1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25 /*
26 * DESCRIPTION: Contains dit_access interface support functions.
27 */
28 #include <sys/systeminfo.h>
29 #include <unistd.h>
30 #include <stdlib.h>
31 #include <sys/types.h>
32 #include <sys/stat.h>
33 #include <sys/systeminfo.h>
34 #include <unistd.h>
35 #include <stdlib.h>
36 #include <syslog.h>
37 #include <ndbm.h>
38 #include <strings.h>
39 #include <errno.h>
40 #include "../ldap_util.h"
41 #include "../ldap_map.h"
42 #include "../ldap_parse.h"
43 #include "../ldap_structs.h"
44 #include "../ldap_val.h"
45 #include "../ldap_ruleval.h"
46 #include "../ldap_op.h"
47 #include "../ldap_attr.h"
48 #include "../ldap_nisdbquery.h"
49 #include "../nisdb_mt.h"
50 #include "shim.h"
51 #include "yptol.h"
52 #include "dit_access_utils.h"
53
54 #define YPMULTI "YP_MULTI_"
55 #define YPMULTISZ 9 /* == strlen(YPMULTI) */
56
57 /*
58 * Returns 'map,domain.'
59 */
60 char *
61 getFullMapName(char *map, char *domain) {
62 char *myself = "getFullMapName";
63 char *objPath;
64 if (map == 0 || domain == 0) {
65 return (0);
66 }
67 objPath = scat(myself, T, scat(myself, F, map, ","),
68 scat(myself, F, domain, "."));
69
70 return (objPath);
71 }
72
73 /*
74 * Convert string to __nis_value_t
75 */
76 __nis_value_t *stringToValue(char *dptr, int dsize) {
77 char *myself = "stringToValue";
78 char *emptystr = "";
79 __nis_value_t *val;
80
81 if ((val = am(myself, sizeof (*val))) == 0) {
82 return (0);
83 }
84
85 val->type = vt_string;
86 val->repeat = 0;
87 val->numVals = 1;
88 if ((val->val = am(myself, sizeof (val->val[0]))) == 0) {
89 sfree(val);
90 return (0);
91 }
92
93 /*
94 * Null strings or strings with length 0 are treated
95 * as empty strings with length 1
96 */
97 if (dptr == 0 || dsize <= 0) {
98 dptr = emptystr;
99 dsize = 1;
100 }
101
102 val->val->length = dsize;
103 if (dptr[dsize - 1] != '\0') {
104 val->val->length = dsize + 1;
105 }
106
107 val->val->value = am(myself, val->val->length);
108 if (val->val->value == 0) {
109 freeValue(val, 1);
110 return (0);
111 }
112 (void) memcpy(val->val->value, dptr, dsize);
113
114 return (val);
115 }
116
117 /*
118 * Returns an array of rule-values corresponding to the
119 * splitfields.
120 */
121 __nis_rule_value_t *
122 processSplitField(__nis_table_mapping_t *sf, __nis_value_t *inVal,
123 int *nv, int *statP) {
124
125 char *sepset;
126 __nis_rule_value_t *rvq;
127 __nis_mapping_format_t *ftmp;
128 __nis_value_t **valA, *tempVal;
129 int i, j, res, numVals, oldlen, count;
130 char *str, *oldstr;
131 char *myself = "processSplitField";
132
133 /* sf will be non NULL */
134
135 if (inVal == 0 || inVal->type != vt_string) {
136 *statP = MAP_PARAM_ERROR;
137 return (0);
138 }
139
140 /* Get the separator list */
141 sepset = sf->separatorStr;
142
143 /* Initialize rule-value */
144 rvq = 0;
145 count = 0;
146
147 if ((tempVal = stringToValue(inVal->val->value,
148 inVal->val->length)) == 0) {
149 *statP = MAP_NO_MEMORY;
150 return (0);
151 }
152
153 str = oldstr = tempVal->val->value;
154 oldlen = tempVal->val->length;
155
156 while (str) {
157 tempVal->val->value = str;
158 tempVal->val->length = strlen(str) + 1;
159
160 /* Loop to check which format matches str */
161 for (i = 0; i <= sf->numSplits; i++) {
162 valA = matchMappingItem(sf->e[i].element.match.fmt,
163 tempVal, &numVals, sepset, &str);
164 if (valA == 0) {
165 /* The format didn't match. Try the next one */
166 continue;
167 }
168
169 /*
170 * If we are here means we had a match.
171 * Each new set of values obtained from the match is
172 * added to a new rule-value. This is to preserve the
173 * the distinction between each set.
174 */
175 rvq = growRuleValue(count, count + 1, rvq, 0);
176 if (rvq == 0) {
177 *statP = MAP_INTERNAL_ERROR;
178 for (j = 0; j < numVals; j++)
179 freeValue(valA[j], 1);
180 sfree(valA);
181 tempVal->val->value = oldstr;
182 tempVal->val->length = oldlen;
183 freeValue(tempVal, 1);
184 return (0);
185 }
186 count++;
187
188 for (j = 0; j < numVals; j++) {
189 res = addCol2RuleValue(vt_string,
190 sf->e[i].element.match.item[j].name,
191 valA[j]->val->value,
192 valA[j]->val->length,
193 &rvq[count - 1]);
194 if (res == -1) {
195 *statP = MAP_INTERNAL_ERROR;
196 for (; j < numVals; j++)
197 freeValue(valA[j], 1);
198 sfree(valA);
199 tempVal->val->value = oldstr;
200 tempVal->val->length = oldlen;
201 freeValue(tempVal, 1);
202 freeRuleValue(rvq, count);
203 return (0);
204 }
205 freeValue(valA[j], 1);
206 }
207 sfree(valA);
208
209 /*
210 * Since we had a match, break out of this loop
211 * to parse remainder of str
212 */
213 break;
214 }
215
216 /* Didn't find any match, so get out of the loop */
217 if (i > sf->numSplits) {
218 str = 0;
219 break;
220 }
221
222 /* Skip the separators before looping back */
223 if (str) {
224 str = str + strspn(str, sepset);
225 if (*str == '\0')
226 break;
227 }
228 }
229
230 tempVal->val->value = oldstr;
231 tempVal->val->length = oldlen;
232 freeValue(tempVal, 1);
233
234 if (str == 0) {
235 freeRuleValue(rvq, count);
236 return (0);
237 }
238
239 if (nv != 0)
240 *nv = count;
241
242 return (rvq);
243 }
244
245 /*
246 * Convert the datum to an array of RuleValues
247 */
248 __nis_rule_value_t *
249 datumToRuleValue(datum *key, datum *value, __nis_table_mapping_t *t,
250 int *nv, char *domain, bool_t readonly, int *statP) {
251
252 __nis_rule_value_t *rvq, *subrvq, *newrvq;
253 __nis_value_t *val;
254 __nis_value_t **valA;
255 __nis_table_mapping_t *sf;
256 int valueLen, comLen, numVals, nr, count = 1;
257 int i, j, k, l, af;
258 char *ipaddr, *ipvalue;
259
260 /* At this point, 't' is always non NULL */
261
262 /* Initialize rule-value */
263 if ((rvq = initRuleValue(1, 0)) == 0) {
264 *statP = MAP_INTERNAL_ERROR;
265 return (0);
266 }
267
268 /* Add domainname to rule-value */
269 if (addCol2RuleValue(vt_string, N2LDOMAIN, domain, strlen(domain),
270 rvq)) {
271 freeRuleValue(rvq, 1);
272 *statP = MAP_INTERNAL_ERROR;
273 return (0);
274 }
275
276 /* Handle key */
277 if (key != 0) {
278 /* Add field=value pair for N2LKEY */
279 i = addCol2RuleValue(vt_string, N2LKEY, key->dptr, key->dsize,
280 rvq);
281
282 /* For readonly, add field=value pair for N2LSEARCHKEY */
283 if (readonly == TRUE && i == 0) {
284 i = addCol2RuleValue(vt_string, N2LSEARCHKEY, key->dptr,
285 key->dsize, rvq);
286 }
287 if (i) {
288 freeRuleValue(rvq, 1);
289 *statP = MAP_INTERNAL_ERROR;
290 return (0);
291 }
292
293 /* Add field=value pairs for IP addresses */
294 if (checkIPaddress(key->dptr, key->dsize, &ipaddr) > 0) {
295 /* If key is IPaddress, use preferred format */
296 ipvalue = ipaddr;
297 valueLen = strlen(ipaddr);
298 i = addCol2RuleValue(vt_string, N2LIPKEY, ipvalue,
299 valueLen, rvq);
300 } else {
301 /* If not, use original value for N2LSEARCHIPKEY */
302 ipaddr = 0;
303 ipvalue = key->dptr;
304 valueLen = key->dsize;
305 i = 0;
306 }
307
308 if (readonly == TRUE && i == 0) {
309 i = addCol2RuleValue(vt_string, N2LSEARCHIPKEY, ipvalue,
310 valueLen, rvq);
311 }
312 sfree(ipaddr);
313 if (i) {
314 freeRuleValue(rvq, 1);
315 *statP = MAP_INTERNAL_ERROR;
316 return (0);
317 }
318 }
319
320 /* Handle datum value */
321 if (value != 0 && t->e) {
322 valueLen = value->dsize;
323 /*
324 * Extract the comment, if any, and add it to
325 * the rule-value.
326 */
327 if (t->commentChar != '\0') {
328 /*
329 * We loop on value->dsize because value->dptr
330 * may not be NULL-terminated.
331 */
332 for (i = 0; i < value->dsize; i++) {
333 if (value->dptr[i] == t->commentChar) {
334 valueLen = i;
335 comLen = value->dsize - i - 1;
336 if (comLen == 0)
337 break;
338 if (addCol2RuleValue(vt_string,
339 N2LCOMMENT, value->dptr + i + 1,
340 comLen, rvq)) {
341 freeRuleValue(rvq, 1);
342 *statP = MAP_INTERNAL_ERROR;
343 return (0);
344 }
345 break;
346 }
347 }
348 }
349
350 /* Skip trailing whitespaces */
351 for (; valueLen > 0 && (value->dptr[valueLen - 1] == ' ' ||
352 value->dptr[valueLen - 1] == '\t'); valueLen--);
353
354 /*
355 * At this point valueLen is the effective length of
356 * the data. Convert value into __nis_value_t so that
357 * we can use the matchMappingItem function to break it
358 * into fields.
359 */
360 if ((val = stringToValue(value->dptr, valueLen)) == 0) {
361 freeRuleValue(rvq, 1);
362 *statP = MAP_NO_MEMORY;
363 return (0);
364 }
365
366 /* Perform namefield match */
367 valA = matchMappingItem(t->e->element.match.fmt, val,
368 &numVals, 0, 0);
369 if (valA == 0) {
370 freeValue(val, 1);
371 freeRuleValue(rvq, 1);
372 *statP = MAP_NAMEFIELD_MATCH_ERROR;
373 return (0);
374 }
375
376 /* We don't need val anymore, so free it */
377 freeValue(val, 1);
378
379 /*
380 * Since matchMappingItem only returns us an array of
381 * __nis_value_t's, we need to associate each value
382 * in the array with the corresponding item name.
383 * This code assumes that numVals will be less than or
384 * equal to the number of item names associated with
385 * the format.
386 * These name=value pairs are added to rvq.
387 */
388 for (i = 0, *statP = SUCCESS; i < numVals; i++) {
389 for (j = 0; j < count; j++) {
390 if (addCol2RuleValue(vt_string,
391 t->e->element.match.item[i].name,
392 valA[i]->val->value,
393 valA[i]->val->length, &rvq[j])) {
394 *statP = MAP_INTERNAL_ERROR;
395 break;
396 }
397 }
398 if (*statP == MAP_INTERNAL_ERROR)
399 break;
400
401 /*
402 * Check if splitField exists for the field.
403 * Since splitfields are also stored as mapping
404 * structures, we need to get the hash table entry
405 * corresponding to the splitfield name
406 */
407 sf = mappingFromMap(t->e->element.match.item[i].name,
408 domain, statP);
409 if (*statP == MAP_NO_MEMORY)
410 break;
411 *statP = SUCCESS;
412 if (sf == 0)
413 continue;
414
415 /*
416 * Process and add splitFields to rule-value rvq
417 */
418 subrvq = processSplitField(sf, valA[i], &nr, statP);
419
420 if (subrvq == 0) {
421 /* statP would have been set */
422 break;
423 }
424
425 /*
426 * We merge 'count' rule-values in rvq with 'nr'
427 * rule-values from subrvq to give us a whopping
428 * 'count * nr' rule-values
429 */
430
431 /* Initialize the new rule-value array */
432 if ((newrvq = initRuleValue(count * nr, 0)) == 0) {
433 *statP = MAP_INTERNAL_ERROR;
434 freeRuleValue(subrvq, nr);
435 break;
436 }
437
438 for (j = 0, l = 0; j < nr; j++) {
439 for (k = 0; k < count; k++, l++) {
440 if ((mergeRuleValue(&newrvq[l],
441 &rvq[k]) == -1) ||
442 (mergeRuleValue(
443 &newrvq[l],
444 &subrvq[j]) == -1)) {
445 *statP = MAP_INTERNAL_ERROR;
446 for (i = 0; i < numVals; i++)
447 freeValue(valA[i], 1);
448 sfree(valA);
449 freeRuleValue(rvq, count);
450 freeRuleValue(newrvq,
451 count * nr);
452 freeRuleValue(subrvq, nr);
453 return (0);
454 }
455 }
456 }
457
458 freeRuleValue(rvq, count);
459 rvq = newrvq;
460 count = l;
461 freeRuleValue(subrvq, nr);
462
463 }
464
465 /* We don't need valA anymore, so free it */
466 for (i = 0; i < numVals; i++)
467 freeValue(valA[i], 1);
468 sfree(valA);
469
470 if (*statP != SUCCESS) {
471 freeRuleValue(rvq, count);
472 return (0);
473 }
474
475 } /* if value */
476
477 if (nv != 0)
478 *nv = count;
479 return (rvq);
480
481 }
482
483 /*
484 * Generate name=values pairs for splitfield names
485 *
486 * Consider Example:
487 * nisLDAPnameFields club:
488 * ("%s %s %s", name, code, members)
489 * nisLDAPsplitField members:
490 * ("(%s,%s,%s)", host, user, domain),
491 * ("%s", group)
492 * On entry,
493 * - rv is an array of numVals rule-values each containing
494 * name=value pairs for names occuring in nisLDAPsplitField.
495 * (i.e host, user, domain, group)
496 * - trv contains name=value pairs for names occuring in
497 * nisLDAPnameFields. (i.e name, code but not members)
498 *
499 * For every name in nisLDAPnamefields that is a splitfield,
500 * this function applies the data in rv to the corresponding
501 * splitfield formats (accessed thru t), to generate a single
502 * string value for the corresponding splitfield (members).
503 * This new name=value pair is then added to trv.
504 * Besides, any uninitialized namefield names are set to empty strings.
505 */
506 suc_code
507 addSplitFieldValues(__nis_table_mapping_t *t, __nis_rule_value_t *rv,
508 __nis_rule_value_t *trv, int numVals, char *domain) {
509 __nis_table_mapping_t *sf;
510 __nis_value_t *val;
511 int i, j, k, nitems, res, statP;
512 char *str, *tempstr;
513 char delim[2] = {0, 0};
514 char *emptystr = "";
515 char *myself = "addSplitFieldValues";
516
517 if (trv == 0)
518 return (MAP_INTERNAL_ERROR);
519
520 if (t->e == 0)
521 return (SUCCESS);
522
523 nitems = t->e->element.match.numItems;
524
525 /*
526 * Procedure:
527 * - Check each name in nisLDAPnamefield
528 * - if it's a splifield, construct its value and add it to trv
529 * - if not, check if it has a value
530 * - if not, add empty string
531 */
532 for (i = 0, sf = 0; i < nitems; i++) {
533 if (rv) {
534 /*
535 * str will eventually contain the single string
536 * value for the corresponding splitfield.
537 * No point initializing str if rv == 0 because
538 * splitfield cannot be constructed without rv.
539 * So, only initialized here.
540 */
541 str = 0;
542
543 /* Check if it's a splitfield name */
544 sf = mappingFromMap(t->e->element.match.item[i].name,
545 domain, &statP);
546
547 /*
548 * Return only incase of memory allocation failure.
549 * The other error case (MAP_NO_MAPPING_EXISTS),
550 * indicates that the item name is not a splitfieldname
551 * i.e it's a namefieldname. This case is handled by
552 * the following if (sf == 0)
553 */
554 if (statP == MAP_NO_MEMORY)
555 return (statP);
556 }
557
558 if (sf == 0) {
559 /*
560 * Not a splitfield name. Verify if it has a value
561 */
562 if (findVal(t->e->element.match.item[i].name,
563 trv, mit_nisplus) == 0) {
564 /* if not, use empty string */
565 res = addCol2RuleValue(vt_string,
566 t->e->element.match.item[i].name,
567 emptystr, 0, trv);
568 if (res == -1) {
569 return (MAP_INTERNAL_ERROR);
570 }
571 }
572 /*
573 * If rv == 0 then sf == 0 so we will continue here
574 * i.e. does not matter that str is not yet set up.
575 */
576 continue;
577 }
578
579 /* Code to construct a single value */
580
581 /* Use the first separator character as the delimiter */
582 delim[0] = sf->separatorStr[0];
583
584 for (j = 0; j < numVals; j++) {
585 /* sf->numSplits is zero-based */
586 for (k = 0; k <= sf->numSplits; k++) {
587 val = getMappingFormatArray(
588 sf->e[k].element.match.fmt, &rv[j],
589 fa_item,
590 sf->e[k].element.match.numItems,
591 sf->e[k].element.match.item);
592 if (val == 0)
593 continue;
594 if (val->numVals > 0) {
595 if (str) {
596 tempstr = scat(myself,
597 0, str, delim);
598 sfree(str);
599 if (tempstr)
600 str = tempstr;
601 else {
602 freeValue(val, 1);
603 return (MAP_NO_MEMORY);
604 }
605 }
606 tempstr = scat(myself, 0, str,
607 val->val->value);
608 sfree(str);
609 if (tempstr)
610 str = tempstr;
611 else {
612 freeValue(val, 1);
613 return (MAP_NO_MEMORY);
614 }
615 }
616 freeValue(val, 1);
617 }
618 }
619 if (str == 0)
620 str = emptystr;
621
622 res = addCol2RuleValue(vt_string,
623 t->e->element.match.item[i].name,
624 str, strlen(str), trv);
625
626 if (str != emptystr)
627 sfree(str);
628
629 if (res == -1) {
630 return (MAP_INTERNAL_ERROR);
631 }
632 }
633
634 return (SUCCESS);
635 }
636
637 /*
638 * Updates 'rv' with NIS name=value pairs suitable to
639 * construct datum from namefield information.
640 * Some part based on createNisPlusEntry (from ldap_nisdbquery.c)
641 * This code assumes that from a given LDAP entry, applying the
642 * mapping rules, would give us one or more NIS entries, differing
643 * only in key.
644 */
645 suc_code
646 buildNISRuleValue(__nis_table_mapping_t *t, __nis_rule_value_t *rv,
647 char *domain) {
648 int r, i, j, k, l, index, nrq, res, len;
649 int numItems, splitname, count, statP;
650 __nis_value_t *rval;
651 __nis_mapping_item_t *litem;
652 __nis_mapping_rule_t *rl;
653 __nis_rule_value_t *rvq;
654 char *value, *emptystr = "";
655
656 statP = SUCCESS;
657
658 /* Initialize default base */
659 __nisdb_get_tsd()->searchBase = t->objectDN->read.base;
660
661 /* Initialize rule-value rvq */
662 rvq = 0;
663 count = 0;
664
665 /* Add domainname to rule-value */
666 if (addCol2RuleValue(vt_string, N2LDOMAIN, domain, strlen(domain),
667 rv)) {
668 return (MAP_INTERNAL_ERROR);
669 }
670
671 for (r = 0; r < t->numRulesFromLDAP; r++) {
672 rl = t->ruleFromLDAP[r];
673
674 /* Set escapeFlag if RHS is "dn" to remove escape chars */
675 if (rl->rhs.numElements == 1 &&
676 rl->rhs.element->type == me_item &&
677 rl->rhs.element->element.item.type == mit_ldap &&
678 strcasecmp(rl->rhs.element->element.item.name, "dn")
679 == 0) {
680 __nisdb_get_tsd()->escapeFlag = '2';
681 }
682
683 rval = buildRvalue(&rl->rhs, mit_ldap, rv, NULL);
684
685 /* Reset escapeFlag */
686 __nisdb_get_tsd()->escapeFlag = '\0';
687
688 if (rval == 0) {
689 continue;
690 }
691
692 if (rval->numVals <= 0) {
693 /* Treat as invalid */
694 freeValue(rval, 1);
695 continue;
696 }
697
698 litem = buildLvalue(&rl->lhs, &rval, &numItems);
699 if (litem == 0) {
700 /* This will take care of numItems == 0 */
701 freeValue(rval, 1);
702 continue;
703 }
704
705 if (rval->numVals > 1) {
706 if (numItems == 1 && litem->repeat)
707 nrq = rval->numVals;
708 else if (numItems > 1 && rval->repeat)
709 nrq = 1 + ((rval->numVals-1)/numItems);
710 else
711 nrq = 1;
712 } else
713 nrq = 1;
714
715 /* Set splitname if splitfield names are specified */
716 for (i = 0; i < numItems; i++) {
717 if (strcasecmp(litem[i].name, N2LKEY) == 0 ||
718 strcasecmp(litem[i].name, N2LIPKEY) == 0 ||
719 strcasecmp(litem[i].name, N2LCOMMENT) == 0)
720 continue;
721 for (j = 0; j < t->numColumns; j++) {
722 if (strcmp(litem[i].name, t->column[j]) == 0)
723 break;
724 }
725 if (j == t->numColumns)
726 break;
727 }
728
729 splitname = (i < numItems)?1:0;
730
731 for (j = 0; j < nrq; j++) {
732 if (splitname == 1) {
733 /*
734 * Put every value of splitfieldname in a new
735 * rule-value. Helps generating splitfields.
736 */
737 rvq = growRuleValue(count, count + 1, rvq, 0);
738 if (rvq == 0) {
739 freeRuleValue(rvq, count);
740 freeValue(rval, 1);
741 freeMappingItem(litem, numItems);
742 return (MAP_INTERNAL_ERROR);
743 }
744 count++;
745 }
746
747 for (k = j % nrq, l = 0; l < numItems; k += nrq, l++) {
748 /* If we run out of values, use empty strings */
749 if (k >= rval->numVals) {
750 value = emptystr;
751 len = 0;
752 } else {
753 value = rval->val[k].value;
754 len = rval->val[k].length;
755 }
756 res = (splitname == 1)?addCol2RuleValue(
757 vt_string, litem[l].name, value,
758 len, &rvq[count - 1]):0;
759 if (res != -1)
760 res = addCol2RuleValue(vt_string,
761 litem[l].name, value, len, rv);
762 if (res == -1) {
763 freeRuleValue(rvq, count);
764 freeValue(rval, 1);
765 freeMappingItem(litem, numItems);
766 return (MAP_INTERNAL_ERROR);
767 }
768 }
769 }
770 freeValue(rval, 1);
771 rval = 0;
772 freeMappingItem(litem, numItems);
773 litem = 0;
774 numItems = 0;
775 } /* for r < t->numRulesFromLDAP */
776
777 statP = addSplitFieldValues(t, rvq, rv, count, domain);
778
779 if (rvq)
780 freeRuleValue(rvq, count);
781
782 if (verifyIndexMatch(t, 0, rv, 0, 0) == 0)
783 return (MAP_INDEXLIST_ERROR);
784 return (statP);
785
786 } /* end of buildNISRuleValue */
787
788 /*
789 * Convert rule-value to datum using namefield information
790 */
791 datum *
792 ruleValueToDatum(__nis_table_mapping_t *t, __nis_rule_value_t *rv, int *statP) {
793 __nis_value_t *val;
794 datum *value;
795 char *str, *cstr, commentSep[3] = {' ', 0, 0};
796 char *myself = "ruleValueToDatum";
797
798 /* No error yet */
799 *statP = 0;
800
801 /* Return empty datum if no namefield information available */
802 if (t->e == 0) {
803 if ((value = am(myself, sizeof (*value))) == 0)
804 *statP = MAP_NO_MEMORY;
805 return (value);
806 }
807
808 val = getMappingFormatArray(t->e->element.match.fmt, rv,
809 fa_item, t->e->element.match.numItems,
810 t->e->element.match.item);
811
812 if (val && val->val && val->val->value) {
813 if ((value = am(myself, sizeof (*value))) == 0) {
814 *statP = MAP_NO_MEMORY;
815 freeValue(val, 1);
816 return (0);
817 }
818
819 /* Strip trailing whitespaces */
820 cstr = (char *)val->val->value + val->val->length;
821 for (; cstr >= (char *)val->val->value &&
822 (*cstr == ' ' || *cstr == '\t'); *cstr-- = '\0');
823
824 if (t->commentChar != '\0' &&
825 (str = findVal(N2LCOMMENT, rv, mit_nisplus)) != 0 &&
826 *str != '\0') {
827 commentSep[1] = t->commentChar;
828 cstr = scat(myself, F, commentSep, str);
829 if (cstr) {
830 value->dptr = scat(myself, F,
831 val->val->value, cstr);
832 sfree(cstr);
833 }
834 } else {
835 value->dptr = sdup(myself, T, val->val->value);
836 }
837 freeValue(val, 1);
838 if (value->dptr) {
839 value->dsize = strlen(value->dptr);
840 return (value);
841 } else {
842 *statP = MAP_NO_MEMORY;
843 sfree(value);
844 return (0);
845 }
846 }
847
848 *statP = MAP_NAMEFIELD_MATCH_ERROR;
849 return (0);
850 }
851
852 datum *
853 getKeyFromRuleValue(__nis_table_mapping_t *t, __nis_rule_value_t *rv, int *nv,
854 int *statP, bool_t xlate_to_lcase)
855 {
856 int i, j, k;
857 datum *key = 0;
858 char *str;
859 char *myself = "getKeyFromRuleValue";
860
861 /* No error yet */
862 *statP = 0;
863
864 if (rv == 0 || nv == 0)
865 return (0);
866
867 for (i = 0; i < rv->numColumns; i++) {
868 if (rv->colName[i] == 0)
869 continue;
870 if (strcasecmp(N2LKEY, rv->colName[i]) == 0 ||
871 strcasecmp(N2LIPKEY, rv->colName[i]) == 0) {
872 if ((*nv = rv->colVal[i].numVals) == 0)
873 return (0);
874 if ((key = am(myself, sizeof (key[0]) * *nv)) == 0) {
875 *statP = MAP_NO_MEMORY;
876 return (0);
877 }
878 for (j = 0; j < *nv; j++) {
879 if ((str = rv->colVal[i].val[j].value) == 0) {
880 key[j].dsize = 0;
881 key[j].dptr = 0;
882 } else {
883 if (verifyIndexMatch(t, 0, 0,
884 rv->colName[i], str) == 0) {
885 key[j].dsize = 0;
886 key[j].dptr = 0;
887 continue;
888 }
889
890 key[j].dsize = strlen(str);
891 key[j].dptr = am(myself,
892 key[j].dsize + 1);
893 if (key[j].dptr == 0) {
894 *statP = MAP_NO_MEMORY;
895 for (--j; j >= 0; j--)
896 sfree(key[j].dptr);
897 sfree(key);
898 return (0);
899 }
900
901 /* transliterate key to lowercase */
902 if (xlate_to_lcase == TRUE) {
903
904 /*
905 * For multi-homed
906 * entries, skip over
907 * "YP_MULTI_" prefix.
908 */
909 k = 0;
910 if (strncmp(YPMULTI, str,
911 YPMULTISZ) == 0) {
912 k = YPMULTISZ;
913 bcopy(str, key[j].dptr,
914 YPMULTISZ);
915 }
916 while (k < key[j].dsize) {
917 key[j].dptr[k] =
918 (char)tolower(
919 (int)(uchar_t)
920 str[k]);
921 k++;
922 }
923 } else {
924 bcopy(str, key[j].dptr,
925 key[j].dsize);
926 }
927 }
928 }
929 return (key);
930 }
931 }
932 return (0);
933 }
934
935 /*
936 * Get the mapping structure corresponding to `map,domain.'
937 */
938 __nis_table_mapping_t *
939 mappingFromMap(char *map, char *domain, int *statP) {
940 char *mapPath;
941 __nis_table_mapping_t *t;
942
943 /* No error yet */
944 *statP = 0;
945
946 /* Construct map,domain. */
947 if ((mapPath = getFullMapName(map, domain)) == 0) {
948 *statP = MAP_NO_MEMORY;
949 return (0);
950 }
951
952 /* Get the hash table entry for the mapPath */
953 if ((t = __nis_find_item_mt(mapPath, &ldapMappingList, 1, 0))
954 == 0) {
955 *statP = MAP_NO_MAPPING_EXISTS;
956 }
957 sfree(mapPath);
958 return (t);
959 }
960
961 /*
962 * Verify at least one key value obtained from DIT matches the search key
963 * RETURNS: 1 MATCH
964 * 0 NO MATCH
965 * -1 NO KEY FOUND
966 */
967 static int
968 verifyKey(char *key, __nis_rule_value_t *rv) {
969 int i, j;
970 char *sipkey, *str;
971
972 for (i = 0; i < rv->numColumns; i++) {
973 if (rv->colName[i] == 0)
974 continue;
975 if (strcasecmp(N2LKEY, rv->colName[i]) == 0) {
976 if (rv->colVal[i].val == 0)
977 return (0);
978 for (j = 0; j < rv->colVal[i].numVals; j++) {
979 str = (char *)rv->colVal[i].val[j].value;
980 if (str && strcmp(str, key) == 0)
981 return (1);
982 }
983 return (0);
984 } else if (strcasecmp(N2LIPKEY, rv->colName[i]) == 0) {
985 if (checkIPaddress(key, strlen(key), &sipkey) > 0) {
986 if (rv->colVal[i].val == 0)
987 return (0);
988 for (j = 0; j < rv->colVal[i].numVals; j++) {
989 str = rv->colVal[i].val[j].value;
990 if (str && strcmp(str, sipkey) == 0) {
991 sfree(sipkey);
992 return (1);
993 }
994 }
995 sfree(sipkey);
996 }
997 return (0);
998 }
999 }
1000 return (-1);
1001 }
1002
1003 /*
1004 * Read (i.e get and map) a single NIS entry from the LDAP DIT
1005 */
1006 bool_t
1007 singleReadFromDIT(char *map, char *domain, datum *key, datum *value,
1008 int *statP) {
1009 __nis_table_mapping_t *t;
1010 __nis_rule_value_t *rv_request = 0, *rv_result = 0;
1011 __nis_ldap_search_t *ls;
1012 __nis_object_dn_t *objectDN = NULL;
1013 int i, rc, nr = 0, nv = 0;
1014 datum *datval = 0;
1015 char *skey, *str, *sipkey;
1016 char *myself = "singleReadFromDIT";
1017
1018 *statP = SUCCESS;
1019
1020 if (!map || !domain || !key || !value) {
1021 *statP = MAP_PARAM_ERROR;
1022 return (FALSE);
1023 }
1024
1025
1026 /* Get the mapping information for the map */
1027 if ((t = mappingFromMap(map, domain, statP)) == 0) {
1028 /*
1029 * No problem. We don't handle this map and domain. Maybe it's
1030 * handled by a service other than NIS.
1031 */
1032 return (FALSE);
1033 }
1034
1035 /* NULL-terminated version of datum key for logging */
1036 if ((skey = am(myself, key->dsize + 1)) == 0) {
1037 *statP = MAP_NO_MEMORY;
1038 return (FALSE);
1039 }
1040 (void) memcpy(skey, key->dptr, key->dsize);
1041
1042 if ((str = getFullMapName(map, domain)) == 0) {
1043 *statP = MAP_NO_MEMORY;
1044 return (FALSE);
1045 }
1046
1047 /* For each alternate mapping */
1048 for (; t != 0; t = t->next) {
1049 /* Verify objName */
1050 if (strcmp(str, t->objName) != 0) {
1051 continue;
1052 }
1053
1054 /* Verify if key matches the index */
1055 if (verifyIndexMatch(t, 0, 0, N2LKEY, skey) == 0 ||
1056 verifyIndexMatch(t, 0, 0, N2LIPKEY, skey) == 0)
1057 continue;
1058
1059 /* Check if rulesFromLDAP are provided */
1060 if (t->numRulesFromLDAP == 0) {
1061 logmsg(MSG_NOTIMECHECK, LOG_INFO,
1062 "%s: No rulesFromLDAP information available "
1063 "for %s (%s)", myself, t->dbId, map);
1064 continue;
1065 }
1066
1067 /* Convert key into rule-value */
1068 if ((rv_request = datumToRuleValue(key, 0, t, 0, domain, TRUE,
1069 statP)) == 0) {
1070 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1071 "%s: Conversion error %d (NIS to name=value "
1072 "pairs) for NIS key (%s) for %s (%s)",
1073 myself, *statP, skey, t->dbId, map);
1074 continue;
1075 }
1076 /* Convert rule-value into ldap request */
1077 for (objectDN = t->objectDN; objectDN &&
1078 objectDN->read.base;
1079 objectDN = objectDN->next) {
1080 ls = createLdapRequest(t, rv_request, 0, 1, NULL,
1081 objectDN);
1082 if (ls == 0) {
1083 *statP = MAP_CREATE_LDAP_REQUEST_ERROR;
1084 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1085 "%s: Failed to create ldapSearch "
1086 "request for "
1087 "NIS key (%s) for %s (%s) "
1088 "for base %s",
1089 myself, skey, t->dbId, map,
1090 objectDN->read.base);
1091 continue;
1092 }
1093 ls->timeout.tv_sec = SINGLE_ACCESS_TIMEOUT_SEC;
1094 ls->timeout.tv_usec = SINGLE_ACCESS_TIMEOUT_USEC;
1095 /* Query LDAP */
1096 nr = (ls->isDN)?0:-1;
1097 rv_result = ldapSearch(ls, &nr, 0, statP);
1098 freeLdapSearch(ls);
1099 if (rv_result == 0) {
1100 if (*statP == LDAP_NO_SUCH_OBJECT) {
1101 /* Entry does not exist in */
1102 /* the ldap server */
1103 }
1104 continue;
1105 }
1106 freeRuleValue(rv_request, 1);
1107 rv_request = 0;
1108
1109 /* if result > 1, first match will be returned */
1110 if (nr > 1) {
1111 logmsg(MSG_NOTIMECHECK, LOG_INFO,
1112 "%s: %d ldapSearch results "
1113 "for NIS key (%s) "
1114 "for %s (%s) for base %s. "
1115 "First match will be returned ",
1116 myself, nr, skey, t->dbId, map,
1117 objectDN->read.base);
1118 }
1119
1120 for (i = 0; i < nr; i++) {
1121 /* Convert LDAP data to NIS equivalents */
1122 *statP = buildNISRuleValue(t, &rv_result[i],
1123 domain);
1124 if (*statP == MAP_INDEXLIST_ERROR)
1125 continue;
1126
1127 if (*statP != SUCCESS) {
1128 logmsg(MSG_NOTIMECHECK, LOG_WARNING,
1129 "%s: Conversion error %d (LDAP to "
1130 "name=value pairs) for NIS key (%s) "
1131 "for %s (%s) for base %s", myself,
1132 *statP, skey,
1133 t->dbId, map, objectDN->read.base);
1134 continue;
1135 }
1136
1137 /*
1138 * Check if 'key' from the ldap result matches the key
1139 * provided by our caller
1140 */
1141 if ((rc = verifyKey(skey, &rv_result[i]))
1142 == -1) {
1143 logmsg(MSG_NOTIMECHECK, LOG_INFO,
1144 "%s: Cannot verify key from ldap "
1145 "result for NIS key (%s) for %s (%s) "
1146 "for base %s",
1147 myself, skey, t->dbId, map,
1148 objectDN->read.base);
1149 continue;
1150 }
1151
1152 if (rc == 1) {
1153 datval = ruleValueToDatum(t,
1154 &rv_result[i], statP);
1155 if (datval == 0) {
1156 logmsg(MSG_NOTIMECHECK,
1157 LOG_WARNING,
1158 "%s: Conversion error %d "
1159 "(name=value pairs to NIS) "
1160 "for NIS key (%s) for %s (%s)"
1161 " for base %s",
1162 myself,
1163 *statP, skey, t->dbId, map,
1164 objectDN->read.base);
1165 continue;
1166 }
1167 if (value) {
1168 value->dptr = datval->dptr;
1169 value->dsize = datval->dsize;
1170 }
1171 sfree(datval);
1172 sfree(skey);
1173 freeRuleValue(rv_result, nr);
1174 rv_result = 0;
1175 *statP = SUCCESS;
1176
1177 /* Free full map name */
1178 sfree(str);
1179
1180 return (TRUE);
1181 }
1182 }
1183 freeRuleValue(rv_result, nr);
1184 rv_result = 0;
1185 } /* end of for over objectDN */
1186
1187 if (rv_request != 0) {
1188 freeRuleValue(rv_request, 1);
1189 rv_request = 0;
1190 }
1191 if (rv_result != 0) {
1192 freeRuleValue(rv_result, nr);
1193 rv_result = 0;
1194 }
1195 }
1196 sfree(skey);
1197 *statP = MAP_NO_MATCHING_KEY;
1198
1199 /* Free full map name */
1200 sfree(str);
1201
1202 return (FALSE);
1203 }
1204
1205
1206 /*
1207 * Maps and writes a single NIS entry to the LDAP DIT
1208 */
1209 int
1210 singleWriteToDIT(char *map, char *domain, datum *key, datum *value,
1211 bool_t replace) {
1212 __nis_table_mapping_t *t;
1213 __nis_rule_value_t *rv, *frv;
1214 __nis_ldap_search_t *ls;
1215 int statP = SUCCESS, flag;
1216 int nv, nr, i, rc, collapse;
1217 char *dn = 0, *skey, *svalue, *str;
1218 char *myself = "singleWriteToDIT";
1219
1220 if (!map || !domain || !key || !value) {
1221 return (MAP_PARAM_ERROR);
1222 }
1223
1224 /* Return SUCCESS for empty or whitespace key */
1225 for (i = 0; i < key->dsize && (key->dptr[i] == 0 ||
1226 key->dptr[i] == ' ' || key->dptr[i] == '\t'); i++);
1227 if (i >= key->dsize)
1228 return (SUCCESS);
1229
1230 /* Get the mapping information for the map */
1231 if ((t = mappingFromMap(map, domain, &statP)) == 0) {
1232 /*
1233 * No problem. We don't handle this map and domain. Maybe it's
1234 * handled by a service other than NIS.
1235 */
1236 return (statP);
1237 }
1238
1239 /* NULL-terminated version of key and value for logging */
1240 if ((skey = am(myself, key->dsize + 1)) == 0)
1241 return (MAP_NO_MEMORY);
1242 (void) memcpy(skey, key->dptr, key->dsize);
1243
1244 if ((svalue = am(myself, value->dsize + 1)) == 0) {
1245 sfree(skey);
1246 return (MAP_NO_MEMORY);
1247 }
1248 (void) memcpy(svalue, value->dptr, value->dsize);
1249
1250 if ((str = getFullMapName(map, domain)) == 0) {
1251 sfree(skey);
1252 sfree(svalue);
1253 return (MAP_NO_MEMORY);
1254 }
1255
1256 /* For each alternate mapping */
1257 for (flag = 0; t != 0; t = t->next) {
1258 /* Verify objName */
1259 if (strcmp(str, t->objName) != 0) {
1260 continue;
1261 }
1262
1263 /* Verify if key matches the index */
1264 if (verifyIndexMatch(t, 0, 0, N2LKEY, skey) == 0 ||
1265 verifyIndexMatch(t, 0, 0, N2LIPKEY, skey) == 0)
1266 continue;
1267
1268 /* Check the writespecs */
1269 if (t->objectDN->write.base == 0) {
1270 logmsg(MSG_NOTIMECHECK, LOG_INFO,
1271 "%s: No baseDN in writespec. Write disabled "
1272 "for %s (%s)", myself, t->dbId, map);
1273 continue;
1274 }
1275
1276 /* Check if rulesToLDAP are provided */
1277 if (t->numRulesToLDAP == 0) {
1278 logmsg(MSG_NOTIMECHECK, LOG_INFO,
1279 "%s: No rulesToLDAP. Write disabled for "
1280 "%s (%s)", myself, t->dbId, map);
1281 continue;
1282 }
1283
1284 /* Set flag to indicate write is enabled */
1285 flag = 1;
1286
1287 /* Convert key and value into an array of rule-values */
1288 if ((rv = datumToRuleValue(key, value, t, &nv, domain, FALSE,
1289 &statP)) == 0) {
1290 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1291 "%s: Conversion error %d (NIS to name=value "
1292 "pairs) for NIS data (key=%s, value=%s) "
1293 "for %s (%s)",
1294 myself, statP, skey, svalue, t->dbId, map);
1295 sfree(skey);
1296 sfree(svalue);
1297
1298 /* Free full map name */
1299 sfree(str);
1300
1301 return (statP);
1302 }
1303
1304 /* Convert NIS data to LDAP equivalents for each rule-value */
1305 for (i = 0; i < nv; i++) {
1306 /* Verify indexlist with name=value pairs */
1307 if (verifyIndexMatch(t, 0, &rv[i], 0, 0) == 0)
1308 break;
1309
1310 /* Create LDAP request and LDAP name=value pairs */
1311 if ((ls = createLdapRequest(t, &rv[i],
1312 0, 0, NULL, NULL)) == 0) {
1313 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1314 "%s: Conversion error (name=value pairs"
1315 " to LDAP) for NIS data "
1316 "(key=%s, value=%s) for %s (%s)",
1317 myself, skey, svalue, t->dbId, map);
1318 freeRuleValue(rv, nv);
1319 sfree(skey);
1320 sfree(svalue);
1321
1322 /* Free full map name */
1323 sfree(str);
1324
1325 return (MAP_CREATE_LDAP_REQUEST_ERROR);
1326 }
1327 freeLdapSearch(ls);
1328 /* printRuleValue(&rv[i]); */
1329 }
1330
1331 /* If i < nv then this alternate mapping isn't the one */
1332 if (i < nv)
1333 continue;
1334
1335 /*
1336 * Merge rule-values with the same DN so that we have
1337 * one ldap write request for each DN
1338 */
1339 nr = nv;
1340 frv = mergeRuleValueWithSameDN(rv, &nr);
1341 freeRuleValue(rv, nv);
1342 if (frv == 0) {
1343 if (nr == -1) {
1344 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1345 "%s: Unable to merge LDAP write "
1346 "requests to same DN for NIS data "
1347 "(key=%s, value=%s) for %s (%s)",
1348 myself, skey, svalue, t->dbId, map);
1349 statP = MAP_INTERNAL_ERROR;
1350 } else if (nr == 0) {
1351 logmsg(MSG_NOTIMECHECK, LOG_WARNING,
1352 "%s: Cannot generate write DN due to "
1353 "missing information for NIS data "
1354 "(key=%s, value=%s) for %s (%s)",
1355 myself, skey, svalue, t->dbId, map);
1356 statP = MAP_NO_DN;
1357 }
1358 sfree(skey);
1359 sfree(svalue);
1360
1361 /* Free full map name */
1362 sfree(str);
1363
1364 return (statP);
1365 }
1366
1367 /* Write to the LDAP server */
1368 for (collapse = 0, i = 0; i < nr; i++) {
1369 if ((dn = findVal("dn", &frv[i], mit_ldap)) != 0) {
1370 if (replace == FALSE) {
1371 /* ldap add */
1372 rc = ldapAdd(dn, &frv[i],
1373 t->objectDN->write.attrs, 0);
1374 } else {
1375 /* ldap modify with addFirst set */
1376 rc = ldapModify(dn, &frv[i],
1377 t->objectDN->write.attrs, 1);
1378 }
1379
1380 /* if we get err=20, collapse and try again */
1381 if (!collapse &&
1382 (rc == LDAP_TYPE_OR_VALUE_EXISTS) &&
1383 (collapseRuleValue(&frv[i]) == 1)) {
1384 logmsg(MSG_NOTIMECHECK, LOG_WARNING,
1385 "%s: Ignoring values differing "
1386 "in case from NIS data (key=%s,"
1387 " value=%s) for (dn: %s) for "
1388 "%s (%s)", myself, skey,
1389 svalue, dn, t->dbId, map);
1390 collapse = 1;
1391 i--;
1392 continue;
1393 }
1394
1395 collapse = 0;
1396 if (rc != LDAP_SUCCESS) {
1397 /* Log error */
1398 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1399 "%s: %s error %d (%s) for "
1400 "(dn: %s) for NIS data "
1401 "(key=%s, value=%s) "
1402 "for %s (%s)",
1403 myself, (replace == TRUE) ?
1404 "ldapModify" : "ldapAdd", rc,
1405 ldap_err2string(rc), dn, skey,
1406 svalue, t->dbId, map);
1407
1408 /* Dumping failed call may be useful */
1409 /* printRuleValue(&frv[i]); */
1410
1411 /*
1412 * Return the error code and let wrapper
1413 * sort out if mapping should continue
1414 * or abort.
1415 */
1416 statP = rc;
1417 sfree(skey);
1418 sfree(svalue);
1419 freeRuleValue(frv, nr);
1420
1421 /* Free full map name */
1422 sfree(str);
1423
1424 return (statP);
1425 }
1426 }
1427 }
1428
1429 freeRuleValue(frv, nr);
1430 }
1431
1432 sfree(skey);
1433 sfree(svalue);
1434
1435 /* Free full map name */
1436 sfree(str);
1437
1438 return ((flag)?SUCCESS:MAP_WRITE_DISABLED);
1439 }
1440
1441 suc_code
1442 collapseRuleValue(__nis_rule_value_t *rv) {
1443 int i, j, k, flag;
1444
1445 /* Using 'val' to appease cstyle's 80 chars/line limit */
1446 __nis_value_t *val;
1447
1448 for (i = 0, flag = 0; i < rv->numAttrs; i++) {
1449 val = &rv->attrVal[i];
1450 for (j = 1; j < val->numVals; j++) {
1451 for (k = 0; k < j; k++) {
1452 if (val->val[j].length != val->val[k].length)
1453 continue;
1454 if (val->val[k].length == 0)
1455 continue;
1456 if (strncasecmp(val->val[j].value,
1457 val->val[k].value,
1458 val->val[j].length) != 0)
1459 continue;
1460 flag = 1;
1461 sfree(val->val[j].value);
1462
1463 #ifdef ORDER_NOT_IMPORTANT
1464 val->val[j--] = val->val[--val->numVals];
1465 #else
1466 /* Order needs to be maintained */
1467 for (k = j + 1; k < val->numVals; k++)
1468 val->val[k - 1] = val->val[k];
1469 j--;
1470 val->numVals--;
1471 #endif
1472 break;
1473 }
1474 }
1475 }
1476 return (flag);
1477 }
1478
1479 /* ObjectClass lookup table */
1480 static struct {
1481 const char *attrType;
1482 const char *objectClass;
1483 } oc_lookup[] = {
1484 { "o", "objectclass=organization"},
1485 { "organizationname", "objectclass=organization"},
1486 { "2.5.4.10", "objectclass=organization"},
1487 { "ou", "objectclass=organizationalunit"},
1488 { "organizationalunitname", "objectclass=organizationalunit"},
1489 { "2.5.4.11", "objectclass=organizationalunit"},
1490 { "c", "objectclass=country"},
1491 { "countryname", "objectclass=country"},
1492 { "2.5.4.6", "objectclass=country"},
1493 { "dc", "objectclass=domain"},
1494 { "domaincomponent", "objectclass=domain"},
1495 { "0.9.2342.19200300.100.1.25", "objectclass=domain"},
1496 { "nismapname", "objectclass=nismap"},
1497 { "1.3.6.1.1.1.1.26", "objectclass=nismap"},
1498 { "automountmapname", "objectclass=automountmap"},
1499 { "1.3.6.1.1.1.1.31", "objectclass=automountmap"},
1500 { 0, 0}
1501 };
1502
1503 /*
1504 * Returns the name of the objectclass to which the object
1505 * represented by the given 'rdn' will most likely belong to.
1506 * The return value is in static memory so it should not be
1507 * freed
1508 */
1509 const char *
1510 getObjectClass(char *rdn) {
1511
1512 char *attrtype, *p;
1513 int len, i;
1514
1515 /* Skip leading whitespaces */
1516 for (p = rdn; *p == ' ' || *p == '\t'; p++);
1517 if (*p == '\0')
1518 return (0);
1519 attrtype = p;
1520
1521 /* Find '=' */
1522 if ((p = strchr(attrtype, '=')) == 0 || p == attrtype ||
1523 *(p - 1) == '\\')
1524 return (0);
1525
1526 /*
1527 * Skip trailing whitespaces in attrtype
1528 * Don't worry, p won't decrease beyond attrtype
1529 */
1530 for (--p; *p == ' ' || *p == '\t'; p--);
1531 len = p - attrtype + 1;
1532
1533 for (i = 0; oc_lookup[i].attrType; i++)
1534 if (!strncasecmp(oc_lookup[i].attrType, attrtype, len))
1535 /* Check length is right */
1536 if (len == strlen(oc_lookup[i].attrType))
1537 return (oc_lookup[i].objectClass);
1538
1539 return (0);
1540 }
1541
1542 /*
1543 * Split 'dn' into rdn and parentdn based on the first
1544 * occurrence of unescaped 'comma' or 'semicolon'. rdn
1545 * lies on the LHS while parentdn lies on the RHS of the
1546 * split. If none found, then an empty string ("") is
1547 * assigned to parentdn
1548 */
1549 int
1550 splitDN(char *dn, char **rdn, char **parentdn) {
1551 char *value, *name;
1552 char *myself = "splitDN";
1553
1554 if ((name = sdup(myself, T, dn)) == 0)
1555 return (-1);
1556
1557 for (value = name; *value != '\0'; value++) {
1558 if (*value == ',' || *value == ';')
1559 if (value == name || *(value - 1) != '\\')
1560 break;
1561 }
1562
1563 if (*value != '\0') {
1564 *value = '\0';
1565 value++;
1566 } else
1567 value = 0;
1568
1569 if (parentdn) {
1570 if ((*parentdn = sdup(myself, T, value)) == 0) {
1571 sfree(name);
1572 return (-1);
1573 }
1574 }
1575 if (rdn)
1576 *rdn = name;
1577 else
1578 sfree(name);
1579
1580 return (1);
1581 }
1582
1583 /*
1584 * FUNCTION : makeNISObject()
1585 *
1586 * DESCRIPTION: Sets up a nis Object in the DIT.
1587 *
1588 * GIVEN :
1589 * Case 1: Both 'domain' and 'dn' are non-NULL
1590 * Create nisDomainObject with the given information
1591 * Case 2: Only 'domain' is non-NULL
1592 * Obtain the 'dn' from the nisLDAPdomainContext list
1593 * Create nisDomainObject with the above information
1594 * Case 3: Only 'dn' is non-NULL
1595 * Create an object with the 'dn'
1596 * Here we guess the objectclass attribute, based on
1597 * oc_lookup table
1598 * Case 4: Both 'domain' and 'dn' are NULL
1599 * Error
1600 *
1601 * RETURNS : SUCCESS = It worked
1602 * FAILURE = There was a problem.
1603 */
1604 suc_code
1605 makeNISObject(char *domain, char *dn) {
1606 __nis_rule_value_t *rv;
1607 __nis_ldap_search_t *ls;
1608 int i, rc, nr, add_rc;
1609 char *val;
1610 char *myself = "makeNISObject";
1611
1612 if (!dn && !domain)
1613 return (FAILURE);
1614
1615 /*
1616 * If only 'domain' name is provided, then
1617 * try to find dn from the nisLDAPdomainContext
1618 * list generated by the parser
1619 */
1620 if (!dn) {
1621 for (i = 0; i < ypDomains.numDomains; i++) {
1622 if (ypDomains.domainLabels[i] == 0)
1623 continue;
1624 if (strcasecmp(domain, ypDomains.domainLabels[i])
1625 == 0) {
1626 dn = ypDomains.domains[i];
1627 break;
1628 }
1629 }
1630 if (!dn)
1631 return (FAILURE);
1632 }
1633
1634 /*
1635 * If only 'dn' is given, then it means that the
1636 * caller simply wants to a create an entry for
1637 * that 'dn'.
1638 *
1639 * If 'domain' is given, then check if the 'dn'
1640 * has already been set up as a nis domain object.
1641 * If not, see if we can make it become one.
1642 */
1643 if (domain) {
1644 /*
1645 * Check to see if the nis domain object has
1646 * already been set up
1647 */
1648 ls = buildLdapSearch(dn, LDAP_SCOPE_BASE, 0, 0,
1649 "objectclass=*", 0, 0, 0);
1650 if (ls == 0) {
1651 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1652 "%s: Unable to create ldapSearch "
1653 "request for dn: %s", myself, dn);
1654 return (FAILURE);
1655 }
1656 nr = -1;
1657 rv = ldapSearch(ls, &nr, 0, &rc);
1658 freeLdapSearch(ls);
1659 if (rc == LDAP_SUCCESS) {
1660 val = findVal("nisDomain", rv, mit_ldap);
1661 if (val != NULL) {
1662 /*
1663 * Yes, nis domain object found. Check
1664 * to see if the domain names match.
1665 * If so, we are done. If not, log
1666 * a warning message, and return SUCCESS.
1667 */
1668 if (strcasecmp(val, domain) == 0) {
1669 freeRuleValue(rv, nr);
1670 return (SUCCESS);
1671 } else {
1672 logmsg(MSG_NOTIMECHECK,
1673 LOG_WARNING,
1674 "%s: Entry (dn: %s) already "
1675 "contains a nis domain name "
1676 "(%s). The domain name (%s) "
1677 "is not added.",
1678 myself, dn, val, domain);
1679 freeRuleValue(rv, nr);
1680 return (SUCCESS);
1681 }
1682 } else {
1683 freeRuleValue(rv, nr);
1684 /*
1685 * Entry for the 'dn' exists, but it
1686 * is not a nis domain object yet.
1687 * Add the nisDoamin attribute and
1688 * the nisDomainObject objectclass to
1689 * the entry.
1690 */
1691 if ((rv = initRuleValue(1, 0)) == 0)
1692 return (FAILURE);
1693
1694 if (addSAttr2RuleValue("nisDomain",
1695 domain, rv) == -1) {
1696 freeRuleValue(rv, 1);
1697 return (FAILURE);
1698 }
1699 rc = ldapModify(dn, rv,
1700 "objectclass=nisDomainObject",
1701 0);
1702 freeRuleValue(rv, 1);
1703 if (rc == LDAP_SUCCESS) {
1704 logmsg(MSG_NOTIMECHECK,
1705 LOG_INFO,
1706 "%s: entry (dn: %s) "
1707 "modified to be an "
1708 "nis domain object",
1709 myself, dn);
1710 return (SUCCESS);
1711 } else {
1712 logmsg(MSG_NOTIMECHECK,
1713 LOG_ERR,
1714 "%s: unable to modify "
1715 "entry (dn: %s) to be "
1716 "a nis domain object: "
1717 "ldapModify error %d (%s)",
1718 myself, dn, rc,
1719 ldap_err2string(rc));
1720 return (FAILURE);
1721 }
1722 }
1723 } else { /* search for 'dn' failed */
1724 freeRuleValue(rv, nr);
1725
1726 /*
1727 * It is OK if no such object, otherwise
1728 * log an error.
1729 */
1730 if (rc != LDAP_NO_SUCH_OBJECT) {
1731 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1732 "%s: unable to retrieve "
1733 "entry (dn: %s): "
1734 "ldapSearch error %d (%s)",
1735 myself, dn, rc,
1736 ldap_err2string(rc));
1737 return (FAILURE);
1738 }
1739 }
1740
1741 /*
1742 * If the 'dn' is actually the naming context of
1743 * the DIT, we should be able to make it a nis domain
1744 * object without worrying about missing parent
1745 * entries. If unable to add the entry for the 'dn'
1746 * due to missing parent entries, fall through
1747 * to create them and then add the nis domain object.
1748 */
1749 if (addNISObject(domain, dn, &add_rc) == SUCCESS)
1750 return (SUCCESS);
1751 else if (add_rc != LDAP_NO_SUCH_OBJECT)
1752 return (FAILURE);
1753 }
1754
1755 /* Create parent */
1756 if (addParent(dn, NULL) == FAILURE)
1757 return (FAILURE);
1758
1759 if (addNISObject(domain, dn, NULL) == FAILURE)
1760 return (FAILURE);
1761
1762 return (SUCCESS);
1763 }
1764
1765 suc_code
1766 addParent(char *dn, char **attr) {
1767 __nis_rule_value_t *rv;
1768 __nis_ldap_search_t *ls;
1769 int rc, nr;
1770 char *parentdn = 0, *rdn = 0;
1771 char *myself = "addParent";
1772
1773 /* Obtain parentdn */
1774 if (splitDN(dn, &rdn, &parentdn) == -1)
1775 return (FAILURE);
1776 if (!parentdn) {
1777 sfree(rdn);
1778 return (FAILURE);
1779 }
1780
1781 /* Check if parentdn exists */
1782 ls = buildLdapSearch(parentdn, LDAP_SCOPE_BASE, 0, 0,
1783 "objectclass=*", 0, 0, 0);
1784 if (ls == 0) {
1785 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1786 "%s: Unable to create ldapSearch request for "
1787 "parent (dn: %s) of (dn: %s)",
1788 myself, parentdn, dn);
1789 sfree(parentdn);
1790 sfree(rdn);
1791 return (FAILURE);
1792 }
1793 nr = -1;
1794 rv = ldapSearch(ls, &nr, 0, &rc);
1795 freeLdapSearch(ls);
1796 freeRuleValue(rv, nr);
1797
1798 /* Create parent if it doesn't exists */
1799 if (rc == LDAP_NO_SUCH_OBJECT) {
1800 if (makeNISObject(0, parentdn) == FAILURE) {
1801 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1802 "%s: Unable to create parent (dn: %s) of "
1803 "(dn: %s) in the DIT", myself, parentdn, dn);
1804 sfree(parentdn);
1805 sfree(rdn);
1806 return (FAILURE);
1807 }
1808 }
1809 sfree(parentdn);
1810
1811 if (attr && rdn)
1812 *attr = (char *)getObjectClass(rdn);
1813 sfree(rdn);
1814
1815 return (SUCCESS);
1816 }
1817
1818
1819
1820 /*
1821 * FUNCTION : is_fatal_error()
1822 *
1823 * DESCRIPTION: Works out if a failed mapping operation should be retried.
1824 *
1825 * INPUTS : Result code from operation
1826 *
1827 * OUTPUTS : TRUE = Fatal error, don't retry.
1828 * FALSE = Temporary error, retry.
1829 */
1830 bool_t
1831 is_fatal_error(int res)
1832 {
1833
1834 if (0 > res)
1835 /* An internal mapping error. Not going to go away. */
1836 return (TRUE);
1837
1838 switch (res) {
1839 case (LDAP_PROTOCOL_ERROR):
1840 case (LDAP_TIMELIMIT_EXCEEDED):
1841 case (LDAP_PARTIAL_RESULTS):
1842 case (LDAP_BUSY):
1843 case (LDAP_UNAVAILABLE):
1844 case (LDAP_UNWILLING_TO_PERFORM):
1845 case (LDAP_OTHER):
1846 case (LDAP_SERVER_DOWN):
1847 case (LDAP_LOCAL_ERROR):
1848 case (LDAP_TIMEOUT):
1849 case (LDAP_NO_MEMORY):
1850 /* Probably worth a retry */
1851 return (FALSE);
1852
1853 default:
1854 return (TRUE);
1855 }
1856 }
1857
1858 /*
1859 * FUNCTION : addNISObject()
1860 *
1861 * DESCRIPTION: Add a nis Object in the DIT.
1862 *
1863 * GIVEN :
1864 * Case 1: 'dn' is NULL
1865 * Error
1866 * Case 2: 'domain' is non-NULL
1867 * Create nisDomainObject with the given information
1868 * Case 3: 'domain' is NULL
1869 * Create an object with the 'dn'
1870 * Here we guess the objectclass attribute, based on
1871 * oc_lookup table
1872 *
1873 * RETURNS : SUCCESS = It worked
1874 * FAILURE = There was a problem. If the ldap add
1875 * operation failed, ldap_rc will be set
1876 * to the ldap error code.
1877 */
1878 suc_code
1879 addNISObject(char *domain, char *dn, int *ldap_rc) {
1880 __nis_rule_value_t *rv;
1881 int rc;
1882 char *objClassAttrs = NULL, *attrs;
1883 char *value, *svalue, *rdn = NULL;
1884 char *myself = "addNISObject";
1885
1886 if (!dn)
1887 return (FAILURE);
1888
1889 if ((rv = initRuleValue(1, 0)) == 0)
1890 return (FAILURE);
1891
1892 if (ldap_rc)
1893 *ldap_rc = -1;
1894
1895 /*
1896 * Add name=value pairs from RDN. Although this is not required
1897 * for SunOne Directory Server, during openldap interoperabilty
1898 * tests, it was found out that openldap server returned object
1899 * class violation errors if MUST attributes were not specified
1900 * explicitly.
1901 */
1902 if (splitDN(dn, &rdn, 0) == -1)
1903 return (FAILURE);
1904 if (rdn != NULL) {
1905 objClassAttrs = (char *)getObjectClass(rdn);
1906 if (objClassAttrs == NULL) {
1907 sfree(rdn);
1908 return (FAILURE);
1909 }
1910
1911 /*
1912 * RDN can be composed of multiple name=value pairs
1913 * concatenated by '+'. Hence, we need to determine each
1914 * pair and add it to 'rv'
1915 */
1916 for (value = rdn, svalue = NULL; *value != '\0'; value++) {
1917 if (*value == '+') {
1918 /* Make sure it's not escaped */
1919 if (value == rdn || *(value - 1) != '\\') {
1920 /*
1921 * We are at the start of the new
1922 * pair. 'svalue' now contains the
1923 * value for the previous pair. Add
1924 * the previous pair to 'rv'
1925 */
1926 *value = '\0';
1927 if (svalue &&
1928 addSAttr2RuleValue(rdn, svalue, rv)
1929 == -1) {
1930 sfree(rdn);
1931 freeRuleValue(rv, 1);
1932 return (FAILURE);
1933 }
1934 svalue = NULL;
1935 rdn = value + 1;
1936 continue;
1937 }
1938 }
1939
1940 if (*value == '=') {
1941 if (value == rdn || *(value - 1) != '\\') {
1942 /*
1943 * 'rdn' now contains the name.
1944 * Whatever follows till the next
1945 * unescaped '+' or '\0' is the
1946 * value for this pair.
1947 */
1948 *value = '\0';
1949 svalue = value + 1;
1950 continue;
1951 }
1952 }
1953 }
1954
1955 /*
1956 * End of String. Add the previous name=value pair to 'rv'
1957 */
1958 if (svalue && addSAttr2RuleValue(rdn, svalue, rv) == -1) {
1959 sfree(rdn);
1960 freeRuleValue(rv, 1);
1961 return (FAILURE);
1962 }
1963 sfree(rdn);
1964 } else /* rdn == NULL */
1965 return (FAILURE);
1966
1967 /* Create the entry */
1968 if (domain) {
1969 if (addSAttr2RuleValue("nisDomain", domain, rv) == -1) {
1970 freeRuleValue(rv, 1);
1971 return (FAILURE);
1972 }
1973 attrs = scat(myself, F, "objectclass=nisdomainobject,",
1974 objClassAttrs);
1975 if (!attrs) {
1976 freeRuleValue(rv, 1);
1977 return (FAILURE);
1978 }
1979 rc = ldapAdd(dn, rv, attrs, 0);
1980 sfree(attrs);
1981 } else {
1982 rc = ldapAdd(dn, rv, objClassAttrs, 0);
1983 }
1984
1985 if (rc == LDAP_SUCCESS)
1986 logmsg(MSG_NOTIMECHECK, LOG_INFO,
1987 "%s: Entry (dn: %s) added to DIT",
1988 myself, dn);
1989 else if (rc == LDAP_ALREADY_EXISTS)
1990 /* Treat this as success */
1991 rc = LDAP_SUCCESS;
1992 else
1993 logmsg(MSG_NOTIMECHECK, LOG_ERR,
1994 "%s: ldapAdd error %d (%s) for (dn: %s)",
1995 myself, rc, ldap_err2string(rc), dn);
1996
1997 freeRuleValue(rv, 1);
1998 if (ldap_rc)
1999 *ldap_rc = rc;
2000 return ((rc == LDAP_SUCCESS)?SUCCESS:FAILURE);
2001 }