?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-docs: Typos in smbclient man page
[Samba/gebeck_regimport.git] / source3 / winbindd / winbindd_cache.c
blob37291a70ab23502c6c9c975ddbbc3faffc30af76
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
30 #include "../librpc/gen_ndr/ndr_wbint.h"
31 #include "ads.h"
32 #include "nss_info.h"
33 #include "../libcli/security/security.h"
34
35 #undef DBGC_CLASS
36 #define DBGC_CLASS DBGC_WINBIND
37
38 #define WINBINDD_CACHE_VERSION 2
39 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
40
41 extern struct winbindd_methods reconnect_methods;
42 #ifdef HAVE_ADS
43 extern struct winbindd_methods ads_methods;
44 #endif
45 extern struct winbindd_methods builtin_passdb_methods;
46 extern struct winbindd_methods sam_passdb_methods;
47
48 /*
49 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
50 * Here are the list of entry types that are *not* stored
51 * as form struct cache_entry in the cache.
52 */
53
54 static const char *non_centry_keys[] = {
55 "SEQNUM/",
56 "DR/",
57 "DE/",
58 "WINBINDD_OFFLINE",
59 WINBINDD_CACHE_VERSION_KEYSTR,
60 NULL
61 };
62
63 /************************************************************************
64 Is this key a non-centry type ?
65 ************************************************************************/
66
67 static bool is_non_centry_key(TDB_DATA kbuf)
68 {
69 int i;
70
71 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
72 return false;
73 }
74 for (i = 0; non_centry_keys[i] != NULL; i++) {
75 size_t namelen = strlen(non_centry_keys[i]);
76 if (kbuf.dsize < namelen) {
77 continue;
78 }
79 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
80 return true;
81 }
82 }
83 return false;
84 }
85
86 /* Global online/offline state - False when online. winbindd starts up online
87 and sets this to true if the first query fails and there's an entry in
88 the cache tdb telling us to stay offline. */
89
90 static bool global_winbindd_offline_state;
91
92 struct winbind_cache {
93 TDB_CONTEXT *tdb;
94 };
95
96 struct cache_entry {
97 NTSTATUS status;
98 uint32 sequence_number;
99 uint64_t timeout;
100 uint8 *data;
101 uint32 len, ofs;
102 };
103
104 void (*smb_panic_fn)(const char *const why) = smb_panic;
105
106 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
107
108 static struct winbind_cache *wcache;
109
110 /* get the winbind_cache structure */
111 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
112 {
113 struct winbind_cache *ret = wcache;
114
115 /* We have to know what type of domain we are dealing with first. */
116
117 if (domain->internal) {
118 domain->backend = &builtin_passdb_methods;
119 domain->initialized = True;
120 }
121
122 if (strequal(domain->name, get_global_sam_name()) &&
123 sid_check_is_domain(&domain->sid)) {
124 domain->backend = &sam_passdb_methods;
125 domain->initialized = True;
126 }
127
128 if ( !domain->initialized ) {
129 init_dc_connection( domain );
130 }
131
132 /*
133 OK. listen up becasue I'm only going to say this once.
134 We have the following scenarios to consider
135 (a) trusted AD domains on a Samba DC,
136 (b) trusted AD domains and we are joined to a non-kerberos domain
137 (c) trusted AD domains and we are joined to a kerberos (AD) domain
138
139 For (a) we can always contact the trusted domain using krb5
140 since we have the domain trust account password
141
142 For (b) we can only use RPC since we have no way of
143 getting a krb5 ticket in our own domain
144
145 For (c) we can always use krb5 since we have a kerberos trust
146
147 --jerry
148 */
149
150 if (!domain->backend) {
151 #ifdef HAVE_ADS
152 struct winbindd_domain *our_domain = domain;
153
154 /* find our domain first so we can figure out if we
155 are joined to a kerberized domain */
156
157 if ( !domain->primary )
158 our_domain = find_our_domain();
159
160 if ((our_domain->active_directory || IS_DC)
161 && domain->active_directory
162 && !lp_winbind_rpc_only()) {
163 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
164 domain->backend = &ads_methods;
165 } else {
166 #endif /* HAVE_ADS */
167 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
168 domain->backend = &reconnect_methods;
169 #ifdef HAVE_ADS
170 }
171 #endif /* HAVE_ADS */
172 }
173
174 if (ret)
175 return ret;
176
177 ret = SMB_XMALLOC_P(struct winbind_cache);
178 ZERO_STRUCTP(ret);
179
180 wcache = ret;
181 wcache_flush_cache();
182
183 return ret;
184 }
185
186 /*
187 free a centry structure
188 */
189 static void centry_free(struct cache_entry *centry)
190 {
191 if (!centry)
192 return;
193 SAFE_FREE(centry->data);
194 free(centry);
195 }
196
197 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
198 {
199 if (centry->len - centry->ofs < nbytes) {
200 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
201 (unsigned int)nbytes,
202 centry->len - centry->ofs));
203 return false;
204 }
205 return true;
206 }
207
208 /*
209 pull a uint64_t from a cache entry
210 */
211 static uint64_t centry_uint64_t(struct cache_entry *centry)
212 {
213 uint64_t ret;
214
215 if (!centry_check_bytes(centry, 8)) {
216 smb_panic_fn("centry_uint64_t");
217 }
218 ret = BVAL(centry->data, centry->ofs);
219 centry->ofs += 8;
220 return ret;
221 }
222
223 /*
224 pull a uint32 from a cache entry
225 */
226 static uint32 centry_uint32(struct cache_entry *centry)
227 {
228 uint32 ret;
229
230 if (!centry_check_bytes(centry, 4)) {
231 smb_panic_fn("centry_uint32");
232 }
233 ret = IVAL(centry->data, centry->ofs);
234 centry->ofs += 4;
235 return ret;
236 }
237
238 /*
239 pull a uint16 from a cache entry
240 */
241 static uint16 centry_uint16(struct cache_entry *centry)
242 {
243 uint16 ret;
244 if (!centry_check_bytes(centry, 2)) {
245 smb_panic_fn("centry_uint16");
246 }
247 ret = CVAL(centry->data, centry->ofs);
248 centry->ofs += 2;
249 return ret;
250 }
251
252 /*
253 pull a uint8 from a cache entry
254 */
255 static uint8 centry_uint8(struct cache_entry *centry)
256 {
257 uint8 ret;
258 if (!centry_check_bytes(centry, 1)) {
259 smb_panic_fn("centry_uint8");
260 }
261 ret = CVAL(centry->data, centry->ofs);
262 centry->ofs += 1;
263 return ret;
264 }
265
266 /*
267 pull a NTTIME from a cache entry
268 */
269 static NTTIME centry_nttime(struct cache_entry *centry)
270 {
271 NTTIME ret;
272 if (!centry_check_bytes(centry, 8)) {
273 smb_panic_fn("centry_nttime");
274 }
275 ret = IVAL(centry->data, centry->ofs);
276 centry->ofs += 4;
277 ret += (uint64)IVAL(centry->data, centry->ofs) << 32;
278 centry->ofs += 4;
279 return ret;
280 }
281
282 /*
283 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
284 */
285 static time_t centry_time(struct cache_entry *centry)
286 {
287 return (time_t)centry_nttime(centry);
288 }
289
290 /* pull a string from a cache entry, using the supplied
291 talloc context
292 */
293 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
294 {
295 uint32 len;
296 char *ret;
297
298 len = centry_uint8(centry);
299
300 if (len == 0xFF) {
301 /* a deliberate NULL string */
302 return NULL;
303 }
304
305 if (!centry_check_bytes(centry, (size_t)len)) {
306 smb_panic_fn("centry_string");
307 }
308
309 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
310 if (!ret) {
311 smb_panic_fn("centry_string out of memory\n");
312 }
313 memcpy(ret,centry->data + centry->ofs, len);
314 ret[len] = 0;
315 centry->ofs += len;
316 return ret;
317 }
318
319 /* pull a hash16 from a cache entry, using the supplied
320 talloc context
321 */
322 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
323 {
324 uint32 len;
325 char *ret;
326
327 len = centry_uint8(centry);
328
329 if (len != 16) {
330 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
331 len ));
332 return NULL;
333 }
334
335 if (!centry_check_bytes(centry, 16)) {
336 return NULL;
337 }
338
339 ret = TALLOC_ARRAY(mem_ctx, char, 16);
340 if (!ret) {
341 smb_panic_fn("centry_hash out of memory\n");
342 }
343 memcpy(ret,centry->data + centry->ofs, 16);
344 centry->ofs += 16;
345 return ret;
346 }
347
348 /* pull a sid from a cache entry, using the supplied
349 talloc context
350 */
351 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
352 {
353 char *sid_string;
354 bool ret;
355
356 sid_string = centry_string(centry, talloc_tos());
357 if (sid_string == NULL) {
358 return false;
359 }
360 ret = string_to_sid(sid, sid_string);
361 TALLOC_FREE(sid_string);
362 return ret;
363 }
364
365
366 /*
367 pull a NTSTATUS from a cache entry
368 */
369 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
370 {
371 NTSTATUS status;
372
373 status = NT_STATUS(centry_uint32(centry));
374 return status;
375 }
376
377
378 /* the server is considered down if it can't give us a sequence number */
379 static bool wcache_server_down(struct winbindd_domain *domain)
380 {
381 bool ret;
382
383 if (!wcache->tdb)
384 return false;
385
386 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
387
388 if (ret)
389 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
390 domain->name ));
391 return ret;
392 }
393
394 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
395 uint32_t *last_seq_check)
396 {
397 char *key;
398 TDB_DATA data;
399
400 if (wcache->tdb == NULL) {
401 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
402 return false;
403 }
404
405 key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
406 if (key == NULL) {
407 DEBUG(10, ("talloc failed\n"));
408 return false;
409 }
410
411 data = tdb_fetch_bystring(wcache->tdb, key);
412 TALLOC_FREE(key);
413
414 if (data.dptr == NULL) {
415 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
416 domain_name));
417 return false;
418 }
419 if (data.dsize != 8) {
420 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
421 (int)data.dsize));
422 SAFE_FREE(data.dptr);
423 return false;
424 }
425
426 *seqnum = IVAL(data.dptr, 0);
427 *last_seq_check = IVAL(data.dptr, 4);
428 SAFE_FREE(data.dptr);
429
430 return true;
431 }
432
433 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
434 {
435 uint32 last_check, time_diff;
436
437 if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
438 &last_check)) {
439 return NT_STATUS_UNSUCCESSFUL;
440 }
441 domain->last_seq_check = last_check;
442
443 /* have we expired? */
444
445 time_diff = now - domain->last_seq_check;
446 if ( time_diff > lp_winbind_cache_time() ) {
447 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
448 domain->name, domain->sequence_number,
449 (uint32)domain->last_seq_check));
450 return NT_STATUS_UNSUCCESSFUL;
451 }
452
453 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
454 domain->name, domain->sequence_number,
455 (uint32)domain->last_seq_check));
456
457 return NT_STATUS_OK;
458 }
459
460 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
461 time_t last_seq_check)
462 {
463 char *key_str;
464 uint8_t buf[8];
465 int ret;
466
467 if (wcache->tdb == NULL) {
468 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
469 return false;
470 }
471
472 key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
473 if (key_str == NULL) {
474 DEBUG(10, ("talloc_asprintf failed\n"));
475 return false;
476 }
477
478 SIVAL(buf, 0, seqnum);
479 SIVAL(buf, 4, last_seq_check);
480
481 ret = tdb_store_bystring(wcache->tdb, key_str,
482 make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
483 TALLOC_FREE(key_str);
484 if (ret == -1) {
485 DEBUG(10, ("tdb_store_bystring failed: %s\n",
486 tdb_errorstr(wcache->tdb)));
487 TALLOC_FREE(key_str);
488 return false;
489 }
490
491 DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
492 domain_name, seqnum, (unsigned)last_seq_check));
493
494 return true;
495 }
496
497 static bool store_cache_seqnum( struct winbindd_domain *domain )
498 {
499 return wcache_store_seqnum(domain->name, domain->sequence_number,
500 domain->last_seq_check);
501 }
502
503 /*
504 refresh the domain sequence number. If force is true
505 then always refresh it, no matter how recently we fetched it
506 */
507
508 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
509 {
510 NTSTATUS status;
511 unsigned time_diff;
512 time_t t = time(NULL);
513 unsigned cache_time = lp_winbind_cache_time();
514
515 if (is_domain_offline(domain)) {
516 return;
517 }
518
519 get_cache( domain );
520
521 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
522 /* trying to reconnect is expensive, don't do it too often */
523 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
524 cache_time *= 8;
525 }
526 #endif
527
528 time_diff = t - domain->last_seq_check;
529
530 /* see if we have to refetch the domain sequence number */
531 if (!force && (time_diff < cache_time) &&
532 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
533 NT_STATUS_IS_OK(domain->last_status)) {
534 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
535 goto done;
536 }
537
538 /* try to get the sequence number from the tdb cache first */
539 /* this will update the timestamp as well */
540
541 status = fetch_cache_seqnum( domain, t );
542 if (NT_STATUS_IS_OK(status) &&
543 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
544 NT_STATUS_IS_OK(domain->last_status)) {
545 goto done;
546 }
547
548 /* important! make sure that we know if this is a native
549 mode domain or not. And that we can contact it. */
550
551 if ( winbindd_can_contact_domain( domain ) ) {
552 status = domain->backend->sequence_number(domain,
553 &domain->sequence_number);
554 } else {
555 /* just use the current time */
556 status = NT_STATUS_OK;
557 domain->sequence_number = time(NULL);
558 }
559
560
561 /* the above call could have set our domain->backend to NULL when
562 * coming from offline to online mode, make sure to reinitialize the
563 * backend - Guenther */
564 get_cache( domain );
565
566 if (!NT_STATUS_IS_OK(status)) {
567 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
568 domain->sequence_number = DOM_SEQUENCE_NONE;
569 }
570
571 domain->last_status = status;
572 domain->last_seq_check = time(NULL);
573
574 /* save the new sequence number in the cache */
575 store_cache_seqnum( domain );
576
577 done:
578 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
579 domain->name, domain->sequence_number));
580
581 return;
582 }
583
584 /*
585 decide if a cache entry has expired
586 */
587 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
588 {
589 /* If we've been told to be offline - stay in that state... */
590 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
591 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
592 keystr, domain->name ));
593 return false;
594 }
595
596 /* when the domain is offline return the cached entry.
597 * This deals with transient offline states... */
598
599 if (!domain->online) {
600 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
601 keystr, domain->name ));
602 return false;
603 }
604
605 /* if the server is OK and our cache entry came from when it was down then
606 the entry is invalid */
607 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
608 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
609 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
610 keystr, domain->name ));
611 return true;
612 }
613
614 /* if the server is down or the cache entry is not older than the
615 current sequence number or it did not timeout then it is OK */
616 if (wcache_server_down(domain)
617 || ((centry->sequence_number == domain->sequence_number)
618 && (centry->timeout > time(NULL)))) {
619 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
620 keystr, domain->name ));
621 return false;
622 }
623
624 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
625 keystr, domain->name ));
626
627 /* it's expired */
628 return true;
629 }
630
631 static struct cache_entry *wcache_fetch_raw(char *kstr)
632 {
633 TDB_DATA data;
634 struct cache_entry *centry;
635 TDB_DATA key;
636
637 key = string_tdb_data(kstr);
638 data = tdb_fetch(wcache->tdb, key);
639 if (!data.dptr) {
640 /* a cache miss */
641 return NULL;
642 }
643
644 centry = SMB_XMALLOC_P(struct cache_entry);
645 centry->data = (unsigned char *)data.dptr;
646 centry->len = data.dsize;
647 centry->ofs = 0;
648
649 if (centry->len < 16) {
650 /* huh? corrupt cache? */
651 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s "
652 "(len < 16)?\n", kstr));
653 centry_free(centry);
654 return NULL;
655 }
656
657 centry->status = centry_ntstatus(centry);
658 centry->sequence_number = centry_uint32(centry);
659 centry->timeout = centry_uint64_t(centry);
660
661 return centry;
662 }
663
664 static bool is_my_own_sam_domain(struct winbindd_domain *domain)
665 {
666 if (strequal(domain->name, get_global_sam_name()) &&
667 sid_check_is_domain(&domain->sid)) {
668 return true;
669 }
670
671 return false;
672 }
673
674 static bool is_builtin_domain(struct winbindd_domain *domain)
675 {
676 if (strequal(domain->name, "BUILTIN") &&
677 sid_check_is_builtin(&domain->sid)) {
678 return true;
679 }
680
681 return false;
682 }
683
684 /*
685 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
686 number and return status
687 */
688 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
689 struct winbindd_domain *domain,
690 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
691 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
692 struct winbindd_domain *domain,
693 const char *format, ...)
694 {
695 va_list ap;
696 char *kstr;
697 struct cache_entry *centry;
698
699 if (!winbindd_use_cache() ||
700 is_my_own_sam_domain(domain) ||
701 is_builtin_domain(domain)) {
702 return NULL;
703 }
704
705 refresh_sequence_number(domain, false);
706
707 va_start(ap, format);
708 smb_xvasprintf(&kstr, format, ap);
709 va_end(ap);
710
711 centry = wcache_fetch_raw(kstr);
712 if (centry == NULL) {
713 free(kstr);
714 return NULL;
715 }
716
717 if (centry_expired(domain, kstr, centry)) {
718
719 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
720 kstr, domain->name ));
721
722 centry_free(centry);
723 free(kstr);
724 return NULL;
725 }
726
727 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
728 kstr, domain->name ));
729
730 free(kstr);
731 return centry;
732 }
733
734 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
735 static void wcache_delete(const char *format, ...)
736 {
737 va_list ap;
738 char *kstr;
739 TDB_DATA key;
740
741 va_start(ap, format);
742 smb_xvasprintf(&kstr, format, ap);
743 va_end(ap);
744
745 key = string_tdb_data(kstr);
746
747 tdb_delete(wcache->tdb, key);
748 free(kstr);
749 }
750
751 /*
752 make sure we have at least len bytes available in a centry
753 */
754 static void centry_expand(struct cache_entry *centry, uint32 len)
755 {
756 if (centry->len - centry->ofs >= len)
757 return;
758 centry->len *= 2;
759 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
760 centry->len);
761 if (!centry->data) {
762 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
763 smb_panic_fn("out of memory in centry_expand");
764 }
765 }
766
767 /*
768 push a uint64_t into a centry
769 */
770 static void centry_put_uint64_t(struct cache_entry *centry, uint64_t v)
771 {
772 centry_expand(centry, 8);
773 SBVAL(centry->data, centry->ofs, v);
774 centry->ofs += 8;
775 }
776
777 /*
778 push a uint32 into a centry
779 */
780 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
781 {
782 centry_expand(centry, 4);
783 SIVAL(centry->data, centry->ofs, v);
784 centry->ofs += 4;
785 }
786
787 /*
788 push a uint16 into a centry
789 */
790 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
791 {
792 centry_expand(centry, 2);
793 SIVAL(centry->data, centry->ofs, v);
794 centry->ofs += 2;
795 }
796
797 /*
798 push a uint8 into a centry
799 */
800 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
801 {
802 centry_expand(centry, 1);
803 SCVAL(centry->data, centry->ofs, v);
804 centry->ofs += 1;
805 }
806
807 /*
808 push a string into a centry
809 */
810 static void centry_put_string(struct cache_entry *centry, const char *s)
811 {
812 int len;
813
814 if (!s) {
815 /* null strings are marked as len 0xFFFF */
816 centry_put_uint8(centry, 0xFF);
817 return;
818 }
819
820 len = strlen(s);
821 /* can't handle more than 254 char strings. Truncating is probably best */
822 if (len > 254) {
823 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
824 len = 254;
825 }
826 centry_put_uint8(centry, len);
827 centry_expand(centry, len);
828 memcpy(centry->data + centry->ofs, s, len);
829 centry->ofs += len;
830 }
831
832 /*
833 push a 16 byte hash into a centry - treat as 16 byte string.
834 */
835 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
836 {
837 centry_put_uint8(centry, 16);
838 centry_expand(centry, 16);
839 memcpy(centry->data + centry->ofs, val, 16);
840 centry->ofs += 16;
841 }
842
843 static void centry_put_sid(struct cache_entry *centry, const struct dom_sid *sid)
844 {
845 fstring sid_string;
846 centry_put_string(centry, sid_to_fstring(sid_string, sid));
847 }
848
849
850 /*
851 put NTSTATUS into a centry
852 */
853 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
854 {
855 uint32 status_value = NT_STATUS_V(status);
856 centry_put_uint32(centry, status_value);
857 }
858
859
860 /*
861 push a NTTIME into a centry
862 */
863 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
864 {
865 centry_expand(centry, 8);
866 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
867 centry->ofs += 4;
868 SIVAL(centry->data, centry->ofs, nt >> 32);
869 centry->ofs += 4;
870 }
871
872 /*
873 push a time_t into a centry - use a 64 bit size.
874 NTTIME here is being used as a convenient 64-bit size.
875 */
876 static void centry_put_time(struct cache_entry *centry, time_t t)
877 {
878 NTTIME nt = (NTTIME)t;
879 centry_put_nttime(centry, nt);
880 }
881
882 /*
883 start a centry for output. When finished, call centry_end()
884 */
885 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
886 {
887 struct cache_entry *centry;
888
889 if (!wcache->tdb)
890 return NULL;
891
892 centry = SMB_XMALLOC_P(struct cache_entry);
893
894 centry->len = 8192; /* reasonable default */
895 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
896 centry->ofs = 0;
897 centry->sequence_number = domain->sequence_number;
898 centry->timeout = lp_winbind_cache_time() + time(NULL);
899 centry_put_ntstatus(centry, status);
900 centry_put_uint32(centry, centry->sequence_number);
901 centry_put_uint64_t(centry, centry->timeout);
902 return centry;
903 }
904
905 /*
906 finish a centry and write it to the tdb
907 */
908 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
909 static void centry_end(struct cache_entry *centry, const char *format, ...)
910 {
911 va_list ap;
912 char *kstr;
913 TDB_DATA key, data;
914
915 if (!winbindd_use_cache()) {
916 return;
917 }
918
919 va_start(ap, format);
920 smb_xvasprintf(&kstr, format, ap);
921 va_end(ap);
922
923 key = string_tdb_data(kstr);
924 data.dptr = centry->data;
925 data.dsize = centry->ofs;
926
927 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
928 free(kstr);
929 }
930
931 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
932 NTSTATUS status, const char *domain_name,
933 const char *name, const struct dom_sid *sid,
934 enum lsa_SidType type)
935 {
936 struct cache_entry *centry;
937 fstring uname;
938
939 centry = centry_start(domain, status);
940 if (!centry)
941 return;
942 centry_put_uint32(centry, type);
943 centry_put_sid(centry, sid);
944 fstrcpy(uname, name);
945 strupper_m(uname);
946 centry_end(centry, "NS/%s/%s", domain_name, uname);
947 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
948 uname, sid_string_dbg(sid), nt_errstr(status)));
949 centry_free(centry);
950 }
951
952 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
953 const struct dom_sid *sid, const char *domain_name, const char *name, enum lsa_SidType type)
954 {
955 struct cache_entry *centry;
956 fstring sid_string;
957
958 centry = centry_start(domain, status);
959 if (!centry)
960 return;
961
962 if (NT_STATUS_IS_OK(status)) {
963 centry_put_uint32(centry, type);
964 centry_put_string(centry, domain_name);
965 centry_put_string(centry, name);
966 }
967
968 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
969 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
970 name, nt_errstr(status)));
971 centry_free(centry);
972 }
973
974
975 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
976 struct wbint_userinfo *info)
977 {
978 struct cache_entry *centry;
979 fstring sid_string;
980
981 if (is_null_sid(&info->user_sid)) {
982 return;
983 }
984
985 centry = centry_start(domain, status);
986 if (!centry)
987 return;
988 centry_put_string(centry, info->acct_name);
989 centry_put_string(centry, info->full_name);
990 centry_put_string(centry, info->homedir);
991 centry_put_string(centry, info->shell);
992 centry_put_uint32(centry, info->primary_gid);
993 centry_put_sid(centry, &info->user_sid);
994 centry_put_sid(centry, &info->group_sid);
995 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
996 &info->user_sid));
997 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
998 centry_free(centry);
999 }
1000
1001 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
1002 NTSTATUS status,
1003 struct samr_DomInfo12 *lockout_policy)
1004 {
1005 struct cache_entry *centry;
1006
1007 centry = centry_start(domain, status);
1008 if (!centry)
1009 return;
1010
1011 centry_put_nttime(centry, lockout_policy->lockout_duration);
1012 centry_put_nttime(centry, lockout_policy->lockout_window);
1013 centry_put_uint16(centry, lockout_policy->lockout_threshold);
1014
1015 centry_end(centry, "LOC_POL/%s", domain->name);
1016
1017 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
1018
1019 centry_free(centry);
1020 }
1021
1022
1023
1024 static void wcache_save_password_policy(struct winbindd_domain *domain,
1025 NTSTATUS status,
1026 struct samr_DomInfo1 *policy)
1027 {
1028 struct cache_entry *centry;
1029
1030 centry = centry_start(domain, status);
1031 if (!centry)
1032 return;
1033
1034 centry_put_uint16(centry, policy->min_password_length);
1035 centry_put_uint16(centry, policy->password_history_length);
1036 centry_put_uint32(centry, policy->password_properties);
1037 centry_put_nttime(centry, policy->max_password_age);
1038 centry_put_nttime(centry, policy->min_password_age);
1039
1040 centry_end(centry, "PWD_POL/%s", domain->name);
1041
1042 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1043
1044 centry_free(centry);
1045 }
1046
1047 /***************************************************************************
1048 ***************************************************************************/
1049
1050 static void wcache_save_username_alias(struct winbindd_domain *domain,
1051 NTSTATUS status,
1052 const char *name, const char *alias)
1053 {
1054 struct cache_entry *centry;
1055 fstring uname;
1056
1057 if ( (centry = centry_start(domain, status)) == NULL )
1058 return;
1059
1060 centry_put_string( centry, alias );
1061
1062 fstrcpy(uname, name);
1063 strupper_m(uname);
1064 centry_end(centry, "NSS/NA/%s", uname);
1065
1066 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1067
1068 centry_free(centry);
1069 }
1070
1071 static void wcache_save_alias_username(struct winbindd_domain *domain,
1072 NTSTATUS status,
1073 const char *alias, const char *name)
1074 {
1075 struct cache_entry *centry;
1076 fstring uname;
1077
1078 if ( (centry = centry_start(domain, status)) == NULL )
1079 return;
1080
1081 centry_put_string( centry, name );
1082
1083 fstrcpy(uname, alias);
1084 strupper_m(uname);
1085 centry_end(centry, "NSS/AN/%s", uname);
1086
1087 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1088
1089 centry_free(centry);
1090 }
1091
1092 /***************************************************************************
1093 ***************************************************************************/
1094
1095 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1096 struct winbindd_domain *domain,
1097 const char *name, char **alias )
1098 {
1099 struct winbind_cache *cache = get_cache(domain);
1100 struct cache_entry *centry = NULL;
1101 NTSTATUS status;
1102 char *upper_name;
1103
1104 if ( domain->internal )
1105 return NT_STATUS_NOT_SUPPORTED;
1106
1107 if (!cache->tdb)
1108 goto do_query;
1109
1110 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1111 return NT_STATUS_NO_MEMORY;
1112 strupper_m(upper_name);
1113
1114 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1115
1116 SAFE_FREE( upper_name );
1117
1118 if (!centry)
1119 goto do_query;
1120
1121 status = centry->status;
1122
1123 if (!NT_STATUS_IS_OK(status)) {
1124 centry_free(centry);
1125 return status;
1126 }
1127
1128 *alias = centry_string( centry, mem_ctx );
1129
1130 centry_free(centry);
1131
1132 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1133 name, *alias ? *alias : "(none)"));
1134
1135 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1136
1137 do_query:
1138
1139 /* If its not in cache and we are offline, then fail */
1140
1141 if ( get_global_winbindd_state_offline() || !domain->online ) {
1142 DEBUG(8,("resolve_username_to_alias: rejecting query "
1143 "in offline mode\n"));
1144 return NT_STATUS_NOT_FOUND;
1145 }
1146
1147 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1148
1149 if ( NT_STATUS_IS_OK( status ) ) {
1150 wcache_save_username_alias(domain, status, name, *alias);
1151 }
1152
1153 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1154 wcache_save_username_alias(domain, status, name, "(NULL)");
1155 }
1156
1157 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1158 nt_errstr(status)));
1159
1160 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1161 set_domain_offline( domain );
1162 }
1163
1164 return status;
1165 }
1166
1167 /***************************************************************************
1168 ***************************************************************************/
1169
1170 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1171 struct winbindd_domain *domain,
1172 const char *alias, char **name )
1173 {
1174 struct winbind_cache *cache = get_cache(domain);
1175 struct cache_entry *centry = NULL;
1176 NTSTATUS status;
1177 char *upper_name;
1178
1179 if ( domain->internal )
1180 return NT_STATUS_NOT_SUPPORTED;
1181
1182 if (!cache->tdb)
1183 goto do_query;
1184
1185 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1186 return NT_STATUS_NO_MEMORY;
1187 strupper_m(upper_name);
1188
1189 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1190
1191 SAFE_FREE( upper_name );
1192
1193 if (!centry)
1194 goto do_query;
1195
1196 status = centry->status;
1197
1198 if (!NT_STATUS_IS_OK(status)) {
1199 centry_free(centry);
1200 return status;
1201 }
1202
1203 *name = centry_string( centry, mem_ctx );
1204
1205 centry_free(centry);
1206
1207 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1208 alias, *name ? *name : "(none)"));
1209
1210 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1211
1212 do_query:
1213
1214 /* If its not in cache and we are offline, then fail */
1215
1216 if ( get_global_winbindd_state_offline() || !domain->online ) {
1217 DEBUG(8,("resolve_alias_to_username: rejecting query "
1218 "in offline mode\n"));
1219 return NT_STATUS_NOT_FOUND;
1220 }
1221
1222 /* an alias cannot contain a domain prefix or '@' */
1223
1224 if (strchr(alias, '\\') || strchr(alias, '@')) {
1225 DEBUG(10,("resolve_alias_to_username: skipping fully "
1226 "qualified name %s\n", alias));
1227 return NT_STATUS_OBJECT_NAME_INVALID;
1228 }
1229
1230 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1231
1232 if ( NT_STATUS_IS_OK( status ) ) {
1233 wcache_save_alias_username( domain, status, alias, *name );
1234 }
1235
1236 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1237 wcache_save_alias_username(domain, status, alias, "(NULL)");
1238 }
1239
1240 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1241 nt_errstr(status)));
1242
1243 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1244 set_domain_offline( domain );
1245 }
1246
1247 return status;
1248 }
1249
1250 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const struct dom_sid *sid)
1251 {
1252 struct winbind_cache *cache = get_cache(domain);
1253 TDB_DATA data;
1254 fstring key_str, tmp;
1255 uint32 rid;
1256
1257 if (!cache->tdb) {
1258 return NT_STATUS_INTERNAL_DB_ERROR;
1259 }
1260
1261 if (is_null_sid(sid)) {
1262 return NT_STATUS_INVALID_SID;
1263 }
1264
1265 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1266 return NT_STATUS_INVALID_SID;
1267 }
1268
1269 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1270
1271 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1272 if (!data.dptr) {
1273 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1274 }
1275
1276 SAFE_FREE(data.dptr);
1277 return NT_STATUS_OK;
1278 }
1279
1280 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1281 as new salted ones. */
1282
1283 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1284 TALLOC_CTX *mem_ctx,
1285 const struct dom_sid *sid,
1286 const uint8 **cached_nt_pass,
1287 const uint8 **cached_salt)
1288 {
1289 struct winbind_cache *cache = get_cache(domain);
1290 struct cache_entry *centry = NULL;
1291 NTSTATUS status;
1292 time_t t;
1293 uint32 rid;
1294 fstring tmp;
1295
1296 if (!cache->tdb) {
1297 return NT_STATUS_INTERNAL_DB_ERROR;
1298 }
1299
1300 if (is_null_sid(sid)) {
1301 return NT_STATUS_INVALID_SID;
1302 }
1303
1304 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1305 return NT_STATUS_INVALID_SID;
1306 }
1307
1308 /* Try and get a salted cred first. If we can't
1309 fall back to an unsalted cred. */
1310
1311 centry = wcache_fetch(cache, domain, "CRED/%s",
1312 sid_to_fstring(tmp, sid));
1313 if (!centry) {
1314 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1315 sid_string_dbg(sid)));
1316 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1317 }
1318
1319 t = centry_time(centry);
1320
1321 /* In the salted case this isn't actually the nt_hash itself,
1322 but the MD5 of the salt + nt_hash. Let the caller
1323 sort this out. It can tell as we only return the cached_salt
1324 if we are returning a salted cred. */
1325
1326 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1327 if (*cached_nt_pass == NULL) {
1328 fstring sidstr;
1329
1330 sid_to_fstring(sidstr, sid);
1331
1332 /* Bad (old) cred cache. Delete and pretend we
1333 don't have it. */
1334 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1335 sidstr));
1336 wcache_delete("CRED/%s", sidstr);
1337 centry_free(centry);
1338 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1339 }
1340
1341 /* We only have 17 bytes more data in the salted cred case. */
1342 if (centry->len - centry->ofs == 17) {
1343 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1344 } else {
1345 *cached_salt = NULL;
1346 }
1347
1348 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1349 if (*cached_salt) {
1350 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1351 }
1352
1353 status = centry->status;
1354
1355 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1356 sid_string_dbg(sid), nt_errstr(status) ));
1357
1358 centry_free(centry);
1359 return status;
1360 }
1361
1362 /* Store creds for a SID - only writes out new salted ones. */
1363
1364 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1365 const struct dom_sid *sid,
1366 const uint8 nt_pass[NT_HASH_LEN])
1367 {
1368 struct cache_entry *centry;
1369 fstring sid_string;
1370 uint32 rid;
1371 uint8 cred_salt[NT_HASH_LEN];
1372 uint8 salted_hash[NT_HASH_LEN];
1373
1374 if (is_null_sid(sid)) {
1375 return NT_STATUS_INVALID_SID;
1376 }
1377
1378 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1379 return NT_STATUS_INVALID_SID;
1380 }
1381
1382 centry = centry_start(domain, NT_STATUS_OK);
1383 if (!centry) {
1384 return NT_STATUS_INTERNAL_DB_ERROR;
1385 }
1386
1387 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1388
1389 centry_put_time(centry, time(NULL));
1390
1391 /* Create a salt and then salt the hash. */
1392 generate_random_buffer(cred_salt, NT_HASH_LEN);
1393 E_md5hash(cred_salt, nt_pass, salted_hash);
1394
1395 centry_put_hash16(centry, salted_hash);
1396 centry_put_hash16(centry, cred_salt);
1397 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1398
1399 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1400
1401 centry_free(centry);
1402
1403 return NT_STATUS_OK;
1404 }
1405
1406
1407 /* Query display info. This is the basic user list fn */
1408 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1409 TALLOC_CTX *mem_ctx,
1410 uint32 *num_entries,
1411 struct wbint_userinfo **info)
1412 {
1413 struct winbind_cache *cache = get_cache(domain);
1414 struct cache_entry *centry = NULL;
1415 NTSTATUS status;
1416 unsigned int i, retry;
1417 bool old_status = domain->online;
1418
1419 if (!cache->tdb)
1420 goto do_query;
1421
1422 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1423 if (!centry)
1424 goto do_query;
1425
1426 do_fetch_cache:
1427 *num_entries = centry_uint32(centry);
1428
1429 if (*num_entries == 0)
1430 goto do_cached;
1431
1432 (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1433 if (! (*info)) {
1434 smb_panic_fn("query_user_list out of memory");
1435 }
1436 for (i=0; i<(*num_entries); i++) {
1437 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1438 (*info)[i].full_name = centry_string(centry, mem_ctx);
1439 (*info)[i].homedir = centry_string(centry, mem_ctx);
1440 (*info)[i].shell = centry_string(centry, mem_ctx);
1441 centry_sid(centry, &(*info)[i].user_sid);
1442 centry_sid(centry, &(*info)[i].group_sid);
1443 }
1444
1445 do_cached:
1446 status = centry->status;
1447
1448 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1449 domain->name, nt_errstr(status) ));
1450
1451 centry_free(centry);
1452 return status;
1453
1454 do_query:
1455 *num_entries = 0;
1456 *info = NULL;
1457
1458 /* Return status value returned by seq number check */
1459
1460 if (!NT_STATUS_IS_OK(domain->last_status))
1461 return domain->last_status;
1462
1463 /* Put the query_user_list() in a retry loop. There appears to be
1464 * some bug either with Windows 2000 or Samba's handling of large
1465 * rpc replies. This manifests itself as sudden disconnection
1466 * at a random point in the enumeration of a large (60k) user list.
1467 * The retry loop simply tries the operation again. )-: It's not
1468 * pretty but an acceptable workaround until we work out what the
1469 * real problem is. */
1470
1471 retry = 0;
1472 do {
1473
1474 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1475 domain->name ));
1476
1477 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1478 if (!NT_STATUS_IS_OK(status)) {
1479 DEBUG(3, ("query_user_list: returned 0x%08x, "
1480 "retrying\n", NT_STATUS_V(status)));
1481 }
1482 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1483 DEBUG(3, ("query_user_list: flushing "
1484 "connection cache\n"));
1485 invalidate_cm_connection(&domain->conn);
1486 }
1487 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1488 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1489 if (!domain->internal && old_status) {
1490 set_domain_offline(domain);
1491 }
1492 /* store partial response. */
1493 if (*num_entries > 0) {
1494 /*
1495 * humm, what about the status used for cache?
1496 * Should it be NT_STATUS_OK?
1497 */
1498 break;
1499 }
1500 /*
1501 * domain is offline now, and there is no user entries,
1502 * try to fetch from cache again.
1503 */
1504 if (cache->tdb && !domain->online && !domain->internal && old_status) {
1505 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1506 /* partial response... */
1507 if (!centry) {
1508 goto skip_save;
1509 } else {
1510 goto do_fetch_cache;
1511 }
1512 } else {
1513 goto skip_save;
1514 }
1515 }
1516
1517 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1518 (retry++ < 5));
1519
1520 /* and save it */
1521 refresh_sequence_number(domain, false);
1522 if (!NT_STATUS_IS_OK(status)) {
1523 return status;
1524 }
1525 centry = centry_start(domain, status);
1526 if (!centry)
1527 goto skip_save;
1528 centry_put_uint32(centry, *num_entries);
1529 for (i=0; i<(*num_entries); i++) {
1530 centry_put_string(centry, (*info)[i].acct_name);
1531 centry_put_string(centry, (*info)[i].full_name);
1532 centry_put_string(centry, (*info)[i].homedir);
1533 centry_put_string(centry, (*info)[i].shell);
1534 centry_put_sid(centry, &(*info)[i].user_sid);
1535 centry_put_sid(centry, &(*info)[i].group_sid);
1536 if (domain->backend && domain->backend->consistent) {
1537 /* when the backend is consistent we can pre-prime some mappings */
1538 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1539 domain->name,
1540 (*info)[i].acct_name,
1541 &(*info)[i].user_sid,
1542 SID_NAME_USER);
1543 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1544 &(*info)[i].user_sid,
1545 domain->name,
1546 (*info)[i].acct_name,
1547 SID_NAME_USER);
1548 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1549 }
1550 }
1551 centry_end(centry, "UL/%s", domain->name);
1552 centry_free(centry);
1553
1554 skip_save:
1555 return status;
1556 }
1557
1558 /* list all domain groups */
1559 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1560 TALLOC_CTX *mem_ctx,
1561 uint32 *num_entries,
1562 struct acct_info **info)
1563 {
1564 struct winbind_cache *cache = get_cache(domain);
1565 struct cache_entry *centry = NULL;
1566 NTSTATUS status;
1567 unsigned int i;
1568 bool old_status;
1569
1570 old_status = domain->online;
1571 if (!cache->tdb)
1572 goto do_query;
1573
1574 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1575 if (!centry)
1576 goto do_query;
1577
1578 do_fetch_cache:
1579 *num_entries = centry_uint32(centry);
1580
1581 if (*num_entries == 0)
1582 goto do_cached;
1583
1584 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1585 if (! (*info)) {
1586 smb_panic_fn("enum_dom_groups out of memory");
1587 }
1588 for (i=0; i<(*num_entries); i++) {
1589 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1590 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1591 (*info)[i].rid = centry_uint32(centry);
1592 }
1593
1594 do_cached:
1595 status = centry->status;
1596
1597 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1598 domain->name, nt_errstr(status) ));
1599
1600 centry_free(centry);
1601 return status;
1602
1603 do_query:
1604 *num_entries = 0;
1605 *info = NULL;
1606
1607 /* Return status value returned by seq number check */
1608
1609 if (!NT_STATUS_IS_OK(domain->last_status))
1610 return domain->last_status;
1611
1612 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1613 domain->name ));
1614
1615 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1616
1617 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1618 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1619 if (!domain->internal && old_status) {
1620 set_domain_offline(domain);
1621 }
1622 if (cache->tdb &&
1623 !domain->online &&
1624 !domain->internal &&
1625 old_status) {
1626 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1627 if (centry) {
1628 goto do_fetch_cache;
1629 }
1630 }
1631 }
1632 /* and save it */
1633 refresh_sequence_number(domain, false);
1634 if (!NT_STATUS_IS_OK(status)) {
1635 return status;
1636 }
1637 centry = centry_start(domain, status);
1638 if (!centry)
1639 goto skip_save;
1640 centry_put_uint32(centry, *num_entries);
1641 for (i=0; i<(*num_entries); i++) {
1642 centry_put_string(centry, (*info)[i].acct_name);
1643 centry_put_string(centry, (*info)[i].acct_desc);
1644 centry_put_uint32(centry, (*info)[i].rid);
1645 }
1646 centry_end(centry, "GL/%s/domain", domain->name);
1647 centry_free(centry);
1648
1649 skip_save:
1650 return status;
1651 }
1652
1653 /* list all domain groups */
1654 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1655 TALLOC_CTX *mem_ctx,
1656 uint32 *num_entries,
1657 struct acct_info **info)
1658 {
1659 struct winbind_cache *cache = get_cache(domain);
1660 struct cache_entry *centry = NULL;
1661 NTSTATUS status;
1662 unsigned int i;
1663 bool old_status;
1664
1665 old_status = domain->online;
1666 if (!cache->tdb)
1667 goto do_query;
1668
1669 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1670 if (!centry)
1671 goto do_query;
1672
1673 do_fetch_cache:
1674 *num_entries = centry_uint32(centry);
1675
1676 if (*num_entries == 0)
1677 goto do_cached;
1678
1679 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1680 if (! (*info)) {
1681 smb_panic_fn("enum_dom_groups out of memory");
1682 }
1683 for (i=0; i<(*num_entries); i++) {
1684 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1685 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1686 (*info)[i].rid = centry_uint32(centry);
1687 }
1688
1689 do_cached:
1690
1691 /* If we are returning cached data and the domain controller
1692 is down then we don't know whether the data is up to date
1693 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1694 indicate this. */
1695
1696 if (wcache_server_down(domain)) {
1697 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1698 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1699 } else
1700 status = centry->status;
1701
1702 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1703 domain->name, nt_errstr(status) ));
1704
1705 centry_free(centry);
1706 return status;
1707
1708 do_query:
1709 *num_entries = 0;
1710 *info = NULL;
1711
1712 /* Return status value returned by seq number check */
1713
1714 if (!NT_STATUS_IS_OK(domain->last_status))
1715 return domain->last_status;
1716
1717 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1718 domain->name ));
1719
1720 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1721
1722 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1723 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1724 if (!domain->internal && old_status) {
1725 set_domain_offline(domain);
1726 }
1727 if (cache->tdb &&
1728 !domain->internal &&
1729 !domain->online &&
1730 old_status) {
1731 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1732 if (centry) {
1733 goto do_fetch_cache;
1734 }
1735 }
1736 }
1737 /* and save it */
1738 refresh_sequence_number(domain, false);
1739 if (!NT_STATUS_IS_OK(status)) {
1740 return status;
1741 }
1742 centry = centry_start(domain, status);
1743 if (!centry)
1744 goto skip_save;
1745 centry_put_uint32(centry, *num_entries);
1746 for (i=0; i<(*num_entries); i++) {
1747 centry_put_string(centry, (*info)[i].acct_name);
1748 centry_put_string(centry, (*info)[i].acct_desc);
1749 centry_put_uint32(centry, (*info)[i].rid);
1750 }
1751 centry_end(centry, "GL/%s/local", domain->name);
1752 centry_free(centry);
1753
1754 skip_save:
1755 return status;
1756 }
1757
1758 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1759 const char *domain_name,
1760 const char *name,
1761 struct dom_sid *sid,
1762 enum lsa_SidType *type)
1763 {
1764 struct winbind_cache *cache = get_cache(domain);
1765 struct cache_entry *centry;
1766 NTSTATUS status;
1767 char *uname;
1768
1769 if (cache->tdb == NULL) {
1770 return NT_STATUS_NOT_FOUND;
1771 }
1772
1773 uname = talloc_strdup_upper(talloc_tos(), name);
1774 if (uname == NULL) {
1775 return NT_STATUS_NO_MEMORY;
1776 }
1777
1778 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1779 TALLOC_FREE(uname);
1780 if (centry == NULL) {
1781 return NT_STATUS_NOT_FOUND;
1782 }
1783
1784 status = centry->status;
1785 if (NT_STATUS_IS_OK(status)) {
1786 *type = (enum lsa_SidType)centry_uint32(centry);
1787 centry_sid(centry, sid);
1788 }
1789
1790 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1791 "%s\n", domain->name, nt_errstr(status) ));
1792
1793 centry_free(centry);
1794 return status;
1795 }
1796
1797 /* convert a single name to a sid in a domain */
1798 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1799 TALLOC_CTX *mem_ctx,
1800 const char *domain_name,
1801 const char *name,
1802 uint32_t flags,
1803 struct dom_sid *sid,
1804 enum lsa_SidType *type)
1805 {
1806 NTSTATUS status;
1807 bool old_status;
1808
1809 old_status = domain->online;
1810
1811 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1812 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1813 return status;
1814 }
1815
1816 ZERO_STRUCTP(sid);
1817
1818 /* If the seq number check indicated that there is a problem
1819 * with this DC, then return that status... except for
1820 * access_denied. This is special because the dc may be in
1821 * "restrict anonymous = 1" mode, in which case it will deny
1822 * most unauthenticated operations, but *will* allow the LSA
1823 * name-to-sid that we try as a fallback. */
1824
1825 if (!(NT_STATUS_IS_OK(domain->last_status)
1826 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1827 return domain->last_status;
1828
1829 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1830 domain->name ));
1831
1832 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1833 name, flags, sid, type);
1834
1835 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1836 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1837 if (!domain->internal && old_status) {
1838 set_domain_offline(domain);
1839 }
1840 if (!domain->internal &&
1841 !domain->online &&
1842 old_status) {
1843 NTSTATUS cache_status;
1844 cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1845 return cache_status;
1846 }
1847 }
1848 /* and save it */
1849 refresh_sequence_number(domain, false);
1850
1851 if (domain->online &&
1852 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1853 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1854
1855 /* Only save the reverse mapping if this was not a UPN */
1856 if (!strchr(name, '@')) {
1857 strupper_m(CONST_DISCARD(char *,domain_name));
1858 strlower_m(CONST_DISCARD(char *,name));
1859 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1860 }
1861 }
1862
1863 return status;
1864 }
1865
1866 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1867 const struct dom_sid *sid,
1868 TALLOC_CTX *mem_ctx,
1869 char **domain_name,
1870 char **name,
1871 enum lsa_SidType *type)
1872 {
1873 struct winbind_cache *cache = get_cache(domain);
1874 struct cache_entry *centry;
1875 char *sid_string;
1876 NTSTATUS status;
1877
1878 if (cache->tdb == NULL) {
1879 return NT_STATUS_NOT_FOUND;
1880 }
1881
1882 sid_string = sid_string_tos(sid);
1883 if (sid_string == NULL) {
1884 return NT_STATUS_NO_MEMORY;
1885 }
1886
1887 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1888 TALLOC_FREE(sid_string);
1889 if (centry == NULL) {
1890 return NT_STATUS_NOT_FOUND;
1891 }
1892
1893 if (NT_STATUS_IS_OK(centry->status)) {
1894 *type = (enum lsa_SidType)centry_uint32(centry);
1895 *domain_name = centry_string(centry, mem_ctx);
1896 *name = centry_string(centry, mem_ctx);
1897 }
1898
1899 status = centry->status;
1900 centry_free(centry);
1901
1902 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1903 "%s\n", domain->name, nt_errstr(status) ));
1904
1905 return status;
1906 }
1907
1908 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1909 given */
1910 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1911 TALLOC_CTX *mem_ctx,
1912 const struct dom_sid *sid,
1913 char **domain_name,
1914 char **name,
1915 enum lsa_SidType *type)
1916 {
1917 NTSTATUS status;
1918 bool old_status;
1919
1920 old_status = domain->online;
1921 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1922 type);
1923 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1924 return status;
1925 }
1926
1927 *name = NULL;
1928 *domain_name = NULL;
1929
1930 /* If the seq number check indicated that there is a problem
1931 * with this DC, then return that status... except for
1932 * access_denied. This is special because the dc may be in
1933 * "restrict anonymous = 1" mode, in which case it will deny
1934 * most unauthenticated operations, but *will* allow the LSA
1935 * sid-to-name that we try as a fallback. */
1936
1937 if (!(NT_STATUS_IS_OK(domain->last_status)
1938 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1939 return domain->last_status;
1940
1941 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1942 domain->name ));
1943
1944 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1945
1946 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1947 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1948 if (!domain->internal && old_status) {
1949 set_domain_offline(domain);
1950 }
1951 if (!domain->internal &&
1952 !domain->online &&
1953 old_status) {
1954 NTSTATUS cache_status;
1955 cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1956 domain_name, name, type);
1957 return cache_status;
1958 }
1959 }
1960 /* and save it */
1961 refresh_sequence_number(domain, false);
1962 if (!NT_STATUS_IS_OK(status)) {
1963 return status;
1964 }
1965 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1966
1967 /* We can't save the name to sid mapping here, as with sid history a
1968 * later name2sid would give the wrong sid. */
1969
1970 return status;
1971 }
1972
1973 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1974 TALLOC_CTX *mem_ctx,
1975 const struct dom_sid *domain_sid,
1976 uint32 *rids,
1977 size_t num_rids,
1978 char **domain_name,
1979 char ***names,
1980 enum lsa_SidType **types)
1981 {
1982 struct winbind_cache *cache = get_cache(domain);
1983 size_t i;
1984 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1985 bool have_mapped;
1986 bool have_unmapped;
1987 bool old_status;
1988
1989 old_status = domain->online;
1990 *domain_name = NULL;
1991 *names = NULL;
1992 *types = NULL;
1993
1994 if (!cache->tdb) {
1995 goto do_query;
1996 }
1997
1998 if (num_rids == 0) {
1999 return NT_STATUS_OK;
2000 }
2001
2002 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
2003 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
2004
2005 if ((*names == NULL) || (*types == NULL)) {
2006 result = NT_STATUS_NO_MEMORY;
2007 goto error;
2008 }
2009
2010 have_mapped = have_unmapped = false;
2011
2012 for (i=0; i<num_rids; i++) {
2013 struct dom_sid sid;
2014 struct cache_entry *centry;
2015 fstring tmp;
2016
2017 if (!sid_compose(&sid, domain_sid, rids[i])) {
2018 result = NT_STATUS_INTERNAL_ERROR;
2019 goto error;
2020 }
2021
2022 centry = wcache_fetch(cache, domain, "SN/%s",
2023 sid_to_fstring(tmp, &sid));
2024 if (!centry) {
2025 goto do_query;
2026 }
2027
2028 (*types)[i] = SID_NAME_UNKNOWN;
2029 (*names)[i] = talloc_strdup(*names, "");
2030
2031 if (NT_STATUS_IS_OK(centry->status)) {
2032 char *dom;
2033 have_mapped = true;
2034 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2035
2036 dom = centry_string(centry, mem_ctx);
2037 if (*domain_name == NULL) {
2038 *domain_name = dom;
2039 } else {
2040 talloc_free(dom);
2041 }
2042
2043 (*names)[i] = centry_string(centry, *names);
2044
2045 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2046 have_unmapped = true;
2047
2048 } else {
2049 /* something's definitely wrong */
2050 result = centry->status;
2051 goto error;
2052 }
2053
2054 centry_free(centry);
2055 }
2056
2057 if (!have_mapped) {
2058 return NT_STATUS_NONE_MAPPED;
2059 }
2060 if (!have_unmapped) {
2061 return NT_STATUS_OK;
2062 }
2063 return STATUS_SOME_UNMAPPED;
2064
2065 do_query:
2066
2067 TALLOC_FREE(*names);
2068 TALLOC_FREE(*types);
2069
2070 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2071 rids, num_rids, domain_name,
2072 names, types);
2073
2074 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2075 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2076 if (!domain->internal && old_status) {
2077 set_domain_offline(domain);
2078 }
2079 if (cache->tdb &&
2080 !domain->internal &&
2081 !domain->online &&
2082 old_status) {
2083 have_mapped = have_unmapped = false;
2084
2085 for (i=0; i<num_rids; i++) {
2086 struct dom_sid sid;
2087 struct cache_entry *centry;
2088 fstring tmp;
2089
2090 if (!sid_compose(&sid, domain_sid, rids[i])) {
2091 result = NT_STATUS_INTERNAL_ERROR;
2092 goto error;
2093 }
2094
2095 centry = wcache_fetch(cache, domain, "SN/%s",
2096 sid_to_fstring(tmp, &sid));
2097 if (!centry) {
2098 (*types)[i] = SID_NAME_UNKNOWN;
2099 (*names)[i] = talloc_strdup(*names, "");
2100 continue;
2101 }
2102
2103 (*types)[i] = SID_NAME_UNKNOWN;
2104 (*names)[i] = talloc_strdup(*names, "");
2105
2106 if (NT_STATUS_IS_OK(centry->status)) {
2107 char *dom;
2108 have_mapped = true;
2109 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2110
2111 dom = centry_string(centry, mem_ctx);
2112 if (*domain_name == NULL) {
2113 *domain_name = dom;
2114 } else {
2115 talloc_free(dom);
2116 }
2117
2118 (*names)[i] = centry_string(centry, *names);
2119
2120 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2121 have_unmapped = true;
2122
2123 } else {
2124 /* something's definitely wrong */
2125 result = centry->status;
2126 goto error;
2127 }
2128
2129 centry_free(centry);
2130 }
2131
2132 if (!have_mapped) {
2133 return NT_STATUS_NONE_MAPPED;
2134 }
2135 if (!have_unmapped) {
2136 return NT_STATUS_OK;
2137 }
2138 return STATUS_SOME_UNMAPPED;
2139 }
2140 }
2141 /*
2142 None of the queried rids has been found so save all negative entries
2143 */
2144 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2145 for (i = 0; i < num_rids; i++) {
2146 struct dom_sid sid;
2147 const char *name = "";
2148 const enum lsa_SidType type = SID_NAME_UNKNOWN;
2149 NTSTATUS status = NT_STATUS_NONE_MAPPED;
2150
2151 if (!sid_compose(&sid, domain_sid, rids[i])) {
2152 return NT_STATUS_INTERNAL_ERROR;
2153 }
2154
2155 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2156 name, type);
2157 }
2158
2159 return result;
2160 }
2161
2162 /*
2163 Some or all of the queried rids have been found.
2164 */
2165 if (!NT_STATUS_IS_OK(result) &&
2166 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2167 return result;
2168 }
2169
2170 refresh_sequence_number(domain, false);
2171
2172 for (i=0; i<num_rids; i++) {
2173 struct dom_sid sid;
2174 NTSTATUS status;
2175
2176 if (!sid_compose(&sid, domain_sid, rids[i])) {
2177 result = NT_STATUS_INTERNAL_ERROR;
2178 goto error;
2179 }
2180
2181 status = (*types)[i] == SID_NAME_UNKNOWN ?
2182 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2183
2184 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2185 (*names)[i], (*types)[i]);
2186 }
2187
2188 return result;
2189
2190 error:
2191 TALLOC_FREE(*names);
2192 TALLOC_FREE(*types);
2193 return result;
2194 }
2195
2196 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2197 TALLOC_CTX *mem_ctx,
2198 const struct dom_sid *user_sid,
2199 struct wbint_userinfo *info)
2200 {
2201 struct winbind_cache *cache = get_cache(domain);
2202 struct cache_entry *centry = NULL;
2203 NTSTATUS status;
2204 char *sid_string;
2205
2206 if (cache->tdb == NULL) {
2207 return NT_STATUS_NOT_FOUND;
2208 }
2209
2210 sid_string = sid_string_tos(user_sid);
2211 if (sid_string == NULL) {
2212 return NT_STATUS_NO_MEMORY;
2213 }
2214
2215 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2216 TALLOC_FREE(sid_string);
2217 if (centry == NULL) {
2218 return NT_STATUS_NOT_FOUND;
2219 }
2220
2221 /*
2222 * If we have an access denied cache entry and a cached info3
2223 * in the samlogon cache then do a query. This will force the
2224 * rpc back end to return the info3 data.
2225 */
2226
2227 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2228 netsamlogon_cache_have(user_sid)) {
2229 DEBUG(10, ("query_user: cached access denied and have cached "
2230 "info3\n"));
2231 domain->last_status = NT_STATUS_OK;
2232 centry_free(centry);
2233 return NT_STATUS_NOT_FOUND;
2234 }
2235
2236 /* if status is not ok then this is a negative hit
2237 and the rest of the data doesn't matter */
2238 status = centry->status;
2239 if (NT_STATUS_IS_OK(status)) {
2240 info->acct_name = centry_string(centry, mem_ctx);
2241 info->full_name = centry_string(centry, mem_ctx);
2242 info->homedir = centry_string(centry, mem_ctx);
2243 info->shell = centry_string(centry, mem_ctx);
2244 info->primary_gid = centry_uint32(centry);
2245 centry_sid(centry, &info->user_sid);
2246 centry_sid(centry, &info->group_sid);
2247 }
2248
2249 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2250 "%s\n", domain->name, nt_errstr(status) ));
2251
2252 centry_free(centry);
2253 return status;
2254 }
2255
2256 /* Lookup user information from a rid */
2257 static NTSTATUS query_user(struct winbindd_domain *domain,
2258 TALLOC_CTX *mem_ctx,
2259 const struct dom_sid *user_sid,
2260 struct wbint_userinfo *info)
2261 {
2262 NTSTATUS status;
2263 bool old_status;
2264
2265 old_status = domain->online;
2266 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2267 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2268 return status;
2269 }
2270
2271 ZERO_STRUCTP(info);
2272
2273 /* Return status value returned by seq number check */
2274
2275 if (!NT_STATUS_IS_OK(domain->last_status))
2276 return domain->last_status;
2277
2278 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2279 domain->name ));
2280
2281 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2282
2283 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2284 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2285 if (!domain->internal && old_status) {
2286 set_domain_offline(domain);
2287 }
2288 if (!domain->internal &&
2289 !domain->online &&
2290 old_status) {
2291 NTSTATUS cache_status;
2292 cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2293 return cache_status;
2294 }
2295 }
2296 /* and save it */
2297 refresh_sequence_number(domain, false);
2298 if (!NT_STATUS_IS_OK(status)) {
2299 return status;
2300 }
2301 wcache_save_user(domain, status, info);
2302
2303 return status;
2304 }
2305
2306 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2307 TALLOC_CTX *mem_ctx,
2308 const struct dom_sid *user_sid,
2309 uint32_t *pnum_sids,
2310 struct dom_sid **psids)
2311 {
2312 struct winbind_cache *cache = get_cache(domain);
2313 struct cache_entry *centry = NULL;
2314 NTSTATUS status;
2315 uint32_t i, num_sids;
2316 struct dom_sid *sids;
2317 fstring sid_string;
2318
2319 if (cache->tdb == NULL) {
2320 return NT_STATUS_NOT_FOUND;
2321 }
2322
2323 centry = wcache_fetch(cache, domain, "UG/%s",
2324 sid_to_fstring(sid_string, user_sid));
2325 if (centry == NULL) {
2326 return NT_STATUS_NOT_FOUND;
2327 }
2328
2329 /* If we have an access denied cache entry and a cached info3 in the
2330 samlogon cache then do a query. This will force the rpc back end
2331 to return the info3 data. */
2332
2333 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2334 && netsamlogon_cache_have(user_sid)) {
2335 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2336 "cached info3\n"));
2337 domain->last_status = NT_STATUS_OK;
2338 centry_free(centry);
2339 return NT_STATUS_NOT_FOUND;
2340 }
2341
2342 num_sids = centry_uint32(centry);
2343 sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2344 if (sids == NULL) {
2345 centry_free(centry);
2346 return NT_STATUS_NO_MEMORY;
2347 }
2348
2349 for (i=0; i<num_sids; i++) {
2350 centry_sid(centry, &sids[i]);
2351 }
2352
2353 status = centry->status;
2354
2355 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2356 "status: %s\n", domain->name, nt_errstr(status)));
2357
2358 centry_free(centry);
2359
2360 *pnum_sids = num_sids;
2361 *psids = sids;
2362 return status;
2363 }
2364
2365 /* Lookup groups a user is a member of. */
2366 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2367 TALLOC_CTX *mem_ctx,
2368 const struct dom_sid *user_sid,
2369 uint32 *num_groups, struct dom_sid **user_gids)
2370 {
2371 struct cache_entry *centry = NULL;
2372 NTSTATUS status;
2373 unsigned int i;
2374 fstring sid_string;
2375 bool old_status;
2376
2377 old_status = domain->online;
2378 status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2379 num_groups, user_gids);
2380 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2381 return status;
2382 }
2383
2384 (*num_groups) = 0;
2385 (*user_gids) = NULL;
2386
2387 /* Return status value returned by seq number check */
2388
2389 if (!NT_STATUS_IS_OK(domain->last_status))
2390 return domain->last_status;
2391
2392 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2393 domain->name ));
2394
2395 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2396
2397 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2398 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2399 if (!domain->internal && old_status) {
2400 set_domain_offline(domain);
2401 }
2402 if (!domain->internal &&
2403 !domain->online &&
2404 old_status) {
2405 NTSTATUS cache_status;
2406 cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2407 num_groups, user_gids);
2408 return cache_status;
2409 }
2410 }
2411 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2412 goto skip_save;
2413
2414 /* and save it */
2415 refresh_sequence_number(domain, false);
2416 if (!NT_STATUS_IS_OK(status)) {
2417 return status;
2418 }
2419 centry = centry_start(domain, status);
2420 if (!centry)
2421 goto skip_save;
2422
2423 centry_put_uint32(centry, *num_groups);
2424 for (i=0; i<(*num_groups); i++) {
2425 centry_put_sid(centry, &(*user_gids)[i]);
2426 }
2427
2428 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2429 centry_free(centry);
2430
2431 skip_save:
2432 return status;
2433 }
2434
2435 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2436 const struct dom_sid *sids)
2437 {
2438 uint32_t i;
2439 char *sidlist;
2440
2441 sidlist = talloc_strdup(mem_ctx, "");
2442 if (sidlist == NULL) {
2443 return NULL;
2444 }
2445 for (i=0; i<num_sids; i++) {
2446 fstring tmp;
2447 sidlist = talloc_asprintf_append_buffer(
2448 sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2449 if (sidlist == NULL) {
2450 return NULL;
2451 }
2452 }
2453 return sidlist;
2454 }
2455
2456 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2457 TALLOC_CTX *mem_ctx, uint32_t num_sids,
2458 const struct dom_sid *sids,
2459 uint32_t *pnum_aliases, uint32_t **paliases)
2460 {
2461 struct winbind_cache *cache = get_cache(domain);
2462 struct cache_entry *centry = NULL;
2463 uint32_t num_aliases;
2464 uint32_t *aliases;
2465 NTSTATUS status;
2466 char *sidlist;
2467 int i;
2468
2469 if (cache->tdb == NULL) {
2470 return NT_STATUS_NOT_FOUND;
2471 }
2472
2473 if (num_sids == 0) {
2474 *pnum_aliases = 0;
2475 *paliases = NULL;
2476 return NT_STATUS_OK;
2477 }
2478
2479 /* We need to cache indexed by the whole list of SIDs, the aliases
2480 * resulting might come from any of the SIDs. */
2481
2482 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2483 if (sidlist == NULL) {
2484 return NT_STATUS_NO_MEMORY;
2485 }
2486
2487 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2488 TALLOC_FREE(sidlist);
2489 if (centry == NULL) {
2490 return NT_STATUS_NOT_FOUND;
2491 }
2492
2493 num_aliases = centry_uint32(centry);
2494 aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2495 if (aliases == NULL) {
2496 centry_free(centry);
2497 return NT_STATUS_NO_MEMORY;
2498 }
2499
2500 for (i=0; i<num_aliases; i++) {
2501 aliases[i] = centry_uint32(centry);
2502 }
2503
2504 status = centry->status;
2505
2506 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2507 "status %s\n", domain->name, nt_errstr(status)));
2508
2509 centry_free(centry);
2510
2511 *pnum_aliases = num_aliases;
2512 *paliases = aliases;
2513
2514 return status;
2515 }
2516
2517 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2518 TALLOC_CTX *mem_ctx,
2519 uint32 num_sids, const struct dom_sid *sids,
2520 uint32 *num_aliases, uint32 **alias_rids)
2521 {
2522 struct cache_entry *centry = NULL;
2523 NTSTATUS status;
2524 char *sidlist;
2525 int i;
2526 bool old_status;
2527
2528 old_status = domain->online;
2529 status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2530 num_aliases, alias_rids);
2531 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2532 return status;
2533 }
2534
2535 (*num_aliases) = 0;
2536 (*alias_rids) = NULL;
2537
2538 if (!NT_STATUS_IS_OK(domain->last_status))
2539 return domain->last_status;
2540
2541 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2542 "for domain %s\n", domain->name ));
2543
2544 sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2545 if (sidlist == NULL) {
2546 return NT_STATUS_NO_MEMORY;
2547 }
2548
2549 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2550 num_sids, sids,
2551 num_aliases, alias_rids);
2552
2553 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2554 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2555 if (!domain->internal && old_status) {
2556 set_domain_offline(domain);
2557 }
2558 if (!domain->internal &&
2559 !domain->online &&
2560 old_status) {
2561 NTSTATUS cache_status;
2562 cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2563 sids, num_aliases, alias_rids);
2564 return cache_status;
2565 }
2566 }
2567 /* and save it */
2568 refresh_sequence_number(domain, false);
2569 if (!NT_STATUS_IS_OK(status)) {
2570 return status;
2571 }
2572 centry = centry_start(domain, status);
2573 if (!centry)
2574 goto skip_save;
2575 centry_put_uint32(centry, *num_aliases);
2576 for (i=0; i<(*num_aliases); i++)
2577 centry_put_uint32(centry, (*alias_rids)[i]);
2578 centry_end(centry, "UA%s", sidlist);
2579 centry_free(centry);
2580
2581 skip_save:
2582 return status;
2583 }
2584
2585 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2586 TALLOC_CTX *mem_ctx,
2587 const struct dom_sid *group_sid,
2588 uint32_t *num_names,
2589 struct dom_sid **sid_mem, char ***names,
2590 uint32_t **name_types)
2591 {
2592 struct winbind_cache *cache = get_cache(domain);
2593 struct cache_entry *centry = NULL;
2594 NTSTATUS status;
2595 unsigned int i;
2596 char *sid_string;
2597
2598 if (cache->tdb == NULL) {
2599 return NT_STATUS_NOT_FOUND;
2600 }
2601
2602 sid_string = sid_string_tos(group_sid);
2603 if (sid_string == NULL) {
2604 return NT_STATUS_NO_MEMORY;
2605 }
2606
2607 centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2608 TALLOC_FREE(sid_string);
2609 if (centry == NULL) {
2610 return NT_STATUS_NOT_FOUND;
2611 }
2612
2613 *sid_mem = NULL;
2614 *names = NULL;
2615 *name_types = NULL;
2616
2617 *num_names = centry_uint32(centry);
2618 if (*num_names == 0) {
2619 centry_free(centry);
2620 return NT_STATUS_OK;
2621 }
2622
2623 *sid_mem = talloc_array(mem_ctx, struct dom_sid, *num_names);
2624 *names = talloc_array(mem_ctx, char *, *num_names);
2625 *name_types = talloc_array(mem_ctx, uint32, *num_names);
2626
2627 if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2628 TALLOC_FREE(*sid_mem);
2629 TALLOC_FREE(*names);
2630 TALLOC_FREE(*name_types);
2631 centry_free(centry);
2632 return NT_STATUS_NO_MEMORY;
2633 }
2634
2635 for (i=0; i<(*num_names); i++) {
2636 centry_sid(centry, &(*sid_mem)[i]);
2637 (*names)[i] = centry_string(centry, mem_ctx);
2638 (*name_types)[i] = centry_uint32(centry);
2639 }
2640
2641 status = centry->status;
2642
2643 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2644 "status: %s\n", domain->name, nt_errstr(status)));
2645
2646 centry_free(centry);
2647 return status;
2648 }
2649
2650 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2651 TALLOC_CTX *mem_ctx,
2652 const struct dom_sid *group_sid,
2653 enum lsa_SidType type,
2654 uint32 *num_names,
2655 struct dom_sid **sid_mem, char ***names,
2656 uint32 **name_types)
2657 {
2658 struct cache_entry *centry = NULL;
2659 NTSTATUS status;
2660 unsigned int i;
2661 fstring sid_string;
2662 bool old_status;
2663
2664 old_status = domain->online;
2665 status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2666 sid_mem, names, name_types);
2667 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2668 return status;
2669 }
2670
2671 (*num_names) = 0;
2672 (*sid_mem) = NULL;
2673 (*names) = NULL;
2674 (*name_types) = NULL;
2675
2676 /* Return status value returned by seq number check */
2677
2678 if (!NT_STATUS_IS_OK(domain->last_status))
2679 return domain->last_status;
2680
2681 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2682 domain->name ));
2683
2684 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2685 type, num_names,
2686 sid_mem, names, name_types);
2687
2688 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2689 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2690 if (!domain->internal && old_status) {
2691 set_domain_offline(domain);
2692 }
2693 if (!domain->internal &&
2694 !domain->online &&
2695 old_status) {
2696 NTSTATUS cache_status;
2697 cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2698 num_names, sid_mem, names,
2699 name_types);
2700 return cache_status;
2701 }
2702 }
2703 /* and save it */
2704 refresh_sequence_number(domain, false);
2705 if (!NT_STATUS_IS_OK(status)) {
2706 return status;
2707 }
2708 centry = centry_start(domain, status);
2709 if (!centry)
2710 goto skip_save;
2711 centry_put_uint32(centry, *num_names);
2712 for (i=0; i<(*num_names); i++) {
2713 centry_put_sid(centry, &(*sid_mem)[i]);
2714 centry_put_string(centry, (*names)[i]);
2715 centry_put_uint32(centry, (*name_types)[i]);
2716 }
2717 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2718 centry_free(centry);
2719
2720 skip_save:
2721 return status;
2722 }
2723
2724 /* find the sequence number for a domain */
2725 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2726 {
2727 refresh_sequence_number(domain, false);
2728
2729 *seq = domain->sequence_number;
2730
2731 return NT_STATUS_OK;
2732 }
2733
2734 /* enumerate trusted domains
2735 * (we need to have the list of trustdoms in the cache when we go offline) -
2736 * Guenther */
2737 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2738 TALLOC_CTX *mem_ctx,
2739 struct netr_DomainTrustList *trusts)
2740 {
2741 NTSTATUS status;
2742 struct winbind_cache *cache;
2743 struct winbindd_tdc_domain *dom_list = NULL;
2744 size_t num_domains = 0;
2745 bool retval = false;
2746 int i;
2747 bool old_status;
2748
2749 old_status = domain->online;
2750 trusts->count = 0;
2751 trusts->array = NULL;
2752
2753 cache = get_cache(domain);
2754 if (!cache || !cache->tdb) {
2755 goto do_query;
2756 }
2757
2758 if (domain->online) {
2759 goto do_query;
2760 }
2761
2762 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2763 if (!retval || !num_domains || !dom_list) {
2764 TALLOC_FREE(dom_list);
2765 goto do_query;
2766 }
2767
2768 do_fetch_cache:
2769 trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
2770 if (!trusts->array) {
2771 TALLOC_FREE(dom_list);
2772 return NT_STATUS_NO_MEMORY;
2773 }
2774
2775 for (i = 0; i < num_domains; i++) {
2776 struct netr_DomainTrust *trust;
2777 struct dom_sid *sid;
2778 struct winbindd_domain *dom;
2779
2780 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2781 if (dom && dom->internal) {
2782 continue;
2783 }
2784
2785 trust = &trusts->array[trusts->count];
2786 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2787 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2788 sid = talloc(trusts->array, struct dom_sid);
2789 if (!trust->netbios_name || !trust->dns_name ||
2790 !sid) {
2791 TALLOC_FREE(dom_list);
2792 TALLOC_FREE(trusts->array);
2793 return NT_STATUS_NO_MEMORY;
2794 }
2795
2796 trust->trust_flags = dom_list[i].trust_flags;
2797 trust->trust_attributes = dom_list[i].trust_attribs;
2798 trust->trust_type = dom_list[i].trust_type;
2799 sid_copy(sid, &dom_list[i].sid);
2800 trust->sid = sid;
2801 trusts->count++;
2802 }
2803
2804 TALLOC_FREE(dom_list);
2805 return NT_STATUS_OK;
2806
2807 do_query:
2808 /* Return status value returned by seq number check */
2809
2810 if (!NT_STATUS_IS_OK(domain->last_status))
2811 return domain->last_status;
2812
2813 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2814 domain->name ));
2815
2816 status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2817
2818 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2819 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2820 if (!domain->internal && old_status) {
2821 set_domain_offline(domain);
2822 }
2823 if (!domain->internal &&
2824 !domain->online &&
2825 old_status) {
2826 retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2827 if (retval && num_domains && dom_list) {
2828 TALLOC_FREE(trusts->array);
2829 trusts->count = 0;
2830 goto do_fetch_cache;
2831 }
2832 }
2833 }
2834 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2835 * so that the generic centry handling still applies correctly -
2836 * Guenther*/
2837
2838 if (!NT_STATUS_IS_ERR(status)) {
2839 status = NT_STATUS_OK;
2840 }
2841 return status;
2842 }
2843
2844 /* get lockout policy */
2845 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2846 TALLOC_CTX *mem_ctx,
2847 struct samr_DomInfo12 *policy)
2848 {
2849 struct winbind_cache *cache = get_cache(domain);
2850 struct cache_entry *centry = NULL;
2851 NTSTATUS status;
2852 bool old_status;
2853
2854 old_status = domain->online;
2855 if (!cache->tdb)
2856 goto do_query;
2857
2858 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2859
2860 if (!centry)
2861 goto do_query;
2862
2863 do_fetch_cache:
2864 policy->lockout_duration = centry_nttime(centry);
2865 policy->lockout_window = centry_nttime(centry);
2866 policy->lockout_threshold = centry_uint16(centry);
2867
2868 status = centry->status;
2869
2870 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2871 domain->name, nt_errstr(status) ));
2872
2873 centry_free(centry);
2874 return status;
2875
2876 do_query:
2877 ZERO_STRUCTP(policy);
2878
2879 /* Return status value returned by seq number check */
2880
2881 if (!NT_STATUS_IS_OK(domain->last_status))
2882 return domain->last_status;
2883
2884 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2885 domain->name ));
2886
2887 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2888
2889 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2890 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2891 if (!domain->internal && old_status) {
2892 set_domain_offline(domain);
2893 }
2894 if (cache->tdb &&
2895 !domain->internal &&
2896 !domain->online &&
2897 old_status) {
2898 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2899 if (centry) {
2900 goto do_fetch_cache;
2901 }
2902 }
2903 }
2904 /* and save it */
2905 refresh_sequence_number(domain, false);
2906 if (!NT_STATUS_IS_OK(status)) {
2907 return status;
2908 }
2909 wcache_save_lockout_policy(domain, status, policy);
2910
2911 return status;
2912 }
2913
2914 /* get password policy */
2915 static NTSTATUS password_policy(struct winbindd_domain *domain,
2916 TALLOC_CTX *mem_ctx,
2917 struct samr_DomInfo1 *policy)
2918 {
2919 struct winbind_cache *cache = get_cache(domain);
2920 struct cache_entry *centry = NULL;
2921 NTSTATUS status;
2922 bool old_status;
2923
2924 old_status = domain->online;
2925 if (!cache->tdb)
2926 goto do_query;
2927
2928 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2929
2930 if (!centry)
2931 goto do_query;
2932
2933 do_fetch_cache:
2934 policy->min_password_length = centry_uint16(centry);
2935 policy->password_history_length = centry_uint16(centry);
2936 policy->password_properties = centry_uint32(centry);
2937 policy->max_password_age = centry_nttime(centry);
2938 policy->min_password_age = centry_nttime(centry);
2939
2940 status = centry->status;
2941
2942 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2943 domain->name, nt_errstr(status) ));
2944
2945 centry_free(centry);
2946 return status;
2947
2948 do_query:
2949 ZERO_STRUCTP(policy);
2950
2951 /* Return status value returned by seq number check */
2952
2953 if (!NT_STATUS_IS_OK(domain->last_status))
2954 return domain->last_status;
2955
2956 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2957 domain->name ));
2958
2959 status = domain->backend->password_policy(domain, mem_ctx, policy);
2960
2961 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2962 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2963 if (!domain->internal && old_status) {
2964 set_domain_offline(domain);
2965 }
2966 if (cache->tdb &&
2967 !domain->internal &&
2968 !domain->online &&
2969 old_status) {
2970 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2971 if (centry) {
2972 goto do_fetch_cache;
2973 }
2974 }
2975 }
2976 /* and save it */
2977 refresh_sequence_number(domain, false);
2978 if (!NT_STATUS_IS_OK(status)) {
2979 return status;
2980 }
2981 wcache_save_password_policy(domain, status, policy);
2982
2983 return status;
2984 }
2985
2986
2987 /* Invalidate cached user and group lists coherently */
2988
2989 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2990 void *state)
2991 {
2992 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2993 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2994 tdb_delete(the_tdb, kbuf);
2995
2996 return 0;
2997 }
2998
2999 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
3000
3001 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
3002 const struct dom_sid *sid)
3003 {
3004 fstring key_str, sid_string;
3005 struct winbind_cache *cache;
3006
3007 /* dont clear cached U/SID and UG/SID entries when we want to logon
3008 * offline - gd */
3009
3010 if (lp_winbind_offline_logon()) {
3011 return;
3012 }
3013
3014 if (!domain)
3015 return;
3016
3017 cache = get_cache(domain);
3018
3019 if (!cache->tdb) {
3020 return;
3021 }
3022
3023 /* Clear U/SID cache entry */
3024 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, sid));
3025 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3026 tdb_delete(cache->tdb, string_tdb_data(key_str));
3027
3028 /* Clear UG/SID cache entry */
3029 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, sid));
3030 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3031 tdb_delete(cache->tdb, string_tdb_data(key_str));
3032
3033 /* Samba/winbindd never needs this. */
3034 netsamlogon_clear_cached_user(sid);
3035 }
3036
3037 bool wcache_invalidate_cache(void)
3038 {
3039 struct winbindd_domain *domain;
3040
3041 for (domain = domain_list(); domain; domain = domain->next) {
3042 struct winbind_cache *cache = get_cache(domain);
3043
3044 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3045 "entries for %s\n", domain->name));
3046 if (cache) {
3047 if (cache->tdb) {
3048 tdb_traverse(cache->tdb, traverse_fn, NULL);
3049 } else {
3050 return false;
3051 }
3052 }
3053 }
3054 return true;
3055 }
3056
3057 bool wcache_invalidate_cache_noinit(void)
3058 {
3059 struct winbindd_domain *domain;
3060
3061 for (domain = domain_list(); domain; domain = domain->next) {
3062 struct winbind_cache *cache;
3063
3064 /* Skip uninitialized domains. */
3065 if (!domain->initialized && !domain->internal) {
3066 continue;
3067 }
3068
3069 cache = get_cache(domain);
3070
3071 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3072 "entries for %s\n", domain->name));
3073 if (cache) {
3074 if (cache->tdb) {
3075 tdb_traverse(cache->tdb, traverse_fn, NULL);
3076 /*
3077 * Flushing cache has nothing to with domains.
3078 * return here if we successfully flushed once.
3079 * To avoid unnecessary traversing the cache.
3080 */
3081 return true;
3082 } else {
3083 return false;
3084 }
3085 }
3086 }
3087 return true;
3088 }
3089
3090 bool init_wcache(void)
3091 {
3092 if (wcache == NULL) {
3093 wcache = SMB_XMALLOC_P(struct winbind_cache);
3094 ZERO_STRUCTP(wcache);
3095 }
3096
3097 if (wcache->tdb != NULL)
3098 return true;
3099
3100 /* when working offline we must not clear the cache on restart */
3101 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3102 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3103 TDB_INCOMPATIBLE_HASH |
3104 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3105 O_RDWR|O_CREAT, 0600);
3106
3107 if (wcache->tdb == NULL) {
3108 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3109 return false;
3110 }
3111
3112 return true;
3113 }
3114
3115 /************************************************************************
3116 This is called by the parent to initialize the cache file.
3117 We don't need sophisticated locking here as we know we're the
3118 only opener.
3119 ************************************************************************/
3120
3121 bool initialize_winbindd_cache(void)
3122 {
3123 bool cache_bad = true;
3124 uint32 vers;
3125
3126 if (!init_wcache()) {
3127 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3128 return false;
3129 }
3130
3131 /* Check version number. */
3132 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3133 vers == WINBINDD_CACHE_VERSION) {
3134 cache_bad = false;
3135 }
3136
3137 if (cache_bad) {
3138 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3139 "and re-creating with version number %d\n",
3140 WINBINDD_CACHE_VERSION ));
3141
3142 tdb_close(wcache->tdb);
3143 wcache->tdb = NULL;
3144
3145 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
3146 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3147 cache_path("winbindd_cache.tdb"),
3148 strerror(errno) ));
3149 return false;
3150 }
3151 if (!init_wcache()) {
3152 DEBUG(0,("initialize_winbindd_cache: re-initialization "
3153 "init_wcache failed.\n"));
3154 return false;
3155 }
3156
3157 /* Write the version. */
3158 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3159 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3160 tdb_errorstr(wcache->tdb) ));
3161 return false;
3162 }
3163 }
3164
3165 tdb_close(wcache->tdb);
3166 wcache->tdb = NULL;
3167 return true;
3168 }
3169
3170 void close_winbindd_cache(void)
3171 {
3172 if (!wcache) {
3173 return;
3174 }
3175 if (wcache->tdb) {
3176 tdb_close(wcache->tdb);
3177 wcache->tdb = NULL;
3178 }
3179 }
3180
3181 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
3182 char **domain_name, char **name,
3183 enum lsa_SidType *type)
3184 {
3185 struct winbindd_domain *domain;
3186 NTSTATUS status;
3187
3188 domain = find_lookup_domain_from_sid(sid);
3189 if (domain == NULL) {
3190 return false;
3191 }
3192 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3193 type);
3194 return NT_STATUS_IS_OK(status);
3195 }
3196
3197 bool lookup_cached_name(const char *domain_name,
3198 const char *name,
3199 struct dom_sid *sid,
3200 enum lsa_SidType *type)
3201 {
3202 struct winbindd_domain *domain;
3203 NTSTATUS status;
3204 bool original_online_state;
3205
3206 domain = find_lookup_domain_from_name(domain_name);
3207 if (domain == NULL) {
3208 return false;
3209 }
3210
3211 /* If we are doing a cached logon, temporarily set the domain
3212 offline so the cache won't expire the entry */
3213
3214 original_online_state = domain->online;
3215 domain->online = false;
3216 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3217 domain->online = original_online_state;
3218
3219 return NT_STATUS_IS_OK(status);
3220 }
3221
3222 void cache_name2sid(struct winbindd_domain *domain,
3223 const char *domain_name, const char *name,
3224 enum lsa_SidType type, const struct dom_sid *sid)
3225 {
3226 refresh_sequence_number(domain, false);
3227 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3228 sid, type);
3229 }
3230
3231 /*
3232 * The original idea that this cache only contains centries has
3233 * been blurred - now other stuff gets put in here. Ensure we
3234 * ignore these things on cleanup.
3235 */
3236
3237 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3238 TDB_DATA dbuf, void *state)
3239 {
3240 struct cache_entry *centry;
3241
3242 if (is_non_centry_key(kbuf)) {
3243 return 0;
3244 }
3245
3246 centry = wcache_fetch_raw((char *)kbuf.dptr);
3247 if (!centry) {
3248 return 0;
3249 }
3250
3251 if (!NT_STATUS_IS_OK(centry->status)) {
3252 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3253 tdb_delete(the_tdb, kbuf);
3254 }
3255
3256 centry_free(centry);
3257 return 0;
3258 }
3259
3260 /* flush the cache */
3261 void wcache_flush_cache(void)
3262 {
3263 if (!wcache)
3264 return;
3265 if (wcache->tdb) {
3266 tdb_close(wcache->tdb);
3267 wcache->tdb = NULL;
3268 }
3269 if (!winbindd_use_cache()) {
3270 return;
3271 }
3272
3273 /* when working offline we must not clear the cache on restart */
3274 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3275 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3276 TDB_INCOMPATIBLE_HASH |
3277 (lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST)),
3278 O_RDWR|O_CREAT, 0600);
3279
3280 if (!wcache->tdb) {
3281 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3282 return;
3283 }
3284
3285 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3286
3287 DEBUG(10,("wcache_flush_cache success\n"));
3288 }
3289
3290 /* Count cached creds */
3291
3292 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3293 void *state)
3294 {
3295 int *cred_count = (int*)state;
3296
3297 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3298 (*cred_count)++;
3299 }
3300 return 0;
3301 }
3302
3303 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3304 {
3305 struct winbind_cache *cache = get_cache(domain);
3306
3307 *count = 0;
3308
3309 if (!cache->tdb) {
3310 return NT_STATUS_INTERNAL_DB_ERROR;
3311 }
3312
3313 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3314
3315 return NT_STATUS_OK;
3316 }
3317
3318 struct cred_list {
3319 struct cred_list *prev, *next;
3320 TDB_DATA key;
3321 fstring name;
3322 time_t created;
3323 };
3324 static struct cred_list *wcache_cred_list;
3325
3326 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3327 void *state)
3328 {
3329 struct cred_list *cred;
3330
3331 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3332
3333 cred = SMB_MALLOC_P(struct cred_list);
3334 if (cred == NULL) {
3335 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3336 return -1;
3337 }
3338
3339 ZERO_STRUCTP(cred);
3340
3341 /* save a copy of the key */
3342
3343 fstrcpy(cred->name, (const char *)kbuf.dptr);
3344 DLIST_ADD(wcache_cred_list, cred);
3345 }
3346
3347 return 0;
3348 }
3349
3350 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const struct dom_sid *sid)
3351 {
3352 struct winbind_cache *cache = get_cache(domain);
3353 NTSTATUS status;
3354 int ret;
3355 struct cred_list *cred, *oldest = NULL;
3356
3357 if (!cache->tdb) {
3358 return NT_STATUS_INTERNAL_DB_ERROR;
3359 }
3360
3361 /* we possibly already have an entry */
3362 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3363
3364 fstring key_str, tmp;
3365
3366 DEBUG(11,("we already have an entry, deleting that\n"));
3367
3368 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3369
3370 tdb_delete(cache->tdb, string_tdb_data(key_str));
3371
3372 return NT_STATUS_OK;
3373 }
3374
3375 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3376 if (ret == 0) {
3377 return NT_STATUS_OK;
3378 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3379 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3380 }
3381
3382 ZERO_STRUCTP(oldest);
3383
3384 for (cred = wcache_cred_list; cred; cred = cred->next) {
3385
3386 TDB_DATA data;
3387 time_t t;
3388
3389 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3390 if (!data.dptr) {
3391 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3392 cred->name));
3393 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3394 goto done;
3395 }
3396
3397 t = IVAL(data.dptr, 0);
3398 SAFE_FREE(data.dptr);
3399
3400 if (!oldest) {
3401 oldest = SMB_MALLOC_P(struct cred_list);
3402 if (oldest == NULL) {
3403 status = NT_STATUS_NO_MEMORY;
3404 goto done;
3405 }
3406
3407 fstrcpy(oldest->name, cred->name);
3408 oldest->created = t;
3409 continue;
3410 }
3411
3412 if (t < oldest->created) {
3413 fstrcpy(oldest->name, cred->name);
3414 oldest->created = t;
3415 }
3416 }
3417
3418 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3419 status = NT_STATUS_OK;
3420 } else {
3421 status = NT_STATUS_UNSUCCESSFUL;
3422 }
3423 done:
3424 SAFE_FREE(wcache_cred_list);
3425 SAFE_FREE(oldest);
3426
3427 return status;
3428 }
3429
3430 /* Change the global online/offline state. */
3431 bool set_global_winbindd_state_offline(void)
3432 {
3433 TDB_DATA data;
3434
3435 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3436
3437 /* Only go offline if someone has created
3438 the key "WINBINDD_OFFLINE" in the cache tdb. */
3439
3440 if (wcache == NULL || wcache->tdb == NULL) {
3441 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3442 return false;
3443 }
3444
3445 if (!lp_winbind_offline_logon()) {
3446 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3447 return false;
3448 }
3449
3450 if (global_winbindd_offline_state) {
3451 /* Already offline. */
3452 return true;
3453 }
3454
3455 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3456
3457 if (!data.dptr || data.dsize != 4) {
3458 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3459 SAFE_FREE(data.dptr);
3460 return false;
3461 } else {
3462 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3463 global_winbindd_offline_state = true;
3464 SAFE_FREE(data.dptr);
3465 return true;
3466 }
3467 }
3468
3469 void set_global_winbindd_state_online(void)
3470 {
3471 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3472
3473 if (!lp_winbind_offline_logon()) {
3474 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3475 return;
3476 }
3477
3478 if (!global_winbindd_offline_state) {
3479 /* Already online. */
3480 return;
3481 }
3482 global_winbindd_offline_state = false;
3483
3484 if (!wcache->tdb) {
3485 return;
3486 }
3487
3488 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3489 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3490 }
3491
3492 bool get_global_winbindd_state_offline(void)
3493 {
3494 return global_winbindd_offline_state;
3495 }
3496
3497 /***********************************************************************
3498 Validate functions for all possible cache tdb keys.
3499 ***********************************************************************/
3500
3501 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3502 struct tdb_validation_status *state)
3503 {
3504 struct cache_entry *centry;
3505
3506 centry = SMB_XMALLOC_P(struct cache_entry);
3507 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3508 if (!centry->data) {
3509 SAFE_FREE(centry);
3510 return NULL;
3511 }
3512 centry->len = data.dsize;
3513 centry->ofs = 0;
3514
3515 if (centry->len < 16) {
3516 /* huh? corrupt cache? */
3517 DEBUG(0,("create_centry_validate: Corrupt cache for key %s "
3518 "(len < 16) ?\n", kstr));
3519 centry_free(centry);
3520 state->bad_entry = true;
3521 state->success = false;
3522 return NULL;
3523 }
3524
3525 centry->status = NT_STATUS(centry_uint32(centry));
3526 centry->sequence_number = centry_uint32(centry);
3527 centry->timeout = centry_uint64_t(centry);
3528 return centry;
3529 }
3530
3531 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3532 struct tdb_validation_status *state)
3533 {
3534 if (dbuf.dsize != 8) {
3535 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3536 keystr, (unsigned int)dbuf.dsize ));
3537 state->bad_entry = true;
3538 return 1;
3539 }
3540 return 0;
3541 }
3542
3543 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3544 struct tdb_validation_status *state)
3545 {
3546 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3547 if (!centry) {
3548 return 1;
3549 }
3550
3551 (void)centry_uint32(centry);
3552 if (NT_STATUS_IS_OK(centry->status)) {
3553 struct dom_sid sid;
3554 (void)centry_sid(centry, &sid);
3555 }
3556
3557 centry_free(centry);
3558
3559 if (!(state->success)) {
3560 return 1;
3561 }
3562 DEBUG(10,("validate_ns: %s ok\n", keystr));
3563 return 0;
3564 }
3565
3566 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3567 struct tdb_validation_status *state)
3568 {
3569 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3570 if (!centry) {
3571 return 1;
3572 }
3573
3574 if (NT_STATUS_IS_OK(centry->status)) {
3575 (void)centry_uint32(centry);
3576 (void)centry_string(centry, mem_ctx);
3577 (void)centry_string(centry, mem_ctx);
3578 }
3579
3580 centry_free(centry);
3581
3582 if (!(state->success)) {
3583 return 1;
3584 }
3585 DEBUG(10,("validate_sn: %s ok\n", keystr));
3586 return 0;
3587 }
3588
3589 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3590 struct tdb_validation_status *state)
3591 {
3592 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3593 struct dom_sid sid;
3594
3595 if (!centry) {
3596 return 1;
3597 }
3598
3599 (void)centry_string(centry, mem_ctx);
3600 (void)centry_string(centry, mem_ctx);
3601 (void)centry_string(centry, mem_ctx);
3602 (void)centry_string(centry, mem_ctx);
3603 (void)centry_uint32(centry);
3604 (void)centry_sid(centry, &sid);
3605 (void)centry_sid(centry, &sid);
3606
3607 centry_free(centry);
3608
3609 if (!(state->success)) {
3610 return 1;
3611 }
3612 DEBUG(10,("validate_u: %s ok\n", keystr));
3613 return 0;
3614 }
3615
3616 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3617 struct tdb_validation_status *state)
3618 {
3619 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3620
3621 if (!centry) {
3622 return 1;
3623 }
3624
3625 (void)centry_nttime(centry);
3626 (void)centry_nttime(centry);
3627 (void)centry_uint16(centry);
3628
3629 centry_free(centry);
3630
3631 if (!(state->success)) {
3632 return 1;
3633 }
3634 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3635 return 0;
3636 }
3637
3638 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3639 struct tdb_validation_status *state)
3640 {
3641 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3642
3643 if (!centry) {
3644 return 1;
3645 }
3646
3647 (void)centry_uint16(centry);
3648 (void)centry_uint16(centry);
3649 (void)centry_uint32(centry);
3650 (void)centry_nttime(centry);
3651 (void)centry_nttime(centry);
3652
3653 centry_free(centry);
3654
3655 if (!(state->success)) {
3656 return 1;
3657 }
3658 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3659 return 0;
3660 }
3661
3662 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3663 struct tdb_validation_status *state)
3664 {
3665 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3666
3667 if (!centry) {
3668 return 1;
3669 }
3670
3671 (void)centry_time(centry);
3672 (void)centry_hash16(centry, mem_ctx);
3673
3674 /* We only have 17 bytes more data in the salted cred case. */
3675 if (centry->len - centry->ofs == 17) {
3676 (void)centry_hash16(centry, mem_ctx);
3677 }
3678
3679 centry_free(centry);
3680
3681 if (!(state->success)) {
3682 return 1;
3683 }
3684 DEBUG(10,("validate_cred: %s ok\n", keystr));
3685 return 0;
3686 }
3687
3688 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3689 struct tdb_validation_status *state)
3690 {
3691 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3692 int32 num_entries, i;
3693
3694 if (!centry) {
3695 return 1;
3696 }
3697
3698 num_entries = (int32)centry_uint32(centry);
3699
3700 for (i=0; i< num_entries; i++) {
3701 struct dom_sid sid;
3702 (void)centry_string(centry, mem_ctx);
3703 (void)centry_string(centry, mem_ctx);
3704 (void)centry_string(centry, mem_ctx);
3705 (void)centry_string(centry, mem_ctx);
3706 (void)centry_sid(centry, &sid);
3707 (void)centry_sid(centry, &sid);
3708 }
3709
3710 centry_free(centry);
3711
3712 if (!(state->success)) {
3713 return 1;
3714 }
3715 DEBUG(10,("validate_ul: %s ok\n", keystr));
3716 return 0;
3717 }
3718
3719 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3720 struct tdb_validation_status *state)
3721 {
3722 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3723 int32 num_entries, i;
3724
3725 if (!centry) {
3726 return 1;
3727 }
3728
3729 num_entries = centry_uint32(centry);
3730
3731 for (i=0; i< num_entries; i++) {
3732 (void)centry_string(centry, mem_ctx);
3733 (void)centry_string(centry, mem_ctx);
3734 (void)centry_uint32(centry);
3735 }
3736
3737 centry_free(centry);
3738
3739 if (!(state->success)) {
3740 return 1;
3741 }
3742 DEBUG(10,("validate_gl: %s ok\n", keystr));
3743 return 0;
3744 }
3745
3746 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3747 struct tdb_validation_status *state)
3748 {
3749 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3750 int32 num_groups, i;
3751
3752 if (!centry) {
3753 return 1;
3754 }
3755
3756 num_groups = centry_uint32(centry);
3757
3758 for (i=0; i< num_groups; i++) {
3759 struct dom_sid sid;
3760 centry_sid(centry, &sid);
3761 }
3762
3763 centry_free(centry);
3764
3765 if (!(state->success)) {
3766 return 1;
3767 }
3768 DEBUG(10,("validate_ug: %s ok\n", keystr));
3769 return 0;
3770 }
3771
3772 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3773 struct tdb_validation_status *state)
3774 {
3775 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3776 int32 num_aliases, i;
3777
3778 if (!centry) {
3779 return 1;
3780 }
3781
3782 num_aliases = centry_uint32(centry);
3783
3784 for (i=0; i < num_aliases; i++) {
3785 (void)centry_uint32(centry);
3786 }
3787
3788 centry_free(centry);
3789
3790 if (!(state->success)) {
3791 return 1;
3792 }
3793 DEBUG(10,("validate_ua: %s ok\n", keystr));
3794 return 0;
3795 }
3796
3797 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3798 struct tdb_validation_status *state)
3799 {
3800 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3801 int32 num_names, i;
3802
3803 if (!centry) {
3804 return 1;
3805 }
3806
3807 num_names = centry_uint32(centry);
3808
3809 for (i=0; i< num_names; i++) {
3810 struct dom_sid sid;
3811 centry_sid(centry, &sid);
3812 (void)centry_string(centry, mem_ctx);
3813 (void)centry_uint32(centry);
3814 }
3815
3816 centry_free(centry);
3817
3818 if (!(state->success)) {
3819 return 1;
3820 }
3821 DEBUG(10,("validate_gm: %s ok\n", keystr));
3822 return 0;
3823 }
3824
3825 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3826 struct tdb_validation_status *state)
3827 {
3828 /* Can't say anything about this other than must be nonzero. */
3829 if (dbuf.dsize == 0) {
3830 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3831 keystr));
3832 state->bad_entry = true;
3833 state->success = false;
3834 return 1;
3835 }
3836
3837 DEBUG(10,("validate_dr: %s ok\n", keystr));
3838 return 0;
3839 }
3840
3841 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3842 struct tdb_validation_status *state)
3843 {
3844 /* Can't say anything about this other than must be nonzero. */
3845 if (dbuf.dsize == 0) {
3846 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3847 keystr));
3848 state->bad_entry = true;
3849 state->success = false;
3850 return 1;
3851 }
3852
3853 DEBUG(10,("validate_de: %s ok\n", keystr));
3854 return 0;
3855 }
3856
3857 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3858 TDB_DATA dbuf, struct tdb_validation_status *state)
3859 {
3860 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3861
3862 if (!centry) {
3863 return 1;
3864 }
3865
3866 (void)centry_string(centry, mem_ctx);
3867 (void)centry_string(centry, mem_ctx);
3868 (void)centry_string(centry, mem_ctx);
3869 (void)centry_uint32(centry);
3870
3871 centry_free(centry);
3872
3873 if (!(state->success)) {
3874 return 1;
3875 }
3876 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3877 return 0;
3878 }
3879
3880 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3881 TDB_DATA dbuf,
3882 struct tdb_validation_status *state)
3883 {
3884 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3885
3886 if (!centry) {
3887 return 1;
3888 }
3889
3890 (void)centry_string( centry, mem_ctx );
3891
3892 centry_free(centry);
3893
3894 if (!(state->success)) {
3895 return 1;
3896 }
3897 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3898 return 0;
3899 }
3900
3901 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3902 TDB_DATA dbuf,
3903 struct tdb_validation_status *state)
3904 {
3905 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3906
3907 if (!centry) {
3908 return 1;
3909 }
3910
3911 (void)centry_string( centry, mem_ctx );
3912
3913 centry_free(centry);
3914
3915 if (!(state->success)) {
3916 return 1;
3917 }
3918 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3919 return 0;
3920 }
3921
3922 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3923 TDB_DATA dbuf,
3924 struct tdb_validation_status *state)
3925 {
3926 if (dbuf.dsize == 0) {
3927 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3928 "key %s (len ==0) ?\n", keystr));
3929 state->bad_entry = true;
3930 state->success = false;
3931 return 1;
3932 }
3933
3934 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3935 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3936 return 0;
3937 }
3938
3939 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3940 struct tdb_validation_status *state)
3941 {
3942 if (dbuf.dsize != 4) {
3943 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3944 keystr, (unsigned int)dbuf.dsize ));
3945 state->bad_entry = true;
3946 state->success = false;
3947 return 1;
3948 }
3949 DEBUG(10,("validate_offline: %s ok\n", keystr));
3950 return 0;
3951 }
3952
3953 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3954 struct tdb_validation_status *state)
3955 {
3956 /*
3957 * Ignore validation for now. The proper way to do this is with a
3958 * checksum. Just pure parsing does not really catch much.
3959 */
3960 return 0;
3961 }
3962
3963 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3964 struct tdb_validation_status *state)
3965 {
3966 if (dbuf.dsize != 4) {
3967 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3968 "key %s (len %u != 4) ?\n",
3969 keystr, (unsigned int)dbuf.dsize));
3970 state->bad_entry = true;
3971 state->success = false;
3972 return 1;
3973 }
3974
3975 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3976 return 0;
3977 }
3978
3979 /***********************************************************************
3980 A list of all possible cache tdb keys with associated validation
3981 functions.
3982 ***********************************************************************/
3983
3984 struct key_val_struct {
3985 const char *keyname;
3986 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3987 } key_val[] = {
3988 {"SEQNUM/", validate_seqnum},
3989 {"NS/", validate_ns},
3990 {"SN/", validate_sn},
3991 {"U/", validate_u},
3992 {"LOC_POL/", validate_loc_pol},
3993 {"PWD_POL/", validate_pwd_pol},
3994 {"CRED/", validate_cred},
3995 {"UL/", validate_ul},
3996 {"GL/", validate_gl},
3997 {"UG/", validate_ug},
3998 {"UA", validate_ua},
3999 {"GM/", validate_gm},
4000 {"DR/", validate_dr},
4001 {"DE/", validate_de},
4002 {"NSS/PWINFO/", validate_pwinfo},
4003 {"TRUSTDOMCACHE/", validate_trustdomcache},
4004 {"NSS/NA/", validate_nss_na},
4005 {"NSS/AN/", validate_nss_an},
4006 {"WINBINDD_OFFLINE", validate_offline},
4007 {"NDR/", validate_ndr},
4008 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
4009 {NULL, NULL}
4010 };
4011
4012 /***********************************************************************
4013 Function to look at every entry in the tdb and validate it as far as
4014 possible.
4015 ***********************************************************************/
4016
4017 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
4018 {
4019 int i;
4020 unsigned int max_key_len = 1024;
4021 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
4022
4023 /* Paranoia check. */
4024 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
4025 max_key_len = 1024 * 1024;
4026 }
4027 if (kbuf.dsize > max_key_len) {
4028 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
4029 "(%u) > (%u)\n\n",
4030 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
4031 return 1;
4032 }
4033
4034 for (i = 0; key_val[i].keyname; i++) {
4035 size_t namelen = strlen(key_val[i].keyname);
4036 if (kbuf.dsize >= namelen && (
4037 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
4038 TALLOC_CTX *mem_ctx;
4039 char *keystr;
4040 int ret;
4041
4042 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
4043 if (!keystr) {
4044 return 1;
4045 }
4046 memcpy(keystr, kbuf.dptr, kbuf.dsize);
4047 keystr[kbuf.dsize] = '\0';
4048
4049 mem_ctx = talloc_init("validate_ctx");
4050 if (!mem_ctx) {
4051 SAFE_FREE(keystr);
4052 return 1;
4053 }
4054
4055 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
4056 v_state);
4057
4058 SAFE_FREE(keystr);
4059 talloc_destroy(mem_ctx);
4060 return ret;
4061 }
4062 }
4063
4064 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
4065 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
4066 DEBUG(0,("data :\n"));
4067 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4068 v_state->unknown_key = true;
4069 v_state->success = false;
4070 return 1; /* terminate. */
4071 }
4072
4073 static void validate_panic(const char *const why)
4074 {
4075 DEBUG(0,("validating cache: would panic %s\n", why ));
4076 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4077 exit(47);
4078 }
4079
4080 /***********************************************************************
4081 Try and validate every entry in the winbindd cache. If we fail here,
4082 delete the cache tdb and return non-zero.
4083 ***********************************************************************/
4084
4085 int winbindd_validate_cache(void)
4086 {
4087 int ret = -1;
4088 const char *tdb_path = cache_path("winbindd_cache.tdb");
4089 TDB_CONTEXT *tdb = NULL;
4090
4091 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4092 smb_panic_fn = validate_panic;
4093
4094
4095 tdb = tdb_open_log(tdb_path,
4096 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4097 TDB_INCOMPATIBLE_HASH |
4098 ( lp_winbind_offline_logon()
4099 ? TDB_DEFAULT
4100 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4101 O_RDWR|O_CREAT,
4102 0600);
4103 if (!tdb) {
4104 DEBUG(0, ("winbindd_validate_cache: "
4105 "error opening/initializing tdb\n"));
4106 goto done;
4107 }
4108 tdb_close(tdb);
4109
4110 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4111
4112 if (ret != 0) {
4113 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4114 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4115 unlink(tdb_path);
4116 }
4117
4118 done:
4119 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4120 smb_panic_fn = smb_panic;
4121 return ret;
4122 }
4123
4124 /***********************************************************************
4125 Try and validate every entry in the winbindd cache.
4126 ***********************************************************************/
4127
4128 int winbindd_validate_cache_nobackup(void)
4129 {
4130 int ret = -1;
4131 const char *tdb_path = cache_path("winbindd_cache.tdb");
4132
4133 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4134 smb_panic_fn = validate_panic;
4135
4136
4137 if (wcache == NULL || wcache->tdb == NULL) {
4138 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4139 } else {
4140 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4141 }
4142
4143 if (ret != 0) {
4144 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4145 "successful.\n"));
4146 }
4147
4148 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4149 "function\n"));
4150 smb_panic_fn = smb_panic;
4151 return ret;
4152 }
4153
4154 bool winbindd_cache_validate_and_initialize(void)
4155 {
4156 close_winbindd_cache();
4157
4158 if (lp_winbind_offline_logon()) {
4159 if (winbindd_validate_cache() < 0) {
4160 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4161 "could be restored.\n"));
4162 }
4163 }
4164
4165 return initialize_winbindd_cache();
4166 }
4167
4168 /*********************************************************************
4169 ********************************************************************/
4170
4171 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4172 struct winbindd_tdc_domain **domains,
4173 size_t *num_domains )
4174 {
4175 struct winbindd_tdc_domain *list = NULL;
4176 size_t idx;
4177 int i;
4178 bool set_only = false;
4179
4180 /* don't allow duplicates */
4181
4182 idx = *num_domains;
4183 list = *domains;
4184
4185 for ( i=0; i< (*num_domains); i++ ) {
4186 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4187 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4188 new_dom->name));
4189 idx = i;
4190 set_only = true;
4191
4192 break;
4193 }
4194 }
4195
4196 if ( !set_only ) {
4197 if ( !*domains ) {
4198 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
4199 idx = 0;
4200 } else {
4201 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
4202 struct winbindd_tdc_domain,
4203 (*num_domains)+1);
4204 idx = *num_domains;
4205 }
4206
4207 ZERO_STRUCT( list[idx] );
4208 }
4209
4210 if ( !list )
4211 return false;
4212
4213 list[idx].domain_name = talloc_strdup( list, new_dom->name );
4214 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4215
4216 if ( !is_null_sid( &new_dom->sid ) ) {
4217 sid_copy( &list[idx].sid, &new_dom->sid );
4218 } else {
4219 sid_copy(&list[idx].sid, &global_sid_NULL);
4220 }
4221
4222 if ( new_dom->domain_flags != 0x0 )
4223 list[idx].trust_flags = new_dom->domain_flags;
4224
4225 if ( new_dom->domain_type != 0x0 )
4226 list[idx].trust_type = new_dom->domain_type;
4227
4228 if ( new_dom->domain_trust_attribs != 0x0 )
4229 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4230
4231 if ( !set_only ) {
4232 *domains = list;
4233 *num_domains = idx + 1;
4234 }
4235
4236 return true;
4237 }
4238
4239 /*********************************************************************
4240 ********************************************************************/
4241
4242 static TDB_DATA make_tdc_key( const char *domain_name )
4243 {
4244 char *keystr = NULL;
4245 TDB_DATA key = { NULL, 0 };
4246
4247 if ( !domain_name ) {
4248 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4249 return key;
4250 }
4251
4252 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4253 return key;
4254 }
4255 key = string_term_tdb_data(keystr);
4256
4257 return key;
4258 }
4259
4260 /*********************************************************************
4261 ********************************************************************/
4262
4263 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4264 size_t num_domains,
4265 unsigned char **buf )
4266 {
4267 unsigned char *buffer = NULL;
4268 int len = 0;
4269 int buflen = 0;
4270 int i = 0;
4271
4272 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4273 (int)num_domains));
4274
4275 buflen = 0;
4276
4277 again:
4278 len = 0;
4279
4280 /* Store the number of array items first */
4281 len += tdb_pack( buffer+len, buflen-len, "d",
4282 num_domains );
4283
4284 /* now pack each domain trust record */
4285 for ( i=0; i<num_domains; i++ ) {
4286
4287 fstring tmp;
4288
4289 if ( buflen > 0 ) {
4290 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4291 domains[i].domain_name,
4292 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4293 }
4294
4295 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4296 domains[i].domain_name,
4297 domains[i].dns_name,
4298 sid_to_fstring(tmp, &domains[i].sid),
4299 domains[i].trust_flags,
4300 domains[i].trust_attribs,
4301 domains[i].trust_type );
4302 }
4303
4304 if ( buflen < len ) {
4305 SAFE_FREE(buffer);
4306 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4307 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4308 buflen = -1;
4309 goto done;
4310 }
4311 buflen = len;
4312 goto again;
4313 }
4314
4315 *buf = buffer;
4316
4317 done:
4318 return buflen;
4319 }
4320
4321 /*********************************************************************
4322 ********************************************************************/
4323
4324 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4325 struct winbindd_tdc_domain **domains )
4326 {
4327 fstring domain_name, dns_name, sid_string;
4328 uint32 type, attribs, flags;
4329 int num_domains;
4330 int len = 0;
4331 int i;
4332 struct winbindd_tdc_domain *list = NULL;
4333
4334 /* get the number of domains */
4335 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4336 if ( len == -1 ) {
4337 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4338 return 0;
4339 }
4340
4341 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4342 if ( !list ) {
4343 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4344 return 0;
4345 }
4346
4347 for ( i=0; i<num_domains; i++ ) {
4348 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4349 domain_name,
4350 dns_name,
4351 sid_string,
4352 &flags,
4353 &attribs,
4354 &type );
4355
4356 if ( len == -1 ) {
4357 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4358 TALLOC_FREE( list );
4359 return 0;
4360 }
4361
4362 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4363 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4364 domain_name, dns_name, sid_string,
4365 flags, attribs, type));
4366
4367 list[i].domain_name = talloc_strdup( list, domain_name );
4368 list[i].dns_name = talloc_strdup( list, dns_name );
4369 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4370 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4371 domain_name));
4372 }
4373 list[i].trust_flags = flags;
4374 list[i].trust_attribs = attribs;
4375 list[i].trust_type = type;
4376 }
4377
4378 *domains = list;
4379
4380 return num_domains;
4381 }
4382
4383 /*********************************************************************
4384 ********************************************************************/
4385
4386 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4387 {
4388 TDB_DATA key = make_tdc_key( lp_workgroup() );
4389 TDB_DATA data = { NULL, 0 };
4390 int ret;
4391
4392 if ( !key.dptr )
4393 return false;
4394
4395 /* See if we were asked to delete the cache entry */
4396
4397 if ( !domains ) {
4398 ret = tdb_delete( wcache->tdb, key );
4399 goto done;
4400 }
4401
4402 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4403
4404 if ( !data.dptr ) {
4405 ret = -1;
4406 goto done;
4407 }
4408
4409 ret = tdb_store( wcache->tdb, key, data, 0 );
4410
4411 done:
4412 SAFE_FREE( data.dptr );
4413 SAFE_FREE( key.dptr );
4414
4415 return ( ret != -1 );
4416 }
4417
4418 /*********************************************************************
4419 ********************************************************************/
4420
4421 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4422 {
4423 TDB_DATA key = make_tdc_key( lp_workgroup() );
4424 TDB_DATA data = { NULL, 0 };
4425
4426 *domains = NULL;
4427 *num_domains = 0;
4428
4429 if ( !key.dptr )
4430 return false;
4431
4432 data = tdb_fetch( wcache->tdb, key );
4433
4434 SAFE_FREE( key.dptr );
4435
4436 if ( !data.dptr )
4437 return false;
4438
4439 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4440
4441 SAFE_FREE( data.dptr );
4442
4443 if ( !*domains )
4444 return false;
4445
4446 return true;
4447 }
4448
4449 /*********************************************************************
4450 ********************************************************************/
4451
4452 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4453 {
4454 struct winbindd_tdc_domain *dom_list = NULL;
4455 size_t num_domains = 0;
4456 bool ret = false;
4457
4458 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4459 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4460 domain->name, domain->alt_name,
4461 sid_string_dbg(&domain->sid),
4462 domain->domain_flags,
4463 domain->domain_trust_attribs,
4464 domain->domain_type));
4465
4466 if ( !init_wcache() ) {
4467 return false;
4468 }
4469
4470 /* fetch the list */
4471
4472 wcache_tdc_fetch_list( &dom_list, &num_domains );
4473
4474 /* add the new domain */
4475
4476 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4477 goto done;
4478 }
4479
4480 /* pack the domain */
4481
4482 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4483 goto done;
4484 }
4485
4486 /* Success */
4487
4488 ret = true;
4489 done:
4490 TALLOC_FREE( dom_list );
4491
4492 return ret;
4493 }
4494
4495 /*********************************************************************
4496 ********************************************************************/
4497
4498 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4499 {
4500 struct winbindd_tdc_domain *dom_list = NULL;
4501 size_t num_domains = 0;
4502 int i;
4503 struct winbindd_tdc_domain *d = NULL;
4504
4505 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4506
4507 if ( !init_wcache() ) {
4508 return false;
4509 }
4510
4511 /* fetch the list */
4512
4513 wcache_tdc_fetch_list( &dom_list, &num_domains );
4514
4515 for ( i=0; i<num_domains; i++ ) {
4516 if ( strequal(name, dom_list[i].domain_name) ||
4517 strequal(name, dom_list[i].dns_name) )
4518 {
4519 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4520 name));
4521
4522 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4523 if ( !d )
4524 break;
4525
4526 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4527 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4528 sid_copy( &d->sid, &dom_list[i].sid );
4529 d->trust_flags = dom_list[i].trust_flags;
4530 d->trust_type = dom_list[i].trust_type;
4531 d->trust_attribs = dom_list[i].trust_attribs;
4532
4533 break;
4534 }
4535 }
4536
4537 TALLOC_FREE( dom_list );
4538
4539 return d;
4540 }
4541
4542 /*********************************************************************
4543 ********************************************************************/
4544
4545 struct winbindd_tdc_domain*
4546 wcache_tdc_fetch_domainbysid(TALLOC_CTX *ctx,
4547 const struct dom_sid *sid)
4548 {
4549 struct winbindd_tdc_domain *dom_list = NULL;
4550 size_t num_domains = 0;
4551 int i;
4552 struct winbindd_tdc_domain *d = NULL;
4553
4554 DEBUG(10,("wcache_tdc_fetch_domainbysid: Searching for domain %s\n",
4555 sid_string_dbg(sid)));
4556
4557 if (!init_wcache()) {
4558 return false;
4559 }
4560
4561 /* fetch the list */
4562
4563 wcache_tdc_fetch_list(&dom_list, &num_domains);
4564
4565 for (i = 0; i<num_domains; i++) {
4566 if (sid_equal(sid, &(dom_list[i].sid))) {
4567 DEBUG(10, ("wcache_tdc_fetch_domainbysid: "
4568 "Found domain %s for SID %s\n",
4569 dom_list[i].domain_name,
4570 sid_string_dbg(sid)));
4571
4572 d = TALLOC_P(ctx, struct winbindd_tdc_domain);
4573 if (!d)
4574 break;
4575
4576 d->domain_name = talloc_strdup(d,
4577 dom_list[i].domain_name);
4578
4579 d->dns_name = talloc_strdup(d, dom_list[i].dns_name);
4580 sid_copy(&d->sid, &dom_list[i].sid);
4581 d->trust_flags = dom_list[i].trust_flags;
4582 d->trust_type = dom_list[i].trust_type;
4583 d->trust_attribs = dom_list[i].trust_attribs;
4584
4585 break;
4586 }
4587 }
4588
4589 TALLOC_FREE(dom_list);
4590
4591 return d;
4592 }
4593
4594
4595 /*********************************************************************
4596 ********************************************************************/
4597
4598 void wcache_tdc_clear( void )
4599 {
4600 if ( !init_wcache() )
4601 return;
4602
4603 wcache_tdc_store_list( NULL, 0 );
4604
4605 return;
4606 }
4607
4608
4609 /*********************************************************************
4610 ********************************************************************/
4611
4612 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4613 NTSTATUS status,
4614 const struct dom_sid *user_sid,
4615 const char *homedir,
4616 const char *shell,
4617 const char *gecos,
4618 uint32 gid)
4619 {
4620 struct cache_entry *centry;
4621 fstring tmp;
4622
4623 if ( (centry = centry_start(domain, status)) == NULL )
4624 return;
4625
4626 centry_put_string( centry, homedir );
4627 centry_put_string( centry, shell );
4628 centry_put_string( centry, gecos );
4629 centry_put_uint32( centry, gid );
4630
4631 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4632
4633 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4634
4635 centry_free(centry);
4636 }
4637
4638 #ifdef HAVE_ADS
4639
4640 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4641 const struct dom_sid *user_sid,
4642 TALLOC_CTX *ctx,
4643 ADS_STRUCT *ads, LDAPMessage *msg,
4644 const char **homedir, const char **shell,
4645 const char **gecos, gid_t *p_gid)
4646 {
4647 struct winbind_cache *cache = get_cache(domain);
4648 struct cache_entry *centry = NULL;
4649 NTSTATUS nt_status;
4650 fstring tmp;
4651
4652 if (!cache->tdb)
4653 goto do_query;
4654
4655 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4656 sid_to_fstring(tmp, user_sid));
4657
4658 if (!centry)
4659 goto do_query;
4660
4661 *homedir = centry_string( centry, ctx );
4662 *shell = centry_string( centry, ctx );
4663 *gecos = centry_string( centry, ctx );
4664 *p_gid = centry_uint32( centry );
4665
4666 centry_free(centry);
4667
4668 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4669 sid_string_dbg(user_sid)));
4670
4671 return NT_STATUS_OK;
4672
4673 do_query:
4674
4675 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4676 homedir, shell, gecos, p_gid );
4677
4678 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4679
4680 if ( NT_STATUS_IS_OK(nt_status) ) {
4681 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4682 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4683 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4684 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4685
4686 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4687 *homedir, *shell, *gecos, *p_gid );
4688 }
4689
4690 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4691 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4692 domain->name ));
4693 set_domain_offline( domain );
4694 }
4695
4696 return nt_status;
4697 }
4698
4699 #endif
4700
4701 /* the cache backend methods are exposed via this structure */
4702 struct winbindd_methods cache_methods = {
4703 true,
4704 query_user_list,
4705 enum_dom_groups,
4706 enum_local_groups,
4707 name_to_sid,
4708 sid_to_name,
4709 rids_to_names,
4710 query_user,
4711 lookup_usergroups,
4712 lookup_useraliases,
4713 lookup_groupmem,
4714 sequence_number,
4715 lockout_policy,
4716 password_policy,
4717 trusted_domains
4718 };
4719
4720 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4721 uint32_t opnum, const DATA_BLOB *req,
4722 TDB_DATA *pkey)
4723 {
4724 char *key;
4725 size_t keylen;
4726
4727 key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4728 if (key == NULL) {
4729 return false;
4730 }
4731 keylen = talloc_get_size(key) - 1;
4732
4733 key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4734 if (key == NULL) {
4735 return false;
4736 }
4737 memcpy(key + keylen, req->data, req->length);
4738
4739 pkey->dptr = (uint8_t *)key;
4740 pkey->dsize = talloc_get_size(key);
4741 return true;
4742 }
4743
4744 static bool wcache_opnum_cacheable(uint32_t opnum)
4745 {
4746 switch (opnum) {
4747 case NDR_WBINT_PING:
4748 case NDR_WBINT_QUERYSEQUENCENUMBER:
4749 case NDR_WBINT_ALLOCATEUID:
4750 case NDR_WBINT_ALLOCATEGID:
4751 case NDR_WBINT_CHECKMACHINEACCOUNT:
4752 case NDR_WBINT_CHANGEMACHINEACCOUNT:
4753 case NDR_WBINT_PINGDC:
4754 return false;
4755 }
4756 return true;
4757 }
4758
4759 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4760 uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4761 {
4762 TDB_DATA key, data;
4763 bool ret = false;
4764
4765 if (!wcache_opnum_cacheable(opnum) ||
4766 is_my_own_sam_domain(domain) ||
4767 is_builtin_domain(domain)) {
4768 return false;
4769 }
4770
4771 if (wcache->tdb == NULL) {
4772 return false;
4773 }
4774
4775 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4776 return false;
4777 }
4778 data = tdb_fetch(wcache->tdb, key);
4779 TALLOC_FREE(key.dptr);
4780
4781 if (data.dptr == NULL) {
4782 return false;
4783 }
4784 if (data.dsize < 12) {
4785 goto fail;
4786 }
4787
4788 if (!is_domain_offline(domain)) {
4789 uint32_t entry_seqnum, dom_seqnum, last_check;
4790 uint64_t entry_timeout;
4791
4792 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4793 &last_check)) {
4794 goto fail;
4795 }
4796 entry_seqnum = IVAL(data.dptr, 0);
4797 if (entry_seqnum != dom_seqnum) {
4798 DEBUG(10, ("Entry has wrong sequence number: %d\n",
4799 (int)entry_seqnum));
4800 goto fail;
4801 }
4802 entry_timeout = BVAL(data.dptr, 4);
4803 if (entry_timeout > time(NULL)) {
4804 DEBUG(10, ("Entry has timed out\n"));
4805 goto fail;
4806 }
4807 }
4808
4809 resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 12,
4810 data.dsize - 12);
4811 if (resp->data == NULL) {
4812 DEBUG(10, ("talloc failed\n"));
4813 goto fail;
4814 }
4815 resp->length = data.dsize - 12;
4816
4817 ret = true;
4818 fail:
4819 SAFE_FREE(data.dptr);
4820 return ret;
4821 }
4822
4823 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4824 const DATA_BLOB *req, const DATA_BLOB *resp)
4825 {
4826 TDB_DATA key, data;
4827 uint32_t dom_seqnum, last_check;
4828 uint64_t timeout;
4829
4830 if (!wcache_opnum_cacheable(opnum) ||
4831 is_my_own_sam_domain(domain) ||
4832 is_builtin_domain(domain)) {
4833 return;
4834 }
4835
4836 if (wcache->tdb == NULL) {
4837 return;
4838 }
4839
4840 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4841 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4842 domain->name));
4843 return;
4844 }
4845
4846 if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4847 return;
4848 }
4849
4850 timeout = time(NULL) + lp_winbind_cache_time();
4851
4852 data.dsize = resp->length + 12;
4853 data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4854 if (data.dptr == NULL) {
4855 goto done;
4856 }
4857
4858 SIVAL(data.dptr, 0, dom_seqnum);
4859 SBVAL(data.dptr, 4, timeout);
4860 memcpy(data.dptr + 12, resp->data, resp->length);
4861
4862 tdb_store(wcache->tdb, key, data, 0);
4863
4864 done:
4865 TALLOC_FREE(key.dptr);
4866 return;
4867 }
reg import