2 Unix SMB/CIFS implementation.
4 Winbind cache backend functions
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 struct winbind_cache
{
37 uint32 sequence_number
;
42 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
44 static struct winbind_cache
*wcache
;
47 void wcache_flush_cache(void)
49 extern BOOL opt_nocache
;
54 tdb_close(wcache
->tdb
);
60 wcache
->tdb
= tdb_open_log(lock_path("winbindd_cache.tdb"), 5000,
61 TDB_CLEAR_IF_FIRST
, O_RDWR
|O_CREAT
, 0600);
64 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
66 DEBUG(10,("wcache_flush_cache success\n"));
69 void winbindd_check_cache_size(time_t t
)
71 static time_t last_check_time
;
74 if (last_check_time
== (time_t)0)
77 if (t
- last_check_time
< 60 && t
- last_check_time
> 0)
80 if (wcache
== NULL
|| wcache
->tdb
== NULL
) {
81 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
85 if (fstat(wcache
->tdb
->fd
, &st
) == -1) {
86 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno
) ));
90 if (st
.st_size
> WINBINDD_MAX_CACHE_SIZE
) {
91 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
92 (unsigned long)st
.st_size
,
93 (unsigned long)WINBINDD_MAX_CACHE_SIZE
));
98 /* get the winbind_cache structure */
99 static struct winbind_cache
*get_cache(struct winbindd_domain
*domain
)
101 struct winbind_cache
*ret
= wcache
;
103 if (!domain
->backend
) {
104 extern struct winbindd_methods msrpc_methods
;
105 switch (lp_security()) {
108 extern struct winbindd_methods ads_methods
;
109 /* always obey the lp_security parameter for our domain */
110 if (domain
->primary
) {
111 domain
->backend
= &ads_methods
;
115 /* only use ADS for native modes at the momment.
116 The problem is the correct detection of mixed
117 mode domains from NT4 BDC's --jerry */
119 if ( domain
->native_mode
) {
120 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n",
122 domain
->backend
= &ads_methods
;
130 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n",
132 domain
->backend
= &msrpc_methods
;
139 ret
= smb_xmalloc(sizeof(*ret
));
143 wcache_flush_cache();
149 free a centry structure
151 static void centry_free(struct cache_entry
*centry
)
155 SAFE_FREE(centry
->data
);
160 pull a uint32 from a cache entry
162 static uint32
centry_uint32(struct cache_entry
*centry
)
165 if (centry
->len
- centry
->ofs
< 4) {
166 DEBUG(0,("centry corruption? needed 4 bytes, have %d\n",
167 centry
->len
- centry
->ofs
));
168 smb_panic("centry_uint32");
170 ret
= IVAL(centry
->data
, centry
->ofs
);
176 pull a uint8 from a cache entry
178 static uint8
centry_uint8(struct cache_entry
*centry
)
181 if (centry
->len
- centry
->ofs
< 1) {
182 DEBUG(0,("centry corruption? needed 1 bytes, have %d\n",
183 centry
->len
- centry
->ofs
));
184 smb_panic("centry_uint32");
186 ret
= CVAL(centry
->data
, centry
->ofs
);
191 /* pull a string from a cache entry, using the supplied
194 static char *centry_string(struct cache_entry
*centry
, TALLOC_CTX
*mem_ctx
)
199 len
= centry_uint8(centry
);
202 /* a deliberate NULL string */
206 if (centry
->len
- centry
->ofs
< len
) {
207 DEBUG(0,("centry corruption? needed %d bytes, have %d\n",
208 len
, centry
->len
- centry
->ofs
));
209 smb_panic("centry_string");
212 ret
= talloc(mem_ctx
, len
+1);
214 smb_panic("centry_string out of memory\n");
216 memcpy(ret
,centry
->data
+ centry
->ofs
, len
);
222 /* pull a string from a cache entry, using the supplied
225 static DOM_SID
*centry_sid(struct cache_entry
*centry
, TALLOC_CTX
*mem_ctx
)
230 sid
= talloc(mem_ctx
, sizeof(*sid
));
234 sid_string
= centry_string(centry
, mem_ctx
);
235 if (!string_to_sid(sid
, sid_string
)) {
241 /* the server is considered down if it can't give us a sequence number */
242 static BOOL
wcache_server_down(struct winbindd_domain
*domain
)
249 ret
= (domain
->sequence_number
== DOM_SEQUENCE_NONE
);
252 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
257 static NTSTATUS
fetch_cache_seqnum( struct winbindd_domain
*domain
, time_t now
)
264 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
265 return NT_STATUS_UNSUCCESSFUL
;
268 fstr_sprintf( key
, "SEQNUM/%s", domain
->name
);
270 data
= tdb_fetch_bystring( wcache
->tdb
, key
);
271 if ( !data
.dptr
|| data
.dsize
!=8 ) {
272 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key
));
273 return NT_STATUS_UNSUCCESSFUL
;
276 domain
->sequence_number
= IVAL(data
.dptr
, 0);
277 domain
->last_seq_check
= IVAL(data
.dptr
, 4);
279 SAFE_FREE(data
.dptr
);
281 /* have we expired? */
283 time_diff
= now
- domain
->last_seq_check
;
284 if ( time_diff
> lp_winbind_cache_time() ) {
285 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
286 domain
->name
, domain
->sequence_number
,
287 (uint32
)domain
->last_seq_check
));
288 return NT_STATUS_UNSUCCESSFUL
;
291 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
292 domain
->name
, domain
->sequence_number
,
293 (uint32
)domain
->last_seq_check
));
298 static NTSTATUS
store_cache_seqnum( struct winbindd_domain
*domain
)
305 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
306 return NT_STATUS_UNSUCCESSFUL
;
309 fstr_sprintf( key_str
, "SEQNUM/%s", domain
->name
);
311 key
.dsize
= strlen(key_str
)+1;
313 SIVAL(buf
, 0, domain
->sequence_number
);
314 SIVAL(buf
, 4, domain
->last_seq_check
);
318 if ( tdb_store( wcache
->tdb
, key
, data
, TDB_REPLACE
) == -1 ) {
319 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str
));
320 return NT_STATUS_UNSUCCESSFUL
;
323 DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
324 domain
->name
, domain
->sequence_number
,
325 (uint32
)domain
->last_seq_check
));
331 refresh the domain sequence number. If force is True
332 then always refresh it, no matter how recently we fetched it
335 static void refresh_sequence_number(struct winbindd_domain
*domain
, BOOL force
)
339 time_t t
= time(NULL
);
340 unsigned cache_time
= lp_winbind_cache_time();
344 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
345 /* trying to reconnect is expensive, don't do it too often */
346 if (domain
->sequence_number
== DOM_SEQUENCE_NONE
) {
351 time_diff
= t
- domain
->last_seq_check
;
353 /* see if we have to refetch the domain sequence number */
354 if (!force
&& (time_diff
< cache_time
)) {
355 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain
->name
));
359 /* try to get the sequence number from the tdb cache first */
360 /* this will update the timestamp as well */
362 status
= fetch_cache_seqnum( domain
, t
);
363 if ( NT_STATUS_IS_OK(status
) )
366 /* important! make sure that we know if this is a native
367 mode domain or not */
369 if ( !domain
->initialized
)
370 set_dc_type_and_flags( domain
);
372 status
= domain
->backend
->sequence_number(domain
, &domain
->sequence_number
);
374 if (!NT_STATUS_IS_OK(status
)) {
375 domain
->sequence_number
= DOM_SEQUENCE_NONE
;
378 domain
->last_status
= status
;
379 domain
->last_seq_check
= time(NULL
);
381 /* save the new sequence number ni the cache */
382 store_cache_seqnum( domain
);
385 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
386 domain
->name
, domain
->sequence_number
));
392 decide if a cache entry has expired
394 static BOOL
centry_expired(struct winbindd_domain
*domain
, const char *keystr
, struct cache_entry
*centry
)
396 /* if the server is OK and our cache entry came from when it was down then
397 the entry is invalid */
398 if (domain
->sequence_number
!= DOM_SEQUENCE_NONE
&&
399 centry
->sequence_number
== DOM_SEQUENCE_NONE
) {
400 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
401 keystr
, domain
->name
));
405 /* if the server is down or the cache entry is not older than the
406 current sequence number then it is OK */
407 if (wcache_server_down(domain
) ||
408 centry
->sequence_number
== domain
->sequence_number
) {
409 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
410 keystr
, domain
->name
));
414 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
415 keystr
, domain
->name
));
422 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
423 number and return status
425 static struct cache_entry
*wcache_fetch(struct winbind_cache
*cache
,
426 struct winbindd_domain
*domain
,
427 const char *format
, ...) PRINTF_ATTRIBUTE(3,4);
428 static struct cache_entry
*wcache_fetch(struct winbind_cache
*cache
,
429 struct winbindd_domain
*domain
,
430 const char *format
, ...)
435 struct cache_entry
*centry
;
438 refresh_sequence_number(domain
, False
);
440 va_start(ap
, format
);
441 smb_xvasprintf(&kstr
, format
, ap
);
445 key
.dsize
= strlen(kstr
);
446 data
= tdb_fetch(wcache
->tdb
, key
);
453 centry
= smb_xmalloc(sizeof(*centry
));
454 centry
->data
= (unsigned char *)data
.dptr
;
455 centry
->len
= data
.dsize
;
458 if (centry
->len
< 8) {
459 /* huh? corrupt cache? */
460 DEBUG(10,("wcache_fetch: Corrupt cache for key %s domain %s (len < 8) ?\n",
461 kstr
, domain
->name
));
467 centry
->status
= NT_STATUS(centry_uint32(centry
));
468 centry
->sequence_number
= centry_uint32(centry
);
470 if (centry_expired(domain
, kstr
, centry
)) {
471 extern BOOL opt_dual_daemon
;
473 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
474 kstr
, domain
->name
));
476 if (opt_dual_daemon
) {
477 extern BOOL background_process
;
478 background_process
= True
;
479 DEBUG(10,("wcache_fetch: background processing expired entry %s for domain %s\n",
480 kstr
, domain
->name
));
488 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
489 kstr
, domain
->name
));
496 make sure we have at least len bytes available in a centry
498 static void centry_expand(struct cache_entry
*centry
, uint32 len
)
501 if (centry
->len
- centry
->ofs
>= len
)
504 p
= realloc(centry
->data
, centry
->len
);
506 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry
->len
));
507 smb_panic("out of memory in centry_expand");
513 push a uint32 into a centry
515 static void centry_put_uint32(struct cache_entry
*centry
, uint32 v
)
517 centry_expand(centry
, 4);
518 SIVAL(centry
->data
, centry
->ofs
, v
);
523 push a uint8 into a centry
525 static void centry_put_uint8(struct cache_entry
*centry
, uint8 v
)
527 centry_expand(centry
, 1);
528 SCVAL(centry
->data
, centry
->ofs
, v
);
533 push a string into a centry
535 static void centry_put_string(struct cache_entry
*centry
, const char *s
)
540 /* null strings are marked as len 0xFFFF */
541 centry_put_uint8(centry
, 0xFF);
546 /* can't handle more than 254 char strings. Truncating is probably best */
549 centry_put_uint8(centry
, len
);
550 centry_expand(centry
, len
);
551 memcpy(centry
->data
+ centry
->ofs
, s
, len
);
555 static void centry_put_sid(struct cache_entry
*centry
, const DOM_SID
*sid
)
558 centry_put_string(centry
, sid_to_string(sid_string
, sid
));
562 start a centry for output. When finished, call centry_end()
564 struct cache_entry
*centry_start(struct winbindd_domain
*domain
, NTSTATUS status
)
566 struct cache_entry
*centry
;
571 centry
= smb_xmalloc(sizeof(*centry
));
573 centry
->len
= 8192; /* reasonable default */
574 centry
->data
= smb_xmalloc(centry
->len
);
576 centry
->sequence_number
= domain
->sequence_number
;
577 centry_put_uint32(centry
, NT_STATUS_V(status
));
578 centry_put_uint32(centry
, centry
->sequence_number
);
583 finish a centry and write it to the tdb
585 static void centry_end(struct cache_entry
*centry
, const char *format
, ...) PRINTF_ATTRIBUTE(2,3);
586 static void centry_end(struct cache_entry
*centry
, const char *format
, ...)
592 va_start(ap
, format
);
593 smb_xvasprintf(&kstr
, format
, ap
);
597 key
.dsize
= strlen(kstr
);
598 data
.dptr
= (char *)centry
->data
;
599 data
.dsize
= centry
->ofs
;
601 tdb_store(wcache
->tdb
, key
, data
, TDB_REPLACE
);
605 static void wcache_save_name_to_sid(struct winbindd_domain
*domain
,
606 NTSTATUS status
, const char *domain_name
,
607 const char *name
, const DOM_SID
*sid
,
608 enum SID_NAME_USE type
)
610 struct cache_entry
*centry
;
614 centry
= centry_start(domain
, status
);
617 centry_put_uint32(centry
, type
);
618 centry_put_sid(centry
, sid
);
619 fstrcpy(uname
, name
);
621 centry_end(centry
, "NS/%s/%s", domain_name
, uname
);
622 DEBUG(10,("wcache_save_name_to_sid: %s -> %s\n", uname
, sid_string
));
626 static void wcache_save_sid_to_name(struct winbindd_domain
*domain
, NTSTATUS status
,
627 const DOM_SID
*sid
, const char *domain_name
, const char *name
, enum SID_NAME_USE type
)
629 struct cache_entry
*centry
;
632 centry
= centry_start(domain
, status
);
635 if (NT_STATUS_IS_OK(status
)) {
636 centry_put_uint32(centry
, type
);
637 centry_put_string(centry
, domain_name
);
638 centry_put_string(centry
, name
);
640 centry_end(centry
, "SN/%s", sid_to_string(sid_string
, sid
));
641 DEBUG(10,("wcache_save_sid_to_name: %s -> %s\n", sid_string
, name
));
646 static void wcache_save_user(struct winbindd_domain
*domain
, NTSTATUS status
, WINBIND_USERINFO
*info
)
648 struct cache_entry
*centry
;
651 centry
= centry_start(domain
, status
);
654 centry_put_string(centry
, info
->acct_name
);
655 centry_put_string(centry
, info
->full_name
);
656 centry_put_sid(centry
, info
->user_sid
);
657 centry_put_sid(centry
, info
->group_sid
);
658 centry_end(centry
, "U/%s", sid_to_string(sid_string
, info
->user_sid
));
659 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string
, info
->acct_name
));
664 /* Query display info. This is the basic user list fn */
665 static NTSTATUS
query_user_list(struct winbindd_domain
*domain
,
668 WINBIND_USERINFO
**info
)
670 struct winbind_cache
*cache
= get_cache(domain
);
671 struct cache_entry
*centry
= NULL
;
673 unsigned int i
, retry
;
678 centry
= wcache_fetch(cache
, domain
, "UL/%s", domain
->name
);
682 *num_entries
= centry_uint32(centry
);
684 if (*num_entries
== 0)
687 (*info
) = talloc(mem_ctx
, sizeof(**info
) * (*num_entries
));
689 smb_panic("query_user_list out of memory");
690 for (i
=0; i
<(*num_entries
); i
++) {
691 (*info
)[i
].acct_name
= centry_string(centry
, mem_ctx
);
692 (*info
)[i
].full_name
= centry_string(centry
, mem_ctx
);
693 (*info
)[i
].user_sid
= centry_sid(centry
, mem_ctx
);
694 (*info
)[i
].group_sid
= centry_sid(centry
, mem_ctx
);
698 status
= centry
->status
;
700 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status %s\n",
701 domain
->name
, get_friendly_nt_error_msg(status
) ));
710 /* Return status value returned by seq number check */
712 if (!NT_STATUS_IS_OK(domain
->last_status
))
713 return domain
->last_status
;
715 /* Put the query_user_list() in a retry loop. There appears to be
716 * some bug either with Windows 2000 or Samba's handling of large
717 * rpc replies. This manifests itself as sudden disconnection
718 * at a random point in the enumeration of a large (60k) user list.
719 * The retry loop simply tries the operation again. )-: It's not
720 * pretty but an acceptable workaround until we work out what the
721 * real problem is. */
726 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
729 status
= domain
->backend
->query_user_list(domain
, mem_ctx
, num_entries
, info
);
730 if (!NT_STATUS_IS_OK(status
))
731 DEBUG(3, ("query_user_list: returned 0x%08x, retrying\n", NT_STATUS_V(status
)));
732 if (NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL
)) {
733 DEBUG(3, ("query_user_list: flushing connection cache\n"));
737 } while (NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL
) &&
741 refresh_sequence_number(domain
, False
);
742 centry
= centry_start(domain
, status
);
745 centry_put_uint32(centry
, *num_entries
);
746 for (i
=0; i
<(*num_entries
); i
++) {
747 centry_put_string(centry
, (*info
)[i
].acct_name
);
748 centry_put_string(centry
, (*info
)[i
].full_name
);
749 centry_put_sid(centry
, (*info
)[i
].user_sid
);
750 centry_put_sid(centry
, (*info
)[i
].group_sid
);
751 if (domain
->backend
->consistent
) {
752 /* when the backend is consistent we can pre-prime some mappings */
753 wcache_save_name_to_sid(domain
, NT_STATUS_OK
,
754 (*info
)[i
].acct_name
,
758 wcache_save_sid_to_name(domain
, NT_STATUS_OK
,
761 (*info
)[i
].acct_name
,
763 wcache_save_user(domain
, NT_STATUS_OK
, &(*info
)[i
]);
766 centry_end(centry
, "UL/%s", domain
->name
);
773 /* list all domain groups */
774 static NTSTATUS
enum_dom_groups(struct winbindd_domain
*domain
,
777 struct acct_info
**info
)
779 struct winbind_cache
*cache
= get_cache(domain
);
780 struct cache_entry
*centry
= NULL
;
787 centry
= wcache_fetch(cache
, domain
, "GL/%s/domain", domain
->name
);
791 *num_entries
= centry_uint32(centry
);
793 if (*num_entries
== 0)
796 (*info
) = talloc(mem_ctx
, sizeof(**info
) * (*num_entries
));
798 smb_panic("enum_dom_groups out of memory");
799 for (i
=0; i
<(*num_entries
); i
++) {
800 fstrcpy((*info
)[i
].acct_name
, centry_string(centry
, mem_ctx
));
801 fstrcpy((*info
)[i
].acct_desc
, centry_string(centry
, mem_ctx
));
802 (*info
)[i
].rid
= centry_uint32(centry
);
806 status
= centry
->status
;
808 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status %s\n",
809 domain
->name
, get_friendly_nt_error_msg(status
) ));
818 /* Return status value returned by seq number check */
820 if (!NT_STATUS_IS_OK(domain
->last_status
))
821 return domain
->last_status
;
823 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
826 status
= domain
->backend
->enum_dom_groups(domain
, mem_ctx
, num_entries
, info
);
829 refresh_sequence_number(domain
, False
);
830 centry
= centry_start(domain
, status
);
833 centry_put_uint32(centry
, *num_entries
);
834 for (i
=0; i
<(*num_entries
); i
++) {
835 centry_put_string(centry
, (*info
)[i
].acct_name
);
836 centry_put_string(centry
, (*info
)[i
].acct_desc
);
837 centry_put_uint32(centry
, (*info
)[i
].rid
);
839 centry_end(centry
, "GL/%s/domain", domain
->name
);
846 /* list all domain groups */
847 static NTSTATUS
enum_local_groups(struct winbindd_domain
*domain
,
850 struct acct_info
**info
)
852 struct winbind_cache
*cache
= get_cache(domain
);
853 struct cache_entry
*centry
= NULL
;
860 centry
= wcache_fetch(cache
, domain
, "GL/%s/local", domain
->name
);
864 *num_entries
= centry_uint32(centry
);
866 if (*num_entries
== 0)
869 (*info
) = talloc(mem_ctx
, sizeof(**info
) * (*num_entries
));
871 smb_panic("enum_dom_groups out of memory");
872 for (i
=0; i
<(*num_entries
); i
++) {
873 fstrcpy((*info
)[i
].acct_name
, centry_string(centry
, mem_ctx
));
874 fstrcpy((*info
)[i
].acct_desc
, centry_string(centry
, mem_ctx
));
875 (*info
)[i
].rid
= centry_uint32(centry
);
880 /* If we are returning cached data and the domain controller
881 is down then we don't know whether the data is up to date
882 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
885 if (wcache_server_down(domain
)) {
886 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
887 status
= NT_STATUS_MORE_PROCESSING_REQUIRED
;
889 status
= centry
->status
;
891 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status %s\n",
892 domain
->name
, get_friendly_nt_error_msg(status
) ));
901 /* Return status value returned by seq number check */
903 if (!NT_STATUS_IS_OK(domain
->last_status
))
904 return domain
->last_status
;
906 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
909 status
= domain
->backend
->enum_local_groups(domain
, mem_ctx
, num_entries
, info
);
912 refresh_sequence_number(domain
, False
);
913 centry
= centry_start(domain
, status
);
916 centry_put_uint32(centry
, *num_entries
);
917 for (i
=0; i
<(*num_entries
); i
++) {
918 centry_put_string(centry
, (*info
)[i
].acct_name
);
919 centry_put_string(centry
, (*info
)[i
].acct_desc
);
920 centry_put_uint32(centry
, (*info
)[i
].rid
);
922 centry_end(centry
, "GL/%s/local", domain
->name
);
929 /* convert a single name to a sid in a domain */
930 static NTSTATUS
name_to_sid(struct winbindd_domain
*domain
,
932 const char *domain_name
,
935 enum SID_NAME_USE
*type
)
937 struct winbind_cache
*cache
= get_cache(domain
);
938 struct cache_entry
*centry
= NULL
;
946 fstrcpy(uname
, name
);
948 centry
= wcache_fetch(cache
, domain
, "NS/%s/%s", domain_name
, uname
);
951 *type
= (enum SID_NAME_USE
)centry_uint32(centry
);
952 sid2
= centry_sid(centry
, mem_ctx
);
959 status
= centry
->status
;
961 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status %s\n",
962 domain
->name
, get_friendly_nt_error_msg(status
) ));
970 /* If the seq number check indicated that there is a problem
971 * with this DC, then return that status... except for
972 * access_denied. This is special because the dc may be in
973 * "restrict anonymous = 1" mode, in which case it will deny
974 * most unauthenticated operations, but *will* allow the LSA
975 * name-to-sid that we try as a fallback. */
977 if (!(NT_STATUS_IS_OK(domain
->last_status
)
978 || NT_STATUS_EQUAL(domain
->last_status
, NT_STATUS_ACCESS_DENIED
)))
979 return domain
->last_status
;
981 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
984 status
= domain
->backend
->name_to_sid(domain
, mem_ctx
, domain_name
, name
, sid
, type
);
987 wcache_save_name_to_sid(domain
, status
, domain_name
, name
, sid
, *type
);
989 /* We can't save the sid to name mapping as we don't know the
990 correct case of the name without looking it up */
995 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
997 static NTSTATUS
sid_to_name(struct winbindd_domain
*domain
,
1002 enum SID_NAME_USE
*type
)
1004 struct winbind_cache
*cache
= get_cache(domain
);
1005 struct cache_entry
*centry
= NULL
;
1012 centry
= wcache_fetch(cache
, domain
, "SN/%s", sid_to_string(sid_string
, sid
));
1015 if (NT_STATUS_IS_OK(centry
->status
)) {
1016 *type
= (enum SID_NAME_USE
)centry_uint32(centry
);
1017 *domain_name
= centry_string(centry
, mem_ctx
);
1018 *name
= centry_string(centry
, mem_ctx
);
1020 status
= centry
->status
;
1022 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status %s\n",
1023 domain
->name
, get_friendly_nt_error_msg(status
) ));
1025 centry_free(centry
);
1030 *domain_name
= NULL
;
1032 /* If the seq number check indicated that there is a problem
1033 * with this DC, then return that status... except for
1034 * access_denied. This is special because the dc may be in
1035 * "restrict anonymous = 1" mode, in which case it will deny
1036 * most unauthenticated operations, but *will* allow the LSA
1037 * sid-to-name that we try as a fallback. */
1039 if (!(NT_STATUS_IS_OK(domain
->last_status
)
1040 || NT_STATUS_EQUAL(domain
->last_status
, NT_STATUS_ACCESS_DENIED
)))
1041 return domain
->last_status
;
1043 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1046 status
= domain
->backend
->sid_to_name(domain
, mem_ctx
, sid
, domain_name
, name
, type
);
1049 refresh_sequence_number(domain
, False
);
1050 wcache_save_sid_to_name(domain
, status
, sid
, *domain_name
, *name
, *type
);
1052 /* We can't save the name to sid mapping here, as with sid history a
1053 * later name2sid would give the wrong sid. */
1059 /* Lookup user information from a rid */
1060 static NTSTATUS
query_user(struct winbindd_domain
*domain
,
1061 TALLOC_CTX
*mem_ctx
,
1062 const DOM_SID
*user_sid
,
1063 WINBIND_USERINFO
*info
)
1065 struct winbind_cache
*cache
= get_cache(domain
);
1066 struct cache_entry
*centry
= NULL
;
1072 centry
= wcache_fetch(cache
, domain
, "U/%s", sid_string_static(user_sid
));
1074 /* If we have an access denied cache entry and a cached info3 in the
1075 samlogon cache then do a query. This will force the rpc back end
1076 to return the info3 data. */
1078 if (NT_STATUS_V(domain
->last_status
) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED
) &&
1079 netsamlogon_cache_have(user_sid
)) {
1080 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1081 domain
->last_status
= NT_STATUS_OK
;
1082 centry_free(centry
);
1089 info
->acct_name
= centry_string(centry
, mem_ctx
);
1090 info
->full_name
= centry_string(centry
, mem_ctx
);
1091 info
->user_sid
= centry_sid(centry
, mem_ctx
);
1092 info
->group_sid
= centry_sid(centry
, mem_ctx
);
1093 status
= centry
->status
;
1095 DEBUG(10,("query_user: [Cached] - cached info for domain %s status %s\n",
1096 domain
->name
, get_friendly_nt_error_msg(status
) ));
1098 centry_free(centry
);
1104 /* Return status value returned by seq number check */
1106 if (!NT_STATUS_IS_OK(domain
->last_status
))
1107 return domain
->last_status
;
1109 DEBUG(10,("sid_to_name: [Cached] - doing backend query for info for domain %s\n",
1112 status
= domain
->backend
->query_user(domain
, mem_ctx
, user_sid
, info
);
1115 refresh_sequence_number(domain
, False
);
1116 wcache_save_user(domain
, status
, info
);
1122 /* Lookup groups a user is a member of. */
1123 static NTSTATUS
lookup_usergroups(struct winbindd_domain
*domain
,
1124 TALLOC_CTX
*mem_ctx
,
1125 const DOM_SID
*user_sid
,
1126 uint32
*num_groups
, DOM_SID
***user_gids
)
1128 struct winbind_cache
*cache
= get_cache(domain
);
1129 struct cache_entry
*centry
= NULL
;
1137 centry
= wcache_fetch(cache
, domain
, "UG/%s", sid_to_string(sid_string
, user_sid
));
1139 /* If we have an access denied cache entry and a cached info3 in the
1140 samlogon cache then do a query. This will force the rpc back end
1141 to return the info3 data. */
1143 if (NT_STATUS_V(domain
->last_status
) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED
) &&
1144 netsamlogon_cache_have(user_sid
)) {
1145 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1146 domain
->last_status
= NT_STATUS_OK
;
1147 centry_free(centry
);
1154 *num_groups
= centry_uint32(centry
);
1156 if (*num_groups
== 0)
1159 (*user_gids
) = talloc(mem_ctx
, sizeof(**user_gids
) * (*num_groups
));
1161 smb_panic("lookup_usergroups out of memory");
1162 for (i
=0; i
<(*num_groups
); i
++) {
1163 (*user_gids
)[i
] = centry_sid(centry
, mem_ctx
);
1167 status
= centry
->status
;
1169 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status %s\n",
1170 domain
->name
, get_friendly_nt_error_msg(status
) ));
1172 centry_free(centry
);
1177 (*user_gids
) = NULL
;
1179 /* Return status value returned by seq number check */
1181 if (!NT_STATUS_IS_OK(domain
->last_status
))
1182 return domain
->last_status
;
1184 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
1187 status
= domain
->backend
->lookup_usergroups(domain
, mem_ctx
, user_sid
, num_groups
, user_gids
);
1190 refresh_sequence_number(domain
, False
);
1191 centry
= centry_start(domain
, status
);
1194 centry_put_uint32(centry
, *num_groups
);
1195 for (i
=0; i
<(*num_groups
); i
++) {
1196 centry_put_sid(centry
, (*user_gids
)[i
]);
1198 centry_end(centry
, "UG/%s", sid_to_string(sid_string
, user_sid
));
1199 centry_free(centry
);
1206 static NTSTATUS
lookup_groupmem(struct winbindd_domain
*domain
,
1207 TALLOC_CTX
*mem_ctx
,
1208 const DOM_SID
*group_sid
, uint32
*num_names
,
1209 DOM_SID
***sid_mem
, char ***names
,
1210 uint32
**name_types
)
1212 struct winbind_cache
*cache
= get_cache(domain
);
1213 struct cache_entry
*centry
= NULL
;
1221 centry
= wcache_fetch(cache
, domain
, "GM/%s", sid_to_string(sid_string
, group_sid
));
1225 *num_names
= centry_uint32(centry
);
1227 if (*num_names
== 0)
1230 (*sid_mem
) = talloc(mem_ctx
, sizeof(**sid_mem
) * (*num_names
));
1231 (*names
) = talloc(mem_ctx
, sizeof(**names
) * (*num_names
));
1232 (*name_types
) = talloc(mem_ctx
, sizeof(**name_types
) * (*num_names
));
1234 if (! (*sid_mem
) || ! (*names
) || ! (*name_types
)) {
1235 smb_panic("lookup_groupmem out of memory");
1238 for (i
=0; i
<(*num_names
); i
++) {
1239 (*sid_mem
)[i
] = centry_sid(centry
, mem_ctx
);
1240 (*names
)[i
] = centry_string(centry
, mem_ctx
);
1241 (*name_types
)[i
] = centry_uint32(centry
);
1245 status
= centry
->status
;
1247 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status %s\n",
1248 domain
->name
, get_friendly_nt_error_msg(status
) ));
1250 centry_free(centry
);
1257 (*name_types
) = NULL
;
1259 /* Return status value returned by seq number check */
1261 if (!NT_STATUS_IS_OK(domain
->last_status
))
1262 return domain
->last_status
;
1264 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
1267 status
= domain
->backend
->lookup_groupmem(domain
, mem_ctx
, group_sid
, num_names
,
1268 sid_mem
, names
, name_types
);
1271 refresh_sequence_number(domain
, False
);
1272 centry
= centry_start(domain
, status
);
1275 centry_put_uint32(centry
, *num_names
);
1276 for (i
=0; i
<(*num_names
); i
++) {
1277 centry_put_sid(centry
, (*sid_mem
)[i
]);
1278 centry_put_string(centry
, (*names
)[i
]);
1279 centry_put_uint32(centry
, (*name_types
)[i
]);
1281 centry_end(centry
, "GM/%s", sid_to_string(sid_string
, group_sid
));
1282 centry_free(centry
);
1288 /* find the sequence number for a domain */
1289 static NTSTATUS
sequence_number(struct winbindd_domain
*domain
, uint32
*seq
)
1291 refresh_sequence_number(domain
, False
);
1293 *seq
= domain
->sequence_number
;
1295 return NT_STATUS_OK
;
1298 /* enumerate trusted domains */
1299 static NTSTATUS
trusted_domains(struct winbindd_domain
*domain
,
1300 TALLOC_CTX
*mem_ctx
,
1301 uint32
*num_domains
,
1308 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
1311 /* we don't cache this call */
1312 return domain
->backend
->trusted_domains(domain
, mem_ctx
, num_domains
,
1313 names
, alt_names
, dom_sids
);
1316 /* find the domain sid */
1317 static NTSTATUS
domain_sid(struct winbindd_domain
*domain
, DOM_SID
*sid
)
1321 DEBUG(10,("domain_sid: [Cached] - doing backend query for info for domain %s\n",
1324 /* we don't cache this call */
1325 return domain
->backend
->domain_sid(domain
, sid
);
1328 /* find the alternate names for the domain, if any */
1329 static NTSTATUS
alternate_name(struct winbindd_domain
*domain
)
1333 DEBUG(10,("alternate_name: [Cached] - doing backend query for info for domain %s\n",
1336 /* we don't cache this call */
1337 return domain
->backend
->alternate_name(domain
);
1340 /* Invalidate cached user and group lists coherently */
1342 static int traverse_fn(TDB_CONTEXT
*the_tdb
, TDB_DATA kbuf
, TDB_DATA dbuf
,
1345 if (strncmp(kbuf
.dptr
, "UL/", 3) == 0 ||
1346 strncmp(kbuf
.dptr
, "GL/", 3) == 0)
1347 tdb_delete(the_tdb
, kbuf
);
1352 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
1354 void wcache_invalidate_samlogon(struct winbindd_domain
*domain
,
1355 NET_USER_INFO_3
*info3
)
1357 struct winbind_cache
*cache
;
1362 cache
= get_cache(domain
);
1363 netsamlogon_clear_cached_user(cache
->tdb
, info3
);
1366 void wcache_invalidate_cache(void)
1368 struct winbindd_domain
*domain
;
1370 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1371 struct winbind_cache
*cache
= get_cache(domain
);
1373 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
1374 "entries for %s\n", domain
->name
));
1376 tdb_traverse(cache
->tdb
, traverse_fn
, NULL
);
1380 /* the ADS backend methods are exposed via this structure */
1381 struct winbindd_methods cache_methods
= {