xref: /titanic_50/usr/src/cmd/idmap/idmapd/dbutils.c (revision 2b4a78020b9c38d1b95e2f3fefa6d6e4be382d1f)
1c5c4113dSnw141292 /*
2c5c4113dSnw141292  * CDDL HEADER START
3c5c4113dSnw141292  *
4c5c4113dSnw141292  * The contents of this file are subject to the terms of the
5c5c4113dSnw141292  * Common Development and Distribution License (the "License").
6c5c4113dSnw141292  * You may not use this file except in compliance with the License.
7c5c4113dSnw141292  *
8c5c4113dSnw141292  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9c5c4113dSnw141292  * or http://www.opensolaris.org/os/licensing.
10c5c4113dSnw141292  * See the License for the specific language governing permissions
11c5c4113dSnw141292  * and limitations under the License.
12c5c4113dSnw141292  *
13c5c4113dSnw141292  * When distributing Covered Code, include this CDDL HEADER in each
14c5c4113dSnw141292  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15c5c4113dSnw141292  * If applicable, add the following below this CDDL HEADER, with the
16c5c4113dSnw141292  * fields enclosed by brackets "[]" replaced with your own identifying
17c5c4113dSnw141292  * information: Portions Copyright [yyyy] [name of copyright owner]
18c5c4113dSnw141292  *
19c5c4113dSnw141292  * CDDL HEADER END
20c5c4113dSnw141292  */
21c5c4113dSnw141292 /*
22042addd6Sbaban  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23c5c4113dSnw141292  * Use is subject to license terms.
24c5c4113dSnw141292  */
25c5c4113dSnw141292 
26c5c4113dSnw141292 /*
27c5c4113dSnw141292  * Database related utility routines
28c5c4113dSnw141292  */
29c5c4113dSnw141292 
30c5c4113dSnw141292 #include <stdio.h>
31c5c4113dSnw141292 #include <stdlib.h>
32c5c4113dSnw141292 #include <string.h>
33c5c4113dSnw141292 #include <errno.h>
34c5c4113dSnw141292 #include <sys/types.h>
35c5c4113dSnw141292 #include <sys/stat.h>
36c5c4113dSnw141292 #include <rpc/rpc.h>
37c5c4113dSnw141292 #include <sys/sid.h>
38c5c4113dSnw141292 #include <time.h>
39c5c4113dSnw141292 #include <pwd.h>
40c5c4113dSnw141292 #include <grp.h>
4184decf41Sjp151216 #include <pthread.h>
4284decf41Sjp151216 #include <assert.h>
43cd37da74Snw141292 #include <sys/u8_textprep.h>
44c5c4113dSnw141292 
45c5c4113dSnw141292 #include "idmapd.h"
46c5c4113dSnw141292 #include "adutils.h"
47c5c4113dSnw141292 #include "string.h"
48c5c4113dSnw141292 #include "idmap_priv.h"
49cd37da74Snw141292 #include "schema.h"
50e8c27ec8Sbaban #include "nldaputils.h"
51c5c4113dSnw141292 
5284decf41Sjp151216 
53c5c4113dSnw141292 static idmap_retcode sql_compile_n_step_once(sqlite *, char *,
54c5c4113dSnw141292 		sqlite_vm **, int *, int, const char ***);
55479ac375Sdm199847 static idmap_retcode ad_lookup_one(lookup_state_t *, idmap_mapping *,
56479ac375Sdm199847 		idmap_id_res *);
57e8c27ec8Sbaban static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *);
58e8c27ec8Sbaban static idmap_retcode lookup_cache_name2sid(sqlite *, const char *,
59e8c27ec8Sbaban 		const char *, char **, char **, idmap_rid_t *, int *);
60e8c27ec8Sbaban 
61c5c4113dSnw141292 
62c5c4113dSnw141292 #define	EMPTY_NAME(name)	(*name == 0 || strcmp(name, "\"\"") == 0)
63c5c4113dSnw141292 
64c5c4113dSnw141292 #define	DO_NOT_ALLOC_NEW_ID_MAPPING(req)\
65c5c4113dSnw141292 		(req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC)
66c5c4113dSnw141292 
67c5c4113dSnw141292 #define	AVOID_NAMESERVICE(req)\
68c5c4113dSnw141292 		(req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE)
69c5c4113dSnw141292 
70*2b4a7802SBaban Kenkre #define	ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)\
71*2b4a7802SBaban Kenkre 		(req->flag & IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY)
72*2b4a7802SBaban Kenkre 
73e8c27ec8Sbaban #define	IS_EPHEMERAL(pid)	(pid > INT32_MAX && pid != SENTINEL_PID)
74c5c4113dSnw141292 
75c5c4113dSnw141292 #define	LOCALRID_MIN	1000
76c5c4113dSnw141292 
77c5c4113dSnw141292 
78c5c4113dSnw141292 typedef enum init_db_option {
79c5c4113dSnw141292 	FAIL_IF_CORRUPT = 0,
80c5c4113dSnw141292 	REMOVE_IF_CORRUPT = 1
81c5c4113dSnw141292 } init_db_option_t;
82c5c4113dSnw141292 
8384decf41Sjp151216 /*
84e8c27ec8Sbaban  * Data structure to store well-known SIDs and
85e8c27ec8Sbaban  * associated mappings (if any)
86e8c27ec8Sbaban  */
87e8c27ec8Sbaban typedef struct wksids_table {
88e8c27ec8Sbaban 	const char	*sidprefix;
89e8c27ec8Sbaban 	uint32_t	rid;
90e8c27ec8Sbaban 	const char	*winname;
91e8c27ec8Sbaban 	int		is_wuser;
92e8c27ec8Sbaban 	uid_t		pid;
93e8c27ec8Sbaban 	int		is_user;
94e8c27ec8Sbaban 	int		direction;
95e8c27ec8Sbaban } wksids_table_t;
96e8c27ec8Sbaban 
97e8c27ec8Sbaban /*
9884decf41Sjp151216  * Thread specfic data to hold the database handles so that the
9984decf41Sjp151216  * databaes are not opened and closed for every request. It also
10084decf41Sjp151216  * contains the sqlite busy handler structure.
10184decf41Sjp151216  */
10284decf41Sjp151216 
10384decf41Sjp151216 struct idmap_busy {
10484decf41Sjp151216 	const char *name;
10584decf41Sjp151216 	const int *delays;
10684decf41Sjp151216 	int delay_size;
10784decf41Sjp151216 	int total;
10884decf41Sjp151216 	int sec;
10984decf41Sjp151216 };
11084decf41Sjp151216 
11184decf41Sjp151216 
11284decf41Sjp151216 typedef struct idmap_tsd {
11384decf41Sjp151216 	sqlite *db_db;
11484decf41Sjp151216 	sqlite *cache_db;
11584decf41Sjp151216 	struct idmap_busy cache_busy;
11684decf41Sjp151216 	struct idmap_busy db_busy;
11784decf41Sjp151216 } idmap_tsd_t;
11884decf41Sjp151216 
11984decf41Sjp151216 
12084decf41Sjp151216 
12184decf41Sjp151216 static const int cache_delay_table[] =
12284decf41Sjp151216 		{ 1, 2, 5, 10, 15, 20, 25, 30,  35,  40,
12384decf41Sjp151216 		50,  50, 60, 70, 80, 90, 100};
12484decf41Sjp151216 
12584decf41Sjp151216 static const int db_delay_table[] =
12684decf41Sjp151216 		{ 5, 10, 15, 20, 30,  40,  55,  70, 100};
12784decf41Sjp151216 
12884decf41Sjp151216 
12984decf41Sjp151216 static pthread_key_t	idmap_tsd_key;
13084decf41Sjp151216 
13184decf41Sjp151216 void
13284decf41Sjp151216 idmap_tsd_destroy(void *key)
13384decf41Sjp151216 {
13484decf41Sjp151216 
13584decf41Sjp151216 	idmap_tsd_t	*tsd = (idmap_tsd_t *)key;
13684decf41Sjp151216 	if (tsd) {
13784decf41Sjp151216 		if (tsd->db_db)
13884decf41Sjp151216 			(void) sqlite_close(tsd->db_db);
13984decf41Sjp151216 		if (tsd->cache_db)
14084decf41Sjp151216 			(void) sqlite_close(tsd->cache_db);
14184decf41Sjp151216 		free(tsd);
14284decf41Sjp151216 	}
14384decf41Sjp151216 }
14484decf41Sjp151216 
14584decf41Sjp151216 int
146cd37da74Snw141292 idmap_init_tsd_key(void)
147cd37da74Snw141292 {
14884decf41Sjp151216 	return (pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy));
14984decf41Sjp151216 }
15084decf41Sjp151216 
15184decf41Sjp151216 
15284decf41Sjp151216 
15384decf41Sjp151216 idmap_tsd_t *
15484decf41Sjp151216 idmap_get_tsd(void)
15584decf41Sjp151216 {
15684decf41Sjp151216 	idmap_tsd_t	*tsd;
15784decf41Sjp151216 
15884decf41Sjp151216 	if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) {
15984decf41Sjp151216 		/* No thread specific data so create it */
16084decf41Sjp151216 		if ((tsd = malloc(sizeof (*tsd))) != NULL) {
16184decf41Sjp151216 			/* Initialize thread specific data */
16284decf41Sjp151216 			(void) memset(tsd, 0, sizeof (*tsd));
16384decf41Sjp151216 			/* save the trhread specific data */
16484decf41Sjp151216 			if (pthread_setspecific(idmap_tsd_key, tsd) != 0) {
16584decf41Sjp151216 				/* Can't store key */
16684decf41Sjp151216 				free(tsd);
16784decf41Sjp151216 				tsd = NULL;
16884decf41Sjp151216 			}
16984decf41Sjp151216 		} else {
17084decf41Sjp151216 			tsd = NULL;
17184decf41Sjp151216 		}
17284decf41Sjp151216 	}
17384decf41Sjp151216 
17484decf41Sjp151216 	return (tsd);
17584decf41Sjp151216 }
17684decf41Sjp151216 
177cd37da74Snw141292 /*
178cd37da74Snw141292  * A simple wrapper around u8_textprep_str() that returns the Unicode
179cd37da74Snw141292  * lower-case version of some string.  The result must be freed.
180cd37da74Snw141292  */
181cd37da74Snw141292 char *
182cd37da74Snw141292 tolower_u8(const char *s)
183cd37da74Snw141292 {
184cd37da74Snw141292 	char *res = NULL;
185cd37da74Snw141292 	char *outs;
186cd37da74Snw141292 	size_t inlen, outlen, inbytesleft, outbytesleft;
187cd37da74Snw141292 	int rc, err;
188cd37da74Snw141292 
189cd37da74Snw141292 	/*
190cd37da74Snw141292 	 * u8_textprep_str() does not allocate memory.  The input and
191cd37da74Snw141292 	 * output buffers may differ in size (though that would be more
192cd37da74Snw141292 	 * likely when normalization is done).  We have to loop over it...
193cd37da74Snw141292 	 *
194cd37da74Snw141292 	 * To improve the chances that we can avoid looping we add 10
195cd37da74Snw141292 	 * bytes of output buffer room the first go around.
196cd37da74Snw141292 	 */
197cd37da74Snw141292 	inlen = inbytesleft = strlen(s);
198cd37da74Snw141292 	outlen = outbytesleft = inlen + 10;
199cd37da74Snw141292 	if ((res = malloc(outlen)) == NULL)
200cd37da74Snw141292 		return (NULL);
201cd37da74Snw141292 	outs = res;
202cd37da74Snw141292 
203cd37da74Snw141292 	while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs,
204cd37da74Snw141292 	    &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 &&
205cd37da74Snw141292 	    err == E2BIG) {
206cd37da74Snw141292 		if ((res = realloc(res, outlen + inbytesleft)) == NULL)
207cd37da74Snw141292 			return (NULL);
208cd37da74Snw141292 		/* adjust input/output buffer pointers */
209cd37da74Snw141292 		s += (inlen - inbytesleft);
210cd37da74Snw141292 		outs = res + outlen - outbytesleft;
211cd37da74Snw141292 		/* adjust outbytesleft and outlen */
212cd37da74Snw141292 		outlen += inbytesleft;
213cd37da74Snw141292 		outbytesleft += inbytesleft;
214cd37da74Snw141292 	}
215cd37da74Snw141292 
216cd37da74Snw141292 	if (rc < 0) {
217cd37da74Snw141292 		free(res);
218cd37da74Snw141292 		res = NULL;
219cd37da74Snw141292 		return (NULL);
220cd37da74Snw141292 	}
221cd37da74Snw141292 
222cd37da74Snw141292 	res[outlen - outbytesleft] = '\0';
223cd37da74Snw141292 
224cd37da74Snw141292 	return (res);
225cd37da74Snw141292 }
226cd37da74Snw141292 
227cd37da74Snw141292 static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
228cd37da74Snw141292 	const char *while_doing);
229cd37da74Snw141292 
230c5c4113dSnw141292 
231c5c4113dSnw141292 /*
232c5c4113dSnw141292  * Initialize 'dbname' using 'sql'
233c5c4113dSnw141292  */
234cd37da74Snw141292 static
235cd37da74Snw141292 int
236cd37da74Snw141292 init_db_instance(const char *dbname, int version,
237cd37da74Snw141292 	const char *detect_version_sql, char * const *sql,
238cd37da74Snw141292 	init_db_option_t opt, int *created, int *upgraded)
239c5c4113dSnw141292 {
240cd37da74Snw141292 	int rc, curr_version;
241cd37da74Snw141292 	int tries = 1;
242cd37da74Snw141292 	int prio = LOG_NOTICE;
243c5c4113dSnw141292 	sqlite *db = NULL;
244cd37da74Snw141292 	char *errmsg = NULL;
245c5c4113dSnw141292 
246cd37da74Snw141292 	*created = 0;
247cd37da74Snw141292 	*upgraded = 0;
248c5c4113dSnw141292 
249cd37da74Snw141292 	if (opt == REMOVE_IF_CORRUPT)
250cd37da74Snw141292 		tries = 3;
251cd37da74Snw141292 
252cd37da74Snw141292 rinse_repeat:
253cd37da74Snw141292 	if (tries == 0) {
254cd37da74Snw141292 		idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname);
255c5c4113dSnw141292 		return (-1);
256cd37da74Snw141292 	}
257cd37da74Snw141292 	if (tries-- == 1)
258cd37da74Snw141292 		/* Last try, log errors */
259cd37da74Snw141292 		prio = LOG_ERR;
260c5c4113dSnw141292 
261cd37da74Snw141292 	db = sqlite_open(dbname, 0600, &errmsg);
262cd37da74Snw141292 	if (db == NULL) {
263cd37da74Snw141292 		idmapdlog(prio, "Error creating database %s (%s)",
264cd37da74Snw141292 		    dbname, CHECK_NULL(errmsg));
265cd37da74Snw141292 		sqlite_freemem(errmsg);
266cd37da74Snw141292 		if (opt == REMOVE_IF_CORRUPT)
267c5c4113dSnw141292 			(void) unlink(dbname);
268cd37da74Snw141292 		goto rinse_repeat;
269c5c4113dSnw141292 	}
270c5c4113dSnw141292 
271c5c4113dSnw141292 	sqlite_busy_timeout(db, 3000);
272cd37da74Snw141292 
273cd37da74Snw141292 	/* Detect current version of schema in the db, if any */
274cd37da74Snw141292 	curr_version = 0;
275cd37da74Snw141292 	if (detect_version_sql != NULL) {
276cd37da74Snw141292 		char *end, **results;
277cd37da74Snw141292 		int nrow;
278cd37da74Snw141292 
279cd37da74Snw141292 #ifdef	IDMAPD_DEBUG
280cd37da74Snw141292 		(void) fprintf(stderr, "Schema version detection SQL: %s\n",
281cd37da74Snw141292 		    detect_version_sql);
282cd37da74Snw141292 #endif	/* IDMAPD_DEBUG */
283cd37da74Snw141292 		rc = sqlite_get_table(db, detect_version_sql, &results,
284cd37da74Snw141292 		    &nrow, NULL, &errmsg);
285cd37da74Snw141292 		if (rc != SQLITE_OK) {
286cd37da74Snw141292 			idmapdlog(prio,
287cd37da74Snw141292 			    "Error detecting schema version of db %s (%s)",
288cd37da74Snw141292 			    dbname, errmsg);
289cd37da74Snw141292 			sqlite_freemem(errmsg);
290cd37da74Snw141292 			sqlite_free_table(results);
291c5c4113dSnw141292 			sqlite_close(db);
292cd37da74Snw141292 			return (-1);
293cd37da74Snw141292 		}
294cd37da74Snw141292 		if (nrow != 1) {
295cd37da74Snw141292 			idmapdlog(prio,
296cd37da74Snw141292 			    "Error detecting schema version of db %s", dbname);
297cd37da74Snw141292 			sqlite_close(db);
298cd37da74Snw141292 			sqlite_free_table(results);
299cd37da74Snw141292 			return (-1);
300cd37da74Snw141292 		}
301cd37da74Snw141292 		curr_version = strtol(results[1], &end, 10);
302cd37da74Snw141292 		sqlite_free_table(results);
303c5c4113dSnw141292 	}
304c5c4113dSnw141292 
305cd37da74Snw141292 	if (curr_version < 0) {
306cd37da74Snw141292 		if (opt == REMOVE_IF_CORRUPT)
307cd37da74Snw141292 			(void) unlink(dbname);
308cd37da74Snw141292 		goto rinse_repeat;
309c5c4113dSnw141292 	}
310c5c4113dSnw141292 
311cd37da74Snw141292 	if (curr_version == version)
312cd37da74Snw141292 		goto done;
313cd37da74Snw141292 
314cd37da74Snw141292 	/* Install or upgrade schema */
315cd37da74Snw141292 #ifdef	IDMAPD_DEBUG
316cd37da74Snw141292 	(void) fprintf(stderr, "Schema init/upgrade SQL: %s\n",
317cd37da74Snw141292 	    sql[curr_version]);
318cd37da74Snw141292 #endif	/* IDMAPD_DEBUG */
319cd37da74Snw141292 	rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname,
320cd37da74Snw141292 	    (curr_version == 0) ? "installing schema" : "upgrading schema");
321cd37da74Snw141292 	if (rc != 0) {
322cd37da74Snw141292 		idmapdlog(prio, "Error %s schema for db %s", dbname,
323cd37da74Snw141292 		    (curr_version == 0) ? "installing schema" :
324cd37da74Snw141292 		    "upgrading schema");
325cd37da74Snw141292 		if (opt == REMOVE_IF_CORRUPT)
326cd37da74Snw141292 			(void) unlink(dbname);
327cd37da74Snw141292 		goto rinse_repeat;
328c5c4113dSnw141292 	}
329c5c4113dSnw141292 
330cd37da74Snw141292 	*upgraded = (curr_version > 0);
331cd37da74Snw141292 	*created = (curr_version == 0);
332cd37da74Snw141292 
333cd37da74Snw141292 done:
334c5c4113dSnw141292 	(void) sqlite_close(db);
335cd37da74Snw141292 	return (0);
336c5c4113dSnw141292 }
337c5c4113dSnw141292 
33884decf41Sjp151216 
33984decf41Sjp151216 /*
34084decf41Sjp151216  * This is the SQLite database busy handler that retries the SQL
34184decf41Sjp151216  * operation until it is successful.
34284decf41Sjp151216  */
34384decf41Sjp151216 int
34484decf41Sjp151216 /* LINTED E_FUNC_ARG_UNUSED */
34584decf41Sjp151216 idmap_sqlite_busy_handler(void *arg, const char *table_name, int count)
34684decf41Sjp151216 {
34784decf41Sjp151216 	struct idmap_busy	*busy = arg;
34884decf41Sjp151216 	int			delay;
34984decf41Sjp151216 	struct timespec		rqtp;
35084decf41Sjp151216 
35184decf41Sjp151216 	if (count == 1)  {
35284decf41Sjp151216 		busy->total = 0;
35384decf41Sjp151216 		busy->sec = 2;
35484decf41Sjp151216 	}
35584decf41Sjp151216 	if (busy->total > 1000 * busy->sec) {
3562b3ecdebSjp151216 		idmapdlog(LOG_DEBUG,
35784decf41Sjp151216 		    "Thread %d waited %d sec for the %s database",
35884decf41Sjp151216 		    pthread_self(), busy->sec, busy->name);
35984decf41Sjp151216 		busy->sec++;
36084decf41Sjp151216 	}
36184decf41Sjp151216 
36284decf41Sjp151216 	if (count <= busy->delay_size) {
36384decf41Sjp151216 		delay = busy->delays[count-1];
36484decf41Sjp151216 	} else {
36584decf41Sjp151216 		delay = busy->delays[busy->delay_size - 1];
36684decf41Sjp151216 	}
36784decf41Sjp151216 	busy->total += delay;
36884decf41Sjp151216 	rqtp.tv_sec = 0;
36984decf41Sjp151216 	rqtp.tv_nsec = delay * (NANOSEC / MILLISEC);
37084decf41Sjp151216 	(void) nanosleep(&rqtp, NULL);
37184decf41Sjp151216 	return (1);
37284decf41Sjp151216 }
37384decf41Sjp151216 
37484decf41Sjp151216 
375c5c4113dSnw141292 /*
376c5c4113dSnw141292  * Get the database handle
377c5c4113dSnw141292  */
378c5c4113dSnw141292 idmap_retcode
379cd37da74Snw141292 get_db_handle(sqlite **db)
380cd37da74Snw141292 {
381c5c4113dSnw141292 	char		*errmsg;
38284decf41Sjp151216 	idmap_tsd_t	*tsd;
383c5c4113dSnw141292 
384c5c4113dSnw141292 	/*
38584decf41Sjp151216 	 * Retrieve the db handle from thread-specific storage
386c5c4113dSnw141292 	 * If none exists, open and store in thread-specific storage.
387c5c4113dSnw141292 	 */
38884decf41Sjp151216 	if ((tsd = idmap_get_tsd()) == NULL) {
38984decf41Sjp151216 		idmapdlog(LOG_ERR,
390cd37da74Snw141292 		    "Error getting thread specific data for %s", IDMAP_DBNAME);
39184decf41Sjp151216 		return (IDMAP_ERR_MEMORY);
39284decf41Sjp151216 	}
393c5c4113dSnw141292 
39484decf41Sjp151216 	if (tsd->db_db == NULL) {
39584decf41Sjp151216 		tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg);
39684decf41Sjp151216 		if (tsd->db_db == NULL) {
397cd37da74Snw141292 			idmapdlog(LOG_ERR, "Error opening database %s (%s)",
398c5c4113dSnw141292 			    IDMAP_DBNAME, CHECK_NULL(errmsg));
399c5c4113dSnw141292 			sqlite_freemem(errmsg);
400cd37da74Snw141292 			return (IDMAP_ERR_DB);
401c5c4113dSnw141292 		}
402cd37da74Snw141292 
40384decf41Sjp151216 		tsd->db_busy.name = IDMAP_DBNAME;
40484decf41Sjp151216 		tsd->db_busy.delays = db_delay_table;
40584decf41Sjp151216 		tsd->db_busy.delay_size = sizeof (db_delay_table) /
40684decf41Sjp151216 		    sizeof (int);
40784decf41Sjp151216 		sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler,
40884decf41Sjp151216 		    &tsd->db_busy);
40984decf41Sjp151216 	}
41084decf41Sjp151216 	*db = tsd->db_db;
411c5c4113dSnw141292 	return (IDMAP_SUCCESS);
412c5c4113dSnw141292 }
413c5c4113dSnw141292 
414c5c4113dSnw141292 /*
415c5c4113dSnw141292  * Get the cache handle
416c5c4113dSnw141292  */
417c5c4113dSnw141292 idmap_retcode
418cd37da74Snw141292 get_cache_handle(sqlite **cache)
419cd37da74Snw141292 {
420c5c4113dSnw141292 	char		*errmsg;
42184decf41Sjp151216 	idmap_tsd_t	*tsd;
422c5c4113dSnw141292 
423c5c4113dSnw141292 	/*
42484decf41Sjp151216 	 * Retrieve the db handle from thread-specific storage
425c5c4113dSnw141292 	 * If none exists, open and store in thread-specific storage.
426c5c4113dSnw141292 	 */
42784decf41Sjp151216 	if ((tsd = idmap_get_tsd()) == NULL) {
428cd37da74Snw141292 		idmapdlog(LOG_ERR, "Error getting thread specific data for %s",
42984decf41Sjp151216 		    IDMAP_DBNAME);
43084decf41Sjp151216 		return (IDMAP_ERR_MEMORY);
43184decf41Sjp151216 	}
432c5c4113dSnw141292 
43384decf41Sjp151216 	if (tsd->cache_db == NULL) {
43484decf41Sjp151216 		tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg);
43584decf41Sjp151216 		if (tsd->cache_db == NULL) {
436cd37da74Snw141292 			idmapdlog(LOG_ERR, "Error opening database %s (%s)",
437c5c4113dSnw141292 			    IDMAP_CACHENAME, CHECK_NULL(errmsg));
438c5c4113dSnw141292 			sqlite_freemem(errmsg);
439cd37da74Snw141292 			return (IDMAP_ERR_DB);
440c5c4113dSnw141292 		}
441cd37da74Snw141292 
44284decf41Sjp151216 		tsd->cache_busy.name = IDMAP_CACHENAME;
44384decf41Sjp151216 		tsd->cache_busy.delays = cache_delay_table;
44484decf41Sjp151216 		tsd->cache_busy.delay_size = sizeof (cache_delay_table) /
44584decf41Sjp151216 		    sizeof (int);
44684decf41Sjp151216 		sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler,
44784decf41Sjp151216 		    &tsd->cache_busy);
44884decf41Sjp151216 	}
44984decf41Sjp151216 	*cache = tsd->cache_db;
450c5c4113dSnw141292 	return (IDMAP_SUCCESS);
451c5c4113dSnw141292 }
452c5c4113dSnw141292 
453c5c4113dSnw141292 /*
454c5c4113dSnw141292  * Initialize cache and db
455c5c4113dSnw141292  */
456c5c4113dSnw141292 int
457cd37da74Snw141292 init_dbs()
458cd37da74Snw141292 {
45948258c6bSjp151216 	char *sql[4];
460cd37da74Snw141292 	int created, upgraded;
461cd37da74Snw141292 
462c5c4113dSnw141292 	/* name-based mappings; probably OK to blow away in a pinch(?) */
463cd37da74Snw141292 	sql[0] = DB_INSTALL_SQL;
464cd37da74Snw141292 	sql[1] = DB_UPGRADE_FROM_v1_SQL;
46548258c6bSjp151216 	sql[2] = NULL;
466cd37da74Snw141292 
467cd37da74Snw141292 	if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql,
468cd37da74Snw141292 	    FAIL_IF_CORRUPT, &created, &upgraded) < 0)
469c5c4113dSnw141292 		return (-1);
470c5c4113dSnw141292 
471c5c4113dSnw141292 	/* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */
472cd37da74Snw141292 	sql[0] = CACHE_INSTALL_SQL;
473cd37da74Snw141292 	sql[1] = CACHE_UPGRADE_FROM_v1_SQL;
47448258c6bSjp151216 	sql[2] = CACHE_UPGRADE_FROM_v2_SQL;
47548258c6bSjp151216 	sql[3] = NULL;
47648258c6bSjp151216 
477cd37da74Snw141292 	if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL,
478cd37da74Snw141292 	    sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0)
479c5c4113dSnw141292 		return (-1);
480c5c4113dSnw141292 
481cd37da74Snw141292 	_idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0;
482cd37da74Snw141292 
483c5c4113dSnw141292 	return (0);
484c5c4113dSnw141292 }
485c5c4113dSnw141292 
486c5c4113dSnw141292 /*
487c5c4113dSnw141292  * Finalize databases
488c5c4113dSnw141292  */
489c5c4113dSnw141292 void
490cd37da74Snw141292 fini_dbs()
491cd37da74Snw141292 {
492c5c4113dSnw141292 }
493c5c4113dSnw141292 
494c5c4113dSnw141292 /*
495e8c27ec8Sbaban  * This table is a listing of status codes that will be returned to the
496c5c4113dSnw141292  * client when a SQL command fails with the corresponding error message.
497c5c4113dSnw141292  */
498c5c4113dSnw141292 static msg_table_t sqlmsgtable[] = {
49962c60062Sbaban 	{IDMAP_ERR_U2W_NAMERULE_CONFLICT,
500c5c4113dSnw141292 	"columns unixname, is_user, u2w_order are not unique"},
50162c60062Sbaban 	{IDMAP_ERR_W2U_NAMERULE_CONFLICT,
502cd37da74Snw141292 	"columns winname, windomain, is_user, is_wuser, w2u_order are not"
503cd37da74Snw141292 	" unique"},
504cd37da74Snw141292 	{IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"},
505c5c4113dSnw141292 	{-1, NULL}
506c5c4113dSnw141292 };
507c5c4113dSnw141292 
508c5c4113dSnw141292 /*
509c5c4113dSnw141292  * idmapd's version of string2stat to map SQLite messages to
510c5c4113dSnw141292  * status codes
511c5c4113dSnw141292  */
512c5c4113dSnw141292 idmap_retcode
513cd37da74Snw141292 idmapd_string2stat(const char *msg)
514cd37da74Snw141292 {
515c5c4113dSnw141292 	int i;
516c5c4113dSnw141292 	for (i = 0; sqlmsgtable[i].msg; i++) {
517c5c4113dSnw141292 		if (strcasecmp(sqlmsgtable[i].msg, msg) == 0)
518c5c4113dSnw141292 			return (sqlmsgtable[i].retcode);
519c5c4113dSnw141292 	}
520c5c4113dSnw141292 	return (IDMAP_ERR_OTHER);
521c5c4113dSnw141292 }
522c5c4113dSnw141292 
523c5c4113dSnw141292 /*
524cd37da74Snw141292  * Executes some SQL in a transaction.
525cd37da74Snw141292  *
526cd37da74Snw141292  * Returns 0 on success, -1 if it failed but the rollback succeeded, -2
527cd37da74Snw141292  * if the rollback failed.
528cd37da74Snw141292  */
529cd37da74Snw141292 static
530cd37da74Snw141292 int
531cd37da74Snw141292 sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname,
532cd37da74Snw141292 	const char *while_doing)
533cd37da74Snw141292 {
534cd37da74Snw141292 	char		*errmsg = NULL;
535cd37da74Snw141292 	int		rc;
536cd37da74Snw141292 
537cd37da74Snw141292 	rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg);
538cd37da74Snw141292 	if (rc != SQLITE_OK) {
539cd37da74Snw141292 		idmapdlog(LOG_ERR, "Begin transaction failed (%s) "
540cd37da74Snw141292 		    "while %s (%s)", errmsg, while_doing, dbname);
541cd37da74Snw141292 		sqlite_freemem(errmsg);
542cd37da74Snw141292 		return (-1);
543cd37da74Snw141292 	}
544cd37da74Snw141292 
545cd37da74Snw141292 	rc = sqlite_exec(db, sql, NULL, NULL, &errmsg);
546cd37da74Snw141292 	if (rc != SQLITE_OK) {
547cd37da74Snw141292 		idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg,
548cd37da74Snw141292 		    while_doing, dbname);
549cd37da74Snw141292 		sqlite_freemem(errmsg);
550cd37da74Snw141292 		errmsg = NULL;
551cd37da74Snw141292 		goto rollback;
552cd37da74Snw141292 	}
553cd37da74Snw141292 
554cd37da74Snw141292 	rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg);
555cd37da74Snw141292 	if (rc == SQLITE_OK) {
556cd37da74Snw141292 		sqlite_freemem(errmsg);
557cd37da74Snw141292 		return (0);
558cd37da74Snw141292 	}
559cd37da74Snw141292 
560cd37da74Snw141292 	idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)",
561cd37da74Snw141292 	    errmsg, while_doing, dbname);
562cd37da74Snw141292 	sqlite_freemem(errmsg);
563cd37da74Snw141292 	errmsg = NULL;
564cd37da74Snw141292 
565cd37da74Snw141292 rollback:
566cd37da74Snw141292 	rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg);
567cd37da74Snw141292 	if (rc != SQLITE_OK) {
568cd37da74Snw141292 		idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)",
569cd37da74Snw141292 		    errmsg, while_doing, dbname);
570cd37da74Snw141292 		sqlite_freemem(errmsg);
571cd37da74Snw141292 		return (-2);
572cd37da74Snw141292 	}
573cd37da74Snw141292 	sqlite_freemem(errmsg);
574cd37da74Snw141292 
575cd37da74Snw141292 	return (-1);
576cd37da74Snw141292 }
577cd37da74Snw141292 
578cd37da74Snw141292 /*
579c5c4113dSnw141292  * Execute the given SQL statment without using any callbacks
580c5c4113dSnw141292  */
581c5c4113dSnw141292 idmap_retcode
58271590c90Snw141292 sql_exec_no_cb(sqlite *db, const char *dbname, char *sql)
583cd37da74Snw141292 {
584c5c4113dSnw141292 	char		*errmsg = NULL;
58584decf41Sjp151216 	int		r;
586c5c4113dSnw141292 	idmap_retcode	retcode;
587c5c4113dSnw141292 
588c5c4113dSnw141292 	r = sqlite_exec(db, sql, NULL, NULL, &errmsg);
58984decf41Sjp151216 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
590c5c4113dSnw141292 
591c5c4113dSnw141292 	if (r != SQLITE_OK) {
59271590c90Snw141292 		idmapdlog(LOG_ERR, "Database error on %s while executing %s "
59371590c90Snw141292 		    "(%s)", dbname, sql, CHECK_NULL(errmsg));
594c5c4113dSnw141292 		retcode = idmapd_string2stat(errmsg);
59562c60062Sbaban 		if (errmsg != NULL)
596c5c4113dSnw141292 			sqlite_freemem(errmsg);
597c5c4113dSnw141292 		return (retcode);
598c5c4113dSnw141292 	}
599c5c4113dSnw141292 
600c5c4113dSnw141292 	return (IDMAP_SUCCESS);
601c5c4113dSnw141292 }
602c5c4113dSnw141292 
603c5c4113dSnw141292 /*
604c5c4113dSnw141292  * Generate expression that can be used in WHERE statements.
605c5c4113dSnw141292  * Examples:
606c5c4113dSnw141292  * <prefix> <col>      <op> <value>   <suffix>
607c5c4113dSnw141292  * ""       "unixuser" "="  "foo" "AND"
608c5c4113dSnw141292  */
609c5c4113dSnw141292 idmap_retcode
610cd37da74Snw141292 gen_sql_expr_from_rule(idmap_namerule *rule, char **out)
611cd37da74Snw141292 {
612cd37da74Snw141292 	char	*s_windomain = NULL, *s_winname = NULL;
613cd37da74Snw141292 	char	*s_unixname = NULL;
614cd37da74Snw141292 	char	*lower_winname;
615cd37da74Snw141292 	int	retcode = IDMAP_SUCCESS;
616cd37da74Snw141292 
617c5c4113dSnw141292 	if (out == NULL)
618c5c4113dSnw141292 		return (IDMAP_ERR_ARG);
619c5c4113dSnw141292 
620c5c4113dSnw141292 
621cd37da74Snw141292 	if (!EMPTY_STRING(rule->windomain)) {
622cd37da74Snw141292 		s_windomain =  sqlite_mprintf("AND windomain = %Q ",
623cd37da74Snw141292 		    rule->windomain);
624cd37da74Snw141292 		if (s_windomain == NULL) {
625cd37da74Snw141292 			retcode = IDMAP_ERR_MEMORY;
626cd37da74Snw141292 			goto out;
627c5c4113dSnw141292 		}
628cd37da74Snw141292 	}
629cd37da74Snw141292 
630cd37da74Snw141292 	if (!EMPTY_STRING(rule->winname)) {
631cd37da74Snw141292 		if ((lower_winname = tolower_u8(rule->winname)) == NULL)
632cd37da74Snw141292 			lower_winname = rule->winname;
633cd37da74Snw141292 		s_winname = sqlite_mprintf(
634cd37da74Snw141292 		    "AND winname = %Q AND is_wuser = %d ",
635cd37da74Snw141292 		    lower_winname, rule->is_wuser ? 1 : 0);
636cd37da74Snw141292 		if (lower_winname != rule->winname)
637cd37da74Snw141292 			free(lower_winname);
638cd37da74Snw141292 		if (s_winname == NULL) {
639cd37da74Snw141292 			retcode = IDMAP_ERR_MEMORY;
640cd37da74Snw141292 			goto out;
641cd37da74Snw141292 		}
642cd37da74Snw141292 	}
643cd37da74Snw141292 
644cd37da74Snw141292 	if (!EMPTY_STRING(rule->unixname)) {
645cd37da74Snw141292 		s_unixname = sqlite_mprintf(
646cd37da74Snw141292 		    "AND unixname = %Q AND is_user = %d ",
647cd37da74Snw141292 		    rule->unixname, rule->is_user ? 1 : 0);
648cd37da74Snw141292 		if (s_unixname == NULL) {
649cd37da74Snw141292 			retcode = IDMAP_ERR_MEMORY;
650cd37da74Snw141292 			goto out;
651cd37da74Snw141292 		}
652cd37da74Snw141292 	}
653cd37da74Snw141292 
654cd37da74Snw141292 	*out = sqlite_mprintf("%s %s %s",
655cd37da74Snw141292 	    s_windomain ? s_windomain : "",
656cd37da74Snw141292 	    s_winname ? s_winname : "",
657cd37da74Snw141292 	    s_unixname ? s_unixname : "");
658cd37da74Snw141292 
659cd37da74Snw141292 	if (*out == NULL) {
660cd37da74Snw141292 		retcode = IDMAP_ERR_MEMORY;
661cd37da74Snw141292 		idmapdlog(LOG_ERR, "Out of memory");
662cd37da74Snw141292 		goto out;
663cd37da74Snw141292 	}
664cd37da74Snw141292 
665cd37da74Snw141292 out:
666cd37da74Snw141292 	if (s_windomain != NULL)
667cd37da74Snw141292 		sqlite_freemem(s_windomain);
668cd37da74Snw141292 	if (s_winname != NULL)
669cd37da74Snw141292 		sqlite_freemem(s_winname);
670cd37da74Snw141292 	if (s_unixname != NULL)
671cd37da74Snw141292 		sqlite_freemem(s_unixname);
672cd37da74Snw141292 
673cd37da74Snw141292 	return (retcode);
674cd37da74Snw141292 }
675cd37da74Snw141292 
676cd37da74Snw141292 
677c5c4113dSnw141292 
678c5c4113dSnw141292 /*
679c5c4113dSnw141292  * Generate and execute SQL statement for LIST RPC calls
680c5c4113dSnw141292  */
681c5c4113dSnw141292 idmap_retcode
68271590c90Snw141292 process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit,
68348258c6bSjp151216 		int flag, list_svc_cb cb, void *result)
684cd37da74Snw141292 {
685c5c4113dSnw141292 	list_cb_data_t	cb_data;
686c5c4113dSnw141292 	char		*errmsg = NULL;
68784decf41Sjp151216 	int		r;
688c5c4113dSnw141292 	idmap_retcode	retcode = IDMAP_ERR_INTERNAL;
689c5c4113dSnw141292 
690c5c4113dSnw141292 	(void) memset(&cb_data, 0, sizeof (cb_data));
691c5c4113dSnw141292 	cb_data.result = result;
692c5c4113dSnw141292 	cb_data.limit = limit;
69348258c6bSjp151216 	cb_data.flag = flag;
694c5c4113dSnw141292 
69584decf41Sjp151216 
696c5c4113dSnw141292 	r = sqlite_exec(db, sql, cb, &cb_data, &errmsg);
69784decf41Sjp151216 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
698c5c4113dSnw141292 	switch (r) {
699c5c4113dSnw141292 	case SQLITE_OK:
700c5c4113dSnw141292 		retcode = IDMAP_SUCCESS;
70184decf41Sjp151216 		break;
70284decf41Sjp151216 
703c5c4113dSnw141292 	default:
704c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
70571590c90Snw141292 		idmapdlog(LOG_ERR, "Database error on %s while executing "
70671590c90Snw141292 		    "%s (%s)", dbname, sql, CHECK_NULL(errmsg));
70784decf41Sjp151216 		break;
708c5c4113dSnw141292 	}
70962c60062Sbaban 	if (errmsg != NULL)
710c5c4113dSnw141292 		sqlite_freemem(errmsg);
711c5c4113dSnw141292 	return (retcode);
712c5c4113dSnw141292 }
713c5c4113dSnw141292 
714c5c4113dSnw141292 /*
715c5c4113dSnw141292  * This routine is called by callbacks that process the results of
716c5c4113dSnw141292  * LIST RPC calls to validate data and to allocate memory for
717c5c4113dSnw141292  * the result array.
718c5c4113dSnw141292  */
719c5c4113dSnw141292 idmap_retcode
720c5c4113dSnw141292 validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv,
721cd37da74Snw141292 		int ncol, uchar_t **list, size_t valsize)
722cd37da74Snw141292 {
723c5c4113dSnw141292 	size_t	nsize;
724c5c4113dSnw141292 	void	*tmplist;
725c5c4113dSnw141292 
726c5c4113dSnw141292 	if (cb_data->limit > 0 && cb_data->next == cb_data->limit)
727c5c4113dSnw141292 		return (IDMAP_NEXT);
728c5c4113dSnw141292 
729c5c4113dSnw141292 	if (argc < ncol || argv == NULL) {
730c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Invalid data");
731c5c4113dSnw141292 		return (IDMAP_ERR_INTERNAL);
732c5c4113dSnw141292 	}
733c5c4113dSnw141292 
734c5c4113dSnw141292 	/* alloc in bulk to reduce number of reallocs */
735c5c4113dSnw141292 	if (cb_data->next >= cb_data->len) {
736c5c4113dSnw141292 		nsize = (cb_data->len + SIZE_INCR) * valsize;
737c5c4113dSnw141292 		tmplist = realloc(*list, nsize);
738c5c4113dSnw141292 		if (tmplist == NULL) {
739c5c4113dSnw141292 			idmapdlog(LOG_ERR, "Out of memory");
740c5c4113dSnw141292 			return (IDMAP_ERR_MEMORY);
741c5c4113dSnw141292 		}
742c5c4113dSnw141292 		*list = tmplist;
743c5c4113dSnw141292 		(void) memset(*list + (cb_data->len * valsize), 0,
744c5c4113dSnw141292 		    SIZE_INCR * valsize);
745c5c4113dSnw141292 		cb_data->len += SIZE_INCR;
746c5c4113dSnw141292 	}
747c5c4113dSnw141292 	return (IDMAP_SUCCESS);
748c5c4113dSnw141292 }
749c5c4113dSnw141292 
750cd37da74Snw141292 static
751cd37da74Snw141292 idmap_retcode
752c5c4113dSnw141292 get_namerule_order(char *winname, char *windomain, char *unixname,
753cd37da74Snw141292 	int direction, int is_diagonal, int *w2u_order, int *u2w_order)
754cd37da74Snw141292 {
755c5c4113dSnw141292 	*w2u_order = 0;
756c5c4113dSnw141292 	*u2w_order = 0;
757c5c4113dSnw141292 
758c5c4113dSnw141292 	/*
759c5c4113dSnw141292 	 * Windows to UNIX lookup order:
760c5c4113dSnw141292 	 *  1. winname@domain (or winname) to ""
761c5c4113dSnw141292 	 *  2. winname@domain (or winname) to unixname
762c5c4113dSnw141292 	 *  3. winname@* to ""
763c5c4113dSnw141292 	 *  4. winname@* to unixname
764c5c4113dSnw141292 	 *  5. *@domain (or *) to *
765c5c4113dSnw141292 	 *  6. *@domain (or *) to ""
766c5c4113dSnw141292 	 *  7. *@domain (or *) to unixname
767c5c4113dSnw141292 	 *  8. *@* to *
768c5c4113dSnw141292 	 *  9. *@* to ""
769c5c4113dSnw141292 	 * 10. *@* to unixname
770c5c4113dSnw141292 	 *
771c5c4113dSnw141292 	 * winname is a special case of winname@domain when domain is the
772c5c4113dSnw141292 	 * default domain. Similarly * is a special case of *@domain when
773c5c4113dSnw141292 	 * domain is the default domain.
774c5c4113dSnw141292 	 *
775c5c4113dSnw141292 	 * Note that "" has priority over specific names because "" inhibits
776c5c4113dSnw141292 	 * mappings and traditionally deny rules always had higher priority.
777c5c4113dSnw141292 	 */
778651c0131Sbaban 	if (direction != IDMAP_DIRECTION_U2W) {
779651c0131Sbaban 		/* bi-directional or from windows to unix */
780c5c4113dSnw141292 		if (winname == NULL)
781c5c4113dSnw141292 			return (IDMAP_ERR_W2U_NAMERULE);
782c5c4113dSnw141292 		else if (unixname == NULL)
783c5c4113dSnw141292 			return (IDMAP_ERR_W2U_NAMERULE);
784c5c4113dSnw141292 		else if (EMPTY_NAME(winname))
785c5c4113dSnw141292 			return (IDMAP_ERR_W2U_NAMERULE);
786c5c4113dSnw141292 		else if (*winname == '*' && windomain && *windomain == '*') {
787c5c4113dSnw141292 			if (*unixname == '*')
788c5c4113dSnw141292 				*w2u_order = 8;
789c5c4113dSnw141292 			else if (EMPTY_NAME(unixname))
790c5c4113dSnw141292 				*w2u_order = 9;
791c5c4113dSnw141292 			else /* unixname == name */
792c5c4113dSnw141292 				*w2u_order = 10;
793c5c4113dSnw141292 		} else if (*winname == '*') {
794c5c4113dSnw141292 			if (*unixname == '*')
795c5c4113dSnw141292 				*w2u_order = 5;
796c5c4113dSnw141292 			else if (EMPTY_NAME(unixname))
797c5c4113dSnw141292 				*w2u_order = 6;
798c5c4113dSnw141292 			else /* name */
799c5c4113dSnw141292 				*w2u_order = 7;
80062c60062Sbaban 		} else if (windomain != NULL && *windomain == '*') {
801c5c4113dSnw141292 			/* winname == name */
802c5c4113dSnw141292 			if (*unixname == '*')
803c5c4113dSnw141292 				return (IDMAP_ERR_W2U_NAMERULE);
804c5c4113dSnw141292 			else if (EMPTY_NAME(unixname))
805c5c4113dSnw141292 				*w2u_order = 3;
806c5c4113dSnw141292 			else /* name */
807c5c4113dSnw141292 				*w2u_order = 4;
808c5c4113dSnw141292 		} else  {
809c5c4113dSnw141292 			/* winname == name && windomain == null or name */
810c5c4113dSnw141292 			if (*unixname == '*')
811c5c4113dSnw141292 				return (IDMAP_ERR_W2U_NAMERULE);
812c5c4113dSnw141292 			else if (EMPTY_NAME(unixname))
813c5c4113dSnw141292 				*w2u_order = 1;
814c5c4113dSnw141292 			else /* name */
815c5c4113dSnw141292 				*w2u_order = 2;
816c5c4113dSnw141292 		}
817cd37da74Snw141292 
818c5c4113dSnw141292 	}
819c5c4113dSnw141292 
820c5c4113dSnw141292 	/*
821cd37da74Snw141292 	 * 1. unixname to "", non-diagonal
822cd37da74Snw141292 	 * 2. unixname to winname@domain (or winname), non-diagonal
823cd37da74Snw141292 	 * 3. unixname to "", diagonal
824cd37da74Snw141292 	 * 4. unixname to winname@domain (or winname), diagonal
825cd37da74Snw141292 	 * 5. * to *@domain (or *), non-diagonal
826cd37da74Snw141292 	 * 5. * to *@domain (or *), diagonal
827cd37da74Snw141292 	 * 7. * to ""
828cd37da74Snw141292 	 * 8. * to winname@domain (or winname)
829cd37da74Snw141292 	 * 9. * to "", non-diagonal
830cd37da74Snw141292 	 * 10. * to winname@domain (or winname), diagonal
831c5c4113dSnw141292 	 */
832651c0131Sbaban 	if (direction != IDMAP_DIRECTION_W2U) {
833cd37da74Snw141292 		int diagonal = is_diagonal ? 1 : 0;
834cd37da74Snw141292 
835651c0131Sbaban 		/* bi-directional or from unix to windows */
836c5c4113dSnw141292 		if (unixname == NULL || EMPTY_NAME(unixname))
837c5c4113dSnw141292 			return (IDMAP_ERR_U2W_NAMERULE);
838c5c4113dSnw141292 		else if (winname == NULL)
839c5c4113dSnw141292 			return (IDMAP_ERR_U2W_NAMERULE);
84062c60062Sbaban 		else if (windomain != NULL && *windomain == '*')
841651c0131Sbaban 			return (IDMAP_ERR_U2W_NAMERULE);
842c5c4113dSnw141292 		else if (*unixname == '*') {
843c5c4113dSnw141292 			if (*winname == '*')
844cd37da74Snw141292 				*u2w_order = 5 + diagonal;
845c5c4113dSnw141292 			else if (EMPTY_NAME(winname))
846cd37da74Snw141292 				*u2w_order = 7 + 2 * diagonal;
847c5c4113dSnw141292 			else
848cd37da74Snw141292 				*u2w_order = 8 + 2 * diagonal;
849c5c4113dSnw141292 		} else {
850c5c4113dSnw141292 			if (*winname == '*')
851c5c4113dSnw141292 				return (IDMAP_ERR_U2W_NAMERULE);
852c5c4113dSnw141292 			else if (EMPTY_NAME(winname))
853cd37da74Snw141292 				*u2w_order = 1 + 2 * diagonal;
854c5c4113dSnw141292 			else
855cd37da74Snw141292 				*u2w_order = 2 + 2 * diagonal;
856c5c4113dSnw141292 		}
857c5c4113dSnw141292 	}
858c5c4113dSnw141292 	return (IDMAP_SUCCESS);
859c5c4113dSnw141292 }
860c5c4113dSnw141292 
861c5c4113dSnw141292 /*
862c5c4113dSnw141292  * Generate and execute SQL statement to add name-based mapping rule
863c5c4113dSnw141292  */
864c5c4113dSnw141292 idmap_retcode
865cd37da74Snw141292 add_namerule(sqlite *db, idmap_namerule *rule)
866cd37da74Snw141292 {
867c5c4113dSnw141292 	char		*sql = NULL;
868c5c4113dSnw141292 	idmap_stat	retcode;
8698e228215Sdm199847 	char		*dom = NULL;
870c5c4113dSnw141292 	int		w2u_order, u2w_order;
871c5c4113dSnw141292 	char		w2ubuf[11], u2wbuf[11];
872c5c4113dSnw141292 
8738e228215Sdm199847 	retcode = get_namerule_order(rule->winname, rule->windomain,
874cd37da74Snw141292 	    rule->unixname, rule->direction,
875cd37da74Snw141292 	    rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order);
876c5c4113dSnw141292 	if (retcode != IDMAP_SUCCESS)
877c5c4113dSnw141292 		goto out;
878c5c4113dSnw141292 
879c5c4113dSnw141292 	if (w2u_order)
880c5c4113dSnw141292 		(void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order);
881c5c4113dSnw141292 	if (u2w_order)
882c5c4113dSnw141292 		(void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order);
883c5c4113dSnw141292 
88462c60062Sbaban 	/*
88562c60062Sbaban 	 * For the triggers on namerules table to work correctly:
88662c60062Sbaban 	 * 1) Use NULL instead of 0 for w2u_order and u2w_order
88762c60062Sbaban 	 * 2) Use "" instead of NULL for "no domain"
88862c60062Sbaban 	 */
88962c60062Sbaban 
890e8c27ec8Sbaban 	if (!EMPTY_STRING(rule->windomain))
8918e228215Sdm199847 		dom = rule->windomain;
892cd37da74Snw141292 	else if (lookup_wksids_name2sid(rule->winname, NULL, NULL, NULL, NULL)
89362c60062Sbaban 	    == IDMAP_SUCCESS) {
89462c60062Sbaban 		/* well-known SIDs don't need domain */
89562c60062Sbaban 		dom = "";
89662c60062Sbaban 	}
897c5c4113dSnw141292 
898c5c4113dSnw141292 	RDLOCK_CONFIG();
89962c60062Sbaban 	if (dom == NULL) {
900c8e26105Sjp151216 		if (_idmapdstate.cfg->pgcfg.default_domain)
901c8e26105Sjp151216 			dom = _idmapdstate.cfg->pgcfg.default_domain;
902c5c4113dSnw141292 		else
903c5c4113dSnw141292 			dom = "";
90462c60062Sbaban 	}
90584decf41Sjp151216 	sql = sqlite_mprintf("INSERT into namerules "
906cd37da74Snw141292 	    "(is_user, is_wuser, windomain, winname_display, is_nt4, "
907c5c4113dSnw141292 	    "unixname, w2u_order, u2w_order) "
908cd37da74Snw141292 	    "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);",
909cd37da74Snw141292 	    rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom,
910cd37da74Snw141292 	    rule->winname, rule->is_nt4 ? 1 : 0, rule->unixname,
911cd37da74Snw141292 	    w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL);
912c5c4113dSnw141292 	UNLOCK_CONFIG();
913c5c4113dSnw141292 
914c5c4113dSnw141292 	if (sql == NULL) {
915c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
916c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
917c5c4113dSnw141292 		goto out;
918c5c4113dSnw141292 	}
919c5c4113dSnw141292 
92071590c90Snw141292 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
921c5c4113dSnw141292 
922c5c4113dSnw141292 	if (retcode == IDMAP_ERR_OTHER)
923c5c4113dSnw141292 		retcode = IDMAP_ERR_CFG;
924c5c4113dSnw141292 
925c5c4113dSnw141292 out:
92662c60062Sbaban 	if (sql != NULL)
927c5c4113dSnw141292 		sqlite_freemem(sql);
928c5c4113dSnw141292 	return (retcode);
929c5c4113dSnw141292 }
930c5c4113dSnw141292 
931c5c4113dSnw141292 /*
932c5c4113dSnw141292  * Flush name-based mapping rules
933c5c4113dSnw141292  */
934c5c4113dSnw141292 idmap_retcode
935cd37da74Snw141292 flush_namerules(sqlite *db)
936cd37da74Snw141292 {
937c5c4113dSnw141292 	idmap_stat	retcode;
938c5c4113dSnw141292 
93971590c90Snw141292 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;");
940c5c4113dSnw141292 
941c5c4113dSnw141292 	return (retcode);
942c5c4113dSnw141292 }
943c5c4113dSnw141292 
944c5c4113dSnw141292 /*
945c5c4113dSnw141292  * Generate and execute SQL statement to remove a name-based mapping rule
946c5c4113dSnw141292  */
947c5c4113dSnw141292 idmap_retcode
948cd37da74Snw141292 rm_namerule(sqlite *db, idmap_namerule *rule)
949cd37da74Snw141292 {
950c5c4113dSnw141292 	char		*sql = NULL;
951c5c4113dSnw141292 	idmap_stat	retcode;
952c5c4113dSnw141292 	char		buf[80];
953cd37da74Snw141292 	char		*expr = NULL;
954c5c4113dSnw141292 
9558e228215Sdm199847 	if (rule->direction < 0 && EMPTY_STRING(rule->windomain) &&
9568e228215Sdm199847 	    EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname))
957c5c4113dSnw141292 		return (IDMAP_SUCCESS);
958c5c4113dSnw141292 
959c5c4113dSnw141292 	buf[0] = 0;
960cd37da74Snw141292 
961cd37da74Snw141292 	if (rule->direction == IDMAP_DIRECTION_BI)
962c5c4113dSnw141292 		(void) snprintf(buf, sizeof (buf), "AND w2u_order > 0"
963c5c4113dSnw141292 		    " AND u2w_order > 0");
964cd37da74Snw141292 	else if (rule->direction == IDMAP_DIRECTION_W2U)
965c5c4113dSnw141292 		(void) snprintf(buf, sizeof (buf), "AND w2u_order > 0"
966c5c4113dSnw141292 		    " AND (u2w_order = 0 OR u2w_order ISNULL)");
967cd37da74Snw141292 	else if (rule->direction == IDMAP_DIRECTION_U2W)
968c5c4113dSnw141292 		(void) snprintf(buf, sizeof (buf), "AND u2w_order > 0"
969c5c4113dSnw141292 		    " AND (w2u_order = 0 OR w2u_order ISNULL)");
970c5c4113dSnw141292 
971cd37da74Snw141292 	retcode = gen_sql_expr_from_rule(rule, &expr);
972cd37da74Snw141292 	if (retcode != IDMAP_SUCCESS)
973c5c4113dSnw141292 		goto out;
974c5c4113dSnw141292 
975cd37da74Snw141292 	sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s %s;", expr,
976c5c4113dSnw141292 	    buf);
977c5c4113dSnw141292 
978c5c4113dSnw141292 	if (sql == NULL) {
979c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
980c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
981c5c4113dSnw141292 		goto out;
982c5c4113dSnw141292 	}
983c5c4113dSnw141292 
984cd37da74Snw141292 
98571590c90Snw141292 	retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql);
986c5c4113dSnw141292 
987c5c4113dSnw141292 out:
988cd37da74Snw141292 	if (expr != NULL)
989cd37da74Snw141292 		sqlite_freemem(expr);
99062c60062Sbaban 	if (sql != NULL)
991c5c4113dSnw141292 		sqlite_freemem(sql);
992c5c4113dSnw141292 	return (retcode);
993c5c4113dSnw141292 }
994c5c4113dSnw141292 
995c5c4113dSnw141292 /*
996c5c4113dSnw141292  * Compile the given SQL query and step just once.
997c5c4113dSnw141292  *
998c5c4113dSnw141292  * Input:
999c5c4113dSnw141292  * db  - db handle
1000c5c4113dSnw141292  * sql - SQL statement
1001c5c4113dSnw141292  *
1002c5c4113dSnw141292  * Output:
1003c5c4113dSnw141292  * vm     -  virtual SQL machine
1004c5c4113dSnw141292  * ncol   - number of columns in the result
1005c5c4113dSnw141292  * values - column values
1006c5c4113dSnw141292  *
1007c5c4113dSnw141292  * Return values:
1008c5c4113dSnw141292  * IDMAP_SUCCESS
1009c5c4113dSnw141292  * IDMAP_ERR_NOTFOUND
1010c5c4113dSnw141292  * IDMAP_ERR_INTERNAL
1011c5c4113dSnw141292  */
1012c5c4113dSnw141292 
1013cd37da74Snw141292 static
1014cd37da74Snw141292 idmap_retcode
1015c5c4113dSnw141292 sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol,
1016cd37da74Snw141292 		int reqcol, const char ***values)
1017cd37da74Snw141292 {
1018c5c4113dSnw141292 	char		*errmsg = NULL;
101984decf41Sjp151216 	int		r;
1020c5c4113dSnw141292 
102184decf41Sjp151216 	if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) {
1022cd37da74Snw141292 		idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1023cd37da74Snw141292 		    CHECK_NULL(errmsg));
1024c5c4113dSnw141292 		sqlite_freemem(errmsg);
1025c5c4113dSnw141292 		return (IDMAP_ERR_INTERNAL);
1026c5c4113dSnw141292 	}
1027c5c4113dSnw141292 
1028c5c4113dSnw141292 	r = sqlite_step(*vm, ncol, values, NULL);
102984decf41Sjp151216 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
1030c5c4113dSnw141292 
103184decf41Sjp151216 	if (r == SQLITE_ROW) {
103262c60062Sbaban 		if (ncol != NULL && *ncol < reqcol) {
1033c5c4113dSnw141292 			(void) sqlite_finalize(*vm, NULL);
1034c5c4113dSnw141292 			*vm = NULL;
1035c5c4113dSnw141292 			return (IDMAP_ERR_INTERNAL);
1036c5c4113dSnw141292 		}
1037c5c4113dSnw141292 		/* Caller will call finalize after using the results */
1038c5c4113dSnw141292 		return (IDMAP_SUCCESS);
1039c5c4113dSnw141292 	} else if (r == SQLITE_DONE) {
1040c5c4113dSnw141292 		(void) sqlite_finalize(*vm, NULL);
1041c5c4113dSnw141292 		*vm = NULL;
1042c5c4113dSnw141292 		return (IDMAP_ERR_NOTFOUND);
1043c5c4113dSnw141292 	}
1044c5c4113dSnw141292 
1045c5c4113dSnw141292 	(void) sqlite_finalize(*vm, &errmsg);
1046c5c4113dSnw141292 	*vm = NULL;
1047cd37da74Snw141292 	idmapdlog(LOG_ERR, "Database error during %s (%s)", sql,
1048cd37da74Snw141292 	    CHECK_NULL(errmsg));
1049c5c4113dSnw141292 	sqlite_freemem(errmsg);
1050c5c4113dSnw141292 	return (IDMAP_ERR_INTERNAL);
1051c5c4113dSnw141292 }
1052c5c4113dSnw141292 
105362c60062Sbaban /*
1054479ac375Sdm199847  * Load config in the state.
1055e8c27ec8Sbaban  *
1056479ac375Sdm199847  * nm_siduid and nm_sidgid fields:
1057e8c27ec8Sbaban  * state->nm_siduid represents mode used by sid2uid and uid2sid
1058e8c27ec8Sbaban  * requests for directory-based name mappings. Similarly,
1059e8c27ec8Sbaban  * state->nm_sidgid represents mode used by sid2gid and gid2sid
1060e8c27ec8Sbaban  * requests.
1061e8c27ec8Sbaban  *
1062e8c27ec8Sbaban  * sid2uid/uid2sid:
1063e8c27ec8Sbaban  * none       -> ds_name_mapping_enabled != true
1064e8c27ec8Sbaban  * AD-mode    -> !nldap_winname_attr && ad_unixuser_attr
1065e8c27ec8Sbaban  * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr
1066e8c27ec8Sbaban  * mixed-mode -> nldap_winname_attr && ad_unixuser_attr
1067e8c27ec8Sbaban  *
1068e8c27ec8Sbaban  * sid2gid/gid2sid:
1069e8c27ec8Sbaban  * none       -> ds_name_mapping_enabled != true
1070e8c27ec8Sbaban  * AD-mode    -> !nldap_winname_attr && ad_unixgroup_attr
1071e8c27ec8Sbaban  * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr
1072e8c27ec8Sbaban  * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr
1073e8c27ec8Sbaban  */
1074e8c27ec8Sbaban idmap_retcode
1075479ac375Sdm199847 load_cfg_in_state(lookup_state_t *state)
1076e8c27ec8Sbaban {
1077e8c27ec8Sbaban 	state->nm_siduid = IDMAP_NM_NONE;
1078e8c27ec8Sbaban 	state->nm_sidgid = IDMAP_NM_NONE;
1079e8c27ec8Sbaban 	RDLOCK_CONFIG();
1080479ac375Sdm199847 
10814aa0a5e7Snw141292 	state->eph_map_unres_sids = 0;
10824aa0a5e7Snw141292 	if (_idmapdstate.cfg->pgcfg.eph_map_unres_sids)
10834aa0a5e7Snw141292 		state->eph_map_unres_sids = 1;
10844aa0a5e7Snw141292 
1085479ac375Sdm199847 	if (_idmapdstate.cfg->pgcfg.default_domain != NULL) {
1086479ac375Sdm199847 		state->defdom =
1087479ac375Sdm199847 		    strdup(_idmapdstate.cfg->pgcfg.default_domain);
1088479ac375Sdm199847 		if (state->defdom == NULL) {
1089479ac375Sdm199847 			UNLOCK_CONFIG();
1090479ac375Sdm199847 			return (IDMAP_ERR_MEMORY);
1091479ac375Sdm199847 		}
1092479ac375Sdm199847 	} else {
1093479ac375Sdm199847 		UNLOCK_CONFIG();
1094dc03a638Sdm199847 		return (IDMAP_SUCCESS);
1095479ac375Sdm199847 	}
1096e8c27ec8Sbaban 	if (_idmapdstate.cfg->pgcfg.ds_name_mapping_enabled == FALSE) {
1097e8c27ec8Sbaban 		UNLOCK_CONFIG();
1098e8c27ec8Sbaban 		return (IDMAP_SUCCESS);
1099e8c27ec8Sbaban 	}
1100e8c27ec8Sbaban 	if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1101e8c27ec8Sbaban 		state->nm_siduid =
1102e8c27ec8Sbaban 		    (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1103e8c27ec8Sbaban 		    ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1104e8c27ec8Sbaban 		state->nm_sidgid =
1105e8c27ec8Sbaban 		    (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1106e8c27ec8Sbaban 		    ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP;
1107e8c27ec8Sbaban 	} else {
1108e8c27ec8Sbaban 		state->nm_siduid =
1109e8c27ec8Sbaban 		    (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL)
1110e8c27ec8Sbaban 		    ? IDMAP_NM_AD : IDMAP_NM_NONE;
1111e8c27ec8Sbaban 		state->nm_sidgid =
1112e8c27ec8Sbaban 		    (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL)
1113e8c27ec8Sbaban 		    ? IDMAP_NM_AD : IDMAP_NM_NONE;
1114e8c27ec8Sbaban 	}
1115e8c27ec8Sbaban 	if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) {
1116e8c27ec8Sbaban 		state->ad_unixuser_attr =
1117e8c27ec8Sbaban 		    strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr);
1118e8c27ec8Sbaban 		if (state->ad_unixuser_attr == NULL) {
1119e8c27ec8Sbaban 			UNLOCK_CONFIG();
1120e8c27ec8Sbaban 			return (IDMAP_ERR_MEMORY);
1121e8c27ec8Sbaban 		}
1122e8c27ec8Sbaban 	}
1123e8c27ec8Sbaban 	if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) {
1124e8c27ec8Sbaban 		state->ad_unixgroup_attr =
1125e8c27ec8Sbaban 		    strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr);
1126e8c27ec8Sbaban 		if (state->ad_unixgroup_attr == NULL) {
1127e8c27ec8Sbaban 			UNLOCK_CONFIG();
1128e8c27ec8Sbaban 			return (IDMAP_ERR_MEMORY);
1129e8c27ec8Sbaban 		}
1130e8c27ec8Sbaban 	}
1131479ac375Sdm199847 	if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) {
1132479ac375Sdm199847 		state->nldap_winname_attr =
1133479ac375Sdm199847 		    strdup(_idmapdstate.cfg->pgcfg.nldap_winname_attr);
1134479ac375Sdm199847 		if (state->nldap_winname_attr == NULL) {
1135479ac375Sdm199847 			UNLOCK_CONFIG();
1136479ac375Sdm199847 			return (IDMAP_ERR_MEMORY);
1137479ac375Sdm199847 		}
1138479ac375Sdm199847 	}
1139e8c27ec8Sbaban 	UNLOCK_CONFIG();
1140e8c27ec8Sbaban 	return (IDMAP_SUCCESS);
1141e8c27ec8Sbaban }
1142e8c27ec8Sbaban 
1143e8c27ec8Sbaban /*
114448258c6bSjp151216  * Set the rule with sepecified values.
114548258c6bSjp151216  * All the strings are copied.
114648258c6bSjp151216  */
114748258c6bSjp151216 static void
114848258c6bSjp151216 idmap_namerule_set(idmap_namerule *rule, const char *windomain,
114948258c6bSjp151216 		const char *winname, const char *unixname, boolean_t is_user,
115048258c6bSjp151216 		boolean_t is_wuser, boolean_t is_nt4, int direction)
115148258c6bSjp151216 {
115248258c6bSjp151216 	/*
115348258c6bSjp151216 	 * Only update if they differ because we have to free
115448258c6bSjp151216 	 * and duplicate the strings
115548258c6bSjp151216 	 */
115648258c6bSjp151216 	if (rule->windomain == NULL || windomain == NULL ||
115748258c6bSjp151216 	    strcmp(rule->windomain, windomain) != 0) {
115848258c6bSjp151216 		if (rule->windomain != NULL) {
115948258c6bSjp151216 			free(rule->windomain);
116048258c6bSjp151216 			rule->windomain = NULL;
116148258c6bSjp151216 		}
116248258c6bSjp151216 		if (windomain != NULL)
116348258c6bSjp151216 			rule->windomain = strdup(windomain);
116448258c6bSjp151216 	}
116548258c6bSjp151216 
116648258c6bSjp151216 	if (rule->winname == NULL || winname == NULL ||
116748258c6bSjp151216 	    strcmp(rule->winname, winname) != 0) {
116848258c6bSjp151216 		if (rule->winname != NULL) {
116948258c6bSjp151216 			free(rule->winname);
117048258c6bSjp151216 			rule->winname = NULL;
117148258c6bSjp151216 		}
117248258c6bSjp151216 		if (winname != NULL)
117348258c6bSjp151216 			rule->winname = strdup(winname);
117448258c6bSjp151216 	}
117548258c6bSjp151216 
117648258c6bSjp151216 	if (rule->unixname == NULL || unixname == NULL ||
117748258c6bSjp151216 	    strcmp(rule->unixname, unixname) != 0) {
117848258c6bSjp151216 		if (rule->unixname != NULL) {
117948258c6bSjp151216 			free(rule->unixname);
118048258c6bSjp151216 			rule->unixname = NULL;
118148258c6bSjp151216 		}
118248258c6bSjp151216 		if (unixname != NULL)
118348258c6bSjp151216 			rule->unixname = strdup(unixname);
118448258c6bSjp151216 	}
118548258c6bSjp151216 
118648258c6bSjp151216 	rule->is_user = is_user;
118748258c6bSjp151216 	rule->is_wuser = is_wuser;
118848258c6bSjp151216 	rule->is_nt4 = is_nt4;
118948258c6bSjp151216 	rule->direction = direction;
119048258c6bSjp151216 }
119148258c6bSjp151216 
119248258c6bSjp151216 
119348258c6bSjp151216 /*
119462c60062Sbaban  * Table for well-known SIDs.
119562c60062Sbaban  *
119662c60062Sbaban  * Background:
119762c60062Sbaban  *
119876b27f93Sbaban  * Some of the well-known principals are stored under:
119962c60062Sbaban  * cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>
120062c60062Sbaban  * They belong to objectClass "foreignSecurityPrincipal". They don't have
120162c60062Sbaban  * "samAccountName" nor "userPrincipalName" attributes. Their names are
120262c60062Sbaban  * available in "cn" and "name" attributes. Some of these principals have a
120362c60062Sbaban  * second entry under CN=ForeignSecurityPrincipals,dc=<forestRootDomain> and
120462c60062Sbaban  * these duplicate entries have the stringified SID in the "name" and "cn"
120562c60062Sbaban  * attributes instead of the actual name.
120662c60062Sbaban  *
120776b27f93Sbaban  * Those of the form S-1-5-32-X are Builtin groups and are stored in the
120876b27f93Sbaban  * cn=builtin container (except, Power Users which is not stored in AD)
120962c60062Sbaban  *
121076b27f93Sbaban  * These principals are and will remain constant. Therefore doing AD lookups
121176b27f93Sbaban  * provides no benefit. Also, using hard-coded table (and thus avoiding AD
121276b27f93Sbaban  * lookup) improves performance and avoids additional complexity in the
121376b27f93Sbaban  * adutils.c code. Moreover these SIDs can be used when no Active Directory
121476b27f93Sbaban  * is available (such as the CIFS server's "workgroup" mode).
121576b27f93Sbaban  *
121676b27f93Sbaban  * Notes:
121776b27f93Sbaban  * 1. Currently we don't support localization of well-known SID names,
121862c60062Sbaban  * unlike Windows.
121962c60062Sbaban  *
122076b27f93Sbaban  * 2. Other well-known SIDs i.e. S-1-5-<domain>-<w-k RID> are not stored
122176b27f93Sbaban  * here. AD does have normal user/group objects for these objects and
122276b27f93Sbaban  * can be looked up using the existing AD lookup code.
1223e8c27ec8Sbaban  *
1224e8c27ec8Sbaban  * 3. See comments above lookup_wksids_sid2pid() for more information
1225e8c27ec8Sbaban  * on how we lookup the wksids table.
122662c60062Sbaban  */
122762c60062Sbaban static wksids_table_t wksids[] = {
1228e8c27ec8Sbaban 	{"S-1-0", 0, "Nobody", 0, SENTINEL_PID, -1, 1},
1229e8c27ec8Sbaban 	{"S-1-1", 0, "Everyone", 0, SENTINEL_PID, -1, -1},
1230e8c27ec8Sbaban 	{"S-1-3", 0, "Creator Owner", 1, IDMAP_WK_CREATOR_OWNER_UID, 1, 0},
1231e8c27ec8Sbaban 	{"S-1-3", 1, "Creator Group", 0, IDMAP_WK_CREATOR_GROUP_GID, 0, 0},
1232e8c27ec8Sbaban 	{"S-1-3", 2, "Creator Owner Server", 1, SENTINEL_PID, -1, -1},
1233e8c27ec8Sbaban 	{"S-1-3", 3, "Creator Group Server", 0, SENTINEL_PID, -1, 1},
1234e8c27ec8Sbaban 	{"S-1-3", 4, "Owner Rights", 0, SENTINEL_PID, -1, -1},
1235e8c27ec8Sbaban 	{"S-1-5", 1, "Dialup", 0, SENTINEL_PID, -1, -1},
1236e8c27ec8Sbaban 	{"S-1-5", 2, "Network", 0, SENTINEL_PID, -1, -1},
1237e8c27ec8Sbaban 	{"S-1-5", 3, "Batch", 0, SENTINEL_PID, -1, -1},
1238e8c27ec8Sbaban 	{"S-1-5", 4, "Interactive", 0, SENTINEL_PID, -1, -1},
1239e8c27ec8Sbaban 	{"S-1-5", 6, "Service", 0, SENTINEL_PID, -1, -1},
1240e8c27ec8Sbaban 	{"S-1-5", 7, "Anonymous Logon", 0, GID_NOBODY, 0, 0},
1241e8c27ec8Sbaban 	{"S-1-5", 7, "Anonymous Logon", 0, UID_NOBODY, 1, 0},
1242e8c27ec8Sbaban 	{"S-1-5", 8, "Proxy", 0, SENTINEL_PID, -1, -1},
1243e8c27ec8Sbaban 	{"S-1-5", 9, "Enterprise Domain Controllers", 0, SENTINEL_PID, -1, -1},
1244e8c27ec8Sbaban 	{"S-1-5", 10, "Self", 0, SENTINEL_PID, -1, -1},
1245e8c27ec8Sbaban 	{"S-1-5", 11, "Authenticated Users", 0, SENTINEL_PID, -1, -1},
1246e8c27ec8Sbaban 	{"S-1-5", 12, "Restricted Code", 0, SENTINEL_PID, -1, -1},
1247e8c27ec8Sbaban 	{"S-1-5", 13, "Terminal Server User", 0, SENTINEL_PID, -1, -1},
1248e8c27ec8Sbaban 	{"S-1-5", 14, "Remote Interactive Logon", 0, SENTINEL_PID, -1, -1},
1249e8c27ec8Sbaban 	{"S-1-5", 15, "This Organization", 0, SENTINEL_PID, -1, -1},
1250e8c27ec8Sbaban 	{"S-1-5", 17, "IUSR", 0, SENTINEL_PID, -1, -1},
1251e8c27ec8Sbaban 	{"S-1-5", 18, "Local System", 0, IDMAP_WK_LOCAL_SYSTEM_GID, 0, 0},
1252e8c27ec8Sbaban 	{"S-1-5", 19, "Local Service", 0, SENTINEL_PID, -1, -1},
1253e8c27ec8Sbaban 	{"S-1-5", 20, "Network Service", 0, SENTINEL_PID, -1, -1},
1254e8c27ec8Sbaban 	{"S-1-5", 1000, "Other Organization", 0, SENTINEL_PID, -1, -1},
1255e8c27ec8Sbaban 	{"S-1-5-32", 544, "Administrators", 0, SENTINEL_PID, -1, -1},
1256e8c27ec8Sbaban 	{"S-1-5-32", 545, "Users", 0, SENTINEL_PID, -1, -1},
1257e8c27ec8Sbaban 	{"S-1-5-32", 546, "Guests", 0, SENTINEL_PID, -1, -1},
1258e8c27ec8Sbaban 	{"S-1-5-32", 547, "Power Users", 0, SENTINEL_PID, -1, -1},
1259e8c27ec8Sbaban 	{"S-1-5-32", 548, "Account Operators", 0, SENTINEL_PID, -1, -1},
1260e8c27ec8Sbaban 	{"S-1-5-32", 549, "Server Operators", 0, SENTINEL_PID, -1, -1},
1261e8c27ec8Sbaban 	{"S-1-5-32", 550, "Print Operators", 0, SENTINEL_PID, -1, -1},
1262e8c27ec8Sbaban 	{"S-1-5-32", 551, "Backup Operators", 0, SENTINEL_PID, -1, -1},
1263e8c27ec8Sbaban 	{"S-1-5-32", 552, "Replicator", 0, SENTINEL_PID, -1, -1},
126476b27f93Sbaban 	{"S-1-5-32", 554, "Pre-Windows 2000 Compatible Access", 0,
1265e8c27ec8Sbaban 	    SENTINEL_PID, -1, -1},
1266e8c27ec8Sbaban 	{"S-1-5-32", 555, "Remote Desktop Users", 0, SENTINEL_PID, -1, -1},
126776b27f93Sbaban 	{"S-1-5-32", 556, "Network Configuration Operators", 0,
1268e8c27ec8Sbaban 	    SENTINEL_PID, -1, -1},
126976b27f93Sbaban 	{"S-1-5-32", 557, "Incoming Forest Trust Builders", 0,
1270e8c27ec8Sbaban 	    SENTINEL_PID, -1, -1},
1271e8c27ec8Sbaban 	{"S-1-5-32", 558, "Performance Monitor Users", 0, SENTINEL_PID, -1, -1},
1272e8c27ec8Sbaban 	{"S-1-5-32", 559, "Performance Log Users", 0, SENTINEL_PID, -1, -1},
127376b27f93Sbaban 	{"S-1-5-32", 560, "Windows Authorization Access Group", 0,
1274e8c27ec8Sbaban 	    SENTINEL_PID, -1, -1},
127576b27f93Sbaban 	{"S-1-5-32", 561, "Terminal Server License Servers", 0,
1276e8c27ec8Sbaban 	    SENTINEL_PID, -1, -1},
1277e8c27ec8Sbaban 	{"S-1-5-32", 561, "Distributed COM Users", 0, SENTINEL_PID, -1, -1},
1278e8c27ec8Sbaban 	{"S-1-5-32", 568, "IIS_IUSRS", 0, SENTINEL_PID, -1, -1},
1279e8c27ec8Sbaban 	{"S-1-5-32", 569, "Cryptographic Operators", 0, SENTINEL_PID, -1, -1},
1280e8c27ec8Sbaban 	{"S-1-5-32", 573, "Event Log Readers", 0, SENTINEL_PID, -1, -1},
128176b27f93Sbaban 	{"S-1-5-32", 574, "Certificate Service DCOM Access", 0,
1282e8c27ec8Sbaban 	    SENTINEL_PID, -1, -1},
1283e8c27ec8Sbaban 	{"S-1-5-64", 21, "Digest Authentication", 0, SENTINEL_PID, -1, -1},
1284e8c27ec8Sbaban 	{"S-1-5-64", 10, "NTLM Authentication", 0, SENTINEL_PID, -1, -1},
1285e8c27ec8Sbaban 	{"S-1-5-64", 14, "SChannel Authentication", 0, SENTINEL_PID, -1, -1},
1286e8c27ec8Sbaban 	{NULL, UINT32_MAX, NULL, -1, SENTINEL_PID, -1, -1}
1287c5c4113dSnw141292 };
1288c5c4113dSnw141292 
1289e8c27ec8Sbaban /*
1290e8c27ec8Sbaban  * Lookup well-known SIDs table either by winname or by SID.
1291e8c27ec8Sbaban  * If the given winname or SID is a well-known SID then we set wksid
1292e8c27ec8Sbaban  * variable and then proceed to see if the SID has a hard mapping to
1293e8c27ec8Sbaban  * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to
1294e8c27ec8Sbaban  * fixed ephemeral ids). If we find such mapping then we return
1295e8c27ec8Sbaban  * success otherwise notfound. If a well-known SID is mapped to
1296e8c27ec8Sbaban  * SENTINEL_PID and the direction field is set (bi-directional or
1297e8c27ec8Sbaban  * win2unix) then we treat it as inhibited mapping and return no
1298e8c27ec8Sbaban  * mapping (Ex. S-1-0-0).
1299e8c27ec8Sbaban  */
1300cd37da74Snw141292 static
1301cd37da74Snw141292 idmap_retcode
1302e8c27ec8Sbaban lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *wksid)
1303cd37da74Snw141292 {
1304c5c4113dSnw141292 	int i;
130562c60062Sbaban 
1306e8c27ec8Sbaban 	*wksid = 0;
1307e8c27ec8Sbaban 
1308e8c27ec8Sbaban 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1309e8c27ec8Sbaban 		if (req->id1.idmap_id_u.sid.prefix != NULL) {
1310e8c27ec8Sbaban 			if ((strcasecmp(wksids[i].sidprefix,
1311e8c27ec8Sbaban 			    req->id1.idmap_id_u.sid.prefix) != 0) ||
1312e8c27ec8Sbaban 			    wksids[i].rid != req->id1.idmap_id_u.sid.rid)
1313e8c27ec8Sbaban 				/* this is not our SID */
1314e8c27ec8Sbaban 				continue;
1315e8c27ec8Sbaban 			if (req->id1name == NULL) {
1316e8c27ec8Sbaban 				req->id1name = strdup(wksids[i].winname);
1317e8c27ec8Sbaban 				if (req->id1name == NULL)
1318e8c27ec8Sbaban 					return (IDMAP_ERR_MEMORY);
1319e8c27ec8Sbaban 			}
1320e8c27ec8Sbaban 		} else if (req->id1name != NULL) {
1321e8c27ec8Sbaban 			if (strcasecmp(wksids[i].winname, req->id1name) != 0)
1322e8c27ec8Sbaban 				/* this is not our winname */
1323e8c27ec8Sbaban 				continue;
1324e8c27ec8Sbaban 			req->id1.idmap_id_u.sid.prefix =
1325e8c27ec8Sbaban 			    strdup(wksids[i].sidprefix);
1326e8c27ec8Sbaban 			if (req->id1.idmap_id_u.sid.prefix == NULL)
1327e8c27ec8Sbaban 				return (IDMAP_ERR_MEMORY);
1328e8c27ec8Sbaban 			req->id1.idmap_id_u.sid.rid = wksids[i].rid;
1329e8c27ec8Sbaban 		}
1330e8c27ec8Sbaban 
1331e8c27ec8Sbaban 		*wksid = 1;
1332e8c27ec8Sbaban 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
1333e8c27ec8Sbaban 
1334e8c27ec8Sbaban 		req->id1.idtype = (wksids[i].is_wuser) ?
1335e8c27ec8Sbaban 		    IDMAP_USID : IDMAP_GSID;
1336e8c27ec8Sbaban 
1337e8c27ec8Sbaban 		if (wksids[i].pid == SENTINEL_PID) {
1338e8c27ec8Sbaban 			if (wksids[i].direction == IDMAP_DIRECTION_BI ||
1339e8c27ec8Sbaban 			    wksids[i].direction == IDMAP_DIRECTION_W2U)
1340e8c27ec8Sbaban 				/* Inhibited */
1341e8c27ec8Sbaban 				return (IDMAP_ERR_NOMAPPING);
1342e8c27ec8Sbaban 			/* Not mapped */
1343479ac375Sdm199847 			if (res->id.idtype == IDMAP_POSIXID) {
1344479ac375Sdm199847 				res->id.idtype =
1345479ac375Sdm199847 				    (wksids[i].is_wuser) ?
1346479ac375Sdm199847 				    IDMAP_UID : IDMAP_GID;
1347479ac375Sdm199847 			}
1348e8c27ec8Sbaban 			return (IDMAP_ERR_NOTFOUND);
1349e8c27ec8Sbaban 		} else if (wksids[i].direction == IDMAP_DIRECTION_U2W)
135062c60062Sbaban 			continue;
135162c60062Sbaban 
1352e8c27ec8Sbaban 		switch (res->id.idtype) {
1353c5c4113dSnw141292 		case IDMAP_UID:
135462c60062Sbaban 			if (wksids[i].is_user == 0)
135562c60062Sbaban 				continue;
135662c60062Sbaban 			res->id.idmap_id_u.uid = wksids[i].pid;
135762c60062Sbaban 			res->direction = wksids[i].direction;
135848258c6bSjp151216 			if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
135948258c6bSjp151216 				res->info.how.map_type =
136048258c6bSjp151216 				    IDMAP_MAP_TYPE_KNOWN_SID;
136148258c6bSjp151216 				res->info.src = IDMAP_MAP_SRC_HARD_CODED;
136248258c6bSjp151216 			}
1363c5c4113dSnw141292 			return (IDMAP_SUCCESS);
1364c5c4113dSnw141292 		case IDMAP_GID:
136562c60062Sbaban 			if (wksids[i].is_user == 1)
136662c60062Sbaban 				continue;
136762c60062Sbaban 			res->id.idmap_id_u.gid = wksids[i].pid;
136862c60062Sbaban 			res->direction = wksids[i].direction;
136948258c6bSjp151216 			if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
137048258c6bSjp151216 				res->info.how.map_type =
137148258c6bSjp151216 				    IDMAP_MAP_TYPE_KNOWN_SID;
137248258c6bSjp151216 				res->info.src = IDMAP_MAP_SRC_HARD_CODED;
137348258c6bSjp151216 			}
1374c5c4113dSnw141292 			return (IDMAP_SUCCESS);
1375c5c4113dSnw141292 		case IDMAP_POSIXID:
137662c60062Sbaban 			res->id.idmap_id_u.uid = wksids[i].pid;
137762c60062Sbaban 			res->id.idtype = (!wksids[i].is_user) ?
1378c5c4113dSnw141292 			    IDMAP_GID : IDMAP_UID;
137962c60062Sbaban 			res->direction = wksids[i].direction;
138048258c6bSjp151216 			if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
138148258c6bSjp151216 				res->info.how.map_type =
138248258c6bSjp151216 				    IDMAP_MAP_TYPE_KNOWN_SID;
138348258c6bSjp151216 				res->info.src = IDMAP_MAP_SRC_HARD_CODED;
138448258c6bSjp151216 			}
1385c5c4113dSnw141292 			return (IDMAP_SUCCESS);
1386c5c4113dSnw141292 		default:
1387c5c4113dSnw141292 			return (IDMAP_ERR_NOTSUPPORTED);
1388c5c4113dSnw141292 		}
1389c5c4113dSnw141292 	}
1390c5c4113dSnw141292 	return (IDMAP_ERR_NOTFOUND);
1391c5c4113dSnw141292 }
1392c5c4113dSnw141292 
1393cd37da74Snw141292 
1394cd37da74Snw141292 static
1395cd37da74Snw141292 idmap_retcode
1396cd37da74Snw141292 lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user)
1397cd37da74Snw141292 {
1398c5c4113dSnw141292 	int i;
1399e8c27ec8Sbaban 	if (req->id1.idmap_id_u.uid == SENTINEL_PID)
1400e8c27ec8Sbaban 		return (IDMAP_ERR_NOTFOUND);
140162c60062Sbaban 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
140262c60062Sbaban 		if (wksids[i].pid == req->id1.idmap_id_u.uid &&
140362c60062Sbaban 		    wksids[i].is_user == is_user &&
140462c60062Sbaban 		    wksids[i].direction != IDMAP_DIRECTION_W2U) {
1405e8c27ec8Sbaban 			if (res->id.idtype == IDMAP_SID) {
1406e8c27ec8Sbaban 				res->id.idtype = (wksids[i].is_wuser) ?
1407e8c27ec8Sbaban 				    IDMAP_USID : IDMAP_GSID;
1408e8c27ec8Sbaban 			}
140962c60062Sbaban 			res->id.idmap_id_u.sid.rid = wksids[i].rid;
1410c5c4113dSnw141292 			res->id.idmap_id_u.sid.prefix =
141162c60062Sbaban 			    strdup(wksids[i].sidprefix);
1412c5c4113dSnw141292 			if (res->id.idmap_id_u.sid.prefix == NULL) {
1413c5c4113dSnw141292 				idmapdlog(LOG_ERR, "Out of memory");
1414c5c4113dSnw141292 				return (IDMAP_ERR_MEMORY);
1415c5c4113dSnw141292 			}
141662c60062Sbaban 			res->direction = wksids[i].direction;
141748258c6bSjp151216 			if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
141848258c6bSjp151216 				res->info.how.map_type =
141948258c6bSjp151216 				    IDMAP_MAP_TYPE_KNOWN_SID;
142048258c6bSjp151216 				res->info.src = IDMAP_MAP_SRC_HARD_CODED;
142148258c6bSjp151216 			}
1422c5c4113dSnw141292 			return (IDMAP_SUCCESS);
1423c5c4113dSnw141292 		}
1424c5c4113dSnw141292 	}
142562c60062Sbaban 	return (IDMAP_ERR_NOTFOUND);
142662c60062Sbaban }
142762c60062Sbaban 
1428cd37da74Snw141292 idmap_retcode
1429cd37da74Snw141292 lookup_wksids_name2sid(const char *name, char **canonname, char **sidprefix,
1430cd37da74Snw141292 	idmap_rid_t *rid, int *type)
1431cd37da74Snw141292 {
143262c60062Sbaban 	int	i;
1433479ac375Sdm199847 
1434479ac375Sdm199847 	if ((strncasecmp(name, "BUILTIN\\", 8) == 0) ||
1435479ac375Sdm199847 	    (strncasecmp(name, "BUILTIN/", 8) == 0))
1436479ac375Sdm199847 		name += 8;
1437479ac375Sdm199847 
143862c60062Sbaban 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1439e8c27ec8Sbaban 		if (strcasecmp(wksids[i].winname, name) != 0)
1440e8c27ec8Sbaban 			continue;
1441e8c27ec8Sbaban 		if (sidprefix != NULL &&
1442e8c27ec8Sbaban 		    (*sidprefix = strdup(wksids[i].sidprefix)) == NULL) {
144362c60062Sbaban 			idmapdlog(LOG_ERR, "Out of memory");
144462c60062Sbaban 			return (IDMAP_ERR_MEMORY);
144562c60062Sbaban 		}
1446cd37da74Snw141292 		if (canonname != NULL &&
1447cd37da74Snw141292 		    (*canonname = strdup(wksids[i].winname)) == NULL) {
1448cd37da74Snw141292 			idmapdlog(LOG_ERR, "Out of memory");
1449e8c27ec8Sbaban 			if (sidprefix != NULL) {
1450e8c27ec8Sbaban 				free(*sidprefix);
1451e8c27ec8Sbaban 				*sidprefix = NULL;
1452e8c27ec8Sbaban 			}
1453cd37da74Snw141292 			return (IDMAP_ERR_MEMORY);
1454cd37da74Snw141292 		}
145562c60062Sbaban 		if (type != NULL)
1456e8c27ec8Sbaban 			*type = (wksids[i].is_wuser) ?
145762c60062Sbaban 			    _IDMAP_T_USER : _IDMAP_T_GROUP;
145862c60062Sbaban 		if (rid != NULL)
145962c60062Sbaban 			*rid = wksids[i].rid;
146062c60062Sbaban 		return (IDMAP_SUCCESS);
146162c60062Sbaban 	}
1462c5c4113dSnw141292 	return (IDMAP_ERR_NOTFOUND);
1463c5c4113dSnw141292 }
1464c5c4113dSnw141292 
1465cd37da74Snw141292 static
1466cd37da74Snw141292 idmap_retcode
1467cd37da74Snw141292 lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1468cd37da74Snw141292 {
1469c5c4113dSnw141292 	char		*end;
1470c5c4113dSnw141292 	char		*sql = NULL;
1471c5c4113dSnw141292 	const char	**values;
1472c5c4113dSnw141292 	sqlite_vm	*vm = NULL;
1473c5c4113dSnw141292 	int		ncol, is_user;
1474c5c4113dSnw141292 	uid_t		pid;
1475c5c4113dSnw141292 	time_t		curtime, exp;
1476c5c4113dSnw141292 	idmap_retcode	retcode;
1477042addd6Sbaban 	char		*is_user_string, *lower_name;
1478c5c4113dSnw141292 
1479c5c4113dSnw141292 	/* Current time */
1480c5c4113dSnw141292 	errno = 0;
1481c5c4113dSnw141292 	if ((curtime = time(NULL)) == (time_t)-1) {
1482cd37da74Snw141292 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1483c5c4113dSnw141292 		    strerror(errno));
1484c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
1485c5c4113dSnw141292 		goto out;
1486c5c4113dSnw141292 	}
1487c5c4113dSnw141292 
1488e8c27ec8Sbaban 	switch (res->id.idtype) {
1489cd37da74Snw141292 	case IDMAP_UID:
1490cd37da74Snw141292 		is_user_string = "1";
1491cd37da74Snw141292 		break;
1492cd37da74Snw141292 	case IDMAP_GID:
1493cd37da74Snw141292 		is_user_string = "0";
1494cd37da74Snw141292 		break;
1495cd37da74Snw141292 	case IDMAP_POSIXID:
1496cd37da74Snw141292 		/* the non-diagonal mapping */
1497cd37da74Snw141292 		is_user_string = "is_wuser";
1498cd37da74Snw141292 		break;
1499cd37da74Snw141292 	default:
1500cd37da74Snw141292 		retcode = IDMAP_ERR_NOTSUPPORTED;
1501cd37da74Snw141292 		goto out;
1502cd37da74Snw141292 	}
1503cd37da74Snw141292 
1504c5c4113dSnw141292 	/* SQL to lookup the cache */
150548258c6bSjp151216 
1506e8c27ec8Sbaban 	if (req->id1.idmap_id_u.sid.prefix != NULL) {
1507e8c27ec8Sbaban 		sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
150848258c6bSjp151216 		    "unixname, u2w, is_wuser, "
150948258c6bSjp151216 		    "map_type, map_dn, map_attr, map_value, "
151048258c6bSjp151216 		    "map_windomain, map_winname, map_unixname, map_is_nt4 "
1511cd37da74Snw141292 		    "FROM idmap_cache WHERE is_user = %s AND "
1512c5c4113dSnw141292 		    "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
1513c5c4113dSnw141292 		    "(pid >= 2147483648 OR "
1514c5c4113dSnw141292 		    "(expiration = 0 OR expiration ISNULL OR "
1515c5c4113dSnw141292 		    "expiration > %d));",
1516e8c27ec8Sbaban 		    is_user_string, req->id1.idmap_id_u.sid.prefix,
1517e8c27ec8Sbaban 		    req->id1.idmap_id_u.sid.rid, curtime);
1518e8c27ec8Sbaban 	} else if (req->id1name != NULL) {
1519042addd6Sbaban 		if ((lower_name = tolower_u8(req->id1name)) == NULL)
1520042addd6Sbaban 			lower_name = req->id1name;
1521e8c27ec8Sbaban 		sql = sqlite_mprintf("SELECT pid, is_user, expiration, "
152248258c6bSjp151216 		    "unixname, u2w, is_wuser, "
152348258c6bSjp151216 		    "map_type, map_dn, map_attr, map_value, "
152448258c6bSjp151216 		    "map_windomain, map_winname, map_unixname, map_is_nt4 "
1525e8c27ec8Sbaban 		    "FROM idmap_cache WHERE is_user = %s AND "
1526e8c27ec8Sbaban 		    "winname = %Q AND windomain = %Q AND w2u = 1 AND "
1527e8c27ec8Sbaban 		    "(pid >= 2147483648 OR "
1528e8c27ec8Sbaban 		    "(expiration = 0 OR expiration ISNULL OR "
1529e8c27ec8Sbaban 		    "expiration > %d));",
153048258c6bSjp151216 		    is_user_string, lower_name, req->id1domain,
153148258c6bSjp151216 		    curtime);
1532042addd6Sbaban 		if (lower_name != req->id1name)
1533042addd6Sbaban 			free(lower_name);
1534e8c27ec8Sbaban 	} else {
1535e8c27ec8Sbaban 		retcode = IDMAP_ERR_ARG;
1536e8c27ec8Sbaban 		goto out;
1537e8c27ec8Sbaban 	}
1538c5c4113dSnw141292 	if (sql == NULL) {
1539c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
1540c5c4113dSnw141292 		retcode = IDMAP_ERR_MEMORY;
1541c5c4113dSnw141292 		goto out;
1542c5c4113dSnw141292 	}
154348258c6bSjp151216 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol,
154448258c6bSjp151216 	    14, &values);
1545c5c4113dSnw141292 	sqlite_freemem(sql);
1546c5c4113dSnw141292 
1547c5c4113dSnw141292 	if (retcode == IDMAP_ERR_NOTFOUND) {
1548c5c4113dSnw141292 		goto out;
1549c5c4113dSnw141292 	} else if (retcode == IDMAP_SUCCESS) {
1550c5c4113dSnw141292 		/* sanity checks */
1551c5c4113dSnw141292 		if (values[0] == NULL || values[1] == NULL) {
1552c5c4113dSnw141292 			retcode = IDMAP_ERR_CACHE;
1553c5c4113dSnw141292 			goto out;
1554c5c4113dSnw141292 		}
1555c5c4113dSnw141292 
1556c5c4113dSnw141292 		pid = strtoul(values[0], &end, 10);
1557c5c4113dSnw141292 		is_user = strncmp(values[1], "0", 2) ? 1 : 0;
1558c5c4113dSnw141292 
1559cd37da74Snw141292 		if (is_user) {
1560cd37da74Snw141292 			res->id.idtype = IDMAP_UID;
1561cd37da74Snw141292 			res->id.idmap_id_u.uid = pid;
1562cd37da74Snw141292 		} else {
1563cd37da74Snw141292 			res->id.idtype = IDMAP_GID;
1564cd37da74Snw141292 			res->id.idmap_id_u.gid = pid;
1565cd37da74Snw141292 		}
1566cd37da74Snw141292 
1567c5c4113dSnw141292 		/*
1568c5c4113dSnw141292 		 * We may have an expired ephemeral mapping. Consider
1569c5c4113dSnw141292 		 * the expired entry as valid if we are not going to
1570c5c4113dSnw141292 		 * perform name-based mapping. But do not renew the
1571c5c4113dSnw141292 		 * expiration.
1572c5c4113dSnw141292 		 * If we will be doing name-based mapping then store the
1573c5c4113dSnw141292 		 * ephemeral pid in the result so that we can use it
1574c5c4113dSnw141292 		 * if we end up doing dynamic mapping again.
1575c5c4113dSnw141292 		 */
1576c5c4113dSnw141292 		if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) &&
1577cd37da74Snw141292 		    !AVOID_NAMESERVICE(req) &&
1578cd37da74Snw141292 		    IS_EPHEMERAL(pid) && values[2] != NULL) {
1579c5c4113dSnw141292 			exp = strtoll(values[2], &end, 10);
1580c5c4113dSnw141292 			if (exp && exp <= curtime) {
1581c5c4113dSnw141292 				/* Store the ephemeral pid */
1582651c0131Sbaban 				res->direction = IDMAP_DIRECTION_BI;
1583cd37da74Snw141292 				req->direction |= is_user
1584cd37da74Snw141292 				    ? _IDMAP_F_EXP_EPH_UID
1585cd37da74Snw141292 				    : _IDMAP_F_EXP_EPH_GID;
1586c5c4113dSnw141292 				retcode = IDMAP_ERR_NOTFOUND;
1587c5c4113dSnw141292 			}
1588c5c4113dSnw141292 		}
1589c5c4113dSnw141292 	}
1590c5c4113dSnw141292 
1591c5c4113dSnw141292 out:
1592c5c4113dSnw141292 	if (retcode == IDMAP_SUCCESS) {
159362c60062Sbaban 		if (values[4] != NULL)
1594c5c4113dSnw141292 			res->direction =
1595651c0131Sbaban 			    (strtol(values[4], &end, 10) == 0)?
1596651c0131Sbaban 			    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
1597c5c4113dSnw141292 		else
1598651c0131Sbaban 			res->direction = IDMAP_DIRECTION_W2U;
1599c5c4113dSnw141292 
160062c60062Sbaban 		if (values[3] != NULL) {
1601e8c27ec8Sbaban 			if (req->id2name != NULL)
1602e8c27ec8Sbaban 				free(req->id2name);
16038e228215Sdm199847 			req->id2name = strdup(values[3]);
16048e228215Sdm199847 			if (req->id2name == NULL) {
1605c5c4113dSnw141292 				idmapdlog(LOG_ERR, "Out of memory");
1606c5c4113dSnw141292 				retcode = IDMAP_ERR_MEMORY;
1607c5c4113dSnw141292 			}
1608c5c4113dSnw141292 		}
1609e8c27ec8Sbaban 
1610e8c27ec8Sbaban 		req->id1.idtype = strncmp(values[5], "0", 2) ?
1611e8c27ec8Sbaban 		    IDMAP_USID : IDMAP_GSID;
161248258c6bSjp151216 
161348258c6bSjp151216 		if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
161448258c6bSjp151216 			res->info.src = IDMAP_MAP_SRC_CACHE;
161548258c6bSjp151216 			res->info.how.map_type = strtoul(values[6], &end, 10);
161648258c6bSjp151216 			switch (res->info.how.map_type) {
161748258c6bSjp151216 			case IDMAP_MAP_TYPE_DS_AD:
161848258c6bSjp151216 				res->info.how.idmap_how_u.ad.dn =
161948258c6bSjp151216 				    strdup(values[7]);
162048258c6bSjp151216 				res->info.how.idmap_how_u.ad.attr =
162148258c6bSjp151216 				    strdup(values[8]);
162248258c6bSjp151216 				res->info.how.idmap_how_u.ad.value =
162348258c6bSjp151216 				    strdup(values[9]);
162448258c6bSjp151216 				break;
162548258c6bSjp151216 
162648258c6bSjp151216 			case IDMAP_MAP_TYPE_DS_NLDAP:
162748258c6bSjp151216 				res->info.how.idmap_how_u.nldap.dn =
162848258c6bSjp151216 				    strdup(values[7]);
162948258c6bSjp151216 				res->info.how.idmap_how_u.nldap.attr =
163048258c6bSjp151216 				    strdup(values[8]);
163148258c6bSjp151216 				res->info.how.idmap_how_u.nldap.value =
163248258c6bSjp151216 				    strdup(values[9]);
163348258c6bSjp151216 				break;
163448258c6bSjp151216 
163548258c6bSjp151216 			case IDMAP_MAP_TYPE_RULE_BASED:
163648258c6bSjp151216 				res->info.how.idmap_how_u.rule.windomain =
163748258c6bSjp151216 				    strdup(values[10]);
163848258c6bSjp151216 				res->info.how.idmap_how_u.rule.winname =
163948258c6bSjp151216 				    strdup(values[11]);
164048258c6bSjp151216 				res->info.how.idmap_how_u.rule.unixname =
164148258c6bSjp151216 				    strdup(values[12]);
164248258c6bSjp151216 				res->info.how.idmap_how_u.rule.is_nt4 =
164348258c6bSjp151216 				    strtoul(values[13], &end, 1);
164448258c6bSjp151216 				res->info.how.idmap_how_u.rule.is_user =
164548258c6bSjp151216 				    is_user;
164648258c6bSjp151216 				res->info.how.idmap_how_u.rule.is_wuser =
164748258c6bSjp151216 				    strtoul(values[5], &end, 1);
164848258c6bSjp151216 				break;
164948258c6bSjp151216 
165048258c6bSjp151216 			case IDMAP_MAP_TYPE_EPHEMERAL:
165148258c6bSjp151216 				break;
165248258c6bSjp151216 
165348258c6bSjp151216 			case IDMAP_MAP_TYPE_LOCAL_SID:
165448258c6bSjp151216 				break;
165548258c6bSjp151216 
165648258c6bSjp151216 			case IDMAP_MAP_TYPE_KNOWN_SID:
165748258c6bSjp151216 				break;
165848258c6bSjp151216 
165948258c6bSjp151216 			default:
166048258c6bSjp151216 				/* Unknow mapping type */
166148258c6bSjp151216 				assert(FALSE);
166248258c6bSjp151216 			}
166348258c6bSjp151216 		}
1664c5c4113dSnw141292 	}
166562c60062Sbaban 	if (vm != NULL)
1666c5c4113dSnw141292 		(void) sqlite_finalize(vm, NULL);
1667c5c4113dSnw141292 	return (retcode);
1668c5c4113dSnw141292 }
1669c5c4113dSnw141292 
1670cd37da74Snw141292 static
1671cd37da74Snw141292 idmap_retcode
167262c60062Sbaban lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid,
1673cd37da74Snw141292 		char **name, char **domain, int *type)
1674cd37da74Snw141292 {
1675c5c4113dSnw141292 	char		*end;
1676c5c4113dSnw141292 	char		*sql = NULL;
1677c5c4113dSnw141292 	const char	**values;
1678c5c4113dSnw141292 	sqlite_vm	*vm = NULL;
1679c5c4113dSnw141292 	int		ncol;
1680c5c4113dSnw141292 	time_t		curtime;
1681c5c4113dSnw141292 	idmap_retcode	retcode = IDMAP_SUCCESS;
1682c5c4113dSnw141292 
1683c5c4113dSnw141292 	/* Get current time */
1684c5c4113dSnw141292 	errno = 0;
1685c5c4113dSnw141292 	if ((curtime = time(NULL)) == (time_t)-1) {
1686cd37da74Snw141292 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
1687c5c4113dSnw141292 		    strerror(errno));
1688c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
1689c5c4113dSnw141292 		goto out;
1690c5c4113dSnw141292 	}
1691c5c4113dSnw141292 
1692c5c4113dSnw141292 	/* SQL to lookup the cache */
1693cd37da74Snw141292 	sql = sqlite_mprintf("SELECT canon_name, domain, type "
1694cd37da74Snw141292 	    "FROM name_cache WHERE "
1695c5c4113dSnw141292 	    "sidprefix = %Q AND rid = %u AND "
1696c5c4113dSnw141292 	    "(expiration = 0 OR expiration ISNULL OR "
1697c5c4113dSnw141292 	    "expiration > %d);",
1698c5c4113dSnw141292 	    sidprefix, rid, curtime);
1699c5c4113dSnw141292 	if (sql == NULL) {
1700c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
1701c5c4113dSnw141292 		retcode = IDMAP_ERR_MEMORY;
1702c5c4113dSnw141292 		goto out;
1703c5c4113dSnw141292 	}
1704c5c4113dSnw141292 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values);
1705c5c4113dSnw141292 	sqlite_freemem(sql);
1706c5c4113dSnw141292 
1707c5c4113dSnw141292 	if (retcode == IDMAP_SUCCESS) {
170862c60062Sbaban 		if (type != NULL) {
1709c5c4113dSnw141292 			if (values[2] == NULL) {
1710c5c4113dSnw141292 				retcode = IDMAP_ERR_CACHE;
1711c5c4113dSnw141292 				goto out;
1712c5c4113dSnw141292 			}
1713c5c4113dSnw141292 			*type = strtol(values[2], &end, 10);
1714c5c4113dSnw141292 		}
1715c5c4113dSnw141292 
171662c60062Sbaban 		if (name != NULL && values[0] != NULL) {
1717c5c4113dSnw141292 			if ((*name = strdup(values[0])) == NULL) {
1718c5c4113dSnw141292 				idmapdlog(LOG_ERR, "Out of memory");
1719c5c4113dSnw141292 				retcode = IDMAP_ERR_MEMORY;
1720c5c4113dSnw141292 				goto out;
1721c5c4113dSnw141292 			}
1722c5c4113dSnw141292 		}
1723c5c4113dSnw141292 
172462c60062Sbaban 		if (domain != NULL && values[1] != NULL) {
1725c5c4113dSnw141292 			if ((*domain = strdup(values[1])) == NULL) {
172662c60062Sbaban 				if (name != NULL && *name) {
1727c5c4113dSnw141292 					free(*name);
1728c5c4113dSnw141292 					*name = NULL;
1729c5c4113dSnw141292 				}
1730c5c4113dSnw141292 				idmapdlog(LOG_ERR, "Out of memory");
1731c5c4113dSnw141292 				retcode = IDMAP_ERR_MEMORY;
1732c5c4113dSnw141292 				goto out;
1733c5c4113dSnw141292 			}
1734c5c4113dSnw141292 		}
1735c5c4113dSnw141292 	}
1736c5c4113dSnw141292 
1737c5c4113dSnw141292 out:
173862c60062Sbaban 	if (vm != NULL)
1739c5c4113dSnw141292 		(void) sqlite_finalize(vm, NULL);
1740c5c4113dSnw141292 	return (retcode);
1741c5c4113dSnw141292 }
1742c5c4113dSnw141292 
1743c5c4113dSnw141292 /*
1744e8c27ec8Sbaban  * Given SID, find winname using name_cache OR
1745e8c27ec8Sbaban  * Given winname, find SID using name_cache.
1746e8c27ec8Sbaban  * Used when mapping win to unix i.e. req->id1 is windows id and
1747e8c27ec8Sbaban  * req->id2 is unix id
1748c5c4113dSnw141292  */
1749cd37da74Snw141292 static
1750cd37da74Snw141292 idmap_retcode
1751e8c27ec8Sbaban lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res)
1752cd37da74Snw141292 {
1753c5c4113dSnw141292 	int		type = -1;
1754c5c4113dSnw141292 	idmap_retcode	retcode;
1755e8c27ec8Sbaban 	char		*sidprefix = NULL;
1756c5c4113dSnw141292 	idmap_rid_t	rid;
1757c5c4113dSnw141292 	char		*name = NULL, *domain = NULL;
1758c5c4113dSnw141292 
1759e8c27ec8Sbaban 	/* Done if we've both sid and winname */
1760e8c27ec8Sbaban 	if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL)
1761e8c27ec8Sbaban 		return (IDMAP_SUCCESS);
1762c5c4113dSnw141292 
1763e8c27ec8Sbaban 	/* Lookup sid to winname */
1764e8c27ec8Sbaban 	if (req->id1.idmap_id_u.sid.prefix != NULL) {
1765e8c27ec8Sbaban 		retcode = lookup_cache_sid2name(cache,
1766e8c27ec8Sbaban 		    req->id1.idmap_id_u.sid.prefix,
1767e8c27ec8Sbaban 		    req->id1.idmap_id_u.sid.rid, &name, &domain, &type);
176862c60062Sbaban 		goto out;
1769e8c27ec8Sbaban 	}
177062c60062Sbaban 
1771e8c27ec8Sbaban 	/* Lookup winame to sid */
1772e8c27ec8Sbaban 	retcode = lookup_cache_name2sid(cache, req->id1name, req->id1domain,
1773e8c27ec8Sbaban 	    &name, &sidprefix, &rid, &type);
1774c5c4113dSnw141292 
177562c60062Sbaban out:
1776e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS) {
1777c5c4113dSnw141292 		free(name);
1778c5c4113dSnw141292 		free(domain);
1779e8c27ec8Sbaban 		free(sidprefix);
1780e8c27ec8Sbaban 		return (retcode);
1781e8c27ec8Sbaban 	}
1782e8c27ec8Sbaban 
1783e8c27ec8Sbaban 	if (res->id.idtype == IDMAP_POSIXID) {
1784e8c27ec8Sbaban 		res->id.idtype = (type == _IDMAP_T_USER) ?
1785e8c27ec8Sbaban 		    IDMAP_UID : IDMAP_GID;
1786e8c27ec8Sbaban 	}
1787e8c27ec8Sbaban 	req->id1.idtype = (type == _IDMAP_T_USER) ?
1788e8c27ec8Sbaban 	    IDMAP_USID : IDMAP_GSID;
1789e8c27ec8Sbaban 
1790e8c27ec8Sbaban 	req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
1791e8c27ec8Sbaban 	if (name != NULL) {
1792e8c27ec8Sbaban 		free(req->id1name);	/* Free existing winname */
1793e8c27ec8Sbaban 		req->id1name = name;	/* and use canonical name instead */
1794e8c27ec8Sbaban 	}
1795e8c27ec8Sbaban 	if (req->id1domain == NULL)
1796e8c27ec8Sbaban 		req->id1domain = domain;
1797e8c27ec8Sbaban 	if (req->id1.idmap_id_u.sid.prefix == NULL) {
1798e8c27ec8Sbaban 		req->id1.idmap_id_u.sid.prefix = sidprefix;
1799e8c27ec8Sbaban 		req->id1.idmap_id_u.sid.rid = rid;
1800c5c4113dSnw141292 	}
1801c5c4113dSnw141292 	return (retcode);
1802c5c4113dSnw141292 }
1803c5c4113dSnw141292 
1804e8c27ec8Sbaban /*
1805e8c27ec8Sbaban  * Batch AD lookups
1806e8c27ec8Sbaban  */
1807c5c4113dSnw141292 idmap_retcode
1808e8c27ec8Sbaban ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch,
1809cd37da74Snw141292 		idmap_ids_res *result)
1810cd37da74Snw141292 {
1811c5c4113dSnw141292 	idmap_retcode	retcode;
1812e8c27ec8Sbaban 	int		i, add, type, is_wuser, is_user;
1813e8c27ec8Sbaban 	int		retries = 0, eunixtype;
1814e8c27ec8Sbaban 	char		**unixname;
1815c5c4113dSnw141292 	idmap_mapping	*req;
1816c5c4113dSnw141292 	idmap_id_res	*res;
1817e8c27ec8Sbaban 	idmap_query_state_t	*qs = NULL;
181848258c6bSjp151216 	idmap_how	*how;
1819479ac375Sdm199847 	char		**dn, **attr, **value;
1820e8c27ec8Sbaban 
1821e8c27ec8Sbaban 	/*
1822e8c27ec8Sbaban 	 * Since req->id2.idtype is unused, we will use it here
1823e8c27ec8Sbaban 	 * to retrieve the value of sid_type. But it needs to be
1824e8c27ec8Sbaban 	 * reset to IDMAP_NONE before we return to prevent xdr
1825e8c27ec8Sbaban 	 * from mis-interpreting req->id2 when it tries to free
1826e8c27ec8Sbaban 	 * the input argument. Other option is to allocate an
1827e8c27ec8Sbaban 	 * array of integers and use it instead for the batched
1828e8c27ec8Sbaban 	 * call. But why un-necessarily allocate memory. That may
1829e8c27ec8Sbaban 	 * be an option if req->id2.idtype cannot be re-used in
1830e8c27ec8Sbaban 	 * future.
1831e8c27ec8Sbaban 	 */
1832c5c4113dSnw141292 
1833c5c4113dSnw141292 	if (state->ad_nqueries == 0)
1834c5c4113dSnw141292 		return (IDMAP_SUCCESS);
1835c5c4113dSnw141292 
183696c3a9a0Sbaban 	for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
183796c3a9a0Sbaban 		req = &batch->idmap_mapping_batch_val[i];
183896c3a9a0Sbaban 		res = &result->ids.ids_val[i];
183996c3a9a0Sbaban 
184096c3a9a0Sbaban 		/* Skip if not marked for AD lookup or already in error. */
184196c3a9a0Sbaban 		if (!(req->direction & _IDMAP_F_LOOKUP_AD) ||
184296c3a9a0Sbaban 		    res->retcode != IDMAP_SUCCESS)
184396c3a9a0Sbaban 			continue;
184496c3a9a0Sbaban 
184596c3a9a0Sbaban 		/* Init status */
184696c3a9a0Sbaban 		res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR;
184796c3a9a0Sbaban 	}
184896c3a9a0Sbaban 
1849c5c4113dSnw141292 retry:
1850*2b4a7802SBaban Kenkre 	RDLOCK_CONFIG();
1851e8c27ec8Sbaban 	retcode = idmap_lookup_batch_start(_idmapdstate.ad, state->ad_nqueries,
1852e8c27ec8Sbaban 	    &qs);
1853*2b4a7802SBaban Kenkre 	UNLOCK_CONFIG();
1854e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS) {
1855*2b4a7802SBaban Kenkre 		if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
1856*2b4a7802SBaban Kenkre 		    retries++ < ADUTILS_DEF_NUM_RETRIES)
18570dcc7149Snw141292 			goto retry;
1858349d5d8fSnw141292 		degrade_svc(1, "failed to create batch for AD lookup");
1859e8c27ec8Sbaban 		goto out;
1860c5c4113dSnw141292 	}
1861c5c4113dSnw141292 
1862c8e26105Sjp151216 	restore_svc();
1863c8e26105Sjp151216 
1864e8c27ec8Sbaban 	idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr,
1865e8c27ec8Sbaban 	    state->ad_unixgroup_attr);
1866e8c27ec8Sbaban 
1867e8c27ec8Sbaban 	for (i = 0, add = 0; i < batch->idmap_mapping_batch_len; i++) {
1868c5c4113dSnw141292 		req = &batch->idmap_mapping_batch_val[i];
1869c5c4113dSnw141292 		res = &result->ids.ids_val[i];
187048258c6bSjp151216 		how = &res->info.how;
187148258c6bSjp151216 
1872e8c27ec8Sbaban 		retcode = IDMAP_SUCCESS;
1873e8c27ec8Sbaban 		req->id2.idtype = IDMAP_NONE;
1874c5c4113dSnw141292 
1875e8c27ec8Sbaban 		/* Skip if not marked for AD lookup */
1876e8c27ec8Sbaban 		if (!(req->direction & _IDMAP_F_LOOKUP_AD))
1877e8c27ec8Sbaban 			continue;
1878e8c27ec8Sbaban 
187996c3a9a0Sbaban 		if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR)
1880c5c4113dSnw141292 			continue;
1881e8c27ec8Sbaban 
1882e8c27ec8Sbaban 		if (IS_REQUEST_SID(*req, 1)) {
1883e8c27ec8Sbaban 
1884479ac375Sdm199847 			/* win2unix request: */
1885e8c27ec8Sbaban 
1886479ac375Sdm199847 			unixname = dn = attr = value = NULL;
1887e8c27ec8Sbaban 			eunixtype = _IDMAP_T_UNDEF;
1888e8c27ec8Sbaban 			if (req->id2name == NULL) {
1889e8c27ec8Sbaban 				if (res->id.idtype == IDMAP_UID &&
1890e8c27ec8Sbaban 				    AD_OR_MIXED(state->nm_siduid)) {
1891e8c27ec8Sbaban 					eunixtype = _IDMAP_T_USER;
1892e8c27ec8Sbaban 					unixname = &req->id2name;
1893e8c27ec8Sbaban 				} else if (res->id.idtype == IDMAP_GID &&
1894e8c27ec8Sbaban 				    AD_OR_MIXED(state->nm_sidgid)) {
1895e8c27ec8Sbaban 					eunixtype = _IDMAP_T_GROUP;
1896e8c27ec8Sbaban 					unixname = &req->id2name;
1897e8c27ec8Sbaban 				} else if (AD_OR_MIXED(state->nm_siduid) ||
1898e8c27ec8Sbaban 				    AD_OR_MIXED(state->nm_sidgid)) {
1899e8c27ec8Sbaban 					unixname = &req->id2name;
1900e8c27ec8Sbaban 				}
1901e8c27ec8Sbaban 			}
1902e8c27ec8Sbaban 			add = 1;
1903479ac375Sdm199847 			if (unixname != NULL) {
1904479ac375Sdm199847 				/*
1905479ac375Sdm199847 				 * Get how info for DS-based name
1906479ac375Sdm199847 				 * mapping only if AD or MIXED
1907479ac375Sdm199847 				 * mode is enabled.
1908479ac375Sdm199847 				 */
1909479ac375Sdm199847 				idmap_info_free(&res->info);
191048258c6bSjp151216 				res->info.src = IDMAP_MAP_SRC_NEW;
191148258c6bSjp151216 				how->map_type = IDMAP_MAP_TYPE_DS_AD;
1912479ac375Sdm199847 				dn = &how->idmap_how_u.ad.dn;
1913479ac375Sdm199847 				attr = &how->idmap_how_u.ad.attr;
1914479ac375Sdm199847 				value = &how->idmap_how_u.ad.value;
1915479ac375Sdm199847 			}
1916479ac375Sdm199847 			if (req->id1.idmap_id_u.sid.prefix != NULL) {
1917479ac375Sdm199847 				/* Lookup AD by SID */
1918c5c4113dSnw141292 				retcode = idmap_sid2name_batch_add1(
1919e8c27ec8Sbaban 				    qs, req->id1.idmap_id_u.sid.prefix,
1920e8c27ec8Sbaban 				    &req->id1.idmap_id_u.sid.rid, eunixtype,
1921479ac375Sdm199847 				    dn, attr, value,
1922479ac375Sdm199847 				    (req->id1name == NULL) ?
1923479ac375Sdm199847 				    &req->id1name : NULL,
1924479ac375Sdm199847 				    (req->id1domain == NULL) ?
1925479ac375Sdm199847 				    &req->id1domain : NULL,
1926479ac375Sdm199847 				    (int *)&req->id2.idtype, unixname,
1927479ac375Sdm199847 				    &res->retcode);
1928479ac375Sdm199847 			} else {
1929479ac375Sdm199847 				/* Lookup AD by winname */
1930479ac375Sdm199847 				assert(req->id1name != NULL);
1931479ac375Sdm199847 				retcode = idmap_name2sid_batch_add1(
1932479ac375Sdm199847 				    qs, req->id1name, req->id1domain,
1933479ac375Sdm199847 				    eunixtype,
1934479ac375Sdm199847 				    dn, attr, value,
1935479ac375Sdm199847 				    &req->id1name,
1936479ac375Sdm199847 				    &req->id1.idmap_id_u.sid.prefix,
1937479ac375Sdm199847 				    &req->id1.idmap_id_u.sid.rid,
1938479ac375Sdm199847 				    (int *)&req->id2.idtype, unixname,
1939479ac375Sdm199847 				    &res->retcode);
1940479ac375Sdm199847 			}
1941c5c4113dSnw141292 
1942e8c27ec8Sbaban 		} else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) {
1943479ac375Sdm199847 
1944479ac375Sdm199847 			/* unix2win request: */
1945e8c27ec8Sbaban 
1946e8c27ec8Sbaban 			if (res->id.idmap_id_u.sid.prefix != NULL &&
1947e8c27ec8Sbaban 			    req->id2name != NULL) {
1948e8c27ec8Sbaban 				/* Already have SID and winname -- done */
1949e8c27ec8Sbaban 				res->retcode = IDMAP_SUCCESS;
1950e8c27ec8Sbaban 				continue;
1951c5c4113dSnw141292 			}
1952c5c4113dSnw141292 
1953e8c27ec8Sbaban 			if (res->id.idmap_id_u.sid.prefix != NULL) {
1954cd37da74Snw141292 				/*
1955e8c27ec8Sbaban 				 * SID but no winname -- lookup AD by
1956e8c27ec8Sbaban 				 * SID to get winname.
1957479ac375Sdm199847 				 * how info is not needed here because
1958479ac375Sdm199847 				 * we are not retrieving unixname from
1959479ac375Sdm199847 				 * AD.
1960cd37da74Snw141292 				 */
1961e8c27ec8Sbaban 				add = 1;
1962e8c27ec8Sbaban 				retcode = idmap_sid2name_batch_add1(
1963e8c27ec8Sbaban 				    qs, res->id.idmap_id_u.sid.prefix,
1964e8c27ec8Sbaban 				    &res->id.idmap_id_u.sid.rid,
196548258c6bSjp151216 				    _IDMAP_T_UNDEF,
1966479ac375Sdm199847 				    NULL, NULL, NULL,
196748258c6bSjp151216 				    &req->id2name,
1968e8c27ec8Sbaban 				    &req->id2domain, (int *)&req->id2.idtype,
1969e8c27ec8Sbaban 				    NULL, &res->retcode);
1970e8c27ec8Sbaban 			} else if (req->id2name != NULL) {
1971e8c27ec8Sbaban 				/*
1972e8c27ec8Sbaban 				 * winname but no SID -- lookup AD by
1973e8c27ec8Sbaban 				 * winname to get SID.
1974479ac375Sdm199847 				 * how info is not needed here because
1975479ac375Sdm199847 				 * we are not retrieving unixname from
1976479ac375Sdm199847 				 * AD.
1977e8c27ec8Sbaban 				 */
1978e8c27ec8Sbaban 				add = 1;
1979e8c27ec8Sbaban 				retcode = idmap_name2sid_batch_add1(
1980e8c27ec8Sbaban 				    qs, req->id2name, req->id2domain,
198148258c6bSjp151216 				    _IDMAP_T_UNDEF,
1982479ac375Sdm199847 				    NULL, NULL, NULL, NULL,
1983e8c27ec8Sbaban 				    &res->id.idmap_id_u.sid.prefix,
1984e8c27ec8Sbaban 				    &res->id.idmap_id_u.sid.rid,
1985e8c27ec8Sbaban 				    (int *)&req->id2.idtype, NULL,
1986e8c27ec8Sbaban 				    &res->retcode);
1987e8c27ec8Sbaban 			} else if (req->id1name != NULL) {
1988e8c27ec8Sbaban 				/*
1989e8c27ec8Sbaban 				 * No SID and no winname but we've unixname --
1990e8c27ec8Sbaban 				 * lookup AD by unixname to get SID.
1991e8c27ec8Sbaban 				 */
1992e8c27ec8Sbaban 				is_user = (IS_REQUEST_UID(*req)) ? 1 : 0;
1993e8c27ec8Sbaban 				if (res->id.idtype == IDMAP_USID)
1994e8c27ec8Sbaban 					is_wuser = 1;
1995e8c27ec8Sbaban 				else if (res->id.idtype == IDMAP_GSID)
1996e8c27ec8Sbaban 					is_wuser = 0;
1997e8c27ec8Sbaban 				else
1998e8c27ec8Sbaban 					is_wuser = is_user;
1999e8c27ec8Sbaban 				add = 1;
2000479ac375Sdm199847 				idmap_info_free(&res->info);
200148258c6bSjp151216 				res->info.src = IDMAP_MAP_SRC_NEW;
200248258c6bSjp151216 				how->map_type = IDMAP_MAP_TYPE_DS_AD;
2003e8c27ec8Sbaban 				retcode = idmap_unixname2sid_batch_add1(
2004e8c27ec8Sbaban 				    qs, req->id1name, is_user, is_wuser,
200548258c6bSjp151216 				    &how->idmap_how_u.ad.dn,
200648258c6bSjp151216 				    &how->idmap_how_u.ad.attr,
200748258c6bSjp151216 				    &how->idmap_how_u.ad.value,
2008e8c27ec8Sbaban 				    &res->id.idmap_id_u.sid.prefix,
2009e8c27ec8Sbaban 				    &res->id.idmap_id_u.sid.rid,
2010e8c27ec8Sbaban 				    &req->id2name, &req->id2domain,
2011e8c27ec8Sbaban 				    (int *)&req->id2.idtype, &res->retcode);
2012e8c27ec8Sbaban 			}
2013e8c27ec8Sbaban 		}
2014e8c27ec8Sbaban 		if (retcode != IDMAP_SUCCESS) {
2015e8c27ec8Sbaban 			idmap_lookup_release_batch(&qs);
2016e8c27ec8Sbaban 			break;
2017e8c27ec8Sbaban 		}
2018cd37da74Snw141292 	}
2019cd37da74Snw141292 
202096c3a9a0Sbaban 	if (retcode == IDMAP_SUCCESS) {
202196c3a9a0Sbaban 		/* add keeps track if we added an entry to the batch */
202296c3a9a0Sbaban 		if (add)
20230dcc7149Snw141292 			retcode = idmap_lookup_batch_end(&qs);
202496c3a9a0Sbaban 		else
202596c3a9a0Sbaban 			idmap_lookup_release_batch(&qs);
202696c3a9a0Sbaban 	}
2027cd37da74Snw141292 
2028*2b4a7802SBaban Kenkre 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
2029*2b4a7802SBaban Kenkre 	    retries++ < ADUTILS_DEF_NUM_RETRIES)
2030c5c4113dSnw141292 		goto retry;
2031c8e26105Sjp151216 	else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
2032349d5d8fSnw141292 		degrade_svc(1, "some AD lookups timed out repeatedly");
2033c5c4113dSnw141292 
2034e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS)
2035e8c27ec8Sbaban 		idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests");
2036c5c4113dSnw141292 
2037c5c4113dSnw141292 out:
2038e8c27ec8Sbaban 	/*
2039e8c27ec8Sbaban 	 * This loop does the following:
2040479ac375Sdm199847 	 * 1. Reset _IDMAP_F_LOOKUP_AD flag from the request.
2041479ac375Sdm199847 	 * 2. Reset req->id2.idtype to IDMAP_NONE
2042479ac375Sdm199847 	 * 3. If batch_start or batch_add failed then set the status
2043479ac375Sdm199847 	 *    of each request marked for AD lookup to that error.
2044479ac375Sdm199847 	 * 4. Evaluate the type of the AD object (i.e. user or group) and
2045479ac375Sdm199847 	 *    update the idtype in request.
2046e8c27ec8Sbaban 	 */
2047e8c27ec8Sbaban 	for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
2048e8c27ec8Sbaban 		req = &batch->idmap_mapping_batch_val[i];
2049e8c27ec8Sbaban 		type = req->id2.idtype;
2050e8c27ec8Sbaban 		req->id2.idtype = IDMAP_NONE;
20515e0794bcSbaban 		res = &result->ids.ids_val[i];
205248258c6bSjp151216 		how = &res->info.how;
2053e8c27ec8Sbaban 		if (!(req->direction & _IDMAP_F_LOOKUP_AD))
2054e8c27ec8Sbaban 			continue;
2055e8c27ec8Sbaban 
2056479ac375Sdm199847 		/* Reset AD lookup flag */
2057479ac375Sdm199847 		req->direction &= ~(_IDMAP_F_LOOKUP_AD);
2058479ac375Sdm199847 
2059479ac375Sdm199847 		/*
2060479ac375Sdm199847 		 * If batch_start or batch_add failed then set the status
2061479ac375Sdm199847 		 * of each request marked for AD lookup to that error.
2062479ac375Sdm199847 		 */
2063e8c27ec8Sbaban 		if (retcode != IDMAP_SUCCESS) {
2064e8c27ec8Sbaban 			res->retcode = retcode;
2065e8c27ec8Sbaban 			continue;
2066e8c27ec8Sbaban 		}
2067e8c27ec8Sbaban 
2068e8c27ec8Sbaban 		if (!add)
2069e8c27ec8Sbaban 			continue;
2070e8c27ec8Sbaban 
207148258c6bSjp151216 		if (res->retcode == IDMAP_ERR_NOTFOUND) {
207248258c6bSjp151216 			/* Nothing found - remove the preset info */
2073479ac375Sdm199847 			idmap_info_free(&res->info);
207448258c6bSjp151216 		}
207548258c6bSjp151216 
2076e8c27ec8Sbaban 		if (IS_REQUEST_SID(*req, 1)) {
2077e8c27ec8Sbaban 			if (res->retcode != IDMAP_SUCCESS)
2078e8c27ec8Sbaban 				continue;
2079479ac375Sdm199847 			/* Evaluate result type */
2080e8c27ec8Sbaban 			switch (type) {
2081e8c27ec8Sbaban 			case _IDMAP_T_USER:
2082e8c27ec8Sbaban 				if (res->id.idtype == IDMAP_POSIXID)
2083e8c27ec8Sbaban 					res->id.idtype = IDMAP_UID;
2084e8c27ec8Sbaban 				req->id1.idtype = IDMAP_USID;
2085e8c27ec8Sbaban 				break;
2086e8c27ec8Sbaban 			case _IDMAP_T_GROUP:
2087e8c27ec8Sbaban 				if (res->id.idtype == IDMAP_POSIXID)
2088e8c27ec8Sbaban 					res->id.idtype = IDMAP_GID;
2089e8c27ec8Sbaban 				req->id1.idtype = IDMAP_GSID;
2090e8c27ec8Sbaban 				break;
2091e8c27ec8Sbaban 			default:
2092e8c27ec8Sbaban 				res->retcode = IDMAP_ERR_SID;
2093e8c27ec8Sbaban 				break;
2094e8c27ec8Sbaban 			}
2095479ac375Sdm199847 			if (res->retcode == IDMAP_SUCCESS &&
2096479ac375Sdm199847 			    req->id1name != NULL &&
2097479ac375Sdm199847 			    (req->id2name == NULL ||
2098479ac375Sdm199847 			    res->id.idmap_id_u.uid == SENTINEL_PID) &&
2099479ac375Sdm199847 			    NLDAP_MODE(res->id.idtype, state)) {
2100479ac375Sdm199847 				req->direction |= _IDMAP_F_LOOKUP_NLDAP;
2101479ac375Sdm199847 				state->nldap_nqueries++;
2102479ac375Sdm199847 			}
2103e8c27ec8Sbaban 		} else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) {
2104e8c27ec8Sbaban 			if (res->retcode != IDMAP_SUCCESS) {
2105e8c27ec8Sbaban 				if ((!(IDMAP_FATAL_ERROR(res->retcode))) &&
2106e8c27ec8Sbaban 				    res->id.idmap_id_u.sid.prefix == NULL &&
2107e8c27ec8Sbaban 				    req->id2name == NULL && /* no winname */
2108e8c27ec8Sbaban 				    req->id1name != NULL) /* unixname */
2109e8c27ec8Sbaban 					/*
2110479ac375Sdm199847 					 * If AD lookup by unixname failed
2111479ac375Sdm199847 					 * with non fatal error then clear
2112479ac375Sdm199847 					 * the error (i.e set res->retcode
2113479ac375Sdm199847 					 * to success). This allows the next
2114479ac375Sdm199847 					 * pass to process other mapping
2115479ac375Sdm199847 					 * mechanisms for this request.
2116e8c27ec8Sbaban 					 */
2117e8c27ec8Sbaban 					res->retcode = IDMAP_SUCCESS;
2118e8c27ec8Sbaban 				continue;
2119e8c27ec8Sbaban 			}
2120479ac375Sdm199847 			/* Evaluate result type */
2121e8c27ec8Sbaban 			switch (type) {
2122e8c27ec8Sbaban 			case _IDMAP_T_USER:
2123e8c27ec8Sbaban 				if (res->id.idtype == IDMAP_SID)
2124e8c27ec8Sbaban 					res->id.idtype = IDMAP_USID;
2125e8c27ec8Sbaban 				break;
2126e8c27ec8Sbaban 			case _IDMAP_T_GROUP:
2127e8c27ec8Sbaban 				if (res->id.idtype == IDMAP_SID)
2128e8c27ec8Sbaban 					res->id.idtype = IDMAP_GSID;
2129e8c27ec8Sbaban 				break;
2130e8c27ec8Sbaban 			default:
2131e8c27ec8Sbaban 				res->retcode = IDMAP_ERR_SID;
2132e8c27ec8Sbaban 				break;
2133e8c27ec8Sbaban 			}
2134e8c27ec8Sbaban 		}
2135e8c27ec8Sbaban 	}
2136e8c27ec8Sbaban 
2137e8c27ec8Sbaban 	/* AD lookups done. Reset state->ad_nqueries and return */
2138e8c27ec8Sbaban 	state->ad_nqueries = 0;
2139c5c4113dSnw141292 	return (retcode);
2140c5c4113dSnw141292 }
2141c5c4113dSnw141292 
2142cd37da74Snw141292 /*
2143cd37da74Snw141292  * Convention when processing win2unix requests:
2144cd37da74Snw141292  *
2145cd37da74Snw141292  * Windows identity:
2146cd37da74Snw141292  * req->id1name =
2147cd37da74Snw141292  *              winname if given otherwise winname found will be placed
2148cd37da74Snw141292  *              here.
2149cd37da74Snw141292  * req->id1domain =
2150cd37da74Snw141292  *              windomain if given otherwise windomain found will be
2151cd37da74Snw141292  *              placed here.
2152cd37da74Snw141292  * req->id1.idtype =
2153cd37da74Snw141292  *              Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll
2154cd37da74Snw141292  *              be set to IDMAP_USID/GSID depending upon whether the
2155cd37da74Snw141292  *              given SID is user or group respectively. The user/group-ness
2156cd37da74Snw141292  *              is determined either when looking up well-known SIDs table OR
2157479ac375Sdm199847  *              if the SID is found in namecache OR by ad_lookup_one() OR by
2158cd37da74Snw141292  *              ad_lookup_batch().
2159cd37da74Snw141292  * req->id1..sid.[prefix, rid] =
2160cd37da74Snw141292  *              SID if given otherwise SID found will be placed here.
2161cd37da74Snw141292  *
2162cd37da74Snw141292  * Unix identity:
2163cd37da74Snw141292  * req->id2name =
2164cd37da74Snw141292  *              unixname found will be placed here.
2165cd37da74Snw141292  * req->id2domain =
2166cd37da74Snw141292  *              NOT USED
2167cd37da74Snw141292  * res->id.idtype =
2168cd37da74Snw141292  *              Target type initialized from req->id2.idtype. If
2169cd37da74Snw141292  *              it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found
2170cd37da74Snw141292  *              will be placed here.
2171cd37da74Snw141292  * res->id..[uid or gid] =
2172cd37da74Snw141292  *              UID/GID found will be placed here.
2173cd37da74Snw141292  *
2174cd37da74Snw141292  * Others:
2175cd37da74Snw141292  * res->retcode =
2176cd37da74Snw141292  *              Return status for this request will be placed here.
2177cd37da74Snw141292  * res->direction =
2178cd37da74Snw141292  *              Direction found will be placed here. Direction
2179cd37da74Snw141292  *              meaning whether the resultant mapping is valid
2180cd37da74Snw141292  *              only from win2unix or bi-directional.
2181cd37da74Snw141292  * req->direction =
2182cd37da74Snw141292  *              INTERNAL USE. Used by idmapd to set various
2183cd37da74Snw141292  *              flags (_IDMAP_F_xxxx) to aid in processing
2184cd37da74Snw141292  *              of the request.
2185cd37da74Snw141292  * req->id2.idtype =
2186cd37da74Snw141292  *              INTERNAL USE. Initially this is the requested target
2187cd37da74Snw141292  *              type and is used to initialize res->id.idtype.
2188cd37da74Snw141292  *              ad_lookup_batch() uses this field temporarily to store
2189cd37da74Snw141292  *              sid_type obtained by the batched AD lookups and after
2190cd37da74Snw141292  *              use resets it to IDMAP_NONE to prevent xdr from
2191cd37da74Snw141292  *              mis-interpreting the contents of req->id2.
2192cd37da74Snw141292  * req->id2..[uid or gid or sid] =
2193cd37da74Snw141292  *              NOT USED
2194cd37da74Snw141292  */
2195cd37da74Snw141292 
2196cd37da74Snw141292 /*
2197cd37da74Snw141292  * This function does the following:
2198cd37da74Snw141292  * 1. Lookup well-known SIDs table.
2199cd37da74Snw141292  * 2. Check if the given SID is a local-SID and if so extract UID/GID from it.
2200cd37da74Snw141292  * 3. Lookup cache.
2201cd37da74Snw141292  * 4. Check if the client does not want new mapping to be allocated
2202cd37da74Snw141292  *    in which case this pass is the final pass.
2203cd37da74Snw141292  * 5. Set AD lookup flag if it determines that the next stage needs
2204cd37da74Snw141292  *    to do AD lookup.
2205cd37da74Snw141292  */
2206c5c4113dSnw141292 idmap_retcode
2207479ac375Sdm199847 sid2pid_first_pass(lookup_state_t *state, idmap_mapping *req,
2208cd37da74Snw141292 		idmap_id_res *res)
2209cd37da74Snw141292 {
2210c5c4113dSnw141292 	idmap_retcode	retcode;
2211e8c27ec8Sbaban 	int		wksid;
2212c5c4113dSnw141292 
2213e8c27ec8Sbaban 	/* Initialize result */
2214e8c27ec8Sbaban 	res->id.idtype = req->id2.idtype;
2215e8c27ec8Sbaban 	res->id.idmap_id_u.uid = SENTINEL_PID;
2216e8c27ec8Sbaban 	res->direction = IDMAP_DIRECTION_UNDEF;
2217e8c27ec8Sbaban 	wksid = 0;
2218c5c4113dSnw141292 
2219cf5b5989Sdm199847 	if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) {
2220e8c27ec8Sbaban 		if (req->id1name == NULL) {
2221e8c27ec8Sbaban 			retcode = IDMAP_ERR_ARG;
2222c5c4113dSnw141292 			goto out;
2223c5c4113dSnw141292 		}
2224e8c27ec8Sbaban 		/* sanitize sidprefix */
2225e8c27ec8Sbaban 		free(req->id1.idmap_id_u.sid.prefix);
2226e8c27ec8Sbaban 		req->id1.idmap_id_u.sid.prefix = NULL;
2227e8c27ec8Sbaban 	}
2228c5c4113dSnw141292 
2229e8c27ec8Sbaban 	/* Lookup well-known SIDs table */
2230e8c27ec8Sbaban 	retcode = lookup_wksids_sid2pid(req, res, &wksid);
2231c5c4113dSnw141292 	if (retcode != IDMAP_ERR_NOTFOUND)
2232c5c4113dSnw141292 		goto out;
2233c5c4113dSnw141292 
2234e8c27ec8Sbaban 	if (!wksid) {
2235*2b4a7802SBaban Kenkre 		/* Check if this is a localsid */
2236e8c27ec8Sbaban 		retcode = lookup_localsid2pid(req, res);
2237e8c27ec8Sbaban 		if (retcode != IDMAP_ERR_NOTFOUND)
2238e8c27ec8Sbaban 			goto out;
2239*2b4a7802SBaban Kenkre 
2240*2b4a7802SBaban Kenkre 		if (ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)) {
2241*2b4a7802SBaban Kenkre 			retcode = IDMAP_ERR_NONEGENERATED;
2242*2b4a7802SBaban Kenkre 			goto out;
2243*2b4a7802SBaban Kenkre 		}
2244e8c27ec8Sbaban 	}
2245e8c27ec8Sbaban 
2246e8c27ec8Sbaban 	/* Lookup cache */
2247479ac375Sdm199847 	retcode = lookup_cache_sid2pid(state->cache, req, res);
2248c5c4113dSnw141292 	if (retcode != IDMAP_ERR_NOTFOUND)
2249c5c4113dSnw141292 		goto out;
2250c5c4113dSnw141292 
2251c5c4113dSnw141292 	if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) {
225248258c6bSjp151216 		retcode = IDMAP_ERR_NONEGENERATED;
2253c5c4113dSnw141292 		goto out;
2254c5c4113dSnw141292 	}
2255c5c4113dSnw141292 
2256c5c4113dSnw141292 	/*
2257e8c27ec8Sbaban 	 * Failed to find non-expired entry in cache. Next step is
2258e8c27ec8Sbaban 	 * to determine if this request needs to be batched for AD lookup.
2259e8c27ec8Sbaban 	 *
2260e8c27ec8Sbaban 	 * At this point we have either sid or winname or both. If we don't
2261e8c27ec8Sbaban 	 * have both then lookup name_cache for the sid or winname
2262e8c27ec8Sbaban 	 * whichever is missing. If not found then this request will be
2263e8c27ec8Sbaban 	 * batched for AD lookup.
2264e8c27ec8Sbaban 	 */
2265479ac375Sdm199847 	retcode = lookup_name_cache(state->cache, req, res);
2266e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS && retcode != IDMAP_ERR_NOTFOUND)
2267e8c27ec8Sbaban 		goto out;
2268e8c27ec8Sbaban 
2269e8c27ec8Sbaban 	/*
2270e8c27ec8Sbaban 	 * Set the flag to indicate that we are not done yet so that
2271e8c27ec8Sbaban 	 * subsequent passes considers this request for name-based
2272e8c27ec8Sbaban 	 * mapping and ephemeral mapping.
2273c5c4113dSnw141292 	 */
2274c5c4113dSnw141292 	state->sid2pid_done = FALSE;
2275e8c27ec8Sbaban 	req->direction |= _IDMAP_F_NOTDONE;
2276c5c4113dSnw141292 
2277c5c4113dSnw141292 	/*
2278e8c27ec8Sbaban 	 * Even if we have both sid and winname, we still may need to batch
2279e8c27ec8Sbaban 	 * this request for AD lookup if we don't have unixname and
2280e8c27ec8Sbaban 	 * directory-based name mapping (AD or mixed) is enabled.
2281e8c27ec8Sbaban 	 * We avoid AD lookup for well-known SIDs because they don't have
2282e8c27ec8Sbaban 	 * regular AD objects.
2283c5c4113dSnw141292 	 */
2284e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS ||
2285e8c27ec8Sbaban 	    (!wksid && req->id2name == NULL &&
2286e8c27ec8Sbaban 	    AD_OR_MIXED_MODE(res->id.idtype, state))) {
2287c5c4113dSnw141292 		retcode = IDMAP_SUCCESS;
2288e8c27ec8Sbaban 		req->direction |= _IDMAP_F_LOOKUP_AD;
2289c5c4113dSnw141292 		state->ad_nqueries++;
2290479ac375Sdm199847 	} else if (NLDAP_MODE(res->id.idtype, state)) {
2291479ac375Sdm199847 		req->direction |= _IDMAP_F_LOOKUP_NLDAP;
2292479ac375Sdm199847 		state->nldap_nqueries++;
2293c5c4113dSnw141292 	}
2294c5c4113dSnw141292 
2295c5c4113dSnw141292 
2296c5c4113dSnw141292 out:
2297c5c4113dSnw141292 	res->retcode = idmap_stat4prot(retcode);
2298e8c27ec8Sbaban 	/*
2299e8c27ec8Sbaban 	 * If we are done and there was an error then set fallback pid
2300e8c27ec8Sbaban 	 * in the result.
2301e8c27ec8Sbaban 	 */
2302e8c27ec8Sbaban 	if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS)
2303e8c27ec8Sbaban 		res->id.idmap_id_u.uid = UID_NOBODY;
2304c5c4113dSnw141292 	return (retcode);
2305c5c4113dSnw141292 }
2306c5c4113dSnw141292 
2307c5c4113dSnw141292 /*
2308c5c4113dSnw141292  * Generate SID using the following convention
2309c5c4113dSnw141292  * 	<machine-sid-prefix>-<1000 + uid>
2310c5c4113dSnw141292  * 	<machine-sid-prefix>-<2^31 + gid>
2311c5c4113dSnw141292  */
2312cd37da74Snw141292 static
2313cd37da74Snw141292 idmap_retcode
231448258c6bSjp151216 generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user,
231548258c6bSjp151216 		int fallback)
2316cd37da74Snw141292 {
2317e8c27ec8Sbaban 	free(res->id.idmap_id_u.sid.prefix);
2318e8c27ec8Sbaban 	res->id.idmap_id_u.sid.prefix = NULL;
2319e8c27ec8Sbaban 
2320e8c27ec8Sbaban 	/*
2321e8c27ec8Sbaban 	 * Diagonal mapping for localSIDs not supported because of the
2322e8c27ec8Sbaban 	 * way we generate localSIDs.
2323e8c27ec8Sbaban 	 */
2324e8c27ec8Sbaban 	if (is_user && res->id.idtype == IDMAP_GSID)
2325e8c27ec8Sbaban 		return (IDMAP_ERR_NOMAPPING);
2326e8c27ec8Sbaban 	if (!is_user && res->id.idtype == IDMAP_USID)
2327e8c27ec8Sbaban 		return (IDMAP_ERR_NOMAPPING);
2328e8c27ec8Sbaban 
2329c5c4113dSnw141292 	/* Skip 1000 UIDs */
2330c5c4113dSnw141292 	if (is_user && req->id1.idmap_id_u.uid >
2331c5c4113dSnw141292 	    (INT32_MAX - LOCALRID_MIN))
233262c60062Sbaban 		return (IDMAP_ERR_NOMAPPING);
2333c5c4113dSnw141292 
2334c5c4113dSnw141292 	RDLOCK_CONFIG();
2335e8c27ec8Sbaban 	/*
2336e8c27ec8Sbaban 	 * machine_sid is never NULL because if it is we won't be here.
2337e8c27ec8Sbaban 	 * No need to assert because stdrup(NULL) will core anyways.
2338e8c27ec8Sbaban 	 */
2339c5c4113dSnw141292 	res->id.idmap_id_u.sid.prefix =
2340c5c4113dSnw141292 	    strdup(_idmapdstate.cfg->pgcfg.machine_sid);
2341c5c4113dSnw141292 	if (res->id.idmap_id_u.sid.prefix == NULL) {
2342c5c4113dSnw141292 		UNLOCK_CONFIG();
2343c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
2344c5c4113dSnw141292 		return (IDMAP_ERR_MEMORY);
2345c5c4113dSnw141292 	}
2346c5c4113dSnw141292 	UNLOCK_CONFIG();
2347c5c4113dSnw141292 	res->id.idmap_id_u.sid.rid =
2348c5c4113dSnw141292 	    (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_MIN :
2349c5c4113dSnw141292 	    req->id1.idmap_id_u.gid + INT32_MAX + 1;
2350651c0131Sbaban 	res->direction = IDMAP_DIRECTION_BI;
2351e8c27ec8Sbaban 	if (res->id.idtype == IDMAP_SID)
2352e8c27ec8Sbaban 		res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
2353c5c4113dSnw141292 
235448258c6bSjp151216 	if (!fallback && req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
235548258c6bSjp151216 		res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID;
235648258c6bSjp151216 		res->info.src = IDMAP_MAP_SRC_ALGORITHMIC;
235748258c6bSjp151216 	}
235848258c6bSjp151216 
2359c5c4113dSnw141292 	/*
2360c5c4113dSnw141292 	 * Don't update name_cache because local sids don't have
2361c5c4113dSnw141292 	 * valid windows names.
2362c5c4113dSnw141292 	 */
2363e8c27ec8Sbaban 	req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
2364947c7bc0Sbaban 	return (IDMAP_SUCCESS);
2365c5c4113dSnw141292 }
2366c5c4113dSnw141292 
2367cd37da74Snw141292 static
2368cd37da74Snw141292 idmap_retcode
2369cd37da74Snw141292 lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res)
2370cd37da74Snw141292 {
2371c5c4113dSnw141292 	char		*sidprefix;
2372c5c4113dSnw141292 	uint32_t	rid;
2373c5c4113dSnw141292 	int		s;
2374c5c4113dSnw141292 
2375c5c4113dSnw141292 	/*
2376c5c4113dSnw141292 	 * If the sidprefix == localsid then UID = last RID - 1000 or
2377c5c4113dSnw141292 	 * GID = last RID - 2^31.
2378c5c4113dSnw141292 	 */
2379e8c27ec8Sbaban 	if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL)
2380e8c27ec8Sbaban 		/* This means we are looking up by winname */
2381e8c27ec8Sbaban 		return (IDMAP_ERR_NOTFOUND);
2382c5c4113dSnw141292 	rid = req->id1.idmap_id_u.sid.rid;
2383c5c4113dSnw141292 
2384c5c4113dSnw141292 	RDLOCK_CONFIG();
2385c5c4113dSnw141292 	s = (_idmapdstate.cfg->pgcfg.machine_sid) ?
2386cd37da74Snw141292 	    strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1;
2387c5c4113dSnw141292 	UNLOCK_CONFIG();
2388c5c4113dSnw141292 
2389e8c27ec8Sbaban 	/*
2390e8c27ec8Sbaban 	 * If the given sidprefix does not match machine_sid then this is
2391e8c27ec8Sbaban 	 * not a local SID.
2392e8c27ec8Sbaban 	 */
2393e8c27ec8Sbaban 	if (s != 0)
2394e8c27ec8Sbaban 		return (IDMAP_ERR_NOTFOUND);
2395e8c27ec8Sbaban 
2396e8c27ec8Sbaban 	switch (res->id.idtype) {
2397c5c4113dSnw141292 	case IDMAP_UID:
2398e8c27ec8Sbaban 		if (rid > INT32_MAX || rid < LOCALRID_MIN)
2399e8c27ec8Sbaban 			return (IDMAP_ERR_ARG);
2400c5c4113dSnw141292 		res->id.idmap_id_u.uid = rid - LOCALRID_MIN;
2401c5c4113dSnw141292 		break;
2402c5c4113dSnw141292 	case IDMAP_GID:
2403e8c27ec8Sbaban 		if (rid <= INT32_MAX)
2404e8c27ec8Sbaban 			return (IDMAP_ERR_ARG);
2405c5c4113dSnw141292 		res->id.idmap_id_u.gid = rid - INT32_MAX - 1;
2406c5c4113dSnw141292 		break;
2407c5c4113dSnw141292 	case IDMAP_POSIXID:
2408c5c4113dSnw141292 		if (rid > INT32_MAX) {
2409cd37da74Snw141292 			res->id.idmap_id_u.gid = rid - INT32_MAX - 1;
2410c5c4113dSnw141292 			res->id.idtype = IDMAP_GID;
2411c5c4113dSnw141292 		} else if (rid < LOCALRID_MIN) {
2412e8c27ec8Sbaban 			return (IDMAP_ERR_ARG);
2413c5c4113dSnw141292 		} else {
2414c5c4113dSnw141292 			res->id.idmap_id_u.uid = rid - LOCALRID_MIN;
2415c5c4113dSnw141292 			res->id.idtype = IDMAP_UID;
2416c5c4113dSnw141292 		}
2417c5c4113dSnw141292 		break;
2418c5c4113dSnw141292 	default:
2419c5c4113dSnw141292 		return (IDMAP_ERR_NOTSUPPORTED);
2420c5c4113dSnw141292 	}
242148258c6bSjp151216 	if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
242248258c6bSjp151216 		res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID;
242348258c6bSjp151216 		res->info.src = IDMAP_MAP_SRC_ALGORITHMIC;
242448258c6bSjp151216 	}
2425c5c4113dSnw141292 	return (IDMAP_SUCCESS);
2426c5c4113dSnw141292 }
2427c5c4113dSnw141292 
2428e8c27ec8Sbaban /*
2429e8c27ec8Sbaban  * Name service lookup by unixname to get pid
2430e8c27ec8Sbaban  */
2431cd37da74Snw141292 static
2432cd37da74Snw141292 idmap_retcode
2433e8c27ec8Sbaban ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id)
2434cd37da74Snw141292 {
2435cd37da74Snw141292 	struct passwd	pwd, *pwdp;
2436cd37da74Snw141292 	struct group	grp, *grpp;
2437c5c4113dSnw141292 	char		buf[1024];
2438c5c4113dSnw141292 	int		errnum;
2439c5c4113dSnw141292 	const char	*me = "ns_lookup_byname";
2440c5c4113dSnw141292 
2441e8c27ec8Sbaban 	switch (id->idtype) {
2442e8c27ec8Sbaban 	case IDMAP_UID:
2443cd37da74Snw141292 		pwdp = getpwnam_r(name, &pwd, buf, sizeof (buf));
2444e8c27ec8Sbaban 		if (pwdp == NULL && errno == 0 && lower_name != NULL &&
2445cd37da74Snw141292 		    name != lower_name && strcmp(name, lower_name) != 0)
2446cd37da74Snw141292 			pwdp = getpwnam_r(lower_name, &pwd, buf, sizeof (buf));
2447cd37da74Snw141292 		if (pwdp == NULL) {
2448c5c4113dSnw141292 			errnum = errno;
2449c5c4113dSnw141292 			idmapdlog(LOG_WARNING,
2450c5c4113dSnw141292 			    "%s: getpwnam_r(%s) failed (%s).",
2451cd37da74Snw141292 			    me, name, errnum ? strerror(errnum) : "not found");
2452c5c4113dSnw141292 			if (errnum == 0)
2453c5c4113dSnw141292 				return (IDMAP_ERR_NOTFOUND);
2454c5c4113dSnw141292 			else
2455c5c4113dSnw141292 				return (IDMAP_ERR_INTERNAL);
2456c5c4113dSnw141292 		}
2457e8c27ec8Sbaban 		id->idmap_id_u.uid = pwd.pw_uid;
2458e8c27ec8Sbaban 		break;
2459e8c27ec8Sbaban 	case IDMAP_GID:
2460cd37da74Snw141292 		grpp = getgrnam_r(name, &grp, buf, sizeof (buf));
2461e8c27ec8Sbaban 		if (grpp == NULL && errno == 0 && lower_name != NULL &&
2462cd37da74Snw141292 		    name != lower_name && strcmp(name, lower_name) != 0)
2463cd37da74Snw141292 			grpp = getgrnam_r(lower_name, &grp, buf, sizeof (buf));
2464cd37da74Snw141292 		if (grpp == NULL) {
2465c5c4113dSnw141292 			errnum = errno;
2466c5c4113dSnw141292 			idmapdlog(LOG_WARNING,
2467c5c4113dSnw141292 			    "%s: getgrnam_r(%s) failed (%s).",
2468cd37da74Snw141292 			    me, name, errnum ? strerror(errnum) : "not found");
2469c5c4113dSnw141292 			if (errnum == 0)
2470c5c4113dSnw141292 				return (IDMAP_ERR_NOTFOUND);
2471c5c4113dSnw141292 			else
2472c5c4113dSnw141292 				return (IDMAP_ERR_INTERNAL);
2473c5c4113dSnw141292 		}
2474e8c27ec8Sbaban 		id->idmap_id_u.gid = grp.gr_gid;
2475e8c27ec8Sbaban 		break;
2476e8c27ec8Sbaban 	default:
2477e8c27ec8Sbaban 		return (IDMAP_ERR_ARG);
2478c5c4113dSnw141292 	}
2479c5c4113dSnw141292 	return (IDMAP_SUCCESS);
2480c5c4113dSnw141292 }
2481c5c4113dSnw141292 
2482e8c27ec8Sbaban 
2483e8c27ec8Sbaban /*
2484e8c27ec8Sbaban  * Name service lookup by pid to get unixname
2485e8c27ec8Sbaban  */
2486e8c27ec8Sbaban static
2487e8c27ec8Sbaban idmap_retcode
2488e8c27ec8Sbaban ns_lookup_bypid(uid_t pid, int is_user, char **unixname)
2489e8c27ec8Sbaban {
2490e8c27ec8Sbaban 	struct passwd	pwd;
2491e8c27ec8Sbaban 	struct group	grp;
2492e8c27ec8Sbaban 	char		buf[1024];
2493e8c27ec8Sbaban 	int		errnum;
2494e8c27ec8Sbaban 	const char	*me = "ns_lookup_bypid";
2495e8c27ec8Sbaban 
2496e8c27ec8Sbaban 	if (is_user) {
2497e8c27ec8Sbaban 		errno = 0;
2498e8c27ec8Sbaban 		if (getpwuid_r(pid, &pwd, buf, sizeof (buf)) == NULL) {
2499e8c27ec8Sbaban 			errnum = errno;
2500e8c27ec8Sbaban 			idmapdlog(LOG_WARNING,
2501e8c27ec8Sbaban 			    "%s: getpwuid_r(%u) failed (%s).",
2502e8c27ec8Sbaban 			    me, pid, errnum ? strerror(errnum) : "not found");
2503e8c27ec8Sbaban 			if (errnum == 0)
2504e8c27ec8Sbaban 				return (IDMAP_ERR_NOTFOUND);
2505e8c27ec8Sbaban 			else
2506e8c27ec8Sbaban 				return (IDMAP_ERR_INTERNAL);
2507e8c27ec8Sbaban 		}
2508e8c27ec8Sbaban 		*unixname = strdup(pwd.pw_name);
2509e8c27ec8Sbaban 	} else {
2510e8c27ec8Sbaban 		errno = 0;
2511e8c27ec8Sbaban 		if (getgrgid_r(pid, &grp, buf, sizeof (buf)) == NULL) {
2512e8c27ec8Sbaban 			errnum = errno;
2513e8c27ec8Sbaban 			idmapdlog(LOG_WARNING,
2514e8c27ec8Sbaban 			    "%s: getgrgid_r(%u) failed (%s).",
2515e8c27ec8Sbaban 			    me, pid, errnum ? strerror(errnum) : "not found");
2516e8c27ec8Sbaban 			if (errnum == 0)
2517e8c27ec8Sbaban 				return (IDMAP_ERR_NOTFOUND);
2518e8c27ec8Sbaban 			else
2519e8c27ec8Sbaban 				return (IDMAP_ERR_INTERNAL);
2520e8c27ec8Sbaban 		}
2521e8c27ec8Sbaban 		*unixname = strdup(grp.gr_name);
2522e8c27ec8Sbaban 	}
2523e8c27ec8Sbaban 	if (*unixname == NULL)
2524e8c27ec8Sbaban 		return (IDMAP_ERR_MEMORY);
2525e8c27ec8Sbaban 	return (IDMAP_SUCCESS);
2526e8c27ec8Sbaban }
2527e8c27ec8Sbaban 
2528c5c4113dSnw141292 /*
2529c5c4113dSnw141292  * Name-based mapping
2530c5c4113dSnw141292  *
2531c5c4113dSnw141292  * Case 1: If no rule matches do ephemeral
2532c5c4113dSnw141292  *
2533c5c4113dSnw141292  * Case 2: If rule matches and unixname is "" then return no mapping.
2534c5c4113dSnw141292  *
2535c5c4113dSnw141292  * Case 3: If rule matches and unixname is specified then lookup name
2536c5c4113dSnw141292  *  service using the unixname. If unixname not found then return no mapping.
2537c5c4113dSnw141292  *
2538c5c4113dSnw141292  * Case 4: If rule matches and unixname is * then lookup name service
2539c5c4113dSnw141292  *  using winname as the unixname. If unixname not found then process
2540c5c4113dSnw141292  *  other rules using the lookup order. If no other rule matches then do
2541c5c4113dSnw141292  *  ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4.
2542c5c4113dSnw141292  *  This allows us to specify a fallback unixname per _domain_ or no mapping
2543c5c4113dSnw141292  *  instead of the default behaviour of doing ephemeral mapping.
2544c5c4113dSnw141292  *
2545c5c4113dSnw141292  * Example 1:
2546c5c4113dSnw141292  * *@sfbay == *
2547c5c4113dSnw141292  * If looking up windows users foo@sfbay and foo does not exists in
2548c5c4113dSnw141292  * the name service then foo@sfbay will be mapped to an ephemeral id.
2549c5c4113dSnw141292  *
2550c5c4113dSnw141292  * Example 2:
2551c5c4113dSnw141292  * *@sfbay == *
2552c5c4113dSnw141292  * *@sfbay => guest
2553c5c4113dSnw141292  * If looking up windows users foo@sfbay and foo does not exists in
2554c5c4113dSnw141292  * the name service then foo@sfbay will be mapped to guest.
2555c5c4113dSnw141292  *
2556c5c4113dSnw141292  * Example 3:
2557c5c4113dSnw141292  * *@sfbay == *
2558c5c4113dSnw141292  * *@sfbay => ""
2559c5c4113dSnw141292  * If looking up windows users foo@sfbay and foo does not exists in
2560c5c4113dSnw141292  * the name service then we will return no mapping for foo@sfbay.
2561c5c4113dSnw141292  *
2562c5c4113dSnw141292  */
2563cd37da74Snw141292 static
2564cd37da74Snw141292 idmap_retcode
2565479ac375Sdm199847 name_based_mapping_sid2pid(lookup_state_t *state,
2566479ac375Sdm199847 		idmap_mapping *req, idmap_id_res *res)
2567cd37da74Snw141292 {
2568cd37da74Snw141292 	const char	*unixname, *windomain;
2569cd37da74Snw141292 	char		*sql = NULL, *errmsg = NULL, *lower_winname = NULL;
2570c5c4113dSnw141292 	idmap_retcode	retcode;
2571cd37da74Snw141292 	char		*end, *lower_unixname, *winname;
2572c5c4113dSnw141292 	const char	**values;
2573c5c4113dSnw141292 	sqlite_vm	*vm = NULL;
2574cd37da74Snw141292 	int		ncol, r, i, is_user, is_wuser;
257548258c6bSjp151216 	idmap_namerule	*rule = &res->info.how.idmap_how_u.rule;
257648258c6bSjp151216 	int		direction;
2577c5c4113dSnw141292 	const char	*me = "name_based_mapping_sid2pid";
2578c5c4113dSnw141292 
2579e8c27ec8Sbaban 	assert(req->id1name != NULL); /* We have winname */
2580e8c27ec8Sbaban 	assert(req->id2name == NULL); /* We don't have unixname */
2581e8c27ec8Sbaban 
25828e228215Sdm199847 	winname = req->id1name;
25838e228215Sdm199847 	windomain = req->id1domain;
2584cd37da74Snw141292 
2585cd37da74Snw141292 	switch (req->id1.idtype) {
2586cd37da74Snw141292 	case IDMAP_USID:
2587cd37da74Snw141292 		is_wuser = 1;
2588cd37da74Snw141292 		break;
2589cd37da74Snw141292 	case IDMAP_GSID:
2590cd37da74Snw141292 		is_wuser = 0;
2591cd37da74Snw141292 		break;
2592cd37da74Snw141292 	default:
2593e8c27ec8Sbaban 		idmapdlog(LOG_ERR, "%s: Unable to determine if the "
2594e8c27ec8Sbaban 		    "given Windows id is user or group.", me);
2595cd37da74Snw141292 		return (IDMAP_ERR_INTERNAL);
2596cd37da74Snw141292 	}
2597cd37da74Snw141292 
2598e8c27ec8Sbaban 	switch (res->id.idtype) {
2599cd37da74Snw141292 	case IDMAP_UID:
2600cd37da74Snw141292 		is_user = 1;
2601cd37da74Snw141292 		break;
2602cd37da74Snw141292 	case IDMAP_GID:
2603cd37da74Snw141292 		is_user = 0;
2604cd37da74Snw141292 		break;
2605cd37da74Snw141292 	case IDMAP_POSIXID:
2606cd37da74Snw141292 		is_user = is_wuser;
2607cd37da74Snw141292 		res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID;
2608cd37da74Snw141292 		break;
2609cd37da74Snw141292 	}
2610c5c4113dSnw141292 
2611c5c4113dSnw141292 	i = 0;
2612479ac375Sdm199847 	if (windomain == NULL)
261362c60062Sbaban 		windomain = "";
261482da9f60Sbaban 	else if (state->defdom != NULL &&
261582da9f60Sbaban 	    strcasecmp(state->defdom, windomain) == 0)
2616c5c4113dSnw141292 		i = 1;
2617c5c4113dSnw141292 
2618cd37da74Snw141292 	if ((lower_winname = tolower_u8(winname)) == NULL)
2619cd37da74Snw141292 		lower_winname = winname;    /* hope for the best */
2620c5c4113dSnw141292 	sql = sqlite_mprintf(
262148258c6bSjp151216 	    "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 "
262248258c6bSjp151216 	    "FROM namerules WHERE "
2623cd37da74Snw141292 	    "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND "
2624c5c4113dSnw141292 	    "(winname = %Q OR winname = '*') AND "
2625c5c4113dSnw141292 	    "(windomain = %Q OR windomain = '*' %s) "
2626c5c4113dSnw141292 	    "ORDER BY w2u_order ASC;",
2627cd37da74Snw141292 	    is_user, is_wuser, lower_winname, windomain,
262862c60062Sbaban 	    i ? "OR windomain ISNULL OR windomain = ''" : "");
2629c5c4113dSnw141292 	if (sql == NULL) {
2630c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
2631c5c4113dSnw141292 		retcode = IDMAP_ERR_MEMORY;
2632c5c4113dSnw141292 		goto out;
2633c5c4113dSnw141292 	}
2634c5c4113dSnw141292 
2635479ac375Sdm199847 	if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
2636c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
2637cd37da74Snw141292 		idmapdlog(LOG_ERR, "%s: database error (%s)", me,
2638cd37da74Snw141292 		    CHECK_NULL(errmsg));
2639c5c4113dSnw141292 		sqlite_freemem(errmsg);
2640c5c4113dSnw141292 		goto out;
2641c5c4113dSnw141292 	}
2642c5c4113dSnw141292 
264384decf41Sjp151216 	for (;;) {
2644c5c4113dSnw141292 		r = sqlite_step(vm, &ncol, &values, NULL);
264584decf41Sjp151216 		assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
2646c5c4113dSnw141292 
264784decf41Sjp151216 		if (r == SQLITE_ROW) {
264848258c6bSjp151216 			if (ncol < 5) {
2649c5c4113dSnw141292 				retcode = IDMAP_ERR_INTERNAL;
2650c5c4113dSnw141292 				goto out;
2651c5c4113dSnw141292 			}
2652c5c4113dSnw141292 			if (values[0] == NULL) {
2653c5c4113dSnw141292 				retcode = IDMAP_ERR_INTERNAL;
2654c5c4113dSnw141292 				goto out;
2655c5c4113dSnw141292 			}
2656c5c4113dSnw141292 
265748258c6bSjp151216 			if (values[1] != NULL)
265848258c6bSjp151216 				direction =
265948258c6bSjp151216 				    (strtol(values[1], &end, 10) == 0)?
266048258c6bSjp151216 				    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
266148258c6bSjp151216 			else
266248258c6bSjp151216 				direction = IDMAP_DIRECTION_W2U;
266348258c6bSjp151216 
2664c5c4113dSnw141292 			if (EMPTY_NAME(values[0])) {
266548258c6bSjp151216 				idmap_namerule_set(rule, values[3], values[2],
266648258c6bSjp151216 				    values[0], is_wuser, is_user,
266748258c6bSjp151216 				    strtol(values[4], &end, 10),
266848258c6bSjp151216 				    direction);
2669c5c4113dSnw141292 				retcode = IDMAP_ERR_NOMAPPING;
2670c5c4113dSnw141292 				goto out;
2671c5c4113dSnw141292 			}
267248258c6bSjp151216 
267348258c6bSjp151216 			if (values[0][0] == '*') {
267448258c6bSjp151216 				unixname = winname;
267548258c6bSjp151216 				lower_unixname = lower_winname;
267648258c6bSjp151216 			} else {
267748258c6bSjp151216 				unixname = values[0];
267848258c6bSjp151216 				lower_unixname = NULL;
267948258c6bSjp151216 			}
268048258c6bSjp151216 
2681e8c27ec8Sbaban 			retcode = ns_lookup_byname(unixname, lower_unixname,
2682e8c27ec8Sbaban 			    &res->id);
2683c5c4113dSnw141292 			if (retcode == IDMAP_ERR_NOTFOUND) {
268448258c6bSjp151216 				if (values[0][0] == '*')
2685c5c4113dSnw141292 					/* Case 4 */
2686c5c4113dSnw141292 					continue;
268748258c6bSjp151216 				else {
2688c5c4113dSnw141292 					/* Case 3 */
268948258c6bSjp151216 					idmap_namerule_set(rule, values[3],
269048258c6bSjp151216 					    values[2], values[0], is_wuser,
269148258c6bSjp151216 					    is_user,
269248258c6bSjp151216 					    strtol(values[4], &end, 10),
269348258c6bSjp151216 					    direction);
2694c5c4113dSnw141292 					retcode = IDMAP_ERR_NOMAPPING;
2695c5c4113dSnw141292 				}
269648258c6bSjp151216 			}
2697c5c4113dSnw141292 			goto out;
2698c5c4113dSnw141292 		} else if (r == SQLITE_DONE) {
2699c5c4113dSnw141292 			retcode = IDMAP_ERR_NOTFOUND;
2700c5c4113dSnw141292 			goto out;
2701c5c4113dSnw141292 		} else {
2702c5c4113dSnw141292 			(void) sqlite_finalize(vm, &errmsg);
2703c5c4113dSnw141292 			vm = NULL;
2704cd37da74Snw141292 			idmapdlog(LOG_ERR, "%s: database error (%s)", me,
2705cd37da74Snw141292 			    CHECK_NULL(errmsg));
2706c5c4113dSnw141292 			sqlite_freemem(errmsg);
2707c5c4113dSnw141292 			retcode = IDMAP_ERR_INTERNAL;
2708c5c4113dSnw141292 			goto out;
2709c5c4113dSnw141292 		}
2710c5c4113dSnw141292 	}
2711c5c4113dSnw141292 
2712c5c4113dSnw141292 out:
271348258c6bSjp151216 	if (sql != NULL)
2714c5c4113dSnw141292 		sqlite_freemem(sql);
271548258c6bSjp151216 	res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED;
2716c5c4113dSnw141292 	if (retcode == IDMAP_SUCCESS) {
271762c60062Sbaban 		if (values[1] != NULL)
2718c5c4113dSnw141292 			res->direction =
2719651c0131Sbaban 			    (strtol(values[1], &end, 10) == 0)?
2720651c0131Sbaban 			    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
2721c5c4113dSnw141292 		else
2722651c0131Sbaban 			res->direction = IDMAP_DIRECTION_W2U;
272348258c6bSjp151216 
27248e228215Sdm199847 		req->id2name = strdup(unixname);
2725479ac375Sdm199847 		if (req->id2name == NULL) {
2726479ac375Sdm199847 			retcode = IDMAP_ERR_MEMORY;
2727479ac375Sdm199847 		}
2728479ac375Sdm199847 	}
2729479ac375Sdm199847 
2730479ac375Sdm199847 	if (retcode == IDMAP_SUCCESS) {
273148258c6bSjp151216 		idmap_namerule_set(rule, values[3], values[2],
273248258c6bSjp151216 		    values[0], is_wuser, is_user, strtol(values[4], &end, 10),
273348258c6bSjp151216 		    res->direction);
273448258c6bSjp151216 		res->info.src = IDMAP_MAP_SRC_NEW;
2735c5c4113dSnw141292 	}
2736479ac375Sdm199847 
2737cd37da74Snw141292 	if (lower_winname != NULL && lower_winname != winname)
2738cd37da74Snw141292 		free(lower_winname);
273962c60062Sbaban 	if (vm != NULL)
2740c5c4113dSnw141292 		(void) sqlite_finalize(vm, NULL);
2741c5c4113dSnw141292 	return (retcode);
2742c5c4113dSnw141292 }
2743c5c4113dSnw141292 
2744c5c4113dSnw141292 static
2745c5c4113dSnw141292 int
2746c5c4113dSnw141292 get_next_eph_uid(uid_t *next_uid)
2747c5c4113dSnw141292 {
2748c5c4113dSnw141292 	uid_t uid;
2749c5c4113dSnw141292 	gid_t gid;
2750c5c4113dSnw141292 	int err;
2751c5c4113dSnw141292 
2752c5c4113dSnw141292 	*next_uid = (uid_t)-1;
2753c5c4113dSnw141292 	uid = _idmapdstate.next_uid++;
2754c5c4113dSnw141292 	if (uid >= _idmapdstate.limit_uid) {
2755c5c4113dSnw141292 		if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0)
2756c5c4113dSnw141292 			return (err);
2757c5c4113dSnw141292 
2758c5c4113dSnw141292 		_idmapdstate.limit_uid = uid + 8192;
2759c5c4113dSnw141292 		_idmapdstate.next_uid = uid;
2760c5c4113dSnw141292 	}
2761c5c4113dSnw141292 	*next_uid = uid;
2762c5c4113dSnw141292 
2763c5c4113dSnw141292 	return (0);
2764c5c4113dSnw141292 }
2765c5c4113dSnw141292 
2766c5c4113dSnw141292 static
2767c5c4113dSnw141292 int
2768c5c4113dSnw141292 get_next_eph_gid(gid_t *next_gid)
2769c5c4113dSnw141292 {
2770c5c4113dSnw141292 	uid_t uid;
2771c5c4113dSnw141292 	gid_t gid;
2772c5c4113dSnw141292 	int err;
2773c5c4113dSnw141292 
2774c5c4113dSnw141292 	*next_gid = (uid_t)-1;
2775c5c4113dSnw141292 	gid = _idmapdstate.next_gid++;
2776c5c4113dSnw141292 	if (gid >= _idmapdstate.limit_gid) {
2777c5c4113dSnw141292 		if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0)
2778c5c4113dSnw141292 			return (err);
2779c5c4113dSnw141292 
2780c5c4113dSnw141292 		_idmapdstate.limit_gid = gid + 8192;
2781c5c4113dSnw141292 		_idmapdstate.next_gid = gid;
2782c5c4113dSnw141292 	}
2783c5c4113dSnw141292 	*next_gid = gid;
2784c5c4113dSnw141292 
2785c5c4113dSnw141292 	return (0);
2786c5c4113dSnw141292 }
2787c5c4113dSnw141292 
278862c60062Sbaban static
278962c60062Sbaban int
2790cd37da74Snw141292 gethash(const char *str, uint32_t num, uint_t htsize)
2791cd37da74Snw141292 {
279262c60062Sbaban 	uint_t  hval, i, len;
279362c60062Sbaban 
279462c60062Sbaban 	if (str == NULL)
279562c60062Sbaban 		return (0);
279662c60062Sbaban 	for (len = strlen(str), hval = 0, i = 0; i < len; i++) {
279762c60062Sbaban 		hval += str[i];
279862c60062Sbaban 		hval += (hval << 10);
279962c60062Sbaban 		hval ^= (hval >> 6);
280062c60062Sbaban 	}
280162c60062Sbaban 	for (str = (const char *)&num, i = 0; i < sizeof (num); i++) {
280262c60062Sbaban 		hval += str[i];
280362c60062Sbaban 		hval += (hval << 10);
280462c60062Sbaban 		hval ^= (hval >> 6);
280562c60062Sbaban 	}
280662c60062Sbaban 	hval += (hval << 3);
280762c60062Sbaban 	hval ^= (hval >> 11);
280862c60062Sbaban 	hval += (hval << 15);
280962c60062Sbaban 	return (hval % htsize);
281062c60062Sbaban }
281162c60062Sbaban 
281262c60062Sbaban static
281362c60062Sbaban int
281462c60062Sbaban get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid,
2815cd37da74Snw141292 		uid_t *pid)
2816cd37da74Snw141292 {
281762c60062Sbaban 	uint_t		next, key;
281862c60062Sbaban 	uint_t		htsize = state->sid_history_size;
281962c60062Sbaban 	idmap_sid	*sid;
282062c60062Sbaban 
282162c60062Sbaban 	next = gethash(prefix, rid, htsize);
282262c60062Sbaban 	while (next != htsize) {
282362c60062Sbaban 		key = state->sid_history[next].key;
282462c60062Sbaban 		if (key == htsize)
282562c60062Sbaban 			return (0);
282662c60062Sbaban 		sid = &state->batch->idmap_mapping_batch_val[key].id1.
282762c60062Sbaban 		    idmap_id_u.sid;
282862c60062Sbaban 		if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) {
282962c60062Sbaban 			*pid = state->result->ids.ids_val[key].id.
283062c60062Sbaban 			    idmap_id_u.uid;
283162c60062Sbaban 			return (1);
283262c60062Sbaban 		}
283362c60062Sbaban 		next = state->sid_history[next].next;
283462c60062Sbaban 	}
283562c60062Sbaban 	return (0);
283662c60062Sbaban }
283762c60062Sbaban 
283862c60062Sbaban static
283962c60062Sbaban void
2840cd37da74Snw141292 add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid)
2841cd37da74Snw141292 {
284262c60062Sbaban 	uint_t		hash, next;
284362c60062Sbaban 	uint_t		htsize = state->sid_history_size;
284462c60062Sbaban 
284562c60062Sbaban 	hash = next = gethash(prefix, rid, htsize);
284662c60062Sbaban 	while (state->sid_history[next].key != htsize) {
284762c60062Sbaban 		next++;
284862c60062Sbaban 		next %= htsize;
284962c60062Sbaban 	}
285062c60062Sbaban 	state->sid_history[next].key = state->curpos;
285162c60062Sbaban 	if (hash == next)
285262c60062Sbaban 		return;
285362c60062Sbaban 	state->sid_history[next].next = state->sid_history[hash].next;
285462c60062Sbaban 	state->sid_history[hash].next = next;
285562c60062Sbaban }
2856c5c4113dSnw141292 
2857e8c27ec8Sbaban void
2858e8c27ec8Sbaban cleanup_lookup_state(lookup_state_t *state)
2859e8c27ec8Sbaban {
2860e8c27ec8Sbaban 	free(state->sid_history);
2861e8c27ec8Sbaban 	free(state->ad_unixuser_attr);
2862e8c27ec8Sbaban 	free(state->ad_unixgroup_attr);
2863479ac375Sdm199847 	free(state->nldap_winname_attr);
2864479ac375Sdm199847 	free(state->defdom);
2865e8c27ec8Sbaban }
2866e8c27ec8Sbaban 
2867c5c4113dSnw141292 /* ARGSUSED */
2868c5c4113dSnw141292 static
2869c5c4113dSnw141292 idmap_retcode
2870479ac375Sdm199847 dynamic_ephemeral_mapping(lookup_state_t *state,
2871cd37da74Snw141292 		idmap_mapping *req, idmap_id_res *res)
2872cd37da74Snw141292 {
2873c5c4113dSnw141292 
2874c5c4113dSnw141292 	uid_t		next_pid;
2875c5c4113dSnw141292 
2876651c0131Sbaban 	res->direction = IDMAP_DIRECTION_BI;
287762c60062Sbaban 
287848258c6bSjp151216 	if (IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
287948258c6bSjp151216 		res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
288048258c6bSjp151216 		res->info.src = IDMAP_MAP_SRC_CACHE;
288162c60062Sbaban 		return (IDMAP_SUCCESS);
288248258c6bSjp151216 	}
288362c60062Sbaban 
288462c60062Sbaban 	if (state->sid_history != NULL &&
288562c60062Sbaban 	    get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix,
288662c60062Sbaban 	    req->id1.idmap_id_u.sid.rid, &next_pid)) {
288762c60062Sbaban 		res->id.idmap_id_u.uid = next_pid;
288848258c6bSjp151216 		res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
288948258c6bSjp151216 		res->info.src = IDMAP_MAP_SRC_NEW;
289062c60062Sbaban 		return (IDMAP_SUCCESS);
289162c60062Sbaban 	}
289262c60062Sbaban 
289362c60062Sbaban 	if (res->id.idtype == IDMAP_UID) {
2894c5c4113dSnw141292 		if (get_next_eph_uid(&next_pid) != 0)
2895c5c4113dSnw141292 			return (IDMAP_ERR_INTERNAL);
2896c5c4113dSnw141292 		res->id.idmap_id_u.uid = next_pid;
2897c5c4113dSnw141292 	} else {
2898c5c4113dSnw141292 		if (get_next_eph_gid(&next_pid) != 0)
2899c5c4113dSnw141292 			return (IDMAP_ERR_INTERNAL);
2900c5c4113dSnw141292 		res->id.idmap_id_u.gid = next_pid;
2901c5c4113dSnw141292 	}
2902c5c4113dSnw141292 
290348258c6bSjp151216 	res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL;
290448258c6bSjp151216 	res->info.src = IDMAP_MAP_SRC_NEW;
290562c60062Sbaban 	if (state->sid_history != NULL)
290662c60062Sbaban 		add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix,
290762c60062Sbaban 		    req->id1.idmap_id_u.sid.rid);
290862c60062Sbaban 
2909c5c4113dSnw141292 	return (IDMAP_SUCCESS);
2910c5c4113dSnw141292 }
2911c5c4113dSnw141292 
2912c5c4113dSnw141292 idmap_retcode
2913479ac375Sdm199847 sid2pid_second_pass(lookup_state_t *state,
2914cd37da74Snw141292 		idmap_mapping *req, idmap_id_res *res)
2915cd37da74Snw141292 {
2916c5c4113dSnw141292 	idmap_retcode	retcode;
2917c5c4113dSnw141292 
2918c5c4113dSnw141292 	/* Check if second pass is needed */
2919e8c27ec8Sbaban 	if (ARE_WE_DONE(req->direction))
2920c5c4113dSnw141292 		return (res->retcode);
2921c5c4113dSnw141292 
2922c5c4113dSnw141292 	/* Get status from previous pass */
2923e8c27ec8Sbaban 	retcode = res->retcode;
29244aa0a5e7Snw141292 	if (retcode != IDMAP_SUCCESS && state->eph_map_unres_sids &&
29254aa0a5e7Snw141292 	    !EMPTY_STRING(req->id1.idmap_id_u.sid.prefix) &&
29264aa0a5e7Snw141292 	    EMPTY_STRING(req->id1name)) {
29274aa0a5e7Snw141292 		/*
29284aa0a5e7Snw141292 		 * We are asked to map an unresolvable SID to a UID or
29294aa0a5e7Snw141292 		 * GID, but, which?  We'll treat all unresolvable SIDs
29304aa0a5e7Snw141292 		 * as users unless the caller specified which of a UID
29314aa0a5e7Snw141292 		 * or GID they want.
29324aa0a5e7Snw141292 		 */
2933a7c8bd9fSNicolas Williams 		if (req->id1.idtype == IDMAP_SID)
2934a7c8bd9fSNicolas Williams 			req->id1.idtype = IDMAP_USID;
29354aa0a5e7Snw141292 		if (res->id.idtype == IDMAP_POSIXID)
29364aa0a5e7Snw141292 			res->id.idtype = IDMAP_UID;
29374aa0a5e7Snw141292 		goto do_eph;
29384aa0a5e7Snw141292 	}
2939e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS)
2940e8c27ec8Sbaban 		goto out;
2941c5c4113dSnw141292 
2942e8c27ec8Sbaban 	/*
2943e8c27ec8Sbaban 	 * If directory-based name mapping is enabled then the unixname
2944e8c27ec8Sbaban 	 * may already have been retrieved from the AD object (AD-mode or
2945e8c27ec8Sbaban 	 * mixed-mode) or from native LDAP object (nldap-mode) -- done.
2946e8c27ec8Sbaban 	 */
2947e8c27ec8Sbaban 	if (req->id2name != NULL) {
2948e8c27ec8Sbaban 		assert(res->id.idtype != IDMAP_POSIXID);
2949e8c27ec8Sbaban 		if (AD_MODE(res->id.idtype, state))
2950e8c27ec8Sbaban 			res->direction = IDMAP_DIRECTION_BI;
2951e8c27ec8Sbaban 		else if (NLDAP_MODE(res->id.idtype, state))
2952e8c27ec8Sbaban 			res->direction = IDMAP_DIRECTION_BI;
2953e8c27ec8Sbaban 		else if (MIXED_MODE(res->id.idtype, state))
2954e8c27ec8Sbaban 			res->direction = IDMAP_DIRECTION_W2U;
2955c5c4113dSnw141292 
2956e8c27ec8Sbaban 		/*
2957e8c27ec8Sbaban 		 * Special case: (1) If the ad_unixuser_attr and
2958e8c27ec8Sbaban 		 * ad_unixgroup_attr uses the same attribute
2959e8c27ec8Sbaban 		 * name and (2) if this is a diagonal mapping
2960e8c27ec8Sbaban 		 * request and (3) the unixname has been retrieved
2961e8c27ec8Sbaban 		 * from the AD object -- then we ignore it and fallback
2962e8c27ec8Sbaban 		 * to name-based mapping rules and ephemeral mapping
2963e8c27ec8Sbaban 		 *
2964e8c27ec8Sbaban 		 * Example:
2965e8c27ec8Sbaban 		 *  Properties:
2966e8c27ec8Sbaban 		 *    config/ad_unixuser_attr = "unixname"
2967e8c27ec8Sbaban 		 *    config/ad_unixgroup_attr = "unixname"
2968e8c27ec8Sbaban 		 *  AD user object:
2969e8c27ec8Sbaban 		 *    dn: cn=bob ...
2970e8c27ec8Sbaban 		 *    objectclass: user
2971e8c27ec8Sbaban 		 *    sam: bob
2972e8c27ec8Sbaban 		 *    unixname: bob1234
2973e8c27ec8Sbaban 		 *  AD group object:
2974e8c27ec8Sbaban 		 *    dn: cn=winadmins ...
2975e8c27ec8Sbaban 		 *    objectclass: group
2976e8c27ec8Sbaban 		 *    sam: winadmins
2977e8c27ec8Sbaban 		 *    unixname: unixadmins
2978e8c27ec8Sbaban 		 *
2979e8c27ec8Sbaban 		 *  In this example whether "unixname" refers to a unixuser
2980e8c27ec8Sbaban 		 *  or unixgroup depends upon the AD object.
2981e8c27ec8Sbaban 		 *
2982e8c27ec8Sbaban 		 * $idmap show -c winname:bob gid
2983e8c27ec8Sbaban 		 *    AD lookup by "samAccountName=bob" for
2984e8c27ec8Sbaban 		 *    "ad_unixgroup_attr (i.e unixname)" for directory-based
2985e8c27ec8Sbaban 		 *    mapping would get "bob1234" which is not what we want.
2986e8c27ec8Sbaban 		 *    Now why not getgrnam_r("bob1234") and use it if it
2987e8c27ec8Sbaban 		 *    is indeed a unixgroup? That's because Unix can have
2988e8c27ec8Sbaban 		 *    users and groups with the same name and we clearly
2989e8c27ec8Sbaban 		 *    don't know the intention of the admin here.
2990e8c27ec8Sbaban 		 *    Therefore we ignore this and fallback to name-based
2991e8c27ec8Sbaban 		 *    mapping rules or ephemeral mapping.
2992e8c27ec8Sbaban 		 */
2993e8c27ec8Sbaban 		if ((AD_MODE(res->id.idtype, state) ||
2994e8c27ec8Sbaban 		    MIXED_MODE(res->id.idtype, state)) &&
2995e8c27ec8Sbaban 		    state->ad_unixuser_attr != NULL &&
2996e8c27ec8Sbaban 		    state->ad_unixgroup_attr != NULL &&
2997e8c27ec8Sbaban 		    strcasecmp(state->ad_unixuser_attr,
2998e8c27ec8Sbaban 		    state->ad_unixgroup_attr) == 0 &&
2999e8c27ec8Sbaban 		    ((req->id1.idtype == IDMAP_USID &&
3000e8c27ec8Sbaban 		    res->id.idtype == IDMAP_GID) ||
3001e8c27ec8Sbaban 		    (req->id1.idtype == IDMAP_GSID &&
3002e8c27ec8Sbaban 		    res->id.idtype == IDMAP_UID))) {
3003e8c27ec8Sbaban 			free(req->id2name);
3004e8c27ec8Sbaban 			req->id2name = NULL;
3005e8c27ec8Sbaban 			res->id.idmap_id_u.uid = SENTINEL_PID;
3006e8c27ec8Sbaban 			/* fallback */
3007e8c27ec8Sbaban 		} else {
3008e8c27ec8Sbaban 			if (res->id.idmap_id_u.uid == SENTINEL_PID)
3009e8c27ec8Sbaban 				retcode = ns_lookup_byname(req->id2name,
3010e8c27ec8Sbaban 				    NULL, &res->id);
3011e8c27ec8Sbaban 			/*
3012479ac375Sdm199847 			 * If ns_lookup_byname() fails that means the
3013479ac375Sdm199847 			 * unixname (req->id2name), which was obtained
3014479ac375Sdm199847 			 * from the AD object by directory-based mapping,
3015479ac375Sdm199847 			 * is not a valid Unix user/group and therefore
3016479ac375Sdm199847 			 * we return the error to the client instead of
3017479ac375Sdm199847 			 * doing rule-based mapping or ephemeral mapping.
3018479ac375Sdm199847 			 * This way the client can detect the issue.
3019e8c27ec8Sbaban 			 */
3020c5c4113dSnw141292 			goto out;
3021c5c4113dSnw141292 		}
3022e8c27ec8Sbaban 	}
3023c5c4113dSnw141292 
302448258c6bSjp151216 	/* Free any mapping info from Directory based mapping */
302548258c6bSjp151216 	if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN)
302648258c6bSjp151216 		idmap_info_free(&res->info);
302748258c6bSjp151216 
3028e8c27ec8Sbaban 	/*
3029e8c27ec8Sbaban 	 * If we don't have unixname then evaluate local name-based
3030e8c27ec8Sbaban 	 * mapping rules.
3031e8c27ec8Sbaban 	 */
3032479ac375Sdm199847 	retcode = name_based_mapping_sid2pid(state, req, res);
3033e8c27ec8Sbaban 	if (retcode != IDMAP_ERR_NOTFOUND)
3034e8c27ec8Sbaban 		goto out;
3035e8c27ec8Sbaban 
30364aa0a5e7Snw141292 do_eph:
3037c5c4113dSnw141292 	/* If not found, do ephemeral mapping */
3038479ac375Sdm199847 	retcode = dynamic_ephemeral_mapping(state, req, res);
3039c5c4113dSnw141292 
3040c5c4113dSnw141292 out:
3041c5c4113dSnw141292 	res->retcode = idmap_stat4prot(retcode);
3042e8c27ec8Sbaban 	if (res->retcode != IDMAP_SUCCESS) {
3043e8c27ec8Sbaban 		req->direction = _IDMAP_F_DONE;
3044e8c27ec8Sbaban 		res->id.idmap_id_u.uid = UID_NOBODY;
3045e8c27ec8Sbaban 	}
3046e8c27ec8Sbaban 	if (!ARE_WE_DONE(req->direction))
3047e8c27ec8Sbaban 		state->sid2pid_done = FALSE;
3048c5c4113dSnw141292 	return (retcode);
3049c5c4113dSnw141292 }
3050c5c4113dSnw141292 
3051c5c4113dSnw141292 idmap_retcode
3052479ac375Sdm199847 update_cache_pid2sid(lookup_state_t *state,
3053cd37da74Snw141292 		idmap_mapping *req, idmap_id_res *res)
3054cd37da74Snw141292 {
3055c5c4113dSnw141292 	char		*sql = NULL;
3056c5c4113dSnw141292 	idmap_retcode	retcode;
305748258c6bSjp151216 	char		*map_dn = NULL;
305848258c6bSjp151216 	char		*map_attr = NULL;
305948258c6bSjp151216 	char		*map_value = NULL;
306048258c6bSjp151216 	char 		*map_windomain = NULL;
306148258c6bSjp151216 	char		*map_winname = NULL;
306248258c6bSjp151216 	char		*map_unixname = NULL;
306348258c6bSjp151216 	int		map_is_nt4 = FALSE;
3064c5c4113dSnw141292 
3065c5c4113dSnw141292 	/* Check if we need to cache anything */
3066e8c27ec8Sbaban 	if (ARE_WE_DONE(req->direction))
3067c5c4113dSnw141292 		return (IDMAP_SUCCESS);
3068c5c4113dSnw141292 
3069c5c4113dSnw141292 	/* We don't cache negative entries */
3070c5c4113dSnw141292 	if (res->retcode != IDMAP_SUCCESS)
3071c5c4113dSnw141292 		return (IDMAP_SUCCESS);
3072c5c4113dSnw141292 
3073e8c27ec8Sbaban 	assert(res->direction != IDMAP_DIRECTION_UNDEF);
307448258c6bSjp151216 	assert(req->id1.idmap_id_u.uid != SENTINEL_PID);
307548258c6bSjp151216 	assert(res->id.idtype != IDMAP_SID);
307648258c6bSjp151216 
307748258c6bSjp151216 	assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN);
307848258c6bSjp151216 	switch (res->info.how.map_type) {
307948258c6bSjp151216 	case IDMAP_MAP_TYPE_DS_AD:
308048258c6bSjp151216 		map_dn = res->info.how.idmap_how_u.ad.dn;
308148258c6bSjp151216 		map_attr = res->info.how.idmap_how_u.ad.attr;
308248258c6bSjp151216 		map_value = res->info.how.idmap_how_u.ad.value;
308348258c6bSjp151216 		break;
308448258c6bSjp151216 
308548258c6bSjp151216 	case IDMAP_MAP_TYPE_DS_NLDAP:
308648258c6bSjp151216 		map_dn = res->info.how.idmap_how_u.nldap.dn;
308748258c6bSjp151216 		map_attr = res->info.how.idmap_how_u.nldap.attr;
308848258c6bSjp151216 		map_value = res->info.how.idmap_how_u.nldap.value;
308948258c6bSjp151216 		break;
309048258c6bSjp151216 
309148258c6bSjp151216 	case IDMAP_MAP_TYPE_RULE_BASED:
309248258c6bSjp151216 		map_windomain = res->info.how.idmap_how_u.rule.windomain;
309348258c6bSjp151216 		map_winname = res->info.how.idmap_how_u.rule.winname;
309448258c6bSjp151216 		map_unixname = res->info.how.idmap_how_u.rule.unixname;
309548258c6bSjp151216 		map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4;
309648258c6bSjp151216 		break;
309748258c6bSjp151216 
309848258c6bSjp151216 	case IDMAP_MAP_TYPE_EPHEMERAL:
309948258c6bSjp151216 		break;
310048258c6bSjp151216 
310148258c6bSjp151216 	case IDMAP_MAP_TYPE_LOCAL_SID:
310248258c6bSjp151216 		break;
310348258c6bSjp151216 
310448258c6bSjp151216 	default:
310548258c6bSjp151216 		/* Dont cache other mapping types */
310648258c6bSjp151216 		assert(FALSE);
310748258c6bSjp151216 	}
3108e8c27ec8Sbaban 
3109c5c4113dSnw141292 	/*
3110c5c4113dSnw141292 	 * Using NULL for u2w instead of 0 so that our trigger allows
3111c5c4113dSnw141292 	 * the same pid to be the destination in multiple entries
3112c5c4113dSnw141292 	 */
3113c5c4113dSnw141292 	sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
3114cd37da74Snw141292 	    "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
311548258c6bSjp151216 	    "is_user, is_wuser, expiration, w2u, u2w, "
311648258c6bSjp151216 	    "map_type, map_dn, map_attr, map_value, map_windomain, "
311748258c6bSjp151216 	    "map_winname, map_unixname, map_is_nt4) "
3118cd37da74Snw141292 	    "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
311948258c6bSjp151216 	    "strftime('%%s','now') + 600, %q, 1, "
312048258c6bSjp151216 	    "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ",
3121cd37da74Snw141292 	    res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
3122cd37da74Snw141292 	    req->id2domain, req->id2name, req->id1.idmap_id_u.uid,
3123cd37da74Snw141292 	    req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0,
3124e8c27ec8Sbaban 	    (res->id.idtype == IDMAP_USID) ? 1 : 0,
312548258c6bSjp151216 	    (res->direction == 0) ? "1" : NULL,
312648258c6bSjp151216 	    res->info.how.map_type, map_dn, map_attr, map_value,
312748258c6bSjp151216 	    map_windomain, map_winname, map_unixname, map_is_nt4);
3128c5c4113dSnw141292 
3129c5c4113dSnw141292 	if (sql == NULL) {
3130c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
3131c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
3132c5c4113dSnw141292 		goto out;
3133c5c4113dSnw141292 	}
3134c5c4113dSnw141292 
3135479ac375Sdm199847 	retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3136c5c4113dSnw141292 	if (retcode != IDMAP_SUCCESS)
3137c5c4113dSnw141292 		goto out;
3138c5c4113dSnw141292 
3139c5c4113dSnw141292 	state->pid2sid_done = FALSE;
3140c5c4113dSnw141292 	sqlite_freemem(sql);
3141c5c4113dSnw141292 	sql = NULL;
3142c5c4113dSnw141292 
3143e8c27ec8Sbaban 	/* Check if we need to update namecache */
3144e8c27ec8Sbaban 	if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
3145c5c4113dSnw141292 		goto out;
3146c5c4113dSnw141292 
31478e228215Sdm199847 	if (req->id2name == NULL)
3148c5c4113dSnw141292 		goto out;
3149c5c4113dSnw141292 
3150c5c4113dSnw141292 	sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
3151cd37da74Snw141292 	    "(sidprefix, rid, canon_name, domain, type, expiration) "
3152c5c4113dSnw141292 	    "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
3153cd37da74Snw141292 	    res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid,
3154cd37da74Snw141292 	    req->id2name, req->id2domain,
3155e8c27ec8Sbaban 	    (res->id.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP);
3156c5c4113dSnw141292 
3157c5c4113dSnw141292 	if (sql == NULL) {
3158c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
3159c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
3160c5c4113dSnw141292 		goto out;
3161c5c4113dSnw141292 	}
3162c5c4113dSnw141292 
3163479ac375Sdm199847 	retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3164c5c4113dSnw141292 
3165c5c4113dSnw141292 out:
316648258c6bSjp151216 	if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO))
316748258c6bSjp151216 		idmap_info_free(&res->info);
316862c60062Sbaban 	if (sql != NULL)
3169c5c4113dSnw141292 		sqlite_freemem(sql);
3170c5c4113dSnw141292 	return (retcode);
3171c5c4113dSnw141292 }
3172c5c4113dSnw141292 
3173c5c4113dSnw141292 idmap_retcode
3174479ac375Sdm199847 update_cache_sid2pid(lookup_state_t *state,
3175cd37da74Snw141292 		idmap_mapping *req, idmap_id_res *res)
3176cd37da74Snw141292 {
3177c5c4113dSnw141292 	char		*sql = NULL;
3178c5c4113dSnw141292 	idmap_retcode	retcode;
3179c5c4113dSnw141292 	int		is_eph_user;
318048258c6bSjp151216 	char		*map_dn = NULL;
318148258c6bSjp151216 	char		*map_attr = NULL;
318248258c6bSjp151216 	char		*map_value = NULL;
318348258c6bSjp151216 	char 		*map_windomain = NULL;
318448258c6bSjp151216 	char		*map_winname = NULL;
318548258c6bSjp151216 	char		*map_unixname = NULL;
318648258c6bSjp151216 	int		map_is_nt4 = FALSE;
3187c5c4113dSnw141292 
3188c5c4113dSnw141292 	/* Check if we need to cache anything */
3189e8c27ec8Sbaban 	if (ARE_WE_DONE(req->direction))
3190c5c4113dSnw141292 		return (IDMAP_SUCCESS);
3191c5c4113dSnw141292 
3192c5c4113dSnw141292 	/* We don't cache negative entries */
3193c5c4113dSnw141292 	if (res->retcode != IDMAP_SUCCESS)
3194c5c4113dSnw141292 		return (IDMAP_SUCCESS);
3195c5c4113dSnw141292 
3196c5c4113dSnw141292 	if (req->direction & _IDMAP_F_EXP_EPH_UID)
3197c5c4113dSnw141292 		is_eph_user = 1;
3198c5c4113dSnw141292 	else if (req->direction & _IDMAP_F_EXP_EPH_GID)
3199c5c4113dSnw141292 		is_eph_user = 0;
3200c5c4113dSnw141292 	else
3201c5c4113dSnw141292 		is_eph_user = -1;
3202c5c4113dSnw141292 
3203c5c4113dSnw141292 	if (is_eph_user >= 0 && !IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
3204c5c4113dSnw141292 		sql = sqlite_mprintf("UPDATE idmap_cache "
3205c5c4113dSnw141292 		    "SET w2u = 0 WHERE "
3206c5c4113dSnw141292 		    "sidprefix = %Q AND rid = %u AND w2u = 1 AND "
3207c5c4113dSnw141292 		    "pid >= 2147483648 AND is_user = %d;",
3208c5c4113dSnw141292 		    req->id1.idmap_id_u.sid.prefix,
3209c5c4113dSnw141292 		    req->id1.idmap_id_u.sid.rid,
3210c5c4113dSnw141292 		    is_eph_user);
3211c5c4113dSnw141292 		if (sql == NULL) {
3212c5c4113dSnw141292 			retcode = IDMAP_ERR_INTERNAL;
3213c5c4113dSnw141292 			idmapdlog(LOG_ERR, "Out of memory");
3214c5c4113dSnw141292 			goto out;
3215c5c4113dSnw141292 		}
3216c5c4113dSnw141292 
3217479ac375Sdm199847 		retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3218c5c4113dSnw141292 		if (retcode != IDMAP_SUCCESS)
3219c5c4113dSnw141292 			goto out;
3220c5c4113dSnw141292 
3221c5c4113dSnw141292 		sqlite_freemem(sql);
3222c5c4113dSnw141292 		sql = NULL;
3223c5c4113dSnw141292 	}
3224c5c4113dSnw141292 
3225e8c27ec8Sbaban 	assert(res->direction != IDMAP_DIRECTION_UNDEF);
322648258c6bSjp151216 	assert(res->id.idmap_id_u.uid != SENTINEL_PID);
322748258c6bSjp151216 
322848258c6bSjp151216 	switch (res->info.how.map_type) {
322948258c6bSjp151216 	case IDMAP_MAP_TYPE_DS_AD:
323048258c6bSjp151216 		map_dn = res->info.how.idmap_how_u.ad.dn;
323148258c6bSjp151216 		map_attr = res->info.how.idmap_how_u.ad.attr;
323248258c6bSjp151216 		map_value = res->info.how.idmap_how_u.ad.value;
323348258c6bSjp151216 		break;
323448258c6bSjp151216 
323548258c6bSjp151216 	case IDMAP_MAP_TYPE_DS_NLDAP:
323648258c6bSjp151216 		map_dn = res->info.how.idmap_how_u.nldap.dn;
323748258c6bSjp151216 		map_attr = res->info.how.idmap_how_u.ad.attr;
323848258c6bSjp151216 		map_value = res->info.how.idmap_how_u.nldap.value;
323948258c6bSjp151216 		break;
324048258c6bSjp151216 
324148258c6bSjp151216 	case IDMAP_MAP_TYPE_RULE_BASED:
324248258c6bSjp151216 		map_windomain = res->info.how.idmap_how_u.rule.windomain;
324348258c6bSjp151216 		map_winname = res->info.how.idmap_how_u.rule.winname;
324448258c6bSjp151216 		map_unixname = res->info.how.idmap_how_u.rule.unixname;
324548258c6bSjp151216 		map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4;
324648258c6bSjp151216 		break;
324748258c6bSjp151216 
324848258c6bSjp151216 	case IDMAP_MAP_TYPE_EPHEMERAL:
324948258c6bSjp151216 		break;
325048258c6bSjp151216 
325148258c6bSjp151216 	default:
325248258c6bSjp151216 		/* Dont cache other mapping types */
325348258c6bSjp151216 		assert(FALSE);
325448258c6bSjp151216 	}
3255cd37da74Snw141292 
3256c5c4113dSnw141292 	sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
3257cd37da74Snw141292 	    "(sidprefix, rid, windomain, canon_winname, pid, unixname, "
325848258c6bSjp151216 	    "is_user, is_wuser, expiration, w2u, u2w, "
325948258c6bSjp151216 	    "map_type, map_dn, map_attr, map_value, map_windomain, "
326048258c6bSjp151216 	    "map_winname, map_unixname, map_is_nt4) "
3261cd37da74Snw141292 	    "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
326248258c6bSjp151216 	    "strftime('%%s','now') + 600, 1, %q, "
326348258c6bSjp151216 	    "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);",
3264cd37da74Snw141292 	    req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
3265e8c27ec8Sbaban 	    (req->id1domain != NULL) ? req->id1domain : "", req->id1name,
3266e8c27ec8Sbaban 	    res->id.idmap_id_u.uid, req->id2name,
3267e8c27ec8Sbaban 	    (res->id.idtype == IDMAP_UID) ? 1 : 0,
3268cd37da74Snw141292 	    (req->id1.idtype == IDMAP_USID) ? 1 : 0,
326948258c6bSjp151216 	    (res->direction == 0) ? "1" : NULL,
327048258c6bSjp151216 	    res->info.how.map_type, map_dn, map_attr, map_value,
327148258c6bSjp151216 	    map_windomain, map_winname, map_unixname, map_is_nt4);
3272c5c4113dSnw141292 
3273c5c4113dSnw141292 	if (sql == NULL) {
3274c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
3275c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
3276c5c4113dSnw141292 		goto out;
3277c5c4113dSnw141292 	}
3278c5c4113dSnw141292 
3279479ac375Sdm199847 	retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3280c5c4113dSnw141292 	if (retcode != IDMAP_SUCCESS)
3281c5c4113dSnw141292 		goto out;
3282c5c4113dSnw141292 
3283c5c4113dSnw141292 	state->sid2pid_done = FALSE;
3284c5c4113dSnw141292 	sqlite_freemem(sql);
3285c5c4113dSnw141292 	sql = NULL;
3286c5c4113dSnw141292 
3287e8c27ec8Sbaban 	/* Check if we need to update namecache */
3288e8c27ec8Sbaban 	if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE)
3289c5c4113dSnw141292 		goto out;
3290c5c4113dSnw141292 
3291cf5b5989Sdm199847 	if (EMPTY_STRING(req->id1name))
3292c5c4113dSnw141292 		goto out;
3293c5c4113dSnw141292 
3294c5c4113dSnw141292 	sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
3295cd37da74Snw141292 	    "(sidprefix, rid, canon_name, domain, type, expiration) "
3296c5c4113dSnw141292 	    "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
3297cd37da74Snw141292 	    req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid,
3298cd37da74Snw141292 	    req->id1name, req->id1domain,
3299cd37da74Snw141292 	    (req->id1.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP);
3300c5c4113dSnw141292 
3301c5c4113dSnw141292 	if (sql == NULL) {
3302c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
3303c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
3304c5c4113dSnw141292 		goto out;
3305c5c4113dSnw141292 	}
3306c5c4113dSnw141292 
3307479ac375Sdm199847 	retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql);
3308c5c4113dSnw141292 
3309c5c4113dSnw141292 out:
331048258c6bSjp151216 	if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO))
331148258c6bSjp151216 		idmap_info_free(&res->info);
331248258c6bSjp151216 
331362c60062Sbaban 	if (sql != NULL)
3314c5c4113dSnw141292 		sqlite_freemem(sql);
3315c5c4113dSnw141292 	return (retcode);
3316c5c4113dSnw141292 }
3317c5c4113dSnw141292 
3318cd37da74Snw141292 static
3319cd37da74Snw141292 idmap_retcode
3320c5c4113dSnw141292 lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res,
3321cd37da74Snw141292 		int is_user, int getname)
3322cd37da74Snw141292 {
3323c5c4113dSnw141292 	char		*end;
3324c5c4113dSnw141292 	char		*sql = NULL;
3325c5c4113dSnw141292 	const char	**values;
3326c5c4113dSnw141292 	sqlite_vm	*vm = NULL;
3327c5c4113dSnw141292 	int		ncol;
3328c5c4113dSnw141292 	idmap_retcode	retcode = IDMAP_SUCCESS;
3329c5c4113dSnw141292 	time_t		curtime;
3330e8c27ec8Sbaban 	idmap_id_type	idtype;
3331c5c4113dSnw141292 
3332c5c4113dSnw141292 	/* Current time */
3333c5c4113dSnw141292 	errno = 0;
3334c5c4113dSnw141292 	if ((curtime = time(NULL)) == (time_t)-1) {
3335cd37da74Snw141292 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
3336c5c4113dSnw141292 		    strerror(errno));
3337c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
3338c5c4113dSnw141292 		goto out;
3339c5c4113dSnw141292 	}
3340c5c4113dSnw141292 
3341e8c27ec8Sbaban 	/* SQL to lookup the cache by pid or by unixname */
3342e8c27ec8Sbaban 	if (req->id1.idmap_id_u.uid != SENTINEL_PID) {
334348258c6bSjp151216 		sql = sqlite_mprintf("SELECT sidprefix, rid, "
334448258c6bSjp151216 		    "canon_winname, windomain, w2u, is_wuser, "
334548258c6bSjp151216 		    "map_type, map_dn, map_attr, map_value, map_windomain, "
334648258c6bSjp151216 		    "map_winname, map_unixname, map_is_nt4 "
3347c5c4113dSnw141292 		    "FROM idmap_cache WHERE "
3348c5c4113dSnw141292 		    "pid = %u AND u2w = 1 AND is_user = %d AND "
3349c5c4113dSnw141292 		    "(pid >= 2147483648 OR "
3350c5c4113dSnw141292 		    "(expiration = 0 OR expiration ISNULL OR "
3351c5c4113dSnw141292 		    "expiration > %d));",
3352c5c4113dSnw141292 		    req->id1.idmap_id_u.uid, is_user, curtime);
3353e8c27ec8Sbaban 	} else if (req->id1name != NULL) {
335448258c6bSjp151216 		sql = sqlite_mprintf("SELECT sidprefix, rid, "
335548258c6bSjp151216 		    "canon_winname, windomain, w2u, is_wuser, "
335648258c6bSjp151216 		    "map_type, map_dn, map_attr, map_value, map_windomain, "
335748258c6bSjp151216 		    "map_winname, map_unixname, map_is_nt4 "
3358e8c27ec8Sbaban 		    "FROM idmap_cache WHERE "
3359e8c27ec8Sbaban 		    "unixname = %Q AND u2w = 1 AND is_user = %d AND "
3360e8c27ec8Sbaban 		    "(pid >= 2147483648 OR "
3361e8c27ec8Sbaban 		    "(expiration = 0 OR expiration ISNULL OR "
3362e8c27ec8Sbaban 		    "expiration > %d));",
3363e8c27ec8Sbaban 		    req->id1name, is_user, curtime);
336448258c6bSjp151216 	} else {
336548258c6bSjp151216 		retcode = IDMAP_ERR_ARG;
336648258c6bSjp151216 		goto out;
3367e8c27ec8Sbaban 	}
3368e8c27ec8Sbaban 
3369c5c4113dSnw141292 	if (sql == NULL) {
3370c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
3371c5c4113dSnw141292 		retcode = IDMAP_ERR_MEMORY;
3372c5c4113dSnw141292 		goto out;
3373c5c4113dSnw141292 	}
337448258c6bSjp151216 	retcode = sql_compile_n_step_once(
337548258c6bSjp151216 	    cache, sql, &vm, &ncol, 14, &values);
3376c5c4113dSnw141292 	sqlite_freemem(sql);
3377c5c4113dSnw141292 
3378c5c4113dSnw141292 	if (retcode == IDMAP_ERR_NOTFOUND)
3379c5c4113dSnw141292 		goto out;
3380c5c4113dSnw141292 	else if (retcode == IDMAP_SUCCESS) {
3381c5c4113dSnw141292 		/* sanity checks */
3382c5c4113dSnw141292 		if (values[0] == NULL || values[1] == NULL) {
3383c5c4113dSnw141292 			retcode = IDMAP_ERR_CACHE;
3384c5c4113dSnw141292 			goto out;
3385c5c4113dSnw141292 		}
3386c5c4113dSnw141292 
3387e8c27ec8Sbaban 		switch (res->id.idtype) {
3388c5c4113dSnw141292 		case IDMAP_SID:
3389cd37da74Snw141292 		case IDMAP_USID:
3390cd37da74Snw141292 		case IDMAP_GSID:
3391e8c27ec8Sbaban 			idtype = strtol(values[5], &end, 10) == 1
3392cd37da74Snw141292 			    ? IDMAP_USID : IDMAP_GSID;
3393cd37da74Snw141292 
3394e8c27ec8Sbaban 			if (res->id.idtype == IDMAP_USID &&
3395e8c27ec8Sbaban 			    idtype != IDMAP_USID) {
3396cd37da74Snw141292 				retcode = IDMAP_ERR_NOTUSER;
3397cd37da74Snw141292 				goto out;
3398e8c27ec8Sbaban 			} else if (res->id.idtype == IDMAP_GSID &&
3399e8c27ec8Sbaban 			    idtype != IDMAP_GSID) {
3400cd37da74Snw141292 				retcode = IDMAP_ERR_NOTGROUP;
3401cd37da74Snw141292 				goto out;
3402cd37da74Snw141292 			}
3403e8c27ec8Sbaban 			res->id.idtype = idtype;
3404cd37da74Snw141292 
3405c5c4113dSnw141292 			res->id.idmap_id_u.sid.rid =
3406c5c4113dSnw141292 			    strtoul(values[1], &end, 10);
3407c5c4113dSnw141292 			res->id.idmap_id_u.sid.prefix = strdup(values[0]);
3408c5c4113dSnw141292 			if (res->id.idmap_id_u.sid.prefix == NULL) {
3409c5c4113dSnw141292 				idmapdlog(LOG_ERR, "Out of memory");
3410c5c4113dSnw141292 				retcode = IDMAP_ERR_MEMORY;
3411c5c4113dSnw141292 				goto out;
3412c5c4113dSnw141292 			}
3413c5c4113dSnw141292 
341462c60062Sbaban 			if (values[4] != NULL)
3415c5c4113dSnw141292 				res->direction =
3416651c0131Sbaban 				    (strtol(values[4], &end, 10) == 0)?
3417651c0131Sbaban 				    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
3418c5c4113dSnw141292 			else
3419651c0131Sbaban 				res->direction = IDMAP_DIRECTION_U2W;
3420c5c4113dSnw141292 
3421c5c4113dSnw141292 			if (getname == 0 || values[2] == NULL)
3422c5c4113dSnw141292 				break;
34238e228215Sdm199847 			req->id2name = strdup(values[2]);
34248e228215Sdm199847 			if (req->id2name == NULL) {
3425c5c4113dSnw141292 				idmapdlog(LOG_ERR, "Out of memory");
3426c5c4113dSnw141292 				retcode = IDMAP_ERR_MEMORY;
3427c5c4113dSnw141292 				goto out;
3428c5c4113dSnw141292 			}
3429c5c4113dSnw141292 
3430c5c4113dSnw141292 			if (values[3] == NULL)
3431c5c4113dSnw141292 				break;
34328e228215Sdm199847 			req->id2domain = strdup(values[3]);
34338e228215Sdm199847 			if (req->id2domain == NULL) {
3434c5c4113dSnw141292 				idmapdlog(LOG_ERR, "Out of memory");
3435c5c4113dSnw141292 				retcode = IDMAP_ERR_MEMORY;
3436c5c4113dSnw141292 				goto out;
3437c5c4113dSnw141292 			}
3438cd37da74Snw141292 
3439c5c4113dSnw141292 			break;
3440c5c4113dSnw141292 		default:
3441c5c4113dSnw141292 			retcode = IDMAP_ERR_NOTSUPPORTED;
3442c5c4113dSnw141292 			break;
3443c5c4113dSnw141292 		}
344448258c6bSjp151216 		if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
344548258c6bSjp151216 			res->info.src = IDMAP_MAP_SRC_CACHE;
344648258c6bSjp151216 			res->info.how.map_type = strtoul(values[6], &end, 10);
344748258c6bSjp151216 			switch (res->info.how.map_type) {
344848258c6bSjp151216 			case IDMAP_MAP_TYPE_DS_AD:
344948258c6bSjp151216 				res->info.how.idmap_how_u.ad.dn =
345048258c6bSjp151216 				    strdup(values[7]);
345148258c6bSjp151216 				res->info.how.idmap_how_u.ad.attr =
345248258c6bSjp151216 				    strdup(values[8]);
345348258c6bSjp151216 				res->info.how.idmap_how_u.ad.value =
345448258c6bSjp151216 				    strdup(values[9]);
345548258c6bSjp151216 				break;
345648258c6bSjp151216 
345748258c6bSjp151216 			case IDMAP_MAP_TYPE_DS_NLDAP:
345848258c6bSjp151216 				res->info.how.idmap_how_u.nldap.dn =
345948258c6bSjp151216 				    strdup(values[7]);
346048258c6bSjp151216 				res->info.how.idmap_how_u.nldap.attr =
346148258c6bSjp151216 				    strdup(values[8]);
346248258c6bSjp151216 				res->info.how.idmap_how_u.nldap.value =
346348258c6bSjp151216 				    strdup(values[9]);
346448258c6bSjp151216 				break;
346548258c6bSjp151216 
346648258c6bSjp151216 			case IDMAP_MAP_TYPE_RULE_BASED:
346748258c6bSjp151216 				res->info.how.idmap_how_u.rule.windomain =
346848258c6bSjp151216 				    strdup(values[10]);
346948258c6bSjp151216 				res->info.how.idmap_how_u.rule.winname =
347048258c6bSjp151216 				    strdup(values[11]);
347148258c6bSjp151216 				res->info.how.idmap_how_u.rule.unixname =
347248258c6bSjp151216 				    strdup(values[12]);
347348258c6bSjp151216 				res->info.how.idmap_how_u.rule.is_nt4 =
347448258c6bSjp151216 				    strtoul(values[13], &end, 10);
347548258c6bSjp151216 				res->info.how.idmap_how_u.rule.is_user =
347648258c6bSjp151216 				    is_user;
347748258c6bSjp151216 				res->info.how.idmap_how_u.rule.is_wuser =
347848258c6bSjp151216 				    strtol(values[5], &end, 10);
347948258c6bSjp151216 				break;
348048258c6bSjp151216 
348148258c6bSjp151216 			case IDMAP_MAP_TYPE_EPHEMERAL:
348248258c6bSjp151216 				break;
348348258c6bSjp151216 
348448258c6bSjp151216 			case IDMAP_MAP_TYPE_LOCAL_SID:
348548258c6bSjp151216 				break;
348648258c6bSjp151216 
348748258c6bSjp151216 			case IDMAP_MAP_TYPE_KNOWN_SID:
348848258c6bSjp151216 				break;
348948258c6bSjp151216 
349048258c6bSjp151216 			default:
349148258c6bSjp151216 				/* Unknow mapping type */
349248258c6bSjp151216 				assert(FALSE);
349348258c6bSjp151216 			}
349448258c6bSjp151216 		}
3495c5c4113dSnw141292 	}
3496c5c4113dSnw141292 
3497c5c4113dSnw141292 out:
349862c60062Sbaban 	if (vm != NULL)
3499c5c4113dSnw141292 		(void) sqlite_finalize(vm, NULL);
3500c5c4113dSnw141292 	return (retcode);
3501c5c4113dSnw141292 }
3502c5c4113dSnw141292 
3503cd37da74Snw141292 static
3504cd37da74Snw141292 idmap_retcode
3505c5c4113dSnw141292 lookup_cache_name2sid(sqlite *cache, const char *name, const char *domain,
3506cd37da74Snw141292 	char **canonname, char **sidprefix, idmap_rid_t *rid, int *type)
3507cd37da74Snw141292 {
3508cd37da74Snw141292 	char		*end, *lower_name;
3509c5c4113dSnw141292 	char		*sql = NULL;
3510c5c4113dSnw141292 	const char	**values;
3511c5c4113dSnw141292 	sqlite_vm	*vm = NULL;
3512c5c4113dSnw141292 	int		ncol;
3513c5c4113dSnw141292 	time_t		curtime;
3514c5c4113dSnw141292 	idmap_retcode	retcode = IDMAP_SUCCESS;
3515c5c4113dSnw141292 
3516c5c4113dSnw141292 	/* Get current time */
3517c5c4113dSnw141292 	errno = 0;
3518c5c4113dSnw141292 	if ((curtime = time(NULL)) == (time_t)-1) {
3519cd37da74Snw141292 		idmapdlog(LOG_ERR, "Failed to get current time (%s)",
3520c5c4113dSnw141292 		    strerror(errno));
3521c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
3522c5c4113dSnw141292 		goto out;
3523c5c4113dSnw141292 	}
3524c5c4113dSnw141292 
3525c5c4113dSnw141292 	/* SQL to lookup the cache */
3526cd37da74Snw141292 	if ((lower_name = tolower_u8(name)) == NULL)
3527cd37da74Snw141292 		lower_name = (char *)name;
3528cd37da74Snw141292 	sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name "
3529cd37da74Snw141292 	    "FROM name_cache WHERE name = %Q AND domain = %Q AND "
3530c5c4113dSnw141292 	    "(expiration = 0 OR expiration ISNULL OR "
3531cd37da74Snw141292 	    "expiration > %d);", lower_name, domain, curtime);
3532cd37da74Snw141292 	if (lower_name != name)
3533cd37da74Snw141292 		free(lower_name);
3534c5c4113dSnw141292 	if (sql == NULL) {
3535c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
3536c5c4113dSnw141292 		retcode = IDMAP_ERR_MEMORY;
3537c5c4113dSnw141292 		goto out;
3538c5c4113dSnw141292 	}
3539cd37da74Snw141292 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values);
3540c5c4113dSnw141292 	sqlite_freemem(sql);
3541c5c4113dSnw141292 
3542c5c4113dSnw141292 	if (retcode == IDMAP_SUCCESS) {
354362c60062Sbaban 		if (type != NULL) {
3544c5c4113dSnw141292 			if (values[2] == NULL) {
3545c5c4113dSnw141292 				retcode = IDMAP_ERR_CACHE;
3546c5c4113dSnw141292 				goto out;
3547c5c4113dSnw141292 			}
3548c5c4113dSnw141292 			*type = strtol(values[2], &end, 10);
3549c5c4113dSnw141292 		}
3550c5c4113dSnw141292 
3551e8c27ec8Sbaban 		if (values[0] == NULL || values[1] == NULL) {
3552e8c27ec8Sbaban 			retcode = IDMAP_ERR_CACHE;
3553e8c27ec8Sbaban 			goto out;
3554e8c27ec8Sbaban 		}
3555e8c27ec8Sbaban 
3556cd37da74Snw141292 		if (canonname != NULL) {
3557cd37da74Snw141292 			assert(values[3] != NULL);
3558cd37da74Snw141292 			if ((*canonname = strdup(values[3])) == NULL) {
3559cd37da74Snw141292 				idmapdlog(LOG_ERR, "Out of memory");
3560cd37da74Snw141292 				retcode = IDMAP_ERR_MEMORY;
3561cd37da74Snw141292 				goto out;
3562cd37da74Snw141292 			}
3563cd37da74Snw141292 		}
3564cd37da74Snw141292 
3565c5c4113dSnw141292 		if ((*sidprefix = strdup(values[0])) == NULL) {
3566c5c4113dSnw141292 			idmapdlog(LOG_ERR, "Out of memory");
3567c5c4113dSnw141292 			retcode = IDMAP_ERR_MEMORY;
3568e8c27ec8Sbaban 			if (canonname != NULL) {
3569e8c27ec8Sbaban 				free(*canonname);
3570e8c27ec8Sbaban 				*canonname = NULL;
3571e8c27ec8Sbaban 			}
3572c5c4113dSnw141292 			goto out;
3573c5c4113dSnw141292 		}
3574c5c4113dSnw141292 		*rid = strtoul(values[1], &end, 10);
3575c5c4113dSnw141292 	}
3576c5c4113dSnw141292 
3577c5c4113dSnw141292 out:
357862c60062Sbaban 	if (vm != NULL)
3579c5c4113dSnw141292 		(void) sqlite_finalize(vm, NULL);
3580c5c4113dSnw141292 	return (retcode);
3581c5c4113dSnw141292 }
3582c5c4113dSnw141292 
3583cd37da74Snw141292 static
3584cd37da74Snw141292 idmap_retcode
3585e8c27ec8Sbaban ad_lookup_by_winname(lookup_state_t *state,
3586e8c27ec8Sbaban 		const char *name, const char *domain, int eunixtype,
358748258c6bSjp151216 		char **dn, char **attr, char **value, char **canonname,
358848258c6bSjp151216 		char **sidprefix, idmap_rid_t *rid, int *wintype,
358948258c6bSjp151216 		char **unixname)
3590cd37da74Snw141292 {
3591c5c4113dSnw141292 	int			retries = 0;
3592c5c4113dSnw141292 	idmap_query_state_t	*qs = NULL;
3593c5c4113dSnw141292 	idmap_retcode		rc, retcode;
3594c5c4113dSnw141292 
3595c5c4113dSnw141292 retry:
3596*2b4a7802SBaban Kenkre 	RDLOCK_CONFIG();
3597e8c27ec8Sbaban 	retcode = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs);
3598*2b4a7802SBaban Kenkre 	UNLOCK_CONFIG();
3599e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS) {
3600*2b4a7802SBaban Kenkre 		if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
3601*2b4a7802SBaban Kenkre 		    retries++ < ADUTILS_DEF_NUM_RETRIES)
36020dcc7149Snw141292 			goto retry;
3603349d5d8fSnw141292 		degrade_svc(1, "failed to create request for AD lookup "
36040dcc7149Snw141292 		    "by winname");
3605e8c27ec8Sbaban 		return (retcode);
3606c5c4113dSnw141292 	}
3607c5c4113dSnw141292 
3608c8e26105Sjp151216 	restore_svc();
3609c8e26105Sjp151216 
3610e8c27ec8Sbaban 	if (state != NULL)
3611e8c27ec8Sbaban 		idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr,
3612e8c27ec8Sbaban 		    state->ad_unixgroup_attr);
3613c5c4113dSnw141292 
3614e8c27ec8Sbaban 	retcode = idmap_name2sid_batch_add1(qs, name, domain, eunixtype,
361548258c6bSjp151216 	    dn, attr, value, canonname, sidprefix, rid, wintype, unixname, &rc);
3616c5c4113dSnw141292 
3617e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS)
361884decf41Sjp151216 		idmap_lookup_release_batch(&qs);
3619c5c4113dSnw141292 	else
36200dcc7149Snw141292 		retcode = idmap_lookup_batch_end(&qs);
3621c5c4113dSnw141292 
3622*2b4a7802SBaban Kenkre 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR &&
3623*2b4a7802SBaban Kenkre 	    retries++ < ADUTILS_DEF_NUM_RETRIES)
3624c5c4113dSnw141292 		goto retry;
3625c8e26105Sjp151216 	else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
3626349d5d8fSnw141292 		degrade_svc(1, "some AD lookups timed out repeatedly");
3627c5c4113dSnw141292 
3628c5c4113dSnw141292 	if (retcode != IDMAP_SUCCESS) {
3629e8c27ec8Sbaban 		idmapdlog(LOG_NOTICE, "AD lookup by winname failed");
3630c5c4113dSnw141292 		return (retcode);
3631e8c27ec8Sbaban 	}
3632c5c4113dSnw141292 	return (rc);
3633c5c4113dSnw141292 }
3634c5c4113dSnw141292 
3635cd37da74Snw141292 idmap_retcode
3636c5c4113dSnw141292 lookup_name2sid(sqlite *cache, const char *name, const char *domain,
3637cd37da74Snw141292 		int *is_wuser, char **canonname, char **sidprefix,
3638479ac375Sdm199847 		idmap_rid_t *rid, idmap_mapping *req, int local_only)
3639cd37da74Snw141292 {
3640c5c4113dSnw141292 	int		type;
3641c5c4113dSnw141292 	idmap_retcode	retcode;
3642c5c4113dSnw141292 
3643cd37da74Snw141292 	*sidprefix = NULL;
3644e8c27ec8Sbaban 	if (canonname != NULL)
3645cd37da74Snw141292 		*canonname = NULL;
3646cd37da74Snw141292 
3647e8c27ec8Sbaban 	/* Lookup well-known SIDs table */
3648cd37da74Snw141292 	retcode = lookup_wksids_name2sid(name, canonname, sidprefix, rid,
3649cd37da74Snw141292 	    &type);
365062c60062Sbaban 	if (retcode == IDMAP_SUCCESS) {
3651e8c27ec8Sbaban 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
365262c60062Sbaban 		goto out;
365362c60062Sbaban 	} else if (retcode != IDMAP_ERR_NOTFOUND) {
365462c60062Sbaban 		return (retcode);
365562c60062Sbaban 	}
365662c60062Sbaban 
3657e8c27ec8Sbaban 	/* Lookup cache */
3658cd37da74Snw141292 	retcode = lookup_cache_name2sid(cache, name, domain, canonname,
3659cd37da74Snw141292 	    sidprefix, rid, &type);
3660e8c27ec8Sbaban 	if (retcode == IDMAP_SUCCESS) {
3661e8c27ec8Sbaban 		req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE;
3662e8c27ec8Sbaban 		goto out;
3663e8c27ec8Sbaban 	} else if (retcode != IDMAP_ERR_NOTFOUND) {
3664e8c27ec8Sbaban 		return (retcode);
3665e8c27ec8Sbaban 	}
3666e8c27ec8Sbaban 
3667479ac375Sdm199847 	/*
3668479ac375Sdm199847 	 * The caller may be using this function to determine if this
3669479ac375Sdm199847 	 * request needs to be marked for AD lookup or not
3670479ac375Sdm199847 	 * (i.e. _IDMAP_F_LOOKUP_AD) and therefore may not want this
3671479ac375Sdm199847 	 * function to AD lookup now.
3672479ac375Sdm199847 	 */
3673479ac375Sdm199847 	if (local_only)
3674479ac375Sdm199847 		return (retcode);
3675479ac375Sdm199847 
3676e8c27ec8Sbaban 	/* Lookup AD */
3677e8c27ec8Sbaban 	retcode = ad_lookup_by_winname(NULL, name, domain, _IDMAP_T_UNDEF,
367848258c6bSjp151216 	    NULL, NULL, NULL, canonname, sidprefix, rid, &type, NULL);
3679c5c4113dSnw141292 	if (retcode != IDMAP_SUCCESS)
3680c5c4113dSnw141292 		return (retcode);
3681c5c4113dSnw141292 
368262c60062Sbaban out:
3683c5c4113dSnw141292 	/*
3684c5c4113dSnw141292 	 * Entry found (cache or Windows lookup)
3685cd37da74Snw141292 	 * is_wuser is both input as well as output parameter
3686c5c4113dSnw141292 	 */
3687e8c27ec8Sbaban 	if (*is_wuser == 1 && type != _IDMAP_T_USER)
3688e8c27ec8Sbaban 		retcode = IDMAP_ERR_NOTUSER;
3689e8c27ec8Sbaban 	else if (*is_wuser == 0 && type != _IDMAP_T_GROUP)
3690e8c27ec8Sbaban 		retcode = IDMAP_ERR_NOTGROUP;
3691e8c27ec8Sbaban 	else if (*is_wuser == -1) {
3692c5c4113dSnw141292 		/* Caller wants to know if its user or group */
3693c5c4113dSnw141292 		if (type == _IDMAP_T_USER)
3694cd37da74Snw141292 			*is_wuser = 1;
3695c5c4113dSnw141292 		else if (type == _IDMAP_T_GROUP)
3696cd37da74Snw141292 			*is_wuser = 0;
3697e8c27ec8Sbaban 		else
3698e8c27ec8Sbaban 			retcode = IDMAP_ERR_SID;
3699e8c27ec8Sbaban 	}
3700e8c27ec8Sbaban 
3701e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS) {
3702cd37da74Snw141292 		free(*sidprefix);
3703cd37da74Snw141292 		*sidprefix = NULL;
3704e8c27ec8Sbaban 		if (canonname != NULL) {
3705cd37da74Snw141292 			free(*canonname);
3706cd37da74Snw141292 			*canonname = NULL;
3707cd37da74Snw141292 		}
3708c5c4113dSnw141292 	}
3709c5c4113dSnw141292 	return (retcode);
3710c5c4113dSnw141292 }
3711c5c4113dSnw141292 
3712cd37da74Snw141292 static
3713cd37da74Snw141292 idmap_retcode
3714479ac375Sdm199847 name_based_mapping_pid2sid(lookup_state_t *state, const char *unixname,
3715cd37da74Snw141292 		int is_user, idmap_mapping *req, idmap_id_res *res)
3716cd37da74Snw141292 {
3717c5c4113dSnw141292 	const char	*winname, *windomain;
3718cd37da74Snw141292 	char		*canonname;
3719c5c4113dSnw141292 	char		*sql = NULL, *errmsg = NULL;
3720c5c4113dSnw141292 	idmap_retcode	retcode;
3721c5c4113dSnw141292 	char		*end;
3722c5c4113dSnw141292 	const char	**values;
3723c5c4113dSnw141292 	sqlite_vm	*vm = NULL;
372448258c6bSjp151216 	int		ncol, r;
3725cd37da74Snw141292 	int		is_wuser;
3726e8c27ec8Sbaban 	const char	*me = "name_based_mapping_pid2sid";
372748258c6bSjp151216 	int 		non_wild_match = FALSE;
372848258c6bSjp151216 	idmap_namerule	*rule = &res->info.how.idmap_how_u.rule;
372948258c6bSjp151216 	int direction;
3730e8c27ec8Sbaban 
3731e8c27ec8Sbaban 	assert(unixname != NULL); /* We have unixname */
3732e8c27ec8Sbaban 	assert(req->id2name == NULL); /* We don't have winname */
3733e8c27ec8Sbaban 	assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */
3734c5c4113dSnw141292 
3735c5c4113dSnw141292 	sql = sqlite_mprintf(
373648258c6bSjp151216 	    "SELECT winname_display, windomain, w2u_order, "
373748258c6bSjp151216 	    "is_wuser, unixname, is_nt4 "
373848258c6bSjp151216 	    "FROM namerules WHERE "
3739c5c4113dSnw141292 	    "u2w_order > 0 AND is_user = %d AND "
3740c5c4113dSnw141292 	    "(unixname = %Q OR unixname = '*') "
3741cd37da74Snw141292 	    "ORDER BY u2w_order ASC;", is_user, unixname);
3742c5c4113dSnw141292 	if (sql == NULL) {
3743c5c4113dSnw141292 		idmapdlog(LOG_ERR, "Out of memory");
3744c5c4113dSnw141292 		retcode = IDMAP_ERR_MEMORY;
3745c5c4113dSnw141292 		goto out;
3746c5c4113dSnw141292 	}
3747c5c4113dSnw141292 
3748479ac375Sdm199847 	if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
3749c5c4113dSnw141292 		retcode = IDMAP_ERR_INTERNAL;
3750cd37da74Snw141292 		idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3751cd37da74Snw141292 		    CHECK_NULL(errmsg));
3752c5c4113dSnw141292 		sqlite_freemem(errmsg);
3753c5c4113dSnw141292 		goto out;
3754c5c4113dSnw141292 	}
3755c5c4113dSnw141292 
375648258c6bSjp151216 	for (;;) {
3757c5c4113dSnw141292 		r = sqlite_step(vm, &ncol, &values, NULL);
375884decf41Sjp151216 		assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
375984decf41Sjp151216 		if (r == SQLITE_ROW) {
376048258c6bSjp151216 			if (ncol < 6) {
3761c5c4113dSnw141292 				retcode = IDMAP_ERR_INTERNAL;
3762c5c4113dSnw141292 				goto out;
3763c5c4113dSnw141292 			}
3764c5c4113dSnw141292 			if (values[0] == NULL) {
3765c5c4113dSnw141292 				/* values [1] and [2] can be null */
3766c5c4113dSnw141292 				retcode = IDMAP_ERR_INTERNAL;
3767c5c4113dSnw141292 				goto out;
3768c5c4113dSnw141292 			}
376948258c6bSjp151216 
377048258c6bSjp151216 			if (values[2] != NULL)
377148258c6bSjp151216 				direction =
377248258c6bSjp151216 				    (strtol(values[2], &end, 10) == 0)?
377348258c6bSjp151216 				    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
377448258c6bSjp151216 			else
377548258c6bSjp151216 				direction = IDMAP_DIRECTION_U2W;
377648258c6bSjp151216 
3777c5c4113dSnw141292 			if (EMPTY_NAME(values[0])) {
377848258c6bSjp151216 				idmap_namerule_set(rule, values[1], values[0],
377948258c6bSjp151216 				    values[4], is_user,
378048258c6bSjp151216 				    strtol(values[3], &end, 10),
378148258c6bSjp151216 				    strtol(values[5], &end, 10),
378248258c6bSjp151216 				    direction);
3783c5c4113dSnw141292 				retcode = IDMAP_ERR_NOMAPPING;
3784c5c4113dSnw141292 				goto out;
3785c5c4113dSnw141292 			}
3786cd37da74Snw141292 
3787cd37da74Snw141292 			if (values[0][0] == '*') {
378848258c6bSjp151216 				winname = unixname;
378948258c6bSjp151216 				if (non_wild_match) {
3790cd37da74Snw141292 					/*
379148258c6bSjp151216 					 * There were non-wildcard rules
379248258c6bSjp151216 					 * where the Windows identity doesn't
379348258c6bSjp151216 					 * exist. Return no mapping.
3794cd37da74Snw141292 					 */
3795cd37da74Snw141292 					retcode = IDMAP_ERR_NOMAPPING;
3796cd37da74Snw141292 					goto out;
3797cd37da74Snw141292 				}
3798cd37da74Snw141292 			} else {
379948258c6bSjp151216 				/* Save first non-wild match rule */
380048258c6bSjp151216 				if (!non_wild_match) {
380148258c6bSjp151216 					idmap_namerule_set(rule, values[1],
380248258c6bSjp151216 					    values[0], values[4],
380348258c6bSjp151216 					    is_user,
380448258c6bSjp151216 					    strtol(values[3], &end, 10),
380548258c6bSjp151216 					    strtol(values[5], &end, 10),
380648258c6bSjp151216 					    direction);
380748258c6bSjp151216 					non_wild_match = TRUE;
380848258c6bSjp151216 				}
3809cd37da74Snw141292 				winname = values[0];
3810cd37da74Snw141292 			}
381148258c6bSjp151216 			is_wuser = res->id.idtype == IDMAP_USID ? 1
381248258c6bSjp151216 			    : res->id.idtype == IDMAP_GSID ? 0
381348258c6bSjp151216 			    : -1;
381462c60062Sbaban 			if (values[1] != NULL)
3815c5c4113dSnw141292 				windomain = values[1];
3816479ac375Sdm199847 			else if (state->defdom != NULL)
3817479ac375Sdm199847 				windomain = state->defdom;
3818c5c4113dSnw141292 			else {
3819cd37da74Snw141292 				idmapdlog(LOG_ERR, "%s: no domain", me);
3820c5c4113dSnw141292 				retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
3821c5c4113dSnw141292 				goto out;
3822c5c4113dSnw141292 			}
3823cd37da74Snw141292 
3824479ac375Sdm199847 			retcode = lookup_name2sid(state->cache,
3825479ac375Sdm199847 			    winname, windomain,
3826cd37da74Snw141292 			    &is_wuser, &canonname,
3827cd37da74Snw141292 			    &res->id.idmap_id_u.sid.prefix,
3828479ac375Sdm199847 			    &res->id.idmap_id_u.sid.rid, req, 0);
3829e8c27ec8Sbaban 
3830c5c4113dSnw141292 			if (retcode == IDMAP_ERR_NOTFOUND) {
3831c5c4113dSnw141292 				continue;
3832c5c4113dSnw141292 			}
3833c5c4113dSnw141292 			goto out;
383448258c6bSjp151216 
3835c5c4113dSnw141292 		} else if (r == SQLITE_DONE) {
383648258c6bSjp151216 			/*
383748258c6bSjp151216 			 * If there were non-wildcard rules where
383848258c6bSjp151216 			 * Windows identity doesn't exist
383948258c6bSjp151216 			 * return no mapping.
384048258c6bSjp151216 			 */
384148258c6bSjp151216 			if (non_wild_match)
384248258c6bSjp151216 				retcode = IDMAP_ERR_NOMAPPING;
384348258c6bSjp151216 			else
3844c5c4113dSnw141292 				retcode = IDMAP_ERR_NOTFOUND;
3845c5c4113dSnw141292 			goto out;
3846c5c4113dSnw141292 		} else {
3847c5c4113dSnw141292 			(void) sqlite_finalize(vm, &errmsg);
3848c5c4113dSnw141292 			vm = NULL;
3849cd37da74Snw141292 			idmapdlog(LOG_ERR, "%s: database error (%s)", me,
3850cd37da74Snw141292 			    CHECK_NULL(errmsg));
3851c5c4113dSnw141292 			sqlite_freemem(errmsg);
3852c5c4113dSnw141292 			retcode = IDMAP_ERR_INTERNAL;
3853c5c4113dSnw141292 			goto out;
3854c5c4113dSnw141292 		}
3855c5c4113dSnw141292 	}
3856c5c4113dSnw141292 
3857c5c4113dSnw141292 out:
385862c60062Sbaban 	if (sql != NULL)
3859c5c4113dSnw141292 		sqlite_freemem(sql);
386048258c6bSjp151216 	res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED;
3861c5c4113dSnw141292 	if (retcode == IDMAP_SUCCESS) {
3862cd37da74Snw141292 		res->id.idtype = is_wuser ? IDMAP_USID : IDMAP_GSID;
3863cd37da74Snw141292 
386462c60062Sbaban 		if (values[2] != NULL)
3865c5c4113dSnw141292 			res->direction =
3866651c0131Sbaban 			    (strtol(values[2], &end, 10) == 0)?
3867651c0131Sbaban 			    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
3868c5c4113dSnw141292 		else
3869651c0131Sbaban 			res->direction = IDMAP_DIRECTION_U2W;
38708e228215Sdm199847 
3871cd37da74Snw141292 		req->id2name = canonname;
38728e228215Sdm199847 		if (req->id2name != NULL) {
38738e228215Sdm199847 			req->id2domain = strdup(windomain);
3874479ac375Sdm199847 			if (req->id2domain == NULL)
3875479ac375Sdm199847 				retcode = IDMAP_ERR_MEMORY;
38768e228215Sdm199847 		}
3877c5c4113dSnw141292 	}
3878479ac375Sdm199847 
3879479ac375Sdm199847 	if (retcode == IDMAP_SUCCESS) {
388048258c6bSjp151216 		idmap_namerule_set(rule, values[1], values[0], values[4],
388148258c6bSjp151216 		    is_user, strtol(values[3], &end, 10),
388248258c6bSjp151216 		    strtol(values[5], &end, 10),
388348258c6bSjp151216 		    rule->direction);
388448258c6bSjp151216 		res->info.src = IDMAP_MAP_SRC_NEW;
3885c5c4113dSnw141292 	}
388662c60062Sbaban 	if (vm != NULL)
3887c5c4113dSnw141292 		(void) sqlite_finalize(vm, NULL);
3888c5c4113dSnw141292 	return (retcode);
3889c5c4113dSnw141292 }
3890c5c4113dSnw141292 
3891cd37da74Snw141292 /*
3892cd37da74Snw141292  * Convention when processing unix2win requests:
3893cd37da74Snw141292  *
3894cd37da74Snw141292  * Unix identity:
3895cd37da74Snw141292  * req->id1name =
3896cd37da74Snw141292  *              unixname if given otherwise unixname found will be placed
3897cd37da74Snw141292  *              here.
3898cd37da74Snw141292  * req->id1domain =
3899cd37da74Snw141292  *              NOT USED
3900cd37da74Snw141292  * req->id1.idtype =
3901cd37da74Snw141292  *              Given type (IDMAP_UID or IDMAP_GID)
3902cd37da74Snw141292  * req->id1..[uid or gid] =
3903cd37da74Snw141292  *              UID/GID if given otherwise UID/GID found will be placed here.
3904cd37da74Snw141292  *
3905cd37da74Snw141292  * Windows identity:
3906cd37da74Snw141292  * req->id2name =
3907cd37da74Snw141292  *              winname found will be placed here.
3908cd37da74Snw141292  * req->id2domain =
3909cd37da74Snw141292  *              windomain found will be placed here.
3910cd37da74Snw141292  * res->id.idtype =
3911cd37da74Snw141292  *              Target type initialized from req->id2.idtype. If
3912cd37da74Snw141292  *              it is IDMAP_SID then actual type (IDMAP_USID/GSID) found
3913cd37da74Snw141292  *              will be placed here.
3914cd37da74Snw141292  * req->id..sid.[prefix, rid] =
3915cd37da74Snw141292  *              SID found will be placed here.
3916cd37da74Snw141292  *
3917cd37da74Snw141292  * Others:
3918cd37da74Snw141292  * res->retcode =
3919cd37da74Snw141292  *              Return status for this request will be placed here.
3920cd37da74Snw141292  * res->direction =
3921cd37da74Snw141292  *              Direction found will be placed here. Direction
3922cd37da74Snw141292  *              meaning whether the resultant mapping is valid
3923cd37da74Snw141292  *              only from unix2win or bi-directional.
3924cd37da74Snw141292  * req->direction =
3925cd37da74Snw141292  *              INTERNAL USE. Used by idmapd to set various
3926cd37da74Snw141292  *              flags (_IDMAP_F_xxxx) to aid in processing
3927cd37da74Snw141292  *              of the request.
3928cd37da74Snw141292  * req->id2.idtype =
3929cd37da74Snw141292  *              INTERNAL USE. Initially this is the requested target
3930cd37da74Snw141292  *              type and is used to initialize res->id.idtype.
3931cd37da74Snw141292  *              ad_lookup_batch() uses this field temporarily to store
3932cd37da74Snw141292  *              sid_type obtained by the batched AD lookups and after
3933cd37da74Snw141292  *              use resets it to IDMAP_NONE to prevent xdr from
3934cd37da74Snw141292  *              mis-interpreting the contents of req->id2.
3935cd37da74Snw141292  * req->id2..[uid or gid or sid] =
3936cd37da74Snw141292  *              NOT USED
3937cd37da74Snw141292  */
3938cd37da74Snw141292 
3939cd37da74Snw141292 /*
3940cd37da74Snw141292  * This function does the following:
3941cd37da74Snw141292  * 1. Lookup well-known SIDs table.
3942cd37da74Snw141292  * 2. Lookup cache.
3943cd37da74Snw141292  * 3. Check if the client does not want new mapping to be allocated
3944cd37da74Snw141292  *    in which case this pass is the final pass.
3945e8c27ec8Sbaban  * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs
3946e8c27ec8Sbaban  *    to do AD/NLDAP lookup.
3947cd37da74Snw141292  */
3948c5c4113dSnw141292 idmap_retcode
3949479ac375Sdm199847 pid2sid_first_pass(lookup_state_t *state, idmap_mapping *req,
3950479ac375Sdm199847 		idmap_id_res *res, int is_user, int getname)
3951cd37da74Snw141292 {
3952e8c27ec8Sbaban 	idmap_retcode	retcode;
3953e8c27ec8Sbaban 	bool_t		gen_localsid_on_err = FALSE;
3954c5c4113dSnw141292 
3955e8c27ec8Sbaban 	/* Initialize result */
3956c5c4113dSnw141292 	res->id.idtype = req->id2.idtype;
3957e8c27ec8Sbaban 	res->direction = IDMAP_DIRECTION_UNDEF;
3958c5c4113dSnw141292 
3959e8c27ec8Sbaban 	if (req->id2.idmap_id_u.sid.prefix != NULL) {
3960e8c27ec8Sbaban 		/* sanitize sidprefix */
3961e8c27ec8Sbaban 		free(req->id2.idmap_id_u.sid.prefix);
3962e8c27ec8Sbaban 		req->id2.idmap_id_u.sid.prefix = NULL;
3963e8c27ec8Sbaban 	}
3964e8c27ec8Sbaban 
396548258c6bSjp151216 	/* Find pid */
396648258c6bSjp151216 	if (req->id1.idmap_id_u.uid == SENTINEL_PID) {
396748258c6bSjp151216 		if (ns_lookup_byname(req->id1name, NULL, &req->id1)
396848258c6bSjp151216 		    != IDMAP_SUCCESS) {
396948258c6bSjp151216 			retcode = IDMAP_ERR_NOMAPPING;
397048258c6bSjp151216 			goto out;
397148258c6bSjp151216 		}
397248258c6bSjp151216 	}
397348258c6bSjp151216 
3974e8c27ec8Sbaban 	/* Lookup well-known SIDs table */
3975c5c4113dSnw141292 	retcode = lookup_wksids_pid2sid(req, res, is_user);
3976c5c4113dSnw141292 	if (retcode != IDMAP_ERR_NOTFOUND)
3977c5c4113dSnw141292 		goto out;
3978c5c4113dSnw141292 
3979e8c27ec8Sbaban 	/* Lookup cache */
3980479ac375Sdm199847 	retcode = lookup_cache_pid2sid(state->cache, req, res, is_user,
3981479ac375Sdm199847 	    getname);
3982c5c4113dSnw141292 	if (retcode != IDMAP_ERR_NOTFOUND)
3983c5c4113dSnw141292 		goto out;
3984c5c4113dSnw141292 
3985c5c4113dSnw141292 	/* Ephemeral ids cannot be allocated during pid2sid */
3986c5c4113dSnw141292 	if (IS_EPHEMERAL(req->id1.idmap_id_u.uid)) {
398762c60062Sbaban 		retcode = IDMAP_ERR_NOMAPPING;
3988c5c4113dSnw141292 		goto out;
3989c5c4113dSnw141292 	}
3990c5c4113dSnw141292 
399148258c6bSjp151216 	if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) {
399248258c6bSjp151216 		retcode = IDMAP_ERR_NONEGENERATED;
399348258c6bSjp151216 		goto out;
399448258c6bSjp151216 	}
399548258c6bSjp151216 
399648258c6bSjp151216 	if (AVOID_NAMESERVICE(req)) {
3997e8c27ec8Sbaban 		gen_localsid_on_err = TRUE;
399862c60062Sbaban 		retcode = IDMAP_ERR_NOMAPPING;
3999c5c4113dSnw141292 		goto out;
4000c5c4113dSnw141292 	}
4001c5c4113dSnw141292 
4002e8c27ec8Sbaban 	/* Set flags for the next stage */
4003e8c27ec8Sbaban 	if (AD_MODE(req->id1.idtype, state)) {
4004e8c27ec8Sbaban 		/*
4005e8c27ec8Sbaban 		 * If AD-based name mapping is enabled then the next stage
4006e8c27ec8Sbaban 		 * will need to lookup AD using unixname to get the
4007e8c27ec8Sbaban 		 * corresponding winname.
4008e8c27ec8Sbaban 		 */
4009e8c27ec8Sbaban 		if (req->id1name == NULL) {
4010e8c27ec8Sbaban 			/* Get unixname if only pid is given. */
4011e8c27ec8Sbaban 			retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid,
4012e8c27ec8Sbaban 			    is_user, &req->id1name);
4013479ac375Sdm199847 			if (retcode != IDMAP_SUCCESS) {
4014479ac375Sdm199847 				gen_localsid_on_err = TRUE;
4015e8c27ec8Sbaban 				goto out;
4016c5c4113dSnw141292 			}
4017479ac375Sdm199847 		}
4018e8c27ec8Sbaban 		req->direction |= _IDMAP_F_LOOKUP_AD;
4019e8c27ec8Sbaban 		state->ad_nqueries++;
4020e8c27ec8Sbaban 	} else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) {
4021e8c27ec8Sbaban 		/*
4022e8c27ec8Sbaban 		 * If native LDAP or mixed mode is enabled for name mapping
4023e8c27ec8Sbaban 		 * then the next stage will need to lookup native LDAP using
4024e8c27ec8Sbaban 		 * unixname/pid to get the corresponding winname.
4025e8c27ec8Sbaban 		 */
4026e8c27ec8Sbaban 		req->direction |= _IDMAP_F_LOOKUP_NLDAP;
4027e8c27ec8Sbaban 		state->nldap_nqueries++;
4028c5c4113dSnw141292 	}
4029c5c4113dSnw141292 
4030e8c27ec8Sbaban 	/*
4031e8c27ec8Sbaban 	 * Failed to find non-expired entry in cache. Set the flag to
4032e8c27ec8Sbaban 	 * indicate that we are not done yet.
4033e8c27ec8Sbaban 	 */
4034e8c27ec8Sbaban 	state->pid2sid_done = FALSE;
4035e8c27ec8Sbaban 	req->direction |= _IDMAP_F_NOTDONE;
4036e8c27ec8Sbaban 	retcode = IDMAP_SUCCESS;
4037e8c27ec8Sbaban 
4038e8c27ec8Sbaban out:
4039e8c27ec8Sbaban 	res->retcode = idmap_stat4prot(retcode);
4040e8c27ec8Sbaban 	if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS)
4041e8c27ec8Sbaban 		if (gen_localsid_on_err == TRUE)
404248258c6bSjp151216 			(void) generate_localsid(req, res, is_user, TRUE);
4043e8c27ec8Sbaban 	return (retcode);
4044e8c27ec8Sbaban }
4045e8c27ec8Sbaban 
4046e8c27ec8Sbaban idmap_retcode
4047479ac375Sdm199847 pid2sid_second_pass(lookup_state_t *state, idmap_mapping *req,
4048479ac375Sdm199847 	idmap_id_res *res, int is_user)
4049e8c27ec8Sbaban {
4050e8c27ec8Sbaban 	bool_t		gen_localsid_on_err = TRUE;
4051e8c27ec8Sbaban 	idmap_retcode	retcode = IDMAP_SUCCESS;
4052e8c27ec8Sbaban 
4053e8c27ec8Sbaban 	/* Check if second pass is needed */
4054e8c27ec8Sbaban 	if (ARE_WE_DONE(req->direction))
4055e8c27ec8Sbaban 		return (res->retcode);
4056e8c27ec8Sbaban 
4057e8c27ec8Sbaban 	/* Get status from previous pass */
4058e8c27ec8Sbaban 	retcode = res->retcode;
4059e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS)
4060e8c27ec8Sbaban 		goto out;
4061e8c27ec8Sbaban 
4062e8c27ec8Sbaban 	/*
4063e8c27ec8Sbaban 	 * If directory-based name mapping is enabled then the winname
4064e8c27ec8Sbaban 	 * may already have been retrieved from the AD object (AD-mode)
4065479ac375Sdm199847 	 * or from native LDAP object (nldap-mode or mixed-mode).
4066479ac375Sdm199847 	 * Note that if we have winname but no SID then it's an error
4067479ac375Sdm199847 	 * because this implies that the Native LDAP entry contains
4068479ac375Sdm199847 	 * winname which does not exist and it's better that we return
4069479ac375Sdm199847 	 * an error instead of doing rule-based mapping so that the user
4070479ac375Sdm199847 	 * can detect the issue and take appropriate action.
4071e8c27ec8Sbaban 	 */
4072479ac375Sdm199847 	if (req->id2name != NULL) {
4073479ac375Sdm199847 		/* Return notfound if we've winname but no SID. */
4074479ac375Sdm199847 		if (res->id.idmap_id_u.sid.prefix == NULL) {
4075479ac375Sdm199847 			retcode = IDMAP_ERR_NOTFOUND;
4076479ac375Sdm199847 			goto out;
4077479ac375Sdm199847 		}
4078e8c27ec8Sbaban 		if (AD_MODE(req->id1.idtype, state))
4079e8c27ec8Sbaban 			res->direction = IDMAP_DIRECTION_BI;
4080e8c27ec8Sbaban 		else if (NLDAP_MODE(req->id1.idtype, state))
4081e8c27ec8Sbaban 			res->direction = IDMAP_DIRECTION_BI;
4082e8c27ec8Sbaban 		else if (MIXED_MODE(req->id1.idtype, state))
4083e8c27ec8Sbaban 			res->direction = IDMAP_DIRECTION_W2U;
4084e8c27ec8Sbaban 		goto out;
4085479ac375Sdm199847 	} else if (res->id.idmap_id_u.sid.prefix != NULL) {
4086479ac375Sdm199847 		/*
4087479ac375Sdm199847 		 * We've SID but no winname. This is fine because
4088479ac375Sdm199847 		 * the caller may have only requested SID.
4089479ac375Sdm199847 		 */
4090479ac375Sdm199847 		goto out;
4091e8c27ec8Sbaban 	}
4092e8c27ec8Sbaban 
4093479ac375Sdm199847 	/* Free any mapping info from Directory based mapping */
4094479ac375Sdm199847 	if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN)
4095479ac375Sdm199847 		idmap_info_free(&res->info);
4096479ac375Sdm199847 
4097e8c27ec8Sbaban 	if (req->id1name == NULL) {
4098e8c27ec8Sbaban 		/* Get unixname from name service */
4099e8c27ec8Sbaban 		retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user,
4100e8c27ec8Sbaban 		    &req->id1name);
4101e8c27ec8Sbaban 		if (retcode != IDMAP_SUCCESS)
4102e8c27ec8Sbaban 			goto out;
4103e8c27ec8Sbaban 	} else if (req->id1.idmap_id_u.uid == SENTINEL_PID) {
4104e8c27ec8Sbaban 		/* Get pid from name service */
4105e8c27ec8Sbaban 		retcode = ns_lookup_byname(req->id1name, NULL, &req->id1);
4106e8c27ec8Sbaban 		if (retcode != IDMAP_SUCCESS) {
4107e8c27ec8Sbaban 			gen_localsid_on_err = FALSE;
4108e8c27ec8Sbaban 			goto out;
4109e8c27ec8Sbaban 		}
4110e8c27ec8Sbaban 	}
4111e8c27ec8Sbaban 
4112e8c27ec8Sbaban 	/* Use unixname to evaluate local name-based mapping rules */
4113479ac375Sdm199847 	retcode = name_based_mapping_pid2sid(state, req->id1name, is_user,
4114c5c4113dSnw141292 	    req, res);
4115c5c4113dSnw141292 	if (retcode == IDMAP_ERR_NOTFOUND) {
411648258c6bSjp151216 		retcode = generate_localsid(req, res, is_user, FALSE);
4117e8c27ec8Sbaban 		gen_localsid_on_err = FALSE;
4118e8c27ec8Sbaban 	}
4119c5c4113dSnw141292 
4120c5c4113dSnw141292 out:
4121c5c4113dSnw141292 	res->retcode = idmap_stat4prot(retcode);
4122e8c27ec8Sbaban 	if (res->retcode != IDMAP_SUCCESS) {
4123e8c27ec8Sbaban 		req->direction = _IDMAP_F_DONE;
4124479ac375Sdm199847 		free(req->id2name);
4125479ac375Sdm199847 		req->id2name = NULL;
4126479ac375Sdm199847 		free(req->id2domain);
4127479ac375Sdm199847 		req->id2domain = NULL;
4128e8c27ec8Sbaban 		if (gen_localsid_on_err == TRUE)
412948258c6bSjp151216 			(void) generate_localsid(req, res, is_user, TRUE);
4130479ac375Sdm199847 		else
4131479ac375Sdm199847 			res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID;
4132e8c27ec8Sbaban 	}
4133e8c27ec8Sbaban 	if (!ARE_WE_DONE(req->direction))
4134e8c27ec8Sbaban 		state->pid2sid_done = FALSE;
4135c5c4113dSnw141292 	return (retcode);
4136c5c4113dSnw141292 }
4137c5c4113dSnw141292 
4138cd37da74Snw141292 static
4139cd37da74Snw141292 int
4140651c0131Sbaban copy_mapping_request(idmap_mapping *mapping, idmap_mapping *request)
4141c5c4113dSnw141292 {
4142651c0131Sbaban 	(void) memset(mapping, 0, sizeof (*mapping));
4143651c0131Sbaban 
4144c5c4113dSnw141292 	mapping->flag = request->flag;
4145e8c27ec8Sbaban 	mapping->direction = _IDMAP_F_DONE;
4146651c0131Sbaban 	mapping->id2.idtype = request->id2.idtype;
4147c5c4113dSnw141292 
4148c5c4113dSnw141292 	mapping->id1.idtype = request->id1.idtype;
4149cd37da74Snw141292 	if (IS_REQUEST_SID(*request, 1)) {
4150c5c4113dSnw141292 		mapping->id1.idmap_id_u.sid.rid =
4151c5c4113dSnw141292 		    request->id1.idmap_id_u.sid.rid;
4152651c0131Sbaban 		if (!EMPTY_STRING(request->id1.idmap_id_u.sid.prefix)) {
4153c5c4113dSnw141292 			mapping->id1.idmap_id_u.sid.prefix =
4154c5c4113dSnw141292 			    strdup(request->id1.idmap_id_u.sid.prefix);
4155651c0131Sbaban 			if (mapping->id1.idmap_id_u.sid.prefix == NULL)
41568e228215Sdm199847 				goto errout;
4157651c0131Sbaban 		}
4158c5c4113dSnw141292 	} else {
4159c5c4113dSnw141292 		mapping->id1.idmap_id_u.uid = request->id1.idmap_id_u.uid;
4160c5c4113dSnw141292 	}
4161c5c4113dSnw141292 
4162e8c27ec8Sbaban 	if (!EMPTY_STRING(request->id1domain)) {
41638e228215Sdm199847 		mapping->id1domain = strdup(request->id1domain);
41648e228215Sdm199847 		if (mapping->id1domain == NULL)
41658e228215Sdm199847 			goto errout;
4166e8c27ec8Sbaban 	}
4167c5c4113dSnw141292 
4168e8c27ec8Sbaban 	if (!EMPTY_STRING(request->id1name)) {
41698e228215Sdm199847 		mapping->id1name = strdup(request->id1name);
41708e228215Sdm199847 		if (mapping->id1name == NULL)
41718e228215Sdm199847 			goto errout;
4172e8c27ec8Sbaban 	}
4173c5c4113dSnw141292 
4174651c0131Sbaban 	/* We don't need the rest of the request i.e request->id2 */
4175651c0131Sbaban 	return (0);
4176c5c4113dSnw141292 
4177651c0131Sbaban errout:
41788e228215Sdm199847 	if (mapping->id1.idmap_id_u.sid.prefix != NULL)
4179651c0131Sbaban 		free(mapping->id1.idmap_id_u.sid.prefix);
41808e228215Sdm199847 	if (mapping->id1domain != NULL)
41818e228215Sdm199847 		free(mapping->id1domain);
41828e228215Sdm199847 	if (mapping->id1name != NULL)
41838e228215Sdm199847 		free(mapping->id1name);
4184651c0131Sbaban 
4185651c0131Sbaban 	(void) memset(mapping, 0, sizeof (*mapping));
4186651c0131Sbaban 	return (-1);
4187c5c4113dSnw141292 }
4188c5c4113dSnw141292 
4189c5c4113dSnw141292 
4190c5c4113dSnw141292 idmap_retcode
4191c5c4113dSnw141292 get_w2u_mapping(sqlite *cache, sqlite *db, idmap_mapping *request,
4192cd37da74Snw141292 		idmap_mapping *mapping)
4193cd37da74Snw141292 {
4194c5c4113dSnw141292 	idmap_id_res	idres;
4195c5c4113dSnw141292 	lookup_state_t	state;
4196dd5829d1Sbaban 	char		*cp;
4197c5c4113dSnw141292 	idmap_retcode	retcode;
4198c5c4113dSnw141292 	const char	*winname, *windomain;
4199c5c4113dSnw141292 
4200c5c4113dSnw141292 	(void) memset(&idres, 0, sizeof (idres));
4201c5c4113dSnw141292 	(void) memset(&state, 0, sizeof (state));
4202479ac375Sdm199847 	state.cache = cache;
4203479ac375Sdm199847 	state.db = db;
4204c5c4113dSnw141292 
4205e8c27ec8Sbaban 	/* Get directory-based name mapping info */
4206479ac375Sdm199847 	retcode = load_cfg_in_state(&state);
4207e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS)
4208c5c4113dSnw141292 		goto out;
4209c5c4113dSnw141292 
4210e8c27ec8Sbaban 	/*
4211e8c27ec8Sbaban 	 * Copy data from "request" to "mapping". Note that
4212e8c27ec8Sbaban 	 * empty strings are not copied from "request" to
4213e8c27ec8Sbaban 	 * "mapping" and therefore the coresponding strings in
4214e8c27ec8Sbaban 	 * "mapping" will be NULL. This eliminates having to
4215e8c27ec8Sbaban 	 * check for empty strings henceforth.
4216e8c27ec8Sbaban 	 */
4217651c0131Sbaban 	if (copy_mapping_request(mapping, request) < 0) {
4218651c0131Sbaban 		retcode = IDMAP_ERR_MEMORY;
4219651c0131Sbaban 		goto out;
4220651c0131Sbaban 	}
4221c5c4113dSnw141292 
42228e228215Sdm199847 	winname = mapping->id1name;
42238e228215Sdm199847 	windomain = mapping->id1domain;
4224c5c4113dSnw141292 
4225e8c27ec8Sbaban 	if (winname == NULL && windomain != NULL) {
4226c5c4113dSnw141292 		retcode = IDMAP_ERR_ARG;
4227c5c4113dSnw141292 		goto out;
4228c5c4113dSnw141292 	}
4229c5c4113dSnw141292 
4230e8c27ec8Sbaban 	/* Need atleast winname or sid to proceed */
4231e8c27ec8Sbaban 	if (winname == NULL && mapping->id1.idmap_id_u.sid.prefix == NULL) {
4232e8c27ec8Sbaban 		retcode = IDMAP_ERR_ARG;
4233e8c27ec8Sbaban 		goto out;
4234e8c27ec8Sbaban 	}
4235e8c27ec8Sbaban 
4236e8c27ec8Sbaban 	/*
4237e8c27ec8Sbaban 	 * If domainname is not given but we have a fully qualified
4238e8c27ec8Sbaban 	 * winname then extract the domainname from the winname,
4239e8c27ec8Sbaban 	 * otherwise use the default_domain from the config
4240e8c27ec8Sbaban 	 */
4241e8c27ec8Sbaban 	if (winname != NULL && windomain == NULL) {
42428e228215Sdm199847 		retcode = IDMAP_SUCCESS;
4243dd5829d1Sbaban 		if ((cp = strchr(winname, '@')) != NULL) {
4244dd5829d1Sbaban 			*cp = '\0';
42458e228215Sdm199847 			mapping->id1domain = strdup(cp + 1);
42468e228215Sdm199847 			if (mapping->id1domain == NULL)
42478e228215Sdm199847 				retcode = IDMAP_ERR_MEMORY;
4248e8c27ec8Sbaban 		} else if (lookup_wksids_name2sid(winname, NULL, NULL, NULL,
4249e8c27ec8Sbaban 		    NULL) != IDMAP_SUCCESS) {
425082da9f60Sbaban 			if (state.defdom == NULL) {
425182da9f60Sbaban 				/*
425282da9f60Sbaban 				 * We have a non-qualified winname which is
425382da9f60Sbaban 				 * neither the name of a well-known SID nor
425482da9f60Sbaban 				 * there is a default domain with which we can
425582da9f60Sbaban 				 * qualify it.
425682da9f60Sbaban 				 */
425782da9f60Sbaban 				retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
425882da9f60Sbaban 			} else {
4259479ac375Sdm199847 				mapping->id1domain = strdup(state.defdom);
42608e228215Sdm199847 				if (mapping->id1domain == NULL)
42618e228215Sdm199847 					retcode = IDMAP_ERR_MEMORY;
42628e228215Sdm199847 			}
426382da9f60Sbaban 		}
4264c5c4113dSnw141292 		if (retcode != IDMAP_SUCCESS)
4265c5c4113dSnw141292 			goto out;
4266c5c4113dSnw141292 	}
4267c5c4113dSnw141292 
4268e8c27ec8Sbaban 	/*
4269e8c27ec8Sbaban 	 * First pass looks up the well-known SIDs table and cache
4270e8c27ec8Sbaban 	 * and handles localSIDs
4271e8c27ec8Sbaban 	 */
4272c5c4113dSnw141292 	state.sid2pid_done = TRUE;
4273479ac375Sdm199847 	retcode = sid2pid_first_pass(&state, mapping, &idres);
4274c5c4113dSnw141292 	if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE)
4275c5c4113dSnw141292 		goto out;
4276c5c4113dSnw141292 
4277479ac375Sdm199847 	/* AD lookup */
4278e8c27ec8Sbaban 	if (state.ad_nqueries > 0) {
4279479ac375Sdm199847 		retcode = ad_lookup_one(&state, mapping, &idres);
4280e8c27ec8Sbaban 		if (IDMAP_ERROR(retcode))
4281e8c27ec8Sbaban 			goto out;
4282c5c4113dSnw141292 	}
4283c5c4113dSnw141292 
4284479ac375Sdm199847 	/* nldap lookup */
4285479ac375Sdm199847 	if (state.nldap_nqueries > 0) {
4286479ac375Sdm199847 		retcode = nldap_lookup_one(&state, mapping, &idres);
4287479ac375Sdm199847 		if (IDMAP_FATAL_ERROR(retcode))
4288e8c27ec8Sbaban 			goto out;
428948258c6bSjp151216 	}
4290e8c27ec8Sbaban 
4291e8c27ec8Sbaban 	/* Next pass performs name-based mapping and ephemeral mapping. */
4292c5c4113dSnw141292 	state.sid2pid_done = TRUE;
4293479ac375Sdm199847 	retcode = sid2pid_second_pass(&state, mapping, &idres);
4294c5c4113dSnw141292 	if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE)
4295c5c4113dSnw141292 		goto out;
4296c5c4113dSnw141292 
4297c5c4113dSnw141292 	/* Update cache */
4298479ac375Sdm199847 	(void) update_cache_sid2pid(&state, mapping, &idres);
4299c5c4113dSnw141292 
4300c5c4113dSnw141292 out:
4301e8c27ec8Sbaban 	/*
4302e8c27ec8Sbaban 	 * Note that "mapping" is returned to the client. Therefore
4303e8c27ec8Sbaban 	 * copy whatever we have in "idres" to mapping->id2 and
4304e8c27ec8Sbaban 	 * free idres.
4305e8c27ec8Sbaban 	 */
4306c5c4113dSnw141292 	mapping->direction = idres.direction;
4307c5c4113dSnw141292 	mapping->id2 = idres.id;
430848258c6bSjp151216 	if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO ||
430948258c6bSjp151216 	    retcode != IDMAP_SUCCESS)
431048258c6bSjp151216 		(void) idmap_info_mov(&mapping->info, &idres.info);
431148258c6bSjp151216 	else
431248258c6bSjp151216 		idmap_info_free(&idres.info);
4313c5c4113dSnw141292 	(void) memset(&idres, 0, sizeof (idres));
4314e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS)
431562c60062Sbaban 		mapping->id2.idmap_id_u.uid = UID_NOBODY;
4316c5c4113dSnw141292 	xdr_free(xdr_idmap_id_res, (caddr_t)&idres);
4317e8c27ec8Sbaban 	cleanup_lookup_state(&state);
4318c5c4113dSnw141292 	return (retcode);
4319c5c4113dSnw141292 }
4320c5c4113dSnw141292 
4321c5c4113dSnw141292 idmap_retcode
4322c5c4113dSnw141292 get_u2w_mapping(sqlite *cache, sqlite *db, idmap_mapping *request,
4323cd37da74Snw141292 		idmap_mapping *mapping, int is_user)
4324cd37da74Snw141292 {
4325c5c4113dSnw141292 	idmap_id_res	idres;
4326c5c4113dSnw141292 	lookup_state_t	state;
4327c5c4113dSnw141292 	idmap_retcode	retcode;
4328c5c4113dSnw141292 
4329c5c4113dSnw141292 	/*
4330c5c4113dSnw141292 	 * In order to re-use the pid2sid code, we convert
4331c5c4113dSnw141292 	 * our input data into structs that are expected by
4332c5c4113dSnw141292 	 * pid2sid_first_pass.
4333c5c4113dSnw141292 	 */
4334c5c4113dSnw141292 
4335c5c4113dSnw141292 	(void) memset(&idres, 0, sizeof (idres));
4336c5c4113dSnw141292 	(void) memset(&state, 0, sizeof (state));
4337479ac375Sdm199847 	state.cache = cache;
4338479ac375Sdm199847 	state.db = db;
4339c5c4113dSnw141292 
4340e8c27ec8Sbaban 	/* Get directory-based name mapping info */
4341479ac375Sdm199847 	retcode = load_cfg_in_state(&state);
4342e8c27ec8Sbaban 	if (retcode != IDMAP_SUCCESS)
4343e8c27ec8Sbaban 		goto out;
4344e8c27ec8Sbaban 
4345e8c27ec8Sbaban 	/*
4346e8c27ec8Sbaban 	 * Copy data from "request" to "mapping". Note that
4347e8c27ec8Sbaban 	 * empty strings are not copied from "request" to
4348e8c27ec8Sbaban 	 * "mapping" and therefore the coresponding strings in
4349e8c27ec8Sbaban 	 * "mapping" will be NULL. This eliminates having to
4350e8c27ec8Sbaban 	 * check for empty strings henceforth.
4351e8c27ec8Sbaban 	 */
4352651c0131Sbaban 	if (copy_mapping_request(mapping, request) < 0) {
4353651c0131Sbaban 		retcode = IDMAP_ERR_MEMORY;
4354651c0131Sbaban 		goto out;
4355651c0131Sbaban 	}
4356c5c4113dSnw141292 
4357e8c27ec8Sbaban 	/*
4358e8c27ec8Sbaban 	 * For unix to windows mapping request, we need atleast a
4359e8c27ec8Sbaban 	 * unixname or uid/gid to proceed
4360e8c27ec8Sbaban 	 */
4361e8c27ec8Sbaban 	if (mapping->id1name == NULL &&
4362cf5b5989Sdm199847 	    mapping->id1.idmap_id_u.uid == SENTINEL_PID) {
4363c5c4113dSnw141292 		retcode = IDMAP_ERR_ARG;
4364c5c4113dSnw141292 		goto out;
4365c5c4113dSnw141292 	}
4366c5c4113dSnw141292 
4367e8c27ec8Sbaban 	/* First pass looks up cache and well-known SIDs */
4368e8c27ec8Sbaban 	state.pid2sid_done = TRUE;
4369479ac375Sdm199847 	retcode = pid2sid_first_pass(&state, mapping, &idres, is_user, 1);
4370e8c27ec8Sbaban 	if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE)
4371c5c4113dSnw141292 		goto out;
4372e8c27ec8Sbaban 
4373479ac375Sdm199847 	/* nldap lookup */
4374e8c27ec8Sbaban 	if (state.nldap_nqueries > 0) {
4375479ac375Sdm199847 		retcode = nldap_lookup_one(&state, mapping, &idres);
4376e8c27ec8Sbaban 		if (IDMAP_FATAL_ERROR(retcode))
4377c5c4113dSnw141292 			goto out;
4378479ac375Sdm199847 	}
4379e8c27ec8Sbaban 
4380479ac375Sdm199847 	/* AD lookup */
4381479ac375Sdm199847 	if (state.ad_nqueries > 0) {
4382479ac375Sdm199847 		retcode = ad_lookup_one(&state, mapping, &idres);
4383e8c27ec8Sbaban 		if (IDMAP_FATAL_ERROR(retcode))
4384e8c27ec8Sbaban 			goto out;
4385c5c4113dSnw141292 	}
4386c5c4113dSnw141292 
4387e8c27ec8Sbaban 	/*
4388e8c27ec8Sbaban 	 * Next pass processes the result of the preceding passes/lookups.
4389e8c27ec8Sbaban 	 * It returns if there's nothing more to be done otherwise it
4390e8c27ec8Sbaban 	 * evaluates local name-based mapping rules
4391e8c27ec8Sbaban 	 */
4392c5c4113dSnw141292 	state.pid2sid_done = TRUE;
4393479ac375Sdm199847 	retcode = pid2sid_second_pass(&state, mapping, &idres, is_user);
4394c5c4113dSnw141292 	if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE)
4395c5c4113dSnw141292 		goto out;
4396c5c4113dSnw141292 
4397c5c4113dSnw141292 	/* Update cache */
4398479ac375Sdm199847 	(void) update_cache_pid2sid(&state, mapping, &idres);
4399c5c4113dSnw141292 
4400c5c4113dSnw141292 out:
4401e8c27ec8Sbaban 	/*
4402e8c27ec8Sbaban 	 * Note that "mapping" is returned to the client. Therefore
4403e8c27ec8Sbaban 	 * copy whatever we have in "idres" to mapping->id2 and
4404e8c27ec8Sbaban 	 * free idres.
4405e8c27ec8Sbaban 	 */
4406c5c4113dSnw141292 	mapping->direction = idres.direction;
4407c5c4113dSnw141292 	mapping->id2 = idres.id;
440848258c6bSjp151216 	if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO ||
440948258c6bSjp151216 	    retcode != IDMAP_SUCCESS)
441048258c6bSjp151216 		(void) idmap_info_mov(&mapping->info, &idres.info);
441148258c6bSjp151216 	else
441248258c6bSjp151216 		idmap_info_free(&idres.info);
4413c5c4113dSnw141292 	(void) memset(&idres, 0, sizeof (idres));
4414c5c4113dSnw141292 	xdr_free(xdr_idmap_id_res, (caddr_t)&idres);
4415e8c27ec8Sbaban 	cleanup_lookup_state(&state);
4416e8c27ec8Sbaban 	return (retcode);
4417e8c27ec8Sbaban }
4418e8c27ec8Sbaban 
4419479ac375Sdm199847 /*ARGSUSED*/
4420e8c27ec8Sbaban static
4421e8c27ec8Sbaban idmap_retcode
4422479ac375Sdm199847 ad_lookup_one(lookup_state_t *state, idmap_mapping *req, idmap_id_res *res)
4423e8c27ec8Sbaban {
4424479ac375Sdm199847 	idmap_mapping_batch	batch;
4425479ac375Sdm199847 	idmap_ids_res		result;
4426e8c27ec8Sbaban 
4427479ac375Sdm199847 	batch.idmap_mapping_batch_len = 1;
4428479ac375Sdm199847 	batch.idmap_mapping_batch_val = req;
4429479ac375Sdm199847 	result.ids.ids_len = 1;
4430479ac375Sdm199847 	result.ids.ids_val = res;
4431479ac375Sdm199847 	return (ad_lookup_batch(state, &batch, &result));
4432c5c4113dSnw141292 }
4433