source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "tdb_validate.h"
  29 #include "../libcli/auth/libcli_auth.h"
  30 #include "../librpc/gen_ndr/ndr_wbint.h"
  31
  32 #undef DBGC_CLASS
  33 #define DBGC_CLASS DBGC_WINBIND
  34
  35 #define WINBINDD_CACHE_VERSION 1
  36 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  37
  38 extern struct winbindd_methods reconnect_methods;
  39 #ifdef HAVE_ADS
  40 extern struct winbindd_methods ads_methods;
  41 #endif
  42 extern struct winbindd_methods builtin_passdb_methods;
  43
  44 /*
  45  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  46  * Here are the list of entry types that are *not* stored
  47  * as form struct cache_entry in the cache.
  48  */
  49
  50 static const char *non_centry_keys[] = {
  51         "SEQNUM/",
  52         "DR/",
  53         "DE/",
  54         "WINBINDD_OFFLINE",
  55         WINBINDD_CACHE_VERSION_KEYSTR,
  56         NULL
  57 };
  58
  59 /************************************************************************
  60  Is this key a non-centry type ?
  61 ************************************************************************/
  62
  63 static bool is_non_centry_key(TDB_DATA kbuf)
  64 {
  65         int i;
  66
  67         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  68                 return false;
  69         }
  70         for (i = 0; non_centry_keys[i] != NULL; i++) {
  71                 size_t namelen = strlen(non_centry_keys[i]);
  72                 if (kbuf.dsize < namelen) {
  73                         continue;
  74                 }
  75                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  76                         return true;
  77                 }
  78         }
  79         return false;
  80 }
  81
  82 /* Global online/offline state - False when online. winbindd starts up online
  83    and sets this to true if the first query fails and there's an entry in
  84    the cache tdb telling us to stay offline. */
  85
  86 static bool global_winbindd_offline_state;
  87
  88 struct winbind_cache {
  89         TDB_CONTEXT *tdb;
  90 };
  91
  92 struct cache_entry {
  93         NTSTATUS status;
  94         uint32 sequence_number;
  95         uint8 *data;
  96         uint32 len, ofs;
  97 };
  98
  99 void (*smb_panic_fn)(const char *const why) = smb_panic;
 100
 101 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
 102
 103 static struct winbind_cache *wcache;
 104
 105 void winbindd_check_cache_size(time_t t)
 106 {
 107         static time_t last_check_time;
 108         struct stat st;
 109
 110         if (last_check_time == (time_t)0)
 111                 last_check_time = t;
 112
 113         if (t - last_check_time < 60 && t - last_check_time > 0)
 114                 return;
 115
 116         if (wcache == NULL || wcache->tdb == NULL) {
 117                 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
 118                 return;
 119         }
 120
 121         if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
 122                 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
 123                 return;
 124         }
 125
 126         if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
 127                 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
 128                         (unsigned long)st.st_size,
 129                         (unsigned long)WINBINDD_MAX_CACHE_SIZE));
 130                 wcache_flush_cache();
 131         }
 132 }
 133
 134 /* get the winbind_cache structure */
 135 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 136 {
 137         struct winbind_cache *ret = wcache;
 138
 139         /* We have to know what type of domain we are dealing with first. */
 140
 141         if (domain->internal) {
 142                 domain->backend = &builtin_passdb_methods;
 143                 domain->initialized = True;
 144         }
 145         if ( !domain->initialized ) {
 146                 init_dc_connection( domain );
 147         }
 148
 149         /*
 150            OK.  listen up becasue I'm only going to say this once.
 151            We have the following scenarios to consider
 152            (a) trusted AD domains on a Samba DC,
 153            (b) trusted AD domains and we are joined to a non-kerberos domain
 154            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 155
 156            For (a) we can always contact the trusted domain using krb5
 157            since we have the domain trust account password
 158
 159            For (b) we can only use RPC since we have no way of
 160            getting a krb5 ticket in our own domain
 161
 162            For (c) we can always use krb5 since we have a kerberos trust
 163
 164            --jerry
 165          */
 166
 167         if (!domain->backend) {
 168 #ifdef HAVE_ADS
 169                 struct winbindd_domain *our_domain = domain;
 170
 171                 /* find our domain first so we can figure out if we
 172                    are joined to a kerberized domain */
 173
 174                 if ( !domain->primary )
 175                         our_domain = find_our_domain();
 176
 177                 if ((our_domain->active_directory || IS_DC)
 178                     && domain->active_directory
 179                     && !lp_winbind_rpc_only()) {
 180                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 181                         domain->backend = &ads_methods;
 182                 } else {
 183 #endif  /* HAVE_ADS */
 184                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 185                         domain->backend = &reconnect_methods;
 186 #ifdef HAVE_ADS
 187                 }
 188 #endif  /* HAVE_ADS */
 189         }
 190
 191         if (ret)
 192                 return ret;
 193
 194         ret = SMB_XMALLOC_P(struct winbind_cache);
 195         ZERO_STRUCTP(ret);
 196
 197         wcache = ret;
 198         wcache_flush_cache();
 199
 200         return ret;
 201 }
 202
 203 /*
 204   free a centry structure
 205 */
 206 static void centry_free(struct cache_entry *centry)
 207 {
 208         if (!centry)
 209                 return;
 210         SAFE_FREE(centry->data);
 211         free(centry);
 212 }
 213
 214 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 215 {
 216         if (centry->len - centry->ofs < nbytes) {
 217                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 218                          (unsigned int)nbytes,
 219                          centry->len - centry->ofs));
 220                 return false;
 221         }
 222         return true;
 223 }
 224
 225 /*
 226   pull a uint32 from a cache entry
 227 */
 228 static uint32 centry_uint32(struct cache_entry *centry)
 229 {
 230         uint32 ret;
 231
 232         if (!centry_check_bytes(centry, 4)) {
 233                 smb_panic_fn("centry_uint32");
 234         }
 235         ret = IVAL(centry->data, centry->ofs);
 236         centry->ofs += 4;
 237         return ret;
 238 }
 239
 240 /*
 241   pull a uint16 from a cache entry
 242 */
 243 static uint16 centry_uint16(struct cache_entry *centry)
 244 {
 245         uint16 ret;
 246         if (!centry_check_bytes(centry, 2)) {
 247                 smb_panic_fn("centry_uint16");
 248         }
 249         ret = CVAL(centry->data, centry->ofs);
 250         centry->ofs += 2;
 251         return ret;
 252 }
 253
 254 /*
 255   pull a uint8 from a cache entry
 256 */
 257 static uint8 centry_uint8(struct cache_entry *centry)
 258 {
 259         uint8 ret;
 260         if (!centry_check_bytes(centry, 1)) {
 261                 smb_panic_fn("centry_uint8");
 262         }
 263         ret = CVAL(centry->data, centry->ofs);
 264         centry->ofs += 1;
 265         return ret;
 266 }
 267
 268 /*
 269   pull a NTTIME from a cache entry
 270 */
 271 static NTTIME centry_nttime(struct cache_entry *centry)
 272 {
 273         NTTIME ret;
 274         if (!centry_check_bytes(centry, 8)) {
 275                 smb_panic_fn("centry_nttime");
 276         }
 277         ret = IVAL(centry->data, centry->ofs);
 278         centry->ofs += 4;
 279         ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
 280         centry->ofs += 4;
 281         return ret;
 282 }
 283
 284 /*
 285   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 286 */
 287 static time_t centry_time(struct cache_entry *centry)
 288 {
 289         return (time_t)centry_nttime(centry);
 290 }
 291
 292 /* pull a string from a cache entry, using the supplied
 293    talloc context
 294 */
 295 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 296 {
 297         uint32 len;
 298         char *ret;
 299
 300         len = centry_uint8(centry);
 301
 302         if (len == 0xFF) {
 303                 /* a deliberate NULL string */
 304                 return NULL;
 305         }
 306
 307         if (!centry_check_bytes(centry, (size_t)len)) {
 308                 smb_panic_fn("centry_string");
 309         }
 310
 311         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 312         if (!ret) {
 313                 smb_panic_fn("centry_string out of memory\n");
 314         }
 315         memcpy(ret,centry->data + centry->ofs, len);
 316         ret[len] = 0;
 317         centry->ofs += len;
 318         return ret;
 319 }
 320
 321 /* pull a hash16 from a cache entry, using the supplied
 322    talloc context
 323 */
 324 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 325 {
 326         uint32 len;
 327         char *ret;
 328
 329         len = centry_uint8(centry);
 330
 331         if (len != 16) {
 332                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 333                         len ));
 334                 return NULL;
 335         }
 336
 337         if (!centry_check_bytes(centry, 16)) {
 338                 return NULL;
 339         }
 340
 341         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 342         if (!ret) {
 343                 smb_panic_fn("centry_hash out of memory\n");
 344         }
 345         memcpy(ret,centry->data + centry->ofs, 16);
 346         centry->ofs += 16;
 347         return ret;
 348 }
 349
 350 /* pull a sid from a cache entry, using the supplied
 351    talloc context
 352 */
 353 static bool centry_sid(struct cache_entry *centry, struct dom_sid *sid)
 354 {
 355         char *sid_string;
 356         bool ret;
 357
 358         sid_string = centry_string(centry, talloc_tos());
 359         if (sid_string == NULL) {
 360                 return false;
 361         }
 362         ret = string_to_sid(sid, sid_string);
 363         TALLOC_FREE(sid_string);
 364         return ret;
 365 }
 366
 367
 368 /*
 369   pull a NTSTATUS from a cache entry
 370 */
 371 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 372 {
 373         NTSTATUS status;
 374
 375         status = NT_STATUS(centry_uint32(centry));
 376         return status;
 377 }
 378
 379
 380 /* the server is considered down if it can't give us a sequence number */
 381 static bool wcache_server_down(struct winbindd_domain *domain)
 382 {
 383         bool ret;
 384
 385         if (!wcache->tdb)
 386                 return false;
 387
 388         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 389
 390         if (ret)
 391                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 392                         domain->name ));
 393         return ret;
 394 }
 395
 396 static bool wcache_fetch_seqnum(const char *domain_name, uint32_t *seqnum,
 397                                 uint32_t *last_seq_check)
 398 {
 399         char *key;
 400         TDB_DATA data;
 401
 402         if (wcache->tdb == NULL) {
 403                 DEBUG(10,("wcache_fetch_seqnum: tdb == NULL\n"));
 404                 return false;
 405         }
 406
 407         key = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 408         if (key == NULL) {
 409                 DEBUG(10, ("talloc failed\n"));
 410                 return false;
 411         }
 412
 413         data = tdb_fetch_bystring(wcache->tdb, key);
 414         TALLOC_FREE(key);
 415
 416         if (data.dptr == NULL) {
 417                 DEBUG(10, ("wcache_fetch_seqnum: %s not found\n",
 418                            domain_name));
 419                 return false;
 420         }
 421         if (data.dsize != 8) {
 422                 DEBUG(10, ("wcache_fetch_seqnum: invalid data size %d\n",
 423                            (int)data.dsize));
 424                 SAFE_FREE(data.dptr);
 425                 return false;
 426         }
 427
 428         *seqnum = IVAL(data.dptr, 0);
 429         *last_seq_check = IVAL(data.dptr, 4);
 430         SAFE_FREE(data.dptr);
 431
 432         return true;
 433 }
 434
 435 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 436 {
 437         uint32 last_check, time_diff;
 438
 439         if (!wcache_fetch_seqnum(domain->name, &domain->sequence_number,
 440                                  &last_check)) {
 441                 return NT_STATUS_UNSUCCESSFUL;
 442         }
 443         domain->last_seq_check = last_check;
 444
 445         /* have we expired? */
 446
 447         time_diff = now - domain->last_seq_check;
 448         if ( time_diff > lp_winbind_cache_time() ) {
 449                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 450                         domain->name, domain->sequence_number,
 451                         (uint32)domain->last_seq_check));
 452                 return NT_STATUS_UNSUCCESSFUL;
 453         }
 454
 455         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 456                 domain->name, domain->sequence_number,
 457                 (uint32)domain->last_seq_check));
 458
 459         return NT_STATUS_OK;
 460 }
 461
 462 bool wcache_store_seqnum(const char *domain_name, uint32_t seqnum,
 463                          time_t last_seq_check)
 464 {
 465         char *key_str;
 466         uint8_t buf[8];
 467         int ret;
 468
 469         if (wcache->tdb == NULL) {
 470                 DEBUG(10, ("wcache_store_seqnum: wcache->tdb == NULL\n"));
 471                 return false;
 472         }
 473
 474         key_str = talloc_asprintf(talloc_tos(), "SEQNUM/%s", domain_name);
 475         if (key_str == NULL) {
 476                 DEBUG(10, ("talloc_asprintf failed\n"));
 477                 return false;
 478         }
 479
 480         SIVAL(buf, 0, seqnum);
 481         SIVAL(buf, 4, last_seq_check);
 482
 483         ret = tdb_store_bystring(wcache->tdb, key_str,
 484                                  make_tdb_data(buf, sizeof(buf)), TDB_REPLACE);
 485         TALLOC_FREE(key_str);
 486         if (ret == -1) {
 487                 DEBUG(10, ("tdb_store_bystring failed: %s\n",
 488                            tdb_errorstr(wcache->tdb)));
 489                 TALLOC_FREE(key_str);
 490                 return false;
 491         }
 492
 493         DEBUG(10, ("wcache_store_seqnum: success [%s][%u @ %u]\n",
 494                    domain_name, seqnum, (unsigned)last_seq_check));
 495
 496         return true;
 497 }
 498
 499 static bool store_cache_seqnum( struct winbindd_domain *domain )
 500 {
 501         return wcache_store_seqnum(domain->name, domain->sequence_number,
 502                                    domain->last_seq_check);
 503 }
 504
 505 /*
 506   refresh the domain sequence number. If force is true
 507   then always refresh it, no matter how recently we fetched it
 508 */
 509
 510 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 511 {
 512         NTSTATUS status;
 513         unsigned time_diff;
 514         time_t t = time(NULL);
 515         unsigned cache_time = lp_winbind_cache_time();
 516
 517         if (is_domain_offline(domain)) {
 518                 return;
 519         }
 520
 521         get_cache( domain );
 522
 523 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 524         /* trying to reconnect is expensive, don't do it too often */
 525         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 526                 cache_time *= 8;
 527         }
 528 #endif
 529
 530         time_diff = t - domain->last_seq_check;
 531
 532         /* see if we have to refetch the domain sequence number */
 533         if (!force && (time_diff < cache_time) &&
 534                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 535                         NT_STATUS_IS_OK(domain->last_status)) {
 536                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 537                 goto done;
 538         }
 539
 540         /* try to get the sequence number from the tdb cache first */
 541         /* this will update the timestamp as well */
 542
 543         status = fetch_cache_seqnum( domain, t );
 544         if (NT_STATUS_IS_OK(status) &&
 545                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 546                         NT_STATUS_IS_OK(domain->last_status)) {
 547                 goto done;
 548         }
 549
 550         /* important! make sure that we know if this is a native
 551            mode domain or not.  And that we can contact it. */
 552
 553         if ( winbindd_can_contact_domain( domain ) ) {
 554                 status = domain->backend->sequence_number(domain,
 555                                                           &domain->sequence_number);
 556         } else {
 557                 /* just use the current time */
 558                 status = NT_STATUS_OK;
 559                 domain->sequence_number = time(NULL);
 560         }
 561
 562
 563         /* the above call could have set our domain->backend to NULL when
 564          * coming from offline to online mode, make sure to reinitialize the
 565          * backend - Guenther */
 566         get_cache( domain );
 567
 568         if (!NT_STATUS_IS_OK(status)) {
 569                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 570                 domain->sequence_number = DOM_SEQUENCE_NONE;
 571         }
 572
 573         domain->last_status = status;
 574         domain->last_seq_check = time(NULL);
 575
 576         /* save the new sequence number in the cache */
 577         store_cache_seqnum( domain );
 578
 579 done:
 580         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 581                    domain->name, domain->sequence_number));
 582
 583         return;
 584 }
 585
 586 /*
 587   decide if a cache entry has expired
 588 */
 589 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 590 {
 591         /* If we've been told to be offline - stay in that state... */
 592         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 593                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 594                         keystr, domain->name ));
 595                 return false;
 596         }
 597
 598         /* when the domain is offline return the cached entry.
 599          * This deals with transient offline states... */
 600
 601         if (!domain->online) {
 602                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 603                         keystr, domain->name ));
 604                 return false;
 605         }
 606
 607         /* if the server is OK and our cache entry came from when it was down then
 608            the entry is invalid */
 609         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 610             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 611                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 612                         keystr, domain->name ));
 613                 return true;
 614         }
 615
 616         /* if the server is down or the cache entry is not older than the
 617            current sequence number then it is OK */
 618         if (wcache_server_down(domain) ||
 619             centry->sequence_number == domain->sequence_number) {
 620                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 621                         keystr, domain->name ));
 622                 return false;
 623         }
 624
 625         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 626                 keystr, domain->name ));
 627
 628         /* it's expired */
 629         return true;
 630 }
 631
 632 static struct cache_entry *wcache_fetch_raw(char *kstr)
 633 {
 634         TDB_DATA data;
 635         struct cache_entry *centry;
 636         TDB_DATA key;
 637
 638         key = string_tdb_data(kstr);
 639         data = tdb_fetch(wcache->tdb, key);
 640         if (!data.dptr) {
 641                 /* a cache miss */
 642                 return NULL;
 643         }
 644
 645         centry = SMB_XMALLOC_P(struct cache_entry);
 646         centry->data = (unsigned char *)data.dptr;
 647         centry->len = data.dsize;
 648         centry->ofs = 0;
 649
 650         if (centry->len < 8) {
 651                 /* huh? corrupt cache? */
 652                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
 653                 centry_free(centry);
 654                 return NULL;
 655         }
 656
 657         centry->status = centry_ntstatus(centry);
 658         centry->sequence_number = centry_uint32(centry);
 659
 660         return centry;
 661 }
 662
 663 /*
 664   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 665   number and return status
 666 */
 667 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 668                                         struct winbindd_domain *domain,
 669                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 670 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 671                                         struct winbindd_domain *domain,
 672                                         const char *format, ...)
 673 {
 674         va_list ap;
 675         char *kstr;
 676         struct cache_entry *centry;
 677
 678         if (!winbindd_use_cache()) {
 679                 return NULL;
 680         }
 681
 682         refresh_sequence_number(domain, false);
 683
 684         va_start(ap, format);
 685         smb_xvasprintf(&kstr, format, ap);
 686         va_end(ap);
 687
 688         centry = wcache_fetch_raw(kstr);
 689         if (centry == NULL) {
 690                 free(kstr);
 691                 return NULL;
 692         }
 693
 694         if (centry_expired(domain, kstr, centry)) {
 695
 696                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 697                          kstr, domain->name ));
 698
 699                 centry_free(centry);
 700                 free(kstr);
 701                 return NULL;
 702         }
 703
 704         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 705                  kstr, domain->name ));
 706
 707         free(kstr);
 708         return centry;
 709 }
 710
 711 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 712 static void wcache_delete(const char *format, ...)
 713 {
 714         va_list ap;
 715         char *kstr;
 716         TDB_DATA key;
 717
 718         va_start(ap, format);
 719         smb_xvasprintf(&kstr, format, ap);
 720         va_end(ap);
 721
 722         key = string_tdb_data(kstr);
 723
 724         tdb_delete(wcache->tdb, key);
 725         free(kstr);
 726 }
 727
 728 /*
 729   make sure we have at least len bytes available in a centry
 730 */
 731 static void centry_expand(struct cache_entry *centry, uint32 len)
 732 {
 733         if (centry->len - centry->ofs >= len)
 734                 return;
 735         centry->len *= 2;
 736         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 737                                          centry->len);
 738         if (!centry->data) {
 739                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 740                 smb_panic_fn("out of memory in centry_expand");
 741         }
 742 }
 743
 744 /*
 745   push a uint32 into a centry
 746 */
 747 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 748 {
 749         centry_expand(centry, 4);
 750         SIVAL(centry->data, centry->ofs, v);
 751         centry->ofs += 4;
 752 }
 753
 754 /*
 755   push a uint16 into a centry
 756 */
 757 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 758 {
 759         centry_expand(centry, 2);
 760         SIVAL(centry->data, centry->ofs, v);
 761         centry->ofs += 2;
 762 }
 763
 764 /*
 765   push a uint8 into a centry
 766 */
 767 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 768 {
 769         centry_expand(centry, 1);
 770         SCVAL(centry->data, centry->ofs, v);
 771         centry->ofs += 1;
 772 }
 773
 774 /*
 775    push a string into a centry
 776  */
 777 static void centry_put_string(struct cache_entry *centry, const char *s)
 778 {
 779         int len;
 780
 781         if (!s) {
 782                 /* null strings are marked as len 0xFFFF */
 783                 centry_put_uint8(centry, 0xFF);
 784                 return;
 785         }
 786
 787         len = strlen(s);
 788         /* can't handle more than 254 char strings. Truncating is probably best */
 789         if (len > 254) {
 790                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 791                 len = 254;
 792         }
 793         centry_put_uint8(centry, len);
 794         centry_expand(centry, len);
 795         memcpy(centry->data + centry->ofs, s, len);
 796         centry->ofs += len;
 797 }
 798
 799 /*
 800    push a 16 byte hash into a centry - treat as 16 byte string.
 801  */
 802 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 803 {
 804         centry_put_uint8(centry, 16);
 805         centry_expand(centry, 16);
 806         memcpy(centry->data + centry->ofs, val, 16);
 807         centry->ofs += 16;
 808 }
 809
 810 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
 811 {
 812         fstring sid_string;
 813         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 814 }
 815
 816
 817 /*
 818   put NTSTATUS into a centry
 819 */
 820 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 821 {
 822         uint32 status_value = NT_STATUS_V(status);
 823         centry_put_uint32(centry, status_value);
 824 }
 825
 826
 827 /*
 828   push a NTTIME into a centry
 829 */
 830 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 831 {
 832         centry_expand(centry, 8);
 833         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 834         centry->ofs += 4;
 835         SIVAL(centry->data, centry->ofs, nt >> 32);
 836         centry->ofs += 4;
 837 }
 838
 839 /*
 840   push a time_t into a centry - use a 64 bit size.
 841   NTTIME here is being used as a convenient 64-bit size.
 842 */
 843 static void centry_put_time(struct cache_entry *centry, time_t t)
 844 {
 845         NTTIME nt = (NTTIME)t;
 846         centry_put_nttime(centry, nt);
 847 }
 848
 849 /*
 850   start a centry for output. When finished, call centry_end()
 851 */
 852 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 853 {
 854         struct cache_entry *centry;
 855
 856         if (!wcache->tdb)
 857                 return NULL;
 858
 859         centry = SMB_XMALLOC_P(struct cache_entry);
 860
 861         centry->len = 8192; /* reasonable default */
 862         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 863         centry->ofs = 0;
 864         centry->sequence_number = domain->sequence_number;
 865         centry_put_ntstatus(centry, status);
 866         centry_put_uint32(centry, centry->sequence_number);
 867         return centry;
 868 }
 869
 870 /*
 871   finish a centry and write it to the tdb
 872 */
 873 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 874 static void centry_end(struct cache_entry *centry, const char *format, ...)
 875 {
 876         va_list ap;
 877         char *kstr;
 878         TDB_DATA key, data;
 879
 880         if (!winbindd_use_cache()) {
 881                 return;
 882         }
 883
 884         va_start(ap, format);
 885         smb_xvasprintf(&kstr, format, ap);
 886         va_end(ap);
 887
 888         key = string_tdb_data(kstr);
 889         data.dptr = centry->data;
 890         data.dsize = centry->ofs;
 891
 892         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 893         free(kstr);
 894 }
 895
 896 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 897                                     NTSTATUS status, const char *domain_name,
 898                                     const char *name, const DOM_SID *sid,
 899                                     enum lsa_SidType type)
 900 {
 901         struct cache_entry *centry;
 902         fstring uname;
 903
 904         centry = centry_start(domain, status);
 905         if (!centry)
 906                 return;
 907         centry_put_uint32(centry, type);
 908         centry_put_sid(centry, sid);
 909         fstrcpy(uname, name);
 910         strupper_m(uname);
 911         centry_end(centry, "NS/%s/%s", domain_name, uname);
 912         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 913                   uname, sid_string_dbg(sid), nt_errstr(status)));
 914         centry_free(centry);
 915 }
 916
 917 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 918                                     const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 919 {
 920         struct cache_entry *centry;
 921         fstring sid_string;
 922
 923         centry = centry_start(domain, status);
 924         if (!centry)
 925                 return;
 926
 927         if (NT_STATUS_IS_OK(status)) {
 928                 centry_put_uint32(centry, type);
 929                 centry_put_string(centry, domain_name);
 930                 centry_put_string(centry, name);
 931         }
 932
 933         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 934         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 935                   name, nt_errstr(status)));
 936         centry_free(centry);
 937 }
 938
 939
 940 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status,
 941                              struct wbint_userinfo *info)
 942 {
 943         struct cache_entry *centry;
 944         fstring sid_string;
 945
 946         if (is_null_sid(&info->user_sid)) {
 947                 return;
 948         }
 949
 950         centry = centry_start(domain, status);
 951         if (!centry)
 952                 return;
 953         centry_put_string(centry, info->acct_name);
 954         centry_put_string(centry, info->full_name);
 955         centry_put_string(centry, info->homedir);
 956         centry_put_string(centry, info->shell);
 957         centry_put_uint32(centry, info->primary_gid);
 958         centry_put_sid(centry, &info->user_sid);
 959         centry_put_sid(centry, &info->group_sid);
 960         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 961                                                   &info->user_sid));
 962         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 963         centry_free(centry);
 964 }
 965
 966 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
 967                                        NTSTATUS status,
 968                                        struct samr_DomInfo12 *lockout_policy)
 969 {
 970         struct cache_entry *centry;
 971
 972         centry = centry_start(domain, status);
 973         if (!centry)
 974                 return;
 975
 976         centry_put_nttime(centry, lockout_policy->lockout_duration);
 977         centry_put_nttime(centry, lockout_policy->lockout_window);
 978         centry_put_uint16(centry, lockout_policy->lockout_threshold);
 979
 980         centry_end(centry, "LOC_POL/%s", domain->name);
 981
 982         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
 983
 984         centry_free(centry);
 985 }
 986
 987
 988
 989 static void wcache_save_password_policy(struct winbindd_domain *domain,
 990                                         NTSTATUS status,
 991                                         struct samr_DomInfo1 *policy)
 992 {
 993         struct cache_entry *centry;
 994
 995         centry = centry_start(domain, status);
 996         if (!centry)
 997                 return;
 998
 999         centry_put_uint16(centry, policy->min_password_length);
1000         centry_put_uint16(centry, policy->password_history_length);
1001         centry_put_uint32(centry, policy->password_properties);
1002         centry_put_nttime(centry, policy->max_password_age);
1003         centry_put_nttime(centry, policy->min_password_age);
1004
1005         centry_end(centry, "PWD_POL/%s", domain->name);
1006
1007         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
1008
1009         centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013  ***************************************************************************/
1014
1015 static void wcache_save_username_alias(struct winbindd_domain *domain,
1016                                        NTSTATUS status,
1017                                        const char *name, const char *alias)
1018 {
1019         struct cache_entry *centry;
1020         fstring uname;
1021
1022         if ( (centry = centry_start(domain, status)) == NULL )
1023                 return;
1024
1025         centry_put_string( centry, alias );
1026
1027         fstrcpy(uname, name);
1028         strupper_m(uname);
1029         centry_end(centry, "NSS/NA/%s", uname);
1030
1031         DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
1032
1033         centry_free(centry);
1034 }
1035
1036 static void wcache_save_alias_username(struct winbindd_domain *domain,
1037                                        NTSTATUS status,
1038                                        const char *alias, const char *name)
1039 {
1040         struct cache_entry *centry;
1041         fstring uname;
1042
1043         if ( (centry = centry_start(domain, status)) == NULL )
1044                 return;
1045
1046         centry_put_string( centry, name );
1047
1048         fstrcpy(uname, alias);
1049         strupper_m(uname);
1050         centry_end(centry, "NSS/AN/%s", uname);
1051
1052         DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1053
1054         centry_free(centry);
1055 }
1056
1057 /***************************************************************************
1058  ***************************************************************************/
1059
1060 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1061                                     struct winbindd_domain *domain,
1062                                     const char *name, char **alias )
1063 {
1064         struct winbind_cache *cache = get_cache(domain);
1065         struct cache_entry *centry = NULL;
1066         NTSTATUS status;
1067         char *upper_name;
1068
1069         if ( domain->internal )
1070                 return NT_STATUS_NOT_SUPPORTED;
1071
1072         if (!cache->tdb)
1073                 goto do_query;
1074
1075         if ( (upper_name = SMB_STRDUP(name)) == NULL )
1076                 return NT_STATUS_NO_MEMORY;
1077         strupper_m(upper_name);
1078
1079         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1080
1081         SAFE_FREE( upper_name );
1082
1083         if (!centry)
1084                 goto do_query;
1085
1086         status = centry->status;
1087
1088         if (!NT_STATUS_IS_OK(status)) {
1089                 centry_free(centry);
1090                 return status;
1091         }
1092
1093         *alias = centry_string( centry, mem_ctx );
1094
1095         centry_free(centry);
1096
1097         DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1098                   name, *alias ? *alias : "(none)"));
1099
1100         return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1101
1102 do_query:
1103
1104         /* If its not in cache and we are offline, then fail */
1105
1106         if ( get_global_winbindd_state_offline() || !domain->online ) {
1107                 DEBUG(8,("resolve_username_to_alias: rejecting query "
1108                          "in offline mode\n"));
1109                 return NT_STATUS_NOT_FOUND;
1110         }
1111
1112         status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1113
1114         if ( NT_STATUS_IS_OK( status ) ) {
1115                 wcache_save_username_alias(domain, status, name, *alias);
1116         }
1117
1118         if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1119                 wcache_save_username_alias(domain, status, name, "(NULL)");
1120         }
1121
1122         DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1123                  nt_errstr(status)));
1124
1125         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1126                 set_domain_offline( domain );
1127         }
1128
1129         return status;
1130 }
1131
1132 /***************************************************************************
1133  ***************************************************************************/
1134
1135 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1136                                     struct winbindd_domain *domain,
1137                                     const char *alias, char **name )
1138 {
1139         struct winbind_cache *cache = get_cache(domain);
1140         struct cache_entry *centry = NULL;
1141         NTSTATUS status;
1142         char *upper_name;
1143
1144         if ( domain->internal )
1145                 return  NT_STATUS_NOT_SUPPORTED;
1146
1147         if (!cache->tdb)
1148                 goto do_query;
1149
1150         if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1151                 return NT_STATUS_NO_MEMORY;
1152         strupper_m(upper_name);
1153
1154         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1155
1156         SAFE_FREE( upper_name );
1157
1158         if (!centry)
1159                 goto do_query;
1160
1161         status = centry->status;
1162
1163         if (!NT_STATUS_IS_OK(status)) {
1164                 centry_free(centry);
1165                 return status;
1166         }
1167
1168         *name = centry_string( centry, mem_ctx );
1169
1170         centry_free(centry);
1171
1172         DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1173                   alias, *name ? *name : "(none)"));
1174
1175         return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1176
1177 do_query:
1178
1179         /* If its not in cache and we are offline, then fail */
1180
1181         if ( get_global_winbindd_state_offline() || !domain->online ) {
1182                 DEBUG(8,("resolve_alias_to_username: rejecting query "
1183                          "in offline mode\n"));
1184                 return NT_STATUS_NOT_FOUND;
1185         }
1186
1187         /* an alias cannot contain a domain prefix or '@' */
1188
1189         if (strchr(alias, '\\') || strchr(alias, '@')) {
1190                 DEBUG(10,("resolve_alias_to_username: skipping fully "
1191                           "qualified name %s\n", alias));
1192                 return NT_STATUS_OBJECT_NAME_INVALID;
1193         }
1194
1195         status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1196
1197         if ( NT_STATUS_IS_OK( status ) ) {
1198                 wcache_save_alias_username( domain, status, alias, *name );
1199         }
1200
1201         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1202                 wcache_save_alias_username(domain, status, alias, "(NULL)");
1203         }
1204
1205         DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1206                  nt_errstr(status)));
1207
1208         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1209                 set_domain_offline( domain );
1210         }
1211
1212         return status;
1213 }
1214
1215 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1216 {
1217         struct winbind_cache *cache = get_cache(domain);
1218         TDB_DATA data;
1219         fstring key_str, tmp;
1220         uint32 rid;
1221
1222         if (!cache->tdb) {
1223                 return NT_STATUS_INTERNAL_DB_ERROR;
1224         }
1225
1226         if (is_null_sid(sid)) {
1227                 return NT_STATUS_INVALID_SID;
1228         }
1229
1230         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1231                 return NT_STATUS_INVALID_SID;
1232         }
1233
1234         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1235
1236         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1237         if (!data.dptr) {
1238                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1239         }
1240
1241         SAFE_FREE(data.dptr);
1242         return NT_STATUS_OK;
1243 }
1244
1245 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1246    as new salted ones. */
1247
1248 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1249                           TALLOC_CTX *mem_ctx,
1250                           const DOM_SID *sid,
1251                           const uint8 **cached_nt_pass,
1252                           const uint8 **cached_salt)
1253 {
1254         struct winbind_cache *cache = get_cache(domain);
1255         struct cache_entry *centry = NULL;
1256         NTSTATUS status;
1257         time_t t;
1258         uint32 rid;
1259         fstring tmp;
1260
1261         if (!cache->tdb) {
1262                 return NT_STATUS_INTERNAL_DB_ERROR;
1263         }
1264
1265         if (is_null_sid(sid)) {
1266                 return NT_STATUS_INVALID_SID;
1267         }
1268
1269         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1270                 return NT_STATUS_INVALID_SID;
1271         }
1272
1273         /* Try and get a salted cred first. If we can't
1274            fall back to an unsalted cred. */
1275
1276         centry = wcache_fetch(cache, domain, "CRED/%s",
1277                               sid_to_fstring(tmp, sid));
1278         if (!centry) {
1279                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1280                           sid_string_dbg(sid)));
1281                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1282         }
1283
1284         t = centry_time(centry);
1285
1286         /* In the salted case this isn't actually the nt_hash itself,
1287            but the MD5 of the salt + nt_hash. Let the caller
1288            sort this out. It can tell as we only return the cached_salt
1289            if we are returning a salted cred. */
1290
1291         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1292         if (*cached_nt_pass == NULL) {
1293                 fstring sidstr;
1294
1295                 sid_to_fstring(sidstr, sid);
1296
1297                 /* Bad (old) cred cache. Delete and pretend we
1298                    don't have it. */
1299                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1300                                 sidstr));
1301                 wcache_delete("CRED/%s", sidstr);
1302                 centry_free(centry);
1303                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1304         }
1305
1306         /* We only have 17 bytes more data in the salted cred case. */
1307         if (centry->len - centry->ofs == 17) {
1308                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1309         } else {
1310                 *cached_salt = NULL;
1311         }
1312
1313         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1314         if (*cached_salt) {
1315                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1316         }
1317
1318         status = centry->status;
1319
1320         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1321                   sid_string_dbg(sid), nt_errstr(status) ));
1322
1323         centry_free(centry);
1324         return status;
1325 }
1326
1327 /* Store creds for a SID - only writes out new salted ones. */
1328
1329 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1330                            TALLOC_CTX *mem_ctx,
1331                            const DOM_SID *sid,
1332                            const uint8 nt_pass[NT_HASH_LEN])
1333 {
1334         struct cache_entry *centry;
1335         fstring sid_string;
1336         uint32 rid;
1337         uint8 cred_salt[NT_HASH_LEN];
1338         uint8 salted_hash[NT_HASH_LEN];
1339
1340         if (is_null_sid(sid)) {
1341                 return NT_STATUS_INVALID_SID;
1342         }
1343
1344         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1345                 return NT_STATUS_INVALID_SID;
1346         }
1347
1348         centry = centry_start(domain, NT_STATUS_OK);
1349         if (!centry) {
1350                 return NT_STATUS_INTERNAL_DB_ERROR;
1351         }
1352
1353         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1354
1355         centry_put_time(centry, time(NULL));
1356
1357         /* Create a salt and then salt the hash. */
1358         generate_random_buffer(cred_salt, NT_HASH_LEN);
1359         E_md5hash(cred_salt, nt_pass, salted_hash);
1360
1361         centry_put_hash16(centry, salted_hash);
1362         centry_put_hash16(centry, cred_salt);
1363         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1364
1365         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1366
1367         centry_free(centry);
1368
1369         return NT_STATUS_OK;
1370 }
1371
1372
1373 /* Query display info. This is the basic user list fn */
1374 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1375                                 TALLOC_CTX *mem_ctx,
1376                                 uint32 *num_entries,
1377                                 struct wbint_userinfo **info)
1378 {
1379         struct winbind_cache *cache = get_cache(domain);
1380         struct cache_entry *centry = NULL;
1381         NTSTATUS status;
1382         unsigned int i, retry;
1383         bool old_status = domain->online;
1384
1385         if (!cache->tdb)
1386                 goto do_query;
1387
1388         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1389         if (!centry)
1390                 goto do_query;
1391
1392 do_fetch_cache:
1393         *num_entries = centry_uint32(centry);
1394
1395         if (*num_entries == 0)
1396                 goto do_cached;
1397
1398         (*info) = TALLOC_ARRAY(mem_ctx, struct wbint_userinfo, *num_entries);
1399         if (! (*info)) {
1400                 smb_panic_fn("query_user_list out of memory");
1401         }
1402         for (i=0; i<(*num_entries); i++) {
1403                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1404                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1405                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1406                 (*info)[i].shell = centry_string(centry, mem_ctx);
1407                 centry_sid(centry, &(*info)[i].user_sid);
1408                 centry_sid(centry, &(*info)[i].group_sid);
1409         }
1410
1411 do_cached:
1412         status = centry->status;
1413
1414         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1415                 domain->name, nt_errstr(status) ));
1416
1417         centry_free(centry);
1418         return status;
1419
1420 do_query:
1421         *num_entries = 0;
1422         *info = NULL;
1423
1424         /* Return status value returned by seq number check */
1425
1426         if (!NT_STATUS_IS_OK(domain->last_status))
1427                 return domain->last_status;
1428
1429         /* Put the query_user_list() in a retry loop.  There appears to be
1430          * some bug either with Windows 2000 or Samba's handling of large
1431          * rpc replies.  This manifests itself as sudden disconnection
1432          * at a random point in the enumeration of a large (60k) user list.
1433          * The retry loop simply tries the operation again. )-:  It's not
1434          * pretty but an acceptable workaround until we work out what the
1435          * real problem is. */
1436
1437         retry = 0;
1438         do {
1439
1440                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1441                         domain->name ));
1442
1443                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1444                 if (!NT_STATUS_IS_OK(status)) {
1445                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1446                                   "retrying\n", NT_STATUS_V(status)));
1447                 }
1448                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1449                         DEBUG(3, ("query_user_list: flushing "
1450                                   "connection cache\n"));
1451                         invalidate_cm_connection(&domain->conn);
1452                 }
1453                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1454                     NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1455                         if (!domain->internal && old_status) {
1456                                 set_domain_offline(domain);
1457                         }
1458                         /* store partial response. */
1459                         if (*num_entries > 0) {
1460                                 /*
1461                                  * humm, what about the status used for cache?
1462                                  * Should it be NT_STATUS_OK?
1463                                  */
1464                                 break;
1465                         }
1466                         /*
1467                          * domain is offline now, and there is no user entries,
1468                          * try to fetch from cache again.
1469                          */
1470                         if (cache->tdb && !domain->online && !domain->internal && old_status) {
1471                                 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1472                                 /* partial response... */
1473                                 if (!centry) {
1474                                         goto skip_save;
1475                                 } else {
1476                                         goto do_fetch_cache;
1477                                 }
1478                         } else {
1479                                 goto skip_save;
1480                         }
1481                 }
1482
1483         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1484                  (retry++ < 5));
1485
1486         /* and save it */
1487         refresh_sequence_number(domain, false);
1488         if (!NT_STATUS_IS_OK(status)) {
1489                 return status;
1490         }
1491         centry = centry_start(domain, status);
1492         if (!centry)
1493                 goto skip_save;
1494         centry_put_uint32(centry, *num_entries);
1495         for (i=0; i<(*num_entries); i++) {
1496                 centry_put_string(centry, (*info)[i].acct_name);
1497                 centry_put_string(centry, (*info)[i].full_name);
1498                 centry_put_string(centry, (*info)[i].homedir);
1499                 centry_put_string(centry, (*info)[i].shell);
1500                 centry_put_sid(centry, &(*info)[i].user_sid);
1501                 centry_put_sid(centry, &(*info)[i].group_sid);
1502                 if (domain->backend && domain->backend->consistent) {
1503                         /* when the backend is consistent we can pre-prime some mappings */
1504                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1505                                                 domain->name,
1506                                                 (*info)[i].acct_name,
1507                                                 &(*info)[i].user_sid,
1508                                                 SID_NAME_USER);
1509                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1510                                                 &(*info)[i].user_sid,
1511                                                 domain->name,
1512                                                 (*info)[i].acct_name,
1513                                                 SID_NAME_USER);
1514                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1515                 }
1516         }
1517         centry_end(centry, "UL/%s", domain->name);
1518         centry_free(centry);
1519
1520 skip_save:
1521         return status;
1522 }
1523
1524 /* list all domain groups */
1525 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1526                                 TALLOC_CTX *mem_ctx,
1527                                 uint32 *num_entries,
1528                                 struct acct_info **info)
1529 {
1530         struct winbind_cache *cache = get_cache(domain);
1531         struct cache_entry *centry = NULL;
1532         NTSTATUS status;
1533         unsigned int i;
1534         bool old_status;
1535
1536         old_status = domain->online;
1537         if (!cache->tdb)
1538                 goto do_query;
1539
1540         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1541         if (!centry)
1542                 goto do_query;
1543
1544 do_fetch_cache:
1545         *num_entries = centry_uint32(centry);
1546
1547         if (*num_entries == 0)
1548                 goto do_cached;
1549
1550         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1551         if (! (*info)) {
1552                 smb_panic_fn("enum_dom_groups out of memory");
1553         }
1554         for (i=0; i<(*num_entries); i++) {
1555                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1556                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1557                 (*info)[i].rid = centry_uint32(centry);
1558         }
1559
1560 do_cached:
1561         status = centry->status;
1562
1563         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1564                 domain->name, nt_errstr(status) ));
1565
1566         centry_free(centry);
1567         return status;
1568
1569 do_query:
1570         *num_entries = 0;
1571         *info = NULL;
1572
1573         /* Return status value returned by seq number check */
1574
1575         if (!NT_STATUS_IS_OK(domain->last_status))
1576                 return domain->last_status;
1577
1578         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1579                 domain->name ));
1580
1581         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1582
1583         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1584             NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1585                 if (!domain->internal && old_status) {
1586                         set_domain_offline(domain);
1587                 }
1588                 if (cache->tdb &&
1589                         !domain->online &&
1590                         !domain->internal &&
1591                         old_status) {
1592                         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1593                         if (centry) {
1594                                 goto do_fetch_cache;
1595                         }
1596                 }
1597         }
1598         /* and save it */
1599         refresh_sequence_number(domain, false);
1600         if (!NT_STATUS_IS_OK(status)) {
1601                 return status;
1602         }
1603         centry = centry_start(domain, status);
1604         if (!centry)
1605                 goto skip_save;
1606         centry_put_uint32(centry, *num_entries);
1607         for (i=0; i<(*num_entries); i++) {
1608                 centry_put_string(centry, (*info)[i].acct_name);
1609                 centry_put_string(centry, (*info)[i].acct_desc);
1610                 centry_put_uint32(centry, (*info)[i].rid);
1611         }
1612         centry_end(centry, "GL/%s/domain", domain->name);
1613         centry_free(centry);
1614
1615 skip_save:
1616         return status;
1617 }
1618
1619 /* list all domain groups */
1620 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1621                                 TALLOC_CTX *mem_ctx,
1622                                 uint32 *num_entries,
1623                                 struct acct_info **info)
1624 {
1625         struct winbind_cache *cache = get_cache(domain);
1626         struct cache_entry *centry = NULL;
1627         NTSTATUS status;
1628         unsigned int i;
1629         bool old_status;
1630
1631         old_status = domain->online;
1632         if (!cache->tdb)
1633                 goto do_query;
1634
1635         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1636         if (!centry)
1637                 goto do_query;
1638
1639 do_fetch_cache:
1640         *num_entries = centry_uint32(centry);
1641
1642         if (*num_entries == 0)
1643                 goto do_cached;
1644
1645         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1646         if (! (*info)) {
1647                 smb_panic_fn("enum_dom_groups out of memory");
1648         }
1649         for (i=0; i<(*num_entries); i++) {
1650                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1651                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1652                 (*info)[i].rid = centry_uint32(centry);
1653         }
1654
1655 do_cached:
1656
1657         /* If we are returning cached data and the domain controller
1658            is down then we don't know whether the data is up to date
1659            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1660            indicate this. */
1661
1662         if (wcache_server_down(domain)) {
1663                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1664                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1665         } else
1666                 status = centry->status;
1667
1668         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1669                 domain->name, nt_errstr(status) ));
1670
1671         centry_free(centry);
1672         return status;
1673
1674 do_query:
1675         *num_entries = 0;
1676         *info = NULL;
1677
1678         /* Return status value returned by seq number check */
1679
1680         if (!NT_STATUS_IS_OK(domain->last_status))
1681                 return domain->last_status;
1682
1683         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1684                 domain->name ));
1685
1686         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1687
1688         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1689                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1690                 if (!domain->internal && old_status) {
1691                         set_domain_offline(domain);
1692                 }
1693                 if (cache->tdb &&
1694                         !domain->internal &&
1695                         !domain->online &&
1696                         old_status) {
1697                         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1698                         if (centry) {
1699                                 goto do_fetch_cache;
1700                         }
1701                 }
1702         }
1703         /* and save it */
1704         refresh_sequence_number(domain, false);
1705         if (!NT_STATUS_IS_OK(status)) {
1706                 return status;
1707         }
1708         centry = centry_start(domain, status);
1709         if (!centry)
1710                 goto skip_save;
1711         centry_put_uint32(centry, *num_entries);
1712         for (i=0; i<(*num_entries); i++) {
1713                 centry_put_string(centry, (*info)[i].acct_name);
1714                 centry_put_string(centry, (*info)[i].acct_desc);
1715                 centry_put_uint32(centry, (*info)[i].rid);
1716         }
1717         centry_end(centry, "GL/%s/local", domain->name);
1718         centry_free(centry);
1719
1720 skip_save:
1721         return status;
1722 }
1723
1724 NTSTATUS wcache_name_to_sid(struct winbindd_domain *domain,
1725                             const char *domain_name,
1726                             const char *name,
1727                             struct dom_sid *sid,
1728                             enum lsa_SidType *type)
1729 {
1730         struct winbind_cache *cache = get_cache(domain);
1731         struct cache_entry *centry;
1732         NTSTATUS status;
1733         char *uname;
1734
1735         if (cache->tdb == NULL) {
1736                 return NT_STATUS_NOT_FOUND;
1737         }
1738
1739         uname = talloc_strdup_upper(talloc_tos(), name);
1740         if (uname == NULL) {
1741                 return NT_STATUS_NO_MEMORY;
1742         }
1743
1744         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1745         TALLOC_FREE(uname);
1746         if (centry == NULL) {
1747                 return NT_STATUS_NOT_FOUND;
1748         }
1749
1750         status = centry->status;
1751         if (NT_STATUS_IS_OK(status)) {
1752                 *type = (enum lsa_SidType)centry_uint32(centry);
1753                 centry_sid(centry, sid);
1754         }
1755
1756         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: "
1757                   "%s\n", domain->name, nt_errstr(status) ));
1758
1759         centry_free(centry);
1760         return status;
1761 }
1762
1763 /* convert a single name to a sid in a domain */
1764 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1765                             TALLOC_CTX *mem_ctx,
1766                             const char *domain_name,
1767                             const char *name,
1768                             uint32_t flags,
1769                             DOM_SID *sid,
1770                             enum lsa_SidType *type)
1771 {
1772         NTSTATUS status;
1773         bool old_status;
1774
1775         old_status = domain->online;
1776
1777         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1778         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1779                 return status;
1780         }
1781
1782         ZERO_STRUCTP(sid);
1783
1784         /* If the seq number check indicated that there is a problem
1785          * with this DC, then return that status... except for
1786          * access_denied.  This is special because the dc may be in
1787          * "restrict anonymous = 1" mode, in which case it will deny
1788          * most unauthenticated operations, but *will* allow the LSA
1789          * name-to-sid that we try as a fallback. */
1790
1791         if (!(NT_STATUS_IS_OK(domain->last_status)
1792               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1793                 return domain->last_status;
1794
1795         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1796                 domain->name ));
1797
1798         status = domain->backend->name_to_sid(domain, mem_ctx, domain_name,
1799                                               name, flags, sid, type);
1800
1801         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1802                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1803                 if (!domain->internal && old_status) {
1804                         set_domain_offline(domain);
1805                 }
1806                 if (!domain->internal &&
1807                         !domain->online &&
1808                         old_status) {
1809                         NTSTATUS cache_status;
1810                         cache_status = wcache_name_to_sid(domain, domain_name, name, sid, type);
1811                         return cache_status;
1812                 }
1813         }
1814         /* and save it */
1815         refresh_sequence_number(domain, false);
1816
1817         if (domain->online &&
1818             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1819                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1820
1821                 /* Only save the reverse mapping if this was not a UPN */
1822                 if (!strchr(name, '@')) {
1823                         strupper_m(CONST_DISCARD(char *,domain_name));
1824                         strlower_m(CONST_DISCARD(char *,name));
1825                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1826                 }
1827         }
1828
1829         return status;
1830 }
1831
1832 NTSTATUS wcache_sid_to_name(struct winbindd_domain *domain,
1833                             const struct dom_sid *sid,
1834                             TALLOC_CTX *mem_ctx,
1835                             char **domain_name,
1836                             char **name,
1837                             enum lsa_SidType *type)
1838 {
1839         struct winbind_cache *cache = get_cache(domain);
1840         struct cache_entry *centry;
1841         char *sid_string;
1842         NTSTATUS status;
1843
1844         if (cache->tdb == NULL) {
1845                 return NT_STATUS_NOT_FOUND;
1846         }
1847
1848         sid_string = sid_string_tos(sid);
1849         if (sid_string == NULL) {
1850                 return NT_STATUS_NO_MEMORY;
1851         }
1852
1853         centry = wcache_fetch(cache, domain, "SN/%s", sid_string);
1854         TALLOC_FREE(sid_string);
1855         if (centry == NULL) {
1856                 return NT_STATUS_NOT_FOUND;
1857         }
1858
1859         if (NT_STATUS_IS_OK(centry->status)) {
1860                 *type = (enum lsa_SidType)centry_uint32(centry);
1861                 *domain_name = centry_string(centry, mem_ctx);
1862                 *name = centry_string(centry, mem_ctx);
1863         }
1864
1865         status = centry->status;
1866         centry_free(centry);
1867
1868         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: "
1869                   "%s\n", domain->name, nt_errstr(status) ));
1870
1871         return status;
1872 }
1873
1874 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1875    given */
1876 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1877                             TALLOC_CTX *mem_ctx,
1878                             const DOM_SID *sid,
1879                             char **domain_name,
1880                             char **name,
1881                             enum lsa_SidType *type)
1882 {
1883         NTSTATUS status;
1884         bool old_status;
1885
1886         old_status = domain->online;
1887         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
1888                                     type);
1889         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
1890                 return status;
1891         }
1892
1893         *name = NULL;
1894         *domain_name = NULL;
1895
1896         /* If the seq number check indicated that there is a problem
1897          * with this DC, then return that status... except for
1898          * access_denied.  This is special because the dc may be in
1899          * "restrict anonymous = 1" mode, in which case it will deny
1900          * most unauthenticated operations, but *will* allow the LSA
1901          * sid-to-name that we try as a fallback. */
1902
1903         if (!(NT_STATUS_IS_OK(domain->last_status)
1904               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1905                 return domain->last_status;
1906
1907         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1908                 domain->name ));
1909
1910         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1911
1912         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
1913                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1914                 if (!domain->internal && old_status) {
1915                         set_domain_offline(domain);
1916                 }
1917                 if (!domain->internal &&
1918                         !domain->online &&
1919                         old_status) {
1920                         NTSTATUS cache_status;
1921                         cache_status = wcache_sid_to_name(domain, sid, mem_ctx,
1922                                                         domain_name, name, type);
1923                         return cache_status;
1924                 }
1925         }
1926         /* and save it */
1927         refresh_sequence_number(domain, false);
1928         if (!NT_STATUS_IS_OK(status)) {
1929                 return status;
1930         }
1931         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1932
1933         /* We can't save the name to sid mapping here, as with sid history a
1934          * later name2sid would give the wrong sid. */
1935
1936         return status;
1937 }
1938
1939 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1940                               TALLOC_CTX *mem_ctx,
1941                               const DOM_SID *domain_sid,
1942                               uint32 *rids,
1943                               size_t num_rids,
1944                               char **domain_name,
1945                               char ***names,
1946                               enum lsa_SidType **types)
1947 {
1948         struct winbind_cache *cache = get_cache(domain);
1949         size_t i;
1950         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1951         bool have_mapped;
1952         bool have_unmapped;
1953         bool old_status;
1954
1955         old_status = domain->online;
1956         *domain_name = NULL;
1957         *names = NULL;
1958         *types = NULL;
1959
1960         if (!cache->tdb) {
1961                 goto do_query;
1962         }
1963
1964         if (num_rids == 0) {
1965                 return NT_STATUS_OK;
1966         }
1967
1968         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1969         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1970
1971         if ((*names == NULL) || (*types == NULL)) {
1972                 result = NT_STATUS_NO_MEMORY;
1973                 goto error;
1974         }
1975
1976         have_mapped = have_unmapped = false;
1977
1978         for (i=0; i<num_rids; i++) {
1979                 DOM_SID sid;
1980                 struct cache_entry *centry;
1981                 fstring tmp;
1982
1983                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1984                         result = NT_STATUS_INTERNAL_ERROR;
1985                         goto error;
1986                 }
1987
1988                 centry = wcache_fetch(cache, domain, "SN/%s",
1989                                       sid_to_fstring(tmp, &sid));
1990                 if (!centry) {
1991                         goto do_query;
1992                 }
1993
1994                 (*types)[i] = SID_NAME_UNKNOWN;
1995                 (*names)[i] = talloc_strdup(*names, "");
1996
1997                 if (NT_STATUS_IS_OK(centry->status)) {
1998                         char *dom;
1999                         have_mapped = true;
2000                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2001
2002                         dom = centry_string(centry, mem_ctx);
2003                         if (*domain_name == NULL) {
2004                                 *domain_name = dom;
2005                         } else {
2006                                 talloc_free(dom);
2007                         }
2008
2009                         (*names)[i] = centry_string(centry, *names);
2010
2011                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2012                         have_unmapped = true;
2013
2014                 } else {
2015                         /* something's definitely wrong */
2016                         result = centry->status;
2017                         goto error;
2018                 }
2019
2020                 centry_free(centry);
2021         }
2022
2023         if (!have_mapped) {
2024                 return NT_STATUS_NONE_MAPPED;
2025         }
2026         if (!have_unmapped) {
2027                 return NT_STATUS_OK;
2028         }
2029         return STATUS_SOME_UNMAPPED;
2030
2031  do_query:
2032
2033         TALLOC_FREE(*names);
2034         TALLOC_FREE(*types);
2035
2036         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
2037                                                 rids, num_rids, domain_name,
2038                                                 names, types);
2039
2040         if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2041                 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2042                 if (!domain->internal && old_status) {
2043                         set_domain_offline(domain);
2044                 }
2045                 if (cache->tdb &&
2046                         !domain->internal &&
2047                         !domain->online &&
2048                         old_status) {
2049                         have_mapped = have_unmapped = false;
2050
2051                         for (i=0; i<num_rids; i++) {
2052                                 DOM_SID sid;
2053                                 struct cache_entry *centry;
2054                                 fstring tmp;
2055
2056                                 if (!sid_compose(&sid, domain_sid, rids[i])) {
2057                                         result = NT_STATUS_INTERNAL_ERROR;
2058                                         goto error;
2059                                 }
2060
2061                                 centry = wcache_fetch(cache, domain, "SN/%s",
2062                                                       sid_to_fstring(tmp, &sid));
2063                                 if (!centry) {
2064                                         (*types)[i] = SID_NAME_UNKNOWN;
2065                                         (*names)[i] = talloc_strdup(*names, "");
2066                                         continue;
2067                                 }
2068
2069                                 (*types)[i] = SID_NAME_UNKNOWN;
2070                                 (*names)[i] = talloc_strdup(*names, "");
2071
2072                                 if (NT_STATUS_IS_OK(centry->status)) {
2073                                         char *dom;
2074                                         have_mapped = true;
2075                                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
2076
2077                                         dom = centry_string(centry, mem_ctx);
2078                                         if (*domain_name == NULL) {
2079                                                 *domain_name = dom;
2080                                         } else {
2081                                                 talloc_free(dom);
2082                                         }
2083
2084                                         (*names)[i] = centry_string(centry, *names);
2085
2086                                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
2087                                         have_unmapped = true;
2088
2089                                 } else {
2090                                         /* something's definitely wrong */
2091                                         result = centry->status;
2092                                         goto error;
2093                                 }
2094
2095                                 centry_free(centry);
2096                         }
2097
2098                         if (!have_mapped) {
2099                                 return NT_STATUS_NONE_MAPPED;
2100                         }
2101                         if (!have_unmapped) {
2102                                 return NT_STATUS_OK;
2103                         }
2104                         return STATUS_SOME_UNMAPPED;
2105                 }
2106         }
2107         /*
2108           None of the queried rids has been found so save all negative entries
2109         */
2110         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
2111                 for (i = 0; i < num_rids; i++) {
2112                         DOM_SID sid;
2113                         const char *name = "";
2114                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
2115                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
2116
2117                         if (!sid_compose(&sid, domain_sid, rids[i])) {
2118                                 return NT_STATUS_INTERNAL_ERROR;
2119                         }
2120
2121                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2122                                                 name, type);
2123                 }
2124
2125                 return result;
2126         }
2127
2128         /*
2129           Some or all of the queried rids have been found.
2130         */
2131         if (!NT_STATUS_IS_OK(result) &&
2132             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2133                 return result;
2134         }
2135
2136         refresh_sequence_number(domain, false);
2137
2138         for (i=0; i<num_rids; i++) {
2139                 DOM_SID sid;
2140                 NTSTATUS status;
2141
2142                 if (!sid_compose(&sid, domain_sid, rids[i])) {
2143                         result = NT_STATUS_INTERNAL_ERROR;
2144                         goto error;
2145                 }
2146
2147                 status = (*types)[i] == SID_NAME_UNKNOWN ?
2148                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
2149
2150                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
2151                                         (*names)[i], (*types)[i]);
2152         }
2153
2154         return result;
2155
2156  error:
2157         TALLOC_FREE(*names);
2158         TALLOC_FREE(*types);
2159         return result;
2160 }
2161
2162 NTSTATUS wcache_query_user(struct winbindd_domain *domain,
2163                            TALLOC_CTX *mem_ctx,
2164                            const struct dom_sid *user_sid,
2165                            struct wbint_userinfo *info)
2166 {
2167         struct winbind_cache *cache = get_cache(domain);
2168         struct cache_entry *centry = NULL;
2169         NTSTATUS status;
2170         char *sid_string;
2171
2172         if (cache->tdb == NULL) {
2173                 return NT_STATUS_NOT_FOUND;
2174         }
2175
2176         sid_string = sid_string_tos(user_sid);
2177         if (sid_string == NULL) {
2178                 return NT_STATUS_NO_MEMORY;
2179         }
2180
2181         centry = wcache_fetch(cache, domain, "U/%s", sid_string);
2182         TALLOC_FREE(sid_string);
2183         if (centry == NULL) {
2184                 return NT_STATUS_NOT_FOUND;
2185         }
2186
2187         /*
2188          * If we have an access denied cache entry and a cached info3
2189          * in the samlogon cache then do a query.  This will force the
2190          * rpc back end to return the info3 data.
2191          */
2192
2193         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED) &&
2194             netsamlogon_cache_have(user_sid)) {
2195                 DEBUG(10, ("query_user: cached access denied and have cached "
2196                            "info3\n"));
2197                 domain->last_status = NT_STATUS_OK;
2198                 centry_free(centry);
2199                 return NT_STATUS_NOT_FOUND;
2200         }
2201
2202         /* if status is not ok then this is a negative hit
2203            and the rest of the data doesn't matter */
2204         status = centry->status;
2205         if (NT_STATUS_IS_OK(status)) {
2206                 info->acct_name = centry_string(centry, mem_ctx);
2207                 info->full_name = centry_string(centry, mem_ctx);
2208                 info->homedir = centry_string(centry, mem_ctx);
2209                 info->shell = centry_string(centry, mem_ctx);
2210                 info->primary_gid = centry_uint32(centry);
2211                 centry_sid(centry, &info->user_sid);
2212                 centry_sid(centry, &info->group_sid);
2213         }
2214
2215         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: "
2216                   "%s\n", domain->name, nt_errstr(status) ));
2217
2218         centry_free(centry);
2219         return status;
2220 }
2221
2222 /* Lookup user information from a rid */
2223 static NTSTATUS query_user(struct winbindd_domain *domain,
2224                            TALLOC_CTX *mem_ctx,
2225                            const DOM_SID *user_sid,
2226                            struct wbint_userinfo *info)
2227 {
2228         NTSTATUS status;
2229         bool old_status;
2230
2231         old_status = domain->online;
2232         status = wcache_query_user(domain, mem_ctx, user_sid, info);
2233         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2234                 return status;
2235         }
2236
2237         ZERO_STRUCTP(info);
2238
2239         /* Return status value returned by seq number check */
2240
2241         if (!NT_STATUS_IS_OK(domain->last_status))
2242                 return domain->last_status;
2243
2244         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
2245                 domain->name ));
2246
2247         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
2248
2249         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2250                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2251                 if (!domain->internal && old_status) {
2252                         set_domain_offline(domain);
2253                 }
2254                 if (!domain->internal &&
2255                         !domain->online &&
2256                         old_status) {
2257                         NTSTATUS cache_status;
2258                         cache_status = wcache_query_user(domain, mem_ctx, user_sid, info);
2259                         return cache_status;
2260                 }
2261         }
2262         /* and save it */
2263         refresh_sequence_number(domain, false);
2264         if (!NT_STATUS_IS_OK(status)) {
2265                 return status;
2266         }
2267         wcache_save_user(domain, status, info);
2268
2269         return status;
2270 }
2271
2272 NTSTATUS wcache_lookup_usergroups(struct winbindd_domain *domain,
2273                                   TALLOC_CTX *mem_ctx,
2274                                   const struct dom_sid *user_sid,
2275                                   uint32_t *pnum_sids,
2276                                   struct dom_sid **psids)
2277 {
2278         struct winbind_cache *cache = get_cache(domain);
2279         struct cache_entry *centry = NULL;
2280         NTSTATUS status;
2281         uint32_t i, num_sids;
2282         struct dom_sid *sids;
2283         fstring sid_string;
2284
2285         if (cache->tdb == NULL) {
2286                 return NT_STATUS_NOT_FOUND;
2287         }
2288
2289         centry = wcache_fetch(cache, domain, "UG/%s",
2290                               sid_to_fstring(sid_string, user_sid));
2291         if (centry == NULL) {
2292                 return NT_STATUS_NOT_FOUND;
2293         }
2294
2295         /* If we have an access denied cache entry and a cached info3 in the
2296            samlogon cache then do a query.  This will force the rpc back end
2297            to return the info3 data. */
2298
2299         if (NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)
2300             && netsamlogon_cache_have(user_sid)) {
2301                 DEBUG(10, ("lookup_usergroups: cached access denied and have "
2302                            "cached info3\n"));
2303                 domain->last_status = NT_STATUS_OK;
2304                 centry_free(centry);
2305                 return NT_STATUS_NOT_FOUND;
2306         }
2307
2308         num_sids = centry_uint32(centry);
2309         sids = talloc_array(mem_ctx, struct dom_sid, num_sids);
2310         if (sids == NULL) {
2311                 centry_free(centry);
2312                 return NT_STATUS_NO_MEMORY;
2313         }
2314
2315         for (i=0; i<num_sids; i++) {
2316                 centry_sid(centry, &sids[i]);
2317         }
2318
2319         status = centry->status;
2320
2321         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s "
2322                   "status: %s\n", domain->name, nt_errstr(status)));
2323
2324         centry_free(centry);
2325
2326         *pnum_sids = num_sids;
2327         *psids = sids;
2328         return status;
2329 }
2330
2331 /* Lookup groups a user is a member of. */
2332 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
2333                                   TALLOC_CTX *mem_ctx,
2334                                   const DOM_SID *user_sid,
2335                                   uint32 *num_groups, DOM_SID **user_gids)
2336 {
2337         struct cache_entry *centry = NULL;
2338         NTSTATUS status;
2339         unsigned int i;
2340         fstring sid_string;
2341         bool old_status;
2342
2343         old_status = domain->online;
2344         status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2345                                           num_groups, user_gids);
2346         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2347                 return status;
2348         }
2349
2350         (*num_groups) = 0;
2351         (*user_gids) = NULL;
2352
2353         /* Return status value returned by seq number check */
2354
2355         if (!NT_STATUS_IS_OK(domain->last_status))
2356                 return domain->last_status;
2357
2358         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2359                 domain->name ));
2360
2361         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2362
2363         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2364                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2365                 if (!domain->internal && old_status) {
2366                         set_domain_offline(domain);
2367                 }
2368                 if (!domain->internal &&
2369                         !domain->online &&
2370                         old_status) {
2371                         NTSTATUS cache_status;
2372                         cache_status = wcache_lookup_usergroups(domain, mem_ctx, user_sid,
2373                                                           num_groups, user_gids);
2374                         return cache_status;
2375                 }
2376         }
2377         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2378                 goto skip_save;
2379
2380         /* and save it */
2381         refresh_sequence_number(domain, false);
2382         if (!NT_STATUS_IS_OK(status)) {
2383                 return status;
2384         }
2385         centry = centry_start(domain, status);
2386         if (!centry)
2387                 goto skip_save;
2388
2389         centry_put_uint32(centry, *num_groups);
2390         for (i=0; i<(*num_groups); i++) {
2391                 centry_put_sid(centry, &(*user_gids)[i]);
2392         }
2393
2394         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2395         centry_free(centry);
2396
2397 skip_save:
2398         return status;
2399 }
2400
2401 static char *wcache_make_sidlist(TALLOC_CTX *mem_ctx, uint32_t num_sids,
2402                                  const struct dom_sid *sids)
2403 {
2404         uint32_t i;
2405         char *sidlist;
2406
2407         sidlist = talloc_strdup(mem_ctx, "");
2408         if (sidlist == NULL) {
2409                 return NULL;
2410         }
2411         for (i=0; i<num_sids; i++) {
2412                 fstring tmp;
2413                 sidlist = talloc_asprintf_append_buffer(
2414                         sidlist, "/%s", sid_to_fstring(tmp, &sids[i]));
2415                 if (sidlist == NULL) {
2416                         return NULL;
2417                 }
2418         }
2419         return sidlist;
2420 }
2421
2422 NTSTATUS wcache_lookup_useraliases(struct winbindd_domain *domain,
2423                                    TALLOC_CTX *mem_ctx, uint32_t num_sids,
2424                                    const struct dom_sid *sids,
2425                                    uint32_t *pnum_aliases, uint32_t **paliases)
2426 {
2427         struct winbind_cache *cache = get_cache(domain);
2428         struct cache_entry *centry = NULL;
2429         uint32_t num_aliases;
2430         uint32_t *aliases;
2431         NTSTATUS status;
2432         char *sidlist;
2433         int i;
2434
2435         if (cache->tdb == NULL) {
2436                 return NT_STATUS_NOT_FOUND;
2437         }
2438
2439         if (num_sids == 0) {
2440                 *pnum_aliases = 0;
2441                 *paliases = NULL;
2442                 return NT_STATUS_OK;
2443         }
2444
2445         /* We need to cache indexed by the whole list of SIDs, the aliases
2446          * resulting might come from any of the SIDs. */
2447
2448         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2449         if (sidlist == NULL) {
2450                 return NT_STATUS_NO_MEMORY;
2451         }
2452
2453         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2454         TALLOC_FREE(sidlist);
2455         if (centry == NULL) {
2456                 return NT_STATUS_NOT_FOUND;
2457         }
2458
2459         num_aliases = centry_uint32(centry);
2460         aliases = talloc_array(mem_ctx, uint32_t, num_aliases);
2461         if (aliases == NULL) {
2462                 centry_free(centry);
2463                 return NT_STATUS_NO_MEMORY;
2464         }
2465
2466         for (i=0; i<num_aliases; i++) {
2467                 aliases[i] = centry_uint32(centry);
2468         }
2469
2470         status = centry->status;
2471
2472         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2473                   "status %s\n", domain->name, nt_errstr(status)));
2474
2475         centry_free(centry);
2476
2477         *pnum_aliases = num_aliases;
2478         *paliases = aliases;
2479
2480         return status;
2481 }
2482
2483 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2484                                    TALLOC_CTX *mem_ctx,
2485                                    uint32 num_sids, const DOM_SID *sids,
2486                                    uint32 *num_aliases, uint32 **alias_rids)
2487 {
2488         struct cache_entry *centry = NULL;
2489         NTSTATUS status;
2490         char *sidlist;
2491         int i;
2492         bool old_status;
2493
2494         old_status = domain->online;
2495         status = wcache_lookup_useraliases(domain, mem_ctx, num_sids, sids,
2496                                            num_aliases, alias_rids);
2497         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2498                 return status;
2499         }
2500
2501         (*num_aliases) = 0;
2502         (*alias_rids) = NULL;
2503
2504         if (!NT_STATUS_IS_OK(domain->last_status))
2505                 return domain->last_status;
2506
2507         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2508                   "for domain %s\n", domain->name ));
2509
2510         sidlist = wcache_make_sidlist(talloc_tos(), num_sids, sids);
2511         if (sidlist == NULL) {
2512                 return NT_STATUS_NO_MEMORY;
2513         }
2514
2515         status = domain->backend->lookup_useraliases(domain, mem_ctx,
2516                                                      num_sids, sids,
2517                                                      num_aliases, alias_rids);
2518
2519         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2520                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2521                 if (!domain->internal && old_status) {
2522                         set_domain_offline(domain);
2523                 }
2524                 if (!domain->internal &&
2525                         !domain->online &&
2526                         old_status) {
2527                         NTSTATUS cache_status;
2528                         cache_status = wcache_lookup_useraliases(domain, mem_ctx, num_sids,
2529                                                                  sids, num_aliases, alias_rids);
2530                         return cache_status;
2531                 }
2532         }
2533         /* and save it */
2534         refresh_sequence_number(domain, false);
2535         if (!NT_STATUS_IS_OK(status)) {
2536                 return status;
2537         }
2538         centry = centry_start(domain, status);
2539         if (!centry)
2540                 goto skip_save;
2541         centry_put_uint32(centry, *num_aliases);
2542         for (i=0; i<(*num_aliases); i++)
2543                 centry_put_uint32(centry, (*alias_rids)[i]);
2544         centry_end(centry, "UA%s", sidlist);
2545         centry_free(centry);
2546
2547  skip_save:
2548         return status;
2549 }
2550
2551 NTSTATUS wcache_lookup_groupmem(struct winbindd_domain *domain,
2552                                 TALLOC_CTX *mem_ctx,
2553                                 const struct dom_sid *group_sid,
2554                                 uint32_t *num_names,
2555                                 struct dom_sid **sid_mem, char ***names,
2556                                 uint32_t **name_types)
2557 {
2558         struct winbind_cache *cache = get_cache(domain);
2559         struct cache_entry *centry = NULL;
2560         NTSTATUS status;
2561         unsigned int i;
2562         char *sid_string;
2563
2564         if (cache->tdb == NULL) {
2565                 return NT_STATUS_NOT_FOUND;
2566         }
2567
2568         sid_string = sid_string_tos(group_sid);
2569         if (sid_string == NULL) {
2570                 return NT_STATUS_NO_MEMORY;
2571         }
2572
2573         centry = wcache_fetch(cache, domain, "GM/%s", sid_string);
2574         TALLOC_FREE(sid_string);
2575         if (centry == NULL) {
2576                 return NT_STATUS_NOT_FOUND;
2577         }
2578
2579         *sid_mem = NULL;
2580         *names = NULL;
2581         *name_types = NULL;
2582
2583         *num_names = centry_uint32(centry);
2584         if (*num_names == 0) {
2585                 centry_free(centry);
2586                 return NT_STATUS_OK;
2587         }
2588
2589         *sid_mem = talloc_array(mem_ctx, DOM_SID, *num_names);
2590         *names = talloc_array(mem_ctx, char *, *num_names);
2591         *name_types = talloc_array(mem_ctx, uint32, *num_names);
2592
2593         if ((*sid_mem == NULL) || (*names == NULL) || (*name_types == NULL)) {
2594                 TALLOC_FREE(*sid_mem);
2595                 TALLOC_FREE(*names);
2596                 TALLOC_FREE(*name_types);
2597                 centry_free(centry);
2598                 return NT_STATUS_NO_MEMORY;
2599         }
2600
2601         for (i=0; i<(*num_names); i++) {
2602                 centry_sid(centry, &(*sid_mem)[i]);
2603                 (*names)[i] = centry_string(centry, mem_ctx);
2604                 (*name_types)[i] = centry_uint32(centry);
2605         }
2606
2607         status = centry->status;
2608
2609         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s "
2610                   "status: %s\n", domain->name, nt_errstr(status)));
2611
2612         centry_free(centry);
2613         return status;
2614 }
2615
2616 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2617                                 TALLOC_CTX *mem_ctx,
2618                                 const DOM_SID *group_sid,
2619                                 enum lsa_SidType type,
2620                                 uint32 *num_names,
2621                                 DOM_SID **sid_mem, char ***names,
2622                                 uint32 **name_types)
2623 {
2624         struct cache_entry *centry = NULL;
2625         NTSTATUS status;
2626         unsigned int i;
2627         fstring sid_string;
2628         bool old_status;
2629
2630         old_status = domain->online;
2631         status = wcache_lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2632                                         sid_mem, names, name_types);
2633         if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
2634                 return status;
2635         }
2636
2637         (*num_names) = 0;
2638         (*sid_mem) = NULL;
2639         (*names) = NULL;
2640         (*name_types) = NULL;
2641
2642         /* Return status value returned by seq number check */
2643
2644         if (!NT_STATUS_IS_OK(domain->last_status))
2645                 return domain->last_status;
2646
2647         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2648                 domain->name ));
2649
2650         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid,
2651                                                   type, num_names,
2652                                                   sid_mem, names, name_types);
2653
2654         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2655                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2656                 if (!domain->internal && old_status) {
2657                         set_domain_offline(domain);
2658                 }
2659                 if (!domain->internal &&
2660                         !domain->online &&
2661                         old_status) {
2662                         NTSTATUS cache_status;
2663                         cache_status = wcache_lookup_groupmem(domain, mem_ctx, group_sid,
2664                                                               num_names, sid_mem, names,
2665                                                               name_types);
2666                         return cache_status;
2667                 }
2668         }
2669         /* and save it */
2670         refresh_sequence_number(domain, false);
2671         if (!NT_STATUS_IS_OK(status)) {
2672                 return status;
2673         }
2674         centry = centry_start(domain, status);
2675         if (!centry)
2676                 goto skip_save;
2677         centry_put_uint32(centry, *num_names);
2678         for (i=0; i<(*num_names); i++) {
2679                 centry_put_sid(centry, &(*sid_mem)[i]);
2680                 centry_put_string(centry, (*names)[i]);
2681                 centry_put_uint32(centry, (*name_types)[i]);
2682         }
2683         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2684         centry_free(centry);
2685
2686 skip_save:
2687         return status;
2688 }
2689
2690 /* find the sequence number for a domain */
2691 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2692 {
2693         refresh_sequence_number(domain, false);
2694
2695         *seq = domain->sequence_number;
2696
2697         return NT_STATUS_OK;
2698 }
2699
2700 /* enumerate trusted domains
2701  * (we need to have the list of trustdoms in the cache when we go offline) -
2702  * Guenther */
2703 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2704                                 TALLOC_CTX *mem_ctx,
2705                                 struct netr_DomainTrustList *trusts)
2706 {
2707         NTSTATUS status;
2708         struct winbind_cache *cache;
2709         struct winbindd_tdc_domain *dom_list = NULL;
2710         size_t num_domains = 0;
2711         bool retval = false;
2712         int i;
2713         bool old_status;
2714
2715         old_status = domain->online;
2716         trusts->count = 0;
2717         trusts->array = NULL;
2718         if (domain->online) {
2719                 goto do_query;
2720         }
2721
2722         cache = get_cache(domain);
2723         if (!cache || !cache->tdb) {
2724                 goto do_query;
2725         }
2726
2727         retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2728         if (!retval || !num_domains || !dom_list) {
2729                 TALLOC_FREE(dom_list);
2730                 goto do_query;
2731         }
2732
2733 do_fetch_cache:
2734         trusts->array = TALLOC_ZERO_ARRAY(mem_ctx, struct netr_DomainTrust, num_domains);
2735         if (!trusts->array) {
2736                 TALLOC_FREE(dom_list);
2737                 return NT_STATUS_NO_MEMORY;
2738         }
2739
2740         for (i = 0; i < num_domains; i++) {
2741                 struct netr_DomainTrust *trust;
2742                 struct dom_sid *sid;
2743                 struct winbindd_domain *dom;
2744
2745                 dom = find_domain_from_name_noinit(dom_list[i].domain_name);
2746                 if (dom && dom->internal) {
2747                         continue;
2748                 }
2749
2750                 trust = &trusts->array[trusts->count];
2751                 trust->netbios_name = talloc_strdup(trusts->array, dom_list[i].domain_name);
2752                 trust->dns_name = talloc_strdup(trusts->array, dom_list[i].dns_name);
2753                 sid = talloc(trusts->array, struct dom_sid);
2754                 if (!trust->netbios_name || !trust->dns_name ||
2755                         !sid) {
2756                         TALLOC_FREE(dom_list);
2757                         TALLOC_FREE(trusts->array);
2758                         return NT_STATUS_NO_MEMORY;
2759                 }
2760
2761                 trust->trust_flags = dom_list[i].trust_flags;
2762                 trust->trust_attributes = dom_list[i].trust_attribs;
2763                 trust->trust_type = dom_list[i].trust_type;
2764                 sid_copy(sid, &dom_list[i].sid);
2765                 trust->sid = sid;
2766                 trusts->count++;
2767         }
2768
2769         TALLOC_FREE(dom_list);
2770         return NT_STATUS_OK;
2771
2772 do_query:
2773         /* Return status value returned by seq number check */
2774
2775         if (!NT_STATUS_IS_OK(domain->last_status))
2776                 return domain->last_status;
2777
2778         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2779                 domain->name ));
2780
2781         status = domain->backend->trusted_domains(domain, mem_ctx, trusts);
2782
2783         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2784                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2785                 if (!domain->internal && old_status) {
2786                         set_domain_offline(domain);
2787                 }
2788                 if (!domain->internal &&
2789                         !domain->online &&
2790                         old_status) {
2791                         retval = wcache_tdc_fetch_list(&dom_list, &num_domains);
2792                         if (retval && num_domains && dom_list) {
2793                                 TALLOC_FREE(trusts->array);
2794                                 trusts->count = 0;
2795                                 goto do_fetch_cache;
2796                         }
2797                 }
2798         }
2799         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2800          * so that the generic centry handling still applies correctly -
2801          * Guenther*/
2802
2803         if (!NT_STATUS_IS_ERR(status)) {
2804                 status = NT_STATUS_OK;
2805         }
2806         return status;
2807 }
2808
2809 /* get lockout policy */
2810 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2811                                TALLOC_CTX *mem_ctx,
2812                                struct samr_DomInfo12 *policy)
2813 {
2814         struct winbind_cache *cache = get_cache(domain);
2815         struct cache_entry *centry = NULL;
2816         NTSTATUS status;
2817         bool old_status;
2818
2819         old_status = domain->online;
2820         if (!cache->tdb)
2821                 goto do_query;
2822
2823         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2824
2825         if (!centry)
2826                 goto do_query;
2827
2828 do_fetch_cache:
2829         policy->lockout_duration = centry_nttime(centry);
2830         policy->lockout_window = centry_nttime(centry);
2831         policy->lockout_threshold = centry_uint16(centry);
2832
2833         status = centry->status;
2834
2835         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2836                 domain->name, nt_errstr(status) ));
2837
2838         centry_free(centry);
2839         return status;
2840
2841 do_query:
2842         ZERO_STRUCTP(policy);
2843
2844         /* Return status value returned by seq number check */
2845
2846         if (!NT_STATUS_IS_OK(domain->last_status))
2847                 return domain->last_status;
2848
2849         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2850                 domain->name ));
2851
2852         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2853
2854         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2855                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2856                 if (!domain->internal && old_status) {
2857                         set_domain_offline(domain);
2858                 }
2859                 if (cache->tdb &&
2860                         !domain->internal &&
2861                         !domain->online &&
2862                         old_status) {
2863                         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2864                         if (centry) {
2865                                 goto do_fetch_cache;
2866                         }
2867                 }
2868         }
2869         /* and save it */
2870         refresh_sequence_number(domain, false);
2871         if (!NT_STATUS_IS_OK(status)) {
2872                 return status;
2873         }
2874         wcache_save_lockout_policy(domain, status, policy);
2875
2876         return status;
2877 }
2878
2879 /* get password policy */
2880 static NTSTATUS password_policy(struct winbindd_domain *domain,
2881                                 TALLOC_CTX *mem_ctx,
2882                                 struct samr_DomInfo1 *policy)
2883 {
2884         struct winbind_cache *cache = get_cache(domain);
2885         struct cache_entry *centry = NULL;
2886         NTSTATUS status;
2887         bool old_status;
2888
2889         old_status = domain->online;
2890         if (!cache->tdb)
2891                 goto do_query;
2892
2893         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2894
2895         if (!centry)
2896                 goto do_query;
2897
2898 do_fetch_cache:
2899         policy->min_password_length = centry_uint16(centry);
2900         policy->password_history_length = centry_uint16(centry);
2901         policy->password_properties = centry_uint32(centry);
2902         policy->max_password_age = centry_nttime(centry);
2903         policy->min_password_age = centry_nttime(centry);
2904
2905         status = centry->status;
2906
2907         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2908                 domain->name, nt_errstr(status) ));
2909
2910         centry_free(centry);
2911         return status;
2912
2913 do_query:
2914         ZERO_STRUCTP(policy);
2915
2916         /* Return status value returned by seq number check */
2917
2918         if (!NT_STATUS_IS_OK(domain->last_status))
2919                 return domain->last_status;
2920
2921         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2922                 domain->name ));
2923
2924         status = domain->backend->password_policy(domain, mem_ctx, policy);
2925
2926         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT) ||
2927                 NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2928                 if (!domain->internal && old_status) {
2929                         set_domain_offline(domain);
2930                 }
2931                 if (cache->tdb &&
2932                         !domain->internal &&
2933                         !domain->online &&
2934                         old_status) {
2935                         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2936                         if (centry) {
2937                                 goto do_fetch_cache;
2938                         }
2939                 }
2940         }
2941         /* and save it */
2942         refresh_sequence_number(domain, false);
2943         if (!NT_STATUS_IS_OK(status)) {
2944                 return status;
2945         }
2946         wcache_save_password_policy(domain, status, policy);
2947
2948         return status;
2949 }
2950
2951
2952 /* Invalidate cached user and group lists coherently */
2953
2954 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2955                        void *state)
2956 {
2957         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2958             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2959                 tdb_delete(the_tdb, kbuf);
2960
2961         return 0;
2962 }
2963
2964 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2965
2966 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2967                                 struct netr_SamInfo3 *info3)
2968 {
2969         DOM_SID sid;
2970         fstring key_str, sid_string;
2971         struct winbind_cache *cache;
2972
2973         /* dont clear cached U/SID and UG/SID entries when we want to logon
2974          * offline - gd */
2975
2976         if (lp_winbind_offline_logon()) {
2977                 return;
2978         }
2979
2980         if (!domain)
2981                 return;
2982
2983         cache = get_cache(domain);
2984
2985         if (!cache->tdb) {
2986                 return;
2987         }
2988
2989         sid_copy(&sid, info3->base.domain_sid);
2990         sid_append_rid(&sid, info3->base.rid);
2991
2992         /* Clear U/SID cache entry */
2993         fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2994         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2995         tdb_delete(cache->tdb, string_tdb_data(key_str));
2996
2997         /* Clear UG/SID cache entry */
2998         fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2999         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
3000         tdb_delete(cache->tdb, string_tdb_data(key_str));
3001
3002         /* Samba/winbindd never needs this. */
3003         netsamlogon_clear_cached_user(info3);
3004 }
3005
3006 bool wcache_invalidate_cache(void)
3007 {
3008         struct winbindd_domain *domain;
3009
3010         for (domain = domain_list(); domain; domain = domain->next) {
3011                 struct winbind_cache *cache = get_cache(domain);
3012
3013                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
3014                            "entries for %s\n", domain->name));
3015                 if (cache) {
3016                         if (cache->tdb) {
3017                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
3018                         } else {
3019                                 return false;
3020                         }
3021                 }
3022         }
3023         return true;
3024 }
3025
3026 bool init_wcache(void)
3027 {
3028         if (wcache == NULL) {
3029                 wcache = SMB_XMALLOC_P(struct winbind_cache);
3030                 ZERO_STRUCTP(wcache);
3031         }
3032
3033         if (wcache->tdb != NULL)
3034                 return true;
3035
3036         /* when working offline we must not clear the cache on restart */
3037         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3038                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3039                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3040                                 O_RDWR|O_CREAT, 0600);
3041
3042         if (wcache->tdb == NULL) {
3043                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3044                 return false;
3045         }
3046
3047         return true;
3048 }
3049
3050 /************************************************************************
3051  This is called by the parent to initialize the cache file.
3052  We don't need sophisticated locking here as we know we're the
3053  only opener.
3054 ************************************************************************/
3055
3056 bool initialize_winbindd_cache(void)
3057 {
3058         bool cache_bad = true;
3059         uint32 vers;
3060
3061         if (!init_wcache()) {
3062                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
3063                 return false;
3064         }
3065
3066         /* Check version number. */
3067         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
3068                         vers == WINBINDD_CACHE_VERSION) {
3069                 cache_bad = false;
3070         }
3071
3072         if (cache_bad) {
3073                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
3074                         "and re-creating with version number %d\n",
3075                         WINBINDD_CACHE_VERSION ));
3076
3077                 tdb_close(wcache->tdb);
3078                 wcache->tdb = NULL;
3079
3080                 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
3081                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
3082                                 cache_path("winbindd_cache.tdb"),
3083                                 strerror(errno) ));
3084                         return false;
3085                 }
3086                 if (!init_wcache()) {
3087                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
3088                                         "init_wcache failed.\n"));
3089                         return false;
3090                 }
3091
3092                 /* Write the version. */
3093                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
3094                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
3095                                 tdb_errorstr(wcache->tdb) ));
3096                         return false;
3097                 }
3098         }
3099
3100         tdb_close(wcache->tdb);
3101         wcache->tdb = NULL;
3102         return true;
3103 }
3104
3105 void close_winbindd_cache(void)
3106 {
3107         if (!wcache) {
3108                 return;
3109         }
3110         if (wcache->tdb) {
3111                 tdb_close(wcache->tdb);
3112                 wcache->tdb = NULL;
3113         }
3114 }
3115
3116 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
3117                        char **domain_name, char **name,
3118                        enum lsa_SidType *type)
3119 {
3120         struct winbindd_domain *domain;
3121         NTSTATUS status;
3122
3123         domain = find_lookup_domain_from_sid(sid);
3124         if (domain == NULL) {
3125                 return false;
3126         }
3127         status = wcache_sid_to_name(domain, sid, mem_ctx, domain_name, name,
3128                                     type);
3129         return NT_STATUS_IS_OK(status);
3130 }
3131
3132 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
3133                         const char *domain_name,
3134                         const char *name,
3135                         DOM_SID *sid,
3136                         enum lsa_SidType *type)
3137 {
3138         struct winbindd_domain *domain;
3139         NTSTATUS status;
3140         bool original_online_state;
3141
3142         domain = find_lookup_domain_from_name(domain_name);
3143         if (domain == NULL) {
3144                 return false;
3145         }
3146
3147         /* If we are doing a cached logon, temporarily set the domain
3148            offline so the cache won't expire the entry */
3149
3150         original_online_state = domain->online;
3151         domain->online = false;
3152         status = wcache_name_to_sid(domain, domain_name, name, sid, type);
3153         domain->online = original_online_state;
3154
3155         return NT_STATUS_IS_OK(status);
3156 }
3157
3158 void cache_name2sid(struct winbindd_domain *domain,
3159                     const char *domain_name, const char *name,
3160                     enum lsa_SidType type, const DOM_SID *sid)
3161 {
3162         refresh_sequence_number(domain, false);
3163         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
3164                                 sid, type);
3165 }
3166
3167 /*
3168  * The original idea that this cache only contains centries has
3169  * been blurred - now other stuff gets put in here. Ensure we
3170  * ignore these things on cleanup.
3171  */
3172
3173 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
3174                                TDB_DATA dbuf, void *state)
3175 {
3176         struct cache_entry *centry;
3177
3178         if (is_non_centry_key(kbuf)) {
3179                 return 0;
3180         }
3181
3182         centry = wcache_fetch_raw((char *)kbuf.dptr);
3183         if (!centry) {
3184                 return 0;
3185         }
3186
3187         if (!NT_STATUS_IS_OK(centry->status)) {
3188                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
3189                 tdb_delete(the_tdb, kbuf);
3190         }
3191
3192         centry_free(centry);
3193         return 0;
3194 }
3195
3196 /* flush the cache */
3197 void wcache_flush_cache(void)
3198 {
3199         if (!wcache)
3200                 return;
3201         if (wcache->tdb) {
3202                 tdb_close(wcache->tdb);
3203                 wcache->tdb = NULL;
3204         }
3205         if (!winbindd_use_cache()) {
3206                 return;
3207         }
3208
3209         /* when working offline we must not clear the cache on restart */
3210         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
3211                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3212                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
3213                                 O_RDWR|O_CREAT, 0600);
3214
3215         if (!wcache->tdb) {
3216                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
3217                 return;
3218         }
3219
3220         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
3221
3222         DEBUG(10,("wcache_flush_cache success\n"));
3223 }
3224
3225 /* Count cached creds */
3226
3227 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3228                                     void *state)
3229 {
3230         int *cred_count = (int*)state;
3231
3232         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3233                 (*cred_count)++;
3234         }
3235         return 0;
3236 }
3237
3238 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
3239 {
3240         struct winbind_cache *cache = get_cache(domain);
3241
3242         *count = 0;
3243
3244         if (!cache->tdb) {
3245                 return NT_STATUS_INTERNAL_DB_ERROR;
3246         }
3247
3248         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
3249
3250         return NT_STATUS_OK;
3251 }
3252
3253 struct cred_list {
3254         struct cred_list *prev, *next;
3255         TDB_DATA key;
3256         fstring name;
3257         time_t created;
3258 };
3259 static struct cred_list *wcache_cred_list;
3260
3261 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
3262                                     void *state)
3263 {
3264         struct cred_list *cred;
3265
3266         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
3267
3268                 cred = SMB_MALLOC_P(struct cred_list);
3269                 if (cred == NULL) {
3270                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
3271                         return -1;
3272                 }
3273
3274                 ZERO_STRUCTP(cred);
3275
3276                 /* save a copy of the key */
3277
3278                 fstrcpy(cred->name, (const char *)kbuf.dptr);
3279                 DLIST_ADD(wcache_cred_list, cred);
3280         }
3281
3282         return 0;
3283 }
3284
3285 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
3286 {
3287         struct winbind_cache *cache = get_cache(domain);
3288         NTSTATUS status;
3289         int ret;
3290         struct cred_list *cred, *oldest = NULL;
3291
3292         if (!cache->tdb) {
3293                 return NT_STATUS_INTERNAL_DB_ERROR;
3294         }
3295
3296         /* we possibly already have an entry */
3297         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
3298
3299                 fstring key_str, tmp;
3300
3301                 DEBUG(11,("we already have an entry, deleting that\n"));
3302
3303                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
3304
3305                 tdb_delete(cache->tdb, string_tdb_data(key_str));
3306
3307                 return NT_STATUS_OK;
3308         }
3309
3310         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
3311         if (ret == 0) {
3312                 return NT_STATUS_OK;
3313         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
3314                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3315         }
3316
3317         ZERO_STRUCTP(oldest);
3318
3319         for (cred = wcache_cred_list; cred; cred = cred->next) {
3320
3321                 TDB_DATA data;
3322                 time_t t;
3323
3324                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
3325                 if (!data.dptr) {
3326                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
3327                                 cred->name));
3328                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
3329                         goto done;
3330                 }
3331
3332                 t = IVAL(data.dptr, 0);
3333                 SAFE_FREE(data.dptr);
3334
3335                 if (!oldest) {
3336                         oldest = SMB_MALLOC_P(struct cred_list);
3337                         if (oldest == NULL) {
3338                                 status = NT_STATUS_NO_MEMORY;
3339                                 goto done;
3340                         }
3341
3342                         fstrcpy(oldest->name, cred->name);
3343                         oldest->created = t;
3344                         continue;
3345                 }
3346
3347                 if (t < oldest->created) {
3348                         fstrcpy(oldest->name, cred->name);
3349                         oldest->created = t;
3350                 }
3351         }
3352
3353         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3354                 status = NT_STATUS_OK;
3355         } else {
3356                 status = NT_STATUS_UNSUCCESSFUL;
3357         }
3358 done:
3359         SAFE_FREE(wcache_cred_list);
3360         SAFE_FREE(oldest);
3361
3362         return status;
3363 }
3364
3365 /* Change the global online/offline state. */
3366 bool set_global_winbindd_state_offline(void)
3367 {
3368         TDB_DATA data;
3369
3370         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3371
3372         /* Only go offline if someone has created
3373            the key "WINBINDD_OFFLINE" in the cache tdb. */
3374
3375         if (wcache == NULL || wcache->tdb == NULL) {
3376                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3377                 return false;
3378         }
3379
3380         if (!lp_winbind_offline_logon()) {
3381                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3382                 return false;
3383         }
3384
3385         if (global_winbindd_offline_state) {
3386                 /* Already offline. */
3387                 return true;
3388         }
3389
3390         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3391
3392         if (!data.dptr || data.dsize != 4) {
3393                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3394                 SAFE_FREE(data.dptr);
3395                 return false;
3396         } else {
3397                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3398                 global_winbindd_offline_state = true;
3399                 SAFE_FREE(data.dptr);
3400                 return true;
3401         }
3402 }
3403
3404 void set_global_winbindd_state_online(void)
3405 {
3406         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3407
3408         if (!lp_winbind_offline_logon()) {
3409                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3410                 return;
3411         }
3412
3413         if (!global_winbindd_offline_state) {
3414                 /* Already online. */
3415                 return;
3416         }
3417         global_winbindd_offline_state = false;
3418
3419         if (!wcache->tdb) {
3420                 return;
3421         }
3422
3423         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3424         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3425 }
3426
3427 bool get_global_winbindd_state_offline(void)
3428 {
3429         return global_winbindd_offline_state;
3430 }
3431
3432 /***********************************************************************
3433  Validate functions for all possible cache tdb keys.
3434 ***********************************************************************/
3435
3436 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3437                                                   struct tdb_validation_status *state)
3438 {
3439         struct cache_entry *centry;
3440
3441         centry = SMB_XMALLOC_P(struct cache_entry);
3442         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3443         if (!centry->data) {
3444                 SAFE_FREE(centry);
3445                 return NULL;
3446         }
3447         centry->len = data.dsize;
3448         centry->ofs = 0;
3449
3450         if (centry->len < 8) {
3451                 /* huh? corrupt cache? */
3452                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3453                 centry_free(centry);
3454                 state->bad_entry = true;
3455                 state->success = false;
3456                 return NULL;
3457         }
3458
3459         centry->status = NT_STATUS(centry_uint32(centry));
3460         centry->sequence_number = centry_uint32(centry);
3461         return centry;
3462 }
3463
3464 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3465                            struct tdb_validation_status *state)
3466 {
3467         if (dbuf.dsize != 8) {
3468                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3469                                 keystr, (unsigned int)dbuf.dsize ));
3470                 state->bad_entry = true;
3471                 return 1;
3472         }
3473         return 0;
3474 }
3475
3476 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3477                        struct tdb_validation_status *state)
3478 {
3479         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3480         if (!centry) {
3481                 return 1;
3482         }
3483
3484         (void)centry_uint32(centry);
3485         if (NT_STATUS_IS_OK(centry->status)) {
3486                 DOM_SID sid;
3487                 (void)centry_sid(centry, &sid);
3488         }
3489
3490         centry_free(centry);
3491
3492         if (!(state->success)) {
3493                 return 1;
3494         }
3495         DEBUG(10,("validate_ns: %s ok\n", keystr));
3496         return 0;
3497 }
3498
3499 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3500                        struct tdb_validation_status *state)
3501 {
3502         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3503         if (!centry) {
3504                 return 1;
3505         }
3506
3507         if (NT_STATUS_IS_OK(centry->status)) {
3508                 (void)centry_uint32(centry);
3509                 (void)centry_string(centry, mem_ctx);
3510                 (void)centry_string(centry, mem_ctx);
3511         }
3512
3513         centry_free(centry);
3514
3515         if (!(state->success)) {
3516                 return 1;
3517         }
3518         DEBUG(10,("validate_sn: %s ok\n", keystr));
3519         return 0;
3520 }
3521
3522 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3523                       struct tdb_validation_status *state)
3524 {
3525         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3526         DOM_SID sid;
3527
3528         if (!centry) {
3529                 return 1;
3530         }
3531
3532         (void)centry_string(centry, mem_ctx);
3533         (void)centry_string(centry, mem_ctx);
3534         (void)centry_string(centry, mem_ctx);
3535         (void)centry_string(centry, mem_ctx);
3536         (void)centry_uint32(centry);
3537         (void)centry_sid(centry, &sid);
3538         (void)centry_sid(centry, &sid);
3539
3540         centry_free(centry);
3541
3542         if (!(state->success)) {
3543                 return 1;
3544         }
3545         DEBUG(10,("validate_u: %s ok\n", keystr));
3546         return 0;
3547 }
3548
3549 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3550                             struct tdb_validation_status *state)
3551 {
3552         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3553
3554         if (!centry) {
3555                 return 1;
3556         }
3557
3558         (void)centry_nttime(centry);
3559         (void)centry_nttime(centry);
3560         (void)centry_uint16(centry);
3561
3562         centry_free(centry);
3563
3564         if (!(state->success)) {
3565                 return 1;
3566         }
3567         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3568         return 0;
3569 }
3570
3571 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3572                             struct tdb_validation_status *state)
3573 {
3574         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3575
3576         if (!centry) {
3577                 return 1;
3578         }
3579
3580         (void)centry_uint16(centry);
3581         (void)centry_uint16(centry);
3582         (void)centry_uint32(centry);
3583         (void)centry_nttime(centry);
3584         (void)centry_nttime(centry);
3585
3586         centry_free(centry);
3587
3588         if (!(state->success)) {
3589                 return 1;
3590         }
3591         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3592         return 0;
3593 }
3594
3595 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3596                          struct tdb_validation_status *state)
3597 {
3598         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3599
3600         if (!centry) {
3601                 return 1;
3602         }
3603
3604         (void)centry_time(centry);
3605         (void)centry_hash16(centry, mem_ctx);
3606
3607         /* We only have 17 bytes more data in the salted cred case. */
3608         if (centry->len - centry->ofs == 17) {
3609                 (void)centry_hash16(centry, mem_ctx);
3610         }
3611
3612         centry_free(centry);
3613
3614         if (!(state->success)) {
3615                 return 1;
3616         }
3617         DEBUG(10,("validate_cred: %s ok\n", keystr));
3618         return 0;
3619 }
3620
3621 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3622                        struct tdb_validation_status *state)
3623 {
3624         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3625         int32 num_entries, i;
3626
3627         if (!centry) {
3628                 return 1;
3629         }
3630
3631         num_entries = (int32)centry_uint32(centry);
3632
3633         for (i=0; i< num_entries; i++) {
3634                 DOM_SID sid;
3635                 (void)centry_string(centry, mem_ctx);
3636                 (void)centry_string(centry, mem_ctx);
3637                 (void)centry_string(centry, mem_ctx);
3638                 (void)centry_string(centry, mem_ctx);
3639                 (void)centry_sid(centry, &sid);
3640                 (void)centry_sid(centry, &sid);
3641         }
3642
3643         centry_free(centry);
3644
3645         if (!(state->success)) {
3646                 return 1;
3647         }
3648         DEBUG(10,("validate_ul: %s ok\n", keystr));
3649         return 0;
3650 }
3651
3652 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3653                        struct tdb_validation_status *state)
3654 {
3655         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3656         int32 num_entries, i;
3657
3658         if (!centry) {
3659                 return 1;
3660         }
3661
3662         num_entries = centry_uint32(centry);
3663
3664         for (i=0; i< num_entries; i++) {
3665                 (void)centry_string(centry, mem_ctx);
3666                 (void)centry_string(centry, mem_ctx);
3667                 (void)centry_uint32(centry);
3668         }
3669
3670         centry_free(centry);
3671
3672         if (!(state->success)) {
3673                 return 1;
3674         }
3675         DEBUG(10,("validate_gl: %s ok\n", keystr));
3676         return 0;
3677 }
3678
3679 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3680                        struct tdb_validation_status *state)
3681 {
3682         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3683         int32 num_groups, i;
3684
3685         if (!centry) {
3686                 return 1;
3687         }
3688
3689         num_groups = centry_uint32(centry);
3690
3691         for (i=0; i< num_groups; i++) {
3692                 DOM_SID sid;
3693                 centry_sid(centry, &sid);
3694         }
3695
3696         centry_free(centry);
3697
3698         if (!(state->success)) {
3699                 return 1;
3700         }
3701         DEBUG(10,("validate_ug: %s ok\n", keystr));
3702         return 0;
3703 }
3704
3705 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3706                        struct tdb_validation_status *state)
3707 {
3708         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3709         int32 num_aliases, i;
3710
3711         if (!centry) {
3712                 return 1;
3713         }
3714
3715         num_aliases = centry_uint32(centry);
3716
3717         for (i=0; i < num_aliases; i++) {
3718                 (void)centry_uint32(centry);
3719         }
3720
3721         centry_free(centry);
3722
3723         if (!(state->success)) {
3724                 return 1;
3725         }
3726         DEBUG(10,("validate_ua: %s ok\n", keystr));
3727         return 0;
3728 }
3729
3730 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3731                        struct tdb_validation_status *state)
3732 {
3733         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3734         int32 num_names, i;
3735
3736         if (!centry) {
3737                 return 1;
3738         }
3739
3740         num_names = centry_uint32(centry);
3741
3742         for (i=0; i< num_names; i++) {
3743                 DOM_SID sid;
3744                 centry_sid(centry, &sid);
3745                 (void)centry_string(centry, mem_ctx);
3746                 (void)centry_uint32(centry);
3747         }
3748
3749         centry_free(centry);
3750
3751         if (!(state->success)) {
3752                 return 1;
3753         }
3754         DEBUG(10,("validate_gm: %s ok\n", keystr));
3755         return 0;
3756 }
3757
3758 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3759                        struct tdb_validation_status *state)
3760 {
3761         /* Can't say anything about this other than must be nonzero. */
3762         if (dbuf.dsize == 0) {
3763                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3764                                 keystr));
3765                 state->bad_entry = true;
3766                 state->success = false;
3767                 return 1;
3768         }
3769
3770         DEBUG(10,("validate_dr: %s ok\n", keystr));
3771         return 0;
3772 }
3773
3774 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3775                        struct tdb_validation_status *state)
3776 {
3777         /* Can't say anything about this other than must be nonzero. */
3778         if (dbuf.dsize == 0) {
3779                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3780                                 keystr));
3781                 state->bad_entry = true;
3782                 state->success = false;
3783                 return 1;
3784         }
3785
3786         DEBUG(10,("validate_de: %s ok\n", keystr));
3787         return 0;
3788 }
3789
3790 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3791                            TDB_DATA dbuf, struct tdb_validation_status *state)
3792 {
3793         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3794
3795         if (!centry) {
3796                 return 1;
3797         }
3798
3799         (void)centry_string(centry, mem_ctx);
3800         (void)centry_string(centry, mem_ctx);
3801         (void)centry_string(centry, mem_ctx);
3802         (void)centry_uint32(centry);
3803
3804         centry_free(centry);
3805
3806         if (!(state->success)) {
3807                 return 1;
3808         }
3809         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3810         return 0;
3811 }
3812
3813 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3814                            TDB_DATA dbuf,
3815                            struct tdb_validation_status *state)
3816 {
3817         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3818
3819         if (!centry) {
3820                 return 1;
3821         }
3822
3823         (void)centry_string( centry, mem_ctx );
3824
3825         centry_free(centry);
3826
3827         if (!(state->success)) {
3828                 return 1;
3829         }
3830         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3831         return 0;
3832 }
3833
3834 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3835                            TDB_DATA dbuf,
3836                            struct tdb_validation_status *state)
3837 {
3838         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3839
3840         if (!centry) {
3841                 return 1;
3842         }
3843
3844         (void)centry_string( centry, mem_ctx );
3845
3846         centry_free(centry);
3847
3848         if (!(state->success)) {
3849                 return 1;
3850         }
3851         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3852         return 0;
3853 }
3854
3855 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3856                                   TDB_DATA dbuf,
3857                                   struct tdb_validation_status *state)
3858 {
3859         if (dbuf.dsize == 0) {
3860                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3861                           "key %s (len ==0) ?\n", keystr));
3862                 state->bad_entry = true;
3863                 state->success = false;
3864                 return 1;
3865         }
3866
3867         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3868         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3869         return 0;
3870 }
3871
3872 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3873                             struct tdb_validation_status *state)
3874 {
3875         if (dbuf.dsize != 4) {
3876                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3877                                 keystr, (unsigned int)dbuf.dsize ));
3878                 state->bad_entry = true;
3879                 state->success = false;
3880                 return 1;
3881         }
3882         DEBUG(10,("validate_offline: %s ok\n", keystr));
3883         return 0;
3884 }
3885
3886 static int validate_ndr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3887                         struct tdb_validation_status *state)
3888 {
3889         /*
3890          * Ignore validation for now. The proper way to do this is with a
3891          * checksum. Just pure parsing does not really catch much.
3892          */
3893         return 0;
3894 }
3895
3896 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3897                                   struct tdb_validation_status *state)
3898 {
3899         if (dbuf.dsize != 4) {
3900                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3901                           "key %s (len %u != 4) ?\n",
3902                           keystr, (unsigned int)dbuf.dsize));
3903                 state->bad_entry = true;
3904                 state->success = false;
3905                 return 1;
3906         }
3907
3908         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3909         return 0;
3910 }
3911
3912 /***********************************************************************
3913  A list of all possible cache tdb keys with associated validation
3914  functions.
3915 ***********************************************************************/
3916
3917 struct key_val_struct {
3918         const char *keyname;
3919         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3920 } key_val[] = {
3921         {"SEQNUM/", validate_seqnum},
3922         {"NS/", validate_ns},
3923         {"SN/", validate_sn},
3924         {"U/", validate_u},
3925         {"LOC_POL/", validate_loc_pol},
3926         {"PWD_POL/", validate_pwd_pol},
3927         {"CRED/", validate_cred},
3928         {"UL/", validate_ul},
3929         {"GL/", validate_gl},
3930         {"UG/", validate_ug},
3931         {"UA", validate_ua},
3932         {"GM/", validate_gm},
3933         {"DR/", validate_dr},
3934         {"DE/", validate_de},
3935         {"NSS/PWINFO/", validate_pwinfo},
3936         {"TRUSTDOMCACHE/", validate_trustdomcache},
3937         {"NSS/NA/", validate_nss_na},
3938         {"NSS/AN/", validate_nss_an},
3939         {"WINBINDD_OFFLINE", validate_offline},
3940         {"NDR/", validate_ndr},
3941         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3942         {NULL, NULL}
3943 };
3944
3945 /***********************************************************************
3946  Function to look at every entry in the tdb and validate it as far as
3947  possible.
3948 ***********************************************************************/
3949
3950 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3951 {
3952         int i;
3953         unsigned int max_key_len = 1024;
3954         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3955
3956         /* Paranoia check. */
3957         if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3958                 max_key_len = 1024 * 1024;
3959         }
3960         if (kbuf.dsize > max_key_len) {
3961                 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3962                           "(%u) > (%u)\n\n",
3963                           (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3964                 return 1;
3965         }
3966
3967         for (i = 0; key_val[i].keyname; i++) {
3968                 size_t namelen = strlen(key_val[i].keyname);
3969                 if (kbuf.dsize >= namelen && (
3970                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3971                         TALLOC_CTX *mem_ctx;
3972                         char *keystr;
3973                         int ret;
3974
3975                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3976                         if (!keystr) {
3977                                 return 1;
3978                         }
3979                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
3980                         keystr[kbuf.dsize] = '\0';
3981
3982                         mem_ctx = talloc_init("validate_ctx");
3983                         if (!mem_ctx) {
3984                                 SAFE_FREE(keystr);
3985                                 return 1;
3986                         }
3987
3988                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3989                                                           v_state);
3990
3991                         SAFE_FREE(keystr);
3992                         talloc_destroy(mem_ctx);
3993                         return ret;
3994                 }
3995         }
3996
3997         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3998         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3999         DEBUG(0,("data :\n"));
4000         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
4001         v_state->unknown_key = true;
4002         v_state->success = false;
4003         return 1; /* terminate. */
4004 }
4005
4006 static void validate_panic(const char *const why)
4007 {
4008         DEBUG(0,("validating cache: would panic %s\n", why ));
4009         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
4010         exit(47);
4011 }
4012
4013 /***********************************************************************
4014  Try and validate every entry in the winbindd cache. If we fail here,
4015  delete the cache tdb and return non-zero.
4016 ***********************************************************************/
4017
4018 int winbindd_validate_cache(void)
4019 {
4020         int ret = -1;
4021         const char *tdb_path = cache_path("winbindd_cache.tdb");
4022         TDB_CONTEXT *tdb = NULL;
4023
4024         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4025         smb_panic_fn = validate_panic;
4026
4027
4028         tdb = tdb_open_log(tdb_path,
4029                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
4030                            ( lp_winbind_offline_logon()
4031                              ? TDB_DEFAULT
4032                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
4033                            O_RDWR|O_CREAT,
4034                            0600);
4035         if (!tdb) {
4036                 DEBUG(0, ("winbindd_validate_cache: "
4037                           "error opening/initializing tdb\n"));
4038                 goto done;
4039         }
4040         tdb_close(tdb);
4041
4042         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
4043
4044         if (ret != 0) {
4045                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
4046                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
4047                 unlink(tdb_path);
4048         }
4049
4050 done:
4051         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
4052         smb_panic_fn = smb_panic;
4053         return ret;
4054 }
4055
4056 /***********************************************************************
4057  Try and validate every entry in the winbindd cache.
4058 ***********************************************************************/
4059
4060 int winbindd_validate_cache_nobackup(void)
4061 {
4062         int ret = -1;
4063         const char *tdb_path = cache_path("winbindd_cache.tdb");
4064
4065         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
4066         smb_panic_fn = validate_panic;
4067
4068
4069         if (wcache == NULL || wcache->tdb == NULL) {
4070                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
4071         } else {
4072                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
4073         }
4074
4075         if (ret != 0) {
4076                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
4077                            "successful.\n"));
4078         }
4079
4080         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
4081                    "function\n"));
4082         smb_panic_fn = smb_panic;
4083         return ret;
4084 }
4085
4086 bool winbindd_cache_validate_and_initialize(void)
4087 {
4088         close_winbindd_cache();
4089
4090         if (lp_winbind_offline_logon()) {
4091                 if (winbindd_validate_cache() < 0) {
4092                         DEBUG(0, ("winbindd cache tdb corrupt and no backup "
4093                                   "could be restored.\n"));
4094                 }
4095         }
4096
4097         return initialize_winbindd_cache();
4098 }
4099
4100 /*********************************************************************
4101  ********************************************************************/
4102
4103 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
4104                                        struct winbindd_tdc_domain **domains,
4105                                        size_t *num_domains )
4106 {
4107         struct winbindd_tdc_domain *list = NULL;
4108         size_t idx;
4109         int i;
4110         bool set_only = false;
4111
4112         /* don't allow duplicates */
4113
4114         idx = *num_domains;
4115         list = *domains;
4116
4117         for ( i=0; i< (*num_domains); i++ ) {
4118                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
4119                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
4120                                   new_dom->name));
4121                         idx = i;
4122                         set_only = true;
4123
4124                         break;
4125                 }
4126         }
4127
4128         if ( !set_only ) {
4129                 if ( !*domains ) {
4130                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
4131                         idx = 0;
4132                 } else {
4133                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
4134                                                      struct winbindd_tdc_domain,
4135                                                      (*num_domains)+1);
4136                         idx = *num_domains;
4137                 }
4138
4139                 ZERO_STRUCT( list[idx] );
4140         }
4141
4142         if ( !list )
4143                 return false;
4144
4145         list[idx].domain_name = talloc_strdup( list, new_dom->name );
4146         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
4147
4148         if ( !is_null_sid( &new_dom->sid ) ) {
4149                 sid_copy( &list[idx].sid, &new_dom->sid );
4150         } else {
4151                 sid_copy(&list[idx].sid, &global_sid_NULL);
4152         }
4153
4154         if ( new_dom->domain_flags != 0x0 )
4155                 list[idx].trust_flags = new_dom->domain_flags;
4156
4157         if ( new_dom->domain_type != 0x0 )
4158                 list[idx].trust_type = new_dom->domain_type;
4159
4160         if ( new_dom->domain_trust_attribs != 0x0 )
4161                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
4162
4163         if ( !set_only ) {
4164                 *domains = list;
4165                 *num_domains = idx + 1;
4166         }
4167
4168         return true;
4169 }
4170
4171 /*********************************************************************
4172  ********************************************************************/
4173
4174 static TDB_DATA make_tdc_key( const char *domain_name )
4175 {
4176         char *keystr = NULL;
4177         TDB_DATA key = { NULL, 0 };
4178
4179         if ( !domain_name ) {
4180                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
4181                 return key;
4182         }
4183
4184         if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
4185                 return key;
4186         }
4187         key = string_term_tdb_data(keystr);
4188
4189         return key;
4190 }
4191
4192 /*********************************************************************
4193  ********************************************************************/
4194
4195 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
4196                              size_t num_domains,
4197                              unsigned char **buf )
4198 {
4199         unsigned char *buffer = NULL;
4200         int len = 0;
4201         int buflen = 0;
4202         int i = 0;
4203
4204         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
4205                   (int)num_domains));
4206
4207         buflen = 0;
4208
4209  again:
4210         len = 0;
4211
4212         /* Store the number of array items first */
4213         len += tdb_pack( buffer+len, buflen-len, "d",
4214                          num_domains );
4215
4216         /* now pack each domain trust record */
4217         for ( i=0; i<num_domains; i++ ) {
4218
4219                 fstring tmp;
4220
4221                 if ( buflen > 0 ) {
4222                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
4223                                   domains[i].domain_name,
4224                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
4225                 }
4226
4227                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
4228                                  domains[i].domain_name,
4229                                  domains[i].dns_name,
4230                                  sid_to_fstring(tmp, &domains[i].sid),
4231                                  domains[i].trust_flags,
4232                                  domains[i].trust_attribs,
4233                                  domains[i].trust_type );
4234         }
4235
4236         if ( buflen < len ) {
4237                 SAFE_FREE(buffer);
4238                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
4239                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
4240                         buflen = -1;
4241                         goto done;
4242                 }
4243                 buflen = len;
4244                 goto again;
4245         }
4246
4247         *buf = buffer;
4248
4249  done:
4250         return buflen;
4251 }
4252
4253 /*********************************************************************
4254  ********************************************************************/
4255
4256 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
4257                                   struct winbindd_tdc_domain **domains )
4258 {
4259         fstring domain_name, dns_name, sid_string;
4260         uint32 type, attribs, flags;
4261         int num_domains;
4262         int len = 0;
4263         int i;
4264         struct winbindd_tdc_domain *list = NULL;
4265
4266         /* get the number of domains */
4267         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
4268         if ( len == -1 ) {
4269                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4270                 return 0;
4271         }
4272
4273         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
4274         if ( !list ) {
4275                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
4276                 return 0;
4277         }
4278
4279         for ( i=0; i<num_domains; i++ ) {
4280                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
4281                                    domain_name,
4282                                    dns_name,
4283                                    sid_string,
4284                                    &flags,
4285                                    &attribs,
4286                                    &type );
4287
4288                 if ( len == -1 ) {
4289                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
4290                         TALLOC_FREE( list );
4291                         return 0;
4292                 }
4293
4294                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
4295                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
4296                           domain_name, dns_name, sid_string,
4297                           flags, attribs, type));
4298
4299                 list[i].domain_name = talloc_strdup( list, domain_name );
4300                 list[i].dns_name = talloc_strdup( list, dns_name );
4301                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
4302                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
4303                                   domain_name));
4304                 }
4305                 list[i].trust_flags = flags;
4306                 list[i].trust_attribs = attribs;
4307                 list[i].trust_type = type;
4308         }
4309
4310         *domains = list;
4311
4312         return num_domains;
4313 }
4314
4315 /*********************************************************************
4316  ********************************************************************/
4317
4318 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
4319 {
4320         TDB_DATA key = make_tdc_key( lp_workgroup() );
4321         TDB_DATA data = { NULL, 0 };
4322         int ret;
4323
4324         if ( !key.dptr )
4325                 return false;
4326
4327         /* See if we were asked to delete the cache entry */
4328
4329         if ( !domains ) {
4330                 ret = tdb_delete( wcache->tdb, key );
4331                 goto done;
4332         }
4333
4334         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4335
4336         if ( !data.dptr ) {
4337                 ret = -1;
4338                 goto done;
4339         }
4340
4341         ret = tdb_store( wcache->tdb, key, data, 0 );
4342
4343  done:
4344         SAFE_FREE( data.dptr );
4345         SAFE_FREE( key.dptr );
4346
4347         return ( ret != -1 );
4348 }
4349
4350 /*********************************************************************
4351  ********************************************************************/
4352
4353 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4354 {
4355         TDB_DATA key = make_tdc_key( lp_workgroup() );
4356         TDB_DATA data = { NULL, 0 };
4357
4358         *domains = NULL;
4359         *num_domains = 0;
4360
4361         if ( !key.dptr )
4362                 return false;
4363
4364         data = tdb_fetch( wcache->tdb, key );
4365
4366         SAFE_FREE( key.dptr );
4367
4368         if ( !data.dptr )
4369                 return false;
4370
4371         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4372
4373         SAFE_FREE( data.dptr );
4374
4375         if ( !*domains )
4376                 return false;
4377
4378         return true;
4379 }
4380
4381 /*********************************************************************
4382  ********************************************************************/
4383
4384 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4385 {
4386         struct winbindd_tdc_domain *dom_list = NULL;
4387         size_t num_domains = 0;
4388         bool ret = false;
4389
4390         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4391                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4392                   domain->name, domain->alt_name,
4393                   sid_string_dbg(&domain->sid),
4394                   domain->domain_flags,
4395                   domain->domain_trust_attribs,
4396                   domain->domain_type));
4397
4398         if ( !init_wcache() ) {
4399                 return false;
4400         }
4401
4402         /* fetch the list */
4403
4404         wcache_tdc_fetch_list( &dom_list, &num_domains );
4405
4406         /* add the new domain */
4407
4408         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4409                 goto done;
4410         }
4411
4412         /* pack the domain */
4413
4414         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4415                 goto done;
4416         }
4417
4418         /* Success */
4419
4420         ret = true;
4421  done:
4422         TALLOC_FREE( dom_list );
4423
4424         return ret;
4425 }
4426
4427 /*********************************************************************
4428  ********************************************************************/
4429
4430 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4431 {
4432         struct winbindd_tdc_domain *dom_list = NULL;
4433         size_t num_domains = 0;
4434         int i;
4435         struct winbindd_tdc_domain *d = NULL;
4436
4437         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4438
4439         if ( !init_wcache() ) {
4440                 return false;
4441         }
4442
4443         /* fetch the list */
4444
4445         wcache_tdc_fetch_list( &dom_list, &num_domains );
4446
4447         for ( i=0; i<num_domains; i++ ) {
4448                 if ( strequal(name, dom_list[i].domain_name) ||
4449                      strequal(name, dom_list[i].dns_name) )
4450                 {
4451                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4452                                   name));
4453
4454                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4455                         if ( !d )
4456                                 break;
4457
4458                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4459                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4460                         sid_copy( &d->sid, &dom_list[i].sid );
4461                         d->trust_flags   = dom_list[i].trust_flags;
4462                         d->trust_type    = dom_list[i].trust_type;
4463                         d->trust_attribs = dom_list[i].trust_attribs;
4464
4465                         break;
4466                 }
4467         }
4468
4469         TALLOC_FREE( dom_list );
4470
4471         return d;
4472 }
4473
4474
4475 /*********************************************************************
4476  ********************************************************************/
4477
4478 void wcache_tdc_clear( void )
4479 {
4480         if ( !init_wcache() )
4481                 return;
4482
4483         wcache_tdc_store_list( NULL, 0 );
4484
4485         return;
4486 }
4487
4488
4489 /*********************************************************************
4490  ********************************************************************/
4491
4492 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4493                                     NTSTATUS status,
4494                                     const DOM_SID *user_sid,
4495                                     const char *homedir,
4496                                     const char *shell,
4497                                     const char *gecos,
4498                                     uint32 gid)
4499 {
4500         struct cache_entry *centry;
4501         fstring tmp;
4502
4503         if ( (centry = centry_start(domain, status)) == NULL )
4504                 return;
4505
4506         centry_put_string( centry, homedir );
4507         centry_put_string( centry, shell );
4508         centry_put_string( centry, gecos );
4509         centry_put_uint32( centry, gid );
4510
4511         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4512
4513         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4514
4515         centry_free(centry);
4516 }
4517
4518 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4519                               const DOM_SID *user_sid,
4520                               TALLOC_CTX *ctx,
4521                               ADS_STRUCT *ads, LDAPMessage *msg,
4522                               const char **homedir, const char **shell,
4523                               const char **gecos, gid_t *p_gid)
4524 {
4525         struct winbind_cache *cache = get_cache(domain);
4526         struct cache_entry *centry = NULL;
4527         NTSTATUS nt_status;
4528         fstring tmp;
4529
4530         if (!cache->tdb)
4531                 goto do_query;
4532
4533         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4534                               sid_to_fstring(tmp, user_sid));
4535
4536         if (!centry)
4537                 goto do_query;
4538
4539         *homedir = centry_string( centry, ctx );
4540         *shell   = centry_string( centry, ctx );
4541         *gecos   = centry_string( centry, ctx );
4542         *p_gid   = centry_uint32( centry );
4543
4544         centry_free(centry);
4545
4546         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4547                   sid_string_dbg(user_sid)));
4548
4549         return NT_STATUS_OK;
4550
4551 do_query:
4552
4553         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4554                                   homedir, shell, gecos, p_gid );
4555
4556         DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4557
4558         if ( NT_STATUS_IS_OK(nt_status) ) {
4559                 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4560                 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4561                 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4562                 DEBUGADD(10, ("\tgid = '%u'\n", (unsigned int)*p_gid));
4563
4564                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4565                                          *homedir, *shell, *gecos, *p_gid );
4566         }
4567
4568         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4569                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4570                          domain->name ));
4571                 set_domain_offline( domain );
4572         }
4573
4574         return nt_status;
4575 }
4576
4577
4578 /* the cache backend methods are exposed via this structure */
4579 struct winbindd_methods cache_methods = {
4580         true,
4581         query_user_list,
4582         enum_dom_groups,
4583         enum_local_groups,
4584         name_to_sid,
4585         sid_to_name,
4586         rids_to_names,
4587         query_user,
4588         lookup_usergroups,
4589         lookup_useraliases,
4590         lookup_groupmem,
4591         sequence_number,
4592         lockout_policy,
4593         password_policy,
4594         trusted_domains
4595 };
4596
4597 static bool wcache_ndr_key(TALLOC_CTX *mem_ctx, char *domain_name,
4598                            uint32_t opnum, const DATA_BLOB *req,
4599                            TDB_DATA *pkey)
4600 {
4601         char *key;
4602         size_t keylen;
4603
4604         key = talloc_asprintf(mem_ctx, "NDR/%s/%d/", domain_name, (int)opnum);
4605         if (key == NULL) {
4606                 return false;
4607         }
4608         keylen = talloc_get_size(key) - 1;
4609
4610         key = talloc_realloc(mem_ctx, key, char, keylen + req->length);
4611         if (key == NULL) {
4612                 return false;
4613         }
4614         memcpy(key + keylen, req->data, req->length);
4615
4616         pkey->dptr = (uint8_t *)key;
4617         pkey->dsize = talloc_get_size(key);
4618         return true;
4619 }
4620
4621 static bool wcache_opnum_cacheable(uint32_t opnum)
4622 {
4623         switch (opnum) {
4624         case NDR_WBINT_PING:
4625         case NDR_WBINT_QUERYSEQUENCENUMBER:
4626         case NDR_WBINT_ALLOCATEUID:
4627         case NDR_WBINT_ALLOCATEGID:
4628         case NDR_WBINT_CHECKMACHINEACCOUNT:
4629         case NDR_WBINT_CHANGEMACHINEACCOUNT:
4630         case NDR_WBINT_PINGDC:
4631                 return false;
4632         }
4633         return true;
4634 }
4635
4636 bool wcache_fetch_ndr(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
4637                       uint32_t opnum, const DATA_BLOB *req, DATA_BLOB *resp)
4638 {
4639         TDB_DATA key, data;
4640         bool ret = false;
4641
4642         if (!wcache_opnum_cacheable(opnum)) {
4643                 return false;
4644         }
4645
4646         if (wcache->tdb == NULL) {
4647                 return false;
4648         }
4649
4650         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4651                 return false;
4652         }
4653         data = tdb_fetch(wcache->tdb, key);
4654         TALLOC_FREE(key.dptr);
4655
4656         if (data.dptr == NULL) {
4657                 return false;
4658         }
4659         if (data.dsize < 4) {
4660                 goto fail;
4661         }
4662
4663         if (!is_domain_offline(domain)) {
4664                 uint32_t entry_seqnum, dom_seqnum, last_check;
4665
4666                 if (!wcache_fetch_seqnum(domain->name, &dom_seqnum,
4667                                          &last_check)) {
4668                         goto fail;
4669                 }
4670                 entry_seqnum = IVAL(data.dptr, 0);
4671                 if (entry_seqnum != dom_seqnum) {
4672                         DEBUG(10, ("Entry has wrong sequence number: %d\n",
4673                                    (int)entry_seqnum));
4674                         goto fail;
4675                 }
4676         }
4677
4678         resp->data = (uint8_t *)talloc_memdup(mem_ctx, data.dptr + 4,
4679                                               data.dsize - 4);
4680         if (resp->data == NULL) {
4681                 DEBUG(10, ("talloc failed\n"));
4682                 goto fail;
4683         }
4684         resp->length = data.dsize - 4;
4685
4686         ret = true;
4687 fail:
4688         SAFE_FREE(data.dptr);
4689         return ret;
4690 }
4691
4692 void wcache_store_ndr(struct winbindd_domain *domain, uint32_t opnum,
4693                       const DATA_BLOB *req, const DATA_BLOB *resp)
4694 {
4695         TDB_DATA key, data;
4696         uint32_t dom_seqnum, last_check;
4697
4698         if (!wcache_opnum_cacheable(opnum)) {
4699                 return;
4700         }
4701
4702         if (wcache->tdb == NULL) {
4703                 return;
4704         }
4705
4706         if (!wcache_fetch_seqnum(domain->name, &dom_seqnum, &last_check)) {
4707                 DEBUG(10, ("could not fetch seqnum for domain %s\n",
4708                            domain->name));
4709                 return;
4710         }
4711
4712         if (!wcache_ndr_key(talloc_tos(), domain->name, opnum, req, &key)) {
4713                 return;
4714         }
4715
4716         data.dsize = resp->length + 4;
4717         data.dptr = talloc_array(key.dptr, uint8_t, data.dsize);
4718         if (data.dptr == NULL) {
4719                 goto done;
4720         }
4721
4722         SIVAL(data.dptr, 0, dom_seqnum);
4723         memcpy(data.dptr+4, resp->data, resp->length);
4724
4725         tdb_store(wcache->tdb, key, data, 0);
4726
4727 done:
4728         TALLOC_FREE(key.dptr);
4729         return;
4730 }