2 Unix SMB/CIFS implementation.
4 Trusted domain names cache on top of gencache.
6 Copyright (C) Rafal Szczesniak 2002
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "../libcli/security/security.h"
24 #include "../librpc/gen_ndr/ndr_lsa_c.h"
25 #include "libsmb/libsmb.h"
26 #include "rpc_client/cli_pipe.h"
27 #include "rpc_client/cli_lsarpc.h"
30 #define DBGC_CLASS DBGC_ALL /* there's no proper class yet */
32 #define TDOMKEY_FMT "TDOM/%s"
33 #define TDOMTSKEY "TDOMCACHE/TIMESTAMP"
34 #define TRUSTDOM_UPDATE_INTERVAL 600
38 * @file trustdom_cache.c
40 * Implementation of trusted domain names cache useful when
41 * samba acts as domain member server. In such case, caching
42 * domain names currently trusted gives a performance gain
43 * because there's no need to query PDC each time we need
44 * list of trusted domains
48 * Form up trustdom name key. It is based only
51 * @param name trusted domain name
52 * @return cache key for use in gencache mechanism
55 static char *trustdom_cache_key(TALLOC_CTX
*mem_ctx
, const char *name
)
57 return talloc_asprintf_strupper_m(mem_ctx
, TDOMKEY_FMT
, name
);
62 * Store trusted domain in gencache as the domain name (key)
63 * and trusted domain's SID (value)
65 * @param name trusted domain name
66 * @param alt_name alternative trusted domain name (used in ADS domains)
67 * @param sid trusted domain's SID
68 * @param timeout cache entry expiration time
69 * @return true upon successful value storing or
70 * false if store attempt failed
73 bool trustdom_cache_store(const char *name
, const struct dom_sid
*sid
)
79 DEBUG(5, ("trustdom_store: storing SID %s of domain %s\n",
80 sid_string_dbg(sid
), name
));
82 key
= trustdom_cache_key(talloc_tos(), name
);
84 /* Generate string representation domain SID */
85 sid_to_fstring(sid_string
, sid
);
87 ret
= gencache_set(key
, sid_string
,
88 time(NULL
) + TRUSTDOM_UPDATE_INTERVAL
);
95 * Fetch trusted domain's SID from the gencache.
96 * This routine can also be used to check whether given
97 * domain is currently trusted one.
99 * @param name trusted domain name
100 * @param sid trusted domain's SID to be returned
101 * @return true if entry is found or
102 * false if has expired/doesn't exist
105 bool trustdom_cache_fetch(const char* name
, struct dom_sid
* sid
)
107 char *key
= NULL
, *value
= NULL
;
111 /* exit now if null pointers were passed as they're required further */
116 /* prepare a key and get the value */
117 key
= trustdom_cache_key(talloc_tos(), name
);
122 ok
= gencache_get(key
, talloc_tos(), &value
, &timeout
);
125 DEBUG(5, ("no entry for trusted domain %s found.\n", name
));
129 DEBUG(5, ("trusted domain %s found (%s)\n", name
, value
));
131 /* convert sid string representation into struct dom_sid structure */
132 ok
= string_to_sid(sid
, value
);
137 /*******************************************************************
138 fetch the timestamp from the last update
139 *******************************************************************/
141 static uint32_t trustdom_cache_fetch_timestamp(void)
147 if (!gencache_get(TDOMTSKEY
, talloc_tos(), &value
, &timeout
)) {
148 DEBUG(5, ("no timestamp for trusted domain cache located.\n"));
153 timestamp
= atoi(value
);
159 /*******************************************************************
160 store the timestamp from the last update
161 *******************************************************************/
163 static bool trustdom_cache_store_timestamp(uint32_t t
, time_t timeout
)
167 fstr_sprintf(value
, "%d", t
);
169 if (!gencache_set(TDOMTSKEY
, value
, timeout
)) {
170 DEBUG(5, ("failed to set timestamp for trustdom_cache\n"));
179 * Delete single trustdom entry. Look at the
180 * gencache_iterate definition.
184 static void flush_trustdom_name(const char* key
, const char *value
, time_t timeout
, void* dptr
)
187 DEBUG(5, ("Deleting entry %s\n", key
));
192 * Flush all the trusted domains entries from the cache.
195 void trustdom_cache_flush(void)
197 char *key
= trustdom_cache_key(talloc_tos(), "*");
199 * iterate through each TDOM cache's entry and flush it
200 * by flush_trustdom_name function
202 gencache_iterate(flush_trustdom_name
, NULL
, key
);
204 DEBUG(5, ("Trusted domains cache flushed\n"));
207 /*********************************************************************
208 Enumerate the list of trusted domains from a DC
209 *********************************************************************/
211 static bool enumerate_domain_trusts( TALLOC_CTX
*mem_ctx
, const char *domain
,
212 char ***domain_names
, uint32_t *num_domains
,
213 struct dom_sid
**sids
)
215 struct policy_handle pol
;
216 NTSTATUS status
, result
;
218 struct sockaddr_storage dc_ss
;
219 uint32_t enum_ctx
= 0;
220 struct cli_state
*cli
= NULL
;
221 struct rpc_pipe_client
*lsa_pipe
= NULL
;
222 struct lsa_DomainList dom_list
;
224 struct dcerpc_binding_handle
*b
= NULL
;
226 *domain_names
= NULL
;
230 /* lookup a DC first */
232 if ( !get_dc_name(domain
, NULL
, dc_name
, &dc_ss
) ) {
233 DEBUG(3,("enumerate_domain_trusts: can't locate a DC for domain %s\n",
238 /* setup the anonymous connection */
240 status
= cli_full_connection( &cli
, lp_netbios_name(), dc_name
, &dc_ss
, 0, "IPC$", "IPC",
241 "", "", "", 0, Undefined
);
242 if ( !NT_STATUS_IS_OK(status
) )
245 /* open the LSARPC_PIPE */
247 status
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_lsarpc
,
249 if (!NT_STATUS_IS_OK(status
)) {
253 b
= lsa_pipe
->binding_handle
;
257 status
= rpccli_lsa_open_policy(lsa_pipe
, mem_ctx
, True
,
258 LSA_POLICY_VIEW_LOCAL_INFORMATION
, &pol
);
259 if ( !NT_STATUS_IS_OK(status
) )
262 /* Lookup list of trusted domains */
264 status
= dcerpc_lsa_EnumTrustDom(b
, mem_ctx
,
270 if ( !NT_STATUS_IS_OK(status
) )
272 if (!NT_STATUS_IS_OK(result
)) {
277 *num_domains
= dom_list
.count
;
279 *domain_names
= talloc_zero_array(mem_ctx
, char *, *num_domains
);
280 if (!*domain_names
) {
281 status
= NT_STATUS_NO_MEMORY
;
285 *sids
= talloc_zero_array(mem_ctx
, struct dom_sid
, *num_domains
);
287 status
= NT_STATUS_NO_MEMORY
;
291 for (i
=0; i
< *num_domains
; i
++) {
292 (*domain_names
)[i
] = discard_const_p(char, dom_list
.domains
[i
].name
.string
);
293 (*sids
)[i
] = *dom_list
.domains
[i
].sid
;
299 DEBUG(10,("enumerate_domain_trusts: shutting down connection...\n"));
303 return NT_STATUS_IS_OK(status
);
306 /********************************************************************
307 update the trustdom_cache if needed
308 ********************************************************************/
310 void update_trustdom_cache( void )
313 struct dom_sid
*dom_sids
;
314 uint32_t num_domains
;
317 TALLOC_CTX
*mem_ctx
= NULL
;
318 time_t now
= time(NULL
);
321 /* get the timestamp. We have to initialise it if the last timestamp == 0 */
322 if ( (last_check
= trustdom_cache_fetch_timestamp()) == 0 )
323 trustdom_cache_store_timestamp(0, now
+TRUSTDOM_UPDATE_INTERVAL
);
325 time_diff
= (int) (now
- last_check
);
327 if ( (time_diff
> 0) && (time_diff
< TRUSTDOM_UPDATE_INTERVAL
) ) {
328 DEBUG(10,("update_trustdom_cache: not time to update trustdom_cache yet\n"));
332 /* note that we don't lock the timestamp. This prevents this
333 smbd from blocking all other smbd daemons while we
334 enumerate the trusted domains */
335 trustdom_cache_store_timestamp(now
, now
+TRUSTDOM_UPDATE_INTERVAL
);
337 if ( !(mem_ctx
= talloc_init("update_trustdom_cache")) ) {
338 DEBUG(0,("update_trustdom_cache: talloc_init() failed!\n"));
342 /* get the domains and store them */
344 if ( enumerate_domain_trusts(mem_ctx
, lp_workgroup(), &domain_names
,
345 &num_domains
, &dom_sids
)) {
346 for ( i
=0; i
<num_domains
; i
++ ) {
347 trustdom_cache_store(domain_names
[i
], &dom_sids
[i
]);
350 /* we failed to fetch the list of trusted domains - restore the old
352 trustdom_cache_store_timestamp(last_check
,
353 last_check
+TRUSTDOM_UPDATE_INTERVAL
);
357 talloc_destroy( mem_ctx
);