xref: /illumos-gate/usr/src/cmd/idmap/idmapd/dbutils.c (revision 95efa359b507db290a2484b8f615822b1e06096f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * Database related utility routines
28  */
29 
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <errno.h>
34 #include <sys/types.h>
35 #include <sys/stat.h>
36 #include <rpc/rpc.h>
37 #include <sys/sid.h>
38 #include <time.h>
39 #include <pwd.h>
40 #include <grp.h>
41 #include <pthread.h>
42 #include <assert.h>
43 #include <sys/u8_textprep.h>
44 
45 #include "idmapd.h"
46 #include "adutils.h"
47 #include "string.h"
48 #include "idmap_priv.h"
49 #include "schema.h"
50 #include "nldaputils.h"
51 
52 
53 static idmap_retcode sql_compile_n_step_once(sqlite *, char *,
54 		sqlite_vm **, int *, int, const char ***);
55 static idmap_retcode ad_lookup_one(lookup_state_t *, idmap_mapping *,
56 		idmap_id_res *);
57 static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *);
58 static idmap_retcode lookup_cache_name2sid(sqlite *, const char *,
59 		const char *, char **, char **, idmap_rid_t *, int *);
60 
61 
62 #define	EMPTY_NAME(name)	(*name == 0 || strcmp(name, "\"\"") == 0)
63 
64 #define	DO_NOT_ALLOC_NEW_ID_MAPPING(req)\
65 		(req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC)
66 
67 #define	AVOID_NAMESERVICE(req)\
68 		(req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE)
69 
70 #define	ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)\
71 		(req->flag & IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY)
72 
73 #define	IS_EPHEMERAL(pid)	(pid > INT32_MAX && pid != SENTINEL_PID)
74 
75 #define	LOCALRID_MIN	1000
76 
77 
78 typedef enum init_db_option {
79 	FAIL_IF_CORRUPT = 0,
80 	REMOVE_IF_CORRUPT = 1
81 } init_db_option_t;
82 
83 /*
84  * Data structure to store well-known SIDs and
85  * associated mappings (if any)
86  */
87 typedef struct wksids_table {
88 	const char	*sidprefix;
89 	uint32_t	rid;
90 	const char	*winname;
91 	int		is_wuser;
92 	uid_t		pid;
93 	int		is_user;
94 	int		direction;
95 } wksids_table_t;
96 
97 /*
98  * Thread specfic data to hold the database handles so that the
99  * databaes are not opened and closed for every request. It also
100  * contains the sqlite busy handler structure.
101  */
102 
103 struct idmap_busy {
104 	const char *name;
105 	const int *delays;
106 	int delay_size;
107 	int total;
108 	int sec;
109 };
110 
111 
112 typedef struct idmap_tsd {
113 	sqlite *db_db;
114 	sqlite *cache_db;
115 	struct idmap_busy cache_busy;
116 	struct idmap_busy db_busy;
117 } idmap_tsd_t;
118 
119 
120 
121 static const int cache_delay_table[] =
122 		{ 1, 2, 5, 10, 15, 20, 25, 30,  35,  40,
123 		50,  50, 60, 70, 80, 90, 100};
124 
125 static const int db_delay_table[] =
126 		{ 5, 10, 15, 20, 30,  40,  55,  70, 100};
127 
128 
129 static pthread_key_t	idmap_tsd_key;
130 
131 void
132 idmap_tsd_destroy(void *key)
133 {
134 
135 	idmap_tsd_t	*tsd = (idmap_tsd_t *)key;
136 	if (tsd) {
137 		if (tsd->db_db)
138 			(void) sqlite_close(tsd->db_db);
139 		if (tsd->cache_db)
140 			(void) sqlite_close(tsd->cache_db);
141 		free(tsd);
142 	}
143 }
144 
145 int
146 idmap_init_tsd_key(void)
147 {
148 	return (pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy));
149 }
150 
151 
152 
153 idmap_tsd_t *
154 idmap_get_tsd(void)
155 {
156 	idmap_tsd_t	*tsd;
157 
158 	if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) {
159 		/* No thread specific data so create it */
160 		if ((tsd = malloc(sizeof (*tsd))) != NULL) {
161 			/* Initialize thread specific data */
162 			(void) memset(tsd, 0, sizeof (*tsd));
163 			/* save the trhread specific data */
164 			if (pthread_setspecific(idmap_tsd_key, tsd) != 0) {
165 				/* Can't store key */
166 				free(tsd);
167 				tsd = NULL;
168 			}
169 		} else {
170 			tsd = NULL;
171 		}
172 	}
173 
174 	return (tsd);
175 }
176 
177 /*
178  * A simple wrapper around u8_textprep_str() that returns the Unicode
179  * lower-case version of some string.  The result must be freed.
180  */
181 char *
182 tolower_u8(const char *s)
183 {
184 	char *res = NULL;
185 	char *outs;
186 	size_t inlen, outlen, inbytesleft, outbytesleft;
187 	int rc, err;
188 
189 	/*
190 	 * u8_textprep_str() does not allocate memory.  The input and
191 	 * output buffers may differ in size (though that would be more
192 	 * likely when normalization is done).  We have to loop over it...
193 	 *
194 	 * To improve the chances that we can avoid looping we add 10
195 	 * bytes of output buffer room the first go around.
196 	 */
197 	inlen = inbytesleft = strlen(s);
198 	outlen = outbytesleft = inlen + 10;
199 	if ((res = malloc(outlen)) == NULL)
200 		return (NULL);
201 	outs = res;
202 
203 	while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs,
204 	    &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 &&
205 	    err == E2BIG) {
206 		if ((res = realloc(res, outlen + inbytesleft)) == NULL)
207 			return (NULL);
208 		/* adjust input/output buffer pointers */
209 		s += (inlen - inbytesleft);
210 		outs = res + outlen - outbytesleft;
211 		/* adjust outbytesleft and outlen */
212 		outlen += inbytesleft;
213 		outbytesleft += inbytesleft;
214 	}
215 
216 	if (rc < 0) {
217 		free(res);
218 		res = NULL;
219 		return (NULL);
220 	}
221 
222 	res[outlen - outbytesleft] = '\0';
223 
224 	return (res);
225 }
226 
227 static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
228 	const char *while_doing);
229 
230 
231 /*
232  * Initialize 'dbname' using 'sql'
233  */
234 static
235 int
236 init_db_instance(const char *dbname, int version,
237 	const char *detect_version_sql, char * const *sql,
238 	init_db_option_t opt, int *created, int *upgraded)
239 {
240 	int rc, curr_version;
241 	int tries = 1;
242 	int prio = LOG_NOTICE;
243 	sqlite *db = NULL;
244 	char *errmsg = NULL;
245 
246 	*created = 0;
247 	*upgraded = 0;
248 
249 	if (opt == REMOVE_IF_CORRUPT)
250 		tries = 3;
251 
252 rinse_repeat:
253 	if (tries == 0) {
254 		idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname);
255 		return (-1);
256 	}
257 	if (tries-- == 1)
258 		/* Last try, log errors */
259 		prio = LOG_ERR;
260 
261 	db = sqlite_open(dbname, 0600, &errmsg);
262 	if (db == NULL) {
263 		idmapdlog(prio, "Error creating database %s (%s)",
264 		    dbname, CHECK_NULL(errmsg));
265 		sqlite_freemem(errmsg);
266 		if (opt == REMOVE_IF_CORRUPT)
267 			(void) unlink(dbname);
268 		goto rinse_repeat;
269 	}
270 
271 	sqlite_busy_timeout(db, 3000);
272 
273 	/* Detect current version of schema in the db, if any */
274 	curr_version = 0;
275 	if (detect_version_sql != NULL) {
276 		char *end, **results;
277 		int nrow;
278 
279 #ifdef	IDMAPD_DEBUG
280 		(void) fprintf(stderr, "Schema version detection SQL: %s\n",
281 		    detect_version_sql);
282 #endif	/* IDMAPD_DEBUG */
283 		rc = sqlite_get_table(db, detect_version_sql, &results,
284 		    &nrow, NULL, &errmsg);
285 		if (rc != SQLITE_OK) {
286 			idmapdlog(prio,
287 			    "Error detecting schema version of db %s (%s)",
288 			    dbname, errmsg);
289 			sqlite_freemem(errmsg);
290 			sqlite_free_table(results);
291 			sqlite_close(db);
292 			return (-1);
293 		}
294 		if (nrow != 1) {
295 			idmapdlog(prio,
296 			    "Error detecting schema version of db %s", dbname);
297 			sqlite_close(db);
298 			sqlite_free_table(results);
299 			return (-1);
300 		}
301 		curr_version = strtol(results[1], &end, 10);
302 		sqlite_free_table(results);
303 	}
304 
305 	if (curr_version < 0) {
306 		if (opt == REMOVE_IF_CORRUPT)
307 			(void) unlink(dbname);
308 		goto rinse_repeat;
309 	}
310 
311 	if (curr_version == version)
312 		goto done;
313 
314 	/* Install or upgrade schema */
315 #ifdef	IDMAPD_DEBUG
316 	(void) fprintf(stderr, "Schema init/upgrade SQL: %s\n",
317 	    sql[curr_version]);
318 #endif	/* IDMAPD_DEBUG */
319 	rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname,
320 	    (curr_version == 0) ? "installing schema" : "upgrading schema");
321 	if (rc != 0) {
322 		idmapdlog(prio, "Error %s schema for db %s", dbname,
323 		    (curr_version == 0) ? "installing schema" :
324 		    "upgrading schema");
325 		if (opt == REMOVE_IF_CORRUPT)
326 			(void) unlink(dbname);
327 		goto rinse_repeat;
328 	}
329 
330 	*upgraded = (curr_version > 0);
331 	*created = (curr_version == 0);
332 
333 done:
334 	(void) sqlite_close(db);
335 	return (0);
336 }
337 
338 
339 /*
340  * This is the SQLite database busy handler that retries the SQL
341  * operation until it is successful.
342  */
343 int
344 /* LINTED E_FUNC_ARG_UNUSED */
345 idmap_sqlite_busy_handler(void *arg, const char *table_name, int count)
346 {
347 	struct idmap_busy	*busy = arg;
348 	int			delay;
349 	struct timespec		rqtp;
350 
351 	if (count == 1)  {
352 		busy->total = 0;
353 		busy->sec = 2;
354 	}
355 	if (busy->total > 1000 * busy->sec) {
356 		idmapdlog(LOG_DEBUG,
357 		    "Thread %d waited %d sec for the %s database",
358 		    pthread_self(), busy->sec, busy->name);
359 		busy->sec++;
360 	}
361 
362 	if (count <= busy->delay_size) {
363 		delay = busy->delays[count-1];
364 	} else {
365 		delay = busy->delays[busy->delay_size - 1];
366 	}
367 	busy->total += delay;
368 	rqtp.tv_sec = 0;
369 	rqtp.tv_nsec = delay * (NANOSEC / MILLISEC);
370 	(void) nanosleep(&rqtp, NULL);
371 	return (1);
372 }
373 
374 
375 /*
376  * Get the database handle
377  */
378 idmap_retcode
379 get_db_handle(sqlite **db)
380 {
381 	char		*errmsg;
382 	idmap_tsd_t	*tsd;
383 
384 	/*
385 	 * Retrieve the db handle from thread-specific storage
386 	 * If none exists, open and store in thread-specific storage.
387 	 */
388 	if ((tsd = idmap_get_tsd()) == NULL) {
389 		idmapdlog(LOG_ERR,
390 		    "Error getting thread specific data for %s", IDMAP_DBNAME);
391 		return (IDMAP_ERR_MEMORY);
392 	}
393 
394 	if (tsd->db_db == NULL) {
395 		tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg);
396 		if (tsd->db_db == NULL) {
397 			idmapdlog(LOG_ERR, "Error opening database %s (%s)",
398 			    IDMAP_DBNAME, CHECK_NULL(errmsg));
399 			sqlite_freemem(errmsg);
400 			return (IDMAP_ERR_DB);
401 		}
402 
403 		tsd->db_busy.name = IDMAP_DBNAME;
404 		tsd->db_busy.delays = db_delay_table;
405 		tsd->db_busy.delay_size = sizeof (db_delay_table) /
406 		    sizeof (int);
407 		sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler,
408 		    &tsd->db_busy);
409 	}
410 	*db = tsd->db_db;
411 	return (IDMAP_SUCCESS);
412 }
413 
414 /*
415  * Get the cache handle
416  */
417 idmap_retcode
418 get_cache_handle(sqlite **cache)
419 {
420 	char		*errmsg;
421 	idmap_tsd_t	*tsd;
422 
423 	/*
424 	 * Retrieve the db handle from thread-specific storage
425 	 * If none exists, open and store in thread-specific storage.
426 	 */
427 	if ((tsd = idmap_get_tsd()) == NULL) {
428 		idmapdlog(LOG_ERR, "Error getting thread specific data for %s",
429 		    IDMAP_DBNAME);
430 		return (IDMAP_ERR_MEMORY);
431 	}
432 
433 	if (tsd->cache_db == NULL) {
434 		tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg);
435 		if (tsd->cache_db == NULL) {
436 			idmapdlog(LOG_ERR, "Error opening database %s (%s)",
437 			    IDMAP_CACHENAME, CHECK_NULL(errmsg));
438 			sqlite_freemem(errmsg);
439 			return (IDMAP_ERR_DB);
440 		}
441 
442 		tsd->cache_busy.name = IDMAP_CACHENAME;
443 		tsd->cache_busy.delays = cache_delay_table;
444 		tsd->cache_busy.delay_size = sizeof (cache_delay_table) /
445 		    sizeof (int);
446 		sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler,
447 		    &tsd->cache_busy);
448 	}
449 	*cache = tsd->cache_db;
450 	return (IDMAP_SUCCESS);
451 }
452 
453 /*
454  * Initialize cache and db
455  */
456 int
457 init_dbs()
458 {
459 	char *sql[4];
460 	int created, upgraded;
461 
462 	/* name-based mappings; probably OK to blow away in a pinch(?) */
463 	sql[0] = DB_INSTALL_SQL;
464 	sql[1] = DB_UPGRADE_FROM_v1_SQL;
465 	sql[2] = NULL;
466 
467 	if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql,
468 	    FAIL_IF_CORRUPT, &created, &upgraded) < 0)
469 		return (-1);
470 
471 	/* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */
472 	sql[0] = CACHE_INSTALL_SQL;
473 	sql[1] = CACHE_UPGRADE_FROM_v1_SQL;
474 	sql[2] = CACHE_UPGRADE_FROM_v2_SQL;
475 	sql[3] = NULL;
476 
477 	if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL,
478 	    sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0)
479 		return (-1);
480 
481 	_idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0;
482 
483 	return (0);
484 }
485 
486 /*
487  * Finalize databases
488  */
489 void
490 fini_dbs()
491 {
492 }
493 
494 /*
495  * This table is a listing of status codes that will be returned to the
496  * client when a SQL command fails with the corresponding error message.
497  */
498 static msg_table_t sqlmsgtable[] = {
499 	{IDMAP_ERR_U2W_NAMERULE_CONFLICT,
500 	"columns unixname, is_user, u2w_order are not unique"},
501 	{IDMAP_ERR_W2U_NAMERULE_CONFLICT,
502 	"columns winname, windomain, is_user, is_wuser, w2u_order are not"
503 	" unique"},
504 	{IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"},
505 	{-1, NULL}
506 };
507 
508 /*
509  * idmapd's version of string2stat to map SQLite messages to
510  * status codes
511  */
512 idmap_retcode
513 idmapd_string2stat(const char *msg)
514 {
515 	int i;
516 	for (i = 0; sqlmsgtable[i].msg; i++) {
517 		if (strcasecmp(sqlmsgtable[i].msg, msg) == 0)
518 			return (sqlmsgtable[i].retcode);
519 	}
520 	return (IDMAP_ERR_OTHER);
521 }
522 
523 /*
524  * Executes some SQL in a transaction.
525  *
526  * Returns 0 on success, -1 if it failed but the rollback succeeded, -2
527  * if the rollback failed.
528  */
529 static
530 int
531 sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
532 	const char *while_doing)
533 {
534 	char		*errmsg = NULL;
535 	int		rc;
536 
537 	rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg);
538 	if (rc != SQLITE_OK) {
539 		idmapdlog(LOG_ERR, "Begin transaction failed (%s) "
540 		    "while %s (%s)", errmsg, while_doing, dbname);
541 		sqlite_freemem(errmsg);
542 		return (-1);
543 	}
544 
545 	rc = sqlite_exec(db, sql, NULL, NULL, &errmsg);
546 	if (rc != SQLITE_OK) {
547 		idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg,
548 		    while_doing, dbname);
549 		sqlite_freemem(errmsg);
550 		errmsg = NULL;
551 		goto rollback;
552 	}
553 
554 	rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg);
555 	if (rc == SQLITE_OK) {
556 		sqlite_freemem(errmsg);
557 		return (0);
558 	}
559 
560 	idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)",
561 	    errmsg, while_doing, dbname);
562 	sqlite_freemem(errmsg);
563 	errmsg = NULL;
564 
565 rollback:
566 	rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg);
567 	if (rc != SQLITE_OK) {
568 		idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)",
569 		    errmsg, while_doing, dbname);
570 		sqlite_freemem(errmsg);
571 		return (-2);
572 	}
573 	sqlite_freemem(errmsg);
574 
575 	return (-1);
576 }
577 
578 /*
579  * Execute the given SQL statment without using any callbacks
580  */
581 idmap_retcode
582 sql_exec_no_cb(sqlite *db, const char *dbname, char *sql)
583 {
584 	char		*errmsg = NULL;
585 	int		r;
586 	idmap_retcode	retcode;
587 
588 	r = sqlite_exec(db, sql, NULL, NULL, &errmsg);
589 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
590 
591 	if (r != SQLITE_OK) {
592 		idmapdlog(LOG_ERR, "Database error on %s while executing %s "
593 		    "(%s)", dbname, sql, CHECK_NULL(errmsg));
594 		retcode = idmapd_string2stat(errmsg);
595 		if (errmsg != NULL)
596 			sqlite_freemem(errmsg);
597 		return (retcode);
598 	}
599 
600 	return (IDMAP_SUCCESS);
601 }
602 
603 /*
604  * Generate expression that can be used in WHERE statements.
605  * Examples:
606  * <prefix> <col>      <op> <value>   <suffix>
607  * ""       "unixuser" "="  "foo" "AND"
608  */
609 idmap_retcode
610 gen_sql_expr_from_rule(idmap_namerule *rule, char **out)
611 {
612 	char	*s_windomain = NULL, *s_winname = NULL;
613 	char	*s_unixname = NULL;
614 	char	*lower_winname;
615 	int	retcode = IDMAP_SUCCESS;
616 
617 	if (out == NULL)
618 		return (IDMAP_ERR_ARG);
619 
620 
621 	if (!EMPTY_STRING(rule->windomain)) {
622 		s_windomain =  sqlite_mprintf("AND windomain = %Q ",
623 		    rule->windomain);
624 		if (s_windomain == NULL) {
625 			retcode = IDMAP_ERR_MEMORY;
626 			goto out;
627 		}
628 	}
629 
630 	if (!EMPTY_STRING(rule->winname)) {
631 		if ((lower_winname = tolower_u8(rule->winname)) == NULL)
632 			lower_winname = rule->winname;
633 		s_winname = sqlite_mprintf(
634 		    "AND winname = %Q AND is_wuser = %d ",
635 		    lower_winname, rule->is_wuser ? 1 : 0);
636 		if (lower_winname != rule->winname)
637 			free(lower_winname);
638 		if (s_winname == NULL) {
639 			retcode = IDMAP_ERR_MEMORY;
640 			goto out;
641 		}
642 	}
643 
644 	if (!EMPTY_STRING(rule->unixname)) {
645 		s_unixname = sqlite_mprintf(
646 		    "AND unixname = %Q AND is_user = %d ",
647 		    rule->unixname, rule->is_user ? 1 : 0);
648 		if (s_unixname == NULL) {
649 			retcode = IDMAP_ERR_MEMORY;
650 			goto out;
651 		}
652 	}
653 
654 	*out = sqlite_mprintf("%s %s %s",
655 	    s_windomain ? s_windomain : "",
656 	    s_winname ? s_winname : "",
657 	    s_unixname ? s_unixname : "");
658 
659 	if (*out == NULL) {
660 		retcode = IDMAP_ERR_MEMORY;
661 		idmapdlog(LOG_ERR, "Out of memory");
662 		goto out;
663 	}
664 
665 out:
666 	if (s_windomain != NULL)
667 		sqlite_freemem(s_windomain);
668 	if (s_winname != NULL)
669 		sqlite_freemem(s_winname);
670 	if (s_unixname != NULL)
671 		sqlite_freemem(s_unixname);
672 
673 	return (retcode);
674 }
675 
676 
677 
678 /*
679  * Generate and execute SQL statement for LIST RPC calls
680  */
681 idmap_retcode
682 process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit,
683 		int flag, list_svc_cb cb, void *result)
684 {
685 	list_cb_data_t	cb_data;
686 	char		*errmsg = NULL;
687 	int		r;
688 	idmap_retcode	retcode = IDMAP_ERR_INTERNAL;
689 
690 	(void) memset(&cb_data, 0, sizeof (cb_data));
691 	cb_data.result = result;
692 	cb_data.limit = limit;
693 	cb_data.flag = flag;
694 
695 
696 	r = sqlite_exec(db, sql, cb, &cb_data, &errmsg);
697 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
698 	switch (r) {
699 	case SQLITE_OK:
700 		retcode = IDMAP_SUCCESS;
701 		break;
702 
703 	default:
704 		retcode = IDMAP_ERR_INTERNAL;
705 		idmapdlog(LOG_ERR, "Database error on %s while executing "
706 		    "%s (%s)", dbname, sql, CHECK_NULL(errmsg));
707 		break;
708 	}
709 	if (errmsg != NULL)
710 		sqlite_freemem(errmsg);
711 	return (retcode);
712 }
713 
714 /*
715  * This routine is called by callbacks that process the results of
716  * LIST RPC calls to validate data and to allocate memory for
717  * the result array.
718  */
719 idmap_retcode
720 validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv,
721 		int ncol, uchar_t **list, size_t valsize)
722 {
723 	size_t	nsize;
724 	void	*tmplist;
725 
726 	if (cb_data->limit > 0 && cb_data->next == cb_data->limit)
727 		return (IDMAP_NEXT);
728 
729 	if (argc < ncol || argv == NULL) {
730 		idmapdlog(LOG_ERR, "Invalid data");
731 		return (IDMAP_ERR_INTERNAL);
732 	}
733 
734 	/* alloc in bulk to reduce number of reallocs */
735 	if (cb_data->next >= cb_data->len) {
736 		nsize = (cb_data->len + SIZE_INCR) * valsize;
737 		tmplist = realloc(*list, nsize);
738 		if (tmplist == NULL) {
739 			idmapdlog(LOG_ERR, "Out of memory");
740 			return (IDMAP_ERR_MEMORY);
741 		}
742 		*list = tmplist;
743 		(void) memset(*list + (cb_data->len * valsize), 0,
744 		    SIZE_INCR * valsize);
745 		cb_data->len += SIZE_INCR;
746 	}
747 	return (IDMAP_SUCCESS);
748 }
749 
750 static
751 idmap_retcode
752 get_namerule_order(char *winname, char *windomain, char *unixname,
753 	int direction, int is_diagonal, int *w2u_order, int *u2w_order)
754 {
755 	*w2u_order = 0;
756 	*u2w_order = 0;
757 
758 	/*
759 	 * Windows to UNIX lookup order:
760 	 *  1. winname@domain (or winname) to ""
761 	 *  2. winname@domain (or winname) to unixname
762 	 *  3. winname@* to ""
763 	 *  4. winname@* to unixname
764 	 *  5. *@domain (or *) to *
765 	 *  6. *@domain (or *) to ""
766 	 *  7. *@domain (or *) to unixname
767 	 *  8. *@* to *
768 	 *  9. *@* to ""
769 	 * 10. *@* to unixname
770 	 *
771 	 * winname is a special case of winname@domain when domain is the
772 	 * default domain. Similarly * is a special case of *@domain when
773 	 * domain is the default domain.
774 	 *
775 	 * Note that "" has priority over specific names because "" inhibits
776 	 * mappings and traditionally deny rules always had higher priority.
777 	 */
778 	if (direction != IDMAP_DIRECTION_U2W) {
779 		/* bi-directional or from windows to unix */
780 		if (winname == NULL)
781 			return (IDMAP_ERR_W2U_NAMERULE);
782 		else if (unixname == NULL)
783 			return (IDMAP_ERR_W2U_NAMERULE);
784 		else if (EMPTY_NAME(winname))
785 			return (IDMAP_ERR_W2U_NAMERULE);
786 		else if (*winname == '*' && windomain && *windomain == '*') {
787 			if (*unixname == '*')
788 				*w2u_order = 8;
789 			else if (EMPTY_NAME(unixname))
790 				*w2u_order = 9;
791 			else /* unixname == name */
792 				*w2u_order = 10;
793 		} else if (*winname == '*') {
794 			if (*unixname == '*')
795 				*w2u_order = 5;
796 			else if (EMPTY_NAME(unixname))
797 				*w2u_order = 6;
798 			else /* name */
799 				*w2u_order = 7;
800 		} else if (windomain != NULL && *windomain == '*') {
801 			/* winname == name */
802 			if (*unixname == '*')
803 				return (IDMAP_ERR_W2U_NAMERULE);
804 			else if (EMPTY_NAME(unixname))
805 				*w2u_order = 3;
806 			else /* name */
807 				*w2u_order = 4;
808 		} else  {
809 			/* winname == name && windomain == null or name */
810 			if (*unixname == '*')
811 				return (IDMAP_ERR_W2U_NAMERULE);
812 			else if (EMPTY_NAME(unixname))
813 				*w2u_order = 1;
814 			else /* name */
815 				*w2u_order = 2;
816 		}
817 
818 	}
819 
820 	/*
821 	 * 1. unixname to "", non-diagonal
822 	 * 2. unixname to winname@domain (or winname), non-diagonal
823 	 * 3. unixname to "", diagonal
824 	 * 4. unixname to winname@domain (or winname), diagonal
825 	 * 5. * to *@domain (or *), non-diagonal
826 	 * 5. * to *@domain (or *), diagonal
827 	 * 7. * to ""
828 	 * 8. * to winname@domain (or winname)
829 	 * 9. * to "", non-diagonal
830 	 * 10. * to winname@domain (or winname), diagonal
831 	 */
832 	if (direction != IDMAP_DIRECTION_W2U) {
833 		int diagonal = is_diagonal ? 1 : 0;
834 
835 		/* bi-directional or from unix to windows */
836 		if (unixname == NULL || EMPTY_NAME(unixname))
837 			return (IDMAP_ERR_U2W_NAMERULE);
838 		else if (winname == NULL)
839 			return (IDMAP_ERR_U2W_NAMERULE);
840 		else if (windomain != NULL && *windomain == '*')
841 			return (IDMAP_ERR_U2W_NAMERULE);
842 		else if (*unixname == '*') {
843 			if (*winname == '*')
844 				*u2w_order = 5 + diagonal;
845 			else if (EMPTY_NAME(winname))
846 				*u2w_order = 7 + 2 * diagonal;
847 			else
848 				*u2w_order = 8 + 2 * diagonal;
849 		} else {
850 			if (*winname == '*')
851 				return (IDMAP_ERR_U2W_NAMERULE);
852 			else if (EMPTY_NAME(winname))
853 				*u2w_order = 1 + 2 * diagonal;
854 			else
855 				*u2w_order = 2 + 2 * diagonal;
856 		}
857 	}
858 	return (IDMAP_SUCCESS);
859 }
860 
861 /*
862  * Generate and execute SQL statement to add name-based mapping rule
863  */
864 idmap_retcode
865 add_namerule(sqlite *db, idmap_namerule *rule)
866 {
867 	char		*sql = NULL;
868 	idmap_stat	retcode;
869 	char		*dom = NULL;
870 	int		w2u_order, u2w_order;
871 	char		w2ubuf[11], u2wbuf[11];
872 
873 	retcode = get_namerule_order(rule->winname, rule->windomain,
874 	    rule->unixname, rule->direction,
875 	    rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order);
876 	if (retcode != IDMAP_SUCCESS)
877 		goto out;
878 
879 	if (w2u_order)
880 		(void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order);
881 	if (u2w_order)
882 		(void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order);
883 
884 	/*
885 	 * For the triggers on namerules table to work correctly:
886 	 * 1) Use NULL instead of 0 for w2u_order and u2w_order
887 	 * 2) Use "" instead of NULL for "no domain"
888 	 */
889 
890 	if (!EMPTY_STRING(rule->windomain))
891 		dom = rule->windomain;
892 	else if (lookup_wksids_name2sid(rule->winname, NULL, NULL, NULL, NULL)
893 	    == IDMAP_SUCCESS) {
894 		/* well-known SIDs don't need domain */
895 		dom = "";
896 	}
897 
898 	RDLOCK_CONFIG();
899 	if (dom == NULL) {
900 		if (_idmapdstate.cfg->pgcfg.default_domain)
901 			dom = _idmapdstate.cfg->pgcfg.default_domain;
902 		else
903 			dom = "";
904 	}
905 	sql = sqlite_mprintf("INSERT into namerules "
906 	    "(is_user, is_wuser, windomain, winname_display, is_nt4, "
907 	    "unixname, w2u_order, u2w_order) "
908 	    "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);",
909 	    rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom,
910 	    rule->winname, rule->is_nt4 ? 1 : 0, rule->unixname,
911 	    w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL);
912 	UNLOCK_CONFIG();
913 
914 	if (sql == NULL) {
915 		retcode = IDMAP_ERR_INTERNAL;
916 		idmapdlog(LOG_ERR, "Out of memory");
917 		goto out;
918 	}
919 
920 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
921 
922 	if (retcode == IDMAP_ERR_OTHER)
923 		retcode = IDMAP_ERR_CFG;
924 
925 out:
926 	if (sql != NULL)
927 		sqlite_freemem(sql);
928 	return (retcode);
929 }
930 
931 /*
932  * Flush name-based mapping rules
933  */
934 idmap_retcode
935 flush_namerules(sqlite *db)
936 {
937 	idmap_stat	retcode;
938 
939 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;");
940 
941 	return (retcode);
942 }
943 
944 /*
945  * Generate and execute SQL statement to remove a name-based mapping rule
946  */
947 idmap_retcode
948 rm_namerule(sqlite *db, idmap_namerule *rule)
949 {
950 	char		*sql = NULL;
951 	idmap_stat	retcode;
952 	char		buf[80];
953 	char		*expr = NULL;
954 
955 	if (rule->direction < 0 && EMPTY_STRING(rule->windomain) &&
956 	    EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname))
957 		return (IDMAP_SUCCESS);
958 
959 	buf[0] = 0;
960 
961 	if (rule->direction == IDMAP_DIRECTION_BI)
962 		(void) snprintf(buf, sizeof (buf), "AND w2u_order > 0"
963 		    " AND u2w_order > 0");
964 	else if (rule->direction == IDMAP_DIRECTION_W2U)
965 		(void) snprintf(buf, sizeof (buf), "AND w2u_order > 0"
966 		    " AND (u2w_order = 0 OR u2w_order ISNULL)");
967 	else if (rule->direction == IDMAP_DIRECTION_U2W)
968 		(void) snprintf(buf, sizeof (buf), "AND u2w_order > 0"
969 		    " AND (w2u_order = 0 OR w2u_order ISNULL)");
970 
971 	retcode = gen_sql_expr_from_rule(rule, &expr);
972 	if (retcode != IDMAP_SUCCESS)
973 		goto out;
974 
975 	sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s %s;", expr,
976 	    buf);
977 
978 	if (sql == NULL) {
979 		retcode = IDMAP_ERR_INTERNAL;
980 		idmapdlog(LOG_ERR, "Out of memory");
981 		goto out;
982 	}
983 
984 
985 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
986 
987 out:
988 	if (expr != NULL)
989 		sqlite_freemem(expr);
990 	if (sql != NULL)
991 		sqlite_freemem(sql);
992 	return (retcode);
993 }
994 
995 /*
996  * Compile the given SQL query and step just once.
997  *
998  * Input:
999  * db  - db handle
1000  * sql - SQL statement
1001  *
1002  * Output:
1003  * vm     -  virtual SQL machine
1004  * ncol   - number of columns in the result
1005  * values - column values
1006  *
1007  * Return values:
1008  * IDMAP_SUCCESS
1009  * IDMAP_ERR_NOTFOUND
1010  * IDMAP_ERR_INTERNAL
1011  */
1012 
1013 static
1014 idmap_retcode
1015 sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol,
1016 		int reqcol, const char ***values)
1017 {
1018 	char		*errmsg = NULL;
1019 	int		r;
1020 
1021 	if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) {
1022 		idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1023 		    CHECK_NULL(errmsg));
1024 		sqlite_freemem(errmsg);
1025 		return (IDMAP_ERR_INTERNAL);
1026 	}
1027 
1028 	r = sqlite_step(*vm, ncol, values, NULL);
1029 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
1030 
1031 	if (r == SQLITE_ROW) {
1032 		if (ncol != NULL && *ncol < reqcol) {
1033 			(void) sqlite_finalize(*vm, NULL);
1034 			*vm = NULL;
1035 			return (IDMAP_ERR_INTERNAL);
1036 		}
1037 		/* Caller will call finalize after using the results */
1038 		return (IDMAP_SUCCESS);
1039 	} else if (r == SQLITE_DONE) {
1040 		(void) sqlite_finalize(*vm, NULL);
1041 		*vm = NULL;
1042 		return (IDMAP_ERR_NOTFOUND);
1043 	}
1044 
1045 	(void) sqlite_finalize(*vm, &errmsg);
1046 	*vm = NULL;
1047 	idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1048 	    CHECK_NULL(errmsg));
1049 	sqlite_freemem(errmsg);
1050 	return (IDMAP_ERR_INTERNAL);
1051 }
1052 
1053 /*
1054  * Load config in the state.
1055  *
1056  * nm_siduid and nm_sidgid fields:
1057  * state->nm_siduid represents mode used by sid2uid and uid2sid
1058  * requests for directory-based name mappings. Similarly,
1059  * state->nm_sidgid represents mode used by sid2gid and gid2sid
1060  * requests.
1061  *
1062  * sid2uid/uid2sid:
1063  * none       -> ds_name_mapping_enabled != true
1064  * AD-mode    -> !nldap_winname_attr && ad_unixuser_attr
1065  * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr
1066  * mixed-mode -> nldap_winname_attr && ad_unixuser_attr
1067  *
1068  * sid2gid/gid2sid:
1069  * none       -> ds_name_mapping_enabled != true
1070  * AD-mode    -> !nldap_winname_attr && ad_unixgroup_attr
1071  * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr
1072  * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr
1073  */
1074 idmap_retcode
1075 load_cfg_in_state(lookup_state_t *state)
1076 {
1077 	state->nm_siduid = IDMAP_NM_NONE;
1078 	state->nm_sidgid = IDMAP_NM_NONE;
1079 	RDLOCK_CONFIG();
1080 
1081 	state->eph_map_unres_sids = 0;
1082 	if (_idmapdstate.cfg->pgcfg.eph_map_unres_sids)
1083 		state->eph_map_unres_sids = 1;
1084 
1085 	if (_idmapdstate.cfg->pgcfg.default_domain != NULL) {
1086 		state->defdom =
1087 		    strdup(_idmapdstate.cfg->pgcfg.default_domain);
1088 		if (state->defdom == NULL) {
1089 			UNLOCK_CONFIG();
1090 			return (IDMAP_ERR_MEMORY);
1091 		}
1092 	} else {
1093 		UNLOCK_CONFIG();
1094 		return (IDMAP_SUCCESS);
1095 	}
1096 	if (_idmapdstate.cfg->pgcfg.ds_name_mapping_enabled == FALSE) {
1097 		UNLOCK_CONFIG();
1098 		return (IDMAP_SUCCESS);
1099 	}
1100 	if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1101 		state->nm_siduid =
1102 		    (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1103 		    ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1104 		state->nm_sidgid =
1105 		    (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1106 		    ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1107 	} else {
1108 		state->nm_siduid =
1109 		    (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1110 		    ? IDMAP_NM_AD : IDMAP_NM_NONE;
1111 		state->nm_sidgid =
1112 		    (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1113 		    ? IDMAP_NM_AD : IDMAP_NM_NONE;
1114 	}
1115 	if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) {
1116 		state->ad_unixuser_attr =
1117 		    strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr);
1118 		if (state->ad_unixuser_attr == NULL) {
1119 			UNLOCK_CONFIG();
1120 			return (IDMAP_ERR_MEMORY);
1121 		}
1122 	}
1123 	if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) {
1124 		state->ad_unixgroup_attr =
1125 		    strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr);
1126 		if (state->ad_unixgroup_attr == NULL) {
1127 			UNLOCK_CONFIG();
1128 			return (IDMAP_ERR_MEMORY);
1129 		}
1130 	}
1131 	if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1132 		state->nldap_winname_attr =
1133 		    strdup(_idmapdstate.cfg->pgcfg.nldap_winname_attr);
1134 		if (state->nldap_winname_attr == NULL) {
1135 			UNLOCK_CONFIG();
1136 			return (IDMAP_ERR_MEMORY);
1137 		}
1138 	}
1139 	UNLOCK_CONFIG();
1140 	return (IDMAP_SUCCESS);
1141 }
1142 
1143 /*
1144  * Set the rule with sepecified values.
1145  * All the strings are copied.
1146  */
1147 static void
1148 idmap_namerule_set(idmap_namerule *rule, const char *windomain,
1149 		const char *winname, const char *unixname, boolean_t is_user,
1150 		boolean_t is_wuser, boolean_t is_nt4, int direction)
1151 {
1152 	/*
1153 	 * Only update if they differ because we have to free
1154 	 * and duplicate the strings
1155 	 */
1156 	if (rule->windomain == NULL || windomain == NULL ||
1157 	    strcmp(rule->windomain, windomain) != 0) {
1158 		if (rule->windomain != NULL) {
1159 			free(rule->windomain);
1160 			rule->windomain = NULL;
1161 		}
1162 		if (windomain != NULL)
1163 			rule->windomain = strdup(windomain);
1164 	}
1165 
1166 	if (rule->winname == NULL || winname == NULL ||
1167 	    strcmp(rule->winname, winname) != 0) {
1168 		if (rule->winname != NULL) {
1169 			free(rule->winname);
1170 			rule->winname = NULL;
1171 		}
1172 		if (winname != NULL)
1173 			rule->winname = strdup(winname);
1174 	}
1175 
1176 	if (rule->unixname == NULL || unixname == NULL ||
1177 	    strcmp(rule->unixname, unixname) != 0) {
1178 		if (rule->unixname != NULL) {
1179 			free(rule->unixname);
1180 			rule->unixname = NULL;
1181 		}
1182 		if (unixname != NULL)
1183 			rule->unixname = strdup(unixname);
1184 	}
1185 
1186 	rule->is_user = is_user;
1187 	rule->is_wuser = is_wuser;
1188 	rule->is_nt4 = is_nt4;
1189 	rule->direction = direction;
1190 }
1191 
1192 
1193 /*
1194  * Table for well-known SIDs.
1195  *
1196  * Background:
1197  *
1198  * Some of the well-known principals are stored under:
1199  * cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>
1200  * They belong to objectClass "foreignSecurityPrincipal". They don't have
1201  * "samAccountName" nor "userPrincipalName" attributes. Their names are
1202  * available in "cn" and "name" attributes. Some of these principals have a
1203  * second entry under CN=ForeignSecurityPrincipals,dc=<forestRootDomain> and
1204  * these duplicate entries have the stringified SID in the "name" and "cn"
1205  * attributes instead of the actual name.
1206  *
1207  * Those of the form S-1-5-32-X are Builtin groups and are stored in the
1208  * cn=builtin container (except, Power Users which is not stored in AD)
1209  *
1210  * These principals are and will remain constant. Therefore doing AD lookups
1211  * provides no benefit. Also, using hard-coded table (and thus avoiding AD
1212  * lookup) improves performance and avoids additional complexity in the
1213  * adutils.c code. Moreover these SIDs can be used when no Active Directory
1214  * is available (such as the CIFS server's "workgroup" mode).
1215  *
1216  * Notes:
1217  * 1. Currently we don't support localization of well-known SID names,
1218  * unlike Windows.
1219  *
1220  * 2. Other well-known SIDs i.e. S-1-5-<domain>-<w-k RID> are not stored
1221  * here. AD does have normal user/group objects for these objects and
1222  * can be looked up using the existing AD lookup code.
1223  *
1224  * 3. See comments above lookup_wksids_sid2pid() for more information
1225  * on how we lookup the wksids table.
1226  */
1227 static wksids_table_t wksids[] = {
1228 	{"S-1-0", 0, "Nobody", 0, SENTINEL_PID, -1, 1},
1229 	{"S-1-1", 0, "Everyone", 0, SENTINEL_PID, -1, -1},
1230 	{"S-1-3", 0, "Creator Owner", 1, IDMAP_WK_CREATOR_OWNER_UID, 1, 0},
1231 	{"S-1-3", 1, "Creator Group", 0, IDMAP_WK_CREATOR_GROUP_GID, 0, 0},
1232 	{"S-1-3", 2, "Creator Owner Server", 1, SENTINEL_PID, -1, -1},
1233 	{"S-1-3", 3, "Creator Group Server", 0, SENTINEL_PID, -1, 1},
1234 	{"S-1-3", 4, "Owner Rights", 0, SENTINEL_PID, -1, -1},
1235 	{"S-1-5", 1, "Dialup", 0, SENTINEL_PID, -1, -1},
1236 	{"S-1-5", 2, "Network", 0, SENTINEL_PID, -1, -1},
1237 	{"S-1-5", 3, "Batch", 0, SENTINEL_PID, -1, -1},
1238 	{"S-1-5", 4, "Interactive", 0, SENTINEL_PID, -1, -1},
1239 	{"S-1-5", 6, "Service", 0, SENTINEL_PID, -1, -1},
1240 	{"S-1-5", 7, "Anonymous Logon", 0, GID_NOBODY, 0, 0},
1241 	{"S-1-5", 7, "Anonymous Logon", 0, UID_NOBODY, 1, 0},
1242 	{"S-1-5", 8, "Proxy", 0, SENTINEL_PID, -1, -1},
1243 	{"S-1-5", 9, "Enterprise Domain Controllers", 0, SENTINEL_PID, -1, -1},
1244 	{"S-1-5", 10, "Self", 0, SENTINEL_PID, -1, -1},
1245 	{"S-1-5", 11, "Authenticated Users", 0, SENTINEL_PID, -1, -1},
1246 	{"S-1-5", 12, "Restricted Code", 0, SENTINEL_PID, -1, -1},
1247 	{"S-1-5", 13, "Terminal Server User", 0, SENTINEL_PID, -1, -1},
1248 	{"S-1-5", 14, "Remote Interactive Logon", 0, SENTINEL_PID, -1, -1},
1249 	{"S-1-5", 15, "This Organization", 0, SENTINEL_PID, -1, -1},
1250 	{"S-1-5", 17, "IUSR", 0, SENTINEL_PID, -1, -1},
1251 	{"S-1-5", 18, "Local System", 0, IDMAP_WK_LOCAL_SYSTEM_GID, 0, 0},
1252 	{"S-1-5", 19, "Local Service", 0, SENTINEL_PID, -1, -1},
1253 	{"S-1-5", 20, "Network Service", 0, SENTINEL_PID, -1, -1},
1254 	{"S-1-5", 1000, "Other Organization", 0, SENTINEL_PID, -1, -1},
1255 	{"S-1-5-32", 544, "Administrators", 0, SENTINEL_PID, -1, -1},
1256 	{"S-1-5-32", 545, "Users", 0, SENTINEL_PID, -1, -1},
1257 	{"S-1-5-32", 546, "Guests", 0, SENTINEL_PID, -1, -1},
1258 	{"S-1-5-32", 547, "Power Users", 0, SENTINEL_PID, -1, -1},
1259 	{"S-1-5-32", 548, "Account Operators", 0, SENTINEL_PID, -1, -1},
1260 	{"S-1-5-32", 549, "Server Operators", 0, SENTINEL_PID, -1, -1},
1261 	{"S-1-5-32", 550, "Print Operators", 0, SENTINEL_PID, -1, -1},
1262 	{"S-1-5-32", 551, "Backup Operators", 0, SENTINEL_PID, -1, -1},
1263 	{"S-1-5-32", 552, "Replicator", 0, SENTINEL_PID, -1, -1},
1264 	{"S-1-5-32", 554, "Pre-Windows 2000 Compatible Access", 0,
1265 	    SENTINEL_PID, -1, -1},
1266 	{"S-1-5-32", 555, "Remote Desktop Users", 0, SENTINEL_PID, -1, -1},
1267 	{"S-1-5-32", 556, "Network Configuration Operators", 0,
1268 	    SENTINEL_PID, -1, -1},
1269 	{"S-1-5-32", 557, "Incoming Forest Trust Builders", 0,
1270 	    SENTINEL_PID, -1, -1},
1271 	{"S-1-5-32", 558, "Performance Monitor Users", 0, SENTINEL_PID, -1, -1},
1272 	{"S-1-5-32", 559, "Performance Log Users", 0, SENTINEL_PID, -1, -1},
1273 	{"S-1-5-32", 560, "Windows Authorization Access Group", 0,
1274 	    SENTINEL_PID, -1, -1},
1275 	{"S-1-5-32", 561, "Terminal Server License Servers", 0,
1276 	    SENTINEL_PID, -1, -1},
1277 	{"S-1-5-32", 561, "Distributed COM Users", 0, SENTINEL_PID, -1, -1},
1278 	{"S-1-5-32", 568, "IIS_IUSRS", 0, SENTINEL_PID, -1, -1},
1279 	{"S-1-5-32", 569, "Cryptographic Operators", 0, SENTINEL_PID, -1, -1},
1280 	{"S-1-5-32", 573, "Event Log Readers", 0, SENTINEL_PID, -1, -1},
1281 	{"S-1-5-32", 574, "Certificate Service DCOM Access", 0,
1282 	    SENTINEL_PID, -1, -1},
1283 	{"S-1-5-64", 21, "Digest Authentication", 0, SENTINEL_PID, -1, -1},
1284 	{"S-1-5-64", 10, "NTLM Authentication", 0, SENTINEL_PID, -1, -1},
1285 	{"S-1-5-64", 14, "SChannel Authentication", 0, SENTINEL_PID, -1, -1},
1286 	{NULL, UINT32_MAX, NULL, -1, SENTINEL_PID, -1, -1}
1287 };
1288 
1289 /*
1290  * Lookup well-known SIDs table either by winname or by SID.
1291  * If the given winname or SID is a well-known SID then we set wksid
1292  * variable and then proceed to see if the SID has a hard mapping to
1293  * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to
1294  * fixed ephemeral ids). If we find such mapping then we return
1295  * success otherwise notfound. If a well-known SID is mapped to
1296  * SENTINEL_PID and the direction field is set (bi-directional or
1297  * win2unix) then we treat it as inhibited mapping and return no
1298  * mapping (Ex. S-1-0-0).
1299  */
1300 static
1301 idmap_retcode
1302 lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *wksid)
1303 {
1304 	int i;
1305 
1306 	*wksid = 0;
1307 
1308 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1309 		if (req->id1.idmap_id_u.sid.prefix != NULL) {
1310 			if ((strcasecmp(wksids[i].sidprefix,
1311 			    req->id1.idmap_id_u.sid.prefix) != 0) ||
1312 			    wksids[i].rid != req->id1.idmap_id_u.sid.rid)
1313 				/* this is not our SID */
1314 				continue;
1315 			if (req->id1name == NULL) {
1316 				req->id1name = strdup(wksids[i].winname);
1317 				if (req->id1name == NULL)
1318 					return (IDMAP_ERR_MEMORY);
1319 			}
1320 		} else if (req->id1name != NULL) {
1321 			if (strcasecmp(wksids[i].winname, req->id1name) != 0)
1322 				/* this is not our winname */
1323 				continue;
1324 			req->id1.idmap_id_u.sid.prefix =
1325 			    strdup(wksids[i].sidprefix);
1326 			if (req->id1.idmap_id_u.sid.prefix == NULL)
1327 				return (IDMAP_ERR_MEMORY);
1328 			req->id1.idmap_id_u.sid.rid = wksids[i].rid;
1329 		}
1330 
1331 		*wksid = 1;
1332 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
1333 
1334 		req->id1.idtype = (wksids[i].is_wuser) ?
1335 		    IDMAP_USID : IDMAP_GSID;
1336 
1337 		if (wksids[i].pid == SENTINEL_PID) {
1338 			if (wksids[i].direction == IDMAP_DIRECTION_BI ||
1339 			    wksids[i].direction == IDMAP_DIRECTION_W2U)
1340 				/* Inhibited */
1341 				return (IDMAP_ERR_NOMAPPING);
1342 			/* Not mapped */
1343 			if (res->id.idtype == IDMAP_POSIXID) {
1344 				res->id.idtype =
1345 				    (wksids[i].is_wuser) ?
1346 				    IDMAP_UID : IDMAP_GID;
1347 			}
1348 			return (IDMAP_ERR_NOTFOUND);
1349 		} else if (wksids[i].direction == IDMAP_DIRECTION_U2W)
1350 			continue;
1351 
1352 		switch (res->id.idtype) {
1353 		case IDMAP_UID:
1354 			if (wksids[i].is_user == 0)
1355 				continue;
1356 			res->id.idmap_id_u.uid = wksids[i].pid;
1357 			res->direction = wksids[i].direction;
1358 			if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
1359 				res->info.how.map_type =
1360 				    IDMAP_MAP_TYPE_KNOWN_SID;
1361 				res->info.src = IDMAP_MAP_SRC_HARD_CODED;
1362 			}
1363 			return (IDMAP_SUCCESS);
1364 		case IDMAP_GID:
1365 			if (wksids[i].is_user == 1)
1366 				continue;
1367 			res->id.idmap_id_u.gid = wksids[i].pid;
1368 			res->direction = wksids[i].direction;
1369 			if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
1370 				res->info.how.map_type =
1371 				    IDMAP_MAP_TYPE_KNOWN_SID;
1372 				res->info.src = IDMAP_MAP_SRC_HARD_CODED;
1373 			}
1374 			return (IDMAP_SUCCESS);
1375 		case IDMAP_POSIXID:
1376 			res->id.idmap_id_u.uid = wksids[i].pid;
1377 			res->id.idtype = (!wksids[i].is_user) ?
1378 			    IDMAP_GID : IDMAP_UID;
1379 			res->direction = wksids[i].direction;
1380 			if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
1381 				res->info.how.map_type =
1382 				    IDMAP_MAP_TYPE_KNOWN_SID;
1383 				res->info.src = IDMAP_MAP_SRC_HARD_CODED;
1384 			}
1385 			return (IDMAP_SUCCESS);
1386 		default:
1387 			return (IDMAP_ERR_NOTSUPPORTED);
1388 		}
1389 	}
1390 	return (IDMAP_ERR_NOTFOUND);
1391 }
1392 
1393 
1394 static
1395 idmap_retcode
1396 lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user)
1397 {
1398 	int i;
1399 	if (req->id1.idmap_id_u.uid == SENTINEL_PID)
1400 		return (IDMAP_ERR_NOTFOUND);
1401 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1402 		if (wksids[i].pid == req->id1.idmap_id_u.uid &&
1403 		    wksids[i].is_user == is_user &&
1404 		    wksids[i].direction != IDMAP_DIRECTION_W2U) {
1405 			if (res->id.idtype == IDMAP_SID) {
1406 				res->id.idtype = (wksids[i].is_wuser) ?
1407 				    IDMAP_USID : IDMAP_GSID;
1408 			}
1409 			res->id.idmap_id_u.sid.rid = wksids[i].rid;
1410 			res->id.idmap_id_u.sid.prefix =
1411 			    strdup(wksids[i].sidprefix);
1412 			if (res->id.idmap_id_u.sid.prefix == NULL) {
1413 				idmapdlog(LOG_ERR, "Out of memory");
1414 				return (IDMAP_ERR_MEMORY);
1415 			}
1416 			res->direction = wksids[i].direction;
1417 			if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
1418 				res->info.how.map_type =
1419 				    IDMAP_MAP_TYPE_KNOWN_SID;
1420 				res->info.src = IDMAP_MAP_SRC_HARD_CODED;
1421 			}
1422 			return (IDMAP_SUCCESS);
1423 		}
1424 	}
1425 	return (IDMAP_ERR_NOTFOUND);
1426 }
1427 
1428 idmap_retcode
1429 lookup_wksids_name2sid(const char *name, char **canonname, char **sidprefix,
1430 	idmap_rid_t *rid, int *type)
1431 {
1432 	int	i;
1433 
1434 	if ((strncasecmp(name, "BUILTIN\\", 8) == 0) ||
1435 	    (strncasecmp(name, "BUILTIN/", 8) == 0))
1436 		name += 8;
1437 
1438 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1439 		if (strcasecmp(wksids[i].winname, name) != 0)
1440 			continue;
1441 		if (sidprefix != NULL &&
1442 		    (*sidprefix = strdup(wksids[i].sidprefix)) == NULL) {
1443 			idmapdlog(LOG_ERR, "Out of memory");
1444 			return (IDMAP_ERR_MEMORY);
1445 		}
1446 		if (canonname != NULL &&
1447 		    (*canonname = strdup(wksids[i].winname)) == NULL) {
1448 			idmapdlog(LOG_ERR, "Out of memory");
1449 			if (sidprefix != NULL) {
1450 				free(*sidprefix);
1451 				*sidprefix = NULL;
1452 			}
1453 			return (IDMAP_ERR_MEMORY);
1454 		}
1455 		if (type != NULL)
1456 			*type = (wksids[i].is_wuser) ?
1457 			    _IDMAP_T_USER : _IDMAP_T_GROUP;
1458 		if (rid != NULL)
1459 			*rid = wksids[i].rid;
1460 		return (IDMAP_SUCCESS);
1461 	}
1462 	return (IDMAP_ERR_NOTFOUND);
1463 }
1464 
1465 static
1466 idmap_retcode
1467 lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1468 {
1469 	char		*end;
1470 	char		*sql = NULL;
1471 	const char	**values;
1472 	sqlite_vm	*vm = NULL;
1473 	int		ncol, is_user;
1474 	uid_t		pid;
1475 	time_t		curtime, exp;
1476 	idmap_retcode	retcode;
1477 	char		*is_user_string, *lower_name;
1478 
1479 	/* Current time */
1480 	errno = 0;
1481 	if ((curtime = time(NULL)) == (time_t)-1) {
1482 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1483 		    strerror(errno));
1484 		retcode = IDMAP_ERR_INTERNAL;
1485 		goto out;
1486 	}
1487 
1488 	switch (res->id.idtype) {
1489 	case IDMAP_UID:
1490 		is_user_string = "1";
1491 		break;
1492 	case IDMAP_GID:
1493 		is_user_string = "0";
1494 		break;
1495 	case IDMAP_POSIXID:
1496 		/* the non-diagonal mapping */
1497 		is_user_string = "is_wuser";
1498 		break;
1499 	default:
1500 		retcode = IDMAP_ERR_NOTSUPPORTED;
1501 		goto out;
1502 	}
1503 
1504 	/* SQL to lookup the cache */
1505 
1506 	if (req->id1.idmap_id_u.sid.prefix != NULL) {
1507 		sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
1508 		    "unixname, u2w, is_wuser, "
1509 		    "map_type, map_dn, map_attr, map_value, "
1510 		    "map_windomain, map_winname, map_unixname, map_is_nt4 "
1511 		    "FROM idmap_cache WHERE is_user = %s AND "
1512 		    "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
1513 		    "(pid >= 2147483648 OR "
1514 		    "(expiration = 0 OR expiration ISNULL OR "
1515 		    "expiration > %d));",
1516 		    is_user_string, req->id1.idmap_id_u.sid.prefix,
1517 		    req->id1.idmap_id_u.sid.rid, curtime);
1518 	} else if (req->id1name != NULL) {
1519 		if ((lower_name = tolower_u8(req->id1name)) == NULL)
1520 			lower_name = req->id1name;
1521 		sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
1522 		    "unixname, u2w, is_wuser, "
1523 		    "map_type, map_dn, map_attr, map_value, "
1524 		    "map_windomain, map_winname, map_unixname, map_is_nt4 "
1525 		    "FROM idmap_cache WHERE is_user = %s AND "
1526 		    "winname = %Q AND windomain = %Q AND w2u = 1 AND "
1527 		    "(pid >= 2147483648 OR "
1528 		    "(expiration = 0 OR expiration ISNULL OR "
1529 		    "expiration > %d));",
1530 		    is_user_string, lower_name, req->id1domain,
1531 		    curtime);
1532 		if (lower_name != req->id1name)
1533 			free(lower_name);
1534 	} else {
1535 		retcode = IDMAP_ERR_ARG;
1536 		goto out;
1537 	}
1538 	if (sql == NULL) {
1539 		idmapdlog(LOG_ERR, "Out of memory");
1540 		retcode = IDMAP_ERR_MEMORY;
1541 		goto out;
1542 	}
1543 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol,
1544 	    14, &values);
1545 	sqlite_freemem(sql);
1546 
1547 	if (retcode == IDMAP_ERR_NOTFOUND) {
1548 		goto out;
1549 	} else if (retcode == IDMAP_SUCCESS) {
1550 		/* sanity checks */
1551 		if (values[0] == NULL || values[1] == NULL) {
1552 			retcode = IDMAP_ERR_CACHE;
1553 			goto out;
1554 		}
1555 
1556 		pid = strtoul(values[0], &end, 10);
1557 		is_user = strncmp(values[1], "0", 2) ? 1 : 0;
1558 
1559 		if (is_user) {
1560 			res->id.idtype = IDMAP_UID;
1561 			res->id.idmap_id_u.uid = pid;
1562 		} else {
1563 			res->id.idtype = IDMAP_GID;
1564 			res->id.idmap_id_u.gid = pid;
1565 		}
1566 
1567 		/*
1568 		 * We may have an expired ephemeral mapping. Consider
1569 		 * the expired entry as valid if we are not going to
1570 		 * perform name-based mapping. But do not renew the
1571 		 * expiration.
1572 		 * If we will be doing name-based mapping then store the
1573 		 * ephemeral pid in the result so that we can use it
1574 		 * if we end up doing dynamic mapping again.
1575 		 */
1576 		if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) &&
1577 		    !AVOID_NAMESERVICE(req) &&
1578 		    IS_EPHEMERAL(pid) && values[2] != NULL) {
1579 			exp = strtoll(values[2], &end, 10);
1580 			if (exp && exp <= curtime) {
1581 				/* Store the ephemeral pid */
1582 				res->direction = IDMAP_DIRECTION_BI;
1583 				req->direction |= is_user
1584 				    ? _IDMAP_F_EXP_EPH_UID
1585 				    : _IDMAP_F_EXP_EPH_GID;
1586 				retcode = IDMAP_ERR_NOTFOUND;
1587 			}
1588 		}
1589 	}
1590 
1591 out:
1592 	if (retcode == IDMAP_SUCCESS) {
1593 		if (values[4] != NULL)
1594 			res->direction =
1595 			    (strtol(values[4], &end, 10) == 0)?
1596 			    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
1597 		else
1598 			res->direction = IDMAP_DIRECTION_W2U;
1599 
1600 		if (values[3] != NULL) {
1601 			if (req->id2name != NULL)
1602 				free(req->id2name);
1603 			req->id2name = strdup(values[3]);
1604 			if (req->id2name == NULL) {
1605 				idmapdlog(LOG_ERR, "Out of memory");
1606 				retcode = IDMAP_ERR_MEMORY;
1607 			}
1608 		}
1609 
1610 		req->id1.idtype = strncmp(values[5], "0", 2) ?
1611 		    IDMAP_USID : IDMAP_GSID;
1612 
1613 		if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
1614 			res->info.src = IDMAP_MAP_SRC_CACHE;
1615 			res->info.how.map_type = strtoul(values[6], &end, 10);
1616 			switch (res->info.how.map_type) {
1617 			case IDMAP_MAP_TYPE_DS_AD:
1618 				res->info.how.idmap_how_u.ad.dn =
1619 				    strdup(values[7]);
1620 				res->info.how.idmap_how_u.ad.attr =
1621 				    strdup(values[8]);
1622 				res->info.how.idmap_how_u.ad.value =
1623 				    strdup(values[9]);
1624 				break;
1625 
1626 			case IDMAP_MAP_TYPE_DS_NLDAP:
1627 				res->info.how.idmap_how_u.nldap.dn =
1628 				    strdup(values[7]);
1629 				res->info.how.idmap_how_u.nldap.attr =
1630 				    strdup(values[8]);
1631 				res->info.how.idmap_how_u.nldap.value =
1632 				    strdup(values[9]);
1633 				break;
1634 
1635 			case IDMAP_MAP_TYPE_RULE_BASED:
1636 				res->info.how.idmap_how_u.rule.windomain =
1637 				    strdup(values[10]);
1638 				res->info.how.idmap_how_u.rule.winname =
1639 				    strdup(values[11]);
1640 				res->info.how.idmap_how_u.rule.unixname =
1641 				    strdup(values[12]);
1642 				res->info.how.idmap_how_u.rule.is_nt4 =
1643 				    strtoul(values[13], &end, 1);
1644 				res->info.how.idmap_how_u.rule.is_user =
1645 				    is_user;
1646 				res->info.how.idmap_how_u.rule.is_wuser =
1647 				    strtoul(values[5], &end, 1);
1648 				break;
1649 
1650 			case IDMAP_MAP_TYPE_EPHEMERAL:
1651 				break;
1652 
1653 			case IDMAP_MAP_TYPE_LOCAL_SID:
1654 				break;
1655 
1656 			case IDMAP_MAP_TYPE_KNOWN_SID:
1657 				break;
1658 
1659 			default:
1660 				/* Unknow mapping type */
1661 				assert(FALSE);
1662 			}
1663 		}
1664 	}
1665 	if (vm != NULL)
1666 		(void) sqlite_finalize(vm, NULL);
1667 	return (retcode);
1668 }
1669 
1670 static
1671 idmap_retcode
1672 lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid,
1673 		char **name, char **domain, int *type)
1674 {
1675 	char		*end;
1676 	char		*sql = NULL;
1677 	const char	**values;
1678 	sqlite_vm	*vm = NULL;
1679 	int		ncol;
1680 	time_t		curtime;
1681 	idmap_retcode	retcode = IDMAP_SUCCESS;
1682 
1683 	/* Get current time */
1684 	errno = 0;
1685 	if ((curtime = time(NULL)) == (time_t)-1) {
1686 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1687 		    strerror(errno));
1688 		retcode = IDMAP_ERR_INTERNAL;
1689 		goto out;
1690 	}
1691 
1692 	/* SQL to lookup the cache */
1693 	sql = sqlite_mprintf("SELECT canon_name, domain, type "
1694 	    "FROM name_cache WHERE "
1695 	    "sidprefix = %Q AND rid = %u AND "
1696 	    "(expiration = 0 OR expiration ISNULL OR "
1697 	    "expiration > %d);",
1698 	    sidprefix, rid, curtime);
1699 	if (sql == NULL) {
1700 		idmapdlog(LOG_ERR, "Out of memory");
1701 		retcode = IDMAP_ERR_MEMORY;
1702 		goto out;
1703 	}
1704 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values);
1705 	sqlite_freemem(sql);
1706 
1707 	if (retcode == IDMAP_SUCCESS) {
1708 		if (type != NULL) {
1709 			if (values[2] == NULL) {
1710 				retcode = IDMAP_ERR_CACHE;
1711 				goto out;
1712 			}
1713 			*type = strtol(values[2], &end, 10);
1714 		}
1715 
1716 		if (name != NULL && values[0] != NULL) {
1717 			if ((*name = strdup(values[0])) == NULL) {
1718 				idmapdlog(LOG_ERR, "Out of memory");
1719 				retcode = IDMAP_ERR_MEMORY;
1720 				goto out;
1721 			}
1722 		}
1723 
1724 		if (domain != NULL && values[1] != NULL) {
1725 			if ((*domain = strdup(values[1])) == NULL) {
1726 				if (name != NULL && *name) {
1727 					free(*name);
1728 					*name = NULL;
1729 				}
1730 				idmapdlog(LOG_ERR, "Out of memory");
1731 				retcode = IDMAP_ERR_MEMORY;
1732 				goto out;
1733 			}
1734 		}
1735 	}
1736 
1737 out:
1738 	if (vm != NULL)
1739 		(void) sqlite_finalize(vm, NULL);
1740 	return (retcode);
1741 }
1742 
1743 /*
1744  * Given SID, find winname using name_cache OR
1745  * Given winname, find SID using name_cache.
1746  * Used when mapping win to unix i.e. req->id1 is windows id and
1747  * req->id2 is unix id
1748  */
1749 static
1750 idmap_retcode
1751 lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1752 {
1753 	int		type = -1;
1754 	idmap_retcode	retcode;
1755 	char		*sidprefix = NULL;
1756 	idmap_rid_t	rid;
1757 	char		*name = NULL, *domain = NULL;
1758 
1759 	/* Done if we've both sid and winname */
1760 	if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL)
1761 		return (IDMAP_SUCCESS);
1762 
1763 	/* Lookup sid to winname */
1764 	if (req->id1.idmap_id_u.sid.prefix != NULL) {
1765 		retcode = lookup_cache_sid2name(cache,
1766 		    req->id1.idmap_id_u.sid.prefix,
1767 		    req->id1.idmap_id_u.sid.rid, &name, &domain, &type);
1768 		goto out;
1769 	}
1770 
1771 	/* Lookup winame to sid */
1772 	retcode = lookup_cache_name2sid(cache, req->id1name, req->id1domain,
1773 	    &name, &sidprefix, &rid, &type);
1774 
1775 out:
1776 	if (retcode != IDMAP_SUCCESS) {
1777 		free(name);
1778 		free(domain);
1779 		free(sidprefix);
1780 		return (retcode);
1781 	}
1782 
1783 	if (res->id.idtype == IDMAP_POSIXID) {
1784 		res->id.idtype = (type == _IDMAP_T_USER) ?
1785 		    IDMAP_UID : IDMAP_GID;
1786 	}
1787 	req->id1.idtype = (type == _IDMAP_T_USER) ?
1788 	    IDMAP_USID : IDMAP_GSID;
1789 
1790 	req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
1791 	if (name != NULL) {
1792 		free(req->id1name);	/* Free existing winname */
1793 		req->id1name = name;	/* and use canonical name instead */
1794 	}
1795 	if (req->id1domain == NULL)
1796 		req->id1domain = domain;
1797 	if (req->id1.idmap_id_u.sid.prefix == NULL) {
1798 		req->id1.idmap_id_u.sid.prefix = sidprefix;
1799 		req->id1.idmap_id_u.sid.rid = rid;
1800 	}
1801 	return (retcode);
1802 }
1803 
1804 
1805 
1806 static int
1807 ad_lookup_batch_int(lookup_state_t *state, idmap_mapping_batch *batch,
1808 		idmap_ids_res *result, int index, int *num_processed)
1809 {
1810 	idmap_retcode	retcode;
1811 	int		i,  num_queued, type, is_wuser, is_user;
1812 	int		next_request;
1813 	int		retries = 0, eunixtype;
1814 	char		**unixname;
1815 	idmap_mapping	*req;
1816 	idmap_id_res	*res;
1817 	idmap_query_state_t	*qs = NULL;
1818 	idmap_how	*how;
1819 	char		**dn, **attr, **value;
1820 
1821 	*num_processed = 0;
1822 
1823 	/*
1824 	 * Since req->id2.idtype is unused, we will use it here
1825 	 * to retrieve the value of sid_type. But it needs to be
1826 	 * reset to IDMAP_NONE before we return to prevent xdr
1827 	 * from mis-interpreting req->id2 when it tries to free
1828 	 * the input argument. Other option is to allocate an
1829 	 * array of integers and use it instead for the batched
1830 	 * call. But why un-necessarily allocate memory. That may
1831 	 * be an option if req->id2.idtype cannot be re-used in
1832 	 * future.
1833 	 */
1834 retry:
1835 	retcode = idmap_lookup_batch_start(_idmapdstate.ads[index],
1836 	    state->ad_nqueries, &qs);
1837 	if (retcode != IDMAP_SUCCESS) {
1838 		if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
1839 		    retries++ < ADUTILS_DEF_NUM_RETRIES)
1840 			goto retry;
1841 		degrade_svc(1, "failed to create batch for AD lookup");
1842 			goto out;
1843 	}
1844 	num_queued = 0;
1845 
1846 	restore_svc();
1847 
1848 	if (index == 0) {
1849 		/*
1850 		 * Directory based name mapping is only performed within the
1851 		 * joined forest (index == 0).  We don't trust other "trusted"
1852 		 * forests to provide DS-based name mapping information because
1853 		 * AD's definition of "cross-forest trust" does not encompass
1854 		 * this sort of behavior.
1855 		 */
1856 		idmap_lookup_batch_set_unixattr(qs,
1857 		    state->ad_unixuser_attr, state->ad_unixgroup_attr);
1858 	}
1859 
1860 	for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
1861 		req = &batch->idmap_mapping_batch_val[i];
1862 		res = &result->ids.ids_val[i];
1863 		how = &res->info.how;
1864 
1865 		retcode = IDMAP_SUCCESS;
1866 		req->id2.idtype = IDMAP_NONE;
1867 
1868 		/* Skip if not marked for this AD lookup */
1869 		if (!(req->direction & _IDMAP_F_LOOKUP_AD) ||
1870 		    (req->direction & _IDMAP_F_LOOKUP_OTHER_AD))
1871 			continue;
1872 
1873 		if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR)
1874 			continue;
1875 
1876 		if (IS_REQUEST_SID(*req, 1)) {
1877 
1878 			/* win2unix request: */
1879 
1880 			unixname = dn = attr = value = NULL;
1881 			eunixtype = _IDMAP_T_UNDEF;
1882 			if (req->id2name == NULL) {
1883 				if (res->id.idtype == IDMAP_UID &&
1884 				    AD_OR_MIXED(state->nm_siduid)) {
1885 					eunixtype = _IDMAP_T_USER;
1886 					unixname = &req->id2name;
1887 				} else if (res->id.idtype == IDMAP_GID &&
1888 				    AD_OR_MIXED(state->nm_sidgid)) {
1889 					eunixtype = _IDMAP_T_GROUP;
1890 					unixname = &req->id2name;
1891 				} else if (AD_OR_MIXED(state->nm_siduid) ||
1892 				    AD_OR_MIXED(state->nm_sidgid)) {
1893 					unixname = &req->id2name;
1894 				}
1895 			}
1896 
1897 			if (unixname != NULL) {
1898 				/*
1899 				 * Get how info for DS-based name
1900 				 * mapping only if AD or MIXED
1901 				 * mode is enabled.
1902 				 */
1903 				idmap_info_free(&res->info);
1904 				res->info.src = IDMAP_MAP_SRC_NEW;
1905 				how->map_type = IDMAP_MAP_TYPE_DS_AD;
1906 				dn = &how->idmap_how_u.ad.dn;
1907 				attr = &how->idmap_how_u.ad.attr;
1908 				value = &how->idmap_how_u.ad.value;
1909 			}
1910 			if (req->id1.idmap_id_u.sid.prefix != NULL) {
1911 				/* Lookup AD by SID */
1912 				retcode = idmap_sid2name_batch_add1(
1913 				    qs, req->id1.idmap_id_u.sid.prefix,
1914 				    &req->id1.idmap_id_u.sid.rid, eunixtype,
1915 				    dn, attr, value,
1916 				    (req->id1name == NULL) ?
1917 				    &req->id1name : NULL,
1918 				    (req->id1domain == NULL) ?
1919 				    &req->id1domain : NULL,
1920 				    (int *)&req->id2.idtype, unixname,
1921 				    &res->retcode);
1922 				if (retcode == IDMAP_SUCCESS)
1923 					num_queued++;
1924 			} else {
1925 				/* Lookup AD by winname */
1926 				assert(req->id1name != NULL);
1927 				retcode = idmap_name2sid_batch_add1(
1928 				    qs, req->id1name, req->id1domain,
1929 				    eunixtype,
1930 				    dn, attr, value,
1931 				    &req->id1name,
1932 				    &req->id1.idmap_id_u.sid.prefix,
1933 				    &req->id1.idmap_id_u.sid.rid,
1934 				    (int *)&req->id2.idtype, unixname,
1935 				    &res->retcode);
1936 				if (retcode == IDMAP_SUCCESS)
1937 					num_queued++;
1938 			}
1939 
1940 		} else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) {
1941 
1942 			/* unix2win request: */
1943 
1944 			if (res->id.idmap_id_u.sid.prefix != NULL &&
1945 			    req->id2name != NULL) {
1946 				/* Already have SID and winname. done */
1947 				res->retcode = IDMAP_SUCCESS;
1948 				continue;
1949 			}
1950 
1951 			if (res->id.idmap_id_u.sid.prefix != NULL) {
1952 				/*
1953 				 * SID but no winname -- lookup AD by
1954 				 * SID to get winname.
1955 				 * how info is not needed here because
1956 				 * we are not retrieving unixname from
1957 				 * AD.
1958 				 */
1959 
1960 				retcode = idmap_sid2name_batch_add1(
1961 				    qs, res->id.idmap_id_u.sid.prefix,
1962 				    &res->id.idmap_id_u.sid.rid,
1963 				    _IDMAP_T_UNDEF,
1964 				    NULL, NULL, NULL,
1965 				    &req->id2name,
1966 				    &req->id2domain, (int *)&req->id2.idtype,
1967 				    NULL, &res->retcode);
1968 				if (retcode == IDMAP_SUCCESS)
1969 					num_queued++;
1970 			} else if (req->id2name != NULL) {
1971 				/*
1972 				 * winname but no SID -- lookup AD by
1973 				 * winname to get SID.
1974 				 * how info is not needed here because
1975 				 * we are not retrieving unixname from
1976 				 * AD.
1977 				 */
1978 				retcode = idmap_name2sid_batch_add1(
1979 				    qs, req->id2name, req->id2domain,
1980 				    _IDMAP_T_UNDEF,
1981 				    NULL, NULL, NULL, NULL,
1982 				    &res->id.idmap_id_u.sid.prefix,
1983 				    &res->id.idmap_id_u.sid.rid,
1984 				    (int *)&req->id2.idtype, NULL,
1985 				    &res->retcode);
1986 				if (retcode == IDMAP_SUCCESS)
1987 					num_queued++;
1988 			} else if (req->id1name != NULL) {
1989 				/*
1990 				 * No SID and no winname but we've unixname.
1991 				 * Lookup AD by unixname to get SID.
1992 				 */
1993 				is_user = (IS_REQUEST_UID(*req)) ? 1 : 0;
1994 				if (res->id.idtype == IDMAP_USID)
1995 					is_wuser = 1;
1996 				else if (res->id.idtype == IDMAP_GSID)
1997 					is_wuser = 0;
1998 				else
1999 					is_wuser = is_user;
2000 
2001 				idmap_info_free(&res->info);
2002 				res->info.src = IDMAP_MAP_SRC_NEW;
2003 				how->map_type = IDMAP_MAP_TYPE_DS_AD;
2004 				retcode = idmap_unixname2sid_batch_add1(
2005 				    qs, req->id1name, is_user, is_wuser,
2006 				    &how->idmap_how_u.ad.dn,
2007 				    &how->idmap_how_u.ad.attr,
2008 				    &how->idmap_how_u.ad.value,
2009 				    &res->id.idmap_id_u.sid.prefix,
2010 				    &res->id.idmap_id_u.sid.rid,
2011 				    &req->id2name, &req->id2domain,
2012 				    (int *)&req->id2.idtype, &res->retcode);
2013 				if (retcode == IDMAP_SUCCESS)
2014 					num_queued++;
2015 			}
2016 		}
2017 
2018 		if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) {
2019 			req->direction |= _IDMAP_F_LOOKUP_OTHER_AD;
2020 			retcode = IDMAP_SUCCESS;
2021 		} else if (retcode != IDMAP_SUCCESS) {
2022 			idmap_lookup_release_batch(&qs);
2023 			num_queued = 0;
2024 			next_request = i + 1;
2025 			break;
2026 		}
2027 	} /* End of for loop */
2028 
2029 	if (retcode == IDMAP_SUCCESS) {
2030 		/* add keeps track if we added an entry to the batch */
2031 		if (num_queued > 0)
2032 			retcode = idmap_lookup_batch_end(&qs);
2033 		else
2034 			idmap_lookup_release_batch(&qs);
2035 	}
2036 
2037 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
2038 	    retries++ < ADUTILS_DEF_NUM_RETRIES)
2039 		goto retry;
2040 	else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
2041 		degrade_svc(1, "some AD lookups timed out repeatedly");
2042 
2043 	if (retcode != IDMAP_SUCCESS) {
2044 		/* Mark any unproccessed requests for an other AD */
2045 		for (i = next_request; i < batch->idmap_mapping_batch_len;
2046 		    i++) {
2047 			req = &batch->idmap_mapping_batch_val[i];
2048 			req->direction |= _IDMAP_F_LOOKUP_OTHER_AD;
2049 
2050 		}
2051 	}
2052 
2053 	if (retcode != IDMAP_SUCCESS)
2054 		idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests");
2055 
2056 out:
2057 	/*
2058 	 * This loop does the following:
2059 	 * 1. Reset _IDMAP_F_LOOKUP_AD flag from the request.
2060 	 * 2. Reset req->id2.idtype to IDMAP_NONE
2061 	 * 3. If batch_start or batch_add failed then set the status
2062 	 *    of each request marked for AD lookup to that error.
2063 	 * 4. Evaluate the type of the AD object (i.e. user or group)
2064 	 *    and update the idtype in request.
2065 	 */
2066 	for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
2067 		req = &batch->idmap_mapping_batch_val[i];
2068 		type = req->id2.idtype;
2069 		req->id2.idtype = IDMAP_NONE;
2070 		res = &result->ids.ids_val[i];
2071 		how = &res->info.how;
2072 		if (!(req->direction & _IDMAP_F_LOOKUP_AD) ||
2073 		    (req->direction & _IDMAP_F_LOOKUP_OTHER_AD))
2074 			continue;
2075 
2076 		/* Count number processed */
2077 		(*num_processed)++;
2078 
2079 		/* Reset AD lookup flag */
2080 		req->direction &= ~(_IDMAP_F_LOOKUP_AD);
2081 
2082 		/*
2083 		 * If batch_start or batch_add failed then set the
2084 		 * status of each request marked for AD lookup to
2085 		 * that error.
2086 		 */
2087 		if (retcode != IDMAP_SUCCESS) {
2088 			res->retcode = retcode;
2089 			continue;
2090 		}
2091 
2092 		if (res->retcode == IDMAP_ERR_NOTFOUND) {
2093 			/* Nothing found - remove the preset info */
2094 			idmap_info_free(&res->info);
2095 		}
2096 
2097 		if (IS_REQUEST_SID(*req, 1)) {
2098 			if (res->retcode != IDMAP_SUCCESS)
2099 				continue;
2100 			/* Evaluate result type */
2101 			switch (type) {
2102 			case _IDMAP_T_USER:
2103 				if (res->id.idtype == IDMAP_POSIXID)
2104 					res->id.idtype = IDMAP_UID;
2105 				req->id1.idtype = IDMAP_USID;
2106 				break;
2107 
2108 			case _IDMAP_T_GROUP:
2109 				if (res->id.idtype == IDMAP_POSIXID)
2110 					res->id.idtype = IDMAP_GID;
2111 				req->id1.idtype = IDMAP_GSID;
2112 				break;
2113 
2114 			default:
2115 				res->retcode = IDMAP_ERR_SID;
2116 				break;
2117 			}
2118 			if (res->retcode == IDMAP_SUCCESS &&
2119 			    req->id1name != NULL &&
2120 			    (req->id2name == NULL ||
2121 			    res->id.idmap_id_u.uid == SENTINEL_PID) &&
2122 			    NLDAP_MODE(res->id.idtype, state)) {
2123 				req->direction |= _IDMAP_F_LOOKUP_NLDAP;
2124 				state->nldap_nqueries++;
2125 			}
2126 		} else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) {
2127 			if (res->retcode != IDMAP_SUCCESS) {
2128 				if ((!(IDMAP_FATAL_ERROR(res->retcode))) &&
2129 				    res->id.idmap_id_u.sid.prefix == NULL &&
2130 				    req->id2name == NULL && /* no winname */
2131 				    req->id1name != NULL) /* unixname */
2132 					/*
2133 					 * If AD lookup by unixname
2134 					 * failed with non fatal error
2135 					 * then clear the error (ie set
2136 					 * res->retcode to success).
2137 					 * This allows the next pass to
2138 					 * process other mapping
2139 					 * mechanisms for this request.
2140 					 */
2141 					res->retcode = IDMAP_SUCCESS;
2142 				continue;
2143 			}
2144 			/* Evaluate result type */
2145 			switch (type) {
2146 			case _IDMAP_T_USER:
2147 				if (res->id.idtype == IDMAP_SID)
2148 					res->id.idtype = IDMAP_USID;
2149 				break;
2150 
2151 			case _IDMAP_T_GROUP:
2152 				if (res->id.idtype == IDMAP_SID)
2153 					res->id.idtype = IDMAP_GSID;
2154 				break;
2155 
2156 			default:
2157 				res->retcode = IDMAP_ERR_SID;
2158 				break;
2159 			}
2160 		}
2161 	}
2162 
2163 	return (retcode);
2164 }
2165 
2166 
2167 
2168 /*
2169  * Batch AD lookups
2170  */
2171 idmap_retcode
2172 ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch,
2173 		idmap_ids_res *result)
2174 {
2175 	idmap_retcode	retcode;
2176 	int		i, j;
2177 	idmap_mapping	*req;
2178 	idmap_id_res	*res;
2179 	int		num_queries;
2180 	int		num_processed;
2181 
2182 	if (state->ad_nqueries == 0)
2183 		return (IDMAP_SUCCESS);
2184 
2185 	for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
2186 		req = &batch->idmap_mapping_batch_val[i];
2187 		res = &result->ids.ids_val[i];
2188 
2189 		/* Skip if not marked for AD lookup or already in error. */
2190 		if (!(req->direction & _IDMAP_F_LOOKUP_AD) ||
2191 		    res->retcode != IDMAP_SUCCESS)
2192 			continue;
2193 
2194 		/* Init status */
2195 		res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR;
2196 	}
2197 
2198 	RDLOCK_CONFIG();
2199 	num_queries = state->ad_nqueries;
2200 	if (_idmapdstate.num_ads > 0) {
2201 		for (i = 0; i < _idmapdstate.num_ads && num_queries > 0; i++) {
2202 
2203 			retcode = ad_lookup_batch_int(state, batch, result, i,
2204 			    &num_processed);
2205 			num_queries -= num_processed;
2206 
2207 			if (num_queries > 0) {
2208 				for (j = 0; j < batch->idmap_mapping_batch_len;
2209 				    j++) {
2210 					req =
2211 					    &batch->idmap_mapping_batch_val[j];
2212 					res = &result->ids.ids_val[j];
2213 					if (!(req->direction &
2214 					    _IDMAP_F_LOOKUP_AD))
2215 						continue;
2216 					/*
2217 					 * Reset the other AD lookup flag so
2218 					 * that we can try the next AD
2219 					 */
2220 					req->direction &=
2221 					    ~(_IDMAP_F_LOOKUP_OTHER_AD);
2222 
2223 					if ((i + 1) >= _idmapdstate.num_ads) {
2224 						/*
2225 						 * There are no more ADs to try
2226 						 */
2227 						req->direction &=
2228 						    ~(_IDMAP_F_LOOKUP_AD);
2229 						res->retcode =
2230 						    IDMAP_ERR_DOMAIN_NOTFOUND;
2231 					}
2232 				}
2233 			}
2234 		}
2235 	} else {
2236 		/* Case of no ADs */
2237 		retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
2238 		for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
2239 			req = &batch->idmap_mapping_batch_val[i];
2240 			res = &result->ids.ids_val[i];
2241 			if (!(req->direction & _IDMAP_F_LOOKUP_AD))
2242 				continue;
2243 			req->direction &= ~(_IDMAP_F_LOOKUP_AD);
2244 			res->retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
2245 		}
2246 	}
2247 	UNLOCK_CONFIG();
2248 
2249 	/* AD lookups done. Reset state->ad_nqueries and return */
2250 	state->ad_nqueries = 0;
2251 	return (retcode);
2252 }
2253 
2254 /*
2255  * Convention when processing win2unix requests:
2256  *
2257  * Windows identity:
2258  * req->id1name =
2259  *              winname if given otherwise winname found will be placed
2260  *              here.
2261  * req->id1domain =
2262  *              windomain if given otherwise windomain found will be
2263  *              placed here.
2264  * req->id1.idtype =
2265  *              Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll
2266  *              be set to IDMAP_USID/GSID depending upon whether the
2267  *              given SID is user or group respectively. The user/group-ness
2268  *              is determined either when looking up well-known SIDs table OR
2269  *              if the SID is found in namecache OR by ad_lookup_one() OR by
2270  *              ad_lookup_batch().
2271  * req->id1..sid.[prefix, rid] =
2272  *              SID if given otherwise SID found will be placed here.
2273  *
2274  * Unix identity:
2275  * req->id2name =
2276  *              unixname found will be placed here.
2277  * req->id2domain =
2278  *              NOT USED
2279  * res->id.idtype =
2280  *              Target type initialized from req->id2.idtype. If
2281  *              it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found
2282  *              will be placed here.
2283  * res->id..[uid or gid] =
2284  *              UID/GID found will be placed here.
2285  *
2286  * Others:
2287  * res->retcode =
2288  *              Return status for this request will be placed here.
2289  * res->direction =
2290  *              Direction found will be placed here. Direction
2291  *              meaning whether the resultant mapping is valid
2292  *              only from win2unix or bi-directional.
2293  * req->direction =
2294  *              INTERNAL USE. Used by idmapd to set various
2295  *              flags (_IDMAP_F_xxxx) to aid in processing
2296  *              of the request.
2297  * req->id2.idtype =
2298  *              INTERNAL USE. Initially this is the requested target
2299  *              type and is used to initialize res->id.idtype.
2300  *              ad_lookup_batch() uses this field temporarily to store
2301  *              sid_type obtained by the batched AD lookups and after
2302  *              use resets it to IDMAP_NONE to prevent xdr from
2303  *              mis-interpreting the contents of req->id2.
2304  * req->id2..[uid or gid or sid] =
2305  *              NOT USED
2306  */
2307 
2308 /*
2309  * This function does the following:
2310  * 1. Lookup well-known SIDs table.
2311  * 2. Check if the given SID is a local-SID and if so extract UID/GID from it.
2312  * 3. Lookup cache.
2313  * 4. Check if the client does not want new mapping to be allocated
2314  *    in which case this pass is the final pass.
2315  * 5. Set AD lookup flag if it determines that the next stage needs
2316  *    to do AD lookup.
2317  */
2318 idmap_retcode
2319 sid2pid_first_pass(lookup_state_t *state, idmap_mapping *req,
2320 		idmap_id_res *res)
2321 {
2322 	idmap_retcode	retcode;
2323 	int		wksid;
2324 
2325 	/* Initialize result */
2326 	res->id.idtype = req->id2.idtype;
2327 	res->id.idmap_id_u.uid = SENTINEL_PID;
2328 	res->direction = IDMAP_DIRECTION_UNDEF;
2329 	wksid = 0;
2330 
2331 	if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) {
2332 		if (req->id1name == NULL) {
2333 			retcode = IDMAP_ERR_ARG;
2334 			goto out;
2335 		}
2336 		/* sanitize sidprefix */
2337 		free(req->id1.idmap_id_u.sid.prefix);
2338 		req->id1.idmap_id_u.sid.prefix = NULL;
2339 	}
2340 
2341 	/* Lookup well-known SIDs table */
2342 	retcode = lookup_wksids_sid2pid(req, res, &wksid);
2343 	if (retcode != IDMAP_ERR_NOTFOUND)
2344 		goto out;
2345 
2346 	if (!wksid) {
2347 		/* Check if this is a localsid */
2348 		retcode = lookup_localsid2pid(req, res);
2349 		if (retcode != IDMAP_ERR_NOTFOUND)
2350 			goto out;
2351 
2352 		if (ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)) {
2353 			retcode = IDMAP_ERR_NONE_GENERATED;
2354 			goto out;
2355 		}
2356 	}
2357 
2358 	/* Lookup cache */
2359 	retcode = lookup_cache_sid2pid(state->cache, req, res);
2360 	if (retcode != IDMAP_ERR_NOTFOUND)
2361 		goto out;
2362 
2363 	if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) {
2364 		retcode = IDMAP_ERR_NONE_GENERATED;
2365 		goto out;
2366 	}
2367 
2368 	/*
2369 	 * Failed to find non-expired entry in cache. Next step is
2370 	 * to determine if this request needs to be batched for AD lookup.
2371 	 *
2372 	 * At this point we have either sid or winname or both. If we don't
2373 	 * have both then lookup name_cache for the sid or winname
2374 	 * whichever is missing. If not found then this request will be
2375 	 * batched for AD lookup.
2376 	 */
2377 	retcode = lookup_name_cache(state->cache, req, res);
2378 	if (retcode != IDMAP_SUCCESS && retcode != IDMAP_ERR_NOTFOUND)
2379 		goto out;
2380 
2381 	/*
2382 	 * Set the flag to indicate that we are not done yet so that
2383 	 * subsequent passes considers this request for name-based
2384 	 * mapping and ephemeral mapping.
2385 	 */
2386 	state->sid2pid_done = FALSE;
2387 	req->direction |= _IDMAP_F_NOTDONE;
2388 
2389 	/*
2390 	 * Even if we have both sid and winname, we still may need to batch
2391 	 * this request for AD lookup if we don't have unixname and
2392 	 * directory-based name mapping (AD or mixed) is enabled.
2393 	 * We avoid AD lookup for well-known SIDs because they don't have
2394 	 * regular AD objects.
2395 	 */
2396 	if (retcode != IDMAP_SUCCESS ||
2397 	    (!wksid && req->id2name == NULL &&
2398 	    AD_OR_MIXED_MODE(res->id.idtype, state))) {
2399 		retcode = IDMAP_SUCCESS;
2400 		req->direction |= _IDMAP_F_LOOKUP_AD;
2401 		state->ad_nqueries++;
2402 	} else if (NLDAP_MODE(res->id.idtype, state)) {
2403 		req->direction |= _IDMAP_F_LOOKUP_NLDAP;
2404 		state->nldap_nqueries++;
2405 	}
2406 
2407 
2408 out:
2409 	res->retcode = idmap_stat4prot(retcode);
2410 	/*
2411 	 * If we are done and there was an error then set fallback pid
2412 	 * in the result.
2413 	 */
2414 	if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS)
2415 		res->id.idmap_id_u.uid = UID_NOBODY;
2416 	return (retcode);
2417 }
2418 
2419 /*
2420  * Generate SID using the following convention
2421  * 	<machine-sid-prefix>-<1000 + uid>
2422  * 	<machine-sid-prefix>-<2^31 + gid>
2423  */
2424 static
2425 idmap_retcode
2426 generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user,
2427 		int fallback)
2428 {
2429 	free(res->id.idmap_id_u.sid.prefix);
2430 	res->id.idmap_id_u.sid.prefix = NULL;
2431 
2432 	/*
2433 	 * Diagonal mapping for localSIDs not supported because of the
2434 	 * way we generate localSIDs.
2435 	 */
2436 	if (is_user && res->id.idtype == IDMAP_GSID)
2437 		return (IDMAP_ERR_NOMAPPING);
2438 	if (!is_user && res->id.idtype == IDMAP_USID)
2439 		return (IDMAP_ERR_NOMAPPING);
2440 
2441 	/* Skip 1000 UIDs */
2442 	if (is_user && req->id1.idmap_id_u.uid >
2443 	    (INT32_MAX - LOCALRID_MIN))
2444 		return (IDMAP_ERR_NOMAPPING);
2445 
2446 	RDLOCK_CONFIG();
2447 	/*
2448 	 * machine_sid is never NULL because if it is we won't be here.
2449 	 * No need to assert because stdrup(NULL) will core anyways.
2450 	 */
2451 	res->id.idmap_id_u.sid.prefix =
2452 	    strdup(_idmapdstate.cfg->pgcfg.machine_sid);
2453 	if (res->id.idmap_id_u.sid.prefix == NULL) {
2454 		UNLOCK_CONFIG();
2455 		idmapdlog(LOG_ERR, "Out of memory");
2456 		return (IDMAP_ERR_MEMORY);
2457 	}
2458 	UNLOCK_CONFIG();
2459 	res->id.idmap_id_u.sid.rid =
2460 	    (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_MIN :
2461 	    req->id1.idmap_id_u.gid + INT32_MAX + 1;
2462 	res->direction = IDMAP_DIRECTION_BI;
2463 	if (res->id.idtype == IDMAP_SID)
2464 		res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
2465 
2466 	if (!fallback && req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
2467 		res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID;
2468 		res->info.src = IDMAP_MAP_SRC_ALGORITHMIC;
2469 	}
2470 
2471 	/*
2472 	 * Don't update name_cache because local sids don't have
2473 	 * valid windows names.
2474 	 */
2475 	req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
2476 	return (IDMAP_SUCCESS);
2477 }
2478 
2479 static
2480 idmap_retcode
2481 lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res)
2482 {
2483 	char		*sidprefix;
2484 	uint32_t	rid;
2485 	int		s;
2486 
2487 	/*
2488 	 * If the sidprefix == localsid then UID = last RID - 1000 or
2489 	 * GID = last RID - 2^31.
2490 	 */
2491 	if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL)
2492 		/* This means we are looking up by winname */
2493 		return (IDMAP_ERR_NOTFOUND);
2494 	rid = req->id1.idmap_id_u.sid.rid;
2495 
2496 	RDLOCK_CONFIG();
2497 	s = (_idmapdstate.cfg->pgcfg.machine_sid) ?
2498 	    strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1;
2499 	UNLOCK_CONFIG();
2500 
2501 	/*
2502 	 * If the given sidprefix does not match machine_sid then this is
2503 	 * not a local SID.
2504 	 */
2505 	if (s != 0)
2506 		return (IDMAP_ERR_NOTFOUND);
2507 
2508 	switch (res->id.idtype) {
2509 	case IDMAP_UID:
2510 		if (rid > INT32_MAX || rid < LOCALRID_MIN)
2511 			return (IDMAP_ERR_ARG);
2512 		res->id.idmap_id_u.uid = rid - LOCALRID_MIN;
2513 		break;
2514 	case IDMAP_GID:
2515 		if (rid <= INT32_MAX)
2516 			return (IDMAP_ERR_ARG);
2517 		res->id.idmap_id_u.gid = rid - INT32_MAX - 1;
2518 		break;
2519 	case IDMAP_POSIXID:
2520 		if (rid > INT32_MAX) {
2521 			res->id.idmap_id_u.gid = rid - INT32_MAX - 1;
2522 			res->id.idtype = IDMAP_GID;
2523 		} else if (rid < LOCALRID_MIN) {
2524 			return (IDMAP_ERR_ARG);
2525 		} else {
2526 			res->id.idmap_id_u.uid = rid - LOCALRID_MIN;
2527 			res->id.idtype = IDMAP_UID;
2528 		}
2529 		break;
2530 	default:
2531 		return (IDMAP_ERR_NOTSUPPORTED);
2532 	}
2533 	if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
2534 		res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID;
2535 		res->info.src = IDMAP_MAP_SRC_ALGORITHMIC;
2536 	}
2537 	return (IDMAP_SUCCESS);
2538 }
2539 
2540 /*
2541  * Name service lookup by unixname to get pid
2542  */
2543 static
2544 idmap_retcode
2545 ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id)
2546 {
2547 	struct passwd	pwd, *pwdp;
2548 	struct group	grp, *grpp;
2549 	char		buf[1024];
2550 	int		errnum;
2551 	const char	*me = "ns_lookup_byname";
2552 
2553 	switch (id->idtype) {
2554 	case IDMAP_UID:
2555 		pwdp = getpwnam_r(name, &pwd, buf, sizeof (buf));
2556 		if (pwdp == NULL && errno == 0 && lower_name != NULL &&
2557 		    name != lower_name && strcmp(name, lower_name) != 0)
2558 			pwdp = getpwnam_r(lower_name, &pwd, buf, sizeof (buf));
2559 		if (pwdp == NULL) {
2560 			errnum = errno;
2561 			idmapdlog(LOG_WARNING,
2562 			    "%s: getpwnam_r(%s) failed (%s).",
2563 			    me, name, errnum ? strerror(errnum) : "not found");
2564 			if (errnum == 0)
2565 				return (IDMAP_ERR_NOTFOUND);
2566 			else
2567 				return (IDMAP_ERR_INTERNAL);
2568 		}
2569 		id->idmap_id_u.uid = pwd.pw_uid;
2570 		break;
2571 	case IDMAP_GID:
2572 		grpp = getgrnam_r(name, &grp, buf, sizeof (buf));
2573 		if (grpp == NULL && errno == 0 && lower_name != NULL &&
2574 		    name != lower_name && strcmp(name, lower_name) != 0)
2575 			grpp = getgrnam_r(lower_name, &grp, buf, sizeof (buf));
2576 		if (grpp == NULL) {
2577 			errnum = errno;
2578 			idmapdlog(LOG_WARNING,
2579 			    "%s: getgrnam_r(%s) failed (%s).",
2580 			    me, name, errnum ? strerror(errnum) : "not found");
2581 			if (errnum == 0)
2582 				return (IDMAP_ERR_NOTFOUND);
2583 			else
2584 				return (IDMAP_ERR_INTERNAL);
2585 		}
2586 		id->idmap_id_u.gid = grp.gr_gid;
2587 		break;
2588 	default:
2589 		return (IDMAP_ERR_ARG);
2590 	}
2591 	return (IDMAP_SUCCESS);
2592 }
2593 
2594 
2595 /*
2596  * Name service lookup by pid to get unixname
2597  */
2598 static
2599 idmap_retcode
2600 ns_lookup_bypid(uid_t pid, int is_user, char **unixname)
2601 {
2602 	struct passwd	pwd;
2603 	struct group	grp;
2604 	char		buf[1024];
2605 	int		errnum;
2606 	const char	*me = "ns_lookup_bypid";
2607 
2608 	if (is_user) {
2609 		errno = 0;
2610 		if (getpwuid_r(pid, &pwd, buf, sizeof (buf)) == NULL) {
2611 			errnum = errno;
2612 			idmapdlog(LOG_WARNING,
2613 			    "%s: getpwuid_r(%u) failed (%s).",
2614 			    me, pid, errnum ? strerror(errnum) : "not found");
2615 			if (errnum == 0)
2616 				return (IDMAP_ERR_NOTFOUND);
2617 			else
2618 				return (IDMAP_ERR_INTERNAL);
2619 		}
2620 		*unixname = strdup(pwd.pw_name);
2621 	} else {
2622 		errno = 0;
2623 		if (getgrgid_r(pid, &grp, buf, sizeof (buf)) == NULL) {
2624 			errnum = errno;
2625 			idmapdlog(LOG_WARNING,
2626 			    "%s: getgrgid_r(%u) failed (%s).",
2627 			    me, pid, errnum ? strerror(errnum) : "not found");
2628 			if (errnum == 0)
2629 				return (IDMAP_ERR_NOTFOUND);
2630 			else
2631 				return (IDMAP_ERR_INTERNAL);
2632 		}
2633 		*unixname = strdup(grp.gr_name);
2634 	}
2635 	if (*unixname == NULL)
2636 		return (IDMAP_ERR_MEMORY);
2637 	return (IDMAP_SUCCESS);
2638 }
2639 
2640 /*
2641  * Name-based mapping
2642  *
2643  * Case 1: If no rule matches do ephemeral
2644  *
2645  * Case 2: If rule matches and unixname is "" then return no mapping.
2646  *
2647  * Case 3: If rule matches and unixname is specified then lookup name
2648  *  service using the unixname. If unixname not found then return no mapping.
2649  *
2650  * Case 4: If rule matches and unixname is * then lookup name service
2651  *  using winname as the unixname. If unixname not found then process
2652  *  other rules using the lookup order. If no other rule matches then do
2653  *  ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4.
2654  *  This allows us to specify a fallback unixname per _domain_ or no mapping
2655  *  instead of the default behaviour of doing ephemeral mapping.
2656  *
2657  * Example 1:
2658  * *@sfbay == *
2659  * If looking up windows users foo@sfbay and foo does not exists in
2660  * the name service then foo@sfbay will be mapped to an ephemeral id.
2661  *
2662  * Example 2:
2663  * *@sfbay == *
2664  * *@sfbay => guest
2665  * If looking up windows users foo@sfbay and foo does not exists in
2666  * the name service then foo@sfbay will be mapped to guest.
2667  *
2668  * Example 3:
2669  * *@sfbay == *
2670  * *@sfbay => ""
2671  * If looking up windows users foo@sfbay and foo does not exists in
2672  * the name service then we will return no mapping for foo@sfbay.
2673  *
2674  */
2675 static
2676 idmap_retcode
2677 name_based_mapping_sid2pid(lookup_state_t *state,
2678 		idmap_mapping *req, idmap_id_res *res)
2679 {
2680 	const char	*unixname, *windomain;
2681 	char		*sql = NULL, *errmsg = NULL, *lower_winname = NULL;
2682 	idmap_retcode	retcode;
2683 	char		*end, *lower_unixname, *winname;
2684 	const char	**values;
2685 	sqlite_vm	*vm = NULL;
2686 	int		ncol, r, i, is_user, is_wuser;
2687 	idmap_namerule	*rule = &res->info.how.idmap_how_u.rule;
2688 	int		direction;
2689 	const char	*me = "name_based_mapping_sid2pid";
2690 
2691 	assert(req->id1name != NULL); /* We have winname */
2692 	assert(req->id2name == NULL); /* We don't have unixname */
2693 
2694 	winname = req->id1name;
2695 	windomain = req->id1domain;
2696 
2697 	switch (req->id1.idtype) {
2698 	case IDMAP_USID:
2699 		is_wuser = 1;
2700 		break;
2701 	case IDMAP_GSID:
2702 		is_wuser = 0;
2703 		break;
2704 	default:
2705 		idmapdlog(LOG_ERR, "%s: Unable to determine if the "
2706 		    "given Windows id is user or group.", me);
2707 		return (IDMAP_ERR_INTERNAL);
2708 	}
2709 
2710 	switch (res->id.idtype) {
2711 	case IDMAP_UID:
2712 		is_user = 1;
2713 		break;
2714 	case IDMAP_GID:
2715 		is_user = 0;
2716 		break;
2717 	case IDMAP_POSIXID:
2718 		is_user = is_wuser;
2719 		res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID;
2720 		break;
2721 	}
2722 
2723 	i = 0;
2724 	if (windomain == NULL)
2725 		windomain = "";
2726 	else if (state->defdom != NULL &&
2727 	    strcasecmp(state->defdom, windomain) == 0)
2728 		i = 1;
2729 
2730 	if ((lower_winname = tolower_u8(winname)) == NULL)
2731 		lower_winname = winname;    /* hope for the best */
2732 	sql = sqlite_mprintf(
2733 	    "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 "
2734 	    "FROM namerules WHERE "
2735 	    "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND "
2736 	    "(winname = %Q OR winname = '*') AND "
2737 	    "(windomain = %Q OR windomain = '*' %s) "
2738 	    "ORDER BY w2u_order ASC;",
2739 	    is_user, is_wuser, lower_winname, windomain,
2740 	    i ? "OR windomain ISNULL OR windomain = ''" : "");
2741 	if (sql == NULL) {
2742 		idmapdlog(LOG_ERR, "Out of memory");
2743 		retcode = IDMAP_ERR_MEMORY;
2744 		goto out;
2745 	}
2746 
2747 	if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
2748 		retcode = IDMAP_ERR_INTERNAL;
2749 		idmapdlog(LOG_ERR, "%s: database error (%s)", me,
2750 		    CHECK_NULL(errmsg));
2751 		sqlite_freemem(errmsg);
2752 		goto out;
2753 	}
2754 
2755 	for (;;) {
2756 		r = sqlite_step(vm, &ncol, &values, NULL);
2757 		assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
2758 
2759 		if (r == SQLITE_ROW) {
2760 			if (ncol < 5) {
2761 				retcode = IDMAP_ERR_INTERNAL;
2762 				goto out;
2763 			}
2764 			if (values[0] == NULL) {
2765 				retcode = IDMAP_ERR_INTERNAL;
2766 				goto out;
2767 			}
2768 
2769 			if (values[1] != NULL)
2770 				direction =
2771 				    (strtol(values[1], &end, 10) == 0)?
2772 				    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
2773 			else
2774 				direction = IDMAP_DIRECTION_W2U;
2775 
2776 			if (EMPTY_NAME(values[0])) {
2777 				idmap_namerule_set(rule, values[3], values[2],
2778 				    values[0], is_wuser, is_user,
2779 				    strtol(values[4], &end, 10),
2780 				    direction);
2781 				retcode = IDMAP_ERR_NOMAPPING;
2782 				goto out;
2783 			}
2784 
2785 			if (values[0][0] == '*') {
2786 				unixname = winname;
2787 				lower_unixname = lower_winname;
2788 			} else {
2789 				unixname = values[0];
2790 				lower_unixname = NULL;
2791 			}
2792 
2793 			retcode = ns_lookup_byname(unixname, lower_unixname,
2794 			    &res->id);
2795 			if (retcode == IDMAP_ERR_NOTFOUND) {
2796 				if (values[0][0] == '*')
2797 					/* Case 4 */
2798 					continue;
2799 				else {
2800 					/* Case 3 */
2801 					idmap_namerule_set(rule, values[3],
2802 					    values[2], values[0], is_wuser,
2803 					    is_user,
2804 					    strtol(values[4], &end, 10),
2805 					    direction);
2806 					retcode = IDMAP_ERR_NOMAPPING;
2807 				}
2808 			}
2809 			goto out;
2810 		} else if (r == SQLITE_DONE) {
2811 			retcode = IDMAP_ERR_NOTFOUND;
2812 			goto out;
2813 		} else {
2814 			(void) sqlite_finalize(vm, &errmsg);
2815 			vm = NULL;
2816 			idmapdlog(LOG_ERR, "%s: database error (%s)", me,
2817 			    CHECK_NULL(errmsg));
2818 			sqlite_freemem(errmsg);
2819 			retcode = IDMAP_ERR_INTERNAL;
2820 			goto out;
2821 		}
2822 	}
2823 
2824 out:
2825 	if (sql != NULL)
2826 		sqlite_freemem(sql);
2827 	res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED;
2828 	if (retcode == IDMAP_SUCCESS) {
2829 		if (values[1] != NULL)
2830 			res->direction =
2831 			    (strtol(values[1], &end, 10) == 0)?
2832 			    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
2833 		else
2834 			res->direction = IDMAP_DIRECTION_W2U;
2835 
2836 		req->id2name = strdup(unixname);
2837 		if (req->id2name == NULL) {
2838 			retcode = IDMAP_ERR_MEMORY;
2839 		}
2840 	}
2841 
2842 	if (retcode == IDMAP_SUCCESS) {
2843 		idmap_namerule_set(rule, values[3], values[2],
2844 		    values[0], is_wuser, is_user, strtol(values[4], &end, 10),
2845 		    res->direction);
2846 		res->info.src = IDMAP_MAP_SRC_NEW;
2847 	}
2848 
2849 	if (lower_winname != NULL && lower_winname != winname)
2850 		free(lower_winname);
2851 	if (vm != NULL)
2852 		(void) sqlite_finalize(vm, NULL);
2853 	return (retcode);
2854 }
2855 
2856 static
2857 int
2858 get_next_eph_uid(uid_t *next_uid)
2859 {
2860 	uid_t uid;
2861 	gid_t gid;
2862 	int err;
2863 
2864 	*next_uid = (uid_t)-1;
2865 	uid = _idmapdstate.next_uid++;
2866 	if (uid >= _idmapdstate.limit_uid) {
2867 		if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0)
2868 			return (err);
2869 
2870 		_idmapdstate.limit_uid = uid + 8192;
2871 		_idmapdstate.next_uid = uid;
2872 	}
2873 	*next_uid = uid;
2874 
2875 	return (0);
2876 }
2877 
2878 static
2879 int
2880 get_next_eph_gid(gid_t *next_gid)
2881 {
2882 	uid_t uid;
2883 	gid_t gid;
2884 	int err;
2885 
2886 	*next_gid = (uid_t)-1;
2887 	gid = _idmapdstate.next_gid++;
2888 	if (gid >= _idmapdstate.limit_gid) {
2889 		if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0)
2890 			return (err);
2891 
2892 		_idmapdstate.limit_gid = gid + 8192;
2893 		_idmapdstate.next_gid = gid;
2894 	}
2895 	*next_gid = gid;
2896 
2897 	return (0);
2898 }
2899 
2900 static
2901 int
2902 gethash(const char *str, uint32_t num, uint_t htsize)
2903 {
2904 	uint_t  hval, i, len;
2905 
2906 	if (str == NULL)
2907 		return (0);
2908 	for (len = strlen(str), hval = 0, i = 0; i < len; i++) {
2909 		hval += str[i];
2910 		hval += (hval << 10);
2911 		hval ^= (hval >> 6);
2912 	}
2913 	for (str = (const char *)&num, i = 0; i < sizeof (num); i++) {
2914 		hval += str[i];
2915 		hval += (hval << 10);
2916 		hval ^= (hval >> 6);
2917 	}
2918 	hval += (hval << 3);
2919 	hval ^= (hval >> 11);
2920 	hval += (hval << 15);
2921 	return (hval % htsize);
2922 }
2923 
2924 static
2925 int
2926 get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid,
2927 		uid_t *pid)
2928 {
2929 	uint_t		next, key;
2930 	uint_t		htsize = state->sid_history_size;
2931 	idmap_sid	*sid;
2932 
2933 	next = gethash(prefix, rid, htsize);
2934 	while (next != htsize) {
2935 		key = state->sid_history[next].key;
2936 		if (key == htsize)
2937 			return (0);
2938 		sid = &state->batch->idmap_mapping_batch_val[key].id1.
2939 		    idmap_id_u.sid;
2940 		if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) {
2941 			*pid = state->result->ids.ids_val[key].id.
2942 			    idmap_id_u.uid;
2943 			return (1);
2944 		}
2945 		next = state->sid_history[next].next;
2946 	}
2947 	return (0);
2948 }
2949 
2950 static
2951 void
2952 add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid)
2953 {
2954 	uint_t		hash, next;
2955 	uint_t		htsize = state->sid_history_size;
2956 
2957 	hash = next = gethash(prefix, rid, htsize);
2958 	while (state->sid_history[next].key != htsize) {
2959 		next++;
2960 		next %= htsize;
2961 	}
2962 	state->sid_history[next].key = state->curpos;
2963 	if (hash == next)
2964 		return;
2965 	state->sid_history[next].next = state->sid_history[hash].next;
2966 	state->sid_history[hash].next = next;
2967 }
2968 
2969 void
2970 cleanup_lookup_state(lookup_state_t *state)
2971 {
2972 	free(state->sid_history);
2973 	free(state->ad_unixuser_attr);
2974 	free(state->ad_unixgroup_attr);
2975 	free(state->nldap_winname_attr);
2976 	free(state->defdom);
2977 }
2978 
2979 /* ARGSUSED */
2980 static
2981 idmap_retcode
2982 dynamic_ephemeral_mapping(lookup_state_t *state,
2983 		idmap_mapping *req, idmap_id_res *res)
2984 {
2985 
2986 	uid_t		next_pid;
2987 
2988 	res->direction = IDMAP_DIRECTION_BI;
2989 
2990 	if (IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
2991 		res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
2992 		res->info.src = IDMAP_MAP_SRC_CACHE;
2993 		return (IDMAP_SUCCESS);
2994 	}
2995 
2996 	if (state->sid_history != NULL &&
2997 	    get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix,
2998 	    req->id1.idmap_id_u.sid.rid, &next_pid)) {
2999 		res->id.idmap_id_u.uid = next_pid;
3000 		res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
3001 		res->info.src = IDMAP_MAP_SRC_NEW;
3002 		return (IDMAP_SUCCESS);
3003 	}
3004 
3005 	if (res->id.idtype == IDMAP_UID) {
3006 		if (get_next_eph_uid(&next_pid) != 0)
3007 			return (IDMAP_ERR_INTERNAL);
3008 		res->id.idmap_id_u.uid = next_pid;
3009 	} else {
3010 		if (get_next_eph_gid(&next_pid) != 0)
3011 			return (IDMAP_ERR_INTERNAL);
3012 		res->id.idmap_id_u.gid = next_pid;
3013 	}
3014 
3015 	res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
3016 	res->info.src = IDMAP_MAP_SRC_NEW;
3017 	if (state->sid_history != NULL)
3018 		add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix,
3019 		    req->id1.idmap_id_u.sid.rid);
3020 
3021 	return (IDMAP_SUCCESS);
3022 }
3023 
3024 idmap_retcode
3025 sid2pid_second_pass(lookup_state_t *state,
3026 		idmap_mapping *req, idmap_id_res *res)
3027 {
3028 	idmap_retcode	retcode;
3029 
3030 	/* Check if second pass is needed */
3031 	if (ARE_WE_DONE(req->direction))
3032 		return (res->retcode);
3033 
3034 	/* Get status from previous pass */
3035 	retcode = res->retcode;
3036 	if (retcode != IDMAP_SUCCESS && state->eph_map_unres_sids &&
3037 	    !EMPTY_STRING(req->id1.idmap_id_u.sid.prefix) &&
3038 	    EMPTY_STRING(req->id1name)) {
3039 		/*
3040 		 * We are asked to map an unresolvable SID to a UID or
3041 		 * GID, but, which?  We'll treat all unresolvable SIDs
3042 		 * as users unless the caller specified which of a UID
3043 		 * or GID they want.
3044 		 */
3045 		if (req->id1.idtype == IDMAP_SID)
3046 			req->id1.idtype = IDMAP_USID;
3047 		if (res->id.idtype == IDMAP_POSIXID)
3048 			res->id.idtype = IDMAP_UID;
3049 		goto do_eph;
3050 	}
3051 	if (retcode != IDMAP_SUCCESS)
3052 		goto out;
3053 
3054 	/*
3055 	 * If directory-based name mapping is enabled then the unixname
3056 	 * may already have been retrieved from the AD object (AD-mode or
3057 	 * mixed-mode) or from native LDAP object (nldap-mode) -- done.
3058 	 */
3059 	if (req->id2name != NULL) {
3060 		assert(res->id.idtype != IDMAP_POSIXID);
3061 		if (AD_MODE(res->id.idtype, state))
3062 			res->direction = IDMAP_DIRECTION_BI;
3063 		else if (NLDAP_MODE(res->id.idtype, state))
3064 			res->direction = IDMAP_DIRECTION_BI;
3065 		else if (MIXED_MODE(res->id.idtype, state))
3066 			res->direction = IDMAP_DIRECTION_W2U;
3067 
3068 		/*
3069 		 * Special case: (1) If the ad_unixuser_attr and
3070 		 * ad_unixgroup_attr uses the same attribute
3071 		 * name and (2) if this is a diagonal mapping
3072 		 * request and (3) the unixname has been retrieved
3073 		 * from the AD object -- then we ignore it and fallback
3074 		 * to name-based mapping rules and ephemeral mapping
3075 		 *
3076 		 * Example:
3077 		 *  Properties:
3078 		 *    config/ad_unixuser_attr = "unixname"
3079 		 *    config/ad_unixgroup_attr = "unixname"
3080 		 *  AD user object:
3081 		 *    dn: cn=bob ...
3082 		 *    objectclass: user
3083 		 *    sam: bob
3084 		 *    unixname: bob1234
3085 		 *  AD group object:
3086 		 *    dn: cn=winadmins ...
3087 		 *    objectclass: group
3088 		 *    sam: winadmins
3089 		 *    unixname: unixadmins
3090 		 *
3091 		 *  In this example whether "unixname" refers to a unixuser
3092 		 *  or unixgroup depends upon the AD object.
3093 		 *
3094 		 * $idmap show -c winname:bob gid
3095 		 *    AD lookup by "samAccountName=bob" for
3096 		 *    "ad_unixgroup_attr (i.e unixname)" for directory-based
3097 		 *    mapping would get "bob1234" which is not what we want.
3098 		 *    Now why not getgrnam_r("bob1234") and use it if it
3099 		 *    is indeed a unixgroup? That's because Unix can have
3100 		 *    users and groups with the same name and we clearly
3101 		 *    don't know the intention of the admin here.
3102 		 *    Therefore we ignore this and fallback to name-based
3103 		 *    mapping rules or ephemeral mapping.
3104 		 */
3105 		if ((AD_MODE(res->id.idtype, state) ||
3106 		    MIXED_MODE(res->id.idtype, state)) &&
3107 		    state->ad_unixuser_attr != NULL &&
3108 		    state->ad_unixgroup_attr != NULL &&
3109 		    strcasecmp(state->ad_unixuser_attr,
3110 		    state->ad_unixgroup_attr) == 0 &&
3111 		    ((req->id1.idtype == IDMAP_USID &&
3112 		    res->id.idtype == IDMAP_GID) ||
3113 		    (req->id1.idtype == IDMAP_GSID &&
3114 		    res->id.idtype == IDMAP_UID))) {
3115 			free(req->id2name);
3116 			req->id2name = NULL;
3117 			res->id.idmap_id_u.uid = SENTINEL_PID;
3118 			/* fallback */
3119 		} else {
3120 			if (res->id.idmap_id_u.uid == SENTINEL_PID)
3121 				retcode = ns_lookup_byname(req->id2name,
3122 				    NULL, &res->id);
3123 			/*
3124 			 * If ns_lookup_byname() fails that means the
3125 			 * unixname (req->id2name), which was obtained
3126 			 * from the AD object by directory-based mapping,
3127 			 * is not a valid Unix user/group and therefore
3128 			 * we return the error to the client instead of
3129 			 * doing rule-based mapping or ephemeral mapping.
3130 			 * This way the client can detect the issue.
3131 			 */
3132 			goto out;
3133 		}
3134 	}
3135 
3136 	/* Free any mapping info from Directory based mapping */
3137 	if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN)
3138 		idmap_info_free(&res->info);
3139 
3140 	/*
3141 	 * If we don't have unixname then evaluate local name-based
3142 	 * mapping rules.
3143 	 */
3144 	retcode = name_based_mapping_sid2pid(state, req, res);
3145 	if (retcode != IDMAP_ERR_NOTFOUND)
3146 		goto out;
3147 
3148 do_eph:
3149 	/* If not found, do ephemeral mapping */
3150 	retcode = dynamic_ephemeral_mapping(state, req, res);
3151 
3152 out:
3153 	res->retcode = idmap_stat4prot(retcode);
3154 	if (res->retcode != IDMAP_SUCCESS) {
3155 		req->direction = _IDMAP_F_DONE;
3156 		res->id.idmap_id_u.uid = UID_NOBODY;
3157 	}
3158 	if (!ARE_WE_DONE(req->direction))
3159 		state->sid2pid_done = FALSE;
3160 	return (retcode);
3161 }
3162 
3163 idmap_retcode
3164 update_cache_pid2sid(lookup_state_t *state,
3165 		idmap_mapping *req, idmap_id_res *res)
3166 {
3167 	char		*sql = NULL;
3168 	idmap_retcode	retcode;
3169 	char		*map_dn = NULL;
3170 	char		*map_attr = NULL;
3171 	char		*map_value = NULL;
3172 	char 		*map_windomain = NULL;
3173 	char		*map_winname = NULL;
3174 	char		*map_unixname = NULL;
3175 	int		map_is_nt4 = FALSE;
3176 
3177 	/* Check if we need to cache anything */
3178 	if (ARE_WE_DONE(req->direction))
3179 		return (IDMAP_SUCCESS);
3180 
3181 	/* We don't cache negative entries */
3182 	if (res->retcode != IDMAP_SUCCESS)
3183 		return (IDMAP_SUCCESS);
3184 
3185 	assert(res->direction != IDMAP_DIRECTION_UNDEF);
3186 	assert(req->id1.idmap_id_u.uid != SENTINEL_PID);
3187 	assert(res->id.idtype != IDMAP_SID);
3188 
3189 	assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN);
3190 	switch (res->info.how.map_type) {
3191 	case IDMAP_MAP_TYPE_DS_AD:
3192 		map_dn = res->info.how.idmap_how_u.ad.dn;
3193 		map_attr = res->info.how.idmap_how_u.ad.attr;
3194 		map_value = res->info.how.idmap_how_u.ad.value;
3195 		break;
3196 
3197 	case IDMAP_MAP_TYPE_DS_NLDAP:
3198 		map_dn = res->info.how.idmap_how_u.nldap.dn;
3199 		map_attr = res->info.how.idmap_how_u.nldap.attr;
3200 		map_value = res->info.how.idmap_how_u.nldap.value;
3201 		break;
3202 
3203 	case IDMAP_MAP_TYPE_RULE_BASED:
3204 		map_windomain = res->info.how.idmap_how_u.rule.windomain;
3205 		map_winname = res->info.how.idmap_how_u.rule.winname;
3206 		map_unixname = res->info.how.idmap_how_u.rule.unixname;
3207 		map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4;
3208 		break;
3209 
3210 	case IDMAP_MAP_TYPE_EPHEMERAL:
3211 		break;
3212 
3213 	case IDMAP_MAP_TYPE_LOCAL_SID:
3214 		break;
3215 
3216 	default:
3217 		/* Dont cache other mapping types */
3218 		assert(FALSE);
3219 	}
3220 
3221 	/*
3222 	 * Using NULL for u2w instead of 0 so that our trigger allows
3223 	 * the same pid to be the destination in multiple entries
3224 	 */
3225 	sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
3226 	    "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
3227 	    "is_user, is_wuser, expiration, w2u, u2w, "
3228 	    "map_type, map_dn, map_attr, map_value, map_windomain, "
3229 	    "map_winname, map_unixname, map_is_nt4) "
3230 	    "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
3231 	    "strftime('%%s','now') + 600, %q, 1, "
3232 	    "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ",
3233 	    res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
3234 	    req->id2domain, req->id2name, req->id1.idmap_id_u.uid,
3235 	    req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0,
3236 	    (res->id.idtype == IDMAP_USID) ? 1 : 0,
3237 	    (res->direction == 0) ? "1" : NULL,
3238 	    res->info.how.map_type, map_dn, map_attr, map_value,
3239 	    map_windomain, map_winname, map_unixname, map_is_nt4);
3240 
3241 	if (sql == NULL) {
3242 		retcode = IDMAP_ERR_INTERNAL;
3243 		idmapdlog(LOG_ERR, "Out of memory");
3244 		goto out;
3245 	}
3246 
3247 	retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3248 	if (retcode != IDMAP_SUCCESS)
3249 		goto out;
3250 
3251 	state->pid2sid_done = FALSE;
3252 	sqlite_freemem(sql);
3253 	sql = NULL;
3254 
3255 	/* Check if we need to update namecache */
3256 	if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
3257 		goto out;
3258 
3259 	if (req->id2name == NULL)
3260 		goto out;
3261 
3262 	sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
3263 	    "(sidprefix, rid, canon_name, domain, type, expiration) "
3264 	    "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
3265 	    res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
3266 	    req->id2name, req->id2domain,
3267 	    (res->id.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP);
3268 
3269 	if (sql == NULL) {
3270 		retcode = IDMAP_ERR_INTERNAL;
3271 		idmapdlog(LOG_ERR, "Out of memory");
3272 		goto out;
3273 	}
3274 
3275 	retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3276 
3277 out:
3278 	if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO))
3279 		idmap_info_free(&res->info);
3280 	if (sql != NULL)
3281 		sqlite_freemem(sql);
3282 	return (retcode);
3283 }
3284 
3285 idmap_retcode
3286 update_cache_sid2pid(lookup_state_t *state,
3287 		idmap_mapping *req, idmap_id_res *res)
3288 {
3289 	char		*sql = NULL;
3290 	idmap_retcode	retcode;
3291 	int		is_eph_user;
3292 	char		*map_dn = NULL;
3293 	char		*map_attr = NULL;
3294 	char		*map_value = NULL;
3295 	char 		*map_windomain = NULL;
3296 	char		*map_winname = NULL;
3297 	char		*map_unixname = NULL;
3298 	int		map_is_nt4 = FALSE;
3299 
3300 	/* Check if we need to cache anything */
3301 	if (ARE_WE_DONE(req->direction))
3302 		return (IDMAP_SUCCESS);
3303 
3304 	/* We don't cache negative entries */
3305 	if (res->retcode != IDMAP_SUCCESS)
3306 		return (IDMAP_SUCCESS);
3307 
3308 	if (req->direction & _IDMAP_F_EXP_EPH_UID)
3309 		is_eph_user = 1;
3310 	else if (req->direction & _IDMAP_F_EXP_EPH_GID)
3311 		is_eph_user = 0;
3312 	else
3313 		is_eph_user = -1;
3314 
3315 	if (is_eph_user >= 0 && !IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
3316 		sql = sqlite_mprintf("UPDATE idmap_cache "
3317 		    "SET w2u = 0 WHERE "
3318 		    "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
3319 		    "pid >= 2147483648 AND is_user = %d;",
3320 		    req->id1.idmap_id_u.sid.prefix,
3321 		    req->id1.idmap_id_u.sid.rid,
3322 		    is_eph_user);
3323 		if (sql == NULL) {
3324 			retcode = IDMAP_ERR_INTERNAL;
3325 			idmapdlog(LOG_ERR, "Out of memory");
3326 			goto out;
3327 		}
3328 
3329 		retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3330 		if (retcode != IDMAP_SUCCESS)
3331 			goto out;
3332 
3333 		sqlite_freemem(sql);
3334 		sql = NULL;
3335 	}
3336 
3337 	assert(res->direction != IDMAP_DIRECTION_UNDEF);
3338 	assert(res->id.idmap_id_u.uid != SENTINEL_PID);
3339 
3340 	switch (res->info.how.map_type) {
3341 	case IDMAP_MAP_TYPE_DS_AD:
3342 		map_dn = res->info.how.idmap_how_u.ad.dn;
3343 		map_attr = res->info.how.idmap_how_u.ad.attr;
3344 		map_value = res->info.how.idmap_how_u.ad.value;
3345 		break;
3346 
3347 	case IDMAP_MAP_TYPE_DS_NLDAP:
3348 		map_dn = res->info.how.idmap_how_u.nldap.dn;
3349 		map_attr = res->info.how.idmap_how_u.ad.attr;
3350 		map_value = res->info.how.idmap_how_u.nldap.value;
3351 		break;
3352 
3353 	case IDMAP_MAP_TYPE_RULE_BASED:
3354 		map_windomain = res->info.how.idmap_how_u.rule.windomain;
3355 		map_winname = res->info.how.idmap_how_u.rule.winname;
3356 		map_unixname = res->info.how.idmap_how_u.rule.unixname;
3357 		map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4;
3358 		break;
3359 
3360 	case IDMAP_MAP_TYPE_EPHEMERAL:
3361 		break;
3362 
3363 	default:
3364 		/* Dont cache other mapping types */
3365 		assert(FALSE);
3366 	}
3367 
3368 	sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
3369 	    "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
3370 	    "is_user, is_wuser, expiration, w2u, u2w, "
3371 	    "map_type, map_dn, map_attr, map_value, map_windomain, "
3372 	    "map_winname, map_unixname, map_is_nt4) "
3373 	    "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
3374 	    "strftime('%%s','now') + 600, 1, %q, "
3375 	    "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);",
3376 	    req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
3377 	    (req->id1domain != NULL) ? req->id1domain : "", req->id1name,
3378 	    res->id.idmap_id_u.uid, req->id2name,
3379 	    (res->id.idtype == IDMAP_UID) ? 1 : 0,
3380 	    (req->id1.idtype == IDMAP_USID) ? 1 : 0,
3381 	    (res->direction == 0) ? "1" : NULL,
3382 	    res->info.how.map_type, map_dn, map_attr, map_value,
3383 	    map_windomain, map_winname, map_unixname, map_is_nt4);
3384 
3385 	if (sql == NULL) {
3386 		retcode = IDMAP_ERR_INTERNAL;
3387 		idmapdlog(LOG_ERR, "Out of memory");
3388 		goto out;
3389 	}
3390 
3391 	retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3392 	if (retcode != IDMAP_SUCCESS)
3393 		goto out;
3394 
3395 	state->sid2pid_done = FALSE;
3396 	sqlite_freemem(sql);
3397 	sql = NULL;
3398 
3399 	/* Check if we need to update namecache */
3400 	if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
3401 		goto out;
3402 
3403 	if (EMPTY_STRING(req->id1name))
3404 		goto out;
3405 
3406 	sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
3407 	    "(sidprefix, rid, canon_name, domain, type, expiration) "
3408 	    "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
3409 	    req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
3410 	    req->id1name, req->id1domain,
3411 	    (req->id1.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP);
3412 
3413 	if (sql == NULL) {
3414 		retcode = IDMAP_ERR_INTERNAL;
3415 		idmapdlog(LOG_ERR, "Out of memory");
3416 		goto out;
3417 	}
3418 
3419 	retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3420 
3421 out:
3422 	if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO))
3423 		idmap_info_free(&res->info);
3424 
3425 	if (sql != NULL)
3426 		sqlite_freemem(sql);
3427 	return (retcode);
3428 }
3429 
3430 static
3431 idmap_retcode
3432 lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res,
3433 		int is_user, int getname)
3434 {
3435 	char		*end;
3436 	char		*sql = NULL;
3437 	const char	**values;
3438 	sqlite_vm	*vm = NULL;
3439 	int		ncol;
3440 	idmap_retcode	retcode = IDMAP_SUCCESS;
3441 	time_t		curtime;
3442 	idmap_id_type	idtype;
3443 
3444 	/* Current time */
3445 	errno = 0;
3446 	if ((curtime = time(NULL)) == (time_t)-1) {
3447 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
3448 		    strerror(errno));
3449 		retcode = IDMAP_ERR_INTERNAL;
3450 		goto out;
3451 	}
3452 
3453 	/* SQL to lookup the cache by pid or by unixname */
3454 	if (req->id1.idmap_id_u.uid != SENTINEL_PID) {
3455 		sql = sqlite_mprintf("SELECT sidprefix, rid, "
3456 		    "canon_winname, windomain, w2u, is_wuser, "
3457 		    "map_type, map_dn, map_attr, map_value, map_windomain, "
3458 		    "map_winname, map_unixname, map_is_nt4 "
3459 		    "FROM idmap_cache WHERE "
3460 		    "pid = %u AND u2w = 1 AND is_user = %d AND "
3461 		    "(pid >= 2147483648 OR "
3462 		    "(expiration = 0 OR expiration ISNULL OR "
3463 		    "expiration > %d));",
3464 		    req->id1.idmap_id_u.uid, is_user, curtime);
3465 	} else if (req->id1name != NULL) {
3466 		sql = sqlite_mprintf("SELECT sidprefix, rid, "
3467 		    "canon_winname, windomain, w2u, is_wuser, "
3468 		    "map_type, map_dn, map_attr, map_value, map_windomain, "
3469 		    "map_winname, map_unixname, map_is_nt4 "
3470 		    "FROM idmap_cache WHERE "
3471 		    "unixname = %Q AND u2w = 1 AND is_user = %d AND "
3472 		    "(pid >= 2147483648 OR "
3473 		    "(expiration = 0 OR expiration ISNULL OR "
3474 		    "expiration > %d));",
3475 		    req->id1name, is_user, curtime);
3476 	} else {
3477 		retcode = IDMAP_ERR_ARG;
3478 		goto out;
3479 	}
3480 
3481 	if (sql == NULL) {
3482 		idmapdlog(LOG_ERR, "Out of memory");
3483 		retcode = IDMAP_ERR_MEMORY;
3484 		goto out;
3485 	}
3486 	retcode = sql_compile_n_step_once(
3487 	    cache, sql, &vm, &ncol, 14, &values);
3488 	sqlite_freemem(sql);
3489 
3490 	if (retcode == IDMAP_ERR_NOTFOUND)
3491 		goto out;
3492 	else if (retcode == IDMAP_SUCCESS) {
3493 		/* sanity checks */
3494 		if (values[0] == NULL || values[1] == NULL) {
3495 			retcode = IDMAP_ERR_CACHE;
3496 			goto out;
3497 		}
3498 
3499 		switch (res->id.idtype) {
3500 		case IDMAP_SID:
3501 		case IDMAP_USID:
3502 		case IDMAP_GSID:
3503 			idtype = strtol(values[5], &end, 10) == 1
3504 			    ? IDMAP_USID : IDMAP_GSID;
3505 
3506 			if (res->id.idtype == IDMAP_USID &&
3507 			    idtype != IDMAP_USID) {
3508 				retcode = IDMAP_ERR_NOTUSER;
3509 				goto out;
3510 			} else if (res->id.idtype == IDMAP_GSID &&
3511 			    idtype != IDMAP_GSID) {
3512 				retcode = IDMAP_ERR_NOTGROUP;
3513 				goto out;
3514 			}
3515 			res->id.idtype = idtype;
3516 
3517 			res->id.idmap_id_u.sid.rid =
3518 			    strtoul(values[1], &end, 10);
3519 			res->id.idmap_id_u.sid.prefix = strdup(values[0]);
3520 			if (res->id.idmap_id_u.sid.prefix == NULL) {
3521 				idmapdlog(LOG_ERR, "Out of memory");
3522 				retcode = IDMAP_ERR_MEMORY;
3523 				goto out;
3524 			}
3525 
3526 			if (values[4] != NULL)
3527 				res->direction =
3528 				    (strtol(values[4], &end, 10) == 0)?
3529 				    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
3530 			else
3531 				res->direction = IDMAP_DIRECTION_U2W;
3532 
3533 			if (getname == 0 || values[2] == NULL)
3534 				break;
3535 			req->id2name = strdup(values[2]);
3536 			if (req->id2name == NULL) {
3537 				idmapdlog(LOG_ERR, "Out of memory");
3538 				retcode = IDMAP_ERR_MEMORY;
3539 				goto out;
3540 			}
3541 
3542 			if (values[3] == NULL)
3543 				break;
3544 			req->id2domain = strdup(values[3]);
3545 			if (req->id2domain == NULL) {
3546 				idmapdlog(LOG_ERR, "Out of memory");
3547 				retcode = IDMAP_ERR_MEMORY;
3548 				goto out;
3549 			}
3550 
3551 			break;
3552 		default:
3553 			retcode = IDMAP_ERR_NOTSUPPORTED;
3554 			break;
3555 		}
3556 		if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
3557 			res->info.src = IDMAP_MAP_SRC_CACHE;
3558 			res->info.how.map_type = strtoul(values[6], &end, 10);
3559 			switch (res->info.how.map_type) {
3560 			case IDMAP_MAP_TYPE_DS_AD:
3561 				res->info.how.idmap_how_u.ad.dn =
3562 				    strdup(values[7]);
3563 				res->info.how.idmap_how_u.ad.attr =
3564 				    strdup(values[8]);
3565 				res->info.how.idmap_how_u.ad.value =
3566 				    strdup(values[9]);
3567 				break;
3568 
3569 			case IDMAP_MAP_TYPE_DS_NLDAP:
3570 				res->info.how.idmap_how_u.nldap.dn =
3571 				    strdup(values[7]);
3572 				res->info.how.idmap_how_u.nldap.attr =
3573 				    strdup(values[8]);
3574 				res->info.how.idmap_how_u.nldap.value =
3575 				    strdup(values[9]);
3576 				break;
3577 
3578 			case IDMAP_MAP_TYPE_RULE_BASED:
3579 				res->info.how.idmap_how_u.rule.windomain =
3580 				    strdup(values[10]);
3581 				res->info.how.idmap_how_u.rule.winname =
3582 				    strdup(values[11]);
3583 				res->info.how.idmap_how_u.rule.unixname =
3584 				    strdup(values[12]);
3585 				res->info.how.idmap_how_u.rule.is_nt4 =
3586 				    strtoul(values[13], &end, 10);
3587 				res->info.how.idmap_how_u.rule.is_user =
3588 				    is_user;
3589 				res->info.how.idmap_how_u.rule.is_wuser =
3590 				    strtol(values[5], &end, 10);
3591 				break;
3592 
3593 			case IDMAP_MAP_TYPE_EPHEMERAL:
3594 				break;
3595 
3596 			case IDMAP_MAP_TYPE_LOCAL_SID:
3597 				break;
3598 
3599 			case IDMAP_MAP_TYPE_KNOWN_SID:
3600 				break;
3601 
3602 			default:
3603 				/* Unknow mapping type */
3604 				assert(FALSE);
3605 			}
3606 		}
3607 	}
3608 
3609 out:
3610 	if (vm != NULL)
3611 		(void) sqlite_finalize(vm, NULL);
3612 	return (retcode);
3613 }
3614 
3615 static
3616 idmap_retcode
3617 lookup_cache_name2sid(sqlite *cache, const char *name, const char *domain,
3618 	char **canonname, char **sidprefix, idmap_rid_t *rid, int *type)
3619 {
3620 	char		*end, *lower_name;
3621 	char		*sql = NULL;
3622 	const char	**values;
3623 	sqlite_vm	*vm = NULL;
3624 	int		ncol;
3625 	time_t		curtime;
3626 	idmap_retcode	retcode = IDMAP_SUCCESS;
3627 
3628 	/* Get current time */
3629 	errno = 0;
3630 	if ((curtime = time(NULL)) == (time_t)-1) {
3631 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
3632 		    strerror(errno));
3633 		retcode = IDMAP_ERR_INTERNAL;
3634 		goto out;
3635 	}
3636 
3637 	/* SQL to lookup the cache */
3638 	if ((lower_name = tolower_u8(name)) == NULL)
3639 		lower_name = (char *)name;
3640 	sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name "
3641 	    "FROM name_cache WHERE name = %Q AND domain = %Q AND "
3642 	    "(expiration = 0 OR expiration ISNULL OR "
3643 	    "expiration > %d);", lower_name, domain, curtime);
3644 	if (lower_name != name)
3645 		free(lower_name);
3646 	if (sql == NULL) {
3647 		idmapdlog(LOG_ERR, "Out of memory");
3648 		retcode = IDMAP_ERR_MEMORY;
3649 		goto out;
3650 	}
3651 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values);
3652 	sqlite_freemem(sql);
3653 
3654 	if (retcode == IDMAP_SUCCESS) {
3655 		if (type != NULL) {
3656 			if (values[2] == NULL) {
3657 				retcode = IDMAP_ERR_CACHE;
3658 				goto out;
3659 			}
3660 			*type = strtol(values[2], &end, 10);
3661 		}
3662 
3663 		if (values[0] == NULL || values[1] == NULL) {
3664 			retcode = IDMAP_ERR_CACHE;
3665 			goto out;
3666 		}
3667 
3668 		if (canonname != NULL) {
3669 			assert(values[3] != NULL);
3670 			if ((*canonname = strdup(values[3])) == NULL) {
3671 				idmapdlog(LOG_ERR, "Out of memory");
3672 				retcode = IDMAP_ERR_MEMORY;
3673 				goto out;
3674 			}
3675 		}
3676 
3677 		if ((*sidprefix = strdup(values[0])) == NULL) {
3678 			idmapdlog(LOG_ERR, "Out of memory");
3679 			retcode = IDMAP_ERR_MEMORY;
3680 			if (canonname != NULL) {
3681 				free(*canonname);
3682 				*canonname = NULL;
3683 			}
3684 			goto out;
3685 		}
3686 		*rid = strtoul(values[1], &end, 10);
3687 	}
3688 
3689 out:
3690 	if (vm != NULL)
3691 		(void) sqlite_finalize(vm, NULL);
3692 	return (retcode);
3693 }
3694 
3695 static
3696 idmap_retcode
3697 ad_lookup_by_winname(lookup_state_t *state,
3698 		const char *name, const char *domain, int eunixtype,
3699 		char **dn, char **attr, char **value, char **canonname,
3700 		char **sidprefix, idmap_rid_t *rid, int *wintype,
3701 		char **unixname)
3702 {
3703 	int			retries;
3704 	idmap_query_state_t	*qs = NULL;
3705 	idmap_retcode		rc, retcode;
3706 	int			i;
3707 	int			found_ad = 0;
3708 
3709 	RDLOCK_CONFIG();
3710 	if (_idmapdstate.num_ads > 0) {
3711 		for (i = 0; i < _idmapdstate.num_ads && !found_ad; i++) {
3712 			retries = 0;
3713 retry:
3714 			retcode = idmap_lookup_batch_start(_idmapdstate.ads[i],
3715 			    1, &qs);
3716 			if (retcode != IDMAP_SUCCESS) {
3717 				if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
3718 				    retries++ < ADUTILS_DEF_NUM_RETRIES)
3719 					goto retry;
3720 				degrade_svc(1, "failed to create request for "
3721 				    "AD lookup by winname");
3722 				return (retcode);
3723 			}
3724 
3725 			restore_svc();
3726 
3727 			if (state != NULL && i == 0) {
3728 				/*
3729 				 * Directory based name mapping is only
3730 				 * performed within the joined forest (i == 0).
3731 				 * We don't trust other "trusted" forests to
3732 				 * provide DS-based name mapping information
3733 				 * because AD's definition of "cross-forest
3734 				 * trust" does not encompass this sort of
3735 				 * behavior.
3736 				 */
3737 				idmap_lookup_batch_set_unixattr(qs,
3738 				    state->ad_unixuser_attr,
3739 				    state->ad_unixgroup_attr);
3740 			}
3741 
3742 			retcode = idmap_name2sid_batch_add1(qs, name, domain,
3743 			    eunixtype, dn, attr, value, canonname, sidprefix,
3744 			    rid, wintype, unixname, &rc);
3745 			if (retcode == IDMAP_ERR_DOMAIN_NOTFOUND) {
3746 				idmap_lookup_release_batch(&qs);
3747 				continue;
3748 			}
3749 			found_ad = 1;
3750 			if (retcode != IDMAP_SUCCESS)
3751 				idmap_lookup_release_batch(&qs);
3752 			else
3753 				retcode = idmap_lookup_batch_end(&qs);
3754 
3755 			if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
3756 			    retries++ < ADUTILS_DEF_NUM_RETRIES)
3757 				goto retry;
3758 			else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
3759 				degrade_svc(1,
3760 				    "some AD lookups timed out repeatedly");
3761 		}
3762 	} else {
3763 		/* No AD case */
3764 		retcode = IDMAP_ERR_NO_ACTIVEDIRECTORY;
3765 	}
3766 	UNLOCK_CONFIG();
3767 
3768 	if (retcode != IDMAP_SUCCESS) {
3769 		idmapdlog(LOG_NOTICE, "AD lookup by winname failed");
3770 		return (retcode);
3771 	}
3772 	return (rc);
3773 }
3774 
3775 idmap_retcode
3776 lookup_name2sid(sqlite *cache, const char *name, const char *domain,
3777 		int *is_wuser, char **canonname, char **sidprefix,
3778 		idmap_rid_t *rid, idmap_mapping *req, int local_only)
3779 {
3780 	int		type;
3781 	idmap_retcode	retcode;
3782 
3783 	*sidprefix = NULL;
3784 	if (canonname != NULL)
3785 		*canonname = NULL;
3786 
3787 	/* Lookup well-known SIDs table */
3788 	retcode = lookup_wksids_name2sid(name, canonname, sidprefix, rid,
3789 	    &type);
3790 	if (retcode == IDMAP_SUCCESS) {
3791 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
3792 		goto out;
3793 	} else if (retcode != IDMAP_ERR_NOTFOUND) {
3794 		return (retcode);
3795 	}
3796 
3797 	/* Lookup cache */
3798 	retcode = lookup_cache_name2sid(cache, name, domain, canonname,
3799 	    sidprefix, rid, &type);
3800 	if (retcode == IDMAP_SUCCESS) {
3801 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
3802 		goto out;
3803 	} else if (retcode != IDMAP_ERR_NOTFOUND) {
3804 		return (retcode);
3805 	}
3806 
3807 	/*
3808 	 * The caller may be using this function to determine if this
3809 	 * request needs to be marked for AD lookup or not
3810 	 * (i.e. _IDMAP_F_LOOKUP_AD) and therefore may not want this
3811 	 * function to AD lookup now.
3812 	 */
3813 	if (local_only)
3814 		return (retcode);
3815 
3816 	/* Lookup AD */
3817 	retcode = ad_lookup_by_winname(NULL, name, domain, _IDMAP_T_UNDEF,
3818 	    NULL, NULL, NULL, canonname, sidprefix, rid, &type, NULL);
3819 	if (retcode != IDMAP_SUCCESS)
3820 		return (retcode);
3821 
3822 out:
3823 	/*
3824 	 * Entry found (cache or Windows lookup)
3825 	 * is_wuser is both input as well as output parameter
3826 	 */
3827 	if (*is_wuser == 1 && type != _IDMAP_T_USER)
3828 		retcode = IDMAP_ERR_NOTUSER;
3829 	else if (*is_wuser == 0 && type != _IDMAP_T_GROUP)
3830 		retcode = IDMAP_ERR_NOTGROUP;
3831 	else if (*is_wuser == -1) {
3832 		/* Caller wants to know if its user or group */
3833 		if (type == _IDMAP_T_USER)
3834 			*is_wuser = 1;
3835 		else if (type == _IDMAP_T_GROUP)
3836 			*is_wuser = 0;
3837 		else
3838 			retcode = IDMAP_ERR_SID;
3839 	}
3840 
3841 	if (retcode != IDMAP_SUCCESS) {
3842 		free(*sidprefix);
3843 		*sidprefix = NULL;
3844 		if (canonname != NULL) {
3845 			free(*canonname);
3846 			*canonname = NULL;
3847 		}
3848 	}
3849 	return (retcode);
3850 }
3851 
3852 static
3853 idmap_retcode
3854 name_based_mapping_pid2sid(lookup_state_t *state, const char *unixname,
3855 		int is_user, idmap_mapping *req, idmap_id_res *res)
3856 {
3857 	const char	*winname, *windomain;
3858 	char		*canonname;
3859 	char		*sql = NULL, *errmsg = NULL;
3860 	idmap_retcode	retcode;
3861 	char		*end;
3862 	const char	**values;
3863 	sqlite_vm	*vm = NULL;
3864 	int		ncol, r;
3865 	int		is_wuser;
3866 	const char	*me = "name_based_mapping_pid2sid";
3867 	int 		non_wild_match = FALSE;
3868 	idmap_namerule	*rule = &res->info.how.idmap_how_u.rule;
3869 	int direction;
3870 
3871 	assert(unixname != NULL); /* We have unixname */
3872 	assert(req->id2name == NULL); /* We don't have winname */
3873 	assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */
3874 
3875 	sql = sqlite_mprintf(
3876 	    "SELECT winname_display, windomain, w2u_order, "
3877 	    "is_wuser, unixname, is_nt4 "
3878 	    "FROM namerules WHERE "
3879 	    "u2w_order > 0 AND is_user = %d AND "
3880 	    "(unixname = %Q OR unixname = '*') "
3881 	    "ORDER BY u2w_order ASC;", is_user, unixname);
3882 	if (sql == NULL) {
3883 		idmapdlog(LOG_ERR, "Out of memory");
3884 		retcode = IDMAP_ERR_MEMORY;
3885 		goto out;
3886 	}
3887 
3888 	if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
3889 		retcode = IDMAP_ERR_INTERNAL;
3890 		idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3891 		    CHECK_NULL(errmsg));
3892 		sqlite_freemem(errmsg);
3893 		goto out;
3894 	}
3895 
3896 	for (;;) {
3897 		r = sqlite_step(vm, &ncol, &values, NULL);
3898 		assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
3899 		if (r == SQLITE_ROW) {
3900 			if (ncol < 6) {
3901 				retcode = IDMAP_ERR_INTERNAL;
3902 				goto out;
3903 			}
3904 			if (values[0] == NULL) {
3905 				/* values [1] and [2] can be null */
3906 				retcode = IDMAP_ERR_INTERNAL;
3907 				goto out;
3908 			}
3909 
3910 			if (values[2] != NULL)
3911 				direction =
3912 				    (strtol(values[2], &end, 10) == 0)?
3913 				    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
3914 			else
3915 				direction = IDMAP_DIRECTION_U2W;
3916 
3917 			if (EMPTY_NAME(values[0])) {
3918 				idmap_namerule_set(rule, values[1], values[0],
3919 				    values[4], is_user,
3920 				    strtol(values[3], &end, 10),
3921 				    strtol(values[5], &end, 10),
3922 				    direction);
3923 				retcode = IDMAP_ERR_NOMAPPING;
3924 				goto out;
3925 			}
3926 
3927 			if (values[0][0] == '*') {
3928 				winname = unixname;
3929 				if (non_wild_match) {
3930 					/*
3931 					 * There were non-wildcard rules
3932 					 * where the Windows identity doesn't
3933 					 * exist. Return no mapping.
3934 					 */
3935 					retcode = IDMAP_ERR_NOMAPPING;
3936 					goto out;
3937 				}
3938 			} else {
3939 				/* Save first non-wild match rule */
3940 				if (!non_wild_match) {
3941 					idmap_namerule_set(rule, values[1],
3942 					    values[0], values[4],
3943 					    is_user,
3944 					    strtol(values[3], &end, 10),
3945 					    strtol(values[5], &end, 10),
3946 					    direction);
3947 					non_wild_match = TRUE;
3948 				}
3949 				winname = values[0];
3950 			}
3951 			is_wuser = res->id.idtype == IDMAP_USID ? 1
3952 			    : res->id.idtype == IDMAP_GSID ? 0
3953 			    : -1;
3954 			if (values[1] != NULL)
3955 				windomain = values[1];
3956 			else if (state->defdom != NULL)
3957 				windomain = state->defdom;
3958 			else {
3959 				idmapdlog(LOG_ERR, "%s: no domain", me);
3960 				retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
3961 				goto out;
3962 			}
3963 
3964 			retcode = lookup_name2sid(state->cache,
3965 			    winname, windomain,
3966 			    &is_wuser, &canonname,
3967 			    &res->id.idmap_id_u.sid.prefix,
3968 			    &res->id.idmap_id_u.sid.rid, req, 0);
3969 
3970 			if (retcode == IDMAP_ERR_NOTFOUND) {
3971 				continue;
3972 			}
3973 			goto out;
3974 
3975 		} else if (r == SQLITE_DONE) {
3976 			/*
3977 			 * If there were non-wildcard rules where
3978 			 * Windows identity doesn't exist
3979 			 * return no mapping.
3980 			 */
3981 			if (non_wild_match)
3982 				retcode = IDMAP_ERR_NOMAPPING;
3983 			else
3984 				retcode = IDMAP_ERR_NOTFOUND;
3985 			goto out;
3986 		} else {
3987 			(void) sqlite_finalize(vm, &errmsg);
3988 			vm = NULL;
3989 			idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3990 			    CHECK_NULL(errmsg));
3991 			sqlite_freemem(errmsg);
3992 			retcode = IDMAP_ERR_INTERNAL;
3993 			goto out;
3994 		}
3995 	}
3996 
3997 out:
3998 	if (sql != NULL)
3999 		sqlite_freemem(sql);
4000 	res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED;
4001 	if (retcode == IDMAP_SUCCESS) {
4002 		res->id.idtype = is_wuser ? IDMAP_USID : IDMAP_GSID;
4003 
4004 		if (values[2] != NULL)
4005 			res->direction =
4006 			    (strtol(values[2], &end, 10) == 0)?
4007 			    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
4008 		else
4009 			res->direction = IDMAP_DIRECTION_U2W;
4010 
4011 		req->id2name = canonname;
4012 		if (req->id2name != NULL) {
4013 			req->id2domain = strdup(windomain);
4014 			if (req->id2domain == NULL)
4015 				retcode = IDMAP_ERR_MEMORY;
4016 		}
4017 	}
4018 
4019 	if (retcode == IDMAP_SUCCESS) {
4020 		idmap_namerule_set(rule, values[1], values[0], values[4],
4021 		    is_user, strtol(values[3], &end, 10),
4022 		    strtol(values[5], &end, 10),
4023 		    rule->direction);
4024 		res->info.src = IDMAP_MAP_SRC_NEW;
4025 	}
4026 	if (vm != NULL)
4027 		(void) sqlite_finalize(vm, NULL);
4028 	return (retcode);
4029 }
4030 
4031 /*
4032  * Convention when processing unix2win requests:
4033  *
4034  * Unix identity:
4035  * req->id1name =
4036  *              unixname if given otherwise unixname found will be placed
4037  *              here.
4038  * req->id1domain =
4039  *              NOT USED
4040  * req->id1.idtype =
4041  *              Given type (IDMAP_UID or IDMAP_GID)
4042  * req->id1..[uid or gid] =
4043  *              UID/GID if given otherwise UID/GID found will be placed here.
4044  *
4045  * Windows identity:
4046  * req->id2name =
4047  *              winname found will be placed here.
4048  * req->id2domain =
4049  *              windomain found will be placed here.
4050  * res->id.idtype =
4051  *              Target type initialized from req->id2.idtype. If
4052  *              it is IDMAP_SID then actual type (IDMAP_USID/GSID) found
4053  *              will be placed here.
4054  * req->id..sid.[prefix, rid] =
4055  *              SID found will be placed here.
4056  *
4057  * Others:
4058  * res->retcode =
4059  *              Return status for this request will be placed here.
4060  * res->direction =
4061  *              Direction found will be placed here. Direction
4062  *              meaning whether the resultant mapping is valid
4063  *              only from unix2win or bi-directional.
4064  * req->direction =
4065  *              INTERNAL USE. Used by idmapd to set various
4066  *              flags (_IDMAP_F_xxxx) to aid in processing
4067  *              of the request.
4068  * req->id2.idtype =
4069  *              INTERNAL USE. Initially this is the requested target
4070  *              type and is used to initialize res->id.idtype.
4071  *              ad_lookup_batch() uses this field temporarily to store
4072  *              sid_type obtained by the batched AD lookups and after
4073  *              use resets it to IDMAP_NONE to prevent xdr from
4074  *              mis-interpreting the contents of req->id2.
4075  * req->id2..[uid or gid or sid] =
4076  *              NOT USED
4077  */
4078 
4079 /*
4080  * This function does the following:
4081  * 1. Lookup well-known SIDs table.
4082  * 2. Lookup cache.
4083  * 3. Check if the client does not want new mapping to be allocated
4084  *    in which case this pass is the final pass.
4085  * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs
4086  *    to do AD/NLDAP lookup.
4087  */
4088 idmap_retcode
4089 pid2sid_first_pass(lookup_state_t *state, idmap_mapping *req,
4090 		idmap_id_res *res, int is_user, int getname)
4091 {
4092 	idmap_retcode	retcode;
4093 	bool_t		gen_localsid_on_err = FALSE;
4094 
4095 	/* Initialize result */
4096 	res->id.idtype = req->id2.idtype;
4097 	res->direction = IDMAP_DIRECTION_UNDEF;
4098 
4099 	if (req->id2.idmap_id_u.sid.prefix != NULL) {
4100 		/* sanitize sidprefix */
4101 		free(req->id2.idmap_id_u.sid.prefix);
4102 		req->id2.idmap_id_u.sid.prefix = NULL;
4103 	}
4104 
4105 	/* Find pid */
4106 	if (req->id1.idmap_id_u.uid == SENTINEL_PID) {
4107 		if (ns_lookup_byname(req->id1name, NULL, &req->id1)
4108 		    != IDMAP_SUCCESS) {
4109 			retcode = IDMAP_ERR_NOMAPPING;
4110 			goto out;
4111 		}
4112 	}
4113 
4114 	/* Lookup well-known SIDs table */
4115 	retcode = lookup_wksids_pid2sid(req, res, is_user);
4116 	if (retcode != IDMAP_ERR_NOTFOUND)
4117 		goto out;
4118 
4119 	/* Lookup cache */
4120 	retcode = lookup_cache_pid2sid(state->cache, req, res, is_user,
4121 	    getname);
4122 	if (retcode != IDMAP_ERR_NOTFOUND)
4123 		goto out;
4124 
4125 	/* Ephemeral ids cannot be allocated during pid2sid */
4126 	if (IS_EPHEMERAL(req->id1.idmap_id_u.uid)) {
4127 		retcode = IDMAP_ERR_NOMAPPING;
4128 		goto out;
4129 	}
4130 
4131 	if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) {
4132 		retcode = IDMAP_ERR_NONE_GENERATED;
4133 		goto out;
4134 	}
4135 
4136 	if (AVOID_NAMESERVICE(req)) {
4137 		gen_localsid_on_err = TRUE;
4138 		retcode = IDMAP_ERR_NOMAPPING;
4139 		goto out;
4140 	}
4141 
4142 	/* Set flags for the next stage */
4143 	if (AD_MODE(req->id1.idtype, state)) {
4144 		/*
4145 		 * If AD-based name mapping is enabled then the next stage
4146 		 * will need to lookup AD using unixname to get the
4147 		 * corresponding winname.
4148 		 */
4149 		if (req->id1name == NULL) {
4150 			/* Get unixname if only pid is given. */
4151 			retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid,
4152 			    is_user, &req->id1name);
4153 			if (retcode != IDMAP_SUCCESS) {
4154 				gen_localsid_on_err = TRUE;
4155 				goto out;
4156 			}
4157 		}
4158 		req->direction |= _IDMAP_F_LOOKUP_AD;
4159 		state->ad_nqueries++;
4160 	} else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) {
4161 		/*
4162 		 * If native LDAP or mixed mode is enabled for name mapping
4163 		 * then the next stage will need to lookup native LDAP using
4164 		 * unixname/pid to get the corresponding winname.
4165 		 */
4166 		req->direction |= _IDMAP_F_LOOKUP_NLDAP;
4167 		state->nldap_nqueries++;
4168 	}
4169 
4170 	/*
4171 	 * Failed to find non-expired entry in cache. Set the flag to
4172 	 * indicate that we are not done yet.
4173 	 */
4174 	state->pid2sid_done = FALSE;
4175 	req->direction |= _IDMAP_F_NOTDONE;
4176 	retcode = IDMAP_SUCCESS;
4177 
4178 out:
4179 	res->retcode = idmap_stat4prot(retcode);
4180 	if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS)
4181 		if (gen_localsid_on_err == TRUE)
4182 			(void) generate_localsid(req, res, is_user, TRUE);
4183 	return (retcode);
4184 }
4185 
4186 idmap_retcode
4187 pid2sid_second_pass(lookup_state_t *state, idmap_mapping *req,
4188 	idmap_id_res *res, int is_user)
4189 {
4190 	bool_t		gen_localsid_on_err = TRUE;
4191 	idmap_retcode	retcode = IDMAP_SUCCESS;
4192 
4193 	/* Check if second pass is needed */
4194 	if (ARE_WE_DONE(req->direction))
4195 		return (res->retcode);
4196 
4197 	/* Get status from previous pass */
4198 	retcode = res->retcode;
4199 	if (retcode != IDMAP_SUCCESS)
4200 		goto out;
4201 
4202 	/*
4203 	 * If directory-based name mapping is enabled then the winname
4204 	 * may already have been retrieved from the AD object (AD-mode)
4205 	 * or from native LDAP object (nldap-mode or mixed-mode).
4206 	 * Note that if we have winname but no SID then it's an error
4207 	 * because this implies that the Native LDAP entry contains
4208 	 * winname which does not exist and it's better that we return
4209 	 * an error instead of doing rule-based mapping so that the user
4210 	 * can detect the issue and take appropriate action.
4211 	 */
4212 	if (req->id2name != NULL) {
4213 		/* Return notfound if we've winname but no SID. */
4214 		if (res->id.idmap_id_u.sid.prefix == NULL) {
4215 			retcode = IDMAP_ERR_NOTFOUND;
4216 			goto out;
4217 		}
4218 		if (AD_MODE(req->id1.idtype, state))
4219 			res->direction = IDMAP_DIRECTION_BI;
4220 		else if (NLDAP_MODE(req->id1.idtype, state))
4221 			res->direction = IDMAP_DIRECTION_BI;
4222 		else if (MIXED_MODE(req->id1.idtype, state))
4223 			res->direction = IDMAP_DIRECTION_W2U;
4224 		goto out;
4225 	} else if (res->id.idmap_id_u.sid.prefix != NULL) {
4226 		/*
4227 		 * We've SID but no winname. This is fine because
4228 		 * the caller may have only requested SID.
4229 		 */
4230 		goto out;
4231 	}
4232 
4233 	/* Free any mapping info from Directory based mapping */
4234 	if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN)
4235 		idmap_info_free(&res->info);
4236 
4237 	if (req->id1name == NULL) {
4238 		/* Get unixname from name service */
4239 		retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user,
4240 		    &req->id1name);
4241 		if (retcode != IDMAP_SUCCESS)
4242 			goto out;
4243 	} else if (req->id1.idmap_id_u.uid == SENTINEL_PID) {
4244 		/* Get pid from name service */
4245 		retcode = ns_lookup_byname(req->id1name, NULL, &req->id1);
4246 		if (retcode != IDMAP_SUCCESS) {
4247 			gen_localsid_on_err = FALSE;
4248 			goto out;
4249 		}
4250 	}
4251 
4252 	/* Use unixname to evaluate local name-based mapping rules */
4253 	retcode = name_based_mapping_pid2sid(state, req->id1name, is_user,
4254 	    req, res);
4255 	if (retcode == IDMAP_ERR_NOTFOUND) {
4256 		retcode = generate_localsid(req, res, is_user, FALSE);
4257 		gen_localsid_on_err = FALSE;
4258 	}
4259 
4260 out:
4261 	res->retcode = idmap_stat4prot(retcode);
4262 	if (res->retcode != IDMAP_SUCCESS) {
4263 		req->direction = _IDMAP_F_DONE;
4264 		free(req->id2name);
4265 		req->id2name = NULL;
4266 		free(req->id2domain);
4267 		req->id2domain = NULL;
4268 		if (gen_localsid_on_err == TRUE)
4269 			(void) generate_localsid(req, res, is_user, TRUE);
4270 		else
4271 			res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
4272 	}
4273 	if (!ARE_WE_DONE(req->direction))
4274 		state->pid2sid_done = FALSE;
4275 	return (retcode);
4276 }
4277 
4278 static
4279 int
4280 copy_mapping_request(idmap_mapping *mapping, idmap_mapping *request)
4281 {
4282 	(void) memset(mapping, 0, sizeof (*mapping));
4283 
4284 	mapping->flag = request->flag;
4285 	mapping->direction = _IDMAP_F_DONE;
4286 	mapping->id2.idtype = request->id2.idtype;
4287 
4288 	mapping->id1.idtype = request->id1.idtype;
4289 	if (IS_REQUEST_SID(*request, 1)) {
4290 		mapping->id1.idmap_id_u.sid.rid =
4291 		    request->id1.idmap_id_u.sid.rid;
4292 		if (!EMPTY_STRING(request->id1.idmap_id_u.sid.prefix)) {
4293 			mapping->id1.idmap_id_u.sid.prefix =
4294 			    strdup(request->id1.idmap_id_u.sid.prefix);
4295 			if (mapping->id1.idmap_id_u.sid.prefix == NULL)
4296 				goto errout;
4297 		}
4298 	} else {
4299 		mapping->id1.idmap_id_u.uid = request->id1.idmap_id_u.uid;
4300 	}
4301 
4302 	if (!EMPTY_STRING(request->id1domain)) {
4303 		mapping->id1domain = strdup(request->id1domain);
4304 		if (mapping->id1domain == NULL)
4305 			goto errout;
4306 	}
4307 
4308 	if (!EMPTY_STRING(request->id1name)) {
4309 		mapping->id1name = strdup(request->id1name);
4310 		if (mapping->id1name == NULL)
4311 			goto errout;
4312 	}
4313 
4314 	/* We don't need the rest of the request i.e request->id2 */
4315 	return (0);
4316 
4317 errout:
4318 	if (mapping->id1.idmap_id_u.sid.prefix != NULL)
4319 		free(mapping->id1.idmap_id_u.sid.prefix);
4320 	if (mapping->id1domain != NULL)
4321 		free(mapping->id1domain);
4322 	if (mapping->id1name != NULL)
4323 		free(mapping->id1name);
4324 
4325 	(void) memset(mapping, 0, sizeof (*mapping));
4326 	return (-1);
4327 }
4328 
4329 
4330 idmap_retcode
4331 get_w2u_mapping(sqlite *cache, sqlite *db, idmap_mapping *request,
4332 		idmap_mapping *mapping)
4333 {
4334 	idmap_id_res	idres;
4335 	lookup_state_t	state;
4336 	char		*cp;
4337 	idmap_retcode	retcode;
4338 	const char	*winname, *windomain;
4339 
4340 	(void) memset(&idres, 0, sizeof (idres));
4341 	(void) memset(&state, 0, sizeof (state));
4342 	state.cache = cache;
4343 	state.db = db;
4344 
4345 	/* Get directory-based name mapping info */
4346 	retcode = load_cfg_in_state(&state);
4347 	if (retcode != IDMAP_SUCCESS)
4348 		goto out;
4349 
4350 	/*
4351 	 * Copy data from "request" to "mapping". Note that
4352 	 * empty strings are not copied from "request" to
4353 	 * "mapping" and therefore the coresponding strings in
4354 	 * "mapping" will be NULL. This eliminates having to
4355 	 * check for empty strings henceforth.
4356 	 */
4357 	if (copy_mapping_request(mapping, request) < 0) {
4358 		retcode = IDMAP_ERR_MEMORY;
4359 		goto out;
4360 	}
4361 
4362 	winname = mapping->id1name;
4363 	windomain = mapping->id1domain;
4364 
4365 	if (winname == NULL && windomain != NULL) {
4366 		retcode = IDMAP_ERR_ARG;
4367 		goto out;
4368 	}
4369 
4370 	/* Need atleast winname or sid to proceed */
4371 	if (winname == NULL && mapping->id1.idmap_id_u.sid.prefix == NULL) {
4372 		retcode = IDMAP_ERR_ARG;
4373 		goto out;
4374 	}
4375 
4376 	/*
4377 	 * If domainname is not given but we have a fully qualified
4378 	 * winname then extract the domainname from the winname,
4379 	 * otherwise use the default_domain from the config
4380 	 */
4381 	if (winname != NULL && windomain == NULL) {
4382 		retcode = IDMAP_SUCCESS;
4383 		if ((cp = strchr(winname, '@')) != NULL) {
4384 			*cp = '\0';
4385 			mapping->id1domain = strdup(cp + 1);
4386 			if (mapping->id1domain == NULL)
4387 				retcode = IDMAP_ERR_MEMORY;
4388 		} else if (lookup_wksids_name2sid(winname, NULL, NULL, NULL,
4389 		    NULL) != IDMAP_SUCCESS) {
4390 			if (state.defdom == NULL) {
4391 				/*
4392 				 * We have a non-qualified winname which is
4393 				 * neither the name of a well-known SID nor
4394 				 * there is a default domain with which we can
4395 				 * qualify it.
4396 				 */
4397 				retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
4398 			} else {
4399 				mapping->id1domain = strdup(state.defdom);
4400 				if (mapping->id1domain == NULL)
4401 					retcode = IDMAP_ERR_MEMORY;
4402 			}
4403 		}
4404 		if (retcode != IDMAP_SUCCESS)
4405 			goto out;
4406 	}
4407 
4408 	/*
4409 	 * First pass looks up the well-known SIDs table and cache
4410 	 * and handles localSIDs
4411 	 */
4412 	state.sid2pid_done = TRUE;
4413 	retcode = sid2pid_first_pass(&state, mapping, &idres);
4414 	if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE)
4415 		goto out;
4416 
4417 	/* AD lookup */
4418 	if (state.ad_nqueries > 0) {
4419 		retcode = ad_lookup_one(&state, mapping, &idres);
4420 		if (IDMAP_ERROR(retcode))
4421 			goto out;
4422 	}
4423 
4424 	/* nldap lookup */
4425 	if (state.nldap_nqueries > 0) {
4426 		retcode = nldap_lookup_one(&state, mapping, &idres);
4427 		if (IDMAP_FATAL_ERROR(retcode))
4428 			goto out;
4429 	}
4430 
4431 	/* Next pass performs name-based mapping and ephemeral mapping. */
4432 	state.sid2pid_done = TRUE;
4433 	retcode = sid2pid_second_pass(&state, mapping, &idres);
4434 	if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE)
4435 		goto out;
4436 
4437 	/* Update cache */
4438 	(void) update_cache_sid2pid(&state, mapping, &idres);
4439 
4440 out:
4441 	/*
4442 	 * Note that "mapping" is returned to the client. Therefore
4443 	 * copy whatever we have in "idres" to mapping->id2 and
4444 	 * free idres.
4445 	 */
4446 	mapping->direction = idres.direction;
4447 	mapping->id2 = idres.id;
4448 	if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO ||
4449 	    retcode != IDMAP_SUCCESS)
4450 		(void) idmap_info_mov(&mapping->info, &idres.info);
4451 	else
4452 		idmap_info_free(&idres.info);
4453 	(void) memset(&idres, 0, sizeof (idres));
4454 	if (retcode != IDMAP_SUCCESS)
4455 		mapping->id2.idmap_id_u.uid = UID_NOBODY;
4456 	xdr_free(xdr_idmap_id_res, (caddr_t)&idres);
4457 	cleanup_lookup_state(&state);
4458 	return (retcode);
4459 }
4460 
4461 idmap_retcode
4462 get_u2w_mapping(sqlite *cache, sqlite *db, idmap_mapping *request,
4463 		idmap_mapping *mapping, int is_user)
4464 {
4465 	idmap_id_res	idres;
4466 	lookup_state_t	state;
4467 	idmap_retcode	retcode;
4468 
4469 	/*
4470 	 * In order to re-use the pid2sid code, we convert
4471 	 * our input data into structs that are expected by
4472 	 * pid2sid_first_pass.
4473 	 */
4474 
4475 	(void) memset(&idres, 0, sizeof (idres));
4476 	(void) memset(&state, 0, sizeof (state));
4477 	state.cache = cache;
4478 	state.db = db;
4479 
4480 	/* Get directory-based name mapping info */
4481 	retcode = load_cfg_in_state(&state);
4482 	if (retcode != IDMAP_SUCCESS)
4483 		goto out;
4484 
4485 	/*
4486 	 * Copy data from "request" to "mapping". Note that
4487 	 * empty strings are not copied from "request" to
4488 	 * "mapping" and therefore the coresponding strings in
4489 	 * "mapping" will be NULL. This eliminates having to
4490 	 * check for empty strings henceforth.
4491 	 */
4492 	if (copy_mapping_request(mapping, request) < 0) {
4493 		retcode = IDMAP_ERR_MEMORY;
4494 		goto out;
4495 	}
4496 
4497 	/*
4498 	 * For unix to windows mapping request, we need atleast a
4499 	 * unixname or uid/gid to proceed
4500 	 */
4501 	if (mapping->id1name == NULL &&
4502 	    mapping->id1.idmap_id_u.uid == SENTINEL_PID) {
4503 		retcode = IDMAP_ERR_ARG;
4504 		goto out;
4505 	}
4506 
4507 	/* First pass looks up cache and well-known SIDs */
4508 	state.pid2sid_done = TRUE;
4509 	retcode = pid2sid_first_pass(&state, mapping, &idres, is_user, 1);
4510 	if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE)
4511 		goto out;
4512 
4513 	/* nldap lookup */
4514 	if (state.nldap_nqueries > 0) {
4515 		retcode = nldap_lookup_one(&state, mapping, &idres);
4516 		if (IDMAP_FATAL_ERROR(retcode))
4517 			goto out;
4518 	}
4519 
4520 	/* AD lookup */
4521 	if (state.ad_nqueries > 0) {
4522 		retcode = ad_lookup_one(&state, mapping, &idres);
4523 		if (IDMAP_FATAL_ERROR(retcode))
4524 			goto out;
4525 	}
4526 
4527 	/*
4528 	 * Next pass processes the result of the preceding passes/lookups.
4529 	 * It returns if there's nothing more to be done otherwise it
4530 	 * evaluates local name-based mapping rules
4531 	 */
4532 	state.pid2sid_done = TRUE;
4533 	retcode = pid2sid_second_pass(&state, mapping, &idres, is_user);
4534 	if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE)
4535 		goto out;
4536 
4537 	/* Update cache */
4538 	(void) update_cache_pid2sid(&state, mapping, &idres);
4539 
4540 out:
4541 	/*
4542 	 * Note that "mapping" is returned to the client. Therefore
4543 	 * copy whatever we have in "idres" to mapping->id2 and
4544 	 * free idres.
4545 	 */
4546 	mapping->direction = idres.direction;
4547 	mapping->id2 = idres.id;
4548 	if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO ||
4549 	    retcode != IDMAP_SUCCESS)
4550 		(void) idmap_info_mov(&mapping->info, &idres.info);
4551 	else
4552 		idmap_info_free(&idres.info);
4553 	(void) memset(&idres, 0, sizeof (idres));
4554 	xdr_free(xdr_idmap_id_res, (caddr_t)&idres);
4555 	cleanup_lookup_state(&state);
4556 	return (retcode);
4557 }
4558 
4559 /*ARGSUSED*/
4560 static
4561 idmap_retcode
4562 ad_lookup_one(lookup_state_t *state, idmap_mapping *req, idmap_id_res *res)
4563 {
4564 	idmap_mapping_batch	batch;
4565 	idmap_ids_res		result;
4566 
4567 	batch.idmap_mapping_batch_len = 1;
4568 	batch.idmap_mapping_batch_val = req;
4569 	result.ids.ids_len = 1;
4570 	result.ids.ids_val = res;
4571 	return (ad_lookup_batch(state, &batch, &result));
4572 }
4573