1c5c4113dSnw141292 /* 2c5c4113dSnw141292 * CDDL HEADER START 3c5c4113dSnw141292 * 4c5c4113dSnw141292 * The contents of this file are subject to the terms of the 5c5c4113dSnw141292 * Common Development and Distribution License (the "License"). 6c5c4113dSnw141292 * You may not use this file except in compliance with the License. 7c5c4113dSnw141292 * 8c5c4113dSnw141292 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw141292 * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw141292 * See the License for the specific language governing permissions 11c5c4113dSnw141292 * and limitations under the License. 12c5c4113dSnw141292 * 13c5c4113dSnw141292 * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw141292 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw141292 * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw141292 * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw141292 * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw141292 * 19c5c4113dSnw141292 * CDDL HEADER END 20c5c4113dSnw141292 */ 21c5c4113dSnw141292 /* 22c5c4113dSnw141292 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23c5c4113dSnw141292 * Use is subject to license terms. 24c5c4113dSnw141292 */ 25c5c4113dSnw141292 26c5c4113dSnw141292 #pragma ident "%Z%%M% %I% %E% SMI" 27c5c4113dSnw141292 28c5c4113dSnw141292 /* 29c5c4113dSnw141292 * Service routines 30c5c4113dSnw141292 */ 31c5c4113dSnw141292 32c5c4113dSnw141292 #include "idmapd.h" 33c5c4113dSnw141292 #include "idmap_priv.h" 34c5c4113dSnw141292 #include <signal.h> 35c5c4113dSnw141292 #include <thread.h> 36c5c4113dSnw141292 #include <string.h> 37c5c4113dSnw141292 #include <strings.h> 38c5c4113dSnw141292 #include <errno.h> 39c5c4113dSnw141292 #include <assert.h> 40c5c4113dSnw141292 #include <sys/types.h> 41c5c4113dSnw141292 #include <sys/stat.h> 42c5c4113dSnw141292 #include <ucred.h> 43c5c4113dSnw141292 #include <pwd.h> 44c5c4113dSnw141292 #include <auth_attr.h> 45c5c4113dSnw141292 #include <secdb.h> 46c5c4113dSnw141292 47c5c4113dSnw141292 #define _VALIDATE_LIST_CB_DATA(col, val, siz)\ 48c5c4113dSnw141292 retcode = validate_list_cb_data(cb_data, argc, argv, col,\ 49c5c4113dSnw141292 (uchar_t **)val, siz);\ 50c5c4113dSnw141292 if (retcode == IDMAP_NEXT) {\ 51c5c4113dSnw141292 result->retcode = IDMAP_NEXT;\ 52c5c4113dSnw141292 return (0);\ 53c5c4113dSnw141292 } else if (retcode < 0) {\ 54c5c4113dSnw141292 result->retcode = retcode;\ 55c5c4113dSnw141292 return (1);\ 56c5c4113dSnw141292 } 57c5c4113dSnw141292 58c5c4113dSnw141292 #define PROCESS_LIST_SVC_SQL(rcode, db, sql, limit, cb, res, len)\ 59c5c4113dSnw141292 rcode = process_list_svc_sql(db, sql, limit, cb, res);\ 60c5c4113dSnw141292 if (rcode == IDMAP_ERR_BUSY)\ 61c5c4113dSnw141292 res->retcode = IDMAP_ERR_BUSY;\ 62c5c4113dSnw141292 else if (rcode == IDMAP_SUCCESS && len == 0)\ 63c5c4113dSnw141292 res->retcode = IDMAP_ERR_NOTFOUND; 64c5c4113dSnw141292 65c5c4113dSnw141292 66c5c4113dSnw141292 /* ARGSUSED */ 67c5c4113dSnw141292 bool_t 68c5c4113dSnw141292 idmap_null_1_svc(void *result, struct svc_req *rqstp) { 69c5c4113dSnw141292 return (TRUE); 70c5c4113dSnw141292 } 71c5c4113dSnw141292 72c5c4113dSnw141292 #define IS_BATCH_SID(batch, i)\ 73c5c4113dSnw141292 batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_SID 74c5c4113dSnw141292 75c5c4113dSnw141292 #define IS_BATCH_UID(batch, i)\ 76c5c4113dSnw141292 batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_UID 77c5c4113dSnw141292 78c5c4113dSnw141292 #define IS_BATCH_GID(batch, i)\ 79c5c4113dSnw141292 batch.idmap_mapping_batch_val[i].id1.idtype == IDMAP_GID 80c5c4113dSnw141292 81c5c4113dSnw141292 #define IS_REQUEST_SID(request)\ 82c5c4113dSnw141292 request.id1.idtype == IDMAP_SID 83c5c4113dSnw141292 84c5c4113dSnw141292 #define IS_REQUEST_UID(request)\ 85c5c4113dSnw141292 request.id1.idtype == IDMAP_UID 86c5c4113dSnw141292 87c5c4113dSnw141292 #define IS_REQUEST_GID(request)\ 88c5c4113dSnw141292 request.id1.idtype == IDMAP_GID 89c5c4113dSnw141292 90c5c4113dSnw141292 /* ARGSUSED */ 91c5c4113dSnw141292 bool_t 92c5c4113dSnw141292 idmap_get_mapped_ids_1_svc(idmap_mapping_batch batch, 93c5c4113dSnw141292 idmap_ids_res *result, struct svc_req *rqstp) { 94c5c4113dSnw141292 sqlite *cache = NULL, *db = NULL; 95c5c4113dSnw141292 lookup_state_t state; 96c5c4113dSnw141292 idmap_retcode retcode, winrc; 97c5c4113dSnw141292 int i; 98c5c4113dSnw141292 99c5c4113dSnw141292 /* Init */ 100c5c4113dSnw141292 (void) memset(result, 0, sizeof (*result)); 101c5c4113dSnw141292 (void) memset(&state, 0, sizeof (state)); 102c5c4113dSnw141292 103c5c4113dSnw141292 /* Return success if nothing was requested */ 104c5c4113dSnw141292 if (batch.idmap_mapping_batch_len < 1) 105c5c4113dSnw141292 goto out; 106c5c4113dSnw141292 107c5c4113dSnw141292 /* Get cache handle */ 108c5c4113dSnw141292 result->retcode = get_cache_handle(&cache); 109c5c4113dSnw141292 if (result->retcode != IDMAP_SUCCESS) 110c5c4113dSnw141292 goto out; 111c5c4113dSnw141292 112c5c4113dSnw141292 /* Get db handle */ 113c5c4113dSnw141292 result->retcode = get_db_handle(&db); 114c5c4113dSnw141292 if (result->retcode != IDMAP_SUCCESS) 115c5c4113dSnw141292 goto out; 116c5c4113dSnw141292 117c5c4113dSnw141292 /* Allocate result array */ 118c5c4113dSnw141292 result->ids.ids_val = calloc(batch.idmap_mapping_batch_len, 119c5c4113dSnw141292 sizeof (idmap_id_res)); 120c5c4113dSnw141292 if (result->ids.ids_val == NULL) { 121c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 122c5c4113dSnw141292 result->retcode = IDMAP_ERR_MEMORY; 123c5c4113dSnw141292 goto out; 124c5c4113dSnw141292 } 125c5c4113dSnw141292 result->ids.ids_len = batch.idmap_mapping_batch_len; 126c5c4113dSnw141292 127c5c4113dSnw141292 /* Init our 'done' flags */ 128c5c4113dSnw141292 state.sid2pid_done = state.pid2sid_done = TRUE; 129c5c4113dSnw141292 130c5c4113dSnw141292 /* First stage */ 131c5c4113dSnw141292 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 132c5c4113dSnw141292 if (IS_BATCH_SID(batch, i)) { 133c5c4113dSnw141292 retcode = sid2pid_first_pass( 134c5c4113dSnw141292 &state, 135c5c4113dSnw141292 cache, 136c5c4113dSnw141292 &batch.idmap_mapping_batch_val[i], 137c5c4113dSnw141292 &result->ids.ids_val[i]); 138c5c4113dSnw141292 } else if (IS_BATCH_UID(batch, i)) { 139c5c4113dSnw141292 retcode = pid2sid_first_pass( 140c5c4113dSnw141292 &state, 141c5c4113dSnw141292 cache, 142c5c4113dSnw141292 db, 143c5c4113dSnw141292 &batch.idmap_mapping_batch_val[i], 144c5c4113dSnw141292 &result->ids.ids_val[i], 1, 0); 145c5c4113dSnw141292 } else if (IS_BATCH_GID(batch, i)) { 146c5c4113dSnw141292 retcode = pid2sid_first_pass( 147c5c4113dSnw141292 &state, 148c5c4113dSnw141292 cache, 149c5c4113dSnw141292 db, 150c5c4113dSnw141292 &batch.idmap_mapping_batch_val[i], 151c5c4113dSnw141292 &result->ids.ids_val[i], 0, 0); 152c5c4113dSnw141292 } else { 153c5c4113dSnw141292 result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE; 154c5c4113dSnw141292 continue; 155c5c4113dSnw141292 } 156c5c4113dSnw141292 if (IDMAP_FATAL_ERROR(retcode)) { 157c5c4113dSnw141292 result->retcode = retcode; 158c5c4113dSnw141292 goto out; 159c5c4113dSnw141292 } 160c5c4113dSnw141292 } 161c5c4113dSnw141292 162c5c4113dSnw141292 /* Check if we are done */ 163c5c4113dSnw141292 if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 164c5c4113dSnw141292 goto out; 165c5c4113dSnw141292 166c5c4113dSnw141292 /* Process Windows server lookups for sid2name */ 167c5c4113dSnw141292 if (state.ad_nqueries) { 168c5c4113dSnw141292 winrc = lookup_win_batch_sid2name(&state, &batch, 169c5c4113dSnw141292 result); 170c5c4113dSnw141292 if (IDMAP_FATAL_ERROR(winrc)) { 171c5c4113dSnw141292 result->retcode = winrc; 172c5c4113dSnw141292 goto out; 173c5c4113dSnw141292 } 174c5c4113dSnw141292 } else 175c5c4113dSnw141292 winrc = IDMAP_SUCCESS; 176c5c4113dSnw141292 177c5c4113dSnw141292 /* Reset sid2pid 'done' flag */ 178c5c4113dSnw141292 state.sid2pid_done = TRUE; 179c5c4113dSnw141292 180c5c4113dSnw141292 /* Second stage */ 181c5c4113dSnw141292 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 182c5c4113dSnw141292 /* Process sid to pid ONLY */ 183c5c4113dSnw141292 if (IS_BATCH_SID(batch, i)) { 184c5c4113dSnw141292 if (IDMAP_ERROR(winrc)) 185c5c4113dSnw141292 result->ids.ids_val[i].retcode = winrc; 186c5c4113dSnw141292 retcode = sid2pid_second_pass( 187c5c4113dSnw141292 &state, 188c5c4113dSnw141292 cache, 189c5c4113dSnw141292 db, 190c5c4113dSnw141292 &batch.idmap_mapping_batch_val[i], 191c5c4113dSnw141292 &result->ids.ids_val[i]); 192c5c4113dSnw141292 if (IDMAP_FATAL_ERROR(retcode)) { 193c5c4113dSnw141292 result->retcode = retcode; 194c5c4113dSnw141292 goto out; 195c5c4113dSnw141292 } 196c5c4113dSnw141292 } 197c5c4113dSnw141292 } 198c5c4113dSnw141292 199c5c4113dSnw141292 /* Check if we are done */ 200c5c4113dSnw141292 if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 201c5c4113dSnw141292 goto out; 202c5c4113dSnw141292 203c5c4113dSnw141292 /* Reset our 'done' flags */ 204c5c4113dSnw141292 state.sid2pid_done = state.pid2sid_done = TRUE; 205c5c4113dSnw141292 206c5c4113dSnw141292 /* Update cache in a single transaction */ 207c5c4113dSnw141292 if (sql_exec_no_cb(cache, "BEGIN TRANSACTION;") != IDMAP_SUCCESS) 208c5c4113dSnw141292 goto out; 209c5c4113dSnw141292 210c5c4113dSnw141292 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 211c5c4113dSnw141292 if (IS_BATCH_SID(batch, i)) { 212c5c4113dSnw141292 (void) update_cache_sid2pid( 213c5c4113dSnw141292 &state, 214c5c4113dSnw141292 cache, 215c5c4113dSnw141292 &batch.idmap_mapping_batch_val[i], 216c5c4113dSnw141292 &result->ids.ids_val[i]); 217c5c4113dSnw141292 } else if ((IS_BATCH_UID(batch, i)) || 218c5c4113dSnw141292 (IS_BATCH_GID(batch, i))) { 219c5c4113dSnw141292 (void) update_cache_pid2sid( 220c5c4113dSnw141292 &state, 221c5c4113dSnw141292 cache, 222c5c4113dSnw141292 &batch.idmap_mapping_batch_val[i], 223c5c4113dSnw141292 &result->ids.ids_val[i]); 224c5c4113dSnw141292 } 225c5c4113dSnw141292 } 226c5c4113dSnw141292 227c5c4113dSnw141292 /* Commit if we have atleast one successful update */ 228c5c4113dSnw141292 if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE) 229c5c4113dSnw141292 (void) sql_exec_no_cb(cache, "COMMIT TRANSACTION;"); 230c5c4113dSnw141292 else 231c5c4113dSnw141292 (void) sql_exec_no_cb(cache, "END TRANSACTION;"); 232c5c4113dSnw141292 233c5c4113dSnw141292 out: 234c5c4113dSnw141292 if (IDMAP_ERROR(result->retcode)) { 235c5c4113dSnw141292 xdr_free(xdr_idmap_ids_res, (caddr_t)result); 236c5c4113dSnw141292 result->ids.ids_len = 0; 237c5c4113dSnw141292 result->ids.ids_val = NULL; 238c5c4113dSnw141292 } 239c5c4113dSnw141292 if (cache) 240c5c4113dSnw141292 (void) sqlite_close(cache); 241c5c4113dSnw141292 if (db) 242c5c4113dSnw141292 (void) sqlite_close(db); 243c5c4113dSnw141292 result->retcode = idmap_stat4prot(result->retcode); 244c5c4113dSnw141292 return (TRUE); 245c5c4113dSnw141292 } 246c5c4113dSnw141292 247c5c4113dSnw141292 248c5c4113dSnw141292 /* ARGSUSED */ 249c5c4113dSnw141292 static int 250c5c4113dSnw141292 list_mappings_cb(void *parg, int argc, char **argv, char **colnames) { 251c5c4113dSnw141292 list_cb_data_t *cb_data; 252c5c4113dSnw141292 char *str; 253c5c4113dSnw141292 idmap_mappings_res *result; 254c5c4113dSnw141292 idmap_utf8str *ptr; 255c5c4113dSnw141292 idmap_retcode retcode; 256c5c4113dSnw141292 int w2u, u2w; 257c5c4113dSnw141292 char *end; 258c5c4113dSnw141292 259c5c4113dSnw141292 cb_data = (list_cb_data_t *)parg; 260c5c4113dSnw141292 result = (idmap_mappings_res *)cb_data->result; 261c5c4113dSnw141292 262c5c4113dSnw141292 _VALIDATE_LIST_CB_DATA(9, &result->mappings.mappings_val, 263c5c4113dSnw141292 sizeof (idmap_mapping)); 264c5c4113dSnw141292 265c5c4113dSnw141292 result->mappings.mappings_len++; 266c5c4113dSnw141292 267c5c4113dSnw141292 if ((str = strdup(argv[1])) == NULL) 268c5c4113dSnw141292 return (1); 269c5c4113dSnw141292 result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix = 270c5c4113dSnw141292 str; 271c5c4113dSnw141292 result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid = 272c5c4113dSnw141292 strtoul(argv[2], &end, 10); 273c5c4113dSnw141292 result->mappings.mappings_val[cb_data->next].id1.idtype = IDMAP_SID; 274c5c4113dSnw141292 275c5c4113dSnw141292 result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid = 276c5c4113dSnw141292 strtoul(argv[3], &end, 10); 277c5c4113dSnw141292 result->mappings.mappings_val[cb_data->next].id2.idtype = IDMAP_UID; 278c5c4113dSnw141292 279c5c4113dSnw141292 w2u = argv[4]?strtol(argv[4], &end, 10):0; 280c5c4113dSnw141292 u2w = argv[5]?strtol(argv[5], &end, 10):0; 281c5c4113dSnw141292 282c5c4113dSnw141292 if (w2u > 0 && u2w == 0) 283*651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 284*651c0131Sbaban IDMAP_DIRECTION_W2U; 285c5c4113dSnw141292 else if (w2u == 0 && u2w > 0) 286*651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 287*651c0131Sbaban IDMAP_DIRECTION_U2W; 288c5c4113dSnw141292 else 289*651c0131Sbaban result->mappings.mappings_val[cb_data->next].direction = 290*651c0131Sbaban IDMAP_DIRECTION_BI; 291c5c4113dSnw141292 292c5c4113dSnw141292 ptr = &result->mappings.mappings_val[cb_data->next].id1domain; 293c5c4113dSnw141292 if (idmap_str2utf8(&ptr, argv[6], 0) != IDMAP_SUCCESS) 294c5c4113dSnw141292 return (1); 295c5c4113dSnw141292 296c5c4113dSnw141292 ptr = &result->mappings.mappings_val[cb_data->next].id1name; 297c5c4113dSnw141292 if (idmap_str2utf8(&ptr, argv[7], 0) != IDMAP_SUCCESS) 298c5c4113dSnw141292 return (1); 299c5c4113dSnw141292 300c5c4113dSnw141292 ptr = &result->mappings.mappings_val[cb_data->next].id2name; 301c5c4113dSnw141292 if (idmap_str2utf8(&ptr, argv[8], 0) != IDMAP_SUCCESS) 302c5c4113dSnw141292 return (1); 303c5c4113dSnw141292 304c5c4113dSnw141292 result->lastrowid = strtoll(argv[0], &end, 10); 305c5c4113dSnw141292 cb_data->next++; 306c5c4113dSnw141292 result->retcode = IDMAP_SUCCESS; 307c5c4113dSnw141292 return (0); 308c5c4113dSnw141292 } 309c5c4113dSnw141292 310c5c4113dSnw141292 311c5c4113dSnw141292 /* ARGSUSED */ 312c5c4113dSnw141292 bool_t 313c5c4113dSnw141292 idmap_list_mappings_1_svc(bool_t is_user, int64_t lastrowid, 314c5c4113dSnw141292 uint64_t limit, idmap_mappings_res *result, 315c5c4113dSnw141292 struct svc_req *rqstp) { 316c5c4113dSnw141292 sqlite *cache = NULL; 317c5c4113dSnw141292 char lbuf[30], rbuf[30]; 318c5c4113dSnw141292 uint64_t maxlimit; 319c5c4113dSnw141292 idmap_retcode retcode; 320c5c4113dSnw141292 char *sql = NULL; 321c5c4113dSnw141292 322c5c4113dSnw141292 (void) memset(result, 0, sizeof (*result)); 323c5c4113dSnw141292 lbuf[0] = rbuf[0] = 0; 324c5c4113dSnw141292 325c5c4113dSnw141292 RDLOCK_CONFIG(); 326c5c4113dSnw141292 maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 327c5c4113dSnw141292 UNLOCK_CONFIG(); 328c5c4113dSnw141292 329c5c4113dSnw141292 /* Get cache handle */ 330c5c4113dSnw141292 result->retcode = get_cache_handle(&cache); 331c5c4113dSnw141292 if (result->retcode != IDMAP_SUCCESS) 332c5c4113dSnw141292 goto out; 333c5c4113dSnw141292 334c5c4113dSnw141292 result->retcode = IDMAP_ERR_INTERNAL; 335c5c4113dSnw141292 336c5c4113dSnw141292 /* Create LIMIT expression. */ 337c5c4113dSnw141292 if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 338c5c4113dSnw141292 limit = maxlimit; 339c5c4113dSnw141292 if (limit > 0) 340c5c4113dSnw141292 (void) snprintf(lbuf, sizeof (lbuf), 341c5c4113dSnw141292 "LIMIT %" PRIu64, limit + 1ULL); 342c5c4113dSnw141292 343c5c4113dSnw141292 (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 344c5c4113dSnw141292 345c5c4113dSnw141292 /* 346c5c4113dSnw141292 * Combine all the above into a giant SELECT statement that 347c5c4113dSnw141292 * will return the requested mappings 348c5c4113dSnw141292 */ 349c5c4113dSnw141292 sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, u2w," 350c5c4113dSnw141292 " windomain, winname, unixname" 351c5c4113dSnw141292 " FROM idmap_cache WHERE " 352c5c4113dSnw141292 " %s AND is_user = %d %s;", 353c5c4113dSnw141292 rbuf, is_user?1:0, lbuf); 354c5c4113dSnw141292 if (sql == NULL) { 355c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 356c5c4113dSnw141292 goto out; 357c5c4113dSnw141292 } 358c5c4113dSnw141292 359c5c4113dSnw141292 /* Execute the SQL statement and update the return buffer */ 360c5c4113dSnw141292 PROCESS_LIST_SVC_SQL(retcode, cache, sql, limit, list_mappings_cb, 361c5c4113dSnw141292 result, result->mappings.mappings_len); 362c5c4113dSnw141292 363c5c4113dSnw141292 out: 364c5c4113dSnw141292 if (sql) 365c5c4113dSnw141292 sqlite_freemem(sql); 366c5c4113dSnw141292 if (IDMAP_ERROR(result->retcode)) 367c5c4113dSnw141292 (void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 368c5c4113dSnw141292 if (cache) 369c5c4113dSnw141292 (void) sqlite_close(cache); 370c5c4113dSnw141292 result->retcode = idmap_stat4prot(result->retcode); 371c5c4113dSnw141292 return (TRUE); 372c5c4113dSnw141292 } 373c5c4113dSnw141292 374c5c4113dSnw141292 375c5c4113dSnw141292 /* ARGSUSED */ 376c5c4113dSnw141292 static int 377c5c4113dSnw141292 list_namerules_cb(void *parg, int argc, char **argv, char **colnames) { 378c5c4113dSnw141292 list_cb_data_t *cb_data; 379c5c4113dSnw141292 idmap_namerules_res *result; 380c5c4113dSnw141292 idmap_retcode retcode; 381c5c4113dSnw141292 idmap_utf8str *ptr; 382c5c4113dSnw141292 int w2u_order, u2w_order; 383c5c4113dSnw141292 char *end; 384c5c4113dSnw141292 385c5c4113dSnw141292 cb_data = (list_cb_data_t *)parg; 386c5c4113dSnw141292 result = (idmap_namerules_res *)cb_data->result; 387c5c4113dSnw141292 388c5c4113dSnw141292 _VALIDATE_LIST_CB_DATA(8, &result->rules.rules_val, 389c5c4113dSnw141292 sizeof (idmap_namerule)); 390c5c4113dSnw141292 391c5c4113dSnw141292 result->rules.rules_len++; 392c5c4113dSnw141292 393c5c4113dSnw141292 result->rules.rules_val[cb_data->next].is_user = 394c5c4113dSnw141292 strtol(argv[1], &end, 10); 395c5c4113dSnw141292 396c5c4113dSnw141292 ptr = &result->rules.rules_val[cb_data->next].windomain; 397c5c4113dSnw141292 if (idmap_str2utf8(&ptr, argv[2], 0) != IDMAP_SUCCESS) 398c5c4113dSnw141292 return (1); 399c5c4113dSnw141292 400c5c4113dSnw141292 ptr = &result->rules.rules_val[cb_data->next].winname; 401c5c4113dSnw141292 if (idmap_str2utf8(&ptr, argv[3], 0) != IDMAP_SUCCESS) 402c5c4113dSnw141292 return (1); 403c5c4113dSnw141292 404c5c4113dSnw141292 result->rules.rules_val[cb_data->next].is_nt4 = 405c5c4113dSnw141292 strtol(argv[4], &end, 10); 406c5c4113dSnw141292 407c5c4113dSnw141292 ptr = &result->rules.rules_val[cb_data->next].unixname; 408c5c4113dSnw141292 if (idmap_str2utf8(&ptr, argv[5], 0) != IDMAP_SUCCESS) 409c5c4113dSnw141292 return (1); 410c5c4113dSnw141292 411c5c4113dSnw141292 w2u_order = argv[6]?strtol(argv[6], &end, 10):0; 412c5c4113dSnw141292 u2w_order = argv[7]?strtol(argv[7], &end, 10):0; 413c5c4113dSnw141292 414c5c4113dSnw141292 if (w2u_order > 0 && u2w_order == 0) 415*651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 416*651c0131Sbaban IDMAP_DIRECTION_W2U; 417c5c4113dSnw141292 else if (w2u_order == 0 && u2w_order > 0) 418*651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 419*651c0131Sbaban IDMAP_DIRECTION_U2W; 420c5c4113dSnw141292 else 421*651c0131Sbaban result->rules.rules_val[cb_data->next].direction = 422*651c0131Sbaban IDMAP_DIRECTION_BI; 423c5c4113dSnw141292 424c5c4113dSnw141292 result->lastrowid = strtoll(argv[0], &end, 10); 425c5c4113dSnw141292 cb_data->next++; 426c5c4113dSnw141292 result->retcode = IDMAP_SUCCESS; 427c5c4113dSnw141292 return (0); 428c5c4113dSnw141292 } 429c5c4113dSnw141292 430c5c4113dSnw141292 431c5c4113dSnw141292 /* ARGSUSED */ 432c5c4113dSnw141292 bool_t 433c5c4113dSnw141292 idmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid, 434c5c4113dSnw141292 uint64_t limit, idmap_namerules_res *result, 435c5c4113dSnw141292 struct svc_req *rqstp) { 436c5c4113dSnw141292 437c5c4113dSnw141292 sqlite *db = NULL; 438c5c4113dSnw141292 char w2ubuf[15], u2wbuf[15]; 439c5c4113dSnw141292 char lbuf[30], rbuf[30]; 440c5c4113dSnw141292 char *sql = NULL; 441c5c4113dSnw141292 char *s_windomain = NULL, *s_winname = NULL; 442c5c4113dSnw141292 char *s_unixname = NULL; 443c5c4113dSnw141292 uint64_t maxlimit; 444c5c4113dSnw141292 idmap_retcode retcode; 445c5c4113dSnw141292 446c5c4113dSnw141292 (void) memset(result, 0, sizeof (*result)); 447c5c4113dSnw141292 lbuf[0] = rbuf[0] = 0; 448c5c4113dSnw141292 449c5c4113dSnw141292 RDLOCK_CONFIG(); 450c5c4113dSnw141292 maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 451c5c4113dSnw141292 UNLOCK_CONFIG(); 452c5c4113dSnw141292 453c5c4113dSnw141292 /* Get db handle */ 454c5c4113dSnw141292 result->retcode = get_db_handle(&db); 455c5c4113dSnw141292 if (result->retcode != IDMAP_SUCCESS) 456c5c4113dSnw141292 goto out; 457c5c4113dSnw141292 458c5c4113dSnw141292 result->retcode = IDMAP_ERR_INTERNAL; 459c5c4113dSnw141292 460c5c4113dSnw141292 if (rule.direction < 0) { 461c5c4113dSnw141292 w2ubuf[0] = u2wbuf[0] = 0; 462*651c0131Sbaban } else if (rule.direction == IDMAP_DIRECTION_BI) { 463c5c4113dSnw141292 (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 464c5c4113dSnw141292 (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 465*651c0131Sbaban } else if (rule.direction == IDMAP_DIRECTION_W2U) { 466c5c4113dSnw141292 (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 467c5c4113dSnw141292 (void) snprintf(u2wbuf, sizeof (u2wbuf), 468c5c4113dSnw141292 "AND (u2w_order = 0 OR u2w_order ISNULL)"); 469*651c0131Sbaban } else if (rule.direction == IDMAP_DIRECTION_U2W) { 470c5c4113dSnw141292 (void) snprintf(w2ubuf, sizeof (w2ubuf), 471c5c4113dSnw141292 "AND (w2u_order = 0 OR w2u_order ISNULL)"); 472c5c4113dSnw141292 (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 473c5c4113dSnw141292 } 474c5c4113dSnw141292 475c5c4113dSnw141292 /* Create where statement for windomain */ 476c5c4113dSnw141292 if (rule.windomain.idmap_utf8str_len > 0) { 477c5c4113dSnw141292 if (gen_sql_expr_from_utf8str("AND", "windomain", "=", 478c5c4113dSnw141292 &rule.windomain, 479c5c4113dSnw141292 "", &s_windomain) != IDMAP_SUCCESS) 480c5c4113dSnw141292 goto out; 481c5c4113dSnw141292 } 482c5c4113dSnw141292 483c5c4113dSnw141292 /* Create where statement for winname */ 484c5c4113dSnw141292 if (rule.winname.idmap_utf8str_len > 0) { 485c5c4113dSnw141292 if (gen_sql_expr_from_utf8str("AND", "winname", "=", 486c5c4113dSnw141292 &rule.winname, 487c5c4113dSnw141292 "", &s_winname) != IDMAP_SUCCESS) 488c5c4113dSnw141292 goto out; 489c5c4113dSnw141292 } 490c5c4113dSnw141292 491c5c4113dSnw141292 /* Create where statement for unixname */ 492c5c4113dSnw141292 if (rule.unixname.idmap_utf8str_len > 0) { 493c5c4113dSnw141292 if (gen_sql_expr_from_utf8str("AND", "unixname", "=", 494c5c4113dSnw141292 &rule.unixname, 495c5c4113dSnw141292 "", &s_unixname) != IDMAP_SUCCESS) 496c5c4113dSnw141292 goto out; 497c5c4113dSnw141292 } 498c5c4113dSnw141292 499c5c4113dSnw141292 /* Create LIMIT expression. */ 500c5c4113dSnw141292 if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 501c5c4113dSnw141292 limit = maxlimit; 502c5c4113dSnw141292 if (limit > 0) 503c5c4113dSnw141292 (void) snprintf(lbuf, sizeof (lbuf), 504c5c4113dSnw141292 "LIMIT %" PRIu64, limit + 1ULL); 505c5c4113dSnw141292 506c5c4113dSnw141292 (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 507c5c4113dSnw141292 508c5c4113dSnw141292 /* 509c5c4113dSnw141292 * Combine all the above into a giant SELECT statement that 510c5c4113dSnw141292 * will return the requested rules 511c5c4113dSnw141292 */ 512c5c4113dSnw141292 sql = sqlite_mprintf("SELECT rowid, is_user, windomain, winname, " 513c5c4113dSnw141292 "is_nt4, unixname, w2u_order, u2w_order " 514c5c4113dSnw141292 "FROM namerules WHERE " 515c5c4113dSnw141292 " %s AND is_user = %d %s %s %s %s %s %s;", 516c5c4113dSnw141292 rbuf, rule.is_user?1:0, 517c5c4113dSnw141292 s_windomain?s_windomain:"", 518c5c4113dSnw141292 s_winname?s_winname:"", 519c5c4113dSnw141292 s_unixname?s_unixname:"", 520c5c4113dSnw141292 w2ubuf, u2wbuf, lbuf); 521c5c4113dSnw141292 if (sql == NULL) { 522c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 523c5c4113dSnw141292 goto out; 524c5c4113dSnw141292 } 525c5c4113dSnw141292 526c5c4113dSnw141292 /* Execute the SQL statement and update the return buffer */ 527c5c4113dSnw141292 PROCESS_LIST_SVC_SQL(retcode, db, sql, limit, list_namerules_cb, 528c5c4113dSnw141292 result, result->rules.rules_len); 529c5c4113dSnw141292 530c5c4113dSnw141292 out: 531c5c4113dSnw141292 if (s_windomain) 532c5c4113dSnw141292 sqlite_freemem(s_windomain); 533c5c4113dSnw141292 if (s_winname) 534c5c4113dSnw141292 sqlite_freemem(s_winname); 535c5c4113dSnw141292 if (s_unixname) 536c5c4113dSnw141292 sqlite_freemem(s_unixname); 537c5c4113dSnw141292 if (sql) 538c5c4113dSnw141292 sqlite_freemem(sql); 539c5c4113dSnw141292 if (IDMAP_ERROR(result->retcode)) 540c5c4113dSnw141292 (void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result); 541c5c4113dSnw141292 if (db) 542c5c4113dSnw141292 (void) sqlite_close(db); 543c5c4113dSnw141292 result->retcode = idmap_stat4prot(result->retcode); 544c5c4113dSnw141292 return (TRUE); 545c5c4113dSnw141292 } 546c5c4113dSnw141292 547c5c4113dSnw141292 #define IDMAP_RULES_AUTH "solaris.admin.idmap.rules" 548c5c4113dSnw141292 static int 549c5c4113dSnw141292 verify_rules_auth(struct svc_req *rqstp) { 550c5c4113dSnw141292 ucred_t *uc = NULL; 551c5c4113dSnw141292 uid_t uid; 552c5c4113dSnw141292 char buf[1024]; 553c5c4113dSnw141292 struct passwd pwd; 554c5c4113dSnw141292 const char *me = "verify_rules_auth"; 555c5c4113dSnw141292 556c5c4113dSnw141292 if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) { 557c5c4113dSnw141292 idmapdlog(LOG_ERR, 558c5c4113dSnw141292 "%s: svc_getcallerucred failed (errno=%d)", 559c5c4113dSnw141292 me, errno); 560c5c4113dSnw141292 return (-1); 561c5c4113dSnw141292 } 562c5c4113dSnw141292 563c5c4113dSnw141292 uid = ucred_geteuid(uc); 564c5c4113dSnw141292 if (uid == (uid_t)-1) { 565c5c4113dSnw141292 idmapdlog(LOG_ERR, 566c5c4113dSnw141292 "%s: ucred_geteuid failed (errno=%d)", 567c5c4113dSnw141292 me, errno); 568c5c4113dSnw141292 ucred_free(uc); 569c5c4113dSnw141292 return (-1); 570c5c4113dSnw141292 } 571c5c4113dSnw141292 572c5c4113dSnw141292 if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) { 573c5c4113dSnw141292 idmapdlog(LOG_ERR, 574c5c4113dSnw141292 "%s: getpwuid_r(%u) failed (errno=%d)", 575c5c4113dSnw141292 me, uid, errno); 576c5c4113dSnw141292 ucred_free(uc); 577c5c4113dSnw141292 return (-1); 578c5c4113dSnw141292 } 579c5c4113dSnw141292 580c5c4113dSnw141292 if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) { 581c5c4113dSnw141292 idmapdlog(LOG_INFO, 582c5c4113dSnw141292 "%s: %s does not have authorization.", 583c5c4113dSnw141292 me, pwd.pw_name); 584c5c4113dSnw141292 ucred_free(uc); 585c5c4113dSnw141292 return (-1); 586c5c4113dSnw141292 } 587c5c4113dSnw141292 588c5c4113dSnw141292 ucred_free(uc); 589c5c4113dSnw141292 return (1); 590c5c4113dSnw141292 } 591c5c4113dSnw141292 592c5c4113dSnw141292 /* ARGSUSED */ 593c5c4113dSnw141292 bool_t 594c5c4113dSnw141292 idmap_update_1_svc(idmap_update_batch batch, idmap_retcode *result, 595c5c4113dSnw141292 struct svc_req *rqstp) { 596c5c4113dSnw141292 sqlite *db = NULL; 597c5c4113dSnw141292 idmap_update_op *up; 598c5c4113dSnw141292 int i; 599c5c4113dSnw141292 600c5c4113dSnw141292 if (verify_rules_auth(rqstp) < 0) { 601c5c4113dSnw141292 *result = IDMAP_ERR_PERMISSION_DENIED; 602c5c4113dSnw141292 goto out; 603c5c4113dSnw141292 } 604c5c4113dSnw141292 605c5c4113dSnw141292 if (batch.idmap_update_batch_len == 0 || 606c5c4113dSnw141292 batch.idmap_update_batch_val == NULL) { 607c5c4113dSnw141292 *result = IDMAP_SUCCESS; 608c5c4113dSnw141292 goto out; 609c5c4113dSnw141292 } 610c5c4113dSnw141292 611c5c4113dSnw141292 /* Get db handle */ 612c5c4113dSnw141292 *result = get_db_handle(&db); 613c5c4113dSnw141292 if (*result != IDMAP_SUCCESS) 614c5c4113dSnw141292 goto out; 615c5c4113dSnw141292 616c5c4113dSnw141292 *result = sql_exec_no_cb(db, "BEGIN TRANSACTION;"); 617c5c4113dSnw141292 if (*result != IDMAP_SUCCESS) 618c5c4113dSnw141292 goto out; 619c5c4113dSnw141292 620c5c4113dSnw141292 for (i = 0; i < batch.idmap_update_batch_len; i++) { 621c5c4113dSnw141292 up = &batch.idmap_update_batch_val[i]; 622c5c4113dSnw141292 switch (up->opnum) { 623c5c4113dSnw141292 case OP_NONE: 624c5c4113dSnw141292 *result = IDMAP_SUCCESS; 625c5c4113dSnw141292 break; 626c5c4113dSnw141292 case OP_ADD_NAMERULE: 627c5c4113dSnw141292 *result = add_namerule(db, 628c5c4113dSnw141292 &up->idmap_update_op_u.rule); 629c5c4113dSnw141292 break; 630c5c4113dSnw141292 case OP_RM_NAMERULE: 631c5c4113dSnw141292 *result = rm_namerule(db, 632c5c4113dSnw141292 &up->idmap_update_op_u.rule); 633c5c4113dSnw141292 break; 634c5c4113dSnw141292 case OP_FLUSH_NAMERULES: 635c5c4113dSnw141292 *result = flush_namerules(db, 636c5c4113dSnw141292 up->idmap_update_op_u.is_user); 637c5c4113dSnw141292 break; 638c5c4113dSnw141292 default: 639c5c4113dSnw141292 *result = IDMAP_ERR_NOTSUPPORTED; 640c5c4113dSnw141292 goto out; 641c5c4113dSnw141292 }; 642c5c4113dSnw141292 643c5c4113dSnw141292 if (*result != IDMAP_SUCCESS) 644c5c4113dSnw141292 goto out; 645c5c4113dSnw141292 } 646c5c4113dSnw141292 647c5c4113dSnw141292 out: 648c5c4113dSnw141292 if (*result == IDMAP_SUCCESS && db) { 649c5c4113dSnw141292 *result = sql_exec_no_cb(db, "COMMIT TRANSACTION;"); 650c5c4113dSnw141292 } 651c5c4113dSnw141292 652c5c4113dSnw141292 if (db) 653c5c4113dSnw141292 (void) sqlite_close(db); 654c5c4113dSnw141292 *result = idmap_stat4prot(*result); 655c5c4113dSnw141292 return (TRUE); 656c5c4113dSnw141292 } 657c5c4113dSnw141292 658c5c4113dSnw141292 659c5c4113dSnw141292 /* ARGSUSED */ 660c5c4113dSnw141292 bool_t 661c5c4113dSnw141292 idmap_get_mapped_id_by_name_1_svc(idmap_mapping request, 662c5c4113dSnw141292 idmap_mappings_res *result, struct svc_req *rqstp) { 663c5c4113dSnw141292 sqlite *cache = NULL, *db = NULL; 664c5c4113dSnw141292 665c5c4113dSnw141292 /* Init */ 666c5c4113dSnw141292 (void) memset(result, 0, sizeof (*result)); 667c5c4113dSnw141292 668c5c4113dSnw141292 /* Get cache handle */ 669c5c4113dSnw141292 result->retcode = get_cache_handle(&cache); 670c5c4113dSnw141292 if (result->retcode != IDMAP_SUCCESS) 671c5c4113dSnw141292 goto out; 672c5c4113dSnw141292 673c5c4113dSnw141292 /* Get db handle */ 674c5c4113dSnw141292 result->retcode = get_db_handle(&db); 675c5c4113dSnw141292 if (result->retcode != IDMAP_SUCCESS) 676c5c4113dSnw141292 goto out; 677c5c4113dSnw141292 678c5c4113dSnw141292 /* Allocate result */ 679c5c4113dSnw141292 result->mappings.mappings_val = calloc(1, sizeof (idmap_mapping)); 680c5c4113dSnw141292 if (result->mappings.mappings_val == NULL) { 681c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 682c5c4113dSnw141292 result->retcode = IDMAP_ERR_MEMORY; 683c5c4113dSnw141292 goto out; 684c5c4113dSnw141292 } 685c5c4113dSnw141292 result->mappings.mappings_len = 1; 686c5c4113dSnw141292 687c5c4113dSnw141292 if (IS_REQUEST_SID(request)) { 688c5c4113dSnw141292 result->retcode = get_w2u_mapping( 689c5c4113dSnw141292 cache, 690c5c4113dSnw141292 db, 691c5c4113dSnw141292 &request, 692c5c4113dSnw141292 result->mappings.mappings_val); 693c5c4113dSnw141292 } else if (IS_REQUEST_UID(request)) { 694c5c4113dSnw141292 result->retcode = get_u2w_mapping( 695c5c4113dSnw141292 cache, 696c5c4113dSnw141292 db, 697c5c4113dSnw141292 &request, 698c5c4113dSnw141292 result->mappings.mappings_val, 699c5c4113dSnw141292 1); 700c5c4113dSnw141292 } else if (IS_REQUEST_GID(request)) { 701c5c4113dSnw141292 result->retcode = get_u2w_mapping( 702c5c4113dSnw141292 cache, 703c5c4113dSnw141292 db, 704c5c4113dSnw141292 &request, 705c5c4113dSnw141292 result->mappings.mappings_val, 706c5c4113dSnw141292 0); 707c5c4113dSnw141292 } else { 708c5c4113dSnw141292 result->retcode = IDMAP_ERR_IDTYPE; 709c5c4113dSnw141292 } 710c5c4113dSnw141292 711c5c4113dSnw141292 out: 712c5c4113dSnw141292 if (IDMAP_FATAL_ERROR(result->retcode)) { 713c5c4113dSnw141292 xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 714c5c4113dSnw141292 result->mappings.mappings_len = 0; 715c5c4113dSnw141292 result->mappings.mappings_val = NULL; 716c5c4113dSnw141292 } 717c5c4113dSnw141292 if (cache) 718c5c4113dSnw141292 (void) sqlite_close(cache); 719c5c4113dSnw141292 if (db) 720c5c4113dSnw141292 (void) sqlite_close(db); 721c5c4113dSnw141292 result->retcode = idmap_stat4prot(result->retcode); 722c5c4113dSnw141292 return (TRUE); 723c5c4113dSnw141292 } 724c5c4113dSnw141292 725c5c4113dSnw141292 726c5c4113dSnw141292 /* ARGSUSED */ 727c5c4113dSnw141292 int 728c5c4113dSnw141292 idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, 729c5c4113dSnw141292 caddr_t result) { 730c5c4113dSnw141292 (void) xdr_free(xdr_result, result); 731c5c4113dSnw141292 return (TRUE); 732c5c4113dSnw141292 } 733