?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix some nonempty blank lines
[Samba/gebeck_regimport.git] / source3 / winbindd / winbindd_cache.c
blob80ec688a7557796f50204a04ae3e3fa4a00bc330
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind cache backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
30
31 #undef DBGC_CLASS
32 #define DBGC_CLASS DBGC_WINBIND
33
34 #define WINBINDD_CACHE_VERSION 1
35 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
36
37 extern struct winbindd_methods reconnect_methods;
38 #ifdef HAVE_ADS
39 extern struct winbindd_methods ads_methods;
40 #endif
41 extern struct winbindd_methods builtin_passdb_methods;
42
43 /*
44 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
45 * Here are the list of entry types that are *not* stored
46 * as form struct cache_entry in the cache.
47 */
48
49 static const char *non_centry_keys[] = {
50 "SEQNUM/",
51 "DR/",
52 "DE/",
53 "WINBINDD_OFFLINE",
54 WINBINDD_CACHE_VERSION_KEYSTR,
55 NULL
56 };
57
58 /************************************************************************
59 Is this key a non-centry type ?
60 ************************************************************************/
61
62 static bool is_non_centry_key(TDB_DATA kbuf)
63 {
64 int i;
65
66 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
67 return false;
68 }
69 for (i = 0; non_centry_keys[i] != NULL; i++) {
70 size_t namelen = strlen(non_centry_keys[i]);
71 if (kbuf.dsize < namelen) {
72 continue;
73 }
74 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
75 return true;
76 }
77 }
78 return false;
79 }
80
81 /* Global online/offline state - False when online. winbindd starts up online
82 and sets this to true if the first query fails and there's an entry in
83 the cache tdb telling us to stay offline. */
84
85 static bool global_winbindd_offline_state;
86
87 struct winbind_cache {
88 TDB_CONTEXT *tdb;
89 };
90
91 struct cache_entry {
92 NTSTATUS status;
93 uint32 sequence_number;
94 uint8 *data;
95 uint32 len, ofs;
96 };
97
98 void (*smb_panic_fn)(const char *const why) = smb_panic;
99
100 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
101
102 static struct winbind_cache *wcache;
103
104 void winbindd_check_cache_size(time_t t)
105 {
106 static time_t last_check_time;
107 struct stat st;
108
109 if (last_check_time == (time_t)0)
110 last_check_time = t;
111
112 if (t - last_check_time < 60 && t - last_check_time > 0)
113 return;
114
115 if (wcache == NULL || wcache->tdb == NULL) {
116 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
117 return;
118 }
119
120 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
121 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
122 return;
123 }
124
125 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
126 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
127 (unsigned long)st.st_size,
128 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
129 wcache_flush_cache();
130 }
131 }
132
133 /* get the winbind_cache structure */
134 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
135 {
136 struct winbind_cache *ret = wcache;
137
138 /* We have to know what type of domain we are dealing with first. */
139
140 if (domain->internal) {
141 domain->backend = &builtin_passdb_methods;
142 domain->initialized = True;
143 }
144 if ( !domain->initialized ) {
145 init_dc_connection( domain );
146 }
147
148 /*
149 OK. listen up becasue I'm only going to say this once.
150 We have the following scenarios to consider
151 (a) trusted AD domains on a Samba DC,
152 (b) trusted AD domains and we are joined to a non-kerberos domain
153 (c) trusted AD domains and we are joined to a kerberos (AD) domain
154
155 For (a) we can always contact the trusted domain using krb5
156 since we have the domain trust account password
157
158 For (b) we can only use RPC since we have no way of
159 getting a krb5 ticket in our own domain
160
161 For (c) we can always use krb5 since we have a kerberos trust
162
163 --jerry
164 */
165
166 if (!domain->backend) {
167 #ifdef HAVE_ADS
168 struct winbindd_domain *our_domain = domain;
169
170 /* find our domain first so we can figure out if we
171 are joined to a kerberized domain */
172
173 if ( !domain->primary )
174 our_domain = find_our_domain();
175
176 if ((our_domain->active_directory || IS_DC)
177 && domain->active_directory
178 && !lp_winbind_rpc_only()) {
179 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
180 domain->backend = &ads_methods;
181 } else {
182 #endif /* HAVE_ADS */
183 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
184 domain->backend = &reconnect_methods;
185 #ifdef HAVE_ADS
186 }
187 #endif /* HAVE_ADS */
188 }
189
190 if (ret)
191 return ret;
192
193 ret = SMB_XMALLOC_P(struct winbind_cache);
194 ZERO_STRUCTP(ret);
195
196 wcache = ret;
197 wcache_flush_cache();
198
199 return ret;
200 }
201
202 /*
203 free a centry structure
204 */
205 static void centry_free(struct cache_entry *centry)
206 {
207 if (!centry)
208 return;
209 SAFE_FREE(centry->data);
210 free(centry);
211 }
212
213 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
214 {
215 if (centry->len - centry->ofs < nbytes) {
216 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
217 (unsigned int)nbytes,
218 centry->len - centry->ofs));
219 return false;
220 }
221 return true;
222 }
223
224 /*
225 pull a uint32 from a cache entry
226 */
227 static uint32 centry_uint32(struct cache_entry *centry)
228 {
229 uint32 ret;
230
231 if (!centry_check_bytes(centry, 4)) {
232 smb_panic_fn("centry_uint32");
233 }
234 ret = IVAL(centry->data, centry->ofs);
235 centry->ofs += 4;
236 return ret;
237 }
238
239 /*
240 pull a uint16 from a cache entry
241 */
242 static uint16 centry_uint16(struct cache_entry *centry)
243 {
244 uint16 ret;
245 if (!centry_check_bytes(centry, 2)) {
246 smb_panic_fn("centry_uint16");
247 }
248 ret = CVAL(centry->data, centry->ofs);
249 centry->ofs += 2;
250 return ret;
251 }
252
253 /*
254 pull a uint8 from a cache entry
255 */
256 static uint8 centry_uint8(struct cache_entry *centry)
257 {
258 uint8 ret;
259 if (!centry_check_bytes(centry, 1)) {
260 smb_panic_fn("centry_uint8");
261 }
262 ret = CVAL(centry->data, centry->ofs);
263 centry->ofs += 1;
264 return ret;
265 }
266
267 /*
268 pull a NTTIME from a cache entry
269 */
270 static NTTIME centry_nttime(struct cache_entry *centry)
271 {
272 NTTIME ret;
273 if (!centry_check_bytes(centry, 8)) {
274 smb_panic_fn("centry_nttime");
275 }
276 ret = IVAL(centry->data, centry->ofs);
277 centry->ofs += 4;
278 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
279 centry->ofs += 4;
280 return ret;
281 }
282
283 /*
284 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
285 */
286 static time_t centry_time(struct cache_entry *centry)
287 {
288 return (time_t)centry_nttime(centry);
289 }
290
291 /* pull a string from a cache entry, using the supplied
292 talloc context
293 */
294 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
295 {
296 uint32 len;
297 char *ret;
298
299 len = centry_uint8(centry);
300
301 if (len == 0xFF) {
302 /* a deliberate NULL string */
303 return NULL;
304 }
305
306 if (!centry_check_bytes(centry, (size_t)len)) {
307 smb_panic_fn("centry_string");
308 }
309
310 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
311 if (!ret) {
312 smb_panic_fn("centry_string out of memory\n");
313 }
314 memcpy(ret,centry->data + centry->ofs, len);
315 ret[len] = 0;
316 centry->ofs += len;
317 return ret;
318 }
319
320 /* pull a hash16 from a cache entry, using the supplied
321 talloc context
322 */
323 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
324 {
325 uint32 len;
326 char *ret;
327
328 len = centry_uint8(centry);
329
330 if (len != 16) {
331 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
332 len ));
333 return NULL;
334 }
335
336 if (!centry_check_bytes(centry, 16)) {
337 return NULL;
338 }
339
340 ret = TALLOC_ARRAY(mem_ctx, char, 16);
341 if (!ret) {
342 smb_panic_fn("centry_hash out of memory\n");
343 }
344 memcpy(ret,centry->data + centry->ofs, 16);
345 centry->ofs += 16;
346 return ret;
347 }
348
349 /* pull a sid from a cache entry, using the supplied
350 talloc context
351 */
352 static bool centry_sid(struct cache_entry *centry, TALLOC_CTX *mem_ctx, DOM_SID *sid)
353 {
354 char *sid_string;
355 sid_string = centry_string(centry, mem_ctx);
356 if ((sid_string == NULL) || (!string_to_sid(sid, sid_string))) {
357 return false;
358 }
359 return true;
360 }
361
362
363 /*
364 pull a NTSTATUS from a cache entry
365 */
366 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
367 {
368 NTSTATUS status;
369
370 status = NT_STATUS(centry_uint32(centry));
371 return status;
372 }
373
374
375 /* the server is considered down if it can't give us a sequence number */
376 static bool wcache_server_down(struct winbindd_domain *domain)
377 {
378 bool ret;
379
380 if (!wcache->tdb)
381 return false;
382
383 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
384
385 if (ret)
386 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
387 domain->name ));
388 return ret;
389 }
390
391 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
392 {
393 TDB_DATA data;
394 fstring key;
395 uint32 time_diff;
396
397 if (!wcache->tdb) {
398 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
399 return NT_STATUS_UNSUCCESSFUL;
400 }
401
402 fstr_sprintf( key, "SEQNUM/%s", domain->name );
403
404 data = tdb_fetch_bystring( wcache->tdb, key );
405 if ( !data.dptr || data.dsize!=8 ) {
406 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key ));
407 return NT_STATUS_UNSUCCESSFUL;
408 }
409
410 domain->sequence_number = IVAL(data.dptr, 0);
411 domain->last_seq_check = IVAL(data.dptr, 4);
412
413 SAFE_FREE(data.dptr);
414
415 /* have we expired? */
416
417 time_diff = now - domain->last_seq_check;
418 if ( time_diff > lp_winbind_cache_time() ) {
419 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
420 domain->name, domain->sequence_number,
421 (uint32)domain->last_seq_check));
422 return NT_STATUS_UNSUCCESSFUL;
423 }
424
425 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
426 domain->name, domain->sequence_number,
427 (uint32)domain->last_seq_check));
428
429 return NT_STATUS_OK;
430 }
431
432 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
433 {
434 TDB_DATA data;
435 fstring key_str;
436 uint8 buf[8];
437
438 if (!wcache->tdb) {
439 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
440 return NT_STATUS_UNSUCCESSFUL;
441 }
442
443 fstr_sprintf( key_str, "SEQNUM/%s", domain->name );
444
445 SIVAL(buf, 0, domain->sequence_number);
446 SIVAL(buf, 4, domain->last_seq_check);
447 data.dptr = buf;
448 data.dsize = 8;
449
450 if ( tdb_store_bystring( wcache->tdb, key_str, data, TDB_REPLACE) == -1 ) {
451 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
452 return NT_STATUS_UNSUCCESSFUL;
453 }
454
455 DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
456 domain->name, domain->sequence_number,
457 (uint32)domain->last_seq_check));
458
459 return NT_STATUS_OK;
460 }
461
462 /*
463 refresh the domain sequence number. If force is true
464 then always refresh it, no matter how recently we fetched it
465 */
466
467 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
468 {
469 NTSTATUS status;
470 unsigned time_diff;
471 time_t t = time(NULL);
472 unsigned cache_time = lp_winbind_cache_time();
473
474 if ( IS_DOMAIN_OFFLINE(domain) ) {
475 return;
476 }
477
478 get_cache( domain );
479
480 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
481 /* trying to reconnect is expensive, don't do it too often */
482 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
483 cache_time *= 8;
484 }
485 #endif
486
487 time_diff = t - domain->last_seq_check;
488
489 /* see if we have to refetch the domain sequence number */
490 if (!force && (time_diff < cache_time) &&
491 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
492 NT_STATUS_IS_OK(domain->last_status)) {
493 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
494 goto done;
495 }
496
497 /* try to get the sequence number from the tdb cache first */
498 /* this will update the timestamp as well */
499
500 status = fetch_cache_seqnum( domain, t );
501 if (NT_STATUS_IS_OK(status) &&
502 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
503 NT_STATUS_IS_OK(domain->last_status)) {
504 goto done;
505 }
506
507 /* important! make sure that we know if this is a native
508 mode domain or not. And that we can contact it. */
509
510 if ( winbindd_can_contact_domain( domain ) ) {
511 status = domain->backend->sequence_number(domain,
512 &domain->sequence_number);
513 } else {
514 /* just use the current time */
515 status = NT_STATUS_OK;
516 domain->sequence_number = time(NULL);
517 }
518
519
520 /* the above call could have set our domain->backend to NULL when
521 * coming from offline to online mode, make sure to reinitialize the
522 * backend - Guenther */
523 get_cache( domain );
524
525 if (!NT_STATUS_IS_OK(status)) {
526 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
527 domain->sequence_number = DOM_SEQUENCE_NONE;
528 }
529
530 domain->last_status = status;
531 domain->last_seq_check = time(NULL);
532
533 /* save the new sequence number in the cache */
534 store_cache_seqnum( domain );
535
536 done:
537 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
538 domain->name, domain->sequence_number));
539
540 return;
541 }
542
543 /*
544 decide if a cache entry has expired
545 */
546 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
547 {
548 /* If we've been told to be offline - stay in that state... */
549 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
550 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
551 keystr, domain->name ));
552 return false;
553 }
554
555 /* when the domain is offline return the cached entry.
556 * This deals with transient offline states... */
557
558 if (!domain->online) {
559 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
560 keystr, domain->name ));
561 return false;
562 }
563
564 /* if the server is OK and our cache entry came from when it was down then
565 the entry is invalid */
566 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
567 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
568 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
569 keystr, domain->name ));
570 return true;
571 }
572
573 /* if the server is down or the cache entry is not older than the
574 current sequence number then it is OK */
575 if (wcache_server_down(domain) ||
576 centry->sequence_number == domain->sequence_number) {
577 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
578 keystr, domain->name ));
579 return false;
580 }
581
582 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
583 keystr, domain->name ));
584
585 /* it's expired */
586 return true;
587 }
588
589 static struct cache_entry *wcache_fetch_raw(char *kstr)
590 {
591 TDB_DATA data;
592 struct cache_entry *centry;
593 TDB_DATA key;
594
595 key = string_tdb_data(kstr);
596 data = tdb_fetch(wcache->tdb, key);
597 if (!data.dptr) {
598 /* a cache miss */
599 return NULL;
600 }
601
602 centry = SMB_XMALLOC_P(struct cache_entry);
603 centry->data = (unsigned char *)data.dptr;
604 centry->len = data.dsize;
605 centry->ofs = 0;
606
607 if (centry->len < 8) {
608 /* huh? corrupt cache? */
609 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
610 centry_free(centry);
611 return NULL;
612 }
613
614 centry->status = centry_ntstatus(centry);
615 centry->sequence_number = centry_uint32(centry);
616
617 return centry;
618 }
619
620 /*
621 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
622 number and return status
623 */
624 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
625 struct winbindd_domain *domain,
626 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
627 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
628 struct winbindd_domain *domain,
629 const char *format, ...)
630 {
631 va_list ap;
632 char *kstr;
633 struct cache_entry *centry;
634
635 if (!winbindd_use_cache()) {
636 return NULL;
637 }
638
639 refresh_sequence_number(domain, false);
640
641 va_start(ap, format);
642 smb_xvasprintf(&kstr, format, ap);
643 va_end(ap);
644
645 centry = wcache_fetch_raw(kstr);
646 if (centry == NULL) {
647 free(kstr);
648 return NULL;
649 }
650
651 if (centry_expired(domain, kstr, centry)) {
652
653 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
654 kstr, domain->name ));
655
656 centry_free(centry);
657 free(kstr);
658 return NULL;
659 }
660
661 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
662 kstr, domain->name ));
663
664 free(kstr);
665 return centry;
666 }
667
668 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
669 static void wcache_delete(const char *format, ...)
670 {
671 va_list ap;
672 char *kstr;
673 TDB_DATA key;
674
675 va_start(ap, format);
676 smb_xvasprintf(&kstr, format, ap);
677 va_end(ap);
678
679 key = string_tdb_data(kstr);
680
681 tdb_delete(wcache->tdb, key);
682 free(kstr);
683 }
684
685 /*
686 make sure we have at least len bytes available in a centry
687 */
688 static void centry_expand(struct cache_entry *centry, uint32 len)
689 {
690 if (centry->len - centry->ofs >= len)
691 return;
692 centry->len *= 2;
693 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
694 centry->len);
695 if (!centry->data) {
696 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
697 smb_panic_fn("out of memory in centry_expand");
698 }
699 }
700
701 /*
702 push a uint32 into a centry
703 */
704 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
705 {
706 centry_expand(centry, 4);
707 SIVAL(centry->data, centry->ofs, v);
708 centry->ofs += 4;
709 }
710
711 /*
712 push a uint16 into a centry
713 */
714 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
715 {
716 centry_expand(centry, 2);
717 SIVAL(centry->data, centry->ofs, v);
718 centry->ofs += 2;
719 }
720
721 /*
722 push a uint8 into a centry
723 */
724 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
725 {
726 centry_expand(centry, 1);
727 SCVAL(centry->data, centry->ofs, v);
728 centry->ofs += 1;
729 }
730
731 /*
732 push a string into a centry
733 */
734 static void centry_put_string(struct cache_entry *centry, const char *s)
735 {
736 int len;
737
738 if (!s) {
739 /* null strings are marked as len 0xFFFF */
740 centry_put_uint8(centry, 0xFF);
741 return;
742 }
743
744 len = strlen(s);
745 /* can't handle more than 254 char strings. Truncating is probably best */
746 if (len > 254) {
747 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
748 len = 254;
749 }
750 centry_put_uint8(centry, len);
751 centry_expand(centry, len);
752 memcpy(centry->data + centry->ofs, s, len);
753 centry->ofs += len;
754 }
755
756 /*
757 push a 16 byte hash into a centry - treat as 16 byte string.
758 */
759 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
760 {
761 centry_put_uint8(centry, 16);
762 centry_expand(centry, 16);
763 memcpy(centry->data + centry->ofs, val, 16);
764 centry->ofs += 16;
765 }
766
767 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
768 {
769 fstring sid_string;
770 centry_put_string(centry, sid_to_fstring(sid_string, sid));
771 }
772
773
774 /*
775 put NTSTATUS into a centry
776 */
777 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
778 {
779 uint32 status_value = NT_STATUS_V(status);
780 centry_put_uint32(centry, status_value);
781 }
782
783
784 /*
785 push a NTTIME into a centry
786 */
787 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
788 {
789 centry_expand(centry, 8);
790 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
791 centry->ofs += 4;
792 SIVAL(centry->data, centry->ofs, nt >> 32);
793 centry->ofs += 4;
794 }
795
796 /*
797 push a time_t into a centry - use a 64 bit size.
798 NTTIME here is being used as a convenient 64-bit size.
799 */
800 static void centry_put_time(struct cache_entry *centry, time_t t)
801 {
802 NTTIME nt = (NTTIME)t;
803 centry_put_nttime(centry, nt);
804 }
805
806 /*
807 start a centry for output. When finished, call centry_end()
808 */
809 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
810 {
811 struct cache_entry *centry;
812
813 if (!wcache->tdb)
814 return NULL;
815
816 centry = SMB_XMALLOC_P(struct cache_entry);
817
818 centry->len = 8192; /* reasonable default */
819 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
820 centry->ofs = 0;
821 centry->sequence_number = domain->sequence_number;
822 centry_put_ntstatus(centry, status);
823 centry_put_uint32(centry, centry->sequence_number);
824 return centry;
825 }
826
827 /*
828 finish a centry and write it to the tdb
829 */
830 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
831 static void centry_end(struct cache_entry *centry, const char *format, ...)
832 {
833 va_list ap;
834 char *kstr;
835 TDB_DATA key, data;
836
837 if (!winbindd_use_cache()) {
838 return;
839 }
840
841 va_start(ap, format);
842 smb_xvasprintf(&kstr, format, ap);
843 va_end(ap);
844
845 key = string_tdb_data(kstr);
846 data.dptr = centry->data;
847 data.dsize = centry->ofs;
848
849 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
850 free(kstr);
851 }
852
853 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
854 NTSTATUS status, const char *domain_name,
855 const char *name, const DOM_SID *sid,
856 enum lsa_SidType type)
857 {
858 struct cache_entry *centry;
859 fstring uname;
860
861 centry = centry_start(domain, status);
862 if (!centry)
863 return;
864 centry_put_uint32(centry, type);
865 centry_put_sid(centry, sid);
866 fstrcpy(uname, name);
867 strupper_m(uname);
868 centry_end(centry, "NS/%s/%s", domain_name, uname);
869 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
870 uname, sid_string_dbg(sid), nt_errstr(status)));
871 centry_free(centry);
872 }
873
874 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
875 const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
876 {
877 struct cache_entry *centry;
878 fstring sid_string;
879
880 centry = centry_start(domain, status);
881 if (!centry)
882 return;
883
884 if (NT_STATUS_IS_OK(status)) {
885 centry_put_uint32(centry, type);
886 centry_put_string(centry, domain_name);
887 centry_put_string(centry, name);
888 }
889
890 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
891 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
892 name, nt_errstr(status)));
893 centry_free(centry);
894 }
895
896
897 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WINBIND_USERINFO *info)
898 {
899 struct cache_entry *centry;
900 fstring sid_string;
901
902 if (is_null_sid(&info->user_sid)) {
903 return;
904 }
905
906 centry = centry_start(domain, status);
907 if (!centry)
908 return;
909 centry_put_string(centry, info->acct_name);
910 centry_put_string(centry, info->full_name);
911 centry_put_string(centry, info->homedir);
912 centry_put_string(centry, info->shell);
913 centry_put_uint32(centry, info->primary_gid);
914 centry_put_sid(centry, &info->user_sid);
915 centry_put_sid(centry, &info->group_sid);
916 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
917 &info->user_sid));
918 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
919 centry_free(centry);
920 }
921
922 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
923 NTSTATUS status,
924 struct samr_DomInfo12 *lockout_policy)
925 {
926 struct cache_entry *centry;
927
928 centry = centry_start(domain, status);
929 if (!centry)
930 return;
931
932 centry_put_nttime(centry, lockout_policy->lockout_duration);
933 centry_put_nttime(centry, lockout_policy->lockout_window);
934 centry_put_uint16(centry, lockout_policy->lockout_threshold);
935
936 centry_end(centry, "LOC_POL/%s", domain->name);
937
938 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
939
940 centry_free(centry);
941 }
942
943
944
945 static void wcache_save_password_policy(struct winbindd_domain *domain,
946 NTSTATUS status,
947 struct samr_DomInfo1 *policy)
948 {
949 struct cache_entry *centry;
950
951 centry = centry_start(domain, status);
952 if (!centry)
953 return;
954
955 centry_put_uint16(centry, policy->min_password_length);
956 centry_put_uint16(centry, policy->password_history_length);
957 centry_put_uint32(centry, policy->password_properties);
958 centry_put_nttime(centry, policy->max_password_age);
959 centry_put_nttime(centry, policy->min_password_age);
960
961 centry_end(centry, "PWD_POL/%s", domain->name);
962
963 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
964
965 centry_free(centry);
966 }
967
968 /***************************************************************************
969 ***************************************************************************/
970
971 static void wcache_save_username_alias(struct winbindd_domain *domain,
972 NTSTATUS status,
973 const char *name, const char *alias)
974 {
975 struct cache_entry *centry;
976 fstring uname;
977
978 if ( (centry = centry_start(domain, status)) == NULL )
979 return;
980
981 centry_put_string( centry, alias );
982
983 fstrcpy(uname, name);
984 strupper_m(uname);
985 centry_end(centry, "NSS/NA/%s", uname);
986
987 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
988
989 centry_free(centry);
990 }
991
992 static void wcache_save_alias_username(struct winbindd_domain *domain,
993 NTSTATUS status,
994 const char *alias, const char *name)
995 {
996 struct cache_entry *centry;
997 fstring uname;
998
999 if ( (centry = centry_start(domain, status)) == NULL )
1000 return;
1001
1002 centry_put_string( centry, name );
1003
1004 fstrcpy(uname, alias);
1005 strupper_m(uname);
1006 centry_end(centry, "NSS/AN/%s", uname);
1007
1008 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1009
1010 centry_free(centry);
1011 }
1012
1013 /***************************************************************************
1014 ***************************************************************************/
1015
1016 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1017 struct winbindd_domain *domain,
1018 const char *name, char **alias )
1019 {
1020 struct winbind_cache *cache = get_cache(domain);
1021 struct cache_entry *centry = NULL;
1022 NTSTATUS status;
1023 char *upper_name;
1024
1025 if ( domain->internal )
1026 return NT_STATUS_NOT_SUPPORTED;
1027
1028 if (!cache->tdb)
1029 goto do_query;
1030
1031 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1032 return NT_STATUS_NO_MEMORY;
1033 strupper_m(upper_name);
1034
1035 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1036
1037 SAFE_FREE( upper_name );
1038
1039 if (!centry)
1040 goto do_query;
1041
1042 status = centry->status;
1043
1044 if (!NT_STATUS_IS_OK(status)) {
1045 centry_free(centry);
1046 return status;
1047 }
1048
1049 *alias = centry_string( centry, mem_ctx );
1050
1051 centry_free(centry);
1052
1053 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1054 name, *alias ? *alias : "(none)"));
1055
1056 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1057
1058 do_query:
1059
1060 /* If its not in cache and we are offline, then fail */
1061
1062 if ( get_global_winbindd_state_offline() || !domain->online ) {
1063 DEBUG(8,("resolve_username_to_alias: rejecting query "
1064 "in offline mode\n"));
1065 return NT_STATUS_NOT_FOUND;
1066 }
1067
1068 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1069
1070 if ( NT_STATUS_IS_OK( status ) ) {
1071 wcache_save_username_alias(domain, status, name, *alias);
1072 }
1073
1074 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1075 wcache_save_username_alias(domain, status, name, "(NULL)");
1076 }
1077
1078 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1079 nt_errstr(status)));
1080
1081 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1082 set_domain_offline( domain );
1083 }
1084
1085 return status;
1086 }
1087
1088 /***************************************************************************
1089 ***************************************************************************/
1090
1091 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1092 struct winbindd_domain *domain,
1093 const char *alias, char **name )
1094 {
1095 struct winbind_cache *cache = get_cache(domain);
1096 struct cache_entry *centry = NULL;
1097 NTSTATUS status;
1098 char *upper_name;
1099
1100 if ( domain->internal )
1101 return NT_STATUS_NOT_SUPPORTED;
1102
1103 if (!cache->tdb)
1104 goto do_query;
1105
1106 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1107 return NT_STATUS_NO_MEMORY;
1108 strupper_m(upper_name);
1109
1110 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1111
1112 SAFE_FREE( upper_name );
1113
1114 if (!centry)
1115 goto do_query;
1116
1117 status = centry->status;
1118
1119 if (!NT_STATUS_IS_OK(status)) {
1120 centry_free(centry);
1121 return status;
1122 }
1123
1124 *name = centry_string( centry, mem_ctx );
1125
1126 centry_free(centry);
1127
1128 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1129 alias, *name ? *name : "(none)"));
1130
1131 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1132
1133 do_query:
1134
1135 /* If its not in cache and we are offline, then fail */
1136
1137 if ( get_global_winbindd_state_offline() || !domain->online ) {
1138 DEBUG(8,("resolve_alias_to_username: rejecting query "
1139 "in offline mode\n"));
1140 return NT_STATUS_NOT_FOUND;
1141 }
1142
1143 /* an alias cannot contain a domain prefix or '@' */
1144
1145 if (strchr(alias, '\\') || strchr(alias, '@')) {
1146 DEBUG(10,("resolve_alias_to_username: skipping fully "
1147 "qualified name %s\n", alias));
1148 return NT_STATUS_OBJECT_NAME_INVALID;
1149 }
1150
1151 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1152
1153 if ( NT_STATUS_IS_OK( status ) ) {
1154 wcache_save_alias_username( domain, status, alias, *name );
1155 }
1156
1157 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1158 wcache_save_alias_username(domain, status, alias, "(NULL)");
1159 }
1160
1161 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1162 nt_errstr(status)));
1163
1164 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1165 set_domain_offline( domain );
1166 }
1167
1168 return status;
1169 }
1170
1171 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1172 {
1173 struct winbind_cache *cache = get_cache(domain);
1174 TDB_DATA data;
1175 fstring key_str, tmp;
1176 uint32 rid;
1177
1178 if (!cache->tdb) {
1179 return NT_STATUS_INTERNAL_DB_ERROR;
1180 }
1181
1182 if (is_null_sid(sid)) {
1183 return NT_STATUS_INVALID_SID;
1184 }
1185
1186 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1187 return NT_STATUS_INVALID_SID;
1188 }
1189
1190 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1191
1192 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1193 if (!data.dptr) {
1194 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1195 }
1196
1197 SAFE_FREE(data.dptr);
1198 return NT_STATUS_OK;
1199 }
1200
1201 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1202 as new salted ones. */
1203
1204 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1205 TALLOC_CTX *mem_ctx,
1206 const DOM_SID *sid,
1207 const uint8 **cached_nt_pass,
1208 const uint8 **cached_salt)
1209 {
1210 struct winbind_cache *cache = get_cache(domain);
1211 struct cache_entry *centry = NULL;
1212 NTSTATUS status;
1213 time_t t;
1214 uint32 rid;
1215 fstring tmp;
1216
1217 if (!cache->tdb) {
1218 return NT_STATUS_INTERNAL_DB_ERROR;
1219 }
1220
1221 if (is_null_sid(sid)) {
1222 return NT_STATUS_INVALID_SID;
1223 }
1224
1225 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1226 return NT_STATUS_INVALID_SID;
1227 }
1228
1229 /* Try and get a salted cred first. If we can't
1230 fall back to an unsalted cred. */
1231
1232 centry = wcache_fetch(cache, domain, "CRED/%s",
1233 sid_to_fstring(tmp, sid));
1234 if (!centry) {
1235 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1236 sid_string_dbg(sid)));
1237 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1238 }
1239
1240 t = centry_time(centry);
1241
1242 /* In the salted case this isn't actually the nt_hash itself,
1243 but the MD5 of the salt + nt_hash. Let the caller
1244 sort this out. It can tell as we only return the cached_salt
1245 if we are returning a salted cred. */
1246
1247 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1248 if (*cached_nt_pass == NULL) {
1249 fstring sidstr;
1250
1251 sid_to_fstring(sidstr, sid);
1252
1253 /* Bad (old) cred cache. Delete and pretend we
1254 don't have it. */
1255 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1256 sidstr));
1257 wcache_delete("CRED/%s", sidstr);
1258 centry_free(centry);
1259 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1260 }
1261
1262 /* We only have 17 bytes more data in the salted cred case. */
1263 if (centry->len - centry->ofs == 17) {
1264 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1265 } else {
1266 *cached_salt = NULL;
1267 }
1268
1269 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1270 if (*cached_salt) {
1271 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1272 }
1273
1274 status = centry->status;
1275
1276 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1277 sid_string_dbg(sid), nt_errstr(status) ));
1278
1279 centry_free(centry);
1280 return status;
1281 }
1282
1283 /* Store creds for a SID - only writes out new salted ones. */
1284
1285 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1286 TALLOC_CTX *mem_ctx,
1287 const DOM_SID *sid,
1288 const uint8 nt_pass[NT_HASH_LEN])
1289 {
1290 struct cache_entry *centry;
1291 fstring sid_string;
1292 uint32 rid;
1293 uint8 cred_salt[NT_HASH_LEN];
1294 uint8 salted_hash[NT_HASH_LEN];
1295
1296 if (is_null_sid(sid)) {
1297 return NT_STATUS_INVALID_SID;
1298 }
1299
1300 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1301 return NT_STATUS_INVALID_SID;
1302 }
1303
1304 centry = centry_start(domain, NT_STATUS_OK);
1305 if (!centry) {
1306 return NT_STATUS_INTERNAL_DB_ERROR;
1307 }
1308
1309 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1310
1311 centry_put_time(centry, time(NULL));
1312
1313 /* Create a salt and then salt the hash. */
1314 generate_random_buffer(cred_salt, NT_HASH_LEN);
1315 E_md5hash(cred_salt, nt_pass, salted_hash);
1316
1317 centry_put_hash16(centry, salted_hash);
1318 centry_put_hash16(centry, cred_salt);
1319 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1320
1321 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1322
1323 centry_free(centry);
1324
1325 return NT_STATUS_OK;
1326 }
1327
1328
1329 /* Query display info. This is the basic user list fn */
1330 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1331 TALLOC_CTX *mem_ctx,
1332 uint32 *num_entries,
1333 WINBIND_USERINFO **info)
1334 {
1335 struct winbind_cache *cache = get_cache(domain);
1336 struct cache_entry *centry = NULL;
1337 NTSTATUS status;
1338 unsigned int i, retry;
1339
1340 if (!cache->tdb)
1341 goto do_query;
1342
1343 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1344 if (!centry)
1345 goto do_query;
1346
1347 *num_entries = centry_uint32(centry);
1348
1349 if (*num_entries == 0)
1350 goto do_cached;
1351
1352 (*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
1353 if (! (*info)) {
1354 smb_panic_fn("query_user_list out of memory");
1355 }
1356 for (i=0; i<(*num_entries); i++) {
1357 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1358 (*info)[i].full_name = centry_string(centry, mem_ctx);
1359 (*info)[i].homedir = centry_string(centry, mem_ctx);
1360 (*info)[i].shell = centry_string(centry, mem_ctx);
1361 centry_sid(centry, mem_ctx, &(*info)[i].user_sid);
1362 centry_sid(centry, mem_ctx, &(*info)[i].group_sid);
1363 }
1364
1365 do_cached:
1366 status = centry->status;
1367
1368 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1369 domain->name, nt_errstr(status) ));
1370
1371 centry_free(centry);
1372 return status;
1373
1374 do_query:
1375 *num_entries = 0;
1376 *info = NULL;
1377
1378 /* Return status value returned by seq number check */
1379
1380 if (!NT_STATUS_IS_OK(domain->last_status))
1381 return domain->last_status;
1382
1383 /* Put the query_user_list() in a retry loop. There appears to be
1384 * some bug either with Windows 2000 or Samba's handling of large
1385 * rpc replies. This manifests itself as sudden disconnection
1386 * at a random point in the enumeration of a large (60k) user list.
1387 * The retry loop simply tries the operation again. )-: It's not
1388 * pretty but an acceptable workaround until we work out what the
1389 * real problem is. */
1390
1391 retry = 0;
1392 do {
1393
1394 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1395 domain->name ));
1396
1397 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1398 if (!NT_STATUS_IS_OK(status)) {
1399 DEBUG(3, ("query_user_list: returned 0x%08x, "
1400 "retrying\n", NT_STATUS_V(status)));
1401 }
1402 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1403 DEBUG(3, ("query_user_list: flushing "
1404 "connection cache\n"));
1405 invalidate_cm_connection(&domain->conn);
1406 }
1407
1408 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1409 (retry++ < 5));
1410
1411 /* and save it */
1412 refresh_sequence_number(domain, false);
1413 centry = centry_start(domain, status);
1414 if (!centry)
1415 goto skip_save;
1416 centry_put_uint32(centry, *num_entries);
1417 for (i=0; i<(*num_entries); i++) {
1418 centry_put_string(centry, (*info)[i].acct_name);
1419 centry_put_string(centry, (*info)[i].full_name);
1420 centry_put_string(centry, (*info)[i].homedir);
1421 centry_put_string(centry, (*info)[i].shell);
1422 centry_put_sid(centry, &(*info)[i].user_sid);
1423 centry_put_sid(centry, &(*info)[i].group_sid);
1424 if (domain->backend && domain->backend->consistent) {
1425 /* when the backend is consistent we can pre-prime some mappings */
1426 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1427 domain->name,
1428 (*info)[i].acct_name,
1429 &(*info)[i].user_sid,
1430 SID_NAME_USER);
1431 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1432 &(*info)[i].user_sid,
1433 domain->name,
1434 (*info)[i].acct_name,
1435 SID_NAME_USER);
1436 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1437 }
1438 }
1439 centry_end(centry, "UL/%s", domain->name);
1440 centry_free(centry);
1441
1442 skip_save:
1443 return status;
1444 }
1445
1446 /* list all domain groups */
1447 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1448 TALLOC_CTX *mem_ctx,
1449 uint32 *num_entries,
1450 struct acct_info **info)
1451 {
1452 struct winbind_cache *cache = get_cache(domain);
1453 struct cache_entry *centry = NULL;
1454 NTSTATUS status;
1455 unsigned int i;
1456
1457 if (!cache->tdb)
1458 goto do_query;
1459
1460 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1461 if (!centry)
1462 goto do_query;
1463
1464 *num_entries = centry_uint32(centry);
1465
1466 if (*num_entries == 0)
1467 goto do_cached;
1468
1469 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1470 if (! (*info)) {
1471 smb_panic_fn("enum_dom_groups out of memory");
1472 }
1473 for (i=0; i<(*num_entries); i++) {
1474 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1475 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1476 (*info)[i].rid = centry_uint32(centry);
1477 }
1478
1479 do_cached:
1480 status = centry->status;
1481
1482 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1483 domain->name, nt_errstr(status) ));
1484
1485 centry_free(centry);
1486 return status;
1487
1488 do_query:
1489 *num_entries = 0;
1490 *info = NULL;
1491
1492 /* Return status value returned by seq number check */
1493
1494 if (!NT_STATUS_IS_OK(domain->last_status))
1495 return domain->last_status;
1496
1497 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1498 domain->name ));
1499
1500 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1501
1502 /* and save it */
1503 refresh_sequence_number(domain, false);
1504 centry = centry_start(domain, status);
1505 if (!centry)
1506 goto skip_save;
1507 centry_put_uint32(centry, *num_entries);
1508 for (i=0; i<(*num_entries); i++) {
1509 centry_put_string(centry, (*info)[i].acct_name);
1510 centry_put_string(centry, (*info)[i].acct_desc);
1511 centry_put_uint32(centry, (*info)[i].rid);
1512 }
1513 centry_end(centry, "GL/%s/domain", domain->name);
1514 centry_free(centry);
1515
1516 skip_save:
1517 return status;
1518 }
1519
1520 /* list all domain groups */
1521 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1522 TALLOC_CTX *mem_ctx,
1523 uint32 *num_entries,
1524 struct acct_info **info)
1525 {
1526 struct winbind_cache *cache = get_cache(domain);
1527 struct cache_entry *centry = NULL;
1528 NTSTATUS status;
1529 unsigned int i;
1530
1531 if (!cache->tdb)
1532 goto do_query;
1533
1534 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1535 if (!centry)
1536 goto do_query;
1537
1538 *num_entries = centry_uint32(centry);
1539
1540 if (*num_entries == 0)
1541 goto do_cached;
1542
1543 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1544 if (! (*info)) {
1545 smb_panic_fn("enum_dom_groups out of memory");
1546 }
1547 for (i=0; i<(*num_entries); i++) {
1548 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1549 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1550 (*info)[i].rid = centry_uint32(centry);
1551 }
1552
1553 do_cached:
1554
1555 /* If we are returning cached data and the domain controller
1556 is down then we don't know whether the data is up to date
1557 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1558 indicate this. */
1559
1560 if (wcache_server_down(domain)) {
1561 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1562 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1563 } else
1564 status = centry->status;
1565
1566 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1567 domain->name, nt_errstr(status) ));
1568
1569 centry_free(centry);
1570 return status;
1571
1572 do_query:
1573 *num_entries = 0;
1574 *info = NULL;
1575
1576 /* Return status value returned by seq number check */
1577
1578 if (!NT_STATUS_IS_OK(domain->last_status))
1579 return domain->last_status;
1580
1581 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1582 domain->name ));
1583
1584 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1585
1586 /* and save it */
1587 refresh_sequence_number(domain, false);
1588 centry = centry_start(domain, status);
1589 if (!centry)
1590 goto skip_save;
1591 centry_put_uint32(centry, *num_entries);
1592 for (i=0; i<(*num_entries); i++) {
1593 centry_put_string(centry, (*info)[i].acct_name);
1594 centry_put_string(centry, (*info)[i].acct_desc);
1595 centry_put_uint32(centry, (*info)[i].rid);
1596 }
1597 centry_end(centry, "GL/%s/local", domain->name);
1598 centry_free(centry);
1599
1600 skip_save:
1601 return status;
1602 }
1603
1604 /* convert a single name to a sid in a domain */
1605 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1606 TALLOC_CTX *mem_ctx,
1607 enum winbindd_cmd orig_cmd,
1608 const char *domain_name,
1609 const char *name,
1610 DOM_SID *sid,
1611 enum lsa_SidType *type)
1612 {
1613 struct winbind_cache *cache = get_cache(domain);
1614 struct cache_entry *centry = NULL;
1615 NTSTATUS status;
1616 fstring uname;
1617
1618 if (!cache->tdb)
1619 goto do_query;
1620
1621 fstrcpy(uname, name);
1622 strupper_m(uname);
1623 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1624 if (!centry)
1625 goto do_query;
1626
1627 status = centry->status;
1628 if (NT_STATUS_IS_OK(status)) {
1629 *type = (enum lsa_SidType)centry_uint32(centry);
1630 centry_sid(centry, mem_ctx, sid);
1631 }
1632
1633 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: %s\n",
1634 domain->name, nt_errstr(status) ));
1635
1636 centry_free(centry);
1637 return status;
1638
1639 do_query:
1640 ZERO_STRUCTP(sid);
1641
1642 /* If the seq number check indicated that there is a problem
1643 * with this DC, then return that status... except for
1644 * access_denied. This is special because the dc may be in
1645 * "restrict anonymous = 1" mode, in which case it will deny
1646 * most unauthenticated operations, but *will* allow the LSA
1647 * name-to-sid that we try as a fallback. */
1648
1649 if (!(NT_STATUS_IS_OK(domain->last_status)
1650 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1651 return domain->last_status;
1652
1653 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1654 domain->name ));
1655
1656 status = domain->backend->name_to_sid(domain, mem_ctx, orig_cmd,
1657 domain_name, name, sid, type);
1658
1659 /* and save it */
1660 refresh_sequence_number(domain, false);
1661
1662 if (domain->online &&
1663 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1664 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1665
1666 /* Only save the reverse mapping if this was not a UPN */
1667 if (!strchr(name, '@')) {
1668 strupper_m(CONST_DISCARD(char *,domain_name));
1669 strlower_m(CONST_DISCARD(char *,name));
1670 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1671 }
1672 }
1673
1674 return status;
1675 }
1676
1677 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1678 given */
1679 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1680 TALLOC_CTX *mem_ctx,
1681 const DOM_SID *sid,
1682 char **domain_name,
1683 char **name,
1684 enum lsa_SidType *type)
1685 {
1686 struct winbind_cache *cache = get_cache(domain);
1687 struct cache_entry *centry = NULL;
1688 NTSTATUS status;
1689 fstring sid_string;
1690
1691 if (!cache->tdb)
1692 goto do_query;
1693
1694 centry = wcache_fetch(cache, domain, "SN/%s",
1695 sid_to_fstring(sid_string, sid));
1696 if (!centry)
1697 goto do_query;
1698
1699 status = centry->status;
1700 if (NT_STATUS_IS_OK(status)) {
1701 *type = (enum lsa_SidType)centry_uint32(centry);
1702 *domain_name = centry_string(centry, mem_ctx);
1703 *name = centry_string(centry, mem_ctx);
1704 }
1705
1706 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: %s\n",
1707 domain->name, nt_errstr(status) ));
1708
1709 centry_free(centry);
1710 return status;
1711
1712 do_query:
1713 *name = NULL;
1714 *domain_name = NULL;
1715
1716 /* If the seq number check indicated that there is a problem
1717 * with this DC, then return that status... except for
1718 * access_denied. This is special because the dc may be in
1719 * "restrict anonymous = 1" mode, in which case it will deny
1720 * most unauthenticated operations, but *will* allow the LSA
1721 * sid-to-name that we try as a fallback. */
1722
1723 if (!(NT_STATUS_IS_OK(domain->last_status)
1724 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1725 return domain->last_status;
1726
1727 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1728 domain->name ));
1729
1730 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1731
1732 /* and save it */
1733 refresh_sequence_number(domain, false);
1734 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1735
1736 /* We can't save the name to sid mapping here, as with sid history a
1737 * later name2sid would give the wrong sid. */
1738
1739 return status;
1740 }
1741
1742 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1743 TALLOC_CTX *mem_ctx,
1744 const DOM_SID *domain_sid,
1745 uint32 *rids,
1746 size_t num_rids,
1747 char **domain_name,
1748 char ***names,
1749 enum lsa_SidType **types)
1750 {
1751 struct winbind_cache *cache = get_cache(domain);
1752 size_t i;
1753 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1754 bool have_mapped;
1755 bool have_unmapped;
1756
1757 *domain_name = NULL;
1758 *names = NULL;
1759 *types = NULL;
1760
1761 if (!cache->tdb) {
1762 goto do_query;
1763 }
1764
1765 if (num_rids == 0) {
1766 return NT_STATUS_OK;
1767 }
1768
1769 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1770 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1771
1772 if ((*names == NULL) || (*types == NULL)) {
1773 result = NT_STATUS_NO_MEMORY;
1774 goto error;
1775 }
1776
1777 have_mapped = have_unmapped = false;
1778
1779 for (i=0; i<num_rids; i++) {
1780 DOM_SID sid;
1781 struct cache_entry *centry;
1782 fstring tmp;
1783
1784 if (!sid_compose(&sid, domain_sid, rids[i])) {
1785 result = NT_STATUS_INTERNAL_ERROR;
1786 goto error;
1787 }
1788
1789 centry = wcache_fetch(cache, domain, "SN/%s",
1790 sid_to_fstring(tmp, &sid));
1791 if (!centry) {
1792 goto do_query;
1793 }
1794
1795 (*types)[i] = SID_NAME_UNKNOWN;
1796 (*names)[i] = talloc_strdup(*names, "");
1797
1798 if (NT_STATUS_IS_OK(centry->status)) {
1799 char *dom;
1800 have_mapped = true;
1801 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1802
1803 dom = centry_string(centry, mem_ctx);
1804 if (*domain_name == NULL) {
1805 *domain_name = dom;
1806 } else {
1807 talloc_free(dom);
1808 }
1809
1810 (*names)[i] = centry_string(centry, *names);
1811
1812 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1813 have_unmapped = true;
1814
1815 } else {
1816 /* something's definitely wrong */
1817 result = centry->status;
1818 goto error;
1819 }
1820
1821 centry_free(centry);
1822 }
1823
1824 if (!have_mapped) {
1825 return NT_STATUS_NONE_MAPPED;
1826 }
1827 if (!have_unmapped) {
1828 return NT_STATUS_OK;
1829 }
1830 return STATUS_SOME_UNMAPPED;
1831
1832 do_query:
1833
1834 TALLOC_FREE(*names);
1835 TALLOC_FREE(*types);
1836
1837 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1838 rids, num_rids, domain_name,
1839 names, types);
1840
1841 /*
1842 None of the queried rids has been found so save all negative entries
1843 */
1844 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1845 for (i = 0; i < num_rids; i++) {
1846 DOM_SID sid;
1847 const char *name = "";
1848 const enum lsa_SidType type = SID_NAME_UNKNOWN;
1849 NTSTATUS status = NT_STATUS_NONE_MAPPED;
1850
1851 if (!sid_compose(&sid, domain_sid, rids[i])) {
1852 return NT_STATUS_INTERNAL_ERROR;
1853 }
1854
1855 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1856 name, type);
1857 }
1858
1859 return result;
1860 }
1861
1862 /*
1863 Some or all of the queried rids have been found.
1864 */
1865 if (!NT_STATUS_IS_OK(result) &&
1866 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1867 return result;
1868 }
1869
1870 refresh_sequence_number(domain, false);
1871
1872 for (i=0; i<num_rids; i++) {
1873 DOM_SID sid;
1874 NTSTATUS status;
1875
1876 if (!sid_compose(&sid, domain_sid, rids[i])) {
1877 result = NT_STATUS_INTERNAL_ERROR;
1878 goto error;
1879 }
1880
1881 status = (*types)[i] == SID_NAME_UNKNOWN ?
1882 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1883
1884 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1885 (*names)[i], (*types)[i]);
1886 }
1887
1888 return result;
1889
1890 error:
1891 TALLOC_FREE(*names);
1892 TALLOC_FREE(*types);
1893 return result;
1894 }
1895
1896 /* Lookup user information from a rid */
1897 static NTSTATUS query_user(struct winbindd_domain *domain,
1898 TALLOC_CTX *mem_ctx,
1899 const DOM_SID *user_sid,
1900 WINBIND_USERINFO *info)
1901 {
1902 struct winbind_cache *cache = get_cache(domain);
1903 struct cache_entry *centry = NULL;
1904 NTSTATUS status;
1905 fstring tmp;
1906
1907 if (!cache->tdb)
1908 goto do_query;
1909
1910 centry = wcache_fetch(cache, domain, "U/%s",
1911 sid_to_fstring(tmp, user_sid));
1912
1913 /* If we have an access denied cache entry and a cached info3 in the
1914 samlogon cache then do a query. This will force the rpc back end
1915 to return the info3 data. */
1916
1917 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1918 netsamlogon_cache_have(user_sid)) {
1919 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1920 domain->last_status = NT_STATUS_OK;
1921 centry_free(centry);
1922 goto do_query;
1923 }
1924
1925 if (!centry)
1926 goto do_query;
1927
1928 /* if status is not ok then this is a negative hit
1929 and the rest of the data doesn't matter */
1930 status = centry->status;
1931 if (NT_STATUS_IS_OK(status)) {
1932 info->acct_name = centry_string(centry, mem_ctx);
1933 info->full_name = centry_string(centry, mem_ctx);
1934 info->homedir = centry_string(centry, mem_ctx);
1935 info->shell = centry_string(centry, mem_ctx);
1936 info->primary_gid = centry_uint32(centry);
1937 centry_sid(centry, mem_ctx, &info->user_sid);
1938 centry_sid(centry, mem_ctx, &info->group_sid);
1939 }
1940
1941 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: %s\n",
1942 domain->name, nt_errstr(status) ));
1943
1944 centry_free(centry);
1945 return status;
1946
1947 do_query:
1948 ZERO_STRUCTP(info);
1949
1950 /* Return status value returned by seq number check */
1951
1952 if (!NT_STATUS_IS_OK(domain->last_status))
1953 return domain->last_status;
1954
1955 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
1956 domain->name ));
1957
1958 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
1959
1960 /* and save it */
1961 refresh_sequence_number(domain, false);
1962 wcache_save_user(domain, status, info);
1963
1964 return status;
1965 }
1966
1967
1968 /* Lookup groups a user is a member of. */
1969 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
1970 TALLOC_CTX *mem_ctx,
1971 const DOM_SID *user_sid,
1972 uint32 *num_groups, DOM_SID **user_gids)
1973 {
1974 struct winbind_cache *cache = get_cache(domain);
1975 struct cache_entry *centry = NULL;
1976 NTSTATUS status;
1977 unsigned int i;
1978 fstring sid_string;
1979
1980 if (!cache->tdb)
1981 goto do_query;
1982
1983 centry = wcache_fetch(cache, domain, "UG/%s",
1984 sid_to_fstring(sid_string, user_sid));
1985
1986 /* If we have an access denied cache entry and a cached info3 in the
1987 samlogon cache then do a query. This will force the rpc back end
1988 to return the info3 data. */
1989
1990 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1991 netsamlogon_cache_have(user_sid)) {
1992 DEBUG(10, ("lookup_usergroups: cached access denied and have cached info3\n"));
1993 domain->last_status = NT_STATUS_OK;
1994 centry_free(centry);
1995 goto do_query;
1996 }
1997
1998 if (!centry)
1999 goto do_query;
2000
2001 *num_groups = centry_uint32(centry);
2002
2003 if (*num_groups == 0)
2004 goto do_cached;
2005
2006 (*user_gids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_groups);
2007 if (! (*user_gids)) {
2008 smb_panic_fn("lookup_usergroups out of memory");
2009 }
2010 for (i=0; i<(*num_groups); i++) {
2011 centry_sid(centry, mem_ctx, &(*user_gids)[i]);
2012 }
2013
2014 do_cached:
2015 status = centry->status;
2016
2017 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status: %s\n",
2018 domain->name, nt_errstr(status) ));
2019
2020 centry_free(centry);
2021 return status;
2022
2023 do_query:
2024 (*num_groups) = 0;
2025 (*user_gids) = NULL;
2026
2027 /* Return status value returned by seq number check */
2028
2029 if (!NT_STATUS_IS_OK(domain->last_status))
2030 return domain->last_status;
2031
2032 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2033 domain->name ));
2034
2035 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2036
2037 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2038 goto skip_save;
2039
2040 /* and save it */
2041 refresh_sequence_number(domain, false);
2042 centry = centry_start(domain, status);
2043 if (!centry)
2044 goto skip_save;
2045
2046 centry_put_uint32(centry, *num_groups);
2047 for (i=0; i<(*num_groups); i++) {
2048 centry_put_sid(centry, &(*user_gids)[i]);
2049 }
2050
2051 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2052 centry_free(centry);
2053
2054 skip_save:
2055 return status;
2056 }
2057
2058 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2059 TALLOC_CTX *mem_ctx,
2060 uint32 num_sids, const DOM_SID *sids,
2061 uint32 *num_aliases, uint32 **alias_rids)
2062 {
2063 struct winbind_cache *cache = get_cache(domain);
2064 struct cache_entry *centry = NULL;
2065 NTSTATUS status;
2066 char *sidlist = talloc_strdup(mem_ctx, "");
2067 int i;
2068
2069 if (!cache->tdb)
2070 goto do_query;
2071
2072 if (num_sids == 0) {
2073 *num_aliases = 0;
2074 *alias_rids = NULL;
2075 return NT_STATUS_OK;
2076 }
2077
2078 /* We need to cache indexed by the whole list of SIDs, the aliases
2079 * resulting might come from any of the SIDs. */
2080
2081 for (i=0; i<num_sids; i++) {
2082 fstring tmp;
2083 sidlist = talloc_asprintf(mem_ctx, "%s/%s", sidlist,
2084 sid_to_fstring(tmp, &sids[i]));
2085 if (sidlist == NULL)
2086 return NT_STATUS_NO_MEMORY;
2087 }
2088
2089 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2090
2091 if (!centry)
2092 goto do_query;
2093
2094 *num_aliases = centry_uint32(centry);
2095 *alias_rids = NULL;
2096
2097 if (*num_aliases) {
2098 (*alias_rids) = TALLOC_ARRAY(mem_ctx, uint32, *num_aliases);
2099
2100 if ((*alias_rids) == NULL) {
2101 centry_free(centry);
2102 return NT_STATUS_NO_MEMORY;
2103 }
2104 } else {
2105 (*alias_rids) = NULL;
2106 }
2107
2108 for (i=0; i<(*num_aliases); i++)
2109 (*alias_rids)[i] = centry_uint32(centry);
2110
2111 status = centry->status;
2112
2113 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2114 "status %s\n", domain->name, nt_errstr(status)));
2115
2116 centry_free(centry);
2117 return status;
2118
2119 do_query:
2120 (*num_aliases) = 0;
2121 (*alias_rids) = NULL;
2122
2123 if (!NT_STATUS_IS_OK(domain->last_status))
2124 return domain->last_status;
2125
2126 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2127 "for domain %s\n", domain->name ));
2128
2129 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2130 num_sids, sids,
2131 num_aliases, alias_rids);
2132
2133 /* and save it */
2134 refresh_sequence_number(domain, false);
2135 centry = centry_start(domain, status);
2136 if (!centry)
2137 goto skip_save;
2138 centry_put_uint32(centry, *num_aliases);
2139 for (i=0; i<(*num_aliases); i++)
2140 centry_put_uint32(centry, (*alias_rids)[i]);
2141 centry_end(centry, "UA%s", sidlist);
2142 centry_free(centry);
2143
2144 skip_save:
2145 return status;
2146 }
2147
2148
2149 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2150 TALLOC_CTX *mem_ctx,
2151 const DOM_SID *group_sid, uint32 *num_names,
2152 DOM_SID **sid_mem, char ***names,
2153 uint32 **name_types)
2154 {
2155 struct winbind_cache *cache = get_cache(domain);
2156 struct cache_entry *centry = NULL;
2157 NTSTATUS status;
2158 unsigned int i;
2159 fstring sid_string;
2160
2161 if (!cache->tdb)
2162 goto do_query;
2163
2164 centry = wcache_fetch(cache, domain, "GM/%s",
2165 sid_to_fstring(sid_string, group_sid));
2166 if (!centry)
2167 goto do_query;
2168
2169 *num_names = centry_uint32(centry);
2170
2171 if (*num_names == 0)
2172 goto do_cached;
2173
2174 (*sid_mem) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_names);
2175 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
2176 (*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
2177
2178 if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
2179 smb_panic_fn("lookup_groupmem out of memory");
2180 }
2181
2182 for (i=0; i<(*num_names); i++) {
2183 centry_sid(centry, mem_ctx, &(*sid_mem)[i]);
2184 (*names)[i] = centry_string(centry, mem_ctx);
2185 (*name_types)[i] = centry_uint32(centry);
2186 }
2187
2188 do_cached:
2189 status = centry->status;
2190
2191 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status: %s\n",
2192 domain->name, nt_errstr(status)));
2193
2194 centry_free(centry);
2195 return status;
2196
2197 do_query:
2198 (*num_names) = 0;
2199 (*sid_mem) = NULL;
2200 (*names) = NULL;
2201 (*name_types) = NULL;
2202
2203 /* Return status value returned by seq number check */
2204
2205 if (!NT_STATUS_IS_OK(domain->last_status))
2206 return domain->last_status;
2207
2208 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2209 domain->name ));
2210
2211 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2212 sid_mem, names, name_types);
2213
2214 /* and save it */
2215 refresh_sequence_number(domain, false);
2216 centry = centry_start(domain, status);
2217 if (!centry)
2218 goto skip_save;
2219 centry_put_uint32(centry, *num_names);
2220 for (i=0; i<(*num_names); i++) {
2221 centry_put_sid(centry, &(*sid_mem)[i]);
2222 centry_put_string(centry, (*names)[i]);
2223 centry_put_uint32(centry, (*name_types)[i]);
2224 }
2225 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2226 centry_free(centry);
2227
2228 skip_save:
2229 return status;
2230 }
2231
2232 /* find the sequence number for a domain */
2233 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2234 {
2235 refresh_sequence_number(domain, false);
2236
2237 *seq = domain->sequence_number;
2238
2239 return NT_STATUS_OK;
2240 }
2241
2242 /* enumerate trusted domains
2243 * (we need to have the list of trustdoms in the cache when we go offline) -
2244 * Guenther */
2245 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2246 TALLOC_CTX *mem_ctx,
2247 uint32 *num_domains,
2248 char ***names,
2249 char ***alt_names,
2250 DOM_SID **dom_sids)
2251 {
2252 struct winbind_cache *cache = get_cache(domain);
2253 struct cache_entry *centry = NULL;
2254 NTSTATUS status;
2255 int i;
2256
2257 if (!cache->tdb)
2258 goto do_query;
2259
2260 centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2261
2262 if (!centry) {
2263 goto do_query;
2264 }
2265
2266 *num_domains = centry_uint32(centry);
2267
2268 if (*num_domains) {
2269 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2270 (*alt_names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2271 (*dom_sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2272
2273 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2274 smb_panic_fn("trusted_domains out of memory");
2275 }
2276 } else {
2277 (*names) = NULL;
2278 (*alt_names) = NULL;
2279 (*dom_sids) = NULL;
2280 }
2281
2282 for (i=0; i<(*num_domains); i++) {
2283 (*names)[i] = centry_string(centry, mem_ctx);
2284 (*alt_names)[i] = centry_string(centry, mem_ctx);
2285 if (!centry_sid(centry, mem_ctx, &(*dom_sids)[i])) {
2286 sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2287 }
2288 }
2289
2290 status = centry->status;
2291
2292 DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2293 domain->name, *num_domains, nt_errstr(status) ));
2294
2295 centry_free(centry);
2296 return status;
2297
2298 do_query:
2299 (*num_domains) = 0;
2300 (*dom_sids) = NULL;
2301 (*names) = NULL;
2302 (*alt_names) = NULL;
2303
2304 /* Return status value returned by seq number check */
2305
2306 if (!NT_STATUS_IS_OK(domain->last_status))
2307 return domain->last_status;
2308
2309 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2310 domain->name ));
2311
2312 status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2313 names, alt_names, dom_sids);
2314
2315 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2316 * so that the generic centry handling still applies correctly -
2317 * Guenther*/
2318
2319 if (!NT_STATUS_IS_ERR(status)) {
2320 status = NT_STATUS_OK;
2321 }
2322
2323
2324 #if 0 /* Disabled as we want the trust dom list to be managed by
2325 the main parent and always to make the query. --jerry */
2326
2327 /* and save it */
2328 refresh_sequence_number(domain, false);
2329
2330 centry = centry_start(domain, status);
2331 if (!centry)
2332 goto skip_save;
2333
2334 centry_put_uint32(centry, *num_domains);
2335
2336 for (i=0; i<(*num_domains); i++) {
2337 centry_put_string(centry, (*names)[i]);
2338 centry_put_string(centry, (*alt_names)[i]);
2339 centry_put_sid(centry, &(*dom_sids)[i]);
2340 }
2341
2342 centry_end(centry, "TRUSTDOMS/%s", domain->name);
2343
2344 centry_free(centry);
2345
2346 skip_save:
2347 #endif
2348
2349 return status;
2350 }
2351
2352 /* get lockout policy */
2353 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2354 TALLOC_CTX *mem_ctx,
2355 struct samr_DomInfo12 *policy)
2356 {
2357 struct winbind_cache *cache = get_cache(domain);
2358 struct cache_entry *centry = NULL;
2359 NTSTATUS status;
2360
2361 if (!cache->tdb)
2362 goto do_query;
2363
2364 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2365
2366 if (!centry)
2367 goto do_query;
2368
2369 policy->lockout_duration = centry_nttime(centry);
2370 policy->lockout_window = centry_nttime(centry);
2371 policy->lockout_threshold = centry_uint16(centry);
2372
2373 status = centry->status;
2374
2375 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2376 domain->name, nt_errstr(status) ));
2377
2378 centry_free(centry);
2379 return status;
2380
2381 do_query:
2382 ZERO_STRUCTP(policy);
2383
2384 /* Return status value returned by seq number check */
2385
2386 if (!NT_STATUS_IS_OK(domain->last_status))
2387 return domain->last_status;
2388
2389 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2390 domain->name ));
2391
2392 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2393
2394 /* and save it */
2395 refresh_sequence_number(domain, false);
2396 wcache_save_lockout_policy(domain, status, policy);
2397
2398 return status;
2399 }
2400
2401 /* get password policy */
2402 static NTSTATUS password_policy(struct winbindd_domain *domain,
2403 TALLOC_CTX *mem_ctx,
2404 struct samr_DomInfo1 *policy)
2405 {
2406 struct winbind_cache *cache = get_cache(domain);
2407 struct cache_entry *centry = NULL;
2408 NTSTATUS status;
2409
2410 if (!cache->tdb)
2411 goto do_query;
2412
2413 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2414
2415 if (!centry)
2416 goto do_query;
2417
2418 policy->min_password_length = centry_uint16(centry);
2419 policy->password_history_length = centry_uint16(centry);
2420 policy->password_properties = centry_uint32(centry);
2421 policy->max_password_age = centry_nttime(centry);
2422 policy->min_password_age = centry_nttime(centry);
2423
2424 status = centry->status;
2425
2426 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2427 domain->name, nt_errstr(status) ));
2428
2429 centry_free(centry);
2430 return status;
2431
2432 do_query:
2433 ZERO_STRUCTP(policy);
2434
2435 /* Return status value returned by seq number check */
2436
2437 if (!NT_STATUS_IS_OK(domain->last_status))
2438 return domain->last_status;
2439
2440 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2441 domain->name ));
2442
2443 status = domain->backend->password_policy(domain, mem_ctx, policy);
2444
2445 /* and save it */
2446 refresh_sequence_number(domain, false);
2447 if (NT_STATUS_IS_OK(status)) {
2448 wcache_save_password_policy(domain, status, policy);
2449 }
2450
2451 return status;
2452 }
2453
2454
2455 /* Invalidate cached user and group lists coherently */
2456
2457 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2458 void *state)
2459 {
2460 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2461 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2462 tdb_delete(the_tdb, kbuf);
2463
2464 return 0;
2465 }
2466
2467 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2468
2469 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2470 struct netr_SamInfo3 *info3)
2471 {
2472 DOM_SID sid;
2473 fstring key_str, sid_string;
2474 struct winbind_cache *cache;
2475
2476 /* dont clear cached U/SID and UG/SID entries when we want to logon
2477 * offline - gd */
2478
2479 if (lp_winbind_offline_logon()) {
2480 return;
2481 }
2482
2483 if (!domain)
2484 return;
2485
2486 cache = get_cache(domain);
2487
2488 if (!cache->tdb) {
2489 return;
2490 }
2491
2492 sid_copy(&sid, info3->base.domain_sid);
2493 sid_append_rid(&sid, info3->base.rid);
2494
2495 /* Clear U/SID cache entry */
2496 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2497 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2498 tdb_delete(cache->tdb, string_tdb_data(key_str));
2499
2500 /* Clear UG/SID cache entry */
2501 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2502 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2503 tdb_delete(cache->tdb, string_tdb_data(key_str));
2504
2505 /* Samba/winbindd never needs this. */
2506 netsamlogon_clear_cached_user(info3);
2507 }
2508
2509 bool wcache_invalidate_cache(void)
2510 {
2511 struct winbindd_domain *domain;
2512
2513 for (domain = domain_list(); domain; domain = domain->next) {
2514 struct winbind_cache *cache = get_cache(domain);
2515
2516 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2517 "entries for %s\n", domain->name));
2518 if (cache) {
2519 if (cache->tdb) {
2520 tdb_traverse(cache->tdb, traverse_fn, NULL);
2521 } else {
2522 return false;
2523 }
2524 }
2525 }
2526 return true;
2527 }
2528
2529 bool init_wcache(void)
2530 {
2531 if (wcache == NULL) {
2532 wcache = SMB_XMALLOC_P(struct winbind_cache);
2533 ZERO_STRUCTP(wcache);
2534 }
2535
2536 if (wcache->tdb != NULL)
2537 return true;
2538
2539 /* when working offline we must not clear the cache on restart */
2540 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2541 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2542 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2543 O_RDWR|O_CREAT, 0600);
2544
2545 if (wcache->tdb == NULL) {
2546 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2547 return false;
2548 }
2549
2550 return true;
2551 }
2552
2553 /************************************************************************
2554 This is called by the parent to initialize the cache file.
2555 We don't need sophisticated locking here as we know we're the
2556 only opener.
2557 ************************************************************************/
2558
2559 bool initialize_winbindd_cache(void)
2560 {
2561 bool cache_bad = true;
2562 uint32 vers;
2563
2564 if (!init_wcache()) {
2565 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2566 return false;
2567 }
2568
2569 /* Check version number. */
2570 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2571 vers == WINBINDD_CACHE_VERSION) {
2572 cache_bad = false;
2573 }
2574
2575 if (cache_bad) {
2576 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2577 "and re-creating with version number %d\n",
2578 WINBINDD_CACHE_VERSION ));
2579
2580 tdb_close(wcache->tdb);
2581 wcache->tdb = NULL;
2582
2583 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2584 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2585 cache_path("winbindd_cache.tdb"),
2586 strerror(errno) ));
2587 return false;
2588 }
2589 if (!init_wcache()) {
2590 DEBUG(0,("initialize_winbindd_cache: re-initialization "
2591 "init_wcache failed.\n"));
2592 return false;
2593 }
2594
2595 /* Write the version. */
2596 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2597 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2598 tdb_errorstr(wcache->tdb) ));
2599 return false;
2600 }
2601 }
2602
2603 tdb_close(wcache->tdb);
2604 wcache->tdb = NULL;
2605 return true;
2606 }
2607
2608 void close_winbindd_cache(void)
2609 {
2610 if (!wcache) {
2611 return;
2612 }
2613 if (wcache->tdb) {
2614 tdb_close(wcache->tdb);
2615 wcache->tdb = NULL;
2616 }
2617 }
2618
2619 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2620 char **domain_name, char **name,
2621 enum lsa_SidType *type)
2622 {
2623 struct winbindd_domain *domain;
2624 struct winbind_cache *cache;
2625 struct cache_entry *centry = NULL;
2626 NTSTATUS status;
2627 fstring tmp;
2628
2629 domain = find_lookup_domain_from_sid(sid);
2630 if (domain == NULL) {
2631 return false;
2632 }
2633
2634 cache = get_cache(domain);
2635
2636 if (cache->tdb == NULL) {
2637 return false;
2638 }
2639
2640 centry = wcache_fetch(cache, domain, "SN/%s",
2641 sid_to_fstring(tmp, sid));
2642 if (centry == NULL) {
2643 return false;
2644 }
2645
2646 if (NT_STATUS_IS_OK(centry->status)) {
2647 *type = (enum lsa_SidType)centry_uint32(centry);
2648 *domain_name = centry_string(centry, mem_ctx);
2649 *name = centry_string(centry, mem_ctx);
2650 }
2651
2652 status = centry->status;
2653 centry_free(centry);
2654 return NT_STATUS_IS_OK(status);
2655 }
2656
2657 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2658 const char *domain_name,
2659 const char *name,
2660 DOM_SID *sid,
2661 enum lsa_SidType *type)
2662 {
2663 struct winbindd_domain *domain;
2664 struct winbind_cache *cache;
2665 struct cache_entry *centry = NULL;
2666 NTSTATUS status;
2667 fstring uname;
2668 bool original_online_state;
2669
2670 domain = find_lookup_domain_from_name(domain_name);
2671 if (domain == NULL) {
2672 return false;
2673 }
2674
2675 cache = get_cache(domain);
2676
2677 if (cache->tdb == NULL) {
2678 return false;
2679 }
2680
2681 fstrcpy(uname, name);
2682 strupper_m(uname);
2683
2684 /* If we are doing a cached logon, temporarily set the domain
2685 offline so the cache won't expire the entry */
2686
2687 original_online_state = domain->online;
2688 domain->online = false;
2689 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
2690 domain->online = original_online_state;
2691
2692 if (centry == NULL) {
2693 return false;
2694 }
2695
2696 if (NT_STATUS_IS_OK(centry->status)) {
2697 *type = (enum lsa_SidType)centry_uint32(centry);
2698 centry_sid(centry, mem_ctx, sid);
2699 }
2700
2701 status = centry->status;
2702 centry_free(centry);
2703
2704 return NT_STATUS_IS_OK(status);
2705 }
2706
2707 void cache_name2sid(struct winbindd_domain *domain,
2708 const char *domain_name, const char *name,
2709 enum lsa_SidType type, const DOM_SID *sid)
2710 {
2711 refresh_sequence_number(domain, false);
2712 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2713 sid, type);
2714 }
2715
2716 /*
2717 * The original idea that this cache only contains centries has
2718 * been blurred - now other stuff gets put in here. Ensure we
2719 * ignore these things on cleanup.
2720 */
2721
2722 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2723 TDB_DATA dbuf, void *state)
2724 {
2725 struct cache_entry *centry;
2726
2727 if (is_non_centry_key(kbuf)) {
2728 return 0;
2729 }
2730
2731 centry = wcache_fetch_raw((char *)kbuf.dptr);
2732 if (!centry) {
2733 return 0;
2734 }
2735
2736 if (!NT_STATUS_IS_OK(centry->status)) {
2737 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2738 tdb_delete(the_tdb, kbuf);
2739 }
2740
2741 centry_free(centry);
2742 return 0;
2743 }
2744
2745 /* flush the cache */
2746 void wcache_flush_cache(void)
2747 {
2748 if (!wcache)
2749 return;
2750 if (wcache->tdb) {
2751 tdb_close(wcache->tdb);
2752 wcache->tdb = NULL;
2753 }
2754 if (!winbindd_use_cache()) {
2755 return;
2756 }
2757
2758 /* when working offline we must not clear the cache on restart */
2759 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2760 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2761 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2762 O_RDWR|O_CREAT, 0600);
2763
2764 if (!wcache->tdb) {
2765 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2766 return;
2767 }
2768
2769 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2770
2771 DEBUG(10,("wcache_flush_cache success\n"));
2772 }
2773
2774 /* Count cached creds */
2775
2776 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2777 void *state)
2778 {
2779 int *cred_count = (int*)state;
2780
2781 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2782 (*cred_count)++;
2783 }
2784 return 0;
2785 }
2786
2787 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2788 {
2789 struct winbind_cache *cache = get_cache(domain);
2790
2791 *count = 0;
2792
2793 if (!cache->tdb) {
2794 return NT_STATUS_INTERNAL_DB_ERROR;
2795 }
2796
2797 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2798
2799 return NT_STATUS_OK;
2800 }
2801
2802 struct cred_list {
2803 struct cred_list *prev, *next;
2804 TDB_DATA key;
2805 fstring name;
2806 time_t created;
2807 };
2808 static struct cred_list *wcache_cred_list;
2809
2810 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2811 void *state)
2812 {
2813 struct cred_list *cred;
2814
2815 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2816
2817 cred = SMB_MALLOC_P(struct cred_list);
2818 if (cred == NULL) {
2819 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2820 return -1;
2821 }
2822
2823 ZERO_STRUCTP(cred);
2824
2825 /* save a copy of the key */
2826
2827 fstrcpy(cred->name, (const char *)kbuf.dptr);
2828 DLIST_ADD(wcache_cred_list, cred);
2829 }
2830
2831 return 0;
2832 }
2833
2834 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2835 {
2836 struct winbind_cache *cache = get_cache(domain);
2837 NTSTATUS status;
2838 int ret;
2839 struct cred_list *cred, *oldest = NULL;
2840
2841 if (!cache->tdb) {
2842 return NT_STATUS_INTERNAL_DB_ERROR;
2843 }
2844
2845 /* we possibly already have an entry */
2846 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2847
2848 fstring key_str, tmp;
2849
2850 DEBUG(11,("we already have an entry, deleting that\n"));
2851
2852 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2853
2854 tdb_delete(cache->tdb, string_tdb_data(key_str));
2855
2856 return NT_STATUS_OK;
2857 }
2858
2859 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2860 if (ret == 0) {
2861 return NT_STATUS_OK;
2862 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
2863 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2864 }
2865
2866 ZERO_STRUCTP(oldest);
2867
2868 for (cred = wcache_cred_list; cred; cred = cred->next) {
2869
2870 TDB_DATA data;
2871 time_t t;
2872
2873 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
2874 if (!data.dptr) {
2875 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
2876 cred->name));
2877 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2878 goto done;
2879 }
2880
2881 t = IVAL(data.dptr, 0);
2882 SAFE_FREE(data.dptr);
2883
2884 if (!oldest) {
2885 oldest = SMB_MALLOC_P(struct cred_list);
2886 if (oldest == NULL) {
2887 status = NT_STATUS_NO_MEMORY;
2888 goto done;
2889 }
2890
2891 fstrcpy(oldest->name, cred->name);
2892 oldest->created = t;
2893 continue;
2894 }
2895
2896 if (t < oldest->created) {
2897 fstrcpy(oldest->name, cred->name);
2898 oldest->created = t;
2899 }
2900 }
2901
2902 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
2903 status = NT_STATUS_OK;
2904 } else {
2905 status = NT_STATUS_UNSUCCESSFUL;
2906 }
2907 done:
2908 SAFE_FREE(wcache_cred_list);
2909 SAFE_FREE(oldest);
2910
2911 return status;
2912 }
2913
2914 /* Change the global online/offline state. */
2915 bool set_global_winbindd_state_offline(void)
2916 {
2917 TDB_DATA data;
2918
2919 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
2920
2921 /* Only go offline if someone has created
2922 the key "WINBINDD_OFFLINE" in the cache tdb. */
2923
2924 if (wcache == NULL || wcache->tdb == NULL) {
2925 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
2926 return false;
2927 }
2928
2929 if (!lp_winbind_offline_logon()) {
2930 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
2931 return false;
2932 }
2933
2934 if (global_winbindd_offline_state) {
2935 /* Already offline. */
2936 return true;
2937 }
2938
2939 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
2940
2941 if (!data.dptr || data.dsize != 4) {
2942 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
2943 SAFE_FREE(data.dptr);
2944 return false;
2945 } else {
2946 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
2947 global_winbindd_offline_state = true;
2948 SAFE_FREE(data.dptr);
2949 return true;
2950 }
2951 }
2952
2953 void set_global_winbindd_state_online(void)
2954 {
2955 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
2956
2957 if (!lp_winbind_offline_logon()) {
2958 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
2959 return;
2960 }
2961
2962 if (!global_winbindd_offline_state) {
2963 /* Already online. */
2964 return;
2965 }
2966 global_winbindd_offline_state = false;
2967
2968 if (!wcache->tdb) {
2969 return;
2970 }
2971
2972 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
2973 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
2974 }
2975
2976 bool get_global_winbindd_state_offline(void)
2977 {
2978 return global_winbindd_offline_state;
2979 }
2980
2981 /***********************************************************************
2982 Validate functions for all possible cache tdb keys.
2983 ***********************************************************************/
2984
2985 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
2986 struct tdb_validation_status *state)
2987 {
2988 struct cache_entry *centry;
2989
2990 centry = SMB_XMALLOC_P(struct cache_entry);
2991 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
2992 if (!centry->data) {
2993 SAFE_FREE(centry);
2994 return NULL;
2995 }
2996 centry->len = data.dsize;
2997 centry->ofs = 0;
2998
2999 if (centry->len < 8) {
3000 /* huh? corrupt cache? */
3001 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3002 centry_free(centry);
3003 state->bad_entry = true;
3004 state->success = false;
3005 return NULL;
3006 }
3007
3008 centry->status = NT_STATUS(centry_uint32(centry));
3009 centry->sequence_number = centry_uint32(centry);
3010 return centry;
3011 }
3012
3013 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3014 struct tdb_validation_status *state)
3015 {
3016 if (dbuf.dsize != 8) {
3017 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3018 keystr, (unsigned int)dbuf.dsize ));
3019 state->bad_entry = true;
3020 return 1;
3021 }
3022 return 0;
3023 }
3024
3025 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3026 struct tdb_validation_status *state)
3027 {
3028 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3029 if (!centry) {
3030 return 1;
3031 }
3032
3033 (void)centry_uint32(centry);
3034 if (NT_STATUS_IS_OK(centry->status)) {
3035 DOM_SID sid;
3036 (void)centry_sid(centry, mem_ctx, &sid);
3037 }
3038
3039 centry_free(centry);
3040
3041 if (!(state->success)) {
3042 return 1;
3043 }
3044 DEBUG(10,("validate_ns: %s ok\n", keystr));
3045 return 0;
3046 }
3047
3048 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3049 struct tdb_validation_status *state)
3050 {
3051 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3052 if (!centry) {
3053 return 1;
3054 }
3055
3056 if (NT_STATUS_IS_OK(centry->status)) {
3057 (void)centry_uint32(centry);
3058 (void)centry_string(centry, mem_ctx);
3059 (void)centry_string(centry, mem_ctx);
3060 }
3061
3062 centry_free(centry);
3063
3064 if (!(state->success)) {
3065 return 1;
3066 }
3067 DEBUG(10,("validate_sn: %s ok\n", keystr));
3068 return 0;
3069 }
3070
3071 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3072 struct tdb_validation_status *state)
3073 {
3074 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3075 DOM_SID sid;
3076
3077 if (!centry) {
3078 return 1;
3079 }
3080
3081 (void)centry_string(centry, mem_ctx);
3082 (void)centry_string(centry, mem_ctx);
3083 (void)centry_string(centry, mem_ctx);
3084 (void)centry_string(centry, mem_ctx);
3085 (void)centry_uint32(centry);
3086 (void)centry_sid(centry, mem_ctx, &sid);
3087 (void)centry_sid(centry, mem_ctx, &sid);
3088
3089 centry_free(centry);
3090
3091 if (!(state->success)) {
3092 return 1;
3093 }
3094 DEBUG(10,("validate_u: %s ok\n", keystr));
3095 return 0;
3096 }
3097
3098 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3099 struct tdb_validation_status *state)
3100 {
3101 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3102
3103 if (!centry) {
3104 return 1;
3105 }
3106
3107 (void)centry_nttime(centry);
3108 (void)centry_nttime(centry);
3109 (void)centry_uint16(centry);
3110
3111 centry_free(centry);
3112
3113 if (!(state->success)) {
3114 return 1;
3115 }
3116 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3117 return 0;
3118 }
3119
3120 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3121 struct tdb_validation_status *state)
3122 {
3123 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3124
3125 if (!centry) {
3126 return 1;
3127 }
3128
3129 (void)centry_uint16(centry);
3130 (void)centry_uint16(centry);
3131 (void)centry_uint32(centry);
3132 (void)centry_nttime(centry);
3133 (void)centry_nttime(centry);
3134
3135 centry_free(centry);
3136
3137 if (!(state->success)) {
3138 return 1;
3139 }
3140 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3141 return 0;
3142 }
3143
3144 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3145 struct tdb_validation_status *state)
3146 {
3147 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3148
3149 if (!centry) {
3150 return 1;
3151 }
3152
3153 (void)centry_time(centry);
3154 (void)centry_hash16(centry, mem_ctx);
3155
3156 /* We only have 17 bytes more data in the salted cred case. */
3157 if (centry->len - centry->ofs == 17) {
3158 (void)centry_hash16(centry, mem_ctx);
3159 }
3160
3161 centry_free(centry);
3162
3163 if (!(state->success)) {
3164 return 1;
3165 }
3166 DEBUG(10,("validate_cred: %s ok\n", keystr));
3167 return 0;
3168 }
3169
3170 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3171 struct tdb_validation_status *state)
3172 {
3173 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3174 int32 num_entries, i;
3175
3176 if (!centry) {
3177 return 1;
3178 }
3179
3180 num_entries = (int32)centry_uint32(centry);
3181
3182 for (i=0; i< num_entries; i++) {
3183 DOM_SID sid;
3184 (void)centry_string(centry, mem_ctx);
3185 (void)centry_string(centry, mem_ctx);
3186 (void)centry_string(centry, mem_ctx);
3187 (void)centry_string(centry, mem_ctx);
3188 (void)centry_sid(centry, mem_ctx, &sid);
3189 (void)centry_sid(centry, mem_ctx, &sid);
3190 }
3191
3192 centry_free(centry);
3193
3194 if (!(state->success)) {
3195 return 1;
3196 }
3197 DEBUG(10,("validate_ul: %s ok\n", keystr));
3198 return 0;
3199 }
3200
3201 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3202 struct tdb_validation_status *state)
3203 {
3204 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3205 int32 num_entries, i;
3206
3207 if (!centry) {
3208 return 1;
3209 }
3210
3211 num_entries = centry_uint32(centry);
3212
3213 for (i=0; i< num_entries; i++) {
3214 (void)centry_string(centry, mem_ctx);
3215 (void)centry_string(centry, mem_ctx);
3216 (void)centry_uint32(centry);
3217 }
3218
3219 centry_free(centry);
3220
3221 if (!(state->success)) {
3222 return 1;
3223 }
3224 DEBUG(10,("validate_gl: %s ok\n", keystr));
3225 return 0;
3226 }
3227
3228 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3229 struct tdb_validation_status *state)
3230 {
3231 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3232 int32 num_groups, i;
3233
3234 if (!centry) {
3235 return 1;
3236 }
3237
3238 num_groups = centry_uint32(centry);
3239
3240 for (i=0; i< num_groups; i++) {
3241 DOM_SID sid;
3242 centry_sid(centry, mem_ctx, &sid);
3243 }
3244
3245 centry_free(centry);
3246
3247 if (!(state->success)) {
3248 return 1;
3249 }
3250 DEBUG(10,("validate_ug: %s ok\n", keystr));
3251 return 0;
3252 }
3253
3254 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3255 struct tdb_validation_status *state)
3256 {
3257 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3258 int32 num_aliases, i;
3259
3260 if (!centry) {
3261 return 1;
3262 }
3263
3264 num_aliases = centry_uint32(centry);
3265
3266 for (i=0; i < num_aliases; i++) {
3267 (void)centry_uint32(centry);
3268 }
3269
3270 centry_free(centry);
3271
3272 if (!(state->success)) {
3273 return 1;
3274 }
3275 DEBUG(10,("validate_ua: %s ok\n", keystr));
3276 return 0;
3277 }
3278
3279 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3280 struct tdb_validation_status *state)
3281 {
3282 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3283 int32 num_names, i;
3284
3285 if (!centry) {
3286 return 1;
3287 }
3288
3289 num_names = centry_uint32(centry);
3290
3291 for (i=0; i< num_names; i++) {
3292 DOM_SID sid;
3293 centry_sid(centry, mem_ctx, &sid);
3294 (void)centry_string(centry, mem_ctx);
3295 (void)centry_uint32(centry);
3296 }
3297
3298 centry_free(centry);
3299
3300 if (!(state->success)) {
3301 return 1;
3302 }
3303 DEBUG(10,("validate_gm: %s ok\n", keystr));
3304 return 0;
3305 }
3306
3307 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3308 struct tdb_validation_status *state)
3309 {
3310 /* Can't say anything about this other than must be nonzero. */
3311 if (dbuf.dsize == 0) {
3312 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3313 keystr));
3314 state->bad_entry = true;
3315 state->success = false;
3316 return 1;
3317 }
3318
3319 DEBUG(10,("validate_dr: %s ok\n", keystr));
3320 return 0;
3321 }
3322
3323 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3324 struct tdb_validation_status *state)
3325 {
3326 /* Can't say anything about this other than must be nonzero. */
3327 if (dbuf.dsize == 0) {
3328 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3329 keystr));
3330 state->bad_entry = true;
3331 state->success = false;
3332 return 1;
3333 }
3334
3335 DEBUG(10,("validate_de: %s ok\n", keystr));
3336 return 0;
3337 }
3338
3339 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3340 TDB_DATA dbuf, struct tdb_validation_status *state)
3341 {
3342 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3343
3344 if (!centry) {
3345 return 1;
3346 }
3347
3348 (void)centry_string(centry, mem_ctx);
3349 (void)centry_string(centry, mem_ctx);
3350 (void)centry_string(centry, mem_ctx);
3351 (void)centry_uint32(centry);
3352
3353 centry_free(centry);
3354
3355 if (!(state->success)) {
3356 return 1;
3357 }
3358 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3359 return 0;
3360 }
3361
3362 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3363 TDB_DATA dbuf,
3364 struct tdb_validation_status *state)
3365 {
3366 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3367
3368 if (!centry) {
3369 return 1;
3370 }
3371
3372 (void)centry_string( centry, mem_ctx );
3373
3374 centry_free(centry);
3375
3376 if (!(state->success)) {
3377 return 1;
3378 }
3379 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3380 return 0;
3381 }
3382
3383 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3384 TDB_DATA dbuf,
3385 struct tdb_validation_status *state)
3386 {
3387 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3388
3389 if (!centry) {
3390 return 1;
3391 }
3392
3393 (void)centry_string( centry, mem_ctx );
3394
3395 centry_free(centry);
3396
3397 if (!(state->success)) {
3398 return 1;
3399 }
3400 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3401 return 0;
3402 }
3403
3404 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3405 struct tdb_validation_status *state)
3406 {
3407 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3408 int32 num_domains, i;
3409
3410 if (!centry) {
3411 return 1;
3412 }
3413
3414 num_domains = centry_uint32(centry);
3415
3416 for (i=0; i< num_domains; i++) {
3417 DOM_SID sid;
3418 (void)centry_string(centry, mem_ctx);
3419 (void)centry_string(centry, mem_ctx);
3420 (void)centry_sid(centry, mem_ctx, &sid);
3421 }
3422
3423 centry_free(centry);
3424
3425 if (!(state->success)) {
3426 return 1;
3427 }
3428 DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3429 return 0;
3430 }
3431
3432 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3433 TDB_DATA dbuf,
3434 struct tdb_validation_status *state)
3435 {
3436 if (dbuf.dsize == 0) {
3437 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3438 "key %s (len ==0) ?\n", keystr));
3439 state->bad_entry = true;
3440 state->success = false;
3441 return 1;
3442 }
3443
3444 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3445 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3446 return 0;
3447 }
3448
3449 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3450 struct tdb_validation_status *state)
3451 {
3452 if (dbuf.dsize != 4) {
3453 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3454 keystr, (unsigned int)dbuf.dsize ));
3455 state->bad_entry = true;
3456 state->success = false;
3457 return 1;
3458 }
3459 DEBUG(10,("validate_offline: %s ok\n", keystr));
3460 return 0;
3461 }
3462
3463 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3464 struct tdb_validation_status *state)
3465 {
3466 if (dbuf.dsize != 4) {
3467 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3468 "key %s (len %u != 4) ?\n",
3469 keystr, (unsigned int)dbuf.dsize));
3470 state->bad_entry = true;
3471 state->success = false;
3472 return 1;
3473 }
3474
3475 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3476 return 0;
3477 }
3478
3479 /***********************************************************************
3480 A list of all possible cache tdb keys with associated validation
3481 functions.
3482 ***********************************************************************/
3483
3484 struct key_val_struct {
3485 const char *keyname;
3486 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3487 } key_val[] = {
3488 {"SEQNUM/", validate_seqnum},
3489 {"NS/", validate_ns},
3490 {"SN/", validate_sn},
3491 {"U/", validate_u},
3492 {"LOC_POL/", validate_loc_pol},
3493 {"PWD_POL/", validate_pwd_pol},
3494 {"CRED/", validate_cred},
3495 {"UL/", validate_ul},
3496 {"GL/", validate_gl},
3497 {"UG/", validate_ug},
3498 {"UA", validate_ua},
3499 {"GM/", validate_gm},
3500 {"DR/", validate_dr},
3501 {"DE/", validate_de},
3502 {"NSS/PWINFO/", validate_pwinfo},
3503 {"TRUSTDOMS/", validate_trustdoms},
3504 {"TRUSTDOMCACHE/", validate_trustdomcache},
3505 {"NSS/NA/", validate_nss_na},
3506 {"NSS/AN/", validate_nss_an},
3507 {"WINBINDD_OFFLINE", validate_offline},
3508 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3509 {NULL, NULL}
3510 };
3511
3512 /***********************************************************************
3513 Function to look at every entry in the tdb and validate it as far as
3514 possible.
3515 ***********************************************************************/
3516
3517 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3518 {
3519 int i;
3520 unsigned int max_key_len = 1024;
3521 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3522
3523 /* Paranoia check. */
3524 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3525 max_key_len = 1024 * 1024;
3526 }
3527 if (kbuf.dsize > max_key_len) {
3528 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3529 "(%u) > (%u)\n\n",
3530 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3531 return 1;
3532 }
3533
3534 for (i = 0; key_val[i].keyname; i++) {
3535 size_t namelen = strlen(key_val[i].keyname);
3536 if (kbuf.dsize >= namelen && (
3537 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3538 TALLOC_CTX *mem_ctx;
3539 char *keystr;
3540 int ret;
3541
3542 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3543 if (!keystr) {
3544 return 1;
3545 }
3546 memcpy(keystr, kbuf.dptr, kbuf.dsize);
3547 keystr[kbuf.dsize] = '\0';
3548
3549 mem_ctx = talloc_init("validate_ctx");
3550 if (!mem_ctx) {
3551 SAFE_FREE(keystr);
3552 return 1;
3553 }
3554
3555 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3556 v_state);
3557
3558 SAFE_FREE(keystr);
3559 talloc_destroy(mem_ctx);
3560 return ret;
3561 }
3562 }
3563
3564 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3565 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3566 DEBUG(0,("data :\n"));
3567 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3568 v_state->unknown_key = true;
3569 v_state->success = false;
3570 return 1; /* terminate. */
3571 }
3572
3573 static void validate_panic(const char *const why)
3574 {
3575 DEBUG(0,("validating cache: would panic %s\n", why ));
3576 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3577 exit(47);
3578 }
3579
3580 /***********************************************************************
3581 Try and validate every entry in the winbindd cache. If we fail here,
3582 delete the cache tdb and return non-zero.
3583 ***********************************************************************/
3584
3585 int winbindd_validate_cache(void)
3586 {
3587 int ret = -1;
3588 const char *tdb_path = cache_path("winbindd_cache.tdb");
3589 TDB_CONTEXT *tdb = NULL;
3590
3591 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3592 smb_panic_fn = validate_panic;
3593
3594
3595 tdb = tdb_open_log(tdb_path,
3596 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3597 ( lp_winbind_offline_logon()
3598 ? TDB_DEFAULT
3599 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3600 O_RDWR|O_CREAT,
3601 0600);
3602 if (!tdb) {
3603 DEBUG(0, ("winbindd_validate_cache: "
3604 "error opening/initializing tdb\n"));
3605 goto done;
3606 }
3607 tdb_close(tdb);
3608
3609 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3610
3611 if (ret != 0) {
3612 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3613 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3614 unlink(tdb_path);
3615 }
3616
3617 done:
3618 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3619 smb_panic_fn = smb_panic;
3620 return ret;
3621 }
3622
3623 /***********************************************************************
3624 Try and validate every entry in the winbindd cache.
3625 ***********************************************************************/
3626
3627 int winbindd_validate_cache_nobackup(void)
3628 {
3629 int ret = -1;
3630 const char *tdb_path = cache_path("winbindd_cache.tdb");
3631
3632 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3633 smb_panic_fn = validate_panic;
3634
3635
3636 if (wcache == NULL || wcache->tdb == NULL) {
3637 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3638 } else {
3639 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3640 }
3641
3642 if (ret != 0) {
3643 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3644 "successful.\n"));
3645 }
3646
3647 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3648 "function\n"));
3649 smb_panic_fn = smb_panic;
3650 return ret;
3651 }
3652
3653 bool winbindd_cache_validate_and_initialize(void)
3654 {
3655 close_winbindd_cache();
3656
3657 if (lp_winbind_offline_logon()) {
3658 if (winbindd_validate_cache() < 0) {
3659 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3660 "could be restored.\n"));
3661 }
3662 }
3663
3664 return initialize_winbindd_cache();
3665 }
3666
3667 /*********************************************************************
3668 ********************************************************************/
3669
3670 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3671 struct winbindd_tdc_domain **domains,
3672 size_t *num_domains )
3673 {
3674 struct winbindd_tdc_domain *list = NULL;
3675 size_t idx;
3676 int i;
3677 bool set_only = false;
3678
3679 /* don't allow duplicates */
3680
3681 idx = *num_domains;
3682 list = *domains;
3683
3684 for ( i=0; i< (*num_domains); i++ ) {
3685 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3686 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3687 new_dom->name));
3688 idx = i;
3689 set_only = true;
3690
3691 break;
3692 }
3693 }
3694
3695 if ( !set_only ) {
3696 if ( !*domains ) {
3697 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3698 idx = 0;
3699 } else {
3700 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3701 struct winbindd_tdc_domain,
3702 (*num_domains)+1);
3703 idx = *num_domains;
3704 }
3705
3706 ZERO_STRUCT( list[idx] );
3707 }
3708
3709 if ( !list )
3710 return false;
3711
3712 list[idx].domain_name = talloc_strdup( list, new_dom->name );
3713 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3714
3715 if ( !is_null_sid( &new_dom->sid ) ) {
3716 sid_copy( &list[idx].sid, &new_dom->sid );
3717 } else {
3718 sid_copy(&list[idx].sid, &global_sid_NULL);
3719 }
3720
3721 if ( new_dom->domain_flags != 0x0 )
3722 list[idx].trust_flags = new_dom->domain_flags;
3723
3724 if ( new_dom->domain_type != 0x0 )
3725 list[idx].trust_type = new_dom->domain_type;
3726
3727 if ( new_dom->domain_trust_attribs != 0x0 )
3728 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3729
3730 if ( !set_only ) {
3731 *domains = list;
3732 *num_domains = idx + 1;
3733 }
3734
3735 return true;
3736 }
3737
3738 /*********************************************************************
3739 ********************************************************************/
3740
3741 static TDB_DATA make_tdc_key( const char *domain_name )
3742 {
3743 char *keystr = NULL;
3744 TDB_DATA key = { NULL, 0 };
3745
3746 if ( !domain_name ) {
3747 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3748 return key;
3749 }
3750
3751 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3752 return key;
3753 }
3754 key = string_term_tdb_data(keystr);
3755
3756 return key;
3757 }
3758
3759 /*********************************************************************
3760 ********************************************************************/
3761
3762 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3763 size_t num_domains,
3764 unsigned char **buf )
3765 {
3766 unsigned char *buffer = NULL;
3767 int len = 0;
3768 int buflen = 0;
3769 int i = 0;
3770
3771 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3772 (int)num_domains));
3773
3774 buflen = 0;
3775
3776 again:
3777 len = 0;
3778
3779 /* Store the number of array items first */
3780 len += tdb_pack( buffer+len, buflen-len, "d",
3781 num_domains );
3782
3783 /* now pack each domain trust record */
3784 for ( i=0; i<num_domains; i++ ) {
3785
3786 fstring tmp;
3787
3788 if ( buflen > 0 ) {
3789 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3790 domains[i].domain_name,
3791 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3792 }
3793
3794 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3795 domains[i].domain_name,
3796 domains[i].dns_name,
3797 sid_to_fstring(tmp, &domains[i].sid),
3798 domains[i].trust_flags,
3799 domains[i].trust_attribs,
3800 domains[i].trust_type );
3801 }
3802
3803 if ( buflen < len ) {
3804 SAFE_FREE(buffer);
3805 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3806 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3807 buflen = -1;
3808 goto done;
3809 }
3810 buflen = len;
3811 goto again;
3812 }
3813
3814 *buf = buffer;
3815
3816 done:
3817 return buflen;
3818 }
3819
3820 /*********************************************************************
3821 ********************************************************************/
3822
3823 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3824 struct winbindd_tdc_domain **domains )
3825 {
3826 fstring domain_name, dns_name, sid_string;
3827 uint32 type, attribs, flags;
3828 int num_domains;
3829 int len = 0;
3830 int i;
3831 struct winbindd_tdc_domain *list = NULL;
3832
3833 /* get the number of domains */
3834 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3835 if ( len == -1 ) {
3836 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3837 return 0;
3838 }
3839
3840 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3841 if ( !list ) {
3842 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3843 return 0;
3844 }
3845
3846 for ( i=0; i<num_domains; i++ ) {
3847 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3848 domain_name,
3849 dns_name,
3850 sid_string,
3851 &flags,
3852 &attribs,
3853 &type );
3854
3855 if ( len == -1 ) {
3856 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3857 TALLOC_FREE( list );
3858 return 0;
3859 }
3860
3861 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
3862 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
3863 domain_name, dns_name, sid_string,
3864 flags, attribs, type));
3865
3866 list[i].domain_name = talloc_strdup( list, domain_name );
3867 list[i].dns_name = talloc_strdup( list, dns_name );
3868 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
3869 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
3870 domain_name));
3871 }
3872 list[i].trust_flags = flags;
3873 list[i].trust_attribs = attribs;
3874 list[i].trust_type = type;
3875 }
3876
3877 *domains = list;
3878
3879 return num_domains;
3880 }
3881
3882 /*********************************************************************
3883 ********************************************************************/
3884
3885 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
3886 {
3887 TDB_DATA key = make_tdc_key( lp_workgroup() );
3888 TDB_DATA data = { NULL, 0 };
3889 int ret;
3890
3891 if ( !key.dptr )
3892 return false;
3893
3894 /* See if we were asked to delete the cache entry */
3895
3896 if ( !domains ) {
3897 ret = tdb_delete( wcache->tdb, key );
3898 goto done;
3899 }
3900
3901 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
3902
3903 if ( !data.dptr ) {
3904 ret = -1;
3905 goto done;
3906 }
3907
3908 ret = tdb_store( wcache->tdb, key, data, 0 );
3909
3910 done:
3911 SAFE_FREE( data.dptr );
3912 SAFE_FREE( key.dptr );
3913
3914 return ( ret != -1 );
3915 }
3916
3917 /*********************************************************************
3918 ********************************************************************/
3919
3920 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
3921 {
3922 TDB_DATA key = make_tdc_key( lp_workgroup() );
3923 TDB_DATA data = { NULL, 0 };
3924
3925 *domains = NULL;
3926 *num_domains = 0;
3927
3928 if ( !key.dptr )
3929 return false;
3930
3931 data = tdb_fetch( wcache->tdb, key );
3932
3933 SAFE_FREE( key.dptr );
3934
3935 if ( !data.dptr )
3936 return false;
3937
3938 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
3939
3940 SAFE_FREE( data.dptr );
3941
3942 if ( !*domains )
3943 return false;
3944
3945 return true;
3946 }
3947
3948 /*********************************************************************
3949 ********************************************************************/
3950
3951 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
3952 {
3953 struct winbindd_tdc_domain *dom_list = NULL;
3954 size_t num_domains = 0;
3955 bool ret = false;
3956
3957 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
3958 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
3959 domain->name, domain->alt_name,
3960 sid_string_dbg(&domain->sid),
3961 domain->domain_flags,
3962 domain->domain_trust_attribs,
3963 domain->domain_type));
3964
3965 if ( !init_wcache() ) {
3966 return false;
3967 }
3968
3969 /* fetch the list */
3970
3971 wcache_tdc_fetch_list( &dom_list, &num_domains );
3972
3973 /* add the new domain */
3974
3975 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
3976 goto done;
3977 }
3978
3979 /* pack the domain */
3980
3981 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
3982 goto done;
3983 }
3984
3985 /* Success */
3986
3987 ret = true;
3988 done:
3989 TALLOC_FREE( dom_list );
3990
3991 return ret;
3992 }
3993
3994 /*********************************************************************
3995 ********************************************************************/
3996
3997 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
3998 {
3999 struct winbindd_tdc_domain *dom_list = NULL;
4000 size_t num_domains = 0;
4001 int i;
4002 struct winbindd_tdc_domain *d = NULL;
4003
4004 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4005
4006 if ( !init_wcache() ) {
4007 return false;
4008 }
4009
4010 /* fetch the list */
4011
4012 wcache_tdc_fetch_list( &dom_list, &num_domains );
4013
4014 for ( i=0; i<num_domains; i++ ) {
4015 if ( strequal(name, dom_list[i].domain_name) ||
4016 strequal(name, dom_list[i].dns_name) )
4017 {
4018 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4019 name));
4020
4021 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4022 if ( !d )
4023 break;
4024
4025 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4026 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4027 sid_copy( &d->sid, &dom_list[i].sid );
4028 d->trust_flags = dom_list[i].trust_flags;
4029 d->trust_type = dom_list[i].trust_type;
4030 d->trust_attribs = dom_list[i].trust_attribs;
4031
4032 break;
4033 }
4034 }
4035
4036 TALLOC_FREE( dom_list );
4037
4038 return d;
4039 }
4040
4041
4042 /*********************************************************************
4043 ********************************************************************/
4044
4045 void wcache_tdc_clear( void )
4046 {
4047 if ( !init_wcache() )
4048 return;
4049
4050 wcache_tdc_store_list( NULL, 0 );
4051
4052 return;
4053 }
4054
4055
4056 /*********************************************************************
4057 ********************************************************************/
4058
4059 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4060 NTSTATUS status,
4061 const DOM_SID *user_sid,
4062 const char *homedir,
4063 const char *shell,
4064 const char *gecos,
4065 uint32 gid)
4066 {
4067 struct cache_entry *centry;
4068 fstring tmp;
4069
4070 if ( (centry = centry_start(domain, status)) == NULL )
4071 return;
4072
4073 centry_put_string( centry, homedir );
4074 centry_put_string( centry, shell );
4075 centry_put_string( centry, gecos );
4076 centry_put_uint32( centry, gid );
4077
4078 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4079
4080 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4081
4082 centry_free(centry);
4083 }
4084
4085 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4086 const DOM_SID *user_sid,
4087 TALLOC_CTX *ctx,
4088 ADS_STRUCT *ads, LDAPMessage *msg,
4089 char **homedir, char **shell, char **gecos,
4090 gid_t *p_gid)
4091 {
4092 struct winbind_cache *cache = get_cache(domain);
4093 struct cache_entry *centry = NULL;
4094 NTSTATUS nt_status;
4095 fstring tmp;
4096
4097 if (!cache->tdb)
4098 goto do_query;
4099
4100 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4101 sid_to_fstring(tmp, user_sid));
4102
4103 if (!centry)
4104 goto do_query;
4105
4106 *homedir = centry_string( centry, ctx );
4107 *shell = centry_string( centry, ctx );
4108 *gecos = centry_string( centry, ctx );
4109 *p_gid = centry_uint32( centry );
4110
4111 centry_free(centry);
4112
4113 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4114 sid_string_dbg(user_sid)));
4115
4116 return NT_STATUS_OK;
4117
4118 do_query:
4119
4120 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4121 homedir, shell, gecos, p_gid );
4122
4123 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4124
4125 if ( NT_STATUS_IS_OK(nt_status) ) {
4126 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4127 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4128 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4129 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4130
4131 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4132 *homedir, *shell, *gecos, *p_gid );
4133 }
4134
4135 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4136 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4137 domain->name ));
4138 set_domain_offline( domain );
4139 }
4140
4141 return nt_status;
4142 }
4143
4144
4145 /* the cache backend methods are exposed via this structure */
4146 struct winbindd_methods cache_methods = {
4147 true,
4148 query_user_list,
4149 enum_dom_groups,
4150 enum_local_groups,
4151 name_to_sid,
4152 sid_to_name,
4153 rids_to_names,
4154 query_user,
4155 lookup_usergroups,
4156 lookup_useraliases,
4157 lookup_groupmem,
4158 sequence_number,
4159 lockout_policy,
4160 password_policy,
4161 trusted_domains
4162 };
reg import