1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 /* 29 * Service routines 30 */ 31 32 #include "idmapd.h" 33 #include "idmap_priv.h" 34 #include "nldaputils.h" 35 #include <signal.h> 36 #include <thread.h> 37 #include <string.h> 38 #include <strings.h> 39 #include <errno.h> 40 #include <assert.h> 41 #include <sys/types.h> 42 #include <sys/stat.h> 43 #include <ucred.h> 44 #include <pwd.h> 45 #include <auth_attr.h> 46 #include <secdb.h> 47 #include <sys/u8_textprep.h> 48 49 #define _VALIDATE_LIST_CB_DATA(col, val, siz)\ 50 retcode = validate_list_cb_data(cb_data, argc, argv, col,\ 51 (uchar_t **)val, siz);\ 52 if (retcode == IDMAP_NEXT) {\ 53 result->retcode = IDMAP_NEXT;\ 54 return (0);\ 55 } else if (retcode < 0) {\ 56 result->retcode = retcode;\ 57 return (1);\ 58 } 59 60 #define PROCESS_LIST_SVC_SQL(rcode, db, dbname, sql, limit, flag, cb, res, len)\ 61 rcode = process_list_svc_sql(db, dbname, sql, limit, flag, cb, res);\ 62 if (rcode == IDMAP_ERR_BUSY)\ 63 res->retcode = IDMAP_ERR_BUSY;\ 64 else if (rcode == IDMAP_SUCCESS && len == 0)\ 65 res->retcode = IDMAP_ERR_NOTFOUND; 66 67 68 #define STRDUP_OR_FAIL(to, from) \ 69 if ((from) == NULL) \ 70 to = NULL; \ 71 else { \ 72 if ((to = strdup(from)) == NULL) \ 73 return (1); \ 74 } 75 76 /* ARGSUSED */ 77 bool_t 78 idmap_null_1_svc(void *result, struct svc_req *rqstp) 79 { 80 return (TRUE); 81 } 82 83 /* 84 * RPC layer allocates empty strings to replace NULL char *. 85 * This utility function frees these empty strings. 86 */ 87 static 88 void 89 sanitize_mapping_request(idmap_mapping *req) 90 { 91 free(req->id1name); 92 req->id1name = NULL; 93 free(req->id1domain); 94 req->id1domain = NULL; 95 free(req->id2name); 96 req->id2name = NULL; 97 free(req->id2domain); 98 req->id2domain = NULL; 99 req->direction = _IDMAP_F_DONE; 100 } 101 102 static 103 int 104 validate_mapped_id_by_name_req(idmap_mapping *req) 105 { 106 int e; 107 108 if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) 109 return (IDMAP_SUCCESS); 110 111 if (IS_REQUEST_SID(*req, 1)) { 112 if (!EMPTY_STRING(req->id1name) && 113 u8_validate(req->id1name, strlen(req->id1name), 114 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 115 return (IDMAP_ERR_BAD_UTF8); 116 if (!EMPTY_STRING(req->id1domain) && 117 u8_validate(req->id1domain, strlen(req->id1domain), 118 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 119 return (IDMAP_ERR_BAD_UTF8); 120 } 121 122 return (IDMAP_SUCCESS); 123 } 124 125 static 126 int 127 validate_rule(idmap_namerule *rule) 128 { 129 int e; 130 131 if (!EMPTY_STRING(rule->winname) && 132 u8_validate(rule->winname, strlen(rule->winname), 133 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 134 return (IDMAP_ERR_BAD_UTF8); 135 136 if (!EMPTY_STRING(rule->windomain) && 137 u8_validate(rule->windomain, strlen(rule->windomain), 138 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 139 return (IDMAP_ERR_BAD_UTF8); 140 141 return (IDMAP_SUCCESS); 142 143 } 144 145 static 146 bool_t 147 validate_rules(idmap_update_batch *batch) 148 { 149 idmap_update_op *up; 150 int i; 151 152 for (i = 0; i < batch->idmap_update_batch_len; i++) { 153 up = &(batch->idmap_update_batch_val[i]); 154 if (validate_rule(&(up->idmap_update_op_u.rule)) 155 != IDMAP_SUCCESS) 156 return (IDMAP_ERR_BAD_UTF8); 157 } 158 159 return (IDMAP_SUCCESS); 160 } 161 162 /* ARGSUSED */ 163 bool_t 164 idmap_get_mapped_ids_1_svc(idmap_mapping_batch batch, 165 idmap_ids_res *result, struct svc_req *rqstp) 166 { 167 sqlite *cache = NULL, *db = NULL; 168 lookup_state_t state; 169 idmap_retcode retcode; 170 uint_t i; 171 172 /* Init */ 173 (void) memset(result, 0, sizeof (*result)); 174 (void) memset(&state, 0, sizeof (state)); 175 176 /* Return success if nothing was requested */ 177 if (batch.idmap_mapping_batch_len < 1) 178 goto out; 179 180 /* Get cache handle */ 181 result->retcode = get_cache_handle(&cache); 182 if (result->retcode != IDMAP_SUCCESS) 183 goto out; 184 185 /* Get db handle */ 186 result->retcode = get_db_handle(&db); 187 if (result->retcode != IDMAP_SUCCESS) 188 goto out; 189 190 /* Allocate result array */ 191 result->ids.ids_val = calloc(batch.idmap_mapping_batch_len, 192 sizeof (idmap_id_res)); 193 if (result->ids.ids_val == NULL) { 194 idmapdlog(LOG_ERR, "Out of memory"); 195 result->retcode = IDMAP_ERR_MEMORY; 196 goto out; 197 } 198 result->ids.ids_len = batch.idmap_mapping_batch_len; 199 200 /* Allocate hash table to check for duplicate sids */ 201 state.sid_history = calloc(batch.idmap_mapping_batch_len, 202 sizeof (*state.sid_history)); 203 if (state.sid_history == NULL) { 204 idmapdlog(LOG_ERR, "Out of memory"); 205 result->retcode = IDMAP_ERR_MEMORY; 206 goto out; 207 } 208 state.sid_history_size = batch.idmap_mapping_batch_len; 209 for (i = 0; i < state.sid_history_size; i++) { 210 state.sid_history[i].key = state.sid_history_size; 211 state.sid_history[i].next = state.sid_history_size; 212 } 213 state.batch = &batch; 214 state.result = result; 215 216 /* Get directory-based name mapping info */ 217 result->retcode = get_ds_namemap_type(&state); 218 if (result->retcode != IDMAP_SUCCESS) 219 goto out; 220 221 /* Init our 'done' flags */ 222 state.sid2pid_done = state.pid2sid_done = TRUE; 223 224 /* First stage */ 225 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 226 state.curpos = i; 227 (void) sanitize_mapping_request( 228 &batch.idmap_mapping_batch_val[i]); 229 if (IS_BATCH_SID(batch, i)) { 230 retcode = sid2pid_first_pass( 231 &state, 232 cache, 233 &batch.idmap_mapping_batch_val[i], 234 &result->ids.ids_val[i]); 235 } else if (IS_BATCH_UID(batch, i)) { 236 retcode = pid2sid_first_pass( 237 &state, 238 cache, 239 &batch.idmap_mapping_batch_val[i], 240 &result->ids.ids_val[i], 1, 0); 241 } else if (IS_BATCH_GID(batch, i)) { 242 retcode = pid2sid_first_pass( 243 &state, 244 cache, 245 &batch.idmap_mapping_batch_val[i], 246 &result->ids.ids_val[i], 0, 0); 247 } else { 248 result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE; 249 continue; 250 } 251 if (IDMAP_FATAL_ERROR(retcode)) { 252 result->retcode = retcode; 253 goto out; 254 } 255 } 256 257 /* Check if we are done */ 258 if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 259 goto out; 260 261 /* 262 * native LDAP lookups: 263 * If nldap or mixed mode is enabled then pid2sid mapping requests 264 * need to lookup native LDAP directory service by uid/gid to get 265 * winname and unixname. 266 */ 267 if (state.nldap_nqueries) { 268 retcode = nldap_lookup_batch(&state, &batch, result); 269 if (IDMAP_FATAL_ERROR(retcode)) { 270 result->retcode = retcode; 271 goto out; 272 } 273 } 274 275 /* 276 * AD lookups: 277 * 1. The pid2sid requests in the preceding step which successfully 278 * retrieved winname from native LDAP objects will now need to 279 * lookup AD by winname to get sid. 280 * 2. The sid2pid requests will need to lookup AD by sid to get 281 * winname and unixname (AD or mixed mode). 282 * 3. If AD-based name mapping is enabled then pid2sid mapping 283 * requests need to lookup AD by unixname to get winname and sid. 284 */ 285 if (state.ad_nqueries) { 286 retcode = ad_lookup_batch(&state, &batch, result); 287 if (IDMAP_FATAL_ERROR(retcode)) { 288 result->retcode = retcode; 289 goto out; 290 } 291 } 292 293 /* 294 * native LDAP lookups: 295 * If nldap mode is enabled then sid2pid mapping requests 296 * which successfully retrieved winname from AD objects in the 297 * preceding step, will now need to lookup native LDAP directory 298 * service by winname to get unixname and pid. 299 */ 300 if (state.nldap_nqueries) { 301 retcode = nldap_lookup_batch(&state, &batch, result); 302 if (IDMAP_FATAL_ERROR(retcode)) { 303 result->retcode = retcode; 304 goto out; 305 } 306 } 307 308 /* Reset 'done' flags */ 309 state.sid2pid_done = state.pid2sid_done = TRUE; 310 311 /* Second stage */ 312 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 313 state.curpos = i; 314 if (IS_BATCH_SID(batch, i)) { 315 retcode = sid2pid_second_pass( 316 &state, 317 cache, 318 db, 319 &batch.idmap_mapping_batch_val[i], 320 &result->ids.ids_val[i]); 321 } else if (IS_BATCH_UID(batch, i)) { 322 retcode = pid2sid_second_pass( 323 &state, 324 cache, 325 db, 326 &batch.idmap_mapping_batch_val[i], 327 &result->ids.ids_val[i], 1); 328 } else if (IS_BATCH_GID(batch, i)) { 329 retcode = pid2sid_second_pass( 330 &state, 331 cache, 332 db, 333 &batch.idmap_mapping_batch_val[i], 334 &result->ids.ids_val[i], 0); 335 } else { 336 /* First stage has already set the error */ 337 continue; 338 } 339 if (IDMAP_FATAL_ERROR(retcode)) { 340 result->retcode = retcode; 341 goto out; 342 } 343 } 344 345 /* Check if we are done */ 346 if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 347 goto out; 348 349 /* Reset our 'done' flags */ 350 state.sid2pid_done = state.pid2sid_done = TRUE; 351 352 /* Update cache in a single transaction */ 353 if (sql_exec_no_cb(cache, IDMAP_CACHENAME, "BEGIN TRANSACTION;") 354 != IDMAP_SUCCESS) 355 goto out; 356 357 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 358 state.curpos = i; 359 if (IS_BATCH_SID(batch, i)) { 360 (void) update_cache_sid2pid( 361 &state, 362 cache, 363 &batch.idmap_mapping_batch_val[i], 364 &result->ids.ids_val[i]); 365 } else if ((IS_BATCH_UID(batch, i)) || 366 (IS_BATCH_GID(batch, i))) { 367 (void) update_cache_pid2sid( 368 &state, 369 cache, 370 &batch.idmap_mapping_batch_val[i], 371 &result->ids.ids_val[i]); 372 } 373 } 374 375 /* Commit if we have at least one successful update */ 376 if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE) 377 (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 378 "COMMIT TRANSACTION;"); 379 else 380 (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 381 "END TRANSACTION;"); 382 383 out: 384 cleanup_lookup_state(&state); 385 if (IDMAP_ERROR(result->retcode)) { 386 xdr_free(xdr_idmap_ids_res, (caddr_t)result); 387 result->ids.ids_len = 0; 388 result->ids.ids_val = NULL; 389 } 390 result->retcode = idmap_stat4prot(result->retcode); 391 return (TRUE); 392 } 393 394 395 /* ARGSUSED */ 396 static 397 int 398 list_mappings_cb(void *parg, int argc, char **argv, char **colnames) 399 { 400 list_cb_data_t *cb_data; 401 char *str; 402 idmap_mappings_res *result; 403 idmap_retcode retcode; 404 int w2u, u2w; 405 char *end; 406 static int validated_column_names = 0; 407 idmap_how *how; 408 409 cb_data = (list_cb_data_t *)parg; 410 411 if (!validated_column_names) { 412 assert(strcmp(colnames[0], "rowid") == 0); 413 assert(strcmp(colnames[1], "sidprefix") == 0); 414 assert(strcmp(colnames[2], "rid") == 0); 415 assert(strcmp(colnames[3], "pid") == 0); 416 assert(strcmp(colnames[4], "w2u") == 0); 417 assert(strcmp(colnames[5], "u2w") == 0); 418 assert(strcmp(colnames[6], "windomain") == 0); 419 assert(strcmp(colnames[7], "canon_winname") == 0); 420 assert(strcmp(colnames[8], "unixname") == 0); 421 assert(strcmp(colnames[9], "is_user") == 0); 422 assert(strcmp(colnames[10], "is_wuser") == 0); 423 assert(strcmp(colnames[11], "map_type") == 0); 424 assert(strcmp(colnames[12], "map_dn") == 0); 425 assert(strcmp(colnames[13], "map_attr") == 0); 426 assert(strcmp(colnames[14], "map_value") == 0); 427 assert(strcmp(colnames[15], "map_windomain") == 0); 428 assert(strcmp(colnames[16], "map_winname") == 0); 429 assert(strcmp(colnames[17], "map_unixname") == 0); 430 assert(strcmp(colnames[18], "map_is_nt4") == 0); 431 validated_column_names = 1; 432 } 433 434 result = (idmap_mappings_res *)cb_data->result; 435 436 _VALIDATE_LIST_CB_DATA(19, &result->mappings.mappings_val, 437 sizeof (idmap_mapping)); 438 439 result->mappings.mappings_len++; 440 441 if ((str = strdup(argv[1])) == NULL) 442 return (1); 443 result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix = 444 str; 445 result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid = 446 strtoul(argv[2], &end, 10); 447 result->mappings.mappings_val[cb_data->next].id1.idtype = 448 strtol(argv[10], &end, 10) ? IDMAP_USID : IDMAP_GSID; 449 450 result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid = 451 strtoul(argv[3], &end, 10); 452 result->mappings.mappings_val[cb_data->next].id2.idtype = 453 strtol(argv[9], &end, 10) ? IDMAP_UID : IDMAP_GID; 454 455 w2u = argv[4] ? strtol(argv[4], &end, 10) : 0; 456 u2w = argv[5] ? strtol(argv[5], &end, 10) : 0; 457 458 if (w2u > 0 && u2w == 0) 459 result->mappings.mappings_val[cb_data->next].direction = 460 IDMAP_DIRECTION_W2U; 461 else if (w2u == 0 && u2w > 0) 462 result->mappings.mappings_val[cb_data->next].direction = 463 IDMAP_DIRECTION_U2W; 464 else 465 result->mappings.mappings_val[cb_data->next].direction = 466 IDMAP_DIRECTION_BI; 467 468 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1domain, 469 argv[6]); 470 471 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1name, 472 argv[7]); 473 474 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id2name, 475 argv[8]); 476 477 if (cb_data->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 478 how = &result->mappings.mappings_val[cb_data->next].info.how; 479 how->map_type = strtoul(argv[11], &end, 10); 480 switch (how->map_type) { 481 case IDMAP_MAP_TYPE_DS_AD: 482 how->idmap_how_u.ad.dn = 483 strdup(argv[12]); 484 how->idmap_how_u.ad.attr = 485 strdup(argv[13]); 486 how->idmap_how_u.ad.value = 487 strdup(argv[14]); 488 break; 489 490 case IDMAP_MAP_TYPE_DS_NLDAP: 491 how->idmap_how_u.nldap.dn = 492 strdup(argv[12]); 493 how->idmap_how_u.nldap.attr = 494 strdup(argv[13]); 495 how->idmap_how_u.nldap.value = 496 strdup(argv[14]); 497 break; 498 499 case IDMAP_MAP_TYPE_RULE_BASED: 500 how->idmap_how_u.rule.windomain = 501 strdup(argv[15]); 502 how->idmap_how_u.rule.winname = 503 strdup(argv[16]); 504 how->idmap_how_u.rule.unixname = 505 strdup(argv[17]); 506 how->idmap_how_u.rule.is_nt4 = 507 strtoul(argv[18], &end, 10); 508 how->idmap_how_u.rule.is_user = 509 strtol(argv[9], &end, 10); 510 how->idmap_how_u.rule.is_wuser = 511 strtol(argv[10], &end, 10); 512 break; 513 514 case IDMAP_MAP_TYPE_EPHEMERAL: 515 break; 516 517 case IDMAP_MAP_TYPE_LOCAL_SID: 518 break; 519 520 default: 521 /* Unknow mapping type */ 522 assert(FALSE); 523 } 524 525 } 526 527 result->lastrowid = strtoll(argv[0], &end, 10); 528 cb_data->next++; 529 result->retcode = IDMAP_SUCCESS; 530 return (0); 531 } 532 533 534 /* ARGSUSED */ 535 bool_t 536 idmap_list_mappings_1_svc(int64_t lastrowid, uint64_t limit, int32_t flag, 537 idmap_mappings_res *result, struct svc_req *rqstp) 538 { 539 sqlite *cache = NULL; 540 char lbuf[30], rbuf[30]; 541 uint64_t maxlimit; 542 idmap_retcode retcode; 543 char *sql = NULL; 544 time_t curtime; 545 546 (void) memset(result, 0, sizeof (*result)); 547 lbuf[0] = rbuf[0] = 0; 548 549 /* Current time */ 550 errno = 0; 551 if ((curtime = time(NULL)) == (time_t)-1) { 552 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 553 strerror(errno)); 554 retcode = IDMAP_ERR_INTERNAL; 555 goto out; 556 } 557 558 RDLOCK_CONFIG(); 559 maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 560 UNLOCK_CONFIG(); 561 562 /* Get cache handle */ 563 result->retcode = get_cache_handle(&cache); 564 if (result->retcode != IDMAP_SUCCESS) 565 goto out; 566 567 result->retcode = IDMAP_ERR_INTERNAL; 568 569 /* Create LIMIT expression. */ 570 if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 571 limit = maxlimit; 572 if (limit > 0) 573 (void) snprintf(lbuf, sizeof (lbuf), 574 "LIMIT %" PRIu64, limit + 1ULL); 575 576 (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 577 578 /* 579 * Combine all the above into a giant SELECT statement that 580 * will return the requested mappings 581 */ 582 583 sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, " 584 "u2w, windomain, canon_winname, unixname, is_user, is_wuser, " 585 "map_type, map_dn, map_attr, map_value, map_windomain, " 586 "map_winname, map_unixname, map_is_nt4 " 587 "FROM idmap_cache WHERE %s AND " 588 "(pid >= 2147483648 OR (expiration = 0 OR " 589 "expiration ISNULL OR expiration > %d)) " 590 "%s;", 591 rbuf, curtime, lbuf); 592 if (sql == NULL) { 593 idmapdlog(LOG_ERR, "Out of memory"); 594 goto out; 595 } 596 597 /* Execute the SQL statement and update the return buffer */ 598 PROCESS_LIST_SVC_SQL(retcode, cache, IDMAP_CACHENAME, sql, limit, 599 flag, list_mappings_cb, result, result->mappings.mappings_len); 600 601 out: 602 if (sql) 603 sqlite_freemem(sql); 604 if (IDMAP_ERROR(result->retcode)) 605 (void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 606 result->retcode = idmap_stat4prot(result->retcode); 607 return (TRUE); 608 } 609 610 611 /* ARGSUSED */ 612 static 613 int 614 list_namerules_cb(void *parg, int argc, char **argv, char **colnames) 615 { 616 list_cb_data_t *cb_data; 617 idmap_namerules_res *result; 618 idmap_retcode retcode; 619 int w2u_order, u2w_order; 620 char *end; 621 static int validated_column_names = 0; 622 623 if (!validated_column_names) { 624 assert(strcmp(colnames[0], "rowid") == 0); 625 assert(strcmp(colnames[1], "is_user") == 0); 626 assert(strcmp(colnames[2], "is_wuser") == 0); 627 assert(strcmp(colnames[3], "windomain") == 0); 628 assert(strcmp(colnames[4], "winname_display") == 0); 629 assert(strcmp(colnames[5], "is_nt4") == 0); 630 assert(strcmp(colnames[6], "unixname") == 0); 631 assert(strcmp(colnames[7], "w2u_order") == 0); 632 assert(strcmp(colnames[8], "u2w_order") == 0); 633 validated_column_names = 1; 634 } 635 636 cb_data = (list_cb_data_t *)parg; 637 result = (idmap_namerules_res *)cb_data->result; 638 639 _VALIDATE_LIST_CB_DATA(9, &result->rules.rules_val, 640 sizeof (idmap_namerule)); 641 642 result->rules.rules_len++; 643 644 result->rules.rules_val[cb_data->next].is_user = 645 strtol(argv[1], &end, 10); 646 647 result->rules.rules_val[cb_data->next].is_wuser = 648 strtol(argv[2], &end, 10); 649 650 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].windomain, 651 argv[3]); 652 653 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].winname, 654 argv[4]); 655 656 result->rules.rules_val[cb_data->next].is_nt4 = 657 strtol(argv[5], &end, 10); 658 659 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].unixname, 660 argv[6]); 661 662 w2u_order = argv[7] ? strtol(argv[7], &end, 10) : 0; 663 u2w_order = argv[8] ? strtol(argv[8], &end, 10) : 0; 664 665 if (w2u_order > 0 && u2w_order == 0) 666 result->rules.rules_val[cb_data->next].direction = 667 IDMAP_DIRECTION_W2U; 668 else if (w2u_order == 0 && u2w_order > 0) 669 result->rules.rules_val[cb_data->next].direction = 670 IDMAP_DIRECTION_U2W; 671 else 672 result->rules.rules_val[cb_data->next].direction = 673 IDMAP_DIRECTION_BI; 674 675 result->lastrowid = strtoll(argv[0], &end, 10); 676 cb_data->next++; 677 result->retcode = IDMAP_SUCCESS; 678 return (0); 679 } 680 681 682 /* ARGSUSED */ 683 bool_t 684 idmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid, 685 uint64_t limit, idmap_namerules_res *result, 686 struct svc_req *rqstp) 687 { 688 689 sqlite *db = NULL; 690 char w2ubuf[15], u2wbuf[15]; 691 char lbuf[30], rbuf[30]; 692 char *sql = NULL; 693 char *expr = NULL; 694 uint64_t maxlimit; 695 idmap_retcode retcode; 696 697 (void) memset(result, 0, sizeof (*result)); 698 lbuf[0] = rbuf[0] = 0; 699 700 result->retcode = validate_rule(&rule); 701 if (result->retcode != IDMAP_SUCCESS) 702 goto out; 703 704 RDLOCK_CONFIG(); 705 maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 706 UNLOCK_CONFIG(); 707 708 /* Get db handle */ 709 result->retcode = get_db_handle(&db); 710 if (result->retcode != IDMAP_SUCCESS) 711 goto out; 712 713 result->retcode = IDMAP_ERR_INTERNAL; 714 715 w2ubuf[0] = u2wbuf[0] = 0; 716 if (rule.direction == IDMAP_DIRECTION_BI) { 717 (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 718 (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 719 } else if (rule.direction == IDMAP_DIRECTION_W2U) { 720 (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 721 (void) snprintf(u2wbuf, sizeof (u2wbuf), 722 "AND (u2w_order = 0 OR u2w_order ISNULL)"); 723 } else if (rule.direction == IDMAP_DIRECTION_U2W) { 724 (void) snprintf(w2ubuf, sizeof (w2ubuf), 725 "AND (w2u_order = 0 OR w2u_order ISNULL)"); 726 (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 727 } 728 729 result->retcode = gen_sql_expr_from_rule(&rule, &expr); 730 if (result->retcode != IDMAP_SUCCESS) 731 goto out; 732 733 /* Create LIMIT expression. */ 734 if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 735 limit = maxlimit; 736 if (limit > 0) 737 (void) snprintf(lbuf, sizeof (lbuf), 738 "LIMIT %" PRIu64, limit + 1ULL); 739 740 (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 741 742 /* 743 * Combine all the above into a giant SELECT statement that 744 * will return the requested rules 745 */ 746 sql = sqlite_mprintf("SELECT rowid, is_user, is_wuser, windomain, " 747 "winname_display, is_nt4, unixname, w2u_order, u2w_order " 748 "FROM namerules WHERE " 749 " %s %s %s %s %s;", 750 rbuf, expr, w2ubuf, u2wbuf, lbuf); 751 752 if (sql == NULL) { 753 idmapdlog(LOG_ERR, "Out of memory"); 754 goto out; 755 } 756 757 /* Execute the SQL statement and update the return buffer */ 758 PROCESS_LIST_SVC_SQL(retcode, db, IDMAP_DBNAME, sql, limit, 759 0, list_namerules_cb, result, result->rules.rules_len); 760 761 out: 762 if (expr) 763 sqlite_freemem(expr); 764 if (sql) 765 sqlite_freemem(sql); 766 if (IDMAP_ERROR(result->retcode)) 767 (void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result); 768 result->retcode = idmap_stat4prot(result->retcode); 769 return (TRUE); 770 } 771 772 #define IDMAP_RULES_AUTH "solaris.admin.idmap.rules" 773 static int 774 verify_rules_auth(struct svc_req *rqstp) 775 { 776 ucred_t *uc = NULL; 777 uid_t uid; 778 char buf[1024]; 779 struct passwd pwd; 780 781 if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) { 782 idmapdlog(LOG_ERR, "svc_getcallerucred failed during " 783 "authorization (%s)", strerror(errno)); 784 return (-1); 785 } 786 787 uid = ucred_geteuid(uc); 788 if (uid == (uid_t)-1) { 789 idmapdlog(LOG_ERR, "ucred_geteuid failed during " 790 "authorization (%s)", strerror(errno)); 791 ucred_free(uc); 792 return (-1); 793 } 794 795 if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) { 796 idmapdlog(LOG_ERR, "getpwuid_r(%u) failed during " 797 "authorization (%s)", uid, strerror(errno)); 798 ucred_free(uc); 799 return (-1); 800 } 801 802 if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) { 803 idmapdlog(LOG_INFO, "%s is not authorized (%s)", 804 pwd.pw_name, IDMAP_RULES_AUTH); 805 ucred_free(uc); 806 return (-1); 807 } 808 809 ucred_free(uc); 810 return (1); 811 } 812 813 /* 814 * Meaning of the return values is the following: For retcode == 815 * IDMAP_SUCCESS, everything went OK and error_index is 816 * undefined. Otherwise, error_index >=0 shows the failed batch 817 * element. errro_index == -1 indicates failure at the beginning, 818 * error_index == -2 at the end. 819 */ 820 821 /* ARGSUSED */ 822 bool_t 823 idmap_update_1_svc(idmap_update_batch batch, idmap_update_res *res, 824 struct svc_req *rqstp) 825 { 826 sqlite *db = NULL; 827 idmap_update_op *up; 828 int i; 829 int trans = FALSE; 830 831 res->error_index = -1; 832 (void) memset(&res->error_rule, 0, sizeof (res->error_rule)); 833 (void) memset(&res->conflict_rule, 0, sizeof (res->conflict_rule)); 834 835 if (verify_rules_auth(rqstp) < 0) { 836 res->retcode = IDMAP_ERR_PERMISSION_DENIED; 837 goto out; 838 } 839 840 if (batch.idmap_update_batch_len == 0 || 841 batch.idmap_update_batch_val == NULL) { 842 res->retcode = IDMAP_SUCCESS; 843 goto out; 844 } 845 846 res->retcode = validate_rules(&batch); 847 if (res->retcode != IDMAP_SUCCESS) 848 goto out; 849 850 /* Get db handle */ 851 res->retcode = get_db_handle(&db); 852 if (res->retcode != IDMAP_SUCCESS) 853 goto out; 854 855 res->retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "BEGIN TRANSACTION;"); 856 if (res->retcode != IDMAP_SUCCESS) 857 goto out; 858 trans = TRUE; 859 860 for (i = 0; i < batch.idmap_update_batch_len; i++) { 861 up = &batch.idmap_update_batch_val[i]; 862 switch (up->opnum) { 863 case OP_NONE: 864 res->retcode = IDMAP_SUCCESS; 865 break; 866 case OP_ADD_NAMERULE: 867 res->retcode = add_namerule(db, 868 &up->idmap_update_op_u.rule); 869 break; 870 case OP_RM_NAMERULE: 871 res->retcode = rm_namerule(db, 872 &up->idmap_update_op_u.rule); 873 break; 874 case OP_FLUSH_NAMERULES: 875 res->retcode = flush_namerules(db); 876 break; 877 default: 878 res->retcode = IDMAP_ERR_NOTSUPPORTED; 879 break; 880 }; 881 882 if (res->retcode != IDMAP_SUCCESS) { 883 res->error_index = i; 884 if (up->opnum == OP_ADD_NAMERULE || 885 up->opnum == OP_RM_NAMERULE) { 886 idmap_stat r2 = 887 idmap_namerule_cpy(&res->error_rule, 888 &up->idmap_update_op_u.rule); 889 if (r2 != IDMAP_SUCCESS) 890 res->retcode = r2; 891 } 892 goto out; 893 } 894 } 895 896 out: 897 if (trans) { 898 if (res->retcode == IDMAP_SUCCESS) { 899 res->retcode = 900 sql_exec_no_cb(db, IDMAP_DBNAME, 901 "COMMIT TRANSACTION;"); 902 if (res->retcode != IDMAP_SUCCESS) 903 res->error_index = -2; 904 } 905 else 906 (void) sql_exec_no_cb(db, IDMAP_DBNAME, 907 "ROLLBACK TRANSACTION;"); 908 } 909 910 res->retcode = idmap_stat4prot(res->retcode); 911 912 return (TRUE); 913 } 914 915 916 /* ARGSUSED */ 917 bool_t 918 idmap_get_mapped_id_by_name_1_svc(idmap_mapping request, 919 idmap_mappings_res *result, struct svc_req *rqstp) 920 { 921 sqlite *cache = NULL, *db = NULL; 922 923 /* Init */ 924 (void) memset(result, 0, sizeof (*result)); 925 926 result->retcode = validate_mapped_id_by_name_req(&request); 927 if (result->retcode != IDMAP_SUCCESS) 928 goto out; 929 930 /* Get cache handle */ 931 result->retcode = get_cache_handle(&cache); 932 if (result->retcode != IDMAP_SUCCESS) 933 goto out; 934 935 /* Get db handle */ 936 result->retcode = get_db_handle(&db); 937 if (result->retcode != IDMAP_SUCCESS) 938 goto out; 939 940 /* Allocate result */ 941 result->mappings.mappings_val = calloc(1, sizeof (idmap_mapping)); 942 if (result->mappings.mappings_val == NULL) { 943 idmapdlog(LOG_ERR, "Out of memory"); 944 result->retcode = IDMAP_ERR_MEMORY; 945 goto out; 946 } 947 result->mappings.mappings_len = 1; 948 949 950 if (IS_REQUEST_SID(request, 1)) { 951 result->retcode = get_w2u_mapping( 952 cache, 953 db, 954 &request, 955 result->mappings.mappings_val); 956 } else if (IS_REQUEST_UID(request)) { 957 result->retcode = get_u2w_mapping( 958 cache, 959 db, 960 &request, 961 result->mappings.mappings_val, 962 1); 963 } else if (IS_REQUEST_GID(request)) { 964 result->retcode = get_u2w_mapping( 965 cache, 966 db, 967 &request, 968 result->mappings.mappings_val, 969 0); 970 } else { 971 result->retcode = IDMAP_ERR_IDTYPE; 972 } 973 974 out: 975 if (IDMAP_FATAL_ERROR(result->retcode)) { 976 xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 977 result->mappings.mappings_len = 0; 978 result->mappings.mappings_val = NULL; 979 } 980 result->retcode = idmap_stat4prot(result->retcode); 981 return (TRUE); 982 } 983 984 985 /* ARGSUSED */ 986 int 987 idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, 988 caddr_t result) 989 { 990 (void) xdr_free(xdr_result, result); 991 return (TRUE); 992 } 993