1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 /* 29 * Database related utility routines 30 */ 31 32 #include <stdio.h> 33 #include <stdlib.h> 34 #include <string.h> 35 #include <errno.h> 36 #include <sys/types.h> 37 #include <sys/stat.h> 38 #include <rpc/rpc.h> 39 #include <sys/sid.h> 40 #include <time.h> 41 #include <pwd.h> 42 #include <grp.h> 43 #include <pthread.h> 44 #include <assert.h> 45 #include <sys/u8_textprep.h> 46 47 #include "idmapd.h" 48 #include "adutils.h" 49 #include "string.h" 50 #include "idmap_priv.h" 51 #include "schema.h" 52 #include "nldaputils.h" 53 54 55 static idmap_retcode sql_compile_n_step_once(sqlite *, char *, 56 sqlite_vm **, int *, int, const char ***); 57 static idmap_retcode lookup_wksids_name2sid(const char *, char **, char **, 58 idmap_rid_t *, int *); 59 static idmap_retcode ad_lookup(lookup_state_t *, idmap_mapping *, 60 idmap_id_res *, int, int, int); 61 static idmap_retcode lookup_localsid2pid(idmap_mapping *, idmap_id_res *); 62 static idmap_retcode lookup_cache_name2sid(sqlite *, const char *, 63 const char *, char **, char **, idmap_rid_t *, int *); 64 65 66 #define EMPTY_NAME(name) (*name == 0 || strcmp(name, "\"\"") == 0) 67 68 #define DO_NOT_ALLOC_NEW_ID_MAPPING(req)\ 69 (req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC) 70 71 #define AVOID_NAMESERVICE(req)\ 72 (req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE) 73 74 #define IS_EPHEMERAL(pid) (pid > INT32_MAX && pid != SENTINEL_PID) 75 76 #define LOCALRID_MIN 1000 77 78 79 typedef enum init_db_option { 80 FAIL_IF_CORRUPT = 0, 81 REMOVE_IF_CORRUPT = 1 82 } init_db_option_t; 83 84 /* 85 * Data structure to store well-known SIDs and 86 * associated mappings (if any) 87 */ 88 typedef struct wksids_table { 89 const char *sidprefix; 90 uint32_t rid; 91 const char *winname; 92 int is_wuser; 93 uid_t pid; 94 int is_user; 95 int direction; 96 } wksids_table_t; 97 98 /* 99 * Thread specfic data to hold the database handles so that the 100 * databaes are not opened and closed for every request. It also 101 * contains the sqlite busy handler structure. 102 */ 103 104 struct idmap_busy { 105 const char *name; 106 const int *delays; 107 int delay_size; 108 int total; 109 int sec; 110 }; 111 112 113 typedef struct idmap_tsd { 114 sqlite *db_db; 115 sqlite *cache_db; 116 struct idmap_busy cache_busy; 117 struct idmap_busy db_busy; 118 } idmap_tsd_t; 119 120 121 122 static const int cache_delay_table[] = 123 { 1, 2, 5, 10, 15, 20, 25, 30, 35, 40, 124 50, 50, 60, 70, 80, 90, 100}; 125 126 static const int db_delay_table[] = 127 { 5, 10, 15, 20, 30, 40, 55, 70, 100}; 128 129 130 static pthread_key_t idmap_tsd_key; 131 132 void 133 idmap_tsd_destroy(void *key) 134 { 135 136 idmap_tsd_t *tsd = (idmap_tsd_t *)key; 137 if (tsd) { 138 if (tsd->db_db) 139 (void) sqlite_close(tsd->db_db); 140 if (tsd->cache_db) 141 (void) sqlite_close(tsd->cache_db); 142 free(tsd); 143 } 144 } 145 146 int 147 idmap_init_tsd_key(void) 148 { 149 return (pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy)); 150 } 151 152 153 154 idmap_tsd_t * 155 idmap_get_tsd(void) 156 { 157 idmap_tsd_t *tsd; 158 159 if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) { 160 /* No thread specific data so create it */ 161 if ((tsd = malloc(sizeof (*tsd))) != NULL) { 162 /* Initialize thread specific data */ 163 (void) memset(tsd, 0, sizeof (*tsd)); 164 /* save the trhread specific data */ 165 if (pthread_setspecific(idmap_tsd_key, tsd) != 0) { 166 /* Can't store key */ 167 free(tsd); 168 tsd = NULL; 169 } 170 } else { 171 tsd = NULL; 172 } 173 } 174 175 return (tsd); 176 } 177 178 /* 179 * A simple wrapper around u8_textprep_str() that returns the Unicode 180 * lower-case version of some string. The result must be freed. 181 */ 182 char * 183 tolower_u8(const char *s) 184 { 185 char *res = NULL; 186 char *outs; 187 size_t inlen, outlen, inbytesleft, outbytesleft; 188 int rc, err; 189 190 /* 191 * u8_textprep_str() does not allocate memory. The input and 192 * output buffers may differ in size (though that would be more 193 * likely when normalization is done). We have to loop over it... 194 * 195 * To improve the chances that we can avoid looping we add 10 196 * bytes of output buffer room the first go around. 197 */ 198 inlen = inbytesleft = strlen(s); 199 outlen = outbytesleft = inlen + 10; 200 if ((res = malloc(outlen)) == NULL) 201 return (NULL); 202 outs = res; 203 204 while ((rc = u8_textprep_str((char *)s, &inbytesleft, outs, 205 &outbytesleft, U8_TEXTPREP_TOLOWER, U8_UNICODE_LATEST, &err)) < 0 && 206 err == E2BIG) { 207 if ((res = realloc(res, outlen + inbytesleft)) == NULL) 208 return (NULL); 209 /* adjust input/output buffer pointers */ 210 s += (inlen - inbytesleft); 211 outs = res + outlen - outbytesleft; 212 /* adjust outbytesleft and outlen */ 213 outlen += inbytesleft; 214 outbytesleft += inbytesleft; 215 } 216 217 if (rc < 0) { 218 free(res); 219 res = NULL; 220 return (NULL); 221 } 222 223 res[outlen - outbytesleft] = '\0'; 224 225 return (res); 226 } 227 228 static int sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 229 const char *while_doing); 230 231 232 /* 233 * Initialize 'dbname' using 'sql' 234 */ 235 static 236 int 237 init_db_instance(const char *dbname, int version, 238 const char *detect_version_sql, char * const *sql, 239 init_db_option_t opt, int *created, int *upgraded) 240 { 241 int rc, curr_version; 242 int tries = 1; 243 int prio = LOG_NOTICE; 244 sqlite *db = NULL; 245 char *errmsg = NULL; 246 247 *created = 0; 248 *upgraded = 0; 249 250 if (opt == REMOVE_IF_CORRUPT) 251 tries = 3; 252 253 rinse_repeat: 254 if (tries == 0) { 255 idmapdlog(LOG_ERR, "Failed to initialize db %s", dbname); 256 return (-1); 257 } 258 if (tries-- == 1) 259 /* Last try, log errors */ 260 prio = LOG_ERR; 261 262 db = sqlite_open(dbname, 0600, &errmsg); 263 if (db == NULL) { 264 idmapdlog(prio, "Error creating database %s (%s)", 265 dbname, CHECK_NULL(errmsg)); 266 sqlite_freemem(errmsg); 267 if (opt == REMOVE_IF_CORRUPT) 268 (void) unlink(dbname); 269 goto rinse_repeat; 270 } 271 272 sqlite_busy_timeout(db, 3000); 273 274 /* Detect current version of schema in the db, if any */ 275 curr_version = 0; 276 if (detect_version_sql != NULL) { 277 char *end, **results; 278 int nrow; 279 280 #ifdef IDMAPD_DEBUG 281 (void) fprintf(stderr, "Schema version detection SQL: %s\n", 282 detect_version_sql); 283 #endif /* IDMAPD_DEBUG */ 284 rc = sqlite_get_table(db, detect_version_sql, &results, 285 &nrow, NULL, &errmsg); 286 if (rc != SQLITE_OK) { 287 idmapdlog(prio, 288 "Error detecting schema version of db %s (%s)", 289 dbname, errmsg); 290 sqlite_freemem(errmsg); 291 sqlite_free_table(results); 292 sqlite_close(db); 293 return (-1); 294 } 295 if (nrow != 1) { 296 idmapdlog(prio, 297 "Error detecting schema version of db %s", dbname); 298 sqlite_close(db); 299 sqlite_free_table(results); 300 return (-1); 301 } 302 curr_version = strtol(results[1], &end, 10); 303 sqlite_free_table(results); 304 } 305 306 if (curr_version < 0) { 307 if (opt == REMOVE_IF_CORRUPT) 308 (void) unlink(dbname); 309 goto rinse_repeat; 310 } 311 312 if (curr_version == version) 313 goto done; 314 315 /* Install or upgrade schema */ 316 #ifdef IDMAPD_DEBUG 317 (void) fprintf(stderr, "Schema init/upgrade SQL: %s\n", 318 sql[curr_version]); 319 #endif /* IDMAPD_DEBUG */ 320 rc = sql_exec_tran_no_cb(db, sql[curr_version], dbname, 321 (curr_version == 0) ? "installing schema" : "upgrading schema"); 322 if (rc != 0) { 323 idmapdlog(prio, "Error %s schema for db %s", dbname, 324 (curr_version == 0) ? "installing schema" : 325 "upgrading schema"); 326 if (opt == REMOVE_IF_CORRUPT) 327 (void) unlink(dbname); 328 goto rinse_repeat; 329 } 330 331 *upgraded = (curr_version > 0); 332 *created = (curr_version == 0); 333 334 done: 335 (void) sqlite_close(db); 336 return (0); 337 } 338 339 340 /* 341 * This is the SQLite database busy handler that retries the SQL 342 * operation until it is successful. 343 */ 344 int 345 /* LINTED E_FUNC_ARG_UNUSED */ 346 idmap_sqlite_busy_handler(void *arg, const char *table_name, int count) 347 { 348 struct idmap_busy *busy = arg; 349 int delay; 350 struct timespec rqtp; 351 352 if (count == 1) { 353 busy->total = 0; 354 busy->sec = 2; 355 } 356 if (busy->total > 1000 * busy->sec) { 357 idmapdlog(LOG_DEBUG, 358 "Thread %d waited %d sec for the %s database", 359 pthread_self(), busy->sec, busy->name); 360 busy->sec++; 361 } 362 363 if (count <= busy->delay_size) { 364 delay = busy->delays[count-1]; 365 } else { 366 delay = busy->delays[busy->delay_size - 1]; 367 } 368 busy->total += delay; 369 rqtp.tv_sec = 0; 370 rqtp.tv_nsec = delay * (NANOSEC / MILLISEC); 371 (void) nanosleep(&rqtp, NULL); 372 return (1); 373 } 374 375 376 /* 377 * Get the database handle 378 */ 379 idmap_retcode 380 get_db_handle(sqlite **db) 381 { 382 char *errmsg; 383 idmap_tsd_t *tsd; 384 385 /* 386 * Retrieve the db handle from thread-specific storage 387 * If none exists, open and store in thread-specific storage. 388 */ 389 if ((tsd = idmap_get_tsd()) == NULL) { 390 idmapdlog(LOG_ERR, 391 "Error getting thread specific data for %s", IDMAP_DBNAME); 392 return (IDMAP_ERR_MEMORY); 393 } 394 395 if (tsd->db_db == NULL) { 396 tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg); 397 if (tsd->db_db == NULL) { 398 idmapdlog(LOG_ERR, "Error opening database %s (%s)", 399 IDMAP_DBNAME, CHECK_NULL(errmsg)); 400 sqlite_freemem(errmsg); 401 return (IDMAP_ERR_DB); 402 } 403 404 tsd->db_busy.name = IDMAP_DBNAME; 405 tsd->db_busy.delays = db_delay_table; 406 tsd->db_busy.delay_size = sizeof (db_delay_table) / 407 sizeof (int); 408 sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler, 409 &tsd->db_busy); 410 } 411 *db = tsd->db_db; 412 return (IDMAP_SUCCESS); 413 } 414 415 /* 416 * Get the cache handle 417 */ 418 idmap_retcode 419 get_cache_handle(sqlite **cache) 420 { 421 char *errmsg; 422 idmap_tsd_t *tsd; 423 424 /* 425 * Retrieve the db handle from thread-specific storage 426 * If none exists, open and store in thread-specific storage. 427 */ 428 if ((tsd = idmap_get_tsd()) == NULL) { 429 idmapdlog(LOG_ERR, "Error getting thread specific data for %s", 430 IDMAP_DBNAME); 431 return (IDMAP_ERR_MEMORY); 432 } 433 434 if (tsd->cache_db == NULL) { 435 tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg); 436 if (tsd->cache_db == NULL) { 437 idmapdlog(LOG_ERR, "Error opening database %s (%s)", 438 IDMAP_CACHENAME, CHECK_NULL(errmsg)); 439 sqlite_freemem(errmsg); 440 return (IDMAP_ERR_DB); 441 } 442 443 tsd->cache_busy.name = IDMAP_CACHENAME; 444 tsd->cache_busy.delays = cache_delay_table; 445 tsd->cache_busy.delay_size = sizeof (cache_delay_table) / 446 sizeof (int); 447 sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler, 448 &tsd->cache_busy); 449 } 450 *cache = tsd->cache_db; 451 return (IDMAP_SUCCESS); 452 } 453 454 /* 455 * Initialize cache and db 456 */ 457 int 458 init_dbs() 459 { 460 char *sql[4]; 461 int created, upgraded; 462 463 /* name-based mappings; probably OK to blow away in a pinch(?) */ 464 sql[0] = DB_INSTALL_SQL; 465 sql[1] = DB_UPGRADE_FROM_v1_SQL; 466 sql[2] = NULL; 467 468 if (init_db_instance(IDMAP_DBNAME, DB_VERSION, DB_VERSION_SQL, sql, 469 FAIL_IF_CORRUPT, &created, &upgraded) < 0) 470 return (-1); 471 472 /* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */ 473 sql[0] = CACHE_INSTALL_SQL; 474 sql[1] = CACHE_UPGRADE_FROM_v1_SQL; 475 sql[2] = CACHE_UPGRADE_FROM_v2_SQL; 476 sql[3] = NULL; 477 478 if (init_db_instance(IDMAP_CACHENAME, CACHE_VERSION, CACHE_VERSION_SQL, 479 sql, REMOVE_IF_CORRUPT, &created, &upgraded) < 0) 480 return (-1); 481 482 _idmapdstate.new_eph_db = (created || upgraded) ? 1 : 0; 483 484 return (0); 485 } 486 487 /* 488 * Finalize databases 489 */ 490 void 491 fini_dbs() 492 { 493 } 494 495 /* 496 * This table is a listing of status codes that will be returned to the 497 * client when a SQL command fails with the corresponding error message. 498 */ 499 static msg_table_t sqlmsgtable[] = { 500 {IDMAP_ERR_U2W_NAMERULE_CONFLICT, 501 "columns unixname, is_user, u2w_order are not unique"}, 502 {IDMAP_ERR_W2U_NAMERULE_CONFLICT, 503 "columns winname, windomain, is_user, is_wuser, w2u_order are not" 504 " unique"}, 505 {IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"}, 506 {-1, NULL} 507 }; 508 509 /* 510 * idmapd's version of string2stat to map SQLite messages to 511 * status codes 512 */ 513 idmap_retcode 514 idmapd_string2stat(const char *msg) 515 { 516 int i; 517 for (i = 0; sqlmsgtable[i].msg; i++) { 518 if (strcasecmp(sqlmsgtable[i].msg, msg) == 0) 519 return (sqlmsgtable[i].retcode); 520 } 521 return (IDMAP_ERR_OTHER); 522 } 523 524 /* 525 * Executes some SQL in a transaction. 526 * 527 * Returns 0 on success, -1 if it failed but the rollback succeeded, -2 528 * if the rollback failed. 529 */ 530 static 531 int 532 sql_exec_tran_no_cb(sqlite *db, char *sql, const char *dbname, 533 const char *while_doing) 534 { 535 char *errmsg = NULL; 536 int rc; 537 538 rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg); 539 if (rc != SQLITE_OK) { 540 idmapdlog(LOG_ERR, "Begin transaction failed (%s) " 541 "while %s (%s)", errmsg, while_doing, dbname); 542 sqlite_freemem(errmsg); 543 return (-1); 544 } 545 546 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 547 if (rc != SQLITE_OK) { 548 idmapdlog(LOG_ERR, "Database error (%s) while %s (%s)", errmsg, 549 while_doing, dbname); 550 sqlite_freemem(errmsg); 551 errmsg = NULL; 552 goto rollback; 553 } 554 555 rc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, &errmsg); 556 if (rc == SQLITE_OK) { 557 sqlite_freemem(errmsg); 558 return (0); 559 } 560 561 idmapdlog(LOG_ERR, "Database commit error (%s) while s (%s)", 562 errmsg, while_doing, dbname); 563 sqlite_freemem(errmsg); 564 errmsg = NULL; 565 566 rollback: 567 rc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, &errmsg); 568 if (rc != SQLITE_OK) { 569 idmapdlog(LOG_ERR, "Rollback failed (%s) while %s (%s)", 570 errmsg, while_doing, dbname); 571 sqlite_freemem(errmsg); 572 return (-2); 573 } 574 sqlite_freemem(errmsg); 575 576 return (-1); 577 } 578 579 /* 580 * Execute the given SQL statment without using any callbacks 581 */ 582 idmap_retcode 583 sql_exec_no_cb(sqlite *db, const char *dbname, char *sql) 584 { 585 char *errmsg = NULL; 586 int r; 587 idmap_retcode retcode; 588 589 r = sqlite_exec(db, sql, NULL, NULL, &errmsg); 590 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 591 592 if (r != SQLITE_OK) { 593 idmapdlog(LOG_ERR, "Database error on %s while executing %s " 594 "(%s)", dbname, sql, CHECK_NULL(errmsg)); 595 retcode = idmapd_string2stat(errmsg); 596 if (errmsg != NULL) 597 sqlite_freemem(errmsg); 598 return (retcode); 599 } 600 601 return (IDMAP_SUCCESS); 602 } 603 604 /* 605 * Generate expression that can be used in WHERE statements. 606 * Examples: 607 * <prefix> <col> <op> <value> <suffix> 608 * "" "unixuser" "=" "foo" "AND" 609 */ 610 idmap_retcode 611 gen_sql_expr_from_rule(idmap_namerule *rule, char **out) 612 { 613 char *s_windomain = NULL, *s_winname = NULL; 614 char *s_unixname = NULL; 615 char *lower_winname; 616 int retcode = IDMAP_SUCCESS; 617 618 if (out == NULL) 619 return (IDMAP_ERR_ARG); 620 621 622 if (!EMPTY_STRING(rule->windomain)) { 623 s_windomain = sqlite_mprintf("AND windomain = %Q ", 624 rule->windomain); 625 if (s_windomain == NULL) { 626 retcode = IDMAP_ERR_MEMORY; 627 goto out; 628 } 629 } 630 631 if (!EMPTY_STRING(rule->winname)) { 632 if ((lower_winname = tolower_u8(rule->winname)) == NULL) 633 lower_winname = rule->winname; 634 s_winname = sqlite_mprintf( 635 "AND winname = %Q AND is_wuser = %d ", 636 lower_winname, rule->is_wuser ? 1 : 0); 637 if (lower_winname != rule->winname) 638 free(lower_winname); 639 if (s_winname == NULL) { 640 retcode = IDMAP_ERR_MEMORY; 641 goto out; 642 } 643 } 644 645 if (!EMPTY_STRING(rule->unixname)) { 646 s_unixname = sqlite_mprintf( 647 "AND unixname = %Q AND is_user = %d ", 648 rule->unixname, rule->is_user ? 1 : 0); 649 if (s_unixname == NULL) { 650 retcode = IDMAP_ERR_MEMORY; 651 goto out; 652 } 653 } 654 655 *out = sqlite_mprintf("%s %s %s", 656 s_windomain ? s_windomain : "", 657 s_winname ? s_winname : "", 658 s_unixname ? s_unixname : ""); 659 660 if (*out == NULL) { 661 retcode = IDMAP_ERR_MEMORY; 662 idmapdlog(LOG_ERR, "Out of memory"); 663 goto out; 664 } 665 666 out: 667 if (s_windomain != NULL) 668 sqlite_freemem(s_windomain); 669 if (s_winname != NULL) 670 sqlite_freemem(s_winname); 671 if (s_unixname != NULL) 672 sqlite_freemem(s_unixname); 673 674 return (retcode); 675 } 676 677 678 679 /* 680 * Generate and execute SQL statement for LIST RPC calls 681 */ 682 idmap_retcode 683 process_list_svc_sql(sqlite *db, const char *dbname, char *sql, uint64_t limit, 684 int flag, list_svc_cb cb, void *result) 685 { 686 list_cb_data_t cb_data; 687 char *errmsg = NULL; 688 int r; 689 idmap_retcode retcode = IDMAP_ERR_INTERNAL; 690 691 (void) memset(&cb_data, 0, sizeof (cb_data)); 692 cb_data.result = result; 693 cb_data.limit = limit; 694 cb_data.flag = flag; 695 696 697 r = sqlite_exec(db, sql, cb, &cb_data, &errmsg); 698 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 699 switch (r) { 700 case SQLITE_OK: 701 retcode = IDMAP_SUCCESS; 702 break; 703 704 default: 705 retcode = IDMAP_ERR_INTERNAL; 706 idmapdlog(LOG_ERR, "Database error on %s while executing " 707 "%s (%s)", dbname, sql, CHECK_NULL(errmsg)); 708 break; 709 } 710 if (errmsg != NULL) 711 sqlite_freemem(errmsg); 712 return (retcode); 713 } 714 715 /* 716 * This routine is called by callbacks that process the results of 717 * LIST RPC calls to validate data and to allocate memory for 718 * the result array. 719 */ 720 idmap_retcode 721 validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv, 722 int ncol, uchar_t **list, size_t valsize) 723 { 724 size_t nsize; 725 void *tmplist; 726 727 if (cb_data->limit > 0 && cb_data->next == cb_data->limit) 728 return (IDMAP_NEXT); 729 730 if (argc < ncol || argv == NULL) { 731 idmapdlog(LOG_ERR, "Invalid data"); 732 return (IDMAP_ERR_INTERNAL); 733 } 734 735 /* alloc in bulk to reduce number of reallocs */ 736 if (cb_data->next >= cb_data->len) { 737 nsize = (cb_data->len + SIZE_INCR) * valsize; 738 tmplist = realloc(*list, nsize); 739 if (tmplist == NULL) { 740 idmapdlog(LOG_ERR, "Out of memory"); 741 return (IDMAP_ERR_MEMORY); 742 } 743 *list = tmplist; 744 (void) memset(*list + (cb_data->len * valsize), 0, 745 SIZE_INCR * valsize); 746 cb_data->len += SIZE_INCR; 747 } 748 return (IDMAP_SUCCESS); 749 } 750 751 static 752 idmap_retcode 753 get_namerule_order(char *winname, char *windomain, char *unixname, 754 int direction, int is_diagonal, int *w2u_order, int *u2w_order) 755 { 756 *w2u_order = 0; 757 *u2w_order = 0; 758 759 /* 760 * Windows to UNIX lookup order: 761 * 1. winname@domain (or winname) to "" 762 * 2. winname@domain (or winname) to unixname 763 * 3. winname@* to "" 764 * 4. winname@* to unixname 765 * 5. *@domain (or *) to * 766 * 6. *@domain (or *) to "" 767 * 7. *@domain (or *) to unixname 768 * 8. *@* to * 769 * 9. *@* to "" 770 * 10. *@* to unixname 771 * 772 * winname is a special case of winname@domain when domain is the 773 * default domain. Similarly * is a special case of *@domain when 774 * domain is the default domain. 775 * 776 * Note that "" has priority over specific names because "" inhibits 777 * mappings and traditionally deny rules always had higher priority. 778 */ 779 if (direction != IDMAP_DIRECTION_U2W) { 780 /* bi-directional or from windows to unix */ 781 if (winname == NULL) 782 return (IDMAP_ERR_W2U_NAMERULE); 783 else if (unixname == NULL) 784 return (IDMAP_ERR_W2U_NAMERULE); 785 else if (EMPTY_NAME(winname)) 786 return (IDMAP_ERR_W2U_NAMERULE); 787 else if (*winname == '*' && windomain && *windomain == '*') { 788 if (*unixname == '*') 789 *w2u_order = 8; 790 else if (EMPTY_NAME(unixname)) 791 *w2u_order = 9; 792 else /* unixname == name */ 793 *w2u_order = 10; 794 } else if (*winname == '*') { 795 if (*unixname == '*') 796 *w2u_order = 5; 797 else if (EMPTY_NAME(unixname)) 798 *w2u_order = 6; 799 else /* name */ 800 *w2u_order = 7; 801 } else if (windomain != NULL && *windomain == '*') { 802 /* winname == name */ 803 if (*unixname == '*') 804 return (IDMAP_ERR_W2U_NAMERULE); 805 else if (EMPTY_NAME(unixname)) 806 *w2u_order = 3; 807 else /* name */ 808 *w2u_order = 4; 809 } else { 810 /* winname == name && windomain == null or name */ 811 if (*unixname == '*') 812 return (IDMAP_ERR_W2U_NAMERULE); 813 else if (EMPTY_NAME(unixname)) 814 *w2u_order = 1; 815 else /* name */ 816 *w2u_order = 2; 817 } 818 819 } 820 821 /* 822 * 1. unixname to "", non-diagonal 823 * 2. unixname to winname@domain (or winname), non-diagonal 824 * 3. unixname to "", diagonal 825 * 4. unixname to winname@domain (or winname), diagonal 826 * 5. * to *@domain (or *), non-diagonal 827 * 5. * to *@domain (or *), diagonal 828 * 7. * to "" 829 * 8. * to winname@domain (or winname) 830 * 9. * to "", non-diagonal 831 * 10. * to winname@domain (or winname), diagonal 832 */ 833 if (direction != IDMAP_DIRECTION_W2U) { 834 int diagonal = is_diagonal ? 1 : 0; 835 836 /* bi-directional or from unix to windows */ 837 if (unixname == NULL || EMPTY_NAME(unixname)) 838 return (IDMAP_ERR_U2W_NAMERULE); 839 else if (winname == NULL) 840 return (IDMAP_ERR_U2W_NAMERULE); 841 else if (windomain != NULL && *windomain == '*') 842 return (IDMAP_ERR_U2W_NAMERULE); 843 else if (*unixname == '*') { 844 if (*winname == '*') 845 *u2w_order = 5 + diagonal; 846 else if (EMPTY_NAME(winname)) 847 *u2w_order = 7 + 2 * diagonal; 848 else 849 *u2w_order = 8 + 2 * diagonal; 850 } else { 851 if (*winname == '*') 852 return (IDMAP_ERR_U2W_NAMERULE); 853 else if (EMPTY_NAME(winname)) 854 *u2w_order = 1 + 2 * diagonal; 855 else 856 *u2w_order = 2 + 2 * diagonal; 857 } 858 } 859 return (IDMAP_SUCCESS); 860 } 861 862 /* 863 * Generate and execute SQL statement to add name-based mapping rule 864 */ 865 idmap_retcode 866 add_namerule(sqlite *db, idmap_namerule *rule) 867 { 868 char *sql = NULL; 869 idmap_stat retcode; 870 char *dom = NULL; 871 int w2u_order, u2w_order; 872 char w2ubuf[11], u2wbuf[11]; 873 874 retcode = get_namerule_order(rule->winname, rule->windomain, 875 rule->unixname, rule->direction, 876 rule->is_user == rule->is_wuser ? 0 : 1, &w2u_order, &u2w_order); 877 if (retcode != IDMAP_SUCCESS) 878 goto out; 879 880 if (w2u_order) 881 (void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order); 882 if (u2w_order) 883 (void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order); 884 885 /* 886 * For the triggers on namerules table to work correctly: 887 * 1) Use NULL instead of 0 for w2u_order and u2w_order 888 * 2) Use "" instead of NULL for "no domain" 889 */ 890 891 if (!EMPTY_STRING(rule->windomain)) 892 dom = rule->windomain; 893 else if (lookup_wksids_name2sid(rule->winname, NULL, NULL, NULL, NULL) 894 == IDMAP_SUCCESS) { 895 /* well-known SIDs don't need domain */ 896 dom = ""; 897 } 898 899 RDLOCK_CONFIG(); 900 if (dom == NULL) { 901 if (_idmapdstate.cfg->pgcfg.default_domain) 902 dom = _idmapdstate.cfg->pgcfg.default_domain; 903 else 904 dom = ""; 905 } 906 sql = sqlite_mprintf("INSERT into namerules " 907 "(is_user, is_wuser, windomain, winname_display, is_nt4, " 908 "unixname, w2u_order, u2w_order) " 909 "VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);", 910 rule->is_user ? 1 : 0, rule->is_wuser ? 1 : 0, dom, 911 rule->winname, rule->is_nt4 ? 1 : 0, rule->unixname, 912 w2u_order ? w2ubuf : NULL, u2w_order ? u2wbuf : NULL); 913 UNLOCK_CONFIG(); 914 915 if (sql == NULL) { 916 retcode = IDMAP_ERR_INTERNAL; 917 idmapdlog(LOG_ERR, "Out of memory"); 918 goto out; 919 } 920 921 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 922 923 if (retcode == IDMAP_ERR_OTHER) 924 retcode = IDMAP_ERR_CFG; 925 926 out: 927 if (sql != NULL) 928 sqlite_freemem(sql); 929 return (retcode); 930 } 931 932 /* 933 * Flush name-based mapping rules 934 */ 935 idmap_retcode 936 flush_namerules(sqlite *db) 937 { 938 idmap_stat retcode; 939 940 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "DELETE FROM namerules;"); 941 942 return (retcode); 943 } 944 945 /* 946 * Generate and execute SQL statement to remove a name-based mapping rule 947 */ 948 idmap_retcode 949 rm_namerule(sqlite *db, idmap_namerule *rule) 950 { 951 char *sql = NULL; 952 idmap_stat retcode; 953 char buf[80]; 954 char *expr = NULL; 955 956 if (rule->direction < 0 && EMPTY_STRING(rule->windomain) && 957 EMPTY_STRING(rule->winname) && EMPTY_STRING(rule->unixname)) 958 return (IDMAP_SUCCESS); 959 960 buf[0] = 0; 961 962 if (rule->direction == IDMAP_DIRECTION_BI) 963 (void) snprintf(buf, sizeof (buf), "AND w2u_order > 0" 964 " AND u2w_order > 0"); 965 else if (rule->direction == IDMAP_DIRECTION_W2U) 966 (void) snprintf(buf, sizeof (buf), "AND w2u_order > 0" 967 " AND (u2w_order = 0 OR u2w_order ISNULL)"); 968 else if (rule->direction == IDMAP_DIRECTION_U2W) 969 (void) snprintf(buf, sizeof (buf), "AND u2w_order > 0" 970 " AND (w2u_order = 0 OR w2u_order ISNULL)"); 971 972 retcode = gen_sql_expr_from_rule(rule, &expr); 973 if (retcode != IDMAP_SUCCESS) 974 goto out; 975 976 sql = sqlite_mprintf("DELETE FROM namerules WHERE 1 %s %s;", expr, 977 buf); 978 979 if (sql == NULL) { 980 retcode = IDMAP_ERR_INTERNAL; 981 idmapdlog(LOG_ERR, "Out of memory"); 982 goto out; 983 } 984 985 986 retcode = sql_exec_no_cb(db, IDMAP_DBNAME, sql); 987 988 out: 989 if (expr != NULL) 990 sqlite_freemem(expr); 991 if (sql != NULL) 992 sqlite_freemem(sql); 993 return (retcode); 994 } 995 996 /* 997 * Compile the given SQL query and step just once. 998 * 999 * Input: 1000 * db - db handle 1001 * sql - SQL statement 1002 * 1003 * Output: 1004 * vm - virtual SQL machine 1005 * ncol - number of columns in the result 1006 * values - column values 1007 * 1008 * Return values: 1009 * IDMAP_SUCCESS 1010 * IDMAP_ERR_NOTFOUND 1011 * IDMAP_ERR_INTERNAL 1012 */ 1013 1014 static 1015 idmap_retcode 1016 sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol, 1017 int reqcol, const char ***values) 1018 { 1019 char *errmsg = NULL; 1020 int r; 1021 1022 if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) { 1023 idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1024 CHECK_NULL(errmsg)); 1025 sqlite_freemem(errmsg); 1026 return (IDMAP_ERR_INTERNAL); 1027 } 1028 1029 r = sqlite_step(*vm, ncol, values, NULL); 1030 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 1031 1032 if (r == SQLITE_ROW) { 1033 if (ncol != NULL && *ncol < reqcol) { 1034 (void) sqlite_finalize(*vm, NULL); 1035 *vm = NULL; 1036 return (IDMAP_ERR_INTERNAL); 1037 } 1038 /* Caller will call finalize after using the results */ 1039 return (IDMAP_SUCCESS); 1040 } else if (r == SQLITE_DONE) { 1041 (void) sqlite_finalize(*vm, NULL); 1042 *vm = NULL; 1043 return (IDMAP_ERR_NOTFOUND); 1044 } 1045 1046 (void) sqlite_finalize(*vm, &errmsg); 1047 *vm = NULL; 1048 idmapdlog(LOG_ERR, "Database error during %s (%s)", sql, 1049 CHECK_NULL(errmsg)); 1050 sqlite_freemem(errmsg); 1051 return (IDMAP_ERR_INTERNAL); 1052 } 1053 1054 /* 1055 * Update nm_siduid and nm_sidgid fields in the lookup state. 1056 * 1057 * state->nm_siduid represents mode used by sid2uid and uid2sid 1058 * requests for directory-based name mappings. Similarly, 1059 * state->nm_sidgid represents mode used by sid2gid and gid2sid 1060 * requests. 1061 * 1062 * sid2uid/uid2sid: 1063 * none -> ds_name_mapping_enabled != true 1064 * AD-mode -> !nldap_winname_attr && ad_unixuser_attr 1065 * nldap-mode -> nldap_winname_attr && !ad_unixuser_attr 1066 * mixed-mode -> nldap_winname_attr && ad_unixuser_attr 1067 * 1068 * sid2gid/gid2sid: 1069 * none -> ds_name_mapping_enabled != true 1070 * AD-mode -> !nldap_winname_attr && ad_unixgroup_attr 1071 * nldap-mode -> nldap_winname_attr && !ad_unixgroup_attr 1072 * mixed-mode -> nldap_winname_attr && ad_unixgroup_attr 1073 */ 1074 idmap_retcode 1075 get_ds_namemap_type(lookup_state_t *state) 1076 { 1077 state->nm_siduid = IDMAP_NM_NONE; 1078 state->nm_sidgid = IDMAP_NM_NONE; 1079 RDLOCK_CONFIG(); 1080 if (_idmapdstate.cfg->pgcfg.ds_name_mapping_enabled == FALSE) { 1081 UNLOCK_CONFIG(); 1082 return (IDMAP_SUCCESS); 1083 } 1084 if (_idmapdstate.cfg->pgcfg.nldap_winname_attr != NULL) { 1085 state->nm_siduid = 1086 (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1087 ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1088 state->nm_sidgid = 1089 (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1090 ? IDMAP_NM_MIXED : IDMAP_NM_NLDAP; 1091 } else { 1092 state->nm_siduid = 1093 (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) 1094 ? IDMAP_NM_AD : IDMAP_NM_NONE; 1095 state->nm_sidgid = 1096 (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) 1097 ? IDMAP_NM_AD : IDMAP_NM_NONE; 1098 } 1099 if (_idmapdstate.cfg->pgcfg.ad_unixuser_attr != NULL) { 1100 state->ad_unixuser_attr = 1101 strdup(_idmapdstate.cfg->pgcfg.ad_unixuser_attr); 1102 if (state->ad_unixuser_attr == NULL) { 1103 UNLOCK_CONFIG(); 1104 return (IDMAP_ERR_MEMORY); 1105 } 1106 } 1107 if (_idmapdstate.cfg->pgcfg.ad_unixgroup_attr != NULL) { 1108 state->ad_unixgroup_attr = 1109 strdup(_idmapdstate.cfg->pgcfg.ad_unixgroup_attr); 1110 if (state->ad_unixgroup_attr == NULL) { 1111 UNLOCK_CONFIG(); 1112 return (IDMAP_ERR_MEMORY); 1113 } 1114 } 1115 UNLOCK_CONFIG(); 1116 return (IDMAP_SUCCESS); 1117 } 1118 1119 /* 1120 * Set the rule with sepecified values. 1121 * All the strings are copied. 1122 */ 1123 static void 1124 idmap_namerule_set(idmap_namerule *rule, const char *windomain, 1125 const char *winname, const char *unixname, boolean_t is_user, 1126 boolean_t is_wuser, boolean_t is_nt4, int direction) 1127 { 1128 /* 1129 * Only update if they differ because we have to free 1130 * and duplicate the strings 1131 */ 1132 if (rule->windomain == NULL || windomain == NULL || 1133 strcmp(rule->windomain, windomain) != 0) { 1134 if (rule->windomain != NULL) { 1135 free(rule->windomain); 1136 rule->windomain = NULL; 1137 } 1138 if (windomain != NULL) 1139 rule->windomain = strdup(windomain); 1140 } 1141 1142 if (rule->winname == NULL || winname == NULL || 1143 strcmp(rule->winname, winname) != 0) { 1144 if (rule->winname != NULL) { 1145 free(rule->winname); 1146 rule->winname = NULL; 1147 } 1148 if (winname != NULL) 1149 rule->winname = strdup(winname); 1150 } 1151 1152 if (rule->unixname == NULL || unixname == NULL || 1153 strcmp(rule->unixname, unixname) != 0) { 1154 if (rule->unixname != NULL) { 1155 free(rule->unixname); 1156 rule->unixname = NULL; 1157 } 1158 if (unixname != NULL) 1159 rule->unixname = strdup(unixname); 1160 } 1161 1162 rule->is_user = is_user; 1163 rule->is_wuser = is_wuser; 1164 rule->is_nt4 = is_nt4; 1165 rule->direction = direction; 1166 } 1167 1168 1169 /* 1170 * Table for well-known SIDs. 1171 * 1172 * Background: 1173 * 1174 * Some of the well-known principals are stored under: 1175 * cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain> 1176 * They belong to objectClass "foreignSecurityPrincipal". They don't have 1177 * "samAccountName" nor "userPrincipalName" attributes. Their names are 1178 * available in "cn" and "name" attributes. Some of these principals have a 1179 * second entry under CN=ForeignSecurityPrincipals,dc=<forestRootDomain> and 1180 * these duplicate entries have the stringified SID in the "name" and "cn" 1181 * attributes instead of the actual name. 1182 * 1183 * Those of the form S-1-5-32-X are Builtin groups and are stored in the 1184 * cn=builtin container (except, Power Users which is not stored in AD) 1185 * 1186 * These principals are and will remain constant. Therefore doing AD lookups 1187 * provides no benefit. Also, using hard-coded table (and thus avoiding AD 1188 * lookup) improves performance and avoids additional complexity in the 1189 * adutils.c code. Moreover these SIDs can be used when no Active Directory 1190 * is available (such as the CIFS server's "workgroup" mode). 1191 * 1192 * Notes: 1193 * 1. Currently we don't support localization of well-known SID names, 1194 * unlike Windows. 1195 * 1196 * 2. Other well-known SIDs i.e. S-1-5-<domain>-<w-k RID> are not stored 1197 * here. AD does have normal user/group objects for these objects and 1198 * can be looked up using the existing AD lookup code. 1199 * 1200 * 3. See comments above lookup_wksids_sid2pid() for more information 1201 * on how we lookup the wksids table. 1202 */ 1203 static wksids_table_t wksids[] = { 1204 {"S-1-0", 0, "Nobody", 0, SENTINEL_PID, -1, 1}, 1205 {"S-1-1", 0, "Everyone", 0, SENTINEL_PID, -1, -1}, 1206 {"S-1-3", 0, "Creator Owner", 1, IDMAP_WK_CREATOR_OWNER_UID, 1, 0}, 1207 {"S-1-3", 1, "Creator Group", 0, IDMAP_WK_CREATOR_GROUP_GID, 0, 0}, 1208 {"S-1-3", 2, "Creator Owner Server", 1, SENTINEL_PID, -1, -1}, 1209 {"S-1-3", 3, "Creator Group Server", 0, SENTINEL_PID, -1, 1}, 1210 {"S-1-3", 4, "Owner Rights", 0, SENTINEL_PID, -1, -1}, 1211 {"S-1-5", 1, "Dialup", 0, SENTINEL_PID, -1, -1}, 1212 {"S-1-5", 2, "Network", 0, SENTINEL_PID, -1, -1}, 1213 {"S-1-5", 3, "Batch", 0, SENTINEL_PID, -1, -1}, 1214 {"S-1-5", 4, "Interactive", 0, SENTINEL_PID, -1, -1}, 1215 {"S-1-5", 6, "Service", 0, SENTINEL_PID, -1, -1}, 1216 {"S-1-5", 7, "Anonymous Logon", 0, GID_NOBODY, 0, 0}, 1217 {"S-1-5", 7, "Anonymous Logon", 0, UID_NOBODY, 1, 0}, 1218 {"S-1-5", 8, "Proxy", 0, SENTINEL_PID, -1, -1}, 1219 {"S-1-5", 9, "Enterprise Domain Controllers", 0, SENTINEL_PID, -1, -1}, 1220 {"S-1-5", 10, "Self", 0, SENTINEL_PID, -1, -1}, 1221 {"S-1-5", 11, "Authenticated Users", 0, SENTINEL_PID, -1, -1}, 1222 {"S-1-5", 12, "Restricted Code", 0, SENTINEL_PID, -1, -1}, 1223 {"S-1-5", 13, "Terminal Server User", 0, SENTINEL_PID, -1, -1}, 1224 {"S-1-5", 14, "Remote Interactive Logon", 0, SENTINEL_PID, -1, -1}, 1225 {"S-1-5", 15, "This Organization", 0, SENTINEL_PID, -1, -1}, 1226 {"S-1-5", 17, "IUSR", 0, SENTINEL_PID, -1, -1}, 1227 {"S-1-5", 18, "Local System", 0, IDMAP_WK_LOCAL_SYSTEM_GID, 0, 0}, 1228 {"S-1-5", 19, "Local Service", 0, SENTINEL_PID, -1, -1}, 1229 {"S-1-5", 20, "Network Service", 0, SENTINEL_PID, -1, -1}, 1230 {"S-1-5", 1000, "Other Organization", 0, SENTINEL_PID, -1, -1}, 1231 {"S-1-5-32", 544, "Administrators", 0, SENTINEL_PID, -1, -1}, 1232 {"S-1-5-32", 545, "Users", 0, SENTINEL_PID, -1, -1}, 1233 {"S-1-5-32", 546, "Guests", 0, SENTINEL_PID, -1, -1}, 1234 {"S-1-5-32", 547, "Power Users", 0, SENTINEL_PID, -1, -1}, 1235 {"S-1-5-32", 548, "Account Operators", 0, SENTINEL_PID, -1, -1}, 1236 {"S-1-5-32", 549, "Server Operators", 0, SENTINEL_PID, -1, -1}, 1237 {"S-1-5-32", 550, "Print Operators", 0, SENTINEL_PID, -1, -1}, 1238 {"S-1-5-32", 551, "Backup Operators", 0, SENTINEL_PID, -1, -1}, 1239 {"S-1-5-32", 552, "Replicator", 0, SENTINEL_PID, -1, -1}, 1240 {"S-1-5-32", 554, "Pre-Windows 2000 Compatible Access", 0, 1241 SENTINEL_PID, -1, -1}, 1242 {"S-1-5-32", 555, "Remote Desktop Users", 0, SENTINEL_PID, -1, -1}, 1243 {"S-1-5-32", 556, "Network Configuration Operators", 0, 1244 SENTINEL_PID, -1, -1}, 1245 {"S-1-5-32", 557, "Incoming Forest Trust Builders", 0, 1246 SENTINEL_PID, -1, -1}, 1247 {"S-1-5-32", 558, "Performance Monitor Users", 0, SENTINEL_PID, -1, -1}, 1248 {"S-1-5-32", 559, "Performance Log Users", 0, SENTINEL_PID, -1, -1}, 1249 {"S-1-5-32", 560, "Windows Authorization Access Group", 0, 1250 SENTINEL_PID, -1, -1}, 1251 {"S-1-5-32", 561, "Terminal Server License Servers", 0, 1252 SENTINEL_PID, -1, -1}, 1253 {"S-1-5-32", 561, "Distributed COM Users", 0, SENTINEL_PID, -1, -1}, 1254 {"S-1-5-32", 568, "IIS_IUSRS", 0, SENTINEL_PID, -1, -1}, 1255 {"S-1-5-32", 569, "Cryptographic Operators", 0, SENTINEL_PID, -1, -1}, 1256 {"S-1-5-32", 573, "Event Log Readers", 0, SENTINEL_PID, -1, -1}, 1257 {"S-1-5-32", 574, "Certificate Service DCOM Access", 0, 1258 SENTINEL_PID, -1, -1}, 1259 {"S-1-5-64", 21, "Digest Authentication", 0, SENTINEL_PID, -1, -1}, 1260 {"S-1-5-64", 10, "NTLM Authentication", 0, SENTINEL_PID, -1, -1}, 1261 {"S-1-5-64", 14, "SChannel Authentication", 0, SENTINEL_PID, -1, -1}, 1262 {NULL, UINT32_MAX, NULL, -1, SENTINEL_PID, -1, -1} 1263 }; 1264 1265 /* 1266 * Lookup well-known SIDs table either by winname or by SID. 1267 * If the given winname or SID is a well-known SID then we set wksid 1268 * variable and then proceed to see if the SID has a hard mapping to 1269 * a particular UID/GID (Ex: Creator Owner/Creator Group mapped to 1270 * fixed ephemeral ids). If we find such mapping then we return 1271 * success otherwise notfound. If a well-known SID is mapped to 1272 * SENTINEL_PID and the direction field is set (bi-directional or 1273 * win2unix) then we treat it as inhibited mapping and return no 1274 * mapping (Ex. S-1-0-0). 1275 */ 1276 static 1277 idmap_retcode 1278 lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res, int *wksid) 1279 { 1280 int i; 1281 1282 *wksid = 0; 1283 1284 for (i = 0; wksids[i].sidprefix != NULL; i++) { 1285 if (req->id1.idmap_id_u.sid.prefix != NULL) { 1286 if ((strcasecmp(wksids[i].sidprefix, 1287 req->id1.idmap_id_u.sid.prefix) != 0) || 1288 wksids[i].rid != req->id1.idmap_id_u.sid.rid) 1289 /* this is not our SID */ 1290 continue; 1291 if (req->id1name == NULL) { 1292 req->id1name = strdup(wksids[i].winname); 1293 if (req->id1name == NULL) 1294 return (IDMAP_ERR_MEMORY); 1295 } 1296 } else if (req->id1name != NULL) { 1297 if (strcasecmp(wksids[i].winname, req->id1name) != 0) 1298 /* this is not our winname */ 1299 continue; 1300 req->id1.idmap_id_u.sid.prefix = 1301 strdup(wksids[i].sidprefix); 1302 if (req->id1.idmap_id_u.sid.prefix == NULL) 1303 return (IDMAP_ERR_MEMORY); 1304 req->id1.idmap_id_u.sid.rid = wksids[i].rid; 1305 } 1306 1307 *wksid = 1; 1308 req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 1309 1310 req->id1.idtype = (wksids[i].is_wuser) ? 1311 IDMAP_USID : IDMAP_GSID; 1312 1313 if (wksids[i].pid == SENTINEL_PID) { 1314 if (wksids[i].direction == IDMAP_DIRECTION_BI || 1315 wksids[i].direction == IDMAP_DIRECTION_W2U) 1316 /* Inhibited */ 1317 return (IDMAP_ERR_NOMAPPING); 1318 /* Not mapped */ 1319 return (IDMAP_ERR_NOTFOUND); 1320 } else if (wksids[i].direction == IDMAP_DIRECTION_U2W) 1321 continue; 1322 1323 switch (res->id.idtype) { 1324 case IDMAP_UID: 1325 if (wksids[i].is_user == 0) 1326 continue; 1327 res->id.idmap_id_u.uid = wksids[i].pid; 1328 res->direction = wksids[i].direction; 1329 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 1330 res->info.how.map_type = 1331 IDMAP_MAP_TYPE_KNOWN_SID; 1332 res->info.src = IDMAP_MAP_SRC_HARD_CODED; 1333 } 1334 return (IDMAP_SUCCESS); 1335 case IDMAP_GID: 1336 if (wksids[i].is_user == 1) 1337 continue; 1338 res->id.idmap_id_u.gid = wksids[i].pid; 1339 res->direction = wksids[i].direction; 1340 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 1341 res->info.how.map_type = 1342 IDMAP_MAP_TYPE_KNOWN_SID; 1343 res->info.src = IDMAP_MAP_SRC_HARD_CODED; 1344 } 1345 return (IDMAP_SUCCESS); 1346 case IDMAP_POSIXID: 1347 res->id.idmap_id_u.uid = wksids[i].pid; 1348 res->id.idtype = (!wksids[i].is_user) ? 1349 IDMAP_GID : IDMAP_UID; 1350 res->direction = wksids[i].direction; 1351 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 1352 res->info.how.map_type = 1353 IDMAP_MAP_TYPE_KNOWN_SID; 1354 res->info.src = IDMAP_MAP_SRC_HARD_CODED; 1355 } 1356 return (IDMAP_SUCCESS); 1357 default: 1358 return (IDMAP_ERR_NOTSUPPORTED); 1359 } 1360 } 1361 return (IDMAP_ERR_NOTFOUND); 1362 } 1363 1364 1365 static 1366 idmap_retcode 1367 lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user) 1368 { 1369 int i; 1370 if (req->id1.idmap_id_u.uid == SENTINEL_PID) 1371 return (IDMAP_ERR_NOTFOUND); 1372 for (i = 0; wksids[i].sidprefix != NULL; i++) { 1373 if (wksids[i].pid == req->id1.idmap_id_u.uid && 1374 wksids[i].is_user == is_user && 1375 wksids[i].direction != IDMAP_DIRECTION_W2U) { 1376 if (res->id.idtype == IDMAP_SID) { 1377 res->id.idtype = (wksids[i].is_wuser) ? 1378 IDMAP_USID : IDMAP_GSID; 1379 } 1380 res->id.idmap_id_u.sid.rid = wksids[i].rid; 1381 res->id.idmap_id_u.sid.prefix = 1382 strdup(wksids[i].sidprefix); 1383 if (res->id.idmap_id_u.sid.prefix == NULL) { 1384 idmapdlog(LOG_ERR, "Out of memory"); 1385 return (IDMAP_ERR_MEMORY); 1386 } 1387 res->direction = wksids[i].direction; 1388 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 1389 res->info.how.map_type = 1390 IDMAP_MAP_TYPE_KNOWN_SID; 1391 res->info.src = IDMAP_MAP_SRC_HARD_CODED; 1392 } 1393 return (IDMAP_SUCCESS); 1394 } 1395 } 1396 return (IDMAP_ERR_NOTFOUND); 1397 } 1398 1399 static 1400 idmap_retcode 1401 lookup_wksids_name2sid(const char *name, char **canonname, char **sidprefix, 1402 idmap_rid_t *rid, int *type) 1403 { 1404 int i; 1405 for (i = 0; wksids[i].sidprefix != NULL; i++) { 1406 if (strcasecmp(wksids[i].winname, name) != 0) 1407 continue; 1408 if (sidprefix != NULL && 1409 (*sidprefix = strdup(wksids[i].sidprefix)) == NULL) { 1410 idmapdlog(LOG_ERR, "Out of memory"); 1411 return (IDMAP_ERR_MEMORY); 1412 } 1413 if (canonname != NULL && 1414 (*canonname = strdup(wksids[i].winname)) == NULL) { 1415 idmapdlog(LOG_ERR, "Out of memory"); 1416 if (sidprefix != NULL) { 1417 free(*sidprefix); 1418 *sidprefix = NULL; 1419 } 1420 return (IDMAP_ERR_MEMORY); 1421 } 1422 if (type != NULL) 1423 *type = (wksids[i].is_wuser) ? 1424 _IDMAP_T_USER : _IDMAP_T_GROUP; 1425 if (rid != NULL) 1426 *rid = wksids[i].rid; 1427 return (IDMAP_SUCCESS); 1428 } 1429 return (IDMAP_ERR_NOTFOUND); 1430 } 1431 1432 static 1433 idmap_retcode 1434 lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1435 { 1436 char *end; 1437 char *sql = NULL; 1438 const char **values; 1439 sqlite_vm *vm = NULL; 1440 int ncol, is_user; 1441 uid_t pid; 1442 time_t curtime, exp; 1443 idmap_retcode retcode; 1444 char *is_user_string, *lower_name; 1445 1446 /* Current time */ 1447 errno = 0; 1448 if ((curtime = time(NULL)) == (time_t)-1) { 1449 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1450 strerror(errno)); 1451 retcode = IDMAP_ERR_INTERNAL; 1452 goto out; 1453 } 1454 1455 switch (res->id.idtype) { 1456 case IDMAP_UID: 1457 is_user_string = "1"; 1458 break; 1459 case IDMAP_GID: 1460 is_user_string = "0"; 1461 break; 1462 case IDMAP_POSIXID: 1463 /* the non-diagonal mapping */ 1464 is_user_string = "is_wuser"; 1465 break; 1466 default: 1467 retcode = IDMAP_ERR_NOTSUPPORTED; 1468 goto out; 1469 } 1470 1471 /* SQL to lookup the cache */ 1472 1473 if (req->id1.idmap_id_u.sid.prefix != NULL) { 1474 sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 1475 "unixname, u2w, is_wuser, " 1476 "map_type, map_dn, map_attr, map_value, " 1477 "map_windomain, map_winname, map_unixname, map_is_nt4 " 1478 "FROM idmap_cache WHERE is_user = %s AND " 1479 "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 1480 "(pid >= 2147483648 OR " 1481 "(expiration = 0 OR expiration ISNULL OR " 1482 "expiration > %d));", 1483 is_user_string, req->id1.idmap_id_u.sid.prefix, 1484 req->id1.idmap_id_u.sid.rid, curtime); 1485 } else if (req->id1name != NULL) { 1486 if ((lower_name = tolower_u8(req->id1name)) == NULL) 1487 lower_name = req->id1name; 1488 sql = sqlite_mprintf("SELECT pid, is_user, expiration, " 1489 "unixname, u2w, is_wuser, " 1490 "map_type, map_dn, map_attr, map_value, " 1491 "map_windomain, map_winname, map_unixname, map_is_nt4 " 1492 "FROM idmap_cache WHERE is_user = %s AND " 1493 "winname = %Q AND windomain = %Q AND w2u = 1 AND " 1494 "(pid >= 2147483648 OR " 1495 "(expiration = 0 OR expiration ISNULL OR " 1496 "expiration > %d));", 1497 is_user_string, lower_name, req->id1domain, 1498 curtime); 1499 if (lower_name != req->id1name) 1500 free(lower_name); 1501 } else { 1502 retcode = IDMAP_ERR_ARG; 1503 goto out; 1504 } 1505 if (sql == NULL) { 1506 idmapdlog(LOG_ERR, "Out of memory"); 1507 retcode = IDMAP_ERR_MEMORY; 1508 goto out; 1509 } 1510 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 1511 14, &values); 1512 sqlite_freemem(sql); 1513 1514 if (retcode == IDMAP_ERR_NOTFOUND) { 1515 goto out; 1516 } else if (retcode == IDMAP_SUCCESS) { 1517 /* sanity checks */ 1518 if (values[0] == NULL || values[1] == NULL) { 1519 retcode = IDMAP_ERR_CACHE; 1520 goto out; 1521 } 1522 1523 pid = strtoul(values[0], &end, 10); 1524 is_user = strncmp(values[1], "0", 2) ? 1 : 0; 1525 1526 if (is_user) { 1527 res->id.idtype = IDMAP_UID; 1528 res->id.idmap_id_u.uid = pid; 1529 } else { 1530 res->id.idtype = IDMAP_GID; 1531 res->id.idmap_id_u.gid = pid; 1532 } 1533 1534 /* 1535 * We may have an expired ephemeral mapping. Consider 1536 * the expired entry as valid if we are not going to 1537 * perform name-based mapping. But do not renew the 1538 * expiration. 1539 * If we will be doing name-based mapping then store the 1540 * ephemeral pid in the result so that we can use it 1541 * if we end up doing dynamic mapping again. 1542 */ 1543 if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) && 1544 !AVOID_NAMESERVICE(req) && 1545 IS_EPHEMERAL(pid) && values[2] != NULL) { 1546 exp = strtoll(values[2], &end, 10); 1547 if (exp && exp <= curtime) { 1548 /* Store the ephemeral pid */ 1549 res->direction = IDMAP_DIRECTION_BI; 1550 req->direction |= is_user 1551 ? _IDMAP_F_EXP_EPH_UID 1552 : _IDMAP_F_EXP_EPH_GID; 1553 retcode = IDMAP_ERR_NOTFOUND; 1554 } 1555 } 1556 } 1557 1558 out: 1559 if (retcode == IDMAP_SUCCESS) { 1560 if (values[4] != NULL) 1561 res->direction = 1562 (strtol(values[4], &end, 10) == 0)? 1563 IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 1564 else 1565 res->direction = IDMAP_DIRECTION_W2U; 1566 1567 if (values[3] != NULL) { 1568 if (req->id2name != NULL) 1569 free(req->id2name); 1570 req->id2name = strdup(values[3]); 1571 if (req->id2name == NULL) { 1572 idmapdlog(LOG_ERR, "Out of memory"); 1573 retcode = IDMAP_ERR_MEMORY; 1574 } 1575 } 1576 1577 req->id1.idtype = strncmp(values[5], "0", 2) ? 1578 IDMAP_USID : IDMAP_GSID; 1579 1580 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 1581 res->info.src = IDMAP_MAP_SRC_CACHE; 1582 res->info.how.map_type = strtoul(values[6], &end, 10); 1583 switch (res->info.how.map_type) { 1584 case IDMAP_MAP_TYPE_DS_AD: 1585 res->info.how.idmap_how_u.ad.dn = 1586 strdup(values[7]); 1587 res->info.how.idmap_how_u.ad.attr = 1588 strdup(values[8]); 1589 res->info.how.idmap_how_u.ad.value = 1590 strdup(values[9]); 1591 break; 1592 1593 case IDMAP_MAP_TYPE_DS_NLDAP: 1594 res->info.how.idmap_how_u.nldap.dn = 1595 strdup(values[7]); 1596 res->info.how.idmap_how_u.nldap.attr = 1597 strdup(values[8]); 1598 res->info.how.idmap_how_u.nldap.value = 1599 strdup(values[9]); 1600 break; 1601 1602 case IDMAP_MAP_TYPE_RULE_BASED: 1603 res->info.how.idmap_how_u.rule.windomain = 1604 strdup(values[10]); 1605 res->info.how.idmap_how_u.rule.winname = 1606 strdup(values[11]); 1607 res->info.how.idmap_how_u.rule.unixname = 1608 strdup(values[12]); 1609 res->info.how.idmap_how_u.rule.is_nt4 = 1610 strtoul(values[13], &end, 1); 1611 res->info.how.idmap_how_u.rule.is_user = 1612 is_user; 1613 res->info.how.idmap_how_u.rule.is_wuser = 1614 strtoul(values[5], &end, 1); 1615 break; 1616 1617 case IDMAP_MAP_TYPE_EPHEMERAL: 1618 break; 1619 1620 case IDMAP_MAP_TYPE_LOCAL_SID: 1621 break; 1622 1623 case IDMAP_MAP_TYPE_KNOWN_SID: 1624 break; 1625 1626 default: 1627 /* Unknow mapping type */ 1628 assert(FALSE); 1629 } 1630 } 1631 } 1632 if (vm != NULL) 1633 (void) sqlite_finalize(vm, NULL); 1634 return (retcode); 1635 } 1636 1637 static 1638 idmap_retcode 1639 lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid, 1640 char **name, char **domain, int *type) 1641 { 1642 char *end; 1643 char *sql = NULL; 1644 const char **values; 1645 sqlite_vm *vm = NULL; 1646 int ncol; 1647 time_t curtime; 1648 idmap_retcode retcode = IDMAP_SUCCESS; 1649 1650 /* Get current time */ 1651 errno = 0; 1652 if ((curtime = time(NULL)) == (time_t)-1) { 1653 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 1654 strerror(errno)); 1655 retcode = IDMAP_ERR_INTERNAL; 1656 goto out; 1657 } 1658 1659 /* SQL to lookup the cache */ 1660 sql = sqlite_mprintf("SELECT canon_name, domain, type " 1661 "FROM name_cache WHERE " 1662 "sidprefix = %Q AND rid = %u AND " 1663 "(expiration = 0 OR expiration ISNULL OR " 1664 "expiration > %d);", 1665 sidprefix, rid, curtime); 1666 if (sql == NULL) { 1667 idmapdlog(LOG_ERR, "Out of memory"); 1668 retcode = IDMAP_ERR_MEMORY; 1669 goto out; 1670 } 1671 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values); 1672 sqlite_freemem(sql); 1673 1674 if (retcode == IDMAP_SUCCESS) { 1675 if (type != NULL) { 1676 if (values[2] == NULL) { 1677 retcode = IDMAP_ERR_CACHE; 1678 goto out; 1679 } 1680 *type = strtol(values[2], &end, 10); 1681 } 1682 1683 if (name != NULL && values[0] != NULL) { 1684 if ((*name = strdup(values[0])) == NULL) { 1685 idmapdlog(LOG_ERR, "Out of memory"); 1686 retcode = IDMAP_ERR_MEMORY; 1687 goto out; 1688 } 1689 } 1690 1691 if (domain != NULL && values[1] != NULL) { 1692 if ((*domain = strdup(values[1])) == NULL) { 1693 if (name != NULL && *name) { 1694 free(*name); 1695 *name = NULL; 1696 } 1697 idmapdlog(LOG_ERR, "Out of memory"); 1698 retcode = IDMAP_ERR_MEMORY; 1699 goto out; 1700 } 1701 } 1702 } 1703 1704 out: 1705 if (vm != NULL) 1706 (void) sqlite_finalize(vm, NULL); 1707 return (retcode); 1708 } 1709 1710 /* 1711 * Given SID, find winname using name_cache OR 1712 * Given winname, find SID using name_cache. 1713 * Used when mapping win to unix i.e. req->id1 is windows id and 1714 * req->id2 is unix id 1715 */ 1716 static 1717 idmap_retcode 1718 lookup_name_cache(sqlite *cache, idmap_mapping *req, idmap_id_res *res) 1719 { 1720 int type = -1; 1721 idmap_retcode retcode; 1722 char *sidprefix = NULL; 1723 idmap_rid_t rid; 1724 char *name = NULL, *domain = NULL; 1725 1726 /* Done if we've both sid and winname */ 1727 if (req->id1.idmap_id_u.sid.prefix != NULL && req->id1name != NULL) 1728 return (IDMAP_SUCCESS); 1729 1730 /* Lookup sid to winname */ 1731 if (req->id1.idmap_id_u.sid.prefix != NULL) { 1732 retcode = lookup_cache_sid2name(cache, 1733 req->id1.idmap_id_u.sid.prefix, 1734 req->id1.idmap_id_u.sid.rid, &name, &domain, &type); 1735 goto out; 1736 } 1737 1738 /* Lookup winame to sid */ 1739 retcode = lookup_cache_name2sid(cache, req->id1name, req->id1domain, 1740 &name, &sidprefix, &rid, &type); 1741 1742 out: 1743 if (retcode != IDMAP_SUCCESS) { 1744 free(name); 1745 free(domain); 1746 free(sidprefix); 1747 return (retcode); 1748 } 1749 1750 if (res->id.idtype == IDMAP_POSIXID) { 1751 res->id.idtype = (type == _IDMAP_T_USER) ? 1752 IDMAP_UID : IDMAP_GID; 1753 } 1754 req->id1.idtype = (type == _IDMAP_T_USER) ? 1755 IDMAP_USID : IDMAP_GSID; 1756 1757 req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 1758 if (name != NULL) { 1759 free(req->id1name); /* Free existing winname */ 1760 req->id1name = name; /* and use canonical name instead */ 1761 } 1762 if (req->id1domain == NULL) 1763 req->id1domain = domain; 1764 if (req->id1.idmap_id_u.sid.prefix == NULL) { 1765 req->id1.idmap_id_u.sid.prefix = sidprefix; 1766 req->id1.idmap_id_u.sid.rid = rid; 1767 } 1768 return (retcode); 1769 } 1770 1771 /* 1772 * Batch AD lookups 1773 */ 1774 idmap_retcode 1775 ad_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch, 1776 idmap_ids_res *result) 1777 { 1778 idmap_retcode retcode; 1779 int i, add, type, is_wuser, is_user; 1780 int retries = 0, eunixtype; 1781 char **unixname; 1782 idmap_mapping *req; 1783 idmap_id_res *res; 1784 idmap_query_state_t *qs = NULL; 1785 idmap_how *how; 1786 1787 /* 1788 * Since req->id2.idtype is unused, we will use it here 1789 * to retrieve the value of sid_type. But it needs to be 1790 * reset to IDMAP_NONE before we return to prevent xdr 1791 * from mis-interpreting req->id2 when it tries to free 1792 * the input argument. Other option is to allocate an 1793 * array of integers and use it instead for the batched 1794 * call. But why un-necessarily allocate memory. That may 1795 * be an option if req->id2.idtype cannot be re-used in 1796 * future. 1797 */ 1798 1799 if (state->ad_nqueries == 0) 1800 return (IDMAP_SUCCESS); 1801 1802 retry: 1803 retcode = idmap_lookup_batch_start(_idmapdstate.ad, state->ad_nqueries, 1804 &qs); 1805 if (retcode != IDMAP_SUCCESS) { 1806 if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2) 1807 goto retry; 1808 degrade_svc(1, "failed to create batch for AD lookup"); 1809 goto out; 1810 } 1811 1812 restore_svc(); 1813 1814 idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr, 1815 state->ad_unixgroup_attr); 1816 1817 for (i = 0, add = 0; i < batch->idmap_mapping_batch_len; i++) { 1818 req = &batch->idmap_mapping_batch_val[i]; 1819 res = &result->ids.ids_val[i]; 1820 how = &res->info.how; 1821 1822 retcode = IDMAP_SUCCESS; 1823 req->id2.idtype = IDMAP_NONE; 1824 1825 /* Skip if not marked for AD lookup */ 1826 if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 1827 continue; 1828 1829 if (retries == 0) 1830 res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR; 1831 else if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR) 1832 continue; 1833 /* 1834 * Make sure that info is not set as we may be performing 1835 * a retry. 1836 */ 1837 idmap_info_free(&res->info); 1838 1839 if (IS_REQUEST_SID(*req, 1)) { 1840 /* win to unix */ 1841 1842 assert(req->id1.idmap_id_u.sid.prefix != NULL); 1843 1844 /* Lookup AD by SID */ 1845 unixname = NULL; 1846 eunixtype = _IDMAP_T_UNDEF; 1847 if (req->id2name == NULL) { 1848 if (res->id.idtype == IDMAP_UID && 1849 AD_OR_MIXED(state->nm_siduid)) { 1850 eunixtype = _IDMAP_T_USER; 1851 unixname = &req->id2name; 1852 } else if (res->id.idtype == IDMAP_GID && 1853 AD_OR_MIXED(state->nm_sidgid)) { 1854 eunixtype = _IDMAP_T_GROUP; 1855 unixname = &req->id2name; 1856 } else if (AD_OR_MIXED(state->nm_siduid) || 1857 AD_OR_MIXED(state->nm_sidgid)) { 1858 unixname = &req->id2name; 1859 } 1860 } 1861 add = 1; 1862 res->info.src = IDMAP_MAP_SRC_NEW; 1863 how->map_type = IDMAP_MAP_TYPE_DS_AD; 1864 retcode = idmap_sid2name_batch_add1( 1865 qs, req->id1.idmap_id_u.sid.prefix, 1866 &req->id1.idmap_id_u.sid.rid, eunixtype, 1867 &how->idmap_how_u.ad.dn, 1868 &how->idmap_how_u.ad.attr, 1869 &how->idmap_how_u.ad.value, 1870 (req->id1name == NULL) ? &req->id1name : NULL, 1871 (req->id1domain == NULL) ? &req->id1domain : NULL, 1872 (int *)&req->id2.idtype, unixname, &res->retcode); 1873 1874 } else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) { 1875 /* unix to win */ 1876 1877 if (res->id.idmap_id_u.sid.prefix != NULL && 1878 req->id2name != NULL) { 1879 /* Already have SID and winname -- done */ 1880 res->retcode = IDMAP_SUCCESS; 1881 continue; 1882 } 1883 1884 if (res->id.idmap_id_u.sid.prefix != NULL) { 1885 /* 1886 * SID but no winname -- lookup AD by 1887 * SID to get winname. 1888 */ 1889 add = 1; 1890 res->info.src = IDMAP_MAP_SRC_NEW; 1891 how->map_type = IDMAP_MAP_TYPE_DS_AD; 1892 retcode = idmap_sid2name_batch_add1( 1893 qs, res->id.idmap_id_u.sid.prefix, 1894 &res->id.idmap_id_u.sid.rid, 1895 _IDMAP_T_UNDEF, 1896 &how->idmap_how_u.ad.dn, 1897 &how->idmap_how_u.ad.attr, 1898 &how->idmap_how_u.ad.value, 1899 &req->id2name, 1900 &req->id2domain, (int *)&req->id2.idtype, 1901 NULL, &res->retcode); 1902 } else if (req->id2name != NULL) { 1903 /* 1904 * winname but no SID -- lookup AD by 1905 * winname to get SID. 1906 */ 1907 add = 1; 1908 res->info.src = IDMAP_MAP_SRC_NEW; 1909 how->map_type = IDMAP_MAP_TYPE_DS_AD; 1910 retcode = idmap_name2sid_batch_add1( 1911 qs, req->id2name, req->id2domain, 1912 _IDMAP_T_UNDEF, 1913 &how->idmap_how_u.ad.dn, 1914 &how->idmap_how_u.ad.attr, 1915 &how->idmap_how_u.ad.value, 1916 NULL, 1917 &res->id.idmap_id_u.sid.prefix, 1918 &res->id.idmap_id_u.sid.rid, 1919 (int *)&req->id2.idtype, NULL, 1920 &res->retcode); 1921 } else if (req->id1name != NULL) { 1922 /* 1923 * No SID and no winname but we've unixname -- 1924 * lookup AD by unixname to get SID. 1925 */ 1926 is_user = (IS_REQUEST_UID(*req)) ? 1 : 0; 1927 if (res->id.idtype == IDMAP_USID) 1928 is_wuser = 1; 1929 else if (res->id.idtype == IDMAP_GSID) 1930 is_wuser = 0; 1931 else 1932 is_wuser = is_user; 1933 add = 1; 1934 res->info.src = IDMAP_MAP_SRC_NEW; 1935 how->map_type = IDMAP_MAP_TYPE_DS_AD; 1936 retcode = idmap_unixname2sid_batch_add1( 1937 qs, req->id1name, is_user, is_wuser, 1938 &how->idmap_how_u.ad.dn, 1939 &how->idmap_how_u.ad.attr, 1940 &how->idmap_how_u.ad.value, 1941 &res->id.idmap_id_u.sid.prefix, 1942 &res->id.idmap_id_u.sid.rid, 1943 &req->id2name, &req->id2domain, 1944 (int *)&req->id2.idtype, &res->retcode); 1945 } 1946 } 1947 if (retcode != IDMAP_SUCCESS) { 1948 idmap_lookup_release_batch(&qs); 1949 break; 1950 } 1951 } 1952 1953 if (retcode == IDMAP_SUCCESS && add) 1954 retcode = idmap_lookup_batch_end(&qs); 1955 1956 if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2) 1957 goto retry; 1958 else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 1959 degrade_svc(1, "some AD lookups timed out repeatedly"); 1960 1961 if (retcode != IDMAP_SUCCESS) 1962 idmapdlog(LOG_NOTICE, "Failed to batch AD lookup requests"); 1963 1964 out: 1965 /* 1966 * This loop does the following: 1967 * 1) If there are errors in creating or submitting the batch then 1968 * we set the retcode for each request (res->retcode) that's part 1969 * of the batch to that error. If there were no such errors then 1970 * res->retcode for each request will reflect the status of AD 1971 * lookup for that particular request. Initial value of 1972 * res->retcode is IDMAP_ERR_RETRIABLE_NET_ERR. 1973 * 2) If AD lookup for a given request succeeds then evaluate the 1974 * type of the AD object (i.e user or group) and update the 1975 * idtype in res and req. 1976 * 3) Reset req->id2.idtype to IDMAP_NONE. 1977 */ 1978 for (i = 0; i < batch->idmap_mapping_batch_len; i++) { 1979 req = &batch->idmap_mapping_batch_val[i]; 1980 type = req->id2.idtype; 1981 req->id2.idtype = IDMAP_NONE; 1982 res = &result->ids.ids_val[i]; 1983 how = &res->info.how; 1984 1985 if (!(req->direction & _IDMAP_F_LOOKUP_AD)) 1986 /* Entry that wasn't marked for AD lookup - skip */ 1987 continue; 1988 1989 if (retcode != IDMAP_SUCCESS) { 1990 res->retcode = retcode; 1991 continue; 1992 } 1993 1994 if (!add) 1995 continue; 1996 1997 1998 if (res->retcode == IDMAP_ERR_NOTFOUND) { 1999 /* Nothing found - remove the preset info */ 2000 res->info.src = IDMAP_MAP_SRC_UNKNOWN; 2001 how->map_type = IDMAP_MAP_TYPE_UNKNOWN; 2002 } 2003 2004 if (IS_REQUEST_SID(*req, 1)) { 2005 if (res->retcode != IDMAP_SUCCESS) 2006 continue; 2007 switch (type) { 2008 case _IDMAP_T_USER: 2009 if (res->id.idtype == IDMAP_POSIXID) 2010 res->id.idtype = IDMAP_UID; 2011 req->id1.idtype = IDMAP_USID; 2012 break; 2013 case _IDMAP_T_GROUP: 2014 if (res->id.idtype == IDMAP_POSIXID) 2015 res->id.idtype = IDMAP_GID; 2016 req->id1.idtype = IDMAP_GSID; 2017 break; 2018 default: 2019 res->retcode = IDMAP_ERR_SID; 2020 break; 2021 } 2022 } else if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) { 2023 if (res->retcode != IDMAP_SUCCESS) { 2024 if ((!(IDMAP_FATAL_ERROR(res->retcode))) && 2025 res->id.idmap_id_u.sid.prefix == NULL && 2026 req->id2name == NULL && /* no winname */ 2027 req->id1name != NULL) /* unixname */ 2028 /* 2029 * Here we have a pid2sid request 2030 * that was marked for AD lookup 2031 * with no SID, no winname but with 2032 * unixname. This request was 2033 * added to the batch to do AD lookup 2034 * by unixname but it failed with non 2035 * fatal error. In such case we 2036 * ignore the error (i.e set 2037 * res->retcode to success) so that 2038 * next pass considers it for name 2039 * based mapping rules or ephemeral 2040 * mapping. 2041 */ 2042 res->retcode = IDMAP_SUCCESS; 2043 continue; 2044 } 2045 switch (type) { 2046 case _IDMAP_T_USER: 2047 if (res->id.idtype == IDMAP_SID) 2048 res->id.idtype = IDMAP_USID; 2049 break; 2050 case _IDMAP_T_GROUP: 2051 if (res->id.idtype == IDMAP_SID) 2052 res->id.idtype = IDMAP_GSID; 2053 break; 2054 default: 2055 res->retcode = IDMAP_ERR_SID; 2056 break; 2057 } 2058 } 2059 } 2060 2061 /* AD lookups done. Reset state->ad_nqueries and return */ 2062 state->ad_nqueries = 0; 2063 return (retcode); 2064 } 2065 2066 /* 2067 * Convention when processing win2unix requests: 2068 * 2069 * Windows identity: 2070 * req->id1name = 2071 * winname if given otherwise winname found will be placed 2072 * here. 2073 * req->id1domain = 2074 * windomain if given otherwise windomain found will be 2075 * placed here. 2076 * req->id1.idtype = 2077 * Either IDMAP_SID/USID/GSID. If this is IDMAP_SID then it'll 2078 * be set to IDMAP_USID/GSID depending upon whether the 2079 * given SID is user or group respectively. The user/group-ness 2080 * is determined either when looking up well-known SIDs table OR 2081 * if the SID is found in namecache OR by ad_lookup() OR by 2082 * ad_lookup_batch(). 2083 * req->id1..sid.[prefix, rid] = 2084 * SID if given otherwise SID found will be placed here. 2085 * 2086 * Unix identity: 2087 * req->id2name = 2088 * unixname found will be placed here. 2089 * req->id2domain = 2090 * NOT USED 2091 * res->id.idtype = 2092 * Target type initialized from req->id2.idtype. If 2093 * it is IDMAP_POSIXID then actual type (IDMAP_UID/GID) found 2094 * will be placed here. 2095 * res->id..[uid or gid] = 2096 * UID/GID found will be placed here. 2097 * 2098 * Others: 2099 * res->retcode = 2100 * Return status for this request will be placed here. 2101 * res->direction = 2102 * Direction found will be placed here. Direction 2103 * meaning whether the resultant mapping is valid 2104 * only from win2unix or bi-directional. 2105 * req->direction = 2106 * INTERNAL USE. Used by idmapd to set various 2107 * flags (_IDMAP_F_xxxx) to aid in processing 2108 * of the request. 2109 * req->id2.idtype = 2110 * INTERNAL USE. Initially this is the requested target 2111 * type and is used to initialize res->id.idtype. 2112 * ad_lookup_batch() uses this field temporarily to store 2113 * sid_type obtained by the batched AD lookups and after 2114 * use resets it to IDMAP_NONE to prevent xdr from 2115 * mis-interpreting the contents of req->id2. 2116 * req->id2..[uid or gid or sid] = 2117 * NOT USED 2118 */ 2119 2120 /* 2121 * This function does the following: 2122 * 1. Lookup well-known SIDs table. 2123 * 2. Check if the given SID is a local-SID and if so extract UID/GID from it. 2124 * 3. Lookup cache. 2125 * 4. Check if the client does not want new mapping to be allocated 2126 * in which case this pass is the final pass. 2127 * 5. Set AD lookup flag if it determines that the next stage needs 2128 * to do AD lookup. 2129 */ 2130 idmap_retcode 2131 sid2pid_first_pass(lookup_state_t *state, sqlite *cache, idmap_mapping *req, 2132 idmap_id_res *res) 2133 { 2134 idmap_retcode retcode; 2135 int wksid; 2136 2137 /* Initialize result */ 2138 res->id.idtype = req->id2.idtype; 2139 res->id.idmap_id_u.uid = SENTINEL_PID; 2140 res->direction = IDMAP_DIRECTION_UNDEF; 2141 wksid = 0; 2142 2143 if (EMPTY_STRING(req->id1.idmap_id_u.sid.prefix)) { 2144 if (req->id1name == NULL) { 2145 retcode = IDMAP_ERR_ARG; 2146 goto out; 2147 } 2148 /* sanitize sidprefix */ 2149 free(req->id1.idmap_id_u.sid.prefix); 2150 req->id1.idmap_id_u.sid.prefix = NULL; 2151 } 2152 2153 /* Lookup well-known SIDs table */ 2154 retcode = lookup_wksids_sid2pid(req, res, &wksid); 2155 if (retcode != IDMAP_ERR_NOTFOUND) 2156 goto out; 2157 2158 /* Check if this is a localsid */ 2159 if (!wksid) { 2160 retcode = lookup_localsid2pid(req, res); 2161 if (retcode != IDMAP_ERR_NOTFOUND) 2162 goto out; 2163 } 2164 2165 /* Lookup cache */ 2166 retcode = lookup_cache_sid2pid(cache, req, res); 2167 if (retcode != IDMAP_ERR_NOTFOUND) 2168 goto out; 2169 2170 if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) { 2171 retcode = IDMAP_ERR_NONEGENERATED; 2172 goto out; 2173 } 2174 2175 /* 2176 * Failed to find non-expired entry in cache. Next step is 2177 * to determine if this request needs to be batched for AD lookup. 2178 * 2179 * At this point we have either sid or winname or both. If we don't 2180 * have both then lookup name_cache for the sid or winname 2181 * whichever is missing. If not found then this request will be 2182 * batched for AD lookup. 2183 */ 2184 retcode = lookup_name_cache(cache, req, res); 2185 if (retcode != IDMAP_SUCCESS && retcode != IDMAP_ERR_NOTFOUND) 2186 goto out; 2187 2188 /* 2189 * Set the flag to indicate that we are not done yet so that 2190 * subsequent passes considers this request for name-based 2191 * mapping and ephemeral mapping. 2192 */ 2193 state->sid2pid_done = FALSE; 2194 req->direction |= _IDMAP_F_NOTDONE; 2195 2196 /* 2197 * Even if we have both sid and winname, we still may need to batch 2198 * this request for AD lookup if we don't have unixname and 2199 * directory-based name mapping (AD or mixed) is enabled. 2200 * We avoid AD lookup for well-known SIDs because they don't have 2201 * regular AD objects. 2202 */ 2203 if (retcode != IDMAP_SUCCESS || 2204 (!wksid && req->id2name == NULL && 2205 AD_OR_MIXED_MODE(res->id.idtype, state))) { 2206 retcode = IDMAP_SUCCESS; 2207 req->direction |= _IDMAP_F_LOOKUP_AD; 2208 state->ad_nqueries++; 2209 } 2210 2211 2212 out: 2213 res->retcode = idmap_stat4prot(retcode); 2214 /* 2215 * If we are done and there was an error then set fallback pid 2216 * in the result. 2217 */ 2218 if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) 2219 res->id.idmap_id_u.uid = UID_NOBODY; 2220 return (retcode); 2221 } 2222 2223 /* 2224 * Generate SID using the following convention 2225 * <machine-sid-prefix>-<1000 + uid> 2226 * <machine-sid-prefix>-<2^31 + gid> 2227 */ 2228 static 2229 idmap_retcode 2230 generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user, 2231 int fallback) 2232 { 2233 free(res->id.idmap_id_u.sid.prefix); 2234 res->id.idmap_id_u.sid.prefix = NULL; 2235 2236 /* 2237 * Diagonal mapping for localSIDs not supported because of the 2238 * way we generate localSIDs. 2239 */ 2240 if (is_user && res->id.idtype == IDMAP_GSID) 2241 return (IDMAP_ERR_NOMAPPING); 2242 if (!is_user && res->id.idtype == IDMAP_USID) 2243 return (IDMAP_ERR_NOMAPPING); 2244 2245 /* Skip 1000 UIDs */ 2246 if (is_user && req->id1.idmap_id_u.uid > 2247 (INT32_MAX - LOCALRID_MIN)) 2248 return (IDMAP_ERR_NOMAPPING); 2249 2250 RDLOCK_CONFIG(); 2251 /* 2252 * machine_sid is never NULL because if it is we won't be here. 2253 * No need to assert because stdrup(NULL) will core anyways. 2254 */ 2255 res->id.idmap_id_u.sid.prefix = 2256 strdup(_idmapdstate.cfg->pgcfg.machine_sid); 2257 if (res->id.idmap_id_u.sid.prefix == NULL) { 2258 UNLOCK_CONFIG(); 2259 idmapdlog(LOG_ERR, "Out of memory"); 2260 return (IDMAP_ERR_MEMORY); 2261 } 2262 UNLOCK_CONFIG(); 2263 res->id.idmap_id_u.sid.rid = 2264 (is_user) ? req->id1.idmap_id_u.uid + LOCALRID_MIN : 2265 req->id1.idmap_id_u.gid + INT32_MAX + 1; 2266 res->direction = IDMAP_DIRECTION_BI; 2267 if (res->id.idtype == IDMAP_SID) 2268 res->id.idtype = is_user ? IDMAP_USID : IDMAP_GSID; 2269 2270 if (!fallback && req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 2271 res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 2272 res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 2273 } 2274 2275 /* 2276 * Don't update name_cache because local sids don't have 2277 * valid windows names. 2278 */ 2279 req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 2280 return (IDMAP_SUCCESS); 2281 } 2282 2283 static 2284 idmap_retcode 2285 lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res) 2286 { 2287 char *sidprefix; 2288 uint32_t rid; 2289 int s; 2290 2291 /* 2292 * If the sidprefix == localsid then UID = last RID - 1000 or 2293 * GID = last RID - 2^31. 2294 */ 2295 if ((sidprefix = req->id1.idmap_id_u.sid.prefix) == NULL) 2296 /* This means we are looking up by winname */ 2297 return (IDMAP_ERR_NOTFOUND); 2298 rid = req->id1.idmap_id_u.sid.rid; 2299 2300 RDLOCK_CONFIG(); 2301 s = (_idmapdstate.cfg->pgcfg.machine_sid) ? 2302 strcasecmp(sidprefix, _idmapdstate.cfg->pgcfg.machine_sid) : 1; 2303 UNLOCK_CONFIG(); 2304 2305 /* 2306 * If the given sidprefix does not match machine_sid then this is 2307 * not a local SID. 2308 */ 2309 if (s != 0) 2310 return (IDMAP_ERR_NOTFOUND); 2311 2312 switch (res->id.idtype) { 2313 case IDMAP_UID: 2314 if (rid > INT32_MAX || rid < LOCALRID_MIN) 2315 return (IDMAP_ERR_ARG); 2316 res->id.idmap_id_u.uid = rid - LOCALRID_MIN; 2317 break; 2318 case IDMAP_GID: 2319 if (rid <= INT32_MAX) 2320 return (IDMAP_ERR_ARG); 2321 res->id.idmap_id_u.gid = rid - INT32_MAX - 1; 2322 break; 2323 case IDMAP_POSIXID: 2324 if (rid > INT32_MAX) { 2325 res->id.idmap_id_u.gid = rid - INT32_MAX - 1; 2326 res->id.idtype = IDMAP_GID; 2327 } else if (rid < LOCALRID_MIN) { 2328 return (IDMAP_ERR_ARG); 2329 } else { 2330 res->id.idmap_id_u.uid = rid - LOCALRID_MIN; 2331 res->id.idtype = IDMAP_UID; 2332 } 2333 break; 2334 default: 2335 return (IDMAP_ERR_NOTSUPPORTED); 2336 } 2337 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 2338 res->info.how.map_type = IDMAP_MAP_TYPE_LOCAL_SID; 2339 res->info.src = IDMAP_MAP_SRC_ALGORITHMIC; 2340 } 2341 return (IDMAP_SUCCESS); 2342 } 2343 2344 /* 2345 * Name service lookup by unixname to get pid 2346 */ 2347 static 2348 idmap_retcode 2349 ns_lookup_byname(const char *name, const char *lower_name, idmap_id *id) 2350 { 2351 struct passwd pwd, *pwdp; 2352 struct group grp, *grpp; 2353 char buf[1024]; 2354 int errnum; 2355 const char *me = "ns_lookup_byname"; 2356 2357 switch (id->idtype) { 2358 case IDMAP_UID: 2359 pwdp = getpwnam_r(name, &pwd, buf, sizeof (buf)); 2360 if (pwdp == NULL && errno == 0 && lower_name != NULL && 2361 name != lower_name && strcmp(name, lower_name) != 0) 2362 pwdp = getpwnam_r(lower_name, &pwd, buf, sizeof (buf)); 2363 if (pwdp == NULL) { 2364 errnum = errno; 2365 idmapdlog(LOG_WARNING, 2366 "%s: getpwnam_r(%s) failed (%s).", 2367 me, name, errnum ? strerror(errnum) : "not found"); 2368 if (errnum == 0) 2369 return (IDMAP_ERR_NOTFOUND); 2370 else 2371 return (IDMAP_ERR_INTERNAL); 2372 } 2373 id->idmap_id_u.uid = pwd.pw_uid; 2374 break; 2375 case IDMAP_GID: 2376 grpp = getgrnam_r(name, &grp, buf, sizeof (buf)); 2377 if (grpp == NULL && errno == 0 && lower_name != NULL && 2378 name != lower_name && strcmp(name, lower_name) != 0) 2379 grpp = getgrnam_r(lower_name, &grp, buf, sizeof (buf)); 2380 if (grpp == NULL) { 2381 errnum = errno; 2382 idmapdlog(LOG_WARNING, 2383 "%s: getgrnam_r(%s) failed (%s).", 2384 me, name, errnum ? strerror(errnum) : "not found"); 2385 if (errnum == 0) 2386 return (IDMAP_ERR_NOTFOUND); 2387 else 2388 return (IDMAP_ERR_INTERNAL); 2389 } 2390 id->idmap_id_u.gid = grp.gr_gid; 2391 break; 2392 default: 2393 return (IDMAP_ERR_ARG); 2394 } 2395 return (IDMAP_SUCCESS); 2396 } 2397 2398 2399 /* 2400 * Name service lookup by pid to get unixname 2401 */ 2402 static 2403 idmap_retcode 2404 ns_lookup_bypid(uid_t pid, int is_user, char **unixname) 2405 { 2406 struct passwd pwd; 2407 struct group grp; 2408 char buf[1024]; 2409 int errnum; 2410 const char *me = "ns_lookup_bypid"; 2411 2412 if (is_user) { 2413 errno = 0; 2414 if (getpwuid_r(pid, &pwd, buf, sizeof (buf)) == NULL) { 2415 errnum = errno; 2416 idmapdlog(LOG_WARNING, 2417 "%s: getpwuid_r(%u) failed (%s).", 2418 me, pid, errnum ? strerror(errnum) : "not found"); 2419 if (errnum == 0) 2420 return (IDMAP_ERR_NOTFOUND); 2421 else 2422 return (IDMAP_ERR_INTERNAL); 2423 } 2424 *unixname = strdup(pwd.pw_name); 2425 } else { 2426 errno = 0; 2427 if (getgrgid_r(pid, &grp, buf, sizeof (buf)) == NULL) { 2428 errnum = errno; 2429 idmapdlog(LOG_WARNING, 2430 "%s: getgrgid_r(%u) failed (%s).", 2431 me, pid, errnum ? strerror(errnum) : "not found"); 2432 if (errnum == 0) 2433 return (IDMAP_ERR_NOTFOUND); 2434 else 2435 return (IDMAP_ERR_INTERNAL); 2436 } 2437 *unixname = strdup(grp.gr_name); 2438 } 2439 if (*unixname == NULL) 2440 return (IDMAP_ERR_MEMORY); 2441 return (IDMAP_SUCCESS); 2442 } 2443 2444 /* 2445 * Name-based mapping 2446 * 2447 * Case 1: If no rule matches do ephemeral 2448 * 2449 * Case 2: If rule matches and unixname is "" then return no mapping. 2450 * 2451 * Case 3: If rule matches and unixname is specified then lookup name 2452 * service using the unixname. If unixname not found then return no mapping. 2453 * 2454 * Case 4: If rule matches and unixname is * then lookup name service 2455 * using winname as the unixname. If unixname not found then process 2456 * other rules using the lookup order. If no other rule matches then do 2457 * ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4. 2458 * This allows us to specify a fallback unixname per _domain_ or no mapping 2459 * instead of the default behaviour of doing ephemeral mapping. 2460 * 2461 * Example 1: 2462 * *@sfbay == * 2463 * If looking up windows users foo@sfbay and foo does not exists in 2464 * the name service then foo@sfbay will be mapped to an ephemeral id. 2465 * 2466 * Example 2: 2467 * *@sfbay == * 2468 * *@sfbay => guest 2469 * If looking up windows users foo@sfbay and foo does not exists in 2470 * the name service then foo@sfbay will be mapped to guest. 2471 * 2472 * Example 3: 2473 * *@sfbay == * 2474 * *@sfbay => "" 2475 * If looking up windows users foo@sfbay and foo does not exists in 2476 * the name service then we will return no mapping for foo@sfbay. 2477 * 2478 */ 2479 static 2480 idmap_retcode 2481 name_based_mapping_sid2pid(sqlite *db, idmap_mapping *req, idmap_id_res *res) 2482 { 2483 const char *unixname, *windomain; 2484 char *sql = NULL, *errmsg = NULL, *lower_winname = NULL; 2485 idmap_retcode retcode; 2486 char *end, *lower_unixname, *winname; 2487 const char **values; 2488 sqlite_vm *vm = NULL; 2489 int ncol, r, i, is_user, is_wuser; 2490 idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 2491 int direction; 2492 const char *me = "name_based_mapping_sid2pid"; 2493 2494 assert(req->id1name != NULL); /* We have winname */ 2495 assert(req->id2name == NULL); /* We don't have unixname */ 2496 2497 winname = req->id1name; 2498 windomain = req->id1domain; 2499 2500 switch (req->id1.idtype) { 2501 case IDMAP_USID: 2502 is_wuser = 1; 2503 break; 2504 case IDMAP_GSID: 2505 is_wuser = 0; 2506 break; 2507 default: 2508 idmapdlog(LOG_ERR, "%s: Unable to determine if the " 2509 "given Windows id is user or group.", me); 2510 return (IDMAP_ERR_INTERNAL); 2511 } 2512 2513 switch (res->id.idtype) { 2514 case IDMAP_UID: 2515 is_user = 1; 2516 break; 2517 case IDMAP_GID: 2518 is_user = 0; 2519 break; 2520 case IDMAP_POSIXID: 2521 is_user = is_wuser; 2522 res->id.idtype = is_user ? IDMAP_UID : IDMAP_GID; 2523 break; 2524 } 2525 2526 i = 0; 2527 if (windomain == NULL) { 2528 windomain = ""; 2529 } else { 2530 RDLOCK_CONFIG(); 2531 if (_idmapdstate.cfg->pgcfg.default_domain != NULL) { 2532 if (strcasecmp(_idmapdstate.cfg->pgcfg.default_domain, 2533 windomain) == 0) 2534 i = 1; 2535 } 2536 UNLOCK_CONFIG(); 2537 } 2538 2539 if ((lower_winname = tolower_u8(winname)) == NULL) 2540 lower_winname = winname; /* hope for the best */ 2541 sql = sqlite_mprintf( 2542 "SELECT unixname, u2w_order, winname_display, windomain, is_nt4 " 2543 "FROM namerules WHERE " 2544 "w2u_order > 0 AND is_user = %d AND is_wuser = %d AND " 2545 "(winname = %Q OR winname = '*') AND " 2546 "(windomain = %Q OR windomain = '*' %s) " 2547 "ORDER BY w2u_order ASC;", 2548 is_user, is_wuser, lower_winname, windomain, 2549 i ? "OR windomain ISNULL OR windomain = ''" : ""); 2550 if (sql == NULL) { 2551 idmapdlog(LOG_ERR, "Out of memory"); 2552 retcode = IDMAP_ERR_MEMORY; 2553 goto out; 2554 } 2555 2556 if (sqlite_compile(db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 2557 retcode = IDMAP_ERR_INTERNAL; 2558 idmapdlog(LOG_ERR, "%s: database error (%s)", me, 2559 CHECK_NULL(errmsg)); 2560 sqlite_freemem(errmsg); 2561 goto out; 2562 } 2563 2564 for (;;) { 2565 r = sqlite_step(vm, &ncol, &values, NULL); 2566 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 2567 2568 if (r == SQLITE_ROW) { 2569 if (ncol < 5) { 2570 retcode = IDMAP_ERR_INTERNAL; 2571 goto out; 2572 } 2573 if (values[0] == NULL) { 2574 retcode = IDMAP_ERR_INTERNAL; 2575 goto out; 2576 } 2577 2578 if (values[1] != NULL) 2579 direction = 2580 (strtol(values[1], &end, 10) == 0)? 2581 IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 2582 else 2583 direction = IDMAP_DIRECTION_W2U; 2584 2585 if (EMPTY_NAME(values[0])) { 2586 idmap_namerule_set(rule, values[3], values[2], 2587 values[0], is_wuser, is_user, 2588 strtol(values[4], &end, 10), 2589 direction); 2590 retcode = IDMAP_ERR_NOMAPPING; 2591 goto out; 2592 } 2593 2594 if (values[0][0] == '*') { 2595 unixname = winname; 2596 lower_unixname = lower_winname; 2597 } else { 2598 unixname = values[0]; 2599 lower_unixname = NULL; 2600 } 2601 2602 retcode = ns_lookup_byname(unixname, lower_unixname, 2603 &res->id); 2604 if (retcode == IDMAP_ERR_NOTFOUND) { 2605 if (values[0][0] == '*') 2606 /* Case 4 */ 2607 continue; 2608 else { 2609 /* Case 3 */ 2610 idmap_namerule_set(rule, values[3], 2611 values[2], values[0], is_wuser, 2612 is_user, 2613 strtol(values[4], &end, 10), 2614 direction); 2615 retcode = IDMAP_ERR_NOMAPPING; 2616 } 2617 } 2618 goto out; 2619 } else if (r == SQLITE_DONE) { 2620 retcode = IDMAP_ERR_NOTFOUND; 2621 goto out; 2622 } else { 2623 (void) sqlite_finalize(vm, &errmsg); 2624 vm = NULL; 2625 idmapdlog(LOG_ERR, "%s: database error (%s)", me, 2626 CHECK_NULL(errmsg)); 2627 sqlite_freemem(errmsg); 2628 retcode = IDMAP_ERR_INTERNAL; 2629 goto out; 2630 } 2631 } 2632 2633 out: 2634 if (sql != NULL) 2635 sqlite_freemem(sql); 2636 res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 2637 if (retcode == IDMAP_SUCCESS) { 2638 if (values[1] != NULL) 2639 res->direction = 2640 (strtol(values[1], &end, 10) == 0)? 2641 IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI; 2642 else 2643 res->direction = IDMAP_DIRECTION_W2U; 2644 2645 req->id2name = strdup(unixname); 2646 idmap_namerule_set(rule, values[3], values[2], 2647 values[0], is_wuser, is_user, strtol(values[4], &end, 10), 2648 res->direction); 2649 res->info.src = IDMAP_MAP_SRC_NEW; 2650 } 2651 if (lower_winname != NULL && lower_winname != winname) 2652 free(lower_winname); 2653 if (vm != NULL) 2654 (void) sqlite_finalize(vm, NULL); 2655 return (retcode); 2656 } 2657 2658 static 2659 int 2660 get_next_eph_uid(uid_t *next_uid) 2661 { 2662 uid_t uid; 2663 gid_t gid; 2664 int err; 2665 2666 *next_uid = (uid_t)-1; 2667 uid = _idmapdstate.next_uid++; 2668 if (uid >= _idmapdstate.limit_uid) { 2669 if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0) 2670 return (err); 2671 2672 _idmapdstate.limit_uid = uid + 8192; 2673 _idmapdstate.next_uid = uid; 2674 } 2675 *next_uid = uid; 2676 2677 return (0); 2678 } 2679 2680 static 2681 int 2682 get_next_eph_gid(gid_t *next_gid) 2683 { 2684 uid_t uid; 2685 gid_t gid; 2686 int err; 2687 2688 *next_gid = (uid_t)-1; 2689 gid = _idmapdstate.next_gid++; 2690 if (gid >= _idmapdstate.limit_gid) { 2691 if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0) 2692 return (err); 2693 2694 _idmapdstate.limit_gid = gid + 8192; 2695 _idmapdstate.next_gid = gid; 2696 } 2697 *next_gid = gid; 2698 2699 return (0); 2700 } 2701 2702 static 2703 int 2704 gethash(const char *str, uint32_t num, uint_t htsize) 2705 { 2706 uint_t hval, i, len; 2707 2708 if (str == NULL) 2709 return (0); 2710 for (len = strlen(str), hval = 0, i = 0; i < len; i++) { 2711 hval += str[i]; 2712 hval += (hval << 10); 2713 hval ^= (hval >> 6); 2714 } 2715 for (str = (const char *)&num, i = 0; i < sizeof (num); i++) { 2716 hval += str[i]; 2717 hval += (hval << 10); 2718 hval ^= (hval >> 6); 2719 } 2720 hval += (hval << 3); 2721 hval ^= (hval >> 11); 2722 hval += (hval << 15); 2723 return (hval % htsize); 2724 } 2725 2726 static 2727 int 2728 get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid, 2729 uid_t *pid) 2730 { 2731 uint_t next, key; 2732 uint_t htsize = state->sid_history_size; 2733 idmap_sid *sid; 2734 2735 next = gethash(prefix, rid, htsize); 2736 while (next != htsize) { 2737 key = state->sid_history[next].key; 2738 if (key == htsize) 2739 return (0); 2740 sid = &state->batch->idmap_mapping_batch_val[key].id1. 2741 idmap_id_u.sid; 2742 if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) { 2743 *pid = state->result->ids.ids_val[key].id. 2744 idmap_id_u.uid; 2745 return (1); 2746 } 2747 next = state->sid_history[next].next; 2748 } 2749 return (0); 2750 } 2751 2752 static 2753 void 2754 add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid) 2755 { 2756 uint_t hash, next; 2757 uint_t htsize = state->sid_history_size; 2758 2759 hash = next = gethash(prefix, rid, htsize); 2760 while (state->sid_history[next].key != htsize) { 2761 next++; 2762 next %= htsize; 2763 } 2764 state->sid_history[next].key = state->curpos; 2765 if (hash == next) 2766 return; 2767 state->sid_history[next].next = state->sid_history[hash].next; 2768 state->sid_history[hash].next = next; 2769 } 2770 2771 void 2772 cleanup_lookup_state(lookup_state_t *state) 2773 { 2774 free(state->sid_history); 2775 free(state->ad_unixuser_attr); 2776 free(state->ad_unixgroup_attr); 2777 } 2778 2779 /* ARGSUSED */ 2780 static 2781 idmap_retcode 2782 dynamic_ephemeral_mapping(lookup_state_t *state, sqlite *cache, 2783 idmap_mapping *req, idmap_id_res *res) 2784 { 2785 2786 uid_t next_pid; 2787 2788 res->direction = IDMAP_DIRECTION_BI; 2789 2790 if (IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 2791 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 2792 res->info.src = IDMAP_MAP_SRC_CACHE; 2793 return (IDMAP_SUCCESS); 2794 } 2795 2796 if (state->sid_history != NULL && 2797 get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix, 2798 req->id1.idmap_id_u.sid.rid, &next_pid)) { 2799 res->id.idmap_id_u.uid = next_pid; 2800 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 2801 res->info.src = IDMAP_MAP_SRC_NEW; 2802 return (IDMAP_SUCCESS); 2803 } 2804 2805 if (res->id.idtype == IDMAP_UID) { 2806 if (get_next_eph_uid(&next_pid) != 0) 2807 return (IDMAP_ERR_INTERNAL); 2808 res->id.idmap_id_u.uid = next_pid; 2809 } else { 2810 if (get_next_eph_gid(&next_pid) != 0) 2811 return (IDMAP_ERR_INTERNAL); 2812 res->id.idmap_id_u.gid = next_pid; 2813 } 2814 2815 res->info.how.map_type = IDMAP_MAP_TYPE_EPHEMERAL; 2816 res->info.src = IDMAP_MAP_SRC_NEW; 2817 if (state->sid_history != NULL) 2818 add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix, 2819 req->id1.idmap_id_u.sid.rid); 2820 2821 return (IDMAP_SUCCESS); 2822 } 2823 2824 idmap_retcode 2825 sid2pid_second_pass(lookup_state_t *state, sqlite *cache, sqlite *db, 2826 idmap_mapping *req, idmap_id_res *res) 2827 { 2828 idmap_retcode retcode; 2829 2830 /* Check if second pass is needed */ 2831 if (ARE_WE_DONE(req->direction)) 2832 return (res->retcode); 2833 2834 /* Get status from previous pass */ 2835 retcode = res->retcode; 2836 if (retcode != IDMAP_SUCCESS) 2837 goto out; 2838 2839 /* 2840 * If directory-based name mapping is enabled then the unixname 2841 * may already have been retrieved from the AD object (AD-mode or 2842 * mixed-mode) or from native LDAP object (nldap-mode) -- done. 2843 */ 2844 if (req->id2name != NULL) { 2845 assert(res->id.idtype != IDMAP_POSIXID); 2846 if (AD_MODE(res->id.idtype, state)) 2847 res->direction = IDMAP_DIRECTION_BI; 2848 else if (NLDAP_MODE(res->id.idtype, state)) 2849 res->direction = IDMAP_DIRECTION_BI; 2850 else if (MIXED_MODE(res->id.idtype, state)) 2851 res->direction = IDMAP_DIRECTION_W2U; 2852 2853 /* 2854 * Special case: (1) If the ad_unixuser_attr and 2855 * ad_unixgroup_attr uses the same attribute 2856 * name and (2) if this is a diagonal mapping 2857 * request and (3) the unixname has been retrieved 2858 * from the AD object -- then we ignore it and fallback 2859 * to name-based mapping rules and ephemeral mapping 2860 * 2861 * Example: 2862 * Properties: 2863 * config/ad_unixuser_attr = "unixname" 2864 * config/ad_unixgroup_attr = "unixname" 2865 * AD user object: 2866 * dn: cn=bob ... 2867 * objectclass: user 2868 * sam: bob 2869 * unixname: bob1234 2870 * AD group object: 2871 * dn: cn=winadmins ... 2872 * objectclass: group 2873 * sam: winadmins 2874 * unixname: unixadmins 2875 * 2876 * In this example whether "unixname" refers to a unixuser 2877 * or unixgroup depends upon the AD object. 2878 * 2879 * $idmap show -c winname:bob gid 2880 * AD lookup by "samAccountName=bob" for 2881 * "ad_unixgroup_attr (i.e unixname)" for directory-based 2882 * mapping would get "bob1234" which is not what we want. 2883 * Now why not getgrnam_r("bob1234") and use it if it 2884 * is indeed a unixgroup? That's because Unix can have 2885 * users and groups with the same name and we clearly 2886 * don't know the intention of the admin here. 2887 * Therefore we ignore this and fallback to name-based 2888 * mapping rules or ephemeral mapping. 2889 */ 2890 if ((AD_MODE(res->id.idtype, state) || 2891 MIXED_MODE(res->id.idtype, state)) && 2892 state->ad_unixuser_attr != NULL && 2893 state->ad_unixgroup_attr != NULL && 2894 strcasecmp(state->ad_unixuser_attr, 2895 state->ad_unixgroup_attr) == 0 && 2896 ((req->id1.idtype == IDMAP_USID && 2897 res->id.idtype == IDMAP_GID) || 2898 (req->id1.idtype == IDMAP_GSID && 2899 res->id.idtype == IDMAP_UID))) { 2900 free(req->id2name); 2901 req->id2name = NULL; 2902 res->id.idmap_id_u.uid = SENTINEL_PID; 2903 /* fallback */ 2904 } else { 2905 if (res->id.idmap_id_u.uid == SENTINEL_PID) 2906 retcode = ns_lookup_byname(req->id2name, 2907 NULL, &res->id); 2908 /* 2909 * We don't fallback to name-based mapping rules 2910 * or ephemeral mapping. 2911 */ 2912 goto out; 2913 } 2914 } 2915 2916 /* Free any mapping info from Directory based mapping */ 2917 if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 2918 idmap_info_free(&res->info); 2919 2920 /* 2921 * If we don't have unixname then evaluate local name-based 2922 * mapping rules. 2923 */ 2924 retcode = name_based_mapping_sid2pid(db, req, res); 2925 if (retcode != IDMAP_ERR_NOTFOUND) 2926 goto out; 2927 2928 /* If not found, do ephemeral mapping */ 2929 retcode = dynamic_ephemeral_mapping(state, cache, req, res); 2930 2931 out: 2932 res->retcode = idmap_stat4prot(retcode); 2933 if (res->retcode != IDMAP_SUCCESS) { 2934 req->direction = _IDMAP_F_DONE; 2935 res->id.idmap_id_u.uid = UID_NOBODY; 2936 } 2937 if (!ARE_WE_DONE(req->direction)) 2938 state->sid2pid_done = FALSE; 2939 return (retcode); 2940 } 2941 2942 idmap_retcode 2943 update_cache_pid2sid(lookup_state_t *state, sqlite *cache, 2944 idmap_mapping *req, idmap_id_res *res) 2945 { 2946 char *sql = NULL; 2947 idmap_retcode retcode; 2948 char *map_dn = NULL; 2949 char *map_attr = NULL; 2950 char *map_value = NULL; 2951 char *map_windomain = NULL; 2952 char *map_winname = NULL; 2953 char *map_unixname = NULL; 2954 int map_is_nt4 = FALSE; 2955 2956 /* Check if we need to cache anything */ 2957 if (ARE_WE_DONE(req->direction)) 2958 return (IDMAP_SUCCESS); 2959 2960 /* We don't cache negative entries */ 2961 if (res->retcode != IDMAP_SUCCESS) 2962 return (IDMAP_SUCCESS); 2963 2964 assert(res->direction != IDMAP_DIRECTION_UNDEF); 2965 assert(req->id1.idmap_id_u.uid != SENTINEL_PID); 2966 assert(res->id.idtype != IDMAP_SID); 2967 2968 assert(res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN); 2969 switch (res->info.how.map_type) { 2970 case IDMAP_MAP_TYPE_DS_AD: 2971 map_dn = res->info.how.idmap_how_u.ad.dn; 2972 map_attr = res->info.how.idmap_how_u.ad.attr; 2973 map_value = res->info.how.idmap_how_u.ad.value; 2974 break; 2975 2976 case IDMAP_MAP_TYPE_DS_NLDAP: 2977 map_dn = res->info.how.idmap_how_u.nldap.dn; 2978 map_attr = res->info.how.idmap_how_u.nldap.attr; 2979 map_value = res->info.how.idmap_how_u.nldap.value; 2980 break; 2981 2982 case IDMAP_MAP_TYPE_RULE_BASED: 2983 map_windomain = res->info.how.idmap_how_u.rule.windomain; 2984 map_winname = res->info.how.idmap_how_u.rule.winname; 2985 map_unixname = res->info.how.idmap_how_u.rule.unixname; 2986 map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 2987 break; 2988 2989 case IDMAP_MAP_TYPE_EPHEMERAL: 2990 break; 2991 2992 case IDMAP_MAP_TYPE_LOCAL_SID: 2993 break; 2994 2995 default: 2996 /* Dont cache other mapping types */ 2997 assert(FALSE); 2998 } 2999 3000 /* 3001 * Using NULL for u2w instead of 0 so that our trigger allows 3002 * the same pid to be the destination in multiple entries 3003 */ 3004 sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3005 "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 3006 "is_user, is_wuser, expiration, w2u, u2w, " 3007 "map_type, map_dn, map_attr, map_value, map_windomain, " 3008 "map_winname, map_unixname, map_is_nt4) " 3009 "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 3010 "strftime('%%s','now') + 600, %q, 1, " 3011 "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d); ", 3012 res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3013 req->id2domain, req->id2name, req->id1.idmap_id_u.uid, 3014 req->id1name, (req->id1.idtype == IDMAP_UID) ? 1 : 0, 3015 (res->id.idtype == IDMAP_USID) ? 1 : 0, 3016 (res->direction == 0) ? "1" : NULL, 3017 res->info.how.map_type, map_dn, map_attr, map_value, 3018 map_windomain, map_winname, map_unixname, map_is_nt4); 3019 3020 if (sql == NULL) { 3021 retcode = IDMAP_ERR_INTERNAL; 3022 idmapdlog(LOG_ERR, "Out of memory"); 3023 goto out; 3024 } 3025 3026 retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql); 3027 if (retcode != IDMAP_SUCCESS) 3028 goto out; 3029 3030 state->pid2sid_done = FALSE; 3031 sqlite_freemem(sql); 3032 sql = NULL; 3033 3034 /* Check if we need to update namecache */ 3035 if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3036 goto out; 3037 3038 if (req->id2name == NULL) 3039 goto out; 3040 3041 sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3042 "(sidprefix, rid, canon_name, domain, type, expiration) " 3043 "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3044 res->id.idmap_id_u.sid.prefix, res->id.idmap_id_u.sid.rid, 3045 req->id2name, req->id2domain, 3046 (res->id.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP); 3047 3048 if (sql == NULL) { 3049 retcode = IDMAP_ERR_INTERNAL; 3050 idmapdlog(LOG_ERR, "Out of memory"); 3051 goto out; 3052 } 3053 3054 retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql); 3055 3056 out: 3057 if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO)) 3058 idmap_info_free(&res->info); 3059 if (sql != NULL) 3060 sqlite_freemem(sql); 3061 return (retcode); 3062 } 3063 3064 idmap_retcode 3065 update_cache_sid2pid(lookup_state_t *state, sqlite *cache, 3066 idmap_mapping *req, idmap_id_res *res) 3067 { 3068 char *sql = NULL; 3069 idmap_retcode retcode; 3070 int is_eph_user; 3071 char *map_dn = NULL; 3072 char *map_attr = NULL; 3073 char *map_value = NULL; 3074 char *map_windomain = NULL; 3075 char *map_winname = NULL; 3076 char *map_unixname = NULL; 3077 int map_is_nt4 = FALSE; 3078 3079 /* Check if we need to cache anything */ 3080 if (ARE_WE_DONE(req->direction)) 3081 return (IDMAP_SUCCESS); 3082 3083 /* We don't cache negative entries */ 3084 if (res->retcode != IDMAP_SUCCESS) 3085 return (IDMAP_SUCCESS); 3086 3087 if (req->direction & _IDMAP_F_EXP_EPH_UID) 3088 is_eph_user = 1; 3089 else if (req->direction & _IDMAP_F_EXP_EPH_GID) 3090 is_eph_user = 0; 3091 else 3092 is_eph_user = -1; 3093 3094 if (is_eph_user >= 0 && !IS_EPHEMERAL(res->id.idmap_id_u.uid)) { 3095 sql = sqlite_mprintf("UPDATE idmap_cache " 3096 "SET w2u = 0 WHERE " 3097 "sidprefix = %Q AND rid = %u AND w2u = 1 AND " 3098 "pid >= 2147483648 AND is_user = %d;", 3099 req->id1.idmap_id_u.sid.prefix, 3100 req->id1.idmap_id_u.sid.rid, 3101 is_eph_user); 3102 if (sql == NULL) { 3103 retcode = IDMAP_ERR_INTERNAL; 3104 idmapdlog(LOG_ERR, "Out of memory"); 3105 goto out; 3106 } 3107 3108 retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql); 3109 if (retcode != IDMAP_SUCCESS) 3110 goto out; 3111 3112 sqlite_freemem(sql); 3113 sql = NULL; 3114 } 3115 3116 assert(res->direction != IDMAP_DIRECTION_UNDEF); 3117 assert(res->id.idmap_id_u.uid != SENTINEL_PID); 3118 3119 switch (res->info.how.map_type) { 3120 case IDMAP_MAP_TYPE_DS_AD: 3121 map_dn = res->info.how.idmap_how_u.ad.dn; 3122 map_attr = res->info.how.idmap_how_u.ad.attr; 3123 map_value = res->info.how.idmap_how_u.ad.value; 3124 break; 3125 3126 case IDMAP_MAP_TYPE_DS_NLDAP: 3127 map_dn = res->info.how.idmap_how_u.nldap.dn; 3128 map_attr = res->info.how.idmap_how_u.ad.attr; 3129 map_value = res->info.how.idmap_how_u.nldap.value; 3130 break; 3131 3132 case IDMAP_MAP_TYPE_RULE_BASED: 3133 map_windomain = res->info.how.idmap_how_u.rule.windomain; 3134 map_winname = res->info.how.idmap_how_u.rule.winname; 3135 map_unixname = res->info.how.idmap_how_u.rule.unixname; 3136 map_is_nt4 = res->info.how.idmap_how_u.rule.is_nt4; 3137 break; 3138 3139 case IDMAP_MAP_TYPE_EPHEMERAL: 3140 break; 3141 3142 default: 3143 /* Dont cache other mapping types */ 3144 assert(FALSE); 3145 } 3146 3147 sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache " 3148 "(sidprefix, rid, windomain, canon_winname, pid, unixname, " 3149 "is_user, is_wuser, expiration, w2u, u2w, " 3150 "map_type, map_dn, map_attr, map_value, map_windomain, " 3151 "map_winname, map_unixname, map_is_nt4) " 3152 "VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, " 3153 "strftime('%%s','now') + 600, 1, %q, " 3154 "%d, %Q, %Q, %Q, %Q, %Q, %Q, %d);", 3155 req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3156 (req->id1domain != NULL) ? req->id1domain : "", req->id1name, 3157 res->id.idmap_id_u.uid, req->id2name, 3158 (res->id.idtype == IDMAP_UID) ? 1 : 0, 3159 (req->id1.idtype == IDMAP_USID) ? 1 : 0, 3160 (res->direction == 0) ? "1" : NULL, 3161 res->info.how.map_type, map_dn, map_attr, map_value, 3162 map_windomain, map_winname, map_unixname, map_is_nt4); 3163 3164 if (sql == NULL) { 3165 retcode = IDMAP_ERR_INTERNAL; 3166 idmapdlog(LOG_ERR, "Out of memory"); 3167 goto out; 3168 } 3169 3170 retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql); 3171 if (retcode != IDMAP_SUCCESS) 3172 goto out; 3173 3174 state->sid2pid_done = FALSE; 3175 sqlite_freemem(sql); 3176 sql = NULL; 3177 3178 /* Check if we need to update namecache */ 3179 if (req->direction & _IDMAP_F_DONT_UPDATE_NAMECACHE) 3180 goto out; 3181 3182 if (EMPTY_STRING(req->id1name)) 3183 goto out; 3184 3185 sql = sqlite_mprintf("INSERT OR REPLACE into name_cache " 3186 "(sidprefix, rid, canon_name, domain, type, expiration) " 3187 "VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ", 3188 req->id1.idmap_id_u.sid.prefix, req->id1.idmap_id_u.sid.rid, 3189 req->id1name, req->id1domain, 3190 (req->id1.idtype == IDMAP_USID) ? _IDMAP_T_USER : _IDMAP_T_GROUP); 3191 3192 if (sql == NULL) { 3193 retcode = IDMAP_ERR_INTERNAL; 3194 idmapdlog(LOG_ERR, "Out of memory"); 3195 goto out; 3196 } 3197 3198 retcode = sql_exec_no_cb(cache, IDMAP_CACHENAME, sql); 3199 3200 out: 3201 if (!(req->flag & IDMAP_REQ_FLG_MAPPING_INFO)) 3202 idmap_info_free(&res->info); 3203 3204 if (sql != NULL) 3205 sqlite_freemem(sql); 3206 return (retcode); 3207 } 3208 3209 static 3210 idmap_retcode 3211 lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res, 3212 int is_user, int getname) 3213 { 3214 char *end; 3215 char *sql = NULL; 3216 const char **values; 3217 sqlite_vm *vm = NULL; 3218 int ncol; 3219 idmap_retcode retcode = IDMAP_SUCCESS; 3220 time_t curtime; 3221 idmap_id_type idtype; 3222 3223 /* Current time */ 3224 errno = 0; 3225 if ((curtime = time(NULL)) == (time_t)-1) { 3226 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 3227 strerror(errno)); 3228 retcode = IDMAP_ERR_INTERNAL; 3229 goto out; 3230 } 3231 3232 /* SQL to lookup the cache by pid or by unixname */ 3233 if (req->id1.idmap_id_u.uid != SENTINEL_PID) { 3234 sql = sqlite_mprintf("SELECT sidprefix, rid, " 3235 "canon_winname, windomain, w2u, is_wuser, " 3236 "map_type, map_dn, map_attr, map_value, map_windomain, " 3237 "map_winname, map_unixname, map_is_nt4 " 3238 "FROM idmap_cache WHERE " 3239 "pid = %u AND u2w = 1 AND is_user = %d AND " 3240 "(pid >= 2147483648 OR " 3241 "(expiration = 0 OR expiration ISNULL OR " 3242 "expiration > %d));", 3243 req->id1.idmap_id_u.uid, is_user, curtime); 3244 } else if (req->id1name != NULL) { 3245 sql = sqlite_mprintf("SELECT sidprefix, rid, " 3246 "canon_winname, windomain, w2u, is_wuser, " 3247 "map_type, map_dn, map_attr, map_value, map_windomain, " 3248 "map_winname, map_unixname, map_is_nt4 " 3249 "FROM idmap_cache WHERE " 3250 "unixname = %Q AND u2w = 1 AND is_user = %d AND " 3251 "(pid >= 2147483648 OR " 3252 "(expiration = 0 OR expiration ISNULL OR " 3253 "expiration > %d));", 3254 req->id1name, is_user, curtime); 3255 } else { 3256 retcode = IDMAP_ERR_ARG; 3257 goto out; 3258 } 3259 3260 if (sql == NULL) { 3261 idmapdlog(LOG_ERR, "Out of memory"); 3262 retcode = IDMAP_ERR_MEMORY; 3263 goto out; 3264 } 3265 retcode = sql_compile_n_step_once( 3266 cache, sql, &vm, &ncol, 14, &values); 3267 sqlite_freemem(sql); 3268 3269 if (retcode == IDMAP_ERR_NOTFOUND) 3270 goto out; 3271 else if (retcode == IDMAP_SUCCESS) { 3272 /* sanity checks */ 3273 if (values[0] == NULL || values[1] == NULL) { 3274 retcode = IDMAP_ERR_CACHE; 3275 goto out; 3276 } 3277 3278 switch (res->id.idtype) { 3279 case IDMAP_SID: 3280 case IDMAP_USID: 3281 case IDMAP_GSID: 3282 idtype = strtol(values[5], &end, 10) == 1 3283 ? IDMAP_USID : IDMAP_GSID; 3284 3285 if (res->id.idtype == IDMAP_USID && 3286 idtype != IDMAP_USID) { 3287 retcode = IDMAP_ERR_NOTUSER; 3288 goto out; 3289 } else if (res->id.idtype == IDMAP_GSID && 3290 idtype != IDMAP_GSID) { 3291 retcode = IDMAP_ERR_NOTGROUP; 3292 goto out; 3293 } 3294 res->id.idtype = idtype; 3295 3296 res->id.idmap_id_u.sid.rid = 3297 strtoul(values[1], &end, 10); 3298 res->id.idmap_id_u.sid.prefix = strdup(values[0]); 3299 if (res->id.idmap_id_u.sid.prefix == NULL) { 3300 idmapdlog(LOG_ERR, "Out of memory"); 3301 retcode = IDMAP_ERR_MEMORY; 3302 goto out; 3303 } 3304 3305 if (values[4] != NULL) 3306 res->direction = 3307 (strtol(values[4], &end, 10) == 0)? 3308 IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 3309 else 3310 res->direction = IDMAP_DIRECTION_U2W; 3311 3312 if (getname == 0 || values[2] == NULL) 3313 break; 3314 req->id2name = strdup(values[2]); 3315 if (req->id2name == NULL) { 3316 idmapdlog(LOG_ERR, "Out of memory"); 3317 retcode = IDMAP_ERR_MEMORY; 3318 goto out; 3319 } 3320 3321 if (values[3] == NULL) 3322 break; 3323 req->id2domain = strdup(values[3]); 3324 if (req->id2domain == NULL) { 3325 idmapdlog(LOG_ERR, "Out of memory"); 3326 retcode = IDMAP_ERR_MEMORY; 3327 goto out; 3328 } 3329 3330 break; 3331 default: 3332 retcode = IDMAP_ERR_NOTSUPPORTED; 3333 break; 3334 } 3335 if (req->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 3336 res->info.src = IDMAP_MAP_SRC_CACHE; 3337 res->info.how.map_type = strtoul(values[6], &end, 10); 3338 switch (res->info.how.map_type) { 3339 case IDMAP_MAP_TYPE_DS_AD: 3340 res->info.how.idmap_how_u.ad.dn = 3341 strdup(values[7]); 3342 res->info.how.idmap_how_u.ad.attr = 3343 strdup(values[8]); 3344 res->info.how.idmap_how_u.ad.value = 3345 strdup(values[9]); 3346 break; 3347 3348 case IDMAP_MAP_TYPE_DS_NLDAP: 3349 res->info.how.idmap_how_u.nldap.dn = 3350 strdup(values[7]); 3351 res->info.how.idmap_how_u.nldap.attr = 3352 strdup(values[8]); 3353 res->info.how.idmap_how_u.nldap.value = 3354 strdup(values[9]); 3355 break; 3356 3357 case IDMAP_MAP_TYPE_RULE_BASED: 3358 res->info.how.idmap_how_u.rule.windomain = 3359 strdup(values[10]); 3360 res->info.how.idmap_how_u.rule.winname = 3361 strdup(values[11]); 3362 res->info.how.idmap_how_u.rule.unixname = 3363 strdup(values[12]); 3364 res->info.how.idmap_how_u.rule.is_nt4 = 3365 strtoul(values[13], &end, 10); 3366 res->info.how.idmap_how_u.rule.is_user = 3367 is_user; 3368 res->info.how.idmap_how_u.rule.is_wuser = 3369 strtol(values[5], &end, 10); 3370 break; 3371 3372 case IDMAP_MAP_TYPE_EPHEMERAL: 3373 break; 3374 3375 case IDMAP_MAP_TYPE_LOCAL_SID: 3376 break; 3377 3378 case IDMAP_MAP_TYPE_KNOWN_SID: 3379 break; 3380 3381 default: 3382 /* Unknow mapping type */ 3383 assert(FALSE); 3384 } 3385 } 3386 } 3387 3388 out: 3389 if (vm != NULL) 3390 (void) sqlite_finalize(vm, NULL); 3391 return (retcode); 3392 } 3393 3394 static 3395 idmap_retcode 3396 lookup_cache_name2sid(sqlite *cache, const char *name, const char *domain, 3397 char **canonname, char **sidprefix, idmap_rid_t *rid, int *type) 3398 { 3399 char *end, *lower_name; 3400 char *sql = NULL; 3401 const char **values; 3402 sqlite_vm *vm = NULL; 3403 int ncol; 3404 time_t curtime; 3405 idmap_retcode retcode = IDMAP_SUCCESS; 3406 3407 /* Get current time */ 3408 errno = 0; 3409 if ((curtime = time(NULL)) == (time_t)-1) { 3410 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 3411 strerror(errno)); 3412 retcode = IDMAP_ERR_INTERNAL; 3413 goto out; 3414 } 3415 3416 /* SQL to lookup the cache */ 3417 if ((lower_name = tolower_u8(name)) == NULL) 3418 lower_name = (char *)name; 3419 sql = sqlite_mprintf("SELECT sidprefix, rid, type, canon_name " 3420 "FROM name_cache WHERE name = %Q AND domain = %Q AND " 3421 "(expiration = 0 OR expiration ISNULL OR " 3422 "expiration > %d);", lower_name, domain, curtime); 3423 if (lower_name != name) 3424 free(lower_name); 3425 if (sql == NULL) { 3426 idmapdlog(LOG_ERR, "Out of memory"); 3427 retcode = IDMAP_ERR_MEMORY; 3428 goto out; 3429 } 3430 retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 4, &values); 3431 sqlite_freemem(sql); 3432 3433 if (retcode == IDMAP_SUCCESS) { 3434 if (type != NULL) { 3435 if (values[2] == NULL) { 3436 retcode = IDMAP_ERR_CACHE; 3437 goto out; 3438 } 3439 *type = strtol(values[2], &end, 10); 3440 } 3441 3442 if (values[0] == NULL || values[1] == NULL) { 3443 retcode = IDMAP_ERR_CACHE; 3444 goto out; 3445 } 3446 3447 if (canonname != NULL) { 3448 assert(values[3] != NULL); 3449 if ((*canonname = strdup(values[3])) == NULL) { 3450 idmapdlog(LOG_ERR, "Out of memory"); 3451 retcode = IDMAP_ERR_MEMORY; 3452 goto out; 3453 } 3454 } 3455 3456 if ((*sidprefix = strdup(values[0])) == NULL) { 3457 idmapdlog(LOG_ERR, "Out of memory"); 3458 retcode = IDMAP_ERR_MEMORY; 3459 if (canonname != NULL) { 3460 free(*canonname); 3461 *canonname = NULL; 3462 } 3463 goto out; 3464 } 3465 *rid = strtoul(values[1], &end, 10); 3466 } 3467 3468 out: 3469 if (vm != NULL) 3470 (void) sqlite_finalize(vm, NULL); 3471 return (retcode); 3472 } 3473 3474 static 3475 idmap_retcode 3476 ad_lookup_by_winname(lookup_state_t *state, 3477 const char *name, const char *domain, int eunixtype, 3478 char **dn, char **attr, char **value, char **canonname, 3479 char **sidprefix, idmap_rid_t *rid, int *wintype, 3480 char **unixname) 3481 { 3482 int retries = 0; 3483 idmap_query_state_t *qs = NULL; 3484 idmap_retcode rc, retcode; 3485 3486 retry: 3487 retcode = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs); 3488 if (retcode != IDMAP_SUCCESS) { 3489 if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2) 3490 goto retry; 3491 degrade_svc(1, "failed to create request for AD lookup " 3492 "by winname"); 3493 return (retcode); 3494 } 3495 3496 restore_svc(); 3497 3498 if (state != NULL) 3499 idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr, 3500 state->ad_unixgroup_attr); 3501 3502 retcode = idmap_name2sid_batch_add1(qs, name, domain, eunixtype, 3503 dn, attr, value, canonname, sidprefix, rid, wintype, unixname, &rc); 3504 3505 if (retcode != IDMAP_SUCCESS) 3506 idmap_lookup_release_batch(&qs); 3507 else 3508 retcode = idmap_lookup_batch_end(&qs); 3509 3510 if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2) 3511 goto retry; 3512 else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 3513 degrade_svc(1, "some AD lookups timed out repeatedly"); 3514 3515 if (retcode != IDMAP_SUCCESS) { 3516 idmapdlog(LOG_NOTICE, "AD lookup by winname failed"); 3517 return (retcode); 3518 } 3519 return (rc); 3520 } 3521 3522 static 3523 idmap_retcode 3524 lookup_name2sid(sqlite *cache, const char *name, const char *domain, 3525 int *is_wuser, char **canonname, char **sidprefix, 3526 idmap_rid_t *rid, idmap_mapping *req) 3527 { 3528 int type; 3529 idmap_retcode retcode; 3530 3531 *sidprefix = NULL; 3532 if (canonname != NULL) 3533 *canonname = NULL; 3534 3535 /* Lookup well-known SIDs table */ 3536 retcode = lookup_wksids_name2sid(name, canonname, sidprefix, rid, 3537 &type); 3538 if (retcode == IDMAP_SUCCESS) { 3539 req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 3540 goto out; 3541 } else if (retcode != IDMAP_ERR_NOTFOUND) { 3542 return (retcode); 3543 } 3544 3545 /* Lookup cache */ 3546 retcode = lookup_cache_name2sid(cache, name, domain, canonname, 3547 sidprefix, rid, &type); 3548 if (retcode == IDMAP_SUCCESS) { 3549 req->direction |= _IDMAP_F_DONT_UPDATE_NAMECACHE; 3550 goto out; 3551 } else if (retcode != IDMAP_ERR_NOTFOUND) { 3552 return (retcode); 3553 } 3554 3555 /* Lookup AD */ 3556 retcode = ad_lookup_by_winname(NULL, name, domain, _IDMAP_T_UNDEF, 3557 NULL, NULL, NULL, canonname, sidprefix, rid, &type, NULL); 3558 if (retcode != IDMAP_SUCCESS) 3559 return (retcode); 3560 /* Don't need to set req->direction |= _IDMAP_F_LOOKUP_AD; */ 3561 3562 out: 3563 /* 3564 * Entry found (cache or Windows lookup) 3565 * is_wuser is both input as well as output parameter 3566 */ 3567 if (*is_wuser == 1 && type != _IDMAP_T_USER) 3568 retcode = IDMAP_ERR_NOTUSER; 3569 else if (*is_wuser == 0 && type != _IDMAP_T_GROUP) 3570 retcode = IDMAP_ERR_NOTGROUP; 3571 else if (*is_wuser == -1) { 3572 /* Caller wants to know if its user or group */ 3573 if (type == _IDMAP_T_USER) 3574 *is_wuser = 1; 3575 else if (type == _IDMAP_T_GROUP) 3576 *is_wuser = 0; 3577 else 3578 retcode = IDMAP_ERR_SID; 3579 } 3580 3581 if (retcode != IDMAP_SUCCESS) { 3582 free(*sidprefix); 3583 *sidprefix = NULL; 3584 if (canonname != NULL) { 3585 free(*canonname); 3586 *canonname = NULL; 3587 } 3588 } 3589 return (retcode); 3590 } 3591 3592 static 3593 idmap_retcode 3594 name_based_mapping_pid2sid(sqlite *db, sqlite *cache, const char *unixname, 3595 int is_user, idmap_mapping *req, idmap_id_res *res) 3596 { 3597 const char *winname, *windomain; 3598 char *canonname; 3599 char *default_domain = NULL; 3600 char *sql = NULL, *errmsg = NULL; 3601 idmap_retcode retcode; 3602 char *end; 3603 const char **values; 3604 sqlite_vm *vm = NULL; 3605 int ncol, r; 3606 int is_wuser; 3607 const char *me = "name_based_mapping_pid2sid"; 3608 int non_wild_match = FALSE; 3609 idmap_namerule *rule = &res->info.how.idmap_how_u.rule; 3610 int direction; 3611 3612 assert(unixname != NULL); /* We have unixname */ 3613 assert(req->id2name == NULL); /* We don't have winname */ 3614 assert(res->id.idmap_id_u.sid.prefix == NULL); /* No SID either */ 3615 3616 RDLOCK_CONFIG(); 3617 if (_idmapdstate.cfg->pgcfg.default_domain != NULL) { 3618 default_domain = 3619 strdup(_idmapdstate.cfg->pgcfg.default_domain); 3620 if (default_domain == NULL) { 3621 UNLOCK_CONFIG(); 3622 idmapdlog(LOG_ERR, "Out of memory"); 3623 retcode = IDMAP_ERR_MEMORY; 3624 goto out; 3625 } 3626 } 3627 UNLOCK_CONFIG(); 3628 3629 sql = sqlite_mprintf( 3630 "SELECT winname_display, windomain, w2u_order, " 3631 "is_wuser, unixname, is_nt4 " 3632 "FROM namerules WHERE " 3633 "u2w_order > 0 AND is_user = %d AND " 3634 "(unixname = %Q OR unixname = '*') " 3635 "ORDER BY u2w_order ASC;", is_user, unixname); 3636 if (sql == NULL) { 3637 idmapdlog(LOG_ERR, "Out of memory"); 3638 retcode = IDMAP_ERR_MEMORY; 3639 goto out; 3640 } 3641 3642 if (sqlite_compile(db, sql, NULL, &vm, &errmsg) != SQLITE_OK) { 3643 retcode = IDMAP_ERR_INTERNAL; 3644 idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3645 CHECK_NULL(errmsg)); 3646 sqlite_freemem(errmsg); 3647 goto out; 3648 } 3649 3650 for (;;) { 3651 r = sqlite_step(vm, &ncol, &values, NULL); 3652 assert(r != SQLITE_LOCKED && r != SQLITE_BUSY); 3653 if (r == SQLITE_ROW) { 3654 if (ncol < 6) { 3655 retcode = IDMAP_ERR_INTERNAL; 3656 goto out; 3657 } 3658 if (values[0] == NULL) { 3659 /* values [1] and [2] can be null */ 3660 retcode = IDMAP_ERR_INTERNAL; 3661 goto out; 3662 } 3663 3664 if (values[2] != NULL) 3665 direction = 3666 (strtol(values[2], &end, 10) == 0)? 3667 IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 3668 else 3669 direction = IDMAP_DIRECTION_U2W; 3670 3671 if (EMPTY_NAME(values[0])) { 3672 idmap_namerule_set(rule, values[1], values[0], 3673 values[4], is_user, 3674 strtol(values[3], &end, 10), 3675 strtol(values[5], &end, 10), 3676 direction); 3677 retcode = IDMAP_ERR_NOMAPPING; 3678 goto out; 3679 } 3680 3681 if (values[0][0] == '*') { 3682 winname = unixname; 3683 if (non_wild_match) { 3684 /* 3685 * There were non-wildcard rules 3686 * where the Windows identity doesn't 3687 * exist. Return no mapping. 3688 */ 3689 retcode = IDMAP_ERR_NOMAPPING; 3690 goto out; 3691 } 3692 } else { 3693 /* Save first non-wild match rule */ 3694 if (!non_wild_match) { 3695 idmap_namerule_set(rule, values[1], 3696 values[0], values[4], 3697 is_user, 3698 strtol(values[3], &end, 10), 3699 strtol(values[5], &end, 10), 3700 direction); 3701 non_wild_match = TRUE; 3702 } 3703 winname = values[0]; 3704 } 3705 is_wuser = res->id.idtype == IDMAP_USID ? 1 3706 : res->id.idtype == IDMAP_GSID ? 0 3707 : -1; 3708 if (values[1] != NULL) 3709 windomain = values[1]; 3710 else if (default_domain != NULL) 3711 windomain = default_domain; 3712 else { 3713 idmapdlog(LOG_ERR, "%s: no domain", me); 3714 retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 3715 goto out; 3716 } 3717 3718 retcode = lookup_name2sid(cache, winname, windomain, 3719 &is_wuser, &canonname, 3720 &res->id.idmap_id_u.sid.prefix, 3721 &res->id.idmap_id_u.sid.rid, req); 3722 3723 if (retcode == IDMAP_ERR_NOTFOUND) { 3724 continue; 3725 } 3726 goto out; 3727 3728 } else if (r == SQLITE_DONE) { 3729 /* 3730 * If there were non-wildcard rules where 3731 * Windows identity doesn't exist 3732 * return no mapping. 3733 */ 3734 if (non_wild_match) 3735 retcode = IDMAP_ERR_NOMAPPING; 3736 else 3737 retcode = IDMAP_ERR_NOTFOUND; 3738 goto out; 3739 } else { 3740 (void) sqlite_finalize(vm, &errmsg); 3741 vm = NULL; 3742 idmapdlog(LOG_ERR, "%s: database error (%s)", me, 3743 CHECK_NULL(errmsg)); 3744 sqlite_freemem(errmsg); 3745 retcode = IDMAP_ERR_INTERNAL; 3746 goto out; 3747 } 3748 } 3749 3750 out: 3751 if (sql != NULL) 3752 sqlite_freemem(sql); 3753 res->info.how.map_type = IDMAP_MAP_TYPE_RULE_BASED; 3754 if (retcode == IDMAP_SUCCESS) { 3755 res->id.idtype = is_wuser ? IDMAP_USID : IDMAP_GSID; 3756 3757 if (values[2] != NULL) 3758 res->direction = 3759 (strtol(values[2], &end, 10) == 0)? 3760 IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI; 3761 else 3762 res->direction = IDMAP_DIRECTION_U2W; 3763 3764 req->id2name = canonname; 3765 if (req->id2name != NULL) { 3766 if (windomain == default_domain) { 3767 req->id2domain = (char *)windomain; 3768 default_domain = NULL; 3769 } else { 3770 req->id2domain = strdup(windomain); 3771 } 3772 } 3773 idmap_namerule_set(rule, values[1], values[0], values[4], 3774 is_user, strtol(values[3], &end, 10), 3775 strtol(values[5], &end, 10), 3776 rule->direction); 3777 res->info.src = IDMAP_MAP_SRC_NEW; 3778 } 3779 if (vm != NULL) 3780 (void) sqlite_finalize(vm, NULL); 3781 if (default_domain != NULL) 3782 free(default_domain); 3783 return (retcode); 3784 } 3785 3786 /* 3787 * Convention when processing unix2win requests: 3788 * 3789 * Unix identity: 3790 * req->id1name = 3791 * unixname if given otherwise unixname found will be placed 3792 * here. 3793 * req->id1domain = 3794 * NOT USED 3795 * req->id1.idtype = 3796 * Given type (IDMAP_UID or IDMAP_GID) 3797 * req->id1..[uid or gid] = 3798 * UID/GID if given otherwise UID/GID found will be placed here. 3799 * 3800 * Windows identity: 3801 * req->id2name = 3802 * winname found will be placed here. 3803 * req->id2domain = 3804 * windomain found will be placed here. 3805 * res->id.idtype = 3806 * Target type initialized from req->id2.idtype. If 3807 * it is IDMAP_SID then actual type (IDMAP_USID/GSID) found 3808 * will be placed here. 3809 * req->id..sid.[prefix, rid] = 3810 * SID found will be placed here. 3811 * 3812 * Others: 3813 * res->retcode = 3814 * Return status for this request will be placed here. 3815 * res->direction = 3816 * Direction found will be placed here. Direction 3817 * meaning whether the resultant mapping is valid 3818 * only from unix2win or bi-directional. 3819 * req->direction = 3820 * INTERNAL USE. Used by idmapd to set various 3821 * flags (_IDMAP_F_xxxx) to aid in processing 3822 * of the request. 3823 * req->id2.idtype = 3824 * INTERNAL USE. Initially this is the requested target 3825 * type and is used to initialize res->id.idtype. 3826 * ad_lookup_batch() uses this field temporarily to store 3827 * sid_type obtained by the batched AD lookups and after 3828 * use resets it to IDMAP_NONE to prevent xdr from 3829 * mis-interpreting the contents of req->id2. 3830 * req->id2..[uid or gid or sid] = 3831 * NOT USED 3832 */ 3833 3834 /* 3835 * This function does the following: 3836 * 1. Lookup well-known SIDs table. 3837 * 2. Lookup cache. 3838 * 3. Check if the client does not want new mapping to be allocated 3839 * in which case this pass is the final pass. 3840 * 4. Set AD/NLDAP lookup flags if it determines that the next stage needs 3841 * to do AD/NLDAP lookup. 3842 */ 3843 idmap_retcode 3844 pid2sid_first_pass(lookup_state_t *state, sqlite *cache, 3845 idmap_mapping *req, idmap_id_res *res, int is_user, 3846 int getname) 3847 { 3848 idmap_retcode retcode; 3849 bool_t gen_localsid_on_err = FALSE; 3850 3851 /* Initialize result */ 3852 res->id.idtype = req->id2.idtype; 3853 res->direction = IDMAP_DIRECTION_UNDEF; 3854 3855 if (req->id2.idmap_id_u.sid.prefix != NULL) { 3856 /* sanitize sidprefix */ 3857 free(req->id2.idmap_id_u.sid.prefix); 3858 req->id2.idmap_id_u.sid.prefix = NULL; 3859 } 3860 3861 /* Find pid */ 3862 if (req->id1.idmap_id_u.uid == SENTINEL_PID) { 3863 if (ns_lookup_byname(req->id1name, NULL, &req->id1) 3864 != IDMAP_SUCCESS) { 3865 retcode = IDMAP_ERR_NOMAPPING; 3866 goto out; 3867 } 3868 } 3869 3870 /* Lookup well-known SIDs table */ 3871 retcode = lookup_wksids_pid2sid(req, res, is_user); 3872 if (retcode != IDMAP_ERR_NOTFOUND) 3873 goto out; 3874 3875 /* Lookup cache */ 3876 retcode = lookup_cache_pid2sid(cache, req, res, is_user, getname); 3877 if (retcode != IDMAP_ERR_NOTFOUND) 3878 goto out; 3879 3880 /* Ephemeral ids cannot be allocated during pid2sid */ 3881 if (IS_EPHEMERAL(req->id1.idmap_id_u.uid)) { 3882 retcode = IDMAP_ERR_NOMAPPING; 3883 goto out; 3884 } 3885 3886 if (DO_NOT_ALLOC_NEW_ID_MAPPING(req)) { 3887 retcode = IDMAP_ERR_NONEGENERATED; 3888 goto out; 3889 } 3890 3891 if (AVOID_NAMESERVICE(req)) { 3892 gen_localsid_on_err = TRUE; 3893 retcode = IDMAP_ERR_NOMAPPING; 3894 goto out; 3895 } 3896 3897 /* Set flags for the next stage */ 3898 if (AD_MODE(req->id1.idtype, state)) { 3899 /* 3900 * If AD-based name mapping is enabled then the next stage 3901 * will need to lookup AD using unixname to get the 3902 * corresponding winname. 3903 */ 3904 if (req->id1name == NULL) { 3905 /* Get unixname if only pid is given. */ 3906 retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, 3907 is_user, &req->id1name); 3908 if (retcode != IDMAP_SUCCESS) 3909 goto out; 3910 } 3911 req->direction |= _IDMAP_F_LOOKUP_AD; 3912 state->ad_nqueries++; 3913 } else if (NLDAP_OR_MIXED_MODE(req->id1.idtype, state)) { 3914 /* 3915 * If native LDAP or mixed mode is enabled for name mapping 3916 * then the next stage will need to lookup native LDAP using 3917 * unixname/pid to get the corresponding winname. 3918 */ 3919 req->direction |= _IDMAP_F_LOOKUP_NLDAP; 3920 state->nldap_nqueries++; 3921 } 3922 3923 /* 3924 * Failed to find non-expired entry in cache. Set the flag to 3925 * indicate that we are not done yet. 3926 */ 3927 state->pid2sid_done = FALSE; 3928 req->direction |= _IDMAP_F_NOTDONE; 3929 retcode = IDMAP_SUCCESS; 3930 3931 out: 3932 res->retcode = idmap_stat4prot(retcode); 3933 if (ARE_WE_DONE(req->direction) && res->retcode != IDMAP_SUCCESS) 3934 if (gen_localsid_on_err == TRUE) 3935 (void) generate_localsid(req, res, is_user, TRUE); 3936 return (retcode); 3937 } 3938 3939 idmap_retcode 3940 pid2sid_second_pass(lookup_state_t *state, sqlite *cache, sqlite *db, 3941 idmap_mapping *req, idmap_id_res *res, int is_user) 3942 { 3943 bool_t gen_localsid_on_err = TRUE; 3944 idmap_retcode retcode = IDMAP_SUCCESS; 3945 3946 /* Check if second pass is needed */ 3947 if (ARE_WE_DONE(req->direction)) 3948 return (res->retcode); 3949 3950 /* Get status from previous pass */ 3951 retcode = res->retcode; 3952 if (retcode != IDMAP_SUCCESS) 3953 goto out; 3954 3955 /* 3956 * If directory-based name mapping is enabled then the winname 3957 * may already have been retrieved from the AD object (AD-mode) 3958 * or from native LDAP object (nldap-mode or mixed-mode) -- done. 3959 */ 3960 if (res->id.idmap_id_u.sid.prefix != NULL || req->id2name != NULL) { 3961 if (AD_MODE(req->id1.idtype, state)) 3962 res->direction = IDMAP_DIRECTION_BI; 3963 else if (NLDAP_MODE(req->id1.idtype, state)) 3964 res->direction = IDMAP_DIRECTION_BI; 3965 else if (MIXED_MODE(req->id1.idtype, state)) 3966 res->direction = IDMAP_DIRECTION_W2U; 3967 goto out; 3968 } 3969 3970 if (req->id1name == NULL) { 3971 /* Get unixname from name service */ 3972 retcode = ns_lookup_bypid(req->id1.idmap_id_u.uid, is_user, 3973 &req->id1name); 3974 if (retcode != IDMAP_SUCCESS) 3975 goto out; 3976 } else if (req->id1.idmap_id_u.uid == SENTINEL_PID) { 3977 /* Get pid from name service */ 3978 retcode = ns_lookup_byname(req->id1name, NULL, &req->id1); 3979 if (retcode != IDMAP_SUCCESS) { 3980 gen_localsid_on_err = FALSE; 3981 goto out; 3982 } 3983 } 3984 3985 /* Free any mapping info from Directory based mapping */ 3986 if (res->info.how.map_type != IDMAP_MAP_TYPE_UNKNOWN) 3987 idmap_info_free(&res->info); 3988 3989 /* Use unixname to evaluate local name-based mapping rules */ 3990 retcode = name_based_mapping_pid2sid(db, cache, req->id1name, is_user, 3991 req, res); 3992 if (retcode == IDMAP_ERR_NOTFOUND) { 3993 retcode = generate_localsid(req, res, is_user, FALSE); 3994 gen_localsid_on_err = FALSE; 3995 } 3996 3997 out: 3998 res->retcode = idmap_stat4prot(retcode); 3999 if (res->retcode != IDMAP_SUCCESS) { 4000 req->direction = _IDMAP_F_DONE; 4001 if (gen_localsid_on_err == TRUE) 4002 (void) generate_localsid(req, res, is_user, TRUE); 4003 } 4004 if (!ARE_WE_DONE(req->direction)) 4005 state->pid2sid_done = FALSE; 4006 return (retcode); 4007 } 4008 4009 static 4010 idmap_retcode 4011 ad_lookup_by_sid(lookup_state_t *state, 4012 const char *sidprefix, idmap_rid_t rid, int eunixtype, 4013 char **dn, char **attr, char **value, char **name, 4014 char **domain, int *type, char **unixname) 4015 { 4016 int retries = 0; 4017 idmap_query_state_t *qs = NULL; 4018 idmap_retcode rc, retcode; 4019 4020 retry: 4021 retcode = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs); 4022 if (retcode != IDMAP_SUCCESS) { 4023 if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2) 4024 goto retry; 4025 degrade_svc(1, "failed to create request for AD lookup by SID"); 4026 return (retcode); 4027 } 4028 4029 restore_svc(); 4030 4031 if (state != NULL) 4032 idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr, 4033 state->ad_unixgroup_attr); 4034 4035 retcode = idmap_sid2name_batch_add1(qs, sidprefix, &rid, eunixtype, 4036 dn, attr, value, name, domain, type, unixname, &rc); 4037 4038 if (retcode != IDMAP_SUCCESS) 4039 idmap_lookup_release_batch(&qs); 4040 else 4041 retcode = idmap_lookup_batch_end(&qs); 4042 4043 if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2) 4044 goto retry; 4045 else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 4046 degrade_svc(1, "some AD lookups timed out repeatedly"); 4047 4048 if (retcode != IDMAP_SUCCESS) { 4049 idmapdlog(LOG_NOTICE, "AD lookup by SID failed"); 4050 return (retcode); 4051 } 4052 return (rc); 4053 } 4054 4055 static 4056 int 4057 copy_mapping_request(idmap_mapping *mapping, idmap_mapping *request) 4058 { 4059 (void) memset(mapping, 0, sizeof (*mapping)); 4060 4061 mapping->flag = request->flag; 4062 mapping->direction = _IDMAP_F_DONE; 4063 mapping->id2.idtype = request->id2.idtype; 4064 4065 mapping->id1.idtype = request->id1.idtype; 4066 if (IS_REQUEST_SID(*request, 1)) { 4067 mapping->id1.idmap_id_u.sid.rid = 4068 request->id1.idmap_id_u.sid.rid; 4069 if (!EMPTY_STRING(request->id1.idmap_id_u.sid.prefix)) { 4070 mapping->id1.idmap_id_u.sid.prefix = 4071 strdup(request->id1.idmap_id_u.sid.prefix); 4072 if (mapping->id1.idmap_id_u.sid.prefix == NULL) 4073 goto errout; 4074 } 4075 } else { 4076 mapping->id1.idmap_id_u.uid = request->id1.idmap_id_u.uid; 4077 } 4078 4079 if (!EMPTY_STRING(request->id1domain)) { 4080 mapping->id1domain = strdup(request->id1domain); 4081 if (mapping->id1domain == NULL) 4082 goto errout; 4083 } 4084 4085 if (!EMPTY_STRING(request->id1name)) { 4086 mapping->id1name = strdup(request->id1name); 4087 if (mapping->id1name == NULL) 4088 goto errout; 4089 } 4090 4091 /* We don't need the rest of the request i.e request->id2 */ 4092 return (0); 4093 4094 errout: 4095 if (mapping->id1.idmap_id_u.sid.prefix != NULL) 4096 free(mapping->id1.idmap_id_u.sid.prefix); 4097 if (mapping->id1domain != NULL) 4098 free(mapping->id1domain); 4099 if (mapping->id1name != NULL) 4100 free(mapping->id1name); 4101 4102 (void) memset(mapping, 0, sizeof (*mapping)); 4103 return (-1); 4104 } 4105 4106 4107 idmap_retcode 4108 get_w2u_mapping(sqlite *cache, sqlite *db, idmap_mapping *request, 4109 idmap_mapping *mapping) 4110 { 4111 idmap_id_res idres; 4112 lookup_state_t state; 4113 char *cp; 4114 idmap_retcode retcode; 4115 const char *winname, *windomain; 4116 4117 (void) memset(&idres, 0, sizeof (idres)); 4118 (void) memset(&state, 0, sizeof (state)); 4119 4120 /* Get directory-based name mapping info */ 4121 retcode = get_ds_namemap_type(&state); 4122 if (retcode != IDMAP_SUCCESS) 4123 goto out; 4124 4125 /* 4126 * Copy data from "request" to "mapping". Note that 4127 * empty strings are not copied from "request" to 4128 * "mapping" and therefore the coresponding strings in 4129 * "mapping" will be NULL. This eliminates having to 4130 * check for empty strings henceforth. 4131 */ 4132 if (copy_mapping_request(mapping, request) < 0) { 4133 retcode = IDMAP_ERR_MEMORY; 4134 goto out; 4135 } 4136 4137 winname = mapping->id1name; 4138 windomain = mapping->id1domain; 4139 4140 if (winname == NULL && windomain != NULL) { 4141 retcode = IDMAP_ERR_ARG; 4142 goto out; 4143 } 4144 4145 /* Need atleast winname or sid to proceed */ 4146 if (winname == NULL && mapping->id1.idmap_id_u.sid.prefix == NULL) { 4147 retcode = IDMAP_ERR_ARG; 4148 goto out; 4149 } 4150 4151 /* 4152 * If domainname is not given but we have a fully qualified 4153 * winname then extract the domainname from the winname, 4154 * otherwise use the default_domain from the config 4155 */ 4156 if (winname != NULL && windomain == NULL) { 4157 retcode = IDMAP_SUCCESS; 4158 if ((cp = strchr(winname, '@')) != NULL) { 4159 *cp = '\0'; 4160 mapping->id1domain = strdup(cp + 1); 4161 if (mapping->id1domain == NULL) 4162 retcode = IDMAP_ERR_MEMORY; 4163 } else if (lookup_wksids_name2sid(winname, NULL, NULL, NULL, 4164 NULL) != IDMAP_SUCCESS) { 4165 /* well-known SIDs don't need domain */ 4166 RDLOCK_CONFIG(); 4167 if (_idmapdstate.cfg->pgcfg.default_domain != NULL) { 4168 mapping->id1domain = 4169 strdup(_idmapdstate.cfg-> 4170 pgcfg.default_domain); 4171 if (mapping->id1domain == NULL) 4172 retcode = IDMAP_ERR_MEMORY; 4173 } else { 4174 retcode = IDMAP_ERR_DOMAIN_NOTFOUND; 4175 } 4176 UNLOCK_CONFIG(); 4177 } 4178 if (retcode != IDMAP_SUCCESS) 4179 goto out; 4180 } 4181 4182 /* 4183 * First pass looks up the well-known SIDs table and cache 4184 * and handles localSIDs 4185 */ 4186 state.sid2pid_done = TRUE; 4187 retcode = sid2pid_first_pass(&state, cache, mapping, &idres); 4188 if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE) 4189 goto out; 4190 4191 /* AD lookup by winname or by sid */ 4192 if (state.ad_nqueries > 0) { 4193 retcode = ad_lookup(&state, mapping, &idres, 1, 1, 0); 4194 if (IDMAP_ERROR(retcode)) 4195 goto out; 4196 } 4197 4198 /* 4199 * If nldap-based name mapping is enabled then lookup native LDAP 4200 * directory service by winname to get pid and unixname. Ignore 4201 * non-fatal errors in which case we simply fallback to evaluating 4202 * local name-based mapping rules. 4203 */ 4204 if (mapping->id1name != NULL && NLDAP_MODE(idres.id.idtype, (&state))) { 4205 retcode = nldap_lookup(mapping, &idres, 1, 1); 4206 if (IDMAP_FATAL_ERROR(retcode)) { 4207 goto out; 4208 } 4209 idres.retcode = IDMAP_SUCCESS; 4210 } 4211 4212 /* Next pass performs name-based mapping and ephemeral mapping. */ 4213 state.sid2pid_done = TRUE; 4214 retcode = sid2pid_second_pass(&state, cache, db, mapping, &idres); 4215 if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE) 4216 goto out; 4217 4218 /* Update cache */ 4219 (void) update_cache_sid2pid(&state, cache, mapping, &idres); 4220 4221 out: 4222 /* 4223 * Note that "mapping" is returned to the client. Therefore 4224 * copy whatever we have in "idres" to mapping->id2 and 4225 * free idres. 4226 */ 4227 mapping->direction = idres.direction; 4228 mapping->id2 = idres.id; 4229 if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO || 4230 retcode != IDMAP_SUCCESS) 4231 (void) idmap_info_mov(&mapping->info, &idres.info); 4232 else 4233 idmap_info_free(&idres.info); 4234 (void) memset(&idres, 0, sizeof (idres)); 4235 if (retcode != IDMAP_SUCCESS) 4236 mapping->id2.idmap_id_u.uid = UID_NOBODY; 4237 xdr_free(xdr_idmap_id_res, (caddr_t)&idres); 4238 cleanup_lookup_state(&state); 4239 return (retcode); 4240 } 4241 4242 idmap_retcode 4243 get_u2w_mapping(sqlite *cache, sqlite *db, idmap_mapping *request, 4244 idmap_mapping *mapping, int is_user) 4245 { 4246 idmap_id_res idres; 4247 lookup_state_t state; 4248 idmap_retcode retcode; 4249 char *canonname; 4250 int is_wuser; 4251 4252 /* 4253 * In order to re-use the pid2sid code, we convert 4254 * our input data into structs that are expected by 4255 * pid2sid_first_pass. 4256 */ 4257 4258 (void) memset(&idres, 0, sizeof (idres)); 4259 (void) memset(&state, 0, sizeof (state)); 4260 4261 /* Get directory-based name mapping info */ 4262 retcode = get_ds_namemap_type(&state); 4263 if (retcode != IDMAP_SUCCESS) 4264 goto out; 4265 4266 /* 4267 * Copy data from "request" to "mapping". Note that 4268 * empty strings are not copied from "request" to 4269 * "mapping" and therefore the coresponding strings in 4270 * "mapping" will be NULL. This eliminates having to 4271 * check for empty strings henceforth. 4272 */ 4273 if (copy_mapping_request(mapping, request) < 0) { 4274 retcode = IDMAP_ERR_MEMORY; 4275 goto out; 4276 } 4277 4278 /* 4279 * For unix to windows mapping request, we need atleast a 4280 * unixname or uid/gid to proceed 4281 */ 4282 if (mapping->id1name == NULL && 4283 mapping->id1.idmap_id_u.uid == SENTINEL_PID) { 4284 retcode = IDMAP_ERR_ARG; 4285 goto out; 4286 } 4287 4288 /* First pass looks up cache and well-known SIDs */ 4289 state.pid2sid_done = TRUE; 4290 retcode = pid2sid_first_pass(&state, cache, mapping, &idres, 4291 is_user, 1); 4292 if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE) 4293 goto out; 4294 4295 if (state.nldap_nqueries > 0) { 4296 /* 4297 * This means directory-based name mapping (nldap or mixed 4298 * mode) is enabled. Lookup native LDAP directory service 4299 * by unixname or pid to get the winname. Ignore non-fatal 4300 * errors in which case we simply fallback to local name 4301 * based mapping rules. 4302 */ 4303 retcode = nldap_lookup(mapping, &idres, 0, 0); 4304 if (IDMAP_FATAL_ERROR(retcode)) 4305 goto out; 4306 idres.retcode = IDMAP_SUCCESS; 4307 4308 /* 4309 * If we've winname then get SID. We use lookup_name2sid() 4310 * instead of ad_lookup() in order to first resolve name2sid 4311 * using well-known SIDs table and name_cache before trying 4312 * AD. 4313 */ 4314 if (mapping->id2name != NULL) { 4315 canonname = NULL; 4316 is_wuser = -1; 4317 retcode = lookup_name2sid(cache, mapping->id2name, 4318 mapping->id2domain, &is_wuser, &canonname, 4319 &idres.id.idmap_id_u.sid.prefix, 4320 &idres.id.idmap_id_u.sid.rid, mapping); 4321 if (canonname != NULL) { 4322 free(mapping->id2name); 4323 mapping->id2name = canonname; 4324 } 4325 if (retcode == IDMAP_SUCCESS) 4326 idres.id.idtype = is_wuser ? IDMAP_USID : 4327 IDMAP_GSID; 4328 idres.retcode = retcode; 4329 } 4330 } else if (state.ad_nqueries > 0) { 4331 /* 4332 * This means AD-based name mapping is enabled. 4333 * Lookup AD by unixname to get winname and sid. 4334 * Ignore non-fatal errors in which case we simply fallback 4335 * to local name based mapping rules. 4336 */ 4337 retcode = ad_lookup(&state, mapping, &idres, 0, 0, 1); 4338 if (IDMAP_FATAL_ERROR(retcode)) 4339 goto out; 4340 idres.retcode = IDMAP_SUCCESS; 4341 } 4342 4343 /* 4344 * Next pass processes the result of the preceding passes/lookups. 4345 * It returns if there's nothing more to be done otherwise it 4346 * evaluates local name-based mapping rules 4347 */ 4348 state.pid2sid_done = TRUE; 4349 retcode = pid2sid_second_pass(&state, cache, db, mapping, &idres, 4350 is_user); 4351 if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE) 4352 goto out; 4353 4354 /* Update cache */ 4355 (void) update_cache_pid2sid(&state, cache, mapping, &idres); 4356 4357 out: 4358 /* 4359 * Note that "mapping" is returned to the client. Therefore 4360 * copy whatever we have in "idres" to mapping->id2 and 4361 * free idres. 4362 */ 4363 mapping->direction = idres.direction; 4364 mapping->id2 = idres.id; 4365 if (mapping->flag & IDMAP_REQ_FLG_MAPPING_INFO || 4366 retcode != IDMAP_SUCCESS) 4367 (void) idmap_info_mov(&mapping->info, &idres.info); 4368 else 4369 idmap_info_free(&idres.info); 4370 (void) memset(&idres, 0, sizeof (idres)); 4371 xdr_free(xdr_idmap_id_res, (caddr_t)&idres); 4372 cleanup_lookup_state(&state); 4373 return (retcode); 4374 } 4375 4376 static 4377 idmap_retcode 4378 ad_lookup_by_unixname(lookup_state_t *state, 4379 const char *unixname, int is_user, int is_wuser, 4380 char **dn, char **attr, char **value, char **sidprefix, 4381 idmap_rid_t *rid, char **winname, char **domain, int *type) 4382 { 4383 /* Lookup AD by unixname */ 4384 int retries = 0; 4385 idmap_query_state_t *qs = NULL; 4386 idmap_retcode rc, retcode; 4387 4388 retry: 4389 retcode = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs); 4390 if (retcode != IDMAP_SUCCESS) { 4391 if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2) 4392 goto retry; 4393 degrade_svc(1, "failed to create request for AD lookup " 4394 "by unixname"); 4395 return (IDMAP_ERR_INTERNAL); 4396 } 4397 4398 restore_svc(); 4399 4400 if (state != NULL) 4401 idmap_lookup_batch_set_unixattr(qs, state->ad_unixuser_attr, 4402 state->ad_unixgroup_attr); 4403 4404 retcode = idmap_unixname2sid_batch_add1(qs, unixname, is_user, 4405 is_wuser, dn, attr, value, sidprefix, rid, winname, domain, 4406 type, &rc); 4407 4408 if (retcode != IDMAP_SUCCESS) 4409 idmap_lookup_release_batch(&qs); 4410 else 4411 retcode = idmap_lookup_batch_end(&qs); 4412 4413 if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2) 4414 goto retry; 4415 else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR) 4416 degrade_svc(1, "some AD lookups timed out repeatedly"); 4417 4418 if (retcode != IDMAP_SUCCESS) { 4419 idmapdlog(LOG_NOTICE, "AD lookup by unixname failed"); 4420 return (retcode); 4421 } 4422 return (rc); 4423 } 4424 4425 /* 4426 * This function is called whenever a non-batched AD lookup needs to be 4427 * done (e.g. get_w2u_mapping() and get_u2w_mapping()). It's already 4428 * determined by the caller before calling this function that AD lookup is 4429 * needed and has already searched the well-known SIDs table and name_cache. 4430 */ 4431 static 4432 idmap_retcode 4433 ad_lookup(lookup_state_t *state, idmap_mapping *req, idmap_id_res *res, 4434 int w2u, int getunixattr, int byunixattr) 4435 { 4436 idmap_retcode retcode; 4437 int type, eunixtype, is_user, is_wuser; 4438 char *canonname = NULL; 4439 idmap_how *how = &res->info.how; 4440 4441 if (w2u) { 4442 /* 4443 * win2unix lookup requests (get_w2u_mapping()) calls this 4444 * function to lookup by sid OR winname and to retrieve 4445 * SID, winname, sidtype (user or group) and unixnames 4446 * from AD. 4447 */ 4448 4449 /* Set the expected unixtype */ 4450 if (res->id.idtype == IDMAP_UID) 4451 eunixtype = _IDMAP_T_USER; 4452 else if (res->id.idtype == IDMAP_GID) 4453 eunixtype = _IDMAP_T_GROUP; 4454 else 4455 eunixtype = _IDMAP_T_UNDEF; 4456 4457 if (req->id1.idmap_id_u.sid.prefix != NULL) { 4458 /* AD lookup by sid */ 4459 res->info.src = IDMAP_MAP_SRC_NEW; 4460 how->map_type = IDMAP_MAP_TYPE_DS_AD; 4461 retcode = ad_lookup_by_sid( 4462 state, req->id1.idmap_id_u.sid.prefix, 4463 req->id1.idmap_id_u.sid.rid, eunixtype, 4464 &how->idmap_how_u.ad.dn, 4465 &how->idmap_how_u.ad.attr, 4466 &how->idmap_how_u.ad.value, 4467 (req->id1name == NULL) ? &req->id1name : NULL, 4468 (req->id1domain == NULL) ? &req->id1domain : NULL, 4469 &type, (getunixattr && req->id2name == NULL) 4470 ? &req->id2name : NULL); 4471 } else { 4472 assert(req->id1name != NULL); 4473 /* AD lookup by winname */ 4474 res->info.src = IDMAP_MAP_SRC_NEW; 4475 how->map_type = IDMAP_MAP_TYPE_DS_AD; 4476 retcode = ad_lookup_by_winname( 4477 state, req->id1name, req->id1domain, eunixtype, 4478 &how->idmap_how_u.ad.dn, 4479 &how->idmap_how_u.ad.attr, 4480 &how->idmap_how_u.ad.value, 4481 &canonname, 4482 &req->id1.idmap_id_u.sid.prefix, 4483 &req->id1.idmap_id_u.sid.rid, &type, 4484 (getunixattr && req->id2name == NULL) 4485 ? &req->id2name : NULL); 4486 4487 if (canonname != NULL) { 4488 free(req->id1name); 4489 req->id1name = canonname; 4490 } 4491 } 4492 if (retcode == IDMAP_SUCCESS) { 4493 switch (type) { 4494 case _IDMAP_T_USER: 4495 if (res->id.idtype == IDMAP_POSIXID) 4496 res->id.idtype = IDMAP_UID; 4497 req->id1.idtype = IDMAP_USID; 4498 break; 4499 case _IDMAP_T_GROUP: 4500 if (res->id.idtype == IDMAP_POSIXID) 4501 res->id.idtype = IDMAP_GID; 4502 req->id1.idtype = IDMAP_GSID; 4503 break; 4504 default: 4505 return (IDMAP_ERR_SID); 4506 } 4507 } else if (retcode == IDMAP_ERR_NOTFOUND) { 4508 /* Nothing found - remove the preset info */ 4509 res->info.src = IDMAP_MAP_SRC_UNKNOWN; 4510 how->map_type = IDMAP_MAP_TYPE_UNKNOWN; 4511 } 4512 return (retcode); 4513 } 4514 4515 /* 4516 * unix2win lookup requests (get_u2w_mapping()) calls this 4517 * function to lookup AD by unixname and to retrieve 4518 * SID, winname, and sidtype (user or group) from AD. 4519 */ 4520 4521 /* Set the expected unixtype */ 4522 eunixtype = (req->id1.idtype == IDMAP_UID) ? _IDMAP_T_USER : 4523 _IDMAP_T_GROUP; 4524 4525 if (byunixattr) { 4526 /* AD lookup by unixname */ 4527 is_user = (IS_REQUEST_UID(*req)) ? 1 : 0; 4528 if (res->id.idtype == IDMAP_USID) 4529 is_wuser = 1; 4530 else if (res->id.idtype == IDMAP_GSID) 4531 is_wuser = 0; 4532 else 4533 is_wuser = is_user; 4534 res->info.src = IDMAP_MAP_SRC_NEW; 4535 how->map_type = IDMAP_MAP_TYPE_DS_AD; 4536 retcode = ad_lookup_by_unixname( 4537 state, req->id1name, is_user, is_wuser, 4538 &how->idmap_how_u.ad.dn, 4539 &how->idmap_how_u.ad.attr, 4540 &how->idmap_how_u.ad.value, 4541 (res->id.idmap_id_u.sid.prefix == NULL) ? 4542 &res->id.idmap_id_u.sid.prefix : NULL, 4543 (res->id.idmap_id_u.sid.prefix == NULL) ? 4544 &res->id.idmap_id_u.sid.rid : NULL, 4545 (req->id2name == NULL) ? &req->id2name : NULL, 4546 (req->id2domain == NULL) ? &req->id2domain : NULL, &type); 4547 } else if (res->id.idmap_id_u.sid.prefix != NULL) { 4548 /* AD lookup by sid */ 4549 res->info.src = IDMAP_MAP_SRC_NEW; 4550 how->map_type = IDMAP_MAP_TYPE_DS_AD; 4551 retcode = ad_lookup_by_sid( 4552 state, res->id.idmap_id_u.sid.prefix, 4553 res->id.idmap_id_u.sid.rid, eunixtype, 4554 &how->idmap_how_u.ad.dn, 4555 &how->idmap_how_u.ad.attr, 4556 &how->idmap_how_u.ad.value, 4557 (req->id2name == NULL) ? &req->id2name : NULL, 4558 (req->id2domain == NULL) ? &req->id2domain : NULL, 4559 &type, (getunixattr && req->id1name == NULL) 4560 ? &req->id1name : NULL); 4561 } else { 4562 /* AD lookup by winname */ 4563 assert(req->id2name != NULL); 4564 res->info.src = IDMAP_MAP_SRC_NEW; 4565 how->map_type = IDMAP_MAP_TYPE_DS_AD; 4566 retcode = ad_lookup_by_winname( 4567 state, req->id2name, req->id2domain, eunixtype, 4568 &how->idmap_how_u.ad.dn, 4569 &how->idmap_how_u.ad.attr, 4570 &how->idmap_how_u.ad.value, 4571 &canonname, &res->id.idmap_id_u.sid.prefix, 4572 &res->id.idmap_id_u.sid.rid, &type, 4573 (getunixattr && req->id1name == NULL) 4574 ? &req->id1name : NULL); 4575 4576 if (canonname != NULL) { 4577 free(req->id2name); 4578 req->id2name = canonname; 4579 } 4580 } 4581 4582 if (retcode == IDMAP_SUCCESS) { 4583 switch (type) { 4584 case _IDMAP_T_USER: 4585 if (res->id.idtype == IDMAP_SID) 4586 res->id.idtype = IDMAP_USID; 4587 break; 4588 case _IDMAP_T_GROUP: 4589 if (res->id.idtype == IDMAP_SID) 4590 res->id.idtype = IDMAP_GSID; 4591 break; 4592 default: 4593 return (IDMAP_ERR_SID); 4594 } 4595 } else if (retcode == IDMAP_ERR_NOTFOUND) { 4596 /* Nothing found - remove the preset info */ 4597 res->info.src = IDMAP_MAP_SRC_UNKNOWN; 4598 how->map_type = IDMAP_MAP_TYPE_UNKNOWN; 4599 } 4600 return (retcode); 4601 } 4602