1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 27 /* 28 * Service routines 29 */ 30 31 #include "idmapd.h" 32 #include "idmap_priv.h" 33 #include "nldaputils.h" 34 #include <signal.h> 35 #include <thread.h> 36 #include <string.h> 37 #include <strings.h> 38 #include <errno.h> 39 #include <assert.h> 40 #include <sys/types.h> 41 #include <sys/stat.h> 42 #include <ucred.h> 43 #include <pwd.h> 44 #include <auth_attr.h> 45 #include <secdb.h> 46 #include <sys/u8_textprep.h> 47 48 #define _VALIDATE_LIST_CB_DATA(col, val, siz)\ 49 retcode = validate_list_cb_data(cb_data, argc, argv, col,\ 50 (uchar_t **)val, siz);\ 51 if (retcode == IDMAP_NEXT) {\ 52 result->retcode = IDMAP_NEXT;\ 53 return (0);\ 54 } else if (retcode < 0) {\ 55 result->retcode = retcode;\ 56 return (1);\ 57 } 58 59 #define PROCESS_LIST_SVC_SQL(rcode, db, dbname, sql, limit, flag, cb, res, len)\ 60 rcode = process_list_svc_sql(db, dbname, sql, limit, flag, cb, res);\ 61 if (rcode == IDMAP_ERR_BUSY)\ 62 res->retcode = IDMAP_ERR_BUSY;\ 63 else if (rcode == IDMAP_SUCCESS && len == 0)\ 64 res->retcode = IDMAP_ERR_NOTFOUND; 65 66 67 #define STRDUP_OR_FAIL(to, from) \ 68 if ((from) == NULL) \ 69 to = NULL; \ 70 else { \ 71 if ((to = strdup(from)) == NULL) \ 72 return (1); \ 73 } 74 75 #define STRDUP_CHECK(to, from) \ 76 if ((from) != NULL) { \ 77 to = strdup(from); \ 78 if (to == NULL) { \ 79 result->retcode = IDMAP_ERR_MEMORY; \ 80 goto out; \ 81 } \ 82 } 83 84 /* ARGSUSED */ 85 bool_t 86 idmap_null_1_svc(void *result, struct svc_req *rqstp) 87 { 88 return (TRUE); 89 } 90 91 /* 92 * RPC layer allocates empty strings to replace NULL char *. 93 * This utility function frees these empty strings. 94 */ 95 static 96 void 97 sanitize_mapping_request(idmap_mapping *req) 98 { 99 free(req->id1name); 100 req->id1name = NULL; 101 free(req->id1domain); 102 req->id1domain = NULL; 103 free(req->id2name); 104 req->id2name = NULL; 105 free(req->id2domain); 106 req->id2domain = NULL; 107 req->direction = _IDMAP_F_DONE; 108 } 109 110 static 111 int 112 validate_mapped_id_by_name_req(idmap_mapping *req) 113 { 114 int e; 115 116 if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) 117 return (IDMAP_SUCCESS); 118 119 if (IS_REQUEST_SID(*req, 1)) { 120 if (!EMPTY_STRING(req->id1name) && 121 u8_validate(req->id1name, strlen(req->id1name), 122 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 123 return (IDMAP_ERR_BAD_UTF8); 124 if (!EMPTY_STRING(req->id1domain) && 125 u8_validate(req->id1domain, strlen(req->id1domain), 126 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 127 return (IDMAP_ERR_BAD_UTF8); 128 } 129 130 return (IDMAP_SUCCESS); 131 } 132 133 static 134 int 135 validate_rule(idmap_namerule *rule) 136 { 137 int e; 138 139 if (!EMPTY_STRING(rule->winname) && 140 u8_validate(rule->winname, strlen(rule->winname), 141 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 142 return (IDMAP_ERR_BAD_UTF8); 143 144 if (!EMPTY_STRING(rule->windomain) && 145 u8_validate(rule->windomain, strlen(rule->windomain), 146 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 147 return (IDMAP_ERR_BAD_UTF8); 148 149 return (IDMAP_SUCCESS); 150 151 } 152 153 static 154 bool_t 155 validate_rules(idmap_update_batch *batch) 156 { 157 idmap_update_op *up; 158 int i; 159 160 for (i = 0; i < batch->idmap_update_batch_len; i++) { 161 up = &(batch->idmap_update_batch_val[i]); 162 if (validate_rule(&(up->idmap_update_op_u.rule)) 163 != IDMAP_SUCCESS) 164 return (IDMAP_ERR_BAD_UTF8); 165 } 166 167 return (IDMAP_SUCCESS); 168 } 169 170 /* ARGSUSED */ 171 bool_t 172 idmap_get_mapped_ids_1_svc(idmap_mapping_batch batch, 173 idmap_ids_res *result, struct svc_req *rqstp) 174 { 175 sqlite *cache = NULL, *db = NULL; 176 lookup_state_t state; 177 idmap_retcode retcode; 178 uint_t i; 179 180 /* Init */ 181 (void) memset(result, 0, sizeof (*result)); 182 (void) memset(&state, 0, sizeof (state)); 183 184 /* Return success if nothing was requested */ 185 if (batch.idmap_mapping_batch_len < 1) 186 goto out; 187 188 /* Get cache handle */ 189 result->retcode = get_cache_handle(&cache); 190 if (result->retcode != IDMAP_SUCCESS) 191 goto out; 192 state.cache = cache; 193 194 /* Get db handle */ 195 result->retcode = get_db_handle(&db); 196 if (result->retcode != IDMAP_SUCCESS) 197 goto out; 198 state.db = db; 199 200 /* Allocate result array */ 201 result->ids.ids_val = calloc(batch.idmap_mapping_batch_len, 202 sizeof (idmap_id_res)); 203 if (result->ids.ids_val == NULL) { 204 idmapdlog(LOG_ERR, "Out of memory"); 205 result->retcode = IDMAP_ERR_MEMORY; 206 goto out; 207 } 208 result->ids.ids_len = batch.idmap_mapping_batch_len; 209 210 /* Allocate hash table to check for duplicate sids */ 211 state.sid_history = calloc(batch.idmap_mapping_batch_len, 212 sizeof (*state.sid_history)); 213 if (state.sid_history == NULL) { 214 idmapdlog(LOG_ERR, "Out of memory"); 215 result->retcode = IDMAP_ERR_MEMORY; 216 goto out; 217 } 218 state.sid_history_size = batch.idmap_mapping_batch_len; 219 for (i = 0; i < state.sid_history_size; i++) { 220 state.sid_history[i].key = state.sid_history_size; 221 state.sid_history[i].next = state.sid_history_size; 222 } 223 state.batch = &batch; 224 state.result = result; 225 226 /* Get directory-based name mapping info */ 227 result->retcode = load_cfg_in_state(&state); 228 if (result->retcode != IDMAP_SUCCESS) 229 goto out; 230 231 /* Init our 'done' flags */ 232 state.sid2pid_done = state.pid2sid_done = TRUE; 233 234 /* First stage */ 235 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 236 state.curpos = i; 237 (void) sanitize_mapping_request( 238 &batch.idmap_mapping_batch_val[i]); 239 if (IS_BATCH_SID(batch, i)) { 240 retcode = sid2pid_first_pass( 241 &state, 242 &batch.idmap_mapping_batch_val[i], 243 &result->ids.ids_val[i]); 244 } else if (IS_BATCH_UID(batch, i)) { 245 retcode = pid2sid_first_pass( 246 &state, 247 &batch.idmap_mapping_batch_val[i], 248 &result->ids.ids_val[i], 1, 0); 249 } else if (IS_BATCH_GID(batch, i)) { 250 retcode = pid2sid_first_pass( 251 &state, 252 &batch.idmap_mapping_batch_val[i], 253 &result->ids.ids_val[i], 0, 0); 254 } else { 255 result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE; 256 continue; 257 } 258 if (IDMAP_FATAL_ERROR(retcode)) { 259 result->retcode = retcode; 260 goto out; 261 } 262 } 263 264 /* Check if we are done */ 265 if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 266 goto out; 267 268 /* 269 * native LDAP lookups: 270 * pid2sid: 271 * - nldap or mixed mode. Lookup nldap by pid or unixname to get 272 * winname. 273 * sid2pid: 274 * - nldap mode. Got winname and sid (either given or found in 275 * name_cache). Lookup nldap by winname to get pid and 276 * unixname. 277 */ 278 if (state.nldap_nqueries) { 279 retcode = nldap_lookup_batch(&state, &batch, result); 280 if (IDMAP_FATAL_ERROR(retcode)) { 281 result->retcode = retcode; 282 goto out; 283 } 284 } 285 286 /* 287 * AD lookups: 288 * pid2sid: 289 * - nldap or mixed mode. Got winname from nldap lookup. 290 * winname2sid could not be resolved locally. Lookup AD 291 * by winname to get sid. 292 * - ad mode. Got unixname. Lookup AD by unixname to get 293 * winname and sid. 294 * sid2pid: 295 * - ad or mixed mode. Lookup AD by sid or winname to get 296 * winname, sid and unixname. 297 * - any mode. Got either sid or winname but not both. Lookup 298 * AD by sid or winname to get winname, sid. 299 */ 300 if (state.ad_nqueries) { 301 retcode = ad_lookup_batch(&state, &batch, result); 302 if (IDMAP_FATAL_ERROR(retcode)) { 303 result->retcode = retcode; 304 goto out; 305 } 306 } 307 308 /* 309 * native LDAP lookups: 310 * sid2pid: 311 * - nldap mode. Got winname and sid from AD lookup. Lookup nldap 312 * by winname to get pid and unixname. 313 */ 314 if (state.nldap_nqueries) { 315 retcode = nldap_lookup_batch(&state, &batch, result); 316 if (IDMAP_FATAL_ERROR(retcode)) { 317 result->retcode = retcode; 318 goto out; 319 } 320 } 321 322 /* Reset 'done' flags */ 323 state.sid2pid_done = state.pid2sid_done = TRUE; 324 325 /* Second stage */ 326 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 327 state.curpos = i; 328 if (IS_BATCH_SID(batch, i)) { 329 retcode = sid2pid_second_pass( 330 &state, 331 &batch.idmap_mapping_batch_val[i], 332 &result->ids.ids_val[i]); 333 } else if (IS_BATCH_UID(batch, i)) { 334 retcode = pid2sid_second_pass( 335 &state, 336 &batch.idmap_mapping_batch_val[i], 337 &result->ids.ids_val[i], 1); 338 } else if (IS_BATCH_GID(batch, i)) { 339 retcode = pid2sid_second_pass( 340 &state, 341 &batch.idmap_mapping_batch_val[i], 342 &result->ids.ids_val[i], 0); 343 } else { 344 /* First stage has already set the error */ 345 continue; 346 } 347 if (IDMAP_FATAL_ERROR(retcode)) { 348 result->retcode = retcode; 349 goto out; 350 } 351 } 352 353 /* Check if we are done */ 354 if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 355 goto out; 356 357 /* Reset our 'done' flags */ 358 state.sid2pid_done = state.pid2sid_done = TRUE; 359 360 /* Update cache in a single transaction */ 361 if (sql_exec_no_cb(cache, IDMAP_CACHENAME, "BEGIN TRANSACTION;") 362 != IDMAP_SUCCESS) 363 goto out; 364 365 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 366 state.curpos = i; 367 if (IS_BATCH_SID(batch, i)) { 368 (void) update_cache_sid2pid( 369 &state, 370 &batch.idmap_mapping_batch_val[i], 371 &result->ids.ids_val[i]); 372 } else if ((IS_BATCH_UID(batch, i)) || 373 (IS_BATCH_GID(batch, i))) { 374 (void) update_cache_pid2sid( 375 &state, 376 &batch.idmap_mapping_batch_val[i], 377 &result->ids.ids_val[i]); 378 } 379 } 380 381 /* Commit if we have at least one successful update */ 382 if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE) 383 (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 384 "COMMIT TRANSACTION;"); 385 else 386 (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 387 "END TRANSACTION;"); 388 389 out: 390 cleanup_lookup_state(&state); 391 if (IDMAP_ERROR(result->retcode)) { 392 xdr_free(xdr_idmap_ids_res, (caddr_t)result); 393 result->ids.ids_len = 0; 394 result->ids.ids_val = NULL; 395 } 396 result->retcode = idmap_stat4prot(result->retcode); 397 return (TRUE); 398 } 399 400 401 /* ARGSUSED */ 402 static 403 int 404 list_mappings_cb(void *parg, int argc, char **argv, char **colnames) 405 { 406 list_cb_data_t *cb_data; 407 char *str; 408 idmap_mappings_res *result; 409 idmap_retcode retcode; 410 int w2u, u2w; 411 char *end; 412 static int validated_column_names = 0; 413 idmap_how *how; 414 415 cb_data = (list_cb_data_t *)parg; 416 417 if (!validated_column_names) { 418 assert(strcmp(colnames[0], "rowid") == 0); 419 assert(strcmp(colnames[1], "sidprefix") == 0); 420 assert(strcmp(colnames[2], "rid") == 0); 421 assert(strcmp(colnames[3], "pid") == 0); 422 assert(strcmp(colnames[4], "w2u") == 0); 423 assert(strcmp(colnames[5], "u2w") == 0); 424 assert(strcmp(colnames[6], "windomain") == 0); 425 assert(strcmp(colnames[7], "canon_winname") == 0); 426 assert(strcmp(colnames[8], "unixname") == 0); 427 assert(strcmp(colnames[9], "is_user") == 0); 428 assert(strcmp(colnames[10], "is_wuser") == 0); 429 assert(strcmp(colnames[11], "map_type") == 0); 430 assert(strcmp(colnames[12], "map_dn") == 0); 431 assert(strcmp(colnames[13], "map_attr") == 0); 432 assert(strcmp(colnames[14], "map_value") == 0); 433 assert(strcmp(colnames[15], "map_windomain") == 0); 434 assert(strcmp(colnames[16], "map_winname") == 0); 435 assert(strcmp(colnames[17], "map_unixname") == 0); 436 assert(strcmp(colnames[18], "map_is_nt4") == 0); 437 validated_column_names = 1; 438 } 439 440 result = (idmap_mappings_res *)cb_data->result; 441 442 _VALIDATE_LIST_CB_DATA(19, &result->mappings.mappings_val, 443 sizeof (idmap_mapping)); 444 445 result->mappings.mappings_len++; 446 447 if ((str = strdup(argv[1])) == NULL) 448 return (1); 449 result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix = 450 str; 451 result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid = 452 strtoul(argv[2], &end, 10); 453 result->mappings.mappings_val[cb_data->next].id1.idtype = 454 strtol(argv[10], &end, 10) ? IDMAP_USID : IDMAP_GSID; 455 456 result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid = 457 strtoul(argv[3], &end, 10); 458 result->mappings.mappings_val[cb_data->next].id2.idtype = 459 strtol(argv[9], &end, 10) ? IDMAP_UID : IDMAP_GID; 460 461 w2u = argv[4] ? strtol(argv[4], &end, 10) : 0; 462 u2w = argv[5] ? strtol(argv[5], &end, 10) : 0; 463 464 if (w2u > 0 && u2w == 0) 465 result->mappings.mappings_val[cb_data->next].direction = 466 IDMAP_DIRECTION_W2U; 467 else if (w2u == 0 && u2w > 0) 468 result->mappings.mappings_val[cb_data->next].direction = 469 IDMAP_DIRECTION_U2W; 470 else 471 result->mappings.mappings_val[cb_data->next].direction = 472 IDMAP_DIRECTION_BI; 473 474 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1domain, 475 argv[6]); 476 477 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1name, 478 argv[7]); 479 480 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id2name, 481 argv[8]); 482 483 if (cb_data->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 484 how = &result->mappings.mappings_val[cb_data->next].info.how; 485 how->map_type = strtoul(argv[11], &end, 10); 486 switch (how->map_type) { 487 case IDMAP_MAP_TYPE_DS_AD: 488 how->idmap_how_u.ad.dn = 489 strdup(argv[12]); 490 how->idmap_how_u.ad.attr = 491 strdup(argv[13]); 492 how->idmap_how_u.ad.value = 493 strdup(argv[14]); 494 break; 495 496 case IDMAP_MAP_TYPE_DS_NLDAP: 497 how->idmap_how_u.nldap.dn = 498 strdup(argv[12]); 499 how->idmap_how_u.nldap.attr = 500 strdup(argv[13]); 501 how->idmap_how_u.nldap.value = 502 strdup(argv[14]); 503 break; 504 505 case IDMAP_MAP_TYPE_RULE_BASED: 506 how->idmap_how_u.rule.windomain = 507 strdup(argv[15]); 508 how->idmap_how_u.rule.winname = 509 strdup(argv[16]); 510 how->idmap_how_u.rule.unixname = 511 strdup(argv[17]); 512 how->idmap_how_u.rule.is_nt4 = 513 strtoul(argv[18], &end, 10); 514 how->idmap_how_u.rule.is_user = 515 strtol(argv[9], &end, 10); 516 how->idmap_how_u.rule.is_wuser = 517 strtol(argv[10], &end, 10); 518 break; 519 520 case IDMAP_MAP_TYPE_EPHEMERAL: 521 break; 522 523 case IDMAP_MAP_TYPE_LOCAL_SID: 524 break; 525 526 default: 527 /* Unknow mapping type */ 528 assert(FALSE); 529 } 530 531 } 532 533 result->lastrowid = strtoll(argv[0], &end, 10); 534 cb_data->next++; 535 result->retcode = IDMAP_SUCCESS; 536 return (0); 537 } 538 539 540 /* ARGSUSED */ 541 bool_t 542 idmap_list_mappings_1_svc(int64_t lastrowid, uint64_t limit, int32_t flag, 543 idmap_mappings_res *result, struct svc_req *rqstp) 544 { 545 sqlite *cache = NULL; 546 char lbuf[30], rbuf[30]; 547 uint64_t maxlimit; 548 idmap_retcode retcode; 549 char *sql = NULL; 550 time_t curtime; 551 552 (void) memset(result, 0, sizeof (*result)); 553 lbuf[0] = rbuf[0] = 0; 554 555 /* Current time */ 556 errno = 0; 557 if ((curtime = time(NULL)) == (time_t)-1) { 558 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 559 strerror(errno)); 560 retcode = IDMAP_ERR_INTERNAL; 561 goto out; 562 } 563 564 RDLOCK_CONFIG(); 565 maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 566 UNLOCK_CONFIG(); 567 568 /* Get cache handle */ 569 result->retcode = get_cache_handle(&cache); 570 if (result->retcode != IDMAP_SUCCESS) 571 goto out; 572 573 result->retcode = IDMAP_ERR_INTERNAL; 574 575 /* Create LIMIT expression. */ 576 if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 577 limit = maxlimit; 578 if (limit > 0) 579 (void) snprintf(lbuf, sizeof (lbuf), 580 "LIMIT %" PRIu64, limit + 1ULL); 581 582 (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 583 584 /* 585 * Combine all the above into a giant SELECT statement that 586 * will return the requested mappings 587 */ 588 589 sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, " 590 "u2w, windomain, canon_winname, unixname, is_user, is_wuser, " 591 "map_type, map_dn, map_attr, map_value, map_windomain, " 592 "map_winname, map_unixname, map_is_nt4 " 593 "FROM idmap_cache WHERE %s AND " 594 "(pid >= 2147483648 OR (expiration = 0 OR " 595 "expiration ISNULL OR expiration > %d)) " 596 "%s;", 597 rbuf, curtime, lbuf); 598 if (sql == NULL) { 599 result->retcode = IDMAP_ERR_MEMORY; 600 idmapdlog(LOG_ERR, "Out of memory"); 601 goto out; 602 } 603 604 /* Execute the SQL statement and update the return buffer */ 605 PROCESS_LIST_SVC_SQL(retcode, cache, IDMAP_CACHENAME, sql, limit, 606 flag, list_mappings_cb, result, result->mappings.mappings_len); 607 608 out: 609 if (sql) 610 sqlite_freemem(sql); 611 if (IDMAP_ERROR(result->retcode)) 612 (void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 613 result->retcode = idmap_stat4prot(result->retcode); 614 return (TRUE); 615 } 616 617 618 /* ARGSUSED */ 619 static 620 int 621 list_namerules_cb(void *parg, int argc, char **argv, char **colnames) 622 { 623 list_cb_data_t *cb_data; 624 idmap_namerules_res *result; 625 idmap_retcode retcode; 626 int w2u_order, u2w_order; 627 char *end; 628 static int validated_column_names = 0; 629 630 if (!validated_column_names) { 631 assert(strcmp(colnames[0], "rowid") == 0); 632 assert(strcmp(colnames[1], "is_user") == 0); 633 assert(strcmp(colnames[2], "is_wuser") == 0); 634 assert(strcmp(colnames[3], "windomain") == 0); 635 assert(strcmp(colnames[4], "winname_display") == 0); 636 assert(strcmp(colnames[5], "is_nt4") == 0); 637 assert(strcmp(colnames[6], "unixname") == 0); 638 assert(strcmp(colnames[7], "w2u_order") == 0); 639 assert(strcmp(colnames[8], "u2w_order") == 0); 640 validated_column_names = 1; 641 } 642 643 cb_data = (list_cb_data_t *)parg; 644 result = (idmap_namerules_res *)cb_data->result; 645 646 _VALIDATE_LIST_CB_DATA(9, &result->rules.rules_val, 647 sizeof (idmap_namerule)); 648 649 result->rules.rules_len++; 650 651 result->rules.rules_val[cb_data->next].is_user = 652 strtol(argv[1], &end, 10); 653 654 result->rules.rules_val[cb_data->next].is_wuser = 655 strtol(argv[2], &end, 10); 656 657 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].windomain, 658 argv[3]); 659 660 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].winname, 661 argv[4]); 662 663 result->rules.rules_val[cb_data->next].is_nt4 = 664 strtol(argv[5], &end, 10); 665 666 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].unixname, 667 argv[6]); 668 669 w2u_order = argv[7] ? strtol(argv[7], &end, 10) : 0; 670 u2w_order = argv[8] ? strtol(argv[8], &end, 10) : 0; 671 672 if (w2u_order > 0 && u2w_order == 0) 673 result->rules.rules_val[cb_data->next].direction = 674 IDMAP_DIRECTION_W2U; 675 else if (w2u_order == 0 && u2w_order > 0) 676 result->rules.rules_val[cb_data->next].direction = 677 IDMAP_DIRECTION_U2W; 678 else 679 result->rules.rules_val[cb_data->next].direction = 680 IDMAP_DIRECTION_BI; 681 682 result->lastrowid = strtoll(argv[0], &end, 10); 683 cb_data->next++; 684 result->retcode = IDMAP_SUCCESS; 685 return (0); 686 } 687 688 689 /* ARGSUSED */ 690 bool_t 691 idmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid, 692 uint64_t limit, idmap_namerules_res *result, 693 struct svc_req *rqstp) 694 { 695 696 sqlite *db = NULL; 697 char w2ubuf[15], u2wbuf[15]; 698 char lbuf[30], rbuf[30]; 699 char *sql = NULL; 700 char *expr = NULL; 701 uint64_t maxlimit; 702 idmap_retcode retcode; 703 704 (void) memset(result, 0, sizeof (*result)); 705 lbuf[0] = rbuf[0] = 0; 706 707 result->retcode = validate_rule(&rule); 708 if (result->retcode != IDMAP_SUCCESS) 709 goto out; 710 711 RDLOCK_CONFIG(); 712 maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 713 UNLOCK_CONFIG(); 714 715 /* Get db handle */ 716 result->retcode = get_db_handle(&db); 717 if (result->retcode != IDMAP_SUCCESS) 718 goto out; 719 720 result->retcode = IDMAP_ERR_INTERNAL; 721 722 w2ubuf[0] = u2wbuf[0] = 0; 723 if (rule.direction == IDMAP_DIRECTION_BI) { 724 (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 725 (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 726 } else if (rule.direction == IDMAP_DIRECTION_W2U) { 727 (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 728 (void) snprintf(u2wbuf, sizeof (u2wbuf), 729 "AND (u2w_order = 0 OR u2w_order ISNULL)"); 730 } else if (rule.direction == IDMAP_DIRECTION_U2W) { 731 (void) snprintf(w2ubuf, sizeof (w2ubuf), 732 "AND (w2u_order = 0 OR w2u_order ISNULL)"); 733 (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 734 } 735 736 result->retcode = gen_sql_expr_from_rule(&rule, &expr); 737 if (result->retcode != IDMAP_SUCCESS) 738 goto out; 739 740 /* Create LIMIT expression. */ 741 if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 742 limit = maxlimit; 743 if (limit > 0) 744 (void) snprintf(lbuf, sizeof (lbuf), 745 "LIMIT %" PRIu64, limit + 1ULL); 746 747 (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 748 749 /* 750 * Combine all the above into a giant SELECT statement that 751 * will return the requested rules 752 */ 753 sql = sqlite_mprintf("SELECT rowid, is_user, is_wuser, windomain, " 754 "winname_display, is_nt4, unixname, w2u_order, u2w_order " 755 "FROM namerules WHERE " 756 " %s %s %s %s %s;", 757 rbuf, expr, w2ubuf, u2wbuf, lbuf); 758 759 if (sql == NULL) { 760 result->retcode = IDMAP_ERR_MEMORY; 761 idmapdlog(LOG_ERR, "Out of memory"); 762 goto out; 763 } 764 765 /* Execute the SQL statement and update the return buffer */ 766 PROCESS_LIST_SVC_SQL(retcode, db, IDMAP_DBNAME, sql, limit, 767 0, list_namerules_cb, result, result->rules.rules_len); 768 769 out: 770 if (expr) 771 sqlite_freemem(expr); 772 if (sql) 773 sqlite_freemem(sql); 774 if (IDMAP_ERROR(result->retcode)) 775 (void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result); 776 result->retcode = idmap_stat4prot(result->retcode); 777 return (TRUE); 778 } 779 780 #define IDMAP_RULES_AUTH "solaris.admin.idmap.rules" 781 static int 782 verify_rules_auth(struct svc_req *rqstp) 783 { 784 ucred_t *uc = NULL; 785 uid_t uid; 786 char buf[1024]; 787 struct passwd pwd; 788 789 if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) { 790 idmapdlog(LOG_ERR, "svc_getcallerucred failed during " 791 "authorization (%s)", strerror(errno)); 792 return (-1); 793 } 794 795 uid = ucred_geteuid(uc); 796 if (uid == (uid_t)-1) { 797 idmapdlog(LOG_ERR, "ucred_geteuid failed during " 798 "authorization (%s)", strerror(errno)); 799 ucred_free(uc); 800 return (-1); 801 } 802 803 if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) { 804 idmapdlog(LOG_ERR, "getpwuid_r(%u) failed during " 805 "authorization (%s)", uid, strerror(errno)); 806 ucred_free(uc); 807 return (-1); 808 } 809 810 if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) { 811 idmapdlog(LOG_INFO, "%s is not authorized (%s)", 812 pwd.pw_name, IDMAP_RULES_AUTH); 813 ucred_free(uc); 814 return (-1); 815 } 816 817 ucred_free(uc); 818 return (1); 819 } 820 821 /* 822 * Meaning of the return values is the following: For retcode == 823 * IDMAP_SUCCESS, everything went OK and error_index is 824 * undefined. Otherwise, error_index >=0 shows the failed batch 825 * element. errro_index == -1 indicates failure at the beginning, 826 * error_index == -2 at the end. 827 */ 828 829 /* ARGSUSED */ 830 bool_t 831 idmap_update_1_svc(idmap_update_batch batch, idmap_update_res *res, 832 struct svc_req *rqstp) 833 { 834 sqlite *db = NULL; 835 idmap_update_op *up; 836 int i; 837 int trans = FALSE; 838 839 res->error_index = -1; 840 (void) memset(&res->error_rule, 0, sizeof (res->error_rule)); 841 (void) memset(&res->conflict_rule, 0, sizeof (res->conflict_rule)); 842 843 if (verify_rules_auth(rqstp) < 0) { 844 res->retcode = IDMAP_ERR_PERMISSION_DENIED; 845 goto out; 846 } 847 848 if (batch.idmap_update_batch_len == 0 || 849 batch.idmap_update_batch_val == NULL) { 850 res->retcode = IDMAP_SUCCESS; 851 goto out; 852 } 853 854 res->retcode = validate_rules(&batch); 855 if (res->retcode != IDMAP_SUCCESS) 856 goto out; 857 858 /* Get db handle */ 859 res->retcode = get_db_handle(&db); 860 if (res->retcode != IDMAP_SUCCESS) 861 goto out; 862 863 res->retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "BEGIN TRANSACTION;"); 864 if (res->retcode != IDMAP_SUCCESS) 865 goto out; 866 trans = TRUE; 867 868 for (i = 0; i < batch.idmap_update_batch_len; i++) { 869 up = &batch.idmap_update_batch_val[i]; 870 switch (up->opnum) { 871 case OP_NONE: 872 res->retcode = IDMAP_SUCCESS; 873 break; 874 case OP_ADD_NAMERULE: 875 res->retcode = add_namerule(db, 876 &up->idmap_update_op_u.rule); 877 break; 878 case OP_RM_NAMERULE: 879 res->retcode = rm_namerule(db, 880 &up->idmap_update_op_u.rule); 881 break; 882 case OP_FLUSH_NAMERULES: 883 res->retcode = flush_namerules(db); 884 break; 885 default: 886 res->retcode = IDMAP_ERR_NOTSUPPORTED; 887 break; 888 }; 889 890 if (res->retcode != IDMAP_SUCCESS) { 891 res->error_index = i; 892 if (up->opnum == OP_ADD_NAMERULE || 893 up->opnum == OP_RM_NAMERULE) { 894 idmap_stat r2 = 895 idmap_namerule_cpy(&res->error_rule, 896 &up->idmap_update_op_u.rule); 897 if (r2 != IDMAP_SUCCESS) 898 res->retcode = r2; 899 } 900 goto out; 901 } 902 } 903 904 out: 905 if (trans) { 906 if (res->retcode == IDMAP_SUCCESS) { 907 res->retcode = 908 sql_exec_no_cb(db, IDMAP_DBNAME, 909 "COMMIT TRANSACTION;"); 910 if (res->retcode != IDMAP_SUCCESS) 911 res->error_index = -2; 912 } 913 else 914 (void) sql_exec_no_cb(db, IDMAP_DBNAME, 915 "ROLLBACK TRANSACTION;"); 916 } 917 918 res->retcode = idmap_stat4prot(res->retcode); 919 920 return (TRUE); 921 } 922 923 924 /* ARGSUSED */ 925 bool_t 926 idmap_get_mapped_id_by_name_1_svc(idmap_mapping request, 927 idmap_mappings_res *result, struct svc_req *rqstp) 928 { 929 sqlite *cache = NULL, *db = NULL; 930 931 /* Init */ 932 (void) memset(result, 0, sizeof (*result)); 933 934 result->retcode = validate_mapped_id_by_name_req(&request); 935 if (result->retcode != IDMAP_SUCCESS) 936 goto out; 937 938 /* Get cache handle */ 939 result->retcode = get_cache_handle(&cache); 940 if (result->retcode != IDMAP_SUCCESS) 941 goto out; 942 943 /* Get db handle */ 944 result->retcode = get_db_handle(&db); 945 if (result->retcode != IDMAP_SUCCESS) 946 goto out; 947 948 /* Allocate result */ 949 result->mappings.mappings_val = calloc(1, sizeof (idmap_mapping)); 950 if (result->mappings.mappings_val == NULL) { 951 idmapdlog(LOG_ERR, "Out of memory"); 952 result->retcode = IDMAP_ERR_MEMORY; 953 goto out; 954 } 955 result->mappings.mappings_len = 1; 956 957 958 if (IS_REQUEST_SID(request, 1)) { 959 result->retcode = get_w2u_mapping( 960 cache, 961 db, 962 &request, 963 result->mappings.mappings_val); 964 } else if (IS_REQUEST_UID(request)) { 965 result->retcode = get_u2w_mapping( 966 cache, 967 db, 968 &request, 969 result->mappings.mappings_val, 970 1); 971 } else if (IS_REQUEST_GID(request)) { 972 result->retcode = get_u2w_mapping( 973 cache, 974 db, 975 &request, 976 result->mappings.mappings_val, 977 0); 978 } else { 979 result->retcode = IDMAP_ERR_IDTYPE; 980 } 981 982 out: 983 if (IDMAP_FATAL_ERROR(result->retcode)) { 984 xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 985 result->mappings.mappings_len = 0; 986 result->mappings.mappings_val = NULL; 987 } 988 result->retcode = idmap_stat4prot(result->retcode); 989 return (TRUE); 990 } 991 992 /* ARGSUSED */ 993 bool_t 994 idmap_get_prop_1_svc(idmap_prop_type request, 995 idmap_prop_res *result, struct svc_req *rqstp) 996 { 997 idmap_pg_config_t *pgcfg; 998 999 /* Init */ 1000 (void) memset(result, 0, sizeof (*result)); 1001 result->retcode = IDMAP_SUCCESS; 1002 result->value.prop = request; 1003 1004 RDLOCK_CONFIG(); 1005 1006 /* Just shortcuts: */ 1007 pgcfg = &_idmapdstate.cfg->pgcfg; 1008 1009 1010 switch (request) { 1011 case PROP_LIST_SIZE_LIMIT: 1012 result->value.idmap_prop_val_u.intval = pgcfg->list_size_limit; 1013 result->auto_discovered = FALSE; 1014 break; 1015 case PROP_DEFAULT_DOMAIN: 1016 result->auto_discovered = FALSE; 1017 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1018 pgcfg->default_domain); 1019 break; 1020 case PROP_DOMAIN_NAME: 1021 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1022 pgcfg->domain_name); 1023 result->auto_discovered = 1024 pgcfg->domain_name_auto_disc; 1025 break; 1026 case PROP_MACHINE_SID: 1027 result->auto_discovered = FALSE; 1028 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1029 pgcfg->machine_sid); 1030 break; 1031 case PROP_DOMAIN_CONTROLLER: 1032 if (pgcfg->domain_controller != NULL) { 1033 (void) memcpy(&result->value.idmap_prop_val_u.dsval, 1034 pgcfg->domain_controller, 1035 sizeof (idmap_ad_disc_ds_t)); 1036 } 1037 result->auto_discovered = pgcfg->domain_controller_auto_disc; 1038 break; 1039 case PROP_FOREST_NAME: 1040 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1041 pgcfg->forest_name); 1042 result->auto_discovered = pgcfg->forest_name_auto_disc; 1043 break; 1044 case PROP_SITE_NAME: 1045 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1046 pgcfg->site_name); 1047 result->auto_discovered = pgcfg->site_name_auto_disc; 1048 break; 1049 case PROP_GLOBAL_CATALOG: 1050 if (pgcfg->global_catalog != NULL) { 1051 (void) memcpy(&result->value.idmap_prop_val_u.dsval, 1052 pgcfg->global_catalog, sizeof (idmap_ad_disc_ds_t)); 1053 } 1054 result->auto_discovered = pgcfg->global_catalog_auto_disc; 1055 break; 1056 case PROP_AD_UNIXUSER_ATTR: 1057 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1058 pgcfg->ad_unixuser_attr); 1059 result->auto_discovered = FALSE; 1060 break; 1061 case PROP_AD_UNIXGROUP_ATTR: 1062 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1063 pgcfg->ad_unixgroup_attr); 1064 result->auto_discovered = FALSE; 1065 break; 1066 case PROP_NLDAP_WINNAME_ATTR: 1067 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1068 pgcfg->nldap_winname_attr); 1069 result->auto_discovered = FALSE; 1070 break; 1071 case PROP_DS_NAME_MAPPING_ENABLED: 1072 result->value.idmap_prop_val_u.boolval = 1073 pgcfg->ds_name_mapping_enabled; 1074 result->auto_discovered = FALSE; 1075 break; 1076 default: 1077 result->retcode = IDMAP_ERR_PROP_UNKNOWN; 1078 break; 1079 } 1080 1081 out: 1082 UNLOCK_CONFIG(); 1083 if (IDMAP_FATAL_ERROR(result->retcode)) { 1084 xdr_free(xdr_idmap_prop_res, (caddr_t)result); 1085 result->value.prop = PROP_UNKNOWN; 1086 } 1087 result->retcode = idmap_stat4prot(result->retcode); 1088 return (TRUE); 1089 } 1090 1091 1092 /* ARGSUSED */ 1093 int 1094 idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, 1095 caddr_t result) 1096 { 1097 (void) xdr_free(xdr_result, result); 1098 return (TRUE); 1099 } 1100