1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 22c5c4113dSnw * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23c5c4113dSnw * Use is subject to license terms. 24c5c4113dSnw */ 25c5c4113dSnw 26c5c4113dSnw #pragma ident "%Z%%M% %I% %E% SMI" 27c5c4113dSnw 28c5c4113dSnw /* 29c5c4113dSnw * Service routines 30c5c4113dSnw */ 31c5c4113dSnw 32c5c4113dSnw #include "idmapd.h" 33c5c4113dSnw #include "idmap_priv.h" 34*e8c27ec8Sbaban #include "nldaputils.h" 35c5c4113dSnw #include <signal.h> 36c5c4113dSnw #include <thread.h> 37c5c4113dSnw #include <string.h> 38c5c4113dSnw #include <strings.h> 39c5c4113dSnw #include <errno.h> 40c5c4113dSnw #include <assert.h> 41c5c4113dSnw #include <sys/types.h> 42c5c4113dSnw #include <sys/stat.h> 43c5c4113dSnw #include <ucred.h> 44c5c4113dSnw #include <pwd.h> 45c5c4113dSnw #include <auth_attr.h> 46c5c4113dSnw #include <secdb.h> 47c5c4113dSnw 48c5c4113dSnw #define _VALIDATE_LIST_CB_DATA(col, val, siz)\ 49c5c4113dSnw retcode = validate_list_cb_data(cb_data, argc, argv, col,\ 50c5c4113dSnw (uchar_t **)val, siz);\ 51c5c4113dSnw if (retcode == IDMAP_NEXT) {\ 52c5c4113dSnw result->retcode = IDMAP_NEXT;\ 53c5c4113dSnw return (0);\ 54c5c4113dSnw } else if (retcode < 0) {\ 55c5c4113dSnw result->retcode = retcode;\ 56c5c4113dSnw return (1);\ 57c5c4113dSnw } 58c5c4113dSnw 59c5c4113dSnw #define PROCESS_LIST_SVC_SQL(rcode, db, sql, limit, cb, res, len)\ 60c5c4113dSnw rcode = process_list_svc_sql(db, sql, limit, cb, res);\ 61c5c4113dSnw if (rcode == IDMAP_ERR_BUSY)\ 62c5c4113dSnw res->retcode = IDMAP_ERR_BUSY;\ 63c5c4113dSnw else if (rcode == IDMAP_SUCCESS && len == 0)\ 64c5c4113dSnw res->retcode = IDMAP_ERR_NOTFOUND; 65c5c4113dSnw 66c5c4113dSnw 678e228215Sdm #define STRDUP_OR_FAIL(to, from) \ 688e228215Sdm if ((from) == NULL) \ 698e228215Sdm to = NULL; \ 708e228215Sdm else { \ 718e228215Sdm if ((to = strdup(from)) == NULL) \ 728e228215Sdm return (1); \ 738e228215Sdm } 748e228215Sdm 75c5c4113dSnw /* ARGSUSED */ 76c5c4113dSnw bool_t 77cd37da74Snw idmap_null_1_svc(void *result, struct svc_req *rqstp) 78cd37da74Snw { 79c5c4113dSnw return (TRUE); 80c5c4113dSnw } 81c5c4113dSnw 82334e3463Sbaban /* 83334e3463Sbaban * RPC layer allocates empty strings to replace NULL char *. 84334e3463Sbaban * This utility function frees these empty strings. 85334e3463Sbaban */ 86*e8c27ec8Sbaban static 87*e8c27ec8Sbaban void 88334e3463Sbaban sanitize_mapping_request(idmap_mapping *req) 89334e3463Sbaban { 90334e3463Sbaban free(req->id1name); 91334e3463Sbaban req->id1name = NULL; 92334e3463Sbaban free(req->id1domain); 93334e3463Sbaban req->id1domain = NULL; 94334e3463Sbaban free(req->id2name); 95334e3463Sbaban req->id2name = NULL; 96334e3463Sbaban free(req->id2domain); 97334e3463Sbaban req->id2domain = NULL; 98*e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 99334e3463Sbaban } 100334e3463Sbaban 101c5c4113dSnw /* ARGSUSED */ 102c5c4113dSnw bool_t 103c5c4113dSnw idmap_get_mapped_ids_1_svc(idmap_mapping_batch batch, 104cd37da74Snw idmap_ids_res *result, struct svc_req *rqstp) 105cd37da74Snw { 106c5c4113dSnw sqlite *cache = NULL, *db = NULL; 107c5c4113dSnw lookup_state_t state; 108*e8c27ec8Sbaban idmap_retcode retcode; 10962c60062Sbaban uint_t i; 110c5c4113dSnw 111c5c4113dSnw /* Init */ 112c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 113c5c4113dSnw (void) memset(&state, 0, sizeof (state)); 114c5c4113dSnw 115c5c4113dSnw /* Return success if nothing was requested */ 116c5c4113dSnw if (batch.idmap_mapping_batch_len < 1) 117c5c4113dSnw goto out; 118c5c4113dSnw 119c5c4113dSnw /* Get cache handle */ 120c5c4113dSnw result->retcode = get_cache_handle(&cache); 121c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 122c5c4113dSnw goto out; 123c5c4113dSnw 124c5c4113dSnw /* Get db handle */ 125c5c4113dSnw result->retcode = get_db_handle(&db); 126c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 127c5c4113dSnw goto out; 128c5c4113dSnw 129c5c4113dSnw /* Allocate result array */ 130c5c4113dSnw result->ids.ids_val = calloc(batch.idmap_mapping_batch_len, 131cd37da74Snw sizeof (idmap_id_res)); 132c5c4113dSnw if (result->ids.ids_val == NULL) { 133c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 134c5c4113dSnw result->retcode = IDMAP_ERR_MEMORY; 135c5c4113dSnw goto out; 136c5c4113dSnw } 137c5c4113dSnw result->ids.ids_len = batch.idmap_mapping_batch_len; 138c5c4113dSnw 13962c60062Sbaban /* Allocate hash table to check for duplicate sids */ 14062c60062Sbaban state.sid_history = calloc(batch.idmap_mapping_batch_len, 141cd37da74Snw sizeof (*state.sid_history)); 14262c60062Sbaban if (state.sid_history == NULL) { 14362c60062Sbaban idmapdlog(LOG_ERR, "Out of memory"); 14462c60062Sbaban result->retcode = IDMAP_ERR_MEMORY; 14562c60062Sbaban goto out; 14662c60062Sbaban } 14762c60062Sbaban state.sid_history_size = batch.idmap_mapping_batch_len; 14862c60062Sbaban for (i = 0; i < state.sid_history_size; i++) { 14962c60062Sbaban state.sid_history[i].key = state.sid_history_size; 15062c60062Sbaban state.sid_history[i].next = state.sid_history_size; 15162c60062Sbaban } 15262c60062Sbaban state.batch = &batch; 15362c60062Sbaban state.result = result; 15462c60062Sbaban 155*e8c27ec8Sbaban /* Get directory-based name mapping info */ 156*e8c27ec8Sbaban result->retcode = get_ds_namemap_type(&state); 157*e8c27ec8Sbaban if (result->retcode != IDMAP_SUCCESS) 158*e8c27ec8Sbaban goto out; 159*e8c27ec8Sbaban 160c5c4113dSnw /* Init our 'done' flags */ 161c5c4113dSnw state.sid2pid_done = state.pid2sid_done = TRUE; 162c5c4113dSnw 163c5c4113dSnw /* First stage */ 164c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 16562c60062Sbaban state.curpos = i; 166334e3463Sbaban (void) sanitize_mapping_request( 167334e3463Sbaban &batch.idmap_mapping_batch_val[i]); 168c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 169c5c4113dSnw retcode = sid2pid_first_pass( 170cd37da74Snw &state, 171cd37da74Snw cache, 172cd37da74Snw &batch.idmap_mapping_batch_val[i], 173cd37da74Snw &result->ids.ids_val[i]); 174c5c4113dSnw } else if (IS_BATCH_UID(batch, i)) { 175c5c4113dSnw retcode = pid2sid_first_pass( 176cd37da74Snw &state, 177cd37da74Snw cache, 178cd37da74Snw &batch.idmap_mapping_batch_val[i], 179cd37da74Snw &result->ids.ids_val[i], 1, 0); 180c5c4113dSnw } else if (IS_BATCH_GID(batch, i)) { 181c5c4113dSnw retcode = pid2sid_first_pass( 182cd37da74Snw &state, 183cd37da74Snw cache, 184cd37da74Snw &batch.idmap_mapping_batch_val[i], 185cd37da74Snw &result->ids.ids_val[i], 0, 0); 186c5c4113dSnw } else { 187c5c4113dSnw result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE; 188c5c4113dSnw continue; 189c5c4113dSnw } 190c5c4113dSnw if (IDMAP_FATAL_ERROR(retcode)) { 191c5c4113dSnw result->retcode = retcode; 192c5c4113dSnw goto out; 193c5c4113dSnw } 194c5c4113dSnw } 195c5c4113dSnw 196c5c4113dSnw /* Check if we are done */ 197c5c4113dSnw if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 198c5c4113dSnw goto out; 199c5c4113dSnw 200*e8c27ec8Sbaban /* 201*e8c27ec8Sbaban * native LDAP lookups: 202*e8c27ec8Sbaban * If nldap or mixed mode is enabled then pid2sid mapping requests 203*e8c27ec8Sbaban * need to lookup native LDAP directory service by uid/gid to get 204*e8c27ec8Sbaban * winname and unixname. 205*e8c27ec8Sbaban */ 206*e8c27ec8Sbaban if (state.nldap_nqueries) { 207*e8c27ec8Sbaban retcode = nldap_lookup_batch(&state, &batch, result); 208*e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 209*e8c27ec8Sbaban result->retcode = retcode; 210*e8c27ec8Sbaban goto out; 211*e8c27ec8Sbaban } 212*e8c27ec8Sbaban } 213*e8c27ec8Sbaban 214*e8c27ec8Sbaban /* 215*e8c27ec8Sbaban * AD lookups: 216*e8c27ec8Sbaban * 1. The pid2sid requests in the preceding step which successfully 217*e8c27ec8Sbaban * retrieved winname from native LDAP objects will now need to 218*e8c27ec8Sbaban * lookup AD by winname to get sid. 219*e8c27ec8Sbaban * 2. The sid2pid requests will need to lookup AD by sid to get 220*e8c27ec8Sbaban * winname and unixname (AD or mixed mode). 221*e8c27ec8Sbaban * 3. If AD-based name mapping is enabled then pid2sid mapping 222*e8c27ec8Sbaban * requests need to lookup AD by unixname to get winname and sid. 223*e8c27ec8Sbaban */ 224c5c4113dSnw if (state.ad_nqueries) { 225*e8c27ec8Sbaban retcode = ad_lookup_batch(&state, &batch, result); 226*e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 227*e8c27ec8Sbaban result->retcode = retcode; 228*e8c27ec8Sbaban goto out; 229*e8c27ec8Sbaban } 230*e8c27ec8Sbaban } 231*e8c27ec8Sbaban 232*e8c27ec8Sbaban /* 233*e8c27ec8Sbaban * native LDAP lookups: 234*e8c27ec8Sbaban * If nldap mode is enabled then sid2pid mapping requests 235*e8c27ec8Sbaban * which successfully retrieved winname from AD objects in the 236*e8c27ec8Sbaban * preceding step, will now need to lookup native LDAP directory 237*e8c27ec8Sbaban * service by winname to get unixname and pid. 238*e8c27ec8Sbaban */ 239*e8c27ec8Sbaban if (state.nldap_nqueries) { 240*e8c27ec8Sbaban retcode = nldap_lookup_batch(&state, &batch, result); 241*e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 242*e8c27ec8Sbaban result->retcode = retcode; 243c5c4113dSnw goto out; 244c5c4113dSnw } 245*e8c27ec8Sbaban } 246c5c4113dSnw 247*e8c27ec8Sbaban /* Reset 'done' flags */ 248*e8c27ec8Sbaban state.sid2pid_done = state.pid2sid_done = TRUE; 249c5c4113dSnw 250c5c4113dSnw /* Second stage */ 251c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 25262c60062Sbaban state.curpos = i; 253c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 254c5c4113dSnw retcode = sid2pid_second_pass( 255cd37da74Snw &state, 256cd37da74Snw cache, 257cd37da74Snw db, 258cd37da74Snw &batch.idmap_mapping_batch_val[i], 259cd37da74Snw &result->ids.ids_val[i]); 260*e8c27ec8Sbaban } else if (IS_BATCH_UID(batch, i)) { 261*e8c27ec8Sbaban retcode = pid2sid_second_pass( 262*e8c27ec8Sbaban &state, 263*e8c27ec8Sbaban cache, 264*e8c27ec8Sbaban db, 265*e8c27ec8Sbaban &batch.idmap_mapping_batch_val[i], 266*e8c27ec8Sbaban &result->ids.ids_val[i], 1); 267*e8c27ec8Sbaban } else if (IS_BATCH_GID(batch, i)) { 268*e8c27ec8Sbaban retcode = pid2sid_second_pass( 269*e8c27ec8Sbaban &state, 270*e8c27ec8Sbaban cache, 271*e8c27ec8Sbaban db, 272*e8c27ec8Sbaban &batch.idmap_mapping_batch_val[i], 273*e8c27ec8Sbaban &result->ids.ids_val[i], 0); 274*e8c27ec8Sbaban } else { 275*e8c27ec8Sbaban /* First stage has already set the error */ 276*e8c27ec8Sbaban continue; 277*e8c27ec8Sbaban } 278*e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) { 279*e8c27ec8Sbaban result->retcode = retcode; 280*e8c27ec8Sbaban goto out; 281c5c4113dSnw } 282c5c4113dSnw } 283c5c4113dSnw 284c5c4113dSnw /* Check if we are done */ 285c5c4113dSnw if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 286c5c4113dSnw goto out; 287c5c4113dSnw 288c5c4113dSnw /* Reset our 'done' flags */ 289c5c4113dSnw state.sid2pid_done = state.pid2sid_done = TRUE; 290c5c4113dSnw 291c5c4113dSnw /* Update cache in a single transaction */ 292c5c4113dSnw if (sql_exec_no_cb(cache, "BEGIN TRANSACTION;") != IDMAP_SUCCESS) 293c5c4113dSnw goto out; 294c5c4113dSnw 295c5c4113dSnw for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 29662c60062Sbaban state.curpos = i; 297c5c4113dSnw if (IS_BATCH_SID(batch, i)) { 298c5c4113dSnw (void) update_cache_sid2pid( 299cd37da74Snw &state, 300cd37da74Snw cache, 301cd37da74Snw &batch.idmap_mapping_batch_val[i], 302cd37da74Snw &result->ids.ids_val[i]); 303c5c4113dSnw } else if ((IS_BATCH_UID(batch, i)) || 304cd37da74Snw (IS_BATCH_GID(batch, i))) { 305c5c4113dSnw (void) update_cache_pid2sid( 306cd37da74Snw &state, 307cd37da74Snw cache, 308cd37da74Snw &batch.idmap_mapping_batch_val[i], 309cd37da74Snw &result->ids.ids_val[i]); 310c5c4113dSnw } 311c5c4113dSnw } 312c5c4113dSnw 313da6c28aaSamw /* Commit if we have at least one successful update */ 314c5c4113dSnw if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE) 315c5c4113dSnw (void) sql_exec_no_cb(cache, "COMMIT TRANSACTION;"); 316c5c4113dSnw else 317c5c4113dSnw (void) sql_exec_no_cb(cache, "END TRANSACTION;"); 318c5c4113dSnw 319c5c4113dSnw out: 320*e8c27ec8Sbaban cleanup_lookup_state(&state); 321c5c4113dSnw if (IDMAP_ERROR(result->retcode)) { 322c5c4113dSnw xdr_free(xdr_idmap_ids_res, (caddr_t)result); 323c5c4113dSnw result->ids.ids_len = 0; 324c5c4113dSnw result->ids.ids_val = NULL; 325c5c4113dSnw } 326c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 327c5c4113dSnw return (TRUE); 328c5c4113dSnw } 329c5c4113dSnw 330c5c4113dSnw 331c5c4113dSnw /* ARGSUSED */ 332cd37da74Snw static 333cd37da74Snw int 334cd37da74Snw list_mappings_cb(void *parg, int argc, char **argv, char **colnames) 335cd37da74Snw { 336c5c4113dSnw list_cb_data_t *cb_data; 337c5c4113dSnw char *str; 338c5c4113dSnw idmap_mappings_res *result; 339c5c4113dSnw idmap_retcode retcode; 340c5c4113dSnw int w2u, u2w; 341c5c4113dSnw char *end; 342cd37da74Snw static int validated_column_names = 0; 343cd37da74Snw 344cd37da74Snw if (!validated_column_names) { 345cd37da74Snw assert(strcmp(colnames[0], "rowid") == 0); 346cd37da74Snw assert(strcmp(colnames[1], "sidprefix") == 0); 347cd37da74Snw assert(strcmp(colnames[2], "rid") == 0); 348cd37da74Snw assert(strcmp(colnames[3], "pid") == 0); 349cd37da74Snw assert(strcmp(colnames[4], "w2u") == 0); 350cd37da74Snw assert(strcmp(colnames[5], "u2w") == 0); 351cd37da74Snw assert(strcmp(colnames[6], "windomain") == 0); 352cd37da74Snw assert(strcmp(colnames[7], "canon_winname") == 0); 353cd37da74Snw assert(strcmp(colnames[8], "unixname") == 0); 354cd37da74Snw assert(strcmp(colnames[9], "is_user") == 0); 355cd37da74Snw assert(strcmp(colnames[10], "is_wuser") == 0); 356cd37da74Snw validated_column_names = 1; 357cd37da74Snw } 358cd37da74Snw 359c5c4113dSnw 360c5c4113dSnw cb_data = (list_cb_data_t *)parg; 361c5c4113dSnw result = (idmap_mappings_res *)cb_data->result; 362c5c4113dSnw 363cd37da74Snw _VALIDATE_LIST_CB_DATA(11, &result->mappings.mappings_val, 364cd37da74Snw sizeof (idmap_mapping)); 365c5c4113dSnw 366c5c4113dSnw result->mappings.mappings_len++; 367c5c4113dSnw 368c5c4113dSnw if ((str = strdup(argv[1])) == NULL) 369c5c4113dSnw return (1); 370c5c4113dSnw result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix = 371cd37da74Snw str; 372c5c4113dSnw result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid = 373cd37da74Snw strtoul(argv[2], &end, 10); 374cd37da74Snw result->mappings.mappings_val[cb_data->next].id1.idtype = 375cd37da74Snw strtol(argv[10], &end, 10) ? IDMAP_USID : IDMAP_GSID; 376c5c4113dSnw 377c5c4113dSnw result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid = 378cd37da74Snw strtoul(argv[3], &end, 10); 379cd37da74Snw result->mappings.mappings_val[cb_data->next].id2.idtype = 380cd37da74Snw strtol(argv[9], &end, 10) ? IDMAP_UID : IDMAP_GID; 381c5c4113dSnw 382cd37da74Snw w2u = argv[4] ? strtol(argv[4], &end, 10) : 0; 383cd37da74Snw u2w = argv[5] ? strtol(argv[5], &end, 10) : 0; 384c5c4113dSnw 385c5c4113dSnw if (w2u > 0 && u2w == 0) 386651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 387651c0131Sbaban IDMAP_DIRECTION_W2U; 388c5c4113dSnw else if (w2u == 0 && u2w > 0) 389651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 390651c0131Sbaban IDMAP_DIRECTION_U2W; 391c5c4113dSnw else 392651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 393651c0131Sbaban IDMAP_DIRECTION_BI; 394c5c4113dSnw 3958e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1domain, 3968e228215Sdm argv[6]); 397c5c4113dSnw 3988e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1name, 3998e228215Sdm argv[7]); 4008e228215Sdm 4018e228215Sdm STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id2name, 4028e228215Sdm argv[8]); 403c5c4113dSnw 404c5c4113dSnw 405c5c4113dSnw result->lastrowid = strtoll(argv[0], &end, 10); 406c5c4113dSnw cb_data->next++; 407c5c4113dSnw result->retcode = IDMAP_SUCCESS; 408c5c4113dSnw return (0); 409c5c4113dSnw } 410c5c4113dSnw 411c5c4113dSnw 412c5c4113dSnw /* ARGSUSED */ 413c5c4113dSnw bool_t 414cd37da74Snw idmap_list_mappings_1_svc(int64_t lastrowid, uint64_t limit, 415cd37da74Snw idmap_mappings_res *result, struct svc_req *rqstp) 416cd37da74Snw { 417c5c4113dSnw sqlite *cache = NULL; 418c5c4113dSnw char lbuf[30], rbuf[30]; 419c5c4113dSnw uint64_t maxlimit; 420c5c4113dSnw idmap_retcode retcode; 421c5c4113dSnw char *sql = NULL; 422c5c4113dSnw 423c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 424c5c4113dSnw lbuf[0] = rbuf[0] = 0; 425c5c4113dSnw 426c5c4113dSnw RDLOCK_CONFIG(); 427c5c4113dSnw maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 428c5c4113dSnw UNLOCK_CONFIG(); 429c5c4113dSnw 430c5c4113dSnw /* Get cache handle */ 431c5c4113dSnw result->retcode = get_cache_handle(&cache); 432c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 433c5c4113dSnw goto out; 434c5c4113dSnw 435c5c4113dSnw result->retcode = IDMAP_ERR_INTERNAL; 436c5c4113dSnw 437c5c4113dSnw /* Create LIMIT expression. */ 438c5c4113dSnw if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 439c5c4113dSnw limit = maxlimit; 440c5c4113dSnw if (limit > 0) 441c5c4113dSnw (void) snprintf(lbuf, sizeof (lbuf), 442cd37da74Snw "LIMIT %" PRIu64, limit + 1ULL); 443c5c4113dSnw 444c5c4113dSnw (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 445c5c4113dSnw 446c5c4113dSnw /* 447c5c4113dSnw * Combine all the above into a giant SELECT statement that 448c5c4113dSnw * will return the requested mappings 449c5c4113dSnw */ 450cd37da74Snw sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, u2w, " 451cd37da74Snw "windomain, canon_winname, unixname, is_user, is_wuser " 452cd37da74Snw " FROM idmap_cache WHERE " 453cd37da74Snw " %s %s;", 454cd37da74Snw rbuf, lbuf); 455c5c4113dSnw if (sql == NULL) { 456c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 457c5c4113dSnw goto out; 458c5c4113dSnw } 459c5c4113dSnw 460c5c4113dSnw /* Execute the SQL statement and update the return buffer */ 461c5c4113dSnw PROCESS_LIST_SVC_SQL(retcode, cache, sql, limit, list_mappings_cb, 462cd37da74Snw result, result->mappings.mappings_len); 463c5c4113dSnw 464c5c4113dSnw out: 465c5c4113dSnw if (sql) 466c5c4113dSnw sqlite_freemem(sql); 467c5c4113dSnw if (IDMAP_ERROR(result->retcode)) 468c5c4113dSnw (void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 469c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 470c5c4113dSnw return (TRUE); 471c5c4113dSnw } 472c5c4113dSnw 473c5c4113dSnw 474c5c4113dSnw /* ARGSUSED */ 475cd37da74Snw static 476cd37da74Snw int 477cd37da74Snw list_namerules_cb(void *parg, int argc, char **argv, char **colnames) 478cd37da74Snw { 479c5c4113dSnw list_cb_data_t *cb_data; 480c5c4113dSnw idmap_namerules_res *result; 481c5c4113dSnw idmap_retcode retcode; 482c5c4113dSnw int w2u_order, u2w_order; 483c5c4113dSnw char *end; 484cd37da74Snw static int validated_column_names = 0; 485cd37da74Snw 486cd37da74Snw if (!validated_column_names) { 487cd37da74Snw assert(strcmp(colnames[0], "rowid") == 0); 488cd37da74Snw assert(strcmp(colnames[1], "is_user") == 0); 489cd37da74Snw assert(strcmp(colnames[2], "is_wuser") == 0); 490cd37da74Snw assert(strcmp(colnames[3], "windomain") == 0); 491cd37da74Snw assert(strcmp(colnames[4], "winname_display") == 0); 492cd37da74Snw assert(strcmp(colnames[5], "is_nt4") == 0); 493cd37da74Snw assert(strcmp(colnames[6], "unixname") == 0); 494cd37da74Snw assert(strcmp(colnames[7], "w2u_order") == 0); 495cd37da74Snw assert(strcmp(colnames[8], "u2w_order") == 0); 496cd37da74Snw validated_column_names = 1; 497cd37da74Snw } 498c5c4113dSnw 499c5c4113dSnw cb_data = (list_cb_data_t *)parg; 500c5c4113dSnw result = (idmap_namerules_res *)cb_data->result; 501c5c4113dSnw 502cd37da74Snw _VALIDATE_LIST_CB_DATA(9, &result->rules.rules_val, 503cd37da74Snw sizeof (idmap_namerule)); 504c5c4113dSnw 505c5c4113dSnw result->rules.rules_len++; 506c5c4113dSnw 507c5c4113dSnw result->rules.rules_val[cb_data->next].is_user = 508cd37da74Snw strtol(argv[1], &end, 10); 509cd37da74Snw 510cd37da74Snw result->rules.rules_val[cb_data->next].is_wuser = 511cd37da74Snw strtol(argv[2], &end, 10); 512c5c4113dSnw 5138e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].windomain, 514cd37da74Snw argv[3]); 515c5c4113dSnw 5168e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].winname, 517cd37da74Snw argv[4]); 518c5c4113dSnw 519c5c4113dSnw result->rules.rules_val[cb_data->next].is_nt4 = 520cd37da74Snw strtol(argv[5], &end, 10); 521c5c4113dSnw 5228e228215Sdm STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].unixname, 523cd37da74Snw argv[6]); 524c5c4113dSnw 525cd37da74Snw w2u_order = argv[7] ? strtol(argv[7], &end, 10) : 0; 526cd37da74Snw u2w_order = argv[8] ? strtol(argv[8], &end, 10) : 0; 527c5c4113dSnw 528c5c4113dSnw if (w2u_order > 0 && u2w_order == 0) 529651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 530651c0131Sbaban IDMAP_DIRECTION_W2U; 531c5c4113dSnw else if (w2u_order == 0 && u2w_order > 0) 532651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 533651c0131Sbaban IDMAP_DIRECTION_U2W; 534c5c4113dSnw else 535651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 536651c0131Sbaban IDMAP_DIRECTION_BI; 537c5c4113dSnw 538c5c4113dSnw result->lastrowid = strtoll(argv[0], &end, 10); 539c5c4113dSnw cb_data->next++; 540c5c4113dSnw result->retcode = IDMAP_SUCCESS; 541c5c4113dSnw return (0); 542c5c4113dSnw } 543c5c4113dSnw 544c5c4113dSnw 545c5c4113dSnw /* ARGSUSED */ 546c5c4113dSnw bool_t 547c5c4113dSnw idmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid, 548c5c4113dSnw uint64_t limit, idmap_namerules_res *result, 549cd37da74Snw struct svc_req *rqstp) 550cd37da74Snw { 551c5c4113dSnw 552c5c4113dSnw sqlite *db = NULL; 553c5c4113dSnw char w2ubuf[15], u2wbuf[15]; 554c5c4113dSnw char lbuf[30], rbuf[30]; 555c5c4113dSnw char *sql = NULL; 556cd37da74Snw char *expr = NULL; 557c5c4113dSnw uint64_t maxlimit; 558c5c4113dSnw idmap_retcode retcode; 559c5c4113dSnw 560c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 561c5c4113dSnw lbuf[0] = rbuf[0] = 0; 562c5c4113dSnw 563c5c4113dSnw RDLOCK_CONFIG(); 564c5c4113dSnw maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 565c5c4113dSnw UNLOCK_CONFIG(); 566c5c4113dSnw 567c5c4113dSnw /* Get db handle */ 568c5c4113dSnw result->retcode = get_db_handle(&db); 569c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 570c5c4113dSnw goto out; 571c5c4113dSnw 572c5c4113dSnw result->retcode = IDMAP_ERR_INTERNAL; 573c5c4113dSnw 574cd37da74Snw w2ubuf[0] = u2wbuf[0] = 0; 575cd37da74Snw if (rule.direction == IDMAP_DIRECTION_BI) { 576c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 577c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 578651c0131Sbaban } else if (rule.direction == IDMAP_DIRECTION_W2U) { 579c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 580c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), 581cd37da74Snw "AND (u2w_order = 0 OR u2w_order ISNULL)"); 582651c0131Sbaban } else if (rule.direction == IDMAP_DIRECTION_U2W) { 583c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), 584cd37da74Snw "AND (w2u_order = 0 OR w2u_order ISNULL)"); 585c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 586c5c4113dSnw } 587c5c4113dSnw 588cd37da74Snw retcode = gen_sql_expr_from_rule(&rule, &expr); 589cd37da74Snw if (retcode != IDMAP_SUCCESS) 590cd37da74Snw goto out; 591c5c4113dSnw 592c5c4113dSnw /* Create LIMIT expression. */ 593c5c4113dSnw if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 594c5c4113dSnw limit = maxlimit; 595c5c4113dSnw if (limit > 0) 596c5c4113dSnw (void) snprintf(lbuf, sizeof (lbuf), 597cd37da74Snw "LIMIT %" PRIu64, limit + 1ULL); 598c5c4113dSnw 599c5c4113dSnw (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 600c5c4113dSnw 601c5c4113dSnw /* 602c5c4113dSnw * Combine all the above into a giant SELECT statement that 603c5c4113dSnw * will return the requested rules 604c5c4113dSnw */ 605cd37da74Snw sql = sqlite_mprintf("SELECT rowid, is_user, is_wuser, windomain, " 606cd37da74Snw "winname_display, is_nt4, unixname, w2u_order, u2w_order " 607cd37da74Snw "FROM namerules WHERE " 608cd37da74Snw " %s %s %s %s %s;", 609cd37da74Snw rbuf, expr, w2ubuf, u2wbuf, lbuf); 610cd37da74Snw 611c5c4113dSnw if (sql == NULL) { 612c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 613c5c4113dSnw goto out; 614c5c4113dSnw } 615c5c4113dSnw 616c5c4113dSnw /* Execute the SQL statement and update the return buffer */ 617c5c4113dSnw PROCESS_LIST_SVC_SQL(retcode, db, sql, limit, list_namerules_cb, 618cd37da74Snw result, result->rules.rules_len); 619c5c4113dSnw 620c5c4113dSnw out: 621cd37da74Snw if (expr) 622cd37da74Snw sqlite_freemem(expr); 623c5c4113dSnw if (sql) 624c5c4113dSnw sqlite_freemem(sql); 625c5c4113dSnw if (IDMAP_ERROR(result->retcode)) 626c5c4113dSnw (void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result); 627c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 628c5c4113dSnw return (TRUE); 629c5c4113dSnw } 630c5c4113dSnw 631c5c4113dSnw #define IDMAP_RULES_AUTH "solaris.admin.idmap.rules" 632c5c4113dSnw static int 633cd37da74Snw verify_rules_auth(struct svc_req *rqstp) 634cd37da74Snw { 635c5c4113dSnw ucred_t *uc = NULL; 636c5c4113dSnw uid_t uid; 637c5c4113dSnw char buf[1024]; 638c5c4113dSnw struct passwd pwd; 639c5c4113dSnw const char *me = "verify_rules_auth"; 640c5c4113dSnw 641c5c4113dSnw if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) { 642c5c4113dSnw idmapdlog(LOG_ERR, 643cd37da74Snw "%s: svc_getcallerucred failed (errno=%d)", 644cd37da74Snw me, errno); 645c5c4113dSnw return (-1); 646c5c4113dSnw } 647c5c4113dSnw 648c5c4113dSnw uid = ucred_geteuid(uc); 649c5c4113dSnw if (uid == (uid_t)-1) { 650c5c4113dSnw idmapdlog(LOG_ERR, 651cd37da74Snw "%s: ucred_geteuid failed (errno=%d)", 652cd37da74Snw me, errno); 653c5c4113dSnw ucred_free(uc); 654c5c4113dSnw return (-1); 655c5c4113dSnw } 656c5c4113dSnw 657c5c4113dSnw if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) { 658c5c4113dSnw idmapdlog(LOG_ERR, 659cd37da74Snw "%s: getpwuid_r(%u) failed (errno=%d)", 660cd37da74Snw me, uid, errno); 661c5c4113dSnw ucred_free(uc); 662c5c4113dSnw return (-1); 663c5c4113dSnw } 664c5c4113dSnw 665c5c4113dSnw if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) { 666c5c4113dSnw idmapdlog(LOG_INFO, 667cd37da74Snw "%s: %s does not have authorization.", 668cd37da74Snw me, pwd.pw_name); 669c5c4113dSnw ucred_free(uc); 670c5c4113dSnw return (-1); 671c5c4113dSnw } 672c5c4113dSnw 673c5c4113dSnw ucred_free(uc); 674c5c4113dSnw return (1); 675c5c4113dSnw } 676c5c4113dSnw 6778e228215Sdm /* 6788e228215Sdm * Meaning of the return values is the following: For retcode == 6798e228215Sdm * IDMAP_SUCCESS, everything went OK and error_index is 6808e228215Sdm * undefined. Otherwise, error_index >=0 shows the failed batch 6818e228215Sdm * element. errro_index == -1 indicates failure at the beginning, 6828e228215Sdm * error_index == -2 at the end. 6838e228215Sdm */ 6848e228215Sdm 685c5c4113dSnw /* ARGSUSED */ 686c5c4113dSnw bool_t 6878e228215Sdm idmap_update_1_svc(idmap_update_batch batch, idmap_update_res *res, 688cd37da74Snw struct svc_req *rqstp) 689cd37da74Snw { 690c5c4113dSnw sqlite *db = NULL; 691c5c4113dSnw idmap_update_op *up; 692c5c4113dSnw int i; 69384decf41Sjp int trans = FALSE; 694c5c4113dSnw 6958e228215Sdm res->error_index = -1; 6968e228215Sdm (void) memset(&res->error_rule, 0, sizeof (res->error_rule)); 6978e228215Sdm (void) memset(&res->conflict_rule, 0, sizeof (res->conflict_rule)); 6988e228215Sdm 699c5c4113dSnw if (verify_rules_auth(rqstp) < 0) { 7008e228215Sdm res->retcode = IDMAP_ERR_PERMISSION_DENIED; 701c5c4113dSnw goto out; 702c5c4113dSnw } 703c5c4113dSnw 704c5c4113dSnw if (batch.idmap_update_batch_len == 0 || 705cd37da74Snw batch.idmap_update_batch_val == NULL) { 7068e228215Sdm res->retcode = IDMAP_SUCCESS; 707c5c4113dSnw goto out; 708c5c4113dSnw } 709c5c4113dSnw 710c5c4113dSnw /* Get db handle */ 7118e228215Sdm res->retcode = get_db_handle(&db); 7128e228215Sdm if (res->retcode != IDMAP_SUCCESS) 713c5c4113dSnw goto out; 714c5c4113dSnw 7158e228215Sdm res->retcode = sql_exec_no_cb(db, "BEGIN TRANSACTION;"); 7168e228215Sdm if (res->retcode != IDMAP_SUCCESS) 717c5c4113dSnw goto out; 71884decf41Sjp trans = TRUE; 719c5c4113dSnw 720c5c4113dSnw for (i = 0; i < batch.idmap_update_batch_len; i++) { 721c5c4113dSnw up = &batch.idmap_update_batch_val[i]; 722c5c4113dSnw switch (up->opnum) { 723c5c4113dSnw case OP_NONE: 7248e228215Sdm res->retcode = IDMAP_SUCCESS; 725c5c4113dSnw break; 726c5c4113dSnw case OP_ADD_NAMERULE: 7278e228215Sdm res->retcode = add_namerule(db, 728cd37da74Snw &up->idmap_update_op_u.rule); 729c5c4113dSnw break; 730c5c4113dSnw case OP_RM_NAMERULE: 7318e228215Sdm res->retcode = rm_namerule(db, 732cd37da74Snw &up->idmap_update_op_u.rule); 733c5c4113dSnw break; 734c5c4113dSnw case OP_FLUSH_NAMERULES: 735cd37da74Snw res->retcode = flush_namerules(db); 736c5c4113dSnw break; 737c5c4113dSnw default: 7388e228215Sdm res->retcode = IDMAP_ERR_NOTSUPPORTED; 7398e228215Sdm break; 740c5c4113dSnw }; 741c5c4113dSnw 7428e228215Sdm if (res->retcode != IDMAP_SUCCESS) { 7438e228215Sdm res->error_index = i; 7448e228215Sdm if (up->opnum == OP_ADD_NAMERULE || 7458e228215Sdm up->opnum == OP_RM_NAMERULE) { 7468e228215Sdm idmap_stat r2 = 7478e228215Sdm idmap_namerule_cpy(&res->error_rule, 748cd37da74Snw &up->idmap_update_op_u.rule); 7498e228215Sdm if (r2 != IDMAP_SUCCESS) 7508e228215Sdm res->retcode = r2; 7518e228215Sdm } 752c5c4113dSnw goto out; 7538e228215Sdm } 754c5c4113dSnw } 755c5c4113dSnw 756c5c4113dSnw out: 75784decf41Sjp if (trans) { 7588e228215Sdm if (res->retcode == IDMAP_SUCCESS) { 7598e228215Sdm res->retcode = 7608e228215Sdm sql_exec_no_cb(db, "COMMIT TRANSACTION;"); 7618e228215Sdm if (res->retcode != IDMAP_SUCCESS) 7628e228215Sdm res->error_index = -2; 7638e228215Sdm } 76484decf41Sjp else 76584decf41Sjp (void) sql_exec_no_cb(db, "ROLLBACK TRANSACTION;"); 766c5c4113dSnw } 7678e228215Sdm 7688e228215Sdm res->retcode = idmap_stat4prot(res->retcode); 7698e228215Sdm 770c5c4113dSnw return (TRUE); 771c5c4113dSnw } 772c5c4113dSnw 773c5c4113dSnw 774c5c4113dSnw /* ARGSUSED */ 775c5c4113dSnw bool_t 776c5c4113dSnw idmap_get_mapped_id_by_name_1_svc(idmap_mapping request, 777cd37da74Snw idmap_mappings_res *result, struct svc_req *rqstp) 778cd37da74Snw { 779c5c4113dSnw sqlite *cache = NULL, *db = NULL; 780c5c4113dSnw 781c5c4113dSnw /* Init */ 782c5c4113dSnw (void) memset(result, 0, sizeof (*result)); 783c5c4113dSnw 784c5c4113dSnw /* Get cache handle */ 785c5c4113dSnw result->retcode = get_cache_handle(&cache); 786c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 787c5c4113dSnw goto out; 788c5c4113dSnw 789c5c4113dSnw /* Get db handle */ 790c5c4113dSnw result->retcode = get_db_handle(&db); 791c5c4113dSnw if (result->retcode != IDMAP_SUCCESS) 792c5c4113dSnw goto out; 793c5c4113dSnw 794c5c4113dSnw /* Allocate result */ 795c5c4113dSnw result->mappings.mappings_val = calloc(1, sizeof (idmap_mapping)); 796c5c4113dSnw if (result->mappings.mappings_val == NULL) { 797c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory"); 798c5c4113dSnw result->retcode = IDMAP_ERR_MEMORY; 799c5c4113dSnw goto out; 800c5c4113dSnw } 801c5c4113dSnw result->mappings.mappings_len = 1; 802c5c4113dSnw 803cd37da74Snw 804cd37da74Snw if (IS_REQUEST_SID(request, 1)) { 805c5c4113dSnw result->retcode = get_w2u_mapping( 806cd37da74Snw cache, 807cd37da74Snw db, 808cd37da74Snw &request, 809cd37da74Snw result->mappings.mappings_val); 810c5c4113dSnw } else if (IS_REQUEST_UID(request)) { 811c5c4113dSnw result->retcode = get_u2w_mapping( 812cd37da74Snw cache, 813cd37da74Snw db, 814cd37da74Snw &request, 815cd37da74Snw result->mappings.mappings_val, 816cd37da74Snw 1); 817c5c4113dSnw } else if (IS_REQUEST_GID(request)) { 818c5c4113dSnw result->retcode = get_u2w_mapping( 819cd37da74Snw cache, 820cd37da74Snw db, 821cd37da74Snw &request, 822cd37da74Snw result->mappings.mappings_val, 823cd37da74Snw 0); 824c5c4113dSnw } else { 825c5c4113dSnw result->retcode = IDMAP_ERR_IDTYPE; 826c5c4113dSnw } 827c5c4113dSnw 828c5c4113dSnw out: 829c5c4113dSnw if (IDMAP_FATAL_ERROR(result->retcode)) { 830c5c4113dSnw xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 831c5c4113dSnw result->mappings.mappings_len = 0; 832c5c4113dSnw result->mappings.mappings_val = NULL; 833c5c4113dSnw } 834c5c4113dSnw result->retcode = idmap_stat4prot(result->retcode); 835c5c4113dSnw return (TRUE); 836c5c4113dSnw } 837c5c4113dSnw 838c5c4113dSnw 839c5c4113dSnw /* ARGSUSED */ 840c5c4113dSnw int 841c5c4113dSnw idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, 842cd37da74Snw caddr_t result) 843cd37da74Snw { 844c5c4113dSnw (void) xdr_free(xdr_result, result); 845c5c4113dSnw return (TRUE); 846c5c4113dSnw } 847