?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: More cleanup in winbindd_ads.c:query_user
[Samba.git] / source3 / winbindd / winbindd_cache.c
blobb92ef2fabb43858966ec79ba535385cae92c5f9d
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
30 #include "../librpc/gen_ndr/ndr_wbint.h"
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_WINBIND
34
35 #define WINBINDD_CACHE_VERSION 1
36 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
37
38 extern struct winbindd_methods reconnect_methods;
39 #ifdef HAVE_ADS
40 extern struct winbindd_methods ads_methods;
41 #endif
42 extern struct winbindd_methods builtin_passdb_methods;
43
44 /*
45 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
46 * Here are the list of entry types that are *not* stored
47 * as form struct cache_entry in the cache.
48 */
49
50 static const char *non_centry_keys[] = {
51 "SEQNUM/",
52 "DR/",
53 "DE/",
54 "WINBINDD_OFFLINE",
55 WINBINDD_CACHE_VERSION_KEYSTR,
56 NULL
57 };
58
59 /************************************************************************
60 Is this key a non-centry type ?
61 ************************************************************************/
62
63 static bool is_non_centry_key(TDB_DATA kbuf)
64 {
65 int i;
66
67 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
68 return false;
69 }
70 for (i = 0; non_centry_keys[i] != NULL; i++) {
71 size_t namelen = strlen(non_centry_keys[i]);
72 if (kbuf.dsize < namelen) {
73 continue;
74 }
75 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
76 return true;
77 }
78 }
79 return false;
80 }
81
82 /* Global online/offline state - False when online. winbindd starts up online
83 and sets this to true if the first query fails and there's an entry in
84 the cache tdb telling us to stay offline. */
85
86 static bool global_winbindd_offline_state;
87
88 struct winbind_cache {
89 TDB_CONTEXT *tdb;
90 };
91
92 struct cache_entry {
93 NTSTATUS status;
94 uint32 sequence_number;
95 uint8 *data;
96 uint32 len, ofs;
97 };
98
99 void (*smb_panic_fn)(const char *const why) = smb_panic;
100
101 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
102
103 static struct winbind_cache *wcache;
104
105 void winbindd_check_cache_size(time_t t)
106 {
107 static time_t last_check_time;
108 struct stat st;
109
110 if (last_check_time == (time_t)0)
111 last_check_time = t;
112
113 if (t - last_check_time < 60 && t - last_check_time > 0)
114 return;
115
116 if (wcache == NULL || wcache->tdb == NULL) {
117 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
118 return;
119 }
120
121 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
122 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
123 return;
124 }
125
126 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
127 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
128 (unsigned long)st.st_size,
129 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
130 wcache_flush_cache();
131 }
132 }
133
134 /* get the winbind_cache structure */
135 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
136 {
137 struct winbind_cache *ret = wcache;
138
139 /* We have to know what type of domain we are dealing with first. */
140
141 if (domain->internal) {
142 domain->backend = &builtin_passdb_methods;
143 domain->initialized = True;
144 }
145 if ( !domain->initialized ) {
146 init_dc_connection( domain );
147 }
148
149 /*
150 OK. listen up becasue I'm only going to say this once.
151 We have the following scenarios to consider
152 (a) trusted AD domains on a Samba DC,
153 (b) trusted AD domains and we are joined to a non-kerberos domain
154 (c) trusted AD domains and we are joined to a kerberos (AD) domain
155
156 For (a) we can always contact the trusted domain using krb5
157 since we have the domain trust account password
158
159 For (b) we can only use RPC since we have no way of
160 getting a krb5 ticket in our own domain
161
162 For (c) we can always use krb5 since we have a kerberos trust
163
164 --jerry
165 */
166
167 if (!domain->backend) {
168 #ifdef HAVE_ADS
169 struct winbindd_domain *our_domain = domain;
170
171 /* find our domain first so we can figure out if we
172 are joined to a kerberized domain */
173
174 if ( !domain->primary )
175 our_domain = find_our_domain();
176
177 if ((our_domain->active_directory || IS_DC)
178 && domain->active_directory
179 && !lp_winbind_rpc_only()) {
180 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
181 domain->backend = &ads_methods;
182 } else {
183 #endif /* HAVE_ADS */
184 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
185 domain->backend = &reconnect_methods;
186 #ifdef HAVE_ADS
187 }
188 #endif /* HAVE_ADS */
189 }
190
191 if (ret)
192 return ret;
193
194 ret = SMB_XMALLOC_P(struct winbind_cache);
195 ZERO_STRUCTP(ret);
196
197 wcache = ret;
198 wcache_flush_cache();
199
200 return ret;
201 }
202
203 /*
204 free a centry structure
205 */
206 static void centry_free(struct cache_entry *centry)
207 {
208 if (!centry)
209 return;
210 SAFE_FREE(centry->data);
211 free(centry);
212 }
213
214 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
215 {
216 if (centry->len - centry->ofs < nbytes) {
217 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
218 (unsigned int)nbytes,
219 centry->len - centry->ofs));
220 return false;
221 }
222 return true;
223 }
224
225 /*
226 pull a uint32 from a cache entry
227 */
228 static uint32 centry_uint32(struct cache_entry *centry)
229 {
230 uint32 ret;
231
232 if (!centry_check_bytes(centry, 4)) {
233 smb_panic_fn("centry_uint32");
234 }
235 ret = IVAL(centry->data, centry->ofs);
236 centry->ofs += 4;
237 return ret;
238 }
239
240 /*
241 pull a uint16 from a cache entry
242 */
243 static uint16 centry_uint16(struct cache_entry *centry)
244 {
245 uint16 ret;
246 if (!centry_check_bytes(centry, 2)) {
247 smb_panic_fn("centry_uint16");
248 }
249 ret = CVAL(centry->data, centry->ofs);
250 centry->ofs += 2;
251 return ret;
252 }
253
254 /*
255 pull a uint8 from a cache entry
256 */
257 static uint8 centry_uint8(struct cache_entry *centry)
258 {
259 uint8 ret;
260 if (!centry_check_bytes(centry, 1)) {
261 smb_panic_fn("centry_uint8");
262 }
263 ret = CVAL(centry->data, centry->ofs);
264 centry->ofs += 1;
265 return ret;
266 }
267
268 /*
269 pull a NTTIME from a cache entry
270 */
271 static NTTIME centry_nttime(struct cache_entry *centry)
272 {
273 NTTIME ret;
274 if (!centry_check_bytes(centry, 8)) {
275 smb_panic_fn("centry_nttime");
276 }
277 ret = IVAL(centry->data, centry->ofs);
278 centry->ofs += 4;
279 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
280 centry->ofs += 4;
281 return ret;
282 }
283
284 /*
285 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
286 */
287 static time_t centry_time(struct cache_entry *centry)
288 {
289 return (time_t)centry_nttime(centry);
290 }
291
292 /* pull a string from a cache entry, using the supplied
293 talloc context
294 */
295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
296 {
297 uint32 len;
298 char *ret;
299
300 len = centry_uint8(centry);
301
302 if (len == 0xFF) {
303 /* a deliberate NULL string */
304 return NULL;
305 }
306
307 if (!centry_check_bytes(centry, (size_t)len)) {
308 smb_panic_fn("centry_string");
309 }
310
311 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
312 if (!ret) {
313 smb_panic_fn("centry_string out of memory\n");
314 }
315 memcpy(ret,centry->data + centry->ofs, len);
316 ret[len] = 0;
317 centry->ofs += len;
318 return ret;
319 }
320
321 /* pull a hash16 from a cache entry, using the supplied
322 talloc context
323 */
324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
325 {
326 uint32 len;
327 char *ret;
328
329 len = centry_uint8(centry);
330
331 if (len != 16) {
332 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
333 len ));
334 return NULL;
335 }
336
337 if (!centry_check_bytes(centry, 16)) {
338 return NULL;
339 }
340
341 ret = TALLOC_ARRAY(mem_ctx, char, 16);
342 if (!ret) {
343 smb_panic_fn("centry_hash out of memory\n");
344 }
345 memcpy(ret,centry->data + centry->ofs, 16);
346 centry->ofs += 16;
347 return ret;
348 }
349
350 /* pull a sid from a cache entry, using the supplied
351 talloc context
352 */
353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
354 {
355 char *sid_string;
356 bool ret;
357
358 sid_string = centry_string(centry, talloc_tos());
359 if (sid_string == NULL) {
360 return false;
361 }
362 ret = string_to_sid(sid, sid_string);
363 TALLOC_FREE(sid_string);
364 return ret;
365 }
366
367
368 /*
369 pull a NTSTATUS from a cache entry
370 */
371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
372 {
373 NTSTATUS status;
374
375 status = NT_STATUS(centry_uint32(centry));
376 return status;
377 }
378
379
380 /* the server is considered down if it can't give us a sequence number */
381 static bool wcache_server_down(struct winbindd_domain *domain)
382 {
383 bool ret;
384
385 if (!wcache->tdb)
386 return false;
387
388 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
389
390 if (ret)
391 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
392 domain->name ));
393 return ret;
394 }
395
396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
397 uint32_t *last_seq_check)
398 {
399 char *key;
400 TDB_DATA data;
401
402 if (wcache->tdb == NULL) {
403 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
404 return false;
405 }
406
407 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
408 if (key == NULL) {
409 DEBUG(10, ("talloc failed\n"));
410 return false;
411 }
412
413 data = tdb_fetch_bystring(wcache->tdb, key);
414 TALLOC_FREE(key);
415
416 if (data.dptr == NULL) {
417 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
418 domain_name));
419 return false;
420 }
421 if (data.dsize != 8) {
422 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
423 (int)data.dsize));
424 SAFE_FREE(data.dptr);
425 return false;
426 }
427
428 *seqnum = IVAL(data.dptr, 0);
429 *last_seq_check = IVAL(data.dptr, 4);
430 SAFE_FREE(data.dptr);
431
432 return true;
433 }
434
435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
436 {
437 uint32 last_check, time_diff;
438
439 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
440 &last_check)) {
441 return NT_STATUS_UNSUCCESSFUL;
442 }
443 domain->last_seq_check = last_check;
444
445 /* have we expired? */
446
447 time_diff = now - domain->last_seq_check;
448 if ( time_diff > lp_winbind_cache_time() ) {
449 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
450 domain->name, domain->sequence_number,
451 (uint32)domain->last_seq_check));
452 return NT_STATUS_UNSUCCESSFUL;
453 }
454
455 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
456 domain->name, domain->sequence_number,
457 (uint32)domain->last_seq_check));
458
459 return NT_STATUS_OK;
460 }
461
462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
463 time_t last_seq_check)
464 {
465 char *key_str;
466 uint8_t buf[8];
467 int ret;
468
469 if (wcache->tdb == NULL) {
470 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
471 return false;
472 }
473
474 key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
475 if (key_str == NULL) {
476 DEBUG(10, ("talloc_asprintf failed\n"));
477 return false;
478 }
479
480 SIVAL(buf, 0, seqnum);
481 SIVAL(buf, 4, last_seq_check);
482
483 ret = tdb_store_bystring(wcache->tdb, key_str,
484 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
485 TALLOC_FREE(key_str);
486 if (ret == -1) {
487 DEBUG(10, ("tdb_store_bystring failed: %s\n",
488 tdb_errorstr(wcache->tdb)));
489 TALLOC_FREE(key_str);
490 return false;
491 }
492
493 DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
494 domain_name, seqnum, (unsigned)last_seq_check));
495
496 return true;
497 }
498
499 static bool store_cache_seqnum( struct winbindd_domain *domain )
500 {
501 return wcache_store_seqnum(domain->name, domain->sequence_number,
502 domain->last_seq_check);
503 }
504
505 /*
506 refresh the domain sequence number. If force is true
507 then always refresh it, no matter how recently we fetched it
508 */
509
510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
511 {
512 NTSTATUS status;
513 unsigned time_diff;
514 time_t t = time(NULL);
515 unsigned cache_time = lp_winbind_cache_time();
516
517 if (is_domain_offline(domain)) {
518 return;
519 }
520
521 get_cache( domain );
522
523 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
524 /* trying to reconnect is expensive, don't do it too often */
525 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
526 cache_time *= 8;
527 }
528 #endif
529
530 time_diff = t - domain->last_seq_check;
531
532 /* see if we have to refetch the domain sequence number */
533 if (!force && (time_diff < cache_time) &&
534 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
535 NT_STATUS_IS_OK(domain->last_status)) {
536 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
537 goto done;
538 }
539
540 /* try to get the sequence number from the tdb cache first */
541 /* this will update the timestamp as well */
542
543 status = fetch_cache_seqnum( domain, t );
544 if (NT_STATUS_IS_OK(status) &&
545 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
546 NT_STATUS_IS_OK(domain->last_status)) {
547 goto done;
548 }
549
550 /* important! make sure that we know if this is a native
551 mode domain or not. And that we can contact it. */
552
553 if ( winbindd_can_contact_domain( domain ) ) {
554 status = domain->backend->sequence_number(domain,
555 &domain->sequence_number);
556 } else {
557 /* just use the current time */
558 status = NT_STATUS_OK;
559 domain->sequence_number = time(NULL);
560 }
561
562
563 /* the above call could have set our domain->backend to NULL when
564 * coming from offline to online mode, make sure to reinitialize the
565 * backend - Guenther */
566 get_cache( domain );
567
568 if (!NT_STATUS_IS_OK(status)) {
569 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
570 domain->sequence_number = DOM_SEQUENCE_NONE;
571 }
572
573 domain->last_status = status;
574 domain->last_seq_check = time(NULL);
575
576 /* save the new sequence number in the cache */
577 store_cache_seqnum( domain );
578
579 done:
580 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
581 domain->name, domain->sequence_number));
582
583 return;
584 }
585
586 /*
587 decide if a cache entry has expired
588 */
589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
590 {
591 /* If we've been told to be offline - stay in that state... */
592 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
593 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
594 keystr, domain->name ));
595 return false;
596 }
597
598 /* when the domain is offline return the cached entry.
599 * This deals with transient offline states... */
600
601 if (!domain->online) {
602 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
603 keystr, domain->name ));
604 return false;
605 }
606
607 /* if the server is OK and our cache entry came from when it was down then
608 the entry is invalid */
609 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
610 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
611 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
612 keystr, domain->name ));
613 return true;
614 }
615
616 /* if the server is down or the cache entry is not older than the
617 current sequence number then it is OK */
618 if (wcache_server_down(domain) ||
619 centry->sequence_number == domain->sequence_number) {
620 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
621 keystr, domain->name ));
622 return false;
623 }
624
625 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
626 keystr, domain->name ));
627
628 /* it's expired */
629 return true;
630 }
631
632 static struct cache_entry *wcache_fetch_raw(char *kstr)
633 {
634 TDB_DATA data;
635 struct cache_entry *centry;
636 TDB_DATA key;
637
638 key = string_tdb_data(kstr);
639 data = tdb_fetch(wcache->tdb, key);
640 if (!data.dptr) {
641 /* a cache miss */
642 return NULL;
643 }
644
645 centry = SMB_XMALLOC_P(struct cache_entry);
646 centry->data = (unsigned char *)data.dptr;
647 centry->len = data.dsize;
648 centry->ofs = 0;
649
650 if (centry->len < 8) {
651 /* huh? corrupt cache? */
652 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
653 centry_free(centry);
654 return NULL;
655 }
656
657 centry->status = centry_ntstatus(centry);
658 centry->sequence_number = centry_uint32(centry);
659
660 return centry;
661 }
662
663 /*
664 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
665 number and return status
666 */
667 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
668 struct winbindd_domain *domain,
669 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
670 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
671 struct winbindd_domain *domain,
672 const char *format, ...)
673 {
674 va_list ap;
675 char *kstr;
676 struct cache_entry *centry;
677
678 if (!winbindd_use_cache()) {
679 return NULL;
680 }
681
682 refresh_sequence_number(domain, false);
683
684 va_start(ap, format);
685 smb_xvasprintf(&kstr, format, ap);
686 va_end(ap);
687
688 centry = wcache_fetch_raw(kstr);
689 if (centry == NULL) {
690 free(kstr);
691 return NULL;
692 }
693
694 if (centry_expired(domain, kstr, centry)) {
695
696 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
697 kstr, domain->name ));
698
699 centry_free(centry);
700 free(kstr);
701 return NULL;
702 }
703
704 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
705 kstr, domain->name ));
706
707 free(kstr);
708 return centry;
709 }
710
711 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
712 static void wcache_delete(const char *format, ...)
713 {
714 va_list ap;
715 char *kstr;
716 TDB_DATA key;
717
718 va_start(ap, format);
719 smb_xvasprintf(&kstr, format, ap);
720 va_end(ap);
721
722 key = string_tdb_data(kstr);
723
724 tdb_delete(wcache->tdb, key);
725 free(kstr);
726 }
727
728 /*
729 make sure we have at least len bytes available in a centry
730 */
731 static void centry_expand(struct cache_entry *centry, uint32 len)
732 {
733 if (centry->len - centry->ofs >= len)
734 return;
735 centry->len *= 2;
736 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
737 centry->len);
738 if (!centry->data) {
739 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
740 smb_panic_fn("out of memory in centry_expand");
741 }
742 }
743
744 /*
745 push a uint32 into a centry
746 */
747 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
748 {
749 centry_expand(centry, 4);
750 SIVAL(centry->data, centry->ofs, v);
751 centry->ofs += 4;
752 }
753
754 /*
755 push a uint16 into a centry
756 */
757 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
758 {
759 centry_expand(centry, 2);
760 SIVAL(centry->data, centry->ofs, v);
761 centry->ofs += 2;
762 }
763
764 /*
765 push a uint8 into a centry
766 */
767 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
768 {
769 centry_expand(centry, 1);
770 SCVAL(centry->data, centry->ofs, v);
771 centry->ofs += 1;
772 }
773
774 /*
775 push a string into a centry
776 */
777 static void centry_put_string(struct cache_entry *centry, const char *s)
778 {
779 int len;
780
781 if (!s) {
782 /* null strings are marked as len 0xFFFF */
783 centry_put_uint8(centry, 0xFF);
784 return;
785 }
786
787 len = strlen(s);
788 /* can't handle more than 254 char strings. Truncating is probably best */
789 if (len > 254) {
790 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
791 len = 254;
792 }
793 centry_put_uint8(centry, len);
794 centry_expand(centry, len);
795 memcpy(centry->data + centry->ofs, s, len);
796 centry->ofs += len;
797 }
798
799 /*
800 push a 16 byte hash into a centry - treat as 16 byte string.
801 */
802 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
803 {
804 centry_put_uint8(centry, 16);
805 centry_expand(centry, 16);
806 memcpy(centry->data + centry->ofs, val, 16);
807 centry->ofs += 16;
808 }
809
810 static void centry_put_sid(struct cache_entry *centry, const struct dom_sid *sid)
811 {
812 fstring sid_string;
813 centry_put_string(centry, sid_to_fstring(sid_string, sid));
814 }
815
816
817 /*
818 put NTSTATUS into a centry
819 */
820 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
821 {
822 uint32 status_value = NT_STATUS_V(status);
823 centry_put_uint32(centry, status_value);
824 }
825
826
827 /*
828 push a NTTIME into a centry
829 */
830 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
831 {
832 centry_expand(centry, 8);
833 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
834 centry->ofs += 4;
835 SIVAL(centry->data, centry->ofs, nt >> 32);
836 centry->ofs += 4;
837 }
838
839 /*
840 push a time_t into a centry - use a 64 bit size.
841 NTTIME here is being used as a convenient 64-bit size.
842 */
843 static void centry_put_time(struct cache_entry *centry, time_t t)
844 {
845 NTTIME nt = (NTTIME)t;
846 centry_put_nttime(centry, nt);
847 }
848
849 /*
850 start a centry for output. When finished, call centry_end()
851 */
852 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
853 {
854 struct cache_entry *centry;
855
856 if (!wcache->tdb)
857 return NULL;
858
859 centry = SMB_XMALLOC_P(struct cache_entry);
860
861 centry->len = 8192; /* reasonable default */
862 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
863 centry->ofs = 0;
864 centry->sequence_number = domain->sequence_number;
865 centry_put_ntstatus(centry, status);
866 centry_put_uint32(centry, centry->sequence_number);
867 return centry;
868 }
869
870 /*
871 finish a centry and write it to the tdb
872 */
873 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
874 static void centry_end(struct cache_entry *centry, const char *format, ...)
875 {
876 va_list ap;
877 char *kstr;
878 TDB_DATA key, data;
879
880 if (!winbindd_use_cache()) {
881 return;
882 }
883
884 va_start(ap, format);
885 smb_xvasprintf(&kstr, format, ap);
886 va_end(ap);
887
888 key = string_tdb_data(kstr);
889 data.dptr = centry->data;
890 data.dsize = centry->ofs;
891
892 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
893 free(kstr);
894 }
895
896 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
897 NTSTATUS status, const char *domain_name,
898 const char *name, const struct dom_sid *sid,
899 enum lsa_SidType type)
900 {
901 struct cache_entry *centry;
902 fstring uname;
903
904 centry = centry_start(domain, status);
905 if (!centry)
906 return;
907 centry_put_uint32(centry, type);
908 centry_put_sid(centry, sid);
909 fstrcpy(uname, name);
910 strupper_m(uname);
911 centry_end(centry, "NS/%s/%s", domain_name, uname);
912 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
913 uname, sid_string_dbg(sid), nt_errstr(status)));
914 centry_free(centry);
915 }
916
917 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
918 const struct dom_sid *sid, const char *domain_name, const char *name, enum lsa_SidType type)
919 {
920 struct cache_entry *centry;
921 fstring sid_string;
922
923 centry = centry_start(domain, status);
924 if (!centry)
925 return;
926
927 if (NT_STATUS_IS_OK(status)) {
928 centry_put_uint32(centry, type);
929 centry_put_string(centry, domain_name);
930 centry_put_string(centry, name);
931 }
932
933 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
934 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
935 name, nt_errstr(status)));
936 centry_free(centry);
937 }
938
939
940 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
941 struct wbint_userinfo *info)
942 {
943 struct cache_entry *centry;
944 fstring sid_string;
945
946 if (is_null_sid(&info->user_sid)) {
947 return;
948 }
949
950 centry = centry_start(domain, status);
951 if (!centry)
952 return;
953 centry_put_string(centry, info->acct_name);
954 centry_put_string(centry, info->full_name);
955 centry_put_string(centry, info->homedir);
956 centry_put_string(centry, info->shell);
957 centry_put_uint32(centry, info->primary_gid);
958 centry_put_sid(centry, &info->user_sid);
959 centry_put_sid(centry, &info->group_sid);
960 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
961 &info->user_sid));
962 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
963 centry_free(centry);
964 }
965
966 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
967 NTSTATUS status,
968 struct samr_DomInfo12 *lockout_policy)
969 {
970 struct cache_entry *centry;
971
972 centry = centry_start(domain, status);
973 if (!centry)
974 return;
975
976 centry_put_nttime(centry, lockout_policy->lockout_duration);
977 centry_put_nttime(centry, lockout_policy->lockout_window);
978 centry_put_uint16(centry, lockout_policy->lockout_threshold);
979
980 centry_end(centry, "LOC_POL/%s", domain->name);
981
982 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
983
984 centry_free(centry);
985 }
986
987
988
989 static void wcache_save_password_policy(struct winbindd_domain *domain,
990 NTSTATUS status,
991 struct samr_DomInfo1 *policy)
992 {
993 struct cache_entry *centry;
994
995 centry = centry_start(domain, status);
996 if (!centry)
997 return;
998
999 centry_put_uint16(centry, policy->min_password_length);
1000 centry_put_uint16(centry, policy->password_history_length);
1001 centry_put_uint32(centry, policy->password_properties);
1002 centry_put_nttime(centry, policy->max_password_age);
1003 centry_put_nttime(centry, policy->min_password_age);
1004
1005 centry_end(centry, "PWD_POL/%s", domain->name);
1006
1007 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1008
1009 centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013 ***************************************************************************/
1014
1015 static void wcache_save_username_alias(struct winbindd_domain *domain,
1016 NTSTATUS status,
1017 const char *name, const char *alias)
1018 {
1019 struct cache_entry *centry;
1020 fstring uname;
1021
1022 if ( (centry = centry_start(domain, status)) == NULL )
1023 return;
1024
1025 centry_put_string( centry, alias );
1026
1027 fstrcpy(uname, name);
1028 strupper_m(uname);
1029 centry_end(centry, "NSS/NA/%s", uname);
1030
1031 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1032
1033 centry_free(centry);
1034 }
1035
1036 static void wcache_save_alias_username(struct winbindd_domain *domain,
1037 NTSTATUS status,
1038 const char *alias, const char *name)
1039 {
1040 struct cache_entry *centry;
1041 fstring uname;
1042
1043 if ( (centry = centry_start(domain, status)) == NULL )
1044 return;
1045
1046 centry_put_string( centry, name );
1047
1048 fstrcpy(uname, alias);
1049 strupper_m(uname);
1050 centry_end(centry, "NSS/AN/%s", uname);
1051
1052 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1053
1054 centry_free(centry);
1055 }
1056
1057 /***************************************************************************
1058 ***************************************************************************/
1059
1060 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1061 struct winbindd_domain *domain,
1062 const char *name, char **alias )
1063 {
1064 struct winbind_cache *cache = get_cache(domain);
1065 struct cache_entry *centry = NULL;
1066 NTSTATUS status;
1067 char *upper_name;
1068
1069 if ( domain->internal )
1070 return NT_STATUS_NOT_SUPPORTED;
1071
1072 if (!cache->tdb)
1073 goto do_query;
1074
1075 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1076 return NT_STATUS_NO_MEMORY;
1077 strupper_m(upper_name);
1078
1079 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1080
1081 SAFE_FREE( upper_name );
1082
1083 if (!centry)
1084 goto do_query;
1085
1086 status = centry->status;
1087
1088 if (!NT_STATUS_IS_OK(status)) {
1089 centry_free(centry);
1090 return status;
1091 }
1092
1093 *alias = centry_string( centry, mem_ctx );
1094
1095 centry_free(centry);
1096
1097 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1098 name, *alias ? *alias : "(none)"));
1099
1100 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1101
1102 do_query:
1103
1104 /* If its not in cache and we are offline, then fail */
1105
1106 if ( get_global_winbindd_state_offline() || !domain->online ) {
1107 DEBUG(8,("resolve_username_to_alias: rejecting query "
1108 "in offline mode\n"));
1109 return NT_STATUS_NOT_FOUND;
1110 }
1111
1112 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1113
1114 if ( NT_STATUS_IS_OK( status ) ) {
1115 wcache_save_username_alias(domain, status, name, *alias);
1116 }
1117
1118 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1119 wcache_save_username_alias(domain, status, name, "(NULL)");
1120 }
1121
1122 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1123 nt_errstr(status)));
1124
1125 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1126 set_domain_offline( domain );
1127 }
1128
1129 return status;
1130 }
1131
1132 /***************************************************************************
1133 ***************************************************************************/
1134
1135 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1136 struct winbindd_domain *domain,
1137 const char *alias, char **name )
1138 {
1139 struct winbind_cache *cache = get_cache(domain);
1140 struct cache_entry *centry = NULL;
1141 NTSTATUS status;
1142 char *upper_name;
1143
1144 if ( domain->internal )
1145 return NT_STATUS_NOT_SUPPORTED;
1146
1147 if (!cache->tdb)
1148 goto do_query;
1149
1150 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1151 return NT_STATUS_NO_MEMORY;
1152 strupper_m(upper_name);
1153
1154 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1155
1156 SAFE_FREE( upper_name );
1157
1158 if (!centry)
1159 goto do_query;
1160
1161 status = centry->status;
1162
1163 if (!NT_STATUS_IS_OK(status)) {
1164 centry_free(centry);
1165 return status;
1166 }
1167
1168 *name = centry_string( centry, mem_ctx );
1169
1170 centry_free(centry);
1171
1172 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1173 alias, *name ? *name : "(none)"));
1174
1175 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1176
1177 do_query:
1178
1179 /* If its not in cache and we are offline, then fail */
1180
1181 if ( get_global_winbindd_state_offline() || !domain->online ) {
1182 DEBUG(8,("resolve_alias_to_username: rejecting query "
1183 "in offline mode\n"));
1184 return NT_STATUS_NOT_FOUND;
1185 }
1186
1187 /* an alias cannot contain a domain prefix or '@' */
1188
1189 if (strchr(alias, '\\') || strchr(alias, '@')) {
1190 DEBUG(10,("resolve_alias_to_username: skipping fully "
1191 "qualified name %s\n", alias));
1192 return NT_STATUS_OBJECT_NAME_INVALID;
1193 }
1194
1195 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1196
1197 if ( NT_STATUS_IS_OK( status ) ) {
1198 wcache_save_alias_username( domain, status, alias, *name );
1199 }
1200
1201 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1202 wcache_save_alias_username(domain, status, alias, "(NULL)");
1203 }
1204
1205 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1206 nt_errstr(status)));
1207
1208 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1209 set_domain_offline( domain );
1210 }
1211
1212 return status;
1213 }
1214
1215 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const struct dom_sid *sid)
1216 {
1217 struct winbind_cache *cache = get_cache(domain);
1218 TDB_DATA data;
1219 fstring key_str, tmp;
1220 uint32 rid;
1221
1222 if (!cache->tdb) {
1223 return NT_STATUS_INTERNAL_DB_ERROR;
1224 }
1225
1226 if (is_null_sid(sid)) {
1227 return NT_STATUS_INVALID_SID;
1228 }
1229
1230 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1231 return NT_STATUS_INVALID_SID;
1232 }
1233
1234 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1235
1236 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1237 if (!data.dptr) {
1238 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1239 }
1240
1241 SAFE_FREE(data.dptr);
1242 return NT_STATUS_OK;
1243 }
1244
1245 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1246 as new salted ones. */
1247
1248 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1249 TALLOC_CTX *mem_ctx,
1250 const struct dom_sid *sid,
1251 const uint8 **cached_nt_pass,
1252 const uint8 **cached_salt)
1253 {
1254 struct winbind_cache *cache = get_cache(domain);
1255 struct cache_entry *centry = NULL;
1256 NTSTATUS status;
1257 time_t t;
1258 uint32 rid;
1259 fstring tmp;
1260
1261 if (!cache->tdb) {
1262 return NT_STATUS_INTERNAL_DB_ERROR;
1263 }
1264
1265 if (is_null_sid(sid)) {
1266 return NT_STATUS_INVALID_SID;
1267 }
1268
1269 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1270 return NT_STATUS_INVALID_SID;
1271 }
1272
1273 /* Try and get a salted cred first. If we can't
1274 fall back to an unsalted cred. */
1275
1276 centry = wcache_fetch(cache, domain, "CRED/%s",
1277 sid_to_fstring(tmp, sid));
1278 if (!centry) {
1279 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1280 sid_string_dbg(sid)));
1281 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1282 }
1283
1284 t = centry_time(centry);
1285
1286 /* In the salted case this isn't actually the nt_hash itself,
1287 but the MD5 of the salt + nt_hash. Let the caller
1288 sort this out. It can tell as we only return the cached_salt
1289 if we are returning a salted cred. */
1290
1291 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1292 if (*cached_nt_pass == NULL) {
1293 fstring sidstr;
1294
1295 sid_to_fstring(sidstr, sid);
1296
1297 /* Bad (old) cred cache. Delete and pretend we
1298 don't have it. */
1299 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1300 sidstr));
1301 wcache_delete("CRED/%s", sidstr);
1302 centry_free(centry);
1303 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1304 }
1305
1306 /* We only have 17 bytes more data in the salted cred case. */
1307 if (centry->len - centry->ofs == 17) {
1308 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1309 } else {
1310 *cached_salt = NULL;
1311 }
1312
1313 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1314 if (*cached_salt) {
1315 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1316 }
1317
1318 status = centry->status;
1319
1320 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1321 sid_string_dbg(sid), nt_errstr(status) ));
1322
1323 centry_free(centry);
1324 return status;
1325 }
1326
1327 /* Store creds for a SID - only writes out new salted ones. */
1328
1329 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1330 TALLOC_CTX *mem_ctx,
1331 const struct dom_sid *sid,
1332 const uint8 nt_pass[NT_HASH_LEN])
1333 {
1334 struct cache_entry *centry;
1335 fstring sid_string;
1336 uint32 rid;
1337 uint8 cred_salt[NT_HASH_LEN];
1338 uint8 salted_hash[NT_HASH_LEN];
1339
1340 if (is_null_sid(sid)) {
1341 return NT_STATUS_INVALID_SID;
1342 }
1343
1344 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1345 return NT_STATUS_INVALID_SID;
1346 }
1347
1348 centry = centry_start(domain, NT_STATUS_OK);
1349 if (!centry) {
1350 return NT_STATUS_INTERNAL_DB_ERROR;
1351 }
1352
1353 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1354
1355 centry_put_time(centry, time(NULL));
1356
1357 /* Create a salt and then salt the hash. */
1358 generate_random_buffer(cred_salt, NT_HASH_LEN);
1359 E_md5hash(cred_salt, nt_pass, salted_hash);
1360
1361 centry_put_hash16(centry, salted_hash);
1362 centry_put_hash16(centry, cred_salt);
1363 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1364
1365 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1366
1367 centry_free(centry);
1368
1369 return NT_STATUS_OK;
1370 }
1371
1372
1373 /* Query display info. This is the basic user list fn */
1374 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1375 TALLOC_CTX *mem_ctx,
1376 uint32 *num_entries,
1377 struct wbint_userinfo **info)
1378 {
1379 struct winbind_cache *cache = get_cache(domain);
1380 struct cache_entry *centry = NULL;
1381 NTSTATUS status;
1382 unsigned int i, retry;
1383 bool old_status = domain->online;
1384
1385 if (!cache->tdb)
1386 goto do_query;
1387
1388 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1389 if (!centry)
1390 goto do_query;
1391
1392 do_fetch_cache:
1393 *num_entries = centry_uint32(centry);
1394
1395 if (*num_entries == 0)
1396 goto do_cached;
1397
1398 (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1399 if (! (*info)) {
1400 smb_panic_fn("query_user_list out of memory");
1401 }
1402 for (i=0; i<(*num_entries); i++) {
1403 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1404 (*info)[i].full_name = centry_string(centry, mem_ctx);
1405 (*info)[i].homedir = centry_string(centry, mem_ctx);
1406 (*info)[i].shell = centry_string(centry, mem_ctx);
1407 centry_sid(centry, &(*info)[i].user_sid);
1408 centry_sid(centry, &(*info)[i].group_sid);
1409 }
1410
1411 do_cached:
1412 status = centry->status;
1413
1414 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1415 domain->name, nt_errstr(status) ));
1416
1417 centry_free(centry);
1418 return status;
1419
1420 do_query:
1421 *num_entries = 0;
1422 *info = NULL;
1423
1424 /* Return status value returned by seq number check */
1425
1426 if (!NT_STATUS_IS_OK(domain->last_status))
1427 return domain->last_status;
1428
1429 /* Put the query_user_list() in a retry loop. There appears to be
1430 * some bug either with Windows 2000 or Samba's handling of large
1431 * rpc replies. This manifests itself as sudden disconnection
1432 * at a random point in the enumeration of a large (60k) user list.
1433 * The retry loop simply tries the operation again. )-: It's not
1434 * pretty but an acceptable workaround until we work out what the
1435 * real problem is. */
1436
1437 retry = 0;
1438 do {
1439
1440 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1441 domain->name ));
1442
1443 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1444 if (!NT_STATUS_IS_OK(status)) {
1445 DEBUG(3, ("query_user_list: returned 0x%08x, "
1446 "retrying\n", NT_STATUS_V(status)));
1447 }
1448 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1449 DEBUG(3, ("query_user_list: flushing "
1450 "connection cache\n"));
1451 invalidate_cm_connection(&domain->conn);
1452 }
1453 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1454 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1455 if (!domain->internal && old_status) {
1456 set_domain_offline(domain);
1457 }
1458 /* store partial response. */
1459 if (*num_entries > 0) {
1460 /*
1461 * humm, what about the status used for cache?
1462 * Should it be NT_STATUS_OK?
1463 */
1464 break;
1465 }
1466 /*
1467 * domain is offline now, and there is no user entries,
1468 * try to fetch from cache again.
1469 */
1470 if (cache->tdb && !domain->online && !domain->internal && old_status) {
1471 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1472 /* partial response... */
1473 if (!centry) {
1474 goto skip_save;
1475 } else {
1476 goto do_fetch_cache;
1477 }
1478 } else {
1479 goto skip_save;
1480 }
1481 }
1482
1483 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1484 (retry++ < 5));
1485
1486 /* and save it */
1487 refresh_sequence_number(domain, false);
1488 if (!NT_STATUS_IS_OK(status)) {
1489 return status;
1490 }
1491 centry = centry_start(domain, status);
1492 if (!centry)
1493 goto skip_save;
1494 centry_put_uint32(centry, *num_entries);
1495 for (i=0; i<(*num_entries); i++) {
1496 centry_put_string(centry, (*info)[i].acct_name);
1497 centry_put_string(centry, (*info)[i].full_name);
1498 centry_put_string(centry, (*info)[i].homedir);
1499 centry_put_string(centry, (*info)[i].shell);
1500 centry_put_sid(centry, &(*info)[i].user_sid);
1501 centry_put_sid(centry, &(*info)[i].group_sid);
1502 if (domain->backend && domain->backend->consistent) {
1503 /* when the backend is consistent we can pre-prime some mappings */
1504 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1505 domain->name,
1506 (*info)[i].acct_name,
1507 &(*info)[i].user_sid,
1508 SID_NAME_USER);
1509 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1510 &(*info)[i].user_sid,
1511 domain->name,
1512 (*info)[i].acct_name,
1513 SID_NAME_USER);
1514 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1515 }
1516 }
1517 centry_end(centry, "UL/%s", domain->name);
1518 centry_free(centry);
1519
1520 skip_save:
1521 return status;
1522 }
1523
1524 /* list all domain groups */
1525 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1526 TALLOC_CTX *mem_ctx,
1527 uint32 *num_entries,
1528 struct acct_info **info)
1529 {
1530 struct winbind_cache *cache = get_cache(domain);
1531 struct cache_entry *centry = NULL;
1532 NTSTATUS status;
1533 unsigned int i;
1534 bool old_status;
1535
1536 old_status = domain->online;
1537 if (!cache->tdb)
1538 goto do_query;
1539
1540 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1541 if (!centry)
1542 goto do_query;
1543
1544 do_fetch_cache:
1545 *num_entries = centry_uint32(centry);
1546
1547 if (*num_entries == 0)
1548 goto do_cached;
1549
1550 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1551 if (! (*info)) {
1552 smb_panic_fn("enum_dom_groups out of memory");
1553 }
1554 for (i=0; i<(*num_entries); i++) {
1555 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1556 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1557 (*info)[i].rid = centry_uint32(centry);
1558 }
1559
1560 do_cached:
1561 status = centry->status;
1562
1563 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1564 domain->name, nt_errstr(status) ));
1565
1566 centry_free(centry);
1567 return status;
1568
1569 do_query:
1570 *num_entries = 0;
1571 *info = NULL;
1572
1573 /* Return status value returned by seq number check */
1574
1575 if (!NT_STATUS_IS_OK(domain->last_status))
1576 return domain->last_status;
1577
1578 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1579 domain->name ));
1580
1581 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1582
1583 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1584 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1585 if (!domain->internal && old_status) {
1586 set_domain_offline(domain);
1587 }
1588 if (cache->tdb &&
1589 !domain->online &&
1590 !domain->internal &&
1591 old_status) {
1592 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1593 if (centry) {
1594 goto do_fetch_cache;
1595 }
1596 }
1597 }
1598 /* and save it */
1599 refresh_sequence_number(domain, false);
1600 if (!NT_STATUS_IS_OK(status)) {
1601 return status;
1602 }
1603 centry = centry_start(domain, status);
1604 if (!centry)
1605 goto skip_save;
1606 centry_put_uint32(centry, *num_entries);
1607 for (i=0; i<(*num_entries); i++) {
1608 centry_put_string(centry, (*info)[i].acct_name);
1609 centry_put_string(centry, (*info)[i].acct_desc);
1610 centry_put_uint32(centry, (*info)[i].rid);
1611 }
1612 centry_end(centry, "GL/%s/domain", domain->name);
1613 centry_free(centry);
1614
1615 skip_save:
1616 return status;
1617 }
1618
1619 /* list all domain groups */
1620 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1621 TALLOC_CTX *mem_ctx,
1622 uint32 *num_entries,
1623 struct acct_info **info)
1624 {
1625 struct winbind_cache *cache = get_cache(domain);
1626 struct cache_entry *centry = NULL;
1627 NTSTATUS status;
1628 unsigned int i;
1629 bool old_status;
1630
1631 old_status = domain->online;
1632 if (!cache->tdb)
1633 goto do_query;
1634
1635 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1636 if (!centry)
1637 goto do_query;
1638
1639 do_fetch_cache:
1640 *num_entries = centry_uint32(centry);
1641
1642 if (*num_entries == 0)
1643 goto do_cached;
1644
1645 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1646 if (! (*info)) {
1647 smb_panic_fn("enum_dom_groups out of memory");
1648 }
1649 for (i=0; i<(*num_entries); i++) {
1650 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1651 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1652 (*info)[i].rid = centry_uint32(centry);
1653 }
1654
1655 do_cached:
1656
1657 /* If we are returning cached data and the domain controller
1658 is down then we don't know whether the data is up to date
1659 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1660 indicate this. */
1661
1662 if (wcache_server_down(domain)) {
1663 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1664 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1665 } else
1666 status = centry->status;
1667
1668 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1669 domain->name, nt_errstr(status) ));
1670
1671 centry_free(centry);
1672 return status;
1673
1674 do_query:
1675 *num_entries = 0;
1676 *info = NULL;
1677
1678 /* Return status value returned by seq number check */
1679
1680 if (!NT_STATUS_IS_OK(domain->last_status))
1681 return domain->last_status;
1682
1683 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1684 domain->name ));
1685
1686 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1687
1688 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1689 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1690 if (!domain->internal && old_status) {
1691 set_domain_offline(domain);
1692 }
1693 if (cache->tdb &&
1694 !domain->internal &&
1695 !domain->online &&
1696 old_status) {
1697 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1698 if (centry) {
1699 goto do_fetch_cache;
1700 }
1701 }
1702 }
1703 /* and save it */
1704 refresh_sequence_number(domain, false);
1705 if (!NT_STATUS_IS_OK(status)) {
1706 return status;
1707 }
1708 centry = centry_start(domain, status);
1709 if (!centry)
1710 goto skip_save;
1711 centry_put_uint32(centry, *num_entries);
1712 for (i=0; i<(*num_entries); i++) {
1713 centry_put_string(centry, (*info)[i].acct_name);
1714 centry_put_string(centry, (*info)[i].acct_desc);
1715 centry_put_uint32(centry, (*info)[i].rid);
1716 }
1717 centry_end(centry, "GL/%s/local", domain->name);
1718 centry_free(centry);
1719
1720 skip_save:
1721 return status;
1722 }
1723
1724 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1725 const char *domain_name,
1726 const char *name,
1727 struct dom_sid *sid,
1728 enum lsa_SidType *type)
1729 {
1730 struct winbind_cache *cache = get_cache(domain);
1731 struct cache_entry *centry;
1732 NTSTATUS status;
1733 char *uname;
1734
1735 if (cache->tdb == NULL) {
1736 return NT_STATUS_NOT_FOUND;
1737 }
1738
1739 uname = talloc_strdup_upper(talloc_tos(), name);
1740 if (uname == NULL) {
1741 return NT_STATUS_NO_MEMORY;
1742 }
1743
1744 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1745 TALLOC_FREE(uname);
1746 if (centry == NULL) {
1747 return NT_STATUS_NOT_FOUND;
1748 }
1749
1750 status = centry->status;
1751 if (NT_STATUS_IS_OK(status)) {
1752 *type = (enum lsa_SidType)centry_uint32(centry);
1753 centry_sid(centry, sid);
1754 }
1755
1756 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1757 "%s\n", domain->name, nt_errstr(status) ));
1758
1759 centry_free(centry);
1760 return status;
1761 }
1762
1763 /* convert a single name to a sid in a domain */
1764 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1765 TALLOC_CTX *mem_ctx,
1766 const char *domain_name,
1767 const char *name,
1768 uint32_t flags,
1769 struct dom_sid *sid,
1770 enum lsa_SidType *type)
1771 {
1772 NTSTATUS status;
1773 bool old_status;
1774
1775 old_status = domain->online;
1776
1777 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1778 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1779 return status;
1780 }
1781
1782 ZERO_STRUCTP(sid);
1783
1784 /* If the seq number check indicated that there is a problem
1785 * with this DC, then return that status... except for
1786 * access_denied. This is special because the dc may be in
1787 * "restrict anonymous = 1" mode, in which case it will deny
1788 * most unauthenticated operations, but *will* allow the LSA
1789 * name-to-sid that we try as a fallback. */
1790
1791 if (!(NT_STATUS_IS_OK(domain->last_status)
1792 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1793 return domain->last_status;
1794
1795 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1796 domain->name ));
1797
1798 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1799 name, flags, sid, type);
1800
1801 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1802 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1803 if (!domain->internal && old_status) {
1804 set_domain_offline(domain);
1805 }
1806 if (!domain->internal &&
1807 !domain->online &&
1808 old_status) {
1809 NTSTATUS cache_status;
1810 cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1811 return cache_status;
1812 }
1813 }
1814 /* and save it */
1815 refresh_sequence_number(domain, false);
1816
1817 if (domain->online &&
1818 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1819 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1820
1821 /* Only save the reverse mapping if this was not a UPN */
1822 if (!strchr(name, '@')) {
1823 strupper_m(CONST_DISCARD(char *,domain_name));
1824 strlower_m(CONST_DISCARD(char *,name));
1825 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1826 }
1827 }
1828
1829 return status;
1830 }
1831
1832 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1833 const struct dom_sid *sid,
1834 TALLOC_CTX *mem_ctx,
1835 char **domain_name,
1836 char **name,
1837 enum lsa_SidType *type)
1838 {
1839 struct winbind_cache *cache = get_cache(domain);
1840 struct cache_entry *centry;
1841 char *sid_string;
1842 NTSTATUS status;
1843
1844 if (cache->tdb == NULL) {
1845 return NT_STATUS_NOT_FOUND;
1846 }
1847
1848 sid_string = sid_string_tos(sid);
1849 if (sid_string == NULL) {
1850 return NT_STATUS_NO_MEMORY;
1851 }
1852
1853 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1854 TALLOC_FREE(sid_string);
1855 if (centry == NULL) {
1856 return NT_STATUS_NOT_FOUND;
1857 }
1858
1859 if (NT_STATUS_IS_OK(centry->status)) {
1860 *type = (enum lsa_SidType)centry_uint32(centry);
1861 *domain_name = centry_string(centry, mem_ctx);
1862 *name = centry_string(centry, mem_ctx);
1863 }
1864
1865 status = centry->status;
1866 centry_free(centry);
1867
1868 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1869 "%s\n", domain->name, nt_errstr(status) ));
1870
1871 return status;
1872 }
1873
1874 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1875 given */
1876 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1877 TALLOC_CTX *mem_ctx,
1878 const struct dom_sid *sid,
1879 char **domain_name,
1880 char **name,
1881 enum lsa_SidType *type)
1882 {
1883 NTSTATUS status;
1884 bool old_status;
1885
1886 old_status = domain->online;
1887 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1888 type);
1889 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1890 return status;
1891 }
1892
1893 *name = NULL;
1894 *domain_name = NULL;
1895
1896 /* If the seq number check indicated that there is a problem
1897 * with this DC, then return that status... except for
1898 * access_denied. This is special because the dc may be in
1899 * "restrict anonymous = 1" mode, in which case it will deny
1900 * most unauthenticated operations, but *will* allow the LSA
1901 * sid-to-name that we try as a fallback. */
1902
1903 if (!(NT_STATUS_IS_OK(domain->last_status)
1904 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1905 return domain->last_status;
1906
1907 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1908 domain->name ));
1909
1910 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1911
1912 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1913 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1914 if (!domain->internal && old_status) {
1915 set_domain_offline(domain);
1916 }
1917 if (!domain->internal &&
1918 !domain->online &&
1919 old_status) {
1920 NTSTATUS cache_status;
1921 cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1922 domain_name, name, type);
1923 return cache_status;
1924 }
1925 }
1926 /* and save it */
1927 refresh_sequence_number(domain, false);
1928 if (!NT_STATUS_IS_OK(status)) {
1929 return status;
1930 }
1931 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1932
1933 /* We can't save the name to sid mapping here, as with sid history a
1934 * later name2sid would give the wrong sid. */
1935
1936 return status;
1937 }
1938
1939 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1940 TALLOC_CTX *mem_ctx,
1941 const struct dom_sid *domain_sid,
1942 uint32 *rids,
1943 size_t num_rids,
1944 char **domain_name,
1945 char ***names,
1946 enum lsa_SidType **types)
1947 {
1948 struct winbind_cache *cache = get_cache(domain);
1949 size_t i;
1950 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1951 bool have_mapped;
1952 bool have_unmapped;
1953 bool old_status;
1954
1955 old_status = domain->online;
1956 *domain_name = NULL;
1957 *names = NULL;
1958 *types = NULL;
1959
1960 if (!cache->tdb) {
1961 goto do_query;
1962 }
1963
1964 if (num_rids == 0) {
1965 return NT_STATUS_OK;
1966 }
1967
1968 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1969 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1970
1971 if ((*names == NULL) || (*types == NULL)) {
1972 result = NT_STATUS_NO_MEMORY;
1973 goto error;
1974 }
1975
1976 have_mapped = have_unmapped = false;
1977
1978 for (i=0; i<num_rids; i++) {
1979 struct dom_sid sid;
1980 struct cache_entry *centry;
1981 fstring tmp;
1982
1983 if (!sid_compose(&sid, domain_sid, rids[i])) {
1984 result = NT_STATUS_INTERNAL_ERROR;
1985 goto error;
1986 }
1987
1988 centry = wcache_fetch(cache, domain, "SN/%s",
1989 sid_to_fstring(tmp, &sid));
1990 if (!centry) {
1991 goto do_query;
1992 }
1993
1994 (*types)[i] = SID_NAME_UNKNOWN;
1995 (*names)[i] = talloc_strdup(*names, "");
1996
1997 if (NT_STATUS_IS_OK(centry->status)) {
1998 char *dom;
1999 have_mapped = true;
2000 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2001
2002 dom = centry_string(centry, mem_ctx);
2003 if (*domain_name == NULL) {
2004 *domain_name = dom;
2005 } else {
2006 talloc_free(dom);
2007 }
2008
2009 (*names)[i] = centry_string(centry, *names);
2010
2011 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2012 have_unmapped = true;
2013
2014 } else {
2015 /* something's definitely wrong */
2016 result = centry->status;
2017 goto error;
2018 }
2019
2020 centry_free(centry);
2021 }
2022
2023 if (!have_mapped) {
2024 return NT_STATUS_NONE_MAPPED;
2025 }
2026 if (!have_unmapped) {
2027 return NT_STATUS_OK;
2028 }
2029 return STATUS_SOME_UNMAPPED;
2030
2031 do_query:
2032
2033 TALLOC_FREE(*names);
2034 TALLOC_FREE(*types);
2035
2036 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2037 rids, num_rids, domain_name,
2038 names, types);
2039
2040 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2041 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2042 if (!domain->internal && old_status) {
2043 set_domain_offline(domain);
2044 }
2045 if (cache->tdb &&
2046 !domain->internal &&
2047 !domain->online &&
2048 old_status) {
2049 have_mapped = have_unmapped = false;
2050
2051 for (i=0; i<num_rids; i++) {
2052 struct dom_sid sid;
2053 struct cache_entry *centry;
2054 fstring tmp;
2055
2056 if (!sid_compose(&sid, domain_sid, rids[i])) {
2057 result = NT_STATUS_INTERNAL_ERROR;
2058 goto error;
2059 }
2060
2061 centry = wcache_fetch(cache, domain, "SN/%s",
2062 sid_to_fstring(tmp, &sid));
2063 if (!centry) {
2064 (*types)[i] = SID_NAME_UNKNOWN;
2065 (*names)[i] = talloc_strdup(*names, "");
2066 continue;
2067 }
2068
2069 (*types)[i] = SID_NAME_UNKNOWN;
2070 (*names)[i] = talloc_strdup(*names, "");
2071
2072 if (NT_STATUS_IS_OK(centry->status)) {
2073 char *dom;
2074 have_mapped = true;
2075 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2076
2077 dom = centry_string(centry, mem_ctx);
2078 if (*domain_name == NULL) {
2079 *domain_name = dom;
2080 } else {
2081 talloc_free(dom);
2082 }
2083
2084 (*names)[i] = centry_string(centry, *names);
2085
2086 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2087 have_unmapped = true;
2088
2089 } else {
2090 /* something's definitely wrong */
2091 result = centry->status;
2092 goto error;
2093 }
2094
2095 centry_free(centry);
2096 }
2097
2098 if (!have_mapped) {
2099 return NT_STATUS_NONE_MAPPED;
2100 }
2101 if (!have_unmapped) {
2102 return NT_STATUS_OK;
2103 }
2104 return STATUS_SOME_UNMAPPED;
2105 }
2106 }
2107 /*
2108 None of the queried rids has been found so save all negative entries
2109 */
2110 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2111 for (i = 0; i < num_rids; i++) {
2112 struct dom_sid sid;
2113 const char *name = "";
2114 const enum lsa_SidType type = SID_NAME_UNKNOWN;
2115 NTSTATUS status = NT_STATUS_NONE_MAPPED;
2116
2117 if (!sid_compose(&sid, domain_sid, rids[i])) {
2118 return NT_STATUS_INTERNAL_ERROR;
2119 }
2120
2121 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2122 name, type);
2123 }
2124
2125 return result;
2126 }
2127
2128 /*
2129 Some or all of the queried rids have been found.
2130 */
2131 if (!NT_STATUS_IS_OK(result) &&
2132 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2133 return result;
2134 }
2135
2136 refresh_sequence_number(domain, false);
2137
2138 for (i=0; i<num_rids; i++) {
2139 struct dom_sid sid;
2140 NTSTATUS status;
2141
2142 if (!sid_compose(&sid, domain_sid, rids[i])) {
2143 result = NT_STATUS_INTERNAL_ERROR;
2144 goto error;
2145 }
2146
2147 status = (*types)[i] == SID_NAME_UNKNOWN ?
2148 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2149
2150 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2151 (*names)[i], (*types)[i]);
2152 }
2153
2154 return result;
2155
2156 error:
2157 TALLOC_FREE(*names);
2158 TALLOC_FREE(*types);
2159 return result;
2160 }
2161
2162 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2163 TALLOC_CTX *mem_ctx,
2164 const struct dom_sid *user_sid,
2165 struct wbint_userinfo *info)
2166 {
2167 struct winbind_cache *cache = get_cache(domain);
2168 struct cache_entry *centry = NULL;
2169 NTSTATUS status;
2170 char *sid_string;
2171
2172 if (cache->tdb == NULL) {
2173 return NT_STATUS_NOT_FOUND;
2174 }
2175
2176 sid_string = sid_string_tos(user_sid);
2177 if (sid_string == NULL) {
2178 return NT_STATUS_NO_MEMORY;
2179 }
2180
2181 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2182 TALLOC_FREE(sid_string);
2183 if (centry == NULL) {
2184 return NT_STATUS_NOT_FOUND;
2185 }
2186
2187 /*
2188 * If we have an access denied cache entry and a cached info3
2189 * in the samlogon cache then do a query. This will force the
2190 * rpc back end to return the info3 data.
2191 */
2192
2193 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2194 netsamlogon_cache_have(user_sid)) {
2195 DEBUG(10, ("query_user: cached access denied and have cached "
2196 "info3\n"));
2197 domain->last_status = NT_STATUS_OK;
2198 centry_free(centry);
2199 return NT_STATUS_NOT_FOUND;
2200 }
2201
2202 /* if status is not ok then this is a negative hit
2203 and the rest of the data doesn't matter */
2204 status = centry->status;
2205 if (NT_STATUS_IS_OK(status)) {
2206 info->acct_name = centry_string(centry, mem_ctx);
2207 info->full_name = centry_string(centry, mem_ctx);
2208 info->homedir = centry_string(centry, mem_ctx);
2209 info->shell = centry_string(centry, mem_ctx);
2210 info->primary_gid = centry_uint32(centry);
2211 centry_sid(centry, &info->user_sid);
2212 centry_sid(centry, &info->group_sid);
2213 }
2214
2215 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2216 "%s\n", domain->name, nt_errstr(status) ));
2217
2218 centry_free(centry);
2219 return status;
2220 }
2221
2222 /* Lookup user information from a rid */
2223 static NTSTATUS query_user(struct winbindd_domain *domain,
2224 TALLOC_CTX *mem_ctx,
2225 const struct dom_sid *user_sid,
2226 struct wbint_userinfo *info)
2227 {
2228 NTSTATUS status;
2229 bool old_status;
2230
2231 old_status = domain->online;
2232 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2233 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2234 return status;
2235 }
2236
2237 ZERO_STRUCTP(info);
2238
2239 /* Return status value returned by seq number check */
2240
2241 if (!NT_STATUS_IS_OK(domain->last_status))
2242 return domain->last_status;
2243
2244 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2245 domain->name ));
2246
2247 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2248
2249 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2250 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2251 if (!domain->internal && old_status) {
2252 set_domain_offline(domain);
2253 }
2254 if (!domain->internal &&
2255 !domain->online &&
2256 old_status) {
2257 NTSTATUS cache_status;
2258 cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2259 return cache_status;
2260 }
2261 }
2262 /* and save it */
2263 refresh_sequence_number(domain, false);
2264 if (!NT_STATUS_IS_OK(status)) {
2265 return status;
2266 }
2267 wcache_save_user(domain, status, info);
2268
2269 return status;
2270 }
2271
2272 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2273 TALLOC_CTX *mem_ctx,
2274 const struct dom_sid *user_sid,
2275 uint32_t *pnum_sids,
2276 struct dom_sid **psids)
2277 {
2278 struct winbind_cache *cache = get_cache(domain);
2279 struct cache_entry *centry = NULL;
2280 NTSTATUS status;
2281 uint32_t i, num_sids;
2282 struct dom_sid *sids;
2283 fstring sid_string;
2284
2285 if (cache->tdb == NULL) {
2286 return NT_STATUS_NOT_FOUND;
2287 }
2288
2289 centry = wcache_fetch(cache, domain, "UG/%s",
2290 sid_to_fstring(sid_string, user_sid));
2291 if (centry == NULL) {
2292 return NT_STATUS_NOT_FOUND;
2293 }
2294
2295 /* If we have an access denied cache entry and a cached info3 in the
2296 samlogon cache then do a query. This will force the rpc back end
2297 to return the info3 data. */
2298
2299 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2300 && netsamlogon_cache_have(user_sid)) {
2301 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2302 "cached info3\n"));
2303 domain->last_status = NT_STATUS_OK;
2304 centry_free(centry);
2305 return NT_STATUS_NOT_FOUND;
2306 }
2307
2308 num_sids = centry_uint32(centry);
2309 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2310 if (sids == NULL) {
2311 centry_free(centry);
2312 return NT_STATUS_NO_MEMORY;
2313 }
2314
2315 for (i=0; i<num_sids; i++) {
2316 centry_sid(centry, &sids[i]);
2317 }
2318
2319 status = centry->status;
2320
2321 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2322 "status: %s\n", domain->name, nt_errstr(status)));
2323
2324 centry_free(centry);
2325
2326 *pnum_sids = num_sids;
2327 *psids = sids;
2328 return status;
2329 }
2330
2331 /* Lookup groups a user is a member of. */
2332 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2333 TALLOC_CTX *mem_ctx,
2334 const struct dom_sid *user_sid,
2335 uint32 *num_groups, struct dom_sid **user_gids)
2336 {
2337 struct cache_entry *centry = NULL;
2338 NTSTATUS status;
2339 unsigned int i;
2340 fstring sid_string;
2341 bool old_status;
2342
2343 old_status = domain->online;
2344 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2345 num_groups, user_gids);
2346 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2347 return status;
2348 }
2349
2350 (*num_groups) = 0;
2351 (*user_gids) = NULL;
2352
2353 /* Return status value returned by seq number check */
2354
2355 if (!NT_STATUS_IS_OK(domain->last_status))
2356 return domain->last_status;
2357
2358 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2359 domain->name ));
2360
2361 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2362
2363 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2364 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2365 if (!domain->internal && old_status) {
2366 set_domain_offline(domain);
2367 }
2368 if (!domain->internal &&
2369 !domain->online &&
2370 old_status) {
2371 NTSTATUS cache_status;
2372 cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2373 num_groups, user_gids);
2374 return cache_status;
2375 }
2376 }
2377 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2378 goto skip_save;
2379
2380 /* and save it */
2381 refresh_sequence_number(domain, false);
2382 if (!NT_STATUS_IS_OK(status)) {
2383 return status;
2384 }
2385 centry = centry_start(domain, status);
2386 if (!centry)
2387 goto skip_save;
2388
2389 centry_put_uint32(centry, *num_groups);
2390 for (i=0; i<(*num_groups); i++) {
2391 centry_put_sid(centry, &(*user_gids)[i]);
2392 }
2393
2394 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2395 centry_free(centry);
2396
2397 skip_save:
2398 return status;
2399 }
2400
2401 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2402 const struct dom_sid *sids)
2403 {
2404 uint32_t i;
2405 char *sidlist;
2406
2407 sidlist = talloc_strdup(mem_ctx, "");
2408 if (sidlist == NULL) {
2409 return NULL;
2410 }
2411 for (i=0; i<num_sids; i++) {
2412 fstring tmp;
2413 sidlist = talloc_asprintf_append_buffer(
2414 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2415 if (sidlist == NULL) {
2416 return NULL;
2417 }
2418 }
2419 return sidlist;
2420 }
2421
2422 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2423 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2424 const struct dom_sid *sids,
2425 uint32_t *pnum_aliases, uint32_t **paliases)
2426 {
2427 struct winbind_cache *cache = get_cache(domain);
2428 struct cache_entry *centry = NULL;
2429 uint32_t num_aliases;
2430 uint32_t *aliases;
2431 NTSTATUS status;
2432 char *sidlist;
2433 int i;
2434
2435 if (cache->tdb == NULL) {
2436 return NT_STATUS_NOT_FOUND;
2437 }
2438
2439 if (num_sids == 0) {
2440 *pnum_aliases = 0;
2441 *paliases = NULL;
2442 return NT_STATUS_OK;
2443 }
2444
2445 /* We need to cache indexed by the whole list of SIDs, the aliases
2446 * resulting might come from any of the SIDs. */
2447
2448 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2449 if (sidlist == NULL) {
2450 return NT_STATUS_NO_MEMORY;
2451 }
2452
2453 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2454 TALLOC_FREE(sidlist);
2455 if (centry == NULL) {
2456 return NT_STATUS_NOT_FOUND;
2457 }
2458
2459 num_aliases = centry_uint32(centry);
2460 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2461 if (aliases == NULL) {
2462 centry_free(centry);
2463 return NT_STATUS_NO_MEMORY;
2464 }
2465
2466 for (i=0; i<num_aliases; i++) {
2467 aliases[i] = centry_uint32(centry);
2468 }
2469
2470 status = centry->status;
2471
2472 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2473 "status %s\n", domain->name, nt_errstr(status)));
2474
2475 centry_free(centry);
2476
2477 *pnum_aliases = num_aliases;
2478 *paliases = aliases;
2479
2480 return status;
2481 }
2482
2483 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2484 TALLOC_CTX *mem_ctx,
2485 uint32 num_sids, const struct dom_sid *sids,
2486 uint32 *num_aliases, uint32 **alias_rids)
2487 {
2488 struct cache_entry *centry = NULL;
2489 NTSTATUS status;
2490 char *sidlist;
2491 int i;
2492 bool old_status;
2493
2494 old_status = domain->online;
2495 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2496 num_aliases, alias_rids);
2497 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2498 return status;
2499 }
2500
2501 (*num_aliases) = 0;
2502 (*alias_rids) = NULL;
2503
2504 if (!NT_STATUS_IS_OK(domain->last_status))
2505 return domain->last_status;
2506
2507 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2508 "for domain %s\n", domain->name ));
2509
2510 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2511 if (sidlist == NULL) {
2512 return NT_STATUS_NO_MEMORY;
2513 }
2514
2515 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2516 num_sids, sids,
2517 num_aliases, alias_rids);
2518
2519 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2520 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2521 if (!domain->internal && old_status) {
2522 set_domain_offline(domain);
2523 }
2524 if (!domain->internal &&
2525 !domain->online &&
2526 old_status) {
2527 NTSTATUS cache_status;
2528 cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2529 sids, num_aliases, alias_rids);
2530 return cache_status;
2531 }
2532 }
2533 /* and save it */
2534 refresh_sequence_number(domain, false);
2535 if (!NT_STATUS_IS_OK(status)) {
2536 return status;
2537 }
2538 centry = centry_start(domain, status);
2539 if (!centry)
2540 goto skip_save;
2541 centry_put_uint32(centry, *num_aliases);
2542 for (i=0; i<(*num_aliases); i++)
2543 centry_put_uint32(centry, (*alias_rids)[i]);
2544 centry_end(centry, "UA%s", sidlist);
2545 centry_free(centry);
2546
2547 skip_save:
2548 return status;
2549 }
2550
2551 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2552 TALLOC_CTX *mem_ctx,
2553 const struct dom_sid *group_sid,
2554 uint32_t *num_names,
2555 struct dom_sid **sid_mem, char ***names,
2556 uint32_t **name_types)
2557 {
2558 struct winbind_cache *cache = get_cache(domain);
2559 struct cache_entry *centry = NULL;
2560 NTSTATUS status;
2561 unsigned int i;
2562 char *sid_string;
2563
2564 if (cache->tdb == NULL) {
2565 return NT_STATUS_NOT_FOUND;
2566 }
2567
2568 sid_string = sid_string_tos(group_sid);
2569 if (sid_string == NULL) {
2570 return NT_STATUS_NO_MEMORY;
2571 }
2572
2573 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2574 TALLOC_FREE(sid_string);
2575 if (centry == NULL) {
2576 return NT_STATUS_NOT_FOUND;
2577 }
2578
2579 *sid_mem = NULL;
2580 *names = NULL;
2581 *name_types = NULL;
2582
2583 *num_names = centry_uint32(centry);
2584 if (*num_names == 0) {
2585 centry_free(centry);
2586 return NT_STATUS_OK;
2587 }
2588
2589 *sid_mem = talloc_array(mem_ctx, struct dom_sid, *num_names);
2590 *names = talloc_array(mem_ctx, char *, *num_names);
2591 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2592
2593 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2594 TALLOC_FREE(*sid_mem);
2595 TALLOC_FREE(*names);
2596 TALLOC_FREE(*name_types);
2597 centry_free(centry);
2598 return NT_STATUS_NO_MEMORY;
2599 }
2600
2601 for (i=0; i<(*num_names); i++) {
2602 centry_sid(centry, &(*sid_mem)[i]);
2603 (*names)[i] = centry_string(centry, mem_ctx);
2604 (*name_types)[i] = centry_uint32(centry);
2605 }
2606
2607 status = centry->status;
2608
2609 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2610 "status: %s\n", domain->name, nt_errstr(status)));
2611
2612 centry_free(centry);
2613 return status;
2614 }
2615
2616 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2617 TALLOC_CTX *mem_ctx,
2618 const struct dom_sid *group_sid,
2619 enum lsa_SidType type,
2620 uint32 *num_names,
2621 struct dom_sid **sid_mem, char ***names,
2622 uint32 **name_types)
2623 {
2624 struct cache_entry *centry = NULL;
2625 NTSTATUS status;
2626 unsigned int i;
2627 fstring sid_string;
2628 bool old_status;
2629
2630 old_status = domain->online;
2631 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2632 sid_mem, names, name_types);
2633 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2634 return status;
2635 }
2636
2637 (*num_names) = 0;
2638 (*sid_mem) = NULL;
2639 (*names) = NULL;
2640 (*name_types) = NULL;
2641
2642 /* Return status value returned by seq number check */
2643
2644 if (!NT_STATUS_IS_OK(domain->last_status))
2645 return domain->last_status;
2646
2647 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2648 domain->name ));
2649
2650 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2651 type, num_names,
2652 sid_mem, names, name_types);
2653
2654 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2655 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2656 if (!domain->internal && old_status) {
2657 set_domain_offline(domain);
2658 }
2659 if (!domain->internal &&
2660 !domain->online &&
2661 old_status) {
2662 NTSTATUS cache_status;
2663 cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2664 num_names, sid_mem, names,
2665 name_types);
2666 return cache_status;
2667 }
2668 }
2669 /* and save it */
2670 refresh_sequence_number(domain, false);
2671 if (!NT_STATUS_IS_OK(status)) {
2672 return status;
2673 }
2674 centry = centry_start(domain, status);
2675 if (!centry)
2676 goto skip_save;
2677 centry_put_uint32(centry, *num_names);
2678 for (i=0; i<(*num_names); i++) {
2679 centry_put_sid(centry, &(*sid_mem)[i]);
2680 centry_put_string(centry, (*names)[i]);
2681 centry_put_uint32(centry, (*name_types)[i]);
2682 }
2683 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2684 centry_free(centry);
2685
2686 skip_save:
2687 return status;
2688 }
2689
2690 /* find the sequence number for a domain */
2691 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2692 {
2693 refresh_sequence_number(domain, false);
2694
2695 *seq = domain->sequence_number;
2696
2697 return NT_STATUS_OK;
2698 }
2699
2700 /* enumerate trusted domains
2701 * (we need to have the list of trustdoms in the cache when we go offline) -
2702 * Guenther */
2703 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2704 TALLOC_CTX *mem_ctx,
2705 struct netr_DomainTrustList *trusts)
2706 {
2707 NTSTATUS status;
2708 struct winbind_cache *cache;
2709 struct winbindd_tdc_domain *dom_list = NULL;
2710 size_t num_domains = 0;
2711 bool retval = false;
2712 int i;
2713 bool old_status;
2714
2715 old_status = domain->online;
2716 trusts->count = 0;
2717 trusts->array = NULL;
2718
2719 cache = get_cache(domain);
2720 if (!cache || !cache->tdb) {
2721 goto do_query;
2722 }
2723
2724 if (domain->online) {
2725 goto do_query;
2726 }
2727
2728 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2729 if (!retval || !num_domains || !dom_list) {
2730 TALLOC_FREE(dom_list);
2731 goto do_query;
2732 }
2733
2734 do_fetch_cache:
2735 trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
2736 if (!trusts->array) {
2737 TALLOC_FREE(dom_list);
2738 return NT_STATUS_NO_MEMORY;
2739 }
2740
2741 for (i = 0; i < num_domains; i++) {
2742 struct netr_DomainTrust *trust;
2743 struct dom_sid *sid;
2744 struct winbindd_domain *dom;
2745
2746 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2747 if (dom && dom->internal) {
2748 continue;
2749 }
2750
2751 trust = &trusts->array[trusts->count];
2752 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2753 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2754 sid = talloc(trusts->array, struct dom_sid);
2755 if (!trust->netbios_name || !trust->dns_name ||
2756 !sid) {
2757 TALLOC_FREE(dom_list);
2758 TALLOC_FREE(trusts->array);
2759 return NT_STATUS_NO_MEMORY;
2760 }
2761
2762 trust->trust_flags = dom_list[i].trust_flags;
2763 trust->trust_attributes = dom_list[i].trust_attribs;
2764 trust->trust_type = dom_list[i].trust_type;
2765 sid_copy(sid, &dom_list[i].sid);
2766 trust->sid = sid;
2767 trusts->count++;
2768 }
2769
2770 TALLOC_FREE(dom_list);
2771 return NT_STATUS_OK;
2772
2773 do_query:
2774 /* Return status value returned by seq number check */
2775
2776 if (!NT_STATUS_IS_OK(domain->last_status))
2777 return domain->last_status;
2778
2779 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2780 domain->name ));
2781
2782 status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2783
2784 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2785 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2786 if (!domain->internal && old_status) {
2787 set_domain_offline(domain);
2788 }
2789 if (!domain->internal &&
2790 !domain->online &&
2791 old_status) {
2792 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2793 if (retval && num_domains && dom_list) {
2794 TALLOC_FREE(trusts->array);
2795 trusts->count = 0;
2796 goto do_fetch_cache;
2797 }
2798 }
2799 }
2800 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2801 * so that the generic centry handling still applies correctly -
2802 * Guenther*/
2803
2804 if (!NT_STATUS_IS_ERR(status)) {
2805 status = NT_STATUS_OK;
2806 }
2807 return status;
2808 }
2809
2810 /* get lockout policy */
2811 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2812 TALLOC_CTX *mem_ctx,
2813 struct samr_DomInfo12 *policy)
2814 {
2815 struct winbind_cache *cache = get_cache(domain);
2816 struct cache_entry *centry = NULL;
2817 NTSTATUS status;
2818 bool old_status;
2819
2820 old_status = domain->online;
2821 if (!cache->tdb)
2822 goto do_query;
2823
2824 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2825
2826 if (!centry)
2827 goto do_query;
2828
2829 do_fetch_cache:
2830 policy->lockout_duration = centry_nttime(centry);
2831 policy->lockout_window = centry_nttime(centry);
2832 policy->lockout_threshold = centry_uint16(centry);
2833
2834 status = centry->status;
2835
2836 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2837 domain->name, nt_errstr(status) ));
2838
2839 centry_free(centry);
2840 return status;
2841
2842 do_query:
2843 ZERO_STRUCTP(policy);
2844
2845 /* Return status value returned by seq number check */
2846
2847 if (!NT_STATUS_IS_OK(domain->last_status))
2848 return domain->last_status;
2849
2850 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2851 domain->name ));
2852
2853 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2854
2855 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2856 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2857 if (!domain->internal && old_status) {
2858 set_domain_offline(domain);
2859 }
2860 if (cache->tdb &&
2861 !domain->internal &&
2862 !domain->online &&
2863 old_status) {
2864 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2865 if (centry) {
2866 goto do_fetch_cache;
2867 }
2868 }
2869 }
2870 /* and save it */
2871 refresh_sequence_number(domain, false);
2872 if (!NT_STATUS_IS_OK(status)) {
2873 return status;
2874 }
2875 wcache_save_lockout_policy(domain, status, policy);
2876
2877 return status;
2878 }
2879
2880 /* get password policy */
2881 static NTSTATUS password_policy(struct winbindd_domain *domain,
2882 TALLOC_CTX *mem_ctx,
2883 struct samr_DomInfo1 *policy)
2884 {
2885 struct winbind_cache *cache = get_cache(domain);
2886 struct cache_entry *centry = NULL;
2887 NTSTATUS status;
2888 bool old_status;
2889
2890 old_status = domain->online;
2891 if (!cache->tdb)
2892 goto do_query;
2893
2894 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2895
2896 if (!centry)
2897 goto do_query;
2898
2899 do_fetch_cache:
2900 policy->min_password_length = centry_uint16(centry);
2901 policy->password_history_length = centry_uint16(centry);
2902 policy->password_properties = centry_uint32(centry);
2903 policy->max_password_age = centry_nttime(centry);
2904 policy->min_password_age = centry_nttime(centry);
2905
2906 status = centry->status;
2907
2908 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2909 domain->name, nt_errstr(status) ));
2910
2911 centry_free(centry);
2912 return status;
2913
2914 do_query:
2915 ZERO_STRUCTP(policy);
2916
2917 /* Return status value returned by seq number check */
2918
2919 if (!NT_STATUS_IS_OK(domain->last_status))
2920 return domain->last_status;
2921
2922 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2923 domain->name ));
2924
2925 status = domain->backend->password_policy(domain, mem_ctx, policy);
2926
2927 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2928 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2929 if (!domain->internal && old_status) {
2930 set_domain_offline(domain);
2931 }
2932 if (cache->tdb &&
2933 !domain->internal &&
2934 !domain->online &&
2935 old_status) {
2936 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2937 if (centry) {
2938 goto do_fetch_cache;
2939 }
2940 }
2941 }
2942 /* and save it */
2943 refresh_sequence_number(domain, false);
2944 if (!NT_STATUS_IS_OK(status)) {
2945 return status;
2946 }
2947 wcache_save_password_policy(domain, status, policy);
2948
2949 return status;
2950 }
2951
2952
2953 /* Invalidate cached user and group lists coherently */
2954
2955 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2956 void *state)
2957 {
2958 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2959 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2960 tdb_delete(the_tdb, kbuf);
2961
2962 return 0;
2963 }
2964
2965 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2966
2967 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2968 struct netr_SamInfo3 *info3)
2969 {
2970 struct dom_sid sid;
2971 fstring key_str, sid_string;
2972 struct winbind_cache *cache;
2973
2974 /* dont clear cached U/SID and UG/SID entries when we want to logon
2975 * offline - gd */
2976
2977 if (lp_winbind_offline_logon()) {
2978 return;
2979 }
2980
2981 if (!domain)
2982 return;
2983
2984 cache = get_cache(domain);
2985
2986 if (!cache->tdb) {
2987 return;
2988 }
2989
2990 sid_compose(&sid, info3->base.domain_sid, info3->base.rid);
2991
2992 /* Clear U/SID cache entry */
2993 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2994 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2995 tdb_delete(cache->tdb, string_tdb_data(key_str));
2996
2997 /* Clear UG/SID cache entry */
2998 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2999 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3000 tdb_delete(cache->tdb, string_tdb_data(key_str));
3001
3002 /* Samba/winbindd never needs this. */
3003 netsamlogon_clear_cached_user(info3);
3004 }
3005
3006 bool wcache_invalidate_cache(void)
3007 {
3008 struct winbindd_domain *domain;
3009
3010 for (domain = domain_list(); domain; domain = domain->next) {
3011 struct winbind_cache *cache = get_cache(domain);
3012
3013 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3014 "entries for %s\n", domain->name));
3015 if (cache) {
3016 if (cache->tdb) {
3017 tdb_traverse(cache->tdb, traverse_fn, NULL);
3018 } else {
3019 return false;
3020 }
3021 }
3022 }
3023 return true;
3024 }
3025
3026 bool wcache_invalidate_cache_noinit(void)
3027 {
3028 struct winbindd_domain *domain;
3029
3030 for (domain = domain_list(); domain; domain = domain->next) {
3031 struct winbind_cache *cache;
3032
3033 /* Skip uninitialized domains. */
3034 if (!domain->initialized && !domain->internal) {
3035 continue;
3036 }
3037
3038 cache = get_cache(domain);
3039
3040 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3041 "entries for %s\n", domain->name));
3042 if (cache) {
3043 if (cache->tdb) {
3044 tdb_traverse(cache->tdb, traverse_fn, NULL);
3045 /*
3046 * Flushing cache has nothing to with domains.
3047 * return here if we successfully flushed once.
3048 * To avoid unnecessary traversing the cache.
3049 */
3050 return true;
3051 } else {
3052 return false;
3053 }
3054 }
3055 }
3056 return true;
3057 }
3058
3059 bool init_wcache(void)
3060 {
3061 if (wcache == NULL) {
3062 wcache = SMB_XMALLOC_P(struct winbind_cache);
3063 ZERO_STRUCTP(wcache);
3064 }
3065
3066 if (wcache->tdb != NULL)
3067 return true;
3068
3069 /* when working offline we must not clear the cache on restart */
3070 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3071 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3072 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3073 O_RDWR|O_CREAT, 0600);
3074
3075 if (wcache->tdb == NULL) {
3076 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3077 return false;
3078 }
3079
3080 return true;
3081 }
3082
3083 /************************************************************************
3084 This is called by the parent to initialize the cache file.
3085 We don't need sophisticated locking here as we know we're the
3086 only opener.
3087 ************************************************************************/
3088
3089 bool initialize_winbindd_cache(void)
3090 {
3091 bool cache_bad = true;
3092 uint32 vers;
3093
3094 if (!init_wcache()) {
3095 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3096 return false;
3097 }
3098
3099 /* Check version number. */
3100 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3101 vers == WINBINDD_CACHE_VERSION) {
3102 cache_bad = false;
3103 }
3104
3105 if (cache_bad) {
3106 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3107 "and re-creating with version number %d\n",
3108 WINBINDD_CACHE_VERSION ));
3109
3110 tdb_close(wcache->tdb);
3111 wcache->tdb = NULL;
3112
3113 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
3114 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3115 cache_path("winbindd_cache.tdb"),
3116 strerror(errno) ));
3117 return false;
3118 }
3119 if (!init_wcache()) {
3120 DEBUG(0,("initialize_winbindd_cache: re-initialization "
3121 "init_wcache failed.\n"));
3122 return false;
3123 }
3124
3125 /* Write the version. */
3126 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3127 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3128 tdb_errorstr(wcache->tdb) ));
3129 return false;
3130 }
3131 }
3132
3133 tdb_close(wcache->tdb);
3134 wcache->tdb = NULL;
3135 return true;
3136 }
3137
3138 void close_winbindd_cache(void)
3139 {
3140 if (!wcache) {
3141 return;
3142 }
3143 if (wcache->tdb) {
3144 tdb_close(wcache->tdb);
3145 wcache->tdb = NULL;
3146 }
3147 }
3148
3149 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
3150 char **domain_name, char **name,
3151 enum lsa_SidType *type)
3152 {
3153 struct winbindd_domain *domain;
3154 NTSTATUS status;
3155
3156 domain = find_lookup_domain_from_sid(sid);
3157 if (domain == NULL) {
3158 return false;
3159 }
3160 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3161 type);
3162 return NT_STATUS_IS_OK(status);
3163 }
3164
3165 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
3166 const char *domain_name,
3167 const char *name,
3168 struct dom_sid *sid,
3169 enum lsa_SidType *type)
3170 {
3171 struct winbindd_domain *domain;
3172 NTSTATUS status;
3173 bool original_online_state;
3174
3175 domain = find_lookup_domain_from_name(domain_name);
3176 if (domain == NULL) {
3177 return false;
3178 }
3179
3180 /* If we are doing a cached logon, temporarily set the domain
3181 offline so the cache won't expire the entry */
3182
3183 original_online_state = domain->online;
3184 domain->online = false;
3185 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3186 domain->online = original_online_state;
3187
3188 return NT_STATUS_IS_OK(status);
3189 }
3190
3191 void cache_name2sid(struct winbindd_domain *domain,
3192 const char *domain_name, const char *name,
3193 enum lsa_SidType type, const struct dom_sid *sid)
3194 {
3195 refresh_sequence_number(domain, false);
3196 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3197 sid, type);
3198 }
3199
3200 /*
3201 * The original idea that this cache only contains centries has
3202 * been blurred - now other stuff gets put in here. Ensure we
3203 * ignore these things on cleanup.
3204 */
3205
3206 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3207 TDB_DATA dbuf, void *state)
3208 {
3209 struct cache_entry *centry;
3210
3211 if (is_non_centry_key(kbuf)) {
3212 return 0;
3213 }
3214
3215 centry = wcache_fetch_raw((char *)kbuf.dptr);
3216 if (!centry) {
3217 return 0;
3218 }
3219
3220 if (!NT_STATUS_IS_OK(centry->status)) {
3221 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3222 tdb_delete(the_tdb, kbuf);
3223 }
3224
3225 centry_free(centry);
3226 return 0;
3227 }
3228
3229 /* flush the cache */
3230 void wcache_flush_cache(void)
3231 {
3232 if (!wcache)
3233 return;
3234 if (wcache->tdb) {
3235 tdb_close(wcache->tdb);
3236 wcache->tdb = NULL;
3237 }
3238 if (!winbindd_use_cache()) {
3239 return;
3240 }
3241
3242 /* when working offline we must not clear the cache on restart */
3243 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3244 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3245 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3246 O_RDWR|O_CREAT, 0600);
3247
3248 if (!wcache->tdb) {
3249 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3250 return;
3251 }
3252
3253 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3254
3255 DEBUG(10,("wcache_flush_cache success\n"));
3256 }
3257
3258 /* Count cached creds */
3259
3260 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3261 void *state)
3262 {
3263 int *cred_count = (int*)state;
3264
3265 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3266 (*cred_count)++;
3267 }
3268 return 0;
3269 }
3270
3271 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3272 {
3273 struct winbind_cache *cache = get_cache(domain);
3274
3275 *count = 0;
3276
3277 if (!cache->tdb) {
3278 return NT_STATUS_INTERNAL_DB_ERROR;
3279 }
3280
3281 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3282
3283 return NT_STATUS_OK;
3284 }
3285
3286 struct cred_list {
3287 struct cred_list *prev, *next;
3288 TDB_DATA key;
3289 fstring name;
3290 time_t created;
3291 };
3292 static struct cred_list *wcache_cred_list;
3293
3294 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3295 void *state)
3296 {
3297 struct cred_list *cred;
3298
3299 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3300
3301 cred = SMB_MALLOC_P(struct cred_list);
3302 if (cred == NULL) {
3303 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3304 return -1;
3305 }
3306
3307 ZERO_STRUCTP(cred);
3308
3309 /* save a copy of the key */
3310
3311 fstrcpy(cred->name, (const char *)kbuf.dptr);
3312 DLIST_ADD(wcache_cred_list, cred);
3313 }
3314
3315 return 0;
3316 }
3317
3318 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const struct dom_sid *sid)
3319 {
3320 struct winbind_cache *cache = get_cache(domain);
3321 NTSTATUS status;
3322 int ret;
3323 struct cred_list *cred, *oldest = NULL;
3324
3325 if (!cache->tdb) {
3326 return NT_STATUS_INTERNAL_DB_ERROR;
3327 }
3328
3329 /* we possibly already have an entry */
3330 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3331
3332 fstring key_str, tmp;
3333
3334 DEBUG(11,("we already have an entry, deleting that\n"));
3335
3336 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3337
3338 tdb_delete(cache->tdb, string_tdb_data(key_str));
3339
3340 return NT_STATUS_OK;
3341 }
3342
3343 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3344 if (ret == 0) {
3345 return NT_STATUS_OK;
3346 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3347 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3348 }
3349
3350 ZERO_STRUCTP(oldest);
3351
3352 for (cred = wcache_cred_list; cred; cred = cred->next) {
3353
3354 TDB_DATA data;
3355 time_t t;
3356
3357 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3358 if (!data.dptr) {
3359 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3360 cred->name));
3361 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3362 goto done;
3363 }
3364
3365 t = IVAL(data.dptr, 0);
3366 SAFE_FREE(data.dptr);
3367
3368 if (!oldest) {
3369 oldest = SMB_MALLOC_P(struct cred_list);
3370 if (oldest == NULL) {
3371 status = NT_STATUS_NO_MEMORY;
3372 goto done;
3373 }
3374
3375 fstrcpy(oldest->name, cred->name);
3376 oldest->created = t;
3377 continue;
3378 }
3379
3380 if (t < oldest->created) {
3381 fstrcpy(oldest->name, cred->name);
3382 oldest->created = t;
3383 }
3384 }
3385
3386 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3387 status = NT_STATUS_OK;
3388 } else {
3389 status = NT_STATUS_UNSUCCESSFUL;
3390 }
3391 done:
3392 SAFE_FREE(wcache_cred_list);
3393 SAFE_FREE(oldest);
3394
3395 return status;
3396 }
3397
3398 /* Change the global online/offline state. */
3399 bool set_global_winbindd_state_offline(void)
3400 {
3401 TDB_DATA data;
3402
3403 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3404
3405 /* Only go offline if someone has created
3406 the key "WINBINDD_OFFLINE" in the cache tdb. */
3407
3408 if (wcache == NULL || wcache->tdb == NULL) {
3409 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3410 return false;
3411 }
3412
3413 if (!lp_winbind_offline_logon()) {
3414 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3415 return false;
3416 }
3417
3418 if (global_winbindd_offline_state) {
3419 /* Already offline. */
3420 return true;
3421 }
3422
3423 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3424
3425 if (!data.dptr || data.dsize != 4) {
3426 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3427 SAFE_FREE(data.dptr);
3428 return false;
3429 } else {
3430 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3431 global_winbindd_offline_state = true;
3432 SAFE_FREE(data.dptr);
3433 return true;
3434 }
3435 }
3436
3437 void set_global_winbindd_state_online(void)
3438 {
3439 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3440
3441 if (!lp_winbind_offline_logon()) {
3442 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3443 return;
3444 }
3445
3446 if (!global_winbindd_offline_state) {
3447 /* Already online. */
3448 return;
3449 }
3450 global_winbindd_offline_state = false;
3451
3452 if (!wcache->tdb) {
3453 return;
3454 }
3455
3456 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3457 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3458 }
3459
3460 bool get_global_winbindd_state_offline(void)
3461 {
3462 return global_winbindd_offline_state;
3463 }
3464
3465 /***********************************************************************
3466 Validate functions for all possible cache tdb keys.
3467 ***********************************************************************/
3468
3469 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3470 struct tdb_validation_status *state)
3471 {
3472 struct cache_entry *centry;
3473
3474 centry = SMB_XMALLOC_P(struct cache_entry);
3475 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3476 if (!centry->data) {
3477 SAFE_FREE(centry);
3478 return NULL;
3479 }
3480 centry->len = data.dsize;
3481 centry->ofs = 0;
3482
3483 if (centry->len < 8) {
3484 /* huh? corrupt cache? */
3485 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3486 centry_free(centry);
3487 state->bad_entry = true;
3488 state->success = false;
3489 return NULL;
3490 }
3491
3492 centry->status = NT_STATUS(centry_uint32(centry));
3493 centry->sequence_number = centry_uint32(centry);
3494 return centry;
3495 }
3496
3497 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3498 struct tdb_validation_status *state)
3499 {
3500 if (dbuf.dsize != 8) {
3501 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3502 keystr, (unsigned int)dbuf.dsize ));
3503 state->bad_entry = true;
3504 return 1;
3505 }
3506 return 0;
3507 }
3508
3509 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3510 struct tdb_validation_status *state)
3511 {
3512 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3513 if (!centry) {
3514 return 1;
3515 }
3516
3517 (void)centry_uint32(centry);
3518 if (NT_STATUS_IS_OK(centry->status)) {
3519 struct dom_sid sid;
3520 (void)centry_sid(centry, &sid);
3521 }
3522
3523 centry_free(centry);
3524
3525 if (!(state->success)) {
3526 return 1;
3527 }
3528 DEBUG(10,("validate_ns: %s ok\n", keystr));
3529 return 0;
3530 }
3531
3532 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3533 struct tdb_validation_status *state)
3534 {
3535 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3536 if (!centry) {
3537 return 1;
3538 }
3539
3540 if (NT_STATUS_IS_OK(centry->status)) {
3541 (void)centry_uint32(centry);
3542 (void)centry_string(centry, mem_ctx);
3543 (void)centry_string(centry, mem_ctx);
3544 }
3545
3546 centry_free(centry);
3547
3548 if (!(state->success)) {
3549 return 1;
3550 }
3551 DEBUG(10,("validate_sn: %s ok\n", keystr));
3552 return 0;
3553 }
3554
3555 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3556 struct tdb_validation_status *state)
3557 {
3558 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3559 struct dom_sid sid;
3560
3561 if (!centry) {
3562 return 1;
3563 }
3564
3565 (void)centry_string(centry, mem_ctx);
3566 (void)centry_string(centry, mem_ctx);
3567 (void)centry_string(centry, mem_ctx);
3568 (void)centry_string(centry, mem_ctx);
3569 (void)centry_uint32(centry);
3570 (void)centry_sid(centry, &sid);
3571 (void)centry_sid(centry, &sid);
3572
3573 centry_free(centry);
3574
3575 if (!(state->success)) {
3576 return 1;
3577 }
3578 DEBUG(10,("validate_u: %s ok\n", keystr));
3579 return 0;
3580 }
3581
3582 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3583 struct tdb_validation_status *state)
3584 {
3585 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3586
3587 if (!centry) {
3588 return 1;
3589 }
3590
3591 (void)centry_nttime(centry);
3592 (void)centry_nttime(centry);
3593 (void)centry_uint16(centry);
3594
3595 centry_free(centry);
3596
3597 if (!(state->success)) {
3598 return 1;
3599 }
3600 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3601 return 0;
3602 }
3603
3604 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3605 struct tdb_validation_status *state)
3606 {
3607 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3608
3609 if (!centry) {
3610 return 1;
3611 }
3612
3613 (void)centry_uint16(centry);
3614 (void)centry_uint16(centry);
3615 (void)centry_uint32(centry);
3616 (void)centry_nttime(centry);
3617 (void)centry_nttime(centry);
3618
3619 centry_free(centry);
3620
3621 if (!(state->success)) {
3622 return 1;
3623 }
3624 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3625 return 0;
3626 }
3627
3628 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3629 struct tdb_validation_status *state)
3630 {
3631 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3632
3633 if (!centry) {
3634 return 1;
3635 }
3636
3637 (void)centry_time(centry);
3638 (void)centry_hash16(centry, mem_ctx);
3639
3640 /* We only have 17 bytes more data in the salted cred case. */
3641 if (centry->len - centry->ofs == 17) {
3642 (void)centry_hash16(centry, mem_ctx);
3643 }
3644
3645 centry_free(centry);
3646
3647 if (!(state->success)) {
3648 return 1;
3649 }
3650 DEBUG(10,("validate_cred: %s ok\n", keystr));
3651 return 0;
3652 }
3653
3654 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3655 struct tdb_validation_status *state)
3656 {
3657 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3658 int32 num_entries, i;
3659
3660 if (!centry) {
3661 return 1;
3662 }
3663
3664 num_entries = (int32)centry_uint32(centry);
3665
3666 for (i=0; i< num_entries; i++) {
3667 struct dom_sid sid;
3668 (void)centry_string(centry, mem_ctx);
3669 (void)centry_string(centry, mem_ctx);
3670 (void)centry_string(centry, mem_ctx);
3671 (void)centry_string(centry, mem_ctx);
3672 (void)centry_sid(centry, &sid);
3673 (void)centry_sid(centry, &sid);
3674 }
3675
3676 centry_free(centry);
3677
3678 if (!(state->success)) {
3679 return 1;
3680 }
3681 DEBUG(10,("validate_ul: %s ok\n", keystr));
3682 return 0;
3683 }
3684
3685 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3686 struct tdb_validation_status *state)
3687 {
3688 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3689 int32 num_entries, i;
3690
3691 if (!centry) {
3692 return 1;
3693 }
3694
3695 num_entries = centry_uint32(centry);
3696
3697 for (i=0; i< num_entries; i++) {
3698 (void)centry_string(centry, mem_ctx);
3699 (void)centry_string(centry, mem_ctx);
3700 (void)centry_uint32(centry);
3701 }
3702
3703 centry_free(centry);
3704
3705 if (!(state->success)) {
3706 return 1;
3707 }
3708 DEBUG(10,("validate_gl: %s ok\n", keystr));
3709 return 0;
3710 }
3711
3712 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3713 struct tdb_validation_status *state)
3714 {
3715 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3716 int32 num_groups, i;
3717
3718 if (!centry) {
3719 return 1;
3720 }
3721
3722 num_groups = centry_uint32(centry);
3723
3724 for (i=0; i< num_groups; i++) {
3725 struct dom_sid sid;
3726 centry_sid(centry, &sid);
3727 }
3728
3729 centry_free(centry);
3730
3731 if (!(state->success)) {
3732 return 1;
3733 }
3734 DEBUG(10,("validate_ug: %s ok\n", keystr));
3735 return 0;
3736 }
3737
3738 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3739 struct tdb_validation_status *state)
3740 {
3741 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3742 int32 num_aliases, i;
3743
3744 if (!centry) {
3745 return 1;
3746 }
3747
3748 num_aliases = centry_uint32(centry);
3749
3750 for (i=0; i < num_aliases; i++) {
3751 (void)centry_uint32(centry);
3752 }
3753
3754 centry_free(centry);
3755
3756 if (!(state->success)) {
3757 return 1;
3758 }
3759 DEBUG(10,("validate_ua: %s ok\n", keystr));
3760 return 0;
3761 }
3762
3763 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3764 struct tdb_validation_status *state)
3765 {
3766 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3767 int32 num_names, i;
3768
3769 if (!centry) {
3770 return 1;
3771 }
3772
3773 num_names = centry_uint32(centry);
3774
3775 for (i=0; i< num_names; i++) {
3776 struct dom_sid sid;
3777 centry_sid(centry, &sid);
3778 (void)centry_string(centry, mem_ctx);
3779 (void)centry_uint32(centry);
3780 }
3781
3782 centry_free(centry);
3783
3784 if (!(state->success)) {
3785 return 1;
3786 }
3787 DEBUG(10,("validate_gm: %s ok\n", keystr));
3788 return 0;
3789 }
3790
3791 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3792 struct tdb_validation_status *state)
3793 {
3794 /* Can't say anything about this other than must be nonzero. */
3795 if (dbuf.dsize == 0) {
3796 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3797 keystr));
3798 state->bad_entry = true;
3799 state->success = false;
3800 return 1;
3801 }
3802
3803 DEBUG(10,("validate_dr: %s ok\n", keystr));
3804 return 0;
3805 }
3806
3807 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3808 struct tdb_validation_status *state)
3809 {
3810 /* Can't say anything about this other than must be nonzero. */
3811 if (dbuf.dsize == 0) {
3812 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3813 keystr));
3814 state->bad_entry = true;
3815 state->success = false;
3816 return 1;
3817 }
3818
3819 DEBUG(10,("validate_de: %s ok\n", keystr));
3820 return 0;
3821 }
3822
3823 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3824 TDB_DATA dbuf, struct tdb_validation_status *state)
3825 {
3826 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3827
3828 if (!centry) {
3829 return 1;
3830 }
3831
3832 (void)centry_string(centry, mem_ctx);
3833 (void)centry_string(centry, mem_ctx);
3834 (void)centry_string(centry, mem_ctx);
3835 (void)centry_uint32(centry);
3836
3837 centry_free(centry);
3838
3839 if (!(state->success)) {
3840 return 1;
3841 }
3842 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3843 return 0;
3844 }
3845
3846 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3847 TDB_DATA dbuf,
3848 struct tdb_validation_status *state)
3849 {
3850 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3851
3852 if (!centry) {
3853 return 1;
3854 }
3855
3856 (void)centry_string( centry, mem_ctx );
3857
3858 centry_free(centry);
3859
3860 if (!(state->success)) {
3861 return 1;
3862 }
3863 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3864 return 0;
3865 }
3866
3867 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3868 TDB_DATA dbuf,
3869 struct tdb_validation_status *state)
3870 {
3871 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3872
3873 if (!centry) {
3874 return 1;
3875 }
3876
3877 (void)centry_string( centry, mem_ctx );
3878
3879 centry_free(centry);
3880
3881 if (!(state->success)) {
3882 return 1;
3883 }
3884 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3885 return 0;
3886 }
3887
3888 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3889 TDB_DATA dbuf,
3890 struct tdb_validation_status *state)
3891 {
3892 if (dbuf.dsize == 0) {
3893 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3894 "key %s (len ==0) ?\n", keystr));
3895 state->bad_entry = true;
3896 state->success = false;
3897 return 1;
3898 }
3899
3900 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3901 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3902 return 0;
3903 }
3904
3905 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3906 struct tdb_validation_status *state)
3907 {
3908 if (dbuf.dsize != 4) {
3909 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3910 keystr, (unsigned int)dbuf.dsize ));
3911 state->bad_entry = true;
3912 state->success = false;
3913 return 1;
3914 }
3915 DEBUG(10,("validate_offline: %s ok\n", keystr));
3916 return 0;
3917 }
3918
3919 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3920 struct tdb_validation_status *state)
3921 {
3922 /*
3923 * Ignore validation for now. The proper way to do this is with a
3924 * checksum. Just pure parsing does not really catch much.
3925 */
3926 return 0;
3927 }
3928
3929 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3930 struct tdb_validation_status *state)
3931 {
3932 if (dbuf.dsize != 4) {
3933 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3934 "key %s (len %u != 4) ?\n",
3935 keystr, (unsigned int)dbuf.dsize));
3936 state->bad_entry = true;
3937 state->success = false;
3938 return 1;
3939 }
3940
3941 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3942 return 0;
3943 }
3944
3945 /***********************************************************************
3946 A list of all possible cache tdb keys with associated validation
3947 functions.
3948 ***********************************************************************/
3949
3950 struct key_val_struct {
3951 const char *keyname;
3952 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3953 } key_val[] = {
3954 {"SEQNUM/", validate_seqnum},
3955 {"NS/", validate_ns},
3956 {"SN/", validate_sn},
3957 {"U/", validate_u},
3958 {"LOC_POL/", validate_loc_pol},
3959 {"PWD_POL/", validate_pwd_pol},
3960 {"CRED/", validate_cred},
3961 {"UL/", validate_ul},
3962 {"GL/", validate_gl},
3963 {"UG/", validate_ug},
3964 {"UA", validate_ua},
3965 {"GM/", validate_gm},
3966 {"DR/", validate_dr},
3967 {"DE/", validate_de},
3968 {"NSS/PWINFO/", validate_pwinfo},
3969 {"TRUSTDOMCACHE/", validate_trustdomcache},
3970 {"NSS/NA/", validate_nss_na},
3971 {"NSS/AN/", validate_nss_an},
3972 {"WINBINDD_OFFLINE", validate_offline},
3973 {"NDR/", validate_ndr},
3974 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3975 {NULL, NULL}
3976 };
3977
3978 /***********************************************************************
3979 Function to look at every entry in the tdb and validate it as far as
3980 possible.
3981 ***********************************************************************/
3982
3983 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3984 {
3985 int i;
3986 unsigned int max_key_len = 1024;
3987 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3988
3989 /* Paranoia check. */
3990 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3991 max_key_len = 1024 * 1024;
3992 }
3993 if (kbuf.dsize > max_key_len) {
3994 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3995 "(%u) > (%u)\n\n",
3996 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3997 return 1;
3998 }
3999
4000 for (i = 0; key_val[i].keyname; i++) {
4001 size_t namelen = strlen(key_val[i].keyname);
4002 if (kbuf.dsize >= namelen && (
4003 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
4004 TALLOC_CTX *mem_ctx;
4005 char *keystr;
4006 int ret;
4007
4008 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
4009 if (!keystr) {
4010 return 1;
4011 }
4012 memcpy(keystr, kbuf.dptr, kbuf.dsize);
4013 keystr[kbuf.dsize] = '\0';
4014
4015 mem_ctx = talloc_init("validate_ctx");
4016 if (!mem_ctx) {
4017 SAFE_FREE(keystr);
4018 return 1;
4019 }
4020
4021 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
4022 v_state);
4023
4024 SAFE_FREE(keystr);
4025 talloc_destroy(mem_ctx);
4026 return ret;
4027 }
4028 }
4029
4030 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
4031 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
4032 DEBUG(0,("data :\n"));
4033 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4034 v_state->unknown_key = true;
4035 v_state->success = false;
4036 return 1; /* terminate. */
4037 }
4038
4039 static void validate_panic(const char *const why)
4040 {
4041 DEBUG(0,("validating cache: would panic %s\n", why ));
4042 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4043 exit(47);
4044 }
4045
4046 /***********************************************************************
4047 Try and validate every entry in the winbindd cache. If we fail here,
4048 delete the cache tdb and return non-zero.
4049 ***********************************************************************/
4050
4051 int winbindd_validate_cache(void)
4052 {
4053 int ret = -1;
4054 const char *tdb_path = cache_path("winbindd_cache.tdb");
4055 TDB_CONTEXT *tdb = NULL;
4056
4057 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4058 smb_panic_fn = validate_panic;
4059
4060
4061 tdb = tdb_open_log(tdb_path,
4062 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4063 ( lp_winbind_offline_logon()
4064 ? TDB_DEFAULT
4065 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4066 O_RDWR|O_CREAT,
4067 0600);
4068 if (!tdb) {
4069 DEBUG(0, ("winbindd_validate_cache: "
4070 "error opening/initializing tdb\n"));
4071 goto done;
4072 }
4073 tdb_close(tdb);
4074
4075 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4076
4077 if (ret != 0) {
4078 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4079 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4080 unlink(tdb_path);
4081 }
4082
4083 done:
4084 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4085 smb_panic_fn = smb_panic;
4086 return ret;
4087 }
4088
4089 /***********************************************************************
4090 Try and validate every entry in the winbindd cache.
4091 ***********************************************************************/
4092
4093 int winbindd_validate_cache_nobackup(void)
4094 {
4095 int ret = -1;
4096 const char *tdb_path = cache_path("winbindd_cache.tdb");
4097
4098 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4099 smb_panic_fn = validate_panic;
4100
4101
4102 if (wcache == NULL || wcache->tdb == NULL) {
4103 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4104 } else {
4105 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4106 }
4107
4108 if (ret != 0) {
4109 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4110 "successful.\n"));
4111 }
4112
4113 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4114 "function\n"));
4115 smb_panic_fn = smb_panic;
4116 return ret;
4117 }
4118
4119 bool winbindd_cache_validate_and_initialize(void)
4120 {
4121 close_winbindd_cache();
4122
4123 if (lp_winbind_offline_logon()) {
4124 if (winbindd_validate_cache() < 0) {
4125 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4126 "could be restored.\n"));
4127 }
4128 }
4129
4130 return initialize_winbindd_cache();
4131 }
4132
4133 /*********************************************************************
4134 ********************************************************************/
4135
4136 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4137 struct winbindd_tdc_domain **domains,
4138 size_t *num_domains )
4139 {
4140 struct winbindd_tdc_domain *list = NULL;
4141 size_t idx;
4142 int i;
4143 bool set_only = false;
4144
4145 /* don't allow duplicates */
4146
4147 idx = *num_domains;
4148 list = *domains;
4149
4150 for ( i=0; i< (*num_domains); i++ ) {
4151 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4152 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4153 new_dom->name));
4154 idx = i;
4155 set_only = true;
4156
4157 break;
4158 }
4159 }
4160
4161 if ( !set_only ) {
4162 if ( !*domains ) {
4163 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
4164 idx = 0;
4165 } else {
4166 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
4167 struct winbindd_tdc_domain,
4168 (*num_domains)+1);
4169 idx = *num_domains;
4170 }
4171
4172 ZERO_STRUCT( list[idx] );
4173 }
4174
4175 if ( !list )
4176 return false;
4177
4178 list[idx].domain_name = talloc_strdup( list, new_dom->name );
4179 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4180
4181 if ( !is_null_sid( &new_dom->sid ) ) {
4182 sid_copy( &list[idx].sid, &new_dom->sid );
4183 } else {
4184 sid_copy(&list[idx].sid, &global_sid_NULL);
4185 }
4186
4187 if ( new_dom->domain_flags != 0x0 )
4188 list[idx].trust_flags = new_dom->domain_flags;
4189
4190 if ( new_dom->domain_type != 0x0 )
4191 list[idx].trust_type = new_dom->domain_type;
4192
4193 if ( new_dom->domain_trust_attribs != 0x0 )
4194 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4195
4196 if ( !set_only ) {
4197 *domains = list;
4198 *num_domains = idx + 1;
4199 }
4200
4201 return true;
4202 }
4203
4204 /*********************************************************************
4205 ********************************************************************/
4206
4207 static TDB_DATA make_tdc_key( const char *domain_name )
4208 {
4209 char *keystr = NULL;
4210 TDB_DATA key = { NULL, 0 };
4211
4212 if ( !domain_name ) {
4213 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4214 return key;
4215 }
4216
4217 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4218 return key;
4219 }
4220 key = string_term_tdb_data(keystr);
4221
4222 return key;
4223 }
4224
4225 /*********************************************************************
4226 ********************************************************************/
4227
4228 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4229 size_t num_domains,
4230 unsigned char **buf )
4231 {
4232 unsigned char *buffer = NULL;
4233 int len = 0;
4234 int buflen = 0;
4235 int i = 0;
4236
4237 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4238 (int)num_domains));
4239
4240 buflen = 0;
4241
4242 again:
4243 len = 0;
4244
4245 /* Store the number of array items first */
4246 len += tdb_pack( buffer+len, buflen-len, "d",
4247 num_domains );
4248
4249 /* now pack each domain trust record */
4250 for ( i=0; i<num_domains; i++ ) {
4251
4252 fstring tmp;
4253
4254 if ( buflen > 0 ) {
4255 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4256 domains[i].domain_name,
4257 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4258 }
4259
4260 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4261 domains[i].domain_name,
4262 domains[i].dns_name,
4263 sid_to_fstring(tmp, &domains[i].sid),
4264 domains[i].trust_flags,
4265 domains[i].trust_attribs,
4266 domains[i].trust_type );
4267 }
4268
4269 if ( buflen < len ) {
4270 SAFE_FREE(buffer);
4271 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4272 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4273 buflen = -1;
4274 goto done;
4275 }
4276 buflen = len;
4277 goto again;
4278 }
4279
4280 *buf = buffer;
4281
4282 done:
4283 return buflen;
4284 }
4285
4286 /*********************************************************************
4287 ********************************************************************/
4288
4289 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4290 struct winbindd_tdc_domain **domains )
4291 {
4292 fstring domain_name, dns_name, sid_string;
4293 uint32 type, attribs, flags;
4294 int num_domains;
4295 int len = 0;
4296 int i;
4297 struct winbindd_tdc_domain *list = NULL;
4298
4299 /* get the number of domains */
4300 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4301 if ( len == -1 ) {
4302 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4303 return 0;
4304 }
4305
4306 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4307 if ( !list ) {
4308 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4309 return 0;
4310 }
4311
4312 for ( i=0; i<num_domains; i++ ) {
4313 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4314 domain_name,
4315 dns_name,
4316 sid_string,
4317 &flags,
4318 &attribs,
4319 &type );
4320
4321 if ( len == -1 ) {
4322 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4323 TALLOC_FREE( list );
4324 return 0;
4325 }
4326
4327 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4328 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4329 domain_name, dns_name, sid_string,
4330 flags, attribs, type));
4331
4332 list[i].domain_name = talloc_strdup( list, domain_name );
4333 list[i].dns_name = talloc_strdup( list, dns_name );
4334 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4335 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4336 domain_name));
4337 }
4338 list[i].trust_flags = flags;
4339 list[i].trust_attribs = attribs;
4340 list[i].trust_type = type;
4341 }
4342
4343 *domains = list;
4344
4345 return num_domains;
4346 }
4347
4348 /*********************************************************************
4349 ********************************************************************/
4350
4351 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4352 {
4353 TDB_DATA key = make_tdc_key( lp_workgroup() );
4354 TDB_DATA data = { NULL, 0 };
4355 int ret;
4356
4357 if ( !key.dptr )
4358 return false;
4359
4360 /* See if we were asked to delete the cache entry */
4361
4362 if ( !domains ) {
4363 ret = tdb_delete( wcache->tdb, key );
4364 goto done;
4365 }
4366
4367 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4368
4369 if ( !data.dptr ) {
4370 ret = -1;
4371 goto done;
4372 }
4373
4374 ret = tdb_store( wcache->tdb, key, data, 0 );
4375
4376 done:
4377 SAFE_FREE( data.dptr );
4378 SAFE_FREE( key.dptr );
4379
4380 return ( ret != -1 );
4381 }
4382
4383 /*********************************************************************
4384 ********************************************************************/
4385
4386 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4387 {
4388 TDB_DATA key = make_tdc_key( lp_workgroup() );
4389 TDB_DATA data = { NULL, 0 };
4390
4391 *domains = NULL;
4392 *num_domains = 0;
4393
4394 if ( !key.dptr )
4395 return false;
4396
4397 data = tdb_fetch( wcache->tdb, key );
4398
4399 SAFE_FREE( key.dptr );
4400
4401 if ( !data.dptr )
4402 return false;
4403
4404 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4405
4406 SAFE_FREE( data.dptr );
4407
4408 if ( !*domains )
4409 return false;
4410
4411 return true;
4412 }
4413
4414 /*********************************************************************
4415 ********************************************************************/
4416
4417 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4418 {
4419 struct winbindd_tdc_domain *dom_list = NULL;
4420 size_t num_domains = 0;
4421 bool ret = false;
4422
4423 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4424 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4425 domain->name, domain->alt_name,
4426 sid_string_dbg(&domain->sid),
4427 domain->domain_flags,
4428 domain->domain_trust_attribs,
4429 domain->domain_type));
4430
4431 if ( !init_wcache() ) {
4432 return false;
4433 }
4434
4435 /* fetch the list */
4436
4437 wcache_tdc_fetch_list( &dom_list, &num_domains );
4438
4439 /* add the new domain */
4440
4441 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4442 goto done;
4443 }
4444
4445 /* pack the domain */
4446
4447 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4448 goto done;
4449 }
4450
4451 /* Success */
4452
4453 ret = true;
4454 done:
4455 TALLOC_FREE( dom_list );
4456
4457 return ret;
4458 }
4459
4460 /*********************************************************************
4461 ********************************************************************/
4462
4463 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4464 {
4465 struct winbindd_tdc_domain *dom_list = NULL;
4466 size_t num_domains = 0;
4467 int i;
4468 struct winbindd_tdc_domain *d = NULL;
4469
4470 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4471
4472 if ( !init_wcache() ) {
4473 return false;
4474 }
4475
4476 /* fetch the list */
4477
4478 wcache_tdc_fetch_list( &dom_list, &num_domains );
4479
4480 for ( i=0; i<num_domains; i++ ) {
4481 if ( strequal(name, dom_list[i].domain_name) ||
4482 strequal(name, dom_list[i].dns_name) )
4483 {
4484 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4485 name));
4486
4487 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4488 if ( !d )
4489 break;
4490
4491 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4492 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4493 sid_copy( &d->sid, &dom_list[i].sid );
4494 d->trust_flags = dom_list[i].trust_flags;
4495 d->trust_type = dom_list[i].trust_type;
4496 d->trust_attribs = dom_list[i].trust_attribs;
4497
4498 break;
4499 }
4500 }
4501
4502 TALLOC_FREE( dom_list );
4503
4504 return d;
4505 }
4506
4507
4508 /*********************************************************************
4509 ********************************************************************/
4510
4511 void wcache_tdc_clear( void )
4512 {
4513 if ( !init_wcache() )
4514 return;
4515
4516 wcache_tdc_store_list( NULL, 0 );
4517
4518 return;
4519 }
4520
4521
4522 /*********************************************************************
4523 ********************************************************************/
4524
4525 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4526 NTSTATUS status,
4527 const struct dom_sid *user_sid,
4528 const char *homedir,
4529 const char *shell,
4530 const char *gecos,
4531 uint32 gid)
4532 {
4533 struct cache_entry *centry;
4534 fstring tmp;
4535
4536 if ( (centry = centry_start(domain, status)) == NULL )
4537 return;
4538
4539 centry_put_string( centry, homedir );
4540 centry_put_string( centry, shell );
4541 centry_put_string( centry, gecos );
4542 centry_put_uint32( centry, gid );
4543
4544 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4545
4546 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4547
4548 centry_free(centry);
4549 }
4550
4551 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4552 const struct dom_sid *user_sid,
4553 TALLOC_CTX *ctx,
4554 ADS_STRUCT *ads, LDAPMessage *msg,
4555 const char **homedir, const char **shell,
4556 const char **gecos, gid_t *p_gid)
4557 {
4558 struct winbind_cache *cache = get_cache(domain);
4559 struct cache_entry *centry = NULL;
4560 NTSTATUS nt_status;
4561 fstring tmp;
4562
4563 if (!cache->tdb)
4564 goto do_query;
4565
4566 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4567 sid_to_fstring(tmp, user_sid));
4568
4569 if (!centry)
4570 goto do_query;
4571
4572 *homedir = centry_string( centry, ctx );
4573 *shell = centry_string( centry, ctx );
4574 *gecos = centry_string( centry, ctx );
4575 *p_gid = centry_uint32( centry );
4576
4577 centry_free(centry);
4578
4579 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4580 sid_string_dbg(user_sid)));
4581
4582 return NT_STATUS_OK;
4583
4584 do_query:
4585
4586 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4587 homedir, shell, gecos, p_gid );
4588
4589 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4590
4591 if ( NT_STATUS_IS_OK(nt_status) ) {
4592 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4593 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4594 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4595 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4596
4597 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4598 *homedir, *shell, *gecos, *p_gid );
4599 }
4600
4601 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4602 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4603 domain->name ));
4604 set_domain_offline( domain );
4605 }
4606
4607 return nt_status;
4608 }
4609
4610
4611 /* the cache backend methods are exposed via this structure */
4612 struct winbindd_methods cache_methods = {
4613 true,
4614 query_user_list,
4615 enum_dom_groups,
4616 enum_local_groups,
4617 name_to_sid,
4618 sid_to_name,
4619 rids_to_names,
4620 query_user,
4621 lookup_usergroups,
4622 lookup_useraliases,
4623 lookup_groupmem,
4624 sequence_number,
4625 lockout_policy,
4626 password_policy,
4627 trusted_domains
4628 };
4629
4630 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4631 uint32_t opnum, const DATA_BLOB *req,
4632 TDB_DATA *pkey)
4633 {
4634 char *key;
4635 size_t keylen;
4636
4637 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4638 if (key == NULL) {
4639 return false;
4640 }
4641 keylen = talloc_get_size(key) - 1;
4642
4643 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4644 if (key == NULL) {
4645 return false;
4646 }
4647 memcpy(key + keylen, req->data, req->length);
4648
4649 pkey->dptr = (uint8_t *)key;
4650 pkey->dsize = talloc_get_size(key);
4651 return true;
4652 }
4653
4654 static bool wcache_opnum_cacheable(uint32_t opnum)
4655 {
4656 switch (opnum) {
4657 case NDR_WBINT_PING:
4658 case NDR_WBINT_QUERYSEQUENCENUMBER:
4659 case NDR_WBINT_ALLOCATEUID:
4660 case NDR_WBINT_ALLOCATEGID:
4661 case NDR_WBINT_CHECKMACHINEACCOUNT:
4662 case NDR_WBINT_CHANGEMACHINEACCOUNT:
4663 case NDR_WBINT_PINGDC:
4664 return false;
4665 }
4666 return true;
4667 }
4668
4669 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4670 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4671 {
4672 TDB_DATA key, data;
4673 bool ret = false;
4674
4675 if (!wcache_opnum_cacheable(opnum)) {
4676 return false;
4677 }
4678
4679 if (wcache->tdb == NULL) {
4680 return false;
4681 }
4682
4683 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4684 return false;
4685 }
4686 data = tdb_fetch(wcache->tdb, key);
4687 TALLOC_FREE(key.dptr);
4688
4689 if (data.dptr == NULL) {
4690 return false;
4691 }
4692 if (data.dsize < 4) {
4693 goto fail;
4694 }
4695
4696 if (!is_domain_offline(domain)) {
4697 uint32_t entry_seqnum, dom_seqnum, last_check;
4698
4699 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4700 &last_check)) {
4701 goto fail;
4702 }
4703 entry_seqnum = IVAL(data.dptr, 0);
4704 if (entry_seqnum != dom_seqnum) {
4705 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4706 (int)entry_seqnum));
4707 goto fail;
4708 }
4709 }
4710
4711 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4712 data.dsize - 4);
4713 if (resp->data == NULL) {
4714 DEBUG(10, ("talloc failed\n"));
4715 goto fail;
4716 }
4717 resp->length = data.dsize - 4;
4718
4719 ret = true;
4720 fail:
4721 SAFE_FREE(data.dptr);
4722 return ret;
4723 }
4724
4725 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4726 const DATA_BLOB *req, const DATA_BLOB *resp)
4727 {
4728 TDB_DATA key, data;
4729 uint32_t dom_seqnum, last_check;
4730
4731 if (!wcache_opnum_cacheable(opnum)) {
4732 return;
4733 }
4734
4735 if (wcache->tdb == NULL) {
4736 return;
4737 }
4738
4739 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4740 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4741 domain->name));
4742 return;
4743 }
4744
4745 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4746 return;
4747 }
4748
4749 data.dsize = resp->length + 4;
4750 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4751 if (data.dptr == NULL) {
4752 goto done;
4753 }
4754
4755 SIVAL(data.dptr, 0, dom_seqnum);
4756 memcpy(data.dptr+4, resp->data, resp->length);
4757
4758 tdb_store(wcache->tdb, key, data, 0);
4759
4760 done:
4761 TALLOC_FREE(key.dptr);
4762 return;
4763 }
Samba GIT mirror