server.c revision 4d61c878ad5fbf36c5338bef5994cc5fe88a589a
2N/A/*
2N/A * CDDL HEADER START
2N/A *
2N/A * The contents of this file are subject to the terms of the
2N/A * Common Development and Distribution License (the "License").
2N/A * You may not use this file except in compliance with the License.
2N/A *
2N/A * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A * or http://www.opensolaris.org/os/licensing.
2N/A * See the License for the specific language governing permissions
2N/A * and limitations under the License.
2N/A *
2N/A * When distributing Covered Code, include this CDDL HEADER in each
2N/A * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A * If applicable, add the following below this CDDL HEADER, with the
2N/A * fields enclosed by brackets "[]" replaced with your own identifying
2N/A * information: Portions Copyright [yyyy] [name of copyright owner]
2N/A *
2N/A * CDDL HEADER END
2N/A */
2N/A/*
2N/A * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
2N/A * Use is subject to license terms.
2N/A */
2N/A
2N/A
2N/A/*
2N/A * Service routines
2N/A */
2N/A
2N/A#include "idmapd.h"
2N/A#include "idmap_priv.h"
2N/A#include "nldaputils.h"
2N/A#include <signal.h>
2N/A#include <thread.h>
2N/A#include <string.h>
2N/A#include <strings.h>
2N/A#include <errno.h>
2N/A#include <assert.h>
2N/A#include <sys/types.h>
2N/A#include <sys/stat.h>
2N/A#include <ucred.h>
2N/A#include <pwd.h>
2N/A#include <auth_attr.h>
2N/A#include <secdb.h>
2N/A#include <sys/u8_textprep.h>
2N/A
2N/A#define _VALIDATE_LIST_CB_DATA(col, val, siz)\
2N/A retcode = validate_list_cb_data(cb_data, argc, argv, col,\
2N/A (uchar_t **)val, siz);\
2N/A if (retcode == IDMAP_NEXT) {\
2N/A result->retcode = IDMAP_NEXT;\
2N/A return (0);\
2N/A } else if (retcode < 0) {\
2N/A result->retcode = retcode;\
2N/A return (1);\
2N/A }
2N/A
2N/A#define PROCESS_LIST_SVC_SQL(rcode, db, dbname, sql, limit, flag, cb, res, len)\
2N/A rcode = process_list_svc_sql(db, dbname, sql, limit, flag, cb, res);\
2N/A if (rcode == IDMAP_ERR_BUSY)\
2N/A res->retcode = IDMAP_ERR_BUSY;\
2N/A else if (rcode == IDMAP_SUCCESS && len == 0)\
2N/A res->retcode = IDMAP_ERR_NOTFOUND;
2N/A
2N/A
2N/A#define STRDUP_OR_FAIL(to, from) \
2N/A if ((from) == NULL) \
2N/A to = NULL; \
2N/A else { \
2N/A if ((to = strdup(from)) == NULL) \
2N/A return (1); \
2N/A }
2N/A
2N/A#define STRDUP_CHECK(to, from) \
2N/A if ((from) != NULL) { \
2N/A to = strdup(from); \
2N/A if (to == NULL) { \
2N/A result->retcode = IDMAP_ERR_MEMORY; \
2N/A goto out; \
2N/A } \
2N/A }
2N/A
2N/A/* ARGSUSED */
2N/Abool_t
2N/Aidmap_null_1_svc(void *result, struct svc_req *rqstp)
2N/A{
2N/A return (TRUE);
2N/A}
2N/A
2N/A/*
2N/A * RPC layer allocates empty strings to replace NULL char *.
2N/A * This utility function frees these empty strings.
2N/A */
2N/Astatic
2N/Avoid
2N/Asanitize_mapping_request(idmap_mapping *req)
2N/A{
2N/A free(req->id1name);
2N/A req->id1name = NULL;
2N/A free(req->id1domain);
2N/A req->id1domain = NULL;
2N/A free(req->id2name);
2N/A req->id2name = NULL;
2N/A free(req->id2domain);
2N/A req->id2domain = NULL;
2N/A req->direction = _IDMAP_F_DONE;
2N/A}
2N/A
2N/Astatic
2N/Aint
2N/Avalidate_mapped_id_by_name_req(idmap_mapping *req)
2N/A{
2N/A int e;
2N/A
2N/A if (IS_REQUEST_UID(*req) || IS_REQUEST_GID(*req))
2N/A return (IDMAP_SUCCESS);
2N/A
2N/A if (IS_REQUEST_SID(*req, 1)) {
2N/A if (!EMPTY_STRING(req->id1name) &&
2N/A u8_validate(req->id1name, strlen(req->id1name),
2N/A NULL, U8_VALIDATE_ENTIRE, &e) < 0)
2N/A return (IDMAP_ERR_BAD_UTF8);
2N/A if (!EMPTY_STRING(req->id1domain) &&
2N/A u8_validate(req->id1domain, strlen(req->id1domain),
2N/A NULL, U8_VALIDATE_ENTIRE, &e) < 0)
2N/A return (IDMAP_ERR_BAD_UTF8);
2N/A }
2N/A
2N/A return (IDMAP_SUCCESS);
2N/A}
2N/A
2N/Astatic
2N/Aint
2N/Avalidate_rule(idmap_namerule *rule)
2N/A{
2N/A int e;
2N/A
2N/A if (!EMPTY_STRING(rule->winname) &&
2N/A u8_validate(rule->winname, strlen(rule->winname),
2N/A NULL, U8_VALIDATE_ENTIRE, &e) < 0)
2N/A return (IDMAP_ERR_BAD_UTF8);
2N/A
2N/A if (!EMPTY_STRING(rule->windomain) &&
2N/A u8_validate(rule->windomain, strlen(rule->windomain),
2N/A NULL, U8_VALIDATE_ENTIRE, &e) < 0)
2N/A return (IDMAP_ERR_BAD_UTF8);
2N/A
2N/A return (IDMAP_SUCCESS);
2N/A
2N/A}
2N/A
2N/Astatic
2N/Abool_t
2N/Avalidate_rules(idmap_update_batch *batch)
2N/A{
2N/A idmap_update_op *up;
2N/A int i;
2N/A
2N/A for (i = 0; i < batch->idmap_update_batch_len; i++) {
2N/A up = &(batch->idmap_update_batch_val[i]);
2N/A if (validate_rule(&(up->idmap_update_op_u.rule))
2N/A != IDMAP_SUCCESS)
2N/A return (IDMAP_ERR_BAD_UTF8);
2N/A }
2N/A
2N/A return (IDMAP_SUCCESS);
2N/A}
2N/A
2N/A/* ARGSUSED */
2N/Abool_t
2N/Aidmap_get_mapped_ids_1_svc(idmap_mapping_batch batch,
2N/A idmap_ids_res *result, struct svc_req *rqstp)
2N/A{
2N/A sqlite *cache = NULL, *db = NULL;
2N/A lookup_state_t state;
2N/A idmap_retcode retcode;
2N/A uint_t i;
2N/A
2N/A /* Init */
2N/A (void) memset(result, 0, sizeof (*result));
2N/A (void) memset(&state, 0, sizeof (state));
2N/A
2N/A /* Return success if nothing was requested */
2N/A if (batch.idmap_mapping_batch_len < 1)
2N/A goto out;
2N/A
2N/A /* Get cache handle */
2N/A result->retcode = get_cache_handle(&cache);
2N/A if (result->retcode != IDMAP_SUCCESS)
2N/A goto out;
2N/A state.cache = cache;
2N/A
2N/A /* Get db handle */
2N/A result->retcode = get_db_handle(&db);
2N/A if (result->retcode != IDMAP_SUCCESS)
2N/A goto out;
2N/A state.db = db;
2N/A
2N/A /* Allocate result array */
2N/A result->ids.ids_val = calloc(batch.idmap_mapping_batch_len,
2N/A sizeof (idmap_id_res));
2N/A if (result->ids.ids_val == NULL) {
2N/A idmapdlog(LOG_ERR, "Out of memory");
2N/A result->retcode = IDMAP_ERR_MEMORY;
2N/A goto out;
2N/A }
2N/A result->ids.ids_len = batch.idmap_mapping_batch_len;
2N/A
2N/A /* Allocate hash table to check for duplicate sids */
2N/A state.sid_history = calloc(batch.idmap_mapping_batch_len,
2N/A sizeof (*state.sid_history));
2N/A if (state.sid_history == NULL) {
2N/A idmapdlog(LOG_ERR, "Out of memory");
2N/A result->retcode = IDMAP_ERR_MEMORY;
2N/A goto out;
2N/A }
2N/A state.sid_history_size = batch.idmap_mapping_batch_len;
2N/A for (i = 0; i < state.sid_history_size; i++) {
2N/A state.sid_history[i].key = state.sid_history_size;
2N/A state.sid_history[i].next = state.sid_history_size;
2N/A }
2N/A state.batch = &batch;
2N/A state.result = result;
2N/A
2N/A /* Get directory-based name mapping info */
2N/A result->retcode = load_cfg_in_state(&state);
2N/A if (result->retcode != IDMAP_SUCCESS)
2N/A goto out;
2N/A
2N/A /* Init our 'done' flags */
2N/A state.sid2pid_done = state.pid2sid_done = TRUE;
2N/A
2N/A /* First stage */
2N/A for (i = 0; i < batch.idmap_mapping_batch_len; i++) {
2N/A state.curpos = i;
2N/A (void) sanitize_mapping_request(
2N/A &batch.idmap_mapping_batch_val[i]);
2N/A if (IS_BATCH_SID(batch, i)) {
2N/A retcode = sid2pid_first_pass(
2N/A &state,
2N/A &batch.idmap_mapping_batch_val[i],
2N/A &result->ids.ids_val[i]);
2N/A } else if (IS_BATCH_UID(batch, i)) {
2N/A retcode = pid2sid_first_pass(
2N/A &state,
2N/A &batch.idmap_mapping_batch_val[i],
2N/A &result->ids.ids_val[i], 1, 0);
2N/A } else if (IS_BATCH_GID(batch, i)) {
2N/A retcode = pid2sid_first_pass(
2N/A &state,
2N/A &batch.idmap_mapping_batch_val[i],
2N/A &result->ids.ids_val[i], 0, 0);
2N/A } else {
2N/A result->ids.ids_val[i].retcode = IDMAP_ERR_IDTYPE;
2N/A continue;
2N/A }
2N/A if (IDMAP_FATAL_ERROR(retcode)) {
2N/A result->retcode = retcode;
2N/A goto out;
2N/A }
2N/A }
2N/A
2N/A /* Check if we are done */
2N/A if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE)
2N/A goto out;
2N/A
2N/A /*
2N/A * native LDAP lookups:
2N/A * pid2sid:
2N/A * - nldap or mixed mode. Lookup nldap by pid or unixname to get
2N/A * winname.
2N/A * sid2pid:
2N/A * - nldap mode. Got winname and sid (either given or found in
2N/A * name_cache). Lookup nldap by winname to get pid and
2N/A * unixname.
2N/A */
2N/A if (state.nldap_nqueries) {
2N/A retcode = nldap_lookup_batch(&state, &batch, result);
2N/A if (IDMAP_FATAL_ERROR(retcode)) {
2N/A result->retcode = retcode;
2N/A goto out;
2N/A }
2N/A }
2N/A
2N/A /*
2N/A * AD lookups:
2N/A * pid2sid:
2N/A * - nldap or mixed mode. Got winname from nldap lookup.
2N/A * winname2sid could not be resolved locally. Lookup AD
2N/A * by winname to get sid.
2N/A * - ad mode. Got unixname. Lookup AD by unixname to get
2N/A * winname and sid.
2N/A * sid2pid:
2N/A * - ad or mixed mode. Lookup AD by sid or winname to get
2N/A * winname, sid and unixname.
2N/A * - any mode. Got either sid or winname but not both. Lookup
2N/A * AD by sid or winname to get winname, sid.
2N/A */
2N/A if (state.ad_nqueries) {
2N/A retcode = ad_lookup_batch(&state, &batch, result);
2N/A if (IDMAP_FATAL_ERROR(retcode)) {
2N/A result->retcode = retcode;
2N/A goto out;
2N/A }
2N/A }
2N/A
2N/A /*
2N/A * native LDAP lookups:
2N/A * sid2pid:
2N/A * - nldap mode. Got winname and sid from AD lookup. Lookup nldap
2N/A * by winname to get pid and unixname.
2N/A */
2N/A if (state.nldap_nqueries) {
2N/A retcode = nldap_lookup_batch(&state, &batch, result);
2N/A if (IDMAP_FATAL_ERROR(retcode)) {
2N/A result->retcode = retcode;
2N/A goto out;
2N/A }
2N/A }
2N/A
2N/A /* Reset 'done' flags */
2N/A state.sid2pid_done = state.pid2sid_done = TRUE;
2N/A
2N/A /* Second stage */
2N/A for (i = 0; i < batch.idmap_mapping_batch_len; i++) {
2N/A state.curpos = i;
2N/A if (IS_BATCH_SID(batch, i)) {
2N/A retcode = sid2pid_second_pass(
2N/A &state,
2N/A &batch.idmap_mapping_batch_val[i],
2N/A &result->ids.ids_val[i]);
2N/A } else if (IS_BATCH_UID(batch, i)) {
2N/A retcode = pid2sid_second_pass(
2N/A &state,
2N/A &batch.idmap_mapping_batch_val[i],
2N/A &result->ids.ids_val[i], 1);
2N/A } else if (IS_BATCH_GID(batch, i)) {
2N/A retcode = pid2sid_second_pass(
2N/A &state,
2N/A &batch.idmap_mapping_batch_val[i],
2N/A &result->ids.ids_val[i], 0);
2N/A } else {
2N/A /* First stage has already set the error */
2N/A continue;
2N/A }
2N/A if (IDMAP_FATAL_ERROR(retcode)) {
2N/A result->retcode = retcode;
2N/A goto out;
2N/A }
2N/A }
2N/A
2N/A /* Check if we are done */
2N/A if (state.sid2pid_done == TRUE && state.pid2sid_done == TRUE)
2N/A goto out;
2N/A
2N/A /* Reset our 'done' flags */
2N/A state.sid2pid_done = state.pid2sid_done = TRUE;
2N/A
2N/A /* Update cache in a single transaction */
2N/A if (sql_exec_no_cb(cache, IDMAP_CACHENAME, "BEGIN TRANSACTION;")
2N/A != IDMAP_SUCCESS)
2N/A goto out;
2N/A
2N/A for (i = 0; i < batch.idmap_mapping_batch_len; i++) {
2N/A state.curpos = i;
2N/A if (IS_BATCH_SID(batch, i)) {
2N/A (void) update_cache_sid2pid(
2N/A &state,
2N/A &batch.idmap_mapping_batch_val[i],
2N/A &result->ids.ids_val[i]);
2N/A } else if ((IS_BATCH_UID(batch, i)) ||
2N/A (IS_BATCH_GID(batch, i))) {
2N/A (void) update_cache_pid2sid(
2N/A &state,
2N/A &batch.idmap_mapping_batch_val[i],
2N/A &result->ids.ids_val[i]);
2N/A }
2N/A }
2N/A
2N/A /* Commit if we have at least one successful update */
2N/A if (state.sid2pid_done == FALSE || state.pid2sid_done == FALSE)
2N/A (void) sql_exec_no_cb(cache, IDMAP_CACHENAME,
2N/A "COMMIT TRANSACTION;");
2N/A else
2N/A (void) sql_exec_no_cb(cache, IDMAP_CACHENAME,
2N/A "END TRANSACTION;");
2N/A
2N/Aout:
2N/A cleanup_lookup_state(&state);
2N/A if (IDMAP_ERROR(result->retcode)) {
2N/A xdr_free(xdr_idmap_ids_res, (caddr_t)result);
2N/A result->ids.ids_len = 0;
2N/A result->ids.ids_val = NULL;
2N/A }
2N/A result->retcode = idmap_stat4prot(result->retcode);
2N/A return (TRUE);
2N/A}
2N/A
2N/A
2N/A/* ARGSUSED */
2N/Astatic
2N/Aint
2N/Alist_mappings_cb(void *parg, int argc, char **argv, char **colnames)
2N/A{
2N/A list_cb_data_t *cb_data;
2N/A char *str;
2N/A idmap_mappings_res *result;
2N/A idmap_retcode retcode;
2N/A int w2u, u2w;
2N/A char *end;
2N/A static int validated_column_names = 0;
2N/A idmap_how *how;
2N/A
2N/A cb_data = (list_cb_data_t *)parg;
2N/A
2N/A if (!validated_column_names) {
2N/A assert(strcmp(colnames[0], "rowid") == 0);
2N/A assert(strcmp(colnames[1], "sidprefix") == 0);
2N/A assert(strcmp(colnames[2], "rid") == 0);
2N/A assert(strcmp(colnames[3], "pid") == 0);
2N/A assert(strcmp(colnames[4], "w2u") == 0);
2N/A assert(strcmp(colnames[5], "u2w") == 0);
2N/A assert(strcmp(colnames[6], "windomain") == 0);
2N/A assert(strcmp(colnames[7], "canon_winname") == 0);
2N/A assert(strcmp(colnames[8], "unixname") == 0);
2N/A assert(strcmp(colnames[9], "is_user") == 0);
2N/A assert(strcmp(colnames[10], "is_wuser") == 0);
2N/A assert(strcmp(colnames[11], "map_type") == 0);
2N/A assert(strcmp(colnames[12], "map_dn") == 0);
2N/A assert(strcmp(colnames[13], "map_attr") == 0);
2N/A assert(strcmp(colnames[14], "map_value") == 0);
2N/A assert(strcmp(colnames[15], "map_windomain") == 0);
2N/A assert(strcmp(colnames[16], "map_winname") == 0);
2N/A assert(strcmp(colnames[17], "map_unixname") == 0);
2N/A assert(strcmp(colnames[18], "map_is_nt4") == 0);
2N/A validated_column_names = 1;
2N/A }
2N/A
2N/A result = (idmap_mappings_res *)cb_data->result;
2N/A
2N/A _VALIDATE_LIST_CB_DATA(19, &result->mappings.mappings_val,
2N/A sizeof (idmap_mapping));
2N/A
2N/A result->mappings.mappings_len++;
2N/A
2N/A if ((str = strdup(argv[1])) == NULL)
2N/A return (1);
2N/A result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.prefix =
2N/A str;
2N/A result->mappings.mappings_val[cb_data->next].id1.idmap_id_u.sid.rid =
2N/A strtoul(argv[2], &end, 10);
2N/A result->mappings.mappings_val[cb_data->next].id1.idtype =
2N/A strtol(argv[10], &end, 10) ? IDMAP_USID : IDMAP_GSID;
2N/A
2N/A result->mappings.mappings_val[cb_data->next].id2.idmap_id_u.uid =
2N/A strtoul(argv[3], &end, 10);
2N/A result->mappings.mappings_val[cb_data->next].id2.idtype =
2N/A strtol(argv[9], &end, 10) ? IDMAP_UID : IDMAP_GID;
2N/A
2N/A w2u = argv[4] ? strtol(argv[4], &end, 10) : 0;
2N/A u2w = argv[5] ? strtol(argv[5], &end, 10) : 0;
2N/A
2N/A if (w2u > 0 && u2w == 0)
2N/A result->mappings.mappings_val[cb_data->next].direction =
2N/A IDMAP_DIRECTION_W2U;
2N/A else if (w2u == 0 && u2w > 0)
2N/A result->mappings.mappings_val[cb_data->next].direction =
2N/A IDMAP_DIRECTION_U2W;
2N/A else
2N/A result->mappings.mappings_val[cb_data->next].direction =
2N/A IDMAP_DIRECTION_BI;
2N/A
2N/A STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1domain,
2N/A argv[6]);
2N/A
2N/A STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id1name,
2N/A argv[7]);
2N/A
2N/A STRDUP_OR_FAIL(result->mappings.mappings_val[cb_data->next].id2name,
2N/A argv[8]);
2N/A
2N/A if (cb_data->flag & IDMAP_REQ_FLG_MAPPING_INFO) {
2N/A how = &result->mappings.mappings_val[cb_data->next].info.how;
2N/A how->map_type = strtoul(argv[11], &end, 10);
2N/A switch (how->map_type) {
2N/A case IDMAP_MAP_TYPE_DS_AD:
2N/A how->idmap_how_u.ad.dn =
2N/A strdup(argv[12]);
2N/A how->idmap_how_u.ad.attr =
2N/A strdup(argv[13]);
2N/A how->idmap_how_u.ad.value =
2N/A strdup(argv[14]);
2N/A break;
2N/A
2N/A case IDMAP_MAP_TYPE_DS_NLDAP:
2N/A how->idmap_how_u.nldap.dn =
2N/A strdup(argv[12]);
2N/A how->idmap_how_u.nldap.attr =
2N/A strdup(argv[13]);
2N/A how->idmap_how_u.nldap.value =
2N/A strdup(argv[14]);
2N/A break;
2N/A
2N/A case IDMAP_MAP_TYPE_RULE_BASED:
2N/A how->idmap_how_u.rule.windomain =
2N/A strdup(argv[15]);
2N/A how->idmap_how_u.rule.winname =
2N/A strdup(argv[16]);
2N/A how->idmap_how_u.rule.unixname =
2N/A strdup(argv[17]);
2N/A how->idmap_how_u.rule.is_nt4 =
2N/A strtoul(argv[18], &end, 10);
2N/A how->idmap_how_u.rule.is_user =
2N/A strtol(argv[9], &end, 10);
2N/A how->idmap_how_u.rule.is_wuser =
2N/A strtol(argv[10], &end, 10);
2N/A break;
2N/A
2N/A case IDMAP_MAP_TYPE_EPHEMERAL:
2N/A break;
2N/A
2N/A case IDMAP_MAP_TYPE_LOCAL_SID:
2N/A break;
2N/A
2N/A default:
2N/A /* Unknow mapping type */
2N/A assert(FALSE);
2N/A }
2N/A
2N/A }
2N/A
2N/A result->lastrowid = strtoll(argv[0], &end, 10);
2N/A cb_data->next++;
2N/A result->retcode = IDMAP_SUCCESS;
2N/A return (0);
2N/A}
2N/A
2N/A
2N/A/* ARGSUSED */
2N/Abool_t
2N/Aidmap_list_mappings_1_svc(int64_t lastrowid, uint64_t limit, int32_t flag,
2N/A idmap_mappings_res *result, struct svc_req *rqstp)
2N/A{
2N/A sqlite *cache = NULL;
2N/A char lbuf[30], rbuf[30];
2N/A uint64_t maxlimit;
2N/A idmap_retcode retcode;
2N/A char *sql = NULL;
2N/A time_t curtime;
2N/A
2N/A (void) memset(result, 0, sizeof (*result));
2N/A lbuf[0] = rbuf[0] = 0;
2N/A
2N/A /* Current time */
2N/A errno = 0;
2N/A if ((curtime = time(NULL)) == (time_t)-1) {
2N/A idmapdlog(LOG_ERR, "Failed to get current time (%s)",
2N/A strerror(errno));
2N/A retcode = IDMAP_ERR_INTERNAL;
2N/A goto out;
2N/A }
2N/A
2N/A RDLOCK_CONFIG();
2N/A maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit;
2N/A UNLOCK_CONFIG();
2N/A
2N/A /* Get cache handle */
2N/A result->retcode = get_cache_handle(&cache);
2N/A if (result->retcode != IDMAP_SUCCESS)
2N/A goto out;
2N/A
2N/A result->retcode = IDMAP_ERR_INTERNAL;
2N/A
2N/A /* Create LIMIT expression. */
2N/A if (limit == 0 || (maxlimit > 0 && maxlimit < limit))
2N/A limit = maxlimit;
2N/A if (limit > 0)
2N/A (void) snprintf(lbuf, sizeof (lbuf),
2N/A "LIMIT %" PRIu64, limit + 1ULL);
2N/A
2N/A (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid);
2N/A
2N/A /*
2N/A * Combine all the above into a giant SELECT statement that
2N/A * will return the requested mappings
2N/A */
2N/A
2N/A sql = sqlite_mprintf("SELECT rowid, sidprefix, rid, pid, w2u, "
2N/A "u2w, windomain, canon_winname, unixname, is_user, is_wuser, "
2N/A "map_type, map_dn, map_attr, map_value, map_windomain, "
2N/A "map_winname, map_unixname, map_is_nt4 "
2N/A "FROM idmap_cache WHERE %s AND "
2N/A "(pid >= 2147483648 OR (expiration = 0 OR "
2N/A "expiration ISNULL OR expiration > %d)) "
2N/A "%s;",
2N/A rbuf, curtime, lbuf);
2N/A if (sql == NULL) {
2N/A result->retcode = IDMAP_ERR_MEMORY;
2N/A idmapdlog(LOG_ERR, "Out of memory");
2N/A goto out;
2N/A }
2N/A
2N/A /* Execute the SQL statement and update the return buffer */
2N/A PROCESS_LIST_SVC_SQL(retcode, cache, IDMAP_CACHENAME, sql, limit,
2N/A flag, list_mappings_cb, result, result->mappings.mappings_len);
2N/A
2N/Aout:
2N/A if (sql)
2N/A sqlite_freemem(sql);
2N/A if (IDMAP_ERROR(result->retcode))
2N/A (void) xdr_free(xdr_idmap_mappings_res, (caddr_t)result);
2N/A result->retcode = idmap_stat4prot(result->retcode);
2N/A return (TRUE);
2N/A}
2N/A
2N/A
2N/A/* ARGSUSED */
2N/Astatic
2N/Aint
2N/Alist_namerules_cb(void *parg, int argc, char **argv, char **colnames)
2N/A{
2N/A list_cb_data_t *cb_data;
2N/A idmap_namerules_res *result;
2N/A idmap_retcode retcode;
2N/A int w2u_order, u2w_order;
2N/A char *end;
2N/A static int validated_column_names = 0;
2N/A
2N/A if (!validated_column_names) {
2N/A assert(strcmp(colnames[0], "rowid") == 0);
2N/A assert(strcmp(colnames[1], "is_user") == 0);
2N/A assert(strcmp(colnames[2], "is_wuser") == 0);
2N/A assert(strcmp(colnames[3], "windomain") == 0);
2N/A assert(strcmp(colnames[4], "winname_display") == 0);
2N/A assert(strcmp(colnames[5], "is_nt4") == 0);
2N/A assert(strcmp(colnames[6], "unixname") == 0);
2N/A assert(strcmp(colnames[7], "w2u_order") == 0);
2N/A assert(strcmp(colnames[8], "u2w_order") == 0);
2N/A validated_column_names = 1;
2N/A }
2N/A
2N/A cb_data = (list_cb_data_t *)parg;
2N/A result = (idmap_namerules_res *)cb_data->result;
2N/A
2N/A _VALIDATE_LIST_CB_DATA(9, &result->rules.rules_val,
2N/A sizeof (idmap_namerule));
2N/A
2N/A result->rules.rules_len++;
2N/A
2N/A result->rules.rules_val[cb_data->next].is_user =
2N/A strtol(argv[1], &end, 10);
2N/A
2N/A result->rules.rules_val[cb_data->next].is_wuser =
2N/A strtol(argv[2], &end, 10);
2N/A
2N/A STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].windomain,
2N/A argv[3]);
2N/A
2N/A STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].winname,
2N/A argv[4]);
2N/A
2N/A result->rules.rules_val[cb_data->next].is_nt4 =
2N/A strtol(argv[5], &end, 10);
2N/A
2N/A STRDUP_OR_FAIL(result->rules.rules_val[cb_data->next].unixname,
2N/A argv[6]);
2N/A
2N/A w2u_order = argv[7] ? strtol(argv[7], &end, 10) : 0;
2N/A u2w_order = argv[8] ? strtol(argv[8], &end, 10) : 0;
2N/A
2N/A if (w2u_order > 0 && u2w_order == 0)
2N/A result->rules.rules_val[cb_data->next].direction =
2N/A IDMAP_DIRECTION_W2U;
2N/A else if (w2u_order == 0 && u2w_order > 0)
2N/A result->rules.rules_val[cb_data->next].direction =
2N/A IDMAP_DIRECTION_U2W;
2N/A else
2N/A result->rules.rules_val[cb_data->next].direction =
2N/A IDMAP_DIRECTION_BI;
2N/A
2N/A result->lastrowid = strtoll(argv[0], &end, 10);
2N/A cb_data->next++;
2N/A result->retcode = IDMAP_SUCCESS;
2N/A return (0);
2N/A}
2N/A
2N/A
2N/A/* ARGSUSED */
2N/Abool_t
2N/Aidmap_list_namerules_1_svc(idmap_namerule rule, uint64_t lastrowid,
2N/A uint64_t limit, idmap_namerules_res *result,
2N/A struct svc_req *rqstp)
2N/A{
2N/A
2N/A sqlite *db = NULL;
2N/A char w2ubuf[15], u2wbuf[15];
2N/A char lbuf[30], rbuf[30];
2N/A char *sql = NULL;
2N/A char *expr = NULL;
2N/A uint64_t maxlimit;
2N/A idmap_retcode retcode;
2N/A
2N/A (void) memset(result, 0, sizeof (*result));
2N/A lbuf[0] = rbuf[0] = 0;
2N/A
2N/A result->retcode = validate_rule(&rule);
2N/A if (result->retcode != IDMAP_SUCCESS)
2N/A goto out;
2N/A
2N/A RDLOCK_CONFIG();
2N/A maxlimit = _idmapdstate.cfg->pgcfg.list_size_limit;
2N/A UNLOCK_CONFIG();
2N/A
2N/A /* Get db handle */
2N/A result->retcode = get_db_handle(&db);
2N/A if (result->retcode != IDMAP_SUCCESS)
2N/A goto out;
2N/A
2N/A result->retcode = IDMAP_ERR_INTERNAL;
2N/A
2N/A w2ubuf[0] = u2wbuf[0] = 0;
2N/A if (rule.direction == IDMAP_DIRECTION_BI) {
2N/A (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0");
2N/A (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0");
2N/A } else if (rule.direction == IDMAP_DIRECTION_W2U) {
2N/A (void) snprintf(w2ubuf, sizeof (w2ubuf), "AND w2u_order > 0");
2N/A (void) snprintf(u2wbuf, sizeof (u2wbuf),
2N/A "AND (u2w_order = 0 OR u2w_order ISNULL)");
2N/A } else if (rule.direction == IDMAP_DIRECTION_U2W) {
2N/A (void) snprintf(w2ubuf, sizeof (w2ubuf),
2N/A "AND (w2u_order = 0 OR w2u_order ISNULL)");
2N/A (void) snprintf(u2wbuf, sizeof (u2wbuf), "AND u2w_order > 0");
2N/A }
2N/A
2N/A result->retcode = gen_sql_expr_from_rule(&rule, &expr);
2N/A if (result->retcode != IDMAP_SUCCESS)
2N/A goto out;
2N/A
2N/A /* Create LIMIT expression. */
2N/A if (limit == 0 || (maxlimit > 0 && maxlimit < limit))
2N/A limit = maxlimit;
2N/A if (limit > 0)
2N/A (void) snprintf(lbuf, sizeof (lbuf),
2N/A "LIMIT %" PRIu64, limit + 1ULL);
2N/A
2N/A (void) snprintf(rbuf, sizeof (rbuf), "rowid > %" PRIu64, lastrowid);
2N/A
2N/A /*
2N/A * Combine all the above into a giant SELECT statement that
2N/A * will return the requested rules
2N/A */
2N/A sql = sqlite_mprintf("SELECT rowid, is_user, is_wuser, windomain, "
2N/A "winname_display, is_nt4, unixname, w2u_order, u2w_order "
2N/A "FROM namerules WHERE "
2N/A " %s %s %s %s %s;",
2N/A rbuf, expr, w2ubuf, u2wbuf, lbuf);
2N/A
2N/A if (sql == NULL) {
2N/A result->retcode = IDMAP_ERR_MEMORY;
2N/A idmapdlog(LOG_ERR, "Out of memory");
2N/A goto out;
2N/A }
2N/A
2N/A /* Execute the SQL statement and update the return buffer */
2N/A PROCESS_LIST_SVC_SQL(retcode, db, IDMAP_DBNAME, sql, limit,
2N/A 0, list_namerules_cb, result, result->rules.rules_len);
out:
if (expr)
sqlite_freemem(expr);
if (sql)
sqlite_freemem(sql);
if (IDMAP_ERROR(result->retcode))
(void) xdr_free(xdr_idmap_namerules_res, (caddr_t)result);
result->retcode = idmap_stat4prot(result->retcode);
return (TRUE);
}
#define IDMAP_RULES_AUTH "solaris.admin.idmap.rules"
static int
verify_rules_auth(struct svc_req *rqstp)
{
ucred_t *uc = NULL;
uid_t uid;
char buf[1024];
struct passwd pwd;
if (svc_getcallerucred(rqstp->rq_xprt, &uc) != 0) {
idmapdlog(LOG_ERR, "svc_getcallerucred failed during "
"authorization (%s)", strerror(errno));
return (-1);
}
uid = ucred_geteuid(uc);
if (uid == (uid_t)-1) {
idmapdlog(LOG_ERR, "ucred_geteuid failed during "
"authorization (%s)", strerror(errno));
ucred_free(uc);
return (-1);
}
if (getpwuid_r(uid, &pwd, buf, sizeof (buf)) == NULL) {
idmapdlog(LOG_ERR, "getpwuid_r(%u) failed during "
"authorization (%s)", uid, strerror(errno));
ucred_free(uc);
return (-1);
}
if (chkauthattr(IDMAP_RULES_AUTH, pwd.pw_name) != 1) {
idmapdlog(LOG_INFO, "%s is not authorized (%s)",
pwd.pw_name, IDMAP_RULES_AUTH);
ucred_free(uc);
return (-1);
}
ucred_free(uc);
return (1);
}
/*
* Meaning of the return values is the following: For retcode ==
* IDMAP_SUCCESS, everything went OK and error_index is
* undefined. Otherwise, error_index >=0 shows the failed batch
* element. errro_index == -1 indicates failure at the beginning,
* error_index == -2 at the end.
*/
/* ARGSUSED */
bool_t
idmap_update_1_svc(idmap_update_batch batch, idmap_update_res *res,
struct svc_req *rqstp)
{
sqlite *db = NULL;
idmap_update_op *up;
int i;
int trans = FALSE;
res->error_index = -1;
(void) memset(&res->error_rule, 0, sizeof (res->error_rule));
(void) memset(&res->conflict_rule, 0, sizeof (res->conflict_rule));
if (verify_rules_auth(rqstp) < 0) {
res->retcode = IDMAP_ERR_PERMISSION_DENIED;
goto out;
}
if (batch.idmap_update_batch_len == 0 ||
batch.idmap_update_batch_val == NULL) {
res->retcode = IDMAP_SUCCESS;
goto out;
}
res->retcode = validate_rules(&batch);
if (res->retcode != IDMAP_SUCCESS)
goto out;
/* Get db handle */
res->retcode = get_db_handle(&db);
if (res->retcode != IDMAP_SUCCESS)
goto out;
res->retcode = sql_exec_no_cb(db, IDMAP_DBNAME, "BEGIN TRANSACTION;");
if (res->retcode != IDMAP_SUCCESS)
goto out;
trans = TRUE;
for (i = 0; i < batch.idmap_update_batch_len; i++) {
up = &batch.idmap_update_batch_val[i];
switch (up->opnum) {
case OP_NONE:
res->retcode = IDMAP_SUCCESS;
break;
case OP_ADD_NAMERULE:
res->retcode = add_namerule(db,
&up->idmap_update_op_u.rule);
break;
case OP_RM_NAMERULE:
res->retcode = rm_namerule(db,
&up->idmap_update_op_u.rule);
break;
case OP_FLUSH_NAMERULES:
res->retcode = flush_namerules(db);
break;
default:
res->retcode = IDMAP_ERR_NOTSUPPORTED;
break;
};
if (res->retcode != IDMAP_SUCCESS) {
res->error_index = i;
if (up->opnum == OP_ADD_NAMERULE ||
up->opnum == OP_RM_NAMERULE) {
idmap_stat r2 =
idmap_namerule_cpy(&res->error_rule,
&up->idmap_update_op_u.rule);
if (r2 != IDMAP_SUCCESS)
res->retcode = r2;
}
goto out;
}
}
out:
if (trans) {
if (res->retcode == IDMAP_SUCCESS) {
res->retcode =
sql_exec_no_cb(db, IDMAP_DBNAME,
"COMMIT TRANSACTION;");
if (res->retcode != IDMAP_SUCCESS)
res->error_index = -2;
}
else
(void) sql_exec_no_cb(db, IDMAP_DBNAME,
"ROLLBACK TRANSACTION;");
}
res->retcode = idmap_stat4prot(res->retcode);
return (TRUE);
}
/* ARGSUSED */
bool_t
idmap_get_mapped_id_by_name_1_svc(idmap_mapping request,
idmap_mappings_res *result, struct svc_req *rqstp)
{
sqlite *cache = NULL, *db = NULL;
/* Init */
(void) memset(result, 0, sizeof (*result));
result->retcode = validate_mapped_id_by_name_req(&request);
if (result->retcode != IDMAP_SUCCESS)
goto out;
/* Get cache handle */
result->retcode = get_cache_handle(&cache);
if (result->retcode != IDMAP_SUCCESS)
goto out;
/* Get db handle */
result->retcode = get_db_handle(&db);
if (result->retcode != IDMAP_SUCCESS)
goto out;
/* Allocate result */
result->mappings.mappings_val = calloc(1, sizeof (idmap_mapping));
if (result->mappings.mappings_val == NULL) {
idmapdlog(LOG_ERR, "Out of memory");
result->retcode = IDMAP_ERR_MEMORY;
goto out;
}
result->mappings.mappings_len = 1;
if (IS_REQUEST_SID(request, 1)) {
result->retcode = get_w2u_mapping(
cache,
db,
&request,
result->mappings.mappings_val);
} else if (IS_REQUEST_UID(request)) {
result->retcode = get_u2w_mapping(
cache,
db,
&request,
result->mappings.mappings_val,
1);
} else if (IS_REQUEST_GID(request)) {
result->retcode = get_u2w_mapping(
cache,
db,
&request,
result->mappings.mappings_val,
0);
} else {
result->retcode = IDMAP_ERR_IDTYPE;
}
out:
if (IDMAP_FATAL_ERROR(result->retcode)) {
xdr_free(xdr_idmap_mappings_res, (caddr_t)result);
result->mappings.mappings_len = 0;
result->mappings.mappings_val = NULL;
}
result->retcode = idmap_stat4prot(result->retcode);
return (TRUE);
}
/* ARGSUSED */
bool_t
idmap_get_prop_1_svc(idmap_prop_type request,
idmap_prop_res *result, struct svc_req *rqstp)
{
idmap_pg_config_t *pgcfg;
/* Init */
(void) memset(result, 0, sizeof (*result));
result->retcode = IDMAP_SUCCESS;
result->value.prop = request;
RDLOCK_CONFIG();
/* Just shortcuts: */
pgcfg = &_idmapdstate.cfg->pgcfg;
switch (request) {
case PROP_LIST_SIZE_LIMIT:
result->value.idmap_prop_val_u.intval = pgcfg->list_size_limit;
result->auto_discovered = FALSE;
break;
case PROP_DEFAULT_DOMAIN:
result->auto_discovered = FALSE;
STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val,
pgcfg->default_domain);
break;
case PROP_DOMAIN_NAME:
STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val,
pgcfg->domain_name);
result->auto_discovered =
pgcfg->domain_name_auto_disc;
break;
case PROP_MACHINE_SID:
result->auto_discovered = FALSE;
STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val,
pgcfg->machine_sid);
break;
case PROP_DOMAIN_CONTROLLER:
if (pgcfg->domain_controller != NULL) {
(void) memcpy(&result->value.idmap_prop_val_u.dsval,
pgcfg->domain_controller,
sizeof (idmap_ad_disc_ds_t));
}
result->auto_discovered = pgcfg->domain_controller_auto_disc;
break;
case PROP_FOREST_NAME:
STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val,
pgcfg->forest_name);
result->auto_discovered = pgcfg->forest_name_auto_disc;
break;
case PROP_SITE_NAME:
STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val,
pgcfg->site_name);
result->auto_discovered = pgcfg->site_name_auto_disc;
break;
case PROP_GLOBAL_CATALOG:
if (pgcfg->global_catalog != NULL) {
(void) memcpy(&result->value.idmap_prop_val_u.dsval,
pgcfg->global_catalog, sizeof (idmap_ad_disc_ds_t));
}
result->auto_discovered = pgcfg->global_catalog_auto_disc;
break;
case PROP_AD_UNIXUSER_ATTR:
STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val,
pgcfg->ad_unixuser_attr);
result->auto_discovered = FALSE;
break;
case PROP_AD_UNIXGROUP_ATTR:
STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val,
pgcfg->ad_unixgroup_attr);
result->auto_discovered = FALSE;
break;
case PROP_NLDAP_WINNAME_ATTR:
STRDUP_CHECK(result->value.idmap_prop_val_u.utf8val,
pgcfg->nldap_winname_attr);
result->auto_discovered = FALSE;
break;
case PROP_DS_NAME_MAPPING_ENABLED:
result->value.idmap_prop_val_u.boolval =
pgcfg->ds_name_mapping_enabled;
result->auto_discovered = FALSE;
break;
default:
result->retcode = IDMAP_ERR_PROP_UNKNOWN;
break;
}
out:
UNLOCK_CONFIG();
if (IDMAP_FATAL_ERROR(result->retcode)) {
xdr_free(xdr_idmap_prop_res, (caddr_t)result);
result->value.prop = PROP_UNKNOWN;
}
result->retcode = idmap_stat4prot(result->retcode);
return (TRUE);
}
/* ARGSUSED */
int
idmap_prog_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result,
caddr_t result)
{
(void) xdr_free(xdr_result, result);
return (TRUE);
}