1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 27 /* 28 * Service routines 29 */ 30 31 #include "idmapd.h" 32 #include "idmap_priv.h" 33 #include "nldaputils.h" 34 #include <signal.h> 35 #include <thread.h> 36 #include <string.h> 37 #include <strings.h> 38 #include <errno.h> 39 #include <assert.h> 40 #include <sys/types.h> 41 #include <sys/stat.h> 42 #include <ucred.h> 43 #include <pwd.h> 44 #include <auth_attr.h> 45 #include <secdb.h> 46 #include <sys/u8_textprep.h> 47 #include <note.h> 48 49 #define _VALIDATE_LIST_CB_DATA(col, val, siz)\ 50 retcode = validate_list_cb_data(cb_data, argc, argv, col,\ 51 (uchar_t **)val, siz);\ 52 if (retcode == IDMAP_NEXT) {\ 53 result->retcode = IDMAP_NEXT;\ 54 return (0);\ 55 } else if (retcode < 0) {\ 56 result->retcode = retcode;\ 57 return (1);\ 58 } 59 60 #define PROCESS_LIST_SVC_SQL(rcode, db, dbname, sql, limit, flag, cb, res, len)\ 61 rcode = process_list_svc_sql(db, dbname, sql, limit, flag, cb, res);\ 62 if (rcode == IDMAP_ERR_BUSY)\ 63 res->retcode = IDMAP_ERR_BUSY;\ 64 else if (rcode == IDMAP_SUCCESS && len == 0)\ 65 res->retcode = IDMAP_ERR_NOTFOUND; 66 67 68 #define STRDUP_OR_FAIL(to, from) \ 69 if ((from) == NULL) \ 70 to = NULL; \ 71 else { \ 72 if ((to = strdup(from)) == NULL) \ 73 return (1); \ 74 } 75 76 #define STRDUP_CHECK(to, from) \ 77 if ((from) != NULL) { \ 78 to = strdup(from); \ 79 if (to == NULL) { \ 80 result->retcode = IDMAP_ERR_MEMORY; \ 81 goto out; \ 82 } \ 83 } 84 85 /* ARGSUSED */ 86 bool_t 87 idmap_null_1_svc(void *result, struct svc_req *rqstp) 88 { 89 return (TRUE); 90 } 91 92 /* 93 * RPC layer allocates empty strings to replace NULL char *. 94 * This utility function frees these empty strings. 95 */ 96 static 97 void 98 sanitize_mapping_request(idmap_mapping *req) 99 { 100 free(req->id1name); 101 req->id1name = NULL; 102 free(req->id1domain); 103 req->id1domain = NULL; 104 free(req->id2name); 105 req->id2name = NULL; 106 free(req->id2domain); 107 req->id2domain = NULL; 108 req->direction = _IDMAP_F_DONE; 109 } 110 111 static 112 int 113 validate_mapped_id_by_name_req(idmap_mapping *req) 114 { 115 int e; 116 117 if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req)) 118 return (IDMAP_SUCCESS); 119 120 if (IS_REQUEST_SID(*req, 1)) { 121 if (!EMPTY_STRING(req->id1name) && 122 u8_validate(req->id1name, strlen(req->id1name), 123 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 124 return (IDMAP_ERR_BAD_UTF8); 125 if (!EMPTY_STRING(req->id1domain) && 126 u8_validate(req->id1domain, strlen(req->id1domain), 127 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 128 return (IDMAP_ERR_BAD_UTF8); 129 } 130 131 return (IDMAP_SUCCESS); 132 } 133 134 static 135 int 136 validate_rule(idmap_namerule *rule) 137 { 138 int e; 139 140 if (!EMPTY_STRING(rule->winname) && 141 u8_validate(rule->winname, strlen(rule->winname), 142 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 143 return (IDMAP_ERR_BAD_UTF8); 144 145 if (!EMPTY_STRING(rule->windomain) && 146 u8_validate(rule->windomain, strlen(rule->windomain), 147 NULL, U8_VALIDATE_ENTIRE, &e) < 0) 148 return (IDMAP_ERR_BAD_UTF8); 149 150 return (IDMAP_SUCCESS); 151 152 } 153 154 static 155 bool_t 156 validate_rules(idmap_update_batch *batch) 157 { 158 idmap_update_op *up; 159 int i; 160 161 for (i = 0; i < batch->idmap_update_batch_len; i++) { 162 up = &(batch->idmap_update_batch_val[i]); 163 if (validate_rule(&(up->idmap_update_op_u.rule)) 164 != IDMAP_SUCCESS) 165 return (IDMAP_ERR_BAD_UTF8); 166 } 167 168 return (IDMAP_SUCCESS); 169 } 170 171 /* ARGSUSED */ 172 bool_t 173 idmap_get_mapped_ids_1_svc(idmap_mapping_batch batch, 174 idmap_ids_res *result, struct svc_req *rqstp) 175 { 176 sqlite *cache = NULL, *db = NULL; 177 lookup_state_t state; 178 idmap_retcode retcode; 179 uint_t i; 180 181 /* Init */ 182 (void) memset(result, 0, sizeof (*result)); 183 (void) memset(&state, 0, sizeof (state)); 184 185 /* Return success if nothing was requested */ 186 if (batch.idmap_mapping_batch_len < 1) 187 goto out; 188 189 /* Get cache handle */ 190 result->retcode = get_cache_handle(&cache); 191 if (result->retcode != IDMAP_SUCCESS) 192 goto out; 193 state.cache = cache; 194 195 /* Get db handle */ 196 result->retcode = get_db_handle(&db); 197 if (result->retcode != IDMAP_SUCCESS) 198 goto out; 199 state.db = db; 200 201 /* Allocate result array */ 202 result->ids.ids_val = calloc(batch.idmap_mapping_batch_len, 203 sizeof (idmap_id_res)); 204 if (result->ids.ids_val == NULL) { 205 idmapdlog(LOG_ERR, "Out of memory"); 206 result->retcode = IDMAP_ERR_MEMORY; 207 goto out; 208 } 209 result->ids.ids_len = batch.idmap_mapping_batch_len; 210 211 /* Allocate hash table to check for duplicate sids */ 212 state.sid_history = calloc(batch.idmap_mapping_batch_len, 213 sizeof (*state.sid_history)); 214 if (state.sid_history == NULL) { 215 idmapdlog(LOG_ERR, "Out of memory"); 216 result->retcode = IDMAP_ERR_MEMORY; 217 goto out; 218 } 219 state.sid_history_size = batch.idmap_mapping_batch_len; 220 for (i = 0; i < state.sid_history_size; i++) { 221 state.sid_history[i].key = state.sid_history_size; 222 state.sid_history[i].next = state.sid_history_size; 223 } 224 state.batch = &batch; 225 state.result = result; 226 227 /* Get directory-based name mapping info */ 228 result->retcode = load_cfg_in_state(&state); 229 if (result->retcode != IDMAP_SUCCESS) 230 goto out; 231 232 /* Init our 'done' flags */ 233 state.sid2pid_done = state.pid2sid_done = TRUE; 234 235 /* First stage */ 236 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 237 state.curpos = i; 238 (void) sanitize_mapping_request( 239 &batch.idmap_mapping_batch_val[i]); 240 if (IS_BATCH_SID(batch, i)) { 241 retcode = sid2pid_first_pass( 242 &state, 243 &batch.idmap_mapping_batch_val[i], 244 &result->ids.ids_val[i]); 245 } else if (IS_BATCH_UID(batch, i)) { 246 retcode = pid2sid_first_pass( 247 &state, 248 &batch.idmap_mapping_batch_val[i], 249 &result->ids.ids_val[i], 1, 0); 250 } else if (IS_BATCH_GID(batch, i)) { 251 retcode = pid2sid_first_pass( 252 &state, 253 &batch.idmap_mapping_batch_val[i], 254 &result->ids.ids_val[i], 0, 0); 255 } else { 256 result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE; 257 continue; 258 } 259 if (IDMAP_FATAL_ERROR(retcode)) { 260 result->retcode = retcode; 261 goto out; 262 } 263 } 264 265 /* Check if we are done */ 266 if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 267 goto out; 268 269 /* 270 * native LDAP lookups: 271 * pid2sid: 272 * - nldap or mixed mode. Lookup nldap by pid or unixname to get 273 * winname. 274 * sid2pid: 275 * - nldap mode. Got winname and sid (either given or found in 276 * name_cache). Lookup nldap by winname to get pid and 277 * unixname. 278 */ 279 if (state.nldap_nqueries) { 280 retcode = nldap_lookup_batch(&state, &batch, result); 281 if (IDMAP_FATAL_ERROR(retcode)) { 282 result->retcode = retcode; 283 goto out; 284 } 285 } 286 287 /* 288 * AD lookups: 289 * pid2sid: 290 * - nldap or mixed mode. Got winname from nldap lookup. 291 * winname2sid could not be resolved locally. Lookup AD 292 * by winname to get sid. 293 * - ad mode. Got unixname. Lookup AD by unixname to get 294 * winname and sid. 295 * sid2pid: 296 * - ad or mixed mode. Lookup AD by sid or winname to get 297 * winname, sid and unixname. 298 * - any mode. Got either sid or winname but not both. Lookup 299 * AD by sid or winname to get winname, sid. 300 */ 301 if (state.ad_nqueries) { 302 retcode = ad_lookup_batch(&state, &batch, result); 303 if (IDMAP_FATAL_ERROR(retcode)) { 304 result->retcode = retcode; 305 goto out; 306 } 307 } 308 309 /* 310 * native LDAP lookups: 311 * sid2pid: 312 * - nldap mode. Got winname and sid from AD lookup. Lookup nldap 313 * by winname to get pid and unixname. 314 */ 315 if (state.nldap_nqueries) { 316 retcode = nldap_lookup_batch(&state, &batch, result); 317 if (IDMAP_FATAL_ERROR(retcode)) { 318 result->retcode = retcode; 319 goto out; 320 } 321 } 322 323 /* Reset 'done' flags */ 324 state.sid2pid_done = state.pid2sid_done = TRUE; 325 326 /* Second stage */ 327 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 328 state.curpos = i; 329 if (IS_BATCH_SID(batch, i)) { 330 retcode = sid2pid_second_pass( 331 &state, 332 &batch.idmap_mapping_batch_val[i], 333 &result->ids.ids_val[i]); 334 } else if (IS_BATCH_UID(batch, i)) { 335 retcode = pid2sid_second_pass( 336 &state, 337 &batch.idmap_mapping_batch_val[i], 338 &result->ids.ids_val[i], 1); 339 } else if (IS_BATCH_GID(batch, i)) { 340 retcode = pid2sid_second_pass( 341 &state, 342 &batch.idmap_mapping_batch_val[i], 343 &result->ids.ids_val[i], 0); 344 } else { 345 /* First stage has already set the error */ 346 continue; 347 } 348 if (IDMAP_FATAL_ERROR(retcode)) { 349 result->retcode = retcode; 350 goto out; 351 } 352 } 353 354 /* Check if we are done */ 355 if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE) 356 goto out; 357 358 /* Reset our 'done' flags */ 359 state.sid2pid_done = state.pid2sid_done = TRUE; 360 361 /* Update cache in a single transaction */ 362 if (sql_exec_no_cb(cache, IDMAP_CACHENAME, "BEGIN TRANSACTION;") 363 != IDMAP_SUCCESS) 364 goto out; 365 366 for (i = 0; i < batch.idmap_mapping_batch_len; i++) { 367 state.curpos = i; 368 if (IS_BATCH_SID(batch, i)) { 369 (void) update_cache_sid2pid( 370 &state, 371 &batch.idmap_mapping_batch_val[i], 372 &result->ids.ids_val[i]); 373 } else if ((IS_BATCH_UID(batch, i)) || 374 (IS_BATCH_GID(batch, i))) { 375 (void) update_cache_pid2sid( 376 &state, 377 &batch.idmap_mapping_batch_val[i], 378 &result->ids.ids_val[i]); 379 } 380 } 381 382 /* Commit if we have at least one successful update */ 383 if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE) 384 (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 385 "COMMIT TRANSACTION;"); 386 else 387 (void) sql_exec_no_cb(cache, IDMAP_CACHENAME, 388 "END TRANSACTION;"); 389 390 out: 391 cleanup_lookup_state(&state); 392 if (IDMAP_ERROR(result->retcode)) { 393 xdr_free(xdr_idmap_ids_res, (caddr_t)result); 394 result->ids.ids_len = 0; 395 result->ids.ids_val = NULL; 396 } 397 result->retcode = idmap_stat4prot(result->retcode); 398 return (TRUE); 399 } 400 401 402 /* ARGSUSED */ 403 static 404 int 405 list_mappings_cb(void *parg, int argc, char **argv, char **colnames) 406 { 407 list_cb_data_t *cb_data; 408 char *str; 409 idmap_mappings_res *result; 410 idmap_retcode retcode; 411 int w2u, u2w; 412 char *end; 413 static int validated_column_names = 0; 414 idmap_how *how; 415 416 cb_data = (list_cb_data_t *)parg; 417 418 if (!validated_column_names) { 419 assert(strcmp(colnames[0], "rowid") == 0); 420 assert(strcmp(colnames[1], "sidprefix") == 0); 421 assert(strcmp(colnames[2], "rid") == 0); 422 assert(strcmp(colnames[3], "pid") == 0); 423 assert(strcmp(colnames[4], "w2u") == 0); 424 assert(strcmp(colnames[5], "u2w") == 0); 425 assert(strcmp(colnames[6], "windomain") == 0); 426 assert(strcmp(colnames[7], "canon_winname") == 0); 427 assert(strcmp(colnames[8], "unixname") == 0); 428 assert(strcmp(colnames[9], "is_user") == 0); 429 assert(strcmp(colnames[10], "is_wuser") == 0); 430 assert(strcmp(colnames[11], "map_type") == 0); 431 assert(strcmp(colnames[12], "map_dn") == 0); 432 assert(strcmp(colnames[13], "map_attr") == 0); 433 assert(strcmp(colnames[14], "map_value") == 0); 434 assert(strcmp(colnames[15], "map_windomain") == 0); 435 assert(strcmp(colnames[16], "map_winname") == 0); 436 assert(strcmp(colnames[17], "map_unixname") == 0); 437 assert(strcmp(colnames[18], "map_is_nt4") == 0); 438 validated_column_names = 1; 439 } 440 441 result = (idmap_mappings_res *)cb_data->result; 442 443 _VALIDATE_LIST_CB_DATA(19, &result->mappings.mappings_val, 444 sizeof (idmap_mapping)); 445 446 result->mappings.mappings_len++; 447 448 if ((str = strdup(argv[1])) == NULL) 449 return (1); 450 result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix = 451 str; 452 result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid = 453 strtoul(argv[2], &end, 10); 454 result->mappings.mappings_val[cb_data->next].id1.idtype = 455 strtol(argv[10], &end, 10) ? IDMAP_USID : IDMAP_GSID; 456 457 result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid = 458 strtoul(argv[3], &end, 10); 459 result->mappings.mappings_val[cb_data->next].id2.idtype = 460 strtol(argv[9], &end, 10) ? IDMAP_UID : IDMAP_GID; 461 462 w2u = argv[4] ? strtol(argv[4], &end, 10) : 0; 463 u2w = argv[5] ? strtol(argv[5], &end, 10) : 0; 464 465 if (w2u > 0 && u2w == 0) 466 result->mappings.mappings_val[cb_data->next].direction = 467 IDMAP_DIRECTION_W2U; 468 else if (w2u == 0 && u2w > 0) 469 result->mappings.mappings_val[cb_data->next].direction = 470 IDMAP_DIRECTION_U2W; 471 else 472 result->mappings.mappings_val[cb_data->next].direction = 473 IDMAP_DIRECTION_BI; 474 475 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1domain, 476 argv[6]); 477 478 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1name, 479 argv[7]); 480 481 STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id2name, 482 argv[8]); 483 484 if (cb_data->flag & IDMAP_REQ_FLG_MAPPING_INFO) { 485 how = &result->mappings.mappings_val[cb_data->next].info.how; 486 how->map_type = strtoul(argv[11], &end, 10); 487 switch (how->map_type) { 488 case IDMAP_MAP_TYPE_DS_AD: 489 how->idmap_how_u.ad.dn = 490 strdup(argv[12]); 491 how->idmap_how_u.ad.attr = 492 strdup(argv[13]); 493 how->idmap_how_u.ad.value = 494 strdup(argv[14]); 495 break; 496 497 case IDMAP_MAP_TYPE_DS_NLDAP: 498 how->idmap_how_u.nldap.dn = 499 strdup(argv[12]); 500 how->idmap_how_u.nldap.attr = 501 strdup(argv[13]); 502 how->idmap_how_u.nldap.value = 503 strdup(argv[14]); 504 break; 505 506 case IDMAP_MAP_TYPE_RULE_BASED: 507 how->idmap_how_u.rule.windomain = 508 strdup(argv[15]); 509 how->idmap_how_u.rule.winname = 510 strdup(argv[16]); 511 how->idmap_how_u.rule.unixname = 512 strdup(argv[17]); 513 how->idmap_how_u.rule.is_nt4 = 514 strtoul(argv[18], &end, 10); 515 how->idmap_how_u.rule.is_user = 516 strtol(argv[9], &end, 10); 517 how->idmap_how_u.rule.is_wuser = 518 strtol(argv[10], &end, 10); 519 break; 520 521 case IDMAP_MAP_TYPE_EPHEMERAL: 522 break; 523 524 case IDMAP_MAP_TYPE_LOCAL_SID: 525 break; 526 527 case IDMAP_MAP_TYPE_IDMU: 528 how->idmap_how_u.idmu.dn = 529 strdup(argv[12]); 530 how->idmap_how_u.idmu.attr = 531 strdup(argv[13]); 532 how->idmap_how_u.idmu.value = 533 strdup(argv[14]); 534 break; 535 536 default: 537 /* Unknown mapping type */ 538 assert(FALSE); 539 } 540 541 } 542 543 result->lastrowid = strtoll(argv[0], &end, 10); 544 cb_data->next++; 545 result->retcode = IDMAP_SUCCESS; 546 return (0); 547 } 548 549 550 /* ARGSUSED */ 551 bool_t 552 idmap_list_mappings_1_svc(int64_t lastrowid, uint64_t limit, int32_t flag, 553 idmap_mappings_res *result, struct svc_req *rqstp) 554 { 555 sqlite *cache = NULL; 556 char lbuf[30], rbuf[30]; 557 uint64_t maxlimit; 558 idmap_retcode retcode; 559 char *sql = NULL; 560 time_t curtime; 561 562 (void) memset(result, 0, sizeof (*result)); 563 lbuf[0] = rbuf[0] = 0; 564 565 /* Current time */ 566 errno = 0; 567 if ((curtime = time(NULL)) == (time_t)-1) { 568 idmapdlog(LOG_ERR, "Failed to get current time (%s)", 569 strerror(errno)); 570 retcode = IDMAP_ERR_INTERNAL; 571 goto out; 572 } 573 574 RDLOCK_CONFIG(); 575 maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 576 UNLOCK_CONFIG(); 577 578 /* Get cache handle */ 579 result->retcode = get_cache_handle(&cache); 580 if (result->retcode != IDMAP_SUCCESS) 581 goto out; 582 583 result->retcode = IDMAP_ERR_INTERNAL; 584 585 /* Create LIMIT expression. */ 586 if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 587 limit = maxlimit; 588 if (limit > 0) 589 (void) snprintf(lbuf, sizeof (lbuf), 590 "LIMIT %" PRIu64, limit + 1ULL); 591 592 (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 593 594 /* 595 * Combine all the above into a giant SELECT statement that 596 * will return the requested mappings 597 */ 598 599 sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, " 600 "u2w, windomain, canon_winname, unixname, is_user, is_wuser, " 601 "map_type, map_dn, map_attr, map_value, map_windomain, " 602 "map_winname, map_unixname, map_is_nt4 " 603 "FROM idmap_cache WHERE %s AND " 604 "(pid >= 2147483648 OR (expiration = 0 OR " 605 "expiration ISNULL OR expiration > %d)) " 606 "%s;", 607 rbuf, curtime, lbuf); 608 if (sql == NULL) { 609 result->retcode = IDMAP_ERR_MEMORY; 610 idmapdlog(LOG_ERR, "Out of memory"); 611 goto out; 612 } 613 614 /* Execute the SQL statement and update the return buffer */ 615 PROCESS_LIST_SVC_SQL(retcode, cache, IDMAP_CACHENAME, sql, limit, 616 flag, list_mappings_cb, result, result->mappings.mappings_len); 617 618 out: 619 if (sql) 620 sqlite_freemem(sql); 621 if (IDMAP_ERROR(result->retcode)) 622 (void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 623 result->retcode = idmap_stat4prot(result->retcode); 624 return (TRUE); 625 } 626 627 628 /* ARGSUSED */ 629 static 630 int 631 list_namerules_cb(void *parg, int argc, char **argv, char **colnames) 632 { 633 list_cb_data_t *cb_data; 634 idmap_namerules_res *result; 635 idmap_retcode retcode; 636 int w2u_order, u2w_order; 637 char *end; 638 static int validated_column_names = 0; 639 640 if (!validated_column_names) { 641 assert(strcmp(colnames[0], "rowid") == 0); 642 assert(strcmp(colnames[1], "is_user") == 0); 643 assert(strcmp(colnames[2], "is_wuser") == 0); 644 assert(strcmp(colnames[3], "windomain") == 0); 645 assert(strcmp(colnames[4], "winname_display") == 0); 646 assert(strcmp(colnames[5], "is_nt4") == 0); 647 assert(strcmp(colnames[6], "unixname") == 0); 648 assert(strcmp(colnames[7], "w2u_order") == 0); 649 assert(strcmp(colnames[8], "u2w_order") == 0); 650 validated_column_names = 1; 651 } 652 653 cb_data = (list_cb_data_t *)parg; 654 result = (idmap_namerules_res *)cb_data->result; 655 656 _VALIDATE_LIST_CB_DATA(9, &result->rules.rules_val, 657 sizeof (idmap_namerule)); 658 659 result->rules.rules_len++; 660 661 result->rules.rules_val[cb_data->next].is_user = 662 strtol(argv[1], &end, 10); 663 664 result->rules.rules_val[cb_data->next].is_wuser = 665 strtol(argv[2], &end, 10); 666 667 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].windomain, 668 argv[3]); 669 670 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].winname, 671 argv[4]); 672 673 result->rules.rules_val[cb_data->next].is_nt4 = 674 strtol(argv[5], &end, 10); 675 676 STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].unixname, 677 argv[6]); 678 679 w2u_order = argv[7] ? strtol(argv[7], &end, 10) : 0; 680 u2w_order = argv[8] ? strtol(argv[8], &end, 10) : 0; 681 682 if (w2u_order > 0 && u2w_order == 0) 683 result->rules.rules_val[cb_data->next].direction = 684 IDMAP_DIRECTION_W2U; 685 else if (w2u_order == 0 && u2w_order > 0) 686 result->rules.rules_val[cb_data->next].direction = 687 IDMAP_DIRECTION_U2W; 688 else 689 result->rules.rules_val[cb_data->next].direction = 690 IDMAP_DIRECTION_BI; 691 692 result->lastrowid = strtoll(argv[0], &end, 10); 693 cb_data->next++; 694 result->retcode = IDMAP_SUCCESS; 695 return (0); 696 } 697 698 699 /* ARGSUSED */ 700 bool_t 701 idmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid, 702 uint64_t limit, idmap_namerules_res *result, 703 struct svc_req *rqstp) 704 { 705 706 sqlite *db = NULL; 707 char w2ubuf[15], u2wbuf[15]; 708 char lbuf[30], rbuf[30]; 709 char *sql = NULL; 710 char *expr = NULL; 711 uint64_t maxlimit; 712 idmap_retcode retcode; 713 714 (void) memset(result, 0, sizeof (*result)); 715 lbuf[0] = rbuf[0] = 0; 716 717 result->retcode = validate_rule(&rule); 718 if (result->retcode != IDMAP_SUCCESS) 719 goto out; 720 721 RDLOCK_CONFIG(); 722 maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit; 723 UNLOCK_CONFIG(); 724 725 /* Get db handle */ 726 result->retcode = get_db_handle(&db); 727 if (result->retcode != IDMAP_SUCCESS) 728 goto out; 729 730 result->retcode = IDMAP_ERR_INTERNAL; 731 732 w2ubuf[0] = u2wbuf[0] = 0; 733 if (rule.direction == IDMAP_DIRECTION_BI) { 734 (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 735 (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 736 } else if (rule.direction == IDMAP_DIRECTION_W2U) { 737 (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0"); 738 (void) snprintf(u2wbuf, sizeof (u2wbuf), 739 "AND (u2w_order = 0 OR u2w_order ISNULL)"); 740 } else if (rule.direction == IDMAP_DIRECTION_U2W) { 741 (void) snprintf(w2ubuf, sizeof (w2ubuf), 742 "AND (w2u_order = 0 OR w2u_order ISNULL)"); 743 (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0"); 744 } 745 746 result->retcode = gen_sql_expr_from_rule(&rule, &expr); 747 if (result->retcode != IDMAP_SUCCESS) 748 goto out; 749 750 /* Create LIMIT expression. */ 751 if (limit == 0 || (maxlimit > 0 && maxlimit < limit)) 752 limit = maxlimit; 753 if (limit > 0) 754 (void) snprintf(lbuf, sizeof (lbuf), 755 "LIMIT %" PRIu64, limit + 1ULL); 756 757 (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid); 758 759 /* 760 * Combine all the above into a giant SELECT statement that 761 * will return the requested rules 762 */ 763 sql = sqlite_mprintf("SELECT rowid, is_user, is_wuser, windomain, " 764 "winname_display, is_nt4, unixname, w2u_order, u2w_order " 765 "FROM namerules WHERE " 766 " %s %s %s %s %s;", 767 rbuf, expr, w2ubuf, u2wbuf, lbuf); 768 769 if (sql == NULL) { 770 result->retcode = IDMAP_ERR_MEMORY; 771 idmapdlog(LOG_ERR, "Out of memory"); 772 goto out; 773 } 774 775 /* Execute the SQL statement and update the return buffer */ 776 PROCESS_LIST_SVC_SQL(retcode, db, IDMAP_DBNAME, sql, limit, 777 0, list_namerules_cb, result, result->rules.rules_len); 778 779 out: 780 if (expr) 781 sqlite_freemem(expr); 782 if (sql) 783 sqlite_freemem(sql); 784 if (IDMAP_ERROR(result->retcode)) 785 (void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result); 786 result->retcode = idmap_stat4prot(result->retcode); 787 return (TRUE); 788 } 789 790 #define IDMAP_RULES_AUTH "solaris.admin.idmap.rules" 791 static int 792 verify_rules_auth(struct svc_req *rqstp) 793 { 794 ucred_t *uc = NULL; 795 uid_t uid; 796 char buf[1024]; 797 struct passwd pwd; 798 799 if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) { 800 idmapdlog(LOG_ERR, "svc_getcallerucred failed during " 801 "authorization (%s)", strerror(errno)); 802 return (-1); 803 } 804 805 uid = ucred_geteuid(uc); 806 if (uid == (uid_t)-1) { 807 idmapdlog(LOG_ERR, "ucred_geteuid failed during " 808 "authorization (%s)", strerror(errno)); 809 ucred_free(uc); 810 return (-1); 811 } 812 813 if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) { 814 idmapdlog(LOG_ERR, "getpwuid_r(%u) failed during " 815 "authorization (%s)", uid, strerror(errno)); 816 ucred_free(uc); 817 return (-1); 818 } 819 820 if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) { 821 idmapdlog(LOG_INFO, "%s is not authorized (%s)", 822 pwd.pw_name, IDMAP_RULES_AUTH); 823 ucred_free(uc); 824 return (-1); 825 } 826 827 ucred_free(uc); 828 return (1); 829 } 830 831 /* 832 * Meaning of the return values is the following: For retcode == 833 * IDMAP_SUCCESS, everything went OK and error_index is 834 * undefined. Otherwise, error_index >=0 shows the failed batch 835 * element. errro_index == -1 indicates failure at the beginning, 836 * error_index == -2 at the end. 837 */ 838 839 /* ARGSUSED */ 840 bool_t 841 idmap_update_1_svc(idmap_update_batch batch, idmap_update_res *res, 842 struct svc_req *rqstp) 843 { 844 sqlite *db = NULL; 845 idmap_update_op *up; 846 int i; 847 int trans = FALSE; 848 849 res->error_index = -1; 850 (void) memset(&res->error_rule, 0, sizeof (res->error_rule)); 851 (void) memset(&res->conflict_rule, 0, sizeof (res->conflict_rule)); 852 853 if (verify_rules_auth(rqstp) < 0) { 854 res->retcode = IDMAP_ERR_PERMISSION_DENIED; 855 goto out; 856 } 857 858 if (batch.idmap_update_batch_len == 0 || 859 batch.idmap_update_batch_val == NULL) { 860 res->retcode = IDMAP_SUCCESS; 861 goto out; 862 } 863 864 res->retcode = validate_rules(&batch); 865 if (res->retcode != IDMAP_SUCCESS) 866 goto out; 867 868 /* Get db handle */ 869 res->retcode = get_db_handle(&db); 870 if (res->retcode != IDMAP_SUCCESS) 871 goto out; 872 873 res->retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "BEGIN TRANSACTION;"); 874 if (res->retcode != IDMAP_SUCCESS) 875 goto out; 876 trans = TRUE; 877 878 for (i = 0; i < batch.idmap_update_batch_len; i++) { 879 up = &batch.idmap_update_batch_val[i]; 880 switch (up->opnum) { 881 case OP_NONE: 882 res->retcode = IDMAP_SUCCESS; 883 break; 884 case OP_ADD_NAMERULE: 885 res->retcode = add_namerule(db, 886 &up->idmap_update_op_u.rule); 887 break; 888 case OP_RM_NAMERULE: 889 res->retcode = rm_namerule(db, 890 &up->idmap_update_op_u.rule); 891 break; 892 case OP_FLUSH_NAMERULES: 893 res->retcode = flush_namerules(db); 894 break; 895 default: 896 res->retcode = IDMAP_ERR_NOTSUPPORTED; 897 break; 898 }; 899 900 if (res->retcode != IDMAP_SUCCESS) { 901 res->error_index = i; 902 if (up->opnum == OP_ADD_NAMERULE || 903 up->opnum == OP_RM_NAMERULE) { 904 idmap_stat r2 = 905 idmap_namerule_cpy(&res->error_rule, 906 &up->idmap_update_op_u.rule); 907 if (r2 != IDMAP_SUCCESS) 908 res->retcode = r2; 909 } 910 goto out; 911 } 912 } 913 914 out: 915 if (trans) { 916 if (res->retcode == IDMAP_SUCCESS) { 917 res->retcode = 918 sql_exec_no_cb(db, IDMAP_DBNAME, 919 "COMMIT TRANSACTION;"); 920 if (res->retcode != IDMAP_SUCCESS) 921 res->error_index = -2; 922 } 923 else 924 (void) sql_exec_no_cb(db, IDMAP_DBNAME, 925 "ROLLBACK TRANSACTION;"); 926 } 927 928 res->retcode = idmap_stat4prot(res->retcode); 929 930 return (TRUE); 931 } 932 933 934 /* ARGSUSED */ 935 bool_t 936 idmap_get_mapped_id_by_name_1_svc(idmap_mapping request, 937 idmap_mappings_res *result, struct svc_req *rqstp) 938 { 939 sqlite *cache = NULL, *db = NULL; 940 941 /* Init */ 942 (void) memset(result, 0, sizeof (*result)); 943 944 result->retcode = validate_mapped_id_by_name_req(&request); 945 if (result->retcode != IDMAP_SUCCESS) 946 goto out; 947 948 /* Get cache handle */ 949 result->retcode = get_cache_handle(&cache); 950 if (result->retcode != IDMAP_SUCCESS) 951 goto out; 952 953 /* Get db handle */ 954 result->retcode = get_db_handle(&db); 955 if (result->retcode != IDMAP_SUCCESS) 956 goto out; 957 958 /* Allocate result */ 959 result->mappings.mappings_val = calloc(1, sizeof (idmap_mapping)); 960 if (result->mappings.mappings_val == NULL) { 961 idmapdlog(LOG_ERR, "Out of memory"); 962 result->retcode = IDMAP_ERR_MEMORY; 963 goto out; 964 } 965 result->mappings.mappings_len = 1; 966 967 968 if (IS_REQUEST_SID(request, 1)) { 969 result->retcode = get_w2u_mapping( 970 cache, 971 db, 972 &request, 973 result->mappings.mappings_val); 974 } else if (IS_REQUEST_UID(request)) { 975 result->retcode = get_u2w_mapping( 976 cache, 977 db, 978 &request, 979 result->mappings.mappings_val, 980 1); 981 } else if (IS_REQUEST_GID(request)) { 982 result->retcode = get_u2w_mapping( 983 cache, 984 db, 985 &request, 986 result->mappings.mappings_val, 987 0); 988 } else { 989 result->retcode = IDMAP_ERR_IDTYPE; 990 } 991 992 out: 993 if (IDMAP_FATAL_ERROR(result->retcode)) { 994 xdr_free(xdr_idmap_mappings_res, (caddr_t)result); 995 result->mappings.mappings_len = 0; 996 result->mappings.mappings_val = NULL; 997 } 998 result->retcode = idmap_stat4prot(result->retcode); 999 return (TRUE); 1000 } 1001 1002 /* ARGSUSED */ 1003 bool_t 1004 idmap_get_prop_1_svc(idmap_prop_type request, 1005 idmap_prop_res *result, struct svc_req *rqstp) 1006 { 1007 idmap_pg_config_t *pgcfg; 1008 1009 /* Init */ 1010 (void) memset(result, 0, sizeof (*result)); 1011 result->retcode = IDMAP_SUCCESS; 1012 result->value.prop = request; 1013 1014 RDLOCK_CONFIG(); 1015 1016 /* Just shortcuts: */ 1017 pgcfg = &_idmapdstate.cfg->pgcfg; 1018 1019 1020 switch (request) { 1021 case PROP_LIST_SIZE_LIMIT: 1022 result->value.idmap_prop_val_u.intval = pgcfg->list_size_limit; 1023 result->auto_discovered = FALSE; 1024 break; 1025 case PROP_DEFAULT_DOMAIN: 1026 result->auto_discovered = FALSE; 1027 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1028 pgcfg->default_domain); 1029 break; 1030 case PROP_DOMAIN_NAME: 1031 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1032 pgcfg->domain_name); 1033 result->auto_discovered = 1034 pgcfg->domain_name_auto_disc; 1035 break; 1036 case PROP_MACHINE_SID: 1037 result->auto_discovered = FALSE; 1038 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1039 pgcfg->machine_sid); 1040 break; 1041 case PROP_DOMAIN_CONTROLLER: 1042 if (pgcfg->domain_controller != NULL) { 1043 (void) memcpy(&result->value.idmap_prop_val_u.dsval, 1044 pgcfg->domain_controller, 1045 sizeof (idmap_ad_disc_ds_t)); 1046 } 1047 result->auto_discovered = pgcfg->domain_controller_auto_disc; 1048 break; 1049 case PROP_FOREST_NAME: 1050 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1051 pgcfg->forest_name); 1052 result->auto_discovered = pgcfg->forest_name_auto_disc; 1053 break; 1054 case PROP_SITE_NAME: 1055 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1056 pgcfg->site_name); 1057 result->auto_discovered = pgcfg->site_name_auto_disc; 1058 break; 1059 case PROP_GLOBAL_CATALOG: 1060 if (pgcfg->global_catalog != NULL) { 1061 (void) memcpy(&result->value.idmap_prop_val_u.dsval, 1062 pgcfg->global_catalog, sizeof (idmap_ad_disc_ds_t)); 1063 } 1064 result->auto_discovered = pgcfg->global_catalog_auto_disc; 1065 break; 1066 case PROP_AD_UNIXUSER_ATTR: 1067 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1068 pgcfg->ad_unixuser_attr); 1069 result->auto_discovered = FALSE; 1070 break; 1071 case PROP_AD_UNIXGROUP_ATTR: 1072 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1073 pgcfg->ad_unixgroup_attr); 1074 result->auto_discovered = FALSE; 1075 break; 1076 case PROP_NLDAP_WINNAME_ATTR: 1077 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1078 pgcfg->nldap_winname_attr); 1079 result->auto_discovered = FALSE; 1080 break; 1081 case PROP_DIRECTORY_BASED_MAPPING: 1082 STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val, 1083 enum_lookup(pgcfg->directory_based_mapping, 1084 directory_mapping_map)); 1085 result->auto_discovered = FALSE; 1086 break; 1087 default: 1088 result->retcode = IDMAP_ERR_PROP_UNKNOWN; 1089 break; 1090 } 1091 1092 out: 1093 UNLOCK_CONFIG(); 1094 if (IDMAP_FATAL_ERROR(result->retcode)) { 1095 xdr_free(xdr_idmap_prop_res, (caddr_t)result); 1096 result->value.prop = PROP_UNKNOWN; 1097 } 1098 result->retcode = idmap_stat4prot(result->retcode); 1099 return (TRUE); 1100 } 1101 1102 1103 /* ARGSUSED */ 1104 int 1105 idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, 1106 caddr_t result) 1107 { 1108 (void) xdr_free(xdr_result, result); 1109 return (TRUE); 1110 } 1111 1112 /* 1113 * This function is called by rpc_svc.c when it encounters an error. 1114 */ 1115 NOTE(PRINTFLIKE(1)) 1116 void 1117 idmap_rpc_msgout(const char *fmt, ...) 1118 { 1119 va_list va; 1120 char buf[1000]; 1121 1122 va_start(va, fmt); 1123 (void) vsnprintf(buf, sizeof (buf), fmt, va); 1124 va_end(va); 1125 1126 idmapdlog(LOG_ERR, "idmap RPC: %s", buf); 1127 } 1128