source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "tdb_validate.h"
  29 #include "../libcli/auth/libcli_auth.h"
  30 #include "../librpc/gen_ndr/ndr_wbint.h"
  31
  32 #undef DBGC_CLASS
  33 #define DBGC_CLASS DBGC_WINBIND
  34
  35 #define WINBINDD_CACHE_VERSION 1
  36 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  37
  38 extern struct winbindd_methods reconnect_methods;
  39 #ifdef HAVE_ADS
  40 extern struct winbindd_methods ads_methods;
  41 #endif
  42 extern struct winbindd_methods builtin_passdb_methods;
  43
  44 /*
  45  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  46  * Here are the list of entry types that are *not* stored
  47  * as form struct cache_entry in the cache.
  48  */
  49
  50 static const char *non_centry_keys[] = {
  51         "SEQNUM/",
  52         "DR/",
  53         "DE/",
  54         "WINBINDD_OFFLINE",
  55         WINBINDD_CACHE_VERSION_KEYSTR,
  56         NULL
  57 };
  58
  59 /************************************************************************
  60  Is this key a non-centry type ?
  61 ************************************************************************/
  62
  63 static bool is_non_centry_key(TDB_DATA kbuf)
  64 {
  65         int i;
  66
  67         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  68                 return false;
  69         }
  70         for (i = 0; non_centry_keys[i] != NULL; i++) {
  71                 size_t namelen = strlen(non_centry_keys[i]);
  72                 if (kbuf.dsize < namelen) {
  73                         continue;
  74                 }
  75                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  76                         return true;
  77                 }
  78         }
  79         return false;
  80 }
  81
  82 /* Global online/offline state - False when online. winbindd starts up online
  83    and sets this to true if the first query fails and there's an entry in
  84    the cache tdb telling us to stay offline. */
  85
  86 static bool global_winbindd_offline_state;
  87
  88 struct winbind_cache {
  89         TDB_CONTEXT *tdb;
  90 };
  91
  92 struct cache_entry {
  93         NTSTATUS status;
  94         uint32 sequence_number;
  95         uint8 *data;
  96         uint32 len, ofs;
  97 };
  98
  99 void (*smb_panic_fn)(const char *const why) = smb_panic;
 100
 101 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
 102
 103 static struct winbind_cache *wcache;
 104
 105 void winbindd_check_cache_size(time_t t)
 106 {
 107         static time_t last_check_time;
 108         struct stat st;
 109
 110         if (last_check_time == (time_t)0)
 111                 last_check_time = t;
 112
 113         if (t - last_check_time < 60 && t - last_check_time > 0)
 114                 return;
 115
 116         if (wcache == NULL || wcache->tdb == NULL) {
 117                 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
 118                 return;
 119         }
 120
 121         if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
 122                 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
 123                 return;
 124         }
 125
 126         if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
 127                 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
 128                         (unsigned long)st.st_size,
 129                         (unsigned long)WINBINDD_MAX_CACHE_SIZE));
 130                 wcache_flush_cache();
 131         }
 132 }
 133
 134 /* get the winbind_cache structure */
 135 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 136 {
 137         struct winbind_cache *ret = wcache;
 138
 139         /* We have to know what type of domain we are dealing with first. */
 140
 141         if (domain->internal) {
 142                 domain->backend = &builtin_passdb_methods;
 143                 domain->initialized = True;
 144         }
 145         if ( !domain->initialized ) {
 146                 init_dc_connection( domain );
 147         }
 148
 149         /*
 150            OK.  listen up becasue I'm only going to say this once.
 151            We have the following scenarios to consider
 152            (a) trusted AD domains on a Samba DC,
 153            (b) trusted AD domains and we are joined to a non-kerberos domain
 154            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 155
 156            For (a) we can always contact the trusted domain using krb5
 157            since we have the domain trust account password
 158
 159            For (b) we can only use RPC since we have no way of
 160            getting a krb5 ticket in our own domain
 161
 162            For (c) we can always use krb5 since we have a kerberos trust
 163
 164            --jerry
 165          */
 166
 167         if (!domain->backend) {
 168 #ifdef HAVE_ADS
 169                 struct winbindd_domain *our_domain = domain;
 170
 171                 /* find our domain first so we can figure out if we
 172                    are joined to a kerberized domain */
 173
 174                 if ( !domain->primary )
 175                         our_domain = find_our_domain();
 176
 177                 if ((our_domain->active_directory || IS_DC)
 178                     && domain->active_directory
 179                     && !lp_winbind_rpc_only()) {
 180                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 181                         domain->backend = &ads_methods;
 182                 } else {
 183 #endif  /* HAVE_ADS */
 184                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 185                         domain->backend = &reconnect_methods;
 186 #ifdef HAVE_ADS
 187                 }
 188 #endif  /* HAVE_ADS */
 189         }
 190
 191         if (ret)
 192                 return ret;
 193
 194         ret = SMB_XMALLOC_P(struct winbind_cache);
 195         ZERO_STRUCTP(ret);
 196
 197         wcache = ret;
 198         wcache_flush_cache();
 199
 200         return ret;
 201 }
 202
 203 /*
 204   free a centry structure
 205 */
 206 static void centry_free(struct cache_entry *centry)
 207 {
 208         if (!centry)
 209                 return;
 210         SAFE_FREE(centry->data);
 211         free(centry);
 212 }
 213
 214 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 215 {
 216         if (centry->len - centry->ofs < nbytes) {
 217                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 218                          (unsigned int)nbytes,
 219                          centry->len - centry->ofs));
 220                 return false;
 221         }
 222         return true;
 223 }
 224
 225 /*
 226   pull a uint32 from a cache entry
 227 */
 228 static uint32 centry_uint32(struct cache_entry *centry)
 229 {
 230         uint32 ret;
 231
 232         if (!centry_check_bytes(centry, 4)) {
 233                 smb_panic_fn("centry_uint32");
 234         }
 235         ret = IVAL(centry->data, centry->ofs);
 236         centry->ofs += 4;
 237         return ret;
 238 }
 239
 240 /*
 241   pull a uint16 from a cache entry
 242 */
 243 static uint16 centry_uint16(struct cache_entry *centry)
 244 {
 245         uint16 ret;
 246         if (!centry_check_bytes(centry, 2)) {
 247                 smb_panic_fn("centry_uint16");
 248         }
 249         ret = CVAL(centry->data, centry->ofs);
 250         centry->ofs += 2;
 251         return ret;
 252 }
 253
 254 /*
 255   pull a uint8 from a cache entry
 256 */
 257 static uint8 centry_uint8(struct cache_entry *centry)
 258 {
 259         uint8 ret;
 260         if (!centry_check_bytes(centry, 1)) {
 261                 smb_panic_fn("centry_uint8");
 262         }
 263         ret = CVAL(centry->data, centry->ofs);
 264         centry->ofs += 1;
 265         return ret;
 266 }
 267
 268 /*
 269   pull a NTTIME from a cache entry
 270 */
 271 static NTTIME centry_nttime(struct cache_entry *centry)
 272 {
 273         NTTIME ret;
 274         if (!centry_check_bytes(centry, 8)) {
 275                 smb_panic_fn("centry_nttime");
 276         }
 277         ret = IVAL(centry->data, centry->ofs);
 278         centry->ofs += 4;
 279         ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
 280         centry->ofs += 4;
 281         return ret;
 282 }
 283
 284 /*
 285   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 286 */
 287 static time_t centry_time(struct cache_entry *centry)
 288 {
 289         return (time_t)centry_nttime(centry);
 290 }
 291
 292 /* pull a string from a cache entry, using the supplied
 293    talloc context
 294 */
 295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 296 {
 297         uint32 len;
 298         char *ret;
 299
 300         len = centry_uint8(centry);
 301
 302         if (len == 0xFF) {
 303                 /* a deliberate NULL string */
 304                 return NULL;
 305         }
 306
 307         if (!centry_check_bytes(centry, (size_t)len)) {
 308                 smb_panic_fn("centry_string");
 309         }
 310
 311         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 312         if (!ret) {
 313                 smb_panic_fn("centry_string out of memory\n");
 314         }
 315         memcpy(ret,centry->data + centry->ofs, len);
 316         ret[len] = 0;
 317         centry->ofs += len;
 318         return ret;
 319 }
 320
 321 /* pull a hash16 from a cache entry, using the supplied
 322    talloc context
 323 */
 324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 325 {
 326         uint32 len;
 327         char *ret;
 328
 329         len = centry_uint8(centry);
 330
 331         if (len != 16) {
 332                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 333                         len ));
 334                 return NULL;
 335         }
 336
 337         if (!centry_check_bytes(centry, 16)) {
 338                 return NULL;
 339         }
 340
 341         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 342         if (!ret) {
 343                 smb_panic_fn("centry_hash out of memory\n");
 344         }
 345         memcpy(ret,centry->data + centry->ofs, 16);
 346         centry->ofs += 16;
 347         return ret;
 348 }
 349
 350 /* pull a sid from a cache entry, using the supplied
 351    talloc context
 352 */
 353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
 354 {
 355         char *sid_string;
 356         bool ret;
 357
 358         sid_string = centry_string(centry, talloc_tos());
 359         if (sid_string == NULL) {
 360                 return false;
 361         }
 362         ret = string_to_sid(sid, sid_string);
 363         TALLOC_FREE(sid_string);
 364         return ret;
 365 }
 366
 367
 368 /*
 369   pull a NTSTATUS from a cache entry
 370 */
 371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 372 {
 373         NTSTATUS status;
 374
 375         status = NT_STATUS(centry_uint32(centry));
 376         return status;
 377 }
 378
 379
 380 /* the server is considered down if it can't give us a sequence number */
 381 static bool wcache_server_down(struct winbindd_domain *domain)
 382 {
 383         bool ret;
 384
 385         if (!wcache->tdb)
 386                 return false;
 387
 388         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 389
 390         if (ret)
 391                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 392                         domain->name ));
 393         return ret;
 394 }
 395
 396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
 397                                 uint32_t *last_seq_check)
 398 {
 399         char *key;
 400         TDB_DATA data;
 401
 402         if (wcache->tdb == NULL) {
 403                 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
 404                 return false;
 405         }
 406
 407         key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 408         if (key == NULL) {
 409                 DEBUG(10, ("talloc failed\n"));
 410                 return false;
 411         }
 412
 413         data = tdb_fetch_bystring(wcache->tdb, key);
 414         TALLOC_FREE(key);
 415
 416         if (data.dptr == NULL) {
 417                 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
 418                            domain_name));
 419                 return false;
 420         }
 421         if (data.dsize != 8) {
 422                 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
 423                            (int)data.dsize));
 424                 SAFE_FREE(data.dptr);
 425                 return false;
 426         }
 427
 428         *seqnum = IVAL(data.dptr, 0);
 429         *last_seq_check = IVAL(data.dptr, 4);
 430         SAFE_FREE(data.dptr);
 431
 432         return true;
 433 }
 434
 435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 436 {
 437         uint32 last_check, time_diff;
 438
 439         if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
 440                                  &last_check)) {
 441                 return NT_STATUS_UNSUCCESSFUL;
 442         }
 443         domain->last_seq_check = last_check;
 444
 445         /* have we expired? */
 446
 447         time_diff = now - domain->last_seq_check;
 448         if ( time_diff > lp_winbind_cache_time() ) {
 449                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 450                         domain->name, domain->sequence_number,
 451                         (uint32)domain->last_seq_check));
 452                 return NT_STATUS_UNSUCCESSFUL;
 453         }
 454
 455         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 456                 domain->name, domain->sequence_number,
 457                 (uint32)domain->last_seq_check));
 458
 459         return NT_STATUS_OK;
 460 }
 461
 462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
 463                          time_t last_seq_check)
 464 {
 465         char *key_str;
 466         uint8_t buf[8];
 467         int ret;
 468
 469         if (wcache->tdb == NULL) {
 470                 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
 471                 return false;
 472         }
 473
 474         key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 475         if (key_str == NULL) {
 476                 DEBUG(10, ("talloc_asprintf failed\n"));
 477                 return false;
 478         }
 479
 480         SIVAL(buf, 0, seqnum);
 481         SIVAL(buf, 4, last_seq_check);
 482
 483         ret = tdb_store_bystring(wcache->tdb, key_str,
 484                                  make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
 485         TALLOC_FREE(key_str);
 486         if (ret == -1) {
 487                 DEBUG(10, ("tdb_store_bystring failed: %s\n",
 488                            tdb_errorstr(wcache->tdb)));
 489                 TALLOC_FREE(key_str);
 490                 return false;
 491         }
 492
 493         DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
 494                    domain_name, seqnum, (unsigned)last_seq_check));
 495
 496         return true;
 497 }
 498
 499 static bool store_cache_seqnum( struct winbindd_domain *domain )
 500 {
 501         return wcache_store_seqnum(domain->name, domain->sequence_number,
 502                                    domain->last_seq_check);
 503 }
 504
 505 /*
 506   refresh the domain sequence number. If force is true
 507   then always refresh it, no matter how recently we fetched it
 508 */
 509
 510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 511 {
 512         NTSTATUS status;
 513         unsigned time_diff;
 514         time_t t = time(NULL);
 515         unsigned cache_time = lp_winbind_cache_time();
 516
 517         if ( IS_DOMAIN_OFFLINE(domain) ) {
 518                 return;
 519         }
 520
 521         get_cache( domain );
 522
 523 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 524         /* trying to reconnect is expensive, don't do it too often */
 525         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 526                 cache_time *= 8;
 527         }
 528 #endif
 529
 530         time_diff = t - domain->last_seq_check;
 531
 532         /* see if we have to refetch the domain sequence number */
 533         if (!force && (time_diff < cache_time) &&
 534                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 535                         NT_STATUS_IS_OK(domain->last_status)) {
 536                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 537                 goto done;
 538         }
 539
 540         /* try to get the sequence number from the tdb cache first */
 541         /* this will update the timestamp as well */
 542
 543         status = fetch_cache_seqnum( domain, t );
 544         if (NT_STATUS_IS_OK(status) &&
 545                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 546                         NT_STATUS_IS_OK(domain->last_status)) {
 547                 goto done;
 548         }
 549
 550         /* important! make sure that we know if this is a native
 551            mode domain or not.  And that we can contact it. */
 552
 553         if ( winbindd_can_contact_domain( domain ) ) {
 554                 status = domain->backend->sequence_number(domain,
 555                                                           &domain->sequence_number);
 556         } else {
 557                 /* just use the current time */
 558                 status = NT_STATUS_OK;
 559                 domain->sequence_number = time(NULL);
 560         }
 561
 562
 563         /* the above call could have set our domain->backend to NULL when
 564          * coming from offline to online mode, make sure to reinitialize the
 565          * backend - Guenther */
 566         get_cache( domain );
 567
 568         if (!NT_STATUS_IS_OK(status)) {
 569                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 570                 domain->sequence_number = DOM_SEQUENCE_NONE;
 571         }
 572
 573         domain->last_status = status;
 574         domain->last_seq_check = time(NULL);
 575
 576         /* save the new sequence number in the cache */
 577         store_cache_seqnum( domain );
 578
 579 done:
 580         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 581                    domain->name, domain->sequence_number));
 582
 583         return;
 584 }
 585
 586 /*
 587   decide if a cache entry has expired
 588 */
 589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 590 {
 591         /* If we've been told to be offline - stay in that state... */
 592         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 593                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 594                         keystr, domain->name ));
 595                 return false;
 596         }
 597
 598         /* when the domain is offline return the cached entry.
 599          * This deals with transient offline states... */
 600
 601         if (!domain->online) {
 602                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 603                         keystr, domain->name ));
 604                 return false;
 605         }
 606
 607         /* if the server is OK and our cache entry came from when it was down then
 608            the entry is invalid */
 609         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 610             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 611                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 612                         keystr, domain->name ));
 613                 return true;
 614         }
 615
 616         /* if the server is down or the cache entry is not older than the
 617            current sequence number then it is OK */
 618         if (wcache_server_down(domain) ||
 619             centry->sequence_number == domain->sequence_number) {
 620                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 621                         keystr, domain->name ));
 622                 return false;
 623         }
 624
 625         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 626                 keystr, domain->name ));
 627
 628         /* it's expired */
 629         return true;
 630 }
 631
 632 static struct cache_entry *wcache_fetch_raw(char *kstr)
 633 {
 634         TDB_DATA data;
 635         struct cache_entry *centry;
 636         TDB_DATA key;
 637
 638         key = string_tdb_data(kstr);
 639         data = tdb_fetch(wcache->tdb, key);
 640         if (!data.dptr) {
 641                 /* a cache miss */
 642                 return NULL;
 643         }
 644
 645         centry = SMB_XMALLOC_P(struct cache_entry);
 646         centry->data = (unsigned char *)data.dptr;
 647         centry->len = data.dsize;
 648         centry->ofs = 0;
 649
 650         if (centry->len < 8) {
 651                 /* huh? corrupt cache? */
 652                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
 653                 centry_free(centry);
 654                 return NULL;
 655         }
 656
 657         centry->status = centry_ntstatus(centry);
 658         centry->sequence_number = centry_uint32(centry);
 659
 660         return centry;
 661 }
 662
 663 /*
 664   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 665   number and return status
 666 */
 667 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 668                                         struct winbindd_domain *domain,
 669                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 670 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 671                                         struct winbindd_domain *domain,
 672                                         const char *format, ...)
 673 {
 674         va_list ap;
 675         char *kstr;
 676         struct cache_entry *centry;
 677
 678         if (!winbindd_use_cache()) {
 679                 return NULL;
 680         }
 681
 682         refresh_sequence_number(domain, false);
 683
 684         va_start(ap, format);
 685         smb_xvasprintf(&kstr, format, ap);
 686         va_end(ap);
 687
 688         centry = wcache_fetch_raw(kstr);
 689         if (centry == NULL) {
 690                 free(kstr);
 691                 return NULL;
 692         }
 693
 694         if (centry_expired(domain, kstr, centry)) {
 695
 696                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 697                          kstr, domain->name ));
 698
 699                 centry_free(centry);
 700                 free(kstr);
 701                 return NULL;
 702         }
 703
 704         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 705                  kstr, domain->name ));
 706
 707         free(kstr);
 708         return centry;
 709 }
 710
 711 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 712 static void wcache_delete(const char *format, ...)
 713 {
 714         va_list ap;
 715         char *kstr;
 716         TDB_DATA key;
 717
 718         va_start(ap, format);
 719         smb_xvasprintf(&kstr, format, ap);
 720         va_end(ap);
 721
 722         key = string_tdb_data(kstr);
 723
 724         tdb_delete(wcache->tdb, key);
 725         free(kstr);
 726 }
 727
 728 /*
 729   make sure we have at least len bytes available in a centry
 730 */
 731 static void centry_expand(struct cache_entry *centry, uint32 len)
 732 {
 733         if (centry->len - centry->ofs >= len)
 734                 return;
 735         centry->len *= 2;
 736         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 737                                          centry->len);
 738         if (!centry->data) {
 739                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 740                 smb_panic_fn("out of memory in centry_expand");
 741         }
 742 }
 743
 744 /*
 745   push a uint32 into a centry
 746 */
 747 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 748 {
 749         centry_expand(centry, 4);
 750         SIVAL(centry->data, centry->ofs, v);
 751         centry->ofs += 4;
 752 }
 753
 754 /*
 755   push a uint16 into a centry
 756 */
 757 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 758 {
 759         centry_expand(centry, 2);
 760         SIVAL(centry->data, centry->ofs, v);
 761         centry->ofs += 2;
 762 }
 763
 764 /*
 765   push a uint8 into a centry
 766 */
 767 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 768 {
 769         centry_expand(centry, 1);
 770         SCVAL(centry->data, centry->ofs, v);
 771         centry->ofs += 1;
 772 }
 773
 774 /*
 775    push a string into a centry
 776  */
 777 static void centry_put_string(struct cache_entry *centry, const char *s)
 778 {
 779         int len;
 780
 781         if (!s) {
 782                 /* null strings are marked as len 0xFFFF */
 783                 centry_put_uint8(centry, 0xFF);
 784                 return;
 785         }
 786
 787         len = strlen(s);
 788         /* can't handle more than 254 char strings. Truncating is probably best */
 789         if (len > 254) {
 790                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 791                 len = 254;
 792         }
 793         centry_put_uint8(centry, len);
 794         centry_expand(centry, len);
 795         memcpy(centry->data + centry->ofs, s, len);
 796         centry->ofs += len;
 797 }
 798
 799 /*
 800    push a 16 byte hash into a centry - treat as 16 byte string.
 801  */
 802 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 803 {
 804         centry_put_uint8(centry, 16);
 805         centry_expand(centry, 16);
 806         memcpy(centry->data + centry->ofs, val, 16);
 807         centry->ofs += 16;
 808 }
 809
 810 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
 811 {
 812         fstring sid_string;
 813         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 814 }
 815
 816
 817 /*
 818   put NTSTATUS into a centry
 819 */
 820 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 821 {
 822         uint32 status_value = NT_STATUS_V(status);
 823         centry_put_uint32(centry, status_value);
 824 }
 825
 826
 827 /*
 828   push a NTTIME into a centry
 829 */
 830 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 831 {
 832         centry_expand(centry, 8);
 833         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 834         centry->ofs += 4;
 835         SIVAL(centry->data, centry->ofs, nt >> 32);
 836         centry->ofs += 4;
 837 }
 838
 839 /*
 840   push a time_t into a centry - use a 64 bit size.
 841   NTTIME here is being used as a convenient 64-bit size.
 842 */
 843 static void centry_put_time(struct cache_entry *centry, time_t t)
 844 {
 845         NTTIME nt = (NTTIME)t;
 846         centry_put_nttime(centry, nt);
 847 }
 848
 849 /*
 850   start a centry for output. When finished, call centry_end()
 851 */
 852 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 853 {
 854         struct cache_entry *centry;
 855
 856         if (!wcache->tdb)
 857                 return NULL;
 858
 859         centry = SMB_XMALLOC_P(struct cache_entry);
 860
 861         centry->len = 8192; /* reasonable default */
 862         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 863         centry->ofs = 0;
 864         centry->sequence_number = domain->sequence_number;
 865         centry_put_ntstatus(centry, status);
 866         centry_put_uint32(centry, centry->sequence_number);
 867         return centry;
 868 }
 869
 870 /*
 871   finish a centry and write it to the tdb
 872 */
 873 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 874 static void centry_end(struct cache_entry *centry, const char *format, ...)
 875 {
 876         va_list ap;
 877         char *kstr;
 878         TDB_DATA key, data;
 879
 880         if (!winbindd_use_cache()) {
 881                 return;
 882         }
 883
 884         va_start(ap, format);
 885         smb_xvasprintf(&kstr, format, ap);
 886         va_end(ap);
 887
 888         key = string_tdb_data(kstr);
 889         data.dptr = centry->data;
 890         data.dsize = centry->ofs;
 891
 892         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 893         free(kstr);
 894 }
 895
 896 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 897                                     NTSTATUS status, const char *domain_name,
 898                                     const char *name, const DOM_SID *sid,
 899                                     enum lsa_SidType type)
 900 {
 901         struct cache_entry *centry;
 902         fstring uname;
 903
 904         centry = centry_start(domain, status);
 905         if (!centry)
 906                 return;
 907         centry_put_uint32(centry, type);
 908         centry_put_sid(centry, sid);
 909         fstrcpy(uname, name);
 910         strupper_m(uname);
 911         centry_end(centry, "NS/%s/%s", domain_name, uname);
 912         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 913                   uname, sid_string_dbg(sid), nt_errstr(status)));
 914         centry_free(centry);
 915 }
 916
 917 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 918                                     const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 919 {
 920         struct cache_entry *centry;
 921         fstring sid_string;
 922
 923         centry = centry_start(domain, status);
 924         if (!centry)
 925                 return;
 926
 927         if (NT_STATUS_IS_OK(status)) {
 928                 centry_put_uint32(centry, type);
 929                 centry_put_string(centry, domain_name);
 930                 centry_put_string(centry, name);
 931         }
 932
 933         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 934         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 935                   name, nt_errstr(status)));
 936         centry_free(centry);
 937 }
 938
 939
 940 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
 941                              struct wbint_userinfo *info)
 942 {
 943         struct cache_entry *centry;
 944         fstring sid_string;
 945
 946         if (is_null_sid(&info->user_sid)) {
 947                 return;
 948         }
 949
 950         centry = centry_start(domain, status);
 951         if (!centry)
 952                 return;
 953         centry_put_string(centry, info->acct_name);
 954         centry_put_string(centry, info->full_name);
 955         centry_put_string(centry, info->homedir);
 956         centry_put_string(centry, info->shell);
 957         centry_put_uint32(centry, info->primary_gid);
 958         centry_put_sid(centry, &info->user_sid);
 959         centry_put_sid(centry, &info->group_sid);
 960         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 961                                                   &info->user_sid));
 962         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 963         centry_free(centry);
 964 }
 965
 966 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
 967                                        NTSTATUS status,
 968                                        struct samr_DomInfo12 *lockout_policy)
 969 {
 970         struct cache_entry *centry;
 971
 972         centry = centry_start(domain, status);
 973         if (!centry)
 974                 return;
 975
 976         centry_put_nttime(centry, lockout_policy->lockout_duration);
 977         centry_put_nttime(centry, lockout_policy->lockout_window);
 978         centry_put_uint16(centry, lockout_policy->lockout_threshold);
 979
 980         centry_end(centry, "LOC_POL/%s", domain->name);
 981
 982         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
 983
 984         centry_free(centry);
 985 }
 986
 987
 988
 989 static void wcache_save_password_policy(struct winbindd_domain *domain,
 990                                         NTSTATUS status,
 991                                         struct samr_DomInfo1 *policy)
 992 {
 993         struct cache_entry *centry;
 994
 995         centry = centry_start(domain, status);
 996         if (!centry)
 997                 return;
 998
 999         centry_put_uint16(centry, policy->min_password_length);
1000         centry_put_uint16(centry, policy->password_history_length);
1001         centry_put_uint32(centry, policy->password_properties);
1002         centry_put_nttime(centry, policy->max_password_age);
1003         centry_put_nttime(centry, policy->min_password_age);
1004
1005         centry_end(centry, "PWD_POL/%s", domain->name);
1006
1007         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1008
1009         centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013  ***************************************************************************/
1014
1015 static void wcache_save_username_alias(struct winbindd_domain *domain,
1016                                        NTSTATUS status,
1017                                        const char *name, const char *alias)
1018 {
1019         struct cache_entry *centry;
1020         fstring uname;
1021
1022         if ( (centry = centry_start(domain, status)) == NULL )
1023                 return;
1024
1025         centry_put_string( centry, alias );
1026
1027         fstrcpy(uname, name);
1028         strupper_m(uname);
1029         centry_end(centry, "NSS/NA/%s", uname);
1030
1031         DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1032
1033         centry_free(centry);
1034 }
1035
1036 static void wcache_save_alias_username(struct winbindd_domain *domain,
1037                                        NTSTATUS status,
1038                                        const char *alias, const char *name)
1039 {
1040         struct cache_entry *centry;
1041         fstring uname;
1042
1043         if ( (centry = centry_start(domain, status)) == NULL )
1044                 return;
1045
1046         centry_put_string( centry, name );
1047
1048         fstrcpy(uname, alias);
1049         strupper_m(uname);
1050         centry_end(centry, "NSS/AN/%s", uname);
1051
1052         DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1053
1054         centry_free(centry);
1055 }
1056
1057 /***************************************************************************
1058  ***************************************************************************/
1059
1060 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1061                                     struct winbindd_domain *domain,
1062                                     const char *name, char **alias )
1063 {
1064         struct winbind_cache *cache = get_cache(domain);
1065         struct cache_entry *centry = NULL;
1066         NTSTATUS status;
1067         char *upper_name;
1068
1069         if ( domain->internal )
1070                 return NT_STATUS_NOT_SUPPORTED;
1071
1072         if (!cache->tdb)
1073                 goto do_query;
1074
1075         if ( (upper_name = SMB_STRDUP(name)) == NULL )
1076                 return NT_STATUS_NO_MEMORY;
1077         strupper_m(upper_name);
1078
1079         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1080
1081         SAFE_FREE( upper_name );
1082
1083         if (!centry)
1084                 goto do_query;
1085
1086         status = centry->status;
1087
1088         if (!NT_STATUS_IS_OK(status)) {
1089                 centry_free(centry);
1090                 return status;
1091         }
1092
1093         *alias = centry_string( centry, mem_ctx );
1094
1095         centry_free(centry);
1096
1097         DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1098                   name, *alias ? *alias : "(none)"));
1099
1100         return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1101
1102 do_query:
1103
1104         /* If its not in cache and we are offline, then fail */
1105
1106         if ( get_global_winbindd_state_offline() || !domain->online ) {
1107                 DEBUG(8,("resolve_username_to_alias: rejecting query "
1108                          "in offline mode\n"));
1109                 return NT_STATUS_NOT_FOUND;
1110         }
1111
1112         status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1113
1114         if ( NT_STATUS_IS_OK( status ) ) {
1115                 wcache_save_username_alias(domain, status, name, *alias);
1116         }
1117
1118         if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1119                 wcache_save_username_alias(domain, status, name, "(NULL)");
1120         }
1121
1122         DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1123                  nt_errstr(status)));
1124
1125         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1126                 set_domain_offline( domain );
1127         }
1128
1129         return status;
1130 }
1131
1132 /***************************************************************************
1133  ***************************************************************************/
1134
1135 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1136                                     struct winbindd_domain *domain,
1137                                     const char *alias, char **name )
1138 {
1139         struct winbind_cache *cache = get_cache(domain);
1140         struct cache_entry *centry = NULL;
1141         NTSTATUS status;
1142         char *upper_name;
1143
1144         if ( domain->internal )
1145                 return  NT_STATUS_NOT_SUPPORTED;
1146
1147         if (!cache->tdb)
1148                 goto do_query;
1149
1150         if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1151                 return NT_STATUS_NO_MEMORY;
1152         strupper_m(upper_name);
1153
1154         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1155
1156         SAFE_FREE( upper_name );
1157
1158         if (!centry)
1159                 goto do_query;
1160
1161         status = centry->status;
1162
1163         if (!NT_STATUS_IS_OK(status)) {
1164                 centry_free(centry);
1165                 return status;
1166         }
1167
1168         *name = centry_string( centry, mem_ctx );
1169
1170         centry_free(centry);
1171
1172         DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1173                   alias, *name ? *name : "(none)"));
1174
1175         return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1176
1177 do_query:
1178
1179         /* If its not in cache and we are offline, then fail */
1180
1181         if ( get_global_winbindd_state_offline() || !domain->online ) {
1182                 DEBUG(8,("resolve_alias_to_username: rejecting query "
1183                          "in offline mode\n"));
1184                 return NT_STATUS_NOT_FOUND;
1185         }
1186
1187         /* an alias cannot contain a domain prefix or '@' */
1188
1189         if (strchr(alias, '\\') || strchr(alias, '@')) {
1190                 DEBUG(10,("resolve_alias_to_username: skipping fully "
1191                           "qualified name %s\n", alias));
1192                 return NT_STATUS_OBJECT_NAME_INVALID;
1193         }
1194
1195         status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1196
1197         if ( NT_STATUS_IS_OK( status ) ) {
1198                 wcache_save_alias_username( domain, status, alias, *name );
1199         }
1200
1201         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1202                 wcache_save_alias_username(domain, status, alias, "(NULL)");
1203         }
1204
1205         DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1206                  nt_errstr(status)));
1207
1208         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1209                 set_domain_offline( domain );
1210         }
1211
1212         return status;
1213 }
1214
1215 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1216 {
1217         struct winbind_cache *cache = get_cache(domain);
1218         TDB_DATA data;
1219         fstring key_str, tmp;
1220         uint32 rid;
1221
1222         if (!cache->tdb) {
1223                 return NT_STATUS_INTERNAL_DB_ERROR;
1224         }
1225
1226         if (is_null_sid(sid)) {
1227                 return NT_STATUS_INVALID_SID;
1228         }
1229
1230         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1231                 return NT_STATUS_INVALID_SID;
1232         }
1233
1234         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1235
1236         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1237         if (!data.dptr) {
1238                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1239         }
1240
1241         SAFE_FREE(data.dptr);
1242         return NT_STATUS_OK;
1243 }
1244
1245 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1246    as new salted ones. */
1247
1248 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1249                           TALLOC_CTX *mem_ctx,
1250                           const DOM_SID *sid,
1251                           const uint8 **cached_nt_pass,
1252                           const uint8 **cached_salt)
1253 {
1254         struct winbind_cache *cache = get_cache(domain);
1255         struct cache_entry *centry = NULL;
1256         NTSTATUS status;
1257         time_t t;
1258         uint32 rid;
1259         fstring tmp;
1260
1261         if (!cache->tdb) {
1262                 return NT_STATUS_INTERNAL_DB_ERROR;
1263         }
1264
1265         if (is_null_sid(sid)) {
1266                 return NT_STATUS_INVALID_SID;
1267         }
1268
1269         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1270                 return NT_STATUS_INVALID_SID;
1271         }
1272
1273         /* Try and get a salted cred first. If we can't
1274            fall back to an unsalted cred. */
1275
1276         centry = wcache_fetch(cache, domain, "CRED/%s",
1277                               sid_to_fstring(tmp, sid));
1278         if (!centry) {
1279                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1280                           sid_string_dbg(sid)));
1281                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1282         }
1283
1284         t = centry_time(centry);
1285
1286         /* In the salted case this isn't actually the nt_hash itself,
1287            but the MD5 of the salt + nt_hash. Let the caller
1288            sort this out. It can tell as we only return the cached_salt
1289            if we are returning a salted cred. */
1290
1291         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1292         if (*cached_nt_pass == NULL) {
1293                 fstring sidstr;
1294
1295                 sid_to_fstring(sidstr, sid);
1296
1297                 /* Bad (old) cred cache. Delete and pretend we
1298                    don't have it. */
1299                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1300                                 sidstr));
1301                 wcache_delete("CRED/%s", sidstr);
1302                 centry_free(centry);
1303                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1304         }
1305
1306         /* We only have 17 bytes more data in the salted cred case. */
1307         if (centry->len - centry->ofs == 17) {
1308                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1309         } else {
1310                 *cached_salt = NULL;
1311         }
1312
1313         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1314         if (*cached_salt) {
1315                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1316         }
1317
1318         status = centry->status;
1319
1320         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1321                   sid_string_dbg(sid), nt_errstr(status) ));
1322
1323         centry_free(centry);
1324         return status;
1325 }
1326
1327 /* Store creds for a SID - only writes out new salted ones. */
1328
1329 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1330                            TALLOC_CTX *mem_ctx,
1331                            const DOM_SID *sid,
1332                            const uint8 nt_pass[NT_HASH_LEN])
1333 {
1334         struct cache_entry *centry;
1335         fstring sid_string;
1336         uint32 rid;
1337         uint8 cred_salt[NT_HASH_LEN];
1338         uint8 salted_hash[NT_HASH_LEN];
1339
1340         if (is_null_sid(sid)) {
1341                 return NT_STATUS_INVALID_SID;
1342         }
1343
1344         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1345                 return NT_STATUS_INVALID_SID;
1346         }
1347
1348         centry = centry_start(domain, NT_STATUS_OK);
1349         if (!centry) {
1350                 return NT_STATUS_INTERNAL_DB_ERROR;
1351         }
1352
1353         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1354
1355         centry_put_time(centry, time(NULL));
1356
1357         /* Create a salt and then salt the hash. */
1358         generate_random_buffer(cred_salt, NT_HASH_LEN);
1359         E_md5hash(cred_salt, nt_pass, salted_hash);
1360
1361         centry_put_hash16(centry, salted_hash);
1362         centry_put_hash16(centry, cred_salt);
1363         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1364
1365         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1366
1367         centry_free(centry);
1368
1369         return NT_STATUS_OK;
1370 }
1371
1372
1373 /* Query display info. This is the basic user list fn */
1374 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1375                                 TALLOC_CTX *mem_ctx,
1376                                 uint32 *num_entries,
1377                                 struct wbint_userinfo **info)
1378 {
1379         struct winbind_cache *cache = get_cache(domain);
1380         struct cache_entry *centry = NULL;
1381         NTSTATUS status;
1382         unsigned int i, retry;
1383
1384         if (!cache->tdb)
1385                 goto do_query;
1386
1387         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1388         if (!centry)
1389                 goto do_query;
1390
1391         *num_entries = centry_uint32(centry);
1392
1393         if (*num_entries == 0)
1394                 goto do_cached;
1395
1396         (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1397         if (! (*info)) {
1398                 smb_panic_fn("query_user_list out of memory");
1399         }
1400         for (i=0; i<(*num_entries); i++) {
1401                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1402                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1403                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1404                 (*info)[i].shell = centry_string(centry, mem_ctx);
1405                 centry_sid(centry, &(*info)[i].user_sid);
1406                 centry_sid(centry, &(*info)[i].group_sid);
1407         }
1408
1409 do_cached:
1410         status = centry->status;
1411
1412         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1413                 domain->name, nt_errstr(status) ));
1414
1415         centry_free(centry);
1416         return status;
1417
1418 do_query:
1419         *num_entries = 0;
1420         *info = NULL;
1421
1422         /* Return status value returned by seq number check */
1423
1424         if (!NT_STATUS_IS_OK(domain->last_status))
1425                 return domain->last_status;
1426
1427         /* Put the query_user_list() in a retry loop.  There appears to be
1428          * some bug either with Windows 2000 or Samba's handling of large
1429          * rpc replies.  This manifests itself as sudden disconnection
1430          * at a random point in the enumeration of a large (60k) user list.
1431          * The retry loop simply tries the operation again. )-:  It's not
1432          * pretty but an acceptable workaround until we work out what the
1433          * real problem is. */
1434
1435         retry = 0;
1436         do {
1437
1438                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1439                         domain->name ));
1440
1441                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1442                 if (!NT_STATUS_IS_OK(status)) {
1443                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1444                                   "retrying\n", NT_STATUS_V(status)));
1445                 }
1446                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1447                         DEBUG(3, ("query_user_list: flushing "
1448                                   "connection cache\n"));
1449                         invalidate_cm_connection(&domain->conn);
1450                 }
1451
1452         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1453                  (retry++ < 5));
1454
1455         /* and save it */
1456         refresh_sequence_number(domain, false);
1457         centry = centry_start(domain, status);
1458         if (!centry)
1459                 goto skip_save;
1460         centry_put_uint32(centry, *num_entries);
1461         for (i=0; i<(*num_entries); i++) {
1462                 centry_put_string(centry, (*info)[i].acct_name);
1463                 centry_put_string(centry, (*info)[i].full_name);
1464                 centry_put_string(centry, (*info)[i].homedir);
1465                 centry_put_string(centry, (*info)[i].shell);
1466                 centry_put_sid(centry, &(*info)[i].user_sid);
1467                 centry_put_sid(centry, &(*info)[i].group_sid);
1468                 if (domain->backend && domain->backend->consistent) {
1469                         /* when the backend is consistent we can pre-prime some mappings */
1470                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1471                                                 domain->name,
1472                                                 (*info)[i].acct_name,
1473                                                 &(*info)[i].user_sid,
1474                                                 SID_NAME_USER);
1475                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1476                                                 &(*info)[i].user_sid,
1477                                                 domain->name,
1478                                                 (*info)[i].acct_name,
1479                                                 SID_NAME_USER);
1480                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1481                 }
1482         }
1483         centry_end(centry, "UL/%s", domain->name);
1484         centry_free(centry);
1485
1486 skip_save:
1487         return status;
1488 }
1489
1490 /* list all domain groups */
1491 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1492                                 TALLOC_CTX *mem_ctx,
1493                                 uint32 *num_entries,
1494                                 struct acct_info **info)
1495 {
1496         struct winbind_cache *cache = get_cache(domain);
1497         struct cache_entry *centry = NULL;
1498         NTSTATUS status;
1499         unsigned int i;
1500
1501         if (!cache->tdb)
1502                 goto do_query;
1503
1504         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1505         if (!centry)
1506                 goto do_query;
1507
1508         *num_entries = centry_uint32(centry);
1509
1510         if (*num_entries == 0)
1511                 goto do_cached;
1512
1513         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1514         if (! (*info)) {
1515                 smb_panic_fn("enum_dom_groups out of memory");
1516         }
1517         for (i=0; i<(*num_entries); i++) {
1518                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1519                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1520                 (*info)[i].rid = centry_uint32(centry);
1521         }
1522
1523 do_cached:
1524         status = centry->status;
1525
1526         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1527                 domain->name, nt_errstr(status) ));
1528
1529         centry_free(centry);
1530         return status;
1531
1532 do_query:
1533         *num_entries = 0;
1534         *info = NULL;
1535
1536         /* Return status value returned by seq number check */
1537
1538         if (!NT_STATUS_IS_OK(domain->last_status))
1539                 return domain->last_status;
1540
1541         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1542                 domain->name ));
1543
1544         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1545
1546         /* and save it */
1547         refresh_sequence_number(domain, false);
1548         centry = centry_start(domain, status);
1549         if (!centry)
1550                 goto skip_save;
1551         centry_put_uint32(centry, *num_entries);
1552         for (i=0; i<(*num_entries); i++) {
1553                 centry_put_string(centry, (*info)[i].acct_name);
1554                 centry_put_string(centry, (*info)[i].acct_desc);
1555                 centry_put_uint32(centry, (*info)[i].rid);
1556         }
1557         centry_end(centry, "GL/%s/domain", domain->name);
1558         centry_free(centry);
1559
1560 skip_save:
1561         return status;
1562 }
1563
1564 /* list all domain groups */
1565 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1566                                 TALLOC_CTX *mem_ctx,
1567                                 uint32 *num_entries,
1568                                 struct acct_info **info)
1569 {
1570         struct winbind_cache *cache = get_cache(domain);
1571         struct cache_entry *centry = NULL;
1572         NTSTATUS status;
1573         unsigned int i;
1574
1575         if (!cache->tdb)
1576                 goto do_query;
1577
1578         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1579         if (!centry)
1580                 goto do_query;
1581
1582         *num_entries = centry_uint32(centry);
1583
1584         if (*num_entries == 0)
1585                 goto do_cached;
1586
1587         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1588         if (! (*info)) {
1589                 smb_panic_fn("enum_dom_groups out of memory");
1590         }
1591         for (i=0; i<(*num_entries); i++) {
1592                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1593                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1594                 (*info)[i].rid = centry_uint32(centry);
1595         }
1596
1597 do_cached:
1598
1599         /* If we are returning cached data and the domain controller
1600            is down then we don't know whether the data is up to date
1601            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1602            indicate this. */
1603
1604         if (wcache_server_down(domain)) {
1605                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1606                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1607         } else
1608                 status = centry->status;
1609
1610         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1611                 domain->name, nt_errstr(status) ));
1612
1613         centry_free(centry);
1614         return status;
1615
1616 do_query:
1617         *num_entries = 0;
1618         *info = NULL;
1619
1620         /* Return status value returned by seq number check */
1621
1622         if (!NT_STATUS_IS_OK(domain->last_status))
1623                 return domain->last_status;
1624
1625         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1626                 domain->name ));
1627
1628         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1629
1630         /* and save it */
1631         refresh_sequence_number(domain, false);
1632         centry = centry_start(domain, status);
1633         if (!centry)
1634                 goto skip_save;
1635         centry_put_uint32(centry, *num_entries);
1636         for (i=0; i<(*num_entries); i++) {
1637                 centry_put_string(centry, (*info)[i].acct_name);
1638                 centry_put_string(centry, (*info)[i].acct_desc);
1639                 centry_put_uint32(centry, (*info)[i].rid);
1640         }
1641         centry_end(centry, "GL/%s/local", domain->name);
1642         centry_free(centry);
1643
1644 skip_save:
1645         return status;
1646 }
1647
1648 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1649                             const char *domain_name,
1650                             const char *name,
1651                             struct dom_sid *sid,
1652                             enum lsa_SidType *type)
1653 {
1654         struct winbind_cache *cache = get_cache(domain);
1655         struct cache_entry *centry;
1656         NTSTATUS status;
1657         char *uname;
1658
1659         if (cache->tdb == NULL) {
1660                 return NT_STATUS_NOT_FOUND;
1661         }
1662
1663         uname = talloc_strdup_upper(talloc_tos(), name);
1664         if (uname == NULL) {
1665                 return NT_STATUS_NO_MEMORY;
1666         }
1667
1668         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1669         TALLOC_FREE(uname);
1670         if (centry == NULL) {
1671                 return NT_STATUS_NOT_FOUND;
1672         }
1673
1674         status = centry->status;
1675         if (NT_STATUS_IS_OK(status)) {
1676                 *type = (enum lsa_SidType)centry_uint32(centry);
1677                 centry_sid(centry, sid);
1678         }
1679
1680         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1681                   "%s\n", domain->name, nt_errstr(status) ));
1682
1683         centry_free(centry);
1684         return status;
1685 }
1686
1687 /* convert a single name to a sid in a domain */
1688 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1689                             TALLOC_CTX *mem_ctx,
1690                             const char *domain_name,
1691                             const char *name,
1692                             uint32_t flags,
1693                             DOM_SID *sid,
1694                             enum lsa_SidType *type)
1695 {
1696         NTSTATUS status;
1697
1698         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1699         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1700                 return status;
1701         }
1702
1703         ZERO_STRUCTP(sid);
1704
1705         /* If the seq number check indicated that there is a problem
1706          * with this DC, then return that status... except for
1707          * access_denied.  This is special because the dc may be in
1708          * "restrict anonymous = 1" mode, in which case it will deny
1709          * most unauthenticated operations, but *will* allow the LSA
1710          * name-to-sid that we try as a fallback. */
1711
1712         if (!(NT_STATUS_IS_OK(domain->last_status)
1713               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1714                 return domain->last_status;
1715
1716         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1717                 domain->name ));
1718
1719         status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1720                                               name, flags, sid, type);
1721
1722         /* and save it */
1723         refresh_sequence_number(domain, false);
1724
1725         if (domain->online &&
1726             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1727                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1728
1729                 /* Only save the reverse mapping if this was not a UPN */
1730                 if (!strchr(name, '@')) {
1731                         strupper_m(CONST_DISCARD(char *,domain_name));
1732                         strlower_m(CONST_DISCARD(char *,name));
1733                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1734                 }
1735         }
1736
1737         return status;
1738 }
1739
1740 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1741                             const struct dom_sid *sid,
1742                             TALLOC_CTX *mem_ctx,
1743                             char **domain_name,
1744                             char **name,
1745                             enum lsa_SidType *type)
1746 {
1747         struct winbind_cache *cache = get_cache(domain);
1748         struct cache_entry *centry;
1749         char *sid_string;
1750         NTSTATUS status;
1751
1752         if (cache->tdb == NULL) {
1753                 return NT_STATUS_NOT_FOUND;
1754         }
1755
1756         sid_string = sid_string_tos(sid);
1757         if (sid_string == NULL) {
1758                 return NT_STATUS_NO_MEMORY;
1759         }
1760
1761         centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1762         TALLOC_FREE(sid_string);
1763         if (centry == NULL) {
1764                 return NT_STATUS_NOT_FOUND;
1765         }
1766
1767         if (NT_STATUS_IS_OK(centry->status)) {
1768                 *type = (enum lsa_SidType)centry_uint32(centry);
1769                 *domain_name = centry_string(centry, mem_ctx);
1770                 *name = centry_string(centry, mem_ctx);
1771         }
1772
1773         status = centry->status;
1774         centry_free(centry);
1775
1776         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1777                   "%s\n", domain->name, nt_errstr(status) ));
1778
1779         return status;
1780 }
1781
1782 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1783    given */
1784 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1785                             TALLOC_CTX *mem_ctx,
1786                             const DOM_SID *sid,
1787                             char **domain_name,
1788                             char **name,
1789                             enum lsa_SidType *type)
1790 {
1791         NTSTATUS status;
1792
1793         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1794                                     type);
1795         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1796                 return status;
1797         }
1798
1799         *name = NULL;
1800         *domain_name = NULL;
1801
1802         /* If the seq number check indicated that there is a problem
1803          * with this DC, then return that status... except for
1804          * access_denied.  This is special because the dc may be in
1805          * "restrict anonymous = 1" mode, in which case it will deny
1806          * most unauthenticated operations, but *will* allow the LSA
1807          * sid-to-name that we try as a fallback. */
1808
1809         if (!(NT_STATUS_IS_OK(domain->last_status)
1810               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1811                 return domain->last_status;
1812
1813         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1814                 domain->name ));
1815
1816         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1817
1818         /* and save it */
1819         refresh_sequence_number(domain, false);
1820         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1821
1822         /* We can't save the name to sid mapping here, as with sid history a
1823          * later name2sid would give the wrong sid. */
1824
1825         return status;
1826 }
1827
1828 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1829                               TALLOC_CTX *mem_ctx,
1830                               const DOM_SID *domain_sid,
1831                               uint32 *rids,
1832                               size_t num_rids,
1833                               char **domain_name,
1834                               char ***names,
1835                               enum lsa_SidType **types)
1836 {
1837         struct winbind_cache *cache = get_cache(domain);
1838         size_t i;
1839         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1840         bool have_mapped;
1841         bool have_unmapped;
1842
1843         *domain_name = NULL;
1844         *names = NULL;
1845         *types = NULL;
1846
1847         if (!cache->tdb) {
1848                 goto do_query;
1849         }
1850
1851         if (num_rids == 0) {
1852                 return NT_STATUS_OK;
1853         }
1854
1855         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1856         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1857
1858         if ((*names == NULL) || (*types == NULL)) {
1859                 result = NT_STATUS_NO_MEMORY;
1860                 goto error;
1861         }
1862
1863         have_mapped = have_unmapped = false;
1864
1865         for (i=0; i<num_rids; i++) {
1866                 DOM_SID sid;
1867                 struct cache_entry *centry;
1868                 fstring tmp;
1869
1870                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1871                         result = NT_STATUS_INTERNAL_ERROR;
1872                         goto error;
1873                 }
1874
1875                 centry = wcache_fetch(cache, domain, "SN/%s",
1876                                       sid_to_fstring(tmp, &sid));
1877                 if (!centry) {
1878                         goto do_query;
1879                 }
1880
1881                 (*types)[i] = SID_NAME_UNKNOWN;
1882                 (*names)[i] = talloc_strdup(*names, "");
1883
1884                 if (NT_STATUS_IS_OK(centry->status)) {
1885                         char *dom;
1886                         have_mapped = true;
1887                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1888
1889                         dom = centry_string(centry, mem_ctx);
1890                         if (*domain_name == NULL) {
1891                                 *domain_name = dom;
1892                         } else {
1893                                 talloc_free(dom);
1894                         }
1895
1896                         (*names)[i] = centry_string(centry, *names);
1897
1898                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1899                         have_unmapped = true;
1900
1901                 } else {
1902                         /* something's definitely wrong */
1903                         result = centry->status;
1904                         goto error;
1905                 }
1906
1907                 centry_free(centry);
1908         }
1909
1910         if (!have_mapped) {
1911                 return NT_STATUS_NONE_MAPPED;
1912         }
1913         if (!have_unmapped) {
1914                 return NT_STATUS_OK;
1915         }
1916         return STATUS_SOME_UNMAPPED;
1917
1918  do_query:
1919
1920         TALLOC_FREE(*names);
1921         TALLOC_FREE(*types);
1922
1923         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1924                                                 rids, num_rids, domain_name,
1925                                                 names, types);
1926
1927         /*
1928           None of the queried rids has been found so save all negative entries
1929         */
1930         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1931                 for (i = 0; i < num_rids; i++) {
1932                         DOM_SID sid;
1933                         const char *name = "";
1934                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
1935                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
1936
1937                         if (!sid_compose(&sid, domain_sid, rids[i])) {
1938                                 return NT_STATUS_INTERNAL_ERROR;
1939                         }
1940
1941                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1942                                                 name, type);
1943                 }
1944
1945                 return result;
1946         }
1947
1948         /*
1949           Some or all of the queried rids have been found.
1950         */
1951         if (!NT_STATUS_IS_OK(result) &&
1952             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1953                 return result;
1954         }
1955
1956         refresh_sequence_number(domain, false);
1957
1958         for (i=0; i<num_rids; i++) {
1959                 DOM_SID sid;
1960                 NTSTATUS status;
1961
1962                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1963                         result = NT_STATUS_INTERNAL_ERROR;
1964                         goto error;
1965                 }
1966
1967                 status = (*types)[i] == SID_NAME_UNKNOWN ?
1968                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1969
1970                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1971                                         (*names)[i], (*types)[i]);
1972         }
1973
1974         return result;
1975
1976  error:
1977         TALLOC_FREE(*names);
1978         TALLOC_FREE(*types);
1979         return result;
1980 }
1981
1982 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
1983                            TALLOC_CTX *mem_ctx,
1984                            const struct dom_sid *user_sid,
1985                            struct wbint_userinfo *info)
1986 {
1987         struct winbind_cache *cache = get_cache(domain);
1988         struct cache_entry *centry = NULL;
1989         NTSTATUS status;
1990         char *sid_string;
1991
1992         if (cache->tdb == NULL) {
1993                 return NT_STATUS_NOT_FOUND;
1994         }
1995
1996         sid_string = sid_string_tos(user_sid);
1997         if (sid_string == NULL) {
1998                 return NT_STATUS_NO_MEMORY;
1999         }
2000
2001         centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2002         TALLOC_FREE(sid_string);
2003         if (centry == NULL) {
2004                 return NT_STATUS_NOT_FOUND;
2005         }
2006
2007         /*
2008          * If we have an access denied cache entry and a cached info3
2009          * in the samlogon cache then do a query.  This will force the
2010          * rpc back end to return the info3 data.
2011          */
2012
2013         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2014             netsamlogon_cache_have(user_sid)) {
2015                 DEBUG(10, ("query_user: cached access denied and have cached "
2016                            "info3\n"));
2017                 domain->last_status = NT_STATUS_OK;
2018                 centry_free(centry);
2019                 return NT_STATUS_NOT_FOUND;
2020         }
2021
2022         /* if status is not ok then this is a negative hit
2023            and the rest of the data doesn't matter */
2024         status = centry->status;
2025         if (NT_STATUS_IS_OK(status)) {
2026                 info->acct_name = centry_string(centry, mem_ctx);
2027                 info->full_name = centry_string(centry, mem_ctx);
2028                 info->homedir = centry_string(centry, mem_ctx);
2029                 info->shell = centry_string(centry, mem_ctx);
2030                 info->primary_gid = centry_uint32(centry);
2031                 centry_sid(centry, &info->user_sid);
2032                 centry_sid(centry, &info->group_sid);
2033         }
2034
2035         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2036                   "%s\n", domain->name, nt_errstr(status) ));
2037
2038         centry_free(centry);
2039         return status;
2040 }
2041
2042 /* Lookup user information from a rid */
2043 static NTSTATUS query_user(struct winbindd_domain *domain,
2044                            TALLOC_CTX *mem_ctx,
2045                            const DOM_SID *user_sid,
2046                            struct wbint_userinfo *info)
2047 {
2048         NTSTATUS status;
2049
2050         status = wcache_query_user(domain, mem_ctx, user_sid, info);
2051         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2052                 return status;
2053         }
2054
2055         ZERO_STRUCTP(info);
2056
2057         /* Return status value returned by seq number check */
2058
2059         if (!NT_STATUS_IS_OK(domain->last_status))
2060                 return domain->last_status;
2061
2062         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2063                 domain->name ));
2064
2065         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2066
2067         /* and save it */
2068         refresh_sequence_number(domain, false);
2069         wcache_save_user(domain, status, info);
2070
2071         return status;
2072 }
2073
2074 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2075                                   TALLOC_CTX *mem_ctx,
2076                                   const struct dom_sid *user_sid,
2077                                   uint32_t *pnum_sids,
2078                                   struct dom_sid **psids)
2079 {
2080         struct winbind_cache *cache = get_cache(domain);
2081         struct cache_entry *centry = NULL;
2082         NTSTATUS status;
2083         uint32_t i, num_sids;
2084         struct dom_sid *sids;
2085         fstring sid_string;
2086
2087         if (cache->tdb == NULL) {
2088                 return NT_STATUS_NOT_FOUND;
2089         }
2090
2091         centry = wcache_fetch(cache, domain, "UG/%s",
2092                               sid_to_fstring(sid_string, user_sid));
2093         if (centry == NULL) {
2094                 return NT_STATUS_NOT_FOUND;
2095         }
2096
2097         /* If we have an access denied cache entry and a cached info3 in the
2098            samlogon cache then do a query.  This will force the rpc back end
2099            to return the info3 data. */
2100
2101         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2102             && netsamlogon_cache_have(user_sid)) {
2103                 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2104                            "cached info3\n"));
2105                 domain->last_status = NT_STATUS_OK;
2106                 centry_free(centry);
2107                 return NT_STATUS_NOT_FOUND;
2108         }
2109
2110         num_sids = centry_uint32(centry);
2111         sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2112         if (sids == NULL) {
2113                 return NT_STATUS_NO_MEMORY;
2114         }
2115
2116         for (i=0; i<num_sids; i++) {
2117                 centry_sid(centry, &sids[i]);
2118         }
2119
2120         status = centry->status;
2121
2122         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2123                   "status: %s\n", domain->name, nt_errstr(status)));
2124
2125         centry_free(centry);
2126
2127         *pnum_sids = num_sids;
2128         *psids = sids;
2129         return status;
2130 }
2131
2132 /* Lookup groups a user is a member of. */
2133 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2134                                   TALLOC_CTX *mem_ctx,
2135                                   const DOM_SID *user_sid,
2136                                   uint32 *num_groups, DOM_SID **user_gids)
2137 {
2138         struct cache_entry *centry = NULL;
2139         NTSTATUS status;
2140         unsigned int i;
2141         fstring sid_string;
2142
2143         status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2144                                           num_groups, user_gids);
2145         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2146                 return status;
2147         }
2148
2149         (*num_groups) = 0;
2150         (*user_gids) = NULL;
2151
2152         /* Return status value returned by seq number check */
2153
2154         if (!NT_STATUS_IS_OK(domain->last_status))
2155                 return domain->last_status;
2156
2157         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2158                 domain->name ));
2159
2160         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2161
2162         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2163                 goto skip_save;
2164
2165         /* and save it */
2166         refresh_sequence_number(domain, false);
2167         centry = centry_start(domain, status);
2168         if (!centry)
2169                 goto skip_save;
2170
2171         centry_put_uint32(centry, *num_groups);
2172         for (i=0; i<(*num_groups); i++) {
2173                 centry_put_sid(centry, &(*user_gids)[i]);
2174         }
2175
2176         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2177         centry_free(centry);
2178
2179 skip_save:
2180         return status;
2181 }
2182
2183 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2184                                  const struct dom_sid *sids)
2185 {
2186         uint32_t i;
2187         char *sidlist;
2188
2189         sidlist = talloc_strdup(mem_ctx, "");
2190         if (sidlist == NULL) {
2191                 return NULL;
2192         }
2193         for (i=0; i<num_sids; i++) {
2194                 fstring tmp;
2195                 sidlist = talloc_asprintf_append_buffer(
2196                         sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2197                 if (sidlist == NULL) {
2198                         return NULL;
2199                 }
2200         }
2201         return sidlist;
2202 }
2203
2204 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2205                                    TALLOC_CTX *mem_ctx, uint32_t num_sids,
2206                                    const struct dom_sid *sids,
2207                                    uint32_t *pnum_aliases, uint32_t **paliases)
2208 {
2209         struct winbind_cache *cache = get_cache(domain);
2210         struct cache_entry *centry = NULL;
2211         uint32_t num_aliases;
2212         uint32_t *aliases;
2213         NTSTATUS status;
2214         char *sidlist;
2215         int i;
2216
2217         if (cache->tdb == NULL) {
2218                 return NT_STATUS_NOT_FOUND;
2219         }
2220
2221         if (num_sids == 0) {
2222                 *pnum_aliases = 0;
2223                 *paliases = NULL;
2224                 return NT_STATUS_OK;
2225         }
2226
2227         /* We need to cache indexed by the whole list of SIDs, the aliases
2228          * resulting might come from any of the SIDs. */
2229
2230         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2231         if (sidlist == NULL) {
2232                 return NT_STATUS_NO_MEMORY;
2233         }
2234
2235         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2236         TALLOC_FREE(sidlist);
2237         if (centry == NULL) {
2238                 return NT_STATUS_NOT_FOUND;
2239         }
2240
2241         num_aliases = centry_uint32(centry);
2242         aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2243         if (aliases == NULL) {
2244                 centry_free(centry);
2245                 return NT_STATUS_NO_MEMORY;
2246         }
2247
2248         for (i=0; i<num_aliases; i++) {
2249                 aliases[i] = centry_uint32(centry);
2250         }
2251
2252         status = centry->status;
2253
2254         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2255                   "status %s\n", domain->name, nt_errstr(status)));
2256
2257         centry_free(centry);
2258
2259         *pnum_aliases = num_aliases;
2260         *paliases = aliases;
2261
2262         return status;
2263 }
2264
2265 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2266                                    TALLOC_CTX *mem_ctx,
2267                                    uint32 num_sids, const DOM_SID *sids,
2268                                    uint32 *num_aliases, uint32 **alias_rids)
2269 {
2270         struct cache_entry *centry = NULL;
2271         NTSTATUS status;
2272         char *sidlist;
2273         int i;
2274
2275         status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2276                                            num_aliases, alias_rids);
2277         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2278                 return status;
2279         }
2280
2281         (*num_aliases) = 0;
2282         (*alias_rids) = NULL;
2283
2284         if (!NT_STATUS_IS_OK(domain->last_status))
2285                 return domain->last_status;
2286
2287         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2288                   "for domain %s\n", domain->name ));
2289
2290         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2291         if (sidlist == NULL) {
2292                 return NT_STATUS_NO_MEMORY;
2293         }
2294
2295         status = domain->backend->lookup_useraliases(domain, mem_ctx,
2296                                                      num_sids, sids,
2297                                                      num_aliases, alias_rids);
2298
2299         /* and save it */
2300         refresh_sequence_number(domain, false);
2301         centry = centry_start(domain, status);
2302         if (!centry)
2303                 goto skip_save;
2304         centry_put_uint32(centry, *num_aliases);
2305         for (i=0; i<(*num_aliases); i++)
2306                 centry_put_uint32(centry, (*alias_rids)[i]);
2307         centry_end(centry, "UA%s", sidlist);
2308         centry_free(centry);
2309
2310  skip_save:
2311         return status;
2312 }
2313
2314 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2315                                 TALLOC_CTX *mem_ctx,
2316                                 const struct dom_sid *group_sid,
2317                                 uint32_t *num_names,
2318                                 struct dom_sid **sid_mem, char ***names,
2319                                 uint32_t **name_types)
2320 {
2321         struct winbind_cache *cache = get_cache(domain);
2322         struct cache_entry *centry = NULL;
2323         NTSTATUS status;
2324         unsigned int i;
2325         char *sid_string;
2326
2327         if (cache->tdb == NULL) {
2328                 return NT_STATUS_NOT_FOUND;
2329         }
2330
2331         sid_string = sid_string_tos(group_sid);
2332         if (sid_string == NULL) {
2333                 return NT_STATUS_NO_MEMORY;
2334         }
2335
2336         centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2337         TALLOC_FREE(sid_string);
2338         if (centry == NULL) {
2339                 return NT_STATUS_NOT_FOUND;
2340         }
2341
2342         *sid_mem = NULL;
2343         *names = NULL;
2344         *name_types = NULL;
2345
2346         *num_names = centry_uint32(centry);
2347         if (*num_names == 0) {
2348                 centry_free(centry);
2349                 return NT_STATUS_OK;
2350         }
2351
2352         *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2353         *names = talloc_array(mem_ctx, char *, *num_names);
2354         *name_types = talloc_array(mem_ctx, uint32, *num_names);
2355
2356         if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2357                 TALLOC_FREE(*sid_mem);
2358                 TALLOC_FREE(*names);
2359                 TALLOC_FREE(*name_types);
2360                 centry_free(centry);
2361                 return NT_STATUS_NO_MEMORY;
2362         }
2363
2364         for (i=0; i<(*num_names); i++) {
2365                 centry_sid(centry, &(*sid_mem)[i]);
2366                 (*names)[i] = centry_string(centry, mem_ctx);
2367                 (*name_types)[i] = centry_uint32(centry);
2368         }
2369
2370         status = centry->status;
2371
2372         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2373                   "status: %s\n", domain->name, nt_errstr(status)));
2374
2375         centry_free(centry);
2376         return status;
2377 }
2378
2379 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2380                                 TALLOC_CTX *mem_ctx,
2381                                 const DOM_SID *group_sid,
2382                                 enum lsa_SidType type,
2383                                 uint32 *num_names,
2384                                 DOM_SID **sid_mem, char ***names,
2385                                 uint32 **name_types)
2386 {
2387         struct cache_entry *centry = NULL;
2388         NTSTATUS status;
2389         unsigned int i;
2390         fstring sid_string;
2391
2392         status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2393                                         sid_mem, names, name_types);
2394         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2395                 return status;
2396         }
2397
2398         (*num_names) = 0;
2399         (*sid_mem) = NULL;
2400         (*names) = NULL;
2401         (*name_types) = NULL;
2402
2403         /* Return status value returned by seq number check */
2404
2405         if (!NT_STATUS_IS_OK(domain->last_status))
2406                 return domain->last_status;
2407
2408         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2409                 domain->name ));
2410
2411         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2412                                                   type, num_names,
2413                                                   sid_mem, names, name_types);
2414
2415         /* and save it */
2416         refresh_sequence_number(domain, false);
2417         centry = centry_start(domain, status);
2418         if (!centry)
2419                 goto skip_save;
2420         centry_put_uint32(centry, *num_names);
2421         for (i=0; i<(*num_names); i++) {
2422                 centry_put_sid(centry, &(*sid_mem)[i]);
2423                 centry_put_string(centry, (*names)[i]);
2424                 centry_put_uint32(centry, (*name_types)[i]);
2425         }
2426         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2427         centry_free(centry);
2428
2429 skip_save:
2430         return status;
2431 }
2432
2433 /* find the sequence number for a domain */
2434 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2435 {
2436         refresh_sequence_number(domain, false);
2437
2438         *seq = domain->sequence_number;
2439
2440         return NT_STATUS_OK;
2441 }
2442
2443 /* enumerate trusted domains
2444  * (we need to have the list of trustdoms in the cache when we go offline) -
2445  * Guenther */
2446 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2447                                 TALLOC_CTX *mem_ctx,
2448                                 uint32 *num_domains,
2449                                 char ***names,
2450                                 char ***alt_names,
2451                                 DOM_SID **dom_sids)
2452 {
2453         struct winbind_cache *cache = get_cache(domain);
2454         struct cache_entry *centry = NULL;
2455         NTSTATUS status;
2456         int i;
2457
2458         if (!cache->tdb)
2459                 goto do_query;
2460
2461         centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2462
2463         if (!centry) {
2464                 goto do_query;
2465         }
2466
2467         *num_domains = centry_uint32(centry);
2468
2469         if (*num_domains) {
2470                 (*names)        = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2471                 (*alt_names)    = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2472                 (*dom_sids)     = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2473
2474                 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2475                         smb_panic_fn("trusted_domains out of memory");
2476                 }
2477         } else {
2478                 (*names) = NULL;
2479                 (*alt_names) = NULL;
2480                 (*dom_sids) = NULL;
2481         }
2482
2483         for (i=0; i<(*num_domains); i++) {
2484                 (*names)[i] = centry_string(centry, mem_ctx);
2485                 (*alt_names)[i] = centry_string(centry, mem_ctx);
2486                 if (!centry_sid(centry, &(*dom_sids)[i])) {
2487                         sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2488                 }
2489         }
2490
2491         status = centry->status;
2492
2493         DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2494                 domain->name, *num_domains, nt_errstr(status) ));
2495
2496         centry_free(centry);
2497         return status;
2498
2499 do_query:
2500         (*num_domains) = 0;
2501         (*dom_sids) = NULL;
2502         (*names) = NULL;
2503         (*alt_names) = NULL;
2504
2505         /* Return status value returned by seq number check */
2506
2507         if (!NT_STATUS_IS_OK(domain->last_status))
2508                 return domain->last_status;
2509
2510         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2511                 domain->name ));
2512
2513         status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2514                                                 names, alt_names, dom_sids);
2515
2516         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2517          * so that the generic centry handling still applies correctly -
2518          * Guenther*/
2519
2520         if (!NT_STATUS_IS_ERR(status)) {
2521                 status = NT_STATUS_OK;
2522         }
2523
2524
2525 #if 0    /* Disabled as we want the trust dom list to be managed by
2526             the main parent and always to make the query.  --jerry */
2527
2528         /* and save it */
2529         refresh_sequence_number(domain, false);
2530
2531         centry = centry_start(domain, status);
2532         if (!centry)
2533                 goto skip_save;
2534
2535         centry_put_uint32(centry, *num_domains);
2536
2537         for (i=0; i<(*num_domains); i++) {
2538                 centry_put_string(centry, (*names)[i]);
2539                 centry_put_string(centry, (*alt_names)[i]);
2540                 centry_put_sid(centry, &(*dom_sids)[i]);
2541         }
2542
2543         centry_end(centry, "TRUSTDOMS/%s", domain->name);
2544
2545         centry_free(centry);
2546
2547 skip_save:
2548 #endif
2549
2550         return status;
2551 }
2552
2553 /* get lockout policy */
2554 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2555                                TALLOC_CTX *mem_ctx,
2556                                struct samr_DomInfo12 *policy)
2557 {
2558         struct winbind_cache *cache = get_cache(domain);
2559         struct cache_entry *centry = NULL;
2560         NTSTATUS status;
2561
2562         if (!cache->tdb)
2563                 goto do_query;
2564
2565         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2566
2567         if (!centry)
2568                 goto do_query;
2569
2570         policy->lockout_duration = centry_nttime(centry);
2571         policy->lockout_window = centry_nttime(centry);
2572         policy->lockout_threshold = centry_uint16(centry);
2573
2574         status = centry->status;
2575
2576         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2577                 domain->name, nt_errstr(status) ));
2578
2579         centry_free(centry);
2580         return status;
2581
2582 do_query:
2583         ZERO_STRUCTP(policy);
2584
2585         /* Return status value returned by seq number check */
2586
2587         if (!NT_STATUS_IS_OK(domain->last_status))
2588                 return domain->last_status;
2589
2590         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2591                 domain->name ));
2592
2593         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2594
2595         /* and save it */
2596         refresh_sequence_number(domain, false);
2597         wcache_save_lockout_policy(domain, status, policy);
2598
2599         return status;
2600 }
2601
2602 /* get password policy */
2603 static NTSTATUS password_policy(struct winbindd_domain *domain,
2604                                 TALLOC_CTX *mem_ctx,
2605                                 struct samr_DomInfo1 *policy)
2606 {
2607         struct winbind_cache *cache = get_cache(domain);
2608         struct cache_entry *centry = NULL;
2609         NTSTATUS status;
2610
2611         if (!cache->tdb)
2612                 goto do_query;
2613
2614         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2615
2616         if (!centry)
2617                 goto do_query;
2618
2619         policy->min_password_length = centry_uint16(centry);
2620         policy->password_history_length = centry_uint16(centry);
2621         policy->password_properties = centry_uint32(centry);
2622         policy->max_password_age = centry_nttime(centry);
2623         policy->min_password_age = centry_nttime(centry);
2624
2625         status = centry->status;
2626
2627         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2628                 domain->name, nt_errstr(status) ));
2629
2630         centry_free(centry);
2631         return status;
2632
2633 do_query:
2634         ZERO_STRUCTP(policy);
2635
2636         /* Return status value returned by seq number check */
2637
2638         if (!NT_STATUS_IS_OK(domain->last_status))
2639                 return domain->last_status;
2640
2641         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2642                 domain->name ));
2643
2644         status = domain->backend->password_policy(domain, mem_ctx, policy);
2645
2646         /* and save it */
2647         refresh_sequence_number(domain, false);
2648         if (NT_STATUS_IS_OK(status)) {
2649                 wcache_save_password_policy(domain, status, policy);
2650         }
2651
2652         return status;
2653 }
2654
2655
2656 /* Invalidate cached user and group lists coherently */
2657
2658 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2659                        void *state)
2660 {
2661         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2662             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2663                 tdb_delete(the_tdb, kbuf);
2664
2665         return 0;
2666 }
2667
2668 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2669
2670 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2671                                 struct netr_SamInfo3 *info3)
2672 {
2673         DOM_SID sid;
2674         fstring key_str, sid_string;
2675         struct winbind_cache *cache;
2676
2677         /* dont clear cached U/SID and UG/SID entries when we want to logon
2678          * offline - gd */
2679
2680         if (lp_winbind_offline_logon()) {
2681                 return;
2682         }
2683
2684         if (!domain)
2685                 return;
2686
2687         cache = get_cache(domain);
2688
2689         if (!cache->tdb) {
2690                 return;
2691         }
2692
2693         sid_copy(&sid, info3->base.domain_sid);
2694         sid_append_rid(&sid, info3->base.rid);
2695
2696         /* Clear U/SID cache entry */
2697         fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2698         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2699         tdb_delete(cache->tdb, string_tdb_data(key_str));
2700
2701         /* Clear UG/SID cache entry */
2702         fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2703         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2704         tdb_delete(cache->tdb, string_tdb_data(key_str));
2705
2706         /* Samba/winbindd never needs this. */
2707         netsamlogon_clear_cached_user(info3);
2708 }
2709
2710 bool wcache_invalidate_cache(void)
2711 {
2712         struct winbindd_domain *domain;
2713
2714         for (domain = domain_list(); domain; domain = domain->next) {
2715                 struct winbind_cache *cache = get_cache(domain);
2716
2717                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2718                            "entries for %s\n", domain->name));
2719                 if (cache) {
2720                         if (cache->tdb) {
2721                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
2722                         } else {
2723                                 return false;
2724                         }
2725                 }
2726         }
2727         return true;
2728 }
2729
2730 bool init_wcache(void)
2731 {
2732         if (wcache == NULL) {
2733                 wcache = SMB_XMALLOC_P(struct winbind_cache);
2734                 ZERO_STRUCTP(wcache);
2735         }
2736
2737         if (wcache->tdb != NULL)
2738                 return true;
2739
2740         /* when working offline we must not clear the cache on restart */
2741         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2742                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2743                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2744                                 O_RDWR|O_CREAT, 0600);
2745
2746         if (wcache->tdb == NULL) {
2747                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2748                 return false;
2749         }
2750
2751         return true;
2752 }
2753
2754 /************************************************************************
2755  This is called by the parent to initialize the cache file.
2756  We don't need sophisticated locking here as we know we're the
2757  only opener.
2758 ************************************************************************/
2759
2760 bool initialize_winbindd_cache(void)
2761 {
2762         bool cache_bad = true;
2763         uint32 vers;
2764
2765         if (!init_wcache()) {
2766                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2767                 return false;
2768         }
2769
2770         /* Check version number. */
2771         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2772                         vers == WINBINDD_CACHE_VERSION) {
2773                 cache_bad = false;
2774         }
2775
2776         if (cache_bad) {
2777                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2778                         "and re-creating with version number %d\n",
2779                         WINBINDD_CACHE_VERSION ));
2780
2781                 tdb_close(wcache->tdb);
2782                 wcache->tdb = NULL;
2783
2784                 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2785                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2786                                 cache_path("winbindd_cache.tdb"),
2787                                 strerror(errno) ));
2788                         return false;
2789                 }
2790                 if (!init_wcache()) {
2791                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
2792                                         "init_wcache failed.\n"));
2793                         return false;
2794                 }
2795
2796                 /* Write the version. */
2797                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2798                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2799                                 tdb_errorstr(wcache->tdb) ));
2800                         return false;
2801                 }
2802         }
2803
2804         tdb_close(wcache->tdb);
2805         wcache->tdb = NULL;
2806         return true;
2807 }
2808
2809 void close_winbindd_cache(void)
2810 {
2811         if (!wcache) {
2812                 return;
2813         }
2814         if (wcache->tdb) {
2815                 tdb_close(wcache->tdb);
2816                 wcache->tdb = NULL;
2817         }
2818 }
2819
2820 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2821                        char **domain_name, char **name,
2822                        enum lsa_SidType *type)
2823 {
2824         struct winbindd_domain *domain;
2825         NTSTATUS status;
2826
2827         domain = find_lookup_domain_from_sid(sid);
2828         if (domain == NULL) {
2829                 return false;
2830         }
2831         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
2832                                     type);
2833         return NT_STATUS_IS_OK(status);
2834 }
2835
2836 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2837                         const char *domain_name,
2838                         const char *name,
2839                         DOM_SID *sid,
2840                         enum lsa_SidType *type)
2841 {
2842         struct winbindd_domain *domain;
2843         NTSTATUS status;
2844         bool original_online_state;
2845
2846         domain = find_lookup_domain_from_name(domain_name);
2847         if (domain == NULL) {
2848                 return false;
2849         }
2850
2851         /* If we are doing a cached logon, temporarily set the domain
2852            offline so the cache won't expire the entry */
2853
2854         original_online_state = domain->online;
2855         domain->online = false;
2856         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
2857         domain->online = original_online_state;
2858
2859         return NT_STATUS_IS_OK(status);
2860 }
2861
2862 void cache_name2sid(struct winbindd_domain *domain,
2863                     const char *domain_name, const char *name,
2864                     enum lsa_SidType type, const DOM_SID *sid)
2865 {
2866         refresh_sequence_number(domain, false);
2867         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2868                                 sid, type);
2869 }
2870
2871 /*
2872  * The original idea that this cache only contains centries has
2873  * been blurred - now other stuff gets put in here. Ensure we
2874  * ignore these things on cleanup.
2875  */
2876
2877 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2878                                TDB_DATA dbuf, void *state)
2879 {
2880         struct cache_entry *centry;
2881
2882         if (is_non_centry_key(kbuf)) {
2883                 return 0;
2884         }
2885
2886         centry = wcache_fetch_raw((char *)kbuf.dptr);
2887         if (!centry) {
2888                 return 0;
2889         }
2890
2891         if (!NT_STATUS_IS_OK(centry->status)) {
2892                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2893                 tdb_delete(the_tdb, kbuf);
2894         }
2895
2896         centry_free(centry);
2897         return 0;
2898 }
2899
2900 /* flush the cache */
2901 void wcache_flush_cache(void)
2902 {
2903         if (!wcache)
2904                 return;
2905         if (wcache->tdb) {
2906                 tdb_close(wcache->tdb);
2907                 wcache->tdb = NULL;
2908         }
2909         if (!winbindd_use_cache()) {
2910                 return;
2911         }
2912
2913         /* when working offline we must not clear the cache on restart */
2914         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2915                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2916                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2917                                 O_RDWR|O_CREAT, 0600);
2918
2919         if (!wcache->tdb) {
2920                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2921                 return;
2922         }
2923
2924         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2925
2926         DEBUG(10,("wcache_flush_cache success\n"));
2927 }
2928
2929 /* Count cached creds */
2930
2931 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2932                                     void *state)
2933 {
2934         int *cred_count = (int*)state;
2935
2936         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2937                 (*cred_count)++;
2938         }
2939         return 0;
2940 }
2941
2942 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2943 {
2944         struct winbind_cache *cache = get_cache(domain);
2945
2946         *count = 0;
2947
2948         if (!cache->tdb) {
2949                 return NT_STATUS_INTERNAL_DB_ERROR;
2950         }
2951
2952         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2953
2954         return NT_STATUS_OK;
2955 }
2956
2957 struct cred_list {
2958         struct cred_list *prev, *next;
2959         TDB_DATA key;
2960         fstring name;
2961         time_t created;
2962 };
2963 static struct cred_list *wcache_cred_list;
2964
2965 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2966                                     void *state)
2967 {
2968         struct cred_list *cred;
2969
2970         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2971
2972                 cred = SMB_MALLOC_P(struct cred_list);
2973                 if (cred == NULL) {
2974                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2975                         return -1;
2976                 }
2977
2978                 ZERO_STRUCTP(cred);
2979
2980                 /* save a copy of the key */
2981
2982                 fstrcpy(cred->name, (const char *)kbuf.dptr);
2983                 DLIST_ADD(wcache_cred_list, cred);
2984         }
2985
2986         return 0;
2987 }
2988
2989 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2990 {
2991         struct winbind_cache *cache = get_cache(domain);
2992         NTSTATUS status;
2993         int ret;
2994         struct cred_list *cred, *oldest = NULL;
2995
2996         if (!cache->tdb) {
2997                 return NT_STATUS_INTERNAL_DB_ERROR;
2998         }
2999
3000         /* we possibly already have an entry */
3001         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3002
3003                 fstring key_str, tmp;
3004
3005                 DEBUG(11,("we already have an entry, deleting that\n"));
3006
3007                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3008
3009                 tdb_delete(cache->tdb, string_tdb_data(key_str));
3010
3011                 return NT_STATUS_OK;
3012         }
3013
3014         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3015         if (ret == 0) {
3016                 return NT_STATUS_OK;
3017         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3018                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3019         }
3020
3021         ZERO_STRUCTP(oldest);
3022
3023         for (cred = wcache_cred_list; cred; cred = cred->next) {
3024
3025                 TDB_DATA data;
3026                 time_t t;
3027
3028                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3029                 if (!data.dptr) {
3030                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3031                                 cred->name));
3032                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3033                         goto done;
3034                 }
3035
3036                 t = IVAL(data.dptr, 0);
3037                 SAFE_FREE(data.dptr);
3038
3039                 if (!oldest) {
3040                         oldest = SMB_MALLOC_P(struct cred_list);
3041                         if (oldest == NULL) {
3042                                 status = NT_STATUS_NO_MEMORY;
3043                                 goto done;
3044                         }
3045
3046                         fstrcpy(oldest->name, cred->name);
3047                         oldest->created = t;
3048                         continue;
3049                 }
3050
3051                 if (t < oldest->created) {
3052                         fstrcpy(oldest->name, cred->name);
3053                         oldest->created = t;
3054                 }
3055         }
3056
3057         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3058                 status = NT_STATUS_OK;
3059         } else {
3060                 status = NT_STATUS_UNSUCCESSFUL;
3061         }
3062 done:
3063         SAFE_FREE(wcache_cred_list);
3064         SAFE_FREE(oldest);
3065
3066         return status;
3067 }
3068
3069 /* Change the global online/offline state. */
3070 bool set_global_winbindd_state_offline(void)
3071 {
3072         TDB_DATA data;
3073
3074         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3075
3076         /* Only go offline if someone has created
3077            the key "WINBINDD_OFFLINE" in the cache tdb. */
3078
3079         if (wcache == NULL || wcache->tdb == NULL) {
3080                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3081                 return false;
3082         }
3083
3084         if (!lp_winbind_offline_logon()) {
3085                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3086                 return false;
3087         }
3088
3089         if (global_winbindd_offline_state) {
3090                 /* Already offline. */
3091                 return true;
3092         }
3093
3094         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3095
3096         if (!data.dptr || data.dsize != 4) {
3097                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3098                 SAFE_FREE(data.dptr);
3099                 return false;
3100         } else {
3101                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3102                 global_winbindd_offline_state = true;
3103                 SAFE_FREE(data.dptr);
3104                 return true;
3105         }
3106 }
3107
3108 void set_global_winbindd_state_online(void)
3109 {
3110         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3111
3112         if (!lp_winbind_offline_logon()) {
3113                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3114                 return;
3115         }
3116
3117         if (!global_winbindd_offline_state) {
3118                 /* Already online. */
3119                 return;
3120         }
3121         global_winbindd_offline_state = false;
3122
3123         if (!wcache->tdb) {
3124                 return;
3125         }
3126
3127         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3128         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3129 }
3130
3131 bool get_global_winbindd_state_offline(void)
3132 {
3133         return global_winbindd_offline_state;
3134 }
3135
3136 /***********************************************************************
3137  Validate functions for all possible cache tdb keys.
3138 ***********************************************************************/
3139
3140 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3141                                                   struct tdb_validation_status *state)
3142 {
3143         struct cache_entry *centry;
3144
3145         centry = SMB_XMALLOC_P(struct cache_entry);
3146         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3147         if (!centry->data) {
3148                 SAFE_FREE(centry);
3149                 return NULL;
3150         }
3151         centry->len = data.dsize;
3152         centry->ofs = 0;
3153
3154         if (centry->len < 8) {
3155                 /* huh? corrupt cache? */
3156                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3157                 centry_free(centry);
3158                 state->bad_entry = true;
3159                 state->success = false;
3160                 return NULL;
3161         }
3162
3163         centry->status = NT_STATUS(centry_uint32(centry));
3164         centry->sequence_number = centry_uint32(centry);
3165         return centry;
3166 }
3167
3168 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3169                            struct tdb_validation_status *state)
3170 {
3171         if (dbuf.dsize != 8) {
3172                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3173                                 keystr, (unsigned int)dbuf.dsize ));
3174                 state->bad_entry = true;
3175                 return 1;
3176         }
3177         return 0;
3178 }
3179
3180 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3181                        struct tdb_validation_status *state)
3182 {
3183         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3184         if (!centry) {
3185                 return 1;
3186         }
3187
3188         (void)centry_uint32(centry);
3189         if (NT_STATUS_IS_OK(centry->status)) {
3190                 DOM_SID sid;
3191                 (void)centry_sid(centry, &sid);
3192         }
3193
3194         centry_free(centry);
3195
3196         if (!(state->success)) {
3197                 return 1;
3198         }
3199         DEBUG(10,("validate_ns: %s ok\n", keystr));
3200         return 0;
3201 }
3202
3203 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3204                        struct tdb_validation_status *state)
3205 {
3206         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3207         if (!centry) {
3208                 return 1;
3209         }
3210
3211         if (NT_STATUS_IS_OK(centry->status)) {
3212                 (void)centry_uint32(centry);
3213                 (void)centry_string(centry, mem_ctx);
3214                 (void)centry_string(centry, mem_ctx);
3215         }
3216
3217         centry_free(centry);
3218
3219         if (!(state->success)) {
3220                 return 1;
3221         }
3222         DEBUG(10,("validate_sn: %s ok\n", keystr));
3223         return 0;
3224 }
3225
3226 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3227                       struct tdb_validation_status *state)
3228 {
3229         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3230         DOM_SID sid;
3231
3232         if (!centry) {
3233                 return 1;
3234         }
3235
3236         (void)centry_string(centry, mem_ctx);
3237         (void)centry_string(centry, mem_ctx);
3238         (void)centry_string(centry, mem_ctx);
3239         (void)centry_string(centry, mem_ctx);
3240         (void)centry_uint32(centry);
3241         (void)centry_sid(centry, &sid);
3242         (void)centry_sid(centry, &sid);
3243
3244         centry_free(centry);
3245
3246         if (!(state->success)) {
3247                 return 1;
3248         }
3249         DEBUG(10,("validate_u: %s ok\n", keystr));
3250         return 0;
3251 }
3252
3253 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3254                             struct tdb_validation_status *state)
3255 {
3256         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3257
3258         if (!centry) {
3259                 return 1;
3260         }
3261
3262         (void)centry_nttime(centry);
3263         (void)centry_nttime(centry);
3264         (void)centry_uint16(centry);
3265
3266         centry_free(centry);
3267
3268         if (!(state->success)) {
3269                 return 1;
3270         }
3271         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3272         return 0;
3273 }
3274
3275 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3276                             struct tdb_validation_status *state)
3277 {
3278         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3279
3280         if (!centry) {
3281                 return 1;
3282         }
3283
3284         (void)centry_uint16(centry);
3285         (void)centry_uint16(centry);
3286         (void)centry_uint32(centry);
3287         (void)centry_nttime(centry);
3288         (void)centry_nttime(centry);
3289
3290         centry_free(centry);
3291
3292         if (!(state->success)) {
3293                 return 1;
3294         }
3295         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3296         return 0;
3297 }
3298
3299 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3300                          struct tdb_validation_status *state)
3301 {
3302         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3303
3304         if (!centry) {
3305                 return 1;
3306         }
3307
3308         (void)centry_time(centry);
3309         (void)centry_hash16(centry, mem_ctx);
3310
3311         /* We only have 17 bytes more data in the salted cred case. */
3312         if (centry->len - centry->ofs == 17) {
3313                 (void)centry_hash16(centry, mem_ctx);
3314         }
3315
3316         centry_free(centry);
3317
3318         if (!(state->success)) {
3319                 return 1;
3320         }
3321         DEBUG(10,("validate_cred: %s ok\n", keystr));
3322         return 0;
3323 }
3324
3325 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3326                        struct tdb_validation_status *state)
3327 {
3328         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3329         int32 num_entries, i;
3330
3331         if (!centry) {
3332                 return 1;
3333         }
3334
3335         num_entries = (int32)centry_uint32(centry);
3336
3337         for (i=0; i< num_entries; i++) {
3338                 DOM_SID sid;
3339                 (void)centry_string(centry, mem_ctx);
3340                 (void)centry_string(centry, mem_ctx);
3341                 (void)centry_string(centry, mem_ctx);
3342                 (void)centry_string(centry, mem_ctx);
3343                 (void)centry_sid(centry, &sid);
3344                 (void)centry_sid(centry, &sid);
3345         }
3346
3347         centry_free(centry);
3348
3349         if (!(state->success)) {
3350                 return 1;
3351         }
3352         DEBUG(10,("validate_ul: %s ok\n", keystr));
3353         return 0;
3354 }
3355
3356 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3357                        struct tdb_validation_status *state)
3358 {
3359         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3360         int32 num_entries, i;
3361
3362         if (!centry) {
3363                 return 1;
3364         }
3365
3366         num_entries = centry_uint32(centry);
3367
3368         for (i=0; i< num_entries; i++) {
3369                 (void)centry_string(centry, mem_ctx);
3370                 (void)centry_string(centry, mem_ctx);
3371                 (void)centry_uint32(centry);
3372         }
3373
3374         centry_free(centry);
3375
3376         if (!(state->success)) {
3377                 return 1;
3378         }
3379         DEBUG(10,("validate_gl: %s ok\n", keystr));
3380         return 0;
3381 }
3382
3383 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3384                        struct tdb_validation_status *state)
3385 {
3386         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3387         int32 num_groups, i;
3388
3389         if (!centry) {
3390                 return 1;
3391         }
3392
3393         num_groups = centry_uint32(centry);
3394
3395         for (i=0; i< num_groups; i++) {
3396                 DOM_SID sid;
3397                 centry_sid(centry, &sid);
3398         }
3399
3400         centry_free(centry);
3401
3402         if (!(state->success)) {
3403                 return 1;
3404         }
3405         DEBUG(10,("validate_ug: %s ok\n", keystr));
3406         return 0;
3407 }
3408
3409 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3410                        struct tdb_validation_status *state)
3411 {
3412         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3413         int32 num_aliases, i;
3414
3415         if (!centry) {
3416                 return 1;
3417         }
3418
3419         num_aliases = centry_uint32(centry);
3420
3421         for (i=0; i < num_aliases; i++) {
3422                 (void)centry_uint32(centry);
3423         }
3424
3425         centry_free(centry);
3426
3427         if (!(state->success)) {
3428                 return 1;
3429         }
3430         DEBUG(10,("validate_ua: %s ok\n", keystr));
3431         return 0;
3432 }
3433
3434 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3435                        struct tdb_validation_status *state)
3436 {
3437         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3438         int32 num_names, i;
3439
3440         if (!centry) {
3441                 return 1;
3442         }
3443
3444         num_names = centry_uint32(centry);
3445
3446         for (i=0; i< num_names; i++) {
3447                 DOM_SID sid;
3448                 centry_sid(centry, &sid);
3449                 (void)centry_string(centry, mem_ctx);
3450                 (void)centry_uint32(centry);
3451         }
3452
3453         centry_free(centry);
3454
3455         if (!(state->success)) {
3456                 return 1;
3457         }
3458         DEBUG(10,("validate_gm: %s ok\n", keystr));
3459         return 0;
3460 }
3461
3462 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3463                        struct tdb_validation_status *state)
3464 {
3465         /* Can't say anything about this other than must be nonzero. */
3466         if (dbuf.dsize == 0) {
3467                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3468                                 keystr));
3469                 state->bad_entry = true;
3470                 state->success = false;
3471                 return 1;
3472         }
3473
3474         DEBUG(10,("validate_dr: %s ok\n", keystr));
3475         return 0;
3476 }
3477
3478 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3479                        struct tdb_validation_status *state)
3480 {
3481         /* Can't say anything about this other than must be nonzero. */
3482         if (dbuf.dsize == 0) {
3483                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3484                                 keystr));
3485                 state->bad_entry = true;
3486                 state->success = false;
3487                 return 1;
3488         }
3489
3490         DEBUG(10,("validate_de: %s ok\n", keystr));
3491         return 0;
3492 }
3493
3494 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3495                            TDB_DATA dbuf, struct tdb_validation_status *state)
3496 {
3497         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3498
3499         if (!centry) {
3500                 return 1;
3501         }
3502
3503         (void)centry_string(centry, mem_ctx);
3504         (void)centry_string(centry, mem_ctx);
3505         (void)centry_string(centry, mem_ctx);
3506         (void)centry_uint32(centry);
3507
3508         centry_free(centry);
3509
3510         if (!(state->success)) {
3511                 return 1;
3512         }
3513         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3514         return 0;
3515 }
3516
3517 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3518                            TDB_DATA dbuf,
3519                            struct tdb_validation_status *state)
3520 {
3521         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3522
3523         if (!centry) {
3524                 return 1;
3525         }
3526
3527         (void)centry_string( centry, mem_ctx );
3528
3529         centry_free(centry);
3530
3531         if (!(state->success)) {
3532                 return 1;
3533         }
3534         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3535         return 0;
3536 }
3537
3538 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3539                            TDB_DATA dbuf,
3540                            struct tdb_validation_status *state)
3541 {
3542         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3543
3544         if (!centry) {
3545                 return 1;
3546         }
3547
3548         (void)centry_string( centry, mem_ctx );
3549
3550         centry_free(centry);
3551
3552         if (!(state->success)) {
3553                 return 1;
3554         }
3555         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3556         return 0;
3557 }
3558
3559 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3560                               struct tdb_validation_status *state)
3561 {
3562         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3563         int32 num_domains, i;
3564
3565         if (!centry) {
3566                 return 1;
3567         }
3568
3569         num_domains = centry_uint32(centry);
3570
3571         for (i=0; i< num_domains; i++) {
3572                 DOM_SID sid;
3573                 (void)centry_string(centry, mem_ctx);
3574                 (void)centry_string(centry, mem_ctx);
3575                 (void)centry_sid(centry, &sid);
3576         }
3577
3578         centry_free(centry);
3579
3580         if (!(state->success)) {
3581                 return 1;
3582         }
3583         DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3584         return 0;
3585 }
3586
3587 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3588                                   TDB_DATA dbuf,
3589                                   struct tdb_validation_status *state)
3590 {
3591         if (dbuf.dsize == 0) {
3592                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3593                           "key %s (len ==0) ?\n", keystr));
3594                 state->bad_entry = true;
3595                 state->success = false;
3596                 return 1;
3597         }
3598
3599         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3600         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3601         return 0;
3602 }
3603
3604 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3605                             struct tdb_validation_status *state)
3606 {
3607         if (dbuf.dsize != 4) {
3608                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3609                                 keystr, (unsigned int)dbuf.dsize ));
3610                 state->bad_entry = true;
3611                 state->success = false;
3612                 return 1;
3613         }
3614         DEBUG(10,("validate_offline: %s ok\n", keystr));
3615         return 0;
3616 }
3617
3618 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3619                         struct tdb_validation_status *state)
3620 {
3621         /*
3622          * Ignore validation for now. The proper way to do this is with a
3623          * checksum. Just pure parsing does not really catch much.
3624          */
3625         return 0;
3626 }
3627
3628 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3629                                   struct tdb_validation_status *state)
3630 {
3631         if (dbuf.dsize != 4) {
3632                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3633                           "key %s (len %u != 4) ?\n",
3634                           keystr, (unsigned int)dbuf.dsize));
3635                 state->bad_entry = true;
3636                 state->success = false;
3637                 return 1;
3638         }
3639
3640         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3641         return 0;
3642 }
3643
3644 /***********************************************************************
3645  A list of all possible cache tdb keys with associated validation
3646  functions.
3647 ***********************************************************************/
3648
3649 struct key_val_struct {
3650         const char *keyname;
3651         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3652 } key_val[] = {
3653         {"SEQNUM/", validate_seqnum},
3654         {"NS/", validate_ns},
3655         {"SN/", validate_sn},
3656         {"U/", validate_u},
3657         {"LOC_POL/", validate_loc_pol},
3658         {"PWD_POL/", validate_pwd_pol},
3659         {"CRED/", validate_cred},
3660         {"UL/", validate_ul},
3661         {"GL/", validate_gl},
3662         {"UG/", validate_ug},
3663         {"UA", validate_ua},
3664         {"GM/", validate_gm},
3665         {"DR/", validate_dr},
3666         {"DE/", validate_de},
3667         {"NSS/PWINFO/", validate_pwinfo},
3668         {"TRUSTDOMS/", validate_trustdoms},
3669         {"TRUSTDOMCACHE/", validate_trustdomcache},
3670         {"NSS/NA/", validate_nss_na},
3671         {"NSS/AN/", validate_nss_an},
3672         {"WINBINDD_OFFLINE", validate_offline},
3673         {"NDR/", validate_ndr},
3674         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3675         {NULL, NULL}
3676 };
3677
3678 /***********************************************************************
3679  Function to look at every entry in the tdb and validate it as far as
3680  possible.
3681 ***********************************************************************/
3682
3683 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3684 {
3685         int i;
3686         unsigned int max_key_len = 1024;
3687         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3688
3689         /* Paranoia check. */
3690         if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3691                 max_key_len = 1024 * 1024;
3692         }
3693         if (kbuf.dsize > max_key_len) {
3694                 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3695                           "(%u) > (%u)\n\n",
3696                           (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3697                 return 1;
3698         }
3699
3700         for (i = 0; key_val[i].keyname; i++) {
3701                 size_t namelen = strlen(key_val[i].keyname);
3702                 if (kbuf.dsize >= namelen && (
3703                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3704                         TALLOC_CTX *mem_ctx;
3705                         char *keystr;
3706                         int ret;
3707
3708                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3709                         if (!keystr) {
3710                                 return 1;
3711                         }
3712                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
3713                         keystr[kbuf.dsize] = '\0';
3714
3715                         mem_ctx = talloc_init("validate_ctx");
3716                         if (!mem_ctx) {
3717                                 SAFE_FREE(keystr);
3718                                 return 1;
3719                         }
3720
3721                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3722                                                           v_state);
3723
3724                         SAFE_FREE(keystr);
3725                         talloc_destroy(mem_ctx);
3726                         return ret;
3727                 }
3728         }
3729
3730         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3731         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3732         DEBUG(0,("data :\n"));
3733         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3734         v_state->unknown_key = true;
3735         v_state->success = false;
3736         return 1; /* terminate. */
3737 }
3738
3739 static void validate_panic(const char *const why)
3740 {
3741         DEBUG(0,("validating cache: would panic %s\n", why ));
3742         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3743         exit(47);
3744 }
3745
3746 /***********************************************************************
3747  Try and validate every entry in the winbindd cache. If we fail here,
3748  delete the cache tdb and return non-zero.
3749 ***********************************************************************/
3750
3751 int winbindd_validate_cache(void)
3752 {
3753         int ret = -1;
3754         const char *tdb_path = cache_path("winbindd_cache.tdb");
3755         TDB_CONTEXT *tdb = NULL;
3756
3757         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3758         smb_panic_fn = validate_panic;
3759
3760
3761         tdb = tdb_open_log(tdb_path,
3762                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3763                            ( lp_winbind_offline_logon()
3764                              ? TDB_DEFAULT
3765                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3766                            O_RDWR|O_CREAT,
3767                            0600);
3768         if (!tdb) {
3769                 DEBUG(0, ("winbindd_validate_cache: "
3770                           "error opening/initializing tdb\n"));
3771                 goto done;
3772         }
3773         tdb_close(tdb);
3774
3775         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3776
3777         if (ret != 0) {
3778                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3779                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3780                 unlink(tdb_path);
3781         }
3782
3783 done:
3784         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3785         smb_panic_fn = smb_panic;
3786         return ret;
3787 }
3788
3789 /***********************************************************************
3790  Try and validate every entry in the winbindd cache.
3791 ***********************************************************************/
3792
3793 int winbindd_validate_cache_nobackup(void)
3794 {
3795         int ret = -1;
3796         const char *tdb_path = cache_path("winbindd_cache.tdb");
3797
3798         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3799         smb_panic_fn = validate_panic;
3800
3801
3802         if (wcache == NULL || wcache->tdb == NULL) {
3803                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3804         } else {
3805                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3806         }
3807
3808         if (ret != 0) {
3809                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3810                            "successful.\n"));
3811         }
3812
3813         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3814                    "function\n"));
3815         smb_panic_fn = smb_panic;
3816         return ret;
3817 }
3818
3819 bool winbindd_cache_validate_and_initialize(void)
3820 {
3821         close_winbindd_cache();
3822
3823         if (lp_winbind_offline_logon()) {
3824                 if (winbindd_validate_cache() < 0) {
3825                         DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3826                                   "could be restored.\n"));
3827                 }
3828         }
3829
3830         return initialize_winbindd_cache();
3831 }
3832
3833 /*********************************************************************
3834  ********************************************************************/
3835
3836 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3837                                        struct winbindd_tdc_domain **domains,
3838                                        size_t *num_domains )
3839 {
3840         struct winbindd_tdc_domain *list = NULL;
3841         size_t idx;
3842         int i;
3843         bool set_only = false;
3844
3845         /* don't allow duplicates */
3846
3847         idx = *num_domains;
3848         list = *domains;
3849
3850         for ( i=0; i< (*num_domains); i++ ) {
3851                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3852                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3853                                   new_dom->name));
3854                         idx = i;
3855                         set_only = true;
3856
3857                         break;
3858                 }
3859         }
3860
3861         if ( !set_only ) {
3862                 if ( !*domains ) {
3863                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3864                         idx = 0;
3865                 } else {
3866                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3867                                                      struct winbindd_tdc_domain,
3868                                                      (*num_domains)+1);
3869                         idx = *num_domains;
3870                 }
3871
3872                 ZERO_STRUCT( list[idx] );
3873         }
3874
3875         if ( !list )
3876                 return false;
3877
3878         list[idx].domain_name = talloc_strdup( list, new_dom->name );
3879         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3880
3881         if ( !is_null_sid( &new_dom->sid ) ) {
3882                 sid_copy( &list[idx].sid, &new_dom->sid );
3883         } else {
3884                 sid_copy(&list[idx].sid, &global_sid_NULL);
3885         }
3886
3887         if ( new_dom->domain_flags != 0x0 )
3888                 list[idx].trust_flags = new_dom->domain_flags;
3889
3890         if ( new_dom->domain_type != 0x0 )
3891                 list[idx].trust_type = new_dom->domain_type;
3892
3893         if ( new_dom->domain_trust_attribs != 0x0 )
3894                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3895
3896         if ( !set_only ) {
3897                 *domains = list;
3898                 *num_domains = idx + 1;
3899         }
3900
3901         return true;
3902 }
3903
3904 /*********************************************************************
3905  ********************************************************************/
3906
3907 static TDB_DATA make_tdc_key( const char *domain_name )
3908 {
3909         char *keystr = NULL;
3910         TDB_DATA key = { NULL, 0 };
3911
3912         if ( !domain_name ) {
3913                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3914                 return key;
3915         }
3916
3917         if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3918                 return key;
3919         }
3920         key = string_term_tdb_data(keystr);
3921
3922         return key;
3923 }
3924
3925 /*********************************************************************
3926  ********************************************************************/
3927
3928 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3929                              size_t num_domains,
3930                              unsigned char **buf )
3931 {
3932         unsigned char *buffer = NULL;
3933         int len = 0;
3934         int buflen = 0;
3935         int i = 0;
3936
3937         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3938                   (int)num_domains));
3939
3940         buflen = 0;
3941
3942  again:
3943         len = 0;
3944
3945         /* Store the number of array items first */
3946         len += tdb_pack( buffer+len, buflen-len, "d",
3947                          num_domains );
3948
3949         /* now pack each domain trust record */
3950         for ( i=0; i<num_domains; i++ ) {
3951
3952                 fstring tmp;
3953
3954                 if ( buflen > 0 ) {
3955                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3956                                   domains[i].domain_name,
3957                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3958                 }
3959
3960                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3961                                  domains[i].domain_name,
3962                                  domains[i].dns_name,
3963                                  sid_to_fstring(tmp, &domains[i].sid),
3964                                  domains[i].trust_flags,
3965                                  domains[i].trust_attribs,
3966                                  domains[i].trust_type );
3967         }
3968
3969         if ( buflen < len ) {
3970                 SAFE_FREE(buffer);
3971                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3972                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3973                         buflen = -1;
3974                         goto done;
3975                 }
3976                 buflen = len;
3977                 goto again;
3978         }
3979
3980         *buf = buffer;
3981
3982  done:
3983         return buflen;
3984 }
3985
3986 /*********************************************************************
3987  ********************************************************************/
3988
3989 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3990                                   struct winbindd_tdc_domain **domains )
3991 {
3992         fstring domain_name, dns_name, sid_string;
3993         uint32 type, attribs, flags;
3994         int num_domains;
3995         int len = 0;
3996         int i;
3997         struct winbindd_tdc_domain *list = NULL;
3998
3999         /* get the number of domains */
4000         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4001         if ( len == -1 ) {
4002                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4003                 return 0;
4004         }
4005
4006         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4007         if ( !list ) {
4008                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4009                 return 0;
4010         }
4011
4012         for ( i=0; i<num_domains; i++ ) {
4013                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4014                                    domain_name,
4015                                    dns_name,
4016                                    sid_string,
4017                                    &flags,
4018                                    &attribs,
4019                                    &type );
4020
4021                 if ( len == -1 ) {
4022                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4023                         TALLOC_FREE( list );
4024                         return 0;
4025                 }
4026
4027                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4028                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4029                           domain_name, dns_name, sid_string,
4030                           flags, attribs, type));
4031
4032                 list[i].domain_name = talloc_strdup( list, domain_name );
4033                 list[i].dns_name = talloc_strdup( list, dns_name );
4034                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4035                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4036                                   domain_name));
4037                 }
4038                 list[i].trust_flags = flags;
4039                 list[i].trust_attribs = attribs;
4040                 list[i].trust_type = type;
4041         }
4042
4043         *domains = list;
4044
4045         return num_domains;
4046 }
4047
4048 /*********************************************************************
4049  ********************************************************************/
4050
4051 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4052 {
4053         TDB_DATA key = make_tdc_key( lp_workgroup() );
4054         TDB_DATA data = { NULL, 0 };
4055         int ret;
4056
4057         if ( !key.dptr )
4058                 return false;
4059
4060         /* See if we were asked to delete the cache entry */
4061
4062         if ( !domains ) {
4063                 ret = tdb_delete( wcache->tdb, key );
4064                 goto done;
4065         }
4066
4067         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4068
4069         if ( !data.dptr ) {
4070                 ret = -1;
4071                 goto done;
4072         }
4073
4074         ret = tdb_store( wcache->tdb, key, data, 0 );
4075
4076  done:
4077         SAFE_FREE( data.dptr );
4078         SAFE_FREE( key.dptr );
4079
4080         return ( ret != -1 );
4081 }
4082
4083 /*********************************************************************
4084  ********************************************************************/
4085
4086 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4087 {
4088         TDB_DATA key = make_tdc_key( lp_workgroup() );
4089         TDB_DATA data = { NULL, 0 };
4090
4091         *domains = NULL;
4092         *num_domains = 0;
4093
4094         if ( !key.dptr )
4095                 return false;
4096
4097         data = tdb_fetch( wcache->tdb, key );
4098
4099         SAFE_FREE( key.dptr );
4100
4101         if ( !data.dptr )
4102                 return false;
4103
4104         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4105
4106         SAFE_FREE( data.dptr );
4107
4108         if ( !*domains )
4109                 return false;
4110
4111         return true;
4112 }
4113
4114 /*********************************************************************
4115  ********************************************************************/
4116
4117 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4118 {
4119         struct winbindd_tdc_domain *dom_list = NULL;
4120         size_t num_domains = 0;
4121         bool ret = false;
4122
4123         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4124                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4125                   domain->name, domain->alt_name,
4126                   sid_string_dbg(&domain->sid),
4127                   domain->domain_flags,
4128                   domain->domain_trust_attribs,
4129                   domain->domain_type));
4130
4131         if ( !init_wcache() ) {
4132                 return false;
4133         }
4134
4135         /* fetch the list */
4136
4137         wcache_tdc_fetch_list( &dom_list, &num_domains );
4138
4139         /* add the new domain */
4140
4141         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4142                 goto done;
4143         }
4144
4145         /* pack the domain */
4146
4147         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4148                 goto done;
4149         }
4150
4151         /* Success */
4152
4153         ret = true;
4154  done:
4155         TALLOC_FREE( dom_list );
4156
4157         return ret;
4158 }
4159
4160 /*********************************************************************
4161  ********************************************************************/
4162
4163 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4164 {
4165         struct winbindd_tdc_domain *dom_list = NULL;
4166         size_t num_domains = 0;
4167         int i;
4168         struct winbindd_tdc_domain *d = NULL;
4169
4170         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4171
4172         if ( !init_wcache() ) {
4173                 return false;
4174         }
4175
4176         /* fetch the list */
4177
4178         wcache_tdc_fetch_list( &dom_list, &num_domains );
4179
4180         for ( i=0; i<num_domains; i++ ) {
4181                 if ( strequal(name, dom_list[i].domain_name) ||
4182                      strequal(name, dom_list[i].dns_name) )
4183                 {
4184                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4185                                   name));
4186
4187                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4188                         if ( !d )
4189                                 break;
4190
4191                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4192                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4193                         sid_copy( &d->sid, &dom_list[i].sid );
4194                         d->trust_flags   = dom_list[i].trust_flags;
4195                         d->trust_type    = dom_list[i].trust_type;
4196                         d->trust_attribs = dom_list[i].trust_attribs;
4197
4198                         break;
4199                 }
4200         }
4201
4202         TALLOC_FREE( dom_list );
4203
4204         return d;
4205 }
4206
4207
4208 /*********************************************************************
4209  ********************************************************************/
4210
4211 void wcache_tdc_clear( void )
4212 {
4213         if ( !init_wcache() )
4214                 return;
4215
4216         wcache_tdc_store_list( NULL, 0 );
4217
4218         return;
4219 }
4220
4221
4222 /*********************************************************************
4223  ********************************************************************/
4224
4225 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4226                                     NTSTATUS status,
4227                                     const DOM_SID *user_sid,
4228                                     const char *homedir,
4229                                     const char *shell,
4230                                     const char *gecos,
4231                                     uint32 gid)
4232 {
4233         struct cache_entry *centry;
4234         fstring tmp;
4235
4236         if ( (centry = centry_start(domain, status)) == NULL )
4237                 return;
4238
4239         centry_put_string( centry, homedir );
4240         centry_put_string( centry, shell );
4241         centry_put_string( centry, gecos );
4242         centry_put_uint32( centry, gid );
4243
4244         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4245
4246         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4247
4248         centry_free(centry);
4249 }
4250
4251 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4252                               const DOM_SID *user_sid,
4253                               TALLOC_CTX *ctx,
4254                               ADS_STRUCT *ads, LDAPMessage *msg,
4255                               const char **homedir, const char **shell,
4256                               const char **gecos, gid_t *p_gid)
4257 {
4258         struct winbind_cache *cache = get_cache(domain);
4259         struct cache_entry *centry = NULL;
4260         NTSTATUS nt_status;
4261         fstring tmp;
4262
4263         if (!cache->tdb)
4264                 goto do_query;
4265
4266         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4267                               sid_to_fstring(tmp, user_sid));
4268
4269         if (!centry)
4270                 goto do_query;
4271
4272         *homedir = centry_string( centry, ctx );
4273         *shell   = centry_string( centry, ctx );
4274         *gecos   = centry_string( centry, ctx );
4275         *p_gid   = centry_uint32( centry );
4276
4277         centry_free(centry);
4278
4279         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4280                   sid_string_dbg(user_sid)));
4281
4282         return NT_STATUS_OK;
4283
4284 do_query:
4285
4286         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4287                                   homedir, shell, gecos, p_gid );
4288
4289         DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4290
4291         if ( NT_STATUS_IS_OK(nt_status) ) {
4292                 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4293                 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4294                 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4295                 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4296
4297                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4298                                          *homedir, *shell, *gecos, *p_gid );
4299         }
4300
4301         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4302                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4303                          domain->name ));
4304                 set_domain_offline( domain );
4305         }
4306
4307         return nt_status;
4308 }
4309
4310
4311 /* the cache backend methods are exposed via this structure */
4312 struct winbindd_methods cache_methods = {
4313         true,
4314         query_user_list,
4315         enum_dom_groups,
4316         enum_local_groups,
4317         name_to_sid,
4318         sid_to_name,
4319         rids_to_names,
4320         query_user,
4321         lookup_usergroups,
4322         lookup_useraliases,
4323         lookup_groupmem,
4324         sequence_number,
4325         lockout_policy,
4326         password_policy,
4327         trusted_domains
4328 };
4329
4330 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4331                            uint32_t opnum, const DATA_BLOB *req,
4332                            TDB_DATA *pkey)
4333 {
4334         char *key;
4335         size_t keylen;
4336
4337         key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4338         if (key == NULL) {
4339                 return false;
4340         }
4341         keylen = talloc_get_size(key) - 1;
4342
4343         key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4344         if (key == NULL) {
4345                 return false;
4346         }
4347         memcpy(key + keylen, req->data, req->length);
4348
4349         pkey->dptr = (uint8_t *)key;
4350         pkey->dsize = talloc_get_size(key);
4351         return true;
4352 }
4353
4354 static bool wcache_opnum_cacheable(uint32_t opnum)
4355 {
4356         switch (opnum) {
4357         case NDR_WBINT_PING:
4358         case NDR_WBINT_QUERYSEQUENCENUMBER:
4359         case NDR_WBINT_ALLOCATEUID:
4360                 return false;
4361         }
4362         return true;
4363 }
4364
4365 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4366                       uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4367 {
4368         TDB_DATA key, data;
4369         bool ret = false;
4370
4371         if (!wcache_opnum_cacheable(opnum)) {
4372                 return false;
4373         }
4374
4375         if (wcache->tdb == NULL) {
4376                 return false;
4377         }
4378
4379         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4380                 return false;
4381         }
4382         data = tdb_fetch(wcache->tdb, key);
4383         TALLOC_FREE(key.dptr);
4384
4385         if (data.dptr == NULL) {
4386                 return false;
4387         }
4388         if (data.dsize < 4) {
4389                 goto fail;
4390         }
4391
4392         if (IS_DOMAIN_ONLINE(domain)) {
4393                 uint32_t entry_seqnum, dom_seqnum, last_check;
4394
4395                 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4396                                          &last_check)) {
4397                         goto fail;
4398                 }
4399                 entry_seqnum = IVAL(data.dptr, 0);
4400                 if (entry_seqnum != dom_seqnum) {
4401                         DEBUG(10, ("Entry has wrong sequence number: %d\n",
4402                                    (int)entry_seqnum));
4403                         goto fail;
4404                 }
4405         }
4406
4407         resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4408                                               data.dsize - 4);
4409         if (resp->data == NULL) {
4410                 DEBUG(10, ("talloc failed\n"));
4411                 goto fail;
4412         }
4413         resp->length = data.dsize - 4;
4414
4415         ret = true;
4416 fail:
4417         SAFE_FREE(data.dptr);
4418         return ret;
4419 }
4420
4421 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4422                       const DATA_BLOB *req, const DATA_BLOB *resp)
4423 {
4424         TDB_DATA key, data;
4425         uint32_t dom_seqnum, last_check;
4426
4427         if (!wcache_opnum_cacheable(opnum)) {
4428                 return;
4429         }
4430
4431         if (wcache->tdb == NULL) {
4432                 return;
4433         }
4434
4435         if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4436                 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4437                            domain->name));
4438                 return;
4439         }
4440
4441         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4442                 return;
4443         }
4444
4445         data.dsize = resp->length + 4;
4446         data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4447         if (data.dptr == NULL) {
4448                 goto done;
4449         }
4450
4451         SIVAL(data.dptr, 0, dom_seqnum);
4452         memcpy(data.dptr+4, resp->data, resp->length);
4453
4454         tdb_store(wcache->tdb, key, data, 0);
4455
4456 done:
4457         TALLOC_FREE(key.dptr);
4458         return;
4459 }