?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Make winbindd_reinit_after_fork return NTSTATUS
[Samba.git] / source3 / winbindd / winbindd_cache.c
blob68a86257da2b8f199d4416af2af0bb631048bb5e
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "system/filesys.h"
28 #include "winbindd.h"
29 #include "tdb_validate.h"
30 #include "../libcli/auth/libcli_auth.h"
31 #include "../librpc/gen_ndr/ndr_wbint.h"
32 #include "ads.h"
33 #include "nss_info.h"
34 #include "../libcli/security/security.h"
35 #include "passdb/machine_sid.h"
36
37 #undef DBGC_CLASS
38 #define DBGC_CLASS DBGC_WINBIND
39
40 #define WINBINDD_CACHE_VERSION 2
41 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
42
43 extern struct winbindd_methods reconnect_methods;
44 #ifdef HAVE_ADS
45 extern struct winbindd_methods ads_methods;
46 #endif
47 extern struct winbindd_methods builtin_passdb_methods;
48 extern struct winbindd_methods sam_passdb_methods;
49
50 /*
51 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
52 * Here are the list of entry types that are *not* stored
53 * as form struct cache_entry in the cache.
54 */
55
56 static const char *non_centry_keys[] = {
57 "SEQNUM/",
58 "DR/",
59 "DE/",
60 "WINBINDD_OFFLINE",
61 WINBINDD_CACHE_VERSION_KEYSTR,
62 NULL
63 };
64
65 /************************************************************************
66 Is this key a non-centry type ?
67 ************************************************************************/
68
69 static bool is_non_centry_key(TDB_DATA kbuf)
70 {
71 int i;
72
73 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
74 return false;
75 }
76 for (i = 0; non_centry_keys[i] != NULL; i++) {
77 size_t namelen = strlen(non_centry_keys[i]);
78 if (kbuf.dsize < namelen) {
79 continue;
80 }
81 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
82 return true;
83 }
84 }
85 return false;
86 }
87
88 /* Global online/offline state - False when online. winbindd starts up online
89 and sets this to true if the first query fails and there's an entry in
90 the cache tdb telling us to stay offline. */
91
92 static bool global_winbindd_offline_state;
93
94 struct winbind_cache {
95 TDB_CONTEXT *tdb;
96 };
97
98 struct cache_entry {
99 NTSTATUS status;
100 uint32 sequence_number;
101 uint64_t timeout;
102 uint8 *data;
103 uint32 len, ofs;
104 };
105
106 void (*smb_panic_fn)(const char *const why) = smb_panic;
107
108 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
109
110 static struct winbind_cache *wcache;
111
112 /* get the winbind_cache structure */
113 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
114 {
115 struct winbind_cache *ret = wcache;
116
117 /* We have to know what type of domain we are dealing with first. */
118
119 if (domain->internal) {
120 domain->backend = &builtin_passdb_methods;
121 domain->initialized = True;
122 }
123
124 if (strequal(domain->name, get_global_sam_name()) &&
125 sid_check_is_domain(&domain->sid)) {
126 domain->backend = &sam_passdb_methods;
127 domain->initialized = True;
128 }
129
130 if ( !domain->initialized ) {
131 init_dc_connection( domain );
132 }
133
134 /*
135 OK. listen up becasue I'm only going to say this once.
136 We have the following scenarios to consider
137 (a) trusted AD domains on a Samba DC,
138 (b) trusted AD domains and we are joined to a non-kerberos domain
139 (c) trusted AD domains and we are joined to a kerberos (AD) domain
140
141 For (a) we can always contact the trusted domain using krb5
142 since we have the domain trust account password
143
144 For (b) we can only use RPC since we have no way of
145 getting a krb5 ticket in our own domain
146
147 For (c) we can always use krb5 since we have a kerberos trust
148
149 --jerry
150 */
151
152 if (!domain->backend) {
153 #ifdef HAVE_ADS
154 struct winbindd_domain *our_domain = domain;
155
156 /* find our domain first so we can figure out if we
157 are joined to a kerberized domain */
158
159 if ( !domain->primary )
160 our_domain = find_our_domain();
161
162 if ((our_domain->active_directory || IS_DC)
163 && domain->active_directory
164 && !lp_winbind_rpc_only()) {
165 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
166 domain->backend = &ads_methods;
167 } else {
168 #endif /* HAVE_ADS */
169 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
170 domain->backend = &reconnect_methods;
171 #ifdef HAVE_ADS
172 }
173 #endif /* HAVE_ADS */
174 }
175
176 if (ret)
177 return ret;
178
179 ret = SMB_XMALLOC_P(struct winbind_cache);
180 ZERO_STRUCTP(ret);
181
182 wcache = ret;
183 wcache_flush_cache();
184
185 return ret;
186 }
187
188 /*
189 free a centry structure
190 */
191 static void centry_free(struct cache_entry *centry)
192 {
193 if (!centry)
194 return;
195 SAFE_FREE(centry->data);
196 free(centry);
197 }
198
199 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
200 {
201 if (centry->len - centry->ofs < nbytes) {
202 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
203 (unsigned int)nbytes,
204 centry->len - centry->ofs));
205 return false;
206 }
207 return true;
208 }
209
210 /*
211 pull a uint64_t from a cache entry
212 */
213 static uint64_t centry_uint64_t(struct cache_entry *centry)
214 {
215 uint64_t ret;
216
217 if (!centry_check_bytes(centry, 8)) {
218 smb_panic_fn("centry_uint64_t");
219 }
220 ret = BVAL(centry->data, centry->ofs);
221 centry->ofs += 8;
222 return ret;
223 }
224
225 /*
226 pull a uint32 from a cache entry
227 */
228 static uint32 centry_uint32(struct cache_entry *centry)
229 {
230 uint32 ret;
231
232 if (!centry_check_bytes(centry, 4)) {
233 smb_panic_fn("centry_uint32");
234 }
235 ret = IVAL(centry->data, centry->ofs);
236 centry->ofs += 4;
237 return ret;
238 }
239
240 /*
241 pull a uint16 from a cache entry
242 */
243 static uint16 centry_uint16(struct cache_entry *centry)
244 {
245 uint16 ret;
246 if (!centry_check_bytes(centry, 2)) {
247 smb_panic_fn("centry_uint16");
248 }
249 ret = SVAL(centry->data, centry->ofs);
250 centry->ofs += 2;
251 return ret;
252 }
253
254 /*
255 pull a uint8 from a cache entry
256 */
257 static uint8 centry_uint8(struct cache_entry *centry)
258 {
259 uint8 ret;
260 if (!centry_check_bytes(centry, 1)) {
261 smb_panic_fn("centry_uint8");
262 }
263 ret = CVAL(centry->data, centry->ofs);
264 centry->ofs += 1;
265 return ret;
266 }
267
268 /*
269 pull a NTTIME from a cache entry
270 */
271 static NTTIME centry_nttime(struct cache_entry *centry)
272 {
273 NTTIME ret;
274 if (!centry_check_bytes(centry, 8)) {
275 smb_panic_fn("centry_nttime");
276 }
277 ret = IVAL(centry->data, centry->ofs);
278 centry->ofs += 4;
279 ret += (uint64)IVAL(centry->data, centry->ofs) << 32;
280 centry->ofs += 4;
281 return ret;
282 }
283
284 /*
285 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
286 */
287 static time_t centry_time(struct cache_entry *centry)
288 {
289 return (time_t)centry_nttime(centry);
290 }
291
292 /* pull a string from a cache entry, using the supplied
293 talloc context
294 */
295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
296 {
297 uint32 len;
298 char *ret;
299
300 len = centry_uint8(centry);
301
302 if (len == 0xFF) {
303 /* a deliberate NULL string */
304 return NULL;
305 }
306
307 if (!centry_check_bytes(centry, (size_t)len)) {
308 smb_panic_fn("centry_string");
309 }
310
311 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
312 if (!ret) {
313 smb_panic_fn("centry_string out of memory\n");
314 }
315 memcpy(ret,centry->data + centry->ofs, len);
316 ret[len] = 0;
317 centry->ofs += len;
318 return ret;
319 }
320
321 /* pull a hash16 from a cache entry, using the supplied
322 talloc context
323 */
324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
325 {
326 uint32 len;
327 char *ret;
328
329 len = centry_uint8(centry);
330
331 if (len != 16) {
332 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
333 len ));
334 return NULL;
335 }
336
337 if (!centry_check_bytes(centry, 16)) {
338 return NULL;
339 }
340
341 ret = TALLOC_ARRAY(mem_ctx, char, 16);
342 if (!ret) {
343 smb_panic_fn("centry_hash out of memory\n");
344 }
345 memcpy(ret,centry->data + centry->ofs, 16);
346 centry->ofs += 16;
347 return ret;
348 }
349
350 /* pull a sid from a cache entry, using the supplied
351 talloc context
352 */
353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
354 {
355 char *sid_string;
356 bool ret;
357
358 sid_string = centry_string(centry, talloc_tos());
359 if (sid_string == NULL) {
360 return false;
361 }
362 ret = string_to_sid(sid, sid_string);
363 TALLOC_FREE(sid_string);
364 return ret;
365 }
366
367
368 /*
369 pull a NTSTATUS from a cache entry
370 */
371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
372 {
373 NTSTATUS status;
374
375 status = NT_STATUS(centry_uint32(centry));
376 return status;
377 }
378
379
380 /* the server is considered down if it can't give us a sequence number */
381 static bool wcache_server_down(struct winbindd_domain *domain)
382 {
383 bool ret;
384
385 if (!wcache->tdb)
386 return false;
387
388 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
389
390 if (ret)
391 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
392 domain->name ));
393 return ret;
394 }
395
396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
397 uint32_t *last_seq_check)
398 {
399 char *key;
400 TDB_DATA data;
401
402 if (wcache->tdb == NULL) {
403 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
404 return false;
405 }
406
407 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
408 if (key == NULL) {
409 DEBUG(10, ("talloc failed\n"));
410 return false;
411 }
412
413 data = tdb_fetch_bystring(wcache->tdb, key);
414 TALLOC_FREE(key);
415
416 if (data.dptr == NULL) {
417 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
418 domain_name));
419 return false;
420 }
421 if (data.dsize != 8) {
422 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
423 (int)data.dsize));
424 SAFE_FREE(data.dptr);
425 return false;
426 }
427
428 *seqnum = IVAL(data.dptr, 0);
429 *last_seq_check = IVAL(data.dptr, 4);
430 SAFE_FREE(data.dptr);
431
432 return true;
433 }
434
435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
436 {
437 uint32 last_check, time_diff;
438
439 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
440 &last_check)) {
441 return NT_STATUS_UNSUCCESSFUL;
442 }
443 domain->last_seq_check = last_check;
444
445 /* have we expired? */
446
447 time_diff = now - domain->last_seq_check;
448 if ( time_diff > lp_winbind_cache_time() ) {
449 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
450 domain->name, domain->sequence_number,
451 (uint32)domain->last_seq_check));
452 return NT_STATUS_UNSUCCESSFUL;
453 }
454
455 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
456 domain->name, domain->sequence_number,
457 (uint32)domain->last_seq_check));
458
459 return NT_STATUS_OK;
460 }
461
462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
463 time_t last_seq_check)
464 {
465 char *key_str;
466 uint8_t buf[8];
467 int ret;
468
469 if (wcache->tdb == NULL) {
470 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
471 return false;
472 }
473
474 key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
475 if (key_str == NULL) {
476 DEBUG(10, ("talloc_asprintf failed\n"));
477 return false;
478 }
479
480 SIVAL(buf, 0, seqnum);
481 SIVAL(buf, 4, last_seq_check);
482
483 ret = tdb_store_bystring(wcache->tdb, key_str,
484 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
485 TALLOC_FREE(key_str);
486 if (ret == -1) {
487 DEBUG(10, ("tdb_store_bystring failed: %s\n",
488 tdb_errorstr(wcache->tdb)));
489 TALLOC_FREE(key_str);
490 return false;
491 }
492
493 DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
494 domain_name, seqnum, (unsigned)last_seq_check));
495
496 return true;
497 }
498
499 static bool store_cache_seqnum( struct winbindd_domain *domain )
500 {
501 return wcache_store_seqnum(domain->name, domain->sequence_number,
502 domain->last_seq_check);
503 }
504
505 /*
506 refresh the domain sequence number. If force is true
507 then always refresh it, no matter how recently we fetched it
508 */
509
510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
511 {
512 NTSTATUS status;
513 unsigned time_diff;
514 time_t t = time(NULL);
515 unsigned cache_time = lp_winbind_cache_time();
516
517 if (is_domain_offline(domain)) {
518 return;
519 }
520
521 get_cache( domain );
522
523 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
524 /* trying to reconnect is expensive, don't do it too often */
525 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
526 cache_time *= 8;
527 }
528 #endif
529
530 time_diff = t - domain->last_seq_check;
531
532 /* see if we have to refetch the domain sequence number */
533 if (!force && (time_diff < cache_time) &&
534 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
535 NT_STATUS_IS_OK(domain->last_status)) {
536 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
537 goto done;
538 }
539
540 /* try to get the sequence number from the tdb cache first */
541 /* this will update the timestamp as well */
542
543 status = fetch_cache_seqnum( domain, t );
544 if (NT_STATUS_IS_OK(status) &&
545 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
546 NT_STATUS_IS_OK(domain->last_status)) {
547 goto done;
548 }
549
550 /* important! make sure that we know if this is a native
551 mode domain or not. And that we can contact it. */
552
553 if ( winbindd_can_contact_domain( domain ) ) {
554 status = domain->backend->sequence_number(domain,
555 &domain->sequence_number);
556 } else {
557 /* just use the current time */
558 status = NT_STATUS_OK;
559 domain->sequence_number = time(NULL);
560 }
561
562
563 /* the above call could have set our domain->backend to NULL when
564 * coming from offline to online mode, make sure to reinitialize the
565 * backend - Guenther */
566 get_cache( domain );
567
568 if (!NT_STATUS_IS_OK(status)) {
569 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
570 domain->sequence_number = DOM_SEQUENCE_NONE;
571 }
572
573 domain->last_status = status;
574 domain->last_seq_check = time(NULL);
575
576 /* save the new sequence number in the cache */
577 store_cache_seqnum( domain );
578
579 done:
580 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
581 domain->name, domain->sequence_number));
582
583 return;
584 }
585
586 /*
587 decide if a cache entry has expired
588 */
589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
590 {
591 /* If we've been told to be offline - stay in that state... */
592 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
593 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
594 keystr, domain->name ));
595 return false;
596 }
597
598 /* when the domain is offline return the cached entry.
599 * This deals with transient offline states... */
600
601 if (!domain->online) {
602 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
603 keystr, domain->name ));
604 return false;
605 }
606
607 /* if the server is OK and our cache entry came from when it was down then
608 the entry is invalid */
609 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
610 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
611 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
612 keystr, domain->name ));
613 return true;
614 }
615
616 /* if the server is down or the cache entry is not older than the
617 current sequence number or it did not timeout then it is OK */
618 if (wcache_server_down(domain)
619 || ((centry->sequence_number == domain->sequence_number)
620 && (centry->timeout > time(NULL)))) {
621 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
622 keystr, domain->name ));
623 return false;
624 }
625
626 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
627 keystr, domain->name ));
628
629 /* it's expired */
630 return true;
631 }
632
633 static struct cache_entry *wcache_fetch_raw(char *kstr)
634 {
635 TDB_DATA data;
636 struct cache_entry *centry;
637 TDB_DATA key;
638
639 key = string_tdb_data(kstr);
640 data = tdb_fetch(wcache->tdb, key);
641 if (!data.dptr) {
642 /* a cache miss */
643 return NULL;
644 }
645
646 centry = SMB_XMALLOC_P(struct cache_entry);
647 centry->data = (unsigned char *)data.dptr;
648 centry->len = data.dsize;
649 centry->ofs = 0;
650
651 if (centry->len < 16) {
652 /* huh? corrupt cache? */
653 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s "
654 "(len < 16)?\n", kstr));
655 centry_free(centry);
656 return NULL;
657 }
658
659 centry->status = centry_ntstatus(centry);
660 centry->sequence_number = centry_uint32(centry);
661 centry->timeout = centry_uint64_t(centry);
662
663 return centry;
664 }
665
666 static bool is_my_own_sam_domain(struct winbindd_domain *domain)
667 {
668 if (strequal(domain->name, get_global_sam_name()) &&
669 sid_check_is_domain(&domain->sid)) {
670 return true;
671 }
672
673 return false;
674 }
675
676 static bool is_builtin_domain(struct winbindd_domain *domain)
677 {
678 if (strequal(domain->name, "BUILTIN") &&
679 sid_check_is_builtin(&domain->sid)) {
680 return true;
681 }
682
683 return false;
684 }
685
686 /*
687 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
688 number and return status
689 */
690 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
691 struct winbindd_domain *domain,
692 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
693 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
694 struct winbindd_domain *domain,
695 const char *format, ...)
696 {
697 va_list ap;
698 char *kstr;
699 struct cache_entry *centry;
700
701 if (!winbindd_use_cache() ||
702 is_my_own_sam_domain(domain) ||
703 is_builtin_domain(domain)) {
704 return NULL;
705 }
706
707 refresh_sequence_number(domain, false);
708
709 va_start(ap, format);
710 smb_xvasprintf(&kstr, format, ap);
711 va_end(ap);
712
713 centry = wcache_fetch_raw(kstr);
714 if (centry == NULL) {
715 free(kstr);
716 return NULL;
717 }
718
719 if (centry_expired(domain, kstr, centry)) {
720
721 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
722 kstr, domain->name ));
723
724 centry_free(centry);
725 free(kstr);
726 return NULL;
727 }
728
729 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
730 kstr, domain->name ));
731
732 free(kstr);
733 return centry;
734 }
735
736 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
737 static void wcache_delete(const char *format, ...)
738 {
739 va_list ap;
740 char *kstr;
741 TDB_DATA key;
742
743 va_start(ap, format);
744 smb_xvasprintf(&kstr, format, ap);
745 va_end(ap);
746
747 key = string_tdb_data(kstr);
748
749 tdb_delete(wcache->tdb, key);
750 free(kstr);
751 }
752
753 /*
754 make sure we have at least len bytes available in a centry
755 */
756 static void centry_expand(struct cache_entry *centry, uint32 len)
757 {
758 if (centry->len - centry->ofs >= len)
759 return;
760 centry->len *= 2;
761 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
762 centry->len);
763 if (!centry->data) {
764 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
765 smb_panic_fn("out of memory in centry_expand");
766 }
767 }
768
769 /*
770 push a uint64_t into a centry
771 */
772 static void centry_put_uint64_t(struct cache_entry *centry, uint64_t v)
773 {
774 centry_expand(centry, 8);
775 SBVAL(centry->data, centry->ofs, v);
776 centry->ofs += 8;
777 }
778
779 /*
780 push a uint32 into a centry
781 */
782 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
783 {
784 centry_expand(centry, 4);
785 SIVAL(centry->data, centry->ofs, v);
786 centry->ofs += 4;
787 }
788
789 /*
790 push a uint16 into a centry
791 */
792 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
793 {
794 centry_expand(centry, 2);
795 SSVAL(centry->data, centry->ofs, v);
796 centry->ofs += 2;
797 }
798
799 /*
800 push a uint8 into a centry
801 */
802 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
803 {
804 centry_expand(centry, 1);
805 SCVAL(centry->data, centry->ofs, v);
806 centry->ofs += 1;
807 }
808
809 /*
810 push a string into a centry
811 */
812 static void centry_put_string(struct cache_entry *centry, const char *s)
813 {
814 int len;
815
816 if (!s) {
817 /* null strings are marked as len 0xFFFF */
818 centry_put_uint8(centry, 0xFF);
819 return;
820 }
821
822 len = strlen(s);
823 /* can't handle more than 254 char strings. Truncating is probably best */
824 if (len > 254) {
825 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
826 len = 254;
827 }
828 centry_put_uint8(centry, len);
829 centry_expand(centry, len);
830 memcpy(centry->data + centry->ofs, s, len);
831 centry->ofs += len;
832 }
833
834 /*
835 push a 16 byte hash into a centry - treat as 16 byte string.
836 */
837 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
838 {
839 centry_put_uint8(centry, 16);
840 centry_expand(centry, 16);
841 memcpy(centry->data + centry->ofs, val, 16);
842 centry->ofs += 16;
843 }
844
845 static void centry_put_sid(struct cache_entry *centry, const struct dom_sid *sid)
846 {
847 fstring sid_string;
848 centry_put_string(centry, sid_to_fstring(sid_string, sid));
849 }
850
851
852 /*
853 put NTSTATUS into a centry
854 */
855 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
856 {
857 uint32 status_value = NT_STATUS_V(status);
858 centry_put_uint32(centry, status_value);
859 }
860
861
862 /*
863 push a NTTIME into a centry
864 */
865 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
866 {
867 centry_expand(centry, 8);
868 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
869 centry->ofs += 4;
870 SIVAL(centry->data, centry->ofs, nt >> 32);
871 centry->ofs += 4;
872 }
873
874 /*
875 push a time_t into a centry - use a 64 bit size.
876 NTTIME here is being used as a convenient 64-bit size.
877 */
878 static void centry_put_time(struct cache_entry *centry, time_t t)
879 {
880 NTTIME nt = (NTTIME)t;
881 centry_put_nttime(centry, nt);
882 }
883
884 /*
885 start a centry for output. When finished, call centry_end()
886 */
887 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
888 {
889 struct cache_entry *centry;
890
891 if (!wcache->tdb)
892 return NULL;
893
894 centry = SMB_XMALLOC_P(struct cache_entry);
895
896 centry->len = 8192; /* reasonable default */
897 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
898 centry->ofs = 0;
899 centry->sequence_number = domain->sequence_number;
900 centry->timeout = lp_winbind_cache_time() + time(NULL);
901 centry_put_ntstatus(centry, status);
902 centry_put_uint32(centry, centry->sequence_number);
903 centry_put_uint64_t(centry, centry->timeout);
904 return centry;
905 }
906
907 /*
908 finish a centry and write it to the tdb
909 */
910 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
911 static void centry_end(struct cache_entry *centry, const char *format, ...)
912 {
913 va_list ap;
914 char *kstr;
915 TDB_DATA key, data;
916
917 if (!winbindd_use_cache()) {
918 return;
919 }
920
921 va_start(ap, format);
922 smb_xvasprintf(&kstr, format, ap);
923 va_end(ap);
924
925 key = string_tdb_data(kstr);
926 data.dptr = centry->data;
927 data.dsize = centry->ofs;
928
929 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
930 free(kstr);
931 }
932
933 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
934 NTSTATUS status, const char *domain_name,
935 const char *name, const struct dom_sid *sid,
936 enum lsa_SidType type)
937 {
938 struct cache_entry *centry;
939 fstring uname;
940
941 centry = centry_start(domain, status);
942 if (!centry)
943 return;
944 centry_put_uint32(centry, type);
945 centry_put_sid(centry, sid);
946 fstrcpy(uname, name);
947 strupper_m(uname);
948 centry_end(centry, "NS/%s/%s", domain_name, uname);
949 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
950 uname, sid_string_dbg(sid), nt_errstr(status)));
951 centry_free(centry);
952 }
953
954 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
955 const struct dom_sid *sid, const char *domain_name, const char *name, enum lsa_SidType type)
956 {
957 struct cache_entry *centry;
958 fstring sid_string;
959
960 centry = centry_start(domain, status);
961 if (!centry)
962 return;
963
964 if (NT_STATUS_IS_OK(status)) {
965 centry_put_uint32(centry, type);
966 centry_put_string(centry, domain_name);
967 centry_put_string(centry, name);
968 }
969
970 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
971 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
972 name, nt_errstr(status)));
973 centry_free(centry);
974 }
975
976
977 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
978 struct wbint_userinfo *info)
979 {
980 struct cache_entry *centry;
981 fstring sid_string;
982
983 if (is_null_sid(&info->user_sid)) {
984 return;
985 }
986
987 centry = centry_start(domain, status);
988 if (!centry)
989 return;
990 centry_put_string(centry, info->acct_name);
991 centry_put_string(centry, info->full_name);
992 centry_put_string(centry, info->homedir);
993 centry_put_string(centry, info->shell);
994 centry_put_uint32(centry, info->primary_gid);
995 centry_put_sid(centry, &info->user_sid);
996 centry_put_sid(centry, &info->group_sid);
997 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
998 &info->user_sid));
999 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
1000 centry_free(centry);
1001 }
1002
1003 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
1004 NTSTATUS status,
1005 struct samr_DomInfo12 *lockout_policy)
1006 {
1007 struct cache_entry *centry;
1008
1009 centry = centry_start(domain, status);
1010 if (!centry)
1011 return;
1012
1013 centry_put_nttime(centry, lockout_policy->lockout_duration);
1014 centry_put_nttime(centry, lockout_policy->lockout_window);
1015 centry_put_uint16(centry, lockout_policy->lockout_threshold);
1016
1017 centry_end(centry, "LOC_POL/%s", domain->name);
1018
1019 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
1020
1021 centry_free(centry);
1022 }
1023
1024
1025
1026 static void wcache_save_password_policy(struct winbindd_domain *domain,
1027 NTSTATUS status,
1028 struct samr_DomInfo1 *policy)
1029 {
1030 struct cache_entry *centry;
1031
1032 centry = centry_start(domain, status);
1033 if (!centry)
1034 return;
1035
1036 centry_put_uint16(centry, policy->min_password_length);
1037 centry_put_uint16(centry, policy->password_history_length);
1038 centry_put_uint32(centry, policy->password_properties);
1039 centry_put_nttime(centry, policy->max_password_age);
1040 centry_put_nttime(centry, policy->min_password_age);
1041
1042 centry_end(centry, "PWD_POL/%s", domain->name);
1043
1044 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1045
1046 centry_free(centry);
1047 }
1048
1049 /***************************************************************************
1050 ***************************************************************************/
1051
1052 static void wcache_save_username_alias(struct winbindd_domain *domain,
1053 NTSTATUS status,
1054 const char *name, const char *alias)
1055 {
1056 struct cache_entry *centry;
1057 fstring uname;
1058
1059 if ( (centry = centry_start(domain, status)) == NULL )
1060 return;
1061
1062 centry_put_string( centry, alias );
1063
1064 fstrcpy(uname, name);
1065 strupper_m(uname);
1066 centry_end(centry, "NSS/NA/%s", uname);
1067
1068 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1069
1070 centry_free(centry);
1071 }
1072
1073 static void wcache_save_alias_username(struct winbindd_domain *domain,
1074 NTSTATUS status,
1075 const char *alias, const char *name)
1076 {
1077 struct cache_entry *centry;
1078 fstring uname;
1079
1080 if ( (centry = centry_start(domain, status)) == NULL )
1081 return;
1082
1083 centry_put_string( centry, name );
1084
1085 fstrcpy(uname, alias);
1086 strupper_m(uname);
1087 centry_end(centry, "NSS/AN/%s", uname);
1088
1089 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1090
1091 centry_free(centry);
1092 }
1093
1094 /***************************************************************************
1095 ***************************************************************************/
1096
1097 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1098 struct winbindd_domain *domain,
1099 const char *name, char **alias )
1100 {
1101 struct winbind_cache *cache = get_cache(domain);
1102 struct cache_entry *centry = NULL;
1103 NTSTATUS status;
1104 char *upper_name;
1105
1106 if ( domain->internal )
1107 return NT_STATUS_NOT_SUPPORTED;
1108
1109 if (!cache->tdb)
1110 goto do_query;
1111
1112 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1113 return NT_STATUS_NO_MEMORY;
1114 strupper_m(upper_name);
1115
1116 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1117
1118 SAFE_FREE( upper_name );
1119
1120 if (!centry)
1121 goto do_query;
1122
1123 status = centry->status;
1124
1125 if (!NT_STATUS_IS_OK(status)) {
1126 centry_free(centry);
1127 return status;
1128 }
1129
1130 *alias = centry_string( centry, mem_ctx );
1131
1132 centry_free(centry);
1133
1134 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1135 name, *alias ? *alias : "(none)"));
1136
1137 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1138
1139 do_query:
1140
1141 /* If its not in cache and we are offline, then fail */
1142
1143 if ( get_global_winbindd_state_offline() || !domain->online ) {
1144 DEBUG(8,("resolve_username_to_alias: rejecting query "
1145 "in offline mode\n"));
1146 return NT_STATUS_NOT_FOUND;
1147 }
1148
1149 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1150
1151 if ( NT_STATUS_IS_OK( status ) ) {
1152 wcache_save_username_alias(domain, status, name, *alias);
1153 }
1154
1155 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1156 wcache_save_username_alias(domain, status, name, "(NULL)");
1157 }
1158
1159 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1160 nt_errstr(status)));
1161
1162 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1163 set_domain_offline( domain );
1164 }
1165
1166 return status;
1167 }
1168
1169 /***************************************************************************
1170 ***************************************************************************/
1171
1172 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1173 struct winbindd_domain *domain,
1174 const char *alias, char **name )
1175 {
1176 struct winbind_cache *cache = get_cache(domain);
1177 struct cache_entry *centry = NULL;
1178 NTSTATUS status;
1179 char *upper_name;
1180
1181 if ( domain->internal )
1182 return NT_STATUS_NOT_SUPPORTED;
1183
1184 if (!cache->tdb)
1185 goto do_query;
1186
1187 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1188 return NT_STATUS_NO_MEMORY;
1189 strupper_m(upper_name);
1190
1191 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1192
1193 SAFE_FREE( upper_name );
1194
1195 if (!centry)
1196 goto do_query;
1197
1198 status = centry->status;
1199
1200 if (!NT_STATUS_IS_OK(status)) {
1201 centry_free(centry);
1202 return status;
1203 }
1204
1205 *name = centry_string( centry, mem_ctx );
1206
1207 centry_free(centry);
1208
1209 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1210 alias, *name ? *name : "(none)"));
1211
1212 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1213
1214 do_query:
1215
1216 /* If its not in cache and we are offline, then fail */
1217
1218 if ( get_global_winbindd_state_offline() || !domain->online ) {
1219 DEBUG(8,("resolve_alias_to_username: rejecting query "
1220 "in offline mode\n"));
1221 return NT_STATUS_NOT_FOUND;
1222 }
1223
1224 /* an alias cannot contain a domain prefix or '@' */
1225
1226 if (strchr(alias, '\\') || strchr(alias, '@')) {
1227 DEBUG(10,("resolve_alias_to_username: skipping fully "
1228 "qualified name %s\n", alias));
1229 return NT_STATUS_OBJECT_NAME_INVALID;
1230 }
1231
1232 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1233
1234 if ( NT_STATUS_IS_OK( status ) ) {
1235 wcache_save_alias_username( domain, status, alias, *name );
1236 }
1237
1238 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1239 wcache_save_alias_username(domain, status, alias, "(NULL)");
1240 }
1241
1242 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1243 nt_errstr(status)));
1244
1245 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1246 set_domain_offline( domain );
1247 }
1248
1249 return status;
1250 }
1251
1252 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const struct dom_sid *sid)
1253 {
1254 struct winbind_cache *cache = get_cache(domain);
1255 TDB_DATA data;
1256 fstring key_str, tmp;
1257 uint32 rid;
1258
1259 if (!cache->tdb) {
1260 return NT_STATUS_INTERNAL_DB_ERROR;
1261 }
1262
1263 if (is_null_sid(sid)) {
1264 return NT_STATUS_INVALID_SID;
1265 }
1266
1267 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1268 return NT_STATUS_INVALID_SID;
1269 }
1270
1271 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1272
1273 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1274 if (!data.dptr) {
1275 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1276 }
1277
1278 SAFE_FREE(data.dptr);
1279 return NT_STATUS_OK;
1280 }
1281
1282 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1283 as new salted ones. */
1284
1285 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1286 TALLOC_CTX *mem_ctx,
1287 const struct dom_sid *sid,
1288 const uint8 **cached_nt_pass,
1289 const uint8 **cached_salt)
1290 {
1291 struct winbind_cache *cache = get_cache(domain);
1292 struct cache_entry *centry = NULL;
1293 NTSTATUS status;
1294 time_t t;
1295 uint32 rid;
1296 fstring tmp;
1297
1298 if (!cache->tdb) {
1299 return NT_STATUS_INTERNAL_DB_ERROR;
1300 }
1301
1302 if (is_null_sid(sid)) {
1303 return NT_STATUS_INVALID_SID;
1304 }
1305
1306 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1307 return NT_STATUS_INVALID_SID;
1308 }
1309
1310 /* Try and get a salted cred first. If we can't
1311 fall back to an unsalted cred. */
1312
1313 centry = wcache_fetch(cache, domain, "CRED/%s",
1314 sid_to_fstring(tmp, sid));
1315 if (!centry) {
1316 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1317 sid_string_dbg(sid)));
1318 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1319 }
1320
1321 t = centry_time(centry);
1322
1323 /* In the salted case this isn't actually the nt_hash itself,
1324 but the MD5 of the salt + nt_hash. Let the caller
1325 sort this out. It can tell as we only return the cached_salt
1326 if we are returning a salted cred. */
1327
1328 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1329 if (*cached_nt_pass == NULL) {
1330 fstring sidstr;
1331
1332 sid_to_fstring(sidstr, sid);
1333
1334 /* Bad (old) cred cache. Delete and pretend we
1335 don't have it. */
1336 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1337 sidstr));
1338 wcache_delete("CRED/%s", sidstr);
1339 centry_free(centry);
1340 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1341 }
1342
1343 /* We only have 17 bytes more data in the salted cred case. */
1344 if (centry->len - centry->ofs == 17) {
1345 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1346 } else {
1347 *cached_salt = NULL;
1348 }
1349
1350 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1351 if (*cached_salt) {
1352 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1353 }
1354
1355 status = centry->status;
1356
1357 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1358 sid_string_dbg(sid), nt_errstr(status) ));
1359
1360 centry_free(centry);
1361 return status;
1362 }
1363
1364 /* Store creds for a SID - only writes out new salted ones. */
1365
1366 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1367 const struct dom_sid *sid,
1368 const uint8 nt_pass[NT_HASH_LEN])
1369 {
1370 struct cache_entry *centry;
1371 fstring sid_string;
1372 uint32 rid;
1373 uint8 cred_salt[NT_HASH_LEN];
1374 uint8 salted_hash[NT_HASH_LEN];
1375
1376 if (is_null_sid(sid)) {
1377 return NT_STATUS_INVALID_SID;
1378 }
1379
1380 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1381 return NT_STATUS_INVALID_SID;
1382 }
1383
1384 centry = centry_start(domain, NT_STATUS_OK);
1385 if (!centry) {
1386 return NT_STATUS_INTERNAL_DB_ERROR;
1387 }
1388
1389 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1390
1391 centry_put_time(centry, time(NULL));
1392
1393 /* Create a salt and then salt the hash. */
1394 generate_random_buffer(cred_salt, NT_HASH_LEN);
1395 E_md5hash(cred_salt, nt_pass, salted_hash);
1396
1397 centry_put_hash16(centry, salted_hash);
1398 centry_put_hash16(centry, cred_salt);
1399 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1400
1401 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1402
1403 centry_free(centry);
1404
1405 return NT_STATUS_OK;
1406 }
1407
1408
1409 /* Query display info. This is the basic user list fn */
1410 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1411 TALLOC_CTX *mem_ctx,
1412 uint32 *num_entries,
1413 struct wbint_userinfo **info)
1414 {
1415 struct winbind_cache *cache = get_cache(domain);
1416 struct cache_entry *centry = NULL;
1417 NTSTATUS status;
1418 unsigned int i, retry;
1419 bool old_status = domain->online;
1420
1421 if (!cache->tdb)
1422 goto do_query;
1423
1424 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1425 if (!centry)
1426 goto do_query;
1427
1428 do_fetch_cache:
1429 *num_entries = centry_uint32(centry);
1430
1431 if (*num_entries == 0)
1432 goto do_cached;
1433
1434 (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1435 if (! (*info)) {
1436 smb_panic_fn("query_user_list out of memory");
1437 }
1438 for (i=0; i<(*num_entries); i++) {
1439 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1440 (*info)[i].full_name = centry_string(centry, mem_ctx);
1441 (*info)[i].homedir = centry_string(centry, mem_ctx);
1442 (*info)[i].shell = centry_string(centry, mem_ctx);
1443 centry_sid(centry, &(*info)[i].user_sid);
1444 centry_sid(centry, &(*info)[i].group_sid);
1445 }
1446
1447 do_cached:
1448 status = centry->status;
1449
1450 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1451 domain->name, nt_errstr(status) ));
1452
1453 centry_free(centry);
1454 return status;
1455
1456 do_query:
1457 *num_entries = 0;
1458 *info = NULL;
1459
1460 /* Return status value returned by seq number check */
1461
1462 if (!NT_STATUS_IS_OK(domain->last_status))
1463 return domain->last_status;
1464
1465 /* Put the query_user_list() in a retry loop. There appears to be
1466 * some bug either with Windows 2000 or Samba's handling of large
1467 * rpc replies. This manifests itself as sudden disconnection
1468 * at a random point in the enumeration of a large (60k) user list.
1469 * The retry loop simply tries the operation again. )-: It's not
1470 * pretty but an acceptable workaround until we work out what the
1471 * real problem is. */
1472
1473 retry = 0;
1474 do {
1475
1476 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1477 domain->name ));
1478
1479 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1480 if (!NT_STATUS_IS_OK(status)) {
1481 DEBUG(3, ("query_user_list: returned 0x%08x, "
1482 "retrying\n", NT_STATUS_V(status)));
1483 }
1484 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1485 DEBUG(3, ("query_user_list: flushing "
1486 "connection cache\n"));
1487 invalidate_cm_connection(&domain->conn);
1488 }
1489 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1490 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1491 if (!domain->internal && old_status) {
1492 set_domain_offline(domain);
1493 }
1494 /* store partial response. */
1495 if (*num_entries > 0) {
1496 /*
1497 * humm, what about the status used for cache?
1498 * Should it be NT_STATUS_OK?
1499 */
1500 break;
1501 }
1502 /*
1503 * domain is offline now, and there is no user entries,
1504 * try to fetch from cache again.
1505 */
1506 if (cache->tdb && !domain->online && !domain->internal && old_status) {
1507 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1508 /* partial response... */
1509 if (!centry) {
1510 goto skip_save;
1511 } else {
1512 goto do_fetch_cache;
1513 }
1514 } else {
1515 goto skip_save;
1516 }
1517 }
1518
1519 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1520 (retry++ < 5));
1521
1522 /* and save it */
1523 refresh_sequence_number(domain, false);
1524 if (!NT_STATUS_IS_OK(status)) {
1525 return status;
1526 }
1527 centry = centry_start(domain, status);
1528 if (!centry)
1529 goto skip_save;
1530 centry_put_uint32(centry, *num_entries);
1531 for (i=0; i<(*num_entries); i++) {
1532 centry_put_string(centry, (*info)[i].acct_name);
1533 centry_put_string(centry, (*info)[i].full_name);
1534 centry_put_string(centry, (*info)[i].homedir);
1535 centry_put_string(centry, (*info)[i].shell);
1536 centry_put_sid(centry, &(*info)[i].user_sid);
1537 centry_put_sid(centry, &(*info)[i].group_sid);
1538 if (domain->backend && domain->backend->consistent) {
1539 /* when the backend is consistent we can pre-prime some mappings */
1540 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1541 domain->name,
1542 (*info)[i].acct_name,
1543 &(*info)[i].user_sid,
1544 SID_NAME_USER);
1545 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1546 &(*info)[i].user_sid,
1547 domain->name,
1548 (*info)[i].acct_name,
1549 SID_NAME_USER);
1550 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1551 }
1552 }
1553 centry_end(centry, "UL/%s", domain->name);
1554 centry_free(centry);
1555
1556 skip_save:
1557 return status;
1558 }
1559
1560 /* list all domain groups */
1561 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1562 TALLOC_CTX *mem_ctx,
1563 uint32 *num_entries,
1564 struct wb_acct_info **info)
1565 {
1566 struct winbind_cache *cache = get_cache(domain);
1567 struct cache_entry *centry = NULL;
1568 NTSTATUS status;
1569 unsigned int i;
1570 bool old_status;
1571
1572 old_status = domain->online;
1573 if (!cache->tdb)
1574 goto do_query;
1575
1576 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1577 if (!centry)
1578 goto do_query;
1579
1580 do_fetch_cache:
1581 *num_entries = centry_uint32(centry);
1582
1583 if (*num_entries == 0)
1584 goto do_cached;
1585
1586 (*info) = TALLOC_ARRAY(mem_ctx, struct wb_acct_info, *num_entries);
1587 if (! (*info)) {
1588 smb_panic_fn("enum_dom_groups out of memory");
1589 }
1590 for (i=0; i<(*num_entries); i++) {
1591 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1592 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1593 (*info)[i].rid = centry_uint32(centry);
1594 }
1595
1596 do_cached:
1597 status = centry->status;
1598
1599 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1600 domain->name, nt_errstr(status) ));
1601
1602 centry_free(centry);
1603 return status;
1604
1605 do_query:
1606 *num_entries = 0;
1607 *info = NULL;
1608
1609 /* Return status value returned by seq number check */
1610
1611 if (!NT_STATUS_IS_OK(domain->last_status))
1612 return domain->last_status;
1613
1614 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1615 domain->name ));
1616
1617 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1618
1619 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1620 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1621 if (!domain->internal && old_status) {
1622 set_domain_offline(domain);
1623 }
1624 if (cache->tdb &&
1625 !domain->online &&
1626 !domain->internal &&
1627 old_status) {
1628 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1629 if (centry) {
1630 goto do_fetch_cache;
1631 }
1632 }
1633 }
1634 /* and save it */
1635 refresh_sequence_number(domain, false);
1636 if (!NT_STATUS_IS_OK(status)) {
1637 return status;
1638 }
1639 centry = centry_start(domain, status);
1640 if (!centry)
1641 goto skip_save;
1642 centry_put_uint32(centry, *num_entries);
1643 for (i=0; i<(*num_entries); i++) {
1644 centry_put_string(centry, (*info)[i].acct_name);
1645 centry_put_string(centry, (*info)[i].acct_desc);
1646 centry_put_uint32(centry, (*info)[i].rid);
1647 }
1648 centry_end(centry, "GL/%s/domain", domain->name);
1649 centry_free(centry);
1650
1651 skip_save:
1652 return status;
1653 }
1654
1655 /* list all domain groups */
1656 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1657 TALLOC_CTX *mem_ctx,
1658 uint32 *num_entries,
1659 struct wb_acct_info **info)
1660 {
1661 struct winbind_cache *cache = get_cache(domain);
1662 struct cache_entry *centry = NULL;
1663 NTSTATUS status;
1664 unsigned int i;
1665 bool old_status;
1666
1667 old_status = domain->online;
1668 if (!cache->tdb)
1669 goto do_query;
1670
1671 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1672 if (!centry)
1673 goto do_query;
1674
1675 do_fetch_cache:
1676 *num_entries = centry_uint32(centry);
1677
1678 if (*num_entries == 0)
1679 goto do_cached;
1680
1681 (*info) = TALLOC_ARRAY(mem_ctx, struct wb_acct_info, *num_entries);
1682 if (! (*info)) {
1683 smb_panic_fn("enum_dom_groups out of memory");
1684 }
1685 for (i=0; i<(*num_entries); i++) {
1686 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1687 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1688 (*info)[i].rid = centry_uint32(centry);
1689 }
1690
1691 do_cached:
1692
1693 /* If we are returning cached data and the domain controller
1694 is down then we don't know whether the data is up to date
1695 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1696 indicate this. */
1697
1698 if (wcache_server_down(domain)) {
1699 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1700 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1701 } else
1702 status = centry->status;
1703
1704 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1705 domain->name, nt_errstr(status) ));
1706
1707 centry_free(centry);
1708 return status;
1709
1710 do_query:
1711 *num_entries = 0;
1712 *info = NULL;
1713
1714 /* Return status value returned by seq number check */
1715
1716 if (!NT_STATUS_IS_OK(domain->last_status))
1717 return domain->last_status;
1718
1719 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1720 domain->name ));
1721
1722 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1723
1724 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1725 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1726 if (!domain->internal && old_status) {
1727 set_domain_offline(domain);
1728 }
1729 if (cache->tdb &&
1730 !domain->internal &&
1731 !domain->online &&
1732 old_status) {
1733 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1734 if (centry) {
1735 goto do_fetch_cache;
1736 }
1737 }
1738 }
1739 /* and save it */
1740 refresh_sequence_number(domain, false);
1741 if (!NT_STATUS_IS_OK(status)) {
1742 return status;
1743 }
1744 centry = centry_start(domain, status);
1745 if (!centry)
1746 goto skip_save;
1747 centry_put_uint32(centry, *num_entries);
1748 for (i=0; i<(*num_entries); i++) {
1749 centry_put_string(centry, (*info)[i].acct_name);
1750 centry_put_string(centry, (*info)[i].acct_desc);
1751 centry_put_uint32(centry, (*info)[i].rid);
1752 }
1753 centry_end(centry, "GL/%s/local", domain->name);
1754 centry_free(centry);
1755
1756 skip_save:
1757 return status;
1758 }
1759
1760 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1761 const char *domain_name,
1762 const char *name,
1763 struct dom_sid *sid,
1764 enum lsa_SidType *type)
1765 {
1766 struct winbind_cache *cache = get_cache(domain);
1767 struct cache_entry *centry;
1768 NTSTATUS status;
1769 char *uname;
1770
1771 if (cache->tdb == NULL) {
1772 return NT_STATUS_NOT_FOUND;
1773 }
1774
1775 uname = talloc_strdup_upper(talloc_tos(), name);
1776 if (uname == NULL) {
1777 return NT_STATUS_NO_MEMORY;
1778 }
1779
1780 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1781 TALLOC_FREE(uname);
1782 if (centry == NULL) {
1783 return NT_STATUS_NOT_FOUND;
1784 }
1785
1786 status = centry->status;
1787 if (NT_STATUS_IS_OK(status)) {
1788 *type = (enum lsa_SidType)centry_uint32(centry);
1789 centry_sid(centry, sid);
1790 }
1791
1792 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1793 "%s\n", domain->name, nt_errstr(status) ));
1794
1795 centry_free(centry);
1796 return status;
1797 }
1798
1799 /* convert a single name to a sid in a domain */
1800 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1801 TALLOC_CTX *mem_ctx,
1802 const char *domain_name,
1803 const char *name,
1804 uint32_t flags,
1805 struct dom_sid *sid,
1806 enum lsa_SidType *type)
1807 {
1808 NTSTATUS status;
1809 bool old_status;
1810
1811 old_status = domain->online;
1812
1813 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1814 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1815 return status;
1816 }
1817
1818 ZERO_STRUCTP(sid);
1819
1820 /* If the seq number check indicated that there is a problem
1821 * with this DC, then return that status... except for
1822 * access_denied. This is special because the dc may be in
1823 * "restrict anonymous = 1" mode, in which case it will deny
1824 * most unauthenticated operations, but *will* allow the LSA
1825 * name-to-sid that we try as a fallback. */
1826
1827 if (!(NT_STATUS_IS_OK(domain->last_status)
1828 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1829 return domain->last_status;
1830
1831 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1832 domain->name ));
1833
1834 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1835 name, flags, sid, type);
1836
1837 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1838 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1839 if (!domain->internal && old_status) {
1840 set_domain_offline(domain);
1841 }
1842 if (!domain->internal &&
1843 !domain->online &&
1844 old_status) {
1845 NTSTATUS cache_status;
1846 cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1847 return cache_status;
1848 }
1849 }
1850 /* and save it */
1851 refresh_sequence_number(domain, false);
1852
1853 if (domain->online &&
1854 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1855 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1856
1857 /* Only save the reverse mapping if this was not a UPN */
1858 if (!strchr(name, '@')) {
1859 strupper_m(CONST_DISCARD(char *,domain_name));
1860 strlower_m(CONST_DISCARD(char *,name));
1861 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1862 }
1863 }
1864
1865 return status;
1866 }
1867
1868 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1869 const struct dom_sid *sid,
1870 TALLOC_CTX *mem_ctx,
1871 char **domain_name,
1872 char **name,
1873 enum lsa_SidType *type)
1874 {
1875 struct winbind_cache *cache = get_cache(domain);
1876 struct cache_entry *centry;
1877 char *sid_string;
1878 NTSTATUS status;
1879
1880 if (cache->tdb == NULL) {
1881 return NT_STATUS_NOT_FOUND;
1882 }
1883
1884 sid_string = sid_string_tos(sid);
1885 if (sid_string == NULL) {
1886 return NT_STATUS_NO_MEMORY;
1887 }
1888
1889 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1890 TALLOC_FREE(sid_string);
1891 if (centry == NULL) {
1892 return NT_STATUS_NOT_FOUND;
1893 }
1894
1895 if (NT_STATUS_IS_OK(centry->status)) {
1896 *type = (enum lsa_SidType)centry_uint32(centry);
1897 *domain_name = centry_string(centry, mem_ctx);
1898 *name = centry_string(centry, mem_ctx);
1899 }
1900
1901 status = centry->status;
1902 centry_free(centry);
1903
1904 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1905 "%s\n", domain->name, nt_errstr(status) ));
1906
1907 return status;
1908 }
1909
1910 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1911 given */
1912 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1913 TALLOC_CTX *mem_ctx,
1914 const struct dom_sid *sid,
1915 char **domain_name,
1916 char **name,
1917 enum lsa_SidType *type)
1918 {
1919 NTSTATUS status;
1920 bool old_status;
1921
1922 old_status = domain->online;
1923 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1924 type);
1925 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1926 return status;
1927 }
1928
1929 *name = NULL;
1930 *domain_name = NULL;
1931
1932 /* If the seq number check indicated that there is a problem
1933 * with this DC, then return that status... except for
1934 * access_denied. This is special because the dc may be in
1935 * "restrict anonymous = 1" mode, in which case it will deny
1936 * most unauthenticated operations, but *will* allow the LSA
1937 * sid-to-name that we try as a fallback. */
1938
1939 if (!(NT_STATUS_IS_OK(domain->last_status)
1940 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1941 return domain->last_status;
1942
1943 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1944 domain->name ));
1945
1946 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1947
1948 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1949 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1950 if (!domain->internal && old_status) {
1951 set_domain_offline(domain);
1952 }
1953 if (!domain->internal &&
1954 !domain->online &&
1955 old_status) {
1956 NTSTATUS cache_status;
1957 cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1958 domain_name, name, type);
1959 return cache_status;
1960 }
1961 }
1962 /* and save it */
1963 refresh_sequence_number(domain, false);
1964 if (!NT_STATUS_IS_OK(status)) {
1965 return status;
1966 }
1967 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1968
1969 /* We can't save the name to sid mapping here, as with sid history a
1970 * later name2sid would give the wrong sid. */
1971
1972 return status;
1973 }
1974
1975 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1976 TALLOC_CTX *mem_ctx,
1977 const struct dom_sid *domain_sid,
1978 uint32 *rids,
1979 size_t num_rids,
1980 char **domain_name,
1981 char ***names,
1982 enum lsa_SidType **types)
1983 {
1984 struct winbind_cache *cache = get_cache(domain);
1985 size_t i;
1986 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1987 bool have_mapped;
1988 bool have_unmapped;
1989 bool old_status;
1990
1991 old_status = domain->online;
1992 *domain_name = NULL;
1993 *names = NULL;
1994 *types = NULL;
1995
1996 if (!cache->tdb) {
1997 goto do_query;
1998 }
1999
2000 if (num_rids == 0) {
2001 return NT_STATUS_OK;
2002 }
2003
2004 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
2005 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
2006
2007 if ((*names == NULL) || (*types == NULL)) {
2008 result = NT_STATUS_NO_MEMORY;
2009 goto error;
2010 }
2011
2012 have_mapped = have_unmapped = false;
2013
2014 for (i=0; i<num_rids; i++) {
2015 struct dom_sid sid;
2016 struct cache_entry *centry;
2017 fstring tmp;
2018
2019 if (!sid_compose(&sid, domain_sid, rids[i])) {
2020 result = NT_STATUS_INTERNAL_ERROR;
2021 goto error;
2022 }
2023
2024 centry = wcache_fetch(cache, domain, "SN/%s",
2025 sid_to_fstring(tmp, &sid));
2026 if (!centry) {
2027 goto do_query;
2028 }
2029
2030 (*types)[i] = SID_NAME_UNKNOWN;
2031 (*names)[i] = talloc_strdup(*names, "");
2032
2033 if (NT_STATUS_IS_OK(centry->status)) {
2034 char *dom;
2035 have_mapped = true;
2036 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2037
2038 dom = centry_string(centry, mem_ctx);
2039 if (*domain_name == NULL) {
2040 *domain_name = dom;
2041 } else {
2042 talloc_free(dom);
2043 }
2044
2045 (*names)[i] = centry_string(centry, *names);
2046
2047 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)
2048 || NT_STATUS_EQUAL(centry->status, STATUS_SOME_UNMAPPED)) {
2049 have_unmapped = true;
2050
2051 } else {
2052 /* something's definitely wrong */
2053 result = centry->status;
2054 goto error;
2055 }
2056
2057 centry_free(centry);
2058 }
2059
2060 if (!have_mapped) {
2061 return NT_STATUS_NONE_MAPPED;
2062 }
2063 if (!have_unmapped) {
2064 return NT_STATUS_OK;
2065 }
2066 return STATUS_SOME_UNMAPPED;
2067
2068 do_query:
2069
2070 TALLOC_FREE(*names);
2071 TALLOC_FREE(*types);
2072
2073 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2074 rids, num_rids, domain_name,
2075 names, types);
2076
2077 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2078 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2079 if (!domain->internal && old_status) {
2080 set_domain_offline(domain);
2081 }
2082 if (cache->tdb &&
2083 !domain->internal &&
2084 !domain->online &&
2085 old_status) {
2086 have_mapped = have_unmapped = false;
2087
2088 for (i=0; i<num_rids; i++) {
2089 struct dom_sid sid;
2090 struct cache_entry *centry;
2091 fstring tmp;
2092
2093 if (!sid_compose(&sid, domain_sid, rids[i])) {
2094 result = NT_STATUS_INTERNAL_ERROR;
2095 goto error;
2096 }
2097
2098 centry = wcache_fetch(cache, domain, "SN/%s",
2099 sid_to_fstring(tmp, &sid));
2100 if (!centry) {
2101 (*types)[i] = SID_NAME_UNKNOWN;
2102 (*names)[i] = talloc_strdup(*names, "");
2103 continue;
2104 }
2105
2106 (*types)[i] = SID_NAME_UNKNOWN;
2107 (*names)[i] = talloc_strdup(*names, "");
2108
2109 if (NT_STATUS_IS_OK(centry->status)) {
2110 char *dom;
2111 have_mapped = true;
2112 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2113
2114 dom = centry_string(centry, mem_ctx);
2115 if (*domain_name == NULL) {
2116 *domain_name = dom;
2117 } else {
2118 talloc_free(dom);
2119 }
2120
2121 (*names)[i] = centry_string(centry, *names);
2122
2123 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2124 have_unmapped = true;
2125
2126 } else {
2127 /* something's definitely wrong */
2128 result = centry->status;
2129 goto error;
2130 }
2131
2132 centry_free(centry);
2133 }
2134
2135 if (!have_mapped) {
2136 return NT_STATUS_NONE_MAPPED;
2137 }
2138 if (!have_unmapped) {
2139 return NT_STATUS_OK;
2140 }
2141 return STATUS_SOME_UNMAPPED;
2142 }
2143 }
2144 /*
2145 None of the queried rids has been found so save all negative entries
2146 */
2147 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2148 for (i = 0; i < num_rids; i++) {
2149 struct dom_sid sid;
2150 const char *name = "";
2151 const enum lsa_SidType type = SID_NAME_UNKNOWN;
2152 NTSTATUS status = NT_STATUS_NONE_MAPPED;
2153
2154 if (!sid_compose(&sid, domain_sid, rids[i])) {
2155 return NT_STATUS_INTERNAL_ERROR;
2156 }
2157
2158 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2159 name, type);
2160 }
2161
2162 return result;
2163 }
2164
2165 /*
2166 Some or all of the queried rids have been found.
2167 */
2168 if (!NT_STATUS_IS_OK(result) &&
2169 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2170 return result;
2171 }
2172
2173 refresh_sequence_number(domain, false);
2174
2175 for (i=0; i<num_rids; i++) {
2176 struct dom_sid sid;
2177 NTSTATUS status;
2178
2179 if (!sid_compose(&sid, domain_sid, rids[i])) {
2180 result = NT_STATUS_INTERNAL_ERROR;
2181 goto error;
2182 }
2183
2184 status = (*types)[i] == SID_NAME_UNKNOWN ?
2185 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2186
2187 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2188 (*names)[i], (*types)[i]);
2189 }
2190
2191 return result;
2192
2193 error:
2194 TALLOC_FREE(*names);
2195 TALLOC_FREE(*types);
2196 return result;
2197 }
2198
2199 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2200 TALLOC_CTX *mem_ctx,
2201 const struct dom_sid *user_sid,
2202 struct wbint_userinfo *info)
2203 {
2204 struct winbind_cache *cache = get_cache(domain);
2205 struct cache_entry *centry = NULL;
2206 NTSTATUS status;
2207 char *sid_string;
2208
2209 if (cache->tdb == NULL) {
2210 return NT_STATUS_NOT_FOUND;
2211 }
2212
2213 sid_string = sid_string_tos(user_sid);
2214 if (sid_string == NULL) {
2215 return NT_STATUS_NO_MEMORY;
2216 }
2217
2218 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2219 TALLOC_FREE(sid_string);
2220 if (centry == NULL) {
2221 return NT_STATUS_NOT_FOUND;
2222 }
2223
2224 /*
2225 * If we have an access denied cache entry and a cached info3
2226 * in the samlogon cache then do a query. This will force the
2227 * rpc back end to return the info3 data.
2228 */
2229
2230 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2231 netsamlogon_cache_have(user_sid)) {
2232 DEBUG(10, ("query_user: cached access denied and have cached "
2233 "info3\n"));
2234 domain->last_status = NT_STATUS_OK;
2235 centry_free(centry);
2236 return NT_STATUS_NOT_FOUND;
2237 }
2238
2239 /* if status is not ok then this is a negative hit
2240 and the rest of the data doesn't matter */
2241 status = centry->status;
2242 if (NT_STATUS_IS_OK(status)) {
2243 info->acct_name = centry_string(centry, mem_ctx);
2244 info->full_name = centry_string(centry, mem_ctx);
2245 info->homedir = centry_string(centry, mem_ctx);
2246 info->shell = centry_string(centry, mem_ctx);
2247 info->primary_gid = centry_uint32(centry);
2248 centry_sid(centry, &info->user_sid);
2249 centry_sid(centry, &info->group_sid);
2250 }
2251
2252 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2253 "%s\n", domain->name, nt_errstr(status) ));
2254
2255 centry_free(centry);
2256 return status;
2257 }
2258
2259 /* Lookup user information from a rid */
2260 static NTSTATUS query_user(struct winbindd_domain *domain,
2261 TALLOC_CTX *mem_ctx,
2262 const struct dom_sid *user_sid,
2263 struct wbint_userinfo *info)
2264 {
2265 NTSTATUS status;
2266 bool old_status;
2267
2268 old_status = domain->online;
2269 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2270 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2271 return status;
2272 }
2273
2274 ZERO_STRUCTP(info);
2275
2276 /* Return status value returned by seq number check */
2277
2278 if (!NT_STATUS_IS_OK(domain->last_status))
2279 return domain->last_status;
2280
2281 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2282 domain->name ));
2283
2284 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2285
2286 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2287 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2288 if (!domain->internal && old_status) {
2289 set_domain_offline(domain);
2290 }
2291 if (!domain->internal &&
2292 !domain->online &&
2293 old_status) {
2294 NTSTATUS cache_status;
2295 cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2296 return cache_status;
2297 }
2298 }
2299 /* and save it */
2300 refresh_sequence_number(domain, false);
2301 if (!NT_STATUS_IS_OK(status)) {
2302 return status;
2303 }
2304 wcache_save_user(domain, status, info);
2305
2306 return status;
2307 }
2308
2309 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2310 TALLOC_CTX *mem_ctx,
2311 const struct dom_sid *user_sid,
2312 uint32_t *pnum_sids,
2313 struct dom_sid **psids)
2314 {
2315 struct winbind_cache *cache = get_cache(domain);
2316 struct cache_entry *centry = NULL;
2317 NTSTATUS status;
2318 uint32_t i, num_sids;
2319 struct dom_sid *sids;
2320 fstring sid_string;
2321
2322 if (cache->tdb == NULL) {
2323 return NT_STATUS_NOT_FOUND;
2324 }
2325
2326 centry = wcache_fetch(cache, domain, "UG/%s",
2327 sid_to_fstring(sid_string, user_sid));
2328 if (centry == NULL) {
2329 return NT_STATUS_NOT_FOUND;
2330 }
2331
2332 /* If we have an access denied cache entry and a cached info3 in the
2333 samlogon cache then do a query. This will force the rpc back end
2334 to return the info3 data. */
2335
2336 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2337 && netsamlogon_cache_have(user_sid)) {
2338 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2339 "cached info3\n"));
2340 domain->last_status = NT_STATUS_OK;
2341 centry_free(centry);
2342 return NT_STATUS_NOT_FOUND;
2343 }
2344
2345 num_sids = centry_uint32(centry);
2346 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2347 if (sids == NULL) {
2348 centry_free(centry);
2349 return NT_STATUS_NO_MEMORY;
2350 }
2351
2352 for (i=0; i<num_sids; i++) {
2353 centry_sid(centry, &sids[i]);
2354 }
2355
2356 status = centry->status;
2357
2358 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2359 "status: %s\n", domain->name, nt_errstr(status)));
2360
2361 centry_free(centry);
2362
2363 *pnum_sids = num_sids;
2364 *psids = sids;
2365 return status;
2366 }
2367
2368 /* Lookup groups a user is a member of. */
2369 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2370 TALLOC_CTX *mem_ctx,
2371 const struct dom_sid *user_sid,
2372 uint32 *num_groups, struct dom_sid **user_gids)
2373 {
2374 struct cache_entry *centry = NULL;
2375 NTSTATUS status;
2376 unsigned int i;
2377 fstring sid_string;
2378 bool old_status;
2379
2380 old_status = domain->online;
2381 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2382 num_groups, user_gids);
2383 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2384 return status;
2385 }
2386
2387 (*num_groups) = 0;
2388 (*user_gids) = NULL;
2389
2390 /* Return status value returned by seq number check */
2391
2392 if (!NT_STATUS_IS_OK(domain->last_status))
2393 return domain->last_status;
2394
2395 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2396 domain->name ));
2397
2398 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2399
2400 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2401 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2402 if (!domain->internal && old_status) {
2403 set_domain_offline(domain);
2404 }
2405 if (!domain->internal &&
2406 !domain->online &&
2407 old_status) {
2408 NTSTATUS cache_status;
2409 cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2410 num_groups, user_gids);
2411 return cache_status;
2412 }
2413 }
2414 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2415 goto skip_save;
2416
2417 /* and save it */
2418 refresh_sequence_number(domain, false);
2419 if (!NT_STATUS_IS_OK(status)) {
2420 return status;
2421 }
2422 centry = centry_start(domain, status);
2423 if (!centry)
2424 goto skip_save;
2425
2426 centry_put_uint32(centry, *num_groups);
2427 for (i=0; i<(*num_groups); i++) {
2428 centry_put_sid(centry, &(*user_gids)[i]);
2429 }
2430
2431 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2432 centry_free(centry);
2433
2434 skip_save:
2435 return status;
2436 }
2437
2438 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2439 const struct dom_sid *sids)
2440 {
2441 uint32_t i;
2442 char *sidlist;
2443
2444 sidlist = talloc_strdup(mem_ctx, "");
2445 if (sidlist == NULL) {
2446 return NULL;
2447 }
2448 for (i=0; i<num_sids; i++) {
2449 fstring tmp;
2450 sidlist = talloc_asprintf_append_buffer(
2451 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2452 if (sidlist == NULL) {
2453 return NULL;
2454 }
2455 }
2456 return sidlist;
2457 }
2458
2459 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2460 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2461 const struct dom_sid *sids,
2462 uint32_t *pnum_aliases, uint32_t **paliases)
2463 {
2464 struct winbind_cache *cache = get_cache(domain);
2465 struct cache_entry *centry = NULL;
2466 uint32_t num_aliases;
2467 uint32_t *aliases;
2468 NTSTATUS status;
2469 char *sidlist;
2470 int i;
2471
2472 if (cache->tdb == NULL) {
2473 return NT_STATUS_NOT_FOUND;
2474 }
2475
2476 if (num_sids == 0) {
2477 *pnum_aliases = 0;
2478 *paliases = NULL;
2479 return NT_STATUS_OK;
2480 }
2481
2482 /* We need to cache indexed by the whole list of SIDs, the aliases
2483 * resulting might come from any of the SIDs. */
2484
2485 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2486 if (sidlist == NULL) {
2487 return NT_STATUS_NO_MEMORY;
2488 }
2489
2490 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2491 TALLOC_FREE(sidlist);
2492 if (centry == NULL) {
2493 return NT_STATUS_NOT_FOUND;
2494 }
2495
2496 num_aliases = centry_uint32(centry);
2497 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2498 if (aliases == NULL) {
2499 centry_free(centry);
2500 return NT_STATUS_NO_MEMORY;
2501 }
2502
2503 for (i=0; i<num_aliases; i++) {
2504 aliases[i] = centry_uint32(centry);
2505 }
2506
2507 status = centry->status;
2508
2509 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2510 "status %s\n", domain->name, nt_errstr(status)));
2511
2512 centry_free(centry);
2513
2514 *pnum_aliases = num_aliases;
2515 *paliases = aliases;
2516
2517 return status;
2518 }
2519
2520 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2521 TALLOC_CTX *mem_ctx,
2522 uint32 num_sids, const struct dom_sid *sids,
2523 uint32 *num_aliases, uint32 **alias_rids)
2524 {
2525 struct cache_entry *centry = NULL;
2526 NTSTATUS status;
2527 char *sidlist;
2528 int i;
2529 bool old_status;
2530
2531 old_status = domain->online;
2532 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2533 num_aliases, alias_rids);
2534 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2535 return status;
2536 }
2537
2538 (*num_aliases) = 0;
2539 (*alias_rids) = NULL;
2540
2541 if (!NT_STATUS_IS_OK(domain->last_status))
2542 return domain->last_status;
2543
2544 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2545 "for domain %s\n", domain->name ));
2546
2547 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2548 if (sidlist == NULL) {
2549 return NT_STATUS_NO_MEMORY;
2550 }
2551
2552 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2553 num_sids, sids,
2554 num_aliases, alias_rids);
2555
2556 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2557 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2558 if (!domain->internal && old_status) {
2559 set_domain_offline(domain);
2560 }
2561 if (!domain->internal &&
2562 !domain->online &&
2563 old_status) {
2564 NTSTATUS cache_status;
2565 cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2566 sids, num_aliases, alias_rids);
2567 return cache_status;
2568 }
2569 }
2570 /* and save it */
2571 refresh_sequence_number(domain, false);
2572 if (!NT_STATUS_IS_OK(status)) {
2573 return status;
2574 }
2575 centry = centry_start(domain, status);
2576 if (!centry)
2577 goto skip_save;
2578 centry_put_uint32(centry, *num_aliases);
2579 for (i=0; i<(*num_aliases); i++)
2580 centry_put_uint32(centry, (*alias_rids)[i]);
2581 centry_end(centry, "UA%s", sidlist);
2582 centry_free(centry);
2583
2584 skip_save:
2585 return status;
2586 }
2587
2588 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2589 TALLOC_CTX *mem_ctx,
2590 const struct dom_sid *group_sid,
2591 uint32_t *num_names,
2592 struct dom_sid **sid_mem, char ***names,
2593 uint32_t **name_types)
2594 {
2595 struct winbind_cache *cache = get_cache(domain);
2596 struct cache_entry *centry = NULL;
2597 NTSTATUS status;
2598 unsigned int i;
2599 char *sid_string;
2600
2601 if (cache->tdb == NULL) {
2602 return NT_STATUS_NOT_FOUND;
2603 }
2604
2605 sid_string = sid_string_tos(group_sid);
2606 if (sid_string == NULL) {
2607 return NT_STATUS_NO_MEMORY;
2608 }
2609
2610 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2611 TALLOC_FREE(sid_string);
2612 if (centry == NULL) {
2613 return NT_STATUS_NOT_FOUND;
2614 }
2615
2616 *sid_mem = NULL;
2617 *names = NULL;
2618 *name_types = NULL;
2619
2620 *num_names = centry_uint32(centry);
2621 if (*num_names == 0) {
2622 centry_free(centry);
2623 return NT_STATUS_OK;
2624 }
2625
2626 *sid_mem = talloc_array(mem_ctx, struct dom_sid, *num_names);
2627 *names = talloc_array(mem_ctx, char *, *num_names);
2628 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2629
2630 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2631 TALLOC_FREE(*sid_mem);
2632 TALLOC_FREE(*names);
2633 TALLOC_FREE(*name_types);
2634 centry_free(centry);
2635 return NT_STATUS_NO_MEMORY;
2636 }
2637
2638 for (i=0; i<(*num_names); i++) {
2639 centry_sid(centry, &(*sid_mem)[i]);
2640 (*names)[i] = centry_string(centry, mem_ctx);
2641 (*name_types)[i] = centry_uint32(centry);
2642 }
2643
2644 status = centry->status;
2645
2646 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2647 "status: %s\n", domain->name, nt_errstr(status)));
2648
2649 centry_free(centry);
2650 return status;
2651 }
2652
2653 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2654 TALLOC_CTX *mem_ctx,
2655 const struct dom_sid *group_sid,
2656 enum lsa_SidType type,
2657 uint32 *num_names,
2658 struct dom_sid **sid_mem, char ***names,
2659 uint32 **name_types)
2660 {
2661 struct cache_entry *centry = NULL;
2662 NTSTATUS status;
2663 unsigned int i;
2664 fstring sid_string;
2665 bool old_status;
2666
2667 old_status = domain->online;
2668 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2669 sid_mem, names, name_types);
2670 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2671 return status;
2672 }
2673
2674 (*num_names) = 0;
2675 (*sid_mem) = NULL;
2676 (*names) = NULL;
2677 (*name_types) = NULL;
2678
2679 /* Return status value returned by seq number check */
2680
2681 if (!NT_STATUS_IS_OK(domain->last_status))
2682 return domain->last_status;
2683
2684 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2685 domain->name ));
2686
2687 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2688 type, num_names,
2689 sid_mem, names, name_types);
2690
2691 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2692 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2693 if (!domain->internal && old_status) {
2694 set_domain_offline(domain);
2695 }
2696 if (!domain->internal &&
2697 !domain->online &&
2698 old_status) {
2699 NTSTATUS cache_status;
2700 cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2701 num_names, sid_mem, names,
2702 name_types);
2703 return cache_status;
2704 }
2705 }
2706 /* and save it */
2707 refresh_sequence_number(domain, false);
2708 if (!NT_STATUS_IS_OK(status)) {
2709 return status;
2710 }
2711 centry = centry_start(domain, status);
2712 if (!centry)
2713 goto skip_save;
2714 centry_put_uint32(centry, *num_names);
2715 for (i=0; i<(*num_names); i++) {
2716 centry_put_sid(centry, &(*sid_mem)[i]);
2717 centry_put_string(centry, (*names)[i]);
2718 centry_put_uint32(centry, (*name_types)[i]);
2719 }
2720 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2721 centry_free(centry);
2722
2723 skip_save:
2724 return status;
2725 }
2726
2727 /* find the sequence number for a domain */
2728 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2729 {
2730 refresh_sequence_number(domain, false);
2731
2732 *seq = domain->sequence_number;
2733
2734 return NT_STATUS_OK;
2735 }
2736
2737 /* enumerate trusted domains
2738 * (we need to have the list of trustdoms in the cache when we go offline) -
2739 * Guenther */
2740 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2741 TALLOC_CTX *mem_ctx,
2742 struct netr_DomainTrustList *trusts)
2743 {
2744 NTSTATUS status;
2745 struct winbind_cache *cache;
2746 struct winbindd_tdc_domain *dom_list = NULL;
2747 size_t num_domains = 0;
2748 bool retval = false;
2749 int i;
2750 bool old_status;
2751
2752 old_status = domain->online;
2753 trusts->count = 0;
2754 trusts->array = NULL;
2755
2756 cache = get_cache(domain);
2757 if (!cache || !cache->tdb) {
2758 goto do_query;
2759 }
2760
2761 if (domain->online) {
2762 goto do_query;
2763 }
2764
2765 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2766 if (!retval || !num_domains || !dom_list) {
2767 TALLOC_FREE(dom_list);
2768 goto do_query;
2769 }
2770
2771 do_fetch_cache:
2772 trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
2773 if (!trusts->array) {
2774 TALLOC_FREE(dom_list);
2775 return NT_STATUS_NO_MEMORY;
2776 }
2777
2778 for (i = 0; i < num_domains; i++) {
2779 struct netr_DomainTrust *trust;
2780 struct dom_sid *sid;
2781 struct winbindd_domain *dom;
2782
2783 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2784 if (dom && dom->internal) {
2785 continue;
2786 }
2787
2788 trust = &trusts->array[trusts->count];
2789 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2790 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2791 sid = talloc(trusts->array, struct dom_sid);
2792 if (!trust->netbios_name || !trust->dns_name ||
2793 !sid) {
2794 TALLOC_FREE(dom_list);
2795 TALLOC_FREE(trusts->array);
2796 return NT_STATUS_NO_MEMORY;
2797 }
2798
2799 trust->trust_flags = dom_list[i].trust_flags;
2800 trust->trust_attributes = dom_list[i].trust_attribs;
2801 trust->trust_type = dom_list[i].trust_type;
2802 sid_copy(sid, &dom_list[i].sid);
2803 trust->sid = sid;
2804 trusts->count++;
2805 }
2806
2807 TALLOC_FREE(dom_list);
2808 return NT_STATUS_OK;
2809
2810 do_query:
2811 /* Return status value returned by seq number check */
2812
2813 if (!NT_STATUS_IS_OK(domain->last_status))
2814 return domain->last_status;
2815
2816 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2817 domain->name ));
2818
2819 status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2820
2821 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2822 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2823 if (!domain->internal && old_status) {
2824 set_domain_offline(domain);
2825 }
2826 if (!domain->internal &&
2827 !domain->online &&
2828 old_status) {
2829 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2830 if (retval && num_domains && dom_list) {
2831 TALLOC_FREE(trusts->array);
2832 trusts->count = 0;
2833 goto do_fetch_cache;
2834 }
2835 }
2836 }
2837 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2838 * so that the generic centry handling still applies correctly -
2839 * Guenther*/
2840
2841 if (!NT_STATUS_IS_ERR(status)) {
2842 status = NT_STATUS_OK;
2843 }
2844 return status;
2845 }
2846
2847 /* get lockout policy */
2848 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2849 TALLOC_CTX *mem_ctx,
2850 struct samr_DomInfo12 *policy)
2851 {
2852 struct winbind_cache *cache = get_cache(domain);
2853 struct cache_entry *centry = NULL;
2854 NTSTATUS status;
2855 bool old_status;
2856
2857 old_status = domain->online;
2858 if (!cache->tdb)
2859 goto do_query;
2860
2861 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2862
2863 if (!centry)
2864 goto do_query;
2865
2866 do_fetch_cache:
2867 policy->lockout_duration = centry_nttime(centry);
2868 policy->lockout_window = centry_nttime(centry);
2869 policy->lockout_threshold = centry_uint16(centry);
2870
2871 status = centry->status;
2872
2873 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2874 domain->name, nt_errstr(status) ));
2875
2876 centry_free(centry);
2877 return status;
2878
2879 do_query:
2880 ZERO_STRUCTP(policy);
2881
2882 /* Return status value returned by seq number check */
2883
2884 if (!NT_STATUS_IS_OK(domain->last_status))
2885 return domain->last_status;
2886
2887 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2888 domain->name ));
2889
2890 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2891
2892 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2893 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2894 if (!domain->internal && old_status) {
2895 set_domain_offline(domain);
2896 }
2897 if (cache->tdb &&
2898 !domain->internal &&
2899 !domain->online &&
2900 old_status) {
2901 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2902 if (centry) {
2903 goto do_fetch_cache;
2904 }
2905 }
2906 }
2907 /* and save it */
2908 refresh_sequence_number(domain, false);
2909 if (!NT_STATUS_IS_OK(status)) {
2910 return status;
2911 }
2912 wcache_save_lockout_policy(domain, status, policy);
2913
2914 return status;
2915 }
2916
2917 /* get password policy */
2918 static NTSTATUS password_policy(struct winbindd_domain *domain,
2919 TALLOC_CTX *mem_ctx,
2920 struct samr_DomInfo1 *policy)
2921 {
2922 struct winbind_cache *cache = get_cache(domain);
2923 struct cache_entry *centry = NULL;
2924 NTSTATUS status;
2925 bool old_status;
2926
2927 old_status = domain->online;
2928 if (!cache->tdb)
2929 goto do_query;
2930
2931 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2932
2933 if (!centry)
2934 goto do_query;
2935
2936 do_fetch_cache:
2937 policy->min_password_length = centry_uint16(centry);
2938 policy->password_history_length = centry_uint16(centry);
2939 policy->password_properties = centry_uint32(centry);
2940 policy->max_password_age = centry_nttime(centry);
2941 policy->min_password_age = centry_nttime(centry);
2942
2943 status = centry->status;
2944
2945 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2946 domain->name, nt_errstr(status) ));
2947
2948 centry_free(centry);
2949 return status;
2950
2951 do_query:
2952 ZERO_STRUCTP(policy);
2953
2954 /* Return status value returned by seq number check */
2955
2956 if (!NT_STATUS_IS_OK(domain->last_status))
2957 return domain->last_status;
2958
2959 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2960 domain->name ));
2961
2962 status = domain->backend->password_policy(domain, mem_ctx, policy);
2963
2964 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2965 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2966 if (!domain->internal && old_status) {
2967 set_domain_offline(domain);
2968 }
2969 if (cache->tdb &&
2970 !domain->internal &&
2971 !domain->online &&
2972 old_status) {
2973 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2974 if (centry) {
2975 goto do_fetch_cache;
2976 }
2977 }
2978 }
2979 /* and save it */
2980 refresh_sequence_number(domain, false);
2981 if (!NT_STATUS_IS_OK(status)) {
2982 return status;
2983 }
2984 wcache_save_password_policy(domain, status, policy);
2985
2986 return status;
2987 }
2988
2989
2990 /* Invalidate cached user and group lists coherently */
2991
2992 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2993 void *state)
2994 {
2995 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2996 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2997 tdb_delete(the_tdb, kbuf);
2998
2999 return 0;
3000 }
3001
3002 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
3003
3004 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
3005 const struct dom_sid *sid)
3006 {
3007 fstring key_str, sid_string;
3008 struct winbind_cache *cache;
3009
3010 /* dont clear cached U/SID and UG/SID entries when we want to logon
3011 * offline - gd */
3012
3013 if (lp_winbind_offline_logon()) {
3014 return;
3015 }
3016
3017 if (!domain)
3018 return;
3019
3020 cache = get_cache(domain);
3021
3022 if (!cache->tdb) {
3023 return;
3024 }
3025
3026 /* Clear U/SID cache entry */
3027 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, sid));
3028 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3029 tdb_delete(cache->tdb, string_tdb_data(key_str));
3030
3031 /* Clear UG/SID cache entry */
3032 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, sid));
3033 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3034 tdb_delete(cache->tdb, string_tdb_data(key_str));
3035
3036 /* Samba/winbindd never needs this. */
3037 netsamlogon_clear_cached_user(sid);
3038 }
3039
3040 bool wcache_invalidate_cache(void)
3041 {
3042 struct winbindd_domain *domain;
3043
3044 for (domain = domain_list(); domain; domain = domain->next) {
3045 struct winbind_cache *cache = get_cache(domain);
3046
3047 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3048 "entries for %s\n", domain->name));
3049 if (cache) {
3050 if (cache->tdb) {
3051 tdb_traverse(cache->tdb, traverse_fn, NULL);
3052 } else {
3053 return false;
3054 }
3055 }
3056 }
3057 return true;
3058 }
3059
3060 bool wcache_invalidate_cache_noinit(void)
3061 {
3062 struct winbindd_domain *domain;
3063
3064 for (domain = domain_list(); domain; domain = domain->next) {
3065 struct winbind_cache *cache;
3066
3067 /* Skip uninitialized domains. */
3068 if (!domain->initialized && !domain->internal) {
3069 continue;
3070 }
3071
3072 cache = get_cache(domain);
3073
3074 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3075 "entries for %s\n", domain->name));
3076 if (cache) {
3077 if (cache->tdb) {
3078 tdb_traverse(cache->tdb, traverse_fn, NULL);
3079 /*
3080 * Flushing cache has nothing to with domains.
3081 * return here if we successfully flushed once.
3082 * To avoid unnecessary traversing the cache.
3083 */
3084 return true;
3085 } else {
3086 return false;
3087 }
3088 }
3089 }
3090 return true;
3091 }
3092
3093 bool init_wcache(void)
3094 {
3095 if (wcache == NULL) {
3096 wcache = SMB_XMALLOC_P(struct winbind_cache);
3097 ZERO_STRUCTP(wcache);
3098 }
3099
3100 if (wcache->tdb != NULL)
3101 return true;
3102
3103 /* when working offline we must not clear the cache on restart */
3104 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3105 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3106 TDB_INCOMPATIBLE_HASH |
3107 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3108 O_RDWR|O_CREAT, 0600);
3109
3110 if (wcache->tdb == NULL) {
3111 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3112 return false;
3113 }
3114
3115 return true;
3116 }
3117
3118 /************************************************************************
3119 This is called by the parent to initialize the cache file.
3120 We don't need sophisticated locking here as we know we're the
3121 only opener.
3122 ************************************************************************/
3123
3124 bool initialize_winbindd_cache(void)
3125 {
3126 bool cache_bad = true;
3127 uint32 vers;
3128
3129 if (!init_wcache()) {
3130 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3131 return false;
3132 }
3133
3134 /* Check version number. */
3135 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3136 vers == WINBINDD_CACHE_VERSION) {
3137 cache_bad = false;
3138 }
3139
3140 if (cache_bad) {
3141 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3142 "and re-creating with version number %d\n",
3143 WINBINDD_CACHE_VERSION ));
3144
3145 tdb_close(wcache->tdb);
3146 wcache->tdb = NULL;
3147
3148 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
3149 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3150 cache_path("winbindd_cache.tdb"),
3151 strerror(errno) ));
3152 return false;
3153 }
3154 if (!init_wcache()) {
3155 DEBUG(0,("initialize_winbindd_cache: re-initialization "
3156 "init_wcache failed.\n"));
3157 return false;
3158 }
3159
3160 /* Write the version. */
3161 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3162 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3163 tdb_errorstr(wcache->tdb) ));
3164 return false;
3165 }
3166 }
3167
3168 tdb_close(wcache->tdb);
3169 wcache->tdb = NULL;
3170 return true;
3171 }
3172
3173 void close_winbindd_cache(void)
3174 {
3175 if (!wcache) {
3176 return;
3177 }
3178 if (wcache->tdb) {
3179 tdb_close(wcache->tdb);
3180 wcache->tdb = NULL;
3181 }
3182 }
3183
3184 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
3185 char **domain_name, char **name,
3186 enum lsa_SidType *type)
3187 {
3188 struct winbindd_domain *domain;
3189 NTSTATUS status;
3190
3191 domain = find_lookup_domain_from_sid(sid);
3192 if (domain == NULL) {
3193 return false;
3194 }
3195 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3196 type);
3197 return NT_STATUS_IS_OK(status);
3198 }
3199
3200 bool lookup_cached_name(const char *domain_name,
3201 const char *name,
3202 struct dom_sid *sid,
3203 enum lsa_SidType *type)
3204 {
3205 struct winbindd_domain *domain;
3206 NTSTATUS status;
3207 bool original_online_state;
3208
3209 domain = find_lookup_domain_from_name(domain_name);
3210 if (domain == NULL) {
3211 return false;
3212 }
3213
3214 /* If we are doing a cached logon, temporarily set the domain
3215 offline so the cache won't expire the entry */
3216
3217 original_online_state = domain->online;
3218 domain->online = false;
3219 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3220 domain->online = original_online_state;
3221
3222 return NT_STATUS_IS_OK(status);
3223 }
3224
3225 void cache_name2sid(struct winbindd_domain *domain,
3226 const char *domain_name, const char *name,
3227 enum lsa_SidType type, const struct dom_sid *sid)
3228 {
3229 refresh_sequence_number(domain, false);
3230 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3231 sid, type);
3232 }
3233
3234 /*
3235 * The original idea that this cache only contains centries has
3236 * been blurred - now other stuff gets put in here. Ensure we
3237 * ignore these things on cleanup.
3238 */
3239
3240 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3241 TDB_DATA dbuf, void *state)
3242 {
3243 struct cache_entry *centry;
3244
3245 if (is_non_centry_key(kbuf)) {
3246 return 0;
3247 }
3248
3249 centry = wcache_fetch_raw((char *)kbuf.dptr);
3250 if (!centry) {
3251 return 0;
3252 }
3253
3254 if (!NT_STATUS_IS_OK(centry->status)) {
3255 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3256 tdb_delete(the_tdb, kbuf);
3257 }
3258
3259 centry_free(centry);
3260 return 0;
3261 }
3262
3263 /* flush the cache */
3264 void wcache_flush_cache(void)
3265 {
3266 if (!wcache)
3267 return;
3268 if (wcache->tdb) {
3269 tdb_close(wcache->tdb);
3270 wcache->tdb = NULL;
3271 }
3272 if (!winbindd_use_cache()) {
3273 return;
3274 }
3275
3276 /* when working offline we must not clear the cache on restart */
3277 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3278 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3279 TDB_INCOMPATIBLE_HASH |
3280 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3281 O_RDWR|O_CREAT, 0600);
3282
3283 if (!wcache->tdb) {
3284 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3285 return;
3286 }
3287
3288 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3289
3290 DEBUG(10,("wcache_flush_cache success\n"));
3291 }
3292
3293 /* Count cached creds */
3294
3295 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3296 void *state)
3297 {
3298 int *cred_count = (int*)state;
3299
3300 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3301 (*cred_count)++;
3302 }
3303 return 0;
3304 }
3305
3306 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3307 {
3308 struct winbind_cache *cache = get_cache(domain);
3309
3310 *count = 0;
3311
3312 if (!cache->tdb) {
3313 return NT_STATUS_INTERNAL_DB_ERROR;
3314 }
3315
3316 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3317
3318 return NT_STATUS_OK;
3319 }
3320
3321 struct cred_list {
3322 struct cred_list *prev, *next;
3323 TDB_DATA key;
3324 fstring name;
3325 time_t created;
3326 };
3327 static struct cred_list *wcache_cred_list;
3328
3329 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3330 void *state)
3331 {
3332 struct cred_list *cred;
3333
3334 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3335
3336 cred = SMB_MALLOC_P(struct cred_list);
3337 if (cred == NULL) {
3338 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3339 return -1;
3340 }
3341
3342 ZERO_STRUCTP(cred);
3343
3344 /* save a copy of the key */
3345
3346 fstrcpy(cred->name, (const char *)kbuf.dptr);
3347 DLIST_ADD(wcache_cred_list, cred);
3348 }
3349
3350 return 0;
3351 }
3352
3353 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const struct dom_sid *sid)
3354 {
3355 struct winbind_cache *cache = get_cache(domain);
3356 NTSTATUS status;
3357 int ret;
3358 struct cred_list *cred, *oldest = NULL;
3359
3360 if (!cache->tdb) {
3361 return NT_STATUS_INTERNAL_DB_ERROR;
3362 }
3363
3364 /* we possibly already have an entry */
3365 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3366
3367 fstring key_str, tmp;
3368
3369 DEBUG(11,("we already have an entry, deleting that\n"));
3370
3371 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3372
3373 tdb_delete(cache->tdb, string_tdb_data(key_str));
3374
3375 return NT_STATUS_OK;
3376 }
3377
3378 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3379 if (ret == 0) {
3380 return NT_STATUS_OK;
3381 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3382 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3383 }
3384
3385 ZERO_STRUCTP(oldest);
3386
3387 for (cred = wcache_cred_list; cred; cred = cred->next) {
3388
3389 TDB_DATA data;
3390 time_t t;
3391
3392 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3393 if (!data.dptr) {
3394 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3395 cred->name));
3396 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3397 goto done;
3398 }
3399
3400 t = IVAL(data.dptr, 0);
3401 SAFE_FREE(data.dptr);
3402
3403 if (!oldest) {
3404 oldest = SMB_MALLOC_P(struct cred_list);
3405 if (oldest == NULL) {
3406 status = NT_STATUS_NO_MEMORY;
3407 goto done;
3408 }
3409
3410 fstrcpy(oldest->name, cred->name);
3411 oldest->created = t;
3412 continue;
3413 }
3414
3415 if (t < oldest->created) {
3416 fstrcpy(oldest->name, cred->name);
3417 oldest->created = t;
3418 }
3419 }
3420
3421 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3422 status = NT_STATUS_OK;
3423 } else {
3424 status = NT_STATUS_UNSUCCESSFUL;
3425 }
3426 done:
3427 SAFE_FREE(wcache_cred_list);
3428 SAFE_FREE(oldest);
3429
3430 return status;
3431 }
3432
3433 /* Change the global online/offline state. */
3434 bool set_global_winbindd_state_offline(void)
3435 {
3436 TDB_DATA data;
3437
3438 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3439
3440 /* Only go offline if someone has created
3441 the key "WINBINDD_OFFLINE" in the cache tdb. */
3442
3443 if (wcache == NULL || wcache->tdb == NULL) {
3444 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3445 return false;
3446 }
3447
3448 if (!lp_winbind_offline_logon()) {
3449 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3450 return false;
3451 }
3452
3453 if (global_winbindd_offline_state) {
3454 /* Already offline. */
3455 return true;
3456 }
3457
3458 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3459
3460 if (!data.dptr || data.dsize != 4) {
3461 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3462 SAFE_FREE(data.dptr);
3463 return false;
3464 } else {
3465 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3466 global_winbindd_offline_state = true;
3467 SAFE_FREE(data.dptr);
3468 return true;
3469 }
3470 }
3471
3472 void set_global_winbindd_state_online(void)
3473 {
3474 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3475
3476 if (!lp_winbind_offline_logon()) {
3477 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3478 return;
3479 }
3480
3481 if (!global_winbindd_offline_state) {
3482 /* Already online. */
3483 return;
3484 }
3485 global_winbindd_offline_state = false;
3486
3487 if (!wcache->tdb) {
3488 return;
3489 }
3490
3491 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3492 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3493 }
3494
3495 bool get_global_winbindd_state_offline(void)
3496 {
3497 return global_winbindd_offline_state;
3498 }
3499
3500 /***********************************************************************
3501 Validate functions for all possible cache tdb keys.
3502 ***********************************************************************/
3503
3504 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3505 struct tdb_validation_status *state)
3506 {
3507 struct cache_entry *centry;
3508
3509 centry = SMB_XMALLOC_P(struct cache_entry);
3510 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3511 if (!centry->data) {
3512 SAFE_FREE(centry);
3513 return NULL;
3514 }
3515 centry->len = data.dsize;
3516 centry->ofs = 0;
3517
3518 if (centry->len < 16) {
3519 /* huh? corrupt cache? */
3520 DEBUG(0,("create_centry_validate: Corrupt cache for key %s "
3521 "(len < 16) ?\n", kstr));
3522 centry_free(centry);
3523 state->bad_entry = true;
3524 state->success = false;
3525 return NULL;
3526 }
3527
3528 centry->status = NT_STATUS(centry_uint32(centry));
3529 centry->sequence_number = centry_uint32(centry);
3530 centry->timeout = centry_uint64_t(centry);
3531 return centry;
3532 }
3533
3534 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3535 struct tdb_validation_status *state)
3536 {
3537 if (dbuf.dsize != 8) {
3538 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3539 keystr, (unsigned int)dbuf.dsize ));
3540 state->bad_entry = true;
3541 return 1;
3542 }
3543 return 0;
3544 }
3545
3546 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3547 struct tdb_validation_status *state)
3548 {
3549 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3550 if (!centry) {
3551 return 1;
3552 }
3553
3554 (void)centry_uint32(centry);
3555 if (NT_STATUS_IS_OK(centry->status)) {
3556 struct dom_sid sid;
3557 (void)centry_sid(centry, &sid);
3558 }
3559
3560 centry_free(centry);
3561
3562 if (!(state->success)) {
3563 return 1;
3564 }
3565 DEBUG(10,("validate_ns: %s ok\n", keystr));
3566 return 0;
3567 }
3568
3569 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3570 struct tdb_validation_status *state)
3571 {
3572 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3573 if (!centry) {
3574 return 1;
3575 }
3576
3577 if (NT_STATUS_IS_OK(centry->status)) {
3578 (void)centry_uint32(centry);
3579 (void)centry_string(centry, mem_ctx);
3580 (void)centry_string(centry, mem_ctx);
3581 }
3582
3583 centry_free(centry);
3584
3585 if (!(state->success)) {
3586 return 1;
3587 }
3588 DEBUG(10,("validate_sn: %s ok\n", keystr));
3589 return 0;
3590 }
3591
3592 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3593 struct tdb_validation_status *state)
3594 {
3595 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3596 struct dom_sid sid;
3597
3598 if (!centry) {
3599 return 1;
3600 }
3601
3602 (void)centry_string(centry, mem_ctx);
3603 (void)centry_string(centry, mem_ctx);
3604 (void)centry_string(centry, mem_ctx);
3605 (void)centry_string(centry, mem_ctx);
3606 (void)centry_uint32(centry);
3607 (void)centry_sid(centry, &sid);
3608 (void)centry_sid(centry, &sid);
3609
3610 centry_free(centry);
3611
3612 if (!(state->success)) {
3613 return 1;
3614 }
3615 DEBUG(10,("validate_u: %s ok\n", keystr));
3616 return 0;
3617 }
3618
3619 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3620 struct tdb_validation_status *state)
3621 {
3622 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3623
3624 if (!centry) {
3625 return 1;
3626 }
3627
3628 (void)centry_nttime(centry);
3629 (void)centry_nttime(centry);
3630 (void)centry_uint16(centry);
3631
3632 centry_free(centry);
3633
3634 if (!(state->success)) {
3635 return 1;
3636 }
3637 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3638 return 0;
3639 }
3640
3641 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3642 struct tdb_validation_status *state)
3643 {
3644 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3645
3646 if (!centry) {
3647 return 1;
3648 }
3649
3650 (void)centry_uint16(centry);
3651 (void)centry_uint16(centry);
3652 (void)centry_uint32(centry);
3653 (void)centry_nttime(centry);
3654 (void)centry_nttime(centry);
3655
3656 centry_free(centry);
3657
3658 if (!(state->success)) {
3659 return 1;
3660 }
3661 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3662 return 0;
3663 }
3664
3665 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3666 struct tdb_validation_status *state)
3667 {
3668 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3669
3670 if (!centry) {
3671 return 1;
3672 }
3673
3674 (void)centry_time(centry);
3675 (void)centry_hash16(centry, mem_ctx);
3676
3677 /* We only have 17 bytes more data in the salted cred case. */
3678 if (centry->len - centry->ofs == 17) {
3679 (void)centry_hash16(centry, mem_ctx);
3680 }
3681
3682 centry_free(centry);
3683
3684 if (!(state->success)) {
3685 return 1;
3686 }
3687 DEBUG(10,("validate_cred: %s ok\n", keystr));
3688 return 0;
3689 }
3690
3691 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3692 struct tdb_validation_status *state)
3693 {
3694 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3695 int32 num_entries, i;
3696
3697 if (!centry) {
3698 return 1;
3699 }
3700
3701 num_entries = (int32)centry_uint32(centry);
3702
3703 for (i=0; i< num_entries; i++) {
3704 struct dom_sid sid;
3705 (void)centry_string(centry, mem_ctx);
3706 (void)centry_string(centry, mem_ctx);
3707 (void)centry_string(centry, mem_ctx);
3708 (void)centry_string(centry, mem_ctx);
3709 (void)centry_sid(centry, &sid);
3710 (void)centry_sid(centry, &sid);
3711 }
3712
3713 centry_free(centry);
3714
3715 if (!(state->success)) {
3716 return 1;
3717 }
3718 DEBUG(10,("validate_ul: %s ok\n", keystr));
3719 return 0;
3720 }
3721
3722 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3723 struct tdb_validation_status *state)
3724 {
3725 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3726 int32 num_entries, i;
3727
3728 if (!centry) {
3729 return 1;
3730 }
3731
3732 num_entries = centry_uint32(centry);
3733
3734 for (i=0; i< num_entries; i++) {
3735 (void)centry_string(centry, mem_ctx);
3736 (void)centry_string(centry, mem_ctx);
3737 (void)centry_uint32(centry);
3738 }
3739
3740 centry_free(centry);
3741
3742 if (!(state->success)) {
3743 return 1;
3744 }
3745 DEBUG(10,("validate_gl: %s ok\n", keystr));
3746 return 0;
3747 }
3748
3749 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3750 struct tdb_validation_status *state)
3751 {
3752 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3753 int32 num_groups, i;
3754
3755 if (!centry) {
3756 return 1;
3757 }
3758
3759 num_groups = centry_uint32(centry);
3760
3761 for (i=0; i< num_groups; i++) {
3762 struct dom_sid sid;
3763 centry_sid(centry, &sid);
3764 }
3765
3766 centry_free(centry);
3767
3768 if (!(state->success)) {
3769 return 1;
3770 }
3771 DEBUG(10,("validate_ug: %s ok\n", keystr));
3772 return 0;
3773 }
3774
3775 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3776 struct tdb_validation_status *state)
3777 {
3778 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3779 int32 num_aliases, i;
3780
3781 if (!centry) {
3782 return 1;
3783 }
3784
3785 num_aliases = centry_uint32(centry);
3786
3787 for (i=0; i < num_aliases; i++) {
3788 (void)centry_uint32(centry);
3789 }
3790
3791 centry_free(centry);
3792
3793 if (!(state->success)) {
3794 return 1;
3795 }
3796 DEBUG(10,("validate_ua: %s ok\n", keystr));
3797 return 0;
3798 }
3799
3800 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3801 struct tdb_validation_status *state)
3802 {
3803 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3804 int32 num_names, i;
3805
3806 if (!centry) {
3807 return 1;
3808 }
3809
3810 num_names = centry_uint32(centry);
3811
3812 for (i=0; i< num_names; i++) {
3813 struct dom_sid sid;
3814 centry_sid(centry, &sid);
3815 (void)centry_string(centry, mem_ctx);
3816 (void)centry_uint32(centry);
3817 }
3818
3819 centry_free(centry);
3820
3821 if (!(state->success)) {
3822 return 1;
3823 }
3824 DEBUG(10,("validate_gm: %s ok\n", keystr));
3825 return 0;
3826 }
3827
3828 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3829 struct tdb_validation_status *state)
3830 {
3831 /* Can't say anything about this other than must be nonzero. */
3832 if (dbuf.dsize == 0) {
3833 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3834 keystr));
3835 state->bad_entry = true;
3836 state->success = false;
3837 return 1;
3838 }
3839
3840 DEBUG(10,("validate_dr: %s ok\n", keystr));
3841 return 0;
3842 }
3843
3844 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3845 struct tdb_validation_status *state)
3846 {
3847 /* Can't say anything about this other than must be nonzero. */
3848 if (dbuf.dsize == 0) {
3849 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3850 keystr));
3851 state->bad_entry = true;
3852 state->success = false;
3853 return 1;
3854 }
3855
3856 DEBUG(10,("validate_de: %s ok\n", keystr));
3857 return 0;
3858 }
3859
3860 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3861 TDB_DATA dbuf, struct tdb_validation_status *state)
3862 {
3863 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3864
3865 if (!centry) {
3866 return 1;
3867 }
3868
3869 (void)centry_string(centry, mem_ctx);
3870 (void)centry_string(centry, mem_ctx);
3871 (void)centry_string(centry, mem_ctx);
3872 (void)centry_uint32(centry);
3873
3874 centry_free(centry);
3875
3876 if (!(state->success)) {
3877 return 1;
3878 }
3879 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3880 return 0;
3881 }
3882
3883 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3884 TDB_DATA dbuf,
3885 struct tdb_validation_status *state)
3886 {
3887 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3888
3889 if (!centry) {
3890 return 1;
3891 }
3892
3893 (void)centry_string( centry, mem_ctx );
3894
3895 centry_free(centry);
3896
3897 if (!(state->success)) {
3898 return 1;
3899 }
3900 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3901 return 0;
3902 }
3903
3904 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3905 TDB_DATA dbuf,
3906 struct tdb_validation_status *state)
3907 {
3908 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3909
3910 if (!centry) {
3911 return 1;
3912 }
3913
3914 (void)centry_string( centry, mem_ctx );
3915
3916 centry_free(centry);
3917
3918 if (!(state->success)) {
3919 return 1;
3920 }
3921 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3922 return 0;
3923 }
3924
3925 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3926 TDB_DATA dbuf,
3927 struct tdb_validation_status *state)
3928 {
3929 if (dbuf.dsize == 0) {
3930 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3931 "key %s (len ==0) ?\n", keystr));
3932 state->bad_entry = true;
3933 state->success = false;
3934 return 1;
3935 }
3936
3937 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3938 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3939 return 0;
3940 }
3941
3942 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3943 struct tdb_validation_status *state)
3944 {
3945 if (dbuf.dsize != 4) {
3946 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3947 keystr, (unsigned int)dbuf.dsize ));
3948 state->bad_entry = true;
3949 state->success = false;
3950 return 1;
3951 }
3952 DEBUG(10,("validate_offline: %s ok\n", keystr));
3953 return 0;
3954 }
3955
3956 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3957 struct tdb_validation_status *state)
3958 {
3959 /*
3960 * Ignore validation for now. The proper way to do this is with a
3961 * checksum. Just pure parsing does not really catch much.
3962 */
3963 return 0;
3964 }
3965
3966 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3967 struct tdb_validation_status *state)
3968 {
3969 if (dbuf.dsize != 4) {
3970 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3971 "key %s (len %u != 4) ?\n",
3972 keystr, (unsigned int)dbuf.dsize));
3973 state->bad_entry = true;
3974 state->success = false;
3975 return 1;
3976 }
3977
3978 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3979 return 0;
3980 }
3981
3982 /***********************************************************************
3983 A list of all possible cache tdb keys with associated validation
3984 functions.
3985 ***********************************************************************/
3986
3987 struct key_val_struct {
3988 const char *keyname;
3989 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3990 } key_val[] = {
3991 {"SEQNUM/", validate_seqnum},
3992 {"NS/", validate_ns},
3993 {"SN/", validate_sn},
3994 {"U/", validate_u},
3995 {"LOC_POL/", validate_loc_pol},
3996 {"PWD_POL/", validate_pwd_pol},
3997 {"CRED/", validate_cred},
3998 {"UL/", validate_ul},
3999 {"GL/", validate_gl},
4000 {"UG/", validate_ug},
4001 {"UA", validate_ua},
4002 {"GM/", validate_gm},
4003 {"DR/", validate_dr},
4004 {"DE/", validate_de},
4005 {"NSS/PWINFO/", validate_pwinfo},
4006 {"TRUSTDOMCACHE/", validate_trustdomcache},
4007 {"NSS/NA/", validate_nss_na},
4008 {"NSS/AN/", validate_nss_an},
4009 {"WINBINDD_OFFLINE", validate_offline},
4010 {"NDR/", validate_ndr},
4011 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
4012 {NULL, NULL}
4013 };
4014
4015 /***********************************************************************
4016 Function to look at every entry in the tdb and validate it as far as
4017 possible.
4018 ***********************************************************************/
4019
4020 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
4021 {
4022 int i;
4023 unsigned int max_key_len = 1024;
4024 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
4025
4026 /* Paranoia check. */
4027 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
4028 max_key_len = 1024 * 1024;
4029 }
4030 if (kbuf.dsize > max_key_len) {
4031 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
4032 "(%u) > (%u)\n\n",
4033 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
4034 return 1;
4035 }
4036
4037 for (i = 0; key_val[i].keyname; i++) {
4038 size_t namelen = strlen(key_val[i].keyname);
4039 if (kbuf.dsize >= namelen && (
4040 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
4041 TALLOC_CTX *mem_ctx;
4042 char *keystr;
4043 int ret;
4044
4045 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
4046 if (!keystr) {
4047 return 1;
4048 }
4049 memcpy(keystr, kbuf.dptr, kbuf.dsize);
4050 keystr[kbuf.dsize] = '\0';
4051
4052 mem_ctx = talloc_init("validate_ctx");
4053 if (!mem_ctx) {
4054 SAFE_FREE(keystr);
4055 return 1;
4056 }
4057
4058 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
4059 v_state);
4060
4061 SAFE_FREE(keystr);
4062 talloc_destroy(mem_ctx);
4063 return ret;
4064 }
4065 }
4066
4067 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
4068 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
4069 DEBUG(0,("data :\n"));
4070 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4071 v_state->unknown_key = true;
4072 v_state->success = false;
4073 return 1; /* terminate. */
4074 }
4075
4076 static void validate_panic(const char *const why)
4077 {
4078 DEBUG(0,("validating cache: would panic %s\n", why ));
4079 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4080 exit(47);
4081 }
4082
4083 /***********************************************************************
4084 Try and validate every entry in the winbindd cache. If we fail here,
4085 delete the cache tdb and return non-zero.
4086 ***********************************************************************/
4087
4088 int winbindd_validate_cache(void)
4089 {
4090 int ret = -1;
4091 const char *tdb_path = cache_path("winbindd_cache.tdb");
4092 TDB_CONTEXT *tdb = NULL;
4093
4094 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4095 smb_panic_fn = validate_panic;
4096
4097
4098 tdb = tdb_open_log(tdb_path,
4099 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4100 TDB_INCOMPATIBLE_HASH |
4101 ( lp_winbind_offline_logon()
4102 ? TDB_DEFAULT
4103 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4104 O_RDWR|O_CREAT,
4105 0600);
4106 if (!tdb) {
4107 DEBUG(0, ("winbindd_validate_cache: "
4108 "error opening/initializing tdb\n"));
4109 goto done;
4110 }
4111 tdb_close(tdb);
4112
4113 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4114
4115 if (ret != 0) {
4116 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4117 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4118 unlink(tdb_path);
4119 }
4120
4121 done:
4122 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4123 smb_panic_fn = smb_panic;
4124 return ret;
4125 }
4126
4127 /***********************************************************************
4128 Try and validate every entry in the winbindd cache.
4129 ***********************************************************************/
4130
4131 int winbindd_validate_cache_nobackup(void)
4132 {
4133 int ret = -1;
4134 const char *tdb_path = cache_path("winbindd_cache.tdb");
4135
4136 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4137 smb_panic_fn = validate_panic;
4138
4139
4140 if (wcache == NULL || wcache->tdb == NULL) {
4141 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4142 } else {
4143 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4144 }
4145
4146 if (ret != 0) {
4147 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4148 "successful.\n"));
4149 }
4150
4151 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4152 "function\n"));
4153 smb_panic_fn = smb_panic;
4154 return ret;
4155 }
4156
4157 bool winbindd_cache_validate_and_initialize(void)
4158 {
4159 close_winbindd_cache();
4160
4161 if (lp_winbind_offline_logon()) {
4162 if (winbindd_validate_cache() < 0) {
4163 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4164 "could be restored.\n"));
4165 }
4166 }
4167
4168 return initialize_winbindd_cache();
4169 }
4170
4171 /*********************************************************************
4172 ********************************************************************/
4173
4174 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4175 struct winbindd_tdc_domain **domains,
4176 size_t *num_domains )
4177 {
4178 struct winbindd_tdc_domain *list = NULL;
4179 size_t idx;
4180 int i;
4181 bool set_only = false;
4182
4183 /* don't allow duplicates */
4184
4185 idx = *num_domains;
4186 list = *domains;
4187
4188 for ( i=0; i< (*num_domains); i++ ) {
4189 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4190 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4191 new_dom->name));
4192 idx = i;
4193 set_only = true;
4194
4195 break;
4196 }
4197 }
4198
4199 if ( !set_only ) {
4200 if ( !*domains ) {
4201 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
4202 idx = 0;
4203 } else {
4204 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
4205 struct winbindd_tdc_domain,
4206 (*num_domains)+1);
4207 idx = *num_domains;
4208 }
4209
4210 ZERO_STRUCT( list[idx] );
4211 }
4212
4213 if ( !list )
4214 return false;
4215
4216 list[idx].domain_name = talloc_strdup( list, new_dom->name );
4217 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4218
4219 if ( !is_null_sid( &new_dom->sid ) ) {
4220 sid_copy( &list[idx].sid, &new_dom->sid );
4221 } else {
4222 sid_copy(&list[idx].sid, &global_sid_NULL);
4223 }
4224
4225 if ( new_dom->domain_flags != 0x0 )
4226 list[idx].trust_flags = new_dom->domain_flags;
4227
4228 if ( new_dom->domain_type != 0x0 )
4229 list[idx].trust_type = new_dom->domain_type;
4230
4231 if ( new_dom->domain_trust_attribs != 0x0 )
4232 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4233
4234 if ( !set_only ) {
4235 *domains = list;
4236 *num_domains = idx + 1;
4237 }
4238
4239 return true;
4240 }
4241
4242 /*********************************************************************
4243 ********************************************************************/
4244
4245 static TDB_DATA make_tdc_key( const char *domain_name )
4246 {
4247 char *keystr = NULL;
4248 TDB_DATA key = { NULL, 0 };
4249
4250 if ( !domain_name ) {
4251 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4252 return key;
4253 }
4254
4255 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4256 return key;
4257 }
4258 key = string_term_tdb_data(keystr);
4259
4260 return key;
4261 }
4262
4263 /*********************************************************************
4264 ********************************************************************/
4265
4266 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4267 size_t num_domains,
4268 unsigned char **buf )
4269 {
4270 unsigned char *buffer = NULL;
4271 int len = 0;
4272 int buflen = 0;
4273 int i = 0;
4274
4275 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4276 (int)num_domains));
4277
4278 buflen = 0;
4279
4280 again:
4281 len = 0;
4282
4283 /* Store the number of array items first */
4284 len += tdb_pack( buffer+len, buflen-len, "d",
4285 num_domains );
4286
4287 /* now pack each domain trust record */
4288 for ( i=0; i<num_domains; i++ ) {
4289
4290 fstring tmp;
4291
4292 if ( buflen > 0 ) {
4293 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4294 domains[i].domain_name,
4295 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4296 }
4297
4298 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4299 domains[i].domain_name,
4300 domains[i].dns_name,
4301 sid_to_fstring(tmp, &domains[i].sid),
4302 domains[i].trust_flags,
4303 domains[i].trust_attribs,
4304 domains[i].trust_type );
4305 }
4306
4307 if ( buflen < len ) {
4308 SAFE_FREE(buffer);
4309 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4310 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4311 buflen = -1;
4312 goto done;
4313 }
4314 buflen = len;
4315 goto again;
4316 }
4317
4318 *buf = buffer;
4319
4320 done:
4321 return buflen;
4322 }
4323
4324 /*********************************************************************
4325 ********************************************************************/
4326
4327 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4328 struct winbindd_tdc_domain **domains )
4329 {
4330 fstring domain_name, dns_name, sid_string;
4331 uint32 type, attribs, flags;
4332 int num_domains;
4333 int len = 0;
4334 int i;
4335 struct winbindd_tdc_domain *list = NULL;
4336
4337 /* get the number of domains */
4338 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4339 if ( len == -1 ) {
4340 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4341 return 0;
4342 }
4343
4344 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4345 if ( !list ) {
4346 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4347 return 0;
4348 }
4349
4350 for ( i=0; i<num_domains; i++ ) {
4351 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4352 domain_name,
4353 dns_name,
4354 sid_string,
4355 &flags,
4356 &attribs,
4357 &type );
4358
4359 if ( len == -1 ) {
4360 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4361 TALLOC_FREE( list );
4362 return 0;
4363 }
4364
4365 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4366 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4367 domain_name, dns_name, sid_string,
4368 flags, attribs, type));
4369
4370 list[i].domain_name = talloc_strdup( list, domain_name );
4371 list[i].dns_name = talloc_strdup( list, dns_name );
4372 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4373 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4374 domain_name));
4375 }
4376 list[i].trust_flags = flags;
4377 list[i].trust_attribs = attribs;
4378 list[i].trust_type = type;
4379 }
4380
4381 *domains = list;
4382
4383 return num_domains;
4384 }
4385
4386 /*********************************************************************
4387 ********************************************************************/
4388
4389 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4390 {
4391 TDB_DATA key = make_tdc_key( lp_workgroup() );
4392 TDB_DATA data = { NULL, 0 };
4393 int ret;
4394
4395 if ( !key.dptr )
4396 return false;
4397
4398 /* See if we were asked to delete the cache entry */
4399
4400 if ( !domains ) {
4401 ret = tdb_delete( wcache->tdb, key );
4402 goto done;
4403 }
4404
4405 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4406
4407 if ( !data.dptr ) {
4408 ret = -1;
4409 goto done;
4410 }
4411
4412 ret = tdb_store( wcache->tdb, key, data, 0 );
4413
4414 done:
4415 SAFE_FREE( data.dptr );
4416 SAFE_FREE( key.dptr );
4417
4418 return ( ret != -1 );
4419 }
4420
4421 /*********************************************************************
4422 ********************************************************************/
4423
4424 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4425 {
4426 TDB_DATA key = make_tdc_key( lp_workgroup() );
4427 TDB_DATA data = { NULL, 0 };
4428
4429 *domains = NULL;
4430 *num_domains = 0;
4431
4432 if ( !key.dptr )
4433 return false;
4434
4435 data = tdb_fetch( wcache->tdb, key );
4436
4437 SAFE_FREE( key.dptr );
4438
4439 if ( !data.dptr )
4440 return false;
4441
4442 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4443
4444 SAFE_FREE( data.dptr );
4445
4446 if ( !*domains )
4447 return false;
4448
4449 return true;
4450 }
4451
4452 /*********************************************************************
4453 ********************************************************************/
4454
4455 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4456 {
4457 struct winbindd_tdc_domain *dom_list = NULL;
4458 size_t num_domains = 0;
4459 bool ret = false;
4460
4461 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4462 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4463 domain->name, domain->alt_name,
4464 sid_string_dbg(&domain->sid),
4465 domain->domain_flags,
4466 domain->domain_trust_attribs,
4467 domain->domain_type));
4468
4469 if ( !init_wcache() ) {
4470 return false;
4471 }
4472
4473 /* fetch the list */
4474
4475 wcache_tdc_fetch_list( &dom_list, &num_domains );
4476
4477 /* add the new domain */
4478
4479 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4480 goto done;
4481 }
4482
4483 /* pack the domain */
4484
4485 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4486 goto done;
4487 }
4488
4489 /* Success */
4490
4491 ret = true;
4492 done:
4493 TALLOC_FREE( dom_list );
4494
4495 return ret;
4496 }
4497
4498 /*********************************************************************
4499 ********************************************************************/
4500
4501 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4502 {
4503 struct winbindd_tdc_domain *dom_list = NULL;
4504 size_t num_domains = 0;
4505 int i;
4506 struct winbindd_tdc_domain *d = NULL;
4507
4508 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4509
4510 if ( !init_wcache() ) {
4511 return false;
4512 }
4513
4514 /* fetch the list */
4515
4516 wcache_tdc_fetch_list( &dom_list, &num_domains );
4517
4518 for ( i=0; i<num_domains; i++ ) {
4519 if ( strequal(name, dom_list[i].domain_name) ||
4520 strequal(name, dom_list[i].dns_name) )
4521 {
4522 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4523 name));
4524
4525 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4526 if ( !d )
4527 break;
4528
4529 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4530 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4531 sid_copy( &d->sid, &dom_list[i].sid );
4532 d->trust_flags = dom_list[i].trust_flags;
4533 d->trust_type = dom_list[i].trust_type;
4534 d->trust_attribs = dom_list[i].trust_attribs;
4535
4536 break;
4537 }
4538 }
4539
4540 TALLOC_FREE( dom_list );
4541
4542 return d;
4543 }
4544
4545 /*********************************************************************
4546 ********************************************************************/
4547
4548 struct winbindd_tdc_domain*
4549 wcache_tdc_fetch_domainbysid(TALLOC_CTX *ctx,
4550 const struct dom_sid *sid)
4551 {
4552 struct winbindd_tdc_domain *dom_list = NULL;
4553 size_t num_domains = 0;
4554 int i;
4555 struct winbindd_tdc_domain *d = NULL;
4556
4557 DEBUG(10,("wcache_tdc_fetch_domainbysid: Searching for domain %s\n",
4558 sid_string_dbg(sid)));
4559
4560 if (!init_wcache()) {
4561 return false;
4562 }
4563
4564 /* fetch the list */
4565
4566 wcache_tdc_fetch_list(&dom_list, &num_domains);
4567
4568 for (i = 0; i<num_domains; i++) {
4569 if (sid_equal(sid, &(dom_list[i].sid))) {
4570 DEBUG(10, ("wcache_tdc_fetch_domainbysid: "
4571 "Found domain %s for SID %s\n",
4572 dom_list[i].domain_name,
4573 sid_string_dbg(sid)));
4574
4575 d = TALLOC_P(ctx, struct winbindd_tdc_domain);
4576 if (!d)
4577 break;
4578
4579 d->domain_name = talloc_strdup(d,
4580 dom_list[i].domain_name);
4581
4582 d->dns_name = talloc_strdup(d, dom_list[i].dns_name);
4583 sid_copy(&d->sid, &dom_list[i].sid);
4584 d->trust_flags = dom_list[i].trust_flags;
4585 d->trust_type = dom_list[i].trust_type;
4586 d->trust_attribs = dom_list[i].trust_attribs;
4587
4588 break;
4589 }
4590 }
4591
4592 TALLOC_FREE(dom_list);
4593
4594 return d;
4595 }
4596
4597
4598 /*********************************************************************
4599 ********************************************************************/
4600
4601 void wcache_tdc_clear( void )
4602 {
4603 if ( !init_wcache() )
4604 return;
4605
4606 wcache_tdc_store_list( NULL, 0 );
4607
4608 return;
4609 }
4610
4611
4612 /*********************************************************************
4613 ********************************************************************/
4614
4615 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4616 NTSTATUS status,
4617 const struct dom_sid *user_sid,
4618 const char *homedir,
4619 const char *shell,
4620 const char *gecos,
4621 uint32 gid)
4622 {
4623 struct cache_entry *centry;
4624 fstring tmp;
4625
4626 if ( (centry = centry_start(domain, status)) == NULL )
4627 return;
4628
4629 centry_put_string( centry, homedir );
4630 centry_put_string( centry, shell );
4631 centry_put_string( centry, gecos );
4632 centry_put_uint32( centry, gid );
4633
4634 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4635
4636 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4637
4638 centry_free(centry);
4639 }
4640
4641 #ifdef HAVE_ADS
4642
4643 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4644 const struct dom_sid *user_sid,
4645 TALLOC_CTX *ctx,
4646 const char **homedir, const char **shell,
4647 const char **gecos, gid_t *p_gid)
4648 {
4649 struct winbind_cache *cache = get_cache(domain);
4650 struct cache_entry *centry = NULL;
4651 NTSTATUS nt_status;
4652 fstring tmp;
4653
4654 if (!cache->tdb)
4655 goto do_query;
4656
4657 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4658 sid_to_fstring(tmp, user_sid));
4659
4660 if (!centry)
4661 goto do_query;
4662
4663 *homedir = centry_string( centry, ctx );
4664 *shell = centry_string( centry, ctx );
4665 *gecos = centry_string( centry, ctx );
4666 *p_gid = centry_uint32( centry );
4667
4668 centry_free(centry);
4669
4670 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4671 sid_string_dbg(user_sid)));
4672
4673 return NT_STATUS_OK;
4674
4675 do_query:
4676
4677 nt_status = nss_get_info( domain->name, user_sid, ctx,
4678 homedir, shell, gecos, p_gid );
4679
4680 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4681
4682 if ( NT_STATUS_IS_OK(nt_status) ) {
4683 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4684 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4685 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4686 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4687
4688 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4689 *homedir, *shell, *gecos, *p_gid );
4690 }
4691
4692 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4693 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4694 domain->name ));
4695 set_domain_offline( domain );
4696 }
4697
4698 return nt_status;
4699 }
4700
4701 #endif
4702
4703 /* the cache backend methods are exposed via this structure */
4704 struct winbindd_methods cache_methods = {
4705 true,
4706 query_user_list,
4707 enum_dom_groups,
4708 enum_local_groups,
4709 name_to_sid,
4710 sid_to_name,
4711 rids_to_names,
4712 query_user,
4713 lookup_usergroups,
4714 lookup_useraliases,
4715 lookup_groupmem,
4716 sequence_number,
4717 lockout_policy,
4718 password_policy,
4719 trusted_domains
4720 };
4721
4722 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4723 uint32_t opnum, const DATA_BLOB *req,
4724 TDB_DATA *pkey)
4725 {
4726 char *key;
4727 size_t keylen;
4728
4729 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4730 if (key == NULL) {
4731 return false;
4732 }
4733 keylen = talloc_get_size(key) - 1;
4734
4735 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4736 if (key == NULL) {
4737 return false;
4738 }
4739 memcpy(key + keylen, req->data, req->length);
4740
4741 pkey->dptr = (uint8_t *)key;
4742 pkey->dsize = talloc_get_size(key);
4743 return true;
4744 }
4745
4746 static bool wcache_opnum_cacheable(uint32_t opnum)
4747 {
4748 switch (opnum) {
4749 case NDR_WBINT_PING:
4750 case NDR_WBINT_QUERYSEQUENCENUMBER:
4751 case NDR_WBINT_ALLOCATEUID:
4752 case NDR_WBINT_ALLOCATEGID:
4753 case NDR_WBINT_CHECKMACHINEACCOUNT:
4754 case NDR_WBINT_CHANGEMACHINEACCOUNT:
4755 case NDR_WBINT_PINGDC:
4756 return false;
4757 }
4758 return true;
4759 }
4760
4761 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4762 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4763 {
4764 TDB_DATA key, data;
4765 bool ret = false;
4766
4767 if (!wcache_opnum_cacheable(opnum) ||
4768 is_my_own_sam_domain(domain) ||
4769 is_builtin_domain(domain)) {
4770 return false;
4771 }
4772
4773 if (wcache->tdb == NULL) {
4774 return false;
4775 }
4776
4777 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4778 return false;
4779 }
4780 data = tdb_fetch(wcache->tdb, key);
4781 TALLOC_FREE(key.dptr);
4782
4783 if (data.dptr == NULL) {
4784 return false;
4785 }
4786 if (data.dsize < 12) {
4787 goto fail;
4788 }
4789
4790 if (!is_domain_offline(domain)) {
4791 uint32_t entry_seqnum, dom_seqnum, last_check;
4792 uint64_t entry_timeout;
4793
4794 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4795 &last_check)) {
4796 goto fail;
4797 }
4798 entry_seqnum = IVAL(data.dptr, 0);
4799 if (entry_seqnum != dom_seqnum) {
4800 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4801 (int)entry_seqnum));
4802 goto fail;
4803 }
4804 entry_timeout = BVAL(data.dptr, 4);
4805 if (entry_timeout > time(NULL)) {
4806 DEBUG(10, ("Entry has timed out\n"));
4807 goto fail;
4808 }
4809 }
4810
4811 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 12,
4812 data.dsize - 12);
4813 if (resp->data == NULL) {
4814 DEBUG(10, ("talloc failed\n"));
4815 goto fail;
4816 }
4817 resp->length = data.dsize - 12;
4818
4819 ret = true;
4820 fail:
4821 SAFE_FREE(data.dptr);
4822 return ret;
4823 }
4824
4825 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4826 const DATA_BLOB *req, const DATA_BLOB *resp)
4827 {
4828 TDB_DATA key, data;
4829 uint32_t dom_seqnum, last_check;
4830 uint64_t timeout;
4831
4832 if (!wcache_opnum_cacheable(opnum) ||
4833 is_my_own_sam_domain(domain) ||
4834 is_builtin_domain(domain)) {
4835 return;
4836 }
4837
4838 if (wcache->tdb == NULL) {
4839 return;
4840 }
4841
4842 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4843 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4844 domain->name));
4845 return;
4846 }
4847
4848 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4849 return;
4850 }
4851
4852 timeout = time(NULL) + lp_winbind_cache_time();
4853
4854 data.dsize = resp->length + 12;
4855 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4856 if (data.dptr == NULL) {
4857 goto done;
4858 }
4859
4860 SIVAL(data.dptr, 0, dom_seqnum);
4861 SBVAL(data.dptr, 4, timeout);
4862 memcpy(data.dptr + 12, resp->data, resp->length);
4863
4864 tdb_store(wcache->tdb, key, data, 0);
4865
4866 done:
4867 TALLOC_FREE(key.dptr);
4868 return;
4869 }
Samba GIT mirror