2 Unix SMB/CIFS implementation.
4 Winbind cache backend functions
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003-2007
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2005
10 Copyright (C) Michael Adam 2007
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #include "tdb_validate.h"
29 #include "../libcli/auth/libcli_auth.h"
32 #define DBGC_CLASS DBGC_WINBIND
34 #define WINBINDD_CACHE_VERSION 1
35 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
37 extern struct winbindd_methods reconnect_methods;
39 extern struct winbindd_methods ads_methods;
41 extern struct winbindd_methods builtin_passdb_methods;
44 * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
45 * Here are the list of entry types that are *not* stored
46 * as form struct cache_entry in the cache.
49 static const char *non_centry_keys[] = {
54 WINBINDD_CACHE_VERSION_KEYSTR,
58 /************************************************************************
59 Is this key a non-centry type ?
60 ************************************************************************/
62 static bool is_non_centry_key(TDB_DATA kbuf)
66 if (kbuf.dptr == NULL || kbuf.dsize == 0) {
69 for (i = 0; non_centry_keys[i] != NULL; i++) {
70 size_t namelen = strlen(non_centry_keys[i]);
71 if (kbuf.dsize < namelen) {
74 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
81 /* Global online/offline state - False when online. winbindd starts up online
82 and sets this to true if the first query fails and there's an entry in
83 the cache tdb telling us to stay offline. */
85 static bool global_winbindd_offline_state;
87 struct winbind_cache {
93 uint32 sequence_number;
98 void (*smb_panic_fn)(const char *const why) = smb_panic;
100 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
102 static struct winbind_cache *wcache;
104 void winbindd_check_cache_size(time_t t)
106 static time_t last_check_time;
109 if (last_check_time == (time_t)0)
112 if (t - last_check_time < 60 && t - last_check_time > 0)
115 if (wcache == NULL || wcache->tdb == NULL) {
116 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
120 if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
121 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
125 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
126 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
127 (unsigned long)st.st_size,
128 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
129 wcache_flush_cache();
133 /* get the winbind_cache structure */
134 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
136 struct winbind_cache *ret = wcache;
138 /* We have to know what type of domain we are dealing with first. */
140 if (domain->internal) {
141 domain->backend = &builtin_passdb_methods;
142 domain->initialized = True;
144 if ( !domain->initialized ) {
145 init_dc_connection( domain );
149 OK. listen up becasue I'm only going to say this once.
150 We have the following scenarios to consider
151 (a) trusted AD domains on a Samba DC,
152 (b) trusted AD domains and we are joined to a non-kerberos domain
153 (c) trusted AD domains and we are joined to a kerberos (AD) domain
155 For (a) we can always contact the trusted domain using krb5
156 since we have the domain trust account password
158 For (b) we can only use RPC since we have no way of
159 getting a krb5 ticket in our own domain
161 For (c) we can always use krb5 since we have a kerberos trust
166 if (!domain->backend) {
168 struct winbindd_domain *our_domain = domain;
170 /* find our domain first so we can figure out if we
171 are joined to a kerberized domain */
173 if ( !domain->primary )
174 our_domain = find_our_domain();
176 if ((our_domain->active_directory || IS_DC)
177 && domain->active_directory
178 && !lp_winbind_rpc_only()) {
179 DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
180 domain->backend = &ads_methods;
182 #endif /* HAVE_ADS */
183 DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
184 domain->backend = &reconnect_methods;
187 #endif /* HAVE_ADS */
193 ret = SMB_XMALLOC_P(struct winbind_cache);
197 wcache_flush_cache();
203 free a centry structure
205 static void centry_free(struct cache_entry *centry)
209 SAFE_FREE(centry->data);
213 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
215 if (centry->len - centry->ofs < nbytes) {
216 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
217 (unsigned int)nbytes,
218 centry->len - centry->ofs));
225 pull a uint32 from a cache entry
227 static uint32 centry_uint32(struct cache_entry *centry)
231 if (!centry_check_bytes(centry, 4)) {
232 smb_panic_fn("centry_uint32");
234 ret = IVAL(centry->data, centry->ofs);
240 pull a uint16 from a cache entry
242 static uint16 centry_uint16(struct cache_entry *centry)
245 if (!centry_check_bytes(centry, 2)) {
246 smb_panic_fn("centry_uint16");
248 ret = CVAL(centry->data, centry->ofs);
254 pull a uint8 from a cache entry
256 static uint8 centry_uint8(struct cache_entry *centry)
259 if (!centry_check_bytes(centry, 1)) {
260 smb_panic_fn("centry_uint8");
262 ret = CVAL(centry->data, centry->ofs);
268 pull a NTTIME from a cache entry
270 static NTTIME centry_nttime(struct cache_entry *centry)
273 if (!centry_check_bytes(centry, 8)) {
274 smb_panic_fn("centry_nttime");
276 ret = IVAL(centry->data, centry->ofs);
278 ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
284 pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
286 static time_t centry_time(struct cache_entry *centry)
288 return (time_t)centry_nttime(centry);
291 /* pull a string from a cache entry, using the supplied
294 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
299 len = centry_uint8(centry);
302 /* a deliberate NULL string */
306 if (!centry_check_bytes(centry, (size_t)len)) {
307 smb_panic_fn("centry_string");
310 ret = TALLOC_ARRAY(mem_ctx, char, len+1);
312 smb_panic_fn("centry_string out of memory\n");
314 memcpy(ret,centry->data + centry->ofs, len);
320 /* pull a hash16 from a cache entry, using the supplied
323 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
328 len = centry_uint8(centry);
331 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
336 if (!centry_check_bytes(centry, 16)) {
340 ret = TALLOC_ARRAY(mem_ctx, char, 16);
342 smb_panic_fn("centry_hash out of memory\n");
344 memcpy(ret,centry->data + centry->ofs, 16);
349 /* pull a sid from a cache entry, using the supplied
352 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
357 sid_string = centry_string(centry, talloc_tos());
358 if (sid_string == NULL) {
361 ret = string_to_sid(sid, sid_string);
362 TALLOC_FREE(sid_string);
368 pull a NTSTATUS from a cache entry
370 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
374 status = NT_STATUS(centry_uint32(centry));
379 /* the server is considered down if it can't give us a sequence number */
380 static bool wcache_server_down(struct winbindd_domain *domain)
387 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
390 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
395 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
402 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
403 return NT_STATUS_UNSUCCESSFUL;
406 fstr_sprintf( key, "SEQNUM/%s", domain->name );
408 data = tdb_fetch_bystring( wcache->tdb, key );
409 if ( !data.dptr || data.dsize!=8 ) {
410 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key ));
411 return NT_STATUS_UNSUCCESSFUL;
414 domain->sequence_number = IVAL(data.dptr, 0);
415 domain->last_seq_check = IVAL(data.dptr, 4);
417 SAFE_FREE(data.dptr);
419 /* have we expired? */
421 time_diff = now - domain->last_seq_check;
422 if ( time_diff > lp_winbind_cache_time() ) {
423 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
424 domain->name, domain->sequence_number,
425 (uint32)domain->last_seq_check));
426 return NT_STATUS_UNSUCCESSFUL;
429 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
430 domain->name, domain->sequence_number,
431 (uint32)domain->last_seq_check));
436 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
443 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
444 return NT_STATUS_UNSUCCESSFUL;
447 fstr_sprintf( key_str, "SEQNUM/%s", domain->name );
449 SIVAL(buf, 0, domain->sequence_number);
450 SIVAL(buf, 4, domain->last_seq_check);
454 if ( tdb_store_bystring( wcache->tdb, key_str, data, TDB_REPLACE) == -1 ) {
455 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
456 return NT_STATUS_UNSUCCESSFUL;
459 DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
460 domain->name, domain->sequence_number,
461 (uint32)domain->last_seq_check));
467 refresh the domain sequence number. If force is true
468 then always refresh it, no matter how recently we fetched it
471 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
475 time_t t = time(NULL);
476 unsigned cache_time = lp_winbind_cache_time();
478 if ( IS_DOMAIN_OFFLINE(domain) ) {
484 #if 0 /* JERRY -- disable as the default cache time is now 5 minutes */
485 /* trying to reconnect is expensive, don't do it too often */
486 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
491 time_diff = t - domain->last_seq_check;
493 /* see if we have to refetch the domain sequence number */
494 if (!force && (time_diff < cache_time) &&
495 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
496 NT_STATUS_IS_OK(domain->last_status)) {
497 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
501 /* try to get the sequence number from the tdb cache first */
502 /* this will update the timestamp as well */
504 status = fetch_cache_seqnum( domain, t );
505 if (NT_STATUS_IS_OK(status) &&
506 (domain->sequence_number != DOM_SEQUENCE_NONE) &&
507 NT_STATUS_IS_OK(domain->last_status)) {
511 /* important! make sure that we know if this is a native
512 mode domain or not. And that we can contact it. */
514 if ( winbindd_can_contact_domain( domain ) ) {
515 status = domain->backend->sequence_number(domain,
516 &domain->sequence_number);
518 /* just use the current time */
519 status = NT_STATUS_OK;
520 domain->sequence_number = time(NULL);
524 /* the above call could have set our domain->backend to NULL when
525 * coming from offline to online mode, make sure to reinitialize the
526 * backend - Guenther */
529 if (!NT_STATUS_IS_OK(status)) {
530 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
531 domain->sequence_number = DOM_SEQUENCE_NONE;
534 domain->last_status = status;
535 domain->last_seq_check = time(NULL);
537 /* save the new sequence number in the cache */
538 store_cache_seqnum( domain );
541 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
542 domain->name, domain->sequence_number));
548 decide if a cache entry has expired
550 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
552 /* If we've been told to be offline - stay in that state... */
553 if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
554 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
555 keystr, domain->name ));
559 /* when the domain is offline return the cached entry.
560 * This deals with transient offline states... */
562 if (!domain->online) {
563 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
564 keystr, domain->name ));
568 /* if the server is OK and our cache entry came from when it was down then
569 the entry is invalid */
570 if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
571 (centry->sequence_number == DOM_SEQUENCE_NONE)) {
572 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
573 keystr, domain->name ));
577 /* if the server is down or the cache entry is not older than the
578 current sequence number then it is OK */
579 if (wcache_server_down(domain) ||
580 centry->sequence_number == domain->sequence_number) {
581 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
582 keystr, domain->name ));
586 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
587 keystr, domain->name ));
593 static struct cache_entry *wcache_fetch_raw(char *kstr)
596 struct cache_entry *centry;
599 key = string_tdb_data(kstr);
600 data = tdb_fetch(wcache->tdb, key);
606 centry = SMB_XMALLOC_P(struct cache_entry);
607 centry->data = (unsigned char *)data.dptr;
608 centry->len = data.dsize;
611 if (centry->len < 8) {
612 /* huh? corrupt cache? */
613 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
618 centry->status = centry_ntstatus(centry);
619 centry->sequence_number = centry_uint32(centry);
625 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
626 number and return status
628 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
629 struct winbindd_domain *domain,
630 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
631 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
632 struct winbindd_domain *domain,
633 const char *format, ...)
637 struct cache_entry *centry;
639 if (!winbindd_use_cache()) {
643 refresh_sequence_number(domain, false);
645 va_start(ap, format);
646 smb_xvasprintf(&kstr, format, ap);
649 centry = wcache_fetch_raw(kstr);
650 if (centry == NULL) {
655 if (centry_expired(domain, kstr, centry)) {
657 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
658 kstr, domain->name ));
665 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
666 kstr, domain->name ));
672 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
673 static void wcache_delete(const char *format, ...)
679 va_start(ap, format);
680 smb_xvasprintf(&kstr, format, ap);
683 key = string_tdb_data(kstr);
685 tdb_delete(wcache->tdb, key);
690 make sure we have at least len bytes available in a centry
692 static void centry_expand(struct cache_entry *centry, uint32 len)
694 if (centry->len - centry->ofs >= len)
697 centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
700 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
701 smb_panic_fn("out of memory in centry_expand");
706 push a uint32 into a centry
708 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
710 centry_expand(centry, 4);
711 SIVAL(centry->data, centry->ofs, v);
716 push a uint16 into a centry
718 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
720 centry_expand(centry, 2);
721 SIVAL(centry->data, centry->ofs, v);
726 push a uint8 into a centry
728 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
730 centry_expand(centry, 1);
731 SCVAL(centry->data, centry->ofs, v);
736 push a string into a centry
738 static void centry_put_string(struct cache_entry *centry, const char *s)
743 /* null strings are marked as len 0xFFFF */
744 centry_put_uint8(centry, 0xFF);
749 /* can't handle more than 254 char strings. Truncating is probably best */
751 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
754 centry_put_uint8(centry, len);
755 centry_expand(centry, len);
756 memcpy(centry->data + centry->ofs, s, len);
761 push a 16 byte hash into a centry - treat as 16 byte string.
763 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
765 centry_put_uint8(centry, 16);
766 centry_expand(centry, 16);
767 memcpy(centry->data + centry->ofs, val, 16);
771 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
774 centry_put_string(centry, sid_to_fstring(sid_string, sid));
779 put NTSTATUS into a centry
781 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
783 uint32 status_value = NT_STATUS_V(status);
784 centry_put_uint32(centry, status_value);
789 push a NTTIME into a centry
791 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
793 centry_expand(centry, 8);
794 SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
796 SIVAL(centry->data, centry->ofs, nt >> 32);
801 push a time_t into a centry - use a 64 bit size.
802 NTTIME here is being used as a convenient 64-bit size.
804 static void centry_put_time(struct cache_entry *centry, time_t t)
806 NTTIME nt = (NTTIME)t;
807 centry_put_nttime(centry, nt);
811 start a centry for output. When finished, call centry_end()
813 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
815 struct cache_entry *centry;
820 centry = SMB_XMALLOC_P(struct cache_entry);
822 centry->len = 8192; /* reasonable default */
823 centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
825 centry->sequence_number = domain->sequence_number;
826 centry_put_ntstatus(centry, status);
827 centry_put_uint32(centry, centry->sequence_number);
832 finish a centry and write it to the tdb
834 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
835 static void centry_end(struct cache_entry *centry, const char *format, ...)
841 if (!winbindd_use_cache()) {
845 va_start(ap, format);
846 smb_xvasprintf(&kstr, format, ap);
849 key = string_tdb_data(kstr);
850 data.dptr = centry->data;
851 data.dsize = centry->ofs;
853 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
857 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
858 NTSTATUS status, const char *domain_name,
859 const char *name, const DOM_SID *sid,
860 enum lsa_SidType type)
862 struct cache_entry *centry;
865 centry = centry_start(domain, status);
868 centry_put_uint32(centry, type);
869 centry_put_sid(centry, sid);
870 fstrcpy(uname, name);
872 centry_end(centry, "NS/%s/%s", domain_name, uname);
873 DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
874 uname, sid_string_dbg(sid), nt_errstr(status)));
878 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
879 const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
881 struct cache_entry *centry;
884 centry = centry_start(domain, status);
888 if (NT_STATUS_IS_OK(status)) {
889 centry_put_uint32(centry, type);
890 centry_put_string(centry, domain_name);
891 centry_put_string(centry, name);
894 centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
895 DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
896 name, nt_errstr(status)));
901 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WINBIND_USERINFO *info)
903 struct cache_entry *centry;
906 if (is_null_sid(&info->user_sid)) {
910 centry = centry_start(domain, status);
913 centry_put_string(centry, info->acct_name);
914 centry_put_string(centry, info->full_name);
915 centry_put_string(centry, info->homedir);
916 centry_put_string(centry, info->shell);
917 centry_put_uint32(centry, info->primary_gid);
918 centry_put_sid(centry, &info->user_sid);
919 centry_put_sid(centry, &info->group_sid);
920 centry_end(centry, "U/%s", sid_to_fstring(sid_string,
922 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
926 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
928 struct samr_DomInfo12 *lockout_policy)
930 struct cache_entry *centry;
932 centry = centry_start(domain, status);
936 centry_put_nttime(centry, lockout_policy->lockout_duration);
937 centry_put_nttime(centry, lockout_policy->lockout_window);
938 centry_put_uint16(centry, lockout_policy->lockout_threshold);
940 centry_end(centry, "LOC_POL/%s", domain->name);
942 DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
949 static void wcache_save_password_policy(struct winbindd_domain *domain,
951 struct samr_DomInfo1 *policy)
953 struct cache_entry *centry;
955 centry = centry_start(domain, status);
959 centry_put_uint16(centry, policy->min_password_length);
960 centry_put_uint16(centry, policy->password_history_length);
961 centry_put_uint32(centry, policy->password_properties);
962 centry_put_nttime(centry, policy->max_password_age);
963 centry_put_nttime(centry, policy->min_password_age);
965 centry_end(centry, "PWD_POL/%s", domain->name);
967 DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
972 /***************************************************************************
973 ***************************************************************************/
975 static void wcache_save_username_alias(struct winbindd_domain *domain,
977 const char *name, const char *alias)
979 struct cache_entry *centry;
982 if ( (centry = centry_start(domain, status)) == NULL )
985 centry_put_string( centry, alias );
987 fstrcpy(uname, name);
989 centry_end(centry, "NSS/NA/%s", uname);
991 DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
996 static void wcache_save_alias_username(struct winbindd_domain *domain,
998 const char *alias, const char *name)
1000 struct cache_entry *centry;
1003 if ( (centry = centry_start(domain, status)) == NULL )
1006 centry_put_string( centry, name );
1008 fstrcpy(uname, alias);
1010 centry_end(centry, "NSS/AN/%s", uname);
1012 DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1014 centry_free(centry);
1017 /***************************************************************************
1018 ***************************************************************************/
1020 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1021 struct winbindd_domain *domain,
1022 const char *name, char **alias )
1024 struct winbind_cache *cache = get_cache(domain);
1025 struct cache_entry *centry = NULL;
1029 if ( domain->internal )
1030 return NT_STATUS_NOT_SUPPORTED;
1035 if ( (upper_name = SMB_STRDUP(name)) == NULL )
1036 return NT_STATUS_NO_MEMORY;
1037 strupper_m(upper_name);
1039 centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1041 SAFE_FREE( upper_name );
1046 status = centry->status;
1048 if (!NT_STATUS_IS_OK(status)) {
1049 centry_free(centry);
1053 *alias = centry_string( centry, mem_ctx );
1055 centry_free(centry);
1057 DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1058 name, *alias ? *alias : "(none)"));
1060 return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1064 /* If its not in cache and we are offline, then fail */
1066 if ( get_global_winbindd_state_offline() || !domain->online ) {
1067 DEBUG(8,("resolve_username_to_alias: rejecting query "
1068 "in offline mode\n"));
1069 return NT_STATUS_NOT_FOUND;
1072 status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1074 if ( NT_STATUS_IS_OK( status ) ) {
1075 wcache_save_username_alias(domain, status, name, *alias);
1078 if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1079 wcache_save_username_alias(domain, status, name, "(NULL)");
1082 DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1083 nt_errstr(status)));
1085 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1086 set_domain_offline( domain );
1092 /***************************************************************************
1093 ***************************************************************************/
1095 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1096 struct winbindd_domain *domain,
1097 const char *alias, char **name )
1099 struct winbind_cache *cache = get_cache(domain);
1100 struct cache_entry *centry = NULL;
1104 if ( domain->internal )
1105 return NT_STATUS_NOT_SUPPORTED;
1110 if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1111 return NT_STATUS_NO_MEMORY;
1112 strupper_m(upper_name);
1114 centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1116 SAFE_FREE( upper_name );
1121 status = centry->status;
1123 if (!NT_STATUS_IS_OK(status)) {
1124 centry_free(centry);
1128 *name = centry_string( centry, mem_ctx );
1130 centry_free(centry);
1132 DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1133 alias, *name ? *name : "(none)"));
1135 return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1139 /* If its not in cache and we are offline, then fail */
1141 if ( get_global_winbindd_state_offline() || !domain->online ) {
1142 DEBUG(8,("resolve_alias_to_username: rejecting query "
1143 "in offline mode\n"));
1144 return NT_STATUS_NOT_FOUND;
1147 /* an alias cannot contain a domain prefix or '@' */
1149 if (strchr(alias, '\\') || strchr(alias, '@')) {
1150 DEBUG(10,("resolve_alias_to_username: skipping fully "
1151 "qualified name %s\n", alias));
1152 return NT_STATUS_OBJECT_NAME_INVALID;
1155 status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1157 if ( NT_STATUS_IS_OK( status ) ) {
1158 wcache_save_alias_username( domain, status, alias, *name );
1161 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1162 wcache_save_alias_username(domain, status, alias, "(NULL)");
1165 DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1166 nt_errstr(status)));
1168 if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1169 set_domain_offline( domain );
1175 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1177 struct winbind_cache *cache = get_cache(domain);
1179 fstring key_str, tmp;
1183 return NT_STATUS_INTERNAL_DB_ERROR;
1186 if (is_null_sid(sid)) {
1187 return NT_STATUS_INVALID_SID;
1190 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1191 return NT_STATUS_INVALID_SID;
1194 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1196 data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1198 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1201 SAFE_FREE(data.dptr);
1202 return NT_STATUS_OK;
1205 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1206 as new salted ones. */
1208 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1209 TALLOC_CTX *mem_ctx,
1211 const uint8 **cached_nt_pass,
1212 const uint8 **cached_salt)
1214 struct winbind_cache *cache = get_cache(domain);
1215 struct cache_entry *centry = NULL;
1222 return NT_STATUS_INTERNAL_DB_ERROR;
1225 if (is_null_sid(sid)) {
1226 return NT_STATUS_INVALID_SID;
1229 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1230 return NT_STATUS_INVALID_SID;
1233 /* Try and get a salted cred first. If we can't
1234 fall back to an unsalted cred. */
1236 centry = wcache_fetch(cache, domain, "CRED/%s",
1237 sid_to_fstring(tmp, sid));
1239 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1240 sid_string_dbg(sid)));
1241 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1244 t = centry_time(centry);
1246 /* In the salted case this isn't actually the nt_hash itself,
1247 but the MD5 of the salt + nt_hash. Let the caller
1248 sort this out. It can tell as we only return the cached_salt
1249 if we are returning a salted cred. */
1251 *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1252 if (*cached_nt_pass == NULL) {
1255 sid_to_fstring(sidstr, sid);
1257 /* Bad (old) cred cache. Delete and pretend we
1259 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1261 wcache_delete("CRED/%s", sidstr);
1262 centry_free(centry);
1263 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1266 /* We only have 17 bytes more data in the salted cred case. */
1267 if (centry->len - centry->ofs == 17) {
1268 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1270 *cached_salt = NULL;
1273 dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1275 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1278 status = centry->status;
1280 DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1281 sid_string_dbg(sid), nt_errstr(status) ));
1283 centry_free(centry);
1287 /* Store creds for a SID - only writes out new salted ones. */
1289 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1290 TALLOC_CTX *mem_ctx,
1292 const uint8 nt_pass[NT_HASH_LEN])
1294 struct cache_entry *centry;
1297 uint8 cred_salt[NT_HASH_LEN];
1298 uint8 salted_hash[NT_HASH_LEN];
1300 if (is_null_sid(sid)) {
1301 return NT_STATUS_INVALID_SID;
1304 if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1305 return NT_STATUS_INVALID_SID;
1308 centry = centry_start(domain, NT_STATUS_OK);
1310 return NT_STATUS_INTERNAL_DB_ERROR;
1313 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1315 centry_put_time(centry, time(NULL));
1317 /* Create a salt and then salt the hash. */
1318 generate_random_buffer(cred_salt, NT_HASH_LEN);
1319 E_md5hash(cred_salt, nt_pass, salted_hash);
1321 centry_put_hash16(centry, salted_hash);
1322 centry_put_hash16(centry, cred_salt);
1323 centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1325 DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1327 centry_free(centry);
1329 return NT_STATUS_OK;
1333 /* Query display info. This is the basic user list fn */
1334 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1335 TALLOC_CTX *mem_ctx,
1336 uint32 *num_entries,
1337 WINBIND_USERINFO **info)
1339 struct winbind_cache *cache = get_cache(domain);
1340 struct cache_entry *centry = NULL;
1342 unsigned int i, retry;
1347 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1351 *num_entries = centry_uint32(centry);
1353 if (*num_entries == 0)
1356 (*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
1358 smb_panic_fn("query_user_list out of memory");
1360 for (i=0; i<(*num_entries); i++) {
1361 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1362 (*info)[i].full_name = centry_string(centry, mem_ctx);
1363 (*info)[i].homedir = centry_string(centry, mem_ctx);
1364 (*info)[i].shell = centry_string(centry, mem_ctx);
1365 centry_sid(centry, &(*info)[i].user_sid);
1366 centry_sid(centry, &(*info)[i].group_sid);
1370 status = centry->status;
1372 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1373 domain->name, nt_errstr(status) ));
1375 centry_free(centry);
1382 /* Return status value returned by seq number check */
1384 if (!NT_STATUS_IS_OK(domain->last_status))
1385 return domain->last_status;
1387 /* Put the query_user_list() in a retry loop. There appears to be
1388 * some bug either with Windows 2000 or Samba's handling of large
1389 * rpc replies. This manifests itself as sudden disconnection
1390 * at a random point in the enumeration of a large (60k) user list.
1391 * The retry loop simply tries the operation again. )-: It's not
1392 * pretty but an acceptable workaround until we work out what the
1393 * real problem is. */
1398 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1401 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1402 if (!NT_STATUS_IS_OK(status)) {
1403 DEBUG(3, ("query_user_list: returned 0x%08x, "
1404 "retrying\n", NT_STATUS_V(status)));
1406 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1407 DEBUG(3, ("query_user_list: flushing "
1408 "connection cache\n"));
1409 invalidate_cm_connection(&domain->conn);
1412 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1416 refresh_sequence_number(domain, false);
1417 centry = centry_start(domain, status);
1420 centry_put_uint32(centry, *num_entries);
1421 for (i=0; i<(*num_entries); i++) {
1422 centry_put_string(centry, (*info)[i].acct_name);
1423 centry_put_string(centry, (*info)[i].full_name);
1424 centry_put_string(centry, (*info)[i].homedir);
1425 centry_put_string(centry, (*info)[i].shell);
1426 centry_put_sid(centry, &(*info)[i].user_sid);
1427 centry_put_sid(centry, &(*info)[i].group_sid);
1428 if (domain->backend && domain->backend->consistent) {
1429 /* when the backend is consistent we can pre-prime some mappings */
1430 wcache_save_name_to_sid(domain, NT_STATUS_OK,
1432 (*info)[i].acct_name,
1433 &(*info)[i].user_sid,
1435 wcache_save_sid_to_name(domain, NT_STATUS_OK,
1436 &(*info)[i].user_sid,
1438 (*info)[i].acct_name,
1440 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1443 centry_end(centry, "UL/%s", domain->name);
1444 centry_free(centry);
1450 /* list all domain groups */
1451 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1452 TALLOC_CTX *mem_ctx,
1453 uint32 *num_entries,
1454 struct acct_info **info)
1456 struct winbind_cache *cache = get_cache(domain);
1457 struct cache_entry *centry = NULL;
1464 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1468 *num_entries = centry_uint32(centry);
1470 if (*num_entries == 0)
1473 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1475 smb_panic_fn("enum_dom_groups out of memory");
1477 for (i=0; i<(*num_entries); i++) {
1478 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1479 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1480 (*info)[i].rid = centry_uint32(centry);
1484 status = centry->status;
1486 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1487 domain->name, nt_errstr(status) ));
1489 centry_free(centry);
1496 /* Return status value returned by seq number check */
1498 if (!NT_STATUS_IS_OK(domain->last_status))
1499 return domain->last_status;
1501 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1504 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1507 refresh_sequence_number(domain, false);
1508 centry = centry_start(domain, status);
1511 centry_put_uint32(centry, *num_entries);
1512 for (i=0; i<(*num_entries); i++) {
1513 centry_put_string(centry, (*info)[i].acct_name);
1514 centry_put_string(centry, (*info)[i].acct_desc);
1515 centry_put_uint32(centry, (*info)[i].rid);
1517 centry_end(centry, "GL/%s/domain", domain->name);
1518 centry_free(centry);
1524 /* list all domain groups */
1525 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1526 TALLOC_CTX *mem_ctx,
1527 uint32 *num_entries,
1528 struct acct_info **info)
1530 struct winbind_cache *cache = get_cache(domain);
1531 struct cache_entry *centry = NULL;
1538 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1542 *num_entries = centry_uint32(centry);
1544 if (*num_entries == 0)
1547 (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1549 smb_panic_fn("enum_dom_groups out of memory");
1551 for (i=0; i<(*num_entries); i++) {
1552 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1553 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1554 (*info)[i].rid = centry_uint32(centry);
1559 /* If we are returning cached data and the domain controller
1560 is down then we don't know whether the data is up to date
1561 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1564 if (wcache_server_down(domain)) {
1565 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1566 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1568 status = centry->status;
1570 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1571 domain->name, nt_errstr(status) ));
1573 centry_free(centry);
1580 /* Return status value returned by seq number check */
1582 if (!NT_STATUS_IS_OK(domain->last_status))
1583 return domain->last_status;
1585 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1588 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1591 refresh_sequence_number(domain, false);
1592 centry = centry_start(domain, status);
1595 centry_put_uint32(centry, *num_entries);
1596 for (i=0; i<(*num_entries); i++) {
1597 centry_put_string(centry, (*info)[i].acct_name);
1598 centry_put_string(centry, (*info)[i].acct_desc);
1599 centry_put_uint32(centry, (*info)[i].rid);
1601 centry_end(centry, "GL/%s/local", domain->name);
1602 centry_free(centry);
1608 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1609 const char *domain_name,
1611 struct dom_sid *sid,
1612 enum lsa_SidType *type)
1614 struct winbind_cache *cache = get_cache(domain);
1615 struct cache_entry *centry;
1619 if (cache->tdb == NULL) {
1620 return NT_STATUS_NOT_FOUND;
1623 uname = talloc_strdup_upper(talloc_tos(), name);
1624 if (uname == NULL) {
1625 return NT_STATUS_NO_MEMORY;
1628 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1630 if (centry == NULL) {
1631 return NT_STATUS_NOT_FOUND;
1634 status = centry->status;
1635 if (NT_STATUS_IS_OK(status)) {
1636 *type = (enum lsa_SidType)centry_uint32(centry);
1637 centry_sid(centry, sid);
1640 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1641 "%s\n", domain->name, nt_errstr(status) ));
1643 centry_free(centry);
1647 /* convert a single name to a sid in a domain */
1648 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1649 TALLOC_CTX *mem_ctx,
1650 const char *domain_name,
1654 enum lsa_SidType *type)
1658 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1659 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1665 /* If the seq number check indicated that there is a problem
1666 * with this DC, then return that status... except for
1667 * access_denied. This is special because the dc may be in
1668 * "restrict anonymous = 1" mode, in which case it will deny
1669 * most unauthenticated operations, but *will* allow the LSA
1670 * name-to-sid that we try as a fallback. */
1672 if (!(NT_STATUS_IS_OK(domain->last_status)
1673 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1674 return domain->last_status;
1676 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1679 status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1680 name, flags, sid, type);
1683 refresh_sequence_number(domain, false);
1685 if (domain->online &&
1686 (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1687 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1689 /* Only save the reverse mapping if this was not a UPN */
1690 if (!strchr(name, '@')) {
1691 strupper_m(CONST_DISCARD(char *,domain_name));
1692 strlower_m(CONST_DISCARD(char *,name));
1693 wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1700 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1701 const struct dom_sid *sid,
1702 TALLOC_CTX *mem_ctx,
1705 enum lsa_SidType *type)
1707 struct winbind_cache *cache = get_cache(domain);
1708 struct cache_entry *centry;
1712 if (cache->tdb == NULL) {
1713 return NT_STATUS_NOT_FOUND;
1716 sid_string = sid_string_tos(sid);
1717 if (sid_string == NULL) {
1718 return NT_STATUS_NO_MEMORY;
1721 centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1722 TALLOC_FREE(sid_string);
1723 if (centry == NULL) {
1724 return NT_STATUS_NOT_FOUND;
1727 if (NT_STATUS_IS_OK(centry->status)) {
1728 *type = (enum lsa_SidType)centry_uint32(centry);
1729 *domain_name = centry_string(centry, mem_ctx);
1730 *name = centry_string(centry, mem_ctx);
1733 status = centry->status;
1734 centry_free(centry);
1736 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1737 "%s\n", domain->name, nt_errstr(status) ));
1742 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1744 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1745 TALLOC_CTX *mem_ctx,
1749 enum lsa_SidType *type)
1753 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1755 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1760 *domain_name = NULL;
1762 /* If the seq number check indicated that there is a problem
1763 * with this DC, then return that status... except for
1764 * access_denied. This is special because the dc may be in
1765 * "restrict anonymous = 1" mode, in which case it will deny
1766 * most unauthenticated operations, but *will* allow the LSA
1767 * sid-to-name that we try as a fallback. */
1769 if (!(NT_STATUS_IS_OK(domain->last_status)
1770 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1771 return domain->last_status;
1773 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1776 status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1779 refresh_sequence_number(domain, false);
1780 wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1782 /* We can't save the name to sid mapping here, as with sid history a
1783 * later name2sid would give the wrong sid. */
1788 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1789 TALLOC_CTX *mem_ctx,
1790 const DOM_SID *domain_sid,
1795 enum lsa_SidType **types)
1797 struct winbind_cache *cache = get_cache(domain);
1799 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1803 *domain_name = NULL;
1811 if (num_rids == 0) {
1812 return NT_STATUS_OK;
1815 *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1816 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1818 if ((*names == NULL) || (*types == NULL)) {
1819 result = NT_STATUS_NO_MEMORY;
1823 have_mapped = have_unmapped = false;
1825 for (i=0; i<num_rids; i++) {
1827 struct cache_entry *centry;
1830 if (!sid_compose(&sid, domain_sid, rids[i])) {
1831 result = NT_STATUS_INTERNAL_ERROR;
1835 centry = wcache_fetch(cache, domain, "SN/%s",
1836 sid_to_fstring(tmp, &sid));
1841 (*types)[i] = SID_NAME_UNKNOWN;
1842 (*names)[i] = talloc_strdup(*names, "");
1844 if (NT_STATUS_IS_OK(centry->status)) {
1847 (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1849 dom = centry_string(centry, mem_ctx);
1850 if (*domain_name == NULL) {
1856 (*names)[i] = centry_string(centry, *names);
1858 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1859 have_unmapped = true;
1862 /* something's definitely wrong */
1863 result = centry->status;
1867 centry_free(centry);
1871 return NT_STATUS_NONE_MAPPED;
1873 if (!have_unmapped) {
1874 return NT_STATUS_OK;
1876 return STATUS_SOME_UNMAPPED;
1880 TALLOC_FREE(*names);
1881 TALLOC_FREE(*types);
1883 result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1884 rids, num_rids, domain_name,
1888 None of the queried rids has been found so save all negative entries
1890 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1891 for (i = 0; i < num_rids; i++) {
1893 const char *name = "";
1894 const enum lsa_SidType type = SID_NAME_UNKNOWN;
1895 NTSTATUS status = NT_STATUS_NONE_MAPPED;
1897 if (!sid_compose(&sid, domain_sid, rids[i])) {
1898 return NT_STATUS_INTERNAL_ERROR;
1901 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1909 Some or all of the queried rids have been found.
1911 if (!NT_STATUS_IS_OK(result) &&
1912 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1916 refresh_sequence_number(domain, false);
1918 for (i=0; i<num_rids; i++) {
1922 if (!sid_compose(&sid, domain_sid, rids[i])) {
1923 result = NT_STATUS_INTERNAL_ERROR;
1927 status = (*types)[i] == SID_NAME_UNKNOWN ?
1928 NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1930 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1931 (*names)[i], (*types)[i]);
1937 TALLOC_FREE(*names);
1938 TALLOC_FREE(*types);
1942 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
1943 TALLOC_CTX *mem_ctx,
1944 const struct dom_sid *user_sid,
1945 struct winbind_userinfo *info)
1947 struct winbind_cache *cache = get_cache(domain);
1948 struct cache_entry *centry = NULL;
1952 if (cache->tdb == NULL) {
1953 return NT_STATUS_NOT_FOUND;
1956 sid_string = sid_string_tos(user_sid);
1957 if (sid_string == NULL) {
1958 return NT_STATUS_NO_MEMORY;
1961 centry = wcache_fetch(cache, domain, "U/%s", sid_string);
1962 TALLOC_FREE(sid_string);
1963 if (centry == NULL) {
1964 return NT_STATUS_NOT_FOUND;
1968 * If we have an access denied cache entry and a cached info3
1969 * in the samlogon cache then do a query. This will force the
1970 * rpc back end to return the info3 data.
1973 if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
1974 netsamlogon_cache_have(user_sid)) {
1975 DEBUG(10, ("query_user: cached access denied and have cached "
1977 domain->last_status = NT_STATUS_OK;
1978 centry_free(centry);
1979 return NT_STATUS_NOT_FOUND;
1982 /* if status is not ok then this is a negative hit
1983 and the rest of the data doesn't matter */
1984 status = centry->status;
1985 if (NT_STATUS_IS_OK(status)) {
1986 info->acct_name = centry_string(centry, mem_ctx);
1987 info->full_name = centry_string(centry, mem_ctx);
1988 info->homedir = centry_string(centry, mem_ctx);
1989 info->shell = centry_string(centry, mem_ctx);
1990 info->primary_gid = centry_uint32(centry);
1991 centry_sid(centry, &info->user_sid);
1992 centry_sid(centry, &info->group_sid);
1995 DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
1996 "%s\n", domain->name, nt_errstr(status) ));
1998 centry_free(centry);
2002 /* Lookup user information from a rid */
2003 static NTSTATUS query_user(struct winbindd_domain *domain,
2004 TALLOC_CTX *mem_ctx,
2005 const DOM_SID *user_sid,
2006 WINBIND_USERINFO *info)
2010 status = wcache_query_user(domain, mem_ctx, user_sid, info);
2011 if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2017 /* Return status value returned by seq number check */
2019 if (!NT_STATUS_IS_OK(domain->last_status))
2020 return domain->last_status;
2022 DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2025 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2028 refresh_sequence_number(domain, false);
2029 wcache_save_user(domain, status, info);
2035 /* Lookup groups a user is a member of. */
2036 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2037 TALLOC_CTX *mem_ctx,
2038 const DOM_SID *user_sid,
2039 uint32 *num_groups, DOM_SID **user_gids)
2041 struct winbind_cache *cache = get_cache(domain);
2042 struct cache_entry *centry = NULL;
2050 centry = wcache_fetch(cache, domain, "UG/%s",
2051 sid_to_fstring(sid_string, user_sid));
2053 /* If we have an access denied cache entry and a cached info3 in the
2054 samlogon cache then do a query. This will force the rpc back end
2055 to return the info3 data. */
2057 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
2058 netsamlogon_cache_have(user_sid)) {
2059 DEBUG(10, ("lookup_usergroups: cached access denied and have cached info3\n"));
2060 domain->last_status = NT_STATUS_OK;
2061 centry_free(centry);
2068 *num_groups = centry_uint32(centry);
2070 if (*num_groups == 0)
2073 (*user_gids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_groups);
2074 if (! (*user_gids)) {
2075 smb_panic_fn("lookup_usergroups out of memory");
2077 for (i=0; i<(*num_groups); i++) {
2078 centry_sid(centry, &(*user_gids)[i]);
2082 status = centry->status;
2084 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status: %s\n",
2085 domain->name, nt_errstr(status) ));
2087 centry_free(centry);
2092 (*user_gids) = NULL;
2094 /* Return status value returned by seq number check */
2096 if (!NT_STATUS_IS_OK(domain->last_status))
2097 return domain->last_status;
2099 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2102 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2104 if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2108 refresh_sequence_number(domain, false);
2109 centry = centry_start(domain, status);
2113 centry_put_uint32(centry, *num_groups);
2114 for (i=0; i<(*num_groups); i++) {
2115 centry_put_sid(centry, &(*user_gids)[i]);
2118 centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2119 centry_free(centry);
2125 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2126 TALLOC_CTX *mem_ctx,
2127 uint32 num_sids, const DOM_SID *sids,
2128 uint32 *num_aliases, uint32 **alias_rids)
2130 struct winbind_cache *cache = get_cache(domain);
2131 struct cache_entry *centry = NULL;
2133 char *sidlist = talloc_strdup(mem_ctx, "");
2139 if (num_sids == 0) {
2142 return NT_STATUS_OK;
2145 /* We need to cache indexed by the whole list of SIDs, the aliases
2146 * resulting might come from any of the SIDs. */
2148 for (i=0; i<num_sids; i++) {
2150 sidlist = talloc_asprintf(mem_ctx, "%s/%s", sidlist,
2151 sid_to_fstring(tmp, &sids[i]));
2152 if (sidlist == NULL)
2153 return NT_STATUS_NO_MEMORY;
2156 centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2161 *num_aliases = centry_uint32(centry);
2165 (*alias_rids) = TALLOC_ARRAY(mem_ctx, uint32, *num_aliases);
2167 if ((*alias_rids) == NULL) {
2168 centry_free(centry);
2169 return NT_STATUS_NO_MEMORY;
2172 (*alias_rids) = NULL;
2175 for (i=0; i<(*num_aliases); i++)
2176 (*alias_rids)[i] = centry_uint32(centry);
2178 status = centry->status;
2180 DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2181 "status %s\n", domain->name, nt_errstr(status)));
2183 centry_free(centry);
2188 (*alias_rids) = NULL;
2190 if (!NT_STATUS_IS_OK(domain->last_status))
2191 return domain->last_status;
2193 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2194 "for domain %s\n", domain->name ));
2196 status = domain->backend->lookup_useraliases(domain, mem_ctx,
2198 num_aliases, alias_rids);
2201 refresh_sequence_number(domain, false);
2202 centry = centry_start(domain, status);
2205 centry_put_uint32(centry, *num_aliases);
2206 for (i=0; i<(*num_aliases); i++)
2207 centry_put_uint32(centry, (*alias_rids)[i]);
2208 centry_end(centry, "UA%s", sidlist);
2209 centry_free(centry);
2216 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2217 TALLOC_CTX *mem_ctx,
2218 const DOM_SID *group_sid, uint32 *num_names,
2219 DOM_SID **sid_mem, char ***names,
2220 uint32 **name_types)
2222 struct winbind_cache *cache = get_cache(domain);
2223 struct cache_entry *centry = NULL;
2231 centry = wcache_fetch(cache, domain, "GM/%s",
2232 sid_to_fstring(sid_string, group_sid));
2236 *num_names = centry_uint32(centry);
2238 if (*num_names == 0)
2241 (*sid_mem) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_names);
2242 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
2243 (*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
2245 if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
2246 smb_panic_fn("lookup_groupmem out of memory");
2249 for (i=0; i<(*num_names); i++) {
2250 centry_sid(centry, &(*sid_mem)[i]);
2251 (*names)[i] = centry_string(centry, mem_ctx);
2252 (*name_types)[i] = centry_uint32(centry);
2256 status = centry->status;
2258 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status: %s\n",
2259 domain->name, nt_errstr(status)));
2261 centry_free(centry);
2268 (*name_types) = NULL;
2270 /* Return status value returned by seq number check */
2272 if (!NT_STATUS_IS_OK(domain->last_status))
2273 return domain->last_status;
2275 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2278 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2279 sid_mem, names, name_types);
2282 refresh_sequence_number(domain, false);
2283 centry = centry_start(domain, status);
2286 centry_put_uint32(centry, *num_names);
2287 for (i=0; i<(*num_names); i++) {
2288 centry_put_sid(centry, &(*sid_mem)[i]);
2289 centry_put_string(centry, (*names)[i]);
2290 centry_put_uint32(centry, (*name_types)[i]);
2292 centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2293 centry_free(centry);
2299 /* find the sequence number for a domain */
2300 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2302 refresh_sequence_number(domain, false);
2304 *seq = domain->sequence_number;
2306 return NT_STATUS_OK;
2309 /* enumerate trusted domains
2310 * (we need to have the list of trustdoms in the cache when we go offline) -
2312 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2313 TALLOC_CTX *mem_ctx,
2314 uint32 *num_domains,
2319 struct winbind_cache *cache = get_cache(domain);
2320 struct cache_entry *centry = NULL;
2327 centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2333 *num_domains = centry_uint32(centry);
2336 (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2337 (*alt_names) = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2338 (*dom_sids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2340 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2341 smb_panic_fn("trusted_domains out of memory");
2345 (*alt_names) = NULL;
2349 for (i=0; i<(*num_domains); i++) {
2350 (*names)[i] = centry_string(centry, mem_ctx);
2351 (*alt_names)[i] = centry_string(centry, mem_ctx);
2352 if (!centry_sid(centry, &(*dom_sids)[i])) {
2353 sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2357 status = centry->status;
2359 DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2360 domain->name, *num_domains, nt_errstr(status) ));
2362 centry_free(centry);
2369 (*alt_names) = NULL;
2371 /* Return status value returned by seq number check */
2373 if (!NT_STATUS_IS_OK(domain->last_status))
2374 return domain->last_status;
2376 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2379 status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2380 names, alt_names, dom_sids);
2382 /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2383 * so that the generic centry handling still applies correctly -
2386 if (!NT_STATUS_IS_ERR(status)) {
2387 status = NT_STATUS_OK;
2391 #if 0 /* Disabled as we want the trust dom list to be managed by
2392 the main parent and always to make the query. --jerry */
2395 refresh_sequence_number(domain, false);
2397 centry = centry_start(domain, status);
2401 centry_put_uint32(centry, *num_domains);
2403 for (i=0; i<(*num_domains); i++) {
2404 centry_put_string(centry, (*names)[i]);
2405 centry_put_string(centry, (*alt_names)[i]);
2406 centry_put_sid(centry, &(*dom_sids)[i]);
2409 centry_end(centry, "TRUSTDOMS/%s", domain->name);
2411 centry_free(centry);
2419 /* get lockout policy */
2420 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2421 TALLOC_CTX *mem_ctx,
2422 struct samr_DomInfo12 *policy)
2424 struct winbind_cache *cache = get_cache(domain);
2425 struct cache_entry *centry = NULL;
2431 centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2436 policy->lockout_duration = centry_nttime(centry);
2437 policy->lockout_window = centry_nttime(centry);
2438 policy->lockout_threshold = centry_uint16(centry);
2440 status = centry->status;
2442 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2443 domain->name, nt_errstr(status) ));
2445 centry_free(centry);
2449 ZERO_STRUCTP(policy);
2451 /* Return status value returned by seq number check */
2453 if (!NT_STATUS_IS_OK(domain->last_status))
2454 return domain->last_status;
2456 DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2459 status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2462 refresh_sequence_number(domain, false);
2463 wcache_save_lockout_policy(domain, status, policy);
2468 /* get password policy */
2469 static NTSTATUS password_policy(struct winbindd_domain *domain,
2470 TALLOC_CTX *mem_ctx,
2471 struct samr_DomInfo1 *policy)
2473 struct winbind_cache *cache = get_cache(domain);
2474 struct cache_entry *centry = NULL;
2480 centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2485 policy->min_password_length = centry_uint16(centry);
2486 policy->password_history_length = centry_uint16(centry);
2487 policy->password_properties = centry_uint32(centry);
2488 policy->max_password_age = centry_nttime(centry);
2489 policy->min_password_age = centry_nttime(centry);
2491 status = centry->status;
2493 DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2494 domain->name, nt_errstr(status) ));
2496 centry_free(centry);
2500 ZERO_STRUCTP(policy);
2502 /* Return status value returned by seq number check */
2504 if (!NT_STATUS_IS_OK(domain->last_status))
2505 return domain->last_status;
2507 DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2510 status = domain->backend->password_policy(domain, mem_ctx, policy);
2513 refresh_sequence_number(domain, false);
2514 if (NT_STATUS_IS_OK(status)) {
2515 wcache_save_password_policy(domain, status, policy);
2522 /* Invalidate cached user and group lists coherently */
2524 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2527 if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2528 strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2529 tdb_delete(the_tdb, kbuf);
2534 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2536 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2537 struct netr_SamInfo3 *info3)
2540 fstring key_str, sid_string;
2541 struct winbind_cache *cache;
2543 /* dont clear cached U/SID and UG/SID entries when we want to logon
2546 if (lp_winbind_offline_logon()) {
2553 cache = get_cache(domain);
2559 sid_copy(&sid, info3->base.domain_sid);
2560 sid_append_rid(&sid, info3->base.rid);
2562 /* Clear U/SID cache entry */
2563 fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2564 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2565 tdb_delete(cache->tdb, string_tdb_data(key_str));
2567 /* Clear UG/SID cache entry */
2568 fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2569 DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2570 tdb_delete(cache->tdb, string_tdb_data(key_str));
2572 /* Samba/winbindd never needs this. */
2573 netsamlogon_clear_cached_user(info3);
2576 bool wcache_invalidate_cache(void)
2578 struct winbindd_domain *domain;
2580 for (domain = domain_list(); domain; domain = domain->next) {
2581 struct winbind_cache *cache = get_cache(domain);
2583 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2584 "entries for %s\n", domain->name));
2587 tdb_traverse(cache->tdb, traverse_fn, NULL);
2596 bool init_wcache(void)
2598 if (wcache == NULL) {
2599 wcache = SMB_XMALLOC_P(struct winbind_cache);
2600 ZERO_STRUCTP(wcache);
2603 if (wcache->tdb != NULL)
2606 /* when working offline we must not clear the cache on restart */
2607 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2608 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2609 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2610 O_RDWR|O_CREAT, 0600);
2612 if (wcache->tdb == NULL) {
2613 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2620 /************************************************************************
2621 This is called by the parent to initialize the cache file.
2622 We don't need sophisticated locking here as we know we're the
2624 ************************************************************************/
2626 bool initialize_winbindd_cache(void)
2628 bool cache_bad = true;
2631 if (!init_wcache()) {
2632 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2636 /* Check version number. */
2637 if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2638 vers == WINBINDD_CACHE_VERSION) {
2643 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2644 "and re-creating with version number %d\n",
2645 WINBINDD_CACHE_VERSION ));
2647 tdb_close(wcache->tdb);
2650 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2651 DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2652 cache_path("winbindd_cache.tdb"),
2656 if (!init_wcache()) {
2657 DEBUG(0,("initialize_winbindd_cache: re-initialization "
2658 "init_wcache failed.\n"));
2662 /* Write the version. */
2663 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2664 DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2665 tdb_errorstr(wcache->tdb) ));
2670 tdb_close(wcache->tdb);
2675 void close_winbindd_cache(void)
2681 tdb_close(wcache->tdb);
2686 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2687 char **domain_name, char **name,
2688 enum lsa_SidType *type)
2690 struct winbindd_domain *domain;
2693 domain = find_lookup_domain_from_sid(sid);
2694 if (domain == NULL) {
2697 status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
2699 return NT_STATUS_IS_OK(status);
2702 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2703 const char *domain_name,
2706 enum lsa_SidType *type)
2708 struct winbindd_domain *domain;
2710 bool original_online_state;
2712 domain = find_lookup_domain_from_name(domain_name);
2713 if (domain == NULL) {
2717 /* If we are doing a cached logon, temporarily set the domain
2718 offline so the cache won't expire the entry */
2720 original_online_state = domain->online;
2721 domain->online = false;
2722 status = wcache_name_to_sid(domain, domain_name, name, sid, type);
2723 domain->online = original_online_state;
2725 return NT_STATUS_IS_OK(status);
2728 void cache_name2sid(struct winbindd_domain *domain,
2729 const char *domain_name, const char *name,
2730 enum lsa_SidType type, const DOM_SID *sid)
2732 refresh_sequence_number(domain, false);
2733 wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2738 * The original idea that this cache only contains centries has
2739 * been blurred - now other stuff gets put in here. Ensure we
2740 * ignore these things on cleanup.
2743 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2744 TDB_DATA dbuf, void *state)
2746 struct cache_entry *centry;
2748 if (is_non_centry_key(kbuf)) {
2752 centry = wcache_fetch_raw((char *)kbuf.dptr);
2757 if (!NT_STATUS_IS_OK(centry->status)) {
2758 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2759 tdb_delete(the_tdb, kbuf);
2762 centry_free(centry);
2766 /* flush the cache */
2767 void wcache_flush_cache(void)
2772 tdb_close(wcache->tdb);
2775 if (!winbindd_use_cache()) {
2779 /* when working offline we must not clear the cache on restart */
2780 wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2781 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2782 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2783 O_RDWR|O_CREAT, 0600);
2786 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2790 tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2792 DEBUG(10,("wcache_flush_cache success\n"));
2795 /* Count cached creds */
2797 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2800 int *cred_count = (int*)state;
2802 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2808 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2810 struct winbind_cache *cache = get_cache(domain);
2815 return NT_STATUS_INTERNAL_DB_ERROR;
2818 tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2820 return NT_STATUS_OK;
2824 struct cred_list *prev, *next;
2829 static struct cred_list *wcache_cred_list;
2831 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2834 struct cred_list *cred;
2836 if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2838 cred = SMB_MALLOC_P(struct cred_list);
2840 DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2846 /* save a copy of the key */
2848 fstrcpy(cred->name, (const char *)kbuf.dptr);
2849 DLIST_ADD(wcache_cred_list, cred);
2855 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2857 struct winbind_cache *cache = get_cache(domain);
2860 struct cred_list *cred, *oldest = NULL;
2863 return NT_STATUS_INTERNAL_DB_ERROR;
2866 /* we possibly already have an entry */
2867 if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2869 fstring key_str, tmp;
2871 DEBUG(11,("we already have an entry, deleting that\n"));
2873 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2875 tdb_delete(cache->tdb, string_tdb_data(key_str));
2877 return NT_STATUS_OK;
2880 ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2882 return NT_STATUS_OK;
2883 } else if ((ret == -1) || (wcache_cred_list == NULL)) {
2884 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2887 ZERO_STRUCTP(oldest);
2889 for (cred = wcache_cred_list; cred; cred = cred->next) {
2894 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
2896 DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
2898 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2902 t = IVAL(data.dptr, 0);
2903 SAFE_FREE(data.dptr);
2906 oldest = SMB_MALLOC_P(struct cred_list);
2907 if (oldest == NULL) {
2908 status = NT_STATUS_NO_MEMORY;
2912 fstrcpy(oldest->name, cred->name);
2913 oldest->created = t;
2917 if (t < oldest->created) {
2918 fstrcpy(oldest->name, cred->name);
2919 oldest->created = t;
2923 if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
2924 status = NT_STATUS_OK;
2926 status = NT_STATUS_UNSUCCESSFUL;
2929 SAFE_FREE(wcache_cred_list);
2935 /* Change the global online/offline state. */
2936 bool set_global_winbindd_state_offline(void)
2940 DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
2942 /* Only go offline if someone has created
2943 the key "WINBINDD_OFFLINE" in the cache tdb. */
2945 if (wcache == NULL || wcache->tdb == NULL) {
2946 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
2950 if (!lp_winbind_offline_logon()) {
2951 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
2955 if (global_winbindd_offline_state) {
2956 /* Already offline. */
2960 data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
2962 if (!data.dptr || data.dsize != 4) {
2963 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
2964 SAFE_FREE(data.dptr);
2967 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
2968 global_winbindd_offline_state = true;
2969 SAFE_FREE(data.dptr);
2974 void set_global_winbindd_state_online(void)
2976 DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
2978 if (!lp_winbind_offline_logon()) {
2979 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
2983 if (!global_winbindd_offline_state) {
2984 /* Already online. */
2987 global_winbindd_offline_state = false;
2993 /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
2994 tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
2997 bool get_global_winbindd_state_offline(void)
2999 return global_winbindd_offline_state;
3002 /***********************************************************************
3003 Validate functions for all possible cache tdb keys.
3004 ***********************************************************************/
3006 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3007 struct tdb_validation_status *state)
3009 struct cache_entry *centry;
3011 centry = SMB_XMALLOC_P(struct cache_entry);
3012 centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3013 if (!centry->data) {
3017 centry->len = data.dsize;
3020 if (centry->len < 8) {
3021 /* huh? corrupt cache? */
3022 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3023 centry_free(centry);
3024 state->bad_entry = true;
3025 state->success = false;
3029 centry->status = NT_STATUS(centry_uint32(centry));
3030 centry->sequence_number = centry_uint32(centry);
3034 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3035 struct tdb_validation_status *state)
3037 if (dbuf.dsize != 8) {
3038 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3039 keystr, (unsigned int)dbuf.dsize ));
3040 state->bad_entry = true;
3046 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3047 struct tdb_validation_status *state)
3049 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3054 (void)centry_uint32(centry);
3055 if (NT_STATUS_IS_OK(centry->status)) {
3057 (void)centry_sid(centry, &sid);
3060 centry_free(centry);
3062 if (!(state->success)) {
3065 DEBUG(10,("validate_ns: %s ok\n", keystr));
3069 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3070 struct tdb_validation_status *state)
3072 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3077 if (NT_STATUS_IS_OK(centry->status)) {
3078 (void)centry_uint32(centry);
3079 (void)centry_string(centry, mem_ctx);
3080 (void)centry_string(centry, mem_ctx);
3083 centry_free(centry);
3085 if (!(state->success)) {
3088 DEBUG(10,("validate_sn: %s ok\n", keystr));
3092 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3093 struct tdb_validation_status *state)
3095 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3102 (void)centry_string(centry, mem_ctx);
3103 (void)centry_string(centry, mem_ctx);
3104 (void)centry_string(centry, mem_ctx);
3105 (void)centry_string(centry, mem_ctx);
3106 (void)centry_uint32(centry);
3107 (void)centry_sid(centry, &sid);
3108 (void)centry_sid(centry, &sid);
3110 centry_free(centry);
3112 if (!(state->success)) {
3115 DEBUG(10,("validate_u: %s ok\n", keystr));
3119 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3120 struct tdb_validation_status *state)
3122 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3128 (void)centry_nttime(centry);
3129 (void)centry_nttime(centry);
3130 (void)centry_uint16(centry);
3132 centry_free(centry);
3134 if (!(state->success)) {
3137 DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3141 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3142 struct tdb_validation_status *state)
3144 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3150 (void)centry_uint16(centry);
3151 (void)centry_uint16(centry);
3152 (void)centry_uint32(centry);
3153 (void)centry_nttime(centry);
3154 (void)centry_nttime(centry);
3156 centry_free(centry);
3158 if (!(state->success)) {
3161 DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3165 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3166 struct tdb_validation_status *state)
3168 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3174 (void)centry_time(centry);
3175 (void)centry_hash16(centry, mem_ctx);
3177 /* We only have 17 bytes more data in the salted cred case. */
3178 if (centry->len - centry->ofs == 17) {
3179 (void)centry_hash16(centry, mem_ctx);
3182 centry_free(centry);
3184 if (!(state->success)) {
3187 DEBUG(10,("validate_cred: %s ok\n", keystr));
3191 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3192 struct tdb_validation_status *state)
3194 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3195 int32 num_entries, i;
3201 num_entries = (int32)centry_uint32(centry);
3203 for (i=0; i< num_entries; i++) {
3205 (void)centry_string(centry, mem_ctx);
3206 (void)centry_string(centry, mem_ctx);
3207 (void)centry_string(centry, mem_ctx);
3208 (void)centry_string(centry, mem_ctx);
3209 (void)centry_sid(centry, &sid);
3210 (void)centry_sid(centry, &sid);
3213 centry_free(centry);
3215 if (!(state->success)) {
3218 DEBUG(10,("validate_ul: %s ok\n", keystr));
3222 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3223 struct tdb_validation_status *state)
3225 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3226 int32 num_entries, i;
3232 num_entries = centry_uint32(centry);
3234 for (i=0; i< num_entries; i++) {
3235 (void)centry_string(centry, mem_ctx);
3236 (void)centry_string(centry, mem_ctx);
3237 (void)centry_uint32(centry);
3240 centry_free(centry);
3242 if (!(state->success)) {
3245 DEBUG(10,("validate_gl: %s ok\n", keystr));
3249 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3250 struct tdb_validation_status *state)
3252 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3253 int32 num_groups, i;
3259 num_groups = centry_uint32(centry);
3261 for (i=0; i< num_groups; i++) {
3263 centry_sid(centry, &sid);
3266 centry_free(centry);
3268 if (!(state->success)) {
3271 DEBUG(10,("validate_ug: %s ok\n", keystr));
3275 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3276 struct tdb_validation_status *state)
3278 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3279 int32 num_aliases, i;
3285 num_aliases = centry_uint32(centry);
3287 for (i=0; i < num_aliases; i++) {
3288 (void)centry_uint32(centry);
3291 centry_free(centry);
3293 if (!(state->success)) {
3296 DEBUG(10,("validate_ua: %s ok\n", keystr));
3300 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3301 struct tdb_validation_status *state)
3303 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3310 num_names = centry_uint32(centry);
3312 for (i=0; i< num_names; i++) {
3314 centry_sid(centry, &sid);
3315 (void)centry_string(centry, mem_ctx);
3316 (void)centry_uint32(centry);
3319 centry_free(centry);
3321 if (!(state->success)) {
3324 DEBUG(10,("validate_gm: %s ok\n", keystr));
3328 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3329 struct tdb_validation_status *state)
3331 /* Can't say anything about this other than must be nonzero. */
3332 if (dbuf.dsize == 0) {
3333 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3335 state->bad_entry = true;
3336 state->success = false;
3340 DEBUG(10,("validate_dr: %s ok\n", keystr));
3344 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3345 struct tdb_validation_status *state)
3347 /* Can't say anything about this other than must be nonzero. */
3348 if (dbuf.dsize == 0) {
3349 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3351 state->bad_entry = true;
3352 state->success = false;
3356 DEBUG(10,("validate_de: %s ok\n", keystr));
3360 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3361 TDB_DATA dbuf, struct tdb_validation_status *state)
3363 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3369 (void)centry_string(centry, mem_ctx);
3370 (void)centry_string(centry, mem_ctx);
3371 (void)centry_string(centry, mem_ctx);
3372 (void)centry_uint32(centry);
3374 centry_free(centry);
3376 if (!(state->success)) {
3379 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3383 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3385 struct tdb_validation_status *state)
3387 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3393 (void)centry_string( centry, mem_ctx );
3395 centry_free(centry);
3397 if (!(state->success)) {
3400 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3404 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3406 struct tdb_validation_status *state)
3408 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3414 (void)centry_string( centry, mem_ctx );
3416 centry_free(centry);
3418 if (!(state->success)) {
3421 DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3425 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3426 struct tdb_validation_status *state)
3428 struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3429 int32 num_domains, i;
3435 num_domains = centry_uint32(centry);
3437 for (i=0; i< num_domains; i++) {
3439 (void)centry_string(centry, mem_ctx);
3440 (void)centry_string(centry, mem_ctx);
3441 (void)centry_sid(centry, &sid);
3444 centry_free(centry);
3446 if (!(state->success)) {
3449 DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3453 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3455 struct tdb_validation_status *state)
3457 if (dbuf.dsize == 0) {
3458 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3459 "key %s (len ==0) ?\n", keystr));
3460 state->bad_entry = true;
3461 state->success = false;
3465 DEBUG(10, ("validate_trustdomcache: %s ok\n", keystr));
3466 DEBUGADD(10, (" Don't trust me, I am a DUMMY!\n"));
3470 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3471 struct tdb_validation_status *state)
3473 if (dbuf.dsize != 4) {
3474 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3475 keystr, (unsigned int)dbuf.dsize ));
3476 state->bad_entry = true;
3477 state->success = false;
3480 DEBUG(10,("validate_offline: %s ok\n", keystr));
3484 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3485 struct tdb_validation_status *state)
3487 if (dbuf.dsize != 4) {
3488 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3489 "key %s (len %u != 4) ?\n",
3490 keystr, (unsigned int)dbuf.dsize));
3491 state->bad_entry = true;
3492 state->success = false;
3496 DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3500 /***********************************************************************
3501 A list of all possible cache tdb keys with associated validation
3503 ***********************************************************************/
3505 struct key_val_struct {
3506 const char *keyname;
3507 int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3509 {"SEQNUM/", validate_seqnum},
3510 {"NS/", validate_ns},
3511 {"SN/", validate_sn},
3513 {"LOC_POL/", validate_loc_pol},
3514 {"PWD_POL/", validate_pwd_pol},
3515 {"CRED/", validate_cred},
3516 {"UL/", validate_ul},
3517 {"GL/", validate_gl},
3518 {"UG/", validate_ug},
3519 {"UA", validate_ua},
3520 {"GM/", validate_gm},
3521 {"DR/", validate_dr},
3522 {"DE/", validate_de},
3523 {"NSS/PWINFO/", validate_pwinfo},
3524 {"TRUSTDOMS/", validate_trustdoms},
3525 {"TRUSTDOMCACHE/", validate_trustdomcache},
3526 {"NSS/NA/", validate_nss_na},
3527 {"NSS/AN/", validate_nss_an},
3528 {"WINBINDD_OFFLINE", validate_offline},
3529 {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3533 /***********************************************************************
3534 Function to look at every entry in the tdb and validate it as far as
3536 ***********************************************************************/
3538 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3541 unsigned int max_key_len = 1024;
3542 struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3544 /* Paranoia check. */
3545 if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3546 max_key_len = 1024 * 1024;
3548 if (kbuf.dsize > max_key_len) {
3549 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3551 (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3555 for (i = 0; key_val[i].keyname; i++) {
3556 size_t namelen = strlen(key_val[i].keyname);
3557 if (kbuf.dsize >= namelen && (
3558 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3559 TALLOC_CTX *mem_ctx;
3563 keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3567 memcpy(keystr, kbuf.dptr, kbuf.dsize);
3568 keystr[kbuf.dsize] = '\0';
3570 mem_ctx = talloc_init("validate_ctx");
3576 ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3580 talloc_destroy(mem_ctx);
3585 DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3586 dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3587 DEBUG(0,("data :\n"));
3588 dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3589 v_state->unknown_key = true;
3590 v_state->success = false;
3591 return 1; /* terminate. */
3594 static void validate_panic(const char *const why)
3596 DEBUG(0,("validating cache: would panic %s\n", why ));
3597 DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3601 /***********************************************************************
3602 Try and validate every entry in the winbindd cache. If we fail here,
3603 delete the cache tdb and return non-zero.
3604 ***********************************************************************/
3606 int winbindd_validate_cache(void)
3609 const char *tdb_path = cache_path("winbindd_cache.tdb");
3610 TDB_CONTEXT *tdb = NULL;
3612 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3613 smb_panic_fn = validate_panic;
3616 tdb = tdb_open_log(tdb_path,
3617 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3618 ( lp_winbind_offline_logon()
3620 : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3624 DEBUG(0, ("winbindd_validate_cache: "
3625 "error opening/initializing tdb\n"));
3630 ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3633 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3634 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3639 DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3640 smb_panic_fn = smb_panic;
3644 /***********************************************************************
3645 Try and validate every entry in the winbindd cache.
3646 ***********************************************************************/
3648 int winbindd_validate_cache_nobackup(void)
3651 const char *tdb_path = cache_path("winbindd_cache.tdb");
3653 DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3654 smb_panic_fn = validate_panic;
3657 if (wcache == NULL || wcache->tdb == NULL) {
3658 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3660 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3664 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3668 DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3670 smb_panic_fn = smb_panic;
3674 bool winbindd_cache_validate_and_initialize(void)
3676 close_winbindd_cache();
3678 if (lp_winbind_offline_logon()) {
3679 if (winbindd_validate_cache() < 0) {
3680 DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3681 "could be restored.\n"));
3685 return initialize_winbindd_cache();
3688 /*********************************************************************
3689 ********************************************************************/
3691 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3692 struct winbindd_tdc_domain **domains,
3693 size_t *num_domains )
3695 struct winbindd_tdc_domain *list = NULL;
3698 bool set_only = false;
3700 /* don't allow duplicates */
3705 for ( i=0; i< (*num_domains); i++ ) {
3706 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3707 DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3718 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3721 list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3722 struct winbindd_tdc_domain,
3727 ZERO_STRUCT( list[idx] );
3733 list[idx].domain_name = talloc_strdup( list, new_dom->name );
3734 list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3736 if ( !is_null_sid( &new_dom->sid ) ) {
3737 sid_copy( &list[idx].sid, &new_dom->sid );
3739 sid_copy(&list[idx].sid, &global_sid_NULL);
3742 if ( new_dom->domain_flags != 0x0 )
3743 list[idx].trust_flags = new_dom->domain_flags;
3745 if ( new_dom->domain_type != 0x0 )
3746 list[idx].trust_type = new_dom->domain_type;
3748 if ( new_dom->domain_trust_attribs != 0x0 )
3749 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3753 *num_domains = idx + 1;
3759 /*********************************************************************
3760 ********************************************************************/
3762 static TDB_DATA make_tdc_key( const char *domain_name )
3764 char *keystr = NULL;
3765 TDB_DATA key = { NULL, 0 };
3767 if ( !domain_name ) {
3768 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3772 if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3775 key = string_term_tdb_data(keystr);
3780 /*********************************************************************
3781 ********************************************************************/
3783 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3785 unsigned char **buf )
3787 unsigned char *buffer = NULL;
3792 DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3800 /* Store the number of array items first */
3801 len += tdb_pack( buffer+len, buflen-len, "d",
3804 /* now pack each domain trust record */
3805 for ( i=0; i<num_domains; i++ ) {
3810 DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3811 domains[i].domain_name,
3812 domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3815 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3816 domains[i].domain_name,
3817 domains[i].dns_name,
3818 sid_to_fstring(tmp, &domains[i].sid),
3819 domains[i].trust_flags,
3820 domains[i].trust_attribs,
3821 domains[i].trust_type );
3824 if ( buflen < len ) {
3826 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3827 DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3841 /*********************************************************************
3842 ********************************************************************/
3844 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3845 struct winbindd_tdc_domain **domains )
3847 fstring domain_name, dns_name, sid_string;
3848 uint32 type, attribs, flags;
3852 struct winbindd_tdc_domain *list = NULL;
3854 /* get the number of domains */
3855 len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3857 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3861 list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3863 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3867 for ( i=0; i<num_domains; i++ ) {
3868 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3877 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3878 TALLOC_FREE( list );
3882 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
3883 "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
3884 domain_name, dns_name, sid_string,
3885 flags, attribs, type));
3887 list[i].domain_name = talloc_strdup( list, domain_name );
3888 list[i].dns_name = talloc_strdup( list, dns_name );
3889 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
3890 DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
3893 list[i].trust_flags = flags;
3894 list[i].trust_attribs = attribs;
3895 list[i].trust_type = type;
3903 /*********************************************************************
3904 ********************************************************************/
3906 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
3908 TDB_DATA key = make_tdc_key( lp_workgroup() );
3909 TDB_DATA data = { NULL, 0 };
3915 /* See if we were asked to delete the cache entry */
3918 ret = tdb_delete( wcache->tdb, key );
3922 data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
3929 ret = tdb_store( wcache->tdb, key, data, 0 );
3932 SAFE_FREE( data.dptr );
3933 SAFE_FREE( key.dptr );
3935 return ( ret != -1 );
3938 /*********************************************************************
3939 ********************************************************************/
3941 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
3943 TDB_DATA key = make_tdc_key( lp_workgroup() );
3944 TDB_DATA data = { NULL, 0 };
3952 data = tdb_fetch( wcache->tdb, key );
3954 SAFE_FREE( key.dptr );
3959 *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
3961 SAFE_FREE( data.dptr );
3969 /*********************************************************************
3970 ********************************************************************/
3972 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
3974 struct winbindd_tdc_domain *dom_list = NULL;
3975 size_t num_domains = 0;
3978 DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
3979 "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
3980 domain->name, domain->alt_name,
3981 sid_string_dbg(&domain->sid),
3982 domain->domain_flags,
3983 domain->domain_trust_attribs,
3984 domain->domain_type));
3986 if ( !init_wcache() ) {
3990 /* fetch the list */
3992 wcache_tdc_fetch_list( &dom_list, &num_domains );
3994 /* add the new domain */
3996 if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4000 /* pack the domain */
4002 if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4010 TALLOC_FREE( dom_list );
4015 /*********************************************************************
4016 ********************************************************************/
4018 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4020 struct winbindd_tdc_domain *dom_list = NULL;
4021 size_t num_domains = 0;
4023 struct winbindd_tdc_domain *d = NULL;
4025 DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4027 if ( !init_wcache() ) {
4031 /* fetch the list */
4033 wcache_tdc_fetch_list( &dom_list, &num_domains );
4035 for ( i=0; i<num_domains; i++ ) {
4036 if ( strequal(name, dom_list[i].domain_name) ||
4037 strequal(name, dom_list[i].dns_name) )
4039 DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4042 d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4046 d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4047 d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4048 sid_copy( &d->sid, &dom_list[i].sid );
4049 d->trust_flags = dom_list[i].trust_flags;
4050 d->trust_type = dom_list[i].trust_type;
4051 d->trust_attribs = dom_list[i].trust_attribs;
4057 TALLOC_FREE( dom_list );
4063 /*********************************************************************
4064 ********************************************************************/
4066 void wcache_tdc_clear( void )
4068 if ( !init_wcache() )
4071 wcache_tdc_store_list( NULL, 0 );
4077 /*********************************************************************
4078 ********************************************************************/
4080 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4082 const DOM_SID *user_sid,
4083 const char *homedir,
4088 struct cache_entry *centry;
4091 if ( (centry = centry_start(domain, status)) == NULL )
4094 centry_put_string( centry, homedir );
4095 centry_put_string( centry, shell );
4096 centry_put_string( centry, gecos );
4097 centry_put_uint32( centry, gid );
4099 centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4101 DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4103 centry_free(centry);
4106 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4107 const DOM_SID *user_sid,
4109 ADS_STRUCT *ads, LDAPMessage *msg,
4110 const char **homedir, const char **shell,
4111 const char **gecos, gid_t *p_gid)
4113 struct winbind_cache *cache = get_cache(domain);
4114 struct cache_entry *centry = NULL;
4121 centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4122 sid_to_fstring(tmp, user_sid));
4127 *homedir = centry_string( centry, ctx );
4128 *shell = centry_string( centry, ctx );
4129 *gecos = centry_string( centry, ctx );
4130 *p_gid = centry_uint32( centry );
4132 centry_free(centry);
4134 DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4135 sid_string_dbg(user_sid)));
4137 return NT_STATUS_OK;
4141 nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4142 homedir, shell, gecos, p_gid );
4144 DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4146 if ( NT_STATUS_IS_OK(nt_status) ) {
4147 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4148 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4149 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4150 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4152 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4153 *homedir, *shell, *gecos, *p_gid );
4156 if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4157 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4159 set_domain_offline( domain );
4166 /* the cache backend methods are exposed via this structure */
4167 struct winbindd_methods cache_methods = {