source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "tdb_validate.h"
  29 #include "../libcli/auth/libcli_auth.h"
  30 #include "../librpc/gen_ndr/ndr_wbint.h"
  31
  32 #undef DBGC_CLASS
  33 #define DBGC_CLASS DBGC_WINBIND
  34
  35 #define WINBINDD_CACHE_VERSION 1
  36 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  37
  38 extern struct winbindd_methods reconnect_methods;
  39 #ifdef HAVE_ADS
  40 extern struct winbindd_methods ads_methods;
  41 #endif
  42 extern struct winbindd_methods builtin_passdb_methods;
  43
  44 /*
  45  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  46  * Here are the list of entry types that are *not* stored
  47  * as form struct cache_entry in the cache.
  48  */
  49
  50 static const char *non_centry_keys[] = {
  51         "SEQNUM/",
  52         "DR/",
  53         "DE/",
  54         "WINBINDD_OFFLINE",
  55         WINBINDD_CACHE_VERSION_KEYSTR,
  56         NULL
  57 };
  58
  59 /************************************************************************
  60  Is this key a non-centry type ?
  61 ************************************************************************/
  62
  63 static bool is_non_centry_key(TDB_DATA kbuf)
  64 {
  65         int i;
  66
  67         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  68                 return false;
  69         }
  70         for (i = 0; non_centry_keys[i] != NULL; i++) {
  71                 size_t namelen = strlen(non_centry_keys[i]);
  72                 if (kbuf.dsize < namelen) {
  73                         continue;
  74                 }
  75                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  76                         return true;
  77                 }
  78         }
  79         return false;
  80 }
  81
  82 /* Global online/offline state - False when online. winbindd starts up online
  83    and sets this to true if the first query fails and there's an entry in
  84    the cache tdb telling us to stay offline. */
  85
  86 static bool global_winbindd_offline_state;
  87
  88 struct winbind_cache {
  89         TDB_CONTEXT *tdb;
  90 };
  91
  92 struct cache_entry {
  93         NTSTATUS status;
  94         uint32 sequence_number;
  95         uint8 *data;
  96         uint32 len, ofs;
  97 };
  98
  99 void (*smb_panic_fn)(const char *const why) = smb_panic;
 100
 101 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
 102
 103 static struct winbind_cache *wcache;
 104
 105 void winbindd_check_cache_size(time_t t)
 106 {
 107         static time_t last_check_time;
 108         struct stat st;
 109
 110         if (last_check_time == (time_t)0)
 111                 last_check_time = t;
 112
 113         if (t - last_check_time < 60 && t - last_check_time > 0)
 114                 return;
 115
 116         if (wcache == NULL || wcache->tdb == NULL) {
 117                 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
 118                 return;
 119         }
 120
 121         if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
 122                 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
 123                 return;
 124         }
 125
 126         if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
 127                 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
 128                         (unsigned long)st.st_size,
 129                         (unsigned long)WINBINDD_MAX_CACHE_SIZE));
 130                 wcache_flush_cache();
 131         }
 132 }
 133
 134 /* get the winbind_cache structure */
 135 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 136 {
 137         struct winbind_cache *ret = wcache;
 138
 139         /* We have to know what type of domain we are dealing with first. */
 140
 141         if (domain->internal) {
 142                 domain->backend = &builtin_passdb_methods;
 143                 domain->initialized = True;
 144         }
 145         if ( !domain->initialized ) {
 146                 init_dc_connection( domain );
 147         }
 148
 149         /*
 150            OK.  listen up becasue I'm only going to say this once.
 151            We have the following scenarios to consider
 152            (a) trusted AD domains on a Samba DC,
 153            (b) trusted AD domains and we are joined to a non-kerberos domain
 154            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 155
 156            For (a) we can always contact the trusted domain using krb5
 157            since we have the domain trust account password
 158
 159            For (b) we can only use RPC since we have no way of
 160            getting a krb5 ticket in our own domain
 161
 162            For (c) we can always use krb5 since we have a kerberos trust
 163
 164            --jerry
 165          */
 166
 167         if (!domain->backend) {
 168 #ifdef HAVE_ADS
 169                 struct winbindd_domain *our_domain = domain;
 170
 171                 /* find our domain first so we can figure out if we
 172                    are joined to a kerberized domain */
 173
 174                 if ( !domain->primary )
 175                         our_domain = find_our_domain();
 176
 177                 if ((our_domain->active_directory || IS_DC)
 178                     && domain->active_directory
 179                     && !lp_winbind_rpc_only()) {
 180                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 181                         domain->backend = &ads_methods;
 182                 } else {
 183 #endif  /* HAVE_ADS */
 184                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 185                         domain->backend = &reconnect_methods;
 186 #ifdef HAVE_ADS
 187                 }
 188 #endif  /* HAVE_ADS */
 189         }
 190
 191         if (ret)
 192                 return ret;
 193
 194         ret = SMB_XMALLOC_P(struct winbind_cache);
 195         ZERO_STRUCTP(ret);
 196
 197         wcache = ret;
 198         wcache_flush_cache();
 199
 200         return ret;
 201 }
 202
 203 /*
 204   free a centry structure
 205 */
 206 static void centry_free(struct cache_entry *centry)
 207 {
 208         if (!centry)
 209                 return;
 210         SAFE_FREE(centry->data);
 211         free(centry);
 212 }
 213
 214 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 215 {
 216         if (centry->len - centry->ofs < nbytes) {
 217                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 218                          (unsigned int)nbytes,
 219                          centry->len - centry->ofs));
 220                 return false;
 221         }
 222         return true;
 223 }
 224
 225 /*
 226   pull a uint32 from a cache entry
 227 */
 228 static uint32 centry_uint32(struct cache_entry *centry)
 229 {
 230         uint32 ret;
 231
 232         if (!centry_check_bytes(centry, 4)) {
 233                 smb_panic_fn("centry_uint32");
 234         }
 235         ret = IVAL(centry->data, centry->ofs);
 236         centry->ofs += 4;
 237         return ret;
 238 }
 239
 240 /*
 241   pull a uint16 from a cache entry
 242 */
 243 static uint16 centry_uint16(struct cache_entry *centry)
 244 {
 245         uint16 ret;
 246         if (!centry_check_bytes(centry, 2)) {
 247                 smb_panic_fn("centry_uint16");
 248         }
 249         ret = CVAL(centry->data, centry->ofs);
 250         centry->ofs += 2;
 251         return ret;
 252 }
 253
 254 /*
 255   pull a uint8 from a cache entry
 256 */
 257 static uint8 centry_uint8(struct cache_entry *centry)
 258 {
 259         uint8 ret;
 260         if (!centry_check_bytes(centry, 1)) {
 261                 smb_panic_fn("centry_uint8");
 262         }
 263         ret = CVAL(centry->data, centry->ofs);
 264         centry->ofs += 1;
 265         return ret;
 266 }
 267
 268 /*
 269   pull a NTTIME from a cache entry
 270 */
 271 static NTTIME centry_nttime(struct cache_entry *centry)
 272 {
 273         NTTIME ret;
 274         if (!centry_check_bytes(centry, 8)) {
 275                 smb_panic_fn("centry_nttime");
 276         }
 277         ret = IVAL(centry->data, centry->ofs);
 278         centry->ofs += 4;
 279         ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
 280         centry->ofs += 4;
 281         return ret;
 282 }
 283
 284 /*
 285   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 286 */
 287 static time_t centry_time(struct cache_entry *centry)
 288 {
 289         return (time_t)centry_nttime(centry);
 290 }
 291
 292 /* pull a string from a cache entry, using the supplied
 293    talloc context
 294 */
 295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 296 {
 297         uint32 len;
 298         char *ret;
 299
 300         len = centry_uint8(centry);
 301
 302         if (len == 0xFF) {
 303                 /* a deliberate NULL string */
 304                 return NULL;
 305         }
 306
 307         if (!centry_check_bytes(centry, (size_t)len)) {
 308                 smb_panic_fn("centry_string");
 309         }
 310
 311         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 312         if (!ret) {
 313                 smb_panic_fn("centry_string out of memory\n");
 314         }
 315         memcpy(ret,centry->data + centry->ofs, len);
 316         ret[len] = 0;
 317         centry->ofs += len;
 318         return ret;
 319 }
 320
 321 /* pull a hash16 from a cache entry, using the supplied
 322    talloc context
 323 */
 324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 325 {
 326         uint32 len;
 327         char *ret;
 328
 329         len = centry_uint8(centry);
 330
 331         if (len != 16) {
 332                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 333                         len ));
 334                 return NULL;
 335         }
 336
 337         if (!centry_check_bytes(centry, 16)) {
 338                 return NULL;
 339         }
 340
 341         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 342         if (!ret) {
 343                 smb_panic_fn("centry_hash out of memory\n");
 344         }
 345         memcpy(ret,centry->data + centry->ofs, 16);
 346         centry->ofs += 16;
 347         return ret;
 348 }
 349
 350 /* pull a sid from a cache entry, using the supplied
 351    talloc context
 352 */
 353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
 354 {
 355         char *sid_string;
 356         bool ret;
 357
 358         sid_string = centry_string(centry, talloc_tos());
 359         if (sid_string == NULL) {
 360                 return false;
 361         }
 362         ret = string_to_sid(sid, sid_string);
 363         TALLOC_FREE(sid_string);
 364         return ret;
 365 }
 366
 367
 368 /*
 369   pull a NTSTATUS from a cache entry
 370 */
 371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 372 {
 373         NTSTATUS status;
 374
 375         status = NT_STATUS(centry_uint32(centry));
 376         return status;
 377 }
 378
 379
 380 /* the server is considered down if it can't give us a sequence number */
 381 static bool wcache_server_down(struct winbindd_domain *domain)
 382 {
 383         bool ret;
 384
 385         if (!wcache->tdb)
 386                 return false;
 387
 388         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 389
 390         if (ret)
 391                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 392                         domain->name ));
 393         return ret;
 394 }
 395
 396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
 397                                 uint32_t *last_seq_check)
 398 {
 399         char *key;
 400         TDB_DATA data;
 401
 402         if (wcache->tdb == NULL) {
 403                 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
 404                 return false;
 405         }
 406
 407         key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 408         if (key == NULL) {
 409                 DEBUG(10, ("talloc failed\n"));
 410                 return false;
 411         }
 412
 413         data = tdb_fetch_bystring(wcache->tdb, key);
 414         TALLOC_FREE(key);
 415
 416         if (data.dptr == NULL) {
 417                 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
 418                            domain_name));
 419                 return false;
 420         }
 421         if (data.dsize != 8) {
 422                 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
 423                            (int)data.dsize));
 424                 SAFE_FREE(data.dptr);
 425                 return false;
 426         }
 427
 428         *seqnum = IVAL(data.dptr, 0);
 429         *last_seq_check = IVAL(data.dptr, 4);
 430         SAFE_FREE(data.dptr);
 431
 432         return true;
 433 }
 434
 435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 436 {
 437         uint32 last_check, time_diff;
 438
 439         if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
 440                                  &last_check)) {
 441                 return NT_STATUS_UNSUCCESSFUL;
 442         }
 443         domain->last_seq_check = last_check;
 444
 445         /* have we expired? */
 446
 447         time_diff = now - domain->last_seq_check;
 448         if ( time_diff > lp_winbind_cache_time() ) {
 449                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 450                         domain->name, domain->sequence_number,
 451                         (uint32)domain->last_seq_check));
 452                 return NT_STATUS_UNSUCCESSFUL;
 453         }
 454
 455         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 456                 domain->name, domain->sequence_number,
 457                 (uint32)domain->last_seq_check));
 458
 459         return NT_STATUS_OK;
 460 }
 461
 462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
 463                          time_t last_seq_check)
 464 {
 465         char *key_str;
 466         uint8_t buf[8];
 467         int ret;
 468
 469         if (wcache->tdb == NULL) {
 470                 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
 471                 return false;
 472         }
 473
 474         key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 475         if (key_str == NULL) {
 476                 DEBUG(10, ("talloc_asprintf failed\n"));
 477                 return false;
 478         }
 479
 480         SIVAL(buf, 0, seqnum);
 481         SIVAL(buf, 4, last_seq_check);
 482
 483         ret = tdb_store_bystring(wcache->tdb, key_str,
 484                                  make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
 485         TALLOC_FREE(key_str);
 486         if (ret == -1) {
 487                 DEBUG(10, ("tdb_store_bystring failed: %s\n",
 488                            tdb_errorstr(wcache->tdb)));
 489                 TALLOC_FREE(key_str);
 490                 return false;
 491         }
 492
 493         DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
 494                    domain_name, seqnum, (unsigned)last_seq_check));
 495
 496         return true;
 497 }
 498
 499 static bool store_cache_seqnum( struct winbindd_domain *domain )
 500 {
 501         return wcache_store_seqnum(domain->name, domain->sequence_number,
 502                                    domain->last_seq_check);
 503 }
 504
 505 /*
 506   refresh the domain sequence number. If force is true
 507   then always refresh it, no matter how recently we fetched it
 508 */
 509
 510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 511 {
 512         NTSTATUS status;
 513         unsigned time_diff;
 514         time_t t = time(NULL);
 515         unsigned cache_time = lp_winbind_cache_time();
 516
 517         if (is_domain_offline(domain)) {
 518                 return;
 519         }
 520
 521         get_cache( domain );
 522
 523 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 524         /* trying to reconnect is expensive, don't do it too often */
 525         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 526                 cache_time *= 8;
 527         }
 528 #endif
 529
 530         time_diff = t - domain->last_seq_check;
 531
 532         /* see if we have to refetch the domain sequence number */
 533         if (!force && (time_diff < cache_time) &&
 534                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 535                         NT_STATUS_IS_OK(domain->last_status)) {
 536                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 537                 goto done;
 538         }
 539
 540         /* try to get the sequence number from the tdb cache first */
 541         /* this will update the timestamp as well */
 542
 543         status = fetch_cache_seqnum( domain, t );
 544         if (NT_STATUS_IS_OK(status) &&
 545                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 546                         NT_STATUS_IS_OK(domain->last_status)) {
 547                 goto done;
 548         }
 549
 550         /* important! make sure that we know if this is a native
 551            mode domain or not.  And that we can contact it. */
 552
 553         if ( winbindd_can_contact_domain( domain ) ) {
 554                 status = domain->backend->sequence_number(domain,
 555                                                           &domain->sequence_number);
 556         } else {
 557                 /* just use the current time */
 558                 status = NT_STATUS_OK;
 559                 domain->sequence_number = time(NULL);
 560         }
 561
 562
 563         /* the above call could have set our domain->backend to NULL when
 564          * coming from offline to online mode, make sure to reinitialize the
 565          * backend - Guenther */
 566         get_cache( domain );
 567
 568         if (!NT_STATUS_IS_OK(status)) {
 569                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 570                 domain->sequence_number = DOM_SEQUENCE_NONE;
 571         }
 572
 573         domain->last_status = status;
 574         domain->last_seq_check = time(NULL);
 575
 576         /* save the new sequence number in the cache */
 577         store_cache_seqnum( domain );
 578
 579 done:
 580         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 581                    domain->name, domain->sequence_number));
 582
 583         return;
 584 }
 585
 586 /*
 587   decide if a cache entry has expired
 588 */
 589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 590 {
 591         /* If we've been told to be offline - stay in that state... */
 592         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 593                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 594                         keystr, domain->name ));
 595                 return false;
 596         }
 597
 598         /* when the domain is offline return the cached entry.
 599          * This deals with transient offline states... */
 600
 601         if (!domain->online) {
 602                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 603                         keystr, domain->name ));
 604                 return false;
 605         }
 606
 607         /* if the server is OK and our cache entry came from when it was down then
 608            the entry is invalid */
 609         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 610             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 611                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 612                         keystr, domain->name ));
 613                 return true;
 614         }
 615
 616         /* if the server is down or the cache entry is not older than the
 617            current sequence number then it is OK */
 618         if (wcache_server_down(domain) ||
 619             centry->sequence_number == domain->sequence_number) {
 620                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 621                         keystr, domain->name ));
 622                 return false;
 623         }
 624
 625         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 626                 keystr, domain->name ));
 627
 628         /* it's expired */
 629         return true;
 630 }
 631
 632 static struct cache_entry *wcache_fetch_raw(char *kstr)
 633 {
 634         TDB_DATA data;
 635         struct cache_entry *centry;
 636         TDB_DATA key;
 637
 638         key = string_tdb_data(kstr);
 639         data = tdb_fetch(wcache->tdb, key);
 640         if (!data.dptr) {
 641                 /* a cache miss */
 642                 return NULL;
 643         }
 644
 645         centry = SMB_XMALLOC_P(struct cache_entry);
 646         centry->data = (unsigned char *)data.dptr;
 647         centry->len = data.dsize;
 648         centry->ofs = 0;
 649
 650         if (centry->len < 8) {
 651                 /* huh? corrupt cache? */
 652                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
 653                 centry_free(centry);
 654                 return NULL;
 655         }
 656
 657         centry->status = centry_ntstatus(centry);
 658         centry->sequence_number = centry_uint32(centry);
 659
 660         return centry;
 661 }
 662
 663 /*
 664   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 665   number and return status
 666 */
 667 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 668                                         struct winbindd_domain *domain,
 669                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 670 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 671                                         struct winbindd_domain *domain,
 672                                         const char *format, ...)
 673 {
 674         va_list ap;
 675         char *kstr;
 676         struct cache_entry *centry;
 677
 678         if (!winbindd_use_cache()) {
 679                 return NULL;
 680         }
 681
 682         refresh_sequence_number(domain, false);
 683
 684         va_start(ap, format);
 685         smb_xvasprintf(&kstr, format, ap);
 686         va_end(ap);
 687
 688         centry = wcache_fetch_raw(kstr);
 689         if (centry == NULL) {
 690                 free(kstr);
 691                 return NULL;
 692         }
 693
 694         if (centry_expired(domain, kstr, centry)) {
 695
 696                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 697                          kstr, domain->name ));
 698
 699                 centry_free(centry);
 700                 free(kstr);
 701                 return NULL;
 702         }
 703
 704         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 705                  kstr, domain->name ));
 706
 707         free(kstr);
 708         return centry;
 709 }
 710
 711 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 712 static void wcache_delete(const char *format, ...)
 713 {
 714         va_list ap;
 715         char *kstr;
 716         TDB_DATA key;
 717
 718         va_start(ap, format);
 719         smb_xvasprintf(&kstr, format, ap);
 720         va_end(ap);
 721
 722         key = string_tdb_data(kstr);
 723
 724         tdb_delete(wcache->tdb, key);
 725         free(kstr);
 726 }
 727
 728 /*
 729   make sure we have at least len bytes available in a centry
 730 */
 731 static void centry_expand(struct cache_entry *centry, uint32 len)
 732 {
 733         if (centry->len - centry->ofs >= len)
 734                 return;
 735         centry->len *= 2;
 736         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 737                                          centry->len);
 738         if (!centry->data) {
 739                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 740                 smb_panic_fn("out of memory in centry_expand");
 741         }
 742 }
 743
 744 /*
 745   push a uint32 into a centry
 746 */
 747 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 748 {
 749         centry_expand(centry, 4);
 750         SIVAL(centry->data, centry->ofs, v);
 751         centry->ofs += 4;
 752 }
 753
 754 /*
 755   push a uint16 into a centry
 756 */
 757 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 758 {
 759         centry_expand(centry, 2);
 760         SIVAL(centry->data, centry->ofs, v);
 761         centry->ofs += 2;
 762 }
 763
 764 /*
 765   push a uint8 into a centry
 766 */
 767 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 768 {
 769         centry_expand(centry, 1);
 770         SCVAL(centry->data, centry->ofs, v);
 771         centry->ofs += 1;
 772 }
 773
 774 /*
 775    push a string into a centry
 776  */
 777 static void centry_put_string(struct cache_entry *centry, const char *s)
 778 {
 779         int len;
 780
 781         if (!s) {
 782                 /* null strings are marked as len 0xFFFF */
 783                 centry_put_uint8(centry, 0xFF);
 784                 return;
 785         }
 786
 787         len = strlen(s);
 788         /* can't handle more than 254 char strings. Truncating is probably best */
 789         if (len > 254) {
 790                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 791                 len = 254;
 792         }
 793         centry_put_uint8(centry, len);
 794         centry_expand(centry, len);
 795         memcpy(centry->data + centry->ofs, s, len);
 796         centry->ofs += len;
 797 }
 798
 799 /*
 800    push a 16 byte hash into a centry - treat as 16 byte string.
 801  */
 802 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 803 {
 804         centry_put_uint8(centry, 16);
 805         centry_expand(centry, 16);
 806         memcpy(centry->data + centry->ofs, val, 16);
 807         centry->ofs += 16;
 808 }
 809
 810 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
 811 {
 812         fstring sid_string;
 813         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 814 }
 815
 816
 817 /*
 818   put NTSTATUS into a centry
 819 */
 820 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 821 {
 822         uint32 status_value = NT_STATUS_V(status);
 823         centry_put_uint32(centry, status_value);
 824 }
 825
 826
 827 /*
 828   push a NTTIME into a centry
 829 */
 830 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 831 {
 832         centry_expand(centry, 8);
 833         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 834         centry->ofs += 4;
 835         SIVAL(centry->data, centry->ofs, nt >> 32);
 836         centry->ofs += 4;
 837 }
 838
 839 /*
 840   push a time_t into a centry - use a 64 bit size.
 841   NTTIME here is being used as a convenient 64-bit size.
 842 */
 843 static void centry_put_time(struct cache_entry *centry, time_t t)
 844 {
 845         NTTIME nt = (NTTIME)t;
 846         centry_put_nttime(centry, nt);
 847 }
 848
 849 /*
 850   start a centry for output. When finished, call centry_end()
 851 */
 852 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 853 {
 854         struct cache_entry *centry;
 855
 856         if (!wcache->tdb)
 857                 return NULL;
 858
 859         centry = SMB_XMALLOC_P(struct cache_entry);
 860
 861         centry->len = 8192; /* reasonable default */
 862         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 863         centry->ofs = 0;
 864         centry->sequence_number = domain->sequence_number;
 865         centry_put_ntstatus(centry, status);
 866         centry_put_uint32(centry, centry->sequence_number);
 867         return centry;
 868 }
 869
 870 /*
 871   finish a centry and write it to the tdb
 872 */
 873 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 874 static void centry_end(struct cache_entry *centry, const char *format, ...)
 875 {
 876         va_list ap;
 877         char *kstr;
 878         TDB_DATA key, data;
 879
 880         if (!winbindd_use_cache()) {
 881                 return;
 882         }
 883
 884         va_start(ap, format);
 885         smb_xvasprintf(&kstr, format, ap);
 886         va_end(ap);
 887
 888         key = string_tdb_data(kstr);
 889         data.dptr = centry->data;
 890         data.dsize = centry->ofs;
 891
 892         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 893         free(kstr);
 894 }
 895
 896 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 897                                     NTSTATUS status, const char *domain_name,
 898                                     const char *name, const DOM_SID *sid,
 899                                     enum lsa_SidType type)
 900 {
 901         struct cache_entry *centry;
 902         fstring uname;
 903
 904         centry = centry_start(domain, status);
 905         if (!centry)
 906                 return;
 907         centry_put_uint32(centry, type);
 908         centry_put_sid(centry, sid);
 909         fstrcpy(uname, name);
 910         strupper_m(uname);
 911         centry_end(centry, "NS/%s/%s", domain_name, uname);
 912         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 913                   uname, sid_string_dbg(sid), nt_errstr(status)));
 914         centry_free(centry);
 915 }
 916
 917 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 918                                     const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 919 {
 920         struct cache_entry *centry;
 921         fstring sid_string;
 922
 923         centry = centry_start(domain, status);
 924         if (!centry)
 925                 return;
 926
 927         if (NT_STATUS_IS_OK(status)) {
 928                 centry_put_uint32(centry, type);
 929                 centry_put_string(centry, domain_name);
 930                 centry_put_string(centry, name);
 931         }
 932
 933         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 934         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 935                   name, nt_errstr(status)));
 936         centry_free(centry);
 937 }
 938
 939
 940 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
 941                              struct wbint_userinfo *info)
 942 {
 943         struct cache_entry *centry;
 944         fstring sid_string;
 945
 946         if (is_null_sid(&info->user_sid)) {
 947                 return;
 948         }
 949
 950         centry = centry_start(domain, status);
 951         if (!centry)
 952                 return;
 953         centry_put_string(centry, info->acct_name);
 954         centry_put_string(centry, info->full_name);
 955         centry_put_string(centry, info->homedir);
 956         centry_put_string(centry, info->shell);
 957         centry_put_uint32(centry, info->primary_gid);
 958         centry_put_sid(centry, &info->user_sid);
 959         centry_put_sid(centry, &info->group_sid);
 960         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 961                                                   &info->user_sid));
 962         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 963         centry_free(centry);
 964 }
 965
 966 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
 967                                        NTSTATUS status,
 968                                        struct samr_DomInfo12 *lockout_policy)
 969 {
 970         struct cache_entry *centry;
 971
 972         centry = centry_start(domain, status);
 973         if (!centry)
 974                 return;
 975
 976         centry_put_nttime(centry, lockout_policy->lockout_duration);
 977         centry_put_nttime(centry, lockout_policy->lockout_window);
 978         centry_put_uint16(centry, lockout_policy->lockout_threshold);
 979
 980         centry_end(centry, "LOC_POL/%s", domain->name);
 981
 982         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
 983
 984         centry_free(centry);
 985 }
 986
 987
 988
 989 static void wcache_save_password_policy(struct winbindd_domain *domain,
 990                                         NTSTATUS status,
 991                                         struct samr_DomInfo1 *policy)
 992 {
 993         struct cache_entry *centry;
 994
 995         centry = centry_start(domain, status);
 996         if (!centry)
 997                 return;
 998
 999         centry_put_uint16(centry, policy->min_password_length);
1000         centry_put_uint16(centry, policy->password_history_length);
1001         centry_put_uint32(centry, policy->password_properties);
1002         centry_put_nttime(centry, policy->max_password_age);
1003         centry_put_nttime(centry, policy->min_password_age);
1004
1005         centry_end(centry, "PWD_POL/%s", domain->name);
1006
1007         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1008
1009         centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013  ***************************************************************************/
1014
1015 static void wcache_save_username_alias(struct winbindd_domain *domain,
1016                                        NTSTATUS status,
1017                                        const char *name, const char *alias)
1018 {
1019         struct cache_entry *centry;
1020         fstring uname;
1021
1022         if ( (centry = centry_start(domain, status)) == NULL )
1023                 return;
1024
1025         centry_put_string( centry, alias );
1026
1027         fstrcpy(uname, name);
1028         strupper_m(uname);
1029         centry_end(centry, "NSS/NA/%s", uname);
1030
1031         DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1032
1033         centry_free(centry);
1034 }
1035
1036 static void wcache_save_alias_username(struct winbindd_domain *domain,
1037                                        NTSTATUS status,
1038                                        const char *alias, const char *name)
1039 {
1040         struct cache_entry *centry;
1041         fstring uname;
1042
1043         if ( (centry = centry_start(domain, status)) == NULL )
1044                 return;
1045
1046         centry_put_string( centry, name );
1047
1048         fstrcpy(uname, alias);
1049         strupper_m(uname);
1050         centry_end(centry, "NSS/AN/%s", uname);
1051
1052         DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1053
1054         centry_free(centry);
1055 }
1056
1057 /***************************************************************************
1058  ***************************************************************************/
1059
1060 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1061                                     struct winbindd_domain *domain,
1062                                     const char *name, char **alias )
1063 {
1064         struct winbind_cache *cache = get_cache(domain);
1065         struct cache_entry *centry = NULL;
1066         NTSTATUS status;
1067         char *upper_name;
1068
1069         if ( domain->internal )
1070                 return NT_STATUS_NOT_SUPPORTED;
1071
1072         if (!cache->tdb)
1073                 goto do_query;
1074
1075         if ( (upper_name = SMB_STRDUP(name)) == NULL )
1076                 return NT_STATUS_NO_MEMORY;
1077         strupper_m(upper_name);
1078
1079         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1080
1081         SAFE_FREE( upper_name );
1082
1083         if (!centry)
1084                 goto do_query;
1085
1086         status = centry->status;
1087
1088         if (!NT_STATUS_IS_OK(status)) {
1089                 centry_free(centry);
1090                 return status;
1091         }
1092
1093         *alias = centry_string( centry, mem_ctx );
1094
1095         centry_free(centry);
1096
1097         DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1098                   name, *alias ? *alias : "(none)"));
1099
1100         return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1101
1102 do_query:
1103
1104         /* If its not in cache and we are offline, then fail */
1105
1106         if ( get_global_winbindd_state_offline() || !domain->online ) {
1107                 DEBUG(8,("resolve_username_to_alias: rejecting query "
1108                          "in offline mode\n"));
1109                 return NT_STATUS_NOT_FOUND;
1110         }
1111
1112         status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1113
1114         if ( NT_STATUS_IS_OK( status ) ) {
1115                 wcache_save_username_alias(domain, status, name, *alias);
1116         }
1117
1118         if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1119                 wcache_save_username_alias(domain, status, name, "(NULL)");
1120         }
1121
1122         DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1123                  nt_errstr(status)));
1124
1125         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1126                 set_domain_offline( domain );
1127         }
1128
1129         return status;
1130 }
1131
1132 /***************************************************************************
1133  ***************************************************************************/
1134
1135 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1136                                     struct winbindd_domain *domain,
1137                                     const char *alias, char **name )
1138 {
1139         struct winbind_cache *cache = get_cache(domain);
1140         struct cache_entry *centry = NULL;
1141         NTSTATUS status;
1142         char *upper_name;
1143
1144         if ( domain->internal )
1145                 return  NT_STATUS_NOT_SUPPORTED;
1146
1147         if (!cache->tdb)
1148                 goto do_query;
1149
1150         if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1151                 return NT_STATUS_NO_MEMORY;
1152         strupper_m(upper_name);
1153
1154         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1155
1156         SAFE_FREE( upper_name );
1157
1158         if (!centry)
1159                 goto do_query;
1160
1161         status = centry->status;
1162
1163         if (!NT_STATUS_IS_OK(status)) {
1164                 centry_free(centry);
1165                 return status;
1166         }
1167
1168         *name = centry_string( centry, mem_ctx );
1169
1170         centry_free(centry);
1171
1172         DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1173                   alias, *name ? *name : "(none)"));
1174
1175         return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1176
1177 do_query:
1178
1179         /* If its not in cache and we are offline, then fail */
1180
1181         if ( get_global_winbindd_state_offline() || !domain->online ) {
1182                 DEBUG(8,("resolve_alias_to_username: rejecting query "
1183                          "in offline mode\n"));
1184                 return NT_STATUS_NOT_FOUND;
1185         }
1186
1187         /* an alias cannot contain a domain prefix or '@' */
1188
1189         if (strchr(alias, '\\') || strchr(alias, '@')) {
1190                 DEBUG(10,("resolve_alias_to_username: skipping fully "
1191                           "qualified name %s\n", alias));
1192                 return NT_STATUS_OBJECT_NAME_INVALID;
1193         }
1194
1195         status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1196
1197         if ( NT_STATUS_IS_OK( status ) ) {
1198                 wcache_save_alias_username( domain, status, alias, *name );
1199         }
1200
1201         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1202                 wcache_save_alias_username(domain, status, alias, "(NULL)");
1203         }
1204
1205         DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1206                  nt_errstr(status)));
1207
1208         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1209                 set_domain_offline( domain );
1210         }
1211
1212         return status;
1213 }
1214
1215 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1216 {
1217         struct winbind_cache *cache = get_cache(domain);
1218         TDB_DATA data;
1219         fstring key_str, tmp;
1220         uint32 rid;
1221
1222         if (!cache->tdb) {
1223                 return NT_STATUS_INTERNAL_DB_ERROR;
1224         }
1225
1226         if (is_null_sid(sid)) {
1227                 return NT_STATUS_INVALID_SID;
1228         }
1229
1230         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1231                 return NT_STATUS_INVALID_SID;
1232         }
1233
1234         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1235
1236         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1237         if (!data.dptr) {
1238                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1239         }
1240
1241         SAFE_FREE(data.dptr);
1242         return NT_STATUS_OK;
1243 }
1244
1245 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1246    as new salted ones. */
1247
1248 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1249                           TALLOC_CTX *mem_ctx,
1250                           const DOM_SID *sid,
1251                           const uint8 **cached_nt_pass,
1252                           const uint8 **cached_salt)
1253 {
1254         struct winbind_cache *cache = get_cache(domain);
1255         struct cache_entry *centry = NULL;
1256         NTSTATUS status;
1257         time_t t;
1258         uint32 rid;
1259         fstring tmp;
1260
1261         if (!cache->tdb) {
1262                 return NT_STATUS_INTERNAL_DB_ERROR;
1263         }
1264
1265         if (is_null_sid(sid)) {
1266                 return NT_STATUS_INVALID_SID;
1267         }
1268
1269         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1270                 return NT_STATUS_INVALID_SID;
1271         }
1272
1273         /* Try and get a salted cred first. If we can't
1274            fall back to an unsalted cred. */
1275
1276         centry = wcache_fetch(cache, domain, "CRED/%s",
1277                               sid_to_fstring(tmp, sid));
1278         if (!centry) {
1279                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1280                           sid_string_dbg(sid)));
1281                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1282         }
1283
1284         t = centry_time(centry);
1285
1286         /* In the salted case this isn't actually the nt_hash itself,
1287            but the MD5 of the salt + nt_hash. Let the caller
1288            sort this out. It can tell as we only return the cached_salt
1289            if we are returning a salted cred. */
1290
1291         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1292         if (*cached_nt_pass == NULL) {
1293                 fstring sidstr;
1294
1295                 sid_to_fstring(sidstr, sid);
1296
1297                 /* Bad (old) cred cache. Delete and pretend we
1298                    don't have it. */
1299                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1300                                 sidstr));
1301                 wcache_delete("CRED/%s", sidstr);
1302                 centry_free(centry);
1303                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1304         }
1305
1306         /* We only have 17 bytes more data in the salted cred case. */
1307         if (centry->len - centry->ofs == 17) {
1308                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1309         } else {
1310                 *cached_salt = NULL;
1311         }
1312
1313         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1314         if (*cached_salt) {
1315                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1316         }
1317
1318         status = centry->status;
1319
1320         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1321                   sid_string_dbg(sid), nt_errstr(status) ));
1322
1323         centry_free(centry);
1324         return status;
1325 }
1326
1327 /* Store creds for a SID - only writes out new salted ones. */
1328
1329 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1330                            TALLOC_CTX *mem_ctx,
1331                            const DOM_SID *sid,
1332                            const uint8 nt_pass[NT_HASH_LEN])
1333 {
1334         struct cache_entry *centry;
1335         fstring sid_string;
1336         uint32 rid;
1337         uint8 cred_salt[NT_HASH_LEN];
1338         uint8 salted_hash[NT_HASH_LEN];
1339
1340         if (is_null_sid(sid)) {
1341                 return NT_STATUS_INVALID_SID;
1342         }
1343
1344         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1345                 return NT_STATUS_INVALID_SID;
1346         }
1347
1348         centry = centry_start(domain, NT_STATUS_OK);
1349         if (!centry) {
1350                 return NT_STATUS_INTERNAL_DB_ERROR;
1351         }
1352
1353         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1354
1355         centry_put_time(centry, time(NULL));
1356
1357         /* Create a salt and then salt the hash. */
1358         generate_random_buffer(cred_salt, NT_HASH_LEN);
1359         E_md5hash(cred_salt, nt_pass, salted_hash);
1360
1361         centry_put_hash16(centry, salted_hash);
1362         centry_put_hash16(centry, cred_salt);
1363         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1364
1365         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1366
1367         centry_free(centry);
1368
1369         return NT_STATUS_OK;
1370 }
1371
1372
1373 /* Query display info. This is the basic user list fn */
1374 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1375                                 TALLOC_CTX *mem_ctx,
1376                                 uint32 *num_entries,
1377                                 struct wbint_userinfo **info)
1378 {
1379         struct winbind_cache *cache = get_cache(domain);
1380         struct cache_entry *centry = NULL;
1381         NTSTATUS status;
1382         unsigned int i, retry;
1383         bool old_status = domain->online;
1384
1385         if (!cache->tdb)
1386                 goto do_query;
1387
1388         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1389         if (!centry)
1390                 goto do_query;
1391
1392 do_fetch_cache:
1393         *num_entries = centry_uint32(centry);
1394
1395         if (*num_entries == 0)
1396                 goto do_cached;
1397
1398         (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1399         if (! (*info)) {
1400                 smb_panic_fn("query_user_list out of memory");
1401         }
1402         for (i=0; i<(*num_entries); i++) {
1403                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1404                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1405                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1406                 (*info)[i].shell = centry_string(centry, mem_ctx);
1407                 centry_sid(centry, &(*info)[i].user_sid);
1408                 centry_sid(centry, &(*info)[i].group_sid);
1409         }
1410
1411 do_cached:
1412         status = centry->status;
1413
1414         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1415                 domain->name, nt_errstr(status) ));
1416
1417         centry_free(centry);
1418         return status;
1419
1420 do_query:
1421         *num_entries = 0;
1422         *info = NULL;
1423
1424         /* Return status value returned by seq number check */
1425
1426         if (!NT_STATUS_IS_OK(domain->last_status))
1427                 return domain->last_status;
1428
1429         /* Put the query_user_list() in a retry loop.  There appears to be
1430          * some bug either with Windows 2000 or Samba's handling of large
1431          * rpc replies.  This manifests itself as sudden disconnection
1432          * at a random point in the enumeration of a large (60k) user list.
1433          * The retry loop simply tries the operation again. )-:  It's not
1434          * pretty but an acceptable workaround until we work out what the
1435          * real problem is. */
1436
1437         retry = 0;
1438         do {
1439
1440                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1441                         domain->name ));
1442
1443                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1444                 if (!NT_STATUS_IS_OK(status)) {
1445                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1446                                   "retrying\n", NT_STATUS_V(status)));
1447                 }
1448                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1449                         DEBUG(3, ("query_user_list: flushing "
1450                                   "connection cache\n"));
1451                         invalidate_cm_connection(&domain->conn);
1452                 }
1453                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1454                     NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1455                         if (!domain->internal && old_status) {
1456                                 set_domain_offline(domain);
1457                         }
1458                         /* store partial response. */
1459                         if (*num_entries > 0) {
1460                                 /*
1461                                  * humm, what about the status used for cache?
1462                                  * Should it be NT_STATUS_OK?
1463                                  */
1464                                 break;
1465                         }
1466                         /*
1467                          * domain is offline now, and there is no user entries,
1468                          * try to fetch from cache again.
1469                          */
1470                         if (cache->tdb && !domain->online && !domain->internal && old_status) {
1471                                 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1472                                 /* partial response... */
1473                                 if (!centry) {
1474                                         goto skip_save;
1475                                 } else {
1476                                         goto do_fetch_cache;
1477                                 }
1478                         } else {
1479                                 goto skip_save;
1480                         }
1481                 }
1482
1483         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1484                  (retry++ < 5));
1485
1486         /* and save it */
1487         refresh_sequence_number(domain, false);
1488         if (!NT_STATUS_IS_OK(status)) {
1489                 return status;
1490         }
1491         centry = centry_start(domain, status);
1492         if (!centry)
1493                 goto skip_save;
1494         centry_put_uint32(centry, *num_entries);
1495         for (i=0; i<(*num_entries); i++) {
1496                 centry_put_string(centry, (*info)[i].acct_name);
1497                 centry_put_string(centry, (*info)[i].full_name);
1498                 centry_put_string(centry, (*info)[i].homedir);
1499                 centry_put_string(centry, (*info)[i].shell);
1500                 centry_put_sid(centry, &(*info)[i].user_sid);
1501                 centry_put_sid(centry, &(*info)[i].group_sid);
1502                 if (domain->backend && domain->backend->consistent) {
1503                         /* when the backend is consistent we can pre-prime some mappings */
1504                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1505                                                 domain->name,
1506                                                 (*info)[i].acct_name,
1507                                                 &(*info)[i].user_sid,
1508                                                 SID_NAME_USER);
1509                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1510                                                 &(*info)[i].user_sid,
1511                                                 domain->name,
1512                                                 (*info)[i].acct_name,
1513                                                 SID_NAME_USER);
1514                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1515                 }
1516         }
1517         centry_end(centry, "UL/%s", domain->name);
1518         centry_free(centry);
1519
1520 skip_save:
1521         return status;
1522 }
1523
1524 /* list all domain groups */
1525 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1526                                 TALLOC_CTX *mem_ctx,
1527                                 uint32 *num_entries,
1528                                 struct acct_info **info)
1529 {
1530         struct winbind_cache *cache = get_cache(domain);
1531         struct cache_entry *centry = NULL;
1532         NTSTATUS status;
1533         unsigned int i;
1534         bool old_status;
1535
1536         old_status = domain->online;
1537         if (!cache->tdb)
1538                 goto do_query;
1539
1540         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1541         if (!centry)
1542                 goto do_query;
1543
1544 do_fetch_cache:
1545         *num_entries = centry_uint32(centry);
1546
1547         if (*num_entries == 0)
1548                 goto do_cached;
1549
1550         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1551         if (! (*info)) {
1552                 smb_panic_fn("enum_dom_groups out of memory");
1553         }
1554         for (i=0; i<(*num_entries); i++) {
1555                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1556                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1557                 (*info)[i].rid = centry_uint32(centry);
1558         }
1559
1560 do_cached:
1561         status = centry->status;
1562
1563         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1564                 domain->name, nt_errstr(status) ));
1565
1566         centry_free(centry);
1567         return status;
1568
1569 do_query:
1570         *num_entries = 0;
1571         *info = NULL;
1572
1573         /* Return status value returned by seq number check */
1574
1575         if (!NT_STATUS_IS_OK(domain->last_status))
1576                 return domain->last_status;
1577
1578         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1579                 domain->name ));
1580
1581         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1582
1583         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1584             NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1585                 if (!domain->internal && old_status) {
1586                         set_domain_offline(domain);
1587                 }
1588                 if (cache->tdb &&
1589                         !domain->online &&
1590                         !domain->internal &&
1591                         old_status) {
1592                         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1593                         if (centry) {
1594                                 goto do_fetch_cache;
1595                         }
1596                 }
1597         }
1598         /* and save it */
1599         refresh_sequence_number(domain, false);
1600         if (!NT_STATUS_IS_OK(status)) {
1601                 return status;
1602         }
1603         centry = centry_start(domain, status);
1604         if (!centry)
1605                 goto skip_save;
1606         centry_put_uint32(centry, *num_entries);
1607         for (i=0; i<(*num_entries); i++) {
1608                 centry_put_string(centry, (*info)[i].acct_name);
1609                 centry_put_string(centry, (*info)[i].acct_desc);
1610                 centry_put_uint32(centry, (*info)[i].rid);
1611         }
1612         centry_end(centry, "GL/%s/domain", domain->name);
1613         centry_free(centry);
1614
1615 skip_save:
1616         return status;
1617 }
1618
1619 /* list all domain groups */
1620 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1621                                 TALLOC_CTX *mem_ctx,
1622                                 uint32 *num_entries,
1623                                 struct acct_info **info)
1624 {
1625         struct winbind_cache *cache = get_cache(domain);
1626         struct cache_entry *centry = NULL;
1627         NTSTATUS status;
1628         unsigned int i;
1629         bool old_status;
1630
1631         old_status = domain->online;
1632         if (!cache->tdb)
1633                 goto do_query;
1634
1635         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1636         if (!centry)
1637                 goto do_query;
1638
1639 do_fetch_cache:
1640         *num_entries = centry_uint32(centry);
1641
1642         if (*num_entries == 0)
1643                 goto do_cached;
1644
1645         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1646         if (! (*info)) {
1647                 smb_panic_fn("enum_dom_groups out of memory");
1648         }
1649         for (i=0; i<(*num_entries); i++) {
1650                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1651                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1652                 (*info)[i].rid = centry_uint32(centry);
1653         }
1654
1655 do_cached:
1656
1657         /* If we are returning cached data and the domain controller
1658            is down then we don't know whether the data is up to date
1659            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1660            indicate this. */
1661
1662         if (wcache_server_down(domain)) {
1663                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1664                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1665         } else
1666                 status = centry->status;
1667
1668         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1669                 domain->name, nt_errstr(status) ));
1670
1671         centry_free(centry);
1672         return status;
1673
1674 do_query:
1675         *num_entries = 0;
1676         *info = NULL;
1677
1678         /* Return status value returned by seq number check */
1679
1680         if (!NT_STATUS_IS_OK(domain->last_status))
1681                 return domain->last_status;
1682
1683         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1684                 domain->name ));
1685
1686         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1687
1688         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1689                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1690                 if (!domain->internal && old_status) {
1691                         set_domain_offline(domain);
1692                 }
1693                 if (cache->tdb &&
1694                         !domain->internal &&
1695                         !domain->online &&
1696                         old_status) {
1697                         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1698                         if (centry) {
1699                                 goto do_fetch_cache;
1700                         }
1701                 }
1702         }
1703         /* and save it */
1704         refresh_sequence_number(domain, false);
1705         if (!NT_STATUS_IS_OK(status)) {
1706                 return status;
1707         }
1708         centry = centry_start(domain, status);
1709         if (!centry)
1710                 goto skip_save;
1711         centry_put_uint32(centry, *num_entries);
1712         for (i=0; i<(*num_entries); i++) {
1713                 centry_put_string(centry, (*info)[i].acct_name);
1714                 centry_put_string(centry, (*info)[i].acct_desc);
1715                 centry_put_uint32(centry, (*info)[i].rid);
1716         }
1717         centry_end(centry, "GL/%s/local", domain->name);
1718         centry_free(centry);
1719
1720 skip_save:
1721         return status;
1722 }
1723
1724 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1725                             const char *domain_name,
1726                             const char *name,
1727                             struct dom_sid *sid,
1728                             enum lsa_SidType *type)
1729 {
1730         struct winbind_cache *cache = get_cache(domain);
1731         struct cache_entry *centry;
1732         NTSTATUS status;
1733         char *uname;
1734
1735         if (cache->tdb == NULL) {
1736                 return NT_STATUS_NOT_FOUND;
1737         }
1738
1739         uname = talloc_strdup_upper(talloc_tos(), name);
1740         if (uname == NULL) {
1741                 return NT_STATUS_NO_MEMORY;
1742         }
1743
1744         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1745         TALLOC_FREE(uname);
1746         if (centry == NULL) {
1747                 return NT_STATUS_NOT_FOUND;
1748         }
1749
1750         status = centry->status;
1751         if (NT_STATUS_IS_OK(status)) {
1752                 *type = (enum lsa_SidType)centry_uint32(centry);
1753                 centry_sid(centry, sid);
1754         }
1755
1756         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1757                   "%s\n", domain->name, nt_errstr(status) ));
1758
1759         centry_free(centry);
1760         return status;
1761 }
1762
1763 /* convert a single name to a sid in a domain */
1764 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1765                             TALLOC_CTX *mem_ctx,
1766                             const char *domain_name,
1767                             const char *name,
1768                             uint32_t flags,
1769                             DOM_SID *sid,
1770                             enum lsa_SidType *type)
1771 {
1772         NTSTATUS status;
1773         bool old_status;
1774
1775         old_status = domain->online;
1776
1777         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1778         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1779                 return status;
1780         }
1781
1782         ZERO_STRUCTP(sid);
1783
1784         /* If the seq number check indicated that there is a problem
1785          * with this DC, then return that status... except for
1786          * access_denied.  This is special because the dc may be in
1787          * "restrict anonymous = 1" mode, in which case it will deny
1788          * most unauthenticated operations, but *will* allow the LSA
1789          * name-to-sid that we try as a fallback. */
1790
1791         if (!(NT_STATUS_IS_OK(domain->last_status)
1792               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1793                 return domain->last_status;
1794
1795         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1796                 domain->name ));
1797
1798         status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1799                                               name, flags, sid, type);
1800
1801         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1802                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1803                 if (!domain->internal && old_status) {
1804                         set_domain_offline(domain);
1805                 }
1806                 if (!domain->internal &&
1807                         !domain->online &&
1808                         old_status) {
1809                         NTSTATUS cache_status;
1810                         cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1811                         return cache_status;
1812                 }
1813         }
1814         /* and save it */
1815         refresh_sequence_number(domain, false);
1816
1817         if (domain->online &&
1818             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1819                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1820
1821                 /* Only save the reverse mapping if this was not a UPN */
1822                 if (!strchr(name, '@')) {
1823                         strupper_m(CONST_DISCARD(char *,domain_name));
1824                         strlower_m(CONST_DISCARD(char *,name));
1825                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1826                 }
1827         }
1828
1829         return status;
1830 }
1831
1832 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1833                             const struct dom_sid *sid,
1834                             TALLOC_CTX *mem_ctx,
1835                             char **domain_name,
1836                             char **name,
1837                             enum lsa_SidType *type)
1838 {
1839         struct winbind_cache *cache = get_cache(domain);
1840         struct cache_entry *centry;
1841         char *sid_string;
1842         NTSTATUS status;
1843
1844         if (cache->tdb == NULL) {
1845                 return NT_STATUS_NOT_FOUND;
1846         }
1847
1848         sid_string = sid_string_tos(sid);
1849         if (sid_string == NULL) {
1850                 return NT_STATUS_NO_MEMORY;
1851         }
1852
1853         centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1854         TALLOC_FREE(sid_string);
1855         if (centry == NULL) {
1856                 return NT_STATUS_NOT_FOUND;
1857         }
1858
1859         if (NT_STATUS_IS_OK(centry->status)) {
1860                 *type = (enum lsa_SidType)centry_uint32(centry);
1861                 *domain_name = centry_string(centry, mem_ctx);
1862                 *name = centry_string(centry, mem_ctx);
1863         }
1864
1865         status = centry->status;
1866         centry_free(centry);
1867
1868         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1869                   "%s\n", domain->name, nt_errstr(status) ));
1870
1871         return status;
1872 }
1873
1874 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1875    given */
1876 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1877                             TALLOC_CTX *mem_ctx,
1878                             const DOM_SID *sid,
1879                             char **domain_name,
1880                             char **name,
1881                             enum lsa_SidType *type)
1882 {
1883         NTSTATUS status;
1884         bool old_status;
1885
1886         old_status = domain->online;
1887         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1888                                     type);
1889         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1890                 return status;
1891         }
1892
1893         *name = NULL;
1894         *domain_name = NULL;
1895
1896         /* If the seq number check indicated that there is a problem
1897          * with this DC, then return that status... except for
1898          * access_denied.  This is special because the dc may be in
1899          * "restrict anonymous = 1" mode, in which case it will deny
1900          * most unauthenticated operations, but *will* allow the LSA
1901          * sid-to-name that we try as a fallback. */
1902
1903         if (!(NT_STATUS_IS_OK(domain->last_status)
1904               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1905                 return domain->last_status;
1906
1907         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1908                 domain->name ));
1909
1910         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1911
1912         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1913                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1914                 if (!domain->internal && old_status) {
1915                         set_domain_offline(domain);
1916                 }
1917                 if (!domain->internal &&
1918                         !domain->online &&
1919                         old_status) {
1920                         NTSTATUS cache_status;
1921                         cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1922                                                         domain_name, name, type);
1923                         return cache_status;
1924                 }
1925         }
1926         /* and save it */
1927         refresh_sequence_number(domain, false);
1928         if (!NT_STATUS_IS_OK(status)) {
1929                 return status;
1930         }
1931         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1932
1933         /* We can't save the name to sid mapping here, as with sid history a
1934          * later name2sid would give the wrong sid. */
1935
1936         return status;
1937 }
1938
1939 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1940                               TALLOC_CTX *mem_ctx,
1941                               const DOM_SID *domain_sid,
1942                               uint32 *rids,
1943                               size_t num_rids,
1944                               char **domain_name,
1945                               char ***names,
1946                               enum lsa_SidType **types)
1947 {
1948         struct winbind_cache *cache = get_cache(domain);
1949         size_t i;
1950         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1951         bool have_mapped;
1952         bool have_unmapped;
1953         bool old_status;
1954
1955         old_status = domain->online;
1956         *domain_name = NULL;
1957         *names = NULL;
1958         *types = NULL;
1959
1960         if (!cache->tdb) {
1961                 goto do_query;
1962         }
1963
1964         if (num_rids == 0) {
1965                 return NT_STATUS_OK;
1966         }
1967
1968         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1969         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1970
1971         if ((*names == NULL) || (*types == NULL)) {
1972                 result = NT_STATUS_NO_MEMORY;
1973                 goto error;
1974         }
1975
1976         have_mapped = have_unmapped = false;
1977
1978         for (i=0; i<num_rids; i++) {
1979                 DOM_SID sid;
1980                 struct cache_entry *centry;
1981                 fstring tmp;
1982
1983                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1984                         result = NT_STATUS_INTERNAL_ERROR;
1985                         goto error;
1986                 }
1987
1988                 centry = wcache_fetch(cache, domain, "SN/%s",
1989                                       sid_to_fstring(tmp, &sid));
1990                 if (!centry) {
1991                         goto do_query;
1992                 }
1993
1994                 (*types)[i] = SID_NAME_UNKNOWN;
1995                 (*names)[i] = talloc_strdup(*names, "");
1996
1997                 if (NT_STATUS_IS_OK(centry->status)) {
1998                         char *dom;
1999                         have_mapped = true;
2000                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2001
2002                         dom = centry_string(centry, mem_ctx);
2003                         if (*domain_name == NULL) {
2004                                 *domain_name = dom;
2005                         } else {
2006                                 talloc_free(dom);
2007                         }
2008
2009                         (*names)[i] = centry_string(centry, *names);
2010
2011                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2012                         have_unmapped = true;
2013
2014                 } else {
2015                         /* something's definitely wrong */
2016                         result = centry->status;
2017                         goto error;
2018                 }
2019
2020                 centry_free(centry);
2021         }
2022
2023         if (!have_mapped) {
2024                 return NT_STATUS_NONE_MAPPED;
2025         }
2026         if (!have_unmapped) {
2027                 return NT_STATUS_OK;
2028         }
2029         return STATUS_SOME_UNMAPPED;
2030
2031  do_query:
2032
2033         TALLOC_FREE(*names);
2034         TALLOC_FREE(*types);
2035
2036         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2037                                                 rids, num_rids, domain_name,
2038                                                 names, types);
2039
2040         if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2041                 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2042                 if (!domain->internal && old_status) {
2043                         set_domain_offline(domain);
2044                 }
2045                 if (cache->tdb &&
2046                         !domain->internal &&
2047                         !domain->online &&
2048                         old_status) {
2049                         have_mapped = have_unmapped = false;
2050
2051                         for (i=0; i<num_rids; i++) {
2052                                 DOM_SID sid;
2053                                 struct cache_entry *centry;
2054                                 fstring tmp;
2055
2056                                 if (!sid_compose(&sid, domain_sid, rids[i])) {
2057                                         result = NT_STATUS_INTERNAL_ERROR;
2058                                         goto error;
2059                                 }
2060
2061                                 centry = wcache_fetch(cache, domain, "SN/%s",
2062                                                       sid_to_fstring(tmp, &sid));
2063                                 if (!centry) {
2064                                         (*types)[i] = SID_NAME_UNKNOWN;
2065                                         (*names)[i] = talloc_strdup(*names, "");
2066                                         continue;
2067                                 }
2068
2069                                 (*types)[i] = SID_NAME_UNKNOWN;
2070                                 (*names)[i] = talloc_strdup(*names, "");
2071
2072                                 if (NT_STATUS_IS_OK(centry->status)) {
2073                                         char *dom;
2074                                         have_mapped = true;
2075                                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2076
2077                                         dom = centry_string(centry, mem_ctx);
2078                                         if (*domain_name == NULL) {
2079                                                 *domain_name = dom;
2080                                         } else {
2081                                                 talloc_free(dom);
2082                                         }
2083
2084                                         (*names)[i] = centry_string(centry, *names);
2085
2086                                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2087                                         have_unmapped = true;
2088
2089                                 } else {
2090                                         /* something's definitely wrong */
2091                                         result = centry->status;
2092                                         goto error;
2093                                 }
2094
2095                                 centry_free(centry);
2096                         }
2097
2098                         if (!have_mapped) {
2099                                 return NT_STATUS_NONE_MAPPED;
2100                         }
2101                         if (!have_unmapped) {
2102                                 return NT_STATUS_OK;
2103                         }
2104                         return STATUS_SOME_UNMAPPED;
2105                 }
2106         }
2107         /*
2108           None of the queried rids has been found so save all negative entries
2109         */
2110         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2111                 for (i = 0; i < num_rids; i++) {
2112                         DOM_SID sid;
2113                         const char *name = "";
2114                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
2115                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
2116
2117                         if (!sid_compose(&sid, domain_sid, rids[i])) {
2118                                 return NT_STATUS_INTERNAL_ERROR;
2119                         }
2120
2121                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2122                                                 name, type);
2123                 }
2124
2125                 return result;
2126         }
2127
2128         /*
2129           Some or all of the queried rids have been found.
2130         */
2131         if (!NT_STATUS_IS_OK(result) &&
2132             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2133                 return result;
2134         }
2135
2136         refresh_sequence_number(domain, false);
2137
2138         for (i=0; i<num_rids; i++) {
2139                 DOM_SID sid;
2140                 NTSTATUS status;
2141
2142                 if (!sid_compose(&sid, domain_sid, rids[i])) {
2143                         result = NT_STATUS_INTERNAL_ERROR;
2144                         goto error;
2145                 }
2146
2147                 status = (*types)[i] == SID_NAME_UNKNOWN ?
2148                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2149
2150                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2151                                         (*names)[i], (*types)[i]);
2152         }
2153
2154         return result;
2155
2156  error:
2157         TALLOC_FREE(*names);
2158         TALLOC_FREE(*types);
2159         return result;
2160 }
2161
2162 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2163                            TALLOC_CTX *mem_ctx,
2164                            const struct dom_sid *user_sid,
2165                            struct wbint_userinfo *info)
2166 {
2167         struct winbind_cache *cache = get_cache(domain);
2168         struct cache_entry *centry = NULL;
2169         NTSTATUS status;
2170         char *sid_string;
2171
2172         if (cache->tdb == NULL) {
2173                 return NT_STATUS_NOT_FOUND;
2174         }
2175
2176         sid_string = sid_string_tos(user_sid);
2177         if (sid_string == NULL) {
2178                 return NT_STATUS_NO_MEMORY;
2179         }
2180
2181         centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2182         TALLOC_FREE(sid_string);
2183         if (centry == NULL) {
2184                 return NT_STATUS_NOT_FOUND;
2185         }
2186
2187         /*
2188          * If we have an access denied cache entry and a cached info3
2189          * in the samlogon cache then do a query.  This will force the
2190          * rpc back end to return the info3 data.
2191          */
2192
2193         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2194             netsamlogon_cache_have(user_sid)) {
2195                 DEBUG(10, ("query_user: cached access denied and have cached "
2196                            "info3\n"));
2197                 domain->last_status = NT_STATUS_OK;
2198                 centry_free(centry);
2199                 return NT_STATUS_NOT_FOUND;
2200         }
2201
2202         /* if status is not ok then this is a negative hit
2203            and the rest of the data doesn't matter */
2204         status = centry->status;
2205         if (NT_STATUS_IS_OK(status)) {
2206                 info->acct_name = centry_string(centry, mem_ctx);
2207                 info->full_name = centry_string(centry, mem_ctx);
2208                 info->homedir = centry_string(centry, mem_ctx);
2209                 info->shell = centry_string(centry, mem_ctx);
2210                 info->primary_gid = centry_uint32(centry);
2211                 centry_sid(centry, &info->user_sid);
2212                 centry_sid(centry, &info->group_sid);
2213         }
2214
2215         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2216                   "%s\n", domain->name, nt_errstr(status) ));
2217
2218         centry_free(centry);
2219         return status;
2220 }
2221
2222 /* Lookup user information from a rid */
2223 static NTSTATUS query_user(struct winbindd_domain *domain,
2224                            TALLOC_CTX *mem_ctx,
2225                            const DOM_SID *user_sid,
2226                            struct wbint_userinfo *info)
2227 {
2228         NTSTATUS status;
2229         bool old_status;
2230
2231         old_status = domain->online;
2232         status = wcache_query_user(domain, mem_ctx, user_sid, info);
2233         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2234                 return status;
2235         }
2236
2237         ZERO_STRUCTP(info);
2238
2239         /* Return status value returned by seq number check */
2240
2241         if (!NT_STATUS_IS_OK(domain->last_status))
2242                 return domain->last_status;
2243
2244         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2245                 domain->name ));
2246
2247         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2248
2249         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2250                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2251                 if (!domain->internal && old_status) {
2252                         set_domain_offline(domain);
2253                 }
2254                 if (!domain->internal &&
2255                         !domain->online &&
2256                         old_status) {
2257                         NTSTATUS cache_status;
2258                         cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2259                         return cache_status;
2260                 }
2261         }
2262         /* and save it */
2263         refresh_sequence_number(domain, false);
2264         if (!NT_STATUS_IS_OK(status)) {
2265                 return status;
2266         }
2267         wcache_save_user(domain, status, info);
2268
2269         return status;
2270 }
2271
2272 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2273                                   TALLOC_CTX *mem_ctx,
2274                                   const struct dom_sid *user_sid,
2275                                   uint32_t *pnum_sids,
2276                                   struct dom_sid **psids)
2277 {
2278         struct winbind_cache *cache = get_cache(domain);
2279         struct cache_entry *centry = NULL;
2280         NTSTATUS status;
2281         uint32_t i, num_sids;
2282         struct dom_sid *sids;
2283         fstring sid_string;
2284
2285         if (cache->tdb == NULL) {
2286                 return NT_STATUS_NOT_FOUND;
2287         }
2288
2289         centry = wcache_fetch(cache, domain, "UG/%s",
2290                               sid_to_fstring(sid_string, user_sid));
2291         if (centry == NULL) {
2292                 return NT_STATUS_NOT_FOUND;
2293         }
2294
2295         /* If we have an access denied cache entry and a cached info3 in the
2296            samlogon cache then do a query.  This will force the rpc back end
2297            to return the info3 data. */
2298
2299         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2300             && netsamlogon_cache_have(user_sid)) {
2301                 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2302                            "cached info3\n"));
2303                 domain->last_status = NT_STATUS_OK;
2304                 centry_free(centry);
2305                 return NT_STATUS_NOT_FOUND;
2306         }
2307
2308         num_sids = centry_uint32(centry);
2309         sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2310         if (sids == NULL) {
2311                 centry_free(centry);
2312                 return NT_STATUS_NO_MEMORY;
2313         }
2314
2315         for (i=0; i<num_sids; i++) {
2316                 centry_sid(centry, &sids[i]);
2317         }
2318
2319         status = centry->status;
2320
2321         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2322                   "status: %s\n", domain->name, nt_errstr(status)));
2323
2324         centry_free(centry);
2325
2326         *pnum_sids = num_sids;
2327         *psids = sids;
2328         return status;
2329 }
2330
2331 /* Lookup groups a user is a member of. */
2332 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2333                                   TALLOC_CTX *mem_ctx,
2334                                   const DOM_SID *user_sid,
2335                                   uint32 *num_groups, DOM_SID **user_gids)
2336 {
2337         struct cache_entry *centry = NULL;
2338         NTSTATUS status;
2339         unsigned int i;
2340         fstring sid_string;
2341         bool old_status;
2342
2343         old_status = domain->online;
2344         status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2345                                           num_groups, user_gids);
2346         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2347                 return status;
2348         }
2349
2350         (*num_groups) = 0;
2351         (*user_gids) = NULL;
2352
2353         /* Return status value returned by seq number check */
2354
2355         if (!NT_STATUS_IS_OK(domain->last_status))
2356                 return domain->last_status;
2357
2358         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2359                 domain->name ));
2360
2361         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2362
2363         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2364                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2365                 if (!domain->internal && old_status) {
2366                         set_domain_offline(domain);
2367                 }
2368                 if (!domain->internal &&
2369                         !domain->online &&
2370                         old_status) {
2371                         NTSTATUS cache_status;
2372                         cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2373                                                           num_groups, user_gids);
2374                         return cache_status;
2375                 }
2376         }
2377         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2378                 goto skip_save;
2379
2380         /* and save it */
2381         refresh_sequence_number(domain, false);
2382         if (!NT_STATUS_IS_OK(status)) {
2383                 return status;
2384         }
2385         centry = centry_start(domain, status);
2386         if (!centry)
2387                 goto skip_save;
2388
2389         centry_put_uint32(centry, *num_groups);
2390         for (i=0; i<(*num_groups); i++) {
2391                 centry_put_sid(centry, &(*user_gids)[i]);
2392         }
2393
2394         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2395         centry_free(centry);
2396
2397 skip_save:
2398         return status;
2399 }
2400
2401 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2402                                  const struct dom_sid *sids)
2403 {
2404         uint32_t i;
2405         char *sidlist;
2406
2407         sidlist = talloc_strdup(mem_ctx, "");
2408         if (sidlist == NULL) {
2409                 return NULL;
2410         }
2411         for (i=0; i<num_sids; i++) {
2412                 fstring tmp;
2413                 sidlist = talloc_asprintf_append_buffer(
2414                         sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2415                 if (sidlist == NULL) {
2416                         return NULL;
2417                 }
2418         }
2419         return sidlist;
2420 }
2421
2422 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2423                                    TALLOC_CTX *mem_ctx, uint32_t num_sids,
2424                                    const struct dom_sid *sids,
2425                                    uint32_t *pnum_aliases, uint32_t **paliases)
2426 {
2427         struct winbind_cache *cache = get_cache(domain);
2428         struct cache_entry *centry = NULL;
2429         uint32_t num_aliases;
2430         uint32_t *aliases;
2431         NTSTATUS status;
2432         char *sidlist;
2433         int i;
2434
2435         if (cache->tdb == NULL) {
2436                 return NT_STATUS_NOT_FOUND;
2437         }
2438
2439         if (num_sids == 0) {
2440                 *pnum_aliases = 0;
2441                 *paliases = NULL;
2442                 return NT_STATUS_OK;
2443         }
2444
2445         /* We need to cache indexed by the whole list of SIDs, the aliases
2446          * resulting might come from any of the SIDs. */
2447
2448         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2449         if (sidlist == NULL) {
2450                 return NT_STATUS_NO_MEMORY;
2451         }
2452
2453         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2454         TALLOC_FREE(sidlist);
2455         if (centry == NULL) {
2456                 return NT_STATUS_NOT_FOUND;
2457         }
2458
2459         num_aliases = centry_uint32(centry);
2460         aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2461         if (aliases == NULL) {
2462                 centry_free(centry);
2463                 return NT_STATUS_NO_MEMORY;
2464         }
2465
2466         for (i=0; i<num_aliases; i++) {
2467                 aliases[i] = centry_uint32(centry);
2468         }
2469
2470         status = centry->status;
2471
2472         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2473                   "status %s\n", domain->name, nt_errstr(status)));
2474
2475         centry_free(centry);
2476
2477         *pnum_aliases = num_aliases;
2478         *paliases = aliases;
2479
2480         return status;
2481 }
2482
2483 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2484                                    TALLOC_CTX *mem_ctx,
2485                                    uint32 num_sids, const DOM_SID *sids,
2486                                    uint32 *num_aliases, uint32 **alias_rids)
2487 {
2488         struct cache_entry *centry = NULL;
2489         NTSTATUS status;
2490         char *sidlist;
2491         int i;
2492         bool old_status;
2493
2494         old_status = domain->online;
2495         status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2496                                            num_aliases, alias_rids);
2497         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2498                 return status;
2499         }
2500
2501         (*num_aliases) = 0;
2502         (*alias_rids) = NULL;
2503
2504         if (!NT_STATUS_IS_OK(domain->last_status))
2505                 return domain->last_status;
2506
2507         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2508                   "for domain %s\n", domain->name ));
2509
2510         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2511         if (sidlist == NULL) {
2512                 return NT_STATUS_NO_MEMORY;
2513         }
2514
2515         status = domain->backend->lookup_useraliases(domain, mem_ctx,
2516                                                      num_sids, sids,
2517                                                      num_aliases, alias_rids);
2518
2519         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2520                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2521                 if (!domain->internal && old_status) {
2522                         set_domain_offline(domain);
2523                 }
2524                 if (!domain->internal &&
2525                         !domain->online &&
2526                         old_status) {
2527                         NTSTATUS cache_status;
2528                         cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2529                                                                  sids, num_aliases, alias_rids);
2530                         return cache_status;
2531                 }
2532         }
2533         /* and save it */
2534         refresh_sequence_number(domain, false);
2535         if (!NT_STATUS_IS_OK(status)) {
2536                 return status;
2537         }
2538         centry = centry_start(domain, status);
2539         if (!centry)
2540                 goto skip_save;
2541         centry_put_uint32(centry, *num_aliases);
2542         for (i=0; i<(*num_aliases); i++)
2543                 centry_put_uint32(centry, (*alias_rids)[i]);
2544         centry_end(centry, "UA%s", sidlist);
2545         centry_free(centry);
2546
2547  skip_save:
2548         return status;
2549 }
2550
2551 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2552                                 TALLOC_CTX *mem_ctx,
2553                                 const struct dom_sid *group_sid,
2554                                 uint32_t *num_names,
2555                                 struct dom_sid **sid_mem, char ***names,
2556                                 uint32_t **name_types)
2557 {
2558         struct winbind_cache *cache = get_cache(domain);
2559         struct cache_entry *centry = NULL;
2560         NTSTATUS status;
2561         unsigned int i;
2562         char *sid_string;
2563
2564         if (cache->tdb == NULL) {
2565                 return NT_STATUS_NOT_FOUND;
2566         }
2567
2568         sid_string = sid_string_tos(group_sid);
2569         if (sid_string == NULL) {
2570                 return NT_STATUS_NO_MEMORY;
2571         }
2572
2573         centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2574         TALLOC_FREE(sid_string);
2575         if (centry == NULL) {
2576                 return NT_STATUS_NOT_FOUND;
2577         }
2578
2579         *sid_mem = NULL;
2580         *names = NULL;
2581         *name_types = NULL;
2582
2583         *num_names = centry_uint32(centry);
2584         if (*num_names == 0) {
2585                 centry_free(centry);
2586                 return NT_STATUS_OK;
2587         }
2588
2589         *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2590         *names = talloc_array(mem_ctx, char *, *num_names);
2591         *name_types = talloc_array(mem_ctx, uint32, *num_names);
2592
2593         if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2594                 TALLOC_FREE(*sid_mem);
2595                 TALLOC_FREE(*names);
2596                 TALLOC_FREE(*name_types);
2597                 centry_free(centry);
2598                 return NT_STATUS_NO_MEMORY;
2599         }
2600
2601         for (i=0; i<(*num_names); i++) {
2602                 centry_sid(centry, &(*sid_mem)[i]);
2603                 (*names)[i] = centry_string(centry, mem_ctx);
2604                 (*name_types)[i] = centry_uint32(centry);
2605         }
2606
2607         status = centry->status;
2608
2609         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2610                   "status: %s\n", domain->name, nt_errstr(status)));
2611
2612         centry_free(centry);
2613         return status;
2614 }
2615
2616 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2617                                 TALLOC_CTX *mem_ctx,
2618                                 const DOM_SID *group_sid,
2619                                 enum lsa_SidType type,
2620                                 uint32 *num_names,
2621                                 DOM_SID **sid_mem, char ***names,
2622                                 uint32 **name_types)
2623 {
2624         struct cache_entry *centry = NULL;
2625         NTSTATUS status;
2626         unsigned int i;
2627         fstring sid_string;
2628         bool old_status;
2629
2630         old_status = domain->online;
2631         status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2632                                         sid_mem, names, name_types);
2633         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2634                 return status;
2635         }
2636
2637         (*num_names) = 0;
2638         (*sid_mem) = NULL;
2639         (*names) = NULL;
2640         (*name_types) = NULL;
2641
2642         /* Return status value returned by seq number check */
2643
2644         if (!NT_STATUS_IS_OK(domain->last_status))
2645                 return domain->last_status;
2646
2647         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2648                 domain->name ));
2649
2650         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2651                                                   type, num_names,
2652                                                   sid_mem, names, name_types);
2653
2654         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2655                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2656                 if (!domain->internal && old_status) {
2657                         set_domain_offline(domain);
2658                 }
2659                 if (!domain->internal &&
2660                         !domain->online &&
2661                         old_status) {
2662                         NTSTATUS cache_status;
2663                         cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2664                                                               num_names, sid_mem, names,
2665                                                               name_types);
2666                         return cache_status;
2667                 }
2668         }
2669         /* and save it */
2670         refresh_sequence_number(domain, false);
2671         if (!NT_STATUS_IS_OK(status)) {
2672                 return status;
2673         }
2674         centry = centry_start(domain, status);
2675         if (!centry)
2676                 goto skip_save;
2677         centry_put_uint32(centry, *num_names);
2678         for (i=0; i<(*num_names); i++) {
2679                 centry_put_sid(centry, &(*sid_mem)[i]);
2680                 centry_put_string(centry, (*names)[i]);
2681                 centry_put_uint32(centry, (*name_types)[i]);
2682         }
2683         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2684         centry_free(centry);
2685
2686 skip_save:
2687         return status;
2688 }
2689
2690 /* find the sequence number for a domain */
2691 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2692 {
2693         refresh_sequence_number(domain, false);
2694
2695         *seq = domain->sequence_number;
2696
2697         return NT_STATUS_OK;
2698 }
2699
2700 /* enumerate trusted domains
2701  * (we need to have the list of trustdoms in the cache when we go offline) -
2702  * Guenther */
2703 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2704                                 TALLOC_CTX *mem_ctx,
2705                                 struct netr_DomainTrustList *trusts)
2706 {
2707         NTSTATUS status;
2708         struct winbind_cache *cache;
2709         struct winbindd_tdc_domain *dom_list = NULL;
2710         size_t num_domains = 0;
2711         bool retval = false;
2712         int i;
2713         bool old_status;
2714
2715         old_status = domain->online;
2716         trusts->count = 0;
2717         trusts->array = NULL;
2718
2719         cache = get_cache(domain);
2720         if (!cache || !cache->tdb) {
2721                 goto do_query;
2722         }
2723
2724         if (domain->online) {
2725                 goto do_query;
2726         }
2727
2728         retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2729         if (!retval || !num_domains || !dom_list) {
2730                 TALLOC_FREE(dom_list);
2731                 goto do_query;
2732         }
2733
2734 do_fetch_cache:
2735         trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
2736         if (!trusts->array) {
2737                 TALLOC_FREE(dom_list);
2738                 return NT_STATUS_NO_MEMORY;
2739         }
2740
2741         for (i = 0; i < num_domains; i++) {
2742                 struct netr_DomainTrust *trust;
2743                 struct dom_sid *sid;
2744                 struct winbindd_domain *dom;
2745
2746                 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2747                 if (dom && dom->internal) {
2748                         continue;
2749                 }
2750
2751                 trust = &trusts->array[trusts->count];
2752                 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2753                 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2754                 sid = talloc(trusts->array, struct dom_sid);
2755                 if (!trust->netbios_name || !trust->dns_name ||
2756                         !sid) {
2757                         TALLOC_FREE(dom_list);
2758                         TALLOC_FREE(trusts->array);
2759                         return NT_STATUS_NO_MEMORY;
2760                 }
2761
2762                 trust->trust_flags = dom_list[i].trust_flags;
2763                 trust->trust_attributes = dom_list[i].trust_attribs;
2764                 trust->trust_type = dom_list[i].trust_type;
2765                 sid_copy(sid, &dom_list[i].sid);
2766                 trust->sid = sid;
2767                 trusts->count++;
2768         }
2769
2770         TALLOC_FREE(dom_list);
2771         return NT_STATUS_OK;
2772
2773 do_query:
2774         /* Return status value returned by seq number check */
2775
2776         if (!NT_STATUS_IS_OK(domain->last_status))
2777                 return domain->last_status;
2778
2779         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2780                 domain->name ));
2781
2782         status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2783
2784         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2785                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2786                 if (!domain->internal && old_status) {
2787                         set_domain_offline(domain);
2788                 }
2789                 if (!domain->internal &&
2790                         !domain->online &&
2791                         old_status) {
2792                         retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2793                         if (retval && num_domains && dom_list) {
2794                                 TALLOC_FREE(trusts->array);
2795                                 trusts->count = 0;
2796                                 goto do_fetch_cache;
2797                         }
2798                 }
2799         }
2800         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2801          * so that the generic centry handling still applies correctly -
2802          * Guenther*/
2803
2804         if (!NT_STATUS_IS_ERR(status)) {
2805                 status = NT_STATUS_OK;
2806         }
2807         return status;
2808 }
2809
2810 /* get lockout policy */
2811 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2812                                TALLOC_CTX *mem_ctx,
2813                                struct samr_DomInfo12 *policy)
2814 {
2815         struct winbind_cache *cache = get_cache(domain);
2816         struct cache_entry *centry = NULL;
2817         NTSTATUS status;
2818         bool old_status;
2819
2820         old_status = domain->online;
2821         if (!cache->tdb)
2822                 goto do_query;
2823
2824         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2825
2826         if (!centry)
2827                 goto do_query;
2828
2829 do_fetch_cache:
2830         policy->lockout_duration = centry_nttime(centry);
2831         policy->lockout_window = centry_nttime(centry);
2832         policy->lockout_threshold = centry_uint16(centry);
2833
2834         status = centry->status;
2835
2836         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2837                 domain->name, nt_errstr(status) ));
2838
2839         centry_free(centry);
2840         return status;
2841
2842 do_query:
2843         ZERO_STRUCTP(policy);
2844
2845         /* Return status value returned by seq number check */
2846
2847         if (!NT_STATUS_IS_OK(domain->last_status))
2848                 return domain->last_status;
2849
2850         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2851                 domain->name ));
2852
2853         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2854
2855         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2856                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2857                 if (!domain->internal && old_status) {
2858                         set_domain_offline(domain);
2859                 }
2860                 if (cache->tdb &&
2861                         !domain->internal &&
2862                         !domain->online &&
2863                         old_status) {
2864                         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2865                         if (centry) {
2866                                 goto do_fetch_cache;
2867                         }
2868                 }
2869         }
2870         /* and save it */
2871         refresh_sequence_number(domain, false);
2872         if (!NT_STATUS_IS_OK(status)) {
2873                 return status;
2874         }
2875         wcache_save_lockout_policy(domain, status, policy);
2876
2877         return status;
2878 }
2879
2880 /* get password policy */
2881 static NTSTATUS password_policy(struct winbindd_domain *domain,
2882                                 TALLOC_CTX *mem_ctx,
2883                                 struct samr_DomInfo1 *policy)
2884 {
2885         struct winbind_cache *cache = get_cache(domain);
2886         struct cache_entry *centry = NULL;
2887         NTSTATUS status;
2888         bool old_status;
2889
2890         old_status = domain->online;
2891         if (!cache->tdb)
2892                 goto do_query;
2893
2894         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2895
2896         if (!centry)
2897                 goto do_query;
2898
2899 do_fetch_cache:
2900         policy->min_password_length = centry_uint16(centry);
2901         policy->password_history_length = centry_uint16(centry);
2902         policy->password_properties = centry_uint32(centry);
2903         policy->max_password_age = centry_nttime(centry);
2904         policy->min_password_age = centry_nttime(centry);
2905
2906         status = centry->status;
2907
2908         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2909                 domain->name, nt_errstr(status) ));
2910
2911         centry_free(centry);
2912         return status;
2913
2914 do_query:
2915         ZERO_STRUCTP(policy);
2916
2917         /* Return status value returned by seq number check */
2918
2919         if (!NT_STATUS_IS_OK(domain->last_status))
2920                 return domain->last_status;
2921
2922         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2923                 domain->name ));
2924
2925         status = domain->backend->password_policy(domain, mem_ctx, policy);
2926
2927         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2928                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2929                 if (!domain->internal && old_status) {
2930                         set_domain_offline(domain);
2931                 }
2932                 if (cache->tdb &&
2933                         !domain->internal &&
2934                         !domain->online &&
2935                         old_status) {
2936                         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2937                         if (centry) {
2938                                 goto do_fetch_cache;
2939                         }
2940                 }
2941         }
2942         /* and save it */
2943         refresh_sequence_number(domain, false);
2944         if (!NT_STATUS_IS_OK(status)) {
2945                 return status;
2946         }
2947         wcache_save_password_policy(domain, status, policy);
2948
2949         return status;
2950 }
2951
2952
2953 /* Invalidate cached user and group lists coherently */
2954
2955 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2956                        void *state)
2957 {
2958         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2959             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2960                 tdb_delete(the_tdb, kbuf);
2961
2962         return 0;
2963 }
2964
2965 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2966
2967 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2968                                 struct netr_SamInfo3 *info3)
2969 {
2970         DOM_SID sid;
2971         fstring key_str, sid_string;
2972         struct winbind_cache *cache;
2973
2974         /* dont clear cached U/SID and UG/SID entries when we want to logon
2975          * offline - gd */
2976
2977         if (lp_winbind_offline_logon()) {
2978                 return;
2979         }
2980
2981         if (!domain)
2982                 return;
2983
2984         cache = get_cache(domain);
2985
2986         if (!cache->tdb) {
2987                 return;
2988         }
2989
2990         sid_compose(&sid, info3->base.domain_sid, info3->base.rid);
2991
2992         /* Clear U/SID cache entry */
2993         fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2994         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2995         tdb_delete(cache->tdb, string_tdb_data(key_str));
2996
2997         /* Clear UG/SID cache entry */
2998         fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2999         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3000         tdb_delete(cache->tdb, string_tdb_data(key_str));
3001
3002         /* Samba/winbindd never needs this. */
3003         netsamlogon_clear_cached_user(info3);
3004 }
3005
3006 bool wcache_invalidate_cache(void)
3007 {
3008         struct winbindd_domain *domain;
3009
3010         for (domain = domain_list(); domain; domain = domain->next) {
3011                 struct winbind_cache *cache = get_cache(domain);
3012
3013                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3014                            "entries for %s\n", domain->name));
3015                 if (cache) {
3016                         if (cache->tdb) {
3017                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
3018                         } else {
3019                                 return false;
3020                         }
3021                 }
3022         }
3023         return true;
3024 }
3025
3026 bool wcache_invalidate_cache_noinit(void)
3027 {
3028         struct winbindd_domain *domain;
3029
3030         for (domain = domain_list(); domain; domain = domain->next) {
3031                 struct winbind_cache *cache;
3032
3033                 /* Skip uninitialized domains. */
3034                 if (!domain->initialized && !domain->internal) {
3035                         continue;
3036                 }
3037
3038                 cache = get_cache(domain);
3039
3040                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3041                            "entries for %s\n", domain->name));
3042                 if (cache) {
3043                         if (cache->tdb) {
3044                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
3045                         } else {
3046                                 return false;
3047                         }
3048                 }
3049         }
3050         return true;
3051 }
3052
3053 bool init_wcache(void)
3054 {
3055         if (wcache == NULL) {
3056                 wcache = SMB_XMALLOC_P(struct winbind_cache);
3057                 ZERO_STRUCTP(wcache);
3058         }
3059
3060         if (wcache->tdb != NULL)
3061                 return true;
3062
3063         /* when working offline we must not clear the cache on restart */
3064         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3065                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3066                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3067                                 O_RDWR|O_CREAT, 0600);
3068
3069         if (wcache->tdb == NULL) {
3070                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3071                 return false;
3072         }
3073
3074         return true;
3075 }
3076
3077 /************************************************************************
3078  This is called by the parent to initialize the cache file.
3079  We don't need sophisticated locking here as we know we're the
3080  only opener.
3081 ************************************************************************/
3082
3083 bool initialize_winbindd_cache(void)
3084 {
3085         bool cache_bad = true;
3086         uint32 vers;
3087
3088         if (!init_wcache()) {
3089                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3090                 return false;
3091         }
3092
3093         /* Check version number. */
3094         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3095                         vers == WINBINDD_CACHE_VERSION) {
3096                 cache_bad = false;
3097         }
3098
3099         if (cache_bad) {
3100                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3101                         "and re-creating with version number %d\n",
3102                         WINBINDD_CACHE_VERSION ));
3103
3104                 tdb_close(wcache->tdb);
3105                 wcache->tdb = NULL;
3106
3107                 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
3108                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3109                                 cache_path("winbindd_cache.tdb"),
3110                                 strerror(errno) ));
3111                         return false;
3112                 }
3113                 if (!init_wcache()) {
3114                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
3115                                         "init_wcache failed.\n"));
3116                         return false;
3117                 }
3118
3119                 /* Write the version. */
3120                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3121                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3122                                 tdb_errorstr(wcache->tdb) ));
3123                         return false;
3124                 }
3125         }
3126
3127         tdb_close(wcache->tdb);
3128         wcache->tdb = NULL;
3129         return true;
3130 }
3131
3132 void close_winbindd_cache(void)
3133 {
3134         if (!wcache) {
3135                 return;
3136         }
3137         if (wcache->tdb) {
3138                 tdb_close(wcache->tdb);
3139                 wcache->tdb = NULL;
3140         }
3141 }
3142
3143 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
3144                        char **domain_name, char **name,
3145                        enum lsa_SidType *type)
3146 {
3147         struct winbindd_domain *domain;
3148         NTSTATUS status;
3149
3150         domain = find_lookup_domain_from_sid(sid);
3151         if (domain == NULL) {
3152                 return false;
3153         }
3154         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3155                                     type);
3156         return NT_STATUS_IS_OK(status);
3157 }
3158
3159 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
3160                         const char *domain_name,
3161                         const char *name,
3162                         DOM_SID *sid,
3163                         enum lsa_SidType *type)
3164 {
3165         struct winbindd_domain *domain;
3166         NTSTATUS status;
3167         bool original_online_state;
3168
3169         domain = find_lookup_domain_from_name(domain_name);
3170         if (domain == NULL) {
3171                 return false;
3172         }
3173
3174         /* If we are doing a cached logon, temporarily set the domain
3175            offline so the cache won't expire the entry */
3176
3177         original_online_state = domain->online;
3178         domain->online = false;
3179         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3180         domain->online = original_online_state;
3181
3182         return NT_STATUS_IS_OK(status);
3183 }
3184
3185 void cache_name2sid(struct winbindd_domain *domain,
3186                     const char *domain_name, const char *name,
3187                     enum lsa_SidType type, const DOM_SID *sid)
3188 {
3189         refresh_sequence_number(domain, false);
3190         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3191                                 sid, type);
3192 }
3193
3194 /*
3195  * The original idea that this cache only contains centries has
3196  * been blurred - now other stuff gets put in here. Ensure we
3197  * ignore these things on cleanup.
3198  */
3199
3200 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3201                                TDB_DATA dbuf, void *state)
3202 {
3203         struct cache_entry *centry;
3204
3205         if (is_non_centry_key(kbuf)) {
3206                 return 0;
3207         }
3208
3209         centry = wcache_fetch_raw((char *)kbuf.dptr);
3210         if (!centry) {
3211                 return 0;
3212         }
3213
3214         if (!NT_STATUS_IS_OK(centry->status)) {
3215                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3216                 tdb_delete(the_tdb, kbuf);
3217         }
3218
3219         centry_free(centry);
3220         return 0;
3221 }
3222
3223 /* flush the cache */
3224 void wcache_flush_cache(void)
3225 {
3226         if (!wcache)
3227                 return;
3228         if (wcache->tdb) {
3229                 tdb_close(wcache->tdb);
3230                 wcache->tdb = NULL;
3231         }
3232         if (!winbindd_use_cache()) {
3233                 return;
3234         }
3235
3236         /* when working offline we must not clear the cache on restart */
3237         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3238                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3239                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3240                                 O_RDWR|O_CREAT, 0600);
3241
3242         if (!wcache->tdb) {
3243                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3244                 return;
3245         }
3246
3247         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3248
3249         DEBUG(10,("wcache_flush_cache success\n"));
3250 }
3251
3252 /* Count cached creds */
3253
3254 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3255                                     void *state)
3256 {
3257         int *cred_count = (int*)state;
3258
3259         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3260                 (*cred_count)++;
3261         }
3262         return 0;
3263 }
3264
3265 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3266 {
3267         struct winbind_cache *cache = get_cache(domain);
3268
3269         *count = 0;
3270
3271         if (!cache->tdb) {
3272                 return NT_STATUS_INTERNAL_DB_ERROR;
3273         }
3274
3275         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3276
3277         return NT_STATUS_OK;
3278 }
3279
3280 struct cred_list {
3281         struct cred_list *prev, *next;
3282         TDB_DATA key;
3283         fstring name;
3284         time_t created;
3285 };
3286 static struct cred_list *wcache_cred_list;
3287
3288 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3289                                     void *state)
3290 {
3291         struct cred_list *cred;
3292
3293         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3294
3295                 cred = SMB_MALLOC_P(struct cred_list);
3296                 if (cred == NULL) {
3297                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3298                         return -1;
3299                 }
3300
3301                 ZERO_STRUCTP(cred);
3302
3303                 /* save a copy of the key */
3304
3305                 fstrcpy(cred->name, (const char *)kbuf.dptr);
3306                 DLIST_ADD(wcache_cred_list, cred);
3307         }
3308
3309         return 0;
3310 }
3311
3312 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
3313 {
3314         struct winbind_cache *cache = get_cache(domain);
3315         NTSTATUS status;
3316         int ret;
3317         struct cred_list *cred, *oldest = NULL;
3318
3319         if (!cache->tdb) {
3320                 return NT_STATUS_INTERNAL_DB_ERROR;
3321         }
3322
3323         /* we possibly already have an entry */
3324         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3325
3326                 fstring key_str, tmp;
3327
3328                 DEBUG(11,("we already have an entry, deleting that\n"));
3329
3330                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3331
3332                 tdb_delete(cache->tdb, string_tdb_data(key_str));
3333
3334                 return NT_STATUS_OK;
3335         }
3336
3337         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3338         if (ret == 0) {
3339                 return NT_STATUS_OK;
3340         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3341                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3342         }
3343
3344         ZERO_STRUCTP(oldest);
3345
3346         for (cred = wcache_cred_list; cred; cred = cred->next) {
3347
3348                 TDB_DATA data;
3349                 time_t t;
3350
3351                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3352                 if (!data.dptr) {
3353                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3354                                 cred->name));
3355                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3356                         goto done;
3357                 }
3358
3359                 t = IVAL(data.dptr, 0);
3360                 SAFE_FREE(data.dptr);
3361
3362                 if (!oldest) {
3363                         oldest = SMB_MALLOC_P(struct cred_list);
3364                         if (oldest == NULL) {
3365                                 status = NT_STATUS_NO_MEMORY;
3366                                 goto done;
3367                         }
3368
3369                         fstrcpy(oldest->name, cred->name);
3370                         oldest->created = t;
3371                         continue;
3372                 }
3373
3374                 if (t < oldest->created) {
3375                         fstrcpy(oldest->name, cred->name);
3376                         oldest->created = t;
3377                 }
3378         }
3379
3380         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3381                 status = NT_STATUS_OK;
3382         } else {
3383                 status = NT_STATUS_UNSUCCESSFUL;
3384         }
3385 done:
3386         SAFE_FREE(wcache_cred_list);
3387         SAFE_FREE(oldest);
3388
3389         return status;
3390 }
3391
3392 /* Change the global online/offline state. */
3393 bool set_global_winbindd_state_offline(void)
3394 {
3395         TDB_DATA data;
3396
3397         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3398
3399         /* Only go offline if someone has created
3400            the key "WINBINDD_OFFLINE" in the cache tdb. */
3401
3402         if (wcache == NULL || wcache->tdb == NULL) {
3403                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3404                 return false;
3405         }
3406
3407         if (!lp_winbind_offline_logon()) {
3408                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3409                 return false;
3410         }
3411
3412         if (global_winbindd_offline_state) {
3413                 /* Already offline. */
3414                 return true;
3415         }
3416
3417         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3418
3419         if (!data.dptr || data.dsize != 4) {
3420                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3421                 SAFE_FREE(data.dptr);
3422                 return false;
3423         } else {
3424                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3425                 global_winbindd_offline_state = true;
3426                 SAFE_FREE(data.dptr);
3427                 return true;
3428         }
3429 }
3430
3431 void set_global_winbindd_state_online(void)
3432 {
3433         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3434
3435         if (!lp_winbind_offline_logon()) {
3436                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3437                 return;
3438         }
3439
3440         if (!global_winbindd_offline_state) {
3441                 /* Already online. */
3442                 return;
3443         }
3444         global_winbindd_offline_state = false;
3445
3446         if (!wcache->tdb) {
3447                 return;
3448         }
3449
3450         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3451         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3452 }
3453
3454 bool get_global_winbindd_state_offline(void)
3455 {
3456         return global_winbindd_offline_state;
3457 }
3458
3459 /***********************************************************************
3460  Validate functions for all possible cache tdb keys.
3461 ***********************************************************************/
3462
3463 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3464                                                   struct tdb_validation_status *state)
3465 {
3466         struct cache_entry *centry;
3467
3468         centry = SMB_XMALLOC_P(struct cache_entry);
3469         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3470         if (!centry->data) {
3471                 SAFE_FREE(centry);
3472                 return NULL;
3473         }
3474         centry->len = data.dsize;
3475         centry->ofs = 0;
3476
3477         if (centry->len < 8) {
3478                 /* huh? corrupt cache? */
3479                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3480                 centry_free(centry);
3481                 state->bad_entry = true;
3482                 state->success = false;
3483                 return NULL;
3484         }
3485
3486         centry->status = NT_STATUS(centry_uint32(centry));
3487         centry->sequence_number = centry_uint32(centry);
3488         return centry;
3489 }
3490
3491 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3492                            struct tdb_validation_status *state)
3493 {
3494         if (dbuf.dsize != 8) {
3495                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3496                                 keystr, (unsigned int)dbuf.dsize ));
3497                 state->bad_entry = true;
3498                 return 1;
3499         }
3500         return 0;
3501 }
3502
3503 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3504                        struct tdb_validation_status *state)
3505 {
3506         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3507         if (!centry) {
3508                 return 1;
3509         }
3510
3511         (void)centry_uint32(centry);
3512         if (NT_STATUS_IS_OK(centry->status)) {
3513                 DOM_SID sid;
3514                 (void)centry_sid(centry, &sid);
3515         }
3516
3517         centry_free(centry);
3518
3519         if (!(state->success)) {
3520                 return 1;
3521         }
3522         DEBUG(10,("validate_ns: %s ok\n", keystr));
3523         return 0;
3524 }
3525
3526 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3527                        struct tdb_validation_status *state)
3528 {
3529         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3530         if (!centry) {
3531                 return 1;
3532         }
3533
3534         if (NT_STATUS_IS_OK(centry->status)) {
3535                 (void)centry_uint32(centry);
3536                 (void)centry_string(centry, mem_ctx);
3537                 (void)centry_string(centry, mem_ctx);
3538         }
3539
3540         centry_free(centry);
3541
3542         if (!(state->success)) {
3543                 return 1;
3544         }
3545         DEBUG(10,("validate_sn: %s ok\n", keystr));
3546         return 0;
3547 }
3548
3549 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3550                       struct tdb_validation_status *state)
3551 {
3552         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3553         DOM_SID sid;
3554
3555         if (!centry) {
3556                 return 1;
3557         }
3558
3559         (void)centry_string(centry, mem_ctx);
3560         (void)centry_string(centry, mem_ctx);
3561         (void)centry_string(centry, mem_ctx);
3562         (void)centry_string(centry, mem_ctx);
3563         (void)centry_uint32(centry);
3564         (void)centry_sid(centry, &sid);
3565         (void)centry_sid(centry, &sid);
3566
3567         centry_free(centry);
3568
3569         if (!(state->success)) {
3570                 return 1;
3571         }
3572         DEBUG(10,("validate_u: %s ok\n", keystr));
3573         return 0;
3574 }
3575
3576 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3577                             struct tdb_validation_status *state)
3578 {
3579         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3580
3581         if (!centry) {
3582                 return 1;
3583         }
3584
3585         (void)centry_nttime(centry);
3586         (void)centry_nttime(centry);
3587         (void)centry_uint16(centry);
3588
3589         centry_free(centry);
3590
3591         if (!(state->success)) {
3592                 return 1;
3593         }
3594         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3595         return 0;
3596 }
3597
3598 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3599                             struct tdb_validation_status *state)
3600 {
3601         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3602
3603         if (!centry) {
3604                 return 1;
3605         }
3606
3607         (void)centry_uint16(centry);
3608         (void)centry_uint16(centry);
3609         (void)centry_uint32(centry);
3610         (void)centry_nttime(centry);
3611         (void)centry_nttime(centry);
3612
3613         centry_free(centry);
3614
3615         if (!(state->success)) {
3616                 return 1;
3617         }
3618         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3619         return 0;
3620 }
3621
3622 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3623                          struct tdb_validation_status *state)
3624 {
3625         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3626
3627         if (!centry) {
3628                 return 1;
3629         }
3630
3631         (void)centry_time(centry);
3632         (void)centry_hash16(centry, mem_ctx);
3633
3634         /* We only have 17 bytes more data in the salted cred case. */
3635         if (centry->len - centry->ofs == 17) {
3636                 (void)centry_hash16(centry, mem_ctx);
3637         }
3638
3639         centry_free(centry);
3640
3641         if (!(state->success)) {
3642                 return 1;
3643         }
3644         DEBUG(10,("validate_cred: %s ok\n", keystr));
3645         return 0;
3646 }
3647
3648 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3649                        struct tdb_validation_status *state)
3650 {
3651         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3652         int32 num_entries, i;
3653
3654         if (!centry) {
3655                 return 1;
3656         }
3657
3658         num_entries = (int32)centry_uint32(centry);
3659
3660         for (i=0; i< num_entries; i++) {
3661                 DOM_SID sid;
3662                 (void)centry_string(centry, mem_ctx);
3663                 (void)centry_string(centry, mem_ctx);
3664                 (void)centry_string(centry, mem_ctx);
3665                 (void)centry_string(centry, mem_ctx);
3666                 (void)centry_sid(centry, &sid);
3667                 (void)centry_sid(centry, &sid);
3668         }
3669
3670         centry_free(centry);
3671
3672         if (!(state->success)) {
3673                 return 1;
3674         }
3675         DEBUG(10,("validate_ul: %s ok\n", keystr));
3676         return 0;
3677 }
3678
3679 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3680                        struct tdb_validation_status *state)
3681 {
3682         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3683         int32 num_entries, i;
3684
3685         if (!centry) {
3686                 return 1;
3687         }
3688
3689         num_entries = centry_uint32(centry);
3690
3691         for (i=0; i< num_entries; i++) {
3692                 (void)centry_string(centry, mem_ctx);
3693                 (void)centry_string(centry, mem_ctx);
3694                 (void)centry_uint32(centry);
3695         }
3696
3697         centry_free(centry);
3698
3699         if (!(state->success)) {
3700                 return 1;
3701         }
3702         DEBUG(10,("validate_gl: %s ok\n", keystr));
3703         return 0;
3704 }
3705
3706 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3707                        struct tdb_validation_status *state)
3708 {
3709         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3710         int32 num_groups, i;
3711
3712         if (!centry) {
3713                 return 1;
3714         }
3715
3716         num_groups = centry_uint32(centry);
3717
3718         for (i=0; i< num_groups; i++) {
3719                 DOM_SID sid;
3720                 centry_sid(centry, &sid);
3721         }
3722
3723         centry_free(centry);
3724
3725         if (!(state->success)) {
3726                 return 1;
3727         }
3728         DEBUG(10,("validate_ug: %s ok\n", keystr));
3729         return 0;
3730 }
3731
3732 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3733                        struct tdb_validation_status *state)
3734 {
3735         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3736         int32 num_aliases, i;
3737
3738         if (!centry) {
3739                 return 1;
3740         }
3741
3742         num_aliases = centry_uint32(centry);
3743
3744         for (i=0; i < num_aliases; i++) {
3745                 (void)centry_uint32(centry);
3746         }
3747
3748         centry_free(centry);
3749
3750         if (!(state->success)) {
3751                 return 1;
3752         }
3753         DEBUG(10,("validate_ua: %s ok\n", keystr));
3754         return 0;
3755 }
3756
3757 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3758                        struct tdb_validation_status *state)
3759 {
3760         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3761         int32 num_names, i;
3762
3763         if (!centry) {
3764                 return 1;
3765         }
3766
3767         num_names = centry_uint32(centry);
3768
3769         for (i=0; i< num_names; i++) {
3770                 DOM_SID sid;
3771                 centry_sid(centry, &sid);
3772                 (void)centry_string(centry, mem_ctx);
3773                 (void)centry_uint32(centry);
3774         }
3775
3776         centry_free(centry);
3777
3778         if (!(state->success)) {
3779                 return 1;
3780         }
3781         DEBUG(10,("validate_gm: %s ok\n", keystr));
3782         return 0;
3783 }
3784
3785 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3786                        struct tdb_validation_status *state)
3787 {
3788         /* Can't say anything about this other than must be nonzero. */
3789         if (dbuf.dsize == 0) {
3790                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3791                                 keystr));
3792                 state->bad_entry = true;
3793                 state->success = false;
3794                 return 1;
3795         }
3796
3797         DEBUG(10,("validate_dr: %s ok\n", keystr));
3798         return 0;
3799 }
3800
3801 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3802                        struct tdb_validation_status *state)
3803 {
3804         /* Can't say anything about this other than must be nonzero. */
3805         if (dbuf.dsize == 0) {
3806                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3807                                 keystr));
3808                 state->bad_entry = true;
3809                 state->success = false;
3810                 return 1;
3811         }
3812
3813         DEBUG(10,("validate_de: %s ok\n", keystr));
3814         return 0;
3815 }
3816
3817 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3818                            TDB_DATA dbuf, struct tdb_validation_status *state)
3819 {
3820         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3821
3822         if (!centry) {
3823                 return 1;
3824         }
3825
3826         (void)centry_string(centry, mem_ctx);
3827         (void)centry_string(centry, mem_ctx);
3828         (void)centry_string(centry, mem_ctx);
3829         (void)centry_uint32(centry);
3830
3831         centry_free(centry);
3832
3833         if (!(state->success)) {
3834                 return 1;
3835         }
3836         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3837         return 0;
3838 }
3839
3840 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3841                            TDB_DATA dbuf,
3842                            struct tdb_validation_status *state)
3843 {
3844         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3845
3846         if (!centry) {
3847                 return 1;
3848         }
3849
3850         (void)centry_string( centry, mem_ctx );
3851
3852         centry_free(centry);
3853
3854         if (!(state->success)) {
3855                 return 1;
3856         }
3857         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3858         return 0;
3859 }
3860
3861 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3862                            TDB_DATA dbuf,
3863                            struct tdb_validation_status *state)
3864 {
3865         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3866
3867         if (!centry) {
3868                 return 1;
3869         }
3870
3871         (void)centry_string( centry, mem_ctx );
3872
3873         centry_free(centry);
3874
3875         if (!(state->success)) {
3876                 return 1;
3877         }
3878         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3879         return 0;
3880 }
3881
3882 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3883                                   TDB_DATA dbuf,
3884                                   struct tdb_validation_status *state)
3885 {
3886         if (dbuf.dsize == 0) {
3887                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3888                           "key %s (len ==0) ?\n", keystr));
3889                 state->bad_entry = true;
3890                 state->success = false;
3891                 return 1;
3892         }
3893
3894         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3895         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3896         return 0;
3897 }
3898
3899 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3900                             struct tdb_validation_status *state)
3901 {
3902         if (dbuf.dsize != 4) {
3903                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3904                                 keystr, (unsigned int)dbuf.dsize ));
3905                 state->bad_entry = true;
3906                 state->success = false;
3907                 return 1;
3908         }
3909         DEBUG(10,("validate_offline: %s ok\n", keystr));
3910         return 0;
3911 }
3912
3913 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3914                         struct tdb_validation_status *state)
3915 {
3916         /*
3917          * Ignore validation for now. The proper way to do this is with a
3918          * checksum. Just pure parsing does not really catch much.
3919          */
3920         return 0;
3921 }
3922
3923 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3924                                   struct tdb_validation_status *state)
3925 {
3926         if (dbuf.dsize != 4) {
3927                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3928                           "key %s (len %u != 4) ?\n",
3929                           keystr, (unsigned int)dbuf.dsize));
3930                 state->bad_entry = true;
3931                 state->success = false;
3932                 return 1;
3933         }
3934
3935         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3936         return 0;
3937 }
3938
3939 /***********************************************************************
3940  A list of all possible cache tdb keys with associated validation
3941  functions.
3942 ***********************************************************************/
3943
3944 struct key_val_struct {
3945         const char *keyname;
3946         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3947 } key_val[] = {
3948         {"SEQNUM/", validate_seqnum},
3949         {"NS/", validate_ns},
3950         {"SN/", validate_sn},
3951         {"U/", validate_u},
3952         {"LOC_POL/", validate_loc_pol},
3953         {"PWD_POL/", validate_pwd_pol},
3954         {"CRED/", validate_cred},
3955         {"UL/", validate_ul},
3956         {"GL/", validate_gl},
3957         {"UG/", validate_ug},
3958         {"UA", validate_ua},
3959         {"GM/", validate_gm},
3960         {"DR/", validate_dr},
3961         {"DE/", validate_de},
3962         {"NSS/PWINFO/", validate_pwinfo},
3963         {"TRUSTDOMCACHE/", validate_trustdomcache},
3964         {"NSS/NA/", validate_nss_na},
3965         {"NSS/AN/", validate_nss_an},
3966         {"WINBINDD_OFFLINE", validate_offline},
3967         {"NDR/", validate_ndr},
3968         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3969         {NULL, NULL}
3970 };
3971
3972 /***********************************************************************
3973  Function to look at every entry in the tdb and validate it as far as
3974  possible.
3975 ***********************************************************************/
3976
3977 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3978 {
3979         int i;
3980         unsigned int max_key_len = 1024;
3981         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3982
3983         /* Paranoia check. */
3984         if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3985                 max_key_len = 1024 * 1024;
3986         }
3987         if (kbuf.dsize > max_key_len) {
3988                 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3989                           "(%u) > (%u)\n\n",
3990                           (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3991                 return 1;
3992         }
3993
3994         for (i = 0; key_val[i].keyname; i++) {
3995                 size_t namelen = strlen(key_val[i].keyname);
3996                 if (kbuf.dsize >= namelen && (
3997                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3998                         TALLOC_CTX *mem_ctx;
3999                         char *keystr;
4000                         int ret;
4001
4002                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
4003                         if (!keystr) {
4004                                 return 1;
4005                         }
4006                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
4007                         keystr[kbuf.dsize] = '\0';
4008
4009                         mem_ctx = talloc_init("validate_ctx");
4010                         if (!mem_ctx) {
4011                                 SAFE_FREE(keystr);
4012                                 return 1;
4013                         }
4014
4015                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
4016                                                           v_state);
4017
4018                         SAFE_FREE(keystr);
4019                         talloc_destroy(mem_ctx);
4020                         return ret;
4021                 }
4022         }
4023
4024         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
4025         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
4026         DEBUG(0,("data :\n"));
4027         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4028         v_state->unknown_key = true;
4029         v_state->success = false;
4030         return 1; /* terminate. */
4031 }
4032
4033 static void validate_panic(const char *const why)
4034 {
4035         DEBUG(0,("validating cache: would panic %s\n", why ));
4036         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4037         exit(47);
4038 }
4039
4040 /***********************************************************************
4041  Try and validate every entry in the winbindd cache. If we fail here,
4042  delete the cache tdb and return non-zero.
4043 ***********************************************************************/
4044
4045 int winbindd_validate_cache(void)
4046 {
4047         int ret = -1;
4048         const char *tdb_path = cache_path("winbindd_cache.tdb");
4049         TDB_CONTEXT *tdb = NULL;
4050
4051         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4052         smb_panic_fn = validate_panic;
4053
4054
4055         tdb = tdb_open_log(tdb_path,
4056                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4057                            ( lp_winbind_offline_logon()
4058                              ? TDB_DEFAULT
4059                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4060                            O_RDWR|O_CREAT,
4061                            0600);
4062         if (!tdb) {
4063                 DEBUG(0, ("winbindd_validate_cache: "
4064                           "error opening/initializing tdb\n"));
4065                 goto done;
4066         }
4067         tdb_close(tdb);
4068
4069         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4070
4071         if (ret != 0) {
4072                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4073                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4074                 unlink(tdb_path);
4075         }
4076
4077 done:
4078         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4079         smb_panic_fn = smb_panic;
4080         return ret;
4081 }
4082
4083 /***********************************************************************
4084  Try and validate every entry in the winbindd cache.
4085 ***********************************************************************/
4086
4087 int winbindd_validate_cache_nobackup(void)
4088 {
4089         int ret = -1;
4090         const char *tdb_path = cache_path("winbindd_cache.tdb");
4091
4092         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4093         smb_panic_fn = validate_panic;
4094
4095
4096         if (wcache == NULL || wcache->tdb == NULL) {
4097                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4098         } else {
4099                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4100         }
4101
4102         if (ret != 0) {
4103                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4104                            "successful.\n"));
4105         }
4106
4107         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4108                    "function\n"));
4109         smb_panic_fn = smb_panic;
4110         return ret;
4111 }
4112
4113 bool winbindd_cache_validate_and_initialize(void)
4114 {
4115         close_winbindd_cache();
4116
4117         if (lp_winbind_offline_logon()) {
4118                 if (winbindd_validate_cache() < 0) {
4119                         DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4120                                   "could be restored.\n"));
4121                 }
4122         }
4123
4124         return initialize_winbindd_cache();
4125 }
4126
4127 /*********************************************************************
4128  ********************************************************************/
4129
4130 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4131                                        struct winbindd_tdc_domain **domains,
4132                                        size_t *num_domains )
4133 {
4134         struct winbindd_tdc_domain *list = NULL;
4135         size_t idx;
4136         int i;
4137         bool set_only = false;
4138
4139         /* don't allow duplicates */
4140
4141         idx = *num_domains;
4142         list = *domains;
4143
4144         for ( i=0; i< (*num_domains); i++ ) {
4145                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4146                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4147                                   new_dom->name));
4148                         idx = i;
4149                         set_only = true;
4150
4151                         break;
4152                 }
4153         }
4154
4155         if ( !set_only ) {
4156                 if ( !*domains ) {
4157                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
4158                         idx = 0;
4159                 } else {
4160                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
4161                                                      struct winbindd_tdc_domain,
4162                                                      (*num_domains)+1);
4163                         idx = *num_domains;
4164                 }
4165
4166                 ZERO_STRUCT( list[idx] );
4167         }
4168
4169         if ( !list )
4170                 return false;
4171
4172         list[idx].domain_name = talloc_strdup( list, new_dom->name );
4173         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4174
4175         if ( !is_null_sid( &new_dom->sid ) ) {
4176                 sid_copy( &list[idx].sid, &new_dom->sid );
4177         } else {
4178                 sid_copy(&list[idx].sid, &global_sid_NULL);
4179         }
4180
4181         if ( new_dom->domain_flags != 0x0 )
4182                 list[idx].trust_flags = new_dom->domain_flags;
4183
4184         if ( new_dom->domain_type != 0x0 )
4185                 list[idx].trust_type = new_dom->domain_type;
4186
4187         if ( new_dom->domain_trust_attribs != 0x0 )
4188                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4189
4190         if ( !set_only ) {
4191                 *domains = list;
4192                 *num_domains = idx + 1;
4193         }
4194
4195         return true;
4196 }
4197
4198 /*********************************************************************
4199  ********************************************************************/
4200
4201 static TDB_DATA make_tdc_key( const char *domain_name )
4202 {
4203         char *keystr = NULL;
4204         TDB_DATA key = { NULL, 0 };
4205
4206         if ( !domain_name ) {
4207                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4208                 return key;
4209         }
4210
4211         if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4212                 return key;
4213         }
4214         key = string_term_tdb_data(keystr);
4215
4216         return key;
4217 }
4218
4219 /*********************************************************************
4220  ********************************************************************/
4221
4222 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4223                              size_t num_domains,
4224                              unsigned char **buf )
4225 {
4226         unsigned char *buffer = NULL;
4227         int len = 0;
4228         int buflen = 0;
4229         int i = 0;
4230
4231         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4232                   (int)num_domains));
4233
4234         buflen = 0;
4235
4236  again:
4237         len = 0;
4238
4239         /* Store the number of array items first */
4240         len += tdb_pack( buffer+len, buflen-len, "d",
4241                          num_domains );
4242
4243         /* now pack each domain trust record */
4244         for ( i=0; i<num_domains; i++ ) {
4245
4246                 fstring tmp;
4247
4248                 if ( buflen > 0 ) {
4249                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4250                                   domains[i].domain_name,
4251                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4252                 }
4253
4254                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4255                                  domains[i].domain_name,
4256                                  domains[i].dns_name,
4257                                  sid_to_fstring(tmp, &domains[i].sid),
4258                                  domains[i].trust_flags,
4259                                  domains[i].trust_attribs,
4260                                  domains[i].trust_type );
4261         }
4262
4263         if ( buflen < len ) {
4264                 SAFE_FREE(buffer);
4265                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4266                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4267                         buflen = -1;
4268                         goto done;
4269                 }
4270                 buflen = len;
4271                 goto again;
4272         }
4273
4274         *buf = buffer;
4275
4276  done:
4277         return buflen;
4278 }
4279
4280 /*********************************************************************
4281  ********************************************************************/
4282
4283 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4284                                   struct winbindd_tdc_domain **domains )
4285 {
4286         fstring domain_name, dns_name, sid_string;
4287         uint32 type, attribs, flags;
4288         int num_domains;
4289         int len = 0;
4290         int i;
4291         struct winbindd_tdc_domain *list = NULL;
4292
4293         /* get the number of domains */
4294         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4295         if ( len == -1 ) {
4296                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4297                 return 0;
4298         }
4299
4300         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4301         if ( !list ) {
4302                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4303                 return 0;
4304         }
4305
4306         for ( i=0; i<num_domains; i++ ) {
4307                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4308                                    domain_name,
4309                                    dns_name,
4310                                    sid_string,
4311                                    &flags,
4312                                    &attribs,
4313                                    &type );
4314
4315                 if ( len == -1 ) {
4316                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4317                         TALLOC_FREE( list );
4318                         return 0;
4319                 }
4320
4321                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4322                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4323                           domain_name, dns_name, sid_string,
4324                           flags, attribs, type));
4325
4326                 list[i].domain_name = talloc_strdup( list, domain_name );
4327                 list[i].dns_name = talloc_strdup( list, dns_name );
4328                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4329                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4330                                   domain_name));
4331                 }
4332                 list[i].trust_flags = flags;
4333                 list[i].trust_attribs = attribs;
4334                 list[i].trust_type = type;
4335         }
4336
4337         *domains = list;
4338
4339         return num_domains;
4340 }
4341
4342 /*********************************************************************
4343  ********************************************************************/
4344
4345 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4346 {
4347         TDB_DATA key = make_tdc_key( lp_workgroup() );
4348         TDB_DATA data = { NULL, 0 };
4349         int ret;
4350
4351         if ( !key.dptr )
4352                 return false;
4353
4354         /* See if we were asked to delete the cache entry */
4355
4356         if ( !domains ) {
4357                 ret = tdb_delete( wcache->tdb, key );
4358                 goto done;
4359         }
4360
4361         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4362
4363         if ( !data.dptr ) {
4364                 ret = -1;
4365                 goto done;
4366         }
4367
4368         ret = tdb_store( wcache->tdb, key, data, 0 );
4369
4370  done:
4371         SAFE_FREE( data.dptr );
4372         SAFE_FREE( key.dptr );
4373
4374         return ( ret != -1 );
4375 }
4376
4377 /*********************************************************************
4378  ********************************************************************/
4379
4380 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4381 {
4382         TDB_DATA key = make_tdc_key( lp_workgroup() );
4383         TDB_DATA data = { NULL, 0 };
4384
4385         *domains = NULL;
4386         *num_domains = 0;
4387
4388         if ( !key.dptr )
4389                 return false;
4390
4391         data = tdb_fetch( wcache->tdb, key );
4392
4393         SAFE_FREE( key.dptr );
4394
4395         if ( !data.dptr )
4396                 return false;
4397
4398         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4399
4400         SAFE_FREE( data.dptr );
4401
4402         if ( !*domains )
4403                 return false;
4404
4405         return true;
4406 }
4407
4408 /*********************************************************************
4409  ********************************************************************/
4410
4411 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4412 {
4413         struct winbindd_tdc_domain *dom_list = NULL;
4414         size_t num_domains = 0;
4415         bool ret = false;
4416
4417         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4418                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4419                   domain->name, domain->alt_name,
4420                   sid_string_dbg(&domain->sid),
4421                   domain->domain_flags,
4422                   domain->domain_trust_attribs,
4423                   domain->domain_type));
4424
4425         if ( !init_wcache() ) {
4426                 return false;
4427         }
4428
4429         /* fetch the list */
4430
4431         wcache_tdc_fetch_list( &dom_list, &num_domains );
4432
4433         /* add the new domain */
4434
4435         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4436                 goto done;
4437         }
4438
4439         /* pack the domain */
4440
4441         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4442                 goto done;
4443         }
4444
4445         /* Success */
4446
4447         ret = true;
4448  done:
4449         TALLOC_FREE( dom_list );
4450
4451         return ret;
4452 }
4453
4454 /*********************************************************************
4455  ********************************************************************/
4456
4457 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4458 {
4459         struct winbindd_tdc_domain *dom_list = NULL;
4460         size_t num_domains = 0;
4461         int i;
4462         struct winbindd_tdc_domain *d = NULL;
4463
4464         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4465
4466         if ( !init_wcache() ) {
4467                 return false;
4468         }
4469
4470         /* fetch the list */
4471
4472         wcache_tdc_fetch_list( &dom_list, &num_domains );
4473
4474         for ( i=0; i<num_domains; i++ ) {
4475                 if ( strequal(name, dom_list[i].domain_name) ||
4476                      strequal(name, dom_list[i].dns_name) )
4477                 {
4478                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4479                                   name));
4480
4481                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4482                         if ( !d )
4483                                 break;
4484
4485                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4486                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4487                         sid_copy( &d->sid, &dom_list[i].sid );
4488                         d->trust_flags   = dom_list[i].trust_flags;
4489                         d->trust_type    = dom_list[i].trust_type;
4490                         d->trust_attribs = dom_list[i].trust_attribs;
4491
4492                         break;
4493                 }
4494         }
4495
4496         TALLOC_FREE( dom_list );
4497
4498         return d;
4499 }
4500
4501
4502 /*********************************************************************
4503  ********************************************************************/
4504
4505 void wcache_tdc_clear( void )
4506 {
4507         if ( !init_wcache() )
4508                 return;
4509
4510         wcache_tdc_store_list( NULL, 0 );
4511
4512         return;
4513 }
4514
4515
4516 /*********************************************************************
4517  ********************************************************************/
4518
4519 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4520                                     NTSTATUS status,
4521                                     const DOM_SID *user_sid,
4522                                     const char *homedir,
4523                                     const char *shell,
4524                                     const char *gecos,
4525                                     uint32 gid)
4526 {
4527         struct cache_entry *centry;
4528         fstring tmp;
4529
4530         if ( (centry = centry_start(domain, status)) == NULL )
4531                 return;
4532
4533         centry_put_string( centry, homedir );
4534         centry_put_string( centry, shell );
4535         centry_put_string( centry, gecos );
4536         centry_put_uint32( centry, gid );
4537
4538         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4539
4540         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4541
4542         centry_free(centry);
4543 }
4544
4545 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4546                               const DOM_SID *user_sid,
4547                               TALLOC_CTX *ctx,
4548                               ADS_STRUCT *ads, LDAPMessage *msg,
4549                               const char **homedir, const char **shell,
4550                               const char **gecos, gid_t *p_gid)
4551 {
4552         struct winbind_cache *cache = get_cache(domain);
4553         struct cache_entry *centry = NULL;
4554         NTSTATUS nt_status;
4555         fstring tmp;
4556
4557         if (!cache->tdb)
4558                 goto do_query;
4559
4560         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4561                               sid_to_fstring(tmp, user_sid));
4562
4563         if (!centry)
4564                 goto do_query;
4565
4566         *homedir = centry_string( centry, ctx );
4567         *shell   = centry_string( centry, ctx );
4568         *gecos   = centry_string( centry, ctx );
4569         *p_gid   = centry_uint32( centry );
4570
4571         centry_free(centry);
4572
4573         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4574                   sid_string_dbg(user_sid)));
4575
4576         return NT_STATUS_OK;
4577
4578 do_query:
4579
4580         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4581                                   homedir, shell, gecos, p_gid );
4582
4583         DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4584
4585         if ( NT_STATUS_IS_OK(nt_status) ) {
4586                 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4587                 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4588                 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4589                 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4590
4591                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4592                                          *homedir, *shell, *gecos, *p_gid );
4593         }
4594
4595         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4596                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4597                          domain->name ));
4598                 set_domain_offline( domain );
4599         }
4600
4601         return nt_status;
4602 }
4603
4604
4605 /* the cache backend methods are exposed via this structure */
4606 struct winbindd_methods cache_methods = {
4607         true,
4608         query_user_list,
4609         enum_dom_groups,
4610         enum_local_groups,
4611         name_to_sid,
4612         sid_to_name,
4613         rids_to_names,
4614         query_user,
4615         lookup_usergroups,
4616         lookup_useraliases,
4617         lookup_groupmem,
4618         sequence_number,
4619         lockout_policy,
4620         password_policy,
4621         trusted_domains
4622 };
4623
4624 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4625                            uint32_t opnum, const DATA_BLOB *req,
4626                            TDB_DATA *pkey)
4627 {
4628         char *key;
4629         size_t keylen;
4630
4631         key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4632         if (key == NULL) {
4633                 return false;
4634         }
4635         keylen = talloc_get_size(key) - 1;
4636
4637         key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4638         if (key == NULL) {
4639                 return false;
4640         }
4641         memcpy(key + keylen, req->data, req->length);
4642
4643         pkey->dptr = (uint8_t *)key;
4644         pkey->dsize = talloc_get_size(key);
4645         return true;
4646 }
4647
4648 static bool wcache_opnum_cacheable(uint32_t opnum)
4649 {
4650         switch (opnum) {
4651         case NDR_WBINT_PING:
4652         case NDR_WBINT_QUERYSEQUENCENUMBER:
4653         case NDR_WBINT_ALLOCATEUID:
4654         case NDR_WBINT_ALLOCATEGID:
4655         case NDR_WBINT_CHECKMACHINEACCOUNT:
4656         case NDR_WBINT_CHANGEMACHINEACCOUNT:
4657         case NDR_WBINT_PINGDC:
4658                 return false;
4659         }
4660         return true;
4661 }
4662
4663 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4664                       uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4665 {
4666         TDB_DATA key, data;
4667         bool ret = false;
4668
4669         if (!wcache_opnum_cacheable(opnum)) {
4670                 return false;
4671         }
4672
4673         if (wcache->tdb == NULL) {
4674                 return false;
4675         }
4676
4677         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4678                 return false;
4679         }
4680         data = tdb_fetch(wcache->tdb, key);
4681         TALLOC_FREE(key.dptr);
4682
4683         if (data.dptr == NULL) {
4684                 return false;
4685         }
4686         if (data.dsize < 4) {
4687                 goto fail;
4688         }
4689
4690         if (!is_domain_offline(domain)) {
4691                 uint32_t entry_seqnum, dom_seqnum, last_check;
4692
4693                 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4694                                          &last_check)) {
4695                         goto fail;
4696                 }
4697                 entry_seqnum = IVAL(data.dptr, 0);
4698                 if (entry_seqnum != dom_seqnum) {
4699                         DEBUG(10, ("Entry has wrong sequence number: %d\n",
4700                                    (int)entry_seqnum));
4701                         goto fail;
4702                 }
4703         }
4704
4705         resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4706                                               data.dsize - 4);
4707         if (resp->data == NULL) {
4708                 DEBUG(10, ("talloc failed\n"));
4709                 goto fail;
4710         }
4711         resp->length = data.dsize - 4;
4712
4713         ret = true;
4714 fail:
4715         SAFE_FREE(data.dptr);
4716         return ret;
4717 }
4718
4719 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4720                       const DATA_BLOB *req, const DATA_BLOB *resp)
4721 {
4722         TDB_DATA key, data;
4723         uint32_t dom_seqnum, last_check;
4724
4725         if (!wcache_opnum_cacheable(opnum)) {
4726                 return;
4727         }
4728
4729         if (wcache->tdb == NULL) {
4730                 return;
4731         }
4732
4733         if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4734                 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4735                            domain->name));
4736                 return;
4737         }
4738
4739         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4740                 return;
4741         }
4742
4743         data.dsize = resp->length + 4;
4744         data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4745         if (data.dptr == NULL) {
4746                 goto done;
4747         }
4748
4749         SIVAL(data.dptr, 0, dom_seqnum);
4750         memcpy(data.dptr+4, resp->data, resp->length);
4751
4752         tdb_store(wcache->tdb, key, data, 0);
4753
4754 done:
4755         TALLOC_FREE(key.dptr);
4756         return;
4757 }