dbutils.c revision cd37da7426f0c49c14ad9a8a07638ca971477566
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
/*
* Database related utility routines
*/
#include <atomic.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <time.h>
#include <pwd.h>
#include <grp.h>
#include <pthread.h>
#include <assert.h>
#include <sys/u8_textprep.h>
#include "idmapd.h"
#include "adutils.h"
#include "string.h"
#include "idmap_priv.h"
#include "schema.h"
static int degraded = 0; /* whether the FMRI has been marked degraded */
sqlite_vm **, int *, int, const char ***);
static idmap_retcode lookup_wksids_name2sid(const char *, char **, char **,
idmap_rid_t *, int *);
#define DO_NOT_ALLOC_NEW_ID_MAPPING(req)\
#define AVOID_NAMESERVICE(req)\
#define LOCALRID_MIN 1000
typedef enum init_db_option {
FAIL_IF_CORRUPT = 0,
/*
* Thread specfic data to hold the database handles so that the
* databaes are not opened and closed for every request. It also
* contains the sqlite busy handler structure.
*/
struct idmap_busy {
const char *name;
const int *delays;
int delay_size;
int total;
int sec;
};
typedef struct idmap_tsd {
struct idmap_busy cache_busy;
struct idmap_busy db_busy;
} idmap_tsd_t;
static const int cache_delay_table[] =
{ 1, 2, 5, 10, 15, 20, 25, 30, 35, 40,
50, 50, 60, 70, 80, 90, 100};
static const int db_delay_table[] =
{ 5, 10, 15, 20, 30, 40, 55, 70, 100};
static pthread_key_t idmap_tsd_key;
void
idmap_tsd_destroy(void *key)
{
if (tsd) {
}
}
int
idmap_init_tsd_key(void)
{
}
idmap_get_tsd(void)
{
/* No thread specific data so create it */
/* Initialize thread specific data */
/* save the trhread specific data */
/* Can't store key */
}
} else {
}
}
return (tsd);
}
static
const char *
get_fmri(void)
{
static char buf[60];
char *s;
s = fmri;
if (s != NULL && *s == '\0')
return (NULL);
else if (s != NULL)
return (s);
buf[0] = '\0';
else
return (get_fmri());
}
/*
* Wrappers for smf_degrade/restore_instance()
*
* smf_restore_instance() is too heavy duty to be calling every time we
* have a successful AD name<->SID lookup.
*/
void
degrade_svc(void)
{
const char *fmri;
return;
if (degraded)
return;
(void) smf_degrade_instance(fmri, 0);
degraded = 1;
}
void
restore_svc(void)
{
const char *fmri;
return;
if (!degraded)
return;
(void) smf_restore_instance(fmri);
degraded = 0;
}
/*
* A simple wrapper around u8_textprep_str() that returns the Unicode
* lower-case version of some string. The result must be freed.
*/
char *
tolower_u8(const char *s)
{
char *outs;
/*
* u8_textprep_str() does not allocate memory. The input and
* output buffers may differ in size (though that would be more
* likely when normalization is done). We have to loop over it...
*
* To improve the chances that we can avoid looping we add 10
* bytes of output buffer room the first go around.
*/
return (NULL);
return (NULL);
s += (inlen - inbytesleft);
/* adjust outbytesleft and outlen */
outlen += inbytesleft;
}
if (rc < 0) {
return (NULL);
}
return (res);
}
const char *while_doing);
/*
* Initialize 'dbname' using 'sql'
*/
static
int
const char *detect_version_sql, char * const *sql,
{
int rc, curr_version;
int tries = 1;
int prio = LOG_NOTICE;
*created = 0;
*upgraded = 0;
if (opt == REMOVE_IF_CORRUPT)
tries = 3;
if (tries == 0) {
return (-1);
}
if (tries-- == 1)
/* Last try, log errors */
if (opt == REMOVE_IF_CORRUPT)
goto rinse_repeat;
}
/* Detect current version of schema in the db, if any */
curr_version = 0;
if (detect_version_sql != NULL) {
int nrow;
#ifdef IDMAPD_DEBUG
#endif /* IDMAPD_DEBUG */
"Error detecting schema version of db %s (%s)",
return (-1);
}
if (nrow != 1) {
"Error detecting schema version of db %s", dbname);
return (-1);
}
}
if (curr_version < 0) {
if (opt == REMOVE_IF_CORRUPT)
goto rinse_repeat;
}
if (curr_version == version)
goto done;
/* Install or upgrade schema */
#ifdef IDMAPD_DEBUG
sql[curr_version]);
#endif /* IDMAPD_DEBUG */
if (rc != 0) {
(curr_version == 0) ? "installing schema" :
"upgrading schema");
if (opt == REMOVE_IF_CORRUPT)
goto rinse_repeat;
}
*upgraded = (curr_version > 0);
*created = (curr_version == 0);
done:
(void) sqlite_close(db);
return (0);
}
/*
* This is the SQLite database busy handler that retries the SQL
* operation until it is successful.
*/
int
/* LINTED E_FUNC_ARG_UNUSED */
{
int delay;
if (count == 1) {
}
"Thread %d waited %d sec for the %s database",
}
} else {
}
return (1);
}
/*
* Get the database handle
*/
{
char *errmsg;
/*
* Retrieve the db handle from thread-specific storage
* If none exists, open and store in thread-specific storage.
*/
"Error getting thread specific data for %s", IDMAP_DBNAME);
return (IDMAP_ERR_MEMORY);
}
return (IDMAP_ERR_DB);
}
sizeof (int);
}
return (IDMAP_SUCCESS);
}
/*
* Get the cache handle
*/
{
char *errmsg;
/*
* Retrieve the db handle from thread-specific storage
* If none exists, open and store in thread-specific storage.
*/
return (IDMAP_ERR_MEMORY);
}
return (IDMAP_ERR_DB);
}
sizeof (int);
&tsd->cache_busy);
}
return (IDMAP_SUCCESS);
}
/*
* Initialize cache and db
*/
int
init_dbs()
{
char *sql[2];
/* name-based mappings; probably OK to blow away in a pinch(?) */
sql[0] = DB_INSTALL_SQL;
return (-1);
sql[0] = CACHE_INSTALL_SQL;
return (-1);
return (0);
}
/*
* Finalize databases
*/
void
fini_dbs()
{
}
/*
* This table is a listing of status codes that will returned to the
* client when a SQL command fails with the corresponding error message.
*/
static msg_table_t sqlmsgtable[] = {
"columns unixname, is_user, u2w_order are not unique"},
"columns winname, windomain, is_user, is_wuser, w2u_order are not"
" unique"},
{IDMAP_ERR_W2U_NAMERULE_CONFLICT, "Conflicting w2u namerules"},
{-1, NULL}
};
/*
* idmapd's version of string2stat to map SQLite messages to
* status codes
*/
idmapd_string2stat(const char *msg)
{
int i;
for (i = 0; sqlmsgtable[i].msg; i++) {
return (sqlmsgtable[i].retcode);
}
return (IDMAP_ERR_OTHER);
}
/*
* Executes some SQL in a transaction.
*
* Returns 0 on success, -1 if it failed but the rollback succeeded, -2
* if the rollback failed.
*/
static
int
const char *while_doing)
{
int rc;
return (-1);
}
goto rollback;
}
return (0);
}
return (-2);
}
return (-1);
}
/*
* Execute the given SQL statment without using any callbacks
*/
{
int r;
if (r != SQLITE_OK) {
CHECK_NULL(errmsg));
return (retcode);
}
return (IDMAP_SUCCESS);
}
/*
* Generate expression that can be used in WHERE statements.
* Examples:
* <prefix> <col> <op> <value> <suffix>
* "" "unixuser" "=" "foo" "AND"
*/
{
char *s_unixname = NULL;
char *lower_winname;
int retcode = IDMAP_SUCCESS;
return (IDMAP_ERR_ARG);
if (s_windomain == NULL) {
goto out;
}
}
"AND winname = %Q AND is_wuser = %d ",
goto out;
}
}
"AND unixname = %Q AND is_user = %d ",
if (s_unixname == NULL) {
goto out;
}
}
goto out;
}
out:
if (s_windomain != NULL)
if (s_unixname != NULL)
return (retcode);
}
/*
* Generate and execute SQL statement for LIST RPC calls
*/
{
int r;
switch (r) {
case SQLITE_OK:
break;
default:
CHECK_NULL(errmsg));
break;
}
return (retcode);
}
/*
* This routine is called by callbacks that process the results of
* LIST RPC calls to validate data and to allocate memory for
* the result array.
*/
{
void *tmplist;
return (IDMAP_NEXT);
return (IDMAP_ERR_INTERNAL);
}
/* alloc in bulk to reduce number of reallocs */
return (IDMAP_ERR_MEMORY);
}
}
return (IDMAP_SUCCESS);
}
static
{
*w2u_order = 0;
*u2w_order = 0;
/*
* Windows to UNIX lookup order:
* 1. winname@domain (or winname) to ""
* 2. winname@domain (or winname) to unixname
* 3. winname@* to ""
* 4. winname@* to unixname
* 5. *@domain (or *) to *
* 6. *@domain (or *) to ""
* 7. *@domain (or *) to unixname
* 8. *@* to *
* 9. *@* to ""
* 10. *@* to unixname
*
* winname is a special case of winname@domain when domain is the
* default domain. Similarly * is a special case of *@domain when
* domain is the default domain.
*
* Note that "" has priority over specific names because "" inhibits
* mappings and traditionally deny rules always had higher priority.
*/
if (direction != IDMAP_DIRECTION_U2W) {
/* bi-directional or from windows to unix */
return (IDMAP_ERR_W2U_NAMERULE);
return (IDMAP_ERR_W2U_NAMERULE);
else if (EMPTY_NAME(winname))
return (IDMAP_ERR_W2U_NAMERULE);
if (*unixname == '*')
*w2u_order = 8;
else if (EMPTY_NAME(unixname))
*w2u_order = 9;
else /* unixname == name */
*w2u_order = 10;
} else if (*winname == '*') {
if (*unixname == '*')
*w2u_order = 5;
else if (EMPTY_NAME(unixname))
*w2u_order = 6;
else /* name */
*w2u_order = 7;
/* winname == name */
if (*unixname == '*')
return (IDMAP_ERR_W2U_NAMERULE);
else if (EMPTY_NAME(unixname))
*w2u_order = 3;
else /* name */
*w2u_order = 4;
} else {
/* winname == name && windomain == null or name */
if (*unixname == '*')
return (IDMAP_ERR_W2U_NAMERULE);
else if (EMPTY_NAME(unixname))
*w2u_order = 1;
else /* name */
*w2u_order = 2;
}
}
/*
* 1. unixname to "", non-diagonal
* 2. unixname to winname@domain (or winname), non-diagonal
* 3. unixname to "", diagonal
* 4. unixname to winname@domain (or winname), diagonal
* 5. * to *@domain (or *), non-diagonal
* 5. * to *@domain (or *), diagonal
* 7. * to ""
* 8. * to winname@domain (or winname)
* 9. * to "", non-diagonal
* 10. * to winname@domain (or winname), diagonal
*/
if (direction != IDMAP_DIRECTION_W2U) {
/* bi-directional or from unix to windows */
return (IDMAP_ERR_U2W_NAMERULE);
return (IDMAP_ERR_U2W_NAMERULE);
return (IDMAP_ERR_U2W_NAMERULE);
else if (*unixname == '*') {
if (*winname == '*')
else if (EMPTY_NAME(winname))
else
} else {
if (*winname == '*')
return (IDMAP_ERR_U2W_NAMERULE);
else if (EMPTY_NAME(winname))
else
}
}
return (IDMAP_SUCCESS);
}
/*
* Generate and execute SQL statement to add name-based mapping rule
*/
{
if (retcode != IDMAP_SUCCESS)
goto out;
if (w2u_order)
if (u2w_order)
/*
* For the triggers on namerules table to work correctly:
* 1) Use NULL instead of 0 for w2u_order and u2w_order
* 2) Use "" instead of NULL for "no domain"
*/
== IDMAP_SUCCESS) {
/* well-known SIDs don't need domain */
dom = "";
}
else
dom = "";
}
"(is_user, is_wuser, windomain, winname_display, is_nt4, "
"unixname, w2u_order, u2w_order) "
"VALUES(%d, %d, %Q, %Q, %d, %Q, %q, %q);",
goto out;
}
if (retcode == IDMAP_ERR_OTHER)
out:
return (retcode);
}
/*
* Flush name-based mapping rules
*/
{
return (retcode);
}
/*
* Generate and execute SQL statement to remove a name-based mapping rule
*/
{
char buf[80];
return (IDMAP_SUCCESS);
buf[0] = 0;
" AND u2w_order > 0");
" AND (u2w_order = 0 OR u2w_order ISNULL)");
" AND (w2u_order = 0 OR w2u_order ISNULL)");
if (retcode != IDMAP_SUCCESS)
goto out;
buf);
goto out;
}
out:
return (retcode);
}
/*
* Compile the given SQL query and step just once.
*
* Input:
* db - db handle
* sql - SQL statement
*
* Output:
* vm - virtual SQL machine
* ncol - number of columns in the result
* values - column values
*
* Return values:
* IDMAP_SUCCESS
* IDMAP_ERR_NOTFOUND
* IDMAP_ERR_INTERNAL
*/
static
{
int r;
CHECK_NULL(errmsg));
return (IDMAP_ERR_INTERNAL);
}
if (r == SQLITE_ROW) {
return (IDMAP_ERR_INTERNAL);
}
/* Caller will call finalize after using the results */
return (IDMAP_SUCCESS);
} else if (r == SQLITE_DONE) {
return (IDMAP_ERR_NOTFOUND);
}
CHECK_NULL(errmsg));
return (IDMAP_ERR_INTERNAL);
}
/*
* Table for well-known SIDs.
*
* Background:
*
* Some of the well-known principals are stored under:
* cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>
* They belong to objectClass "foreignSecurityPrincipal". They don't have
* "samAccountName" nor "userPrincipalName" attributes. Their names are
* available in "cn" and "name" attributes. Some of these principals have a
* second entry under CN=ForeignSecurityPrincipals,dc=<forestRootDomain> and
* these duplicate entries have the stringified SID in the "name" and "cn"
* attributes instead of the actual name.
*
* Those of the form S-1-5-32-X are Builtin groups and are stored in the
* cn=builtin container (except, Power Users which is not stored in AD)
*
* These principals are and will remain constant. Therefore doing AD lookups
* provides no benefit. Also, using hard-coded table (and thus avoiding AD
* lookup) improves performance and avoids additional complexity in the
* adutils.c code. Moreover these SIDs can be used when no Active Directory
* is available (such as the CIFS server's "workgroup" mode).
*
* Notes:
* 1. Currently we don't support localization of well-known SID names,
* unlike Windows.
*
* 2. Other well-known SIDs i.e. S-1-5-<domain>-<w-k RID> are not stored
* can be looked up using the existing AD lookup code.
*/
static wksids_table_t wksids[] = {
{"S-1-5-32", 554, "Pre-Windows 2000 Compatible Access", 0,
SENTINEL_PID, -1},
{"S-1-5-32", 556, "Network Configuration Operators", 0,
SENTINEL_PID, -1},
{"S-1-5-32", 557, "Incoming Forest Trust Builders", 0,
SENTINEL_PID, -1},
{"S-1-5-32", 560, "Windows Authorization Access Group", 0,
SENTINEL_PID, -1},
{"S-1-5-32", 561, "Terminal Server License Servers", 0,
SENTINEL_PID, -1},
{"S-1-5-32", 574, "Certificate Service DCOM Access", 0,
SENTINEL_PID, -1},
};
static
{
int i;
/* Not mapped, break */
break;
continue;
case IDMAP_UID:
continue;
return (IDMAP_SUCCESS);
case IDMAP_GID:
continue;
return (IDMAP_SUCCESS);
case IDMAP_POSIXID:
return (IDMAP_SUCCESS);
default:
return (IDMAP_ERR_NOTSUPPORTED);
}
}
}
return (IDMAP_ERR_NOTFOUND);
}
static
{
int i;
return (IDMAP_ERR_NOTSUPPORTED);
return (IDMAP_ERR_MEMORY);
}
return (IDMAP_SUCCESS);
}
}
return (IDMAP_ERR_NOTFOUND);
}
static
int *type)
{
int i;
return (IDMAP_ERR_MEMORY);
}
return (IDMAP_SUCCESS);
}
}
return (IDMAP_ERR_NOTFOUND);
}
static
{
int i;
return (IDMAP_ERR_MEMORY);
}
return (IDMAP_ERR_MEMORY);
}
return (IDMAP_SUCCESS);
}
}
return (IDMAP_ERR_NOTFOUND);
}
static
{
char *end;
const char **values;
char *is_user_string;
/* Current time */
errno = 0;
goto out;
}
case IDMAP_UID:
is_user_string = "1";
break;
case IDMAP_GID:
is_user_string = "0";
break;
case IDMAP_POSIXID:
/* the non-diagonal mapping */
is_user_string = "is_wuser";
break;
default:
goto out;
}
/* SQL to lookup the cache */
"FROM idmap_cache WHERE is_user = %s AND "
"sidprefix = %Q AND rid = %u AND w2u = 1 AND "
"(pid >= 2147483648 OR "
"(expiration = 0 OR expiration ISNULL OR "
"expiration > %d));",
curtime);
goto out;
}
if (retcode == IDMAP_ERR_NOTFOUND) {
goto out;
} else if (retcode == IDMAP_SUCCESS) {
/* sanity checks */
goto out;
}
if (is_user) {
} else {
}
/*
* We may have an expired ephemeral mapping. Consider
* the expired entry as valid if we are not going to
* perform name-based mapping. But do not renew the
* expiration.
* If we will be doing name-based mapping then store the
* ephemeral pid in the result so that we can use it
* if we end up doing dynamic mapping again.
*/
if (!DO_NOT_ALLOC_NEW_ID_MAPPING(req) &&
!AVOID_NAMESERVICE(req) &&
/* Store the ephemeral pid */
}
}
}
out:
if (retcode == IDMAP_SUCCESS) {
else
}
}
}
return (retcode);
}
static
{
char *end;
const char **values;
int ncol;
/* Get current time */
errno = 0;
goto out;
}
/* SQL to lookup the cache */
"FROM name_cache WHERE "
"sidprefix = %Q AND rid = %u AND "
"(expiration = 0 OR expiration ISNULL OR "
"expiration > %d);",
goto out;
}
if (retcode == IDMAP_SUCCESS) {
goto out;
}
}
goto out;
}
}
}
goto out;
}
}
}
out:
return (retcode);
}
/*
* Lookup sid to name locally
*/
static
{
int type = -1;
char *sidprefix;
/* Lookup sids to name in well-known sids table */
if (retcode != IDMAP_ERR_NOTFOUND)
goto out;
/* Lookup sid to name in cache */
if (retcode != IDMAP_SUCCESS)
goto out;
out:
if (retcode == IDMAP_SUCCESS) {
? IDMAP_USID : IDMAP_GSID;
/* update state in 'req' */
} else {
}
return (retcode);
}
{
int ret, i;
int retries = 0;
if (state->ad_nqueries == 0)
return (IDMAP_SUCCESS);
if (ret != 0) {
degrade_svc();
"Failed to create sid2name batch for AD lookup");
return (IDMAP_ERR_INTERNAL);
}
restore_svc();
for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
if (retries == 0)
continue;
if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
break;
if (retcode != IDMAP_SUCCESS)
goto out;
}
}
if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
else
for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
continue;
continue;
continue;
/*
* Map from type values known to adutils to type values
*/
} else {
}
}
goto retry;
else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
degrade_svc();
return (retcode);
out:
return (retcode);
}
/*
* Convention when processing win2unix requests:
*
* Windows identity:
* req->id1name =
* winname if given otherwise winname found will be placed
* here.
* req->id1domain =
* windomain if given otherwise windomain found will be
* placed here.
* req->id1.idtype =
* be set to IDMAP_USID/GSID depending upon whether the
* given SID is user or group respectively. The user/group-ness
* is determined either when looking up well-known SIDs table OR
* if the SID is found in namecache OR by ad_lookup() OR by
* ad_lookup_batch().
* req->id1..sid.[prefix, rid] =
* SID if given otherwise SID found will be placed here.
*
* Unix identity:
* req->id2name =
* unixname found will be placed here.
* req->id2domain =
* NOT USED
* res->id.idtype =
* Target type initialized from req->id2.idtype. If
* will be placed here.
* res->id..[uid or gid] =
*
* Others:
* res->retcode =
* Return status for this request will be placed here.
* res->direction =
* Direction found will be placed here. Direction
* meaning whether the resultant mapping is valid
* only from win2unix or bi-directional.
* req->direction =
* INTERNAL USE. Used by idmapd to set various
* flags (_IDMAP_F_xxxx) to aid in processing
* of the request.
* req->id2.idtype =
* INTERNAL USE. Initially this is the requested target
* type and is used to initialize res->id.idtype.
* ad_lookup_batch() uses this field temporarily to store
* sid_type obtained by the batched AD lookups and after
* use resets it to IDMAP_NONE to prevent xdr from
* mis-interpreting the contents of req->id2.
* req->id2..[uid or gid or sid] =
* NOT USED
*/
/*
* This function does the following:
* 1. Lookup well-known SIDs table.
* 3. Lookup cache.
* 4. Check if the client does not want new mapping to be allocated
* in which case this pass is the final pass.
* 5. Set AD lookup flag if it determines that the next stage needs
* to do AD lookup.
*/
{
/*
* The req->direction field is used to maintain state of the
* sid2pid request.
*/
goto out;
}
/* Lookup well-known sid to pid mapping */
if (retcode != IDMAP_ERR_NOTFOUND)
goto out;
/* Lookup sid to pid in cache */
if (retcode != IDMAP_ERR_NOTFOUND)
goto out;
goto out;
}
/*
* Failed to find non-expired entry in cache. Tell the caller
* that we are not done yet.
*/
/*
* Our next step is name-based mapping. To lookup name-based
* mapping rules, we need the windows name and domain-name
* associated with the SID.
*/
/*
* Check if we already have the name (i.e name2pid lookups)
*/
goto out;
}
/* Lookup sid to winname@domain locally first */
if (retcode == IDMAP_SUCCESS) {
} else if (retcode == IDMAP_ERR_NOTFOUND) {
/* Batch sid to name AD lookup request */
state->ad_nqueries++;
goto out;
}
out:
return (retcode);
}
/*
* Generate SID using the following convention
* <machine-sid-prefix>-<1000 + uid>
* <machine-sid-prefix>-<2^31 + gid>
*/
static
{
/* Skip 1000 UIDs */
(INT32_MAX - LOCALRID_MIN))
return (IDMAP_ERR_NOMAPPING);
return (IDMAP_ERR_MEMORY);
}
/*
* Don't update name_cache because local sids don't have
* valid windows names.
* We mark the entry as being found in the namecache so that
* the cache update routine doesn't update namecache.
*/
return (IDMAP_SUCCESS);
}
return (IDMAP_ERR_NOMAPPING);
}
static
{
char *sidprefix;
int s;
/*
* If the sidprefix == localsid then UID = last RID - 1000 or
* GID = last RID - 2^31.
*/
if (s == 0) {
case IDMAP_UID:
return (IDMAP_ERR_NOTFOUND);
} else if (rid < LOCALRID_MIN) {
return (IDMAP_ERR_NOTFOUND);
}
break;
case IDMAP_GID:
return (IDMAP_ERR_NOTFOUND);
}
break;
case IDMAP_POSIXID:
} else if (rid < LOCALRID_MIN) {
return (IDMAP_ERR_NOTFOUND);
} else {
}
break;
default:
return (IDMAP_ERR_NOTSUPPORTED);
}
return (IDMAP_SUCCESS);
}
return (IDMAP_ERR_NOTFOUND);
}
static
{
char buf[1024];
int errnum;
const char *me = "ns_lookup_byname";
if (is_user) {
"%s: getpwnam_r(%s) failed (%s).",
if (errnum == 0)
return (IDMAP_ERR_NOTFOUND);
else
return (IDMAP_ERR_INTERNAL);
}
} else {
"%s: getgrnam_r(%s) failed (%s).",
if (errnum == 0)
return (IDMAP_ERR_NOTFOUND);
else
return (IDMAP_ERR_INTERNAL);
}
}
return (IDMAP_SUCCESS);
}
/*
* Name-based mapping
*
* Case 1: If no rule matches do ephemeral
*
* Case 2: If rule matches and unixname is "" then return no mapping.
*
* Case 3: If rule matches and unixname is specified then lookup name
* service using the unixname. If unixname not found then return no mapping.
*
* Case 4: If rule matches and unixname is * then lookup name service
* using winname as the unixname. If unixname not found then process
* other rules using the lookup order. If no other rule matches then do
* ephemeral. Otherwise, based on the matched rule do Case 2 or 3 or 4.
* This allows us to specify a fallback unixname per _domain_ or no mapping
* instead of the default behaviour of doing ephemeral mapping.
*
* Example 1:
* *@sfbay == *
* If looking up windows users foo@sfbay and foo does not exists in
* the name service then foo@sfbay will be mapped to an ephemeral id.
*
* Example 2:
* *@sfbay == *
* *@sfbay => guest
* If looking up windows users foo@sfbay and foo does not exists in
* the name service then foo@sfbay will be mapped to guest.
*
* Example 3:
* *@sfbay == *
* *@sfbay => ""
* If looking up windows users foo@sfbay and foo does not exists in
* the name service then we will return no mapping for foo@sfbay.
*
*/
static
{
const char **values;
const char *me = "name_based_mapping_sid2pid";
case IDMAP_USID:
is_wuser = 1;
break;
case IDMAP_GSID:
is_wuser = 0;
break;
default:
"winname undetermined.");
return (IDMAP_ERR_INTERNAL);
break;
}
case IDMAP_UID:
is_user = 1;
break;
case IDMAP_GID:
is_user = 0;
break;
case IDMAP_POSIXID:
break;
}
i = 0;
windomain = "";
} else {
windomain) == 0)
i = 1;
}
}
"SELECT unixname, u2w_order FROM namerules WHERE "
"w2u_order > 0 AND is_user = %d AND is_wuser = %d AND "
"(winname = %Q OR winname = '*') AND "
"(windomain = %Q OR windomain = '*' %s) "
"ORDER BY w2u_order ASC;",
i ? "OR windomain ISNULL OR windomain = ''" : "");
goto out;
}
CHECK_NULL(errmsg));
goto out;
}
for (; ; ) {
if (r == SQLITE_ROW) {
if (ncol < 2) {
goto out;
}
goto out;
}
if (EMPTY_NAME(values[0])) {
goto out;
}
if (retcode == IDMAP_ERR_NOTFOUND) {
/* Case 4 */
continue;
else
/* Case 3 */
}
goto out;
} else if (r == SQLITE_DONE) {
goto out;
} else {
CHECK_NULL(errmsg));
goto out;
}
}
out:
if (retcode == IDMAP_SUCCESS) {
else
}
return (retcode);
}
static
int
{
int err;
return (err);
}
return (0);
}
static
int
{
int err;
return (err);
}
return (0);
}
static
int
{
return (0);
}
}
}
static
int
{
return (0);
return (1);
}
}
return (0);
}
static
void
{
next++;
}
return;
}
/* ARGSUSED */
static
{
return (IDMAP_SUCCESS);
return (IDMAP_SUCCESS);
}
if (get_next_eph_uid(&next_pid) != 0)
return (IDMAP_ERR_INTERNAL);
} else {
if (get_next_eph_gid(&next_pid) != 0)
return (IDMAP_ERR_INTERNAL);
}
return (IDMAP_SUCCESS);
}
{
/*
* The req->direction field is used to maintain state of the
* sid2pid request.
*/
/* Check if second pass is needed */
/* Get status from previous pass */
if (retcode != IDMAP_SUCCESS) {
/* Reset return type */
/* Check if this is a localsid */
if (retcode == IDMAP_ERR_NOTFOUND &&
if (retcode == IDMAP_SUCCESS) {
}
}
goto out;
}
/* Name-based mapping */
if (retcode == IDMAP_ERR_NOTFOUND)
/* If not found, do ephemeral mapping */
goto ephemeral;
else if (retcode != IDMAP_SUCCESS)
goto out;
goto out;
if (retcode == IDMAP_SUCCESS)
out:
return (retcode);
}
{
/* Check if we need to cache anything */
return (IDMAP_SUCCESS);
/* We don't cache negative entries */
return (IDMAP_SUCCESS);
/*
* Using NULL for u2w instead of 0 so that our trigger allows
* the same pid to be the destination in multiple entries
*/
"(sidprefix, rid, windomain, canon_winname, pid, unixname, "
"is_user, is_wuser, expiration, w2u, u2w) "
"VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
"strftime('%%s','now') + 600, %q, 1); ",
goto out;
}
if (retcode != IDMAP_SUCCESS)
goto out;
/* If sid2name was found in the cache, no need to update namecache */
goto out;
goto out;
"(sidprefix, rid, canon_name, domain, type, expiration) "
"VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
goto out;
}
out:
return (retcode);
}
{
int is_eph_user;
/* Check if we need to cache anything */
return (IDMAP_SUCCESS);
/* We don't cache negative entries */
return (IDMAP_SUCCESS);
is_eph_user = 1;
is_eph_user = 0;
else
is_eph_user = -1;
"SET w2u = 0 WHERE "
"sidprefix = %Q AND rid = %u AND w2u = 1 AND "
"pid >= 2147483648 AND is_user = %d;",
goto out;
}
if (retcode != IDMAP_SUCCESS)
goto out;
}
"(sidprefix, rid, windomain, canon_winname, pid, unixname, "
"is_user, is_wuser, expiration, w2u, u2w) "
"VALUES(%Q, %u, %Q, %Q, %u, %Q, %d, %d, "
"strftime('%%s','now') + 600, 1, %q); ",
goto out;
}
if (retcode != IDMAP_SUCCESS)
goto out;
/* If name2sid was found in the cache, no need to update namecache */
goto out;
goto out;
"(sidprefix, rid, canon_name, domain, type, expiration) "
"VALUES(%Q, %u, %Q, %Q, %d, strftime('%%s','now') + 3600); ",
goto out;
}
out:
return (retcode);
}
static
{
char *end;
const char **values;
int ncol;
/* Current time */
errno = 0;
goto out;
}
/* SQL to lookup the cache */
"w2u, is_wuser "
"FROM idmap_cache WHERE "
"pid = %u AND u2w = 1 AND is_user = %d AND "
"(pid >= 2147483648 OR "
"(expiration = 0 OR expiration ISNULL OR "
"expiration > %d));",
goto out;
}
if (retcode == IDMAP_ERR_NOTFOUND)
goto out;
else if (retcode == IDMAP_SUCCESS) {
/* sanity checks */
goto out;
}
case IDMAP_SID:
case IDMAP_USID:
case IDMAP_GSID:
? IDMAP_USID : IDMAP_GSID;
goto out;
goto out;
}
goto out;
}
else
break;
goto out;
}
break;
goto out;
}
break;
default:
break;
}
}
out:
return (retcode);
}
static
{
char *end, *lower_name;
const char **values;
int ncol;
/* Get current time */
errno = 0;
goto out;
}
/* SQL to lookup the cache */
lower_name = (char *)name;
"FROM name_cache WHERE name = %Q AND domain = %Q AND "
"(expiration = 0 OR expiration ISNULL OR "
if (lower_name != name)
goto out;
}
if (retcode == IDMAP_SUCCESS) {
goto out;
}
}
goto out;
}
}
goto out;
}
goto out;
}
}
out:
return (retcode);
}
static
int *type)
{
int ret;
int retries = 0;
if (ret != 0) {
degrade_svc();
"Failed to create name2sid batch for AD lookup");
return (IDMAP_ERR_INTERNAL);
}
restore_svc();
if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
goto out;
if (retcode != IDMAP_SUCCESS) {
return (IDMAP_ERR_INTERNAL);
}
out:
if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
else
goto retry;
else if (retcode == IDMAP_ERR_RETRIABLE_NET_ERR)
degrade_svc();
if (retcode != IDMAP_SUCCESS) {
"failed");
return (retcode);
} else
return (rc);
/* NOTREACHED */
}
static
{
int type;
/* Lookup name@domain to sid in the well-known sids table */
&type);
if (retcode == IDMAP_SUCCESS) {
goto out;
} else if (retcode != IDMAP_ERR_NOTFOUND) {
return (retcode);
}
/* Lookup name@domain to sid in cache */
if (retcode == IDMAP_ERR_NOTFOUND) {
if (retcode != IDMAP_SUCCESS)
return (retcode);
} else if (retcode != IDMAP_SUCCESS) {
return (retcode);
} else {
/* Set flag */
}
out:
/*
* Entry found (cache or Windows lookup)
* is_wuser is both input as well as output parameter
*/
if (*is_wuser == 1) {
if (type != _IDMAP_T_USER) {
}
}
return (IDMAP_ERR_NOTUSER);
}
} else if (*is_wuser == 0) {
if (type != _IDMAP_T_GROUP) {
}
}
return (IDMAP_ERR_NOTGROUP);
}
} else if (*is_wuser == -1) {
/* Caller wants to know if its user or group */
if (type == _IDMAP_T_USER)
*is_wuser = 1;
else if (type == _IDMAP_T_GROUP)
*is_wuser = 0;
else {
}
}
return (IDMAP_ERR_SID);
}
}
return (retcode);
}
static
{
char *canonname;
char *default_domain = NULL;
char *end;
const char **values;
const char *me = "name_based_mapping_pid2sid";
int is_wuser;
if (default_domain == NULL) {
goto out;
}
}
"SELECT winname_display, windomain, w2u_order FROM namerules WHERE "
"u2w_order > 0 AND is_user = %d AND "
"(unixname = %Q OR unixname = '*') "
goto out;
}
CHECK_NULL(errmsg));
goto out;
}
for (nrow = 0; ; ) {
if (r == SQLITE_ROW) {
nrow++;
if (ncol < 3) {
goto out;
}
/* values [1] and [2] can be null */
goto out;
}
if (EMPTY_NAME(values[0])) {
goto out;
}
if (values[0][0] == '*') {
if (nrow > 1) {
/*
* There were non-wildcard rules where
* windows identity doesn't exist
*/
goto out;
}
} else {
}
else if (default_domain != NULL)
else {
goto out;
}
/* Lookup winname@domain to sid */
: -1;
if (retcode == IDMAP_ERR_NOTFOUND) {
continue;
}
goto out;
} else if (r == SQLITE_DONE) {
goto out;
} else {
CHECK_NULL(errmsg));
goto out;
}
}
out:
if (retcode == IDMAP_SUCCESS) {
else
if (windomain == default_domain) {
} else {
}
}
}
if (default_domain != NULL)
return (retcode);
}
/*
* Convention when processing unix2win requests:
*
* Unix identity:
* req->id1name =
* unixname if given otherwise unixname found will be placed
* here.
* req->id1domain =
* NOT USED
* req->id1.idtype =
* Given type (IDMAP_UID or IDMAP_GID)
* req->id1..[uid or gid] =
*
* Windows identity:
* req->id2name =
* winname found will be placed here.
* req->id2domain =
* windomain found will be placed here.
* res->id.idtype =
* Target type initialized from req->id2.idtype. If
* it is IDMAP_SID then actual type (IDMAP_USID/GSID) found
* will be placed here.
* req->id..sid.[prefix, rid] =
* SID found will be placed here.
*
* Others:
* res->retcode =
* Return status for this request will be placed here.
* res->direction =
* Direction found will be placed here. Direction
* meaning whether the resultant mapping is valid
* only from unix2win or bi-directional.
* req->direction =
* INTERNAL USE. Used by idmapd to set various
* flags (_IDMAP_F_xxxx) to aid in processing
* of the request.
* req->id2.idtype =
* INTERNAL USE. Initially this is the requested target
* type and is used to initialize res->id.idtype.
* ad_lookup_batch() uses this field temporarily to store
* sid_type obtained by the batched AD lookups and after
* use resets it to IDMAP_NONE to prevent xdr from
* mis-interpreting the contents of req->id2.
* req->id2..[uid or gid or sid] =
* NOT USED
*/
/*
* This function does the following:
* 1. Lookup well-known SIDs table.
* 2. Lookup cache.
* 3. Check if the client does not want new mapping to be allocated
* in which case this pass is the final pass.
* 4. Set AD lookup flags if it determines that the next stage needs
* to do AD lookup.
*/
int getname)
{
char buf[1024];
int errnum;
const char *me = "pid2sid";
/* Lookup well-known SIDs */
if (retcode != IDMAP_ERR_NOTFOUND)
goto out;
/* Lookup pid to sid in cache */
if (retcode != IDMAP_ERR_NOTFOUND)
goto out;
/* Ephemeral ids cannot be allocated during pid2sid */
goto out;
}
goto out;
}
} else if (is_user) {
errno = 0;
"%s: getpwuid_r(%u) failed (%s).",
goto fallback_localsid;
}
} else {
errno = 0;
"%s: getgrgid_r(%u) failed (%s).",
goto fallback_localsid;
}
}
/* Name-based mapping */
if (retcode == IDMAP_ERR_NOTFOUND) {
goto out;
} else if (retcode == IDMAP_SUCCESS)
goto out;
/*
* Here we generate localsid as fallback id on errors. Our
* return status is the error that's been previously assigned.
*/
out:
}
return (retcode);
}
static
{
int ret;
if (ret != 0) {
degrade_svc();
"Failed to create sid2name batch for AD lookup");
goto out;
}
restore_svc();
if (ret != 0) {
goto out;
}
out:
if (ret == IDMAP_ERR_RETRIABLE_NET_ERR)
degrade_svc();
if (ret != 0) {
"Failed to execute sid2name AD lookup");
} else
}
return (retcode);
}
static
int
{
goto errout;
}
} else {
}
goto errout;
goto errout;
/* We don't need the rest of the request i.e request->id2 */
return (0);
return (-1);
}
{
char *cp;
int is_wuser;
char *canonname;
is_wuser = 1;
is_wuser = 0;
is_wuser = -1;
else {
goto out;
}
/* Copy data from request to result */
goto out;
}
goto out;
}
/*
* if winname is qualified with a domain, use it.
*/
*cp = '\0';
} else {
/*
* otherwise use the mapping domain
*/
}
}
if (retcode != IDMAP_SUCCESS) {
goto out;
}
}
if (!EMPTY_STRING(winname) &&
if (retcode != IDMAP_SUCCESS)
goto out;
}
goto out;
if (state.ad_nqueries) {
/* sid2name AD lookup */
}
goto out;
/* Update cache */
out:
if (retcode == IDMAP_SUCCESS) {
} else {
}
return (retcode);
}
{
char buf[1024];
int errnum;
const char *unixname;
const char *me = "get_u2w_mapping";
/*
* In order to re-use the pid2sid code, we convert
* our input data into structs that are expected by
* pid2sid_first_pass.
*/
/* Copy data from request to result */
goto out;
}
if (EMPTY_STRING(unixname) &&
goto out;
}
if (!EMPTY_STRING(unixname) &&
if (is_user) {
errno = 0;
"%s: getpwnam_r(%s) failed (%s).",
goto out;
}
} else {
errno = 0;
"%s: getgrnam_r(%s) failed (%s).",
goto out;
}
}
}
is_user, 1);
goto out;
/* Update cache */
out:
return (retcode);
}