?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Use smbcli dead transport handler in vfs_proxy
[Samba/vfs_proxy.git] / source3 / winbindd / winbindd_cache.c
blob2f4a6ffe568232a2404a2932eddea5441051866e
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28
29 #undef DBGC_CLASS
30 #define DBGC_CLASS DBGC_WINBIND
31
32 #define WINBINDD_CACHE_VERSION 1
33 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
34
35 extern struct winbindd_methods reconnect_methods;
36 extern bool opt_nocache;
37 #ifdef HAVE_ADS
38 extern struct winbindd_methods ads_methods;
39 #endif
40 extern struct winbindd_methods builtin_passdb_methods;
41
42 /*
43 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
44 * Here are the list of entry types that are *not* stored
45 * as form struct cache_entry in the cache.
46 */
47
48 static const char *non_centry_keys[] = {
49 "SEQNUM/",
50 "DR/",
51 "DE/",
52 "WINBINDD_OFFLINE",
53 WINBINDD_CACHE_VERSION_KEYSTR,
54 NULL
55 };
56
57 /************************************************************************
58 Is this key a non-centry type ?
59 ************************************************************************/
60
61 static bool is_non_centry_key(TDB_DATA kbuf)
62 {
63 int i;
64
65 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
66 return false;
67 }
68 for (i = 0; non_centry_keys[i] != NULL; i++) {
69 size_t namelen = strlen(non_centry_keys[i]);
70 if (kbuf.dsize < namelen) {
71 continue;
72 }
73 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
74 return true;
75 }
76 }
77 return false;
78 }
79
80 /* Global online/offline state - False when online. winbindd starts up online
81 and sets this to true if the first query fails and there's an entry in
82 the cache tdb telling us to stay offline. */
83
84 static bool global_winbindd_offline_state;
85
86 struct winbind_cache {
87 TDB_CONTEXT *tdb;
88 };
89
90 struct cache_entry {
91 NTSTATUS status;
92 uint32 sequence_number;
93 uint8 *data;
94 uint32 len, ofs;
95 };
96
97 void (*smb_panic_fn)(const char *const why) = smb_panic;
98
99 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
100
101 static struct winbind_cache *wcache;
102
103 void winbindd_check_cache_size(time_t t)
104 {
105 static time_t last_check_time;
106 struct stat st;
107
108 if (last_check_time == (time_t)0)
109 last_check_time = t;
110
111 if (t - last_check_time < 60 && t - last_check_time > 0)
112 return;
113
114 if (wcache == NULL || wcache->tdb == NULL) {
115 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
116 return;
117 }
118
119 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
120 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
121 return;
122 }
123
124 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
125 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
126 (unsigned long)st.st_size,
127 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
128 wcache_flush_cache();
129 }
130 }
131
132 /* get the winbind_cache structure */
133 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
134 {
135 struct winbind_cache *ret = wcache;
136
137 /* We have to know what type of domain we are dealing with first. */
138
139 if (domain->internal) {
140 domain->backend = &builtin_passdb_methods;
141 domain->initialized = True;
142 }
143 if ( !domain->initialized ) {
144 init_dc_connection( domain );
145 }
146
147 /*
148 OK. listen up becasue I'm only going to say this once.
149 We have the following scenarios to consider
150 (a) trusted AD domains on a Samba DC,
151 (b) trusted AD domains and we are joined to a non-kerberos domain
152 (c) trusted AD domains and we are joined to a kerberos (AD) domain
153
154 For (a) we can always contact the trusted domain using krb5
155 since we have the domain trust account password
156
157 For (b) we can only use RPC since we have no way of
158 getting a krb5 ticket in our own domain
159
160 For (c) we can always use krb5 since we have a kerberos trust
161
162 --jerry
163 */
164
165 if (!domain->backend) {
166 #ifdef HAVE_ADS
167 struct winbindd_domain *our_domain = domain;
168
169 /* find our domain first so we can figure out if we
170 are joined to a kerberized domain */
171
172 if ( !domain->primary )
173 our_domain = find_our_domain();
174
175 if ((our_domain->active_directory || IS_DC)
176 && domain->active_directory
177 && !lp_winbind_rpc_only()) {
178 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
179 domain->backend = &ads_methods;
180 } else {
181 #endif /* HAVE_ADS */
182 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
183 domain->backend = &reconnect_methods;
184 #ifdef HAVE_ADS
185 }
186 #endif /* HAVE_ADS */
187 }
188
189 if (ret)
190 return ret;
191
192 ret = SMB_XMALLOC_P(struct winbind_cache);
193 ZERO_STRUCTP(ret);
194
195 wcache = ret;
196 wcache_flush_cache();
197
198 return ret;
199 }
200
201 /*
202 free a centry structure
203 */
204 static void centry_free(struct cache_entry *centry)
205 {
206 if (!centry)
207 return;
208 SAFE_FREE(centry->data);
209 free(centry);
210 }
211
212 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
213 {
214 if (centry->len - centry->ofs < nbytes) {
215 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
216 (unsigned int)nbytes,
217 centry->len - centry->ofs));
218 return false;
219 }
220 return true;
221 }
222
223 /*
224 pull a uint32 from a cache entry
225 */
226 static uint32 centry_uint32(struct cache_entry *centry)
227 {
228 uint32 ret;
229
230 if (!centry_check_bytes(centry, 4)) {
231 smb_panic_fn("centry_uint32");
232 }
233 ret = IVAL(centry->data, centry->ofs);
234 centry->ofs += 4;
235 return ret;
236 }
237
238 /*
239 pull a uint16 from a cache entry
240 */
241 static uint16 centry_uint16(struct cache_entry *centry)
242 {
243 uint16 ret;
244 if (!centry_check_bytes(centry, 2)) {
245 smb_panic_fn("centry_uint16");
246 }
247 ret = CVAL(centry->data, centry->ofs);
248 centry->ofs += 2;
249 return ret;
250 }
251
252 /*
253 pull a uint8 from a cache entry
254 */
255 static uint8 centry_uint8(struct cache_entry *centry)
256 {
257 uint8 ret;
258 if (!centry_check_bytes(centry, 1)) {
259 smb_panic_fn("centry_uint8");
260 }
261 ret = CVAL(centry->data, centry->ofs);
262 centry->ofs += 1;
263 return ret;
264 }
265
266 /*
267 pull a NTTIME from a cache entry
268 */
269 static NTTIME centry_nttime(struct cache_entry *centry)
270 {
271 NTTIME ret;
272 if (!centry_check_bytes(centry, 8)) {
273 smb_panic_fn("centry_nttime");
274 }
275 ret = IVAL(centry->data, centry->ofs);
276 centry->ofs += 4;
277 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
278 centry->ofs += 4;
279 return ret;
280 }
281
282 /*
283 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
284 */
285 static time_t centry_time(struct cache_entry *centry)
286 {
287 return (time_t)centry_nttime(centry);
288 }
289
290 /* pull a string from a cache entry, using the supplied
291 talloc context
292 */
293 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
294 {
295 uint32 len;
296 char *ret;
297
298 len = centry_uint8(centry);
299
300 if (len == 0xFF) {
301 /* a deliberate NULL string */
302 return NULL;
303 }
304
305 if (!centry_check_bytes(centry, (size_t)len)) {
306 smb_panic_fn("centry_string");
307 }
308
309 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
310 if (!ret) {
311 smb_panic_fn("centry_string out of memory\n");
312 }
313 memcpy(ret,centry->data + centry->ofs, len);
314 ret[len] = 0;
315 centry->ofs += len;
316 return ret;
317 }
318
319 /* pull a hash16 from a cache entry, using the supplied
320 talloc context
321 */
322 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
323 {
324 uint32 len;
325 char *ret;
326
327 len = centry_uint8(centry);
328
329 if (len != 16) {
330 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
331 len ));
332 return NULL;
333 }
334
335 if (!centry_check_bytes(centry, 16)) {
336 return NULL;
337 }
338
339 ret = TALLOC_ARRAY(mem_ctx, char, 16);
340 if (!ret) {
341 smb_panic_fn("centry_hash out of memory\n");
342 }
343 memcpy(ret,centry->data + centry->ofs, 16);
344 centry->ofs += 16;
345 return ret;
346 }
347
348 /* pull a sid from a cache entry, using the supplied
349 talloc context
350 */
351 static bool centry_sid(struct cache_entry *centry, TALLOC_CTX *mem_ctx, DOM_SID *sid)
352 {
353 char *sid_string;
354 sid_string = centry_string(centry, mem_ctx);
355 if ((sid_string == NULL) || (!string_to_sid(sid, sid_string))) {
356 return false;
357 }
358 return true;
359 }
360
361
362 /*
363 pull a NTSTATUS from a cache entry
364 */
365 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
366 {
367 NTSTATUS status;
368
369 status = NT_STATUS(centry_uint32(centry));
370 return status;
371 }
372
373
374 /* the server is considered down if it can't give us a sequence number */
375 static bool wcache_server_down(struct winbindd_domain *domain)
376 {
377 bool ret;
378
379 if (!wcache->tdb)
380 return false;
381
382 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
383
384 if (ret)
385 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
386 domain->name ));
387 return ret;
388 }
389
390 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
391 {
392 TDB_DATA data;
393 fstring key;
394 uint32 time_diff;
395
396 if (!wcache->tdb) {
397 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
398 return NT_STATUS_UNSUCCESSFUL;
399 }
400
401 fstr_sprintf( key, "SEQNUM/%s", domain->name );
402
403 data = tdb_fetch_bystring( wcache->tdb, key );
404 if ( !data.dptr || data.dsize!=8 ) {
405 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key ));
406 return NT_STATUS_UNSUCCESSFUL;
407 }
408
409 domain->sequence_number = IVAL(data.dptr, 0);
410 domain->last_seq_check = IVAL(data.dptr, 4);
411
412 SAFE_FREE(data.dptr);
413
414 /* have we expired? */
415
416 time_diff = now - domain->last_seq_check;
417 if ( time_diff > lp_winbind_cache_time() ) {
418 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
419 domain->name, domain->sequence_number,
420 (uint32)domain->last_seq_check));
421 return NT_STATUS_UNSUCCESSFUL;
422 }
423
424 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
425 domain->name, domain->sequence_number,
426 (uint32)domain->last_seq_check));
427
428 return NT_STATUS_OK;
429 }
430
431 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
432 {
433 TDB_DATA data;
434 fstring key_str;
435 uint8 buf[8];
436
437 if (!wcache->tdb) {
438 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
439 return NT_STATUS_UNSUCCESSFUL;
440 }
441
442 fstr_sprintf( key_str, "SEQNUM/%s", domain->name );
443
444 SIVAL(buf, 0, domain->sequence_number);
445 SIVAL(buf, 4, domain->last_seq_check);
446 data.dptr = buf;
447 data.dsize = 8;
448
449 if ( tdb_store_bystring( wcache->tdb, key_str, data, TDB_REPLACE) == -1 ) {
450 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
451 return NT_STATUS_UNSUCCESSFUL;
452 }
453
454 DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
455 domain->name, domain->sequence_number,
456 (uint32)domain->last_seq_check));
457
458 return NT_STATUS_OK;
459 }
460
461 /*
462 refresh the domain sequence number. If force is true
463 then always refresh it, no matter how recently we fetched it
464 */
465
466 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
467 {
468 NTSTATUS status;
469 unsigned time_diff;
470 time_t t = time(NULL);
471 unsigned cache_time = lp_winbind_cache_time();
472
473 if ( IS_DOMAIN_OFFLINE(domain) ) {
474 return;
475 }
476
477 get_cache( domain );
478
479 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
480 /* trying to reconnect is expensive, don't do it too often */
481 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
482 cache_time *= 8;
483 }
484 #endif
485
486 time_diff = t - domain->last_seq_check;
487
488 /* see if we have to refetch the domain sequence number */
489 if (!force && (time_diff < cache_time)) {
490 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
491 goto done;
492 }
493
494 /* try to get the sequence number from the tdb cache first */
495 /* this will update the timestamp as well */
496
497 status = fetch_cache_seqnum( domain, t );
498 if ( NT_STATUS_IS_OK(status) )
499 goto done;
500
501 /* important! make sure that we know if this is a native
502 mode domain or not. And that we can contact it. */
503
504 if ( winbindd_can_contact_domain( domain ) ) {
505 status = domain->backend->sequence_number(domain,
506 &domain->sequence_number);
507 } else {
508 /* just use the current time */
509 status = NT_STATUS_OK;
510 domain->sequence_number = time(NULL);
511 }
512
513
514 /* the above call could have set our domain->backend to NULL when
515 * coming from offline to online mode, make sure to reinitialize the
516 * backend - Guenther */
517 get_cache( domain );
518
519 if (!NT_STATUS_IS_OK(status)) {
520 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
521 domain->sequence_number = DOM_SEQUENCE_NONE;
522 }
523
524 domain->last_status = status;
525 domain->last_seq_check = time(NULL);
526
527 /* save the new sequence number in the cache */
528 store_cache_seqnum( domain );
529
530 done:
531 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
532 domain->name, domain->sequence_number));
533
534 return;
535 }
536
537 /*
538 decide if a cache entry has expired
539 */
540 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
541 {
542 /* If we've been told to be offline - stay in that state... */
543 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
544 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
545 keystr, domain->name ));
546 return false;
547 }
548
549 /* when the domain is offline return the cached entry.
550 * This deals with transient offline states... */
551
552 if (!domain->online) {
553 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
554 keystr, domain->name ));
555 return false;
556 }
557
558 /* if the server is OK and our cache entry came from when it was down then
559 the entry is invalid */
560 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
561 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
562 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
563 keystr, domain->name ));
564 return true;
565 }
566
567 /* if the server is down or the cache entry is not older than the
568 current sequence number then it is OK */
569 if (wcache_server_down(domain) ||
570 centry->sequence_number == domain->sequence_number) {
571 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
572 keystr, domain->name ));
573 return false;
574 }
575
576 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
577 keystr, domain->name ));
578
579 /* it's expired */
580 return true;
581 }
582
583 static struct cache_entry *wcache_fetch_raw(char *kstr)
584 {
585 TDB_DATA data;
586 struct cache_entry *centry;
587 TDB_DATA key;
588
589 key = string_tdb_data(kstr);
590 data = tdb_fetch(wcache->tdb, key);
591 if (!data.dptr) {
592 /* a cache miss */
593 return NULL;
594 }
595
596 centry = SMB_XMALLOC_P(struct cache_entry);
597 centry->data = (unsigned char *)data.dptr;
598 centry->len = data.dsize;
599 centry->ofs = 0;
600
601 if (centry->len < 8) {
602 /* huh? corrupt cache? */
603 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
604 centry_free(centry);
605 return NULL;
606 }
607
608 centry->status = centry_ntstatus(centry);
609 centry->sequence_number = centry_uint32(centry);
610
611 return centry;
612 }
613
614 /*
615 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
616 number and return status
617 */
618 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
619 struct winbindd_domain *domain,
620 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
621 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
622 struct winbindd_domain *domain,
623 const char *format, ...)
624 {
625 va_list ap;
626 char *kstr;
627 struct cache_entry *centry;
628
629 if (opt_nocache) {
630 return NULL;
631 }
632
633 refresh_sequence_number(domain, false);
634
635 va_start(ap, format);
636 smb_xvasprintf(&kstr, format, ap);
637 va_end(ap);
638
639 centry = wcache_fetch_raw(kstr);
640 if (centry == NULL) {
641 free(kstr);
642 return NULL;
643 }
644
645 if (centry_expired(domain, kstr, centry)) {
646
647 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
648 kstr, domain->name ));
649
650 centry_free(centry);
651 free(kstr);
652 return NULL;
653 }
654
655 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
656 kstr, domain->name ));
657
658 free(kstr);
659 return centry;
660 }
661
662 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
663 static void wcache_delete(const char *format, ...)
664 {
665 va_list ap;
666 char *kstr;
667 TDB_DATA key;
668
669 va_start(ap, format);
670 smb_xvasprintf(&kstr, format, ap);
671 va_end(ap);
672
673 key = string_tdb_data(kstr);
674
675 tdb_delete(wcache->tdb, key);
676 free(kstr);
677 }
678
679 /*
680 make sure we have at least len bytes available in a centry
681 */
682 static void centry_expand(struct cache_entry *centry, uint32 len)
683 {
684 if (centry->len - centry->ofs >= len)
685 return;
686 centry->len *= 2;
687 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
688 centry->len);
689 if (!centry->data) {
690 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
691 smb_panic_fn("out of memory in centry_expand");
692 }
693 }
694
695 /*
696 push a uint32 into a centry
697 */
698 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
699 {
700 centry_expand(centry, 4);
701 SIVAL(centry->data, centry->ofs, v);
702 centry->ofs += 4;
703 }
704
705 /*
706 push a uint16 into a centry
707 */
708 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
709 {
710 centry_expand(centry, 2);
711 SIVAL(centry->data, centry->ofs, v);
712 centry->ofs += 2;
713 }
714
715 /*
716 push a uint8 into a centry
717 */
718 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
719 {
720 centry_expand(centry, 1);
721 SCVAL(centry->data, centry->ofs, v);
722 centry->ofs += 1;
723 }
724
725 /*
726 push a string into a centry
727 */
728 static void centry_put_string(struct cache_entry *centry, const char *s)
729 {
730 int len;
731
732 if (!s) {
733 /* null strings are marked as len 0xFFFF */
734 centry_put_uint8(centry, 0xFF);
735 return;
736 }
737
738 len = strlen(s);
739 /* can't handle more than 254 char strings. Truncating is probably best */
740 if (len > 254) {
741 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
742 len = 254;
743 }
744 centry_put_uint8(centry, len);
745 centry_expand(centry, len);
746 memcpy(centry->data + centry->ofs, s, len);
747 centry->ofs += len;
748 }
749
750 /*
751 push a 16 byte hash into a centry - treat as 16 byte string.
752 */
753 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
754 {
755 centry_put_uint8(centry, 16);
756 centry_expand(centry, 16);
757 memcpy(centry->data + centry->ofs, val, 16);
758 centry->ofs += 16;
759 }
760
761 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
762 {
763 fstring sid_string;
764 centry_put_string(centry, sid_to_fstring(sid_string, sid));
765 }
766
767
768 /*
769 put NTSTATUS into a centry
770 */
771 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
772 {
773 uint32 status_value = NT_STATUS_V(status);
774 centry_put_uint32(centry, status_value);
775 }
776
777
778 /*
779 push a NTTIME into a centry
780 */
781 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
782 {
783 centry_expand(centry, 8);
784 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
785 centry->ofs += 4;
786 SIVAL(centry->data, centry->ofs, nt >> 32);
787 centry->ofs += 4;
788 }
789
790 /*
791 push a time_t into a centry - use a 64 bit size.
792 NTTIME here is being used as a convenient 64-bit size.
793 */
794 static void centry_put_time(struct cache_entry *centry, time_t t)
795 {
796 NTTIME nt = (NTTIME)t;
797 centry_put_nttime(centry, nt);
798 }
799
800 /*
801 start a centry for output. When finished, call centry_end()
802 */
803 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
804 {
805 struct cache_entry *centry;
806
807 if (!wcache->tdb)
808 return NULL;
809
810 centry = SMB_XMALLOC_P(struct cache_entry);
811
812 centry->len = 8192; /* reasonable default */
813 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
814 centry->ofs = 0;
815 centry->sequence_number = domain->sequence_number;
816 centry_put_ntstatus(centry, status);
817 centry_put_uint32(centry, centry->sequence_number);
818 return centry;
819 }
820
821 /*
822 finish a centry and write it to the tdb
823 */
824 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
825 static void centry_end(struct cache_entry *centry, const char *format, ...)
826 {
827 va_list ap;
828 char *kstr;
829 TDB_DATA key, data;
830
831 if (opt_nocache) {
832 return;
833 }
834
835 va_start(ap, format);
836 smb_xvasprintf(&kstr, format, ap);
837 va_end(ap);
838
839 key = string_tdb_data(kstr);
840 data.dptr = centry->data;
841 data.dsize = centry->ofs;
842
843 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
844 free(kstr);
845 }
846
847 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
848 NTSTATUS status, const char *domain_name,
849 const char *name, const DOM_SID *sid,
850 enum lsa_SidType type)
851 {
852 struct cache_entry *centry;
853 fstring uname;
854
855 centry = centry_start(domain, status);
856 if (!centry)
857 return;
858 centry_put_uint32(centry, type);
859 centry_put_sid(centry, sid);
860 fstrcpy(uname, name);
861 strupper_m(uname);
862 centry_end(centry, "NS/%s/%s", domain_name, uname);
863 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
864 uname, sid_string_dbg(sid), nt_errstr(status)));
865 centry_free(centry);
866 }
867
868 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
869 const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
870 {
871 struct cache_entry *centry;
872 fstring sid_string;
873
874 centry = centry_start(domain, status);
875 if (!centry)
876 return;
877
878 if (NT_STATUS_IS_OK(status)) {
879 centry_put_uint32(centry, type);
880 centry_put_string(centry, domain_name);
881 centry_put_string(centry, name);
882 }
883
884 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
885 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
886 name, nt_errstr(status)));
887 centry_free(centry);
888 }
889
890
891 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WINBIND_USERINFO *info)
892 {
893 struct cache_entry *centry;
894 fstring sid_string;
895
896 if (is_null_sid(&info->user_sid)) {
897 return;
898 }
899
900 centry = centry_start(domain, status);
901 if (!centry)
902 return;
903 centry_put_string(centry, info->acct_name);
904 centry_put_string(centry, info->full_name);
905 centry_put_string(centry, info->homedir);
906 centry_put_string(centry, info->shell);
907 centry_put_uint32(centry, info->primary_gid);
908 centry_put_sid(centry, &info->user_sid);
909 centry_put_sid(centry, &info->group_sid);
910 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
911 &info->user_sid));
912 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
913 centry_free(centry);
914 }
915
916 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
917 NTSTATUS status,
918 struct samr_DomInfo12 *lockout_policy)
919 {
920 struct cache_entry *centry;
921
922 centry = centry_start(domain, status);
923 if (!centry)
924 return;
925
926 centry_put_nttime(centry, lockout_policy->lockout_duration);
927 centry_put_nttime(centry, lockout_policy->lockout_window);
928 centry_put_uint16(centry, lockout_policy->lockout_threshold);
929
930 centry_end(centry, "LOC_POL/%s", domain->name);
931
932 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
933
934 centry_free(centry);
935 }
936
937
938
939 static void wcache_save_password_policy(struct winbindd_domain *domain,
940 NTSTATUS status,
941 struct samr_DomInfo1 *policy)
942 {
943 struct cache_entry *centry;
944
945 centry = centry_start(domain, status);
946 if (!centry)
947 return;
948
949 centry_put_uint16(centry, policy->min_password_length);
950 centry_put_uint16(centry, policy->password_history_length);
951 centry_put_uint32(centry, policy->password_properties);
952 centry_put_nttime(centry, policy->max_password_age);
953 centry_put_nttime(centry, policy->min_password_age);
954
955 centry_end(centry, "PWD_POL/%s", domain->name);
956
957 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
958
959 centry_free(centry);
960 }
961
962 /***************************************************************************
963 ***************************************************************************/
964
965 static void wcache_save_username_alias(struct winbindd_domain *domain,
966 NTSTATUS status,
967 const char *name, const char *alias)
968 {
969 struct cache_entry *centry;
970 fstring uname;
971
972 if ( (centry = centry_start(domain, status)) == NULL )
973 return;
974
975 centry_put_string( centry, alias );
976
977 fstrcpy(uname, name);
978 strupper_m(uname);
979 centry_end(centry, "NSS/NA/%s", uname);
980
981 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
982
983 centry_free(centry);
984 }
985
986 static void wcache_save_alias_username(struct winbindd_domain *domain,
987 NTSTATUS status,
988 const char *alias, const char *name)
989 {
990 struct cache_entry *centry;
991 fstring uname;
992
993 if ( (centry = centry_start(domain, status)) == NULL )
994 return;
995
996 centry_put_string( centry, name );
997
998 fstrcpy(uname, alias);
999 strupper_m(uname);
1000 centry_end(centry, "NSS/AN/%s", uname);
1001
1002 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1003
1004 centry_free(centry);
1005 }
1006
1007 /***************************************************************************
1008 ***************************************************************************/
1009
1010 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1011 struct winbindd_domain *domain,
1012 const char *name, char **alias )
1013 {
1014 struct winbind_cache *cache = get_cache(domain);
1015 struct cache_entry *centry = NULL;
1016 NTSTATUS status;
1017 char *upper_name;
1018
1019 if ( domain->internal )
1020 return NT_STATUS_NOT_SUPPORTED;
1021
1022 if (!cache->tdb)
1023 goto do_query;
1024
1025 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1026 return NT_STATUS_NO_MEMORY;
1027 strupper_m(upper_name);
1028
1029 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1030
1031 SAFE_FREE( upper_name );
1032
1033 if (!centry)
1034 goto do_query;
1035
1036 status = centry->status;
1037
1038 if (!NT_STATUS_IS_OK(status)) {
1039 centry_free(centry);
1040 return status;
1041 }
1042
1043 *alias = centry_string( centry, mem_ctx );
1044
1045 centry_free(centry);
1046
1047 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1048 name, *alias ? *alias : "(none)"));
1049
1050 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1051
1052 do_query:
1053
1054 /* If its not in cache and we are offline, then fail */
1055
1056 if ( get_global_winbindd_state_offline() || !domain->online ) {
1057 DEBUG(8,("resolve_username_to_alias: rejecting query "
1058 "in offline mode\n"));
1059 return NT_STATUS_NOT_FOUND;
1060 }
1061
1062 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1063
1064 if ( NT_STATUS_IS_OK( status ) ) {
1065 wcache_save_username_alias(domain, status, name, *alias);
1066 }
1067
1068 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1069 wcache_save_username_alias(domain, status, name, "(NULL)");
1070 }
1071
1072 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1073 nt_errstr(status)));
1074
1075 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1076 set_domain_offline( domain );
1077 }
1078
1079 return status;
1080 }
1081
1082 /***************************************************************************
1083 ***************************************************************************/
1084
1085 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1086 struct winbindd_domain *domain,
1087 const char *alias, char **name )
1088 {
1089 struct winbind_cache *cache = get_cache(domain);
1090 struct cache_entry *centry = NULL;
1091 NTSTATUS status;
1092 char *upper_name;
1093
1094 if ( domain->internal )
1095 return NT_STATUS_NOT_SUPPORTED;
1096
1097 if (!cache->tdb)
1098 goto do_query;
1099
1100 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1101 return NT_STATUS_NO_MEMORY;
1102 strupper_m(upper_name);
1103
1104 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1105
1106 SAFE_FREE( upper_name );
1107
1108 if (!centry)
1109 goto do_query;
1110
1111 status = centry->status;
1112
1113 if (!NT_STATUS_IS_OK(status)) {
1114 centry_free(centry);
1115 return status;
1116 }
1117
1118 *name = centry_string( centry, mem_ctx );
1119
1120 centry_free(centry);
1121
1122 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1123 alias, *name ? *name : "(none)"));
1124
1125 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1126
1127 do_query:
1128
1129 /* If its not in cache and we are offline, then fail */
1130
1131 if ( get_global_winbindd_state_offline() || !domain->online ) {
1132 DEBUG(8,("resolve_alias_to_username: rejecting query "
1133 "in offline mode\n"));
1134 return NT_STATUS_NOT_FOUND;
1135 }
1136
1137 /* an alias cannot contain a domain prefix or '@' */
1138
1139 if (strchr(alias, '\\') || strchr(alias, '@')) {
1140 DEBUG(10,("resolve_alias_to_username: skipping fully "
1141 "qualified name %s\n", alias));
1142 return NT_STATUS_OBJECT_NAME_INVALID;
1143 }
1144
1145 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1146
1147 if ( NT_STATUS_IS_OK( status ) ) {
1148 wcache_save_alias_username( domain, status, alias, *name );
1149 }
1150
1151 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1152 wcache_save_alias_username(domain, status, alias, "(NULL)");
1153 }
1154
1155 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1156 nt_errstr(status)));
1157
1158 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1159 set_domain_offline( domain );
1160 }
1161
1162 return status;
1163 }
1164
1165 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1166 {
1167 struct winbind_cache *cache = get_cache(domain);
1168 TDB_DATA data;
1169 fstring key_str, tmp;
1170 uint32 rid;
1171
1172 if (!cache->tdb) {
1173 return NT_STATUS_INTERNAL_DB_ERROR;
1174 }
1175
1176 if (is_null_sid(sid)) {
1177 return NT_STATUS_INVALID_SID;
1178 }
1179
1180 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1181 return NT_STATUS_INVALID_SID;
1182 }
1183
1184 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1185
1186 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1187 if (!data.dptr) {
1188 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1189 }
1190
1191 SAFE_FREE(data.dptr);
1192 return NT_STATUS_OK;
1193 }
1194
1195 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1196 as new salted ones. */
1197
1198 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1199 TALLOC_CTX *mem_ctx,
1200 const DOM_SID *sid,
1201 const uint8 **cached_nt_pass,
1202 const uint8 **cached_salt)
1203 {
1204 struct winbind_cache *cache = get_cache(domain);
1205 struct cache_entry *centry = NULL;
1206 NTSTATUS status;
1207 time_t t;
1208 uint32 rid;
1209 fstring tmp;
1210
1211 if (!cache->tdb) {
1212 return NT_STATUS_INTERNAL_DB_ERROR;
1213 }
1214
1215 if (is_null_sid(sid)) {
1216 return NT_STATUS_INVALID_SID;
1217 }
1218
1219 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1220 return NT_STATUS_INVALID_SID;
1221 }
1222
1223 /* Try and get a salted cred first. If we can't
1224 fall back to an unsalted cred. */
1225
1226 centry = wcache_fetch(cache, domain, "CRED/%s",
1227 sid_to_fstring(tmp, sid));
1228 if (!centry) {
1229 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1230 sid_string_dbg(sid)));
1231 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1232 }
1233
1234 t = centry_time(centry);
1235
1236 /* In the salted case this isn't actually the nt_hash itself,
1237 but the MD5 of the salt + nt_hash. Let the caller
1238 sort this out. It can tell as we only return the cached_salt
1239 if we are returning a salted cred. */
1240
1241 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1242 if (*cached_nt_pass == NULL) {
1243 fstring sidstr;
1244
1245 sid_to_fstring(sidstr, sid);
1246
1247 /* Bad (old) cred cache. Delete and pretend we
1248 don't have it. */
1249 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1250 sidstr));
1251 wcache_delete("CRED/%s", sidstr);
1252 centry_free(centry);
1253 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1254 }
1255
1256 /* We only have 17 bytes more data in the salted cred case. */
1257 if (centry->len - centry->ofs == 17) {
1258 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1259 } else {
1260 *cached_salt = NULL;
1261 }
1262
1263 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1264 if (*cached_salt) {
1265 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1266 }
1267
1268 status = centry->status;
1269
1270 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1271 sid_string_dbg(sid), nt_errstr(status) ));
1272
1273 centry_free(centry);
1274 return status;
1275 }
1276
1277 /* Store creds for a SID - only writes out new salted ones. */
1278
1279 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1280 TALLOC_CTX *mem_ctx,
1281 const DOM_SID *sid,
1282 const uint8 nt_pass[NT_HASH_LEN])
1283 {
1284 struct cache_entry *centry;
1285 fstring sid_string;
1286 uint32 rid;
1287 uint8 cred_salt[NT_HASH_LEN];
1288 uint8 salted_hash[NT_HASH_LEN];
1289
1290 if (is_null_sid(sid)) {
1291 return NT_STATUS_INVALID_SID;
1292 }
1293
1294 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1295 return NT_STATUS_INVALID_SID;
1296 }
1297
1298 centry = centry_start(domain, NT_STATUS_OK);
1299 if (!centry) {
1300 return NT_STATUS_INTERNAL_DB_ERROR;
1301 }
1302
1303 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1304
1305 centry_put_time(centry, time(NULL));
1306
1307 /* Create a salt and then salt the hash. */
1308 generate_random_buffer(cred_salt, NT_HASH_LEN);
1309 E_md5hash(cred_salt, nt_pass, salted_hash);
1310
1311 centry_put_hash16(centry, salted_hash);
1312 centry_put_hash16(centry, cred_salt);
1313 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1314
1315 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1316
1317 centry_free(centry);
1318
1319 return NT_STATUS_OK;
1320 }
1321
1322
1323 /* Query display info. This is the basic user list fn */
1324 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1325 TALLOC_CTX *mem_ctx,
1326 uint32 *num_entries,
1327 WINBIND_USERINFO **info)
1328 {
1329 struct winbind_cache *cache = get_cache(domain);
1330 struct cache_entry *centry = NULL;
1331 NTSTATUS status;
1332 unsigned int i, retry;
1333
1334 if (!cache->tdb)
1335 goto do_query;
1336
1337 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1338 if (!centry)
1339 goto do_query;
1340
1341 *num_entries = centry_uint32(centry);
1342
1343 if (*num_entries == 0)
1344 goto do_cached;
1345
1346 (*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
1347 if (! (*info)) {
1348 smb_panic_fn("query_user_list out of memory");
1349 }
1350 for (i=0; i<(*num_entries); i++) {
1351 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1352 (*info)[i].full_name = centry_string(centry, mem_ctx);
1353 (*info)[i].homedir = centry_string(centry, mem_ctx);
1354 (*info)[i].shell = centry_string(centry, mem_ctx);
1355 centry_sid(centry, mem_ctx, &(*info)[i].user_sid);
1356 centry_sid(centry, mem_ctx, &(*info)[i].group_sid);
1357 }
1358
1359 do_cached:
1360 status = centry->status;
1361
1362 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1363 domain->name, nt_errstr(status) ));
1364
1365 centry_free(centry);
1366 return status;
1367
1368 do_query:
1369 *num_entries = 0;
1370 *info = NULL;
1371
1372 /* Return status value returned by seq number check */
1373
1374 if (!NT_STATUS_IS_OK(domain->last_status))
1375 return domain->last_status;
1376
1377 /* Put the query_user_list() in a retry loop. There appears to be
1378 * some bug either with Windows 2000 or Samba's handling of large
1379 * rpc replies. This manifests itself as sudden disconnection
1380 * at a random point in the enumeration of a large (60k) user list.
1381 * The retry loop simply tries the operation again. )-: It's not
1382 * pretty but an acceptable workaround until we work out what the
1383 * real problem is. */
1384
1385 retry = 0;
1386 do {
1387
1388 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1389 domain->name ));
1390
1391 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1392 if (!NT_STATUS_IS_OK(status)) {
1393 DEBUG(3, ("query_user_list: returned 0x%08x, "
1394 "retrying\n", NT_STATUS_V(status)));
1395 }
1396 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1397 DEBUG(3, ("query_user_list: flushing "
1398 "connection cache\n"));
1399 invalidate_cm_connection(&domain->conn);
1400 }
1401
1402 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1403 (retry++ < 5));
1404
1405 /* and save it */
1406 refresh_sequence_number(domain, false);
1407 centry = centry_start(domain, status);
1408 if (!centry)
1409 goto skip_save;
1410 centry_put_uint32(centry, *num_entries);
1411 for (i=0; i<(*num_entries); i++) {
1412 centry_put_string(centry, (*info)[i].acct_name);
1413 centry_put_string(centry, (*info)[i].full_name);
1414 centry_put_string(centry, (*info)[i].homedir);
1415 centry_put_string(centry, (*info)[i].shell);
1416 centry_put_sid(centry, &(*info)[i].user_sid);
1417 centry_put_sid(centry, &(*info)[i].group_sid);
1418 if (domain->backend && domain->backend->consistent) {
1419 /* when the backend is consistent we can pre-prime some mappings */
1420 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1421 domain->name,
1422 (*info)[i].acct_name,
1423 &(*info)[i].user_sid,
1424 SID_NAME_USER);
1425 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1426 &(*info)[i].user_sid,
1427 domain->name,
1428 (*info)[i].acct_name,
1429 SID_NAME_USER);
1430 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1431 }
1432 }
1433 centry_end(centry, "UL/%s", domain->name);
1434 centry_free(centry);
1435
1436 skip_save:
1437 return status;
1438 }
1439
1440 /* list all domain groups */
1441 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1442 TALLOC_CTX *mem_ctx,
1443 uint32 *num_entries,
1444 struct acct_info **info)
1445 {
1446 struct winbind_cache *cache = get_cache(domain);
1447 struct cache_entry *centry = NULL;
1448 NTSTATUS status;
1449 unsigned int i;
1450
1451 if (!cache->tdb)
1452 goto do_query;
1453
1454 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1455 if (!centry)
1456 goto do_query;
1457
1458 *num_entries = centry_uint32(centry);
1459
1460 if (*num_entries == 0)
1461 goto do_cached;
1462
1463 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1464 if (! (*info)) {
1465 smb_panic_fn("enum_dom_groups out of memory");
1466 }
1467 for (i=0; i<(*num_entries); i++) {
1468 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1469 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1470 (*info)[i].rid = centry_uint32(centry);
1471 }
1472
1473 do_cached:
1474 status = centry->status;
1475
1476 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1477 domain->name, nt_errstr(status) ));
1478
1479 centry_free(centry);
1480 return status;
1481
1482 do_query:
1483 *num_entries = 0;
1484 *info = NULL;
1485
1486 /* Return status value returned by seq number check */
1487
1488 if (!NT_STATUS_IS_OK(domain->last_status))
1489 return domain->last_status;
1490
1491 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1492 domain->name ));
1493
1494 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1495
1496 /* and save it */
1497 refresh_sequence_number(domain, false);
1498 centry = centry_start(domain, status);
1499 if (!centry)
1500 goto skip_save;
1501 centry_put_uint32(centry, *num_entries);
1502 for (i=0; i<(*num_entries); i++) {
1503 centry_put_string(centry, (*info)[i].acct_name);
1504 centry_put_string(centry, (*info)[i].acct_desc);
1505 centry_put_uint32(centry, (*info)[i].rid);
1506 }
1507 centry_end(centry, "GL/%s/domain", domain->name);
1508 centry_free(centry);
1509
1510 skip_save:
1511 return status;
1512 }
1513
1514 /* list all domain groups */
1515 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1516 TALLOC_CTX *mem_ctx,
1517 uint32 *num_entries,
1518 struct acct_info **info)
1519 {
1520 struct winbind_cache *cache = get_cache(domain);
1521 struct cache_entry *centry = NULL;
1522 NTSTATUS status;
1523 unsigned int i;
1524
1525 if (!cache->tdb)
1526 goto do_query;
1527
1528 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1529 if (!centry)
1530 goto do_query;
1531
1532 *num_entries = centry_uint32(centry);
1533
1534 if (*num_entries == 0)
1535 goto do_cached;
1536
1537 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1538 if (! (*info)) {
1539 smb_panic_fn("enum_dom_groups out of memory");
1540 }
1541 for (i=0; i<(*num_entries); i++) {
1542 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1543 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1544 (*info)[i].rid = centry_uint32(centry);
1545 }
1546
1547 do_cached:
1548
1549 /* If we are returning cached data and the domain controller
1550 is down then we don't know whether the data is up to date
1551 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1552 indicate this. */
1553
1554 if (wcache_server_down(domain)) {
1555 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1556 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1557 } else
1558 status = centry->status;
1559
1560 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1561 domain->name, nt_errstr(status) ));
1562
1563 centry_free(centry);
1564 return status;
1565
1566 do_query:
1567 *num_entries = 0;
1568 *info = NULL;
1569
1570 /* Return status value returned by seq number check */
1571
1572 if (!NT_STATUS_IS_OK(domain->last_status))
1573 return domain->last_status;
1574
1575 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1576 domain->name ));
1577
1578 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1579
1580 /* and save it */
1581 refresh_sequence_number(domain, false);
1582 centry = centry_start(domain, status);
1583 if (!centry)
1584 goto skip_save;
1585 centry_put_uint32(centry, *num_entries);
1586 for (i=0; i<(*num_entries); i++) {
1587 centry_put_string(centry, (*info)[i].acct_name);
1588 centry_put_string(centry, (*info)[i].acct_desc);
1589 centry_put_uint32(centry, (*info)[i].rid);
1590 }
1591 centry_end(centry, "GL/%s/local", domain->name);
1592 centry_free(centry);
1593
1594 skip_save:
1595 return status;
1596 }
1597
1598 /* convert a single name to a sid in a domain */
1599 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1600 TALLOC_CTX *mem_ctx,
1601 enum winbindd_cmd orig_cmd,
1602 const char *domain_name,
1603 const char *name,
1604 DOM_SID *sid,
1605 enum lsa_SidType *type)
1606 {
1607 struct winbind_cache *cache = get_cache(domain);
1608 struct cache_entry *centry = NULL;
1609 NTSTATUS status;
1610 fstring uname;
1611
1612 if (!cache->tdb)
1613 goto do_query;
1614
1615 fstrcpy(uname, name);
1616 strupper_m(uname);
1617 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1618 if (!centry)
1619 goto do_query;
1620
1621 status = centry->status;
1622 if (NT_STATUS_IS_OK(status)) {
1623 *type = (enum lsa_SidType)centry_uint32(centry);
1624 centry_sid(centry, mem_ctx, sid);
1625 }
1626
1627 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: %s\n",
1628 domain->name, nt_errstr(status) ));
1629
1630 centry_free(centry);
1631 return status;
1632
1633 do_query:
1634 ZERO_STRUCTP(sid);
1635
1636 /* If the seq number check indicated that there is a problem
1637 * with this DC, then return that status... except for
1638 * access_denied. This is special because the dc may be in
1639 * "restrict anonymous = 1" mode, in which case it will deny
1640 * most unauthenticated operations, but *will* allow the LSA
1641 * name-to-sid that we try as a fallback. */
1642
1643 if (!(NT_STATUS_IS_OK(domain->last_status)
1644 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1645 return domain->last_status;
1646
1647 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1648 domain->name ));
1649
1650 status = domain->backend->name_to_sid(domain, mem_ctx, orig_cmd,
1651 domain_name, name, sid, type);
1652
1653 /* and save it */
1654 refresh_sequence_number(domain, false);
1655
1656 if (domain->online &&
1657 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1658 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1659
1660 /* Only save the reverse mapping if this was not a UPN */
1661 if (!strchr(name, '@')) {
1662 strupper_m(CONST_DISCARD(char *,domain_name));
1663 strlower_m(CONST_DISCARD(char *,name));
1664 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1665 }
1666 }
1667
1668 return status;
1669 }
1670
1671 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1672 given */
1673 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1674 TALLOC_CTX *mem_ctx,
1675 const DOM_SID *sid,
1676 char **domain_name,
1677 char **name,
1678 enum lsa_SidType *type)
1679 {
1680 struct winbind_cache *cache = get_cache(domain);
1681 struct cache_entry *centry = NULL;
1682 NTSTATUS status;
1683 fstring sid_string;
1684
1685 if (!cache->tdb)
1686 goto do_query;
1687
1688 centry = wcache_fetch(cache, domain, "SN/%s",
1689 sid_to_fstring(sid_string, sid));
1690 if (!centry)
1691 goto do_query;
1692
1693 status = centry->status;
1694 if (NT_STATUS_IS_OK(status)) {
1695 *type = (enum lsa_SidType)centry_uint32(centry);
1696 *domain_name = centry_string(centry, mem_ctx);
1697 *name = centry_string(centry, mem_ctx);
1698 }
1699
1700 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: %s\n",
1701 domain->name, nt_errstr(status) ));
1702
1703 centry_free(centry);
1704 return status;
1705
1706 do_query:
1707 *name = NULL;
1708 *domain_name = NULL;
1709
1710 /* If the seq number check indicated that there is a problem
1711 * with this DC, then return that status... except for
1712 * access_denied. This is special because the dc may be in
1713 * "restrict anonymous = 1" mode, in which case it will deny
1714 * most unauthenticated operations, but *will* allow the LSA
1715 * sid-to-name that we try as a fallback. */
1716
1717 if (!(NT_STATUS_IS_OK(domain->last_status)
1718 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1719 return domain->last_status;
1720
1721 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1722 domain->name ));
1723
1724 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1725
1726 /* and save it */
1727 refresh_sequence_number(domain, false);
1728 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1729
1730 /* We can't save the name to sid mapping here, as with sid history a
1731 * later name2sid would give the wrong sid. */
1732
1733 return status;
1734 }
1735
1736 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1737 TALLOC_CTX *mem_ctx,
1738 const DOM_SID *domain_sid,
1739 uint32 *rids,
1740 size_t num_rids,
1741 char **domain_name,
1742 char ***names,
1743 enum lsa_SidType **types)
1744 {
1745 struct winbind_cache *cache = get_cache(domain);
1746 size_t i;
1747 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1748 bool have_mapped;
1749 bool have_unmapped;
1750
1751 *domain_name = NULL;
1752 *names = NULL;
1753 *types = NULL;
1754
1755 if (!cache->tdb) {
1756 goto do_query;
1757 }
1758
1759 if (num_rids == 0) {
1760 return NT_STATUS_OK;
1761 }
1762
1763 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1764 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1765
1766 if ((*names == NULL) || (*types == NULL)) {
1767 result = NT_STATUS_NO_MEMORY;
1768 goto error;
1769 }
1770
1771 have_mapped = have_unmapped = false;
1772
1773 for (i=0; i<num_rids; i++) {
1774 DOM_SID sid;
1775 struct cache_entry *centry;
1776 fstring tmp;
1777
1778 if (!sid_compose(&sid, domain_sid, rids[i])) {
1779 result = NT_STATUS_INTERNAL_ERROR;
1780 goto error;
1781 }
1782
1783 centry = wcache_fetch(cache, domain, "SN/%s",
1784 sid_to_fstring(tmp, &sid));
1785 if (!centry) {
1786 goto do_query;
1787 }
1788
1789 (*types)[i] = SID_NAME_UNKNOWN;
1790 (*names)[i] = talloc_strdup(*names, "");
1791
1792 if (NT_STATUS_IS_OK(centry->status)) {
1793 char *dom;
1794 have_mapped = true;
1795 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1796
1797 dom = centry_string(centry, mem_ctx);
1798 if (*domain_name == NULL) {
1799 *domain_name = dom;
1800 } else {
1801 talloc_free(dom);
1802 }
1803
1804 (*names)[i] = centry_string(centry, *names);
1805
1806 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1807 have_unmapped = true;
1808
1809 } else {
1810 /* something's definitely wrong */
1811 result = centry->status;
1812 goto error;
1813 }
1814
1815 centry_free(centry);
1816 }
1817
1818 if (!have_mapped) {
1819 return NT_STATUS_NONE_MAPPED;
1820 }
1821 if (!have_unmapped) {
1822 return NT_STATUS_OK;
1823 }
1824 return STATUS_SOME_UNMAPPED;
1825
1826 do_query:
1827
1828 TALLOC_FREE(*names);
1829 TALLOC_FREE(*types);
1830
1831 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1832 rids, num_rids, domain_name,
1833 names, types);
1834
1835 /*
1836 None of the queried rids has been found so save all negative entries
1837 */
1838 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1839 for (i = 0; i < num_rids; i++) {
1840 DOM_SID sid;
1841 const char *name = "";
1842 const enum lsa_SidType type = SID_NAME_UNKNOWN;
1843 NTSTATUS status = NT_STATUS_NONE_MAPPED;
1844
1845 if (!sid_compose(&sid, domain_sid, rids[i])) {
1846 return NT_STATUS_INTERNAL_ERROR;
1847 }
1848
1849 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1850 name, type);
1851 }
1852
1853 return result;
1854 }
1855
1856 /*
1857 Some or all of the queried rids have been found.
1858 */
1859 if (!NT_STATUS_IS_OK(result) &&
1860 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1861 return result;
1862 }
1863
1864 refresh_sequence_number(domain, false);
1865
1866 for (i=0; i<num_rids; i++) {
1867 DOM_SID sid;
1868 NTSTATUS status;
1869
1870 if (!sid_compose(&sid, domain_sid, rids[i])) {
1871 result = NT_STATUS_INTERNAL_ERROR;
1872 goto error;
1873 }
1874
1875 status = (*types)[i] == SID_NAME_UNKNOWN ?
1876 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1877
1878 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1879 (*names)[i], (*types)[i]);
1880 }
1881
1882 return result;
1883
1884 error:
1885
1886 TALLOC_FREE(*names);
1887 TALLOC_FREE(*types);
1888 return result;
1889 }
1890
1891 /* Lookup user information from a rid */
1892 static NTSTATUS query_user(struct winbindd_domain *domain,
1893 TALLOC_CTX *mem_ctx,
1894 const DOM_SID *user_sid,
1895 WINBIND_USERINFO *info)
1896 {
1897 struct winbind_cache *cache = get_cache(domain);
1898 struct cache_entry *centry = NULL;
1899 NTSTATUS status;
1900 fstring tmp;
1901
1902 if (!cache->tdb)
1903 goto do_query;
1904
1905 centry = wcache_fetch(cache, domain, "U/%s",
1906 sid_to_fstring(tmp, user_sid));
1907
1908 /* If we have an access denied cache entry and a cached info3 in the
1909 samlogon cache then do a query. This will force the rpc back end
1910 to return the info3 data. */
1911
1912 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1913 netsamlogon_cache_have(user_sid)) {
1914 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1915 domain->last_status = NT_STATUS_OK;
1916 centry_free(centry);
1917 goto do_query;
1918 }
1919
1920 if (!centry)
1921 goto do_query;
1922
1923 /* if status is not ok then this is a negative hit
1924 and the rest of the data doesn't matter */
1925 status = centry->status;
1926 if (NT_STATUS_IS_OK(status)) {
1927 info->acct_name = centry_string(centry, mem_ctx);
1928 info->full_name = centry_string(centry, mem_ctx);
1929 info->homedir = centry_string(centry, mem_ctx);
1930 info->shell = centry_string(centry, mem_ctx);
1931 info->primary_gid = centry_uint32(centry);
1932 centry_sid(centry, mem_ctx, &info->user_sid);
1933 centry_sid(centry, mem_ctx, &info->group_sid);
1934 }
1935
1936 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: %s\n",
1937 domain->name, nt_errstr(status) ));
1938
1939 centry_free(centry);
1940 return status;
1941
1942 do_query:
1943 ZERO_STRUCTP(info);
1944
1945 /* Return status value returned by seq number check */
1946
1947 if (!NT_STATUS_IS_OK(domain->last_status))
1948 return domain->last_status;
1949
1950 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
1951 domain->name ));
1952
1953 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
1954
1955 /* and save it */
1956 refresh_sequence_number(domain, false);
1957 wcache_save_user(domain, status, info);
1958
1959 return status;
1960 }
1961
1962
1963 /* Lookup groups a user is a member of. */
1964 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
1965 TALLOC_CTX *mem_ctx,
1966 const DOM_SID *user_sid,
1967 uint32 *num_groups, DOM_SID **user_gids)
1968 {
1969 struct winbind_cache *cache = get_cache(domain);
1970 struct cache_entry *centry = NULL;
1971 NTSTATUS status;
1972 unsigned int i;
1973 fstring sid_string;
1974
1975 if (!cache->tdb)
1976 goto do_query;
1977
1978 centry = wcache_fetch(cache, domain, "UG/%s",
1979 sid_to_fstring(sid_string, user_sid));
1980
1981 /* If we have an access denied cache entry and a cached info3 in the
1982 samlogon cache then do a query. This will force the rpc back end
1983 to return the info3 data. */
1984
1985 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1986 netsamlogon_cache_have(user_sid)) {
1987 DEBUG(10, ("lookup_usergroups: cached access denied and have cached info3\n"));
1988 domain->last_status = NT_STATUS_OK;
1989 centry_free(centry);
1990 goto do_query;
1991 }
1992
1993 if (!centry)
1994 goto do_query;
1995
1996 *num_groups = centry_uint32(centry);
1997
1998 if (*num_groups == 0)
1999 goto do_cached;
2000
2001 (*user_gids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_groups);
2002 if (! (*user_gids)) {
2003 smb_panic_fn("lookup_usergroups out of memory");
2004 }
2005 for (i=0; i<(*num_groups); i++) {
2006 centry_sid(centry, mem_ctx, &(*user_gids)[i]);
2007 }
2008
2009 do_cached:
2010 status = centry->status;
2011
2012 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status: %s\n",
2013 domain->name, nt_errstr(status) ));
2014
2015 centry_free(centry);
2016 return status;
2017
2018 do_query:
2019 (*num_groups) = 0;
2020 (*user_gids) = NULL;
2021
2022 /* Return status value returned by seq number check */
2023
2024 if (!NT_STATUS_IS_OK(domain->last_status))
2025 return domain->last_status;
2026
2027 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2028 domain->name ));
2029
2030 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2031
2032 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2033 goto skip_save;
2034
2035 /* and save it */
2036 refresh_sequence_number(domain, false);
2037 centry = centry_start(domain, status);
2038 if (!centry)
2039 goto skip_save;
2040
2041 centry_put_uint32(centry, *num_groups);
2042 for (i=0; i<(*num_groups); i++) {
2043 centry_put_sid(centry, &(*user_gids)[i]);
2044 }
2045
2046 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2047 centry_free(centry);
2048
2049 skip_save:
2050 return status;
2051 }
2052
2053 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2054 TALLOC_CTX *mem_ctx,
2055 uint32 num_sids, const DOM_SID *sids,
2056 uint32 *num_aliases, uint32 **alias_rids)
2057 {
2058 struct winbind_cache *cache = get_cache(domain);
2059 struct cache_entry *centry = NULL;
2060 NTSTATUS status;
2061 char *sidlist = talloc_strdup(mem_ctx, "");
2062 int i;
2063
2064 if (!cache->tdb)
2065 goto do_query;
2066
2067 if (num_sids == 0) {
2068 *num_aliases = 0;
2069 *alias_rids = NULL;
2070 return NT_STATUS_OK;
2071 }
2072
2073 /* We need to cache indexed by the whole list of SIDs, the aliases
2074 * resulting might come from any of the SIDs. */
2075
2076 for (i=0; i<num_sids; i++) {
2077 fstring tmp;
2078 sidlist = talloc_asprintf(mem_ctx, "%s/%s", sidlist,
2079 sid_to_fstring(tmp, &sids[i]));
2080 if (sidlist == NULL)
2081 return NT_STATUS_NO_MEMORY;
2082 }
2083
2084 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2085
2086 if (!centry)
2087 goto do_query;
2088
2089 *num_aliases = centry_uint32(centry);
2090 *alias_rids = NULL;
2091
2092 if (*num_aliases) {
2093 (*alias_rids) = TALLOC_ARRAY(mem_ctx, uint32, *num_aliases);
2094
2095 if ((*alias_rids) == NULL) {
2096 centry_free(centry);
2097 return NT_STATUS_NO_MEMORY;
2098 }
2099 } else {
2100 (*alias_rids) = NULL;
2101 }
2102
2103 for (i=0; i<(*num_aliases); i++)
2104 (*alias_rids)[i] = centry_uint32(centry);
2105
2106 status = centry->status;
2107
2108 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2109 "status %s\n", domain->name, nt_errstr(status)));
2110
2111 centry_free(centry);
2112 return status;
2113
2114 do_query:
2115 (*num_aliases) = 0;
2116 (*alias_rids) = NULL;
2117
2118 if (!NT_STATUS_IS_OK(domain->last_status))
2119 return domain->last_status;
2120
2121 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2122 "for domain %s\n", domain->name ));
2123
2124 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2125 num_sids, sids,
2126 num_aliases, alias_rids);
2127
2128 /* and save it */
2129 refresh_sequence_number(domain, false);
2130 centry = centry_start(domain, status);
2131 if (!centry)
2132 goto skip_save;
2133 centry_put_uint32(centry, *num_aliases);
2134 for (i=0; i<(*num_aliases); i++)
2135 centry_put_uint32(centry, (*alias_rids)[i]);
2136 centry_end(centry, "UA%s", sidlist);
2137 centry_free(centry);
2138
2139 skip_save:
2140 return status;
2141 }
2142
2143
2144 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2145 TALLOC_CTX *mem_ctx,
2146 const DOM_SID *group_sid, uint32 *num_names,
2147 DOM_SID **sid_mem, char ***names,
2148 uint32 **name_types)
2149 {
2150 struct winbind_cache *cache = get_cache(domain);
2151 struct cache_entry *centry = NULL;
2152 NTSTATUS status;
2153 unsigned int i;
2154 fstring sid_string;
2155
2156 if (!cache->tdb)
2157 goto do_query;
2158
2159 centry = wcache_fetch(cache, domain, "GM/%s",
2160 sid_to_fstring(sid_string, group_sid));
2161 if (!centry)
2162 goto do_query;
2163
2164 *num_names = centry_uint32(centry);
2165
2166 if (*num_names == 0)
2167 goto do_cached;
2168
2169 (*sid_mem) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_names);
2170 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
2171 (*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
2172
2173 if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
2174 smb_panic_fn("lookup_groupmem out of memory");
2175 }
2176
2177 for (i=0; i<(*num_names); i++) {
2178 centry_sid(centry, mem_ctx, &(*sid_mem)[i]);
2179 (*names)[i] = centry_string(centry, mem_ctx);
2180 (*name_types)[i] = centry_uint32(centry);
2181 }
2182
2183 do_cached:
2184 status = centry->status;
2185
2186 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status: %s\n",
2187 domain->name, nt_errstr(status)));
2188
2189 centry_free(centry);
2190 return status;
2191
2192 do_query:
2193 (*num_names) = 0;
2194 (*sid_mem) = NULL;
2195 (*names) = NULL;
2196 (*name_types) = NULL;
2197
2198 /* Return status value returned by seq number check */
2199
2200 if (!NT_STATUS_IS_OK(domain->last_status))
2201 return domain->last_status;
2202
2203 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2204 domain->name ));
2205
2206 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2207 sid_mem, names, name_types);
2208
2209 /* and save it */
2210 refresh_sequence_number(domain, false);
2211 centry = centry_start(domain, status);
2212 if (!centry)
2213 goto skip_save;
2214 centry_put_uint32(centry, *num_names);
2215 for (i=0; i<(*num_names); i++) {
2216 centry_put_sid(centry, &(*sid_mem)[i]);
2217 centry_put_string(centry, (*names)[i]);
2218 centry_put_uint32(centry, (*name_types)[i]);
2219 }
2220 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2221 centry_free(centry);
2222
2223 skip_save:
2224 return status;
2225 }
2226
2227 /* find the sequence number for a domain */
2228 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2229 {
2230 refresh_sequence_number(domain, false);
2231
2232 *seq = domain->sequence_number;
2233
2234 return NT_STATUS_OK;
2235 }
2236
2237 /* enumerate trusted domains
2238 * (we need to have the list of trustdoms in the cache when we go offline) -
2239 * Guenther */
2240 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2241 TALLOC_CTX *mem_ctx,
2242 uint32 *num_domains,
2243 char ***names,
2244 char ***alt_names,
2245 DOM_SID **dom_sids)
2246 {
2247 struct winbind_cache *cache = get_cache(domain);
2248 struct cache_entry *centry = NULL;
2249 NTSTATUS status;
2250 int i;
2251
2252 if (!cache->tdb)
2253 goto do_query;
2254
2255 centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2256
2257 if (!centry) {
2258 goto do_query;
2259 }
2260
2261 *num_domains = centry_uint32(centry);
2262
2263 if (*num_domains) {
2264 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2265 (*alt_names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2266 (*dom_sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2267
2268 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2269 smb_panic_fn("trusted_domains out of memory");
2270 }
2271 } else {
2272 (*names) = NULL;
2273 (*alt_names) = NULL;
2274 (*dom_sids) = NULL;
2275 }
2276
2277 for (i=0; i<(*num_domains); i++) {
2278 (*names)[i] = centry_string(centry, mem_ctx);
2279 (*alt_names)[i] = centry_string(centry, mem_ctx);
2280 if (!centry_sid(centry, mem_ctx, &(*dom_sids)[i])) {
2281 sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2282 }
2283 }
2284
2285 status = centry->status;
2286
2287 DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2288 domain->name, *num_domains, nt_errstr(status) ));
2289
2290 centry_free(centry);
2291 return status;
2292
2293 do_query:
2294 (*num_domains) = 0;
2295 (*dom_sids) = NULL;
2296 (*names) = NULL;
2297 (*alt_names) = NULL;
2298
2299 /* Return status value returned by seq number check */
2300
2301 if (!NT_STATUS_IS_OK(domain->last_status))
2302 return domain->last_status;
2303
2304 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2305 domain->name ));
2306
2307 status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2308 names, alt_names, dom_sids);
2309
2310 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2311 * so that the generic centry handling still applies correctly -
2312 * Guenther*/
2313
2314 if (!NT_STATUS_IS_ERR(status)) {
2315 status = NT_STATUS_OK;
2316 }
2317
2318
2319 #if 0 /* Disabled as we want the trust dom list to be managed by
2320 the main parent and always to make the query. --jerry */
2321
2322 /* and save it */
2323 refresh_sequence_number(domain, false);
2324
2325 centry = centry_start(domain, status);
2326 if (!centry)
2327 goto skip_save;
2328
2329 centry_put_uint32(centry, *num_domains);
2330
2331 for (i=0; i<(*num_domains); i++) {
2332 centry_put_string(centry, (*names)[i]);
2333 centry_put_string(centry, (*alt_names)[i]);
2334 centry_put_sid(centry, &(*dom_sids)[i]);
2335 }
2336
2337 centry_end(centry, "TRUSTDOMS/%s", domain->name);
2338
2339 centry_free(centry);
2340
2341 skip_save:
2342 #endif
2343
2344 return status;
2345 }
2346
2347 /* get lockout policy */
2348 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2349 TALLOC_CTX *mem_ctx,
2350 struct samr_DomInfo12 *policy)
2351 {
2352 struct winbind_cache *cache = get_cache(domain);
2353 struct cache_entry *centry = NULL;
2354 NTSTATUS status;
2355
2356 if (!cache->tdb)
2357 goto do_query;
2358
2359 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2360
2361 if (!centry)
2362 goto do_query;
2363
2364 policy->lockout_duration = centry_nttime(centry);
2365 policy->lockout_window = centry_nttime(centry);
2366 policy->lockout_threshold = centry_uint16(centry);
2367
2368 status = centry->status;
2369
2370 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2371 domain->name, nt_errstr(status) ));
2372
2373 centry_free(centry);
2374 return status;
2375
2376 do_query:
2377 ZERO_STRUCTP(policy);
2378
2379 /* Return status value returned by seq number check */
2380
2381 if (!NT_STATUS_IS_OK(domain->last_status))
2382 return domain->last_status;
2383
2384 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2385 domain->name ));
2386
2387 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2388
2389 /* and save it */
2390 refresh_sequence_number(domain, false);
2391 wcache_save_lockout_policy(domain, status, policy);
2392
2393 return status;
2394 }
2395
2396 /* get password policy */
2397 static NTSTATUS password_policy(struct winbindd_domain *domain,
2398 TALLOC_CTX *mem_ctx,
2399 struct samr_DomInfo1 *policy)
2400 {
2401 struct winbind_cache *cache = get_cache(domain);
2402 struct cache_entry *centry = NULL;
2403 NTSTATUS status;
2404
2405 if (!cache->tdb)
2406 goto do_query;
2407
2408 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2409
2410 if (!centry)
2411 goto do_query;
2412
2413 policy->min_password_length = centry_uint16(centry);
2414 policy->password_history_length = centry_uint16(centry);
2415 policy->password_properties = centry_uint32(centry);
2416 policy->max_password_age = centry_nttime(centry);
2417 policy->min_password_age = centry_nttime(centry);
2418
2419 status = centry->status;
2420
2421 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2422 domain->name, nt_errstr(status) ));
2423
2424 centry_free(centry);
2425 return status;
2426
2427 do_query:
2428 ZERO_STRUCTP(policy);
2429
2430 /* Return status value returned by seq number check */
2431
2432 if (!NT_STATUS_IS_OK(domain->last_status))
2433 return domain->last_status;
2434
2435 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2436 domain->name ));
2437
2438 status = domain->backend->password_policy(domain, mem_ctx, policy);
2439
2440 /* and save it */
2441 refresh_sequence_number(domain, false);
2442 if (NT_STATUS_IS_OK(status)) {
2443 wcache_save_password_policy(domain, status, policy);
2444 }
2445
2446 return status;
2447 }
2448
2449
2450 /* Invalidate cached user and group lists coherently */
2451
2452 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2453 void *state)
2454 {
2455 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2456 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2457 tdb_delete(the_tdb, kbuf);
2458
2459 return 0;
2460 }
2461
2462 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2463
2464 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2465 struct netr_SamInfo3 *info3)
2466 {
2467 DOM_SID sid;
2468 fstring key_str, sid_string;
2469 struct winbind_cache *cache;
2470
2471 /* dont clear cached U/SID and UG/SID entries when we want to logon
2472 * offline - gd */
2473
2474 if (lp_winbind_offline_logon()) {
2475 return;
2476 }
2477
2478 if (!domain)
2479 return;
2480
2481 cache = get_cache(domain);
2482
2483 if (!cache->tdb) {
2484 return;
2485 }
2486
2487 sid_copy(&sid, info3->base.domain_sid);
2488 sid_append_rid(&sid, info3->base.rid);
2489
2490 /* Clear U/SID cache entry */
2491 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2492 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2493 tdb_delete(cache->tdb, string_tdb_data(key_str));
2494
2495 /* Clear UG/SID cache entry */
2496 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2497 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2498 tdb_delete(cache->tdb, string_tdb_data(key_str));
2499
2500 /* Samba/winbindd never needs this. */
2501 netsamlogon_clear_cached_user(info3);
2502 }
2503
2504 bool wcache_invalidate_cache(void)
2505 {
2506 struct winbindd_domain *domain;
2507
2508 for (domain = domain_list(); domain; domain = domain->next) {
2509 struct winbind_cache *cache = get_cache(domain);
2510
2511 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2512 "entries for %s\n", domain->name));
2513 if (cache) {
2514 if (cache->tdb) {
2515 tdb_traverse(cache->tdb, traverse_fn, NULL);
2516 } else {
2517 return false;
2518 }
2519 }
2520 }
2521 return true;
2522 }
2523
2524 bool init_wcache(void)
2525 {
2526 if (wcache == NULL) {
2527 wcache = SMB_XMALLOC_P(struct winbind_cache);
2528 ZERO_STRUCTP(wcache);
2529 }
2530
2531 if (wcache->tdb != NULL)
2532 return true;
2533
2534 /* when working offline we must not clear the cache on restart */
2535 wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
2536 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2537 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2538 O_RDWR|O_CREAT, 0600);
2539
2540 if (wcache->tdb == NULL) {
2541 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2542 return false;
2543 }
2544
2545 return true;
2546 }
2547
2548 /************************************************************************
2549 This is called by the parent to initialize the cache file.
2550 We don't need sophisticated locking here as we know we're the
2551 only opener.
2552 ************************************************************************/
2553
2554 bool initialize_winbindd_cache(void)
2555 {
2556 bool cache_bad = true;
2557 uint32 vers;
2558
2559 if (!init_wcache()) {
2560 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2561 return false;
2562 }
2563
2564 /* Check version number. */
2565 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2566 vers == WINBINDD_CACHE_VERSION) {
2567 cache_bad = false;
2568 }
2569
2570 if (cache_bad) {
2571 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2572 "and re-creating with version number %d\n",
2573 WINBINDD_CACHE_VERSION ));
2574
2575 tdb_close(wcache->tdb);
2576 wcache->tdb = NULL;
2577
2578 if (unlink(lock_path("winbindd_cache.tdb")) == -1) {
2579 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2580 lock_path("winbindd_cache.tdb"),
2581 strerror(errno) ));
2582 return false;
2583 }
2584 if (!init_wcache()) {
2585 DEBUG(0,("initialize_winbindd_cache: re-initialization "
2586 "init_wcache failed.\n"));
2587 return false;
2588 }
2589
2590 /* Write the version. */
2591 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2592 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2593 tdb_errorstr(wcache->tdb) ));
2594 return false;
2595 }
2596 }
2597
2598 tdb_close(wcache->tdb);
2599 wcache->tdb = NULL;
2600 return true;
2601 }
2602
2603 void close_winbindd_cache(void)
2604 {
2605 if (!wcache) {
2606 return;
2607 }
2608 if (wcache->tdb) {
2609 tdb_close(wcache->tdb);
2610 wcache->tdb = NULL;
2611 }
2612 }
2613
2614 void cache_store_response(pid_t pid, struct winbindd_response *response)
2615 {
2616 fstring key_str;
2617
2618 if (!init_wcache())
2619 return;
2620
2621 DEBUG(10, ("Storing response for pid %d, len %d\n",
2622 pid, response->length));
2623
2624 fstr_sprintf(key_str, "DR/%d", pid);
2625 if (tdb_store(wcache->tdb, string_tdb_data(key_str),
2626 make_tdb_data((uint8 *)response, sizeof(*response)),
2627 TDB_REPLACE) == -1)
2628 return;
2629
2630 if (response->length == sizeof(*response))
2631 return;
2632
2633 /* There's extra data */
2634
2635 DEBUG(10, ("Storing extra data: len=%d\n",
2636 (int)(response->length - sizeof(*response))));
2637
2638 fstr_sprintf(key_str, "DE/%d", pid);
2639 if (tdb_store(wcache->tdb, string_tdb_data(key_str),
2640 make_tdb_data((uint8 *)response->extra_data.data,
2641 response->length - sizeof(*response)),
2642 TDB_REPLACE) == 0)
2643 return;
2644
2645 /* We could not store the extra data, make sure the tdb does not
2646 * contain a main record with wrong dangling extra data */
2647
2648 fstr_sprintf(key_str, "DR/%d", pid);
2649 tdb_delete(wcache->tdb, string_tdb_data(key_str));
2650
2651 return;
2652 }
2653
2654 bool cache_retrieve_response(pid_t pid, struct winbindd_response * response)
2655 {
2656 TDB_DATA data;
2657 fstring key_str;
2658
2659 if (!init_wcache())
2660 return false;
2661
2662 DEBUG(10, ("Retrieving response for pid %d\n", pid));
2663
2664 fstr_sprintf(key_str, "DR/%d", pid);
2665 data = tdb_fetch(wcache->tdb, string_tdb_data(key_str));
2666
2667 if (data.dptr == NULL)
2668 return false;
2669
2670 if (data.dsize != sizeof(*response))
2671 return false;
2672
2673 memcpy(response, data.dptr, data.dsize);
2674 SAFE_FREE(data.dptr);
2675
2676 if (response->length == sizeof(*response)) {
2677 response->extra_data.data = NULL;
2678 return true;
2679 }
2680
2681 /* There's extra data */
2682
2683 DEBUG(10, ("Retrieving extra data length=%d\n",
2684 (int)(response->length - sizeof(*response))));
2685
2686 fstr_sprintf(key_str, "DE/%d", pid);
2687 data = tdb_fetch(wcache->tdb, string_tdb_data(key_str));
2688
2689 if (data.dptr == NULL) {
2690 DEBUG(0, ("Did not find extra data\n"));
2691 return false;
2692 }
2693
2694 if (data.dsize != (response->length - sizeof(*response))) {
2695 DEBUG(0, ("Invalid extra data length: %d\n", (int)data.dsize));
2696 SAFE_FREE(data.dptr);
2697 return false;
2698 }
2699
2700 dump_data(11, (uint8 *)data.dptr, data.dsize);
2701
2702 response->extra_data.data = data.dptr;
2703 return true;
2704 }
2705
2706 void cache_cleanup_response(pid_t pid)
2707 {
2708 fstring key_str;
2709
2710 if (!init_wcache())
2711 return;
2712
2713 fstr_sprintf(key_str, "DR/%d", pid);
2714 tdb_delete(wcache->tdb, string_tdb_data(key_str));
2715
2716 fstr_sprintf(key_str, "DE/%d", pid);
2717 tdb_delete(wcache->tdb, string_tdb_data(key_str));
2718
2719 return;
2720 }
2721
2722
2723 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2724 char **domain_name, char **name,
2725 enum lsa_SidType *type)
2726 {
2727 struct winbindd_domain *domain;
2728 struct winbind_cache *cache;
2729 struct cache_entry *centry = NULL;
2730 NTSTATUS status;
2731 fstring tmp;
2732
2733 domain = find_lookup_domain_from_sid(sid);
2734 if (domain == NULL) {
2735 return false;
2736 }
2737
2738 cache = get_cache(domain);
2739
2740 if (cache->tdb == NULL) {
2741 return false;
2742 }
2743
2744 centry = wcache_fetch(cache, domain, "SN/%s",
2745 sid_to_fstring(tmp, sid));
2746 if (centry == NULL) {
2747 return false;
2748 }
2749
2750 if (NT_STATUS_IS_OK(centry->status)) {
2751 *type = (enum lsa_SidType)centry_uint32(centry);
2752 *domain_name = centry_string(centry, mem_ctx);
2753 *name = centry_string(centry, mem_ctx);
2754 }
2755
2756 status = centry->status;
2757 centry_free(centry);
2758 return NT_STATUS_IS_OK(status);
2759 }
2760
2761 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2762 const char *domain_name,
2763 const char *name,
2764 DOM_SID *sid,
2765 enum lsa_SidType *type)
2766 {
2767 struct winbindd_domain *domain;
2768 struct winbind_cache *cache;
2769 struct cache_entry *centry = NULL;
2770 NTSTATUS status;
2771 fstring uname;
2772 bool original_online_state;
2773
2774 domain = find_lookup_domain_from_name(domain_name);
2775 if (domain == NULL) {
2776 return false;
2777 }
2778
2779 cache = get_cache(domain);
2780
2781 if (cache->tdb == NULL) {
2782 return false;
2783 }
2784
2785 fstrcpy(uname, name);
2786 strupper_m(uname);
2787
2788 /* If we are doing a cached logon, temporarily set the domain
2789 offline so the cache won't expire the entry */
2790
2791 original_online_state = domain->online;
2792 domain->online = false;
2793 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
2794 domain->online = original_online_state;
2795
2796 if (centry == NULL) {
2797 return false;
2798 }
2799
2800 if (NT_STATUS_IS_OK(centry->status)) {
2801 *type = (enum lsa_SidType)centry_uint32(centry);
2802 centry_sid(centry, mem_ctx, sid);
2803 }
2804
2805 status = centry->status;
2806 centry_free(centry);
2807
2808 return NT_STATUS_IS_OK(status);
2809 }
2810
2811 void cache_name2sid(struct winbindd_domain *domain,
2812 const char *domain_name, const char *name,
2813 enum lsa_SidType type, const DOM_SID *sid)
2814 {
2815 refresh_sequence_number(domain, false);
2816 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2817 sid, type);
2818 }
2819
2820 /*
2821 * The original idea that this cache only contains centries has
2822 * been blurred - now other stuff gets put in here. Ensure we
2823 * ignore these things on cleanup.
2824 */
2825
2826 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2827 TDB_DATA dbuf, void *state)
2828 {
2829 struct cache_entry *centry;
2830
2831 if (is_non_centry_key(kbuf)) {
2832 return 0;
2833 }
2834
2835 centry = wcache_fetch_raw((char *)kbuf.dptr);
2836 if (!centry) {
2837 return 0;
2838 }
2839
2840 if (!NT_STATUS_IS_OK(centry->status)) {
2841 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2842 tdb_delete(the_tdb, kbuf);
2843 }
2844
2845 centry_free(centry);
2846 return 0;
2847 }
2848
2849 /* flush the cache */
2850 void wcache_flush_cache(void)
2851 {
2852 if (!wcache)
2853 return;
2854 if (wcache->tdb) {
2855 tdb_close(wcache->tdb);
2856 wcache->tdb = NULL;
2857 }
2858 if (opt_nocache)
2859 return;
2860
2861 /* when working offline we must not clear the cache on restart */
2862 wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
2863 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2864 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2865 O_RDWR|O_CREAT, 0600);
2866
2867 if (!wcache->tdb) {
2868 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2869 return;
2870 }
2871
2872 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2873
2874 DEBUG(10,("wcache_flush_cache success\n"));
2875 }
2876
2877 /* Count cached creds */
2878
2879 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2880 void *state)
2881 {
2882 int *cred_count = (int*)state;
2883
2884 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2885 (*cred_count)++;
2886 }
2887 return 0;
2888 }
2889
2890 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2891 {
2892 struct winbind_cache *cache = get_cache(domain);
2893
2894 *count = 0;
2895
2896 if (!cache->tdb) {
2897 return NT_STATUS_INTERNAL_DB_ERROR;
2898 }
2899
2900 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2901
2902 return NT_STATUS_OK;
2903 }
2904
2905 struct cred_list {
2906 struct cred_list *prev, *next;
2907 TDB_DATA key;
2908 fstring name;
2909 time_t created;
2910 };
2911 static struct cred_list *wcache_cred_list;
2912
2913 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2914 void *state)
2915 {
2916 struct cred_list *cred;
2917
2918 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2919
2920 cred = SMB_MALLOC_P(struct cred_list);
2921 if (cred == NULL) {
2922 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2923 return -1;
2924 }
2925
2926 ZERO_STRUCTP(cred);
2927
2928 /* save a copy of the key */
2929
2930 fstrcpy(cred->name, (const char *)kbuf.dptr);
2931 DLIST_ADD(wcache_cred_list, cred);
2932 }
2933
2934 return 0;
2935 }
2936
2937 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2938 {
2939 struct winbind_cache *cache = get_cache(domain);
2940 NTSTATUS status;
2941 int ret;
2942 struct cred_list *cred, *oldest = NULL;
2943
2944 if (!cache->tdb) {
2945 return NT_STATUS_INTERNAL_DB_ERROR;
2946 }
2947
2948 /* we possibly already have an entry */
2949 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2950
2951 fstring key_str, tmp;
2952
2953 DEBUG(11,("we already have an entry, deleting that\n"));
2954
2955 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2956
2957 tdb_delete(cache->tdb, string_tdb_data(key_str));
2958
2959 return NT_STATUS_OK;
2960 }
2961
2962 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2963 if (ret == 0) {
2964 return NT_STATUS_OK;
2965 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
2966 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2967 }
2968
2969 ZERO_STRUCTP(oldest);
2970
2971 for (cred = wcache_cred_list; cred; cred = cred->next) {
2972
2973 TDB_DATA data;
2974 time_t t;
2975
2976 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
2977 if (!data.dptr) {
2978 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
2979 cred->name));
2980 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2981 goto done;
2982 }
2983
2984 t = IVAL(data.dptr, 0);
2985 SAFE_FREE(data.dptr);
2986
2987 if (!oldest) {
2988 oldest = SMB_MALLOC_P(struct cred_list);
2989 if (oldest == NULL) {
2990 status = NT_STATUS_NO_MEMORY;
2991 goto done;
2992 }
2993
2994 fstrcpy(oldest->name, cred->name);
2995 oldest->created = t;
2996 continue;
2997 }
2998
2999 if (t < oldest->created) {
3000 fstrcpy(oldest->name, cred->name);
3001 oldest->created = t;
3002 }
3003 }
3004
3005 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3006 status = NT_STATUS_OK;
3007 } else {
3008 status = NT_STATUS_UNSUCCESSFUL;
3009 }
3010 done:
3011 SAFE_FREE(wcache_cred_list);
3012 SAFE_FREE(oldest);
3013
3014 return status;
3015 }
3016
3017 /* Change the global online/offline state. */
3018 bool set_global_winbindd_state_offline(void)
3019 {
3020 TDB_DATA data;
3021
3022 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3023
3024 /* Only go offline if someone has created
3025 the key "WINBINDD_OFFLINE" in the cache tdb. */
3026
3027 if (wcache == NULL || wcache->tdb == NULL) {
3028 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3029 return false;
3030 }
3031
3032 if (!lp_winbind_offline_logon()) {
3033 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3034 return false;
3035 }
3036
3037 if (global_winbindd_offline_state) {
3038 /* Already offline. */
3039 return true;
3040 }
3041
3042 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3043
3044 if (!data.dptr || data.dsize != 4) {
3045 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3046 SAFE_FREE(data.dptr);
3047 return false;
3048 } else {
3049 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3050 global_winbindd_offline_state = true;
3051 SAFE_FREE(data.dptr);
3052 return true;
3053 }
3054 }
3055
3056 void set_global_winbindd_state_online(void)
3057 {
3058 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3059
3060 if (!lp_winbind_offline_logon()) {
3061 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3062 return;
3063 }
3064
3065 if (!global_winbindd_offline_state) {
3066 /* Already online. */
3067 return;
3068 }
3069 global_winbindd_offline_state = false;
3070
3071 if (!wcache->tdb) {
3072 return;
3073 }
3074
3075 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3076 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3077 }
3078
3079 bool get_global_winbindd_state_offline(void)
3080 {
3081 return global_winbindd_offline_state;
3082 }
3083
3084 /***********************************************************************
3085 Validate functions for all possible cache tdb keys.
3086 ***********************************************************************/
3087
3088 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3089 struct tdb_validation_status *state)
3090 {
3091 struct cache_entry *centry;
3092
3093 centry = SMB_XMALLOC_P(struct cache_entry);
3094 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3095 if (!centry->data) {
3096 SAFE_FREE(centry);
3097 return NULL;
3098 }
3099 centry->len = data.dsize;
3100 centry->ofs = 0;
3101
3102 if (centry->len < 8) {
3103 /* huh? corrupt cache? */
3104 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3105 centry_free(centry);
3106 state->bad_entry = true;
3107 state->success = false;
3108 return NULL;
3109 }
3110
3111 centry->status = NT_STATUS(centry_uint32(centry));
3112 centry->sequence_number = centry_uint32(centry);
3113 return centry;
3114 }
3115
3116 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3117 struct tdb_validation_status *state)
3118 {
3119 if (dbuf.dsize != 8) {
3120 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3121 keystr, (unsigned int)dbuf.dsize ));
3122 state->bad_entry = true;
3123 return 1;
3124 }
3125 return 0;
3126 }
3127
3128 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3129 struct tdb_validation_status *state)
3130 {
3131 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3132 if (!centry) {
3133 return 1;
3134 }
3135
3136 (void)centry_uint32(centry);
3137 if (NT_STATUS_IS_OK(centry->status)) {
3138 DOM_SID sid;
3139 (void)centry_sid(centry, mem_ctx, &sid);
3140 }
3141
3142 centry_free(centry);
3143
3144 if (!(state->success)) {
3145 return 1;
3146 }
3147 DEBUG(10,("validate_ns: %s ok\n", keystr));
3148 return 0;
3149 }
3150
3151 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3152 struct tdb_validation_status *state)
3153 {
3154 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3155 if (!centry) {
3156 return 1;
3157 }
3158
3159 if (NT_STATUS_IS_OK(centry->status)) {
3160 (void)centry_uint32(centry);
3161 (void)centry_string(centry, mem_ctx);
3162 (void)centry_string(centry, mem_ctx);
3163 }
3164
3165 centry_free(centry);
3166
3167 if (!(state->success)) {
3168 return 1;
3169 }
3170 DEBUG(10,("validate_sn: %s ok\n", keystr));
3171 return 0;
3172 }
3173
3174 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3175 struct tdb_validation_status *state)
3176 {
3177 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3178 DOM_SID sid;
3179
3180 if (!centry) {
3181 return 1;
3182 }
3183
3184 (void)centry_string(centry, mem_ctx);
3185 (void)centry_string(centry, mem_ctx);
3186 (void)centry_string(centry, mem_ctx);
3187 (void)centry_string(centry, mem_ctx);
3188 (void)centry_uint32(centry);
3189 (void)centry_sid(centry, mem_ctx, &sid);
3190 (void)centry_sid(centry, mem_ctx, &sid);
3191
3192 centry_free(centry);
3193
3194 if (!(state->success)) {
3195 return 1;
3196 }
3197 DEBUG(10,("validate_u: %s ok\n", keystr));
3198 return 0;
3199 }
3200
3201 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3202 struct tdb_validation_status *state)
3203 {
3204 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3205
3206 if (!centry) {
3207 return 1;
3208 }
3209
3210 (void)centry_nttime(centry);
3211 (void)centry_nttime(centry);
3212 (void)centry_uint16(centry);
3213
3214 centry_free(centry);
3215
3216 if (!(state->success)) {
3217 return 1;
3218 }
3219 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3220 return 0;
3221 }
3222
3223 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3224 struct tdb_validation_status *state)
3225 {
3226 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3227
3228 if (!centry) {
3229 return 1;
3230 }
3231
3232 (void)centry_uint16(centry);
3233 (void)centry_uint16(centry);
3234 (void)centry_uint32(centry);
3235 (void)centry_nttime(centry);
3236 (void)centry_nttime(centry);
3237
3238 centry_free(centry);
3239
3240 if (!(state->success)) {
3241 return 1;
3242 }
3243 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3244 return 0;
3245 }
3246
3247 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3248 struct tdb_validation_status *state)
3249 {
3250 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3251
3252 if (!centry) {
3253 return 1;
3254 }
3255
3256 (void)centry_time(centry);
3257 (void)centry_hash16(centry, mem_ctx);
3258
3259 /* We only have 17 bytes more data in the salted cred case. */
3260 if (centry->len - centry->ofs == 17) {
3261 (void)centry_hash16(centry, mem_ctx);
3262 }
3263
3264 centry_free(centry);
3265
3266 if (!(state->success)) {
3267 return 1;
3268 }
3269 DEBUG(10,("validate_cred: %s ok\n", keystr));
3270 return 0;
3271 }
3272
3273 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3274 struct tdb_validation_status *state)
3275 {
3276 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3277 int32 num_entries, i;
3278
3279 if (!centry) {
3280 return 1;
3281 }
3282
3283 num_entries = (int32)centry_uint32(centry);
3284
3285 for (i=0; i< num_entries; i++) {
3286 DOM_SID sid;
3287 (void)centry_string(centry, mem_ctx);
3288 (void)centry_string(centry, mem_ctx);
3289 (void)centry_string(centry, mem_ctx);
3290 (void)centry_string(centry, mem_ctx);
3291 (void)centry_sid(centry, mem_ctx, &sid);
3292 (void)centry_sid(centry, mem_ctx, &sid);
3293 }
3294
3295 centry_free(centry);
3296
3297 if (!(state->success)) {
3298 return 1;
3299 }
3300 DEBUG(10,("validate_ul: %s ok\n", keystr));
3301 return 0;
3302 }
3303
3304 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3305 struct tdb_validation_status *state)
3306 {
3307 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3308 int32 num_entries, i;
3309
3310 if (!centry) {
3311 return 1;
3312 }
3313
3314 num_entries = centry_uint32(centry);
3315
3316 for (i=0; i< num_entries; i++) {
3317 (void)centry_string(centry, mem_ctx);
3318 (void)centry_string(centry, mem_ctx);
3319 (void)centry_uint32(centry);
3320 }
3321
3322 centry_free(centry);
3323
3324 if (!(state->success)) {
3325 return 1;
3326 }
3327 DEBUG(10,("validate_gl: %s ok\n", keystr));
3328 return 0;
3329 }
3330
3331 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3332 struct tdb_validation_status *state)
3333 {
3334 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3335 int32 num_groups, i;
3336
3337 if (!centry) {
3338 return 1;
3339 }
3340
3341 num_groups = centry_uint32(centry);
3342
3343 for (i=0; i< num_groups; i++) {
3344 DOM_SID sid;
3345 centry_sid(centry, mem_ctx, &sid);
3346 }
3347
3348 centry_free(centry);
3349
3350 if (!(state->success)) {
3351 return 1;
3352 }
3353 DEBUG(10,("validate_ug: %s ok\n", keystr));
3354 return 0;
3355 }
3356
3357 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3358 struct tdb_validation_status *state)
3359 {
3360 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3361 int32 num_aliases, i;
3362
3363 if (!centry) {
3364 return 1;
3365 }
3366
3367 num_aliases = centry_uint32(centry);
3368
3369 for (i=0; i < num_aliases; i++) {
3370 (void)centry_uint32(centry);
3371 }
3372
3373 centry_free(centry);
3374
3375 if (!(state->success)) {
3376 return 1;
3377 }
3378 DEBUG(10,("validate_ua: %s ok\n", keystr));
3379 return 0;
3380 }
3381
3382 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3383 struct tdb_validation_status *state)
3384 {
3385 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3386 int32 num_names, i;
3387
3388 if (!centry) {
3389 return 1;
3390 }
3391
3392 num_names = centry_uint32(centry);
3393
3394 for (i=0; i< num_names; i++) {
3395 DOM_SID sid;
3396 centry_sid(centry, mem_ctx, &sid);
3397 (void)centry_string(centry, mem_ctx);
3398 (void)centry_uint32(centry);
3399 }
3400
3401 centry_free(centry);
3402
3403 if (!(state->success)) {
3404 return 1;
3405 }
3406 DEBUG(10,("validate_gm: %s ok\n", keystr));
3407 return 0;
3408 }
3409
3410 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3411 struct tdb_validation_status *state)
3412 {
3413 /* Can't say anything about this other than must be nonzero. */
3414 if (dbuf.dsize == 0) {
3415 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3416 keystr));
3417 state->bad_entry = true;
3418 state->success = false;
3419 return 1;
3420 }
3421
3422 DEBUG(10,("validate_dr: %s ok\n", keystr));
3423 return 0;
3424 }
3425
3426 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3427 struct tdb_validation_status *state)
3428 {
3429 /* Can't say anything about this other than must be nonzero. */
3430 if (dbuf.dsize == 0) {
3431 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3432 keystr));
3433 state->bad_entry = true;
3434 state->success = false;
3435 return 1;
3436 }
3437
3438 DEBUG(10,("validate_de: %s ok\n", keystr));
3439 return 0;
3440 }
3441
3442 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3443 TDB_DATA dbuf, struct tdb_validation_status *state)
3444 {
3445 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3446
3447 if (!centry) {
3448 return 1;
3449 }
3450
3451 (void)centry_string(centry, mem_ctx);
3452 (void)centry_string(centry, mem_ctx);
3453 (void)centry_string(centry, mem_ctx);
3454 (void)centry_uint32(centry);
3455
3456 centry_free(centry);
3457
3458 if (!(state->success)) {
3459 return 1;
3460 }
3461 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3462 return 0;
3463 }
3464
3465 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3466 TDB_DATA dbuf,
3467 struct tdb_validation_status *state)
3468 {
3469 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3470
3471 if (!centry) {
3472 return 1;
3473 }
3474
3475 (void)centry_string( centry, mem_ctx );
3476
3477 centry_free(centry);
3478
3479 if (!(state->success)) {
3480 return 1;
3481 }
3482 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3483 return 0;
3484 }
3485
3486 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3487 TDB_DATA dbuf,
3488 struct tdb_validation_status *state)
3489 {
3490 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3491
3492 if (!centry) {
3493 return 1;
3494 }
3495
3496 (void)centry_string( centry, mem_ctx );
3497
3498 centry_free(centry);
3499
3500 if (!(state->success)) {
3501 return 1;
3502 }
3503 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3504 return 0;
3505 }
3506
3507 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3508 struct tdb_validation_status *state)
3509 {
3510 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3511 int32 num_domains, i;
3512
3513 if (!centry) {
3514 return 1;
3515 }
3516
3517 num_domains = centry_uint32(centry);
3518
3519 for (i=0; i< num_domains; i++) {
3520 DOM_SID sid;
3521 (void)centry_string(centry, mem_ctx);
3522 (void)centry_string(centry, mem_ctx);
3523 (void)centry_sid(centry, mem_ctx, &sid);
3524 }
3525
3526 centry_free(centry);
3527
3528 if (!(state->success)) {
3529 return 1;
3530 }
3531 DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3532 return 0;
3533 }
3534
3535 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3536 TDB_DATA dbuf,
3537 struct tdb_validation_status *state)
3538 {
3539 if (dbuf.dsize == 0) {
3540 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3541 "key %s (len ==0) ?\n", keystr));
3542 state->bad_entry = true;
3543 state->success = false;
3544 return 1;
3545 }
3546
3547 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3548 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3549 return 0;
3550 }
3551
3552 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3553 struct tdb_validation_status *state)
3554 {
3555 if (dbuf.dsize != 4) {
3556 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3557 keystr, (unsigned int)dbuf.dsize ));
3558 state->bad_entry = true;
3559 state->success = false;
3560 return 1;
3561 }
3562 DEBUG(10,("validate_offline: %s ok\n", keystr));
3563 return 0;
3564 }
3565
3566 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3567 struct tdb_validation_status *state)
3568 {
3569 if (dbuf.dsize != 4) {
3570 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3571 "key %s (len %u != 4) ?\n",
3572 keystr, (unsigned int)dbuf.dsize));
3573 state->bad_entry = true;
3574 state->success = false;
3575 return 1;
3576 }
3577
3578 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3579 return 0;
3580 }
3581
3582 /***********************************************************************
3583 A list of all possible cache tdb keys with associated validation
3584 functions.
3585 ***********************************************************************/
3586
3587 struct key_val_struct {
3588 const char *keyname;
3589 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3590 } key_val[] = {
3591 {"SEQNUM/", validate_seqnum},
3592 {"NS/", validate_ns},
3593 {"SN/", validate_sn},
3594 {"U/", validate_u},
3595 {"LOC_POL/", validate_loc_pol},
3596 {"PWD_POL/", validate_pwd_pol},
3597 {"CRED/", validate_cred},
3598 {"UL/", validate_ul},
3599 {"GL/", validate_gl},
3600 {"UG/", validate_ug},
3601 {"UA", validate_ua},
3602 {"GM/", validate_gm},
3603 {"DR/", validate_dr},
3604 {"DE/", validate_de},
3605 {"NSS/PWINFO/", validate_pwinfo},
3606 {"TRUSTDOMS/", validate_trustdoms},
3607 {"TRUSTDOMCACHE/", validate_trustdomcache},
3608 {"NSS/NA/", validate_nss_na},
3609 {"NSS/AN/", validate_nss_an},
3610 {"WINBINDD_OFFLINE", validate_offline},
3611 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3612 {NULL, NULL}
3613 };
3614
3615 /***********************************************************************
3616 Function to look at every entry in the tdb and validate it as far as
3617 possible.
3618 ***********************************************************************/
3619
3620 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3621 {
3622 int i;
3623 unsigned int max_key_len = 1024;
3624 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3625
3626 /* Paranoia check. */
3627 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3628 max_key_len = 1024 * 1024;
3629 }
3630 if (kbuf.dsize > max_key_len) {
3631 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3632 "(%u) > (%u)\n\n",
3633 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3634 return 1;
3635 }
3636
3637 for (i = 0; key_val[i].keyname; i++) {
3638 size_t namelen = strlen(key_val[i].keyname);
3639 if (kbuf.dsize >= namelen && (
3640 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3641 TALLOC_CTX *mem_ctx;
3642 char *keystr;
3643 int ret;
3644
3645 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3646 if (!keystr) {
3647 return 1;
3648 }
3649 memcpy(keystr, kbuf.dptr, kbuf.dsize);
3650 keystr[kbuf.dsize] = '\0';
3651
3652 mem_ctx = talloc_init("validate_ctx");
3653 if (!mem_ctx) {
3654 SAFE_FREE(keystr);
3655 return 1;
3656 }
3657
3658 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3659 v_state);
3660
3661 SAFE_FREE(keystr);
3662 talloc_destroy(mem_ctx);
3663 return ret;
3664 }
3665 }
3666
3667 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3668 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3669 DEBUG(0,("data :\n"));
3670 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3671 v_state->unknown_key = true;
3672 v_state->success = false;
3673 return 1; /* terminate. */
3674 }
3675
3676 static void validate_panic(const char *const why)
3677 {
3678 DEBUG(0,("validating cache: would panic %s\n", why ));
3679 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3680 exit(47);
3681 }
3682
3683 /***********************************************************************
3684 Try and validate every entry in the winbindd cache. If we fail here,
3685 delete the cache tdb and return non-zero.
3686 ***********************************************************************/
3687
3688 int winbindd_validate_cache(void)
3689 {
3690 int ret = -1;
3691 const char *tdb_path = lock_path("winbindd_cache.tdb");
3692 TDB_CONTEXT *tdb = NULL;
3693
3694 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3695 smb_panic_fn = validate_panic;
3696
3697
3698 tdb = tdb_open_log(tdb_path,
3699 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3700 ( lp_winbind_offline_logon()
3701 ? TDB_DEFAULT
3702 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3703 O_RDWR|O_CREAT,
3704 0600);
3705 if (!tdb) {
3706 DEBUG(0, ("winbindd_validate_cache: "
3707 "error opening/initializing tdb\n"));
3708 goto done;
3709 }
3710 tdb_close(tdb);
3711
3712 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3713
3714 if (ret != 0) {
3715 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3716 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3717 unlink(tdb_path);
3718 }
3719
3720 done:
3721 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3722 smb_panic_fn = smb_panic;
3723 return ret;
3724 }
3725
3726 /***********************************************************************
3727 Try and validate every entry in the winbindd cache.
3728 ***********************************************************************/
3729
3730 int winbindd_validate_cache_nobackup(void)
3731 {
3732 int ret = -1;
3733 const char *tdb_path = lock_path("winbindd_cache.tdb");
3734
3735 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3736 smb_panic_fn = validate_panic;
3737
3738
3739 if (wcache == NULL || wcache->tdb == NULL) {
3740 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3741 } else {
3742 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3743 }
3744
3745 if (ret != 0) {
3746 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3747 "successful.\n"));
3748 }
3749
3750 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3751 "function\n"));
3752 smb_panic_fn = smb_panic;
3753 return ret;
3754 }
3755
3756 bool winbindd_cache_validate_and_initialize(void)
3757 {
3758 close_winbindd_cache();
3759
3760 if (lp_winbind_offline_logon()) {
3761 if (winbindd_validate_cache() < 0) {
3762 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3763 "could be restored.\n"));
3764 }
3765 }
3766
3767 return initialize_winbindd_cache();
3768 }
3769
3770 /*********************************************************************
3771 ********************************************************************/
3772
3773 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3774 struct winbindd_tdc_domain **domains,
3775 size_t *num_domains )
3776 {
3777 struct winbindd_tdc_domain *list = NULL;
3778 size_t idx;
3779 int i;
3780 bool set_only = false;
3781
3782 /* don't allow duplicates */
3783
3784 idx = *num_domains;
3785 list = *domains;
3786
3787 for ( i=0; i< (*num_domains); i++ ) {
3788 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3789 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3790 new_dom->name));
3791 idx = i;
3792 set_only = true;
3793
3794 break;
3795 }
3796 }
3797
3798 if ( !set_only ) {
3799 if ( !*domains ) {
3800 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3801 idx = 0;
3802 } else {
3803 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3804 struct winbindd_tdc_domain,
3805 (*num_domains)+1);
3806 idx = *num_domains;
3807 }
3808
3809 ZERO_STRUCT( list[idx] );
3810 }
3811
3812 if ( !list )
3813 return false;
3814
3815 list[idx].domain_name = talloc_strdup( list, new_dom->name );
3816 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3817
3818 if ( !is_null_sid( &new_dom->sid ) ) {
3819 sid_copy( &list[idx].sid, &new_dom->sid );
3820 } else {
3821 sid_copy(&list[idx].sid, &global_sid_NULL);
3822 }
3823
3824 if ( new_dom->domain_flags != 0x0 )
3825 list[idx].trust_flags = new_dom->domain_flags;
3826
3827 if ( new_dom->domain_type != 0x0 )
3828 list[idx].trust_type = new_dom->domain_type;
3829
3830 if ( new_dom->domain_trust_attribs != 0x0 )
3831 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3832
3833 if ( !set_only ) {
3834 *domains = list;
3835 *num_domains = idx + 1;
3836 }
3837
3838 return true;
3839 }
3840
3841 /*********************************************************************
3842 ********************************************************************/
3843
3844 static TDB_DATA make_tdc_key( const char *domain_name )
3845 {
3846 char *keystr = NULL;
3847 TDB_DATA key = { NULL, 0 };
3848
3849 if ( !domain_name ) {
3850 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3851 return key;
3852 }
3853
3854
3855 asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name );
3856 key = string_term_tdb_data(keystr);
3857
3858 return key;
3859 }
3860
3861 /*********************************************************************
3862 ********************************************************************/
3863
3864 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3865 size_t num_domains,
3866 unsigned char **buf )
3867 {
3868 unsigned char *buffer = NULL;
3869 int len = 0;
3870 int buflen = 0;
3871 int i = 0;
3872
3873 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3874 (int)num_domains));
3875
3876 buflen = 0;
3877
3878 again:
3879 len = 0;
3880
3881 /* Store the number of array items first */
3882 len += tdb_pack( buffer+len, buflen-len, "d",
3883 num_domains );
3884
3885 /* now pack each domain trust record */
3886 for ( i=0; i<num_domains; i++ ) {
3887
3888 fstring tmp;
3889
3890 if ( buflen > 0 ) {
3891 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3892 domains[i].domain_name,
3893 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3894 }
3895
3896 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3897 domains[i].domain_name,
3898 domains[i].dns_name,
3899 sid_to_fstring(tmp, &domains[i].sid),
3900 domains[i].trust_flags,
3901 domains[i].trust_attribs,
3902 domains[i].trust_type );
3903 }
3904
3905 if ( buflen < len ) {
3906 SAFE_FREE(buffer);
3907 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3908 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3909 buflen = -1;
3910 goto done;
3911 }
3912 buflen = len;
3913 goto again;
3914 }
3915
3916 *buf = buffer;
3917
3918 done:
3919 return buflen;
3920 }
3921
3922 /*********************************************************************
3923 ********************************************************************/
3924
3925 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3926 struct winbindd_tdc_domain **domains )
3927 {
3928 fstring domain_name, dns_name, sid_string;
3929 uint32 type, attribs, flags;
3930 int num_domains;
3931 int len = 0;
3932 int i;
3933 struct winbindd_tdc_domain *list = NULL;
3934
3935 /* get the number of domains */
3936 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3937 if ( len == -1 ) {
3938 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3939 return 0;
3940 }
3941
3942 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3943 if ( !list ) {
3944 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3945 return 0;
3946 }
3947
3948 for ( i=0; i<num_domains; i++ ) {
3949 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3950 domain_name,
3951 dns_name,
3952 sid_string,
3953 &flags,
3954 &attribs,
3955 &type );
3956
3957 if ( len == -1 ) {
3958 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3959 TALLOC_FREE( list );
3960 return 0;
3961 }
3962
3963 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
3964 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
3965 domain_name, dns_name, sid_string,
3966 flags, attribs, type));
3967
3968 list[i].domain_name = talloc_strdup( list, domain_name );
3969 list[i].dns_name = talloc_strdup( list, dns_name );
3970 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
3971 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
3972 domain_name));
3973 }
3974 list[i].trust_flags = flags;
3975 list[i].trust_attribs = attribs;
3976 list[i].trust_type = type;
3977 }
3978
3979 *domains = list;
3980
3981 return num_domains;
3982 }
3983
3984 /*********************************************************************
3985 ********************************************************************/
3986
3987 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
3988 {
3989 TDB_DATA key = make_tdc_key( lp_workgroup() );
3990 TDB_DATA data = { NULL, 0 };
3991 int ret;
3992
3993 if ( !key.dptr )
3994 return false;
3995
3996 /* See if we were asked to delete the cache entry */
3997
3998 if ( !domains ) {
3999 ret = tdb_delete( wcache->tdb, key );
4000 goto done;
4001 }
4002
4003 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4004
4005 if ( !data.dptr ) {
4006 ret = -1;
4007 goto done;
4008 }
4009
4010 ret = tdb_store( wcache->tdb, key, data, 0 );
4011
4012 done:
4013 SAFE_FREE( data.dptr );
4014 SAFE_FREE( key.dptr );
4015
4016 return ( ret != -1 );
4017 }
4018
4019 /*********************************************************************
4020 ********************************************************************/
4021
4022 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4023 {
4024 TDB_DATA key = make_tdc_key( lp_workgroup() );
4025 TDB_DATA data = { NULL, 0 };
4026
4027 *domains = NULL;
4028 *num_domains = 0;
4029
4030 if ( !key.dptr )
4031 return false;
4032
4033 data = tdb_fetch( wcache->tdb, key );
4034
4035 SAFE_FREE( key.dptr );
4036
4037 if ( !data.dptr )
4038 return false;
4039
4040 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4041
4042 SAFE_FREE( data.dptr );
4043
4044 if ( !*domains )
4045 return false;
4046
4047 return true;
4048 }
4049
4050 /*********************************************************************
4051 ********************************************************************/
4052
4053 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4054 {
4055 struct winbindd_tdc_domain *dom_list = NULL;
4056 size_t num_domains = 0;
4057 bool ret = false;
4058
4059 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4060 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4061 domain->name, domain->alt_name,
4062 sid_string_dbg(&domain->sid),
4063 domain->domain_flags,
4064 domain->domain_trust_attribs,
4065 domain->domain_type));
4066
4067 if ( !init_wcache() ) {
4068 return false;
4069 }
4070
4071 /* fetch the list */
4072
4073 wcache_tdc_fetch_list( &dom_list, &num_domains );
4074
4075 /* add the new domain */
4076
4077 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4078 goto done;
4079 }
4080
4081 /* pack the domain */
4082
4083 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4084 goto done;
4085 }
4086
4087 /* Success */
4088
4089 ret = true;
4090 done:
4091 TALLOC_FREE( dom_list );
4092
4093 return ret;
4094 }
4095
4096 /*********************************************************************
4097 ********************************************************************/
4098
4099 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4100 {
4101 struct winbindd_tdc_domain *dom_list = NULL;
4102 size_t num_domains = 0;
4103 int i;
4104 struct winbindd_tdc_domain *d = NULL;
4105
4106 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4107
4108 if ( !init_wcache() ) {
4109 return false;
4110 }
4111
4112 /* fetch the list */
4113
4114 wcache_tdc_fetch_list( &dom_list, &num_domains );
4115
4116 for ( i=0; i<num_domains; i++ ) {
4117 if ( strequal(name, dom_list[i].domain_name) ||
4118 strequal(name, dom_list[i].dns_name) )
4119 {
4120 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4121 name));
4122
4123 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4124 if ( !d )
4125 break;
4126
4127 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4128 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4129 sid_copy( &d->sid, &dom_list[i].sid );
4130 d->trust_flags = dom_list[i].trust_flags;
4131 d->trust_type = dom_list[i].trust_type;
4132 d->trust_attribs = dom_list[i].trust_attribs;
4133
4134 break;
4135 }
4136 }
4137
4138 TALLOC_FREE( dom_list );
4139
4140 return d;
4141 }
4142
4143
4144 /*********************************************************************
4145 ********************************************************************/
4146
4147 void wcache_tdc_clear( void )
4148 {
4149 if ( !init_wcache() )
4150 return;
4151
4152 wcache_tdc_store_list( NULL, 0 );
4153
4154 return;
4155 }
4156
4157
4158 /*********************************************************************
4159 ********************************************************************/
4160
4161 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4162 NTSTATUS status,
4163 const DOM_SID *user_sid,
4164 const char *homedir,
4165 const char *shell,
4166 const char *gecos,
4167 uint32 gid)
4168 {
4169 struct cache_entry *centry;
4170 fstring tmp;
4171
4172 if ( (centry = centry_start(domain, status)) == NULL )
4173 return;
4174
4175 centry_put_string( centry, homedir );
4176 centry_put_string( centry, shell );
4177 centry_put_string( centry, gecos );
4178 centry_put_uint32( centry, gid );
4179
4180 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4181
4182 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4183
4184 centry_free(centry);
4185 }
4186
4187 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4188 const DOM_SID *user_sid,
4189 TALLOC_CTX *ctx,
4190 ADS_STRUCT *ads, LDAPMessage *msg,
4191 char **homedir, char **shell, char **gecos,
4192 gid_t *p_gid)
4193 {
4194 struct winbind_cache *cache = get_cache(domain);
4195 struct cache_entry *centry = NULL;
4196 NTSTATUS nt_status;
4197 fstring tmp;
4198
4199 if (!cache->tdb)
4200 goto do_query;
4201
4202 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4203 sid_to_fstring(tmp, user_sid));
4204
4205 if (!centry)
4206 goto do_query;
4207
4208 *homedir = centry_string( centry, ctx );
4209 *shell = centry_string( centry, ctx );
4210 *gecos = centry_string( centry, ctx );
4211 *p_gid = centry_uint32( centry );
4212
4213 centry_free(centry);
4214
4215 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4216 sid_string_dbg(user_sid)));
4217
4218 return NT_STATUS_OK;
4219
4220 do_query:
4221
4222 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4223 homedir, shell, gecos, p_gid );
4224
4225 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4226
4227 if ( NT_STATUS_IS_OK(nt_status) ) {
4228 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4229 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4230 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4231 DEBUGADD(10, ("\tgid = '%u'\n", *p_gid));
4232
4233 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4234 *homedir, *shell, *gecos, *p_gid );
4235 }
4236
4237 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4238 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4239 domain->name ));
4240 set_domain_offline( domain );
4241 }
4242
4243 return nt_status;
4244 }
4245
4246
4247 /* the cache backend methods are exposed via this structure */
4248 struct winbindd_methods cache_methods = {
4249 true,
4250 query_user_list,
4251 enum_dom_groups,
4252 enum_local_groups,
4253 name_to_sid,
4254 sid_to_name,
4255 rids_to_names,
4256 query_user,
4257 lookup_usergroups,
4258 lookup_useraliases,
4259 lookup_groupmem,
4260 sequence_number,
4261 lockout_policy,
4262 password_policy,
4263 trusted_domains
4264 };
Proof-of-concept samba4 based caching proxy