?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:kdc Fill in more data fields
[Samba/ekacnet.git] / source3 / winbindd / winbindd_cache.c
bloba9690aea1c696dc6363f4b693025cbd87fdb9598
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
30 #include "../librpc/gen_ndr/ndr_wbint.h"
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_WINBIND
34
35 #define WINBINDD_CACHE_VERSION 1
36 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
37
38 extern struct winbindd_methods reconnect_methods;
39 #ifdef HAVE_ADS
40 extern struct winbindd_methods ads_methods;
41 #endif
42 extern struct winbindd_methods builtin_passdb_methods;
43
44 /*
45 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
46 * Here are the list of entry types that are *not* stored
47 * as form struct cache_entry in the cache.
48 */
49
50 static const char *non_centry_keys[] = {
51 "SEQNUM/",
52 "DR/",
53 "DE/",
54 "WINBINDD_OFFLINE",
55 WINBINDD_CACHE_VERSION_KEYSTR,
56 NULL
57 };
58
59 /************************************************************************
60 Is this key a non-centry type ?
61 ************************************************************************/
62
63 static bool is_non_centry_key(TDB_DATA kbuf)
64 {
65 int i;
66
67 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
68 return false;
69 }
70 for (i = 0; non_centry_keys[i] != NULL; i++) {
71 size_t namelen = strlen(non_centry_keys[i]);
72 if (kbuf.dsize < namelen) {
73 continue;
74 }
75 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
76 return true;
77 }
78 }
79 return false;
80 }
81
82 /* Global online/offline state - False when online. winbindd starts up online
83 and sets this to true if the first query fails and there's an entry in
84 the cache tdb telling us to stay offline. */
85
86 static bool global_winbindd_offline_state;
87
88 struct winbind_cache {
89 TDB_CONTEXT *tdb;
90 };
91
92 struct cache_entry {
93 NTSTATUS status;
94 uint32 sequence_number;
95 uint8 *data;
96 uint32 len, ofs;
97 };
98
99 void (*smb_panic_fn)(const char *const why) = smb_panic;
100
101 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
102
103 static struct winbind_cache *wcache;
104
105 void winbindd_check_cache_size(time_t t)
106 {
107 static time_t last_check_time;
108 struct stat st;
109
110 if (last_check_time == (time_t)0)
111 last_check_time = t;
112
113 if (t - last_check_time < 60 && t - last_check_time > 0)
114 return;
115
116 if (wcache == NULL || wcache->tdb == NULL) {
117 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
118 return;
119 }
120
121 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
122 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
123 return;
124 }
125
126 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
127 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
128 (unsigned long)st.st_size,
129 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
130 wcache_flush_cache();
131 }
132 }
133
134 /* get the winbind_cache structure */
135 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
136 {
137 struct winbind_cache *ret = wcache;
138
139 /* We have to know what type of domain we are dealing with first. */
140
141 if (domain->internal) {
142 domain->backend = &builtin_passdb_methods;
143 domain->initialized = True;
144 }
145 if ( !domain->initialized ) {
146 init_dc_connection( domain );
147 }
148
149 /*
150 OK. listen up becasue I'm only going to say this once.
151 We have the following scenarios to consider
152 (a) trusted AD domains on a Samba DC,
153 (b) trusted AD domains and we are joined to a non-kerberos domain
154 (c) trusted AD domains and we are joined to a kerberos (AD) domain
155
156 For (a) we can always contact the trusted domain using krb5
157 since we have the domain trust account password
158
159 For (b) we can only use RPC since we have no way of
160 getting a krb5 ticket in our own domain
161
162 For (c) we can always use krb5 since we have a kerberos trust
163
164 --jerry
165 */
166
167 if (!domain->backend) {
168 #ifdef HAVE_ADS
169 struct winbindd_domain *our_domain = domain;
170
171 /* find our domain first so we can figure out if we
172 are joined to a kerberized domain */
173
174 if ( !domain->primary )
175 our_domain = find_our_domain();
176
177 if ((our_domain->active_directory || IS_DC)
178 && domain->active_directory
179 && !lp_winbind_rpc_only()) {
180 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
181 domain->backend = &ads_methods;
182 } else {
183 #endif /* HAVE_ADS */
184 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
185 domain->backend = &reconnect_methods;
186 #ifdef HAVE_ADS
187 }
188 #endif /* HAVE_ADS */
189 }
190
191 if (ret)
192 return ret;
193
194 ret = SMB_XMALLOC_P(struct winbind_cache);
195 ZERO_STRUCTP(ret);
196
197 wcache = ret;
198 wcache_flush_cache();
199
200 return ret;
201 }
202
203 /*
204 free a centry structure
205 */
206 static void centry_free(struct cache_entry *centry)
207 {
208 if (!centry)
209 return;
210 SAFE_FREE(centry->data);
211 free(centry);
212 }
213
214 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
215 {
216 if (centry->len - centry->ofs < nbytes) {
217 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
218 (unsigned int)nbytes,
219 centry->len - centry->ofs));
220 return false;
221 }
222 return true;
223 }
224
225 /*
226 pull a uint32 from a cache entry
227 */
228 static uint32 centry_uint32(struct cache_entry *centry)
229 {
230 uint32 ret;
231
232 if (!centry_check_bytes(centry, 4)) {
233 smb_panic_fn("centry_uint32");
234 }
235 ret = IVAL(centry->data, centry->ofs);
236 centry->ofs += 4;
237 return ret;
238 }
239
240 /*
241 pull a uint16 from a cache entry
242 */
243 static uint16 centry_uint16(struct cache_entry *centry)
244 {
245 uint16 ret;
246 if (!centry_check_bytes(centry, 2)) {
247 smb_panic_fn("centry_uint16");
248 }
249 ret = CVAL(centry->data, centry->ofs);
250 centry->ofs += 2;
251 return ret;
252 }
253
254 /*
255 pull a uint8 from a cache entry
256 */
257 static uint8 centry_uint8(struct cache_entry *centry)
258 {
259 uint8 ret;
260 if (!centry_check_bytes(centry, 1)) {
261 smb_panic_fn("centry_uint8");
262 }
263 ret = CVAL(centry->data, centry->ofs);
264 centry->ofs += 1;
265 return ret;
266 }
267
268 /*
269 pull a NTTIME from a cache entry
270 */
271 static NTTIME centry_nttime(struct cache_entry *centry)
272 {
273 NTTIME ret;
274 if (!centry_check_bytes(centry, 8)) {
275 smb_panic_fn("centry_nttime");
276 }
277 ret = IVAL(centry->data, centry->ofs);
278 centry->ofs += 4;
279 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
280 centry->ofs += 4;
281 return ret;
282 }
283
284 /*
285 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
286 */
287 static time_t centry_time(struct cache_entry *centry)
288 {
289 return (time_t)centry_nttime(centry);
290 }
291
292 /* pull a string from a cache entry, using the supplied
293 talloc context
294 */
295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
296 {
297 uint32 len;
298 char *ret;
299
300 len = centry_uint8(centry);
301
302 if (len == 0xFF) {
303 /* a deliberate NULL string */
304 return NULL;
305 }
306
307 if (!centry_check_bytes(centry, (size_t)len)) {
308 smb_panic_fn("centry_string");
309 }
310
311 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
312 if (!ret) {
313 smb_panic_fn("centry_string out of memory\n");
314 }
315 memcpy(ret,centry->data + centry->ofs, len);
316 ret[len] = 0;
317 centry->ofs += len;
318 return ret;
319 }
320
321 /* pull a hash16 from a cache entry, using the supplied
322 talloc context
323 */
324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
325 {
326 uint32 len;
327 char *ret;
328
329 len = centry_uint8(centry);
330
331 if (len != 16) {
332 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
333 len ));
334 return NULL;
335 }
336
337 if (!centry_check_bytes(centry, 16)) {
338 return NULL;
339 }
340
341 ret = TALLOC_ARRAY(mem_ctx, char, 16);
342 if (!ret) {
343 smb_panic_fn("centry_hash out of memory\n");
344 }
345 memcpy(ret,centry->data + centry->ofs, 16);
346 centry->ofs += 16;
347 return ret;
348 }
349
350 /* pull a sid from a cache entry, using the supplied
351 talloc context
352 */
353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
354 {
355 char *sid_string;
356 bool ret;
357
358 sid_string = centry_string(centry, talloc_tos());
359 if (sid_string == NULL) {
360 return false;
361 }
362 ret = string_to_sid(sid, sid_string);
363 TALLOC_FREE(sid_string);
364 return ret;
365 }
366
367
368 /*
369 pull a NTSTATUS from a cache entry
370 */
371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
372 {
373 NTSTATUS status;
374
375 status = NT_STATUS(centry_uint32(centry));
376 return status;
377 }
378
379
380 /* the server is considered down if it can't give us a sequence number */
381 static bool wcache_server_down(struct winbindd_domain *domain)
382 {
383 bool ret;
384
385 if (!wcache->tdb)
386 return false;
387
388 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
389
390 if (ret)
391 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
392 domain->name ));
393 return ret;
394 }
395
396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
397 uint32_t *last_seq_check)
398 {
399 char *key;
400 TDB_DATA data;
401
402 if (wcache->tdb == NULL) {
403 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
404 return false;
405 }
406
407 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
408 if (key == NULL) {
409 DEBUG(10, ("talloc failed\n"));
410 return false;
411 }
412
413 data = tdb_fetch_bystring(wcache->tdb, key);
414 TALLOC_FREE(key);
415
416 if (data.dptr == NULL) {
417 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
418 domain_name));
419 return false;
420 }
421 if (data.dsize != 8) {
422 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
423 (int)data.dsize));
424 SAFE_FREE(data.dptr);
425 return false;
426 }
427
428 *seqnum = IVAL(data.dptr, 0);
429 *last_seq_check = IVAL(data.dptr, 4);
430 SAFE_FREE(data.dptr);
431
432 return true;
433 }
434
435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
436 {
437 uint32 last_check, time_diff;
438
439 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
440 &last_check)) {
441 return NT_STATUS_UNSUCCESSFUL;
442 }
443 domain->last_seq_check = last_check;
444
445 /* have we expired? */
446
447 time_diff = now - domain->last_seq_check;
448 if ( time_diff > lp_winbind_cache_time() ) {
449 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
450 domain->name, domain->sequence_number,
451 (uint32)domain->last_seq_check));
452 return NT_STATUS_UNSUCCESSFUL;
453 }
454
455 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
456 domain->name, domain->sequence_number,
457 (uint32)domain->last_seq_check));
458
459 return NT_STATUS_OK;
460 }
461
462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
463 time_t last_seq_check)
464 {
465 char *key_str;
466 uint8_t buf[8];
467 int ret;
468
469 if (wcache->tdb == NULL) {
470 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
471 return false;
472 }
473
474 key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
475 if (key_str == NULL) {
476 DEBUG(10, ("talloc_asprintf failed\n"));
477 return false;
478 }
479
480 SIVAL(buf, 0, seqnum);
481 SIVAL(buf, 4, last_seq_check);
482
483 ret = tdb_store_bystring(wcache->tdb, key_str,
484 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
485 TALLOC_FREE(key_str);
486 if (ret == -1) {
487 DEBUG(10, ("tdb_store_bystring failed: %s\n",
488 tdb_errorstr(wcache->tdb)));
489 TALLOC_FREE(key_str);
490 return false;
491 }
492
493 DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
494 domain_name, seqnum, (unsigned)last_seq_check));
495
496 return true;
497 }
498
499 static bool store_cache_seqnum( struct winbindd_domain *domain )
500 {
501 return wcache_store_seqnum(domain->name, domain->sequence_number,
502 domain->last_seq_check);
503 }
504
505 /*
506 refresh the domain sequence number. If force is true
507 then always refresh it, no matter how recently we fetched it
508 */
509
510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
511 {
512 NTSTATUS status;
513 unsigned time_diff;
514 time_t t = time(NULL);
515 unsigned cache_time = lp_winbind_cache_time();
516
517 if (is_domain_offline(domain)) {
518 return;
519 }
520
521 get_cache( domain );
522
523 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
524 /* trying to reconnect is expensive, don't do it too often */
525 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
526 cache_time *= 8;
527 }
528 #endif
529
530 time_diff = t - domain->last_seq_check;
531
532 /* see if we have to refetch the domain sequence number */
533 if (!force && (time_diff < cache_time) &&
534 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
535 NT_STATUS_IS_OK(domain->last_status)) {
536 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
537 goto done;
538 }
539
540 /* try to get the sequence number from the tdb cache first */
541 /* this will update the timestamp as well */
542
543 status = fetch_cache_seqnum( domain, t );
544 if (NT_STATUS_IS_OK(status) &&
545 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
546 NT_STATUS_IS_OK(domain->last_status)) {
547 goto done;
548 }
549
550 /* important! make sure that we know if this is a native
551 mode domain or not. And that we can contact it. */
552
553 if ( winbindd_can_contact_domain( domain ) ) {
554 status = domain->backend->sequence_number(domain,
555 &domain->sequence_number);
556 } else {
557 /* just use the current time */
558 status = NT_STATUS_OK;
559 domain->sequence_number = time(NULL);
560 }
561
562
563 /* the above call could have set our domain->backend to NULL when
564 * coming from offline to online mode, make sure to reinitialize the
565 * backend - Guenther */
566 get_cache( domain );
567
568 if (!NT_STATUS_IS_OK(status)) {
569 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
570 domain->sequence_number = DOM_SEQUENCE_NONE;
571 }
572
573 domain->last_status = status;
574 domain->last_seq_check = time(NULL);
575
576 /* save the new sequence number in the cache */
577 store_cache_seqnum( domain );
578
579 done:
580 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
581 domain->name, domain->sequence_number));
582
583 return;
584 }
585
586 /*
587 decide if a cache entry has expired
588 */
589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
590 {
591 /* If we've been told to be offline - stay in that state... */
592 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
593 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
594 keystr, domain->name ));
595 return false;
596 }
597
598 /* when the domain is offline return the cached entry.
599 * This deals with transient offline states... */
600
601 if (!domain->online) {
602 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
603 keystr, domain->name ));
604 return false;
605 }
606
607 /* if the server is OK and our cache entry came from when it was down then
608 the entry is invalid */
609 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
610 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
611 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
612 keystr, domain->name ));
613 return true;
614 }
615
616 /* if the server is down or the cache entry is not older than the
617 current sequence number then it is OK */
618 if (wcache_server_down(domain) ||
619 centry->sequence_number == domain->sequence_number) {
620 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
621 keystr, domain->name ));
622 return false;
623 }
624
625 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
626 keystr, domain->name ));
627
628 /* it's expired */
629 return true;
630 }
631
632 static struct cache_entry *wcache_fetch_raw(char *kstr)
633 {
634 TDB_DATA data;
635 struct cache_entry *centry;
636 TDB_DATA key;
637
638 key = string_tdb_data(kstr);
639 data = tdb_fetch(wcache->tdb, key);
640 if (!data.dptr) {
641 /* a cache miss */
642 return NULL;
643 }
644
645 centry = SMB_XMALLOC_P(struct cache_entry);
646 centry->data = (unsigned char *)data.dptr;
647 centry->len = data.dsize;
648 centry->ofs = 0;
649
650 if (centry->len < 8) {
651 /* huh? corrupt cache? */
652 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
653 centry_free(centry);
654 return NULL;
655 }
656
657 centry->status = centry_ntstatus(centry);
658 centry->sequence_number = centry_uint32(centry);
659
660 return centry;
661 }
662
663 /*
664 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
665 number and return status
666 */
667 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
668 struct winbindd_domain *domain,
669 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
670 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
671 struct winbindd_domain *domain,
672 const char *format, ...)
673 {
674 va_list ap;
675 char *kstr;
676 struct cache_entry *centry;
677
678 if (!winbindd_use_cache()) {
679 return NULL;
680 }
681
682 refresh_sequence_number(domain, false);
683
684 va_start(ap, format);
685 smb_xvasprintf(&kstr, format, ap);
686 va_end(ap);
687
688 centry = wcache_fetch_raw(kstr);
689 if (centry == NULL) {
690 free(kstr);
691 return NULL;
692 }
693
694 if (centry_expired(domain, kstr, centry)) {
695
696 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
697 kstr, domain->name ));
698
699 centry_free(centry);
700 free(kstr);
701 return NULL;
702 }
703
704 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
705 kstr, domain->name ));
706
707 free(kstr);
708 return centry;
709 }
710
711 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
712 static void wcache_delete(const char *format, ...)
713 {
714 va_list ap;
715 char *kstr;
716 TDB_DATA key;
717
718 va_start(ap, format);
719 smb_xvasprintf(&kstr, format, ap);
720 va_end(ap);
721
722 key = string_tdb_data(kstr);
723
724 tdb_delete(wcache->tdb, key);
725 free(kstr);
726 }
727
728 /*
729 make sure we have at least len bytes available in a centry
730 */
731 static void centry_expand(struct cache_entry *centry, uint32 len)
732 {
733 if (centry->len - centry->ofs >= len)
734 return;
735 centry->len *= 2;
736 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
737 centry->len);
738 if (!centry->data) {
739 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
740 smb_panic_fn("out of memory in centry_expand");
741 }
742 }
743
744 /*
745 push a uint32 into a centry
746 */
747 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
748 {
749 centry_expand(centry, 4);
750 SIVAL(centry->data, centry->ofs, v);
751 centry->ofs += 4;
752 }
753
754 /*
755 push a uint16 into a centry
756 */
757 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
758 {
759 centry_expand(centry, 2);
760 SIVAL(centry->data, centry->ofs, v);
761 centry->ofs += 2;
762 }
763
764 /*
765 push a uint8 into a centry
766 */
767 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
768 {
769 centry_expand(centry, 1);
770 SCVAL(centry->data, centry->ofs, v);
771 centry->ofs += 1;
772 }
773
774 /*
775 push a string into a centry
776 */
777 static void centry_put_string(struct cache_entry *centry, const char *s)
778 {
779 int len;
780
781 if (!s) {
782 /* null strings are marked as len 0xFFFF */
783 centry_put_uint8(centry, 0xFF);
784 return;
785 }
786
787 len = strlen(s);
788 /* can't handle more than 254 char strings. Truncating is probably best */
789 if (len > 254) {
790 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
791 len = 254;
792 }
793 centry_put_uint8(centry, len);
794 centry_expand(centry, len);
795 memcpy(centry->data + centry->ofs, s, len);
796 centry->ofs += len;
797 }
798
799 /*
800 push a 16 byte hash into a centry - treat as 16 byte string.
801 */
802 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
803 {
804 centry_put_uint8(centry, 16);
805 centry_expand(centry, 16);
806 memcpy(centry->data + centry->ofs, val, 16);
807 centry->ofs += 16;
808 }
809
810 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
811 {
812 fstring sid_string;
813 centry_put_string(centry, sid_to_fstring(sid_string, sid));
814 }
815
816
817 /*
818 put NTSTATUS into a centry
819 */
820 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
821 {
822 uint32 status_value = NT_STATUS_V(status);
823 centry_put_uint32(centry, status_value);
824 }
825
826
827 /*
828 push a NTTIME into a centry
829 */
830 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
831 {
832 centry_expand(centry, 8);
833 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
834 centry->ofs += 4;
835 SIVAL(centry->data, centry->ofs, nt >> 32);
836 centry->ofs += 4;
837 }
838
839 /*
840 push a time_t into a centry - use a 64 bit size.
841 NTTIME here is being used as a convenient 64-bit size.
842 */
843 static void centry_put_time(struct cache_entry *centry, time_t t)
844 {
845 NTTIME nt = (NTTIME)t;
846 centry_put_nttime(centry, nt);
847 }
848
849 /*
850 start a centry for output. When finished, call centry_end()
851 */
852 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
853 {
854 struct cache_entry *centry;
855
856 if (!wcache->tdb)
857 return NULL;
858
859 centry = SMB_XMALLOC_P(struct cache_entry);
860
861 centry->len = 8192; /* reasonable default */
862 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
863 centry->ofs = 0;
864 centry->sequence_number = domain->sequence_number;
865 centry_put_ntstatus(centry, status);
866 centry_put_uint32(centry, centry->sequence_number);
867 return centry;
868 }
869
870 /*
871 finish a centry and write it to the tdb
872 */
873 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
874 static void centry_end(struct cache_entry *centry, const char *format, ...)
875 {
876 va_list ap;
877 char *kstr;
878 TDB_DATA key, data;
879
880 if (!winbindd_use_cache()) {
881 return;
882 }
883
884 va_start(ap, format);
885 smb_xvasprintf(&kstr, format, ap);
886 va_end(ap);
887
888 key = string_tdb_data(kstr);
889 data.dptr = centry->data;
890 data.dsize = centry->ofs;
891
892 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
893 free(kstr);
894 }
895
896 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
897 NTSTATUS status, const char *domain_name,
898 const char *name, const DOM_SID *sid,
899 enum lsa_SidType type)
900 {
901 struct cache_entry *centry;
902 fstring uname;
903
904 centry = centry_start(domain, status);
905 if (!centry)
906 return;
907 centry_put_uint32(centry, type);
908 centry_put_sid(centry, sid);
909 fstrcpy(uname, name);
910 strupper_m(uname);
911 centry_end(centry, "NS/%s/%s", domain_name, uname);
912 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
913 uname, sid_string_dbg(sid), nt_errstr(status)));
914 centry_free(centry);
915 }
916
917 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
918 const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
919 {
920 struct cache_entry *centry;
921 fstring sid_string;
922
923 centry = centry_start(domain, status);
924 if (!centry)
925 return;
926
927 if (NT_STATUS_IS_OK(status)) {
928 centry_put_uint32(centry, type);
929 centry_put_string(centry, domain_name);
930 centry_put_string(centry, name);
931 }
932
933 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
934 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
935 name, nt_errstr(status)));
936 centry_free(centry);
937 }
938
939
940 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
941 struct wbint_userinfo *info)
942 {
943 struct cache_entry *centry;
944 fstring sid_string;
945
946 if (is_null_sid(&info->user_sid)) {
947 return;
948 }
949
950 centry = centry_start(domain, status);
951 if (!centry)
952 return;
953 centry_put_string(centry, info->acct_name);
954 centry_put_string(centry, info->full_name);
955 centry_put_string(centry, info->homedir);
956 centry_put_string(centry, info->shell);
957 centry_put_uint32(centry, info->primary_gid);
958 centry_put_sid(centry, &info->user_sid);
959 centry_put_sid(centry, &info->group_sid);
960 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
961 &info->user_sid));
962 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
963 centry_free(centry);
964 }
965
966 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
967 NTSTATUS status,
968 struct samr_DomInfo12 *lockout_policy)
969 {
970 struct cache_entry *centry;
971
972 centry = centry_start(domain, status);
973 if (!centry)
974 return;
975
976 centry_put_nttime(centry, lockout_policy->lockout_duration);
977 centry_put_nttime(centry, lockout_policy->lockout_window);
978 centry_put_uint16(centry, lockout_policy->lockout_threshold);
979
980 centry_end(centry, "LOC_POL/%s", domain->name);
981
982 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
983
984 centry_free(centry);
985 }
986
987
988
989 static void wcache_save_password_policy(struct winbindd_domain *domain,
990 NTSTATUS status,
991 struct samr_DomInfo1 *policy)
992 {
993 struct cache_entry *centry;
994
995 centry = centry_start(domain, status);
996 if (!centry)
997 return;
998
999 centry_put_uint16(centry, policy->min_password_length);
1000 centry_put_uint16(centry, policy->password_history_length);
1001 centry_put_uint32(centry, policy->password_properties);
1002 centry_put_nttime(centry, policy->max_password_age);
1003 centry_put_nttime(centry, policy->min_password_age);
1004
1005 centry_end(centry, "PWD_POL/%s", domain->name);
1006
1007 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1008
1009 centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013 ***************************************************************************/
1014
1015 static void wcache_save_username_alias(struct winbindd_domain *domain,
1016 NTSTATUS status,
1017 const char *name, const char *alias)
1018 {
1019 struct cache_entry *centry;
1020 fstring uname;
1021
1022 if ( (centry = centry_start(domain, status)) == NULL )
1023 return;
1024
1025 centry_put_string( centry, alias );
1026
1027 fstrcpy(uname, name);
1028 strupper_m(uname);
1029 centry_end(centry, "NSS/NA/%s", uname);
1030
1031 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1032
1033 centry_free(centry);
1034 }
1035
1036 static void wcache_save_alias_username(struct winbindd_domain *domain,
1037 NTSTATUS status,
1038 const char *alias, const char *name)
1039 {
1040 struct cache_entry *centry;
1041 fstring uname;
1042
1043 if ( (centry = centry_start(domain, status)) == NULL )
1044 return;
1045
1046 centry_put_string( centry, name );
1047
1048 fstrcpy(uname, alias);
1049 strupper_m(uname);
1050 centry_end(centry, "NSS/AN/%s", uname);
1051
1052 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1053
1054 centry_free(centry);
1055 }
1056
1057 /***************************************************************************
1058 ***************************************************************************/
1059
1060 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1061 struct winbindd_domain *domain,
1062 const char *name, char **alias )
1063 {
1064 struct winbind_cache *cache = get_cache(domain);
1065 struct cache_entry *centry = NULL;
1066 NTSTATUS status;
1067 char *upper_name;
1068
1069 if ( domain->internal )
1070 return NT_STATUS_NOT_SUPPORTED;
1071
1072 if (!cache->tdb)
1073 goto do_query;
1074
1075 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1076 return NT_STATUS_NO_MEMORY;
1077 strupper_m(upper_name);
1078
1079 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1080
1081 SAFE_FREE( upper_name );
1082
1083 if (!centry)
1084 goto do_query;
1085
1086 status = centry->status;
1087
1088 if (!NT_STATUS_IS_OK(status)) {
1089 centry_free(centry);
1090 return status;
1091 }
1092
1093 *alias = centry_string( centry, mem_ctx );
1094
1095 centry_free(centry);
1096
1097 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1098 name, *alias ? *alias : "(none)"));
1099
1100 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1101
1102 do_query:
1103
1104 /* If its not in cache and we are offline, then fail */
1105
1106 if ( get_global_winbindd_state_offline() || !domain->online ) {
1107 DEBUG(8,("resolve_username_to_alias: rejecting query "
1108 "in offline mode\n"));
1109 return NT_STATUS_NOT_FOUND;
1110 }
1111
1112 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1113
1114 if ( NT_STATUS_IS_OK( status ) ) {
1115 wcache_save_username_alias(domain, status, name, *alias);
1116 }
1117
1118 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1119 wcache_save_username_alias(domain, status, name, "(NULL)");
1120 }
1121
1122 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1123 nt_errstr(status)));
1124
1125 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1126 set_domain_offline( domain );
1127 }
1128
1129 return status;
1130 }
1131
1132 /***************************************************************************
1133 ***************************************************************************/
1134
1135 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1136 struct winbindd_domain *domain,
1137 const char *alias, char **name )
1138 {
1139 struct winbind_cache *cache = get_cache(domain);
1140 struct cache_entry *centry = NULL;
1141 NTSTATUS status;
1142 char *upper_name;
1143
1144 if ( domain->internal )
1145 return NT_STATUS_NOT_SUPPORTED;
1146
1147 if (!cache->tdb)
1148 goto do_query;
1149
1150 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1151 return NT_STATUS_NO_MEMORY;
1152 strupper_m(upper_name);
1153
1154 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1155
1156 SAFE_FREE( upper_name );
1157
1158 if (!centry)
1159 goto do_query;
1160
1161 status = centry->status;
1162
1163 if (!NT_STATUS_IS_OK(status)) {
1164 centry_free(centry);
1165 return status;
1166 }
1167
1168 *name = centry_string( centry, mem_ctx );
1169
1170 centry_free(centry);
1171
1172 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1173 alias, *name ? *name : "(none)"));
1174
1175 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1176
1177 do_query:
1178
1179 /* If its not in cache and we are offline, then fail */
1180
1181 if ( get_global_winbindd_state_offline() || !domain->online ) {
1182 DEBUG(8,("resolve_alias_to_username: rejecting query "
1183 "in offline mode\n"));
1184 return NT_STATUS_NOT_FOUND;
1185 }
1186
1187 /* an alias cannot contain a domain prefix or '@' */
1188
1189 if (strchr(alias, '\\') || strchr(alias, '@')) {
1190 DEBUG(10,("resolve_alias_to_username: skipping fully "
1191 "qualified name %s\n", alias));
1192 return NT_STATUS_OBJECT_NAME_INVALID;
1193 }
1194
1195 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1196
1197 if ( NT_STATUS_IS_OK( status ) ) {
1198 wcache_save_alias_username( domain, status, alias, *name );
1199 }
1200
1201 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1202 wcache_save_alias_username(domain, status, alias, "(NULL)");
1203 }
1204
1205 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1206 nt_errstr(status)));
1207
1208 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1209 set_domain_offline( domain );
1210 }
1211
1212 return status;
1213 }
1214
1215 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1216 {
1217 struct winbind_cache *cache = get_cache(domain);
1218 TDB_DATA data;
1219 fstring key_str, tmp;
1220 uint32 rid;
1221
1222 if (!cache->tdb) {
1223 return NT_STATUS_INTERNAL_DB_ERROR;
1224 }
1225
1226 if (is_null_sid(sid)) {
1227 return NT_STATUS_INVALID_SID;
1228 }
1229
1230 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1231 return NT_STATUS_INVALID_SID;
1232 }
1233
1234 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1235
1236 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1237 if (!data.dptr) {
1238 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1239 }
1240
1241 SAFE_FREE(data.dptr);
1242 return NT_STATUS_OK;
1243 }
1244
1245 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1246 as new salted ones. */
1247
1248 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1249 TALLOC_CTX *mem_ctx,
1250 const DOM_SID *sid,
1251 const uint8 **cached_nt_pass,
1252 const uint8 **cached_salt)
1253 {
1254 struct winbind_cache *cache = get_cache(domain);
1255 struct cache_entry *centry = NULL;
1256 NTSTATUS status;
1257 time_t t;
1258 uint32 rid;
1259 fstring tmp;
1260
1261 if (!cache->tdb) {
1262 return NT_STATUS_INTERNAL_DB_ERROR;
1263 }
1264
1265 if (is_null_sid(sid)) {
1266 return NT_STATUS_INVALID_SID;
1267 }
1268
1269 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1270 return NT_STATUS_INVALID_SID;
1271 }
1272
1273 /* Try and get a salted cred first. If we can't
1274 fall back to an unsalted cred. */
1275
1276 centry = wcache_fetch(cache, domain, "CRED/%s",
1277 sid_to_fstring(tmp, sid));
1278 if (!centry) {
1279 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1280 sid_string_dbg(sid)));
1281 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1282 }
1283
1284 t = centry_time(centry);
1285
1286 /* In the salted case this isn't actually the nt_hash itself,
1287 but the MD5 of the salt + nt_hash. Let the caller
1288 sort this out. It can tell as we only return the cached_salt
1289 if we are returning a salted cred. */
1290
1291 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1292 if (*cached_nt_pass == NULL) {
1293 fstring sidstr;
1294
1295 sid_to_fstring(sidstr, sid);
1296
1297 /* Bad (old) cred cache. Delete and pretend we
1298 don't have it. */
1299 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1300 sidstr));
1301 wcache_delete("CRED/%s", sidstr);
1302 centry_free(centry);
1303 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1304 }
1305
1306 /* We only have 17 bytes more data in the salted cred case. */
1307 if (centry->len - centry->ofs == 17) {
1308 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1309 } else {
1310 *cached_salt = NULL;
1311 }
1312
1313 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1314 if (*cached_salt) {
1315 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1316 }
1317
1318 status = centry->status;
1319
1320 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1321 sid_string_dbg(sid), nt_errstr(status) ));
1322
1323 centry_free(centry);
1324 return status;
1325 }
1326
1327 /* Store creds for a SID - only writes out new salted ones. */
1328
1329 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1330 TALLOC_CTX *mem_ctx,
1331 const DOM_SID *sid,
1332 const uint8 nt_pass[NT_HASH_LEN])
1333 {
1334 struct cache_entry *centry;
1335 fstring sid_string;
1336 uint32 rid;
1337 uint8 cred_salt[NT_HASH_LEN];
1338 uint8 salted_hash[NT_HASH_LEN];
1339
1340 if (is_null_sid(sid)) {
1341 return NT_STATUS_INVALID_SID;
1342 }
1343
1344 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1345 return NT_STATUS_INVALID_SID;
1346 }
1347
1348 centry = centry_start(domain, NT_STATUS_OK);
1349 if (!centry) {
1350 return NT_STATUS_INTERNAL_DB_ERROR;
1351 }
1352
1353 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1354
1355 centry_put_time(centry, time(NULL));
1356
1357 /* Create a salt and then salt the hash. */
1358 generate_random_buffer(cred_salt, NT_HASH_LEN);
1359 E_md5hash(cred_salt, nt_pass, salted_hash);
1360
1361 centry_put_hash16(centry, salted_hash);
1362 centry_put_hash16(centry, cred_salt);
1363 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1364
1365 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1366
1367 centry_free(centry);
1368
1369 return NT_STATUS_OK;
1370 }
1371
1372
1373 /* Query display info. This is the basic user list fn */
1374 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1375 TALLOC_CTX *mem_ctx,
1376 uint32 *num_entries,
1377 struct wbint_userinfo **info)
1378 {
1379 struct winbind_cache *cache = get_cache(domain);
1380 struct cache_entry *centry = NULL;
1381 NTSTATUS status;
1382 unsigned int i, retry;
1383 bool old_status = domain->online;
1384
1385 if (!cache->tdb)
1386 goto do_query;
1387
1388 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1389 if (!centry)
1390 goto do_query;
1391
1392 do_fetch_cache:
1393 *num_entries = centry_uint32(centry);
1394
1395 if (*num_entries == 0)
1396 goto do_cached;
1397
1398 (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1399 if (! (*info)) {
1400 smb_panic_fn("query_user_list out of memory");
1401 }
1402 for (i=0; i<(*num_entries); i++) {
1403 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1404 (*info)[i].full_name = centry_string(centry, mem_ctx);
1405 (*info)[i].homedir = centry_string(centry, mem_ctx);
1406 (*info)[i].shell = centry_string(centry, mem_ctx);
1407 centry_sid(centry, &(*info)[i].user_sid);
1408 centry_sid(centry, &(*info)[i].group_sid);
1409 }
1410
1411 do_cached:
1412 status = centry->status;
1413
1414 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1415 domain->name, nt_errstr(status) ));
1416
1417 centry_free(centry);
1418 return status;
1419
1420 do_query:
1421 *num_entries = 0;
1422 *info = NULL;
1423
1424 /* Return status value returned by seq number check */
1425
1426 if (!NT_STATUS_IS_OK(domain->last_status))
1427 return domain->last_status;
1428
1429 /* Put the query_user_list() in a retry loop. There appears to be
1430 * some bug either with Windows 2000 or Samba's handling of large
1431 * rpc replies. This manifests itself as sudden disconnection
1432 * at a random point in the enumeration of a large (60k) user list.
1433 * The retry loop simply tries the operation again. )-: It's not
1434 * pretty but an acceptable workaround until we work out what the
1435 * real problem is. */
1436
1437 retry = 0;
1438 do {
1439
1440 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1441 domain->name ));
1442
1443 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1444 if (!NT_STATUS_IS_OK(status)) {
1445 DEBUG(3, ("query_user_list: returned 0x%08x, "
1446 "retrying\n", NT_STATUS_V(status)));
1447 }
1448 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1449 DEBUG(3, ("query_user_list: flushing "
1450 "connection cache\n"));
1451 invalidate_cm_connection(&domain->conn);
1452 }
1453 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1454 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1455 if (!domain->internal && old_status) {
1456 set_domain_offline(domain);
1457 }
1458 /* store partial response. */
1459 if (*num_entries > 0) {
1460 /*
1461 * humm, what about the status used for cache?
1462 * Should it be NT_STATUS_OK?
1463 */
1464 break;
1465 }
1466 /*
1467 * domain is offline now, and there is no user entries,
1468 * try to fetch from cache again.
1469 */
1470 if (cache->tdb && !domain->online && !domain->internal && old_status) {
1471 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1472 /* partial response... */
1473 if (!centry) {
1474 goto skip_save;
1475 } else {
1476 goto do_fetch_cache;
1477 }
1478 } else {
1479 goto skip_save;
1480 }
1481 }
1482
1483 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1484 (retry++ < 5));
1485
1486 /* and save it */
1487 refresh_sequence_number(domain, false);
1488 if (!NT_STATUS_IS_OK(status)) {
1489 return status;
1490 }
1491 centry = centry_start(domain, status);
1492 if (!centry)
1493 goto skip_save;
1494 centry_put_uint32(centry, *num_entries);
1495 for (i=0; i<(*num_entries); i++) {
1496 centry_put_string(centry, (*info)[i].acct_name);
1497 centry_put_string(centry, (*info)[i].full_name);
1498 centry_put_string(centry, (*info)[i].homedir);
1499 centry_put_string(centry, (*info)[i].shell);
1500 centry_put_sid(centry, &(*info)[i].user_sid);
1501 centry_put_sid(centry, &(*info)[i].group_sid);
1502 if (domain->backend && domain->backend->consistent) {
1503 /* when the backend is consistent we can pre-prime some mappings */
1504 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1505 domain->name,
1506 (*info)[i].acct_name,
1507 &(*info)[i].user_sid,
1508 SID_NAME_USER);
1509 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1510 &(*info)[i].user_sid,
1511 domain->name,
1512 (*info)[i].acct_name,
1513 SID_NAME_USER);
1514 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1515 }
1516 }
1517 centry_end(centry, "UL/%s", domain->name);
1518 centry_free(centry);
1519
1520 skip_save:
1521 return status;
1522 }
1523
1524 /* list all domain groups */
1525 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1526 TALLOC_CTX *mem_ctx,
1527 uint32 *num_entries,
1528 struct acct_info **info)
1529 {
1530 struct winbind_cache *cache = get_cache(domain);
1531 struct cache_entry *centry = NULL;
1532 NTSTATUS status;
1533 unsigned int i;
1534 bool old_status;
1535
1536 old_status = domain->online;
1537 if (!cache->tdb)
1538 goto do_query;
1539
1540 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1541 if (!centry)
1542 goto do_query;
1543
1544 do_fetch_cache:
1545 *num_entries = centry_uint32(centry);
1546
1547 if (*num_entries == 0)
1548 goto do_cached;
1549
1550 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1551 if (! (*info)) {
1552 smb_panic_fn("enum_dom_groups out of memory");
1553 }
1554 for (i=0; i<(*num_entries); i++) {
1555 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1556 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1557 (*info)[i].rid = centry_uint32(centry);
1558 }
1559
1560 do_cached:
1561 status = centry->status;
1562
1563 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1564 domain->name, nt_errstr(status) ));
1565
1566 centry_free(centry);
1567 return status;
1568
1569 do_query:
1570 *num_entries = 0;
1571 *info = NULL;
1572
1573 /* Return status value returned by seq number check */
1574
1575 if (!NT_STATUS_IS_OK(domain->last_status))
1576 return domain->last_status;
1577
1578 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1579 domain->name ));
1580
1581 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1582
1583 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1584 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1585 if (!domain->internal && old_status) {
1586 set_domain_offline(domain);
1587 }
1588 if (cache->tdb &&
1589 !domain->online &&
1590 !domain->internal &&
1591 old_status) {
1592 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1593 if (centry) {
1594 goto do_fetch_cache;
1595 }
1596 }
1597 }
1598 /* and save it */
1599 refresh_sequence_number(domain, false);
1600 if (!NT_STATUS_IS_OK(status)) {
1601 return status;
1602 }
1603 centry = centry_start(domain, status);
1604 if (!centry)
1605 goto skip_save;
1606 centry_put_uint32(centry, *num_entries);
1607 for (i=0; i<(*num_entries); i++) {
1608 centry_put_string(centry, (*info)[i].acct_name);
1609 centry_put_string(centry, (*info)[i].acct_desc);
1610 centry_put_uint32(centry, (*info)[i].rid);
1611 }
1612 centry_end(centry, "GL/%s/domain", domain->name);
1613 centry_free(centry);
1614
1615 skip_save:
1616 return status;
1617 }
1618
1619 /* list all domain groups */
1620 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1621 TALLOC_CTX *mem_ctx,
1622 uint32 *num_entries,
1623 struct acct_info **info)
1624 {
1625 struct winbind_cache *cache = get_cache(domain);
1626 struct cache_entry *centry = NULL;
1627 NTSTATUS status;
1628 unsigned int i;
1629 bool old_status;
1630
1631 old_status = domain->online;
1632 if (!cache->tdb)
1633 goto do_query;
1634
1635 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1636 if (!centry)
1637 goto do_query;
1638
1639 do_fetch_cache:
1640 *num_entries = centry_uint32(centry);
1641
1642 if (*num_entries == 0)
1643 goto do_cached;
1644
1645 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1646 if (! (*info)) {
1647 smb_panic_fn("enum_dom_groups out of memory");
1648 }
1649 for (i=0; i<(*num_entries); i++) {
1650 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1651 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1652 (*info)[i].rid = centry_uint32(centry);
1653 }
1654
1655 do_cached:
1656
1657 /* If we are returning cached data and the domain controller
1658 is down then we don't know whether the data is up to date
1659 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1660 indicate this. */
1661
1662 if (wcache_server_down(domain)) {
1663 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1664 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1665 } else
1666 status = centry->status;
1667
1668 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1669 domain->name, nt_errstr(status) ));
1670
1671 centry_free(centry);
1672 return status;
1673
1674 do_query:
1675 *num_entries = 0;
1676 *info = NULL;
1677
1678 /* Return status value returned by seq number check */
1679
1680 if (!NT_STATUS_IS_OK(domain->last_status))
1681 return domain->last_status;
1682
1683 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1684 domain->name ));
1685
1686 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1687
1688 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1689 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1690 if (!domain->internal && old_status) {
1691 set_domain_offline(domain);
1692 }
1693 if (cache->tdb &&
1694 !domain->internal &&
1695 !domain->online &&
1696 old_status) {
1697 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1698 if (centry) {
1699 goto do_fetch_cache;
1700 }
1701 }
1702 }
1703 /* and save it */
1704 refresh_sequence_number(domain, false);
1705 if (!NT_STATUS_IS_OK(status)) {
1706 return status;
1707 }
1708 centry = centry_start(domain, status);
1709 if (!centry)
1710 goto skip_save;
1711 centry_put_uint32(centry, *num_entries);
1712 for (i=0; i<(*num_entries); i++) {
1713 centry_put_string(centry, (*info)[i].acct_name);
1714 centry_put_string(centry, (*info)[i].acct_desc);
1715 centry_put_uint32(centry, (*info)[i].rid);
1716 }
1717 centry_end(centry, "GL/%s/local", domain->name);
1718 centry_free(centry);
1719
1720 skip_save:
1721 return status;
1722 }
1723
1724 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1725 const char *domain_name,
1726 const char *name,
1727 struct dom_sid *sid,
1728 enum lsa_SidType *type)
1729 {
1730 struct winbind_cache *cache = get_cache(domain);
1731 struct cache_entry *centry;
1732 NTSTATUS status;
1733 char *uname;
1734
1735 if (cache->tdb == NULL) {
1736 return NT_STATUS_NOT_FOUND;
1737 }
1738
1739 uname = talloc_strdup_upper(talloc_tos(), name);
1740 if (uname == NULL) {
1741 return NT_STATUS_NO_MEMORY;
1742 }
1743
1744 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1745 TALLOC_FREE(uname);
1746 if (centry == NULL) {
1747 return NT_STATUS_NOT_FOUND;
1748 }
1749
1750 status = centry->status;
1751 if (NT_STATUS_IS_OK(status)) {
1752 *type = (enum lsa_SidType)centry_uint32(centry);
1753 centry_sid(centry, sid);
1754 }
1755
1756 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1757 "%s\n", domain->name, nt_errstr(status) ));
1758
1759 centry_free(centry);
1760 return status;
1761 }
1762
1763 /* convert a single name to a sid in a domain */
1764 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1765 TALLOC_CTX *mem_ctx,
1766 const char *domain_name,
1767 const char *name,
1768 uint32_t flags,
1769 DOM_SID *sid,
1770 enum lsa_SidType *type)
1771 {
1772 NTSTATUS status;
1773 bool old_status;
1774
1775 old_status = domain->online;
1776
1777 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1778 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1779 return status;
1780 }
1781
1782 ZERO_STRUCTP(sid);
1783
1784 /* If the seq number check indicated that there is a problem
1785 * with this DC, then return that status... except for
1786 * access_denied. This is special because the dc may be in
1787 * "restrict anonymous = 1" mode, in which case it will deny
1788 * most unauthenticated operations, but *will* allow the LSA
1789 * name-to-sid that we try as a fallback. */
1790
1791 if (!(NT_STATUS_IS_OK(domain->last_status)
1792 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1793 return domain->last_status;
1794
1795 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1796 domain->name ));
1797
1798 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1799 name, flags, sid, type);
1800
1801 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1802 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1803 if (!domain->internal && old_status) {
1804 set_domain_offline(domain);
1805 }
1806 if (!domain->internal &&
1807 !domain->online &&
1808 old_status) {
1809 NTSTATUS cache_status;
1810 cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1811 return cache_status;
1812 }
1813 }
1814 /* and save it */
1815 refresh_sequence_number(domain, false);
1816
1817 if (domain->online &&
1818 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1819 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1820
1821 /* Only save the reverse mapping if this was not a UPN */
1822 if (!strchr(name, '@')) {
1823 strupper_m(CONST_DISCARD(char *,domain_name));
1824 strlower_m(CONST_DISCARD(char *,name));
1825 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1826 }
1827 }
1828
1829 return status;
1830 }
1831
1832 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1833 const struct dom_sid *sid,
1834 TALLOC_CTX *mem_ctx,
1835 char **domain_name,
1836 char **name,
1837 enum lsa_SidType *type)
1838 {
1839 struct winbind_cache *cache = get_cache(domain);
1840 struct cache_entry *centry;
1841 char *sid_string;
1842 NTSTATUS status;
1843
1844 if (cache->tdb == NULL) {
1845 return NT_STATUS_NOT_FOUND;
1846 }
1847
1848 sid_string = sid_string_tos(sid);
1849 if (sid_string == NULL) {
1850 return NT_STATUS_NO_MEMORY;
1851 }
1852
1853 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1854 TALLOC_FREE(sid_string);
1855 if (centry == NULL) {
1856 return NT_STATUS_NOT_FOUND;
1857 }
1858
1859 if (NT_STATUS_IS_OK(centry->status)) {
1860 *type = (enum lsa_SidType)centry_uint32(centry);
1861 *domain_name = centry_string(centry, mem_ctx);
1862 *name = centry_string(centry, mem_ctx);
1863 }
1864
1865 status = centry->status;
1866 centry_free(centry);
1867
1868 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1869 "%s\n", domain->name, nt_errstr(status) ));
1870
1871 return status;
1872 }
1873
1874 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1875 given */
1876 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1877 TALLOC_CTX *mem_ctx,
1878 const DOM_SID *sid,
1879 char **domain_name,
1880 char **name,
1881 enum lsa_SidType *type)
1882 {
1883 NTSTATUS status;
1884 bool old_status;
1885
1886 old_status = domain->online;
1887 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1888 type);
1889 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1890 return status;
1891 }
1892
1893 *name = NULL;
1894 *domain_name = NULL;
1895
1896 /* If the seq number check indicated that there is a problem
1897 * with this DC, then return that status... except for
1898 * access_denied. This is special because the dc may be in
1899 * "restrict anonymous = 1" mode, in which case it will deny
1900 * most unauthenticated operations, but *will* allow the LSA
1901 * sid-to-name that we try as a fallback. */
1902
1903 if (!(NT_STATUS_IS_OK(domain->last_status)
1904 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1905 return domain->last_status;
1906
1907 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1908 domain->name ));
1909
1910 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1911
1912 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1913 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1914 if (!domain->internal && old_status) {
1915 set_domain_offline(domain);
1916 }
1917 if (!domain->internal &&
1918 !domain->online &&
1919 old_status) {
1920 NTSTATUS cache_status;
1921 cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1922 domain_name, name, type);
1923 return cache_status;
1924 }
1925 }
1926 /* and save it */
1927 refresh_sequence_number(domain, false);
1928 if (!NT_STATUS_IS_OK(status)) {
1929 return status;
1930 }
1931 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1932
1933 /* We can't save the name to sid mapping here, as with sid history a
1934 * later name2sid would give the wrong sid. */
1935
1936 return status;
1937 }
1938
1939 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1940 TALLOC_CTX *mem_ctx,
1941 const DOM_SID *domain_sid,
1942 uint32 *rids,
1943 size_t num_rids,
1944 char **domain_name,
1945 char ***names,
1946 enum lsa_SidType **types)
1947 {
1948 struct winbind_cache *cache = get_cache(domain);
1949 size_t i;
1950 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1951 bool have_mapped;
1952 bool have_unmapped;
1953 bool old_status;
1954
1955 old_status = domain->online;
1956 *domain_name = NULL;
1957 *names = NULL;
1958 *types = NULL;
1959
1960 if (!cache->tdb) {
1961 goto do_query;
1962 }
1963
1964 if (num_rids == 0) {
1965 return NT_STATUS_OK;
1966 }
1967
1968 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1969 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1970
1971 if ((*names == NULL) || (*types == NULL)) {
1972 result = NT_STATUS_NO_MEMORY;
1973 goto error;
1974 }
1975
1976 have_mapped = have_unmapped = false;
1977
1978 for (i=0; i<num_rids; i++) {
1979 DOM_SID sid;
1980 struct cache_entry *centry;
1981 fstring tmp;
1982
1983 if (!sid_compose(&sid, domain_sid, rids[i])) {
1984 result = NT_STATUS_INTERNAL_ERROR;
1985 goto error;
1986 }
1987
1988 centry = wcache_fetch(cache, domain, "SN/%s",
1989 sid_to_fstring(tmp, &sid));
1990 if (!centry) {
1991 goto do_query;
1992 }
1993
1994 (*types)[i] = SID_NAME_UNKNOWN;
1995 (*names)[i] = talloc_strdup(*names, "");
1996
1997 if (NT_STATUS_IS_OK(centry->status)) {
1998 char *dom;
1999 have_mapped = true;
2000 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2001
2002 dom = centry_string(centry, mem_ctx);
2003 if (*domain_name == NULL) {
2004 *domain_name = dom;
2005 } else {
2006 talloc_free(dom);
2007 }
2008
2009 (*names)[i] = centry_string(centry, *names);
2010
2011 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2012 have_unmapped = true;
2013
2014 } else {
2015 /* something's definitely wrong */
2016 result = centry->status;
2017 goto error;
2018 }
2019
2020 centry_free(centry);
2021 }
2022
2023 if (!have_mapped) {
2024 return NT_STATUS_NONE_MAPPED;
2025 }
2026 if (!have_unmapped) {
2027 return NT_STATUS_OK;
2028 }
2029 return STATUS_SOME_UNMAPPED;
2030
2031 do_query:
2032
2033 TALLOC_FREE(*names);
2034 TALLOC_FREE(*types);
2035
2036 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2037 rids, num_rids, domain_name,
2038 names, types);
2039
2040 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2041 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2042 if (!domain->internal && old_status) {
2043 set_domain_offline(domain);
2044 }
2045 if (cache->tdb &&
2046 !domain->internal &&
2047 !domain->online &&
2048 old_status) {
2049 have_mapped = have_unmapped = false;
2050
2051 for (i=0; i<num_rids; i++) {
2052 DOM_SID sid;
2053 struct cache_entry *centry;
2054 fstring tmp;
2055
2056 if (!sid_compose(&sid, domain_sid, rids[i])) {
2057 result = NT_STATUS_INTERNAL_ERROR;
2058 goto error;
2059 }
2060
2061 centry = wcache_fetch(cache, domain, "SN/%s",
2062 sid_to_fstring(tmp, &sid));
2063 if (!centry) {
2064 (*types)[i] = SID_NAME_UNKNOWN;
2065 (*names)[i] = talloc_strdup(*names, "");
2066 continue;
2067 }
2068
2069 (*types)[i] = SID_NAME_UNKNOWN;
2070 (*names)[i] = talloc_strdup(*names, "");
2071
2072 if (NT_STATUS_IS_OK(centry->status)) {
2073 char *dom;
2074 have_mapped = true;
2075 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2076
2077 dom = centry_string(centry, mem_ctx);
2078 if (*domain_name == NULL) {
2079 *domain_name = dom;
2080 } else {
2081 talloc_free(dom);
2082 }
2083
2084 (*names)[i] = centry_string(centry, *names);
2085
2086 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2087 have_unmapped = true;
2088
2089 } else {
2090 /* something's definitely wrong */
2091 result = centry->status;
2092 goto error;
2093 }
2094
2095 centry_free(centry);
2096 }
2097
2098 if (!have_mapped) {
2099 return NT_STATUS_NONE_MAPPED;
2100 }
2101 if (!have_unmapped) {
2102 return NT_STATUS_OK;
2103 }
2104 return STATUS_SOME_UNMAPPED;
2105 }
2106 }
2107 /*
2108 None of the queried rids has been found so save all negative entries
2109 */
2110 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2111 for (i = 0; i < num_rids; i++) {
2112 DOM_SID sid;
2113 const char *name = "";
2114 const enum lsa_SidType type = SID_NAME_UNKNOWN;
2115 NTSTATUS status = NT_STATUS_NONE_MAPPED;
2116
2117 if (!sid_compose(&sid, domain_sid, rids[i])) {
2118 return NT_STATUS_INTERNAL_ERROR;
2119 }
2120
2121 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2122 name, type);
2123 }
2124
2125 return result;
2126 }
2127
2128 /*
2129 Some or all of the queried rids have been found.
2130 */
2131 if (!NT_STATUS_IS_OK(result) &&
2132 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2133 return result;
2134 }
2135
2136 refresh_sequence_number(domain, false);
2137
2138 for (i=0; i<num_rids; i++) {
2139 DOM_SID sid;
2140 NTSTATUS status;
2141
2142 if (!sid_compose(&sid, domain_sid, rids[i])) {
2143 result = NT_STATUS_INTERNAL_ERROR;
2144 goto error;
2145 }
2146
2147 status = (*types)[i] == SID_NAME_UNKNOWN ?
2148 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2149
2150 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2151 (*names)[i], (*types)[i]);
2152 }
2153
2154 return result;
2155
2156 error:
2157 TALLOC_FREE(*names);
2158 TALLOC_FREE(*types);
2159 return result;
2160 }
2161
2162 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2163 TALLOC_CTX *mem_ctx,
2164 const struct dom_sid *user_sid,
2165 struct wbint_userinfo *info)
2166 {
2167 struct winbind_cache *cache = get_cache(domain);
2168 struct cache_entry *centry = NULL;
2169 NTSTATUS status;
2170 char *sid_string;
2171
2172 if (cache->tdb == NULL) {
2173 return NT_STATUS_NOT_FOUND;
2174 }
2175
2176 sid_string = sid_string_tos(user_sid);
2177 if (sid_string == NULL) {
2178 return NT_STATUS_NO_MEMORY;
2179 }
2180
2181 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2182 TALLOC_FREE(sid_string);
2183 if (centry == NULL) {
2184 return NT_STATUS_NOT_FOUND;
2185 }
2186
2187 /*
2188 * If we have an access denied cache entry and a cached info3
2189 * in the samlogon cache then do a query. This will force the
2190 * rpc back end to return the info3 data.
2191 */
2192
2193 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2194 netsamlogon_cache_have(user_sid)) {
2195 DEBUG(10, ("query_user: cached access denied and have cached "
2196 "info3\n"));
2197 domain->last_status = NT_STATUS_OK;
2198 centry_free(centry);
2199 return NT_STATUS_NOT_FOUND;
2200 }
2201
2202 /* if status is not ok then this is a negative hit
2203 and the rest of the data doesn't matter */
2204 status = centry->status;
2205 if (NT_STATUS_IS_OK(status)) {
2206 info->acct_name = centry_string(centry, mem_ctx);
2207 info->full_name = centry_string(centry, mem_ctx);
2208 info->homedir = centry_string(centry, mem_ctx);
2209 info->shell = centry_string(centry, mem_ctx);
2210 info->primary_gid = centry_uint32(centry);
2211 centry_sid(centry, &info->user_sid);
2212 centry_sid(centry, &info->group_sid);
2213 }
2214
2215 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2216 "%s\n", domain->name, nt_errstr(status) ));
2217
2218 centry_free(centry);
2219 return status;
2220 }
2221
2222 /* Lookup user information from a rid */
2223 static NTSTATUS query_user(struct winbindd_domain *domain,
2224 TALLOC_CTX *mem_ctx,
2225 const DOM_SID *user_sid,
2226 struct wbint_userinfo *info)
2227 {
2228 NTSTATUS status;
2229 bool old_status;
2230
2231 old_status = domain->online;
2232 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2233 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2234 return status;
2235 }
2236
2237 ZERO_STRUCTP(info);
2238
2239 /* Return status value returned by seq number check */
2240
2241 if (!NT_STATUS_IS_OK(domain->last_status))
2242 return domain->last_status;
2243
2244 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2245 domain->name ));
2246
2247 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2248
2249 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2250 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2251 if (!domain->internal && old_status) {
2252 set_domain_offline(domain);
2253 }
2254 if (!domain->internal &&
2255 !domain->online &&
2256 old_status) {
2257 NTSTATUS cache_status;
2258 cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2259 return cache_status;
2260 }
2261 }
2262 /* and save it */
2263 refresh_sequence_number(domain, false);
2264 if (!NT_STATUS_IS_OK(status)) {
2265 return status;
2266 }
2267 wcache_save_user(domain, status, info);
2268
2269 return status;
2270 }
2271
2272 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2273 TALLOC_CTX *mem_ctx,
2274 const struct dom_sid *user_sid,
2275 uint32_t *pnum_sids,
2276 struct dom_sid **psids)
2277 {
2278 struct winbind_cache *cache = get_cache(domain);
2279 struct cache_entry *centry = NULL;
2280 NTSTATUS status;
2281 uint32_t i, num_sids;
2282 struct dom_sid *sids;
2283 fstring sid_string;
2284
2285 if (cache->tdb == NULL) {
2286 return NT_STATUS_NOT_FOUND;
2287 }
2288
2289 centry = wcache_fetch(cache, domain, "UG/%s",
2290 sid_to_fstring(sid_string, user_sid));
2291 if (centry == NULL) {
2292 return NT_STATUS_NOT_FOUND;
2293 }
2294
2295 /* If we have an access denied cache entry and a cached info3 in the
2296 samlogon cache then do a query. This will force the rpc back end
2297 to return the info3 data. */
2298
2299 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2300 && netsamlogon_cache_have(user_sid)) {
2301 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2302 "cached info3\n"));
2303 domain->last_status = NT_STATUS_OK;
2304 centry_free(centry);
2305 return NT_STATUS_NOT_FOUND;
2306 }
2307
2308 num_sids = centry_uint32(centry);
2309 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2310 if (sids == NULL) {
2311 centry_free(centry);
2312 return NT_STATUS_NO_MEMORY;
2313 }
2314
2315 for (i=0; i<num_sids; i++) {
2316 centry_sid(centry, &sids[i]);
2317 }
2318
2319 status = centry->status;
2320
2321 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2322 "status: %s\n", domain->name, nt_errstr(status)));
2323
2324 centry_free(centry);
2325
2326 *pnum_sids = num_sids;
2327 *psids = sids;
2328 return status;
2329 }
2330
2331 /* Lookup groups a user is a member of. */
2332 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2333 TALLOC_CTX *mem_ctx,
2334 const DOM_SID *user_sid,
2335 uint32 *num_groups, DOM_SID **user_gids)
2336 {
2337 struct cache_entry *centry = NULL;
2338 NTSTATUS status;
2339 unsigned int i;
2340 fstring sid_string;
2341 bool old_status;
2342
2343 old_status = domain->online;
2344 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2345 num_groups, user_gids);
2346 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2347 return status;
2348 }
2349
2350 (*num_groups) = 0;
2351 (*user_gids) = NULL;
2352
2353 /* Return status value returned by seq number check */
2354
2355 if (!NT_STATUS_IS_OK(domain->last_status))
2356 return domain->last_status;
2357
2358 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2359 domain->name ));
2360
2361 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2362
2363 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2364 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2365 if (!domain->internal && old_status) {
2366 set_domain_offline(domain);
2367 }
2368 if (!domain->internal &&
2369 !domain->online &&
2370 old_status) {
2371 NTSTATUS cache_status;
2372 cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2373 num_groups, user_gids);
2374 return cache_status;
2375 }
2376 }
2377 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2378 goto skip_save;
2379
2380 /* and save it */
2381 refresh_sequence_number(domain, false);
2382 if (!NT_STATUS_IS_OK(status)) {
2383 return status;
2384 }
2385 centry = centry_start(domain, status);
2386 if (!centry)
2387 goto skip_save;
2388
2389 centry_put_uint32(centry, *num_groups);
2390 for (i=0; i<(*num_groups); i++) {
2391 centry_put_sid(centry, &(*user_gids)[i]);
2392 }
2393
2394 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2395 centry_free(centry);
2396
2397 skip_save:
2398 return status;
2399 }
2400
2401 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2402 const struct dom_sid *sids)
2403 {
2404 uint32_t i;
2405 char *sidlist;
2406
2407 sidlist = talloc_strdup(mem_ctx, "");
2408 if (sidlist == NULL) {
2409 return NULL;
2410 }
2411 for (i=0; i<num_sids; i++) {
2412 fstring tmp;
2413 sidlist = talloc_asprintf_append_buffer(
2414 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2415 if (sidlist == NULL) {
2416 return NULL;
2417 }
2418 }
2419 return sidlist;
2420 }
2421
2422 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2423 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2424 const struct dom_sid *sids,
2425 uint32_t *pnum_aliases, uint32_t **paliases)
2426 {
2427 struct winbind_cache *cache = get_cache(domain);
2428 struct cache_entry *centry = NULL;
2429 uint32_t num_aliases;
2430 uint32_t *aliases;
2431 NTSTATUS status;
2432 char *sidlist;
2433 int i;
2434
2435 if (cache->tdb == NULL) {
2436 return NT_STATUS_NOT_FOUND;
2437 }
2438
2439 if (num_sids == 0) {
2440 *pnum_aliases = 0;
2441 *paliases = NULL;
2442 return NT_STATUS_OK;
2443 }
2444
2445 /* We need to cache indexed by the whole list of SIDs, the aliases
2446 * resulting might come from any of the SIDs. */
2447
2448 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2449 if (sidlist == NULL) {
2450 return NT_STATUS_NO_MEMORY;
2451 }
2452
2453 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2454 TALLOC_FREE(sidlist);
2455 if (centry == NULL) {
2456 return NT_STATUS_NOT_FOUND;
2457 }
2458
2459 num_aliases = centry_uint32(centry);
2460 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2461 if (aliases == NULL) {
2462 centry_free(centry);
2463 return NT_STATUS_NO_MEMORY;
2464 }
2465
2466 for (i=0; i<num_aliases; i++) {
2467 aliases[i] = centry_uint32(centry);
2468 }
2469
2470 status = centry->status;
2471
2472 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2473 "status %s\n", domain->name, nt_errstr(status)));
2474
2475 centry_free(centry);
2476
2477 *pnum_aliases = num_aliases;
2478 *paliases = aliases;
2479
2480 return status;
2481 }
2482
2483 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2484 TALLOC_CTX *mem_ctx,
2485 uint32 num_sids, const DOM_SID *sids,
2486 uint32 *num_aliases, uint32 **alias_rids)
2487 {
2488 struct cache_entry *centry = NULL;
2489 NTSTATUS status;
2490 char *sidlist;
2491 int i;
2492 bool old_status;
2493
2494 old_status = domain->online;
2495 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2496 num_aliases, alias_rids);
2497 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2498 return status;
2499 }
2500
2501 (*num_aliases) = 0;
2502 (*alias_rids) = NULL;
2503
2504 if (!NT_STATUS_IS_OK(domain->last_status))
2505 return domain->last_status;
2506
2507 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2508 "for domain %s\n", domain->name ));
2509
2510 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2511 if (sidlist == NULL) {
2512 return NT_STATUS_NO_MEMORY;
2513 }
2514
2515 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2516 num_sids, sids,
2517 num_aliases, alias_rids);
2518
2519 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2520 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2521 if (!domain->internal && old_status) {
2522 set_domain_offline(domain);
2523 }
2524 if (!domain->internal &&
2525 !domain->online &&
2526 old_status) {
2527 NTSTATUS cache_status;
2528 cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2529 sids, num_aliases, alias_rids);
2530 return cache_status;
2531 }
2532 }
2533 /* and save it */
2534 refresh_sequence_number(domain, false);
2535 if (!NT_STATUS_IS_OK(status)) {
2536 return status;
2537 }
2538 centry = centry_start(domain, status);
2539 if (!centry)
2540 goto skip_save;
2541 centry_put_uint32(centry, *num_aliases);
2542 for (i=0; i<(*num_aliases); i++)
2543 centry_put_uint32(centry, (*alias_rids)[i]);
2544 centry_end(centry, "UA%s", sidlist);
2545 centry_free(centry);
2546
2547 skip_save:
2548 return status;
2549 }
2550
2551 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2552 TALLOC_CTX *mem_ctx,
2553 const struct dom_sid *group_sid,
2554 uint32_t *num_names,
2555 struct dom_sid **sid_mem, char ***names,
2556 uint32_t **name_types)
2557 {
2558 struct winbind_cache *cache = get_cache(domain);
2559 struct cache_entry *centry = NULL;
2560 NTSTATUS status;
2561 unsigned int i;
2562 char *sid_string;
2563
2564 if (cache->tdb == NULL) {
2565 return NT_STATUS_NOT_FOUND;
2566 }
2567
2568 sid_string = sid_string_tos(group_sid);
2569 if (sid_string == NULL) {
2570 return NT_STATUS_NO_MEMORY;
2571 }
2572
2573 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2574 TALLOC_FREE(sid_string);
2575 if (centry == NULL) {
2576 return NT_STATUS_NOT_FOUND;
2577 }
2578
2579 *sid_mem = NULL;
2580 *names = NULL;
2581 *name_types = NULL;
2582
2583 *num_names = centry_uint32(centry);
2584 if (*num_names == 0) {
2585 centry_free(centry);
2586 return NT_STATUS_OK;
2587 }
2588
2589 *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2590 *names = talloc_array(mem_ctx, char *, *num_names);
2591 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2592
2593 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2594 TALLOC_FREE(*sid_mem);
2595 TALLOC_FREE(*names);
2596 TALLOC_FREE(*name_types);
2597 centry_free(centry);
2598 return NT_STATUS_NO_MEMORY;
2599 }
2600
2601 for (i=0; i<(*num_names); i++) {
2602 centry_sid(centry, &(*sid_mem)[i]);
2603 (*names)[i] = centry_string(centry, mem_ctx);
2604 (*name_types)[i] = centry_uint32(centry);
2605 }
2606
2607 status = centry->status;
2608
2609 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2610 "status: %s\n", domain->name, nt_errstr(status)));
2611
2612 centry_free(centry);
2613 return status;
2614 }
2615
2616 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2617 TALLOC_CTX *mem_ctx,
2618 const DOM_SID *group_sid,
2619 enum lsa_SidType type,
2620 uint32 *num_names,
2621 DOM_SID **sid_mem, char ***names,
2622 uint32 **name_types)
2623 {
2624 struct cache_entry *centry = NULL;
2625 NTSTATUS status;
2626 unsigned int i;
2627 fstring sid_string;
2628 bool old_status;
2629
2630 old_status = domain->online;
2631 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2632 sid_mem, names, name_types);
2633 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2634 return status;
2635 }
2636
2637 (*num_names) = 0;
2638 (*sid_mem) = NULL;
2639 (*names) = NULL;
2640 (*name_types) = NULL;
2641
2642 /* Return status value returned by seq number check */
2643
2644 if (!NT_STATUS_IS_OK(domain->last_status))
2645 return domain->last_status;
2646
2647 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2648 domain->name ));
2649
2650 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2651 type, num_names,
2652 sid_mem, names, name_types);
2653
2654 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2655 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2656 if (!domain->internal && old_status) {
2657 set_domain_offline(domain);
2658 }
2659 if (!domain->internal &&
2660 !domain->online &&
2661 old_status) {
2662 NTSTATUS cache_status;
2663 cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2664 num_names, sid_mem, names,
2665 name_types);
2666 return cache_status;
2667 }
2668 }
2669 /* and save it */
2670 refresh_sequence_number(domain, false);
2671 if (!NT_STATUS_IS_OK(status)) {
2672 return status;
2673 }
2674 centry = centry_start(domain, status);
2675 if (!centry)
2676 goto skip_save;
2677 centry_put_uint32(centry, *num_names);
2678 for (i=0; i<(*num_names); i++) {
2679 centry_put_sid(centry, &(*sid_mem)[i]);
2680 centry_put_string(centry, (*names)[i]);
2681 centry_put_uint32(centry, (*name_types)[i]);
2682 }
2683 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2684 centry_free(centry);
2685
2686 skip_save:
2687 return status;
2688 }
2689
2690 /* find the sequence number for a domain */
2691 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2692 {
2693 refresh_sequence_number(domain, false);
2694
2695 *seq = domain->sequence_number;
2696
2697 return NT_STATUS_OK;
2698 }
2699
2700 /* enumerate trusted domains
2701 * (we need to have the list of trustdoms in the cache when we go offline) -
2702 * Guenther */
2703 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2704 TALLOC_CTX *mem_ctx,
2705 struct netr_DomainTrustList *trusts)
2706 {
2707 NTSTATUS status;
2708 struct winbind_cache *cache;
2709 struct winbindd_tdc_domain *dom_list = NULL;
2710 size_t num_domains = 0;
2711 bool retval = false;
2712 int i;
2713 bool old_status;
2714
2715 old_status = domain->online;
2716 trusts->count = 0;
2717 trusts->array = NULL;
2718
2719 cache = get_cache(domain);
2720 if (!cache || !cache->tdb) {
2721 goto do_query;
2722 }
2723
2724 if (domain->online) {
2725 goto do_query;
2726 }
2727
2728 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2729 if (!retval || !num_domains || !dom_list) {
2730 TALLOC_FREE(dom_list);
2731 goto do_query;
2732 }
2733
2734 do_fetch_cache:
2735 trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
2736 if (!trusts->array) {
2737 TALLOC_FREE(dom_list);
2738 return NT_STATUS_NO_MEMORY;
2739 }
2740
2741 for (i = 0; i < num_domains; i++) {
2742 struct netr_DomainTrust *trust;
2743 struct dom_sid *sid;
2744 struct winbindd_domain *dom;
2745
2746 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2747 if (dom && dom->internal) {
2748 continue;
2749 }
2750
2751 trust = &trusts->array[trusts->count];
2752 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2753 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2754 sid = talloc(trusts->array, struct dom_sid);
2755 if (!trust->netbios_name || !trust->dns_name ||
2756 !sid) {
2757 TALLOC_FREE(dom_list);
2758 TALLOC_FREE(trusts->array);
2759 return NT_STATUS_NO_MEMORY;
2760 }
2761
2762 trust->trust_flags = dom_list[i].trust_flags;
2763 trust->trust_attributes = dom_list[i].trust_attribs;
2764 trust->trust_type = dom_list[i].trust_type;
2765 sid_copy(sid, &dom_list[i].sid);
2766 trust->sid = sid;
2767 trusts->count++;
2768 }
2769
2770 TALLOC_FREE(dom_list);
2771 return NT_STATUS_OK;
2772
2773 do_query:
2774 /* Return status value returned by seq number check */
2775
2776 if (!NT_STATUS_IS_OK(domain->last_status))
2777 return domain->last_status;
2778
2779 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2780 domain->name ));
2781
2782 status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2783
2784 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2785 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2786 if (!domain->internal && old_status) {
2787 set_domain_offline(domain);
2788 }
2789 if (!domain->internal &&
2790 !domain->online &&
2791 old_status) {
2792 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2793 if (retval && num_domains && dom_list) {
2794 TALLOC_FREE(trusts->array);
2795 trusts->count = 0;
2796 goto do_fetch_cache;
2797 }
2798 }
2799 }
2800 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2801 * so that the generic centry handling still applies correctly -
2802 * Guenther*/
2803
2804 if (!NT_STATUS_IS_ERR(status)) {
2805 status = NT_STATUS_OK;
2806 }
2807 return status;
2808 }
2809
2810 /* get lockout policy */
2811 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2812 TALLOC_CTX *mem_ctx,
2813 struct samr_DomInfo12 *policy)
2814 {
2815 struct winbind_cache *cache = get_cache(domain);
2816 struct cache_entry *centry = NULL;
2817 NTSTATUS status;
2818 bool old_status;
2819
2820 old_status = domain->online;
2821 if (!cache->tdb)
2822 goto do_query;
2823
2824 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2825
2826 if (!centry)
2827 goto do_query;
2828
2829 do_fetch_cache:
2830 policy->lockout_duration = centry_nttime(centry);
2831 policy->lockout_window = centry_nttime(centry);
2832 policy->lockout_threshold = centry_uint16(centry);
2833
2834 status = centry->status;
2835
2836 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2837 domain->name, nt_errstr(status) ));
2838
2839 centry_free(centry);
2840 return status;
2841
2842 do_query:
2843 ZERO_STRUCTP(policy);
2844
2845 /* Return status value returned by seq number check */
2846
2847 if (!NT_STATUS_IS_OK(domain->last_status))
2848 return domain->last_status;
2849
2850 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2851 domain->name ));
2852
2853 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2854
2855 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2856 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2857 if (!domain->internal && old_status) {
2858 set_domain_offline(domain);
2859 }
2860 if (cache->tdb &&
2861 !domain->internal &&
2862 !domain->online &&
2863 old_status) {
2864 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2865 if (centry) {
2866 goto do_fetch_cache;
2867 }
2868 }
2869 }
2870 /* and save it */
2871 refresh_sequence_number(domain, false);
2872 if (!NT_STATUS_IS_OK(status)) {
2873 return status;
2874 }
2875 wcache_save_lockout_policy(domain, status, policy);
2876
2877 return status;
2878 }
2879
2880 /* get password policy */
2881 static NTSTATUS password_policy(struct winbindd_domain *domain,
2882 TALLOC_CTX *mem_ctx,
2883 struct samr_DomInfo1 *policy)
2884 {
2885 struct winbind_cache *cache = get_cache(domain);
2886 struct cache_entry *centry = NULL;
2887 NTSTATUS status;
2888 bool old_status;
2889
2890 old_status = domain->online;
2891 if (!cache->tdb)
2892 goto do_query;
2893
2894 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2895
2896 if (!centry)
2897 goto do_query;
2898
2899 do_fetch_cache:
2900 policy->min_password_length = centry_uint16(centry);
2901 policy->password_history_length = centry_uint16(centry);
2902 policy->password_properties = centry_uint32(centry);
2903 policy->max_password_age = centry_nttime(centry);
2904 policy->min_password_age = centry_nttime(centry);
2905
2906 status = centry->status;
2907
2908 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2909 domain->name, nt_errstr(status) ));
2910
2911 centry_free(centry);
2912 return status;
2913
2914 do_query:
2915 ZERO_STRUCTP(policy);
2916
2917 /* Return status value returned by seq number check */
2918
2919 if (!NT_STATUS_IS_OK(domain->last_status))
2920 return domain->last_status;
2921
2922 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2923 domain->name ));
2924
2925 status = domain->backend->password_policy(domain, mem_ctx, policy);
2926
2927 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2928 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2929 if (!domain->internal && old_status) {
2930 set_domain_offline(domain);
2931 }
2932 if (cache->tdb &&
2933 !domain->internal &&
2934 !domain->online &&
2935 old_status) {
2936 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2937 if (centry) {
2938 goto do_fetch_cache;
2939 }
2940 }
2941 }
2942 /* and save it */
2943 refresh_sequence_number(domain, false);
2944 if (!NT_STATUS_IS_OK(status)) {
2945 return status;
2946 }
2947 wcache_save_password_policy(domain, status, policy);
2948
2949 return status;
2950 }
2951
2952
2953 /* Invalidate cached user and group lists coherently */
2954
2955 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2956 void *state)
2957 {
2958 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2959 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2960 tdb_delete(the_tdb, kbuf);
2961
2962 return 0;
2963 }
2964
2965 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2966
2967 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2968 struct netr_SamInfo3 *info3)
2969 {
2970 DOM_SID sid;
2971 fstring key_str, sid_string;
2972 struct winbind_cache *cache;
2973
2974 /* dont clear cached U/SID and UG/SID entries when we want to logon
2975 * offline - gd */
2976
2977 if (lp_winbind_offline_logon()) {
2978 return;
2979 }
2980
2981 if (!domain)
2982 return;
2983
2984 cache = get_cache(domain);
2985
2986 if (!cache->tdb) {
2987 return;
2988 }
2989
2990 sid_compose(&sid, info3->base.domain_sid, info3->base.rid);
2991
2992 /* Clear U/SID cache entry */
2993 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2994 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2995 tdb_delete(cache->tdb, string_tdb_data(key_str));
2996
2997 /* Clear UG/SID cache entry */
2998 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2999 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3000 tdb_delete(cache->tdb, string_tdb_data(key_str));
3001
3002 /* Samba/winbindd never needs this. */
3003 netsamlogon_clear_cached_user(info3);
3004 }
3005
3006 bool wcache_invalidate_cache(void)
3007 {
3008 struct winbindd_domain *domain;
3009
3010 for (domain = domain_list(); domain; domain = domain->next) {
3011 struct winbind_cache *cache = get_cache(domain);
3012
3013 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3014 "entries for %s\n", domain->name));
3015 if (cache) {
3016 if (cache->tdb) {
3017 tdb_traverse(cache->tdb, traverse_fn, NULL);
3018 } else {
3019 return false;
3020 }
3021 }
3022 }
3023 return true;
3024 }
3025
3026 bool init_wcache(void)
3027 {
3028 if (wcache == NULL) {
3029 wcache = SMB_XMALLOC_P(struct winbind_cache);
3030 ZERO_STRUCTP(wcache);
3031 }
3032
3033 if (wcache->tdb != NULL)
3034 return true;
3035
3036 /* when working offline we must not clear the cache on restart */
3037 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3038 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3039 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3040 O_RDWR|O_CREAT, 0600);
3041
3042 if (wcache->tdb == NULL) {
3043 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3044 return false;
3045 }
3046
3047 return true;
3048 }
3049
3050 /************************************************************************
3051 This is called by the parent to initialize the cache file.
3052 We don't need sophisticated locking here as we know we're the
3053 only opener.
3054 ************************************************************************/
3055
3056 bool initialize_winbindd_cache(void)
3057 {
3058 bool cache_bad = true;
3059 uint32 vers;
3060
3061 if (!init_wcache()) {
3062 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3063 return false;
3064 }
3065
3066 /* Check version number. */
3067 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3068 vers == WINBINDD_CACHE_VERSION) {
3069 cache_bad = false;
3070 }
3071
3072 if (cache_bad) {
3073 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3074 "and re-creating with version number %d\n",
3075 WINBINDD_CACHE_VERSION ));
3076
3077 tdb_close(wcache->tdb);
3078 wcache->tdb = NULL;
3079
3080 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
3081 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3082 cache_path("winbindd_cache.tdb"),
3083 strerror(errno) ));
3084 return false;
3085 }
3086 if (!init_wcache()) {
3087 DEBUG(0,("initialize_winbindd_cache: re-initialization "
3088 "init_wcache failed.\n"));
3089 return false;
3090 }
3091
3092 /* Write the version. */
3093 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3094 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3095 tdb_errorstr(wcache->tdb) ));
3096 return false;
3097 }
3098 }
3099
3100 tdb_close(wcache->tdb);
3101 wcache->tdb = NULL;
3102 return true;
3103 }
3104
3105 void close_winbindd_cache(void)
3106 {
3107 if (!wcache) {
3108 return;
3109 }
3110 if (wcache->tdb) {
3111 tdb_close(wcache->tdb);
3112 wcache->tdb = NULL;
3113 }
3114 }
3115
3116 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
3117 char **domain_name, char **name,
3118 enum lsa_SidType *type)
3119 {
3120 struct winbindd_domain *domain;
3121 NTSTATUS status;
3122
3123 domain = find_lookup_domain_from_sid(sid);
3124 if (domain == NULL) {
3125 return false;
3126 }
3127 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3128 type);
3129 return NT_STATUS_IS_OK(status);
3130 }
3131
3132 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
3133 const char *domain_name,
3134 const char *name,
3135 DOM_SID *sid,
3136 enum lsa_SidType *type)
3137 {
3138 struct winbindd_domain *domain;
3139 NTSTATUS status;
3140 bool original_online_state;
3141
3142 domain = find_lookup_domain_from_name(domain_name);
3143 if (domain == NULL) {
3144 return false;
3145 }
3146
3147 /* If we are doing a cached logon, temporarily set the domain
3148 offline so the cache won't expire the entry */
3149
3150 original_online_state = domain->online;
3151 domain->online = false;
3152 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3153 domain->online = original_online_state;
3154
3155 return NT_STATUS_IS_OK(status);
3156 }
3157
3158 void cache_name2sid(struct winbindd_domain *domain,
3159 const char *domain_name, const char *name,
3160 enum lsa_SidType type, const DOM_SID *sid)
3161 {
3162 refresh_sequence_number(domain, false);
3163 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3164 sid, type);
3165 }
3166
3167 /*
3168 * The original idea that this cache only contains centries has
3169 * been blurred - now other stuff gets put in here. Ensure we
3170 * ignore these things on cleanup.
3171 */
3172
3173 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3174 TDB_DATA dbuf, void *state)
3175 {
3176 struct cache_entry *centry;
3177
3178 if (is_non_centry_key(kbuf)) {
3179 return 0;
3180 }
3181
3182 centry = wcache_fetch_raw((char *)kbuf.dptr);
3183 if (!centry) {
3184 return 0;
3185 }
3186
3187 if (!NT_STATUS_IS_OK(centry->status)) {
3188 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3189 tdb_delete(the_tdb, kbuf);
3190 }
3191
3192 centry_free(centry);
3193 return 0;
3194 }
3195
3196 /* flush the cache */
3197 void wcache_flush_cache(void)
3198 {
3199 if (!wcache)
3200 return;
3201 if (wcache->tdb) {
3202 tdb_close(wcache->tdb);
3203 wcache->tdb = NULL;
3204 }
3205 if (!winbindd_use_cache()) {
3206 return;
3207 }
3208
3209 /* when working offline we must not clear the cache on restart */
3210 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3211 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3212 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3213 O_RDWR|O_CREAT, 0600);
3214
3215 if (!wcache->tdb) {
3216 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3217 return;
3218 }
3219
3220 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3221
3222 DEBUG(10,("wcache_flush_cache success\n"));
3223 }
3224
3225 /* Count cached creds */
3226
3227 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3228 void *state)
3229 {
3230 int *cred_count = (int*)state;
3231
3232 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3233 (*cred_count)++;
3234 }
3235 return 0;
3236 }
3237
3238 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3239 {
3240 struct winbind_cache *cache = get_cache(domain);
3241
3242 *count = 0;
3243
3244 if (!cache->tdb) {
3245 return NT_STATUS_INTERNAL_DB_ERROR;
3246 }
3247
3248 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3249
3250 return NT_STATUS_OK;
3251 }
3252
3253 struct cred_list {
3254 struct cred_list *prev, *next;
3255 TDB_DATA key;
3256 fstring name;
3257 time_t created;
3258 };
3259 static struct cred_list *wcache_cred_list;
3260
3261 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3262 void *state)
3263 {
3264 struct cred_list *cred;
3265
3266 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3267
3268 cred = SMB_MALLOC_P(struct cred_list);
3269 if (cred == NULL) {
3270 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3271 return -1;
3272 }
3273
3274 ZERO_STRUCTP(cred);
3275
3276 /* save a copy of the key */
3277
3278 fstrcpy(cred->name, (const char *)kbuf.dptr);
3279 DLIST_ADD(wcache_cred_list, cred);
3280 }
3281
3282 return 0;
3283 }
3284
3285 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
3286 {
3287 struct winbind_cache *cache = get_cache(domain);
3288 NTSTATUS status;
3289 int ret;
3290 struct cred_list *cred, *oldest = NULL;
3291
3292 if (!cache->tdb) {
3293 return NT_STATUS_INTERNAL_DB_ERROR;
3294 }
3295
3296 /* we possibly already have an entry */
3297 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3298
3299 fstring key_str, tmp;
3300
3301 DEBUG(11,("we already have an entry, deleting that\n"));
3302
3303 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3304
3305 tdb_delete(cache->tdb, string_tdb_data(key_str));
3306
3307 return NT_STATUS_OK;
3308 }
3309
3310 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3311 if (ret == 0) {
3312 return NT_STATUS_OK;
3313 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3314 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3315 }
3316
3317 ZERO_STRUCTP(oldest);
3318
3319 for (cred = wcache_cred_list; cred; cred = cred->next) {
3320
3321 TDB_DATA data;
3322 time_t t;
3323
3324 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3325 if (!data.dptr) {
3326 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3327 cred->name));
3328 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3329 goto done;
3330 }
3331
3332 t = IVAL(data.dptr, 0);
3333 SAFE_FREE(data.dptr);
3334
3335 if (!oldest) {
3336 oldest = SMB_MALLOC_P(struct cred_list);
3337 if (oldest == NULL) {
3338 status = NT_STATUS_NO_MEMORY;
3339 goto done;
3340 }
3341
3342 fstrcpy(oldest->name, cred->name);
3343 oldest->created = t;
3344 continue;
3345 }
3346
3347 if (t < oldest->created) {
3348 fstrcpy(oldest->name, cred->name);
3349 oldest->created = t;
3350 }
3351 }
3352
3353 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3354 status = NT_STATUS_OK;
3355 } else {
3356 status = NT_STATUS_UNSUCCESSFUL;
3357 }
3358 done:
3359 SAFE_FREE(wcache_cred_list);
3360 SAFE_FREE(oldest);
3361
3362 return status;
3363 }
3364
3365 /* Change the global online/offline state. */
3366 bool set_global_winbindd_state_offline(void)
3367 {
3368 TDB_DATA data;
3369
3370 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3371
3372 /* Only go offline if someone has created
3373 the key "WINBINDD_OFFLINE" in the cache tdb. */
3374
3375 if (wcache == NULL || wcache->tdb == NULL) {
3376 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3377 return false;
3378 }
3379
3380 if (!lp_winbind_offline_logon()) {
3381 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3382 return false;
3383 }
3384
3385 if (global_winbindd_offline_state) {
3386 /* Already offline. */
3387 return true;
3388 }
3389
3390 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3391
3392 if (!data.dptr || data.dsize != 4) {
3393 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3394 SAFE_FREE(data.dptr);
3395 return false;
3396 } else {
3397 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3398 global_winbindd_offline_state = true;
3399 SAFE_FREE(data.dptr);
3400 return true;
3401 }
3402 }
3403
3404 void set_global_winbindd_state_online(void)
3405 {
3406 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3407
3408 if (!lp_winbind_offline_logon()) {
3409 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3410 return;
3411 }
3412
3413 if (!global_winbindd_offline_state) {
3414 /* Already online. */
3415 return;
3416 }
3417 global_winbindd_offline_state = false;
3418
3419 if (!wcache->tdb) {
3420 return;
3421 }
3422
3423 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3424 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3425 }
3426
3427 bool get_global_winbindd_state_offline(void)
3428 {
3429 return global_winbindd_offline_state;
3430 }
3431
3432 /***********************************************************************
3433 Validate functions for all possible cache tdb keys.
3434 ***********************************************************************/
3435
3436 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3437 struct tdb_validation_status *state)
3438 {
3439 struct cache_entry *centry;
3440
3441 centry = SMB_XMALLOC_P(struct cache_entry);
3442 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3443 if (!centry->data) {
3444 SAFE_FREE(centry);
3445 return NULL;
3446 }
3447 centry->len = data.dsize;
3448 centry->ofs = 0;
3449
3450 if (centry->len < 8) {
3451 /* huh? corrupt cache? */
3452 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3453 centry_free(centry);
3454 state->bad_entry = true;
3455 state->success = false;
3456 return NULL;
3457 }
3458
3459 centry->status = NT_STATUS(centry_uint32(centry));
3460 centry->sequence_number = centry_uint32(centry);
3461 return centry;
3462 }
3463
3464 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3465 struct tdb_validation_status *state)
3466 {
3467 if (dbuf.dsize != 8) {
3468 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3469 keystr, (unsigned int)dbuf.dsize ));
3470 state->bad_entry = true;
3471 return 1;
3472 }
3473 return 0;
3474 }
3475
3476 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3477 struct tdb_validation_status *state)
3478 {
3479 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3480 if (!centry) {
3481 return 1;
3482 }
3483
3484 (void)centry_uint32(centry);
3485 if (NT_STATUS_IS_OK(centry->status)) {
3486 DOM_SID sid;
3487 (void)centry_sid(centry, &sid);
3488 }
3489
3490 centry_free(centry);
3491
3492 if (!(state->success)) {
3493 return 1;
3494 }
3495 DEBUG(10,("validate_ns: %s ok\n", keystr));
3496 return 0;
3497 }
3498
3499 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3500 struct tdb_validation_status *state)
3501 {
3502 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3503 if (!centry) {
3504 return 1;
3505 }
3506
3507 if (NT_STATUS_IS_OK(centry->status)) {
3508 (void)centry_uint32(centry);
3509 (void)centry_string(centry, mem_ctx);
3510 (void)centry_string(centry, mem_ctx);
3511 }
3512
3513 centry_free(centry);
3514
3515 if (!(state->success)) {
3516 return 1;
3517 }
3518 DEBUG(10,("validate_sn: %s ok\n", keystr));
3519 return 0;
3520 }
3521
3522 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3523 struct tdb_validation_status *state)
3524 {
3525 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3526 DOM_SID sid;
3527
3528 if (!centry) {
3529 return 1;
3530 }
3531
3532 (void)centry_string(centry, mem_ctx);
3533 (void)centry_string(centry, mem_ctx);
3534 (void)centry_string(centry, mem_ctx);
3535 (void)centry_string(centry, mem_ctx);
3536 (void)centry_uint32(centry);
3537 (void)centry_sid(centry, &sid);
3538 (void)centry_sid(centry, &sid);
3539
3540 centry_free(centry);
3541
3542 if (!(state->success)) {
3543 return 1;
3544 }
3545 DEBUG(10,("validate_u: %s ok\n", keystr));
3546 return 0;
3547 }
3548
3549 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3550 struct tdb_validation_status *state)
3551 {
3552 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3553
3554 if (!centry) {
3555 return 1;
3556 }
3557
3558 (void)centry_nttime(centry);
3559 (void)centry_nttime(centry);
3560 (void)centry_uint16(centry);
3561
3562 centry_free(centry);
3563
3564 if (!(state->success)) {
3565 return 1;
3566 }
3567 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3568 return 0;
3569 }
3570
3571 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3572 struct tdb_validation_status *state)
3573 {
3574 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3575
3576 if (!centry) {
3577 return 1;
3578 }
3579
3580 (void)centry_uint16(centry);
3581 (void)centry_uint16(centry);
3582 (void)centry_uint32(centry);
3583 (void)centry_nttime(centry);
3584 (void)centry_nttime(centry);
3585
3586 centry_free(centry);
3587
3588 if (!(state->success)) {
3589 return 1;
3590 }
3591 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3592 return 0;
3593 }
3594
3595 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3596 struct tdb_validation_status *state)
3597 {
3598 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3599
3600 if (!centry) {
3601 return 1;
3602 }
3603
3604 (void)centry_time(centry);
3605 (void)centry_hash16(centry, mem_ctx);
3606
3607 /* We only have 17 bytes more data in the salted cred case. */
3608 if (centry->len - centry->ofs == 17) {
3609 (void)centry_hash16(centry, mem_ctx);
3610 }
3611
3612 centry_free(centry);
3613
3614 if (!(state->success)) {
3615 return 1;
3616 }
3617 DEBUG(10,("validate_cred: %s ok\n", keystr));
3618 return 0;
3619 }
3620
3621 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3622 struct tdb_validation_status *state)
3623 {
3624 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3625 int32 num_entries, i;
3626
3627 if (!centry) {
3628 return 1;
3629 }
3630
3631 num_entries = (int32)centry_uint32(centry);
3632
3633 for (i=0; i< num_entries; i++) {
3634 DOM_SID sid;
3635 (void)centry_string(centry, mem_ctx);
3636 (void)centry_string(centry, mem_ctx);
3637 (void)centry_string(centry, mem_ctx);
3638 (void)centry_string(centry, mem_ctx);
3639 (void)centry_sid(centry, &sid);
3640 (void)centry_sid(centry, &sid);
3641 }
3642
3643 centry_free(centry);
3644
3645 if (!(state->success)) {
3646 return 1;
3647 }
3648 DEBUG(10,("validate_ul: %s ok\n", keystr));
3649 return 0;
3650 }
3651
3652 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3653 struct tdb_validation_status *state)
3654 {
3655 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3656 int32 num_entries, i;
3657
3658 if (!centry) {
3659 return 1;
3660 }
3661
3662 num_entries = centry_uint32(centry);
3663
3664 for (i=0; i< num_entries; i++) {
3665 (void)centry_string(centry, mem_ctx);
3666 (void)centry_string(centry, mem_ctx);
3667 (void)centry_uint32(centry);
3668 }
3669
3670 centry_free(centry);
3671
3672 if (!(state->success)) {
3673 return 1;
3674 }
3675 DEBUG(10,("validate_gl: %s ok\n", keystr));
3676 return 0;
3677 }
3678
3679 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3680 struct tdb_validation_status *state)
3681 {
3682 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3683 int32 num_groups, i;
3684
3685 if (!centry) {
3686 return 1;
3687 }
3688
3689 num_groups = centry_uint32(centry);
3690
3691 for (i=0; i< num_groups; i++) {
3692 DOM_SID sid;
3693 centry_sid(centry, &sid);
3694 }
3695
3696 centry_free(centry);
3697
3698 if (!(state->success)) {
3699 return 1;
3700 }
3701 DEBUG(10,("validate_ug: %s ok\n", keystr));
3702 return 0;
3703 }
3704
3705 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3706 struct tdb_validation_status *state)
3707 {
3708 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3709 int32 num_aliases, i;
3710
3711 if (!centry) {
3712 return 1;
3713 }
3714
3715 num_aliases = centry_uint32(centry);
3716
3717 for (i=0; i < num_aliases; i++) {
3718 (void)centry_uint32(centry);
3719 }
3720
3721 centry_free(centry);
3722
3723 if (!(state->success)) {
3724 return 1;
3725 }
3726 DEBUG(10,("validate_ua: %s ok\n", keystr));
3727 return 0;
3728 }
3729
3730 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3731 struct tdb_validation_status *state)
3732 {
3733 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3734 int32 num_names, i;
3735
3736 if (!centry) {
3737 return 1;
3738 }
3739
3740 num_names = centry_uint32(centry);
3741
3742 for (i=0; i< num_names; i++) {
3743 DOM_SID sid;
3744 centry_sid(centry, &sid);
3745 (void)centry_string(centry, mem_ctx);
3746 (void)centry_uint32(centry);
3747 }
3748
3749 centry_free(centry);
3750
3751 if (!(state->success)) {
3752 return 1;
3753 }
3754 DEBUG(10,("validate_gm: %s ok\n", keystr));
3755 return 0;
3756 }
3757
3758 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3759 struct tdb_validation_status *state)
3760 {
3761 /* Can't say anything about this other than must be nonzero. */
3762 if (dbuf.dsize == 0) {
3763 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3764 keystr));
3765 state->bad_entry = true;
3766 state->success = false;
3767 return 1;
3768 }
3769
3770 DEBUG(10,("validate_dr: %s ok\n", keystr));
3771 return 0;
3772 }
3773
3774 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3775 struct tdb_validation_status *state)
3776 {
3777 /* Can't say anything about this other than must be nonzero. */
3778 if (dbuf.dsize == 0) {
3779 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3780 keystr));
3781 state->bad_entry = true;
3782 state->success = false;
3783 return 1;
3784 }
3785
3786 DEBUG(10,("validate_de: %s ok\n", keystr));
3787 return 0;
3788 }
3789
3790 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3791 TDB_DATA dbuf, struct tdb_validation_status *state)
3792 {
3793 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3794
3795 if (!centry) {
3796 return 1;
3797 }
3798
3799 (void)centry_string(centry, mem_ctx);
3800 (void)centry_string(centry, mem_ctx);
3801 (void)centry_string(centry, mem_ctx);
3802 (void)centry_uint32(centry);
3803
3804 centry_free(centry);
3805
3806 if (!(state->success)) {
3807 return 1;
3808 }
3809 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3810 return 0;
3811 }
3812
3813 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3814 TDB_DATA dbuf,
3815 struct tdb_validation_status *state)
3816 {
3817 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3818
3819 if (!centry) {
3820 return 1;
3821 }
3822
3823 (void)centry_string( centry, mem_ctx );
3824
3825 centry_free(centry);
3826
3827 if (!(state->success)) {
3828 return 1;
3829 }
3830 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3831 return 0;
3832 }
3833
3834 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3835 TDB_DATA dbuf,
3836 struct tdb_validation_status *state)
3837 {
3838 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3839
3840 if (!centry) {
3841 return 1;
3842 }
3843
3844 (void)centry_string( centry, mem_ctx );
3845
3846 centry_free(centry);
3847
3848 if (!(state->success)) {
3849 return 1;
3850 }
3851 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3852 return 0;
3853 }
3854
3855 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3856 TDB_DATA dbuf,
3857 struct tdb_validation_status *state)
3858 {
3859 if (dbuf.dsize == 0) {
3860 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3861 "key %s (len ==0) ?\n", keystr));
3862 state->bad_entry = true;
3863 state->success = false;
3864 return 1;
3865 }
3866
3867 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3868 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3869 return 0;
3870 }
3871
3872 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3873 struct tdb_validation_status *state)
3874 {
3875 if (dbuf.dsize != 4) {
3876 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3877 keystr, (unsigned int)dbuf.dsize ));
3878 state->bad_entry = true;
3879 state->success = false;
3880 return 1;
3881 }
3882 DEBUG(10,("validate_offline: %s ok\n", keystr));
3883 return 0;
3884 }
3885
3886 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3887 struct tdb_validation_status *state)
3888 {
3889 /*
3890 * Ignore validation for now. The proper way to do this is with a
3891 * checksum. Just pure parsing does not really catch much.
3892 */
3893 return 0;
3894 }
3895
3896 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3897 struct tdb_validation_status *state)
3898 {
3899 if (dbuf.dsize != 4) {
3900 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3901 "key %s (len %u != 4) ?\n",
3902 keystr, (unsigned int)dbuf.dsize));
3903 state->bad_entry = true;
3904 state->success = false;
3905 return 1;
3906 }
3907
3908 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3909 return 0;
3910 }
3911
3912 /***********************************************************************
3913 A list of all possible cache tdb keys with associated validation
3914 functions.
3915 ***********************************************************************/
3916
3917 struct key_val_struct {
3918 const char *keyname;
3919 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3920 } key_val[] = {
3921 {"SEQNUM/", validate_seqnum},
3922 {"NS/", validate_ns},
3923 {"SN/", validate_sn},
3924 {"U/", validate_u},
3925 {"LOC_POL/", validate_loc_pol},
3926 {"PWD_POL/", validate_pwd_pol},
3927 {"CRED/", validate_cred},
3928 {"UL/", validate_ul},
3929 {"GL/", validate_gl},
3930 {"UG/", validate_ug},
3931 {"UA", validate_ua},
3932 {"GM/", validate_gm},
3933 {"DR/", validate_dr},
3934 {"DE/", validate_de},
3935 {"NSS/PWINFO/", validate_pwinfo},
3936 {"TRUSTDOMCACHE/", validate_trustdomcache},
3937 {"NSS/NA/", validate_nss_na},
3938 {"NSS/AN/", validate_nss_an},
3939 {"WINBINDD_OFFLINE", validate_offline},
3940 {"NDR/", validate_ndr},
3941 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3942 {NULL, NULL}
3943 };
3944
3945 /***********************************************************************
3946 Function to look at every entry in the tdb and validate it as far as
3947 possible.
3948 ***********************************************************************/
3949
3950 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3951 {
3952 int i;
3953 unsigned int max_key_len = 1024;
3954 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3955
3956 /* Paranoia check. */
3957 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3958 max_key_len = 1024 * 1024;
3959 }
3960 if (kbuf.dsize > max_key_len) {
3961 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3962 "(%u) > (%u)\n\n",
3963 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3964 return 1;
3965 }
3966
3967 for (i = 0; key_val[i].keyname; i++) {
3968 size_t namelen = strlen(key_val[i].keyname);
3969 if (kbuf.dsize >= namelen && (
3970 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3971 TALLOC_CTX *mem_ctx;
3972 char *keystr;
3973 int ret;
3974
3975 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3976 if (!keystr) {
3977 return 1;
3978 }
3979 memcpy(keystr, kbuf.dptr, kbuf.dsize);
3980 keystr[kbuf.dsize] = '\0';
3981
3982 mem_ctx = talloc_init("validate_ctx");
3983 if (!mem_ctx) {
3984 SAFE_FREE(keystr);
3985 return 1;
3986 }
3987
3988 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3989 v_state);
3990
3991 SAFE_FREE(keystr);
3992 talloc_destroy(mem_ctx);
3993 return ret;
3994 }
3995 }
3996
3997 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3998 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3999 DEBUG(0,("data :\n"));
4000 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4001 v_state->unknown_key = true;
4002 v_state->success = false;
4003 return 1; /* terminate. */
4004 }
4005
4006 static void validate_panic(const char *const why)
4007 {
4008 DEBUG(0,("validating cache: would panic %s\n", why ));
4009 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4010 exit(47);
4011 }
4012
4013 /***********************************************************************
4014 Try and validate every entry in the winbindd cache. If we fail here,
4015 delete the cache tdb and return non-zero.
4016 ***********************************************************************/
4017
4018 int winbindd_validate_cache(void)
4019 {
4020 int ret = -1;
4021 const char *tdb_path = cache_path("winbindd_cache.tdb");
4022 TDB_CONTEXT *tdb = NULL;
4023
4024 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4025 smb_panic_fn = validate_panic;
4026
4027
4028 tdb = tdb_open_log(tdb_path,
4029 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4030 ( lp_winbind_offline_logon()
4031 ? TDB_DEFAULT
4032 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4033 O_RDWR|O_CREAT,
4034 0600);
4035 if (!tdb) {
4036 DEBUG(0, ("winbindd_validate_cache: "
4037 "error opening/initializing tdb\n"));
4038 goto done;
4039 }
4040 tdb_close(tdb);
4041
4042 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4043
4044 if (ret != 0) {
4045 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4046 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4047 unlink(tdb_path);
4048 }
4049
4050 done:
4051 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4052 smb_panic_fn = smb_panic;
4053 return ret;
4054 }
4055
4056 /***********************************************************************
4057 Try and validate every entry in the winbindd cache.
4058 ***********************************************************************/
4059
4060 int winbindd_validate_cache_nobackup(void)
4061 {
4062 int ret = -1;
4063 const char *tdb_path = cache_path("winbindd_cache.tdb");
4064
4065 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4066 smb_panic_fn = validate_panic;
4067
4068
4069 if (wcache == NULL || wcache->tdb == NULL) {
4070 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4071 } else {
4072 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4073 }
4074
4075 if (ret != 0) {
4076 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4077 "successful.\n"));
4078 }
4079
4080 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4081 "function\n"));
4082 smb_panic_fn = smb_panic;
4083 return ret;
4084 }
4085
4086 bool winbindd_cache_validate_and_initialize(void)
4087 {
4088 close_winbindd_cache();
4089
4090 if (lp_winbind_offline_logon()) {
4091 if (winbindd_validate_cache() < 0) {
4092 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4093 "could be restored.\n"));
4094 }
4095 }
4096
4097 return initialize_winbindd_cache();
4098 }
4099
4100 /*********************************************************************
4101 ********************************************************************/
4102
4103 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4104 struct winbindd_tdc_domain **domains,
4105 size_t *num_domains )
4106 {
4107 struct winbindd_tdc_domain *list = NULL;
4108 size_t idx;
4109 int i;
4110 bool set_only = false;
4111
4112 /* don't allow duplicates */
4113
4114 idx = *num_domains;
4115 list = *domains;
4116
4117 for ( i=0; i< (*num_domains); i++ ) {
4118 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4119 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4120 new_dom->name));
4121 idx = i;
4122 set_only = true;
4123
4124 break;
4125 }
4126 }
4127
4128 if ( !set_only ) {
4129 if ( !*domains ) {
4130 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
4131 idx = 0;
4132 } else {
4133 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
4134 struct winbindd_tdc_domain,
4135 (*num_domains)+1);
4136 idx = *num_domains;
4137 }
4138
4139 ZERO_STRUCT( list[idx] );
4140 }
4141
4142 if ( !list )
4143 return false;
4144
4145 list[idx].domain_name = talloc_strdup( list, new_dom->name );
4146 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4147
4148 if ( !is_null_sid( &new_dom->sid ) ) {
4149 sid_copy( &list[idx].sid, &new_dom->sid );
4150 } else {
4151 sid_copy(&list[idx].sid, &global_sid_NULL);
4152 }
4153
4154 if ( new_dom->domain_flags != 0x0 )
4155 list[idx].trust_flags = new_dom->domain_flags;
4156
4157 if ( new_dom->domain_type != 0x0 )
4158 list[idx].trust_type = new_dom->domain_type;
4159
4160 if ( new_dom->domain_trust_attribs != 0x0 )
4161 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4162
4163 if ( !set_only ) {
4164 *domains = list;
4165 *num_domains = idx + 1;
4166 }
4167
4168 return true;
4169 }
4170
4171 /*********************************************************************
4172 ********************************************************************/
4173
4174 static TDB_DATA make_tdc_key( const char *domain_name )
4175 {
4176 char *keystr = NULL;
4177 TDB_DATA key = { NULL, 0 };
4178
4179 if ( !domain_name ) {
4180 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4181 return key;
4182 }
4183
4184 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4185 return key;
4186 }
4187 key = string_term_tdb_data(keystr);
4188
4189 return key;
4190 }
4191
4192 /*********************************************************************
4193 ********************************************************************/
4194
4195 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4196 size_t num_domains,
4197 unsigned char **buf )
4198 {
4199 unsigned char *buffer = NULL;
4200 int len = 0;
4201 int buflen = 0;
4202 int i = 0;
4203
4204 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4205 (int)num_domains));
4206
4207 buflen = 0;
4208
4209 again:
4210 len = 0;
4211
4212 /* Store the number of array items first */
4213 len += tdb_pack( buffer+len, buflen-len, "d",
4214 num_domains );
4215
4216 /* now pack each domain trust record */
4217 for ( i=0; i<num_domains; i++ ) {
4218
4219 fstring tmp;
4220
4221 if ( buflen > 0 ) {
4222 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4223 domains[i].domain_name,
4224 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4225 }
4226
4227 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4228 domains[i].domain_name,
4229 domains[i].dns_name,
4230 sid_to_fstring(tmp, &domains[i].sid),
4231 domains[i].trust_flags,
4232 domains[i].trust_attribs,
4233 domains[i].trust_type );
4234 }
4235
4236 if ( buflen < len ) {
4237 SAFE_FREE(buffer);
4238 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4239 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4240 buflen = -1;
4241 goto done;
4242 }
4243 buflen = len;
4244 goto again;
4245 }
4246
4247 *buf = buffer;
4248
4249 done:
4250 return buflen;
4251 }
4252
4253 /*********************************************************************
4254 ********************************************************************/
4255
4256 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4257 struct winbindd_tdc_domain **domains )
4258 {
4259 fstring domain_name, dns_name, sid_string;
4260 uint32 type, attribs, flags;
4261 int num_domains;
4262 int len = 0;
4263 int i;
4264 struct winbindd_tdc_domain *list = NULL;
4265
4266 /* get the number of domains */
4267 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4268 if ( len == -1 ) {
4269 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4270 return 0;
4271 }
4272
4273 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4274 if ( !list ) {
4275 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4276 return 0;
4277 }
4278
4279 for ( i=0; i<num_domains; i++ ) {
4280 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4281 domain_name,
4282 dns_name,
4283 sid_string,
4284 &flags,
4285 &attribs,
4286 &type );
4287
4288 if ( len == -1 ) {
4289 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4290 TALLOC_FREE( list );
4291 return 0;
4292 }
4293
4294 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4295 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4296 domain_name, dns_name, sid_string,
4297 flags, attribs, type));
4298
4299 list[i].domain_name = talloc_strdup( list, domain_name );
4300 list[i].dns_name = talloc_strdup( list, dns_name );
4301 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4302 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4303 domain_name));
4304 }
4305 list[i].trust_flags = flags;
4306 list[i].trust_attribs = attribs;
4307 list[i].trust_type = type;
4308 }
4309
4310 *domains = list;
4311
4312 return num_domains;
4313 }
4314
4315 /*********************************************************************
4316 ********************************************************************/
4317
4318 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4319 {
4320 TDB_DATA key = make_tdc_key( lp_workgroup() );
4321 TDB_DATA data = { NULL, 0 };
4322 int ret;
4323
4324 if ( !key.dptr )
4325 return false;
4326
4327 /* See if we were asked to delete the cache entry */
4328
4329 if ( !domains ) {
4330 ret = tdb_delete( wcache->tdb, key );
4331 goto done;
4332 }
4333
4334 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4335
4336 if ( !data.dptr ) {
4337 ret = -1;
4338 goto done;
4339 }
4340
4341 ret = tdb_store( wcache->tdb, key, data, 0 );
4342
4343 done:
4344 SAFE_FREE( data.dptr );
4345 SAFE_FREE( key.dptr );
4346
4347 return ( ret != -1 );
4348 }
4349
4350 /*********************************************************************
4351 ********************************************************************/
4352
4353 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4354 {
4355 TDB_DATA key = make_tdc_key( lp_workgroup() );
4356 TDB_DATA data = { NULL, 0 };
4357
4358 *domains = NULL;
4359 *num_domains = 0;
4360
4361 if ( !key.dptr )
4362 return false;
4363
4364 data = tdb_fetch( wcache->tdb, key );
4365
4366 SAFE_FREE( key.dptr );
4367
4368 if ( !data.dptr )
4369 return false;
4370
4371 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4372
4373 SAFE_FREE( data.dptr );
4374
4375 if ( !*domains )
4376 return false;
4377
4378 return true;
4379 }
4380
4381 /*********************************************************************
4382 ********************************************************************/
4383
4384 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4385 {
4386 struct winbindd_tdc_domain *dom_list = NULL;
4387 size_t num_domains = 0;
4388 bool ret = false;
4389
4390 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4391 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4392 domain->name, domain->alt_name,
4393 sid_string_dbg(&domain->sid),
4394 domain->domain_flags,
4395 domain->domain_trust_attribs,
4396 domain->domain_type));
4397
4398 if ( !init_wcache() ) {
4399 return false;
4400 }
4401
4402 /* fetch the list */
4403
4404 wcache_tdc_fetch_list( &dom_list, &num_domains );
4405
4406 /* add the new domain */
4407
4408 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4409 goto done;
4410 }
4411
4412 /* pack the domain */
4413
4414 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4415 goto done;
4416 }
4417
4418 /* Success */
4419
4420 ret = true;
4421 done:
4422 TALLOC_FREE( dom_list );
4423
4424 return ret;
4425 }
4426
4427 /*********************************************************************
4428 ********************************************************************/
4429
4430 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4431 {
4432 struct winbindd_tdc_domain *dom_list = NULL;
4433 size_t num_domains = 0;
4434 int i;
4435 struct winbindd_tdc_domain *d = NULL;
4436
4437 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4438
4439 if ( !init_wcache() ) {
4440 return false;
4441 }
4442
4443 /* fetch the list */
4444
4445 wcache_tdc_fetch_list( &dom_list, &num_domains );
4446
4447 for ( i=0; i<num_domains; i++ ) {
4448 if ( strequal(name, dom_list[i].domain_name) ||
4449 strequal(name, dom_list[i].dns_name) )
4450 {
4451 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4452 name));
4453
4454 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4455 if ( !d )
4456 break;
4457
4458 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4459 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4460 sid_copy( &d->sid, &dom_list[i].sid );
4461 d->trust_flags = dom_list[i].trust_flags;
4462 d->trust_type = dom_list[i].trust_type;
4463 d->trust_attribs = dom_list[i].trust_attribs;
4464
4465 break;
4466 }
4467 }
4468
4469 TALLOC_FREE( dom_list );
4470
4471 return d;
4472 }
4473
4474
4475 /*********************************************************************
4476 ********************************************************************/
4477
4478 void wcache_tdc_clear( void )
4479 {
4480 if ( !init_wcache() )
4481 return;
4482
4483 wcache_tdc_store_list( NULL, 0 );
4484
4485 return;
4486 }
4487
4488
4489 /*********************************************************************
4490 ********************************************************************/
4491
4492 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4493 NTSTATUS status,
4494 const DOM_SID *user_sid,
4495 const char *homedir,
4496 const char *shell,
4497 const char *gecos,
4498 uint32 gid)
4499 {
4500 struct cache_entry *centry;
4501 fstring tmp;
4502
4503 if ( (centry = centry_start(domain, status)) == NULL )
4504 return;
4505
4506 centry_put_string( centry, homedir );
4507 centry_put_string( centry, shell );
4508 centry_put_string( centry, gecos );
4509 centry_put_uint32( centry, gid );
4510
4511 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4512
4513 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4514
4515 centry_free(centry);
4516 }
4517
4518 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4519 const DOM_SID *user_sid,
4520 TALLOC_CTX *ctx,
4521 ADS_STRUCT *ads, LDAPMessage *msg,
4522 const char **homedir, const char **shell,
4523 const char **gecos, gid_t *p_gid)
4524 {
4525 struct winbind_cache *cache = get_cache(domain);
4526 struct cache_entry *centry = NULL;
4527 NTSTATUS nt_status;
4528 fstring tmp;
4529
4530 if (!cache->tdb)
4531 goto do_query;
4532
4533 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4534 sid_to_fstring(tmp, user_sid));
4535
4536 if (!centry)
4537 goto do_query;
4538
4539 *homedir = centry_string( centry, ctx );
4540 *shell = centry_string( centry, ctx );
4541 *gecos = centry_string( centry, ctx );
4542 *p_gid = centry_uint32( centry );
4543
4544 centry_free(centry);
4545
4546 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4547 sid_string_dbg(user_sid)));
4548
4549 return NT_STATUS_OK;
4550
4551 do_query:
4552
4553 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4554 homedir, shell, gecos, p_gid );
4555
4556 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4557
4558 if ( NT_STATUS_IS_OK(nt_status) ) {
4559 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4560 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4561 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4562 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4563
4564 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4565 *homedir, *shell, *gecos, *p_gid );
4566 }
4567
4568 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4569 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4570 domain->name ));
4571 set_domain_offline( domain );
4572 }
4573
4574 return nt_status;
4575 }
4576
4577
4578 /* the cache backend methods are exposed via this structure */
4579 struct winbindd_methods cache_methods = {
4580 true,
4581 query_user_list,
4582 enum_dom_groups,
4583 enum_local_groups,
4584 name_to_sid,
4585 sid_to_name,
4586 rids_to_names,
4587 query_user,
4588 lookup_usergroups,
4589 lookup_useraliases,
4590 lookup_groupmem,
4591 sequence_number,
4592 lockout_policy,
4593 password_policy,
4594 trusted_domains
4595 };
4596
4597 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4598 uint32_t opnum, const DATA_BLOB *req,
4599 TDB_DATA *pkey)
4600 {
4601 char *key;
4602 size_t keylen;
4603
4604 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4605 if (key == NULL) {
4606 return false;
4607 }
4608 keylen = talloc_get_size(key) - 1;
4609
4610 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4611 if (key == NULL) {
4612 return false;
4613 }
4614 memcpy(key + keylen, req->data, req->length);
4615
4616 pkey->dptr = (uint8_t *)key;
4617 pkey->dsize = talloc_get_size(key);
4618 return true;
4619 }
4620
4621 static bool wcache_opnum_cacheable(uint32_t opnum)
4622 {
4623 switch (opnum) {
4624 case NDR_WBINT_PING:
4625 case NDR_WBINT_QUERYSEQUENCENUMBER:
4626 case NDR_WBINT_ALLOCATEUID:
4627 case NDR_WBINT_ALLOCATEGID:
4628 case NDR_WBINT_CHECKMACHINEACCOUNT:
4629 case NDR_WBINT_CHANGEMACHINEACCOUNT:
4630 case NDR_WBINT_PINGDC:
4631 return false;
4632 }
4633 return true;
4634 }
4635
4636 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4637 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4638 {
4639 TDB_DATA key, data;
4640 bool ret = false;
4641
4642 if (!wcache_opnum_cacheable(opnum)) {
4643 return false;
4644 }
4645
4646 if (wcache->tdb == NULL) {
4647 return false;
4648 }
4649
4650 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4651 return false;
4652 }
4653 data = tdb_fetch(wcache->tdb, key);
4654 TALLOC_FREE(key.dptr);
4655
4656 if (data.dptr == NULL) {
4657 return false;
4658 }
4659 if (data.dsize < 4) {
4660 goto fail;
4661 }
4662
4663 if (!is_domain_offline(domain)) {
4664 uint32_t entry_seqnum, dom_seqnum, last_check;
4665
4666 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4667 &last_check)) {
4668 goto fail;
4669 }
4670 entry_seqnum = IVAL(data.dptr, 0);
4671 if (entry_seqnum != dom_seqnum) {
4672 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4673 (int)entry_seqnum));
4674 goto fail;
4675 }
4676 }
4677
4678 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4679 data.dsize - 4);
4680 if (resp->data == NULL) {
4681 DEBUG(10, ("talloc failed\n"));
4682 goto fail;
4683 }
4684 resp->length = data.dsize - 4;
4685
4686 ret = true;
4687 fail:
4688 SAFE_FREE(data.dptr);
4689 return ret;
4690 }
4691
4692 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4693 const DATA_BLOB *req, const DATA_BLOB *resp)
4694 {
4695 TDB_DATA key, data;
4696 uint32_t dom_seqnum, last_check;
4697
4698 if (!wcache_opnum_cacheable(opnum)) {
4699 return;
4700 }
4701
4702 if (wcache->tdb == NULL) {
4703 return;
4704 }
4705
4706 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4707 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4708 domain->name));
4709 return;
4710 }
4711
4712 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4713 return;
4714 }
4715
4716 data.dsize = resp->length + 4;
4717 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4718 if (data.dptr == NULL) {
4719 goto done;
4720 }
4721
4722 SIVAL(data.dptr, 0, dom_seqnum);
4723 memcpy(data.dptr+4, resp->data, resp->length);
4724
4725 tdb_store(wcache->tdb, key, data, 0);
4726
4727 done:
4728 TALLOC_FREE(key.dptr);
4729 return;
4730 }