?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Fix bug #9085.
[Samba.git] / source3 / winbindd / winbindd_cache.c
blobff4eeaa3d12ddc45817fd2a596fa08896a225fbd
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
30 #include "../librpc/gen_ndr/ndr_wbint.h"
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_WINBIND
34
35 #define WINBINDD_CACHE_VER1 1 /* initial db version */
36 #define WINBINDD_CACHE_VER2 2 /* second version with timeouts for NDR entries */
37
38 #define WINBINDD_CACHE_VERSION WINBINDD_CACHE_VER2
39 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
40
41 extern struct winbindd_methods reconnect_methods;
42 #ifdef HAVE_ADS
43 extern struct winbindd_methods ads_methods;
44 #endif
45 extern struct winbindd_methods builtin_passdb_methods;
46
47 /*
48 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
49 * Here are the list of entry types that are *not* stored
50 * as form struct cache_entry in the cache.
51 */
52
53 static const char *non_centry_keys[] = {
54 "SEQNUM/",
55 "DR/",
56 "DE/",
57 "WINBINDD_OFFLINE",
58 WINBINDD_CACHE_VERSION_KEYSTR,
59 NULL
60 };
61
62 /************************************************************************
63 Is this key a non-centry type ?
64 ************************************************************************/
65
66 static bool is_non_centry_key(TDB_DATA kbuf)
67 {
68 int i;
69
70 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
71 return false;
72 }
73 for (i = 0; non_centry_keys[i] != NULL; i++) {
74 size_t namelen = strlen(non_centry_keys[i]);
75 if (kbuf.dsize < namelen) {
76 continue;
77 }
78 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
79 return true;
80 }
81 }
82 return false;
83 }
84
85 /* Global online/offline state - False when online. winbindd starts up online
86 and sets this to true if the first query fails and there's an entry in
87 the cache tdb telling us to stay offline. */
88
89 static bool global_winbindd_offline_state;
90
91 struct winbind_cache {
92 TDB_CONTEXT *tdb;
93 };
94
95 struct cache_entry {
96 NTSTATUS status;
97 uint32 sequence_number;
98 uint64 timeout;
99 uint8 *data;
100 uint32 len, ofs;
101 };
102
103 void (*smb_panic_fn)(const char *const why) = smb_panic;
104
105 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
106
107 static struct winbind_cache *wcache;
108
109 void winbindd_check_cache_size(time_t t)
110 {
111 static time_t last_check_time;
112 struct stat st;
113
114 if (last_check_time == (time_t)0)
115 last_check_time = t;
116
117 if (t - last_check_time < 60 && t - last_check_time > 0)
118 return;
119
120 if (wcache == NULL || wcache->tdb == NULL) {
121 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
122 return;
123 }
124
125 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
126 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
127 return;
128 }
129
130 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
131 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
132 (unsigned long)st.st_size,
133 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
134 wcache_flush_cache();
135 }
136 }
137
138 /* get the winbind_cache structure */
139 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
140 {
141 struct winbind_cache *ret = wcache;
142
143 /* We have to know what type of domain we are dealing with first. */
144
145 if (domain->internal) {
146 domain->backend = &builtin_passdb_methods;
147 domain->initialized = True;
148 }
149 if ( !domain->initialized ) {
150 init_dc_connection( domain );
151 }
152
153 /*
154 OK. listen up becasue I'm only going to say this once.
155 We have the following scenarios to consider
156 (a) trusted AD domains on a Samba DC,
157 (b) trusted AD domains and we are joined to a non-kerberos domain
158 (c) trusted AD domains and we are joined to a kerberos (AD) domain
159
160 For (a) we can always contact the trusted domain using krb5
161 since we have the domain trust account password
162
163 For (b) we can only use RPC since we have no way of
164 getting a krb5 ticket in our own domain
165
166 For (c) we can always use krb5 since we have a kerberos trust
167
168 --jerry
169 */
170
171 if (!domain->backend) {
172 #ifdef HAVE_ADS
173 struct winbindd_domain *our_domain = domain;
174
175 /* find our domain first so we can figure out if we
176 are joined to a kerberized domain */
177
178 if ( !domain->primary )
179 our_domain = find_our_domain();
180
181 if ((our_domain->active_directory || IS_DC)
182 && domain->active_directory
183 && !lp_winbind_rpc_only()) {
184 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
185 domain->backend = &ads_methods;
186 } else {
187 #endif /* HAVE_ADS */
188 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
189 domain->backend = &reconnect_methods;
190 #ifdef HAVE_ADS
191 }
192 #endif /* HAVE_ADS */
193 }
194
195 if (ret)
196 return ret;
197
198 ret = SMB_XMALLOC_P(struct winbind_cache);
199 ZERO_STRUCTP(ret);
200
201 wcache = ret;
202 wcache_flush_cache();
203
204 return ret;
205 }
206
207 /*
208 free a centry structure
209 */
210 static void centry_free(struct cache_entry *centry)
211 {
212 if (!centry)
213 return;
214 SAFE_FREE(centry->data);
215 free(centry);
216 }
217
218 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
219 {
220 if (centry->len - centry->ofs < nbytes) {
221 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
222 (unsigned int)nbytes,
223 centry->len - centry->ofs));
224 return false;
225 }
226 return true;
227 }
228
229 /*
230 pull a uint64 from a cache entry
231 */
232 static uint64 centry_uint64(struct cache_entry *centry)
233 {
234 uint64 ret;
235
236 if (!centry_check_bytes(centry, 8)) {
237 smb_panic_fn("centry_uint64");
238 }
239 ret = BVAL(centry->data, centry->ofs);
240 centry->ofs += 8;
241 return ret;
242 }
243
244 /*
245 pull a uint32 from a cache entry
246 */
247 static uint32 centry_uint32(struct cache_entry *centry)
248 {
249 uint32 ret;
250
251 if (!centry_check_bytes(centry, 4)) {
252 smb_panic_fn("centry_uint32");
253 }
254 ret = IVAL(centry->data, centry->ofs);
255 centry->ofs += 4;
256 return ret;
257 }
258
259 /*
260 pull a uint16 from a cache entry
261 */
262 static uint16 centry_uint16(struct cache_entry *centry)
263 {
264 uint16 ret;
265 if (!centry_check_bytes(centry, 2)) {
266 smb_panic_fn("centry_uint16");
267 }
268 ret = SVAL(centry->data, centry->ofs);
269 centry->ofs += 2;
270 return ret;
271 }
272
273 /*
274 pull a uint8 from a cache entry
275 */
276 static uint8 centry_uint8(struct cache_entry *centry)
277 {
278 uint8 ret;
279 if (!centry_check_bytes(centry, 1)) {
280 smb_panic_fn("centry_uint8");
281 }
282 ret = CVAL(centry->data, centry->ofs);
283 centry->ofs += 1;
284 return ret;
285 }
286
287 /*
288 pull a NTTIME from a cache entry
289 */
290 static NTTIME centry_nttime(struct cache_entry *centry)
291 {
292 NTTIME ret;
293 if (!centry_check_bytes(centry, 8)) {
294 smb_panic_fn("centry_nttime");
295 }
296 ret = IVAL(centry->data, centry->ofs);
297 centry->ofs += 4;
298 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
299 centry->ofs += 4;
300 return ret;
301 }
302
303 /*
304 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
305 */
306 static time_t centry_time(struct cache_entry *centry)
307 {
308 return (time_t)centry_nttime(centry);
309 }
310
311 /* pull a string from a cache entry, using the supplied
312 talloc context
313 */
314 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
315 {
316 uint32 len;
317 char *ret;
318
319 len = centry_uint8(centry);
320
321 if (len == 0xFF) {
322 /* a deliberate NULL string */
323 return NULL;
324 }
325
326 if (!centry_check_bytes(centry, (size_t)len)) {
327 smb_panic_fn("centry_string");
328 }
329
330 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
331 if (!ret) {
332 smb_panic_fn("centry_string out of memory\n");
333 }
334 memcpy(ret,centry->data + centry->ofs, len);
335 ret[len] = 0;
336 centry->ofs += len;
337 return ret;
338 }
339
340 /* pull a hash16 from a cache entry, using the supplied
341 talloc context
342 */
343 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
344 {
345 uint32 len;
346 char *ret;
347
348 len = centry_uint8(centry);
349
350 if (len != 16) {
351 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
352 len ));
353 return NULL;
354 }
355
356 if (!centry_check_bytes(centry, 16)) {
357 return NULL;
358 }
359
360 ret = TALLOC_ARRAY(mem_ctx, char, 16);
361 if (!ret) {
362 smb_panic_fn("centry_hash out of memory\n");
363 }
364 memcpy(ret,centry->data + centry->ofs, 16);
365 centry->ofs += 16;
366 return ret;
367 }
368
369 /* pull a sid from a cache entry, using the supplied
370 talloc context
371 */
372 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
373 {
374 char *sid_string;
375 bool ret;
376
377 sid_string = centry_string(centry, talloc_tos());
378 if (sid_string == NULL) {
379 return false;
380 }
381 ret = string_to_sid(sid, sid_string);
382 TALLOC_FREE(sid_string);
383 return ret;
384 }
385
386
387 /*
388 pull a NTSTATUS from a cache entry
389 */
390 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
391 {
392 NTSTATUS status;
393
394 status = NT_STATUS(centry_uint32(centry));
395 return status;
396 }
397
398
399 /* the server is considered down if it can't give us a sequence number */
400 static bool wcache_server_down(struct winbindd_domain *domain)
401 {
402 bool ret;
403
404 if (!wcache->tdb)
405 return false;
406
407 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
408
409 if (ret)
410 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
411 domain->name ));
412 return ret;
413 }
414
415 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
416 uint32_t *last_seq_check)
417 {
418 char *key;
419 TDB_DATA data;
420
421 if (wcache->tdb == NULL) {
422 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
423 return false;
424 }
425
426 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
427 if (key == NULL) {
428 DEBUG(10, ("talloc failed\n"));
429 return false;
430 }
431
432 data = tdb_fetch_bystring(wcache->tdb, key);
433 TALLOC_FREE(key);
434
435 if (data.dptr == NULL) {
436 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
437 domain_name));
438 return false;
439 }
440 if (data.dsize != 8) {
441 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
442 (int)data.dsize));
443 SAFE_FREE(data.dptr);
444 return false;
445 }
446
447 *seqnum = IVAL(data.dptr, 0);
448 *last_seq_check = IVAL(data.dptr, 4);
449 SAFE_FREE(data.dptr);
450
451 return true;
452 }
453
454 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
455 {
456 uint32 last_check, time_diff;
457
458 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
459 &last_check)) {
460 return NT_STATUS_UNSUCCESSFUL;
461 }
462 domain->last_seq_check = last_check;
463
464 /* have we expired? */
465
466 time_diff = now - domain->last_seq_check;
467 if ( time_diff > lp_winbind_cache_time() ) {
468 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
469 domain->name, domain->sequence_number,
470 (uint32)domain->last_seq_check));
471 return NT_STATUS_UNSUCCESSFUL;
472 }
473
474 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
475 domain->name, domain->sequence_number,
476 (uint32)domain->last_seq_check));
477
478 return NT_STATUS_OK;
479 }
480
481 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
482 time_t last_seq_check)
483 {
484 char *key_str;
485 uint8_t buf[8];
486 int ret;
487
488 if (wcache->tdb == NULL) {
489 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
490 return false;
491 }
492
493 key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
494 if (key_str == NULL) {
495 DEBUG(10, ("talloc_asprintf failed\n"));
496 return false;
497 }
498
499 SIVAL(buf, 0, seqnum);
500 SIVAL(buf, 4, last_seq_check);
501
502 ret = tdb_store_bystring(wcache->tdb, key_str,
503 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
504 TALLOC_FREE(key_str);
505 if (ret == -1) {
506 DEBUG(10, ("tdb_store_bystring failed: %s\n",
507 tdb_errorstr(wcache->tdb)));
508 TALLOC_FREE(key_str);
509 return false;
510 }
511
512 DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
513 domain_name, seqnum, (unsigned)last_seq_check));
514
515 return true;
516 }
517
518 static bool store_cache_seqnum( struct winbindd_domain *domain )
519 {
520 return wcache_store_seqnum(domain->name, domain->sequence_number,
521 domain->last_seq_check);
522 }
523
524 /*
525 refresh the domain sequence number. If force is true
526 then always refresh it, no matter how recently we fetched it
527 */
528
529 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
530 {
531 NTSTATUS status;
532 unsigned time_diff;
533 time_t t = time(NULL);
534 unsigned cache_time = lp_winbind_cache_time();
535
536 if (is_domain_offline(domain)) {
537 return;
538 }
539
540 get_cache( domain );
541
542 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
543 /* trying to reconnect is expensive, don't do it too often */
544 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
545 cache_time *= 8;
546 }
547 #endif
548
549 time_diff = t - domain->last_seq_check;
550
551 /* see if we have to refetch the domain sequence number */
552 if (!force && (time_diff < cache_time) &&
553 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
554 NT_STATUS_IS_OK(domain->last_status)) {
555 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
556 goto done;
557 }
558
559 /* try to get the sequence number from the tdb cache first */
560 /* this will update the timestamp as well */
561
562 status = fetch_cache_seqnum( domain, t );
563 if (NT_STATUS_IS_OK(status) &&
564 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
565 NT_STATUS_IS_OK(domain->last_status)) {
566 goto done;
567 }
568
569 /* important! make sure that we know if this is a native
570 mode domain or not. And that we can contact it. */
571
572 if ( winbindd_can_contact_domain( domain ) ) {
573 status = domain->backend->sequence_number(domain,
574 &domain->sequence_number);
575 } else {
576 /* just use the current time */
577 status = NT_STATUS_OK;
578 domain->sequence_number = time(NULL);
579 }
580
581
582 /* the above call could have set our domain->backend to NULL when
583 * coming from offline to online mode, make sure to reinitialize the
584 * backend - Guenther */
585 get_cache( domain );
586
587 if (!NT_STATUS_IS_OK(status)) {
588 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
589 domain->sequence_number = DOM_SEQUENCE_NONE;
590 }
591
592 domain->last_status = status;
593 domain->last_seq_check = time(NULL);
594
595 /* save the new sequence number in the cache */
596 store_cache_seqnum( domain );
597
598 done:
599 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
600 domain->name, domain->sequence_number));
601
602 return;
603 }
604
605 /*
606 decide if a cache entry has expired
607 */
608 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
609 {
610 /* If we've been told to be offline - stay in that state... */
611 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
612 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
613 keystr, domain->name ));
614 return false;
615 }
616
617 /* when the domain is offline return the cached entry.
618 * This deals with transient offline states... */
619
620 if (!domain->online) {
621 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
622 keystr, domain->name ));
623 return false;
624 }
625
626 /* if the server is OK and our cache entry came from when it was down then
627 the entry is invalid */
628 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
629 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
630 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
631 keystr, domain->name ));
632 return true;
633 }
634
635 /* if the server is down or the cache entry is not older than the
636 current sequence number or it did not timeout then it is OK */
637 if (wcache_server_down(domain)
638 || (centry->sequence_number == domain->sequence_number
639 && centry->timeout > time(NULL))) {
640 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
641 keystr, domain->name ));
642 return false;
643 }
644
645 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
646 keystr, domain->name ));
647
648 /* it's expired */
649 return true;
650 }
651
652 static struct cache_entry *wcache_fetch_raw(char *kstr)
653 {
654 TDB_DATA data;
655 struct cache_entry *centry;
656 TDB_DATA key;
657
658 key = string_tdb_data(kstr);
659 data = tdb_fetch(wcache->tdb, key);
660 if (!data.dptr) {
661 /* a cache miss */
662 return NULL;
663 }
664
665 centry = SMB_XMALLOC_P(struct cache_entry);
666 centry->data = (unsigned char *)data.dptr;
667 centry->len = data.dsize;
668 centry->ofs = 0;
669
670 if (centry->len < 16) {
671 /* huh? corrupt cache? */
672 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s "
673 "(len < 16)?\n", kstr));
674 centry_free(centry);
675 return NULL;
676 }
677
678 centry->status = centry_ntstatus(centry);
679 centry->sequence_number = centry_uint32(centry);
680 centry->timeout = centry_uint64(centry);
681
682 return centry;
683 }
684
685 /*
686 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
687 number and return status
688 */
689 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
690 struct winbindd_domain *domain,
691 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
692 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
693 struct winbindd_domain *domain,
694 const char *format, ...)
695 {
696 va_list ap;
697 char *kstr;
698 struct cache_entry *centry;
699
700 if (!winbindd_use_cache()) {
701 return NULL;
702 }
703
704 refresh_sequence_number(domain, false);
705
706 va_start(ap, format);
707 smb_xvasprintf(&kstr, format, ap);
708 va_end(ap);
709
710 centry = wcache_fetch_raw(kstr);
711 if (centry == NULL) {
712 free(kstr);
713 return NULL;
714 }
715
716 if (centry_expired(domain, kstr, centry)) {
717
718 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
719 kstr, domain->name ));
720
721 centry_free(centry);
722 free(kstr);
723 return NULL;
724 }
725
726 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
727 kstr, domain->name ));
728
729 free(kstr);
730 return centry;
731 }
732
733 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
734 static void wcache_delete(const char *format, ...)
735 {
736 va_list ap;
737 char *kstr;
738 TDB_DATA key;
739
740 va_start(ap, format);
741 smb_xvasprintf(&kstr, format, ap);
742 va_end(ap);
743
744 key = string_tdb_data(kstr);
745
746 tdb_delete(wcache->tdb, key);
747 free(kstr);
748 }
749
750 /*
751 make sure we have at least len bytes available in a centry
752 */
753 static void centry_expand(struct cache_entry *centry, uint32 len)
754 {
755 if (centry->len - centry->ofs >= len)
756 return;
757 centry->len *= 2;
758 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
759 centry->len);
760 if (!centry->data) {
761 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
762 smb_panic_fn("out of memory in centry_expand");
763 }
764 }
765
766 /*
767 push a uint64 into a centry
768 */
769 static void centry_put_uint64(struct cache_entry *centry, uint64 v)
770 {
771 centry_expand(centry, 8);
772 SBVAL(centry->data, centry->ofs, v);
773 centry->ofs += 8;
774 }
775
776 /*
777 push a uint32 into a centry
778 */
779 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
780 {
781 centry_expand(centry, 4);
782 SIVAL(centry->data, centry->ofs, v);
783 centry->ofs += 4;
784 }
785
786 /*
787 push a uint16 into a centry
788 */
789 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
790 {
791 centry_expand(centry, 2);
792 SSVAL(centry->data, centry->ofs, v);
793 centry->ofs += 2;
794 }
795
796 /*
797 push a uint8 into a centry
798 */
799 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
800 {
801 centry_expand(centry, 1);
802 SCVAL(centry->data, centry->ofs, v);
803 centry->ofs += 1;
804 }
805
806 /*
807 push a string into a centry
808 */
809 static void centry_put_string(struct cache_entry *centry, const char *s)
810 {
811 int len;
812
813 if (!s) {
814 /* null strings are marked as len 0xFFFF */
815 centry_put_uint8(centry, 0xFF);
816 return;
817 }
818
819 len = strlen(s);
820 /* can't handle more than 254 char strings. Truncating is probably best */
821 if (len > 254) {
822 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
823 len = 254;
824 }
825 centry_put_uint8(centry, len);
826 centry_expand(centry, len);
827 memcpy(centry->data + centry->ofs, s, len);
828 centry->ofs += len;
829 }
830
831 /*
832 push a 16 byte hash into a centry - treat as 16 byte string.
833 */
834 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
835 {
836 centry_put_uint8(centry, 16);
837 centry_expand(centry, 16);
838 memcpy(centry->data + centry->ofs, val, 16);
839 centry->ofs += 16;
840 }
841
842 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
843 {
844 fstring sid_string;
845 centry_put_string(centry, sid_to_fstring(sid_string, sid));
846 }
847
848
849 /*
850 put NTSTATUS into a centry
851 */
852 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
853 {
854 uint32 status_value = NT_STATUS_V(status);
855 centry_put_uint32(centry, status_value);
856 }
857
858
859 /*
860 push a NTTIME into a centry
861 */
862 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
863 {
864 centry_expand(centry, 8);
865 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
866 centry->ofs += 4;
867 SIVAL(centry->data, centry->ofs, nt >> 32);
868 centry->ofs += 4;
869 }
870
871 /*
872 push a time_t into a centry - use a 64 bit size.
873 NTTIME here is being used as a convenient 64-bit size.
874 */
875 static void centry_put_time(struct cache_entry *centry, time_t t)
876 {
877 NTTIME nt = (NTTIME)t;
878 centry_put_nttime(centry, nt);
879 }
880
881 /*
882 start a centry for output. When finished, call centry_end()
883 */
884 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
885 {
886 struct cache_entry *centry;
887
888 if (!wcache->tdb)
889 return NULL;
890
891 centry = SMB_XMALLOC_P(struct cache_entry);
892
893 centry->len = 8192; /* reasonable default */
894 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
895 centry->ofs = 0;
896 centry->sequence_number = domain->sequence_number;
897 centry->timeout = lp_winbind_cache_time() + time(NULL);
898 centry_put_ntstatus(centry, status);
899 centry_put_uint32(centry, centry->sequence_number);
900 centry_put_uint64(centry, centry->timeout);
901 return centry;
902 }
903
904 /*
905 finish a centry and write it to the tdb
906 */
907 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
908 static void centry_end(struct cache_entry *centry, const char *format, ...)
909 {
910 va_list ap;
911 char *kstr;
912 TDB_DATA key, data;
913
914 if (!winbindd_use_cache()) {
915 return;
916 }
917
918 va_start(ap, format);
919 smb_xvasprintf(&kstr, format, ap);
920 va_end(ap);
921
922 key = string_tdb_data(kstr);
923 data.dptr = centry->data;
924 data.dsize = centry->ofs;
925
926 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
927 free(kstr);
928 }
929
930 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
931 NTSTATUS status, const char *domain_name,
932 const char *name, const DOM_SID *sid,
933 enum lsa_SidType type)
934 {
935 struct cache_entry *centry;
936 fstring uname;
937
938 centry = centry_start(domain, status);
939 if (!centry)
940 return;
941 centry_put_uint32(centry, type);
942 centry_put_sid(centry, sid);
943 fstrcpy(uname, name);
944 strupper_m(uname);
945 centry_end(centry, "NS/%s/%s", domain_name, uname);
946 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
947 uname, sid_string_dbg(sid), nt_errstr(status)));
948 centry_free(centry);
949 }
950
951 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
952 const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
953 {
954 struct cache_entry *centry;
955 fstring sid_string;
956
957 centry = centry_start(domain, status);
958 if (!centry)
959 return;
960
961 if (NT_STATUS_IS_OK(status)) {
962 centry_put_uint32(centry, type);
963 centry_put_string(centry, domain_name);
964 centry_put_string(centry, name);
965 }
966
967 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
968 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
969 name, nt_errstr(status)));
970 centry_free(centry);
971 }
972
973
974 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
975 struct wbint_userinfo *info)
976 {
977 struct cache_entry *centry;
978 fstring sid_string;
979
980 if (is_null_sid(&info->user_sid)) {
981 return;
982 }
983
984 centry = centry_start(domain, status);
985 if (!centry)
986 return;
987 centry_put_string(centry, info->acct_name);
988 centry_put_string(centry, info->full_name);
989 centry_put_string(centry, info->homedir);
990 centry_put_string(centry, info->shell);
991 centry_put_uint32(centry, info->primary_gid);
992 centry_put_sid(centry, &info->user_sid);
993 centry_put_sid(centry, &info->group_sid);
994 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
995 &info->user_sid));
996 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
997 centry_free(centry);
998 }
999
1000 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
1001 NTSTATUS status,
1002 struct samr_DomInfo12 *lockout_policy)
1003 {
1004 struct cache_entry *centry;
1005
1006 centry = centry_start(domain, status);
1007 if (!centry)
1008 return;
1009
1010 centry_put_nttime(centry, lockout_policy->lockout_duration);
1011 centry_put_nttime(centry, lockout_policy->lockout_window);
1012 centry_put_uint16(centry, lockout_policy->lockout_threshold);
1013
1014 centry_end(centry, "LOC_POL/%s", domain->name);
1015
1016 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
1017
1018 centry_free(centry);
1019 }
1020
1021
1022
1023 static void wcache_save_password_policy(struct winbindd_domain *domain,
1024 NTSTATUS status,
1025 struct samr_DomInfo1 *policy)
1026 {
1027 struct cache_entry *centry;
1028
1029 centry = centry_start(domain, status);
1030 if (!centry)
1031 return;
1032
1033 centry_put_uint16(centry, policy->min_password_length);
1034 centry_put_uint16(centry, policy->password_history_length);
1035 centry_put_uint32(centry, policy->password_properties);
1036 centry_put_nttime(centry, policy->max_password_age);
1037 centry_put_nttime(centry, policy->min_password_age);
1038
1039 centry_end(centry, "PWD_POL/%s", domain->name);
1040
1041 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1042
1043 centry_free(centry);
1044 }
1045
1046 /***************************************************************************
1047 ***************************************************************************/
1048
1049 static void wcache_save_username_alias(struct winbindd_domain *domain,
1050 NTSTATUS status,
1051 const char *name, const char *alias)
1052 {
1053 struct cache_entry *centry;
1054 fstring uname;
1055
1056 if ( (centry = centry_start(domain, status)) == NULL )
1057 return;
1058
1059 centry_put_string( centry, alias );
1060
1061 fstrcpy(uname, name);
1062 strupper_m(uname);
1063 centry_end(centry, "NSS/NA/%s", uname);
1064
1065 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1066
1067 centry_free(centry);
1068 }
1069
1070 static void wcache_save_alias_username(struct winbindd_domain *domain,
1071 NTSTATUS status,
1072 const char *alias, const char *name)
1073 {
1074 struct cache_entry *centry;
1075 fstring uname;
1076
1077 if ( (centry = centry_start(domain, status)) == NULL )
1078 return;
1079
1080 centry_put_string( centry, name );
1081
1082 fstrcpy(uname, alias);
1083 strupper_m(uname);
1084 centry_end(centry, "NSS/AN/%s", uname);
1085
1086 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1087
1088 centry_free(centry);
1089 }
1090
1091 /***************************************************************************
1092 ***************************************************************************/
1093
1094 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1095 struct winbindd_domain *domain,
1096 const char *name, char **alias )
1097 {
1098 struct winbind_cache *cache = get_cache(domain);
1099 struct cache_entry *centry = NULL;
1100 NTSTATUS status;
1101 char *upper_name;
1102
1103 if ( domain->internal )
1104 return NT_STATUS_NOT_SUPPORTED;
1105
1106 if (!cache->tdb)
1107 goto do_query;
1108
1109 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1110 return NT_STATUS_NO_MEMORY;
1111 strupper_m(upper_name);
1112
1113 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1114
1115 SAFE_FREE( upper_name );
1116
1117 if (!centry)
1118 goto do_query;
1119
1120 status = centry->status;
1121
1122 if (!NT_STATUS_IS_OK(status)) {
1123 centry_free(centry);
1124 return status;
1125 }
1126
1127 *alias = centry_string( centry, mem_ctx );
1128
1129 centry_free(centry);
1130
1131 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1132 name, *alias ? *alias : "(none)"));
1133
1134 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1135
1136 do_query:
1137
1138 /* If its not in cache and we are offline, then fail */
1139
1140 if ( get_global_winbindd_state_offline() || !domain->online ) {
1141 DEBUG(8,("resolve_username_to_alias: rejecting query "
1142 "in offline mode\n"));
1143 return NT_STATUS_NOT_FOUND;
1144 }
1145
1146 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1147
1148 if ( NT_STATUS_IS_OK( status ) ) {
1149 wcache_save_username_alias(domain, status, name, *alias);
1150 }
1151
1152 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1153 wcache_save_username_alias(domain, status, name, "(NULL)");
1154 }
1155
1156 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1157 nt_errstr(status)));
1158
1159 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1160 set_domain_offline( domain );
1161 }
1162
1163 return status;
1164 }
1165
1166 /***************************************************************************
1167 ***************************************************************************/
1168
1169 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1170 struct winbindd_domain *domain,
1171 const char *alias, char **name )
1172 {
1173 struct winbind_cache *cache = get_cache(domain);
1174 struct cache_entry *centry = NULL;
1175 NTSTATUS status;
1176 char *upper_name;
1177
1178 if ( domain->internal )
1179 return NT_STATUS_NOT_SUPPORTED;
1180
1181 if (!cache->tdb)
1182 goto do_query;
1183
1184 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1185 return NT_STATUS_NO_MEMORY;
1186 strupper_m(upper_name);
1187
1188 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1189
1190 SAFE_FREE( upper_name );
1191
1192 if (!centry)
1193 goto do_query;
1194
1195 status = centry->status;
1196
1197 if (!NT_STATUS_IS_OK(status)) {
1198 centry_free(centry);
1199 return status;
1200 }
1201
1202 *name = centry_string( centry, mem_ctx );
1203
1204 centry_free(centry);
1205
1206 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1207 alias, *name ? *name : "(none)"));
1208
1209 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1210
1211 do_query:
1212
1213 /* If its not in cache and we are offline, then fail */
1214
1215 if ( get_global_winbindd_state_offline() || !domain->online ) {
1216 DEBUG(8,("resolve_alias_to_username: rejecting query "
1217 "in offline mode\n"));
1218 return NT_STATUS_NOT_FOUND;
1219 }
1220
1221 /* an alias cannot contain a domain prefix or '@' */
1222
1223 if (strchr(alias, '\\') || strchr(alias, '@')) {
1224 DEBUG(10,("resolve_alias_to_username: skipping fully "
1225 "qualified name %s\n", alias));
1226 return NT_STATUS_OBJECT_NAME_INVALID;
1227 }
1228
1229 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1230
1231 if ( NT_STATUS_IS_OK( status ) ) {
1232 wcache_save_alias_username( domain, status, alias, *name );
1233 }
1234
1235 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1236 wcache_save_alias_username(domain, status, alias, "(NULL)");
1237 }
1238
1239 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1240 nt_errstr(status)));
1241
1242 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1243 set_domain_offline( domain );
1244 }
1245
1246 return status;
1247 }
1248
1249 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1250 {
1251 struct winbind_cache *cache = get_cache(domain);
1252 TDB_DATA data;
1253 fstring key_str, tmp;
1254 uint32 rid;
1255
1256 if (!cache->tdb) {
1257 return NT_STATUS_INTERNAL_DB_ERROR;
1258 }
1259
1260 if (is_null_sid(sid)) {
1261 return NT_STATUS_INVALID_SID;
1262 }
1263
1264 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1265 return NT_STATUS_INVALID_SID;
1266 }
1267
1268 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1269
1270 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1271 if (!data.dptr) {
1272 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1273 }
1274
1275 SAFE_FREE(data.dptr);
1276 return NT_STATUS_OK;
1277 }
1278
1279 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1280 as new salted ones. */
1281
1282 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1283 TALLOC_CTX *mem_ctx,
1284 const DOM_SID *sid,
1285 const uint8 **cached_nt_pass,
1286 const uint8 **cached_salt)
1287 {
1288 struct winbind_cache *cache = get_cache(domain);
1289 struct cache_entry *centry = NULL;
1290 NTSTATUS status;
1291 time_t t;
1292 uint32 rid;
1293 fstring tmp;
1294
1295 if (!cache->tdb) {
1296 return NT_STATUS_INTERNAL_DB_ERROR;
1297 }
1298
1299 if (is_null_sid(sid)) {
1300 return NT_STATUS_INVALID_SID;
1301 }
1302
1303 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1304 return NT_STATUS_INVALID_SID;
1305 }
1306
1307 /* Try and get a salted cred first. If we can't
1308 fall back to an unsalted cred. */
1309
1310 centry = wcache_fetch(cache, domain, "CRED/%s",
1311 sid_to_fstring(tmp, sid));
1312 if (!centry) {
1313 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1314 sid_string_dbg(sid)));
1315 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1316 }
1317
1318 t = centry_time(centry);
1319
1320 /* In the salted case this isn't actually the nt_hash itself,
1321 but the MD5 of the salt + nt_hash. Let the caller
1322 sort this out. It can tell as we only return the cached_salt
1323 if we are returning a salted cred. */
1324
1325 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1326 if (*cached_nt_pass == NULL) {
1327 fstring sidstr;
1328
1329 sid_to_fstring(sidstr, sid);
1330
1331 /* Bad (old) cred cache. Delete and pretend we
1332 don't have it. */
1333 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1334 sidstr));
1335 wcache_delete("CRED/%s", sidstr);
1336 centry_free(centry);
1337 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1338 }
1339
1340 /* We only have 17 bytes more data in the salted cred case. */
1341 if (centry->len - centry->ofs == 17) {
1342 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1343 } else {
1344 *cached_salt = NULL;
1345 }
1346
1347 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1348 if (*cached_salt) {
1349 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1350 }
1351
1352 status = centry->status;
1353
1354 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1355 sid_string_dbg(sid), nt_errstr(status) ));
1356
1357 centry_free(centry);
1358 return status;
1359 }
1360
1361 /* Store creds for a SID - only writes out new salted ones. */
1362
1363 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1364 TALLOC_CTX *mem_ctx,
1365 const DOM_SID *sid,
1366 const uint8 nt_pass[NT_HASH_LEN])
1367 {
1368 struct cache_entry *centry;
1369 fstring sid_string;
1370 uint32 rid;
1371 uint8 cred_salt[NT_HASH_LEN];
1372 uint8 salted_hash[NT_HASH_LEN];
1373
1374 if (is_null_sid(sid)) {
1375 return NT_STATUS_INVALID_SID;
1376 }
1377
1378 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1379 return NT_STATUS_INVALID_SID;
1380 }
1381
1382 centry = centry_start(domain, NT_STATUS_OK);
1383 if (!centry) {
1384 return NT_STATUS_INTERNAL_DB_ERROR;
1385 }
1386
1387 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1388
1389 centry_put_time(centry, time(NULL));
1390
1391 /* Create a salt and then salt the hash. */
1392 generate_random_buffer(cred_salt, NT_HASH_LEN);
1393 E_md5hash(cred_salt, nt_pass, salted_hash);
1394
1395 centry_put_hash16(centry, salted_hash);
1396 centry_put_hash16(centry, cred_salt);
1397 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1398
1399 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1400
1401 centry_free(centry);
1402
1403 return NT_STATUS_OK;
1404 }
1405
1406
1407 /* Query display info. This is the basic user list fn */
1408 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1409 TALLOC_CTX *mem_ctx,
1410 uint32 *num_entries,
1411 struct wbint_userinfo **info)
1412 {
1413 struct winbind_cache *cache = get_cache(domain);
1414 struct cache_entry *centry = NULL;
1415 NTSTATUS status;
1416 unsigned int i, retry;
1417 bool old_status = domain->online;
1418
1419 if (!cache->tdb)
1420 goto do_query;
1421
1422 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1423 if (!centry)
1424 goto do_query;
1425
1426 do_fetch_cache:
1427 *num_entries = centry_uint32(centry);
1428
1429 if (*num_entries == 0)
1430 goto do_cached;
1431
1432 (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1433 if (! (*info)) {
1434 smb_panic_fn("query_user_list out of memory");
1435 }
1436 for (i=0; i<(*num_entries); i++) {
1437 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1438 (*info)[i].full_name = centry_string(centry, mem_ctx);
1439 (*info)[i].homedir = centry_string(centry, mem_ctx);
1440 (*info)[i].shell = centry_string(centry, mem_ctx);
1441 centry_sid(centry, &(*info)[i].user_sid);
1442 centry_sid(centry, &(*info)[i].group_sid);
1443 }
1444
1445 do_cached:
1446 status = centry->status;
1447
1448 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1449 domain->name, nt_errstr(status) ));
1450
1451 centry_free(centry);
1452 return status;
1453
1454 do_query:
1455 *num_entries = 0;
1456 *info = NULL;
1457
1458 /* Return status value returned by seq number check */
1459
1460 if (!NT_STATUS_IS_OK(domain->last_status))
1461 return domain->last_status;
1462
1463 /* Put the query_user_list() in a retry loop. There appears to be
1464 * some bug either with Windows 2000 or Samba's handling of large
1465 * rpc replies. This manifests itself as sudden disconnection
1466 * at a random point in the enumeration of a large (60k) user list.
1467 * The retry loop simply tries the operation again. )-: It's not
1468 * pretty but an acceptable workaround until we work out what the
1469 * real problem is. */
1470
1471 retry = 0;
1472 do {
1473
1474 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1475 domain->name ));
1476
1477 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1478 if (!NT_STATUS_IS_OK(status)) {
1479 DEBUG(3, ("query_user_list: returned 0x%08x, "
1480 "retrying\n", NT_STATUS_V(status)));
1481 }
1482 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1483 DEBUG(3, ("query_user_list: flushing "
1484 "connection cache\n"));
1485 invalidate_cm_connection(&domain->conn);
1486 }
1487 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1488 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1489 if (!domain->internal && old_status) {
1490 set_domain_offline(domain);
1491 }
1492 /* store partial response. */
1493 if (*num_entries > 0) {
1494 /*
1495 * humm, what about the status used for cache?
1496 * Should it be NT_STATUS_OK?
1497 */
1498 break;
1499 }
1500 /*
1501 * domain is offline now, and there is no user entries,
1502 * try to fetch from cache again.
1503 */
1504 if (cache->tdb && !domain->online && !domain->internal && old_status) {
1505 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1506 /* partial response... */
1507 if (!centry) {
1508 goto skip_save;
1509 } else {
1510 goto do_fetch_cache;
1511 }
1512 } else {
1513 goto skip_save;
1514 }
1515 }
1516
1517 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1518 (retry++ < 5));
1519
1520 /* and save it */
1521 refresh_sequence_number(domain, false);
1522 if (!NT_STATUS_IS_OK(status)) {
1523 return status;
1524 }
1525 centry = centry_start(domain, status);
1526 if (!centry)
1527 goto skip_save;
1528 centry_put_uint32(centry, *num_entries);
1529 for (i=0; i<(*num_entries); i++) {
1530 centry_put_string(centry, (*info)[i].acct_name);
1531 centry_put_string(centry, (*info)[i].full_name);
1532 centry_put_string(centry, (*info)[i].homedir);
1533 centry_put_string(centry, (*info)[i].shell);
1534 centry_put_sid(centry, &(*info)[i].user_sid);
1535 centry_put_sid(centry, &(*info)[i].group_sid);
1536 if (domain->backend && domain->backend->consistent) {
1537 /* when the backend is consistent we can pre-prime some mappings */
1538 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1539 domain->name,
1540 (*info)[i].acct_name,
1541 &(*info)[i].user_sid,
1542 SID_NAME_USER);
1543 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1544 &(*info)[i].user_sid,
1545 domain->name,
1546 (*info)[i].acct_name,
1547 SID_NAME_USER);
1548 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1549 }
1550 }
1551 centry_end(centry, "UL/%s", domain->name);
1552 centry_free(centry);
1553
1554 skip_save:
1555 return status;
1556 }
1557
1558 /* list all domain groups */
1559 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1560 TALLOC_CTX *mem_ctx,
1561 uint32 *num_entries,
1562 struct acct_info **info)
1563 {
1564 struct winbind_cache *cache = get_cache(domain);
1565 struct cache_entry *centry = NULL;
1566 NTSTATUS status;
1567 unsigned int i;
1568 bool old_status;
1569
1570 old_status = domain->online;
1571 if (!cache->tdb)
1572 goto do_query;
1573
1574 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1575 if (!centry)
1576 goto do_query;
1577
1578 do_fetch_cache:
1579 *num_entries = centry_uint32(centry);
1580
1581 if (*num_entries == 0)
1582 goto do_cached;
1583
1584 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1585 if (! (*info)) {
1586 smb_panic_fn("enum_dom_groups out of memory");
1587 }
1588 for (i=0; i<(*num_entries); i++) {
1589 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1590 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1591 (*info)[i].rid = centry_uint32(centry);
1592 }
1593
1594 do_cached:
1595 status = centry->status;
1596
1597 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1598 domain->name, nt_errstr(status) ));
1599
1600 centry_free(centry);
1601 return status;
1602
1603 do_query:
1604 *num_entries = 0;
1605 *info = NULL;
1606
1607 /* Return status value returned by seq number check */
1608
1609 if (!NT_STATUS_IS_OK(domain->last_status))
1610 return domain->last_status;
1611
1612 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1613 domain->name ));
1614
1615 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1616
1617 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1618 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1619 if (!domain->internal && old_status) {
1620 set_domain_offline(domain);
1621 }
1622 if (cache->tdb &&
1623 !domain->online &&
1624 !domain->internal &&
1625 old_status) {
1626 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1627 if (centry) {
1628 goto do_fetch_cache;
1629 }
1630 }
1631 }
1632 /* and save it */
1633 refresh_sequence_number(domain, false);
1634 if (!NT_STATUS_IS_OK(status)) {
1635 return status;
1636 }
1637 centry = centry_start(domain, status);
1638 if (!centry)
1639 goto skip_save;
1640 centry_put_uint32(centry, *num_entries);
1641 for (i=0; i<(*num_entries); i++) {
1642 centry_put_string(centry, (*info)[i].acct_name);
1643 centry_put_string(centry, (*info)[i].acct_desc);
1644 centry_put_uint32(centry, (*info)[i].rid);
1645 }
1646 centry_end(centry, "GL/%s/domain", domain->name);
1647 centry_free(centry);
1648
1649 skip_save:
1650 return status;
1651 }
1652
1653 /* list all domain groups */
1654 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1655 TALLOC_CTX *mem_ctx,
1656 uint32 *num_entries,
1657 struct acct_info **info)
1658 {
1659 struct winbind_cache *cache = get_cache(domain);
1660 struct cache_entry *centry = NULL;
1661 NTSTATUS status;
1662 unsigned int i;
1663 bool old_status;
1664
1665 old_status = domain->online;
1666 if (!cache->tdb)
1667 goto do_query;
1668
1669 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1670 if (!centry)
1671 goto do_query;
1672
1673 do_fetch_cache:
1674 *num_entries = centry_uint32(centry);
1675
1676 if (*num_entries == 0)
1677 goto do_cached;
1678
1679 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1680 if (! (*info)) {
1681 smb_panic_fn("enum_dom_groups out of memory");
1682 }
1683 for (i=0; i<(*num_entries); i++) {
1684 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1685 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1686 (*info)[i].rid = centry_uint32(centry);
1687 }
1688
1689 do_cached:
1690
1691 /* If we are returning cached data and the domain controller
1692 is down then we don't know whether the data is up to date
1693 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1694 indicate this. */
1695
1696 if (wcache_server_down(domain)) {
1697 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1698 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1699 } else
1700 status = centry->status;
1701
1702 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1703 domain->name, nt_errstr(status) ));
1704
1705 centry_free(centry);
1706 return status;
1707
1708 do_query:
1709 *num_entries = 0;
1710 *info = NULL;
1711
1712 /* Return status value returned by seq number check */
1713
1714 if (!NT_STATUS_IS_OK(domain->last_status))
1715 return domain->last_status;
1716
1717 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1718 domain->name ));
1719
1720 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1721
1722 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1723 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1724 if (!domain->internal && old_status) {
1725 set_domain_offline(domain);
1726 }
1727 if (cache->tdb &&
1728 !domain->internal &&
1729 !domain->online &&
1730 old_status) {
1731 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1732 if (centry) {
1733 goto do_fetch_cache;
1734 }
1735 }
1736 }
1737 /* and save it */
1738 refresh_sequence_number(domain, false);
1739 if (!NT_STATUS_IS_OK(status)) {
1740 return status;
1741 }
1742 centry = centry_start(domain, status);
1743 if (!centry)
1744 goto skip_save;
1745 centry_put_uint32(centry, *num_entries);
1746 for (i=0; i<(*num_entries); i++) {
1747 centry_put_string(centry, (*info)[i].acct_name);
1748 centry_put_string(centry, (*info)[i].acct_desc);
1749 centry_put_uint32(centry, (*info)[i].rid);
1750 }
1751 centry_end(centry, "GL/%s/local", domain->name);
1752 centry_free(centry);
1753
1754 skip_save:
1755 return status;
1756 }
1757
1758 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1759 const char *domain_name,
1760 const char *name,
1761 struct dom_sid *sid,
1762 enum lsa_SidType *type)
1763 {
1764 struct winbind_cache *cache = get_cache(domain);
1765 struct cache_entry *centry;
1766 NTSTATUS status;
1767 char *uname;
1768
1769 if (cache->tdb == NULL) {
1770 return NT_STATUS_NOT_FOUND;
1771 }
1772
1773 uname = talloc_strdup_upper(talloc_tos(), name);
1774 if (uname == NULL) {
1775 return NT_STATUS_NO_MEMORY;
1776 }
1777
1778 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1779 TALLOC_FREE(uname);
1780 if (centry == NULL) {
1781 return NT_STATUS_NOT_FOUND;
1782 }
1783
1784 status = centry->status;
1785 if (NT_STATUS_IS_OK(status)) {
1786 *type = (enum lsa_SidType)centry_uint32(centry);
1787 centry_sid(centry, sid);
1788 }
1789
1790 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1791 "%s\n", domain->name, nt_errstr(status) ));
1792
1793 centry_free(centry);
1794 return status;
1795 }
1796
1797 /* convert a single name to a sid in a domain */
1798 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1799 TALLOC_CTX *mem_ctx,
1800 const char *domain_name,
1801 const char *name,
1802 uint32_t flags,
1803 DOM_SID *sid,
1804 enum lsa_SidType *type)
1805 {
1806 NTSTATUS status;
1807 bool old_status;
1808
1809 old_status = domain->online;
1810
1811 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1812 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1813 return status;
1814 }
1815
1816 ZERO_STRUCTP(sid);
1817
1818 /* If the seq number check indicated that there is a problem
1819 * with this DC, then return that status... except for
1820 * access_denied. This is special because the dc may be in
1821 * "restrict anonymous = 1" mode, in which case it will deny
1822 * most unauthenticated operations, but *will* allow the LSA
1823 * name-to-sid that we try as a fallback. */
1824
1825 if (!(NT_STATUS_IS_OK(domain->last_status)
1826 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1827 return domain->last_status;
1828
1829 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1830 domain->name ));
1831
1832 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1833 name, flags, sid, type);
1834
1835 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1836 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1837 if (!domain->internal && old_status) {
1838 set_domain_offline(domain);
1839 }
1840 if (!domain->internal &&
1841 !domain->online &&
1842 old_status) {
1843 NTSTATUS cache_status;
1844 cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1845 return cache_status;
1846 }
1847 }
1848 /* and save it */
1849 refresh_sequence_number(domain, false);
1850
1851 if (domain->online &&
1852 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1853 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1854
1855 /* Only save the reverse mapping if this was not a UPN */
1856 if (!strchr(name, '@')) {
1857 strupper_m(CONST_DISCARD(char *,domain_name));
1858 strlower_m(CONST_DISCARD(char *,name));
1859 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1860 }
1861 }
1862
1863 return status;
1864 }
1865
1866 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1867 const struct dom_sid *sid,
1868 TALLOC_CTX *mem_ctx,
1869 char **domain_name,
1870 char **name,
1871 enum lsa_SidType *type)
1872 {
1873 struct winbind_cache *cache = get_cache(domain);
1874 struct cache_entry *centry;
1875 char *sid_string;
1876 NTSTATUS status;
1877
1878 if (cache->tdb == NULL) {
1879 return NT_STATUS_NOT_FOUND;
1880 }
1881
1882 sid_string = sid_string_tos(sid);
1883 if (sid_string == NULL) {
1884 return NT_STATUS_NO_MEMORY;
1885 }
1886
1887 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1888 TALLOC_FREE(sid_string);
1889 if (centry == NULL) {
1890 return NT_STATUS_NOT_FOUND;
1891 }
1892
1893 if (NT_STATUS_IS_OK(centry->status)) {
1894 *type = (enum lsa_SidType)centry_uint32(centry);
1895 *domain_name = centry_string(centry, mem_ctx);
1896 *name = centry_string(centry, mem_ctx);
1897 }
1898
1899 status = centry->status;
1900 centry_free(centry);
1901
1902 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1903 "%s\n", domain->name, nt_errstr(status) ));
1904
1905 return status;
1906 }
1907
1908 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1909 given */
1910 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1911 TALLOC_CTX *mem_ctx,
1912 const DOM_SID *sid,
1913 char **domain_name,
1914 char **name,
1915 enum lsa_SidType *type)
1916 {
1917 NTSTATUS status;
1918 bool old_status;
1919
1920 old_status = domain->online;
1921 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1922 type);
1923 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1924 return status;
1925 }
1926
1927 *name = NULL;
1928 *domain_name = NULL;
1929
1930 /* If the seq number check indicated that there is a problem
1931 * with this DC, then return that status... except for
1932 * access_denied. This is special because the dc may be in
1933 * "restrict anonymous = 1" mode, in which case it will deny
1934 * most unauthenticated operations, but *will* allow the LSA
1935 * sid-to-name that we try as a fallback. */
1936
1937 if (!(NT_STATUS_IS_OK(domain->last_status)
1938 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1939 return domain->last_status;
1940
1941 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1942 domain->name ));
1943
1944 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1945
1946 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1947 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1948 if (!domain->internal && old_status) {
1949 set_domain_offline(domain);
1950 }
1951 if (!domain->internal &&
1952 !domain->online &&
1953 old_status) {
1954 NTSTATUS cache_status;
1955 cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1956 domain_name, name, type);
1957 return cache_status;
1958 }
1959 }
1960 /* and save it */
1961 refresh_sequence_number(domain, false);
1962 if (!NT_STATUS_IS_OK(status)) {
1963 return status;
1964 }
1965 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1966
1967 /* We can't save the name to sid mapping here, as with sid history a
1968 * later name2sid would give the wrong sid. */
1969
1970 return status;
1971 }
1972
1973 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1974 TALLOC_CTX *mem_ctx,
1975 const DOM_SID *domain_sid,
1976 uint32 *rids,
1977 size_t num_rids,
1978 char **domain_name,
1979 char ***names,
1980 enum lsa_SidType **types)
1981 {
1982 struct winbind_cache *cache = get_cache(domain);
1983 size_t i;
1984 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1985 bool have_mapped;
1986 bool have_unmapped;
1987 bool old_status;
1988
1989 old_status = domain->online;
1990 *domain_name = NULL;
1991 *names = NULL;
1992 *types = NULL;
1993
1994 if (!cache->tdb) {
1995 goto do_query;
1996 }
1997
1998 if (num_rids == 0) {
1999 return NT_STATUS_OK;
2000 }
2001
2002 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
2003 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
2004
2005 if ((*names == NULL) || (*types == NULL)) {
2006 result = NT_STATUS_NO_MEMORY;
2007 goto error;
2008 }
2009
2010 have_mapped = have_unmapped = false;
2011
2012 for (i=0; i<num_rids; i++) {
2013 DOM_SID sid;
2014 struct cache_entry *centry;
2015 fstring tmp;
2016
2017 if (!sid_compose(&sid, domain_sid, rids[i])) {
2018 result = NT_STATUS_INTERNAL_ERROR;
2019 goto error;
2020 }
2021
2022 centry = wcache_fetch(cache, domain, "SN/%s",
2023 sid_to_fstring(tmp, &sid));
2024 if (!centry) {
2025 goto do_query;
2026 }
2027
2028 (*types)[i] = SID_NAME_UNKNOWN;
2029 (*names)[i] = talloc_strdup(*names, "");
2030
2031 if (NT_STATUS_IS_OK(centry->status)) {
2032 char *dom;
2033 have_mapped = true;
2034 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2035
2036 dom = centry_string(centry, mem_ctx);
2037 if (*domain_name == NULL) {
2038 *domain_name = dom;
2039 } else {
2040 talloc_free(dom);
2041 }
2042
2043 (*names)[i] = centry_string(centry, *names);
2044
2045 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2046 have_unmapped = true;
2047
2048 } else {
2049 /* something's definitely wrong */
2050 result = centry->status;
2051 goto error;
2052 }
2053
2054 centry_free(centry);
2055 }
2056
2057 if (!have_mapped) {
2058 return NT_STATUS_NONE_MAPPED;
2059 }
2060 if (!have_unmapped) {
2061 return NT_STATUS_OK;
2062 }
2063 return STATUS_SOME_UNMAPPED;
2064
2065 do_query:
2066
2067 TALLOC_FREE(*names);
2068 TALLOC_FREE(*types);
2069
2070 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2071 rids, num_rids, domain_name,
2072 names, types);
2073
2074 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2075 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2076 if (!domain->internal && old_status) {
2077 set_domain_offline(domain);
2078 }
2079 if (cache->tdb &&
2080 !domain->internal &&
2081 !domain->online &&
2082 old_status) {
2083 have_mapped = have_unmapped = false;
2084
2085 for (i=0; i<num_rids; i++) {
2086 DOM_SID sid;
2087 struct cache_entry *centry;
2088 fstring tmp;
2089
2090 if (!sid_compose(&sid, domain_sid, rids[i])) {
2091 result = NT_STATUS_INTERNAL_ERROR;
2092 goto error;
2093 }
2094
2095 centry = wcache_fetch(cache, domain, "SN/%s",
2096 sid_to_fstring(tmp, &sid));
2097 if (!centry) {
2098 (*types)[i] = SID_NAME_UNKNOWN;
2099 (*names)[i] = talloc_strdup(*names, "");
2100 continue;
2101 }
2102
2103 (*types)[i] = SID_NAME_UNKNOWN;
2104 (*names)[i] = talloc_strdup(*names, "");
2105
2106 if (NT_STATUS_IS_OK(centry->status)) {
2107 char *dom;
2108 have_mapped = true;
2109 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2110
2111 dom = centry_string(centry, mem_ctx);
2112 if (*domain_name == NULL) {
2113 *domain_name = dom;
2114 } else {
2115 talloc_free(dom);
2116 }
2117
2118 (*names)[i] = centry_string(centry, *names);
2119
2120 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2121 have_unmapped = true;
2122
2123 } else {
2124 /* something's definitely wrong */
2125 result = centry->status;
2126 goto error;
2127 }
2128
2129 centry_free(centry);
2130 }
2131
2132 if (!have_mapped) {
2133 return NT_STATUS_NONE_MAPPED;
2134 }
2135 if (!have_unmapped) {
2136 return NT_STATUS_OK;
2137 }
2138 return STATUS_SOME_UNMAPPED;
2139 }
2140 }
2141 /*
2142 None of the queried rids has been found so save all negative entries
2143 */
2144 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2145 for (i = 0; i < num_rids; i++) {
2146 DOM_SID sid;
2147 const char *name = "";
2148 const enum lsa_SidType type = SID_NAME_UNKNOWN;
2149 NTSTATUS status = NT_STATUS_NONE_MAPPED;
2150
2151 if (!sid_compose(&sid, domain_sid, rids[i])) {
2152 return NT_STATUS_INTERNAL_ERROR;
2153 }
2154
2155 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2156 name, type);
2157 }
2158
2159 return result;
2160 }
2161
2162 /*
2163 Some or all of the queried rids have been found.
2164 */
2165 if (!NT_STATUS_IS_OK(result) &&
2166 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2167 return result;
2168 }
2169
2170 refresh_sequence_number(domain, false);
2171
2172 for (i=0; i<num_rids; i++) {
2173 DOM_SID sid;
2174 NTSTATUS status;
2175
2176 if (!sid_compose(&sid, domain_sid, rids[i])) {
2177 result = NT_STATUS_INTERNAL_ERROR;
2178 goto error;
2179 }
2180
2181 status = (*types)[i] == SID_NAME_UNKNOWN ?
2182 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2183
2184 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2185 (*names)[i], (*types)[i]);
2186 }
2187
2188 return result;
2189
2190 error:
2191 TALLOC_FREE(*names);
2192 TALLOC_FREE(*types);
2193 return result;
2194 }
2195
2196 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2197 TALLOC_CTX *mem_ctx,
2198 const struct dom_sid *user_sid,
2199 struct wbint_userinfo *info)
2200 {
2201 struct winbind_cache *cache = get_cache(domain);
2202 struct cache_entry *centry = NULL;
2203 NTSTATUS status;
2204 char *sid_string;
2205
2206 if (cache->tdb == NULL) {
2207 return NT_STATUS_NOT_FOUND;
2208 }
2209
2210 sid_string = sid_string_tos(user_sid);
2211 if (sid_string == NULL) {
2212 return NT_STATUS_NO_MEMORY;
2213 }
2214
2215 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2216 TALLOC_FREE(sid_string);
2217 if (centry == NULL) {
2218 return NT_STATUS_NOT_FOUND;
2219 }
2220
2221 /*
2222 * If we have an access denied cache entry and a cached info3
2223 * in the samlogon cache then do a query. This will force the
2224 * rpc back end to return the info3 data.
2225 */
2226
2227 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2228 netsamlogon_cache_have(user_sid)) {
2229 DEBUG(10, ("query_user: cached access denied and have cached "
2230 "info3\n"));
2231 domain->last_status = NT_STATUS_OK;
2232 centry_free(centry);
2233 return NT_STATUS_NOT_FOUND;
2234 }
2235
2236 /* if status is not ok then this is a negative hit
2237 and the rest of the data doesn't matter */
2238 status = centry->status;
2239 if (NT_STATUS_IS_OK(status)) {
2240 info->acct_name = centry_string(centry, mem_ctx);
2241 info->full_name = centry_string(centry, mem_ctx);
2242 info->homedir = centry_string(centry, mem_ctx);
2243 info->shell = centry_string(centry, mem_ctx);
2244 info->primary_gid = centry_uint32(centry);
2245 centry_sid(centry, &info->user_sid);
2246 centry_sid(centry, &info->group_sid);
2247 }
2248
2249 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2250 "%s\n", domain->name, nt_errstr(status) ));
2251
2252 centry_free(centry);
2253 return status;
2254 }
2255
2256 /* Lookup user information from a rid */
2257 static NTSTATUS query_user(struct winbindd_domain *domain,
2258 TALLOC_CTX *mem_ctx,
2259 const DOM_SID *user_sid,
2260 struct wbint_userinfo *info)
2261 {
2262 NTSTATUS status;
2263 bool old_status;
2264
2265 old_status = domain->online;
2266 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2267 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2268 return status;
2269 }
2270
2271 ZERO_STRUCTP(info);
2272
2273 /* Return status value returned by seq number check */
2274
2275 if (!NT_STATUS_IS_OK(domain->last_status))
2276 return domain->last_status;
2277
2278 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2279 domain->name ));
2280
2281 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2282
2283 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2284 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2285 if (!domain->internal && old_status) {
2286 set_domain_offline(domain);
2287 }
2288 if (!domain->internal &&
2289 !domain->online &&
2290 old_status) {
2291 NTSTATUS cache_status;
2292 cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2293 return cache_status;
2294 }
2295 }
2296 /* and save it */
2297 refresh_sequence_number(domain, false);
2298 if (!NT_STATUS_IS_OK(status)) {
2299 return status;
2300 }
2301 wcache_save_user(domain, status, info);
2302
2303 return status;
2304 }
2305
2306 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2307 TALLOC_CTX *mem_ctx,
2308 const struct dom_sid *user_sid,
2309 uint32_t *pnum_sids,
2310 struct dom_sid **psids)
2311 {
2312 struct winbind_cache *cache = get_cache(domain);
2313 struct cache_entry *centry = NULL;
2314 NTSTATUS status;
2315 uint32_t i, num_sids;
2316 struct dom_sid *sids;
2317 fstring sid_string;
2318
2319 if (cache->tdb == NULL) {
2320 return NT_STATUS_NOT_FOUND;
2321 }
2322
2323 centry = wcache_fetch(cache, domain, "UG/%s",
2324 sid_to_fstring(sid_string, user_sid));
2325 if (centry == NULL) {
2326 return NT_STATUS_NOT_FOUND;
2327 }
2328
2329 /* If we have an access denied cache entry and a cached info3 in the
2330 samlogon cache then do a query. This will force the rpc back end
2331 to return the info3 data. */
2332
2333 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2334 && netsamlogon_cache_have(user_sid)) {
2335 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2336 "cached info3\n"));
2337 domain->last_status = NT_STATUS_OK;
2338 centry_free(centry);
2339 return NT_STATUS_NOT_FOUND;
2340 }
2341
2342 num_sids = centry_uint32(centry);
2343 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2344 if (sids == NULL) {
2345 centry_free(centry);
2346 return NT_STATUS_NO_MEMORY;
2347 }
2348
2349 for (i=0; i<num_sids; i++) {
2350 centry_sid(centry, &sids[i]);
2351 }
2352
2353 status = centry->status;
2354
2355 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2356 "status: %s\n", domain->name, nt_errstr(status)));
2357
2358 centry_free(centry);
2359
2360 *pnum_sids = num_sids;
2361 *psids = sids;
2362 return status;
2363 }
2364
2365 /* Lookup groups a user is a member of. */
2366 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2367 TALLOC_CTX *mem_ctx,
2368 const DOM_SID *user_sid,
2369 uint32 *num_groups, DOM_SID **user_gids)
2370 {
2371 struct cache_entry *centry = NULL;
2372 NTSTATUS status;
2373 unsigned int i;
2374 fstring sid_string;
2375 bool old_status;
2376
2377 old_status = domain->online;
2378 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2379 num_groups, user_gids);
2380 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2381 return status;
2382 }
2383
2384 (*num_groups) = 0;
2385 (*user_gids) = NULL;
2386
2387 /* Return status value returned by seq number check */
2388
2389 if (!NT_STATUS_IS_OK(domain->last_status))
2390 return domain->last_status;
2391
2392 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2393 domain->name ));
2394
2395 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2396
2397 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2398 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2399 if (!domain->internal && old_status) {
2400 set_domain_offline(domain);
2401 }
2402 if (!domain->internal &&
2403 !domain->online &&
2404 old_status) {
2405 NTSTATUS cache_status;
2406 cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2407 num_groups, user_gids);
2408 return cache_status;
2409 }
2410 }
2411 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2412 goto skip_save;
2413
2414 /* and save it */
2415 refresh_sequence_number(domain, false);
2416 if (!NT_STATUS_IS_OK(status)) {
2417 return status;
2418 }
2419 centry = centry_start(domain, status);
2420 if (!centry)
2421 goto skip_save;
2422
2423 centry_put_uint32(centry, *num_groups);
2424 for (i=0; i<(*num_groups); i++) {
2425 centry_put_sid(centry, &(*user_gids)[i]);
2426 }
2427
2428 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2429 centry_free(centry);
2430
2431 skip_save:
2432 return status;
2433 }
2434
2435 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2436 const struct dom_sid *sids)
2437 {
2438 uint32_t i;
2439 char *sidlist;
2440
2441 sidlist = talloc_strdup(mem_ctx, "");
2442 if (sidlist == NULL) {
2443 return NULL;
2444 }
2445 for (i=0; i<num_sids; i++) {
2446 fstring tmp;
2447 sidlist = talloc_asprintf_append_buffer(
2448 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2449 if (sidlist == NULL) {
2450 return NULL;
2451 }
2452 }
2453 return sidlist;
2454 }
2455
2456 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2457 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2458 const struct dom_sid *sids,
2459 uint32_t *pnum_aliases, uint32_t **paliases)
2460 {
2461 struct winbind_cache *cache = get_cache(domain);
2462 struct cache_entry *centry = NULL;
2463 uint32_t num_aliases;
2464 uint32_t *aliases;
2465 NTSTATUS status;
2466 char *sidlist;
2467 int i;
2468
2469 if (cache->tdb == NULL) {
2470 return NT_STATUS_NOT_FOUND;
2471 }
2472
2473 if (num_sids == 0) {
2474 *pnum_aliases = 0;
2475 *paliases = NULL;
2476 return NT_STATUS_OK;
2477 }
2478
2479 /* We need to cache indexed by the whole list of SIDs, the aliases
2480 * resulting might come from any of the SIDs. */
2481
2482 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2483 if (sidlist == NULL) {
2484 return NT_STATUS_NO_MEMORY;
2485 }
2486
2487 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2488 TALLOC_FREE(sidlist);
2489 if (centry == NULL) {
2490 return NT_STATUS_NOT_FOUND;
2491 }
2492
2493 num_aliases = centry_uint32(centry);
2494 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2495 if (aliases == NULL) {
2496 centry_free(centry);
2497 return NT_STATUS_NO_MEMORY;
2498 }
2499
2500 for (i=0; i<num_aliases; i++) {
2501 aliases[i] = centry_uint32(centry);
2502 }
2503
2504 status = centry->status;
2505
2506 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2507 "status %s\n", domain->name, nt_errstr(status)));
2508
2509 centry_free(centry);
2510
2511 *pnum_aliases = num_aliases;
2512 *paliases = aliases;
2513
2514 return status;
2515 }
2516
2517 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2518 TALLOC_CTX *mem_ctx,
2519 uint32 num_sids, const DOM_SID *sids,
2520 uint32 *num_aliases, uint32 **alias_rids)
2521 {
2522 struct cache_entry *centry = NULL;
2523 NTSTATUS status;
2524 char *sidlist;
2525 int i;
2526 bool old_status;
2527
2528 old_status = domain->online;
2529 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2530 num_aliases, alias_rids);
2531 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2532 return status;
2533 }
2534
2535 (*num_aliases) = 0;
2536 (*alias_rids) = NULL;
2537
2538 if (!NT_STATUS_IS_OK(domain->last_status))
2539 return domain->last_status;
2540
2541 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2542 "for domain %s\n", domain->name ));
2543
2544 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2545 if (sidlist == NULL) {
2546 return NT_STATUS_NO_MEMORY;
2547 }
2548
2549 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2550 num_sids, sids,
2551 num_aliases, alias_rids);
2552
2553 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2554 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2555 if (!domain->internal && old_status) {
2556 set_domain_offline(domain);
2557 }
2558 if (!domain->internal &&
2559 !domain->online &&
2560 old_status) {
2561 NTSTATUS cache_status;
2562 cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2563 sids, num_aliases, alias_rids);
2564 return cache_status;
2565 }
2566 }
2567 /* and save it */
2568 refresh_sequence_number(domain, false);
2569 if (!NT_STATUS_IS_OK(status)) {
2570 return status;
2571 }
2572 centry = centry_start(domain, status);
2573 if (!centry)
2574 goto skip_save;
2575 centry_put_uint32(centry, *num_aliases);
2576 for (i=0; i<(*num_aliases); i++)
2577 centry_put_uint32(centry, (*alias_rids)[i]);
2578 centry_end(centry, "UA%s", sidlist);
2579 centry_free(centry);
2580
2581 skip_save:
2582 return status;
2583 }
2584
2585 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2586 TALLOC_CTX *mem_ctx,
2587 const struct dom_sid *group_sid,
2588 uint32_t *num_names,
2589 struct dom_sid **sid_mem, char ***names,
2590 uint32_t **name_types)
2591 {
2592 struct winbind_cache *cache = get_cache(domain);
2593 struct cache_entry *centry = NULL;
2594 NTSTATUS status;
2595 unsigned int i;
2596 char *sid_string;
2597
2598 if (cache->tdb == NULL) {
2599 return NT_STATUS_NOT_FOUND;
2600 }
2601
2602 sid_string = sid_string_tos(group_sid);
2603 if (sid_string == NULL) {
2604 return NT_STATUS_NO_MEMORY;
2605 }
2606
2607 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2608 TALLOC_FREE(sid_string);
2609 if (centry == NULL) {
2610 return NT_STATUS_NOT_FOUND;
2611 }
2612
2613 *sid_mem = NULL;
2614 *names = NULL;
2615 *name_types = NULL;
2616
2617 *num_names = centry_uint32(centry);
2618 if (*num_names == 0) {
2619 centry_free(centry);
2620 return NT_STATUS_OK;
2621 }
2622
2623 *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2624 *names = talloc_array(mem_ctx, char *, *num_names);
2625 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2626
2627 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2628 TALLOC_FREE(*sid_mem);
2629 TALLOC_FREE(*names);
2630 TALLOC_FREE(*name_types);
2631 centry_free(centry);
2632 return NT_STATUS_NO_MEMORY;
2633 }
2634
2635 for (i=0; i<(*num_names); i++) {
2636 centry_sid(centry, &(*sid_mem)[i]);
2637 (*names)[i] = centry_string(centry, mem_ctx);
2638 (*name_types)[i] = centry_uint32(centry);
2639 }
2640
2641 status = centry->status;
2642
2643 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2644 "status: %s\n", domain->name, nt_errstr(status)));
2645
2646 centry_free(centry);
2647 return status;
2648 }
2649
2650 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2651 TALLOC_CTX *mem_ctx,
2652 const DOM_SID *group_sid,
2653 enum lsa_SidType type,
2654 uint32 *num_names,
2655 DOM_SID **sid_mem, char ***names,
2656 uint32 **name_types)
2657 {
2658 struct cache_entry *centry = NULL;
2659 NTSTATUS status;
2660 unsigned int i;
2661 fstring sid_string;
2662 bool old_status;
2663
2664 old_status = domain->online;
2665 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2666 sid_mem, names, name_types);
2667 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2668 return status;
2669 }
2670
2671 (*num_names) = 0;
2672 (*sid_mem) = NULL;
2673 (*names) = NULL;
2674 (*name_types) = NULL;
2675
2676 /* Return status value returned by seq number check */
2677
2678 if (!NT_STATUS_IS_OK(domain->last_status))
2679 return domain->last_status;
2680
2681 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2682 domain->name ));
2683
2684 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2685 type, num_names,
2686 sid_mem, names, name_types);
2687
2688 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2689 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2690 if (!domain->internal && old_status) {
2691 set_domain_offline(domain);
2692 }
2693 if (!domain->internal &&
2694 !domain->online &&
2695 old_status) {
2696 NTSTATUS cache_status;
2697 cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2698 num_names, sid_mem, names,
2699 name_types);
2700 return cache_status;
2701 }
2702 }
2703 /* and save it */
2704 refresh_sequence_number(domain, false);
2705 if (!NT_STATUS_IS_OK(status)) {
2706 return status;
2707 }
2708 centry = centry_start(domain, status);
2709 if (!centry)
2710 goto skip_save;
2711 centry_put_uint32(centry, *num_names);
2712 for (i=0; i<(*num_names); i++) {
2713 centry_put_sid(centry, &(*sid_mem)[i]);
2714 centry_put_string(centry, (*names)[i]);
2715 centry_put_uint32(centry, (*name_types)[i]);
2716 }
2717 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2718 centry_free(centry);
2719
2720 skip_save:
2721 return status;
2722 }
2723
2724 /* find the sequence number for a domain */
2725 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2726 {
2727 refresh_sequence_number(domain, false);
2728
2729 *seq = domain->sequence_number;
2730
2731 return NT_STATUS_OK;
2732 }
2733
2734 /* enumerate trusted domains
2735 * (we need to have the list of trustdoms in the cache when we go offline) -
2736 * Guenther */
2737 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2738 TALLOC_CTX *mem_ctx,
2739 struct netr_DomainTrustList *trusts)
2740 {
2741 NTSTATUS status;
2742 struct winbind_cache *cache;
2743 struct winbindd_tdc_domain *dom_list = NULL;
2744 size_t num_domains = 0;
2745 bool retval = false;
2746 int i;
2747 bool old_status;
2748
2749 old_status = domain->online;
2750 trusts->count = 0;
2751 trusts->array = NULL;
2752
2753 cache = get_cache(domain);
2754 if (!cache || !cache->tdb) {
2755 goto do_query;
2756 }
2757
2758 if (domain->online) {
2759 goto do_query;
2760 }
2761
2762 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2763 if (!retval || !num_domains || !dom_list) {
2764 TALLOC_FREE(dom_list);
2765 goto do_query;
2766 }
2767
2768 do_fetch_cache:
2769 trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
2770 if (!trusts->array) {
2771 TALLOC_FREE(dom_list);
2772 return NT_STATUS_NO_MEMORY;
2773 }
2774
2775 for (i = 0; i < num_domains; i++) {
2776 struct netr_DomainTrust *trust;
2777 struct dom_sid *sid;
2778 struct winbindd_domain *dom;
2779
2780 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2781 if (dom && dom->internal) {
2782 continue;
2783 }
2784
2785 trust = &trusts->array[trusts->count];
2786 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2787 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2788 sid = talloc(trusts->array, struct dom_sid);
2789 if (!trust->netbios_name || !trust->dns_name ||
2790 !sid) {
2791 TALLOC_FREE(dom_list);
2792 TALLOC_FREE(trusts->array);
2793 return NT_STATUS_NO_MEMORY;
2794 }
2795
2796 trust->trust_flags = dom_list[i].trust_flags;
2797 trust->trust_attributes = dom_list[i].trust_attribs;
2798 trust->trust_type = dom_list[i].trust_type;
2799 sid_copy(sid, &dom_list[i].sid);
2800 trust->sid = sid;
2801 trusts->count++;
2802 }
2803
2804 TALLOC_FREE(dom_list);
2805 return NT_STATUS_OK;
2806
2807 do_query:
2808 /* Return status value returned by seq number check */
2809
2810 if (!NT_STATUS_IS_OK(domain->last_status))
2811 return domain->last_status;
2812
2813 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2814 domain->name ));
2815
2816 status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2817
2818 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2819 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2820 if (!domain->internal && old_status) {
2821 set_domain_offline(domain);
2822 }
2823 if (!domain->internal &&
2824 !domain->online &&
2825 old_status) {
2826 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2827 if (retval && num_domains && dom_list) {
2828 TALLOC_FREE(trusts->array);
2829 trusts->count = 0;
2830 goto do_fetch_cache;
2831 }
2832 }
2833 }
2834 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2835 * so that the generic centry handling still applies correctly -
2836 * Guenther*/
2837
2838 if (!NT_STATUS_IS_ERR(status)) {
2839 status = NT_STATUS_OK;
2840 }
2841 return status;
2842 }
2843
2844 /* get lockout policy */
2845 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2846 TALLOC_CTX *mem_ctx,
2847 struct samr_DomInfo12 *policy)
2848 {
2849 struct winbind_cache *cache = get_cache(domain);
2850 struct cache_entry *centry = NULL;
2851 NTSTATUS status;
2852 bool old_status;
2853
2854 old_status = domain->online;
2855 if (!cache->tdb)
2856 goto do_query;
2857
2858 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2859
2860 if (!centry)
2861 goto do_query;
2862
2863 do_fetch_cache:
2864 policy->lockout_duration = centry_nttime(centry);
2865 policy->lockout_window = centry_nttime(centry);
2866 policy->lockout_threshold = centry_uint16(centry);
2867
2868 status = centry->status;
2869
2870 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2871 domain->name, nt_errstr(status) ));
2872
2873 centry_free(centry);
2874 return status;
2875
2876 do_query:
2877 ZERO_STRUCTP(policy);
2878
2879 /* Return status value returned by seq number check */
2880
2881 if (!NT_STATUS_IS_OK(domain->last_status))
2882 return domain->last_status;
2883
2884 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2885 domain->name ));
2886
2887 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2888
2889 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2890 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2891 if (!domain->internal && old_status) {
2892 set_domain_offline(domain);
2893 }
2894 if (cache->tdb &&
2895 !domain->internal &&
2896 !domain->online &&
2897 old_status) {
2898 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2899 if (centry) {
2900 goto do_fetch_cache;
2901 }
2902 }
2903 }
2904 /* and save it */
2905 refresh_sequence_number(domain, false);
2906 if (!NT_STATUS_IS_OK(status)) {
2907 return status;
2908 }
2909 wcache_save_lockout_policy(domain, status, policy);
2910
2911 return status;
2912 }
2913
2914 /* get password policy */
2915 static NTSTATUS password_policy(struct winbindd_domain *domain,
2916 TALLOC_CTX *mem_ctx,
2917 struct samr_DomInfo1 *policy)
2918 {
2919 struct winbind_cache *cache = get_cache(domain);
2920 struct cache_entry *centry = NULL;
2921 NTSTATUS status;
2922 bool old_status;
2923
2924 old_status = domain->online;
2925 if (!cache->tdb)
2926 goto do_query;
2927
2928 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2929
2930 if (!centry)
2931 goto do_query;
2932
2933 do_fetch_cache:
2934 policy->min_password_length = centry_uint16(centry);
2935 policy->password_history_length = centry_uint16(centry);
2936 policy->password_properties = centry_uint32(centry);
2937 policy->max_password_age = centry_nttime(centry);
2938 policy->min_password_age = centry_nttime(centry);
2939
2940 status = centry->status;
2941
2942 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2943 domain->name, nt_errstr(status) ));
2944
2945 centry_free(centry);
2946 return status;
2947
2948 do_query:
2949 ZERO_STRUCTP(policy);
2950
2951 /* Return status value returned by seq number check */
2952
2953 if (!NT_STATUS_IS_OK(domain->last_status))
2954 return domain->last_status;
2955
2956 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2957 domain->name ));
2958
2959 status = domain->backend->password_policy(domain, mem_ctx, policy);
2960
2961 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2962 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2963 if (!domain->internal && old_status) {
2964 set_domain_offline(domain);
2965 }
2966 if (cache->tdb &&
2967 !domain->internal &&
2968 !domain->online &&
2969 old_status) {
2970 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2971 if (centry) {
2972 goto do_fetch_cache;
2973 }
2974 }
2975 }
2976 /* and save it */
2977 refresh_sequence_number(domain, false);
2978 if (!NT_STATUS_IS_OK(status)) {
2979 return status;
2980 }
2981 wcache_save_password_policy(domain, status, policy);
2982
2983 return status;
2984 }
2985
2986
2987 /* Invalidate cached user and group lists coherently */
2988
2989 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2990 void *state)
2991 {
2992 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2993 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2994 tdb_delete(the_tdb, kbuf);
2995
2996 return 0;
2997 }
2998
2999 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
3000
3001 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
3002 struct netr_SamInfo3 *info3)
3003 {
3004 DOM_SID sid;
3005 fstring key_str, sid_string;
3006 struct winbind_cache *cache;
3007
3008 /* dont clear cached U/SID and UG/SID entries when we want to logon
3009 * offline - gd */
3010
3011 if (lp_winbind_offline_logon()) {
3012 return;
3013 }
3014
3015 if (!domain)
3016 return;
3017
3018 cache = get_cache(domain);
3019
3020 if (!cache->tdb) {
3021 return;
3022 }
3023
3024 sid_copy(&sid, info3->base.domain_sid);
3025 sid_append_rid(&sid, info3->base.rid);
3026
3027 /* Clear U/SID cache entry */
3028 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
3029 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3030 tdb_delete(cache->tdb, string_tdb_data(key_str));
3031
3032 /* Clear UG/SID cache entry */
3033 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
3034 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3035 tdb_delete(cache->tdb, string_tdb_data(key_str));
3036
3037 /* Samba/winbindd never needs this. */
3038 netsamlogon_clear_cached_user(info3);
3039 }
3040
3041 bool wcache_invalidate_cache(void)
3042 {
3043 struct winbindd_domain *domain;
3044
3045 for (domain = domain_list(); domain; domain = domain->next) {
3046 struct winbind_cache *cache = get_cache(domain);
3047
3048 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3049 "entries for %s\n", domain->name));
3050 if (cache) {
3051 if (cache->tdb) {
3052 tdb_traverse(cache->tdb, traverse_fn, NULL);
3053 } else {
3054 return false;
3055 }
3056 }
3057 }
3058 return true;
3059 }
3060
3061 bool init_wcache(void)
3062 {
3063 if (wcache == NULL) {
3064 wcache = SMB_XMALLOC_P(struct winbind_cache);
3065 ZERO_STRUCTP(wcache);
3066 }
3067
3068 if (wcache->tdb != NULL)
3069 return true;
3070
3071 /* when working offline we must not clear the cache on restart */
3072 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3073 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3074 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3075 O_RDWR|O_CREAT, 0600);
3076
3077 if (wcache->tdb == NULL) {
3078 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3079 return false;
3080 }
3081
3082 return true;
3083 }
3084
3085 /************************************************************************
3086 This is called by the parent to initialize the cache file.
3087 We don't need sophisticated locking here as we know we're the
3088 only opener.
3089 ************************************************************************/
3090
3091 bool initialize_winbindd_cache(void)
3092 {
3093 bool cache_bad = true;
3094 uint32 vers;
3095
3096 if (!init_wcache()) {
3097 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3098 return false;
3099 }
3100
3101 /* Check version number. */
3102 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3103 vers == WINBINDD_CACHE_VERSION) {
3104 cache_bad = false;
3105 }
3106
3107 if (cache_bad) {
3108 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3109 "and re-creating with version number %d\n",
3110 WINBINDD_CACHE_VERSION ));
3111
3112 tdb_close(wcache->tdb);
3113 wcache->tdb = NULL;
3114
3115 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
3116 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3117 cache_path("winbindd_cache.tdb"),
3118 strerror(errno) ));
3119 return false;
3120 }
3121 if (!init_wcache()) {
3122 DEBUG(0,("initialize_winbindd_cache: re-initialization "
3123 "init_wcache failed.\n"));
3124 return false;
3125 }
3126
3127 /* Write the version. */
3128 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3129 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3130 tdb_errorstr(wcache->tdb) ));
3131 return false;
3132 }
3133 }
3134
3135 tdb_close(wcache->tdb);
3136 wcache->tdb = NULL;
3137 return true;
3138 }
3139
3140 void close_winbindd_cache(void)
3141 {
3142 if (!wcache) {
3143 return;
3144 }
3145 if (wcache->tdb) {
3146 tdb_close(wcache->tdb);
3147 wcache->tdb = NULL;
3148 }
3149 }
3150
3151 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
3152 char **domain_name, char **name,
3153 enum lsa_SidType *type)
3154 {
3155 struct winbindd_domain *domain;
3156 NTSTATUS status;
3157
3158 domain = find_lookup_domain_from_sid(sid);
3159 if (domain == NULL) {
3160 return false;
3161 }
3162 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3163 type);
3164 return NT_STATUS_IS_OK(status);
3165 }
3166
3167 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
3168 const char *domain_name,
3169 const char *name,
3170 DOM_SID *sid,
3171 enum lsa_SidType *type)
3172 {
3173 struct winbindd_domain *domain;
3174 NTSTATUS status;
3175 bool original_online_state;
3176
3177 domain = find_lookup_domain_from_name(domain_name);
3178 if (domain == NULL) {
3179 return false;
3180 }
3181
3182 /* If we are doing a cached logon, temporarily set the domain
3183 offline so the cache won't expire the entry */
3184
3185 original_online_state = domain->online;
3186 domain->online = false;
3187 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3188 domain->online = original_online_state;
3189
3190 return NT_STATUS_IS_OK(status);
3191 }
3192
3193 void cache_name2sid(struct winbindd_domain *domain,
3194 const char *domain_name, const char *name,
3195 enum lsa_SidType type, const DOM_SID *sid)
3196 {
3197 refresh_sequence_number(domain, false);
3198 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3199 sid, type);
3200 }
3201
3202 /*
3203 * The original idea that this cache only contains centries has
3204 * been blurred - now other stuff gets put in here. Ensure we
3205 * ignore these things on cleanup.
3206 */
3207
3208 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3209 TDB_DATA dbuf, void *state)
3210 {
3211 struct cache_entry *centry;
3212
3213 if (is_non_centry_key(kbuf)) {
3214 return 0;
3215 }
3216
3217 centry = wcache_fetch_raw((char *)kbuf.dptr);
3218 if (!centry) {
3219 return 0;
3220 }
3221
3222 if (!NT_STATUS_IS_OK(centry->status)) {
3223 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3224 tdb_delete(the_tdb, kbuf);
3225 }
3226
3227 centry_free(centry);
3228 return 0;
3229 }
3230
3231 /* flush the cache */
3232 void wcache_flush_cache(void)
3233 {
3234 if (!wcache)
3235 return;
3236 if (wcache->tdb) {
3237 tdb_close(wcache->tdb);
3238 wcache->tdb = NULL;
3239 }
3240 if (!winbindd_use_cache()) {
3241 return;
3242 }
3243
3244 /* when working offline we must not clear the cache on restart */
3245 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3246 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3247 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3248 O_RDWR|O_CREAT, 0600);
3249
3250 if (!wcache->tdb) {
3251 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3252 return;
3253 }
3254
3255 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3256
3257 DEBUG(10,("wcache_flush_cache success\n"));
3258 }
3259
3260 /* Count cached creds */
3261
3262 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3263 void *state)
3264 {
3265 int *cred_count = (int*)state;
3266
3267 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3268 (*cred_count)++;
3269 }
3270 return 0;
3271 }
3272
3273 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3274 {
3275 struct winbind_cache *cache = get_cache(domain);
3276
3277 *count = 0;
3278
3279 if (!cache->tdb) {
3280 return NT_STATUS_INTERNAL_DB_ERROR;
3281 }
3282
3283 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3284
3285 return NT_STATUS_OK;
3286 }
3287
3288 struct cred_list {
3289 struct cred_list *prev, *next;
3290 TDB_DATA key;
3291 fstring name;
3292 time_t created;
3293 };
3294 static struct cred_list *wcache_cred_list;
3295
3296 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3297 void *state)
3298 {
3299 struct cred_list *cred;
3300
3301 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3302
3303 cred = SMB_MALLOC_P(struct cred_list);
3304 if (cred == NULL) {
3305 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3306 return -1;
3307 }
3308
3309 ZERO_STRUCTP(cred);
3310
3311 /* save a copy of the key */
3312
3313 fstrcpy(cred->name, (const char *)kbuf.dptr);
3314 DLIST_ADD(wcache_cred_list, cred);
3315 }
3316
3317 return 0;
3318 }
3319
3320 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
3321 {
3322 struct winbind_cache *cache = get_cache(domain);
3323 NTSTATUS status;
3324 int ret;
3325 struct cred_list *cred, *oldest = NULL;
3326
3327 if (!cache->tdb) {
3328 return NT_STATUS_INTERNAL_DB_ERROR;
3329 }
3330
3331 /* we possibly already have an entry */
3332 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3333
3334 fstring key_str, tmp;
3335
3336 DEBUG(11,("we already have an entry, deleting that\n"));
3337
3338 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3339
3340 tdb_delete(cache->tdb, string_tdb_data(key_str));
3341
3342 return NT_STATUS_OK;
3343 }
3344
3345 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3346 if (ret == 0) {
3347 return NT_STATUS_OK;
3348 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3349 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3350 }
3351
3352 ZERO_STRUCTP(oldest);
3353
3354 for (cred = wcache_cred_list; cred; cred = cred->next) {
3355
3356 TDB_DATA data;
3357 time_t t;
3358
3359 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3360 if (!data.dptr) {
3361 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3362 cred->name));
3363 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3364 goto done;
3365 }
3366
3367 t = IVAL(data.dptr, 0);
3368 SAFE_FREE(data.dptr);
3369
3370 if (!oldest) {
3371 oldest = SMB_MALLOC_P(struct cred_list);
3372 if (oldest == NULL) {
3373 status = NT_STATUS_NO_MEMORY;
3374 goto done;
3375 }
3376
3377 fstrcpy(oldest->name, cred->name);
3378 oldest->created = t;
3379 continue;
3380 }
3381
3382 if (t < oldest->created) {
3383 fstrcpy(oldest->name, cred->name);
3384 oldest->created = t;
3385 }
3386 }
3387
3388 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3389 status = NT_STATUS_OK;
3390 } else {
3391 status = NT_STATUS_UNSUCCESSFUL;
3392 }
3393 done:
3394 SAFE_FREE(wcache_cred_list);
3395 SAFE_FREE(oldest);
3396
3397 return status;
3398 }
3399
3400 /* Change the global online/offline state. */
3401 bool set_global_winbindd_state_offline(void)
3402 {
3403 TDB_DATA data;
3404
3405 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3406
3407 /* Only go offline if someone has created
3408 the key "WINBINDD_OFFLINE" in the cache tdb. */
3409
3410 if (wcache == NULL || wcache->tdb == NULL) {
3411 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3412 return false;
3413 }
3414
3415 if (!lp_winbind_offline_logon()) {
3416 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3417 return false;
3418 }
3419
3420 if (global_winbindd_offline_state) {
3421 /* Already offline. */
3422 return true;
3423 }
3424
3425 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3426
3427 if (!data.dptr || data.dsize != 4) {
3428 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3429 SAFE_FREE(data.dptr);
3430 return false;
3431 } else {
3432 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3433 global_winbindd_offline_state = true;
3434 SAFE_FREE(data.dptr);
3435 return true;
3436 }
3437 }
3438
3439 void set_global_winbindd_state_online(void)
3440 {
3441 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3442
3443 if (!lp_winbind_offline_logon()) {
3444 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3445 return;
3446 }
3447
3448 if (!global_winbindd_offline_state) {
3449 /* Already online. */
3450 return;
3451 }
3452 global_winbindd_offline_state = false;
3453
3454 if (!wcache->tdb) {
3455 return;
3456 }
3457
3458 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3459 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3460 }
3461
3462 bool get_global_winbindd_state_offline(void)
3463 {
3464 return global_winbindd_offline_state;
3465 }
3466
3467 /***********************************************************************
3468 Validate functions for all possible cache tdb keys.
3469 ***********************************************************************/
3470
3471 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3472 struct tdb_validation_status *state)
3473 {
3474 struct cache_entry *centry;
3475
3476 centry = SMB_XMALLOC_P(struct cache_entry);
3477 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3478 if (!centry->data) {
3479 SAFE_FREE(centry);
3480 return NULL;
3481 }
3482 centry->len = data.dsize;
3483 centry->ofs = 0;
3484
3485 if (centry->len < 16) {
3486 /* huh? corrupt cache? */
3487 DEBUG(0,("create_centry_validate: Corrupt cache for key %s "
3488 "(len < 16) ?\n", kstr));
3489 centry_free(centry);
3490 state->bad_entry = true;
3491 state->success = false;
3492 return NULL;
3493 }
3494
3495 centry->status = NT_STATUS(centry_uint32(centry));
3496 centry->sequence_number = centry_uint32(centry);
3497 centry->timeout = centry_uint64(centry);
3498 return centry;
3499 }
3500
3501 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3502 struct tdb_validation_status *state)
3503 {
3504 if (dbuf.dsize != 8) {
3505 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3506 keystr, (unsigned int)dbuf.dsize ));
3507 state->bad_entry = true;
3508 return 1;
3509 }
3510 return 0;
3511 }
3512
3513 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3514 struct tdb_validation_status *state)
3515 {
3516 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3517 if (!centry) {
3518 return 1;
3519 }
3520
3521 (void)centry_uint32(centry);
3522 if (NT_STATUS_IS_OK(centry->status)) {
3523 DOM_SID sid;
3524 (void)centry_sid(centry, &sid);
3525 }
3526
3527 centry_free(centry);
3528
3529 if (!(state->success)) {
3530 return 1;
3531 }
3532 DEBUG(10,("validate_ns: %s ok\n", keystr));
3533 return 0;
3534 }
3535
3536 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3537 struct tdb_validation_status *state)
3538 {
3539 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3540 if (!centry) {
3541 return 1;
3542 }
3543
3544 if (NT_STATUS_IS_OK(centry->status)) {
3545 (void)centry_uint32(centry);
3546 (void)centry_string(centry, mem_ctx);
3547 (void)centry_string(centry, mem_ctx);
3548 }
3549
3550 centry_free(centry);
3551
3552 if (!(state->success)) {
3553 return 1;
3554 }
3555 DEBUG(10,("validate_sn: %s ok\n", keystr));
3556 return 0;
3557 }
3558
3559 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3560 struct tdb_validation_status *state)
3561 {
3562 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3563 DOM_SID sid;
3564
3565 if (!centry) {
3566 return 1;
3567 }
3568
3569 (void)centry_string(centry, mem_ctx);
3570 (void)centry_string(centry, mem_ctx);
3571 (void)centry_string(centry, mem_ctx);
3572 (void)centry_string(centry, mem_ctx);
3573 (void)centry_uint32(centry);
3574 (void)centry_sid(centry, &sid);
3575 (void)centry_sid(centry, &sid);
3576
3577 centry_free(centry);
3578
3579 if (!(state->success)) {
3580 return 1;
3581 }
3582 DEBUG(10,("validate_u: %s ok\n", keystr));
3583 return 0;
3584 }
3585
3586 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3587 struct tdb_validation_status *state)
3588 {
3589 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3590
3591 if (!centry) {
3592 return 1;
3593 }
3594
3595 (void)centry_nttime(centry);
3596 (void)centry_nttime(centry);
3597 (void)centry_uint16(centry);
3598
3599 centry_free(centry);
3600
3601 if (!(state->success)) {
3602 return 1;
3603 }
3604 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3605 return 0;
3606 }
3607
3608 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3609 struct tdb_validation_status *state)
3610 {
3611 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3612
3613 if (!centry) {
3614 return 1;
3615 }
3616
3617 (void)centry_uint16(centry);
3618 (void)centry_uint16(centry);
3619 (void)centry_uint32(centry);
3620 (void)centry_nttime(centry);
3621 (void)centry_nttime(centry);
3622
3623 centry_free(centry);
3624
3625 if (!(state->success)) {
3626 return 1;
3627 }
3628 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3629 return 0;
3630 }
3631
3632 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3633 struct tdb_validation_status *state)
3634 {
3635 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3636
3637 if (!centry) {
3638 return 1;
3639 }
3640
3641 (void)centry_time(centry);
3642 (void)centry_hash16(centry, mem_ctx);
3643
3644 /* We only have 17 bytes more data in the salted cred case. */
3645 if (centry->len - centry->ofs == 17) {
3646 (void)centry_hash16(centry, mem_ctx);
3647 }
3648
3649 centry_free(centry);
3650
3651 if (!(state->success)) {
3652 return 1;
3653 }
3654 DEBUG(10,("validate_cred: %s ok\n", keystr));
3655 return 0;
3656 }
3657
3658 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3659 struct tdb_validation_status *state)
3660 {
3661 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3662 int32 num_entries, i;
3663
3664 if (!centry) {
3665 return 1;
3666 }
3667
3668 num_entries = (int32)centry_uint32(centry);
3669
3670 for (i=0; i< num_entries; i++) {
3671 DOM_SID sid;
3672 (void)centry_string(centry, mem_ctx);
3673 (void)centry_string(centry, mem_ctx);
3674 (void)centry_string(centry, mem_ctx);
3675 (void)centry_string(centry, mem_ctx);
3676 (void)centry_sid(centry, &sid);
3677 (void)centry_sid(centry, &sid);
3678 }
3679
3680 centry_free(centry);
3681
3682 if (!(state->success)) {
3683 return 1;
3684 }
3685 DEBUG(10,("validate_ul: %s ok\n", keystr));
3686 return 0;
3687 }
3688
3689 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3690 struct tdb_validation_status *state)
3691 {
3692 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3693 int32 num_entries, i;
3694
3695 if (!centry) {
3696 return 1;
3697 }
3698
3699 num_entries = centry_uint32(centry);
3700
3701 for (i=0; i< num_entries; i++) {
3702 (void)centry_string(centry, mem_ctx);
3703 (void)centry_string(centry, mem_ctx);
3704 (void)centry_uint32(centry);
3705 }
3706
3707 centry_free(centry);
3708
3709 if (!(state->success)) {
3710 return 1;
3711 }
3712 DEBUG(10,("validate_gl: %s ok\n", keystr));
3713 return 0;
3714 }
3715
3716 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3717 struct tdb_validation_status *state)
3718 {
3719 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3720 int32 num_groups, i;
3721
3722 if (!centry) {
3723 return 1;
3724 }
3725
3726 num_groups = centry_uint32(centry);
3727
3728 for (i=0; i< num_groups; i++) {
3729 DOM_SID sid;
3730 centry_sid(centry, &sid);
3731 }
3732
3733 centry_free(centry);
3734
3735 if (!(state->success)) {
3736 return 1;
3737 }
3738 DEBUG(10,("validate_ug: %s ok\n", keystr));
3739 return 0;
3740 }
3741
3742 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3743 struct tdb_validation_status *state)
3744 {
3745 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3746 int32 num_aliases, i;
3747
3748 if (!centry) {
3749 return 1;
3750 }
3751
3752 num_aliases = centry_uint32(centry);
3753
3754 for (i=0; i < num_aliases; i++) {
3755 (void)centry_uint32(centry);
3756 }
3757
3758 centry_free(centry);
3759
3760 if (!(state->success)) {
3761 return 1;
3762 }
3763 DEBUG(10,("validate_ua: %s ok\n", keystr));
3764 return 0;
3765 }
3766
3767 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3768 struct tdb_validation_status *state)
3769 {
3770 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3771 int32 num_names, i;
3772
3773 if (!centry) {
3774 return 1;
3775 }
3776
3777 num_names = centry_uint32(centry);
3778
3779 for (i=0; i< num_names; i++) {
3780 DOM_SID sid;
3781 centry_sid(centry, &sid);
3782 (void)centry_string(centry, mem_ctx);
3783 (void)centry_uint32(centry);
3784 }
3785
3786 centry_free(centry);
3787
3788 if (!(state->success)) {
3789 return 1;
3790 }
3791 DEBUG(10,("validate_gm: %s ok\n", keystr));
3792 return 0;
3793 }
3794
3795 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3796 struct tdb_validation_status *state)
3797 {
3798 /* Can't say anything about this other than must be nonzero. */
3799 if (dbuf.dsize == 0) {
3800 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3801 keystr));
3802 state->bad_entry = true;
3803 state->success = false;
3804 return 1;
3805 }
3806
3807 DEBUG(10,("validate_dr: %s ok\n", keystr));
3808 return 0;
3809 }
3810
3811 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3812 struct tdb_validation_status *state)
3813 {
3814 /* Can't say anything about this other than must be nonzero. */
3815 if (dbuf.dsize == 0) {
3816 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3817 keystr));
3818 state->bad_entry = true;
3819 state->success = false;
3820 return 1;
3821 }
3822
3823 DEBUG(10,("validate_de: %s ok\n", keystr));
3824 return 0;
3825 }
3826
3827 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3828 TDB_DATA dbuf, struct tdb_validation_status *state)
3829 {
3830 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3831
3832 if (!centry) {
3833 return 1;
3834 }
3835
3836 (void)centry_string(centry, mem_ctx);
3837 (void)centry_string(centry, mem_ctx);
3838 (void)centry_string(centry, mem_ctx);
3839 (void)centry_uint32(centry);
3840
3841 centry_free(centry);
3842
3843 if (!(state->success)) {
3844 return 1;
3845 }
3846 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3847 return 0;
3848 }
3849
3850 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3851 TDB_DATA dbuf,
3852 struct tdb_validation_status *state)
3853 {
3854 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3855
3856 if (!centry) {
3857 return 1;
3858 }
3859
3860 (void)centry_string( centry, mem_ctx );
3861
3862 centry_free(centry);
3863
3864 if (!(state->success)) {
3865 return 1;
3866 }
3867 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3868 return 0;
3869 }
3870
3871 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3872 TDB_DATA dbuf,
3873 struct tdb_validation_status *state)
3874 {
3875 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3876
3877 if (!centry) {
3878 return 1;
3879 }
3880
3881 (void)centry_string( centry, mem_ctx );
3882
3883 centry_free(centry);
3884
3885 if (!(state->success)) {
3886 return 1;
3887 }
3888 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3889 return 0;
3890 }
3891
3892 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3893 TDB_DATA dbuf,
3894 struct tdb_validation_status *state)
3895 {
3896 if (dbuf.dsize == 0) {
3897 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3898 "key %s (len ==0) ?\n", keystr));
3899 state->bad_entry = true;
3900 state->success = false;
3901 return 1;
3902 }
3903
3904 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3905 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3906 return 0;
3907 }
3908
3909 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3910 struct tdb_validation_status *state)
3911 {
3912 if (dbuf.dsize != 4) {
3913 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3914 keystr, (unsigned int)dbuf.dsize ));
3915 state->bad_entry = true;
3916 state->success = false;
3917 return 1;
3918 }
3919 DEBUG(10,("validate_offline: %s ok\n", keystr));
3920 return 0;
3921 }
3922
3923 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3924 struct tdb_validation_status *state)
3925 {
3926 /*
3927 * Ignore validation for now. The proper way to do this is with a
3928 * checksum. Just pure parsing does not really catch much.
3929 */
3930 return 0;
3931 }
3932
3933 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3934 struct tdb_validation_status *state)
3935 {
3936 if (dbuf.dsize != 4) {
3937 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3938 "key %s (len %u != 4) ?\n",
3939 keystr, (unsigned int)dbuf.dsize));
3940 state->bad_entry = true;
3941 state->success = false;
3942 return 1;
3943 }
3944
3945 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3946 return 0;
3947 }
3948
3949 /***********************************************************************
3950 A list of all possible cache tdb keys with associated validation
3951 functions.
3952 ***********************************************************************/
3953
3954 struct key_val_struct {
3955 const char *keyname;
3956 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3957 } key_val[] = {
3958 {"SEQNUM/", validate_seqnum},
3959 {"NS/", validate_ns},
3960 {"SN/", validate_sn},
3961 {"U/", validate_u},
3962 {"LOC_POL/", validate_loc_pol},
3963 {"PWD_POL/", validate_pwd_pol},
3964 {"CRED/", validate_cred},
3965 {"UL/", validate_ul},
3966 {"GL/", validate_gl},
3967 {"UG/", validate_ug},
3968 {"UA", validate_ua},
3969 {"GM/", validate_gm},
3970 {"DR/", validate_dr},
3971 {"DE/", validate_de},
3972 {"NSS/PWINFO/", validate_pwinfo},
3973 {"TRUSTDOMCACHE/", validate_trustdomcache},
3974 {"NSS/NA/", validate_nss_na},
3975 {"NSS/AN/", validate_nss_an},
3976 {"WINBINDD_OFFLINE", validate_offline},
3977 {"NDR/", validate_ndr},
3978 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3979 {NULL, NULL}
3980 };
3981
3982 /***********************************************************************
3983 Function to look at every entry in the tdb and validate it as far as
3984 possible.
3985 ***********************************************************************/
3986
3987 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3988 {
3989 int i;
3990 unsigned int max_key_len = 1024;
3991 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3992
3993 /* Paranoia check. */
3994 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3995 max_key_len = 1024 * 1024;
3996 }
3997 if (kbuf.dsize > max_key_len) {
3998 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3999 "(%u) > (%u)\n\n",
4000 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
4001 return 1;
4002 }
4003
4004 for (i = 0; key_val[i].keyname; i++) {
4005 size_t namelen = strlen(key_val[i].keyname);
4006 if (kbuf.dsize >= namelen && (
4007 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
4008 TALLOC_CTX *mem_ctx;
4009 char *keystr;
4010 int ret;
4011
4012 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
4013 if (!keystr) {
4014 return 1;
4015 }
4016 memcpy(keystr, kbuf.dptr, kbuf.dsize);
4017 keystr[kbuf.dsize] = '\0';
4018
4019 mem_ctx = talloc_init("validate_ctx");
4020 if (!mem_ctx) {
4021 SAFE_FREE(keystr);
4022 return 1;
4023 }
4024
4025 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
4026 v_state);
4027
4028 SAFE_FREE(keystr);
4029 talloc_destroy(mem_ctx);
4030 return ret;
4031 }
4032 }
4033
4034 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
4035 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
4036 DEBUG(0,("data :\n"));
4037 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4038 v_state->unknown_key = true;
4039 v_state->success = false;
4040 return 1; /* terminate. */
4041 }
4042
4043 static void validate_panic(const char *const why)
4044 {
4045 DEBUG(0,("validating cache: would panic %s\n", why ));
4046 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4047 exit(47);
4048 }
4049
4050 static int wbcache_update_centry_fn(TDB_CONTEXT *tdb,
4051 TDB_DATA key,
4052 TDB_DATA data,
4053 void *state)
4054 {
4055 uint64_t ctimeout;
4056 TDB_DATA blob;
4057
4058 if (is_non_centry_key(key)) {
4059 return 0;
4060 }
4061
4062 if (data.dptr == NULL || data.dsize == 0) {
4063 if (tdb_delete(tdb, key) < 0) {
4064 DEBUG(0, ("tdb_delete for [%s] failed!\n",
4065 key.dptr));
4066 return 1;
4067 }
4068 }
4069
4070 /* add timeout to blob (uint64_t) */
4071 blob.dsize = data.dsize + 8;
4072
4073 blob.dptr = SMB_XMALLOC_ARRAY(uint8_t, blob.dsize);
4074 if (blob.dptr == NULL) {
4075 return 1;
4076 }
4077 memset(blob.dptr, 0, blob.dsize);
4078
4079 /* copy status and seqnum */
4080 memcpy(blob.dptr, data.dptr, 8);
4081
4082 /* add timeout */
4083 ctimeout = lp_winbind_cache_time() + time(NULL);
4084 SBVAL(blob.dptr, 8, ctimeout);
4085
4086 /* copy the rest */
4087 memcpy(blob.dptr + 16, data.dptr + 8, data.dsize - 8);
4088
4089 if (tdb_store(tdb, key, blob, TDB_REPLACE) < 0) {
4090 DEBUG(0, ("tdb_store to update [%s] failed!\n",
4091 key.dptr));
4092 SAFE_FREE(blob.dptr);
4093 return 1;
4094 }
4095
4096 SAFE_FREE(blob.dptr);
4097 return 0;
4098 }
4099
4100 static bool wbcache_upgrade_v1_to_v2(TDB_CONTEXT *tdb)
4101 {
4102 int rc;
4103
4104 DEBUG(1, ("Upgrade to version 2 of the winbindd_cache.tdb\n"));
4105
4106 rc = tdb_traverse(tdb, wbcache_update_centry_fn, NULL);
4107 if (rc < 0) {
4108 return false;
4109 }
4110
4111 return true;
4112 }
4113
4114 /***********************************************************************
4115 Try and validate every entry in the winbindd cache. If we fail here,
4116 delete the cache tdb and return non-zero.
4117 ***********************************************************************/
4118
4119 int winbindd_validate_cache(void)
4120 {
4121 int ret = -1;
4122 const char *tdb_path = cache_path("winbindd_cache.tdb");
4123 TDB_CONTEXT *tdb = NULL;
4124 uint32_t vers_id;
4125 bool ok;
4126
4127 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4128 smb_panic_fn = validate_panic;
4129
4130 tdb = tdb_open_log(tdb_path,
4131 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4132 ( lp_winbind_offline_logon()
4133 ? TDB_DEFAULT
4134 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4135 O_RDWR|O_CREAT,
4136 0600);
4137 if (!tdb) {
4138 DEBUG(0, ("winbindd_validate_cache: "
4139 "error opening/initializing tdb\n"));
4140 goto done;
4141 }
4142
4143 /* Version check and upgrade code. */
4144 if (!tdb_fetch_uint32(tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers_id)) {
4145 DEBUG(10, ("Fresh database\n"));
4146 tdb_store_uint32(tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION);
4147 vers_id = WINBINDD_CACHE_VERSION;
4148 }
4149
4150 if (vers_id != WINBINDD_CACHE_VERSION) {
4151 if (vers_id == WINBINDD_CACHE_VER1) {
4152 ok = wbcache_upgrade_v1_to_v2(tdb);
4153 if (!ok) {
4154 DEBUG(10, ("winbindd_validate_cache: upgrade to version 2 failed.\n"));
4155 unlink(tdb_path);
4156 goto done;
4157 }
4158
4159 tdb_store_uint32(tdb,
4160 WINBINDD_CACHE_VERSION_KEYSTR,
4161 WINBINDD_CACHE_VERSION);
4162 vers_id = WINBINDD_CACHE_VER2;
4163 }
4164 }
4165
4166 tdb_close(tdb);
4167
4168 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4169
4170 if (ret != 0) {
4171 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4172 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4173 unlink(tdb_path);
4174 }
4175
4176 done:
4177 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4178 smb_panic_fn = smb_panic;
4179 return ret;
4180 }
4181
4182 /***********************************************************************
4183 Try and validate every entry in the winbindd cache.
4184 ***********************************************************************/
4185
4186 int winbindd_validate_cache_nobackup(void)
4187 {
4188 int ret = -1;
4189 const char *tdb_path = cache_path("winbindd_cache.tdb");
4190
4191 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4192 smb_panic_fn = validate_panic;
4193
4194
4195 if (wcache == NULL || wcache->tdb == NULL) {
4196 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4197 } else {
4198 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4199 }
4200
4201 if (ret != 0) {
4202 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4203 "successful.\n"));
4204 }
4205
4206 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4207 "function\n"));
4208 smb_panic_fn = smb_panic;
4209 return ret;
4210 }
4211
4212 bool winbindd_cache_validate_and_initialize(void)
4213 {
4214 close_winbindd_cache();
4215
4216 if (lp_winbind_offline_logon()) {
4217 if (winbindd_validate_cache() < 0) {
4218 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4219 "could be restored.\n"));
4220 }
4221 }
4222
4223 return initialize_winbindd_cache();
4224 }
4225
4226 /*********************************************************************
4227 ********************************************************************/
4228
4229 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4230 struct winbindd_tdc_domain **domains,
4231 size_t *num_domains )
4232 {
4233 struct winbindd_tdc_domain *list = NULL;
4234 size_t idx;
4235 int i;
4236 bool set_only = false;
4237
4238 /* don't allow duplicates */
4239
4240 idx = *num_domains;
4241 list = *domains;
4242
4243 for ( i=0; i< (*num_domains); i++ ) {
4244 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4245 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4246 new_dom->name));
4247 idx = i;
4248 set_only = true;
4249
4250 break;
4251 }
4252 }
4253
4254 if ( !set_only ) {
4255 if ( !*domains ) {
4256 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
4257 idx = 0;
4258 } else {
4259 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
4260 struct winbindd_tdc_domain,
4261 (*num_domains)+1);
4262 idx = *num_domains;
4263 }
4264
4265 ZERO_STRUCT( list[idx] );
4266 }
4267
4268 if ( !list )
4269 return false;
4270
4271 list[idx].domain_name = talloc_strdup( list, new_dom->name );
4272 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4273
4274 if ( !is_null_sid( &new_dom->sid ) ) {
4275 sid_copy( &list[idx].sid, &new_dom->sid );
4276 } else {
4277 sid_copy(&list[idx].sid, &global_sid_NULL);
4278 }
4279
4280 if ( new_dom->domain_flags != 0x0 )
4281 list[idx].trust_flags = new_dom->domain_flags;
4282
4283 if ( new_dom->domain_type != 0x0 )
4284 list[idx].trust_type = new_dom->domain_type;
4285
4286 if ( new_dom->domain_trust_attribs != 0x0 )
4287 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4288
4289 if ( !set_only ) {
4290 *domains = list;
4291 *num_domains = idx + 1;
4292 }
4293
4294 return true;
4295 }
4296
4297 /*********************************************************************
4298 ********************************************************************/
4299
4300 static TDB_DATA make_tdc_key( const char *domain_name )
4301 {
4302 char *keystr = NULL;
4303 TDB_DATA key = { NULL, 0 };
4304
4305 if ( !domain_name ) {
4306 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4307 return key;
4308 }
4309
4310 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4311 return key;
4312 }
4313 key = string_term_tdb_data(keystr);
4314
4315 return key;
4316 }
4317
4318 /*********************************************************************
4319 ********************************************************************/
4320
4321 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4322 size_t num_domains,
4323 unsigned char **buf )
4324 {
4325 unsigned char *buffer = NULL;
4326 int len = 0;
4327 int buflen = 0;
4328 int i = 0;
4329
4330 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4331 (int)num_domains));
4332
4333 buflen = 0;
4334
4335 again:
4336 len = 0;
4337
4338 /* Store the number of array items first */
4339 len += tdb_pack( buffer+len, buflen-len, "d",
4340 num_domains );
4341
4342 /* now pack each domain trust record */
4343 for ( i=0; i<num_domains; i++ ) {
4344
4345 fstring tmp;
4346
4347 if ( buflen > 0 ) {
4348 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4349 domains[i].domain_name,
4350 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4351 }
4352
4353 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4354 domains[i].domain_name,
4355 domains[i].dns_name,
4356 sid_to_fstring(tmp, &domains[i].sid),
4357 domains[i].trust_flags,
4358 domains[i].trust_attribs,
4359 domains[i].trust_type );
4360 }
4361
4362 if ( buflen < len ) {
4363 SAFE_FREE(buffer);
4364 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4365 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4366 buflen = -1;
4367 goto done;
4368 }
4369 buflen = len;
4370 goto again;
4371 }
4372
4373 *buf = buffer;
4374
4375 done:
4376 return buflen;
4377 }
4378
4379 /*********************************************************************
4380 ********************************************************************/
4381
4382 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4383 struct winbindd_tdc_domain **domains )
4384 {
4385 fstring domain_name, dns_name, sid_string;
4386 uint32 type, attribs, flags;
4387 int num_domains;
4388 int len = 0;
4389 int i;
4390 struct winbindd_tdc_domain *list = NULL;
4391
4392 /* get the number of domains */
4393 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4394 if ( len == -1 ) {
4395 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4396 return 0;
4397 }
4398
4399 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4400 if ( !list ) {
4401 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4402 return 0;
4403 }
4404
4405 for ( i=0; i<num_domains; i++ ) {
4406 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4407 domain_name,
4408 dns_name,
4409 sid_string,
4410 &flags,
4411 &attribs,
4412 &type );
4413
4414 if ( len == -1 ) {
4415 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4416 TALLOC_FREE( list );
4417 return 0;
4418 }
4419
4420 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4421 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4422 domain_name, dns_name, sid_string,
4423 flags, attribs, type));
4424
4425 list[i].domain_name = talloc_strdup( list, domain_name );
4426 list[i].dns_name = talloc_strdup( list, dns_name );
4427 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4428 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4429 domain_name));
4430 }
4431 list[i].trust_flags = flags;
4432 list[i].trust_attribs = attribs;
4433 list[i].trust_type = type;
4434 }
4435
4436 *domains = list;
4437
4438 return num_domains;
4439 }
4440
4441 /*********************************************************************
4442 ********************************************************************/
4443
4444 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4445 {
4446 TDB_DATA key = make_tdc_key( lp_workgroup() );
4447 TDB_DATA data = { NULL, 0 };
4448 int ret;
4449
4450 if ( !key.dptr )
4451 return false;
4452
4453 /* See if we were asked to delete the cache entry */
4454
4455 if ( !domains ) {
4456 ret = tdb_delete( wcache->tdb, key );
4457 goto done;
4458 }
4459
4460 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4461
4462 if ( !data.dptr ) {
4463 ret = -1;
4464 goto done;
4465 }
4466
4467 ret = tdb_store( wcache->tdb, key, data, 0 );
4468
4469 done:
4470 SAFE_FREE( data.dptr );
4471 SAFE_FREE( key.dptr );
4472
4473 return ( ret != -1 );
4474 }
4475
4476 /*********************************************************************
4477 ********************************************************************/
4478
4479 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4480 {
4481 TDB_DATA key = make_tdc_key( lp_workgroup() );
4482 TDB_DATA data = { NULL, 0 };
4483
4484 *domains = NULL;
4485 *num_domains = 0;
4486
4487 if ( !key.dptr )
4488 return false;
4489
4490 data = tdb_fetch( wcache->tdb, key );
4491
4492 SAFE_FREE( key.dptr );
4493
4494 if ( !data.dptr )
4495 return false;
4496
4497 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4498
4499 SAFE_FREE( data.dptr );
4500
4501 if ( !*domains )
4502 return false;
4503
4504 return true;
4505 }
4506
4507 /*********************************************************************
4508 ********************************************************************/
4509
4510 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4511 {
4512 struct winbindd_tdc_domain *dom_list = NULL;
4513 size_t num_domains = 0;
4514 bool ret = false;
4515
4516 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4517 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4518 domain->name, domain->alt_name,
4519 sid_string_dbg(&domain->sid),
4520 domain->domain_flags,
4521 domain->domain_trust_attribs,
4522 domain->domain_type));
4523
4524 if ( !init_wcache() ) {
4525 return false;
4526 }
4527
4528 /* fetch the list */
4529
4530 wcache_tdc_fetch_list( &dom_list, &num_domains );
4531
4532 /* add the new domain */
4533
4534 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4535 goto done;
4536 }
4537
4538 /* pack the domain */
4539
4540 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4541 goto done;
4542 }
4543
4544 /* Success */
4545
4546 ret = true;
4547 done:
4548 TALLOC_FREE( dom_list );
4549
4550 return ret;
4551 }
4552
4553 /*********************************************************************
4554 ********************************************************************/
4555
4556 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4557 {
4558 struct winbindd_tdc_domain *dom_list = NULL;
4559 size_t num_domains = 0;
4560 int i;
4561 struct winbindd_tdc_domain *d = NULL;
4562
4563 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4564
4565 if ( !init_wcache() ) {
4566 return false;
4567 }
4568
4569 /* fetch the list */
4570
4571 wcache_tdc_fetch_list( &dom_list, &num_domains );
4572
4573 for ( i=0; i<num_domains; i++ ) {
4574 if ( strequal(name, dom_list[i].domain_name) ||
4575 strequal(name, dom_list[i].dns_name) )
4576 {
4577 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4578 name));
4579
4580 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4581 if ( !d )
4582 break;
4583
4584 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4585 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4586 sid_copy( &d->sid, &dom_list[i].sid );
4587 d->trust_flags = dom_list[i].trust_flags;
4588 d->trust_type = dom_list[i].trust_type;
4589 d->trust_attribs = dom_list[i].trust_attribs;
4590
4591 break;
4592 }
4593 }
4594
4595 TALLOC_FREE( dom_list );
4596
4597 return d;
4598 }
4599
4600
4601 /*********************************************************************
4602 ********************************************************************/
4603
4604 void wcache_tdc_clear( void )
4605 {
4606 if ( !init_wcache() )
4607 return;
4608
4609 wcache_tdc_store_list( NULL, 0 );
4610
4611 return;
4612 }
4613
4614
4615 /*********************************************************************
4616 ********************************************************************/
4617
4618 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4619 NTSTATUS status,
4620 const DOM_SID *user_sid,
4621 const char *homedir,
4622 const char *shell,
4623 const char *gecos,
4624 uint32 gid)
4625 {
4626 struct cache_entry *centry;
4627 fstring tmp;
4628
4629 if ( (centry = centry_start(domain, status)) == NULL )
4630 return;
4631
4632 centry_put_string( centry, homedir );
4633 centry_put_string( centry, shell );
4634 centry_put_string( centry, gecos );
4635 centry_put_uint32( centry, gid );
4636
4637 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4638
4639 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4640
4641 centry_free(centry);
4642 }
4643
4644 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4645 const DOM_SID *user_sid,
4646 TALLOC_CTX *ctx,
4647 ADS_STRUCT *ads, LDAPMessage *msg,
4648 const char **homedir, const char **shell,
4649 const char **gecos, gid_t *p_gid)
4650 {
4651 struct winbind_cache *cache = get_cache(domain);
4652 struct cache_entry *centry = NULL;
4653 NTSTATUS nt_status;
4654 fstring tmp;
4655
4656 if (!cache->tdb)
4657 goto do_query;
4658
4659 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4660 sid_to_fstring(tmp, user_sid));
4661
4662 if (!centry)
4663 goto do_query;
4664
4665 *homedir = centry_string( centry, ctx );
4666 *shell = centry_string( centry, ctx );
4667 *gecos = centry_string( centry, ctx );
4668 *p_gid = centry_uint32( centry );
4669
4670 centry_free(centry);
4671
4672 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4673 sid_string_dbg(user_sid)));
4674
4675 return NT_STATUS_OK;
4676
4677 do_query:
4678
4679 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4680 homedir, shell, gecos, p_gid );
4681
4682 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4683
4684 if ( NT_STATUS_IS_OK(nt_status) ) {
4685 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4686 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4687 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4688 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4689
4690 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4691 *homedir, *shell, *gecos, *p_gid );
4692 }
4693
4694 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4695 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4696 domain->name ));
4697 set_domain_offline( domain );
4698 }
4699
4700 return nt_status;
4701 }
4702
4703
4704 /* the cache backend methods are exposed via this structure */
4705 struct winbindd_methods cache_methods = {
4706 true,
4707 query_user_list,
4708 enum_dom_groups,
4709 enum_local_groups,
4710 name_to_sid,
4711 sid_to_name,
4712 rids_to_names,
4713 query_user,
4714 lookup_usergroups,
4715 lookup_useraliases,
4716 lookup_groupmem,
4717 sequence_number,
4718 lockout_policy,
4719 password_policy,
4720 trusted_domains
4721 };
4722
4723 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4724 uint32_t opnum, const DATA_BLOB *req,
4725 TDB_DATA *pkey)
4726 {
4727 char *key;
4728 size_t keylen;
4729
4730 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4731 if (key == NULL) {
4732 return false;
4733 }
4734 keylen = talloc_get_size(key) - 1;
4735
4736 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4737 if (key == NULL) {
4738 return false;
4739 }
4740 memcpy(key + keylen, req->data, req->length);
4741
4742 pkey->dptr = (uint8_t *)key;
4743 pkey->dsize = talloc_get_size(key);
4744 return true;
4745 }
4746
4747 static bool wcache_opnum_cacheable(uint32_t opnum)
4748 {
4749 switch (opnum) {
4750 case NDR_WBINT_PING:
4751 case NDR_WBINT_QUERYSEQUENCENUMBER:
4752 case NDR_WBINT_ALLOCATEUID:
4753 case NDR_WBINT_ALLOCATEGID:
4754 case NDR_WBINT_CHECKMACHINEACCOUNT:
4755 case NDR_WBINT_CHANGEMACHINEACCOUNT:
4756 case NDR_WBINT_PINGDC:
4757 return false;
4758 }
4759 return true;
4760 }
4761
4762 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4763 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4764 {
4765 TDB_DATA key, data;
4766 bool ret = false;
4767
4768 if (!wcache_opnum_cacheable(opnum)) {
4769 return false;
4770 }
4771
4772 if (wcache->tdb == NULL) {
4773 return false;
4774 }
4775
4776 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4777 return false;
4778 }
4779 data = tdb_fetch(wcache->tdb, key);
4780 TALLOC_FREE(key.dptr);
4781
4782 if (data.dptr == NULL) {
4783 return false;
4784 }
4785 if (data.dsize < 12) {
4786 goto fail;
4787 }
4788
4789 if (!is_domain_offline(domain)) {
4790 uint32_t entry_seqnum, dom_seqnum, last_check;
4791 uint64_t entry_timeout;
4792
4793 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4794 &last_check)) {
4795 goto fail;
4796 }
4797 entry_seqnum = IVAL(data.dptr, 0);
4798 if (entry_seqnum != dom_seqnum) {
4799 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4800 (int)entry_seqnum));
4801 goto fail;
4802 }
4803 entry_timeout = BVAL(data.dptr, 4);
4804 if (time(NULL) > entry_timeout) {
4805 DEBUG(10, ("Entry has timed out\n"));
4806 goto fail;
4807 }
4808 }
4809
4810 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 12,
4811 data.dsize - 12);
4812 if (resp->data == NULL) {
4813 DEBUG(10, ("talloc failed\n"));
4814 goto fail;
4815 }
4816 resp->length = data.dsize - 12;
4817
4818 ret = true;
4819 fail:
4820 SAFE_FREE(data.dptr);
4821 return ret;
4822 }
4823
4824 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4825 const DATA_BLOB *req, const DATA_BLOB *resp)
4826 {
4827 TDB_DATA key, data;
4828 uint32_t dom_seqnum, last_check;
4829 uint64_t timeout;
4830
4831 if (!wcache_opnum_cacheable(opnum)) {
4832 return;
4833 }
4834
4835 if (wcache->tdb == NULL) {
4836 return;
4837 }
4838
4839 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4840 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4841 domain->name));
4842 return;
4843 }
4844
4845 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4846 return;
4847 }
4848
4849 timeout = time(NULL) + lp_winbind_cache_time();
4850
4851 data.dsize = resp->length + 12;
4852 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4853 if (data.dptr == NULL) {
4854 goto done;
4855 }
4856
4857 SIVAL(data.dptr, 0, dom_seqnum);
4858 SBVAL(data.dptr, 4, timeout);
4859 memcpy(data.dptr + 12, resp->data, resp->length);
4860
4861 tdb_store(wcache->tdb, key, data, 0);
4862
4863 done:
4864 TALLOC_FREE(key.dptr);
4865 return;
4866 }
Samba GIT mirror