?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-winbind: Remove unused keys from list.
[Samba/gebeck_regimport.git] / source3 / winbindd / winbindd_cache.c
blob9aed366a47b83b8847fbe6da369a10568ce04b15
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "system/filesys.h"
28 #include "winbindd.h"
29 #include "tdb_validate.h"
30 #include "../libcli/auth/libcli_auth.h"
31 #include "../librpc/gen_ndr/ndr_wbint.h"
32 #include "ads.h"
33 #include "nss_info.h"
34 #include "../libcli/security/security.h"
35 #include "passdb/machine_sid.h"
36 #include "util_tdb.h"
37
38 #undef DBGC_CLASS
39 #define DBGC_CLASS DBGC_WINBIND
40
41 #define WINBINDD_CACHE_VERSION 2
42 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
43
44 extern struct winbindd_methods reconnect_methods;
45 #ifdef HAVE_ADS
46 extern struct winbindd_methods ads_methods;
47 #endif
48 extern struct winbindd_methods builtin_passdb_methods;
49 extern struct winbindd_methods sam_passdb_methods;
50
51 /*
52 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
53 * Here are the list of entry types that are *not* stored
54 * as form struct cache_entry in the cache.
55 */
56
57 static const char *non_centry_keys[] = {
58 "SEQNUM/",
59 "WINBINDD_OFFLINE",
60 WINBINDD_CACHE_VERSION_KEYSTR,
61 NULL
62 };
63
64 /************************************************************************
65 Is this key a non-centry type ?
66 ************************************************************************/
67
68 static bool is_non_centry_key(TDB_DATA kbuf)
69 {
70 int i;
71
72 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
73 return false;
74 }
75 for (i = 0; non_centry_keys[i] != NULL; i++) {
76 size_t namelen = strlen(non_centry_keys[i]);
77 if (kbuf.dsize < namelen) {
78 continue;
79 }
80 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
81 return true;
82 }
83 }
84 return false;
85 }
86
87 /* Global online/offline state - False when online. winbindd starts up online
88 and sets this to true if the first query fails and there's an entry in
89 the cache tdb telling us to stay offline. */
90
91 static bool global_winbindd_offline_state;
92
93 struct winbind_cache {
94 TDB_CONTEXT *tdb;
95 };
96
97 struct cache_entry {
98 NTSTATUS status;
99 uint32 sequence_number;
100 uint64_t timeout;
101 uint8 *data;
102 uint32 len, ofs;
103 };
104
105 void (*smb_panic_fn)(const char *const why) = smb_panic;
106
107 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
108
109 static struct winbind_cache *wcache;
110
111 /* get the winbind_cache structure */
112 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
113 {
114 struct winbind_cache *ret = wcache;
115
116 /* We have to know what type of domain we are dealing with first. */
117
118 if (domain->internal) {
119 domain->backend = &builtin_passdb_methods;
120 domain->initialized = True;
121 }
122
123 if (strequal(domain->name, get_global_sam_name()) &&
124 sid_check_is_domain(&domain->sid)) {
125 domain->backend = &sam_passdb_methods;
126 domain->initialized = True;
127 }
128
129 if ( !domain->initialized ) {
130 init_dc_connection( domain );
131 }
132
133 /*
134 OK. listen up becasue I'm only going to say this once.
135 We have the following scenarios to consider
136 (a) trusted AD domains on a Samba DC,
137 (b) trusted AD domains and we are joined to a non-kerberos domain
138 (c) trusted AD domains and we are joined to a kerberos (AD) domain
139
140 For (a) we can always contact the trusted domain using krb5
141 since we have the domain trust account password
142
143 For (b) we can only use RPC since we have no way of
144 getting a krb5 ticket in our own domain
145
146 For (c) we can always use krb5 since we have a kerberos trust
147
148 --jerry
149 */
150
151 if (!domain->backend) {
152 #ifdef HAVE_ADS
153 struct winbindd_domain *our_domain = domain;
154
155 /* find our domain first so we can figure out if we
156 are joined to a kerberized domain */
157
158 if ( !domain->primary )
159 our_domain = find_our_domain();
160
161 if ((our_domain->active_directory || IS_DC)
162 && domain->active_directory
163 && !lp_winbind_rpc_only()) {
164 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
165 domain->backend = &ads_methods;
166 } else {
167 #endif /* HAVE_ADS */
168 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
169 domain->backend = &reconnect_methods;
170 #ifdef HAVE_ADS
171 }
172 #endif /* HAVE_ADS */
173 }
174
175 if (ret)
176 return ret;
177
178 ret = SMB_XMALLOC_P(struct winbind_cache);
179 ZERO_STRUCTP(ret);
180
181 wcache = ret;
182 wcache_flush_cache();
183
184 return ret;
185 }
186
187 /*
188 free a centry structure
189 */
190 static void centry_free(struct cache_entry *centry)
191 {
192 if (!centry)
193 return;
194 SAFE_FREE(centry->data);
195 free(centry);
196 }
197
198 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
199 {
200 if (centry->len - centry->ofs < nbytes) {
201 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
202 (unsigned int)nbytes,
203 centry->len - centry->ofs));
204 return false;
205 }
206 return true;
207 }
208
209 /*
210 pull a uint64_t from a cache entry
211 */
212 static uint64_t centry_uint64_t(struct cache_entry *centry)
213 {
214 uint64_t ret;
215
216 if (!centry_check_bytes(centry, 8)) {
217 smb_panic_fn("centry_uint64_t");
218 }
219 ret = BVAL(centry->data, centry->ofs);
220 centry->ofs += 8;
221 return ret;
222 }
223
224 /*
225 pull a uint32 from a cache entry
226 */
227 static uint32 centry_uint32(struct cache_entry *centry)
228 {
229 uint32 ret;
230
231 if (!centry_check_bytes(centry, 4)) {
232 smb_panic_fn("centry_uint32");
233 }
234 ret = IVAL(centry->data, centry->ofs);
235 centry->ofs += 4;
236 return ret;
237 }
238
239 /*
240 pull a uint16 from a cache entry
241 */
242 static uint16 centry_uint16(struct cache_entry *centry)
243 {
244 uint16 ret;
245 if (!centry_check_bytes(centry, 2)) {
246 smb_panic_fn("centry_uint16");
247 }
248 ret = SVAL(centry->data, centry->ofs);
249 centry->ofs += 2;
250 return ret;
251 }
252
253 /*
254 pull a uint8 from a cache entry
255 */
256 static uint8 centry_uint8(struct cache_entry *centry)
257 {
258 uint8 ret;
259 if (!centry_check_bytes(centry, 1)) {
260 smb_panic_fn("centry_uint8");
261 }
262 ret = CVAL(centry->data, centry->ofs);
263 centry->ofs += 1;
264 return ret;
265 }
266
267 /*
268 pull a NTTIME from a cache entry
269 */
270 static NTTIME centry_nttime(struct cache_entry *centry)
271 {
272 NTTIME ret;
273 if (!centry_check_bytes(centry, 8)) {
274 smb_panic_fn("centry_nttime");
275 }
276 ret = IVAL(centry->data, centry->ofs);
277 centry->ofs += 4;
278 ret += (uint64)IVAL(centry->data, centry->ofs) << 32;
279 centry->ofs += 4;
280 return ret;
281 }
282
283 /*
284 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
285 */
286 static time_t centry_time(struct cache_entry *centry)
287 {
288 return (time_t)centry_nttime(centry);
289 }
290
291 /* pull a string from a cache entry, using the supplied
292 talloc context
293 */
294 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
295 {
296 uint32 len;
297 char *ret;
298
299 len = centry_uint8(centry);
300
301 if (len == 0xFF) {
302 /* a deliberate NULL string */
303 return NULL;
304 }
305
306 if (!centry_check_bytes(centry, (size_t)len)) {
307 smb_panic_fn("centry_string");
308 }
309
310 ret = talloc_array(mem_ctx, char, len+1);
311 if (!ret) {
312 smb_panic_fn("centry_string out of memory\n");
313 }
314 memcpy(ret,centry->data + centry->ofs, len);
315 ret[len] = 0;
316 centry->ofs += len;
317 return ret;
318 }
319
320 /* pull a hash16 from a cache entry, using the supplied
321 talloc context
322 */
323 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
324 {
325 uint32 len;
326 char *ret;
327
328 len = centry_uint8(centry);
329
330 if (len != 16) {
331 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
332 len ));
333 return NULL;
334 }
335
336 if (!centry_check_bytes(centry, 16)) {
337 return NULL;
338 }
339
340 ret = talloc_array(mem_ctx, char, 16);
341 if (!ret) {
342 smb_panic_fn("centry_hash out of memory\n");
343 }
344 memcpy(ret,centry->data + centry->ofs, 16);
345 centry->ofs += 16;
346 return ret;
347 }
348
349 /* pull a sid from a cache entry, using the supplied
350 talloc context
351 */
352 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
353 {
354 char *sid_string;
355 bool ret;
356
357 sid_string = centry_string(centry, talloc_tos());
358 if (sid_string == NULL) {
359 return false;
360 }
361 ret = string_to_sid(sid, sid_string);
362 TALLOC_FREE(sid_string);
363 return ret;
364 }
365
366
367 /*
368 pull a NTSTATUS from a cache entry
369 */
370 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
371 {
372 NTSTATUS status;
373
374 status = NT_STATUS(centry_uint32(centry));
375 return status;
376 }
377
378
379 /* the server is considered down if it can't give us a sequence number */
380 static bool wcache_server_down(struct winbindd_domain *domain)
381 {
382 bool ret;
383
384 if (!wcache->tdb)
385 return false;
386
387 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
388
389 if (ret)
390 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
391 domain->name ));
392 return ret;
393 }
394
395 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
396 uint32_t *last_seq_check)
397 {
398 char *key;
399 TDB_DATA data;
400
401 if (wcache->tdb == NULL) {
402 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
403 return false;
404 }
405
406 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
407 if (key == NULL) {
408 DEBUG(10, ("talloc failed\n"));
409 return false;
410 }
411
412 data = tdb_fetch_bystring(wcache->tdb, key);
413 TALLOC_FREE(key);
414
415 if (data.dptr == NULL) {
416 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
417 domain_name));
418 return false;
419 }
420 if (data.dsize != 8) {
421 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
422 (int)data.dsize));
423 SAFE_FREE(data.dptr);
424 return false;
425 }
426
427 *seqnum = IVAL(data.dptr, 0);
428 *last_seq_check = IVAL(data.dptr, 4);
429 SAFE_FREE(data.dptr);
430
431 return true;
432 }
433
434 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
435 {
436 uint32 last_check, time_diff;
437
438 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
439 &last_check)) {
440 return NT_STATUS_UNSUCCESSFUL;
441 }
442 domain->last_seq_check = last_check;
443
444 /* have we expired? */
445
446 time_diff = now - domain->last_seq_check;
447 if ( time_diff > lp_winbind_cache_time() ) {
448 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
449 domain->name, domain->sequence_number,
450 (uint32)domain->last_seq_check));
451 return NT_STATUS_UNSUCCESSFUL;
452 }
453
454 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
455 domain->name, domain->sequence_number,
456 (uint32)domain->last_seq_check));
457
458 return NT_STATUS_OK;
459 }
460
461 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
462 time_t last_seq_check)
463 {
464 char *key_str;
465 uint8_t buf[8];
466 int ret;
467
468 if (wcache->tdb == NULL) {
469 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
470 return false;
471 }
472
473 key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
474 if (key_str == NULL) {
475 DEBUG(10, ("talloc_asprintf failed\n"));
476 return false;
477 }
478
479 SIVAL(buf, 0, seqnum);
480 SIVAL(buf, 4, last_seq_check);
481
482 ret = tdb_store_bystring(wcache->tdb, key_str,
483 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
484 TALLOC_FREE(key_str);
485 if (ret != 0) {
486 DEBUG(10, ("tdb_store_bystring failed: %s\n",
487 tdb_errorstr_compat(wcache->tdb)));
488 TALLOC_FREE(key_str);
489 return false;
490 }
491
492 DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
493 domain_name, seqnum, (unsigned)last_seq_check));
494
495 return true;
496 }
497
498 static bool store_cache_seqnum( struct winbindd_domain *domain )
499 {
500 return wcache_store_seqnum(domain->name, domain->sequence_number,
501 domain->last_seq_check);
502 }
503
504 /*
505 refresh the domain sequence number. If force is true
506 then always refresh it, no matter how recently we fetched it
507 */
508
509 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
510 {
511 NTSTATUS status;
512 unsigned time_diff;
513 time_t t = time(NULL);
514 unsigned cache_time = lp_winbind_cache_time();
515
516 if (is_domain_offline(domain)) {
517 return;
518 }
519
520 get_cache( domain );
521
522 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
523 /* trying to reconnect is expensive, don't do it too often */
524 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
525 cache_time *= 8;
526 }
527 #endif
528
529 time_diff = t - domain->last_seq_check;
530
531 /* see if we have to refetch the domain sequence number */
532 if (!force && (time_diff < cache_time) &&
533 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
534 NT_STATUS_IS_OK(domain->last_status)) {
535 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
536 goto done;
537 }
538
539 /* try to get the sequence number from the tdb cache first */
540 /* this will update the timestamp as well */
541
542 status = fetch_cache_seqnum( domain, t );
543 if (NT_STATUS_IS_OK(status) &&
544 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
545 NT_STATUS_IS_OK(domain->last_status)) {
546 goto done;
547 }
548
549 /* important! make sure that we know if this is a native
550 mode domain or not. And that we can contact it. */
551
552 if ( winbindd_can_contact_domain( domain ) ) {
553 status = domain->backend->sequence_number(domain,
554 &domain->sequence_number);
555 } else {
556 /* just use the current time */
557 status = NT_STATUS_OK;
558 domain->sequence_number = time(NULL);
559 }
560
561
562 /* the above call could have set our domain->backend to NULL when
563 * coming from offline to online mode, make sure to reinitialize the
564 * backend - Guenther */
565 get_cache( domain );
566
567 if (!NT_STATUS_IS_OK(status)) {
568 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
569 domain->sequence_number = DOM_SEQUENCE_NONE;
570 }
571
572 domain->last_status = status;
573 domain->last_seq_check = time(NULL);
574
575 /* save the new sequence number in the cache */
576 store_cache_seqnum( domain );
577
578 done:
579 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
580 domain->name, domain->sequence_number));
581
582 return;
583 }
584
585 /*
586 decide if a cache entry has expired
587 */
588 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
589 {
590 /* If we've been told to be offline - stay in that state... */
591 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
592 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
593 keystr, domain->name ));
594 return false;
595 }
596
597 /* when the domain is offline return the cached entry.
598 * This deals with transient offline states... */
599
600 if (!domain->online) {
601 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
602 keystr, domain->name ));
603 return false;
604 }
605
606 /* if the server is OK and our cache entry came from when it was down then
607 the entry is invalid */
608 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
609 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
610 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
611 keystr, domain->name ));
612 return true;
613 }
614
615 /* if the server is down or the cache entry is not older than the
616 current sequence number or it did not timeout then it is OK */
617 if (wcache_server_down(domain)
618 || ((centry->sequence_number == domain->sequence_number)
619 && (centry->timeout > time(NULL)))) {
620 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
621 keystr, domain->name ));
622 return false;
623 }
624
625 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
626 keystr, domain->name ));
627
628 /* it's expired */
629 return true;
630 }
631
632 static struct cache_entry *wcache_fetch_raw(char *kstr)
633 {
634 TDB_DATA data;
635 struct cache_entry *centry;
636 TDB_DATA key;
637
638 key = string_tdb_data(kstr);
639 data = tdb_fetch_compat(wcache->tdb, key);
640 if (!data.dptr) {
641 /* a cache miss */
642 return NULL;
643 }
644
645 centry = SMB_XMALLOC_P(struct cache_entry);
646 centry->data = (unsigned char *)data.dptr;
647 centry->len = data.dsize;
648 centry->ofs = 0;
649
650 if (centry->len < 16) {
651 /* huh? corrupt cache? */
652 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s "
653 "(len < 16)?\n", kstr));
654 centry_free(centry);
655 return NULL;
656 }
657
658 centry->status = centry_ntstatus(centry);
659 centry->sequence_number = centry_uint32(centry);
660 centry->timeout = centry_uint64_t(centry);
661
662 return centry;
663 }
664
665 static bool is_my_own_sam_domain(struct winbindd_domain *domain)
666 {
667 if (strequal(domain->name, get_global_sam_name()) &&
668 sid_check_is_domain(&domain->sid)) {
669 return true;
670 }
671
672 return false;
673 }
674
675 static bool is_builtin_domain(struct winbindd_domain *domain)
676 {
677 if (strequal(domain->name, "BUILTIN") &&
678 sid_check_is_builtin(&domain->sid)) {
679 return true;
680 }
681
682 return false;
683 }
684
685 /*
686 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
687 number and return status
688 */
689 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
690 struct winbindd_domain *domain,
691 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
692 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
693 struct winbindd_domain *domain,
694 const char *format, ...)
695 {
696 va_list ap;
697 char *kstr;
698 struct cache_entry *centry;
699
700 if (!winbindd_use_cache() ||
701 is_my_own_sam_domain(domain) ||
702 is_builtin_domain(domain)) {
703 return NULL;
704 }
705
706 refresh_sequence_number(domain, false);
707
708 va_start(ap, format);
709 smb_xvasprintf(&kstr, format, ap);
710 va_end(ap);
711
712 centry = wcache_fetch_raw(kstr);
713 if (centry == NULL) {
714 free(kstr);
715 return NULL;
716 }
717
718 if (centry_expired(domain, kstr, centry)) {
719
720 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
721 kstr, domain->name ));
722
723 centry_free(centry);
724 free(kstr);
725 return NULL;
726 }
727
728 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
729 kstr, domain->name ));
730
731 free(kstr);
732 return centry;
733 }
734
735 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
736 static void wcache_delete(const char *format, ...)
737 {
738 va_list ap;
739 char *kstr;
740 TDB_DATA key;
741
742 va_start(ap, format);
743 smb_xvasprintf(&kstr, format, ap);
744 va_end(ap);
745
746 key = string_tdb_data(kstr);
747
748 tdb_delete(wcache->tdb, key);
749 free(kstr);
750 }
751
752 /*
753 make sure we have at least len bytes available in a centry
754 */
755 static void centry_expand(struct cache_entry *centry, uint32 len)
756 {
757 if (centry->len - centry->ofs >= len)
758 return;
759 centry->len *= 2;
760 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
761 centry->len);
762 if (!centry->data) {
763 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
764 smb_panic_fn("out of memory in centry_expand");
765 }
766 }
767
768 /*
769 push a uint64_t into a centry
770 */
771 static void centry_put_uint64_t(struct cache_entry *centry, uint64_t v)
772 {
773 centry_expand(centry, 8);
774 SBVAL(centry->data, centry->ofs, v);
775 centry->ofs += 8;
776 }
777
778 /*
779 push a uint32 into a centry
780 */
781 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
782 {
783 centry_expand(centry, 4);
784 SIVAL(centry->data, centry->ofs, v);
785 centry->ofs += 4;
786 }
787
788 /*
789 push a uint16 into a centry
790 */
791 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
792 {
793 centry_expand(centry, 2);
794 SSVAL(centry->data, centry->ofs, v);
795 centry->ofs += 2;
796 }
797
798 /*
799 push a uint8 into a centry
800 */
801 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
802 {
803 centry_expand(centry, 1);
804 SCVAL(centry->data, centry->ofs, v);
805 centry->ofs += 1;
806 }
807
808 /*
809 push a string into a centry
810 */
811 static void centry_put_string(struct cache_entry *centry, const char *s)
812 {
813 int len;
814
815 if (!s) {
816 /* null strings are marked as len 0xFFFF */
817 centry_put_uint8(centry, 0xFF);
818 return;
819 }
820
821 len = strlen(s);
822 /* can't handle more than 254 char strings. Truncating is probably best */
823 if (len > 254) {
824 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
825 len = 254;
826 }
827 centry_put_uint8(centry, len);
828 centry_expand(centry, len);
829 memcpy(centry->data + centry->ofs, s, len);
830 centry->ofs += len;
831 }
832
833 /*
834 push a 16 byte hash into a centry - treat as 16 byte string.
835 */
836 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
837 {
838 centry_put_uint8(centry, 16);
839 centry_expand(centry, 16);
840 memcpy(centry->data + centry->ofs, val, 16);
841 centry->ofs += 16;
842 }
843
844 static void centry_put_sid(struct cache_entry *centry, const struct dom_sid *sid)
845 {
846 fstring sid_string;
847 centry_put_string(centry, sid_to_fstring(sid_string, sid));
848 }
849
850
851 /*
852 put NTSTATUS into a centry
853 */
854 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
855 {
856 uint32 status_value = NT_STATUS_V(status);
857 centry_put_uint32(centry, status_value);
858 }
859
860
861 /*
862 push a NTTIME into a centry
863 */
864 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
865 {
866 centry_expand(centry, 8);
867 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
868 centry->ofs += 4;
869 SIVAL(centry->data, centry->ofs, nt >> 32);
870 centry->ofs += 4;
871 }
872
873 /*
874 push a time_t into a centry - use a 64 bit size.
875 NTTIME here is being used as a convenient 64-bit size.
876 */
877 static void centry_put_time(struct cache_entry *centry, time_t t)
878 {
879 NTTIME nt = (NTTIME)t;
880 centry_put_nttime(centry, nt);
881 }
882
883 /*
884 start a centry for output. When finished, call centry_end()
885 */
886 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
887 {
888 struct cache_entry *centry;
889
890 if (!wcache->tdb)
891 return NULL;
892
893 centry = SMB_XMALLOC_P(struct cache_entry);
894
895 centry->len = 8192; /* reasonable default */
896 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
897 centry->ofs = 0;
898 centry->sequence_number = domain->sequence_number;
899 centry->timeout = lp_winbind_cache_time() + time(NULL);
900 centry_put_ntstatus(centry, status);
901 centry_put_uint32(centry, centry->sequence_number);
902 centry_put_uint64_t(centry, centry->timeout);
903 return centry;
904 }
905
906 /*
907 finish a centry and write it to the tdb
908 */
909 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
910 static void centry_end(struct cache_entry *centry, const char *format, ...)
911 {
912 va_list ap;
913 char *kstr;
914 TDB_DATA key, data;
915
916 if (!winbindd_use_cache()) {
917 return;
918 }
919
920 va_start(ap, format);
921 smb_xvasprintf(&kstr, format, ap);
922 va_end(ap);
923
924 key = string_tdb_data(kstr);
925 data.dptr = centry->data;
926 data.dsize = centry->ofs;
927
928 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
929 free(kstr);
930 }
931
932 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
933 NTSTATUS status, const char *domain_name,
934 const char *name, const struct dom_sid *sid,
935 enum lsa_SidType type)
936 {
937 struct cache_entry *centry;
938 fstring uname;
939
940 centry = centry_start(domain, status);
941 if (!centry)
942 return;
943 centry_put_uint32(centry, type);
944 centry_put_sid(centry, sid);
945 fstrcpy(uname, name);
946 strupper_m(uname);
947 centry_end(centry, "NS/%s/%s", domain_name, uname);
948 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
949 uname, sid_string_dbg(sid), nt_errstr(status)));
950 centry_free(centry);
951 }
952
953 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
954 const struct dom_sid *sid, const char *domain_name, const char *name, enum lsa_SidType type)
955 {
956 struct cache_entry *centry;
957 fstring sid_string;
958
959 centry = centry_start(domain, status);
960 if (!centry)
961 return;
962
963 if (NT_STATUS_IS_OK(status)) {
964 centry_put_uint32(centry, type);
965 centry_put_string(centry, domain_name);
966 centry_put_string(centry, name);
967 }
968
969 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
970 DEBUG(10,("wcache_save_sid_to_name: %s -> %s\\%s (%s)\n", sid_string,
971 domain_name, name, nt_errstr(status)));
972 centry_free(centry);
973 }
974
975
976 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
977 struct wbint_userinfo *info)
978 {
979 struct cache_entry *centry;
980 fstring sid_string;
981
982 if (is_null_sid(&info->user_sid)) {
983 return;
984 }
985
986 centry = centry_start(domain, status);
987 if (!centry)
988 return;
989 centry_put_string(centry, info->acct_name);
990 centry_put_string(centry, info->full_name);
991 centry_put_string(centry, info->homedir);
992 centry_put_string(centry, info->shell);
993 centry_put_uint32(centry, info->primary_gid);
994 centry_put_sid(centry, &info->user_sid);
995 centry_put_sid(centry, &info->group_sid);
996 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
997 &info->user_sid));
998 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
999 centry_free(centry);
1000 }
1001
1002 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
1003 NTSTATUS status,
1004 struct samr_DomInfo12 *lockout_policy)
1005 {
1006 struct cache_entry *centry;
1007
1008 centry = centry_start(domain, status);
1009 if (!centry)
1010 return;
1011
1012 centry_put_nttime(centry, lockout_policy->lockout_duration);
1013 centry_put_nttime(centry, lockout_policy->lockout_window);
1014 centry_put_uint16(centry, lockout_policy->lockout_threshold);
1015
1016 centry_end(centry, "LOC_POL/%s", domain->name);
1017
1018 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
1019
1020 centry_free(centry);
1021 }
1022
1023
1024
1025 static void wcache_save_password_policy(struct winbindd_domain *domain,
1026 NTSTATUS status,
1027 struct samr_DomInfo1 *policy)
1028 {
1029 struct cache_entry *centry;
1030
1031 centry = centry_start(domain, status);
1032 if (!centry)
1033 return;
1034
1035 centry_put_uint16(centry, policy->min_password_length);
1036 centry_put_uint16(centry, policy->password_history_length);
1037 centry_put_uint32(centry, policy->password_properties);
1038 centry_put_nttime(centry, policy->max_password_age);
1039 centry_put_nttime(centry, policy->min_password_age);
1040
1041 centry_end(centry, "PWD_POL/%s", domain->name);
1042
1043 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1044
1045 centry_free(centry);
1046 }
1047
1048 /***************************************************************************
1049 ***************************************************************************/
1050
1051 static void wcache_save_username_alias(struct winbindd_domain *domain,
1052 NTSTATUS status,
1053 const char *name, const char *alias)
1054 {
1055 struct cache_entry *centry;
1056 fstring uname;
1057
1058 if ( (centry = centry_start(domain, status)) == NULL )
1059 return;
1060
1061 centry_put_string( centry, alias );
1062
1063 fstrcpy(uname, name);
1064 strupper_m(uname);
1065 centry_end(centry, "NSS/NA/%s", uname);
1066
1067 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1068
1069 centry_free(centry);
1070 }
1071
1072 static void wcache_save_alias_username(struct winbindd_domain *domain,
1073 NTSTATUS status,
1074 const char *alias, const char *name)
1075 {
1076 struct cache_entry *centry;
1077 fstring uname;
1078
1079 if ( (centry = centry_start(domain, status)) == NULL )
1080 return;
1081
1082 centry_put_string( centry, name );
1083
1084 fstrcpy(uname, alias);
1085 strupper_m(uname);
1086 centry_end(centry, "NSS/AN/%s", uname);
1087
1088 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1089
1090 centry_free(centry);
1091 }
1092
1093 /***************************************************************************
1094 ***************************************************************************/
1095
1096 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1097 struct winbindd_domain *domain,
1098 const char *name, char **alias )
1099 {
1100 struct winbind_cache *cache = get_cache(domain);
1101 struct cache_entry *centry = NULL;
1102 NTSTATUS status;
1103 char *upper_name;
1104
1105 if ( domain->internal )
1106 return NT_STATUS_NOT_SUPPORTED;
1107
1108 if (!cache->tdb)
1109 goto do_query;
1110
1111 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1112 return NT_STATUS_NO_MEMORY;
1113 strupper_m(upper_name);
1114
1115 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1116
1117 SAFE_FREE( upper_name );
1118
1119 if (!centry)
1120 goto do_query;
1121
1122 status = centry->status;
1123
1124 if (!NT_STATUS_IS_OK(status)) {
1125 centry_free(centry);
1126 return status;
1127 }
1128
1129 *alias = centry_string( centry, mem_ctx );
1130
1131 centry_free(centry);
1132
1133 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1134 name, *alias ? *alias : "(none)"));
1135
1136 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1137
1138 do_query:
1139
1140 /* If its not in cache and we are offline, then fail */
1141
1142 if ( get_global_winbindd_state_offline() || !domain->online ) {
1143 DEBUG(8,("resolve_username_to_alias: rejecting query "
1144 "in offline mode\n"));
1145 return NT_STATUS_NOT_FOUND;
1146 }
1147
1148 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1149
1150 if ( NT_STATUS_IS_OK( status ) ) {
1151 wcache_save_username_alias(domain, status, name, *alias);
1152 }
1153
1154 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1155 wcache_save_username_alias(domain, status, name, "(NULL)");
1156 }
1157
1158 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1159 nt_errstr(status)));
1160
1161 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1162 set_domain_offline( domain );
1163 }
1164
1165 return status;
1166 }
1167
1168 /***************************************************************************
1169 ***************************************************************************/
1170
1171 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1172 struct winbindd_domain *domain,
1173 const char *alias, char **name )
1174 {
1175 struct winbind_cache *cache = get_cache(domain);
1176 struct cache_entry *centry = NULL;
1177 NTSTATUS status;
1178 char *upper_name;
1179
1180 if ( domain->internal )
1181 return NT_STATUS_NOT_SUPPORTED;
1182
1183 if (!cache->tdb)
1184 goto do_query;
1185
1186 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1187 return NT_STATUS_NO_MEMORY;
1188 strupper_m(upper_name);
1189
1190 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1191
1192 SAFE_FREE( upper_name );
1193
1194 if (!centry)
1195 goto do_query;
1196
1197 status = centry->status;
1198
1199 if (!NT_STATUS_IS_OK(status)) {
1200 centry_free(centry);
1201 return status;
1202 }
1203
1204 *name = centry_string( centry, mem_ctx );
1205
1206 centry_free(centry);
1207
1208 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1209 alias, *name ? *name : "(none)"));
1210
1211 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1212
1213 do_query:
1214
1215 /* If its not in cache and we are offline, then fail */
1216
1217 if ( get_global_winbindd_state_offline() || !domain->online ) {
1218 DEBUG(8,("resolve_alias_to_username: rejecting query "
1219 "in offline mode\n"));
1220 return NT_STATUS_NOT_FOUND;
1221 }
1222
1223 /* an alias cannot contain a domain prefix or '@' */
1224
1225 if (strchr(alias, '\\') || strchr(alias, '@')) {
1226 DEBUG(10,("resolve_alias_to_username: skipping fully "
1227 "qualified name %s\n", alias));
1228 return NT_STATUS_OBJECT_NAME_INVALID;
1229 }
1230
1231 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1232
1233 if ( NT_STATUS_IS_OK( status ) ) {
1234 wcache_save_alias_username( domain, status, alias, *name );
1235 }
1236
1237 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1238 wcache_save_alias_username(domain, status, alias, "(NULL)");
1239 }
1240
1241 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1242 nt_errstr(status)));
1243
1244 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1245 set_domain_offline( domain );
1246 }
1247
1248 return status;
1249 }
1250
1251 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const struct dom_sid *sid)
1252 {
1253 struct winbind_cache *cache = get_cache(domain);
1254 TDB_DATA data;
1255 fstring key_str, tmp;
1256 uint32 rid;
1257
1258 if (!cache->tdb) {
1259 return NT_STATUS_INTERNAL_DB_ERROR;
1260 }
1261
1262 if (is_null_sid(sid)) {
1263 return NT_STATUS_INVALID_SID;
1264 }
1265
1266 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1267 return NT_STATUS_INVALID_SID;
1268 }
1269
1270 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1271
1272 data = tdb_fetch_compat(cache->tdb, string_tdb_data(key_str));
1273 if (!data.dptr) {
1274 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1275 }
1276
1277 SAFE_FREE(data.dptr);
1278 return NT_STATUS_OK;
1279 }
1280
1281 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1282 as new salted ones. */
1283
1284 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1285 TALLOC_CTX *mem_ctx,
1286 const struct dom_sid *sid,
1287 const uint8 **cached_nt_pass,
1288 const uint8 **cached_salt)
1289 {
1290 struct winbind_cache *cache = get_cache(domain);
1291 struct cache_entry *centry = NULL;
1292 NTSTATUS status;
1293 time_t t;
1294 uint32 rid;
1295 fstring tmp;
1296
1297 if (!winbindd_use_cache()) {
1298 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1299 }
1300
1301 if (!cache->tdb) {
1302 return NT_STATUS_INTERNAL_DB_ERROR;
1303 }
1304
1305 if (is_null_sid(sid)) {
1306 return NT_STATUS_INVALID_SID;
1307 }
1308
1309 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1310 return NT_STATUS_INVALID_SID;
1311 }
1312
1313 /* Try and get a salted cred first. If we can't
1314 fall back to an unsalted cred. */
1315
1316 centry = wcache_fetch(cache, domain, "CRED/%s",
1317 sid_to_fstring(tmp, sid));
1318 if (!centry) {
1319 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1320 sid_string_dbg(sid)));
1321 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1322 }
1323
1324 t = centry_time(centry);
1325
1326 /* In the salted case this isn't actually the nt_hash itself,
1327 but the MD5 of the salt + nt_hash. Let the caller
1328 sort this out. It can tell as we only return the cached_salt
1329 if we are returning a salted cred. */
1330
1331 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1332 if (*cached_nt_pass == NULL) {
1333 fstring sidstr;
1334
1335 sid_to_fstring(sidstr, sid);
1336
1337 /* Bad (old) cred cache. Delete and pretend we
1338 don't have it. */
1339 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1340 sidstr));
1341 wcache_delete("CRED/%s", sidstr);
1342 centry_free(centry);
1343 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1344 }
1345
1346 /* We only have 17 bytes more data in the salted cred case. */
1347 if (centry->len - centry->ofs == 17) {
1348 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1349 } else {
1350 *cached_salt = NULL;
1351 }
1352
1353 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1354 if (*cached_salt) {
1355 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1356 }
1357
1358 status = centry->status;
1359
1360 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1361 sid_string_dbg(sid), nt_errstr(status) ));
1362
1363 centry_free(centry);
1364 return status;
1365 }
1366
1367 /* Store creds for a SID - only writes out new salted ones. */
1368
1369 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1370 const struct dom_sid *sid,
1371 const uint8 nt_pass[NT_HASH_LEN])
1372 {
1373 struct cache_entry *centry;
1374 fstring sid_string;
1375 uint32 rid;
1376 uint8 cred_salt[NT_HASH_LEN];
1377 uint8 salted_hash[NT_HASH_LEN];
1378
1379 if (is_null_sid(sid)) {
1380 return NT_STATUS_INVALID_SID;
1381 }
1382
1383 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1384 return NT_STATUS_INVALID_SID;
1385 }
1386
1387 centry = centry_start(domain, NT_STATUS_OK);
1388 if (!centry) {
1389 return NT_STATUS_INTERNAL_DB_ERROR;
1390 }
1391
1392 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1393
1394 centry_put_time(centry, time(NULL));
1395
1396 /* Create a salt and then salt the hash. */
1397 generate_random_buffer(cred_salt, NT_HASH_LEN);
1398 E_md5hash(cred_salt, nt_pass, salted_hash);
1399
1400 centry_put_hash16(centry, salted_hash);
1401 centry_put_hash16(centry, cred_salt);
1402 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1403
1404 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1405
1406 centry_free(centry);
1407
1408 return NT_STATUS_OK;
1409 }
1410
1411
1412 /* Query display info. This is the basic user list fn */
1413 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1414 TALLOC_CTX *mem_ctx,
1415 uint32 *num_entries,
1416 struct wbint_userinfo **info)
1417 {
1418 struct winbind_cache *cache = get_cache(domain);
1419 struct cache_entry *centry = NULL;
1420 NTSTATUS status;
1421 unsigned int i, retry;
1422 bool old_status = domain->online;
1423
1424 if (!cache->tdb)
1425 goto do_query;
1426
1427 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1428 if (!centry)
1429 goto do_query;
1430
1431 do_fetch_cache:
1432 *num_entries = centry_uint32(centry);
1433
1434 if (*num_entries == 0)
1435 goto do_cached;
1436
1437 (*info) = talloc_array(mem_ctx, struct wbint_userinfo, *num_entries);
1438 if (! (*info)) {
1439 smb_panic_fn("query_user_list out of memory");
1440 }
1441 for (i=0; i<(*num_entries); i++) {
1442 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1443 (*info)[i].full_name = centry_string(centry, mem_ctx);
1444 (*info)[i].homedir = centry_string(centry, mem_ctx);
1445 (*info)[i].shell = centry_string(centry, mem_ctx);
1446 centry_sid(centry, &(*info)[i].user_sid);
1447 centry_sid(centry, &(*info)[i].group_sid);
1448 }
1449
1450 do_cached:
1451 status = centry->status;
1452
1453 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1454 domain->name, nt_errstr(status) ));
1455
1456 centry_free(centry);
1457 return status;
1458
1459 do_query:
1460 *num_entries = 0;
1461 *info = NULL;
1462
1463 /* Return status value returned by seq number check */
1464
1465 if (!NT_STATUS_IS_OK(domain->last_status))
1466 return domain->last_status;
1467
1468 /* Put the query_user_list() in a retry loop. There appears to be
1469 * some bug either with Windows 2000 or Samba's handling of large
1470 * rpc replies. This manifests itself as sudden disconnection
1471 * at a random point in the enumeration of a large (60k) user list.
1472 * The retry loop simply tries the operation again. )-: It's not
1473 * pretty but an acceptable workaround until we work out what the
1474 * real problem is. */
1475
1476 retry = 0;
1477 do {
1478
1479 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1480 domain->name ));
1481
1482 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1483 if (!NT_STATUS_IS_OK(status)) {
1484 DEBUG(3, ("query_user_list: returned 0x%08x, "
1485 "retrying\n", NT_STATUS_V(status)));
1486 }
1487 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1488 DEBUG(3, ("query_user_list: flushing "
1489 "connection cache\n"));
1490 invalidate_cm_connection(&domain->conn);
1491 }
1492 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1493 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1494 if (!domain->internal && old_status) {
1495 set_domain_offline(domain);
1496 }
1497 /* store partial response. */
1498 if (*num_entries > 0) {
1499 /*
1500 * humm, what about the status used for cache?
1501 * Should it be NT_STATUS_OK?
1502 */
1503 break;
1504 }
1505 /*
1506 * domain is offline now, and there is no user entries,
1507 * try to fetch from cache again.
1508 */
1509 if (cache->tdb && !domain->online && !domain->internal && old_status) {
1510 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1511 /* partial response... */
1512 if (!centry) {
1513 goto skip_save;
1514 } else {
1515 goto do_fetch_cache;
1516 }
1517 } else {
1518 goto skip_save;
1519 }
1520 }
1521
1522 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1523 (retry++ < 5));
1524
1525 /* and save it */
1526 refresh_sequence_number(domain, false);
1527 if (!NT_STATUS_IS_OK(status)) {
1528 return status;
1529 }
1530 centry = centry_start(domain, status);
1531 if (!centry)
1532 goto skip_save;
1533 centry_put_uint32(centry, *num_entries);
1534 for (i=0; i<(*num_entries); i++) {
1535 centry_put_string(centry, (*info)[i].acct_name);
1536 centry_put_string(centry, (*info)[i].full_name);
1537 centry_put_string(centry, (*info)[i].homedir);
1538 centry_put_string(centry, (*info)[i].shell);
1539 centry_put_sid(centry, &(*info)[i].user_sid);
1540 centry_put_sid(centry, &(*info)[i].group_sid);
1541 if (domain->backend && domain->backend->consistent) {
1542 /* when the backend is consistent we can pre-prime some mappings */
1543 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1544 domain->name,
1545 (*info)[i].acct_name,
1546 &(*info)[i].user_sid,
1547 SID_NAME_USER);
1548 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1549 &(*info)[i].user_sid,
1550 domain->name,
1551 (*info)[i].acct_name,
1552 SID_NAME_USER);
1553 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1554 }
1555 }
1556 centry_end(centry, "UL/%s", domain->name);
1557 centry_free(centry);
1558
1559 skip_save:
1560 return status;
1561 }
1562
1563 /* list all domain groups */
1564 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1565 TALLOC_CTX *mem_ctx,
1566 uint32 *num_entries,
1567 struct wb_acct_info **info)
1568 {
1569 struct winbind_cache *cache = get_cache(domain);
1570 struct cache_entry *centry = NULL;
1571 NTSTATUS status;
1572 unsigned int i;
1573 bool old_status;
1574
1575 old_status = domain->online;
1576 if (!cache->tdb)
1577 goto do_query;
1578
1579 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1580 if (!centry)
1581 goto do_query;
1582
1583 do_fetch_cache:
1584 *num_entries = centry_uint32(centry);
1585
1586 if (*num_entries == 0)
1587 goto do_cached;
1588
1589 (*info) = talloc_array(mem_ctx, struct wb_acct_info, *num_entries);
1590 if (! (*info)) {
1591 smb_panic_fn("enum_dom_groups out of memory");
1592 }
1593 for (i=0; i<(*num_entries); i++) {
1594 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1595 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1596 (*info)[i].rid = centry_uint32(centry);
1597 }
1598
1599 do_cached:
1600 status = centry->status;
1601
1602 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1603 domain->name, nt_errstr(status) ));
1604
1605 centry_free(centry);
1606 return status;
1607
1608 do_query:
1609 *num_entries = 0;
1610 *info = NULL;
1611
1612 /* Return status value returned by seq number check */
1613
1614 if (!NT_STATUS_IS_OK(domain->last_status))
1615 return domain->last_status;
1616
1617 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1618 domain->name ));
1619
1620 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1621
1622 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1623 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1624 if (!domain->internal && old_status) {
1625 set_domain_offline(domain);
1626 }
1627 if (cache->tdb &&
1628 !domain->online &&
1629 !domain->internal &&
1630 old_status) {
1631 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1632 if (centry) {
1633 goto do_fetch_cache;
1634 }
1635 }
1636 }
1637 /* and save it */
1638 refresh_sequence_number(domain, false);
1639 if (!NT_STATUS_IS_OK(status)) {
1640 return status;
1641 }
1642 centry = centry_start(domain, status);
1643 if (!centry)
1644 goto skip_save;
1645 centry_put_uint32(centry, *num_entries);
1646 for (i=0; i<(*num_entries); i++) {
1647 centry_put_string(centry, (*info)[i].acct_name);
1648 centry_put_string(centry, (*info)[i].acct_desc);
1649 centry_put_uint32(centry, (*info)[i].rid);
1650 }
1651 centry_end(centry, "GL/%s/domain", domain->name);
1652 centry_free(centry);
1653
1654 skip_save:
1655 return status;
1656 }
1657
1658 /* list all domain groups */
1659 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1660 TALLOC_CTX *mem_ctx,
1661 uint32 *num_entries,
1662 struct wb_acct_info **info)
1663 {
1664 struct winbind_cache *cache = get_cache(domain);
1665 struct cache_entry *centry = NULL;
1666 NTSTATUS status;
1667 unsigned int i;
1668 bool old_status;
1669
1670 old_status = domain->online;
1671 if (!cache->tdb)
1672 goto do_query;
1673
1674 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1675 if (!centry)
1676 goto do_query;
1677
1678 do_fetch_cache:
1679 *num_entries = centry_uint32(centry);
1680
1681 if (*num_entries == 0)
1682 goto do_cached;
1683
1684 (*info) = talloc_array(mem_ctx, struct wb_acct_info, *num_entries);
1685 if (! (*info)) {
1686 smb_panic_fn("enum_dom_groups out of memory");
1687 }
1688 for (i=0; i<(*num_entries); i++) {
1689 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1690 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1691 (*info)[i].rid = centry_uint32(centry);
1692 }
1693
1694 do_cached:
1695
1696 /* If we are returning cached data and the domain controller
1697 is down then we don't know whether the data is up to date
1698 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1699 indicate this. */
1700
1701 if (wcache_server_down(domain)) {
1702 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1703 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1704 } else
1705 status = centry->status;
1706
1707 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1708 domain->name, nt_errstr(status) ));
1709
1710 centry_free(centry);
1711 return status;
1712
1713 do_query:
1714 *num_entries = 0;
1715 *info = NULL;
1716
1717 /* Return status value returned by seq number check */
1718
1719 if (!NT_STATUS_IS_OK(domain->last_status))
1720 return domain->last_status;
1721
1722 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1723 domain->name ));
1724
1725 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1726
1727 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1728 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1729 if (!domain->internal && old_status) {
1730 set_domain_offline(domain);
1731 }
1732 if (cache->tdb &&
1733 !domain->internal &&
1734 !domain->online &&
1735 old_status) {
1736 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1737 if (centry) {
1738 goto do_fetch_cache;
1739 }
1740 }
1741 }
1742 /* and save it */
1743 refresh_sequence_number(domain, false);
1744 if (!NT_STATUS_IS_OK(status)) {
1745 return status;
1746 }
1747 centry = centry_start(domain, status);
1748 if (!centry)
1749 goto skip_save;
1750 centry_put_uint32(centry, *num_entries);
1751 for (i=0; i<(*num_entries); i++) {
1752 centry_put_string(centry, (*info)[i].acct_name);
1753 centry_put_string(centry, (*info)[i].acct_desc);
1754 centry_put_uint32(centry, (*info)[i].rid);
1755 }
1756 centry_end(centry, "GL/%s/local", domain->name);
1757 centry_free(centry);
1758
1759 skip_save:
1760 return status;
1761 }
1762
1763 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1764 const char *domain_name,
1765 const char *name,
1766 struct dom_sid *sid,
1767 enum lsa_SidType *type)
1768 {
1769 struct winbind_cache *cache = get_cache(domain);
1770 struct cache_entry *centry;
1771 NTSTATUS status;
1772 char *uname;
1773
1774 if (cache->tdb == NULL) {
1775 return NT_STATUS_NOT_FOUND;
1776 }
1777
1778 uname = talloc_strdup_upper(talloc_tos(), name);
1779 if (uname == NULL) {
1780 return NT_STATUS_NO_MEMORY;
1781 }
1782
1783 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1784 TALLOC_FREE(uname);
1785 if (centry == NULL) {
1786 return NT_STATUS_NOT_FOUND;
1787 }
1788
1789 status = centry->status;
1790 if (NT_STATUS_IS_OK(status)) {
1791 *type = (enum lsa_SidType)centry_uint32(centry);
1792 centry_sid(centry, sid);
1793 }
1794
1795 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1796 "%s\n", domain->name, nt_errstr(status) ));
1797
1798 centry_free(centry);
1799 return status;
1800 }
1801
1802 /* convert a single name to a sid in a domain */
1803 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1804 TALLOC_CTX *mem_ctx,
1805 const char *domain_name,
1806 const char *name,
1807 uint32_t flags,
1808 struct dom_sid *sid,
1809 enum lsa_SidType *type)
1810 {
1811 NTSTATUS status;
1812 bool old_status;
1813
1814 old_status = domain->online;
1815
1816 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1817 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1818 return status;
1819 }
1820
1821 ZERO_STRUCTP(sid);
1822
1823 /* If the seq number check indicated that there is a problem
1824 * with this DC, then return that status... except for
1825 * access_denied. This is special because the dc may be in
1826 * "restrict anonymous = 1" mode, in which case it will deny
1827 * most unauthenticated operations, but *will* allow the LSA
1828 * name-to-sid that we try as a fallback. */
1829
1830 if (!(NT_STATUS_IS_OK(domain->last_status)
1831 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1832 return domain->last_status;
1833
1834 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1835 domain->name ));
1836
1837 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1838 name, flags, sid, type);
1839
1840 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1841 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1842 if (!domain->internal && old_status) {
1843 set_domain_offline(domain);
1844 }
1845 if (!domain->internal &&
1846 !domain->online &&
1847 old_status) {
1848 NTSTATUS cache_status;
1849 cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1850 return cache_status;
1851 }
1852 }
1853 /* and save it */
1854 refresh_sequence_number(domain, false);
1855
1856 if (domain->online &&
1857 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1858 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1859
1860 /* Only save the reverse mapping if this was not a UPN */
1861 if (!strchr(name, '@')) {
1862 strupper_m(discard_const_p(char, domain_name));
1863 strlower_m(discard_const_p(char, name));
1864 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1865 }
1866 }
1867
1868 return status;
1869 }
1870
1871 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1872 const struct dom_sid *sid,
1873 TALLOC_CTX *mem_ctx,
1874 char **domain_name,
1875 char **name,
1876 enum lsa_SidType *type)
1877 {
1878 struct winbind_cache *cache = get_cache(domain);
1879 struct cache_entry *centry;
1880 char *sid_string;
1881 NTSTATUS status;
1882
1883 if (cache->tdb == NULL) {
1884 return NT_STATUS_NOT_FOUND;
1885 }
1886
1887 sid_string = sid_string_tos(sid);
1888 if (sid_string == NULL) {
1889 return NT_STATUS_NO_MEMORY;
1890 }
1891
1892 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1893 TALLOC_FREE(sid_string);
1894 if (centry == NULL) {
1895 return NT_STATUS_NOT_FOUND;
1896 }
1897
1898 if (NT_STATUS_IS_OK(centry->status)) {
1899 *type = (enum lsa_SidType)centry_uint32(centry);
1900 *domain_name = centry_string(centry, mem_ctx);
1901 *name = centry_string(centry, mem_ctx);
1902 }
1903
1904 status = centry->status;
1905 centry_free(centry);
1906
1907 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1908 "%s\n", domain->name, nt_errstr(status) ));
1909
1910 return status;
1911 }
1912
1913 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1914 given */
1915 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1916 TALLOC_CTX *mem_ctx,
1917 const struct dom_sid *sid,
1918 char **domain_name,
1919 char **name,
1920 enum lsa_SidType *type)
1921 {
1922 NTSTATUS status;
1923 bool old_status;
1924
1925 old_status = domain->online;
1926 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1927 type);
1928 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1929 return status;
1930 }
1931
1932 *name = NULL;
1933 *domain_name = NULL;
1934
1935 /* If the seq number check indicated that there is a problem
1936 * with this DC, then return that status... except for
1937 * access_denied. This is special because the dc may be in
1938 * "restrict anonymous = 1" mode, in which case it will deny
1939 * most unauthenticated operations, but *will* allow the LSA
1940 * sid-to-name that we try as a fallback. */
1941
1942 if (!(NT_STATUS_IS_OK(domain->last_status)
1943 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1944 return domain->last_status;
1945
1946 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1947 domain->name ));
1948
1949 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1950
1951 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1952 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1953 if (!domain->internal && old_status) {
1954 set_domain_offline(domain);
1955 }
1956 if (!domain->internal &&
1957 !domain->online &&
1958 old_status) {
1959 NTSTATUS cache_status;
1960 cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1961 domain_name, name, type);
1962 return cache_status;
1963 }
1964 }
1965 /* and save it */
1966 refresh_sequence_number(domain, false);
1967 if (!NT_STATUS_IS_OK(status)) {
1968 return status;
1969 }
1970 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1971
1972 /* We can't save the name to sid mapping here, as with sid history a
1973 * later name2sid would give the wrong sid. */
1974
1975 return status;
1976 }
1977
1978 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1979 TALLOC_CTX *mem_ctx,
1980 const struct dom_sid *domain_sid,
1981 uint32 *rids,
1982 size_t num_rids,
1983 char **domain_name,
1984 char ***names,
1985 enum lsa_SidType **types)
1986 {
1987 struct winbind_cache *cache = get_cache(domain);
1988 size_t i;
1989 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1990 bool have_mapped;
1991 bool have_unmapped;
1992 bool old_status;
1993
1994 old_status = domain->online;
1995 *domain_name = NULL;
1996 *names = NULL;
1997 *types = NULL;
1998
1999 if (!cache->tdb) {
2000 goto do_query;
2001 }
2002
2003 if (num_rids == 0) {
2004 return NT_STATUS_OK;
2005 }
2006
2007 *names = talloc_array(mem_ctx, char *, num_rids);
2008 *types = talloc_array(mem_ctx, enum lsa_SidType, num_rids);
2009
2010 if ((*names == NULL) || (*types == NULL)) {
2011 result = NT_STATUS_NO_MEMORY;
2012 goto error;
2013 }
2014
2015 have_mapped = have_unmapped = false;
2016
2017 for (i=0; i<num_rids; i++) {
2018 struct dom_sid sid;
2019 struct cache_entry *centry;
2020 fstring tmp;
2021
2022 if (!sid_compose(&sid, domain_sid, rids[i])) {
2023 result = NT_STATUS_INTERNAL_ERROR;
2024 goto error;
2025 }
2026
2027 centry = wcache_fetch(cache, domain, "SN/%s",
2028 sid_to_fstring(tmp, &sid));
2029 if (!centry) {
2030 goto do_query;
2031 }
2032
2033 (*types)[i] = SID_NAME_UNKNOWN;
2034 (*names)[i] = talloc_strdup(*names, "");
2035
2036 if (NT_STATUS_IS_OK(centry->status)) {
2037 char *dom;
2038 have_mapped = true;
2039 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2040
2041 dom = centry_string(centry, mem_ctx);
2042 if (*domain_name == NULL) {
2043 *domain_name = dom;
2044 } else {
2045 talloc_free(dom);
2046 }
2047
2048 (*names)[i] = centry_string(centry, *names);
2049
2050 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)
2051 || NT_STATUS_EQUAL(centry->status, STATUS_SOME_UNMAPPED)) {
2052 have_unmapped = true;
2053
2054 } else {
2055 /* something's definitely wrong */
2056 result = centry->status;
2057 goto error;
2058 }
2059
2060 centry_free(centry);
2061 }
2062
2063 if (!have_mapped) {
2064 return NT_STATUS_NONE_MAPPED;
2065 }
2066 if (!have_unmapped) {
2067 return NT_STATUS_OK;
2068 }
2069 return STATUS_SOME_UNMAPPED;
2070
2071 do_query:
2072
2073 TALLOC_FREE(*names);
2074 TALLOC_FREE(*types);
2075
2076 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2077 rids, num_rids, domain_name,
2078 names, types);
2079
2080 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2081 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2082 if (!domain->internal && old_status) {
2083 set_domain_offline(domain);
2084 }
2085 if (cache->tdb &&
2086 !domain->internal &&
2087 !domain->online &&
2088 old_status) {
2089 have_mapped = have_unmapped = false;
2090
2091 for (i=0; i<num_rids; i++) {
2092 struct dom_sid sid;
2093 struct cache_entry *centry;
2094 fstring tmp;
2095
2096 if (!sid_compose(&sid, domain_sid, rids[i])) {
2097 result = NT_STATUS_INTERNAL_ERROR;
2098 goto error;
2099 }
2100
2101 centry = wcache_fetch(cache, domain, "SN/%s",
2102 sid_to_fstring(tmp, &sid));
2103 if (!centry) {
2104 (*types)[i] = SID_NAME_UNKNOWN;
2105 (*names)[i] = talloc_strdup(*names, "");
2106 continue;
2107 }
2108
2109 (*types)[i] = SID_NAME_UNKNOWN;
2110 (*names)[i] = talloc_strdup(*names, "");
2111
2112 if (NT_STATUS_IS_OK(centry->status)) {
2113 char *dom;
2114 have_mapped = true;
2115 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2116
2117 dom = centry_string(centry, mem_ctx);
2118 if (*domain_name == NULL) {
2119 *domain_name = dom;
2120 } else {
2121 talloc_free(dom);
2122 }
2123
2124 (*names)[i] = centry_string(centry, *names);
2125
2126 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2127 have_unmapped = true;
2128
2129 } else {
2130 /* something's definitely wrong */
2131 result = centry->status;
2132 goto error;
2133 }
2134
2135 centry_free(centry);
2136 }
2137
2138 if (!have_mapped) {
2139 return NT_STATUS_NONE_MAPPED;
2140 }
2141 if (!have_unmapped) {
2142 return NT_STATUS_OK;
2143 }
2144 return STATUS_SOME_UNMAPPED;
2145 }
2146 }
2147 /*
2148 None of the queried rids has been found so save all negative entries
2149 */
2150 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2151 for (i = 0; i < num_rids; i++) {
2152 struct dom_sid sid;
2153 const char *name = "";
2154 const enum lsa_SidType type = SID_NAME_UNKNOWN;
2155 NTSTATUS status = NT_STATUS_NONE_MAPPED;
2156
2157 if (!sid_compose(&sid, domain_sid, rids[i])) {
2158 return NT_STATUS_INTERNAL_ERROR;
2159 }
2160
2161 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2162 name, type);
2163 }
2164
2165 return result;
2166 }
2167
2168 /*
2169 Some or all of the queried rids have been found.
2170 */
2171 if (!NT_STATUS_IS_OK(result) &&
2172 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2173 return result;
2174 }
2175
2176 refresh_sequence_number(domain, false);
2177
2178 for (i=0; i<num_rids; i++) {
2179 struct dom_sid sid;
2180 NTSTATUS status;
2181
2182 if (!sid_compose(&sid, domain_sid, rids[i])) {
2183 result = NT_STATUS_INTERNAL_ERROR;
2184 goto error;
2185 }
2186
2187 status = (*types)[i] == SID_NAME_UNKNOWN ?
2188 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2189
2190 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2191 (*names)[i], (*types)[i]);
2192 }
2193
2194 return result;
2195
2196 error:
2197 TALLOC_FREE(*names);
2198 TALLOC_FREE(*types);
2199 return result;
2200 }
2201
2202 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2203 TALLOC_CTX *mem_ctx,
2204 const struct dom_sid *user_sid,
2205 struct wbint_userinfo *info)
2206 {
2207 struct winbind_cache *cache = get_cache(domain);
2208 struct cache_entry *centry = NULL;
2209 NTSTATUS status;
2210 char *sid_string;
2211
2212 if (cache->tdb == NULL) {
2213 return NT_STATUS_NOT_FOUND;
2214 }
2215
2216 sid_string = sid_string_tos(user_sid);
2217 if (sid_string == NULL) {
2218 return NT_STATUS_NO_MEMORY;
2219 }
2220
2221 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2222 TALLOC_FREE(sid_string);
2223 if (centry == NULL) {
2224 return NT_STATUS_NOT_FOUND;
2225 }
2226
2227 /*
2228 * If we have an access denied cache entry and a cached info3
2229 * in the samlogon cache then do a query. This will force the
2230 * rpc back end to return the info3 data.
2231 */
2232
2233 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2234 netsamlogon_cache_have(user_sid)) {
2235 DEBUG(10, ("query_user: cached access denied and have cached "
2236 "info3\n"));
2237 domain->last_status = NT_STATUS_OK;
2238 centry_free(centry);
2239 return NT_STATUS_NOT_FOUND;
2240 }
2241
2242 /* if status is not ok then this is a negative hit
2243 and the rest of the data doesn't matter */
2244 status = centry->status;
2245 if (NT_STATUS_IS_OK(status)) {
2246 info->acct_name = centry_string(centry, mem_ctx);
2247 info->full_name = centry_string(centry, mem_ctx);
2248 info->homedir = centry_string(centry, mem_ctx);
2249 info->shell = centry_string(centry, mem_ctx);
2250 info->primary_gid = centry_uint32(centry);
2251 centry_sid(centry, &info->user_sid);
2252 centry_sid(centry, &info->group_sid);
2253 }
2254
2255 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2256 "%s\n", domain->name, nt_errstr(status) ));
2257
2258 centry_free(centry);
2259 return status;
2260 }
2261
2262 /* Lookup user information from a rid */
2263 static NTSTATUS query_user(struct winbindd_domain *domain,
2264 TALLOC_CTX *mem_ctx,
2265 const struct dom_sid *user_sid,
2266 struct wbint_userinfo *info)
2267 {
2268 NTSTATUS status;
2269 bool old_status;
2270
2271 old_status = domain->online;
2272 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2273 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2274 return status;
2275 }
2276
2277 ZERO_STRUCTP(info);
2278
2279 /* Return status value returned by seq number check */
2280
2281 if (!NT_STATUS_IS_OK(domain->last_status))
2282 return domain->last_status;
2283
2284 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2285 domain->name ));
2286
2287 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2288
2289 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2290 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2291 if (!domain->internal && old_status) {
2292 set_domain_offline(domain);
2293 }
2294 if (!domain->internal &&
2295 !domain->online &&
2296 old_status) {
2297 NTSTATUS cache_status;
2298 cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2299 return cache_status;
2300 }
2301 }
2302 /* and save it */
2303 refresh_sequence_number(domain, false);
2304 if (!NT_STATUS_IS_OK(status)) {
2305 return status;
2306 }
2307 wcache_save_user(domain, status, info);
2308
2309 return status;
2310 }
2311
2312 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2313 TALLOC_CTX *mem_ctx,
2314 const struct dom_sid *user_sid,
2315 uint32_t *pnum_sids,
2316 struct dom_sid **psids)
2317 {
2318 struct winbind_cache *cache = get_cache(domain);
2319 struct cache_entry *centry = NULL;
2320 NTSTATUS status;
2321 uint32_t i, num_sids;
2322 struct dom_sid *sids;
2323 fstring sid_string;
2324
2325 if (cache->tdb == NULL) {
2326 return NT_STATUS_NOT_FOUND;
2327 }
2328
2329 centry = wcache_fetch(cache, domain, "UG/%s",
2330 sid_to_fstring(sid_string, user_sid));
2331 if (centry == NULL) {
2332 return NT_STATUS_NOT_FOUND;
2333 }
2334
2335 /* If we have an access denied cache entry and a cached info3 in the
2336 samlogon cache then do a query. This will force the rpc back end
2337 to return the info3 data. */
2338
2339 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2340 && netsamlogon_cache_have(user_sid)) {
2341 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2342 "cached info3\n"));
2343 domain->last_status = NT_STATUS_OK;
2344 centry_free(centry);
2345 return NT_STATUS_NOT_FOUND;
2346 }
2347
2348 num_sids = centry_uint32(centry);
2349 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2350 if (sids == NULL) {
2351 centry_free(centry);
2352 return NT_STATUS_NO_MEMORY;
2353 }
2354
2355 for (i=0; i<num_sids; i++) {
2356 centry_sid(centry, &sids[i]);
2357 }
2358
2359 status = centry->status;
2360
2361 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2362 "status: %s\n", domain->name, nt_errstr(status)));
2363
2364 centry_free(centry);
2365
2366 *pnum_sids = num_sids;
2367 *psids = sids;
2368 return status;
2369 }
2370
2371 /* Lookup groups a user is a member of. */
2372 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2373 TALLOC_CTX *mem_ctx,
2374 const struct dom_sid *user_sid,
2375 uint32 *num_groups, struct dom_sid **user_gids)
2376 {
2377 struct cache_entry *centry = NULL;
2378 NTSTATUS status;
2379 unsigned int i;
2380 fstring sid_string;
2381 bool old_status;
2382
2383 old_status = domain->online;
2384 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2385 num_groups, user_gids);
2386 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2387 return status;
2388 }
2389
2390 (*num_groups) = 0;
2391 (*user_gids) = NULL;
2392
2393 /* Return status value returned by seq number check */
2394
2395 if (!NT_STATUS_IS_OK(domain->last_status))
2396 return domain->last_status;
2397
2398 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2399 domain->name ));
2400
2401 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2402
2403 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2404 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2405 if (!domain->internal && old_status) {
2406 set_domain_offline(domain);
2407 }
2408 if (!domain->internal &&
2409 !domain->online &&
2410 old_status) {
2411 NTSTATUS cache_status;
2412 cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2413 num_groups, user_gids);
2414 return cache_status;
2415 }
2416 }
2417 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2418 goto skip_save;
2419
2420 /* and save it */
2421 refresh_sequence_number(domain, false);
2422 if (!NT_STATUS_IS_OK(status)) {
2423 return status;
2424 }
2425 centry = centry_start(domain, status);
2426 if (!centry)
2427 goto skip_save;
2428
2429 centry_put_uint32(centry, *num_groups);
2430 for (i=0; i<(*num_groups); i++) {
2431 centry_put_sid(centry, &(*user_gids)[i]);
2432 }
2433
2434 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2435 centry_free(centry);
2436
2437 skip_save:
2438 return status;
2439 }
2440
2441 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2442 const struct dom_sid *sids)
2443 {
2444 uint32_t i;
2445 char *sidlist;
2446
2447 sidlist = talloc_strdup(mem_ctx, "");
2448 if (sidlist == NULL) {
2449 return NULL;
2450 }
2451 for (i=0; i<num_sids; i++) {
2452 fstring tmp;
2453 sidlist = talloc_asprintf_append_buffer(
2454 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2455 if (sidlist == NULL) {
2456 return NULL;
2457 }
2458 }
2459 return sidlist;
2460 }
2461
2462 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2463 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2464 const struct dom_sid *sids,
2465 uint32_t *pnum_aliases, uint32_t **paliases)
2466 {
2467 struct winbind_cache *cache = get_cache(domain);
2468 struct cache_entry *centry = NULL;
2469 uint32_t num_aliases;
2470 uint32_t *aliases;
2471 NTSTATUS status;
2472 char *sidlist;
2473 int i;
2474
2475 if (cache->tdb == NULL) {
2476 return NT_STATUS_NOT_FOUND;
2477 }
2478
2479 if (num_sids == 0) {
2480 *pnum_aliases = 0;
2481 *paliases = NULL;
2482 return NT_STATUS_OK;
2483 }
2484
2485 /* We need to cache indexed by the whole list of SIDs, the aliases
2486 * resulting might come from any of the SIDs. */
2487
2488 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2489 if (sidlist == NULL) {
2490 return NT_STATUS_NO_MEMORY;
2491 }
2492
2493 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2494 TALLOC_FREE(sidlist);
2495 if (centry == NULL) {
2496 return NT_STATUS_NOT_FOUND;
2497 }
2498
2499 num_aliases = centry_uint32(centry);
2500 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2501 if (aliases == NULL) {
2502 centry_free(centry);
2503 return NT_STATUS_NO_MEMORY;
2504 }
2505
2506 for (i=0; i<num_aliases; i++) {
2507 aliases[i] = centry_uint32(centry);
2508 }
2509
2510 status = centry->status;
2511
2512 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2513 "status %s\n", domain->name, nt_errstr(status)));
2514
2515 centry_free(centry);
2516
2517 *pnum_aliases = num_aliases;
2518 *paliases = aliases;
2519
2520 return status;
2521 }
2522
2523 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2524 TALLOC_CTX *mem_ctx,
2525 uint32 num_sids, const struct dom_sid *sids,
2526 uint32 *num_aliases, uint32 **alias_rids)
2527 {
2528 struct cache_entry *centry = NULL;
2529 NTSTATUS status;
2530 char *sidlist;
2531 int i;
2532 bool old_status;
2533
2534 old_status = domain->online;
2535 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2536 num_aliases, alias_rids);
2537 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2538 return status;
2539 }
2540
2541 (*num_aliases) = 0;
2542 (*alias_rids) = NULL;
2543
2544 if (!NT_STATUS_IS_OK(domain->last_status))
2545 return domain->last_status;
2546
2547 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2548 "for domain %s\n", domain->name ));
2549
2550 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2551 if (sidlist == NULL) {
2552 return NT_STATUS_NO_MEMORY;
2553 }
2554
2555 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2556 num_sids, sids,
2557 num_aliases, alias_rids);
2558
2559 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2560 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2561 if (!domain->internal && old_status) {
2562 set_domain_offline(domain);
2563 }
2564 if (!domain->internal &&
2565 !domain->online &&
2566 old_status) {
2567 NTSTATUS cache_status;
2568 cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2569 sids, num_aliases, alias_rids);
2570 return cache_status;
2571 }
2572 }
2573 /* and save it */
2574 refresh_sequence_number(domain, false);
2575 if (!NT_STATUS_IS_OK(status)) {
2576 return status;
2577 }
2578 centry = centry_start(domain, status);
2579 if (!centry)
2580 goto skip_save;
2581 centry_put_uint32(centry, *num_aliases);
2582 for (i=0; i<(*num_aliases); i++)
2583 centry_put_uint32(centry, (*alias_rids)[i]);
2584 centry_end(centry, "UA%s", sidlist);
2585 centry_free(centry);
2586
2587 skip_save:
2588 return status;
2589 }
2590
2591 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2592 TALLOC_CTX *mem_ctx,
2593 const struct dom_sid *group_sid,
2594 uint32_t *num_names,
2595 struct dom_sid **sid_mem, char ***names,
2596 uint32_t **name_types)
2597 {
2598 struct winbind_cache *cache = get_cache(domain);
2599 struct cache_entry *centry = NULL;
2600 NTSTATUS status;
2601 unsigned int i;
2602 char *sid_string;
2603
2604 if (cache->tdb == NULL) {
2605 return NT_STATUS_NOT_FOUND;
2606 }
2607
2608 sid_string = sid_string_tos(group_sid);
2609 if (sid_string == NULL) {
2610 return NT_STATUS_NO_MEMORY;
2611 }
2612
2613 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2614 TALLOC_FREE(sid_string);
2615 if (centry == NULL) {
2616 return NT_STATUS_NOT_FOUND;
2617 }
2618
2619 *sid_mem = NULL;
2620 *names = NULL;
2621 *name_types = NULL;
2622
2623 *num_names = centry_uint32(centry);
2624 if (*num_names == 0) {
2625 centry_free(centry);
2626 return NT_STATUS_OK;
2627 }
2628
2629 *sid_mem = talloc_array(mem_ctx, struct dom_sid, *num_names);
2630 *names = talloc_array(mem_ctx, char *, *num_names);
2631 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2632
2633 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2634 TALLOC_FREE(*sid_mem);
2635 TALLOC_FREE(*names);
2636 TALLOC_FREE(*name_types);
2637 centry_free(centry);
2638 return NT_STATUS_NO_MEMORY;
2639 }
2640
2641 for (i=0; i<(*num_names); i++) {
2642 centry_sid(centry, &(*sid_mem)[i]);
2643 (*names)[i] = centry_string(centry, mem_ctx);
2644 (*name_types)[i] = centry_uint32(centry);
2645 }
2646
2647 status = centry->status;
2648
2649 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2650 "status: %s\n", domain->name, nt_errstr(status)));
2651
2652 centry_free(centry);
2653 return status;
2654 }
2655
2656 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2657 TALLOC_CTX *mem_ctx,
2658 const struct dom_sid *group_sid,
2659 enum lsa_SidType type,
2660 uint32 *num_names,
2661 struct dom_sid **sid_mem, char ***names,
2662 uint32 **name_types)
2663 {
2664 struct cache_entry *centry = NULL;
2665 NTSTATUS status;
2666 unsigned int i;
2667 fstring sid_string;
2668 bool old_status;
2669
2670 old_status = domain->online;
2671 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2672 sid_mem, names, name_types);
2673 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2674 return status;
2675 }
2676
2677 (*num_names) = 0;
2678 (*sid_mem) = NULL;
2679 (*names) = NULL;
2680 (*name_types) = NULL;
2681
2682 /* Return status value returned by seq number check */
2683
2684 if (!NT_STATUS_IS_OK(domain->last_status))
2685 return domain->last_status;
2686
2687 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2688 domain->name ));
2689
2690 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2691 type, num_names,
2692 sid_mem, names, name_types);
2693
2694 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2695 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2696 if (!domain->internal && old_status) {
2697 set_domain_offline(domain);
2698 }
2699 if (!domain->internal &&
2700 !domain->online &&
2701 old_status) {
2702 NTSTATUS cache_status;
2703 cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2704 num_names, sid_mem, names,
2705 name_types);
2706 return cache_status;
2707 }
2708 }
2709 /* and save it */
2710 refresh_sequence_number(domain, false);
2711 if (!NT_STATUS_IS_OK(status)) {
2712 return status;
2713 }
2714 centry = centry_start(domain, status);
2715 if (!centry)
2716 goto skip_save;
2717 centry_put_uint32(centry, *num_names);
2718 for (i=0; i<(*num_names); i++) {
2719 centry_put_sid(centry, &(*sid_mem)[i]);
2720 centry_put_string(centry, (*names)[i]);
2721 centry_put_uint32(centry, (*name_types)[i]);
2722 }
2723 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2724 centry_free(centry);
2725
2726 skip_save:
2727 return status;
2728 }
2729
2730 /* find the sequence number for a domain */
2731 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2732 {
2733 refresh_sequence_number(domain, false);
2734
2735 *seq = domain->sequence_number;
2736
2737 return NT_STATUS_OK;
2738 }
2739
2740 /* enumerate trusted domains
2741 * (we need to have the list of trustdoms in the cache when we go offline) -
2742 * Guenther */
2743 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2744 TALLOC_CTX *mem_ctx,
2745 struct netr_DomainTrustList *trusts)
2746 {
2747 NTSTATUS status;
2748 struct winbind_cache *cache;
2749 struct winbindd_tdc_domain *dom_list = NULL;
2750 size_t num_domains = 0;
2751 bool retval = false;
2752 int i;
2753 bool old_status;
2754
2755 old_status = domain->online;
2756 trusts->count = 0;
2757 trusts->array = NULL;
2758
2759 cache = get_cache(domain);
2760 if (!cache || !cache->tdb) {
2761 goto do_query;
2762 }
2763
2764 if (domain->online) {
2765 goto do_query;
2766 }
2767
2768 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2769 if (!retval || !num_domains || !dom_list) {
2770 TALLOC_FREE(dom_list);
2771 goto do_query;
2772 }
2773
2774 do_fetch_cache:
2775 trusts->array = talloc_zero_array(mem_ctx, struct netr_DomainTrust, num_domains);
2776 if (!trusts->array) {
2777 TALLOC_FREE(dom_list);
2778 return NT_STATUS_NO_MEMORY;
2779 }
2780
2781 for (i = 0; i < num_domains; i++) {
2782 struct netr_DomainTrust *trust;
2783 struct dom_sid *sid;
2784 struct winbindd_domain *dom;
2785
2786 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2787 if (dom && dom->internal) {
2788 continue;
2789 }
2790
2791 trust = &trusts->array[trusts->count];
2792 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2793 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2794 sid = talloc(trusts->array, struct dom_sid);
2795 if (!trust->netbios_name || !trust->dns_name ||
2796 !sid) {
2797 TALLOC_FREE(dom_list);
2798 TALLOC_FREE(trusts->array);
2799 return NT_STATUS_NO_MEMORY;
2800 }
2801
2802 trust->trust_flags = dom_list[i].trust_flags;
2803 trust->trust_attributes = dom_list[i].trust_attribs;
2804 trust->trust_type = dom_list[i].trust_type;
2805 sid_copy(sid, &dom_list[i].sid);
2806 trust->sid = sid;
2807 trusts->count++;
2808 }
2809
2810 TALLOC_FREE(dom_list);
2811 return NT_STATUS_OK;
2812
2813 do_query:
2814 /* Return status value returned by seq number check */
2815
2816 if (!NT_STATUS_IS_OK(domain->last_status))
2817 return domain->last_status;
2818
2819 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2820 domain->name ));
2821
2822 status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2823
2824 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2825 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2826 if (!domain->internal && old_status) {
2827 set_domain_offline(domain);
2828 }
2829 if (!domain->internal &&
2830 !domain->online &&
2831 old_status) {
2832 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2833 if (retval && num_domains && dom_list) {
2834 TALLOC_FREE(trusts->array);
2835 trusts->count = 0;
2836 goto do_fetch_cache;
2837 }
2838 }
2839 }
2840 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2841 * so that the generic centry handling still applies correctly -
2842 * Guenther*/
2843
2844 if (!NT_STATUS_IS_ERR(status)) {
2845 status = NT_STATUS_OK;
2846 }
2847 return status;
2848 }
2849
2850 /* get lockout policy */
2851 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2852 TALLOC_CTX *mem_ctx,
2853 struct samr_DomInfo12 *policy)
2854 {
2855 struct winbind_cache *cache = get_cache(domain);
2856 struct cache_entry *centry = NULL;
2857 NTSTATUS status;
2858 bool old_status;
2859
2860 old_status = domain->online;
2861 if (!cache->tdb)
2862 goto do_query;
2863
2864 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2865
2866 if (!centry)
2867 goto do_query;
2868
2869 do_fetch_cache:
2870 policy->lockout_duration = centry_nttime(centry);
2871 policy->lockout_window = centry_nttime(centry);
2872 policy->lockout_threshold = centry_uint16(centry);
2873
2874 status = centry->status;
2875
2876 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2877 domain->name, nt_errstr(status) ));
2878
2879 centry_free(centry);
2880 return status;
2881
2882 do_query:
2883 ZERO_STRUCTP(policy);
2884
2885 /* Return status value returned by seq number check */
2886
2887 if (!NT_STATUS_IS_OK(domain->last_status))
2888 return domain->last_status;
2889
2890 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2891 domain->name ));
2892
2893 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2894
2895 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2896 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2897 if (!domain->internal && old_status) {
2898 set_domain_offline(domain);
2899 }
2900 if (cache->tdb &&
2901 !domain->internal &&
2902 !domain->online &&
2903 old_status) {
2904 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2905 if (centry) {
2906 goto do_fetch_cache;
2907 }
2908 }
2909 }
2910 /* and save it */
2911 refresh_sequence_number(domain, false);
2912 if (!NT_STATUS_IS_OK(status)) {
2913 return status;
2914 }
2915 wcache_save_lockout_policy(domain, status, policy);
2916
2917 return status;
2918 }
2919
2920 /* get password policy */
2921 static NTSTATUS password_policy(struct winbindd_domain *domain,
2922 TALLOC_CTX *mem_ctx,
2923 struct samr_DomInfo1 *policy)
2924 {
2925 struct winbind_cache *cache = get_cache(domain);
2926 struct cache_entry *centry = NULL;
2927 NTSTATUS status;
2928 bool old_status;
2929
2930 old_status = domain->online;
2931 if (!cache->tdb)
2932 goto do_query;
2933
2934 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2935
2936 if (!centry)
2937 goto do_query;
2938
2939 do_fetch_cache:
2940 policy->min_password_length = centry_uint16(centry);
2941 policy->password_history_length = centry_uint16(centry);
2942 policy->password_properties = centry_uint32(centry);
2943 policy->max_password_age = centry_nttime(centry);
2944 policy->min_password_age = centry_nttime(centry);
2945
2946 status = centry->status;
2947
2948 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2949 domain->name, nt_errstr(status) ));
2950
2951 centry_free(centry);
2952 return status;
2953
2954 do_query:
2955 ZERO_STRUCTP(policy);
2956
2957 /* Return status value returned by seq number check */
2958
2959 if (!NT_STATUS_IS_OK(domain->last_status))
2960 return domain->last_status;
2961
2962 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2963 domain->name ));
2964
2965 status = domain->backend->password_policy(domain, mem_ctx, policy);
2966
2967 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2968 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2969 if (!domain->internal && old_status) {
2970 set_domain_offline(domain);
2971 }
2972 if (cache->tdb &&
2973 !domain->internal &&
2974 !domain->online &&
2975 old_status) {
2976 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2977 if (centry) {
2978 goto do_fetch_cache;
2979 }
2980 }
2981 }
2982 /* and save it */
2983 refresh_sequence_number(domain, false);
2984 if (!NT_STATUS_IS_OK(status)) {
2985 return status;
2986 }
2987 wcache_save_password_policy(domain, status, policy);
2988
2989 return status;
2990 }
2991
2992
2993 /* Invalidate cached user and group lists coherently */
2994
2995 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2996 void *state)
2997 {
2998 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2999 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
3000 tdb_delete(the_tdb, kbuf);
3001
3002 return 0;
3003 }
3004
3005 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
3006
3007 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
3008 const struct dom_sid *sid)
3009 {
3010 fstring key_str, sid_string;
3011 struct winbind_cache *cache;
3012
3013 /* dont clear cached U/SID and UG/SID entries when we want to logon
3014 * offline - gd */
3015
3016 if (lp_winbind_offline_logon()) {
3017 return;
3018 }
3019
3020 if (!domain)
3021 return;
3022
3023 cache = get_cache(domain);
3024
3025 if (!cache->tdb) {
3026 return;
3027 }
3028
3029 /* Clear U/SID cache entry */
3030 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, sid));
3031 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3032 tdb_delete(cache->tdb, string_tdb_data(key_str));
3033
3034 /* Clear UG/SID cache entry */
3035 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, sid));
3036 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3037 tdb_delete(cache->tdb, string_tdb_data(key_str));
3038
3039 /* Samba/winbindd never needs this. */
3040 netsamlogon_clear_cached_user(sid);
3041 }
3042
3043 bool wcache_invalidate_cache(void)
3044 {
3045 struct winbindd_domain *domain;
3046
3047 for (domain = domain_list(); domain; domain = domain->next) {
3048 struct winbind_cache *cache = get_cache(domain);
3049
3050 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3051 "entries for %s\n", domain->name));
3052 if (cache) {
3053 if (cache->tdb) {
3054 tdb_traverse(cache->tdb, traverse_fn, NULL);
3055 } else {
3056 return false;
3057 }
3058 }
3059 }
3060 return true;
3061 }
3062
3063 bool wcache_invalidate_cache_noinit(void)
3064 {
3065 struct winbindd_domain *domain;
3066
3067 for (domain = domain_list(); domain; domain = domain->next) {
3068 struct winbind_cache *cache;
3069
3070 /* Skip uninitialized domains. */
3071 if (!domain->initialized && !domain->internal) {
3072 continue;
3073 }
3074
3075 cache = get_cache(domain);
3076
3077 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3078 "entries for %s\n", domain->name));
3079 if (cache) {
3080 if (cache->tdb) {
3081 tdb_traverse(cache->tdb, traverse_fn, NULL);
3082 /*
3083 * Flushing cache has nothing to with domains.
3084 * return here if we successfully flushed once.
3085 * To avoid unnecessary traversing the cache.
3086 */
3087 return true;
3088 } else {
3089 return false;
3090 }
3091 }
3092 }
3093 return true;
3094 }
3095
3096 bool init_wcache(void)
3097 {
3098 if (wcache == NULL) {
3099 wcache = SMB_XMALLOC_P(struct winbind_cache);
3100 ZERO_STRUCTP(wcache);
3101 }
3102
3103 if (wcache->tdb != NULL)
3104 return true;
3105
3106 /* when working offline we must not clear the cache on restart */
3107 wcache->tdb = tdb_open_log(state_path("winbindd_cache.tdb"),
3108 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3109 TDB_INCOMPATIBLE_HASH |
3110 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3111 O_RDWR|O_CREAT, 0600);
3112
3113 if (wcache->tdb == NULL) {
3114 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3115 return false;
3116 }
3117
3118 return true;
3119 }
3120
3121 /************************************************************************
3122 This is called by the parent to initialize the cache file.
3123 We don't need sophisticated locking here as we know we're the
3124 only opener.
3125 ************************************************************************/
3126
3127 bool initialize_winbindd_cache(void)
3128 {
3129 bool cache_bad = true;
3130 uint32 vers;
3131
3132 if (!init_wcache()) {
3133 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3134 return false;
3135 }
3136
3137 /* Check version number. */
3138 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3139 vers == WINBINDD_CACHE_VERSION) {
3140 cache_bad = false;
3141 }
3142
3143 if (cache_bad) {
3144 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3145 "and re-creating with version number %d\n",
3146 WINBINDD_CACHE_VERSION ));
3147
3148 tdb_close(wcache->tdb);
3149 wcache->tdb = NULL;
3150
3151 if (unlink(state_path("winbindd_cache.tdb")) == -1) {
3152 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3153 state_path("winbindd_cache.tdb"),
3154 strerror(errno) ));
3155 return false;
3156 }
3157 if (!init_wcache()) {
3158 DEBUG(0,("initialize_winbindd_cache: re-initialization "
3159 "init_wcache failed.\n"));
3160 return false;
3161 }
3162
3163 /* Write the version. */
3164 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3165 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3166 tdb_errorstr_compat(wcache->tdb) ));
3167 return false;
3168 }
3169 }
3170
3171 tdb_close(wcache->tdb);
3172 wcache->tdb = NULL;
3173 return true;
3174 }
3175
3176 void close_winbindd_cache(void)
3177 {
3178 if (!wcache) {
3179 return;
3180 }
3181 if (wcache->tdb) {
3182 tdb_close(wcache->tdb);
3183 wcache->tdb = NULL;
3184 }
3185 }
3186
3187 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
3188 char **domain_name, char **name,
3189 enum lsa_SidType *type)
3190 {
3191 struct winbindd_domain *domain;
3192 NTSTATUS status;
3193
3194 domain = find_lookup_domain_from_sid(sid);
3195 if (domain == NULL) {
3196 return false;
3197 }
3198 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3199 type);
3200 return NT_STATUS_IS_OK(status);
3201 }
3202
3203 bool lookup_cached_name(const char *domain_name,
3204 const char *name,
3205 struct dom_sid *sid,
3206 enum lsa_SidType *type)
3207 {
3208 struct winbindd_domain *domain;
3209 NTSTATUS status;
3210 bool original_online_state;
3211
3212 domain = find_lookup_domain_from_name(domain_name);
3213 if (domain == NULL) {
3214 return false;
3215 }
3216
3217 /* If we are doing a cached logon, temporarily set the domain
3218 offline so the cache won't expire the entry */
3219
3220 original_online_state = domain->online;
3221 domain->online = false;
3222 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3223 domain->online = original_online_state;
3224
3225 return NT_STATUS_IS_OK(status);
3226 }
3227
3228 void cache_name2sid(struct winbindd_domain *domain,
3229 const char *domain_name, const char *name,
3230 enum lsa_SidType type, const struct dom_sid *sid)
3231 {
3232 refresh_sequence_number(domain, false);
3233 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3234 sid, type);
3235 }
3236
3237 /*
3238 * The original idea that this cache only contains centries has
3239 * been blurred - now other stuff gets put in here. Ensure we
3240 * ignore these things on cleanup.
3241 */
3242
3243 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3244 TDB_DATA dbuf, void *state)
3245 {
3246 struct cache_entry *centry;
3247
3248 if (is_non_centry_key(kbuf)) {
3249 return 0;
3250 }
3251
3252 centry = wcache_fetch_raw((char *)kbuf.dptr);
3253 if (!centry) {
3254 return 0;
3255 }
3256
3257 if (!NT_STATUS_IS_OK(centry->status)) {
3258 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3259 tdb_delete(the_tdb, kbuf);
3260 }
3261
3262 centry_free(centry);
3263 return 0;
3264 }
3265
3266 /* flush the cache */
3267 void wcache_flush_cache(void)
3268 {
3269 if (!wcache)
3270 return;
3271 if (wcache->tdb) {
3272 tdb_close(wcache->tdb);
3273 wcache->tdb = NULL;
3274 }
3275 if (!winbindd_use_cache()) {
3276 return;
3277 }
3278
3279 /* when working offline we must not clear the cache on restart */
3280 wcache->tdb = tdb_open_log(state_path("winbindd_cache.tdb"),
3281 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3282 TDB_INCOMPATIBLE_HASH |
3283 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3284 O_RDWR|O_CREAT, 0600);
3285
3286 if (!wcache->tdb) {
3287 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3288 return;
3289 }
3290
3291 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3292
3293 DEBUG(10,("wcache_flush_cache success\n"));
3294 }
3295
3296 /* Count cached creds */
3297
3298 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3299 void *state)
3300 {
3301 int *cred_count = (int*)state;
3302
3303 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3304 (*cred_count)++;
3305 }
3306 return 0;
3307 }
3308
3309 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3310 {
3311 struct winbind_cache *cache = get_cache(domain);
3312
3313 *count = 0;
3314
3315 if (!cache->tdb) {
3316 return NT_STATUS_INTERNAL_DB_ERROR;
3317 }
3318
3319 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3320
3321 return NT_STATUS_OK;
3322 }
3323
3324 struct cred_list {
3325 struct cred_list *prev, *next;
3326 TDB_DATA key;
3327 fstring name;
3328 time_t created;
3329 };
3330 static struct cred_list *wcache_cred_list;
3331
3332 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3333 void *state)
3334 {
3335 struct cred_list *cred;
3336
3337 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3338
3339 cred = SMB_MALLOC_P(struct cred_list);
3340 if (cred == NULL) {
3341 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3342 return -1;
3343 }
3344
3345 ZERO_STRUCTP(cred);
3346
3347 /* save a copy of the key */
3348
3349 fstrcpy(cred->name, (const char *)kbuf.dptr);
3350 DLIST_ADD(wcache_cred_list, cred);
3351 }
3352
3353 return 0;
3354 }
3355
3356 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const struct dom_sid *sid)
3357 {
3358 struct winbind_cache *cache = get_cache(domain);
3359 NTSTATUS status;
3360 int ret;
3361 struct cred_list *cred, *oldest = NULL;
3362
3363 if (!cache->tdb) {
3364 return NT_STATUS_INTERNAL_DB_ERROR;
3365 }
3366
3367 /* we possibly already have an entry */
3368 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3369
3370 fstring key_str, tmp;
3371
3372 DEBUG(11,("we already have an entry, deleting that\n"));
3373
3374 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3375
3376 tdb_delete(cache->tdb, string_tdb_data(key_str));
3377
3378 return NT_STATUS_OK;
3379 }
3380
3381 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3382 if (ret == 0) {
3383 return NT_STATUS_OK;
3384 } else if ((ret < 0) || (wcache_cred_list == NULL)) {
3385 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3386 }
3387
3388 ZERO_STRUCTP(oldest);
3389
3390 for (cred = wcache_cred_list; cred; cred = cred->next) {
3391
3392 TDB_DATA data;
3393 time_t t;
3394
3395 data = tdb_fetch_compat(cache->tdb, string_tdb_data(cred->name));
3396 if (!data.dptr) {
3397 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3398 cred->name));
3399 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3400 goto done;
3401 }
3402
3403 t = IVAL(data.dptr, 0);
3404 SAFE_FREE(data.dptr);
3405
3406 if (!oldest) {
3407 oldest = SMB_MALLOC_P(struct cred_list);
3408 if (oldest == NULL) {
3409 status = NT_STATUS_NO_MEMORY;
3410 goto done;
3411 }
3412
3413 fstrcpy(oldest->name, cred->name);
3414 oldest->created = t;
3415 continue;
3416 }
3417
3418 if (t < oldest->created) {
3419 fstrcpy(oldest->name, cred->name);
3420 oldest->created = t;
3421 }
3422 }
3423
3424 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3425 status = NT_STATUS_OK;
3426 } else {
3427 status = NT_STATUS_UNSUCCESSFUL;
3428 }
3429 done:
3430 SAFE_FREE(wcache_cred_list);
3431 SAFE_FREE(oldest);
3432
3433 return status;
3434 }
3435
3436 /* Change the global online/offline state. */
3437 bool set_global_winbindd_state_offline(void)
3438 {
3439 TDB_DATA data;
3440
3441 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3442
3443 /* Only go offline if someone has created
3444 the key "WINBINDD_OFFLINE" in the cache tdb. */
3445
3446 if (wcache == NULL || wcache->tdb == NULL) {
3447 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3448 return false;
3449 }
3450
3451 if (!lp_winbind_offline_logon()) {
3452 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3453 return false;
3454 }
3455
3456 if (global_winbindd_offline_state) {
3457 /* Already offline. */
3458 return true;
3459 }
3460
3461 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3462
3463 if (!data.dptr || data.dsize != 4) {
3464 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3465 SAFE_FREE(data.dptr);
3466 return false;
3467 } else {
3468 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3469 global_winbindd_offline_state = true;
3470 SAFE_FREE(data.dptr);
3471 return true;
3472 }
3473 }
3474
3475 void set_global_winbindd_state_online(void)
3476 {
3477 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3478
3479 if (!lp_winbind_offline_logon()) {
3480 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3481 return;
3482 }
3483
3484 if (!global_winbindd_offline_state) {
3485 /* Already online. */
3486 return;
3487 }
3488 global_winbindd_offline_state = false;
3489
3490 if (!wcache->tdb) {
3491 return;
3492 }
3493
3494 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3495 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3496 }
3497
3498 bool get_global_winbindd_state_offline(void)
3499 {
3500 return global_winbindd_offline_state;
3501 }
3502
3503 /***********************************************************************
3504 Validate functions for all possible cache tdb keys.
3505 ***********************************************************************/
3506
3507 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3508 struct tdb_validation_status *state)
3509 {
3510 struct cache_entry *centry;
3511
3512 centry = SMB_XMALLOC_P(struct cache_entry);
3513 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3514 if (!centry->data) {
3515 SAFE_FREE(centry);
3516 return NULL;
3517 }
3518 centry->len = data.dsize;
3519 centry->ofs = 0;
3520
3521 if (centry->len < 16) {
3522 /* huh? corrupt cache? */
3523 DEBUG(0,("create_centry_validate: Corrupt cache for key %s "
3524 "(len < 16) ?\n", kstr));
3525 centry_free(centry);
3526 state->bad_entry = true;
3527 state->success = false;
3528 return NULL;
3529 }
3530
3531 centry->status = NT_STATUS(centry_uint32(centry));
3532 centry->sequence_number = centry_uint32(centry);
3533 centry->timeout = centry_uint64_t(centry);
3534 return centry;
3535 }
3536
3537 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3538 struct tdb_validation_status *state)
3539 {
3540 if (dbuf.dsize != 8) {
3541 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3542 keystr, (unsigned int)dbuf.dsize ));
3543 state->bad_entry = true;
3544 return 1;
3545 }
3546 return 0;
3547 }
3548
3549 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3550 struct tdb_validation_status *state)
3551 {
3552 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3553 if (!centry) {
3554 return 1;
3555 }
3556
3557 (void)centry_uint32(centry);
3558 if (NT_STATUS_IS_OK(centry->status)) {
3559 struct dom_sid sid;
3560 (void)centry_sid(centry, &sid);
3561 }
3562
3563 centry_free(centry);
3564
3565 if (!(state->success)) {
3566 return 1;
3567 }
3568 DEBUG(10,("validate_ns: %s ok\n", keystr));
3569 return 0;
3570 }
3571
3572 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3573 struct tdb_validation_status *state)
3574 {
3575 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3576 if (!centry) {
3577 return 1;
3578 }
3579
3580 if (NT_STATUS_IS_OK(centry->status)) {
3581 (void)centry_uint32(centry);
3582 (void)centry_string(centry, mem_ctx);
3583 (void)centry_string(centry, mem_ctx);
3584 }
3585
3586 centry_free(centry);
3587
3588 if (!(state->success)) {
3589 return 1;
3590 }
3591 DEBUG(10,("validate_sn: %s ok\n", keystr));
3592 return 0;
3593 }
3594
3595 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3596 struct tdb_validation_status *state)
3597 {
3598 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3599 struct dom_sid sid;
3600
3601 if (!centry) {
3602 return 1;
3603 }
3604
3605 (void)centry_string(centry, mem_ctx);
3606 (void)centry_string(centry, mem_ctx);
3607 (void)centry_string(centry, mem_ctx);
3608 (void)centry_string(centry, mem_ctx);
3609 (void)centry_uint32(centry);
3610 (void)centry_sid(centry, &sid);
3611 (void)centry_sid(centry, &sid);
3612
3613 centry_free(centry);
3614
3615 if (!(state->success)) {
3616 return 1;
3617 }
3618 DEBUG(10,("validate_u: %s ok\n", keystr));
3619 return 0;
3620 }
3621
3622 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3623 struct tdb_validation_status *state)
3624 {
3625 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3626
3627 if (!centry) {
3628 return 1;
3629 }
3630
3631 (void)centry_nttime(centry);
3632 (void)centry_nttime(centry);
3633 (void)centry_uint16(centry);
3634
3635 centry_free(centry);
3636
3637 if (!(state->success)) {
3638 return 1;
3639 }
3640 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3641 return 0;
3642 }
3643
3644 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3645 struct tdb_validation_status *state)
3646 {
3647 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3648
3649 if (!centry) {
3650 return 1;
3651 }
3652
3653 (void)centry_uint16(centry);
3654 (void)centry_uint16(centry);
3655 (void)centry_uint32(centry);
3656 (void)centry_nttime(centry);
3657 (void)centry_nttime(centry);
3658
3659 centry_free(centry);
3660
3661 if (!(state->success)) {
3662 return 1;
3663 }
3664 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3665 return 0;
3666 }
3667
3668 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3669 struct tdb_validation_status *state)
3670 {
3671 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3672
3673 if (!centry) {
3674 return 1;
3675 }
3676
3677 (void)centry_time(centry);
3678 (void)centry_hash16(centry, mem_ctx);
3679
3680 /* We only have 17 bytes more data in the salted cred case. */
3681 if (centry->len - centry->ofs == 17) {
3682 (void)centry_hash16(centry, mem_ctx);
3683 }
3684
3685 centry_free(centry);
3686
3687 if (!(state->success)) {
3688 return 1;
3689 }
3690 DEBUG(10,("validate_cred: %s ok\n", keystr));
3691 return 0;
3692 }
3693
3694 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3695 struct tdb_validation_status *state)
3696 {
3697 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3698 int32 num_entries, i;
3699
3700 if (!centry) {
3701 return 1;
3702 }
3703
3704 num_entries = (int32)centry_uint32(centry);
3705
3706 for (i=0; i< num_entries; i++) {
3707 struct dom_sid sid;
3708 (void)centry_string(centry, mem_ctx);
3709 (void)centry_string(centry, mem_ctx);
3710 (void)centry_string(centry, mem_ctx);
3711 (void)centry_string(centry, mem_ctx);
3712 (void)centry_sid(centry, &sid);
3713 (void)centry_sid(centry, &sid);
3714 }
3715
3716 centry_free(centry);
3717
3718 if (!(state->success)) {
3719 return 1;
3720 }
3721 DEBUG(10,("validate_ul: %s ok\n", keystr));
3722 return 0;
3723 }
3724
3725 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3726 struct tdb_validation_status *state)
3727 {
3728 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3729 int32 num_entries, i;
3730
3731 if (!centry) {
3732 return 1;
3733 }
3734
3735 num_entries = centry_uint32(centry);
3736
3737 for (i=0; i< num_entries; i++) {
3738 (void)centry_string(centry, mem_ctx);
3739 (void)centry_string(centry, mem_ctx);
3740 (void)centry_uint32(centry);
3741 }
3742
3743 centry_free(centry);
3744
3745 if (!(state->success)) {
3746 return 1;
3747 }
3748 DEBUG(10,("validate_gl: %s ok\n", keystr));
3749 return 0;
3750 }
3751
3752 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3753 struct tdb_validation_status *state)
3754 {
3755 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3756 int32 num_groups, i;
3757
3758 if (!centry) {
3759 return 1;
3760 }
3761
3762 num_groups = centry_uint32(centry);
3763
3764 for (i=0; i< num_groups; i++) {
3765 struct dom_sid sid;
3766 centry_sid(centry, &sid);
3767 }
3768
3769 centry_free(centry);
3770
3771 if (!(state->success)) {
3772 return 1;
3773 }
3774 DEBUG(10,("validate_ug: %s ok\n", keystr));
3775 return 0;
3776 }
3777
3778 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3779 struct tdb_validation_status *state)
3780 {
3781 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3782 int32 num_aliases, i;
3783
3784 if (!centry) {
3785 return 1;
3786 }
3787
3788 num_aliases = centry_uint32(centry);
3789
3790 for (i=0; i < num_aliases; i++) {
3791 (void)centry_uint32(centry);
3792 }
3793
3794 centry_free(centry);
3795
3796 if (!(state->success)) {
3797 return 1;
3798 }
3799 DEBUG(10,("validate_ua: %s ok\n", keystr));
3800 return 0;
3801 }
3802
3803 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3804 struct tdb_validation_status *state)
3805 {
3806 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3807 int32 num_names, i;
3808
3809 if (!centry) {
3810 return 1;
3811 }
3812
3813 num_names = centry_uint32(centry);
3814
3815 for (i=0; i< num_names; i++) {
3816 struct dom_sid sid;
3817 centry_sid(centry, &sid);
3818 (void)centry_string(centry, mem_ctx);
3819 (void)centry_uint32(centry);
3820 }
3821
3822 centry_free(centry);
3823
3824 if (!(state->success)) {
3825 return 1;
3826 }
3827 DEBUG(10,("validate_gm: %s ok\n", keystr));
3828 return 0;
3829 }
3830
3831 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3832 struct tdb_validation_status *state)
3833 {
3834 /* Can't say anything about this other than must be nonzero. */
3835 if (dbuf.dsize == 0) {
3836 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3837 keystr));
3838 state->bad_entry = true;
3839 state->success = false;
3840 return 1;
3841 }
3842
3843 DEBUG(10,("validate_dr: %s ok\n", keystr));
3844 return 0;
3845 }
3846
3847 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3848 struct tdb_validation_status *state)
3849 {
3850 /* Can't say anything about this other than must be nonzero. */
3851 if (dbuf.dsize == 0) {
3852 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3853 keystr));
3854 state->bad_entry = true;
3855 state->success = false;
3856 return 1;
3857 }
3858
3859 DEBUG(10,("validate_de: %s ok\n", keystr));
3860 return 0;
3861 }
3862
3863 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3864 TDB_DATA dbuf, struct tdb_validation_status *state)
3865 {
3866 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3867
3868 if (!centry) {
3869 return 1;
3870 }
3871
3872 (void)centry_string(centry, mem_ctx);
3873 (void)centry_string(centry, mem_ctx);
3874 (void)centry_string(centry, mem_ctx);
3875 (void)centry_uint32(centry);
3876
3877 centry_free(centry);
3878
3879 if (!(state->success)) {
3880 return 1;
3881 }
3882 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3883 return 0;
3884 }
3885
3886 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3887 TDB_DATA dbuf,
3888 struct tdb_validation_status *state)
3889 {
3890 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3891
3892 if (!centry) {
3893 return 1;
3894 }
3895
3896 (void)centry_string( centry, mem_ctx );
3897
3898 centry_free(centry);
3899
3900 if (!(state->success)) {
3901 return 1;
3902 }
3903 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3904 return 0;
3905 }
3906
3907 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3908 TDB_DATA dbuf,
3909 struct tdb_validation_status *state)
3910 {
3911 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3912
3913 if (!centry) {
3914 return 1;
3915 }
3916
3917 (void)centry_string( centry, mem_ctx );
3918
3919 centry_free(centry);
3920
3921 if (!(state->success)) {
3922 return 1;
3923 }
3924 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3925 return 0;
3926 }
3927
3928 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3929 TDB_DATA dbuf,
3930 struct tdb_validation_status *state)
3931 {
3932 if (dbuf.dsize == 0) {
3933 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3934 "key %s (len ==0) ?\n", keystr));
3935 state->bad_entry = true;
3936 state->success = false;
3937 return 1;
3938 }
3939
3940 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3941 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3942 return 0;
3943 }
3944
3945 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3946 struct tdb_validation_status *state)
3947 {
3948 if (dbuf.dsize != 4) {
3949 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3950 keystr, (unsigned int)dbuf.dsize ));
3951 state->bad_entry = true;
3952 state->success = false;
3953 return 1;
3954 }
3955 DEBUG(10,("validate_offline: %s ok\n", keystr));
3956 return 0;
3957 }
3958
3959 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3960 struct tdb_validation_status *state)
3961 {
3962 /*
3963 * Ignore validation for now. The proper way to do this is with a
3964 * checksum. Just pure parsing does not really catch much.
3965 */
3966 return 0;
3967 }
3968
3969 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3970 struct tdb_validation_status *state)
3971 {
3972 if (dbuf.dsize != 4) {
3973 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3974 "key %s (len %u != 4) ?\n",
3975 keystr, (unsigned int)dbuf.dsize));
3976 state->bad_entry = true;
3977 state->success = false;
3978 return 1;
3979 }
3980
3981 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3982 return 0;
3983 }
3984
3985 /***********************************************************************
3986 A list of all possible cache tdb keys with associated validation
3987 functions.
3988 ***********************************************************************/
3989
3990 struct key_val_struct {
3991 const char *keyname;
3992 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3993 } key_val[] = {
3994 {"SEQNUM/", validate_seqnum},
3995 {"NS/", validate_ns},
3996 {"SN/", validate_sn},
3997 {"U/", validate_u},
3998 {"LOC_POL/", validate_loc_pol},
3999 {"PWD_POL/", validate_pwd_pol},
4000 {"CRED/", validate_cred},
4001 {"UL/", validate_ul},
4002 {"GL/", validate_gl},
4003 {"UG/", validate_ug},
4004 {"UA", validate_ua},
4005 {"GM/", validate_gm},
4006 {"DR/", validate_dr},
4007 {"DE/", validate_de},
4008 {"NSS/PWINFO/", validate_pwinfo},
4009 {"TRUSTDOMCACHE/", validate_trustdomcache},
4010 {"NSS/NA/", validate_nss_na},
4011 {"NSS/AN/", validate_nss_an},
4012 {"WINBINDD_OFFLINE", validate_offline},
4013 {"NDR/", validate_ndr},
4014 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
4015 {NULL, NULL}
4016 };
4017
4018 /***********************************************************************
4019 Function to look at every entry in the tdb and validate it as far as
4020 possible.
4021 ***********************************************************************/
4022
4023 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
4024 {
4025 int i;
4026 unsigned int max_key_len = 1024;
4027 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
4028
4029 /* Paranoia check. */
4030 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
4031 max_key_len = 1024 * 1024;
4032 }
4033 if (kbuf.dsize > max_key_len) {
4034 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
4035 "(%u) > (%u)\n\n",
4036 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
4037 return 1;
4038 }
4039
4040 for (i = 0; key_val[i].keyname; i++) {
4041 size_t namelen = strlen(key_val[i].keyname);
4042 if (kbuf.dsize >= namelen && (
4043 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
4044 TALLOC_CTX *mem_ctx;
4045 char *keystr;
4046 int ret;
4047
4048 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
4049 if (!keystr) {
4050 return 1;
4051 }
4052 memcpy(keystr, kbuf.dptr, kbuf.dsize);
4053 keystr[kbuf.dsize] = '\0';
4054
4055 mem_ctx = talloc_init("validate_ctx");
4056 if (!mem_ctx) {
4057 SAFE_FREE(keystr);
4058 return 1;
4059 }
4060
4061 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
4062 v_state);
4063
4064 SAFE_FREE(keystr);
4065 talloc_destroy(mem_ctx);
4066 return ret;
4067 }
4068 }
4069
4070 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
4071 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
4072 DEBUG(0,("data :\n"));
4073 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4074 v_state->unknown_key = true;
4075 v_state->success = false;
4076 return 1; /* terminate. */
4077 }
4078
4079 static void validate_panic(const char *const why)
4080 {
4081 DEBUG(0,("validating cache: would panic %s\n", why ));
4082 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4083 exit(47);
4084 }
4085
4086 /***********************************************************************
4087 Try and validate every entry in the winbindd cache. If we fail here,
4088 delete the cache tdb and return non-zero.
4089 ***********************************************************************/
4090
4091 int winbindd_validate_cache(void)
4092 {
4093 int ret = -1;
4094 const char *tdb_path = state_path("winbindd_cache.tdb");
4095 TDB_CONTEXT *tdb = NULL;
4096
4097 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4098 smb_panic_fn = validate_panic;
4099
4100
4101 tdb = tdb_open_log(tdb_path,
4102 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4103 TDB_INCOMPATIBLE_HASH |
4104 ( lp_winbind_offline_logon()
4105 ? TDB_DEFAULT
4106 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4107 O_RDWR|O_CREAT,
4108 0600);
4109 if (!tdb) {
4110 DEBUG(0, ("winbindd_validate_cache: "
4111 "error opening/initializing tdb\n"));
4112 goto done;
4113 }
4114 tdb_close(tdb);
4115
4116 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4117
4118 if (ret != 0) {
4119 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4120 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4121 unlink(tdb_path);
4122 }
4123
4124 done:
4125 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4126 smb_panic_fn = smb_panic;
4127 return ret;
4128 }
4129
4130 /***********************************************************************
4131 Try and validate every entry in the winbindd cache.
4132 ***********************************************************************/
4133
4134 int winbindd_validate_cache_nobackup(void)
4135 {
4136 int ret = -1;
4137 const char *tdb_path = state_path("winbindd_cache.tdb");
4138
4139 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4140 smb_panic_fn = validate_panic;
4141
4142
4143 if (wcache == NULL || wcache->tdb == NULL) {
4144 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4145 } else {
4146 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4147 }
4148
4149 if (ret != 0) {
4150 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4151 "successful.\n"));
4152 }
4153
4154 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4155 "function\n"));
4156 smb_panic_fn = smb_panic;
4157 return ret;
4158 }
4159
4160 bool winbindd_cache_validate_and_initialize(void)
4161 {
4162 close_winbindd_cache();
4163
4164 if (lp_winbind_offline_logon()) {
4165 if (winbindd_validate_cache() < 0) {
4166 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4167 "could be restored.\n"));
4168 }
4169 }
4170
4171 return initialize_winbindd_cache();
4172 }
4173
4174 /*********************************************************************
4175 ********************************************************************/
4176
4177 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4178 struct winbindd_tdc_domain **domains,
4179 size_t *num_domains )
4180 {
4181 struct winbindd_tdc_domain *list = NULL;
4182 size_t idx;
4183 int i;
4184 bool set_only = false;
4185
4186 /* don't allow duplicates */
4187
4188 idx = *num_domains;
4189 list = *domains;
4190
4191 for ( i=0; i< (*num_domains); i++ ) {
4192 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4193 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4194 new_dom->name));
4195 idx = i;
4196 set_only = true;
4197
4198 break;
4199 }
4200 }
4201
4202 if ( !set_only ) {
4203 if ( !*domains ) {
4204 list = talloc_array( NULL, struct winbindd_tdc_domain, 1 );
4205 idx = 0;
4206 } else {
4207 list = talloc_realloc( *domains, *domains,
4208 struct winbindd_tdc_domain,
4209 (*num_domains)+1);
4210 idx = *num_domains;
4211 }
4212
4213 ZERO_STRUCT( list[idx] );
4214 }
4215
4216 if ( !list )
4217 return false;
4218
4219 list[idx].domain_name = talloc_strdup( list, new_dom->name );
4220 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4221
4222 if ( !is_null_sid( &new_dom->sid ) ) {
4223 sid_copy( &list[idx].sid, &new_dom->sid );
4224 } else {
4225 sid_copy(&list[idx].sid, &global_sid_NULL);
4226 }
4227
4228 if ( new_dom->domain_flags != 0x0 )
4229 list[idx].trust_flags = new_dom->domain_flags;
4230
4231 if ( new_dom->domain_type != 0x0 )
4232 list[idx].trust_type = new_dom->domain_type;
4233
4234 if ( new_dom->domain_trust_attribs != 0x0 )
4235 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4236
4237 if ( !set_only ) {
4238 *domains = list;
4239 *num_domains = idx + 1;
4240 }
4241
4242 return true;
4243 }
4244
4245 /*********************************************************************
4246 ********************************************************************/
4247
4248 static TDB_DATA make_tdc_key( const char *domain_name )
4249 {
4250 char *keystr = NULL;
4251 TDB_DATA key = { NULL, 0 };
4252
4253 if ( !domain_name ) {
4254 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4255 return key;
4256 }
4257
4258 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4259 return key;
4260 }
4261 key = string_term_tdb_data(keystr);
4262
4263 return key;
4264 }
4265
4266 /*********************************************************************
4267 ********************************************************************/
4268
4269 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4270 size_t num_domains,
4271 unsigned char **buf )
4272 {
4273 unsigned char *buffer = NULL;
4274 int len = 0;
4275 int buflen = 0;
4276 int i = 0;
4277
4278 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4279 (int)num_domains));
4280
4281 buflen = 0;
4282
4283 again:
4284 len = 0;
4285
4286 /* Store the number of array items first */
4287 len += tdb_pack( buffer+len, buflen-len, "d",
4288 num_domains );
4289
4290 /* now pack each domain trust record */
4291 for ( i=0; i<num_domains; i++ ) {
4292
4293 fstring tmp;
4294
4295 if ( buflen > 0 ) {
4296 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4297 domains[i].domain_name,
4298 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4299 }
4300
4301 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4302 domains[i].domain_name,
4303 domains[i].dns_name,
4304 sid_to_fstring(tmp, &domains[i].sid),
4305 domains[i].trust_flags,
4306 domains[i].trust_attribs,
4307 domains[i].trust_type );
4308 }
4309
4310 if ( buflen < len ) {
4311 SAFE_FREE(buffer);
4312 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4313 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4314 buflen = -1;
4315 goto done;
4316 }
4317 buflen = len;
4318 goto again;
4319 }
4320
4321 *buf = buffer;
4322
4323 done:
4324 return buflen;
4325 }
4326
4327 /*********************************************************************
4328 ********************************************************************/
4329
4330 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4331 struct winbindd_tdc_domain **domains )
4332 {
4333 fstring domain_name, dns_name, sid_string;
4334 uint32 type, attribs, flags;
4335 int num_domains;
4336 int len = 0;
4337 int i;
4338 struct winbindd_tdc_domain *list = NULL;
4339
4340 /* get the number of domains */
4341 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4342 if ( len == -1 ) {
4343 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4344 return 0;
4345 }
4346
4347 list = talloc_array( NULL, struct winbindd_tdc_domain, num_domains );
4348 if ( !list ) {
4349 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4350 return 0;
4351 }
4352
4353 for ( i=0; i<num_domains; i++ ) {
4354 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4355 domain_name,
4356 dns_name,
4357 sid_string,
4358 &flags,
4359 &attribs,
4360 &type );
4361
4362 if ( len == -1 ) {
4363 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4364 TALLOC_FREE( list );
4365 return 0;
4366 }
4367
4368 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4369 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4370 domain_name, dns_name, sid_string,
4371 flags, attribs, type));
4372
4373 list[i].domain_name = talloc_strdup( list, domain_name );
4374 list[i].dns_name = talloc_strdup( list, dns_name );
4375 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4376 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4377 domain_name));
4378 }
4379 list[i].trust_flags = flags;
4380 list[i].trust_attribs = attribs;
4381 list[i].trust_type = type;
4382 }
4383
4384 *domains = list;
4385
4386 return num_domains;
4387 }
4388
4389 /*********************************************************************
4390 ********************************************************************/
4391
4392 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4393 {
4394 TDB_DATA key = make_tdc_key( lp_workgroup() );
4395 TDB_DATA data = { NULL, 0 };
4396 int ret;
4397
4398 if ( !key.dptr )
4399 return false;
4400
4401 /* See if we were asked to delete the cache entry */
4402
4403 if ( !domains ) {
4404 ret = tdb_delete( wcache->tdb, key );
4405 goto done;
4406 }
4407
4408 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4409
4410 if ( !data.dptr ) {
4411 ret = -1;
4412 goto done;
4413 }
4414
4415 ret = tdb_store( wcache->tdb, key, data, 0 );
4416
4417 done:
4418 SAFE_FREE( data.dptr );
4419 SAFE_FREE( key.dptr );
4420
4421 return ( ret == 0 );
4422 }
4423
4424 /*********************************************************************
4425 ********************************************************************/
4426
4427 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4428 {
4429 TDB_DATA key = make_tdc_key( lp_workgroup() );
4430 TDB_DATA data = { NULL, 0 };
4431
4432 *domains = NULL;
4433 *num_domains = 0;
4434
4435 if ( !key.dptr )
4436 return false;
4437
4438 data = tdb_fetch_compat( wcache->tdb, key );
4439
4440 SAFE_FREE( key.dptr );
4441
4442 if ( !data.dptr )
4443 return false;
4444
4445 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4446
4447 SAFE_FREE( data.dptr );
4448
4449 if ( !*domains )
4450 return false;
4451
4452 return true;
4453 }
4454
4455 /*********************************************************************
4456 ********************************************************************/
4457
4458 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4459 {
4460 struct winbindd_tdc_domain *dom_list = NULL;
4461 size_t num_domains = 0;
4462 bool ret = false;
4463
4464 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4465 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4466 domain->name, domain->alt_name,
4467 sid_string_dbg(&domain->sid),
4468 domain->domain_flags,
4469 domain->domain_trust_attribs,
4470 domain->domain_type));
4471
4472 if ( !init_wcache() ) {
4473 return false;
4474 }
4475
4476 /* fetch the list */
4477
4478 wcache_tdc_fetch_list( &dom_list, &num_domains );
4479
4480 /* add the new domain */
4481
4482 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4483 goto done;
4484 }
4485
4486 /* pack the domain */
4487
4488 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4489 goto done;
4490 }
4491
4492 /* Success */
4493
4494 ret = true;
4495 done:
4496 TALLOC_FREE( dom_list );
4497
4498 return ret;
4499 }
4500
4501 /*********************************************************************
4502 ********************************************************************/
4503
4504 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4505 {
4506 struct winbindd_tdc_domain *dom_list = NULL;
4507 size_t num_domains = 0;
4508 int i;
4509 struct winbindd_tdc_domain *d = NULL;
4510
4511 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4512
4513 if ( !init_wcache() ) {
4514 return false;
4515 }
4516
4517 /* fetch the list */
4518
4519 wcache_tdc_fetch_list( &dom_list, &num_domains );
4520
4521 for ( i=0; i<num_domains; i++ ) {
4522 if ( strequal(name, dom_list[i].domain_name) ||
4523 strequal(name, dom_list[i].dns_name) )
4524 {
4525 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4526 name));
4527
4528 d = talloc( ctx, struct winbindd_tdc_domain );
4529 if ( !d )
4530 break;
4531
4532 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4533 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4534 sid_copy( &d->sid, &dom_list[i].sid );
4535 d->trust_flags = dom_list[i].trust_flags;
4536 d->trust_type = dom_list[i].trust_type;
4537 d->trust_attribs = dom_list[i].trust_attribs;
4538
4539 break;
4540 }
4541 }
4542
4543 TALLOC_FREE( dom_list );
4544
4545 return d;
4546 }
4547
4548 /*********************************************************************
4549 ********************************************************************/
4550
4551 struct winbindd_tdc_domain*
4552 wcache_tdc_fetch_domainbysid(TALLOC_CTX *ctx,
4553 const struct dom_sid *sid)
4554 {
4555 struct winbindd_tdc_domain *dom_list = NULL;
4556 size_t num_domains = 0;
4557 int i;
4558 struct winbindd_tdc_domain *d = NULL;
4559
4560 DEBUG(10,("wcache_tdc_fetch_domainbysid: Searching for domain %s\n",
4561 sid_string_dbg(sid)));
4562
4563 if (!init_wcache()) {
4564 return false;
4565 }
4566
4567 /* fetch the list */
4568
4569 wcache_tdc_fetch_list(&dom_list, &num_domains);
4570
4571 for (i = 0; i<num_domains; i++) {
4572 if (dom_sid_equal(sid, &(dom_list[i].sid))) {
4573 DEBUG(10, ("wcache_tdc_fetch_domainbysid: "
4574 "Found domain %s for SID %s\n",
4575 dom_list[i].domain_name,
4576 sid_string_dbg(sid)));
4577
4578 d = talloc(ctx, struct winbindd_tdc_domain);
4579 if (!d)
4580 break;
4581
4582 d->domain_name = talloc_strdup(d,
4583 dom_list[i].domain_name);
4584
4585 d->dns_name = talloc_strdup(d, dom_list[i].dns_name);
4586 sid_copy(&d->sid, &dom_list[i].sid);
4587 d->trust_flags = dom_list[i].trust_flags;
4588 d->trust_type = dom_list[i].trust_type;
4589 d->trust_attribs = dom_list[i].trust_attribs;
4590
4591 break;
4592 }
4593 }
4594
4595 TALLOC_FREE(dom_list);
4596
4597 return d;
4598 }
4599
4600
4601 /*********************************************************************
4602 ********************************************************************/
4603
4604 void wcache_tdc_clear( void )
4605 {
4606 if ( !init_wcache() )
4607 return;
4608
4609 wcache_tdc_store_list( NULL, 0 );
4610
4611 return;
4612 }
4613
4614
4615 /*********************************************************************
4616 ********************************************************************/
4617
4618 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4619 NTSTATUS status,
4620 const struct dom_sid *user_sid,
4621 const char *homedir,
4622 const char *shell,
4623 const char *gecos,
4624 uint32 gid)
4625 {
4626 struct cache_entry *centry;
4627 fstring tmp;
4628
4629 if ( (centry = centry_start(domain, status)) == NULL )
4630 return;
4631
4632 centry_put_string( centry, homedir );
4633 centry_put_string( centry, shell );
4634 centry_put_string( centry, gecos );
4635 centry_put_uint32( centry, gid );
4636
4637 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4638
4639 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4640
4641 centry_free(centry);
4642 }
4643
4644 #ifdef HAVE_ADS
4645
4646 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4647 const struct dom_sid *user_sid,
4648 TALLOC_CTX *ctx,
4649 const char **homedir, const char **shell,
4650 const char **gecos, gid_t *p_gid)
4651 {
4652 struct winbind_cache *cache = get_cache(domain);
4653 struct cache_entry *centry = NULL;
4654 NTSTATUS nt_status;
4655 fstring tmp;
4656
4657 if (!cache->tdb)
4658 goto do_query;
4659
4660 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4661 sid_to_fstring(tmp, user_sid));
4662
4663 if (!centry)
4664 goto do_query;
4665
4666 *homedir = centry_string( centry, ctx );
4667 *shell = centry_string( centry, ctx );
4668 *gecos = centry_string( centry, ctx );
4669 *p_gid = centry_uint32( centry );
4670
4671 centry_free(centry);
4672
4673 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4674 sid_string_dbg(user_sid)));
4675
4676 return NT_STATUS_OK;
4677
4678 do_query:
4679
4680 nt_status = nss_get_info( domain->name, user_sid, ctx,
4681 homedir, shell, gecos, p_gid );
4682
4683 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4684
4685 if ( NT_STATUS_IS_OK(nt_status) ) {
4686 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4687 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4688 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4689 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4690
4691 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4692 *homedir, *shell, *gecos, *p_gid );
4693 }
4694
4695 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4696 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4697 domain->name ));
4698 set_domain_offline( domain );
4699 }
4700
4701 return nt_status;
4702 }
4703
4704 #endif
4705
4706 /* the cache backend methods are exposed via this structure */
4707 struct winbindd_methods cache_methods = {
4708 true,
4709 query_user_list,
4710 enum_dom_groups,
4711 enum_local_groups,
4712 name_to_sid,
4713 sid_to_name,
4714 rids_to_names,
4715 query_user,
4716 lookup_usergroups,
4717 lookup_useraliases,
4718 lookup_groupmem,
4719 sequence_number,
4720 lockout_policy,
4721 password_policy,
4722 trusted_domains
4723 };
4724
4725 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4726 uint32_t opnum, const DATA_BLOB *req,
4727 TDB_DATA *pkey)
4728 {
4729 char *key;
4730 size_t keylen;
4731
4732 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4733 if (key == NULL) {
4734 return false;
4735 }
4736 keylen = talloc_get_size(key) - 1;
4737
4738 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4739 if (key == NULL) {
4740 return false;
4741 }
4742 memcpy(key + keylen, req->data, req->length);
4743
4744 pkey->dptr = (uint8_t *)key;
4745 pkey->dsize = talloc_get_size(key);
4746 return true;
4747 }
4748
4749 static bool wcache_opnum_cacheable(uint32_t opnum)
4750 {
4751 switch (opnum) {
4752 case NDR_WBINT_PING:
4753 case NDR_WBINT_QUERYSEQUENCENUMBER:
4754 case NDR_WBINT_ALLOCATEUID:
4755 case NDR_WBINT_ALLOCATEGID:
4756 case NDR_WBINT_CHECKMACHINEACCOUNT:
4757 case NDR_WBINT_CHANGEMACHINEACCOUNT:
4758 case NDR_WBINT_PINGDC:
4759 return false;
4760 }
4761 return true;
4762 }
4763
4764 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4765 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4766 {
4767 TDB_DATA key, data;
4768 bool ret = false;
4769
4770 if (!wcache_opnum_cacheable(opnum) ||
4771 is_my_own_sam_domain(domain) ||
4772 is_builtin_domain(domain)) {
4773 return false;
4774 }
4775
4776 if (wcache->tdb == NULL) {
4777 return false;
4778 }
4779
4780 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4781 return false;
4782 }
4783 data = tdb_fetch_compat(wcache->tdb, key);
4784 TALLOC_FREE(key.dptr);
4785
4786 if (data.dptr == NULL) {
4787 return false;
4788 }
4789 if (data.dsize < 12) {
4790 goto fail;
4791 }
4792
4793 if (!is_domain_offline(domain)) {
4794 uint32_t entry_seqnum, dom_seqnum, last_check;
4795 uint64_t entry_timeout;
4796
4797 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4798 &last_check)) {
4799 goto fail;
4800 }
4801 entry_seqnum = IVAL(data.dptr, 0);
4802 if (entry_seqnum != dom_seqnum) {
4803 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4804 (int)entry_seqnum));
4805 goto fail;
4806 }
4807 entry_timeout = BVAL(data.dptr, 4);
4808 if (time(NULL) > entry_timeout) {
4809 DEBUG(10, ("Entry has timed out\n"));
4810 goto fail;
4811 }
4812 }
4813
4814 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 12,
4815 data.dsize - 12);
4816 if (resp->data == NULL) {
4817 DEBUG(10, ("talloc failed\n"));
4818 goto fail;
4819 }
4820 resp->length = data.dsize - 12;
4821
4822 ret = true;
4823 fail:
4824 SAFE_FREE(data.dptr);
4825 return ret;
4826 }
4827
4828 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4829 const DATA_BLOB *req, const DATA_BLOB *resp)
4830 {
4831 TDB_DATA key, data;
4832 uint32_t dom_seqnum, last_check;
4833 uint64_t timeout;
4834
4835 if (!wcache_opnum_cacheable(opnum) ||
4836 is_my_own_sam_domain(domain) ||
4837 is_builtin_domain(domain)) {
4838 return;
4839 }
4840
4841 if (wcache->tdb == NULL) {
4842 return;
4843 }
4844
4845 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4846 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4847 domain->name));
4848 return;
4849 }
4850
4851 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4852 return;
4853 }
4854
4855 timeout = time(NULL) + lp_winbind_cache_time();
4856
4857 data.dsize = resp->length + 12;
4858 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4859 if (data.dptr == NULL) {
4860 goto done;
4861 }
4862
4863 SIVAL(data.dptr, 0, dom_seqnum);
4864 SBVAL(data.dptr, 4, timeout);
4865 memcpy(data.dptr + 12, resp->data, resp->length);
4866
4867 tdb_store(wcache->tdb, key, data, 0);
4868
4869 done:
4870 TALLOC_FREE(key.dptr);
4871 return;
4872 }
reg import