/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
 */

/*
 * ACL conversion support for smbfs
 * (To/from NT/ZFS-style ACLs.)
 */

#include <sys/types.h>
#include <sys/errno.h>
#include <sys/acl.h>
#include <sys/byteorder.h>

#if defined(_KERNEL) || defined(_FAKE_KERNEL)

#include <sys/cred.h>
#include <sys/cmn_err.h>
#include <sys/kmem.h>
#include <sys/sunddi.h>
#include <sys/vnode.h>
#include <sys/vfs.h>

#else   /* _KERNEL || _FAKE_KERNEL */

#include <stdio.h>
#include <stdlib.h>
#include <strings.h>

#endif  /* _KERNEL || _FAKE_KERNEL */

#ifdef _KERNEL
#include <sys/kidmap.h>
#else   /* _KERNEL */
#include <idmap.h>
#endif  /* _KERNEL */

#include <netsmb/mchain.h>
#include <netsmb/smb.h>
#include "smbfs_ntacl.h"

#define NT_SD_REVISION  1
#define NT_ACL_REVISION 2

#if defined(_KERNEL) || defined(_FAKE_KERNEL)
#define MALLOC(size) kmem_alloc(size, KM_SLEEP)
#define FREESZ(p, sz) kmem_free(p, sz)
#else   /* _KERNEL */
#define MALLOC(size) malloc(size)
/*
 * Define FREESZ() as inline function so the compiler will not
 * trigger variable set but not used warning for sz in calling function.
 */
/* ARGSUSED */
static inline void
FREESZ(void *p, size_t sz __unused)
{
        free(p);
}
#endif  /* _KERNEL */

#define ERRCHK(expr)    if ((error = expr) != 0) goto errout

/*
 * Security IDentifier (SID)
 */
static void
ifree_sid(i_ntsid_t *sid)
{
        size_t sz;

        if (sid == NULL)
                return;

        sz = I_SID_SIZE(sid->sid_subauthcount);
        FREESZ(sid, sz);
}

static int
md_get_sid(mdchain_t *mdp, i_ntsid_t **sidp)
{
        i_ntsid_t *sid = NULL;
        uint8_t revision, subauthcount;
        uint32_t *subauthp;
        size_t sidsz;
        int error, i;

        if ((error = md_get_uint8(mdp, &revision)) != 0)
                return (error);
        if ((error = md_get_uint8(mdp, &subauthcount)) != 0)
                return (error);

        sidsz = I_SID_SIZE(subauthcount);

        if ((sid = MALLOC(sidsz)) == NULL)
                return (ENOMEM);

        bzero(sid, sidsz);
        sid->sid_revision = revision;
        sid->sid_subauthcount = subauthcount;
        ERRCHK(md_get_mem(mdp, sid->sid_authority, 6, MB_MSYSTEM));

        subauthp = &sid->sid_subauthvec[0];
        for (i = 0; i < subauthcount; i++) {
                ERRCHK(md_get_uint32le(mdp, subauthp));
                subauthp++;
        }

        /* Success! */
        *sidp = sid;
        return (0);

errout:
        ifree_sid(sid);
        return (error);
}

static int
mb_put_sid(mbchain_t *mbp, i_ntsid_t *sid)
{
        uint32_t *subauthp;
        int error, i;

        if (sid == NULL)
                return (EINVAL);

        ERRCHK(mb_put_uint8(mbp, sid->sid_revision));
        ERRCHK(mb_put_uint8(mbp, sid->sid_subauthcount));
        ERRCHK(mb_put_mem(mbp, sid->sid_authority, 6, MB_MSYSTEM));

        subauthp = &sid->sid_subauthvec[0];
        for (i = 0; i < sid->sid_subauthcount; i++) {
                ERRCHK(mb_put_uint32le(mbp, *subauthp));
                subauthp++;
        }

        /* Success! */
        return (0);

errout:
        return (error);
}


/*
 * Access Control Entry (ACE)
 */
static void
ifree_ace(i_ntace_t *ace)
{

        if (ace == NULL)
                return;

        switch (ace->ace_hdr.ace_type) {
        case ACCESS_ALLOWED_ACE_TYPE:
        case ACCESS_DENIED_ACE_TYPE:
        case SYSTEM_AUDIT_ACE_TYPE:
        case SYSTEM_ALARM_ACE_TYPE:
                ifree_sid(ace->ace_v2.ace_sid);
                FREESZ(ace, sizeof (i_ntace_v2_t));
                break;
        /* other types todo */
        default:
                break;
        }
}

static int
md_get_ace(mdchain_t *mdp, i_ntace_t **acep)
{
        mdchain_t tmp_md;
        i_ntace_hdr_t ace_hdr;
        i_ntace_t *ace = NULL;
        uint16_t alloc_size;
        int error;

        /*
         * The ACE is realy variable length,
         * with format determined by the type.
         *
         * There may also be padding after it, so
         * decode it using a copy of the mdchain,
         * and then consume the specified length.
         */
        tmp_md = *mdp;

        /* Fixed-size ACE header */
        ERRCHK(md_get_uint8(&tmp_md, &ace_hdr.ace_type));
        ERRCHK(md_get_uint8(&tmp_md, &ace_hdr.ace_flags));
        ERRCHK(md_get_uint16le(&tmp_md, &ace_hdr.ace_size));

        switch (ace_hdr.ace_type) {
        case ACCESS_ALLOWED_ACE_TYPE:
        case ACCESS_DENIED_ACE_TYPE:
        case SYSTEM_AUDIT_ACE_TYPE:
        case SYSTEM_ALARM_ACE_TYPE:
                alloc_size = sizeof (i_ntace_v2_t);
                if ((ace = MALLOC(alloc_size)) == NULL)
                        return (ENOMEM);
                bzero(ace, alloc_size);
                /* ACE header */
                ace->ace_hdr.ace_type = ace_hdr.ace_type;
                ace->ace_hdr.ace_flags = ace_hdr.ace_flags;
                ace->ace_hdr.ace_size = alloc_size;
                /* Type-specific data. */
                ERRCHK(md_get_uint32le(&tmp_md, &ace->ace_v2.ace_rights));
                ERRCHK(md_get_sid(&tmp_md, &ace->ace_v2.ace_sid));
                break;

        /* other types todo */
        default:
                error = EIO;
                goto errout;
        }

        /* Now actually consume ace_hdr.ace_size */
        ERRCHK(md_get_mem(mdp, NULL, ace_hdr.ace_size, MB_MSYSTEM));

        /* Success! */
        *acep = ace;
        return (0);

errout:
        ifree_ace(ace);
        return (error);
}

static int
mb_put_ace(mbchain_t *mbp, i_ntace_t *ace)
{
        int cnt0, error;
        uint16_t ace_len, *ace_len_p;

        if (ace == NULL)
                return (EINVAL);

        cnt0 = mbp->mb_count;

        /*
         * Put the (fixed-size) ACE header
         * Will fill in the length later.
         */
        ERRCHK(mb_put_uint8(mbp, ace->ace_hdr.ace_type));
        ERRCHK(mb_put_uint8(mbp, ace->ace_hdr.ace_flags));
        ace_len_p = mb_reserve(mbp, sizeof (*ace_len_p));
        if (ace_len_p == NULL) {
                error = ENOMEM;
                goto errout;
        }

        switch (ace->ace_hdr.ace_type) {
        case ACCESS_ALLOWED_ACE_TYPE:
        case ACCESS_DENIED_ACE_TYPE:
        case SYSTEM_AUDIT_ACE_TYPE:
        case SYSTEM_ALARM_ACE_TYPE:
                /* Put type-specific data. */
                ERRCHK(mb_put_uint32le(mbp, ace->ace_v2.ace_rights));
                ERRCHK(mb_put_sid(mbp, ace->ace_v2.ace_sid));
                break;

        /* other types todo */
        default:
                error = EIO;
                goto errout;
        }

        /* Fill in the (OtW) ACE length. */
        ace_len = mbp->mb_count - cnt0;
        *ace_len_p = htoles(ace_len);

        /* Success! */
        return (0);

errout:
        return (error);
}


/*
 * Access Control List (ACL)
 */

/* Not an OTW structure, so size can be at our convenience. */
#define I_ACL_SIZE(cnt) (sizeof (i_ntacl_t) + (cnt) * sizeof (void *))

static void
ifree_acl(i_ntacl_t *acl)
{
        i_ntace_t **acep;
        size_t sz;
        int i;

        if (acl == NULL)
                return;

        acep = &acl->acl_acevec[0];
        for (i = 0; i < acl->acl_acecount; i++) {
                ifree_ace(*acep);
                acep++;
        }
        sz = I_ACL_SIZE(acl->acl_acecount);
        FREESZ(acl, sz);
}

static int
md_get_acl(mdchain_t *mdp, i_ntacl_t **aclp)
{
        i_ntacl_t *acl = NULL;
        i_ntace_t **acep;
        uint8_t revision;
        uint16_t acl_len, acecount;
        size_t aclsz;
        int i, error;

        if ((error = md_get_uint8(mdp, &revision)) != 0)
                return (error);
        if ((error = md_get_uint8(mdp, NULL)) != 0) /* pad1 */
                return (error);
        if ((error = md_get_uint16le(mdp, &acl_len)) != 0)
                return (error);
        if ((error = md_get_uint16le(mdp, &acecount)) != 0)
                return (error);
        if ((error = md_get_uint16le(mdp, NULL)) != 0) /* pad2 */
                return (error);

        aclsz = I_ACL_SIZE(acecount);
        if ((acl = MALLOC(aclsz)) == NULL)
                return (ENOMEM);
        bzero(acl, aclsz);
        acl->acl_revision = revision;
        acl->acl_acecount = acecount;

        acep = &acl->acl_acevec[0];
        for (i = 0; i < acl->acl_acecount; i++) {
                ERRCHK(md_get_ace(mdp, acep));
                acep++;
        }
        /*
         * There may be more data here, but
         * the caller takes care of that.
         */

        /* Success! */
        *aclp = acl;
        return (0);

errout:
        ifree_acl(acl);
        return (error);
}

static int
mb_put_acl(mbchain_t *mbp, i_ntacl_t *acl)
{
        i_ntace_t **acep;
        uint16_t acl_len, *acl_len_p;
        int i, cnt0, error;

        cnt0 = mbp->mb_count;

        ERRCHK(mb_put_uint8(mbp, acl->acl_revision));
        ERRCHK(mb_put_uint8(mbp, 0)); /* pad1 */
        acl_len_p = mb_reserve(mbp, sizeof (*acl_len_p));
        if (acl_len_p == NULL) {
                error = ENOMEM;
                goto errout;
        }
        ERRCHK(mb_put_uint16le(mbp, acl->acl_acecount));
        ERRCHK(mb_put_uint16le(mbp, 0)); /* pad2 */

        acep = &acl->acl_acevec[0];
        for (i = 0; i < acl->acl_acecount; i++) {
                ERRCHK(mb_put_ace(mbp, *acep));
                acep++;
        }

        /* Fill in acl_len_p */
        acl_len = mbp->mb_count - cnt0;
        *acl_len_p = htoles(acl_len);

        /* Success! */
        return (0);

errout:
        return (error);
}


/*
 * Security Descriptor
 */
void
smbfs_acl_free_sd(i_ntsd_t *sd)
{

        if (sd == NULL)
                return;

        ifree_sid(sd->sd_owner);
        ifree_sid(sd->sd_group);
        ifree_acl(sd->sd_sacl);
        ifree_acl(sd->sd_dacl);

        FREESZ(sd, sizeof (*sd));
}

/*
 * Import a raw SD (mb chain) into "internal" form.
 * (like "absolute" form per. NT docs)
 * Returns allocated data in sdp
 *
 * Note: does NOT consume all the mdp data, so the
 * caller has to take care of that if necessary.
 */
int
md_get_ntsd(mdchain_t *mdp, i_ntsd_t **sdp)
{
        i_ntsd_t *sd = NULL;
        mdchain_t top_md, tmp_md;
        uint32_t owneroff, groupoff, sacloff, dacloff;
        int error;

        if ((sd = MALLOC(sizeof (*sd))) == NULL)
                return (ENOMEM);
        bzero(sd, sizeof (*sd));

        /*
         * Offsets below are relative to this point,
         * so save the mdp state for use below.
         */
        top_md = *mdp;

        ERRCHK(md_get_uint8(mdp, &sd->sd_revision));
        ERRCHK(md_get_uint8(mdp, &sd->sd_rmctl));
        ERRCHK(md_get_uint16le(mdp, &sd->sd_flags));
        ERRCHK(md_get_uint32le(mdp, &owneroff));
        ERRCHK(md_get_uint32le(mdp, &groupoff));
        ERRCHK(md_get_uint32le(mdp, &sacloff));
        ERRCHK(md_get_uint32le(mdp, &dacloff));

        /*
         * The SD is "self-relative" on the wire,
         * but not after this decodes it.
         */
        sd->sd_flags &= ~SD_SELF_RELATIVE;

        /*
         * For each section make a temporary copy of the
         * top_md state, advance to the given offset, and
         * pass that to the lower md_get_xxx functions.
         * These could be marshalled in any order, but
         * are normally found in the order shown here.
         */
        if (sacloff) {
                tmp_md = top_md;
                md_get_mem(&tmp_md, NULL, sacloff, MB_MSYSTEM);
                ERRCHK(md_get_acl(&tmp_md, &sd->sd_sacl));
        }
        if (dacloff) {
                tmp_md = top_md;
                md_get_mem(&tmp_md, NULL, dacloff, MB_MSYSTEM);
                ERRCHK(md_get_acl(&tmp_md, &sd->sd_dacl));
        }
        if (owneroff) {
                tmp_md = top_md;
                md_get_mem(&tmp_md, NULL, owneroff, MB_MSYSTEM);
                ERRCHK(md_get_sid(&tmp_md, &sd->sd_owner));
        }
        if (groupoff) {
                tmp_md = top_md;
                md_get_mem(&tmp_md, NULL, groupoff, MB_MSYSTEM);
                ERRCHK(md_get_sid(&tmp_md, &sd->sd_group));
        }

        /* Success! */
        *sdp = sd;
        return (0);

errout:
        smbfs_acl_free_sd(sd);
        return (error);
}

/*
 * Export an "internal" SD into an raw SD (mb chain).
 * (a.k.a "self-relative" form per. NT docs)
 * Returns allocated mbchain in mbp.
 */
int
mb_put_ntsd(mbchain_t *mbp, i_ntsd_t *sd)
{
        uint32_t *owneroffp, *groupoffp, *sacloffp, *dacloffp;
        uint32_t owneroff, groupoff, sacloff, dacloff;
        uint16_t flags;
        int cnt0, error;

        cnt0 = mbp->mb_count;
        owneroff = groupoff = sacloff = dacloff = 0;

        /* The SD is "self-relative" on the wire. */
        flags = sd->sd_flags | SD_SELF_RELATIVE;

        ERRCHK(mb_put_uint8(mbp, sd->sd_revision));
        ERRCHK(mb_put_uint8(mbp, sd->sd_rmctl));
        ERRCHK(mb_put_uint16le(mbp, flags));

        owneroffp = mb_reserve(mbp, sizeof (*owneroffp));
        groupoffp = mb_reserve(mbp, sizeof (*groupoffp));
        sacloffp  = mb_reserve(mbp, sizeof (*sacloffp));
        dacloffp  = mb_reserve(mbp, sizeof (*dacloffp));
        if (owneroffp == NULL || groupoffp == NULL ||
            sacloffp == NULL || dacloffp == NULL) {
                error = ENOMEM;
                goto errout;
        }

        /*
         * These could be marshalled in any order, but
         * are normally found in the order shown here.
         */
        if (sd->sd_sacl) {
                sacloff = mbp->mb_count - cnt0;
                ERRCHK(mb_put_acl(mbp, sd->sd_sacl));
        }
        if (sd->sd_dacl) {
                dacloff = mbp->mb_count - cnt0;
                ERRCHK(mb_put_acl(mbp, sd->sd_dacl));
        }
        if (sd->sd_owner) {
                owneroff = mbp->mb_count - cnt0;
                ERRCHK(mb_put_sid(mbp, sd->sd_owner));
        }
        if (sd->sd_group) {
                groupoff = mbp->mb_count - cnt0;
                ERRCHK(mb_put_sid(mbp, sd->sd_group));
        }

        /* Fill in the offsets */
        *owneroffp = htolel(owneroff);
        *groupoffp = htolel(groupoff);
        *sacloffp  = htolel(sacloff);
        *dacloffp  = htolel(dacloff);

        /* Success! */
        return (0);

errout:
        return (error);
}

/*
 * ================================================================
 * Support for ACL fetch, including conversions
 * from Windows ACLs to NFSv4-style ACLs.
 * ================================================================
 */

#define GENERIC_RIGHTS_MASK \
        (GENERIC_RIGHT_READ_ACCESS | GENERIC_RIGHT_WRITE_ACCESS |\
        GENERIC_RIGHT_EXECUTE_ACCESS | GENERIC_RIGHT_ALL_ACCESS)

/*
 * Table for converting NT GENERIC_RIGHT_... to specific rights
 * appropriate for objects of type file.
 */
struct gen2fsr {
        uint32_t        gf_generic;
        uint32_t        gf_specific;
};
static const struct gen2fsr
smbfs_gen2fsr[] = {
        {
                GENERIC_RIGHT_READ_ACCESS,
                STD_RIGHT_SYNCHRONIZE_ACCESS |
                STD_RIGHT_READ_CONTROL_ACCESS |
                SA_RIGHT_FILE_READ_ATTRIBUTES |
                SA_RIGHT_FILE_READ_EA |
                SA_RIGHT_FILE_READ_DATA },
        {
                GENERIC_RIGHT_WRITE_ACCESS,
                STD_RIGHT_SYNCHRONIZE_ACCESS |
                STD_RIGHT_READ_CONTROL_ACCESS |
                SA_RIGHT_FILE_WRITE_ATTRIBUTES |
                SA_RIGHT_FILE_WRITE_EA |
                SA_RIGHT_FILE_APPEND_DATA |
                SA_RIGHT_FILE_WRITE_DATA },
        {
                GENERIC_RIGHT_EXECUTE_ACCESS,
                STD_RIGHT_SYNCHRONIZE_ACCESS |
                STD_RIGHT_READ_CONTROL_ACCESS |
                SA_RIGHT_FILE_READ_ATTRIBUTES |
                SA_RIGHT_FILE_EXECUTE },
        {
                GENERIC_RIGHT_ALL_ACCESS,
                STD_RIGHT_SYNCHRONIZE_ACCESS |
                STD_RIGHT_WRITE_OWNER_ACCESS |
                STD_RIGHT_WRITE_DAC_ACCESS |
                STD_RIGHT_READ_CONTROL_ACCESS |
                STD_RIGHT_DELETE_ACCESS |
                SA_RIGHT_FILE_ALL_ACCESS },
        { 0, 0 }
};

/*
 * Table for translating ZFS ACE flags to NT ACE flags.
 * The low four bits are the same, but not others.
 */
struct zaf2naf {
        uint16_t        za_flag;
        uint8_t         na_flag;
};
static const struct zaf2naf
smbfs_zaf2naf[] = {
        { ACE_FILE_INHERIT_ACE,         OBJECT_INHERIT_ACE_FLAG },
        { ACE_DIRECTORY_INHERIT_ACE,    CONTAINER_INHERIT_ACE_FLAG },
        { ACE_NO_PROPAGATE_INHERIT_ACE, NO_PROPAGATE_INHERIT_ACE_FLAG },
        { ACE_INHERIT_ONLY_ACE,         INHERIT_ONLY_ACE_FLAG },
        { ACE_INHERITED_ACE,            INHERITED_ACE_FLAG },
        { ACE_SUCCESSFUL_ACCESS_ACE_FLAG, SUCCESSFUL_ACCESS_ACE_FLAG },
        { ACE_FAILED_ACCESS_ACE_FLAG,   FAILED_ACCESS_ACE_FLAG },
        { 0, 0 }
};

/*
 * Convert an NT SID to a string. Optionally return the
 * last sub-authority (or "relative ID" -- RID) in *ridp
 * and truncate the output string after the domain part.
 * If ridp==NULL, the output string is the whole SID,
 * including both the domain and RID.
 *
 * Return length written, or -1 on error.
 */
int
smbfs_sid2str(i_ntsid_t *sid,
        char *obuf, size_t osz, uint32_t *ridp)
{
        char *s = obuf;
        uint64_t auth = 0;
        uint_t i, n;
        uint32_t subs, *ip;

        n = snprintf(s, osz, "S-%u", sid->sid_revision);
        if (n > osz)
                return (-1);
        s += n; osz -= n;

        for (i = 0; i < 6; i++)
                auth = (auth << 8) | sid->sid_authority[i];
        n = snprintf(s, osz, "-%llu", (u_longlong_t)auth);
        if (n > osz)
                return (-1);
        s += n; osz -= n;

        subs = sid->sid_subauthcount;
        if (subs < 1 || subs > 15)
                return (-1);
        if (ridp)
                subs--;

        ip = &sid->sid_subauthvec[0];
        for (; subs; subs--, ip++) {
                n = snprintf(s, osz, "-%u", *ip);
                if (n > osz)
                        return (-1);
                s += n; osz -= n;
        }
        if (ridp)
                *ridp = *ip;

        /* LINTED E_PTRDIFF_OVERFLOW */
        return (s - obuf);
}

/*
 * Our interface to the idmap service.
 *
 * The idmap API is _almost_ the same between
 * kernel and user-level.  But not quite...
 * Hope this improves readability below.
 */
#ifdef  _KERNEL

#define I_getuidbysid(GH, SPP, RID, UIDP, SP) \
        kidmap_batch_getuidbysid(GH, SPP, RID, UIDP, SP)

#define I_getgidbysid(GH, SPP, RID, GIDP, SP) \
        kidmap_batch_getgidbysid(GH, SPP, RID, GIDP, SP)

#define I_getpidbysid(GH, SPP, RID, PIDP, ISUP, SP) \
        kidmap_batch_getpidbysid(GH, SPP, RID, PIDP, ISUP, SP)

#define I_getmappings kidmap_get_mappings

#else /* _KERNEL */

#define I_getuidbysid(GH, SPP, RID, UIDP, SP) \
        idmap_get_uidbysid(GH, SPP, RID, 0, UIDP, SP)

#define I_getgidbysid(GH, SPP, RID, GIDP, SP) \
        idmap_get_gidbysid(GH, SPP, RID, 0, GIDP, SP)

#define I_getpidbysid(GH, SPP, RID, PIDP, ISUP, SP) \
        idmap_get_pidbysid(GH, SPP, RID, 0, PIDP, ISUP, SP)

#define I_getmappings idmap_get_mappings

#endif /* _KERNEL */


/*
 * The idmap request types, chosen so they also
 * match the values returned in mi_isuser.
 */
#define IDM_TYPE_ANY    -1
#define IDM_TYPE_GROUP  0
#define IDM_TYPE_USER   1

/*
 * A sentinel value for mi_isuser (below) to indicate
 * that the SID is the well-known "Everyone" (S-1-1-0).
 * The idmap library only uses -1, 0, 1, so this value
 * is arbitrary but must not overlap w/ idmap values.
 * XXX: Could use a way for idmap to tell us when
 * it recognizes this well-known SID.
 */
#define IDM_EVERYONE    11

struct mapinfo2uid {
        uid_t   mi_uid; /* or gid, or pid */
        int     mi_isuser; /* IDM_TYPE */
        idmap_stat mi_status;
};

/*
 * Build an idmap request.  Cleanup is
 * handled by the caller (error or not)
 */
static int
mkrq_idmap_sid2ux(
        idmap_get_handle_t *idmap_gh,
        struct mapinfo2uid *mip,
        i_ntsid_t *sid,
        int req_type)
{
        char strbuf[256];
        char *sid_prefix;
        uint32_t        rid;
        idmap_stat      idms;

        if (smbfs_sid2str(sid, strbuf, sizeof (strbuf), &rid) < 0)
                return (EINVAL);
        sid_prefix = strbuf;

        /*
         * Give the "Everyone" group special treatment.
         */
        if (strcmp(sid_prefix, "S-1-1") == 0 && rid == 0) {
                /* This is "Everyone" */
                mip->mi_uid = (uid_t)-1;
                mip->mi_isuser = IDM_EVERYONE;
                mip->mi_status = 0;
                return (0);
        }

        switch (req_type) {

        case IDM_TYPE_USER:
                mip->mi_isuser = req_type;
                idms = I_getuidbysid(idmap_gh, sid_prefix, rid,
                    &mip->mi_uid, &mip->mi_status);
                break;

        case IDM_TYPE_GROUP:
                mip->mi_isuser = req_type;
                idms = I_getgidbysid(idmap_gh, sid_prefix, rid,
                    &mip->mi_uid, &mip->mi_status);
                break;

        case IDM_TYPE_ANY:
                idms = I_getpidbysid(idmap_gh, sid_prefix, rid,
                    &mip->mi_uid, &mip->mi_isuser, &mip->mi_status);
                break;

        default:
                idms = IDMAP_ERR_OTHER;
                break;
        }

        if (idms != IDMAP_SUCCESS)
                return (EINVAL);

        return (0);
}

/*
 * Convert an NT ACE to a ZFS ACE.
 * ACE type was already validated.
 */
static void
ntace2zace(ace_t *zacep, i_ntace_t *ntace, struct mapinfo2uid *mip)
{
        const struct zaf2naf *znaf;
        uid_t zwho;
        uint32_t zamask;
        uint16_t zflags;

        /*
         * Set the "ID type" flags in the ZFS ace flags.
         */
        zflags = 0;
        switch (mip->mi_isuser) {
        case IDM_EVERYONE:
                zflags = ACE_EVERYONE;
                zwho = (uid_t)-1;
                break;

        case IDM_TYPE_GROUP: /* it's a GID */
                zflags = ACE_IDENTIFIER_GROUP;
                zwho = mip->mi_uid;
                break;

        default:
        case IDM_TYPE_USER: /* it's a UID */
                zflags = 0;
                zwho = mip->mi_uid;
                break;
        }

        /*
         * Translate NT ACE flags to ZFS ACE flags.
         */
        for (znaf = smbfs_zaf2naf; znaf->za_flag; znaf++)
                if (ntace->ace_hdr.ace_flags & znaf->na_flag)
                        zflags |= znaf->za_flag;

        /*
         * The "normal" access mask bits are the same, but
         * if the ACE has any GENERIC_RIGHT_... convert those
         * to specific rights.  GENERIC bits are rarely seen,
         * but reportedly can happen with inherit-only ACEs.
         */
        zamask = ntace->ace_v2.ace_rights & ACE_ALL_PERMS;
        if (ntace->ace_v2.ace_rights & GENERIC_RIGHTS_MASK) {
                const struct gen2fsr *gf;
                for (gf = smbfs_gen2fsr; gf->gf_generic; gf++)
                        if (ntace->ace_v2.ace_rights & gf->gf_generic)
                                zamask |= gf->gf_specific;
        }

        /*
         * Fill in the ZFS-style ACE
         */
        zacep->a_who = zwho;
        zacep->a_access_mask = zamask;
        zacep->a_flags = zflags;
        zacep->a_type = ntace->ace_hdr.ace_type;
}

/*
 * Convert an internal SD to a ZFS-style ACL.
 * Note optional args: vsa/acl, uidp, gidp.
 *
 * This makes two passes over the SD, the first building a
 * "batch" request for idmap with results in mapinfo, the
 * second building a ZFS-style ACL using the idmap results.
 */
int
smbfs_acl_sd2zfs(
        i_ntsd_t *sd,
#if defined(_KERNEL) || defined(_FAKE_KERNEL)
        vsecattr_t *acl_info,
#else /* _KERNEL */
        acl_t *acl_info,
#endif /* _KERNEL */
        uid_t *uidp, gid_t *gidp)
{
        struct mapinfo2uid *mip, *mapinfo = NULL;
        int error, i, mapcnt, zacecnt, zacl_size;
        ace_t *zacep0, *zacep;
        uid_t own_uid = (uid_t)-1;
        gid_t own_gid = (gid_t)-1;
        i_ntacl_t *ntacl;
        i_ntace_t **ntacep;
        idmap_get_handle_t *idmap_gh = NULL;
        idmap_stat      idms;

        /*
         * sanity checks
         */
        if (acl_info) {
#if !defined(_KERNEL) && !defined(_FAKE_KERNEL)
                if (acl_info->acl_type != ACE_T ||
                    acl_info->acl_aclp != NULL ||
                    acl_info->acl_entry_size != sizeof (ace_t))
                        return (EINVAL);
#endif /* !_KERNEL */
                if ((sd->sd_flags & SD_DACL_PRESENT) == 0)
                        return (EINVAL);
        }

        /*
         * How many SID mappings will we need?
         */
        mapcnt = 0;
        if (sd->sd_owner)
                mapcnt++;
        if (sd->sd_group)
                mapcnt++;
        if ((sd->sd_flags & SD_SACL_PRESENT) &&
            (sd->sd_sacl != NULL))
                mapcnt += sd->sd_sacl->acl_acecount;
        if ((sd->sd_flags & SD_DACL_PRESENT) &&
            (sd->sd_dacl != NULL))
                mapcnt += sd->sd_dacl->acl_acecount;
        if (mapcnt == 0) {
                /*
                 * We have a NULL DACL, SACL, and don't
                 * have an owner or group, so there's no
                 * idmap work to do.  This is very rare,
                 * so rather than complicate things below,
                 * pretend we need one mapping slot.
                 */
                mapcnt = 1;
        }

        mapinfo = MALLOC(mapcnt * sizeof (*mapinfo));
        if (mapinfo == NULL) {
                error = ENOMEM;
                goto errout;
        }
        bzero(mapinfo, mapcnt * sizeof (*mapinfo));


        /*
         * Get an imap "batch" request handle.
         */
#ifdef  _KERNEL
        idmap_gh = kidmap_get_create(curproc->p_zone);
#else /* _KERNEL */
        idms = idmap_get_create(&idmap_gh);
        if (idms != IDMAP_SUCCESS) {
                error = ENOTACTIVE;
                goto errout;
        }
#endif /* _KERNEL */

        /*
         * Build our request to the idmap deamon,
         * getting Unix IDs for every SID.
         */
        mip = mapinfo;
        if (sd->sd_owner) {
                error = mkrq_idmap_sid2ux(idmap_gh, mip,
                    sd->sd_owner, IDM_TYPE_USER);
                if (error)
                        goto errout;
                mip++;
        }
        if (sd->sd_group) {
                error = mkrq_idmap_sid2ux(idmap_gh, mip,
                    sd->sd_group, IDM_TYPE_GROUP);
                if (error)
                        goto errout;
                mip++;
        }
        if ((sd->sd_flags & SD_SACL_PRESENT) &&
            (sd->sd_sacl != NULL)) {
                ntacl = sd->sd_sacl;
                ntacep = &ntacl->acl_acevec[0];
                for (i = 0; i < ntacl->acl_acecount; i++) {
                        error = mkrq_idmap_sid2ux(idmap_gh, mip,
                            (*ntacep)->ace_v2.ace_sid, IDM_TYPE_ANY);
                        if (error)
                                goto errout;
                        ntacep++;
                        mip++;
                }
        }
        if ((sd->sd_flags & SD_DACL_PRESENT) &&
            (sd->sd_dacl != NULL)) {
                ntacl = sd->sd_dacl;
                ntacep = &ntacl->acl_acevec[0];
                for (i = 0; i < ntacl->acl_acecount; i++) {
                        error = mkrq_idmap_sid2ux(idmap_gh, mip,
                            (*ntacep)->ace_v2.ace_sid, IDM_TYPE_ANY);
                        if (error)
                                goto errout;
                        ntacep++;
                        mip++;
                }
        }

        if (mip != mapinfo) {
                idms = I_getmappings(idmap_gh);
                if (idms != IDMAP_SUCCESS) {
                        /* creative error choice */
                        error = EIDRM;
                        goto errout;
                }
        }

        /*
         * With any luck, we now have Unix user/group IDs
         * for every Windows SID in the security descriptor.
         * The remaining work is just format conversion.
         */
        mip = mapinfo;
        if (sd->sd_owner) {
                own_uid = mip->mi_uid;
                mip++;
        }
        if (sd->sd_group) {
                own_gid = mip->mi_uid;
                mip++;
        }

        if (uidp)
                *uidp = own_uid;
        if (gidp)
                *gidp = own_gid;

        if (acl_info == NULL) {
                /* Caller only wanted uid/gid */
                goto done;
        }

        /*
         * Build the ZFS-style ACL
         * First, allocate the most ZFS ACEs we'll need.
         */
        zacecnt = 0;
        if ((sd->sd_flags & SD_SACL_PRESENT) &&
            (sd->sd_sacl != NULL))
                zacecnt += sd->sd_sacl->acl_acecount;

        /* NB, have: (sd->sd_flags & SD_DACL_PRESENT) */
        if ((sd->sd_dacl != NULL) &&
            (sd->sd_dacl->acl_acecount > 0)) {
                zacecnt += sd->sd_dacl->acl_acecount;
        } else {
                /*
                 * DACL is NULL or empty. Either way,
                 * we'll need to add a ZFS ACE below.
                 */
                zacecnt++;
        }
        zacl_size = zacecnt * sizeof (ace_t);
        zacep0 = MALLOC(zacl_size);
        if (zacep0 == NULL) {
                error = ENOMEM;
                goto errout;
        }
        zacep = zacep0;

        if ((sd->sd_flags & SD_SACL_PRESENT) &&
            (sd->sd_sacl != NULL)) {
                ntacl = sd->sd_sacl;
                ntacep = &ntacl->acl_acevec[0];
                for (i = 0; i < ntacl->acl_acecount; i++) {
                        ntace2zace(zacep, *ntacep, mip);
                        zacep++;
                        ntacep++;
                        mip++;
                }
        }

        /* NB, have: (sd->sd_flags & SD_DACL_PRESENT) */
        if (sd->sd_dacl != NULL) {
                ntacl = sd->sd_dacl;
                ntacep = &ntacl->acl_acevec[0];
                for (i = 0; i < ntacl->acl_acecount; i++) {
                        ntace2zace(zacep, *ntacep, mip);
                        zacep++;
                        ntacep++;
                        mip++;
                }
        }
        if (sd->sd_dacl == NULL) {
                /*
                 * The SD has a NULL DACL.  That means
                 * everyone@, full-control
                 */
                zacep->a_who = (uid_t)-1;
                zacep->a_access_mask = ACE_ALL_PERMS;
                zacep->a_flags = ACE_EVERYONE;
                zacep->a_type = ACCESS_ALLOWED_ACE_TYPE;
        } else if (sd->sd_dacl->acl_acecount == 0) {
                /*
                 * The SD has an Empty DACL.  We need
                 * at least one ACE, so add one giving
                 * the owner the usual implied access.
                 */
                zacep->a_who = (uid_t)-1;
                zacep->a_access_mask = ACE_READ_ATTRIBUTES | \
                    ACE_READ_ACL | ACE_WRITE_ACL;
                zacep->a_flags = ACE_OWNER;
                zacep->a_type = ACCESS_ALLOWED_ACE_TYPE;
        }

#if defined(_KERNEL) || defined(_FAKE_KERNEL)
        acl_info->vsa_aclcnt = zacecnt;
        acl_info->vsa_aclentp = zacep0;
        acl_info->vsa_aclentsz = zacl_size;
#else   /* _KERNEL */
        acl_info->acl_cnt = zacecnt;
        acl_info->acl_aclp = zacep0;
#endif  /* _KERNEL */

done:
        error = 0;

errout:
        if (mapinfo != NULL)
                FREESZ(mapinfo, mapcnt * sizeof (*mapinfo));
#ifdef  _KERNEL
        if (idmap_gh != NULL)
                kidmap_get_destroy(idmap_gh);
#else /* _KERNEL */
        if (idmap_gh != NULL)
                idmap_get_destroy(idmap_gh);
#endif /* _KERNEL */

        return (error);
}


/*
 * ================================================================
 * Support for ACL store, including conversions
 * from NFSv4-style ACLs to Windows ACLs.
 * ================================================================
 */

/*
 * Convert a "sid-prefix" string plus RID into an NT SID.
 *
 * If successful, sets *osid and returns zero,
 * otherwise returns an errno value.
 */
int
smbfs_str2sid(const char *sid_prefix, uint32_t *ridp, i_ntsid_t **osidp)
{
        i_ntsid_t *sid = NULL;
        u_longlong_t auth = 0;
        ulong_t sa;
        uint8_t sacnt;
        const char *p;
        char *np;
        size_t size;
        int i;
        int err;

        if (sid_prefix == NULL)
                return (EINVAL);

        p = sid_prefix;
        if (strncmp(p, "S-1-", 4) != 0)
                return (EINVAL);
        p += 4;

        /* Parse the "authority" */
#ifdef  _KERNEL
        err = ddi_strtoull(p, &np, 10, &auth);
        if (err != 0)
                return (err);
#else   /* _KERNEL */
        auth = strtoull(p, &np, 10);
        if (p == np)
                return (EINVAL);
#endif  /* _KERNEL */

        /*
         * Count the sub-authorities.  Here, np points to
         * the "-" before the first sub-authority.
         */
        sacnt = 0;
        for (p = np; *p; p++) {
                if (*p == '-')
                        sacnt++;
        }
        if (ridp != NULL)
                sacnt++;

        /* Allocate the internal SID. */
        size = I_SID_SIZE(sacnt);
        sid = MALLOC(size);
        if (sid == NULL)
                return (ENOMEM);
        bzero(sid, size);

        /* Fill it in. */
        sid->sid_revision = 1;
        sid->sid_subauthcount = sacnt;
        for (i = 5; i >= 0; i--) {
                sid->sid_authority[i] = auth & 0xFF;
                auth = auth >> 8;
        }

        err = EINVAL;
        if (ridp != NULL)
                sacnt--; /* Last SA not from string */
        p = np;
        for (i = 0; i < sacnt; i++) {
                if (*p != '-') {
                        err = EINVAL;
                        goto out;
                }
                p++;
#if defined(_KERNEL) || defined(_FAKE_KERNEL)
                err = ddi_strtoul(p, &np, 10, &sa);
                if (err != 0)
                        goto out;
#else   /* _KERNEL */
                sa = strtoul(p, &np, 10);
                if (p == np) {
                        err = EINVAL;
                        goto out;
                }
#endif  /* _KERNEL */
                sid->sid_subauthvec[i] = (uint32_t)sa;
                p = np;
        }
        if (*p != '\0')
                goto out;
        if (ridp != NULL)
                sid->sid_subauthvec[i] = *ridp;
        err = 0;

out:
        if (err)
                FREESZ(sid, size);
        else
                *osidp = sid;

        return (err);
}

/*
 * The idmap API is _almost_ the same between
 * kernel and user-level.  But not quite...
 * Hope this improves readability below.
 */
#ifdef  _KERNEL

#define I_getsidbyuid(GH, UID, SPP, RP, ST) \
        kidmap_batch_getsidbyuid(GH, UID, SPP, RP, ST)

#define I_getsidbygid(GH, GID, SPP, RP, ST) \
        kidmap_batch_getsidbygid(GH, GID, SPP, RP, ST)

#else /* _KERNEL */

#define I_getsidbyuid(GH, UID, SPP, RP, ST) \
        idmap_get_sidbyuid(GH, UID, 0, SPP, RP, ST)

#define I_getsidbygid(GH, GID, SPP, RP, ST) \
        idmap_get_sidbygid(GH, GID, 0, SPP, RP, ST)

#endif /* _KERNEL */

struct mapinfo2sid {
        /* Yet another kernel vs. user difference. */
#ifdef  _KERNEL
        const char *mi_dsid;    /* domain SID */
#else /* _KERNEL */
        char *mi_dsid;
#endif /* _KERNEL */
        uint32_t mi_rid;        /* relative ID */
        idmap_stat mi_status;
};

/*
 * Build an idmap request.  Cleanup is
 * handled by the caller (error or not)
 */
static int
mkrq_idmap_ux2sid(
        idmap_get_handle_t *idmap_gh,
        struct mapinfo2sid *mip,
        uid_t   uid, /* or gid */
        int req_type)
{
        idmap_stat      idms;

        switch (req_type) {

        case IDM_TYPE_USER:
                if (uid == (uid_t)-1)
                        return (EINVAL);
                idms = I_getsidbyuid(idmap_gh, uid,
                    &mip->mi_dsid, &mip->mi_rid, &mip->mi_status);
                break;

        case IDM_TYPE_GROUP:
                if (uid == (uid_t)-1)
                        return (EINVAL);
                idms = I_getsidbygid(idmap_gh, uid,
                    &mip->mi_dsid, &mip->mi_rid, &mip->mi_status);
                break;

        case IDM_EVERYONE:
                mip->mi_dsid = "S-1-1";
                mip->mi_rid = 0;
                mip->mi_status = 0;
                idms = IDMAP_SUCCESS;
                break;

        default:
                idms = IDMAP_ERR_OTHER;
                break;
        }

        if (idms != IDMAP_SUCCESS)
                return (EINVAL);

        return (0);
}

/*
 * Convert a ZFS ACE to an NT ACE.
 * ACE type was already validated.
 */
static int
zace2ntace(i_ntace_t **ntacep, ace_t *zacep, struct mapinfo2sid *mip)
{
        const struct zaf2naf *znaf;
        uint8_t aflags;
        uint16_t alloc_size;
        uint32_t rights;
        i_ntace_t *ntace = NULL;
        i_ntsid_t *sid = NULL;
        int error;

        if (mip->mi_dsid == NULL || mip->mi_status != 0) {
                return (EINVAL);
        }

        /*
         * Translate ZFS ACE flags to NT ACE flags.
         */
        aflags = 0;
        for (znaf = smbfs_zaf2naf; znaf->za_flag; znaf++)
                if (zacep->a_flags & znaf->za_flag)
                        aflags |= znaf->na_flag;

        /*
         * The access rights bits are OK as-is.
         */
        rights = zacep->a_access_mask;

        /*
         * Make sure we can get the SID.
         * Note: allocates sid.
         */
        error = smbfs_str2sid(mip->mi_dsid, &mip->mi_rid, &sid);
        if (error)
                return (error);

        /*
         * Allocate the NT ACE and fill it in.
         */
        alloc_size = sizeof (i_ntace_v2_t);
        if ((ntace = MALLOC(alloc_size)) == NULL) {
                ifree_sid(sid);
                return (ENOMEM);
        }
        bzero(ntace, alloc_size);

        ntace->ace_hdr.ace_type = zacep->a_type;
        ntace->ace_hdr.ace_flags = aflags;
        ntace->ace_hdr.ace_size = alloc_size;
        ntace->ace_v2.ace_rights = rights;
        ntace->ace_v2.ace_sid = sid;

        *ntacep = ntace;
        return (0);
}

/*
 * Convert a ZFS-style ACL to an internal SD.
 * Set owner/group too if selector indicates.
 * Always need to pass uid+gid, either the new
 * (when setting them) or existing, so that any
 * owner@ or group@ ACEs can be translated.
 *
 * This makes two passes over the ZFS ACL.  The first builds a
 * "batch" request for idmap with results in mapinfo, and the
 * second builds the NT SD using the idmap SID results.
 */
int
smbfs_acl_zfs2sd(
#if defined(_KERNEL) || defined(_FAKE_KERNEL)
        vsecattr_t *acl_info,
#else /* _KERNEL */
        acl_t *acl_info,
#endif /* _KERNEL */
        uid_t own_uid,
        gid_t own_gid,
        uint32_t selector,
        i_ntsd_t **sdp)
{
        struct mapinfo2sid *mip, *mip_acl, *mapinfo = NULL;
        int aclsz, error, i, mapcnt;
        int dacl_acecnt = 0;
        int sacl_acecnt = 0;
        int zacecnt = 0;
        ace_t *zacevec = NULL;
        ace_t *zacep;
        i_ntsd_t *sd = NULL;
        i_ntacl_t *acl = NULL;
        i_ntace_t **acep = NULL;
        idmap_get_handle_t *idmap_gh = NULL;
        idmap_stat      idms;

        /*
         * First, get all the UID+GID to SID mappings.
         * How many?  Also sanity checks.
         */
        mapcnt = 0;
        if (selector & OWNER_SECURITY_INFORMATION) {
                if (own_uid == (uid_t)-1)
                        return (EINVAL);
                mapcnt++;
        }
        if (selector & GROUP_SECURITY_INFORMATION) {
                if (own_gid == (gid_t)-1)
                        return (EINVAL);
                mapcnt++;
        }
        if (selector & (DACL_SECURITY_INFORMATION |
            SACL_SECURITY_INFORMATION)) {
                if (acl_info == NULL)
                        return (EINVAL);
                if (own_uid == (uid_t)-1)
                        return (EINVAL);
                if (own_gid == (gid_t)-1)
                        return (EINVAL);
#if defined(_KERNEL) || defined(_FAKE_KERNEL)
                if ((acl_info->vsa_mask & VSA_ACE) == 0)
                        return (EINVAL);
                zacecnt = acl_info->vsa_aclcnt;
                zacevec = acl_info->vsa_aclentp;
#else   /* _KERNEL */
                if (acl_info->acl_type != ACE_T ||
                    acl_info->acl_entry_size != sizeof (ace_t))
                        return (EINVAL);
                zacecnt = acl_info->acl_cnt;
                zacevec = acl_info->acl_aclp;
#endif  /* _KERNEL */
                if (zacecnt == 0 || zacevec == NULL)
                        return (EINVAL);
                mapcnt += zacecnt;
        }
        if (mapcnt == 0)
                return (EINVAL);
        mapinfo = MALLOC(mapcnt * sizeof (*mapinfo));
        if (mapinfo == NULL)
                return (ENOMEM);
        bzero(mapinfo, mapcnt * sizeof (*mapinfo));
        /* no more returns until errout */

        /*
         * Get an imap "batch" request handle.
         */
#ifdef  _KERNEL
        idmap_gh = kidmap_get_create(curproc->p_zone);
#else /* _KERNEL */
        idms = idmap_get_create(&idmap_gh);
        if (idms != IDMAP_SUCCESS) {
                error = ENOTACTIVE;
                goto errout;
        }
#endif /* _KERNEL */

        /*
         * Build our request to the idmap deamon,
         * getting SIDs for every Unix UID/GID.
         * Also count DACL and SACL ACEs here.
         */
        mip = mapinfo;
        if (selector & OWNER_SECURITY_INFORMATION) {
                error = mkrq_idmap_ux2sid(idmap_gh, mip,
                    own_uid, IDM_TYPE_USER);
                if (error)
                        goto errout;
                mip++;
        }
        if (selector & GROUP_SECURITY_INFORMATION) {
                error = mkrq_idmap_ux2sid(idmap_gh, mip,
                    own_gid, IDM_TYPE_GROUP);
                if (error)
                        goto errout;
                mip++;
        }
        if (selector & (DACL_SECURITY_INFORMATION |
            SACL_SECURITY_INFORMATION)) {
                int rqtype;
                uid_t uid;

                zacep = zacevec;
                for (i = 0; i < zacecnt; i++) {

                        switch (zacep->a_type) {
                        case ACE_ACCESS_ALLOWED_ACE_TYPE:
                        case ACE_ACCESS_DENIED_ACE_TYPE:
                                dacl_acecnt++;
                                break;
                        case ACE_SYSTEM_AUDIT_ACE_TYPE:
                        case ACE_SYSTEM_ALARM_ACE_TYPE:
                                sacl_acecnt++;
                                break;
                        /* other types todo */
                        }

                        if (zacep->a_flags & ACE_EVERYONE) {
                                rqtype = IDM_EVERYONE;
                                uid = (uid_t)-1;
                        } else if (zacep->a_flags & ACE_GROUP) {
                                /* owning group (a_who = -1) */
                                rqtype = IDM_TYPE_GROUP;
                                uid = (uid_t)own_gid;
                        } else if (zacep->a_flags & ACE_OWNER) {
                                /* owning user (a_who = -1) */
                                rqtype = IDM_TYPE_USER;
                                uid = (uid_t)own_uid;
                        } else if (zacep->a_flags & ACE_IDENTIFIER_GROUP) {
                                /* regular group */
                                rqtype = IDM_TYPE_GROUP;
                                uid = zacep->a_who;
                        } else {
                                rqtype = IDM_TYPE_USER;
                                uid = zacep->a_who;
                        }

                        error = mkrq_idmap_ux2sid(idmap_gh, mip, uid, rqtype);
                        if (error)
                                goto errout;
                        zacep++;
                        mip++;
                }
        }

        idms = I_getmappings(idmap_gh);
        if (idms != IDMAP_SUCCESS) {
                /* creative error choice */
                error = EIDRM;
                goto errout;
        }

        /*
         * With any luck, we now have a Windows SID for
         * every Unix UID or GID in the NFS/ZFS ACL.
         * The remaining work is just format conversion,
         * memory allocation, etc.
         */
        if ((sd = MALLOC(sizeof (*sd))) == NULL) {
                error = ENOMEM;
                goto errout;
        }
        bzero(sd, sizeof (*sd));
        sd->sd_revision = NT_SD_REVISION;

        mip = mapinfo;
        if (selector & OWNER_SECURITY_INFORMATION) {
                error = smbfs_str2sid(mip->mi_dsid, &mip->mi_rid,
                    &sd->sd_owner);
                mip++;
        }
        if (selector & GROUP_SECURITY_INFORMATION) {
                error = smbfs_str2sid(mip->mi_dsid, &mip->mi_rid,
                    &sd->sd_group);
                mip++;
        }

        /*
         * If setting both DACL and SACL, we will
         * make two passes starting here in mapinfo.
         */
        mip_acl = mip;

        if (selector & DACL_SECURITY_INFORMATION) {
                /*
                 * Caller wants to set the DACL.
                 */
                aclsz = I_ACL_SIZE(dacl_acecnt);
                if ((acl = MALLOC(aclsz)) == NULL) {
                        error = ENOMEM;
                        goto errout;
                }
                bzero(acl, aclsz);

                acl->acl_revision = NT_ACL_REVISION;
                acl->acl_acecount = (uint16_t)dacl_acecnt;
                acep = &acl->acl_acevec[0];

                /* 1st pass - scan for DACL ACE types. */
                mip = mip_acl;
                zacep = zacevec;
                for (i = 0; i < zacecnt; i++) {

                        switch (zacep->a_type) {
                        case ACE_ACCESS_ALLOWED_ACE_TYPE:
                        case ACE_ACCESS_DENIED_ACE_TYPE:
                                error = zace2ntace(acep, zacep, mip);
                                if (error != 0)
                                        goto errout;
                                acep++;
                                break;

                        case ACE_SYSTEM_AUDIT_ACE_TYPE:
                        case ACE_SYSTEM_ALARM_ACE_TYPE:
                                break;
                        /* other types todo */
                        }
                        zacep++;
                        mip++;
                }
                sd->sd_dacl = acl;
                acl = NULL;
                sd->sd_flags |= SD_DACL_PRESENT;
        }

        if (selector & SACL_SECURITY_INFORMATION) {
                /*
                 * Caller wants to set the SACL.
                 */
                aclsz = I_ACL_SIZE(sacl_acecnt);
                if ((acl = MALLOC(aclsz)) == NULL) {
                        error = ENOMEM;
                        goto errout;
                }
                bzero(acl, aclsz);

                acl->acl_revision = NT_ACL_REVISION;
                acl->acl_acecount = (uint16_t)sacl_acecnt;
                acep = &acl->acl_acevec[0];

                /* 2nd pass - scan for SACL ACE types. */
                mip = mip_acl;
                zacep = zacevec;
                for (i = 0; i < zacecnt; i++) {

                        switch (zacep->a_type) {
                        case ACE_ACCESS_ALLOWED_ACE_TYPE:
                        case ACE_ACCESS_DENIED_ACE_TYPE:
                                break;

                        case ACE_SYSTEM_AUDIT_ACE_TYPE:
                        case ACE_SYSTEM_ALARM_ACE_TYPE:
                                error = zace2ntace(acep, zacep, mip);
                                if (error != 0)
                                        goto errout;
                                acep++;
                                break;
                        /* other types todo */
                        }
                        zacep++;
                        mip++;
                }
                sd->sd_sacl = acl;
                acl = NULL;
                sd->sd_flags |= SD_SACL_PRESENT;
        }

        *sdp = sd;
        error = 0;

errout:
        if (error != 0) {
                if (acl != NULL)
                        ifree_acl(acl);
                if (sd != NULL)
                        smbfs_acl_free_sd(sd);
        }
        if (mapinfo != NULL)
                FREESZ(mapinfo, mapcnt * sizeof (*mapinfo));
#ifdef  _KERNEL
        if (idmap_gh != NULL)
                kidmap_get_destroy(idmap_gh);
#else /* _KERNEL */
        if (idmap_gh != NULL)
                idmap_get_destroy(idmap_gh);
#endif /* _KERNEL */

        return (error);
}