xref: /titanic_44/usr/src/cmd/idmap/idmapd/server.c (revision 651c0131ccc65381cbda174bee44a4fd7a518d6b)
1c5c4113dSnw141292 /*
2c5c4113dSnw141292  * CDDL HEADER START
3c5c4113dSnw141292  *
4c5c4113dSnw141292  * The contents of this file are subject to the terms of the
5c5c4113dSnw141292  * Common Development and Distribution License (the "License").
6c5c4113dSnw141292  * You may not use this file except in compliance with the License.
7c5c4113dSnw141292  *
8c5c4113dSnw141292  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9c5c4113dSnw141292  * or http://www.opensolaris.org/os/licensing.
10c5c4113dSnw141292  * See the License for the specific language governing permissions
11c5c4113dSnw141292  * and limitations under the License.
12c5c4113dSnw141292  *
13c5c4113dSnw141292  * When distributing Covered Code, include this CDDL HEADER in each
14c5c4113dSnw141292  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15c5c4113dSnw141292  * If applicable, add the following below this CDDL HEADER, with the
16c5c4113dSnw141292  * fields enclosed by brackets "[]" replaced with your own identifying
17c5c4113dSnw141292  * information: Portions Copyright [yyyy] [name of copyright owner]
18c5c4113dSnw141292  *
19c5c4113dSnw141292  * CDDL HEADER END
20c5c4113dSnw141292  */
21c5c4113dSnw141292 /*
22c5c4113dSnw141292  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23c5c4113dSnw141292  * Use is subject to license terms.
24c5c4113dSnw141292  */
25c5c4113dSnw141292 
26c5c4113dSnw141292 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27c5c4113dSnw141292 
28c5c4113dSnw141292 /*
29c5c4113dSnw141292  * Service routines
30c5c4113dSnw141292  */
31c5c4113dSnw141292 
32c5c4113dSnw141292 #include "idmapd.h"
33c5c4113dSnw141292 #include "idmap_priv.h"
34c5c4113dSnw141292 #include <signal.h>
35c5c4113dSnw141292 #include <thread.h>
36c5c4113dSnw141292 #include <string.h>
37c5c4113dSnw141292 #include <strings.h>
38c5c4113dSnw141292 #include <errno.h>
39c5c4113dSnw141292 #include <assert.h>
40c5c4113dSnw141292 #include <sys/types.h>
41c5c4113dSnw141292 #include <sys/stat.h>
42c5c4113dSnw141292 #include <ucred.h>
43c5c4113dSnw141292 #include <pwd.h>
44c5c4113dSnw141292 #include <auth_attr.h>
45c5c4113dSnw141292 #include <secdb.h>
46c5c4113dSnw141292 
47c5c4113dSnw141292 #define	_VALIDATE_LIST_CB_DATA(col, val, siz)\
48c5c4113dSnw141292 	retcode = validate_list_cb_data(cb_data, argc, argv, col,\
49c5c4113dSnw141292 			(uchar_t **)val, siz);\
50c5c4113dSnw141292 	if (retcode == IDMAP_NEXT) {\
51c5c4113dSnw141292 		result->retcode = IDMAP_NEXT;\
52c5c4113dSnw141292 		return (0);\
53c5c4113dSnw141292 	} else if (retcode < 0) {\
54c5c4113dSnw141292 		result->retcode = retcode;\
55c5c4113dSnw141292 		return (1);\
56c5c4113dSnw141292 	}
57c5c4113dSnw141292 
58c5c4113dSnw141292 #define	PROCESS_LIST_SVC_SQL(rcode, db, sql, limit, cb, res, len)\
59c5c4113dSnw141292 	rcode = process_list_svc_sql(db, sql, limit, cb, res);\
60c5c4113dSnw141292 	if (rcode == IDMAP_ERR_BUSY)\
61c5c4113dSnw141292 		res->retcode = IDMAP_ERR_BUSY;\
62c5c4113dSnw141292 	else if (rcode == IDMAP_SUCCESS && len == 0)\
63c5c4113dSnw141292 		res->retcode = IDMAP_ERR_NOTFOUND;
64c5c4113dSnw141292 
65c5c4113dSnw141292 
66c5c4113dSnw141292 /* ARGSUSED */
67c5c4113dSnw141292 bool_t
68c5c4113dSnw141292 idmap_null_1_svc(void *result, struct svc_req *rqstp) {
69c5c4113dSnw141292 	return (TRUE);
70c5c4113dSnw141292 }
71c5c4113dSnw141292 
72c5c4113dSnw141292 #define	IS_BATCH_SID(batch, i)\
73c5c4113dSnw141292 	batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_SID
74c5c4113dSnw141292 
75c5c4113dSnw141292 #define	IS_BATCH_UID(batch, i)\
76c5c4113dSnw141292 	batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_UID
77c5c4113dSnw141292 
78c5c4113dSnw141292 #define	IS_BATCH_GID(batch, i)\
79c5c4113dSnw141292 	batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GID
80c5c4113dSnw141292 
81c5c4113dSnw141292 #define	IS_REQUEST_SID(request)\
82c5c4113dSnw141292 	request.id1.idtype == IDMAP_SID
83c5c4113dSnw141292 
84c5c4113dSnw141292 #define	IS_REQUEST_UID(request)\
85c5c4113dSnw141292 	request.id1.idtype == IDMAP_UID
86c5c4113dSnw141292 
87c5c4113dSnw141292 #define	IS_REQUEST_GID(request)\
88c5c4113dSnw141292 	request.id1.idtype == IDMAP_GID
89c5c4113dSnw141292 
90c5c4113dSnw141292 /* ARGSUSED */
91c5c4113dSnw141292 bool_t
92c5c4113dSnw141292 idmap_get_mapped_ids_1_svc(idmap_mapping_batch batch,
93c5c4113dSnw141292 		idmap_ids_res *result, struct svc_req *rqstp) {
94c5c4113dSnw141292 	sqlite		*cache = NULL, *db = NULL;
95c5c4113dSnw141292 	lookup_state_t	state;
96c5c4113dSnw141292 	idmap_retcode	retcode, winrc;
97c5c4113dSnw141292 	int		i;
98c5c4113dSnw141292 
99c5c4113dSnw141292 	/* Init */
100c5c4113dSnw141292 	(void) memset(result, 0, sizeof (*result));
101c5c4113dSnw141292 	(void) memset(&state, 0, sizeof (state));
102c5c4113dSnw141292 
103c5c4113dSnw141292 	/* Return success if nothing was requested */
104c5c4113dSnw141292 	if (batch.idmap_mapping_batch_len < 1)
105c5c4113dSnw141292 		goto out;
106c5c4113dSnw141292 
107c5c4113dSnw141292 	/* Get cache handle */
108c5c4113dSnw141292 	result->retcode = get_cache_handle(&cache);
109c5c4113dSnw141292 	if (result->retcode != IDMAP_SUCCESS)
110c5c4113dSnw141292 		goto out;
111c5c4113dSnw141292 
112c5c4113dSnw141292 	/* Get db handle */
113c5c4113dSnw141292 	result->retcode = get_db_handle(&db);
114c5c4113dSnw141292 	if (result->retcode != IDMAP_SUCCESS)
115c5c4113dSnw141292 		goto out;
116c5c4113dSnw141292 
117c5c4113dSnw141292 	/* Allocate result array */
118c5c4113dSnw141292 	result->ids.ids_val = calloc(batch.idmap_mapping_batch_len,
119c5c4113dSnw141292 			sizeof (idmap_id_res));
120c5c4113dSnw141292 	if (result->ids.ids_val == NULL) {
121c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
122c5c4113dSnw141292 		result->retcode = IDMAP_ERR_MEMORY;
123c5c4113dSnw141292 		goto out;
124c5c4113dSnw141292 	}
125c5c4113dSnw141292 	result->ids.ids_len = batch.idmap_mapping_batch_len;
126c5c4113dSnw141292 
127c5c4113dSnw141292 	/* Init our 'done' flags */
128c5c4113dSnw141292 	state.sid2pid_done = state.pid2sid_done = TRUE;
129c5c4113dSnw141292 
130c5c4113dSnw141292 	/* First stage */
131c5c4113dSnw141292 	for (i = 0; i < batch.idmap_mapping_batch_len; i++) {
132c5c4113dSnw141292 		if (IS_BATCH_SID(batch, i)) {
133c5c4113dSnw141292 			retcode = sid2pid_first_pass(
134c5c4113dSnw141292 				&state,
135c5c4113dSnw141292 				cache,
136c5c4113dSnw141292 				&batch.idmap_mapping_batch_val[i],
137c5c4113dSnw141292 				&result->ids.ids_val[i]);
138c5c4113dSnw141292 		} else if (IS_BATCH_UID(batch, i)) {
139c5c4113dSnw141292 			retcode = pid2sid_first_pass(
140c5c4113dSnw141292 				&state,
141c5c4113dSnw141292 				cache,
142c5c4113dSnw141292 				db,
143c5c4113dSnw141292 				&batch.idmap_mapping_batch_val[i],
144c5c4113dSnw141292 				&result->ids.ids_val[i], 1, 0);
145c5c4113dSnw141292 		} else if (IS_BATCH_GID(batch, i)) {
146c5c4113dSnw141292 			retcode = pid2sid_first_pass(
147c5c4113dSnw141292 				&state,
148c5c4113dSnw141292 				cache,
149c5c4113dSnw141292 				db,
150c5c4113dSnw141292 				&batch.idmap_mapping_batch_val[i],
151c5c4113dSnw141292 				&result->ids.ids_val[i], 0, 0);
152c5c4113dSnw141292 		} else {
153c5c4113dSnw141292 			result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE;
154c5c4113dSnw141292 			continue;
155c5c4113dSnw141292 		}
156c5c4113dSnw141292 		if (IDMAP_FATAL_ERROR(retcode)) {
157c5c4113dSnw141292 			result->retcode = retcode;
158c5c4113dSnw141292 			goto out;
159c5c4113dSnw141292 		}
160c5c4113dSnw141292 	}
161c5c4113dSnw141292 
162c5c4113dSnw141292 	/* Check if we are done */
163c5c4113dSnw141292 	if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE)
164c5c4113dSnw141292 		goto out;
165c5c4113dSnw141292 
166c5c4113dSnw141292 	/* Process Windows server lookups for sid2name */
167c5c4113dSnw141292 	if (state.ad_nqueries) {
168c5c4113dSnw141292 		winrc = lookup_win_batch_sid2name(&state, &batch,
169c5c4113dSnw141292 				result);
170c5c4113dSnw141292 		if (IDMAP_FATAL_ERROR(winrc)) {
171c5c4113dSnw141292 			result->retcode = winrc;
172c5c4113dSnw141292 			goto out;
173c5c4113dSnw141292 		}
174c5c4113dSnw141292 	} else
175c5c4113dSnw141292 		winrc = IDMAP_SUCCESS;
176c5c4113dSnw141292 
177c5c4113dSnw141292 	/* Reset sid2pid 'done' flag */
178c5c4113dSnw141292 	state.sid2pid_done = TRUE;
179c5c4113dSnw141292 
180c5c4113dSnw141292 	/* Second stage */
181c5c4113dSnw141292 	for (i = 0; i < batch.idmap_mapping_batch_len; i++) {
182c5c4113dSnw141292 		/* Process sid to pid ONLY */
183c5c4113dSnw141292 		if (IS_BATCH_SID(batch, i)) {
184c5c4113dSnw141292 			if (IDMAP_ERROR(winrc))
185c5c4113dSnw141292 				result->ids.ids_val[i].retcode = winrc;
186c5c4113dSnw141292 			retcode = sid2pid_second_pass(
187c5c4113dSnw141292 				&state,
188c5c4113dSnw141292 				cache,
189c5c4113dSnw141292 				db,
190c5c4113dSnw141292 				&batch.idmap_mapping_batch_val[i],
191c5c4113dSnw141292 				&result->ids.ids_val[i]);
192c5c4113dSnw141292 			if (IDMAP_FATAL_ERROR(retcode)) {
193c5c4113dSnw141292 				result->retcode = retcode;
194c5c4113dSnw141292 				goto out;
195c5c4113dSnw141292 			}
196c5c4113dSnw141292 		}
197c5c4113dSnw141292 	}
198c5c4113dSnw141292 
199c5c4113dSnw141292 	/* Check if we are done */
200c5c4113dSnw141292 	if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE)
201c5c4113dSnw141292 		goto out;
202c5c4113dSnw141292 
203c5c4113dSnw141292 	/* Reset our 'done' flags */
204c5c4113dSnw141292 	state.sid2pid_done = state.pid2sid_done = TRUE;
205c5c4113dSnw141292 
206c5c4113dSnw141292 	/* Update cache in a single transaction */
207c5c4113dSnw141292 	if (sql_exec_no_cb(cache, "BEGIN TRANSACTION;") != IDMAP_SUCCESS)
208c5c4113dSnw141292 		goto out;
209c5c4113dSnw141292 
210c5c4113dSnw141292 	for (i = 0; i < batch.idmap_mapping_batch_len; i++) {
211c5c4113dSnw141292 		if (IS_BATCH_SID(batch, i)) {
212c5c4113dSnw141292 			(void) update_cache_sid2pid(
213c5c4113dSnw141292 				&state,
214c5c4113dSnw141292 				cache,
215c5c4113dSnw141292 				&batch.idmap_mapping_batch_val[i],
216c5c4113dSnw141292 				&result->ids.ids_val[i]);
217c5c4113dSnw141292 		} else if ((IS_BATCH_UID(batch, i)) ||
218c5c4113dSnw141292 				(IS_BATCH_GID(batch, i))) {
219c5c4113dSnw141292 			(void) update_cache_pid2sid(
220c5c4113dSnw141292 				&state,
221c5c4113dSnw141292 				cache,
222c5c4113dSnw141292 				&batch.idmap_mapping_batch_val[i],
223c5c4113dSnw141292 				&result->ids.ids_val[i]);
224c5c4113dSnw141292 		}
225c5c4113dSnw141292 	}
226c5c4113dSnw141292 
227c5c4113dSnw141292 	/* Commit if we have atleast one successful update */
228c5c4113dSnw141292 	if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE)
229c5c4113dSnw141292 		(void) sql_exec_no_cb(cache, "COMMIT TRANSACTION;");
230c5c4113dSnw141292 	else
231c5c4113dSnw141292 		(void) sql_exec_no_cb(cache, "END TRANSACTION;");
232c5c4113dSnw141292 
233c5c4113dSnw141292 out:
234c5c4113dSnw141292 	if (IDMAP_ERROR(result->retcode)) {
235c5c4113dSnw141292 		xdr_free(xdr_idmap_ids_res, (caddr_t)result);
236c5c4113dSnw141292 		result->ids.ids_len = 0;
237c5c4113dSnw141292 		result->ids.ids_val = NULL;
238c5c4113dSnw141292 	}
239c5c4113dSnw141292 	if (cache)
240c5c4113dSnw141292 		(void) sqlite_close(cache);
241c5c4113dSnw141292 	if (db)
242c5c4113dSnw141292 		(void) sqlite_close(db);
243c5c4113dSnw141292 	result->retcode = idmap_stat4prot(result->retcode);
244c5c4113dSnw141292 	return (TRUE);
245c5c4113dSnw141292 }
246c5c4113dSnw141292 
247c5c4113dSnw141292 
248c5c4113dSnw141292 /* ARGSUSED */
249c5c4113dSnw141292 static int
250c5c4113dSnw141292 list_mappings_cb(void *parg, int argc, char **argv, char **colnames) {
251c5c4113dSnw141292 	list_cb_data_t		*cb_data;
252c5c4113dSnw141292 	char			*str;
253c5c4113dSnw141292 	idmap_mappings_res	*result;
254c5c4113dSnw141292 	idmap_utf8str		*ptr;
255c5c4113dSnw141292 	idmap_retcode		retcode;
256c5c4113dSnw141292 	int			w2u, u2w;
257c5c4113dSnw141292 	char			*end;
258c5c4113dSnw141292 
259c5c4113dSnw141292 	cb_data = (list_cb_data_t *)parg;
260c5c4113dSnw141292 	result = (idmap_mappings_res *)cb_data->result;
261c5c4113dSnw141292 
262c5c4113dSnw141292 	_VALIDATE_LIST_CB_DATA(9, &result->mappings.mappings_val,
263c5c4113dSnw141292 		sizeof (idmap_mapping));
264c5c4113dSnw141292 
265c5c4113dSnw141292 	result->mappings.mappings_len++;
266c5c4113dSnw141292 
267c5c4113dSnw141292 	if ((str = strdup(argv[1])) == NULL)
268c5c4113dSnw141292 		return (1);
269c5c4113dSnw141292 	result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix =
270c5c4113dSnw141292 		str;
271c5c4113dSnw141292 	result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid =
272c5c4113dSnw141292 		strtoul(argv[2], &end, 10);
273c5c4113dSnw141292 	result->mappings.mappings_val[cb_data->next].id1.idtype = IDMAP_SID;
274c5c4113dSnw141292 
275c5c4113dSnw141292 	result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid =
276c5c4113dSnw141292 		strtoul(argv[3], &end, 10);
277c5c4113dSnw141292 	result->mappings.mappings_val[cb_data->next].id2.idtype = IDMAP_UID;
278c5c4113dSnw141292 
279c5c4113dSnw141292 	w2u = argv[4]?strtol(argv[4], &end, 10):0;
280c5c4113dSnw141292 	u2w = argv[5]?strtol(argv[5], &end, 10):0;
281c5c4113dSnw141292 
282c5c4113dSnw141292 	if (w2u > 0 && u2w == 0)
283*651c0131Sbaban 		result->mappings.mappings_val[cb_data->next].direction =
284*651c0131Sbaban 		    IDMAP_DIRECTION_W2U;
285c5c4113dSnw141292 	else if (w2u == 0 && u2w > 0)
286*651c0131Sbaban 		result->mappings.mappings_val[cb_data->next].direction =
287*651c0131Sbaban 		    IDMAP_DIRECTION_U2W;
288c5c4113dSnw141292 	else
289*651c0131Sbaban 		result->mappings.mappings_val[cb_data->next].direction =
290*651c0131Sbaban 		    IDMAP_DIRECTION_BI;
291c5c4113dSnw141292 
292c5c4113dSnw141292 	ptr = &result->mappings.mappings_val[cb_data->next].id1domain;
293c5c4113dSnw141292 	if (idmap_str2utf8(&ptr, argv[6], 0) != IDMAP_SUCCESS)
294c5c4113dSnw141292 		return (1);
295c5c4113dSnw141292 
296c5c4113dSnw141292 	ptr = &result->mappings.mappings_val[cb_data->next].id1name;
297c5c4113dSnw141292 	if (idmap_str2utf8(&ptr, argv[7], 0) != IDMAP_SUCCESS)
298c5c4113dSnw141292 		return (1);
299c5c4113dSnw141292 
300c5c4113dSnw141292 	ptr = &result->mappings.mappings_val[cb_data->next].id2name;
301c5c4113dSnw141292 	if (idmap_str2utf8(&ptr, argv[8], 0) != IDMAP_SUCCESS)
302c5c4113dSnw141292 		return (1);
303c5c4113dSnw141292 
304c5c4113dSnw141292 	result->lastrowid = strtoll(argv[0], &end, 10);
305c5c4113dSnw141292 	cb_data->next++;
306c5c4113dSnw141292 	result->retcode = IDMAP_SUCCESS;
307c5c4113dSnw141292 	return (0);
308c5c4113dSnw141292 }
309c5c4113dSnw141292 
310c5c4113dSnw141292 
311c5c4113dSnw141292 /* ARGSUSED */
312c5c4113dSnw141292 bool_t
313c5c4113dSnw141292 idmap_list_mappings_1_svc(bool_t is_user, int64_t lastrowid,
314c5c4113dSnw141292 		uint64_t limit, idmap_mappings_res *result,
315c5c4113dSnw141292 		struct svc_req *rqstp) {
316c5c4113dSnw141292 	sqlite		*cache = NULL;
317c5c4113dSnw141292 	char		lbuf[30], rbuf[30];
318c5c4113dSnw141292 	uint64_t	maxlimit;
319c5c4113dSnw141292 	idmap_retcode	retcode;
320c5c4113dSnw141292 	char		*sql = NULL;
321c5c4113dSnw141292 
322c5c4113dSnw141292 	(void) memset(result, 0, sizeof (*result));
323c5c4113dSnw141292 	lbuf[0] = rbuf[0] = 0;
324c5c4113dSnw141292 
325c5c4113dSnw141292 	RDLOCK_CONFIG();
326c5c4113dSnw141292 	maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit;
327c5c4113dSnw141292 	UNLOCK_CONFIG();
328c5c4113dSnw141292 
329c5c4113dSnw141292 	/* Get cache handle */
330c5c4113dSnw141292 	result->retcode = get_cache_handle(&cache);
331c5c4113dSnw141292 	if (result->retcode != IDMAP_SUCCESS)
332c5c4113dSnw141292 		goto out;
333c5c4113dSnw141292 
334c5c4113dSnw141292 	result->retcode = IDMAP_ERR_INTERNAL;
335c5c4113dSnw141292 
336c5c4113dSnw141292 	/* Create LIMIT expression. */
337c5c4113dSnw141292 	if (limit == 0 || (maxlimit > 0 && maxlimit < limit))
338c5c4113dSnw141292 		limit = maxlimit;
339c5c4113dSnw141292 	if (limit > 0)
340c5c4113dSnw141292 		(void) snprintf(lbuf, sizeof (lbuf),
341c5c4113dSnw141292 			"LIMIT %" PRIu64, limit + 1ULL);
342c5c4113dSnw141292 
343c5c4113dSnw141292 	(void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid);
344c5c4113dSnw141292 
345c5c4113dSnw141292 	/*
346c5c4113dSnw141292 	 * Combine all the above into a giant SELECT statement that
347c5c4113dSnw141292 	 * will return the requested mappings
348c5c4113dSnw141292 	 */
349c5c4113dSnw141292 	sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, u2w,"
350c5c4113dSnw141292 			" windomain, winname, unixname"
351c5c4113dSnw141292 			" FROM idmap_cache WHERE "
352c5c4113dSnw141292 			" %s AND is_user = %d %s;",
353c5c4113dSnw141292 			rbuf, is_user?1:0, lbuf);
354c5c4113dSnw141292 	if (sql == NULL) {
355c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
356c5c4113dSnw141292 		goto out;
357c5c4113dSnw141292 	}
358c5c4113dSnw141292 
359c5c4113dSnw141292 	/* Execute the SQL statement and update the return buffer */
360c5c4113dSnw141292 	PROCESS_LIST_SVC_SQL(retcode, cache, sql, limit, list_mappings_cb,
361c5c4113dSnw141292 		result, result->mappings.mappings_len);
362c5c4113dSnw141292 
363c5c4113dSnw141292 out:
364c5c4113dSnw141292 	if (sql)
365c5c4113dSnw141292 		sqlite_freemem(sql);
366c5c4113dSnw141292 	if (IDMAP_ERROR(result->retcode))
367c5c4113dSnw141292 		(void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result);
368c5c4113dSnw141292 	if (cache)
369c5c4113dSnw141292 		(void) sqlite_close(cache);
370c5c4113dSnw141292 	result->retcode = idmap_stat4prot(result->retcode);
371c5c4113dSnw141292 	return (TRUE);
372c5c4113dSnw141292 }
373c5c4113dSnw141292 
374c5c4113dSnw141292 
375c5c4113dSnw141292 /* ARGSUSED */
376c5c4113dSnw141292 static int
377c5c4113dSnw141292 list_namerules_cb(void *parg, int argc, char **argv, char **colnames) {
378c5c4113dSnw141292 	list_cb_data_t		*cb_data;
379c5c4113dSnw141292 	idmap_namerules_res	*result;
380c5c4113dSnw141292 	idmap_retcode		retcode;
381c5c4113dSnw141292 	idmap_utf8str		*ptr;
382c5c4113dSnw141292 	int			w2u_order, u2w_order;
383c5c4113dSnw141292 	char			*end;
384c5c4113dSnw141292 
385c5c4113dSnw141292 	cb_data = (list_cb_data_t *)parg;
386c5c4113dSnw141292 	result = (idmap_namerules_res *)cb_data->result;
387c5c4113dSnw141292 
388c5c4113dSnw141292 	_VALIDATE_LIST_CB_DATA(8, &result->rules.rules_val,
389c5c4113dSnw141292 		sizeof (idmap_namerule));
390c5c4113dSnw141292 
391c5c4113dSnw141292 	result->rules.rules_len++;
392c5c4113dSnw141292 
393c5c4113dSnw141292 	result->rules.rules_val[cb_data->next].is_user =
394c5c4113dSnw141292 		strtol(argv[1], &end, 10);
395c5c4113dSnw141292 
396c5c4113dSnw141292 	ptr = &result->rules.rules_val[cb_data->next].windomain;
397c5c4113dSnw141292 	if (idmap_str2utf8(&ptr, argv[2], 0) != IDMAP_SUCCESS)
398c5c4113dSnw141292 		return (1);
399c5c4113dSnw141292 
400c5c4113dSnw141292 	ptr = &result->rules.rules_val[cb_data->next].winname;
401c5c4113dSnw141292 	if (idmap_str2utf8(&ptr, argv[3], 0) != IDMAP_SUCCESS)
402c5c4113dSnw141292 		return (1);
403c5c4113dSnw141292 
404c5c4113dSnw141292 	result->rules.rules_val[cb_data->next].is_nt4 =
405c5c4113dSnw141292 		strtol(argv[4], &end, 10);
406c5c4113dSnw141292 
407c5c4113dSnw141292 	ptr = &result->rules.rules_val[cb_data->next].unixname;
408c5c4113dSnw141292 	if (idmap_str2utf8(&ptr, argv[5], 0) != IDMAP_SUCCESS)
409c5c4113dSnw141292 		return (1);
410c5c4113dSnw141292 
411c5c4113dSnw141292 	w2u_order = argv[6]?strtol(argv[6], &end, 10):0;
412c5c4113dSnw141292 	u2w_order = argv[7]?strtol(argv[7], &end, 10):0;
413c5c4113dSnw141292 
414c5c4113dSnw141292 	if (w2u_order > 0 && u2w_order == 0)
415*651c0131Sbaban 		result->rules.rules_val[cb_data->next].direction =
416*651c0131Sbaban 		    IDMAP_DIRECTION_W2U;
417c5c4113dSnw141292 	else if (w2u_order == 0 && u2w_order > 0)
418*651c0131Sbaban 		result->rules.rules_val[cb_data->next].direction =
419*651c0131Sbaban 		    IDMAP_DIRECTION_U2W;
420c5c4113dSnw141292 	else
421*651c0131Sbaban 		result->rules.rules_val[cb_data->next].direction =
422*651c0131Sbaban 		    IDMAP_DIRECTION_BI;
423c5c4113dSnw141292 
424c5c4113dSnw141292 	result->lastrowid = strtoll(argv[0], &end, 10);
425c5c4113dSnw141292 	cb_data->next++;
426c5c4113dSnw141292 	result->retcode = IDMAP_SUCCESS;
427c5c4113dSnw141292 	return (0);
428c5c4113dSnw141292 }
429c5c4113dSnw141292 
430c5c4113dSnw141292 
431c5c4113dSnw141292 /* ARGSUSED */
432c5c4113dSnw141292 bool_t
433c5c4113dSnw141292 idmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid,
434c5c4113dSnw141292 		uint64_t limit, idmap_namerules_res *result,
435c5c4113dSnw141292 		struct svc_req *rqstp) {
436c5c4113dSnw141292 
437c5c4113dSnw141292 	sqlite		*db = NULL;
438c5c4113dSnw141292 	char		w2ubuf[15], u2wbuf[15];
439c5c4113dSnw141292 	char		lbuf[30], rbuf[30];
440c5c4113dSnw141292 	char		*sql = NULL;
441c5c4113dSnw141292 	char		*s_windomain = NULL, *s_winname = NULL;
442c5c4113dSnw141292 	char		*s_unixname = NULL;
443c5c4113dSnw141292 	uint64_t	maxlimit;
444c5c4113dSnw141292 	idmap_retcode	retcode;
445c5c4113dSnw141292 
446c5c4113dSnw141292 	(void) memset(result, 0, sizeof (*result));
447c5c4113dSnw141292 	lbuf[0] = rbuf[0] = 0;
448c5c4113dSnw141292 
449c5c4113dSnw141292 	RDLOCK_CONFIG();
450c5c4113dSnw141292 	maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit;
451c5c4113dSnw141292 	UNLOCK_CONFIG();
452c5c4113dSnw141292 
453c5c4113dSnw141292 	/* Get db handle */
454c5c4113dSnw141292 	result->retcode = get_db_handle(&db);
455c5c4113dSnw141292 	if (result->retcode != IDMAP_SUCCESS)
456c5c4113dSnw141292 		goto out;
457c5c4113dSnw141292 
458c5c4113dSnw141292 	result->retcode = IDMAP_ERR_INTERNAL;
459c5c4113dSnw141292 
460c5c4113dSnw141292 	if (rule.direction < 0) {
461c5c4113dSnw141292 		w2ubuf[0] = u2wbuf[0] = 0;
462*651c0131Sbaban 	} else if (rule.direction == IDMAP_DIRECTION_BI) {
463c5c4113dSnw141292 		(void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0");
464c5c4113dSnw141292 		(void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0");
465*651c0131Sbaban 	} else if (rule.direction == IDMAP_DIRECTION_W2U) {
466c5c4113dSnw141292 		(void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0");
467c5c4113dSnw141292 		(void) snprintf(u2wbuf, sizeof (u2wbuf),
468c5c4113dSnw141292 				"AND (u2w_order = 0 OR u2w_order ISNULL)");
469*651c0131Sbaban 	} else if (rule.direction == IDMAP_DIRECTION_U2W) {
470c5c4113dSnw141292 		(void) snprintf(w2ubuf, sizeof (w2ubuf),
471c5c4113dSnw141292 				"AND (w2u_order = 0 OR w2u_order ISNULL)");
472c5c4113dSnw141292 		(void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0");
473c5c4113dSnw141292 	}
474c5c4113dSnw141292 
475c5c4113dSnw141292 	/* Create where statement for windomain */
476c5c4113dSnw141292 	if (rule.windomain.idmap_utf8str_len > 0) {
477c5c4113dSnw141292 		if (gen_sql_expr_from_utf8str("AND", "windomain", "=",
478c5c4113dSnw141292 				&rule.windomain,
479c5c4113dSnw141292 				"", &s_windomain) != IDMAP_SUCCESS)
480c5c4113dSnw141292 			goto out;
481c5c4113dSnw141292 	}
482c5c4113dSnw141292 
483c5c4113dSnw141292 	/* Create where statement for winname */
484c5c4113dSnw141292 	if (rule.winname.idmap_utf8str_len > 0) {
485c5c4113dSnw141292 		if (gen_sql_expr_from_utf8str("AND", "winname", "=",
486c5c4113dSnw141292 				&rule.winname,
487c5c4113dSnw141292 				"", &s_winname) != IDMAP_SUCCESS)
488c5c4113dSnw141292 			goto out;
489c5c4113dSnw141292 	}
490c5c4113dSnw141292 
491c5c4113dSnw141292 	/* Create where statement for unixname */
492c5c4113dSnw141292 	if (rule.unixname.idmap_utf8str_len > 0) {
493c5c4113dSnw141292 		if (gen_sql_expr_from_utf8str("AND", "unixname", "=",
494c5c4113dSnw141292 				&rule.unixname,
495c5c4113dSnw141292 				"", &s_unixname) != IDMAP_SUCCESS)
496c5c4113dSnw141292 			goto out;
497c5c4113dSnw141292 	}
498c5c4113dSnw141292 
499c5c4113dSnw141292 	/* Create LIMIT expression. */
500c5c4113dSnw141292 	if (limit == 0 || (maxlimit > 0 && maxlimit < limit))
501c5c4113dSnw141292 		limit = maxlimit;
502c5c4113dSnw141292 	if (limit > 0)
503c5c4113dSnw141292 		(void) snprintf(lbuf, sizeof (lbuf),
504c5c4113dSnw141292 			"LIMIT %" PRIu64, limit + 1ULL);
505c5c4113dSnw141292 
506c5c4113dSnw141292 	(void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid);
507c5c4113dSnw141292 
508c5c4113dSnw141292 	/*
509c5c4113dSnw141292 	 * Combine all the above into a giant SELECT statement that
510c5c4113dSnw141292 	 * will return the requested rules
511c5c4113dSnw141292 	 */
512c5c4113dSnw141292 	sql = sqlite_mprintf("SELECT rowid, is_user, windomain, winname, "
513c5c4113dSnw141292 			"is_nt4, unixname, w2u_order, u2w_order "
514c5c4113dSnw141292 			"FROM namerules WHERE "
515c5c4113dSnw141292 			" %s AND is_user = %d %s %s %s %s %s %s;",
516c5c4113dSnw141292 			rbuf, rule.is_user?1:0,
517c5c4113dSnw141292 			s_windomain?s_windomain:"",
518c5c4113dSnw141292 			s_winname?s_winname:"",
519c5c4113dSnw141292 			s_unixname?s_unixname:"",
520c5c4113dSnw141292 			w2ubuf, u2wbuf, lbuf);
521c5c4113dSnw141292 	if (sql == NULL) {
522c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
523c5c4113dSnw141292 		goto out;
524c5c4113dSnw141292 	}
525c5c4113dSnw141292 
526c5c4113dSnw141292 	/* Execute the SQL statement and update the return buffer */
527c5c4113dSnw141292 	PROCESS_LIST_SVC_SQL(retcode, db, sql, limit, list_namerules_cb,
528c5c4113dSnw141292 		result, result->rules.rules_len);
529c5c4113dSnw141292 
530c5c4113dSnw141292 out:
531c5c4113dSnw141292 	if (s_windomain)
532c5c4113dSnw141292 		sqlite_freemem(s_windomain);
533c5c4113dSnw141292 	if (s_winname)
534c5c4113dSnw141292 		sqlite_freemem(s_winname);
535c5c4113dSnw141292 	if (s_unixname)
536c5c4113dSnw141292 		sqlite_freemem(s_unixname);
537c5c4113dSnw141292 	if (sql)
538c5c4113dSnw141292 		sqlite_freemem(sql);
539c5c4113dSnw141292 	if (IDMAP_ERROR(result->retcode))
540c5c4113dSnw141292 		(void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result);
541c5c4113dSnw141292 	if (db)
542c5c4113dSnw141292 		(void) sqlite_close(db);
543c5c4113dSnw141292 	result->retcode = idmap_stat4prot(result->retcode);
544c5c4113dSnw141292 	return (TRUE);
545c5c4113dSnw141292 }
546c5c4113dSnw141292 
547c5c4113dSnw141292 #define	IDMAP_RULES_AUTH	"solaris.admin.idmap.rules"
548c5c4113dSnw141292 static int
549c5c4113dSnw141292 verify_rules_auth(struct svc_req *rqstp) {
550c5c4113dSnw141292 	ucred_t		*uc = NULL;
551c5c4113dSnw141292 	uid_t		uid;
552c5c4113dSnw141292 	char		buf[1024];
553c5c4113dSnw141292 	struct passwd	pwd;
554c5c4113dSnw141292 	const char	*me = "verify_rules_auth";
555c5c4113dSnw141292 
556c5c4113dSnw141292 	if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) {
557c5c4113dSnw141292 		idmapdlog(LOG_ERR,
558c5c4113dSnw141292 			"%s: svc_getcallerucred failed (errno=%d)",
559c5c4113dSnw141292 			me, errno);
560c5c4113dSnw141292 		return (-1);
561c5c4113dSnw141292 	}
562c5c4113dSnw141292 
563c5c4113dSnw141292 	uid = ucred_geteuid(uc);
564c5c4113dSnw141292 	if (uid == (uid_t)-1) {
565c5c4113dSnw141292 		idmapdlog(LOG_ERR,
566c5c4113dSnw141292 			"%s: ucred_geteuid failed (errno=%d)",
567c5c4113dSnw141292 			me, errno);
568c5c4113dSnw141292 		ucred_free(uc);
569c5c4113dSnw141292 		return (-1);
570c5c4113dSnw141292 	}
571c5c4113dSnw141292 
572c5c4113dSnw141292 	if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) {
573c5c4113dSnw141292 		idmapdlog(LOG_ERR,
574c5c4113dSnw141292 			"%s: getpwuid_r(%u) failed (errno=%d)",
575c5c4113dSnw141292 			me, uid, errno);
576c5c4113dSnw141292 		ucred_free(uc);
577c5c4113dSnw141292 		return (-1);
578c5c4113dSnw141292 	}
579c5c4113dSnw141292 
580c5c4113dSnw141292 	if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) {
581c5c4113dSnw141292 		idmapdlog(LOG_INFO,
582c5c4113dSnw141292 			"%s: %s does not have authorization.",
583c5c4113dSnw141292 			me, pwd.pw_name);
584c5c4113dSnw141292 		ucred_free(uc);
585c5c4113dSnw141292 		return (-1);
586c5c4113dSnw141292 	}
587c5c4113dSnw141292 
588c5c4113dSnw141292 	ucred_free(uc);
589c5c4113dSnw141292 	return (1);
590c5c4113dSnw141292 }
591c5c4113dSnw141292 
592c5c4113dSnw141292 /* ARGSUSED */
593c5c4113dSnw141292 bool_t
594c5c4113dSnw141292 idmap_update_1_svc(idmap_update_batch batch, idmap_retcode *result,
595c5c4113dSnw141292 		struct svc_req *rqstp) {
596c5c4113dSnw141292 	sqlite		*db = NULL;
597c5c4113dSnw141292 	idmap_update_op	*up;
598c5c4113dSnw141292 	int		i;
599c5c4113dSnw141292 
600c5c4113dSnw141292 	if (verify_rules_auth(rqstp) < 0) {
601c5c4113dSnw141292 		*result = IDMAP_ERR_PERMISSION_DENIED;
602c5c4113dSnw141292 		goto out;
603c5c4113dSnw141292 	}
604c5c4113dSnw141292 
605c5c4113dSnw141292 	if (batch.idmap_update_batch_len == 0 ||
606c5c4113dSnw141292 			batch.idmap_update_batch_val == NULL) {
607c5c4113dSnw141292 		*result = IDMAP_SUCCESS;
608c5c4113dSnw141292 		goto out;
609c5c4113dSnw141292 	}
610c5c4113dSnw141292 
611c5c4113dSnw141292 	/* Get db handle */
612c5c4113dSnw141292 	*result = get_db_handle(&db);
613c5c4113dSnw141292 	if (*result != IDMAP_SUCCESS)
614c5c4113dSnw141292 		goto out;
615c5c4113dSnw141292 
616c5c4113dSnw141292 	*result = sql_exec_no_cb(db, "BEGIN TRANSACTION;");
617c5c4113dSnw141292 	if (*result != IDMAP_SUCCESS)
618c5c4113dSnw141292 		goto out;
619c5c4113dSnw141292 
620c5c4113dSnw141292 	for (i = 0; i < batch.idmap_update_batch_len; i++) {
621c5c4113dSnw141292 		up = &batch.idmap_update_batch_val[i];
622c5c4113dSnw141292 		switch (up->opnum) {
623c5c4113dSnw141292 		case OP_NONE:
624c5c4113dSnw141292 			*result = IDMAP_SUCCESS;
625c5c4113dSnw141292 			break;
626c5c4113dSnw141292 		case OP_ADD_NAMERULE:
627c5c4113dSnw141292 			*result = add_namerule(db,
628c5c4113dSnw141292 				&up->idmap_update_op_u.rule);
629c5c4113dSnw141292 			break;
630c5c4113dSnw141292 		case OP_RM_NAMERULE:
631c5c4113dSnw141292 			*result = rm_namerule(db,
632c5c4113dSnw141292 				&up->idmap_update_op_u.rule);
633c5c4113dSnw141292 			break;
634c5c4113dSnw141292 		case OP_FLUSH_NAMERULES:
635c5c4113dSnw141292 			*result = flush_namerules(db,
636c5c4113dSnw141292 				up->idmap_update_op_u.is_user);
637c5c4113dSnw141292 			break;
638c5c4113dSnw141292 		default:
639c5c4113dSnw141292 			*result = IDMAP_ERR_NOTSUPPORTED;
640c5c4113dSnw141292 			goto out;
641c5c4113dSnw141292 		};
642c5c4113dSnw141292 
643c5c4113dSnw141292 		if (*result != IDMAP_SUCCESS)
644c5c4113dSnw141292 			goto out;
645c5c4113dSnw141292 	}
646c5c4113dSnw141292 
647c5c4113dSnw141292 out:
648c5c4113dSnw141292 	if (*result == IDMAP_SUCCESS && db) {
649c5c4113dSnw141292 		*result = sql_exec_no_cb(db, "COMMIT TRANSACTION;");
650c5c4113dSnw141292 	}
651c5c4113dSnw141292 
652c5c4113dSnw141292 	if (db)
653c5c4113dSnw141292 		(void) sqlite_close(db);
654c5c4113dSnw141292 	*result = idmap_stat4prot(*result);
655c5c4113dSnw141292 	return (TRUE);
656c5c4113dSnw141292 }
657c5c4113dSnw141292 
658c5c4113dSnw141292 
659c5c4113dSnw141292 /* ARGSUSED */
660c5c4113dSnw141292 bool_t
661c5c4113dSnw141292 idmap_get_mapped_id_by_name_1_svc(idmap_mapping request,
662c5c4113dSnw141292 		idmap_mappings_res *result, struct svc_req *rqstp) {
663c5c4113dSnw141292 	sqlite		*cache = NULL, *db = NULL;
664c5c4113dSnw141292 
665c5c4113dSnw141292 	/* Init */
666c5c4113dSnw141292 	(void) memset(result, 0, sizeof (*result));
667c5c4113dSnw141292 
668c5c4113dSnw141292 	/* Get cache handle */
669c5c4113dSnw141292 	result->retcode = get_cache_handle(&cache);
670c5c4113dSnw141292 	if (result->retcode != IDMAP_SUCCESS)
671c5c4113dSnw141292 		goto out;
672c5c4113dSnw141292 
673c5c4113dSnw141292 	/* Get db handle */
674c5c4113dSnw141292 	result->retcode = get_db_handle(&db);
675c5c4113dSnw141292 	if (result->retcode != IDMAP_SUCCESS)
676c5c4113dSnw141292 		goto out;
677c5c4113dSnw141292 
678c5c4113dSnw141292 	/* Allocate result */
679c5c4113dSnw141292 	result->mappings.mappings_val = calloc(1, sizeof (idmap_mapping));
680c5c4113dSnw141292 	if (result->mappings.mappings_val == NULL) {
681c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
682c5c4113dSnw141292 		result->retcode = IDMAP_ERR_MEMORY;
683c5c4113dSnw141292 		goto out;
684c5c4113dSnw141292 	}
685c5c4113dSnw141292 	result->mappings.mappings_len = 1;
686c5c4113dSnw141292 
687c5c4113dSnw141292 	if (IS_REQUEST_SID(request)) {
688c5c4113dSnw141292 		result->retcode = get_w2u_mapping(
689c5c4113dSnw141292 			cache,
690c5c4113dSnw141292 			db,
691c5c4113dSnw141292 			&request,
692c5c4113dSnw141292 			result->mappings.mappings_val);
693c5c4113dSnw141292 	} else if (IS_REQUEST_UID(request)) {
694c5c4113dSnw141292 		result->retcode = get_u2w_mapping(
695c5c4113dSnw141292 			cache,
696c5c4113dSnw141292 			db,
697c5c4113dSnw141292 			&request,
698c5c4113dSnw141292 			result->mappings.mappings_val,
699c5c4113dSnw141292 			1);
700c5c4113dSnw141292 	} else if (IS_REQUEST_GID(request)) {
701c5c4113dSnw141292 		result->retcode = get_u2w_mapping(
702c5c4113dSnw141292 			cache,
703c5c4113dSnw141292 			db,
704c5c4113dSnw141292 			&request,
705c5c4113dSnw141292 			result->mappings.mappings_val,
706c5c4113dSnw141292 			0);
707c5c4113dSnw141292 	} else {
708c5c4113dSnw141292 		result->retcode = IDMAP_ERR_IDTYPE;
709c5c4113dSnw141292 	}
710c5c4113dSnw141292 
711c5c4113dSnw141292 out:
712c5c4113dSnw141292 	if (IDMAP_FATAL_ERROR(result->retcode)) {
713c5c4113dSnw141292 		xdr_free(xdr_idmap_mappings_res, (caddr_t)result);
714c5c4113dSnw141292 		result->mappings.mappings_len = 0;
715c5c4113dSnw141292 		result->mappings.mappings_val = NULL;
716c5c4113dSnw141292 	}
717c5c4113dSnw141292 	if (cache)
718c5c4113dSnw141292 		(void) sqlite_close(cache);
719c5c4113dSnw141292 	if (db)
720c5c4113dSnw141292 		(void) sqlite_close(db);
721c5c4113dSnw141292 	result->retcode = idmap_stat4prot(result->retcode);
722c5c4113dSnw141292 	return (TRUE);
723c5c4113dSnw141292 }
724c5c4113dSnw141292 
725c5c4113dSnw141292 
726c5c4113dSnw141292 /* ARGSUSED */
727c5c4113dSnw141292 int
728c5c4113dSnw141292 idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result,
729c5c4113dSnw141292 		caddr_t result) {
730c5c4113dSnw141292 	(void) xdr_free(xdr_result, result);
731c5c4113dSnw141292 	return (TRUE);
732c5c4113dSnw141292 }
733