?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
w3:winbind: Convert WINBINDD_ALLOCATE_GID to the new API
[Samba/aatanasov.git] / source3 / winbindd / winbindd_cache.c
blob8d44d27141467d24b9a917db7e4258ababbfc5c0
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
30 #include "../librpc/gen_ndr/ndr_wbint.h"
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_WINBIND
34
35 #define WINBINDD_CACHE_VERSION 1
36 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
37
38 extern struct winbindd_methods reconnect_methods;
39 #ifdef HAVE_ADS
40 extern struct winbindd_methods ads_methods;
41 #endif
42 extern struct winbindd_methods builtin_passdb_methods;
43
44 /*
45 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
46 * Here are the list of entry types that are *not* stored
47 * as form struct cache_entry in the cache.
48 */
49
50 static const char *non_centry_keys[] = {
51 "SEQNUM/",
52 "DR/",
53 "DE/",
54 "WINBINDD_OFFLINE",
55 WINBINDD_CACHE_VERSION_KEYSTR,
56 NULL
57 };
58
59 /************************************************************************
60 Is this key a non-centry type ?
61 ************************************************************************/
62
63 static bool is_non_centry_key(TDB_DATA kbuf)
64 {
65 int i;
66
67 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
68 return false;
69 }
70 for (i = 0; non_centry_keys[i] != NULL; i++) {
71 size_t namelen = strlen(non_centry_keys[i]);
72 if (kbuf.dsize < namelen) {
73 continue;
74 }
75 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
76 return true;
77 }
78 }
79 return false;
80 }
81
82 /* Global online/offline state - False when online. winbindd starts up online
83 and sets this to true if the first query fails and there's an entry in
84 the cache tdb telling us to stay offline. */
85
86 static bool global_winbindd_offline_state;
87
88 struct winbind_cache {
89 TDB_CONTEXT *tdb;
90 };
91
92 struct cache_entry {
93 NTSTATUS status;
94 uint32 sequence_number;
95 uint8 *data;
96 uint32 len, ofs;
97 };
98
99 void (*smb_panic_fn)(const char *const why) = smb_panic;
100
101 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
102
103 static struct winbind_cache *wcache;
104
105 void winbindd_check_cache_size(time_t t)
106 {
107 static time_t last_check_time;
108 struct stat st;
109
110 if (last_check_time == (time_t)0)
111 last_check_time = t;
112
113 if (t - last_check_time < 60 && t - last_check_time > 0)
114 return;
115
116 if (wcache == NULL || wcache->tdb == NULL) {
117 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
118 return;
119 }
120
121 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
122 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
123 return;
124 }
125
126 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
127 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
128 (unsigned long)st.st_size,
129 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
130 wcache_flush_cache();
131 }
132 }
133
134 /* get the winbind_cache structure */
135 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
136 {
137 struct winbind_cache *ret = wcache;
138
139 /* We have to know what type of domain we are dealing with first. */
140
141 if (domain->internal) {
142 domain->backend = &builtin_passdb_methods;
143 domain->initialized = True;
144 }
145 if ( !domain->initialized ) {
146 init_dc_connection( domain );
147 }
148
149 /*
150 OK. listen up becasue I'm only going to say this once.
151 We have the following scenarios to consider
152 (a) trusted AD domains on a Samba DC,
153 (b) trusted AD domains and we are joined to a non-kerberos domain
154 (c) trusted AD domains and we are joined to a kerberos (AD) domain
155
156 For (a) we can always contact the trusted domain using krb5
157 since we have the domain trust account password
158
159 For (b) we can only use RPC since we have no way of
160 getting a krb5 ticket in our own domain
161
162 For (c) we can always use krb5 since we have a kerberos trust
163
164 --jerry
165 */
166
167 if (!domain->backend) {
168 #ifdef HAVE_ADS
169 struct winbindd_domain *our_domain = domain;
170
171 /* find our domain first so we can figure out if we
172 are joined to a kerberized domain */
173
174 if ( !domain->primary )
175 our_domain = find_our_domain();
176
177 if ((our_domain->active_directory || IS_DC)
178 && domain->active_directory
179 && !lp_winbind_rpc_only()) {
180 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
181 domain->backend = &ads_methods;
182 } else {
183 #endif /* HAVE_ADS */
184 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
185 domain->backend = &reconnect_methods;
186 #ifdef HAVE_ADS
187 }
188 #endif /* HAVE_ADS */
189 }
190
191 if (ret)
192 return ret;
193
194 ret = SMB_XMALLOC_P(struct winbind_cache);
195 ZERO_STRUCTP(ret);
196
197 wcache = ret;
198 wcache_flush_cache();
199
200 return ret;
201 }
202
203 /*
204 free a centry structure
205 */
206 static void centry_free(struct cache_entry *centry)
207 {
208 if (!centry)
209 return;
210 SAFE_FREE(centry->data);
211 free(centry);
212 }
213
214 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
215 {
216 if (centry->len - centry->ofs < nbytes) {
217 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
218 (unsigned int)nbytes,
219 centry->len - centry->ofs));
220 return false;
221 }
222 return true;
223 }
224
225 /*
226 pull a uint32 from a cache entry
227 */
228 static uint32 centry_uint32(struct cache_entry *centry)
229 {
230 uint32 ret;
231
232 if (!centry_check_bytes(centry, 4)) {
233 smb_panic_fn("centry_uint32");
234 }
235 ret = IVAL(centry->data, centry->ofs);
236 centry->ofs += 4;
237 return ret;
238 }
239
240 /*
241 pull a uint16 from a cache entry
242 */
243 static uint16 centry_uint16(struct cache_entry *centry)
244 {
245 uint16 ret;
246 if (!centry_check_bytes(centry, 2)) {
247 smb_panic_fn("centry_uint16");
248 }
249 ret = CVAL(centry->data, centry->ofs);
250 centry->ofs += 2;
251 return ret;
252 }
253
254 /*
255 pull a uint8 from a cache entry
256 */
257 static uint8 centry_uint8(struct cache_entry *centry)
258 {
259 uint8 ret;
260 if (!centry_check_bytes(centry, 1)) {
261 smb_panic_fn("centry_uint8");
262 }
263 ret = CVAL(centry->data, centry->ofs);
264 centry->ofs += 1;
265 return ret;
266 }
267
268 /*
269 pull a NTTIME from a cache entry
270 */
271 static NTTIME centry_nttime(struct cache_entry *centry)
272 {
273 NTTIME ret;
274 if (!centry_check_bytes(centry, 8)) {
275 smb_panic_fn("centry_nttime");
276 }
277 ret = IVAL(centry->data, centry->ofs);
278 centry->ofs += 4;
279 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
280 centry->ofs += 4;
281 return ret;
282 }
283
284 /*
285 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
286 */
287 static time_t centry_time(struct cache_entry *centry)
288 {
289 return (time_t)centry_nttime(centry);
290 }
291
292 /* pull a string from a cache entry, using the supplied
293 talloc context
294 */
295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
296 {
297 uint32 len;
298 char *ret;
299
300 len = centry_uint8(centry);
301
302 if (len == 0xFF) {
303 /* a deliberate NULL string */
304 return NULL;
305 }
306
307 if (!centry_check_bytes(centry, (size_t)len)) {
308 smb_panic_fn("centry_string");
309 }
310
311 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
312 if (!ret) {
313 smb_panic_fn("centry_string out of memory\n");
314 }
315 memcpy(ret,centry->data + centry->ofs, len);
316 ret[len] = 0;
317 centry->ofs += len;
318 return ret;
319 }
320
321 /* pull a hash16 from a cache entry, using the supplied
322 talloc context
323 */
324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
325 {
326 uint32 len;
327 char *ret;
328
329 len = centry_uint8(centry);
330
331 if (len != 16) {
332 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
333 len ));
334 return NULL;
335 }
336
337 if (!centry_check_bytes(centry, 16)) {
338 return NULL;
339 }
340
341 ret = TALLOC_ARRAY(mem_ctx, char, 16);
342 if (!ret) {
343 smb_panic_fn("centry_hash out of memory\n");
344 }
345 memcpy(ret,centry->data + centry->ofs, 16);
346 centry->ofs += 16;
347 return ret;
348 }
349
350 /* pull a sid from a cache entry, using the supplied
351 talloc context
352 */
353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
354 {
355 char *sid_string;
356 bool ret;
357
358 sid_string = centry_string(centry, talloc_tos());
359 if (sid_string == NULL) {
360 return false;
361 }
362 ret = string_to_sid(sid, sid_string);
363 TALLOC_FREE(sid_string);
364 return ret;
365 }
366
367
368 /*
369 pull a NTSTATUS from a cache entry
370 */
371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
372 {
373 NTSTATUS status;
374
375 status = NT_STATUS(centry_uint32(centry));
376 return status;
377 }
378
379
380 /* the server is considered down if it can't give us a sequence number */
381 static bool wcache_server_down(struct winbindd_domain *domain)
382 {
383 bool ret;
384
385 if (!wcache->tdb)
386 return false;
387
388 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
389
390 if (ret)
391 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
392 domain->name ));
393 return ret;
394 }
395
396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
397 uint32_t *last_seq_check)
398 {
399 char *key;
400 TDB_DATA data;
401
402 if (wcache->tdb == NULL) {
403 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
404 return false;
405 }
406
407 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
408 if (key == NULL) {
409 DEBUG(10, ("talloc failed\n"));
410 return false;
411 }
412
413 data = tdb_fetch_bystring(wcache->tdb, key);
414 TALLOC_FREE(key);
415
416 if (data.dptr == NULL) {
417 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
418 domain_name));
419 return false;
420 }
421 if (data.dsize != 8) {
422 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
423 (int)data.dsize));
424 SAFE_FREE(data.dptr);
425 return false;
426 }
427
428 *seqnum = IVAL(data.dptr, 0);
429 *last_seq_check = IVAL(data.dptr, 4);
430 SAFE_FREE(data.dptr);
431
432 return true;
433 }
434
435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
436 {
437 uint32 last_check, time_diff;
438
439 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
440 &last_check)) {
441 return NT_STATUS_UNSUCCESSFUL;
442 }
443 domain->last_seq_check = last_check;
444
445 /* have we expired? */
446
447 time_diff = now - domain->last_seq_check;
448 if ( time_diff > lp_winbind_cache_time() ) {
449 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
450 domain->name, domain->sequence_number,
451 (uint32)domain->last_seq_check));
452 return NT_STATUS_UNSUCCESSFUL;
453 }
454
455 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
456 domain->name, domain->sequence_number,
457 (uint32)domain->last_seq_check));
458
459 return NT_STATUS_OK;
460 }
461
462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
463 time_t last_seq_check)
464 {
465 char *key_str;
466 uint8_t buf[8];
467 int ret;
468
469 if (wcache->tdb == NULL) {
470 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
471 return false;
472 }
473
474 key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
475 if (key_str == NULL) {
476 DEBUG(10, ("talloc_asprintf failed\n"));
477 return false;
478 }
479
480 SIVAL(buf, 0, seqnum);
481 SIVAL(buf, 4, last_seq_check);
482
483 ret = tdb_store_bystring(wcache->tdb, key_str,
484 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
485 TALLOC_FREE(key_str);
486 if (ret == -1) {
487 DEBUG(10, ("tdb_store_bystring failed: %s\n",
488 tdb_errorstr(wcache->tdb)));
489 TALLOC_FREE(key_str);
490 return false;
491 }
492
493 DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
494 domain_name, seqnum, (unsigned)last_seq_check));
495
496 return true;
497 }
498
499 static bool store_cache_seqnum( struct winbindd_domain *domain )
500 {
501 return wcache_store_seqnum(domain->name, domain->sequence_number,
502 domain->last_seq_check);
503 }
504
505 /*
506 refresh the domain sequence number. If force is true
507 then always refresh it, no matter how recently we fetched it
508 */
509
510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
511 {
512 NTSTATUS status;
513 unsigned time_diff;
514 time_t t = time(NULL);
515 unsigned cache_time = lp_winbind_cache_time();
516
517 if ( IS_DOMAIN_OFFLINE(domain) ) {
518 return;
519 }
520
521 get_cache( domain );
522
523 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
524 /* trying to reconnect is expensive, don't do it too often */
525 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
526 cache_time *= 8;
527 }
528 #endif
529
530 time_diff = t - domain->last_seq_check;
531
532 /* see if we have to refetch the domain sequence number */
533 if (!force && (time_diff < cache_time) &&
534 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
535 NT_STATUS_IS_OK(domain->last_status)) {
536 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
537 goto done;
538 }
539
540 /* try to get the sequence number from the tdb cache first */
541 /* this will update the timestamp as well */
542
543 status = fetch_cache_seqnum( domain, t );
544 if (NT_STATUS_IS_OK(status) &&
545 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
546 NT_STATUS_IS_OK(domain->last_status)) {
547 goto done;
548 }
549
550 /* important! make sure that we know if this is a native
551 mode domain or not. And that we can contact it. */
552
553 if ( winbindd_can_contact_domain( domain ) ) {
554 status = domain->backend->sequence_number(domain,
555 &domain->sequence_number);
556 } else {
557 /* just use the current time */
558 status = NT_STATUS_OK;
559 domain->sequence_number = time(NULL);
560 }
561
562
563 /* the above call could have set our domain->backend to NULL when
564 * coming from offline to online mode, make sure to reinitialize the
565 * backend - Guenther */
566 get_cache( domain );
567
568 if (!NT_STATUS_IS_OK(status)) {
569 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
570 domain->sequence_number = DOM_SEQUENCE_NONE;
571 }
572
573 domain->last_status = status;
574 domain->last_seq_check = time(NULL);
575
576 /* save the new sequence number in the cache */
577 store_cache_seqnum( domain );
578
579 done:
580 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
581 domain->name, domain->sequence_number));
582
583 return;
584 }
585
586 /*
587 decide if a cache entry has expired
588 */
589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
590 {
591 /* If we've been told to be offline - stay in that state... */
592 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
593 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
594 keystr, domain->name ));
595 return false;
596 }
597
598 /* when the domain is offline return the cached entry.
599 * This deals with transient offline states... */
600
601 if (!domain->online) {
602 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
603 keystr, domain->name ));
604 return false;
605 }
606
607 /* if the server is OK and our cache entry came from when it was down then
608 the entry is invalid */
609 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
610 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
611 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
612 keystr, domain->name ));
613 return true;
614 }
615
616 /* if the server is down or the cache entry is not older than the
617 current sequence number then it is OK */
618 if (wcache_server_down(domain) ||
619 centry->sequence_number == domain->sequence_number) {
620 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
621 keystr, domain->name ));
622 return false;
623 }
624
625 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
626 keystr, domain->name ));
627
628 /* it's expired */
629 return true;
630 }
631
632 static struct cache_entry *wcache_fetch_raw(char *kstr)
633 {
634 TDB_DATA data;
635 struct cache_entry *centry;
636 TDB_DATA key;
637
638 key = string_tdb_data(kstr);
639 data = tdb_fetch(wcache->tdb, key);
640 if (!data.dptr) {
641 /* a cache miss */
642 return NULL;
643 }
644
645 centry = SMB_XMALLOC_P(struct cache_entry);
646 centry->data = (unsigned char *)data.dptr;
647 centry->len = data.dsize;
648 centry->ofs = 0;
649
650 if (centry->len < 8) {
651 /* huh? corrupt cache? */
652 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
653 centry_free(centry);
654 return NULL;
655 }
656
657 centry->status = centry_ntstatus(centry);
658 centry->sequence_number = centry_uint32(centry);
659
660 return centry;
661 }
662
663 /*
664 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
665 number and return status
666 */
667 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
668 struct winbindd_domain *domain,
669 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
670 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
671 struct winbindd_domain *domain,
672 const char *format, ...)
673 {
674 va_list ap;
675 char *kstr;
676 struct cache_entry *centry;
677
678 if (!winbindd_use_cache()) {
679 return NULL;
680 }
681
682 refresh_sequence_number(domain, false);
683
684 va_start(ap, format);
685 smb_xvasprintf(&kstr, format, ap);
686 va_end(ap);
687
688 centry = wcache_fetch_raw(kstr);
689 if (centry == NULL) {
690 free(kstr);
691 return NULL;
692 }
693
694 if (centry_expired(domain, kstr, centry)) {
695
696 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
697 kstr, domain->name ));
698
699 centry_free(centry);
700 free(kstr);
701 return NULL;
702 }
703
704 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
705 kstr, domain->name ));
706
707 free(kstr);
708 return centry;
709 }
710
711 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
712 static void wcache_delete(const char *format, ...)
713 {
714 va_list ap;
715 char *kstr;
716 TDB_DATA key;
717
718 va_start(ap, format);
719 smb_xvasprintf(&kstr, format, ap);
720 va_end(ap);
721
722 key = string_tdb_data(kstr);
723
724 tdb_delete(wcache->tdb, key);
725 free(kstr);
726 }
727
728 /*
729 make sure we have at least len bytes available in a centry
730 */
731 static void centry_expand(struct cache_entry *centry, uint32 len)
732 {
733 if (centry->len - centry->ofs >= len)
734 return;
735 centry->len *= 2;
736 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
737 centry->len);
738 if (!centry->data) {
739 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
740 smb_panic_fn("out of memory in centry_expand");
741 }
742 }
743
744 /*
745 push a uint32 into a centry
746 */
747 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
748 {
749 centry_expand(centry, 4);
750 SIVAL(centry->data, centry->ofs, v);
751 centry->ofs += 4;
752 }
753
754 /*
755 push a uint16 into a centry
756 */
757 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
758 {
759 centry_expand(centry, 2);
760 SIVAL(centry->data, centry->ofs, v);
761 centry->ofs += 2;
762 }
763
764 /*
765 push a uint8 into a centry
766 */
767 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
768 {
769 centry_expand(centry, 1);
770 SCVAL(centry->data, centry->ofs, v);
771 centry->ofs += 1;
772 }
773
774 /*
775 push a string into a centry
776 */
777 static void centry_put_string(struct cache_entry *centry, const char *s)
778 {
779 int len;
780
781 if (!s) {
782 /* null strings are marked as len 0xFFFF */
783 centry_put_uint8(centry, 0xFF);
784 return;
785 }
786
787 len = strlen(s);
788 /* can't handle more than 254 char strings. Truncating is probably best */
789 if (len > 254) {
790 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
791 len = 254;
792 }
793 centry_put_uint8(centry, len);
794 centry_expand(centry, len);
795 memcpy(centry->data + centry->ofs, s, len);
796 centry->ofs += len;
797 }
798
799 /*
800 push a 16 byte hash into a centry - treat as 16 byte string.
801 */
802 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
803 {
804 centry_put_uint8(centry, 16);
805 centry_expand(centry, 16);
806 memcpy(centry->data + centry->ofs, val, 16);
807 centry->ofs += 16;
808 }
809
810 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
811 {
812 fstring sid_string;
813 centry_put_string(centry, sid_to_fstring(sid_string, sid));
814 }
815
816
817 /*
818 put NTSTATUS into a centry
819 */
820 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
821 {
822 uint32 status_value = NT_STATUS_V(status);
823 centry_put_uint32(centry, status_value);
824 }
825
826
827 /*
828 push a NTTIME into a centry
829 */
830 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
831 {
832 centry_expand(centry, 8);
833 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
834 centry->ofs += 4;
835 SIVAL(centry->data, centry->ofs, nt >> 32);
836 centry->ofs += 4;
837 }
838
839 /*
840 push a time_t into a centry - use a 64 bit size.
841 NTTIME here is being used as a convenient 64-bit size.
842 */
843 static void centry_put_time(struct cache_entry *centry, time_t t)
844 {
845 NTTIME nt = (NTTIME)t;
846 centry_put_nttime(centry, nt);
847 }
848
849 /*
850 start a centry for output. When finished, call centry_end()
851 */
852 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
853 {
854 struct cache_entry *centry;
855
856 if (!wcache->tdb)
857 return NULL;
858
859 centry = SMB_XMALLOC_P(struct cache_entry);
860
861 centry->len = 8192; /* reasonable default */
862 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
863 centry->ofs = 0;
864 centry->sequence_number = domain->sequence_number;
865 centry_put_ntstatus(centry, status);
866 centry_put_uint32(centry, centry->sequence_number);
867 return centry;
868 }
869
870 /*
871 finish a centry and write it to the tdb
872 */
873 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
874 static void centry_end(struct cache_entry *centry, const char *format, ...)
875 {
876 va_list ap;
877 char *kstr;
878 TDB_DATA key, data;
879
880 if (!winbindd_use_cache()) {
881 return;
882 }
883
884 va_start(ap, format);
885 smb_xvasprintf(&kstr, format, ap);
886 va_end(ap);
887
888 key = string_tdb_data(kstr);
889 data.dptr = centry->data;
890 data.dsize = centry->ofs;
891
892 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
893 free(kstr);
894 }
895
896 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
897 NTSTATUS status, const char *domain_name,
898 const char *name, const DOM_SID *sid,
899 enum lsa_SidType type)
900 {
901 struct cache_entry *centry;
902 fstring uname;
903
904 centry = centry_start(domain, status);
905 if (!centry)
906 return;
907 centry_put_uint32(centry, type);
908 centry_put_sid(centry, sid);
909 fstrcpy(uname, name);
910 strupper_m(uname);
911 centry_end(centry, "NS/%s/%s", domain_name, uname);
912 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
913 uname, sid_string_dbg(sid), nt_errstr(status)));
914 centry_free(centry);
915 }
916
917 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
918 const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
919 {
920 struct cache_entry *centry;
921 fstring sid_string;
922
923 centry = centry_start(domain, status);
924 if (!centry)
925 return;
926
927 if (NT_STATUS_IS_OK(status)) {
928 centry_put_uint32(centry, type);
929 centry_put_string(centry, domain_name);
930 centry_put_string(centry, name);
931 }
932
933 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
934 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
935 name, nt_errstr(status)));
936 centry_free(centry);
937 }
938
939
940 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
941 struct wbint_userinfo *info)
942 {
943 struct cache_entry *centry;
944 fstring sid_string;
945
946 if (is_null_sid(&info->user_sid)) {
947 return;
948 }
949
950 centry = centry_start(domain, status);
951 if (!centry)
952 return;
953 centry_put_string(centry, info->acct_name);
954 centry_put_string(centry, info->full_name);
955 centry_put_string(centry, info->homedir);
956 centry_put_string(centry, info->shell);
957 centry_put_uint32(centry, info->primary_gid);
958 centry_put_sid(centry, &info->user_sid);
959 centry_put_sid(centry, &info->group_sid);
960 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
961 &info->user_sid));
962 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
963 centry_free(centry);
964 }
965
966 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
967 NTSTATUS status,
968 struct samr_DomInfo12 *lockout_policy)
969 {
970 struct cache_entry *centry;
971
972 centry = centry_start(domain, status);
973 if (!centry)
974 return;
975
976 centry_put_nttime(centry, lockout_policy->lockout_duration);
977 centry_put_nttime(centry, lockout_policy->lockout_window);
978 centry_put_uint16(centry, lockout_policy->lockout_threshold);
979
980 centry_end(centry, "LOC_POL/%s", domain->name);
981
982 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
983
984 centry_free(centry);
985 }
986
987
988
989 static void wcache_save_password_policy(struct winbindd_domain *domain,
990 NTSTATUS status,
991 struct samr_DomInfo1 *policy)
992 {
993 struct cache_entry *centry;
994
995 centry = centry_start(domain, status);
996 if (!centry)
997 return;
998
999 centry_put_uint16(centry, policy->min_password_length);
1000 centry_put_uint16(centry, policy->password_history_length);
1001 centry_put_uint32(centry, policy->password_properties);
1002 centry_put_nttime(centry, policy->max_password_age);
1003 centry_put_nttime(centry, policy->min_password_age);
1004
1005 centry_end(centry, "PWD_POL/%s", domain->name);
1006
1007 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1008
1009 centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013 ***************************************************************************/
1014
1015 static void wcache_save_username_alias(struct winbindd_domain *domain,
1016 NTSTATUS status,
1017 const char *name, const char *alias)
1018 {
1019 struct cache_entry *centry;
1020 fstring uname;
1021
1022 if ( (centry = centry_start(domain, status)) == NULL )
1023 return;
1024
1025 centry_put_string( centry, alias );
1026
1027 fstrcpy(uname, name);
1028 strupper_m(uname);
1029 centry_end(centry, "NSS/NA/%s", uname);
1030
1031 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1032
1033 centry_free(centry);
1034 }
1035
1036 static void wcache_save_alias_username(struct winbindd_domain *domain,
1037 NTSTATUS status,
1038 const char *alias, const char *name)
1039 {
1040 struct cache_entry *centry;
1041 fstring uname;
1042
1043 if ( (centry = centry_start(domain, status)) == NULL )
1044 return;
1045
1046 centry_put_string( centry, name );
1047
1048 fstrcpy(uname, alias);
1049 strupper_m(uname);
1050 centry_end(centry, "NSS/AN/%s", uname);
1051
1052 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1053
1054 centry_free(centry);
1055 }
1056
1057 /***************************************************************************
1058 ***************************************************************************/
1059
1060 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1061 struct winbindd_domain *domain,
1062 const char *name, char **alias )
1063 {
1064 struct winbind_cache *cache = get_cache(domain);
1065 struct cache_entry *centry = NULL;
1066 NTSTATUS status;
1067 char *upper_name;
1068
1069 if ( domain->internal )
1070 return NT_STATUS_NOT_SUPPORTED;
1071
1072 if (!cache->tdb)
1073 goto do_query;
1074
1075 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1076 return NT_STATUS_NO_MEMORY;
1077 strupper_m(upper_name);
1078
1079 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1080
1081 SAFE_FREE( upper_name );
1082
1083 if (!centry)
1084 goto do_query;
1085
1086 status = centry->status;
1087
1088 if (!NT_STATUS_IS_OK(status)) {
1089 centry_free(centry);
1090 return status;
1091 }
1092
1093 *alias = centry_string( centry, mem_ctx );
1094
1095 centry_free(centry);
1096
1097 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1098 name, *alias ? *alias : "(none)"));
1099
1100 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1101
1102 do_query:
1103
1104 /* If its not in cache and we are offline, then fail */
1105
1106 if ( get_global_winbindd_state_offline() || !domain->online ) {
1107 DEBUG(8,("resolve_username_to_alias: rejecting query "
1108 "in offline mode\n"));
1109 return NT_STATUS_NOT_FOUND;
1110 }
1111
1112 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1113
1114 if ( NT_STATUS_IS_OK( status ) ) {
1115 wcache_save_username_alias(domain, status, name, *alias);
1116 }
1117
1118 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1119 wcache_save_username_alias(domain, status, name, "(NULL)");
1120 }
1121
1122 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1123 nt_errstr(status)));
1124
1125 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1126 set_domain_offline( domain );
1127 }
1128
1129 return status;
1130 }
1131
1132 /***************************************************************************
1133 ***************************************************************************/
1134
1135 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1136 struct winbindd_domain *domain,
1137 const char *alias, char **name )
1138 {
1139 struct winbind_cache *cache = get_cache(domain);
1140 struct cache_entry *centry = NULL;
1141 NTSTATUS status;
1142 char *upper_name;
1143
1144 if ( domain->internal )
1145 return NT_STATUS_NOT_SUPPORTED;
1146
1147 if (!cache->tdb)
1148 goto do_query;
1149
1150 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1151 return NT_STATUS_NO_MEMORY;
1152 strupper_m(upper_name);
1153
1154 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1155
1156 SAFE_FREE( upper_name );
1157
1158 if (!centry)
1159 goto do_query;
1160
1161 status = centry->status;
1162
1163 if (!NT_STATUS_IS_OK(status)) {
1164 centry_free(centry);
1165 return status;
1166 }
1167
1168 *name = centry_string( centry, mem_ctx );
1169
1170 centry_free(centry);
1171
1172 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1173 alias, *name ? *name : "(none)"));
1174
1175 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1176
1177 do_query:
1178
1179 /* If its not in cache and we are offline, then fail */
1180
1181 if ( get_global_winbindd_state_offline() || !domain->online ) {
1182 DEBUG(8,("resolve_alias_to_username: rejecting query "
1183 "in offline mode\n"));
1184 return NT_STATUS_NOT_FOUND;
1185 }
1186
1187 /* an alias cannot contain a domain prefix or '@' */
1188
1189 if (strchr(alias, '\\') || strchr(alias, '@')) {
1190 DEBUG(10,("resolve_alias_to_username: skipping fully "
1191 "qualified name %s\n", alias));
1192 return NT_STATUS_OBJECT_NAME_INVALID;
1193 }
1194
1195 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1196
1197 if ( NT_STATUS_IS_OK( status ) ) {
1198 wcache_save_alias_username( domain, status, alias, *name );
1199 }
1200
1201 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1202 wcache_save_alias_username(domain, status, alias, "(NULL)");
1203 }
1204
1205 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1206 nt_errstr(status)));
1207
1208 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1209 set_domain_offline( domain );
1210 }
1211
1212 return status;
1213 }
1214
1215 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1216 {
1217 struct winbind_cache *cache = get_cache(domain);
1218 TDB_DATA data;
1219 fstring key_str, tmp;
1220 uint32 rid;
1221
1222 if (!cache->tdb) {
1223 return NT_STATUS_INTERNAL_DB_ERROR;
1224 }
1225
1226 if (is_null_sid(sid)) {
1227 return NT_STATUS_INVALID_SID;
1228 }
1229
1230 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1231 return NT_STATUS_INVALID_SID;
1232 }
1233
1234 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1235
1236 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1237 if (!data.dptr) {
1238 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1239 }
1240
1241 SAFE_FREE(data.dptr);
1242 return NT_STATUS_OK;
1243 }
1244
1245 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1246 as new salted ones. */
1247
1248 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1249 TALLOC_CTX *mem_ctx,
1250 const DOM_SID *sid,
1251 const uint8 **cached_nt_pass,
1252 const uint8 **cached_salt)
1253 {
1254 struct winbind_cache *cache = get_cache(domain);
1255 struct cache_entry *centry = NULL;
1256 NTSTATUS status;
1257 time_t t;
1258 uint32 rid;
1259 fstring tmp;
1260
1261 if (!cache->tdb) {
1262 return NT_STATUS_INTERNAL_DB_ERROR;
1263 }
1264
1265 if (is_null_sid(sid)) {
1266 return NT_STATUS_INVALID_SID;
1267 }
1268
1269 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1270 return NT_STATUS_INVALID_SID;
1271 }
1272
1273 /* Try and get a salted cred first. If we can't
1274 fall back to an unsalted cred. */
1275
1276 centry = wcache_fetch(cache, domain, "CRED/%s",
1277 sid_to_fstring(tmp, sid));
1278 if (!centry) {
1279 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1280 sid_string_dbg(sid)));
1281 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1282 }
1283
1284 t = centry_time(centry);
1285
1286 /* In the salted case this isn't actually the nt_hash itself,
1287 but the MD5 of the salt + nt_hash. Let the caller
1288 sort this out. It can tell as we only return the cached_salt
1289 if we are returning a salted cred. */
1290
1291 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1292 if (*cached_nt_pass == NULL) {
1293 fstring sidstr;
1294
1295 sid_to_fstring(sidstr, sid);
1296
1297 /* Bad (old) cred cache. Delete and pretend we
1298 don't have it. */
1299 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1300 sidstr));
1301 wcache_delete("CRED/%s", sidstr);
1302 centry_free(centry);
1303 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1304 }
1305
1306 /* We only have 17 bytes more data in the salted cred case. */
1307 if (centry->len - centry->ofs == 17) {
1308 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1309 } else {
1310 *cached_salt = NULL;
1311 }
1312
1313 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1314 if (*cached_salt) {
1315 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1316 }
1317
1318 status = centry->status;
1319
1320 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1321 sid_string_dbg(sid), nt_errstr(status) ));
1322
1323 centry_free(centry);
1324 return status;
1325 }
1326
1327 /* Store creds for a SID - only writes out new salted ones. */
1328
1329 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1330 TALLOC_CTX *mem_ctx,
1331 const DOM_SID *sid,
1332 const uint8 nt_pass[NT_HASH_LEN])
1333 {
1334 struct cache_entry *centry;
1335 fstring sid_string;
1336 uint32 rid;
1337 uint8 cred_salt[NT_HASH_LEN];
1338 uint8 salted_hash[NT_HASH_LEN];
1339
1340 if (is_null_sid(sid)) {
1341 return NT_STATUS_INVALID_SID;
1342 }
1343
1344 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1345 return NT_STATUS_INVALID_SID;
1346 }
1347
1348 centry = centry_start(domain, NT_STATUS_OK);
1349 if (!centry) {
1350 return NT_STATUS_INTERNAL_DB_ERROR;
1351 }
1352
1353 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1354
1355 centry_put_time(centry, time(NULL));
1356
1357 /* Create a salt and then salt the hash. */
1358 generate_random_buffer(cred_salt, NT_HASH_LEN);
1359 E_md5hash(cred_salt, nt_pass, salted_hash);
1360
1361 centry_put_hash16(centry, salted_hash);
1362 centry_put_hash16(centry, cred_salt);
1363 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1364
1365 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1366
1367 centry_free(centry);
1368
1369 return NT_STATUS_OK;
1370 }
1371
1372
1373 /* Query display info. This is the basic user list fn */
1374 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1375 TALLOC_CTX *mem_ctx,
1376 uint32 *num_entries,
1377 struct wbint_userinfo **info)
1378 {
1379 struct winbind_cache *cache = get_cache(domain);
1380 struct cache_entry *centry = NULL;
1381 NTSTATUS status;
1382 unsigned int i, retry;
1383
1384 if (!cache->tdb)
1385 goto do_query;
1386
1387 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1388 if (!centry)
1389 goto do_query;
1390
1391 *num_entries = centry_uint32(centry);
1392
1393 if (*num_entries == 0)
1394 goto do_cached;
1395
1396 (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1397 if (! (*info)) {
1398 smb_panic_fn("query_user_list out of memory");
1399 }
1400 for (i=0; i<(*num_entries); i++) {
1401 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1402 (*info)[i].full_name = centry_string(centry, mem_ctx);
1403 (*info)[i].homedir = centry_string(centry, mem_ctx);
1404 (*info)[i].shell = centry_string(centry, mem_ctx);
1405 centry_sid(centry, &(*info)[i].user_sid);
1406 centry_sid(centry, &(*info)[i].group_sid);
1407 }
1408
1409 do_cached:
1410 status = centry->status;
1411
1412 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1413 domain->name, nt_errstr(status) ));
1414
1415 centry_free(centry);
1416 return status;
1417
1418 do_query:
1419 *num_entries = 0;
1420 *info = NULL;
1421
1422 /* Return status value returned by seq number check */
1423
1424 if (!NT_STATUS_IS_OK(domain->last_status))
1425 return domain->last_status;
1426
1427 /* Put the query_user_list() in a retry loop. There appears to be
1428 * some bug either with Windows 2000 or Samba's handling of large
1429 * rpc replies. This manifests itself as sudden disconnection
1430 * at a random point in the enumeration of a large (60k) user list.
1431 * The retry loop simply tries the operation again. )-: It's not
1432 * pretty but an acceptable workaround until we work out what the
1433 * real problem is. */
1434
1435 retry = 0;
1436 do {
1437
1438 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1439 domain->name ));
1440
1441 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1442 if (!NT_STATUS_IS_OK(status)) {
1443 DEBUG(3, ("query_user_list: returned 0x%08x, "
1444 "retrying\n", NT_STATUS_V(status)));
1445 }
1446 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1447 DEBUG(3, ("query_user_list: flushing "
1448 "connection cache\n"));
1449 invalidate_cm_connection(&domain->conn);
1450 }
1451
1452 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1453 (retry++ < 5));
1454
1455 /* and save it */
1456 refresh_sequence_number(domain, false);
1457 centry = centry_start(domain, status);
1458 if (!centry)
1459 goto skip_save;
1460 centry_put_uint32(centry, *num_entries);
1461 for (i=0; i<(*num_entries); i++) {
1462 centry_put_string(centry, (*info)[i].acct_name);
1463 centry_put_string(centry, (*info)[i].full_name);
1464 centry_put_string(centry, (*info)[i].homedir);
1465 centry_put_string(centry, (*info)[i].shell);
1466 centry_put_sid(centry, &(*info)[i].user_sid);
1467 centry_put_sid(centry, &(*info)[i].group_sid);
1468 if (domain->backend && domain->backend->consistent) {
1469 /* when the backend is consistent we can pre-prime some mappings */
1470 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1471 domain->name,
1472 (*info)[i].acct_name,
1473 &(*info)[i].user_sid,
1474 SID_NAME_USER);
1475 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1476 &(*info)[i].user_sid,
1477 domain->name,
1478 (*info)[i].acct_name,
1479 SID_NAME_USER);
1480 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1481 }
1482 }
1483 centry_end(centry, "UL/%s", domain->name);
1484 centry_free(centry);
1485
1486 skip_save:
1487 return status;
1488 }
1489
1490 /* list all domain groups */
1491 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1492 TALLOC_CTX *mem_ctx,
1493 uint32 *num_entries,
1494 struct acct_info **info)
1495 {
1496 struct winbind_cache *cache = get_cache(domain);
1497 struct cache_entry *centry = NULL;
1498 NTSTATUS status;
1499 unsigned int i;
1500
1501 if (!cache->tdb)
1502 goto do_query;
1503
1504 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1505 if (!centry)
1506 goto do_query;
1507
1508 *num_entries = centry_uint32(centry);
1509
1510 if (*num_entries == 0)
1511 goto do_cached;
1512
1513 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1514 if (! (*info)) {
1515 smb_panic_fn("enum_dom_groups out of memory");
1516 }
1517 for (i=0; i<(*num_entries); i++) {
1518 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1519 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1520 (*info)[i].rid = centry_uint32(centry);
1521 }
1522
1523 do_cached:
1524 status = centry->status;
1525
1526 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1527 domain->name, nt_errstr(status) ));
1528
1529 centry_free(centry);
1530 return status;
1531
1532 do_query:
1533 *num_entries = 0;
1534 *info = NULL;
1535
1536 /* Return status value returned by seq number check */
1537
1538 if (!NT_STATUS_IS_OK(domain->last_status))
1539 return domain->last_status;
1540
1541 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1542 domain->name ));
1543
1544 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1545
1546 /* and save it */
1547 refresh_sequence_number(domain, false);
1548 centry = centry_start(domain, status);
1549 if (!centry)
1550 goto skip_save;
1551 centry_put_uint32(centry, *num_entries);
1552 for (i=0; i<(*num_entries); i++) {
1553 centry_put_string(centry, (*info)[i].acct_name);
1554 centry_put_string(centry, (*info)[i].acct_desc);
1555 centry_put_uint32(centry, (*info)[i].rid);
1556 }
1557 centry_end(centry, "GL/%s/domain", domain->name);
1558 centry_free(centry);
1559
1560 skip_save:
1561 return status;
1562 }
1563
1564 /* list all domain groups */
1565 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1566 TALLOC_CTX *mem_ctx,
1567 uint32 *num_entries,
1568 struct acct_info **info)
1569 {
1570 struct winbind_cache *cache = get_cache(domain);
1571 struct cache_entry *centry = NULL;
1572 NTSTATUS status;
1573 unsigned int i;
1574
1575 if (!cache->tdb)
1576 goto do_query;
1577
1578 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1579 if (!centry)
1580 goto do_query;
1581
1582 *num_entries = centry_uint32(centry);
1583
1584 if (*num_entries == 0)
1585 goto do_cached;
1586
1587 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1588 if (! (*info)) {
1589 smb_panic_fn("enum_dom_groups out of memory");
1590 }
1591 for (i=0; i<(*num_entries); i++) {
1592 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1593 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1594 (*info)[i].rid = centry_uint32(centry);
1595 }
1596
1597 do_cached:
1598
1599 /* If we are returning cached data and the domain controller
1600 is down then we don't know whether the data is up to date
1601 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1602 indicate this. */
1603
1604 if (wcache_server_down(domain)) {
1605 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1606 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1607 } else
1608 status = centry->status;
1609
1610 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1611 domain->name, nt_errstr(status) ));
1612
1613 centry_free(centry);
1614 return status;
1615
1616 do_query:
1617 *num_entries = 0;
1618 *info = NULL;
1619
1620 /* Return status value returned by seq number check */
1621
1622 if (!NT_STATUS_IS_OK(domain->last_status))
1623 return domain->last_status;
1624
1625 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1626 domain->name ));
1627
1628 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1629
1630 /* and save it */
1631 refresh_sequence_number(domain, false);
1632 centry = centry_start(domain, status);
1633 if (!centry)
1634 goto skip_save;
1635 centry_put_uint32(centry, *num_entries);
1636 for (i=0; i<(*num_entries); i++) {
1637 centry_put_string(centry, (*info)[i].acct_name);
1638 centry_put_string(centry, (*info)[i].acct_desc);
1639 centry_put_uint32(centry, (*info)[i].rid);
1640 }
1641 centry_end(centry, "GL/%s/local", domain->name);
1642 centry_free(centry);
1643
1644 skip_save:
1645 return status;
1646 }
1647
1648 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1649 const char *domain_name,
1650 const char *name,
1651 struct dom_sid *sid,
1652 enum lsa_SidType *type)
1653 {
1654 struct winbind_cache *cache = get_cache(domain);
1655 struct cache_entry *centry;
1656 NTSTATUS status;
1657 char *uname;
1658
1659 if (cache->tdb == NULL) {
1660 return NT_STATUS_NOT_FOUND;
1661 }
1662
1663 uname = talloc_strdup_upper(talloc_tos(), name);
1664 if (uname == NULL) {
1665 return NT_STATUS_NO_MEMORY;
1666 }
1667
1668 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1669 TALLOC_FREE(uname);
1670 if (centry == NULL) {
1671 return NT_STATUS_NOT_FOUND;
1672 }
1673
1674 status = centry->status;
1675 if (NT_STATUS_IS_OK(status)) {
1676 *type = (enum lsa_SidType)centry_uint32(centry);
1677 centry_sid(centry, sid);
1678 }
1679
1680 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1681 "%s\n", domain->name, nt_errstr(status) ));
1682
1683 centry_free(centry);
1684 return status;
1685 }
1686
1687 /* convert a single name to a sid in a domain */
1688 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1689 TALLOC_CTX *mem_ctx,
1690 const char *domain_name,
1691 const char *name,
1692 uint32_t flags,
1693 DOM_SID *sid,
1694 enum lsa_SidType *type)
1695 {
1696 NTSTATUS status;
1697
1698 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1699 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1700 return status;
1701 }
1702
1703 ZERO_STRUCTP(sid);
1704
1705 /* If the seq number check indicated that there is a problem
1706 * with this DC, then return that status... except for
1707 * access_denied. This is special because the dc may be in
1708 * "restrict anonymous = 1" mode, in which case it will deny
1709 * most unauthenticated operations, but *will* allow the LSA
1710 * name-to-sid that we try as a fallback. */
1711
1712 if (!(NT_STATUS_IS_OK(domain->last_status)
1713 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1714 return domain->last_status;
1715
1716 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1717 domain->name ));
1718
1719 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1720 name, flags, sid, type);
1721
1722 /* and save it */
1723 refresh_sequence_number(domain, false);
1724
1725 if (domain->online &&
1726 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1727 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1728
1729 /* Only save the reverse mapping if this was not a UPN */
1730 if (!strchr(name, '@')) {
1731 strupper_m(CONST_DISCARD(char *,domain_name));
1732 strlower_m(CONST_DISCARD(char *,name));
1733 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1734 }
1735 }
1736
1737 return status;
1738 }
1739
1740 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1741 const struct dom_sid *sid,
1742 TALLOC_CTX *mem_ctx,
1743 char **domain_name,
1744 char **name,
1745 enum lsa_SidType *type)
1746 {
1747 struct winbind_cache *cache = get_cache(domain);
1748 struct cache_entry *centry;
1749 char *sid_string;
1750 NTSTATUS status;
1751
1752 if (cache->tdb == NULL) {
1753 return NT_STATUS_NOT_FOUND;
1754 }
1755
1756 sid_string = sid_string_tos(sid);
1757 if (sid_string == NULL) {
1758 return NT_STATUS_NO_MEMORY;
1759 }
1760
1761 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1762 TALLOC_FREE(sid_string);
1763 if (centry == NULL) {
1764 return NT_STATUS_NOT_FOUND;
1765 }
1766
1767 if (NT_STATUS_IS_OK(centry->status)) {
1768 *type = (enum lsa_SidType)centry_uint32(centry);
1769 *domain_name = centry_string(centry, mem_ctx);
1770 *name = centry_string(centry, mem_ctx);
1771 }
1772
1773 status = centry->status;
1774 centry_free(centry);
1775
1776 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1777 "%s\n", domain->name, nt_errstr(status) ));
1778
1779 return status;
1780 }
1781
1782 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1783 given */
1784 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1785 TALLOC_CTX *mem_ctx,
1786 const DOM_SID *sid,
1787 char **domain_name,
1788 char **name,
1789 enum lsa_SidType *type)
1790 {
1791 NTSTATUS status;
1792
1793 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1794 type);
1795 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1796 return status;
1797 }
1798
1799 *name = NULL;
1800 *domain_name = NULL;
1801
1802 /* If the seq number check indicated that there is a problem
1803 * with this DC, then return that status... except for
1804 * access_denied. This is special because the dc may be in
1805 * "restrict anonymous = 1" mode, in which case it will deny
1806 * most unauthenticated operations, but *will* allow the LSA
1807 * sid-to-name that we try as a fallback. */
1808
1809 if (!(NT_STATUS_IS_OK(domain->last_status)
1810 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1811 return domain->last_status;
1812
1813 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1814 domain->name ));
1815
1816 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1817
1818 /* and save it */
1819 refresh_sequence_number(domain, false);
1820 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1821
1822 /* We can't save the name to sid mapping here, as with sid history a
1823 * later name2sid would give the wrong sid. */
1824
1825 return status;
1826 }
1827
1828 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1829 TALLOC_CTX *mem_ctx,
1830 const DOM_SID *domain_sid,
1831 uint32 *rids,
1832 size_t num_rids,
1833 char **domain_name,
1834 char ***names,
1835 enum lsa_SidType **types)
1836 {
1837 struct winbind_cache *cache = get_cache(domain);
1838 size_t i;
1839 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1840 bool have_mapped;
1841 bool have_unmapped;
1842
1843 *domain_name = NULL;
1844 *names = NULL;
1845 *types = NULL;
1846
1847 if (!cache->tdb) {
1848 goto do_query;
1849 }
1850
1851 if (num_rids == 0) {
1852 return NT_STATUS_OK;
1853 }
1854
1855 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1856 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1857
1858 if ((*names == NULL) || (*types == NULL)) {
1859 result = NT_STATUS_NO_MEMORY;
1860 goto error;
1861 }
1862
1863 have_mapped = have_unmapped = false;
1864
1865 for (i=0; i<num_rids; i++) {
1866 DOM_SID sid;
1867 struct cache_entry *centry;
1868 fstring tmp;
1869
1870 if (!sid_compose(&sid, domain_sid, rids[i])) {
1871 result = NT_STATUS_INTERNAL_ERROR;
1872 goto error;
1873 }
1874
1875 centry = wcache_fetch(cache, domain, "SN/%s",
1876 sid_to_fstring(tmp, &sid));
1877 if (!centry) {
1878 goto do_query;
1879 }
1880
1881 (*types)[i] = SID_NAME_UNKNOWN;
1882 (*names)[i] = talloc_strdup(*names, "");
1883
1884 if (NT_STATUS_IS_OK(centry->status)) {
1885 char *dom;
1886 have_mapped = true;
1887 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1888
1889 dom = centry_string(centry, mem_ctx);
1890 if (*domain_name == NULL) {
1891 *domain_name = dom;
1892 } else {
1893 talloc_free(dom);
1894 }
1895
1896 (*names)[i] = centry_string(centry, *names);
1897
1898 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1899 have_unmapped = true;
1900
1901 } else {
1902 /* something's definitely wrong */
1903 result = centry->status;
1904 goto error;
1905 }
1906
1907 centry_free(centry);
1908 }
1909
1910 if (!have_mapped) {
1911 return NT_STATUS_NONE_MAPPED;
1912 }
1913 if (!have_unmapped) {
1914 return NT_STATUS_OK;
1915 }
1916 return STATUS_SOME_UNMAPPED;
1917
1918 do_query:
1919
1920 TALLOC_FREE(*names);
1921 TALLOC_FREE(*types);
1922
1923 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1924 rids, num_rids, domain_name,
1925 names, types);
1926
1927 /*
1928 None of the queried rids has been found so save all negative entries
1929 */
1930 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1931 for (i = 0; i < num_rids; i++) {
1932 DOM_SID sid;
1933 const char *name = "";
1934 const enum lsa_SidType type = SID_NAME_UNKNOWN;
1935 NTSTATUS status = NT_STATUS_NONE_MAPPED;
1936
1937 if (!sid_compose(&sid, domain_sid, rids[i])) {
1938 return NT_STATUS_INTERNAL_ERROR;
1939 }
1940
1941 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1942 name, type);
1943 }
1944
1945 return result;
1946 }
1947
1948 /*
1949 Some or all of the queried rids have been found.
1950 */
1951 if (!NT_STATUS_IS_OK(result) &&
1952 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1953 return result;
1954 }
1955
1956 refresh_sequence_number(domain, false);
1957
1958 for (i=0; i<num_rids; i++) {
1959 DOM_SID sid;
1960 NTSTATUS status;
1961
1962 if (!sid_compose(&sid, domain_sid, rids[i])) {
1963 result = NT_STATUS_INTERNAL_ERROR;
1964 goto error;
1965 }
1966
1967 status = (*types)[i] == SID_NAME_UNKNOWN ?
1968 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1969
1970 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1971 (*names)[i], (*types)[i]);
1972 }
1973
1974 return result;
1975
1976 error:
1977 TALLOC_FREE(*names);
1978 TALLOC_FREE(*types);
1979 return result;
1980 }
1981
1982 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
1983 TALLOC_CTX *mem_ctx,
1984 const struct dom_sid *user_sid,
1985 struct wbint_userinfo *info)
1986 {
1987 struct winbind_cache *cache = get_cache(domain);
1988 struct cache_entry *centry = NULL;
1989 NTSTATUS status;
1990 char *sid_string;
1991
1992 if (cache->tdb == NULL) {
1993 return NT_STATUS_NOT_FOUND;
1994 }
1995
1996 sid_string = sid_string_tos(user_sid);
1997 if (sid_string == NULL) {
1998 return NT_STATUS_NO_MEMORY;
1999 }
2000
2001 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2002 TALLOC_FREE(sid_string);
2003 if (centry == NULL) {
2004 return NT_STATUS_NOT_FOUND;
2005 }
2006
2007 /*
2008 * If we have an access denied cache entry and a cached info3
2009 * in the samlogon cache then do a query. This will force the
2010 * rpc back end to return the info3 data.
2011 */
2012
2013 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2014 netsamlogon_cache_have(user_sid)) {
2015 DEBUG(10, ("query_user: cached access denied and have cached "
2016 "info3\n"));
2017 domain->last_status = NT_STATUS_OK;
2018 centry_free(centry);
2019 return NT_STATUS_NOT_FOUND;
2020 }
2021
2022 /* if status is not ok then this is a negative hit
2023 and the rest of the data doesn't matter */
2024 status = centry->status;
2025 if (NT_STATUS_IS_OK(status)) {
2026 info->acct_name = centry_string(centry, mem_ctx);
2027 info->full_name = centry_string(centry, mem_ctx);
2028 info->homedir = centry_string(centry, mem_ctx);
2029 info->shell = centry_string(centry, mem_ctx);
2030 info->primary_gid = centry_uint32(centry);
2031 centry_sid(centry, &info->user_sid);
2032 centry_sid(centry, &info->group_sid);
2033 }
2034
2035 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2036 "%s\n", domain->name, nt_errstr(status) ));
2037
2038 centry_free(centry);
2039 return status;
2040 }
2041
2042 /* Lookup user information from a rid */
2043 static NTSTATUS query_user(struct winbindd_domain *domain,
2044 TALLOC_CTX *mem_ctx,
2045 const DOM_SID *user_sid,
2046 struct wbint_userinfo *info)
2047 {
2048 NTSTATUS status;
2049
2050 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2051 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2052 return status;
2053 }
2054
2055 ZERO_STRUCTP(info);
2056
2057 /* Return status value returned by seq number check */
2058
2059 if (!NT_STATUS_IS_OK(domain->last_status))
2060 return domain->last_status;
2061
2062 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2063 domain->name ));
2064
2065 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2066
2067 /* and save it */
2068 refresh_sequence_number(domain, false);
2069 wcache_save_user(domain, status, info);
2070
2071 return status;
2072 }
2073
2074 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2075 TALLOC_CTX *mem_ctx,
2076 const struct dom_sid *user_sid,
2077 uint32_t *pnum_sids,
2078 struct dom_sid **psids)
2079 {
2080 struct winbind_cache *cache = get_cache(domain);
2081 struct cache_entry *centry = NULL;
2082 NTSTATUS status;
2083 uint32_t i, num_sids;
2084 struct dom_sid *sids;
2085 fstring sid_string;
2086
2087 if (cache->tdb == NULL) {
2088 return NT_STATUS_NOT_FOUND;
2089 }
2090
2091 centry = wcache_fetch(cache, domain, "UG/%s",
2092 sid_to_fstring(sid_string, user_sid));
2093 if (centry == NULL) {
2094 return NT_STATUS_NOT_FOUND;
2095 }
2096
2097 /* If we have an access denied cache entry and a cached info3 in the
2098 samlogon cache then do a query. This will force the rpc back end
2099 to return the info3 data. */
2100
2101 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2102 && netsamlogon_cache_have(user_sid)) {
2103 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2104 "cached info3\n"));
2105 domain->last_status = NT_STATUS_OK;
2106 centry_free(centry);
2107 return NT_STATUS_NOT_FOUND;
2108 }
2109
2110 num_sids = centry_uint32(centry);
2111 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2112 if (sids == NULL) {
2113 return NT_STATUS_NO_MEMORY;
2114 }
2115
2116 for (i=0; i<num_sids; i++) {
2117 centry_sid(centry, &sids[i]);
2118 }
2119
2120 status = centry->status;
2121
2122 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2123 "status: %s\n", domain->name, nt_errstr(status)));
2124
2125 centry_free(centry);
2126
2127 *pnum_sids = num_sids;
2128 *psids = sids;
2129 return status;
2130 }
2131
2132 /* Lookup groups a user is a member of. */
2133 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2134 TALLOC_CTX *mem_ctx,
2135 const DOM_SID *user_sid,
2136 uint32 *num_groups, DOM_SID **user_gids)
2137 {
2138 struct cache_entry *centry = NULL;
2139 NTSTATUS status;
2140 unsigned int i;
2141 fstring sid_string;
2142
2143 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2144 num_groups, user_gids);
2145 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2146 return status;
2147 }
2148
2149 (*num_groups) = 0;
2150 (*user_gids) = NULL;
2151
2152 /* Return status value returned by seq number check */
2153
2154 if (!NT_STATUS_IS_OK(domain->last_status))
2155 return domain->last_status;
2156
2157 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2158 domain->name ));
2159
2160 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2161
2162 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2163 goto skip_save;
2164
2165 /* and save it */
2166 refresh_sequence_number(domain, false);
2167 centry = centry_start(domain, status);
2168 if (!centry)
2169 goto skip_save;
2170
2171 centry_put_uint32(centry, *num_groups);
2172 for (i=0; i<(*num_groups); i++) {
2173 centry_put_sid(centry, &(*user_gids)[i]);
2174 }
2175
2176 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2177 centry_free(centry);
2178
2179 skip_save:
2180 return status;
2181 }
2182
2183 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2184 const struct dom_sid *sids)
2185 {
2186 uint32_t i;
2187 char *sidlist;
2188
2189 sidlist = talloc_strdup(mem_ctx, "");
2190 if (sidlist == NULL) {
2191 return NULL;
2192 }
2193 for (i=0; i<num_sids; i++) {
2194 fstring tmp;
2195 sidlist = talloc_asprintf_append_buffer(
2196 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2197 if (sidlist == NULL) {
2198 return NULL;
2199 }
2200 }
2201 return sidlist;
2202 }
2203
2204 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2205 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2206 const struct dom_sid *sids,
2207 uint32_t *pnum_aliases, uint32_t **paliases)
2208 {
2209 struct winbind_cache *cache = get_cache(domain);
2210 struct cache_entry *centry = NULL;
2211 uint32_t num_aliases;
2212 uint32_t *aliases;
2213 NTSTATUS status;
2214 char *sidlist;
2215 int i;
2216
2217 if (cache->tdb == NULL) {
2218 return NT_STATUS_NOT_FOUND;
2219 }
2220
2221 if (num_sids == 0) {
2222 *pnum_aliases = 0;
2223 *paliases = NULL;
2224 return NT_STATUS_OK;
2225 }
2226
2227 /* We need to cache indexed by the whole list of SIDs, the aliases
2228 * resulting might come from any of the SIDs. */
2229
2230 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2231 if (sidlist == NULL) {
2232 return NT_STATUS_NO_MEMORY;
2233 }
2234
2235 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2236 TALLOC_FREE(sidlist);
2237 if (centry == NULL) {
2238 return NT_STATUS_NOT_FOUND;
2239 }
2240
2241 num_aliases = centry_uint32(centry);
2242 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2243 if (aliases == NULL) {
2244 centry_free(centry);
2245 return NT_STATUS_NO_MEMORY;
2246 }
2247
2248 for (i=0; i<num_aliases; i++) {
2249 aliases[i] = centry_uint32(centry);
2250 }
2251
2252 status = centry->status;
2253
2254 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2255 "status %s\n", domain->name, nt_errstr(status)));
2256
2257 centry_free(centry);
2258
2259 *pnum_aliases = num_aliases;
2260 *paliases = aliases;
2261
2262 return status;
2263 }
2264
2265 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2266 TALLOC_CTX *mem_ctx,
2267 uint32 num_sids, const DOM_SID *sids,
2268 uint32 *num_aliases, uint32 **alias_rids)
2269 {
2270 struct cache_entry *centry = NULL;
2271 NTSTATUS status;
2272 char *sidlist;
2273 int i;
2274
2275 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2276 num_aliases, alias_rids);
2277 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2278 return status;
2279 }
2280
2281 (*num_aliases) = 0;
2282 (*alias_rids) = NULL;
2283
2284 if (!NT_STATUS_IS_OK(domain->last_status))
2285 return domain->last_status;
2286
2287 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2288 "for domain %s\n", domain->name ));
2289
2290 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2291 if (sidlist == NULL) {
2292 return NT_STATUS_NO_MEMORY;
2293 }
2294
2295 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2296 num_sids, sids,
2297 num_aliases, alias_rids);
2298
2299 /* and save it */
2300 refresh_sequence_number(domain, false);
2301 centry = centry_start(domain, status);
2302 if (!centry)
2303 goto skip_save;
2304 centry_put_uint32(centry, *num_aliases);
2305 for (i=0; i<(*num_aliases); i++)
2306 centry_put_uint32(centry, (*alias_rids)[i]);
2307 centry_end(centry, "UA%s", sidlist);
2308 centry_free(centry);
2309
2310 skip_save:
2311 return status;
2312 }
2313
2314 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2315 TALLOC_CTX *mem_ctx,
2316 const struct dom_sid *group_sid,
2317 uint32_t *num_names,
2318 struct dom_sid **sid_mem, char ***names,
2319 uint32_t **name_types)
2320 {
2321 struct winbind_cache *cache = get_cache(domain);
2322 struct cache_entry *centry = NULL;
2323 NTSTATUS status;
2324 unsigned int i;
2325 char *sid_string;
2326
2327 if (cache->tdb == NULL) {
2328 return NT_STATUS_NOT_FOUND;
2329 }
2330
2331 sid_string = sid_string_tos(group_sid);
2332 if (sid_string == NULL) {
2333 return NT_STATUS_NO_MEMORY;
2334 }
2335
2336 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2337 TALLOC_FREE(sid_string);
2338 if (centry == NULL) {
2339 return NT_STATUS_NOT_FOUND;
2340 }
2341
2342 *sid_mem = NULL;
2343 *names = NULL;
2344 *name_types = NULL;
2345
2346 *num_names = centry_uint32(centry);
2347 if (*num_names == 0) {
2348 centry_free(centry);
2349 return NT_STATUS_OK;
2350 }
2351
2352 *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2353 *names = talloc_array(mem_ctx, char *, *num_names);
2354 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2355
2356 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2357 TALLOC_FREE(*sid_mem);
2358 TALLOC_FREE(*names);
2359 TALLOC_FREE(*name_types);
2360 centry_free(centry);
2361 return NT_STATUS_NO_MEMORY;
2362 }
2363
2364 for (i=0; i<(*num_names); i++) {
2365 centry_sid(centry, &(*sid_mem)[i]);
2366 (*names)[i] = centry_string(centry, mem_ctx);
2367 (*name_types)[i] = centry_uint32(centry);
2368 }
2369
2370 status = centry->status;
2371
2372 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2373 "status: %s\n", domain->name, nt_errstr(status)));
2374
2375 centry_free(centry);
2376 return status;
2377 }
2378
2379 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2380 TALLOC_CTX *mem_ctx,
2381 const DOM_SID *group_sid,
2382 enum lsa_SidType type,
2383 uint32 *num_names,
2384 DOM_SID **sid_mem, char ***names,
2385 uint32 **name_types)
2386 {
2387 struct cache_entry *centry = NULL;
2388 NTSTATUS status;
2389 unsigned int i;
2390 fstring sid_string;
2391
2392 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2393 sid_mem, names, name_types);
2394 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2395 return status;
2396 }
2397
2398 (*num_names) = 0;
2399 (*sid_mem) = NULL;
2400 (*names) = NULL;
2401 (*name_types) = NULL;
2402
2403 /* Return status value returned by seq number check */
2404
2405 if (!NT_STATUS_IS_OK(domain->last_status))
2406 return domain->last_status;
2407
2408 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2409 domain->name ));
2410
2411 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2412 type, num_names,
2413 sid_mem, names, name_types);
2414
2415 /* and save it */
2416 refresh_sequence_number(domain, false);
2417 centry = centry_start(domain, status);
2418 if (!centry)
2419 goto skip_save;
2420 centry_put_uint32(centry, *num_names);
2421 for (i=0; i<(*num_names); i++) {
2422 centry_put_sid(centry, &(*sid_mem)[i]);
2423 centry_put_string(centry, (*names)[i]);
2424 centry_put_uint32(centry, (*name_types)[i]);
2425 }
2426 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2427 centry_free(centry);
2428
2429 skip_save:
2430 return status;
2431 }
2432
2433 /* find the sequence number for a domain */
2434 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2435 {
2436 refresh_sequence_number(domain, false);
2437
2438 *seq = domain->sequence_number;
2439
2440 return NT_STATUS_OK;
2441 }
2442
2443 /* enumerate trusted domains
2444 * (we need to have the list of trustdoms in the cache when we go offline) -
2445 * Guenther */
2446 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2447 TALLOC_CTX *mem_ctx,
2448 uint32 *num_domains,
2449 char ***names,
2450 char ***alt_names,
2451 DOM_SID **dom_sids)
2452 {
2453 struct winbind_cache *cache = get_cache(domain);
2454 struct cache_entry *centry = NULL;
2455 NTSTATUS status;
2456 int i;
2457
2458 if (!cache->tdb)
2459 goto do_query;
2460
2461 centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2462
2463 if (!centry) {
2464 goto do_query;
2465 }
2466
2467 *num_domains = centry_uint32(centry);
2468
2469 if (*num_domains) {
2470 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2471 (*alt_names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2472 (*dom_sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2473
2474 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2475 smb_panic_fn("trusted_domains out of memory");
2476 }
2477 } else {
2478 (*names) = NULL;
2479 (*alt_names) = NULL;
2480 (*dom_sids) = NULL;
2481 }
2482
2483 for (i=0; i<(*num_domains); i++) {
2484 (*names)[i] = centry_string(centry, mem_ctx);
2485 (*alt_names)[i] = centry_string(centry, mem_ctx);
2486 if (!centry_sid(centry, &(*dom_sids)[i])) {
2487 sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2488 }
2489 }
2490
2491 status = centry->status;
2492
2493 DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2494 domain->name, *num_domains, nt_errstr(status) ));
2495
2496 centry_free(centry);
2497 return status;
2498
2499 do_query:
2500 (*num_domains) = 0;
2501 (*dom_sids) = NULL;
2502 (*names) = NULL;
2503 (*alt_names) = NULL;
2504
2505 /* Return status value returned by seq number check */
2506
2507 if (!NT_STATUS_IS_OK(domain->last_status))
2508 return domain->last_status;
2509
2510 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2511 domain->name ));
2512
2513 status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2514 names, alt_names, dom_sids);
2515
2516 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2517 * so that the generic centry handling still applies correctly -
2518 * Guenther*/
2519
2520 if (!NT_STATUS_IS_ERR(status)) {
2521 status = NT_STATUS_OK;
2522 }
2523
2524
2525 #if 0 /* Disabled as we want the trust dom list to be managed by
2526 the main parent and always to make the query. --jerry */
2527
2528 /* and save it */
2529 refresh_sequence_number(domain, false);
2530
2531 centry = centry_start(domain, status);
2532 if (!centry)
2533 goto skip_save;
2534
2535 centry_put_uint32(centry, *num_domains);
2536
2537 for (i=0; i<(*num_domains); i++) {
2538 centry_put_string(centry, (*names)[i]);
2539 centry_put_string(centry, (*alt_names)[i]);
2540 centry_put_sid(centry, &(*dom_sids)[i]);
2541 }
2542
2543 centry_end(centry, "TRUSTDOMS/%s", domain->name);
2544
2545 centry_free(centry);
2546
2547 skip_save:
2548 #endif
2549
2550 return status;
2551 }
2552
2553 /* get lockout policy */
2554 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2555 TALLOC_CTX *mem_ctx,
2556 struct samr_DomInfo12 *policy)
2557 {
2558 struct winbind_cache *cache = get_cache(domain);
2559 struct cache_entry *centry = NULL;
2560 NTSTATUS status;
2561
2562 if (!cache->tdb)
2563 goto do_query;
2564
2565 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2566
2567 if (!centry)
2568 goto do_query;
2569
2570 policy->lockout_duration = centry_nttime(centry);
2571 policy->lockout_window = centry_nttime(centry);
2572 policy->lockout_threshold = centry_uint16(centry);
2573
2574 status = centry->status;
2575
2576 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2577 domain->name, nt_errstr(status) ));
2578
2579 centry_free(centry);
2580 return status;
2581
2582 do_query:
2583 ZERO_STRUCTP(policy);
2584
2585 /* Return status value returned by seq number check */
2586
2587 if (!NT_STATUS_IS_OK(domain->last_status))
2588 return domain->last_status;
2589
2590 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2591 domain->name ));
2592
2593 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2594
2595 /* and save it */
2596 refresh_sequence_number(domain, false);
2597 wcache_save_lockout_policy(domain, status, policy);
2598
2599 return status;
2600 }
2601
2602 /* get password policy */
2603 static NTSTATUS password_policy(struct winbindd_domain *domain,
2604 TALLOC_CTX *mem_ctx,
2605 struct samr_DomInfo1 *policy)
2606 {
2607 struct winbind_cache *cache = get_cache(domain);
2608 struct cache_entry *centry = NULL;
2609 NTSTATUS status;
2610
2611 if (!cache->tdb)
2612 goto do_query;
2613
2614 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2615
2616 if (!centry)
2617 goto do_query;
2618
2619 policy->min_password_length = centry_uint16(centry);
2620 policy->password_history_length = centry_uint16(centry);
2621 policy->password_properties = centry_uint32(centry);
2622 policy->max_password_age = centry_nttime(centry);
2623 policy->min_password_age = centry_nttime(centry);
2624
2625 status = centry->status;
2626
2627 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2628 domain->name, nt_errstr(status) ));
2629
2630 centry_free(centry);
2631 return status;
2632
2633 do_query:
2634 ZERO_STRUCTP(policy);
2635
2636 /* Return status value returned by seq number check */
2637
2638 if (!NT_STATUS_IS_OK(domain->last_status))
2639 return domain->last_status;
2640
2641 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2642 domain->name ));
2643
2644 status = domain->backend->password_policy(domain, mem_ctx, policy);
2645
2646 /* and save it */
2647 refresh_sequence_number(domain, false);
2648 if (NT_STATUS_IS_OK(status)) {
2649 wcache_save_password_policy(domain, status, policy);
2650 }
2651
2652 return status;
2653 }
2654
2655
2656 /* Invalidate cached user and group lists coherently */
2657
2658 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2659 void *state)
2660 {
2661 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2662 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2663 tdb_delete(the_tdb, kbuf);
2664
2665 return 0;
2666 }
2667
2668 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2669
2670 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2671 struct netr_SamInfo3 *info3)
2672 {
2673 DOM_SID sid;
2674 fstring key_str, sid_string;
2675 struct winbind_cache *cache;
2676
2677 /* dont clear cached U/SID and UG/SID entries when we want to logon
2678 * offline - gd */
2679
2680 if (lp_winbind_offline_logon()) {
2681 return;
2682 }
2683
2684 if (!domain)
2685 return;
2686
2687 cache = get_cache(domain);
2688
2689 if (!cache->tdb) {
2690 return;
2691 }
2692
2693 sid_copy(&sid, info3->base.domain_sid);
2694 sid_append_rid(&sid, info3->base.rid);
2695
2696 /* Clear U/SID cache entry */
2697 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2698 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2699 tdb_delete(cache->tdb, string_tdb_data(key_str));
2700
2701 /* Clear UG/SID cache entry */
2702 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2703 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2704 tdb_delete(cache->tdb, string_tdb_data(key_str));
2705
2706 /* Samba/winbindd never needs this. */
2707 netsamlogon_clear_cached_user(info3);
2708 }
2709
2710 bool wcache_invalidate_cache(void)
2711 {
2712 struct winbindd_domain *domain;
2713
2714 for (domain = domain_list(); domain; domain = domain->next) {
2715 struct winbind_cache *cache = get_cache(domain);
2716
2717 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2718 "entries for %s\n", domain->name));
2719 if (cache) {
2720 if (cache->tdb) {
2721 tdb_traverse(cache->tdb, traverse_fn, NULL);
2722 } else {
2723 return false;
2724 }
2725 }
2726 }
2727 return true;
2728 }
2729
2730 bool init_wcache(void)
2731 {
2732 if (wcache == NULL) {
2733 wcache = SMB_XMALLOC_P(struct winbind_cache);
2734 ZERO_STRUCTP(wcache);
2735 }
2736
2737 if (wcache->tdb != NULL)
2738 return true;
2739
2740 /* when working offline we must not clear the cache on restart */
2741 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2742 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2743 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2744 O_RDWR|O_CREAT, 0600);
2745
2746 if (wcache->tdb == NULL) {
2747 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2748 return false;
2749 }
2750
2751 return true;
2752 }
2753
2754 /************************************************************************
2755 This is called by the parent to initialize the cache file.
2756 We don't need sophisticated locking here as we know we're the
2757 only opener.
2758 ************************************************************************/
2759
2760 bool initialize_winbindd_cache(void)
2761 {
2762 bool cache_bad = true;
2763 uint32 vers;
2764
2765 if (!init_wcache()) {
2766 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2767 return false;
2768 }
2769
2770 /* Check version number. */
2771 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2772 vers == WINBINDD_CACHE_VERSION) {
2773 cache_bad = false;
2774 }
2775
2776 if (cache_bad) {
2777 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2778 "and re-creating with version number %d\n",
2779 WINBINDD_CACHE_VERSION ));
2780
2781 tdb_close(wcache->tdb);
2782 wcache->tdb = NULL;
2783
2784 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2785 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2786 cache_path("winbindd_cache.tdb"),
2787 strerror(errno) ));
2788 return false;
2789 }
2790 if (!init_wcache()) {
2791 DEBUG(0,("initialize_winbindd_cache: re-initialization "
2792 "init_wcache failed.\n"));
2793 return false;
2794 }
2795
2796 /* Write the version. */
2797 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2798 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2799 tdb_errorstr(wcache->tdb) ));
2800 return false;
2801 }
2802 }
2803
2804 tdb_close(wcache->tdb);
2805 wcache->tdb = NULL;
2806 return true;
2807 }
2808
2809 void close_winbindd_cache(void)
2810 {
2811 if (!wcache) {
2812 return;
2813 }
2814 if (wcache->tdb) {
2815 tdb_close(wcache->tdb);
2816 wcache->tdb = NULL;
2817 }
2818 }
2819
2820 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2821 char **domain_name, char **name,
2822 enum lsa_SidType *type)
2823 {
2824 struct winbindd_domain *domain;
2825 NTSTATUS status;
2826
2827 domain = find_lookup_domain_from_sid(sid);
2828 if (domain == NULL) {
2829 return false;
2830 }
2831 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
2832 type);
2833 return NT_STATUS_IS_OK(status);
2834 }
2835
2836 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2837 const char *domain_name,
2838 const char *name,
2839 DOM_SID *sid,
2840 enum lsa_SidType *type)
2841 {
2842 struct winbindd_domain *domain;
2843 NTSTATUS status;
2844 bool original_online_state;
2845
2846 domain = find_lookup_domain_from_name(domain_name);
2847 if (domain == NULL) {
2848 return false;
2849 }
2850
2851 /* If we are doing a cached logon, temporarily set the domain
2852 offline so the cache won't expire the entry */
2853
2854 original_online_state = domain->online;
2855 domain->online = false;
2856 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
2857 domain->online = original_online_state;
2858
2859 return NT_STATUS_IS_OK(status);
2860 }
2861
2862 void cache_name2sid(struct winbindd_domain *domain,
2863 const char *domain_name, const char *name,
2864 enum lsa_SidType type, const DOM_SID *sid)
2865 {
2866 refresh_sequence_number(domain, false);
2867 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2868 sid, type);
2869 }
2870
2871 /*
2872 * The original idea that this cache only contains centries has
2873 * been blurred - now other stuff gets put in here. Ensure we
2874 * ignore these things on cleanup.
2875 */
2876
2877 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2878 TDB_DATA dbuf, void *state)
2879 {
2880 struct cache_entry *centry;
2881
2882 if (is_non_centry_key(kbuf)) {
2883 return 0;
2884 }
2885
2886 centry = wcache_fetch_raw((char *)kbuf.dptr);
2887 if (!centry) {
2888 return 0;
2889 }
2890
2891 if (!NT_STATUS_IS_OK(centry->status)) {
2892 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2893 tdb_delete(the_tdb, kbuf);
2894 }
2895
2896 centry_free(centry);
2897 return 0;
2898 }
2899
2900 /* flush the cache */
2901 void wcache_flush_cache(void)
2902 {
2903 if (!wcache)
2904 return;
2905 if (wcache->tdb) {
2906 tdb_close(wcache->tdb);
2907 wcache->tdb = NULL;
2908 }
2909 if (!winbindd_use_cache()) {
2910 return;
2911 }
2912
2913 /* when working offline we must not clear the cache on restart */
2914 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2915 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2916 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2917 O_RDWR|O_CREAT, 0600);
2918
2919 if (!wcache->tdb) {
2920 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2921 return;
2922 }
2923
2924 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2925
2926 DEBUG(10,("wcache_flush_cache success\n"));
2927 }
2928
2929 /* Count cached creds */
2930
2931 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2932 void *state)
2933 {
2934 int *cred_count = (int*)state;
2935
2936 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2937 (*cred_count)++;
2938 }
2939 return 0;
2940 }
2941
2942 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2943 {
2944 struct winbind_cache *cache = get_cache(domain);
2945
2946 *count = 0;
2947
2948 if (!cache->tdb) {
2949 return NT_STATUS_INTERNAL_DB_ERROR;
2950 }
2951
2952 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2953
2954 return NT_STATUS_OK;
2955 }
2956
2957 struct cred_list {
2958 struct cred_list *prev, *next;
2959 TDB_DATA key;
2960 fstring name;
2961 time_t created;
2962 };
2963 static struct cred_list *wcache_cred_list;
2964
2965 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2966 void *state)
2967 {
2968 struct cred_list *cred;
2969
2970 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2971
2972 cred = SMB_MALLOC_P(struct cred_list);
2973 if (cred == NULL) {
2974 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2975 return -1;
2976 }
2977
2978 ZERO_STRUCTP(cred);
2979
2980 /* save a copy of the key */
2981
2982 fstrcpy(cred->name, (const char *)kbuf.dptr);
2983 DLIST_ADD(wcache_cred_list, cred);
2984 }
2985
2986 return 0;
2987 }
2988
2989 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2990 {
2991 struct winbind_cache *cache = get_cache(domain);
2992 NTSTATUS status;
2993 int ret;
2994 struct cred_list *cred, *oldest = NULL;
2995
2996 if (!cache->tdb) {
2997 return NT_STATUS_INTERNAL_DB_ERROR;
2998 }
2999
3000 /* we possibly already have an entry */
3001 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3002
3003 fstring key_str, tmp;
3004
3005 DEBUG(11,("we already have an entry, deleting that\n"));
3006
3007 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3008
3009 tdb_delete(cache->tdb, string_tdb_data(key_str));
3010
3011 return NT_STATUS_OK;
3012 }
3013
3014 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3015 if (ret == 0) {
3016 return NT_STATUS_OK;
3017 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3018 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3019 }
3020
3021 ZERO_STRUCTP(oldest);
3022
3023 for (cred = wcache_cred_list; cred; cred = cred->next) {
3024
3025 TDB_DATA data;
3026 time_t t;
3027
3028 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3029 if (!data.dptr) {
3030 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3031 cred->name));
3032 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3033 goto done;
3034 }
3035
3036 t = IVAL(data.dptr, 0);
3037 SAFE_FREE(data.dptr);
3038
3039 if (!oldest) {
3040 oldest = SMB_MALLOC_P(struct cred_list);
3041 if (oldest == NULL) {
3042 status = NT_STATUS_NO_MEMORY;
3043 goto done;
3044 }
3045
3046 fstrcpy(oldest->name, cred->name);
3047 oldest->created = t;
3048 continue;
3049 }
3050
3051 if (t < oldest->created) {
3052 fstrcpy(oldest->name, cred->name);
3053 oldest->created = t;
3054 }
3055 }
3056
3057 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3058 status = NT_STATUS_OK;
3059 } else {
3060 status = NT_STATUS_UNSUCCESSFUL;
3061 }
3062 done:
3063 SAFE_FREE(wcache_cred_list);
3064 SAFE_FREE(oldest);
3065
3066 return status;
3067 }
3068
3069 /* Change the global online/offline state. */
3070 bool set_global_winbindd_state_offline(void)
3071 {
3072 TDB_DATA data;
3073
3074 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3075
3076 /* Only go offline if someone has created
3077 the key "WINBINDD_OFFLINE" in the cache tdb. */
3078
3079 if (wcache == NULL || wcache->tdb == NULL) {
3080 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3081 return false;
3082 }
3083
3084 if (!lp_winbind_offline_logon()) {
3085 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3086 return false;
3087 }
3088
3089 if (global_winbindd_offline_state) {
3090 /* Already offline. */
3091 return true;
3092 }
3093
3094 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3095
3096 if (!data.dptr || data.dsize != 4) {
3097 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3098 SAFE_FREE(data.dptr);
3099 return false;
3100 } else {
3101 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3102 global_winbindd_offline_state = true;
3103 SAFE_FREE(data.dptr);
3104 return true;
3105 }
3106 }
3107
3108 void set_global_winbindd_state_online(void)
3109 {
3110 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3111
3112 if (!lp_winbind_offline_logon()) {
3113 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3114 return;
3115 }
3116
3117 if (!global_winbindd_offline_state) {
3118 /* Already online. */
3119 return;
3120 }
3121 global_winbindd_offline_state = false;
3122
3123 if (!wcache->tdb) {
3124 return;
3125 }
3126
3127 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3128 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3129 }
3130
3131 bool get_global_winbindd_state_offline(void)
3132 {
3133 return global_winbindd_offline_state;
3134 }
3135
3136 /***********************************************************************
3137 Validate functions for all possible cache tdb keys.
3138 ***********************************************************************/
3139
3140 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3141 struct tdb_validation_status *state)
3142 {
3143 struct cache_entry *centry;
3144
3145 centry = SMB_XMALLOC_P(struct cache_entry);
3146 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3147 if (!centry->data) {
3148 SAFE_FREE(centry);
3149 return NULL;
3150 }
3151 centry->len = data.dsize;
3152 centry->ofs = 0;
3153
3154 if (centry->len < 8) {
3155 /* huh? corrupt cache? */
3156 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3157 centry_free(centry);
3158 state->bad_entry = true;
3159 state->success = false;
3160 return NULL;
3161 }
3162
3163 centry->status = NT_STATUS(centry_uint32(centry));
3164 centry->sequence_number = centry_uint32(centry);
3165 return centry;
3166 }
3167
3168 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3169 struct tdb_validation_status *state)
3170 {
3171 if (dbuf.dsize != 8) {
3172 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3173 keystr, (unsigned int)dbuf.dsize ));
3174 state->bad_entry = true;
3175 return 1;
3176 }
3177 return 0;
3178 }
3179
3180 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3181 struct tdb_validation_status *state)
3182 {
3183 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3184 if (!centry) {
3185 return 1;
3186 }
3187
3188 (void)centry_uint32(centry);
3189 if (NT_STATUS_IS_OK(centry->status)) {
3190 DOM_SID sid;
3191 (void)centry_sid(centry, &sid);
3192 }
3193
3194 centry_free(centry);
3195
3196 if (!(state->success)) {
3197 return 1;
3198 }
3199 DEBUG(10,("validate_ns: %s ok\n", keystr));
3200 return 0;
3201 }
3202
3203 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3204 struct tdb_validation_status *state)
3205 {
3206 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3207 if (!centry) {
3208 return 1;
3209 }
3210
3211 if (NT_STATUS_IS_OK(centry->status)) {
3212 (void)centry_uint32(centry);
3213 (void)centry_string(centry, mem_ctx);
3214 (void)centry_string(centry, mem_ctx);
3215 }
3216
3217 centry_free(centry);
3218
3219 if (!(state->success)) {
3220 return 1;
3221 }
3222 DEBUG(10,("validate_sn: %s ok\n", keystr));
3223 return 0;
3224 }
3225
3226 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3227 struct tdb_validation_status *state)
3228 {
3229 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3230 DOM_SID sid;
3231
3232 if (!centry) {
3233 return 1;
3234 }
3235
3236 (void)centry_string(centry, mem_ctx);
3237 (void)centry_string(centry, mem_ctx);
3238 (void)centry_string(centry, mem_ctx);
3239 (void)centry_string(centry, mem_ctx);
3240 (void)centry_uint32(centry);
3241 (void)centry_sid(centry, &sid);
3242 (void)centry_sid(centry, &sid);
3243
3244 centry_free(centry);
3245
3246 if (!(state->success)) {
3247 return 1;
3248 }
3249 DEBUG(10,("validate_u: %s ok\n", keystr));
3250 return 0;
3251 }
3252
3253 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3254 struct tdb_validation_status *state)
3255 {
3256 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3257
3258 if (!centry) {
3259 return 1;
3260 }
3261
3262 (void)centry_nttime(centry);
3263 (void)centry_nttime(centry);
3264 (void)centry_uint16(centry);
3265
3266 centry_free(centry);
3267
3268 if (!(state->success)) {
3269 return 1;
3270 }
3271 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3272 return 0;
3273 }
3274
3275 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3276 struct tdb_validation_status *state)
3277 {
3278 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3279
3280 if (!centry) {
3281 return 1;
3282 }
3283
3284 (void)centry_uint16(centry);
3285 (void)centry_uint16(centry);
3286 (void)centry_uint32(centry);
3287 (void)centry_nttime(centry);
3288 (void)centry_nttime(centry);
3289
3290 centry_free(centry);
3291
3292 if (!(state->success)) {
3293 return 1;
3294 }
3295 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3296 return 0;
3297 }
3298
3299 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3300 struct tdb_validation_status *state)
3301 {
3302 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3303
3304 if (!centry) {
3305 return 1;
3306 }
3307
3308 (void)centry_time(centry);
3309 (void)centry_hash16(centry, mem_ctx);
3310
3311 /* We only have 17 bytes more data in the salted cred case. */
3312 if (centry->len - centry->ofs == 17) {
3313 (void)centry_hash16(centry, mem_ctx);
3314 }
3315
3316 centry_free(centry);
3317
3318 if (!(state->success)) {
3319 return 1;
3320 }
3321 DEBUG(10,("validate_cred: %s ok\n", keystr));
3322 return 0;
3323 }
3324
3325 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3326 struct tdb_validation_status *state)
3327 {
3328 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3329 int32 num_entries, i;
3330
3331 if (!centry) {
3332 return 1;
3333 }
3334
3335 num_entries = (int32)centry_uint32(centry);
3336
3337 for (i=0; i< num_entries; i++) {
3338 DOM_SID sid;
3339 (void)centry_string(centry, mem_ctx);
3340 (void)centry_string(centry, mem_ctx);
3341 (void)centry_string(centry, mem_ctx);
3342 (void)centry_string(centry, mem_ctx);
3343 (void)centry_sid(centry, &sid);
3344 (void)centry_sid(centry, &sid);
3345 }
3346
3347 centry_free(centry);
3348
3349 if (!(state->success)) {
3350 return 1;
3351 }
3352 DEBUG(10,("validate_ul: %s ok\n", keystr));
3353 return 0;
3354 }
3355
3356 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3357 struct tdb_validation_status *state)
3358 {
3359 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3360 int32 num_entries, i;
3361
3362 if (!centry) {
3363 return 1;
3364 }
3365
3366 num_entries = centry_uint32(centry);
3367
3368 for (i=0; i< num_entries; i++) {
3369 (void)centry_string(centry, mem_ctx);
3370 (void)centry_string(centry, mem_ctx);
3371 (void)centry_uint32(centry);
3372 }
3373
3374 centry_free(centry);
3375
3376 if (!(state->success)) {
3377 return 1;
3378 }
3379 DEBUG(10,("validate_gl: %s ok\n", keystr));
3380 return 0;
3381 }
3382
3383 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3384 struct tdb_validation_status *state)
3385 {
3386 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3387 int32 num_groups, i;
3388
3389 if (!centry) {
3390 return 1;
3391 }
3392
3393 num_groups = centry_uint32(centry);
3394
3395 for (i=0; i< num_groups; i++) {
3396 DOM_SID sid;
3397 centry_sid(centry, &sid);
3398 }
3399
3400 centry_free(centry);
3401
3402 if (!(state->success)) {
3403 return 1;
3404 }
3405 DEBUG(10,("validate_ug: %s ok\n", keystr));
3406 return 0;
3407 }
3408
3409 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3410 struct tdb_validation_status *state)
3411 {
3412 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3413 int32 num_aliases, i;
3414
3415 if (!centry) {
3416 return 1;
3417 }
3418
3419 num_aliases = centry_uint32(centry);
3420
3421 for (i=0; i < num_aliases; i++) {
3422 (void)centry_uint32(centry);
3423 }
3424
3425 centry_free(centry);
3426
3427 if (!(state->success)) {
3428 return 1;
3429 }
3430 DEBUG(10,("validate_ua: %s ok\n", keystr));
3431 return 0;
3432 }
3433
3434 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3435 struct tdb_validation_status *state)
3436 {
3437 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3438 int32 num_names, i;
3439
3440 if (!centry) {
3441 return 1;
3442 }
3443
3444 num_names = centry_uint32(centry);
3445
3446 for (i=0; i< num_names; i++) {
3447 DOM_SID sid;
3448 centry_sid(centry, &sid);
3449 (void)centry_string(centry, mem_ctx);
3450 (void)centry_uint32(centry);
3451 }
3452
3453 centry_free(centry);
3454
3455 if (!(state->success)) {
3456 return 1;
3457 }
3458 DEBUG(10,("validate_gm: %s ok\n", keystr));
3459 return 0;
3460 }
3461
3462 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3463 struct tdb_validation_status *state)
3464 {
3465 /* Can't say anything about this other than must be nonzero. */
3466 if (dbuf.dsize == 0) {
3467 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3468 keystr));
3469 state->bad_entry = true;
3470 state->success = false;
3471 return 1;
3472 }
3473
3474 DEBUG(10,("validate_dr: %s ok\n", keystr));
3475 return 0;
3476 }
3477
3478 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3479 struct tdb_validation_status *state)
3480 {
3481 /* Can't say anything about this other than must be nonzero. */
3482 if (dbuf.dsize == 0) {
3483 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3484 keystr));
3485 state->bad_entry = true;
3486 state->success = false;
3487 return 1;
3488 }
3489
3490 DEBUG(10,("validate_de: %s ok\n", keystr));
3491 return 0;
3492 }
3493
3494 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3495 TDB_DATA dbuf, struct tdb_validation_status *state)
3496 {
3497 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3498
3499 if (!centry) {
3500 return 1;
3501 }
3502
3503 (void)centry_string(centry, mem_ctx);
3504 (void)centry_string(centry, mem_ctx);
3505 (void)centry_string(centry, mem_ctx);
3506 (void)centry_uint32(centry);
3507
3508 centry_free(centry);
3509
3510 if (!(state->success)) {
3511 return 1;
3512 }
3513 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3514 return 0;
3515 }
3516
3517 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3518 TDB_DATA dbuf,
3519 struct tdb_validation_status *state)
3520 {
3521 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3522
3523 if (!centry) {
3524 return 1;
3525 }
3526
3527 (void)centry_string( centry, mem_ctx );
3528
3529 centry_free(centry);
3530
3531 if (!(state->success)) {
3532 return 1;
3533 }
3534 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3535 return 0;
3536 }
3537
3538 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3539 TDB_DATA dbuf,
3540 struct tdb_validation_status *state)
3541 {
3542 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3543
3544 if (!centry) {
3545 return 1;
3546 }
3547
3548 (void)centry_string( centry, mem_ctx );
3549
3550 centry_free(centry);
3551
3552 if (!(state->success)) {
3553 return 1;
3554 }
3555 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3556 return 0;
3557 }
3558
3559 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3560 struct tdb_validation_status *state)
3561 {
3562 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3563 int32 num_domains, i;
3564
3565 if (!centry) {
3566 return 1;
3567 }
3568
3569 num_domains = centry_uint32(centry);
3570
3571 for (i=0; i< num_domains; i++) {
3572 DOM_SID sid;
3573 (void)centry_string(centry, mem_ctx);
3574 (void)centry_string(centry, mem_ctx);
3575 (void)centry_sid(centry, &sid);
3576 }
3577
3578 centry_free(centry);
3579
3580 if (!(state->success)) {
3581 return 1;
3582 }
3583 DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3584 return 0;
3585 }
3586
3587 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3588 TDB_DATA dbuf,
3589 struct tdb_validation_status *state)
3590 {
3591 if (dbuf.dsize == 0) {
3592 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3593 "key %s (len ==0) ?\n", keystr));
3594 state->bad_entry = true;
3595 state->success = false;
3596 return 1;
3597 }
3598
3599 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3600 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3601 return 0;
3602 }
3603
3604 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3605 struct tdb_validation_status *state)
3606 {
3607 if (dbuf.dsize != 4) {
3608 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3609 keystr, (unsigned int)dbuf.dsize ));
3610 state->bad_entry = true;
3611 state->success = false;
3612 return 1;
3613 }
3614 DEBUG(10,("validate_offline: %s ok\n", keystr));
3615 return 0;
3616 }
3617
3618 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3619 struct tdb_validation_status *state)
3620 {
3621 /*
3622 * Ignore validation for now. The proper way to do this is with a
3623 * checksum. Just pure parsing does not really catch much.
3624 */
3625 return 0;
3626 }
3627
3628 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3629 struct tdb_validation_status *state)
3630 {
3631 if (dbuf.dsize != 4) {
3632 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3633 "key %s (len %u != 4) ?\n",
3634 keystr, (unsigned int)dbuf.dsize));
3635 state->bad_entry = true;
3636 state->success = false;
3637 return 1;
3638 }
3639
3640 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3641 return 0;
3642 }
3643
3644 /***********************************************************************
3645 A list of all possible cache tdb keys with associated validation
3646 functions.
3647 ***********************************************************************/
3648
3649 struct key_val_struct {
3650 const char *keyname;
3651 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3652 } key_val[] = {
3653 {"SEQNUM/", validate_seqnum},
3654 {"NS/", validate_ns},
3655 {"SN/", validate_sn},
3656 {"U/", validate_u},
3657 {"LOC_POL/", validate_loc_pol},
3658 {"PWD_POL/", validate_pwd_pol},
3659 {"CRED/", validate_cred},
3660 {"UL/", validate_ul},
3661 {"GL/", validate_gl},
3662 {"UG/", validate_ug},
3663 {"UA", validate_ua},
3664 {"GM/", validate_gm},
3665 {"DR/", validate_dr},
3666 {"DE/", validate_de},
3667 {"NSS/PWINFO/", validate_pwinfo},
3668 {"TRUSTDOMS/", validate_trustdoms},
3669 {"TRUSTDOMCACHE/", validate_trustdomcache},
3670 {"NSS/NA/", validate_nss_na},
3671 {"NSS/AN/", validate_nss_an},
3672 {"WINBINDD_OFFLINE", validate_offline},
3673 {"NDR/", validate_ndr},
3674 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3675 {NULL, NULL}
3676 };
3677
3678 /***********************************************************************
3679 Function to look at every entry in the tdb and validate it as far as
3680 possible.
3681 ***********************************************************************/
3682
3683 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3684 {
3685 int i;
3686 unsigned int max_key_len = 1024;
3687 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3688
3689 /* Paranoia check. */
3690 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3691 max_key_len = 1024 * 1024;
3692 }
3693 if (kbuf.dsize > max_key_len) {
3694 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3695 "(%u) > (%u)\n\n",
3696 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3697 return 1;
3698 }
3699
3700 for (i = 0; key_val[i].keyname; i++) {
3701 size_t namelen = strlen(key_val[i].keyname);
3702 if (kbuf.dsize >= namelen && (
3703 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3704 TALLOC_CTX *mem_ctx;
3705 char *keystr;
3706 int ret;
3707
3708 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3709 if (!keystr) {
3710 return 1;
3711 }
3712 memcpy(keystr, kbuf.dptr, kbuf.dsize);
3713 keystr[kbuf.dsize] = '\0';
3714
3715 mem_ctx = talloc_init("validate_ctx");
3716 if (!mem_ctx) {
3717 SAFE_FREE(keystr);
3718 return 1;
3719 }
3720
3721 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3722 v_state);
3723
3724 SAFE_FREE(keystr);
3725 talloc_destroy(mem_ctx);
3726 return ret;
3727 }
3728 }
3729
3730 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3731 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3732 DEBUG(0,("data :\n"));
3733 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3734 v_state->unknown_key = true;
3735 v_state->success = false;
3736 return 1; /* terminate. */
3737 }
3738
3739 static void validate_panic(const char *const why)
3740 {
3741 DEBUG(0,("validating cache: would panic %s\n", why ));
3742 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3743 exit(47);
3744 }
3745
3746 /***********************************************************************
3747 Try and validate every entry in the winbindd cache. If we fail here,
3748 delete the cache tdb and return non-zero.
3749 ***********************************************************************/
3750
3751 int winbindd_validate_cache(void)
3752 {
3753 int ret = -1;
3754 const char *tdb_path = cache_path("winbindd_cache.tdb");
3755 TDB_CONTEXT *tdb = NULL;
3756
3757 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3758 smb_panic_fn = validate_panic;
3759
3760
3761 tdb = tdb_open_log(tdb_path,
3762 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3763 ( lp_winbind_offline_logon()
3764 ? TDB_DEFAULT
3765 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3766 O_RDWR|O_CREAT,
3767 0600);
3768 if (!tdb) {
3769 DEBUG(0, ("winbindd_validate_cache: "
3770 "error opening/initializing tdb\n"));
3771 goto done;
3772 }
3773 tdb_close(tdb);
3774
3775 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3776
3777 if (ret != 0) {
3778 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3779 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3780 unlink(tdb_path);
3781 }
3782
3783 done:
3784 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3785 smb_panic_fn = smb_panic;
3786 return ret;
3787 }
3788
3789 /***********************************************************************
3790 Try and validate every entry in the winbindd cache.
3791 ***********************************************************************/
3792
3793 int winbindd_validate_cache_nobackup(void)
3794 {
3795 int ret = -1;
3796 const char *tdb_path = cache_path("winbindd_cache.tdb");
3797
3798 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3799 smb_panic_fn = validate_panic;
3800
3801
3802 if (wcache == NULL || wcache->tdb == NULL) {
3803 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3804 } else {
3805 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3806 }
3807
3808 if (ret != 0) {
3809 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3810 "successful.\n"));
3811 }
3812
3813 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3814 "function\n"));
3815 smb_panic_fn = smb_panic;
3816 return ret;
3817 }
3818
3819 bool winbindd_cache_validate_and_initialize(void)
3820 {
3821 close_winbindd_cache();
3822
3823 if (lp_winbind_offline_logon()) {
3824 if (winbindd_validate_cache() < 0) {
3825 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3826 "could be restored.\n"));
3827 }
3828 }
3829
3830 return initialize_winbindd_cache();
3831 }
3832
3833 /*********************************************************************
3834 ********************************************************************/
3835
3836 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3837 struct winbindd_tdc_domain **domains,
3838 size_t *num_domains )
3839 {
3840 struct winbindd_tdc_domain *list = NULL;
3841 size_t idx;
3842 int i;
3843 bool set_only = false;
3844
3845 /* don't allow duplicates */
3846
3847 idx = *num_domains;
3848 list = *domains;
3849
3850 for ( i=0; i< (*num_domains); i++ ) {
3851 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3852 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3853 new_dom->name));
3854 idx = i;
3855 set_only = true;
3856
3857 break;
3858 }
3859 }
3860
3861 if ( !set_only ) {
3862 if ( !*domains ) {
3863 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3864 idx = 0;
3865 } else {
3866 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3867 struct winbindd_tdc_domain,
3868 (*num_domains)+1);
3869 idx = *num_domains;
3870 }
3871
3872 ZERO_STRUCT( list[idx] );
3873 }
3874
3875 if ( !list )
3876 return false;
3877
3878 list[idx].domain_name = talloc_strdup( list, new_dom->name );
3879 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3880
3881 if ( !is_null_sid( &new_dom->sid ) ) {
3882 sid_copy( &list[idx].sid, &new_dom->sid );
3883 } else {
3884 sid_copy(&list[idx].sid, &global_sid_NULL);
3885 }
3886
3887 if ( new_dom->domain_flags != 0x0 )
3888 list[idx].trust_flags = new_dom->domain_flags;
3889
3890 if ( new_dom->domain_type != 0x0 )
3891 list[idx].trust_type = new_dom->domain_type;
3892
3893 if ( new_dom->domain_trust_attribs != 0x0 )
3894 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3895
3896 if ( !set_only ) {
3897 *domains = list;
3898 *num_domains = idx + 1;
3899 }
3900
3901 return true;
3902 }
3903
3904 /*********************************************************************
3905 ********************************************************************/
3906
3907 static TDB_DATA make_tdc_key( const char *domain_name )
3908 {
3909 char *keystr = NULL;
3910 TDB_DATA key = { NULL, 0 };
3911
3912 if ( !domain_name ) {
3913 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3914 return key;
3915 }
3916
3917 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3918 return key;
3919 }
3920 key = string_term_tdb_data(keystr);
3921
3922 return key;
3923 }
3924
3925 /*********************************************************************
3926 ********************************************************************/
3927
3928 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3929 size_t num_domains,
3930 unsigned char **buf )
3931 {
3932 unsigned char *buffer = NULL;
3933 int len = 0;
3934 int buflen = 0;
3935 int i = 0;
3936
3937 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3938 (int)num_domains));
3939
3940 buflen = 0;
3941
3942 again:
3943 len = 0;
3944
3945 /* Store the number of array items first */
3946 len += tdb_pack( buffer+len, buflen-len, "d",
3947 num_domains );
3948
3949 /* now pack each domain trust record */
3950 for ( i=0; i<num_domains; i++ ) {
3951
3952 fstring tmp;
3953
3954 if ( buflen > 0 ) {
3955 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3956 domains[i].domain_name,
3957 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3958 }
3959
3960 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3961 domains[i].domain_name,
3962 domains[i].dns_name,
3963 sid_to_fstring(tmp, &domains[i].sid),
3964 domains[i].trust_flags,
3965 domains[i].trust_attribs,
3966 domains[i].trust_type );
3967 }
3968
3969 if ( buflen < len ) {
3970 SAFE_FREE(buffer);
3971 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3972 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3973 buflen = -1;
3974 goto done;
3975 }
3976 buflen = len;
3977 goto again;
3978 }
3979
3980 *buf = buffer;
3981
3982 done:
3983 return buflen;
3984 }
3985
3986 /*********************************************************************
3987 ********************************************************************/
3988
3989 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3990 struct winbindd_tdc_domain **domains )
3991 {
3992 fstring domain_name, dns_name, sid_string;
3993 uint32 type, attribs, flags;
3994 int num_domains;
3995 int len = 0;
3996 int i;
3997 struct winbindd_tdc_domain *list = NULL;
3998
3999 /* get the number of domains */
4000 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4001 if ( len == -1 ) {
4002 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4003 return 0;
4004 }
4005
4006 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4007 if ( !list ) {
4008 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4009 return 0;
4010 }
4011
4012 for ( i=0; i<num_domains; i++ ) {
4013 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4014 domain_name,
4015 dns_name,
4016 sid_string,
4017 &flags,
4018 &attribs,
4019 &type );
4020
4021 if ( len == -1 ) {
4022 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4023 TALLOC_FREE( list );
4024 return 0;
4025 }
4026
4027 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4028 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4029 domain_name, dns_name, sid_string,
4030 flags, attribs, type));
4031
4032 list[i].domain_name = talloc_strdup( list, domain_name );
4033 list[i].dns_name = talloc_strdup( list, dns_name );
4034 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4035 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4036 domain_name));
4037 }
4038 list[i].trust_flags = flags;
4039 list[i].trust_attribs = attribs;
4040 list[i].trust_type = type;
4041 }
4042
4043 *domains = list;
4044
4045 return num_domains;
4046 }
4047
4048 /*********************************************************************
4049 ********************************************************************/
4050
4051 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4052 {
4053 TDB_DATA key = make_tdc_key( lp_workgroup() );
4054 TDB_DATA data = { NULL, 0 };
4055 int ret;
4056
4057 if ( !key.dptr )
4058 return false;
4059
4060 /* See if we were asked to delete the cache entry */
4061
4062 if ( !domains ) {
4063 ret = tdb_delete( wcache->tdb, key );
4064 goto done;
4065 }
4066
4067 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4068
4069 if ( !data.dptr ) {
4070 ret = -1;
4071 goto done;
4072 }
4073
4074 ret = tdb_store( wcache->tdb, key, data, 0 );
4075
4076 done:
4077 SAFE_FREE( data.dptr );
4078 SAFE_FREE( key.dptr );
4079
4080 return ( ret != -1 );
4081 }
4082
4083 /*********************************************************************
4084 ********************************************************************/
4085
4086 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4087 {
4088 TDB_DATA key = make_tdc_key( lp_workgroup() );
4089 TDB_DATA data = { NULL, 0 };
4090
4091 *domains = NULL;
4092 *num_domains = 0;
4093
4094 if ( !key.dptr )
4095 return false;
4096
4097 data = tdb_fetch( wcache->tdb, key );
4098
4099 SAFE_FREE( key.dptr );
4100
4101 if ( !data.dptr )
4102 return false;
4103
4104 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4105
4106 SAFE_FREE( data.dptr );
4107
4108 if ( !*domains )
4109 return false;
4110
4111 return true;
4112 }
4113
4114 /*********************************************************************
4115 ********************************************************************/
4116
4117 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4118 {
4119 struct winbindd_tdc_domain *dom_list = NULL;
4120 size_t num_domains = 0;
4121 bool ret = false;
4122
4123 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4124 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4125 domain->name, domain->alt_name,
4126 sid_string_dbg(&domain->sid),
4127 domain->domain_flags,
4128 domain->domain_trust_attribs,
4129 domain->domain_type));
4130
4131 if ( !init_wcache() ) {
4132 return false;
4133 }
4134
4135 /* fetch the list */
4136
4137 wcache_tdc_fetch_list( &dom_list, &num_domains );
4138
4139 /* add the new domain */
4140
4141 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4142 goto done;
4143 }
4144
4145 /* pack the domain */
4146
4147 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4148 goto done;
4149 }
4150
4151 /* Success */
4152
4153 ret = true;
4154 done:
4155 TALLOC_FREE( dom_list );
4156
4157 return ret;
4158 }
4159
4160 /*********************************************************************
4161 ********************************************************************/
4162
4163 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4164 {
4165 struct winbindd_tdc_domain *dom_list = NULL;
4166 size_t num_domains = 0;
4167 int i;
4168 struct winbindd_tdc_domain *d = NULL;
4169
4170 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4171
4172 if ( !init_wcache() ) {
4173 return false;
4174 }
4175
4176 /* fetch the list */
4177
4178 wcache_tdc_fetch_list( &dom_list, &num_domains );
4179
4180 for ( i=0; i<num_domains; i++ ) {
4181 if ( strequal(name, dom_list[i].domain_name) ||
4182 strequal(name, dom_list[i].dns_name) )
4183 {
4184 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4185 name));
4186
4187 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4188 if ( !d )
4189 break;
4190
4191 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4192 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4193 sid_copy( &d->sid, &dom_list[i].sid );
4194 d->trust_flags = dom_list[i].trust_flags;
4195 d->trust_type = dom_list[i].trust_type;
4196 d->trust_attribs = dom_list[i].trust_attribs;
4197
4198 break;
4199 }
4200 }
4201
4202 TALLOC_FREE( dom_list );
4203
4204 return d;
4205 }
4206
4207
4208 /*********************************************************************
4209 ********************************************************************/
4210
4211 void wcache_tdc_clear( void )
4212 {
4213 if ( !init_wcache() )
4214 return;
4215
4216 wcache_tdc_store_list( NULL, 0 );
4217
4218 return;
4219 }
4220
4221
4222 /*********************************************************************
4223 ********************************************************************/
4224
4225 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4226 NTSTATUS status,
4227 const DOM_SID *user_sid,
4228 const char *homedir,
4229 const char *shell,
4230 const char *gecos,
4231 uint32 gid)
4232 {
4233 struct cache_entry *centry;
4234 fstring tmp;
4235
4236 if ( (centry = centry_start(domain, status)) == NULL )
4237 return;
4238
4239 centry_put_string( centry, homedir );
4240 centry_put_string( centry, shell );
4241 centry_put_string( centry, gecos );
4242 centry_put_uint32( centry, gid );
4243
4244 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4245
4246 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4247
4248 centry_free(centry);
4249 }
4250
4251 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4252 const DOM_SID *user_sid,
4253 TALLOC_CTX *ctx,
4254 ADS_STRUCT *ads, LDAPMessage *msg,
4255 const char **homedir, const char **shell,
4256 const char **gecos, gid_t *p_gid)
4257 {
4258 struct winbind_cache *cache = get_cache(domain);
4259 struct cache_entry *centry = NULL;
4260 NTSTATUS nt_status;
4261 fstring tmp;
4262
4263 if (!cache->tdb)
4264 goto do_query;
4265
4266 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4267 sid_to_fstring(tmp, user_sid));
4268
4269 if (!centry)
4270 goto do_query;
4271
4272 *homedir = centry_string( centry, ctx );
4273 *shell = centry_string( centry, ctx );
4274 *gecos = centry_string( centry, ctx );
4275 *p_gid = centry_uint32( centry );
4276
4277 centry_free(centry);
4278
4279 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4280 sid_string_dbg(user_sid)));
4281
4282 return NT_STATUS_OK;
4283
4284 do_query:
4285
4286 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4287 homedir, shell, gecos, p_gid );
4288
4289 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4290
4291 if ( NT_STATUS_IS_OK(nt_status) ) {
4292 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4293 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4294 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4295 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4296
4297 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4298 *homedir, *shell, *gecos, *p_gid );
4299 }
4300
4301 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4302 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4303 domain->name ));
4304 set_domain_offline( domain );
4305 }
4306
4307 return nt_status;
4308 }
4309
4310
4311 /* the cache backend methods are exposed via this structure */
4312 struct winbindd_methods cache_methods = {
4313 true,
4314 query_user_list,
4315 enum_dom_groups,
4316 enum_local_groups,
4317 name_to_sid,
4318 sid_to_name,
4319 rids_to_names,
4320 query_user,
4321 lookup_usergroups,
4322 lookup_useraliases,
4323 lookup_groupmem,
4324 sequence_number,
4325 lockout_policy,
4326 password_policy,
4327 trusted_domains
4328 };
4329
4330 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4331 uint32_t opnum, const DATA_BLOB *req,
4332 TDB_DATA *pkey)
4333 {
4334 char *key;
4335 size_t keylen;
4336
4337 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4338 if (key == NULL) {
4339 return false;
4340 }
4341 keylen = talloc_get_size(key) - 1;
4342
4343 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4344 if (key == NULL) {
4345 return false;
4346 }
4347 memcpy(key + keylen, req->data, req->length);
4348
4349 pkey->dptr = (uint8_t *)key;
4350 pkey->dsize = talloc_get_size(key);
4351 return true;
4352 }
4353
4354 static bool wcache_opnum_cacheable(uint32_t opnum)
4355 {
4356 switch (opnum) {
4357 case NDR_WBINT_PING:
4358 case NDR_WBINT_QUERYSEQUENCENUMBER:
4359 case NDR_WBINT_ALLOCATEUID:
4360 case NDR_WBINT_ALLOCATEGID:
4361 return false;
4362 }
4363 return true;
4364 }
4365
4366 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4367 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4368 {
4369 TDB_DATA key, data;
4370 bool ret = false;
4371
4372 if (!wcache_opnum_cacheable(opnum)) {
4373 return false;
4374 }
4375
4376 if (wcache->tdb == NULL) {
4377 return false;
4378 }
4379
4380 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4381 return false;
4382 }
4383 data = tdb_fetch(wcache->tdb, key);
4384 TALLOC_FREE(key.dptr);
4385
4386 if (data.dptr == NULL) {
4387 return false;
4388 }
4389 if (data.dsize < 4) {
4390 goto fail;
4391 }
4392
4393 if (IS_DOMAIN_ONLINE(domain)) {
4394 uint32_t entry_seqnum, dom_seqnum, last_check;
4395
4396 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4397 &last_check)) {
4398 goto fail;
4399 }
4400 entry_seqnum = IVAL(data.dptr, 0);
4401 if (entry_seqnum != dom_seqnum) {
4402 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4403 (int)entry_seqnum));
4404 goto fail;
4405 }
4406 }
4407
4408 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4409 data.dsize - 4);
4410 if (resp->data == NULL) {
4411 DEBUG(10, ("talloc failed\n"));
4412 goto fail;
4413 }
4414 resp->length = data.dsize - 4;
4415
4416 ret = true;
4417 fail:
4418 SAFE_FREE(data.dptr);
4419 return ret;
4420 }
4421
4422 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4423 const DATA_BLOB *req, const DATA_BLOB *resp)
4424 {
4425 TDB_DATA key, data;
4426 uint32_t dom_seqnum, last_check;
4427
4428 if (!wcache_opnum_cacheable(opnum)) {
4429 return;
4430 }
4431
4432 if (wcache->tdb == NULL) {
4433 return;
4434 }
4435
4436 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4437 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4438 domain->name));
4439 return;
4440 }
4441
4442 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4443 return;
4444 }
4445
4446 data.dsize = resp->length + 4;
4447 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4448 if (data.dptr == NULL) {
4449 goto done;
4450 }
4451
4452 SIVAL(data.dptr, 0, dom_seqnum);
4453 memcpy(data.dptr+4, resp->data, resp->length);
4454
4455 tdb_store(wcache->tdb, key, data, 0);
4456
4457 done:
4458 TALLOC_FREE(key.dptr);
4459 return;
4460 }
aatanasov's samba4 branch