?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:librpc/rpc: also call dcerpc_schedule_io_trigger() after bind and alter_context...
[Samba/gebeck_regimport.git] / source3 / winbindd / winbindd_cache.c
blob2c9dd4a9b3e19472e9cfd0ceaff1d1b669cb037c
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "system/filesys.h"
28 #include "winbindd.h"
29 #include "tdb_validate.h"
30 #include "../libcli/auth/libcli_auth.h"
31 #include "../librpc/gen_ndr/ndr_wbint.h"
32 #include "ads.h"
33 #include "nss_info.h"
34 #include "../libcli/security/security.h"
35 #include "passdb/machine_sid.h"
36 #include "util_tdb.h"
37
38 #undef DBGC_CLASS
39 #define DBGC_CLASS DBGC_WINBIND
40
41 #define WINBINDD_CACHE_VER1 1 /* initial db version */
42 #define WINBINDD_CACHE_VER2 2 /* second version with timeouts for NDR entries */
43
44 #define WINBINDD_CACHE_VERSION WINBINDD_CACHE_VER2
45 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
46
47 extern struct winbindd_methods reconnect_methods;
48 #ifdef HAVE_ADS
49 extern struct winbindd_methods ads_methods;
50 #endif
51 extern struct winbindd_methods builtin_passdb_methods;
52 extern struct winbindd_methods sam_passdb_methods;
53
54 /*
55 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
56 * Here are the list of entry types that are *not* stored
57 * as form struct cache_entry in the cache.
58 */
59
60 static const char *non_centry_keys[] = {
61 "SEQNUM/",
62 "WINBINDD_OFFLINE",
63 WINBINDD_CACHE_VERSION_KEYSTR,
64 NULL
65 };
66
67 /************************************************************************
68 Is this key a non-centry type ?
69 ************************************************************************/
70
71 static bool is_non_centry_key(TDB_DATA kbuf)
72 {
73 int i;
74
75 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
76 return false;
77 }
78 for (i = 0; non_centry_keys[i] != NULL; i++) {
79 size_t namelen = strlen(non_centry_keys[i]);
80 if (kbuf.dsize < namelen) {
81 continue;
82 }
83 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
84 return true;
85 }
86 }
87 return false;
88 }
89
90 /* Global online/offline state - False when online. winbindd starts up online
91 and sets this to true if the first query fails and there's an entry in
92 the cache tdb telling us to stay offline. */
93
94 static bool global_winbindd_offline_state;
95
96 struct winbind_cache {
97 TDB_CONTEXT *tdb;
98 };
99
100 struct cache_entry {
101 NTSTATUS status;
102 uint32 sequence_number;
103 uint64_t timeout;
104 uint8 *data;
105 uint32 len, ofs;
106 };
107
108 void (*smb_panic_fn)(const char *const why) = smb_panic;
109
110 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
111
112 static struct winbind_cache *wcache;
113
114 /* get the winbind_cache structure */
115 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
116 {
117 struct winbind_cache *ret = wcache;
118
119 /* We have to know what type of domain we are dealing with first. */
120
121 if (domain->internal) {
122 domain->backend = &builtin_passdb_methods;
123 domain->initialized = True;
124 }
125
126 if (strequal(domain->name, get_global_sam_name()) &&
127 sid_check_is_our_sam(&domain->sid)) {
128 domain->backend = &sam_passdb_methods;
129 domain->initialized = True;
130 }
131
132 if ( !domain->initialized ) {
133 init_dc_connection( domain );
134 }
135
136 /*
137 OK. listen up becasue I'm only going to say this once.
138 We have the following scenarios to consider
139 (a) trusted AD domains on a Samba DC,
140 (b) trusted AD domains and we are joined to a non-kerberos domain
141 (c) trusted AD domains and we are joined to a kerberos (AD) domain
142
143 For (a) we can always contact the trusted domain using krb5
144 since we have the domain trust account password
145
146 For (b) we can only use RPC since we have no way of
147 getting a krb5 ticket in our own domain
148
149 For (c) we can always use krb5 since we have a kerberos trust
150
151 --jerry
152 */
153
154 if (!domain->backend) {
155 #ifdef HAVE_ADS
156 struct winbindd_domain *our_domain = domain;
157
158 /* find our domain first so we can figure out if we
159 are joined to a kerberized domain */
160
161 if ( !domain->primary )
162 our_domain = find_our_domain();
163
164 if ((our_domain->active_directory || IS_DC)
165 && domain->active_directory
166 && !lp_winbind_rpc_only()) {
167 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
168 domain->backend = &ads_methods;
169 } else {
170 #endif /* HAVE_ADS */
171 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
172 domain->backend = &reconnect_methods;
173 #ifdef HAVE_ADS
174 }
175 #endif /* HAVE_ADS */
176 }
177
178 if (ret)
179 return ret;
180
181 ret = SMB_XMALLOC_P(struct winbind_cache);
182 ZERO_STRUCTP(ret);
183
184 wcache = ret;
185 wcache_flush_cache();
186
187 return ret;
188 }
189
190 /*
191 free a centry structure
192 */
193 static void centry_free(struct cache_entry *centry)
194 {
195 if (!centry)
196 return;
197 SAFE_FREE(centry->data);
198 free(centry);
199 }
200
201 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
202 {
203 if (centry->len - centry->ofs < nbytes) {
204 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
205 (unsigned int)nbytes,
206 centry->len - centry->ofs));
207 return false;
208 }
209 return true;
210 }
211
212 /*
213 pull a uint64_t from a cache entry
214 */
215 static uint64_t centry_uint64_t(struct cache_entry *centry)
216 {
217 uint64_t ret;
218
219 if (!centry_check_bytes(centry, 8)) {
220 smb_panic_fn("centry_uint64_t");
221 }
222 ret = BVAL(centry->data, centry->ofs);
223 centry->ofs += 8;
224 return ret;
225 }
226
227 /*
228 pull a uint32 from a cache entry
229 */
230 static uint32 centry_uint32(struct cache_entry *centry)
231 {
232 uint32 ret;
233
234 if (!centry_check_bytes(centry, 4)) {
235 smb_panic_fn("centry_uint32");
236 }
237 ret = IVAL(centry->data, centry->ofs);
238 centry->ofs += 4;
239 return ret;
240 }
241
242 /*
243 pull a uint16 from a cache entry
244 */
245 static uint16 centry_uint16(struct cache_entry *centry)
246 {
247 uint16 ret;
248 if (!centry_check_bytes(centry, 2)) {
249 smb_panic_fn("centry_uint16");
250 }
251 ret = SVAL(centry->data, centry->ofs);
252 centry->ofs += 2;
253 return ret;
254 }
255
256 /*
257 pull a uint8 from a cache entry
258 */
259 static uint8 centry_uint8(struct cache_entry *centry)
260 {
261 uint8 ret;
262 if (!centry_check_bytes(centry, 1)) {
263 smb_panic_fn("centry_uint8");
264 }
265 ret = CVAL(centry->data, centry->ofs);
266 centry->ofs += 1;
267 return ret;
268 }
269
270 /*
271 pull a NTTIME from a cache entry
272 */
273 static NTTIME centry_nttime(struct cache_entry *centry)
274 {
275 NTTIME ret;
276 if (!centry_check_bytes(centry, 8)) {
277 smb_panic_fn("centry_nttime");
278 }
279 ret = IVAL(centry->data, centry->ofs);
280 centry->ofs += 4;
281 ret += (uint64)IVAL(centry->data, centry->ofs) << 32;
282 centry->ofs += 4;
283 return ret;
284 }
285
286 /*
287 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
288 */
289 static time_t centry_time(struct cache_entry *centry)
290 {
291 return (time_t)centry_nttime(centry);
292 }
293
294 /* pull a string from a cache entry, using the supplied
295 talloc context
296 */
297 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
298 {
299 uint32 len;
300 char *ret;
301
302 len = centry_uint8(centry);
303
304 if (len == 0xFF) {
305 /* a deliberate NULL string */
306 return NULL;
307 }
308
309 if (!centry_check_bytes(centry, (size_t)len)) {
310 smb_panic_fn("centry_string");
311 }
312
313 ret = talloc_array(mem_ctx, char, len+1);
314 if (!ret) {
315 smb_panic_fn("centry_string out of memory\n");
316 }
317 memcpy(ret,centry->data + centry->ofs, len);
318 ret[len] = 0;
319 centry->ofs += len;
320 return ret;
321 }
322
323 /* pull a hash16 from a cache entry, using the supplied
324 talloc context
325 */
326 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
327 {
328 uint32 len;
329 char *ret;
330
331 len = centry_uint8(centry);
332
333 if (len != 16) {
334 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
335 len ));
336 return NULL;
337 }
338
339 if (!centry_check_bytes(centry, 16)) {
340 return NULL;
341 }
342
343 ret = talloc_array(mem_ctx, char, 16);
344 if (!ret) {
345 smb_panic_fn("centry_hash out of memory\n");
346 }
347 memcpy(ret,centry->data + centry->ofs, 16);
348 centry->ofs += 16;
349 return ret;
350 }
351
352 /* pull a sid from a cache entry, using the supplied
353 talloc context
354 */
355 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
356 {
357 char *sid_string;
358 bool ret;
359
360 sid_string = centry_string(centry, talloc_tos());
361 if (sid_string == NULL) {
362 return false;
363 }
364 ret = string_to_sid(sid, sid_string);
365 TALLOC_FREE(sid_string);
366 return ret;
367 }
368
369
370 /*
371 pull a NTSTATUS from a cache entry
372 */
373 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
374 {
375 NTSTATUS status;
376
377 status = NT_STATUS(centry_uint32(centry));
378 return status;
379 }
380
381
382 /* the server is considered down if it can't give us a sequence number */
383 static bool wcache_server_down(struct winbindd_domain *domain)
384 {
385 bool ret;
386
387 if (!wcache->tdb)
388 return false;
389
390 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
391
392 if (ret)
393 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
394 domain->name ));
395 return ret;
396 }
397
398 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
399 uint32_t *last_seq_check)
400 {
401 char *key;
402 TDB_DATA data;
403
404 if (wcache->tdb == NULL) {
405 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
406 return false;
407 }
408
409 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
410 if (key == NULL) {
411 DEBUG(10, ("talloc failed\n"));
412 return false;
413 }
414
415 data = tdb_fetch_bystring(wcache->tdb, key);
416 TALLOC_FREE(key);
417
418 if (data.dptr == NULL) {
419 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
420 domain_name));
421 return false;
422 }
423 if (data.dsize != 8) {
424 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
425 (int)data.dsize));
426 SAFE_FREE(data.dptr);
427 return false;
428 }
429
430 *seqnum = IVAL(data.dptr, 0);
431 *last_seq_check = IVAL(data.dptr, 4);
432 SAFE_FREE(data.dptr);
433
434 return true;
435 }
436
437 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
438 {
439 uint32 last_check, time_diff;
440
441 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
442 &last_check)) {
443 return NT_STATUS_UNSUCCESSFUL;
444 }
445 domain->last_seq_check = last_check;
446
447 /* have we expired? */
448
449 time_diff = now - domain->last_seq_check;
450 if ( time_diff > lp_winbind_cache_time() ) {
451 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
452 domain->name, domain->sequence_number,
453 (uint32)domain->last_seq_check));
454 return NT_STATUS_UNSUCCESSFUL;
455 }
456
457 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
458 domain->name, domain->sequence_number,
459 (uint32)domain->last_seq_check));
460
461 return NT_STATUS_OK;
462 }
463
464 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
465 time_t last_seq_check)
466 {
467 char *key_str;
468 uint8_t buf[8];
469 int ret;
470
471 if (wcache->tdb == NULL) {
472 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
473 return false;
474 }
475
476 key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
477 if (key_str == NULL) {
478 DEBUG(10, ("talloc_asprintf failed\n"));
479 return false;
480 }
481
482 SIVAL(buf, 0, seqnum);
483 SIVAL(buf, 4, last_seq_check);
484
485 ret = tdb_store_bystring(wcache->tdb, key_str,
486 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
487 TALLOC_FREE(key_str);
488 if (ret != 0) {
489 DEBUG(10, ("tdb_store_bystring failed: %s\n",
490 tdb_errorstr_compat(wcache->tdb)));
491 TALLOC_FREE(key_str);
492 return false;
493 }
494
495 DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
496 domain_name, seqnum, (unsigned)last_seq_check));
497
498 return true;
499 }
500
501 static bool store_cache_seqnum( struct winbindd_domain *domain )
502 {
503 return wcache_store_seqnum(domain->name, domain->sequence_number,
504 domain->last_seq_check);
505 }
506
507 /*
508 refresh the domain sequence number. If force is true
509 then always refresh it, no matter how recently we fetched it
510 */
511
512 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
513 {
514 NTSTATUS status;
515 unsigned time_diff;
516 time_t t = time(NULL);
517 unsigned cache_time = lp_winbind_cache_time();
518
519 if (is_domain_offline(domain)) {
520 return;
521 }
522
523 get_cache( domain );
524
525 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
526 /* trying to reconnect is expensive, don't do it too often */
527 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
528 cache_time *= 8;
529 }
530 #endif
531
532 time_diff = t - domain->last_seq_check;
533
534 /* see if we have to refetch the domain sequence number */
535 if (!force && (time_diff < cache_time) &&
536 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
537 NT_STATUS_IS_OK(domain->last_status)) {
538 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
539 goto done;
540 }
541
542 /* try to get the sequence number from the tdb cache first */
543 /* this will update the timestamp as well */
544
545 status = fetch_cache_seqnum( domain, t );
546 if (NT_STATUS_IS_OK(status) &&
547 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
548 NT_STATUS_IS_OK(domain->last_status)) {
549 goto done;
550 }
551
552 /* important! make sure that we know if this is a native
553 mode domain or not. And that we can contact it. */
554
555 if ( winbindd_can_contact_domain( domain ) ) {
556 status = domain->backend->sequence_number(domain,
557 &domain->sequence_number);
558 } else {
559 /* just use the current time */
560 status = NT_STATUS_OK;
561 domain->sequence_number = time(NULL);
562 }
563
564
565 /* the above call could have set our domain->backend to NULL when
566 * coming from offline to online mode, make sure to reinitialize the
567 * backend - Guenther */
568 get_cache( domain );
569
570 if (!NT_STATUS_IS_OK(status)) {
571 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
572 domain->sequence_number = DOM_SEQUENCE_NONE;
573 }
574
575 domain->last_status = status;
576 domain->last_seq_check = time(NULL);
577
578 /* save the new sequence number in the cache */
579 store_cache_seqnum( domain );
580
581 done:
582 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
583 domain->name, domain->sequence_number));
584
585 return;
586 }
587
588 /*
589 decide if a cache entry has expired
590 */
591 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
592 {
593 /* If we've been told to be offline - stay in that state... */
594 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
595 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
596 keystr, domain->name ));
597 return false;
598 }
599
600 /* when the domain is offline return the cached entry.
601 * This deals with transient offline states... */
602
603 if (!domain->online) {
604 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
605 keystr, domain->name ));
606 return false;
607 }
608
609 /* if the server is OK and our cache entry came from when it was down then
610 the entry is invalid */
611 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
612 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
613 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
614 keystr, domain->name ));
615 return true;
616 }
617
618 /* if the server is down or the cache entry is not older than the
619 current sequence number or it did not timeout then it is OK */
620 if (wcache_server_down(domain)
621 || ((centry->sequence_number == domain->sequence_number)
622 && (centry->timeout > time(NULL)))) {
623 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
624 keystr, domain->name ));
625 return false;
626 }
627
628 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
629 keystr, domain->name ));
630
631 /* it's expired */
632 return true;
633 }
634
635 static struct cache_entry *wcache_fetch_raw(char *kstr)
636 {
637 TDB_DATA data;
638 struct cache_entry *centry;
639 TDB_DATA key;
640
641 key = string_tdb_data(kstr);
642 data = tdb_fetch_compat(wcache->tdb, key);
643 if (!data.dptr) {
644 /* a cache miss */
645 return NULL;
646 }
647
648 centry = SMB_XMALLOC_P(struct cache_entry);
649 centry->data = (unsigned char *)data.dptr;
650 centry->len = data.dsize;
651 centry->ofs = 0;
652
653 if (centry->len < 16) {
654 /* huh? corrupt cache? */
655 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s "
656 "(len < 16)?\n", kstr));
657 centry_free(centry);
658 return NULL;
659 }
660
661 centry->status = centry_ntstatus(centry);
662 centry->sequence_number = centry_uint32(centry);
663 centry->timeout = centry_uint64_t(centry);
664
665 return centry;
666 }
667
668 static bool is_my_own_sam_domain(struct winbindd_domain *domain)
669 {
670 if (strequal(domain->name, get_global_sam_name()) &&
671 sid_check_is_our_sam(&domain->sid)) {
672 return true;
673 }
674
675 return false;
676 }
677
678 static bool is_builtin_domain(struct winbindd_domain *domain)
679 {
680 if (strequal(domain->name, "BUILTIN") &&
681 sid_check_is_builtin(&domain->sid)) {
682 return true;
683 }
684
685 return false;
686 }
687
688 /*
689 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
690 number and return status
691 */
692 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
693 struct winbindd_domain *domain,
694 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
695 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
696 struct winbindd_domain *domain,
697 const char *format, ...)
698 {
699 va_list ap;
700 char *kstr;
701 struct cache_entry *centry;
702
703 if (!winbindd_use_cache() ||
704 is_my_own_sam_domain(domain) ||
705 is_builtin_domain(domain)) {
706 return NULL;
707 }
708
709 refresh_sequence_number(domain, false);
710
711 va_start(ap, format);
712 smb_xvasprintf(&kstr, format, ap);
713 va_end(ap);
714
715 centry = wcache_fetch_raw(kstr);
716 if (centry == NULL) {
717 free(kstr);
718 return NULL;
719 }
720
721 if (centry_expired(domain, kstr, centry)) {
722
723 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
724 kstr, domain->name ));
725
726 centry_free(centry);
727 free(kstr);
728 return NULL;
729 }
730
731 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
732 kstr, domain->name ));
733
734 free(kstr);
735 return centry;
736 }
737
738 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
739 static void wcache_delete(const char *format, ...)
740 {
741 va_list ap;
742 char *kstr;
743 TDB_DATA key;
744
745 va_start(ap, format);
746 smb_xvasprintf(&kstr, format, ap);
747 va_end(ap);
748
749 key = string_tdb_data(kstr);
750
751 tdb_delete(wcache->tdb, key);
752 free(kstr);
753 }
754
755 /*
756 make sure we have at least len bytes available in a centry
757 */
758 static void centry_expand(struct cache_entry *centry, uint32 len)
759 {
760 if (centry->len - centry->ofs >= len)
761 return;
762 centry->len *= 2;
763 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
764 centry->len);
765 if (!centry->data) {
766 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
767 smb_panic_fn("out of memory in centry_expand");
768 }
769 }
770
771 /*
772 push a uint64_t into a centry
773 */
774 static void centry_put_uint64_t(struct cache_entry *centry, uint64_t v)
775 {
776 centry_expand(centry, 8);
777 SBVAL(centry->data, centry->ofs, v);
778 centry->ofs += 8;
779 }
780
781 /*
782 push a uint32 into a centry
783 */
784 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
785 {
786 centry_expand(centry, 4);
787 SIVAL(centry->data, centry->ofs, v);
788 centry->ofs += 4;
789 }
790
791 /*
792 push a uint16 into a centry
793 */
794 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
795 {
796 centry_expand(centry, 2);
797 SSVAL(centry->data, centry->ofs, v);
798 centry->ofs += 2;
799 }
800
801 /*
802 push a uint8 into a centry
803 */
804 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
805 {
806 centry_expand(centry, 1);
807 SCVAL(centry->data, centry->ofs, v);
808 centry->ofs += 1;
809 }
810
811 /*
812 push a string into a centry
813 */
814 static void centry_put_string(struct cache_entry *centry, const char *s)
815 {
816 int len;
817
818 if (!s) {
819 /* null strings are marked as len 0xFFFF */
820 centry_put_uint8(centry, 0xFF);
821 return;
822 }
823
824 len = strlen(s);
825 /* can't handle more than 254 char strings. Truncating is probably best */
826 if (len > 254) {
827 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
828 len = 254;
829 }
830 centry_put_uint8(centry, len);
831 centry_expand(centry, len);
832 memcpy(centry->data + centry->ofs, s, len);
833 centry->ofs += len;
834 }
835
836 /*
837 push a 16 byte hash into a centry - treat as 16 byte string.
838 */
839 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
840 {
841 centry_put_uint8(centry, 16);
842 centry_expand(centry, 16);
843 memcpy(centry->data + centry->ofs, val, 16);
844 centry->ofs += 16;
845 }
846
847 static void centry_put_sid(struct cache_entry *centry, const struct dom_sid *sid)
848 {
849 fstring sid_string;
850 centry_put_string(centry, sid_to_fstring(sid_string, sid));
851 }
852
853
854 /*
855 put NTSTATUS into a centry
856 */
857 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
858 {
859 uint32 status_value = NT_STATUS_V(status);
860 centry_put_uint32(centry, status_value);
861 }
862
863
864 /*
865 push a NTTIME into a centry
866 */
867 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
868 {
869 centry_expand(centry, 8);
870 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
871 centry->ofs += 4;
872 SIVAL(centry->data, centry->ofs, nt >> 32);
873 centry->ofs += 4;
874 }
875
876 /*
877 push a time_t into a centry - use a 64 bit size.
878 NTTIME here is being used as a convenient 64-bit size.
879 */
880 static void centry_put_time(struct cache_entry *centry, time_t t)
881 {
882 NTTIME nt = (NTTIME)t;
883 centry_put_nttime(centry, nt);
884 }
885
886 /*
887 start a centry for output. When finished, call centry_end()
888 */
889 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
890 {
891 struct cache_entry *centry;
892
893 if (!wcache->tdb)
894 return NULL;
895
896 centry = SMB_XMALLOC_P(struct cache_entry);
897
898 centry->len = 8192; /* reasonable default */
899 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
900 centry->ofs = 0;
901 centry->sequence_number = domain->sequence_number;
902 centry->timeout = lp_winbind_cache_time() + time(NULL);
903 centry_put_ntstatus(centry, status);
904 centry_put_uint32(centry, centry->sequence_number);
905 centry_put_uint64_t(centry, centry->timeout);
906 return centry;
907 }
908
909 /*
910 finish a centry and write it to the tdb
911 */
912 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
913 static void centry_end(struct cache_entry *centry, const char *format, ...)
914 {
915 va_list ap;
916 char *kstr;
917 TDB_DATA key, data;
918
919 if (!winbindd_use_cache()) {
920 return;
921 }
922
923 va_start(ap, format);
924 smb_xvasprintf(&kstr, format, ap);
925 va_end(ap);
926
927 key = string_tdb_data(kstr);
928 data.dptr = centry->data;
929 data.dsize = centry->ofs;
930
931 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
932 free(kstr);
933 }
934
935 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
936 NTSTATUS status, const char *domain_name,
937 const char *name, const struct dom_sid *sid,
938 enum lsa_SidType type)
939 {
940 struct cache_entry *centry;
941 fstring uname;
942
943 centry = centry_start(domain, status);
944 if (!centry)
945 return;
946 centry_put_uint32(centry, type);
947 centry_put_sid(centry, sid);
948 fstrcpy(uname, name);
949 (void)strupper_m(uname);
950 centry_end(centry, "NS/%s/%s", domain_name, uname);
951 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
952 uname, sid_string_dbg(sid), nt_errstr(status)));
953 centry_free(centry);
954 }
955
956 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
957 const struct dom_sid *sid, const char *domain_name, const char *name, enum lsa_SidType type)
958 {
959 struct cache_entry *centry;
960 fstring sid_string;
961
962 centry = centry_start(domain, status);
963 if (!centry)
964 return;
965
966 if (NT_STATUS_IS_OK(status)) {
967 centry_put_uint32(centry, type);
968 centry_put_string(centry, domain_name);
969 centry_put_string(centry, name);
970 }
971
972 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
973 DEBUG(10,("wcache_save_sid_to_name: %s -> %s\\%s (%s)\n", sid_string,
974 domain_name, name, nt_errstr(status)));
975 centry_free(centry);
976 }
977
978
979 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
980 struct wbint_userinfo *info)
981 {
982 struct cache_entry *centry;
983 fstring sid_string;
984
985 if (is_null_sid(&info->user_sid)) {
986 return;
987 }
988
989 centry = centry_start(domain, status);
990 if (!centry)
991 return;
992 centry_put_string(centry, info->acct_name);
993 centry_put_string(centry, info->full_name);
994 centry_put_string(centry, info->homedir);
995 centry_put_string(centry, info->shell);
996 centry_put_uint32(centry, info->primary_gid);
997 centry_put_sid(centry, &info->user_sid);
998 centry_put_sid(centry, &info->group_sid);
999 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
1000 &info->user_sid));
1001 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
1002 centry_free(centry);
1003 }
1004
1005 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
1006 NTSTATUS status,
1007 struct samr_DomInfo12 *lockout_policy)
1008 {
1009 struct cache_entry *centry;
1010
1011 centry = centry_start(domain, status);
1012 if (!centry)
1013 return;
1014
1015 centry_put_nttime(centry, lockout_policy->lockout_duration);
1016 centry_put_nttime(centry, lockout_policy->lockout_window);
1017 centry_put_uint16(centry, lockout_policy->lockout_threshold);
1018
1019 centry_end(centry, "LOC_POL/%s", domain->name);
1020
1021 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
1022
1023 centry_free(centry);
1024 }
1025
1026
1027
1028 static void wcache_save_password_policy(struct winbindd_domain *domain,
1029 NTSTATUS status,
1030 struct samr_DomInfo1 *policy)
1031 {
1032 struct cache_entry *centry;
1033
1034 centry = centry_start(domain, status);
1035 if (!centry)
1036 return;
1037
1038 centry_put_uint16(centry, policy->min_password_length);
1039 centry_put_uint16(centry, policy->password_history_length);
1040 centry_put_uint32(centry, policy->password_properties);
1041 centry_put_nttime(centry, policy->max_password_age);
1042 centry_put_nttime(centry, policy->min_password_age);
1043
1044 centry_end(centry, "PWD_POL/%s", domain->name);
1045
1046 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1047
1048 centry_free(centry);
1049 }
1050
1051 /***************************************************************************
1052 ***************************************************************************/
1053
1054 static void wcache_save_username_alias(struct winbindd_domain *domain,
1055 NTSTATUS status,
1056 const char *name, const char *alias)
1057 {
1058 struct cache_entry *centry;
1059 fstring uname;
1060
1061 if ( (centry = centry_start(domain, status)) == NULL )
1062 return;
1063
1064 centry_put_string( centry, alias );
1065
1066 fstrcpy(uname, name);
1067 (void)strupper_m(uname);
1068 centry_end(centry, "NSS/NA/%s", uname);
1069
1070 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1071
1072 centry_free(centry);
1073 }
1074
1075 static void wcache_save_alias_username(struct winbindd_domain *domain,
1076 NTSTATUS status,
1077 const char *alias, const char *name)
1078 {
1079 struct cache_entry *centry;
1080 fstring uname;
1081
1082 if ( (centry = centry_start(domain, status)) == NULL )
1083 return;
1084
1085 centry_put_string( centry, name );
1086
1087 fstrcpy(uname, alias);
1088 (void)strupper_m(uname);
1089 centry_end(centry, "NSS/AN/%s", uname);
1090
1091 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1092
1093 centry_free(centry);
1094 }
1095
1096 /***************************************************************************
1097 ***************************************************************************/
1098
1099 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1100 struct winbindd_domain *domain,
1101 const char *name, char **alias )
1102 {
1103 struct winbind_cache *cache = get_cache(domain);
1104 struct cache_entry *centry = NULL;
1105 NTSTATUS status;
1106 char *upper_name;
1107
1108 if ( domain->internal )
1109 return NT_STATUS_NOT_SUPPORTED;
1110
1111 if (!cache->tdb)
1112 goto do_query;
1113
1114 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1115 return NT_STATUS_NO_MEMORY;
1116 if (!strupper_m(upper_name)) {
1117 SAFE_FREE(name);
1118 return NT_STATUS_INVALID_PARAMETER;
1119 }
1120
1121 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1122
1123 SAFE_FREE( upper_name );
1124
1125 if (!centry)
1126 goto do_query;
1127
1128 status = centry->status;
1129
1130 if (!NT_STATUS_IS_OK(status)) {
1131 centry_free(centry);
1132 return status;
1133 }
1134
1135 *alias = centry_string( centry, mem_ctx );
1136
1137 centry_free(centry);
1138
1139 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1140 name, *alias ? *alias : "(none)"));
1141
1142 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1143
1144 do_query:
1145
1146 /* If its not in cache and we are offline, then fail */
1147
1148 if ( get_global_winbindd_state_offline() || !domain->online ) {
1149 DEBUG(8,("resolve_username_to_alias: rejecting query "
1150 "in offline mode\n"));
1151 return NT_STATUS_NOT_FOUND;
1152 }
1153
1154 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1155
1156 if ( NT_STATUS_IS_OK( status ) ) {
1157 wcache_save_username_alias(domain, status, name, *alias);
1158 }
1159
1160 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1161 wcache_save_username_alias(domain, status, name, "(NULL)");
1162 }
1163
1164 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1165 nt_errstr(status)));
1166
1167 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1168 set_domain_offline( domain );
1169 }
1170
1171 return status;
1172 }
1173
1174 /***************************************************************************
1175 ***************************************************************************/
1176
1177 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1178 struct winbindd_domain *domain,
1179 const char *alias, char **name )
1180 {
1181 struct winbind_cache *cache = get_cache(domain);
1182 struct cache_entry *centry = NULL;
1183 NTSTATUS status;
1184 char *upper_name;
1185
1186 if ( domain->internal )
1187 return NT_STATUS_NOT_SUPPORTED;
1188
1189 if (!cache->tdb)
1190 goto do_query;
1191
1192 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1193 return NT_STATUS_NO_MEMORY;
1194 if (!strupper_m(upper_name)) {
1195 SAFE_FREE(alias);
1196 return NT_STATUS_INVALID_PARAMETER;
1197 }
1198
1199 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1200
1201 SAFE_FREE( upper_name );
1202
1203 if (!centry)
1204 goto do_query;
1205
1206 status = centry->status;
1207
1208 if (!NT_STATUS_IS_OK(status)) {
1209 centry_free(centry);
1210 return status;
1211 }
1212
1213 *name = centry_string( centry, mem_ctx );
1214
1215 centry_free(centry);
1216
1217 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1218 alias, *name ? *name : "(none)"));
1219
1220 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1221
1222 do_query:
1223
1224 /* If its not in cache and we are offline, then fail */
1225
1226 if ( get_global_winbindd_state_offline() || !domain->online ) {
1227 DEBUG(8,("resolve_alias_to_username: rejecting query "
1228 "in offline mode\n"));
1229 return NT_STATUS_NOT_FOUND;
1230 }
1231
1232 /* an alias cannot contain a domain prefix or '@' */
1233
1234 if (strchr(alias, '\\') || strchr(alias, '@')) {
1235 DEBUG(10,("resolve_alias_to_username: skipping fully "
1236 "qualified name %s\n", alias));
1237 return NT_STATUS_OBJECT_NAME_INVALID;
1238 }
1239
1240 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1241
1242 if ( NT_STATUS_IS_OK( status ) ) {
1243 wcache_save_alias_username( domain, status, alias, *name );
1244 }
1245
1246 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1247 wcache_save_alias_username(domain, status, alias, "(NULL)");
1248 }
1249
1250 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1251 nt_errstr(status)));
1252
1253 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1254 set_domain_offline( domain );
1255 }
1256
1257 return status;
1258 }
1259
1260 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const struct dom_sid *sid)
1261 {
1262 struct winbind_cache *cache = get_cache(domain);
1263 TDB_DATA data;
1264 fstring key_str, tmp;
1265 uint32 rid;
1266
1267 if (!cache->tdb) {
1268 return NT_STATUS_INTERNAL_DB_ERROR;
1269 }
1270
1271 if (is_null_sid(sid)) {
1272 return NT_STATUS_INVALID_SID;
1273 }
1274
1275 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1276 return NT_STATUS_INVALID_SID;
1277 }
1278
1279 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1280
1281 data = tdb_fetch_compat(cache->tdb, string_tdb_data(key_str));
1282 if (!data.dptr) {
1283 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1284 }
1285
1286 SAFE_FREE(data.dptr);
1287 return NT_STATUS_OK;
1288 }
1289
1290 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1291 as new salted ones. */
1292
1293 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1294 TALLOC_CTX *mem_ctx,
1295 const struct dom_sid *sid,
1296 const uint8 **cached_nt_pass,
1297 const uint8 **cached_salt)
1298 {
1299 struct winbind_cache *cache = get_cache(domain);
1300 struct cache_entry *centry = NULL;
1301 NTSTATUS status;
1302 uint32 rid;
1303 fstring tmp;
1304
1305 if (!winbindd_use_cache()) {
1306 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1307 }
1308
1309 if (!cache->tdb) {
1310 return NT_STATUS_INTERNAL_DB_ERROR;
1311 }
1312
1313 if (is_null_sid(sid)) {
1314 return NT_STATUS_INVALID_SID;
1315 }
1316
1317 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1318 return NT_STATUS_INVALID_SID;
1319 }
1320
1321 /* Try and get a salted cred first. If we can't
1322 fall back to an unsalted cred. */
1323
1324 centry = wcache_fetch(cache, domain, "CRED/%s",
1325 sid_to_fstring(tmp, sid));
1326 if (!centry) {
1327 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1328 sid_string_dbg(sid)));
1329 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1330 }
1331
1332 /* In the salted case this isn't actually the nt_hash itself,
1333 but the MD5 of the salt + nt_hash. Let the caller
1334 sort this out. It can tell as we only return the cached_salt
1335 if we are returning a salted cred. */
1336
1337 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1338 if (*cached_nt_pass == NULL) {
1339 fstring sidstr;
1340
1341 sid_to_fstring(sidstr, sid);
1342
1343 /* Bad (old) cred cache. Delete and pretend we
1344 don't have it. */
1345 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1346 sidstr));
1347 wcache_delete("CRED/%s", sidstr);
1348 centry_free(centry);
1349 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1350 }
1351
1352 /* We only have 17 bytes more data in the salted cred case. */
1353 if (centry->len - centry->ofs == 17) {
1354 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1355 } else {
1356 *cached_salt = NULL;
1357 }
1358
1359 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1360 if (*cached_salt) {
1361 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1362 }
1363
1364 status = centry->status;
1365
1366 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1367 sid_string_dbg(sid), nt_errstr(status) ));
1368
1369 centry_free(centry);
1370 return status;
1371 }
1372
1373 /* Store creds for a SID - only writes out new salted ones. */
1374
1375 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1376 const struct dom_sid *sid,
1377 const uint8 nt_pass[NT_HASH_LEN])
1378 {
1379 struct cache_entry *centry;
1380 fstring sid_string;
1381 uint32 rid;
1382 uint8 cred_salt[NT_HASH_LEN];
1383 uint8 salted_hash[NT_HASH_LEN];
1384
1385 if (is_null_sid(sid)) {
1386 return NT_STATUS_INVALID_SID;
1387 }
1388
1389 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1390 return NT_STATUS_INVALID_SID;
1391 }
1392
1393 centry = centry_start(domain, NT_STATUS_OK);
1394 if (!centry) {
1395 return NT_STATUS_INTERNAL_DB_ERROR;
1396 }
1397
1398 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1399
1400 centry_put_time(centry, time(NULL));
1401
1402 /* Create a salt and then salt the hash. */
1403 generate_random_buffer(cred_salt, NT_HASH_LEN);
1404 E_md5hash(cred_salt, nt_pass, salted_hash);
1405
1406 centry_put_hash16(centry, salted_hash);
1407 centry_put_hash16(centry, cred_salt);
1408 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1409
1410 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1411
1412 centry_free(centry);
1413
1414 return NT_STATUS_OK;
1415 }
1416
1417
1418 /* Query display info. This is the basic user list fn */
1419 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1420 TALLOC_CTX *mem_ctx,
1421 uint32 *num_entries,
1422 struct wbint_userinfo **info)
1423 {
1424 struct winbind_cache *cache = get_cache(domain);
1425 struct cache_entry *centry = NULL;
1426 NTSTATUS status;
1427 unsigned int i, retry;
1428 bool old_status = domain->online;
1429
1430 if (!cache->tdb)
1431 goto do_query;
1432
1433 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1434 if (!centry)
1435 goto do_query;
1436
1437 do_fetch_cache:
1438 *num_entries = centry_uint32(centry);
1439
1440 if (*num_entries == 0)
1441 goto do_cached;
1442
1443 (*info) = talloc_array(mem_ctx, struct wbint_userinfo, *num_entries);
1444 if (! (*info)) {
1445 smb_panic_fn("query_user_list out of memory");
1446 }
1447 for (i=0; i<(*num_entries); i++) {
1448 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1449 (*info)[i].full_name = centry_string(centry, mem_ctx);
1450 (*info)[i].homedir = centry_string(centry, mem_ctx);
1451 (*info)[i].shell = centry_string(centry, mem_ctx);
1452 centry_sid(centry, &(*info)[i].user_sid);
1453 centry_sid(centry, &(*info)[i].group_sid);
1454 }
1455
1456 do_cached:
1457 status = centry->status;
1458
1459 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1460 domain->name, nt_errstr(status) ));
1461
1462 centry_free(centry);
1463 return status;
1464
1465 do_query:
1466 *num_entries = 0;
1467 *info = NULL;
1468
1469 /* Return status value returned by seq number check */
1470
1471 if (!NT_STATUS_IS_OK(domain->last_status))
1472 return domain->last_status;
1473
1474 /* Put the query_user_list() in a retry loop. There appears to be
1475 * some bug either with Windows 2000 or Samba's handling of large
1476 * rpc replies. This manifests itself as sudden disconnection
1477 * at a random point in the enumeration of a large (60k) user list.
1478 * The retry loop simply tries the operation again. )-: It's not
1479 * pretty but an acceptable workaround until we work out what the
1480 * real problem is. */
1481
1482 retry = 0;
1483 do {
1484
1485 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1486 domain->name ));
1487
1488 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1489 if (!NT_STATUS_IS_OK(status)) {
1490 DEBUG(3, ("query_user_list: returned 0x%08x, "
1491 "retrying\n", NT_STATUS_V(status)));
1492 }
1493 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1494 DEBUG(3, ("query_user_list: flushing "
1495 "connection cache\n"));
1496 invalidate_cm_connection(&domain->conn);
1497 }
1498 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1499 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1500 if (!domain->internal && old_status) {
1501 set_domain_offline(domain);
1502 }
1503 /* store partial response. */
1504 if (*num_entries > 0) {
1505 /*
1506 * humm, what about the status used for cache?
1507 * Should it be NT_STATUS_OK?
1508 */
1509 break;
1510 }
1511 /*
1512 * domain is offline now, and there is no user entries,
1513 * try to fetch from cache again.
1514 */
1515 if (cache->tdb && !domain->online && !domain->internal && old_status) {
1516 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1517 /* partial response... */
1518 if (!centry) {
1519 goto skip_save;
1520 } else {
1521 goto do_fetch_cache;
1522 }
1523 } else {
1524 goto skip_save;
1525 }
1526 }
1527
1528 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1529 (retry++ < 5));
1530
1531 /* and save it */
1532 refresh_sequence_number(domain, false);
1533 if (!NT_STATUS_IS_OK(status)) {
1534 return status;
1535 }
1536 centry = centry_start(domain, status);
1537 if (!centry)
1538 goto skip_save;
1539 centry_put_uint32(centry, *num_entries);
1540 for (i=0; i<(*num_entries); i++) {
1541 centry_put_string(centry, (*info)[i].acct_name);
1542 centry_put_string(centry, (*info)[i].full_name);
1543 centry_put_string(centry, (*info)[i].homedir);
1544 centry_put_string(centry, (*info)[i].shell);
1545 centry_put_sid(centry, &(*info)[i].user_sid);
1546 centry_put_sid(centry, &(*info)[i].group_sid);
1547 if (domain->backend && domain->backend->consistent) {
1548 /* when the backend is consistent we can pre-prime some mappings */
1549 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1550 domain->name,
1551 (*info)[i].acct_name,
1552 &(*info)[i].user_sid,
1553 SID_NAME_USER);
1554 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1555 &(*info)[i].user_sid,
1556 domain->name,
1557 (*info)[i].acct_name,
1558 SID_NAME_USER);
1559 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1560 }
1561 }
1562 centry_end(centry, "UL/%s", domain->name);
1563 centry_free(centry);
1564
1565 skip_save:
1566 return status;
1567 }
1568
1569 /* list all domain groups */
1570 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1571 TALLOC_CTX *mem_ctx,
1572 uint32 *num_entries,
1573 struct wb_acct_info **info)
1574 {
1575 struct winbind_cache *cache = get_cache(domain);
1576 struct cache_entry *centry = NULL;
1577 NTSTATUS status;
1578 unsigned int i;
1579 bool old_status;
1580
1581 old_status = domain->online;
1582 if (!cache->tdb)
1583 goto do_query;
1584
1585 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1586 if (!centry)
1587 goto do_query;
1588
1589 do_fetch_cache:
1590 *num_entries = centry_uint32(centry);
1591
1592 if (*num_entries == 0)
1593 goto do_cached;
1594
1595 (*info) = talloc_array(mem_ctx, struct wb_acct_info, *num_entries);
1596 if (! (*info)) {
1597 smb_panic_fn("enum_dom_groups out of memory");
1598 }
1599 for (i=0; i<(*num_entries); i++) {
1600 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1601 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1602 (*info)[i].rid = centry_uint32(centry);
1603 }
1604
1605 do_cached:
1606 status = centry->status;
1607
1608 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1609 domain->name, nt_errstr(status) ));
1610
1611 centry_free(centry);
1612 return status;
1613
1614 do_query:
1615 *num_entries = 0;
1616 *info = NULL;
1617
1618 /* Return status value returned by seq number check */
1619
1620 if (!NT_STATUS_IS_OK(domain->last_status))
1621 return domain->last_status;
1622
1623 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1624 domain->name ));
1625
1626 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1627
1628 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1629 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1630 if (!domain->internal && old_status) {
1631 set_domain_offline(domain);
1632 }
1633 if (cache->tdb &&
1634 !domain->online &&
1635 !domain->internal &&
1636 old_status) {
1637 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1638 if (centry) {
1639 goto do_fetch_cache;
1640 }
1641 }
1642 }
1643 /* and save it */
1644 refresh_sequence_number(domain, false);
1645 if (!NT_STATUS_IS_OK(status)) {
1646 return status;
1647 }
1648 centry = centry_start(domain, status);
1649 if (!centry)
1650 goto skip_save;
1651 centry_put_uint32(centry, *num_entries);
1652 for (i=0; i<(*num_entries); i++) {
1653 centry_put_string(centry, (*info)[i].acct_name);
1654 centry_put_string(centry, (*info)[i].acct_desc);
1655 centry_put_uint32(centry, (*info)[i].rid);
1656 }
1657 centry_end(centry, "GL/%s/domain", domain->name);
1658 centry_free(centry);
1659
1660 skip_save:
1661 return status;
1662 }
1663
1664 /* list all domain groups */
1665 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1666 TALLOC_CTX *mem_ctx,
1667 uint32 *num_entries,
1668 struct wb_acct_info **info)
1669 {
1670 struct winbind_cache *cache = get_cache(domain);
1671 struct cache_entry *centry = NULL;
1672 NTSTATUS status;
1673 unsigned int i;
1674 bool old_status;
1675
1676 old_status = domain->online;
1677 if (!cache->tdb)
1678 goto do_query;
1679
1680 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1681 if (!centry)
1682 goto do_query;
1683
1684 do_fetch_cache:
1685 *num_entries = centry_uint32(centry);
1686
1687 if (*num_entries == 0)
1688 goto do_cached;
1689
1690 (*info) = talloc_array(mem_ctx, struct wb_acct_info, *num_entries);
1691 if (! (*info)) {
1692 smb_panic_fn("enum_dom_groups out of memory");
1693 }
1694 for (i=0; i<(*num_entries); i++) {
1695 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1696 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1697 (*info)[i].rid = centry_uint32(centry);
1698 }
1699
1700 do_cached:
1701
1702 /* If we are returning cached data and the domain controller
1703 is down then we don't know whether the data is up to date
1704 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1705 indicate this. */
1706
1707 if (wcache_server_down(domain)) {
1708 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1709 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1710 } else
1711 status = centry->status;
1712
1713 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1714 domain->name, nt_errstr(status) ));
1715
1716 centry_free(centry);
1717 return status;
1718
1719 do_query:
1720 *num_entries = 0;
1721 *info = NULL;
1722
1723 /* Return status value returned by seq number check */
1724
1725 if (!NT_STATUS_IS_OK(domain->last_status))
1726 return domain->last_status;
1727
1728 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1729 domain->name ));
1730
1731 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1732
1733 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1734 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1735 if (!domain->internal && old_status) {
1736 set_domain_offline(domain);
1737 }
1738 if (cache->tdb &&
1739 !domain->internal &&
1740 !domain->online &&
1741 old_status) {
1742 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1743 if (centry) {
1744 goto do_fetch_cache;
1745 }
1746 }
1747 }
1748 /* and save it */
1749 refresh_sequence_number(domain, false);
1750 if (!NT_STATUS_IS_OK(status)) {
1751 return status;
1752 }
1753 centry = centry_start(domain, status);
1754 if (!centry)
1755 goto skip_save;
1756 centry_put_uint32(centry, *num_entries);
1757 for (i=0; i<(*num_entries); i++) {
1758 centry_put_string(centry, (*info)[i].acct_name);
1759 centry_put_string(centry, (*info)[i].acct_desc);
1760 centry_put_uint32(centry, (*info)[i].rid);
1761 }
1762 centry_end(centry, "GL/%s/local", domain->name);
1763 centry_free(centry);
1764
1765 skip_save:
1766 return status;
1767 }
1768
1769 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1770 const char *domain_name,
1771 const char *name,
1772 struct dom_sid *sid,
1773 enum lsa_SidType *type)
1774 {
1775 struct winbind_cache *cache = get_cache(domain);
1776 struct cache_entry *centry;
1777 NTSTATUS status;
1778 char *uname;
1779
1780 if (cache->tdb == NULL) {
1781 return NT_STATUS_NOT_FOUND;
1782 }
1783
1784 uname = talloc_strdup_upper(talloc_tos(), name);
1785 if (uname == NULL) {
1786 return NT_STATUS_NO_MEMORY;
1787 }
1788
1789 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1790 TALLOC_FREE(uname);
1791 if (centry == NULL) {
1792 return NT_STATUS_NOT_FOUND;
1793 }
1794
1795 status = centry->status;
1796 if (NT_STATUS_IS_OK(status)) {
1797 *type = (enum lsa_SidType)centry_uint32(centry);
1798 centry_sid(centry, sid);
1799 }
1800
1801 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1802 "%s\n", domain->name, nt_errstr(status) ));
1803
1804 centry_free(centry);
1805 return status;
1806 }
1807
1808 /* convert a single name to a sid in a domain */
1809 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1810 TALLOC_CTX *mem_ctx,
1811 const char *domain_name,
1812 const char *name,
1813 uint32_t flags,
1814 struct dom_sid *sid,
1815 enum lsa_SidType *type)
1816 {
1817 NTSTATUS status;
1818 bool old_status;
1819
1820 old_status = domain->online;
1821
1822 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1823 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1824 return status;
1825 }
1826
1827 ZERO_STRUCTP(sid);
1828
1829 /* If the seq number check indicated that there is a problem
1830 * with this DC, then return that status... except for
1831 * access_denied. This is special because the dc may be in
1832 * "restrict anonymous = 1" mode, in which case it will deny
1833 * most unauthenticated operations, but *will* allow the LSA
1834 * name-to-sid that we try as a fallback. */
1835
1836 if (!(NT_STATUS_IS_OK(domain->last_status)
1837 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1838 return domain->last_status;
1839
1840 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1841 domain->name ));
1842
1843 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1844 name, flags, sid, type);
1845
1846 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1847 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1848 if (!domain->internal && old_status) {
1849 set_domain_offline(domain);
1850 }
1851 if (!domain->internal &&
1852 !domain->online &&
1853 old_status) {
1854 NTSTATUS cache_status;
1855 cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1856 return cache_status;
1857 }
1858 }
1859 /* and save it */
1860 refresh_sequence_number(domain, false);
1861
1862 if (domain->online &&
1863 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1864 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1865
1866 /* Only save the reverse mapping if this was not a UPN */
1867 if (!strchr(name, '@')) {
1868 if (!strupper_m(discard_const_p(char, domain_name))) {
1869 return NT_STATUS_INVALID_PARAMETER;
1870 }
1871 (void)strlower_m(discard_const_p(char, name));
1872 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1873 }
1874 }
1875
1876 return status;
1877 }
1878
1879 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1880 const struct dom_sid *sid,
1881 TALLOC_CTX *mem_ctx,
1882 char **domain_name,
1883 char **name,
1884 enum lsa_SidType *type)
1885 {
1886 struct winbind_cache *cache = get_cache(domain);
1887 struct cache_entry *centry;
1888 char *sid_string;
1889 NTSTATUS status;
1890
1891 if (cache->tdb == NULL) {
1892 return NT_STATUS_NOT_FOUND;
1893 }
1894
1895 sid_string = sid_string_tos(sid);
1896 if (sid_string == NULL) {
1897 return NT_STATUS_NO_MEMORY;
1898 }
1899
1900 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1901 TALLOC_FREE(sid_string);
1902 if (centry == NULL) {
1903 return NT_STATUS_NOT_FOUND;
1904 }
1905
1906 if (NT_STATUS_IS_OK(centry->status)) {
1907 *type = (enum lsa_SidType)centry_uint32(centry);
1908 *domain_name = centry_string(centry, mem_ctx);
1909 *name = centry_string(centry, mem_ctx);
1910 }
1911
1912 status = centry->status;
1913 centry_free(centry);
1914
1915 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1916 "%s\n", domain->name, nt_errstr(status) ));
1917
1918 return status;
1919 }
1920
1921 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1922 given */
1923 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1924 TALLOC_CTX *mem_ctx,
1925 const struct dom_sid *sid,
1926 char **domain_name,
1927 char **name,
1928 enum lsa_SidType *type)
1929 {
1930 NTSTATUS status;
1931 bool old_status;
1932
1933 old_status = domain->online;
1934 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1935 type);
1936 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1937 return status;
1938 }
1939
1940 *name = NULL;
1941 *domain_name = NULL;
1942
1943 /* If the seq number check indicated that there is a problem
1944 * with this DC, then return that status... except for
1945 * access_denied. This is special because the dc may be in
1946 * "restrict anonymous = 1" mode, in which case it will deny
1947 * most unauthenticated operations, but *will* allow the LSA
1948 * sid-to-name that we try as a fallback. */
1949
1950 if (!(NT_STATUS_IS_OK(domain->last_status)
1951 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1952 return domain->last_status;
1953
1954 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1955 domain->name ));
1956
1957 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1958
1959 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1960 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1961 if (!domain->internal && old_status) {
1962 set_domain_offline(domain);
1963 }
1964 if (!domain->internal &&
1965 !domain->online &&
1966 old_status) {
1967 NTSTATUS cache_status;
1968 cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1969 domain_name, name, type);
1970 return cache_status;
1971 }
1972 }
1973 /* and save it */
1974 refresh_sequence_number(domain, false);
1975 if (!NT_STATUS_IS_OK(status)) {
1976 return status;
1977 }
1978 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1979
1980 /* We can't save the name to sid mapping here, as with sid history a
1981 * later name2sid would give the wrong sid. */
1982
1983 return status;
1984 }
1985
1986 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1987 TALLOC_CTX *mem_ctx,
1988 const struct dom_sid *domain_sid,
1989 uint32 *rids,
1990 size_t num_rids,
1991 char **domain_name,
1992 char ***names,
1993 enum lsa_SidType **types)
1994 {
1995 struct winbind_cache *cache = get_cache(domain);
1996 size_t i;
1997 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1998 bool have_mapped;
1999 bool have_unmapped;
2000 bool old_status;
2001
2002 old_status = domain->online;
2003 *domain_name = NULL;
2004 *names = NULL;
2005 *types = NULL;
2006
2007 if (!cache->tdb) {
2008 goto do_query;
2009 }
2010
2011 if (num_rids == 0) {
2012 return NT_STATUS_OK;
2013 }
2014
2015 *names = talloc_array(mem_ctx, char *, num_rids);
2016 *types = talloc_array(mem_ctx, enum lsa_SidType, num_rids);
2017
2018 if ((*names == NULL) || (*types == NULL)) {
2019 result = NT_STATUS_NO_MEMORY;
2020 goto error;
2021 }
2022
2023 have_mapped = have_unmapped = false;
2024
2025 for (i=0; i<num_rids; i++) {
2026 struct dom_sid sid;
2027 struct cache_entry *centry;
2028 fstring tmp;
2029
2030 if (!sid_compose(&sid, domain_sid, rids[i])) {
2031 result = NT_STATUS_INTERNAL_ERROR;
2032 goto error;
2033 }
2034
2035 centry = wcache_fetch(cache, domain, "SN/%s",
2036 sid_to_fstring(tmp, &sid));
2037 if (!centry) {
2038 goto do_query;
2039 }
2040
2041 (*types)[i] = SID_NAME_UNKNOWN;
2042 (*names)[i] = talloc_strdup(*names, "");
2043
2044 if (NT_STATUS_IS_OK(centry->status)) {
2045 char *dom;
2046 have_mapped = true;
2047 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2048
2049 dom = centry_string(centry, mem_ctx);
2050 if (*domain_name == NULL) {
2051 *domain_name = dom;
2052 } else {
2053 talloc_free(dom);
2054 }
2055
2056 (*names)[i] = centry_string(centry, *names);
2057
2058 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)
2059 || NT_STATUS_EQUAL(centry->status, STATUS_SOME_UNMAPPED)) {
2060 have_unmapped = true;
2061
2062 } else {
2063 /* something's definitely wrong */
2064 result = centry->status;
2065 goto error;
2066 }
2067
2068 centry_free(centry);
2069 }
2070
2071 if (!have_mapped) {
2072 return NT_STATUS_NONE_MAPPED;
2073 }
2074 if (!have_unmapped) {
2075 return NT_STATUS_OK;
2076 }
2077 return STATUS_SOME_UNMAPPED;
2078
2079 do_query:
2080
2081 TALLOC_FREE(*names);
2082 TALLOC_FREE(*types);
2083
2084 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2085 rids, num_rids, domain_name,
2086 names, types);
2087
2088 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2089 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2090 if (!domain->internal && old_status) {
2091 set_domain_offline(domain);
2092 }
2093 if (cache->tdb &&
2094 !domain->internal &&
2095 !domain->online &&
2096 old_status) {
2097 have_mapped = have_unmapped = false;
2098
2099 for (i=0; i<num_rids; i++) {
2100 struct dom_sid sid;
2101 struct cache_entry *centry;
2102 fstring tmp;
2103
2104 if (!sid_compose(&sid, domain_sid, rids[i])) {
2105 result = NT_STATUS_INTERNAL_ERROR;
2106 goto error;
2107 }
2108
2109 centry = wcache_fetch(cache, domain, "SN/%s",
2110 sid_to_fstring(tmp, &sid));
2111 if (!centry) {
2112 (*types)[i] = SID_NAME_UNKNOWN;
2113 (*names)[i] = talloc_strdup(*names, "");
2114 continue;
2115 }
2116
2117 (*types)[i] = SID_NAME_UNKNOWN;
2118 (*names)[i] = talloc_strdup(*names, "");
2119
2120 if (NT_STATUS_IS_OK(centry->status)) {
2121 char *dom;
2122 have_mapped = true;
2123 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2124
2125 dom = centry_string(centry, mem_ctx);
2126 if (*domain_name == NULL) {
2127 *domain_name = dom;
2128 } else {
2129 talloc_free(dom);
2130 }
2131
2132 (*names)[i] = centry_string(centry, *names);
2133
2134 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2135 have_unmapped = true;
2136
2137 } else {
2138 /* something's definitely wrong */
2139 result = centry->status;
2140 goto error;
2141 }
2142
2143 centry_free(centry);
2144 }
2145
2146 if (!have_mapped) {
2147 return NT_STATUS_NONE_MAPPED;
2148 }
2149 if (!have_unmapped) {
2150 return NT_STATUS_OK;
2151 }
2152 return STATUS_SOME_UNMAPPED;
2153 }
2154 }
2155 /*
2156 None of the queried rids has been found so save all negative entries
2157 */
2158 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2159 for (i = 0; i < num_rids; i++) {
2160 struct dom_sid sid;
2161 const char *name = "";
2162 const enum lsa_SidType type = SID_NAME_UNKNOWN;
2163 NTSTATUS status = NT_STATUS_NONE_MAPPED;
2164
2165 if (!sid_compose(&sid, domain_sid, rids[i])) {
2166 return NT_STATUS_INTERNAL_ERROR;
2167 }
2168
2169 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2170 name, type);
2171 }
2172
2173 return result;
2174 }
2175
2176 /*
2177 Some or all of the queried rids have been found.
2178 */
2179 if (!NT_STATUS_IS_OK(result) &&
2180 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2181 return result;
2182 }
2183
2184 refresh_sequence_number(domain, false);
2185
2186 for (i=0; i<num_rids; i++) {
2187 struct dom_sid sid;
2188 NTSTATUS status;
2189
2190 if (!sid_compose(&sid, domain_sid, rids[i])) {
2191 result = NT_STATUS_INTERNAL_ERROR;
2192 goto error;
2193 }
2194
2195 status = (*types)[i] == SID_NAME_UNKNOWN ?
2196 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2197
2198 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2199 (*names)[i], (*types)[i]);
2200 }
2201
2202 return result;
2203
2204 error:
2205 TALLOC_FREE(*names);
2206 TALLOC_FREE(*types);
2207 return result;
2208 }
2209
2210 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2211 TALLOC_CTX *mem_ctx,
2212 const struct dom_sid *user_sid,
2213 struct wbint_userinfo *info)
2214 {
2215 struct winbind_cache *cache = get_cache(domain);
2216 struct cache_entry *centry = NULL;
2217 NTSTATUS status;
2218 char *sid_string;
2219
2220 if (cache->tdb == NULL) {
2221 return NT_STATUS_NOT_FOUND;
2222 }
2223
2224 sid_string = sid_string_tos(user_sid);
2225 if (sid_string == NULL) {
2226 return NT_STATUS_NO_MEMORY;
2227 }
2228
2229 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2230 TALLOC_FREE(sid_string);
2231 if (centry == NULL) {
2232 return NT_STATUS_NOT_FOUND;
2233 }
2234
2235 /*
2236 * If we have an access denied cache entry and a cached info3
2237 * in the samlogon cache then do a query. This will force the
2238 * rpc back end to return the info3 data.
2239 */
2240
2241 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2242 netsamlogon_cache_have(user_sid)) {
2243 DEBUG(10, ("query_user: cached access denied and have cached "
2244 "info3\n"));
2245 domain->last_status = NT_STATUS_OK;
2246 centry_free(centry);
2247 return NT_STATUS_NOT_FOUND;
2248 }
2249
2250 /* if status is not ok then this is a negative hit
2251 and the rest of the data doesn't matter */
2252 status = centry->status;
2253 if (NT_STATUS_IS_OK(status)) {
2254 info->acct_name = centry_string(centry, mem_ctx);
2255 info->full_name = centry_string(centry, mem_ctx);
2256 info->homedir = centry_string(centry, mem_ctx);
2257 info->shell = centry_string(centry, mem_ctx);
2258 info->primary_gid = centry_uint32(centry);
2259 centry_sid(centry, &info->user_sid);
2260 centry_sid(centry, &info->group_sid);
2261 }
2262
2263 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2264 "%s\n", domain->name, nt_errstr(status) ));
2265
2266 centry_free(centry);
2267 return status;
2268 }
2269
2270 /* Lookup user information from a rid */
2271 static NTSTATUS query_user(struct winbindd_domain *domain,
2272 TALLOC_CTX *mem_ctx,
2273 const struct dom_sid *user_sid,
2274 struct wbint_userinfo *info)
2275 {
2276 NTSTATUS status;
2277 bool old_status;
2278
2279 old_status = domain->online;
2280 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2281 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2282 return status;
2283 }
2284
2285 ZERO_STRUCTP(info);
2286
2287 /* Return status value returned by seq number check */
2288
2289 if (!NT_STATUS_IS_OK(domain->last_status))
2290 return domain->last_status;
2291
2292 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2293 domain->name ));
2294
2295 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2296
2297 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2298 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2299 if (!domain->internal && old_status) {
2300 set_domain_offline(domain);
2301 }
2302 if (!domain->internal &&
2303 !domain->online &&
2304 old_status) {
2305 NTSTATUS cache_status;
2306 cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2307 return cache_status;
2308 }
2309 }
2310 /* and save it */
2311 refresh_sequence_number(domain, false);
2312 if (!NT_STATUS_IS_OK(status)) {
2313 return status;
2314 }
2315 wcache_save_user(domain, status, info);
2316
2317 return status;
2318 }
2319
2320 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2321 TALLOC_CTX *mem_ctx,
2322 const struct dom_sid *user_sid,
2323 uint32_t *pnum_sids,
2324 struct dom_sid **psids)
2325 {
2326 struct winbind_cache *cache = get_cache(domain);
2327 struct cache_entry *centry = NULL;
2328 NTSTATUS status;
2329 uint32_t i, num_sids;
2330 struct dom_sid *sids;
2331 fstring sid_string;
2332
2333 if (cache->tdb == NULL) {
2334 return NT_STATUS_NOT_FOUND;
2335 }
2336
2337 centry = wcache_fetch(cache, domain, "UG/%s",
2338 sid_to_fstring(sid_string, user_sid));
2339 if (centry == NULL) {
2340 return NT_STATUS_NOT_FOUND;
2341 }
2342
2343 /* If we have an access denied cache entry and a cached info3 in the
2344 samlogon cache then do a query. This will force the rpc back end
2345 to return the info3 data. */
2346
2347 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2348 && netsamlogon_cache_have(user_sid)) {
2349 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2350 "cached info3\n"));
2351 domain->last_status = NT_STATUS_OK;
2352 centry_free(centry);
2353 return NT_STATUS_NOT_FOUND;
2354 }
2355
2356 num_sids = centry_uint32(centry);
2357 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2358 if (sids == NULL) {
2359 centry_free(centry);
2360 return NT_STATUS_NO_MEMORY;
2361 }
2362
2363 for (i=0; i<num_sids; i++) {
2364 centry_sid(centry, &sids[i]);
2365 }
2366
2367 status = centry->status;
2368
2369 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2370 "status: %s\n", domain->name, nt_errstr(status)));
2371
2372 centry_free(centry);
2373
2374 *pnum_sids = num_sids;
2375 *psids = sids;
2376 return status;
2377 }
2378
2379 /* Lookup groups a user is a member of. */
2380 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2381 TALLOC_CTX *mem_ctx,
2382 const struct dom_sid *user_sid,
2383 uint32 *num_groups, struct dom_sid **user_gids)
2384 {
2385 struct cache_entry *centry = NULL;
2386 NTSTATUS status;
2387 unsigned int i;
2388 fstring sid_string;
2389 bool old_status;
2390
2391 old_status = domain->online;
2392 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2393 num_groups, user_gids);
2394 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2395 return status;
2396 }
2397
2398 (*num_groups) = 0;
2399 (*user_gids) = NULL;
2400
2401 /* Return status value returned by seq number check */
2402
2403 if (!NT_STATUS_IS_OK(domain->last_status))
2404 return domain->last_status;
2405
2406 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2407 domain->name ));
2408
2409 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2410
2411 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2412 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2413 if (!domain->internal && old_status) {
2414 set_domain_offline(domain);
2415 }
2416 if (!domain->internal &&
2417 !domain->online &&
2418 old_status) {
2419 NTSTATUS cache_status;
2420 cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2421 num_groups, user_gids);
2422 return cache_status;
2423 }
2424 }
2425 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2426 goto skip_save;
2427
2428 /* and save it */
2429 refresh_sequence_number(domain, false);
2430 if (!NT_STATUS_IS_OK(status)) {
2431 return status;
2432 }
2433 centry = centry_start(domain, status);
2434 if (!centry)
2435 goto skip_save;
2436
2437 centry_put_uint32(centry, *num_groups);
2438 for (i=0; i<(*num_groups); i++) {
2439 centry_put_sid(centry, &(*user_gids)[i]);
2440 }
2441
2442 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2443 centry_free(centry);
2444
2445 skip_save:
2446 return status;
2447 }
2448
2449 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2450 const struct dom_sid *sids)
2451 {
2452 uint32_t i;
2453 char *sidlist;
2454
2455 sidlist = talloc_strdup(mem_ctx, "");
2456 if (sidlist == NULL) {
2457 return NULL;
2458 }
2459 for (i=0; i<num_sids; i++) {
2460 fstring tmp;
2461 sidlist = talloc_asprintf_append_buffer(
2462 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2463 if (sidlist == NULL) {
2464 return NULL;
2465 }
2466 }
2467 return sidlist;
2468 }
2469
2470 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2471 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2472 const struct dom_sid *sids,
2473 uint32_t *pnum_aliases, uint32_t **paliases)
2474 {
2475 struct winbind_cache *cache = get_cache(domain);
2476 struct cache_entry *centry = NULL;
2477 uint32_t num_aliases;
2478 uint32_t *aliases;
2479 NTSTATUS status;
2480 char *sidlist;
2481 int i;
2482
2483 if (cache->tdb == NULL) {
2484 return NT_STATUS_NOT_FOUND;
2485 }
2486
2487 if (num_sids == 0) {
2488 *pnum_aliases = 0;
2489 *paliases = NULL;
2490 return NT_STATUS_OK;
2491 }
2492
2493 /* We need to cache indexed by the whole list of SIDs, the aliases
2494 * resulting might come from any of the SIDs. */
2495
2496 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2497 if (sidlist == NULL) {
2498 return NT_STATUS_NO_MEMORY;
2499 }
2500
2501 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2502 TALLOC_FREE(sidlist);
2503 if (centry == NULL) {
2504 return NT_STATUS_NOT_FOUND;
2505 }
2506
2507 num_aliases = centry_uint32(centry);
2508 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2509 if (aliases == NULL) {
2510 centry_free(centry);
2511 return NT_STATUS_NO_MEMORY;
2512 }
2513
2514 for (i=0; i<num_aliases; i++) {
2515 aliases[i] = centry_uint32(centry);
2516 }
2517
2518 status = centry->status;
2519
2520 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2521 "status %s\n", domain->name, nt_errstr(status)));
2522
2523 centry_free(centry);
2524
2525 *pnum_aliases = num_aliases;
2526 *paliases = aliases;
2527
2528 return status;
2529 }
2530
2531 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2532 TALLOC_CTX *mem_ctx,
2533 uint32 num_sids, const struct dom_sid *sids,
2534 uint32 *num_aliases, uint32 **alias_rids)
2535 {
2536 struct cache_entry *centry = NULL;
2537 NTSTATUS status;
2538 char *sidlist;
2539 int i;
2540 bool old_status;
2541
2542 old_status = domain->online;
2543 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2544 num_aliases, alias_rids);
2545 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2546 return status;
2547 }
2548
2549 (*num_aliases) = 0;
2550 (*alias_rids) = NULL;
2551
2552 if (!NT_STATUS_IS_OK(domain->last_status))
2553 return domain->last_status;
2554
2555 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2556 "for domain %s\n", domain->name ));
2557
2558 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2559 if (sidlist == NULL) {
2560 return NT_STATUS_NO_MEMORY;
2561 }
2562
2563 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2564 num_sids, sids,
2565 num_aliases, alias_rids);
2566
2567 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2568 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2569 if (!domain->internal && old_status) {
2570 set_domain_offline(domain);
2571 }
2572 if (!domain->internal &&
2573 !domain->online &&
2574 old_status) {
2575 NTSTATUS cache_status;
2576 cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2577 sids, num_aliases, alias_rids);
2578 return cache_status;
2579 }
2580 }
2581 /* and save it */
2582 refresh_sequence_number(domain, false);
2583 if (!NT_STATUS_IS_OK(status)) {
2584 return status;
2585 }
2586 centry = centry_start(domain, status);
2587 if (!centry)
2588 goto skip_save;
2589 centry_put_uint32(centry, *num_aliases);
2590 for (i=0; i<(*num_aliases); i++)
2591 centry_put_uint32(centry, (*alias_rids)[i]);
2592 centry_end(centry, "UA%s", sidlist);
2593 centry_free(centry);
2594
2595 skip_save:
2596 return status;
2597 }
2598
2599 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2600 TALLOC_CTX *mem_ctx,
2601 const struct dom_sid *group_sid,
2602 uint32_t *num_names,
2603 struct dom_sid **sid_mem, char ***names,
2604 uint32_t **name_types)
2605 {
2606 struct winbind_cache *cache = get_cache(domain);
2607 struct cache_entry *centry = NULL;
2608 NTSTATUS status;
2609 unsigned int i;
2610 char *sid_string;
2611
2612 if (cache->tdb == NULL) {
2613 return NT_STATUS_NOT_FOUND;
2614 }
2615
2616 sid_string = sid_string_tos(group_sid);
2617 if (sid_string == NULL) {
2618 return NT_STATUS_NO_MEMORY;
2619 }
2620
2621 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2622 TALLOC_FREE(sid_string);
2623 if (centry == NULL) {
2624 return NT_STATUS_NOT_FOUND;
2625 }
2626
2627 *sid_mem = NULL;
2628 *names = NULL;
2629 *name_types = NULL;
2630
2631 *num_names = centry_uint32(centry);
2632 if (*num_names == 0) {
2633 centry_free(centry);
2634 return NT_STATUS_OK;
2635 }
2636
2637 *sid_mem = talloc_array(mem_ctx, struct dom_sid, *num_names);
2638 *names = talloc_array(mem_ctx, char *, *num_names);
2639 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2640
2641 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2642 TALLOC_FREE(*sid_mem);
2643 TALLOC_FREE(*names);
2644 TALLOC_FREE(*name_types);
2645 centry_free(centry);
2646 return NT_STATUS_NO_MEMORY;
2647 }
2648
2649 for (i=0; i<(*num_names); i++) {
2650 centry_sid(centry, &(*sid_mem)[i]);
2651 (*names)[i] = centry_string(centry, mem_ctx);
2652 (*name_types)[i] = centry_uint32(centry);
2653 }
2654
2655 status = centry->status;
2656
2657 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2658 "status: %s\n", domain->name, nt_errstr(status)));
2659
2660 centry_free(centry);
2661 return status;
2662 }
2663
2664 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2665 TALLOC_CTX *mem_ctx,
2666 const struct dom_sid *group_sid,
2667 enum lsa_SidType type,
2668 uint32 *num_names,
2669 struct dom_sid **sid_mem, char ***names,
2670 uint32 **name_types)
2671 {
2672 struct cache_entry *centry = NULL;
2673 NTSTATUS status;
2674 unsigned int i;
2675 fstring sid_string;
2676 bool old_status;
2677
2678 old_status = domain->online;
2679 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2680 sid_mem, names, name_types);
2681 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2682 return status;
2683 }
2684
2685 (*num_names) = 0;
2686 (*sid_mem) = NULL;
2687 (*names) = NULL;
2688 (*name_types) = NULL;
2689
2690 /* Return status value returned by seq number check */
2691
2692 if (!NT_STATUS_IS_OK(domain->last_status))
2693 return domain->last_status;
2694
2695 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2696 domain->name ));
2697
2698 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2699 type, num_names,
2700 sid_mem, names, name_types);
2701
2702 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2703 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2704 if (!domain->internal && old_status) {
2705 set_domain_offline(domain);
2706 }
2707 if (!domain->internal &&
2708 !domain->online &&
2709 old_status) {
2710 NTSTATUS cache_status;
2711 cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2712 num_names, sid_mem, names,
2713 name_types);
2714 return cache_status;
2715 }
2716 }
2717 /* and save it */
2718 refresh_sequence_number(domain, false);
2719 if (!NT_STATUS_IS_OK(status)) {
2720 return status;
2721 }
2722 centry = centry_start(domain, status);
2723 if (!centry)
2724 goto skip_save;
2725 centry_put_uint32(centry, *num_names);
2726 for (i=0; i<(*num_names); i++) {
2727 centry_put_sid(centry, &(*sid_mem)[i]);
2728 centry_put_string(centry, (*names)[i]);
2729 centry_put_uint32(centry, (*name_types)[i]);
2730 }
2731 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2732 centry_free(centry);
2733
2734 skip_save:
2735 return status;
2736 }
2737
2738 /* find the sequence number for a domain */
2739 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2740 {
2741 refresh_sequence_number(domain, false);
2742
2743 *seq = domain->sequence_number;
2744
2745 return NT_STATUS_OK;
2746 }
2747
2748 /* enumerate trusted domains
2749 * (we need to have the list of trustdoms in the cache when we go offline) -
2750 * Guenther */
2751 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2752 TALLOC_CTX *mem_ctx,
2753 struct netr_DomainTrustList *trusts)
2754 {
2755 NTSTATUS status;
2756 struct winbind_cache *cache;
2757 struct winbindd_tdc_domain *dom_list = NULL;
2758 size_t num_domains = 0;
2759 bool retval = false;
2760 int i;
2761 bool old_status;
2762
2763 old_status = domain->online;
2764 trusts->count = 0;
2765 trusts->array = NULL;
2766
2767 cache = get_cache(domain);
2768 if (!cache || !cache->tdb) {
2769 goto do_query;
2770 }
2771
2772 if (domain->online) {
2773 goto do_query;
2774 }
2775
2776 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2777 if (!retval || !num_domains || !dom_list) {
2778 TALLOC_FREE(dom_list);
2779 goto do_query;
2780 }
2781
2782 do_fetch_cache:
2783 trusts->array = talloc_zero_array(mem_ctx, struct netr_DomainTrust, num_domains);
2784 if (!trusts->array) {
2785 TALLOC_FREE(dom_list);
2786 return NT_STATUS_NO_MEMORY;
2787 }
2788
2789 for (i = 0; i < num_domains; i++) {
2790 struct netr_DomainTrust *trust;
2791 struct dom_sid *sid;
2792 struct winbindd_domain *dom;
2793
2794 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2795 if (dom && dom->internal) {
2796 continue;
2797 }
2798
2799 trust = &trusts->array[trusts->count];
2800 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2801 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2802 sid = talloc(trusts->array, struct dom_sid);
2803 if (!trust->netbios_name || !trust->dns_name ||
2804 !sid) {
2805 TALLOC_FREE(dom_list);
2806 TALLOC_FREE(trusts->array);
2807 return NT_STATUS_NO_MEMORY;
2808 }
2809
2810 trust->trust_flags = dom_list[i].trust_flags;
2811 trust->trust_attributes = dom_list[i].trust_attribs;
2812 trust->trust_type = dom_list[i].trust_type;
2813 sid_copy(sid, &dom_list[i].sid);
2814 trust->sid = sid;
2815 trusts->count++;
2816 }
2817
2818 TALLOC_FREE(dom_list);
2819 return NT_STATUS_OK;
2820
2821 do_query:
2822 /* Return status value returned by seq number check */
2823
2824 if (!NT_STATUS_IS_OK(domain->last_status))
2825 return domain->last_status;
2826
2827 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2828 domain->name ));
2829
2830 status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2831
2832 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2833 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2834 if (!domain->internal && old_status) {
2835 set_domain_offline(domain);
2836 }
2837 if (!domain->internal &&
2838 !domain->online &&
2839 old_status) {
2840 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2841 if (retval && num_domains && dom_list) {
2842 TALLOC_FREE(trusts->array);
2843 trusts->count = 0;
2844 goto do_fetch_cache;
2845 }
2846 }
2847 }
2848 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2849 * so that the generic centry handling still applies correctly -
2850 * Guenther*/
2851
2852 if (!NT_STATUS_IS_ERR(status)) {
2853 status = NT_STATUS_OK;
2854 }
2855 return status;
2856 }
2857
2858 /* get lockout policy */
2859 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2860 TALLOC_CTX *mem_ctx,
2861 struct samr_DomInfo12 *policy)
2862 {
2863 struct winbind_cache *cache = get_cache(domain);
2864 struct cache_entry *centry = NULL;
2865 NTSTATUS status;
2866 bool old_status;
2867
2868 old_status = domain->online;
2869 if (!cache->tdb)
2870 goto do_query;
2871
2872 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2873
2874 if (!centry)
2875 goto do_query;
2876
2877 do_fetch_cache:
2878 policy->lockout_duration = centry_nttime(centry);
2879 policy->lockout_window = centry_nttime(centry);
2880 policy->lockout_threshold = centry_uint16(centry);
2881
2882 status = centry->status;
2883
2884 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2885 domain->name, nt_errstr(status) ));
2886
2887 centry_free(centry);
2888 return status;
2889
2890 do_query:
2891 ZERO_STRUCTP(policy);
2892
2893 /* Return status value returned by seq number check */
2894
2895 if (!NT_STATUS_IS_OK(domain->last_status))
2896 return domain->last_status;
2897
2898 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2899 domain->name ));
2900
2901 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2902
2903 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2904 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2905 if (!domain->internal && old_status) {
2906 set_domain_offline(domain);
2907 }
2908 if (cache->tdb &&
2909 !domain->internal &&
2910 !domain->online &&
2911 old_status) {
2912 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2913 if (centry) {
2914 goto do_fetch_cache;
2915 }
2916 }
2917 }
2918 /* and save it */
2919 refresh_sequence_number(domain, false);
2920 if (!NT_STATUS_IS_OK(status)) {
2921 return status;
2922 }
2923 wcache_save_lockout_policy(domain, status, policy);
2924
2925 return status;
2926 }
2927
2928 /* get password policy */
2929 static NTSTATUS password_policy(struct winbindd_domain *domain,
2930 TALLOC_CTX *mem_ctx,
2931 struct samr_DomInfo1 *policy)
2932 {
2933 struct winbind_cache *cache = get_cache(domain);
2934 struct cache_entry *centry = NULL;
2935 NTSTATUS status;
2936 bool old_status;
2937
2938 old_status = domain->online;
2939 if (!cache->tdb)
2940 goto do_query;
2941
2942 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2943
2944 if (!centry)
2945 goto do_query;
2946
2947 do_fetch_cache:
2948 policy->min_password_length = centry_uint16(centry);
2949 policy->password_history_length = centry_uint16(centry);
2950 policy->password_properties = centry_uint32(centry);
2951 policy->max_password_age = centry_nttime(centry);
2952 policy->min_password_age = centry_nttime(centry);
2953
2954 status = centry->status;
2955
2956 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2957 domain->name, nt_errstr(status) ));
2958
2959 centry_free(centry);
2960 return status;
2961
2962 do_query:
2963 ZERO_STRUCTP(policy);
2964
2965 /* Return status value returned by seq number check */
2966
2967 if (!NT_STATUS_IS_OK(domain->last_status))
2968 return domain->last_status;
2969
2970 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2971 domain->name ));
2972
2973 status = domain->backend->password_policy(domain, mem_ctx, policy);
2974
2975 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2976 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2977 if (!domain->internal && old_status) {
2978 set_domain_offline(domain);
2979 }
2980 if (cache->tdb &&
2981 !domain->internal &&
2982 !domain->online &&
2983 old_status) {
2984 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2985 if (centry) {
2986 goto do_fetch_cache;
2987 }
2988 }
2989 }
2990 /* and save it */
2991 refresh_sequence_number(domain, false);
2992 if (!NT_STATUS_IS_OK(status)) {
2993 return status;
2994 }
2995 wcache_save_password_policy(domain, status, policy);
2996
2997 return status;
2998 }
2999
3000
3001 /* Invalidate cached user and group lists coherently */
3002
3003 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3004 void *state)
3005 {
3006 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
3007 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
3008 tdb_delete(the_tdb, kbuf);
3009
3010 return 0;
3011 }
3012
3013 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
3014
3015 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
3016 const struct dom_sid *sid)
3017 {
3018 fstring key_str, sid_string;
3019 struct winbind_cache *cache;
3020
3021 /* dont clear cached U/SID and UG/SID entries when we want to logon
3022 * offline - gd */
3023
3024 if (lp_winbind_offline_logon()) {
3025 return;
3026 }
3027
3028 if (!domain)
3029 return;
3030
3031 cache = get_cache(domain);
3032
3033 if (!cache->tdb) {
3034 return;
3035 }
3036
3037 /* Clear U/SID cache entry */
3038 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, sid));
3039 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3040 tdb_delete(cache->tdb, string_tdb_data(key_str));
3041
3042 /* Clear UG/SID cache entry */
3043 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, sid));
3044 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3045 tdb_delete(cache->tdb, string_tdb_data(key_str));
3046
3047 /* Samba/winbindd never needs this. */
3048 netsamlogon_clear_cached_user(sid);
3049 }
3050
3051 bool wcache_invalidate_cache(void)
3052 {
3053 struct winbindd_domain *domain;
3054
3055 for (domain = domain_list(); domain; domain = domain->next) {
3056 struct winbind_cache *cache = get_cache(domain);
3057
3058 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3059 "entries for %s\n", domain->name));
3060 if (cache) {
3061 if (cache->tdb) {
3062 tdb_traverse(cache->tdb, traverse_fn, NULL);
3063 } else {
3064 return false;
3065 }
3066 }
3067 }
3068 return true;
3069 }
3070
3071 bool wcache_invalidate_cache_noinit(void)
3072 {
3073 struct winbindd_domain *domain;
3074
3075 for (domain = domain_list(); domain; domain = domain->next) {
3076 struct winbind_cache *cache;
3077
3078 /* Skip uninitialized domains. */
3079 if (!domain->initialized && !domain->internal) {
3080 continue;
3081 }
3082
3083 cache = get_cache(domain);
3084
3085 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3086 "entries for %s\n", domain->name));
3087 if (cache) {
3088 if (cache->tdb) {
3089 tdb_traverse(cache->tdb, traverse_fn, NULL);
3090 /*
3091 * Flushing cache has nothing to with domains.
3092 * return here if we successfully flushed once.
3093 * To avoid unnecessary traversing the cache.
3094 */
3095 return true;
3096 } else {
3097 return false;
3098 }
3099 }
3100 }
3101 return true;
3102 }
3103
3104 bool init_wcache(void)
3105 {
3106 if (wcache == NULL) {
3107 wcache = SMB_XMALLOC_P(struct winbind_cache);
3108 ZERO_STRUCTP(wcache);
3109 }
3110
3111 if (wcache->tdb != NULL)
3112 return true;
3113
3114 /* when working offline we must not clear the cache on restart */
3115 wcache->tdb = tdb_open_log(state_path("winbindd_cache.tdb"),
3116 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3117 TDB_INCOMPATIBLE_HASH |
3118 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3119 O_RDWR|O_CREAT, 0600);
3120
3121 if (wcache->tdb == NULL) {
3122 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3123 return false;
3124 }
3125
3126 return true;
3127 }
3128
3129 /************************************************************************
3130 This is called by the parent to initialize the cache file.
3131 We don't need sophisticated locking here as we know we're the
3132 only opener.
3133 ************************************************************************/
3134
3135 bool initialize_winbindd_cache(void)
3136 {
3137 bool cache_bad = true;
3138 uint32 vers;
3139
3140 if (!init_wcache()) {
3141 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3142 return false;
3143 }
3144
3145 /* Check version number. */
3146 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3147 vers == WINBINDD_CACHE_VERSION) {
3148 cache_bad = false;
3149 }
3150
3151 if (cache_bad) {
3152 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3153 "and re-creating with version number %d\n",
3154 WINBINDD_CACHE_VERSION ));
3155
3156 tdb_close(wcache->tdb);
3157 wcache->tdb = NULL;
3158
3159 if (unlink(state_path("winbindd_cache.tdb")) == -1) {
3160 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3161 state_path("winbindd_cache.tdb"),
3162 strerror(errno) ));
3163 return false;
3164 }
3165 if (!init_wcache()) {
3166 DEBUG(0,("initialize_winbindd_cache: re-initialization "
3167 "init_wcache failed.\n"));
3168 return false;
3169 }
3170
3171 /* Write the version. */
3172 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3173 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3174 tdb_errorstr_compat(wcache->tdb) ));
3175 return false;
3176 }
3177 }
3178
3179 tdb_close(wcache->tdb);
3180 wcache->tdb = NULL;
3181 return true;
3182 }
3183
3184 void close_winbindd_cache(void)
3185 {
3186 if (!wcache) {
3187 return;
3188 }
3189 if (wcache->tdb) {
3190 tdb_close(wcache->tdb);
3191 wcache->tdb = NULL;
3192 }
3193 }
3194
3195 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
3196 char **domain_name, char **name,
3197 enum lsa_SidType *type)
3198 {
3199 struct winbindd_domain *domain;
3200 NTSTATUS status;
3201
3202 domain = find_lookup_domain_from_sid(sid);
3203 if (domain == NULL) {
3204 return false;
3205 }
3206 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3207 type);
3208 return NT_STATUS_IS_OK(status);
3209 }
3210
3211 bool lookup_cached_name(const char *domain_name,
3212 const char *name,
3213 struct dom_sid *sid,
3214 enum lsa_SidType *type)
3215 {
3216 struct winbindd_domain *domain;
3217 NTSTATUS status;
3218 bool original_online_state;
3219
3220 domain = find_lookup_domain_from_name(domain_name);
3221 if (domain == NULL) {
3222 return false;
3223 }
3224
3225 /* If we are doing a cached logon, temporarily set the domain
3226 offline so the cache won't expire the entry */
3227
3228 original_online_state = domain->online;
3229 domain->online = false;
3230 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3231 domain->online = original_online_state;
3232
3233 return NT_STATUS_IS_OK(status);
3234 }
3235
3236 void cache_name2sid(struct winbindd_domain *domain,
3237 const char *domain_name, const char *name,
3238 enum lsa_SidType type, const struct dom_sid *sid)
3239 {
3240 refresh_sequence_number(domain, false);
3241 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3242 sid, type);
3243 }
3244
3245 /*
3246 * The original idea that this cache only contains centries has
3247 * been blurred - now other stuff gets put in here. Ensure we
3248 * ignore these things on cleanup.
3249 */
3250
3251 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3252 TDB_DATA dbuf, void *state)
3253 {
3254 struct cache_entry *centry;
3255
3256 if (is_non_centry_key(kbuf)) {
3257 return 0;
3258 }
3259
3260 centry = wcache_fetch_raw((char *)kbuf.dptr);
3261 if (!centry) {
3262 return 0;
3263 }
3264
3265 if (!NT_STATUS_IS_OK(centry->status)) {
3266 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3267 tdb_delete(the_tdb, kbuf);
3268 }
3269
3270 centry_free(centry);
3271 return 0;
3272 }
3273
3274 /* flush the cache */
3275 void wcache_flush_cache(void)
3276 {
3277 if (!wcache)
3278 return;
3279 if (wcache->tdb) {
3280 tdb_close(wcache->tdb);
3281 wcache->tdb = NULL;
3282 }
3283 if (!winbindd_use_cache()) {
3284 return;
3285 }
3286
3287 /* when working offline we must not clear the cache on restart */
3288 wcache->tdb = tdb_open_log(state_path("winbindd_cache.tdb"),
3289 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3290 TDB_INCOMPATIBLE_HASH |
3291 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3292 O_RDWR|O_CREAT, 0600);
3293
3294 if (!wcache->tdb) {
3295 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3296 return;
3297 }
3298
3299 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3300
3301 DEBUG(10,("wcache_flush_cache success\n"));
3302 }
3303
3304 /* Count cached creds */
3305
3306 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3307 void *state)
3308 {
3309 int *cred_count = (int*)state;
3310
3311 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3312 (*cred_count)++;
3313 }
3314 return 0;
3315 }
3316
3317 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3318 {
3319 struct winbind_cache *cache = get_cache(domain);
3320
3321 *count = 0;
3322
3323 if (!cache->tdb) {
3324 return NT_STATUS_INTERNAL_DB_ERROR;
3325 }
3326
3327 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3328
3329 return NT_STATUS_OK;
3330 }
3331
3332 struct cred_list {
3333 struct cred_list *prev, *next;
3334 TDB_DATA key;
3335 fstring name;
3336 time_t created;
3337 };
3338 static struct cred_list *wcache_cred_list;
3339
3340 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3341 void *state)
3342 {
3343 struct cred_list *cred;
3344
3345 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3346
3347 cred = SMB_MALLOC_P(struct cred_list);
3348 if (cred == NULL) {
3349 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3350 return -1;
3351 }
3352
3353 ZERO_STRUCTP(cred);
3354
3355 /* save a copy of the key */
3356
3357 fstrcpy(cred->name, (const char *)kbuf.dptr);
3358 DLIST_ADD(wcache_cred_list, cred);
3359 }
3360
3361 return 0;
3362 }
3363
3364 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const struct dom_sid *sid)
3365 {
3366 struct winbind_cache *cache = get_cache(domain);
3367 NTSTATUS status;
3368 int ret;
3369 struct cred_list *cred, *oldest = NULL;
3370
3371 if (!cache->tdb) {
3372 return NT_STATUS_INTERNAL_DB_ERROR;
3373 }
3374
3375 /* we possibly already have an entry */
3376 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3377
3378 fstring key_str, tmp;
3379
3380 DEBUG(11,("we already have an entry, deleting that\n"));
3381
3382 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3383
3384 tdb_delete(cache->tdb, string_tdb_data(key_str));
3385
3386 return NT_STATUS_OK;
3387 }
3388
3389 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3390 if (ret == 0) {
3391 return NT_STATUS_OK;
3392 } else if ((ret < 0) || (wcache_cred_list == NULL)) {
3393 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3394 }
3395
3396 ZERO_STRUCTP(oldest);
3397
3398 for (cred = wcache_cred_list; cred; cred = cred->next) {
3399
3400 TDB_DATA data;
3401 time_t t;
3402
3403 data = tdb_fetch_compat(cache->tdb, string_tdb_data(cred->name));
3404 if (!data.dptr) {
3405 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3406 cred->name));
3407 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3408 goto done;
3409 }
3410
3411 t = IVAL(data.dptr, 0);
3412 SAFE_FREE(data.dptr);
3413
3414 if (!oldest) {
3415 oldest = SMB_MALLOC_P(struct cred_list);
3416 if (oldest == NULL) {
3417 status = NT_STATUS_NO_MEMORY;
3418 goto done;
3419 }
3420
3421 fstrcpy(oldest->name, cred->name);
3422 oldest->created = t;
3423 continue;
3424 }
3425
3426 if (t < oldest->created) {
3427 fstrcpy(oldest->name, cred->name);
3428 oldest->created = t;
3429 }
3430 }
3431
3432 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3433 status = NT_STATUS_OK;
3434 } else {
3435 status = NT_STATUS_UNSUCCESSFUL;
3436 }
3437 done:
3438 SAFE_FREE(wcache_cred_list);
3439 SAFE_FREE(oldest);
3440
3441 return status;
3442 }
3443
3444 /* Change the global online/offline state. */
3445 bool set_global_winbindd_state_offline(void)
3446 {
3447 TDB_DATA data;
3448
3449 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3450
3451 /* Only go offline if someone has created
3452 the key "WINBINDD_OFFLINE" in the cache tdb. */
3453
3454 if (wcache == NULL || wcache->tdb == NULL) {
3455 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3456 return false;
3457 }
3458
3459 if (!lp_winbind_offline_logon()) {
3460 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3461 return false;
3462 }
3463
3464 if (global_winbindd_offline_state) {
3465 /* Already offline. */
3466 return true;
3467 }
3468
3469 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3470
3471 if (!data.dptr || data.dsize != 4) {
3472 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3473 SAFE_FREE(data.dptr);
3474 return false;
3475 } else {
3476 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3477 global_winbindd_offline_state = true;
3478 SAFE_FREE(data.dptr);
3479 return true;
3480 }
3481 }
3482
3483 void set_global_winbindd_state_online(void)
3484 {
3485 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3486
3487 if (!lp_winbind_offline_logon()) {
3488 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3489 return;
3490 }
3491
3492 if (!global_winbindd_offline_state) {
3493 /* Already online. */
3494 return;
3495 }
3496 global_winbindd_offline_state = false;
3497
3498 if (!wcache->tdb) {
3499 return;
3500 }
3501
3502 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3503 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3504 }
3505
3506 bool get_global_winbindd_state_offline(void)
3507 {
3508 return global_winbindd_offline_state;
3509 }
3510
3511 /***********************************************************************
3512 Validate functions for all possible cache tdb keys.
3513 ***********************************************************************/
3514
3515 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3516 struct tdb_validation_status *state)
3517 {
3518 struct cache_entry *centry;
3519
3520 centry = SMB_XMALLOC_P(struct cache_entry);
3521 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3522 if (!centry->data) {
3523 SAFE_FREE(centry);
3524 return NULL;
3525 }
3526 centry->len = data.dsize;
3527 centry->ofs = 0;
3528
3529 if (centry->len < 16) {
3530 /* huh? corrupt cache? */
3531 DEBUG(0,("create_centry_validate: Corrupt cache for key %s "
3532 "(len < 16) ?\n", kstr));
3533 centry_free(centry);
3534 state->bad_entry = true;
3535 state->success = false;
3536 return NULL;
3537 }
3538
3539 centry->status = NT_STATUS(centry_uint32(centry));
3540 centry->sequence_number = centry_uint32(centry);
3541 centry->timeout = centry_uint64_t(centry);
3542 return centry;
3543 }
3544
3545 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3546 struct tdb_validation_status *state)
3547 {
3548 if (dbuf.dsize != 8) {
3549 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3550 keystr, (unsigned int)dbuf.dsize ));
3551 state->bad_entry = true;
3552 return 1;
3553 }
3554 return 0;
3555 }
3556
3557 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3558 struct tdb_validation_status *state)
3559 {
3560 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3561 if (!centry) {
3562 return 1;
3563 }
3564
3565 (void)centry_uint32(centry);
3566 if (NT_STATUS_IS_OK(centry->status)) {
3567 struct dom_sid sid;
3568 (void)centry_sid(centry, &sid);
3569 }
3570
3571 centry_free(centry);
3572
3573 if (!(state->success)) {
3574 return 1;
3575 }
3576 DEBUG(10,("validate_ns: %s ok\n", keystr));
3577 return 0;
3578 }
3579
3580 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3581 struct tdb_validation_status *state)
3582 {
3583 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3584 if (!centry) {
3585 return 1;
3586 }
3587
3588 if (NT_STATUS_IS_OK(centry->status)) {
3589 (void)centry_uint32(centry);
3590 (void)centry_string(centry, mem_ctx);
3591 (void)centry_string(centry, mem_ctx);
3592 }
3593
3594 centry_free(centry);
3595
3596 if (!(state->success)) {
3597 return 1;
3598 }
3599 DEBUG(10,("validate_sn: %s ok\n", keystr));
3600 return 0;
3601 }
3602
3603 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3604 struct tdb_validation_status *state)
3605 {
3606 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3607 struct dom_sid sid;
3608
3609 if (!centry) {
3610 return 1;
3611 }
3612
3613 (void)centry_string(centry, mem_ctx);
3614 (void)centry_string(centry, mem_ctx);
3615 (void)centry_string(centry, mem_ctx);
3616 (void)centry_string(centry, mem_ctx);
3617 (void)centry_uint32(centry);
3618 (void)centry_sid(centry, &sid);
3619 (void)centry_sid(centry, &sid);
3620
3621 centry_free(centry);
3622
3623 if (!(state->success)) {
3624 return 1;
3625 }
3626 DEBUG(10,("validate_u: %s ok\n", keystr));
3627 return 0;
3628 }
3629
3630 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3631 struct tdb_validation_status *state)
3632 {
3633 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3634
3635 if (!centry) {
3636 return 1;
3637 }
3638
3639 (void)centry_nttime(centry);
3640 (void)centry_nttime(centry);
3641 (void)centry_uint16(centry);
3642
3643 centry_free(centry);
3644
3645 if (!(state->success)) {
3646 return 1;
3647 }
3648 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3649 return 0;
3650 }
3651
3652 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3653 struct tdb_validation_status *state)
3654 {
3655 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3656
3657 if (!centry) {
3658 return 1;
3659 }
3660
3661 (void)centry_uint16(centry);
3662 (void)centry_uint16(centry);
3663 (void)centry_uint32(centry);
3664 (void)centry_nttime(centry);
3665 (void)centry_nttime(centry);
3666
3667 centry_free(centry);
3668
3669 if (!(state->success)) {
3670 return 1;
3671 }
3672 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3673 return 0;
3674 }
3675
3676 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3677 struct tdb_validation_status *state)
3678 {
3679 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3680
3681 if (!centry) {
3682 return 1;
3683 }
3684
3685 (void)centry_time(centry);
3686 (void)centry_hash16(centry, mem_ctx);
3687
3688 /* We only have 17 bytes more data in the salted cred case. */
3689 if (centry->len - centry->ofs == 17) {
3690 (void)centry_hash16(centry, mem_ctx);
3691 }
3692
3693 centry_free(centry);
3694
3695 if (!(state->success)) {
3696 return 1;
3697 }
3698 DEBUG(10,("validate_cred: %s ok\n", keystr));
3699 return 0;
3700 }
3701
3702 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3703 struct tdb_validation_status *state)
3704 {
3705 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3706 int32 num_entries, i;
3707
3708 if (!centry) {
3709 return 1;
3710 }
3711
3712 num_entries = (int32)centry_uint32(centry);
3713
3714 for (i=0; i< num_entries; i++) {
3715 struct dom_sid sid;
3716 (void)centry_string(centry, mem_ctx);
3717 (void)centry_string(centry, mem_ctx);
3718 (void)centry_string(centry, mem_ctx);
3719 (void)centry_string(centry, mem_ctx);
3720 (void)centry_sid(centry, &sid);
3721 (void)centry_sid(centry, &sid);
3722 }
3723
3724 centry_free(centry);
3725
3726 if (!(state->success)) {
3727 return 1;
3728 }
3729 DEBUG(10,("validate_ul: %s ok\n", keystr));
3730 return 0;
3731 }
3732
3733 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3734 struct tdb_validation_status *state)
3735 {
3736 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3737 int32 num_entries, i;
3738
3739 if (!centry) {
3740 return 1;
3741 }
3742
3743 num_entries = centry_uint32(centry);
3744
3745 for (i=0; i< num_entries; i++) {
3746 (void)centry_string(centry, mem_ctx);
3747 (void)centry_string(centry, mem_ctx);
3748 (void)centry_uint32(centry);
3749 }
3750
3751 centry_free(centry);
3752
3753 if (!(state->success)) {
3754 return 1;
3755 }
3756 DEBUG(10,("validate_gl: %s ok\n", keystr));
3757 return 0;
3758 }
3759
3760 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3761 struct tdb_validation_status *state)
3762 {
3763 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3764 int32 num_groups, i;
3765
3766 if (!centry) {
3767 return 1;
3768 }
3769
3770 num_groups = centry_uint32(centry);
3771
3772 for (i=0; i< num_groups; i++) {
3773 struct dom_sid sid;
3774 centry_sid(centry, &sid);
3775 }
3776
3777 centry_free(centry);
3778
3779 if (!(state->success)) {
3780 return 1;
3781 }
3782 DEBUG(10,("validate_ug: %s ok\n", keystr));
3783 return 0;
3784 }
3785
3786 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3787 struct tdb_validation_status *state)
3788 {
3789 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3790 int32 num_aliases, i;
3791
3792 if (!centry) {
3793 return 1;
3794 }
3795
3796 num_aliases = centry_uint32(centry);
3797
3798 for (i=0; i < num_aliases; i++) {
3799 (void)centry_uint32(centry);
3800 }
3801
3802 centry_free(centry);
3803
3804 if (!(state->success)) {
3805 return 1;
3806 }
3807 DEBUG(10,("validate_ua: %s ok\n", keystr));
3808 return 0;
3809 }
3810
3811 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3812 struct tdb_validation_status *state)
3813 {
3814 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3815 int32 num_names, i;
3816
3817 if (!centry) {
3818 return 1;
3819 }
3820
3821 num_names = centry_uint32(centry);
3822
3823 for (i=0; i< num_names; i++) {
3824 struct dom_sid sid;
3825 centry_sid(centry, &sid);
3826 (void)centry_string(centry, mem_ctx);
3827 (void)centry_uint32(centry);
3828 }
3829
3830 centry_free(centry);
3831
3832 if (!(state->success)) {
3833 return 1;
3834 }
3835 DEBUG(10,("validate_gm: %s ok\n", keystr));
3836 return 0;
3837 }
3838
3839 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3840 struct tdb_validation_status *state)
3841 {
3842 /* Can't say anything about this other than must be nonzero. */
3843 if (dbuf.dsize == 0) {
3844 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3845 keystr));
3846 state->bad_entry = true;
3847 state->success = false;
3848 return 1;
3849 }
3850
3851 DEBUG(10,("validate_dr: %s ok\n", keystr));
3852 return 0;
3853 }
3854
3855 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3856 struct tdb_validation_status *state)
3857 {
3858 /* Can't say anything about this other than must be nonzero. */
3859 if (dbuf.dsize == 0) {
3860 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3861 keystr));
3862 state->bad_entry = true;
3863 state->success = false;
3864 return 1;
3865 }
3866
3867 DEBUG(10,("validate_de: %s ok\n", keystr));
3868 return 0;
3869 }
3870
3871 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3872 TDB_DATA dbuf, struct tdb_validation_status *state)
3873 {
3874 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3875
3876 if (!centry) {
3877 return 1;
3878 }
3879
3880 (void)centry_string(centry, mem_ctx);
3881 (void)centry_string(centry, mem_ctx);
3882 (void)centry_string(centry, mem_ctx);
3883 (void)centry_uint32(centry);
3884
3885 centry_free(centry);
3886
3887 if (!(state->success)) {
3888 return 1;
3889 }
3890 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3891 return 0;
3892 }
3893
3894 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3895 TDB_DATA dbuf,
3896 struct tdb_validation_status *state)
3897 {
3898 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3899
3900 if (!centry) {
3901 return 1;
3902 }
3903
3904 (void)centry_string( centry, mem_ctx );
3905
3906 centry_free(centry);
3907
3908 if (!(state->success)) {
3909 return 1;
3910 }
3911 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3912 return 0;
3913 }
3914
3915 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3916 TDB_DATA dbuf,
3917 struct tdb_validation_status *state)
3918 {
3919 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3920
3921 if (!centry) {
3922 return 1;
3923 }
3924
3925 (void)centry_string( centry, mem_ctx );
3926
3927 centry_free(centry);
3928
3929 if (!(state->success)) {
3930 return 1;
3931 }
3932 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3933 return 0;
3934 }
3935
3936 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3937 TDB_DATA dbuf,
3938 struct tdb_validation_status *state)
3939 {
3940 if (dbuf.dsize == 0) {
3941 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3942 "key %s (len ==0) ?\n", keystr));
3943 state->bad_entry = true;
3944 state->success = false;
3945 return 1;
3946 }
3947
3948 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3949 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3950 return 0;
3951 }
3952
3953 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3954 struct tdb_validation_status *state)
3955 {
3956 if (dbuf.dsize != 4) {
3957 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3958 keystr, (unsigned int)dbuf.dsize ));
3959 state->bad_entry = true;
3960 state->success = false;
3961 return 1;
3962 }
3963 DEBUG(10,("validate_offline: %s ok\n", keystr));
3964 return 0;
3965 }
3966
3967 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3968 struct tdb_validation_status *state)
3969 {
3970 /*
3971 * Ignore validation for now. The proper way to do this is with a
3972 * checksum. Just pure parsing does not really catch much.
3973 */
3974 return 0;
3975 }
3976
3977 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3978 struct tdb_validation_status *state)
3979 {
3980 if (dbuf.dsize != 4) {
3981 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3982 "key %s (len %u != 4) ?\n",
3983 keystr, (unsigned int)dbuf.dsize));
3984 state->bad_entry = true;
3985 state->success = false;
3986 return 1;
3987 }
3988
3989 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3990 return 0;
3991 }
3992
3993 /***********************************************************************
3994 A list of all possible cache tdb keys with associated validation
3995 functions.
3996 ***********************************************************************/
3997
3998 struct key_val_struct {
3999 const char *keyname;
4000 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
4001 } key_val[] = {
4002 {"SEQNUM/", validate_seqnum},
4003 {"NS/", validate_ns},
4004 {"SN/", validate_sn},
4005 {"U/", validate_u},
4006 {"LOC_POL/", validate_loc_pol},
4007 {"PWD_POL/", validate_pwd_pol},
4008 {"CRED/", validate_cred},
4009 {"UL/", validate_ul},
4010 {"GL/", validate_gl},
4011 {"UG/", validate_ug},
4012 {"UA", validate_ua},
4013 {"GM/", validate_gm},
4014 {"DR/", validate_dr},
4015 {"DE/", validate_de},
4016 {"NSS/PWINFO/", validate_pwinfo},
4017 {"TRUSTDOMCACHE/", validate_trustdomcache},
4018 {"NSS/NA/", validate_nss_na},
4019 {"NSS/AN/", validate_nss_an},
4020 {"WINBINDD_OFFLINE", validate_offline},
4021 {"NDR/", validate_ndr},
4022 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
4023 {NULL, NULL}
4024 };
4025
4026 /***********************************************************************
4027 Function to look at every entry in the tdb and validate it as far as
4028 possible.
4029 ***********************************************************************/
4030
4031 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
4032 {
4033 int i;
4034 unsigned int max_key_len = 1024;
4035 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
4036
4037 /* Paranoia check. */
4038 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
4039 max_key_len = 1024 * 1024;
4040 }
4041 if (kbuf.dsize > max_key_len) {
4042 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
4043 "(%u) > (%u)\n\n",
4044 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
4045 return 1;
4046 }
4047
4048 for (i = 0; key_val[i].keyname; i++) {
4049 size_t namelen = strlen(key_val[i].keyname);
4050 if (kbuf.dsize >= namelen && (
4051 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
4052 TALLOC_CTX *mem_ctx;
4053 char *keystr;
4054 int ret;
4055
4056 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
4057 if (!keystr) {
4058 return 1;
4059 }
4060 memcpy(keystr, kbuf.dptr, kbuf.dsize);
4061 keystr[kbuf.dsize] = '\0';
4062
4063 mem_ctx = talloc_init("validate_ctx");
4064 if (!mem_ctx) {
4065 SAFE_FREE(keystr);
4066 return 1;
4067 }
4068
4069 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
4070 v_state);
4071
4072 SAFE_FREE(keystr);
4073 talloc_destroy(mem_ctx);
4074 return ret;
4075 }
4076 }
4077
4078 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
4079 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
4080 DEBUG(0,("data :\n"));
4081 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4082 v_state->unknown_key = true;
4083 v_state->success = false;
4084 return 1; /* terminate. */
4085 }
4086
4087 static void validate_panic(const char *const why)
4088 {
4089 DEBUG(0,("validating cache: would panic %s\n", why ));
4090 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4091 exit(47);
4092 }
4093
4094 static int wbcache_update_centry_fn(TDB_CONTEXT *tdb,
4095 TDB_DATA key,
4096 TDB_DATA data,
4097 void *state)
4098 {
4099 uint64_t ctimeout;
4100 TDB_DATA blob;
4101
4102 if (is_non_centry_key(key)) {
4103 return 0;
4104 }
4105
4106 if (data.dptr == NULL || data.dsize == 0) {
4107 if (tdb_delete(tdb, key) < 0) {
4108 DEBUG(0, ("tdb_delete for [%s] failed!\n",
4109 key.dptr));
4110 return 1;
4111 }
4112 }
4113
4114 /* add timeout to blob (uint64_t) */
4115 blob.dsize = data.dsize + 8;
4116
4117 blob.dptr = SMB_XMALLOC_ARRAY(uint8_t, blob.dsize);
4118 if (blob.dptr == NULL) {
4119 return 1;
4120 }
4121 memset(blob.dptr, 0, blob.dsize);
4122
4123 /* copy status and seqnum */
4124 memcpy(blob.dptr, data.dptr, 8);
4125
4126 /* add timeout */
4127 ctimeout = lp_winbind_cache_time() + time(NULL);
4128 SBVAL(blob.dptr, 8, ctimeout);
4129
4130 /* copy the rest */
4131 memcpy(blob.dptr + 16, data.dptr + 8, data.dsize - 8);
4132
4133 if (tdb_store(tdb, key, blob, TDB_REPLACE) < 0) {
4134 DEBUG(0, ("tdb_store to update [%s] failed!\n",
4135 key.dptr));
4136 SAFE_FREE(blob.dptr);
4137 return 1;
4138 }
4139
4140 SAFE_FREE(blob.dptr);
4141 return 0;
4142 }
4143
4144 static bool wbcache_upgrade_v1_to_v2(TDB_CONTEXT *tdb)
4145 {
4146 int rc;
4147
4148 DEBUG(1, ("Upgrade to version 2 of the winbindd_cache.tdb\n"));
4149
4150 rc = tdb_traverse(tdb, wbcache_update_centry_fn, NULL);
4151 if (rc < 0) {
4152 return false;
4153 }
4154
4155 return true;
4156 }
4157
4158 /***********************************************************************
4159 Try and validate every entry in the winbindd cache. If we fail here,
4160 delete the cache tdb and return non-zero.
4161 ***********************************************************************/
4162
4163 int winbindd_validate_cache(void)
4164 {
4165 int ret = -1;
4166 const char *tdb_path = state_path("winbindd_cache.tdb");
4167 TDB_CONTEXT *tdb = NULL;
4168 uint32_t vers_id;
4169 bool ok;
4170
4171 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4172 smb_panic_fn = validate_panic;
4173
4174 tdb = tdb_open_log(tdb_path,
4175 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4176 TDB_INCOMPATIBLE_HASH |
4177 ( lp_winbind_offline_logon()
4178 ? TDB_DEFAULT
4179 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4180 O_RDWR|O_CREAT,
4181 0600);
4182 if (!tdb) {
4183 DEBUG(0, ("winbindd_validate_cache: "
4184 "error opening/initializing tdb\n"));
4185 goto done;
4186 }
4187
4188 /* Version check and upgrade code. */
4189 if (!tdb_fetch_uint32(tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers_id)) {
4190 DEBUG(10, ("Fresh database\n"));
4191 tdb_store_uint32(tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION);
4192 vers_id = WINBINDD_CACHE_VERSION;
4193 }
4194
4195 if (vers_id != WINBINDD_CACHE_VERSION) {
4196 if (vers_id == WINBINDD_CACHE_VER1) {
4197 ok = wbcache_upgrade_v1_to_v2(tdb);
4198 if (!ok) {
4199 DEBUG(10, ("winbindd_validate_cache: upgrade to version 2 failed.\n"));
4200 unlink(tdb_path);
4201 goto done;
4202 }
4203
4204 tdb_store_uint32(tdb,
4205 WINBINDD_CACHE_VERSION_KEYSTR,
4206 WINBINDD_CACHE_VERSION);
4207 vers_id = WINBINDD_CACHE_VER2;
4208 }
4209 }
4210
4211 tdb_close(tdb);
4212
4213 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4214
4215 if (ret != 0) {
4216 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4217 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4218 unlink(tdb_path);
4219 }
4220
4221 done:
4222 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4223 smb_panic_fn = smb_panic;
4224 return ret;
4225 }
4226
4227 /***********************************************************************
4228 Try and validate every entry in the winbindd cache.
4229 ***********************************************************************/
4230
4231 int winbindd_validate_cache_nobackup(void)
4232 {
4233 int ret = -1;
4234 const char *tdb_path = state_path("winbindd_cache.tdb");
4235
4236 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4237 smb_panic_fn = validate_panic;
4238
4239
4240 if (wcache == NULL || wcache->tdb == NULL) {
4241 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4242 } else {
4243 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4244 }
4245
4246 if (ret != 0) {
4247 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4248 "successful.\n"));
4249 }
4250
4251 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4252 "function\n"));
4253 smb_panic_fn = smb_panic;
4254 return ret;
4255 }
4256
4257 bool winbindd_cache_validate_and_initialize(void)
4258 {
4259 close_winbindd_cache();
4260
4261 if (lp_winbind_offline_logon()) {
4262 if (winbindd_validate_cache() < 0) {
4263 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4264 "could be restored.\n"));
4265 }
4266 }
4267
4268 return initialize_winbindd_cache();
4269 }
4270
4271 /*********************************************************************
4272 ********************************************************************/
4273
4274 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4275 struct winbindd_tdc_domain **domains,
4276 size_t *num_domains )
4277 {
4278 struct winbindd_tdc_domain *list = NULL;
4279 size_t idx;
4280 int i;
4281 bool set_only = false;
4282
4283 /* don't allow duplicates */
4284
4285 idx = *num_domains;
4286 list = *domains;
4287
4288 for ( i=0; i< (*num_domains); i++ ) {
4289 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4290 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4291 new_dom->name));
4292 idx = i;
4293 set_only = true;
4294
4295 break;
4296 }
4297 }
4298
4299 if ( !set_only ) {
4300 if ( !*domains ) {
4301 list = talloc_array( NULL, struct winbindd_tdc_domain, 1 );
4302 idx = 0;
4303 } else {
4304 list = talloc_realloc( *domains, *domains,
4305 struct winbindd_tdc_domain,
4306 (*num_domains)+1);
4307 idx = *num_domains;
4308 }
4309
4310 ZERO_STRUCT( list[idx] );
4311 }
4312
4313 if ( !list )
4314 return false;
4315
4316 list[idx].domain_name = talloc_strdup( list, new_dom->name );
4317 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4318
4319 if ( !is_null_sid( &new_dom->sid ) ) {
4320 sid_copy( &list[idx].sid, &new_dom->sid );
4321 } else {
4322 sid_copy(&list[idx].sid, &global_sid_NULL);
4323 }
4324
4325 if ( new_dom->domain_flags != 0x0 )
4326 list[idx].trust_flags = new_dom->domain_flags;
4327
4328 if ( new_dom->domain_type != 0x0 )
4329 list[idx].trust_type = new_dom->domain_type;
4330
4331 if ( new_dom->domain_trust_attribs != 0x0 )
4332 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4333
4334 if ( !set_only ) {
4335 *domains = list;
4336 *num_domains = idx + 1;
4337 }
4338
4339 return true;
4340 }
4341
4342 /*********************************************************************
4343 ********************************************************************/
4344
4345 static TDB_DATA make_tdc_key( const char *domain_name )
4346 {
4347 char *keystr = NULL;
4348 TDB_DATA key = { NULL, 0 };
4349
4350 if ( !domain_name ) {
4351 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4352 return key;
4353 }
4354
4355 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4356 return key;
4357 }
4358 key = string_term_tdb_data(keystr);
4359
4360 return key;
4361 }
4362
4363 /*********************************************************************
4364 ********************************************************************/
4365
4366 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4367 size_t num_domains,
4368 unsigned char **buf )
4369 {
4370 unsigned char *buffer = NULL;
4371 int len = 0;
4372 int buflen = 0;
4373 int i = 0;
4374
4375 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4376 (int)num_domains));
4377
4378 buflen = 0;
4379
4380 again:
4381 len = 0;
4382
4383 /* Store the number of array items first */
4384 len += tdb_pack( buffer+len, buflen-len, "d",
4385 num_domains );
4386
4387 /* now pack each domain trust record */
4388 for ( i=0; i<num_domains; i++ ) {
4389
4390 fstring tmp;
4391
4392 if ( buflen > 0 ) {
4393 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4394 domains[i].domain_name,
4395 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4396 }
4397
4398 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4399 domains[i].domain_name,
4400 domains[i].dns_name,
4401 sid_to_fstring(tmp, &domains[i].sid),
4402 domains[i].trust_flags,
4403 domains[i].trust_attribs,
4404 domains[i].trust_type );
4405 }
4406
4407 if ( buflen < len ) {
4408 SAFE_FREE(buffer);
4409 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4410 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4411 buflen = -1;
4412 goto done;
4413 }
4414 buflen = len;
4415 goto again;
4416 }
4417
4418 *buf = buffer;
4419
4420 done:
4421 return buflen;
4422 }
4423
4424 /*********************************************************************
4425 ********************************************************************/
4426
4427 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4428 struct winbindd_tdc_domain **domains )
4429 {
4430 fstring domain_name, dns_name, sid_string;
4431 uint32 type, attribs, flags;
4432 int num_domains;
4433 int len = 0;
4434 int i;
4435 struct winbindd_tdc_domain *list = NULL;
4436
4437 /* get the number of domains */
4438 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4439 if ( len == -1 ) {
4440 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4441 return 0;
4442 }
4443
4444 list = talloc_array( NULL, struct winbindd_tdc_domain, num_domains );
4445 if ( !list ) {
4446 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4447 return 0;
4448 }
4449
4450 for ( i=0; i<num_domains; i++ ) {
4451 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4452 domain_name,
4453 dns_name,
4454 sid_string,
4455 &flags,
4456 &attribs,
4457 &type );
4458
4459 if ( len == -1 ) {
4460 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4461 TALLOC_FREE( list );
4462 return 0;
4463 }
4464
4465 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4466 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4467 domain_name, dns_name, sid_string,
4468 flags, attribs, type));
4469
4470 list[i].domain_name = talloc_strdup( list, domain_name );
4471 list[i].dns_name = talloc_strdup( list, dns_name );
4472 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4473 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4474 domain_name));
4475 }
4476 list[i].trust_flags = flags;
4477 list[i].trust_attribs = attribs;
4478 list[i].trust_type = type;
4479 }
4480
4481 *domains = list;
4482
4483 return num_domains;
4484 }
4485
4486 /*********************************************************************
4487 ********************************************************************/
4488
4489 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4490 {
4491 TDB_DATA key = make_tdc_key( lp_workgroup() );
4492 TDB_DATA data = { NULL, 0 };
4493 int ret;
4494
4495 if ( !key.dptr )
4496 return false;
4497
4498 /* See if we were asked to delete the cache entry */
4499
4500 if ( !domains ) {
4501 ret = tdb_delete( wcache->tdb, key );
4502 goto done;
4503 }
4504
4505 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4506
4507 if ( !data.dptr ) {
4508 ret = -1;
4509 goto done;
4510 }
4511
4512 ret = tdb_store( wcache->tdb, key, data, 0 );
4513
4514 done:
4515 SAFE_FREE( data.dptr );
4516 SAFE_FREE( key.dptr );
4517
4518 return ( ret == 0 );
4519 }
4520
4521 /*********************************************************************
4522 ********************************************************************/
4523
4524 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4525 {
4526 TDB_DATA key = make_tdc_key( lp_workgroup() );
4527 TDB_DATA data = { NULL, 0 };
4528
4529 *domains = NULL;
4530 *num_domains = 0;
4531
4532 if ( !key.dptr )
4533 return false;
4534
4535 data = tdb_fetch_compat( wcache->tdb, key );
4536
4537 SAFE_FREE( key.dptr );
4538
4539 if ( !data.dptr )
4540 return false;
4541
4542 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4543
4544 SAFE_FREE( data.dptr );
4545
4546 if ( !*domains )
4547 return false;
4548
4549 return true;
4550 }
4551
4552 /*********************************************************************
4553 ********************************************************************/
4554
4555 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4556 {
4557 struct winbindd_tdc_domain *dom_list = NULL;
4558 size_t num_domains = 0;
4559 bool ret = false;
4560
4561 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4562 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4563 domain->name, domain->alt_name,
4564 sid_string_dbg(&domain->sid),
4565 domain->domain_flags,
4566 domain->domain_trust_attribs,
4567 domain->domain_type));
4568
4569 if ( !init_wcache() ) {
4570 return false;
4571 }
4572
4573 /* fetch the list */
4574
4575 wcache_tdc_fetch_list( &dom_list, &num_domains );
4576
4577 /* add the new domain */
4578
4579 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4580 goto done;
4581 }
4582
4583 /* pack the domain */
4584
4585 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4586 goto done;
4587 }
4588
4589 /* Success */
4590
4591 ret = true;
4592 done:
4593 TALLOC_FREE( dom_list );
4594
4595 return ret;
4596 }
4597
4598 /*********************************************************************
4599 ********************************************************************/
4600
4601 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4602 {
4603 struct winbindd_tdc_domain *dom_list = NULL;
4604 size_t num_domains = 0;
4605 int i;
4606 struct winbindd_tdc_domain *d = NULL;
4607
4608 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4609
4610 if ( !init_wcache() ) {
4611 return NULL;
4612 }
4613
4614 /* fetch the list */
4615
4616 wcache_tdc_fetch_list( &dom_list, &num_domains );
4617
4618 for ( i=0; i<num_domains; i++ ) {
4619 if ( strequal(name, dom_list[i].domain_name) ||
4620 strequal(name, dom_list[i].dns_name) )
4621 {
4622 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4623 name));
4624
4625 d = talloc( ctx, struct winbindd_tdc_domain );
4626 if ( !d )
4627 break;
4628
4629 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4630 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4631 sid_copy( &d->sid, &dom_list[i].sid );
4632 d->trust_flags = dom_list[i].trust_flags;
4633 d->trust_type = dom_list[i].trust_type;
4634 d->trust_attribs = dom_list[i].trust_attribs;
4635
4636 break;
4637 }
4638 }
4639
4640 TALLOC_FREE( dom_list );
4641
4642 return d;
4643 }
4644
4645 /*********************************************************************
4646 ********************************************************************/
4647
4648 struct winbindd_tdc_domain*
4649 wcache_tdc_fetch_domainbysid(TALLOC_CTX *ctx,
4650 const struct dom_sid *sid)
4651 {
4652 struct winbindd_tdc_domain *dom_list = NULL;
4653 size_t num_domains = 0;
4654 int i;
4655 struct winbindd_tdc_domain *d = NULL;
4656
4657 DEBUG(10,("wcache_tdc_fetch_domainbysid: Searching for domain %s\n",
4658 sid_string_dbg(sid)));
4659
4660 if (!init_wcache()) {
4661 return NULL;
4662 }
4663
4664 /* fetch the list */
4665
4666 wcache_tdc_fetch_list(&dom_list, &num_domains);
4667
4668 for (i = 0; i<num_domains; i++) {
4669 if (dom_sid_equal(sid, &(dom_list[i].sid))) {
4670 DEBUG(10, ("wcache_tdc_fetch_domainbysid: "
4671 "Found domain %s for SID %s\n",
4672 dom_list[i].domain_name,
4673 sid_string_dbg(sid)));
4674
4675 d = talloc(ctx, struct winbindd_tdc_domain);
4676 if (!d)
4677 break;
4678
4679 d->domain_name = talloc_strdup(d,
4680 dom_list[i].domain_name);
4681
4682 d->dns_name = talloc_strdup(d, dom_list[i].dns_name);
4683 sid_copy(&d->sid, &dom_list[i].sid);
4684 d->trust_flags = dom_list[i].trust_flags;
4685 d->trust_type = dom_list[i].trust_type;
4686 d->trust_attribs = dom_list[i].trust_attribs;
4687
4688 break;
4689 }
4690 }
4691
4692 TALLOC_FREE(dom_list);
4693
4694 return d;
4695 }
4696
4697
4698 /*********************************************************************
4699 ********************************************************************/
4700
4701 void wcache_tdc_clear( void )
4702 {
4703 if ( !init_wcache() )
4704 return;
4705
4706 wcache_tdc_store_list( NULL, 0 );
4707
4708 return;
4709 }
4710
4711
4712 /*********************************************************************
4713 ********************************************************************/
4714
4715 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4716 NTSTATUS status,
4717 const struct dom_sid *user_sid,
4718 const char *homedir,
4719 const char *shell,
4720 const char *gecos,
4721 uint32 gid)
4722 {
4723 struct cache_entry *centry;
4724 fstring tmp;
4725
4726 if ( (centry = centry_start(domain, status)) == NULL )
4727 return;
4728
4729 centry_put_string( centry, homedir );
4730 centry_put_string( centry, shell );
4731 centry_put_string( centry, gecos );
4732 centry_put_uint32( centry, gid );
4733
4734 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4735
4736 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4737
4738 centry_free(centry);
4739 }
4740
4741 #ifdef HAVE_ADS
4742
4743 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4744 const struct dom_sid *user_sid,
4745 TALLOC_CTX *ctx,
4746 const char **homedir, const char **shell,
4747 const char **gecos, gid_t *p_gid)
4748 {
4749 struct winbind_cache *cache = get_cache(domain);
4750 struct cache_entry *centry = NULL;
4751 NTSTATUS nt_status;
4752 fstring tmp;
4753
4754 if (!cache->tdb)
4755 goto do_query;
4756
4757 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4758 sid_to_fstring(tmp, user_sid));
4759
4760 if (!centry)
4761 goto do_query;
4762
4763 *homedir = centry_string( centry, ctx );
4764 *shell = centry_string( centry, ctx );
4765 *gecos = centry_string( centry, ctx );
4766 *p_gid = centry_uint32( centry );
4767
4768 centry_free(centry);
4769
4770 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4771 sid_string_dbg(user_sid)));
4772
4773 return NT_STATUS_OK;
4774
4775 do_query:
4776
4777 nt_status = nss_get_info( domain->name, user_sid, ctx,
4778 homedir, shell, gecos, p_gid );
4779
4780 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4781
4782 if ( NT_STATUS_IS_OK(nt_status) ) {
4783 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4784 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4785 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4786 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4787
4788 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4789 *homedir, *shell, *gecos, *p_gid );
4790 }
4791
4792 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4793 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4794 domain->name ));
4795 set_domain_offline( domain );
4796 }
4797
4798 return nt_status;
4799 }
4800
4801 #endif
4802
4803 /* the cache backend methods are exposed via this structure */
4804 struct winbindd_methods cache_methods = {
4805 true,
4806 query_user_list,
4807 enum_dom_groups,
4808 enum_local_groups,
4809 name_to_sid,
4810 sid_to_name,
4811 rids_to_names,
4812 query_user,
4813 lookup_usergroups,
4814 lookup_useraliases,
4815 lookup_groupmem,
4816 sequence_number,
4817 lockout_policy,
4818 password_policy,
4819 trusted_domains
4820 };
4821
4822 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4823 uint32_t opnum, const DATA_BLOB *req,
4824 TDB_DATA *pkey)
4825 {
4826 char *key;
4827 size_t keylen;
4828
4829 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4830 if (key == NULL) {
4831 return false;
4832 }
4833 keylen = talloc_get_size(key) - 1;
4834
4835 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4836 if (key == NULL) {
4837 return false;
4838 }
4839 memcpy(key + keylen, req->data, req->length);
4840
4841 pkey->dptr = (uint8_t *)key;
4842 pkey->dsize = talloc_get_size(key);
4843 return true;
4844 }
4845
4846 static bool wcache_opnum_cacheable(uint32_t opnum)
4847 {
4848 switch (opnum) {
4849 case NDR_WBINT_PING:
4850 case NDR_WBINT_QUERYSEQUENCENUMBER:
4851 case NDR_WBINT_ALLOCATEUID:
4852 case NDR_WBINT_ALLOCATEGID:
4853 case NDR_WBINT_CHECKMACHINEACCOUNT:
4854 case NDR_WBINT_CHANGEMACHINEACCOUNT:
4855 case NDR_WBINT_PINGDC:
4856 return false;
4857 }
4858 return true;
4859 }
4860
4861 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4862 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4863 {
4864 TDB_DATA key, data;
4865 bool ret = false;
4866
4867 if (!wcache_opnum_cacheable(opnum) ||
4868 is_my_own_sam_domain(domain) ||
4869 is_builtin_domain(domain)) {
4870 return false;
4871 }
4872
4873 if (wcache->tdb == NULL) {
4874 return false;
4875 }
4876
4877 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4878 return false;
4879 }
4880 data = tdb_fetch_compat(wcache->tdb, key);
4881 TALLOC_FREE(key.dptr);
4882
4883 if (data.dptr == NULL) {
4884 return false;
4885 }
4886 if (data.dsize < 12) {
4887 goto fail;
4888 }
4889
4890 if (!is_domain_offline(domain)) {
4891 uint32_t entry_seqnum, dom_seqnum, last_check;
4892 uint64_t entry_timeout;
4893
4894 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4895 &last_check)) {
4896 goto fail;
4897 }
4898 entry_seqnum = IVAL(data.dptr, 0);
4899 if (entry_seqnum != dom_seqnum) {
4900 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4901 (int)entry_seqnum));
4902 goto fail;
4903 }
4904 entry_timeout = BVAL(data.dptr, 4);
4905 if (time(NULL) > entry_timeout) {
4906 DEBUG(10, ("Entry has timed out\n"));
4907 goto fail;
4908 }
4909 }
4910
4911 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 12,
4912 data.dsize - 12);
4913 if (resp->data == NULL) {
4914 DEBUG(10, ("talloc failed\n"));
4915 goto fail;
4916 }
4917 resp->length = data.dsize - 12;
4918
4919 ret = true;
4920 fail:
4921 SAFE_FREE(data.dptr);
4922 return ret;
4923 }
4924
4925 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4926 const DATA_BLOB *req, const DATA_BLOB *resp)
4927 {
4928 TDB_DATA key, data;
4929 uint32_t dom_seqnum, last_check;
4930 uint64_t timeout;
4931
4932 if (!wcache_opnum_cacheable(opnum) ||
4933 is_my_own_sam_domain(domain) ||
4934 is_builtin_domain(domain)) {
4935 return;
4936 }
4937
4938 if (wcache->tdb == NULL) {
4939 return;
4940 }
4941
4942 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4943 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4944 domain->name));
4945 return;
4946 }
4947
4948 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4949 return;
4950 }
4951
4952 timeout = time(NULL) + lp_winbind_cache_time();
4953
4954 data.dsize = resp->length + 12;
4955 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4956 if (data.dptr == NULL) {
4957 goto done;
4958 }
4959
4960 SIVAL(data.dptr, 0, dom_seqnum);
4961 SBVAL(data.dptr, 4, timeout);
4962 memcpy(data.dptr + 12, resp->data, resp->length);
4963
4964 tdb_store(wcache->tdb, key, data, 0);
4965
4966 done:
4967 TALLOC_FREE(key.dptr);
4968 return;
4969 }
reg import