xref: /titanic_50/usr/src/cmd/idmap/idmapd/dbutils.c (revision df4628cb18cef0a7960608d573d5a9b6cc9e29d5)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * Database related utility routines
30  */
31 
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <string.h>
35 #include <errno.h>
36 #include <sys/types.h>
37 #include <sys/stat.h>
38 #include <rpc/rpc.h>
39 #include <sys/sid.h>
40 #include <time.h>
41 #include <pwd.h>
42 #include <grp.h>
43 #include <pthread.h>
44 #include <assert.h>
45 
46 #include "idmapd.h"
47 #include "adutils.h"
48 #include "string.h"
49 #include "idmap_priv.h"
50 
51 
52 static idmap_retcode sql_compile_n_step_once(sqlite *, char *,
53 		sqlite_vm **, int *, int, const char ***);
54 static idmap_retcode lookup_wksids_name2sid(const char *, char **,
55 		idmap_rid_t *, int *);
56 
57 #define	EMPTY_NAME(name)	(*name == 0 || strcmp(name, "\"\"") == 0)
58 
59 #define	EMPTY_STRING(str)	(str == NULL || *str == 0)
60 
61 #define	DO_NOT_ALLOC_NEW_ID_MAPPING(req)\
62 		(req->flag & IDMAP_REQ_FLG_NO_NEW_ID_ALLOC)
63 
64 #define	AVOID_NAMESERVICE(req)\
65 		(req->flag & IDMAP_REQ_FLG_NO_NAMESERVICE)
66 
67 #define	IS_EPHEMERAL(pid)	(pid > INT32_MAX)
68 
69 #define	LOCALRID_MIN	1000
70 
71 
72 
73 typedef enum init_db_option {
74 	FAIL_IF_CORRUPT = 0,
75 	REMOVE_IF_CORRUPT = 1
76 } init_db_option_t;
77 
78 /*
79  * Thread specfic data to hold the database handles so that the
80  * databaes are not opened and closed for every request. It also
81  * contains the sqlite busy handler structure.
82  */
83 
84 struct idmap_busy {
85 	const char *name;
86 	const int *delays;
87 	int delay_size;
88 	int total;
89 	int sec;
90 };
91 
92 
93 typedef struct idmap_tsd {
94 	sqlite *db_db;
95 	sqlite *cache_db;
96 	struct idmap_busy cache_busy;
97 	struct idmap_busy db_busy;
98 } idmap_tsd_t;
99 
100 
101 
102 static const int cache_delay_table[] =
103 		{ 1, 2, 5, 10, 15, 20, 25, 30,  35,  40,
104 		50,  50, 60, 70, 80, 90, 100};
105 
106 static const int db_delay_table[] =
107 		{ 5, 10, 15, 20, 30,  40,  55,  70, 100};
108 
109 
110 static pthread_key_t	idmap_tsd_key;
111 
112 void
113 idmap_tsd_destroy(void *key)
114 {
115 
116 	idmap_tsd_t	*tsd = (idmap_tsd_t *)key;
117 	if (tsd) {
118 		if (tsd->db_db)
119 			(void) sqlite_close(tsd->db_db);
120 		if (tsd->cache_db)
121 			(void) sqlite_close(tsd->cache_db);
122 		free(tsd);
123 	}
124 }
125 
126 int
127 idmap_init_tsd_key(void) {
128 
129 	return (pthread_key_create(&idmap_tsd_key, idmap_tsd_destroy));
130 }
131 
132 
133 
134 idmap_tsd_t *
135 idmap_get_tsd(void)
136 {
137 	idmap_tsd_t	*tsd;
138 
139 	if ((tsd = pthread_getspecific(idmap_tsd_key)) == NULL) {
140 		/* No thread specific data so create it */
141 		if ((tsd = malloc(sizeof (*tsd))) != NULL) {
142 			/* Initialize thread specific data */
143 			(void) memset(tsd, 0, sizeof (*tsd));
144 			/* save the trhread specific data */
145 			if (pthread_setspecific(idmap_tsd_key, tsd) != 0) {
146 				/* Can't store key */
147 				free(tsd);
148 				tsd = NULL;
149 			}
150 		} else {
151 			tsd = NULL;
152 		}
153 	}
154 
155 	return (tsd);
156 }
157 
158 
159 
160 /*
161  * Initialize 'dbname' using 'sql'
162  */
163 static int
164 init_db_instance(const char *dbname, const char *sql, init_db_option_t opt,
165 		int *new_db_created)
166 {
167 	int rc = 0;
168 	int tries = 0;
169 	sqlite *db = NULL;
170 	char *str = NULL;
171 
172 	if (new_db_created != NULL)
173 		*new_db_created = 0;
174 
175 	db = sqlite_open(dbname, 0600, &str);
176 	while (db == NULL) {
177 		idmapdlog(LOG_ERR,
178 		    "Error creating database %s (%s)",
179 		    dbname, CHECK_NULL(str));
180 		sqlite_freemem(str);
181 		if (opt == FAIL_IF_CORRUPT || opt != REMOVE_IF_CORRUPT ||
182 		    tries > 0)
183 			return (-1);
184 
185 		tries++;
186 		(void) unlink(dbname);
187 		db = sqlite_open(dbname, 0600, &str);
188 	}
189 
190 	sqlite_busy_timeout(db, 3000);
191 	rc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &str);
192 	if (SQLITE_OK != rc) {
193 		idmapdlog(LOG_ERR, "Cannot begin database transaction (%s)",
194 		    str);
195 		sqlite_freemem(str);
196 		sqlite_close(db);
197 		return (1);
198 	}
199 
200 	switch (sqlite_exec(db, sql, NULL, NULL, &str)) {
201 	case SQLITE_ERROR:
202 /*
203  * This is the normal situation: CREATE probably failed because tables
204  * already exist. It may indicate an error in SQL as well, but we cannot
205  * tell.
206  */
207 		sqlite_freemem(str);
208 		rc =  sqlite_exec(db, "ROLLBACK TRANSACTION",
209 		    NULL, NULL, &str);
210 		break;
211 	case SQLITE_OK:
212 		rc =  sqlite_exec(db, "COMMIT TRANSACTION",
213 		    NULL, NULL, &str);
214 		idmapdlog(LOG_INFO,
215 		    "Database created at %s", dbname);
216 
217 		if (new_db_created != NULL)
218 			*new_db_created = 1;
219 		break;
220 	default:
221 		idmapdlog(LOG_ERR,
222 		    "Error initializing database %s (%s)",
223 		    dbname, str);
224 		sqlite_freemem(str);
225 		rc =  sqlite_exec(db, "ROLLBACK TRANSACTION",
226 		    NULL, NULL, &str);
227 		break;
228 	}
229 
230 	if (SQLITE_OK != rc) {
231 		/* this is bad - database may be left in a locked state */
232 		idmapdlog(LOG_ERR,
233 		    "Error closing transaction (%s)", str);
234 		sqlite_freemem(str);
235 	}
236 
237 	(void) sqlite_close(db);
238 	return (rc);
239 }
240 
241 
242 /*
243  * This is the SQLite database busy handler that retries the SQL
244  * operation until it is successful.
245  */
246 int
247 /* LINTED E_FUNC_ARG_UNUSED */
248 idmap_sqlite_busy_handler(void *arg, const char *table_name, int count)
249 {
250 	struct idmap_busy	*busy = arg;
251 	int			delay;
252 	struct timespec		rqtp;
253 
254 	if (count == 1)  {
255 		busy->total = 0;
256 		busy->sec = 2;
257 	}
258 	if (busy->total > 1000 * busy->sec) {
259 		idmapdlog(LOG_ERR,
260 		    "Thread %d waited %d sec for the %s database",
261 		    pthread_self(), busy->sec, busy->name);
262 		busy->sec++;
263 	}
264 
265 	if (count <= busy->delay_size) {
266 		delay = busy->delays[count-1];
267 	} else {
268 		delay = busy->delays[busy->delay_size - 1];
269 	}
270 	busy->total += delay;
271 	rqtp.tv_sec = 0;
272 	rqtp.tv_nsec = delay * (NANOSEC / MILLISEC);
273 	(void) nanosleep(&rqtp, NULL);
274 	return (1);
275 }
276 
277 
278 /*
279  * Get the database handle
280  */
281 idmap_retcode
282 get_db_handle(sqlite **db) {
283 	char	*errmsg;
284 	idmap_tsd_t *tsd;
285 
286 	/*
287 	 * Retrieve the db handle from thread-specific storage
288 	 * If none exists, open and store in thread-specific storage.
289 	 */
290 	if ((tsd = idmap_get_tsd()) == NULL) {
291 		idmapdlog(LOG_ERR,
292 			"Error getting thread specific data for %s",
293 			IDMAP_DBNAME);
294 		return (IDMAP_ERR_MEMORY);
295 	}
296 
297 	if (tsd->db_db == NULL) {
298 		tsd->db_db = sqlite_open(IDMAP_DBNAME, 0, &errmsg);
299 		if (tsd->db_db == NULL) {
300 			idmapdlog(LOG_ERR,
301 				"Error opening database %s (%s)",
302 				IDMAP_DBNAME, CHECK_NULL(errmsg));
303 			sqlite_freemem(errmsg);
304 			return (IDMAP_ERR_INTERNAL);
305 		}
306 		tsd->db_busy.name = IDMAP_DBNAME;
307 		tsd->db_busy.delays = db_delay_table;
308 		tsd->db_busy.delay_size = sizeof (db_delay_table) /
309 		    sizeof (int);
310 		sqlite_busy_handler(tsd->db_db, idmap_sqlite_busy_handler,
311 		    &tsd->db_busy);
312 	}
313 	*db = tsd->db_db;
314 	return (IDMAP_SUCCESS);
315 }
316 
317 /*
318  * Get the cache handle
319  */
320 idmap_retcode
321 get_cache_handle(sqlite **cache) {
322 	char	*errmsg;
323 	idmap_tsd_t *tsd;
324 
325 	/*
326 	 * Retrieve the db handle from thread-specific storage
327 	 * If none exists, open and store in thread-specific storage.
328 	 */
329 	if ((tsd = idmap_get_tsd()) == NULL) {
330 		idmapdlog(LOG_ERR,
331 			"Error getting thread specific data for %s",
332 			IDMAP_DBNAME);
333 		return (IDMAP_ERR_MEMORY);
334 	}
335 
336 	if (tsd->cache_db == NULL) {
337 		tsd->cache_db = sqlite_open(IDMAP_CACHENAME, 0, &errmsg);
338 		if (tsd->cache_db == NULL) {
339 			idmapdlog(LOG_ERR,
340 				"Error opening database %s (%s)",
341 				IDMAP_CACHENAME, CHECK_NULL(errmsg));
342 			sqlite_freemem(errmsg);
343 			return (IDMAP_ERR_INTERNAL);
344 		}
345 		tsd->cache_busy.name = IDMAP_CACHENAME;
346 		tsd->cache_busy.delays = cache_delay_table;
347 		tsd->cache_busy.delay_size = sizeof (cache_delay_table) /
348 		    sizeof (int);
349 		sqlite_busy_handler(tsd->cache_db, idmap_sqlite_busy_handler,
350 		    &tsd->cache_busy);
351 	}
352 	*cache = tsd->cache_db;
353 	return (IDMAP_SUCCESS);
354 }
355 
356 #define	CACHE_SQL\
357 	"CREATE TABLE idmap_cache ("\
358 	"	sidprefix TEXT,"\
359 	"	rid INTEGER,"\
360 	"	windomain TEXT,"\
361 	"	winname TEXT,"\
362 	"	pid INTEGER,"\
363 	"	unixname TEXT,"\
364 	"	is_user INTEGER,"\
365 	"	w2u INTEGER,"\
366 	"	u2w INTEGER,"\
367 	"	expiration INTEGER"\
368 	");"\
369 	"CREATE UNIQUE INDEX idmap_cache_sid_w2u ON idmap_cache"\
370 	"		(sidprefix, rid, w2u);"\
371 	"CREATE UNIQUE INDEX idmap_cache_pid_u2w ON idmap_cache"\
372 	"		(pid, is_user, u2w);"\
373 	"CREATE TABLE name_cache ("\
374 	"	sidprefix TEXT,"\
375 	"	rid INTEGER,"\
376 	"	name TEXT,"\
377 	"	domain TEXT,"\
378 	"	type INTEGER,"\
379 	"	expiration INTEGER"\
380 	");"\
381 	"CREATE UNIQUE INDEX name_cache_sid ON name_cache"\
382 	"		(sidprefix, rid);"
383 
384 #define	DB_SQL\
385 	"CREATE TABLE namerules ("\
386 	"	is_user INTEGER NOT NULL,"\
387 	"	windomain TEXT,"\
388 	"	winname TEXT NOT NULL,"\
389 	"	is_nt4 INTEGER NOT NULL,"\
390 	"	unixname NOT NULL,"\
391 	"	w2u_order INTEGER,"\
392 	"	u2w_order INTEGER"\
393 	");"\
394 	"CREATE UNIQUE INDEX namerules_w2u ON namerules"\
395 	"		(winname, windomain, is_user, w2u_order);"\
396 	"CREATE UNIQUE INDEX namerules_u2w ON namerules"\
397 	"		(unixname, is_user, u2w_order);"
398 
399 /*
400  * Initialize cache and db
401  */
402 int
403 init_dbs() {
404 	/* name-based mappings; probably OK to blow away in a pinch(?) */
405 	if (init_db_instance(IDMAP_DBNAME, DB_SQL, FAIL_IF_CORRUPT, NULL) < 0)
406 		return (-1);
407 
408 	/* mappings, name/SID lookup cache + ephemeral IDs; OK to blow away */
409 	if (init_db_instance(IDMAP_CACHENAME, CACHE_SQL, REMOVE_IF_CORRUPT,
410 			&_idmapdstate.new_eph_db) < 0)
411 		return (-1);
412 
413 	return (0);
414 }
415 
416 /*
417  * Finalize databases
418  */
419 void
420 fini_dbs() {
421 }
422 
423 /*
424  * This table is a listing of status codes that will returned to the
425  * client when a SQL command fails with the corresponding error message.
426  */
427 static msg_table_t sqlmsgtable[] = {
428 	{IDMAP_ERR_U2W_NAMERULE_CONFLICT,
429 	"columns unixname, is_user, u2w_order are not unique"},
430 	{IDMAP_ERR_W2U_NAMERULE_CONFLICT,
431 	"columns winname, windomain, is_user, w2u_order are not unique"},
432 	{-1, NULL}
433 };
434 
435 /*
436  * idmapd's version of string2stat to map SQLite messages to
437  * status codes
438  */
439 idmap_retcode
440 idmapd_string2stat(const char *msg) {
441 	int i;
442 	for (i = 0; sqlmsgtable[i].msg; i++) {
443 		if (strcasecmp(sqlmsgtable[i].msg, msg) == 0)
444 			return (sqlmsgtable[i].retcode);
445 	}
446 	return (IDMAP_ERR_OTHER);
447 }
448 
449 /*
450  * Execute the given SQL statment without using any callbacks
451  */
452 idmap_retcode
453 sql_exec_no_cb(sqlite *db, char *sql) {
454 	char		*errmsg = NULL;
455 	int		r;
456 	idmap_retcode	retcode;
457 
458 	r = sqlite_exec(db, sql, NULL, NULL, &errmsg);
459 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
460 
461 	if (r != SQLITE_OK) {
462 		idmapdlog(LOG_ERR, "Database error during %s (%s)",
463 			sql, CHECK_NULL(errmsg));
464 		retcode = idmapd_string2stat(errmsg);
465 		if (errmsg != NULL)
466 			sqlite_freemem(errmsg);
467 		return (retcode);
468 	}
469 
470 	return (IDMAP_SUCCESS);
471 }
472 
473 /*
474  * Generate expression that can be used in WHERE statements.
475  * Examples:
476  * <prefix> <col>      <op> <value>   <suffix>
477  * ""       "unixuser" "="  "foo" "AND"
478  */
479 idmap_retcode
480 gen_sql_expr_from_utf8str(const char *prefix, const char *col,
481 		const char *op, idmap_utf8str *value,
482 		const char *suffix, char **out) {
483 	char		*str;
484 	idmap_stat	retcode;
485 
486 	if (out == NULL)
487 		return (IDMAP_ERR_ARG);
488 
489 	if (value == NULL)
490 		return (IDMAP_SUCCESS);
491 
492 	retcode = idmap_utf82str(&str, 0, value);
493 	if (retcode != IDMAP_SUCCESS)
494 		return (retcode);
495 
496 	if (prefix == NULL)
497 		prefix = "";
498 	if (suffix == NULL)
499 		suffix = "";
500 
501 	*out = sqlite_mprintf("%s %s %s %Q %s",
502 			prefix, col, op, str, suffix);
503 	idmap_free(str);
504 	if (*out == NULL)
505 		return (IDMAP_ERR_MEMORY);
506 	return (IDMAP_SUCCESS);
507 }
508 
509 /*
510  * Generate and execute SQL statement for LIST RPC calls
511  */
512 idmap_retcode
513 process_list_svc_sql(sqlite *db, char *sql, uint64_t limit,
514 		list_svc_cb cb, void *result) {
515 	list_cb_data_t	cb_data;
516 	char		*errmsg = NULL;
517 	int		r;
518 	idmap_retcode	retcode = IDMAP_ERR_INTERNAL;
519 
520 	(void) memset(&cb_data, 0, sizeof (cb_data));
521 	cb_data.result = result;
522 	cb_data.limit = limit;
523 
524 
525 	r = sqlite_exec(db, sql, cb, &cb_data, &errmsg);
526 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
527 	switch (r) {
528 	case SQLITE_OK:
529 		retcode = IDMAP_SUCCESS;
530 		break;
531 
532 	default:
533 		retcode = IDMAP_ERR_INTERNAL;
534 		idmapdlog(LOG_ERR,
535 			"Database error during %s (%s)",
536 			sql, CHECK_NULL(errmsg));
537 		break;
538 	}
539 	if (errmsg != NULL)
540 		sqlite_freemem(errmsg);
541 	return (retcode);
542 }
543 
544 /*
545  * This routine is called by callbacks that process the results of
546  * LIST RPC calls to validate data and to allocate memory for
547  * the result array.
548  */
549 idmap_retcode
550 validate_list_cb_data(list_cb_data_t *cb_data, int argc, char **argv,
551 		int ncol, uchar_t **list, size_t valsize) {
552 	size_t	nsize;
553 	void	*tmplist;
554 
555 	if (cb_data->limit > 0 && cb_data->next == cb_data->limit)
556 		return (IDMAP_NEXT);
557 
558 	if (argc < ncol || argv == NULL) {
559 		idmapdlog(LOG_ERR, "Invalid data");
560 		return (IDMAP_ERR_INTERNAL);
561 	}
562 
563 	/* alloc in bulk to reduce number of reallocs */
564 	if (cb_data->next >= cb_data->len) {
565 		nsize = (cb_data->len + SIZE_INCR) * valsize;
566 		tmplist = realloc(*list, nsize);
567 		if (tmplist == NULL) {
568 			idmapdlog(LOG_ERR, "Out of memory");
569 			return (IDMAP_ERR_MEMORY);
570 		}
571 		*list = tmplist;
572 		(void) memset(*list + (cb_data->len * valsize), 0,
573 			SIZE_INCR * valsize);
574 		cb_data->len += SIZE_INCR;
575 	}
576 	return (IDMAP_SUCCESS);
577 }
578 
579 static idmap_retcode
580 get_namerule_order(char *winname, char *windomain, char *unixname,
581 		int direction, int *w2u_order, int *u2w_order) {
582 
583 	*w2u_order = 0;
584 	*u2w_order = 0;
585 
586 	/*
587 	 * Windows to UNIX lookup order:
588 	 *  1. winname@domain (or winname) to ""
589 	 *  2. winname@domain (or winname) to unixname
590 	 *  3. winname@* to ""
591 	 *  4. winname@* to unixname
592 	 *  5. *@domain (or *) to *
593 	 *  6. *@domain (or *) to ""
594 	 *  7. *@domain (or *) to unixname
595 	 *  8. *@* to *
596 	 *  9. *@* to ""
597 	 * 10. *@* to unixname
598 	 *
599 	 * winname is a special case of winname@domain when domain is the
600 	 * default domain. Similarly * is a special case of *@domain when
601 	 * domain is the default domain.
602 	 *
603 	 * Note that "" has priority over specific names because "" inhibits
604 	 * mappings and traditionally deny rules always had higher priority.
605 	 */
606 	if (direction != IDMAP_DIRECTION_U2W) {
607 		/* bi-directional or from windows to unix */
608 		if (winname == NULL)
609 			return (IDMAP_ERR_W2U_NAMERULE);
610 		else if (unixname == NULL)
611 			return (IDMAP_ERR_W2U_NAMERULE);
612 		else if (EMPTY_NAME(winname))
613 			return (IDMAP_ERR_W2U_NAMERULE);
614 		else if (*winname == '*' && windomain && *windomain == '*') {
615 			if (*unixname == '*')
616 				*w2u_order = 8;
617 			else if (EMPTY_NAME(unixname))
618 				*w2u_order = 9;
619 			else /* unixname == name */
620 				*w2u_order = 10;
621 		} else if (*winname == '*') {
622 			if (*unixname == '*')
623 				*w2u_order = 5;
624 			else if (EMPTY_NAME(unixname))
625 				*w2u_order = 6;
626 			else /* name */
627 				*w2u_order = 7;
628 		} else if (windomain != NULL && *windomain == '*') {
629 			/* winname == name */
630 			if (*unixname == '*')
631 				return (IDMAP_ERR_W2U_NAMERULE);
632 			else if (EMPTY_NAME(unixname))
633 				*w2u_order = 3;
634 			else /* name */
635 				*w2u_order = 4;
636 		} else  {
637 			/* winname == name && windomain == null or name */
638 			if (*unixname == '*')
639 				return (IDMAP_ERR_W2U_NAMERULE);
640 			else if (EMPTY_NAME(unixname))
641 				*w2u_order = 1;
642 			else /* name */
643 				*w2u_order = 2;
644 		}
645 	}
646 
647 	/*
648 	 * 1. unixname to ""
649 	 * 2. unixname to winname@domain (or winname)
650 	 * 3. * to *@domain (or *)
651 	 * 4. * to ""
652 	 * 5. * to winname@domain (or winname)
653 	 */
654 	if (direction != IDMAP_DIRECTION_W2U) {
655 		/* bi-directional or from unix to windows */
656 		if (unixname == NULL || EMPTY_NAME(unixname))
657 			return (IDMAP_ERR_U2W_NAMERULE);
658 		else if (winname == NULL)
659 			return (IDMAP_ERR_U2W_NAMERULE);
660 		else if (windomain != NULL && *windomain == '*')
661 			return (IDMAP_ERR_U2W_NAMERULE);
662 		else if (*unixname == '*') {
663 			if (*winname == '*')
664 				*u2w_order = 3;
665 			else if (EMPTY_NAME(winname))
666 				*u2w_order = 4;
667 			else
668 				*u2w_order = 5;
669 		} else {
670 			if (*winname == '*')
671 				return (IDMAP_ERR_U2W_NAMERULE);
672 			else if (EMPTY_NAME(winname))
673 				*u2w_order = 1;
674 			else
675 				*u2w_order = 2;
676 		}
677 	}
678 	return (IDMAP_SUCCESS);
679 }
680 
681 /*
682  * Generate and execute SQL statement to add name-based mapping rule
683  */
684 idmap_retcode
685 add_namerule(sqlite *db, idmap_namerule *rule) {
686 	char		*sql = NULL;
687 	idmap_stat	retcode;
688 	char		*windomain = NULL, *winname = NULL, *dom = NULL;
689 	char		*unixname = NULL;
690 	int		w2u_order, u2w_order;
691 	char		w2ubuf[11], u2wbuf[11];
692 
693 	retcode = idmap_utf82str(&windomain, 0, &rule->windomain);
694 	if (retcode != IDMAP_SUCCESS)
695 		goto out;
696 	retcode = idmap_utf82str(&winname, 0, &rule->winname);
697 	if (retcode != IDMAP_SUCCESS)
698 		goto out;
699 	retcode = idmap_utf82str(&unixname, 0, &rule->unixname);
700 	if (retcode != IDMAP_SUCCESS)
701 		goto out;
702 
703 	retcode = get_namerule_order(winname, windomain, unixname,
704 			rule->direction, &w2u_order, &u2w_order);
705 	if (retcode != IDMAP_SUCCESS)
706 		goto out;
707 
708 	if (w2u_order)
709 		(void) snprintf(w2ubuf, sizeof (w2ubuf), "%d", w2u_order);
710 	if (u2w_order)
711 		(void) snprintf(u2wbuf, sizeof (u2wbuf), "%d", u2w_order);
712 
713 	/*
714 	 * For the triggers on namerules table to work correctly:
715 	 * 1) Use NULL instead of 0 for w2u_order and u2w_order
716 	 * 2) Use "" instead of NULL for "no domain"
717 	 */
718 
719 	if (windomain != NULL)
720 		dom = windomain;
721 	else if (lookup_wksids_name2sid(winname, NULL, NULL, NULL)
722 	    == IDMAP_SUCCESS) {
723 		/* well-known SIDs don't need domain */
724 		dom = "";
725 	}
726 
727 	RDLOCK_CONFIG();
728 	if (dom == NULL) {
729 		if (_idmapdstate.cfg->pgcfg.mapping_domain)
730 			dom = _idmapdstate.cfg->pgcfg.mapping_domain;
731 		else
732 			dom = "";
733 	}
734 	sql = sqlite_mprintf("INSERT into namerules "
735 		"(is_user, windomain, winname, is_nt4, "
736 		"unixname, w2u_order, u2w_order) "
737 		"VALUES(%d, %Q, %Q, %d, %Q, %q, %q);",
738 		rule->is_user?1:0,
739 		dom,
740 		winname, rule->is_nt4?1:0,
741 		unixname,
742 		w2u_order?w2ubuf:NULL,
743 		u2w_order?u2wbuf:NULL);
744 	UNLOCK_CONFIG();
745 
746 	if (sql == NULL) {
747 		retcode = IDMAP_ERR_INTERNAL;
748 		idmapdlog(LOG_ERR, "Out of memory");
749 		goto out;
750 	}
751 
752 	retcode = sql_exec_no_cb(db, sql);
753 
754 	if (retcode == IDMAP_ERR_OTHER)
755 		retcode = IDMAP_ERR_CFG;
756 
757 out:
758 	if (windomain != NULL)
759 		idmap_free(windomain);
760 	if (winname != NULL)
761 		idmap_free(winname);
762 	if (unixname != NULL)
763 		idmap_free(unixname);
764 	if (sql != NULL)
765 		sqlite_freemem(sql);
766 	return (retcode);
767 }
768 
769 /*
770  * Flush name-based mapping rules
771  */
772 idmap_retcode
773 flush_namerules(sqlite *db, bool_t is_user) {
774 	char		*sql = NULL;
775 	idmap_stat	retcode;
776 
777 	sql = sqlite_mprintf("DELETE FROM namerules WHERE "
778 		"is_user = %d;", is_user?1:0);
779 
780 	if (sql == NULL) {
781 		idmapdlog(LOG_ERR, "Out of memory");
782 		return (IDMAP_ERR_MEMORY);
783 	}
784 
785 	retcode = sql_exec_no_cb(db, sql);
786 
787 	sqlite_freemem(sql);
788 	return (retcode);
789 }
790 
791 /*
792  * Generate and execute SQL statement to remove a name-based mapping rule
793  */
794 idmap_retcode
795 rm_namerule(sqlite *db, idmap_namerule *rule) {
796 	char		*sql = NULL;
797 	idmap_stat	retcode;
798 	char		*s_windomain = NULL, *s_winname = NULL;
799 	char		*s_unixname = NULL;
800 	char		buf[80];
801 
802 	if (rule->direction < 0 &&
803 			rule->windomain.idmap_utf8str_len < 1 &&
804 			rule->winname.idmap_utf8str_len < 1 &&
805 			rule->unixname.idmap_utf8str_len < 1)
806 		return (IDMAP_SUCCESS);
807 
808 	if (rule->direction < 0) {
809 		buf[0] = 0;
810 	} else if (rule->direction == IDMAP_DIRECTION_BI) {
811 		(void) snprintf(buf, sizeof (buf), "AND w2u_order > 0"
812 				" AND u2w_order > 0");
813 	} else if (rule->direction == IDMAP_DIRECTION_W2U) {
814 		(void) snprintf(buf, sizeof (buf), "AND w2u_order > 0"
815 				" AND (u2w_order = 0 OR u2w_order ISNULL)");
816 	} else if (rule->direction == IDMAP_DIRECTION_U2W) {
817 		(void) snprintf(buf, sizeof (buf), "AND u2w_order > 0"
818 				" AND (w2u_order = 0 OR w2u_order ISNULL)");
819 	}
820 
821 	retcode = IDMAP_ERR_INTERNAL;
822 	if (rule->windomain.idmap_utf8str_len > 0) {
823 		if (gen_sql_expr_from_utf8str("AND", "windomain", "=",
824 				&rule->windomain,
825 				"", &s_windomain) != IDMAP_SUCCESS)
826 			goto out;
827 	}
828 
829 	if (rule->winname.idmap_utf8str_len > 0) {
830 		if (gen_sql_expr_from_utf8str("AND", "winname", "=",
831 				&rule->winname,
832 				"", &s_winname) != IDMAP_SUCCESS)
833 			goto out;
834 	}
835 
836 	if (rule->unixname.idmap_utf8str_len > 0) {
837 		if (gen_sql_expr_from_utf8str("AND", "unixname", "=",
838 				&rule->unixname,
839 				"", &s_unixname) != IDMAP_SUCCESS)
840 			goto out;
841 	}
842 
843 	sql = sqlite_mprintf("DELETE FROM namerules WHERE "
844 		"is_user = %d %s %s %s %s;",
845 		rule->is_user?1:0,
846 		s_windomain?s_windomain:"",
847 		s_winname?s_winname:"",
848 		s_unixname?s_unixname:"",
849 		buf);
850 
851 	if (sql == NULL) {
852 		retcode = IDMAP_ERR_INTERNAL;
853 		idmapdlog(LOG_ERR, "Out of memory");
854 		goto out;
855 	}
856 
857 	retcode = sql_exec_no_cb(db, sql);
858 
859 out:
860 	if (s_windomain != NULL)
861 		sqlite_freemem(s_windomain);
862 	if (s_winname != NULL)
863 		sqlite_freemem(s_winname);
864 	if (s_unixname != NULL)
865 		sqlite_freemem(s_unixname);
866 	if (sql != NULL)
867 		sqlite_freemem(sql);
868 	return (retcode);
869 }
870 
871 /*
872  * Compile the given SQL query and step just once.
873  *
874  * Input:
875  * db  - db handle
876  * sql - SQL statement
877  *
878  * Output:
879  * vm     -  virtual SQL machine
880  * ncol   - number of columns in the result
881  * values - column values
882  *
883  * Return values:
884  * IDMAP_SUCCESS
885  * IDMAP_ERR_NOTFOUND
886  * IDMAP_ERR_INTERNAL
887  */
888 
889 static idmap_retcode
890 sql_compile_n_step_once(sqlite *db, char *sql, sqlite_vm **vm, int *ncol,
891 		int reqcol, const char ***values) {
892 	char		*errmsg = NULL;
893 	int		r;
894 
895 	if ((r = sqlite_compile(db, sql, NULL, vm, &errmsg)) != SQLITE_OK) {
896 		idmapdlog(LOG_ERR,
897 			"Database error during %s (%s)",
898 			sql, CHECK_NULL(errmsg));
899 		sqlite_freemem(errmsg);
900 		return (IDMAP_ERR_INTERNAL);
901 	}
902 
903 	r = sqlite_step(*vm, ncol, values, NULL);
904 	assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
905 
906 	if (r == SQLITE_ROW) {
907 		if (ncol != NULL && *ncol < reqcol) {
908 			(void) sqlite_finalize(*vm, NULL);
909 			*vm = NULL;
910 			return (IDMAP_ERR_INTERNAL);
911 		}
912 		/* Caller will call finalize after using the results */
913 		return (IDMAP_SUCCESS);
914 	} else if (r == SQLITE_DONE) {
915 		(void) sqlite_finalize(*vm, NULL);
916 		*vm = NULL;
917 		return (IDMAP_ERR_NOTFOUND);
918 	}
919 
920 	(void) sqlite_finalize(*vm, &errmsg);
921 	*vm = NULL;
922 	idmapdlog(LOG_ERR, "Database error during %s (%s)",
923 	    sql, CHECK_NULL(errmsg));
924 	sqlite_freemem(errmsg);
925 	return (IDMAP_ERR_INTERNAL);
926 }
927 
928 /*
929  * Table for well-known SIDs.
930  *
931  * Background:
932  *
933  * These well-known principals are stored (as of Windows Server 2003) under:
934  * cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>
935  * They belong to objectClass "foreignSecurityPrincipal". They don't have
936  * "samAccountName" nor "userPrincipalName" attributes. Their names are
937  * available in "cn" and "name" attributes. Some of these principals have a
938  * second entry under CN=ForeignSecurityPrincipals,dc=<forestRootDomain> and
939  * these duplicate entries have the stringified SID in the "name" and "cn"
940  * attributes instead of the actual name.
941  *
942  * These principals remain constant across all operating systems. Using
943  * a hard-coded table here improves performance and avoids additional
944  * complexity in the AD lookup code in adutils.c
945  *
946  * Currently we don't support localization of well-known SID names,
947  * unlike Windows.
948  *
949  * Note that other well-known SIDs (i.e. S-1-5-<domain>-<w-k RID> and
950  * S-1-5-32-<w-k RID>) are not stored here because AD does have normal
951  * user/group objects for these objects and can be looked up using the
952  * existing AD lookup code.
953  */
954 static wksids_table_t wksids[] = {
955 	{"S-1-1", 0, "Everyone", 0, SENTINEL_PID, -1},
956 	{"S-1-3", 0, "Creator Owner", 1, IDMAP_WK_CREATOR_OWNER_UID, 0},
957 	{"S-1-3", 1, "Creator Group", 0, IDMAP_WK_CREATOR_GROUP_GID, 0},
958 	{"S-1-3", 2, "Creator Owner Server", 1, SENTINEL_PID, -1},
959 	{"S-1-3", 3, "Creator Group Server", 0, SENTINEL_PID, -1},
960 	{"S-1-5", 1, "Dialup", 0, SENTINEL_PID, -1},
961 	{"S-1-5", 2, "Network", 0, SENTINEL_PID, -1},
962 	{"S-1-5", 3, "Batch", 0, SENTINEL_PID, -1},
963 	{"S-1-5", 4, "Interactive", 0, SENTINEL_PID, -1},
964 	{"S-1-5", 6, "Service", 0, SENTINEL_PID, -1},
965 	{"S-1-5", 7, "Anonymous Logon", 0, GID_NOBODY, 0},
966 	{"S-1-5", 8, "Proxy", 0, SENTINEL_PID, -1},
967 	{"S-1-5", 9, "Enterprise Domain Controllers", 0, SENTINEL_PID, -1},
968 	{"S-1-5", 10, "Self", 0, SENTINEL_PID, -1},
969 	{"S-1-5", 11, "Authenticated Users", 0, SENTINEL_PID, -1},
970 	{"S-1-5", 12, "Restricted Code", 0, SENTINEL_PID, -1},
971 	{"S-1-5", 13, "Terminal Server User", 0, SENTINEL_PID, -1},
972 	{"S-1-5", 14, "Remote Interactive Logon", 0, SENTINEL_PID, -1},
973 	{"S-1-5", 15, "This Organization", 0, SENTINEL_PID, -1},
974 	{"S-1-5", 18, "Local System", 0, IDMAP_WK_LOCAL_SYSTEM_GID, 0},
975 	{"S-1-5", 19, "Local Service", 0, SENTINEL_PID, -1},
976 	{"S-1-5", 20, "Network Service", 0, SENTINEL_PID, -1},
977 	{"S-1-5", 1000, "Other Organization", 0, SENTINEL_PID, -1},
978 	{"S-1-5-64", 21, "Digest Authentication", 0, SENTINEL_PID, -1},
979 	{"S-1-5-64", 10, "NTLM Authentication", 0, SENTINEL_PID, -1},
980 	{"S-1-5-64", 14, "SChannel Authentication", 0, SENTINEL_PID, -1},
981 	{NULL, UINT32_MAX, NULL, -1, SENTINEL_PID, -1}
982 };
983 
984 static idmap_retcode
985 lookup_wksids_sid2pid(idmap_mapping *req, idmap_id_res *res) {
986 	int i;
987 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
988 		if (wksids[i].rid == req->id1.idmap_id_u.sid.rid &&
989 		    (strcasecmp(wksids[i].sidprefix,
990 		    req->id1.idmap_id_u.sid.prefix) == 0)) {
991 
992 			if (wksids[i].pid == SENTINEL_PID)
993 				/* Not mapped, break */
994 				break;
995 			else if (wksids[i].direction == IDMAP_DIRECTION_U2W)
996 				continue;
997 
998 			switch (req->id2.idtype) {
999 			case IDMAP_UID:
1000 				if (wksids[i].is_user == 0)
1001 					continue;
1002 				res->id.idmap_id_u.uid = wksids[i].pid;
1003 				res->direction = wksids[i].direction;
1004 				return (IDMAP_SUCCESS);
1005 			case IDMAP_GID:
1006 				if (wksids[i].is_user == 1)
1007 					continue;
1008 				res->id.idmap_id_u.gid = wksids[i].pid;
1009 				res->direction = wksids[i].direction;
1010 				return (IDMAP_SUCCESS);
1011 			case IDMAP_POSIXID:
1012 				res->id.idmap_id_u.uid = wksids[i].pid;
1013 				res->id.idtype = (!wksids[i].is_user)?
1014 						IDMAP_GID:IDMAP_UID;
1015 				res->direction = wksids[i].direction;
1016 				return (IDMAP_SUCCESS);
1017 			default:
1018 				return (IDMAP_ERR_NOTSUPPORTED);
1019 			}
1020 		}
1021 	}
1022 	return (IDMAP_ERR_NOTFOUND);
1023 }
1024 
1025 static idmap_retcode
1026 lookup_wksids_pid2sid(idmap_mapping *req, idmap_id_res *res, int is_user) {
1027 	int i;
1028 	if (req->id2.idtype != IDMAP_SID)
1029 		return (IDMAP_ERR_NOTSUPPORTED);
1030 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1031 		if (wksids[i].pid == req->id1.idmap_id_u.uid &&
1032 		    wksids[i].is_user == is_user &&
1033 		    wksids[i].direction != IDMAP_DIRECTION_W2U) {
1034 			res->id.idmap_id_u.sid.rid = wksids[i].rid;
1035 			res->id.idmap_id_u.sid.prefix =
1036 				strdup(wksids[i].sidprefix);
1037 			if (res->id.idmap_id_u.sid.prefix == NULL) {
1038 				idmapdlog(LOG_ERR, "Out of memory");
1039 				return (IDMAP_ERR_MEMORY);
1040 			}
1041 			res->direction = wksids[i].direction;
1042 			return (IDMAP_SUCCESS);
1043 		}
1044 	}
1045 	return (IDMAP_ERR_NOTFOUND);
1046 }
1047 
1048 static idmap_retcode
1049 lookup_wksids_sid2name(const char *sidprefix, idmap_rid_t rid, char **name,
1050 		int *type) {
1051 	int i;
1052 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1053 		if ((strcasecmp(wksids[i].sidprefix, sidprefix) == 0) &&
1054 		    wksids[i].rid == rid) {
1055 			if ((*name = strdup(wksids[i].winname)) == NULL) {
1056 				idmapdlog(LOG_ERR, "Out of memory");
1057 				return (IDMAP_ERR_MEMORY);
1058 			}
1059 			*type = (wksids[i].is_user)?
1060 			    _IDMAP_T_USER:_IDMAP_T_GROUP;
1061 			return (IDMAP_SUCCESS);
1062 		}
1063 	}
1064 	return (IDMAP_ERR_NOTFOUND);
1065 }
1066 
1067 static idmap_retcode
1068 lookup_wksids_name2sid(const char *name, char **sidprefix, idmap_rid_t *rid,
1069 		int *type) {
1070 	int i;
1071 	for (i = 0; wksids[i].sidprefix != NULL; i++) {
1072 		if (strcasecmp(wksids[i].winname, name) == 0) {
1073 			if (sidprefix != NULL && (*sidprefix =
1074 			    strdup(wksids[i].sidprefix)) == NULL) {
1075 				idmapdlog(LOG_ERR, "Out of memory");
1076 				return (IDMAP_ERR_MEMORY);
1077 			}
1078 			if (type != NULL)
1079 				*type = (wksids[i].is_user)?
1080 				    _IDMAP_T_USER:_IDMAP_T_GROUP;
1081 			if (rid != NULL)
1082 				*rid = wksids[i].rid;
1083 			return (IDMAP_SUCCESS);
1084 		}
1085 	}
1086 	return (IDMAP_ERR_NOTFOUND);
1087 }
1088 
1089 static idmap_retcode
1090 lookup_cache_sid2pid(sqlite *cache, idmap_mapping *req, idmap_id_res *res) {
1091 	char		*end;
1092 	char		*sql = NULL;
1093 	const char	**values;
1094 	sqlite_vm	*vm = NULL;
1095 	int		ncol, is_user;
1096 	uid_t		pid;
1097 	idmap_utf8str	*str;
1098 	time_t		curtime, exp;
1099 	idmap_retcode	retcode;
1100 
1101 	/* Current time */
1102 	errno = 0;
1103 	if ((curtime = time(NULL)) == (time_t)-1) {
1104 		idmapdlog(LOG_ERR,
1105 			"Failed to get current time (%s)",
1106 			strerror(errno));
1107 		retcode = IDMAP_ERR_INTERNAL;
1108 		goto out;
1109 	}
1110 
1111 	/* SQL to lookup the cache */
1112 	sql = sqlite_mprintf("SELECT pid, is_user, expiration, unixname, u2w "
1113 			"FROM idmap_cache WHERE "
1114 			"sidprefix = %Q AND rid = %u AND w2u = 1 AND "
1115 			"(pid >= 2147483648 OR "
1116 			"(expiration = 0 OR expiration ISNULL OR "
1117 			"expiration > %d));",
1118 			req->id1.idmap_id_u.sid.prefix,
1119 			req->id1.idmap_id_u.sid.rid,
1120 			curtime);
1121 	if (sql == NULL) {
1122 		idmapdlog(LOG_ERR, "Out of memory");
1123 		retcode = IDMAP_ERR_MEMORY;
1124 		goto out;
1125 	}
1126 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 5, &values);
1127 	sqlite_freemem(sql);
1128 
1129 	if (retcode == IDMAP_ERR_NOTFOUND) {
1130 		goto out;
1131 	} else if (retcode == IDMAP_SUCCESS) {
1132 		/* sanity checks */
1133 		if (values[0] == NULL || values[1] == NULL) {
1134 			retcode = IDMAP_ERR_CACHE;
1135 			goto out;
1136 		}
1137 
1138 		pid = strtoul(values[0], &end, 10);
1139 		is_user = strncmp(values[1], "0", 2)?1:0;
1140 
1141 		/*
1142 		 * We may have an expired ephemeral mapping. Consider
1143 		 * the expired entry as valid if we are not going to
1144 		 * perform name-based mapping. But do not renew the
1145 		 * expiration.
1146 		 * If we will be doing name-based mapping then store the
1147 		 * ephemeral pid in the result so that we can use it
1148 		 * if we end up doing dynamic mapping again.
1149 		 */
1150 		if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) &&
1151 				!AVOID_NAMESERVICE(req)) {
1152 			if (IS_EPHEMERAL(pid) && values[2] != NULL) {
1153 				exp = strtoll(values[2], &end, 10);
1154 				if (exp && exp <= curtime) {
1155 					/* Store the ephemeral pid */
1156 					res->id.idmap_id_u.uid = pid;
1157 					res->id.idtype = is_user?
1158 						IDMAP_UID:IDMAP_GID;
1159 					res->direction = IDMAP_DIRECTION_BI;
1160 					req->direction |= is_user?
1161 						_IDMAP_F_EXP_EPH_UID:
1162 						_IDMAP_F_EXP_EPH_GID;
1163 					retcode = IDMAP_ERR_NOTFOUND;
1164 					goto out;
1165 				}
1166 			}
1167 		}
1168 
1169 		switch (req->id2.idtype) {
1170 		case IDMAP_UID:
1171 			if (!is_user)
1172 				retcode = IDMAP_ERR_NOTUSER;
1173 			else
1174 				res->id.idmap_id_u.uid = pid;
1175 			break;
1176 		case IDMAP_GID:
1177 			if (is_user)
1178 				retcode = IDMAP_ERR_NOTGROUP;
1179 			else
1180 				res->id.idmap_id_u.gid = pid;
1181 			break;
1182 		case IDMAP_POSIXID:
1183 			res->id.idmap_id_u.uid = pid;
1184 			res->id.idtype = (is_user)?IDMAP_UID:IDMAP_GID;
1185 			break;
1186 		default:
1187 			retcode = IDMAP_ERR_NOTSUPPORTED;
1188 			break;
1189 		}
1190 	}
1191 
1192 out:
1193 	if (retcode == IDMAP_SUCCESS) {
1194 		if (values[4] != NULL)
1195 			res->direction =
1196 			    (strtol(values[4], &end, 10) == 0)?
1197 			    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
1198 		else
1199 			res->direction = IDMAP_DIRECTION_W2U;
1200 
1201 		if (values[3] != NULL) {
1202 			str = &req->id2name;
1203 			retcode = idmap_str2utf8(&str, values[3], 0);
1204 			if (retcode != IDMAP_SUCCESS) {
1205 				idmapdlog(LOG_ERR, "Out of memory");
1206 				retcode = IDMAP_ERR_MEMORY;
1207 			}
1208 		}
1209 	}
1210 	if (vm != NULL)
1211 		(void) sqlite_finalize(vm, NULL);
1212 	return (retcode);
1213 }
1214 
1215 static idmap_retcode
1216 lookup_cache_sid2name(sqlite *cache, const char *sidprefix, idmap_rid_t rid,
1217 		char **name, char **domain, int *type) {
1218 	char		*end;
1219 	char		*sql = NULL;
1220 	const char	**values;
1221 	sqlite_vm	*vm = NULL;
1222 	int		ncol;
1223 	time_t		curtime;
1224 	idmap_retcode	retcode = IDMAP_SUCCESS;
1225 
1226 	/* Get current time */
1227 	errno = 0;
1228 	if ((curtime = time(NULL)) == (time_t)-1) {
1229 		idmapdlog(LOG_ERR,
1230 			"Failed to get current time (%s)",
1231 			strerror(errno));
1232 		retcode = IDMAP_ERR_INTERNAL;
1233 		goto out;
1234 	}
1235 
1236 	/* SQL to lookup the cache */
1237 	sql = sqlite_mprintf("SELECT name, domain, type FROM name_cache WHERE "
1238 			"sidprefix = %Q AND rid = %u AND "
1239 			"(expiration = 0 OR expiration ISNULL OR "
1240 			"expiration > %d);",
1241 			sidprefix, rid, curtime);
1242 	if (sql == NULL) {
1243 		idmapdlog(LOG_ERR, "Out of memory");
1244 		retcode = IDMAP_ERR_MEMORY;
1245 		goto out;
1246 	}
1247 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values);
1248 	sqlite_freemem(sql);
1249 
1250 	if (retcode == IDMAP_SUCCESS) {
1251 		if (type != NULL) {
1252 			if (values[2] == NULL) {
1253 				retcode = IDMAP_ERR_CACHE;
1254 				goto out;
1255 			}
1256 			*type = strtol(values[2], &end, 10);
1257 		}
1258 
1259 		if (name != NULL && values[0] != NULL) {
1260 			if ((*name = strdup(values[0])) == NULL) {
1261 				idmapdlog(LOG_ERR, "Out of memory");
1262 				retcode = IDMAP_ERR_MEMORY;
1263 				goto out;
1264 			}
1265 		}
1266 
1267 		if (domain != NULL && values[1] != NULL) {
1268 			if ((*domain = strdup(values[1])) == NULL) {
1269 				if (name != NULL && *name) {
1270 					free(*name);
1271 					*name = NULL;
1272 				}
1273 				idmapdlog(LOG_ERR, "Out of memory");
1274 				retcode = IDMAP_ERR_MEMORY;
1275 				goto out;
1276 			}
1277 		}
1278 	}
1279 
1280 out:
1281 	if (vm != NULL)
1282 		(void) sqlite_finalize(vm, NULL);
1283 	return (retcode);
1284 }
1285 
1286 static idmap_retcode
1287 verify_type(idmap_id_type idtype, int type, idmap_id_res *res) {
1288 	switch (idtype) {
1289 	case IDMAP_UID:
1290 		if (type != _IDMAP_T_USER)
1291 			return (IDMAP_ERR_NOTUSER);
1292 		res->id.idtype = IDMAP_UID;
1293 		break;
1294 	case IDMAP_GID:
1295 		if (type != _IDMAP_T_GROUP)
1296 			return (IDMAP_ERR_NOTGROUP);
1297 		res->id.idtype = IDMAP_GID;
1298 		break;
1299 	case IDMAP_POSIXID:
1300 		if (type == _IDMAP_T_USER)
1301 			res->id.idtype = IDMAP_UID;
1302 		else if (type == _IDMAP_T_GROUP)
1303 			res->id.idtype = IDMAP_GID;
1304 		else
1305 			return (IDMAP_ERR_SID);
1306 		break;
1307 	default:
1308 		return (IDMAP_ERR_NOTSUPPORTED);
1309 	}
1310 	return (IDMAP_SUCCESS);
1311 }
1312 
1313 /*
1314  * Lookup sid to name locally
1315  */
1316 static idmap_retcode
1317 lookup_local_sid2name(sqlite *cache, idmap_mapping *req, idmap_id_res *res) {
1318 	int		type = -1;
1319 	idmap_retcode	retcode;
1320 	char		*sidprefix;
1321 	idmap_rid_t	rid;
1322 	char		*name = NULL, *domain = NULL;
1323 	idmap_utf8str	*str;
1324 
1325 	sidprefix = req->id1.idmap_id_u.sid.prefix;
1326 	rid = req->id1.idmap_id_u.sid.rid;
1327 
1328 	/* Lookup sids to name in well-known sids table */
1329 	retcode = lookup_wksids_sid2name(sidprefix, rid, &name, &type);
1330 	if (retcode != IDMAP_ERR_NOTFOUND)
1331 		goto out;
1332 
1333 	/* Lookup sid to name in cache */
1334 	retcode = lookup_cache_sid2name(cache, sidprefix, rid, &name,
1335 		&domain, &type);
1336 	if (retcode != IDMAP_SUCCESS)
1337 		goto out;
1338 
1339 out:
1340 	if (retcode == IDMAP_SUCCESS) {
1341 		/* Verify that the sid type matches the request */
1342 		retcode = verify_type(req->id2.idtype, type, res);
1343 
1344 		/* update state in 'req' */
1345 		if (name != NULL) {
1346 			str = &req->id1name;
1347 			(void) idmap_str2utf8(&str, name, 1);
1348 		}
1349 		if (domain != NULL) {
1350 			str = &req->id1domain;
1351 			(void) idmap_str2utf8(&str, domain, 1);
1352 		}
1353 	} else {
1354 		if (name != NULL)
1355 			free(name);
1356 		if (domain != NULL)
1357 			free(domain);
1358 	}
1359 	return (retcode);
1360 }
1361 
1362 idmap_retcode
1363 lookup_win_batch_sid2name(lookup_state_t *state, idmap_mapping_batch *batch,
1364 		idmap_ids_res *result) {
1365 	idmap_retcode	retcode;
1366 	int		ret, i;
1367 	int		retries = 0;
1368 	idmap_mapping	*req;
1369 	idmap_id_res	*res;
1370 
1371 	if (state->ad_nqueries == 0)
1372 		return (IDMAP_SUCCESS);
1373 
1374 retry:
1375 	ret = idmap_lookup_batch_start(_idmapdstate.ad, state->ad_nqueries,
1376 		&state->ad_lookup);
1377 	if (ret != 0) {
1378 		idmapdlog(LOG_ERR,
1379 		"Failed to create sid2name batch for AD lookup");
1380 		return (IDMAP_ERR_INTERNAL);
1381 	}
1382 
1383 	for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
1384 		req = &batch->idmap_mapping_batch_val[i];
1385 		res = &result->ids.ids_val[i];
1386 
1387 		if (req->id1.idtype == IDMAP_SID &&
1388 				req->direction & _IDMAP_F_S2N_AD) {
1389 			if (retries == 0)
1390 				res->retcode = IDMAP_ERR_RETRIABLE_NET_ERR;
1391 			else if (res->retcode != IDMAP_ERR_RETRIABLE_NET_ERR)
1392 				continue;
1393 			retcode = idmap_sid2name_batch_add1(
1394 					state->ad_lookup,
1395 					req->id1.idmap_id_u.sid.prefix,
1396 					&req->id1.idmap_id_u.sid.rid,
1397 					&req->id1name.idmap_utf8str_val,
1398 					&req->id1domain.idmap_utf8str_val,
1399 					(int *)&res->id.idtype,
1400 					&res->retcode);
1401 
1402 			if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
1403 				break;
1404 			if (retcode != IDMAP_SUCCESS)
1405 				goto out;
1406 		}
1407 	}
1408 
1409 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
1410 		idmap_lookup_release_batch(&state->ad_lookup);
1411 	else
1412 		retcode = idmap_lookup_batch_end(&state->ad_lookup, NULL);
1413 
1414 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
1415 		goto retry;
1416 
1417 	return (retcode);
1418 
1419 out:
1420 	idmapdlog(LOG_NOTICE, "Windows SID to user/group name lookup failed");
1421 	idmap_lookup_release_batch(&state->ad_lookup);
1422 	return (retcode);
1423 }
1424 
1425 idmap_retcode
1426 sid2pid_first_pass(lookup_state_t *state, sqlite *cache, idmap_mapping *req,
1427 		idmap_id_res *res) {
1428 	idmap_retcode	retcode;
1429 
1430 	/*
1431 	 * The req->direction field is used to maintain state of the
1432 	 * sid2pid request.
1433 	 */
1434 	req->direction = _IDMAP_F_DONE;
1435 
1436 	if (req->id1.idmap_id_u.sid.prefix == NULL) {
1437 		retcode = IDMAP_ERR_SID;
1438 		goto out;
1439 	}
1440 	res->id.idtype = req->id2.idtype;
1441 	res->id.idmap_id_u.uid = UID_NOBODY;
1442 
1443 	/* Lookup well-known sid to pid mapping */
1444 	retcode = lookup_wksids_sid2pid(req, res);
1445 	if (retcode != IDMAP_ERR_NOTFOUND)
1446 		goto out;
1447 
1448 	/* Lookup sid to pid in cache */
1449 	retcode = lookup_cache_sid2pid(cache, req, res);
1450 	if (retcode != IDMAP_ERR_NOTFOUND)
1451 		goto out;
1452 
1453 	if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) {
1454 		res->id.idmap_id_u.uid = SENTINEL_PID;
1455 		goto out;
1456 	}
1457 
1458 	/*
1459 	 * Failed to find non-expired entry in cache. Tell the caller
1460 	 * that we are not done yet.
1461 	 */
1462 	state->sid2pid_done = FALSE;
1463 
1464 	/*
1465 	 * Our next step is name-based mapping. To lookup name-based
1466 	 * mapping rules, we need the windows name and domain-name
1467 	 * associated with the SID.
1468 	 */
1469 
1470 	/*
1471 	 * Check if we already have the name (i.e name2pid lookups)
1472 	 */
1473 	if (req->id1name.idmap_utf8str_val != NULL &&
1474 	    req->id1domain.idmap_utf8str_val != NULL) {
1475 		retcode = IDMAP_SUCCESS;
1476 		req->direction |= _IDMAP_F_S2N_CACHE;
1477 		goto out;
1478 	}
1479 
1480 	/* Lookup sid to winname@domain locally first */
1481 	retcode = lookup_local_sid2name(cache, req, res);
1482 	if (retcode == IDMAP_SUCCESS) {
1483 		req->direction |= _IDMAP_F_S2N_CACHE;
1484 	} else if (retcode == IDMAP_ERR_NOTFOUND) {
1485 		/* Batch sid to name AD lookup request */
1486 		retcode = IDMAP_SUCCESS;
1487 		req->direction |= _IDMAP_F_S2N_AD;
1488 		state->ad_nqueries++;
1489 		goto out;
1490 	}
1491 
1492 
1493 out:
1494 	res->retcode = idmap_stat4prot(retcode);
1495 	return (retcode);
1496 }
1497 
1498 /*
1499  * Generate SID using the following convention
1500  * 	<machine-sid-prefix>-<1000 + uid>
1501  * 	<machine-sid-prefix>-<2^31 + gid>
1502  */
1503 static idmap_retcode
1504 generate_localsid(idmap_mapping *req, idmap_id_res *res, int is_user) {
1505 
1506 	if (_idmapdstate.cfg->pgcfg.machine_sid != NULL) {
1507 		/* Skip 1000 UIDs */
1508 		if (is_user && req->id1.idmap_id_u.uid >
1509 				(INT32_MAX - LOCALRID_MIN))
1510 			return (IDMAP_ERR_NOMAPPING);
1511 
1512 		RDLOCK_CONFIG();
1513 		res->id.idmap_id_u.sid.prefix =
1514 			strdup(_idmapdstate.cfg->pgcfg.machine_sid);
1515 		if (res->id.idmap_id_u.sid.prefix == NULL) {
1516 			UNLOCK_CONFIG();
1517 			idmapdlog(LOG_ERR, "Out of memory");
1518 			return (IDMAP_ERR_MEMORY);
1519 		}
1520 		UNLOCK_CONFIG();
1521 		res->id.idmap_id_u.sid.rid =
1522 			(is_user)?req->id1.idmap_id_u.uid + LOCALRID_MIN:
1523 			req->id1.idmap_id_u.gid + INT32_MAX + 1;
1524 		res->direction = IDMAP_DIRECTION_BI;
1525 
1526 		/*
1527 		 * Don't update name_cache because local sids don't have
1528 		 * valid windows names.
1529 		 * We mark the entry as being found in the namecache so that
1530 		 * the cache update routine doesn't update namecache.
1531 		 */
1532 		req->direction = _IDMAP_F_S2N_CACHE;
1533 		return (IDMAP_SUCCESS);
1534 	}
1535 
1536 	return (IDMAP_ERR_NOMAPPING);
1537 }
1538 
1539 static idmap_retcode
1540 lookup_localsid2pid(idmap_mapping *req, idmap_id_res *res) {
1541 	char		*sidprefix;
1542 	uint32_t	rid;
1543 	int		s;
1544 
1545 	/*
1546 	 * If the sidprefix == localsid then UID = last RID - 1000 or
1547 	 * GID = last RID - 2^31.
1548 	 */
1549 	sidprefix = req->id1.idmap_id_u.sid.prefix;
1550 	rid = req->id1.idmap_id_u.sid.rid;
1551 
1552 	RDLOCK_CONFIG();
1553 	s = (_idmapdstate.cfg->pgcfg.machine_sid)?
1554 		strcasecmp(sidprefix,
1555 		_idmapdstate.cfg->pgcfg.machine_sid):1;
1556 	UNLOCK_CONFIG();
1557 
1558 	if (s == 0) {
1559 		switch (req->id2.idtype) {
1560 		case IDMAP_UID:
1561 			if (rid > INT32_MAX) {
1562 				return (IDMAP_ERR_NOTUSER);
1563 			} else if (rid < LOCALRID_MIN) {
1564 				return (IDMAP_ERR_NOTFOUND);
1565 			}
1566 			res->id.idmap_id_u.uid = rid - LOCALRID_MIN;
1567 			res->id.idtype = IDMAP_UID;
1568 			break;
1569 		case IDMAP_GID:
1570 			if (rid <= INT32_MAX) {
1571 				return (IDMAP_ERR_NOTGROUP);
1572 			}
1573 			res->id.idmap_id_u.gid = rid - INT32_MAX - 1;
1574 			res->id.idtype = IDMAP_GID;
1575 			break;
1576 		case IDMAP_POSIXID:
1577 			if (rid > INT32_MAX) {
1578 				res->id.idmap_id_u.gid =
1579 					rid - INT32_MAX - 1;
1580 				res->id.idtype = IDMAP_GID;
1581 			} else if (rid < LOCALRID_MIN) {
1582 				return (IDMAP_ERR_NOTFOUND);
1583 			} else {
1584 				res->id.idmap_id_u.uid = rid - LOCALRID_MIN;
1585 				res->id.idtype = IDMAP_UID;
1586 			}
1587 			break;
1588 		default:
1589 			return (IDMAP_ERR_NOTSUPPORTED);
1590 		}
1591 		return (IDMAP_SUCCESS);
1592 	}
1593 
1594 	return (IDMAP_ERR_NOTFOUND);
1595 }
1596 
1597 static idmap_retcode
1598 ns_lookup_byname(int is_user, const char *name, idmap_id_res *res) {
1599 	struct passwd	pwd;
1600 	struct group	grp;
1601 	char		buf[1024];
1602 	int		errnum;
1603 	const char	*me = "ns_lookup_byname";
1604 
1605 	if (is_user) {
1606 		if (getpwnam_r(name, &pwd, buf, sizeof (buf)) == NULL) {
1607 			errnum = errno;
1608 			idmapdlog(LOG_WARNING,
1609 			"%s: getpwnam_r(%s) failed (%s).",
1610 				me, name,
1611 				errnum?strerror(errnum):"not found");
1612 			if (errnum == 0)
1613 				return (IDMAP_ERR_NOTFOUND);
1614 			else
1615 				return (IDMAP_ERR_INTERNAL);
1616 		}
1617 		res->id.idmap_id_u.uid = pwd.pw_uid;
1618 		res->id.idtype = IDMAP_UID;
1619 	} else {
1620 		if (getgrnam_r(name, &grp, buf, sizeof (buf)) == NULL) {
1621 			errnum = errno;
1622 			idmapdlog(LOG_WARNING,
1623 			"%s: getgrnam_r(%s) failed (%s).",
1624 				me, name,
1625 				errnum?strerror(errnum):"not found");
1626 			if (errnum == 0)
1627 				return (IDMAP_ERR_NOTFOUND);
1628 			else
1629 				return (IDMAP_ERR_INTERNAL);
1630 		}
1631 		res->id.idmap_id_u.gid = grp.gr_gid;
1632 		res->id.idtype = IDMAP_GID;
1633 	}
1634 	return (IDMAP_SUCCESS);
1635 }
1636 
1637 /*
1638  * Name-based mapping
1639  *
1640  * Case 1: If no rule matches do ephemeral
1641  *
1642  * Case 2: If rule matches and unixname is "" then return no mapping.
1643  *
1644  * Case 3: If rule matches and unixname is specified then lookup name
1645  *  service using the unixname. If unixname not found then return no mapping.
1646  *
1647  * Case 4: If rule matches and unixname is * then lookup name service
1648  *  using winname as the unixname. If unixname not found then process
1649  *  other rules using the lookup order. If no other rule matches then do
1650  *  ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4.
1651  *  This allows us to specify a fallback unixname per _domain_ or no mapping
1652  *  instead of the default behaviour of doing ephemeral mapping.
1653  *
1654  * Example 1:
1655  * *@sfbay == *
1656  * If looking up windows users foo@sfbay and foo does not exists in
1657  * the name service then foo@sfbay will be mapped to an ephemeral id.
1658  *
1659  * Example 2:
1660  * *@sfbay == *
1661  * *@sfbay => guest
1662  * If looking up windows users foo@sfbay and foo does not exists in
1663  * the name service then foo@sfbay will be mapped to guest.
1664  *
1665  * Example 3:
1666  * *@sfbay == *
1667  * *@sfbay => ""
1668  * If looking up windows users foo@sfbay and foo does not exists in
1669  * the name service then we will return no mapping for foo@sfbay.
1670  *
1671  */
1672 static idmap_retcode
1673 name_based_mapping_sid2pid(sqlite *db, idmap_mapping *req, idmap_id_res *res) {
1674 	const char	*unixname, *winname, *windomain;
1675 	char		*sql = NULL, *errmsg = NULL;
1676 	idmap_retcode	retcode;
1677 	char		*end;
1678 	const char	**values;
1679 	sqlite_vm	*vm = NULL;
1680 	idmap_utf8str	*str;
1681 	int		ncol, r, i, is_user;
1682 	const char	*me = "name_based_mapping_sid2pid";
1683 
1684 	winname = req->id1name.idmap_utf8str_val;
1685 	windomain = req->id1domain.idmap_utf8str_val;
1686 	is_user = (res->id.idtype == IDMAP_UID)?1:0;
1687 
1688 	i = 0;
1689 	if (windomain == NULL) {
1690 		windomain = "";
1691 	} else {
1692 		RDLOCK_CONFIG();
1693 		if (_idmapdstate.cfg->pgcfg.mapping_domain != NULL) {
1694 			if (strcasecmp(_idmapdstate.cfg->pgcfg.mapping_domain,
1695 			    windomain) == 0)
1696 				i = 1;
1697 		}
1698 		UNLOCK_CONFIG();
1699 	}
1700 
1701 	sql = sqlite_mprintf(
1702 		"SELECT unixname, u2w_order FROM namerules WHERE "
1703 		"w2u_order > 0 AND is_user = %d AND "
1704 		"(winname = %Q OR winname = '*') AND "
1705 		"(windomain = %Q OR windomain = '*' %s) "
1706 		"ORDER BY w2u_order ASC;",
1707 		is_user, winname,
1708 		windomain,
1709 		i?"OR windomain ISNULL OR windomain = ''":"");
1710 	if (sql == NULL) {
1711 		idmapdlog(LOG_ERR, "Out of memory");
1712 		retcode = IDMAP_ERR_MEMORY;
1713 		goto out;
1714 	}
1715 
1716 	if (sqlite_compile(db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
1717 		retcode = IDMAP_ERR_INTERNAL;
1718 		idmapdlog(LOG_ERR,
1719 			"%s: database error (%s)",
1720 			me, CHECK_NULL(errmsg));
1721 		sqlite_freemem(errmsg);
1722 		goto out;
1723 	}
1724 
1725 	for (; ; ) {
1726 		r = sqlite_step(vm, &ncol, &values, NULL);
1727 		assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
1728 
1729 		if (r == SQLITE_ROW) {
1730 			if (ncol < 2) {
1731 				retcode = IDMAP_ERR_INTERNAL;
1732 				goto out;
1733 			}
1734 			if (values[0] == NULL) {
1735 				retcode = IDMAP_ERR_INTERNAL;
1736 				goto out;
1737 			}
1738 
1739 			if (EMPTY_NAME(values[0])) {
1740 				retcode = IDMAP_ERR_NOMAPPING;
1741 				goto out;
1742 			}
1743 			unixname = (values[0][0] == '*')?winname:values[0];
1744 			retcode = ns_lookup_byname(is_user, unixname, res);
1745 			if (retcode == IDMAP_ERR_NOTFOUND) {
1746 				if (unixname == winname)
1747 					/* Case 4 */
1748 					continue;
1749 				else
1750 					/* Case 3 */
1751 					retcode = IDMAP_ERR_NOMAPPING;
1752 			}
1753 			goto out;
1754 		} else if (r == SQLITE_DONE) {
1755 			retcode = IDMAP_ERR_NOTFOUND;
1756 			goto out;
1757 		} else {
1758 			(void) sqlite_finalize(vm, &errmsg);
1759 			vm = NULL;
1760 			idmapdlog(LOG_ERR,
1761 				"%s: database error (%s)",
1762 				me, CHECK_NULL(errmsg));
1763 			sqlite_freemem(errmsg);
1764 			retcode = IDMAP_ERR_INTERNAL;
1765 			goto out;
1766 		}
1767 	}
1768 
1769 out:
1770 	if (sql != NULL)
1771 		sqlite_freemem(sql);
1772 	if (retcode == IDMAP_SUCCESS) {
1773 		if (values[1] != NULL)
1774 			res->direction =
1775 			    (strtol(values[1], &end, 10) == 0)?
1776 			    IDMAP_DIRECTION_W2U:IDMAP_DIRECTION_BI;
1777 		else
1778 			res->direction = IDMAP_DIRECTION_W2U;
1779 		str = &req->id2name;
1780 		retcode = idmap_str2utf8(&str, unixname, 0);
1781 	}
1782 	if (vm != NULL)
1783 		(void) sqlite_finalize(vm, NULL);
1784 	return (retcode);
1785 }
1786 
1787 static
1788 int
1789 get_next_eph_uid(uid_t *next_uid)
1790 {
1791 	uid_t uid;
1792 	gid_t gid;
1793 	int err;
1794 
1795 	*next_uid = (uid_t)-1;
1796 	uid = _idmapdstate.next_uid++;
1797 	if (uid >= _idmapdstate.limit_uid) {
1798 		if ((err = allocids(0, 8192, &uid, 0, &gid)) != 0)
1799 			return (err);
1800 
1801 		_idmapdstate.limit_uid = uid + 8192;
1802 		_idmapdstate.next_uid = uid;
1803 	}
1804 	*next_uid = uid;
1805 
1806 	return (0);
1807 }
1808 
1809 static
1810 int
1811 get_next_eph_gid(gid_t *next_gid)
1812 {
1813 	uid_t uid;
1814 	gid_t gid;
1815 	int err;
1816 
1817 	*next_gid = (uid_t)-1;
1818 	gid = _idmapdstate.next_gid++;
1819 	if (gid >= _idmapdstate.limit_gid) {
1820 		if ((err = allocids(0, 0, &uid, 8192, &gid)) != 0)
1821 			return (err);
1822 
1823 		_idmapdstate.limit_gid = gid + 8192;
1824 		_idmapdstate.next_gid = gid;
1825 	}
1826 	*next_gid = gid;
1827 
1828 	return (0);
1829 }
1830 
1831 static
1832 int
1833 gethash(const char *str, uint32_t num, uint_t htsize) {
1834 	uint_t  hval, i, len;
1835 
1836 	if (str == NULL)
1837 		return (0);
1838 	for (len = strlen(str), hval = 0, i = 0; i < len; i++) {
1839 		hval += str[i];
1840 		hval += (hval << 10);
1841 		hval ^= (hval >> 6);
1842 	}
1843 	for (str = (const char *)&num, i = 0; i < sizeof (num); i++) {
1844 		hval += str[i];
1845 		hval += (hval << 10);
1846 		hval ^= (hval >> 6);
1847 	}
1848 	hval += (hval << 3);
1849 	hval ^= (hval >> 11);
1850 	hval += (hval << 15);
1851 	return (hval % htsize);
1852 }
1853 
1854 static
1855 int
1856 get_from_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid,
1857 		uid_t *pid) {
1858 	uint_t		next, key;
1859 	uint_t		htsize = state->sid_history_size;
1860 	idmap_sid	*sid;
1861 
1862 	next = gethash(prefix, rid, htsize);
1863 	while (next != htsize) {
1864 		key = state->sid_history[next].key;
1865 		if (key == htsize)
1866 			return (0);
1867 		sid = &state->batch->idmap_mapping_batch_val[key].id1.
1868 		    idmap_id_u.sid;
1869 		if (sid->rid == rid && strcmp(sid->prefix, prefix) == 0) {
1870 			*pid = state->result->ids.ids_val[key].id.
1871 			    idmap_id_u.uid;
1872 			return (1);
1873 		}
1874 		next = state->sid_history[next].next;
1875 	}
1876 	return (0);
1877 }
1878 
1879 static
1880 void
1881 add_to_sid_history(lookup_state_t *state, const char *prefix, uint32_t rid) {
1882 	uint_t		hash, next;
1883 	uint_t		htsize = state->sid_history_size;
1884 
1885 	hash = next = gethash(prefix, rid, htsize);
1886 	while (state->sid_history[next].key != htsize) {
1887 		next++;
1888 		next %= htsize;
1889 	}
1890 	state->sid_history[next].key = state->curpos;
1891 	if (hash == next)
1892 		return;
1893 	state->sid_history[next].next = state->sid_history[hash].next;
1894 	state->sid_history[hash].next = next;
1895 }
1896 
1897 /* ARGSUSED */
1898 static
1899 idmap_retcode
1900 dynamic_ephemeral_mapping(lookup_state_t *state, sqlite *cache,
1901 		idmap_mapping *req, idmap_id_res *res) {
1902 
1903 	uid_t		next_pid;
1904 
1905 	res->direction = IDMAP_DIRECTION_BI;
1906 
1907 	if (IS_EPHEMERAL(res->id.idmap_id_u.uid))
1908 		return (IDMAP_SUCCESS);
1909 
1910 	if (state->sid_history != NULL &&
1911 	    get_from_sid_history(state, req->id1.idmap_id_u.sid.prefix,
1912 	    req->id1.idmap_id_u.sid.rid, &next_pid)) {
1913 		res->id.idmap_id_u.uid = next_pid;
1914 		return (IDMAP_SUCCESS);
1915 	}
1916 
1917 	if (res->id.idtype == IDMAP_UID) {
1918 		if (get_next_eph_uid(&next_pid) != 0)
1919 			return (IDMAP_ERR_INTERNAL);
1920 		res->id.idmap_id_u.uid = next_pid;
1921 	} else {
1922 		if (get_next_eph_gid(&next_pid) != 0)
1923 			return (IDMAP_ERR_INTERNAL);
1924 		res->id.idmap_id_u.gid = next_pid;
1925 	}
1926 
1927 	if (state->sid_history != NULL)
1928 		add_to_sid_history(state, req->id1.idmap_id_u.sid.prefix,
1929 		    req->id1.idmap_id_u.sid.rid);
1930 
1931 	return (IDMAP_SUCCESS);
1932 }
1933 
1934 idmap_retcode
1935 sid2pid_second_pass(lookup_state_t *state, sqlite *cache, sqlite *db,
1936 		idmap_mapping *req, idmap_id_res *res) {
1937 	idmap_retcode	retcode;
1938 
1939 	/*
1940 	 * The req->direction field is used to maintain state of the
1941 	 * sid2pid request.
1942 	 */
1943 
1944 	/* Check if second pass is needed */
1945 	if (req->direction == _IDMAP_F_DONE)
1946 		return (res->retcode);
1947 
1948 	/* Get status from previous pass */
1949 	retcode = (res->retcode == IDMAP_NEXT)?IDMAP_SUCCESS:res->retcode;
1950 
1951 	if (retcode != IDMAP_SUCCESS) {
1952 		/* Reset return type */
1953 		res->id.idtype = req->id2.idtype;
1954 		res->id.idmap_id_u.uid = UID_NOBODY;
1955 
1956 		/* Check if this is a localsid */
1957 		if (retcode == IDMAP_ERR_NOTFOUND &&
1958 		    _idmapdstate.cfg->pgcfg.machine_sid) {
1959 			retcode = lookup_localsid2pid(req, res);
1960 			if (retcode == IDMAP_SUCCESS) {
1961 				state->sid2pid_done = FALSE;
1962 				req->direction = _IDMAP_F_S2N_CACHE;
1963 			}
1964 		}
1965 		goto out;
1966 	}
1967 
1968 	/*
1969 	 * Verify that the sid type matches the request if the
1970 	 * SID was validated by an AD lookup.
1971 	 */
1972 	if (req->direction & _IDMAP_F_S2N_AD) {
1973 		retcode = verify_type(req->id2.idtype,
1974 			(int)res->id.idtype, res);
1975 		if (retcode != IDMAP_SUCCESS) {
1976 			res->id.idtype = req->id2.idtype;
1977 			res->id.idmap_id_u.uid = UID_NOBODY;
1978 			goto out;
1979 		}
1980 	}
1981 
1982 	/* Name-based mapping */
1983 	retcode = name_based_mapping_sid2pid(db, req, res);
1984 	if (retcode == IDMAP_ERR_NOTFOUND)
1985 		/* If not found, do ephemeral mapping */
1986 		goto ephemeral;
1987 	else if (retcode != IDMAP_SUCCESS)
1988 		goto out;
1989 
1990 	state->sid2pid_done = FALSE;
1991 	goto out;
1992 
1993 
1994 ephemeral:
1995 	retcode = dynamic_ephemeral_mapping(state, cache, req, res);
1996 	if (retcode == IDMAP_SUCCESS)
1997 		state->sid2pid_done = FALSE;
1998 
1999 out:
2000 	res->retcode = idmap_stat4prot(retcode);
2001 	return (retcode);
2002 }
2003 
2004 idmap_retcode
2005 update_cache_pid2sid(lookup_state_t *state, sqlite *cache,
2006 		idmap_mapping *req, idmap_id_res *res) {
2007 	char		*sql = NULL;
2008 	idmap_retcode	retcode;
2009 
2010 	/* Check if we need to cache anything */
2011 	if (req->direction == _IDMAP_F_DONE)
2012 		return (IDMAP_SUCCESS);
2013 
2014 	/* We don't cache negative entries */
2015 	if (res->retcode != IDMAP_SUCCESS)
2016 		return (IDMAP_SUCCESS);
2017 
2018 	/*
2019 	 * Using NULL for u2w instead of 0 so that our trigger allows
2020 	 * the same pid to be the destination in multiple entries
2021 	 */
2022 	sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
2023 		"(sidprefix, rid, windomain, winname, pid, unixname, "
2024 		"is_user, expiration, w2u, u2w) "
2025 		"VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, "
2026 		"strftime('%%s','now') + 600, %q, 1); ",
2027 		res->id.idmap_id_u.sid.prefix,
2028 		res->id.idmap_id_u.sid.rid,
2029 		req->id2domain.idmap_utf8str_val,
2030 		req->id2name.idmap_utf8str_val,
2031 		req->id1.idmap_id_u.uid,
2032 		req->id1name.idmap_utf8str_val,
2033 		(req->id1.idtype == IDMAP_UID)?1:0,
2034 		(res->direction == 0)?"1":NULL);
2035 
2036 	if (sql == NULL) {
2037 		retcode = IDMAP_ERR_INTERNAL;
2038 		idmapdlog(LOG_ERR, "Out of memory");
2039 		goto out;
2040 	}
2041 
2042 	retcode = sql_exec_no_cb(cache, sql);
2043 	if (retcode != IDMAP_SUCCESS)
2044 		goto out;
2045 
2046 	state->pid2sid_done = FALSE;
2047 	sqlite_freemem(sql);
2048 	sql = NULL;
2049 
2050 	/* If sid2name was found in the cache, no need to update namecache */
2051 	if (req->direction & _IDMAP_F_S2N_CACHE)
2052 		goto out;
2053 
2054 	if (req->id2name.idmap_utf8str_val == NULL)
2055 		goto out;
2056 
2057 	sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
2058 		"(sidprefix, rid, name, domain, type, expiration) "
2059 		"VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
2060 		res->id.idmap_id_u.sid.prefix,
2061 		res->id.idmap_id_u.sid.rid,
2062 		req->id2name.idmap_utf8str_val,
2063 		req->id2domain.idmap_utf8str_val,
2064 		(req->id1.idtype == IDMAP_UID)?_IDMAP_T_USER:_IDMAP_T_GROUP);
2065 
2066 	if (sql == NULL) {
2067 		retcode = IDMAP_ERR_INTERNAL;
2068 		idmapdlog(LOG_ERR, "Out of memory");
2069 		goto out;
2070 	}
2071 
2072 	retcode = sql_exec_no_cb(cache, sql);
2073 
2074 out:
2075 	if (sql != NULL)
2076 		sqlite_freemem(sql);
2077 	return (retcode);
2078 }
2079 
2080 idmap_retcode
2081 update_cache_sid2pid(lookup_state_t *state, sqlite *cache,
2082 		idmap_mapping *req, idmap_id_res *res) {
2083 	char		*sql = NULL;
2084 	idmap_retcode	retcode;
2085 	int		is_eph_user;
2086 
2087 	/* Check if we need to cache anything */
2088 	if (req->direction == _IDMAP_F_DONE)
2089 		return (IDMAP_SUCCESS);
2090 
2091 	/* We don't cache negative entries */
2092 	if (res->retcode != IDMAP_SUCCESS)
2093 		return (IDMAP_SUCCESS);
2094 
2095 	if (req->direction & _IDMAP_F_EXP_EPH_UID)
2096 		is_eph_user = 1;
2097 	else if (req->direction & _IDMAP_F_EXP_EPH_GID)
2098 		is_eph_user = 0;
2099 	else
2100 		is_eph_user = -1;
2101 
2102 	if (is_eph_user >= 0 && !IS_EPHEMERAL(res->id.idmap_id_u.uid)) {
2103 		sql = sqlite_mprintf("UPDATE idmap_cache "
2104 			"SET w2u = 0 WHERE "
2105 			"sidprefix = %Q AND rid = %u AND w2u = 1 AND "
2106 			"pid >= 2147483648 AND is_user = %d;",
2107 			req->id1.idmap_id_u.sid.prefix,
2108 			req->id1.idmap_id_u.sid.rid,
2109 			is_eph_user);
2110 		if (sql == NULL) {
2111 			retcode = IDMAP_ERR_INTERNAL;
2112 			idmapdlog(LOG_ERR, "Out of memory");
2113 			goto out;
2114 		}
2115 
2116 		retcode = sql_exec_no_cb(cache, sql);
2117 		if (retcode != IDMAP_SUCCESS)
2118 			goto out;
2119 
2120 		sqlite_freemem(sql);
2121 		sql = NULL;
2122 	}
2123 
2124 	sql = sqlite_mprintf("INSERT OR REPLACE into idmap_cache "
2125 		"(sidprefix, rid, windomain, winname, pid, unixname, "
2126 		"is_user, expiration, w2u, u2w) "
2127 		"VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, "
2128 		"strftime('%%s','now') + 600, 1, %q); ",
2129 		req->id1.idmap_id_u.sid.prefix,
2130 		req->id1.idmap_id_u.sid.rid,
2131 		req->id1domain.idmap_utf8str_val,
2132 		req->id1name.idmap_utf8str_val,
2133 		res->id.idmap_id_u.uid,
2134 		req->id2name.idmap_utf8str_val,
2135 		(res->id.idtype == IDMAP_UID)?1:0,
2136 		(res->direction == 0)?"1":NULL);
2137 
2138 	if (sql == NULL) {
2139 		retcode = IDMAP_ERR_INTERNAL;
2140 		idmapdlog(LOG_ERR, "Out of memory");
2141 		goto out;
2142 	}
2143 
2144 	retcode = sql_exec_no_cb(cache, sql);
2145 	if (retcode != IDMAP_SUCCESS)
2146 		goto out;
2147 
2148 	state->sid2pid_done = FALSE;
2149 	sqlite_freemem(sql);
2150 	sql = NULL;
2151 
2152 	/* If name2sid was found in the cache, no need to update namecache */
2153 	if (req->direction & _IDMAP_F_S2N_CACHE)
2154 		goto out;
2155 
2156 	if (req->id1name.idmap_utf8str_val == NULL)
2157 		goto out;
2158 
2159 	sql = sqlite_mprintf("INSERT OR REPLACE into name_cache "
2160 		"(sidprefix, rid, name, domain, type, expiration) "
2161 		"VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
2162 		req->id1.idmap_id_u.sid.prefix,
2163 		req->id1.idmap_id_u.sid.rid,
2164 		req->id1name.idmap_utf8str_val,
2165 		req->id1domain.idmap_utf8str_val,
2166 		(res->id.idtype == IDMAP_UID)?_IDMAP_T_USER:_IDMAP_T_GROUP);
2167 
2168 	if (sql == NULL) {
2169 		retcode = IDMAP_ERR_INTERNAL;
2170 		idmapdlog(LOG_ERR, "Out of memory");
2171 		goto out;
2172 	}
2173 
2174 	retcode = sql_exec_no_cb(cache, sql);
2175 
2176 out:
2177 	if (sql != NULL)
2178 		sqlite_freemem(sql);
2179 	return (retcode);
2180 }
2181 
2182 static idmap_retcode
2183 lookup_cache_pid2sid(sqlite *cache, idmap_mapping *req, idmap_id_res *res,
2184 		int is_user, int getname) {
2185 	char		*end;
2186 	char		*sql = NULL;
2187 	const char	**values;
2188 	sqlite_vm	*vm = NULL;
2189 	int		ncol;
2190 	idmap_retcode	retcode = IDMAP_SUCCESS;
2191 	idmap_utf8str	*str;
2192 	time_t		curtime;
2193 
2194 	/* Current time */
2195 	errno = 0;
2196 	if ((curtime = time(NULL)) == (time_t)-1) {
2197 		idmapdlog(LOG_ERR,
2198 			"Failed to get current time (%s)",
2199 			strerror(errno));
2200 		retcode = IDMAP_ERR_INTERNAL;
2201 		goto out;
2202 	}
2203 
2204 	/* SQL to lookup the cache */
2205 	sql = sqlite_mprintf("SELECT sidprefix, rid, winname, windomain, w2u "
2206 			"FROM idmap_cache WHERE "
2207 			"pid = %u AND u2w = 1 AND is_user = %d AND "
2208 			"(pid >= 2147483648 OR "
2209 			"(expiration = 0 OR expiration ISNULL OR "
2210 			"expiration > %d));",
2211 			req->id1.idmap_id_u.uid, is_user, curtime);
2212 	if (sql == NULL) {
2213 		idmapdlog(LOG_ERR, "Out of memory");
2214 		retcode = IDMAP_ERR_MEMORY;
2215 		goto out;
2216 	}
2217 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 5, &values);
2218 	sqlite_freemem(sql);
2219 
2220 	if (retcode == IDMAP_ERR_NOTFOUND)
2221 		goto out;
2222 	else if (retcode == IDMAP_SUCCESS) {
2223 		/* sanity checks */
2224 		if (values[0] == NULL || values[1] == NULL) {
2225 			retcode = IDMAP_ERR_CACHE;
2226 			goto out;
2227 		}
2228 
2229 		switch (req->id2.idtype) {
2230 		case IDMAP_SID:
2231 			res->id.idmap_id_u.sid.rid =
2232 				strtoul(values[1], &end, 10);
2233 			res->id.idmap_id_u.sid.prefix = strdup(values[0]);
2234 			if (res->id.idmap_id_u.sid.prefix == NULL) {
2235 				idmapdlog(LOG_ERR, "Out of memory");
2236 				retcode = IDMAP_ERR_MEMORY;
2237 				goto out;
2238 			}
2239 
2240 			if (values[4] != NULL)
2241 				res->direction =
2242 				    (strtol(values[4], &end, 10) == 0)?
2243 				    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
2244 			else
2245 				res->direction = IDMAP_DIRECTION_U2W;
2246 
2247 			if (getname == 0 || values[2] == NULL)
2248 				break;
2249 			str = &req->id2name;
2250 			retcode = idmap_str2utf8(&str, values[2], 0);
2251 			if (retcode != IDMAP_SUCCESS) {
2252 				idmapdlog(LOG_ERR, "Out of memory");
2253 				retcode = IDMAP_ERR_MEMORY;
2254 				goto out;
2255 			}
2256 
2257 			if (values[3] == NULL)
2258 				break;
2259 			str = &req->id2domain;
2260 			retcode = idmap_str2utf8(&str, values[3], 0);
2261 			if (retcode != IDMAP_SUCCESS) {
2262 				idmapdlog(LOG_ERR, "Out of memory");
2263 				retcode = IDMAP_ERR_MEMORY;
2264 				goto out;
2265 			}
2266 			break;
2267 		default:
2268 			retcode = IDMAP_ERR_NOTSUPPORTED;
2269 			break;
2270 		}
2271 	}
2272 
2273 out:
2274 	if (vm != NULL)
2275 		(void) sqlite_finalize(vm, NULL);
2276 	return (retcode);
2277 }
2278 
2279 static idmap_retcode
2280 lookup_cache_name2sid(sqlite *cache, const char *name, const char *domain,
2281 		char **sidprefix, idmap_rid_t *rid, int *type) {
2282 	char		*end;
2283 	char		*sql = NULL;
2284 	const char	**values;
2285 	sqlite_vm	*vm = NULL;
2286 	int		ncol;
2287 	time_t		curtime;
2288 	idmap_retcode	retcode = IDMAP_SUCCESS;
2289 
2290 	/* Get current time */
2291 	errno = 0;
2292 	if ((curtime = time(NULL)) == (time_t)-1) {
2293 		idmapdlog(LOG_ERR,
2294 			"Failed to get current time (%s)",
2295 			strerror(errno));
2296 		retcode = IDMAP_ERR_INTERNAL;
2297 		goto out;
2298 	}
2299 
2300 	/* SQL to lookup the cache */
2301 	sql = sqlite_mprintf("SELECT sidprefix, rid, type FROM name_cache "
2302 			"WHERE name = %Q AND domain = %Q AND "
2303 			"(expiration = 0 OR expiration ISNULL OR "
2304 			"expiration > %d);",
2305 			name, domain, curtime);
2306 	if (sql == NULL) {
2307 		idmapdlog(LOG_ERR, "Out of memory");
2308 		retcode = IDMAP_ERR_MEMORY;
2309 		goto out;
2310 	}
2311 	retcode = sql_compile_n_step_once(cache, sql, &vm, &ncol, 3, &values);
2312 	sqlite_freemem(sql);
2313 
2314 	if (retcode == IDMAP_SUCCESS) {
2315 		if (type != NULL) {
2316 			if (values[2] == NULL) {
2317 				retcode = IDMAP_ERR_CACHE;
2318 				goto out;
2319 			}
2320 			*type = strtol(values[2], &end, 10);
2321 		}
2322 
2323 		if (values[0] == NULL || values[1] == NULL) {
2324 			retcode = IDMAP_ERR_CACHE;
2325 			goto out;
2326 		}
2327 		if ((*sidprefix = strdup(values[0])) == NULL) {
2328 			idmapdlog(LOG_ERR, "Out of memory");
2329 			retcode = IDMAP_ERR_MEMORY;
2330 			goto out;
2331 		}
2332 		*rid = strtoul(values[1], &end, 10);
2333 	}
2334 
2335 out:
2336 	if (vm != NULL)
2337 		(void) sqlite_finalize(vm, NULL);
2338 	return (retcode);
2339 }
2340 
2341 static idmap_retcode
2342 lookup_win_name2sid(const char *name, const char *domain, char **sidprefix,
2343 		idmap_rid_t *rid, int *type) {
2344 	int			ret;
2345 	int			retries = 0;
2346 	idmap_query_state_t	*qs = NULL;
2347 	idmap_retcode		rc, retcode;
2348 
2349 	retcode = IDMAP_ERR_NOTFOUND;
2350 
2351 retry:
2352 	ret = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs);
2353 	if (ret != 0) {
2354 		idmapdlog(LOG_ERR,
2355 		"Failed to create name2sid batch for AD lookup");
2356 		return (IDMAP_ERR_INTERNAL);
2357 	}
2358 
2359 	retcode = idmap_name2sid_batch_add1(qs, name, domain, sidprefix,
2360 					rid, type, &rc);
2361 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
2362 		goto out;
2363 
2364 	if (retcode != IDMAP_SUCCESS) {
2365 		idmapdlog(LOG_ERR,
2366 		"Failed to batch name2sid for AD lookup");
2367 		idmap_lookup_release_batch(&qs);
2368 		return (IDMAP_ERR_INTERNAL);
2369 	}
2370 
2371 out:
2372 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
2373 		idmap_lookup_release_batch(&qs);
2374 	else
2375 		retcode = idmap_lookup_batch_end(&qs, NULL);
2376 
2377 	if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR && retries++ < 2)
2378 		goto retry;
2379 
2380 	if (retcode != IDMAP_SUCCESS) {
2381 		idmapdlog(LOG_NOTICE, "Windows user/group name to SID lookup "
2382 		    "failed");
2383 		return (retcode);
2384 	} else
2385 		return (rc);
2386 	/* NOTREACHED */
2387 }
2388 
2389 static idmap_retcode
2390 lookup_name2sid(sqlite *cache, const char *name, const char *domain,
2391 		int *is_user, char **sidprefix, idmap_rid_t *rid,
2392 		idmap_mapping *req) {
2393 	int		type;
2394 	idmap_retcode	retcode;
2395 
2396 	/* Lookup name@domain to sid in the well-known sids table */
2397 	retcode = lookup_wksids_name2sid(name, sidprefix, rid, &type);
2398 	if (retcode == IDMAP_SUCCESS) {
2399 		req->direction |= _IDMAP_F_S2N_CACHE;
2400 		goto out;
2401 	} else if (retcode != IDMAP_ERR_NOTFOUND) {
2402 		return (retcode);
2403 	}
2404 
2405 	/* Lookup name@domain to sid in cache */
2406 	retcode = lookup_cache_name2sid(cache, name, domain, sidprefix,
2407 		rid, &type);
2408 	if (retcode == IDMAP_ERR_NOTFOUND) {
2409 		/* Lookup Windows NT/AD to map name@domain to sid */
2410 		retcode = lookup_win_name2sid(name, domain, sidprefix, rid,
2411 			&type);
2412 		if (retcode != IDMAP_SUCCESS)
2413 			return (retcode);
2414 		req->direction |= _IDMAP_F_S2N_AD;
2415 	} else if (retcode != IDMAP_SUCCESS) {
2416 		return (retcode);
2417 	} else {
2418 		/* Set flag */
2419 		req->direction |= _IDMAP_F_S2N_CACHE;
2420 	}
2421 
2422 out:
2423 	/*
2424 	 * Entry found (cache or Windows lookup)
2425 	 * is_user is both input as well as output parameter
2426 	 */
2427 	if (*is_user == 1) {
2428 		if (type != _IDMAP_T_USER)
2429 			return (IDMAP_ERR_NOTUSER);
2430 	} else if (*is_user == 0) {
2431 		if (type != _IDMAP_T_GROUP)
2432 			return (IDMAP_ERR_NOTGROUP);
2433 	} else if (*is_user == -1) {
2434 		/* Caller wants to know if its user or group */
2435 		if (type == _IDMAP_T_USER)
2436 			*is_user = 1;
2437 		else if (type == _IDMAP_T_GROUP)
2438 			*is_user = 0;
2439 		else
2440 			return (IDMAP_ERR_SID);
2441 	}
2442 
2443 	return (retcode);
2444 }
2445 
2446 static idmap_retcode
2447 name_based_mapping_pid2sid(sqlite *db, sqlite *cache, const char *unixname,
2448 		int is_user, idmap_mapping *req, idmap_id_res *res) {
2449 	const char	*winname, *windomain;
2450 	char		*mapping_domain = NULL;
2451 	char		*sql = NULL, *errmsg = NULL;
2452 	idmap_retcode	retcode;
2453 	char		*end;
2454 	const char	**values;
2455 	sqlite_vm	*vm = NULL;
2456 	idmap_utf8str	*str;
2457 	int		ncol, r;
2458 	const char	*me = "name_based_mapping_pid2sid";
2459 
2460 	RDLOCK_CONFIG();
2461 	if (_idmapdstate.cfg->pgcfg.mapping_domain != NULL) {
2462 		mapping_domain =
2463 			strdup(_idmapdstate.cfg->pgcfg.mapping_domain);
2464 		if (mapping_domain == NULL) {
2465 			UNLOCK_CONFIG();
2466 			idmapdlog(LOG_ERR, "Out of memory");
2467 			retcode = IDMAP_ERR_MEMORY;
2468 			goto out;
2469 		}
2470 	}
2471 	UNLOCK_CONFIG();
2472 
2473 	sql = sqlite_mprintf(
2474 		"SELECT winname, windomain, w2u_order FROM namerules WHERE "
2475 		"u2w_order > 0 AND is_user = %d AND "
2476 		"(unixname = %Q OR unixname = '*') "
2477 		"ORDER BY u2w_order ASC;",
2478 		is_user, unixname);
2479 	if (sql == NULL) {
2480 		idmapdlog(LOG_ERR, "Out of memory");
2481 		retcode = IDMAP_ERR_MEMORY;
2482 		goto out;
2483 	}
2484 
2485 	if (sqlite_compile(db, sql, NULL, &vm, &errmsg) != SQLITE_OK) {
2486 		retcode = IDMAP_ERR_INTERNAL;
2487 		idmapdlog(LOG_ERR,
2488 			"%s: database error (%s)",
2489 			me, CHECK_NULL(errmsg));
2490 		sqlite_freemem(errmsg);
2491 		goto out;
2492 	}
2493 
2494 	for (;;) {
2495 		r = sqlite_step(vm, &ncol, &values, NULL);
2496 		assert(r != SQLITE_LOCKED && r != SQLITE_BUSY);
2497 		if (r == SQLITE_ROW) {
2498 			if (ncol < 3) {
2499 				retcode = IDMAP_ERR_INTERNAL;
2500 				goto out;
2501 			}
2502 			if (values[0] == NULL) {
2503 				/* values [1] and [2] can be null */
2504 				retcode = IDMAP_ERR_INTERNAL;
2505 				goto out;
2506 			}
2507 			if (EMPTY_NAME(values[0])) {
2508 				retcode = IDMAP_ERR_NOMAPPING;
2509 				goto out;
2510 			}
2511 			winname = (values[0][0] == '*')?unixname:values[0];
2512 			if (values[1] != NULL)
2513 				windomain = values[1];
2514 			else if (mapping_domain != NULL)
2515 				windomain = mapping_domain;
2516 			else {
2517 				idmapdlog(LOG_ERR,
2518 					"%s: no domain", me);
2519 				retcode = IDMAP_ERR_DOMAIN_NOTFOUND;
2520 				goto out;
2521 			}
2522 			/* Lookup winname@domain to sid */
2523 			retcode = lookup_name2sid(cache, winname, windomain,
2524 				&is_user, &res->id.idmap_id_u.sid.prefix,
2525 				&res->id.idmap_id_u.sid.rid, req);
2526 			if (retcode == IDMAP_ERR_NOTFOUND) {
2527 				if (winname == unixname)
2528 					continue;
2529 				else
2530 					retcode = IDMAP_ERR_NOMAPPING;
2531 			}
2532 			goto out;
2533 		} else if (r == SQLITE_DONE) {
2534 			retcode = IDMAP_ERR_NOTFOUND;
2535 			goto out;
2536 		} else {
2537 			(void) sqlite_finalize(vm, &errmsg);
2538 			vm = NULL;
2539 			idmapdlog(LOG_ERR,
2540 				"%s: database error (%s)",
2541 				me, CHECK_NULL(errmsg));
2542 			sqlite_freemem(errmsg);
2543 			retcode = IDMAP_ERR_INTERNAL;
2544 			goto out;
2545 		}
2546 	}
2547 
2548 out:
2549 	if (sql != NULL)
2550 		sqlite_freemem(sql);
2551 	if (retcode == IDMAP_SUCCESS) {
2552 		if (values[2] != NULL)
2553 			res->direction =
2554 			    (strtol(values[2], &end, 10) == 0)?
2555 			    IDMAP_DIRECTION_U2W:IDMAP_DIRECTION_BI;
2556 		else
2557 			res->direction = IDMAP_DIRECTION_U2W;
2558 		str = &req->id2name;
2559 		retcode = idmap_str2utf8(&str, winname, 0);
2560 		if (retcode == IDMAP_SUCCESS) {
2561 			str = &req->id2domain;
2562 			if (windomain == mapping_domain) {
2563 				(void) idmap_str2utf8(&str, windomain, 1);
2564 				mapping_domain = NULL;
2565 			} else
2566 				retcode = idmap_str2utf8(&str, windomain, 0);
2567 		}
2568 	}
2569 	if (vm != NULL)
2570 		(void) sqlite_finalize(vm, NULL);
2571 	if (mapping_domain != NULL)
2572 		free(mapping_domain);
2573 	return (retcode);
2574 }
2575 
2576 idmap_retcode
2577 pid2sid_first_pass(lookup_state_t *state, sqlite *cache, sqlite *db,
2578 		idmap_mapping *req, idmap_id_res *res, int is_user,
2579 		int getname) {
2580 	char		*unixname = NULL;
2581 	struct passwd	pwd;
2582 	struct group	grp;
2583 	idmap_utf8str	*str;
2584 	char		buf[1024];
2585 	int		errnum;
2586 	idmap_retcode	retcode = IDMAP_SUCCESS;
2587 	const char	*me = "pid2sid";
2588 
2589 	req->direction = _IDMAP_F_DONE;
2590 	res->id.idtype = req->id2.idtype;
2591 
2592 	/* Lookup well-known SIDs */
2593 	retcode = lookup_wksids_pid2sid(req, res, is_user);
2594 	if (retcode != IDMAP_ERR_NOTFOUND)
2595 		goto out;
2596 
2597 	/* Lookup pid to sid in cache */
2598 	retcode = lookup_cache_pid2sid(cache, req, res, is_user, getname);
2599 	if (retcode != IDMAP_ERR_NOTFOUND)
2600 		goto out;
2601 
2602 	/* Ephemeral ids cannot be allocated during pid2sid */
2603 	if (IS_EPHEMERAL(req->id1.idmap_id_u.uid)) {
2604 		retcode = IDMAP_ERR_NOMAPPING;
2605 		goto out;
2606 	}
2607 
2608 	if (DO_NOT_ALLOC_NEW_ID_MAPPING(req) || AVOID_NAMESERVICE(req)) {
2609 		retcode = IDMAP_ERR_NOMAPPING;
2610 		goto out;
2611 	}
2612 
2613 	/* uid/gid to name */
2614 	if (req->id1name.idmap_utf8str_val != NULL) {
2615 		unixname = req->id1name.idmap_utf8str_val;
2616 	} if (is_user) {
2617 		errno = 0;
2618 		if (getpwuid_r(req->id1.idmap_id_u.uid, &pwd, buf,
2619 				sizeof (buf)) == NULL) {
2620 			errnum = errno;
2621 			idmapdlog(LOG_WARNING,
2622 			"%s: getpwuid_r(%u) failed (%s).",
2623 				me, req->id1.idmap_id_u.uid,
2624 				errnum?strerror(errnum):"not found");
2625 			retcode = (errnum == 0)?IDMAP_ERR_NOTFOUND:
2626 					IDMAP_ERR_INTERNAL;
2627 			goto fallback_localsid;
2628 		}
2629 		unixname = pwd.pw_name;
2630 	} else {
2631 		errno = 0;
2632 		if (getgrgid_r(req->id1.idmap_id_u.gid, &grp, buf,
2633 				sizeof (buf)) == NULL) {
2634 			errnum = errno;
2635 			idmapdlog(LOG_WARNING,
2636 			"%s: getgrgid_r(%u) failed (%s).",
2637 				me, req->id1.idmap_id_u.gid,
2638 				errnum?strerror(errnum):"not found");
2639 			retcode = (errnum == 0)?IDMAP_ERR_NOTFOUND:
2640 					IDMAP_ERR_INTERNAL;
2641 			goto fallback_localsid;
2642 		}
2643 		unixname = grp.gr_name;
2644 	}
2645 
2646 	/* Name-based mapping */
2647 	retcode = name_based_mapping_pid2sid(db, cache, unixname, is_user,
2648 		req, res);
2649 	if (retcode == IDMAP_ERR_NOTFOUND) {
2650 		retcode = generate_localsid(req, res, is_user);
2651 		goto out;
2652 	} else if (retcode == IDMAP_SUCCESS)
2653 		goto out;
2654 
2655 fallback_localsid:
2656 	/*
2657 	 * Here we generate localsid as fallback id on errors. Our
2658 	 * return status is the error that's been previously assigned.
2659 	 */
2660 	(void) generate_localsid(req, res, is_user);
2661 
2662 out:
2663 	if (retcode == IDMAP_SUCCESS) {
2664 		if (req->id1name.idmap_utf8str_val == NULL &&
2665 		    unixname != NULL) {
2666 			str = &req->id1name;
2667 			retcode = idmap_str2utf8(&str, unixname, 0);
2668 		}
2669 	}
2670 	if (req->direction != _IDMAP_F_DONE)
2671 		state->pid2sid_done = FALSE;
2672 	res->retcode = idmap_stat4prot(retcode);
2673 	return (retcode);
2674 }
2675 
2676 static idmap_retcode
2677 lookup_win_sid2name(const char *sidprefix, idmap_rid_t rid, char **name,
2678 		char **domain, int *type) {
2679 	int			ret;
2680 	idmap_query_state_t	*qs = NULL;
2681 	idmap_retcode		rc, retcode;
2682 
2683 	retcode = IDMAP_ERR_NOTFOUND;
2684 
2685 	ret = idmap_lookup_batch_start(_idmapdstate.ad, 1, &qs);
2686 	if (ret != 0) {
2687 		idmapdlog(LOG_ERR,
2688 		"Failed to create sid2name batch for AD lookup");
2689 		retcode = IDMAP_ERR_INTERNAL;
2690 		goto out;
2691 	}
2692 
2693 	ret = idmap_sid2name_batch_add1(
2694 			qs, sidprefix, &rid, name, domain, type, &rc);
2695 	if (ret != 0) {
2696 		idmapdlog(LOG_ERR,
2697 		"Failed to batch sid2name for AD lookup");
2698 		retcode = IDMAP_ERR_INTERNAL;
2699 		goto out;
2700 	}
2701 
2702 out:
2703 	if (qs != NULL) {
2704 		ret = idmap_lookup_batch_end(&qs, NULL);
2705 		if (ret != 0) {
2706 			idmapdlog(LOG_ERR,
2707 			"Failed to execute sid2name AD lookup");
2708 			retcode = IDMAP_ERR_INTERNAL;
2709 		} else
2710 			retcode = rc;
2711 	}
2712 
2713 	return (retcode);
2714 }
2715 
2716 static int
2717 copy_mapping_request(idmap_mapping *mapping, idmap_mapping *request)
2718 {
2719 	(void) memset(mapping, 0, sizeof (*mapping));
2720 
2721 	mapping->flag = request->flag;
2722 	mapping->direction = request->direction;
2723 	mapping->id2.idtype = request->id2.idtype;
2724 
2725 	mapping->id1.idtype = request->id1.idtype;
2726 	if (request->id1.idtype == IDMAP_SID) {
2727 		mapping->id1.idmap_id_u.sid.rid =
2728 		    request->id1.idmap_id_u.sid.rid;
2729 		if (!EMPTY_STRING(request->id1.idmap_id_u.sid.prefix)) {
2730 			mapping->id1.idmap_id_u.sid.prefix =
2731 			    strdup(request->id1.idmap_id_u.sid.prefix);
2732 			if (mapping->id1.idmap_id_u.sid.prefix == NULL)
2733 				return (-1);
2734 		}
2735 	} else {
2736 		mapping->id1.idmap_id_u.uid = request->id1.idmap_id_u.uid;
2737 	}
2738 
2739 	mapping->id1domain.idmap_utf8str_len =
2740 	    request->id1domain.idmap_utf8str_len;
2741 	if (mapping->id1domain.idmap_utf8str_len) {
2742 		mapping->id1domain.idmap_utf8str_val =
2743 		    strdup(request->id1domain.idmap_utf8str_val);
2744 		if (mapping->id1domain.idmap_utf8str_val == NULL)
2745 			return (-1);
2746 	}
2747 
2748 	mapping->id1name.idmap_utf8str_len  =
2749 	    request->id1name.idmap_utf8str_len;
2750 	if (mapping->id1name.idmap_utf8str_len) {
2751 		mapping->id1name.idmap_utf8str_val =
2752 		    strdup(request->id1name.idmap_utf8str_val);
2753 		if (mapping->id1name.idmap_utf8str_val == NULL)
2754 			return (-1);
2755 	}
2756 
2757 	/* We don't need the rest of the request i.e request->id2 */
2758 	return (0);
2759 
2760 errout:
2761 	if (mapping->id1.idmap_id_u.sid.prefix != NULL) {
2762 		free(mapping->id1.idmap_id_u.sid.prefix);
2763 		mapping->id1.idmap_id_u.sid.prefix = NULL;
2764 	}
2765 
2766 	if (mapping->id1domain.idmap_utf8str_val != NULL) {
2767 		free(mapping->id1domain.idmap_utf8str_val);
2768 		mapping->id1domain.idmap_utf8str_val = NULL;
2769 		mapping->id1domain.idmap_utf8str_len = 0;
2770 	}
2771 
2772 	if (mapping->id1name.idmap_utf8str_val != NULL) {
2773 		free(mapping->id1name.idmap_utf8str_val);
2774 		mapping->id1name.idmap_utf8str_val = NULL;
2775 		mapping->id1name.idmap_utf8str_len = 0;
2776 	}
2777 
2778 	(void) memset(mapping, 0, sizeof (*mapping));
2779 	return (-1);
2780 }
2781 
2782 
2783 idmap_retcode
2784 get_w2u_mapping(sqlite *cache, sqlite *db, idmap_mapping *request,
2785 		idmap_mapping *mapping) {
2786 	idmap_id_res	idres;
2787 	lookup_state_t	state;
2788 	idmap_utf8str	*str;
2789 	int		is_user;
2790 	idmap_retcode	retcode;
2791 	const char	*winname, *windomain;
2792 
2793 	(void) memset(&idres, 0, sizeof (idres));
2794 	(void) memset(&state, 0, sizeof (state));
2795 
2796 	if (request->id2.idtype == IDMAP_UID)
2797 		is_user = 1;
2798 	else if (request->id2.idtype == IDMAP_GID)
2799 		is_user = 0;
2800 	else if (request->id2.idtype == IDMAP_POSIXID)
2801 		is_user = -1;
2802 	else {
2803 		retcode = IDMAP_ERR_IDTYPE;
2804 		goto out;
2805 	}
2806 
2807 	/* Copy data from request to result */
2808 	if (copy_mapping_request(mapping, request) < 0) {
2809 		retcode = IDMAP_ERR_MEMORY;
2810 		goto out;
2811 	}
2812 
2813 	winname = mapping->id1name.idmap_utf8str_val;
2814 	windomain = mapping->id1domain.idmap_utf8str_val;
2815 
2816 	if (winname == NULL && windomain != NULL) {
2817 		retcode = IDMAP_ERR_ARG;
2818 		goto out;
2819 	}
2820 
2821 	if (winname != NULL && windomain == NULL) {
2822 		str = &mapping->id1domain;
2823 		RDLOCK_CONFIG();
2824 		if (_idmapdstate.cfg->pgcfg.mapping_domain != NULL) {
2825 			retcode = idmap_str2utf8(&str,
2826 				_idmapdstate.cfg->pgcfg.mapping_domain, 0);
2827 			if (retcode != IDMAP_SUCCESS) {
2828 				UNLOCK_CONFIG();
2829 				idmapdlog(LOG_ERR, "Out of memory");
2830 				retcode = IDMAP_ERR_MEMORY;
2831 				goto out;
2832 			}
2833 		}
2834 		UNLOCK_CONFIG();
2835 		windomain = mapping->id1domain.idmap_utf8str_val;
2836 	}
2837 
2838 	if (winname != NULL && mapping->id1.idmap_id_u.sid.prefix == NULL) {
2839 		retcode = lookup_name2sid(cache, winname, windomain,
2840 			&is_user, &mapping->id1.idmap_id_u.sid.prefix,
2841 			&mapping->id1.idmap_id_u.sid.rid, mapping);
2842 		if (retcode != IDMAP_SUCCESS)
2843 			goto out;
2844 		if (mapping->id2.idtype == IDMAP_POSIXID)
2845 			mapping->id2.idtype = is_user?IDMAP_UID:IDMAP_GID;
2846 	}
2847 
2848 	state.sid2pid_done = TRUE;
2849 	retcode = sid2pid_first_pass(&state, cache, mapping, &idres);
2850 	if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE)
2851 		goto out;
2852 
2853 	if (state.ad_nqueries) {
2854 		/* sid2name AD lookup */
2855 		retcode = lookup_win_sid2name(
2856 			mapping->id1.idmap_id_u.sid.prefix,
2857 			mapping->id1.idmap_id_u.sid.rid,
2858 			&mapping->id1name.idmap_utf8str_val,
2859 			&mapping->id1domain.idmap_utf8str_val,
2860 			(int *)&idres.id.idtype);
2861 
2862 		idres.retcode = retcode;
2863 	}
2864 
2865 	state.sid2pid_done = TRUE;
2866 	retcode = sid2pid_second_pass(&state, cache, db, mapping, &idres);
2867 	if (IDMAP_ERROR(retcode) || state.sid2pid_done == TRUE)
2868 		goto out;
2869 
2870 	/* Update cache */
2871 	(void) update_cache_sid2pid(&state, cache, mapping, &idres);
2872 
2873 out:
2874 	if (retcode == IDMAP_SUCCESS) {
2875 		mapping->direction = idres.direction;
2876 		mapping->id2 = idres.id;
2877 		(void) memset(&idres, 0, sizeof (idres));
2878 	} else {
2879 		mapping->id2.idmap_id_u.uid = UID_NOBODY;
2880 	}
2881 	xdr_free(xdr_idmap_id_res, (caddr_t)&idres);
2882 	return (retcode);
2883 }
2884 
2885 idmap_retcode
2886 get_u2w_mapping(sqlite *cache, sqlite *db, idmap_mapping *request,
2887 		idmap_mapping *mapping, int is_user) {
2888 	idmap_id_res	idres;
2889 	lookup_state_t	state;
2890 	struct passwd	pwd;
2891 	struct group	grp;
2892 	char		buf[1024];
2893 	int		errnum;
2894 	idmap_retcode	retcode;
2895 	const char	*unixname;
2896 	const char	*me = "get_u2w_mapping";
2897 
2898 	/*
2899 	 * In order to re-use the pid2sid code, we convert
2900 	 * our input data into structs that are expected by
2901 	 * pid2sid_first_pass.
2902 	 */
2903 
2904 	(void) memset(&idres, 0, sizeof (idres));
2905 	(void) memset(&state, 0, sizeof (state));
2906 
2907 	/* Copy data from request to result */
2908 	if (copy_mapping_request(mapping, request) < 0) {
2909 		retcode = IDMAP_ERR_MEMORY;
2910 		goto out;
2911 	}
2912 
2913 	unixname = mapping->id1name.idmap_utf8str_val;
2914 
2915 	if (unixname == NULL && mapping->id1.idmap_id_u.uid == SENTINEL_PID) {
2916 		retcode = IDMAP_ERR_ARG;
2917 		goto out;
2918 	}
2919 
2920 	if (unixname != NULL && mapping->id1.idmap_id_u.uid == SENTINEL_PID) {
2921 		/* Get uid/gid by name */
2922 		if (is_user) {
2923 			errno = 0;
2924 			if (getpwnam_r(unixname, &pwd, buf,
2925 					sizeof (buf)) == NULL) {
2926 				errnum = errno;
2927 				idmapdlog(LOG_WARNING,
2928 				"%s: getpwnam_r(%s) failed (%s).",
2929 					me, unixname,
2930 					errnum?strerror(errnum):"not found");
2931 				retcode = (errnum == 0)?IDMAP_ERR_NOTFOUND:
2932 						IDMAP_ERR_INTERNAL;
2933 				goto out;
2934 			}
2935 			mapping->id1.idmap_id_u.uid = pwd.pw_uid;
2936 		} else {
2937 			errno = 0;
2938 			if (getgrnam_r(unixname, &grp, buf,
2939 					sizeof (buf)) == NULL) {
2940 				errnum = errno;
2941 				idmapdlog(LOG_WARNING,
2942 				"%s: getgrnam_r(%s) failed (%s).",
2943 					me, unixname,
2944 					errnum?strerror(errnum):"not found");
2945 				retcode = (errnum == 0)?IDMAP_ERR_NOTFOUND:
2946 						IDMAP_ERR_INTERNAL;
2947 				goto out;
2948 			}
2949 			mapping->id1.idmap_id_u.gid = grp.gr_gid;
2950 		}
2951 	}
2952 
2953 	state.pid2sid_done = TRUE;
2954 	retcode = pid2sid_first_pass(&state, cache, db, mapping, &idres,
2955 			is_user, 1);
2956 	if (IDMAP_ERROR(retcode) || state.pid2sid_done == TRUE)
2957 		goto out;
2958 
2959 	/* Update cache */
2960 	(void) update_cache_pid2sid(&state, cache, mapping, &idres);
2961 
2962 out:
2963 	mapping->direction = idres.direction;
2964 	mapping->id2 = idres.id;
2965 	(void) memset(&idres, 0, sizeof (idres));
2966 	xdr_free(xdr_idmap_id_res, (caddr_t)&idres);
2967 	return (retcode);
2968 }
2969