?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:winbind: Add a generic cache for NDR based parent-child requests
[Samba/aatanasov.git] / source3 / winbindd / winbindd_cache.c
blobe8f928867b53e5d089c971a2368fb43f0d9c1bc2
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
30
31 #undef DBGC_CLASS
32 #define DBGC_CLASS DBGC_WINBIND
33
34 #define WINBINDD_CACHE_VERSION 1
35 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
36
37 extern struct winbindd_methods reconnect_methods;
38 #ifdef HAVE_ADS
39 extern struct winbindd_methods ads_methods;
40 #endif
41 extern struct winbindd_methods builtin_passdb_methods;
42
43 /*
44 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
45 * Here are the list of entry types that are *not* stored
46 * as form struct cache_entry in the cache.
47 */
48
49 static const char *non_centry_keys[] = {
50 "SEQNUM/",
51 "DR/",
52 "DE/",
53 "WINBINDD_OFFLINE",
54 WINBINDD_CACHE_VERSION_KEYSTR,
55 NULL
56 };
57
58 /************************************************************************
59 Is this key a non-centry type ?
60 ************************************************************************/
61
62 static bool is_non_centry_key(TDB_DATA kbuf)
63 {
64 int i;
65
66 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
67 return false;
68 }
69 for (i = 0; non_centry_keys[i] != NULL; i++) {
70 size_t namelen = strlen(non_centry_keys[i]);
71 if (kbuf.dsize < namelen) {
72 continue;
73 }
74 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
75 return true;
76 }
77 }
78 return false;
79 }
80
81 /* Global online/offline state - False when online. winbindd starts up online
82 and sets this to true if the first query fails and there's an entry in
83 the cache tdb telling us to stay offline. */
84
85 static bool global_winbindd_offline_state;
86
87 struct winbind_cache {
88 TDB_CONTEXT *tdb;
89 };
90
91 struct cache_entry {
92 NTSTATUS status;
93 uint32 sequence_number;
94 uint8 *data;
95 uint32 len, ofs;
96 };
97
98 void (*smb_panic_fn)(const char *const why) = smb_panic;
99
100 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
101
102 static struct winbind_cache *wcache;
103
104 void winbindd_check_cache_size(time_t t)
105 {
106 static time_t last_check_time;
107 struct stat st;
108
109 if (last_check_time == (time_t)0)
110 last_check_time = t;
111
112 if (t - last_check_time < 60 && t - last_check_time > 0)
113 return;
114
115 if (wcache == NULL || wcache->tdb == NULL) {
116 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
117 return;
118 }
119
120 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
121 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
122 return;
123 }
124
125 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
126 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
127 (unsigned long)st.st_size,
128 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
129 wcache_flush_cache();
130 }
131 }
132
133 /* get the winbind_cache structure */
134 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
135 {
136 struct winbind_cache *ret = wcache;
137
138 /* We have to know what type of domain we are dealing with first. */
139
140 if (domain->internal) {
141 domain->backend = &builtin_passdb_methods;
142 domain->initialized = True;
143 }
144 if ( !domain->initialized ) {
145 init_dc_connection( domain );
146 }
147
148 /*
149 OK. listen up becasue I'm only going to say this once.
150 We have the following scenarios to consider
151 (a) trusted AD domains on a Samba DC,
152 (b) trusted AD domains and we are joined to a non-kerberos domain
153 (c) trusted AD domains and we are joined to a kerberos (AD) domain
154
155 For (a) we can always contact the trusted domain using krb5
156 since we have the domain trust account password
157
158 For (b) we can only use RPC since we have no way of
159 getting a krb5 ticket in our own domain
160
161 For (c) we can always use krb5 since we have a kerberos trust
162
163 --jerry
164 */
165
166 if (!domain->backend) {
167 #ifdef HAVE_ADS
168 struct winbindd_domain *our_domain = domain;
169
170 /* find our domain first so we can figure out if we
171 are joined to a kerberized domain */
172
173 if ( !domain->primary )
174 our_domain = find_our_domain();
175
176 if ((our_domain->active_directory || IS_DC)
177 && domain->active_directory
178 && !lp_winbind_rpc_only()) {
179 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
180 domain->backend = &ads_methods;
181 } else {
182 #endif /* HAVE_ADS */
183 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
184 domain->backend = &reconnect_methods;
185 #ifdef HAVE_ADS
186 }
187 #endif /* HAVE_ADS */
188 }
189
190 if (ret)
191 return ret;
192
193 ret = SMB_XMALLOC_P(struct winbind_cache);
194 ZERO_STRUCTP(ret);
195
196 wcache = ret;
197 wcache_flush_cache();
198
199 return ret;
200 }
201
202 /*
203 free a centry structure
204 */
205 static void centry_free(struct cache_entry *centry)
206 {
207 if (!centry)
208 return;
209 SAFE_FREE(centry->data);
210 free(centry);
211 }
212
213 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
214 {
215 if (centry->len - centry->ofs < nbytes) {
216 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
217 (unsigned int)nbytes,
218 centry->len - centry->ofs));
219 return false;
220 }
221 return true;
222 }
223
224 /*
225 pull a uint32 from a cache entry
226 */
227 static uint32 centry_uint32(struct cache_entry *centry)
228 {
229 uint32 ret;
230
231 if (!centry_check_bytes(centry, 4)) {
232 smb_panic_fn("centry_uint32");
233 }
234 ret = IVAL(centry->data, centry->ofs);
235 centry->ofs += 4;
236 return ret;
237 }
238
239 /*
240 pull a uint16 from a cache entry
241 */
242 static uint16 centry_uint16(struct cache_entry *centry)
243 {
244 uint16 ret;
245 if (!centry_check_bytes(centry, 2)) {
246 smb_panic_fn("centry_uint16");
247 }
248 ret = CVAL(centry->data, centry->ofs);
249 centry->ofs += 2;
250 return ret;
251 }
252
253 /*
254 pull a uint8 from a cache entry
255 */
256 static uint8 centry_uint8(struct cache_entry *centry)
257 {
258 uint8 ret;
259 if (!centry_check_bytes(centry, 1)) {
260 smb_panic_fn("centry_uint8");
261 }
262 ret = CVAL(centry->data, centry->ofs);
263 centry->ofs += 1;
264 return ret;
265 }
266
267 /*
268 pull a NTTIME from a cache entry
269 */
270 static NTTIME centry_nttime(struct cache_entry *centry)
271 {
272 NTTIME ret;
273 if (!centry_check_bytes(centry, 8)) {
274 smb_panic_fn("centry_nttime");
275 }
276 ret = IVAL(centry->data, centry->ofs);
277 centry->ofs += 4;
278 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
279 centry->ofs += 4;
280 return ret;
281 }
282
283 /*
284 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
285 */
286 static time_t centry_time(struct cache_entry *centry)
287 {
288 return (time_t)centry_nttime(centry);
289 }
290
291 /* pull a string from a cache entry, using the supplied
292 talloc context
293 */
294 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
295 {
296 uint32 len;
297 char *ret;
298
299 len = centry_uint8(centry);
300
301 if (len == 0xFF) {
302 /* a deliberate NULL string */
303 return NULL;
304 }
305
306 if (!centry_check_bytes(centry, (size_t)len)) {
307 smb_panic_fn("centry_string");
308 }
309
310 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
311 if (!ret) {
312 smb_panic_fn("centry_string out of memory\n");
313 }
314 memcpy(ret,centry->data + centry->ofs, len);
315 ret[len] = 0;
316 centry->ofs += len;
317 return ret;
318 }
319
320 /* pull a hash16 from a cache entry, using the supplied
321 talloc context
322 */
323 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
324 {
325 uint32 len;
326 char *ret;
327
328 len = centry_uint8(centry);
329
330 if (len != 16) {
331 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
332 len ));
333 return NULL;
334 }
335
336 if (!centry_check_bytes(centry, 16)) {
337 return NULL;
338 }
339
340 ret = TALLOC_ARRAY(mem_ctx, char, 16);
341 if (!ret) {
342 smb_panic_fn("centry_hash out of memory\n");
343 }
344 memcpy(ret,centry->data + centry->ofs, 16);
345 centry->ofs += 16;
346 return ret;
347 }
348
349 /* pull a sid from a cache entry, using the supplied
350 talloc context
351 */
352 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
353 {
354 char *sid_string;
355 bool ret;
356
357 sid_string = centry_string(centry, talloc_tos());
358 if (sid_string == NULL) {
359 return false;
360 }
361 ret = string_to_sid(sid, sid_string);
362 TALLOC_FREE(sid_string);
363 return ret;
364 }
365
366
367 /*
368 pull a NTSTATUS from a cache entry
369 */
370 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
371 {
372 NTSTATUS status;
373
374 status = NT_STATUS(centry_uint32(centry));
375 return status;
376 }
377
378
379 /* the server is considered down if it can't give us a sequence number */
380 static bool wcache_server_down(struct winbindd_domain *domain)
381 {
382 bool ret;
383
384 if (!wcache->tdb)
385 return false;
386
387 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
388
389 if (ret)
390 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
391 domain->name ));
392 return ret;
393 }
394
395 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
396 uint32_t *last_seq_check)
397 {
398 char *key;
399 TDB_DATA data;
400
401 if (wcache->tdb == NULL) {
402 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
403 return false;
404 }
405
406 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
407 if (key == NULL) {
408 DEBUG(10, ("talloc failed\n"));
409 return false;
410 }
411
412 data = tdb_fetch_bystring(wcache->tdb, key);
413 TALLOC_FREE(key);
414
415 if (data.dptr == NULL) {
416 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
417 domain_name));
418 return false;
419 }
420 if (data.dsize != 8) {
421 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
422 (int)data.dsize));
423 SAFE_FREE(data.dptr);
424 return false;
425 }
426
427 *seqnum = IVAL(data.dptr, 0);
428 *last_seq_check = IVAL(data.dptr, 4);
429 SAFE_FREE(data.dptr);
430
431 return true;
432 }
433
434 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
435 {
436 uint32 last_check, time_diff;
437
438 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
439 &last_check)) {
440 return NT_STATUS_UNSUCCESSFUL;
441 }
442 domain->last_seq_check = last_check;
443
444 /* have we expired? */
445
446 time_diff = now - domain->last_seq_check;
447 if ( time_diff > lp_winbind_cache_time() ) {
448 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
449 domain->name, domain->sequence_number,
450 (uint32)domain->last_seq_check));
451 return NT_STATUS_UNSUCCESSFUL;
452 }
453
454 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
455 domain->name, domain->sequence_number,
456 (uint32)domain->last_seq_check));
457
458 return NT_STATUS_OK;
459 }
460
461 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
462 {
463 TDB_DATA data;
464 fstring key_str;
465 uint8 buf[8];
466
467 if (!wcache->tdb) {
468 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
469 return NT_STATUS_UNSUCCESSFUL;
470 }
471
472 fstr_sprintf( key_str, "SEQNUM/%s", domain->name );
473
474 SIVAL(buf, 0, domain->sequence_number);
475 SIVAL(buf, 4, domain->last_seq_check);
476 data.dptr = buf;
477 data.dsize = 8;
478
479 if ( tdb_store_bystring( wcache->tdb, key_str, data, TDB_REPLACE) == -1 ) {
480 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
481 return NT_STATUS_UNSUCCESSFUL;
482 }
483
484 DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
485 domain->name, domain->sequence_number,
486 (uint32)domain->last_seq_check));
487
488 return NT_STATUS_OK;
489 }
490
491 /*
492 refresh the domain sequence number. If force is true
493 then always refresh it, no matter how recently we fetched it
494 */
495
496 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
497 {
498 NTSTATUS status;
499 unsigned time_diff;
500 time_t t = time(NULL);
501 unsigned cache_time = lp_winbind_cache_time();
502
503 if ( IS_DOMAIN_OFFLINE(domain) ) {
504 return;
505 }
506
507 get_cache( domain );
508
509 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
510 /* trying to reconnect is expensive, don't do it too often */
511 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
512 cache_time *= 8;
513 }
514 #endif
515
516 time_diff = t - domain->last_seq_check;
517
518 /* see if we have to refetch the domain sequence number */
519 if (!force && (time_diff < cache_time) &&
520 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
521 NT_STATUS_IS_OK(domain->last_status)) {
522 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
523 goto done;
524 }
525
526 /* try to get the sequence number from the tdb cache first */
527 /* this will update the timestamp as well */
528
529 status = fetch_cache_seqnum( domain, t );
530 if (NT_STATUS_IS_OK(status) &&
531 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
532 NT_STATUS_IS_OK(domain->last_status)) {
533 goto done;
534 }
535
536 /* important! make sure that we know if this is a native
537 mode domain or not. And that we can contact it. */
538
539 if ( winbindd_can_contact_domain( domain ) ) {
540 status = domain->backend->sequence_number(domain,
541 &domain->sequence_number);
542 } else {
543 /* just use the current time */
544 status = NT_STATUS_OK;
545 domain->sequence_number = time(NULL);
546 }
547
548
549 /* the above call could have set our domain->backend to NULL when
550 * coming from offline to online mode, make sure to reinitialize the
551 * backend - Guenther */
552 get_cache( domain );
553
554 if (!NT_STATUS_IS_OK(status)) {
555 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
556 domain->sequence_number = DOM_SEQUENCE_NONE;
557 }
558
559 domain->last_status = status;
560 domain->last_seq_check = time(NULL);
561
562 /* save the new sequence number in the cache */
563 store_cache_seqnum( domain );
564
565 done:
566 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
567 domain->name, domain->sequence_number));
568
569 return;
570 }
571
572 /*
573 decide if a cache entry has expired
574 */
575 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
576 {
577 /* If we've been told to be offline - stay in that state... */
578 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
579 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
580 keystr, domain->name ));
581 return false;
582 }
583
584 /* when the domain is offline return the cached entry.
585 * This deals with transient offline states... */
586
587 if (!domain->online) {
588 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
589 keystr, domain->name ));
590 return false;
591 }
592
593 /* if the server is OK and our cache entry came from when it was down then
594 the entry is invalid */
595 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
596 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
597 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
598 keystr, domain->name ));
599 return true;
600 }
601
602 /* if the server is down or the cache entry is not older than the
603 current sequence number then it is OK */
604 if (wcache_server_down(domain) ||
605 centry->sequence_number == domain->sequence_number) {
606 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
607 keystr, domain->name ));
608 return false;
609 }
610
611 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
612 keystr, domain->name ));
613
614 /* it's expired */
615 return true;
616 }
617
618 static struct cache_entry *wcache_fetch_raw(char *kstr)
619 {
620 TDB_DATA data;
621 struct cache_entry *centry;
622 TDB_DATA key;
623
624 key = string_tdb_data(kstr);
625 data = tdb_fetch(wcache->tdb, key);
626 if (!data.dptr) {
627 /* a cache miss */
628 return NULL;
629 }
630
631 centry = SMB_XMALLOC_P(struct cache_entry);
632 centry->data = (unsigned char *)data.dptr;
633 centry->len = data.dsize;
634 centry->ofs = 0;
635
636 if (centry->len < 8) {
637 /* huh? corrupt cache? */
638 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
639 centry_free(centry);
640 return NULL;
641 }
642
643 centry->status = centry_ntstatus(centry);
644 centry->sequence_number = centry_uint32(centry);
645
646 return centry;
647 }
648
649 /*
650 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
651 number and return status
652 */
653 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
654 struct winbindd_domain *domain,
655 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
656 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
657 struct winbindd_domain *domain,
658 const char *format, ...)
659 {
660 va_list ap;
661 char *kstr;
662 struct cache_entry *centry;
663
664 if (!winbindd_use_cache()) {
665 return NULL;
666 }
667
668 refresh_sequence_number(domain, false);
669
670 va_start(ap, format);
671 smb_xvasprintf(&kstr, format, ap);
672 va_end(ap);
673
674 centry = wcache_fetch_raw(kstr);
675 if (centry == NULL) {
676 free(kstr);
677 return NULL;
678 }
679
680 if (centry_expired(domain, kstr, centry)) {
681
682 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
683 kstr, domain->name ));
684
685 centry_free(centry);
686 free(kstr);
687 return NULL;
688 }
689
690 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
691 kstr, domain->name ));
692
693 free(kstr);
694 return centry;
695 }
696
697 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
698 static void wcache_delete(const char *format, ...)
699 {
700 va_list ap;
701 char *kstr;
702 TDB_DATA key;
703
704 va_start(ap, format);
705 smb_xvasprintf(&kstr, format, ap);
706 va_end(ap);
707
708 key = string_tdb_data(kstr);
709
710 tdb_delete(wcache->tdb, key);
711 free(kstr);
712 }
713
714 /*
715 make sure we have at least len bytes available in a centry
716 */
717 static void centry_expand(struct cache_entry *centry, uint32 len)
718 {
719 if (centry->len - centry->ofs >= len)
720 return;
721 centry->len *= 2;
722 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
723 centry->len);
724 if (!centry->data) {
725 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
726 smb_panic_fn("out of memory in centry_expand");
727 }
728 }
729
730 /*
731 push a uint32 into a centry
732 */
733 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
734 {
735 centry_expand(centry, 4);
736 SIVAL(centry->data, centry->ofs, v);
737 centry->ofs += 4;
738 }
739
740 /*
741 push a uint16 into a centry
742 */
743 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
744 {
745 centry_expand(centry, 2);
746 SIVAL(centry->data, centry->ofs, v);
747 centry->ofs += 2;
748 }
749
750 /*
751 push a uint8 into a centry
752 */
753 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
754 {
755 centry_expand(centry, 1);
756 SCVAL(centry->data, centry->ofs, v);
757 centry->ofs += 1;
758 }
759
760 /*
761 push a string into a centry
762 */
763 static void centry_put_string(struct cache_entry *centry, const char *s)
764 {
765 int len;
766
767 if (!s) {
768 /* null strings are marked as len 0xFFFF */
769 centry_put_uint8(centry, 0xFF);
770 return;
771 }
772
773 len = strlen(s);
774 /* can't handle more than 254 char strings. Truncating is probably best */
775 if (len > 254) {
776 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
777 len = 254;
778 }
779 centry_put_uint8(centry, len);
780 centry_expand(centry, len);
781 memcpy(centry->data + centry->ofs, s, len);
782 centry->ofs += len;
783 }
784
785 /*
786 push a 16 byte hash into a centry - treat as 16 byte string.
787 */
788 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
789 {
790 centry_put_uint8(centry, 16);
791 centry_expand(centry, 16);
792 memcpy(centry->data + centry->ofs, val, 16);
793 centry->ofs += 16;
794 }
795
796 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
797 {
798 fstring sid_string;
799 centry_put_string(centry, sid_to_fstring(sid_string, sid));
800 }
801
802
803 /*
804 put NTSTATUS into a centry
805 */
806 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
807 {
808 uint32 status_value = NT_STATUS_V(status);
809 centry_put_uint32(centry, status_value);
810 }
811
812
813 /*
814 push a NTTIME into a centry
815 */
816 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
817 {
818 centry_expand(centry, 8);
819 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
820 centry->ofs += 4;
821 SIVAL(centry->data, centry->ofs, nt >> 32);
822 centry->ofs += 4;
823 }
824
825 /*
826 push a time_t into a centry - use a 64 bit size.
827 NTTIME here is being used as a convenient 64-bit size.
828 */
829 static void centry_put_time(struct cache_entry *centry, time_t t)
830 {
831 NTTIME nt = (NTTIME)t;
832 centry_put_nttime(centry, nt);
833 }
834
835 /*
836 start a centry for output. When finished, call centry_end()
837 */
838 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
839 {
840 struct cache_entry *centry;
841
842 if (!wcache->tdb)
843 return NULL;
844
845 centry = SMB_XMALLOC_P(struct cache_entry);
846
847 centry->len = 8192; /* reasonable default */
848 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
849 centry->ofs = 0;
850 centry->sequence_number = domain->sequence_number;
851 centry_put_ntstatus(centry, status);
852 centry_put_uint32(centry, centry->sequence_number);
853 return centry;
854 }
855
856 /*
857 finish a centry and write it to the tdb
858 */
859 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
860 static void centry_end(struct cache_entry *centry, const char *format, ...)
861 {
862 va_list ap;
863 char *kstr;
864 TDB_DATA key, data;
865
866 if (!winbindd_use_cache()) {
867 return;
868 }
869
870 va_start(ap, format);
871 smb_xvasprintf(&kstr, format, ap);
872 va_end(ap);
873
874 key = string_tdb_data(kstr);
875 data.dptr = centry->data;
876 data.dsize = centry->ofs;
877
878 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
879 free(kstr);
880 }
881
882 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
883 NTSTATUS status, const char *domain_name,
884 const char *name, const DOM_SID *sid,
885 enum lsa_SidType type)
886 {
887 struct cache_entry *centry;
888 fstring uname;
889
890 centry = centry_start(domain, status);
891 if (!centry)
892 return;
893 centry_put_uint32(centry, type);
894 centry_put_sid(centry, sid);
895 fstrcpy(uname, name);
896 strupper_m(uname);
897 centry_end(centry, "NS/%s/%s", domain_name, uname);
898 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
899 uname, sid_string_dbg(sid), nt_errstr(status)));
900 centry_free(centry);
901 }
902
903 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
904 const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
905 {
906 struct cache_entry *centry;
907 fstring sid_string;
908
909 centry = centry_start(domain, status);
910 if (!centry)
911 return;
912
913 if (NT_STATUS_IS_OK(status)) {
914 centry_put_uint32(centry, type);
915 centry_put_string(centry, domain_name);
916 centry_put_string(centry, name);
917 }
918
919 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
920 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
921 name, nt_errstr(status)));
922 centry_free(centry);
923 }
924
925
926 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
927 struct wbint_userinfo *info)
928 {
929 struct cache_entry *centry;
930 fstring sid_string;
931
932 if (is_null_sid(&info->user_sid)) {
933 return;
934 }
935
936 centry = centry_start(domain, status);
937 if (!centry)
938 return;
939 centry_put_string(centry, info->acct_name);
940 centry_put_string(centry, info->full_name);
941 centry_put_string(centry, info->homedir);
942 centry_put_string(centry, info->shell);
943 centry_put_uint32(centry, info->primary_gid);
944 centry_put_sid(centry, &info->user_sid);
945 centry_put_sid(centry, &info->group_sid);
946 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
947 &info->user_sid));
948 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
949 centry_free(centry);
950 }
951
952 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
953 NTSTATUS status,
954 struct samr_DomInfo12 *lockout_policy)
955 {
956 struct cache_entry *centry;
957
958 centry = centry_start(domain, status);
959 if (!centry)
960 return;
961
962 centry_put_nttime(centry, lockout_policy->lockout_duration);
963 centry_put_nttime(centry, lockout_policy->lockout_window);
964 centry_put_uint16(centry, lockout_policy->lockout_threshold);
965
966 centry_end(centry, "LOC_POL/%s", domain->name);
967
968 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
969
970 centry_free(centry);
971 }
972
973
974
975 static void wcache_save_password_policy(struct winbindd_domain *domain,
976 NTSTATUS status,
977 struct samr_DomInfo1 *policy)
978 {
979 struct cache_entry *centry;
980
981 centry = centry_start(domain, status);
982 if (!centry)
983 return;
984
985 centry_put_uint16(centry, policy->min_password_length);
986 centry_put_uint16(centry, policy->password_history_length);
987 centry_put_uint32(centry, policy->password_properties);
988 centry_put_nttime(centry, policy->max_password_age);
989 centry_put_nttime(centry, policy->min_password_age);
990
991 centry_end(centry, "PWD_POL/%s", domain->name);
992
993 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
994
995 centry_free(centry);
996 }
997
998 /***************************************************************************
999 ***************************************************************************/
1000
1001 static void wcache_save_username_alias(struct winbindd_domain *domain,
1002 NTSTATUS status,
1003 const char *name, const char *alias)
1004 {
1005 struct cache_entry *centry;
1006 fstring uname;
1007
1008 if ( (centry = centry_start(domain, status)) == NULL )
1009 return;
1010
1011 centry_put_string( centry, alias );
1012
1013 fstrcpy(uname, name);
1014 strupper_m(uname);
1015 centry_end(centry, "NSS/NA/%s", uname);
1016
1017 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1018
1019 centry_free(centry);
1020 }
1021
1022 static void wcache_save_alias_username(struct winbindd_domain *domain,
1023 NTSTATUS status,
1024 const char *alias, const char *name)
1025 {
1026 struct cache_entry *centry;
1027 fstring uname;
1028
1029 if ( (centry = centry_start(domain, status)) == NULL )
1030 return;
1031
1032 centry_put_string( centry, name );
1033
1034 fstrcpy(uname, alias);
1035 strupper_m(uname);
1036 centry_end(centry, "NSS/AN/%s", uname);
1037
1038 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1039
1040 centry_free(centry);
1041 }
1042
1043 /***************************************************************************
1044 ***************************************************************************/
1045
1046 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1047 struct winbindd_domain *domain,
1048 const char *name, char **alias )
1049 {
1050 struct winbind_cache *cache = get_cache(domain);
1051 struct cache_entry *centry = NULL;
1052 NTSTATUS status;
1053 char *upper_name;
1054
1055 if ( domain->internal )
1056 return NT_STATUS_NOT_SUPPORTED;
1057
1058 if (!cache->tdb)
1059 goto do_query;
1060
1061 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1062 return NT_STATUS_NO_MEMORY;
1063 strupper_m(upper_name);
1064
1065 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1066
1067 SAFE_FREE( upper_name );
1068
1069 if (!centry)
1070 goto do_query;
1071
1072 status = centry->status;
1073
1074 if (!NT_STATUS_IS_OK(status)) {
1075 centry_free(centry);
1076 return status;
1077 }
1078
1079 *alias = centry_string( centry, mem_ctx );
1080
1081 centry_free(centry);
1082
1083 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1084 name, *alias ? *alias : "(none)"));
1085
1086 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1087
1088 do_query:
1089
1090 /* If its not in cache and we are offline, then fail */
1091
1092 if ( get_global_winbindd_state_offline() || !domain->online ) {
1093 DEBUG(8,("resolve_username_to_alias: rejecting query "
1094 "in offline mode\n"));
1095 return NT_STATUS_NOT_FOUND;
1096 }
1097
1098 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1099
1100 if ( NT_STATUS_IS_OK( status ) ) {
1101 wcache_save_username_alias(domain, status, name, *alias);
1102 }
1103
1104 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1105 wcache_save_username_alias(domain, status, name, "(NULL)");
1106 }
1107
1108 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1109 nt_errstr(status)));
1110
1111 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1112 set_domain_offline( domain );
1113 }
1114
1115 return status;
1116 }
1117
1118 /***************************************************************************
1119 ***************************************************************************/
1120
1121 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1122 struct winbindd_domain *domain,
1123 const char *alias, char **name )
1124 {
1125 struct winbind_cache *cache = get_cache(domain);
1126 struct cache_entry *centry = NULL;
1127 NTSTATUS status;
1128 char *upper_name;
1129
1130 if ( domain->internal )
1131 return NT_STATUS_NOT_SUPPORTED;
1132
1133 if (!cache->tdb)
1134 goto do_query;
1135
1136 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1137 return NT_STATUS_NO_MEMORY;
1138 strupper_m(upper_name);
1139
1140 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1141
1142 SAFE_FREE( upper_name );
1143
1144 if (!centry)
1145 goto do_query;
1146
1147 status = centry->status;
1148
1149 if (!NT_STATUS_IS_OK(status)) {
1150 centry_free(centry);
1151 return status;
1152 }
1153
1154 *name = centry_string( centry, mem_ctx );
1155
1156 centry_free(centry);
1157
1158 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1159 alias, *name ? *name : "(none)"));
1160
1161 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1162
1163 do_query:
1164
1165 /* If its not in cache and we are offline, then fail */
1166
1167 if ( get_global_winbindd_state_offline() || !domain->online ) {
1168 DEBUG(8,("resolve_alias_to_username: rejecting query "
1169 "in offline mode\n"));
1170 return NT_STATUS_NOT_FOUND;
1171 }
1172
1173 /* an alias cannot contain a domain prefix or '@' */
1174
1175 if (strchr(alias, '\\') || strchr(alias, '@')) {
1176 DEBUG(10,("resolve_alias_to_username: skipping fully "
1177 "qualified name %s\n", alias));
1178 return NT_STATUS_OBJECT_NAME_INVALID;
1179 }
1180
1181 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1182
1183 if ( NT_STATUS_IS_OK( status ) ) {
1184 wcache_save_alias_username( domain, status, alias, *name );
1185 }
1186
1187 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1188 wcache_save_alias_username(domain, status, alias, "(NULL)");
1189 }
1190
1191 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1192 nt_errstr(status)));
1193
1194 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1195 set_domain_offline( domain );
1196 }
1197
1198 return status;
1199 }
1200
1201 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1202 {
1203 struct winbind_cache *cache = get_cache(domain);
1204 TDB_DATA data;
1205 fstring key_str, tmp;
1206 uint32 rid;
1207
1208 if (!cache->tdb) {
1209 return NT_STATUS_INTERNAL_DB_ERROR;
1210 }
1211
1212 if (is_null_sid(sid)) {
1213 return NT_STATUS_INVALID_SID;
1214 }
1215
1216 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1217 return NT_STATUS_INVALID_SID;
1218 }
1219
1220 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1221
1222 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1223 if (!data.dptr) {
1224 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1225 }
1226
1227 SAFE_FREE(data.dptr);
1228 return NT_STATUS_OK;
1229 }
1230
1231 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1232 as new salted ones. */
1233
1234 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1235 TALLOC_CTX *mem_ctx,
1236 const DOM_SID *sid,
1237 const uint8 **cached_nt_pass,
1238 const uint8 **cached_salt)
1239 {
1240 struct winbind_cache *cache = get_cache(domain);
1241 struct cache_entry *centry = NULL;
1242 NTSTATUS status;
1243 time_t t;
1244 uint32 rid;
1245 fstring tmp;
1246
1247 if (!cache->tdb) {
1248 return NT_STATUS_INTERNAL_DB_ERROR;
1249 }
1250
1251 if (is_null_sid(sid)) {
1252 return NT_STATUS_INVALID_SID;
1253 }
1254
1255 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1256 return NT_STATUS_INVALID_SID;
1257 }
1258
1259 /* Try and get a salted cred first. If we can't
1260 fall back to an unsalted cred. */
1261
1262 centry = wcache_fetch(cache, domain, "CRED/%s",
1263 sid_to_fstring(tmp, sid));
1264 if (!centry) {
1265 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1266 sid_string_dbg(sid)));
1267 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1268 }
1269
1270 t = centry_time(centry);
1271
1272 /* In the salted case this isn't actually the nt_hash itself,
1273 but the MD5 of the salt + nt_hash. Let the caller
1274 sort this out. It can tell as we only return the cached_salt
1275 if we are returning a salted cred. */
1276
1277 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1278 if (*cached_nt_pass == NULL) {
1279 fstring sidstr;
1280
1281 sid_to_fstring(sidstr, sid);
1282
1283 /* Bad (old) cred cache. Delete and pretend we
1284 don't have it. */
1285 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1286 sidstr));
1287 wcache_delete("CRED/%s", sidstr);
1288 centry_free(centry);
1289 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1290 }
1291
1292 /* We only have 17 bytes more data in the salted cred case. */
1293 if (centry->len - centry->ofs == 17) {
1294 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1295 } else {
1296 *cached_salt = NULL;
1297 }
1298
1299 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1300 if (*cached_salt) {
1301 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1302 }
1303
1304 status = centry->status;
1305
1306 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1307 sid_string_dbg(sid), nt_errstr(status) ));
1308
1309 centry_free(centry);
1310 return status;
1311 }
1312
1313 /* Store creds for a SID - only writes out new salted ones. */
1314
1315 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1316 TALLOC_CTX *mem_ctx,
1317 const DOM_SID *sid,
1318 const uint8 nt_pass[NT_HASH_LEN])
1319 {
1320 struct cache_entry *centry;
1321 fstring sid_string;
1322 uint32 rid;
1323 uint8 cred_salt[NT_HASH_LEN];
1324 uint8 salted_hash[NT_HASH_LEN];
1325
1326 if (is_null_sid(sid)) {
1327 return NT_STATUS_INVALID_SID;
1328 }
1329
1330 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1331 return NT_STATUS_INVALID_SID;
1332 }
1333
1334 centry = centry_start(domain, NT_STATUS_OK);
1335 if (!centry) {
1336 return NT_STATUS_INTERNAL_DB_ERROR;
1337 }
1338
1339 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1340
1341 centry_put_time(centry, time(NULL));
1342
1343 /* Create a salt and then salt the hash. */
1344 generate_random_buffer(cred_salt, NT_HASH_LEN);
1345 E_md5hash(cred_salt, nt_pass, salted_hash);
1346
1347 centry_put_hash16(centry, salted_hash);
1348 centry_put_hash16(centry, cred_salt);
1349 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1350
1351 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1352
1353 centry_free(centry);
1354
1355 return NT_STATUS_OK;
1356 }
1357
1358
1359 /* Query display info. This is the basic user list fn */
1360 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1361 TALLOC_CTX *mem_ctx,
1362 uint32 *num_entries,
1363 struct wbint_userinfo **info)
1364 {
1365 struct winbind_cache *cache = get_cache(domain);
1366 struct cache_entry *centry = NULL;
1367 NTSTATUS status;
1368 unsigned int i, retry;
1369
1370 if (!cache->tdb)
1371 goto do_query;
1372
1373 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1374 if (!centry)
1375 goto do_query;
1376
1377 *num_entries = centry_uint32(centry);
1378
1379 if (*num_entries == 0)
1380 goto do_cached;
1381
1382 (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1383 if (! (*info)) {
1384 smb_panic_fn("query_user_list out of memory");
1385 }
1386 for (i=0; i<(*num_entries); i++) {
1387 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1388 (*info)[i].full_name = centry_string(centry, mem_ctx);
1389 (*info)[i].homedir = centry_string(centry, mem_ctx);
1390 (*info)[i].shell = centry_string(centry, mem_ctx);
1391 centry_sid(centry, &(*info)[i].user_sid);
1392 centry_sid(centry, &(*info)[i].group_sid);
1393 }
1394
1395 do_cached:
1396 status = centry->status;
1397
1398 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1399 domain->name, nt_errstr(status) ));
1400
1401 centry_free(centry);
1402 return status;
1403
1404 do_query:
1405 *num_entries = 0;
1406 *info = NULL;
1407
1408 /* Return status value returned by seq number check */
1409
1410 if (!NT_STATUS_IS_OK(domain->last_status))
1411 return domain->last_status;
1412
1413 /* Put the query_user_list() in a retry loop. There appears to be
1414 * some bug either with Windows 2000 or Samba's handling of large
1415 * rpc replies. This manifests itself as sudden disconnection
1416 * at a random point in the enumeration of a large (60k) user list.
1417 * The retry loop simply tries the operation again. )-: It's not
1418 * pretty but an acceptable workaround until we work out what the
1419 * real problem is. */
1420
1421 retry = 0;
1422 do {
1423
1424 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1425 domain->name ));
1426
1427 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1428 if (!NT_STATUS_IS_OK(status)) {
1429 DEBUG(3, ("query_user_list: returned 0x%08x, "
1430 "retrying\n", NT_STATUS_V(status)));
1431 }
1432 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1433 DEBUG(3, ("query_user_list: flushing "
1434 "connection cache\n"));
1435 invalidate_cm_connection(&domain->conn);
1436 }
1437
1438 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1439 (retry++ < 5));
1440
1441 /* and save it */
1442 refresh_sequence_number(domain, false);
1443 centry = centry_start(domain, status);
1444 if (!centry)
1445 goto skip_save;
1446 centry_put_uint32(centry, *num_entries);
1447 for (i=0; i<(*num_entries); i++) {
1448 centry_put_string(centry, (*info)[i].acct_name);
1449 centry_put_string(centry, (*info)[i].full_name);
1450 centry_put_string(centry, (*info)[i].homedir);
1451 centry_put_string(centry, (*info)[i].shell);
1452 centry_put_sid(centry, &(*info)[i].user_sid);
1453 centry_put_sid(centry, &(*info)[i].group_sid);
1454 if (domain->backend && domain->backend->consistent) {
1455 /* when the backend is consistent we can pre-prime some mappings */
1456 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1457 domain->name,
1458 (*info)[i].acct_name,
1459 &(*info)[i].user_sid,
1460 SID_NAME_USER);
1461 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1462 &(*info)[i].user_sid,
1463 domain->name,
1464 (*info)[i].acct_name,
1465 SID_NAME_USER);
1466 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1467 }
1468 }
1469 centry_end(centry, "UL/%s", domain->name);
1470 centry_free(centry);
1471
1472 skip_save:
1473 return status;
1474 }
1475
1476 /* list all domain groups */
1477 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1478 TALLOC_CTX *mem_ctx,
1479 uint32 *num_entries,
1480 struct acct_info **info)
1481 {
1482 struct winbind_cache *cache = get_cache(domain);
1483 struct cache_entry *centry = NULL;
1484 NTSTATUS status;
1485 unsigned int i;
1486
1487 if (!cache->tdb)
1488 goto do_query;
1489
1490 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1491 if (!centry)
1492 goto do_query;
1493
1494 *num_entries = centry_uint32(centry);
1495
1496 if (*num_entries == 0)
1497 goto do_cached;
1498
1499 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1500 if (! (*info)) {
1501 smb_panic_fn("enum_dom_groups out of memory");
1502 }
1503 for (i=0; i<(*num_entries); i++) {
1504 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1505 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1506 (*info)[i].rid = centry_uint32(centry);
1507 }
1508
1509 do_cached:
1510 status = centry->status;
1511
1512 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1513 domain->name, nt_errstr(status) ));
1514
1515 centry_free(centry);
1516 return status;
1517
1518 do_query:
1519 *num_entries = 0;
1520 *info = NULL;
1521
1522 /* Return status value returned by seq number check */
1523
1524 if (!NT_STATUS_IS_OK(domain->last_status))
1525 return domain->last_status;
1526
1527 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1528 domain->name ));
1529
1530 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1531
1532 /* and save it */
1533 refresh_sequence_number(domain, false);
1534 centry = centry_start(domain, status);
1535 if (!centry)
1536 goto skip_save;
1537 centry_put_uint32(centry, *num_entries);
1538 for (i=0; i<(*num_entries); i++) {
1539 centry_put_string(centry, (*info)[i].acct_name);
1540 centry_put_string(centry, (*info)[i].acct_desc);
1541 centry_put_uint32(centry, (*info)[i].rid);
1542 }
1543 centry_end(centry, "GL/%s/domain", domain->name);
1544 centry_free(centry);
1545
1546 skip_save:
1547 return status;
1548 }
1549
1550 /* list all domain groups */
1551 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1552 TALLOC_CTX *mem_ctx,
1553 uint32 *num_entries,
1554 struct acct_info **info)
1555 {
1556 struct winbind_cache *cache = get_cache(domain);
1557 struct cache_entry *centry = NULL;
1558 NTSTATUS status;
1559 unsigned int i;
1560
1561 if (!cache->tdb)
1562 goto do_query;
1563
1564 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1565 if (!centry)
1566 goto do_query;
1567
1568 *num_entries = centry_uint32(centry);
1569
1570 if (*num_entries == 0)
1571 goto do_cached;
1572
1573 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1574 if (! (*info)) {
1575 smb_panic_fn("enum_dom_groups out of memory");
1576 }
1577 for (i=0; i<(*num_entries); i++) {
1578 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1579 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1580 (*info)[i].rid = centry_uint32(centry);
1581 }
1582
1583 do_cached:
1584
1585 /* If we are returning cached data and the domain controller
1586 is down then we don't know whether the data is up to date
1587 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1588 indicate this. */
1589
1590 if (wcache_server_down(domain)) {
1591 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1592 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1593 } else
1594 status = centry->status;
1595
1596 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1597 domain->name, nt_errstr(status) ));
1598
1599 centry_free(centry);
1600 return status;
1601
1602 do_query:
1603 *num_entries = 0;
1604 *info = NULL;
1605
1606 /* Return status value returned by seq number check */
1607
1608 if (!NT_STATUS_IS_OK(domain->last_status))
1609 return domain->last_status;
1610
1611 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1612 domain->name ));
1613
1614 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1615
1616 /* and save it */
1617 refresh_sequence_number(domain, false);
1618 centry = centry_start(domain, status);
1619 if (!centry)
1620 goto skip_save;
1621 centry_put_uint32(centry, *num_entries);
1622 for (i=0; i<(*num_entries); i++) {
1623 centry_put_string(centry, (*info)[i].acct_name);
1624 centry_put_string(centry, (*info)[i].acct_desc);
1625 centry_put_uint32(centry, (*info)[i].rid);
1626 }
1627 centry_end(centry, "GL/%s/local", domain->name);
1628 centry_free(centry);
1629
1630 skip_save:
1631 return status;
1632 }
1633
1634 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1635 const char *domain_name,
1636 const char *name,
1637 struct dom_sid *sid,
1638 enum lsa_SidType *type)
1639 {
1640 struct winbind_cache *cache = get_cache(domain);
1641 struct cache_entry *centry;
1642 NTSTATUS status;
1643 char *uname;
1644
1645 if (cache->tdb == NULL) {
1646 return NT_STATUS_NOT_FOUND;
1647 }
1648
1649 uname = talloc_strdup_upper(talloc_tos(), name);
1650 if (uname == NULL) {
1651 return NT_STATUS_NO_MEMORY;
1652 }
1653
1654 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1655 TALLOC_FREE(uname);
1656 if (centry == NULL) {
1657 return NT_STATUS_NOT_FOUND;
1658 }
1659
1660 status = centry->status;
1661 if (NT_STATUS_IS_OK(status)) {
1662 *type = (enum lsa_SidType)centry_uint32(centry);
1663 centry_sid(centry, sid);
1664 }
1665
1666 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1667 "%s\n", domain->name, nt_errstr(status) ));
1668
1669 centry_free(centry);
1670 return status;
1671 }
1672
1673 /* convert a single name to a sid in a domain */
1674 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1675 TALLOC_CTX *mem_ctx,
1676 const char *domain_name,
1677 const char *name,
1678 uint32_t flags,
1679 DOM_SID *sid,
1680 enum lsa_SidType *type)
1681 {
1682 NTSTATUS status;
1683
1684 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1685 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1686 return status;
1687 }
1688
1689 ZERO_STRUCTP(sid);
1690
1691 /* If the seq number check indicated that there is a problem
1692 * with this DC, then return that status... except for
1693 * access_denied. This is special because the dc may be in
1694 * "restrict anonymous = 1" mode, in which case it will deny
1695 * most unauthenticated operations, but *will* allow the LSA
1696 * name-to-sid that we try as a fallback. */
1697
1698 if (!(NT_STATUS_IS_OK(domain->last_status)
1699 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1700 return domain->last_status;
1701
1702 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1703 domain->name ));
1704
1705 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1706 name, flags, sid, type);
1707
1708 /* and save it */
1709 refresh_sequence_number(domain, false);
1710
1711 if (domain->online &&
1712 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1713 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1714
1715 /* Only save the reverse mapping if this was not a UPN */
1716 if (!strchr(name, '@')) {
1717 strupper_m(CONST_DISCARD(char *,domain_name));
1718 strlower_m(CONST_DISCARD(char *,name));
1719 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1720 }
1721 }
1722
1723 return status;
1724 }
1725
1726 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1727 const struct dom_sid *sid,
1728 TALLOC_CTX *mem_ctx,
1729 char **domain_name,
1730 char **name,
1731 enum lsa_SidType *type)
1732 {
1733 struct winbind_cache *cache = get_cache(domain);
1734 struct cache_entry *centry;
1735 char *sid_string;
1736 NTSTATUS status;
1737
1738 if (cache->tdb == NULL) {
1739 return NT_STATUS_NOT_FOUND;
1740 }
1741
1742 sid_string = sid_string_tos(sid);
1743 if (sid_string == NULL) {
1744 return NT_STATUS_NO_MEMORY;
1745 }
1746
1747 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1748 TALLOC_FREE(sid_string);
1749 if (centry == NULL) {
1750 return NT_STATUS_NOT_FOUND;
1751 }
1752
1753 if (NT_STATUS_IS_OK(centry->status)) {
1754 *type = (enum lsa_SidType)centry_uint32(centry);
1755 *domain_name = centry_string(centry, mem_ctx);
1756 *name = centry_string(centry, mem_ctx);
1757 }
1758
1759 status = centry->status;
1760 centry_free(centry);
1761
1762 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1763 "%s\n", domain->name, nt_errstr(status) ));
1764
1765 return status;
1766 }
1767
1768 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1769 given */
1770 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1771 TALLOC_CTX *mem_ctx,
1772 const DOM_SID *sid,
1773 char **domain_name,
1774 char **name,
1775 enum lsa_SidType *type)
1776 {
1777 NTSTATUS status;
1778
1779 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1780 type);
1781 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1782 return status;
1783 }
1784
1785 *name = NULL;
1786 *domain_name = NULL;
1787
1788 /* If the seq number check indicated that there is a problem
1789 * with this DC, then return that status... except for
1790 * access_denied. This is special because the dc may be in
1791 * "restrict anonymous = 1" mode, in which case it will deny
1792 * most unauthenticated operations, but *will* allow the LSA
1793 * sid-to-name that we try as a fallback. */
1794
1795 if (!(NT_STATUS_IS_OK(domain->last_status)
1796 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1797 return domain->last_status;
1798
1799 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1800 domain->name ));
1801
1802 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1803
1804 /* and save it */
1805 refresh_sequence_number(domain, false);
1806 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1807
1808 /* We can't save the name to sid mapping here, as with sid history a
1809 * later name2sid would give the wrong sid. */
1810
1811 return status;
1812 }
1813
1814 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1815 TALLOC_CTX *mem_ctx,
1816 const DOM_SID *domain_sid,
1817 uint32 *rids,
1818 size_t num_rids,
1819 char **domain_name,
1820 char ***names,
1821 enum lsa_SidType **types)
1822 {
1823 struct winbind_cache *cache = get_cache(domain);
1824 size_t i;
1825 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1826 bool have_mapped;
1827 bool have_unmapped;
1828
1829 *domain_name = NULL;
1830 *names = NULL;
1831 *types = NULL;
1832
1833 if (!cache->tdb) {
1834 goto do_query;
1835 }
1836
1837 if (num_rids == 0) {
1838 return NT_STATUS_OK;
1839 }
1840
1841 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1842 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1843
1844 if ((*names == NULL) || (*types == NULL)) {
1845 result = NT_STATUS_NO_MEMORY;
1846 goto error;
1847 }
1848
1849 have_mapped = have_unmapped = false;
1850
1851 for (i=0; i<num_rids; i++) {
1852 DOM_SID sid;
1853 struct cache_entry *centry;
1854 fstring tmp;
1855
1856 if (!sid_compose(&sid, domain_sid, rids[i])) {
1857 result = NT_STATUS_INTERNAL_ERROR;
1858 goto error;
1859 }
1860
1861 centry = wcache_fetch(cache, domain, "SN/%s",
1862 sid_to_fstring(tmp, &sid));
1863 if (!centry) {
1864 goto do_query;
1865 }
1866
1867 (*types)[i] = SID_NAME_UNKNOWN;
1868 (*names)[i] = talloc_strdup(*names, "");
1869
1870 if (NT_STATUS_IS_OK(centry->status)) {
1871 char *dom;
1872 have_mapped = true;
1873 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1874
1875 dom = centry_string(centry, mem_ctx);
1876 if (*domain_name == NULL) {
1877 *domain_name = dom;
1878 } else {
1879 talloc_free(dom);
1880 }
1881
1882 (*names)[i] = centry_string(centry, *names);
1883
1884 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1885 have_unmapped = true;
1886
1887 } else {
1888 /* something's definitely wrong */
1889 result = centry->status;
1890 goto error;
1891 }
1892
1893 centry_free(centry);
1894 }
1895
1896 if (!have_mapped) {
1897 return NT_STATUS_NONE_MAPPED;
1898 }
1899 if (!have_unmapped) {
1900 return NT_STATUS_OK;
1901 }
1902 return STATUS_SOME_UNMAPPED;
1903
1904 do_query:
1905
1906 TALLOC_FREE(*names);
1907 TALLOC_FREE(*types);
1908
1909 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1910 rids, num_rids, domain_name,
1911 names, types);
1912
1913 /*
1914 None of the queried rids has been found so save all negative entries
1915 */
1916 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1917 for (i = 0; i < num_rids; i++) {
1918 DOM_SID sid;
1919 const char *name = "";
1920 const enum lsa_SidType type = SID_NAME_UNKNOWN;
1921 NTSTATUS status = NT_STATUS_NONE_MAPPED;
1922
1923 if (!sid_compose(&sid, domain_sid, rids[i])) {
1924 return NT_STATUS_INTERNAL_ERROR;
1925 }
1926
1927 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1928 name, type);
1929 }
1930
1931 return result;
1932 }
1933
1934 /*
1935 Some or all of the queried rids have been found.
1936 */
1937 if (!NT_STATUS_IS_OK(result) &&
1938 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1939 return result;
1940 }
1941
1942 refresh_sequence_number(domain, false);
1943
1944 for (i=0; i<num_rids; i++) {
1945 DOM_SID sid;
1946 NTSTATUS status;
1947
1948 if (!sid_compose(&sid, domain_sid, rids[i])) {
1949 result = NT_STATUS_INTERNAL_ERROR;
1950 goto error;
1951 }
1952
1953 status = (*types)[i] == SID_NAME_UNKNOWN ?
1954 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1955
1956 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1957 (*names)[i], (*types)[i]);
1958 }
1959
1960 return result;
1961
1962 error:
1963 TALLOC_FREE(*names);
1964 TALLOC_FREE(*types);
1965 return result;
1966 }
1967
1968 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
1969 TALLOC_CTX *mem_ctx,
1970 const struct dom_sid *user_sid,
1971 struct wbint_userinfo *info)
1972 {
1973 struct winbind_cache *cache = get_cache(domain);
1974 struct cache_entry *centry = NULL;
1975 NTSTATUS status;
1976 char *sid_string;
1977
1978 if (cache->tdb == NULL) {
1979 return NT_STATUS_NOT_FOUND;
1980 }
1981
1982 sid_string = sid_string_tos(user_sid);
1983 if (sid_string == NULL) {
1984 return NT_STATUS_NO_MEMORY;
1985 }
1986
1987 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
1988 TALLOC_FREE(sid_string);
1989 if (centry == NULL) {
1990 return NT_STATUS_NOT_FOUND;
1991 }
1992
1993 /*
1994 * If we have an access denied cache entry and a cached info3
1995 * in the samlogon cache then do a query. This will force the
1996 * rpc back end to return the info3 data.
1997 */
1998
1999 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2000 netsamlogon_cache_have(user_sid)) {
2001 DEBUG(10, ("query_user: cached access denied and have cached "
2002 "info3\n"));
2003 domain->last_status = NT_STATUS_OK;
2004 centry_free(centry);
2005 return NT_STATUS_NOT_FOUND;
2006 }
2007
2008 /* if status is not ok then this is a negative hit
2009 and the rest of the data doesn't matter */
2010 status = centry->status;
2011 if (NT_STATUS_IS_OK(status)) {
2012 info->acct_name = centry_string(centry, mem_ctx);
2013 info->full_name = centry_string(centry, mem_ctx);
2014 info->homedir = centry_string(centry, mem_ctx);
2015 info->shell = centry_string(centry, mem_ctx);
2016 info->primary_gid = centry_uint32(centry);
2017 centry_sid(centry, &info->user_sid);
2018 centry_sid(centry, &info->group_sid);
2019 }
2020
2021 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2022 "%s\n", domain->name, nt_errstr(status) ));
2023
2024 centry_free(centry);
2025 return status;
2026 }
2027
2028 /* Lookup user information from a rid */
2029 static NTSTATUS query_user(struct winbindd_domain *domain,
2030 TALLOC_CTX *mem_ctx,
2031 const DOM_SID *user_sid,
2032 struct wbint_userinfo *info)
2033 {
2034 NTSTATUS status;
2035
2036 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2037 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2038 return status;
2039 }
2040
2041 ZERO_STRUCTP(info);
2042
2043 /* Return status value returned by seq number check */
2044
2045 if (!NT_STATUS_IS_OK(domain->last_status))
2046 return domain->last_status;
2047
2048 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2049 domain->name ));
2050
2051 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2052
2053 /* and save it */
2054 refresh_sequence_number(domain, false);
2055 wcache_save_user(domain, status, info);
2056
2057 return status;
2058 }
2059
2060 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2061 TALLOC_CTX *mem_ctx,
2062 const struct dom_sid *user_sid,
2063 uint32_t *pnum_sids,
2064 struct dom_sid **psids)
2065 {
2066 struct winbind_cache *cache = get_cache(domain);
2067 struct cache_entry *centry = NULL;
2068 NTSTATUS status;
2069 uint32_t i, num_sids;
2070 struct dom_sid *sids;
2071 fstring sid_string;
2072
2073 if (cache->tdb == NULL) {
2074 return NT_STATUS_NOT_FOUND;
2075 }
2076
2077 centry = wcache_fetch(cache, domain, "UG/%s",
2078 sid_to_fstring(sid_string, user_sid));
2079 if (centry == NULL) {
2080 return NT_STATUS_NOT_FOUND;
2081 }
2082
2083 /* If we have an access denied cache entry and a cached info3 in the
2084 samlogon cache then do a query. This will force the rpc back end
2085 to return the info3 data. */
2086
2087 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2088 && netsamlogon_cache_have(user_sid)) {
2089 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2090 "cached info3\n"));
2091 domain->last_status = NT_STATUS_OK;
2092 centry_free(centry);
2093 return NT_STATUS_NOT_FOUND;
2094 }
2095
2096 num_sids = centry_uint32(centry);
2097 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2098 if (sids == NULL) {
2099 return NT_STATUS_NO_MEMORY;
2100 }
2101
2102 for (i=0; i<num_sids; i++) {
2103 centry_sid(centry, &sids[i]);
2104 }
2105
2106 status = centry->status;
2107
2108 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2109 "status: %s\n", domain->name, nt_errstr(status)));
2110
2111 centry_free(centry);
2112
2113 *pnum_sids = num_sids;
2114 *psids = sids;
2115 return status;
2116 }
2117
2118 /* Lookup groups a user is a member of. */
2119 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2120 TALLOC_CTX *mem_ctx,
2121 const DOM_SID *user_sid,
2122 uint32 *num_groups, DOM_SID **user_gids)
2123 {
2124 struct cache_entry *centry = NULL;
2125 NTSTATUS status;
2126 unsigned int i;
2127 fstring sid_string;
2128
2129 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2130 num_groups, user_gids);
2131 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2132 return status;
2133 }
2134
2135 (*num_groups) = 0;
2136 (*user_gids) = NULL;
2137
2138 /* Return status value returned by seq number check */
2139
2140 if (!NT_STATUS_IS_OK(domain->last_status))
2141 return domain->last_status;
2142
2143 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2144 domain->name ));
2145
2146 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2147
2148 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2149 goto skip_save;
2150
2151 /* and save it */
2152 refresh_sequence_number(domain, false);
2153 centry = centry_start(domain, status);
2154 if (!centry)
2155 goto skip_save;
2156
2157 centry_put_uint32(centry, *num_groups);
2158 for (i=0; i<(*num_groups); i++) {
2159 centry_put_sid(centry, &(*user_gids)[i]);
2160 }
2161
2162 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2163 centry_free(centry);
2164
2165 skip_save:
2166 return status;
2167 }
2168
2169 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2170 const struct dom_sid *sids)
2171 {
2172 uint32_t i;
2173 char *sidlist;
2174
2175 sidlist = talloc_strdup(mem_ctx, "");
2176 if (sidlist == NULL) {
2177 return NULL;
2178 }
2179 for (i=0; i<num_sids; i++) {
2180 fstring tmp;
2181 sidlist = talloc_asprintf_append_buffer(
2182 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2183 if (sidlist == NULL) {
2184 return NULL;
2185 }
2186 }
2187 return sidlist;
2188 }
2189
2190 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2191 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2192 const struct dom_sid *sids,
2193 uint32_t *pnum_aliases, uint32_t **paliases)
2194 {
2195 struct winbind_cache *cache = get_cache(domain);
2196 struct cache_entry *centry = NULL;
2197 uint32_t num_aliases;
2198 uint32_t *aliases;
2199 NTSTATUS status;
2200 char *sidlist;
2201 int i;
2202
2203 if (cache->tdb == NULL) {
2204 return NT_STATUS_NOT_FOUND;
2205 }
2206
2207 if (num_sids == 0) {
2208 *pnum_aliases = 0;
2209 *paliases = NULL;
2210 return NT_STATUS_OK;
2211 }
2212
2213 /* We need to cache indexed by the whole list of SIDs, the aliases
2214 * resulting might come from any of the SIDs. */
2215
2216 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2217 if (sidlist == NULL) {
2218 return NT_STATUS_NO_MEMORY;
2219 }
2220
2221 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2222 TALLOC_FREE(sidlist);
2223 if (centry == NULL) {
2224 return NT_STATUS_NOT_FOUND;
2225 }
2226
2227 num_aliases = centry_uint32(centry);
2228 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2229 if (aliases == NULL) {
2230 centry_free(centry);
2231 return NT_STATUS_NO_MEMORY;
2232 }
2233
2234 for (i=0; i<num_aliases; i++) {
2235 aliases[i] = centry_uint32(centry);
2236 }
2237
2238 status = centry->status;
2239
2240 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2241 "status %s\n", domain->name, nt_errstr(status)));
2242
2243 centry_free(centry);
2244
2245 *pnum_aliases = num_aliases;
2246 *paliases = aliases;
2247
2248 return status;
2249 }
2250
2251 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2252 TALLOC_CTX *mem_ctx,
2253 uint32 num_sids, const DOM_SID *sids,
2254 uint32 *num_aliases, uint32 **alias_rids)
2255 {
2256 struct cache_entry *centry = NULL;
2257 NTSTATUS status;
2258 char *sidlist;
2259 int i;
2260
2261 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2262 num_aliases, alias_rids);
2263 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2264 return status;
2265 }
2266
2267 (*num_aliases) = 0;
2268 (*alias_rids) = NULL;
2269
2270 if (!NT_STATUS_IS_OK(domain->last_status))
2271 return domain->last_status;
2272
2273 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2274 "for domain %s\n", domain->name ));
2275
2276 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2277 if (sidlist == NULL) {
2278 return NT_STATUS_NO_MEMORY;
2279 }
2280
2281 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2282 num_sids, sids,
2283 num_aliases, alias_rids);
2284
2285 /* and save it */
2286 refresh_sequence_number(domain, false);
2287 centry = centry_start(domain, status);
2288 if (!centry)
2289 goto skip_save;
2290 centry_put_uint32(centry, *num_aliases);
2291 for (i=0; i<(*num_aliases); i++)
2292 centry_put_uint32(centry, (*alias_rids)[i]);
2293 centry_end(centry, "UA%s", sidlist);
2294 centry_free(centry);
2295
2296 skip_save:
2297 return status;
2298 }
2299
2300 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2301 TALLOC_CTX *mem_ctx,
2302 const struct dom_sid *group_sid,
2303 uint32_t *num_names,
2304 struct dom_sid **sid_mem, char ***names,
2305 uint32_t **name_types)
2306 {
2307 struct winbind_cache *cache = get_cache(domain);
2308 struct cache_entry *centry = NULL;
2309 NTSTATUS status;
2310 unsigned int i;
2311 char *sid_string;
2312
2313 if (cache->tdb == NULL) {
2314 return NT_STATUS_NOT_FOUND;
2315 }
2316
2317 sid_string = sid_string_tos(group_sid);
2318 if (sid_string == NULL) {
2319 return NT_STATUS_NO_MEMORY;
2320 }
2321
2322 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2323 TALLOC_FREE(sid_string);
2324 if (centry == NULL) {
2325 return NT_STATUS_NOT_FOUND;
2326 }
2327
2328 *sid_mem = NULL;
2329 *names = NULL;
2330 *name_types = NULL;
2331
2332 *num_names = centry_uint32(centry);
2333 if (*num_names == 0) {
2334 centry_free(centry);
2335 return NT_STATUS_OK;
2336 }
2337
2338 *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2339 *names = talloc_array(mem_ctx, char *, *num_names);
2340 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2341
2342 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2343 TALLOC_FREE(*sid_mem);
2344 TALLOC_FREE(*names);
2345 TALLOC_FREE(*name_types);
2346 centry_free(centry);
2347 return NT_STATUS_NO_MEMORY;
2348 }
2349
2350 for (i=0; i<(*num_names); i++) {
2351 centry_sid(centry, &(*sid_mem)[i]);
2352 (*names)[i] = centry_string(centry, mem_ctx);
2353 (*name_types)[i] = centry_uint32(centry);
2354 }
2355
2356 status = centry->status;
2357
2358 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2359 "status: %s\n", domain->name, nt_errstr(status)));
2360
2361 centry_free(centry);
2362 return status;
2363 }
2364
2365 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2366 TALLOC_CTX *mem_ctx,
2367 const DOM_SID *group_sid, uint32 *num_names,
2368 DOM_SID **sid_mem, char ***names,
2369 uint32 **name_types)
2370 {
2371 struct cache_entry *centry = NULL;
2372 NTSTATUS status;
2373 unsigned int i;
2374 fstring sid_string;
2375
2376 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2377 sid_mem, names, name_types);
2378 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2379 return status;
2380 }
2381
2382 (*num_names) = 0;
2383 (*sid_mem) = NULL;
2384 (*names) = NULL;
2385 (*name_types) = NULL;
2386
2387 /* Return status value returned by seq number check */
2388
2389 if (!NT_STATUS_IS_OK(domain->last_status))
2390 return domain->last_status;
2391
2392 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2393 domain->name ));
2394
2395 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2396 sid_mem, names, name_types);
2397
2398 /* and save it */
2399 refresh_sequence_number(domain, false);
2400 centry = centry_start(domain, status);
2401 if (!centry)
2402 goto skip_save;
2403 centry_put_uint32(centry, *num_names);
2404 for (i=0; i<(*num_names); i++) {
2405 centry_put_sid(centry, &(*sid_mem)[i]);
2406 centry_put_string(centry, (*names)[i]);
2407 centry_put_uint32(centry, (*name_types)[i]);
2408 }
2409 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2410 centry_free(centry);
2411
2412 skip_save:
2413 return status;
2414 }
2415
2416 /* find the sequence number for a domain */
2417 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2418 {
2419 refresh_sequence_number(domain, false);
2420
2421 *seq = domain->sequence_number;
2422
2423 return NT_STATUS_OK;
2424 }
2425
2426 /* enumerate trusted domains
2427 * (we need to have the list of trustdoms in the cache when we go offline) -
2428 * Guenther */
2429 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2430 TALLOC_CTX *mem_ctx,
2431 uint32 *num_domains,
2432 char ***names,
2433 char ***alt_names,
2434 DOM_SID **dom_sids)
2435 {
2436 struct winbind_cache *cache = get_cache(domain);
2437 struct cache_entry *centry = NULL;
2438 NTSTATUS status;
2439 int i;
2440
2441 if (!cache->tdb)
2442 goto do_query;
2443
2444 centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2445
2446 if (!centry) {
2447 goto do_query;
2448 }
2449
2450 *num_domains = centry_uint32(centry);
2451
2452 if (*num_domains) {
2453 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2454 (*alt_names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2455 (*dom_sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2456
2457 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2458 smb_panic_fn("trusted_domains out of memory");
2459 }
2460 } else {
2461 (*names) = NULL;
2462 (*alt_names) = NULL;
2463 (*dom_sids) = NULL;
2464 }
2465
2466 for (i=0; i<(*num_domains); i++) {
2467 (*names)[i] = centry_string(centry, mem_ctx);
2468 (*alt_names)[i] = centry_string(centry, mem_ctx);
2469 if (!centry_sid(centry, &(*dom_sids)[i])) {
2470 sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2471 }
2472 }
2473
2474 status = centry->status;
2475
2476 DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2477 domain->name, *num_domains, nt_errstr(status) ));
2478
2479 centry_free(centry);
2480 return status;
2481
2482 do_query:
2483 (*num_domains) = 0;
2484 (*dom_sids) = NULL;
2485 (*names) = NULL;
2486 (*alt_names) = NULL;
2487
2488 /* Return status value returned by seq number check */
2489
2490 if (!NT_STATUS_IS_OK(domain->last_status))
2491 return domain->last_status;
2492
2493 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2494 domain->name ));
2495
2496 status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2497 names, alt_names, dom_sids);
2498
2499 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2500 * so that the generic centry handling still applies correctly -
2501 * Guenther*/
2502
2503 if (!NT_STATUS_IS_ERR(status)) {
2504 status = NT_STATUS_OK;
2505 }
2506
2507
2508 #if 0 /* Disabled as we want the trust dom list to be managed by
2509 the main parent and always to make the query. --jerry */
2510
2511 /* and save it */
2512 refresh_sequence_number(domain, false);
2513
2514 centry = centry_start(domain, status);
2515 if (!centry)
2516 goto skip_save;
2517
2518 centry_put_uint32(centry, *num_domains);
2519
2520 for (i=0; i<(*num_domains); i++) {
2521 centry_put_string(centry, (*names)[i]);
2522 centry_put_string(centry, (*alt_names)[i]);
2523 centry_put_sid(centry, &(*dom_sids)[i]);
2524 }
2525
2526 centry_end(centry, "TRUSTDOMS/%s", domain->name);
2527
2528 centry_free(centry);
2529
2530 skip_save:
2531 #endif
2532
2533 return status;
2534 }
2535
2536 /* get lockout policy */
2537 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2538 TALLOC_CTX *mem_ctx,
2539 struct samr_DomInfo12 *policy)
2540 {
2541 struct winbind_cache *cache = get_cache(domain);
2542 struct cache_entry *centry = NULL;
2543 NTSTATUS status;
2544
2545 if (!cache->tdb)
2546 goto do_query;
2547
2548 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2549
2550 if (!centry)
2551 goto do_query;
2552
2553 policy->lockout_duration = centry_nttime(centry);
2554 policy->lockout_window = centry_nttime(centry);
2555 policy->lockout_threshold = centry_uint16(centry);
2556
2557 status = centry->status;
2558
2559 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2560 domain->name, nt_errstr(status) ));
2561
2562 centry_free(centry);
2563 return status;
2564
2565 do_query:
2566 ZERO_STRUCTP(policy);
2567
2568 /* Return status value returned by seq number check */
2569
2570 if (!NT_STATUS_IS_OK(domain->last_status))
2571 return domain->last_status;
2572
2573 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2574 domain->name ));
2575
2576 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2577
2578 /* and save it */
2579 refresh_sequence_number(domain, false);
2580 wcache_save_lockout_policy(domain, status, policy);
2581
2582 return status;
2583 }
2584
2585 /* get password policy */
2586 static NTSTATUS password_policy(struct winbindd_domain *domain,
2587 TALLOC_CTX *mem_ctx,
2588 struct samr_DomInfo1 *policy)
2589 {
2590 struct winbind_cache *cache = get_cache(domain);
2591 struct cache_entry *centry = NULL;
2592 NTSTATUS status;
2593
2594 if (!cache->tdb)
2595 goto do_query;
2596
2597 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2598
2599 if (!centry)
2600 goto do_query;
2601
2602 policy->min_password_length = centry_uint16(centry);
2603 policy->password_history_length = centry_uint16(centry);
2604 policy->password_properties = centry_uint32(centry);
2605 policy->max_password_age = centry_nttime(centry);
2606 policy->min_password_age = centry_nttime(centry);
2607
2608 status = centry->status;
2609
2610 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2611 domain->name, nt_errstr(status) ));
2612
2613 centry_free(centry);
2614 return status;
2615
2616 do_query:
2617 ZERO_STRUCTP(policy);
2618
2619 /* Return status value returned by seq number check */
2620
2621 if (!NT_STATUS_IS_OK(domain->last_status))
2622 return domain->last_status;
2623
2624 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2625 domain->name ));
2626
2627 status = domain->backend->password_policy(domain, mem_ctx, policy);
2628
2629 /* and save it */
2630 refresh_sequence_number(domain, false);
2631 if (NT_STATUS_IS_OK(status)) {
2632 wcache_save_password_policy(domain, status, policy);
2633 }
2634
2635 return status;
2636 }
2637
2638
2639 /* Invalidate cached user and group lists coherently */
2640
2641 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2642 void *state)
2643 {
2644 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2645 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2646 tdb_delete(the_tdb, kbuf);
2647
2648 return 0;
2649 }
2650
2651 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2652
2653 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2654 struct netr_SamInfo3 *info3)
2655 {
2656 DOM_SID sid;
2657 fstring key_str, sid_string;
2658 struct winbind_cache *cache;
2659
2660 /* dont clear cached U/SID and UG/SID entries when we want to logon
2661 * offline - gd */
2662
2663 if (lp_winbind_offline_logon()) {
2664 return;
2665 }
2666
2667 if (!domain)
2668 return;
2669
2670 cache = get_cache(domain);
2671
2672 if (!cache->tdb) {
2673 return;
2674 }
2675
2676 sid_copy(&sid, info3->base.domain_sid);
2677 sid_append_rid(&sid, info3->base.rid);
2678
2679 /* Clear U/SID cache entry */
2680 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2681 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2682 tdb_delete(cache->tdb, string_tdb_data(key_str));
2683
2684 /* Clear UG/SID cache entry */
2685 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2686 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2687 tdb_delete(cache->tdb, string_tdb_data(key_str));
2688
2689 /* Samba/winbindd never needs this. */
2690 netsamlogon_clear_cached_user(info3);
2691 }
2692
2693 bool wcache_invalidate_cache(void)
2694 {
2695 struct winbindd_domain *domain;
2696
2697 for (domain = domain_list(); domain; domain = domain->next) {
2698 struct winbind_cache *cache = get_cache(domain);
2699
2700 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2701 "entries for %s\n", domain->name));
2702 if (cache) {
2703 if (cache->tdb) {
2704 tdb_traverse(cache->tdb, traverse_fn, NULL);
2705 } else {
2706 return false;
2707 }
2708 }
2709 }
2710 return true;
2711 }
2712
2713 bool init_wcache(void)
2714 {
2715 if (wcache == NULL) {
2716 wcache = SMB_XMALLOC_P(struct winbind_cache);
2717 ZERO_STRUCTP(wcache);
2718 }
2719
2720 if (wcache->tdb != NULL)
2721 return true;
2722
2723 /* when working offline we must not clear the cache on restart */
2724 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2725 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2726 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2727 O_RDWR|O_CREAT, 0600);
2728
2729 if (wcache->tdb == NULL) {
2730 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2731 return false;
2732 }
2733
2734 return true;
2735 }
2736
2737 /************************************************************************
2738 This is called by the parent to initialize the cache file.
2739 We don't need sophisticated locking here as we know we're the
2740 only opener.
2741 ************************************************************************/
2742
2743 bool initialize_winbindd_cache(void)
2744 {
2745 bool cache_bad = true;
2746 uint32 vers;
2747
2748 if (!init_wcache()) {
2749 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2750 return false;
2751 }
2752
2753 /* Check version number. */
2754 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2755 vers == WINBINDD_CACHE_VERSION) {
2756 cache_bad = false;
2757 }
2758
2759 if (cache_bad) {
2760 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2761 "and re-creating with version number %d\n",
2762 WINBINDD_CACHE_VERSION ));
2763
2764 tdb_close(wcache->tdb);
2765 wcache->tdb = NULL;
2766
2767 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2768 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2769 cache_path("winbindd_cache.tdb"),
2770 strerror(errno) ));
2771 return false;
2772 }
2773 if (!init_wcache()) {
2774 DEBUG(0,("initialize_winbindd_cache: re-initialization "
2775 "init_wcache failed.\n"));
2776 return false;
2777 }
2778
2779 /* Write the version. */
2780 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2781 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2782 tdb_errorstr(wcache->tdb) ));
2783 return false;
2784 }
2785 }
2786
2787 tdb_close(wcache->tdb);
2788 wcache->tdb = NULL;
2789 return true;
2790 }
2791
2792 void close_winbindd_cache(void)
2793 {
2794 if (!wcache) {
2795 return;
2796 }
2797 if (wcache->tdb) {
2798 tdb_close(wcache->tdb);
2799 wcache->tdb = NULL;
2800 }
2801 }
2802
2803 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2804 char **domain_name, char **name,
2805 enum lsa_SidType *type)
2806 {
2807 struct winbindd_domain *domain;
2808 NTSTATUS status;
2809
2810 domain = find_lookup_domain_from_sid(sid);
2811 if (domain == NULL) {
2812 return false;
2813 }
2814 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
2815 type);
2816 return NT_STATUS_IS_OK(status);
2817 }
2818
2819 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2820 const char *domain_name,
2821 const char *name,
2822 DOM_SID *sid,
2823 enum lsa_SidType *type)
2824 {
2825 struct winbindd_domain *domain;
2826 NTSTATUS status;
2827 bool original_online_state;
2828
2829 domain = find_lookup_domain_from_name(domain_name);
2830 if (domain == NULL) {
2831 return false;
2832 }
2833
2834 /* If we are doing a cached logon, temporarily set the domain
2835 offline so the cache won't expire the entry */
2836
2837 original_online_state = domain->online;
2838 domain->online = false;
2839 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
2840 domain->online = original_online_state;
2841
2842 return NT_STATUS_IS_OK(status);
2843 }
2844
2845 void cache_name2sid(struct winbindd_domain *domain,
2846 const char *domain_name, const char *name,
2847 enum lsa_SidType type, const DOM_SID *sid)
2848 {
2849 refresh_sequence_number(domain, false);
2850 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2851 sid, type);
2852 }
2853
2854 /*
2855 * The original idea that this cache only contains centries has
2856 * been blurred - now other stuff gets put in here. Ensure we
2857 * ignore these things on cleanup.
2858 */
2859
2860 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2861 TDB_DATA dbuf, void *state)
2862 {
2863 struct cache_entry *centry;
2864
2865 if (is_non_centry_key(kbuf)) {
2866 return 0;
2867 }
2868
2869 centry = wcache_fetch_raw((char *)kbuf.dptr);
2870 if (!centry) {
2871 return 0;
2872 }
2873
2874 if (!NT_STATUS_IS_OK(centry->status)) {
2875 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2876 tdb_delete(the_tdb, kbuf);
2877 }
2878
2879 centry_free(centry);
2880 return 0;
2881 }
2882
2883 /* flush the cache */
2884 void wcache_flush_cache(void)
2885 {
2886 if (!wcache)
2887 return;
2888 if (wcache->tdb) {
2889 tdb_close(wcache->tdb);
2890 wcache->tdb = NULL;
2891 }
2892 if (!winbindd_use_cache()) {
2893 return;
2894 }
2895
2896 /* when working offline we must not clear the cache on restart */
2897 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2898 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2899 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2900 O_RDWR|O_CREAT, 0600);
2901
2902 if (!wcache->tdb) {
2903 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2904 return;
2905 }
2906
2907 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2908
2909 DEBUG(10,("wcache_flush_cache success\n"));
2910 }
2911
2912 /* Count cached creds */
2913
2914 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2915 void *state)
2916 {
2917 int *cred_count = (int*)state;
2918
2919 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2920 (*cred_count)++;
2921 }
2922 return 0;
2923 }
2924
2925 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2926 {
2927 struct winbind_cache *cache = get_cache(domain);
2928
2929 *count = 0;
2930
2931 if (!cache->tdb) {
2932 return NT_STATUS_INTERNAL_DB_ERROR;
2933 }
2934
2935 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2936
2937 return NT_STATUS_OK;
2938 }
2939
2940 struct cred_list {
2941 struct cred_list *prev, *next;
2942 TDB_DATA key;
2943 fstring name;
2944 time_t created;
2945 };
2946 static struct cred_list *wcache_cred_list;
2947
2948 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2949 void *state)
2950 {
2951 struct cred_list *cred;
2952
2953 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2954
2955 cred = SMB_MALLOC_P(struct cred_list);
2956 if (cred == NULL) {
2957 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2958 return -1;
2959 }
2960
2961 ZERO_STRUCTP(cred);
2962
2963 /* save a copy of the key */
2964
2965 fstrcpy(cred->name, (const char *)kbuf.dptr);
2966 DLIST_ADD(wcache_cred_list, cred);
2967 }
2968
2969 return 0;
2970 }
2971
2972 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2973 {
2974 struct winbind_cache *cache = get_cache(domain);
2975 NTSTATUS status;
2976 int ret;
2977 struct cred_list *cred, *oldest = NULL;
2978
2979 if (!cache->tdb) {
2980 return NT_STATUS_INTERNAL_DB_ERROR;
2981 }
2982
2983 /* we possibly already have an entry */
2984 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2985
2986 fstring key_str, tmp;
2987
2988 DEBUG(11,("we already have an entry, deleting that\n"));
2989
2990 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2991
2992 tdb_delete(cache->tdb, string_tdb_data(key_str));
2993
2994 return NT_STATUS_OK;
2995 }
2996
2997 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2998 if (ret == 0) {
2999 return NT_STATUS_OK;
3000 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3001 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3002 }
3003
3004 ZERO_STRUCTP(oldest);
3005
3006 for (cred = wcache_cred_list; cred; cred = cred->next) {
3007
3008 TDB_DATA data;
3009 time_t t;
3010
3011 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3012 if (!data.dptr) {
3013 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3014 cred->name));
3015 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3016 goto done;
3017 }
3018
3019 t = IVAL(data.dptr, 0);
3020 SAFE_FREE(data.dptr);
3021
3022 if (!oldest) {
3023 oldest = SMB_MALLOC_P(struct cred_list);
3024 if (oldest == NULL) {
3025 status = NT_STATUS_NO_MEMORY;
3026 goto done;
3027 }
3028
3029 fstrcpy(oldest->name, cred->name);
3030 oldest->created = t;
3031 continue;
3032 }
3033
3034 if (t < oldest->created) {
3035 fstrcpy(oldest->name, cred->name);
3036 oldest->created = t;
3037 }
3038 }
3039
3040 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3041 status = NT_STATUS_OK;
3042 } else {
3043 status = NT_STATUS_UNSUCCESSFUL;
3044 }
3045 done:
3046 SAFE_FREE(wcache_cred_list);
3047 SAFE_FREE(oldest);
3048
3049 return status;
3050 }
3051
3052 /* Change the global online/offline state. */
3053 bool set_global_winbindd_state_offline(void)
3054 {
3055 TDB_DATA data;
3056
3057 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3058
3059 /* Only go offline if someone has created
3060 the key "WINBINDD_OFFLINE" in the cache tdb. */
3061
3062 if (wcache == NULL || wcache->tdb == NULL) {
3063 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3064 return false;
3065 }
3066
3067 if (!lp_winbind_offline_logon()) {
3068 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3069 return false;
3070 }
3071
3072 if (global_winbindd_offline_state) {
3073 /* Already offline. */
3074 return true;
3075 }
3076
3077 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3078
3079 if (!data.dptr || data.dsize != 4) {
3080 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3081 SAFE_FREE(data.dptr);
3082 return false;
3083 } else {
3084 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3085 global_winbindd_offline_state = true;
3086 SAFE_FREE(data.dptr);
3087 return true;
3088 }
3089 }
3090
3091 void set_global_winbindd_state_online(void)
3092 {
3093 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3094
3095 if (!lp_winbind_offline_logon()) {
3096 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3097 return;
3098 }
3099
3100 if (!global_winbindd_offline_state) {
3101 /* Already online. */
3102 return;
3103 }
3104 global_winbindd_offline_state = false;
3105
3106 if (!wcache->tdb) {
3107 return;
3108 }
3109
3110 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3111 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3112 }
3113
3114 bool get_global_winbindd_state_offline(void)
3115 {
3116 return global_winbindd_offline_state;
3117 }
3118
3119 /***********************************************************************
3120 Validate functions for all possible cache tdb keys.
3121 ***********************************************************************/
3122
3123 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3124 struct tdb_validation_status *state)
3125 {
3126 struct cache_entry *centry;
3127
3128 centry = SMB_XMALLOC_P(struct cache_entry);
3129 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3130 if (!centry->data) {
3131 SAFE_FREE(centry);
3132 return NULL;
3133 }
3134 centry->len = data.dsize;
3135 centry->ofs = 0;
3136
3137 if (centry->len < 8) {
3138 /* huh? corrupt cache? */
3139 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3140 centry_free(centry);
3141 state->bad_entry = true;
3142 state->success = false;
3143 return NULL;
3144 }
3145
3146 centry->status = NT_STATUS(centry_uint32(centry));
3147 centry->sequence_number = centry_uint32(centry);
3148 return centry;
3149 }
3150
3151 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3152 struct tdb_validation_status *state)
3153 {
3154 if (dbuf.dsize != 8) {
3155 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3156 keystr, (unsigned int)dbuf.dsize ));
3157 state->bad_entry = true;
3158 return 1;
3159 }
3160 return 0;
3161 }
3162
3163 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3164 struct tdb_validation_status *state)
3165 {
3166 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3167 if (!centry) {
3168 return 1;
3169 }
3170
3171 (void)centry_uint32(centry);
3172 if (NT_STATUS_IS_OK(centry->status)) {
3173 DOM_SID sid;
3174 (void)centry_sid(centry, &sid);
3175 }
3176
3177 centry_free(centry);
3178
3179 if (!(state->success)) {
3180 return 1;
3181 }
3182 DEBUG(10,("validate_ns: %s ok\n", keystr));
3183 return 0;
3184 }
3185
3186 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3187 struct tdb_validation_status *state)
3188 {
3189 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3190 if (!centry) {
3191 return 1;
3192 }
3193
3194 if (NT_STATUS_IS_OK(centry->status)) {
3195 (void)centry_uint32(centry);
3196 (void)centry_string(centry, mem_ctx);
3197 (void)centry_string(centry, mem_ctx);
3198 }
3199
3200 centry_free(centry);
3201
3202 if (!(state->success)) {
3203 return 1;
3204 }
3205 DEBUG(10,("validate_sn: %s ok\n", keystr));
3206 return 0;
3207 }
3208
3209 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3210 struct tdb_validation_status *state)
3211 {
3212 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3213 DOM_SID sid;
3214
3215 if (!centry) {
3216 return 1;
3217 }
3218
3219 (void)centry_string(centry, mem_ctx);
3220 (void)centry_string(centry, mem_ctx);
3221 (void)centry_string(centry, mem_ctx);
3222 (void)centry_string(centry, mem_ctx);
3223 (void)centry_uint32(centry);
3224 (void)centry_sid(centry, &sid);
3225 (void)centry_sid(centry, &sid);
3226
3227 centry_free(centry);
3228
3229 if (!(state->success)) {
3230 return 1;
3231 }
3232 DEBUG(10,("validate_u: %s ok\n", keystr));
3233 return 0;
3234 }
3235
3236 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3237 struct tdb_validation_status *state)
3238 {
3239 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3240
3241 if (!centry) {
3242 return 1;
3243 }
3244
3245 (void)centry_nttime(centry);
3246 (void)centry_nttime(centry);
3247 (void)centry_uint16(centry);
3248
3249 centry_free(centry);
3250
3251 if (!(state->success)) {
3252 return 1;
3253 }
3254 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3255 return 0;
3256 }
3257
3258 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3259 struct tdb_validation_status *state)
3260 {
3261 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3262
3263 if (!centry) {
3264 return 1;
3265 }
3266
3267 (void)centry_uint16(centry);
3268 (void)centry_uint16(centry);
3269 (void)centry_uint32(centry);
3270 (void)centry_nttime(centry);
3271 (void)centry_nttime(centry);
3272
3273 centry_free(centry);
3274
3275 if (!(state->success)) {
3276 return 1;
3277 }
3278 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3279 return 0;
3280 }
3281
3282 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3283 struct tdb_validation_status *state)
3284 {
3285 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3286
3287 if (!centry) {
3288 return 1;
3289 }
3290
3291 (void)centry_time(centry);
3292 (void)centry_hash16(centry, mem_ctx);
3293
3294 /* We only have 17 bytes more data in the salted cred case. */
3295 if (centry->len - centry->ofs == 17) {
3296 (void)centry_hash16(centry, mem_ctx);
3297 }
3298
3299 centry_free(centry);
3300
3301 if (!(state->success)) {
3302 return 1;
3303 }
3304 DEBUG(10,("validate_cred: %s ok\n", keystr));
3305 return 0;
3306 }
3307
3308 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3309 struct tdb_validation_status *state)
3310 {
3311 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3312 int32 num_entries, i;
3313
3314 if (!centry) {
3315 return 1;
3316 }
3317
3318 num_entries = (int32)centry_uint32(centry);
3319
3320 for (i=0; i< num_entries; i++) {
3321 DOM_SID sid;
3322 (void)centry_string(centry, mem_ctx);
3323 (void)centry_string(centry, mem_ctx);
3324 (void)centry_string(centry, mem_ctx);
3325 (void)centry_string(centry, mem_ctx);
3326 (void)centry_sid(centry, &sid);
3327 (void)centry_sid(centry, &sid);
3328 }
3329
3330 centry_free(centry);
3331
3332 if (!(state->success)) {
3333 return 1;
3334 }
3335 DEBUG(10,("validate_ul: %s ok\n", keystr));
3336 return 0;
3337 }
3338
3339 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3340 struct tdb_validation_status *state)
3341 {
3342 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3343 int32 num_entries, i;
3344
3345 if (!centry) {
3346 return 1;
3347 }
3348
3349 num_entries = centry_uint32(centry);
3350
3351 for (i=0; i< num_entries; i++) {
3352 (void)centry_string(centry, mem_ctx);
3353 (void)centry_string(centry, mem_ctx);
3354 (void)centry_uint32(centry);
3355 }
3356
3357 centry_free(centry);
3358
3359 if (!(state->success)) {
3360 return 1;
3361 }
3362 DEBUG(10,("validate_gl: %s ok\n", keystr));
3363 return 0;
3364 }
3365
3366 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3367 struct tdb_validation_status *state)
3368 {
3369 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3370 int32 num_groups, i;
3371
3372 if (!centry) {
3373 return 1;
3374 }
3375
3376 num_groups = centry_uint32(centry);
3377
3378 for (i=0; i< num_groups; i++) {
3379 DOM_SID sid;
3380 centry_sid(centry, &sid);
3381 }
3382
3383 centry_free(centry);
3384
3385 if (!(state->success)) {
3386 return 1;
3387 }
3388 DEBUG(10,("validate_ug: %s ok\n", keystr));
3389 return 0;
3390 }
3391
3392 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3393 struct tdb_validation_status *state)
3394 {
3395 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3396 int32 num_aliases, i;
3397
3398 if (!centry) {
3399 return 1;
3400 }
3401
3402 num_aliases = centry_uint32(centry);
3403
3404 for (i=0; i < num_aliases; i++) {
3405 (void)centry_uint32(centry);
3406 }
3407
3408 centry_free(centry);
3409
3410 if (!(state->success)) {
3411 return 1;
3412 }
3413 DEBUG(10,("validate_ua: %s ok\n", keystr));
3414 return 0;
3415 }
3416
3417 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3418 struct tdb_validation_status *state)
3419 {
3420 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3421 int32 num_names, i;
3422
3423 if (!centry) {
3424 return 1;
3425 }
3426
3427 num_names = centry_uint32(centry);
3428
3429 for (i=0; i< num_names; i++) {
3430 DOM_SID sid;
3431 centry_sid(centry, &sid);
3432 (void)centry_string(centry, mem_ctx);
3433 (void)centry_uint32(centry);
3434 }
3435
3436 centry_free(centry);
3437
3438 if (!(state->success)) {
3439 return 1;
3440 }
3441 DEBUG(10,("validate_gm: %s ok\n", keystr));
3442 return 0;
3443 }
3444
3445 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3446 struct tdb_validation_status *state)
3447 {
3448 /* Can't say anything about this other than must be nonzero. */
3449 if (dbuf.dsize == 0) {
3450 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3451 keystr));
3452 state->bad_entry = true;
3453 state->success = false;
3454 return 1;
3455 }
3456
3457 DEBUG(10,("validate_dr: %s ok\n", keystr));
3458 return 0;
3459 }
3460
3461 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3462 struct tdb_validation_status *state)
3463 {
3464 /* Can't say anything about this other than must be nonzero. */
3465 if (dbuf.dsize == 0) {
3466 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3467 keystr));
3468 state->bad_entry = true;
3469 state->success = false;
3470 return 1;
3471 }
3472
3473 DEBUG(10,("validate_de: %s ok\n", keystr));
3474 return 0;
3475 }
3476
3477 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3478 TDB_DATA dbuf, struct tdb_validation_status *state)
3479 {
3480 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3481
3482 if (!centry) {
3483 return 1;
3484 }
3485
3486 (void)centry_string(centry, mem_ctx);
3487 (void)centry_string(centry, mem_ctx);
3488 (void)centry_string(centry, mem_ctx);
3489 (void)centry_uint32(centry);
3490
3491 centry_free(centry);
3492
3493 if (!(state->success)) {
3494 return 1;
3495 }
3496 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3497 return 0;
3498 }
3499
3500 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3501 TDB_DATA dbuf,
3502 struct tdb_validation_status *state)
3503 {
3504 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3505
3506 if (!centry) {
3507 return 1;
3508 }
3509
3510 (void)centry_string( centry, mem_ctx );
3511
3512 centry_free(centry);
3513
3514 if (!(state->success)) {
3515 return 1;
3516 }
3517 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3518 return 0;
3519 }
3520
3521 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3522 TDB_DATA dbuf,
3523 struct tdb_validation_status *state)
3524 {
3525 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3526
3527 if (!centry) {
3528 return 1;
3529 }
3530
3531 (void)centry_string( centry, mem_ctx );
3532
3533 centry_free(centry);
3534
3535 if (!(state->success)) {
3536 return 1;
3537 }
3538 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3539 return 0;
3540 }
3541
3542 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3543 struct tdb_validation_status *state)
3544 {
3545 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3546 int32 num_domains, i;
3547
3548 if (!centry) {
3549 return 1;
3550 }
3551
3552 num_domains = centry_uint32(centry);
3553
3554 for (i=0; i< num_domains; i++) {
3555 DOM_SID sid;
3556 (void)centry_string(centry, mem_ctx);
3557 (void)centry_string(centry, mem_ctx);
3558 (void)centry_sid(centry, &sid);
3559 }
3560
3561 centry_free(centry);
3562
3563 if (!(state->success)) {
3564 return 1;
3565 }
3566 DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3567 return 0;
3568 }
3569
3570 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3571 TDB_DATA dbuf,
3572 struct tdb_validation_status *state)
3573 {
3574 if (dbuf.dsize == 0) {
3575 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3576 "key %s (len ==0) ?\n", keystr));
3577 state->bad_entry = true;
3578 state->success = false;
3579 return 1;
3580 }
3581
3582 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3583 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3584 return 0;
3585 }
3586
3587 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3588 struct tdb_validation_status *state)
3589 {
3590 if (dbuf.dsize != 4) {
3591 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3592 keystr, (unsigned int)dbuf.dsize ));
3593 state->bad_entry = true;
3594 state->success = false;
3595 return 1;
3596 }
3597 DEBUG(10,("validate_offline: %s ok\n", keystr));
3598 return 0;
3599 }
3600
3601 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3602 struct tdb_validation_status *state)
3603 {
3604 if (dbuf.dsize != 4) {
3605 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3606 "key %s (len %u != 4) ?\n",
3607 keystr, (unsigned int)dbuf.dsize));
3608 state->bad_entry = true;
3609 state->success = false;
3610 return 1;
3611 }
3612
3613 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3614 return 0;
3615 }
3616
3617 /***********************************************************************
3618 A list of all possible cache tdb keys with associated validation
3619 functions.
3620 ***********************************************************************/
3621
3622 struct key_val_struct {
3623 const char *keyname;
3624 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3625 } key_val[] = {
3626 {"SEQNUM/", validate_seqnum},
3627 {"NS/", validate_ns},
3628 {"SN/", validate_sn},
3629 {"U/", validate_u},
3630 {"LOC_POL/", validate_loc_pol},
3631 {"PWD_POL/", validate_pwd_pol},
3632 {"CRED/", validate_cred},
3633 {"UL/", validate_ul},
3634 {"GL/", validate_gl},
3635 {"UG/", validate_ug},
3636 {"UA", validate_ua},
3637 {"GM/", validate_gm},
3638 {"DR/", validate_dr},
3639 {"DE/", validate_de},
3640 {"NSS/PWINFO/", validate_pwinfo},
3641 {"TRUSTDOMS/", validate_trustdoms},
3642 {"TRUSTDOMCACHE/", validate_trustdomcache},
3643 {"NSS/NA/", validate_nss_na},
3644 {"NSS/AN/", validate_nss_an},
3645 {"WINBINDD_OFFLINE", validate_offline},
3646 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3647 {NULL, NULL}
3648 };
3649
3650 /***********************************************************************
3651 Function to look at every entry in the tdb and validate it as far as
3652 possible.
3653 ***********************************************************************/
3654
3655 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3656 {
3657 int i;
3658 unsigned int max_key_len = 1024;
3659 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3660
3661 /* Paranoia check. */
3662 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3663 max_key_len = 1024 * 1024;
3664 }
3665 if (kbuf.dsize > max_key_len) {
3666 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3667 "(%u) > (%u)\n\n",
3668 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3669 return 1;
3670 }
3671
3672 for (i = 0; key_val[i].keyname; i++) {
3673 size_t namelen = strlen(key_val[i].keyname);
3674 if (kbuf.dsize >= namelen && (
3675 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3676 TALLOC_CTX *mem_ctx;
3677 char *keystr;
3678 int ret;
3679
3680 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3681 if (!keystr) {
3682 return 1;
3683 }
3684 memcpy(keystr, kbuf.dptr, kbuf.dsize);
3685 keystr[kbuf.dsize] = '\0';
3686
3687 mem_ctx = talloc_init("validate_ctx");
3688 if (!mem_ctx) {
3689 SAFE_FREE(keystr);
3690 return 1;
3691 }
3692
3693 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3694 v_state);
3695
3696 SAFE_FREE(keystr);
3697 talloc_destroy(mem_ctx);
3698 return ret;
3699 }
3700 }
3701
3702 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3703 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3704 DEBUG(0,("data :\n"));
3705 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3706 v_state->unknown_key = true;
3707 v_state->success = false;
3708 return 1; /* terminate. */
3709 }
3710
3711 static void validate_panic(const char *const why)
3712 {
3713 DEBUG(0,("validating cache: would panic %s\n", why ));
3714 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3715 exit(47);
3716 }
3717
3718 /***********************************************************************
3719 Try and validate every entry in the winbindd cache. If we fail here,
3720 delete the cache tdb and return non-zero.
3721 ***********************************************************************/
3722
3723 int winbindd_validate_cache(void)
3724 {
3725 int ret = -1;
3726 const char *tdb_path = cache_path("winbindd_cache.tdb");
3727 TDB_CONTEXT *tdb = NULL;
3728
3729 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3730 smb_panic_fn = validate_panic;
3731
3732
3733 tdb = tdb_open_log(tdb_path,
3734 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3735 ( lp_winbind_offline_logon()
3736 ? TDB_DEFAULT
3737 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3738 O_RDWR|O_CREAT,
3739 0600);
3740 if (!tdb) {
3741 DEBUG(0, ("winbindd_validate_cache: "
3742 "error opening/initializing tdb\n"));
3743 goto done;
3744 }
3745 tdb_close(tdb);
3746
3747 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3748
3749 if (ret != 0) {
3750 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3751 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3752 unlink(tdb_path);
3753 }
3754
3755 done:
3756 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3757 smb_panic_fn = smb_panic;
3758 return ret;
3759 }
3760
3761 /***********************************************************************
3762 Try and validate every entry in the winbindd cache.
3763 ***********************************************************************/
3764
3765 int winbindd_validate_cache_nobackup(void)
3766 {
3767 int ret = -1;
3768 const char *tdb_path = cache_path("winbindd_cache.tdb");
3769
3770 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3771 smb_panic_fn = validate_panic;
3772
3773
3774 if (wcache == NULL || wcache->tdb == NULL) {
3775 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3776 } else {
3777 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3778 }
3779
3780 if (ret != 0) {
3781 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3782 "successful.\n"));
3783 }
3784
3785 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3786 "function\n"));
3787 smb_panic_fn = smb_panic;
3788 return ret;
3789 }
3790
3791 bool winbindd_cache_validate_and_initialize(void)
3792 {
3793 close_winbindd_cache();
3794
3795 if (lp_winbind_offline_logon()) {
3796 if (winbindd_validate_cache() < 0) {
3797 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3798 "could be restored.\n"));
3799 }
3800 }
3801
3802 return initialize_winbindd_cache();
3803 }
3804
3805 /*********************************************************************
3806 ********************************************************************/
3807
3808 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3809 struct winbindd_tdc_domain **domains,
3810 size_t *num_domains )
3811 {
3812 struct winbindd_tdc_domain *list = NULL;
3813 size_t idx;
3814 int i;
3815 bool set_only = false;
3816
3817 /* don't allow duplicates */
3818
3819 idx = *num_domains;
3820 list = *domains;
3821
3822 for ( i=0; i< (*num_domains); i++ ) {
3823 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3824 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3825 new_dom->name));
3826 idx = i;
3827 set_only = true;
3828
3829 break;
3830 }
3831 }
3832
3833 if ( !set_only ) {
3834 if ( !*domains ) {
3835 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3836 idx = 0;
3837 } else {
3838 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3839 struct winbindd_tdc_domain,
3840 (*num_domains)+1);
3841 idx = *num_domains;
3842 }
3843
3844 ZERO_STRUCT( list[idx] );
3845 }
3846
3847 if ( !list )
3848 return false;
3849
3850 list[idx].domain_name = talloc_strdup( list, new_dom->name );
3851 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3852
3853 if ( !is_null_sid( &new_dom->sid ) ) {
3854 sid_copy( &list[idx].sid, &new_dom->sid );
3855 } else {
3856 sid_copy(&list[idx].sid, &global_sid_NULL);
3857 }
3858
3859 if ( new_dom->domain_flags != 0x0 )
3860 list[idx].trust_flags = new_dom->domain_flags;
3861
3862 if ( new_dom->domain_type != 0x0 )
3863 list[idx].trust_type = new_dom->domain_type;
3864
3865 if ( new_dom->domain_trust_attribs != 0x0 )
3866 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3867
3868 if ( !set_only ) {
3869 *domains = list;
3870 *num_domains = idx + 1;
3871 }
3872
3873 return true;
3874 }
3875
3876 /*********************************************************************
3877 ********************************************************************/
3878
3879 static TDB_DATA make_tdc_key( const char *domain_name )
3880 {
3881 char *keystr = NULL;
3882 TDB_DATA key = { NULL, 0 };
3883
3884 if ( !domain_name ) {
3885 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3886 return key;
3887 }
3888
3889 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3890 return key;
3891 }
3892 key = string_term_tdb_data(keystr);
3893
3894 return key;
3895 }
3896
3897 /*********************************************************************
3898 ********************************************************************/
3899
3900 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3901 size_t num_domains,
3902 unsigned char **buf )
3903 {
3904 unsigned char *buffer = NULL;
3905 int len = 0;
3906 int buflen = 0;
3907 int i = 0;
3908
3909 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3910 (int)num_domains));
3911
3912 buflen = 0;
3913
3914 again:
3915 len = 0;
3916
3917 /* Store the number of array items first */
3918 len += tdb_pack( buffer+len, buflen-len, "d",
3919 num_domains );
3920
3921 /* now pack each domain trust record */
3922 for ( i=0; i<num_domains; i++ ) {
3923
3924 fstring tmp;
3925
3926 if ( buflen > 0 ) {
3927 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3928 domains[i].domain_name,
3929 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3930 }
3931
3932 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3933 domains[i].domain_name,
3934 domains[i].dns_name,
3935 sid_to_fstring(tmp, &domains[i].sid),
3936 domains[i].trust_flags,
3937 domains[i].trust_attribs,
3938 domains[i].trust_type );
3939 }
3940
3941 if ( buflen < len ) {
3942 SAFE_FREE(buffer);
3943 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3944 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3945 buflen = -1;
3946 goto done;
3947 }
3948 buflen = len;
3949 goto again;
3950 }
3951
3952 *buf = buffer;
3953
3954 done:
3955 return buflen;
3956 }
3957
3958 /*********************************************************************
3959 ********************************************************************/
3960
3961 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3962 struct winbindd_tdc_domain **domains )
3963 {
3964 fstring domain_name, dns_name, sid_string;
3965 uint32 type, attribs, flags;
3966 int num_domains;
3967 int len = 0;
3968 int i;
3969 struct winbindd_tdc_domain *list = NULL;
3970
3971 /* get the number of domains */
3972 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3973 if ( len == -1 ) {
3974 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3975 return 0;
3976 }
3977
3978 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3979 if ( !list ) {
3980 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3981 return 0;
3982 }
3983
3984 for ( i=0; i<num_domains; i++ ) {
3985 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3986 domain_name,
3987 dns_name,
3988 sid_string,
3989 &flags,
3990 &attribs,
3991 &type );
3992
3993 if ( len == -1 ) {
3994 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3995 TALLOC_FREE( list );
3996 return 0;
3997 }
3998
3999 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4000 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4001 domain_name, dns_name, sid_string,
4002 flags, attribs, type));
4003
4004 list[i].domain_name = talloc_strdup( list, domain_name );
4005 list[i].dns_name = talloc_strdup( list, dns_name );
4006 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4007 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4008 domain_name));
4009 }
4010 list[i].trust_flags = flags;
4011 list[i].trust_attribs = attribs;
4012 list[i].trust_type = type;
4013 }
4014
4015 *domains = list;
4016
4017 return num_domains;
4018 }
4019
4020 /*********************************************************************
4021 ********************************************************************/
4022
4023 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4024 {
4025 TDB_DATA key = make_tdc_key( lp_workgroup() );
4026 TDB_DATA data = { NULL, 0 };
4027 int ret;
4028
4029 if ( !key.dptr )
4030 return false;
4031
4032 /* See if we were asked to delete the cache entry */
4033
4034 if ( !domains ) {
4035 ret = tdb_delete( wcache->tdb, key );
4036 goto done;
4037 }
4038
4039 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4040
4041 if ( !data.dptr ) {
4042 ret = -1;
4043 goto done;
4044 }
4045
4046 ret = tdb_store( wcache->tdb, key, data, 0 );
4047
4048 done:
4049 SAFE_FREE( data.dptr );
4050 SAFE_FREE( key.dptr );
4051
4052 return ( ret != -1 );
4053 }
4054
4055 /*********************************************************************
4056 ********************************************************************/
4057
4058 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4059 {
4060 TDB_DATA key = make_tdc_key( lp_workgroup() );
4061 TDB_DATA data = { NULL, 0 };
4062
4063 *domains = NULL;
4064 *num_domains = 0;
4065
4066 if ( !key.dptr )
4067 return false;
4068
4069 data = tdb_fetch( wcache->tdb, key );
4070
4071 SAFE_FREE( key.dptr );
4072
4073 if ( !data.dptr )
4074 return false;
4075
4076 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4077
4078 SAFE_FREE( data.dptr );
4079
4080 if ( !*domains )
4081 return false;
4082
4083 return true;
4084 }
4085
4086 /*********************************************************************
4087 ********************************************************************/
4088
4089 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4090 {
4091 struct winbindd_tdc_domain *dom_list = NULL;
4092 size_t num_domains = 0;
4093 bool ret = false;
4094
4095 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4096 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4097 domain->name, domain->alt_name,
4098 sid_string_dbg(&domain->sid),
4099 domain->domain_flags,
4100 domain->domain_trust_attribs,
4101 domain->domain_type));
4102
4103 if ( !init_wcache() ) {
4104 return false;
4105 }
4106
4107 /* fetch the list */
4108
4109 wcache_tdc_fetch_list( &dom_list, &num_domains );
4110
4111 /* add the new domain */
4112
4113 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4114 goto done;
4115 }
4116
4117 /* pack the domain */
4118
4119 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4120 goto done;
4121 }
4122
4123 /* Success */
4124
4125 ret = true;
4126 done:
4127 TALLOC_FREE( dom_list );
4128
4129 return ret;
4130 }
4131
4132 /*********************************************************************
4133 ********************************************************************/
4134
4135 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4136 {
4137 struct winbindd_tdc_domain *dom_list = NULL;
4138 size_t num_domains = 0;
4139 int i;
4140 struct winbindd_tdc_domain *d = NULL;
4141
4142 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4143
4144 if ( !init_wcache() ) {
4145 return false;
4146 }
4147
4148 /* fetch the list */
4149
4150 wcache_tdc_fetch_list( &dom_list, &num_domains );
4151
4152 for ( i=0; i<num_domains; i++ ) {
4153 if ( strequal(name, dom_list[i].domain_name) ||
4154 strequal(name, dom_list[i].dns_name) )
4155 {
4156 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4157 name));
4158
4159 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4160 if ( !d )
4161 break;
4162
4163 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4164 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4165 sid_copy( &d->sid, &dom_list[i].sid );
4166 d->trust_flags = dom_list[i].trust_flags;
4167 d->trust_type = dom_list[i].trust_type;
4168 d->trust_attribs = dom_list[i].trust_attribs;
4169
4170 break;
4171 }
4172 }
4173
4174 TALLOC_FREE( dom_list );
4175
4176 return d;
4177 }
4178
4179
4180 /*********************************************************************
4181 ********************************************************************/
4182
4183 void wcache_tdc_clear( void )
4184 {
4185 if ( !init_wcache() )
4186 return;
4187
4188 wcache_tdc_store_list( NULL, 0 );
4189
4190 return;
4191 }
4192
4193
4194 /*********************************************************************
4195 ********************************************************************/
4196
4197 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4198 NTSTATUS status,
4199 const DOM_SID *user_sid,
4200 const char *homedir,
4201 const char *shell,
4202 const char *gecos,
4203 uint32 gid)
4204 {
4205 struct cache_entry *centry;
4206 fstring tmp;
4207
4208 if ( (centry = centry_start(domain, status)) == NULL )
4209 return;
4210
4211 centry_put_string( centry, homedir );
4212 centry_put_string( centry, shell );
4213 centry_put_string( centry, gecos );
4214 centry_put_uint32( centry, gid );
4215
4216 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4217
4218 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4219
4220 centry_free(centry);
4221 }
4222
4223 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4224 const DOM_SID *user_sid,
4225 TALLOC_CTX *ctx,
4226 ADS_STRUCT *ads, LDAPMessage *msg,
4227 const char **homedir, const char **shell,
4228 const char **gecos, gid_t *p_gid)
4229 {
4230 struct winbind_cache *cache = get_cache(domain);
4231 struct cache_entry *centry = NULL;
4232 NTSTATUS nt_status;
4233 fstring tmp;
4234
4235 if (!cache->tdb)
4236 goto do_query;
4237
4238 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4239 sid_to_fstring(tmp, user_sid));
4240
4241 if (!centry)
4242 goto do_query;
4243
4244 *homedir = centry_string( centry, ctx );
4245 *shell = centry_string( centry, ctx );
4246 *gecos = centry_string( centry, ctx );
4247 *p_gid = centry_uint32( centry );
4248
4249 centry_free(centry);
4250
4251 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4252 sid_string_dbg(user_sid)));
4253
4254 return NT_STATUS_OK;
4255
4256 do_query:
4257
4258 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4259 homedir, shell, gecos, p_gid );
4260
4261 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4262
4263 if ( NT_STATUS_IS_OK(nt_status) ) {
4264 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4265 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4266 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4267 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4268
4269 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4270 *homedir, *shell, *gecos, *p_gid );
4271 }
4272
4273 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4274 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4275 domain->name ));
4276 set_domain_offline( domain );
4277 }
4278
4279 return nt_status;
4280 }
4281
4282
4283 /* the cache backend methods are exposed via this structure */
4284 struct winbindd_methods cache_methods = {
4285 true,
4286 query_user_list,
4287 enum_dom_groups,
4288 enum_local_groups,
4289 name_to_sid,
4290 sid_to_name,
4291 rids_to_names,
4292 query_user,
4293 lookup_usergroups,
4294 lookup_useraliases,
4295 lookup_groupmem,
4296 sequence_number,
4297 lockout_policy,
4298 password_policy,
4299 trusted_domains
4300 };
4301
4302 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4303 uint32_t opnum, const DATA_BLOB *req,
4304 TDB_DATA *pkey)
4305 {
4306 char *key;
4307 size_t keylen;
4308
4309 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4310 if (key == NULL) {
4311 return false;
4312 }
4313 keylen = talloc_get_size(key) - 1;
4314
4315 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4316 if (key == NULL) {
4317 return false;
4318 }
4319 memcpy(key + keylen, req->data, req->length);
4320
4321 pkey->dptr = (uint8_t *)key;
4322 pkey->dsize = talloc_get_size(key);
4323 return true;
4324 }
4325
4326 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4327 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4328 {
4329 TDB_DATA key, data;
4330 bool ret = false;
4331
4332 if (wcache->tdb == NULL) {
4333 return false;
4334 }
4335
4336 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4337 return false;
4338 }
4339 data = tdb_fetch(wcache->tdb, key);
4340 TALLOC_FREE(key.dptr);
4341
4342 if (data.dptr == NULL) {
4343 return false;
4344 }
4345 if (data.dsize < 4) {
4346 goto fail;
4347 }
4348
4349 if (IS_DOMAIN_ONLINE(domain)) {
4350 uint32_t entry_seqnum, dom_seqnum, last_check;
4351
4352 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4353 &last_check)) {
4354 goto fail;
4355 }
4356 entry_seqnum = IVAL(data.dptr, 0);
4357 if (entry_seqnum != dom_seqnum) {
4358 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4359 (int)entry_seqnum));
4360 goto fail;
4361 }
4362 }
4363
4364 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4365 data.dsize - 4);
4366 if (resp->data == NULL) {
4367 DEBUG(10, ("talloc failed\n"));
4368 goto fail;
4369 }
4370 resp->length = data.dsize - 4;
4371
4372 ret = true;
4373 fail:
4374 SAFE_FREE(data.dptr);
4375 return ret;
4376 }
4377
4378 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4379 const DATA_BLOB *req, const DATA_BLOB *resp)
4380 {
4381 TDB_DATA key, data;
4382 uint32_t dom_seqnum, last_check;
4383
4384 if (wcache->tdb == NULL) {
4385 return;
4386 }
4387
4388 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4389 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4390 domain->name));
4391 return;
4392 }
4393
4394 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4395 return;
4396 }
4397
4398 data.dsize = resp->length + 4;
4399 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4400 if (data.dptr == NULL) {
4401 goto done;
4402 }
4403
4404 SIVAL(data.dptr, 0, dom_seqnum);
4405 memcpy(data.dptr+4, resp->data, resp->length);
4406
4407 tdb_store(wcache->tdb, key, data, 0);
4408
4409 done:
4410 TALLOC_FREE(key.dptr);
4411 return;
4412 }
aatanasov's samba4 branch