1c5c4113dSnw /*
2c5c4113dSnw * CDDL HEADER START
3c5c4113dSnw *
4c5c4113dSnw * The contents of this file are subject to the terms of the
5c5c4113dSnw * Common Development and Distribution License (the "License").
6c5c4113dSnw * You may not use this file except in compliance with the License.
7c5c4113dSnw *
8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9c5c4113dSnw * or http://www.opensolaris.org/os/licensing.
10c5c4113dSnw * See the License for the specific language governing permissions
11c5c4113dSnw * and limitations under the License.
12c5c4113dSnw *
13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each
14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the
16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying
17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner]
18c5c4113dSnw *
19c5c4113dSnw * CDDL HEADER END
20c5c4113dSnw */
21c5c4113dSnw /*
22148c5f43SAlan Wright * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23f4a94a44SGordon Ross * Copyright 2016 Nexenta Systems, Inc. All rights reserved.
24*e3d9e7f3SGordon Ross * Copyright 2022 RackTop Systems, Inc.
25c5c4113dSnw */
26c5c4113dSnw
27c5c4113dSnw /*
28c5c4113dSnw * Database related utility routines
29c5c4113dSnw */
30c5c4113dSnw
31c5c4113dSnw #include <stdio.h>
32c5c4113dSnw #include <stdlib.h>
33c5c4113dSnw #include <string.h>
34c5c4113dSnw #include <errno.h>
35c5c4113dSnw #include <sys/types.h>
36c5c4113dSnw #include <sys/stat.h>
37c5c4113dSnw #include <rpc/rpc.h>
38c5c4113dSnw #include <sys/sid.h>
39c5c4113dSnw #include <time.h>
40c5c4113dSnw #include <pwd.h>
41c5c4113dSnw #include <grp.h>
4284decf41Sjp #include <pthread.h>
4384decf41Sjp #include <assert.h>
44cd37da74Snw #include <sys/u8_textprep.h>
458c155366SJordan Brown #include <alloca.h>
46cb174861Sjoyce mcintosh #include <libuutil.h>
47148c5f43SAlan Wright #include <note.h>
48c5c4113dSnw
49c5c4113dSnw #include "idmapd.h"
50c5c4113dSnw #include "adutils.h"
51c5c4113dSnw #include "string.h"
52c5c4113dSnw #include "idmap_priv.h"
53cd37da74Snw #include "schema.h"
54e8c27ec8Sbaban #include "nldaputils.h"
55148c5f43SAlan Wright #include "idmap_lsa.h"
56c5c4113dSnw
5784decf41Sjp
58c5c4113dSnw static idmap_retcode sql_compile_n_step_once(sqlite *, char *,
59c5c4113dSnw sqlite_vm **, int *, int, const char ***);
60e8c27ec8Sbaban static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *);
61e8c27ec8Sbaban static idmap_retcode lookup_cache_name2sid(sqlite *, const char *,
62148c5f43SAlan Wright const char *, char **, char **, idmap_rid_t *, idmap_id_type *);
63e8c27ec8Sbaban
64c5c4113dSnw #define EMPTY_NAME(name) (*name == 0 || strcmp(name, "\"\"") == 0)
65c5c4113dSnw
66c5c4113dSnw #define DO_NOT_ALLOC_NEW_ID_MAPPING(req)\
67c5c4113dSnw (req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC)
68c5c4113dSnw
69c5c4113dSnw #define AVOID_NAMESERVICE(req)\
70c5c4113dSnw (req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE)
71c5c4113dSnw
722b4a7802SBaban Kenkre #define ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)\
732b4a7802SBaban Kenkre (req->flag & IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY)
742b4a7802SBaban Kenkre
75c5c4113dSnw typedef enum init_db_option {
76c5c4113dSnw FAIL_IF_CORRUPT = 0,
77c5c4113dSnw REMOVE_IF_CORRUPT = 1
78c5c4113dSnw } init_db_option_t;
79c5c4113dSnw
8084decf41Sjp /*
8108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Thread specific data to hold the database handles so that the
8208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * databases are not opened and closed for every request. It also
8384decf41Sjp * contains the sqlite busy handler structure.
8484decf41Sjp */
8584decf41Sjp
8684decf41Sjp struct idmap_busy {
8784decf41Sjp const char *name;
8884decf41Sjp const int *delays;
8984decf41Sjp int delay_size;
9084decf41Sjp int total;
9184decf41Sjp int sec;
9284decf41Sjp };
9384decf41Sjp
9484decf41Sjp
9584decf41Sjp typedef struct idmap_tsd {
9684decf41Sjp sqlite *db_db;
9784decf41Sjp sqlite *cache_db;
9884decf41Sjp struct idmap_busy cache_busy;
9984decf41Sjp struct idmap_busy db_busy;
10084decf41Sjp } idmap_tsd_t;
10184decf41Sjp
102e3f2c991SKeyur Desai /*
103e3f2c991SKeyur Desai * Flags to indicate how local the directory we're consulting is.
104e3f2c991SKeyur Desai * If neither is set, it means the directory belongs to a remote forest.
105e3f2c991SKeyur Desai */
106e3f2c991SKeyur Desai #define DOMAIN_IS_LOCAL 0x01
107e3f2c991SKeyur Desai #define FOREST_IS_LOCAL 0x02
10884decf41Sjp
10984decf41Sjp static const int cache_delay_table[] =
11084decf41Sjp { 1, 2, 5, 10, 15, 20, 25, 30, 35, 40,
11184decf41Sjp 50, 50, 60, 70, 80, 90, 100};
11284decf41Sjp
11384decf41Sjp static const int db_delay_table[] =
11484decf41Sjp { 5, 10, 15, 20, 30, 40, 55, 70, 100};
11584decf41Sjp
11684decf41Sjp
11784decf41Sjp static pthread_key_t idmap_tsd_key;
11884decf41Sjp
11984decf41Sjp void
idmap_tsd_destroy(void * key)12084decf41Sjp idmap_tsd_destroy(void *key)
12184decf41Sjp {
12284decf41Sjp
12384decf41Sjp idmap_tsd_t *tsd = (idmap_tsd_t *)key;
12484decf41Sjp if (tsd) {
12584decf41Sjp if (tsd->db_db)
12684decf41Sjp (void) sqlite_close(tsd->db_db);
12784decf41Sjp if (tsd->cache_db)
12884decf41Sjp (void) sqlite_close(tsd->cache_db);
12984decf41Sjp free(tsd);
13084decf41Sjp }
13184decf41Sjp }
13284decf41Sjp
133148c5f43SAlan Wright void
idmap_init_tsd_key(void)134cd37da74Snw idmap_init_tsd_key(void)
135cd37da74Snw {
136148c5f43SAlan Wright int rc;
137148c5f43SAlan Wright
138148c5f43SAlan Wright rc = pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy);
139148c5f43SAlan Wright assert(rc == 0);
14084decf41Sjp }
14184decf41Sjp
14284decf41Sjp
14384decf41Sjp
14484decf41Sjp idmap_tsd_t *
idmap_get_tsd(void)14584decf41Sjp idmap_get_tsd(void)
14684decf41Sjp {
14784decf41Sjp idmap_tsd_t *tsd;
14884decf41Sjp
14984decf41Sjp if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) {
15084decf41Sjp /* No thread specific data so create it */
15184decf41Sjp if ((tsd = malloc(sizeof (*tsd))) != NULL) {
15284decf41Sjp /* Initialize thread specific data */
15384decf41Sjp (void) memset(tsd, 0, sizeof (*tsd));
15484decf41Sjp /* save the trhread specific data */
15584decf41Sjp if (pthread_setspecific(idmap_tsd_key, tsd) != 0) {
15684decf41Sjp /* Can't store key */
15784decf41Sjp free(tsd);
15884decf41Sjp tsd = NULL;
15984decf41Sjp }
16084decf41Sjp } else {
16184decf41Sjp tsd = NULL;
16284decf41Sjp }
16384decf41Sjp }
16484decf41Sjp
16584decf41Sjp return (tsd);
16684decf41Sjp }
16784decf41Sjp
168cd37da74Snw /*
169cd37da74Snw * A simple wrapper around u8_textprep_str() that returns the Unicode
170cd37da74Snw * lower-case version of some string. The result must be freed.
171cd37da74Snw */
172cd37da74Snw char *
tolower_u8(const char * s)173cd37da74Snw tolower_u8(const char *s)
174cd37da74Snw {
175cd37da74Snw char *res = NULL;
176cd37da74Snw char *outs;
177cd37da74Snw size_t inlen, outlen, inbytesleft, outbytesleft;
178cd37da74Snw int rc, err;
179cd37da74Snw
180cd37da74Snw /*
181cd37da74Snw * u8_textprep_str() does not allocate memory. The input and
182cd37da74Snw * output buffers may differ in size (though that would be more
183cd37da74Snw * likely when normalization is done). We have to loop over it...
184cd37da74Snw *
185cd37da74Snw * To improve the chances that we can avoid looping we add 10
186cd37da74Snw * bytes of output buffer room the first go around.
187cd37da74Snw */
188cd37da74Snw inlen = inbytesleft = strlen(s);
189cd37da74Snw outlen = outbytesleft = inlen + 10;
190cd37da74Snw if ((res = malloc(outlen)) == NULL)
191cd37da74Snw return (NULL);
192cd37da74Snw outs = res;
193cd37da74Snw
194cd37da74Snw while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs,
195cd37da74Snw &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 &&
196cd37da74Snw err == E2BIG) {
197cd37da74Snw if ((res = realloc(res, outlen + inbytesleft)) == NULL)
198cd37da74Snw return (NULL);
199cd37da74Snw /* adjust input/output buffer pointers */
200cd37da74Snw s += (inlen - inbytesleft);
201cd37da74Snw outs = res + outlen - outbytesleft;
202cd37da74Snw /* adjust outbytesleft and outlen */
203cd37da74Snw outlen += inbytesleft;
204cd37da74Snw outbytesleft += inbytesleft;
205cd37da74Snw }
206cd37da74Snw
207cd37da74Snw if (rc < 0) {
208cd37da74Snw free(res);
209cd37da74Snw res = NULL;
210cd37da74Snw return (NULL);
211cd37da74Snw }
212cd37da74Snw
213cd37da74Snw res[outlen - outbytesleft] = '\0';
214cd37da74Snw
215cd37da74Snw return (res);
216cd37da74Snw }
217cd37da74Snw
218cd37da74Snw static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
219cd37da74Snw const char *while_doing);
220cd37da74Snw
221c5c4113dSnw
222c5c4113dSnw /*
223c5c4113dSnw * Initialize 'dbname' using 'sql'
224c5c4113dSnw */
225cd37da74Snw static
226cd37da74Snw int
init_db_instance(const char * dbname,int version,const char * detect_version_sql,char * const * sql,init_db_option_t opt,int * created,int * upgraded)227cd37da74Snw init_db_instance(const char *dbname, int version,
2289bf5f78fSMatt Barden const char *detect_version_sql, char * const *sql,
2299bf5f78fSMatt Barden init_db_option_t opt, int *created, int *upgraded)
230c5c4113dSnw {
231cd37da74Snw int rc, curr_version;
232cd37da74Snw int tries = 1;
233cd37da74Snw int prio = LOG_NOTICE;
234c5c4113dSnw sqlite *db = NULL;
235cd37da74Snw char *errmsg = NULL;
236c5c4113dSnw
237cd37da74Snw *created = 0;
238cd37da74Snw *upgraded = 0;
239c5c4113dSnw
240cd37da74Snw if (opt == REMOVE_IF_CORRUPT)
241cd37da74Snw tries = 3;
242c5c4113dSnw
243cd37da74Snw rinse_repeat:
244cd37da74Snw if (tries == 0) {
245cd37da74Snw idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname);
246cd37da74Snw return (-1);
247c5c4113dSnw }
248cd37da74Snw if (tries-- == 1)
249cd37da74Snw /* Last try, log errors */
250cd37da74Snw prio = LOG_ERR;
251c5c4113dSnw
252cd37da74Snw db = sqlite_open(dbname, 0600, &errmsg);
253cd37da74Snw if (db == NULL) {
254cd37da74Snw idmapdlog(prio, "Error creating database %s (%s)",
255cd37da74Snw dbname, CHECK_NULL(errmsg));
256cd37da74Snw sqlite_freemem(errmsg);
257cd37da74Snw if (opt == REMOVE_IF_CORRUPT)
258cd37da74Snw (void) unlink(dbname);
259cd37da74Snw goto rinse_repeat;
260c5c4113dSnw }
261c5c4113dSnw
262cd37da74Snw sqlite_busy_timeout(db, 3000);
263c5c4113dSnw
264cd37da74Snw /* Detect current version of schema in the db, if any */
265cd37da74Snw curr_version = 0;
266cd37da74Snw if (detect_version_sql != NULL) {
267cd37da74Snw char *end, **results;
268cd37da74Snw int nrow;
269cd37da74Snw
270cd37da74Snw #ifdef IDMAPD_DEBUG
271cd37da74Snw (void) fprintf(stderr, "Schema version detection SQL: %s\n",
272cd37da74Snw detect_version_sql);
273cd37da74Snw #endif /* IDMAPD_DEBUG */
274cd37da74Snw rc = sqlite_get_table(db, detect_version_sql, &results,
275cd37da74Snw &nrow, NULL, &errmsg);
276cd37da74Snw if (rc != SQLITE_OK) {
277cd37da74Snw idmapdlog(prio,
278cd37da74Snw "Error detecting schema version of db %s (%s)",
279cd37da74Snw dbname, errmsg);
280cd37da74Snw sqlite_freemem(errmsg);
281cd37da74Snw sqlite_free_table(results);
282cd37da74Snw sqlite_close(db);
283cd37da74Snw return (-1);
284cd37da74Snw }
285cd37da74Snw if (nrow != 1) {
286cd37da74Snw idmapdlog(prio,
287cd37da74Snw "Error detecting schema version of db %s", dbname);
288cd37da74Snw sqlite_close(db);
289cd37da74Snw sqlite_free_table(results);
290cd37da74Snw return (-1);
291cd37da74Snw }
292cd37da74Snw curr_version = strtol(results[1], &end, 10);
293cd37da74Snw sqlite_free_table(results);
294c5c4113dSnw }
295c5c4113dSnw
296cd37da74Snw if (curr_version < 0) {
297cd37da74Snw if (opt == REMOVE_IF_CORRUPT)
298cd37da74Snw (void) unlink(dbname);
299cd37da74Snw goto rinse_repeat;
300cd37da74Snw }
301cd37da74Snw
302cd37da74Snw if (curr_version == version)
303cd37da74Snw goto done;
304cd37da74Snw
305cd37da74Snw /* Install or upgrade schema */
306cd37da74Snw #ifdef IDMAPD_DEBUG
307cd37da74Snw (void) fprintf(stderr, "Schema init/upgrade SQL: %s\n",
308cd37da74Snw sql[curr_version]);
309cd37da74Snw #endif /* IDMAPD_DEBUG */
310cd37da74Snw rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname,
311cd37da74Snw (curr_version == 0) ? "installing schema" : "upgrading schema");
312cd37da74Snw if (rc != 0) {
313cd37da74Snw idmapdlog(prio, "Error %s schema for db %s", dbname,
314cd37da74Snw (curr_version == 0) ? "installing schema" :
315cd37da74Snw "upgrading schema");
316cd37da74Snw if (opt == REMOVE_IF_CORRUPT)
317cd37da74Snw (void) unlink(dbname);
318cd37da74Snw goto rinse_repeat;
319c5c4113dSnw }
320c5c4113dSnw
321cd37da74Snw *upgraded = (curr_version > 0);
322cd37da74Snw *created = (curr_version == 0);
323cd37da74Snw
324cd37da74Snw done:
325c5c4113dSnw (void) sqlite_close(db);
326cd37da74Snw return (0);
327c5c4113dSnw }
328c5c4113dSnw
32984decf41Sjp
33084decf41Sjp /*
33184decf41Sjp * This is the SQLite database busy handler that retries the SQL
33284decf41Sjp * operation until it is successful.
33384decf41Sjp */
33484decf41Sjp int
idmap_sqlite_busy_handler(void * arg,const char * table_name,int count)33584decf41Sjp idmap_sqlite_busy_handler(void *arg, const char *table_name, int count)
33684decf41Sjp {
33784decf41Sjp struct idmap_busy *busy = arg;
33884decf41Sjp int delay;
33984decf41Sjp struct timespec rqtp;
34084decf41Sjp
34184decf41Sjp if (count == 1) {
34284decf41Sjp busy->total = 0;
34384decf41Sjp busy->sec = 2;
34484decf41Sjp }
34584decf41Sjp if (busy->total > 1000 * busy->sec) {
3462b3ecdebSjp idmapdlog(LOG_DEBUG,
34784decf41Sjp "Thread %d waited %d sec for the %s database",
34884decf41Sjp pthread_self(), busy->sec, busy->name);
34984decf41Sjp busy->sec++;
35084decf41Sjp }
35184decf41Sjp
35284decf41Sjp if (count <= busy->delay_size) {
35384decf41Sjp delay = busy->delays[count-1];
35484decf41Sjp } else {
35584decf41Sjp delay = busy->delays[busy->delay_size - 1];
35684decf41Sjp }
35784decf41Sjp busy->total += delay;
35884decf41Sjp rqtp.tv_sec = 0;
35919449258SJosef 'Jeff' Sipek rqtp.tv_nsec = MSEC2NSEC(delay);
36084decf41Sjp (void) nanosleep(&rqtp, NULL);
36184decf41Sjp return (1);
36284decf41Sjp }
36384decf41Sjp
36484decf41Sjp
365c5c4113dSnw /*
366c5c4113dSnw * Get the database handle
367c5c4113dSnw */
368c5c4113dSnw idmap_retcode
get_db_handle(sqlite ** db)369cd37da74Snw get_db_handle(sqlite **db)
370cd37da74Snw {
371cd37da74Snw char *errmsg;
372cd37da74Snw idmap_tsd_t *tsd;
373c5c4113dSnw
374c5c4113dSnw /*
37584decf41Sjp * Retrieve the db handle from thread-specific storage
376c5c4113dSnw * If none exists, open and store in thread-specific storage.
377c5c4113dSnw */
37884decf41Sjp if ((tsd = idmap_get_tsd()) == NULL) {
379c5c4113dSnw idmapdlog(LOG_ERR,
380cd37da74Snw "Error getting thread specific data for %s", IDMAP_DBNAME);
38184decf41Sjp return (IDMAP_ERR_MEMORY);
382c5c4113dSnw }
38384decf41Sjp
38484decf41Sjp if (tsd->db_db == NULL) {
38584decf41Sjp tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg);
38684decf41Sjp if (tsd->db_db == NULL) {
387cd37da74Snw idmapdlog(LOG_ERR, "Error opening database %s (%s)",
388cd37da74Snw IDMAP_DBNAME, CHECK_NULL(errmsg));
38984decf41Sjp sqlite_freemem(errmsg);
390cd37da74Snw return (IDMAP_ERR_DB);
39184decf41Sjp }
392cd37da74Snw
39384decf41Sjp tsd->db_busy.name = IDMAP_DBNAME;
39484decf41Sjp tsd->db_busy.delays = db_delay_table;
39584decf41Sjp tsd->db_busy.delay_size = sizeof (db_delay_table) /
39684decf41Sjp sizeof (int);
39784decf41Sjp sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler,
39884decf41Sjp &tsd->db_busy);
39984decf41Sjp }
40084decf41Sjp *db = tsd->db_db;
401c5c4113dSnw return (IDMAP_SUCCESS);
402c5c4113dSnw }
403c5c4113dSnw
404*e3d9e7f3SGordon Ross /*
405*e3d9e7f3SGordon Ross * Force next get_db_handle to reopen.
406*e3d9e7f3SGordon Ross * Called after DB errors.
407*e3d9e7f3SGordon Ross */
408*e3d9e7f3SGordon Ross void
kill_db_handle(sqlite * db)409*e3d9e7f3SGordon Ross kill_db_handle(sqlite *db)
410*e3d9e7f3SGordon Ross {
411*e3d9e7f3SGordon Ross idmap_tsd_t *tsd;
412*e3d9e7f3SGordon Ross sqlite *t;
413*e3d9e7f3SGordon Ross
414*e3d9e7f3SGordon Ross if (db == NULL)
415*e3d9e7f3SGordon Ross return;
416*e3d9e7f3SGordon Ross
417*e3d9e7f3SGordon Ross if ((tsd = idmap_get_tsd()) == NULL)
418*e3d9e7f3SGordon Ross return;
419*e3d9e7f3SGordon Ross
420*e3d9e7f3SGordon Ross if ((t = tsd->db_db) == NULL)
421*e3d9e7f3SGordon Ross return;
422*e3d9e7f3SGordon Ross assert(t == db);
423*e3d9e7f3SGordon Ross tsd->db_db = NULL;
424*e3d9e7f3SGordon Ross (void) sqlite_close(t);
425*e3d9e7f3SGordon Ross }
426*e3d9e7f3SGordon Ross
427c5c4113dSnw /*
428c5c4113dSnw * Get the cache handle
429c5c4113dSnw */
430c5c4113dSnw idmap_retcode
get_cache_handle(sqlite ** cache)431cd37da74Snw get_cache_handle(sqlite **cache)
432cd37da74Snw {
433cd37da74Snw char *errmsg;
434cd37da74Snw idmap_tsd_t *tsd;
435c5c4113dSnw
436c5c4113dSnw /*
43784decf41Sjp * Retrieve the db handle from thread-specific storage
438c5c4113dSnw * If none exists, open and store in thread-specific storage.
439c5c4113dSnw */
44084decf41Sjp if ((tsd = idmap_get_tsd()) == NULL) {
441cd37da74Snw idmapdlog(LOG_ERR, "Error getting thread specific data for %s",
442cd37da74Snw IDMAP_DBNAME);
44384decf41Sjp return (IDMAP_ERR_MEMORY);
444c5c4113dSnw }
44584decf41Sjp
44684decf41Sjp if (tsd->cache_db == NULL) {
44784decf41Sjp tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg);
44884decf41Sjp if (tsd->cache_db == NULL) {
449cd37da74Snw idmapdlog(LOG_ERR, "Error opening database %s (%s)",
450cd37da74Snw IDMAP_CACHENAME, CHECK_NULL(errmsg));
45184decf41Sjp sqlite_freemem(errmsg);
452cd37da74Snw return (IDMAP_ERR_DB);
45384decf41Sjp }
454cd37da74Snw
45584decf41Sjp tsd->cache_busy.name = IDMAP_CACHENAME;
45684decf41Sjp tsd->cache_busy.delays = cache_delay_table;
45784decf41Sjp tsd->cache_busy.delay_size = sizeof (cache_delay_table) /
45884decf41Sjp sizeof (int);
45984decf41Sjp sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler,
46084decf41Sjp &tsd->cache_busy);
46184decf41Sjp }
46284decf41Sjp *cache = tsd->cache_db;
463c5c4113dSnw return (IDMAP_SUCCESS);
464c5c4113dSnw }
465c5c4113dSnw
466*e3d9e7f3SGordon Ross /*
467*e3d9e7f3SGordon Ross * Force next get_cache_handle to reopen.
468*e3d9e7f3SGordon Ross * Called after DB errors.
469*e3d9e7f3SGordon Ross */
470*e3d9e7f3SGordon Ross void
kill_cache_handle(sqlite * db)471*e3d9e7f3SGordon Ross kill_cache_handle(sqlite *db)
472*e3d9e7f3SGordon Ross {
473*e3d9e7f3SGordon Ross idmap_tsd_t *tsd;
474*e3d9e7f3SGordon Ross sqlite *t;
475*e3d9e7f3SGordon Ross
476*e3d9e7f3SGordon Ross if (db == NULL)
477*e3d9e7f3SGordon Ross return;
478*e3d9e7f3SGordon Ross
479*e3d9e7f3SGordon Ross if ((tsd = idmap_get_tsd()) == NULL)
480*e3d9e7f3SGordon Ross return;
481*e3d9e7f3SGordon Ross
482*e3d9e7f3SGordon Ross if ((t = tsd->cache_db) == NULL)
483*e3d9e7f3SGordon Ross return;
484*e3d9e7f3SGordon Ross assert(t == db);
485*e3d9e7f3SGordon Ross tsd->cache_db = NULL;
486*e3d9e7f3SGordon Ross (void) sqlite_close(t);
487*e3d9e7f3SGordon Ross }
488*e3d9e7f3SGordon Ross
489c5c4113dSnw /*
490c5c4113dSnw * Initialize cache and db
491c5c4113dSnw */
492c5c4113dSnw int
init_dbs(void)4939bf5f78fSMatt Barden init_dbs(void)
494cd37da74Snw {
49548258c6bSjp char *sql[4];
496cd37da74Snw int created, upgraded;
497cd37da74Snw
498c5c4113dSnw /* name-based mappings; probably OK to blow away in a pinch(?) */
499cd37da74Snw sql[0] = DB_INSTALL_SQL;
500cd37da74Snw sql[1] = DB_UPGRADE_FROM_v1_SQL;
50148258c6bSjp sql[2] = NULL;
502cd37da74Snw
503cd37da74Snw if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql,
504cd37da74Snw FAIL_IF_CORRUPT, &created, &upgraded) < 0)
505c5c4113dSnw return (-1);
506c5c4113dSnw
507c5c4113dSnw /* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */
508cd37da74Snw sql[0] = CACHE_INSTALL_SQL;
509cd37da74Snw sql[1] = CACHE_UPGRADE_FROM_v1_SQL;
51048258c6bSjp sql[2] = CACHE_UPGRADE_FROM_v2_SQL;
51148258c6bSjp sql[3] = NULL;
51248258c6bSjp
513cd37da74Snw if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL,
514cd37da74Snw sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0)
515c5c4113dSnw return (-1);
516c5c4113dSnw
517*e3d9e7f3SGordon Ross /*
518*e3d9e7f3SGordon Ross * TODO: If cache DB NOT created, get MAX PID for allocids(), eg.
519*e3d9e7f3SGordon Ross * sql = "SELECT MAX(pid) as max_pid FROM idmap_cache;"
520*e3d9e7f3SGordon Ross * sqlite_get_table(db, sql, &results, &nrow, NULL, &errmsg);
521*e3d9e7f3SGordon Ross *
522*e3d9e7f3SGordon Ross * However, the allocids() system call does not currently allow
523*e3d9e7f3SGordon Ross * for this kind of initialization. Until that's dealt with,
524*e3d9e7f3SGordon Ross * use of a persistent idmap cache DB cannot work.
525*e3d9e7f3SGordon Ross */
526*e3d9e7f3SGordon Ross
527*e3d9e7f3SGordon Ross /* This becomes the "flush" flag for allocids() */
528cd37da74Snw _idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0;
529cd37da74Snw
530c5c4113dSnw return (0);
531c5c4113dSnw }
532c5c4113dSnw
533c5c4113dSnw /*
534c5c4113dSnw * Finalize databases
535c5c4113dSnw */
536c5c4113dSnw void
fini_dbs(void)5379bf5f78fSMatt Barden fini_dbs(void)
538cd37da74Snw {
539c5c4113dSnw }
540c5c4113dSnw
541c5c4113dSnw /*
542e8c27ec8Sbaban * This table is a listing of status codes that will be returned to the
543c5c4113dSnw * client when a SQL command fails with the corresponding error message.
544c5c4113dSnw */
545c5c4113dSnw static msg_table_t sqlmsgtable[] = {
54662c60062Sbaban {IDMAP_ERR_U2W_NAMERULE_CONFLICT,
547c5c4113dSnw "columns unixname, is_user, u2w_order are not unique"},
54862c60062Sbaban {IDMAP_ERR_W2U_NAMERULE_CONFLICT,
549cd37da74Snw "columns winname, windomain, is_user, is_wuser, w2u_order are not"
550cd37da74Snw " unique"},
551cd37da74Snw {IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"},
552c5c4113dSnw {-1, NULL}
553c5c4113dSnw };
554c5c4113dSnw
555c5c4113dSnw /*
556c5c4113dSnw * idmapd's version of string2stat to map SQLite messages to
557c5c4113dSnw * status codes
558c5c4113dSnw */
559c5c4113dSnw idmap_retcode
idmapd_string2stat(const char * msg)560cd37da74Snw idmapd_string2stat(const char *msg)
561cd37da74Snw {
562c5c4113dSnw int i;
563c5c4113dSnw for (i = 0; sqlmsgtable[i].msg; i++) {
564c5c4113dSnw if (strcasecmp(sqlmsgtable[i].msg, msg) == 0)
565c5c4113dSnw return (sqlmsgtable[i].retcode);
566c5c4113dSnw }
567c5c4113dSnw return (IDMAP_ERR_OTHER);
568c5c4113dSnw }
569c5c4113dSnw
570cd37da74Snw /*
571cd37da74Snw * Executes some SQL in a transaction.
572cd37da74Snw *
573cd37da74Snw * Returns 0 on success, -1 if it failed but the rollback succeeded, -2
574cd37da74Snw * if the rollback failed.
575cd37da74Snw */
576cd37da74Snw static
577cd37da74Snw int
sql_exec_tran_no_cb(sqlite * db,char * sql,const char * dbname,const char * while_doing)578cd37da74Snw sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
5799bf5f78fSMatt Barden const char *while_doing)
580cd37da74Snw {
581cd37da74Snw char *errmsg = NULL;
582cd37da74Snw int rc;
583cd37da74Snw
584cd37da74Snw rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg);
585cd37da74Snw if (rc != SQLITE_OK) {
586cd37da74Snw idmapdlog(LOG_ERR, "Begin transaction failed (%s) "
587cd37da74Snw "while %s (%s)", errmsg, while_doing, dbname);
588cd37da74Snw sqlite_freemem(errmsg);
589cd37da74Snw return (-1);
590cd37da74Snw }
591cd37da74Snw
592cd37da74Snw rc = sqlite_exec(db, sql, NULL, NULL, &errmsg);
593cd37da74Snw if (rc != SQLITE_OK) {
594cd37da74Snw idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg,
595cd37da74Snw while_doing, dbname);
596cd37da74Snw sqlite_freemem(errmsg);
597cd37da74Snw errmsg = NULL;
598cd37da74Snw goto rollback;
599cd37da74Snw }
600cd37da74Snw
601cd37da74Snw rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg);
602cd37da74Snw if (rc == SQLITE_OK) {
603cd37da74Snw sqlite_freemem(errmsg);
604cd37da74Snw return (0);
605cd37da74Snw }
606cd37da74Snw
607cd37da74Snw idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)",
608cd37da74Snw errmsg, while_doing, dbname);
609cd37da74Snw sqlite_freemem(errmsg);
610cd37da74Snw errmsg = NULL;
611cd37da74Snw
612cd37da74Snw rollback:
613cd37da74Snw rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg);
614cd37da74Snw if (rc != SQLITE_OK) {
615cd37da74Snw idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)",
616cd37da74Snw errmsg, while_doing, dbname);
617cd37da74Snw sqlite_freemem(errmsg);
618cd37da74Snw return (-2);
619cd37da74Snw }
620cd37da74Snw sqlite_freemem(errmsg);
621cd37da74Snw
622cd37da74Snw return (-1);
623cd37da74Snw }
624cd37da74Snw
625c5c4113dSnw /*
626c5c4113dSnw * Execute the given SQL statment without using any callbacks
627c5c4113dSnw */
628c5c4113dSnw idmap_retcode
sql_exec_no_cb(sqlite * db,const char * dbname,char * sql)62971590c90Snw sql_exec_no_cb(sqlite *db, const char *dbname, char *sql)
630cd37da74Snw {
631c5c4113dSnw char *errmsg = NULL;
63284decf41Sjp int r;
633c5c4113dSnw idmap_retcode retcode;
634c5c4113dSnw
63584decf41Sjp r = sqlite_exec(db, sql, NULL, NULL, &errmsg);
636c5c4113dSnw if (r != SQLITE_OK) {
63771590c90Snw idmapdlog(LOG_ERR, "Database error on %s while executing %s "
63871590c90Snw "(%s)", dbname, sql, CHECK_NULL(errmsg));
639*e3d9e7f3SGordon Ross
640*e3d9e7f3SGordon Ross switch (r) {
641*e3d9e7f3SGordon Ross case SQLITE_BUSY:
642*e3d9e7f3SGordon Ross case SQLITE_LOCKED:
643*e3d9e7f3SGordon Ross assert(0);
644*e3d9e7f3SGordon Ross retcode = IDMAP_ERR_INTERNAL;
645*e3d9e7f3SGordon Ross break;
646*e3d9e7f3SGordon Ross
647*e3d9e7f3SGordon Ross case SQLITE_NOMEM:
648*e3d9e7f3SGordon Ross retcode = IDMAP_ERR_MEMORY;
649*e3d9e7f3SGordon Ross break;
650*e3d9e7f3SGordon Ross
651*e3d9e7f3SGordon Ross case SQLITE_FULL:
652*e3d9e7f3SGordon Ross retcode = IDMAP_ERR_DB;
653*e3d9e7f3SGordon Ross break;
654*e3d9e7f3SGordon Ross
655*e3d9e7f3SGordon Ross default:
656*e3d9e7f3SGordon Ross retcode = idmapd_string2stat(errmsg);
657*e3d9e7f3SGordon Ross break;
658*e3d9e7f3SGordon Ross }
659*e3d9e7f3SGordon Ross
66062c60062Sbaban if (errmsg != NULL)
661c5c4113dSnw sqlite_freemem(errmsg);
662c5c4113dSnw return (retcode);
663c5c4113dSnw }
664c5c4113dSnw
665c5c4113dSnw return (IDMAP_SUCCESS);
666c5c4113dSnw }
667c5c4113dSnw
668c5c4113dSnw /*
669c5c4113dSnw * Generate expression that can be used in WHERE statements.
670c5c4113dSnw * Examples:
671c5c4113dSnw * <prefix> <col> <op> <value> <suffix>
672c5c4113dSnw * "" "unixuser" "=" "foo" "AND"
673c5c4113dSnw */
674c5c4113dSnw idmap_retcode
gen_sql_expr_from_rule(idmap_namerule * rule,char ** out)675cd37da74Snw gen_sql_expr_from_rule(idmap_namerule *rule, char **out)
676cd37da74Snw {
677cd37da74Snw char *s_windomain = NULL, *s_winname = NULL;
678cd37da74Snw char *s_unixname = NULL;
679bbf6f00cSJordan Brown char *dir;
680cd37da74Snw char *lower_winname;
681cd37da74Snw int retcode = IDMAP_SUCCESS;
682cd37da74Snw
683c5c4113dSnw if (out == NULL)
684c5c4113dSnw return (IDMAP_ERR_ARG);
685c5c4113dSnw
686c5c4113dSnw
687cd37da74Snw if (!EMPTY_STRING(rule->windomain)) {
688cd37da74Snw s_windomain = sqlite_mprintf("AND windomain = %Q ",
689cd37da74Snw rule->windomain);
690cd37da74Snw if (s_windomain == NULL) {
691cd37da74Snw retcode = IDMAP_ERR_MEMORY;
692cd37da74Snw goto out;
693cd37da74Snw }
694cd37da74Snw }
695c5c4113dSnw
696cd37da74Snw if (!EMPTY_STRING(rule->winname)) {
697cd37da74Snw if ((lower_winname = tolower_u8(rule->winname)) == NULL)
698cd37da74Snw lower_winname = rule->winname;
699cd37da74Snw s_winname = sqlite_mprintf(
700cd37da74Snw "AND winname = %Q AND is_wuser = %d ",
701cd37da74Snw lower_winname, rule->is_wuser ? 1 : 0);
702cd37da74Snw if (lower_winname != rule->winname)
703cd37da74Snw free(lower_winname);
704cd37da74Snw if (s_winname == NULL) {
705cd37da74Snw retcode = IDMAP_ERR_MEMORY;
706cd37da74Snw goto out;
707cd37da74Snw }
708cd37da74Snw }
709cd37da74Snw
710cd37da74Snw if (!EMPTY_STRING(rule->unixname)) {
711cd37da74Snw s_unixname = sqlite_mprintf(
712cd37da74Snw "AND unixname = %Q AND is_user = %d ",
713cd37da74Snw rule->unixname, rule->is_user ? 1 : 0);
714cd37da74Snw if (s_unixname == NULL) {
715cd37da74Snw retcode = IDMAP_ERR_MEMORY;
716cd37da74Snw goto out;
717cd37da74Snw }
718cd37da74Snw }
719cd37da74Snw
720bbf6f00cSJordan Brown switch (rule->direction) {
721bbf6f00cSJordan Brown case IDMAP_DIRECTION_BI:
722bbf6f00cSJordan Brown dir = "AND w2u_order > 0 AND u2w_order > 0";
723bbf6f00cSJordan Brown break;
724bbf6f00cSJordan Brown case IDMAP_DIRECTION_W2U:
725bbf6f00cSJordan Brown dir = "AND w2u_order > 0"
726bbf6f00cSJordan Brown " AND (u2w_order = 0 OR u2w_order ISNULL)";
727bbf6f00cSJordan Brown break;
728bbf6f00cSJordan Brown case IDMAP_DIRECTION_U2W:
729bbf6f00cSJordan Brown dir = "AND u2w_order > 0"
730bbf6f00cSJordan Brown " AND (w2u_order = 0 OR w2u_order ISNULL)";
731bbf6f00cSJordan Brown break;
732bbf6f00cSJordan Brown default:
733bbf6f00cSJordan Brown dir = "";
734bbf6f00cSJordan Brown break;
735bbf6f00cSJordan Brown }
736bbf6f00cSJordan Brown
737bbf6f00cSJordan Brown *out = sqlite_mprintf("%s %s %s %s",
738cd37da74Snw s_windomain ? s_windomain : "",
739cd37da74Snw s_winname ? s_winname : "",
740bbf6f00cSJordan Brown s_unixname ? s_unixname : "",
741bbf6f00cSJordan Brown dir);
742cd37da74Snw
743cd37da74Snw if (*out == NULL) {
744cd37da74Snw retcode = IDMAP_ERR_MEMORY;
745cd37da74Snw idmapdlog(LOG_ERR, "Out of memory");
746cd37da74Snw goto out;
747cd37da74Snw }
748cd37da74Snw
749cd37da74Snw out:
750cd37da74Snw if (s_windomain != NULL)
751cd37da74Snw sqlite_freemem(s_windomain);
752cd37da74Snw if (s_winname != NULL)
753cd37da74Snw sqlite_freemem(s_winname);
754cd37da74Snw if (s_unixname != NULL)
755cd37da74Snw sqlite_freemem(s_unixname);
756cd37da74Snw
757cd37da74Snw return (retcode);
758c5c4113dSnw }
759c5c4113dSnw
760cd37da74Snw
761cd37da74Snw
762c5c4113dSnw /*
763c5c4113dSnw * Generate and execute SQL statement for LIST RPC calls
764c5c4113dSnw */
765c5c4113dSnw idmap_retcode
process_list_svc_sql(sqlite * db,const char * dbname,char * sql,uint64_t limit,int flag,list_svc_cb cb,void * result)76671590c90Snw process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit,
7679bf5f78fSMatt Barden int flag, list_svc_cb cb, void *result)
768cd37da74Snw {
769c5c4113dSnw list_cb_data_t cb_data;
770c5c4113dSnw char *errmsg = NULL;
77184decf41Sjp int r;
772c5c4113dSnw idmap_retcode retcode = IDMAP_ERR_INTERNAL;
773c5c4113dSnw
774c5c4113dSnw (void) memset(&cb_data, 0, sizeof (cb_data));
775c5c4113dSnw cb_data.result = result;
776c5c4113dSnw cb_data.limit = limit;
77748258c6bSjp cb_data.flag = flag;
778c5c4113dSnw
77984decf41Sjp
78084decf41Sjp r = sqlite_exec(db, sql, cb, &cb_data, &errmsg);
78184decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
78284decf41Sjp switch (r) {
78384decf41Sjp case SQLITE_OK:
78484decf41Sjp retcode = IDMAP_SUCCESS;
78584decf41Sjp break;
78684decf41Sjp
78784decf41Sjp default:
78884decf41Sjp retcode = IDMAP_ERR_INTERNAL;
78971590c90Snw idmapdlog(LOG_ERR, "Database error on %s while executing "
79071590c90Snw "%s (%s)", dbname, sql, CHECK_NULL(errmsg));
79184decf41Sjp break;
792c5c4113dSnw }
79362c60062Sbaban if (errmsg != NULL)
794c5c4113dSnw sqlite_freemem(errmsg);
795c5c4113dSnw return (retcode);
796c5c4113dSnw }
797c5c4113dSnw
798c5c4113dSnw /*
799c5c4113dSnw * This routine is called by callbacks that process the results of
800c5c4113dSnw * LIST RPC calls to validate data and to allocate memory for
801c5c4113dSnw * the result array.
802c5c4113dSnw */
803c5c4113dSnw idmap_retcode
validate_list_cb_data(list_cb_data_t * cb_data,int argc,char ** argv,int ncol,uchar_t ** list,size_t valsize)804c5c4113dSnw validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv,
8059bf5f78fSMatt Barden int ncol, uchar_t **list, size_t valsize)
806cd37da74Snw {
807c5c4113dSnw size_t nsize;
808c5c4113dSnw void *tmplist;
809c5c4113dSnw
810c5c4113dSnw if (cb_data->limit > 0 && cb_data->next == cb_data->limit)
811c5c4113dSnw return (IDMAP_NEXT);
812c5c4113dSnw
813c5c4113dSnw if (argc < ncol || argv == NULL) {
814c5c4113dSnw idmapdlog(LOG_ERR, "Invalid data");
815c5c4113dSnw return (IDMAP_ERR_INTERNAL);
816c5c4113dSnw }
817c5c4113dSnw
818c5c4113dSnw /* alloc in bulk to reduce number of reallocs */
819c5c4113dSnw if (cb_data->next >= cb_data->len) {
820c5c4113dSnw nsize = (cb_data->len + SIZE_INCR) * valsize;
821c5c4113dSnw tmplist = realloc(*list, nsize);
822c5c4113dSnw if (tmplist == NULL) {
823c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
824c5c4113dSnw return (IDMAP_ERR_MEMORY);
825c5c4113dSnw }
826c5c4113dSnw *list = tmplist;
827c5c4113dSnw (void) memset(*list + (cb_data->len * valsize), 0,
828cd37da74Snw SIZE_INCR * valsize);
829c5c4113dSnw cb_data->len += SIZE_INCR;
830c5c4113dSnw }
831c5c4113dSnw return (IDMAP_SUCCESS);
832c5c4113dSnw }
833c5c4113dSnw
834cd37da74Snw static
835cd37da74Snw idmap_retcode
get_namerule_order(char * winname,char * windomain,char * unixname,int direction,int is_diagonal,int * w2u_order,int * u2w_order)836c5c4113dSnw get_namerule_order(char *winname, char *windomain, char *unixname,
8379bf5f78fSMatt Barden int direction, int is_diagonal, int *w2u_order, int *u2w_order)
838cd37da74Snw {
839c5c4113dSnw *w2u_order = 0;
840c5c4113dSnw *u2w_order = 0;
841c5c4113dSnw
842c5c4113dSnw /*
843c5c4113dSnw * Windows to UNIX lookup order:
844c5c4113dSnw * 1. winname@domain (or winname) to ""
845c5c4113dSnw * 2. winname@domain (or winname) to unixname
846c5c4113dSnw * 3. winname@* to ""
847c5c4113dSnw * 4. winname@* to unixname
848c5c4113dSnw * 5. *@domain (or *) to *
849c5c4113dSnw * 6. *@domain (or *) to ""
850c5c4113dSnw * 7. *@domain (or *) to unixname
851c5c4113dSnw * 8. *@* to *
852c5c4113dSnw * 9. *@* to ""
853c5c4113dSnw * 10. *@* to unixname
854c5c4113dSnw *
855c5c4113dSnw * winname is a special case of winname@domain when domain is the
856c5c4113dSnw * default domain. Similarly * is a special case of *@domain when
857c5c4113dSnw * domain is the default domain.
858c5c4113dSnw *
859c5c4113dSnw * Note that "" has priority over specific names because "" inhibits
860c5c4113dSnw * mappings and traditionally deny rules always had higher priority.
861c5c4113dSnw */
862651c0131Sbaban if (direction != IDMAP_DIRECTION_U2W) {
863651c0131Sbaban /* bi-directional or from windows to unix */
864c5c4113dSnw if (winname == NULL)
865c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE);
866c5c4113dSnw else if (unixname == NULL)
867c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE);
868c5c4113dSnw else if (EMPTY_NAME(winname))
869c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE);
870c5c4113dSnw else if (*winname == '*' && windomain && *windomain == '*') {
871c5c4113dSnw if (*unixname == '*')
872c5c4113dSnw *w2u_order = 8;
873c5c4113dSnw else if (EMPTY_NAME(unixname))
874c5c4113dSnw *w2u_order = 9;
875c5c4113dSnw else /* unixname == name */
876c5c4113dSnw *w2u_order = 10;
877c5c4113dSnw } else if (*winname == '*') {
878c5c4113dSnw if (*unixname == '*')
879c5c4113dSnw *w2u_order = 5;
880c5c4113dSnw else if (EMPTY_NAME(unixname))
881c5c4113dSnw *w2u_order = 6;
882c5c4113dSnw else /* name */
883c5c4113dSnw *w2u_order = 7;
88462c60062Sbaban } else if (windomain != NULL && *windomain == '*') {
885c5c4113dSnw /* winname == name */
886c5c4113dSnw if (*unixname == '*')
887c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE);
888c5c4113dSnw else if (EMPTY_NAME(unixname))
889c5c4113dSnw *w2u_order = 3;
890c5c4113dSnw else /* name */
891c5c4113dSnw *w2u_order = 4;
892c5c4113dSnw } else {
893c5c4113dSnw /* winname == name && windomain == null or name */
894c5c4113dSnw if (*unixname == '*')
895c5c4113dSnw return (IDMAP_ERR_W2U_NAMERULE);
896c5c4113dSnw else if (EMPTY_NAME(unixname))
897c5c4113dSnw *w2u_order = 1;
898c5c4113dSnw else /* name */
899c5c4113dSnw *w2u_order = 2;
900c5c4113dSnw }
901cd37da74Snw
902c5c4113dSnw }
903c5c4113dSnw
904c5c4113dSnw /*
905cd37da74Snw * 1. unixname to "", non-diagonal
906cd37da74Snw * 2. unixname to winname@domain (or winname), non-diagonal
907cd37da74Snw * 3. unixname to "", diagonal
908cd37da74Snw * 4. unixname to winname@domain (or winname), diagonal
909cd37da74Snw * 5. * to *@domain (or *), non-diagonal
910cd37da74Snw * 5. * to *@domain (or *), diagonal
911cd37da74Snw * 7. * to ""
912cd37da74Snw * 8. * to winname@domain (or winname)
913cd37da74Snw * 9. * to "", non-diagonal
914cd37da74Snw * 10. * to winname@domain (or winname), diagonal
915c5c4113dSnw */
916651c0131Sbaban if (direction != IDMAP_DIRECTION_W2U) {
917cd37da74Snw int diagonal = is_diagonal ? 1 : 0;
918cd37da74Snw
919651c0131Sbaban /* bi-directional or from unix to windows */
920c5c4113dSnw if (unixname == NULL || EMPTY_NAME(unixname))
921c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE);
922c5c4113dSnw else if (winname == NULL)
923c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE);
92462c60062Sbaban else if (windomain != NULL && *windomain == '*')
925651c0131Sbaban return (IDMAP_ERR_U2W_NAMERULE);
926c5c4113dSnw else if (*unixname == '*') {
927c5c4113dSnw if (*winname == '*')
928cd37da74Snw *u2w_order = 5 + diagonal;
929c5c4113dSnw else if (EMPTY_NAME(winname))
930cd37da74Snw *u2w_order = 7 + 2 * diagonal;
931c5c4113dSnw else
932cd37da74Snw *u2w_order = 8 + 2 * diagonal;
933c5c4113dSnw } else {
934c5c4113dSnw if (*winname == '*')
935c5c4113dSnw return (IDMAP_ERR_U2W_NAMERULE);
936c5c4113dSnw else if (EMPTY_NAME(winname))
937cd37da74Snw *u2w_order = 1 + 2 * diagonal;
938c5c4113dSnw else
939cd37da74Snw *u2w_order = 2 + 2 * diagonal;
940c5c4113dSnw }
941c5c4113dSnw }
942c5c4113dSnw return (IDMAP_SUCCESS);
943c5c4113dSnw }
944c5c4113dSnw
945c5c4113dSnw /*
946c5c4113dSnw * Generate and execute SQL statement to add name-based mapping rule
947c5c4113dSnw */
948c5c4113dSnw idmap_retcode
add_namerule(sqlite * db,idmap_namerule * rule)949cd37da74Snw add_namerule(sqlite *db, idmap_namerule *rule)
950cd37da74Snw {
951c5c4113dSnw char *sql = NULL;
952c5c4113dSnw idmap_stat retcode;
9538e228215Sdm char *dom = NULL;
95408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *name;
955c5c4113dSnw int w2u_order, u2w_order;
956c5c4113dSnw char w2ubuf[11], u2wbuf[11];
95708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canonname = NULL;
95808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canondomain = NULL;
959c5c4113dSnw
9608e228215Sdm retcode = get_namerule_order(rule->winname, rule->windomain,
961cd37da74Snw rule->unixname, rule->direction,
962cd37da74Snw rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order);
963c5c4113dSnw if (retcode != IDMAP_SUCCESS)
964c5c4113dSnw goto out;
965c5c4113dSnw
966c5c4113dSnw if (w2u_order)
967c5c4113dSnw (void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order);
968c5c4113dSnw if (u2w_order)
969c5c4113dSnw (void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order);
970c5c4113dSnw
97162c60062Sbaban /*
97262c60062Sbaban * For the triggers on namerules table to work correctly:
97362c60062Sbaban * 1) Use NULL instead of 0 for w2u_order and u2w_order
97462c60062Sbaban * 2) Use "" instead of NULL for "no domain"
97562c60062Sbaban */
976c5c4113dSnw
97708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name = rule->winname;
97808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = rule->windomain;
97962c60062Sbaban
98062c60062Sbaban RDLOCK_CONFIG();
98108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (lookup_wksids_name2sid(name, dom,
98208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States &canonname, &canondomain,
98308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States NULL, NULL, NULL) == IDMAP_SUCCESS) {
98408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name = canonname;
98508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = canondomain;
98608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else if (EMPTY_STRING(dom)) {
987c8e26105Sjp if (_idmapdstate.cfg->pgcfg.default_domain)
988c8e26105Sjp dom = _idmapdstate.cfg->pgcfg.default_domain;
98962c60062Sbaban else
99062c60062Sbaban dom = "";
99162c60062Sbaban }
99284decf41Sjp sql = sqlite_mprintf("INSERT into namerules "
993cd37da74Snw "(is_user, is_wuser, windomain, winname_display, is_nt4, "
994cd37da74Snw "unixname, w2u_order, u2w_order) "
995cd37da74Snw "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);",
996cd37da74Snw rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom,
99708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States name, rule->is_nt4 ? 1 : 0, rule->unixname,
998cd37da74Snw w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL);
999c5c4113dSnw UNLOCK_CONFIG();
1000c5c4113dSnw
1001c5c4113dSnw if (sql == NULL) {
1002c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
1003c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
1004c5c4113dSnw goto out;
1005c5c4113dSnw }
1006c5c4113dSnw
100771590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
1008c5c4113dSnw
1009c5c4113dSnw if (retcode == IDMAP_ERR_OTHER)
1010c5c4113dSnw retcode = IDMAP_ERR_CFG;
1011c5c4113dSnw
1012c5c4113dSnw out:
101308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(canonname);
101408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(canondomain);
101562c60062Sbaban if (sql != NULL)
1016c5c4113dSnw sqlite_freemem(sql);
1017c5c4113dSnw return (retcode);
1018c5c4113dSnw }
1019c5c4113dSnw
1020c5c4113dSnw /*
1021c5c4113dSnw * Flush name-based mapping rules
1022c5c4113dSnw */
1023c5c4113dSnw idmap_retcode
flush_namerules(sqlite * db)1024cd37da74Snw flush_namerules(sqlite *db)
1025cd37da74Snw {
1026c5c4113dSnw idmap_stat retcode;
1027c5c4113dSnw
102871590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;");
1029c5c4113dSnw
1030c5c4113dSnw return (retcode);
1031c5c4113dSnw }
1032c5c4113dSnw
1033c5c4113dSnw /*
1034c5c4113dSnw * Generate and execute SQL statement to remove a name-based mapping rule
1035c5c4113dSnw */
1036c5c4113dSnw idmap_retcode
rm_namerule(sqlite * db,idmap_namerule * rule)1037cd37da74Snw rm_namerule(sqlite *db, idmap_namerule *rule)
1038cd37da74Snw {
1039c5c4113dSnw char *sql = NULL;
1040c5c4113dSnw idmap_stat retcode;
1041cd37da74Snw char *expr = NULL;
1042c5c4113dSnw
10438e228215Sdm if (rule->direction < 0 && EMPTY_STRING(rule->windomain) &&
10448e228215Sdm EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname))
1045c5c4113dSnw return (IDMAP_SUCCESS);
1046c5c4113dSnw
1047cd37da74Snw retcode = gen_sql_expr_from_rule(rule, &expr);
1048cd37da74Snw if (retcode != IDMAP_SUCCESS)
1049cd37da74Snw goto out;
1050c5c4113dSnw
1051bbf6f00cSJordan Brown sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s;", expr);
1052c5c4113dSnw
1053c5c4113dSnw if (sql == NULL) {
1054c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
1055c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
1056c5c4113dSnw goto out;
1057c5c4113dSnw }
1058c5c4113dSnw
1059cd37da74Snw
106071590c90Snw retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
1061c5c4113dSnw
1062c5c4113dSnw out:
1063cd37da74Snw if (expr != NULL)
1064cd37da74Snw sqlite_freemem(expr);
106562c60062Sbaban if (sql != NULL)
1066c5c4113dSnw sqlite_freemem(sql);
1067c5c4113dSnw return (retcode);
1068c5c4113dSnw }
1069c5c4113dSnw
1070c5c4113dSnw /*
1071c5c4113dSnw * Compile the given SQL query and step just once.
1072c5c4113dSnw *
1073c5c4113dSnw * Input:
1074c5c4113dSnw * db - db handle
1075c5c4113dSnw * sql - SQL statement
1076c5c4113dSnw *
1077c5c4113dSnw * Output:
1078c5c4113dSnw * vm - virtual SQL machine
1079c5c4113dSnw * ncol - number of columns in the result
1080c5c4113dSnw * values - column values
1081c5c4113dSnw *
1082c5c4113dSnw * Return values:
1083c5c4113dSnw * IDMAP_SUCCESS
1084c5c4113dSnw * IDMAP_ERR_NOTFOUND
1085c5c4113dSnw * IDMAP_ERR_INTERNAL
1086c5c4113dSnw */
1087c5c4113dSnw
1088cd37da74Snw static
1089cd37da74Snw idmap_retcode
sql_compile_n_step_once(sqlite * db,char * sql,sqlite_vm ** vm,int * ncol,int reqcol,const char *** values)1090c5c4113dSnw sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol,
10919bf5f78fSMatt Barden int reqcol, const char ***values)
1092cd37da74Snw {
1093c5c4113dSnw char *errmsg = NULL;
109484decf41Sjp int r;
1095c5c4113dSnw
109684decf41Sjp if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) {
1097cd37da74Snw idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1098cd37da74Snw CHECK_NULL(errmsg));
1099c5c4113dSnw sqlite_freemem(errmsg);
1100c5c4113dSnw return (IDMAP_ERR_INTERNAL);
1101c5c4113dSnw }
1102c5c4113dSnw
110384decf41Sjp r = sqlite_step(*vm, ncol, values, NULL);
110484decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
1105c5c4113dSnw
110684decf41Sjp if (r == SQLITE_ROW) {
110762c60062Sbaban if (ncol != NULL && *ncol < reqcol) {
1108c5c4113dSnw (void) sqlite_finalize(*vm, NULL);
1109c5c4113dSnw *vm = NULL;
1110c5c4113dSnw return (IDMAP_ERR_INTERNAL);
1111c5c4113dSnw }
1112c5c4113dSnw /* Caller will call finalize after using the results */
1113c5c4113dSnw return (IDMAP_SUCCESS);
1114c5c4113dSnw } else if (r == SQLITE_DONE) {
1115c5c4113dSnw (void) sqlite_finalize(*vm, NULL);
1116c5c4113dSnw *vm = NULL;
1117c5c4113dSnw return (IDMAP_ERR_NOTFOUND);
1118c5c4113dSnw }
1119c5c4113dSnw
1120c5c4113dSnw (void) sqlite_finalize(*vm, &errmsg);
1121c5c4113dSnw *vm = NULL;
1122cd37da74Snw idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1123cd37da74Snw CHECK_NULL(errmsg));
1124c5c4113dSnw sqlite_freemem(errmsg);
1125c5c4113dSnw return (IDMAP_ERR_INTERNAL);
1126c5c4113dSnw }
1127c5c4113dSnw
1128e8c27ec8Sbaban /*
1129479ac375Sdm * Load config in the state.
1130e8c27ec8Sbaban *
1131479ac375Sdm * nm_siduid and nm_sidgid fields:
1132e8c27ec8Sbaban * state->nm_siduid represents mode used by sid2uid and uid2sid
1133e8c27ec8Sbaban * requests for directory-based name mappings. Similarly,
1134e8c27ec8Sbaban * state->nm_sidgid represents mode used by sid2gid and gid2sid
1135e8c27ec8Sbaban * requests.
1136e8c27ec8Sbaban *
1137e8c27ec8Sbaban * sid2uid/uid2sid:
1138e3f2c991SKeyur Desai * none -> directory_based_mapping != DIRECTORY_MAPPING_NAME
1139e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixuser_attr
1140e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr
1141e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixuser_attr
1142e8c27ec8Sbaban *
1143e8c27ec8Sbaban * sid2gid/gid2sid:
1144e3f2c991SKeyur Desai * none -> directory_based_mapping != DIRECTORY_MAPPING_NAME
1145e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixgroup_attr
1146e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr
1147e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr
1148e8c27ec8Sbaban */
1149e8c27ec8Sbaban idmap_retcode
load_cfg_in_state(lookup_state_t * state)1150479ac375Sdm load_cfg_in_state(lookup_state_t *state)
1151e8c27ec8Sbaban {
1152e8c27ec8Sbaban state->nm_siduid = IDMAP_NM_NONE;
1153e8c27ec8Sbaban state->nm_sidgid = IDMAP_NM_NONE;
1154e8c27ec8Sbaban RDLOCK_CONFIG();
1155479ac375Sdm
11564aa0a5e7Snw state->eph_map_unres_sids = 0;
11574aa0a5e7Snw if (_idmapdstate.cfg->pgcfg.eph_map_unres_sids)
11584aa0a5e7Snw state->eph_map_unres_sids = 1;
11594aa0a5e7Snw
116048cd229bSGordon Ross state->id_cache_timeout =
116148cd229bSGordon Ross _idmapdstate.cfg->pgcfg.id_cache_timeout;
116248cd229bSGordon Ross state->name_cache_timeout =
116348cd229bSGordon Ross _idmapdstate.cfg->pgcfg.name_cache_timeout;
116448cd229bSGordon Ross
1165e3f2c991SKeyur Desai state->directory_based_mapping =
1166e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.directory_based_mapping;
1167e3f2c991SKeyur Desai
1168479ac375Sdm if (_idmapdstate.cfg->pgcfg.default_domain != NULL) {
1169479ac375Sdm state->defdom =
1170479ac375Sdm strdup(_idmapdstate.cfg->pgcfg.default_domain);
1171479ac375Sdm if (state->defdom == NULL) {
1172479ac375Sdm UNLOCK_CONFIG();
1173479ac375Sdm return (IDMAP_ERR_MEMORY);
1174479ac375Sdm }
1175479ac375Sdm } else {
1176479ac375Sdm UNLOCK_CONFIG();
1177dc03a638Sdm return (IDMAP_SUCCESS);
1178479ac375Sdm }
1179e3f2c991SKeyur Desai
1180e3f2c991SKeyur Desai if (_idmapdstate.cfg->pgcfg.directory_based_mapping !=
1181e3f2c991SKeyur Desai DIRECTORY_MAPPING_NAME) {
1182e8c27ec8Sbaban UNLOCK_CONFIG();
1183e8c27ec8Sbaban return (IDMAP_SUCCESS);
1184e8c27ec8Sbaban }
1185e3f2c991SKeyur Desai
1186e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1187e8c27ec8Sbaban state->nm_siduid =
1188e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1189e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1190e8c27ec8Sbaban state->nm_sidgid =
1191e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1192e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1193e8c27ec8Sbaban } else {
1194e8c27ec8Sbaban state->nm_siduid =
1195e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1196e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE;
1197e8c27ec8Sbaban state->nm_sidgid =
1198e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1199e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE;
1200e8c27ec8Sbaban }
1201e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) {
1202e8c27ec8Sbaban state->ad_unixuser_attr =
1203e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr);
1204e8c27ec8Sbaban if (state->ad_unixuser_attr == NULL) {
1205e8c27ec8Sbaban UNLOCK_CONFIG();
1206e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
1207e8c27ec8Sbaban }
1208e8c27ec8Sbaban }
1209e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) {
1210e8c27ec8Sbaban state->ad_unixgroup_attr =
1211e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr);
1212e8c27ec8Sbaban if (state->ad_unixgroup_attr == NULL) {
1213e8c27ec8Sbaban UNLOCK_CONFIG();
1214e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
1215e8c27ec8Sbaban }
1216e8c27ec8Sbaban }
1217479ac375Sdm if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1218479ac375Sdm state->nldap_winname_attr =
1219479ac375Sdm strdup(_idmapdstate.cfg->pgcfg.nldap_winname_attr);
1220479ac375Sdm if (state->nldap_winname_attr == NULL) {
1221479ac375Sdm UNLOCK_CONFIG();
1222479ac375Sdm return (IDMAP_ERR_MEMORY);
1223479ac375Sdm }
1224479ac375Sdm }
1225e8c27ec8Sbaban UNLOCK_CONFIG();
1226e8c27ec8Sbaban return (IDMAP_SUCCESS);
1227e8c27ec8Sbaban }
1228e8c27ec8Sbaban
122948258c6bSjp /*
123008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Set the rule with specified values.
123148258c6bSjp * All the strings are copied.
123248258c6bSjp */
123348258c6bSjp static void
idmap_namerule_set(idmap_namerule * rule,const char * windomain,const char * winname,const char * unixname,boolean_t is_user,boolean_t is_wuser,boolean_t is_nt4,int direction)123448258c6bSjp idmap_namerule_set(idmap_namerule *rule, const char *windomain,
12359bf5f78fSMatt Barden const char *winname, const char *unixname, boolean_t is_user,
12369bf5f78fSMatt Barden boolean_t is_wuser, boolean_t is_nt4, int direction)
123748258c6bSjp {
123848258c6bSjp /*
123948258c6bSjp * Only update if they differ because we have to free
124048258c6bSjp * and duplicate the strings
124148258c6bSjp */
124248258c6bSjp if (rule->windomain == NULL || windomain == NULL ||
124348258c6bSjp strcmp(rule->windomain, windomain) != 0) {
124448258c6bSjp if (rule->windomain != NULL) {
124548258c6bSjp free(rule->windomain);
124648258c6bSjp rule->windomain = NULL;
124748258c6bSjp }
124848258c6bSjp if (windomain != NULL)
124948258c6bSjp rule->windomain = strdup(windomain);
125048258c6bSjp }
125148258c6bSjp
125248258c6bSjp if (rule->winname == NULL || winname == NULL ||
125348258c6bSjp strcmp(rule->winname, winname) != 0) {
125448258c6bSjp if (rule->winname != NULL) {
125548258c6bSjp free(rule->winname);
125648258c6bSjp rule->winname = NULL;
125748258c6bSjp }
125848258c6bSjp if (winname != NULL)
125948258c6bSjp rule->winname = strdup(winname);
126048258c6bSjp }
126148258c6bSjp
126248258c6bSjp if (rule->unixname == NULL || unixname == NULL ||
126348258c6bSjp strcmp(rule->unixname, unixname) != 0) {
126448258c6bSjp if (rule->unixname != NULL) {
126548258c6bSjp free(rule->unixname);
126648258c6bSjp rule->unixname = NULL;
126748258c6bSjp }
126848258c6bSjp if (unixname != NULL)
126948258c6bSjp rule->unixname = strdup(unixname);
127048258c6bSjp }
127148258c6bSjp
127248258c6bSjp rule->is_user = is_user;
127348258c6bSjp rule->is_wuser = is_wuser;
127448258c6bSjp rule->is_nt4 = is_nt4;
127548258c6bSjp rule->direction = direction;
127648258c6bSjp }
127748258c6bSjp
1278e8c27ec8Sbaban /*
1279e8c27ec8Sbaban * Lookup well-known SIDs table either by winname or by SID.
128008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
128108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If the given winname or SID is a well-known SID then we set is_wksid
1282e8c27ec8Sbaban * variable and then proceed to see if the SID has a hard mapping to
1283e8c27ec8Sbaban * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to
128408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * fixed ephemeral ids). The direction flag indicates whether we have
128508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * a mapping; UNDEF indicates that we do not.
128608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
128708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we find a mapping then we return success, except for the
12889fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * special case of IDMAP_SENTINEL_PID which indicates an inhibited mapping.
128908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
129008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we find a matching entry, but no mapping, we supply SID, name, and type
129108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * information and return "not found". Higher layers will probably
129208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * do ephemeral mapping.
129308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
129408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we do not find a match, we return "not found" and leave the question
129508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * to higher layers.
1296e8c27ec8Sbaban */
1297cd37da74Snw static
1298cd37da74Snw idmap_retcode
lookup_wksids_sid2pid(idmap_mapping * req,idmap_id_res * res,int * is_wksid)129908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *is_wksid)
1300cd37da74Snw {
130108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid;
130262c60062Sbaban
130308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *is_wksid = 0;
130462c60062Sbaban
130508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.sid.prefix != NULL ||
130608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name != NULL);
130708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
130808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix != NULL) {
130908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_sid(req->id1.idmap_id_u.sid.prefix,
131008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.rid, res->id.idtype);
131108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
131208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_name(req->id1name, req->id1domain,
131308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype);
131408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
131508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL)
131608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND);
131708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
131808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Found matching entry. */
131908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
132008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in name if it was not already there. */
132108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1name == NULL) {
132208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name = strdup(wksid->winname);
132308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1name == NULL)
132408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY);
132508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
132608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
132708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in SID if it was not already there */
132808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix == NULL) {
132908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) {
133008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.prefix =
133108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(wksid->sidprefix);
133208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
133308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
1334e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix =
133508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(_idmapdstate.cfg->pgcfg.machine_sid);
133608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
1337e8c27ec8Sbaban }
133808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.sid.prefix == NULL)
133908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY);
134008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idmap_id_u.sid.rid = wksid->rid;
134108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
1342e8c27ec8Sbaban
134308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Fill in the canonical domain if not already there */
134408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1domain == NULL) {
134508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *dom;
1346e8c27ec8Sbaban
134708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
1348fe1c642dSBill Krier if (wksid->domain != NULL)
134908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = wksid->domain;
1350fe1c642dSBill Krier else
135108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States dom = _idmapdstate.hostname;
135208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1domain = strdup(dom);
135308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
135408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1domain == NULL)
135508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY);
135608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
1357e8c27ec8Sbaban
135808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *is_wksid = 1;
135908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
1360e8c27ec8Sbaban
136108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1.idtype = wksid->is_wuser ? IDMAP_USID : IDMAP_GSID;
136208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
136308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idtype == IDMAP_POSIXID) {
136408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype = wksid->is_wuser ? IDMAP_UID : IDMAP_GID;
1365c5c4113dSnw }
136608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
136708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->direction == IDMAP_DIRECTION_UNDEF) {
136808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
136908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * We don't have a mapping
137008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * (But note that we may have supplied SID, name, or type
137108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * information.)
137208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
137308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND);
137408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
137508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
137608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
137708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * We have an explicit mapping.
137808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
13799fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->pid == IDMAP_SENTINEL_PID) {
138008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
138108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * ... which is that mapping is inhibited.
138208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
138308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOMAPPING);
138408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
138508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
138608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States switch (res->id.idtype) {
138708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_UID:
138808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = wksid->pid;
138908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States break;
139008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_GID:
139108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.gid = wksid->pid;
139208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States break;
139308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States default:
139408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* IDMAP_POSIXID is eliminated above */
139508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTSUPPORTED);
139608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
139708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
139808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->direction = wksid->direction;
139908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID;
140008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.src = IDMAP_MAP_SRC_HARD_CODED;
140108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS);
1402c5c4113dSnw }
1403c5c4113dSnw
1404cd37da74Snw
140508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
140608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Look for an entry mapping a PID to a SID.
140708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
140808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Note that direction=UNDEF entries do not specify a mapping,
14099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * and that IDMAP_SENTINEL_PID entries represent either an inhibited
141008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * mapping or an ephemeral mapping. We don't handle either here;
141108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * they are filtered out by find_wksid_by_pid.
141208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
1413cd37da74Snw static
1414cd37da74Snw idmap_retcode
lookup_wksids_pid2sid(idmap_mapping * req,idmap_id_res * res,int is_user)1415cd37da74Snw lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user)
1416cd37da74Snw {
141708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid;
141808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
141908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_pid(req->id1.idmap_id_u.uid, is_user);
142008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL)
1421e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
142208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
142308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idtype == IDMAP_SID) {
142408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idtype = wksid->is_wuser ? IDMAP_USID : IDMAP_GSID;
142508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
142608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.rid = wksid->rid;
142708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
142808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) {
142908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.prefix =
143008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(wksid->sidprefix);
143108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
143208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
143308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.sid.prefix =
143408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States strdup(_idmapdstate.cfg->pgcfg.machine_sid);
143508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
143608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
143708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
143808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (res->id.idmap_id_u.sid.prefix == NULL) {
143908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory");
144008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY);
144162c60062Sbaban }
144208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1443fe1c642dSBill Krier /* Fill in name if it was not already there. */
1444fe1c642dSBill Krier if (req->id2name == NULL) {
1445fe1c642dSBill Krier req->id2name = strdup(wksid->winname);
1446fe1c642dSBill Krier if (req->id2name == NULL)
1447fe1c642dSBill Krier return (IDMAP_ERR_MEMORY);
1448fe1c642dSBill Krier }
1449fe1c642dSBill Krier
1450fe1c642dSBill Krier /* Fill in the canonical domain if not already there */
1451fe1c642dSBill Krier if (req->id2domain == NULL) {
1452fe1c642dSBill Krier const char *dom;
1453fe1c642dSBill Krier
1454fe1c642dSBill Krier RDLOCK_CONFIG();
1455fe1c642dSBill Krier if (wksid->domain != NULL)
1456fe1c642dSBill Krier dom = wksid->domain;
1457fe1c642dSBill Krier else
1458fe1c642dSBill Krier dom = _idmapdstate.hostname;
1459fe1c642dSBill Krier req->id2domain = strdup(dom);
1460fe1c642dSBill Krier UNLOCK_CONFIG();
1461fe1c642dSBill Krier if (req->id2domain == NULL)
1462fe1c642dSBill Krier return (IDMAP_ERR_MEMORY);
1463fe1c642dSBill Krier }
1464fe1c642dSBill Krier
146508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->direction = wksid->direction;
146608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.how.map_type = IDMAP_MAP_TYPE_KNOWN_SID;
146708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States res->info.src = IDMAP_MAP_SRC_HARD_CODED;
146808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS);
146962c60062Sbaban }
147062c60062Sbaban
147108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
147208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Look up a name in the wksids list, matching name and, if supplied, domain,
147308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * and extract data.
147408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
147508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given:
147608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name
147708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name (or NULL)
147808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
147908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Return: Error code
148008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
148108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname canonical name (if canonname non-NULL) [1]
148208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canondomain canonical domain (if canondomain non-NULL) [1]
148308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix (if sidprefix non-NULL) [1]
148408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID (if rid non-NULL) [2]
148508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *type Type (if type non-NULL) [2]
148608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
148708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error
148808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [2] Undefined on error
148908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
1490cd37da74Snw idmap_retcode
lookup_wksids_name2sid(const char * name,const char * domain,char ** canonname,char ** canondomain,char ** sidprefix,idmap_rid_t * rid,idmap_id_type * type)149108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_wksids_name2sid(
149208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *name,
149308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *domain,
149408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canonname,
149508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canondomain,
149608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **sidprefix,
149708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *rid,
1498148c5f43SAlan Wright idmap_id_type *type)
1499cd37da74Snw {
150008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const wksids_table_t *wksid;
1501479ac375Sdm
150208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL)
150308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL;
150408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL)
150508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
150608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL)
150708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL;
1508479ac375Sdm
150908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States wksid = find_wksid_by_name(name, domain, IDMAP_POSIXID);
151008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid == NULL)
151108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_NOTFOUND);
151208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
151308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) {
151408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->sidprefix != NULL) {
151508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(wksid->sidprefix);
151608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
151708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
151808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(
151908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.cfg->pgcfg.machine_sid);
152008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
1521e8c27ec8Sbaban }
152208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*sidprefix == NULL)
152308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem;
152408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
152508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
152608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (rid != NULL)
152708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *rid = wksid->rid;
152808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
152908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
153008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = strdup(wksid->winname);
153108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canonname == NULL)
153208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem;
153308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
153408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
153508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) {
153608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (wksid->domain != NULL) {
153708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(wksid->domain);
153808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
153908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States RDLOCK_CONFIG();
154008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(_idmapdstate.hostname);
154108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States UNLOCK_CONFIG();
1542c5c4113dSnw }
154308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canondomain == NULL)
154408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto nomem;
154508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
154608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
154708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (type != NULL)
154808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *type = (wksid->is_wuser) ?
1549148c5f43SAlan Wright IDMAP_USID : IDMAP_GSID;
155008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
155108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_SUCCESS);
155208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
155308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States nomem:
155408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory");
155508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
155608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (sidprefix != NULL) {
155708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*sidprefix);
155808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL;
1559c5c4113dSnw }
156008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
156108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
156208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname);
156308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
156408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
156508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
156608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) {
156708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canondomain);
156808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL;
156908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
157008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
157108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_MEMORY);
1572c5c4113dSnw }
1573c5c4113dSnw
1574cd37da74Snw static
1575cd37da74Snw idmap_retcode
lookup_cache_sid2pid(sqlite * cache,idmap_mapping * req,idmap_id_res * res)1576cd37da74Snw lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1577cd37da74Snw {
1578c5c4113dSnw char *end;
1579c5c4113dSnw char *sql = NULL;
1580c5c4113dSnw const char **values;
1581c5c4113dSnw sqlite_vm *vm = NULL;
1582c5c4113dSnw int ncol, is_user;
1583c5c4113dSnw uid_t pid;
1584c5c4113dSnw time_t curtime, exp;
1585c5c4113dSnw idmap_retcode retcode;
1586042addd6Sbaban char *is_user_string, *lower_name;
1587c5c4113dSnw
1588c5c4113dSnw /* Current time */
1589c5c4113dSnw errno = 0;
1590c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) {
1591cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1592cd37da74Snw strerror(errno));
1593c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
1594c5c4113dSnw goto out;
1595c5c4113dSnw }
1596c5c4113dSnw
1597e8c27ec8Sbaban switch (res->id.idtype) {
1598cd37da74Snw case IDMAP_UID:
1599cd37da74Snw is_user_string = "1";
1600cd37da74Snw break;
1601cd37da74Snw case IDMAP_GID:
1602cd37da74Snw is_user_string = "0";
1603cd37da74Snw break;
1604cd37da74Snw case IDMAP_POSIXID:
1605cd37da74Snw /* the non-diagonal mapping */
1606cd37da74Snw is_user_string = "is_wuser";
1607cd37da74Snw break;
1608cd37da74Snw default:
1609cd37da74Snw retcode = IDMAP_ERR_NOTSUPPORTED;
1610cd37da74Snw goto out;
1611cd37da74Snw }
1612cd37da74Snw
1613c5c4113dSnw /* SQL to lookup the cache */
161448258c6bSjp
1615e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) {
1616e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
161748258c6bSjp "unixname, u2w, is_wuser, "
161848258c6bSjp "map_type, map_dn, map_attr, map_value, "
161948258c6bSjp "map_windomain, map_winname, map_unixname, map_is_nt4 "
1620e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND "
1621e8c27ec8Sbaban "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
1622e8c27ec8Sbaban "(pid >= 2147483648 OR "
1623e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR "
1624e8c27ec8Sbaban "expiration > %d));",
1625e8c27ec8Sbaban is_user_string, req->id1.idmap_id_u.sid.prefix,
1626e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, curtime);
1627e8c27ec8Sbaban } else if (req->id1name != NULL) {
1628042addd6Sbaban if ((lower_name = tolower_u8(req->id1name)) == NULL)
1629042addd6Sbaban lower_name = req->id1name;
1630e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
163148258c6bSjp "unixname, u2w, is_wuser, "
163248258c6bSjp "map_type, map_dn, map_attr, map_value, "
163348258c6bSjp "map_windomain, map_winname, map_unixname, map_is_nt4 "
1634e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND "
1635e8c27ec8Sbaban "winname = %Q AND windomain = %Q AND w2u = 1 AND "
1636e8c27ec8Sbaban "(pid >= 2147483648 OR "
1637e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR "
1638e8c27ec8Sbaban "expiration > %d));",
163948258c6bSjp is_user_string, lower_name, req->id1domain,
164048258c6bSjp curtime);
1641042addd6Sbaban if (lower_name != req->id1name)
1642042addd6Sbaban free(lower_name);
1643e8c27ec8Sbaban } else {
1644e8c27ec8Sbaban retcode = IDMAP_ERR_ARG;
1645e8c27ec8Sbaban goto out;
1646e8c27ec8Sbaban }
1647c5c4113dSnw if (sql == NULL) {
1648c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
1649c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
1650c5c4113dSnw goto out;
1651c5c4113dSnw }
165248258c6bSjp retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol,
165348258c6bSjp 14, &values);
1654c5c4113dSnw sqlite_freemem(sql);
1655c5c4113dSnw
1656c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND) {
1657c5c4113dSnw goto out;
1658c5c4113dSnw } else if (retcode == IDMAP_SUCCESS) {
1659c5c4113dSnw /* sanity checks */
1660c5c4113dSnw if (values[0] == NULL || values[1] == NULL) {
1661c5c4113dSnw retcode = IDMAP_ERR_CACHE;
1662c5c4113dSnw goto out;
1663c5c4113dSnw }
1664c5c4113dSnw
1665c5c4113dSnw pid = strtoul(values[0], &end, 10);
1666e8c27ec8Sbaban is_user = strncmp(values[1], "0", 2) ? 1 : 0;
1667c5c4113dSnw
1668cd37da74Snw if (is_user) {
1669cd37da74Snw res->id.idtype = IDMAP_UID;
1670cd37da74Snw res->id.idmap_id_u.uid = pid;
1671cd37da74Snw } else {
1672cd37da74Snw res->id.idtype = IDMAP_GID;
1673cd37da74Snw res->id.idmap_id_u.gid = pid;
1674cd37da74Snw }
1675cd37da74Snw
1676c5c4113dSnw /*
1677c5c4113dSnw * We may have an expired ephemeral mapping. Consider
1678c5c4113dSnw * the expired entry as valid if we are not going to
1679c5c4113dSnw * perform name-based mapping. But do not renew the
1680c5c4113dSnw * expiration.
1681c5c4113dSnw * If we will be doing name-based mapping then store the
1682c5c4113dSnw * ephemeral pid in the result so that we can use it
1683c5c4113dSnw * if we end up doing dynamic mapping again.
1684c5c4113dSnw */
1685c5c4113dSnw if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) &&
1686cd37da74Snw !AVOID_NAMESERVICE(req) &&
16879fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States IDMAP_ID_IS_EPHEMERAL(pid) && values[2] != NULL) {
1688cd37da74Snw exp = strtoll(values[2], &end, 10);
1689cd37da74Snw if (exp && exp <= curtime) {
1690cd37da74Snw /* Store the ephemeral pid */
1691cd37da74Snw res->direction = IDMAP_DIRECTION_BI;
1692cd37da74Snw req->direction |= is_user
1693cd37da74Snw ? _IDMAP_F_EXP_EPH_UID
1694cd37da74Snw : _IDMAP_F_EXP_EPH_GID;
1695cd37da74Snw retcode = IDMAP_ERR_NOTFOUND;
1696c5c4113dSnw }
1697c5c4113dSnw }
1698c5c4113dSnw }
1699c5c4113dSnw
1700c5c4113dSnw out:
1701c5c4113dSnw if (retcode == IDMAP_SUCCESS) {
170262c60062Sbaban if (values[4] != NULL)
1703c5c4113dSnw res->direction =
1704651c0131Sbaban (strtol(values[4], &end, 10) == 0)?
1705651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
1706c5c4113dSnw else
1707651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U;
1708c5c4113dSnw
170962c60062Sbaban if (values[3] != NULL) {
1710e8c27ec8Sbaban if (req->id2name != NULL)
1711e8c27ec8Sbaban free(req->id2name);
17128e228215Sdm req->id2name = strdup(values[3]);
17138e228215Sdm if (req->id2name == NULL) {
1714c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
1715c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
1716c5c4113dSnw }
1717c5c4113dSnw }
1718e8c27ec8Sbaban
1719e8c27ec8Sbaban req->id1.idtype = strncmp(values[5], "0", 2) ?
1720e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID;
172148258c6bSjp
172248258c6bSjp if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
172348258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE;
172448258c6bSjp res->info.how.map_type = strtoul(values[6], &end, 10);
172548258c6bSjp switch (res->info.how.map_type) {
172648258c6bSjp case IDMAP_MAP_TYPE_DS_AD:
172748258c6bSjp res->info.how.idmap_how_u.ad.dn =
172848258c6bSjp strdup(values[7]);
172948258c6bSjp res->info.how.idmap_how_u.ad.attr =
173048258c6bSjp strdup(values[8]);
173148258c6bSjp res->info.how.idmap_how_u.ad.value =
173248258c6bSjp strdup(values[9]);
173348258c6bSjp break;
173448258c6bSjp
173548258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP:
173648258c6bSjp res->info.how.idmap_how_u.nldap.dn =
173748258c6bSjp strdup(values[7]);
173848258c6bSjp res->info.how.idmap_how_u.nldap.attr =
173948258c6bSjp strdup(values[8]);
174048258c6bSjp res->info.how.idmap_how_u.nldap.value =
174148258c6bSjp strdup(values[9]);
174248258c6bSjp break;
174348258c6bSjp
174448258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED:
174548258c6bSjp res->info.how.idmap_how_u.rule.windomain =
174648258c6bSjp strdup(values[10]);
174748258c6bSjp res->info.how.idmap_how_u.rule.winname =
174848258c6bSjp strdup(values[11]);
174948258c6bSjp res->info.how.idmap_how_u.rule.unixname =
175048258c6bSjp strdup(values[12]);
175148258c6bSjp res->info.how.idmap_how_u.rule.is_nt4 =
175248258c6bSjp strtoul(values[13], &end, 1);
175348258c6bSjp res->info.how.idmap_how_u.rule.is_user =
175448258c6bSjp is_user;
175548258c6bSjp res->info.how.idmap_how_u.rule.is_wuser =
175648258c6bSjp strtoul(values[5], &end, 1);
175748258c6bSjp break;
175848258c6bSjp
175948258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL:
176048258c6bSjp break;
176148258c6bSjp
176248258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID:
176348258c6bSjp break;
176448258c6bSjp
176548258c6bSjp case IDMAP_MAP_TYPE_KNOWN_SID:
176648258c6bSjp break;
176748258c6bSjp
1768e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU:
1769e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.dn =
1770e3f2c991SKeyur Desai strdup(values[7]);
1771e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.attr =
1772e3f2c991SKeyur Desai strdup(values[8]);
1773e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.value =
1774e3f2c991SKeyur Desai strdup(values[9]);
1775e3f2c991SKeyur Desai break;
1776e3f2c991SKeyur Desai
177748258c6bSjp default:
1778e3f2c991SKeyur Desai /* Unknown mapping type */
177948258c6bSjp assert(FALSE);
178048258c6bSjp }
178148258c6bSjp }
1782c5c4113dSnw }
178362c60062Sbaban if (vm != NULL)
1784c5c4113dSnw (void) sqlite_finalize(vm, NULL);
1785c5c4113dSnw return (retcode);
1786c5c4113dSnw }
1787c5c4113dSnw
1788148c5f43SAlan Wright /*
1789148c5f43SAlan Wright * Previous versions used two enumerations for representing types.
1790148c5f43SAlan Wright * One of those has largely been eliminated, but was used in the
1791148c5f43SAlan Wright * name cache table and so during an upgrade might still be visible.
1792148c5f43SAlan Wright * In addition, the test suite prepopulates the cache with these values.
1793148c5f43SAlan Wright *
1794148c5f43SAlan Wright * This function translates those old values into the new values.
1795148c5f43SAlan Wright *
1796148c5f43SAlan Wright * This code deliberately does not use symbolic values for the legacy
1797148c5f43SAlan Wright * values. This is the *only* place where they should be used.
1798148c5f43SAlan Wright */
1799148c5f43SAlan Wright static
1800148c5f43SAlan Wright idmap_id_type
xlate_legacy_type(int type)1801148c5f43SAlan Wright xlate_legacy_type(int type)
1802148c5f43SAlan Wright {
1803148c5f43SAlan Wright switch (type) {
1804148c5f43SAlan Wright case -1004: /* _IDMAP_T_USER */
1805148c5f43SAlan Wright return (IDMAP_USID);
1806148c5f43SAlan Wright case -1005: /* _IDMAP_T_GROUP */
1807148c5f43SAlan Wright return (IDMAP_GSID);
1808148c5f43SAlan Wright default:
1809148c5f43SAlan Wright return (type);
1810148c5f43SAlan Wright }
1811148c5f43SAlan Wright NOTE(NOTREACHED)
1812148c5f43SAlan Wright }
1813148c5f43SAlan Wright
1814cd37da74Snw static
1815cd37da74Snw idmap_retcode
lookup_cache_sid2name(sqlite * cache,const char * sidprefix,idmap_rid_t rid,char ** canonname,char ** canondomain,idmap_id_type * type)181662c60062Sbaban lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid,
18179bf5f78fSMatt Barden char **canonname, char **canondomain, idmap_id_type *type)
1818cd37da74Snw {
1819c5c4113dSnw char *end;
1820c5c4113dSnw char *sql = NULL;
1821c5c4113dSnw const char **values;
1822c5c4113dSnw sqlite_vm *vm = NULL;
1823c5c4113dSnw int ncol;
1824c5c4113dSnw time_t curtime;
1825c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS;
1826c5c4113dSnw
1827c5c4113dSnw /* Get current time */
1828c5c4113dSnw errno = 0;
1829c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) {
1830cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1831cd37da74Snw strerror(errno));
1832c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
1833c5c4113dSnw goto out;
1834c5c4113dSnw }
1835c5c4113dSnw
1836c5c4113dSnw /* SQL to lookup the cache */
1837cd37da74Snw sql = sqlite_mprintf("SELECT canon_name, domain, type "
1838cd37da74Snw "FROM name_cache WHERE "
1839cd37da74Snw "sidprefix = %Q AND rid = %u AND "
1840cd37da74Snw "(expiration = 0 OR expiration ISNULL OR "
1841cd37da74Snw "expiration > %d);",
1842cd37da74Snw sidprefix, rid, curtime);
1843c5c4113dSnw if (sql == NULL) {
1844c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
1845c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
1846c5c4113dSnw goto out;
1847c5c4113dSnw }
1848c5c4113dSnw retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values);
1849c5c4113dSnw sqlite_freemem(sql);
1850c5c4113dSnw
1851c5c4113dSnw if (retcode == IDMAP_SUCCESS) {
185262c60062Sbaban if (type != NULL) {
1853c5c4113dSnw if (values[2] == NULL) {
1854c5c4113dSnw retcode = IDMAP_ERR_CACHE;
1855c5c4113dSnw goto out;
1856c5c4113dSnw }
1857148c5f43SAlan Wright *type = xlate_legacy_type(strtol(values[2], &end, 10));
1858c5c4113dSnw }
1859c5c4113dSnw
186008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL && values[0] != NULL) {
186108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if ((*canonname = strdup(values[0])) == NULL) {
1862c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
1863c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
1864c5c4113dSnw goto out;
1865c5c4113dSnw }
1866c5c4113dSnw }
1867c5c4113dSnw
186808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL && values[1] != NULL) {
186908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if ((*canondomain = strdup(values[1])) == NULL) {
187008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
187108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname);
187208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
1873c5c4113dSnw }
1874c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
1875c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
1876c5c4113dSnw goto out;
1877c5c4113dSnw }
1878c5c4113dSnw }
1879c5c4113dSnw }
1880c5c4113dSnw
1881c5c4113dSnw out:
188262c60062Sbaban if (vm != NULL)
1883c5c4113dSnw (void) sqlite_finalize(vm, NULL);
1884c5c4113dSnw return (retcode);
1885c5c4113dSnw }
1886c5c4113dSnw
1887c5c4113dSnw /*
1888e8c27ec8Sbaban * Given SID, find winname using name_cache OR
1889e8c27ec8Sbaban * Given winname, find SID using name_cache.
1890e8c27ec8Sbaban * Used when mapping win to unix i.e. req->id1 is windows id and
1891e8c27ec8Sbaban * req->id2 is unix id
1892c5c4113dSnw */
1893cd37da74Snw static
1894cd37da74Snw idmap_retcode
lookup_name_cache(sqlite * cache,idmap_mapping * req,idmap_id_res * res)1895e8c27ec8Sbaban lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1896cd37da74Snw {
1897148c5f43SAlan Wright idmap_id_type type = -1;
1898c5c4113dSnw idmap_retcode retcode;
1899e8c27ec8Sbaban char *sidprefix = NULL;
1900c5c4113dSnw idmap_rid_t rid;
1901c5c4113dSnw char *name = NULL, *domain = NULL;
1902c5c4113dSnw
1903e8c27ec8Sbaban /* Done if we've both sid and winname */
1904148c5f43SAlan Wright if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL) {
1905148c5f43SAlan Wright /* Don't bother TRACE()ing, too boring */
1906e8c27ec8Sbaban return (IDMAP_SUCCESS);
1907148c5f43SAlan Wright }
1908c5c4113dSnw
1909e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) {
191008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup sid to winname */
1911e8c27ec8Sbaban retcode = lookup_cache_sid2name(cache,
1912e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix,
1913e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, &name, &domain, &type);
191408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States } else {
191508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup winame to sid */
191608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = lookup_cache_name2sid(cache, req->id1name,
191708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1domain, &name, &sidprefix, &rid, &type);
1918e8c27ec8Sbaban }
191962c60062Sbaban
1920e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
1921148c5f43SAlan Wright if (retcode == IDMAP_ERR_NOTFOUND) {
1922148c5f43SAlan Wright TRACE(req, res, "Not found in name cache");
1923148c5f43SAlan Wright } else {
1924148c5f43SAlan Wright TRACE(req, res, "Name cache lookup error=%d", retcode);
1925148c5f43SAlan Wright }
1926e8c27ec8Sbaban free(name);
1927e8c27ec8Sbaban free(domain);
1928e8c27ec8Sbaban free(sidprefix);
1929e8c27ec8Sbaban return (retcode);
1930e8c27ec8Sbaban }
1931e8c27ec8Sbaban
1932148c5f43SAlan Wright req->id1.idtype = type;
1933e8c27ec8Sbaban
1934e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
193508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
193608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
193708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we found canonical names or domain, use them instead of
193808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * the existing values.
193908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
1940e8c27ec8Sbaban if (name != NULL) {
194108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(req->id1name);
194208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States req->id1name = name;
1943e8c27ec8Sbaban }
194408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (domain != NULL) {
194508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(req->id1domain);
1946e8c27ec8Sbaban req->id1domain = domain;
194708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
194808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
1949e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL) {
1950e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = sidprefix;
1951e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid = rid;
1952c5c4113dSnw }
1953148c5f43SAlan Wright
1954148c5f43SAlan Wright TRACE(req, res, "Found in name cache");
1955c5c4113dSnw return (retcode);
1956c5c4113dSnw }
1957c5c4113dSnw
19584d61c878SJulian Pullen
19594d61c878SJulian Pullen
19604d61c878SJulian Pullen static int
ad_lookup_batch_int(lookup_state_t * state,idmap_mapping_batch * batch,idmap_ids_res * result,adutils_ad_t * dir,int how_local,int * num_processed)19614d61c878SJulian Pullen ad_lookup_batch_int(lookup_state_t *state, idmap_mapping_batch *batch,
19629bf5f78fSMatt Barden idmap_ids_res *result, adutils_ad_t *dir, int how_local,
19639bf5f78fSMatt Barden int *num_processed)
1964cd37da74Snw {
1965c5c4113dSnw idmap_retcode retcode;
1966e3f2c991SKeyur Desai int i, num_queued, is_wuser, is_user;
19674d61c878SJulian Pullen int next_request;
1968148c5f43SAlan Wright int retries = 0, esidtype;
1969e8c27ec8Sbaban char **unixname;
1970c5c4113dSnw idmap_mapping *req;
1971c5c4113dSnw idmap_id_res *res;
1972e8c27ec8Sbaban idmap_query_state_t *qs = NULL;
197348258c6bSjp idmap_how *how;
1974479ac375Sdm char **dn, **attr, **value;
1975e8c27ec8Sbaban
19764d61c878SJulian Pullen *num_processed = 0;
19774d61c878SJulian Pullen
1978e8c27ec8Sbaban /*
1979e8c27ec8Sbaban * Since req->id2.idtype is unused, we will use it here
1980e8c27ec8Sbaban * to retrieve the value of sid_type. But it needs to be
1981e8c27ec8Sbaban * reset to IDMAP_NONE before we return to prevent xdr
1982e8c27ec8Sbaban * from mis-interpreting req->id2 when it tries to free
1983e8c27ec8Sbaban * the input argument. Other option is to allocate an
1984e8c27ec8Sbaban * array of integers and use it instead for the batched
1985e8c27ec8Sbaban * call. But why un-necessarily allocate memory. That may
1986e8c27ec8Sbaban * be an option if req->id2.idtype cannot be re-used in
1987e8c27ec8Sbaban * future.
1988e3f2c991SKeyur Desai *
19899fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Similarly, we use req->id2.idmap_id_u.uid to return
19909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * uidNumber or gidNumber supplied by IDMU, and reset it
19919fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * back to IDMAP_SENTINEL_PID when we're done. Note that
19929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * the query always puts the result in req->id2.idmap_id_u.uid,
19939fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * not .gid.
1994e8c27ec8Sbaban */
1995c5c4113dSnw retry:
1996e3f2c991SKeyur Desai retcode = idmap_lookup_batch_start(dir, state->ad_nqueries,
1997e3f2c991SKeyur Desai state->directory_based_mapping,
1998e3f2c991SKeyur Desai state->defdom,
1999e3f2c991SKeyur Desai &qs);
2000e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
20012b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
20022b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES)
20030dcc7149Snw goto retry;
2004349d5d8fSnw degrade_svc(1, "failed to create batch for AD lookup");
20054d61c878SJulian Pullen goto out;
2006c5c4113dSnw }
20074d61c878SJulian Pullen num_queued = 0;
2008c5c4113dSnw
2009c8e26105Sjp restore_svc();
2010c8e26105Sjp
2011e3f2c991SKeyur Desai if (how_local & FOREST_IS_LOCAL) {
20124d61c878SJulian Pullen /*
20134d61c878SJulian Pullen * Directory based name mapping is only performed within the
2014e3f2c991SKeyur Desai * joined forest. We don't trust other "trusted"
20154d61c878SJulian Pullen * forests to provide DS-based name mapping information because
20164d61c878SJulian Pullen * AD's definition of "cross-forest trust" does not encompass
20174d61c878SJulian Pullen * this sort of behavior.
20184d61c878SJulian Pullen */
20194d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs,
20204d61c878SJulian Pullen state->ad_unixuser_attr, state->ad_unixgroup_attr);
20214d61c878SJulian Pullen }
2022e8c27ec8Sbaban
20234d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
2024c5c4113dSnw req = &batch->idmap_mapping_batch_val[i];
2025c5c4113dSnw res = &result->ids.ids_val[i];
202648258c6bSjp how = &res->info.how;
202748258c6bSjp
2028e8c27ec8Sbaban retcode = IDMAP_SUCCESS;
2029e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE;
20309fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States req->id2.idmap_id_u.uid = IDMAP_SENTINEL_PID;
2031c5c4113dSnw
2032e3f2c991SKeyur Desai /* Skip if no AD lookup required */
2033e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD))
2034e3f2c991SKeyur Desai continue;
2035e3f2c991SKeyur Desai
2036e3f2c991SKeyur Desai /* Skip if we've already tried and gotten a "not found" */
2037e3f2c991SKeyur Desai if (req->direction & _IDMAP_F_LOOKUP_OTHER_AD)
2038e8c27ec8Sbaban continue;
2039e8c27ec8Sbaban
2040e3f2c991SKeyur Desai /* Skip if we've already either succeeded or failed */
204196c3a9a0Sbaban if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR)
2042e8c27ec8Sbaban continue;
2043e8c27ec8Sbaban
2044148c5f43SAlan Wright if (IS_ID_SID(req->id1)) {
2045e8c27ec8Sbaban
2046479ac375Sdm /* win2unix request: */
2047e8c27ec8Sbaban
2048e3f2c991SKeyur Desai posix_id_t *pid = NULL;
2049479ac375Sdm unixname = dn = attr = value = NULL;
2050148c5f43SAlan Wright esidtype = IDMAP_SID;
2051e3f2c991SKeyur Desai if (state->directory_based_mapping ==
2052e3f2c991SKeyur Desai DIRECTORY_MAPPING_NAME &&
2053e3f2c991SKeyur Desai req->id2name == NULL) {
2054e8c27ec8Sbaban if (res->id.idtype == IDMAP_UID &&
2055e8c27ec8Sbaban AD_OR_MIXED(state->nm_siduid)) {
2056148c5f43SAlan Wright esidtype = IDMAP_USID;
2057e8c27ec8Sbaban unixname = &req->id2name;
2058e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GID &&
2059e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) {
2060148c5f43SAlan Wright esidtype = IDMAP_GSID;
2061e8c27ec8Sbaban unixname = &req->id2name;
2062e8c27ec8Sbaban } else if (AD_OR_MIXED(state->nm_siduid) ||
2063e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) {
2064e8c27ec8Sbaban unixname = &req->id2name;
2065e8c27ec8Sbaban }
20664d61c878SJulian Pullen
2067e3f2c991SKeyur Desai if (unixname != NULL) {
2068e3f2c991SKeyur Desai /*
2069e3f2c991SKeyur Desai * Get how info for DS-based name
2070e3f2c991SKeyur Desai * mapping only if AD or MIXED
2071e3f2c991SKeyur Desai * mode is enabled.
2072e3f2c991SKeyur Desai */
2073148c5f43SAlan Wright idmap_how_clear(&res->info.how);
2074e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW;
2075e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_DS_AD;
2076e3f2c991SKeyur Desai dn = &how->idmap_how_u.ad.dn;
2077e3f2c991SKeyur Desai attr = &how->idmap_how_u.ad.attr;
2078e3f2c991SKeyur Desai value = &how->idmap_how_u.ad.value;
2079e3f2c991SKeyur Desai }
2080e3f2c991SKeyur Desai } else if (state->directory_based_mapping ==
2081e3f2c991SKeyur Desai DIRECTORY_MAPPING_IDMU &&
2082e3f2c991SKeyur Desai (how_local & DOMAIN_IS_LOCAL)) {
2083479ac375Sdm /*
2084e3f2c991SKeyur Desai * Ensure that we only do IDMU processing
2085e3f2c991SKeyur Desai * when querying the domain we've joined.
2086e3f2c991SKeyur Desai */
2087e3f2c991SKeyur Desai pid = &req->id2.idmap_id_u.uid;
2088e3f2c991SKeyur Desai /*
2089e3f2c991SKeyur Desai * Get how info for IDMU based mapping.
2090479ac375Sdm */
2091148c5f43SAlan Wright idmap_how_clear(&res->info.how);
2092479ac375Sdm res->info.src = IDMAP_MAP_SRC_NEW;
2093e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_IDMU;
2094e3f2c991SKeyur Desai dn = &how->idmap_how_u.idmu.dn;
2095e3f2c991SKeyur Desai attr = &how->idmap_how_u.idmu.attr;
2096e3f2c991SKeyur Desai value = &how->idmap_how_u.idmu.value;
2097479ac375Sdm }
2098e3f2c991SKeyur Desai
2099479ac375Sdm if (req->id1.idmap_id_u.sid.prefix != NULL) {
2100479ac375Sdm /* Lookup AD by SID */
2101479ac375Sdm retcode = idmap_sid2name_batch_add1(
2102479ac375Sdm qs, req->id1.idmap_id_u.sid.prefix,
2103148c5f43SAlan Wright &req->id1.idmap_id_u.sid.rid, esidtype,
2104479ac375Sdm dn, attr, value,
2105479ac375Sdm (req->id1name == NULL) ?
2106479ac375Sdm &req->id1name : NULL,
2107479ac375Sdm (req->id1domain == NULL) ?
2108479ac375Sdm &req->id1domain : NULL,
2109148c5f43SAlan Wright &req->id2.idtype, unixname,
2110e3f2c991SKeyur Desai pid,
2111479ac375Sdm &res->retcode);
21124d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
21134d61c878SJulian Pullen num_queued++;
2114479ac375Sdm } else {
2115479ac375Sdm /* Lookup AD by winname */
2116479ac375Sdm assert(req->id1name != NULL);
2117479ac375Sdm retcode = idmap_name2sid_batch_add1(
2118479ac375Sdm qs, req->id1name, req->id1domain,
2119148c5f43SAlan Wright esidtype,
2120479ac375Sdm dn, attr, value,
2121479ac375Sdm &req->id1name,
2122479ac375Sdm &req->id1.idmap_id_u.sid.prefix,
2123479ac375Sdm &req->id1.idmap_id_u.sid.rid,
2124148c5f43SAlan Wright &req->id2.idtype, unixname,
2125e3f2c991SKeyur Desai pid,
2126479ac375Sdm &res->retcode);
21274d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
21284d61c878SJulian Pullen num_queued++;
2129479ac375Sdm }
2130e8c27ec8Sbaban
2131148c5f43SAlan Wright } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) {
2132479ac375Sdm
2133479ac375Sdm /* unix2win request: */
2134e8c27ec8Sbaban
2135e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL &&
2136e8c27ec8Sbaban req->id2name != NULL) {
21374d61c878SJulian Pullen /* Already have SID and winname. done */
2138e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS;
2139e8c27ec8Sbaban continue;
2140e8c27ec8Sbaban }
2141c5c4113dSnw
2142e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL) {
2143e8c27ec8Sbaban /*
2144e8c27ec8Sbaban * SID but no winname -- lookup AD by
2145e8c27ec8Sbaban * SID to get winname.
2146479ac375Sdm * how info is not needed here because
2147479ac375Sdm * we are not retrieving unixname from
2148479ac375Sdm * AD.
2149e8c27ec8Sbaban */
21504d61c878SJulian Pullen
2151e8c27ec8Sbaban retcode = idmap_sid2name_batch_add1(
2152e8c27ec8Sbaban qs, res->id.idmap_id_u.sid.prefix,
2153e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid,
2154148c5f43SAlan Wright IDMAP_POSIXID,
2155479ac375Sdm NULL, NULL, NULL,
215648258c6bSjp &req->id2name,
2157148c5f43SAlan Wright &req->id2domain, &req->id2.idtype,
2158e3f2c991SKeyur Desai NULL, NULL, &res->retcode);
21594d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
21604d61c878SJulian Pullen num_queued++;
2161e8c27ec8Sbaban } else if (req->id2name != NULL) {
2162e8c27ec8Sbaban /*
2163e8c27ec8Sbaban * winname but no SID -- lookup AD by
2164e8c27ec8Sbaban * winname to get SID.
2165479ac375Sdm * how info is not needed here because
2166479ac375Sdm * we are not retrieving unixname from
2167479ac375Sdm * AD.
2168e8c27ec8Sbaban */
2169e8c27ec8Sbaban retcode = idmap_name2sid_batch_add1(
2170e8c27ec8Sbaban qs, req->id2name, req->id2domain,
2171148c5f43SAlan Wright IDMAP_POSIXID,
2172479ac375Sdm NULL, NULL, NULL, NULL,
2173e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix,
2174e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid,
2175148c5f43SAlan Wright &req->id2.idtype, NULL,
2176e3f2c991SKeyur Desai NULL,
2177e8c27ec8Sbaban &res->retcode);
21784d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
21794d61c878SJulian Pullen num_queued++;
2180e3f2c991SKeyur Desai } else if (state->directory_based_mapping ==
2181e3f2c991SKeyur Desai DIRECTORY_MAPPING_IDMU &&
2182e3f2c991SKeyur Desai (how_local & DOMAIN_IS_LOCAL)) {
21839fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.uid !=
21849fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States IDMAP_SENTINEL_PID);
2185148c5f43SAlan Wright is_user = IS_ID_UID(req->id1);
2186e3f2c991SKeyur Desai if (res->id.idtype == IDMAP_USID)
2187e3f2c991SKeyur Desai is_wuser = 1;
2188e3f2c991SKeyur Desai else if (res->id.idtype == IDMAP_GSID)
2189e3f2c991SKeyur Desai is_wuser = 0;
2190e3f2c991SKeyur Desai else
2191e3f2c991SKeyur Desai is_wuser = is_user;
2192e3f2c991SKeyur Desai
2193e3f2c991SKeyur Desai /* IDMU can't do diagonal mappings */
2194e3f2c991SKeyur Desai if (is_user != is_wuser)
2195e3f2c991SKeyur Desai continue;
2196e3f2c991SKeyur Desai
2197148c5f43SAlan Wright idmap_how_clear(&res->info.how);
2198e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW;
2199e3f2c991SKeyur Desai how->map_type = IDMAP_MAP_TYPE_IDMU;
2200e3f2c991SKeyur Desai retcode = idmap_pid2sid_batch_add1(
2201e3f2c991SKeyur Desai qs, req->id1.idmap_id_u.uid, is_user,
2202e3f2c991SKeyur Desai &how->idmap_how_u.ad.dn,
2203e3f2c991SKeyur Desai &how->idmap_how_u.ad.attr,
2204e3f2c991SKeyur Desai &how->idmap_how_u.ad.value,
2205e3f2c991SKeyur Desai &res->id.idmap_id_u.sid.prefix,
2206e3f2c991SKeyur Desai &res->id.idmap_id_u.sid.rid,
2207e3f2c991SKeyur Desai &req->id2name, &req->id2domain,
2208148c5f43SAlan Wright &req->id2.idtype, &res->retcode);
2209e3f2c991SKeyur Desai if (retcode == IDMAP_SUCCESS)
2210e3f2c991SKeyur Desai num_queued++;
2211e8c27ec8Sbaban } else if (req->id1name != NULL) {
2212e8c27ec8Sbaban /*
22134d61c878SJulian Pullen * No SID and no winname but we've unixname.
22144d61c878SJulian Pullen * Lookup AD by unixname to get SID.
2215e8c27ec8Sbaban */
2216148c5f43SAlan Wright is_user = (IS_ID_UID(req->id1)) ? 1 : 0;
2217e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID)
2218e8c27ec8Sbaban is_wuser = 1;
2219e8c27ec8Sbaban else if (res->id.idtype == IDMAP_GSID)
2220e8c27ec8Sbaban is_wuser = 0;
2221e8c27ec8Sbaban else
2222e8c27ec8Sbaban is_wuser = is_user;
22234d61c878SJulian Pullen
2224148c5f43SAlan Wright idmap_how_clear(&res->info.how);
222548258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW;
222648258c6bSjp how->map_type = IDMAP_MAP_TYPE_DS_AD;
2227e8c27ec8Sbaban retcode = idmap_unixname2sid_batch_add1(
2228e8c27ec8Sbaban qs, req->id1name, is_user, is_wuser,
222948258c6bSjp &how->idmap_how_u.ad.dn,
223048258c6bSjp &how->idmap_how_u.ad.attr,
223148258c6bSjp &how->idmap_how_u.ad.value,
2232e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix,
2233e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid,
2234e8c27ec8Sbaban &req->id2name, &req->id2domain,
2235148c5f43SAlan Wright &req->id2.idtype, &res->retcode);
22364d61c878SJulian Pullen if (retcode == IDMAP_SUCCESS)
22374d61c878SJulian Pullen num_queued++;
2238e8c27ec8Sbaban }
2239e8c27ec8Sbaban }
22404d61c878SJulian Pullen
22414d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) {
22424d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD;
22434d61c878SJulian Pullen retcode = IDMAP_SUCCESS;
22444d61c878SJulian Pullen } else if (retcode != IDMAP_SUCCESS) {
2245e8c27ec8Sbaban break;
2246c5c4113dSnw }
22474d61c878SJulian Pullen } /* End of for loop */
2248c5c4113dSnw
224996c3a9a0Sbaban if (retcode == IDMAP_SUCCESS) {
225096c3a9a0Sbaban /* add keeps track if we added an entry to the batch */
22514d61c878SJulian Pullen if (num_queued > 0)
225296c3a9a0Sbaban retcode = idmap_lookup_batch_end(&qs);
225396c3a9a0Sbaban else
225496c3a9a0Sbaban idmap_lookup_release_batch(&qs);
2255e3f2c991SKeyur Desai } else {
2256e3f2c991SKeyur Desai idmap_lookup_release_batch(&qs);
2257e3f2c991SKeyur Desai num_queued = 0;
2258e3f2c991SKeyur Desai next_request = i + 1;
225996c3a9a0Sbaban }
2260c5c4113dSnw
22612b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
22622b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES)
2263e8c27ec8Sbaban goto retry;
2264e8c27ec8Sbaban else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
2265349d5d8fSnw degrade_svc(1, "some AD lookups timed out repeatedly");
2266e8c27ec8Sbaban
22674d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) {
22684d61c878SJulian Pullen /* Mark any unproccessed requests for an other AD */
22694d61c878SJulian Pullen for (i = next_request; i < batch->idmap_mapping_batch_len;
22704d61c878SJulian Pullen i++) {
22714d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i];
22724d61c878SJulian Pullen req->direction |= _IDMAP_F_LOOKUP_OTHER_AD;
22734d61c878SJulian Pullen
22744d61c878SJulian Pullen }
22754d61c878SJulian Pullen }
22764d61c878SJulian Pullen
2277e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS)
2278e8c27ec8Sbaban idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests");
2279e8c27ec8Sbaban
2280e8c27ec8Sbaban out:
2281e8c27ec8Sbaban /*
2282e8c27ec8Sbaban * This loop does the following:
2283479ac375Sdm * 1. Reset _IDMAP_F_LOOKUP_AD flag from the request.
2284479ac375Sdm * 2. Reset req->id2.idtype to IDMAP_NONE
2285479ac375Sdm * 3. If batch_start or batch_add failed then set the status
2286479ac375Sdm * of each request marked for AD lookup to that error.
22874d61c878SJulian Pullen * 4. Evaluate the type of the AD object (i.e. user or group)
22884d61c878SJulian Pullen * and update the idtype in request.
2289e8c27ec8Sbaban */
2290cd37da74Snw for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
2291148c5f43SAlan Wright idmap_id_type type;
2292e3f2c991SKeyur Desai uid_t posix_id;
2293e3f2c991SKeyur Desai
2294cd37da74Snw req = &batch->idmap_mapping_batch_val[i];
2295e8c27ec8Sbaban type = req->id2.idtype;
2296e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE;
2297e3f2c991SKeyur Desai posix_id = req->id2.idmap_id_u.uid;
22989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States req->id2.idmap_id_u.uid = IDMAP_SENTINEL_PID;
22995e0794bcSbaban res = &result->ids.ids_val[i];
2300e3f2c991SKeyur Desai
2301e3f2c991SKeyur Desai /*
2302e3f2c991SKeyur Desai * If it didn't need AD lookup, ignore it.
2303e3f2c991SKeyur Desai */
2304e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD))
2305cd37da74Snw continue;
2306cd37da74Snw
2307e3f2c991SKeyur Desai /*
2308e3f2c991SKeyur Desai * If we deferred it this time, reset for the next
2309e3f2c991SKeyur Desai * AD server.
2310e3f2c991SKeyur Desai */
2311e3f2c991SKeyur Desai if (req->direction & _IDMAP_F_LOOKUP_OTHER_AD) {
2312e3f2c991SKeyur Desai req->direction &= ~_IDMAP_F_LOOKUP_OTHER_AD;
2313e3f2c991SKeyur Desai continue;
2314e3f2c991SKeyur Desai }
2315e3f2c991SKeyur Desai
23164d61c878SJulian Pullen /* Count number processed */
23174d61c878SJulian Pullen (*num_processed)++;
23184d61c878SJulian Pullen
2319479ac375Sdm /* Reset AD lookup flag */
2320479ac375Sdm req->direction &= ~(_IDMAP_F_LOOKUP_AD);
2321479ac375Sdm
2322479ac375Sdm /*
23234d61c878SJulian Pullen * If batch_start or batch_add failed then set the
23244d61c878SJulian Pullen * status of each request marked for AD lookup to
23254d61c878SJulian Pullen * that error.
2326479ac375Sdm */
2327e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
2328e8c27ec8Sbaban res->retcode = retcode;
2329cd37da74Snw continue;
2330cd37da74Snw }
2331cd37da74Snw
233248258c6bSjp if (res->retcode == IDMAP_ERR_NOTFOUND) {
233348258c6bSjp /* Nothing found - remove the preset info */
2334148c5f43SAlan Wright idmap_how_clear(&res->info.how);
233548258c6bSjp }
233648258c6bSjp
2337148c5f43SAlan Wright if (IS_ID_SID(req->id1)) {
2338cb174861Sjoyce mcintosh if (res->retcode == IDMAP_ERR_NOTFOUND) {
2339cb174861Sjoyce mcintosh TRACE(req, res, "Not found in AD");
2340cb174861Sjoyce mcintosh continue;
2341cb174861Sjoyce mcintosh }
2342cb174861Sjoyce mcintosh if (res->retcode != IDMAP_SUCCESS) {
2343cb174861Sjoyce mcintosh TRACE(req, res, "AD lookup error=%d",
2344cb174861Sjoyce mcintosh res->retcode);
2345e8c27ec8Sbaban continue;
2346cb174861Sjoyce mcintosh }
2347479ac375Sdm /* Evaluate result type */
2348e8c27ec8Sbaban switch (type) {
2349148c5f43SAlan Wright case IDMAP_USID:
2350e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID)
2351e8c27ec8Sbaban res->id.idtype = IDMAP_UID;
2352e3f2c991SKeyur Desai /*
2353e3f2c991SKeyur Desai * We found a user. If we got information
2354e3f2c991SKeyur Desai * from IDMU and we were expecting a user,
2355e3f2c991SKeyur Desai * copy the id.
2356e3f2c991SKeyur Desai */
23579fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (posix_id != IDMAP_SENTINEL_PID &&
2358e3f2c991SKeyur Desai res->id.idtype == IDMAP_UID) {
2359e3f2c991SKeyur Desai res->id.idmap_id_u.uid = posix_id;
2360e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI;
2361e3f2c991SKeyur Desai res->info.how.map_type =
2362e3f2c991SKeyur Desai IDMAP_MAP_TYPE_IDMU;
2363e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW;
2364e3f2c991SKeyur Desai }
2365e8c27ec8Sbaban req->id1.idtype = IDMAP_USID;
2366e8c27ec8Sbaban break;
23674d61c878SJulian Pullen
2368148c5f43SAlan Wright case IDMAP_GSID:
2369e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID)
2370e8c27ec8Sbaban res->id.idtype = IDMAP_GID;
2371e3f2c991SKeyur Desai /*
2372e3f2c991SKeyur Desai * We found a group. If we got information
2373e3f2c991SKeyur Desai * from IDMU and we were expecting a group,
2374e3f2c991SKeyur Desai * copy the id.
2375e3f2c991SKeyur Desai */
23769fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (posix_id != IDMAP_SENTINEL_PID &&
2377e3f2c991SKeyur Desai res->id.idtype == IDMAP_GID) {
2378e3f2c991SKeyur Desai res->id.idmap_id_u.gid = posix_id;
2379e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI;
2380e3f2c991SKeyur Desai res->info.how.map_type =
2381e3f2c991SKeyur Desai IDMAP_MAP_TYPE_IDMU;
2382e3f2c991SKeyur Desai res->info.src = IDMAP_MAP_SRC_NEW;
2383e3f2c991SKeyur Desai }
2384e8c27ec8Sbaban req->id1.idtype = IDMAP_GSID;
2385e8c27ec8Sbaban break;
23864d61c878SJulian Pullen
2387e8c27ec8Sbaban default:
2388e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID;
2389e8c27ec8Sbaban break;
2390e8c27ec8Sbaban }
2391cb174861Sjoyce mcintosh TRACE(req, res, "Found in AD");
2392479ac375Sdm if (res->retcode == IDMAP_SUCCESS &&
2393479ac375Sdm req->id1name != NULL &&
2394479ac375Sdm (req->id2name == NULL ||
23959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID) &&
2396479ac375Sdm NLDAP_MODE(res->id.idtype, state)) {
2397479ac375Sdm req->direction |= _IDMAP_F_LOOKUP_NLDAP;
2398479ac375Sdm state->nldap_nqueries++;
2399479ac375Sdm }
2400148c5f43SAlan Wright } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) {
2401e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) {
2402e8c27ec8Sbaban if ((!(IDMAP_FATAL_ERROR(res->retcode))) &&
2403e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix == NULL &&
2404cb174861Sjoyce mcintosh req->id2name == NULL) {
2405e8c27ec8Sbaban /*
2406e3f2c991SKeyur Desai * If AD lookup by unixname or pid
24074d61c878SJulian Pullen * failed with non fatal error
24084d61c878SJulian Pullen * then clear the error (ie set
24094d61c878SJulian Pullen * res->retcode to success).
24104d61c878SJulian Pullen * This allows the next pass to
24114d61c878SJulian Pullen * process other mapping
2412479ac375Sdm * mechanisms for this request.
2413e8c27ec8Sbaban */
2414cb174861Sjoyce mcintosh if (res->retcode ==
2415cb174861Sjoyce mcintosh IDMAP_ERR_NOTFOUND) {
2416cb174861Sjoyce mcintosh /* This is not an error */
2417cb174861Sjoyce mcintosh res->retcode = IDMAP_SUCCESS;
2418cb174861Sjoyce mcintosh TRACE(req, res,
2419cb174861Sjoyce mcintosh "Not found in AD");
2420cb174861Sjoyce mcintosh } else {
2421cb174861Sjoyce mcintosh TRACE(req, res,
2422cb174861Sjoyce mcintosh "AD lookup error (ignored)");
2423cb174861Sjoyce mcintosh res->retcode = IDMAP_SUCCESS;
2424cb174861Sjoyce mcintosh }
2425cb174861Sjoyce mcintosh } else {
2426cb174861Sjoyce mcintosh TRACE(req, res, "AD lookup error");
2427cb174861Sjoyce mcintosh }
2428e8c27ec8Sbaban continue;
2429e8c27ec8Sbaban }
2430479ac375Sdm /* Evaluate result type */
2431e8c27ec8Sbaban switch (type) {
2432148c5f43SAlan Wright case IDMAP_USID:
2433148c5f43SAlan Wright case IDMAP_GSID:
2434e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID)
2435148c5f43SAlan Wright res->id.idtype = type;
2436e8c27ec8Sbaban break;
24374d61c878SJulian Pullen
2438e8c27ec8Sbaban default:
2439e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID;
2440e8c27ec8Sbaban break;
2441e8c27ec8Sbaban }
2442cb174861Sjoyce mcintosh TRACE(req, res, "Found in AD");
2443e8c27ec8Sbaban }
2444e8c27ec8Sbaban }
2445c5c4113dSnw
24464d61c878SJulian Pullen return (retcode);
24474d61c878SJulian Pullen }
24484d61c878SJulian Pullen
24494d61c878SJulian Pullen
24504d61c878SJulian Pullen
24514d61c878SJulian Pullen /*
24524d61c878SJulian Pullen * Batch AD lookups
24534d61c878SJulian Pullen */
24544d61c878SJulian Pullen idmap_retcode
ad_lookup_batch(lookup_state_t * state,idmap_mapping_batch * batch,idmap_ids_res * result)24554d61c878SJulian Pullen ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch,
24569bf5f78fSMatt Barden idmap_ids_res *result)
24574d61c878SJulian Pullen {
24584d61c878SJulian Pullen idmap_retcode retcode;
24594d61c878SJulian Pullen int i, j;
24604d61c878SJulian Pullen idmap_mapping *req;
24614d61c878SJulian Pullen idmap_id_res *res;
24624d61c878SJulian Pullen int num_queries;
24634d61c878SJulian Pullen int num_processed;
24644d61c878SJulian Pullen
24654d61c878SJulian Pullen if (state->ad_nqueries == 0)
24664d61c878SJulian Pullen return (IDMAP_SUCCESS);
24674d61c878SJulian Pullen
24684d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
24694d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i];
24704d61c878SJulian Pullen res = &result->ids.ids_val[i];
24714d61c878SJulian Pullen
24724d61c878SJulian Pullen /* Skip if not marked for AD lookup or already in error. */
24734d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD) ||
24744d61c878SJulian Pullen res->retcode != IDMAP_SUCCESS)
24754d61c878SJulian Pullen continue;
24764d61c878SJulian Pullen
24774d61c878SJulian Pullen /* Init status */
24784d61c878SJulian Pullen res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR;
24794d61c878SJulian Pullen }
24804d61c878SJulian Pullen
24814d61c878SJulian Pullen RDLOCK_CONFIG();
24824d61c878SJulian Pullen num_queries = state->ad_nqueries;
24834d61c878SJulian Pullen
2484e3f2c991SKeyur Desai if (_idmapdstate.num_gcs == 0 && _idmapdstate.num_dcs == 0) {
24854d61c878SJulian Pullen /* Case of no ADs */
24864d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
24874d61c878SJulian Pullen for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
24884d61c878SJulian Pullen req = &batch->idmap_mapping_batch_val[i];
24894d61c878SJulian Pullen res = &result->ids.ids_val[i];
24904d61c878SJulian Pullen if (!(req->direction & _IDMAP_F_LOOKUP_AD))
24914d61c878SJulian Pullen continue;
24924d61c878SJulian Pullen req->direction &= ~(_IDMAP_F_LOOKUP_AD);
24934d61c878SJulian Pullen res->retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
24944d61c878SJulian Pullen }
2495e3f2c991SKeyur Desai goto out;
24964d61c878SJulian Pullen }
2497e3f2c991SKeyur Desai
2498e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) {
2499e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_dcs && num_queries > 0; i++) {
2500e3f2c991SKeyur Desai
2501e3f2c991SKeyur Desai retcode = ad_lookup_batch_int(state, batch,
2502e3f2c991SKeyur Desai result, _idmapdstate.dcs[i],
2503e3f2c991SKeyur Desai i == 0 ? DOMAIN_IS_LOCAL|FOREST_IS_LOCAL : 0,
2504e3f2c991SKeyur Desai &num_processed);
2505e3f2c991SKeyur Desai num_queries -= num_processed;
2506e3f2c991SKeyur Desai
2507e3f2c991SKeyur Desai }
2508e3f2c991SKeyur Desai }
2509e3f2c991SKeyur Desai
2510e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_gcs && num_queries > 0; i++) {
2511e3f2c991SKeyur Desai
2512e3f2c991SKeyur Desai retcode = ad_lookup_batch_int(state, batch, result,
2513e3f2c991SKeyur Desai _idmapdstate.gcs[i],
2514e3f2c991SKeyur Desai i == 0 ? FOREST_IS_LOCAL : 0,
2515e3f2c991SKeyur Desai &num_processed);
2516e3f2c991SKeyur Desai num_queries -= num_processed;
2517e3f2c991SKeyur Desai
2518e3f2c991SKeyur Desai }
2519e3f2c991SKeyur Desai
2520e3f2c991SKeyur Desai /*
2521e3f2c991SKeyur Desai * There are no more ADs to try. Return errors for any
2522e3f2c991SKeyur Desai * remaining requests.
2523e3f2c991SKeyur Desai */
2524e3f2c991SKeyur Desai if (num_queries > 0) {
2525e3f2c991SKeyur Desai for (j = 0; j < batch->idmap_mapping_batch_len; j++) {
2526e3f2c991SKeyur Desai req = &batch->idmap_mapping_batch_val[j];
2527e3f2c991SKeyur Desai res = &result->ids.ids_val[j];
2528e3f2c991SKeyur Desai if (!(req->direction & _IDMAP_F_LOOKUP_AD))
2529e3f2c991SKeyur Desai continue;
2530e3f2c991SKeyur Desai req->direction &= ~(_IDMAP_F_LOOKUP_AD);
2531e3f2c991SKeyur Desai res->retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
2532e3f2c991SKeyur Desai }
2533e3f2c991SKeyur Desai }
2534e3f2c991SKeyur Desai
2535e3f2c991SKeyur Desai out:
25364d61c878SJulian Pullen UNLOCK_CONFIG();
25374d61c878SJulian Pullen
2538e8c27ec8Sbaban /* AD lookups done. Reset state->ad_nqueries and return */
2539e8c27ec8Sbaban state->ad_nqueries = 0;
2540c5c4113dSnw return (retcode);
2541c5c4113dSnw }
2542c5c4113dSnw
2543cd37da74Snw /*
2544cd37da74Snw * Convention when processing win2unix requests:
2545cd37da74Snw *
2546cd37da74Snw * Windows identity:
2547cd37da74Snw * req->id1name =
2548cd37da74Snw * winname if given otherwise winname found will be placed
2549cd37da74Snw * here.
2550cd37da74Snw * req->id1domain =
2551cd37da74Snw * windomain if given otherwise windomain found will be
2552cd37da74Snw * placed here.
2553cd37da74Snw * req->id1.idtype =
2554cd37da74Snw * Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll
2555cd37da74Snw * be set to IDMAP_USID/GSID depending upon whether the
2556cd37da74Snw * given SID is user or group respectively. The user/group-ness
2557cd37da74Snw * is determined either when looking up well-known SIDs table OR
2558fe1c642dSBill Krier * if the SID is found in namecache OR by ad_lookup_batch().
2559cd37da74Snw * req->id1..sid.[prefix, rid] =
2560cd37da74Snw * SID if given otherwise SID found will be placed here.
2561cd37da74Snw *
2562cd37da74Snw * Unix identity:
2563cd37da74Snw * req->id2name =
2564cd37da74Snw * unixname found will be placed here.
2565cd37da74Snw * req->id2domain =
2566cd37da74Snw * NOT USED
2567cd37da74Snw * res->id.idtype =
2568cd37da74Snw * Target type initialized from req->id2.idtype. If
2569cd37da74Snw * it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found
2570cd37da74Snw * will be placed here.
2571cd37da74Snw * res->id..[uid or gid] =
2572cd37da74Snw * UID/GID found will be placed here.
2573cd37da74Snw *
2574cd37da74Snw * Others:
2575cd37da74Snw * res->retcode =
2576cd37da74Snw * Return status for this request will be placed here.
2577cd37da74Snw * res->direction =
2578cd37da74Snw * Direction found will be placed here. Direction
2579cd37da74Snw * meaning whether the resultant mapping is valid
2580cd37da74Snw * only from win2unix or bi-directional.
2581cd37da74Snw * req->direction =
2582cd37da74Snw * INTERNAL USE. Used by idmapd to set various
2583cd37da74Snw * flags (_IDMAP_F_xxxx) to aid in processing
2584cd37da74Snw * of the request.
2585cd37da74Snw * req->id2.idtype =
2586cd37da74Snw * INTERNAL USE. Initially this is the requested target
2587cd37da74Snw * type and is used to initialize res->id.idtype.
2588cd37da74Snw * ad_lookup_batch() uses this field temporarily to store
2589cd37da74Snw * sid_type obtained by the batched AD lookups and after
2590cd37da74Snw * use resets it to IDMAP_NONE to prevent xdr from
2591cd37da74Snw * mis-interpreting the contents of req->id2.
2592e3f2c991SKeyur Desai * req->id2.idmap_id_u.uid =
2593e3f2c991SKeyur Desai * INTERNAL USE. If the AD lookup finds IDMU data
2594e3f2c991SKeyur Desai * (uidNumber or gidNumber, depending on the type of
2595e3f2c991SKeyur Desai * the entry), it's left here.
2596cd37da74Snw */
2597cd37da74Snw
2598cd37da74Snw /*
2599cd37da74Snw * This function does the following:
2600cd37da74Snw * 1. Lookup well-known SIDs table.
2601cd37da74Snw * 2. Check if the given SID is a local-SID and if so extract UID/GID from it.
2602cd37da74Snw * 3. Lookup cache.
2603cd37da74Snw * 4. Check if the client does not want new mapping to be allocated
2604cd37da74Snw * in which case this pass is the final pass.
2605cd37da74Snw * 5. Set AD lookup flag if it determines that the next stage needs
2606cd37da74Snw * to do AD lookup.
2607cd37da74Snw */
2608c5c4113dSnw idmap_retcode
sid2pid_first_pass(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)2609479ac375Sdm sid2pid_first_pass(lookup_state_t *state, idmap_mapping *req,
26109bf5f78fSMatt Barden idmap_id_res *res)
2611cd37da74Snw {
2612c5c4113dSnw idmap_retcode retcode;
2613e8c27ec8Sbaban int wksid;
2614c5c4113dSnw
2615e8c27ec8Sbaban /* Initialize result */
2616e8c27ec8Sbaban res->id.idtype = req->id2.idtype;
26179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = IDMAP_SENTINEL_PID;
2618e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF;
2619e8c27ec8Sbaban wksid = 0;
2620c5c4113dSnw
2621cf5b5989Sdm if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) {
2622fe1c642dSBill Krier /* They have to give us *something* to work with! */
2623e8c27ec8Sbaban if (req->id1name == NULL) {
2624e8c27ec8Sbaban retcode = IDMAP_ERR_ARG;
2625e8c27ec8Sbaban goto out;
2626e8c27ec8Sbaban }
2627fe1c642dSBill Krier
2628e8c27ec8Sbaban /* sanitize sidprefix */
2629e8c27ec8Sbaban free(req->id1.idmap_id_u.sid.prefix);
2630e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = NULL;
2631fe1c642dSBill Krier
2632fe1c642dSBill Krier /* Allow for a fully-qualified name in the "name" parameter */
2633fe1c642dSBill Krier if (req->id1domain == NULL) {
2634fe1c642dSBill Krier char *p;
2635fe1c642dSBill Krier p = strchr(req->id1name, '@');
2636fe1c642dSBill Krier if (p != NULL) {
2637fe1c642dSBill Krier char *q;
2638fe1c642dSBill Krier q = req->id1name;
2639cb174861Sjoyce mcintosh req->id1name = uu_strndup(q, p - req->id1name);
2640fe1c642dSBill Krier req->id1domain = strdup(p+1);
2641fe1c642dSBill Krier free(q);
2642fe1c642dSBill Krier if (req->id1name == NULL ||
2643fe1c642dSBill Krier req->id1domain == NULL) {
2644fe1c642dSBill Krier retcode = IDMAP_ERR_MEMORY;
2645fe1c642dSBill Krier goto out;
2646fe1c642dSBill Krier }
2647fe1c642dSBill Krier }
2648fe1c642dSBill Krier }
2649c5c4113dSnw }
2650c5c4113dSnw
2651e8c27ec8Sbaban /* Lookup well-known SIDs table */
2652e8c27ec8Sbaban retcode = lookup_wksids_sid2pid(req, res, &wksid);
2653148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2654148c5f43SAlan Wright /* Found a well-known account with a hardwired mapping */
2655148c5f43SAlan Wright TRACE(req, res, "Hardwired mapping");
2656148c5f43SAlan Wright goto out;
2657148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
2658148c5f43SAlan Wright TRACE(req, res,
2659148c5f43SAlan Wright "Well-known account lookup failed, code %d", retcode);
2660c5c4113dSnw goto out;
2661148c5f43SAlan Wright }
2662148c5f43SAlan Wright
2663148c5f43SAlan Wright if (wksid) {
2664148c5f43SAlan Wright /* Found a well-known account, but no mapping */
2665148c5f43SAlan Wright TRACE(req, res, "Well-known account");
2666148c5f43SAlan Wright } else {
2667148c5f43SAlan Wright TRACE(req, res, "Not a well-known account");
2668c5c4113dSnw
26692b4a7802SBaban Kenkre /* Check if this is a localsid */
2670e8c27ec8Sbaban retcode = lookup_localsid2pid(req, res);
2671148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2672148c5f43SAlan Wright TRACE(req, res, "Local SID");
2673148c5f43SAlan Wright goto out;
2674148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
2675148c5f43SAlan Wright TRACE(req, res,
2676148c5f43SAlan Wright "Local SID lookup error=%d", retcode);
2677e8c27ec8Sbaban goto out;
2678148c5f43SAlan Wright }
2679148c5f43SAlan Wright TRACE(req, res, "Not a local SID");
26802b4a7802SBaban Kenkre
26812b4a7802SBaban Kenkre if (ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)) {
26824d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED;
26832b4a7802SBaban Kenkre goto out;
26842b4a7802SBaban Kenkre }
2685e8c27ec8Sbaban }
2686e8c27ec8Sbaban
2687fe1c642dSBill Krier /*
2688fe1c642dSBill Krier * If this is a name-based request and we don't have a domain,
2689fe1c642dSBill Krier * use the default domain. Note that the well-known identity
2690fe1c642dSBill Krier * cases will have supplied a SID prefix already, and that we
2691fe1c642dSBill Krier * don't (yet?) support looking up a local user through a Windows
2692fe1c642dSBill Krier * style name.
2693fe1c642dSBill Krier */
2694fe1c642dSBill Krier if (req->id1.idmap_id_u.sid.prefix == NULL &&
2695fe1c642dSBill Krier req->id1name != NULL && req->id1domain == NULL) {
2696fe1c642dSBill Krier if (state->defdom == NULL) {
2697fe1c642dSBill Krier retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
2698fe1c642dSBill Krier goto out;
2699fe1c642dSBill Krier }
2700fe1c642dSBill Krier req->id1domain = strdup(state->defdom);
2701fe1c642dSBill Krier if (req->id1domain == NULL) {
2702fe1c642dSBill Krier retcode = IDMAP_ERR_MEMORY;
2703fe1c642dSBill Krier goto out;
2704fe1c642dSBill Krier }
2705148c5f43SAlan Wright TRACE(req, res, "Added default domain");
2706fe1c642dSBill Krier }
2707fe1c642dSBill Krier
2708e8c27ec8Sbaban /* Lookup cache */
2709479ac375Sdm retcode = lookup_cache_sid2pid(state->cache, req, res);
2710148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2711148c5f43SAlan Wright TRACE(req, res, "Found in mapping cache");
2712c5c4113dSnw goto out;
2713148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
2714148c5f43SAlan Wright TRACE(req, res, "Mapping cache lookup error=%d", retcode);
2715148c5f43SAlan Wright goto out;
2716148c5f43SAlan Wright }
2717148c5f43SAlan Wright TRACE(req, res, "Not found in mapping cache");
2718c5c4113dSnw
2719c5c4113dSnw if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) {
27204d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED;
2721c5c4113dSnw goto out;
2722c5c4113dSnw }
2723c5c4113dSnw
2724c5c4113dSnw /*
2725e8c27ec8Sbaban * Failed to find non-expired entry in cache. Next step is
2726e8c27ec8Sbaban * to determine if this request needs to be batched for AD lookup.
2727e8c27ec8Sbaban *
2728e8c27ec8Sbaban * At this point we have either sid or winname or both. If we don't
2729e8c27ec8Sbaban * have both then lookup name_cache for the sid or winname
2730e8c27ec8Sbaban * whichever is missing. If not found then this request will be
2731e8c27ec8Sbaban * batched for AD lookup.
2732c5c4113dSnw */
2733479ac375Sdm retcode = lookup_name_cache(state->cache, req, res);
2734148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2735148c5f43SAlan Wright if (res->id.idtype == IDMAP_POSIXID) {
2736148c5f43SAlan Wright if (req->id1.idtype == IDMAP_USID)
2737148c5f43SAlan Wright res->id.idtype = IDMAP_UID;
2738148c5f43SAlan Wright else
2739148c5f43SAlan Wright res->id.idtype = IDMAP_GID;
2740148c5f43SAlan Wright }
2741148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND)
2742e8c27ec8Sbaban goto out;
2743c5c4113dSnw
2744148c5f43SAlan Wright if (_idmapdstate.cfg->pgcfg.use_lsa &&
2745148c5f43SAlan Wright _idmapdstate.cfg->pgcfg.domain_name != NULL) {
2746148c5f43SAlan Wright /*
2747148c5f43SAlan Wright * If we don't have both name and SID, try looking up the
2748148c5f43SAlan Wright * entry with LSA.
2749148c5f43SAlan Wright */
2750148c5f43SAlan Wright if (req->id1.idmap_id_u.sid.prefix != NULL &&
2751148c5f43SAlan Wright req->id1name == NULL) {
2752148c5f43SAlan Wright
2753148c5f43SAlan Wright retcode = lookup_lsa_by_sid(
2754148c5f43SAlan Wright req->id1.idmap_id_u.sid.prefix,
2755148c5f43SAlan Wright req->id1.idmap_id_u.sid.rid,
2756148c5f43SAlan Wright &req->id1name, &req->id1domain, &req->id1.idtype);
2757148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2758148c5f43SAlan Wright TRACE(req, res, "Found with LSA");
2759148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) {
2760148c5f43SAlan Wright TRACE(req, res, "Not found with LSA");
2761148c5f43SAlan Wright } else {
2762148c5f43SAlan Wright TRACE(req, res, "LSA error %d", retcode);
2763148c5f43SAlan Wright goto out;
2764148c5f43SAlan Wright }
2765148c5f43SAlan Wright
2766148c5f43SAlan Wright } else if (req->id1name != NULL &&
2767148c5f43SAlan Wright req->id1.idmap_id_u.sid.prefix == NULL) {
2768148c5f43SAlan Wright char *canonname;
2769148c5f43SAlan Wright char *canondomain;
2770148c5f43SAlan Wright
2771148c5f43SAlan Wright retcode = lookup_lsa_by_name(
2772148c5f43SAlan Wright req->id1name, req->id1domain,
2773148c5f43SAlan Wright &req->id1.idmap_id_u.sid.prefix,
2774148c5f43SAlan Wright &req->id1.idmap_id_u.sid.rid,
2775148c5f43SAlan Wright &canonname, &canondomain,
2776148c5f43SAlan Wright &req->id1.idtype);
2777148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
2778148c5f43SAlan Wright free(req->id1name);
2779148c5f43SAlan Wright req->id1name = canonname;
2780148c5f43SAlan Wright free(req->id1domain);
2781148c5f43SAlan Wright req->id1domain = canondomain;
2782148c5f43SAlan Wright TRACE(req, res, "Found with LSA");
2783148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) {
2784148c5f43SAlan Wright TRACE(req, res, "Not found with LSA");
2785148c5f43SAlan Wright } else {
2786148c5f43SAlan Wright TRACE(req, res, "LSA error %d", retcode);
2787148c5f43SAlan Wright goto out;
2788148c5f43SAlan Wright }
2789148c5f43SAlan Wright }
2790148c5f43SAlan Wright }
2791148c5f43SAlan Wright
2792c5c4113dSnw /*
2793e8c27ec8Sbaban * Set the flag to indicate that we are not done yet so that
2794e8c27ec8Sbaban * subsequent passes considers this request for name-based
2795e8c27ec8Sbaban * mapping and ephemeral mapping.
2796c5c4113dSnw */
2797e8c27ec8Sbaban state->sid2pid_done = FALSE;
2798e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE;
2799c5c4113dSnw
2800c5c4113dSnw /*
2801e8c27ec8Sbaban * Even if we have both sid and winname, we still may need to batch
2802e8c27ec8Sbaban * this request for AD lookup if we don't have unixname and
2803e8c27ec8Sbaban * directory-based name mapping (AD or mixed) is enabled.
2804e8c27ec8Sbaban * We avoid AD lookup for well-known SIDs because they don't have
2805e8c27ec8Sbaban * regular AD objects.
2806c5c4113dSnw */
2807e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS ||
2808e8c27ec8Sbaban (!wksid && req->id2name == NULL &&
2809e3f2c991SKeyur Desai AD_OR_MIXED_MODE(res->id.idtype, state)) ||
28109fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States (!wksid && res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID &&
2811e3f2c991SKeyur Desai state->directory_based_mapping == DIRECTORY_MAPPING_IDMU)) {
2812c5c4113dSnw retcode = IDMAP_SUCCESS;
2813e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD;
2814c5c4113dSnw state->ad_nqueries++;
2815479ac375Sdm } else if (NLDAP_MODE(res->id.idtype, state)) {
2816479ac375Sdm req->direction |= _IDMAP_F_LOOKUP_NLDAP;
2817479ac375Sdm state->nldap_nqueries++;
2818c5c4113dSnw }
2819c5c4113dSnw
2820c5c4113dSnw
2821c5c4113dSnw out:
2822c5c4113dSnw res->retcode = idmap_stat4prot(retcode);
2823e8c27ec8Sbaban /*
2824e8c27ec8Sbaban * If we are done and there was an error then set fallback pid
2825e8c27ec8Sbaban * in the result.
2826e8c27ec8Sbaban */
2827e8c27ec8Sbaban if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS)
2828e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY;
2829c5c4113dSnw return (retcode);
2830c5c4113dSnw }
2831c5c4113dSnw
2832c5c4113dSnw /*
2833c5c4113dSnw * Generate SID using the following convention
28349bf5f78fSMatt Barden * <machine-sid-prefix>-<1000 + uid>
28359bf5f78fSMatt Barden * <machine-sid-prefix>-<2^31 + gid>
2836c5c4113dSnw */
2837cd37da74Snw static
2838cd37da74Snw idmap_retcode
generate_localsid(idmap_mapping * req,idmap_id_res * res,int is_user,int fallback)283948258c6bSjp generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user,
28409bf5f78fSMatt Barden int fallback)
2841cd37da74Snw {
2842e8c27ec8Sbaban free(res->id.idmap_id_u.sid.prefix);
2843e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = NULL;
2844c5c4113dSnw
2845e8c27ec8Sbaban /*
2846e8c27ec8Sbaban * Diagonal mapping for localSIDs not supported because of the
2847e8c27ec8Sbaban * way we generate localSIDs.
2848e8c27ec8Sbaban */
2849e8c27ec8Sbaban if (is_user && res->id.idtype == IDMAP_GSID)
2850a0aa776eSAlan Wright return (IDMAP_ERR_NOTGROUP);
2851e8c27ec8Sbaban if (!is_user && res->id.idtype == IDMAP_USID)
2852a0aa776eSAlan Wright return (IDMAP_ERR_NOTUSER);
2853c5c4113dSnw
2854e8c27ec8Sbaban /* Skip 1000 UIDs */
28551fcced4cSJordan Brown if (is_user &&
28561fcced4cSJordan Brown req->id1.idmap_id_u.uid + LOCALRID_UID_MIN > LOCALRID_UID_MAX)
2857e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING);
2858e8c27ec8Sbaban
2859e8c27ec8Sbaban RDLOCK_CONFIG();
2860e8c27ec8Sbaban /*
2861e8c27ec8Sbaban * machine_sid is never NULL because if it is we won't be here.
2862148c5f43SAlan Wright * No need to assert because strdup(NULL) will core anyways.
2863e8c27ec8Sbaban */
2864e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix =
2865e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.machine_sid);
2866e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix == NULL) {
2867e8c27ec8Sbaban UNLOCK_CONFIG();
2868e8c27ec8Sbaban idmapdlog(LOG_ERR, "Out of memory");
2869e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
2870c5c4113dSnw }
2871e8c27ec8Sbaban UNLOCK_CONFIG();
2872e8c27ec8Sbaban res->id.idmap_id_u.sid.rid =
28731fcced4cSJordan Brown (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_UID_MIN :
28741fcced4cSJordan Brown req->id1.idmap_id_u.gid + LOCALRID_GID_MIN;
2875e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
2876e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID)
2877e8c27ec8Sbaban res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
2878c5c4113dSnw
2879fc724630SAlan Wright if (!fallback) {
288048258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID;
288148258c6bSjp res->info.src = IDMAP_MAP_SRC_ALGORITHMIC;
288248258c6bSjp }
288348258c6bSjp
2884e8c27ec8Sbaban /*
2885e8c27ec8Sbaban * Don't update name_cache because local sids don't have
2886e8c27ec8Sbaban * valid windows names.
2887e8c27ec8Sbaban */
2888e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
2889e8c27ec8Sbaban return (IDMAP_SUCCESS);
2890c5c4113dSnw }
2891c5c4113dSnw
2892cd37da74Snw static
2893cd37da74Snw idmap_retcode
lookup_localsid2pid(idmap_mapping * req,idmap_id_res * res)2894cd37da74Snw lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res)
2895cd37da74Snw {
2896c5c4113dSnw char *sidprefix;
2897c5c4113dSnw uint32_t rid;
2898c5c4113dSnw int s;
2899c5c4113dSnw
2900c5c4113dSnw /*
2901c5c4113dSnw * If the sidprefix == localsid then UID = last RID - 1000 or
2902c5c4113dSnw * GID = last RID - 2^31.
2903c5c4113dSnw */
2904e8c27ec8Sbaban if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL)
2905e8c27ec8Sbaban /* This means we are looking up by winname */
2906e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
2907c5c4113dSnw rid = req->id1.idmap_id_u.sid.rid;
2908c5c4113dSnw
2909c5c4113dSnw RDLOCK_CONFIG();
2910cd37da74Snw s = (_idmapdstate.cfg->pgcfg.machine_sid) ?
2911cd37da74Snw strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1;
2912c5c4113dSnw UNLOCK_CONFIG();
2913c5c4113dSnw
2914e8c27ec8Sbaban /*
2915e8c27ec8Sbaban * If the given sidprefix does not match machine_sid then this is
2916e8c27ec8Sbaban * not a local SID.
2917e8c27ec8Sbaban */
2918e8c27ec8Sbaban if (s != 0)
2919e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
2920e8c27ec8Sbaban
2921e8c27ec8Sbaban switch (res->id.idtype) {
2922e8c27ec8Sbaban case IDMAP_UID:
29231fcced4cSJordan Brown if (rid < LOCALRID_UID_MIN || rid > LOCALRID_UID_MAX)
2924e8c27ec8Sbaban return (IDMAP_ERR_ARG);
29251fcced4cSJordan Brown res->id.idmap_id_u.uid = rid - LOCALRID_UID_MIN;
2926e8c27ec8Sbaban break;
2927e8c27ec8Sbaban case IDMAP_GID:
29281fcced4cSJordan Brown if (rid < LOCALRID_GID_MIN)
2929e8c27ec8Sbaban return (IDMAP_ERR_ARG);
29301fcced4cSJordan Brown res->id.idmap_id_u.gid = rid - LOCALRID_GID_MIN;
2931e8c27ec8Sbaban break;
2932e8c27ec8Sbaban case IDMAP_POSIXID:
29331fcced4cSJordan Brown if (rid >= LOCALRID_GID_MIN) {
29341fcced4cSJordan Brown res->id.idmap_id_u.gid = rid - LOCALRID_GID_MIN;
2935c5c4113dSnw res->id.idtype = IDMAP_GID;
29361fcced4cSJordan Brown } else if (rid >= LOCALRID_UID_MIN) {
29371fcced4cSJordan Brown res->id.idmap_id_u.uid = rid - LOCALRID_UID_MIN;
2938e8c27ec8Sbaban res->id.idtype = IDMAP_UID;
29391fcced4cSJordan Brown } else {
29401fcced4cSJordan Brown return (IDMAP_ERR_ARG);
2941c5c4113dSnw }
2942e8c27ec8Sbaban break;
2943e8c27ec8Sbaban default:
2944e8c27ec8Sbaban return (IDMAP_ERR_NOTSUPPORTED);
2945c5c4113dSnw }
2946fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID;
2947fc724630SAlan Wright res->info.src = IDMAP_MAP_SRC_ALGORITHMIC;
2948e8c27ec8Sbaban return (IDMAP_SUCCESS);
2949c5c4113dSnw }
2950c5c4113dSnw
2951e8c27ec8Sbaban /*
2952e8c27ec8Sbaban * Name service lookup by unixname to get pid
2953e8c27ec8Sbaban */
2954cd37da74Snw static
2955cd37da74Snw idmap_retcode
ns_lookup_byname(const char * name,const char * lower_name,idmap_id * id)2956e8c27ec8Sbaban ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id)
2957cd37da74Snw {
2958cd37da74Snw struct passwd pwd, *pwdp;
2959cd37da74Snw struct group grp, *grpp;
29608c155366SJordan Brown char *buf;
29618c155366SJordan Brown static size_t pwdbufsiz = 0;
29628c155366SJordan Brown static size_t grpbufsiz = 0;
2963c5c4113dSnw
2964e8c27ec8Sbaban switch (id->idtype) {
2965e8c27ec8Sbaban case IDMAP_UID:
29668c155366SJordan Brown if (pwdbufsiz == 0)
29678c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX);
29688c155366SJordan Brown buf = alloca(pwdbufsiz);
29698c155366SJordan Brown pwdp = getpwnam_r(name, &pwd, buf, pwdbufsiz);
2970e8c27ec8Sbaban if (pwdp == NULL && errno == 0 && lower_name != NULL &&
2971cd37da74Snw name != lower_name && strcmp(name, lower_name) != 0)
29728c155366SJordan Brown pwdp = getpwnam_r(lower_name, &pwd, buf, pwdbufsiz);
2973cd37da74Snw if (pwdp == NULL) {
2974bbf6f00cSJordan Brown if (errno == 0)
2975c5c4113dSnw return (IDMAP_ERR_NOTFOUND);
2976c5c4113dSnw else
2977c5c4113dSnw return (IDMAP_ERR_INTERNAL);
2978c5c4113dSnw }
2979e8c27ec8Sbaban id->idmap_id_u.uid = pwd.pw_uid;
2980e8c27ec8Sbaban break;
2981e8c27ec8Sbaban case IDMAP_GID:
29828c155366SJordan Brown if (grpbufsiz == 0)
29838c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX);
29848c155366SJordan Brown buf = alloca(grpbufsiz);
29858c155366SJordan Brown grpp = getgrnam_r(name, &grp, buf, grpbufsiz);
2986e8c27ec8Sbaban if (grpp == NULL && errno == 0 && lower_name != NULL &&
2987cd37da74Snw name != lower_name && strcmp(name, lower_name) != 0)
29888c155366SJordan Brown grpp = getgrnam_r(lower_name, &grp, buf, grpbufsiz);
2989cd37da74Snw if (grpp == NULL) {
2990bbf6f00cSJordan Brown if (errno == 0)
2991c5c4113dSnw return (IDMAP_ERR_NOTFOUND);
2992c5c4113dSnw else
2993c5c4113dSnw return (IDMAP_ERR_INTERNAL);
2994c5c4113dSnw }
2995e8c27ec8Sbaban id->idmap_id_u.gid = grp.gr_gid;
2996e8c27ec8Sbaban break;
2997e8c27ec8Sbaban default:
2998e8c27ec8Sbaban return (IDMAP_ERR_ARG);
2999e8c27ec8Sbaban }
3000e8c27ec8Sbaban return (IDMAP_SUCCESS);
3001e8c27ec8Sbaban }
3002e8c27ec8Sbaban
3003e8c27ec8Sbaban
3004e8c27ec8Sbaban /*
3005e8c27ec8Sbaban * Name service lookup by pid to get unixname
3006e8c27ec8Sbaban */
3007e8c27ec8Sbaban static
3008e8c27ec8Sbaban idmap_retcode
ns_lookup_bypid(uid_t pid,int is_user,char ** unixname)3009e8c27ec8Sbaban ns_lookup_bypid(uid_t pid, int is_user, char **unixname)
3010e8c27ec8Sbaban {
3011e8c27ec8Sbaban struct passwd pwd;
3012e8c27ec8Sbaban struct group grp;
30138c155366SJordan Brown char *buf;
30148c155366SJordan Brown static size_t pwdbufsiz = 0;
30158c155366SJordan Brown static size_t grpbufsiz = 0;
3016e8c27ec8Sbaban
3017e8c27ec8Sbaban if (is_user) {
30188c155366SJordan Brown if (pwdbufsiz == 0)
30198c155366SJordan Brown pwdbufsiz = sysconf(_SC_GETPW_R_SIZE_MAX);
30208c155366SJordan Brown buf = alloca(pwdbufsiz);
3021e8c27ec8Sbaban errno = 0;
30228c155366SJordan Brown if (getpwuid_r(pid, &pwd, buf, pwdbufsiz) == NULL) {
3023bbf6f00cSJordan Brown if (errno == 0)
3024e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
3025e8c27ec8Sbaban else
3026e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL);
3027e8c27ec8Sbaban }
3028e8c27ec8Sbaban *unixname = strdup(pwd.pw_name);
3029e8c27ec8Sbaban } else {
30308c155366SJordan Brown if (grpbufsiz == 0)
30318c155366SJordan Brown grpbufsiz = sysconf(_SC_GETGR_R_SIZE_MAX);
30328c155366SJordan Brown buf = alloca(grpbufsiz);
3033e8c27ec8Sbaban errno = 0;
30348c155366SJordan Brown if (getgrgid_r(pid, &grp, buf, grpbufsiz) == NULL) {
3035bbf6f00cSJordan Brown if (errno == 0)
3036e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND);
3037e8c27ec8Sbaban else
3038e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL);
3039e8c27ec8Sbaban }
3040e8c27ec8Sbaban *unixname = strdup(grp.gr_name);
3041c5c4113dSnw }
3042e8c27ec8Sbaban if (*unixname == NULL)
3043e8c27ec8Sbaban return (IDMAP_ERR_MEMORY);
3044c5c4113dSnw return (IDMAP_SUCCESS);
3045c5c4113dSnw }
3046c5c4113dSnw
3047c5c4113dSnw /*
3048c5c4113dSnw * Name-based mapping
3049c5c4113dSnw *
3050c5c4113dSnw * Case 1: If no rule matches do ephemeral
3051c5c4113dSnw *
3052c5c4113dSnw * Case 2: If rule matches and unixname is "" then return no mapping.
3053c5c4113dSnw *
3054c5c4113dSnw * Case 3: If rule matches and unixname is specified then lookup name
3055c5c4113dSnw * service using the unixname. If unixname not found then return no mapping.
3056c5c4113dSnw *
3057c5c4113dSnw * Case 4: If rule matches and unixname is * then lookup name service
3058c5c4113dSnw * using winname as the unixname. If unixname not found then process
3059c5c4113dSnw * other rules using the lookup order. If no other rule matches then do
3060c5c4113dSnw * ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4.
3061c5c4113dSnw * This allows us to specify a fallback unixname per _domain_ or no mapping
3062c5c4113dSnw * instead of the default behaviour of doing ephemeral mapping.
3063c5c4113dSnw *
3064c5c4113dSnw * Example 1:
3065c5c4113dSnw * *@sfbay == *
3066c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in
3067c5c4113dSnw * the name service then foo@sfbay will be mapped to an ephemeral id.
3068c5c4113dSnw *
3069c5c4113dSnw * Example 2:
3070c5c4113dSnw * *@sfbay == *
3071c5c4113dSnw * *@sfbay => guest
3072c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in
3073c5c4113dSnw * the name service then foo@sfbay will be mapped to guest.
3074c5c4113dSnw *
3075c5c4113dSnw * Example 3:
3076c5c4113dSnw * *@sfbay == *
3077c5c4113dSnw * *@sfbay => ""
3078c5c4113dSnw * If looking up windows users foo@sfbay and foo does not exists in
3079c5c4113dSnw * the name service then we will return no mapping for foo@sfbay.
3080c5c4113dSnw *
3081c5c4113dSnw */
3082cd37da74Snw static
3083cd37da74Snw idmap_retcode
name_based_mapping_sid2pid(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3084479ac375Sdm name_based_mapping_sid2pid(lookup_state_t *state,
30859bf5f78fSMatt Barden idmap_mapping *req, idmap_id_res *res)
3086cd37da74Snw {
3087cd37da74Snw const char *unixname, *windomain;
3088cd37da74Snw char *sql = NULL, *errmsg = NULL, *lower_winname = NULL;
3089c5c4113dSnw idmap_retcode retcode;
3090cd37da74Snw char *end, *lower_unixname, *winname;
3091c5c4113dSnw const char **values;
3092c5c4113dSnw sqlite_vm *vm = NULL;
309308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int ncol, r, is_user, is_wuser;
309448258c6bSjp idmap_namerule *rule = &res->info.how.idmap_how_u.rule;
309548258c6bSjp int direction;
3096c5c4113dSnw const char *me = "name_based_mapping_sid2pid";
3097c5c4113dSnw
3098e8c27ec8Sbaban assert(req->id1name != NULL); /* We have winname */
3099e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have unixname */
3100e8c27ec8Sbaban
31018e228215Sdm winname = req->id1name;
31028e228215Sdm windomain = req->id1domain;
3103cd37da74Snw
3104cd37da74Snw switch (req->id1.idtype) {
3105cd37da74Snw case IDMAP_USID:
3106cd37da74Snw is_wuser = 1;
3107cd37da74Snw break;
3108cd37da74Snw case IDMAP_GSID:
3109cd37da74Snw is_wuser = 0;
3110cd37da74Snw break;
3111cd37da74Snw default:
3112e8c27ec8Sbaban idmapdlog(LOG_ERR, "%s: Unable to determine if the "
3113e8c27ec8Sbaban "given Windows id is user or group.", me);
3114cd37da74Snw return (IDMAP_ERR_INTERNAL);
3115cd37da74Snw }
3116cd37da74Snw
3117e8c27ec8Sbaban switch (res->id.idtype) {
3118cd37da74Snw case IDMAP_UID:
3119cd37da74Snw is_user = 1;
3120cd37da74Snw break;
3121cd37da74Snw case IDMAP_GID:
3122cd37da74Snw is_user = 0;
3123cd37da74Snw break;
3124cd37da74Snw case IDMAP_POSIXID:
3125cd37da74Snw is_user = is_wuser;
3126cd37da74Snw res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID;
3127cd37da74Snw break;
3128cd37da74Snw }
3129c5c4113dSnw
3130479ac375Sdm if (windomain == NULL)
313162c60062Sbaban windomain = "";
3132c5c4113dSnw
3133cd37da74Snw if ((lower_winname = tolower_u8(winname)) == NULL)
3134cd37da74Snw lower_winname = winname; /* hope for the best */
3135c5c4113dSnw sql = sqlite_mprintf(
313648258c6bSjp "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 "
313748258c6bSjp "FROM namerules WHERE "
3138cd37da74Snw "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND "
3139cd37da74Snw "(winname = %Q OR winname = '*') AND "
314008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States "(windomain = %Q OR windomain = '*') "
3141cd37da74Snw "ORDER BY w2u_order ASC;",
314208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States is_user, is_wuser, lower_winname, windomain);
3143c5c4113dSnw if (sql == NULL) {
3144c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
3145c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
3146c5c4113dSnw goto out;
3147c5c4113dSnw }
3148c5c4113dSnw
3149479ac375Sdm if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
3150c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3151cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3152cd37da74Snw CHECK_NULL(errmsg));
3153c5c4113dSnw sqlite_freemem(errmsg);
3154c5c4113dSnw goto out;
3155c5c4113dSnw }
3156c5c4113dSnw
315748258c6bSjp for (;;) {
3158c5c4113dSnw r = sqlite_step(vm, &ncol, &values, NULL);
315984decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
3160c5c4113dSnw
316184decf41Sjp if (r == SQLITE_ROW) {
316248258c6bSjp if (ncol < 5) {
3163c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3164c5c4113dSnw goto out;
3165c5c4113dSnw }
3166148c5f43SAlan Wright
3167148c5f43SAlan Wright TRACE(req, res, "Matching rule: %s@%s -> %s",
3168148c5f43SAlan Wright values[2] == NULL ? "(null)" : values[2],
3169148c5f43SAlan Wright values[3] == NULL ? "(null)" : values[3],
3170148c5f43SAlan Wright values[0] == NULL ? "(null)" : values[0]);
3171148c5f43SAlan Wright
3172c5c4113dSnw if (values[0] == NULL) {
3173c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3174c5c4113dSnw goto out;
3175c5c4113dSnw }
3176c5c4113dSnw
317748258c6bSjp if (values[1] != NULL)
317848258c6bSjp direction =
317948258c6bSjp (strtol(values[1], &end, 10) == 0)?
318048258c6bSjp IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
318148258c6bSjp else
318248258c6bSjp direction = IDMAP_DIRECTION_W2U;
318348258c6bSjp
3184c5c4113dSnw if (EMPTY_NAME(values[0])) {
3185148c5f43SAlan Wright TRACE(req, res, "Mapping inhibited");
318648258c6bSjp idmap_namerule_set(rule, values[3], values[2],
31879fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[0], is_user, is_wuser,
318848258c6bSjp strtol(values[4], &end, 10),
318948258c6bSjp direction);
3190c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING;
3191c5c4113dSnw goto out;
3192c5c4113dSnw }
319348258c6bSjp
319448258c6bSjp if (values[0][0] == '*') {
319548258c6bSjp unixname = winname;
319648258c6bSjp lower_unixname = lower_winname;
319748258c6bSjp } else {
319848258c6bSjp unixname = values[0];
319948258c6bSjp lower_unixname = NULL;
320048258c6bSjp }
320148258c6bSjp
3202e8c27ec8Sbaban retcode = ns_lookup_byname(unixname, lower_unixname,
3203e8c27ec8Sbaban &res->id);
3204148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
3205148c5f43SAlan Wright break;
3206148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) {
3207148c5f43SAlan Wright if (values[0][0] == '*') {
3208148c5f43SAlan Wright TRACE(req, res,
3209148c5f43SAlan Wright "%s not found, continuing",
3210148c5f43SAlan Wright unixname);
3211c5c4113dSnw /* Case 4 */
3212c5c4113dSnw continue;
3213148c5f43SAlan Wright } else {
3214148c5f43SAlan Wright TRACE(req, res,
3215148c5f43SAlan Wright "%s not found, error", unixname);
3216c5c4113dSnw /* Case 3 */
321748258c6bSjp idmap_namerule_set(rule, values[3],
32189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States values[2], values[0], is_user,
32199fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States is_wuser,
322048258c6bSjp strtol(values[4], &end, 10),
322148258c6bSjp direction);
3222c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING;
322348258c6bSjp }
3224148c5f43SAlan Wright } else {
3225148c5f43SAlan Wright TRACE(req, res, "Looking up %s error=%d",
3226148c5f43SAlan Wright unixname, retcode);
3227c5c4113dSnw }
3228c5c4113dSnw goto out;
3229c5c4113dSnw } else if (r == SQLITE_DONE) {
3230cb174861Sjoyce mcintosh TRACE(req, res, "No matching rule");
3231c5c4113dSnw retcode = IDMAP_ERR_NOTFOUND;
3232c5c4113dSnw goto out;
3233c5c4113dSnw } else {
3234c5c4113dSnw (void) sqlite_finalize(vm, &errmsg);
3235c5c4113dSnw vm = NULL;
3236cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3237cd37da74Snw CHECK_NULL(errmsg));
3238c5c4113dSnw sqlite_freemem(errmsg);
3239c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3240c5c4113dSnw goto out;
3241c5c4113dSnw }
3242c5c4113dSnw }
3243c5c4113dSnw
3244148c5f43SAlan Wright /* Found */
324548258c6bSjp
3246148c5f43SAlan Wright if (values[1] != NULL)
3247148c5f43SAlan Wright res->direction =
3248148c5f43SAlan Wright (strtol(values[1], &end, 10) == 0)?
3249148c5f43SAlan Wright IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
3250148c5f43SAlan Wright else
3251148c5f43SAlan Wright res->direction = IDMAP_DIRECTION_W2U;
3252148c5f43SAlan Wright
3253148c5f43SAlan Wright req->id2name = strdup(unixname);
3254148c5f43SAlan Wright if (req->id2name == NULL) {
3255148c5f43SAlan Wright retcode = IDMAP_ERR_MEMORY;
3256148c5f43SAlan Wright goto out;
3257479ac375Sdm }
3258148c5f43SAlan Wright TRACE(req, res, "UNIX name found");
3259479ac375Sdm
3260148c5f43SAlan Wright idmap_namerule_set(rule, values[3], values[2],
3261148c5f43SAlan Wright values[0], is_user, is_wuser, strtol(values[4], &end, 10),
3262148c5f43SAlan Wright res->direction);
3263148c5f43SAlan Wright
3264148c5f43SAlan Wright out:
3265148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS &&
3266148c5f43SAlan Wright retcode != IDMAP_ERR_NOTFOUND &&
3267148c5f43SAlan Wright retcode != IDMAP_ERR_NOMAPPING) {
3268148c5f43SAlan Wright TRACE(req, res, "Rule processing error, code=%d", retcode);
3269fc724630SAlan Wright }
3270fc724630SAlan Wright
3271148c5f43SAlan Wright if (sql != NULL)
3272148c5f43SAlan Wright sqlite_freemem(sql);
3273148c5f43SAlan Wright
3274fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) {
3275fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED;
327648258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW;
3277c5c4113dSnw }
3278479ac375Sdm
3279cd37da74Snw if (lower_winname != NULL && lower_winname != winname)
3280cd37da74Snw free(lower_winname);
328162c60062Sbaban if (vm != NULL)
3282c5c4113dSnw (void) sqlite_finalize(vm, NULL);
3283c5c4113dSnw return (retcode);
3284c5c4113dSnw }
3285c5c4113dSnw
3286c5c4113dSnw static
3287c5c4113dSnw int
get_next_eph_uid(uid_t * next_uid)3288c5c4113dSnw get_next_eph_uid(uid_t *next_uid)
3289c5c4113dSnw {
3290c5c4113dSnw uid_t uid;
3291c5c4113dSnw gid_t gid;
3292c5c4113dSnw int err;
3293c5c4113dSnw
3294c5c4113dSnw *next_uid = (uid_t)-1;
3295c5c4113dSnw uid = _idmapdstate.next_uid++;
3296c5c4113dSnw if (uid >= _idmapdstate.limit_uid) {
3297c5c4113dSnw if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0)
3298c5c4113dSnw return (err);
3299c5c4113dSnw
3300c5c4113dSnw _idmapdstate.limit_uid = uid + 8192;
3301c5c4113dSnw _idmapdstate.next_uid = uid;
3302c5c4113dSnw }
3303c5c4113dSnw *next_uid = uid;
3304c5c4113dSnw
3305c5c4113dSnw return (0);
3306c5c4113dSnw }
3307c5c4113dSnw
3308c5c4113dSnw static
3309c5c4113dSnw int
get_next_eph_gid(gid_t * next_gid)3310c5c4113dSnw get_next_eph_gid(gid_t *next_gid)
3311c5c4113dSnw {
3312c5c4113dSnw uid_t uid;
3313c5c4113dSnw gid_t gid;
3314c5c4113dSnw int err;
3315c5c4113dSnw
3316c5c4113dSnw *next_gid = (uid_t)-1;
3317c5c4113dSnw gid = _idmapdstate.next_gid++;
3318c5c4113dSnw if (gid >= _idmapdstate.limit_gid) {
3319c5c4113dSnw if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0)
3320c5c4113dSnw return (err);
3321c5c4113dSnw
3322c5c4113dSnw _idmapdstate.limit_gid = gid + 8192;
3323c5c4113dSnw _idmapdstate.next_gid = gid;
3324c5c4113dSnw }
3325c5c4113dSnw *next_gid = gid;
3326c5c4113dSnw
3327c5c4113dSnw return (0);
3328c5c4113dSnw }
3329c5c4113dSnw
333062c60062Sbaban static
333162c60062Sbaban int
gethash(const char * str,uint32_t num,uint_t htsize)3332cd37da74Snw gethash(const char *str, uint32_t num, uint_t htsize)
3333cd37da74Snw {
333462c60062Sbaban uint_t hval, i, len;
333562c60062Sbaban
333662c60062Sbaban if (str == NULL)
333762c60062Sbaban return (0);
333862c60062Sbaban for (len = strlen(str), hval = 0, i = 0; i < len; i++) {
333962c60062Sbaban hval += str[i];
334062c60062Sbaban hval += (hval << 10);
334162c60062Sbaban hval ^= (hval >> 6);
334262c60062Sbaban }
334362c60062Sbaban for (str = (const char *)&num, i = 0; i < sizeof (num); i++) {
334462c60062Sbaban hval += str[i];
334562c60062Sbaban hval += (hval << 10);
334662c60062Sbaban hval ^= (hval >> 6);
334762c60062Sbaban }
334862c60062Sbaban hval += (hval << 3);
334962c60062Sbaban hval ^= (hval >> 11);
335062c60062Sbaban hval += (hval << 15);
335162c60062Sbaban return (hval % htsize);
335262c60062Sbaban }
335362c60062Sbaban
335462c60062Sbaban static
335562c60062Sbaban int
get_from_sid_history(lookup_state_t * state,const char * prefix,uint32_t rid,uid_t * pid)335662c60062Sbaban get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid,
33579bf5f78fSMatt Barden uid_t *pid)
3358cd37da74Snw {
335962c60062Sbaban uint_t next, key;
336062c60062Sbaban uint_t htsize = state->sid_history_size;
336162c60062Sbaban idmap_sid *sid;
336262c60062Sbaban
336362c60062Sbaban next = gethash(prefix, rid, htsize);
336462c60062Sbaban while (next != htsize) {
336562c60062Sbaban key = state->sid_history[next].key;
336662c60062Sbaban if (key == htsize)
336762c60062Sbaban return (0);
336862c60062Sbaban sid = &state->batch->idmap_mapping_batch_val[key].id1.
336962c60062Sbaban idmap_id_u.sid;
337062c60062Sbaban if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) {
337162c60062Sbaban *pid = state->result->ids.ids_val[key].id.
337262c60062Sbaban idmap_id_u.uid;
337362c60062Sbaban return (1);
337462c60062Sbaban }
337562c60062Sbaban next = state->sid_history[next].next;
337662c60062Sbaban }
337762c60062Sbaban return (0);
337862c60062Sbaban }
337962c60062Sbaban
338062c60062Sbaban static
338162c60062Sbaban void
add_to_sid_history(lookup_state_t * state,const char * prefix,uint32_t rid)3382cd37da74Snw add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid)
3383cd37da74Snw {
338462c60062Sbaban uint_t hash, next;
338562c60062Sbaban uint_t htsize = state->sid_history_size;
338662c60062Sbaban
338762c60062Sbaban hash = next = gethash(prefix, rid, htsize);
338862c60062Sbaban while (state->sid_history[next].key != htsize) {
338962c60062Sbaban next++;
339062c60062Sbaban next %= htsize;
339162c60062Sbaban }
339262c60062Sbaban state->sid_history[next].key = state->curpos;
339362c60062Sbaban if (hash == next)
339462c60062Sbaban return;
339562c60062Sbaban state->sid_history[next].next = state->sid_history[hash].next;
339662c60062Sbaban state->sid_history[hash].next = next;
339762c60062Sbaban }
3398c5c4113dSnw
3399e8c27ec8Sbaban void
cleanup_lookup_state(lookup_state_t * state)3400e8c27ec8Sbaban cleanup_lookup_state(lookup_state_t *state)
3401e8c27ec8Sbaban {
3402e8c27ec8Sbaban free(state->sid_history);
3403e8c27ec8Sbaban free(state->ad_unixuser_attr);
3404e8c27ec8Sbaban free(state->ad_unixgroup_attr);
3405479ac375Sdm free(state->nldap_winname_attr);
3406479ac375Sdm free(state->defdom);
3407e8c27ec8Sbaban }
3408e8c27ec8Sbaban
3409c5c4113dSnw /* ARGSUSED */
3410c5c4113dSnw static
3411c5c4113dSnw idmap_retcode
dynamic_ephemeral_mapping(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3412479ac375Sdm dynamic_ephemeral_mapping(lookup_state_t *state,
34139bf5f78fSMatt Barden idmap_mapping *req, idmap_id_res *res)
3414cd37da74Snw {
3415c5c4113dSnw
3416c5c4113dSnw uid_t next_pid;
3417c5c4113dSnw
341862c60062Sbaban res->direction = IDMAP_DIRECTION_BI;
341962c60062Sbaban
34209fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
342148258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
342248258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE;
342362c60062Sbaban return (IDMAP_SUCCESS);
342448258c6bSjp }
342562c60062Sbaban
342662c60062Sbaban if (state->sid_history != NULL &&
342762c60062Sbaban get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix,
342862c60062Sbaban req->id1.idmap_id_u.sid.rid, &next_pid)) {
342962c60062Sbaban res->id.idmap_id_u.uid = next_pid;
343048258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
343148258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW;
343262c60062Sbaban return (IDMAP_SUCCESS);
343362c60062Sbaban }
343462c60062Sbaban
343562c60062Sbaban if (res->id.idtype == IDMAP_UID) {
3436c5c4113dSnw if (get_next_eph_uid(&next_pid) != 0)
3437c5c4113dSnw return (IDMAP_ERR_INTERNAL);
3438c5c4113dSnw res->id.idmap_id_u.uid = next_pid;
3439c5c4113dSnw } else {
3440c5c4113dSnw if (get_next_eph_gid(&next_pid) != 0)
3441c5c4113dSnw return (IDMAP_ERR_INTERNAL);
3442c5c4113dSnw res->id.idmap_id_u.gid = next_pid;
3443c5c4113dSnw }
3444c5c4113dSnw
344548258c6bSjp res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
344648258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW;
344762c60062Sbaban if (state->sid_history != NULL)
344862c60062Sbaban add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix,
344962c60062Sbaban req->id1.idmap_id_u.sid.rid);
345062c60062Sbaban
3451c5c4113dSnw return (IDMAP_SUCCESS);
3452c5c4113dSnw }
3453c5c4113dSnw
3454c5c4113dSnw idmap_retcode
sid2pid_second_pass(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3455479ac375Sdm sid2pid_second_pass(lookup_state_t *state,
34569bf5f78fSMatt Barden idmap_mapping *req, idmap_id_res *res)
3457cd37da74Snw {
3458c5c4113dSnw idmap_retcode retcode;
3459148c5f43SAlan Wright idmap_retcode retcode2;
3460c5c4113dSnw
3461c5c4113dSnw /* Check if second pass is needed */
3462e8c27ec8Sbaban if (ARE_WE_DONE(req->direction))
3463c5c4113dSnw return (res->retcode);
3464c5c4113dSnw
3465c5c4113dSnw /* Get status from previous pass */
3466e8c27ec8Sbaban retcode = res->retcode;
34674aa0a5e7Snw if (retcode != IDMAP_SUCCESS && state->eph_map_unres_sids &&
34684aa0a5e7Snw !EMPTY_STRING(req->id1.idmap_id_u.sid.prefix) &&
34694aa0a5e7Snw EMPTY_STRING(req->id1name)) {
34704aa0a5e7Snw /*
34714aa0a5e7Snw * We are asked to map an unresolvable SID to a UID or
34724aa0a5e7Snw * GID, but, which? We'll treat all unresolvable SIDs
34734aa0a5e7Snw * as users unless the caller specified which of a UID
34744aa0a5e7Snw * or GID they want.
34754aa0a5e7Snw */
3476a7c8bd9fSNicolas Williams if (req->id1.idtype == IDMAP_SID)
3477a7c8bd9fSNicolas Williams req->id1.idtype = IDMAP_USID;
3478148c5f43SAlan Wright if (res->id.idtype == IDMAP_POSIXID) {
34794aa0a5e7Snw res->id.idtype = IDMAP_UID;
3480148c5f43SAlan Wright TRACE(req, res, "Assume unresolvable SID is user");
3481148c5f43SAlan Wright } else if (res->id.idtype == IDMAP_UID) {
3482148c5f43SAlan Wright TRACE(req, res, "Must map unresolvable SID to user");
3483148c5f43SAlan Wright } else if (res->id.idtype == IDMAP_GID) {
3484148c5f43SAlan Wright TRACE(req, res, "Must map unresolvable SID to group");
3485148c5f43SAlan Wright }
34864aa0a5e7Snw goto do_eph;
34874aa0a5e7Snw }
3488e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS)
3489e8c27ec8Sbaban goto out;
3490c5c4113dSnw
3491e3f2c991SKeyur Desai /*
3492e3f2c991SKeyur Desai * There are two ways we might get here with a Posix ID:
3493e3f2c991SKeyur Desai * - It could be from an expired ephemeral cache entry.
3494e3f2c991SKeyur Desai * - It could be from IDMU.
3495e3f2c991SKeyur Desai * If it's from IDMU, we need to look up the name, for name-based
3496e3f2c991SKeyur Desai * requests and the cache.
3497e3f2c991SKeyur Desai */
34989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (!IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid) &&
34999fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID) {
3500e3f2c991SKeyur Desai if (req->id2name == NULL) {
3501e3f2c991SKeyur Desai /*
3502e3f2c991SKeyur Desai * If the lookup fails, go ahead anyway.
3503e3f2c991SKeyur Desai * The general UNIX rule is that it's OK to
3504e3f2c991SKeyur Desai * have a UID or GID that isn't in the
3505e3f2c991SKeyur Desai * name service.
3506e3f2c991SKeyur Desai */
3507148c5f43SAlan Wright retcode2 = ns_lookup_bypid(res->id.idmap_id_u.uid,
3508e3f2c991SKeyur Desai res->id.idtype == IDMAP_UID, &req->id2name);
3509148c5f43SAlan Wright if (IDMAP_ERROR(retcode2)) {
3510148c5f43SAlan Wright TRACE(req, res,
3511148c5f43SAlan Wright "Getting UNIX name, error=%d (ignored)",
3512148c5f43SAlan Wright retcode2);
3513148c5f43SAlan Wright } else {
3514148c5f43SAlan Wright TRACE(req, res, "Found UNIX name");
3515148c5f43SAlan Wright }
3516e3f2c991SKeyur Desai }
3517e3f2c991SKeyur Desai goto out;
3518e3f2c991SKeyur Desai }
3519e3f2c991SKeyur Desai
3520e8c27ec8Sbaban /*
3521e8c27ec8Sbaban * If directory-based name mapping is enabled then the unixname
3522e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode or
3523e8c27ec8Sbaban * mixed-mode) or from native LDAP object (nldap-mode) -- done.
3524e8c27ec8Sbaban */
3525e8c27ec8Sbaban if (req->id2name != NULL) {
3526e8c27ec8Sbaban assert(res->id.idtype != IDMAP_POSIXID);
3527e8c27ec8Sbaban if (AD_MODE(res->id.idtype, state))
3528e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
3529e8c27ec8Sbaban else if (NLDAP_MODE(res->id.idtype, state))
3530e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
3531e8c27ec8Sbaban else if (MIXED_MODE(res->id.idtype, state))
3532e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U;
3533c5c4113dSnw
3534e8c27ec8Sbaban /*
3535e8c27ec8Sbaban * Special case: (1) If the ad_unixuser_attr and
3536e8c27ec8Sbaban * ad_unixgroup_attr uses the same attribute
3537e8c27ec8Sbaban * name and (2) if this is a diagonal mapping
3538e8c27ec8Sbaban * request and (3) the unixname has been retrieved
3539e8c27ec8Sbaban * from the AD object -- then we ignore it and fallback
3540e8c27ec8Sbaban * to name-based mapping rules and ephemeral mapping
3541e8c27ec8Sbaban *
3542e8c27ec8Sbaban * Example:
3543e8c27ec8Sbaban * Properties:
3544e8c27ec8Sbaban * config/ad_unixuser_attr = "unixname"
3545e8c27ec8Sbaban * config/ad_unixgroup_attr = "unixname"
3546e8c27ec8Sbaban * AD user object:
3547e8c27ec8Sbaban * dn: cn=bob ...
3548e8c27ec8Sbaban * objectclass: user
3549e8c27ec8Sbaban * sam: bob
3550e8c27ec8Sbaban * unixname: bob1234
3551e8c27ec8Sbaban * AD group object:
3552e8c27ec8Sbaban * dn: cn=winadmins ...
3553e8c27ec8Sbaban * objectclass: group
3554e8c27ec8Sbaban * sam: winadmins
3555e8c27ec8Sbaban * unixname: unixadmins
3556e8c27ec8Sbaban *
3557e8c27ec8Sbaban * In this example whether "unixname" refers to a unixuser
3558e8c27ec8Sbaban * or unixgroup depends upon the AD object.
3559e8c27ec8Sbaban *
3560e8c27ec8Sbaban * $idmap show -c winname:bob gid
3561e8c27ec8Sbaban * AD lookup by "samAccountName=bob" for
3562e8c27ec8Sbaban * "ad_unixgroup_attr (i.e unixname)" for directory-based
3563e8c27ec8Sbaban * mapping would get "bob1234" which is not what we want.
3564e8c27ec8Sbaban * Now why not getgrnam_r("bob1234") and use it if it
3565e8c27ec8Sbaban * is indeed a unixgroup? That's because Unix can have
3566e8c27ec8Sbaban * users and groups with the same name and we clearly
3567e8c27ec8Sbaban * don't know the intention of the admin here.
3568e8c27ec8Sbaban * Therefore we ignore this and fallback to name-based
3569e8c27ec8Sbaban * mapping rules or ephemeral mapping.
3570e8c27ec8Sbaban */
3571e8c27ec8Sbaban if ((AD_MODE(res->id.idtype, state) ||
3572e8c27ec8Sbaban MIXED_MODE(res->id.idtype, state)) &&
3573e8c27ec8Sbaban state->ad_unixuser_attr != NULL &&
3574e8c27ec8Sbaban state->ad_unixgroup_attr != NULL &&
3575e8c27ec8Sbaban strcasecmp(state->ad_unixuser_attr,
3576e8c27ec8Sbaban state->ad_unixgroup_attr) == 0 &&
3577e8c27ec8Sbaban ((req->id1.idtype == IDMAP_USID &&
3578e8c27ec8Sbaban res->id.idtype == IDMAP_GID) ||
3579e8c27ec8Sbaban (req->id1.idtype == IDMAP_GSID &&
3580e8c27ec8Sbaban res->id.idtype == IDMAP_UID))) {
3581148c5f43SAlan Wright TRACE(req, res, "Ignoring UNIX name found in AD");
3582e8c27ec8Sbaban free(req->id2name);
3583e8c27ec8Sbaban req->id2name = NULL;
35849fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States res->id.idmap_id_u.uid = IDMAP_SENTINEL_PID;
3585e8c27ec8Sbaban /* fallback */
3586e8c27ec8Sbaban } else {
3587148c5f43SAlan Wright if (res->id.idmap_id_u.uid == IDMAP_SENTINEL_PID) {
3588e8c27ec8Sbaban retcode = ns_lookup_byname(req->id2name,
3589e8c27ec8Sbaban NULL, &res->id);
3590148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) {
3591148c5f43SAlan Wright /*
3592148c5f43SAlan Wright * If ns_lookup_byname() fails that
3593148c5f43SAlan Wright * means the unixname (req->id2name),
3594148c5f43SAlan Wright * which was obtained from the AD
3595148c5f43SAlan Wright * object by directory-based mapping,
3596148c5f43SAlan Wright * is not a valid Unix user/group and
3597148c5f43SAlan Wright * therefore we return the error to the
3598148c5f43SAlan Wright * client instead of doing rule-based
3599148c5f43SAlan Wright * mapping or ephemeral mapping. This
3600148c5f43SAlan Wright * way the client can detect the issue.
3601148c5f43SAlan Wright */
3602148c5f43SAlan Wright TRACE(req, res,
3603148c5f43SAlan Wright "UNIX lookup error=%d", retcode);
3604148c5f43SAlan Wright goto out;
3605148c5f43SAlan Wright }
3606148c5f43SAlan Wright TRACE(req, res, "UNIX lookup");
3607148c5f43SAlan Wright }
3608e8c27ec8Sbaban goto out;
3609c5c4113dSnw }
3610c5c4113dSnw }
3611c5c4113dSnw
361248258c6bSjp /* Free any mapping info from Directory based mapping */
361348258c6bSjp if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN)
3614148c5f43SAlan Wright idmap_how_clear(&res->info.how);
361548258c6bSjp
3616e8c27ec8Sbaban /*
3617e8c27ec8Sbaban * If we don't have unixname then evaluate local name-based
3618e8c27ec8Sbaban * mapping rules.
3619e8c27ec8Sbaban */
3620479ac375Sdm retcode = name_based_mapping_sid2pid(state, req, res);
3621148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
3622148c5f43SAlan Wright TRACE(req, res, "Rule-based mapping");
3623c5c4113dSnw goto out;
3624148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
3625148c5f43SAlan Wright TRACE(req, res, "Rule-based mapping error=%d", retcode);
3626148c5f43SAlan Wright goto out;
3627148c5f43SAlan Wright }
3628c5c4113dSnw
36294aa0a5e7Snw do_eph:
3630e8c27ec8Sbaban /* If not found, do ephemeral mapping */
3631479ac375Sdm retcode = dynamic_ephemeral_mapping(state, req, res);
3632148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
3633148c5f43SAlan Wright TRACE(req, res, "Ephemeral mapping");
3634148c5f43SAlan Wright goto out;
3635148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
3636148c5f43SAlan Wright TRACE(req, res, "Ephemeral mapping error=%d", retcode);
3637148c5f43SAlan Wright goto out;
3638148c5f43SAlan Wright }
3639c5c4113dSnw
3640c5c4113dSnw out:
3641c5c4113dSnw res->retcode = idmap_stat4prot(retcode);
3642e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) {
3643e8c27ec8Sbaban req->direction = _IDMAP_F_DONE;
3644e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY;
3645e8c27ec8Sbaban }
3646e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction))
3647e8c27ec8Sbaban state->sid2pid_done = FALSE;
3648c5c4113dSnw return (retcode);
3649c5c4113dSnw }
3650c5c4113dSnw
3651c5c4113dSnw idmap_retcode
update_cache_pid2sid(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3652479ac375Sdm update_cache_pid2sid(lookup_state_t *state,
36539bf5f78fSMatt Barden idmap_mapping *req, idmap_id_res *res)
3654cd37da74Snw {
3655c5c4113dSnw char *sql = NULL;
3656c5c4113dSnw idmap_retcode retcode;
3657148c5f43SAlan Wright idmap_retcode retcode2;
365848258c6bSjp char *map_dn = NULL;
365948258c6bSjp char *map_attr = NULL;
366048258c6bSjp char *map_value = NULL;
36619bf5f78fSMatt Barden char *map_windomain = NULL;
366248258c6bSjp char *map_winname = NULL;
366348258c6bSjp char *map_unixname = NULL;
366448258c6bSjp int map_is_nt4 = FALSE;
3665c5c4113dSnw
3666c5c4113dSnw /* Check if we need to cache anything */
3667e8c27ec8Sbaban if (ARE_WE_DONE(req->direction))
3668c5c4113dSnw return (IDMAP_SUCCESS);
3669c5c4113dSnw
3670c5c4113dSnw /* We don't cache negative entries */
3671c5c4113dSnw if (res->retcode != IDMAP_SUCCESS)
3672c5c4113dSnw return (IDMAP_SUCCESS);
3673c5c4113dSnw
3674e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF);
36759fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID);
367648258c6bSjp assert(res->id.idtype != IDMAP_SID);
367748258c6bSjp
3678e3f2c991SKeyur Desai /*
3679e3f2c991SKeyur Desai * If we've gotten to this point and we *still* don't know the
3680e3f2c991SKeyur Desai * unixname, well, we'd like to have it now for the cache.
3681e3f2c991SKeyur Desai *
3682e3f2c991SKeyur Desai * If we truly always need it for the cache, we should probably
3683e3f2c991SKeyur Desai * look it up once at the beginning, rather than "at need" in
3684e3f2c991SKeyur Desai * several places as is now done. However, it's not really clear
3685e3f2c991SKeyur Desai * that we *do* need it in the cache; there's a decent argument
3686e3f2c991SKeyur Desai * that the cache should contain only SIDs and PIDs, so we'll
3687e3f2c991SKeyur Desai * leave our options open by doing it "at need" here too.
3688e3f2c991SKeyur Desai *
3689e3f2c991SKeyur Desai * If we can't find it... c'est la vie.
3690e3f2c991SKeyur Desai */
3691e3f2c991SKeyur Desai if (req->id1name == NULL) {
3692148c5f43SAlan Wright retcode2 = ns_lookup_bypid(req->id1.idmap_id_u.uid,
3693e3f2c991SKeyur Desai req->id1.idtype == IDMAP_UID, &req->id1name);
3694148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS)
3695148c5f43SAlan Wright TRACE(req, res, "Found UNIX name");
3696148c5f43SAlan Wright else
3697148c5f43SAlan Wright TRACE(req, res, "Getting UNIX name error=%d", retcode2);
3698e3f2c991SKeyur Desai }
3699e3f2c991SKeyur Desai
370048258c6bSjp assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN);
370148258c6bSjp switch (res->info.how.map_type) {
370248258c6bSjp case IDMAP_MAP_TYPE_DS_AD:
370348258c6bSjp map_dn = res->info.how.idmap_how_u.ad.dn;
370448258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr;
370548258c6bSjp map_value = res->info.how.idmap_how_u.ad.value;
370648258c6bSjp break;
370748258c6bSjp
370848258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP:
370948258c6bSjp map_dn = res->info.how.idmap_how_u.nldap.dn;
371048258c6bSjp map_attr = res->info.how.idmap_how_u.nldap.attr;
371148258c6bSjp map_value = res->info.how.idmap_how_u.nldap.value;
371248258c6bSjp break;
371348258c6bSjp
371448258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED:
371548258c6bSjp map_windomain = res->info.how.idmap_how_u.rule.windomain;
371648258c6bSjp map_winname = res->info.how.idmap_how_u.rule.winname;
371748258c6bSjp map_unixname = res->info.how.idmap_how_u.rule.unixname;
371848258c6bSjp map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4;
371948258c6bSjp break;
372048258c6bSjp
372148258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL:
372248258c6bSjp break;
372348258c6bSjp
372448258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID:
372548258c6bSjp break;
372648258c6bSjp
3727e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU:
3728e3f2c991SKeyur Desai map_dn = res->info.how.idmap_how_u.idmu.dn;
3729e3f2c991SKeyur Desai map_attr = res->info.how.idmap_how_u.idmu.attr;
3730e3f2c991SKeyur Desai map_value = res->info.how.idmap_how_u.idmu.value;
3731e3f2c991SKeyur Desai break;
3732e3f2c991SKeyur Desai
373348258c6bSjp default:
3734148c5f43SAlan Wright /* Don't cache other mapping types */
373548258c6bSjp assert(FALSE);
373648258c6bSjp }
3737e8c27ec8Sbaban
3738c5c4113dSnw /*
3739c5c4113dSnw * Using NULL for u2w instead of 0 so that our trigger allows
3740c5c4113dSnw * the same pid to be the destination in multiple entries
3741c5c4113dSnw */
3742c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
3743cd37da74Snw "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
374448258c6bSjp "is_user, is_wuser, expiration, w2u, u2w, "
374548258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, "
374648258c6bSjp "map_winname, map_unixname, map_is_nt4) "
3747cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
374848cd229bSGordon Ross "strftime('%%s','now') + %u, %q, 1, "
374948258c6bSjp "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ",
3750cd37da74Snw res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
3751cd37da74Snw req->id2domain, req->id2name, req->id1.idmap_id_u.uid,
3752cd37da74Snw req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0,
3753e8c27ec8Sbaban (res->id.idtype == IDMAP_USID) ? 1 : 0,
375448cd229bSGordon Ross state->id_cache_timeout,
375548258c6bSjp (res->direction == 0) ? "1" : NULL,
375648258c6bSjp res->info.how.map_type, map_dn, map_attr, map_value,
375748258c6bSjp map_windomain, map_winname, map_unixname, map_is_nt4);
3758c5c4113dSnw
3759c5c4113dSnw if (sql == NULL) {
3760c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3761c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
3762c5c4113dSnw goto out;
3763c5c4113dSnw }
3764c5c4113dSnw
3765479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3766c5c4113dSnw if (retcode != IDMAP_SUCCESS)
3767c5c4113dSnw goto out;
3768c5c4113dSnw
3769c5c4113dSnw state->pid2sid_done = FALSE;
3770c5c4113dSnw sqlite_freemem(sql);
3771c5c4113dSnw sql = NULL;
3772c5c4113dSnw
3773e8c27ec8Sbaban /* Check if we need to update namecache */
3774e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
3775c5c4113dSnw goto out;
3776c5c4113dSnw
37778e228215Sdm if (req->id2name == NULL)
3778c5c4113dSnw goto out;
3779c5c4113dSnw
3780c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
3781cd37da74Snw "(sidprefix, rid, canon_name, domain, type, expiration) "
378248cd229bSGordon Ross "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + %u); ",
3783cd37da74Snw res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
3784cd37da74Snw req->id2name, req->id2domain,
378548cd229bSGordon Ross res->id.idtype, state->name_cache_timeout);
3786c5c4113dSnw
3787c5c4113dSnw if (sql == NULL) {
3788c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3789c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
3790c5c4113dSnw goto out;
3791c5c4113dSnw }
3792c5c4113dSnw
3793479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3794c5c4113dSnw
3795c5c4113dSnw out:
379662c60062Sbaban if (sql != NULL)
3797c5c4113dSnw sqlite_freemem(sql);
3798c5c4113dSnw return (retcode);
3799c5c4113dSnw }
3800c5c4113dSnw
3801c5c4113dSnw idmap_retcode
update_cache_sid2pid(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res)3802479ac375Sdm update_cache_sid2pid(lookup_state_t *state,
38039bf5f78fSMatt Barden idmap_mapping *req, idmap_id_res *res)
3804cd37da74Snw {
3805c5c4113dSnw char *sql = NULL;
3806c5c4113dSnw idmap_retcode retcode;
3807c5c4113dSnw int is_eph_user;
380848258c6bSjp char *map_dn = NULL;
380948258c6bSjp char *map_attr = NULL;
381048258c6bSjp char *map_value = NULL;
38119bf5f78fSMatt Barden char *map_windomain = NULL;
381248258c6bSjp char *map_winname = NULL;
381348258c6bSjp char *map_unixname = NULL;
381448258c6bSjp int map_is_nt4 = FALSE;
3815c5c4113dSnw
3816c5c4113dSnw /* Check if we need to cache anything */
3817e8c27ec8Sbaban if (ARE_WE_DONE(req->direction))
3818c5c4113dSnw return (IDMAP_SUCCESS);
3819c5c4113dSnw
3820c5c4113dSnw /* We don't cache negative entries */
3821c5c4113dSnw if (res->retcode != IDMAP_SUCCESS)
3822c5c4113dSnw return (IDMAP_SUCCESS);
3823c5c4113dSnw
3824c5c4113dSnw if (req->direction & _IDMAP_F_EXP_EPH_UID)
3825c5c4113dSnw is_eph_user = 1;
3826c5c4113dSnw else if (req->direction & _IDMAP_F_EXP_EPH_GID)
3827c5c4113dSnw is_eph_user = 0;
3828c5c4113dSnw else
3829c5c4113dSnw is_eph_user = -1;
3830c5c4113dSnw
38319fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (is_eph_user >= 0 &&
38329fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States !IDMAP_ID_IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
3833c5c4113dSnw sql = sqlite_mprintf("UPDATE idmap_cache "
3834cd37da74Snw "SET w2u = 0 WHERE "
3835cd37da74Snw "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
3836cd37da74Snw "pid >= 2147483648 AND is_user = %d;",
3837cd37da74Snw req->id1.idmap_id_u.sid.prefix,
3838cd37da74Snw req->id1.idmap_id_u.sid.rid,
3839cd37da74Snw is_eph_user);
3840c5c4113dSnw if (sql == NULL) {
3841c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3842c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
3843c5c4113dSnw goto out;
3844c5c4113dSnw }
3845c5c4113dSnw
3846479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3847c5c4113dSnw if (retcode != IDMAP_SUCCESS)
3848c5c4113dSnw goto out;
3849c5c4113dSnw
3850c5c4113dSnw sqlite_freemem(sql);
3851c5c4113dSnw sql = NULL;
3852c5c4113dSnw }
3853c5c4113dSnw
3854e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF);
38559fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States assert(res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID);
385648258c6bSjp
385748258c6bSjp switch (res->info.how.map_type) {
385848258c6bSjp case IDMAP_MAP_TYPE_DS_AD:
385948258c6bSjp map_dn = res->info.how.idmap_how_u.ad.dn;
386048258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr;
386148258c6bSjp map_value = res->info.how.idmap_how_u.ad.value;
386248258c6bSjp break;
386348258c6bSjp
386448258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP:
386548258c6bSjp map_dn = res->info.how.idmap_how_u.nldap.dn;
386648258c6bSjp map_attr = res->info.how.idmap_how_u.ad.attr;
386748258c6bSjp map_value = res->info.how.idmap_how_u.nldap.value;
386848258c6bSjp break;
386948258c6bSjp
387048258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED:
387148258c6bSjp map_windomain = res->info.how.idmap_how_u.rule.windomain;
387248258c6bSjp map_winname = res->info.how.idmap_how_u.rule.winname;
387348258c6bSjp map_unixname = res->info.how.idmap_how_u.rule.unixname;
387448258c6bSjp map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4;
387548258c6bSjp break;
387648258c6bSjp
387748258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL:
387848258c6bSjp break;
387948258c6bSjp
3880e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU:
3881e3f2c991SKeyur Desai map_dn = res->info.how.idmap_how_u.idmu.dn;
3882e3f2c991SKeyur Desai map_attr = res->info.how.idmap_how_u.idmu.attr;
3883e3f2c991SKeyur Desai map_value = res->info.how.idmap_how_u.idmu.value;
3884e3f2c991SKeyur Desai break;
3885e3f2c991SKeyur Desai
388648258c6bSjp default:
3887148c5f43SAlan Wright /* Don't cache other mapping types */
388848258c6bSjp assert(FALSE);
388948258c6bSjp }
3890cd37da74Snw
3891c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
3892cd37da74Snw "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
389348258c6bSjp "is_user, is_wuser, expiration, w2u, u2w, "
389448258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, "
389548258c6bSjp "map_winname, map_unixname, map_is_nt4) "
3896cd37da74Snw "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
389748cd229bSGordon Ross "strftime('%%s','now') + %u, 1, %q, "
389848258c6bSjp "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);",
3899cd37da74Snw req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
3900e8c27ec8Sbaban (req->id1domain != NULL) ? req->id1domain : "", req->id1name,
3901e8c27ec8Sbaban res->id.idmap_id_u.uid, req->id2name,
3902e8c27ec8Sbaban (res->id.idtype == IDMAP_UID) ? 1 : 0,
3903cd37da74Snw (req->id1.idtype == IDMAP_USID) ? 1 : 0,
390448cd229bSGordon Ross state->id_cache_timeout,
390548258c6bSjp (res->direction == 0) ? "1" : NULL,
390648258c6bSjp res->info.how.map_type, map_dn, map_attr, map_value,
390748258c6bSjp map_windomain, map_winname, map_unixname, map_is_nt4);
3908c5c4113dSnw
3909c5c4113dSnw if (sql == NULL) {
3910c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3911c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
3912c5c4113dSnw goto out;
3913c5c4113dSnw }
3914c5c4113dSnw
3915479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3916c5c4113dSnw if (retcode != IDMAP_SUCCESS)
3917c5c4113dSnw goto out;
3918c5c4113dSnw
3919c5c4113dSnw state->sid2pid_done = FALSE;
3920c5c4113dSnw sqlite_freemem(sql);
3921c5c4113dSnw sql = NULL;
3922c5c4113dSnw
3923e8c27ec8Sbaban /* Check if we need to update namecache */
3924e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
3925c5c4113dSnw goto out;
3926c5c4113dSnw
3927cf5b5989Sdm if (EMPTY_STRING(req->id1name))
3928c5c4113dSnw goto out;
3929c5c4113dSnw
3930c5c4113dSnw sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
3931cd37da74Snw "(sidprefix, rid, canon_name, domain, type, expiration) "
393248cd229bSGordon Ross "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + %u); ",
3933cd37da74Snw req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
3934cd37da74Snw req->id1name, req->id1domain,
393548cd229bSGordon Ross req->id1.idtype, state->name_cache_timeout);
3936c5c4113dSnw
3937c5c4113dSnw if (sql == NULL) {
3938c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3939c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
3940c5c4113dSnw goto out;
3941c5c4113dSnw }
3942c5c4113dSnw
3943479ac375Sdm retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3944c5c4113dSnw
3945c5c4113dSnw out:
394662c60062Sbaban if (sql != NULL)
3947c5c4113dSnw sqlite_freemem(sql);
3948c5c4113dSnw return (retcode);
3949c5c4113dSnw }
3950c5c4113dSnw
3951cd37da74Snw static
3952cd37da74Snw idmap_retcode
lookup_cache_pid2sid(sqlite * cache,idmap_mapping * req,idmap_id_res * res,int is_user)3953c5c4113dSnw lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res,
39549bf5f78fSMatt Barden int is_user)
3955cd37da74Snw {
3956c5c4113dSnw char *end;
3957c5c4113dSnw char *sql = NULL;
3958c5c4113dSnw const char **values;
3959c5c4113dSnw sqlite_vm *vm = NULL;
3960c5c4113dSnw int ncol;
3961c5c4113dSnw idmap_retcode retcode = IDMAP_SUCCESS;
3962c5c4113dSnw time_t curtime;
3963e8c27ec8Sbaban idmap_id_type idtype;
3964c5c4113dSnw
3965c5c4113dSnw /* Current time */
3966c5c4113dSnw errno = 0;
3967c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) {
3968cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)",
3969cd37da74Snw strerror(errno));
3970c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
3971c5c4113dSnw goto out;
3972c5c4113dSnw }
3973c5c4113dSnw
3974e8c27ec8Sbaban /* SQL to lookup the cache by pid or by unixname */
39759fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID) {
397648258c6bSjp sql = sqlite_mprintf("SELECT sidprefix, rid, "
397748258c6bSjp "canon_winname, windomain, w2u, is_wuser, "
397848258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, "
397948258c6bSjp "map_winname, map_unixname, map_is_nt4 "
3980e8c27ec8Sbaban "FROM idmap_cache WHERE "
3981e8c27ec8Sbaban "pid = %u AND u2w = 1 AND is_user = %d AND "
3982e8c27ec8Sbaban "(pid >= 2147483648 OR "
3983e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR "
3984e8c27ec8Sbaban "expiration > %d));",
3985e8c27ec8Sbaban req->id1.idmap_id_u.uid, is_user, curtime);
3986e8c27ec8Sbaban } else if (req->id1name != NULL) {
398748258c6bSjp sql = sqlite_mprintf("SELECT sidprefix, rid, "
398848258c6bSjp "canon_winname, windomain, w2u, is_wuser, "
398948258c6bSjp "map_type, map_dn, map_attr, map_value, map_windomain, "
399048258c6bSjp "map_winname, map_unixname, map_is_nt4 "
3991e8c27ec8Sbaban "FROM idmap_cache WHERE "
3992e8c27ec8Sbaban "unixname = %Q AND u2w = 1 AND is_user = %d AND "
3993e8c27ec8Sbaban "(pid >= 2147483648 OR "
3994e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR "
3995e8c27ec8Sbaban "expiration > %d));",
3996e8c27ec8Sbaban req->id1name, is_user, curtime);
399748258c6bSjp } else {
399848258c6bSjp retcode = IDMAP_ERR_ARG;
399948258c6bSjp goto out;
4000e8c27ec8Sbaban }
4001e8c27ec8Sbaban
4002c5c4113dSnw if (sql == NULL) {
4003c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
4004c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
4005c5c4113dSnw goto out;
4006c5c4113dSnw }
400748258c6bSjp retcode = sql_compile_n_step_once(
400848258c6bSjp cache, sql, &vm, &ncol, 14, &values);
4009c5c4113dSnw sqlite_freemem(sql);
4010c5c4113dSnw
4011c5c4113dSnw if (retcode == IDMAP_ERR_NOTFOUND)
4012c5c4113dSnw goto out;
4013c5c4113dSnw else if (retcode == IDMAP_SUCCESS) {
4014c5c4113dSnw /* sanity checks */
4015c5c4113dSnw if (values[0] == NULL || values[1] == NULL) {
4016c5c4113dSnw retcode = IDMAP_ERR_CACHE;
4017c5c4113dSnw goto out;
4018c5c4113dSnw }
4019c5c4113dSnw
4020e8c27ec8Sbaban switch (res->id.idtype) {
4021c5c4113dSnw case IDMAP_SID:
4022cd37da74Snw case IDMAP_USID:
4023cd37da74Snw case IDMAP_GSID:
4024e8c27ec8Sbaban idtype = strtol(values[5], &end, 10) == 1
4025cd37da74Snw ? IDMAP_USID : IDMAP_GSID;
4026cd37da74Snw
4027e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID &&
4028e8c27ec8Sbaban idtype != IDMAP_USID) {
4029cd37da74Snw retcode = IDMAP_ERR_NOTUSER;
4030cd37da74Snw goto out;
4031e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GSID &&
4032e8c27ec8Sbaban idtype != IDMAP_GSID) {
4033cd37da74Snw retcode = IDMAP_ERR_NOTGROUP;
4034cd37da74Snw goto out;
4035cd37da74Snw }
4036e8c27ec8Sbaban res->id.idtype = idtype;
4037cd37da74Snw
4038c5c4113dSnw res->id.idmap_id_u.sid.rid =
4039cd37da74Snw strtoul(values[1], &end, 10);
4040c5c4113dSnw res->id.idmap_id_u.sid.prefix = strdup(values[0]);
4041c5c4113dSnw if (res->id.idmap_id_u.sid.prefix == NULL) {
4042c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
4043c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
4044c5c4113dSnw goto out;
4045c5c4113dSnw }
4046c5c4113dSnw
404762c60062Sbaban if (values[4] != NULL)
4048c5c4113dSnw res->direction =
4049651c0131Sbaban (strtol(values[4], &end, 10) == 0)?
4050651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
4051c5c4113dSnw else
4052651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W;
4053c5c4113dSnw
4054fe1c642dSBill Krier if (values[2] == NULL)
4055c5c4113dSnw break;
40568e228215Sdm req->id2name = strdup(values[2]);
40578e228215Sdm if (req->id2name == NULL) {
4058c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
4059c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
4060c5c4113dSnw goto out;
4061c5c4113dSnw }
4062c5c4113dSnw
4063c5c4113dSnw if (values[3] == NULL)
4064c5c4113dSnw break;
40658e228215Sdm req->id2domain = strdup(values[3]);
40668e228215Sdm if (req->id2domain == NULL) {
4067c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
4068c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
4069c5c4113dSnw goto out;
4070c5c4113dSnw }
4071cd37da74Snw
4072c5c4113dSnw break;
4073c5c4113dSnw default:
4074c5c4113dSnw retcode = IDMAP_ERR_NOTSUPPORTED;
4075c5c4113dSnw break;
4076c5c4113dSnw }
407748258c6bSjp if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
407848258c6bSjp res->info.src = IDMAP_MAP_SRC_CACHE;
407948258c6bSjp res->info.how.map_type = strtoul(values[6], &end, 10);
408048258c6bSjp switch (res->info.how.map_type) {
408148258c6bSjp case IDMAP_MAP_TYPE_DS_AD:
408248258c6bSjp res->info.how.idmap_how_u.ad.dn =
408348258c6bSjp strdup(values[7]);
408448258c6bSjp res->info.how.idmap_how_u.ad.attr =
408548258c6bSjp strdup(values[8]);
408648258c6bSjp res->info.how.idmap_how_u.ad.value =
408748258c6bSjp strdup(values[9]);
408848258c6bSjp break;
408948258c6bSjp
409048258c6bSjp case IDMAP_MAP_TYPE_DS_NLDAP:
409148258c6bSjp res->info.how.idmap_how_u.nldap.dn =
409248258c6bSjp strdup(values[7]);
409348258c6bSjp res->info.how.idmap_how_u.nldap.attr =
409448258c6bSjp strdup(values[8]);
409548258c6bSjp res->info.how.idmap_how_u.nldap.value =
409648258c6bSjp strdup(values[9]);
409748258c6bSjp break;
409848258c6bSjp
409948258c6bSjp case IDMAP_MAP_TYPE_RULE_BASED:
410048258c6bSjp res->info.how.idmap_how_u.rule.windomain =
410148258c6bSjp strdup(values[10]);
410248258c6bSjp res->info.how.idmap_how_u.rule.winname =
410348258c6bSjp strdup(values[11]);
410448258c6bSjp res->info.how.idmap_how_u.rule.unixname =
410548258c6bSjp strdup(values[12]);
410648258c6bSjp res->info.how.idmap_how_u.rule.is_nt4 =
410748258c6bSjp strtoul(values[13], &end, 10);
410848258c6bSjp res->info.how.idmap_how_u.rule.is_user =
410948258c6bSjp is_user;
411048258c6bSjp res->info.how.idmap_how_u.rule.is_wuser =
411148258c6bSjp strtol(values[5], &end, 10);
411248258c6bSjp break;
411348258c6bSjp
411448258c6bSjp case IDMAP_MAP_TYPE_EPHEMERAL:
411548258c6bSjp break;
411648258c6bSjp
411748258c6bSjp case IDMAP_MAP_TYPE_LOCAL_SID:
411848258c6bSjp break;
411948258c6bSjp
412048258c6bSjp case IDMAP_MAP_TYPE_KNOWN_SID:
412148258c6bSjp break;
412248258c6bSjp
4123e3f2c991SKeyur Desai case IDMAP_MAP_TYPE_IDMU:
4124e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.dn =
4125e3f2c991SKeyur Desai strdup(values[7]);
4126e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.attr =
4127e3f2c991SKeyur Desai strdup(values[8]);
4128e3f2c991SKeyur Desai res->info.how.idmap_how_u.idmu.value =
4129e3f2c991SKeyur Desai strdup(values[9]);
4130e3f2c991SKeyur Desai break;
4131e3f2c991SKeyur Desai
413248258c6bSjp default:
4133e3f2c991SKeyur Desai /* Unknown mapping type */
413448258c6bSjp assert(FALSE);
413548258c6bSjp }
413648258c6bSjp }
4137c5c4113dSnw }
4138c5c4113dSnw
4139c5c4113dSnw out:
414062c60062Sbaban if (vm != NULL)
4141c5c4113dSnw (void) sqlite_finalize(vm, NULL);
4142c5c4113dSnw return (retcode);
4143c5c4113dSnw }
4144c5c4113dSnw
414508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
414608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given:
414708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * cache sqlite handle
414808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name
414908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name
415008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
415108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Return: Error code
415208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
415308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname Canonical name (if canonname is non-NULL) [1]
415408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix [1]
415508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID
415608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *type Type of name
415708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
415808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error
415908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
4160cd37da74Snw static
4161cd37da74Snw idmap_retcode
lookup_cache_name2sid(sqlite * cache,const char * name,const char * domain,char ** canonname,char ** sidprefix,idmap_rid_t * rid,idmap_id_type * type)4162148c5f43SAlan Wright lookup_cache_name2sid(
4163148c5f43SAlan Wright sqlite *cache,
4164148c5f43SAlan Wright const char *name,
4165148c5f43SAlan Wright const char *domain,
4166148c5f43SAlan Wright char **canonname,
4167148c5f43SAlan Wright char **sidprefix,
4168148c5f43SAlan Wright idmap_rid_t *rid,
4169148c5f43SAlan Wright idmap_id_type *type)
4170cd37da74Snw {
4171cd37da74Snw char *end, *lower_name;
417208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *sql;
4173c5c4113dSnw const char **values;
4174c5c4113dSnw sqlite_vm *vm = NULL;
4175c5c4113dSnw int ncol;
4176c5c4113dSnw time_t curtime;
417708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode retcode;
417808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
417908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL;
418008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL)
418108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
4182c5c4113dSnw
4183c5c4113dSnw /* Get current time */
4184c5c4113dSnw errno = 0;
4185c5c4113dSnw if ((curtime = time(NULL)) == (time_t)-1) {
4186cd37da74Snw idmapdlog(LOG_ERR, "Failed to get current time (%s)",
4187cd37da74Snw strerror(errno));
4188c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
4189c5c4113dSnw goto out;
4190c5c4113dSnw }
4191c5c4113dSnw
4192c5c4113dSnw /* SQL to lookup the cache */
4193cd37da74Snw if ((lower_name = tolower_u8(name)) == NULL)
4194cd37da74Snw lower_name = (char *)name;
4195cd37da74Snw sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name "
4196cd37da74Snw "FROM name_cache WHERE name = %Q AND domain = %Q AND "
4197cd37da74Snw "(expiration = 0 OR expiration ISNULL OR "
4198cd37da74Snw "expiration > %d);", lower_name, domain, curtime);
4199cd37da74Snw if (lower_name != name)
4200cd37da74Snw free(lower_name);
4201c5c4113dSnw if (sql == NULL) {
4202c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
4203c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
4204c5c4113dSnw goto out;
4205c5c4113dSnw }
4206cd37da74Snw retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values);
420708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
4208c5c4113dSnw sqlite_freemem(sql);
4209c5c4113dSnw
421008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode != IDMAP_SUCCESS)
421108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out;
4212c5c4113dSnw
421308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (type != NULL) {
421408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (values[2] == NULL) {
4215e8c27ec8Sbaban retcode = IDMAP_ERR_CACHE;
4216e8c27ec8Sbaban goto out;
4217e8c27ec8Sbaban }
4218148c5f43SAlan Wright *type = xlate_legacy_type(strtol(values[2], &end, 10));
421908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
4220e8c27ec8Sbaban
422108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (values[0] == NULL || values[1] == NULL) {
422208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_CACHE;
422308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out;
422408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
4225cd37da74Snw
422608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
422708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States assert(values[3] != NULL);
422808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = strdup(values[3]);
422908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canonname == NULL) {
4230c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
4231c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
4232c5c4113dSnw goto out;
4233c5c4113dSnw }
4234c5c4113dSnw }
4235c5c4113dSnw
423608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = strdup(values[0]);
423708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*sidprefix == NULL) {
423808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_ERR, "Out of memory");
423908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_MEMORY;
424008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States goto out;
424108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
424208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *rid = strtoul(values[1], &end, 10);
424308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
424408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_SUCCESS;
424508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
4246c5c4113dSnw out:
424762c60062Sbaban if (vm != NULL)
4248c5c4113dSnw (void) sqlite_finalize(vm, NULL);
424908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States
425008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode != IDMAP_SUCCESS) {
425108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*sidprefix);
425208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *sidprefix = NULL;
425308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canonname != NULL) {
425408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canonname);
425508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canonname = NULL;
425608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
425708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
4258c5c4113dSnw return (retcode);
4259c5c4113dSnw }
4260c5c4113dSnw
4261cd37da74Snw static
4262cd37da74Snw idmap_retcode
ad_lookup_by_winname(lookup_state_t * state,const char * name,const char * domain,int esidtype,char ** dn,char ** attr,char ** value,char ** canonname,char ** sidprefix,idmap_rid_t * rid,idmap_id_type * wintype,char ** unixname)4263e8c27ec8Sbaban ad_lookup_by_winname(lookup_state_t *state,
42649bf5f78fSMatt Barden const char *name, const char *domain, int esidtype,
42659bf5f78fSMatt Barden char **dn, char **attr, char **value, char **canonname,
42669bf5f78fSMatt Barden char **sidprefix, idmap_rid_t *rid, idmap_id_type *wintype,
42679bf5f78fSMatt Barden char **unixname)
4268cd37da74Snw {
42694d61c878SJulian Pullen int retries;
4270c5c4113dSnw idmap_query_state_t *qs = NULL;
4271c5c4113dSnw idmap_retcode rc, retcode;
42724d61c878SJulian Pullen int i;
42734d61c878SJulian Pullen int found_ad = 0;
4274c5c4113dSnw
42752b4a7802SBaban Kenkre RDLOCK_CONFIG();
4276e3f2c991SKeyur Desai if (_idmapdstate.num_gcs > 0) {
4277e3f2c991SKeyur Desai for (i = 0; i < _idmapdstate.num_gcs && !found_ad; i++) {
42784d61c878SJulian Pullen retries = 0;
42794d61c878SJulian Pullen retry:
4280e3f2c991SKeyur Desai retcode = idmap_lookup_batch_start(
4281e3f2c991SKeyur Desai _idmapdstate.gcs[i],
4282e3f2c991SKeyur Desai 1,
4283e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.directory_based_mapping,
4284e3f2c991SKeyur Desai _idmapdstate.cfg->pgcfg.default_domain,
4285e3f2c991SKeyur Desai &qs);
42864d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS) {
42874d61c878SJulian Pullen if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
42884d61c878SJulian Pullen retries++ < ADUTILS_DEF_NUM_RETRIES)
42894d61c878SJulian Pullen goto retry;
42904d61c878SJulian Pullen degrade_svc(1, "failed to create request for "
42914d61c878SJulian Pullen "AD lookup by winname");
4292f4a94a44SGordon Ross UNLOCK_CONFIG();
42934d61c878SJulian Pullen return (retcode);
42944d61c878SJulian Pullen }
4295c5c4113dSnw
42964d61c878SJulian Pullen restore_svc();
4297c5c4113dSnw
42984d61c878SJulian Pullen if (state != NULL && i == 0) {
42994d61c878SJulian Pullen /*
43004d61c878SJulian Pullen * Directory based name mapping is only
43014d61c878SJulian Pullen * performed within the joined forest (i == 0).
43024d61c878SJulian Pullen * We don't trust other "trusted" forests to
43034d61c878SJulian Pullen * provide DS-based name mapping information
43044d61c878SJulian Pullen * because AD's definition of "cross-forest
43054d61c878SJulian Pullen * trust" does not encompass this sort of
43064d61c878SJulian Pullen * behavior.
43074d61c878SJulian Pullen */
43084d61c878SJulian Pullen idmap_lookup_batch_set_unixattr(qs,
43094d61c878SJulian Pullen state->ad_unixuser_attr,
43104d61c878SJulian Pullen state->ad_unixgroup_attr);
43114d61c878SJulian Pullen }
4312c5c4113dSnw
43134d61c878SJulian Pullen retcode = idmap_name2sid_batch_add1(qs, name, domain,
4314148c5f43SAlan Wright esidtype, dn, attr, value, canonname, sidprefix,
4315e3f2c991SKeyur Desai rid, wintype, unixname, NULL, &rc);
43164d61c878SJulian Pullen if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) {
43174d61c878SJulian Pullen idmap_lookup_release_batch(&qs);
43184d61c878SJulian Pullen continue;
43194d61c878SJulian Pullen }
43204d61c878SJulian Pullen found_ad = 1;
43214d61c878SJulian Pullen if (retcode != IDMAP_SUCCESS)
43224d61c878SJulian Pullen idmap_lookup_release_batch(&qs);
43234d61c878SJulian Pullen else
43244d61c878SJulian Pullen retcode = idmap_lookup_batch_end(&qs);
43254d61c878SJulian Pullen
43264d61c878SJulian Pullen if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
43274d61c878SJulian Pullen retries++ < ADUTILS_DEF_NUM_RETRIES)
43284d61c878SJulian Pullen goto retry;
43294d61c878SJulian Pullen else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
43304d61c878SJulian Pullen degrade_svc(1,
43314d61c878SJulian Pullen "some AD lookups timed out repeatedly");
43324d61c878SJulian Pullen }
43334d61c878SJulian Pullen } else {
43344d61c878SJulian Pullen /* No AD case */
43354d61c878SJulian Pullen retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
43364d61c878SJulian Pullen }
43374d61c878SJulian Pullen UNLOCK_CONFIG();
4338c5c4113dSnw
4339c5c4113dSnw if (retcode != IDMAP_SUCCESS) {
43409fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmapdlog(LOG_NOTICE,
43419fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "AD lookup of winname %s@%s failed, error code %d",
43429fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States name == NULL ? "(null)" : name,
43439fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States domain == NULL ? "(null)" : domain,
43449fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States retcode);
4345c5c4113dSnw return (retcode);
4346e8c27ec8Sbaban }
4347e8c27ec8Sbaban return (rc);
4348c5c4113dSnw }
4349c5c4113dSnw
435008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
435108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Given:
435208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * cache sqlite handle to cache
435308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * name Windows user name
435408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * domain Windows domain name
435508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * local_only if true, don't try AD lookups
435608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
435708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * Returns: Error code
435808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
435908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canonname Canonical name (if non-NULL) [1]
436008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *canondomain Canonical domain (if non-NULL) [1]
436108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *sidprefix SID prefix [1]
436208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *rid RID
436308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * *req Request (direction is updated)
436408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *
436508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * [1] malloc'ed, NULL on error
436608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
4367cd37da74Snw idmap_retcode
lookup_name2sid(sqlite * cache,const char * name,const char * domain,int want_wuser,char ** canonname,char ** canondomain,char ** sidprefix,idmap_rid_t * rid,idmap_id_type * type,idmap_mapping * req,int local_only)436808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States lookup_name2sid(
436908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States sqlite *cache,
437008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *name,
437108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States const char *domain,
4372148c5f43SAlan Wright int want_wuser,
437308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canonname,
437408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **canondomain,
437508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char **sidprefix,
437608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_rid_t *rid,
4377148c5f43SAlan Wright idmap_id_type *type,
437808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States idmap_mapping *req,
437908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States int local_only)
4380cd37da74Snw {
4381c5c4113dSnw idmap_retcode retcode;
4382c5c4113dSnw
4383cd37da74Snw *sidprefix = NULL;
4384e8c27ec8Sbaban if (canonname != NULL)
4385e8c27ec8Sbaban *canonname = NULL;
438608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL)
438708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL;
4388cd37da74Snw
4389e8c27ec8Sbaban /* Lookup well-known SIDs table */
439008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = lookup_wksids_name2sid(name, domain, canonname, canondomain,
4391148c5f43SAlan Wright sidprefix, rid, type);
439262c60062Sbaban if (retcode == IDMAP_SUCCESS) {
4393e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
439462c60062Sbaban goto out;
439562c60062Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) {
439662c60062Sbaban return (retcode);
439762c60062Sbaban }
439862c60062Sbaban
4399e8c27ec8Sbaban /* Lookup cache */
4400cd37da74Snw retcode = lookup_cache_name2sid(cache, name, domain, canonname,
4401148c5f43SAlan Wright sidprefix, rid, type);
4402e8c27ec8Sbaban if (retcode == IDMAP_SUCCESS) {
4403e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
4404e8c27ec8Sbaban goto out;
4405e8c27ec8Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) {
4406c5c4113dSnw return (retcode);
4407c5c4113dSnw }
4408c5c4113dSnw
4409479ac375Sdm /*
4410479ac375Sdm * The caller may be using this function to determine if this
4411479ac375Sdm * request needs to be marked for AD lookup or not
4412479ac375Sdm * (i.e. _IDMAP_F_LOOKUP_AD) and therefore may not want this
4413479ac375Sdm * function to AD lookup now.
4414479ac375Sdm */
4415479ac375Sdm if (local_only)
4416479ac375Sdm return (retcode);
4417479ac375Sdm
4418148c5f43SAlan Wright if (_idmapdstate.cfg->pgcfg.use_lsa &&
4419148c5f43SAlan Wright _idmapdstate.cfg->pgcfg.domain_name != NULL &&
4420148c5f43SAlan Wright name != NULL && *sidprefix == NULL) {
4421148c5f43SAlan Wright retcode = lookup_lsa_by_name(name, domain,
4422148c5f43SAlan Wright sidprefix, rid,
4423148c5f43SAlan Wright canonname, canondomain,
4424148c5f43SAlan Wright type);
4425148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS)
4426148c5f43SAlan Wright goto out;
4427148c5f43SAlan Wright else if (retcode != IDMAP_ERR_NOTFOUND)
4428148c5f43SAlan Wright return (retcode);
4429148c5f43SAlan Wright }
4430148c5f43SAlan Wright
4431e8c27ec8Sbaban /* Lookup AD */
4432148c5f43SAlan Wright retcode = ad_lookup_by_winname(NULL, name, domain, IDMAP_POSIXID,
4433148c5f43SAlan Wright NULL, NULL, NULL, canonname, sidprefix, rid, type, NULL);
4434e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS)
4435e8c27ec8Sbaban return (retcode);
4436e8c27ec8Sbaban
443762c60062Sbaban out:
4438c5c4113dSnw /*
4439c5c4113dSnw * Entry found (cache or Windows lookup)
4440c5c4113dSnw */
4441148c5f43SAlan Wright if (want_wuser == 1 && *type != IDMAP_USID)
4442e8c27ec8Sbaban retcode = IDMAP_ERR_NOTUSER;
4443148c5f43SAlan Wright else if (want_wuser == 0 && *type != IDMAP_GSID)
4444e8c27ec8Sbaban retcode = IDMAP_ERR_NOTGROUP;
4445148c5f43SAlan Wright else if (want_wuser == -1) {
4446148c5f43SAlan Wright /*
4447148c5f43SAlan Wright * Caller wants to know if its user or group
4448148c5f43SAlan Wright * Verify that it's one or the other.
4449148c5f43SAlan Wright */
4450148c5f43SAlan Wright if (*type != IDMAP_USID && *type != IDMAP_GSID)
4451e8c27ec8Sbaban retcode = IDMAP_ERR_SID;
4452c5c4113dSnw }
4453c5c4113dSnw
445408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (retcode == IDMAP_SUCCESS) {
445508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /*
445608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * If we were asked for a canonical domain and none
445708f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * of the searches have provided one, assume it's the
445808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States * supplied domain.
445908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States */
446008f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL && *canondomain == NULL) {
446108f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = strdup(domain);
446208f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (*canondomain == NULL)
446308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States retcode = IDMAP_ERR_MEMORY;
446408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
446508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
4466e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
4467e8c27ec8Sbaban free(*sidprefix);
4468e8c27ec8Sbaban *sidprefix = NULL;
4469e8c27ec8Sbaban if (canonname != NULL) {
4470e8c27ec8Sbaban free(*canonname);
4471e8c27ec8Sbaban *canonname = NULL;
4472e8c27ec8Sbaban }
447308f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States if (canondomain != NULL) {
447408f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States free(*canondomain);
447508f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States *canondomain = NULL;
447608f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States }
4477e8c27ec8Sbaban }
4478c5c4113dSnw return (retcode);
4479c5c4113dSnw }
4480c5c4113dSnw
4481cd37da74Snw static
4482cd37da74Snw idmap_retcode
name_based_mapping_pid2sid(lookup_state_t * state,const char * unixname,int is_user,idmap_mapping * req,idmap_id_res * res)4483479ac375Sdm name_based_mapping_pid2sid(lookup_state_t *state, const char *unixname,
44849bf5f78fSMatt Barden int is_user, idmap_mapping *req, idmap_id_res *res)
4485cd37da74Snw {
4486c5c4113dSnw const char *winname, *windomain;
4487cd37da74Snw char *canonname;
448808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States char *canondomain;
4489c5c4113dSnw char *sql = NULL, *errmsg = NULL;
4490c5c4113dSnw idmap_retcode retcode;
4491c5c4113dSnw char *end;
4492c5c4113dSnw const char **values;
4493c5c4113dSnw sqlite_vm *vm = NULL;
449448258c6bSjp int ncol, r;
4495148c5f43SAlan Wright int want_wuser;
4496c5c4113dSnw const char *me = "name_based_mapping_pid2sid";
449748258c6bSjp idmap_namerule *rule = &res->info.how.idmap_how_u.rule;
449848258c6bSjp int direction;
4499e8c27ec8Sbaban
4500e8c27ec8Sbaban assert(unixname != NULL); /* We have unixname */
4501e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have winname */
4502e8c27ec8Sbaban assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */
4503c5c4113dSnw
4504c5c4113dSnw sql = sqlite_mprintf(
450548258c6bSjp "SELECT winname_display, windomain, w2u_order, "
450648258c6bSjp "is_wuser, unixname, is_nt4 "
450748258c6bSjp "FROM namerules WHERE "
4508cd37da74Snw "u2w_order > 0 AND is_user = %d AND "
4509cd37da74Snw "(unixname = %Q OR unixname = '*') "
4510cd37da74Snw "ORDER BY u2w_order ASC;", is_user, unixname);
4511c5c4113dSnw if (sql == NULL) {
4512c5c4113dSnw idmapdlog(LOG_ERR, "Out of memory");
4513c5c4113dSnw retcode = IDMAP_ERR_MEMORY;
4514c5c4113dSnw goto out;
4515c5c4113dSnw }
4516c5c4113dSnw
4517479ac375Sdm if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
4518c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
4519cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me,
4520cd37da74Snw CHECK_NULL(errmsg));
4521c5c4113dSnw sqlite_freemem(errmsg);
4522c5c4113dSnw goto out;
4523c5c4113dSnw }
4524c5c4113dSnw
452548258c6bSjp for (;;) {
4526c5c4113dSnw r = sqlite_step(vm, &ncol, &values, NULL);
452784decf41Sjp assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
452884decf41Sjp if (r == SQLITE_ROW) {
452948258c6bSjp if (ncol < 6) {
4530c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
4531c5c4113dSnw goto out;
4532c5c4113dSnw }
4533148c5f43SAlan Wright
4534148c5f43SAlan Wright TRACE(req, res, "Matching rule: %s -> %s@%s",
4535148c5f43SAlan Wright values[4] == NULL ? "(null)" : values[4],
4536148c5f43SAlan Wright values[0] == NULL ? "(null)" : values[0],
4537148c5f43SAlan Wright values[1] == NULL ? "(null)" : values[1]);
4538148c5f43SAlan Wright
4539c5c4113dSnw if (values[0] == NULL) {
4540c5c4113dSnw /* values [1] and [2] can be null */
4541c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
4542c5c4113dSnw goto out;
4543c5c4113dSnw }
454448258c6bSjp
454548258c6bSjp if (values[2] != NULL)
454648258c6bSjp direction =
454748258c6bSjp (strtol(values[2], &end, 10) == 0)?
454848258c6bSjp IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
454948258c6bSjp else
455048258c6bSjp direction = IDMAP_DIRECTION_U2W;
455148258c6bSjp
4552c5c4113dSnw if (EMPTY_NAME(values[0])) {
455348258c6bSjp idmap_namerule_set(rule, values[1], values[0],
455448258c6bSjp values[4], is_user,
455548258c6bSjp strtol(values[3], &end, 10),
455648258c6bSjp strtol(values[5], &end, 10),
455748258c6bSjp direction);
4558148c5f43SAlan Wright TRACE(req, res, "Mapping inhibited");
4559c5c4113dSnw retcode = IDMAP_ERR_NOMAPPING;
4560c5c4113dSnw goto out;
4561c5c4113dSnw }
4562cd37da74Snw
4563cd37da74Snw if (values[0][0] == '*') {
456448258c6bSjp winname = unixname;
4565cd37da74Snw } else {
4566cd37da74Snw winname = values[0];
4567cd37da74Snw }
4568cb174861Sjoyce mcintosh
4569148c5f43SAlan Wright want_wuser = res->id.idtype == IDMAP_USID ? 1
457048258c6bSjp : res->id.idtype == IDMAP_GSID ? 0
457148258c6bSjp : -1;
457262c60062Sbaban if (values[1] != NULL)
4573c5c4113dSnw windomain = values[1];
4574148c5f43SAlan Wright else if (state->defdom != NULL) {
4575479ac375Sdm windomain = state->defdom;
4576148c5f43SAlan Wright TRACE(req, res,
4577148c5f43SAlan Wright "Added default domain %s to rule",
4578148c5f43SAlan Wright windomain);
4579148c5f43SAlan Wright } else {
4580cd37da74Snw idmapdlog(LOG_ERR, "%s: no domain", me);
4581148c5f43SAlan Wright TRACE(req, res,
4582148c5f43SAlan Wright "No domain in rule, and no default domain");
4583c5c4113dSnw retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
4584c5c4113dSnw goto out;
4585c5c4113dSnw }
4586cd37da74Snw
4587479ac375Sdm retcode = lookup_name2sid(state->cache,
4588479ac375Sdm winname, windomain,
4589148c5f43SAlan Wright want_wuser, &canonname, &canondomain,
4590cd37da74Snw &res->id.idmap_id_u.sid.prefix,
4591148c5f43SAlan Wright &res->id.idmap_id_u.sid.rid,
4592148c5f43SAlan Wright &res->id.idtype, req, 0);
4593e8c27ec8Sbaban
4594148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
4595148c5f43SAlan Wright break;
4596148c5f43SAlan Wright } else if (retcode == IDMAP_ERR_NOTFOUND) {
4597cb174861Sjoyce mcintosh if (values[0][0] == '*') {
4598cb174861Sjoyce mcintosh TRACE(req, res,
4599cb174861Sjoyce mcintosh "%s@%s not found, continuing",
4600cb174861Sjoyce mcintosh winname, windomain);
4601cb174861Sjoyce mcintosh continue;
4602cb174861Sjoyce mcintosh } else {
4603cb174861Sjoyce mcintosh TRACE(req, res,
4604cb174861Sjoyce mcintosh "%s@%s not found",
4605cb174861Sjoyce mcintosh winname, windomain);
4606cb174861Sjoyce mcintosh retcode = IDMAP_ERR_NOMAPPING;
4607cb174861Sjoyce mcintosh }
4608148c5f43SAlan Wright } else {
4609148c5f43SAlan Wright TRACE(req, res,
4610148c5f43SAlan Wright "Looking up %s@%s error=%d",
4611148c5f43SAlan Wright winname, windomain, retcode);
4612c5c4113dSnw }
4613148c5f43SAlan Wright
4614cb174861Sjoyce mcintosh idmap_namerule_set(rule, values[1],
4615cb174861Sjoyce mcintosh values[0], values[4], is_user,
4616cb174861Sjoyce mcintosh strtol(values[3], &end, 10),
4617cb174861Sjoyce mcintosh strtol(values[5], &end, 10),
4618cb174861Sjoyce mcintosh direction);
4619cb174861Sjoyce mcintosh
4620c5c4113dSnw goto out;
462148258c6bSjp
4622c5c4113dSnw } else if (r == SQLITE_DONE) {
4623cb174861Sjoyce mcintosh TRACE(req, res, "No matching rule");
4624cb174861Sjoyce mcintosh retcode = IDMAP_ERR_NOTFOUND;
4625c5c4113dSnw goto out;
4626c5c4113dSnw } else {
4627c5c4113dSnw (void) sqlite_finalize(vm, &errmsg);
4628c5c4113dSnw vm = NULL;
4629cd37da74Snw idmapdlog(LOG_ERR, "%s: database error (%s)", me,
4630cd37da74Snw CHECK_NULL(errmsg));
4631c5c4113dSnw sqlite_freemem(errmsg);
4632c5c4113dSnw retcode = IDMAP_ERR_INTERNAL;
4633c5c4113dSnw goto out;
4634c5c4113dSnw }
4635c5c4113dSnw }
4636c5c4113dSnw
4637148c5f43SAlan Wright if (values[2] != NULL)
4638148c5f43SAlan Wright res->direction =
4639148c5f43SAlan Wright (strtol(values[2], &end, 10) == 0)?
4640148c5f43SAlan Wright IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
4641148c5f43SAlan Wright else
4642148c5f43SAlan Wright res->direction = IDMAP_DIRECTION_U2W;
4643cd37da74Snw
4644148c5f43SAlan Wright req->id2name = canonname;
4645148c5f43SAlan Wright req->id2domain = canondomain;
46468e228215Sdm
4647148c5f43SAlan Wright idmap_namerule_set(rule, values[1], values[0], values[4],
4648148c5f43SAlan Wright is_user, strtol(values[3], &end, 10),
4649148c5f43SAlan Wright strtol(values[5], &end, 10),
4650148c5f43SAlan Wright rule->direction);
4651148c5f43SAlan Wright TRACE(req, res, "Windows name found");
4652479ac375Sdm
4653148c5f43SAlan Wright out:
4654148c5f43SAlan Wright if (sql != NULL)
4655148c5f43SAlan Wright sqlite_freemem(sql);
4656fc724630SAlan Wright
4657fc724630SAlan Wright if (retcode != IDMAP_ERR_NOTFOUND) {
4658fc724630SAlan Wright res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED;
465948258c6bSjp res->info.src = IDMAP_MAP_SRC_NEW;
4660c5c4113dSnw }
4661fc724630SAlan Wright
466262c60062Sbaban if (vm != NULL)
4663c5c4113dSnw (void) sqlite_finalize(vm, NULL);
4664c5c4113dSnw return (retcode);
4665c5c4113dSnw }
4666c5c4113dSnw
4667cd37da74Snw /*
4668cd37da74Snw * Convention when processing unix2win requests:
4669cd37da74Snw *
4670cd37da74Snw * Unix identity:
4671cd37da74Snw * req->id1name =
4672cd37da74Snw * unixname if given otherwise unixname found will be placed
4673cd37da74Snw * here.
4674cd37da74Snw * req->id1domain =
4675cd37da74Snw * NOT USED
4676cd37da74Snw * req->id1.idtype =
4677cd37da74Snw * Given type (IDMAP_UID or IDMAP_GID)
4678cd37da74Snw * req->id1..[uid or gid] =
4679cd37da74Snw * UID/GID if given otherwise UID/GID found will be placed here.
4680cd37da74Snw *
4681cd37da74Snw * Windows identity:
4682cd37da74Snw * req->id2name =
4683cd37da74Snw * winname found will be placed here.
4684cd37da74Snw * req->id2domain =
4685cd37da74Snw * windomain found will be placed here.
4686cd37da74Snw * res->id.idtype =
4687cd37da74Snw * Target type initialized from req->id2.idtype. If
4688cd37da74Snw * it is IDMAP_SID then actual type (IDMAP_USID/GSID) found
4689cd37da74Snw * will be placed here.
4690cd37da74Snw * req->id..sid.[prefix, rid] =
4691cd37da74Snw * SID found will be placed here.
4692cd37da74Snw *
4693cd37da74Snw * Others:
4694cd37da74Snw * res->retcode =
4695cd37da74Snw * Return status for this request will be placed here.
4696cd37da74Snw * res->direction =
4697cd37da74Snw * Direction found will be placed here. Direction
4698cd37da74Snw * meaning whether the resultant mapping is valid
4699cd37da74Snw * only from unix2win or bi-directional.
4700cd37da74Snw * req->direction =
4701cd37da74Snw * INTERNAL USE. Used by idmapd to set various
4702cd37da74Snw * flags (_IDMAP_F_xxxx) to aid in processing
4703cd37da74Snw * of the request.
4704cd37da74Snw * req->id2.idtype =
4705cd37da74Snw * INTERNAL USE. Initially this is the requested target
4706cd37da74Snw * type and is used to initialize res->id.idtype.
4707cd37da74Snw * ad_lookup_batch() uses this field temporarily to store
4708cd37da74Snw * sid_type obtained by the batched AD lookups and after
4709cd37da74Snw * use resets it to IDMAP_NONE to prevent xdr from
4710cd37da74Snw * mis-interpreting the contents of req->id2.
4711cd37da74Snw * req->id2..[uid or gid or sid] =
4712cd37da74Snw * NOT USED
4713cd37da74Snw */
4714cd37da74Snw
4715cd37da74Snw /*
4716cd37da74Snw * This function does the following:
4717cd37da74Snw * 1. Lookup well-known SIDs table.
4718cd37da74Snw * 2. Lookup cache.
4719cd37da74Snw * 3. Check if the client does not want new mapping to be allocated
4720cd37da74Snw * in which case this pass is the final pass.
4721e8c27ec8Sbaban * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs
4722e8c27ec8Sbaban * to do AD/NLDAP lookup.
4723cd37da74Snw */
4724c5c4113dSnw idmap_retcode
pid2sid_first_pass(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res,int is_user)4725479ac375Sdm pid2sid_first_pass(lookup_state_t *state, idmap_mapping *req,
47269bf5f78fSMatt Barden idmap_id_res *res, int is_user)
4727cd37da74Snw {
4728e8c27ec8Sbaban idmap_retcode retcode;
4729148c5f43SAlan Wright idmap_retcode retcode2;
4730e8c27ec8Sbaban bool_t gen_localsid_on_err = FALSE;
4731c5c4113dSnw
4732e8c27ec8Sbaban /* Initialize result */
4733c5c4113dSnw res->id.idtype = req->id2.idtype;
4734e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF;
4735e8c27ec8Sbaban
4736e8c27ec8Sbaban if (req->id2.idmap_id_u.sid.prefix != NULL) {
4737e8c27ec8Sbaban /* sanitize sidprefix */
4738e8c27ec8Sbaban free(req->id2.idmap_id_u.sid.prefix);
4739e8c27ec8Sbaban req->id2.idmap_id_u.sid.prefix = NULL;
4740e8c27ec8Sbaban }
4741c5c4113dSnw
474248258c6bSjp /* Find pid */
47439fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (req->id1.idmap_id_u.uid == IDMAP_SENTINEL_PID) {
4744fe1c642dSBill Krier if (req->id1name == NULL) {
4745fe1c642dSBill Krier retcode = IDMAP_ERR_ARG;
4746fe1c642dSBill Krier goto out;
4747fe1c642dSBill Krier }
4748fe1c642dSBill Krier
4749148c5f43SAlan Wright retcode = ns_lookup_byname(req->id1name, NULL, &req->id1);
4750148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) {
4751148c5f43SAlan Wright TRACE(req, res, "Getting UNIX ID error=%d", retcode);
475248258c6bSjp retcode = IDMAP_ERR_NOMAPPING;
475348258c6bSjp goto out;
475448258c6bSjp }
4755148c5f43SAlan Wright TRACE(req, res, "Found UNIX ID");
475648258c6bSjp }
475748258c6bSjp
475808f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup in well-known SIDs table */
4759c5c4113dSnw retcode = lookup_wksids_pid2sid(req, res, is_user);
4760148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
4761148c5f43SAlan Wright TRACE(req, res, "Hardwired mapping");
4762148c5f43SAlan Wright goto out;
4763148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
4764148c5f43SAlan Wright TRACE(req, res,
4765148c5f43SAlan Wright "Well-known account lookup error=%d", retcode);
4766c5c4113dSnw goto out;
4767148c5f43SAlan Wright }
4768c5c4113dSnw
476908f0d8daSafshin salek ardakani - Sun Microsystems - Irvine United States /* Lookup in cache */
4770fe1c642dSBill Krier retcode = lookup_cache_pid2sid(state->cache, req, res, is_user);
4771148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
4772148c5f43SAlan Wright TRACE(req, res, "Found in mapping cache");
4773148c5f43SAlan Wright goto out;
4774148c5f43SAlan Wright } else if (retcode != IDMAP_ERR_NOTFOUND) {
4775148c5f43SAlan Wright TRACE(req, res,
4776148c5f43SAlan Wright "Mapping cache lookup error=%d", retcode);
4777c5c4113dSnw goto out;
4778148c5f43SAlan Wright }
4779148c5f43SAlan Wright TRACE(req, res, "Not found in mapping cache");
4780c5c4113dSnw
4781c5c4113dSnw /* Ephemeral ids cannot be allocated during pid2sid */
47829fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (IDMAP_ID_IS_EPHEMERAL(req->id1.idmap_id_u.uid)) {
478362c60062Sbaban retcode = IDMAP_ERR_NOMAPPING;
4784148c5f43SAlan Wright TRACE(req, res, "Shouldn't have an ephemeral ID here");
4785c5c4113dSnw goto out;
4786c5c4113dSnw }
4787c5c4113dSnw
478848258c6bSjp if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) {
47894d61c878SJulian Pullen retcode = IDMAP_ERR_NONE_GENERATED;
479048258c6bSjp goto out;
479148258c6bSjp }
479248258c6bSjp
479348258c6bSjp if (AVOID_NAMESERVICE(req)) {
4794e8c27ec8Sbaban gen_localsid_on_err = TRUE;
479562c60062Sbaban retcode = IDMAP_ERR_NOMAPPING;
4796c5c4113dSnw goto out;
4797c5c4113dSnw }
4798c5c4113dSnw
4799e8c27ec8Sbaban /* Set flags for the next stage */
4800e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU) {
4801e3f2c991SKeyur Desai req->direction |= _IDMAP_F_LOOKUP_AD;
4802e3f2c991SKeyur Desai state->ad_nqueries++;
4803e3f2c991SKeyur Desai } else if (AD_MODE(req->id1.idtype, state)) {
4804e8c27ec8Sbaban /*
4805e8c27ec8Sbaban * If AD-based name mapping is enabled then the next stage
4806e8c27ec8Sbaban * will need to lookup AD using unixname to get the
4807e8c27ec8Sbaban * corresponding winname.
4808e8c27ec8Sbaban */
4809e8c27ec8Sbaban if (req->id1name == NULL) {
4810e8c27ec8Sbaban /* Get unixname if only pid is given. */
4811e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid,
4812e8c27ec8Sbaban is_user, &req->id1name);
4813479ac375Sdm if (retcode != IDMAP_SUCCESS) {
4814148c5f43SAlan Wright TRACE(req, res,
4815148c5f43SAlan Wright "Getting UNIX name error=%d", retcode);
4816479ac375Sdm gen_localsid_on_err = TRUE;
4817e8c27ec8Sbaban goto out;
4818479ac375Sdm }
4819148c5f43SAlan Wright TRACE(req, res, "Found UNIX name");
4820c5c4113dSnw }
4821e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD;
4822e8c27ec8Sbaban state->ad_nqueries++;
4823e8c27ec8Sbaban } else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) {
4824e8c27ec8Sbaban /*
4825e8c27ec8Sbaban * If native LDAP or mixed mode is enabled for name mapping
4826e8c27ec8Sbaban * then the next stage will need to lookup native LDAP using
4827e8c27ec8Sbaban * unixname/pid to get the corresponding winname.
4828e8c27ec8Sbaban */
4829e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_NLDAP;
4830e8c27ec8Sbaban state->nldap_nqueries++;
4831c5c4113dSnw }
4832c5c4113dSnw
4833e8c27ec8Sbaban /*
4834e8c27ec8Sbaban * Failed to find non-expired entry in cache. Set the flag to
4835e8c27ec8Sbaban * indicate that we are not done yet.
4836e8c27ec8Sbaban */
4837e8c27ec8Sbaban state->pid2sid_done = FALSE;
4838e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE;
4839e8c27ec8Sbaban retcode = IDMAP_SUCCESS;
4840e8c27ec8Sbaban
4841e8c27ec8Sbaban out:
4842e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode);
4843148c5f43SAlan Wright if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) {
4844148c5f43SAlan Wright if (gen_localsid_on_err == TRUE) {
4845148c5f43SAlan Wright retcode2 = generate_localsid(req, res, is_user, TRUE);
4846148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS)
4847148c5f43SAlan Wright TRACE(req, res, "Generate local SID");
4848148c5f43SAlan Wright else
4849148c5f43SAlan Wright TRACE(req, res,
4850148c5f43SAlan Wright "Generate local SID error=%d", retcode2);
4851148c5f43SAlan Wright }
4852148c5f43SAlan Wright }
4853e8c27ec8Sbaban return (retcode);
4854e8c27ec8Sbaban }
4855e8c27ec8Sbaban
4856e8c27ec8Sbaban idmap_retcode
pid2sid_second_pass(lookup_state_t * state,idmap_mapping * req,idmap_id_res * res,int is_user)4857479ac375Sdm pid2sid_second_pass(lookup_state_t *state, idmap_mapping *req,
48589bf5f78fSMatt Barden idmap_id_res *res, int is_user)
4859e8c27ec8Sbaban {
4860e8c27ec8Sbaban bool_t gen_localsid_on_err = TRUE;
4861e8c27ec8Sbaban idmap_retcode retcode = IDMAP_SUCCESS;
4862148c5f43SAlan Wright idmap_retcode retcode2;
4863e8c27ec8Sbaban
4864e8c27ec8Sbaban /* Check if second pass is needed */
4865e8c27ec8Sbaban if (ARE_WE_DONE(req->direction))
4866e8c27ec8Sbaban return (res->retcode);
4867e8c27ec8Sbaban
4868e8c27ec8Sbaban /* Get status from previous pass */
4869e8c27ec8Sbaban retcode = res->retcode;
4870e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS)
4871c5c4113dSnw goto out;
4872c5c4113dSnw
4873c5c4113dSnw /*
4874e8c27ec8Sbaban * If directory-based name mapping is enabled then the winname
4875e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode)
4876479ac375Sdm * or from native LDAP object (nldap-mode or mixed-mode).
4877479ac375Sdm * Note that if we have winname but no SID then it's an error
4878479ac375Sdm * because this implies that the Native LDAP entry contains
4879479ac375Sdm * winname which does not exist and it's better that we return
4880479ac375Sdm * an error instead of doing rule-based mapping so that the user
4881479ac375Sdm * can detect the issue and take appropriate action.
4882c5c4113dSnw */
4883479ac375Sdm if (req->id2name != NULL) {
4884479ac375Sdm /* Return notfound if we've winname but no SID. */
4885479ac375Sdm if (res->id.idmap_id_u.sid.prefix == NULL) {
4886148c5f43SAlan Wright TRACE(req, res, "Windows name but no SID");
4887479ac375Sdm retcode = IDMAP_ERR_NOTFOUND;
4888479ac375Sdm goto out;
4889479ac375Sdm }
4890e3f2c991SKeyur Desai if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU)
4891e3f2c991SKeyur Desai res->direction = IDMAP_DIRECTION_BI;
4892e3f2c991SKeyur Desai else if (AD_MODE(req->id1.idtype, state))
4893e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
4894e8c27ec8Sbaban else if (NLDAP_MODE(req->id1.idtype, state))
4895e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI;
4896e8c27ec8Sbaban else if (MIXED_MODE(req->id1.idtype, state))
4897e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U;
4898e8c27ec8Sbaban goto out;
4899479ac375Sdm } else if (res->id.idmap_id_u.sid.prefix != NULL) {
4900479ac375Sdm /*
4901479ac375Sdm * We've SID but no winname. This is fine because
4902479ac375Sdm * the caller may have only requested SID.
4903479ac375Sdm */
4904479ac375Sdm goto out;
4905e8c27ec8Sbaban }
4906e8c27ec8Sbaban
4907479ac375Sdm /* Free any mapping info from Directory based mapping */
4908479ac375Sdm if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN)
4909148c5f43SAlan Wright idmap_how_clear(&res->info.how);
4910479ac375Sdm
4911e8c27ec8Sbaban if (req->id1name == NULL) {
4912e8c27ec8Sbaban /* Get unixname from name service */
4913e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user,
4914e8c27ec8Sbaban &req->id1name);
4915148c5f43SAlan Wright if (retcode != IDMAP_SUCCESS) {
4916148c5f43SAlan Wright TRACE(req, res,
4917148c5f43SAlan Wright "Getting UNIX name error=%d", retcode);
4918e8c27ec8Sbaban goto out;
4919148c5f43SAlan Wright }
4920148c5f43SAlan Wright TRACE(req, res, "Found UNIX name");
49219fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } else if (req->id1.idmap_id_u.uid == IDMAP_SENTINEL_PID) {
4922e8c27ec8Sbaban /* Get pid from name service */
4923e8c27ec8Sbaban retcode = ns_lookup_byname(req->id1name, NULL, &req->id1);
4924e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) {
4925148c5f43SAlan Wright TRACE(req, res,
4926148c5f43SAlan Wright "Getting UNIX ID error=%d", retcode);
4927e8c27ec8Sbaban gen_localsid_on_err = FALSE;
4928e8c27ec8Sbaban goto out;
4929e8c27ec8Sbaban }
4930148c5f43SAlan Wright TRACE(req, res, "Found UNIX ID");
4931e8c27ec8Sbaban }
4932e8c27ec8Sbaban
4933e8c27ec8Sbaban /* Use unixname to evaluate local name-based mapping rules */
4934479ac375Sdm retcode = name_based_mapping_pid2sid(state, req->id1name, is_user,
4935e8c27ec8Sbaban req, res);
4936e8c27ec8Sbaban if (retcode == IDMAP_ERR_NOTFOUND) {
493748258c6bSjp retcode = generate_localsid(req, res, is_user, FALSE);
4938148c5f43SAlan Wright if (retcode == IDMAP_SUCCESS) {
4939148c5f43SAlan Wright TRACE(req, res, "Generated local SID");
4940148c5f43SAlan Wright } else {
4941148c5f43SAlan Wright TRACE(req, res,
4942148c5f43SAlan Wright "Generating local SID error=%d", retcode);
4943148c5f43SAlan Wright }
4944e8c27ec8Sbaban gen_localsid_on_err = FALSE;
4945e8c27ec8Sbaban }
4946c5c4113dSnw
4947c5c4113dSnw out:
4948e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode);
4949e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) {
4950e8c27ec8Sbaban req->direction = _IDMAP_F_DONE;
4951479ac375Sdm free(req->id2name);
4952479ac375Sdm req->id2name = NULL;
4953479ac375Sdm free(req->id2domain);
4954479ac375Sdm req->id2domain = NULL;
4955148c5f43SAlan Wright if (gen_localsid_on_err == TRUE) {
4956148c5f43SAlan Wright retcode2 = generate_localsid(req, res, is_user, TRUE);
4957148c5f43SAlan Wright if (retcode2 == IDMAP_SUCCESS)
4958148c5f43SAlan Wright TRACE(req, res, "Generate local SID");
4959148c5f43SAlan Wright else
4960148c5f43SAlan Wright TRACE(req, res,
4961148c5f43SAlan Wright "Generate local SID error=%d", retcode2);
4962148c5f43SAlan Wright } else {
4963479ac375Sdm res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
4964148c5f43SAlan Wright }
4965c5c4113dSnw }
4966e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction))
4967c5c4113dSnw state->pid2sid_done = FALSE;
4968c5c4113dSnw return (retcode);
4969c5c4113dSnw }
49709fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49719fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode
idmap_cache_flush(idmap_flush_op op)49729fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_cache_flush(idmap_flush_op op)
49739fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States {
49749fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States idmap_retcode rc;
49759fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sqlite *cache = NULL;
49769fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States char *sql1;
49779fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States char *sql2;
49789fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49799fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States switch (op) {
49809fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_FLUSH_EXPIRE:
49819fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql1 =
49829fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "UPDATE idmap_cache SET expiration=1 WHERE expiration>0;";
49839fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql2 =
49849fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States "UPDATE name_cache SET expiration=1 WHERE expiration>0;";
49859fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States break;
49869fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49879fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States case IDMAP_FLUSH_DELETE:
49889fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql1 = "DELETE FROM idmap_cache;";
49899fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States sql2 = "DELETE FROM name_cache;";
49909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States break;
49919fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States default:
49939fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (IDMAP_ERR_INTERNAL);
49949fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States }
49959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
49969fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = get_cache_handle(&cache);
49979fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if (rc != IDMAP_SUCCESS)
49989fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc);
49999fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
50009fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States /*
50019fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * Note that we flush the idmapd cache first, before the kernel
50029fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * cache. If we did it the other way 'round, a request could come
50039fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * in after the kernel cache flush and pull a soon-to-be-flushed
50049fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * idmapd cache entry back into the kernel cache. This way the
50059fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * worst that will happen is that a new entry will be added to
50069fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States * the kernel cache and then immediately flushed.
50079fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States */
50089fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
50099fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States rc = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql1);
5010*e3d9e7f3SGordon Ross if (rc == IDMAP_SUCCESS)
5011*e3d9e7f3SGordon Ross rc = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql2);
5012*e3d9e7f3SGordon Ross if (rc == IDMAP_SUCCESS)
5013*e3d9e7f3SGordon Ross (void) __idmap_flush_kcache();
50149fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
5015*e3d9e7f3SGordon Ross if (rc == IDMAP_ERR_DB)
5016*e3d9e7f3SGordon Ross kill_cache_handle(cache);
50179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States
50189fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States return (rc);
50199fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States }
5020