xref: /titanic_44/usr/src/cmd/idmap/idmapd/dbutils.c (revision a417a0e00dcfc46716fd95c676b5017c7923e382)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * Database related utility routines
30  */
31 
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <string.h>
35 #include <errno.h>
36 #include <sys/types.h>
37 #include <sys/stat.h>
38 #include <rpc/rpc.h>
39 #include <sys/sid.h>
40 #include <time.h>
41 #include <pwd.h>
42 #include <grp.h>
43 #include <pthread.h>
44 #include <assert.h>
45 #include <sys/u8_textprep.h>
46 
47 #include "idmapd.h"
48 #include "adutils.h"
49 #include "string.h"
50 #include "idmap_priv.h"
51 #include "schema.h"
52 #include "nldaputils.h"
53 
54 
55 static idmap_retcode sql_compile_n_step_once(sqlite *, char *,
56 		sqlite_vm **, int *, int, const char ***);
57 static idmap_retcode lookup_wksids_name2sid(const char *, char **, char **,
58 		idmap_rid_t *, int *);
59 static idmap_retcode ad_lookup(lookup_state_t *, idmap_mapping *,
60 		idmap_id_res *, int, int, int);
61 static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *);
62 static idmap_retcode lookup_cache_name2sid(sqlite *, const char *,
63 		const char *, char **, char **, idmap_rid_t *, int *);
64 
65 
66 #define	EMPTY_NAME(name)	(*name == 0 || strcmp(name, "\"\"") == 0)
67 
68 #define	DO_NOT_ALLOC_NEW_ID_MAPPING(req)\
69 		(req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC)
70 
71 #define	AVOID_NAMESERVICE(req)\
72 		(req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE)
73 
74 #define	IS_EPHEMERAL(pid)	(pid > INT32_MAX && pid != SENTINEL_PID)
75 
76 #define	LOCALRID_MIN	1000
77 
78 
79 typedef enum init_db_option {
80 	FAIL_IF_CORRUPT = 0,
81 	REMOVE_IF_CORRUPT = 1
82 } init_db_option_t;
83 
84 /*
85  * Data structure to store well-known SIDs and
86  * associated mappings (if any)
87  */
88 typedef struct wksids_table {
89 	const char	*sidprefix;
90 	uint32_t	rid;
91 	const char	*winname;
92 	int		is_wuser;
93 	uid_t		pid;
94 	int		is_user;
95 	int		direction;
96 } wksids_table_t;
97 
98 /*
99  * Thread specfic data to hold the database handles so that the
100  * databaes are not opened and closed for every request. It also
101  * contains the sqlite busy handler structure.
102  */
103 
104 struct idmap_busy {
105 	const char *name;
106 	const int *delays;
107 	int delay_size;
108 	int total;
109 	int sec;
110 };
111 
112 
113 typedef struct idmap_tsd {
114 	sqlite *db_db;
115 	sqlite *cache_db;
116 	struct idmap_busy cache_busy;
117 	struct idmap_busy db_busy;
118 } idmap_tsd_t;
119 
120 
121 
122 static const int cache_delay_table[] =
123 		{ 1, 2, 5, 10, 15, 20, 25, 30,  35,  40,
124 		50,  50, 60, 70, 80, 90, 100};
125 
126 static const int db_delay_table[] =
127 		{ 5, 10, 15, 20, 30,  40,  55,  70, 100};
128 
129 
130 static pthread_key_t	idmap_tsd_key;
131 
132 void
133 idmap_tsd_destroy(void *key)
134 {
135 
136 	idmap_tsd_t	*tsd = (idmap_tsd_t *)key;
137 	if (tsd) {
138 		if (tsd->db_db)
139 			(void) sqlite_close(tsd->db_db);
140 		if (tsd->cache_db)
141 			(void) sqlite_close(tsd->cache_db);
142 		free(tsd);
143 	}
144 }
145 
146 int
147 idmap_init_tsd_key(void)
148 {
149 	return (pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy));
150 }
151 
152 
153 
154 idmap_tsd_t *
155 idmap_get_tsd(void)
156 {
157 	idmap_tsd_t	*tsd;
158 
159 	if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) {
160 		/* No thread specific data so create it */
161 		if ((tsd = malloc(sizeof (*tsd))) != NULL) {
162 			/* Initialize thread specific data */
163 			(void) memset(tsd, 0, sizeof (*tsd));
164 			/* save the trhread specific data */
165 			if (pthread_setspecific(idmap_tsd_key, tsd) != 0) {
166 				/* Can't store key */
167 				free(tsd);
168 				tsd = NULL;
169 			}
170 		} else {
171 			tsd = NULL;
172 		}
173 	}
174 
175 	return (tsd);
176 }
177 
178 /*
179  * A simple wrapper around u8_textprep_str() that returns the Unicode
180  * lower-case version of some string.  The result must be freed.
181  */
182 char *
183 tolower_u8(const char *s)
184 {
185 	char *res = NULL;
186 	char *outs;
187 	size_t inlen, outlen, inbytesleft, outbytesleft;
188 	int rc, err;
189 
190 	/*
191 	 * u8_textprep_str() does not allocate memory.  The input and
192 	 * output buffers may differ in size (though that would be more
193 	 * likely when normalization is done).  We have to loop over it...
194 	 *
195 	 * To improve the chances that we can avoid looping we add 10
196 	 * bytes of output buffer room the first go around.
197 	 */
198 	inlen = inbytesleft = strlen(s);
199 	outlen = outbytesleft = inlen + 10;
200 	if ((res = malloc(outlen)) == NULL)
201 		return (NULL);
202 	outs = res;
203 
204 	while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs,
205 	    &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 &&
206 	    err == E2BIG) {
207 		if ((res = realloc(res, outlen + inbytesleft)) == NULL)
208 			return (NULL);
209 		/* adjust input/output buffer pointers */
210 		s += (inlen - inbytesleft);
211 		outs = res + outlen - outbytesleft;
212 		/* adjust outbytesleft and outlen */
213 		outlen += inbytesleft;
214 		outbytesleft += inbytesleft;
215 	}
216 
217 	if (rc < 0) {
218 		free(res);
219 		res = NULL;
220 		return (NULL);
221 	}
222 
223 	res[outlen - outbytesleft] = '\0';
224 
225 	return (res);
226 }
227 
228 static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
229 	const char *while_doing);
230 
231 
232 /*
233  * Initialize 'dbname' using 'sql'
234  */
235 static
236 int
237 init_db_instance(const char *dbname, int version,
238 	const char *detect_version_sql, char * const *sql,
239 	init_db_option_t opt, int *created, int *upgraded)
240 {
241 	int rc, curr_version;
242 	int tries = 1;
243 	int prio = LOG_NOTICE;
244 	sqlite *db = NULL;
245 	char *errmsg = NULL;
246 
247 	*created = 0;
248 	*upgraded = 0;
249 
250 	if (opt == REMOVE_IF_CORRUPT)
251 		tries = 3;
252 
253 rinse_repeat:
254 	if (tries == 0) {
255 		idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname);
256 		return (-1);
257 	}
258 	if (tries-- == 1)
259 		/* Last try, log errors */
260 		prio = LOG_ERR;
261 
262 	db = sqlite_open(dbname, 0600, &errmsg);
263 	if (db == NULL) {
264 		idmapdlog(prio, "Error creating database %s (%s)",
265 		    dbname, CHECK_NULL(errmsg));
266 		sqlite_freemem(errmsg);
267 		if (opt == REMOVE_IF_CORRUPT)
268 			(void) unlink(dbname);
269 		goto rinse_repeat;
270 	}
271 
272 	sqlite_busy_timeout(db, 3000);
273 
274 	/* Detect current version of schema in the db, if any */
275 	curr_version = 0;
276 	if (detect_version_sql != NULL) {
277 		char *end, **results;
278 		int nrow;
279 
280 #ifdef	IDMAPD_DEBUG
281 		(void) fprintf(stderr, "Schema version detection SQL: %s\n",
282 		    detect_version_sql);
283 #endif	/* IDMAPD_DEBUG */
284 		rc = sqlite_get_table(db, detect_version_sql, &results,
285 		    &nrow, NULL, &errmsg);
286 		if (rc != SQLITE_OK) {
287 			idmapdlog(prio,
288 			    "Error detecting schema version of db %s (%s)",
289 			    dbname, errmsg);
290 			sqlite_freemem(errmsg);
291 			sqlite_free_table(results);
292 			sqlite_close(db);
293 			return (-1);
294 		}
295 		if (nrow != 1) {
296 			idmapdlog(prio,
297 			    "Error detecting schema version of db %s", dbname);
298 			sqlite_close(db);
299 			sqlite_free_table(results);
300 			return (-1);
301 		}
302 		curr_version = strtol(results[1], &end, 10);
303 		sqlite_free_table(results);
304 	}
305 
306 	if (curr_version < 0) {
307 		if (opt == REMOVE_IF_CORRUPT)
308 			(void) unlink(dbname);
309 		goto rinse_repeat;
310 	}
311 
312 	if (curr_version == version)
313 		goto done;
314 
315 	/* Install or upgrade schema */
316 #ifdef	IDMAPD_DEBUG
317 	(void) fprintf(stderr, "Schema init/upgrade SQL: %s\n",
318 	    sql[curr_version]);
319 #endif	/* IDMAPD_DEBUG */
320 	rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname,
321 	    (curr_version == 0) ? "installing schema" : "upgrading schema");
322 	if (rc != 0) {
323 		idmapdlog(prio, "Error %s schema for db %s", dbname,
324 		    (curr_version == 0) ? "installing schema" :
325 		    "upgrading schema");
326 		if (opt == REMOVE_IF_CORRUPT)
327 			(void) unlink(dbname);
328 		goto rinse_repeat;
329 	}
330 
331 	*upgraded = (curr_version > 0);
332 	*created = (curr_version == 0);
333 
334 done:
335 	(void) sqlite_close(db);
336 	return (0);
337 }
338 
339 
340 /*
341  * This is the SQLite database busy handler that retries the SQL
342  * operation until it is successful.
343  */
344 int
345 /* LINTED E_FUNC_ARG_UNUSED */
346 idmap_sqlite_busy_handler(void *arg, const char *table_name, int count)
347 {
348 	struct idmap_busy	*busy = arg;
349 	int			delay;
350 	struct timespec		rqtp;
351 
352 	if (count == 1)  {
353 		busy->total = 0;
354 		busy->sec = 2;
355 	}
356 	if (busy->total > 1000 * busy->sec) {
357 		idmapdlog(LOG_ERR,
358 		    "Thread %d waited %d sec for the %s database",
359 		    pthread_self(), busy->sec, busy->name);
360 		busy->sec++;
361 	}
362 
363 	if (count <= busy->delay_size) {
364 		delay = busy->delays[count-1];
365 	} else {
366 		delay = busy->delays[busy->delay_size - 1];
367 	}
368 	busy->total += delay;
369 	rqtp.tv_sec = 0;
370 	rqtp.tv_nsec = delay * (NANOSEC / MILLISEC);
371 	(void) nanosleep(&rqtp, NULL);
372 	return (1);
373 }
374 
375 
376 /*
377  * Get the database handle
378  */
379 idmap_retcode
380 get_db_handle(sqlite **db)
381 {
382 	char		*errmsg;
383 	idmap_tsd_t	*tsd;
384 
385 	/*
386 	 * Retrieve the db handle from thread-specific storage
387 	 * If none exists, open and store in thread-specific storage.
388 	 */
389 	if ((tsd = idmap_get_tsd()) == NULL) {
390 		idmapdlog(LOG_ERR,
391 		    "Error getting thread specific data for %s", IDMAP_DBNAME);
392 		return (IDMAP_ERR_MEMORY);
393 	}
394 
395 	if (tsd->db_db == NULL) {
396 		tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg);
397 		if (tsd->db_db == NULL) {
398 			idmapdlog(LOG_ERR, "Error opening database %s (%s)",
399 			    IDMAP_DBNAME, CHECK_NULL(errmsg));
400 			sqlite_freemem(errmsg);
401 			return (IDMAP_ERR_DB);
402 		}
403 
404 		tsd->db_busy.name = IDMAP_DBNAME;
405 		tsd->db_busy.delays = db_delay_table;
406 		tsd->db_busy.delay_size = sizeof (db_delay_table) /
407 		    sizeof (int);
408 		sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler,
409 		    &tsd->db_busy);
410 	}
411 	*db = tsd->db_db;
412 	return (IDMAP_SUCCESS);
413 }
414 
415 /*
416  * Get the cache handle
417  */
418 idmap_retcode
419 get_cache_handle(sqlite **cache)
420 {
421 	char		*errmsg;
422 	idmap_tsd_t	*tsd;
423 
424 	/*
425 	 * Retrieve the db handle from thread-specific storage
426 	 * If none exists, open and store in thread-specific storage.
427 	 */
428 	if ((tsd = idmap_get_tsd()) == NULL) {
429 		idmapdlog(LOG_ERR, "Error getting thread specific data for %s",
430 		    IDMAP_DBNAME);
431 		return (IDMAP_ERR_MEMORY);
432 	}
433 
434 	if (tsd->cache_db == NULL) {
435 		tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg);
436 		if (tsd->cache_db == NULL) {
437 			idmapdlog(LOG_ERR, "Error opening database %s (%s)",
438 			    IDMAP_CACHENAME, CHECK_NULL(errmsg));
439 			sqlite_freemem(errmsg);
440 			return (IDMAP_ERR_DB);
441 		}
442 
443 		tsd->cache_busy.name = IDMAP_CACHENAME;
444 		tsd->cache_busy.delays = cache_delay_table;
445 		tsd->cache_busy.delay_size = sizeof (cache_delay_table) /
446 		    sizeof (int);
447 		sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler,
448 		    &tsd->cache_busy);
449 	}
450 	*cache = tsd->cache_db;
451 	return (IDMAP_SUCCESS);
452 }
453 
454 /*
455  * Initialize cache and db
456  */
457 int
458 init_dbs()
459 {
460 	char *sql[2];
461 	int created, upgraded;
462 
463 	/* name-based mappings; probably OK to blow away in a pinch(?) */
464 	sql[0] = DB_INSTALL_SQL;
465 	sql[1] = DB_UPGRADE_FROM_v1_SQL;
466 
467 	if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql,
468 	    FAIL_IF_CORRUPT, &created, &upgraded) < 0)
469 		return (-1);
470 
471 	/* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */
472 	sql[0] = CACHE_INSTALL_SQL;
473 	sql[1] = CACHE_UPGRADE_FROM_v1_SQL;
474 	if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL,
475 	    sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0)
476 		return (-1);
477 
478 	_idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0;
479 
480 	return (0);
481 }
482 
483 /*
484  * Finalize databases
485  */
486 void
487 fini_dbs()
488 {
489 }
490 
491 /*
492  * This table is a listing of status codes that will be returned to the
493  * client when a SQL command fails with the corresponding error message.
494  */
495 static msg_table_t sqlmsgtable[] = {
496 	{IDMAP_ERR_U2W_NAMERULE_CONFLICT,
497 	"columns unixname, is_user, u2w_order are not unique"},
498 	{IDMAP_ERR_W2U_NAMERULE_CONFLICT,
499 	"columns winname, windomain, is_user, is_wuser, w2u_order are not"
500 	" unique"},
501 	{IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"},
502 	{-1, NULL}
503 };
504 
505 /*
506  * idmapd's version of string2stat to map SQLite messages to
507  * status codes
508  */
509 idmap_retcode
510 idmapd_string2stat(const char *msg)
511 {
512 	int i;
513 	for (i = 0; sqlmsgtable[i].msg; i++) {
514 		if (strcasecmp(sqlmsgtable[i].msg, msg) == 0)
515 			return (sqlmsgtable[i].retcode);
516 	}
517 	return (IDMAP_ERR_OTHER);
518 }
519 
520 /*
521  * Executes some SQL in a transaction.
522  *
523  * Returns 0 on success, -1 if it failed but the rollback succeeded, -2
524  * if the rollback failed.
525  */
526 static
527 int
528 sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
529 	const char *while_doing)
530 {
531 	char		*errmsg = NULL;
532 	int		rc;
533 
534 	rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg);
535 	if (rc != SQLITE_OK) {
536 		idmapdlog(LOG_ERR, "Begin transaction failed (%s) "
537 		    "while %s (%s)", errmsg, while_doing, dbname);
538 		sqlite_freemem(errmsg);
539 		return (-1);
540 	}
541 
542 	rc = sqlite_exec(db, sql, NULL, NULL, &errmsg);
543 	if (rc != SQLITE_OK) {
544 		idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg,
545 		    while_doing, dbname);
546 		sqlite_freemem(errmsg);
547 		errmsg = NULL;
548 		goto rollback;
549 	}
550 
551 	rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg);
552 	if (rc == SQLITE_OK) {
553 		sqlite_freemem(errmsg);
554 		return (0);
555 	}
556 
557 	idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)",
558 	    errmsg, while_doing, dbname);
559 	sqlite_freemem(errmsg);
560 	errmsg = NULL;
561 
562 rollback:
563 	rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg);
564 	if (rc != SQLITE_OK) {
565 		idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)",
566 		    errmsg, while_doing, dbname);
567 		sqlite_freemem(errmsg);
568 		return (-2);
569 	}
570 	sqlite_freemem(errmsg);
571 
572 	return (-1);
573 }
574 
575 /*
576  * Execute the given SQL statment without using any callbacks
577  */
578 idmap_retcode
579 sql_exec_no_cb(sqlite *db, const char *dbname, char *sql)
580 {
581 	char		*errmsg = NULL;
582 	int		r;
583 	idmap_retcode	retcode;
584 
585 	r = sqlite_exec(db, sql, NULL, NULL, &errmsg);
586 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
587 
588 	if (r != SQLITE_OK) {
589 		idmapdlog(LOG_ERR, "Database error on %s while executing %s "
590 		    "(%s)", dbname, sql, CHECK_NULL(errmsg));
591 		retcode = idmapd_string2stat(errmsg);
592 		if (errmsg != NULL)
593 			sqlite_freemem(errmsg);
594 		return (retcode);
595 	}
596 
597 	return (IDMAP_SUCCESS);
598 }
599 
600 /*
601  * Generate expression that can be used in WHERE statements.
602  * Examples:
603  * <prefix> <col>      <op> <value>   <suffix>
604  * ""       "unixuser" "="  "foo" "AND"
605  */
606 idmap_retcode
607 gen_sql_expr_from_rule(idmap_namerule *rule, char **out)
608 {
609 	char	*s_windomain = NULL, *s_winname = NULL;
610 	char	*s_unixname = NULL;
611 	char	*lower_winname;
612 	int	retcode = IDMAP_SUCCESS;
613 
614 	if (out == NULL)
615 		return (IDMAP_ERR_ARG);
616 
617 
618 	if (!EMPTY_STRING(rule->windomain)) {
619 		s_windomain =  sqlite_mprintf("AND windomain = %Q ",
620 		    rule->windomain);
621 		if (s_windomain == NULL) {
622 			retcode = IDMAP_ERR_MEMORY;
623 			goto out;
624 		}
625 	}
626 
627 	if (!EMPTY_STRING(rule->winname)) {
628 		if ((lower_winname = tolower_u8(rule->winname)) == NULL)
629 			lower_winname = rule->winname;
630 		s_winname = sqlite_mprintf(
631 		    "AND winname = %Q AND is_wuser = %d ",
632 		    lower_winname, rule->is_wuser ? 1 : 0);
633 		if (lower_winname != rule->winname)
634 			free(lower_winname);
635 		if (s_winname == NULL) {
636 			retcode = IDMAP_ERR_MEMORY;
637 			goto out;
638 		}
639 	}
640 
641 	if (!EMPTY_STRING(rule->unixname)) {
642 		s_unixname = sqlite_mprintf(
643 		    "AND unixname = %Q AND is_user = %d ",
644 		    rule->unixname, rule->is_user ? 1 : 0);
645 		if (s_unixname == NULL) {
646 			retcode = IDMAP_ERR_MEMORY;
647 			goto out;
648 		}
649 	}
650 
651 	*out = sqlite_mprintf("%s %s %s",
652 	    s_windomain ? s_windomain : "",
653 	    s_winname ? s_winname : "",
654 	    s_unixname ? s_unixname : "");
655 
656 	if (*out == NULL) {
657 		retcode = IDMAP_ERR_MEMORY;
658 		idmapdlog(LOG_ERR, "Out of memory");
659 		goto out;
660 	}
661 
662 out:
663 	if (s_windomain != NULL)
664 		sqlite_freemem(s_windomain);
665 	if (s_winname != NULL)
666 		sqlite_freemem(s_winname);
667 	if (s_unixname != NULL)
668 		sqlite_freemem(s_unixname);
669 
670 	return (retcode);
671 }
672 
673 
674 
675 /*
676  * Generate and execute SQL statement for LIST RPC calls
677  */
678 idmap_retcode
679 process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit,
680 		list_svc_cb cb, void *result)
681 {
682 	list_cb_data_t	cb_data;
683 	char		*errmsg = NULL;
684 	int		r;
685 	idmap_retcode	retcode = IDMAP_ERR_INTERNAL;
686 
687 	(void) memset(&cb_data, 0, sizeof (cb_data));
688 	cb_data.result = result;
689 	cb_data.limit = limit;
690 
691 
692 	r = sqlite_exec(db, sql, cb, &cb_data, &errmsg);
693 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
694 	switch (r) {
695 	case SQLITE_OK:
696 		retcode = IDMAP_SUCCESS;
697 		break;
698 
699 	default:
700 		retcode = IDMAP_ERR_INTERNAL;
701 		idmapdlog(LOG_ERR, "Database error on %s while executing "
702 		    "%s (%s)", dbname, sql, CHECK_NULL(errmsg));
703 		break;
704 	}
705 	if (errmsg != NULL)
706 		sqlite_freemem(errmsg);
707 	return (retcode);
708 }
709 
710 /*
711  * This routine is called by callbacks that process the results of
712  * LIST RPC calls to validate data and to allocate memory for
713  * the result array.
714  */
715 idmap_retcode
716 validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv,
717 		int ncol, uchar_t **list, size_t valsize)
718 {
719 	size_t	nsize;
720 	void	*tmplist;
721 
722 	if (cb_data->limit > 0 && cb_data->next == cb_data->limit)
723 		return (IDMAP_NEXT);
724 
725 	if (argc < ncol || argv == NULL) {
726 		idmapdlog(LOG_ERR, "Invalid data");
727 		return (IDMAP_ERR_INTERNAL);
728 	}
729 
730 	/* alloc in bulk to reduce number of reallocs */
731 	if (cb_data->next >= cb_data->len) {
732 		nsize = (cb_data->len + SIZE_INCR) * valsize;
733 		tmplist = realloc(*list, nsize);
734 		if (tmplist == NULL) {
735 			idmapdlog(LOG_ERR, "Out of memory");
736 			return (IDMAP_ERR_MEMORY);
737 		}
738 		*list = tmplist;
739 		(void) memset(*list + (cb_data->len * valsize), 0,
740 		    SIZE_INCR * valsize);
741 		cb_data->len += SIZE_INCR;
742 	}
743 	return (IDMAP_SUCCESS);
744 }
745 
746 static
747 idmap_retcode
748 get_namerule_order(char *winname, char *windomain, char *unixname,
749 	int direction, int is_diagonal, int *w2u_order, int *u2w_order)
750 {
751 	*w2u_order = 0;
752 	*u2w_order = 0;
753 
754 	/*
755 	 * Windows to UNIX lookup order:
756 	 *  1. winname@domain (or winname) to ""
757 	 *  2. winname@domain (or winname) to unixname
758 	 *  3. winname@* to ""
759 	 *  4. winname@* to unixname
760 	 *  5. *@domain (or *) to *
761 	 *  6. *@domain (or *) to ""
762 	 *  7. *@domain (or *) to unixname
763 	 *  8. *@* to *
764 	 *  9. *@* to ""
765 	 * 10. *@* to unixname
766 	 *
767 	 * winname is a special case of winname@domain when domain is the
768 	 * default domain. Similarly * is a special case of *@domain when
769 	 * domain is the default domain.
770 	 *
771 	 * Note that "" has priority over specific names because "" inhibits
772 	 * mappings and traditionally deny rules always had higher priority.
773 	 */
774 	if (direction != IDMAP_DIRECTION_U2W) {
775 		/* bi-directional or from windows to unix */
776 		if (winname == NULL)
777 			return (IDMAP_ERR_W2U_NAMERULE);
778 		else if (unixname == NULL)
779 			return (IDMAP_ERR_W2U_NAMERULE);
780 		else if (EMPTY_NAME(winname))
781 			return (IDMAP_ERR_W2U_NAMERULE);
782 		else if (*winname == '*' && windomain && *windomain == '*') {
783 			if (*unixname == '*')
784 				*w2u_order = 8;
785 			else if (EMPTY_NAME(unixname))
786 				*w2u_order = 9;
787 			else /* unixname == name */
788 				*w2u_order = 10;
789 		} else if (*winname == '*') {
790 			if (*unixname == '*')
791 				*w2u_order = 5;
792 			else if (EMPTY_NAME(unixname))
793 				*w2u_order = 6;
794 			else /* name */
795 				*w2u_order = 7;
796 		} else if (windomain != NULL && *windomain == '*') {
797 			/* winname == name */
798 			if (*unixname == '*')
799 				return (IDMAP_ERR_W2U_NAMERULE);
800 			else if (EMPTY_NAME(unixname))
801 				*w2u_order = 3;
802 			else /* name */
803 				*w2u_order = 4;
804 		} else  {
805 			/* winname == name && windomain == null or name */
806 			if (*unixname == '*')
807 				return (IDMAP_ERR_W2U_NAMERULE);
808 			else if (EMPTY_NAME(unixname))
809 				*w2u_order = 1;
810 			else /* name */
811 				*w2u_order = 2;
812 		}
813 
814 	}
815 
816 	/*
817 	 * 1. unixname to "", non-diagonal
818 	 * 2. unixname to winname@domain (or winname), non-diagonal
819 	 * 3. unixname to "", diagonal
820 	 * 4. unixname to winname@domain (or winname), diagonal
821 	 * 5. * to *@domain (or *), non-diagonal
822 	 * 5. * to *@domain (or *), diagonal
823 	 * 7. * to ""
824 	 * 8. * to winname@domain (or winname)
825 	 * 9. * to "", non-diagonal
826 	 * 10. * to winname@domain (or winname), diagonal
827 	 */
828 	if (direction != IDMAP_DIRECTION_W2U) {
829 		int diagonal = is_diagonal ? 1 : 0;
830 
831 		/* bi-directional or from unix to windows */
832 		if (unixname == NULL || EMPTY_NAME(unixname))
833 			return (IDMAP_ERR_U2W_NAMERULE);
834 		else if (winname == NULL)
835 			return (IDMAP_ERR_U2W_NAMERULE);
836 		else if (windomain != NULL && *windomain == '*')
837 			return (IDMAP_ERR_U2W_NAMERULE);
838 		else if (*unixname == '*') {
839 			if (*winname == '*')
840 				*u2w_order = 5 + diagonal;
841 			else if (EMPTY_NAME(winname))
842 				*u2w_order = 7 + 2 * diagonal;
843 			else
844 				*u2w_order = 8 + 2 * diagonal;
845 		} else {
846 			if (*winname == '*')
847 				return (IDMAP_ERR_U2W_NAMERULE);
848 			else if (EMPTY_NAME(winname))
849 				*u2w_order = 1 + 2 * diagonal;
850 			else
851 				*u2w_order = 2 + 2 * diagonal;
852 		}
853 	}
854 	return (IDMAP_SUCCESS);
855 }
856 
857 /*
858  * Generate and execute SQL statement to add name-based mapping rule
859  */
860 idmap_retcode
861 add_namerule(sqlite *db, idmap_namerule *rule)
862 {
863 	char		*sql = NULL;
864 	idmap_stat	retcode;
865 	char		*dom = NULL;
866 	int		w2u_order, u2w_order;
867 	char		w2ubuf[11], u2wbuf[11];
868 
869 	retcode = get_namerule_order(rule->winname, rule->windomain,
870 	    rule->unixname, rule->direction,
871 	    rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order);
872 	if (retcode != IDMAP_SUCCESS)
873 		goto out;
874 
875 	if (w2u_order)
876 		(void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order);
877 	if (u2w_order)
878 		(void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order);
879 
880 	/*
881 	 * For the triggers on namerules table to work correctly:
882 	 * 1) Use NULL instead of 0 for w2u_order and u2w_order
883 	 * 2) Use "" instead of NULL for "no domain"
884 	 */
885 
886 	if (!EMPTY_STRING(rule->windomain))
887 		dom = rule->windomain;
888 	else if (lookup_wksids_name2sid(rule->winname, NULL, NULL, NULL, NULL)
889 	    == IDMAP_SUCCESS) {
890 		/* well-known SIDs don't need domain */
891 		dom = "";
892 	}
893 
894 	RDLOCK_CONFIG();
895 	if (dom == NULL) {
896 		if (_idmapdstate.cfg->pgcfg.default_domain)
897 			dom = _idmapdstate.cfg->pgcfg.default_domain;
898 		else
899 			dom = "";
900 	}
901 	sql = sqlite_mprintf("INSERT into namerules "
902 	    "(is_user, is_wuser, windomain, winname_display, is_nt4, "
903 	    "unixname, w2u_order, u2w_order) "
904 	    "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);",
905 	    rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom,
906 	    rule->winname, rule->is_nt4 ? 1 : 0, rule->unixname,
907 	    w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL);
908 	UNLOCK_CONFIG();
909 
910 	if (sql == NULL) {
911 		retcode = IDMAP_ERR_INTERNAL;
912 		idmapdlog(LOG_ERR, "Out of memory");
913 		goto out;
914 	}
915 
916 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
917 
918 	if (retcode == IDMAP_ERR_OTHER)
919 		retcode = IDMAP_ERR_CFG;
920 
921 out:
922 	if (sql != NULL)
923 		sqlite_freemem(sql);
924 	return (retcode);
925 }
926 
927 /*
928  * Flush name-based mapping rules
929  */
930 idmap_retcode
931 flush_namerules(sqlite *db)
932 {
933 	idmap_stat	retcode;
934 
935 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;");
936 
937 	return (retcode);
938 }
939 
940 /*
941  * Generate and execute SQL statement to remove a name-based mapping rule
942  */
943 idmap_retcode
944 rm_namerule(sqlite *db, idmap_namerule *rule)
945 {
946 	char		*sql = NULL;
947 	idmap_stat	retcode;
948 	char		buf[80];
949 	char		*expr = NULL;
950 
951 	if (rule->direction < 0 && EMPTY_STRING(rule->windomain) &&
952 	    EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname))
953 		return (IDMAP_SUCCESS);
954 
955 	buf[0] = 0;
956 
957 	if (rule->direction == IDMAP_DIRECTION_BI)
958 		(void) snprintf(buf, sizeof (buf), "AND w2u_order > 0"
959 		    " AND u2w_order > 0");
960 	else if (rule->direction == IDMAP_DIRECTION_W2U)
961 		(void) snprintf(buf, sizeof (buf), "AND w2u_order > 0"
962 		    " AND (u2w_order = 0 OR u2w_order ISNULL)");
963 	else if (rule->direction == IDMAP_DIRECTION_U2W)
964 		(void) snprintf(buf, sizeof (buf), "AND u2w_order > 0"
965 		    " AND (w2u_order = 0 OR w2u_order ISNULL)");
966 
967 	retcode = gen_sql_expr_from_rule(rule, &expr);
968 	if (retcode != IDMAP_SUCCESS)
969 		goto out;
970 
971 	sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s %s;", expr,
972 	    buf);
973 
974 	if (sql == NULL) {
975 		retcode = IDMAP_ERR_INTERNAL;
976 		idmapdlog(LOG_ERR, "Out of memory");
977 		goto out;
978 	}
979 
980 
981 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
982 
983 out:
984 	if (expr != NULL)
985 		sqlite_freemem(expr);
986 	if (sql != NULL)
987 		sqlite_freemem(sql);
988 	return (retcode);
989 }
990 
991 /*
992  * Compile the given SQL query and step just once.
993  *
994  * Input:
995  * db  - db handle
996  * sql - SQL statement
997  *
998  * Output:
999  * vm     -  virtual SQL machine
1000  * ncol   - number of columns in the result
1001  * values - column values
1002  *
1003  * Return values:
1004  * IDMAP_SUCCESS
1005  * IDMAP_ERR_NOTFOUND
1006  * IDMAP_ERR_INTERNAL
1007  */
1008 
1009 static
1010 idmap_retcode
1011 sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol,
1012 		int reqcol, const char ***values)
1013 {
1014 	char		*errmsg = NULL;
1015 	int		r;
1016 
1017 	if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) {
1018 		idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1019 		    CHECK_NULL(errmsg));
1020 		sqlite_freemem(errmsg);
1021 		return (IDMAP_ERR_INTERNAL);
1022 	}
1023 
1024 	r = sqlite_step(*vm, ncol, values, NULL);
1025 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
1026 
1027 	if (r == SQLITE_ROW) {
1028 		if (ncol != NULL && *ncol < reqcol) {
1029 			(void) sqlite_finalize(*vm, NULL);
1030 			*vm = NULL;
1031 			return (IDMAP_ERR_INTERNAL);
1032 		}
1033 		/* Caller will call finalize after using the results */
1034 		return (IDMAP_SUCCESS);
1035 	} else if (r == SQLITE_DONE) {
1036 		(void) sqlite_finalize(*vm, NULL);
1037 		*vm = NULL;
1038 		return (IDMAP_ERR_NOTFOUND);
1039 	}
1040 
1041 	(void) sqlite_finalize(*vm, &errmsg);
1042 	*vm = NULL;
1043 	idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1044 	    CHECK_NULL(errmsg));
1045 	sqlite_freemem(errmsg);
1046 	return (IDMAP_ERR_INTERNAL);
1047 }
1048 
1049 /*
1050  * Update nm_siduid and nm_sidgid fields in the lookup state.
1051  *
1052  * state->nm_siduid represents mode used by sid2uid and uid2sid
1053  * requests for directory-based name mappings. Similarly,
1054  * state->nm_sidgid represents mode used by sid2gid and gid2sid
1055  * requests.
1056  *
1057  * sid2uid/uid2sid:
1058  * none       -> ds_name_mapping_enabled != true
1059  * AD-mode    -> !nldap_winname_attr && ad_unixuser_attr
1060  * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr
1061  * mixed-mode -> nldap_winname_attr && ad_unixuser_attr
1062  *
1063  * sid2gid/gid2sid:
1064  * none       -> ds_name_mapping_enabled != true
1065  * AD-mode    -> !nldap_winname_attr && ad_unixgroup_attr
1066  * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr
1067  * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr
1068  */
1069 idmap_retcode
1070 get_ds_namemap_type(lookup_state_t *state)
1071 {
1072 	state->nm_siduid = IDMAP_NM_NONE;
1073 	state->nm_sidgid = IDMAP_NM_NONE;
1074 	RDLOCK_CONFIG();
1075 	if (_idmapdstate.cfg->pgcfg.ds_name_mapping_enabled == FALSE) {
1076 		UNLOCK_CONFIG();
1077 		return (IDMAP_SUCCESS);
1078 	}
1079 	if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1080 		state->nm_siduid =
1081 		    (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1082 		    ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1083 		state->nm_sidgid =
1084 		    (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1085 		    ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1086 	} else {
1087 		state->nm_siduid =
1088 		    (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1089 		    ? IDMAP_NM_AD : IDMAP_NM_NONE;
1090 		state->nm_sidgid =
1091 		    (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1092 		    ? IDMAP_NM_AD : IDMAP_NM_NONE;
1093 	}
1094 	if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) {
1095 		state->ad_unixuser_attr =
1096 		    strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr);
1097 		if (state->ad_unixuser_attr == NULL) {
1098 			UNLOCK_CONFIG();
1099 			return (IDMAP_ERR_MEMORY);
1100 		}
1101 	}
1102 	if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) {
1103 		state->ad_unixgroup_attr =
1104 		    strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr);
1105 		if (state->ad_unixgroup_attr == NULL) {
1106 			UNLOCK_CONFIG();
1107 			return (IDMAP_ERR_MEMORY);
1108 		}
1109 	}
1110 	UNLOCK_CONFIG();
1111 	return (IDMAP_SUCCESS);
1112 }
1113 
1114 /*
1115  * Table for well-known SIDs.
1116  *
1117  * Background:
1118  *
1119  * Some of the well-known principals are stored under:
1120  * cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>
1121  * They belong to objectClass "foreignSecurityPrincipal". They don't have
1122  * "samAccountName" nor "userPrincipalName" attributes. Their names are
1123  * available in "cn" and "name" attributes. Some of these principals have a
1124  * second entry under CN=ForeignSecurityPrincipals,dc=<forestRootDomain> and
1125  * these duplicate entries have the stringified SID in the "name" and "cn"
1126  * attributes instead of the actual name.
1127  *
1128  * Those of the form S-1-5-32-X are Builtin groups and are stored in the
1129  * cn=builtin container (except, Power Users which is not stored in AD)
1130  *
1131  * These principals are and will remain constant. Therefore doing AD lookups
1132  * provides no benefit. Also, using hard-coded table (and thus avoiding AD
1133  * lookup) improves performance and avoids additional complexity in the
1134  * adutils.c code. Moreover these SIDs can be used when no Active Directory
1135  * is available (such as the CIFS server's "workgroup" mode).
1136  *
1137  * Notes:
1138  * 1. Currently we don't support localization of well-known SID names,
1139  * unlike Windows.
1140  *
1141  * 2. Other well-known SIDs i.e. S-1-5-<domain>-<w-k RID> are not stored
1142  * here. AD does have normal user/group objects for these objects and
1143  * can be looked up using the existing AD lookup code.
1144  *
1145  * 3. See comments above lookup_wksids_sid2pid() for more information
1146  * on how we lookup the wksids table.
1147  */
1148 static wksids_table_t wksids[] = {
1149 	{"S-1-0", 0, "Nobody", 0, SENTINEL_PID, -1, 1},
1150 	{"S-1-1", 0, "Everyone", 0, SENTINEL_PID, -1, -1},
1151 	{"S-1-3", 0, "Creator Owner", 1, IDMAP_WK_CREATOR_OWNER_UID, 1, 0},
1152 	{"S-1-3", 1, "Creator Group", 0, IDMAP_WK_CREATOR_GROUP_GID, 0, 0},
1153 	{"S-1-3", 2, "Creator Owner Server", 1, SENTINEL_PID, -1, -1},
1154 	{"S-1-3", 3, "Creator Group Server", 0, SENTINEL_PID, -1, 1},
1155 	{"S-1-3", 4, "Owner Rights", 0, SENTINEL_PID, -1, -1},
1156 	{"S-1-5", 1, "Dialup", 0, SENTINEL_PID, -1, -1},
1157 	{"S-1-5", 2, "Network", 0, SENTINEL_PID, -1, -1},
1158 	{"S-1-5", 3, "Batch", 0, SENTINEL_PID, -1, -1},
1159 	{"S-1-5", 4, "Interactive", 0, SENTINEL_PID, -1, -1},
1160 	{"S-1-5", 6, "Service", 0, SENTINEL_PID, -1, -1},
1161 	{"S-1-5", 7, "Anonymous Logon", 0, GID_NOBODY, 0, 0},
1162 	{"S-1-5", 7, "Anonymous Logon", 0, UID_NOBODY, 1, 0},
1163 	{"S-1-5", 8, "Proxy", 0, SENTINEL_PID, -1, -1},
1164 	{"S-1-5", 9, "Enterprise Domain Controllers", 0, SENTINEL_PID, -1, -1},
1165 	{"S-1-5", 10, "Self", 0, SENTINEL_PID, -1, -1},
1166 	{"S-1-5", 11, "Authenticated Users", 0, SENTINEL_PID, -1, -1},
1167 	{"S-1-5", 12, "Restricted Code", 0, SENTINEL_PID, -1, -1},
1168 	{"S-1-5", 13, "Terminal Server User", 0, SENTINEL_PID, -1, -1},
1169 	{"S-1-5", 14, "Remote Interactive Logon", 0, SENTINEL_PID, -1, -1},
1170 	{"S-1-5", 15, "This Organization", 0, SENTINEL_PID, -1, -1},
1171 	{"S-1-5", 17, "IUSR", 0, SENTINEL_PID, -1, -1},
1172 	{"S-1-5", 18, "Local System", 0, IDMAP_WK_LOCAL_SYSTEM_GID, 0, 0},
1173 	{"S-1-5", 19, "Local Service", 0, SENTINEL_PID, -1, -1},
1174 	{"S-1-5", 20, "Network Service", 0, SENTINEL_PID, -1, -1},
1175 	{"S-1-5", 1000, "Other Organization", 0, SENTINEL_PID, -1, -1},
1176 	{"S-1-5-32", 544, "Administrators", 0, SENTINEL_PID, -1, -1},
1177 	{"S-1-5-32", 545, "Users", 0, SENTINEL_PID, -1, -1},
1178 	{"S-1-5-32", 546, "Guests", 0, SENTINEL_PID, -1, -1},
1179 	{"S-1-5-32", 547, "Power Users", 0, SENTINEL_PID, -1, -1},
1180 	{"S-1-5-32", 548, "Account Operators", 0, SENTINEL_PID, -1, -1},
1181 	{"S-1-5-32", 549, "Server Operators", 0, SENTINEL_PID, -1, -1},
1182 	{"S-1-5-32", 550, "Print Operators", 0, SENTINEL_PID, -1, -1},
1183 	{"S-1-5-32", 551, "Backup Operators", 0, SENTINEL_PID, -1, -1},
1184 	{"S-1-5-32", 552, "Replicator", 0, SENTINEL_PID, -1, -1},
1185 	{"S-1-5-32", 554, "Pre-Windows 2000 Compatible Access", 0,
1186 	    SENTINEL_PID, -1, -1},
1187 	{"S-1-5-32", 555, "Remote Desktop Users", 0, SENTINEL_PID, -1, -1},
1188 	{"S-1-5-32", 556, "Network Configuration Operators", 0,
1189 	    SENTINEL_PID, -1, -1},
1190 	{"S-1-5-32", 557, "Incoming Forest Trust Builders", 0,
1191 	    SENTINEL_PID, -1, -1},
1192 	{"S-1-5-32", 558, "Performance Monitor Users", 0, SENTINEL_PID, -1, -1},
1193 	{"S-1-5-32", 559, "Performance Log Users", 0, SENTINEL_PID, -1, -1},
1194 	{"S-1-5-32", 560, "Windows Authorization Access Group", 0,
1195 	    SENTINEL_PID, -1, -1},
1196 	{"S-1-5-32", 561, "Terminal Server License Servers", 0,
1197 	    SENTINEL_PID, -1, -1},
1198 	{"S-1-5-32", 561, "Distributed COM Users", 0, SENTINEL_PID, -1, -1},
1199 	{"S-1-5-32", 568, "IIS_IUSRS", 0, SENTINEL_PID, -1, -1},
1200 	{"S-1-5-32", 569, "Cryptographic Operators", 0, SENTINEL_PID, -1, -1},
1201 	{"S-1-5-32", 573, "Event Log Readers", 0, SENTINEL_PID, -1, -1},
1202 	{"S-1-5-32", 574, "Certificate Service DCOM Access", 0,
1203 	    SENTINEL_PID, -1, -1},
1204 	{"S-1-5-64", 21, "Digest Authentication", 0, SENTINEL_PID, -1, -1},
1205 	{"S-1-5-64", 10, "NTLM Authentication", 0, SENTINEL_PID, -1, -1},
1206 	{"S-1-5-64", 14, "SChannel Authentication", 0, SENTINEL_PID, -1, -1},
1207 	{NULL, UINT32_MAX, NULL, -1, SENTINEL_PID, -1, -1}
1208 };
1209 
1210 /*
1211  * Lookup well-known SIDs table either by winname or by SID.
1212  * If the given winname or SID is a well-known SID then we set wksid
1213  * variable and then proceed to see if the SID has a hard mapping to
1214  * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to
1215  * fixed ephemeral ids). If we find such mapping then we return
1216  * success otherwise notfound. If a well-known SID is mapped to
1217  * SENTINEL_PID and the direction field is set (bi-directional or
1218  * win2unix) then we treat it as inhibited mapping and return no
1219  * mapping (Ex. S-1-0-0).
1220  */
1221 static
1222 idmap_retcode
1223 lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *wksid)
1224 {
1225 	int i;
1226 
1227 	*wksid = 0;
1228 
1229 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1230 		if (req->id1.idmap_id_u.sid.prefix != NULL) {
1231 			if ((strcasecmp(wksids[i].sidprefix,
1232 			    req->id1.idmap_id_u.sid.prefix) != 0) ||
1233 			    wksids[i].rid != req->id1.idmap_id_u.sid.rid)
1234 				/* this is not our SID */
1235 				continue;
1236 			if (req->id1name == NULL) {
1237 				req->id1name = strdup(wksids[i].winname);
1238 				if (req->id1name == NULL)
1239 					return (IDMAP_ERR_MEMORY);
1240 			}
1241 		} else if (req->id1name != NULL) {
1242 			if (strcasecmp(wksids[i].winname, req->id1name) != 0)
1243 				/* this is not our winname */
1244 				continue;
1245 			req->id1.idmap_id_u.sid.prefix =
1246 			    strdup(wksids[i].sidprefix);
1247 			if (req->id1.idmap_id_u.sid.prefix == NULL)
1248 				return (IDMAP_ERR_MEMORY);
1249 			req->id1.idmap_id_u.sid.rid = wksids[i].rid;
1250 		}
1251 
1252 		*wksid = 1;
1253 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
1254 
1255 		req->id1.idtype = (wksids[i].is_wuser) ?
1256 		    IDMAP_USID : IDMAP_GSID;
1257 
1258 		if (wksids[i].pid == SENTINEL_PID) {
1259 			if (wksids[i].direction == IDMAP_DIRECTION_BI ||
1260 			    wksids[i].direction == IDMAP_DIRECTION_W2U)
1261 				/* Inhibited */
1262 				return (IDMAP_ERR_NOMAPPING);
1263 			/* Not mapped */
1264 			return (IDMAP_ERR_NOTFOUND);
1265 		} else if (wksids[i].direction == IDMAP_DIRECTION_U2W)
1266 			continue;
1267 
1268 		switch (res->id.idtype) {
1269 		case IDMAP_UID:
1270 			if (wksids[i].is_user == 0)
1271 				continue;
1272 			res->id.idmap_id_u.uid = wksids[i].pid;
1273 			res->direction = wksids[i].direction;
1274 			return (IDMAP_SUCCESS);
1275 		case IDMAP_GID:
1276 			if (wksids[i].is_user == 1)
1277 				continue;
1278 			res->id.idmap_id_u.gid = wksids[i].pid;
1279 			res->direction = wksids[i].direction;
1280 			return (IDMAP_SUCCESS);
1281 		case IDMAP_POSIXID:
1282 			res->id.idmap_id_u.uid = wksids[i].pid;
1283 			res->id.idtype = (!wksids[i].is_user) ?
1284 			    IDMAP_GID : IDMAP_UID;
1285 			res->direction = wksids[i].direction;
1286 			return (IDMAP_SUCCESS);
1287 		default:
1288 			return (IDMAP_ERR_NOTSUPPORTED);
1289 		}
1290 	}
1291 	return (IDMAP_ERR_NOTFOUND);
1292 }
1293 
1294 
1295 static
1296 idmap_retcode
1297 lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user)
1298 {
1299 	int i;
1300 	if (req->id1.idmap_id_u.uid == SENTINEL_PID)
1301 		return (IDMAP_ERR_NOTFOUND);
1302 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1303 		if (wksids[i].pid == req->id1.idmap_id_u.uid &&
1304 		    wksids[i].is_user == is_user &&
1305 		    wksids[i].direction != IDMAP_DIRECTION_W2U) {
1306 			if (res->id.idtype == IDMAP_SID) {
1307 				res->id.idtype = (wksids[i].is_wuser) ?
1308 				    IDMAP_USID : IDMAP_GSID;
1309 			}
1310 			res->id.idmap_id_u.sid.rid = wksids[i].rid;
1311 			res->id.idmap_id_u.sid.prefix =
1312 			    strdup(wksids[i].sidprefix);
1313 			if (res->id.idmap_id_u.sid.prefix == NULL) {
1314 				idmapdlog(LOG_ERR, "Out of memory");
1315 				return (IDMAP_ERR_MEMORY);
1316 			}
1317 			res->direction = wksids[i].direction;
1318 			return (IDMAP_SUCCESS);
1319 		}
1320 	}
1321 	return (IDMAP_ERR_NOTFOUND);
1322 }
1323 
1324 static
1325 idmap_retcode
1326 lookup_wksids_name2sid(const char *name, char **canonname, char **sidprefix,
1327 	idmap_rid_t *rid, int *type)
1328 {
1329 	int i;
1330 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1331 		if (strcasecmp(wksids[i].winname, name) != 0)
1332 			continue;
1333 		if (sidprefix != NULL &&
1334 		    (*sidprefix = strdup(wksids[i].sidprefix)) == NULL) {
1335 			idmapdlog(LOG_ERR, "Out of memory");
1336 			return (IDMAP_ERR_MEMORY);
1337 		}
1338 		if (canonname != NULL &&
1339 		    (*canonname = strdup(wksids[i].winname)) == NULL) {
1340 			idmapdlog(LOG_ERR, "Out of memory");
1341 			if (sidprefix != NULL) {
1342 				free(*sidprefix);
1343 				*sidprefix = NULL;
1344 			}
1345 			return (IDMAP_ERR_MEMORY);
1346 		}
1347 		if (type != NULL)
1348 			*type = (wksids[i].is_wuser) ?
1349 			    _IDMAP_T_USER : _IDMAP_T_GROUP;
1350 		if (rid != NULL)
1351 			*rid = wksids[i].rid;
1352 		return (IDMAP_SUCCESS);
1353 	}
1354 	return (IDMAP_ERR_NOTFOUND);
1355 }
1356 
1357 static
1358 idmap_retcode
1359 lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1360 {
1361 	char		*end;
1362 	char		*sql = NULL;
1363 	const char	**values;
1364 	sqlite_vm	*vm = NULL;
1365 	int		ncol, is_user;
1366 	uid_t		pid;
1367 	time_t		curtime, exp;
1368 	idmap_retcode	retcode;
1369 	char		*is_user_string, *lower_name;
1370 
1371 	/* Current time */
1372 	errno = 0;
1373 	if ((curtime = time(NULL)) == (time_t)-1) {
1374 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1375 		    strerror(errno));
1376 		retcode = IDMAP_ERR_INTERNAL;
1377 		goto out;
1378 	}
1379 
1380 	switch (res->id.idtype) {
1381 	case IDMAP_UID:
1382 		is_user_string = "1";
1383 		break;
1384 	case IDMAP_GID:
1385 		is_user_string = "0";
1386 		break;
1387 	case IDMAP_POSIXID:
1388 		/* the non-diagonal mapping */
1389 		is_user_string = "is_wuser";
1390 		break;
1391 	default:
1392 		retcode = IDMAP_ERR_NOTSUPPORTED;
1393 		goto out;
1394 	}
1395 
1396 	/* SQL to lookup the cache */
1397 	if (req->id1.idmap_id_u.sid.prefix != NULL) {
1398 		sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
1399 		    "unixname, u2w, is_wuser "
1400 		    "FROM idmap_cache WHERE is_user = %s AND "
1401 		    "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
1402 		    "(pid >= 2147483648 OR "
1403 		    "(expiration = 0 OR expiration ISNULL OR "
1404 		    "expiration > %d));",
1405 		    is_user_string, req->id1.idmap_id_u.sid.prefix,
1406 		    req->id1.idmap_id_u.sid.rid, curtime);
1407 	} else if (req->id1name != NULL) {
1408 		if ((lower_name = tolower_u8(req->id1name)) == NULL)
1409 			lower_name = req->id1name;
1410 		sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
1411 		    "unixname, u2w, is_wuser "
1412 		    "FROM idmap_cache WHERE is_user = %s AND "
1413 		    "winname = %Q AND windomain = %Q AND w2u = 1 AND "
1414 		    "(pid >= 2147483648 OR "
1415 		    "(expiration = 0 OR expiration ISNULL OR "
1416 		    "expiration > %d));",
1417 		    is_user_string, lower_name, req->id1domain, curtime);
1418 		if (lower_name != req->id1name)
1419 			free(lower_name);
1420 	} else {
1421 		retcode = IDMAP_ERR_ARG;
1422 		goto out;
1423 	}
1424 
1425 	if (sql == NULL) {
1426 		idmapdlog(LOG_ERR, "Out of memory");
1427 		retcode = IDMAP_ERR_MEMORY;
1428 		goto out;
1429 	}
1430 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 6, &values);
1431 	sqlite_freemem(sql);
1432 
1433 	if (retcode == IDMAP_ERR_NOTFOUND) {
1434 		goto out;
1435 	} else if (retcode == IDMAP_SUCCESS) {
1436 		/* sanity checks */
1437 		if (values[0] == NULL || values[1] == NULL) {
1438 			retcode = IDMAP_ERR_CACHE;
1439 			goto out;
1440 		}
1441 
1442 		pid = strtoul(values[0], &end, 10);
1443 		is_user = strncmp(values[1], "0", 2) ? 1 : 0;
1444 
1445 		if (is_user) {
1446 			res->id.idtype = IDMAP_UID;
1447 			res->id.idmap_id_u.uid = pid;
1448 		} else {
1449 			res->id.idtype = IDMAP_GID;
1450 			res->id.idmap_id_u.gid = pid;
1451 		}
1452 
1453 		/*
1454 		 * We may have an expired ephemeral mapping. Consider
1455 		 * the expired entry as valid if we are not going to
1456 		 * perform name-based mapping. But do not renew the
1457 		 * expiration.
1458 		 * If we will be doing name-based mapping then store the
1459 		 * ephemeral pid in the result so that we can use it
1460 		 * if we end up doing dynamic mapping again.
1461 		 */
1462 		if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) &&
1463 		    !AVOID_NAMESERVICE(req) &&
1464 		    IS_EPHEMERAL(pid) && values[2] != NULL) {
1465 			exp = strtoll(values[2], &end, 10);
1466 			if (exp && exp <= curtime) {
1467 				/* Store the ephemeral pid */
1468 				res->direction = IDMAP_DIRECTION_BI;
1469 				req->direction |= is_user
1470 				    ? _IDMAP_F_EXP_EPH_UID
1471 				    : _IDMAP_F_EXP_EPH_GID;
1472 				retcode = IDMAP_ERR_NOTFOUND;
1473 			}
1474 		}
1475 	}
1476 
1477 out:
1478 	if (retcode == IDMAP_SUCCESS) {
1479 		if (values[4] != NULL)
1480 			res->direction =
1481 			    (strtol(values[4], &end, 10) == 0)?
1482 			    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
1483 		else
1484 			res->direction = IDMAP_DIRECTION_W2U;
1485 
1486 		if (values[3] != NULL) {
1487 			if (req->id2name != NULL)
1488 				free(req->id2name);
1489 			req->id2name = strdup(values[3]);
1490 			if (req->id2name == NULL) {
1491 				idmapdlog(LOG_ERR, "Out of memory");
1492 				retcode = IDMAP_ERR_MEMORY;
1493 			}
1494 		}
1495 
1496 		req->id1.idtype = strncmp(values[5], "0", 2) ?
1497 		    IDMAP_USID : IDMAP_GSID;
1498 	}
1499 	if (vm != NULL)
1500 		(void) sqlite_finalize(vm, NULL);
1501 	return (retcode);
1502 }
1503 
1504 static
1505 idmap_retcode
1506 lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid,
1507 		char **name, char **domain, int *type)
1508 {
1509 	char		*end;
1510 	char		*sql = NULL;
1511 	const char	**values;
1512 	sqlite_vm	*vm = NULL;
1513 	int		ncol;
1514 	time_t		curtime;
1515 	idmap_retcode	retcode = IDMAP_SUCCESS;
1516 
1517 	/* Get current time */
1518 	errno = 0;
1519 	if ((curtime = time(NULL)) == (time_t)-1) {
1520 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1521 		    strerror(errno));
1522 		retcode = IDMAP_ERR_INTERNAL;
1523 		goto out;
1524 	}
1525 
1526 	/* SQL to lookup the cache */
1527 	sql = sqlite_mprintf("SELECT canon_name, domain, type "
1528 	    "FROM name_cache WHERE "
1529 	    "sidprefix = %Q AND rid = %u AND "
1530 	    "(expiration = 0 OR expiration ISNULL OR "
1531 	    "expiration > %d);",
1532 	    sidprefix, rid, curtime);
1533 	if (sql == NULL) {
1534 		idmapdlog(LOG_ERR, "Out of memory");
1535 		retcode = IDMAP_ERR_MEMORY;
1536 		goto out;
1537 	}
1538 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values);
1539 	sqlite_freemem(sql);
1540 
1541 	if (retcode == IDMAP_SUCCESS) {
1542 		if (type != NULL) {
1543 			if (values[2] == NULL) {
1544 				retcode = IDMAP_ERR_CACHE;
1545 				goto out;
1546 			}
1547 			*type = strtol(values[2], &end, 10);
1548 		}
1549 
1550 		if (name != NULL && values[0] != NULL) {
1551 			if ((*name = strdup(values[0])) == NULL) {
1552 				idmapdlog(LOG_ERR, "Out of memory");
1553 				retcode = IDMAP_ERR_MEMORY;
1554 				goto out;
1555 			}
1556 		}
1557 
1558 		if (domain != NULL && values[1] != NULL) {
1559 			if ((*domain = strdup(values[1])) == NULL) {
1560 				if (name != NULL && *name) {
1561 					free(*name);
1562 					*name = NULL;
1563 				}
1564 				idmapdlog(LOG_ERR, "Out of memory");
1565 				retcode = IDMAP_ERR_MEMORY;
1566 				goto out;
1567 			}
1568 		}
1569 	}
1570 
1571 out:
1572 	if (vm != NULL)
1573 		(void) sqlite_finalize(vm, NULL);
1574 	return (retcode);
1575 }
1576 
1577 /*
1578  * Given SID, find winname using name_cache OR
1579  * Given winname, find SID using name_cache.
1580  * Used when mapping win to unix i.e. req->id1 is windows id and
1581  * req->id2 is unix id
1582  */
1583 static
1584 idmap_retcode
1585 lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1586 {
1587 	int		type = -1;
1588 	idmap_retcode	retcode;
1589 	char		*sidprefix = NULL;
1590 	idmap_rid_t	rid;
1591 	char		*name = NULL, *domain = NULL;
1592 
1593 	/* Done if we've both sid and winname */
1594 	if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL)
1595 		return (IDMAP_SUCCESS);
1596 
1597 	/* Lookup sid to winname */
1598 	if (req->id1.idmap_id_u.sid.prefix != NULL) {
1599 		retcode = lookup_cache_sid2name(cache,
1600 		    req->id1.idmap_id_u.sid.prefix,
1601 		    req->id1.idmap_id_u.sid.rid, &name, &domain, &type);
1602 		goto out;
1603 	}
1604 
1605 	/* Lookup winame to sid */
1606 	retcode = lookup_cache_name2sid(cache, req->id1name, req->id1domain,
1607 	    &name, &sidprefix, &rid, &type);
1608 
1609 out:
1610 	if (retcode != IDMAP_SUCCESS) {
1611 		free(name);
1612 		free(domain);
1613 		free(sidprefix);
1614 		return (retcode);
1615 	}
1616 
1617 	if (res->id.idtype == IDMAP_POSIXID) {
1618 		res->id.idtype = (type == _IDMAP_T_USER) ?
1619 		    IDMAP_UID : IDMAP_GID;
1620 	}
1621 	req->id1.idtype = (type == _IDMAP_T_USER) ?
1622 	    IDMAP_USID : IDMAP_GSID;
1623 
1624 	req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
1625 	if (name != NULL) {
1626 		free(req->id1name);	/* Free existing winname */
1627 		req->id1name = name;	/* and use canonical name instead */
1628 	}
1629 	if (req->id1domain == NULL)
1630 		req->id1domain = domain;
1631 	if (req->id1.idmap_id_u.sid.prefix == NULL) {
1632 		req->id1.idmap_id_u.sid.prefix = sidprefix;
1633 		req->id1.idmap_id_u.sid.rid = rid;
1634 	}
1635 	return (retcode);
1636 }
1637 
1638 /*
1639  * Batch AD lookups
1640  */
1641 idmap_retcode
1642 ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch,
1643 		idmap_ids_res *result)
1644 {
1645 	idmap_retcode	retcode;
1646 	int		i, add, type, is_wuser, is_user;
1647 	int		retries = 0, eunixtype;
1648 	char		**unixname;
1649 	idmap_mapping	*req;
1650 	idmap_id_res	*res;
1651 	idmap_query_state_t	*qs = NULL;
1652 
1653 	/*
1654 	 * Since req->id2.idtype is unused, we will use it here
1655 	 * to retrieve the value of sid_type. But it needs to be
1656 	 * reset to IDMAP_NONE before we return to prevent xdr
1657 	 * from mis-interpreting req->id2 when it tries to free
1658 	 * the input argument. Other option is to allocate an
1659 	 * array of integers and use it instead for the batched
1660 	 * call. But why un-necessarily allocate memory. That may
1661 	 * be an option if req->id2.idtype cannot be re-used in
1662 	 * future.
1663 	 */
1664 
1665 	if (state->ad_nqueries == 0)
1666 		return (IDMAP_SUCCESS);
1667 
1668 retry:
1669 	retcode = idmap_lookup_batch_start(_idmapdstate.ad, state->ad_nqueries,
1670 	    &qs);
1671 	if (retcode != IDMAP_SUCCESS) {
1672 		if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
1673 			goto retry;
1674 		degrade_svc(1, "failed to create batch for AD lookup");
1675 		goto out;
1676 	}
1677 
1678 	restore_svc();
1679 
1680 	idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr,
1681 	    state->ad_unixgroup_attr);
1682 
1683 	for (i = 0, add = 0; i < batch->idmap_mapping_batch_len; i++) {
1684 		req = &batch->idmap_mapping_batch_val[i];
1685 		res = &result->ids.ids_val[i];
1686 		retcode = IDMAP_SUCCESS;
1687 		req->id2.idtype = IDMAP_NONE;
1688 
1689 		/* Skip if not marked for AD lookup */
1690 		if (!(req->direction & _IDMAP_F_LOOKUP_AD))
1691 			continue;
1692 
1693 		if (retries == 0)
1694 			res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR;
1695 		else if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR)
1696 			continue;
1697 
1698 		if (IS_REQUEST_SID(*req, 1)) {
1699 			/* win to unix */
1700 
1701 			assert(req->id1.idmap_id_u.sid.prefix != NULL);
1702 
1703 			/* Lookup AD by SID */
1704 			unixname = NULL;
1705 			eunixtype = _IDMAP_T_UNDEF;
1706 			if (req->id2name == NULL) {
1707 				if (res->id.idtype == IDMAP_UID &&
1708 				    AD_OR_MIXED(state->nm_siduid)) {
1709 					eunixtype = _IDMAP_T_USER;
1710 					unixname = &req->id2name;
1711 				} else if (res->id.idtype == IDMAP_GID &&
1712 				    AD_OR_MIXED(state->nm_sidgid)) {
1713 					eunixtype = _IDMAP_T_GROUP;
1714 					unixname = &req->id2name;
1715 				} else if (AD_OR_MIXED(state->nm_siduid) ||
1716 				    AD_OR_MIXED(state->nm_sidgid)) {
1717 					unixname = &req->id2name;
1718 				}
1719 			}
1720 			add = 1;
1721 			retcode = idmap_sid2name_batch_add1(
1722 			    qs, req->id1.idmap_id_u.sid.prefix,
1723 			    &req->id1.idmap_id_u.sid.rid, eunixtype,
1724 			    (req->id1name == NULL) ? &req->id1name : NULL,
1725 			    (req->id1domain == NULL) ? &req->id1domain : NULL,
1726 			    (int *)&req->id2.idtype, unixname, &res->retcode);
1727 
1728 		} else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) {
1729 			/* unix to win */
1730 
1731 			if (res->id.idmap_id_u.sid.prefix != NULL &&
1732 			    req->id2name != NULL) {
1733 				/* Already have SID and winname -- done */
1734 				res->retcode = IDMAP_SUCCESS;
1735 				continue;
1736 			}
1737 
1738 			if (res->id.idmap_id_u.sid.prefix != NULL) {
1739 				/*
1740 				 * SID but no winname -- lookup AD by
1741 				 * SID to get winname.
1742 				 */
1743 				add = 1;
1744 				retcode = idmap_sid2name_batch_add1(
1745 				    qs, res->id.idmap_id_u.sid.prefix,
1746 				    &res->id.idmap_id_u.sid.rid,
1747 				    _IDMAP_T_UNDEF, &req->id2name,
1748 				    &req->id2domain, (int *)&req->id2.idtype,
1749 				    NULL, &res->retcode);
1750 			} else if (req->id2name != NULL) {
1751 				/*
1752 				 * winname but no SID -- lookup AD by
1753 				 * winname to get SID.
1754 				 */
1755 				add = 1;
1756 				retcode = idmap_name2sid_batch_add1(
1757 				    qs, req->id2name, req->id2domain,
1758 				    _IDMAP_T_UNDEF, NULL,
1759 				    &res->id.idmap_id_u.sid.prefix,
1760 				    &res->id.idmap_id_u.sid.rid,
1761 				    (int *)&req->id2.idtype, NULL,
1762 				    &res->retcode);
1763 			} else if (req->id1name != NULL) {
1764 				/*
1765 				 * No SID and no winname but we've unixname --
1766 				 * lookup AD by unixname to get SID.
1767 				 */
1768 				is_user = (IS_REQUEST_UID(*req)) ? 1 : 0;
1769 				if (res->id.idtype == IDMAP_USID)
1770 					is_wuser = 1;
1771 				else if (res->id.idtype == IDMAP_GSID)
1772 					is_wuser = 0;
1773 				else
1774 					is_wuser = is_user;
1775 				add = 1;
1776 				retcode = idmap_unixname2sid_batch_add1(
1777 				    qs, req->id1name, is_user, is_wuser,
1778 				    &res->id.idmap_id_u.sid.prefix,
1779 				    &res->id.idmap_id_u.sid.rid,
1780 				    &req->id2name, &req->id2domain,
1781 				    (int *)&req->id2.idtype, &res->retcode);
1782 			}
1783 		}
1784 		if (retcode != IDMAP_SUCCESS) {
1785 			idmap_lookup_release_batch(&qs);
1786 			break;
1787 		}
1788 	}
1789 
1790 	if (retcode == IDMAP_SUCCESS && add)
1791 		retcode = idmap_lookup_batch_end(&qs);
1792 
1793 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
1794 		goto retry;
1795 	else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
1796 		degrade_svc(1, "some AD lookups timed out repeatedly");
1797 
1798 	if (retcode != IDMAP_SUCCESS)
1799 		idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests");
1800 
1801 out:
1802 	/*
1803 	 * This loop does the following:
1804 	 * 1) If there are errors in creating or submitting the batch then
1805 	 *    we set the retcode for each request (res->retcode) that's part
1806 	 *    of the batch to that error. If there were no such errors then
1807 	 *    res->retcode for each request will reflect the status of AD
1808 	 *    lookup for that particular request. Initial value of
1809 	 *    res->retcode is IDMAP_ERR_RETRIABLE_NET_ERR.
1810 	 * 2) If AD lookup for a given request succeeds then evaluate the
1811 	 *    type of the AD object (i.e user or group) and update the
1812 	 *    idtype in res and req.
1813 	 * 3) Reset req->id2.idtype to IDMAP_NONE.
1814 	 */
1815 	for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
1816 		req = &batch->idmap_mapping_batch_val[i];
1817 		type = req->id2.idtype;
1818 		req->id2.idtype = IDMAP_NONE;
1819 		res = &result->ids.ids_val[i];
1820 
1821 		if (!(req->direction & _IDMAP_F_LOOKUP_AD))
1822 			/* Entry that wasn't marked for AD lookup - skip */
1823 			continue;
1824 
1825 		if (retcode != IDMAP_SUCCESS) {
1826 			res->retcode = retcode;
1827 			continue;
1828 		}
1829 
1830 		if (!add)
1831 			continue;
1832 
1833 
1834 		if (IS_REQUEST_SID(*req, 1)) {
1835 			if (res->retcode != IDMAP_SUCCESS)
1836 				continue;
1837 			switch (type) {
1838 			case _IDMAP_T_USER:
1839 				if (res->id.idtype == IDMAP_POSIXID)
1840 					res->id.idtype = IDMAP_UID;
1841 				req->id1.idtype = IDMAP_USID;
1842 				break;
1843 			case _IDMAP_T_GROUP:
1844 				if (res->id.idtype == IDMAP_POSIXID)
1845 					res->id.idtype = IDMAP_GID;
1846 				req->id1.idtype = IDMAP_GSID;
1847 				break;
1848 			default:
1849 				res->retcode = IDMAP_ERR_SID;
1850 				break;
1851 			}
1852 		} else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) {
1853 			if (res->retcode != IDMAP_SUCCESS) {
1854 				if ((!(IDMAP_FATAL_ERROR(res->retcode))) &&
1855 				    res->id.idmap_id_u.sid.prefix == NULL &&
1856 				    req->id2name == NULL && /* no winname */
1857 				    req->id1name != NULL) /* unixname */
1858 					/*
1859 					 * Here we have a pid2sid request
1860 					 * that was marked for AD lookup
1861 					 * with no SID, no winname but with
1862 					 * unixname. This request was
1863 					 * added to the batch to do AD lookup
1864 					 * by unixname but it failed with non
1865 					 * fatal error. In such case we
1866 					 * ignore the error (i.e set
1867 					 * res->retcode to success) so that
1868 					 * next pass considers it for name
1869 					 * based mapping rules or ephemeral
1870 					 * mapping.
1871 					 */
1872 					res->retcode = IDMAP_SUCCESS;
1873 				continue;
1874 			}
1875 			switch (type) {
1876 			case _IDMAP_T_USER:
1877 				if (res->id.idtype == IDMAP_SID)
1878 					res->id.idtype = IDMAP_USID;
1879 				break;
1880 			case _IDMAP_T_GROUP:
1881 				if (res->id.idtype == IDMAP_SID)
1882 					res->id.idtype = IDMAP_GSID;
1883 				break;
1884 			default:
1885 				res->retcode = IDMAP_ERR_SID;
1886 				break;
1887 			}
1888 		}
1889 	}
1890 
1891 	/* AD lookups done. Reset state->ad_nqueries and return */
1892 	state->ad_nqueries = 0;
1893 	return (retcode);
1894 }
1895 
1896 /*
1897  * Convention when processing win2unix requests:
1898  *
1899  * Windows identity:
1900  * req->id1name =
1901  *              winname if given otherwise winname found will be placed
1902  *              here.
1903  * req->id1domain =
1904  *              windomain if given otherwise windomain found will be
1905  *              placed here.
1906  * req->id1.idtype =
1907  *              Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll
1908  *              be set to IDMAP_USID/GSID depending upon whether the
1909  *              given SID is user or group respectively. The user/group-ness
1910  *              is determined either when looking up well-known SIDs table OR
1911  *              if the SID is found in namecache OR by ad_lookup() OR by
1912  *              ad_lookup_batch().
1913  * req->id1..sid.[prefix, rid] =
1914  *              SID if given otherwise SID found will be placed here.
1915  *
1916  * Unix identity:
1917  * req->id2name =
1918  *              unixname found will be placed here.
1919  * req->id2domain =
1920  *              NOT USED
1921  * res->id.idtype =
1922  *              Target type initialized from req->id2.idtype. If
1923  *              it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found
1924  *              will be placed here.
1925  * res->id..[uid or gid] =
1926  *              UID/GID found will be placed here.
1927  *
1928  * Others:
1929  * res->retcode =
1930  *              Return status for this request will be placed here.
1931  * res->direction =
1932  *              Direction found will be placed here. Direction
1933  *              meaning whether the resultant mapping is valid
1934  *              only from win2unix or bi-directional.
1935  * req->direction =
1936  *              INTERNAL USE. Used by idmapd to set various
1937  *              flags (_IDMAP_F_xxxx) to aid in processing
1938  *              of the request.
1939  * req->id2.idtype =
1940  *              INTERNAL USE. Initially this is the requested target
1941  *              type and is used to initialize res->id.idtype.
1942  *              ad_lookup_batch() uses this field temporarily to store
1943  *              sid_type obtained by the batched AD lookups and after
1944  *              use resets it to IDMAP_NONE to prevent xdr from
1945  *              mis-interpreting the contents of req->id2.
1946  * req->id2..[uid or gid or sid] =
1947  *              NOT USED
1948  */
1949 
1950 /*
1951  * This function does the following:
1952  * 1. Lookup well-known SIDs table.
1953  * 2. Check if the given SID is a local-SID and if so extract UID/GID from it.
1954  * 3. Lookup cache.
1955  * 4. Check if the client does not want new mapping to be allocated
1956  *    in which case this pass is the final pass.
1957  * 5. Set AD lookup flag if it determines that the next stage needs
1958  *    to do AD lookup.
1959  */
1960 idmap_retcode
1961 sid2pid_first_pass(lookup_state_t *state, sqlite *cache, idmap_mapping *req,
1962 		idmap_id_res *res)
1963 {
1964 	idmap_retcode	retcode;
1965 	int		wksid;
1966 
1967 	/* Initialize result */
1968 	res->id.idtype = req->id2.idtype;
1969 	res->id.idmap_id_u.uid = SENTINEL_PID;
1970 	res->direction = IDMAP_DIRECTION_UNDEF;
1971 	wksid = 0;
1972 
1973 	if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) {
1974 		if (req->id1name == NULL) {
1975 			retcode = IDMAP_ERR_ARG;
1976 			goto out;
1977 		}
1978 		/* sanitize sidprefix */
1979 		free(req->id1.idmap_id_u.sid.prefix);
1980 		req->id1.idmap_id_u.sid.prefix = NULL;
1981 	}
1982 
1983 	/* Lookup well-known SIDs table */
1984 	retcode = lookup_wksids_sid2pid(req, res, &wksid);
1985 	if (retcode != IDMAP_ERR_NOTFOUND)
1986 		goto out;
1987 
1988 	/* Check if this is a localsid */
1989 	if (!wksid) {
1990 		retcode = lookup_localsid2pid(req, res);
1991 		if (retcode != IDMAP_ERR_NOTFOUND)
1992 			goto out;
1993 	}
1994 
1995 	/* Lookup cache */
1996 	retcode = lookup_cache_sid2pid(cache, req, res);
1997 	if (retcode != IDMAP_ERR_NOTFOUND)
1998 		goto out;
1999 
2000 	if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) {
2001 		retcode = IDMAP_ERR_NOMAPPING;
2002 		goto out;
2003 	}
2004 
2005 	/*
2006 	 * Failed to find non-expired entry in cache. Next step is
2007 	 * to determine if this request needs to be batched for AD lookup.
2008 	 *
2009 	 * At this point we have either sid or winname or both. If we don't
2010 	 * have both then lookup name_cache for the sid or winname
2011 	 * whichever is missing. If not found then this request will be
2012 	 * batched for AD lookup.
2013 	 */
2014 	retcode = lookup_name_cache(cache, req, res);
2015 	if (retcode != IDMAP_SUCCESS && retcode != IDMAP_ERR_NOTFOUND)
2016 		goto out;
2017 
2018 	/*
2019 	 * Set the flag to indicate that we are not done yet so that
2020 	 * subsequent passes considers this request for name-based
2021 	 * mapping and ephemeral mapping.
2022 	 */
2023 	state->sid2pid_done = FALSE;
2024 	req->direction |= _IDMAP_F_NOTDONE;
2025 
2026 	/*
2027 	 * Even if we have both sid and winname, we still may need to batch
2028 	 * this request for AD lookup if we don't have unixname and
2029 	 * directory-based name mapping (AD or mixed) is enabled.
2030 	 * We avoid AD lookup for well-known SIDs because they don't have
2031 	 * regular AD objects.
2032 	 */
2033 	if (retcode != IDMAP_SUCCESS ||
2034 	    (!wksid && req->id2name == NULL &&
2035 	    AD_OR_MIXED_MODE(res->id.idtype, state))) {
2036 		retcode = IDMAP_SUCCESS;
2037 		req->direction |= _IDMAP_F_LOOKUP_AD;
2038 		state->ad_nqueries++;
2039 	}
2040 
2041 
2042 out:
2043 	res->retcode = idmap_stat4prot(retcode);
2044 	/*
2045 	 * If we are done and there was an error then set fallback pid
2046 	 * in the result.
2047 	 */
2048 	if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS)
2049 		res->id.idmap_id_u.uid = UID_NOBODY;
2050 	return (retcode);
2051 }
2052 
2053 /*
2054  * Generate SID using the following convention
2055  * 	<machine-sid-prefix>-<1000 + uid>
2056  * 	<machine-sid-prefix>-<2^31 + gid>
2057  */
2058 static
2059 idmap_retcode
2060 generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user)
2061 {
2062 	free(res->id.idmap_id_u.sid.prefix);
2063 	res->id.idmap_id_u.sid.prefix = NULL;
2064 
2065 	/*
2066 	 * Diagonal mapping for localSIDs not supported because of the
2067 	 * way we generate localSIDs.
2068 	 */
2069 	if (is_user && res->id.idtype == IDMAP_GSID)
2070 		return (IDMAP_ERR_NOMAPPING);
2071 	if (!is_user && res->id.idtype == IDMAP_USID)
2072 		return (IDMAP_ERR_NOMAPPING);
2073 
2074 	/* Skip 1000 UIDs */
2075 	if (is_user && req->id1.idmap_id_u.uid >
2076 	    (INT32_MAX - LOCALRID_MIN))
2077 		return (IDMAP_ERR_NOMAPPING);
2078 
2079 	RDLOCK_CONFIG();
2080 	/*
2081 	 * machine_sid is never NULL because if it is we won't be here.
2082 	 * No need to assert because stdrup(NULL) will core anyways.
2083 	 */
2084 	res->id.idmap_id_u.sid.prefix =
2085 	    strdup(_idmapdstate.cfg->pgcfg.machine_sid);
2086 	if (res->id.idmap_id_u.sid.prefix == NULL) {
2087 		UNLOCK_CONFIG();
2088 		idmapdlog(LOG_ERR, "Out of memory");
2089 		return (IDMAP_ERR_MEMORY);
2090 	}
2091 	UNLOCK_CONFIG();
2092 	res->id.idmap_id_u.sid.rid =
2093 	    (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_MIN :
2094 	    req->id1.idmap_id_u.gid + INT32_MAX + 1;
2095 	res->direction = IDMAP_DIRECTION_BI;
2096 	if (res->id.idtype == IDMAP_SID)
2097 		res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
2098 
2099 	/*
2100 	 * Don't update name_cache because local sids don't have
2101 	 * valid windows names.
2102 	 */
2103 	req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
2104 	return (IDMAP_SUCCESS);
2105 }
2106 
2107 static
2108 idmap_retcode
2109 lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res)
2110 {
2111 	char		*sidprefix;
2112 	uint32_t	rid;
2113 	int		s;
2114 
2115 	/*
2116 	 * If the sidprefix == localsid then UID = last RID - 1000 or
2117 	 * GID = last RID - 2^31.
2118 	 */
2119 	if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL)
2120 		/* This means we are looking up by winname */
2121 		return (IDMAP_ERR_NOTFOUND);
2122 	rid = req->id1.idmap_id_u.sid.rid;
2123 
2124 	RDLOCK_CONFIG();
2125 	s = (_idmapdstate.cfg->pgcfg.machine_sid) ?
2126 	    strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1;
2127 	UNLOCK_CONFIG();
2128 
2129 	/*
2130 	 * If the given sidprefix does not match machine_sid then this is
2131 	 * not a local SID.
2132 	 */
2133 	if (s != 0)
2134 		return (IDMAP_ERR_NOTFOUND);
2135 
2136 	switch (res->id.idtype) {
2137 	case IDMAP_UID:
2138 		if (rid > INT32_MAX || rid < LOCALRID_MIN)
2139 			return (IDMAP_ERR_ARG);
2140 		res->id.idmap_id_u.uid = rid - LOCALRID_MIN;
2141 		break;
2142 	case IDMAP_GID:
2143 		if (rid <= INT32_MAX)
2144 			return (IDMAP_ERR_ARG);
2145 		res->id.idmap_id_u.gid = rid - INT32_MAX - 1;
2146 		break;
2147 	case IDMAP_POSIXID:
2148 		if (rid > INT32_MAX) {
2149 			res->id.idmap_id_u.gid = rid - INT32_MAX - 1;
2150 			res->id.idtype = IDMAP_GID;
2151 		} else if (rid < LOCALRID_MIN) {
2152 			return (IDMAP_ERR_ARG);
2153 		} else {
2154 			res->id.idmap_id_u.uid = rid - LOCALRID_MIN;
2155 			res->id.idtype = IDMAP_UID;
2156 		}
2157 		break;
2158 	default:
2159 		return (IDMAP_ERR_NOTSUPPORTED);
2160 	}
2161 	return (IDMAP_SUCCESS);
2162 }
2163 
2164 /*
2165  * Name service lookup by unixname to get pid
2166  */
2167 static
2168 idmap_retcode
2169 ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id)
2170 {
2171 	struct passwd	pwd, *pwdp;
2172 	struct group	grp, *grpp;
2173 	char		buf[1024];
2174 	int		errnum;
2175 	const char	*me = "ns_lookup_byname";
2176 
2177 	switch (id->idtype) {
2178 	case IDMAP_UID:
2179 		pwdp = getpwnam_r(name, &pwd, buf, sizeof (buf));
2180 		if (pwdp == NULL && errno == 0 && lower_name != NULL &&
2181 		    name != lower_name && strcmp(name, lower_name) != 0)
2182 			pwdp = getpwnam_r(lower_name, &pwd, buf, sizeof (buf));
2183 		if (pwdp == NULL) {
2184 			errnum = errno;
2185 			idmapdlog(LOG_WARNING,
2186 			    "%s: getpwnam_r(%s) failed (%s).",
2187 			    me, name, errnum ? strerror(errnum) : "not found");
2188 			if (errnum == 0)
2189 				return (IDMAP_ERR_NOTFOUND);
2190 			else
2191 				return (IDMAP_ERR_INTERNAL);
2192 		}
2193 		id->idmap_id_u.uid = pwd.pw_uid;
2194 		break;
2195 	case IDMAP_GID:
2196 		grpp = getgrnam_r(name, &grp, buf, sizeof (buf));
2197 		if (grpp == NULL && errno == 0 && lower_name != NULL &&
2198 		    name != lower_name && strcmp(name, lower_name) != 0)
2199 			grpp = getgrnam_r(lower_name, &grp, buf, sizeof (buf));
2200 		if (grpp == NULL) {
2201 			errnum = errno;
2202 			idmapdlog(LOG_WARNING,
2203 			    "%s: getgrnam_r(%s) failed (%s).",
2204 			    me, name, errnum ? strerror(errnum) : "not found");
2205 			if (errnum == 0)
2206 				return (IDMAP_ERR_NOTFOUND);
2207 			else
2208 				return (IDMAP_ERR_INTERNAL);
2209 		}
2210 		id->idmap_id_u.gid = grp.gr_gid;
2211 		break;
2212 	default:
2213 		return (IDMAP_ERR_ARG);
2214 	}
2215 	return (IDMAP_SUCCESS);
2216 }
2217 
2218 
2219 /*
2220  * Name service lookup by pid to get unixname
2221  */
2222 static
2223 idmap_retcode
2224 ns_lookup_bypid(uid_t pid, int is_user, char **unixname)
2225 {
2226 	struct passwd	pwd;
2227 	struct group	grp;
2228 	char		buf[1024];
2229 	int		errnum;
2230 	const char	*me = "ns_lookup_bypid";
2231 
2232 	if (is_user) {
2233 		errno = 0;
2234 		if (getpwuid_r(pid, &pwd, buf, sizeof (buf)) == NULL) {
2235 			errnum = errno;
2236 			idmapdlog(LOG_WARNING,
2237 			    "%s: getpwuid_r(%u) failed (%s).",
2238 			    me, pid, errnum ? strerror(errnum) : "not found");
2239 			if (errnum == 0)
2240 				return (IDMAP_ERR_NOTFOUND);
2241 			else
2242 				return (IDMAP_ERR_INTERNAL);
2243 		}
2244 		*unixname = strdup(pwd.pw_name);
2245 	} else {
2246 		errno = 0;
2247 		if (getgrgid_r(pid, &grp, buf, sizeof (buf)) == NULL) {
2248 			errnum = errno;
2249 			idmapdlog(LOG_WARNING,
2250 			    "%s: getgrgid_r(%u) failed (%s).",
2251 			    me, pid, errnum ? strerror(errnum) : "not found");
2252 			if (errnum == 0)
2253 				return (IDMAP_ERR_NOTFOUND);
2254 			else
2255 				return (IDMAP_ERR_INTERNAL);
2256 		}
2257 		*unixname = strdup(grp.gr_name);
2258 	}
2259 	if (*unixname == NULL)
2260 		return (IDMAP_ERR_MEMORY);
2261 	return (IDMAP_SUCCESS);
2262 }
2263 
2264 /*
2265  * Name-based mapping
2266  *
2267  * Case 1: If no rule matches do ephemeral
2268  *
2269  * Case 2: If rule matches and unixname is "" then return no mapping.
2270  *
2271  * Case 3: If rule matches and unixname is specified then lookup name
2272  *  service using the unixname. If unixname not found then return no mapping.
2273  *
2274  * Case 4: If rule matches and unixname is * then lookup name service
2275  *  using winname as the unixname. If unixname not found then process
2276  *  other rules using the lookup order. If no other rule matches then do
2277  *  ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4.
2278  *  This allows us to specify a fallback unixname per _domain_ or no mapping
2279  *  instead of the default behaviour of doing ephemeral mapping.
2280  *
2281  * Example 1:
2282  * *@sfbay == *
2283  * If looking up windows users foo@sfbay and foo does not exists in
2284  * the name service then foo@sfbay will be mapped to an ephemeral id.
2285  *
2286  * Example 2:
2287  * *@sfbay == *
2288  * *@sfbay => guest
2289  * If looking up windows users foo@sfbay and foo does not exists in
2290  * the name service then foo@sfbay will be mapped to guest.
2291  *
2292  * Example 3:
2293  * *@sfbay == *
2294  * *@sfbay => ""
2295  * If looking up windows users foo@sfbay and foo does not exists in
2296  * the name service then we will return no mapping for foo@sfbay.
2297  *
2298  */
2299 static
2300 idmap_retcode
2301 name_based_mapping_sid2pid(sqlite *db, idmap_mapping *req, idmap_id_res *res)
2302 {
2303 	const char	*unixname, *windomain;
2304 	char		*sql = NULL, *errmsg = NULL, *lower_winname = NULL;
2305 	idmap_retcode	retcode;
2306 	char		*end, *lower_unixname, *winname;
2307 	const char	**values;
2308 	sqlite_vm	*vm = NULL;
2309 	int		ncol, r, i, is_user, is_wuser;
2310 	const char	*me = "name_based_mapping_sid2pid";
2311 
2312 	assert(req->id1name != NULL); /* We have winname */
2313 	assert(req->id2name == NULL); /* We don't have unixname */
2314 
2315 	winname = req->id1name;
2316 	windomain = req->id1domain;
2317 
2318 	switch (req->id1.idtype) {
2319 	case IDMAP_USID:
2320 		is_wuser = 1;
2321 		break;
2322 	case IDMAP_GSID:
2323 		is_wuser = 0;
2324 		break;
2325 	default:
2326 		idmapdlog(LOG_ERR, "%s: Unable to determine if the "
2327 		    "given Windows id is user or group.", me);
2328 		return (IDMAP_ERR_INTERNAL);
2329 	}
2330 
2331 	switch (res->id.idtype) {
2332 	case IDMAP_UID:
2333 		is_user = 1;
2334 		break;
2335 	case IDMAP_GID:
2336 		is_user = 0;
2337 		break;
2338 	case IDMAP_POSIXID:
2339 		is_user = is_wuser;
2340 		res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID;
2341 		break;
2342 	}
2343 
2344 	i = 0;
2345 	if (windomain == NULL) {
2346 		windomain = "";
2347 	} else {
2348 		RDLOCK_CONFIG();
2349 		if (_idmapdstate.cfg->pgcfg.default_domain != NULL) {
2350 			if (strcasecmp(_idmapdstate.cfg->pgcfg.default_domain,
2351 			    windomain) == 0)
2352 				i = 1;
2353 		}
2354 		UNLOCK_CONFIG();
2355 	}
2356 
2357 	if ((lower_winname = tolower_u8(winname)) == NULL)
2358 		lower_winname = winname;    /* hope for the best */
2359 	sql = sqlite_mprintf(
2360 	    "SELECT unixname, u2w_order FROM namerules WHERE "
2361 	    "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND "
2362 	    "(winname = %Q OR winname = '*') AND "
2363 	    "(windomain = %Q OR windomain = '*' %s) "
2364 	    "ORDER BY w2u_order ASC;",
2365 	    is_user, is_wuser, lower_winname, windomain,
2366 	    i ? "OR windomain ISNULL OR windomain = ''" : "");
2367 	if (sql == NULL) {
2368 		idmapdlog(LOG_ERR, "Out of memory");
2369 		retcode = IDMAP_ERR_MEMORY;
2370 		goto out;
2371 	}
2372 
2373 	if (sqlite_compile(db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
2374 		retcode = IDMAP_ERR_INTERNAL;
2375 		idmapdlog(LOG_ERR, "%s: database error (%s)", me,
2376 		    CHECK_NULL(errmsg));
2377 		sqlite_freemem(errmsg);
2378 		goto out;
2379 	}
2380 
2381 	for (; ; ) {
2382 		r = sqlite_step(vm, &ncol, &values, NULL);
2383 		assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
2384 
2385 		if (r == SQLITE_ROW) {
2386 			if (ncol < 2) {
2387 				retcode = IDMAP_ERR_INTERNAL;
2388 				goto out;
2389 			}
2390 			if (values[0] == NULL) {
2391 				retcode = IDMAP_ERR_INTERNAL;
2392 				goto out;
2393 			}
2394 
2395 			if (EMPTY_NAME(values[0])) {
2396 				retcode = IDMAP_ERR_NOMAPPING;
2397 				goto out;
2398 			}
2399 			unixname = (values[0][0] == '*') ? winname : values[0];
2400 			lower_unixname = (values[0][0] == '*') ?
2401 			    lower_winname : NULL;
2402 			retcode = ns_lookup_byname(unixname, lower_unixname,
2403 			    &res->id);
2404 			if (retcode == IDMAP_ERR_NOTFOUND) {
2405 				if (unixname == winname)
2406 					/* Case 4 */
2407 					continue;
2408 				else
2409 					/* Case 3 */
2410 					retcode = IDMAP_ERR_NOMAPPING;
2411 			}
2412 			goto out;
2413 		} else if (r == SQLITE_DONE) {
2414 			retcode = IDMAP_ERR_NOTFOUND;
2415 			goto out;
2416 		} else {
2417 			(void) sqlite_finalize(vm, &errmsg);
2418 			vm = NULL;
2419 			idmapdlog(LOG_ERR, "%s: database error (%s)", me,
2420 			    CHECK_NULL(errmsg));
2421 			sqlite_freemem(errmsg);
2422 			retcode = IDMAP_ERR_INTERNAL;
2423 			goto out;
2424 		}
2425 	}
2426 
2427 out:
2428 	sqlite_freemem(sql);
2429 	if (retcode == IDMAP_SUCCESS) {
2430 		if (values[1] != NULL)
2431 			res->direction =
2432 			    (strtol(values[1], &end, 10) == 0)?
2433 			    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
2434 		else
2435 			res->direction = IDMAP_DIRECTION_W2U;
2436 		req->id2name = strdup(unixname);
2437 	}
2438 	if (lower_winname != NULL && lower_winname != winname)
2439 		free(lower_winname);
2440 	if (vm != NULL)
2441 		(void) sqlite_finalize(vm, NULL);
2442 	return (retcode);
2443 }
2444 
2445 static
2446 int
2447 get_next_eph_uid(uid_t *next_uid)
2448 {
2449 	uid_t uid;
2450 	gid_t gid;
2451 	int err;
2452 
2453 	*next_uid = (uid_t)-1;
2454 	uid = _idmapdstate.next_uid++;
2455 	if (uid >= _idmapdstate.limit_uid) {
2456 		if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0)
2457 			return (err);
2458 
2459 		_idmapdstate.limit_uid = uid + 8192;
2460 		_idmapdstate.next_uid = uid;
2461 	}
2462 	*next_uid = uid;
2463 
2464 	return (0);
2465 }
2466 
2467 static
2468 int
2469 get_next_eph_gid(gid_t *next_gid)
2470 {
2471 	uid_t uid;
2472 	gid_t gid;
2473 	int err;
2474 
2475 	*next_gid = (uid_t)-1;
2476 	gid = _idmapdstate.next_gid++;
2477 	if (gid >= _idmapdstate.limit_gid) {
2478 		if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0)
2479 			return (err);
2480 
2481 		_idmapdstate.limit_gid = gid + 8192;
2482 		_idmapdstate.next_gid = gid;
2483 	}
2484 	*next_gid = gid;
2485 
2486 	return (0);
2487 }
2488 
2489 static
2490 int
2491 gethash(const char *str, uint32_t num, uint_t htsize)
2492 {
2493 	uint_t  hval, i, len;
2494 
2495 	if (str == NULL)
2496 		return (0);
2497 	for (len = strlen(str), hval = 0, i = 0; i < len; i++) {
2498 		hval += str[i];
2499 		hval += (hval << 10);
2500 		hval ^= (hval >> 6);
2501 	}
2502 	for (str = (const char *)&num, i = 0; i < sizeof (num); i++) {
2503 		hval += str[i];
2504 		hval += (hval << 10);
2505 		hval ^= (hval >> 6);
2506 	}
2507 	hval += (hval << 3);
2508 	hval ^= (hval >> 11);
2509 	hval += (hval << 15);
2510 	return (hval % htsize);
2511 }
2512 
2513 static
2514 int
2515 get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid,
2516 		uid_t *pid)
2517 {
2518 	uint_t		next, key;
2519 	uint_t		htsize = state->sid_history_size;
2520 	idmap_sid	*sid;
2521 
2522 	next = gethash(prefix, rid, htsize);
2523 	while (next != htsize) {
2524 		key = state->sid_history[next].key;
2525 		if (key == htsize)
2526 			return (0);
2527 		sid = &state->batch->idmap_mapping_batch_val[key].id1.
2528 		    idmap_id_u.sid;
2529 		if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) {
2530 			*pid = state->result->ids.ids_val[key].id.
2531 			    idmap_id_u.uid;
2532 			return (1);
2533 		}
2534 		next = state->sid_history[next].next;
2535 	}
2536 	return (0);
2537 }
2538 
2539 static
2540 void
2541 add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid)
2542 {
2543 	uint_t		hash, next;
2544 	uint_t		htsize = state->sid_history_size;
2545 
2546 	hash = next = gethash(prefix, rid, htsize);
2547 	while (state->sid_history[next].key != htsize) {
2548 		next++;
2549 		next %= htsize;
2550 	}
2551 	state->sid_history[next].key = state->curpos;
2552 	if (hash == next)
2553 		return;
2554 	state->sid_history[next].next = state->sid_history[hash].next;
2555 	state->sid_history[hash].next = next;
2556 }
2557 
2558 void
2559 cleanup_lookup_state(lookup_state_t *state)
2560 {
2561 	free(state->sid_history);
2562 	free(state->ad_unixuser_attr);
2563 	free(state->ad_unixgroup_attr);
2564 }
2565 
2566 /* ARGSUSED */
2567 static
2568 idmap_retcode
2569 dynamic_ephemeral_mapping(lookup_state_t *state, sqlite *cache,
2570 		idmap_mapping *req, idmap_id_res *res)
2571 {
2572 
2573 	uid_t		next_pid;
2574 
2575 	res->direction = IDMAP_DIRECTION_BI;
2576 
2577 	if (IS_EPHEMERAL(res->id.idmap_id_u.uid))
2578 		return (IDMAP_SUCCESS);
2579 
2580 	if (state->sid_history != NULL &&
2581 	    get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix,
2582 	    req->id1.idmap_id_u.sid.rid, &next_pid)) {
2583 		res->id.idmap_id_u.uid = next_pid;
2584 		return (IDMAP_SUCCESS);
2585 	}
2586 
2587 	if (res->id.idtype == IDMAP_UID) {
2588 		if (get_next_eph_uid(&next_pid) != 0)
2589 			return (IDMAP_ERR_INTERNAL);
2590 		res->id.idmap_id_u.uid = next_pid;
2591 	} else {
2592 		if (get_next_eph_gid(&next_pid) != 0)
2593 			return (IDMAP_ERR_INTERNAL);
2594 		res->id.idmap_id_u.gid = next_pid;
2595 	}
2596 
2597 	if (state->sid_history != NULL)
2598 		add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix,
2599 		    req->id1.idmap_id_u.sid.rid);
2600 
2601 	return (IDMAP_SUCCESS);
2602 }
2603 
2604 idmap_retcode
2605 sid2pid_second_pass(lookup_state_t *state, sqlite *cache, sqlite *db,
2606 		idmap_mapping *req, idmap_id_res *res)
2607 {
2608 	idmap_retcode	retcode;
2609 
2610 	/* Check if second pass is needed */
2611 	if (ARE_WE_DONE(req->direction))
2612 		return (res->retcode);
2613 
2614 	/* Get status from previous pass */
2615 	retcode = res->retcode;
2616 	if (retcode != IDMAP_SUCCESS)
2617 		goto out;
2618 
2619 	/*
2620 	 * If directory-based name mapping is enabled then the unixname
2621 	 * may already have been retrieved from the AD object (AD-mode or
2622 	 * mixed-mode) or from native LDAP object (nldap-mode) -- done.
2623 	 */
2624 	if (req->id2name != NULL) {
2625 		assert(res->id.idtype != IDMAP_POSIXID);
2626 		if (AD_MODE(res->id.idtype, state))
2627 			res->direction = IDMAP_DIRECTION_BI;
2628 		else if (NLDAP_MODE(res->id.idtype, state))
2629 			res->direction = IDMAP_DIRECTION_BI;
2630 		else if (MIXED_MODE(res->id.idtype, state))
2631 			res->direction = IDMAP_DIRECTION_W2U;
2632 
2633 		/*
2634 		 * Special case: (1) If the ad_unixuser_attr and
2635 		 * ad_unixgroup_attr uses the same attribute
2636 		 * name and (2) if this is a diagonal mapping
2637 		 * request and (3) the unixname has been retrieved
2638 		 * from the AD object -- then we ignore it and fallback
2639 		 * to name-based mapping rules and ephemeral mapping
2640 		 *
2641 		 * Example:
2642 		 *  Properties:
2643 		 *    config/ad_unixuser_attr = "unixname"
2644 		 *    config/ad_unixgroup_attr = "unixname"
2645 		 *  AD user object:
2646 		 *    dn: cn=bob ...
2647 		 *    objectclass: user
2648 		 *    sam: bob
2649 		 *    unixname: bob1234
2650 		 *  AD group object:
2651 		 *    dn: cn=winadmins ...
2652 		 *    objectclass: group
2653 		 *    sam: winadmins
2654 		 *    unixname: unixadmins
2655 		 *
2656 		 *  In this example whether "unixname" refers to a unixuser
2657 		 *  or unixgroup depends upon the AD object.
2658 		 *
2659 		 * $idmap show -c winname:bob gid
2660 		 *    AD lookup by "samAccountName=bob" for
2661 		 *    "ad_unixgroup_attr (i.e unixname)" for directory-based
2662 		 *    mapping would get "bob1234" which is not what we want.
2663 		 *    Now why not getgrnam_r("bob1234") and use it if it
2664 		 *    is indeed a unixgroup? That's because Unix can have
2665 		 *    users and groups with the same name and we clearly
2666 		 *    don't know the intention of the admin here.
2667 		 *    Therefore we ignore this and fallback to name-based
2668 		 *    mapping rules or ephemeral mapping.
2669 		 */
2670 		if ((AD_MODE(res->id.idtype, state) ||
2671 		    MIXED_MODE(res->id.idtype, state)) &&
2672 		    state->ad_unixuser_attr != NULL &&
2673 		    state->ad_unixgroup_attr != NULL &&
2674 		    strcasecmp(state->ad_unixuser_attr,
2675 		    state->ad_unixgroup_attr) == 0 &&
2676 		    ((req->id1.idtype == IDMAP_USID &&
2677 		    res->id.idtype == IDMAP_GID) ||
2678 		    (req->id1.idtype == IDMAP_GSID &&
2679 		    res->id.idtype == IDMAP_UID))) {
2680 			free(req->id2name);
2681 			req->id2name = NULL;
2682 			res->id.idmap_id_u.uid = SENTINEL_PID;
2683 			/* fallback */
2684 		} else {
2685 			if (res->id.idmap_id_u.uid == SENTINEL_PID)
2686 				retcode = ns_lookup_byname(req->id2name,
2687 				    NULL, &res->id);
2688 			/*
2689 			 * We don't fallback to name-based mapping rules
2690 			 * or ephemeral mapping.
2691 			 */
2692 			goto out;
2693 		}
2694 	}
2695 
2696 	/*
2697 	 * If we don't have unixname then evaluate local name-based
2698 	 * mapping rules.
2699 	 */
2700 	retcode = name_based_mapping_sid2pid(db, req, res);
2701 	if (retcode != IDMAP_ERR_NOTFOUND)
2702 		goto out;
2703 
2704 	/* If not found, do ephemeral mapping */
2705 	retcode = dynamic_ephemeral_mapping(state, cache, req, res);
2706 
2707 out:
2708 	res->retcode = idmap_stat4prot(retcode);
2709 	if (res->retcode != IDMAP_SUCCESS) {
2710 		req->direction = _IDMAP_F_DONE;
2711 		res->id.idmap_id_u.uid = UID_NOBODY;
2712 	}
2713 	if (!ARE_WE_DONE(req->direction))
2714 		state->sid2pid_done = FALSE;
2715 	return (retcode);
2716 }
2717 
2718 idmap_retcode
2719 update_cache_pid2sid(lookup_state_t *state, sqlite *cache,
2720 		idmap_mapping *req, idmap_id_res *res)
2721 {
2722 	char		*sql = NULL;
2723 	idmap_retcode	retcode;
2724 
2725 	/* Check if we need to cache anything */
2726 	if (ARE_WE_DONE(req->direction))
2727 		return (IDMAP_SUCCESS);
2728 
2729 	/* We don't cache negative entries */
2730 	if (res->retcode != IDMAP_SUCCESS)
2731 		return (IDMAP_SUCCESS);
2732 
2733 	assert(res->direction != IDMAP_DIRECTION_UNDEF);
2734 
2735 	/*
2736 	 * Using NULL for u2w instead of 0 so that our trigger allows
2737 	 * the same pid to be the destination in multiple entries
2738 	 */
2739 	sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
2740 	    "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
2741 	    "is_user, is_wuser, expiration, w2u, u2w) "
2742 	    "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
2743 	    "strftime('%%s','now') + 600, %q, 1); ",
2744 	    res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
2745 	    req->id2domain, req->id2name, req->id1.idmap_id_u.uid,
2746 	    req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0,
2747 	    (res->id.idtype == IDMAP_USID) ? 1 : 0,
2748 	    (res->direction == 0) ? "1" : NULL);
2749 
2750 	if (sql == NULL) {
2751 		retcode = IDMAP_ERR_INTERNAL;
2752 		idmapdlog(LOG_ERR, "Out of memory");
2753 		goto out;
2754 	}
2755 
2756 	retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql);
2757 	if (retcode != IDMAP_SUCCESS)
2758 		goto out;
2759 
2760 	state->pid2sid_done = FALSE;
2761 	sqlite_freemem(sql);
2762 	sql = NULL;
2763 
2764 	/* Check if we need to update namecache */
2765 	if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
2766 		goto out;
2767 
2768 	if (req->id2name == NULL)
2769 		goto out;
2770 
2771 	sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
2772 	    "(sidprefix, rid, canon_name, domain, type, expiration) "
2773 	    "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
2774 	    res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
2775 	    req->id2name, req->id2domain,
2776 	    (res->id.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP);
2777 
2778 	if (sql == NULL) {
2779 		retcode = IDMAP_ERR_INTERNAL;
2780 		idmapdlog(LOG_ERR, "Out of memory");
2781 		goto out;
2782 	}
2783 
2784 	retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql);
2785 
2786 out:
2787 	if (sql != NULL)
2788 		sqlite_freemem(sql);
2789 	return (retcode);
2790 }
2791 
2792 idmap_retcode
2793 update_cache_sid2pid(lookup_state_t *state, sqlite *cache,
2794 		idmap_mapping *req, idmap_id_res *res)
2795 {
2796 	char		*sql = NULL;
2797 	idmap_retcode	retcode;
2798 	int		is_eph_user;
2799 
2800 	/* Check if we need to cache anything */
2801 	if (ARE_WE_DONE(req->direction))
2802 		return (IDMAP_SUCCESS);
2803 
2804 	/* We don't cache negative entries */
2805 	if (res->retcode != IDMAP_SUCCESS)
2806 		return (IDMAP_SUCCESS);
2807 
2808 	if (req->direction & _IDMAP_F_EXP_EPH_UID)
2809 		is_eph_user = 1;
2810 	else if (req->direction & _IDMAP_F_EXP_EPH_GID)
2811 		is_eph_user = 0;
2812 	else
2813 		is_eph_user = -1;
2814 
2815 	if (is_eph_user >= 0 && !IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
2816 		sql = sqlite_mprintf("UPDATE idmap_cache "
2817 		    "SET w2u = 0 WHERE "
2818 		    "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
2819 		    "pid >= 2147483648 AND is_user = %d;",
2820 		    req->id1.idmap_id_u.sid.prefix,
2821 		    req->id1.idmap_id_u.sid.rid,
2822 		    is_eph_user);
2823 		if (sql == NULL) {
2824 			retcode = IDMAP_ERR_INTERNAL;
2825 			idmapdlog(LOG_ERR, "Out of memory");
2826 			goto out;
2827 		}
2828 
2829 		retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql);
2830 		if (retcode != IDMAP_SUCCESS)
2831 			goto out;
2832 
2833 		sqlite_freemem(sql);
2834 		sql = NULL;
2835 	}
2836 
2837 	assert(res->direction != IDMAP_DIRECTION_UNDEF);
2838 
2839 	sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
2840 	    "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
2841 	    "is_user, is_wuser, expiration, w2u, u2w) "
2842 	    "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
2843 	    "strftime('%%s','now') + 600, 1, %q); ",
2844 	    req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
2845 	    (req->id1domain != NULL) ? req->id1domain : "", req->id1name,
2846 	    res->id.idmap_id_u.uid, req->id2name,
2847 	    (res->id.idtype == IDMAP_UID) ? 1 : 0,
2848 	    (req->id1.idtype == IDMAP_USID) ? 1 : 0,
2849 	    (res->direction == 0) ? "1" : NULL);
2850 
2851 	if (sql == NULL) {
2852 		retcode = IDMAP_ERR_INTERNAL;
2853 		idmapdlog(LOG_ERR, "Out of memory");
2854 		goto out;
2855 	}
2856 
2857 	retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql);
2858 	if (retcode != IDMAP_SUCCESS)
2859 		goto out;
2860 
2861 	state->sid2pid_done = FALSE;
2862 	sqlite_freemem(sql);
2863 	sql = NULL;
2864 
2865 	/* Check if we need to update namecache */
2866 	if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
2867 		goto out;
2868 
2869 	if (EMPTY_STRING(req->id1name))
2870 		goto out;
2871 
2872 	sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
2873 	    "(sidprefix, rid, canon_name, domain, type, expiration) "
2874 	    "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
2875 	    req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
2876 	    req->id1name, req->id1domain,
2877 	    (req->id1.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP);
2878 
2879 	if (sql == NULL) {
2880 		retcode = IDMAP_ERR_INTERNAL;
2881 		idmapdlog(LOG_ERR, "Out of memory");
2882 		goto out;
2883 	}
2884 
2885 	retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql);
2886 
2887 out:
2888 	if (sql != NULL)
2889 		sqlite_freemem(sql);
2890 	return (retcode);
2891 }
2892 
2893 static
2894 idmap_retcode
2895 lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res,
2896 		int is_user, int getname)
2897 {
2898 	char		*end;
2899 	char		*sql = NULL;
2900 	const char	**values;
2901 	sqlite_vm	*vm = NULL;
2902 	int		ncol;
2903 	idmap_retcode	retcode = IDMAP_SUCCESS;
2904 	time_t		curtime;
2905 	idmap_id_type	idtype;
2906 
2907 	/* Current time */
2908 	errno = 0;
2909 	if ((curtime = time(NULL)) == (time_t)-1) {
2910 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
2911 		    strerror(errno));
2912 		retcode = IDMAP_ERR_INTERNAL;
2913 		goto out;
2914 	}
2915 
2916 	/* SQL to lookup the cache by pid or by unixname */
2917 	if (req->id1.idmap_id_u.uid != SENTINEL_PID) {
2918 		sql = sqlite_mprintf("SELECT sidprefix, rid, canon_winname, "
2919 		    "windomain, w2u, is_wuser "
2920 		    "FROM idmap_cache WHERE "
2921 		    "pid = %u AND u2w = 1 AND is_user = %d AND "
2922 		    "(pid >= 2147483648 OR "
2923 		    "(expiration = 0 OR expiration ISNULL OR "
2924 		    "expiration > %d));",
2925 		    req->id1.idmap_id_u.uid, is_user, curtime);
2926 	} else if (req->id1name != NULL) {
2927 		sql = sqlite_mprintf("SELECT sidprefix, rid, canon_winname, "
2928 		    "windomain, w2u, is_wuser "
2929 		    "FROM idmap_cache WHERE "
2930 		    "unixname = %Q AND u2w = 1 AND is_user = %d AND "
2931 		    "(pid >= 2147483648 OR "
2932 		    "(expiration = 0 OR expiration ISNULL OR "
2933 		    "expiration > %d));",
2934 		    req->id1name, is_user, curtime);
2935 	}
2936 
2937 	if (sql == NULL) {
2938 		idmapdlog(LOG_ERR, "Out of memory");
2939 		retcode = IDMAP_ERR_MEMORY;
2940 		goto out;
2941 	}
2942 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 5, &values);
2943 	sqlite_freemem(sql);
2944 
2945 	if (retcode == IDMAP_ERR_NOTFOUND)
2946 		goto out;
2947 	else if (retcode == IDMAP_SUCCESS) {
2948 		/* sanity checks */
2949 		if (values[0] == NULL || values[1] == NULL) {
2950 			retcode = IDMAP_ERR_CACHE;
2951 			goto out;
2952 		}
2953 
2954 		switch (res->id.idtype) {
2955 		case IDMAP_SID:
2956 		case IDMAP_USID:
2957 		case IDMAP_GSID:
2958 			idtype = strtol(values[5], &end, 10) == 1
2959 			    ? IDMAP_USID : IDMAP_GSID;
2960 
2961 			if (res->id.idtype == IDMAP_USID &&
2962 			    idtype != IDMAP_USID) {
2963 				retcode = IDMAP_ERR_NOTUSER;
2964 				goto out;
2965 			} else if (res->id.idtype == IDMAP_GSID &&
2966 			    idtype != IDMAP_GSID) {
2967 				retcode = IDMAP_ERR_NOTGROUP;
2968 				goto out;
2969 			}
2970 			res->id.idtype = idtype;
2971 
2972 			res->id.idmap_id_u.sid.rid =
2973 			    strtoul(values[1], &end, 10);
2974 			res->id.idmap_id_u.sid.prefix = strdup(values[0]);
2975 			if (res->id.idmap_id_u.sid.prefix == NULL) {
2976 				idmapdlog(LOG_ERR, "Out of memory");
2977 				retcode = IDMAP_ERR_MEMORY;
2978 				goto out;
2979 			}
2980 
2981 			if (values[4] != NULL)
2982 				res->direction =
2983 				    (strtol(values[4], &end, 10) == 0)?
2984 				    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
2985 			else
2986 				res->direction = IDMAP_DIRECTION_U2W;
2987 
2988 			if (getname == 0 || values[2] == NULL)
2989 				break;
2990 			req->id2name = strdup(values[2]);
2991 			if (req->id2name == NULL) {
2992 				idmapdlog(LOG_ERR, "Out of memory");
2993 				retcode = IDMAP_ERR_MEMORY;
2994 				goto out;
2995 			}
2996 
2997 			if (values[3] == NULL)
2998 				break;
2999 			req->id2domain = strdup(values[3]);
3000 			if (req->id2domain == NULL) {
3001 				idmapdlog(LOG_ERR, "Out of memory");
3002 				retcode = IDMAP_ERR_MEMORY;
3003 				goto out;
3004 			}
3005 
3006 			break;
3007 		default:
3008 			retcode = IDMAP_ERR_NOTSUPPORTED;
3009 			break;
3010 		}
3011 	}
3012 
3013 out:
3014 	if (vm != NULL)
3015 		(void) sqlite_finalize(vm, NULL);
3016 	return (retcode);
3017 }
3018 
3019 static
3020 idmap_retcode
3021 lookup_cache_name2sid(sqlite *cache, const char *name, const char *domain,
3022 	char **canonname, char **sidprefix, idmap_rid_t *rid, int *type)
3023 {
3024 	char		*end, *lower_name;
3025 	char		*sql = NULL;
3026 	const char	**values;
3027 	sqlite_vm	*vm = NULL;
3028 	int		ncol;
3029 	time_t		curtime;
3030 	idmap_retcode	retcode = IDMAP_SUCCESS;
3031 
3032 	/* Get current time */
3033 	errno = 0;
3034 	if ((curtime = time(NULL)) == (time_t)-1) {
3035 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
3036 		    strerror(errno));
3037 		retcode = IDMAP_ERR_INTERNAL;
3038 		goto out;
3039 	}
3040 
3041 	/* SQL to lookup the cache */
3042 	if ((lower_name = tolower_u8(name)) == NULL)
3043 		lower_name = (char *)name;
3044 	sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name "
3045 	    "FROM name_cache WHERE name = %Q AND domain = %Q AND "
3046 	    "(expiration = 0 OR expiration ISNULL OR "
3047 	    "expiration > %d);", lower_name, domain, curtime);
3048 	if (lower_name != name)
3049 		free(lower_name);
3050 	if (sql == NULL) {
3051 		idmapdlog(LOG_ERR, "Out of memory");
3052 		retcode = IDMAP_ERR_MEMORY;
3053 		goto out;
3054 	}
3055 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values);
3056 	sqlite_freemem(sql);
3057 
3058 	if (retcode == IDMAP_SUCCESS) {
3059 		if (type != NULL) {
3060 			if (values[2] == NULL) {
3061 				retcode = IDMAP_ERR_CACHE;
3062 				goto out;
3063 			}
3064 			*type = strtol(values[2], &end, 10);
3065 		}
3066 
3067 		if (values[0] == NULL || values[1] == NULL) {
3068 			retcode = IDMAP_ERR_CACHE;
3069 			goto out;
3070 		}
3071 
3072 		if (canonname != NULL) {
3073 			assert(values[3] != NULL);
3074 			if ((*canonname = strdup(values[3])) == NULL) {
3075 				idmapdlog(LOG_ERR, "Out of memory");
3076 				retcode = IDMAP_ERR_MEMORY;
3077 				goto out;
3078 			}
3079 		}
3080 
3081 		if ((*sidprefix = strdup(values[0])) == NULL) {
3082 			idmapdlog(LOG_ERR, "Out of memory");
3083 			retcode = IDMAP_ERR_MEMORY;
3084 			if (canonname != NULL) {
3085 				free(*canonname);
3086 				*canonname = NULL;
3087 			}
3088 			goto out;
3089 		}
3090 		*rid = strtoul(values[1], &end, 10);
3091 	}
3092 
3093 out:
3094 	if (vm != NULL)
3095 		(void) sqlite_finalize(vm, NULL);
3096 	return (retcode);
3097 }
3098 
3099 static
3100 idmap_retcode
3101 ad_lookup_by_winname(lookup_state_t *state,
3102 		const char *name, const char *domain, int eunixtype,
3103 		char **canonname, char **sidprefix,
3104 		idmap_rid_t *rid, int *wintype, char **unixname)
3105 {
3106 	int			retries = 0;
3107 	idmap_query_state_t	*qs = NULL;
3108 	idmap_retcode		rc, retcode;
3109 
3110 retry:
3111 	retcode = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs);
3112 	if (retcode != IDMAP_SUCCESS) {
3113 		if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
3114 			goto retry;
3115 		degrade_svc(1, "failed to create request for AD lookup "
3116 		    "by winname");
3117 		return (retcode);
3118 	}
3119 
3120 	restore_svc();
3121 
3122 	if (state != NULL)
3123 		idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr,
3124 		    state->ad_unixgroup_attr);
3125 
3126 	retcode = idmap_name2sid_batch_add1(qs, name, domain, eunixtype,
3127 	    canonname, sidprefix, rid, wintype, unixname, &rc);
3128 
3129 	if (retcode != IDMAP_SUCCESS)
3130 		idmap_lookup_release_batch(&qs);
3131 	else
3132 		retcode = idmap_lookup_batch_end(&qs);
3133 
3134 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
3135 		goto retry;
3136 	else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
3137 		degrade_svc(1, "some AD lookups timed out repeatedly");
3138 
3139 	if (retcode != IDMAP_SUCCESS) {
3140 		idmapdlog(LOG_NOTICE, "AD lookup by winname failed");
3141 		return (retcode);
3142 	}
3143 	return (rc);
3144 }
3145 
3146 static
3147 idmap_retcode
3148 lookup_name2sid(sqlite *cache, const char *name, const char *domain,
3149 		int *is_wuser, char **canonname, char **sidprefix,
3150 		idmap_rid_t *rid, idmap_mapping *req)
3151 {
3152 	int		type;
3153 	idmap_retcode	retcode;
3154 
3155 	*sidprefix = NULL;
3156 	if (canonname != NULL)
3157 		*canonname = NULL;
3158 
3159 	/* Lookup well-known SIDs table */
3160 	retcode = lookup_wksids_name2sid(name, canonname, sidprefix, rid,
3161 	    &type);
3162 	if (retcode == IDMAP_SUCCESS) {
3163 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
3164 		goto out;
3165 	} else if (retcode != IDMAP_ERR_NOTFOUND) {
3166 		return (retcode);
3167 	}
3168 
3169 	/* Lookup cache */
3170 	retcode = lookup_cache_name2sid(cache, name, domain, canonname,
3171 	    sidprefix, rid, &type);
3172 	if (retcode == IDMAP_SUCCESS) {
3173 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
3174 		goto out;
3175 	} else if (retcode != IDMAP_ERR_NOTFOUND) {
3176 		return (retcode);
3177 	}
3178 
3179 	/* Lookup AD */
3180 	retcode = ad_lookup_by_winname(NULL, name, domain, _IDMAP_T_UNDEF,
3181 	    canonname, sidprefix, rid, &type, NULL);
3182 	if (retcode != IDMAP_SUCCESS)
3183 		return (retcode);
3184 	/* Don't need to set req->direction |= _IDMAP_F_LOOKUP_AD; */
3185 
3186 out:
3187 	/*
3188 	 * Entry found (cache or Windows lookup)
3189 	 * is_wuser is both input as well as output parameter
3190 	 */
3191 	if (*is_wuser == 1 && type != _IDMAP_T_USER)
3192 		retcode = IDMAP_ERR_NOTUSER;
3193 	else if (*is_wuser == 0 && type != _IDMAP_T_GROUP)
3194 		retcode = IDMAP_ERR_NOTGROUP;
3195 	else if (*is_wuser == -1) {
3196 		/* Caller wants to know if its user or group */
3197 		if (type == _IDMAP_T_USER)
3198 			*is_wuser = 1;
3199 		else if (type == _IDMAP_T_GROUP)
3200 			*is_wuser = 0;
3201 		else
3202 			retcode = IDMAP_ERR_SID;
3203 	}
3204 
3205 	if (retcode != IDMAP_SUCCESS) {
3206 		free(*sidprefix);
3207 		*sidprefix = NULL;
3208 		if (canonname != NULL) {
3209 			free(*canonname);
3210 			*canonname = NULL;
3211 		}
3212 	}
3213 	return (retcode);
3214 }
3215 
3216 static
3217 idmap_retcode
3218 name_based_mapping_pid2sid(sqlite *db, sqlite *cache, const char *unixname,
3219 		int is_user, idmap_mapping *req, idmap_id_res *res)
3220 {
3221 	const char	*winname, *windomain;
3222 	char		*canonname;
3223 	char		*default_domain = NULL;
3224 	char		*sql = NULL, *errmsg = NULL;
3225 	idmap_retcode	retcode;
3226 	char		*end;
3227 	const char	**values;
3228 	sqlite_vm	*vm = NULL;
3229 	int		ncol, r, nrow;
3230 	int		is_wuser;
3231 	const char	*me = "name_based_mapping_pid2sid";
3232 
3233 	assert(unixname != NULL); /* We have unixname */
3234 	assert(req->id2name == NULL); /* We don't have winname */
3235 	assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */
3236 
3237 	RDLOCK_CONFIG();
3238 	if (_idmapdstate.cfg->pgcfg.default_domain != NULL) {
3239 		default_domain =
3240 		    strdup(_idmapdstate.cfg->pgcfg.default_domain);
3241 		if (default_domain == NULL) {
3242 			UNLOCK_CONFIG();
3243 			idmapdlog(LOG_ERR, "Out of memory");
3244 			retcode = IDMAP_ERR_MEMORY;
3245 			goto out;
3246 		}
3247 	}
3248 	UNLOCK_CONFIG();
3249 
3250 	sql = sqlite_mprintf(
3251 	    "SELECT winname_display, windomain, w2u_order FROM namerules WHERE "
3252 	    "u2w_order > 0 AND is_user = %d AND "
3253 	    "(unixname = %Q OR unixname = '*') "
3254 	    "ORDER BY u2w_order ASC;", is_user, unixname);
3255 	if (sql == NULL) {
3256 		idmapdlog(LOG_ERR, "Out of memory");
3257 		retcode = IDMAP_ERR_MEMORY;
3258 		goto out;
3259 	}
3260 
3261 	if (sqlite_compile(db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
3262 		retcode = IDMAP_ERR_INTERNAL;
3263 		idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3264 		    CHECK_NULL(errmsg));
3265 		sqlite_freemem(errmsg);
3266 		goto out;
3267 	}
3268 
3269 	for (nrow = 0; ; ) {
3270 		r = sqlite_step(vm, &ncol, &values, NULL);
3271 		assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
3272 		if (r == SQLITE_ROW) {
3273 			nrow++;
3274 			if (ncol < 3) {
3275 				retcode = IDMAP_ERR_INTERNAL;
3276 				goto out;
3277 			}
3278 			if (values[0] == NULL) {
3279 				/* values [1] and [2] can be null */
3280 				retcode = IDMAP_ERR_INTERNAL;
3281 				goto out;
3282 			}
3283 			if (EMPTY_NAME(values[0])) {
3284 				retcode = IDMAP_ERR_NOMAPPING;
3285 				goto out;
3286 			}
3287 
3288 			if (values[0][0] == '*') {
3289 				if (nrow > 1) {
3290 					/*
3291 					 * There were non-wildcard rules where
3292 					 * windows identity doesn't exist
3293 					 */
3294 					retcode = IDMAP_ERR_NOMAPPING;
3295 					goto out;
3296 				}
3297 				winname = unixname;
3298 			} else {
3299 				winname = values[0];
3300 			}
3301 
3302 			if (values[1] != NULL)
3303 				windomain = values[1];
3304 			else if (default_domain != NULL)
3305 				windomain = default_domain;
3306 			else {
3307 				idmapdlog(LOG_ERR, "%s: no domain", me);
3308 				retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
3309 				goto out;
3310 			}
3311 			/* Lookup winname@domain to sid */
3312 
3313 			is_wuser = res->id.idtype == IDMAP_USID ? 1
3314 			    : res->id.idtype == IDMAP_GSID ? 0
3315 			    : -1;
3316 
3317 			retcode = lookup_name2sid(cache, winname, windomain,
3318 			    &is_wuser, &canonname,
3319 			    &res->id.idmap_id_u.sid.prefix,
3320 			    &res->id.idmap_id_u.sid.rid, req);
3321 
3322 			if (retcode == IDMAP_ERR_NOTFOUND) {
3323 				continue;
3324 			}
3325 
3326 			goto out;
3327 		} else if (r == SQLITE_DONE) {
3328 			retcode = IDMAP_ERR_NOTFOUND;
3329 			goto out;
3330 		} else {
3331 			(void) sqlite_finalize(vm, &errmsg);
3332 			vm = NULL;
3333 			idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3334 			    CHECK_NULL(errmsg));
3335 			sqlite_freemem(errmsg);
3336 			retcode = IDMAP_ERR_INTERNAL;
3337 			goto out;
3338 		}
3339 	}
3340 
3341 out:
3342 	if (sql != NULL)
3343 		sqlite_freemem(sql);
3344 	if (retcode == IDMAP_SUCCESS) {
3345 		res->id.idtype = is_wuser ? IDMAP_USID : IDMAP_GSID;
3346 
3347 		if (values[2] != NULL)
3348 			res->direction =
3349 			    (strtol(values[2], &end, 10) == 0)?
3350 			    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
3351 		else
3352 			res->direction = IDMAP_DIRECTION_U2W;
3353 
3354 		req->id2name = canonname;
3355 		if (req->id2name != NULL) {
3356 			if (windomain == default_domain) {
3357 				req->id2domain = (char *)windomain;
3358 				default_domain = NULL;
3359 			} else {
3360 				req->id2domain = strdup(windomain);
3361 			}
3362 		}
3363 	}
3364 	if (vm != NULL)
3365 		(void) sqlite_finalize(vm, NULL);
3366 	if (default_domain != NULL)
3367 		free(default_domain);
3368 	return (retcode);
3369 }
3370 
3371 /*
3372  * Convention when processing unix2win requests:
3373  *
3374  * Unix identity:
3375  * req->id1name =
3376  *              unixname if given otherwise unixname found will be placed
3377  *              here.
3378  * req->id1domain =
3379  *              NOT USED
3380  * req->id1.idtype =
3381  *              Given type (IDMAP_UID or IDMAP_GID)
3382  * req->id1..[uid or gid] =
3383  *              UID/GID if given otherwise UID/GID found will be placed here.
3384  *
3385  * Windows identity:
3386  * req->id2name =
3387  *              winname found will be placed here.
3388  * req->id2domain =
3389  *              windomain found will be placed here.
3390  * res->id.idtype =
3391  *              Target type initialized from req->id2.idtype. If
3392  *              it is IDMAP_SID then actual type (IDMAP_USID/GSID) found
3393  *              will be placed here.
3394  * req->id..sid.[prefix, rid] =
3395  *              SID found will be placed here.
3396  *
3397  * Others:
3398  * res->retcode =
3399  *              Return status for this request will be placed here.
3400  * res->direction =
3401  *              Direction found will be placed here. Direction
3402  *              meaning whether the resultant mapping is valid
3403  *              only from unix2win or bi-directional.
3404  * req->direction =
3405  *              INTERNAL USE. Used by idmapd to set various
3406  *              flags (_IDMAP_F_xxxx) to aid in processing
3407  *              of the request.
3408  * req->id2.idtype =
3409  *              INTERNAL USE. Initially this is the requested target
3410  *              type and is used to initialize res->id.idtype.
3411  *              ad_lookup_batch() uses this field temporarily to store
3412  *              sid_type obtained by the batched AD lookups and after
3413  *              use resets it to IDMAP_NONE to prevent xdr from
3414  *              mis-interpreting the contents of req->id2.
3415  * req->id2..[uid or gid or sid] =
3416  *              NOT USED
3417  */
3418 
3419 /*
3420  * This function does the following:
3421  * 1. Lookup well-known SIDs table.
3422  * 2. Lookup cache.
3423  * 3. Check if the client does not want new mapping to be allocated
3424  *    in which case this pass is the final pass.
3425  * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs
3426  *    to do AD/NLDAP lookup.
3427  */
3428 idmap_retcode
3429 pid2sid_first_pass(lookup_state_t *state, sqlite *cache,
3430 		idmap_mapping *req, idmap_id_res *res, int is_user,
3431 		int getname)
3432 {
3433 	idmap_retcode	retcode;
3434 	bool_t		gen_localsid_on_err = FALSE;
3435 
3436 	/* Initialize result */
3437 	res->id.idtype = req->id2.idtype;
3438 	res->direction = IDMAP_DIRECTION_UNDEF;
3439 
3440 	if (req->id2.idmap_id_u.sid.prefix != NULL) {
3441 		/* sanitize sidprefix */
3442 		free(req->id2.idmap_id_u.sid.prefix);
3443 		req->id2.idmap_id_u.sid.prefix = NULL;
3444 	}
3445 
3446 	/* Lookup well-known SIDs table */
3447 	retcode = lookup_wksids_pid2sid(req, res, is_user);
3448 	if (retcode != IDMAP_ERR_NOTFOUND)
3449 		goto out;
3450 
3451 	/* Lookup cache */
3452 	retcode = lookup_cache_pid2sid(cache, req, res, is_user, getname);
3453 	if (retcode != IDMAP_ERR_NOTFOUND)
3454 		goto out;
3455 
3456 	/* Ephemeral ids cannot be allocated during pid2sid */
3457 	if (IS_EPHEMERAL(req->id1.idmap_id_u.uid)) {
3458 		retcode = IDMAP_ERR_NOMAPPING;
3459 		goto out;
3460 	}
3461 
3462 	if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) {
3463 		gen_localsid_on_err = TRUE;
3464 		retcode = IDMAP_ERR_NOMAPPING;
3465 		goto out;
3466 	}
3467 
3468 	/* Set flags for the next stage */
3469 	if (AD_MODE(req->id1.idtype, state)) {
3470 		/*
3471 		 * If AD-based name mapping is enabled then the next stage
3472 		 * will need to lookup AD using unixname to get the
3473 		 * corresponding winname.
3474 		 */
3475 		if (req->id1name == NULL) {
3476 			/* Get unixname if only pid is given. */
3477 			retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid,
3478 			    is_user, &req->id1name);
3479 			if (retcode != IDMAP_SUCCESS)
3480 				goto out;
3481 		}
3482 		req->direction |= _IDMAP_F_LOOKUP_AD;
3483 		state->ad_nqueries++;
3484 	} else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) {
3485 		/*
3486 		 * If native LDAP or mixed mode is enabled for name mapping
3487 		 * then the next stage will need to lookup native LDAP using
3488 		 * unixname/pid to get the corresponding winname.
3489 		 */
3490 		req->direction |= _IDMAP_F_LOOKUP_NLDAP;
3491 		state->nldap_nqueries++;
3492 	}
3493 
3494 	/*
3495 	 * Failed to find non-expired entry in cache. Set the flag to
3496 	 * indicate that we are not done yet.
3497 	 */
3498 	state->pid2sid_done = FALSE;
3499 	req->direction |= _IDMAP_F_NOTDONE;
3500 	retcode = IDMAP_SUCCESS;
3501 
3502 out:
3503 	res->retcode = idmap_stat4prot(retcode);
3504 	if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS)
3505 		if (gen_localsid_on_err == TRUE)
3506 			(void) generate_localsid(req, res, is_user);
3507 	return (retcode);
3508 }
3509 
3510 idmap_retcode
3511 pid2sid_second_pass(lookup_state_t *state, sqlite *cache, sqlite *db,
3512 		idmap_mapping *req, idmap_id_res *res, int is_user)
3513 {
3514 	bool_t		gen_localsid_on_err = TRUE;
3515 	idmap_retcode	retcode = IDMAP_SUCCESS;
3516 
3517 	/* Check if second pass is needed */
3518 	if (ARE_WE_DONE(req->direction))
3519 		return (res->retcode);
3520 
3521 	/* Get status from previous pass */
3522 	retcode = res->retcode;
3523 	if (retcode != IDMAP_SUCCESS)
3524 		goto out;
3525 
3526 	/*
3527 	 * If directory-based name mapping is enabled then the winname
3528 	 * may already have been retrieved from the AD object (AD-mode)
3529 	 * or from native LDAP object (nldap-mode or mixed-mode) -- done.
3530 	 */
3531 	if (res->id.idmap_id_u.sid.prefix != NULL || req->id2name != NULL) {
3532 		if (AD_MODE(req->id1.idtype, state))
3533 			res->direction = IDMAP_DIRECTION_BI;
3534 		else if (NLDAP_MODE(req->id1.idtype, state))
3535 			res->direction = IDMAP_DIRECTION_BI;
3536 		else if (MIXED_MODE(req->id1.idtype, state))
3537 			res->direction = IDMAP_DIRECTION_W2U;
3538 		goto out;
3539 	}
3540 
3541 	if (req->id1name == NULL) {
3542 		/* Get unixname from name service */
3543 		retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user,
3544 		    &req->id1name);
3545 		if (retcode != IDMAP_SUCCESS)
3546 			goto out;
3547 	} else if (req->id1.idmap_id_u.uid == SENTINEL_PID) {
3548 		/* Get pid from name service */
3549 		retcode = ns_lookup_byname(req->id1name, NULL, &req->id1);
3550 		if (retcode != IDMAP_SUCCESS) {
3551 			gen_localsid_on_err = FALSE;
3552 			goto out;
3553 		}
3554 	}
3555 
3556 	/* Use unixname to evaluate local name-based mapping rules */
3557 	retcode = name_based_mapping_pid2sid(db, cache, req->id1name, is_user,
3558 	    req, res);
3559 	if (retcode == IDMAP_ERR_NOTFOUND) {
3560 		retcode = generate_localsid(req, res, is_user);
3561 		gen_localsid_on_err = FALSE;
3562 	}
3563 
3564 out:
3565 	res->retcode = idmap_stat4prot(retcode);
3566 	if (res->retcode != IDMAP_SUCCESS) {
3567 		req->direction = _IDMAP_F_DONE;
3568 		if (gen_localsid_on_err == TRUE)
3569 			(void) generate_localsid(req, res, is_user);
3570 	}
3571 	if (!ARE_WE_DONE(req->direction))
3572 		state->pid2sid_done = FALSE;
3573 	return (retcode);
3574 }
3575 
3576 static
3577 idmap_retcode
3578 ad_lookup_by_sid(lookup_state_t *state,
3579 		const char *sidprefix, idmap_rid_t rid, int eunixtype,
3580 		char **name, char **domain, int *type, char **unixname)
3581 {
3582 	int			retries = 0;
3583 	idmap_query_state_t	*qs = NULL;
3584 	idmap_retcode		rc, retcode;
3585 
3586 retry:
3587 	retcode = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs);
3588 	if (retcode != IDMAP_SUCCESS) {
3589 		if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
3590 			goto retry;
3591 		degrade_svc(1, "failed to create request for AD lookup by SID");
3592 		return (retcode);
3593 	}
3594 
3595 	restore_svc();
3596 
3597 	if (state != NULL)
3598 		idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr,
3599 		    state->ad_unixgroup_attr);
3600 
3601 	retcode = idmap_sid2name_batch_add1(qs, sidprefix, &rid, eunixtype,
3602 	    name, domain, type, unixname, &rc);
3603 
3604 	if (retcode != IDMAP_SUCCESS)
3605 		idmap_lookup_release_batch(&qs);
3606 	else
3607 		retcode = idmap_lookup_batch_end(&qs);
3608 
3609 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
3610 		goto retry;
3611 	else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
3612 		degrade_svc(1, "some AD lookups timed out repeatedly");
3613 
3614 	if (retcode != IDMAP_SUCCESS) {
3615 		idmapdlog(LOG_NOTICE, "AD lookup by SID failed");
3616 		return (retcode);
3617 	}
3618 	return (rc);
3619 }
3620 
3621 static
3622 int
3623 copy_mapping_request(idmap_mapping *mapping, idmap_mapping *request)
3624 {
3625 	(void) memset(mapping, 0, sizeof (*mapping));
3626 
3627 	mapping->flag = request->flag;
3628 	mapping->direction = _IDMAP_F_DONE;
3629 	mapping->id2.idtype = request->id2.idtype;
3630 
3631 	mapping->id1.idtype = request->id1.idtype;
3632 	if (IS_REQUEST_SID(*request, 1)) {
3633 		mapping->id1.idmap_id_u.sid.rid =
3634 		    request->id1.idmap_id_u.sid.rid;
3635 		if (!EMPTY_STRING(request->id1.idmap_id_u.sid.prefix)) {
3636 			mapping->id1.idmap_id_u.sid.prefix =
3637 			    strdup(request->id1.idmap_id_u.sid.prefix);
3638 			if (mapping->id1.idmap_id_u.sid.prefix == NULL)
3639 				goto errout;
3640 		}
3641 	} else {
3642 		mapping->id1.idmap_id_u.uid = request->id1.idmap_id_u.uid;
3643 	}
3644 
3645 	if (!EMPTY_STRING(request->id1domain)) {
3646 		mapping->id1domain = strdup(request->id1domain);
3647 		if (mapping->id1domain == NULL)
3648 			goto errout;
3649 	}
3650 
3651 	if (!EMPTY_STRING(request->id1name)) {
3652 		mapping->id1name = strdup(request->id1name);
3653 		if (mapping->id1name == NULL)
3654 			goto errout;
3655 	}
3656 
3657 	/* We don't need the rest of the request i.e request->id2 */
3658 	return (0);
3659 
3660 errout:
3661 	if (mapping->id1.idmap_id_u.sid.prefix != NULL)
3662 		free(mapping->id1.idmap_id_u.sid.prefix);
3663 	if (mapping->id1domain != NULL)
3664 		free(mapping->id1domain);
3665 	if (mapping->id1name != NULL)
3666 		free(mapping->id1name);
3667 
3668 	(void) memset(mapping, 0, sizeof (*mapping));
3669 	return (-1);
3670 }
3671 
3672 
3673 idmap_retcode
3674 get_w2u_mapping(sqlite *cache, sqlite *db, idmap_mapping *request,
3675 		idmap_mapping *mapping)
3676 {
3677 	idmap_id_res	idres;
3678 	lookup_state_t	state;
3679 	char		*cp;
3680 	idmap_retcode	retcode;
3681 	const char	*winname, *windomain;
3682 
3683 	(void) memset(&idres, 0, sizeof (idres));
3684 	(void) memset(&state, 0, sizeof (state));
3685 
3686 	/* Get directory-based name mapping info */
3687 	retcode = get_ds_namemap_type(&state);
3688 	if (retcode != IDMAP_SUCCESS)
3689 		goto out;
3690 
3691 	/*
3692 	 * Copy data from "request" to "mapping". Note that
3693 	 * empty strings are not copied from "request" to
3694 	 * "mapping" and therefore the coresponding strings in
3695 	 * "mapping" will be NULL. This eliminates having to
3696 	 * check for empty strings henceforth.
3697 	 */
3698 	if (copy_mapping_request(mapping, request) < 0) {
3699 		retcode = IDMAP_ERR_MEMORY;
3700 		goto out;
3701 	}
3702 
3703 	winname = mapping->id1name;
3704 	windomain = mapping->id1domain;
3705 
3706 	if (winname == NULL && windomain != NULL) {
3707 		retcode = IDMAP_ERR_ARG;
3708 		goto out;
3709 	}
3710 
3711 	/* Need atleast winname or sid to proceed */
3712 	if (winname == NULL && mapping->id1.idmap_id_u.sid.prefix == NULL) {
3713 		retcode = IDMAP_ERR_ARG;
3714 		goto out;
3715 	}
3716 
3717 	/*
3718 	 * If domainname is not given but we have a fully qualified
3719 	 * winname then extract the domainname from the winname,
3720 	 * otherwise use the default_domain from the config
3721 	 */
3722 	if (winname != NULL && windomain == NULL) {
3723 		retcode = IDMAP_SUCCESS;
3724 		if ((cp = strchr(winname, '@')) != NULL) {
3725 			*cp = '\0';
3726 			mapping->id1domain = strdup(cp + 1);
3727 			if (mapping->id1domain == NULL)
3728 				retcode = IDMAP_ERR_MEMORY;
3729 		} else if (lookup_wksids_name2sid(winname, NULL, NULL, NULL,
3730 		    NULL) != IDMAP_SUCCESS) {
3731 			/* well-known SIDs don't need domain */
3732 			RDLOCK_CONFIG();
3733 			if (_idmapdstate.cfg->pgcfg.default_domain != NULL) {
3734 				mapping->id1domain =
3735 				    strdup(_idmapdstate.cfg->
3736 				    pgcfg.default_domain);
3737 				if (mapping->id1domain == NULL)
3738 					retcode = IDMAP_ERR_MEMORY;
3739 			} else {
3740 				retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
3741 			}
3742 			UNLOCK_CONFIG();
3743 		}
3744 		if (retcode != IDMAP_SUCCESS)
3745 			goto out;
3746 	}
3747 
3748 	/*
3749 	 * First pass looks up the well-known SIDs table and cache
3750 	 * and handles localSIDs
3751 	 */
3752 	state.sid2pid_done = TRUE;
3753 	retcode = sid2pid_first_pass(&state, cache, mapping, &idres);
3754 	if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE)
3755 		goto out;
3756 
3757 	/* AD lookup by winname or by sid */
3758 	if (state.ad_nqueries > 0) {
3759 		retcode = ad_lookup(&state, mapping, &idres, 1, 1, 0);
3760 		if (IDMAP_ERROR(retcode))
3761 			goto out;
3762 	}
3763 
3764 	/*
3765 	 * If nldap-based name mapping is enabled then lookup native LDAP
3766 	 * directory service by winname to get pid and unixname. Ignore
3767 	 * non-fatal errors in which case we simply fallback to evaluating
3768 	 * local name-based mapping rules.
3769 	 */
3770 	if (mapping->id1name != NULL && NLDAP_MODE(idres.id.idtype, (&state))) {
3771 		retcode = nldap_lookup(mapping, &idres, 1, 1);
3772 		if (IDMAP_FATAL_ERROR(retcode))
3773 			goto out;
3774 		idres.retcode = IDMAP_SUCCESS;
3775 	}
3776 
3777 	/* Next pass performs name-based mapping and ephemeral mapping. */
3778 	state.sid2pid_done = TRUE;
3779 	retcode = sid2pid_second_pass(&state, cache, db, mapping, &idres);
3780 	if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE)
3781 		goto out;
3782 
3783 	/* Update cache */
3784 	(void) update_cache_sid2pid(&state, cache, mapping, &idres);
3785 
3786 out:
3787 	/*
3788 	 * Note that "mapping" is returned to the client. Therefore
3789 	 * copy whatever we have in "idres" to mapping->id2 and
3790 	 * free idres.
3791 	 */
3792 	mapping->direction = idres.direction;
3793 	mapping->id2 = idres.id;
3794 	(void) memset(&idres, 0, sizeof (idres));
3795 	if (retcode != IDMAP_SUCCESS)
3796 		mapping->id2.idmap_id_u.uid = UID_NOBODY;
3797 	xdr_free(xdr_idmap_id_res, (caddr_t)&idres);
3798 	cleanup_lookup_state(&state);
3799 	return (retcode);
3800 }
3801 
3802 idmap_retcode
3803 get_u2w_mapping(sqlite *cache, sqlite *db, idmap_mapping *request,
3804 		idmap_mapping *mapping, int is_user)
3805 {
3806 	idmap_id_res	idres;
3807 	lookup_state_t	state;
3808 	idmap_retcode	retcode;
3809 	char		*canonname;
3810 	int		is_wuser;
3811 
3812 	/*
3813 	 * In order to re-use the pid2sid code, we convert
3814 	 * our input data into structs that are expected by
3815 	 * pid2sid_first_pass.
3816 	 */
3817 
3818 	(void) memset(&idres, 0, sizeof (idres));
3819 	(void) memset(&state, 0, sizeof (state));
3820 
3821 	/* Get directory-based name mapping info */
3822 	retcode = get_ds_namemap_type(&state);
3823 	if (retcode != IDMAP_SUCCESS)
3824 		goto out;
3825 
3826 	/*
3827 	 * Copy data from "request" to "mapping". Note that
3828 	 * empty strings are not copied from "request" to
3829 	 * "mapping" and therefore the coresponding strings in
3830 	 * "mapping" will be NULL. This eliminates having to
3831 	 * check for empty strings henceforth.
3832 	 */
3833 	if (copy_mapping_request(mapping, request) < 0) {
3834 		retcode = IDMAP_ERR_MEMORY;
3835 		goto out;
3836 	}
3837 
3838 	/*
3839 	 * For unix to windows mapping request, we need atleast a
3840 	 * unixname or uid/gid to proceed
3841 	 */
3842 	if (mapping->id1name == NULL &&
3843 	    mapping->id1.idmap_id_u.uid == SENTINEL_PID) {
3844 		retcode = IDMAP_ERR_ARG;
3845 		goto out;
3846 	}
3847 
3848 	/* First pass looks up cache and well-known SIDs */
3849 	state.pid2sid_done = TRUE;
3850 	retcode = pid2sid_first_pass(&state, cache, mapping, &idres,
3851 	    is_user, 1);
3852 	if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE)
3853 		goto out;
3854 
3855 	if (state.nldap_nqueries > 0) {
3856 		/*
3857 		 * This means directory-based name mapping (nldap or mixed
3858 		 * mode) is enabled. Lookup native LDAP directory service
3859 		 * by unixname or pid to get the winname. Ignore non-fatal
3860 		 * errors in which case we simply fallback to local name
3861 		 * based mapping rules.
3862 		 */
3863 		retcode = nldap_lookup(mapping, &idres, 0, 0);
3864 		if (IDMAP_FATAL_ERROR(retcode))
3865 			goto out;
3866 		idres.retcode = IDMAP_SUCCESS;
3867 
3868 		/*
3869 		 * If we've winname then get SID. We use lookup_name2sid()
3870 		 * instead of ad_lookup() in order to first resolve name2sid
3871 		 * using well-known SIDs table and name_cache before trying
3872 		 * AD.
3873 		 */
3874 		if (mapping->id2name != NULL) {
3875 			canonname = NULL;
3876 			is_wuser = -1;
3877 			retcode = lookup_name2sid(cache, mapping->id2name,
3878 			    mapping->id2domain, &is_wuser, &canonname,
3879 			    &idres.id.idmap_id_u.sid.prefix,
3880 			    &idres.id.idmap_id_u.sid.rid, mapping);
3881 			if (canonname != NULL) {
3882 				free(mapping->id2name);
3883 				mapping->id2name = canonname;
3884 			}
3885 			if (retcode == IDMAP_SUCCESS)
3886 				idres.id.idtype = is_wuser ? IDMAP_USID :
3887 				    IDMAP_GSID;
3888 			idres.retcode = retcode;
3889 		}
3890 	} else if (state.ad_nqueries > 0) {
3891 		/*
3892 		 * This means AD-based name mapping is enabled.
3893 		 * Lookup AD by unixname to get winname and sid.
3894 		 * Ignore non-fatal errors in which case we simply fallback
3895 		 * to local name based mapping rules.
3896 		 */
3897 		retcode = ad_lookup(&state, mapping, &idres, 0, 0, 1);
3898 		if (IDMAP_FATAL_ERROR(retcode))
3899 			goto out;
3900 		idres.retcode = IDMAP_SUCCESS;
3901 	}
3902 
3903 	/*
3904 	 * Next pass processes the result of the preceding passes/lookups.
3905 	 * It returns if there's nothing more to be done otherwise it
3906 	 * evaluates local name-based mapping rules
3907 	 */
3908 	state.pid2sid_done = TRUE;
3909 	retcode = pid2sid_second_pass(&state, cache, db, mapping, &idres,
3910 	    is_user);
3911 	if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE)
3912 		goto out;
3913 
3914 	/* Update cache */
3915 	(void) update_cache_pid2sid(&state, cache, mapping, &idres);
3916 
3917 out:
3918 	/*
3919 	 * Note that "mapping" is returned to the client. Therefore
3920 	 * copy whatever we have in "idres" to mapping->id2 and
3921 	 * free idres.
3922 	 */
3923 	mapping->direction = idres.direction;
3924 	mapping->id2 = idres.id;
3925 	(void) memset(&idres, 0, sizeof (idres));
3926 	xdr_free(xdr_idmap_id_res, (caddr_t)&idres);
3927 	cleanup_lookup_state(&state);
3928 	return (retcode);
3929 }
3930 
3931 static
3932 idmap_retcode
3933 ad_lookup_by_unixname(lookup_state_t *state,
3934 		const char *unixname, int is_user, int is_wuser,
3935 		char **sidprefix, idmap_rid_t *rid, char **winname,
3936 		char **domain, int *type)
3937 {
3938 	/* Lookup AD by unixname */
3939 	int			retries = 0;
3940 	idmap_query_state_t	*qs = NULL;
3941 	idmap_retcode		rc, retcode;
3942 
3943 retry:
3944 	retcode = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs);
3945 	if (retcode != IDMAP_SUCCESS) {
3946 		if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
3947 			goto retry;
3948 		degrade_svc(1, "failed to create request for AD lookup "
3949 		    "by unixname");
3950 		return (IDMAP_ERR_INTERNAL);
3951 	}
3952 
3953 	restore_svc();
3954 
3955 	if (state != NULL)
3956 		idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr,
3957 		    state->ad_unixgroup_attr);
3958 
3959 	retcode = idmap_unixname2sid_batch_add1(qs, unixname, is_user,
3960 	    is_wuser, sidprefix, rid, winname, domain, type, &rc);
3961 
3962 	if (retcode != IDMAP_SUCCESS)
3963 		idmap_lookup_release_batch(&qs);
3964 	else
3965 		retcode = idmap_lookup_batch_end(&qs);
3966 
3967 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
3968 		goto retry;
3969 	else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
3970 		degrade_svc(1, "some AD lookups timed out repeatedly");
3971 
3972 	if (retcode != IDMAP_SUCCESS) {
3973 		idmapdlog(LOG_NOTICE, "AD lookup by unixname failed");
3974 		return (retcode);
3975 	}
3976 	return (rc);
3977 }
3978 
3979 /*
3980  * This function is called whenever a non-batched AD lookup needs to be
3981  * done (e.g. get_w2u_mapping() and get_u2w_mapping()). It's already
3982  * determined by the caller before calling this function that AD lookup is
3983  * needed and has already searched the well-known SIDs table and name_cache.
3984  */
3985 static
3986 idmap_retcode
3987 ad_lookup(lookup_state_t *state, idmap_mapping *req, idmap_id_res *res,
3988 		int w2u, int getunixattr, int byunixattr)
3989 {
3990 	idmap_retcode	retcode;
3991 	int		type, eunixtype, is_user, is_wuser;
3992 	char		*canonname = NULL;
3993 
3994 	if (w2u) {
3995 		/*
3996 		 * win2unix lookup requests (get_w2u_mapping()) calls this
3997 		 * function to lookup by sid OR winname and to retrieve
3998 		 * SID, winname, sidtype (user or group) and unixnames
3999 		 * from AD.
4000 		 */
4001 
4002 		/* Set the expected unixtype */
4003 		if (res->id.idtype == IDMAP_UID)
4004 			eunixtype = _IDMAP_T_USER;
4005 		else if (res->id.idtype == IDMAP_GID)
4006 			eunixtype = _IDMAP_T_GROUP;
4007 		else
4008 			eunixtype = _IDMAP_T_UNDEF;
4009 
4010 		if (req->id1.idmap_id_u.sid.prefix != NULL) {
4011 			/* AD lookup by sid */
4012 			retcode = ad_lookup_by_sid(
4013 			    state, req->id1.idmap_id_u.sid.prefix,
4014 			    req->id1.idmap_id_u.sid.rid, eunixtype,
4015 			    (req->id1name == NULL) ? &req->id1name : NULL,
4016 			    (req->id1domain == NULL) ? &req->id1domain : NULL,
4017 			    &type, (getunixattr && req->id2name == NULL)
4018 			    ? &req->id2name : NULL);
4019 		} else {
4020 			assert(req->id1name != NULL);
4021 			/* AD lookup by winname */
4022 			retcode = ad_lookup_by_winname(
4023 			    state, req->id1name, req->id1domain, eunixtype,
4024 			    &canonname, &req->id1.idmap_id_u.sid.prefix,
4025 			    &req->id1.idmap_id_u.sid.rid, &type,
4026 			    (getunixattr && req->id2name == NULL)
4027 			    ? &req->id2name : NULL);
4028 
4029 			if (canonname != NULL) {
4030 				free(req->id1name);
4031 				req->id1name = canonname;
4032 			}
4033 		}
4034 		if (retcode == IDMAP_SUCCESS) {
4035 			switch (type) {
4036 			case _IDMAP_T_USER:
4037 				if (res->id.idtype == IDMAP_POSIXID)
4038 					res->id.idtype = IDMAP_UID;
4039 				req->id1.idtype = IDMAP_USID;
4040 				break;
4041 			case _IDMAP_T_GROUP:
4042 				if (res->id.idtype == IDMAP_POSIXID)
4043 					res->id.idtype = IDMAP_GID;
4044 				req->id1.idtype = IDMAP_GSID;
4045 				break;
4046 			default:
4047 				return (IDMAP_ERR_SID);
4048 			}
4049 		}
4050 		return (retcode);
4051 	}
4052 
4053 	/*
4054 	 * unix2win lookup requests (get_u2w_mapping()) calls this
4055 	 * function to lookup AD by unixname and to retrieve
4056 	 * SID, winname, and sidtype (user or group) from AD.
4057 	 */
4058 
4059 	/* Set the expected unixtype */
4060 	eunixtype = (req->id1.idtype == IDMAP_UID) ? _IDMAP_T_USER :
4061 	    _IDMAP_T_GROUP;
4062 
4063 	if (byunixattr) {
4064 		/* AD lookup by unixname */
4065 		is_user = (IS_REQUEST_UID(*req)) ? 1 : 0;
4066 		if (res->id.idtype == IDMAP_USID)
4067 			is_wuser = 1;
4068 		else if (res->id.idtype == IDMAP_GSID)
4069 			is_wuser = 0;
4070 		else
4071 			is_wuser = is_user;
4072 		retcode = ad_lookup_by_unixname(
4073 		    state, req->id1name, is_user, is_wuser,
4074 		    (res->id.idmap_id_u.sid.prefix == NULL) ?
4075 		    &res->id.idmap_id_u.sid.prefix : NULL,
4076 		    (res->id.idmap_id_u.sid.prefix == NULL) ?
4077 		    &res->id.idmap_id_u.sid.rid : NULL,
4078 		    (req->id2name == NULL) ? &req->id2name : NULL,
4079 		    (req->id2domain == NULL) ? &req->id2domain : NULL, NULL);
4080 	} else if (res->id.idmap_id_u.sid.prefix != NULL) {
4081 		/* AD lookup by sid */
4082 		retcode = ad_lookup_by_sid(
4083 		    state, res->id.idmap_id_u.sid.prefix,
4084 		    res->id.idmap_id_u.sid.rid, eunixtype,
4085 		    (req->id2name == NULL) ? &req->id2name : NULL,
4086 		    (req->id2domain == NULL) ? &req->id2domain : NULL,
4087 		    NULL, (getunixattr && req->id1name == NULL)
4088 		    ? &req->id1name : NULL);
4089 	} else {
4090 		/* AD lookup by winname */
4091 		assert(req->id2name != NULL);
4092 		retcode = ad_lookup_by_winname(
4093 		    state, req->id2name, req->id2domain, eunixtype,
4094 		    &canonname, &res->id.idmap_id_u.sid.prefix,
4095 		    &res->id.idmap_id_u.sid.rid, NULL,
4096 		    (getunixattr && req->id1name == NULL)
4097 		    ? &req->id1name : NULL);
4098 
4099 		if (canonname != NULL) {
4100 			free(req->id2name);
4101 			req->id2name = canonname;
4102 		}
4103 	}
4104 
4105 	if (retcode == IDMAP_SUCCESS) {
4106 		switch (type) {
4107 		case _IDMAP_T_USER:
4108 			if (res->id.idtype == IDMAP_SID)
4109 				res->id.idtype = IDMAP_USID;
4110 			break;
4111 		case _IDMAP_T_GROUP:
4112 			if (res->id.idtype == IDMAP_SID)
4113 				res->id.idtype = IDMAP_GSID;
4114 			break;
4115 		default:
4116 			return (IDMAP_ERR_SID);
4117 		}
4118 	}
4119 	return (retcode);
4120 }
4121