1c5c4113dSnw141292 /* 2c5c4113dSnw141292 * CDDL HEADER START 3c5c4113dSnw141292 * 4c5c4113dSnw141292 * The contents of this file are subject to the terms of the 5c5c4113dSnw141292 * Common Development and Distribution License (the "License"). 6c5c4113dSnw141292 * You may not use this file except in compliance with the License. 7c5c4113dSnw141292 * 8c5c4113dSnw141292 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw141292 * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw141292 * See the License for the specific language governing permissions 11c5c4113dSnw141292 * and limitations under the License. 12c5c4113dSnw141292 * 13c5c4113dSnw141292 * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw141292 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw141292 * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw141292 * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw141292 * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw141292 * 19c5c4113dSnw141292 * CDDL HEADER END 20c5c4113dSnw141292 */ 21c5c4113dSnw141292 /* 22042addd6Sbaban * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23c5c4113dSnw141292 * Use is subject to license terms. 24c5c4113dSnw141292 */ 25c5c4113dSnw141292 26c5c4113dSnw141292 /* 27c5c4113dSnw141292 * Database related utility routines 28c5c4113dSnw141292 */ 29c5c4113dSnw141292 30c5c4113dSnw141292 #include <stdio.h> 31c5c4113dSnw141292 #include <stdlib.h> 32c5c4113dSnw141292 #include <string.h> 33c5c4113dSnw141292 #include <errno.h> 34c5c4113dSnw141292 #include <sys/types.h> 35c5c4113dSnw141292 #include <sys/stat.h> 36c5c4113dSnw141292 #include <rpc/rpc.h> 37c5c4113dSnw141292 #include <sys/sid.h> 38c5c4113dSnw141292 #include <time.h> 39c5c4113dSnw141292 #include <pwd.h> 40c5c4113dSnw141292 #include <grp.h> 4184decf41Sjp151216 #include <pthread.h> 4284decf41Sjp151216 #include <assert.h> 43cd37da74Snw141292 #include <sys/u8_textprep.h> 44c5c4113dSnw141292 45c5c4113dSnw141292 #include "idmapd.h" 46c5c4113dSnw141292 #include "adutils.h" 47c5c4113dSnw141292 #include "string.h" 48c5c4113dSnw141292 #include "idmap_priv.h" 49cd37da74Snw141292 #include "schema.h" 50e8c27ec8Sbaban #include "nldaputils.h" 51c5c4113dSnw141292 5284decf41Sjp151216 53c5c4113dSnw141292 static idmap_retcode sql_compile_n_step_once(sqlite *, char *, 54c5c4113dSnw141292 sqlite_vm **, int *, int, const char ***); 55479ac375Sdm199847 static idmap_retcode ad_lookup_one(lookup_state_t *, idmap_mapping *, 56479ac375Sdm199847 idmap_id_res *); 57e8c27ec8Sbaban static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *); 58e8c27ec8Sbaban static idmap_retcode lookup_cache_name2sid(sqlite *, const char *, 59e8c27ec8Sbaban const char *, char **, char **, idmap_rid_t *, int *); 60e8c27ec8Sbaban 61c5c4113dSnw141292 62c5c4113dSnw141292 #define EMPTY_NAME(name) (*name == 0 || strcmp(name, "\"\"") == 0) 63c5c4113dSnw141292 64c5c4113dSnw141292 #define DO_NOT_ALLOC_NEW_ID_MAPPING(req)\ 65c5c4113dSnw141292 (req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC) 66c5c4113dSnw141292 67c5c4113dSnw141292 #define AVOID_NAMESERVICE(req)\ 68c5c4113dSnw141292 (req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE) 69c5c4113dSnw141292 70*2b4a7802SBaban Kenkre #define ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)\ 71*2b4a7802SBaban Kenkre (req->flag & IDMAP_REQ_FLG_WK_OR_LOCAL_SIDS_ONLY) 72*2b4a7802SBaban Kenkre 73e8c27ec8Sbaban #define IS_EPHEMERAL(pid) (pid > INT32_MAX && pid != SENTINEL_PID) 74c5c4113dSnw141292 75c5c4113dSnw141292 #define LOCALRID_MIN 1000 76c5c4113dSnw141292 77c5c4113dSnw141292 78c5c4113dSnw141292 typedef enum init_db_option { 79c5c4113dSnw141292 FAIL_IF_CORRUPT = 0, 80c5c4113dSnw141292 REMOVE_IF_CORRUPT = 1 81c5c4113dSnw141292 } init_db_option_t; 82c5c4113dSnw141292 8384decf41Sjp151216 /* 84e8c27ec8Sbaban * Data structure to store well-known SIDs and 85e8c27ec8Sbaban * associated mappings (if any) 86e8c27ec8Sbaban */ 87e8c27ec8Sbaban typedef struct wksids_table { 88e8c27ec8Sbaban const char *sidprefix; 89e8c27ec8Sbaban uint32_t rid; 90e8c27ec8Sbaban const char *winname; 91e8c27ec8Sbaban int is_wuser; 92e8c27ec8Sbaban uid_t pid; 93e8c27ec8Sbaban int is_user; 94e8c27ec8Sbaban int direction; 95e8c27ec8Sbaban } wksids_table_t; 96e8c27ec8Sbaban 97e8c27ec8Sbaban /* 9884decf41Sjp151216 * Thread specfic data to hold the database handles so that the 9984decf41Sjp151216 * databaes are not opened and closed for every request. It also 10084decf41Sjp151216 * contains the sqlite busy handler structure. 10184decf41Sjp151216 */ 10284decf41Sjp151216 10384decf41Sjp151216 struct idmap_busy { 10484decf41Sjp151216 const char *name; 10584decf41Sjp151216 const int *delays; 10684decf41Sjp151216 int delay_size; 10784decf41Sjp151216 int total; 10884decf41Sjp151216 int sec; 10984decf41Sjp151216 }; 11084decf41Sjp151216 11184decf41Sjp151216 11284decf41Sjp151216 typedef struct idmap_tsd { 11384decf41Sjp151216 sqlite *db_db; 11484decf41Sjp151216 sqlite *cache_db; 11584decf41Sjp151216 struct idmap_busy cache_busy; 11684decf41Sjp151216 struct idmap_busy db_busy; 11784decf41Sjp151216 } idmap_tsd_t; 11884decf41Sjp151216 11984decf41Sjp151216 12084decf41Sjp151216 12184decf41Sjp151216 static const int cache_delay_table[] = 12284decf41Sjp151216 { 1, 2, 5, 10, 15, 20, 25, 30, 35, 40, 12384decf41Sjp151216 50, 50, 60, 70, 80, 90, 100}; 12484decf41Sjp151216 12584decf41Sjp151216 static const int db_delay_table[] = 12684decf41Sjp151216 { 5, 10, 15, 20, 30, 40, 55, 70, 100}; 12784decf41Sjp151216 12884decf41Sjp151216 12984decf41Sjp151216 static pthread_key_t idmap_tsd_key; 13084decf41Sjp151216 13184decf41Sjp151216 void 13284decf41Sjp151216 idmap_tsd_destroy(void *key) 13384decf41Sjp151216 { 13484decf41Sjp151216 13584decf41Sjp151216 idmap_tsd_t *tsd = (idmap_tsd_t *)key; 13684decf41Sjp151216 if (tsd) { 13784decf41Sjp151216 if (tsd->db_db) 13884decf41Sjp151216 (void) sqlite_close(tsd->db_db); 13984decf41Sjp151216 if (tsd->cache_db) 14084decf41Sjp151216 (void) sqlite_close(tsd->cache_db); 14184decf41Sjp151216 free(tsd); 14284decf41Sjp151216 } 14384decf41Sjp151216 } 14484decf41Sjp151216 14584decf41Sjp151216 int 146cd37da74Snw141292 idmap_init_tsd_key(void) 147cd37da74Snw141292 { 14884decf41Sjp151216 return (pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy)); 14984decf41Sjp151216 } 15084decf41Sjp151216 15184decf41Sjp151216 15284decf41Sjp151216 15384decf41Sjp151216 idmap_tsd_t * 15484decf41Sjp151216 idmap_get_tsd(void) 15584decf41Sjp151216 { 15684decf41Sjp151216 idmap_tsd_t *tsd; 15784decf41Sjp151216 15884decf41Sjp151216 if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) { 15984decf41Sjp151216 /* No thread specific data so create it */ 16084decf41Sjp151216 if ((tsd = malloc(sizeof (*tsd))) != NULL) { 16184decf41Sjp151216 /* Initialize thread specific data */ 16284decf41Sjp151216 (void) memset(tsd, 0, sizeof (*tsd)); 16384decf41Sjp151216 /* save the trhread specific data */ 16484decf41Sjp151216 if (pthread_setspecific(idmap_tsd_key, tsd) != 0) { 16584decf41Sjp151216 /* Can't store key */ 16684decf41Sjp151216 free(tsd); 16784decf41Sjp151216 tsd = NULL; 16884decf41Sjp151216 } 16984decf41Sjp151216 } else { 17084decf41Sjp151216 tsd = NULL; 17184decf41Sjp151216 } 17284decf41Sjp151216 } 17384decf41Sjp151216 17484decf41Sjp151216 return (tsd); 17584decf41Sjp151216 } 17684decf41Sjp151216 177cd37da74Snw141292 /* 178cd37da74Snw141292 * A simple wrapper around u8_textprep_str() that returns the Unicode 179cd37da74Snw141292 * lower-case version of some string. The result must be freed. 180cd37da74Snw141292 */ 181cd37da74Snw141292 char * 182cd37da74Snw141292 tolower_u8(const char *s) 183cd37da74Snw141292 { 184cd37da74Snw141292 char *res = NULL; 185cd37da74Snw141292 char *outs; 186cd37da74Snw141292 size_t inlen, outlen, inbytesleft, outbytesleft; 187cd37da74Snw141292 int rc, err; 188cd37da74Snw141292 189cd37da74Snw141292 /* 190cd37da74Snw141292 * u8_textprep_str() does not allocate memory. The input and 191cd37da74Snw141292 * output buffers may differ in size (though that would be more 192cd37da74Snw141292 * likely when normalization is done). We have to loop over it... 193cd37da74Snw141292 * 194cd37da74Snw141292 * To improve the chances that we can avoid looping we add 10 195cd37da74Snw141292 * bytes of output buffer room the first go around. 196cd37da74Snw141292 */ 197cd37da74Snw141292 inlen = inbytesleft = strlen(s); 198cd37da74Snw141292 outlen = outbytesleft = inlen + 10; 199cd37da74Snw141292 if ((res = malloc(outlen)) == NULL) 200cd37da74Snw141292 return (NULL); 201cd37da74Snw141292 outs = res; 202cd37da74Snw141292 203cd37da74Snw141292 while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs, 204cd37da74Snw141292 &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 && 205cd37da74Snw141292 err == E2BIG) { 206cd37da74Snw141292 if ((res = realloc(res, outlen + inbytesleft)) == NULL) 207cd37da74Snw141292 return (NULL); 208cd37da74Snw141292 /* adjust input/output buffer pointers */ 209cd37da74Snw141292 s += (inlen - inbytesleft); 210cd37da74Snw141292 outs = res + outlen - outbytesleft; 211cd37da74Snw141292 /* adjust outbytesleft and outlen */ 212cd37da74Snw141292 outlen += inbytesleft; 213cd37da74Snw141292 outbytesleft += inbytesleft; 214cd37da74Snw141292 } 215cd37da74Snw141292 216cd37da74Snw141292 if (rc < 0) { 217cd37da74Snw141292 free(res); 218cd37da74Snw141292 res = NULL; 219cd37da74Snw141292 return (NULL); 220cd37da74Snw141292 } 221cd37da74Snw141292 222cd37da74Snw141292 res[outlen - outbytesleft] = '\0'; 223cd37da74Snw141292 224cd37da74Snw141292 return (res); 225cd37da74Snw141292 } 226cd37da74Snw141292 227cd37da74Snw141292 static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 228cd37da74Snw141292 const char *while_doing); 229cd37da74Snw141292 230c5c4113dSnw141292 231c5c4113dSnw141292 /* 232c5c4113dSnw141292 * Initialize 'dbname' using 'sql' 233c5c4113dSnw141292 */ 234cd37da74Snw141292 static 235cd37da74Snw141292 int 236cd37da74Snw141292 init_db_instance(const char *dbname, int version, 237cd37da74Snw141292 const char *detect_version_sql, char * const *sql, 238cd37da74Snw141292 init_db_option_t opt, int *created, int *upgraded) 239c5c4113dSnw141292 { 240cd37da74Snw141292 int rc, curr_version; 241cd37da74Snw141292 int tries = 1; 242cd37da74Snw141292 int prio = LOG_NOTICE; 243c5c4113dSnw141292 sqlite *db = NULL; 244cd37da74Snw141292 char *errmsg = NULL; 245c5c4113dSnw141292 246cd37da74Snw141292 *created = 0; 247cd37da74Snw141292 *upgraded = 0; 248c5c4113dSnw141292 249cd37da74Snw141292 if (opt == REMOVE_IF_CORRUPT) 250cd37da74Snw141292 tries = 3; 251cd37da74Snw141292 252cd37da74Snw141292 rinse_repeat: 253cd37da74Snw141292 if (tries == 0) { 254cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname); 255c5c4113dSnw141292 return (-1); 256cd37da74Snw141292 } 257cd37da74Snw141292 if (tries-- == 1) 258cd37da74Snw141292 /* Last try, log errors */ 259cd37da74Snw141292 prio = LOG_ERR; 260c5c4113dSnw141292 261cd37da74Snw141292 db = sqlite_open(dbname, 0600, &errmsg); 262cd37da74Snw141292 if (db == NULL) { 263cd37da74Snw141292 idmapdlog(prio, "Error creating database %s (%s)", 264cd37da74Snw141292 dbname, CHECK_NULL(errmsg)); 265cd37da74Snw141292 sqlite_freemem(errmsg); 266cd37da74Snw141292 if (opt == REMOVE_IF_CORRUPT) 267c5c4113dSnw141292 (void) unlink(dbname); 268cd37da74Snw141292 goto rinse_repeat; 269c5c4113dSnw141292 } 270c5c4113dSnw141292 271c5c4113dSnw141292 sqlite_busy_timeout(db, 3000); 272cd37da74Snw141292 273cd37da74Snw141292 /* Detect current version of schema in the db, if any */ 274cd37da74Snw141292 curr_version = 0; 275cd37da74Snw141292 if (detect_version_sql != NULL) { 276cd37da74Snw141292 char *end, **results; 277cd37da74Snw141292 int nrow; 278cd37da74Snw141292 279cd37da74Snw141292 #ifdef IDMAPD_DEBUG 280cd37da74Snw141292 (void) fprintf(stderr, "Schema version detection SQL: %s\n", 281cd37da74Snw141292 detect_version_sql); 282cd37da74Snw141292 #endif /* IDMAPD_DEBUG */ 283cd37da74Snw141292 rc = sqlite_get_table(db, detect_version_sql, &results, 284cd37da74Snw141292 &nrow, NULL, &errmsg); 285cd37da74Snw141292 if (rc != SQLITE_OK) { 286cd37da74Snw141292 idmapdlog(prio, 287cd37da74Snw141292 "Error detecting schema version of db %s (%s)", 288cd37da74Snw141292 dbname, errmsg); 289cd37da74Snw141292 sqlite_freemem(errmsg); 290cd37da74Snw141292 sqlite_free_table(results); 291c5c4113dSnw141292 sqlite_close(db); 292cd37da74Snw141292 return (-1); 293cd37da74Snw141292 } 294cd37da74Snw141292 if (nrow != 1) { 295cd37da74Snw141292 idmapdlog(prio, 296cd37da74Snw141292 "Error detecting schema version of db %s", dbname); 297cd37da74Snw141292 sqlite_close(db); 298cd37da74Snw141292 sqlite_free_table(results); 299cd37da74Snw141292 return (-1); 300cd37da74Snw141292 } 301cd37da74Snw141292 curr_version = strtol(results[1], &end, 10); 302cd37da74Snw141292 sqlite_free_table(results); 303c5c4113dSnw141292 } 304c5c4113dSnw141292 305cd37da74Snw141292 if (curr_version < 0) { 306cd37da74Snw141292 if (opt == REMOVE_IF_CORRUPT) 307cd37da74Snw141292 (void) unlink(dbname); 308cd37da74Snw141292 goto rinse_repeat; 309c5c4113dSnw141292 } 310c5c4113dSnw141292 311cd37da74Snw141292 if (curr_version == version) 312cd37da74Snw141292 goto done; 313cd37da74Snw141292 314cd37da74Snw141292 /* Install or upgrade schema */ 315cd37da74Snw141292 #ifdef IDMAPD_DEBUG 316cd37da74Snw141292 (void) fprintf(stderr, "Schema init/upgrade SQL: %s\n", 317cd37da74Snw141292 sql[curr_version]); 318cd37da74Snw141292 #endif /* IDMAPD_DEBUG */ 319cd37da74Snw141292 rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname, 320cd37da74Snw141292 (curr_version == 0) ? "installing schema" : "upgrading schema"); 321cd37da74Snw141292 if (rc != 0) { 322cd37da74Snw141292 idmapdlog(prio, "Error %s schema for db %s", dbname, 323cd37da74Snw141292 (curr_version == 0) ? "installing schema" : 324cd37da74Snw141292 "upgrading schema"); 325cd37da74Snw141292 if (opt == REMOVE_IF_CORRUPT) 326cd37da74Snw141292 (void) unlink(dbname); 327cd37da74Snw141292 goto rinse_repeat; 328c5c4113dSnw141292 } 329c5c4113dSnw141292 330cd37da74Snw141292 *upgraded = (curr_version > 0); 331cd37da74Snw141292 *created = (curr_version == 0); 332cd37da74Snw141292 333cd37da74Snw141292 done: 334c5c4113dSnw141292 (void) sqlite_close(db); 335cd37da74Snw141292 return (0); 336c5c4113dSnw141292 } 337c5c4113dSnw141292 33884decf41Sjp151216 33984decf41Sjp151216 /* 34084decf41Sjp151216 * This is the SQLite database busy handler that retries the SQL 34184decf41Sjp151216 * operation until it is successful. 34284decf41Sjp151216 */ 34384decf41Sjp151216 int 34484decf41Sjp151216 /* LINTED E_FUNC_ARG_UNUSED */ 34584decf41Sjp151216 idmap_sqlite_busy_handler(void *arg, const char *table_name, int count) 34684decf41Sjp151216 { 34784decf41Sjp151216 struct idmap_busy *busy = arg; 34884decf41Sjp151216 int delay; 34984decf41Sjp151216 struct timespec rqtp; 35084decf41Sjp151216 35184decf41Sjp151216 if (count == 1) { 35284decf41Sjp151216 busy->total = 0; 35384decf41Sjp151216 busy->sec = 2; 35484decf41Sjp151216 } 35584decf41Sjp151216 if (busy->total > 1000 * busy->sec) { 3562b3ecdebSjp151216 idmapdlog(LOG_DEBUG, 35784decf41Sjp151216 "Thread %d waited %d sec for the %s database", 35884decf41Sjp151216 pthread_self(), busy->sec, busy->name); 35984decf41Sjp151216 busy->sec++; 36084decf41Sjp151216 } 36184decf41Sjp151216 36284decf41Sjp151216 if (count <= busy->delay_size) { 36384decf41Sjp151216 delay = busy->delays[count-1]; 36484decf41Sjp151216 } else { 36584decf41Sjp151216 delay = busy->delays[busy->delay_size - 1]; 36684decf41Sjp151216 } 36784decf41Sjp151216 busy->total += delay; 36884decf41Sjp151216 rqtp.tv_sec = 0; 36984decf41Sjp151216 rqtp.tv_nsec = delay * (NANOSEC / MILLISEC); 37084decf41Sjp151216 (void) nanosleep(&rqtp, NULL); 37184decf41Sjp151216 return (1); 37284decf41Sjp151216 } 37384decf41Sjp151216 37484decf41Sjp151216 375c5c4113dSnw141292 /* 376c5c4113dSnw141292 * Get the database handle 377c5c4113dSnw141292 */ 378c5c4113dSnw141292 idmap_retcode 379cd37da74Snw141292 get_db_handle(sqlite **db) 380cd37da74Snw141292 { 381c5c4113dSnw141292 char *errmsg; 38284decf41Sjp151216 idmap_tsd_t *tsd; 383c5c4113dSnw141292 384c5c4113dSnw141292 /* 38584decf41Sjp151216 * Retrieve the db handle from thread-specific storage 386c5c4113dSnw141292 * If none exists, open and store in thread-specific storage. 387c5c4113dSnw141292 */ 38884decf41Sjp151216 if ((tsd = idmap_get_tsd()) == NULL) { 38984decf41Sjp151216 idmapdlog(LOG_ERR, 390cd37da74Snw141292 "Error getting thread specific data for %s", IDMAP_DBNAME); 39184decf41Sjp151216 return (IDMAP_ERR_MEMORY); 39284decf41Sjp151216 } 393c5c4113dSnw141292 39484decf41Sjp151216 if (tsd->db_db == NULL) { 39584decf41Sjp151216 tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg); 39684decf41Sjp151216 if (tsd->db_db == NULL) { 397cd37da74Snw141292 idmapdlog(LOG_ERR, "Error opening database %s (%s)", 398c5c4113dSnw141292 IDMAP_DBNAME, CHECK_NULL(errmsg)); 399c5c4113dSnw141292 sqlite_freemem(errmsg); 400cd37da74Snw141292 return (IDMAP_ERR_DB); 401c5c4113dSnw141292 } 402cd37da74Snw141292 40384decf41Sjp151216 tsd->db_busy.name = IDMAP_DBNAME; 40484decf41Sjp151216 tsd->db_busy.delays = db_delay_table; 40584decf41Sjp151216 tsd->db_busy.delay_size = sizeof (db_delay_table) / 40684decf41Sjp151216 sizeof (int); 40784decf41Sjp151216 sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler, 40884decf41Sjp151216 &tsd->db_busy); 40984decf41Sjp151216 } 41084decf41Sjp151216 *db = tsd->db_db; 411c5c4113dSnw141292 return (IDMAP_SUCCESS); 412c5c4113dSnw141292 } 413c5c4113dSnw141292 414c5c4113dSnw141292 /* 415c5c4113dSnw141292 * Get the cache handle 416c5c4113dSnw141292 */ 417c5c4113dSnw141292 idmap_retcode 418cd37da74Snw141292 get_cache_handle(sqlite **cache) 419cd37da74Snw141292 { 420c5c4113dSnw141292 char *errmsg; 42184decf41Sjp151216 idmap_tsd_t *tsd; 422c5c4113dSnw141292 423c5c4113dSnw141292 /* 42484decf41Sjp151216 * Retrieve the db handle from thread-specific storage 425c5c4113dSnw141292 * If none exists, open and store in thread-specific storage. 426c5c4113dSnw141292 */ 42784decf41Sjp151216 if ((tsd = idmap_get_tsd()) == NULL) { 428cd37da74Snw141292 idmapdlog(LOG_ERR, "Error getting thread specific data for %s", 42984decf41Sjp151216 IDMAP_DBNAME); 43084decf41Sjp151216 return (IDMAP_ERR_MEMORY); 43184decf41Sjp151216 } 432c5c4113dSnw141292 43384decf41Sjp151216 if (tsd->cache_db == NULL) { 43484decf41Sjp151216 tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg); 43584decf41Sjp151216 if (tsd->cache_db == NULL) { 436cd37da74Snw141292 idmapdlog(LOG_ERR, "Error opening database %s (%s)", 437c5c4113dSnw141292 IDMAP_CACHENAME, CHECK_NULL(errmsg)); 438c5c4113dSnw141292 sqlite_freemem(errmsg); 439cd37da74Snw141292 return (IDMAP_ERR_DB); 440c5c4113dSnw141292 } 441cd37da74Snw141292 44284decf41Sjp151216 tsd->cache_busy.name = IDMAP_CACHENAME; 44384decf41Sjp151216 tsd->cache_busy.delays = cache_delay_table; 44484decf41Sjp151216 tsd->cache_busy.delay_size = sizeof (cache_delay_table) / 44584decf41Sjp151216 sizeof (int); 44684decf41Sjp151216 sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler, 44784decf41Sjp151216 &tsd->cache_busy); 44884decf41Sjp151216 } 44984decf41Sjp151216 *cache = tsd->cache_db; 450c5c4113dSnw141292 return (IDMAP_SUCCESS); 451c5c4113dSnw141292 } 452c5c4113dSnw141292 453c5c4113dSnw141292 /* 454c5c4113dSnw141292 * Initialize cache and db 455c5c4113dSnw141292 */ 456c5c4113dSnw141292 int 457cd37da74Snw141292 init_dbs() 458cd37da74Snw141292 { 45948258c6bSjp151216 char *sql[4]; 460cd37da74Snw141292 int created, upgraded; 461cd37da74Snw141292 462c5c4113dSnw141292 /* name-based mappings; probably OK to blow away in a pinch(?) */ 463cd37da74Snw141292 sql[0] = DB_INSTALL_SQL; 464cd37da74Snw141292 sql[1] = DB_UPGRADE_FROM_v1_SQL; 46548258c6bSjp151216 sql[2] = NULL; 466cd37da74Snw141292 467cd37da74Snw141292 if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql, 468cd37da74Snw141292 FAIL_IF_CORRUPT, &created, &upgraded) < 0) 469c5c4113dSnw141292 return (-1); 470c5c4113dSnw141292 471c5c4113dSnw141292 /* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */ 472cd37da74Snw141292 sql[0] = CACHE_INSTALL_SQL; 473cd37da74Snw141292 sql[1] = CACHE_UPGRADE_FROM_v1_SQL; 47448258c6bSjp151216 sql[2] = CACHE_UPGRADE_FROM_v2_SQL; 47548258c6bSjp151216 sql[3] = NULL; 47648258c6bSjp151216 477cd37da74Snw141292 if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL, 478cd37da74Snw141292 sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0) 479c5c4113dSnw141292 return (-1); 480c5c4113dSnw141292 481cd37da74Snw141292 _idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0; 482cd37da74Snw141292 483c5c4113dSnw141292 return (0); 484c5c4113dSnw141292 } 485c5c4113dSnw141292 486c5c4113dSnw141292 /* 487c5c4113dSnw141292 * Finalize databases 488c5c4113dSnw141292 */ 489c5c4113dSnw141292 void 490cd37da74Snw141292 fini_dbs() 491cd37da74Snw141292 { 492c5c4113dSnw141292 } 493c5c4113dSnw141292 494c5c4113dSnw141292 /* 495e8c27ec8Sbaban * This table is a listing of status codes that will be returned to the 496c5c4113dSnw141292 * client when a SQL command fails with the corresponding error message. 497c5c4113dSnw141292 */ 498c5c4113dSnw141292 static msg_table_t sqlmsgtable[] = { 49962c60062Sbaban {IDMAP_ERR_U2W_NAMERULE_CONFLICT, 500c5c4113dSnw141292 "columns unixname, is_user, u2w_order are not unique"}, 50162c60062Sbaban {IDMAP_ERR_W2U_NAMERULE_CONFLICT, 502cd37da74Snw141292 "columns winname, windomain, is_user, is_wuser, w2u_order are not" 503cd37da74Snw141292 " unique"}, 504cd37da74Snw141292 {IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"}, 505c5c4113dSnw141292 {-1, NULL} 506c5c4113dSnw141292 }; 507c5c4113dSnw141292 508c5c4113dSnw141292 /* 509c5c4113dSnw141292 * idmapd's version of string2stat to map SQLite messages to 510c5c4113dSnw141292 * status codes 511c5c4113dSnw141292 */ 512c5c4113dSnw141292 idmap_retcode 513cd37da74Snw141292 idmapd_string2stat(const char *msg) 514cd37da74Snw141292 { 515c5c4113dSnw141292 int i; 516c5c4113dSnw141292 for (i = 0; sqlmsgtable[i].msg; i++) { 517c5c4113dSnw141292 if (strcasecmp(sqlmsgtable[i].msg, msg) == 0) 518c5c4113dSnw141292 return (sqlmsgtable[i].retcode); 519c5c4113dSnw141292 } 520c5c4113dSnw141292 return (IDMAP_ERR_OTHER); 521c5c4113dSnw141292 } 522c5c4113dSnw141292 523c5c4113dSnw141292 /* 524cd37da74Snw141292 * Executes some SQL in a transaction. 525cd37da74Snw141292 * 526cd37da74Snw141292 * Returns 0 on success, -1 if it failed but the rollback succeeded, -2 527cd37da74Snw141292 * if the rollback failed. 528cd37da74Snw141292 */ 529cd37da74Snw141292 static 530cd37da74Snw141292 int 531cd37da74Snw141292 sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 532cd37da74Snw141292 const char *while_doing) 533cd37da74Snw141292 { 534cd37da74Snw141292 char *errmsg = NULL; 535cd37da74Snw141292 int rc; 536cd37da74Snw141292 537cd37da74Snw141292 rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg); 538cd37da74Snw141292 if (rc != SQLITE_OK) { 539cd37da74Snw141292 idmapdlog(LOG_ERR, "Begin transaction failed (%s) " 540cd37da74Snw141292 "while %s (%s)", errmsg, while_doing, dbname); 541cd37da74Snw141292 sqlite_freemem(errmsg); 542cd37da74Snw141292 return (-1); 543cd37da74Snw141292 } 544cd37da74Snw141292 545cd37da74Snw141292 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 546cd37da74Snw141292 if (rc != SQLITE_OK) { 547cd37da74Snw141292 idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg, 548cd37da74Snw141292 while_doing, dbname); 549cd37da74Snw141292 sqlite_freemem(errmsg); 550cd37da74Snw141292 errmsg = NULL; 551cd37da74Snw141292 goto rollback; 552cd37da74Snw141292 } 553cd37da74Snw141292 554cd37da74Snw141292 rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg); 555cd37da74Snw141292 if (rc == SQLITE_OK) { 556cd37da74Snw141292 sqlite_freemem(errmsg); 557cd37da74Snw141292 return (0); 558cd37da74Snw141292 } 559cd37da74Snw141292 560cd37da74Snw141292 idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)", 561cd37da74Snw141292 errmsg, while_doing, dbname); 562cd37da74Snw141292 sqlite_freemem(errmsg); 563cd37da74Snw141292 errmsg = NULL; 564cd37da74Snw141292 565cd37da74Snw141292 rollback: 566cd37da74Snw141292 rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg); 567cd37da74Snw141292 if (rc != SQLITE_OK) { 568cd37da74Snw141292 idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)", 569cd37da74Snw141292 errmsg, while_doing, dbname); 570cd37da74Snw141292 sqlite_freemem(errmsg); 571cd37da74Snw141292 return (-2); 572cd37da74Snw141292 } 573cd37da74Snw141292 sqlite_freemem(errmsg); 574cd37da74Snw141292 575cd37da74Snw141292 return (-1); 576cd37da74Snw141292 } 577cd37da74Snw141292 578cd37da74Snw141292 /* 579c5c4113dSnw141292 * Execute the given SQL statment without using any callbacks 580c5c4113dSnw141292 */ 581c5c4113dSnw141292 idmap_retcode 58271590c90Snw141292 sql_exec_no_cb(sqlite *db, const char *dbname, char *sql) 583cd37da74Snw141292 { 584c5c4113dSnw141292 char *errmsg = NULL; 58584decf41Sjp151216 int r; 586c5c4113dSnw141292 idmap_retcode retcode; 587c5c4113dSnw141292 588c5c4113dSnw141292 r = sqlite_exec(db, sql, NULL, NULL, &errmsg); 58984decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 590c5c4113dSnw141292 591c5c4113dSnw141292 if (r != SQLITE_OK) { 59271590c90Snw141292 idmapdlog(LOG_ERR, "Database error on %s while executing %s " 59371590c90Snw141292 "(%s)", dbname, sql, CHECK_NULL(errmsg)); 594c5c4113dSnw141292 retcode = idmapd_string2stat(errmsg); 59562c60062Sbaban if (errmsg != NULL) 596c5c4113dSnw141292 sqlite_freemem(errmsg); 597c5c4113dSnw141292 return (retcode); 598c5c4113dSnw141292 } 599c5c4113dSnw141292 600c5c4113dSnw141292 return (IDMAP_SUCCESS); 601c5c4113dSnw141292 } 602c5c4113dSnw141292 603c5c4113dSnw141292 /* 604c5c4113dSnw141292 * Generate expression that can be used in WHERE statements. 605c5c4113dSnw141292 * Examples: 606c5c4113dSnw141292 * <prefix> <col> <op> <value> <suffix> 607c5c4113dSnw141292 * "" "unixuser" "=" "foo" "AND" 608c5c4113dSnw141292 */ 609c5c4113dSnw141292 idmap_retcode 610cd37da74Snw141292 gen_sql_expr_from_rule(idmap_namerule *rule, char **out) 611cd37da74Snw141292 { 612cd37da74Snw141292 char *s_windomain = NULL, *s_winname = NULL; 613cd37da74Snw141292 char *s_unixname = NULL; 614cd37da74Snw141292 char *lower_winname; 615cd37da74Snw141292 int retcode = IDMAP_SUCCESS; 616cd37da74Snw141292 617c5c4113dSnw141292 if (out == NULL) 618c5c4113dSnw141292 return (IDMAP_ERR_ARG); 619c5c4113dSnw141292 620c5c4113dSnw141292 621cd37da74Snw141292 if (!EMPTY_STRING(rule->windomain)) { 622cd37da74Snw141292 s_windomain = sqlite_mprintf("AND windomain = %Q ", 623cd37da74Snw141292 rule->windomain); 624cd37da74Snw141292 if (s_windomain == NULL) { 625cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY; 626cd37da74Snw141292 goto out; 627c5c4113dSnw141292 } 628cd37da74Snw141292 } 629cd37da74Snw141292 630cd37da74Snw141292 if (!EMPTY_STRING(rule->winname)) { 631cd37da74Snw141292 if ((lower_winname = tolower_u8(rule->winname)) == NULL) 632cd37da74Snw141292 lower_winname = rule->winname; 633cd37da74Snw141292 s_winname = sqlite_mprintf( 634cd37da74Snw141292 "AND winname = %Q AND is_wuser = %d ", 635cd37da74Snw141292 lower_winname, rule->is_wuser ? 1 : 0); 636cd37da74Snw141292 if (lower_winname != rule->winname) 637cd37da74Snw141292 free(lower_winname); 638cd37da74Snw141292 if (s_winname == NULL) { 639cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY; 640cd37da74Snw141292 goto out; 641cd37da74Snw141292 } 642cd37da74Snw141292 } 643cd37da74Snw141292 644cd37da74Snw141292 if (!EMPTY_STRING(rule->unixname)) { 645cd37da74Snw141292 s_unixname = sqlite_mprintf( 646cd37da74Snw141292 "AND unixname = %Q AND is_user = %d ", 647cd37da74Snw141292 rule->unixname, rule->is_user ? 1 : 0); 648cd37da74Snw141292 if (s_unixname == NULL) { 649cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY; 650cd37da74Snw141292 goto out; 651cd37da74Snw141292 } 652cd37da74Snw141292 } 653cd37da74Snw141292 654cd37da74Snw141292 *out = sqlite_mprintf("%s %s %s", 655cd37da74Snw141292 s_windomain ? s_windomain : "", 656cd37da74Snw141292 s_winname ? s_winname : "", 657cd37da74Snw141292 s_unixname ? s_unixname : ""); 658cd37da74Snw141292 659cd37da74Snw141292 if (*out == NULL) { 660cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY; 661cd37da74Snw141292 idmapdlog(LOG_ERR, "Out of memory"); 662cd37da74Snw141292 goto out; 663cd37da74Snw141292 } 664cd37da74Snw141292 665cd37da74Snw141292 out: 666cd37da74Snw141292 if (s_windomain != NULL) 667cd37da74Snw141292 sqlite_freemem(s_windomain); 668cd37da74Snw141292 if (s_winname != NULL) 669cd37da74Snw141292 sqlite_freemem(s_winname); 670cd37da74Snw141292 if (s_unixname != NULL) 671cd37da74Snw141292 sqlite_freemem(s_unixname); 672cd37da74Snw141292 673cd37da74Snw141292 return (retcode); 674cd37da74Snw141292 } 675cd37da74Snw141292 676cd37da74Snw141292 677c5c4113dSnw141292 678c5c4113dSnw141292 /* 679c5c4113dSnw141292 * Generate and execute SQL statement for LIST RPC calls 680c5c4113dSnw141292 */ 681c5c4113dSnw141292 idmap_retcode 68271590c90Snw141292 process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit, 68348258c6bSjp151216 int flag, list_svc_cb cb, void *result) 684cd37da74Snw141292 { 685c5c4113dSnw141292 list_cb_data_t cb_data; 686c5c4113dSnw141292 char *errmsg = NULL; 68784decf41Sjp151216 int r; 688c5c4113dSnw141292 idmap_retcode retcode = IDMAP_ERR_INTERNAL; 689c5c4113dSnw141292 690c5c4113dSnw141292 (void) memset(&cb_data, 0, sizeof (cb_data)); 691c5c4113dSnw141292 cb_data.result = result; 692c5c4113dSnw141292 cb_data.limit = limit; 69348258c6bSjp151216 cb_data.flag = flag; 694c5c4113dSnw141292 69584decf41Sjp151216 696c5c4113dSnw141292 r = sqlite_exec(db, sql, cb, &cb_data, &errmsg); 69784decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 698c5c4113dSnw141292 switch (r) { 699c5c4113dSnw141292 case SQLITE_OK: 700c5c4113dSnw141292 retcode = IDMAP_SUCCESS; 70184decf41Sjp151216 break; 70284decf41Sjp151216 703c5c4113dSnw141292 default: 704c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 70571590c90Snw141292 idmapdlog(LOG_ERR, "Database error on %s while executing " 70671590c90Snw141292 "%s (%s)", dbname, sql, CHECK_NULL(errmsg)); 70784decf41Sjp151216 break; 708c5c4113dSnw141292 } 70962c60062Sbaban if (errmsg != NULL) 710c5c4113dSnw141292 sqlite_freemem(errmsg); 711c5c4113dSnw141292 return (retcode); 712c5c4113dSnw141292 } 713c5c4113dSnw141292 714c5c4113dSnw141292 /* 715c5c4113dSnw141292 * This routine is called by callbacks that process the results of 716c5c4113dSnw141292 * LIST RPC calls to validate data and to allocate memory for 717c5c4113dSnw141292 * the result array. 718c5c4113dSnw141292 */ 719c5c4113dSnw141292 idmap_retcode 720c5c4113dSnw141292 validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv, 721cd37da74Snw141292 int ncol, uchar_t **list, size_t valsize) 722cd37da74Snw141292 { 723c5c4113dSnw141292 size_t nsize; 724c5c4113dSnw141292 void *tmplist; 725c5c4113dSnw141292 726c5c4113dSnw141292 if (cb_data->limit > 0 && cb_data->next == cb_data->limit) 727c5c4113dSnw141292 return (IDMAP_NEXT); 728c5c4113dSnw141292 729c5c4113dSnw141292 if (argc < ncol || argv == NULL) { 730c5c4113dSnw141292 idmapdlog(LOG_ERR, "Invalid data"); 731c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL); 732c5c4113dSnw141292 } 733c5c4113dSnw141292 734c5c4113dSnw141292 /* alloc in bulk to reduce number of reallocs */ 735c5c4113dSnw141292 if (cb_data->next >= cb_data->len) { 736c5c4113dSnw141292 nsize = (cb_data->len + SIZE_INCR) * valsize; 737c5c4113dSnw141292 tmplist = realloc(*list, nsize); 738c5c4113dSnw141292 if (tmplist == NULL) { 739c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 740c5c4113dSnw141292 return (IDMAP_ERR_MEMORY); 741c5c4113dSnw141292 } 742c5c4113dSnw141292 *list = tmplist; 743c5c4113dSnw141292 (void) memset(*list + (cb_data->len * valsize), 0, 744c5c4113dSnw141292 SIZE_INCR * valsize); 745c5c4113dSnw141292 cb_data->len += SIZE_INCR; 746c5c4113dSnw141292 } 747c5c4113dSnw141292 return (IDMAP_SUCCESS); 748c5c4113dSnw141292 } 749c5c4113dSnw141292 750cd37da74Snw141292 static 751cd37da74Snw141292 idmap_retcode 752c5c4113dSnw141292 get_namerule_order(char *winname, char *windomain, char *unixname, 753cd37da74Snw141292 int direction, int is_diagonal, int *w2u_order, int *u2w_order) 754cd37da74Snw141292 { 755c5c4113dSnw141292 *w2u_order = 0; 756c5c4113dSnw141292 *u2w_order = 0; 757c5c4113dSnw141292 758c5c4113dSnw141292 /* 759c5c4113dSnw141292 * Windows to UNIX lookup order: 760c5c4113dSnw141292 * 1. winname@domain (or winname) to "" 761c5c4113dSnw141292 * 2. winname@domain (or winname) to unixname 762c5c4113dSnw141292 * 3. winname@* to "" 763c5c4113dSnw141292 * 4. winname@* to unixname 764c5c4113dSnw141292 * 5. *@domain (or *) to * 765c5c4113dSnw141292 * 6. *@domain (or *) to "" 766c5c4113dSnw141292 * 7. *@domain (or *) to unixname 767c5c4113dSnw141292 * 8. *@* to * 768c5c4113dSnw141292 * 9. *@* to "" 769c5c4113dSnw141292 * 10. *@* to unixname 770c5c4113dSnw141292 * 771c5c4113dSnw141292 * winname is a special case of winname@domain when domain is the 772c5c4113dSnw141292 * default domain. Similarly * is a special case of *@domain when 773c5c4113dSnw141292 * domain is the default domain. 774c5c4113dSnw141292 * 775c5c4113dSnw141292 * Note that "" has priority over specific names because "" inhibits 776c5c4113dSnw141292 * mappings and traditionally deny rules always had higher priority. 777c5c4113dSnw141292 */ 778651c0131Sbaban if (direction != IDMAP_DIRECTION_U2W) { 779651c0131Sbaban /* bi-directional or from windows to unix */ 780c5c4113dSnw141292 if (winname == NULL) 781c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE); 782c5c4113dSnw141292 else if (unixname == NULL) 783c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE); 784c5c4113dSnw141292 else if (EMPTY_NAME(winname)) 785c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE); 786c5c4113dSnw141292 else if (*winname == '*' && windomain && *windomain == '*') { 787c5c4113dSnw141292 if (*unixname == '*') 788c5c4113dSnw141292 *w2u_order = 8; 789c5c4113dSnw141292 else if (EMPTY_NAME(unixname)) 790c5c4113dSnw141292 *w2u_order = 9; 791c5c4113dSnw141292 else /* unixname == name */ 792c5c4113dSnw141292 *w2u_order = 10; 793c5c4113dSnw141292 } else if (*winname == '*') { 794c5c4113dSnw141292 if (*unixname == '*') 795c5c4113dSnw141292 *w2u_order = 5; 796c5c4113dSnw141292 else if (EMPTY_NAME(unixname)) 797c5c4113dSnw141292 *w2u_order = 6; 798c5c4113dSnw141292 else /* name */ 799c5c4113dSnw141292 *w2u_order = 7; 80062c60062Sbaban } else if (windomain != NULL && *windomain == '*') { 801c5c4113dSnw141292 /* winname == name */ 802c5c4113dSnw141292 if (*unixname == '*') 803c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE); 804c5c4113dSnw141292 else if (EMPTY_NAME(unixname)) 805c5c4113dSnw141292 *w2u_order = 3; 806c5c4113dSnw141292 else /* name */ 807c5c4113dSnw141292 *w2u_order = 4; 808c5c4113dSnw141292 } else { 809c5c4113dSnw141292 /* winname == name && windomain == null or name */ 810c5c4113dSnw141292 if (*unixname == '*') 811c5c4113dSnw141292 return (IDMAP_ERR_W2U_NAMERULE); 812c5c4113dSnw141292 else if (EMPTY_NAME(unixname)) 813c5c4113dSnw141292 *w2u_order = 1; 814c5c4113dSnw141292 else /* name */ 815c5c4113dSnw141292 *w2u_order = 2; 816c5c4113dSnw141292 } 817cd37da74Snw141292 818c5c4113dSnw141292 } 819c5c4113dSnw141292 820c5c4113dSnw141292 /* 821cd37da74Snw141292 * 1. unixname to "", non-diagonal 822cd37da74Snw141292 * 2. unixname to winname@domain (or winname), non-diagonal 823cd37da74Snw141292 * 3. unixname to "", diagonal 824cd37da74Snw141292 * 4. unixname to winname@domain (or winname), diagonal 825cd37da74Snw141292 * 5. * to *@domain (or *), non-diagonal 826cd37da74Snw141292 * 5. * to *@domain (or *), diagonal 827cd37da74Snw141292 * 7. * to "" 828cd37da74Snw141292 * 8. * to winname@domain (or winname) 829cd37da74Snw141292 * 9. * to "", non-diagonal 830cd37da74Snw141292 * 10. * to winname@domain (or winname), diagonal 831c5c4113dSnw141292 */ 832651c0131Sbaban if (direction != IDMAP_DIRECTION_W2U) { 833cd37da74Snw141292 int diagonal = is_diagonal ? 1 : 0; 834cd37da74Snw141292 835651c0131Sbaban /* bi-directional or from unix to windows */ 836c5c4113dSnw141292 if (unixname == NULL || EMPTY_NAME(unixname)) 837c5c4113dSnw141292 return (IDMAP_ERR_U2W_NAMERULE); 838c5c4113dSnw141292 else if (winname == NULL) 839c5c4113dSnw141292 return (IDMAP_ERR_U2W_NAMERULE); 84062c60062Sbaban else if (windomain != NULL && *windomain == '*') 841651c0131Sbaban return (IDMAP_ERR_U2W_NAMERULE); 842c5c4113dSnw141292 else if (*unixname == '*') { 843c5c4113dSnw141292 if (*winname == '*') 844cd37da74Snw141292 *u2w_order = 5 + diagonal; 845c5c4113dSnw141292 else if (EMPTY_NAME(winname)) 846cd37da74Snw141292 *u2w_order = 7 + 2 * diagonal; 847c5c4113dSnw141292 else 848cd37da74Snw141292 *u2w_order = 8 + 2 * diagonal; 849c5c4113dSnw141292 } else { 850c5c4113dSnw141292 if (*winname == '*') 851c5c4113dSnw141292 return (IDMAP_ERR_U2W_NAMERULE); 852c5c4113dSnw141292 else if (EMPTY_NAME(winname)) 853cd37da74Snw141292 *u2w_order = 1 + 2 * diagonal; 854c5c4113dSnw141292 else 855cd37da74Snw141292 *u2w_order = 2 + 2 * diagonal; 856c5c4113dSnw141292 } 857c5c4113dSnw141292 } 858c5c4113dSnw141292 return (IDMAP_SUCCESS); 859c5c4113dSnw141292 } 860c5c4113dSnw141292 861c5c4113dSnw141292 /* 862c5c4113dSnw141292 * Generate and execute SQL statement to add name-based mapping rule 863c5c4113dSnw141292 */ 864c5c4113dSnw141292 idmap_retcode 865cd37da74Snw141292 add_namerule(sqlite *db, idmap_namerule *rule) 866cd37da74Snw141292 { 867c5c4113dSnw141292 char *sql = NULL; 868c5c4113dSnw141292 idmap_stat retcode; 8698e228215Sdm199847 char *dom = NULL; 870c5c4113dSnw141292 int w2u_order, u2w_order; 871c5c4113dSnw141292 char w2ubuf[11], u2wbuf[11]; 872c5c4113dSnw141292 8738e228215Sdm199847 retcode = get_namerule_order(rule->winname, rule->windomain, 874cd37da74Snw141292 rule->unixname, rule->direction, 875cd37da74Snw141292 rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order); 876c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS) 877c5c4113dSnw141292 goto out; 878c5c4113dSnw141292 879c5c4113dSnw141292 if (w2u_order) 880c5c4113dSnw141292 (void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order); 881c5c4113dSnw141292 if (u2w_order) 882c5c4113dSnw141292 (void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order); 883c5c4113dSnw141292 88462c60062Sbaban /* 88562c60062Sbaban * For the triggers on namerules table to work correctly: 88662c60062Sbaban * 1) Use NULL instead of 0 for w2u_order and u2w_order 88762c60062Sbaban * 2) Use "" instead of NULL for "no domain" 88862c60062Sbaban */ 88962c60062Sbaban 890e8c27ec8Sbaban if (!EMPTY_STRING(rule->windomain)) 8918e228215Sdm199847 dom = rule->windomain; 892cd37da74Snw141292 else if (lookup_wksids_name2sid(rule->winname, NULL, NULL, NULL, NULL) 89362c60062Sbaban == IDMAP_SUCCESS) { 89462c60062Sbaban /* well-known SIDs don't need domain */ 89562c60062Sbaban dom = ""; 89662c60062Sbaban } 897c5c4113dSnw141292 898c5c4113dSnw141292 RDLOCK_CONFIG(); 89962c60062Sbaban if (dom == NULL) { 900c8e26105Sjp151216 if (_idmapdstate.cfg->pgcfg.default_domain) 901c8e26105Sjp151216 dom = _idmapdstate.cfg->pgcfg.default_domain; 902c5c4113dSnw141292 else 903c5c4113dSnw141292 dom = ""; 90462c60062Sbaban } 90584decf41Sjp151216 sql = sqlite_mprintf("INSERT into namerules " 906cd37da74Snw141292 "(is_user, is_wuser, windomain, winname_display, is_nt4, " 907c5c4113dSnw141292 "unixname, w2u_order, u2w_order) " 908cd37da74Snw141292 "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);", 909cd37da74Snw141292 rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom, 910cd37da74Snw141292 rule->winname, rule->is_nt4 ? 1 : 0, rule->unixname, 911cd37da74Snw141292 w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL); 912c5c4113dSnw141292 UNLOCK_CONFIG(); 913c5c4113dSnw141292 914c5c4113dSnw141292 if (sql == NULL) { 915c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 916c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 917c5c4113dSnw141292 goto out; 918c5c4113dSnw141292 } 919c5c4113dSnw141292 92071590c90Snw141292 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 921c5c4113dSnw141292 922c5c4113dSnw141292 if (retcode == IDMAP_ERR_OTHER) 923c5c4113dSnw141292 retcode = IDMAP_ERR_CFG; 924c5c4113dSnw141292 925c5c4113dSnw141292 out: 92662c60062Sbaban if (sql != NULL) 927c5c4113dSnw141292 sqlite_freemem(sql); 928c5c4113dSnw141292 return (retcode); 929c5c4113dSnw141292 } 930c5c4113dSnw141292 931c5c4113dSnw141292 /* 932c5c4113dSnw141292 * Flush name-based mapping rules 933c5c4113dSnw141292 */ 934c5c4113dSnw141292 idmap_retcode 935cd37da74Snw141292 flush_namerules(sqlite *db) 936cd37da74Snw141292 { 937c5c4113dSnw141292 idmap_stat retcode; 938c5c4113dSnw141292 93971590c90Snw141292 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;"); 940c5c4113dSnw141292 941c5c4113dSnw141292 return (retcode); 942c5c4113dSnw141292 } 943c5c4113dSnw141292 944c5c4113dSnw141292 /* 945c5c4113dSnw141292 * Generate and execute SQL statement to remove a name-based mapping rule 946c5c4113dSnw141292 */ 947c5c4113dSnw141292 idmap_retcode 948cd37da74Snw141292 rm_namerule(sqlite *db, idmap_namerule *rule) 949cd37da74Snw141292 { 950c5c4113dSnw141292 char *sql = NULL; 951c5c4113dSnw141292 idmap_stat retcode; 952c5c4113dSnw141292 char buf[80]; 953cd37da74Snw141292 char *expr = NULL; 954c5c4113dSnw141292 9558e228215Sdm199847 if (rule->direction < 0 && EMPTY_STRING(rule->windomain) && 9568e228215Sdm199847 EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname)) 957c5c4113dSnw141292 return (IDMAP_SUCCESS); 958c5c4113dSnw141292 959c5c4113dSnw141292 buf[0] = 0; 960cd37da74Snw141292 961cd37da74Snw141292 if (rule->direction == IDMAP_DIRECTION_BI) 962c5c4113dSnw141292 (void) snprintf(buf, sizeof (buf), "AND w2u_order > 0" 963c5c4113dSnw141292 " AND u2w_order > 0"); 964cd37da74Snw141292 else if (rule->direction == IDMAP_DIRECTION_W2U) 965c5c4113dSnw141292 (void) snprintf(buf, sizeof (buf), "AND w2u_order > 0" 966c5c4113dSnw141292 " AND (u2w_order = 0 OR u2w_order ISNULL)"); 967cd37da74Snw141292 else if (rule->direction == IDMAP_DIRECTION_U2W) 968c5c4113dSnw141292 (void) snprintf(buf, sizeof (buf), "AND u2w_order > 0" 969c5c4113dSnw141292 " AND (w2u_order = 0 OR w2u_order ISNULL)"); 970c5c4113dSnw141292 971cd37da74Snw141292 retcode = gen_sql_expr_from_rule(rule, &expr); 972cd37da74Snw141292 if (retcode != IDMAP_SUCCESS) 973c5c4113dSnw141292 goto out; 974c5c4113dSnw141292 975cd37da74Snw141292 sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s %s;", expr, 976c5c4113dSnw141292 buf); 977c5c4113dSnw141292 978c5c4113dSnw141292 if (sql == NULL) { 979c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 980c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 981c5c4113dSnw141292 goto out; 982c5c4113dSnw141292 } 983c5c4113dSnw141292 984cd37da74Snw141292 98571590c90Snw141292 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 986c5c4113dSnw141292 987c5c4113dSnw141292 out: 988cd37da74Snw141292 if (expr != NULL) 989cd37da74Snw141292 sqlite_freemem(expr); 99062c60062Sbaban if (sql != NULL) 991c5c4113dSnw141292 sqlite_freemem(sql); 992c5c4113dSnw141292 return (retcode); 993c5c4113dSnw141292 } 994c5c4113dSnw141292 995c5c4113dSnw141292 /* 996c5c4113dSnw141292 * Compile the given SQL query and step just once. 997c5c4113dSnw141292 * 998c5c4113dSnw141292 * Input: 999c5c4113dSnw141292 * db - db handle 1000c5c4113dSnw141292 * sql - SQL statement 1001c5c4113dSnw141292 * 1002c5c4113dSnw141292 * Output: 1003c5c4113dSnw141292 * vm - virtual SQL machine 1004c5c4113dSnw141292 * ncol - number of columns in the result 1005c5c4113dSnw141292 * values - column values 1006c5c4113dSnw141292 * 1007c5c4113dSnw141292 * Return values: 1008c5c4113dSnw141292 * IDMAP_SUCCESS 1009c5c4113dSnw141292 * IDMAP_ERR_NOTFOUND 1010c5c4113dSnw141292 * IDMAP_ERR_INTERNAL 1011c5c4113dSnw141292 */ 1012c5c4113dSnw141292 1013cd37da74Snw141292 static 1014cd37da74Snw141292 idmap_retcode 1015c5c4113dSnw141292 sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol, 1016cd37da74Snw141292 int reqcol, const char ***values) 1017cd37da74Snw141292 { 1018c5c4113dSnw141292 char *errmsg = NULL; 101984decf41Sjp151216 int r; 1020c5c4113dSnw141292 102184decf41Sjp151216 if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) { 1022cd37da74Snw141292 idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1023cd37da74Snw141292 CHECK_NULL(errmsg)); 1024c5c4113dSnw141292 sqlite_freemem(errmsg); 1025c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL); 1026c5c4113dSnw141292 } 1027c5c4113dSnw141292 1028c5c4113dSnw141292 r = sqlite_step(*vm, ncol, values, NULL); 102984decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 1030c5c4113dSnw141292 103184decf41Sjp151216 if (r == SQLITE_ROW) { 103262c60062Sbaban if (ncol != NULL && *ncol < reqcol) { 1033c5c4113dSnw141292 (void) sqlite_finalize(*vm, NULL); 1034c5c4113dSnw141292 *vm = NULL; 1035c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL); 1036c5c4113dSnw141292 } 1037c5c4113dSnw141292 /* Caller will call finalize after using the results */ 1038c5c4113dSnw141292 return (IDMAP_SUCCESS); 1039c5c4113dSnw141292 } else if (r == SQLITE_DONE) { 1040c5c4113dSnw141292 (void) sqlite_finalize(*vm, NULL); 1041c5c4113dSnw141292 *vm = NULL; 1042c5c4113dSnw141292 return (IDMAP_ERR_NOTFOUND); 1043c5c4113dSnw141292 } 1044c5c4113dSnw141292 1045c5c4113dSnw141292 (void) sqlite_finalize(*vm, &errmsg); 1046c5c4113dSnw141292 *vm = NULL; 1047cd37da74Snw141292 idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1048cd37da74Snw141292 CHECK_NULL(errmsg)); 1049c5c4113dSnw141292 sqlite_freemem(errmsg); 1050c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL); 1051c5c4113dSnw141292 } 1052c5c4113dSnw141292 105362c60062Sbaban /* 1054479ac375Sdm199847 * Load config in the state. 1055e8c27ec8Sbaban * 1056479ac375Sdm199847 * nm_siduid and nm_sidgid fields: 1057e8c27ec8Sbaban * state->nm_siduid represents mode used by sid2uid and uid2sid 1058e8c27ec8Sbaban * requests for directory-based name mappings. Similarly, 1059e8c27ec8Sbaban * state->nm_sidgid represents mode used by sid2gid and gid2sid 1060e8c27ec8Sbaban * requests. 1061e8c27ec8Sbaban * 1062e8c27ec8Sbaban * sid2uid/uid2sid: 1063e8c27ec8Sbaban * none -> ds_name_mapping_enabled != true 1064e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixuser_attr 1065e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr 1066e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixuser_attr 1067e8c27ec8Sbaban * 1068e8c27ec8Sbaban * sid2gid/gid2sid: 1069e8c27ec8Sbaban * none -> ds_name_mapping_enabled != true 1070e8c27ec8Sbaban * AD-mode -> !nldap_winname_attr && ad_unixgroup_attr 1071e8c27ec8Sbaban * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr 1072e8c27ec8Sbaban * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr 1073e8c27ec8Sbaban */ 1074e8c27ec8Sbaban idmap_retcode 1075479ac375Sdm199847 load_cfg_in_state(lookup_state_t *state) 1076e8c27ec8Sbaban { 1077e8c27ec8Sbaban state->nm_siduid = IDMAP_NM_NONE; 1078e8c27ec8Sbaban state->nm_sidgid = IDMAP_NM_NONE; 1079e8c27ec8Sbaban RDLOCK_CONFIG(); 1080479ac375Sdm199847 10814aa0a5e7Snw141292 state->eph_map_unres_sids = 0; 10824aa0a5e7Snw141292 if (_idmapdstate.cfg->pgcfg.eph_map_unres_sids) 10834aa0a5e7Snw141292 state->eph_map_unres_sids = 1; 10844aa0a5e7Snw141292 1085479ac375Sdm199847 if (_idmapdstate.cfg->pgcfg.default_domain != NULL) { 1086479ac375Sdm199847 state->defdom = 1087479ac375Sdm199847 strdup(_idmapdstate.cfg->pgcfg.default_domain); 1088479ac375Sdm199847 if (state->defdom == NULL) { 1089479ac375Sdm199847 UNLOCK_CONFIG(); 1090479ac375Sdm199847 return (IDMAP_ERR_MEMORY); 1091479ac375Sdm199847 } 1092479ac375Sdm199847 } else { 1093479ac375Sdm199847 UNLOCK_CONFIG(); 1094dc03a638Sdm199847 return (IDMAP_SUCCESS); 1095479ac375Sdm199847 } 1096e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ds_name_mapping_enabled == FALSE) { 1097e8c27ec8Sbaban UNLOCK_CONFIG(); 1098e8c27ec8Sbaban return (IDMAP_SUCCESS); 1099e8c27ec8Sbaban } 1100e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1101e8c27ec8Sbaban state->nm_siduid = 1102e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1103e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1104e8c27ec8Sbaban state->nm_sidgid = 1105e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1106e8c27ec8Sbaban ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1107e8c27ec8Sbaban } else { 1108e8c27ec8Sbaban state->nm_siduid = 1109e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1110e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE; 1111e8c27ec8Sbaban state->nm_sidgid = 1112e8c27ec8Sbaban (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1113e8c27ec8Sbaban ? IDMAP_NM_AD : IDMAP_NM_NONE; 1114e8c27ec8Sbaban } 1115e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) { 1116e8c27ec8Sbaban state->ad_unixuser_attr = 1117e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr); 1118e8c27ec8Sbaban if (state->ad_unixuser_attr == NULL) { 1119e8c27ec8Sbaban UNLOCK_CONFIG(); 1120e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1121e8c27ec8Sbaban } 1122e8c27ec8Sbaban } 1123e8c27ec8Sbaban if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) { 1124e8c27ec8Sbaban state->ad_unixgroup_attr = 1125e8c27ec8Sbaban strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr); 1126e8c27ec8Sbaban if (state->ad_unixgroup_attr == NULL) { 1127e8c27ec8Sbaban UNLOCK_CONFIG(); 1128e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1129e8c27ec8Sbaban } 1130e8c27ec8Sbaban } 1131479ac375Sdm199847 if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1132479ac375Sdm199847 state->nldap_winname_attr = 1133479ac375Sdm199847 strdup(_idmapdstate.cfg->pgcfg.nldap_winname_attr); 1134479ac375Sdm199847 if (state->nldap_winname_attr == NULL) { 1135479ac375Sdm199847 UNLOCK_CONFIG(); 1136479ac375Sdm199847 return (IDMAP_ERR_MEMORY); 1137479ac375Sdm199847 } 1138479ac375Sdm199847 } 1139e8c27ec8Sbaban UNLOCK_CONFIG(); 1140e8c27ec8Sbaban return (IDMAP_SUCCESS); 1141e8c27ec8Sbaban } 1142e8c27ec8Sbaban 1143e8c27ec8Sbaban /* 114448258c6bSjp151216 * Set the rule with sepecified values. 114548258c6bSjp151216 * All the strings are copied. 114648258c6bSjp151216 */ 114748258c6bSjp151216 static void 114848258c6bSjp151216 idmap_namerule_set(idmap_namerule *rule, const char *windomain, 114948258c6bSjp151216 const char *winname, const char *unixname, boolean_t is_user, 115048258c6bSjp151216 boolean_t is_wuser, boolean_t is_nt4, int direction) 115148258c6bSjp151216 { 115248258c6bSjp151216 /* 115348258c6bSjp151216 * Only update if they differ because we have to free 115448258c6bSjp151216 * and duplicate the strings 115548258c6bSjp151216 */ 115648258c6bSjp151216 if (rule->windomain == NULL || windomain == NULL || 115748258c6bSjp151216 strcmp(rule->windomain, windomain) != 0) { 115848258c6bSjp151216 if (rule->windomain != NULL) { 115948258c6bSjp151216 free(rule->windomain); 116048258c6bSjp151216 rule->windomain = NULL; 116148258c6bSjp151216 } 116248258c6bSjp151216 if (windomain != NULL) 116348258c6bSjp151216 rule->windomain = strdup(windomain); 116448258c6bSjp151216 } 116548258c6bSjp151216 116648258c6bSjp151216 if (rule->winname == NULL || winname == NULL || 116748258c6bSjp151216 strcmp(rule->winname, winname) != 0) { 116848258c6bSjp151216 if (rule->winname != NULL) { 116948258c6bSjp151216 free(rule->winname); 117048258c6bSjp151216 rule->winname = NULL; 117148258c6bSjp151216 } 117248258c6bSjp151216 if (winname != NULL) 117348258c6bSjp151216 rule->winname = strdup(winname); 117448258c6bSjp151216 } 117548258c6bSjp151216 117648258c6bSjp151216 if (rule->unixname == NULL || unixname == NULL || 117748258c6bSjp151216 strcmp(rule->unixname, unixname) != 0) { 117848258c6bSjp151216 if (rule->unixname != NULL) { 117948258c6bSjp151216 free(rule->unixname); 118048258c6bSjp151216 rule->unixname = NULL; 118148258c6bSjp151216 } 118248258c6bSjp151216 if (unixname != NULL) 118348258c6bSjp151216 rule->unixname = strdup(unixname); 118448258c6bSjp151216 } 118548258c6bSjp151216 118648258c6bSjp151216 rule->is_user = is_user; 118748258c6bSjp151216 rule->is_wuser = is_wuser; 118848258c6bSjp151216 rule->is_nt4 = is_nt4; 118948258c6bSjp151216 rule->direction = direction; 119048258c6bSjp151216 } 119148258c6bSjp151216 119248258c6bSjp151216 119348258c6bSjp151216 /* 119462c60062Sbaban * Table for well-known SIDs. 119562c60062Sbaban * 119662c60062Sbaban * Background: 119762c60062Sbaban * 119876b27f93Sbaban * Some of the well-known principals are stored under: 119962c60062Sbaban * cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain> 120062c60062Sbaban * They belong to objectClass "foreignSecurityPrincipal". They don't have 120162c60062Sbaban * "samAccountName" nor "userPrincipalName" attributes. Their names are 120262c60062Sbaban * available in "cn" and "name" attributes. Some of these principals have a 120362c60062Sbaban * second entry under CN=ForeignSecurityPrincipals,dc=<forestRootDomain> and 120462c60062Sbaban * these duplicate entries have the stringified SID in the "name" and "cn" 120562c60062Sbaban * attributes instead of the actual name. 120662c60062Sbaban * 120776b27f93Sbaban * Those of the form S-1-5-32-X are Builtin groups and are stored in the 120876b27f93Sbaban * cn=builtin container (except, Power Users which is not stored in AD) 120962c60062Sbaban * 121076b27f93Sbaban * These principals are and will remain constant. Therefore doing AD lookups 121176b27f93Sbaban * provides no benefit. Also, using hard-coded table (and thus avoiding AD 121276b27f93Sbaban * lookup) improves performance and avoids additional complexity in the 121376b27f93Sbaban * adutils.c code. Moreover these SIDs can be used when no Active Directory 121476b27f93Sbaban * is available (such as the CIFS server's "workgroup" mode). 121576b27f93Sbaban * 121676b27f93Sbaban * Notes: 121776b27f93Sbaban * 1. Currently we don't support localization of well-known SID names, 121862c60062Sbaban * unlike Windows. 121962c60062Sbaban * 122076b27f93Sbaban * 2. Other well-known SIDs i.e. S-1-5-<domain>-<w-k RID> are not stored 122176b27f93Sbaban * here. AD does have normal user/group objects for these objects and 122276b27f93Sbaban * can be looked up using the existing AD lookup code. 1223e8c27ec8Sbaban * 1224e8c27ec8Sbaban * 3. See comments above lookup_wksids_sid2pid() for more information 1225e8c27ec8Sbaban * on how we lookup the wksids table. 122662c60062Sbaban */ 122762c60062Sbaban static wksids_table_t wksids[] = { 1228e8c27ec8Sbaban {"S-1-0", 0, "Nobody", 0, SENTINEL_PID, -1, 1}, 1229e8c27ec8Sbaban {"S-1-1", 0, "Everyone", 0, SENTINEL_PID, -1, -1}, 1230e8c27ec8Sbaban {"S-1-3", 0, "Creator Owner", 1, IDMAP_WK_CREATOR_OWNER_UID, 1, 0}, 1231e8c27ec8Sbaban {"S-1-3", 1, "Creator Group", 0, IDMAP_WK_CREATOR_GROUP_GID, 0, 0}, 1232e8c27ec8Sbaban {"S-1-3", 2, "Creator Owner Server", 1, SENTINEL_PID, -1, -1}, 1233e8c27ec8Sbaban {"S-1-3", 3, "Creator Group Server", 0, SENTINEL_PID, -1, 1}, 1234e8c27ec8Sbaban {"S-1-3", 4, "Owner Rights", 0, SENTINEL_PID, -1, -1}, 1235e8c27ec8Sbaban {"S-1-5", 1, "Dialup", 0, SENTINEL_PID, -1, -1}, 1236e8c27ec8Sbaban {"S-1-5", 2, "Network", 0, SENTINEL_PID, -1, -1}, 1237e8c27ec8Sbaban {"S-1-5", 3, "Batch", 0, SENTINEL_PID, -1, -1}, 1238e8c27ec8Sbaban {"S-1-5", 4, "Interactive", 0, SENTINEL_PID, -1, -1}, 1239e8c27ec8Sbaban {"S-1-5", 6, "Service", 0, SENTINEL_PID, -1, -1}, 1240e8c27ec8Sbaban {"S-1-5", 7, "Anonymous Logon", 0, GID_NOBODY, 0, 0}, 1241e8c27ec8Sbaban {"S-1-5", 7, "Anonymous Logon", 0, UID_NOBODY, 1, 0}, 1242e8c27ec8Sbaban {"S-1-5", 8, "Proxy", 0, SENTINEL_PID, -1, -1}, 1243e8c27ec8Sbaban {"S-1-5", 9, "Enterprise Domain Controllers", 0, SENTINEL_PID, -1, -1}, 1244e8c27ec8Sbaban {"S-1-5", 10, "Self", 0, SENTINEL_PID, -1, -1}, 1245e8c27ec8Sbaban {"S-1-5", 11, "Authenticated Users", 0, SENTINEL_PID, -1, -1}, 1246e8c27ec8Sbaban {"S-1-5", 12, "Restricted Code", 0, SENTINEL_PID, -1, -1}, 1247e8c27ec8Sbaban {"S-1-5", 13, "Terminal Server User", 0, SENTINEL_PID, -1, -1}, 1248e8c27ec8Sbaban {"S-1-5", 14, "Remote Interactive Logon", 0, SENTINEL_PID, -1, -1}, 1249e8c27ec8Sbaban {"S-1-5", 15, "This Organization", 0, SENTINEL_PID, -1, -1}, 1250e8c27ec8Sbaban {"S-1-5", 17, "IUSR", 0, SENTINEL_PID, -1, -1}, 1251e8c27ec8Sbaban {"S-1-5", 18, "Local System", 0, IDMAP_WK_LOCAL_SYSTEM_GID, 0, 0}, 1252e8c27ec8Sbaban {"S-1-5", 19, "Local Service", 0, SENTINEL_PID, -1, -1}, 1253e8c27ec8Sbaban {"S-1-5", 20, "Network Service", 0, SENTINEL_PID, -1, -1}, 1254e8c27ec8Sbaban {"S-1-5", 1000, "Other Organization", 0, SENTINEL_PID, -1, -1}, 1255e8c27ec8Sbaban {"S-1-5-32", 544, "Administrators", 0, SENTINEL_PID, -1, -1}, 1256e8c27ec8Sbaban {"S-1-5-32", 545, "Users", 0, SENTINEL_PID, -1, -1}, 1257e8c27ec8Sbaban {"S-1-5-32", 546, "Guests", 0, SENTINEL_PID, -1, -1}, 1258e8c27ec8Sbaban {"S-1-5-32", 547, "Power Users", 0, SENTINEL_PID, -1, -1}, 1259e8c27ec8Sbaban {"S-1-5-32", 548, "Account Operators", 0, SENTINEL_PID, -1, -1}, 1260e8c27ec8Sbaban {"S-1-5-32", 549, "Server Operators", 0, SENTINEL_PID, -1, -1}, 1261e8c27ec8Sbaban {"S-1-5-32", 550, "Print Operators", 0, SENTINEL_PID, -1, -1}, 1262e8c27ec8Sbaban {"S-1-5-32", 551, "Backup Operators", 0, SENTINEL_PID, -1, -1}, 1263e8c27ec8Sbaban {"S-1-5-32", 552, "Replicator", 0, SENTINEL_PID, -1, -1}, 126476b27f93Sbaban {"S-1-5-32", 554, "Pre-Windows 2000 Compatible Access", 0, 1265e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 1266e8c27ec8Sbaban {"S-1-5-32", 555, "Remote Desktop Users", 0, SENTINEL_PID, -1, -1}, 126776b27f93Sbaban {"S-1-5-32", 556, "Network Configuration Operators", 0, 1268e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 126976b27f93Sbaban {"S-1-5-32", 557, "Incoming Forest Trust Builders", 0, 1270e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 1271e8c27ec8Sbaban {"S-1-5-32", 558, "Performance Monitor Users", 0, SENTINEL_PID, -1, -1}, 1272e8c27ec8Sbaban {"S-1-5-32", 559, "Performance Log Users", 0, SENTINEL_PID, -1, -1}, 127376b27f93Sbaban {"S-1-5-32", 560, "Windows Authorization Access Group", 0, 1274e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 127576b27f93Sbaban {"S-1-5-32", 561, "Terminal Server License Servers", 0, 1276e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 1277e8c27ec8Sbaban {"S-1-5-32", 561, "Distributed COM Users", 0, SENTINEL_PID, -1, -1}, 1278e8c27ec8Sbaban {"S-1-5-32", 568, "IIS_IUSRS", 0, SENTINEL_PID, -1, -1}, 1279e8c27ec8Sbaban {"S-1-5-32", 569, "Cryptographic Operators", 0, SENTINEL_PID, -1, -1}, 1280e8c27ec8Sbaban {"S-1-5-32", 573, "Event Log Readers", 0, SENTINEL_PID, -1, -1}, 128176b27f93Sbaban {"S-1-5-32", 574, "Certificate Service DCOM Access", 0, 1282e8c27ec8Sbaban SENTINEL_PID, -1, -1}, 1283e8c27ec8Sbaban {"S-1-5-64", 21, "Digest Authentication", 0, SENTINEL_PID, -1, -1}, 1284e8c27ec8Sbaban {"S-1-5-64", 10, "NTLM Authentication", 0, SENTINEL_PID, -1, -1}, 1285e8c27ec8Sbaban {"S-1-5-64", 14, "SChannel Authentication", 0, SENTINEL_PID, -1, -1}, 1286e8c27ec8Sbaban {NULL, UINT32_MAX, NULL, -1, SENTINEL_PID, -1, -1} 1287c5c4113dSnw141292 }; 1288c5c4113dSnw141292 1289e8c27ec8Sbaban /* 1290e8c27ec8Sbaban * Lookup well-known SIDs table either by winname or by SID. 1291e8c27ec8Sbaban * If the given winname or SID is a well-known SID then we set wksid 1292e8c27ec8Sbaban * variable and then proceed to see if the SID has a hard mapping to 1293e8c27ec8Sbaban * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to 1294e8c27ec8Sbaban * fixed ephemeral ids). If we find such mapping then we return 1295e8c27ec8Sbaban * success otherwise notfound. If a well-known SID is mapped to 1296e8c27ec8Sbaban * SENTINEL_PID and the direction field is set (bi-directional or 1297e8c27ec8Sbaban * win2unix) then we treat it as inhibited mapping and return no 1298e8c27ec8Sbaban * mapping (Ex. S-1-0-0). 1299e8c27ec8Sbaban */ 1300cd37da74Snw141292 static 1301cd37da74Snw141292 idmap_retcode 1302e8c27ec8Sbaban lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *wksid) 1303cd37da74Snw141292 { 1304c5c4113dSnw141292 int i; 130562c60062Sbaban 1306e8c27ec8Sbaban *wksid = 0; 1307e8c27ec8Sbaban 1308e8c27ec8Sbaban for (i = 0; wksids[i].sidprefix != NULL; i++) { 1309e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 1310e8c27ec8Sbaban if ((strcasecmp(wksids[i].sidprefix, 1311e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix) != 0) || 1312e8c27ec8Sbaban wksids[i].rid != req->id1.idmap_id_u.sid.rid) 1313e8c27ec8Sbaban /* this is not our SID */ 1314e8c27ec8Sbaban continue; 1315e8c27ec8Sbaban if (req->id1name == NULL) { 1316e8c27ec8Sbaban req->id1name = strdup(wksids[i].winname); 1317e8c27ec8Sbaban if (req->id1name == NULL) 1318e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1319e8c27ec8Sbaban } 1320e8c27ec8Sbaban } else if (req->id1name != NULL) { 1321e8c27ec8Sbaban if (strcasecmp(wksids[i].winname, req->id1name) != 0) 1322e8c27ec8Sbaban /* this is not our winname */ 1323e8c27ec8Sbaban continue; 1324e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = 1325e8c27ec8Sbaban strdup(wksids[i].sidprefix); 1326e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL) 1327e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 1328e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid = wksids[i].rid; 1329e8c27ec8Sbaban } 1330e8c27ec8Sbaban 1331e8c27ec8Sbaban *wksid = 1; 1332e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 1333e8c27ec8Sbaban 1334e8c27ec8Sbaban req->id1.idtype = (wksids[i].is_wuser) ? 1335e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 1336e8c27ec8Sbaban 1337e8c27ec8Sbaban if (wksids[i].pid == SENTINEL_PID) { 1338e8c27ec8Sbaban if (wksids[i].direction == IDMAP_DIRECTION_BI || 1339e8c27ec8Sbaban wksids[i].direction == IDMAP_DIRECTION_W2U) 1340e8c27ec8Sbaban /* Inhibited */ 1341e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 1342e8c27ec8Sbaban /* Not mapped */ 1343479ac375Sdm199847 if (res->id.idtype == IDMAP_POSIXID) { 1344479ac375Sdm199847 res->id.idtype = 1345479ac375Sdm199847 (wksids[i].is_wuser) ? 1346479ac375Sdm199847 IDMAP_UID : IDMAP_GID; 1347479ac375Sdm199847 } 1348e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 1349e8c27ec8Sbaban } else if (wksids[i].direction == IDMAP_DIRECTION_U2W) 135062c60062Sbaban continue; 135162c60062Sbaban 1352e8c27ec8Sbaban switch (res->id.idtype) { 1353c5c4113dSnw141292 case IDMAP_UID: 135462c60062Sbaban if (wksids[i].is_user == 0) 135562c60062Sbaban continue; 135662c60062Sbaban res->id.idmap_id_u.uid = wksids[i].pid; 135762c60062Sbaban res->direction = wksids[i].direction; 135848258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 135948258c6bSjp151216 res->info.how.map_type = 136048258c6bSjp151216 IDMAP_MAP_TYPE_KNOWN_SID; 136148258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_HARD_CODED; 136248258c6bSjp151216 } 1363c5c4113dSnw141292 return (IDMAP_SUCCESS); 1364c5c4113dSnw141292 case IDMAP_GID: 136562c60062Sbaban if (wksids[i].is_user == 1) 136662c60062Sbaban continue; 136762c60062Sbaban res->id.idmap_id_u.gid = wksids[i].pid; 136862c60062Sbaban res->direction = wksids[i].direction; 136948258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 137048258c6bSjp151216 res->info.how.map_type = 137148258c6bSjp151216 IDMAP_MAP_TYPE_KNOWN_SID; 137248258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_HARD_CODED; 137348258c6bSjp151216 } 1374c5c4113dSnw141292 return (IDMAP_SUCCESS); 1375c5c4113dSnw141292 case IDMAP_POSIXID: 137662c60062Sbaban res->id.idmap_id_u.uid = wksids[i].pid; 137762c60062Sbaban res->id.idtype = (!wksids[i].is_user) ? 1378c5c4113dSnw141292 IDMAP_GID : IDMAP_UID; 137962c60062Sbaban res->direction = wksids[i].direction; 138048258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 138148258c6bSjp151216 res->info.how.map_type = 138248258c6bSjp151216 IDMAP_MAP_TYPE_KNOWN_SID; 138348258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_HARD_CODED; 138448258c6bSjp151216 } 1385c5c4113dSnw141292 return (IDMAP_SUCCESS); 1386c5c4113dSnw141292 default: 1387c5c4113dSnw141292 return (IDMAP_ERR_NOTSUPPORTED); 1388c5c4113dSnw141292 } 1389c5c4113dSnw141292 } 1390c5c4113dSnw141292 return (IDMAP_ERR_NOTFOUND); 1391c5c4113dSnw141292 } 1392c5c4113dSnw141292 1393cd37da74Snw141292 1394cd37da74Snw141292 static 1395cd37da74Snw141292 idmap_retcode 1396cd37da74Snw141292 lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user) 1397cd37da74Snw141292 { 1398c5c4113dSnw141292 int i; 1399e8c27ec8Sbaban if (req->id1.idmap_id_u.uid == SENTINEL_PID) 1400e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 140162c60062Sbaban for (i = 0; wksids[i].sidprefix != NULL; i++) { 140262c60062Sbaban if (wksids[i].pid == req->id1.idmap_id_u.uid && 140362c60062Sbaban wksids[i].is_user == is_user && 140462c60062Sbaban wksids[i].direction != IDMAP_DIRECTION_W2U) { 1405e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) { 1406e8c27ec8Sbaban res->id.idtype = (wksids[i].is_wuser) ? 1407e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 1408e8c27ec8Sbaban } 140962c60062Sbaban res->id.idmap_id_u.sid.rid = wksids[i].rid; 1410c5c4113dSnw141292 res->id.idmap_id_u.sid.prefix = 141162c60062Sbaban strdup(wksids[i].sidprefix); 1412c5c4113dSnw141292 if (res->id.idmap_id_u.sid.prefix == NULL) { 1413c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 1414c5c4113dSnw141292 return (IDMAP_ERR_MEMORY); 1415c5c4113dSnw141292 } 141662c60062Sbaban res->direction = wksids[i].direction; 141748258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 141848258c6bSjp151216 res->info.how.map_type = 141948258c6bSjp151216 IDMAP_MAP_TYPE_KNOWN_SID; 142048258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_HARD_CODED; 142148258c6bSjp151216 } 1422c5c4113dSnw141292 return (IDMAP_SUCCESS); 1423c5c4113dSnw141292 } 1424c5c4113dSnw141292 } 142562c60062Sbaban return (IDMAP_ERR_NOTFOUND); 142662c60062Sbaban } 142762c60062Sbaban 1428cd37da74Snw141292 idmap_retcode 1429cd37da74Snw141292 lookup_wksids_name2sid(const char *name, char **canonname, char **sidprefix, 1430cd37da74Snw141292 idmap_rid_t *rid, int *type) 1431cd37da74Snw141292 { 143262c60062Sbaban int i; 1433479ac375Sdm199847 1434479ac375Sdm199847 if ((strncasecmp(name, "BUILTIN\\", 8) == 0) || 1435479ac375Sdm199847 (strncasecmp(name, "BUILTIN/", 8) == 0)) 1436479ac375Sdm199847 name += 8; 1437479ac375Sdm199847 143862c60062Sbaban for (i = 0; wksids[i].sidprefix != NULL; i++) { 1439e8c27ec8Sbaban if (strcasecmp(wksids[i].winname, name) != 0) 1440e8c27ec8Sbaban continue; 1441e8c27ec8Sbaban if (sidprefix != NULL && 1442e8c27ec8Sbaban (*sidprefix = strdup(wksids[i].sidprefix)) == NULL) { 144362c60062Sbaban idmapdlog(LOG_ERR, "Out of memory"); 144462c60062Sbaban return (IDMAP_ERR_MEMORY); 144562c60062Sbaban } 1446cd37da74Snw141292 if (canonname != NULL && 1447cd37da74Snw141292 (*canonname = strdup(wksids[i].winname)) == NULL) { 1448cd37da74Snw141292 idmapdlog(LOG_ERR, "Out of memory"); 1449e8c27ec8Sbaban if (sidprefix != NULL) { 1450e8c27ec8Sbaban free(*sidprefix); 1451e8c27ec8Sbaban *sidprefix = NULL; 1452e8c27ec8Sbaban } 1453cd37da74Snw141292 return (IDMAP_ERR_MEMORY); 1454cd37da74Snw141292 } 145562c60062Sbaban if (type != NULL) 1456e8c27ec8Sbaban *type = (wksids[i].is_wuser) ? 145762c60062Sbaban _IDMAP_T_USER : _IDMAP_T_GROUP; 145862c60062Sbaban if (rid != NULL) 145962c60062Sbaban *rid = wksids[i].rid; 146062c60062Sbaban return (IDMAP_SUCCESS); 146162c60062Sbaban } 1462c5c4113dSnw141292 return (IDMAP_ERR_NOTFOUND); 1463c5c4113dSnw141292 } 1464c5c4113dSnw141292 1465cd37da74Snw141292 static 1466cd37da74Snw141292 idmap_retcode 1467cd37da74Snw141292 lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1468cd37da74Snw141292 { 1469c5c4113dSnw141292 char *end; 1470c5c4113dSnw141292 char *sql = NULL; 1471c5c4113dSnw141292 const char **values; 1472c5c4113dSnw141292 sqlite_vm *vm = NULL; 1473c5c4113dSnw141292 int ncol, is_user; 1474c5c4113dSnw141292 uid_t pid; 1475c5c4113dSnw141292 time_t curtime, exp; 1476c5c4113dSnw141292 idmap_retcode retcode; 1477042addd6Sbaban char *is_user_string, *lower_name; 1478c5c4113dSnw141292 1479c5c4113dSnw141292 /* Current time */ 1480c5c4113dSnw141292 errno = 0; 1481c5c4113dSnw141292 if ((curtime = time(NULL)) == (time_t)-1) { 1482cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1483c5c4113dSnw141292 strerror(errno)); 1484c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 1485c5c4113dSnw141292 goto out; 1486c5c4113dSnw141292 } 1487c5c4113dSnw141292 1488e8c27ec8Sbaban switch (res->id.idtype) { 1489cd37da74Snw141292 case IDMAP_UID: 1490cd37da74Snw141292 is_user_string = "1"; 1491cd37da74Snw141292 break; 1492cd37da74Snw141292 case IDMAP_GID: 1493cd37da74Snw141292 is_user_string = "0"; 1494cd37da74Snw141292 break; 1495cd37da74Snw141292 case IDMAP_POSIXID: 1496cd37da74Snw141292 /* the non-diagonal mapping */ 1497cd37da74Snw141292 is_user_string = "is_wuser"; 1498cd37da74Snw141292 break; 1499cd37da74Snw141292 default: 1500cd37da74Snw141292 retcode = IDMAP_ERR_NOTSUPPORTED; 1501cd37da74Snw141292 goto out; 1502cd37da74Snw141292 } 1503cd37da74Snw141292 1504c5c4113dSnw141292 /* SQL to lookup the cache */ 150548258c6bSjp151216 1506e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 1507e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 150848258c6bSjp151216 "unixname, u2w, is_wuser, " 150948258c6bSjp151216 "map_type, map_dn, map_attr, map_value, " 151048258c6bSjp151216 "map_windomain, map_winname, map_unixname, map_is_nt4 " 1511cd37da74Snw141292 "FROM idmap_cache WHERE is_user = %s AND " 1512c5c4113dSnw141292 "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 1513c5c4113dSnw141292 "(pid >= 2147483648 OR " 1514c5c4113dSnw141292 "(expiration = 0 OR expiration ISNULL OR " 1515c5c4113dSnw141292 "expiration > %d));", 1516e8c27ec8Sbaban is_user_string, req->id1.idmap_id_u.sid.prefix, 1517e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, curtime); 1518e8c27ec8Sbaban } else if (req->id1name != NULL) { 1519042addd6Sbaban if ((lower_name = tolower_u8(req->id1name)) == NULL) 1520042addd6Sbaban lower_name = req->id1name; 1521e8c27ec8Sbaban sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 152248258c6bSjp151216 "unixname, u2w, is_wuser, " 152348258c6bSjp151216 "map_type, map_dn, map_attr, map_value, " 152448258c6bSjp151216 "map_windomain, map_winname, map_unixname, map_is_nt4 " 1525e8c27ec8Sbaban "FROM idmap_cache WHERE is_user = %s AND " 1526e8c27ec8Sbaban "winname = %Q AND windomain = %Q AND w2u = 1 AND " 1527e8c27ec8Sbaban "(pid >= 2147483648 OR " 1528e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 1529e8c27ec8Sbaban "expiration > %d));", 153048258c6bSjp151216 is_user_string, lower_name, req->id1domain, 153148258c6bSjp151216 curtime); 1532042addd6Sbaban if (lower_name != req->id1name) 1533042addd6Sbaban free(lower_name); 1534e8c27ec8Sbaban } else { 1535e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 1536e8c27ec8Sbaban goto out; 1537e8c27ec8Sbaban } 1538c5c4113dSnw141292 if (sql == NULL) { 1539c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 1540c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 1541c5c4113dSnw141292 goto out; 1542c5c4113dSnw141292 } 154348258c6bSjp151216 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 154448258c6bSjp151216 14, &values); 1545c5c4113dSnw141292 sqlite_freemem(sql); 1546c5c4113dSnw141292 1547c5c4113dSnw141292 if (retcode == IDMAP_ERR_NOTFOUND) { 1548c5c4113dSnw141292 goto out; 1549c5c4113dSnw141292 } else if (retcode == IDMAP_SUCCESS) { 1550c5c4113dSnw141292 /* sanity checks */ 1551c5c4113dSnw141292 if (values[0] == NULL || values[1] == NULL) { 1552c5c4113dSnw141292 retcode = IDMAP_ERR_CACHE; 1553c5c4113dSnw141292 goto out; 1554c5c4113dSnw141292 } 1555c5c4113dSnw141292 1556c5c4113dSnw141292 pid = strtoul(values[0], &end, 10); 1557c5c4113dSnw141292 is_user = strncmp(values[1], "0", 2) ? 1 : 0; 1558c5c4113dSnw141292 1559cd37da74Snw141292 if (is_user) { 1560cd37da74Snw141292 res->id.idtype = IDMAP_UID; 1561cd37da74Snw141292 res->id.idmap_id_u.uid = pid; 1562cd37da74Snw141292 } else { 1563cd37da74Snw141292 res->id.idtype = IDMAP_GID; 1564cd37da74Snw141292 res->id.idmap_id_u.gid = pid; 1565cd37da74Snw141292 } 1566cd37da74Snw141292 1567c5c4113dSnw141292 /* 1568c5c4113dSnw141292 * We may have an expired ephemeral mapping. Consider 1569c5c4113dSnw141292 * the expired entry as valid if we are not going to 1570c5c4113dSnw141292 * perform name-based mapping. But do not renew the 1571c5c4113dSnw141292 * expiration. 1572c5c4113dSnw141292 * If we will be doing name-based mapping then store the 1573c5c4113dSnw141292 * ephemeral pid in the result so that we can use it 1574c5c4113dSnw141292 * if we end up doing dynamic mapping again. 1575c5c4113dSnw141292 */ 1576c5c4113dSnw141292 if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) && 1577cd37da74Snw141292 !AVOID_NAMESERVICE(req) && 1578cd37da74Snw141292 IS_EPHEMERAL(pid) && values[2] != NULL) { 1579c5c4113dSnw141292 exp = strtoll(values[2], &end, 10); 1580c5c4113dSnw141292 if (exp && exp <= curtime) { 1581c5c4113dSnw141292 /* Store the ephemeral pid */ 1582651c0131Sbaban res->direction = IDMAP_DIRECTION_BI; 1583cd37da74Snw141292 req->direction |= is_user 1584cd37da74Snw141292 ? _IDMAP_F_EXP_EPH_UID 1585cd37da74Snw141292 : _IDMAP_F_EXP_EPH_GID; 1586c5c4113dSnw141292 retcode = IDMAP_ERR_NOTFOUND; 1587c5c4113dSnw141292 } 1588c5c4113dSnw141292 } 1589c5c4113dSnw141292 } 1590c5c4113dSnw141292 1591c5c4113dSnw141292 out: 1592c5c4113dSnw141292 if (retcode == IDMAP_SUCCESS) { 159362c60062Sbaban if (values[4] != NULL) 1594c5c4113dSnw141292 res->direction = 1595651c0131Sbaban (strtol(values[4], &end, 10) == 0)? 1596651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 1597c5c4113dSnw141292 else 1598651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U; 1599c5c4113dSnw141292 160062c60062Sbaban if (values[3] != NULL) { 1601e8c27ec8Sbaban if (req->id2name != NULL) 1602e8c27ec8Sbaban free(req->id2name); 16038e228215Sdm199847 req->id2name = strdup(values[3]); 16048e228215Sdm199847 if (req->id2name == NULL) { 1605c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 1606c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 1607c5c4113dSnw141292 } 1608c5c4113dSnw141292 } 1609e8c27ec8Sbaban 1610e8c27ec8Sbaban req->id1.idtype = strncmp(values[5], "0", 2) ? 1611e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 161248258c6bSjp151216 161348258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 161448258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_CACHE; 161548258c6bSjp151216 res->info.how.map_type = strtoul(values[6], &end, 10); 161648258c6bSjp151216 switch (res->info.how.map_type) { 161748258c6bSjp151216 case IDMAP_MAP_TYPE_DS_AD: 161848258c6bSjp151216 res->info.how.idmap_how_u.ad.dn = 161948258c6bSjp151216 strdup(values[7]); 162048258c6bSjp151216 res->info.how.idmap_how_u.ad.attr = 162148258c6bSjp151216 strdup(values[8]); 162248258c6bSjp151216 res->info.how.idmap_how_u.ad.value = 162348258c6bSjp151216 strdup(values[9]); 162448258c6bSjp151216 break; 162548258c6bSjp151216 162648258c6bSjp151216 case IDMAP_MAP_TYPE_DS_NLDAP: 162748258c6bSjp151216 res->info.how.idmap_how_u.nldap.dn = 162848258c6bSjp151216 strdup(values[7]); 162948258c6bSjp151216 res->info.how.idmap_how_u.nldap.attr = 163048258c6bSjp151216 strdup(values[8]); 163148258c6bSjp151216 res->info.how.idmap_how_u.nldap.value = 163248258c6bSjp151216 strdup(values[9]); 163348258c6bSjp151216 break; 163448258c6bSjp151216 163548258c6bSjp151216 case IDMAP_MAP_TYPE_RULE_BASED: 163648258c6bSjp151216 res->info.how.idmap_how_u.rule.windomain = 163748258c6bSjp151216 strdup(values[10]); 163848258c6bSjp151216 res->info.how.idmap_how_u.rule.winname = 163948258c6bSjp151216 strdup(values[11]); 164048258c6bSjp151216 res->info.how.idmap_how_u.rule.unixname = 164148258c6bSjp151216 strdup(values[12]); 164248258c6bSjp151216 res->info.how.idmap_how_u.rule.is_nt4 = 164348258c6bSjp151216 strtoul(values[13], &end, 1); 164448258c6bSjp151216 res->info.how.idmap_how_u.rule.is_user = 164548258c6bSjp151216 is_user; 164648258c6bSjp151216 res->info.how.idmap_how_u.rule.is_wuser = 164748258c6bSjp151216 strtoul(values[5], &end, 1); 164848258c6bSjp151216 break; 164948258c6bSjp151216 165048258c6bSjp151216 case IDMAP_MAP_TYPE_EPHEMERAL: 165148258c6bSjp151216 break; 165248258c6bSjp151216 165348258c6bSjp151216 case IDMAP_MAP_TYPE_LOCAL_SID: 165448258c6bSjp151216 break; 165548258c6bSjp151216 165648258c6bSjp151216 case IDMAP_MAP_TYPE_KNOWN_SID: 165748258c6bSjp151216 break; 165848258c6bSjp151216 165948258c6bSjp151216 default: 166048258c6bSjp151216 /* Unknow mapping type */ 166148258c6bSjp151216 assert(FALSE); 166248258c6bSjp151216 } 166348258c6bSjp151216 } 1664c5c4113dSnw141292 } 166562c60062Sbaban if (vm != NULL) 1666c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL); 1667c5c4113dSnw141292 return (retcode); 1668c5c4113dSnw141292 } 1669c5c4113dSnw141292 1670cd37da74Snw141292 static 1671cd37da74Snw141292 idmap_retcode 167262c60062Sbaban lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid, 1673cd37da74Snw141292 char **name, char **domain, int *type) 1674cd37da74Snw141292 { 1675c5c4113dSnw141292 char *end; 1676c5c4113dSnw141292 char *sql = NULL; 1677c5c4113dSnw141292 const char **values; 1678c5c4113dSnw141292 sqlite_vm *vm = NULL; 1679c5c4113dSnw141292 int ncol; 1680c5c4113dSnw141292 time_t curtime; 1681c5c4113dSnw141292 idmap_retcode retcode = IDMAP_SUCCESS; 1682c5c4113dSnw141292 1683c5c4113dSnw141292 /* Get current time */ 1684c5c4113dSnw141292 errno = 0; 1685c5c4113dSnw141292 if ((curtime = time(NULL)) == (time_t)-1) { 1686cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1687c5c4113dSnw141292 strerror(errno)); 1688c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 1689c5c4113dSnw141292 goto out; 1690c5c4113dSnw141292 } 1691c5c4113dSnw141292 1692c5c4113dSnw141292 /* SQL to lookup the cache */ 1693cd37da74Snw141292 sql = sqlite_mprintf("SELECT canon_name, domain, type " 1694cd37da74Snw141292 "FROM name_cache WHERE " 1695c5c4113dSnw141292 "sidprefix = %Q AND rid = %u AND " 1696c5c4113dSnw141292 "(expiration = 0 OR expiration ISNULL OR " 1697c5c4113dSnw141292 "expiration > %d);", 1698c5c4113dSnw141292 sidprefix, rid, curtime); 1699c5c4113dSnw141292 if (sql == NULL) { 1700c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 1701c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 1702c5c4113dSnw141292 goto out; 1703c5c4113dSnw141292 } 1704c5c4113dSnw141292 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values); 1705c5c4113dSnw141292 sqlite_freemem(sql); 1706c5c4113dSnw141292 1707c5c4113dSnw141292 if (retcode == IDMAP_SUCCESS) { 170862c60062Sbaban if (type != NULL) { 1709c5c4113dSnw141292 if (values[2] == NULL) { 1710c5c4113dSnw141292 retcode = IDMAP_ERR_CACHE; 1711c5c4113dSnw141292 goto out; 1712c5c4113dSnw141292 } 1713c5c4113dSnw141292 *type = strtol(values[2], &end, 10); 1714c5c4113dSnw141292 } 1715c5c4113dSnw141292 171662c60062Sbaban if (name != NULL && values[0] != NULL) { 1717c5c4113dSnw141292 if ((*name = strdup(values[0])) == NULL) { 1718c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 1719c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 1720c5c4113dSnw141292 goto out; 1721c5c4113dSnw141292 } 1722c5c4113dSnw141292 } 1723c5c4113dSnw141292 172462c60062Sbaban if (domain != NULL && values[1] != NULL) { 1725c5c4113dSnw141292 if ((*domain = strdup(values[1])) == NULL) { 172662c60062Sbaban if (name != NULL && *name) { 1727c5c4113dSnw141292 free(*name); 1728c5c4113dSnw141292 *name = NULL; 1729c5c4113dSnw141292 } 1730c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 1731c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 1732c5c4113dSnw141292 goto out; 1733c5c4113dSnw141292 } 1734c5c4113dSnw141292 } 1735c5c4113dSnw141292 } 1736c5c4113dSnw141292 1737c5c4113dSnw141292 out: 173862c60062Sbaban if (vm != NULL) 1739c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL); 1740c5c4113dSnw141292 return (retcode); 1741c5c4113dSnw141292 } 1742c5c4113dSnw141292 1743c5c4113dSnw141292 /* 1744e8c27ec8Sbaban * Given SID, find winname using name_cache OR 1745e8c27ec8Sbaban * Given winname, find SID using name_cache. 1746e8c27ec8Sbaban * Used when mapping win to unix i.e. req->id1 is windows id and 1747e8c27ec8Sbaban * req->id2 is unix id 1748c5c4113dSnw141292 */ 1749cd37da74Snw141292 static 1750cd37da74Snw141292 idmap_retcode 1751e8c27ec8Sbaban lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1752cd37da74Snw141292 { 1753c5c4113dSnw141292 int type = -1; 1754c5c4113dSnw141292 idmap_retcode retcode; 1755e8c27ec8Sbaban char *sidprefix = NULL; 1756c5c4113dSnw141292 idmap_rid_t rid; 1757c5c4113dSnw141292 char *name = NULL, *domain = NULL; 1758c5c4113dSnw141292 1759e8c27ec8Sbaban /* Done if we've both sid and winname */ 1760e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL) 1761e8c27ec8Sbaban return (IDMAP_SUCCESS); 1762c5c4113dSnw141292 1763e8c27ec8Sbaban /* Lookup sid to winname */ 1764e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix != NULL) { 1765e8c27ec8Sbaban retcode = lookup_cache_sid2name(cache, 1766e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix, 1767e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid, &name, &domain, &type); 176862c60062Sbaban goto out; 1769e8c27ec8Sbaban } 177062c60062Sbaban 1771e8c27ec8Sbaban /* Lookup winame to sid */ 1772e8c27ec8Sbaban retcode = lookup_cache_name2sid(cache, req->id1name, req->id1domain, 1773e8c27ec8Sbaban &name, &sidprefix, &rid, &type); 1774c5c4113dSnw141292 177562c60062Sbaban out: 1776e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 1777c5c4113dSnw141292 free(name); 1778c5c4113dSnw141292 free(domain); 1779e8c27ec8Sbaban free(sidprefix); 1780e8c27ec8Sbaban return (retcode); 1781e8c27ec8Sbaban } 1782e8c27ec8Sbaban 1783e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) { 1784e8c27ec8Sbaban res->id.idtype = (type == _IDMAP_T_USER) ? 1785e8c27ec8Sbaban IDMAP_UID : IDMAP_GID; 1786e8c27ec8Sbaban } 1787e8c27ec8Sbaban req->id1.idtype = (type == _IDMAP_T_USER) ? 1788e8c27ec8Sbaban IDMAP_USID : IDMAP_GSID; 1789e8c27ec8Sbaban 1790e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 1791e8c27ec8Sbaban if (name != NULL) { 1792e8c27ec8Sbaban free(req->id1name); /* Free existing winname */ 1793e8c27ec8Sbaban req->id1name = name; /* and use canonical name instead */ 1794e8c27ec8Sbaban } 1795e8c27ec8Sbaban if (req->id1domain == NULL) 1796e8c27ec8Sbaban req->id1domain = domain; 1797e8c27ec8Sbaban if (req->id1.idmap_id_u.sid.prefix == NULL) { 1798e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = sidprefix; 1799e8c27ec8Sbaban req->id1.idmap_id_u.sid.rid = rid; 1800c5c4113dSnw141292 } 1801c5c4113dSnw141292 return (retcode); 1802c5c4113dSnw141292 } 1803c5c4113dSnw141292 1804e8c27ec8Sbaban /* 1805e8c27ec8Sbaban * Batch AD lookups 1806e8c27ec8Sbaban */ 1807c5c4113dSnw141292 idmap_retcode 1808e8c27ec8Sbaban ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch, 1809cd37da74Snw141292 idmap_ids_res *result) 1810cd37da74Snw141292 { 1811c5c4113dSnw141292 idmap_retcode retcode; 1812e8c27ec8Sbaban int i, add, type, is_wuser, is_user; 1813e8c27ec8Sbaban int retries = 0, eunixtype; 1814e8c27ec8Sbaban char **unixname; 1815c5c4113dSnw141292 idmap_mapping *req; 1816c5c4113dSnw141292 idmap_id_res *res; 1817e8c27ec8Sbaban idmap_query_state_t *qs = NULL; 181848258c6bSjp151216 idmap_how *how; 1819479ac375Sdm199847 char **dn, **attr, **value; 1820e8c27ec8Sbaban 1821e8c27ec8Sbaban /* 1822e8c27ec8Sbaban * Since req->id2.idtype is unused, we will use it here 1823e8c27ec8Sbaban * to retrieve the value of sid_type. But it needs to be 1824e8c27ec8Sbaban * reset to IDMAP_NONE before we return to prevent xdr 1825e8c27ec8Sbaban * from mis-interpreting req->id2 when it tries to free 1826e8c27ec8Sbaban * the input argument. Other option is to allocate an 1827e8c27ec8Sbaban * array of integers and use it instead for the batched 1828e8c27ec8Sbaban * call. But why un-necessarily allocate memory. That may 1829e8c27ec8Sbaban * be an option if req->id2.idtype cannot be re-used in 1830e8c27ec8Sbaban * future. 1831e8c27ec8Sbaban */ 1832c5c4113dSnw141292 1833c5c4113dSnw141292 if (state->ad_nqueries == 0) 1834c5c4113dSnw141292 return (IDMAP_SUCCESS); 1835c5c4113dSnw141292 183696c3a9a0Sbaban for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 183796c3a9a0Sbaban req = &batch->idmap_mapping_batch_val[i]; 183896c3a9a0Sbaban res = &result->ids.ids_val[i]; 183996c3a9a0Sbaban 184096c3a9a0Sbaban /* Skip if not marked for AD lookup or already in error. */ 184196c3a9a0Sbaban if (!(req->direction & _IDMAP_F_LOOKUP_AD) || 184296c3a9a0Sbaban res->retcode != IDMAP_SUCCESS) 184396c3a9a0Sbaban continue; 184496c3a9a0Sbaban 184596c3a9a0Sbaban /* Init status */ 184696c3a9a0Sbaban res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR; 184796c3a9a0Sbaban } 184896c3a9a0Sbaban 1849c5c4113dSnw141292 retry: 1850*2b4a7802SBaban Kenkre RDLOCK_CONFIG(); 1851e8c27ec8Sbaban retcode = idmap_lookup_batch_start(_idmapdstate.ad, state->ad_nqueries, 1852e8c27ec8Sbaban &qs); 1853*2b4a7802SBaban Kenkre UNLOCK_CONFIG(); 1854e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 1855*2b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 1856*2b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 18570dcc7149Snw141292 goto retry; 1858349d5d8fSnw141292 degrade_svc(1, "failed to create batch for AD lookup"); 1859e8c27ec8Sbaban goto out; 1860c5c4113dSnw141292 } 1861c5c4113dSnw141292 1862c8e26105Sjp151216 restore_svc(); 1863c8e26105Sjp151216 1864e8c27ec8Sbaban idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr, 1865e8c27ec8Sbaban state->ad_unixgroup_attr); 1866e8c27ec8Sbaban 1867e8c27ec8Sbaban for (i = 0, add = 0; i < batch->idmap_mapping_batch_len; i++) { 1868c5c4113dSnw141292 req = &batch->idmap_mapping_batch_val[i]; 1869c5c4113dSnw141292 res = &result->ids.ids_val[i]; 187048258c6bSjp151216 how = &res->info.how; 187148258c6bSjp151216 1872e8c27ec8Sbaban retcode = IDMAP_SUCCESS; 1873e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE; 1874c5c4113dSnw141292 1875e8c27ec8Sbaban /* Skip if not marked for AD lookup */ 1876e8c27ec8Sbaban if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 1877e8c27ec8Sbaban continue; 1878e8c27ec8Sbaban 187996c3a9a0Sbaban if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR) 1880c5c4113dSnw141292 continue; 1881e8c27ec8Sbaban 1882e8c27ec8Sbaban if (IS_REQUEST_SID(*req, 1)) { 1883e8c27ec8Sbaban 1884479ac375Sdm199847 /* win2unix request: */ 1885e8c27ec8Sbaban 1886479ac375Sdm199847 unixname = dn = attr = value = NULL; 1887e8c27ec8Sbaban eunixtype = _IDMAP_T_UNDEF; 1888e8c27ec8Sbaban if (req->id2name == NULL) { 1889e8c27ec8Sbaban if (res->id.idtype == IDMAP_UID && 1890e8c27ec8Sbaban AD_OR_MIXED(state->nm_siduid)) { 1891e8c27ec8Sbaban eunixtype = _IDMAP_T_USER; 1892e8c27ec8Sbaban unixname = &req->id2name; 1893e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GID && 1894e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) { 1895e8c27ec8Sbaban eunixtype = _IDMAP_T_GROUP; 1896e8c27ec8Sbaban unixname = &req->id2name; 1897e8c27ec8Sbaban } else if (AD_OR_MIXED(state->nm_siduid) || 1898e8c27ec8Sbaban AD_OR_MIXED(state->nm_sidgid)) { 1899e8c27ec8Sbaban unixname = &req->id2name; 1900e8c27ec8Sbaban } 1901e8c27ec8Sbaban } 1902e8c27ec8Sbaban add = 1; 1903479ac375Sdm199847 if (unixname != NULL) { 1904479ac375Sdm199847 /* 1905479ac375Sdm199847 * Get how info for DS-based name 1906479ac375Sdm199847 * mapping only if AD or MIXED 1907479ac375Sdm199847 * mode is enabled. 1908479ac375Sdm199847 */ 1909479ac375Sdm199847 idmap_info_free(&res->info); 191048258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW; 191148258c6bSjp151216 how->map_type = IDMAP_MAP_TYPE_DS_AD; 1912479ac375Sdm199847 dn = &how->idmap_how_u.ad.dn; 1913479ac375Sdm199847 attr = &how->idmap_how_u.ad.attr; 1914479ac375Sdm199847 value = &how->idmap_how_u.ad.value; 1915479ac375Sdm199847 } 1916479ac375Sdm199847 if (req->id1.idmap_id_u.sid.prefix != NULL) { 1917479ac375Sdm199847 /* Lookup AD by SID */ 1918c5c4113dSnw141292 retcode = idmap_sid2name_batch_add1( 1919e8c27ec8Sbaban qs, req->id1.idmap_id_u.sid.prefix, 1920e8c27ec8Sbaban &req->id1.idmap_id_u.sid.rid, eunixtype, 1921479ac375Sdm199847 dn, attr, value, 1922479ac375Sdm199847 (req->id1name == NULL) ? 1923479ac375Sdm199847 &req->id1name : NULL, 1924479ac375Sdm199847 (req->id1domain == NULL) ? 1925479ac375Sdm199847 &req->id1domain : NULL, 1926479ac375Sdm199847 (int *)&req->id2.idtype, unixname, 1927479ac375Sdm199847 &res->retcode); 1928479ac375Sdm199847 } else { 1929479ac375Sdm199847 /* Lookup AD by winname */ 1930479ac375Sdm199847 assert(req->id1name != NULL); 1931479ac375Sdm199847 retcode = idmap_name2sid_batch_add1( 1932479ac375Sdm199847 qs, req->id1name, req->id1domain, 1933479ac375Sdm199847 eunixtype, 1934479ac375Sdm199847 dn, attr, value, 1935479ac375Sdm199847 &req->id1name, 1936479ac375Sdm199847 &req->id1.idmap_id_u.sid.prefix, 1937479ac375Sdm199847 &req->id1.idmap_id_u.sid.rid, 1938479ac375Sdm199847 (int *)&req->id2.idtype, unixname, 1939479ac375Sdm199847 &res->retcode); 1940479ac375Sdm199847 } 1941c5c4113dSnw141292 1942e8c27ec8Sbaban } else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) { 1943479ac375Sdm199847 1944479ac375Sdm199847 /* unix2win request: */ 1945e8c27ec8Sbaban 1946e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL && 1947e8c27ec8Sbaban req->id2name != NULL) { 1948e8c27ec8Sbaban /* Already have SID and winname -- done */ 1949e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS; 1950e8c27ec8Sbaban continue; 1951c5c4113dSnw141292 } 1952c5c4113dSnw141292 1953e8c27ec8Sbaban if (res->id.idmap_id_u.sid.prefix != NULL) { 1954cd37da74Snw141292 /* 1955e8c27ec8Sbaban * SID but no winname -- lookup AD by 1956e8c27ec8Sbaban * SID to get winname. 1957479ac375Sdm199847 * how info is not needed here because 1958479ac375Sdm199847 * we are not retrieving unixname from 1959479ac375Sdm199847 * AD. 1960cd37da74Snw141292 */ 1961e8c27ec8Sbaban add = 1; 1962e8c27ec8Sbaban retcode = idmap_sid2name_batch_add1( 1963e8c27ec8Sbaban qs, res->id.idmap_id_u.sid.prefix, 1964e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 196548258c6bSjp151216 _IDMAP_T_UNDEF, 1966479ac375Sdm199847 NULL, NULL, NULL, 196748258c6bSjp151216 &req->id2name, 1968e8c27ec8Sbaban &req->id2domain, (int *)&req->id2.idtype, 1969e8c27ec8Sbaban NULL, &res->retcode); 1970e8c27ec8Sbaban } else if (req->id2name != NULL) { 1971e8c27ec8Sbaban /* 1972e8c27ec8Sbaban * winname but no SID -- lookup AD by 1973e8c27ec8Sbaban * winname to get SID. 1974479ac375Sdm199847 * how info is not needed here because 1975479ac375Sdm199847 * we are not retrieving unixname from 1976479ac375Sdm199847 * AD. 1977e8c27ec8Sbaban */ 1978e8c27ec8Sbaban add = 1; 1979e8c27ec8Sbaban retcode = idmap_name2sid_batch_add1( 1980e8c27ec8Sbaban qs, req->id2name, req->id2domain, 198148258c6bSjp151216 _IDMAP_T_UNDEF, 1982479ac375Sdm199847 NULL, NULL, NULL, NULL, 1983e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix, 1984e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 1985e8c27ec8Sbaban (int *)&req->id2.idtype, NULL, 1986e8c27ec8Sbaban &res->retcode); 1987e8c27ec8Sbaban } else if (req->id1name != NULL) { 1988e8c27ec8Sbaban /* 1989e8c27ec8Sbaban * No SID and no winname but we've unixname -- 1990e8c27ec8Sbaban * lookup AD by unixname to get SID. 1991e8c27ec8Sbaban */ 1992e8c27ec8Sbaban is_user = (IS_REQUEST_UID(*req)) ? 1 : 0; 1993e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID) 1994e8c27ec8Sbaban is_wuser = 1; 1995e8c27ec8Sbaban else if (res->id.idtype == IDMAP_GSID) 1996e8c27ec8Sbaban is_wuser = 0; 1997e8c27ec8Sbaban else 1998e8c27ec8Sbaban is_wuser = is_user; 1999e8c27ec8Sbaban add = 1; 2000479ac375Sdm199847 idmap_info_free(&res->info); 200148258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW; 200248258c6bSjp151216 how->map_type = IDMAP_MAP_TYPE_DS_AD; 2003e8c27ec8Sbaban retcode = idmap_unixname2sid_batch_add1( 2004e8c27ec8Sbaban qs, req->id1name, is_user, is_wuser, 200548258c6bSjp151216 &how->idmap_how_u.ad.dn, 200648258c6bSjp151216 &how->idmap_how_u.ad.attr, 200748258c6bSjp151216 &how->idmap_how_u.ad.value, 2008e8c27ec8Sbaban &res->id.idmap_id_u.sid.prefix, 2009e8c27ec8Sbaban &res->id.idmap_id_u.sid.rid, 2010e8c27ec8Sbaban &req->id2name, &req->id2domain, 2011e8c27ec8Sbaban (int *)&req->id2.idtype, &res->retcode); 2012e8c27ec8Sbaban } 2013e8c27ec8Sbaban } 2014e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 2015e8c27ec8Sbaban idmap_lookup_release_batch(&qs); 2016e8c27ec8Sbaban break; 2017e8c27ec8Sbaban } 2018cd37da74Snw141292 } 2019cd37da74Snw141292 202096c3a9a0Sbaban if (retcode == IDMAP_SUCCESS) { 202196c3a9a0Sbaban /* add keeps track if we added an entry to the batch */ 202296c3a9a0Sbaban if (add) 20230dcc7149Snw141292 retcode = idmap_lookup_batch_end(&qs); 202496c3a9a0Sbaban else 202596c3a9a0Sbaban idmap_lookup_release_batch(&qs); 202696c3a9a0Sbaban } 2027cd37da74Snw141292 2028*2b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 2029*2b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 2030c5c4113dSnw141292 goto retry; 2031c8e26105Sjp151216 else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 2032349d5d8fSnw141292 degrade_svc(1, "some AD lookups timed out repeatedly"); 2033c5c4113dSnw141292 2034e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 2035e8c27ec8Sbaban idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests"); 2036c5c4113dSnw141292 2037c5c4113dSnw141292 out: 2038e8c27ec8Sbaban /* 2039e8c27ec8Sbaban * This loop does the following: 2040479ac375Sdm199847 * 1. Reset _IDMAP_F_LOOKUP_AD flag from the request. 2041479ac375Sdm199847 * 2. Reset req->id2.idtype to IDMAP_NONE 2042479ac375Sdm199847 * 3. If batch_start or batch_add failed then set the status 2043479ac375Sdm199847 * of each request marked for AD lookup to that error. 2044479ac375Sdm199847 * 4. Evaluate the type of the AD object (i.e. user or group) and 2045479ac375Sdm199847 * update the idtype in request. 2046e8c27ec8Sbaban */ 2047e8c27ec8Sbaban for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 2048e8c27ec8Sbaban req = &batch->idmap_mapping_batch_val[i]; 2049e8c27ec8Sbaban type = req->id2.idtype; 2050e8c27ec8Sbaban req->id2.idtype = IDMAP_NONE; 20515e0794bcSbaban res = &result->ids.ids_val[i]; 205248258c6bSjp151216 how = &res->info.how; 2053e8c27ec8Sbaban if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 2054e8c27ec8Sbaban continue; 2055e8c27ec8Sbaban 2056479ac375Sdm199847 /* Reset AD lookup flag */ 2057479ac375Sdm199847 req->direction &= ~(_IDMAP_F_LOOKUP_AD); 2058479ac375Sdm199847 2059479ac375Sdm199847 /* 2060479ac375Sdm199847 * If batch_start or batch_add failed then set the status 2061479ac375Sdm199847 * of each request marked for AD lookup to that error. 2062479ac375Sdm199847 */ 2063e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 2064e8c27ec8Sbaban res->retcode = retcode; 2065e8c27ec8Sbaban continue; 2066e8c27ec8Sbaban } 2067e8c27ec8Sbaban 2068e8c27ec8Sbaban if (!add) 2069e8c27ec8Sbaban continue; 2070e8c27ec8Sbaban 207148258c6bSjp151216 if (res->retcode == IDMAP_ERR_NOTFOUND) { 207248258c6bSjp151216 /* Nothing found - remove the preset info */ 2073479ac375Sdm199847 idmap_info_free(&res->info); 207448258c6bSjp151216 } 207548258c6bSjp151216 2076e8c27ec8Sbaban if (IS_REQUEST_SID(*req, 1)) { 2077e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) 2078e8c27ec8Sbaban continue; 2079479ac375Sdm199847 /* Evaluate result type */ 2080e8c27ec8Sbaban switch (type) { 2081e8c27ec8Sbaban case _IDMAP_T_USER: 2082e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) 2083e8c27ec8Sbaban res->id.idtype = IDMAP_UID; 2084e8c27ec8Sbaban req->id1.idtype = IDMAP_USID; 2085e8c27ec8Sbaban break; 2086e8c27ec8Sbaban case _IDMAP_T_GROUP: 2087e8c27ec8Sbaban if (res->id.idtype == IDMAP_POSIXID) 2088e8c27ec8Sbaban res->id.idtype = IDMAP_GID; 2089e8c27ec8Sbaban req->id1.idtype = IDMAP_GSID; 2090e8c27ec8Sbaban break; 2091e8c27ec8Sbaban default: 2092e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID; 2093e8c27ec8Sbaban break; 2094e8c27ec8Sbaban } 2095479ac375Sdm199847 if (res->retcode == IDMAP_SUCCESS && 2096479ac375Sdm199847 req->id1name != NULL && 2097479ac375Sdm199847 (req->id2name == NULL || 2098479ac375Sdm199847 res->id.idmap_id_u.uid == SENTINEL_PID) && 2099479ac375Sdm199847 NLDAP_MODE(res->id.idtype, state)) { 2100479ac375Sdm199847 req->direction |= _IDMAP_F_LOOKUP_NLDAP; 2101479ac375Sdm199847 state->nldap_nqueries++; 2102479ac375Sdm199847 } 2103e8c27ec8Sbaban } else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) { 2104e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 2105e8c27ec8Sbaban if ((!(IDMAP_FATAL_ERROR(res->retcode))) && 2106e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix == NULL && 2107e8c27ec8Sbaban req->id2name == NULL && /* no winname */ 2108e8c27ec8Sbaban req->id1name != NULL) /* unixname */ 2109e8c27ec8Sbaban /* 2110479ac375Sdm199847 * If AD lookup by unixname failed 2111479ac375Sdm199847 * with non fatal error then clear 2112479ac375Sdm199847 * the error (i.e set res->retcode 2113479ac375Sdm199847 * to success). This allows the next 2114479ac375Sdm199847 * pass to process other mapping 2115479ac375Sdm199847 * mechanisms for this request. 2116e8c27ec8Sbaban */ 2117e8c27ec8Sbaban res->retcode = IDMAP_SUCCESS; 2118e8c27ec8Sbaban continue; 2119e8c27ec8Sbaban } 2120479ac375Sdm199847 /* Evaluate result type */ 2121e8c27ec8Sbaban switch (type) { 2122e8c27ec8Sbaban case _IDMAP_T_USER: 2123e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2124e8c27ec8Sbaban res->id.idtype = IDMAP_USID; 2125e8c27ec8Sbaban break; 2126e8c27ec8Sbaban case _IDMAP_T_GROUP: 2127e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2128e8c27ec8Sbaban res->id.idtype = IDMAP_GSID; 2129e8c27ec8Sbaban break; 2130e8c27ec8Sbaban default: 2131e8c27ec8Sbaban res->retcode = IDMAP_ERR_SID; 2132e8c27ec8Sbaban break; 2133e8c27ec8Sbaban } 2134e8c27ec8Sbaban } 2135e8c27ec8Sbaban } 2136e8c27ec8Sbaban 2137e8c27ec8Sbaban /* AD lookups done. Reset state->ad_nqueries and return */ 2138e8c27ec8Sbaban state->ad_nqueries = 0; 2139c5c4113dSnw141292 return (retcode); 2140c5c4113dSnw141292 } 2141c5c4113dSnw141292 2142cd37da74Snw141292 /* 2143cd37da74Snw141292 * Convention when processing win2unix requests: 2144cd37da74Snw141292 * 2145cd37da74Snw141292 * Windows identity: 2146cd37da74Snw141292 * req->id1name = 2147cd37da74Snw141292 * winname if given otherwise winname found will be placed 2148cd37da74Snw141292 * here. 2149cd37da74Snw141292 * req->id1domain = 2150cd37da74Snw141292 * windomain if given otherwise windomain found will be 2151cd37da74Snw141292 * placed here. 2152cd37da74Snw141292 * req->id1.idtype = 2153cd37da74Snw141292 * Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll 2154cd37da74Snw141292 * be set to IDMAP_USID/GSID depending upon whether the 2155cd37da74Snw141292 * given SID is user or group respectively. The user/group-ness 2156cd37da74Snw141292 * is determined either when looking up well-known SIDs table OR 2157479ac375Sdm199847 * if the SID is found in namecache OR by ad_lookup_one() OR by 2158cd37da74Snw141292 * ad_lookup_batch(). 2159cd37da74Snw141292 * req->id1..sid.[prefix, rid] = 2160cd37da74Snw141292 * SID if given otherwise SID found will be placed here. 2161cd37da74Snw141292 * 2162cd37da74Snw141292 * Unix identity: 2163cd37da74Snw141292 * req->id2name = 2164cd37da74Snw141292 * unixname found will be placed here. 2165cd37da74Snw141292 * req->id2domain = 2166cd37da74Snw141292 * NOT USED 2167cd37da74Snw141292 * res->id.idtype = 2168cd37da74Snw141292 * Target type initialized from req->id2.idtype. If 2169cd37da74Snw141292 * it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found 2170cd37da74Snw141292 * will be placed here. 2171cd37da74Snw141292 * res->id..[uid or gid] = 2172cd37da74Snw141292 * UID/GID found will be placed here. 2173cd37da74Snw141292 * 2174cd37da74Snw141292 * Others: 2175cd37da74Snw141292 * res->retcode = 2176cd37da74Snw141292 * Return status for this request will be placed here. 2177cd37da74Snw141292 * res->direction = 2178cd37da74Snw141292 * Direction found will be placed here. Direction 2179cd37da74Snw141292 * meaning whether the resultant mapping is valid 2180cd37da74Snw141292 * only from win2unix or bi-directional. 2181cd37da74Snw141292 * req->direction = 2182cd37da74Snw141292 * INTERNAL USE. Used by idmapd to set various 2183cd37da74Snw141292 * flags (_IDMAP_F_xxxx) to aid in processing 2184cd37da74Snw141292 * of the request. 2185cd37da74Snw141292 * req->id2.idtype = 2186cd37da74Snw141292 * INTERNAL USE. Initially this is the requested target 2187cd37da74Snw141292 * type and is used to initialize res->id.idtype. 2188cd37da74Snw141292 * ad_lookup_batch() uses this field temporarily to store 2189cd37da74Snw141292 * sid_type obtained by the batched AD lookups and after 2190cd37da74Snw141292 * use resets it to IDMAP_NONE to prevent xdr from 2191cd37da74Snw141292 * mis-interpreting the contents of req->id2. 2192cd37da74Snw141292 * req->id2..[uid or gid or sid] = 2193cd37da74Snw141292 * NOT USED 2194cd37da74Snw141292 */ 2195cd37da74Snw141292 2196cd37da74Snw141292 /* 2197cd37da74Snw141292 * This function does the following: 2198cd37da74Snw141292 * 1. Lookup well-known SIDs table. 2199cd37da74Snw141292 * 2. Check if the given SID is a local-SID and if so extract UID/GID from it. 2200cd37da74Snw141292 * 3. Lookup cache. 2201cd37da74Snw141292 * 4. Check if the client does not want new mapping to be allocated 2202cd37da74Snw141292 * in which case this pass is the final pass. 2203cd37da74Snw141292 * 5. Set AD lookup flag if it determines that the next stage needs 2204cd37da74Snw141292 * to do AD lookup. 2205cd37da74Snw141292 */ 2206c5c4113dSnw141292 idmap_retcode 2207479ac375Sdm199847 sid2pid_first_pass(lookup_state_t *state, idmap_mapping *req, 2208cd37da74Snw141292 idmap_id_res *res) 2209cd37da74Snw141292 { 2210c5c4113dSnw141292 idmap_retcode retcode; 2211e8c27ec8Sbaban int wksid; 2212c5c4113dSnw141292 2213e8c27ec8Sbaban /* Initialize result */ 2214e8c27ec8Sbaban res->id.idtype = req->id2.idtype; 2215e8c27ec8Sbaban res->id.idmap_id_u.uid = SENTINEL_PID; 2216e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF; 2217e8c27ec8Sbaban wksid = 0; 2218c5c4113dSnw141292 2219cf5b5989Sdm199847 if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) { 2220e8c27ec8Sbaban if (req->id1name == NULL) { 2221e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 2222c5c4113dSnw141292 goto out; 2223c5c4113dSnw141292 } 2224e8c27ec8Sbaban /* sanitize sidprefix */ 2225e8c27ec8Sbaban free(req->id1.idmap_id_u.sid.prefix); 2226e8c27ec8Sbaban req->id1.idmap_id_u.sid.prefix = NULL; 2227e8c27ec8Sbaban } 2228c5c4113dSnw141292 2229e8c27ec8Sbaban /* Lookup well-known SIDs table */ 2230e8c27ec8Sbaban retcode = lookup_wksids_sid2pid(req, res, &wksid); 2231c5c4113dSnw141292 if (retcode != IDMAP_ERR_NOTFOUND) 2232c5c4113dSnw141292 goto out; 2233c5c4113dSnw141292 2234e8c27ec8Sbaban if (!wksid) { 2235*2b4a7802SBaban Kenkre /* Check if this is a localsid */ 2236e8c27ec8Sbaban retcode = lookup_localsid2pid(req, res); 2237e8c27ec8Sbaban if (retcode != IDMAP_ERR_NOTFOUND) 2238e8c27ec8Sbaban goto out; 2239*2b4a7802SBaban Kenkre 2240*2b4a7802SBaban Kenkre if (ALLOW_WK_OR_LOCAL_SIDS_ONLY(req)) { 2241*2b4a7802SBaban Kenkre retcode = IDMAP_ERR_NONEGENERATED; 2242*2b4a7802SBaban Kenkre goto out; 2243*2b4a7802SBaban Kenkre } 2244e8c27ec8Sbaban } 2245e8c27ec8Sbaban 2246e8c27ec8Sbaban /* Lookup cache */ 2247479ac375Sdm199847 retcode = lookup_cache_sid2pid(state->cache, req, res); 2248c5c4113dSnw141292 if (retcode != IDMAP_ERR_NOTFOUND) 2249c5c4113dSnw141292 goto out; 2250c5c4113dSnw141292 2251c5c4113dSnw141292 if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) { 225248258c6bSjp151216 retcode = IDMAP_ERR_NONEGENERATED; 2253c5c4113dSnw141292 goto out; 2254c5c4113dSnw141292 } 2255c5c4113dSnw141292 2256c5c4113dSnw141292 /* 2257e8c27ec8Sbaban * Failed to find non-expired entry in cache. Next step is 2258e8c27ec8Sbaban * to determine if this request needs to be batched for AD lookup. 2259e8c27ec8Sbaban * 2260e8c27ec8Sbaban * At this point we have either sid or winname or both. If we don't 2261e8c27ec8Sbaban * have both then lookup name_cache for the sid or winname 2262e8c27ec8Sbaban * whichever is missing. If not found then this request will be 2263e8c27ec8Sbaban * batched for AD lookup. 2264e8c27ec8Sbaban */ 2265479ac375Sdm199847 retcode = lookup_name_cache(state->cache, req, res); 2266e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS && retcode != IDMAP_ERR_NOTFOUND) 2267e8c27ec8Sbaban goto out; 2268e8c27ec8Sbaban 2269e8c27ec8Sbaban /* 2270e8c27ec8Sbaban * Set the flag to indicate that we are not done yet so that 2271e8c27ec8Sbaban * subsequent passes considers this request for name-based 2272e8c27ec8Sbaban * mapping and ephemeral mapping. 2273c5c4113dSnw141292 */ 2274c5c4113dSnw141292 state->sid2pid_done = FALSE; 2275e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE; 2276c5c4113dSnw141292 2277c5c4113dSnw141292 /* 2278e8c27ec8Sbaban * Even if we have both sid and winname, we still may need to batch 2279e8c27ec8Sbaban * this request for AD lookup if we don't have unixname and 2280e8c27ec8Sbaban * directory-based name mapping (AD or mixed) is enabled. 2281e8c27ec8Sbaban * We avoid AD lookup for well-known SIDs because they don't have 2282e8c27ec8Sbaban * regular AD objects. 2283c5c4113dSnw141292 */ 2284e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS || 2285e8c27ec8Sbaban (!wksid && req->id2name == NULL && 2286e8c27ec8Sbaban AD_OR_MIXED_MODE(res->id.idtype, state))) { 2287c5c4113dSnw141292 retcode = IDMAP_SUCCESS; 2288e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD; 2289c5c4113dSnw141292 state->ad_nqueries++; 2290479ac375Sdm199847 } else if (NLDAP_MODE(res->id.idtype, state)) { 2291479ac375Sdm199847 req->direction |= _IDMAP_F_LOOKUP_NLDAP; 2292479ac375Sdm199847 state->nldap_nqueries++; 2293c5c4113dSnw141292 } 2294c5c4113dSnw141292 2295c5c4113dSnw141292 2296c5c4113dSnw141292 out: 2297c5c4113dSnw141292 res->retcode = idmap_stat4prot(retcode); 2298e8c27ec8Sbaban /* 2299e8c27ec8Sbaban * If we are done and there was an error then set fallback pid 2300e8c27ec8Sbaban * in the result. 2301e8c27ec8Sbaban */ 2302e8c27ec8Sbaban if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) 2303e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY; 2304c5c4113dSnw141292 return (retcode); 2305c5c4113dSnw141292 } 2306c5c4113dSnw141292 2307c5c4113dSnw141292 /* 2308c5c4113dSnw141292 * Generate SID using the following convention 2309c5c4113dSnw141292 * <machine-sid-prefix>-<1000 + uid> 2310c5c4113dSnw141292 * <machine-sid-prefix>-<2^31 + gid> 2311c5c4113dSnw141292 */ 2312cd37da74Snw141292 static 2313cd37da74Snw141292 idmap_retcode 231448258c6bSjp151216 generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user, 231548258c6bSjp151216 int fallback) 2316cd37da74Snw141292 { 2317e8c27ec8Sbaban free(res->id.idmap_id_u.sid.prefix); 2318e8c27ec8Sbaban res->id.idmap_id_u.sid.prefix = NULL; 2319e8c27ec8Sbaban 2320e8c27ec8Sbaban /* 2321e8c27ec8Sbaban * Diagonal mapping for localSIDs not supported because of the 2322e8c27ec8Sbaban * way we generate localSIDs. 2323e8c27ec8Sbaban */ 2324e8c27ec8Sbaban if (is_user && res->id.idtype == IDMAP_GSID) 2325e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 2326e8c27ec8Sbaban if (!is_user && res->id.idtype == IDMAP_USID) 2327e8c27ec8Sbaban return (IDMAP_ERR_NOMAPPING); 2328e8c27ec8Sbaban 2329c5c4113dSnw141292 /* Skip 1000 UIDs */ 2330c5c4113dSnw141292 if (is_user && req->id1.idmap_id_u.uid > 2331c5c4113dSnw141292 (INT32_MAX - LOCALRID_MIN)) 233262c60062Sbaban return (IDMAP_ERR_NOMAPPING); 2333c5c4113dSnw141292 2334c5c4113dSnw141292 RDLOCK_CONFIG(); 2335e8c27ec8Sbaban /* 2336e8c27ec8Sbaban * machine_sid is never NULL because if it is we won't be here. 2337e8c27ec8Sbaban * No need to assert because stdrup(NULL) will core anyways. 2338e8c27ec8Sbaban */ 2339c5c4113dSnw141292 res->id.idmap_id_u.sid.prefix = 2340c5c4113dSnw141292 strdup(_idmapdstate.cfg->pgcfg.machine_sid); 2341c5c4113dSnw141292 if (res->id.idmap_id_u.sid.prefix == NULL) { 2342c5c4113dSnw141292 UNLOCK_CONFIG(); 2343c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 2344c5c4113dSnw141292 return (IDMAP_ERR_MEMORY); 2345c5c4113dSnw141292 } 2346c5c4113dSnw141292 UNLOCK_CONFIG(); 2347c5c4113dSnw141292 res->id.idmap_id_u.sid.rid = 2348c5c4113dSnw141292 (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_MIN : 2349c5c4113dSnw141292 req->id1.idmap_id_u.gid + INT32_MAX + 1; 2350651c0131Sbaban res->direction = IDMAP_DIRECTION_BI; 2351e8c27ec8Sbaban if (res->id.idtype == IDMAP_SID) 2352e8c27ec8Sbaban res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 2353c5c4113dSnw141292 235448258c6bSjp151216 if (!fallback && req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 235548258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 235648258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 235748258c6bSjp151216 } 235848258c6bSjp151216 2359c5c4113dSnw141292 /* 2360c5c4113dSnw141292 * Don't update name_cache because local sids don't have 2361c5c4113dSnw141292 * valid windows names. 2362c5c4113dSnw141292 */ 2363e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 2364947c7bc0Sbaban return (IDMAP_SUCCESS); 2365c5c4113dSnw141292 } 2366c5c4113dSnw141292 2367cd37da74Snw141292 static 2368cd37da74Snw141292 idmap_retcode 2369cd37da74Snw141292 lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res) 2370cd37da74Snw141292 { 2371c5c4113dSnw141292 char *sidprefix; 2372c5c4113dSnw141292 uint32_t rid; 2373c5c4113dSnw141292 int s; 2374c5c4113dSnw141292 2375c5c4113dSnw141292 /* 2376c5c4113dSnw141292 * If the sidprefix == localsid then UID = last RID - 1000 or 2377c5c4113dSnw141292 * GID = last RID - 2^31. 2378c5c4113dSnw141292 */ 2379e8c27ec8Sbaban if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL) 2380e8c27ec8Sbaban /* This means we are looking up by winname */ 2381e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2382c5c4113dSnw141292 rid = req->id1.idmap_id_u.sid.rid; 2383c5c4113dSnw141292 2384c5c4113dSnw141292 RDLOCK_CONFIG(); 2385c5c4113dSnw141292 s = (_idmapdstate.cfg->pgcfg.machine_sid) ? 2386cd37da74Snw141292 strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1; 2387c5c4113dSnw141292 UNLOCK_CONFIG(); 2388c5c4113dSnw141292 2389e8c27ec8Sbaban /* 2390e8c27ec8Sbaban * If the given sidprefix does not match machine_sid then this is 2391e8c27ec8Sbaban * not a local SID. 2392e8c27ec8Sbaban */ 2393e8c27ec8Sbaban if (s != 0) 2394e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2395e8c27ec8Sbaban 2396e8c27ec8Sbaban switch (res->id.idtype) { 2397c5c4113dSnw141292 case IDMAP_UID: 2398e8c27ec8Sbaban if (rid > INT32_MAX || rid < LOCALRID_MIN) 2399e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2400c5c4113dSnw141292 res->id.idmap_id_u.uid = rid - LOCALRID_MIN; 2401c5c4113dSnw141292 break; 2402c5c4113dSnw141292 case IDMAP_GID: 2403e8c27ec8Sbaban if (rid <= INT32_MAX) 2404e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2405c5c4113dSnw141292 res->id.idmap_id_u.gid = rid - INT32_MAX - 1; 2406c5c4113dSnw141292 break; 2407c5c4113dSnw141292 case IDMAP_POSIXID: 2408c5c4113dSnw141292 if (rid > INT32_MAX) { 2409cd37da74Snw141292 res->id.idmap_id_u.gid = rid - INT32_MAX - 1; 2410c5c4113dSnw141292 res->id.idtype = IDMAP_GID; 2411c5c4113dSnw141292 } else if (rid < LOCALRID_MIN) { 2412e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2413c5c4113dSnw141292 } else { 2414c5c4113dSnw141292 res->id.idmap_id_u.uid = rid - LOCALRID_MIN; 2415c5c4113dSnw141292 res->id.idtype = IDMAP_UID; 2416c5c4113dSnw141292 } 2417c5c4113dSnw141292 break; 2418c5c4113dSnw141292 default: 2419c5c4113dSnw141292 return (IDMAP_ERR_NOTSUPPORTED); 2420c5c4113dSnw141292 } 242148258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 242248258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 242348258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 242448258c6bSjp151216 } 2425c5c4113dSnw141292 return (IDMAP_SUCCESS); 2426c5c4113dSnw141292 } 2427c5c4113dSnw141292 2428e8c27ec8Sbaban /* 2429e8c27ec8Sbaban * Name service lookup by unixname to get pid 2430e8c27ec8Sbaban */ 2431cd37da74Snw141292 static 2432cd37da74Snw141292 idmap_retcode 2433e8c27ec8Sbaban ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id) 2434cd37da74Snw141292 { 2435cd37da74Snw141292 struct passwd pwd, *pwdp; 2436cd37da74Snw141292 struct group grp, *grpp; 2437c5c4113dSnw141292 char buf[1024]; 2438c5c4113dSnw141292 int errnum; 2439c5c4113dSnw141292 const char *me = "ns_lookup_byname"; 2440c5c4113dSnw141292 2441e8c27ec8Sbaban switch (id->idtype) { 2442e8c27ec8Sbaban case IDMAP_UID: 2443cd37da74Snw141292 pwdp = getpwnam_r(name, &pwd, buf, sizeof (buf)); 2444e8c27ec8Sbaban if (pwdp == NULL && errno == 0 && lower_name != NULL && 2445cd37da74Snw141292 name != lower_name && strcmp(name, lower_name) != 0) 2446cd37da74Snw141292 pwdp = getpwnam_r(lower_name, &pwd, buf, sizeof (buf)); 2447cd37da74Snw141292 if (pwdp == NULL) { 2448c5c4113dSnw141292 errnum = errno; 2449c5c4113dSnw141292 idmapdlog(LOG_WARNING, 2450c5c4113dSnw141292 "%s: getpwnam_r(%s) failed (%s).", 2451cd37da74Snw141292 me, name, errnum ? strerror(errnum) : "not found"); 2452c5c4113dSnw141292 if (errnum == 0) 2453c5c4113dSnw141292 return (IDMAP_ERR_NOTFOUND); 2454c5c4113dSnw141292 else 2455c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL); 2456c5c4113dSnw141292 } 2457e8c27ec8Sbaban id->idmap_id_u.uid = pwd.pw_uid; 2458e8c27ec8Sbaban break; 2459e8c27ec8Sbaban case IDMAP_GID: 2460cd37da74Snw141292 grpp = getgrnam_r(name, &grp, buf, sizeof (buf)); 2461e8c27ec8Sbaban if (grpp == NULL && errno == 0 && lower_name != NULL && 2462cd37da74Snw141292 name != lower_name && strcmp(name, lower_name) != 0) 2463cd37da74Snw141292 grpp = getgrnam_r(lower_name, &grp, buf, sizeof (buf)); 2464cd37da74Snw141292 if (grpp == NULL) { 2465c5c4113dSnw141292 errnum = errno; 2466c5c4113dSnw141292 idmapdlog(LOG_WARNING, 2467c5c4113dSnw141292 "%s: getgrnam_r(%s) failed (%s).", 2468cd37da74Snw141292 me, name, errnum ? strerror(errnum) : "not found"); 2469c5c4113dSnw141292 if (errnum == 0) 2470c5c4113dSnw141292 return (IDMAP_ERR_NOTFOUND); 2471c5c4113dSnw141292 else 2472c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL); 2473c5c4113dSnw141292 } 2474e8c27ec8Sbaban id->idmap_id_u.gid = grp.gr_gid; 2475e8c27ec8Sbaban break; 2476e8c27ec8Sbaban default: 2477e8c27ec8Sbaban return (IDMAP_ERR_ARG); 2478c5c4113dSnw141292 } 2479c5c4113dSnw141292 return (IDMAP_SUCCESS); 2480c5c4113dSnw141292 } 2481c5c4113dSnw141292 2482e8c27ec8Sbaban 2483e8c27ec8Sbaban /* 2484e8c27ec8Sbaban * Name service lookup by pid to get unixname 2485e8c27ec8Sbaban */ 2486e8c27ec8Sbaban static 2487e8c27ec8Sbaban idmap_retcode 2488e8c27ec8Sbaban ns_lookup_bypid(uid_t pid, int is_user, char **unixname) 2489e8c27ec8Sbaban { 2490e8c27ec8Sbaban struct passwd pwd; 2491e8c27ec8Sbaban struct group grp; 2492e8c27ec8Sbaban char buf[1024]; 2493e8c27ec8Sbaban int errnum; 2494e8c27ec8Sbaban const char *me = "ns_lookup_bypid"; 2495e8c27ec8Sbaban 2496e8c27ec8Sbaban if (is_user) { 2497e8c27ec8Sbaban errno = 0; 2498e8c27ec8Sbaban if (getpwuid_r(pid, &pwd, buf, sizeof (buf)) == NULL) { 2499e8c27ec8Sbaban errnum = errno; 2500e8c27ec8Sbaban idmapdlog(LOG_WARNING, 2501e8c27ec8Sbaban "%s: getpwuid_r(%u) failed (%s).", 2502e8c27ec8Sbaban me, pid, errnum ? strerror(errnum) : "not found"); 2503e8c27ec8Sbaban if (errnum == 0) 2504e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2505e8c27ec8Sbaban else 2506e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL); 2507e8c27ec8Sbaban } 2508e8c27ec8Sbaban *unixname = strdup(pwd.pw_name); 2509e8c27ec8Sbaban } else { 2510e8c27ec8Sbaban errno = 0; 2511e8c27ec8Sbaban if (getgrgid_r(pid, &grp, buf, sizeof (buf)) == NULL) { 2512e8c27ec8Sbaban errnum = errno; 2513e8c27ec8Sbaban idmapdlog(LOG_WARNING, 2514e8c27ec8Sbaban "%s: getgrgid_r(%u) failed (%s).", 2515e8c27ec8Sbaban me, pid, errnum ? strerror(errnum) : "not found"); 2516e8c27ec8Sbaban if (errnum == 0) 2517e8c27ec8Sbaban return (IDMAP_ERR_NOTFOUND); 2518e8c27ec8Sbaban else 2519e8c27ec8Sbaban return (IDMAP_ERR_INTERNAL); 2520e8c27ec8Sbaban } 2521e8c27ec8Sbaban *unixname = strdup(grp.gr_name); 2522e8c27ec8Sbaban } 2523e8c27ec8Sbaban if (*unixname == NULL) 2524e8c27ec8Sbaban return (IDMAP_ERR_MEMORY); 2525e8c27ec8Sbaban return (IDMAP_SUCCESS); 2526e8c27ec8Sbaban } 2527e8c27ec8Sbaban 2528c5c4113dSnw141292 /* 2529c5c4113dSnw141292 * Name-based mapping 2530c5c4113dSnw141292 * 2531c5c4113dSnw141292 * Case 1: If no rule matches do ephemeral 2532c5c4113dSnw141292 * 2533c5c4113dSnw141292 * Case 2: If rule matches and unixname is "" then return no mapping. 2534c5c4113dSnw141292 * 2535c5c4113dSnw141292 * Case 3: If rule matches and unixname is specified then lookup name 2536c5c4113dSnw141292 * service using the unixname. If unixname not found then return no mapping. 2537c5c4113dSnw141292 * 2538c5c4113dSnw141292 * Case 4: If rule matches and unixname is * then lookup name service 2539c5c4113dSnw141292 * using winname as the unixname. If unixname not found then process 2540c5c4113dSnw141292 * other rules using the lookup order. If no other rule matches then do 2541c5c4113dSnw141292 * ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4. 2542c5c4113dSnw141292 * This allows us to specify a fallback unixname per _domain_ or no mapping 2543c5c4113dSnw141292 * instead of the default behaviour of doing ephemeral mapping. 2544c5c4113dSnw141292 * 2545c5c4113dSnw141292 * Example 1: 2546c5c4113dSnw141292 * *@sfbay == * 2547c5c4113dSnw141292 * If looking up windows users foo@sfbay and foo does not exists in 2548c5c4113dSnw141292 * the name service then foo@sfbay will be mapped to an ephemeral id. 2549c5c4113dSnw141292 * 2550c5c4113dSnw141292 * Example 2: 2551c5c4113dSnw141292 * *@sfbay == * 2552c5c4113dSnw141292 * *@sfbay => guest 2553c5c4113dSnw141292 * If looking up windows users foo@sfbay and foo does not exists in 2554c5c4113dSnw141292 * the name service then foo@sfbay will be mapped to guest. 2555c5c4113dSnw141292 * 2556c5c4113dSnw141292 * Example 3: 2557c5c4113dSnw141292 * *@sfbay == * 2558c5c4113dSnw141292 * *@sfbay => "" 2559c5c4113dSnw141292 * If looking up windows users foo@sfbay and foo does not exists in 2560c5c4113dSnw141292 * the name service then we will return no mapping for foo@sfbay. 2561c5c4113dSnw141292 * 2562c5c4113dSnw141292 */ 2563cd37da74Snw141292 static 2564cd37da74Snw141292 idmap_retcode 2565479ac375Sdm199847 name_based_mapping_sid2pid(lookup_state_t *state, 2566479ac375Sdm199847 idmap_mapping *req, idmap_id_res *res) 2567cd37da74Snw141292 { 2568cd37da74Snw141292 const char *unixname, *windomain; 2569cd37da74Snw141292 char *sql = NULL, *errmsg = NULL, *lower_winname = NULL; 2570c5c4113dSnw141292 idmap_retcode retcode; 2571cd37da74Snw141292 char *end, *lower_unixname, *winname; 2572c5c4113dSnw141292 const char **values; 2573c5c4113dSnw141292 sqlite_vm *vm = NULL; 2574cd37da74Snw141292 int ncol, r, i, is_user, is_wuser; 257548258c6bSjp151216 idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 257648258c6bSjp151216 int direction; 2577c5c4113dSnw141292 const char *me = "name_based_mapping_sid2pid"; 2578c5c4113dSnw141292 2579e8c27ec8Sbaban assert(req->id1name != NULL); /* We have winname */ 2580e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have unixname */ 2581e8c27ec8Sbaban 25828e228215Sdm199847 winname = req->id1name; 25838e228215Sdm199847 windomain = req->id1domain; 2584cd37da74Snw141292 2585cd37da74Snw141292 switch (req->id1.idtype) { 2586cd37da74Snw141292 case IDMAP_USID: 2587cd37da74Snw141292 is_wuser = 1; 2588cd37da74Snw141292 break; 2589cd37da74Snw141292 case IDMAP_GSID: 2590cd37da74Snw141292 is_wuser = 0; 2591cd37da74Snw141292 break; 2592cd37da74Snw141292 default: 2593e8c27ec8Sbaban idmapdlog(LOG_ERR, "%s: Unable to determine if the " 2594e8c27ec8Sbaban "given Windows id is user or group.", me); 2595cd37da74Snw141292 return (IDMAP_ERR_INTERNAL); 2596cd37da74Snw141292 } 2597cd37da74Snw141292 2598e8c27ec8Sbaban switch (res->id.idtype) { 2599cd37da74Snw141292 case IDMAP_UID: 2600cd37da74Snw141292 is_user = 1; 2601cd37da74Snw141292 break; 2602cd37da74Snw141292 case IDMAP_GID: 2603cd37da74Snw141292 is_user = 0; 2604cd37da74Snw141292 break; 2605cd37da74Snw141292 case IDMAP_POSIXID: 2606cd37da74Snw141292 is_user = is_wuser; 2607cd37da74Snw141292 res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID; 2608cd37da74Snw141292 break; 2609cd37da74Snw141292 } 2610c5c4113dSnw141292 2611c5c4113dSnw141292 i = 0; 2612479ac375Sdm199847 if (windomain == NULL) 261362c60062Sbaban windomain = ""; 261482da9f60Sbaban else if (state->defdom != NULL && 261582da9f60Sbaban strcasecmp(state->defdom, windomain) == 0) 2616c5c4113dSnw141292 i = 1; 2617c5c4113dSnw141292 2618cd37da74Snw141292 if ((lower_winname = tolower_u8(winname)) == NULL) 2619cd37da74Snw141292 lower_winname = winname; /* hope for the best */ 2620c5c4113dSnw141292 sql = sqlite_mprintf( 262148258c6bSjp151216 "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 " 262248258c6bSjp151216 "FROM namerules WHERE " 2623cd37da74Snw141292 "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND " 2624c5c4113dSnw141292 "(winname = %Q OR winname = '*') AND " 2625c5c4113dSnw141292 "(windomain = %Q OR windomain = '*' %s) " 2626c5c4113dSnw141292 "ORDER BY w2u_order ASC;", 2627cd37da74Snw141292 is_user, is_wuser, lower_winname, windomain, 262862c60062Sbaban i ? "OR windomain ISNULL OR windomain = ''" : ""); 2629c5c4113dSnw141292 if (sql == NULL) { 2630c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 2631c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 2632c5c4113dSnw141292 goto out; 2633c5c4113dSnw141292 } 2634c5c4113dSnw141292 2635479ac375Sdm199847 if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 2636c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 2637cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: database error (%s)", me, 2638cd37da74Snw141292 CHECK_NULL(errmsg)); 2639c5c4113dSnw141292 sqlite_freemem(errmsg); 2640c5c4113dSnw141292 goto out; 2641c5c4113dSnw141292 } 2642c5c4113dSnw141292 264384decf41Sjp151216 for (;;) { 2644c5c4113dSnw141292 r = sqlite_step(vm, &ncol, &values, NULL); 264584decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 2646c5c4113dSnw141292 264784decf41Sjp151216 if (r == SQLITE_ROW) { 264848258c6bSjp151216 if (ncol < 5) { 2649c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 2650c5c4113dSnw141292 goto out; 2651c5c4113dSnw141292 } 2652c5c4113dSnw141292 if (values[0] == NULL) { 2653c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 2654c5c4113dSnw141292 goto out; 2655c5c4113dSnw141292 } 2656c5c4113dSnw141292 265748258c6bSjp151216 if (values[1] != NULL) 265848258c6bSjp151216 direction = 265948258c6bSjp151216 (strtol(values[1], &end, 10) == 0)? 266048258c6bSjp151216 IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 266148258c6bSjp151216 else 266248258c6bSjp151216 direction = IDMAP_DIRECTION_W2U; 266348258c6bSjp151216 2664c5c4113dSnw141292 if (EMPTY_NAME(values[0])) { 266548258c6bSjp151216 idmap_namerule_set(rule, values[3], values[2], 266648258c6bSjp151216 values[0], is_wuser, is_user, 266748258c6bSjp151216 strtol(values[4], &end, 10), 266848258c6bSjp151216 direction); 2669c5c4113dSnw141292 retcode = IDMAP_ERR_NOMAPPING; 2670c5c4113dSnw141292 goto out; 2671c5c4113dSnw141292 } 267248258c6bSjp151216 267348258c6bSjp151216 if (values[0][0] == '*') { 267448258c6bSjp151216 unixname = winname; 267548258c6bSjp151216 lower_unixname = lower_winname; 267648258c6bSjp151216 } else { 267748258c6bSjp151216 unixname = values[0]; 267848258c6bSjp151216 lower_unixname = NULL; 267948258c6bSjp151216 } 268048258c6bSjp151216 2681e8c27ec8Sbaban retcode = ns_lookup_byname(unixname, lower_unixname, 2682e8c27ec8Sbaban &res->id); 2683c5c4113dSnw141292 if (retcode == IDMAP_ERR_NOTFOUND) { 268448258c6bSjp151216 if (values[0][0] == '*') 2685c5c4113dSnw141292 /* Case 4 */ 2686c5c4113dSnw141292 continue; 268748258c6bSjp151216 else { 2688c5c4113dSnw141292 /* Case 3 */ 268948258c6bSjp151216 idmap_namerule_set(rule, values[3], 269048258c6bSjp151216 values[2], values[0], is_wuser, 269148258c6bSjp151216 is_user, 269248258c6bSjp151216 strtol(values[4], &end, 10), 269348258c6bSjp151216 direction); 2694c5c4113dSnw141292 retcode = IDMAP_ERR_NOMAPPING; 2695c5c4113dSnw141292 } 269648258c6bSjp151216 } 2697c5c4113dSnw141292 goto out; 2698c5c4113dSnw141292 } else if (r == SQLITE_DONE) { 2699c5c4113dSnw141292 retcode = IDMAP_ERR_NOTFOUND; 2700c5c4113dSnw141292 goto out; 2701c5c4113dSnw141292 } else { 2702c5c4113dSnw141292 (void) sqlite_finalize(vm, &errmsg); 2703c5c4113dSnw141292 vm = NULL; 2704cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: database error (%s)", me, 2705cd37da74Snw141292 CHECK_NULL(errmsg)); 2706c5c4113dSnw141292 sqlite_freemem(errmsg); 2707c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 2708c5c4113dSnw141292 goto out; 2709c5c4113dSnw141292 } 2710c5c4113dSnw141292 } 2711c5c4113dSnw141292 2712c5c4113dSnw141292 out: 271348258c6bSjp151216 if (sql != NULL) 2714c5c4113dSnw141292 sqlite_freemem(sql); 271548258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 2716c5c4113dSnw141292 if (retcode == IDMAP_SUCCESS) { 271762c60062Sbaban if (values[1] != NULL) 2718c5c4113dSnw141292 res->direction = 2719651c0131Sbaban (strtol(values[1], &end, 10) == 0)? 2720651c0131Sbaban IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 2721c5c4113dSnw141292 else 2722651c0131Sbaban res->direction = IDMAP_DIRECTION_W2U; 272348258c6bSjp151216 27248e228215Sdm199847 req->id2name = strdup(unixname); 2725479ac375Sdm199847 if (req->id2name == NULL) { 2726479ac375Sdm199847 retcode = IDMAP_ERR_MEMORY; 2727479ac375Sdm199847 } 2728479ac375Sdm199847 } 2729479ac375Sdm199847 2730479ac375Sdm199847 if (retcode == IDMAP_SUCCESS) { 273148258c6bSjp151216 idmap_namerule_set(rule, values[3], values[2], 273248258c6bSjp151216 values[0], is_wuser, is_user, strtol(values[4], &end, 10), 273348258c6bSjp151216 res->direction); 273448258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW; 2735c5c4113dSnw141292 } 2736479ac375Sdm199847 2737cd37da74Snw141292 if (lower_winname != NULL && lower_winname != winname) 2738cd37da74Snw141292 free(lower_winname); 273962c60062Sbaban if (vm != NULL) 2740c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL); 2741c5c4113dSnw141292 return (retcode); 2742c5c4113dSnw141292 } 2743c5c4113dSnw141292 2744c5c4113dSnw141292 static 2745c5c4113dSnw141292 int 2746c5c4113dSnw141292 get_next_eph_uid(uid_t *next_uid) 2747c5c4113dSnw141292 { 2748c5c4113dSnw141292 uid_t uid; 2749c5c4113dSnw141292 gid_t gid; 2750c5c4113dSnw141292 int err; 2751c5c4113dSnw141292 2752c5c4113dSnw141292 *next_uid = (uid_t)-1; 2753c5c4113dSnw141292 uid = _idmapdstate.next_uid++; 2754c5c4113dSnw141292 if (uid >= _idmapdstate.limit_uid) { 2755c5c4113dSnw141292 if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0) 2756c5c4113dSnw141292 return (err); 2757c5c4113dSnw141292 2758c5c4113dSnw141292 _idmapdstate.limit_uid = uid + 8192; 2759c5c4113dSnw141292 _idmapdstate.next_uid = uid; 2760c5c4113dSnw141292 } 2761c5c4113dSnw141292 *next_uid = uid; 2762c5c4113dSnw141292 2763c5c4113dSnw141292 return (0); 2764c5c4113dSnw141292 } 2765c5c4113dSnw141292 2766c5c4113dSnw141292 static 2767c5c4113dSnw141292 int 2768c5c4113dSnw141292 get_next_eph_gid(gid_t *next_gid) 2769c5c4113dSnw141292 { 2770c5c4113dSnw141292 uid_t uid; 2771c5c4113dSnw141292 gid_t gid; 2772c5c4113dSnw141292 int err; 2773c5c4113dSnw141292 2774c5c4113dSnw141292 *next_gid = (uid_t)-1; 2775c5c4113dSnw141292 gid = _idmapdstate.next_gid++; 2776c5c4113dSnw141292 if (gid >= _idmapdstate.limit_gid) { 2777c5c4113dSnw141292 if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0) 2778c5c4113dSnw141292 return (err); 2779c5c4113dSnw141292 2780c5c4113dSnw141292 _idmapdstate.limit_gid = gid + 8192; 2781c5c4113dSnw141292 _idmapdstate.next_gid = gid; 2782c5c4113dSnw141292 } 2783c5c4113dSnw141292 *next_gid = gid; 2784c5c4113dSnw141292 2785c5c4113dSnw141292 return (0); 2786c5c4113dSnw141292 } 2787c5c4113dSnw141292 278862c60062Sbaban static 278962c60062Sbaban int 2790cd37da74Snw141292 gethash(const char *str, uint32_t num, uint_t htsize) 2791cd37da74Snw141292 { 279262c60062Sbaban uint_t hval, i, len; 279362c60062Sbaban 279462c60062Sbaban if (str == NULL) 279562c60062Sbaban return (0); 279662c60062Sbaban for (len = strlen(str), hval = 0, i = 0; i < len; i++) { 279762c60062Sbaban hval += str[i]; 279862c60062Sbaban hval += (hval << 10); 279962c60062Sbaban hval ^= (hval >> 6); 280062c60062Sbaban } 280162c60062Sbaban for (str = (const char *)&num, i = 0; i < sizeof (num); i++) { 280262c60062Sbaban hval += str[i]; 280362c60062Sbaban hval += (hval << 10); 280462c60062Sbaban hval ^= (hval >> 6); 280562c60062Sbaban } 280662c60062Sbaban hval += (hval << 3); 280762c60062Sbaban hval ^= (hval >> 11); 280862c60062Sbaban hval += (hval << 15); 280962c60062Sbaban return (hval % htsize); 281062c60062Sbaban } 281162c60062Sbaban 281262c60062Sbaban static 281362c60062Sbaban int 281462c60062Sbaban get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid, 2815cd37da74Snw141292 uid_t *pid) 2816cd37da74Snw141292 { 281762c60062Sbaban uint_t next, key; 281862c60062Sbaban uint_t htsize = state->sid_history_size; 281962c60062Sbaban idmap_sid *sid; 282062c60062Sbaban 282162c60062Sbaban next = gethash(prefix, rid, htsize); 282262c60062Sbaban while (next != htsize) { 282362c60062Sbaban key = state->sid_history[next].key; 282462c60062Sbaban if (key == htsize) 282562c60062Sbaban return (0); 282662c60062Sbaban sid = &state->batch->idmap_mapping_batch_val[key].id1. 282762c60062Sbaban idmap_id_u.sid; 282862c60062Sbaban if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) { 282962c60062Sbaban *pid = state->result->ids.ids_val[key].id. 283062c60062Sbaban idmap_id_u.uid; 283162c60062Sbaban return (1); 283262c60062Sbaban } 283362c60062Sbaban next = state->sid_history[next].next; 283462c60062Sbaban } 283562c60062Sbaban return (0); 283662c60062Sbaban } 283762c60062Sbaban 283862c60062Sbaban static 283962c60062Sbaban void 2840cd37da74Snw141292 add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid) 2841cd37da74Snw141292 { 284262c60062Sbaban uint_t hash, next; 284362c60062Sbaban uint_t htsize = state->sid_history_size; 284462c60062Sbaban 284562c60062Sbaban hash = next = gethash(prefix, rid, htsize); 284662c60062Sbaban while (state->sid_history[next].key != htsize) { 284762c60062Sbaban next++; 284862c60062Sbaban next %= htsize; 284962c60062Sbaban } 285062c60062Sbaban state->sid_history[next].key = state->curpos; 285162c60062Sbaban if (hash == next) 285262c60062Sbaban return; 285362c60062Sbaban state->sid_history[next].next = state->sid_history[hash].next; 285462c60062Sbaban state->sid_history[hash].next = next; 285562c60062Sbaban } 2856c5c4113dSnw141292 2857e8c27ec8Sbaban void 2858e8c27ec8Sbaban cleanup_lookup_state(lookup_state_t *state) 2859e8c27ec8Sbaban { 2860e8c27ec8Sbaban free(state->sid_history); 2861e8c27ec8Sbaban free(state->ad_unixuser_attr); 2862e8c27ec8Sbaban free(state->ad_unixgroup_attr); 2863479ac375Sdm199847 free(state->nldap_winname_attr); 2864479ac375Sdm199847 free(state->defdom); 2865e8c27ec8Sbaban } 2866e8c27ec8Sbaban 2867c5c4113dSnw141292 /* ARGSUSED */ 2868c5c4113dSnw141292 static 2869c5c4113dSnw141292 idmap_retcode 2870479ac375Sdm199847 dynamic_ephemeral_mapping(lookup_state_t *state, 2871cd37da74Snw141292 idmap_mapping *req, idmap_id_res *res) 2872cd37da74Snw141292 { 2873c5c4113dSnw141292 2874c5c4113dSnw141292 uid_t next_pid; 2875c5c4113dSnw141292 2876651c0131Sbaban res->direction = IDMAP_DIRECTION_BI; 287762c60062Sbaban 287848258c6bSjp151216 if (IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 287948258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 288048258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_CACHE; 288162c60062Sbaban return (IDMAP_SUCCESS); 288248258c6bSjp151216 } 288362c60062Sbaban 288462c60062Sbaban if (state->sid_history != NULL && 288562c60062Sbaban get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix, 288662c60062Sbaban req->id1.idmap_id_u.sid.rid, &next_pid)) { 288762c60062Sbaban res->id.idmap_id_u.uid = next_pid; 288848258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 288948258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW; 289062c60062Sbaban return (IDMAP_SUCCESS); 289162c60062Sbaban } 289262c60062Sbaban 289362c60062Sbaban if (res->id.idtype == IDMAP_UID) { 2894c5c4113dSnw141292 if (get_next_eph_uid(&next_pid) != 0) 2895c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL); 2896c5c4113dSnw141292 res->id.idmap_id_u.uid = next_pid; 2897c5c4113dSnw141292 } else { 2898c5c4113dSnw141292 if (get_next_eph_gid(&next_pid) != 0) 2899c5c4113dSnw141292 return (IDMAP_ERR_INTERNAL); 2900c5c4113dSnw141292 res->id.idmap_id_u.gid = next_pid; 2901c5c4113dSnw141292 } 2902c5c4113dSnw141292 290348258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 290448258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW; 290562c60062Sbaban if (state->sid_history != NULL) 290662c60062Sbaban add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix, 290762c60062Sbaban req->id1.idmap_id_u.sid.rid); 290862c60062Sbaban 2909c5c4113dSnw141292 return (IDMAP_SUCCESS); 2910c5c4113dSnw141292 } 2911c5c4113dSnw141292 2912c5c4113dSnw141292 idmap_retcode 2913479ac375Sdm199847 sid2pid_second_pass(lookup_state_t *state, 2914cd37da74Snw141292 idmap_mapping *req, idmap_id_res *res) 2915cd37da74Snw141292 { 2916c5c4113dSnw141292 idmap_retcode retcode; 2917c5c4113dSnw141292 2918c5c4113dSnw141292 /* Check if second pass is needed */ 2919e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 2920c5c4113dSnw141292 return (res->retcode); 2921c5c4113dSnw141292 2922c5c4113dSnw141292 /* Get status from previous pass */ 2923e8c27ec8Sbaban retcode = res->retcode; 29244aa0a5e7Snw141292 if (retcode != IDMAP_SUCCESS && state->eph_map_unres_sids && 29254aa0a5e7Snw141292 !EMPTY_STRING(req->id1.idmap_id_u.sid.prefix) && 29264aa0a5e7Snw141292 EMPTY_STRING(req->id1name)) { 29274aa0a5e7Snw141292 /* 29284aa0a5e7Snw141292 * We are asked to map an unresolvable SID to a UID or 29294aa0a5e7Snw141292 * GID, but, which? We'll treat all unresolvable SIDs 29304aa0a5e7Snw141292 * as users unless the caller specified which of a UID 29314aa0a5e7Snw141292 * or GID they want. 29324aa0a5e7Snw141292 */ 2933a7c8bd9fSNicolas Williams if (req->id1.idtype == IDMAP_SID) 2934a7c8bd9fSNicolas Williams req->id1.idtype = IDMAP_USID; 29354aa0a5e7Snw141292 if (res->id.idtype == IDMAP_POSIXID) 29364aa0a5e7Snw141292 res->id.idtype = IDMAP_UID; 29374aa0a5e7Snw141292 goto do_eph; 29384aa0a5e7Snw141292 } 2939e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 2940e8c27ec8Sbaban goto out; 2941c5c4113dSnw141292 2942e8c27ec8Sbaban /* 2943e8c27ec8Sbaban * If directory-based name mapping is enabled then the unixname 2944e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode or 2945e8c27ec8Sbaban * mixed-mode) or from native LDAP object (nldap-mode) -- done. 2946e8c27ec8Sbaban */ 2947e8c27ec8Sbaban if (req->id2name != NULL) { 2948e8c27ec8Sbaban assert(res->id.idtype != IDMAP_POSIXID); 2949e8c27ec8Sbaban if (AD_MODE(res->id.idtype, state)) 2950e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 2951e8c27ec8Sbaban else if (NLDAP_MODE(res->id.idtype, state)) 2952e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 2953e8c27ec8Sbaban else if (MIXED_MODE(res->id.idtype, state)) 2954e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U; 2955c5c4113dSnw141292 2956e8c27ec8Sbaban /* 2957e8c27ec8Sbaban * Special case: (1) If the ad_unixuser_attr and 2958e8c27ec8Sbaban * ad_unixgroup_attr uses the same attribute 2959e8c27ec8Sbaban * name and (2) if this is a diagonal mapping 2960e8c27ec8Sbaban * request and (3) the unixname has been retrieved 2961e8c27ec8Sbaban * from the AD object -- then we ignore it and fallback 2962e8c27ec8Sbaban * to name-based mapping rules and ephemeral mapping 2963e8c27ec8Sbaban * 2964e8c27ec8Sbaban * Example: 2965e8c27ec8Sbaban * Properties: 2966e8c27ec8Sbaban * config/ad_unixuser_attr = "unixname" 2967e8c27ec8Sbaban * config/ad_unixgroup_attr = "unixname" 2968e8c27ec8Sbaban * AD user object: 2969e8c27ec8Sbaban * dn: cn=bob ... 2970e8c27ec8Sbaban * objectclass: user 2971e8c27ec8Sbaban * sam: bob 2972e8c27ec8Sbaban * unixname: bob1234 2973e8c27ec8Sbaban * AD group object: 2974e8c27ec8Sbaban * dn: cn=winadmins ... 2975e8c27ec8Sbaban * objectclass: group 2976e8c27ec8Sbaban * sam: winadmins 2977e8c27ec8Sbaban * unixname: unixadmins 2978e8c27ec8Sbaban * 2979e8c27ec8Sbaban * In this example whether "unixname" refers to a unixuser 2980e8c27ec8Sbaban * or unixgroup depends upon the AD object. 2981e8c27ec8Sbaban * 2982e8c27ec8Sbaban * $idmap show -c winname:bob gid 2983e8c27ec8Sbaban * AD lookup by "samAccountName=bob" for 2984e8c27ec8Sbaban * "ad_unixgroup_attr (i.e unixname)" for directory-based 2985e8c27ec8Sbaban * mapping would get "bob1234" which is not what we want. 2986e8c27ec8Sbaban * Now why not getgrnam_r("bob1234") and use it if it 2987e8c27ec8Sbaban * is indeed a unixgroup? That's because Unix can have 2988e8c27ec8Sbaban * users and groups with the same name and we clearly 2989e8c27ec8Sbaban * don't know the intention of the admin here. 2990e8c27ec8Sbaban * Therefore we ignore this and fallback to name-based 2991e8c27ec8Sbaban * mapping rules or ephemeral mapping. 2992e8c27ec8Sbaban */ 2993e8c27ec8Sbaban if ((AD_MODE(res->id.idtype, state) || 2994e8c27ec8Sbaban MIXED_MODE(res->id.idtype, state)) && 2995e8c27ec8Sbaban state->ad_unixuser_attr != NULL && 2996e8c27ec8Sbaban state->ad_unixgroup_attr != NULL && 2997e8c27ec8Sbaban strcasecmp(state->ad_unixuser_attr, 2998e8c27ec8Sbaban state->ad_unixgroup_attr) == 0 && 2999e8c27ec8Sbaban ((req->id1.idtype == IDMAP_USID && 3000e8c27ec8Sbaban res->id.idtype == IDMAP_GID) || 3001e8c27ec8Sbaban (req->id1.idtype == IDMAP_GSID && 3002e8c27ec8Sbaban res->id.idtype == IDMAP_UID))) { 3003e8c27ec8Sbaban free(req->id2name); 3004e8c27ec8Sbaban req->id2name = NULL; 3005e8c27ec8Sbaban res->id.idmap_id_u.uid = SENTINEL_PID; 3006e8c27ec8Sbaban /* fallback */ 3007e8c27ec8Sbaban } else { 3008e8c27ec8Sbaban if (res->id.idmap_id_u.uid == SENTINEL_PID) 3009e8c27ec8Sbaban retcode = ns_lookup_byname(req->id2name, 3010e8c27ec8Sbaban NULL, &res->id); 3011e8c27ec8Sbaban /* 3012479ac375Sdm199847 * If ns_lookup_byname() fails that means the 3013479ac375Sdm199847 * unixname (req->id2name), which was obtained 3014479ac375Sdm199847 * from the AD object by directory-based mapping, 3015479ac375Sdm199847 * is not a valid Unix user/group and therefore 3016479ac375Sdm199847 * we return the error to the client instead of 3017479ac375Sdm199847 * doing rule-based mapping or ephemeral mapping. 3018479ac375Sdm199847 * This way the client can detect the issue. 3019e8c27ec8Sbaban */ 3020c5c4113dSnw141292 goto out; 3021c5c4113dSnw141292 } 3022e8c27ec8Sbaban } 3023c5c4113dSnw141292 302448258c6bSjp151216 /* Free any mapping info from Directory based mapping */ 302548258c6bSjp151216 if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 302648258c6bSjp151216 idmap_info_free(&res->info); 302748258c6bSjp151216 3028e8c27ec8Sbaban /* 3029e8c27ec8Sbaban * If we don't have unixname then evaluate local name-based 3030e8c27ec8Sbaban * mapping rules. 3031e8c27ec8Sbaban */ 3032479ac375Sdm199847 retcode = name_based_mapping_sid2pid(state, req, res); 3033e8c27ec8Sbaban if (retcode != IDMAP_ERR_NOTFOUND) 3034e8c27ec8Sbaban goto out; 3035e8c27ec8Sbaban 30364aa0a5e7Snw141292 do_eph: 3037c5c4113dSnw141292 /* If not found, do ephemeral mapping */ 3038479ac375Sdm199847 retcode = dynamic_ephemeral_mapping(state, req, res); 3039c5c4113dSnw141292 3040c5c4113dSnw141292 out: 3041c5c4113dSnw141292 res->retcode = idmap_stat4prot(retcode); 3042e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 3043e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 3044e8c27ec8Sbaban res->id.idmap_id_u.uid = UID_NOBODY; 3045e8c27ec8Sbaban } 3046e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction)) 3047e8c27ec8Sbaban state->sid2pid_done = FALSE; 3048c5c4113dSnw141292 return (retcode); 3049c5c4113dSnw141292 } 3050c5c4113dSnw141292 3051c5c4113dSnw141292 idmap_retcode 3052479ac375Sdm199847 update_cache_pid2sid(lookup_state_t *state, 3053cd37da74Snw141292 idmap_mapping *req, idmap_id_res *res) 3054cd37da74Snw141292 { 3055c5c4113dSnw141292 char *sql = NULL; 3056c5c4113dSnw141292 idmap_retcode retcode; 305748258c6bSjp151216 char *map_dn = NULL; 305848258c6bSjp151216 char *map_attr = NULL; 305948258c6bSjp151216 char *map_value = NULL; 306048258c6bSjp151216 char *map_windomain = NULL; 306148258c6bSjp151216 char *map_winname = NULL; 306248258c6bSjp151216 char *map_unixname = NULL; 306348258c6bSjp151216 int map_is_nt4 = FALSE; 3064c5c4113dSnw141292 3065c5c4113dSnw141292 /* Check if we need to cache anything */ 3066e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3067c5c4113dSnw141292 return (IDMAP_SUCCESS); 3068c5c4113dSnw141292 3069c5c4113dSnw141292 /* We don't cache negative entries */ 3070c5c4113dSnw141292 if (res->retcode != IDMAP_SUCCESS) 3071c5c4113dSnw141292 return (IDMAP_SUCCESS); 3072c5c4113dSnw141292 3073e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF); 307448258c6bSjp151216 assert(req->id1.idmap_id_u.uid != SENTINEL_PID); 307548258c6bSjp151216 assert(res->id.idtype != IDMAP_SID); 307648258c6bSjp151216 307748258c6bSjp151216 assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN); 307848258c6bSjp151216 switch (res->info.how.map_type) { 307948258c6bSjp151216 case IDMAP_MAP_TYPE_DS_AD: 308048258c6bSjp151216 map_dn = res->info.how.idmap_how_u.ad.dn; 308148258c6bSjp151216 map_attr = res->info.how.idmap_how_u.ad.attr; 308248258c6bSjp151216 map_value = res->info.how.idmap_how_u.ad.value; 308348258c6bSjp151216 break; 308448258c6bSjp151216 308548258c6bSjp151216 case IDMAP_MAP_TYPE_DS_NLDAP: 308648258c6bSjp151216 map_dn = res->info.how.idmap_how_u.nldap.dn; 308748258c6bSjp151216 map_attr = res->info.how.idmap_how_u.nldap.attr; 308848258c6bSjp151216 map_value = res->info.how.idmap_how_u.nldap.value; 308948258c6bSjp151216 break; 309048258c6bSjp151216 309148258c6bSjp151216 case IDMAP_MAP_TYPE_RULE_BASED: 309248258c6bSjp151216 map_windomain = res->info.how.idmap_how_u.rule.windomain; 309348258c6bSjp151216 map_winname = res->info.how.idmap_how_u.rule.winname; 309448258c6bSjp151216 map_unixname = res->info.how.idmap_how_u.rule.unixname; 309548258c6bSjp151216 map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 309648258c6bSjp151216 break; 309748258c6bSjp151216 309848258c6bSjp151216 case IDMAP_MAP_TYPE_EPHEMERAL: 309948258c6bSjp151216 break; 310048258c6bSjp151216 310148258c6bSjp151216 case IDMAP_MAP_TYPE_LOCAL_SID: 310248258c6bSjp151216 break; 310348258c6bSjp151216 310448258c6bSjp151216 default: 310548258c6bSjp151216 /* Dont cache other mapping types */ 310648258c6bSjp151216 assert(FALSE); 310748258c6bSjp151216 } 3108e8c27ec8Sbaban 3109c5c4113dSnw141292 /* 3110c5c4113dSnw141292 * Using NULL for u2w instead of 0 so that our trigger allows 3111c5c4113dSnw141292 * the same pid to be the destination in multiple entries 3112c5c4113dSnw141292 */ 3113c5c4113dSnw141292 sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3114cd37da74Snw141292 "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 311548258c6bSjp151216 "is_user, is_wuser, expiration, w2u, u2w, " 311648258c6bSjp151216 "map_type, map_dn, map_attr, map_value, map_windomain, " 311748258c6bSjp151216 "map_winname, map_unixname, map_is_nt4) " 3118cd37da74Snw141292 "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 311948258c6bSjp151216 "strftime('%%s','now') + 600, %q, 1, " 312048258c6bSjp151216 "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ", 3121cd37da74Snw141292 res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3122cd37da74Snw141292 req->id2domain, req->id2name, req->id1.idmap_id_u.uid, 3123cd37da74Snw141292 req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0, 3124e8c27ec8Sbaban (res->id.idtype == IDMAP_USID) ? 1 : 0, 312548258c6bSjp151216 (res->direction == 0) ? "1" : NULL, 312648258c6bSjp151216 res->info.how.map_type, map_dn, map_attr, map_value, 312748258c6bSjp151216 map_windomain, map_winname, map_unixname, map_is_nt4); 3128c5c4113dSnw141292 3129c5c4113dSnw141292 if (sql == NULL) { 3130c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3131c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3132c5c4113dSnw141292 goto out; 3133c5c4113dSnw141292 } 3134c5c4113dSnw141292 3135479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3136c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS) 3137c5c4113dSnw141292 goto out; 3138c5c4113dSnw141292 3139c5c4113dSnw141292 state->pid2sid_done = FALSE; 3140c5c4113dSnw141292 sqlite_freemem(sql); 3141c5c4113dSnw141292 sql = NULL; 3142c5c4113dSnw141292 3143e8c27ec8Sbaban /* Check if we need to update namecache */ 3144e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3145c5c4113dSnw141292 goto out; 3146c5c4113dSnw141292 31478e228215Sdm199847 if (req->id2name == NULL) 3148c5c4113dSnw141292 goto out; 3149c5c4113dSnw141292 3150c5c4113dSnw141292 sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3151cd37da74Snw141292 "(sidprefix, rid, canon_name, domain, type, expiration) " 3152c5c4113dSnw141292 "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3153cd37da74Snw141292 res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3154cd37da74Snw141292 req->id2name, req->id2domain, 3155e8c27ec8Sbaban (res->id.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP); 3156c5c4113dSnw141292 3157c5c4113dSnw141292 if (sql == NULL) { 3158c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3159c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3160c5c4113dSnw141292 goto out; 3161c5c4113dSnw141292 } 3162c5c4113dSnw141292 3163479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3164c5c4113dSnw141292 3165c5c4113dSnw141292 out: 316648258c6bSjp151216 if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO)) 316748258c6bSjp151216 idmap_info_free(&res->info); 316862c60062Sbaban if (sql != NULL) 3169c5c4113dSnw141292 sqlite_freemem(sql); 3170c5c4113dSnw141292 return (retcode); 3171c5c4113dSnw141292 } 3172c5c4113dSnw141292 3173c5c4113dSnw141292 idmap_retcode 3174479ac375Sdm199847 update_cache_sid2pid(lookup_state_t *state, 3175cd37da74Snw141292 idmap_mapping *req, idmap_id_res *res) 3176cd37da74Snw141292 { 3177c5c4113dSnw141292 char *sql = NULL; 3178c5c4113dSnw141292 idmap_retcode retcode; 3179c5c4113dSnw141292 int is_eph_user; 318048258c6bSjp151216 char *map_dn = NULL; 318148258c6bSjp151216 char *map_attr = NULL; 318248258c6bSjp151216 char *map_value = NULL; 318348258c6bSjp151216 char *map_windomain = NULL; 318448258c6bSjp151216 char *map_winname = NULL; 318548258c6bSjp151216 char *map_unixname = NULL; 318648258c6bSjp151216 int map_is_nt4 = FALSE; 3187c5c4113dSnw141292 3188c5c4113dSnw141292 /* Check if we need to cache anything */ 3189e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 3190c5c4113dSnw141292 return (IDMAP_SUCCESS); 3191c5c4113dSnw141292 3192c5c4113dSnw141292 /* We don't cache negative entries */ 3193c5c4113dSnw141292 if (res->retcode != IDMAP_SUCCESS) 3194c5c4113dSnw141292 return (IDMAP_SUCCESS); 3195c5c4113dSnw141292 3196c5c4113dSnw141292 if (req->direction & _IDMAP_F_EXP_EPH_UID) 3197c5c4113dSnw141292 is_eph_user = 1; 3198c5c4113dSnw141292 else if (req->direction & _IDMAP_F_EXP_EPH_GID) 3199c5c4113dSnw141292 is_eph_user = 0; 3200c5c4113dSnw141292 else 3201c5c4113dSnw141292 is_eph_user = -1; 3202c5c4113dSnw141292 3203c5c4113dSnw141292 if (is_eph_user >= 0 && !IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 3204c5c4113dSnw141292 sql = sqlite_mprintf("UPDATE idmap_cache " 3205c5c4113dSnw141292 "SET w2u = 0 WHERE " 3206c5c4113dSnw141292 "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 3207c5c4113dSnw141292 "pid >= 2147483648 AND is_user = %d;", 3208c5c4113dSnw141292 req->id1.idmap_id_u.sid.prefix, 3209c5c4113dSnw141292 req->id1.idmap_id_u.sid.rid, 3210c5c4113dSnw141292 is_eph_user); 3211c5c4113dSnw141292 if (sql == NULL) { 3212c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3213c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3214c5c4113dSnw141292 goto out; 3215c5c4113dSnw141292 } 3216c5c4113dSnw141292 3217479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3218c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS) 3219c5c4113dSnw141292 goto out; 3220c5c4113dSnw141292 3221c5c4113dSnw141292 sqlite_freemem(sql); 3222c5c4113dSnw141292 sql = NULL; 3223c5c4113dSnw141292 } 3224c5c4113dSnw141292 3225e8c27ec8Sbaban assert(res->direction != IDMAP_DIRECTION_UNDEF); 322648258c6bSjp151216 assert(res->id.idmap_id_u.uid != SENTINEL_PID); 322748258c6bSjp151216 322848258c6bSjp151216 switch (res->info.how.map_type) { 322948258c6bSjp151216 case IDMAP_MAP_TYPE_DS_AD: 323048258c6bSjp151216 map_dn = res->info.how.idmap_how_u.ad.dn; 323148258c6bSjp151216 map_attr = res->info.how.idmap_how_u.ad.attr; 323248258c6bSjp151216 map_value = res->info.how.idmap_how_u.ad.value; 323348258c6bSjp151216 break; 323448258c6bSjp151216 323548258c6bSjp151216 case IDMAP_MAP_TYPE_DS_NLDAP: 323648258c6bSjp151216 map_dn = res->info.how.idmap_how_u.nldap.dn; 323748258c6bSjp151216 map_attr = res->info.how.idmap_how_u.ad.attr; 323848258c6bSjp151216 map_value = res->info.how.idmap_how_u.nldap.value; 323948258c6bSjp151216 break; 324048258c6bSjp151216 324148258c6bSjp151216 case IDMAP_MAP_TYPE_RULE_BASED: 324248258c6bSjp151216 map_windomain = res->info.how.idmap_how_u.rule.windomain; 324348258c6bSjp151216 map_winname = res->info.how.idmap_how_u.rule.winname; 324448258c6bSjp151216 map_unixname = res->info.how.idmap_how_u.rule.unixname; 324548258c6bSjp151216 map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 324648258c6bSjp151216 break; 324748258c6bSjp151216 324848258c6bSjp151216 case IDMAP_MAP_TYPE_EPHEMERAL: 324948258c6bSjp151216 break; 325048258c6bSjp151216 325148258c6bSjp151216 default: 325248258c6bSjp151216 /* Dont cache other mapping types */ 325348258c6bSjp151216 assert(FALSE); 325448258c6bSjp151216 } 3255cd37da74Snw141292 3256c5c4113dSnw141292 sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3257cd37da74Snw141292 "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 325848258c6bSjp151216 "is_user, is_wuser, expiration, w2u, u2w, " 325948258c6bSjp151216 "map_type, map_dn, map_attr, map_value, map_windomain, " 326048258c6bSjp151216 "map_winname, map_unixname, map_is_nt4) " 3261cd37da74Snw141292 "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 326248258c6bSjp151216 "strftime('%%s','now') + 600, 1, %q, " 326348258c6bSjp151216 "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);", 3264cd37da74Snw141292 req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3265e8c27ec8Sbaban (req->id1domain != NULL) ? req->id1domain : "", req->id1name, 3266e8c27ec8Sbaban res->id.idmap_id_u.uid, req->id2name, 3267e8c27ec8Sbaban (res->id.idtype == IDMAP_UID) ? 1 : 0, 3268cd37da74Snw141292 (req->id1.idtype == IDMAP_USID) ? 1 : 0, 326948258c6bSjp151216 (res->direction == 0) ? "1" : NULL, 327048258c6bSjp151216 res->info.how.map_type, map_dn, map_attr, map_value, 327148258c6bSjp151216 map_windomain, map_winname, map_unixname, map_is_nt4); 3272c5c4113dSnw141292 3273c5c4113dSnw141292 if (sql == NULL) { 3274c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3275c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3276c5c4113dSnw141292 goto out; 3277c5c4113dSnw141292 } 3278c5c4113dSnw141292 3279479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3280c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS) 3281c5c4113dSnw141292 goto out; 3282c5c4113dSnw141292 3283c5c4113dSnw141292 state->sid2pid_done = FALSE; 3284c5c4113dSnw141292 sqlite_freemem(sql); 3285c5c4113dSnw141292 sql = NULL; 3286c5c4113dSnw141292 3287e8c27ec8Sbaban /* Check if we need to update namecache */ 3288e8c27ec8Sbaban if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3289c5c4113dSnw141292 goto out; 3290c5c4113dSnw141292 3291cf5b5989Sdm199847 if (EMPTY_STRING(req->id1name)) 3292c5c4113dSnw141292 goto out; 3293c5c4113dSnw141292 3294c5c4113dSnw141292 sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3295cd37da74Snw141292 "(sidprefix, rid, canon_name, domain, type, expiration) " 3296c5c4113dSnw141292 "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3297cd37da74Snw141292 req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3298cd37da74Snw141292 req->id1name, req->id1domain, 3299cd37da74Snw141292 (req->id1.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP); 3300c5c4113dSnw141292 3301c5c4113dSnw141292 if (sql == NULL) { 3302c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3303c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3304c5c4113dSnw141292 goto out; 3305c5c4113dSnw141292 } 3306c5c4113dSnw141292 3307479ac375Sdm199847 retcode = sql_exec_no_cb(state->cache, IDMAP_CACHENAME, sql); 3308c5c4113dSnw141292 3309c5c4113dSnw141292 out: 331048258c6bSjp151216 if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO)) 331148258c6bSjp151216 idmap_info_free(&res->info); 331248258c6bSjp151216 331362c60062Sbaban if (sql != NULL) 3314c5c4113dSnw141292 sqlite_freemem(sql); 3315c5c4113dSnw141292 return (retcode); 3316c5c4113dSnw141292 } 3317c5c4113dSnw141292 3318cd37da74Snw141292 static 3319cd37da74Snw141292 idmap_retcode 3320c5c4113dSnw141292 lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res, 3321cd37da74Snw141292 int is_user, int getname) 3322cd37da74Snw141292 { 3323c5c4113dSnw141292 char *end; 3324c5c4113dSnw141292 char *sql = NULL; 3325c5c4113dSnw141292 const char **values; 3326c5c4113dSnw141292 sqlite_vm *vm = NULL; 3327c5c4113dSnw141292 int ncol; 3328c5c4113dSnw141292 idmap_retcode retcode = IDMAP_SUCCESS; 3329c5c4113dSnw141292 time_t curtime; 3330e8c27ec8Sbaban idmap_id_type idtype; 3331c5c4113dSnw141292 3332c5c4113dSnw141292 /* Current time */ 3333c5c4113dSnw141292 errno = 0; 3334c5c4113dSnw141292 if ((curtime = time(NULL)) == (time_t)-1) { 3335cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 3336c5c4113dSnw141292 strerror(errno)); 3337c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3338c5c4113dSnw141292 goto out; 3339c5c4113dSnw141292 } 3340c5c4113dSnw141292 3341e8c27ec8Sbaban /* SQL to lookup the cache by pid or by unixname */ 3342e8c27ec8Sbaban if (req->id1.idmap_id_u.uid != SENTINEL_PID) { 334348258c6bSjp151216 sql = sqlite_mprintf("SELECT sidprefix, rid, " 334448258c6bSjp151216 "canon_winname, windomain, w2u, is_wuser, " 334548258c6bSjp151216 "map_type, map_dn, map_attr, map_value, map_windomain, " 334648258c6bSjp151216 "map_winname, map_unixname, map_is_nt4 " 3347c5c4113dSnw141292 "FROM idmap_cache WHERE " 3348c5c4113dSnw141292 "pid = %u AND u2w = 1 AND is_user = %d AND " 3349c5c4113dSnw141292 "(pid >= 2147483648 OR " 3350c5c4113dSnw141292 "(expiration = 0 OR expiration ISNULL OR " 3351c5c4113dSnw141292 "expiration > %d));", 3352c5c4113dSnw141292 req->id1.idmap_id_u.uid, is_user, curtime); 3353e8c27ec8Sbaban } else if (req->id1name != NULL) { 335448258c6bSjp151216 sql = sqlite_mprintf("SELECT sidprefix, rid, " 335548258c6bSjp151216 "canon_winname, windomain, w2u, is_wuser, " 335648258c6bSjp151216 "map_type, map_dn, map_attr, map_value, map_windomain, " 335748258c6bSjp151216 "map_winname, map_unixname, map_is_nt4 " 3358e8c27ec8Sbaban "FROM idmap_cache WHERE " 3359e8c27ec8Sbaban "unixname = %Q AND u2w = 1 AND is_user = %d AND " 3360e8c27ec8Sbaban "(pid >= 2147483648 OR " 3361e8c27ec8Sbaban "(expiration = 0 OR expiration ISNULL OR " 3362e8c27ec8Sbaban "expiration > %d));", 3363e8c27ec8Sbaban req->id1name, is_user, curtime); 336448258c6bSjp151216 } else { 336548258c6bSjp151216 retcode = IDMAP_ERR_ARG; 336648258c6bSjp151216 goto out; 3367e8c27ec8Sbaban } 3368e8c27ec8Sbaban 3369c5c4113dSnw141292 if (sql == NULL) { 3370c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3371c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 3372c5c4113dSnw141292 goto out; 3373c5c4113dSnw141292 } 337448258c6bSjp151216 retcode = sql_compile_n_step_once( 337548258c6bSjp151216 cache, sql, &vm, &ncol, 14, &values); 3376c5c4113dSnw141292 sqlite_freemem(sql); 3377c5c4113dSnw141292 3378c5c4113dSnw141292 if (retcode == IDMAP_ERR_NOTFOUND) 3379c5c4113dSnw141292 goto out; 3380c5c4113dSnw141292 else if (retcode == IDMAP_SUCCESS) { 3381c5c4113dSnw141292 /* sanity checks */ 3382c5c4113dSnw141292 if (values[0] == NULL || values[1] == NULL) { 3383c5c4113dSnw141292 retcode = IDMAP_ERR_CACHE; 3384c5c4113dSnw141292 goto out; 3385c5c4113dSnw141292 } 3386c5c4113dSnw141292 3387e8c27ec8Sbaban switch (res->id.idtype) { 3388c5c4113dSnw141292 case IDMAP_SID: 3389cd37da74Snw141292 case IDMAP_USID: 3390cd37da74Snw141292 case IDMAP_GSID: 3391e8c27ec8Sbaban idtype = strtol(values[5], &end, 10) == 1 3392cd37da74Snw141292 ? IDMAP_USID : IDMAP_GSID; 3393cd37da74Snw141292 3394e8c27ec8Sbaban if (res->id.idtype == IDMAP_USID && 3395e8c27ec8Sbaban idtype != IDMAP_USID) { 3396cd37da74Snw141292 retcode = IDMAP_ERR_NOTUSER; 3397cd37da74Snw141292 goto out; 3398e8c27ec8Sbaban } else if (res->id.idtype == IDMAP_GSID && 3399e8c27ec8Sbaban idtype != IDMAP_GSID) { 3400cd37da74Snw141292 retcode = IDMAP_ERR_NOTGROUP; 3401cd37da74Snw141292 goto out; 3402cd37da74Snw141292 } 3403e8c27ec8Sbaban res->id.idtype = idtype; 3404cd37da74Snw141292 3405c5c4113dSnw141292 res->id.idmap_id_u.sid.rid = 3406c5c4113dSnw141292 strtoul(values[1], &end, 10); 3407c5c4113dSnw141292 res->id.idmap_id_u.sid.prefix = strdup(values[0]); 3408c5c4113dSnw141292 if (res->id.idmap_id_u.sid.prefix == NULL) { 3409c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3410c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 3411c5c4113dSnw141292 goto out; 3412c5c4113dSnw141292 } 3413c5c4113dSnw141292 341462c60062Sbaban if (values[4] != NULL) 3415c5c4113dSnw141292 res->direction = 3416651c0131Sbaban (strtol(values[4], &end, 10) == 0)? 3417651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 3418c5c4113dSnw141292 else 3419651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W; 3420c5c4113dSnw141292 3421c5c4113dSnw141292 if (getname == 0 || values[2] == NULL) 3422c5c4113dSnw141292 break; 34238e228215Sdm199847 req->id2name = strdup(values[2]); 34248e228215Sdm199847 if (req->id2name == NULL) { 3425c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3426c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 3427c5c4113dSnw141292 goto out; 3428c5c4113dSnw141292 } 3429c5c4113dSnw141292 3430c5c4113dSnw141292 if (values[3] == NULL) 3431c5c4113dSnw141292 break; 34328e228215Sdm199847 req->id2domain = strdup(values[3]); 34338e228215Sdm199847 if (req->id2domain == NULL) { 3434c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3435c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 3436c5c4113dSnw141292 goto out; 3437c5c4113dSnw141292 } 3438cd37da74Snw141292 3439c5c4113dSnw141292 break; 3440c5c4113dSnw141292 default: 3441c5c4113dSnw141292 retcode = IDMAP_ERR_NOTSUPPORTED; 3442c5c4113dSnw141292 break; 3443c5c4113dSnw141292 } 344448258c6bSjp151216 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 344548258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_CACHE; 344648258c6bSjp151216 res->info.how.map_type = strtoul(values[6], &end, 10); 344748258c6bSjp151216 switch (res->info.how.map_type) { 344848258c6bSjp151216 case IDMAP_MAP_TYPE_DS_AD: 344948258c6bSjp151216 res->info.how.idmap_how_u.ad.dn = 345048258c6bSjp151216 strdup(values[7]); 345148258c6bSjp151216 res->info.how.idmap_how_u.ad.attr = 345248258c6bSjp151216 strdup(values[8]); 345348258c6bSjp151216 res->info.how.idmap_how_u.ad.value = 345448258c6bSjp151216 strdup(values[9]); 345548258c6bSjp151216 break; 345648258c6bSjp151216 345748258c6bSjp151216 case IDMAP_MAP_TYPE_DS_NLDAP: 345848258c6bSjp151216 res->info.how.idmap_how_u.nldap.dn = 345948258c6bSjp151216 strdup(values[7]); 346048258c6bSjp151216 res->info.how.idmap_how_u.nldap.attr = 346148258c6bSjp151216 strdup(values[8]); 346248258c6bSjp151216 res->info.how.idmap_how_u.nldap.value = 346348258c6bSjp151216 strdup(values[9]); 346448258c6bSjp151216 break; 346548258c6bSjp151216 346648258c6bSjp151216 case IDMAP_MAP_TYPE_RULE_BASED: 346748258c6bSjp151216 res->info.how.idmap_how_u.rule.windomain = 346848258c6bSjp151216 strdup(values[10]); 346948258c6bSjp151216 res->info.how.idmap_how_u.rule.winname = 347048258c6bSjp151216 strdup(values[11]); 347148258c6bSjp151216 res->info.how.idmap_how_u.rule.unixname = 347248258c6bSjp151216 strdup(values[12]); 347348258c6bSjp151216 res->info.how.idmap_how_u.rule.is_nt4 = 347448258c6bSjp151216 strtoul(values[13], &end, 10); 347548258c6bSjp151216 res->info.how.idmap_how_u.rule.is_user = 347648258c6bSjp151216 is_user; 347748258c6bSjp151216 res->info.how.idmap_how_u.rule.is_wuser = 347848258c6bSjp151216 strtol(values[5], &end, 10); 347948258c6bSjp151216 break; 348048258c6bSjp151216 348148258c6bSjp151216 case IDMAP_MAP_TYPE_EPHEMERAL: 348248258c6bSjp151216 break; 348348258c6bSjp151216 348448258c6bSjp151216 case IDMAP_MAP_TYPE_LOCAL_SID: 348548258c6bSjp151216 break; 348648258c6bSjp151216 348748258c6bSjp151216 case IDMAP_MAP_TYPE_KNOWN_SID: 348848258c6bSjp151216 break; 348948258c6bSjp151216 349048258c6bSjp151216 default: 349148258c6bSjp151216 /* Unknow mapping type */ 349248258c6bSjp151216 assert(FALSE); 349348258c6bSjp151216 } 349448258c6bSjp151216 } 3495c5c4113dSnw141292 } 3496c5c4113dSnw141292 3497c5c4113dSnw141292 out: 349862c60062Sbaban if (vm != NULL) 3499c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL); 3500c5c4113dSnw141292 return (retcode); 3501c5c4113dSnw141292 } 3502c5c4113dSnw141292 3503cd37da74Snw141292 static 3504cd37da74Snw141292 idmap_retcode 3505c5c4113dSnw141292 lookup_cache_name2sid(sqlite *cache, const char *name, const char *domain, 3506cd37da74Snw141292 char **canonname, char **sidprefix, idmap_rid_t *rid, int *type) 3507cd37da74Snw141292 { 3508cd37da74Snw141292 char *end, *lower_name; 3509c5c4113dSnw141292 char *sql = NULL; 3510c5c4113dSnw141292 const char **values; 3511c5c4113dSnw141292 sqlite_vm *vm = NULL; 3512c5c4113dSnw141292 int ncol; 3513c5c4113dSnw141292 time_t curtime; 3514c5c4113dSnw141292 idmap_retcode retcode = IDMAP_SUCCESS; 3515c5c4113dSnw141292 3516c5c4113dSnw141292 /* Get current time */ 3517c5c4113dSnw141292 errno = 0; 3518c5c4113dSnw141292 if ((curtime = time(NULL)) == (time_t)-1) { 3519cd37da74Snw141292 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 3520c5c4113dSnw141292 strerror(errno)); 3521c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3522c5c4113dSnw141292 goto out; 3523c5c4113dSnw141292 } 3524c5c4113dSnw141292 3525c5c4113dSnw141292 /* SQL to lookup the cache */ 3526cd37da74Snw141292 if ((lower_name = tolower_u8(name)) == NULL) 3527cd37da74Snw141292 lower_name = (char *)name; 3528cd37da74Snw141292 sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name " 3529cd37da74Snw141292 "FROM name_cache WHERE name = %Q AND domain = %Q AND " 3530c5c4113dSnw141292 "(expiration = 0 OR expiration ISNULL OR " 3531cd37da74Snw141292 "expiration > %d);", lower_name, domain, curtime); 3532cd37da74Snw141292 if (lower_name != name) 3533cd37da74Snw141292 free(lower_name); 3534c5c4113dSnw141292 if (sql == NULL) { 3535c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3536c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 3537c5c4113dSnw141292 goto out; 3538c5c4113dSnw141292 } 3539cd37da74Snw141292 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values); 3540c5c4113dSnw141292 sqlite_freemem(sql); 3541c5c4113dSnw141292 3542c5c4113dSnw141292 if (retcode == IDMAP_SUCCESS) { 354362c60062Sbaban if (type != NULL) { 3544c5c4113dSnw141292 if (values[2] == NULL) { 3545c5c4113dSnw141292 retcode = IDMAP_ERR_CACHE; 3546c5c4113dSnw141292 goto out; 3547c5c4113dSnw141292 } 3548c5c4113dSnw141292 *type = strtol(values[2], &end, 10); 3549c5c4113dSnw141292 } 3550c5c4113dSnw141292 3551e8c27ec8Sbaban if (values[0] == NULL || values[1] == NULL) { 3552e8c27ec8Sbaban retcode = IDMAP_ERR_CACHE; 3553e8c27ec8Sbaban goto out; 3554e8c27ec8Sbaban } 3555e8c27ec8Sbaban 3556cd37da74Snw141292 if (canonname != NULL) { 3557cd37da74Snw141292 assert(values[3] != NULL); 3558cd37da74Snw141292 if ((*canonname = strdup(values[3])) == NULL) { 3559cd37da74Snw141292 idmapdlog(LOG_ERR, "Out of memory"); 3560cd37da74Snw141292 retcode = IDMAP_ERR_MEMORY; 3561cd37da74Snw141292 goto out; 3562cd37da74Snw141292 } 3563cd37da74Snw141292 } 3564cd37da74Snw141292 3565c5c4113dSnw141292 if ((*sidprefix = strdup(values[0])) == NULL) { 3566c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3567c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 3568e8c27ec8Sbaban if (canonname != NULL) { 3569e8c27ec8Sbaban free(*canonname); 3570e8c27ec8Sbaban *canonname = NULL; 3571e8c27ec8Sbaban } 3572c5c4113dSnw141292 goto out; 3573c5c4113dSnw141292 } 3574c5c4113dSnw141292 *rid = strtoul(values[1], &end, 10); 3575c5c4113dSnw141292 } 3576c5c4113dSnw141292 3577c5c4113dSnw141292 out: 357862c60062Sbaban if (vm != NULL) 3579c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL); 3580c5c4113dSnw141292 return (retcode); 3581c5c4113dSnw141292 } 3582c5c4113dSnw141292 3583cd37da74Snw141292 static 3584cd37da74Snw141292 idmap_retcode 3585e8c27ec8Sbaban ad_lookup_by_winname(lookup_state_t *state, 3586e8c27ec8Sbaban const char *name, const char *domain, int eunixtype, 358748258c6bSjp151216 char **dn, char **attr, char **value, char **canonname, 358848258c6bSjp151216 char **sidprefix, idmap_rid_t *rid, int *wintype, 358948258c6bSjp151216 char **unixname) 3590cd37da74Snw141292 { 3591c5c4113dSnw141292 int retries = 0; 3592c5c4113dSnw141292 idmap_query_state_t *qs = NULL; 3593c5c4113dSnw141292 idmap_retcode rc, retcode; 3594c5c4113dSnw141292 3595c5c4113dSnw141292 retry: 3596*2b4a7802SBaban Kenkre RDLOCK_CONFIG(); 3597e8c27ec8Sbaban retcode = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs); 3598*2b4a7802SBaban Kenkre UNLOCK_CONFIG(); 3599e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 3600*2b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 3601*2b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 36020dcc7149Snw141292 goto retry; 3603349d5d8fSnw141292 degrade_svc(1, "failed to create request for AD lookup " 36040dcc7149Snw141292 "by winname"); 3605e8c27ec8Sbaban return (retcode); 3606c5c4113dSnw141292 } 3607c5c4113dSnw141292 3608c8e26105Sjp151216 restore_svc(); 3609c8e26105Sjp151216 3610e8c27ec8Sbaban if (state != NULL) 3611e8c27ec8Sbaban idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr, 3612e8c27ec8Sbaban state->ad_unixgroup_attr); 3613c5c4113dSnw141292 3614e8c27ec8Sbaban retcode = idmap_name2sid_batch_add1(qs, name, domain, eunixtype, 361548258c6bSjp151216 dn, attr, value, canonname, sidprefix, rid, wintype, unixname, &rc); 3616c5c4113dSnw141292 3617e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 361884decf41Sjp151216 idmap_lookup_release_batch(&qs); 3619c5c4113dSnw141292 else 36200dcc7149Snw141292 retcode = idmap_lookup_batch_end(&qs); 3621c5c4113dSnw141292 3622*2b4a7802SBaban Kenkre if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && 3623*2b4a7802SBaban Kenkre retries++ < ADUTILS_DEF_NUM_RETRIES) 3624c5c4113dSnw141292 goto retry; 3625c8e26105Sjp151216 else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 3626349d5d8fSnw141292 degrade_svc(1, "some AD lookups timed out repeatedly"); 3627c5c4113dSnw141292 3628c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS) { 3629e8c27ec8Sbaban idmapdlog(LOG_NOTICE, "AD lookup by winname failed"); 3630c5c4113dSnw141292 return (retcode); 3631e8c27ec8Sbaban } 3632c5c4113dSnw141292 return (rc); 3633c5c4113dSnw141292 } 3634c5c4113dSnw141292 3635cd37da74Snw141292 idmap_retcode 3636c5c4113dSnw141292 lookup_name2sid(sqlite *cache, const char *name, const char *domain, 3637cd37da74Snw141292 int *is_wuser, char **canonname, char **sidprefix, 3638479ac375Sdm199847 idmap_rid_t *rid, idmap_mapping *req, int local_only) 3639cd37da74Snw141292 { 3640c5c4113dSnw141292 int type; 3641c5c4113dSnw141292 idmap_retcode retcode; 3642c5c4113dSnw141292 3643cd37da74Snw141292 *sidprefix = NULL; 3644e8c27ec8Sbaban if (canonname != NULL) 3645cd37da74Snw141292 *canonname = NULL; 3646cd37da74Snw141292 3647e8c27ec8Sbaban /* Lookup well-known SIDs table */ 3648cd37da74Snw141292 retcode = lookup_wksids_name2sid(name, canonname, sidprefix, rid, 3649cd37da74Snw141292 &type); 365062c60062Sbaban if (retcode == IDMAP_SUCCESS) { 3651e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 365262c60062Sbaban goto out; 365362c60062Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) { 365462c60062Sbaban return (retcode); 365562c60062Sbaban } 365662c60062Sbaban 3657e8c27ec8Sbaban /* Lookup cache */ 3658cd37da74Snw141292 retcode = lookup_cache_name2sid(cache, name, domain, canonname, 3659cd37da74Snw141292 sidprefix, rid, &type); 3660e8c27ec8Sbaban if (retcode == IDMAP_SUCCESS) { 3661e8c27ec8Sbaban req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 3662e8c27ec8Sbaban goto out; 3663e8c27ec8Sbaban } else if (retcode != IDMAP_ERR_NOTFOUND) { 3664e8c27ec8Sbaban return (retcode); 3665e8c27ec8Sbaban } 3666e8c27ec8Sbaban 3667479ac375Sdm199847 /* 3668479ac375Sdm199847 * The caller may be using this function to determine if this 3669479ac375Sdm199847 * request needs to be marked for AD lookup or not 3670479ac375Sdm199847 * (i.e. _IDMAP_F_LOOKUP_AD) and therefore may not want this 3671479ac375Sdm199847 * function to AD lookup now. 3672479ac375Sdm199847 */ 3673479ac375Sdm199847 if (local_only) 3674479ac375Sdm199847 return (retcode); 3675479ac375Sdm199847 3676e8c27ec8Sbaban /* Lookup AD */ 3677e8c27ec8Sbaban retcode = ad_lookup_by_winname(NULL, name, domain, _IDMAP_T_UNDEF, 367848258c6bSjp151216 NULL, NULL, NULL, canonname, sidprefix, rid, &type, NULL); 3679c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS) 3680c5c4113dSnw141292 return (retcode); 3681c5c4113dSnw141292 368262c60062Sbaban out: 3683c5c4113dSnw141292 /* 3684c5c4113dSnw141292 * Entry found (cache or Windows lookup) 3685cd37da74Snw141292 * is_wuser is both input as well as output parameter 3686c5c4113dSnw141292 */ 3687e8c27ec8Sbaban if (*is_wuser == 1 && type != _IDMAP_T_USER) 3688e8c27ec8Sbaban retcode = IDMAP_ERR_NOTUSER; 3689e8c27ec8Sbaban else if (*is_wuser == 0 && type != _IDMAP_T_GROUP) 3690e8c27ec8Sbaban retcode = IDMAP_ERR_NOTGROUP; 3691e8c27ec8Sbaban else if (*is_wuser == -1) { 3692c5c4113dSnw141292 /* Caller wants to know if its user or group */ 3693c5c4113dSnw141292 if (type == _IDMAP_T_USER) 3694cd37da74Snw141292 *is_wuser = 1; 3695c5c4113dSnw141292 else if (type == _IDMAP_T_GROUP) 3696cd37da74Snw141292 *is_wuser = 0; 3697e8c27ec8Sbaban else 3698e8c27ec8Sbaban retcode = IDMAP_ERR_SID; 3699e8c27ec8Sbaban } 3700e8c27ec8Sbaban 3701e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 3702cd37da74Snw141292 free(*sidprefix); 3703cd37da74Snw141292 *sidprefix = NULL; 3704e8c27ec8Sbaban if (canonname != NULL) { 3705cd37da74Snw141292 free(*canonname); 3706cd37da74Snw141292 *canonname = NULL; 3707cd37da74Snw141292 } 3708c5c4113dSnw141292 } 3709c5c4113dSnw141292 return (retcode); 3710c5c4113dSnw141292 } 3711c5c4113dSnw141292 3712cd37da74Snw141292 static 3713cd37da74Snw141292 idmap_retcode 3714479ac375Sdm199847 name_based_mapping_pid2sid(lookup_state_t *state, const char *unixname, 3715cd37da74Snw141292 int is_user, idmap_mapping *req, idmap_id_res *res) 3716cd37da74Snw141292 { 3717c5c4113dSnw141292 const char *winname, *windomain; 3718cd37da74Snw141292 char *canonname; 3719c5c4113dSnw141292 char *sql = NULL, *errmsg = NULL; 3720c5c4113dSnw141292 idmap_retcode retcode; 3721c5c4113dSnw141292 char *end; 3722c5c4113dSnw141292 const char **values; 3723c5c4113dSnw141292 sqlite_vm *vm = NULL; 372448258c6bSjp151216 int ncol, r; 3725cd37da74Snw141292 int is_wuser; 3726e8c27ec8Sbaban const char *me = "name_based_mapping_pid2sid"; 372748258c6bSjp151216 int non_wild_match = FALSE; 372848258c6bSjp151216 idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 372948258c6bSjp151216 int direction; 3730e8c27ec8Sbaban 3731e8c27ec8Sbaban assert(unixname != NULL); /* We have unixname */ 3732e8c27ec8Sbaban assert(req->id2name == NULL); /* We don't have winname */ 3733e8c27ec8Sbaban assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */ 3734c5c4113dSnw141292 3735c5c4113dSnw141292 sql = sqlite_mprintf( 373648258c6bSjp151216 "SELECT winname_display, windomain, w2u_order, " 373748258c6bSjp151216 "is_wuser, unixname, is_nt4 " 373848258c6bSjp151216 "FROM namerules WHERE " 3739c5c4113dSnw141292 "u2w_order > 0 AND is_user = %d AND " 3740c5c4113dSnw141292 "(unixname = %Q OR unixname = '*') " 3741cd37da74Snw141292 "ORDER BY u2w_order ASC;", is_user, unixname); 3742c5c4113dSnw141292 if (sql == NULL) { 3743c5c4113dSnw141292 idmapdlog(LOG_ERR, "Out of memory"); 3744c5c4113dSnw141292 retcode = IDMAP_ERR_MEMORY; 3745c5c4113dSnw141292 goto out; 3746c5c4113dSnw141292 } 3747c5c4113dSnw141292 3748479ac375Sdm199847 if (sqlite_compile(state->db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 3749c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3750cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3751cd37da74Snw141292 CHECK_NULL(errmsg)); 3752c5c4113dSnw141292 sqlite_freemem(errmsg); 3753c5c4113dSnw141292 goto out; 3754c5c4113dSnw141292 } 3755c5c4113dSnw141292 375648258c6bSjp151216 for (;;) { 3757c5c4113dSnw141292 r = sqlite_step(vm, &ncol, &values, NULL); 375884decf41Sjp151216 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 375984decf41Sjp151216 if (r == SQLITE_ROW) { 376048258c6bSjp151216 if (ncol < 6) { 3761c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3762c5c4113dSnw141292 goto out; 3763c5c4113dSnw141292 } 3764c5c4113dSnw141292 if (values[0] == NULL) { 3765c5c4113dSnw141292 /* values [1] and [2] can be null */ 3766c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3767c5c4113dSnw141292 goto out; 3768c5c4113dSnw141292 } 376948258c6bSjp151216 377048258c6bSjp151216 if (values[2] != NULL) 377148258c6bSjp151216 direction = 377248258c6bSjp151216 (strtol(values[2], &end, 10) == 0)? 377348258c6bSjp151216 IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 377448258c6bSjp151216 else 377548258c6bSjp151216 direction = IDMAP_DIRECTION_U2W; 377648258c6bSjp151216 3777c5c4113dSnw141292 if (EMPTY_NAME(values[0])) { 377848258c6bSjp151216 idmap_namerule_set(rule, values[1], values[0], 377948258c6bSjp151216 values[4], is_user, 378048258c6bSjp151216 strtol(values[3], &end, 10), 378148258c6bSjp151216 strtol(values[5], &end, 10), 378248258c6bSjp151216 direction); 3783c5c4113dSnw141292 retcode = IDMAP_ERR_NOMAPPING; 3784c5c4113dSnw141292 goto out; 3785c5c4113dSnw141292 } 3786cd37da74Snw141292 3787cd37da74Snw141292 if (values[0][0] == '*') { 378848258c6bSjp151216 winname = unixname; 378948258c6bSjp151216 if (non_wild_match) { 3790cd37da74Snw141292 /* 379148258c6bSjp151216 * There were non-wildcard rules 379248258c6bSjp151216 * where the Windows identity doesn't 379348258c6bSjp151216 * exist. Return no mapping. 3794cd37da74Snw141292 */ 3795cd37da74Snw141292 retcode = IDMAP_ERR_NOMAPPING; 3796cd37da74Snw141292 goto out; 3797cd37da74Snw141292 } 3798cd37da74Snw141292 } else { 379948258c6bSjp151216 /* Save first non-wild match rule */ 380048258c6bSjp151216 if (!non_wild_match) { 380148258c6bSjp151216 idmap_namerule_set(rule, values[1], 380248258c6bSjp151216 values[0], values[4], 380348258c6bSjp151216 is_user, 380448258c6bSjp151216 strtol(values[3], &end, 10), 380548258c6bSjp151216 strtol(values[5], &end, 10), 380648258c6bSjp151216 direction); 380748258c6bSjp151216 non_wild_match = TRUE; 380848258c6bSjp151216 } 3809cd37da74Snw141292 winname = values[0]; 3810cd37da74Snw141292 } 381148258c6bSjp151216 is_wuser = res->id.idtype == IDMAP_USID ? 1 381248258c6bSjp151216 : res->id.idtype == IDMAP_GSID ? 0 381348258c6bSjp151216 : -1; 381462c60062Sbaban if (values[1] != NULL) 3815c5c4113dSnw141292 windomain = values[1]; 3816479ac375Sdm199847 else if (state->defdom != NULL) 3817479ac375Sdm199847 windomain = state->defdom; 3818c5c4113dSnw141292 else { 3819cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: no domain", me); 3820c5c4113dSnw141292 retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 3821c5c4113dSnw141292 goto out; 3822c5c4113dSnw141292 } 3823cd37da74Snw141292 3824479ac375Sdm199847 retcode = lookup_name2sid(state->cache, 3825479ac375Sdm199847 winname, windomain, 3826cd37da74Snw141292 &is_wuser, &canonname, 3827cd37da74Snw141292 &res->id.idmap_id_u.sid.prefix, 3828479ac375Sdm199847 &res->id.idmap_id_u.sid.rid, req, 0); 3829e8c27ec8Sbaban 3830c5c4113dSnw141292 if (retcode == IDMAP_ERR_NOTFOUND) { 3831c5c4113dSnw141292 continue; 3832c5c4113dSnw141292 } 3833c5c4113dSnw141292 goto out; 383448258c6bSjp151216 3835c5c4113dSnw141292 } else if (r == SQLITE_DONE) { 383648258c6bSjp151216 /* 383748258c6bSjp151216 * If there were non-wildcard rules where 383848258c6bSjp151216 * Windows identity doesn't exist 383948258c6bSjp151216 * return no mapping. 384048258c6bSjp151216 */ 384148258c6bSjp151216 if (non_wild_match) 384248258c6bSjp151216 retcode = IDMAP_ERR_NOMAPPING; 384348258c6bSjp151216 else 3844c5c4113dSnw141292 retcode = IDMAP_ERR_NOTFOUND; 3845c5c4113dSnw141292 goto out; 3846c5c4113dSnw141292 } else { 3847c5c4113dSnw141292 (void) sqlite_finalize(vm, &errmsg); 3848c5c4113dSnw141292 vm = NULL; 3849cd37da74Snw141292 idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3850cd37da74Snw141292 CHECK_NULL(errmsg)); 3851c5c4113dSnw141292 sqlite_freemem(errmsg); 3852c5c4113dSnw141292 retcode = IDMAP_ERR_INTERNAL; 3853c5c4113dSnw141292 goto out; 3854c5c4113dSnw141292 } 3855c5c4113dSnw141292 } 3856c5c4113dSnw141292 3857c5c4113dSnw141292 out: 385862c60062Sbaban if (sql != NULL) 3859c5c4113dSnw141292 sqlite_freemem(sql); 386048258c6bSjp151216 res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 3861c5c4113dSnw141292 if (retcode == IDMAP_SUCCESS) { 3862cd37da74Snw141292 res->id.idtype = is_wuser ? IDMAP_USID : IDMAP_GSID; 3863cd37da74Snw141292 386462c60062Sbaban if (values[2] != NULL) 3865c5c4113dSnw141292 res->direction = 3866651c0131Sbaban (strtol(values[2], &end, 10) == 0)? 3867651c0131Sbaban IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 3868c5c4113dSnw141292 else 3869651c0131Sbaban res->direction = IDMAP_DIRECTION_U2W; 38708e228215Sdm199847 3871cd37da74Snw141292 req->id2name = canonname; 38728e228215Sdm199847 if (req->id2name != NULL) { 38738e228215Sdm199847 req->id2domain = strdup(windomain); 3874479ac375Sdm199847 if (req->id2domain == NULL) 3875479ac375Sdm199847 retcode = IDMAP_ERR_MEMORY; 38768e228215Sdm199847 } 3877c5c4113dSnw141292 } 3878479ac375Sdm199847 3879479ac375Sdm199847 if (retcode == IDMAP_SUCCESS) { 388048258c6bSjp151216 idmap_namerule_set(rule, values[1], values[0], values[4], 388148258c6bSjp151216 is_user, strtol(values[3], &end, 10), 388248258c6bSjp151216 strtol(values[5], &end, 10), 388348258c6bSjp151216 rule->direction); 388448258c6bSjp151216 res->info.src = IDMAP_MAP_SRC_NEW; 3885c5c4113dSnw141292 } 388662c60062Sbaban if (vm != NULL) 3887c5c4113dSnw141292 (void) sqlite_finalize(vm, NULL); 3888c5c4113dSnw141292 return (retcode); 3889c5c4113dSnw141292 } 3890c5c4113dSnw141292 3891cd37da74Snw141292 /* 3892cd37da74Snw141292 * Convention when processing unix2win requests: 3893cd37da74Snw141292 * 3894cd37da74Snw141292 * Unix identity: 3895cd37da74Snw141292 * req->id1name = 3896cd37da74Snw141292 * unixname if given otherwise unixname found will be placed 3897cd37da74Snw141292 * here. 3898cd37da74Snw141292 * req->id1domain = 3899cd37da74Snw141292 * NOT USED 3900cd37da74Snw141292 * req->id1.idtype = 3901cd37da74Snw141292 * Given type (IDMAP_UID or IDMAP_GID) 3902cd37da74Snw141292 * req->id1..[uid or gid] = 3903cd37da74Snw141292 * UID/GID if given otherwise UID/GID found will be placed here. 3904cd37da74Snw141292 * 3905cd37da74Snw141292 * Windows identity: 3906cd37da74Snw141292 * req->id2name = 3907cd37da74Snw141292 * winname found will be placed here. 3908cd37da74Snw141292 * req->id2domain = 3909cd37da74Snw141292 * windomain found will be placed here. 3910cd37da74Snw141292 * res->id.idtype = 3911cd37da74Snw141292 * Target type initialized from req->id2.idtype. If 3912cd37da74Snw141292 * it is IDMAP_SID then actual type (IDMAP_USID/GSID) found 3913cd37da74Snw141292 * will be placed here. 3914cd37da74Snw141292 * req->id..sid.[prefix, rid] = 3915cd37da74Snw141292 * SID found will be placed here. 3916cd37da74Snw141292 * 3917cd37da74Snw141292 * Others: 3918cd37da74Snw141292 * res->retcode = 3919cd37da74Snw141292 * Return status for this request will be placed here. 3920cd37da74Snw141292 * res->direction = 3921cd37da74Snw141292 * Direction found will be placed here. Direction 3922cd37da74Snw141292 * meaning whether the resultant mapping is valid 3923cd37da74Snw141292 * only from unix2win or bi-directional. 3924cd37da74Snw141292 * req->direction = 3925cd37da74Snw141292 * INTERNAL USE. Used by idmapd to set various 3926cd37da74Snw141292 * flags (_IDMAP_F_xxxx) to aid in processing 3927cd37da74Snw141292 * of the request. 3928cd37da74Snw141292 * req->id2.idtype = 3929cd37da74Snw141292 * INTERNAL USE. Initially this is the requested target 3930cd37da74Snw141292 * type and is used to initialize res->id.idtype. 3931cd37da74Snw141292 * ad_lookup_batch() uses this field temporarily to store 3932cd37da74Snw141292 * sid_type obtained by the batched AD lookups and after 3933cd37da74Snw141292 * use resets it to IDMAP_NONE to prevent xdr from 3934cd37da74Snw141292 * mis-interpreting the contents of req->id2. 3935cd37da74Snw141292 * req->id2..[uid or gid or sid] = 3936cd37da74Snw141292 * NOT USED 3937cd37da74Snw141292 */ 3938cd37da74Snw141292 3939cd37da74Snw141292 /* 3940cd37da74Snw141292 * This function does the following: 3941cd37da74Snw141292 * 1. Lookup well-known SIDs table. 3942cd37da74Snw141292 * 2. Lookup cache. 3943cd37da74Snw141292 * 3. Check if the client does not want new mapping to be allocated 3944cd37da74Snw141292 * in which case this pass is the final pass. 3945e8c27ec8Sbaban * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs 3946e8c27ec8Sbaban * to do AD/NLDAP lookup. 3947cd37da74Snw141292 */ 3948c5c4113dSnw141292 idmap_retcode 3949479ac375Sdm199847 pid2sid_first_pass(lookup_state_t *state, idmap_mapping *req, 3950479ac375Sdm199847 idmap_id_res *res, int is_user, int getname) 3951cd37da74Snw141292 { 3952e8c27ec8Sbaban idmap_retcode retcode; 3953e8c27ec8Sbaban bool_t gen_localsid_on_err = FALSE; 3954c5c4113dSnw141292 3955e8c27ec8Sbaban /* Initialize result */ 3956c5c4113dSnw141292 res->id.idtype = req->id2.idtype; 3957e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_UNDEF; 3958c5c4113dSnw141292 3959e8c27ec8Sbaban if (req->id2.idmap_id_u.sid.prefix != NULL) { 3960e8c27ec8Sbaban /* sanitize sidprefix */ 3961e8c27ec8Sbaban free(req->id2.idmap_id_u.sid.prefix); 3962e8c27ec8Sbaban req->id2.idmap_id_u.sid.prefix = NULL; 3963e8c27ec8Sbaban } 3964e8c27ec8Sbaban 396548258c6bSjp151216 /* Find pid */ 396648258c6bSjp151216 if (req->id1.idmap_id_u.uid == SENTINEL_PID) { 396748258c6bSjp151216 if (ns_lookup_byname(req->id1name, NULL, &req->id1) 396848258c6bSjp151216 != IDMAP_SUCCESS) { 396948258c6bSjp151216 retcode = IDMAP_ERR_NOMAPPING; 397048258c6bSjp151216 goto out; 397148258c6bSjp151216 } 397248258c6bSjp151216 } 397348258c6bSjp151216 3974e8c27ec8Sbaban /* Lookup well-known SIDs table */ 3975c5c4113dSnw141292 retcode = lookup_wksids_pid2sid(req, res, is_user); 3976c5c4113dSnw141292 if (retcode != IDMAP_ERR_NOTFOUND) 3977c5c4113dSnw141292 goto out; 3978c5c4113dSnw141292 3979e8c27ec8Sbaban /* Lookup cache */ 3980479ac375Sdm199847 retcode = lookup_cache_pid2sid(state->cache, req, res, is_user, 3981479ac375Sdm199847 getname); 3982c5c4113dSnw141292 if (retcode != IDMAP_ERR_NOTFOUND) 3983c5c4113dSnw141292 goto out; 3984c5c4113dSnw141292 3985c5c4113dSnw141292 /* Ephemeral ids cannot be allocated during pid2sid */ 3986c5c4113dSnw141292 if (IS_EPHEMERAL(req->id1.idmap_id_u.uid)) { 398762c60062Sbaban retcode = IDMAP_ERR_NOMAPPING; 3988c5c4113dSnw141292 goto out; 3989c5c4113dSnw141292 } 3990c5c4113dSnw141292 399148258c6bSjp151216 if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) { 399248258c6bSjp151216 retcode = IDMAP_ERR_NONEGENERATED; 399348258c6bSjp151216 goto out; 399448258c6bSjp151216 } 399548258c6bSjp151216 399648258c6bSjp151216 if (AVOID_NAMESERVICE(req)) { 3997e8c27ec8Sbaban gen_localsid_on_err = TRUE; 399862c60062Sbaban retcode = IDMAP_ERR_NOMAPPING; 3999c5c4113dSnw141292 goto out; 4000c5c4113dSnw141292 } 4001c5c4113dSnw141292 4002e8c27ec8Sbaban /* Set flags for the next stage */ 4003e8c27ec8Sbaban if (AD_MODE(req->id1.idtype, state)) { 4004e8c27ec8Sbaban /* 4005e8c27ec8Sbaban * If AD-based name mapping is enabled then the next stage 4006e8c27ec8Sbaban * will need to lookup AD using unixname to get the 4007e8c27ec8Sbaban * corresponding winname. 4008e8c27ec8Sbaban */ 4009e8c27ec8Sbaban if (req->id1name == NULL) { 4010e8c27ec8Sbaban /* Get unixname if only pid is given. */ 4011e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, 4012e8c27ec8Sbaban is_user, &req->id1name); 4013479ac375Sdm199847 if (retcode != IDMAP_SUCCESS) { 4014479ac375Sdm199847 gen_localsid_on_err = TRUE; 4015e8c27ec8Sbaban goto out; 4016c5c4113dSnw141292 } 4017479ac375Sdm199847 } 4018e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_AD; 4019e8c27ec8Sbaban state->ad_nqueries++; 4020e8c27ec8Sbaban } else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) { 4021e8c27ec8Sbaban /* 4022e8c27ec8Sbaban * If native LDAP or mixed mode is enabled for name mapping 4023e8c27ec8Sbaban * then the next stage will need to lookup native LDAP using 4024e8c27ec8Sbaban * unixname/pid to get the corresponding winname. 4025e8c27ec8Sbaban */ 4026e8c27ec8Sbaban req->direction |= _IDMAP_F_LOOKUP_NLDAP; 4027e8c27ec8Sbaban state->nldap_nqueries++; 4028c5c4113dSnw141292 } 4029c5c4113dSnw141292 4030e8c27ec8Sbaban /* 4031e8c27ec8Sbaban * Failed to find non-expired entry in cache. Set the flag to 4032e8c27ec8Sbaban * indicate that we are not done yet. 4033e8c27ec8Sbaban */ 4034e8c27ec8Sbaban state->pid2sid_done = FALSE; 4035e8c27ec8Sbaban req->direction |= _IDMAP_F_NOTDONE; 4036e8c27ec8Sbaban retcode = IDMAP_SUCCESS; 4037e8c27ec8Sbaban 4038e8c27ec8Sbaban out: 4039e8c27ec8Sbaban res->retcode = idmap_stat4prot(retcode); 4040e8c27ec8Sbaban if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) 4041e8c27ec8Sbaban if (gen_localsid_on_err == TRUE) 404248258c6bSjp151216 (void) generate_localsid(req, res, is_user, TRUE); 4043e8c27ec8Sbaban return (retcode); 4044e8c27ec8Sbaban } 4045e8c27ec8Sbaban 4046e8c27ec8Sbaban idmap_retcode 4047479ac375Sdm199847 pid2sid_second_pass(lookup_state_t *state, idmap_mapping *req, 4048479ac375Sdm199847 idmap_id_res *res, int is_user) 4049e8c27ec8Sbaban { 4050e8c27ec8Sbaban bool_t gen_localsid_on_err = TRUE; 4051e8c27ec8Sbaban idmap_retcode retcode = IDMAP_SUCCESS; 4052e8c27ec8Sbaban 4053e8c27ec8Sbaban /* Check if second pass is needed */ 4054e8c27ec8Sbaban if (ARE_WE_DONE(req->direction)) 4055e8c27ec8Sbaban return (res->retcode); 4056e8c27ec8Sbaban 4057e8c27ec8Sbaban /* Get status from previous pass */ 4058e8c27ec8Sbaban retcode = res->retcode; 4059e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4060e8c27ec8Sbaban goto out; 4061e8c27ec8Sbaban 4062e8c27ec8Sbaban /* 4063e8c27ec8Sbaban * If directory-based name mapping is enabled then the winname 4064e8c27ec8Sbaban * may already have been retrieved from the AD object (AD-mode) 4065479ac375Sdm199847 * or from native LDAP object (nldap-mode or mixed-mode). 4066479ac375Sdm199847 * Note that if we have winname but no SID then it's an error 4067479ac375Sdm199847 * because this implies that the Native LDAP entry contains 4068479ac375Sdm199847 * winname which does not exist and it's better that we return 4069479ac375Sdm199847 * an error instead of doing rule-based mapping so that the user 4070479ac375Sdm199847 * can detect the issue and take appropriate action. 4071e8c27ec8Sbaban */ 4072479ac375Sdm199847 if (req->id2name != NULL) { 4073479ac375Sdm199847 /* Return notfound if we've winname but no SID. */ 4074479ac375Sdm199847 if (res->id.idmap_id_u.sid.prefix == NULL) { 4075479ac375Sdm199847 retcode = IDMAP_ERR_NOTFOUND; 4076479ac375Sdm199847 goto out; 4077479ac375Sdm199847 } 4078e8c27ec8Sbaban if (AD_MODE(req->id1.idtype, state)) 4079e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 4080e8c27ec8Sbaban else if (NLDAP_MODE(req->id1.idtype, state)) 4081e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_BI; 4082e8c27ec8Sbaban else if (MIXED_MODE(req->id1.idtype, state)) 4083e8c27ec8Sbaban res->direction = IDMAP_DIRECTION_W2U; 4084e8c27ec8Sbaban goto out; 4085479ac375Sdm199847 } else if (res->id.idmap_id_u.sid.prefix != NULL) { 4086479ac375Sdm199847 /* 4087479ac375Sdm199847 * We've SID but no winname. This is fine because 4088479ac375Sdm199847 * the caller may have only requested SID. 4089479ac375Sdm199847 */ 4090479ac375Sdm199847 goto out; 4091e8c27ec8Sbaban } 4092e8c27ec8Sbaban 4093479ac375Sdm199847 /* Free any mapping info from Directory based mapping */ 4094479ac375Sdm199847 if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 4095479ac375Sdm199847 idmap_info_free(&res->info); 4096479ac375Sdm199847 4097e8c27ec8Sbaban if (req->id1name == NULL) { 4098e8c27ec8Sbaban /* Get unixname from name service */ 4099e8c27ec8Sbaban retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user, 4100e8c27ec8Sbaban &req->id1name); 4101e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4102e8c27ec8Sbaban goto out; 4103e8c27ec8Sbaban } else if (req->id1.idmap_id_u.uid == SENTINEL_PID) { 4104e8c27ec8Sbaban /* Get pid from name service */ 4105e8c27ec8Sbaban retcode = ns_lookup_byname(req->id1name, NULL, &req->id1); 4106e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) { 4107e8c27ec8Sbaban gen_localsid_on_err = FALSE; 4108e8c27ec8Sbaban goto out; 4109e8c27ec8Sbaban } 4110e8c27ec8Sbaban } 4111e8c27ec8Sbaban 4112e8c27ec8Sbaban /* Use unixname to evaluate local name-based mapping rules */ 4113479ac375Sdm199847 retcode = name_based_mapping_pid2sid(state, req->id1name, is_user, 4114c5c4113dSnw141292 req, res); 4115c5c4113dSnw141292 if (retcode == IDMAP_ERR_NOTFOUND) { 411648258c6bSjp151216 retcode = generate_localsid(req, res, is_user, FALSE); 4117e8c27ec8Sbaban gen_localsid_on_err = FALSE; 4118e8c27ec8Sbaban } 4119c5c4113dSnw141292 4120c5c4113dSnw141292 out: 4121c5c4113dSnw141292 res->retcode = idmap_stat4prot(retcode); 4122e8c27ec8Sbaban if (res->retcode != IDMAP_SUCCESS) { 4123e8c27ec8Sbaban req->direction = _IDMAP_F_DONE; 4124479ac375Sdm199847 free(req->id2name); 4125479ac375Sdm199847 req->id2name = NULL; 4126479ac375Sdm199847 free(req->id2domain); 4127479ac375Sdm199847 req->id2domain = NULL; 4128e8c27ec8Sbaban if (gen_localsid_on_err == TRUE) 412948258c6bSjp151216 (void) generate_localsid(req, res, is_user, TRUE); 4130479ac375Sdm199847 else 4131479ac375Sdm199847 res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 4132e8c27ec8Sbaban } 4133e8c27ec8Sbaban if (!ARE_WE_DONE(req->direction)) 4134e8c27ec8Sbaban state->pid2sid_done = FALSE; 4135c5c4113dSnw141292 return (retcode); 4136c5c4113dSnw141292 } 4137c5c4113dSnw141292 4138cd37da74Snw141292 static 4139cd37da74Snw141292 int 4140651c0131Sbaban copy_mapping_request(idmap_mapping *mapping, idmap_mapping *request) 4141c5c4113dSnw141292 { 4142651c0131Sbaban (void) memset(mapping, 0, sizeof (*mapping)); 4143651c0131Sbaban 4144c5c4113dSnw141292 mapping->flag = request->flag; 4145e8c27ec8Sbaban mapping->direction = _IDMAP_F_DONE; 4146651c0131Sbaban mapping->id2.idtype = request->id2.idtype; 4147c5c4113dSnw141292 4148c5c4113dSnw141292 mapping->id1.idtype = request->id1.idtype; 4149cd37da74Snw141292 if (IS_REQUEST_SID(*request, 1)) { 4150c5c4113dSnw141292 mapping->id1.idmap_id_u.sid.rid = 4151c5c4113dSnw141292 request->id1.idmap_id_u.sid.rid; 4152651c0131Sbaban if (!EMPTY_STRING(request->id1.idmap_id_u.sid.prefix)) { 4153c5c4113dSnw141292 mapping->id1.idmap_id_u.sid.prefix = 4154c5c4113dSnw141292 strdup(request->id1.idmap_id_u.sid.prefix); 4155651c0131Sbaban if (mapping->id1.idmap_id_u.sid.prefix == NULL) 41568e228215Sdm199847 goto errout; 4157651c0131Sbaban } 4158c5c4113dSnw141292 } else { 4159c5c4113dSnw141292 mapping->id1.idmap_id_u.uid = request->id1.idmap_id_u.uid; 4160c5c4113dSnw141292 } 4161c5c4113dSnw141292 4162e8c27ec8Sbaban if (!EMPTY_STRING(request->id1domain)) { 41638e228215Sdm199847 mapping->id1domain = strdup(request->id1domain); 41648e228215Sdm199847 if (mapping->id1domain == NULL) 41658e228215Sdm199847 goto errout; 4166e8c27ec8Sbaban } 4167c5c4113dSnw141292 4168e8c27ec8Sbaban if (!EMPTY_STRING(request->id1name)) { 41698e228215Sdm199847 mapping->id1name = strdup(request->id1name); 41708e228215Sdm199847 if (mapping->id1name == NULL) 41718e228215Sdm199847 goto errout; 4172e8c27ec8Sbaban } 4173c5c4113dSnw141292 4174651c0131Sbaban /* We don't need the rest of the request i.e request->id2 */ 4175651c0131Sbaban return (0); 4176c5c4113dSnw141292 4177651c0131Sbaban errout: 41788e228215Sdm199847 if (mapping->id1.idmap_id_u.sid.prefix != NULL) 4179651c0131Sbaban free(mapping->id1.idmap_id_u.sid.prefix); 41808e228215Sdm199847 if (mapping->id1domain != NULL) 41818e228215Sdm199847 free(mapping->id1domain); 41828e228215Sdm199847 if (mapping->id1name != NULL) 41838e228215Sdm199847 free(mapping->id1name); 4184651c0131Sbaban 4185651c0131Sbaban (void) memset(mapping, 0, sizeof (*mapping)); 4186651c0131Sbaban return (-1); 4187c5c4113dSnw141292 } 4188c5c4113dSnw141292 4189c5c4113dSnw141292 4190c5c4113dSnw141292 idmap_retcode 4191c5c4113dSnw141292 get_w2u_mapping(sqlite *cache, sqlite *db, idmap_mapping *request, 4192cd37da74Snw141292 idmap_mapping *mapping) 4193cd37da74Snw141292 { 4194c5c4113dSnw141292 idmap_id_res idres; 4195c5c4113dSnw141292 lookup_state_t state; 4196dd5829d1Sbaban char *cp; 4197c5c4113dSnw141292 idmap_retcode retcode; 4198c5c4113dSnw141292 const char *winname, *windomain; 4199c5c4113dSnw141292 4200c5c4113dSnw141292 (void) memset(&idres, 0, sizeof (idres)); 4201c5c4113dSnw141292 (void) memset(&state, 0, sizeof (state)); 4202479ac375Sdm199847 state.cache = cache; 4203479ac375Sdm199847 state.db = db; 4204c5c4113dSnw141292 4205e8c27ec8Sbaban /* Get directory-based name mapping info */ 4206479ac375Sdm199847 retcode = load_cfg_in_state(&state); 4207e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4208c5c4113dSnw141292 goto out; 4209c5c4113dSnw141292 4210e8c27ec8Sbaban /* 4211e8c27ec8Sbaban * Copy data from "request" to "mapping". Note that 4212e8c27ec8Sbaban * empty strings are not copied from "request" to 4213e8c27ec8Sbaban * "mapping" and therefore the coresponding strings in 4214e8c27ec8Sbaban * "mapping" will be NULL. This eliminates having to 4215e8c27ec8Sbaban * check for empty strings henceforth. 4216e8c27ec8Sbaban */ 4217651c0131Sbaban if (copy_mapping_request(mapping, request) < 0) { 4218651c0131Sbaban retcode = IDMAP_ERR_MEMORY; 4219651c0131Sbaban goto out; 4220651c0131Sbaban } 4221c5c4113dSnw141292 42228e228215Sdm199847 winname = mapping->id1name; 42238e228215Sdm199847 windomain = mapping->id1domain; 4224c5c4113dSnw141292 4225e8c27ec8Sbaban if (winname == NULL && windomain != NULL) { 4226c5c4113dSnw141292 retcode = IDMAP_ERR_ARG; 4227c5c4113dSnw141292 goto out; 4228c5c4113dSnw141292 } 4229c5c4113dSnw141292 4230e8c27ec8Sbaban /* Need atleast winname or sid to proceed */ 4231e8c27ec8Sbaban if (winname == NULL && mapping->id1.idmap_id_u.sid.prefix == NULL) { 4232e8c27ec8Sbaban retcode = IDMAP_ERR_ARG; 4233e8c27ec8Sbaban goto out; 4234e8c27ec8Sbaban } 4235e8c27ec8Sbaban 4236e8c27ec8Sbaban /* 4237e8c27ec8Sbaban * If domainname is not given but we have a fully qualified 4238e8c27ec8Sbaban * winname then extract the domainname from the winname, 4239e8c27ec8Sbaban * otherwise use the default_domain from the config 4240e8c27ec8Sbaban */ 4241e8c27ec8Sbaban if (winname != NULL && windomain == NULL) { 42428e228215Sdm199847 retcode = IDMAP_SUCCESS; 4243dd5829d1Sbaban if ((cp = strchr(winname, '@')) != NULL) { 4244dd5829d1Sbaban *cp = '\0'; 42458e228215Sdm199847 mapping->id1domain = strdup(cp + 1); 42468e228215Sdm199847 if (mapping->id1domain == NULL) 42478e228215Sdm199847 retcode = IDMAP_ERR_MEMORY; 4248e8c27ec8Sbaban } else if (lookup_wksids_name2sid(winname, NULL, NULL, NULL, 4249e8c27ec8Sbaban NULL) != IDMAP_SUCCESS) { 425082da9f60Sbaban if (state.defdom == NULL) { 425182da9f60Sbaban /* 425282da9f60Sbaban * We have a non-qualified winname which is 425382da9f60Sbaban * neither the name of a well-known SID nor 425482da9f60Sbaban * there is a default domain with which we can 425582da9f60Sbaban * qualify it. 425682da9f60Sbaban */ 425782da9f60Sbaban retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 425882da9f60Sbaban } else { 4259479ac375Sdm199847 mapping->id1domain = strdup(state.defdom); 42608e228215Sdm199847 if (mapping->id1domain == NULL) 42618e228215Sdm199847 retcode = IDMAP_ERR_MEMORY; 42628e228215Sdm199847 } 426382da9f60Sbaban } 4264c5c4113dSnw141292 if (retcode != IDMAP_SUCCESS) 4265c5c4113dSnw141292 goto out; 4266c5c4113dSnw141292 } 4267c5c4113dSnw141292 4268e8c27ec8Sbaban /* 4269e8c27ec8Sbaban * First pass looks up the well-known SIDs table and cache 4270e8c27ec8Sbaban * and handles localSIDs 4271e8c27ec8Sbaban */ 4272c5c4113dSnw141292 state.sid2pid_done = TRUE; 4273479ac375Sdm199847 retcode = sid2pid_first_pass(&state, mapping, &idres); 4274c5c4113dSnw141292 if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE) 4275c5c4113dSnw141292 goto out; 4276c5c4113dSnw141292 4277479ac375Sdm199847 /* AD lookup */ 4278e8c27ec8Sbaban if (state.ad_nqueries > 0) { 4279479ac375Sdm199847 retcode = ad_lookup_one(&state, mapping, &idres); 4280e8c27ec8Sbaban if (IDMAP_ERROR(retcode)) 4281e8c27ec8Sbaban goto out; 4282c5c4113dSnw141292 } 4283c5c4113dSnw141292 4284479ac375Sdm199847 /* nldap lookup */ 4285479ac375Sdm199847 if (state.nldap_nqueries > 0) { 4286479ac375Sdm199847 retcode = nldap_lookup_one(&state, mapping, &idres); 4287479ac375Sdm199847 if (IDMAP_FATAL_ERROR(retcode)) 4288e8c27ec8Sbaban goto out; 428948258c6bSjp151216 } 4290e8c27ec8Sbaban 4291e8c27ec8Sbaban /* Next pass performs name-based mapping and ephemeral mapping. */ 4292c5c4113dSnw141292 state.sid2pid_done = TRUE; 4293479ac375Sdm199847 retcode = sid2pid_second_pass(&state, mapping, &idres); 4294c5c4113dSnw141292 if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE) 4295c5c4113dSnw141292 goto out; 4296c5c4113dSnw141292 4297c5c4113dSnw141292 /* Update cache */ 4298479ac375Sdm199847 (void) update_cache_sid2pid(&state, mapping, &idres); 4299c5c4113dSnw141292 4300c5c4113dSnw141292 out: 4301e8c27ec8Sbaban /* 4302e8c27ec8Sbaban * Note that "mapping" is returned to the client. Therefore 4303e8c27ec8Sbaban * copy whatever we have in "idres" to mapping->id2 and 4304e8c27ec8Sbaban * free idres. 4305e8c27ec8Sbaban */ 4306c5c4113dSnw141292 mapping->direction = idres.direction; 4307c5c4113dSnw141292 mapping->id2 = idres.id; 430848258c6bSjp151216 if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO || 430948258c6bSjp151216 retcode != IDMAP_SUCCESS) 431048258c6bSjp151216 (void) idmap_info_mov(&mapping->info, &idres.info); 431148258c6bSjp151216 else 431248258c6bSjp151216 idmap_info_free(&idres.info); 4313c5c4113dSnw141292 (void) memset(&idres, 0, sizeof (idres)); 4314e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 431562c60062Sbaban mapping->id2.idmap_id_u.uid = UID_NOBODY; 4316c5c4113dSnw141292 xdr_free(xdr_idmap_id_res, (caddr_t)&idres); 4317e8c27ec8Sbaban cleanup_lookup_state(&state); 4318c5c4113dSnw141292 return (retcode); 4319c5c4113dSnw141292 } 4320c5c4113dSnw141292 4321c5c4113dSnw141292 idmap_retcode 4322c5c4113dSnw141292 get_u2w_mapping(sqlite *cache, sqlite *db, idmap_mapping *request, 4323cd37da74Snw141292 idmap_mapping *mapping, int is_user) 4324cd37da74Snw141292 { 4325c5c4113dSnw141292 idmap_id_res idres; 4326c5c4113dSnw141292 lookup_state_t state; 4327c5c4113dSnw141292 idmap_retcode retcode; 4328c5c4113dSnw141292 4329c5c4113dSnw141292 /* 4330c5c4113dSnw141292 * In order to re-use the pid2sid code, we convert 4331c5c4113dSnw141292 * our input data into structs that are expected by 4332c5c4113dSnw141292 * pid2sid_first_pass. 4333c5c4113dSnw141292 */ 4334c5c4113dSnw141292 4335c5c4113dSnw141292 (void) memset(&idres, 0, sizeof (idres)); 4336c5c4113dSnw141292 (void) memset(&state, 0, sizeof (state)); 4337479ac375Sdm199847 state.cache = cache; 4338479ac375Sdm199847 state.db = db; 4339c5c4113dSnw141292 4340e8c27ec8Sbaban /* Get directory-based name mapping info */ 4341479ac375Sdm199847 retcode = load_cfg_in_state(&state); 4342e8c27ec8Sbaban if (retcode != IDMAP_SUCCESS) 4343e8c27ec8Sbaban goto out; 4344e8c27ec8Sbaban 4345e8c27ec8Sbaban /* 4346e8c27ec8Sbaban * Copy data from "request" to "mapping". Note that 4347e8c27ec8Sbaban * empty strings are not copied from "request" to 4348e8c27ec8Sbaban * "mapping" and therefore the coresponding strings in 4349e8c27ec8Sbaban * "mapping" will be NULL. This eliminates having to 4350e8c27ec8Sbaban * check for empty strings henceforth. 4351e8c27ec8Sbaban */ 4352651c0131Sbaban if (copy_mapping_request(mapping, request) < 0) { 4353651c0131Sbaban retcode = IDMAP_ERR_MEMORY; 4354651c0131Sbaban goto out; 4355651c0131Sbaban } 4356c5c4113dSnw141292 4357e8c27ec8Sbaban /* 4358e8c27ec8Sbaban * For unix to windows mapping request, we need atleast a 4359e8c27ec8Sbaban * unixname or uid/gid to proceed 4360e8c27ec8Sbaban */ 4361e8c27ec8Sbaban if (mapping->id1name == NULL && 4362cf5b5989Sdm199847 mapping->id1.idmap_id_u.uid == SENTINEL_PID) { 4363c5c4113dSnw141292 retcode = IDMAP_ERR_ARG; 4364c5c4113dSnw141292 goto out; 4365c5c4113dSnw141292 } 4366c5c4113dSnw141292 4367e8c27ec8Sbaban /* First pass looks up cache and well-known SIDs */ 4368e8c27ec8Sbaban state.pid2sid_done = TRUE; 4369479ac375Sdm199847 retcode = pid2sid_first_pass(&state, mapping, &idres, is_user, 1); 4370e8c27ec8Sbaban if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE) 4371c5c4113dSnw141292 goto out; 4372e8c27ec8Sbaban 4373479ac375Sdm199847 /* nldap lookup */ 4374e8c27ec8Sbaban if (state.nldap_nqueries > 0) { 4375479ac375Sdm199847 retcode = nldap_lookup_one(&state, mapping, &idres); 4376e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) 4377c5c4113dSnw141292 goto out; 4378479ac375Sdm199847 } 4379e8c27ec8Sbaban 4380479ac375Sdm199847 /* AD lookup */ 4381479ac375Sdm199847 if (state.ad_nqueries > 0) { 4382479ac375Sdm199847 retcode = ad_lookup_one(&state, mapping, &idres); 4383e8c27ec8Sbaban if (IDMAP_FATAL_ERROR(retcode)) 4384e8c27ec8Sbaban goto out; 4385c5c4113dSnw141292 } 4386c5c4113dSnw141292 4387e8c27ec8Sbaban /* 4388e8c27ec8Sbaban * Next pass processes the result of the preceding passes/lookups. 4389e8c27ec8Sbaban * It returns if there's nothing more to be done otherwise it 4390e8c27ec8Sbaban * evaluates local name-based mapping rules 4391e8c27ec8Sbaban */ 4392c5c4113dSnw141292 state.pid2sid_done = TRUE; 4393479ac375Sdm199847 retcode = pid2sid_second_pass(&state, mapping, &idres, is_user); 4394c5c4113dSnw141292 if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE) 4395c5c4113dSnw141292 goto out; 4396c5c4113dSnw141292 4397c5c4113dSnw141292 /* Update cache */ 4398479ac375Sdm199847 (void) update_cache_pid2sid(&state, mapping, &idres); 4399c5c4113dSnw141292 4400c5c4113dSnw141292 out: 4401e8c27ec8Sbaban /* 4402e8c27ec8Sbaban * Note that "mapping" is returned to the client. Therefore 4403e8c27ec8Sbaban * copy whatever we have in "idres" to mapping->id2 and 4404e8c27ec8Sbaban * free idres. 4405e8c27ec8Sbaban */ 4406c5c4113dSnw141292 mapping->direction = idres.direction; 4407c5c4113dSnw141292 mapping->id2 = idres.id; 440848258c6bSjp151216 if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO || 440948258c6bSjp151216 retcode != IDMAP_SUCCESS) 441048258c6bSjp151216 (void) idmap_info_mov(&mapping->info, &idres.info); 441148258c6bSjp151216 else 441248258c6bSjp151216 idmap_info_free(&idres.info); 4413c5c4113dSnw141292 (void) memset(&idres, 0, sizeof (idres)); 4414c5c4113dSnw141292 xdr_free(xdr_idmap_id_res, (caddr_t)&idres); 4415e8c27ec8Sbaban cleanup_lookup_state(&state); 4416e8c27ec8Sbaban return (retcode); 4417e8c27ec8Sbaban } 4418e8c27ec8Sbaban 4419479ac375Sdm199847 /*ARGSUSED*/ 4420e8c27ec8Sbaban static 4421e8c27ec8Sbaban idmap_retcode 4422479ac375Sdm199847 ad_lookup_one(lookup_state_t *state, idmap_mapping *req, idmap_id_res *res) 4423e8c27ec8Sbaban { 4424479ac375Sdm199847 idmap_mapping_batch batch; 4425479ac375Sdm199847 idmap_ids_res result; 4426e8c27ec8Sbaban 4427479ac375Sdm199847 batch.idmap_mapping_batch_len = 1; 4428479ac375Sdm199847 batch.idmap_mapping_batch_val = req; 4429479ac375Sdm199847 result.ids.ids_len = 1; 4430479ac375Sdm199847 result.ids.ids_val = res; 4431479ac375Sdm199847 return (ad_lookup_batch(state, &batch, &result)); 4432c5c4113dSnw141292 } 4433