2 Unix SMB/CIFS implementation.
4 Winbind cache backend functions
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Gerald Carter 2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #define DBGC_CLASS DBGC_WINBIND
30 struct winbind_cache {
36 uint32 sequence_number;
41 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
43 static struct winbind_cache *wcache;
46 void wcache_flush_cache(void)
48 extern BOOL opt_nocache;
53 tdb_close(wcache->tdb);
59 wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), 5000,
60 TDB_CLEAR_IF_FIRST, O_RDWR|O_CREAT, 0600);
63 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
65 DEBUG(10,("wcache_flush_cache success\n"));
68 void winbindd_check_cache_size(time_t t)
70 static time_t last_check_time;
73 if (last_check_time == (time_t)0)
76 if (t - last_check_time < 60 && t - last_check_time > 0)
79 if (wcache == NULL || wcache->tdb == NULL) {
80 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
84 if (fstat(wcache->tdb->fd, &st) == -1) {
85 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
89 if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
90 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
91 (unsigned long)st.st_size,
92 (unsigned long)WINBINDD_MAX_CACHE_SIZE));
97 /* get the winbind_cache structure */
98 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
100 struct winbind_cache *ret = wcache;
102 if (!domain->backend) {
103 extern struct winbindd_methods msrpc_methods;
104 switch (lp_security()) {
107 extern struct winbindd_methods ads_methods;
108 /* always obey the lp_security parameter for our domain */
109 if ( strequal(lp_realm(), domain->alt_name) ) {
110 domain->backend = &ads_methods;
114 if ( domain->native_mode ) {
115 domain->backend = &ads_methods;
123 domain->backend = &msrpc_methods;
130 ret = smb_xmalloc(sizeof(*ret));
134 wcache_flush_cache();
140 free a centry structure
142 static void centry_free(struct cache_entry *centry)
146 SAFE_FREE(centry->data);
151 pull a uint32 from a cache entry
153 static uint32 centry_uint32(struct cache_entry *centry)
156 if (centry->len - centry->ofs < 4) {
157 DEBUG(0,("centry corruption? needed 4 bytes, have %d\n",
158 centry->len - centry->ofs));
159 smb_panic("centry_uint32");
161 ret = IVAL(centry->data, centry->ofs);
167 pull a uint8 from a cache entry
169 static uint8 centry_uint8(struct cache_entry *centry)
172 if (centry->len - centry->ofs < 1) {
173 DEBUG(0,("centry corruption? needed 1 bytes, have %d\n",
174 centry->len - centry->ofs));
175 smb_panic("centry_uint32");
177 ret = CVAL(centry->data, centry->ofs);
182 /* pull a string from a cache entry, using the supplied
185 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
190 len = centry_uint8(centry);
193 /* a deliberate NULL string */
197 if (centry->len - centry->ofs < len) {
198 DEBUG(0,("centry corruption? needed %d bytes, have %d\n",
199 len, centry->len - centry->ofs));
200 smb_panic("centry_string");
203 ret = talloc(mem_ctx, len+1);
205 smb_panic("centry_string out of memory\n");
207 memcpy(ret,centry->data + centry->ofs, len);
213 /* pull a string from a cache entry, using the supplied
216 static DOM_SID *centry_sid(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
221 sid = talloc(mem_ctx, sizeof(*sid));
225 sid_string = centry_string(centry, mem_ctx);
226 if (!string_to_sid(sid, sid_string)) {
232 /* the server is considered down if it can't give us a sequence number */
233 static BOOL wcache_server_down(struct winbindd_domain *domain)
240 ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
243 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
248 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
255 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
256 return NT_STATUS_UNSUCCESSFUL;
259 snprintf( key, sizeof(key), "SEQNUM/%s", domain->name );
261 data = tdb_fetch_bystring( wcache->tdb, key );
262 if ( !data.dptr || data.dsize!=8 ) {
263 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key ));
264 return NT_STATUS_UNSUCCESSFUL;
267 domain->sequence_number = IVAL(data.dptr, 0);
268 domain->last_seq_check = IVAL(data.dptr, 4);
270 /* have we expired? */
272 time_diff = now - domain->last_seq_check;
273 if ( time_diff > lp_winbind_cache_time() ) {
274 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
275 domain->name, domain->sequence_number,
276 (uint32)domain->last_seq_check));
277 return NT_STATUS_UNSUCCESSFUL;
280 DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
281 domain->name, domain->sequence_number,
282 (uint32)domain->last_seq_check));
287 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
294 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
295 return NT_STATUS_UNSUCCESSFUL;
298 snprintf( key_str, sizeof(key_str), "SEQNUM/%s", domain->name );
300 key.dsize = strlen(key_str)+1;
302 SIVAL(buf, 0, domain->sequence_number);
303 SIVAL(buf, 4, domain->last_seq_check);
307 if ( tdb_store( wcache->tdb, key, data, TDB_REPLACE) == -1 ) {
308 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
309 return NT_STATUS_UNSUCCESSFUL;
312 DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
313 domain->name, domain->sequence_number,
314 (uint32)domain->last_seq_check));
320 refresh the domain sequence number. If force is True
321 then always refresh it, no matter how recently we fetched it
324 static void refresh_sequence_number(struct winbindd_domain *domain, BOOL force)
328 time_t t = time(NULL);
329 unsigned cache_time = lp_winbind_cache_time();
331 /* trying to reconnect is expensive, don't do it too often */
332 if (domain->sequence_number == DOM_SEQUENCE_NONE) {
336 time_diff = t - domain->last_seq_check;
338 /* see if we have to refetch the domain sequence number */
339 if (!force && (time_diff < cache_time)) {
340 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
344 /* try to get the sequence number from the tdb cache first */
345 /* this will update the timestamp as well */
347 status = fetch_cache_seqnum( domain, t );
348 if ( NT_STATUS_IS_OK(status) )
351 status = domain->backend->sequence_number(domain, &domain->sequence_number);
353 if (!NT_STATUS_IS_OK(status)) {
354 domain->sequence_number = DOM_SEQUENCE_NONE;
357 domain->last_status = status;
358 domain->last_seq_check = time(NULL);
360 /* save the new sequence number ni the cache */
361 store_cache_seqnum( domain );
364 DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
365 domain->name, domain->sequence_number));
371 decide if a cache entry has expired
373 static BOOL centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
375 /* if the server is OK and our cache entry came from when it was down then
376 the entry is invalid */
377 if (domain->sequence_number != DOM_SEQUENCE_NONE &&
378 centry->sequence_number == DOM_SEQUENCE_NONE) {
379 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
380 keystr, domain->name ));
384 /* if the server is down or the cache entry is not older than the
385 current sequence number then it is OK */
386 if (wcache_server_down(domain) ||
387 centry->sequence_number == domain->sequence_number) {
388 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
389 keystr, domain->name ));
393 DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
394 keystr, domain->name ));
401 fetch an entry from the cache, with a varargs key. auto-fetch the sequence
402 number and return status
404 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
405 struct winbindd_domain *domain,
406 const char *format, ...) PRINTF_ATTRIBUTE(3,4);
407 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
408 struct winbindd_domain *domain,
409 const char *format, ...)
414 struct cache_entry *centry;
417 refresh_sequence_number(domain, False);
419 va_start(ap, format);
420 smb_xvasprintf(&kstr, format, ap);
424 key.dsize = strlen(kstr);
425 data = tdb_fetch(wcache->tdb, key);
432 centry = smb_xmalloc(sizeof(*centry));
433 centry->data = data.dptr;
434 centry->len = data.dsize;
437 if (centry->len < 8) {
438 /* huh? corrupt cache? */
439 DEBUG(10,("wcache_fetch: Corrupt cache for key %s domain %s (len < 8) ?\n",
440 kstr, domain->name ));
446 centry->status = NT_STATUS(centry_uint32(centry));
447 centry->sequence_number = centry_uint32(centry);
449 if (centry_expired(domain, kstr, centry)) {
450 extern BOOL opt_dual_daemon;
452 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
453 kstr, domain->name ));
455 if (opt_dual_daemon) {
456 extern BOOL background_process;
457 background_process = True;
458 DEBUG(10,("wcache_fetch: background processing expired entry %s for domain %s\n",
459 kstr, domain->name ));
467 DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
468 kstr, domain->name ));
475 make sure we have at least len bytes available in a centry
477 static void centry_expand(struct cache_entry *centry, uint32 len)
480 if (centry->len - centry->ofs >= len)
483 p = realloc(centry->data, centry->len);
485 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
486 smb_panic("out of memory in centry_expand");
492 push a uint32 into a centry
494 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
496 centry_expand(centry, 4);
497 SIVAL(centry->data, centry->ofs, v);
502 push a uint8 into a centry
504 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
506 centry_expand(centry, 1);
507 SCVAL(centry->data, centry->ofs, v);
512 push a string into a centry
514 static void centry_put_string(struct cache_entry *centry, const char *s)
519 /* null strings are marked as len 0xFFFF */
520 centry_put_uint8(centry, 0xFF);
525 /* can't handle more than 254 char strings. Truncating is probably best */
528 centry_put_uint8(centry, len);
529 centry_expand(centry, len);
530 memcpy(centry->data + centry->ofs, s, len);
534 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
537 centry_put_string(centry, sid_to_string(sid_string, sid));
541 start a centry for output. When finished, call centry_end()
543 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
545 struct cache_entry *centry;
550 centry = smb_xmalloc(sizeof(*centry));
552 centry->len = 8192; /* reasonable default */
553 centry->data = smb_xmalloc(centry->len);
555 centry->sequence_number = domain->sequence_number;
556 centry_put_uint32(centry, NT_STATUS_V(status));
557 centry_put_uint32(centry, centry->sequence_number);
562 finish a centry and write it to the tdb
564 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
565 static void centry_end(struct cache_entry *centry, const char *format, ...)
571 va_start(ap, format);
572 smb_xvasprintf(&kstr, format, ap);
576 key.dsize = strlen(kstr);
577 data.dptr = centry->data;
578 data.dsize = centry->ofs;
580 tdb_store(wcache->tdb, key, data, TDB_REPLACE);
584 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
586 const char *name, DOM_SID *sid,
587 enum SID_NAME_USE type)
589 struct cache_entry *centry;
593 centry = centry_start(domain, status);
596 centry_put_sid(centry, sid);
597 fstrcpy(uname, name);
599 centry_end(centry, "NS/%s", sid_to_string(sid_string, sid));
600 DEBUG(10,("wcache_save_name_to_sid: %s -> %s\n", uname, sid_string));
604 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
605 DOM_SID *sid, const char *name, enum SID_NAME_USE type)
607 struct cache_entry *centry;
610 centry = centry_start(domain, status);
613 if (NT_STATUS_IS_OK(status)) {
614 centry_put_uint32(centry, type);
615 centry_put_string(centry, name);
617 centry_end(centry, "SN/%s", sid_to_string(sid_string, sid));
618 DEBUG(10,("wcache_save_sid_to_name: %s -> %s\n", sid_string, name));
623 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WINBIND_USERINFO *info)
625 struct cache_entry *centry;
628 centry = centry_start(domain, status);
631 centry_put_string(centry, info->acct_name);
632 centry_put_string(centry, info->full_name);
633 centry_put_sid(centry, info->user_sid);
634 centry_put_sid(centry, info->group_sid);
635 centry_end(centry, "U/%s", sid_to_string(sid_string, info->user_sid));
636 DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
641 /* Query display info. This is the basic user list fn */
642 static NTSTATUS query_user_list(struct winbindd_domain *domain,
645 WINBIND_USERINFO **info)
647 struct winbind_cache *cache = get_cache(domain);
648 struct cache_entry *centry = NULL;
650 unsigned int i, retry;
655 centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
659 *num_entries = centry_uint32(centry);
661 if (*num_entries == 0)
664 (*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries));
666 smb_panic("query_user_list out of memory");
667 for (i=0; i<(*num_entries); i++) {
668 (*info)[i].acct_name = centry_string(centry, mem_ctx);
669 (*info)[i].full_name = centry_string(centry, mem_ctx);
670 (*info)[i].user_sid = centry_sid(centry, mem_ctx);
671 (*info)[i].group_sid = centry_sid(centry, mem_ctx);
675 status = centry->status;
677 DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status %s\n",
678 domain->name, get_friendly_nt_error_msg(status) ));
687 /* Return status value returned by seq number check */
689 if (!NT_STATUS_IS_OK(domain->last_status))
690 return domain->last_status;
692 /* Put the query_user_list() in a retry loop. There appears to be
693 * some bug either with Windows 2000 or Samba's handling of large
694 * rpc replies. This manifests itself as sudden disconnection
695 * at a random point in the enumeration of a large (60k) user list.
696 * The retry loop simply tries the operation again. )-: It's not
697 * pretty but an acceptable workaround until we work out what the
698 * real problem is. */
703 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
706 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
707 if (!NT_STATUS_IS_OK(status))
708 DEBUG(3, ("query_user_list: returned 0x%08x, retrying\n", NT_STATUS_V(status)));
709 if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL)) {
710 DEBUG(3, ("query_user_list: flushing connection cache\n"));
714 } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
718 refresh_sequence_number(domain, False);
719 centry = centry_start(domain, status);
722 centry_put_uint32(centry, *num_entries);
723 for (i=0; i<(*num_entries); i++) {
724 centry_put_string(centry, (*info)[i].acct_name);
725 centry_put_string(centry, (*info)[i].full_name);
726 centry_put_sid(centry, (*info)[i].user_sid);
727 centry_put_sid(centry, (*info)[i].group_sid);
728 if (domain->backend->consistent) {
729 /* when the backend is consistent we can pre-prime some mappings */
730 wcache_save_name_to_sid(domain, NT_STATUS_OK,
731 (*info)[i].acct_name,
734 wcache_save_sid_to_name(domain, NT_STATUS_OK,
736 (*info)[i].acct_name,
738 wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
741 centry_end(centry, "UL/%s", domain->name);
748 /* list all domain groups */
749 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
752 struct acct_info **info)
754 struct winbind_cache *cache = get_cache(domain);
755 struct cache_entry *centry = NULL;
762 centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
766 *num_entries = centry_uint32(centry);
768 if (*num_entries == 0)
771 (*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries));
773 smb_panic("enum_dom_groups out of memory");
774 for (i=0; i<(*num_entries); i++) {
775 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
776 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
777 (*info)[i].rid = centry_uint32(centry);
781 status = centry->status;
783 DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status %s\n",
784 domain->name, get_friendly_nt_error_msg(status) ));
793 /* Return status value returned by seq number check */
795 if (!NT_STATUS_IS_OK(domain->last_status))
796 return domain->last_status;
798 DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
801 status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
804 refresh_sequence_number(domain, False);
805 centry = centry_start(domain, status);
808 centry_put_uint32(centry, *num_entries);
809 for (i=0; i<(*num_entries); i++) {
810 centry_put_string(centry, (*info)[i].acct_name);
811 centry_put_string(centry, (*info)[i].acct_desc);
812 centry_put_uint32(centry, (*info)[i].rid);
814 centry_end(centry, "GL/%s/domain", domain->name);
821 /* list all domain groups */
822 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
825 struct acct_info **info)
827 struct winbind_cache *cache = get_cache(domain);
828 struct cache_entry *centry = NULL;
835 centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
839 *num_entries = centry_uint32(centry);
841 if (*num_entries == 0)
844 (*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries));
846 smb_panic("enum_dom_groups out of memory");
847 for (i=0; i<(*num_entries); i++) {
848 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
849 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
850 (*info)[i].rid = centry_uint32(centry);
855 /* If we are returning cached data and the domain controller
856 is down then we don't know whether the data is up to date
857 or not. Return NT_STATUS_MORE_PROCESSING_REQUIRED to
860 if (wcache_server_down(domain)) {
861 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
862 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
864 status = centry->status;
866 DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status %s\n",
867 domain->name, get_friendly_nt_error_msg(status) ));
876 /* Return status value returned by seq number check */
878 if (!NT_STATUS_IS_OK(domain->last_status))
879 return domain->last_status;
881 DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
884 status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
887 refresh_sequence_number(domain, False);
888 centry = centry_start(domain, status);
891 centry_put_uint32(centry, *num_entries);
892 for (i=0; i<(*num_entries); i++) {
893 centry_put_string(centry, (*info)[i].acct_name);
894 centry_put_string(centry, (*info)[i].acct_desc);
895 centry_put_uint32(centry, (*info)[i].rid);
897 centry_end(centry, "GL/%s/local", domain->name);
904 /* convert a single name to a sid in a domain */
905 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
909 enum SID_NAME_USE *type)
911 struct winbind_cache *cache = get_cache(domain);
912 struct cache_entry *centry = NULL;
920 fstrcpy(uname, name);
922 centry = wcache_fetch(cache, domain, "NS/%s/%s", domain->name, uname);
925 *type = centry_uint32(centry);
926 sid2 = centry_sid(centry, mem_ctx);
933 status = centry->status;
935 DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status %s\n",
936 domain->name, get_friendly_nt_error_msg(status) ));
944 /* If the seq number check indicated that there is a problem
945 * with this DC, then return that status... except for
946 * access_denied. This is special because the dc may be in
947 * "restrict anonymous = 1" mode, in which case it will deny
948 * most unauthenticated operations, but *will* allow the LSA
949 * name-to-sid that we try as a fallback. */
951 if (!(NT_STATUS_IS_OK(domain->last_status)
952 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
953 return domain->last_status;
955 DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
958 status = domain->backend->name_to_sid(domain, mem_ctx, name, sid, type);
961 wcache_save_name_to_sid(domain, status, name, sid, *type);
963 /* We can't save the sid to name mapping as we don't know the
964 correct case of the name without looking it up */
969 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
971 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
975 enum SID_NAME_USE *type)
977 struct winbind_cache *cache = get_cache(domain);
978 struct cache_entry *centry = NULL;
985 centry = wcache_fetch(cache, domain, "SN/%s", sid_to_string(sid_string, sid));
988 if (NT_STATUS_IS_OK(centry->status)) {
989 *type = centry_uint32(centry);
990 *name = centry_string(centry, mem_ctx);
992 status = centry->status;
994 DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status %s\n",
995 domain->name, get_friendly_nt_error_msg(status) ));
1003 /* If the seq number check indicated that there is a problem
1004 * with this DC, then return that status... except for
1005 * access_denied. This is special because the dc may be in
1006 * "restrict anonymous = 1" mode, in which case it will deny
1007 * most unauthenticated operations, but *will* allow the LSA
1008 * sid-to-name that we try as a fallback. */
1010 if (!(NT_STATUS_IS_OK(domain->last_status)
1011 || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1012 return domain->last_status;
1014 DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1017 status = domain->backend->sid_to_name(domain, mem_ctx, sid, name, type);
1020 refresh_sequence_number(domain, False);
1021 wcache_save_sid_to_name(domain, status, sid, *name, *type);
1022 wcache_save_name_to_sid(domain, status, *name, sid, *type);
1028 /* Lookup user information from a rid */
1029 static NTSTATUS query_user(struct winbindd_domain *domain,
1030 TALLOC_CTX *mem_ctx,
1032 WINBIND_USERINFO *info)
1034 struct winbind_cache *cache = get_cache(domain);
1035 struct cache_entry *centry = NULL;
1041 centry = wcache_fetch(cache, domain, "U/%s", sid_string_static(user_sid));
1043 /* If we have an access denied cache entry and a cached info3 in the
1044 samlogon cache then do a query. This will force the rpc back end
1045 to return the info3 data. */
1047 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1048 netsamlogon_cache_have(user_sid)) {
1049 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1050 domain->last_status = NT_STATUS_OK;
1051 centry_free(centry);
1058 info->acct_name = centry_string(centry, mem_ctx);
1059 info->full_name = centry_string(centry, mem_ctx);
1060 info->user_sid = centry_sid(centry, mem_ctx);
1061 info->group_sid = centry_sid(centry, mem_ctx);
1062 status = centry->status;
1064 DEBUG(10,("query_user: [Cached] - cached info for domain %s status %s\n",
1065 domain->name, get_friendly_nt_error_msg(status) ));
1067 centry_free(centry);
1073 /* Return status value returned by seq number check */
1075 if (!NT_STATUS_IS_OK(domain->last_status))
1076 return domain->last_status;
1078 DEBUG(10,("sid_to_name: [Cached] - doing backend query for info for domain %s\n",
1081 status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
1084 refresh_sequence_number(domain, False);
1085 wcache_save_user(domain, status, info);
1091 /* Lookup groups a user is a member of. */
1092 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
1093 TALLOC_CTX *mem_ctx,
1095 uint32 *num_groups, DOM_SID ***user_gids)
1097 struct winbind_cache *cache = get_cache(domain);
1098 struct cache_entry *centry = NULL;
1106 centry = wcache_fetch(cache, domain, "UG/%s", sid_to_string(sid_string, user_sid));
1108 /* If we have an access denied cache entry and a cached info3 in the
1109 samlogon cache then do a query. This will force the rpc back end
1110 to return the info3 data. */
1112 if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1113 netsamlogon_cache_have(user_sid)) {
1114 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1115 domain->last_status = NT_STATUS_OK;
1116 centry_free(centry);
1123 *num_groups = centry_uint32(centry);
1125 if (*num_groups == 0)
1128 (*user_gids) = talloc(mem_ctx, sizeof(**user_gids) * (*num_groups));
1130 smb_panic("lookup_usergroups out of memory");
1131 for (i=0; i<(*num_groups); i++) {
1132 (*user_gids)[i] = centry_sid(centry, mem_ctx);
1136 status = centry->status;
1138 DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status %s\n",
1139 domain->name, get_friendly_nt_error_msg(status) ));
1141 centry_free(centry);
1146 (*user_gids) = NULL;
1148 /* Return status value returned by seq number check */
1150 if (!NT_STATUS_IS_OK(domain->last_status))
1151 return domain->last_status;
1153 DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
1156 status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
1159 refresh_sequence_number(domain, False);
1160 centry = centry_start(domain, status);
1163 centry_put_uint32(centry, *num_groups);
1164 for (i=0; i<(*num_groups); i++) {
1165 centry_put_sid(centry, (*user_gids)[i]);
1167 centry_end(centry, "UG/%s", sid_to_string(sid_string, user_sid));
1168 centry_free(centry);
1175 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
1176 TALLOC_CTX *mem_ctx,
1177 DOM_SID *group_sid, uint32 *num_names,
1178 DOM_SID ***sid_mem, char ***names,
1179 uint32 **name_types)
1181 struct winbind_cache *cache = get_cache(domain);
1182 struct cache_entry *centry = NULL;
1190 centry = wcache_fetch(cache, domain, "GM/%s", sid_to_string(sid_string, group_sid));
1194 *num_names = centry_uint32(centry);
1196 if (*num_names == 0)
1199 (*sid_mem) = talloc(mem_ctx, sizeof(**sid_mem) * (*num_names));
1200 (*names) = talloc(mem_ctx, sizeof(**names) * (*num_names));
1201 (*name_types) = talloc(mem_ctx, sizeof(**name_types) * (*num_names));
1203 if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
1204 smb_panic("lookup_groupmem out of memory");
1207 for (i=0; i<(*num_names); i++) {
1208 (*sid_mem)[i] = centry_sid(centry, mem_ctx);
1209 (*names)[i] = centry_string(centry, mem_ctx);
1210 (*name_types)[i] = centry_uint32(centry);
1214 status = centry->status;
1216 DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status %s\n",
1217 domain->name, get_friendly_nt_error_msg(status) ));
1219 centry_free(centry);
1226 (*name_types) = NULL;
1228 /* Return status value returned by seq number check */
1230 if (!NT_STATUS_IS_OK(domain->last_status))
1231 return domain->last_status;
1233 DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
1236 status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
1237 sid_mem, names, name_types);
1240 refresh_sequence_number(domain, False);
1241 centry = centry_start(domain, status);
1244 centry_put_uint32(centry, *num_names);
1245 for (i=0; i<(*num_names); i++) {
1246 centry_put_sid(centry, (*sid_mem)[i]);
1247 centry_put_string(centry, (*names)[i]);
1248 centry_put_uint32(centry, (*name_types)[i]);
1250 centry_end(centry, "GM/%s", sid_to_string(sid_string, group_sid));
1251 centry_free(centry);
1257 /* find the sequence number for a domain */
1258 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
1260 refresh_sequence_number(domain, False);
1262 *seq = domain->sequence_number;
1264 return NT_STATUS_OK;
1267 /* enumerate trusted domains */
1268 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
1269 TALLOC_CTX *mem_ctx,
1270 uint32 *num_domains,
1277 DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
1280 /* we don't cache this call */
1281 return domain->backend->trusted_domains(domain, mem_ctx, num_domains,
1282 names, alt_names, dom_sids);
1285 /* find the domain sid */
1286 static NTSTATUS domain_sid(struct winbindd_domain *domain, DOM_SID *sid)
1290 DEBUG(10,("domain_sid: [Cached] - doing backend query for info for domain %s\n",
1293 /* we don't cache this call */
1294 return domain->backend->domain_sid(domain, sid);
1297 /* find the alternate names for the domain, if any */
1298 static NTSTATUS alternate_name(struct winbindd_domain *domain)
1302 DEBUG(10,("alternate_name: [Cached] - doing backend query for info for domain %s\n",
1305 /* we don't cache this call */
1306 return domain->backend->alternate_name(domain);
1309 /* Invalidate cached user and group lists coherently */
1311 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
1314 if (strncmp(kbuf.dptr, "UL/", 3) == 0 ||
1315 strncmp(kbuf.dptr, "GL/", 3) == 0)
1316 tdb_delete(the_tdb, kbuf);
1321 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
1323 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
1324 NET_USER_INFO_3 *info3)
1326 struct winbind_cache *cache;
1331 cache = get_cache(domain);
1332 netsamlogon_clear_cached_user(cache->tdb, info3);
1335 void wcache_invalidate_cache(void)
1337 struct winbindd_domain *domain;
1339 for (domain = domain_list(); domain; domain = domain->next) {
1340 struct winbind_cache *cache = get_cache(domain);
1342 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
1343 "entries for %s\n", domain->name));
1345 tdb_traverse(cache->tdb, traverse_fn, NULL);
1349 /* the ADS backend methods are exposed via this structure */
1350 struct winbindd_methods cache_methods = {