idmap/idmapd/nldaputils.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
 */

/*
 * native LDAP related utility routines
 */

#include "idmapd.h"
#include "idmap_priv.h"
#include "ns_sldap.h"
#include "nldaputils.h"
#include <assert.h>

/*
 * The following are format strings used to construct LDAP search filters
 * when looking up Native LDAP directory service. The _F_XXX_SSD format
 * is used by the libsldap API if a corresponding SSD is defined in
 * Native LDAP configuration. The SSD contains a string that replaces
 * the first %s in _F_XXX_SSD. If no SSD is defined then the regular
 * _F_XXX format is used.
 *
 * Note that '\\' needs to be represented as "\\5c" in LDAP filters.
 */

/* Native LDAP lookup using UNIX username */
#define _F_GETPWNAM     "(&(objectClass=posixAccount)(uid=%s))"
#define _F_GETPWNAM_SSD     "(&(%%s)(uid=%s))"

/*
 * Native LDAP user lookup using names of well-known SIDs
 * Note the use of 1$, 2$ in the format string which basically
 * allows snprintf to re-use its first two arguments.
 */
#define _F_GETPWWNAMWK \
        "(&(objectClass=posixAccount)(|(%s=%s)(%1$s=BUILTIN\\5c%2$s)))"
#define _F_GETPWWNAMWK_SSD  "(&(%%s)(|(%s=%s)(%1$s=BUILTIN\\5c%2$s)))"

/* Native LDAP user lookup using winname@windomain OR windomain\winname */
#define _F_GETPWWNAMDOM \
    "(&(objectClass=posixAccount)(|(%s=%s@%s)(%1$s=%3$s\\5c%2$s)))"
#define _F_GETPWWNAMDOM_SSD "(&(%%s)(|(%s=%s@%s)(%1$s=%3$s\\5c%2$s)))"

/* Native LDAP lookup using UID */
#define _F_GETPWUID     "(&(objectClass=posixAccount)(uidNumber=%u))"
#define _F_GETPWUID_SSD     "(&(%%s)(uidNumber=%u))"

/* Native LDAP lookup using UNIX groupname */
#define _F_GETGRNAM     "(&(objectClass=posixGroup)(cn=%s))"
#define _F_GETGRNAM_SSD     "(&(%%s)(cn=%s))"

/* Native LDAP group lookup using names of well-known SIDs */
#define _F_GETGRWNAMWK \
        "(&(objectClass=posixGroup)(|(%s=%s)(%1$s=BUILTIN\\5c%2$s)))"
#define _F_GETGRWNAMWK_SSD  "(&(%%s)(|(%s=%s)(%1$s=BUILTIN\\5c%2$s)))"

/* Native LDAP group lookup using winname@windomain OR windomain\winname */
#define _F_GETGRWNAMDOM \
        "(&(objectClass=posixGroup)(|(%s=%s@%s)(%1$s=%3$s\\5c%2$s)))"
#define _F_GETGRWNAMDOM_SSD "(&(%%s)(|(%s=%s@%s)(%1$s=%3$s\\5c%2$s)))"

/* Native LDAP lookup using GID */
#define _F_GETGRGID     "(&(objectClass=posixGroup)(gidNumber=%u))"
#define _F_GETGRGID_SSD     "(&(%%s)(gidNumber=%u))"

/* Native LDAP attribute names */
#define UID         "uid"
#define CN          "cn"
#define UIDNUMBER       "uidnumber"
#define GIDNUMBER       "gidnumber"
#define DN          "dn"

#define IS_NLDAP_RC_FATAL(x)    ((x == NS_LDAP_MEMORY) ? 1 : 0)

typedef struct idmap_nldap_q {
    char            **winname;
    char            **windomain;
    char            **unixname;
    uid_t           *pid;
    char            **dn;
    char            **attr;
    char            **value;
    int         is_user;
    idmap_retcode       *rc;
    int         lrc;
    ns_ldap_result_t    *result;
    ns_ldap_error_t     *errorp;
    char            *filter;
    char            *udata;
} idmap_nldap_q_t;

typedef struct idmap_nldap_query_state {
    const char      *nldap_winname_attr;
    const char      *defdom;
    int         nqueries;
    int         qid;
    int         flag;
    ns_ldap_list_batch_t    *batch;
    idmap_nldap_q_t     queries[1];
} idmap_nldap_query_state_t;

/*
 * This routine has been copied from lib/nsswitch/ldap/common/ldap_utils.c
 * after removing the debug statements.
 *
 * This is a generic filter callback function for merging the filter
 * from service search descriptor with an existing search filter. This
 * routine expects userdata to contain a format string with a single %s
 * in it, and will use the format string with sprintf() to insert the
 * SSD filter.
 *
 * This routine and userdata are passed to the __ns_ldap_list_batch_add()
 * API.
 *
 * Consider an example that uses __ns_ldap_list_batch_add() to lookup
 * native LDAP directory using a given userid 'xy12345'. In this
 * example the userdata will contain the filter "(&(%s)(cn=xy1234))".
 * If a SSD is defined to replace the rfc2307bis specified filter
 * i.e. (objectClass=posixAccount) by a site-specific filter
 * say (department=sds) then this routine when called will produce
 * "(&(department=sds)(uid=xy1234))" as the real search filter.
 */
static
int
merge_SSD_filter(const ns_ldap_search_desc_t *desc,
    char **realfilter, const void *userdata)
{
    int len;
    char *checker;

    if (realfilter == NULL)
        return (NS_LDAP_INVALID_PARAM);
    *realfilter = NULL;
    if (desc == NULL || desc->filter == NULL || userdata == NULL)
        return (NS_LDAP_INVALID_PARAM);

    /* Parameter check.  We only want one %s here, otherwise bail. */
    len = 0;    /* Reuse 'len' as "Number of %s hits"... */
    checker = (char *)userdata;
    do {
        checker = strchr(checker, '%');
        if (checker != NULL) {
            if (len > 0 || *(checker + 1) != 's')
                return (NS_LDAP_INVALID_PARAM);
            len++;  /* Got our %s. */
            checker += 2;
        } else if (len != 1)
            return (NS_LDAP_INVALID_PARAM);
    } while (checker != NULL);

    len = strlen(userdata) + strlen(desc->filter) + 1;
    *realfilter = (char *)malloc(len);
    if (*realfilter == NULL)
        return (NS_LDAP_MEMORY);
    (void) sprintf(*realfilter, (char *)userdata, desc->filter);
    return (NS_LDAP_SUCCESS);
}

static
char
hex_char(int n)
{
    return ("0123456789abcdef"[n & 0xf]);
}

/*
 * If the input string contains special characters that needs to be
 * escaped before the string can be used in a LDAP filter then this
 * function will return a new sanitized string. Otherwise this function
 * returns the input string (This saves us un-necessary memory allocations
 * especially when processing a batch of requests). The caller must free
 * the returned string if it isn't the input string.
 *
 * The escape mechanism for LDAP filter is described in RFC2254 basically
 * it's \hh where hh are the two hexadecimal digits representing the ASCII
 * value of the encoded character (case of hh is not significant).
 * Example: * -> \2a, ( -> \28, ) -> \29, \ -> \5c,
 *
 * outstring = sanitize_for_ldap_filter(instring);
 * if (outstring == NULL)
 *  Out of memory
 * else
 *  Use outstring
 *  if (outstring != instring)
 *      free(outstring);
 * done
 */
char *
sanitize_for_ldap_filter(const char *str)
{
    const char  *p;
    char        *q, *s_str = NULL;
    int     n;

    /* Get a count of special characters */
    for (p = str, n = 0; *p; p++)
        if (*p == '*' || *p == '(' || *p == ')' ||
            *p == '\\' || *p == '%')
            n++;
    /* If count is zero then no need to sanitize */
    if (n == 0)
        return ((char *)str);
    /* Create output buffer that will contain the sanitized value */
    s_str = calloc(1, n * 2 + strlen(str) + 1);
    if (s_str == NULL)
        return (NULL);
    for (p = str, q = s_str; *p; p++) {
        if (*p == '*' || *p == '(' || *p == ')' ||
            *p == '\\' || *p == '%') {
            *q++ = '\\';
            *q++ = hex_char(*p >> 4);
            *q++ = hex_char(*p & 0xf);
        } else
            *q++ = *p;
    }
    return (s_str);
}

/*
 * Map libsldap status to idmap  status
 */
static
idmap_retcode
nldaprc2retcode(int rc)
{
    switch (rc) {
    case NS_LDAP_SUCCESS:
    case NS_LDAP_SUCCESS_WITH_INFO:
        return (IDMAP_SUCCESS);
    case NS_LDAP_NOTFOUND:
        return (IDMAP_ERR_NOTFOUND);
    case NS_LDAP_MEMORY:
        return (IDMAP_ERR_MEMORY);
    case NS_LDAP_CONFIG:
        return (IDMAP_ERR_NS_LDAP_CFG);
    case NS_LDAP_OP_FAILED:
        return (IDMAP_ERR_NS_LDAP_OP_FAILED);
    case NS_LDAP_PARTIAL:
        return (IDMAP_ERR_NS_LDAP_PARTIAL);
    case NS_LDAP_INTERNAL:
        return (IDMAP_ERR_INTERNAL);
    case NS_LDAP_INVALID_PARAM:
        return (IDMAP_ERR_ARG);
    default:
        return (IDMAP_ERR_OTHER);
    }
    /*NOTREACHED*/
}

/*
 * Create a batch for native LDAP lookup.
 */
static
idmap_retcode
idmap_nldap_lookup_batch_start(int nqueries, idmap_nldap_query_state_t **qs)
{
    idmap_nldap_query_state_t   *s;

    s = calloc(1, sizeof (*s) +
        (nqueries - 1) * sizeof (idmap_nldap_q_t));
    if (s == NULL)
        return (IDMAP_ERR_MEMORY);
    if (__ns_ldap_list_batch_start(&s->batch) != NS_LDAP_SUCCESS) {
        free(s);
        return (IDMAP_ERR_MEMORY);
    }
    s->nqueries = nqueries;
    s->flag = NS_LDAP_KEEP_CONN;
    *qs = s;
    return (IDMAP_SUCCESS);
}

/*
 * Add a lookup by winname request to the batch.
 */
static
idmap_retcode
idmap_nldap_bywinname_batch_add(idmap_nldap_query_state_t *qs,
    const char *winname, const char *windomain, int is_user,
    char **dn, char **attr, char **value,
    char **unixname, uid_t *pid, idmap_retcode *rc)
{
    idmap_nldap_q_t     *q;
    const char      *db, *filter, *udata;
    int         flen, ulen, wksid = 0;
    char            *s_winname, *s_windomain;
    const char      **attrs;
    const char      *pwd_attrs[] = {UID, UIDNUMBER, NULL, NULL};
    const char      *grp_attrs[] = {CN, GIDNUMBER, NULL, NULL};

    s_winname = s_windomain = NULL;
    q = &(qs->queries[qs->qid++]);
    q->unixname = unixname;
    q->pid = pid;
    q->rc = rc;
    q->is_user = is_user;
    q->dn = dn;
    q->attr = attr;
    q->value = value;

    if (is_user) {
        db = "passwd";
        if (lookup_wksids_name2sid(winname, NULL, NULL, NULL, NULL,
            NULL, NULL) == IDMAP_SUCCESS) {
            filter = _F_GETPWWNAMWK;
            udata = _F_GETPWWNAMWK_SSD;
            wksid = 1;
        } else if (windomain != NULL) {
            filter = _F_GETPWWNAMDOM;
            udata = _F_GETPWWNAMDOM_SSD;
        } else {
            *q->rc = IDMAP_ERR_DOMAIN_NOTFOUND;
            goto errout;
        }
        pwd_attrs[2] = qs->nldap_winname_attr;
        attrs = pwd_attrs;
    } else {
        db = "group";
        if (lookup_wksids_name2sid(winname, NULL, NULL, NULL, NULL,
            NULL, NULL) == IDMAP_SUCCESS) {
            filter = _F_GETGRWNAMWK;
            udata = _F_GETGRWNAMWK_SSD;
            wksid = 1;
        } else if (windomain != NULL) {
            filter = _F_GETGRWNAMDOM;
            udata = _F_GETGRWNAMDOM_SSD;
        } else {
            *q->rc = IDMAP_ERR_DOMAIN_NOTFOUND;
            goto errout;
        }
        grp_attrs[2] = qs->nldap_winname_attr;
        attrs = grp_attrs;
    }

    /*
     * Sanitize names. No need to sanitize qs->nldap_winname_attr
     * because if it contained any of the special characters then
     * it would have been rejected by the function that reads it
     * from the SMF config. LDAP attribute names can only contain
     * letters, digits or hyphens.
     */
    s_winname = sanitize_for_ldap_filter(winname);
    if (s_winname == NULL) {
        *q->rc = IDMAP_ERR_MEMORY;
        goto errout;
    }
    /* windomain could be NULL for names of well-known SIDs */
    if (windomain != NULL) {
        s_windomain = sanitize_for_ldap_filter(windomain);
        if (s_windomain == NULL) {
            *q->rc = IDMAP_ERR_MEMORY;
            goto errout;
        }
    }

    /* Construct the filter and udata using snprintf. */
    if (wksid) {
        flen = snprintf(NULL, 0, filter, qs->nldap_winname_attr,
            s_winname) + 1;
        ulen = snprintf(NULL, 0, udata, qs->nldap_winname_attr,
            s_winname) + 1;
    } else {
        flen = snprintf(NULL, 0, filter, qs->nldap_winname_attr,
            s_winname, s_windomain) + 1;
        ulen = snprintf(NULL, 0, udata, qs->nldap_winname_attr,
            s_winname, s_windomain) + 1;
    }

    q->filter = malloc(flen);
    if (q->filter == NULL) {
        *q->rc = IDMAP_ERR_MEMORY;
        goto errout;
    }
    q->udata = malloc(ulen);
    if (q->udata == NULL) {
        *q->rc = IDMAP_ERR_MEMORY;
        goto errout;
    }

    if (wksid) {
        (void) snprintf(q->filter, flen, filter,
            qs->nldap_winname_attr, s_winname);
        (void) snprintf(q->udata, ulen, udata,
            qs->nldap_winname_attr, s_winname);
    } else {
        (void) snprintf(q->filter, flen, filter,
            qs->nldap_winname_attr, s_winname, s_windomain);
        (void) snprintf(q->udata, ulen, udata,
            qs->nldap_winname_attr, s_winname, s_windomain);
    }

    if (s_winname != winname)
        free(s_winname);
    if (s_windomain != windomain)
        free(s_windomain);

    q->lrc = __ns_ldap_list_batch_add(qs->batch, db, q->filter,
        merge_SSD_filter, attrs, NULL, qs->flag, &q->result,
        &q->errorp, &q->lrc, NULL, q->udata);

    if (IS_NLDAP_RC_FATAL(q->lrc))
        return (nldaprc2retcode(q->lrc));
    return (IDMAP_SUCCESS);

errout:
    /* query q and its content will be freed by batch_release */
    if (s_winname != winname)
        free(s_winname);
    if (s_windomain != windomain)
        free(s_windomain);
    return (*q->rc);
}

/*
 * Add a lookup by uid/gid request to the batch.
 */
static
idmap_retcode
idmap_nldap_bypid_batch_add(idmap_nldap_query_state_t *qs,
    uid_t pid, int is_user, char **dn, char **attr, char **value,
    char **winname, char **windomain,
    char **unixname, idmap_retcode *rc)
{
    idmap_nldap_q_t     *q;
    const char      *db, *filter, *udata;
    int         len;
    const char      **attrs;
    const char      *pwd_attrs[] = {UID, NULL, NULL};
    const char      *grp_attrs[] = {CN, NULL, NULL};

    q = &(qs->queries[qs->qid++]);
    q->winname = winname;
    q->windomain = windomain;
    q->unixname = unixname;
    q->rc = rc;
    q->is_user = is_user;
    q->dn = dn;
    q->attr = attr;
    q->value = value;

    if (is_user) {
        db = "passwd";
        filter = _F_GETPWUID;
        udata = _F_GETPWUID_SSD;
        pwd_attrs[1] = qs->nldap_winname_attr;
        attrs = pwd_attrs;
    } else {
        db = "group";
        filter = _F_GETGRGID;
        udata = _F_GETGRGID_SSD;
        grp_attrs[1] = qs->nldap_winname_attr;
        attrs = grp_attrs;
    }

    len = snprintf(NULL, 0, filter, pid) + 1;
    q->filter = malloc(len);
    if (q->filter == NULL) {
        *q->rc = IDMAP_ERR_MEMORY;
        return (IDMAP_ERR_MEMORY);
    }
    (void) snprintf(q->filter, len, filter, pid);

    len = snprintf(NULL, 0, udata, pid) + 1;
    q->udata = malloc(len);
    if (q->udata == NULL) {
        *q->rc = IDMAP_ERR_MEMORY;
        return (IDMAP_ERR_MEMORY);
    }
    (void) snprintf(q->udata, len, udata, pid);

    q->lrc = __ns_ldap_list_batch_add(qs->batch, db, q->filter,
        merge_SSD_filter, attrs, NULL, qs->flag, &q->result,
        &q->errorp, &q->lrc, NULL, q->udata);

    if (IS_NLDAP_RC_FATAL(q->lrc))
        return (nldaprc2retcode(q->lrc));
    return (IDMAP_SUCCESS);
}

/*
 * Add a lookup by user/group name request to the batch.
 */
static
idmap_retcode
idmap_nldap_byunixname_batch_add(idmap_nldap_query_state_t *qs,
    const char *unixname, int is_user,
    char **dn, char **attr, char **value,
    char **winname, char **windomain, uid_t *pid, idmap_retcode *rc)
{
    idmap_nldap_q_t     *q;
    const char      *db, *filter, *udata;
    int         len;
    char            *s_unixname = NULL;
    const char      **attrs;
    const char      *pwd_attrs[] = {UIDNUMBER, NULL, NULL};
    const char      *grp_attrs[] = {GIDNUMBER, NULL, NULL};

    q = &(qs->queries[qs->qid++]);
    q->winname = winname;
    q->windomain = windomain;
    q->pid = pid;
    q->rc = rc;
    q->is_user = is_user;
    q->dn = dn;
    q->attr = attr;
    q->value = value;

    if (is_user) {
        db = "passwd";
        filter = _F_GETPWNAM;
        udata = _F_GETPWNAM_SSD;
        pwd_attrs[1] = qs->nldap_winname_attr;
        attrs = pwd_attrs;
    } else {
        db = "group";
        filter = _F_GETGRNAM;
        udata = _F_GETGRNAM_SSD;
        grp_attrs[1] = qs->nldap_winname_attr;
        attrs = grp_attrs;
    }

    s_unixname = sanitize_for_ldap_filter(unixname);
    if (s_unixname == NULL) {
        *q->rc = IDMAP_ERR_MEMORY;
        return (IDMAP_ERR_MEMORY);
    }

    len = snprintf(NULL, 0, filter, s_unixname) + 1;
    q->filter = malloc(len);
    if (q->filter == NULL) {
        if (s_unixname != unixname)
            free(s_unixname);
        *q->rc = IDMAP_ERR_MEMORY;
        return (IDMAP_ERR_MEMORY);
    }
    (void) snprintf(q->filter, len, filter, s_unixname);

    len = snprintf(NULL, 0, udata, s_unixname) + 1;
    q->udata = malloc(len);
    if (q->udata == NULL) {
        if (s_unixname != unixname)
            free(s_unixname);
        *q->rc = IDMAP_ERR_MEMORY;
        return (IDMAP_ERR_MEMORY);
    }
    (void) snprintf(q->udata, len, udata, s_unixname);

    if (s_unixname != unixname)
        free(s_unixname);

    q->lrc = __ns_ldap_list_batch_add(qs->batch, db, q->filter,
        merge_SSD_filter, attrs, NULL, qs->flag, &q->result,
        &q->errorp, &q->lrc, NULL, q->udata);

    if (IS_NLDAP_RC_FATAL(q->lrc))
        return (nldaprc2retcode(q->lrc));
    return (IDMAP_SUCCESS);
}

/*
 * Free the batch
 */
static
void
idmap_nldap_lookup_batch_release(idmap_nldap_query_state_t *qs)
{
    idmap_nldap_q_t     *q;
    int         i;

    if (qs->batch != NULL)
        (void) __ns_ldap_list_batch_release(qs->batch);
    for (i = 0; i < qs->qid; i++) {
        q = &(qs->queries[i]);
        free(q->filter);
        free(q->udata);
        if (q->errorp != NULL)
            (void) __ns_ldap_freeError(&q->errorp);
        if (q->result != NULL)
            (void) __ns_ldap_freeResult(&q->result);
    }
    free(qs);
}

/*
 * Process all requests added to the batch and then free the batch.
 * The results for individual requests will be accessible using the
 * pointers passed during idmap_nldap_lookup_batch_end.
 */
static
idmap_retcode
idmap_nldap_lookup_batch_end(idmap_nldap_query_state_t *qs)
{
    idmap_nldap_q_t     *q;
    int         i;
    ns_ldap_entry_t     *entry;
    char            **val, *end, *str, *name, *dom;
    idmap_retcode       rc = IDMAP_SUCCESS;

    (void) __ns_ldap_list_batch_end(qs->batch);
    qs->batch = NULL;
    for (i = 0; i < qs->qid; i++) {
        q = &(qs->queries[i]);
        *q->rc = nldaprc2retcode(q->lrc);
        if (*q->rc != IDMAP_SUCCESS)
            continue;
        if (q->result == NULL ||
            !q->result->entries_count ||
            (entry = q->result->entry) == NULL ||
            !entry->attr_count) {
            *q->rc = IDMAP_ERR_NOTFOUND;
            continue;
        }
        /* Get uid/gid */
        if (q->pid != NULL) {
            val = __ns_ldap_getAttr(entry,
                (q->is_user) ? UIDNUMBER : GIDNUMBER);
            if (val != NULL && *val != NULL)
                *q->pid = strtoul(*val, &end, 10);
        }
        /* Get unixname */
        if (q->unixname != NULL) {
            val = __ns_ldap_getAttr(entry,
                (q->is_user) ? UID : CN);
            if (val != NULL && *val != NULL) {
                *q->unixname = strdup(*val);
                if (*q->unixname == NULL) {
                    rc = *q->rc = IDMAP_ERR_MEMORY;
                    goto out;
                }
            }
        }
        /* Get DN for how info */
        if (q->dn != NULL) {
            val = __ns_ldap_getAttr(entry, DN);
            if (val != NULL && *val != NULL) {
                *q->dn = strdup(*val);
                if (*q->dn == NULL) {
                    rc = *q->rc = IDMAP_ERR_MEMORY;
                    goto out;
                }
            }
        }
        /* Get nldap name mapping attr name for how info */
        if (q->attr != NULL) {
            *q->attr = strdup(qs->nldap_winname_attr);
            if (*q->attr == NULL) {
                rc = *q->rc = IDMAP_ERR_MEMORY;
                goto out;
            }
        }
        /* Get nldap name mapping attr value for how info */
        val =  __ns_ldap_getAttr(entry, qs->nldap_winname_attr);
        if (val == NULL || *val == NULL)
            continue;
        if (q->value != NULL) {
            *q->value = strdup(*val);
            if (*q->value == NULL) {
                rc = *q->rc = IDMAP_ERR_MEMORY;
                goto out;
            }
        }

        /* Get winname and windomain */
        if (q->winname == NULL && q->windomain == NULL)
            continue;
        /*
         * We need to split the value into winname and
         * windomain. The value could be either in NT4
         * style (i.e. dom\name) or AD-style (i.e. name@dom).
         * We choose the first '\\' if it's in NT4 style and
         * the last '@' if it's in AD-style for the split.
         */
        name = dom = NULL;
        if (lookup_wksids_name2sid(*val, NULL, NULL, NULL, NULL, NULL,
            NULL) == IDMAP_SUCCESS) {
            name = *val;
            dom = NULL;
        } else if ((str = strchr(*val, '\\')) != NULL) {
            *str = '\0';
            name = str + 1;
            dom = *val;
        } else if ((str = strrchr(*val, '@')) != NULL) {
            *str = '\0';
            name = *val;
            dom = str + 1;
        } else {
            idmapdlog(LOG_INFO, "Domain-less "
                "winname (%s) found in Native LDAP", *val);
            *q->rc = IDMAP_ERR_NS_LDAP_BAD_WINNAME;
            continue;
        }
        if (q->winname != NULL) {
            *q->winname = strdup(name);
            if (*q->winname == NULL) {
                rc = *q->rc = IDMAP_ERR_MEMORY;
                goto out;
            }
        }
        if (q->windomain != NULL && dom != NULL) {
            *q->windomain = strdup(dom);
            if (*q->windomain == NULL) {
                rc = *q->rc = IDMAP_ERR_MEMORY;
                goto out;
            }
        }
    }

out:
    (void) idmap_nldap_lookup_batch_release(qs);
    return (rc);
}

/* ARGSUSED */
idmap_retcode
nldap_lookup_batch(lookup_state_t *state, idmap_mapping_batch *batch,
        idmap_ids_res *result)
{
    idmap_retcode           retcode, rc1;
    int             i, add;
    idmap_mapping           *req;
    idmap_id_res            *res;
    idmap_nldap_query_state_t   *qs = NULL;
    idmap_how           *how;

    if (state->nldap_nqueries == 0)
        return (IDMAP_SUCCESS);

    /* Create nldap lookup batch */
    retcode = idmap_nldap_lookup_batch_start(state->nldap_nqueries, &qs);
    if (retcode != IDMAP_SUCCESS) {
        idmapdlog(LOG_ERR,
            "Failed to create batch for native LDAP lookup");
        goto out;
    }

    qs->nldap_winname_attr = state->nldap_winname_attr;
    qs->defdom = state->defdom;

    /* Add requests to the batch */
    for (i = 0, add = 0; i < batch->idmap_mapping_batch_len; i++) {
        req = &batch->idmap_mapping_batch_val[i];
        res = &result->ids.ids_val[i];
        retcode = IDMAP_SUCCESS;

        /* Skip if not marked for nldap lookup */
        if (!(req->direction & _IDMAP_F_LOOKUP_NLDAP))
            continue;

        if (IS_ID_SID(req->id1)) {

            /* win2unix request: */

            /*
             * When processing a win2unix request, nldap lookup
             * is performed after AD lookup or a successful
             * name-cache lookup. Therefore we should already
             * have sid, winname and sidtype. Note that
             * windomain could be NULL e.g. well-known SIDs.
             */
            assert(req->id1name != NULL &&
                (res->id.idtype == IDMAP_UID ||
                res->id.idtype == IDMAP_GID));

            /* Skip if we already have pid and unixname */
            if (req->id2name != NULL &&
                res->id.idmap_id_u.uid != IDMAP_SENTINEL_PID) {
                res->retcode = IDMAP_SUCCESS;
                continue;
            }

            /* Clear leftover value */
            free(req->id2name);
            req->id2name = NULL;

            /* Lookup nldap by winname to get pid and unixname */
            add = 1;
            idmap_how_clear(&res->info.how);
            res->info.src = IDMAP_MAP_SRC_NEW;
            how = &res->info.how;
            how->map_type = IDMAP_MAP_TYPE_DS_NLDAP;
            retcode = idmap_nldap_bywinname_batch_add(
                qs, req->id1name, req->id1domain,
                (res->id.idtype == IDMAP_UID) ? 1 : 0,
                &how->idmap_how_u.nldap.dn,
                &how->idmap_how_u.nldap.attr,
                &how->idmap_how_u.nldap.value,
                &req->id2name, &res->id.idmap_id_u.uid,
                &res->retcode);

        } else if (IS_ID_UID(req->id1) || IS_ID_GID(req->id1)) {

            /* unix2win request: */

            /* Skip if we already have winname */
            if (req->id2name != NULL) {
                res->retcode = IDMAP_SUCCESS;
                continue;
            }

            /* Clear old value */
            free(req->id2domain);
            req->id2domain = NULL;

            /* Set how info */
            idmap_how_clear(&res->info.how);
            res->info.src = IDMAP_MAP_SRC_NEW;
            how = &res->info.how;
            how->map_type = IDMAP_MAP_TYPE_DS_NLDAP;

            /* Lookup nldap by pid or unixname to get winname */
            if (req->id1.idmap_id_u.uid != IDMAP_SENTINEL_PID) {
                add = 1;
                retcode = idmap_nldap_bypid_batch_add(
                    qs, req->id1.idmap_id_u.uid,
                    (req->id1.idtype == IDMAP_UID) ? 1 : 0,
                    &how->idmap_how_u.nldap.dn,
                    &how->idmap_how_u.nldap.attr,
                    &how->idmap_how_u.nldap.value,
                    &req->id2name, &req->id2domain,
                    (req->id1name == NULL) ?
                    &req->id1name : NULL,
                    &res->retcode);
            } else if (req->id1name != NULL) {
                add = 1;
                retcode = idmap_nldap_byunixname_batch_add(
                    qs, req->id1name,
                    (req->id1.idtype == IDMAP_UID) ? 1 : 0,
                    &how->idmap_how_u.nldap.dn,
                    &how->idmap_how_u.nldap.attr,
                    &how->idmap_how_u.nldap.value,
                    &req->id2name, &req->id2domain,
                    &req->id1.idmap_id_u.uid, &res->retcode);
            }

        }

        /*
         * nldap_batch_add API returns error only on fatal failures
         * otherwise it returns success and the actual status
         * is stored in the individual request (res->retcode).
         * Stop adding requests to this batch on fatal failures
         * (i.e. if retcode != success)
         */
        if (retcode != IDMAP_SUCCESS)
            break;
    }

    if (!add)
        idmap_nldap_lookup_batch_release(qs);
    else if (retcode != IDMAP_SUCCESS)
        idmap_nldap_lookup_batch_release(qs);
    else
        retcode = idmap_nldap_lookup_batch_end(qs);

out:
    for (i = 0; i < batch->idmap_mapping_batch_len; i++) {
        req = &batch->idmap_mapping_batch_val[i];
        res = &result->ids.ids_val[i];
        if (!(req->direction & _IDMAP_F_LOOKUP_NLDAP))
            continue;

        /* Reset nldap flag */
        req->direction &= ~(_IDMAP_F_LOOKUP_NLDAP);

        /*
         * As noted earlier retcode != success if there were fatal
         * errors during batch_start and batch_adds. If so then set
         * the status of each nldap request to that error.
         */
        if (retcode != IDMAP_SUCCESS) {
            res->retcode = retcode;
            continue;
        }
        if (!add)
            continue;

        /*
         * If we successfully retrieved winname from nldap entry
         * then lookup winname2sid locally. If not found locally
         * then mark this request for AD lookup.
         */
        if (res->retcode == IDMAP_SUCCESS &&
            req->id2name != NULL &&
            res->id.idmap_id_u.sid.prefix == NULL &&
            (IS_ID_UID(req->id1) || IS_ID_GID(req->id1))) {

            rc1 = lookup_name2sid(state->cache,
                req->id2name, req->id2domain, -1,
                NULL, NULL,
                &res->id.idmap_id_u.sid.prefix,
                &res->id.idmap_id_u.sid.rid,
                &res->id.idtype,
                req, 1);
            if (rc1 == IDMAP_ERR_NOTFOUND) {
                req->direction |= _IDMAP_F_LOOKUP_AD;
                state->ad_nqueries++;
            } else
                res->retcode = rc1;
        }

        /*
         * Unset non-fatal errors in individual request. This allows
         * the next pass to process other mapping mechanisms for
         * this request.
         */
        if (res->retcode != IDMAP_SUCCESS &&
            res->retcode != IDMAP_ERR_NS_LDAP_BAD_WINNAME &&
            !(IDMAP_FATAL_ERROR(res->retcode))) {
            idmap_how_clear(&res->info.how);
            res->retcode = IDMAP_SUCCESS;
        }
    }

    state->nldap_nqueries = 0;
    return (retcode);
}