dSnw retcode = pid2sid_first_pass( 256cd37da74Snw &state, 257cd37da74Snw &batch.idmap_mapping_batch_val[i], 258fe1c642dSBill Krier &result->ids.ids_val[i], 1); 259c5c4113dSnw } else if (IS_BATCH_GID(batch, i)) { 260c5c4113dSnw retcode = pid2sid_first_pass( 261cd37da74Snw &state, 262cd37da74Snw &batch.idmap_mapping_batch_val[i], 263fe1c642dSBill Krier &result->ids.ids_val[i], 0); 264c5c4113dSnw } else { 265c5c4113dSnw result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE; 266c5c4113dSnw continue; 267c5c4113dSnw } 268c5c4113dSnw if (IDMAP_FATAL_ERROR(retcode)) { 269c5c4113dSnw result->retcode = retcode; 270c5c4113dSnw goto out; 271c5c4113dSnw } 272c5c4113dSnw } 273c5c4113dSnw 274c5c4113dSnw /* Check if we are done */ 275c5c4113dSnw if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 276c5c4113dSnw goto out; 277c5c4113dSnw 278e8c27ec8Sbaban /* 279e8c27ec8Sbaban * native LDAP lookups: 280479ac375Sdm * pid2sid: 281479ac375Sdm * - nldap or mixed mode. Lookup nldap by pid or unixname to get 282479ac375Sdm * winname. 283479ac375Sdm * sid2pid: 284479ac375Sdm * - nldap mode. Got winname and sid (either given or found in 285479ac375Sdm * name_cache). Lookup nldap by winname to get pid and 286479ac375Sdm * unixname. 287e8c27ec8Sbaban */ 288e8c27ec8Sbaban if (state.nldap_nqueries) { 289e8c27ec8Sbaban retcode = nldap_lookup_batch(&state, &batch, result); 290e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 291e8c27ec8Sbaban result->retcode = retcode; 292e8c27ec8Sbaban goto out; 293e8c27ec8Sbaban } 294e8c27ec8Sbaban } 295e8c27ec8Sbaban 296e8c27ec8Sbaban /* 297e8c27ec8Sbaban * AD lookups: 298479ac375Sdm * pid2sid: 299479ac375Sdm * - nldap or mixed mode. Got winname from nldap lookup. 300479ac375Sdm * winname2sid could not be resolved locally. Lookup AD 301479ac375Sdm * by winname to get sid. 302479ac375Sdm * - ad mode. Got unixname. Lookup AD by unixname to get 303479ac375Sdm * winname and sid. 304479ac375Sdm * sid2pid: 305479ac375Sdm * - ad or mixed mode. Lookup AD by sid or winname to get 306479ac375Sdm * winname, sid and unixname. 307479ac375Sdm * - any mode. Got either sid or winname but not both. Lookup 308479ac375Sdm * AD by sid or winname to get winname, sid. 309e8c27ec8Sbaban */ 310c5c4113dSnw if (state.ad_nqueries) { 311e8c27ec8Sbaban retcode = ad_lookup_batch(&state, &batch, result); 312e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 313e8c27ec8Sbaban result->retcode = retcode; 314e8c27ec8Sbaban goto out; 315e8c27ec8Sbaban } 316e8c27ec8Sbaban } 317e8c27ec8Sbaban 318e8c27ec8Sbaban /* 319e8c27ec8Sbaban * native LDAP lookups: 320479ac375Sdm * sid2pid: 321479ac375Sdm * - nldap mode. Got winname and sid from AD lookup. Lookup nldap 322479ac375Sdm * by winname to get pid and unixname. 323e8c27ec8Sbaban */ 324e8c27ec8Sbaban if (state.nldap_nqueries) { 325e8c27ec8Sbaban retcode = nldap_lookup_batch(&state, &batch, result); 326e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 327e8c27ec8Sbaban result->retcode = retcode; 328c5c4113dSnw goto out; 329c5c4113dSnw } 330e8c27ec8Sbaban } 331c5c4113dSnw 332e8c27ec8Sbaban /* Reset 'done' flags */ 333e8c27ec8Sbaban state.sid2pid_done = state.pid2sid_done = TRUE; 334c5c4113dSnw 335c5c4113dSnw /* Second stage */ 336c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 33762c60062Sbaban state.curpos = i; 338c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 339c5c4113dSnw retcode = sid2pid_second_pass( 340cd37da74Snw &state, 341cd37da74Snw &batch.idmap_mapping_batch_val[i], 342cd37da74Snw &result->ids.ids_val[i]); 343e8c27ec8Sbaban } else if (IS_BATCH_UID(batch, i)) { 344e8c27ec8Sbaban retcode = pid2sid_second_pass( 345e8c27ec8Sbaban &state, 346e8c27ec8Sbaban &batch.idmap_mapping_batch_val[i], 347e8c27ec8Sbaban &result->ids.ids_val[i], 1); 348e8c27ec8Sbaban } else if (IS_BATCH_GID(batch, i)) { 349e8c27ec8Sbaban retcode = pid2sid_second_pass( 350e8c27ec8Sbaban &state, 351e8c27ec8Sbaban &batch.idmap_mapping_batch_val[i], 352e8c27ec8Sbaban &result->ids.ids_val[i], 0); 353e8c27ec8Sbaban } else { 354e8c27ec8Sbaban /* First stage has already set the error */ 355e8c27ec8Sbaban continue; 356e8c27ec8Sbaban } 357e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 358e8c27ec8Sbaban result->retcode = retcode; 359e8c27ec8Sbaban goto out; 360c5c4113dSnw } 361c5c4113dSnw } 362c5c4113dSnw 363c5c4113dSnw /* Check if we are done */ 364c5c4113dSnw if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 365c5c4113dSnw goto out; 366c5c4113dSnw 367c5c4113dSnw /* Reset our 'done' flags */ 368c5c4113dSnw state.sid2pid_done = state.pid2sid_done = TRUE; 369c5c4113dSnw 370c5c4113dSnw /* Update cache in a single transaction */ 37171590c90Snw if (sql_exec_no_cb(cache, IDMAP_CACHENAME, "BEGIN TRANSACTION;") 37271590c90Snw != IDMAP_SUCCESS) 373c5c4113dSnw goto out; 374c5c4113dSnw 375c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 37662c60062Sbaban state.curpos = i; 377c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 378c5c4113dSnw (void) update_cache_sid2pid( 379cd37da74Snw &state, 380cd37da74Snw &batch.idmap_mapping_batch_val[i], 381cd37da74Snw &result->ids.ids_val[i]); 382c5c4113dSnw } else if ((IS_BATCH_UID(batch, i)) || 383cd37da74Snw (IS_BATCH_GID(batch, i))) { 384c5c4113dSnw (void) update_cache_pid2sid( 385cd37da74Snw &state, 386cd37da74Snw &batch.idmap_mapping_batch_val[i], 387cd37da74Snw &result->ids.ids_val[i]); 388c5c4113dSnw } 389c5c4113dSnw } 390c5c4113dSnw 391da6c28aaSamw /* Commit if we have at least one successful update */ 392c5c4113dSnw if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE) 39371590c90Snw (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 39471590c90Snw "COMMIT TRANSACTION;"); 395c5c4113dSnw else 39671590c90Snw (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 39771590c90Snw "END TRANSACTION;"); 398c5c4113dSnw 399c5c4113dSnw out: 400e8c27ec8Sbaban cleanup_lookup_state(&state); 401c5c4113dSnw if (IDMAP_ERROR(result->retcode)) { 402c5c4113dSnw xdr_free(xdr_idmap_ids_res, (caddr_t)result); 403c5c4113dSnw result->ids.ids_len = 0; 404c5c4113dSnw result->ids.ids_val = NULL; 405c5c4113dSnw } 406c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 407c5c4113dSnw return (TRUE); 408c5c4113dSnw } 409c5c4113dSnw 410c5c4113dSnw 411c5c4113dSnw /* ARGSUSED */ 412cd37da74Snw static 413cd37da74Snw int 414cd37da74Snw list_mappings_cb(void *parg, int argc, char **argv, char **colnames) 415cd37da74Snw { 416c5c4113dSnw list_cb_data_t *cb_data; 417c5c4113dSnw char *str; 418c5c4113dSnw idmap_mappings_res *result; 419c5c4113dSnw idmap_retcode retcode; 420c5c4113dSnw int w2u, u2w; 421c5c4113dSnw char *end; 422cd37da74Snw static int validated_column_names = 0; 42348258c6bSjp idmap_how *how; 42448258c6bSjp 42548258c6bSjp cb_data = (list_cb_data_t *)parg; 426cd37da74Snw 427cd37da74Snw if (!validated_column_names) { 428cd37da74Snw assert(strcmp(colnames[0], "rowid") == 0); 429cd37da74Snw assert(strcmp(colnames[1], "sidprefix") == 0); 430cd37da74Snw assert(strcmp(colnames[2], "rid") == 0); 431cd37da74Snw assert(strcmp(colnames[3], "pid") == 0); 432cd37da74Snw assert(strcmp(colnames[4], "w2u") == 0); 433cd37da74Snw assert(strcmp(colnames[5], "u2w") == 0); 434cd37da74Snw assert(strcmp(colnames[6], "windomain") == 0); 435cd37da74Snw assert(strcmp(colnames[7], "canon_winname") == 0); 436cd37da74Snw assert(strcmp(colnames[8], "unixname") == 0); 437cd37da74Snw assert(strcmp(colnames[9], "is_user") == 0); 438cd37da74Snw assert(strcmp(colnames[10], "is_wuser") == 0); 43948258c6bSjp assert(strcmp(colnames[11], "map_type") == 0); 44048258c6bSjp assert(strcmp(colnames[12], "map_dn") == 0); 44148258c6bSjp assert(strcmp(colnames[13], "map_attr") == 0); 44248258c6bSjp assert(strcmp(colnames[14], "map_value") == 0); 44348258c6bSjp assert(strcmp(colnames[15], "map_windomain") == 0); 44448258c6bSjp assert(strcmp(colnames[16], "map_winname") == 0); 44548258c6bSjp assert(strcmp(colnames[17], "map_unixname") == 0); 44648258c6bSjp assert(strcmp(colnames[18], "map_is_nt4") == 0); 447cd37da74Snw validated_column_names = 1; 448cd37da74Snw } 449cd37da74Snw 450c5c4113dSnw result = (idmap_mappings_res *)cb_data->result; 451c5c4113dSnw 45248258c6bSjp _VALIDATE_LIST_CB_DATA(19, &result->mappings.mappings_val, 453cd37da74Snw sizeof (idmap_mapping)); 454c5c4113dSnw 455c5c4113dSnw result->mappings.mappings_len++; 456c5c4113dSnw 457c5c4113dSnw if ((str = strdup(argv[1])) == NULL) 458c5c4113dSnw return (1); 459c5c4113dSnw result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix = 460cd37da74Snw str; 461c5c4113dSnw result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid = 462cd37da74Snw strtoul(argv[2], &end, 10); 463cd37da74Snw result->mappings.mappings_val[cb_data->next].id1.idtype = 464cd37da74Snw strtol(argv[10], &end, 10) ? IDMAP_USID : IDMAP_GSID; 465c5c4113dSnw 466c5c4113dSnw result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid = 467cd37da74Snw strtoul(argv[3], &end, 10); 468cd37da74Snw result->mappings.mappings_val[cb_data->next].id2.idtype = 469cd37da74Snw strtol(argv[9], &end, 10) ? IDMAP_UID : IDMAP_GID; 470c5c4113dSnw 471cd37da74Snw w2u = argv[4] ? strtol(argv[4], &end, 10) : 0; 472cd37da74Snw u2w = argv[5] ? strtol(argv[5], &end, 10) : 0; 473c5c4113dSnw 474c5c4113dSnw if (w2u > 0 && u2w == 0) 475651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 476651c0131Sbaban IDMAP_DIRECTION_W2U; 477c5c4113dSnw else if (w2u == 0 && u2w > 0) 478651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 479651c0131Sbaban IDMAP_DIRECTION_U2W; 480c5c4113dSnw else 481651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 482651c0131Sbaban IDMAP_DIRECTION_BI; 483c5c4113dSnw 4848e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1domain, 4858e228215Sdm argv[6]); 486c5c4113dSnw 4878e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1name, 4888e228215Sdm argv[7]); 4898e228215Sdm 4908e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id2name, 4918e228215Sdm argv[8]); 492c5c4113dSnw 49348258c6bSjp if (cb_data->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 49448258c6bSjp how = &result->mappings.mappings_val[cb_data->next].info.how; 49548258c6bSjp how->map_type = strtoul(argv[11], &end, 10); 49648258c6bSjp switch (how->map_type) { 49748258c6bSjp case IDMAP_MAP_TYPE_DS_AD: 49848258c6bSjp how->idmap_how_u.ad.dn = 49948258c6bSjp strdup(argv[12]); 50048258c6bSjp how->idmap_how_u.ad.attr = 50148258c6bSjp strdup(argv[13]); 50248258c6bSjp how->idmap_how_u.ad.value = 50348258c6bSjp strdup(argv[14]); 50448258c6bSjp break; 50548258c6bSjp 50648258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP: 50748258c6bSjp how->idmap_how_u.nldap.dn = 50848258c6bSjp strdup(argv[12]); 50948258c6bSjp how->idmap_how_u.nldap.attr = 51048258c6bSjp strdup(argv[13]); 51148258c6bSjp how->idmap_how_u.nldap.value = 51248258c6bSjp strdup(argv[14]); 51348258c6bSjp break; 51448258c6bSjp 51548258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED: 51648258c6bSjp how->idmap_how_u.rule.windomain = 51748258c6bSjp strdup(argv[15]); 51848258c6bSjp how->idmap_how_u.rule.winname = 51948258c6bSjp strdup(argv[16]); 52048258c6bSjp how->idmap_how_u.rule.unixname = 52148258c6bSjp strdup(argv[17]); 52248258c6bSjp how->idmap_how_u.rule.is_nt4 = 52348258c6bSjp strtoul(argv[18], &end, 10); 52448258c6bSjp how->idmap_how_u.rule.is_user = 52548258c6bSjp strtol(argv[9], &end, 10); 52648258c6bSjp how->idmap_how_u.rule.is_wuser = 52748258c6bSjp strtol(argv[10], &end, 10); 52848258c6bSjp break; 52948258c6bSjp 53048258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL: 53148258c6bSjp break; 53248258c6bSjp 53348258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID: 53448258c6bSjp break; 53548258c6bSjp 536e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU: 537e3f2c991SKeyur Desai how->idmap_how_u.idmu.dn = 538e3f2c991SKeyur Desai strdup(argv[12]); 539e3f2c991SKeyur Desai how->idmap_how_u.idmu.attr = 540e3f2c991SKeyur Desai strdup(argv[13]); 541e3f2c991SKeyur Desai how->idmap_how_u.idmu.value = 542e3f2c991SKeyur Desai strdup(argv[14]); 543e3f2c991SKeyur Desai break; 544e3f2c991SKeyur Desai 54548258c6bSjp default: 546e3f2c991SKeyur Desai /* Unknown mapping type */ 54748258c6bSjp assert(FALSE); 54848258c6bSjp } 54948258c6bSjp 55048258c6bSjp } 551c5c4113dSnw 552c5c4113dSnw result->lastrowid = strtoll(argv[0], &end, 10); 553c5c4113dSnw cb_data->next++; 554c5c4113dSnw result->retcode = IDMAP_SUCCESS; 555c5c4113dSnw return (0); 556c5c4113dSnw } 557c5c4113dSnw 558c5c4113dSnw 559c5c4113dSnw /* ARGSUSED */ 560c5c4113dSnw bool_t 56148258c6bSjp idmap_list_mappings_1_svc(int64_t lastrowid, uint64_t limit, int32_t flag, 562cd37da74Snw idmap_mappings_res *result, struct svc_req *rqstp) 563cd37da74Snw { 564c5c4113dSnw sqlite *cache = NULL; 565c5c4113dSnw char lbuf[30], rbuf[30]; 566c5c4113dSnw uint64_t maxlimit; 567c5c4113dSnw idmap_retcode retcode; 568c5c4113dSnw char *sql = NULL; 56948258c6bSjp time_t curtime; 570c5c4113dSnw 571c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 572c5c4113dSnw 57348258c6bSjp /* Current time */ 57448258c6bSjp errno = 0; 57548258c6bSjp if ((curtime = time(NULL)) == (time_t)-1) { 57648258c6bSjp idmapdlog(LOG_ERR, "Failed to get current time (%s)", 57748258c6bSjp strerror(errno)); 57848258c6bSjp retcode = IDMAP_ERR_INTERNAL; 57948258c6bSjp goto out; 58048258c6bSjp } 58148258c6bSjp 582c5c4113dSnw RDLOCK_CONFIG(); 583c5c4113dSnw maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 584c5c4113dSnw UNLOCK_CONFIG(); 585c5c4113dSnw 586c5c4113dSnw /* Get cache handle */ 587c5c4113dSnw result->retcode = get_cache_handle(&cache); 588c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 589c5c4113dSnw goto out; 590c5c4113dSnw 591c5c4113dSnw result->retcode = IDMAP_ERR_INTERNAL; 592c5c4113dSnw 593c5c4113dSnw /* Create LIMIT expression. */ 594c5c4113dSnw if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 595c5c4113dSnw limit = maxlimit; 596c5c4113dSnw if (limit > 0) 597c5c4113dSnw (void) snprintf(lbuf, sizeof (lbuf), 598cd37da74Snw "LIMIT %" PRIu64, limit + 1ULL); 599bbf6f00cSJordan Brown else 600bbf6f00cSJordan Brown lbuf[0] = '\0'; 601c5c4113dSnw 602c5c4113dSnw (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 603c5c4113dSnw 604c5c4113dSnw /* 605c5c4113dSnw * Combine all the above into a giant SELECT statement that 606c5c4113dSnw * will return the requested mappings 607c5c4113dSnw */ 60848258c6bSjp 60948258c6bSjp sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, " 61048258c6bSjp "u2w, windomain, canon_winname, unixname, is_user, is_wuser, " 61148258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, " 61248258c6bSjp "map_winname, map_unixname, map_is_nt4 " 61348258c6bSjp "FROM idmap_cache WHERE %s AND " 61448258c6bSjp "(pid >= 2147483648 OR (expiration = 0 OR " 61548258c6bSjp "expiration ISNULL OR expiration > %d)) " 61648258c6bSjp "%s;", 61748258c6bSjp rbuf, curtime, lbuf); 618c5c4113dSnw if (sql == NULL) { 619479ac375Sdm result->retcode = IDMAP_ERR_MEMORY; 620c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 621c5c4113dSnw goto out; 622c5c4113dSnw } 623c5c4113dSnw 624c5c4113dSnw /* Execute the SQL statement and update the return buffer */ 62571590c90Snw PROCESS_LIST_SVC_SQL(retcode, cache, IDMAP_CACHENAME, sql, limit, 62648258c6bSjp flag, list_mappings_cb, result, result->mappings.mappings_len); 627c5c4113dSnw 628c5c4113dSnw out: 629c5c4113dSnw if (sql) 630c5c4113dSnw sqlite_freemem(sql); 631c5c4113dSnw if (IDMAP_ERROR(result->retcode)) 632c5c4113dSnw (void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 633c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 634c5c4113dSnw return (TRUE); 635c5c4113dSnw } 636c5c4113dSnw 637c5c4113dSnw 638c5c4113dSnw /* ARGSUSED */ 639cd37da74Snw static 640cd37da74Snw int 641cd37da74Snw list_namerules_cb(void *parg, int argc, char **argv, char **colnames) 642cd37da74Snw { 643c5c4113dSnw list_cb_data_t *cb_data; 644c5c4113dSnw idmap_namerules_res *result; 645c5c4113dSnw idmap_retcode retcode; 646c5c4113dSnw int w2u_order, u2w_order; 647c5c4113dSnw char *end; 648cd37da74Snw static int validated_column_names = 0; 649cd37da74Snw 650cd37da74Snw if (!validated_column_names) { 651cd37da74Snw assert(strcmp(colnames[0], "rowid") == 0); 652cd37da74Snw assert(strcmp(colnames[1], "is_user") == 0); 653cd37da74Snw assert(strcmp(colnames[2], "is_wuser") == 0); 654cd37da74Snw assert(strcmp(colnames[3], "windomain") == 0); 655cd37da74Snw assert(strcmp(colnames[4], "winname_display") == 0); 656cd37da74Snw assert(strcmp(colnames[5], "is_nt4") == 0); 657cd37da74Snw assert(strcmp(colnames[6], "unixname") == 0); 658cd37da74Snw assert(strcmp(colnames[7], "w2u_order") == 0); 659cd37da74Snw assert(strcmp(colnames[8], "u2w_order") == 0); 660cd37da74Snw validated_column_names = 1; 661cd37da74Snw } 662c5c4113dSnw 663c5c4113dSnw cb_data = (list_cb_data_t *)parg; 664c5c4113dSnw result = (idmap_namerules_res *)cb_data->result; 665c5c4113dSnw 666cd37da74Snw _VALIDATE_LIST_CB_DATA(9, &result->rules.rules_val, 667cd37da74Snw sizeof (idmap_namerule)); 668c5c4113dSnw 669c5c4113dSnw result->rules.rules_len++; 670c5c4113dSnw 671c5c4113dSnw result->rules.rules_val[cb_data->next].is_user = 672cd37da74Snw strtol(argv[1], &end, 10); 673cd37da74Snw 674cd37da74Snw result->rules.rules_val[cb_data->next].is_wuser = 675cd37da74Snw strtol(argv[2], &end, 10); 676c5c4113dSnw 6778e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].windomain, 678cd37da74Snw argv[3]); 679c5c4113dSnw 6808e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].winname, 681cd37da74Snw argv[4]); 682c5c4113dSnw 683c5c4113dSnw result->rules.rules_val[cb_data->next].is_nt4 = 684cd37da74Snw strtol(argv[5], &end, 10); 685c5c4113dSnw 6868e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].unixname, 687cd37da74Snw argv[6]); 688c5c4113dSnw 689cd37da74Snw w2u_order = argv[7] ? strtol(argv[7], &end, 10) : 0; 690cd37da74Snw u2w_order = argv[8] ? strtol(argv[8], &end, 10) : 0; 691c5c4113dSnw 692c5c4113dSnw if (w2u_order > 0 && u2w_order == 0) 693651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 694651c0131Sbaban IDMAP_DIRECTION_W2U; 695c5c4113dSnw else if (w2u_order == 0 && u2w_order > 0) 696651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 697651c0131Sbaban IDMAP_DIRECTION_U2W; 698c5c4113dSnw else 699651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 700651c0131Sbaban IDMAP_DIRECTION_BI; 701c5c4113dSnw 702c5c4113dSnw result->lastrowid = strtoll(argv[0], &end, 10); 703c5c4113dSnw cb_data->next++; 704c5c4113dSnw result->retcode = IDMAP_SUCCESS; 705c5c4113dSnw return (0); 706c5c4113dSnw } 707c5c4113dSnw 708c5c4113dSnw 709c5c4113dSnw /* ARGSUSED */ 710c5c4113dSnw bool_t 711c5c4113dSnw idmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid, 712c5c4113dSnw uint64_t limit, idmap_namerules_res *result, 713cd37da74Snw struct svc_req *rqstp) 714cd37da74Snw { 715c5c4113dSnw 716c5c4113dSnw sqlite *db = NULL; 717c5c4113dSnw char lbuf[30], rbuf[30]; 718c5c4113dSnw char *sql = NULL; 719cd37da74Snw char *expr = NULL; 720c5c4113dSnw uint64_t maxlimit; 721c5c4113dSnw idmap_retcode retcode; 722c5c4113dSnw 723c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 724c5c4113dSnw 7250dcc7149Snw result->retcode = validate_rule(&rule); 7260dcc7149Snw if (result->retcode != IDMAP_SUCCESS) 7270dcc7149Snw goto out; 7280dcc7149Snw 729c5c4113dSnw RDLOCK_CONFIG(); 730c5c4113dSnw maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 731c5c4113dSnw UNLOCK_CONFIG(); 732c5c4113dSnw 733c5c4113dSnw /* Get db handle */ 734c5c4113dSnw result->retcode = get_db_handle(&db); 735c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 736c5c4113dSnw goto out; 737c5c4113dSnw 7380dcc7149Snw result->retcode = gen_sql_expr_from_rule(&rule, &expr); 7390dcc7149Snw if (result->retcode != IDMAP_SUCCESS) 740cd37da74Snw goto out; 741c5c4113dSnw 742c5c4113dSnw /* Create LIMIT expression. */ 743c5c4113dSnw if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 744c5c4113dSnw limit = maxlimit; 745c5c4113dSnw if (limit > 0) 746c5c4113dSnw (void) snprintf(lbuf, sizeof (lbuf), 747cd37da74Snw "LIMIT %" PRIu64, limit + 1ULL); 748bbf6f00cSJordan Brown else 749bbf6f00cSJordan Brown lbuf[0] = '\0'; 750c5c4113dSnw 751c5c4113dSnw (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 752c5c4113dSnw 753c5c4113dSnw /* 754c5c4113dSnw * Combine all the above into a giant SELECT statement that 755c5c4113dSnw * will return the requested rules 756c5c4113dSnw */ 757cd37da74Snw sql = sqlite_mprintf("SELECT rowid, is_user, is_wuser, windomain, " 758cd37da74Snw "winname_display, is_nt4, unixname, w2u_order, u2w_order " 759cd37da74Snw "FROM namerules WHERE " 760bbf6f00cSJordan Brown " %s %s %s;", 761bbf6f00cSJordan Brown rbuf, expr, lbuf); 762cd37da74Snw 763c5c4113dSnw if (sql == NULL) { 764479ac375Sdm result->retcode = IDMAP_ERR_MEMORY; 765c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 766c5c4113dSnw goto out; 767c5c4113dSnw } 768c5c4113dSnw 769c5c4113dSnw /* Execute the SQL statement and update the return buffer */ 77071590c90Snw PROCESS_LIST_SVC_SQL(retcode, db, IDMAP_DBNAME, sql, limit, 77148258c6bSjp 0, list_namerules_cb, result, result->rules.rules_len); 772c5c4113dSnw 773c5c4113dSnw out: 774cd37da74Snw if (expr) 775cd37da74Snw sqlite_freemem(expr); 776c5c4113dSnw if (sql) 777c5c4113dSnw sqlite_freemem(sql); 778c5c4113dSnw if (IDMAP_ERROR(result->retcode)) 779c5c4113dSnw (void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result); 780c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 781c5c4113dSnw return (TRUE); 782c5c4113dSnw } 783c5c4113dSnw 784c5c4113dSnw #define IDMAP_RULES_AUTH "solaris.admin.idmap.rules" 785c5c4113dSnw static int 786cd37da74Snw verify_rules_auth(struct svc_req *rqstp) 787cd37da74Snw { 788c5c4113dSnw ucred_t *uc = NULL; 789c5c4113dSnw uid_t uid; 790c5c4113dSnw char buf[1024]; 791c5c4113dSnw struct passwd pwd; 792c5c4113dSnw 793c5c4113dSnw if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) { 79471590c90Snw idmapdlog(LOG_ERR, "svc_getcallerucred failed during " 79571590c90Snw "authorization (%s)", strerror(errno)); 796c5c4113dSnw return (-1); 797c5c4113dSnw } 798c5c4113dSnw 799c5c4113dSnw uid = ucred_geteuid(uc); 800c5c4113dSnw if (uid == (uid_t)-1) { 80171590c90Snw idmapdlog(LOG_ERR, "ucred_geteuid failed during " 80271590c90Snw "authorization (%s)", strerror(errno)); 803c5c4113dSnw ucred_free(uc); 804c5c4113dSnw return (-1); 805c5c4113dSnw } 806c5c4113dSnw 807c5c4113dSnw if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) { 80871590c90Snw idmapdlog(LOG_ERR, "getpwuid_r(%u) failed during " 80971590c90Snw "authorization (%s)", uid, strerror(errno)); 810c5c4113dSnw ucred_free(uc); 811c5c4113dSnw return (-1); 812c5c4113dSnw } 813c5c4113dSnw 814c5c4113dSnw if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) { 81571590c90Snw idmapdlog(LOG_INFO, "%s is not authorized (%s)", 81671590c90Snw pwd.pw_name, IDMAP_RULES_AUTH); 817c5c4113dSnw ucred_free(uc); 818c5c4113dSnw return (-1); 819c5c4113dSnw } 820c5c4113dSnw 821c5c4113dSnw ucred_free(uc); 822c5c4113dSnw return (1); 823c5c4113dSnw } 824c5c4113dSnw 8258e228215Sdm /* 8268e228215Sdm * Meaning of the return values is the following: For retcode == 8278e228215Sdm * IDMAP_SUCCESS, everything went OK and error_index is 8288e228215Sdm * undefined. Otherwise, error_index >=0 shows the failed batch 8298e228215Sdm * element. errro_index == -1 indicates failure at the beginning, 8308e228215Sdm * error_index == -2 at the end. 8318e228215Sdm */ 8328e228215Sdm 833c5c4113dSnw /* ARGSUSED */ 834c5c4113dSnw bool_t 8358e228215Sdm idmap_update_1_svc(idmap_update_batch batch, idmap_update_res *res, 836cd37da74Snw struct svc_req *rqstp) 837cd37da74Snw { 838c5c4113dSnw sqlite *db = NULL; 839c5c4113dSnw idmap_update_op *up; 840c5c4113dSnw int i; 84184decf41Sjp int trans = FALSE; 842c5c4113dSnw 8438e228215Sdm res->error_index = -1; 8448e228215Sdm (void) memset(&res->error_rule, 0, sizeof (res->error_rule)); 8458e228215Sdm (void) memset(&res->conflict_rule, 0, sizeof (res->conflict_rule)); 8468e228215Sdm 847c5c4113dSnw if (verify_rules_auth(rqstp) < 0) { 8488e228215Sdm res->retcode = IDMAP_ERR_PERMISSION_DENIED; 849c5c4113dSnw goto out; 850c5c4113dSnw } 851c5c4113dSnw 852c5c4113dSnw if (batch.idmap_update_batch_len == 0 || 853cd37da74Snw batch.idmap_update_batch_val == NULL) { 8548e228215Sdm res->retcode = IDMAP_SUCCESS; 855c5c4113dSnw goto out; 856c5c4113dSnw } 857c5c4113dSnw 8580dcc7149Snw res->retcode = validate_rules(&batch); 8590dcc7149Snw if (res->retcode != IDMAP_SUCCESS) 8600dcc7149Snw goto out; 8610dcc7149Snw 862c5c4113dSnw /* Get db handle */ 8638e228215Sdm res->retcode = get_db_handle(&db); 8648e228215Sdm if (res->retcode != IDMAP_SUCCESS) 865c5c4113dSnw goto out; 866c5c4113dSnw 86771590c90Snw res->retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "BEGIN TRANSACTION;"); 8688e228215Sdm if (res->retcode != IDMAP_SUCCESS) 869c5c4113dSnw goto out; 87084decf41Sjp trans = TRUE; 871c5c4113dSnw 872c5c4113dSnw for (i = 0; i < batch.idmap_update_batch_len; i++) { 873c5c4113dSnw up = &batch.idmap_update_batch_val[i]; 874c5c4113dSnw switch (up->opnum) { 875c5c4113dSnw case OP_NONE: 8768e228215Sdm res->retcode = IDMAP_SUCCESS; 877c5c4113dSnw break; 878c5c4113dSnw case OP_ADD_NAMERULE: 8798e228215Sdm res->retcode = add_namerule(db, 880cd37da74Snw &up->idmap_update_op_u.rule); 881c5c4113dSnw break; 882c5c4113dSnw case OP_RM_NAMERULE: 8838e228215Sdm res->retcode = rm_namerule(db, 884cd37da74Snw &up->idmap_update_op_u.rule); 885c5c4113dSnw break; 886c5c4113dSnw case OP_FLUSH_NAMERULES: 887cd37da74Snw res->retcode = flush_namerules(db); 888c5c4113dSnw break; 889c5c4113dSnw default: 8908e228215Sdm res->retcode = IDMAP_ERR_NOTSUPPORTED; 8918e228215Sdm break; 892c5c4113dSnw }; 893c5c4113dSnw 8948e228215Sdm if (res->retcode != IDMAP_SUCCESS) { 8958e228215Sdm res->error_index = i; 8968e228215Sdm if (up->opnum == OP_ADD_NAMERULE || 8978e228215Sdm up->opnum == OP_RM_NAMERULE) { 8988e228215Sdm idmap_stat r2 = 8998e228215Sdm idmap_namerule_cpy(&res->error_rule, 900cd37da74Snw &up->idmap_update_op_u.rule); 9018e228215Sdm if (r2 != IDMAP_SUCCESS) 9028e228215Sdm res->retcode = r2; 9038e228215Sdm } 904c5c4113dSnw goto out; 9058e228215Sdm } 906c5c4113dSnw } 907c5c4113dSnw 908c5c4113dSnw out: 90984decf41Sjp if (trans) { 9108e228215Sdm if (res->retcode == IDMAP_SUCCESS) { 9118e228215Sdm res->retcode = 91271590c90Snw sql_exec_no_cb(db, IDMAP_DBNAME, 91371590c90Snw "COMMIT TRANSACTION;"); 914*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (res->retcode == IDMAP_SUCCESS) { 915*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States /* 916*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * We've updated the rules. Expire the cache 917*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * so that existing mappings will be 918*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * reconsidered. 919*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States */ 920*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->retcode = 921*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_cache_flush(IDMAP_FLUSH_EXPIRE); 922*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } else { 9238e228215Sdm res->error_index = -2; 924*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 9258e228215Sdm } 92684decf41Sjp else 92771590c90Snw (void) sql_exec_no_cb(db, IDMAP_DBNAME, 92871590c90Snw "ROLLBACK TRANSACTION;"); 929c5c4113dSnw } 9308e228215Sdm 9318e228215Sdm res->retcode = idmap_stat4prot(res->retcode); 9328e228215Sdm 933c5c4113dSnw return (TRUE); 934c5c4113dSnw } 935c5c4113dSnw 936fe1c642dSBill Krier static 937fe1c642dSBill Krier int 938fe1c642dSBill Krier copy_string(char **to, char *from) 939fe1c642dSBill Krier { 940fe1c642dSBill Krier if (EMPTY_STRING(from)) { 941fe1c642dSBill Krier *to = NULL; 942fe1c642dSBill Krier } else { 943fe1c642dSBill Krier *to = strdup(from); 944fe1c642dSBill Krier if (*to == NULL) { 945fe1c642dSBill Krier idmapdlog(LOG_ERR, "Out of memory"); 946fe1c642dSBill Krier return (IDMAP_ERR_MEMORY); 947fe1c642dSBill Krier } 948fe1c642dSBill Krier } 949fe1c642dSBill Krier return (IDMAP_SUCCESS); 950fe1c642dSBill Krier } 951fe1c642dSBill Krier 952fe1c642dSBill Krier static 953fe1c642dSBill Krier int 954fe1c642dSBill Krier copy_id(idmap_id *to, idmap_id *from) 955fe1c642dSBill Krier { 956fe1c642dSBill Krier (void) memset(to, 0, sizeof (*to)); 957fe1c642dSBill Krier 958fe1c642dSBill Krier to->idtype = from->idtype; 959fe1c642dSBill Krier if (IS_ID_SID(*from)) { 960fe1c642dSBill Krier idmap_retcode retcode; 961fe1c642dSBill Krier 962fe1c642dSBill Krier to->idmap_id_u.sid.rid = from->idmap_id_u.sid.rid; 963fe1c642dSBill Krier retcode = copy_string(&to->idmap_id_u.sid.prefix, 964fe1c642dSBill Krier from->idmap_id_u.sid.prefix); 965fe1c642dSBill Krier 966fe1c642dSBill Krier return (retcode); 967fe1c642dSBill Krier } else { 968fe1c642dSBill Krier to->idmap_id_u.uid = from->idmap_id_u.uid; 969fe1c642dSBill Krier return (IDMAP_SUCCESS); 970fe1c642dSBill Krier } 971fe1c642dSBill Krier } 972fe1c642dSBill Krier 973fe1c642dSBill Krier static 974fe1c642dSBill Krier int 975fe1c642dSBill Krier copy_mapping(idmap_mapping *mapping, idmap_mapping *request) 976fe1c642dSBill Krier { 977fe1c642dSBill Krier idmap_retcode retcode; 978fe1c642dSBill Krier 979fe1c642dSBill Krier (void) memset(mapping, 0, sizeof (*mapping)); 980fe1c642dSBill Krier 981fe1c642dSBill Krier mapping->flag = request->flag; 982fe1c642dSBill Krier mapping->direction = _IDMAP_F_DONE; 983fe1c642dSBill Krier 984fe1c642dSBill Krier retcode = copy_id(&mapping->id1, &request->id1); 985fe1c642dSBill Krier if (retcode != IDMAP_SUCCESS) 986fe1c642dSBill Krier goto errout; 987fe1c642dSBill Krier 988fe1c642dSBill Krier retcode = copy_string(&mapping->id1domain, request->id1domain); 989fe1c642dSBill Krier if (retcode != IDMAP_SUCCESS) 990fe1c642dSBill Krier goto errout; 991fe1c642dSBill Krier 992fe1c642dSBill Krier retcode = copy_string(&mapping->id1name, request->id1name); 993fe1c642dSBill Krier if (retcode != IDMAP_SUCCESS) 994fe1c642dSBill Krier goto errout; 995fe1c642dSBill Krier 996fe1c642dSBill Krier retcode = copy_id(&mapping->id2, &request->id2); 997fe1c642dSBill Krier if (retcode != IDMAP_SUCCESS) 998fe1c642dSBill Krier goto errout; 999fe1c642dSBill Krier 1000fe1c642dSBill Krier retcode = copy_string(&mapping->id2domain, request->id2domain); 1001fe1c642dSBill Krier if (retcode != IDMAP_SUCCESS) 1002fe1c642dSBill Krier goto errout; 1003fe1c642dSBill Krier retcode = copy_string(&mapping->id2name, request->id2name); 1004fe1c642dSBill Krier if (retcode != IDMAP_SUCCESS) 1005fe1c642dSBill Krier goto errout; 1006fe1c642dSBill Krier 1007fe1c642dSBill Krier return (IDMAP_SUCCESS); 1008fe1c642dSBill Krier 1009fe1c642dSBill Krier errout: 1010fe1c642dSBill Krier if (IS_ID_SID(mapping->id1)) 1011fe1c642dSBill Krier free(mapping->id1.idmap_id_u.sid.prefix); 1012fe1c642dSBill Krier free(mapping->id1domain); 1013fe1c642dSBill Krier free(mapping->id1name); 1014fe1c642dSBill Krier if (IS_ID_SID(mapping->id2)) 1015fe1c642dSBill Krier free(mapping->id2.idmap_id_u.sid.prefix); 1016fe1c642dSBill Krier free(mapping->id2domain); 1017fe1c642dSBill Krier free(mapping->id2name); 1018fe1c642dSBill Krier 1019fe1c642dSBill Krier (void) memset(mapping, 0, sizeof (*mapping)); 1020fe1c642dSBill Krier return (retcode); 1021fe1c642dSBill Krier } 1022fe1c642dSBill Krier 1023c5c4113dSnw 1024c5c4113dSnw /* ARGSUSED */ 1025c5c4113dSnw bool_t 1026c5c4113dSnw idmap_get_mapped_id_by_name_1_svc(idmap_mapping request, 1027cd37da74Snw idmap_mappings_res *result, struct svc_req *rqstp) 1028cd37da74Snw { 1029fe1c642dSBill Krier idmap_mapping_batch batch_request; 1030fe1c642dSBill Krier idmap_ids_res batch_result; 1031fe1c642dSBill Krier idmap_mapping *map; 1032c5c4113dSnw 1033fe1c642dSBill Krier /* Clear out things we might want to xdr_free on error */ 1034fe1c642dSBill Krier (void) memset(&batch_result, 0, sizeof (batch_result)); 1035c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 1036c5c4113dSnw 10370dcc7149Snw result->retcode = validate_mapped_id_by_name_req(&request); 10380dcc7149Snw if (result->retcode != IDMAP_SUCCESS) 10390dcc7149Snw goto out; 10400dcc7149Snw 1041fe1c642dSBill Krier /* 1042fe1c642dSBill Krier * Copy the request. We need to modify it, and 1043fe1c642dSBill Krier * what we have is a shallow copy. Freeing pointers from 1044fe1c642dSBill Krier * our copy will lead to problems, since the RPC framework 1045fe1c642dSBill Krier * has its own copy of those pointers. Besides, we need 1046fe1c642dSBill Krier * a copy to return. 1047fe1c642dSBill Krier */ 1048fe1c642dSBill Krier map = calloc(1, sizeof (idmap_mapping)); 1049fe1c642dSBill Krier if (map == NULL) { 1050fe1c642dSBill Krier idmapdlog(LOG_ERR, "Out of memory"); 1051fe1c642dSBill Krier result->retcode = IDMAP_ERR_MEMORY; 1052c5c4113dSnw goto out; 1053fe1c642dSBill Krier } 1054c5c4113dSnw 1055fe1c642dSBill Krier /* 1056fe1c642dSBill Krier * Set up to return the filled-in mapping structure. 1057fe1c642dSBill Krier * Note that we xdr_free result on error, and that'll take 1058fe1c642dSBill Krier * care of freeing the mapping structure. 1059fe1c642dSBill Krier */ 1060fe1c642dSBill Krier result->mappings.mappings_val = map; 1061fe1c642dSBill Krier result->mappings.mappings_len = 1; 1062fe1c642dSBill Krier 1063fe1c642dSBill Krier result->retcode = copy_mapping(map, &request); 1064c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 1065c5c4113dSnw goto out; 1066c5c4113dSnw 1067fe1c642dSBill Krier /* Set up for the request to the batch API */ 1068fe1c642dSBill Krier batch_request.idmap_mapping_batch_val = map; 1069fe1c642dSBill Krier batch_request.idmap_mapping_batch_len = 1; 1070fe1c642dSBill Krier 1071fe1c642dSBill Krier /* Do the real work. */ 1072fe1c642dSBill Krier (void) idmap_get_mapped_ids_1_svc(batch_request, 1073fe1c642dSBill Krier &batch_result, rqstp); 1074fe1c642dSBill Krier 1075fe1c642dSBill Krier /* Copy what we need out of the batch response */ 1076fe1c642dSBill Krier 1077fe1c642dSBill Krier if (batch_result.retcode != IDMAP_SUCCESS) { 1078fe1c642dSBill Krier result->retcode = batch_result.retcode; 1079c5c4113dSnw goto out; 1080c5c4113dSnw } 1081c5c4113dSnw 1082fe1c642dSBill Krier result->retcode = copy_id(&map->id2, &batch_result.ids.ids_val[0].id); 1083fe1c642dSBill Krier if (result->retcode != IDMAP_SUCCESS) 1084fe1c642dSBill Krier goto out; 1085cd37da74Snw 1086fe1c642dSBill Krier map->direction = batch_result.ids.ids_val[0].direction; 1087fe1c642dSBill Krier 1088fe1c642dSBill Krier result->retcode = batch_result.ids.ids_val[0].retcode; 1089fe1c642dSBill Krier 1090fe1c642dSBill Krier if (map->flag & IDMAP_REQ_FLG_MAPPING_INFO || 1091fe1c642dSBill Krier result->retcode != IDMAP_SUCCESS) { 1092fe1c642dSBill Krier (void) idmap_info_mov(&map->info, 1093fe1c642dSBill Krier &batch_result.ids.ids_val[0].info); 1094c5c4113dSnw } 1095c5c4113dSnw 1096c5c4113dSnw out: 1097c5c4113dSnw if (IDMAP_FATAL_ERROR(result->retcode)) { 1098c5c4113dSnw xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 1099c5c4113dSnw result->mappings.mappings_len = 0; 1100c5c4113dSnw result->mappings.mappings_val = NULL; 1101c5c4113dSnw } 1102c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 1103fe1c642dSBill Krier 1104fe1c642dSBill Krier xdr_free(xdr_idmap_ids_res, (char *)&batch_result); 1105fe1c642dSBill Krier 1106c5c4113dSnw return (TRUE); 1107c5c4113dSnw } 1108c5c4113dSnw 1109479ac375Sdm /* ARGSUSED */ 1110479ac375Sdm bool_t 1111479ac375Sdm idmap_get_prop_1_svc(idmap_prop_type request, 1112479ac375Sdm idmap_prop_res *result, struct svc_req *rqstp) 1113479ac375Sdm { 1114479ac375Sdm idmap_pg_config_t *pgcfg; 1115479ac375Sdm 1116479ac375Sdm /* Init */ 1117479ac375Sdm (void) memset(result, 0, sizeof (*result)); 1118479ac375Sdm result->retcode = IDMAP_SUCCESS; 1119479ac375Sdm result->value.prop = request; 1120479ac375Sdm 1121479ac375Sdm RDLOCK_CONFIG(); 1122479ac375Sdm 1123479ac375Sdm /* Just shortcuts: */ 1124479ac375Sdm pgcfg = &_idmapdstate.cfg->pgcfg; 11254d61c878SJulian Pullen 1126479ac375Sdm 1127479ac375Sdm switch (request) { 1128479ac375Sdm case PROP_LIST_SIZE_LIMIT: 1129479ac375Sdm result->value.idmap_prop_val_u.intval = pgcfg->list_size_limit; 1130479ac375Sdm result->auto_discovered = FALSE; 1131479ac375Sdm break; 1132479ac375Sdm case PROP_DEFAULT_DOMAIN: 1133479ac375Sdm result->auto_discovered = FALSE; 1134479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1135479ac375Sdm pgcfg->default_domain); 1136479ac375Sdm break; 1137479ac375Sdm case PROP_DOMAIN_NAME: 1138479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1139479ac375Sdm pgcfg->domain_name); 1140479ac375Sdm result->auto_discovered = 11414d61c878SJulian Pullen pgcfg->domain_name_auto_disc; 1142479ac375Sdm break; 1143479ac375Sdm case PROP_MACHINE_SID: 1144479ac375Sdm result->auto_discovered = FALSE; 1145479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1146479ac375Sdm pgcfg->machine_sid); 1147479ac375Sdm break; 1148479ac375Sdm case PROP_DOMAIN_CONTROLLER: 1149479ac375Sdm if (pgcfg->domain_controller != NULL) { 1150479ac375Sdm (void) memcpy(&result->value.idmap_prop_val_u.dsval, 1151479ac375Sdm pgcfg->domain_controller, 1152479ac375Sdm sizeof (idmap_ad_disc_ds_t)); 1153479ac375Sdm } 11544d61c878SJulian Pullen result->auto_discovered = pgcfg->domain_controller_auto_disc; 1155479ac375Sdm break; 1156479ac375Sdm case PROP_FOREST_NAME: 1157479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1158479ac375Sdm pgcfg->forest_name); 11594d61c878SJulian Pullen result->auto_discovered = pgcfg->forest_name_auto_disc; 1160479ac375Sdm break; 1161479ac375Sdm case PROP_SITE_NAME: 1162479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1163479ac375Sdm pgcfg->site_name); 11644d61c878SJulian Pullen result->auto_discovered = pgcfg->site_name_auto_disc; 1165479ac375Sdm break; 1166479ac375Sdm case PROP_GLOBAL_CATALOG: 1167479ac375Sdm if (pgcfg->global_catalog != NULL) { 1168479ac375Sdm (void) memcpy(&result->value.idmap_prop_val_u.dsval, 1169479ac375Sdm pgcfg->global_catalog, sizeof (idmap_ad_disc_ds_t)); 1170479ac375Sdm } 11714d61c878SJulian Pullen result->auto_discovered = pgcfg->global_catalog_auto_disc; 1172479ac375Sdm break; 1173479ac375Sdm case PROP_AD_UNIXUSER_ATTR: 1174479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1175479ac375Sdm pgcfg->ad_unixuser_attr); 1176479ac375Sdm result->auto_discovered = FALSE; 1177479ac375Sdm break; 1178479ac375Sdm case PROP_AD_UNIXGROUP_ATTR: 1179479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1180479ac375Sdm pgcfg->ad_unixgroup_attr); 1181479ac375Sdm result->auto_discovered = FALSE; 1182479ac375Sdm break; 1183479ac375Sdm case PROP_NLDAP_WINNAME_ATTR: 1184479ac375Sdm STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1185479ac375Sdm pgcfg->nldap_winname_attr); 1186479ac375Sdm result->auto_discovered = FALSE; 1187479ac375Sdm break; 1188e3f2c991SKeyur Desai case PROP_DIRECTORY_BASED_MAPPING: 1189e3f2c991SKeyur Desai STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1190e3f2c991SKeyur Desai enum_lookup(pgcfg->directory_based_mapping, 1191e3f2c991SKeyur Desai directory_mapping_map)); 1192479ac375Sdm result->auto_discovered = FALSE; 1193479ac375Sdm break; 1194479ac375Sdm default: 1195479ac375Sdm result->retcode = IDMAP_ERR_PROP_UNKNOWN; 1196479ac375Sdm break; 1197479ac375Sdm } 1198479ac375Sdm 1199479ac375Sdm out: 1200479ac375Sdm UNLOCK_CONFIG(); 1201479ac375Sdm if (IDMAP_FATAL_ERROR(result->retcode)) { 1202479ac375Sdm xdr_free(xdr_idmap_prop_res, (caddr_t)result); 1203479ac375Sdm result->value.prop = PROP_UNKNOWN; 1204479ac375Sdm } 1205479ac375Sdm result->retcode = idmap_stat4prot(result->retcode); 1206479ac375Sdm return (TRUE); 1207479ac375Sdm } 1208479ac375Sdm 1209*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States int 1210*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_flush_1_svc( 1211*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_flush_op op, 1212*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode *result, 1213*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States struct svc_req *rqstp) 1214*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States { 1215*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States NOTE(ARGUNUSED(rqstp)) 1216*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (verify_rules_auth(rqstp) < 0) { 1217*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States *result = IDMAP_ERR_PERMISSION_DENIED; 1218*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (TRUE); 1219*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 1220*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 1221*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States *result = idmap_cache_flush(op); 1222*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 1223*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (TRUE); 1224*9fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 1225c5c4113dSnw 1226c5c4113dSnw /* ARGSUSED */ 1227c5c4113dSnw int 1228c5c4113dSnw idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, 1229cd37da74Snw caddr_t result) 1230cd37da74Snw { 1231c5c4113dSnw (void) xdr_free(xdr_result, result); 1232c5c4113dSnw return (TRUE); 1233c5c4113dSnw } 12341fcced4cSJordan Brown 12351fcced4cSJordan Brown /* 12361fcced4cSJordan Brown * This function is called by rpc_svc.c when it encounters an error. 12371fcced4cSJordan Brown */ 12381fcced4cSJordan Brown NOTE(PRINTFLIKE(1)) 12391fcced4cSJordan Brown void 12401fcced4cSJordan Brown idmap_rpc_msgout(const char *fmt, ...) 12411fcced4cSJordan Brown { 12421fcced4cSJordan Brown va_list va; 12431fcced4cSJordan Brown char buf[1000]; 12441fcced4cSJordan Brown 12451fcced4cSJordan Brown va_start(va, fmt); 12461fcced4cSJordan Brown (void) vsnprintf(buf, sizeof (buf), fmt, va); 12471fcced4cSJordan Brown va_end(va); 12481fcced4cSJordan Brown 12491fcced4cSJordan Brown idmapdlog(LOG_ERR, "idmap RPC: %s", buf); 12501fcced4cSJordan Brown } 1251