source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_WINBIND
  31
  32 #define WINBINDD_CACHE_VERSION 1
  33 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  34
  35 extern struct winbindd_methods reconnect_methods;
  36 extern bool opt_nocache;
  37 #ifdef HAVE_ADS
  38 extern struct winbindd_methods ads_methods;
  39 #endif
  40
  41 /*
  42  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  43  * Here are the list of entry types that are *not* stored
  44  * as form struct cache_entry in the cache.
  45  */
  46
  47 static const char *non_centry_keys[] = {
  48         "SEQNUM/",
  49         "DR/",
  50         "DE/",
  51         "WINBINDD_OFFLINE",
  52         WINBINDD_CACHE_VERSION_KEYSTR,
  53         NULL
  54 };
  55
  56 /************************************************************************
  57  Is this key a non-centry type ?
  58 ************************************************************************/
  59
  60 static bool is_non_centry_key(TDB_DATA kbuf)
  61 {
  62         int i;
  63
  64         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  65                 return False;
  66         }
  67         for (i = 0; non_centry_keys[i] != NULL; i++) {
  68                 size_t namelen = strlen(non_centry_keys[i]);
  69                 if (kbuf.dsize < namelen) {
  70                         continue;
  71                 }
  72                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  73                         return True;
  74                 }
  75         }
  76         return False;
  77 }
  78
  79 /* Global online/offline state - False when online. winbindd starts up online
  80    and sets this to true if the first query fails and there's an entry in
  81    the cache tdb telling us to stay offline. */
  82
  83 static bool global_winbindd_offline_state;
  84
  85 struct winbind_cache {
  86         TDB_CONTEXT *tdb;
  87 };
  88
  89 struct cache_entry {
  90         NTSTATUS status;
  91         uint32 sequence_number;
  92         uint8 *data;
  93         uint32 len, ofs;
  94 };
  95
  96 void (*smb_panic_fn)(const char *const why) = smb_panic;
  97
  98 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
  99
 100 static struct winbind_cache *wcache;
 101
 102 void winbindd_check_cache_size(time_t t)
 103 {
 104         static time_t last_check_time;
 105         struct stat st;
 106
 107         if (last_check_time == (time_t)0)
 108                 last_check_time = t;
 109
 110         if (t - last_check_time < 60 && t - last_check_time > 0)
 111                 return;
 112
 113         if (wcache == NULL || wcache->tdb == NULL) {
 114                 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
 115                 return;
 116         }
 117
 118         if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
 119                 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
 120                 return;
 121         }
 122
 123         if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
 124                 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
 125                         (unsigned long)st.st_size,
 126                         (unsigned long)WINBINDD_MAX_CACHE_SIZE));
 127                 wcache_flush_cache();
 128         }
 129 }
 130
 131 /* get the winbind_cache structure */
 132 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 133 {
 134         struct winbind_cache *ret = wcache;
 135
 136         /* We have to know what type of domain we are dealing with first. */
 137
 138         if ( !domain->initialized ) {
 139                 init_dc_connection( domain );
 140         }
 141
 142         /*
 143            OK.  listen up becasue I'm only going to say this once.
 144            We have the following scenarios to consider
 145            (a) trusted AD domains on a Samba DC,
 146            (b) trusted AD domains and we are joined to a non-kerberos domain
 147            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 148
 149            For (a) we can always contact the trusted domain using krb5
 150            since we have the domain trust account password
 151
 152            For (b) we can only use RPC since we have no way of
 153            getting a krb5 ticket in our own domain
 154
 155            For (c) we can always use krb5 since we have a kerberos trust
 156
 157            --jerry
 158          */
 159
 160         if (!domain->backend) {
 161 #ifdef HAVE_ADS
 162                 struct winbindd_domain *our_domain = domain;
 163
 164                 /* find our domain first so we can figure out if we
 165                    are joined to a kerberized domain */
 166
 167                 if ( !domain->primary )
 168                         our_domain = find_our_domain();
 169
 170                 if ((our_domain->active_directory || IS_DC)
 171                     && domain->active_directory
 172                     && !lp_winbind_rpc_only()) {
 173                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 174                         domain->backend = &ads_methods;
 175                 } else {
 176 #endif  /* HAVE_ADS */
 177                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 178                         domain->backend = &reconnect_methods;
 179 #ifdef HAVE_ADS
 180                 }
 181 #endif  /* HAVE_ADS */
 182         }
 183
 184         if (ret)
 185                 return ret;
 186
 187         ret = SMB_XMALLOC_P(struct winbind_cache);
 188         ZERO_STRUCTP(ret);
 189
 190         wcache = ret;
 191         wcache_flush_cache();
 192
 193         return ret;
 194 }
 195
 196 /*
 197   free a centry structure
 198 */
 199 static void centry_free(struct cache_entry *centry)
 200 {
 201         if (!centry)
 202                 return;
 203         SAFE_FREE(centry->data);
 204         free(centry);
 205 }
 206
 207 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 208 {
 209         if (centry->len - centry->ofs < nbytes) {
 210                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 211                          (unsigned int)nbytes,
 212                          centry->len - centry->ofs));
 213                 return False;
 214         }
 215         return True;
 216 }
 217
 218 /*
 219   pull a uint32 from a cache entry
 220 */
 221 static uint32 centry_uint32(struct cache_entry *centry)
 222 {
 223         uint32 ret;
 224
 225         if (!centry_check_bytes(centry, 4)) {
 226                 smb_panic_fn("centry_uint32");
 227         }
 228         ret = IVAL(centry->data, centry->ofs);
 229         centry->ofs += 4;
 230         return ret;
 231 }
 232
 233 /*
 234   pull a uint16 from a cache entry
 235 */
 236 static uint16 centry_uint16(struct cache_entry *centry)
 237 {
 238         uint16 ret;
 239         if (!centry_check_bytes(centry, 2)) {
 240                 smb_panic_fn("centry_uint16");
 241         }
 242         ret = CVAL(centry->data, centry->ofs);
 243         centry->ofs += 2;
 244         return ret;
 245 }
 246
 247 /*
 248   pull a uint8 from a cache entry
 249 */
 250 static uint8 centry_uint8(struct cache_entry *centry)
 251 {
 252         uint8 ret;
 253         if (!centry_check_bytes(centry, 1)) {
 254                 smb_panic_fn("centry_uint8");
 255         }
 256         ret = CVAL(centry->data, centry->ofs);
 257         centry->ofs += 1;
 258         return ret;
 259 }
 260
 261 /*
 262   pull a NTTIME from a cache entry
 263 */
 264 static NTTIME centry_nttime(struct cache_entry *centry)
 265 {
 266         NTTIME ret;
 267         if (!centry_check_bytes(centry, 8)) {
 268                 smb_panic_fn("centry_nttime");
 269         }
 270         ret = IVAL(centry->data, centry->ofs);
 271         centry->ofs += 4;
 272         ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
 273         centry->ofs += 4;
 274         return ret;
 275 }
 276
 277 /*
 278   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 279 */
 280 static time_t centry_time(struct cache_entry *centry)
 281 {
 282         return (time_t)centry_nttime(centry);
 283 }
 284
 285 /* pull a string from a cache entry, using the supplied
 286    talloc context
 287 */
 288 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 289 {
 290         uint32 len;
 291         char *ret;
 292
 293         len = centry_uint8(centry);
 294
 295         if (len == 0xFF) {
 296                 /* a deliberate NULL string */
 297                 return NULL;
 298         }
 299
 300         if (!centry_check_bytes(centry, (size_t)len)) {
 301                 smb_panic_fn("centry_string");
 302         }
 303
 304         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 305         if (!ret) {
 306                 smb_panic_fn("centry_string out of memory\n");
 307         }
 308         memcpy(ret,centry->data + centry->ofs, len);
 309         ret[len] = 0;
 310         centry->ofs += len;
 311         return ret;
 312 }
 313
 314 /* pull a hash16 from a cache entry, using the supplied
 315    talloc context
 316 */
 317 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 318 {
 319         uint32 len;
 320         char *ret;
 321
 322         len = centry_uint8(centry);
 323
 324         if (len != 16) {
 325                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 326                         len ));
 327                 return NULL;
 328         }
 329
 330         if (!centry_check_bytes(centry, 16)) {
 331                 return NULL;
 332         }
 333
 334         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 335         if (!ret) {
 336                 smb_panic_fn("centry_hash out of memory\n");
 337         }
 338         memcpy(ret,centry->data + centry->ofs, 16);
 339         centry->ofs += 16;
 340         return ret;
 341 }
 342
 343 /* pull a sid from a cache entry, using the supplied
 344    talloc context
 345 */
 346 static bool centry_sid(struct cache_entry *centry, TALLOC_CTX *mem_ctx, DOM_SID *sid)
 347 {
 348         char *sid_string;
 349         sid_string = centry_string(centry, mem_ctx);
 350         if ((sid_string == NULL) || (!string_to_sid(sid, sid_string))) {
 351                 return False;
 352         }
 353         return True;
 354 }
 355
 356
 357 /*
 358   pull a NTSTATUS from a cache entry
 359 */
 360 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 361 {
 362         NTSTATUS status;
 363
 364         status = NT_STATUS(centry_uint32(centry));
 365         return status;
 366 }
 367
 368
 369 /* the server is considered down if it can't give us a sequence number */
 370 static bool wcache_server_down(struct winbindd_domain *domain)
 371 {
 372         bool ret;
 373
 374         if (!wcache->tdb)
 375                 return False;
 376
 377         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 378
 379         if (ret)
 380                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 381                         domain->name ));
 382         return ret;
 383 }
 384
 385 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 386 {
 387         TDB_DATA data;
 388         fstring key;
 389         uint32 time_diff;
 390
 391         if (!wcache->tdb) {
 392                 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
 393                 return NT_STATUS_UNSUCCESSFUL;
 394         }
 395
 396         fstr_sprintf( key, "SEQNUM/%s", domain->name );
 397
 398         data = tdb_fetch_bystring( wcache->tdb, key );
 399         if ( !data.dptr || data.dsize!=8 ) {
 400                 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key ));
 401                 return NT_STATUS_UNSUCCESSFUL;
 402         }
 403
 404         domain->sequence_number = IVAL(data.dptr, 0);
 405         domain->last_seq_check  = IVAL(data.dptr, 4);
 406
 407         SAFE_FREE(data.dptr);
 408
 409         /* have we expired? */
 410
 411         time_diff = now - domain->last_seq_check;
 412         if ( time_diff > lp_winbind_cache_time() ) {
 413                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 414                         domain->name, domain->sequence_number,
 415                         (uint32)domain->last_seq_check));
 416                 return NT_STATUS_UNSUCCESSFUL;
 417         }
 418
 419         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 420                 domain->name, domain->sequence_number,
 421                 (uint32)domain->last_seq_check));
 422
 423         return NT_STATUS_OK;
 424 }
 425
 426 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
 427 {
 428         TDB_DATA data;
 429         fstring key_str;
 430         uint8 buf[8];
 431
 432         if (!wcache->tdb) {
 433                 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
 434                 return NT_STATUS_UNSUCCESSFUL;
 435         }
 436
 437         fstr_sprintf( key_str, "SEQNUM/%s", domain->name );
 438
 439         SIVAL(buf, 0, domain->sequence_number);
 440         SIVAL(buf, 4, domain->last_seq_check);
 441         data.dptr = buf;
 442         data.dsize = 8;
 443
 444         if ( tdb_store_bystring( wcache->tdb, key_str, data, TDB_REPLACE) == -1 ) {
 445                 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
 446                 return NT_STATUS_UNSUCCESSFUL;
 447         }
 448
 449         DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
 450                 domain->name, domain->sequence_number,
 451                 (uint32)domain->last_seq_check));
 452
 453         return NT_STATUS_OK;
 454 }
 455
 456 /*
 457   refresh the domain sequence number. If force is True
 458   then always refresh it, no matter how recently we fetched it
 459 */
 460
 461 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 462 {
 463         NTSTATUS status;
 464         unsigned time_diff;
 465         time_t t = time(NULL);
 466         unsigned cache_time = lp_winbind_cache_time();
 467
 468         if ( IS_DOMAIN_OFFLINE(domain) ) {
 469                 return;
 470         }
 471
 472         get_cache( domain );
 473
 474 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 475         /* trying to reconnect is expensive, don't do it too often */
 476         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 477                 cache_time *= 8;
 478         }
 479 #endif
 480
 481         time_diff = t - domain->last_seq_check;
 482
 483         /* see if we have to refetch the domain sequence number */
 484         if (!force && (time_diff < cache_time)) {
 485                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 486                 goto done;
 487         }
 488
 489         /* try to get the sequence number from the tdb cache first */
 490         /* this will update the timestamp as well */
 491
 492         status = fetch_cache_seqnum( domain, t );
 493         if ( NT_STATUS_IS_OK(status) )
 494                 goto done;
 495
 496         /* important! make sure that we know if this is a native
 497            mode domain or not.  And that we can contact it. */
 498
 499         if ( winbindd_can_contact_domain( domain ) ) {
 500                 status = domain->backend->sequence_number(domain,
 501                                                           &domain->sequence_number);
 502         } else {
 503                 /* just use the current time */
 504                 status = NT_STATUS_OK;
 505                 domain->sequence_number = time(NULL);
 506         }
 507
 508
 509         /* the above call could have set our domain->backend to NULL when
 510          * coming from offline to online mode, make sure to reinitialize the
 511          * backend - Guenther */
 512         get_cache( domain );
 513
 514         if (!NT_STATUS_IS_OK(status)) {
 515                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 516                 domain->sequence_number = DOM_SEQUENCE_NONE;
 517         }
 518
 519         domain->last_status = status;
 520         domain->last_seq_check = time(NULL);
 521
 522         /* save the new sequence number ni the cache */
 523         store_cache_seqnum( domain );
 524
 525 done:
 526         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 527                    domain->name, domain->sequence_number));
 528
 529         return;
 530 }
 531
 532 /*
 533   decide if a cache entry has expired
 534 */
 535 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 536 {
 537         /* If we've been told to be offline - stay in that state... */
 538         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 539                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 540                         keystr, domain->name ));
 541                 return False;
 542         }
 543
 544         /* when the domain is offline return the cached entry.
 545          * This deals with transient offline states... */
 546
 547         if (!domain->online) {
 548                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 549                         keystr, domain->name ));
 550                 return False;
 551         }
 552
 553         /* if the server is OK and our cache entry came from when it was down then
 554            the entry is invalid */
 555         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 556             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 557                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 558                         keystr, domain->name ));
 559                 return True;
 560         }
 561
 562         /* if the server is down or the cache entry is not older than the
 563            current sequence number then it is OK */
 564         if (wcache_server_down(domain) ||
 565             centry->sequence_number == domain->sequence_number) {
 566                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 567                         keystr, domain->name ));
 568                 return False;
 569         }
 570
 571         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 572                 keystr, domain->name ));
 573
 574         /* it's expired */
 575         return True;
 576 }
 577
 578 static struct cache_entry *wcache_fetch_raw(char *kstr)
 579 {
 580         TDB_DATA data;
 581         struct cache_entry *centry;
 582         TDB_DATA key;
 583
 584         key = string_tdb_data(kstr);
 585         data = tdb_fetch(wcache->tdb, key);
 586         if (!data.dptr) {
 587                 /* a cache miss */
 588                 return NULL;
 589         }
 590
 591         centry = SMB_XMALLOC_P(struct cache_entry);
 592         centry->data = (unsigned char *)data.dptr;
 593         centry->len = data.dsize;
 594         centry->ofs = 0;
 595
 596         if (centry->len < 8) {
 597                 /* huh? corrupt cache? */
 598                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
 599                 centry_free(centry);
 600                 return NULL;
 601         }
 602
 603         centry->status = centry_ntstatus(centry);
 604         centry->sequence_number = centry_uint32(centry);
 605
 606         return centry;
 607 }
 608
 609 /*
 610   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 611   number and return status
 612 */
 613 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 614                                         struct winbindd_domain *domain,
 615                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 616 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 617                                         struct winbindd_domain *domain,
 618                                         const char *format, ...)
 619 {
 620         va_list ap;
 621         char *kstr;
 622         struct cache_entry *centry;
 623
 624         if (opt_nocache) {
 625                 return NULL;
 626         }
 627
 628         refresh_sequence_number(domain, False);
 629
 630         va_start(ap, format);
 631         smb_xvasprintf(&kstr, format, ap);
 632         va_end(ap);
 633
 634         centry = wcache_fetch_raw(kstr);
 635         if (centry == NULL) {
 636                 free(kstr);
 637                 return NULL;
 638         }
 639
 640         if (centry_expired(domain, kstr, centry)) {
 641
 642                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 643                          kstr, domain->name ));
 644
 645                 centry_free(centry);
 646                 free(kstr);
 647                 return NULL;
 648         }
 649
 650         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 651                  kstr, domain->name ));
 652
 653         free(kstr);
 654         return centry;
 655 }
 656
 657 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 658 static void wcache_delete(const char *format, ...)
 659 {
 660         va_list ap;
 661         char *kstr;
 662         TDB_DATA key;
 663
 664         va_start(ap, format);
 665         smb_xvasprintf(&kstr, format, ap);
 666         va_end(ap);
 667
 668         key = string_tdb_data(kstr);
 669
 670         tdb_delete(wcache->tdb, key);
 671         free(kstr);
 672 }
 673
 674 /*
 675   make sure we have at least len bytes available in a centry
 676 */
 677 static void centry_expand(struct cache_entry *centry, uint32 len)
 678 {
 679         if (centry->len - centry->ofs >= len)
 680                 return;
 681         centry->len *= 2;
 682         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 683                                          centry->len);
 684         if (!centry->data) {
 685                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 686                 smb_panic_fn("out of memory in centry_expand");
 687         }
 688 }
 689
 690 /*
 691   push a uint32 into a centry
 692 */
 693 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 694 {
 695         centry_expand(centry, 4);
 696         SIVAL(centry->data, centry->ofs, v);
 697         centry->ofs += 4;
 698 }
 699
 700 /*
 701   push a uint16 into a centry
 702 */
 703 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 704 {
 705         centry_expand(centry, 2);
 706         SIVAL(centry->data, centry->ofs, v);
 707         centry->ofs += 2;
 708 }
 709
 710 /*
 711   push a uint8 into a centry
 712 */
 713 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 714 {
 715         centry_expand(centry, 1);
 716         SCVAL(centry->data, centry->ofs, v);
 717         centry->ofs += 1;
 718 }
 719
 720 /*
 721    push a string into a centry
 722  */
 723 static void centry_put_string(struct cache_entry *centry, const char *s)
 724 {
 725         int len;
 726
 727         if (!s) {
 728                 /* null strings are marked as len 0xFFFF */
 729                 centry_put_uint8(centry, 0xFF);
 730                 return;
 731         }
 732
 733         len = strlen(s);
 734         /* can't handle more than 254 char strings. Truncating is probably best */
 735         if (len > 254) {
 736                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 737                 len = 254;
 738         }
 739         centry_put_uint8(centry, len);
 740         centry_expand(centry, len);
 741         memcpy(centry->data + centry->ofs, s, len);
 742         centry->ofs += len;
 743 }
 744
 745 /*
 746    push a 16 byte hash into a centry - treat as 16 byte string.
 747  */
 748 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 749 {
 750         centry_put_uint8(centry, 16);
 751         centry_expand(centry, 16);
 752         memcpy(centry->data + centry->ofs, val, 16);
 753         centry->ofs += 16;
 754 }
 755
 756 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
 757 {
 758         fstring sid_string;
 759         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 760 }
 761
 762
 763 /*
 764   put NTSTATUS into a centry
 765 */
 766 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 767 {
 768         uint32 status_value = NT_STATUS_V(status);
 769         centry_put_uint32(centry, status_value);
 770 }
 771
 772
 773 /*
 774   push a NTTIME into a centry
 775 */
 776 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 777 {
 778         centry_expand(centry, 8);
 779         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 780         centry->ofs += 4;
 781         SIVAL(centry->data, centry->ofs, nt >> 32);
 782         centry->ofs += 4;
 783 }
 784
 785 /*
 786   push a time_t into a centry - use a 64 bit size.
 787   NTTIME here is being used as a convenient 64-bit size.
 788 */
 789 static void centry_put_time(struct cache_entry *centry, time_t t)
 790 {
 791         NTTIME nt = (NTTIME)t;
 792         centry_put_nttime(centry, nt);
 793 }
 794
 795 /*
 796   start a centry for output. When finished, call centry_end()
 797 */
 798 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 799 {
 800         struct cache_entry *centry;
 801
 802         if (!wcache->tdb)
 803                 return NULL;
 804
 805         centry = SMB_XMALLOC_P(struct cache_entry);
 806
 807         centry->len = 8192; /* reasonable default */
 808         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 809         centry->ofs = 0;
 810         centry->sequence_number = domain->sequence_number;
 811         centry_put_ntstatus(centry, status);
 812         centry_put_uint32(centry, centry->sequence_number);
 813         return centry;
 814 }
 815
 816 /*
 817   finish a centry and write it to the tdb
 818 */
 819 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 820 static void centry_end(struct cache_entry *centry, const char *format, ...)
 821 {
 822         va_list ap;
 823         char *kstr;
 824         TDB_DATA key, data;
 825
 826         if (opt_nocache) {
 827                 return;
 828         }
 829
 830         va_start(ap, format);
 831         smb_xvasprintf(&kstr, format, ap);
 832         va_end(ap);
 833
 834         key = string_tdb_data(kstr);
 835         data.dptr = centry->data;
 836         data.dsize = centry->ofs;
 837
 838         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 839         free(kstr);
 840 }
 841
 842 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 843                                     NTSTATUS status, const char *domain_name,
 844                                     const char *name, const DOM_SID *sid,
 845                                     enum lsa_SidType type)
 846 {
 847         struct cache_entry *centry;
 848         fstring uname;
 849
 850         centry = centry_start(domain, status);
 851         if (!centry)
 852                 return;
 853         centry_put_uint32(centry, type);
 854         centry_put_sid(centry, sid);
 855         fstrcpy(uname, name);
 856         strupper_m(uname);
 857         centry_end(centry, "NS/%s/%s", domain_name, uname);
 858         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 859                   uname, sid_string_dbg(sid), nt_errstr(status)));
 860         centry_free(centry);
 861 }
 862
 863 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 864                                     const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 865 {
 866         struct cache_entry *centry;
 867         fstring sid_string;
 868
 869         centry = centry_start(domain, status);
 870         if (!centry)
 871                 return;
 872
 873         if (NT_STATUS_IS_OK(status)) {
 874                 centry_put_uint32(centry, type);
 875                 centry_put_string(centry, domain_name);
 876                 centry_put_string(centry, name);
 877         }
 878
 879         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 880         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 881                   name, nt_errstr(status)));
 882         centry_free(centry);
 883 }
 884
 885
 886 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WINBIND_USERINFO *info)
 887 {
 888         struct cache_entry *centry;
 889         fstring sid_string;
 890
 891         if (is_null_sid(&info->user_sid)) {
 892                 return;
 893         }
 894
 895         centry = centry_start(domain, status);
 896         if (!centry)
 897                 return;
 898         centry_put_string(centry, info->acct_name);
 899         centry_put_string(centry, info->full_name);
 900         centry_put_string(centry, info->homedir);
 901         centry_put_string(centry, info->shell);
 902         centry_put_uint32(centry, info->primary_gid);
 903         centry_put_sid(centry, &info->user_sid);
 904         centry_put_sid(centry, &info->group_sid);
 905         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 906                                                   &info->user_sid));
 907         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 908         centry_free(centry);
 909 }
 910
 911 static void wcache_save_lockout_policy(struct winbindd_domain *domain, NTSTATUS status, SAM_UNK_INFO_12 *lockout_policy)
 912 {
 913         struct cache_entry *centry;
 914
 915         centry = centry_start(domain, status);
 916         if (!centry)
 917                 return;
 918
 919         centry_put_nttime(centry, lockout_policy->duration);
 920         centry_put_nttime(centry, lockout_policy->reset_count);
 921         centry_put_uint16(centry, lockout_policy->bad_attempt_lockout);
 922
 923         centry_end(centry, "LOC_POL/%s", domain->name);
 924
 925         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
 926
 927         centry_free(centry);
 928 }
 929
 930 static void wcache_save_password_policy(struct winbindd_domain *domain, NTSTATUS status, SAM_UNK_INFO_1 *policy)
 931 {
 932         struct cache_entry *centry;
 933
 934         centry = centry_start(domain, status);
 935         if (!centry)
 936                 return;
 937
 938         centry_put_uint16(centry, policy->min_length_password);
 939         centry_put_uint16(centry, policy->password_history);
 940         centry_put_uint32(centry, policy->password_properties);
 941         centry_put_nttime(centry, policy->expire);
 942         centry_put_nttime(centry, policy->min_passwordage);
 943
 944         centry_end(centry, "PWD_POL/%s", domain->name);
 945
 946         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
 947
 948         centry_free(centry);
 949 }
 950
 951 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
 952 {
 953         struct winbind_cache *cache = get_cache(domain);
 954         TDB_DATA data;
 955         fstring key_str, tmp;
 956         uint32 rid;
 957
 958         if (!cache->tdb) {
 959                 return NT_STATUS_INTERNAL_DB_ERROR;
 960         }
 961
 962         if (is_null_sid(sid)) {
 963                 return NT_STATUS_INVALID_SID;
 964         }
 965
 966         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
 967                 return NT_STATUS_INVALID_SID;
 968         }
 969
 970         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
 971
 972         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
 973         if (!data.dptr) {
 974                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 975         }
 976
 977         SAFE_FREE(data.dptr);
 978         return NT_STATUS_OK;
 979 }
 980
 981 /* Lookup creds for a SID - copes with old (unsalted) creds as well
 982    as new salted ones. */
 983
 984 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
 985                           TALLOC_CTX *mem_ctx,
 986                           const DOM_SID *sid,
 987                           const uint8 **cached_nt_pass,
 988                           const uint8 **cached_salt)
 989 {
 990         struct winbind_cache *cache = get_cache(domain);
 991         struct cache_entry *centry = NULL;
 992         NTSTATUS status;
 993         time_t t;
 994         uint32 rid;
 995         fstring tmp;
 996
 997         if (!cache->tdb) {
 998                 return NT_STATUS_INTERNAL_DB_ERROR;
 999         }
1000
1001         if (is_null_sid(sid)) {
1002                 return NT_STATUS_INVALID_SID;
1003         }
1004
1005         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1006                 return NT_STATUS_INVALID_SID;
1007         }
1008
1009         /* Try and get a salted cred first. If we can't
1010            fall back to an unsalted cred. */
1011
1012         centry = wcache_fetch(cache, domain, "CRED/%s",
1013                               sid_to_fstring(tmp, sid));
1014         if (!centry) {
1015                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1016                           sid_string_dbg(sid)));
1017                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1018         }
1019
1020         t = centry_time(centry);
1021
1022         /* In the salted case this isn't actually the nt_hash itself,
1023            but the MD5 of the salt + nt_hash. Let the caller
1024            sort this out. It can tell as we only return the cached_salt
1025            if we are returning a salted cred. */
1026
1027         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1028         if (*cached_nt_pass == NULL) {
1029                 fstring sidstr;
1030
1031                 sid_to_fstring(sidstr, sid);
1032
1033                 /* Bad (old) cred cache. Delete and pretend we
1034                    don't have it. */
1035                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1036                                 sidstr));
1037                 wcache_delete("CRED/%s", sidstr);
1038                 centry_free(centry);
1039                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1040         }
1041
1042         /* We only have 17 bytes more data in the salted cred case. */
1043         if (centry->len - centry->ofs == 17) {
1044                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1045         } else {
1046                 *cached_salt = NULL;
1047         }
1048
1049         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1050         if (*cached_salt) {
1051                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1052         }
1053
1054         status = centry->status;
1055
1056         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1057                   sid_string_dbg(sid), nt_errstr(status) ));
1058
1059         centry_free(centry);
1060         return status;
1061 }
1062
1063 /* Store creds for a SID - only writes out new salted ones. */
1064
1065 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1066                            TALLOC_CTX *mem_ctx,
1067                            const DOM_SID *sid,
1068                            const uint8 nt_pass[NT_HASH_LEN])
1069 {
1070         struct cache_entry *centry;
1071         fstring sid_string;
1072         uint32 rid;
1073         uint8 cred_salt[NT_HASH_LEN];
1074         uint8 salted_hash[NT_HASH_LEN];
1075
1076         if (is_null_sid(sid)) {
1077                 return NT_STATUS_INVALID_SID;
1078         }
1079
1080         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1081                 return NT_STATUS_INVALID_SID;
1082         }
1083
1084         centry = centry_start(domain, NT_STATUS_OK);
1085         if (!centry) {
1086                 return NT_STATUS_INTERNAL_DB_ERROR;
1087         }
1088
1089         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1090
1091         centry_put_time(centry, time(NULL));
1092
1093         /* Create a salt and then salt the hash. */
1094         generate_random_buffer(cred_salt, NT_HASH_LEN);
1095         E_md5hash(cred_salt, nt_pass, salted_hash);
1096
1097         centry_put_hash16(centry, salted_hash);
1098         centry_put_hash16(centry, cred_salt);
1099         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1100
1101         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1102
1103         centry_free(centry);
1104
1105         return NT_STATUS_OK;
1106 }
1107
1108
1109 /* Query display info. This is the basic user list fn */
1110 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1111                                 TALLOC_CTX *mem_ctx,
1112                                 uint32 *num_entries,
1113                                 WINBIND_USERINFO **info)
1114 {
1115         struct winbind_cache *cache = get_cache(domain);
1116         struct cache_entry *centry = NULL;
1117         NTSTATUS status;
1118         unsigned int i, retry;
1119
1120         if (!cache->tdb)
1121                 goto do_query;
1122
1123         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1124         if (!centry)
1125                 goto do_query;
1126
1127         *num_entries = centry_uint32(centry);
1128
1129         if (*num_entries == 0)
1130                 goto do_cached;
1131
1132         (*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
1133         if (! (*info)) {
1134                 smb_panic_fn("query_user_list out of memory");
1135         }
1136         for (i=0; i<(*num_entries); i++) {
1137                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1138                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1139                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1140                 (*info)[i].shell = centry_string(centry, mem_ctx);
1141                 centry_sid(centry, mem_ctx, &(*info)[i].user_sid);
1142                 centry_sid(centry, mem_ctx, &(*info)[i].group_sid);
1143         }
1144
1145 do_cached:
1146         status = centry->status;
1147
1148         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1149                 domain->name, nt_errstr(status) ));
1150
1151         centry_free(centry);
1152         return status;
1153
1154 do_query:
1155         *num_entries = 0;
1156         *info = NULL;
1157
1158         /* Return status value returned by seq number check */
1159
1160         if (!NT_STATUS_IS_OK(domain->last_status))
1161                 return domain->last_status;
1162
1163         /* Put the query_user_list() in a retry loop.  There appears to be
1164          * some bug either with Windows 2000 or Samba's handling of large
1165          * rpc replies.  This manifests itself as sudden disconnection
1166          * at a random point in the enumeration of a large (60k) user list.
1167          * The retry loop simply tries the operation again. )-:  It's not
1168          * pretty but an acceptable workaround until we work out what the
1169          * real problem is. */
1170
1171         retry = 0;
1172         do {
1173
1174                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1175                         domain->name ));
1176
1177                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1178                 if (!NT_STATUS_IS_OK(status)) {
1179                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1180                                   "retrying\n", NT_STATUS_V(status)));
1181                 }
1182                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1183                         DEBUG(3, ("query_user_list: flushing "
1184                                   "connection cache\n"));
1185                         invalidate_cm_connection(&domain->conn);
1186                 }
1187
1188         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1189                  (retry++ < 5));
1190
1191         /* and save it */
1192         refresh_sequence_number(domain, False);
1193         centry = centry_start(domain, status);
1194         if (!centry)
1195                 goto skip_save;
1196         centry_put_uint32(centry, *num_entries);
1197         for (i=0; i<(*num_entries); i++) {
1198                 centry_put_string(centry, (*info)[i].acct_name);
1199                 centry_put_string(centry, (*info)[i].full_name);
1200                 centry_put_string(centry, (*info)[i].homedir);
1201                 centry_put_string(centry, (*info)[i].shell);
1202                 centry_put_sid(centry, &(*info)[i].user_sid);
1203                 centry_put_sid(centry, &(*info)[i].group_sid);
1204                 if (domain->backend && domain->backend->consistent) {
1205                         /* when the backend is consistent we can pre-prime some mappings */
1206                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1207                                                 domain->name,
1208                                                 (*info)[i].acct_name,
1209                                                 &(*info)[i].user_sid,
1210                                                 SID_NAME_USER);
1211                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1212                                                 &(*info)[i].user_sid,
1213                                                 domain->name,
1214                                                 (*info)[i].acct_name,
1215                                                 SID_NAME_USER);
1216                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1217                 }
1218         }
1219         centry_end(centry, "UL/%s", domain->name);
1220         centry_free(centry);
1221
1222 skip_save:
1223         return status;
1224 }
1225
1226 /* list all domain groups */
1227 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1228                                 TALLOC_CTX *mem_ctx,
1229                                 uint32 *num_entries,
1230                                 struct acct_info **info)
1231 {
1232         struct winbind_cache *cache = get_cache(domain);
1233         struct cache_entry *centry = NULL;
1234         NTSTATUS status;
1235         unsigned int i;
1236
1237         if (!cache->tdb)
1238                 goto do_query;
1239
1240         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1241         if (!centry)
1242                 goto do_query;
1243
1244         *num_entries = centry_uint32(centry);
1245
1246         if (*num_entries == 0)
1247                 goto do_cached;
1248
1249         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1250         if (! (*info)) {
1251                 smb_panic_fn("enum_dom_groups out of memory");
1252         }
1253         for (i=0; i<(*num_entries); i++) {
1254                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1255                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1256                 (*info)[i].rid = centry_uint32(centry);
1257         }
1258
1259 do_cached:
1260         status = centry->status;
1261
1262         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1263                 domain->name, nt_errstr(status) ));
1264
1265         centry_free(centry);
1266         return status;
1267
1268 do_query:
1269         *num_entries = 0;
1270         *info = NULL;
1271
1272         /* Return status value returned by seq number check */
1273
1274         if (!NT_STATUS_IS_OK(domain->last_status))
1275                 return domain->last_status;
1276
1277         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1278                 domain->name ));
1279
1280         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1281
1282         /* and save it */
1283         refresh_sequence_number(domain, False);
1284         centry = centry_start(domain, status);
1285         if (!centry)
1286                 goto skip_save;
1287         centry_put_uint32(centry, *num_entries);
1288         for (i=0; i<(*num_entries); i++) {
1289                 centry_put_string(centry, (*info)[i].acct_name);
1290                 centry_put_string(centry, (*info)[i].acct_desc);
1291                 centry_put_uint32(centry, (*info)[i].rid);
1292         }
1293         centry_end(centry, "GL/%s/domain", domain->name);
1294         centry_free(centry);
1295
1296 skip_save:
1297         return status;
1298 }
1299
1300 /* list all domain groups */
1301 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1302                                 TALLOC_CTX *mem_ctx,
1303                                 uint32 *num_entries,
1304                                 struct acct_info **info)
1305 {
1306         struct winbind_cache *cache = get_cache(domain);
1307         struct cache_entry *centry = NULL;
1308         NTSTATUS status;
1309         unsigned int i;
1310
1311         if (!cache->tdb)
1312                 goto do_query;
1313
1314         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1315         if (!centry)
1316                 goto do_query;
1317
1318         *num_entries = centry_uint32(centry);
1319
1320         if (*num_entries == 0)
1321                 goto do_cached;
1322
1323         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1324         if (! (*info)) {
1325                 smb_panic_fn("enum_dom_groups out of memory");
1326         }
1327         for (i=0; i<(*num_entries); i++) {
1328                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1329                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1330                 (*info)[i].rid = centry_uint32(centry);
1331         }
1332
1333 do_cached:
1334
1335         /* If we are returning cached data and the domain controller
1336            is down then we don't know whether the data is up to date
1337            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1338            indicate this. */
1339
1340         if (wcache_server_down(domain)) {
1341                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1342                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1343         } else
1344                 status = centry->status;
1345
1346         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1347                 domain->name, nt_errstr(status) ));
1348
1349         centry_free(centry);
1350         return status;
1351
1352 do_query:
1353         *num_entries = 0;
1354         *info = NULL;
1355
1356         /* Return status value returned by seq number check */
1357
1358         if (!NT_STATUS_IS_OK(domain->last_status))
1359                 return domain->last_status;
1360
1361         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1362                 domain->name ));
1363
1364         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1365
1366         /* and save it */
1367         refresh_sequence_number(domain, False);
1368         centry = centry_start(domain, status);
1369         if (!centry)
1370                 goto skip_save;
1371         centry_put_uint32(centry, *num_entries);
1372         for (i=0; i<(*num_entries); i++) {
1373                 centry_put_string(centry, (*info)[i].acct_name);
1374                 centry_put_string(centry, (*info)[i].acct_desc);
1375                 centry_put_uint32(centry, (*info)[i].rid);
1376         }
1377         centry_end(centry, "GL/%s/local", domain->name);
1378         centry_free(centry);
1379
1380 skip_save:
1381         return status;
1382 }
1383
1384 /* convert a single name to a sid in a domain */
1385 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1386                             TALLOC_CTX *mem_ctx,
1387                             enum winbindd_cmd orig_cmd,
1388                             const char *domain_name,
1389                             const char *name,
1390                             DOM_SID *sid,
1391                             enum lsa_SidType *type)
1392 {
1393         struct winbind_cache *cache = get_cache(domain);
1394         struct cache_entry *centry = NULL;
1395         NTSTATUS status;
1396         fstring uname;
1397
1398         if (!cache->tdb)
1399                 goto do_query;
1400
1401         fstrcpy(uname, name);
1402         strupper_m(uname);
1403         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1404         if (!centry)
1405                 goto do_query;
1406
1407         status = centry->status;
1408         if (NT_STATUS_IS_OK(status)) {
1409                 *type = (enum lsa_SidType)centry_uint32(centry);
1410                 centry_sid(centry, mem_ctx, sid);
1411         }
1412
1413         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: %s\n",
1414                 domain->name, nt_errstr(status) ));
1415
1416         centry_free(centry);
1417         return status;
1418
1419 do_query:
1420         ZERO_STRUCTP(sid);
1421
1422         /* If the seq number check indicated that there is a problem
1423          * with this DC, then return that status... except for
1424          * access_denied.  This is special because the dc may be in
1425          * "restrict anonymous = 1" mode, in which case it will deny
1426          * most unauthenticated operations, but *will* allow the LSA
1427          * name-to-sid that we try as a fallback. */
1428
1429         if (!(NT_STATUS_IS_OK(domain->last_status)
1430               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1431                 return domain->last_status;
1432
1433         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1434                 domain->name ));
1435
1436         status = domain->backend->name_to_sid(domain, mem_ctx, orig_cmd,
1437                                               domain_name, name, sid, type);
1438
1439         /* and save it */
1440         refresh_sequence_number(domain, False);
1441
1442         if (domain->online &&
1443             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1444                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1445
1446                 /* Only save the reverse mapping if this was not a UPN */
1447                 if (!strchr(name, '@')) {
1448                         strupper_m(CONST_DISCARD(char *,domain_name));
1449                         strlower_m(CONST_DISCARD(char *,name));
1450                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1451                 }
1452         }
1453
1454         return status;
1455 }
1456
1457 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1458    given */
1459 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1460                             TALLOC_CTX *mem_ctx,
1461                             const DOM_SID *sid,
1462                             char **domain_name,
1463                             char **name,
1464                             enum lsa_SidType *type)
1465 {
1466         struct winbind_cache *cache = get_cache(domain);
1467         struct cache_entry *centry = NULL;
1468         NTSTATUS status;
1469         fstring sid_string;
1470
1471         if (!cache->tdb)
1472                 goto do_query;
1473
1474         centry = wcache_fetch(cache, domain, "SN/%s",
1475                               sid_to_fstring(sid_string, sid));
1476         if (!centry)
1477                 goto do_query;
1478
1479         status = centry->status;
1480         if (NT_STATUS_IS_OK(status)) {
1481                 *type = (enum lsa_SidType)centry_uint32(centry);
1482                 *domain_name = centry_string(centry, mem_ctx);
1483                 *name = centry_string(centry, mem_ctx);
1484         }
1485
1486         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: %s\n",
1487                 domain->name, nt_errstr(status) ));
1488
1489         centry_free(centry);
1490         return status;
1491
1492 do_query:
1493         *name = NULL;
1494         *domain_name = NULL;
1495
1496         /* If the seq number check indicated that there is a problem
1497          * with this DC, then return that status... except for
1498          * access_denied.  This is special because the dc may be in
1499          * "restrict anonymous = 1" mode, in which case it will deny
1500          * most unauthenticated operations, but *will* allow the LSA
1501          * sid-to-name that we try as a fallback. */
1502
1503         if (!(NT_STATUS_IS_OK(domain->last_status)
1504               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1505                 return domain->last_status;
1506
1507         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1508                 domain->name ));
1509
1510         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1511
1512         /* and save it */
1513         refresh_sequence_number(domain, False);
1514         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1515
1516         /* We can't save the name to sid mapping here, as with sid history a
1517          * later name2sid would give the wrong sid. */
1518
1519         return status;
1520 }
1521
1522 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1523                               TALLOC_CTX *mem_ctx,
1524                               const DOM_SID *domain_sid,
1525                               uint32 *rids,
1526                               size_t num_rids,
1527                               char **domain_name,
1528                               char ***names,
1529                               enum lsa_SidType **types)
1530 {
1531         struct winbind_cache *cache = get_cache(domain);
1532         size_t i;
1533         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1534         bool have_mapped;
1535         bool have_unmapped;
1536
1537         *domain_name = NULL;
1538         *names = NULL;
1539         *types = NULL;
1540
1541         if (!cache->tdb) {
1542                 goto do_query;
1543         }
1544
1545         if (num_rids == 0) {
1546                 return NT_STATUS_OK;
1547         }
1548
1549         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1550         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1551
1552         if ((*names == NULL) || (*types == NULL)) {
1553                 result = NT_STATUS_NO_MEMORY;
1554                 goto error;
1555         }
1556
1557         have_mapped = have_unmapped = False;
1558
1559         for (i=0; i<num_rids; i++) {
1560                 DOM_SID sid;
1561                 struct cache_entry *centry;
1562                 fstring tmp;
1563
1564                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1565                         result = NT_STATUS_INTERNAL_ERROR;
1566                         goto error;
1567                 }
1568
1569                 centry = wcache_fetch(cache, domain, "SN/%s",
1570                                       sid_to_fstring(tmp, &sid));
1571                 if (!centry) {
1572                         goto do_query;
1573                 }
1574
1575                 (*types)[i] = SID_NAME_UNKNOWN;
1576                 (*names)[i] = talloc_strdup(*names, "");
1577
1578                 if (NT_STATUS_IS_OK(centry->status)) {
1579                         char *dom;
1580                         have_mapped = True;
1581                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1582
1583                         dom = centry_string(centry, mem_ctx);
1584                         if (*domain_name == NULL) {
1585                                 *domain_name = dom;
1586                         } else {
1587                                 talloc_free(dom);
1588                         }
1589
1590                         (*names)[i] = centry_string(centry, *names);
1591
1592                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1593                         have_unmapped = True;
1594
1595                 } else {
1596                         /* something's definitely wrong */
1597                         result = centry->status;
1598                         goto error;
1599                 }
1600
1601                 centry_free(centry);
1602         }
1603
1604         if (!have_mapped) {
1605                 return NT_STATUS_NONE_MAPPED;
1606         }
1607         if (!have_unmapped) {
1608                 return NT_STATUS_OK;
1609         }
1610         return STATUS_SOME_UNMAPPED;
1611
1612  do_query:
1613
1614         TALLOC_FREE(*names);
1615         TALLOC_FREE(*types);
1616
1617         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1618                                                 rids, num_rids, domain_name,
1619                                                 names, types);
1620
1621         /*
1622           None of the queried rids has been found so save all negative entries
1623         */
1624         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1625                 for (i = 0; i < num_rids; i++) {
1626                         DOM_SID sid;
1627                         const char *name = "";
1628                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
1629                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
1630
1631                         if (!sid_compose(&sid, domain_sid, rids[i])) {
1632                                 return NT_STATUS_INTERNAL_ERROR;
1633                         }
1634
1635                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1636                                                 name, type);
1637                 }
1638
1639                 return result;
1640         }
1641
1642         /*
1643           Some or all of the queried rids have been found.
1644         */
1645         if (!NT_STATUS_IS_OK(result) &&
1646             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1647                 return result;
1648         }
1649
1650         refresh_sequence_number(domain, False);
1651
1652         for (i=0; i<num_rids; i++) {
1653                 DOM_SID sid;
1654                 NTSTATUS status;
1655
1656                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1657                         result = NT_STATUS_INTERNAL_ERROR;
1658                         goto error;
1659                 }
1660
1661                 status = (*types)[i] == SID_NAME_UNKNOWN ?
1662                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1663
1664                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1665                                         (*names)[i], (*types)[i]);
1666         }
1667
1668         return result;
1669
1670  error:
1671
1672         TALLOC_FREE(*names);
1673         TALLOC_FREE(*types);
1674         return result;
1675 }
1676
1677 /* Lookup user information from a rid */
1678 static NTSTATUS query_user(struct winbindd_domain *domain,
1679                            TALLOC_CTX *mem_ctx,
1680                            const DOM_SID *user_sid,
1681                            WINBIND_USERINFO *info)
1682 {
1683         struct winbind_cache *cache = get_cache(domain);
1684         struct cache_entry *centry = NULL;
1685         NTSTATUS status;
1686         fstring tmp;
1687
1688         if (!cache->tdb)
1689                 goto do_query;
1690
1691         centry = wcache_fetch(cache, domain, "U/%s",
1692                               sid_to_fstring(tmp, user_sid));
1693
1694         /* If we have an access denied cache entry and a cached info3 in the
1695            samlogon cache then do a query.  This will force the rpc back end
1696            to return the info3 data. */
1697
1698         if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1699             netsamlogon_cache_have(user_sid)) {
1700                 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1701                 domain->last_status = NT_STATUS_OK;
1702                 centry_free(centry);
1703                 goto do_query;
1704         }
1705
1706         if (!centry)
1707                 goto do_query;
1708
1709         /* if status is not ok then this is a negative hit
1710            and the rest of the data doesn't matter */
1711         status = centry->status;
1712         if (NT_STATUS_IS_OK(status)) {
1713                 info->acct_name = centry_string(centry, mem_ctx);
1714                 info->full_name = centry_string(centry, mem_ctx);
1715                 info->homedir = centry_string(centry, mem_ctx);
1716                 info->shell = centry_string(centry, mem_ctx);
1717                 info->primary_gid = centry_uint32(centry);
1718                 centry_sid(centry, mem_ctx, &info->user_sid);
1719                 centry_sid(centry, mem_ctx, &info->group_sid);
1720         }
1721
1722         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: %s\n",
1723                 domain->name, nt_errstr(status) ));
1724
1725         centry_free(centry);
1726         return status;
1727
1728 do_query:
1729         ZERO_STRUCTP(info);
1730
1731         /* Return status value returned by seq number check */
1732
1733         if (!NT_STATUS_IS_OK(domain->last_status))
1734                 return domain->last_status;
1735
1736         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
1737                 domain->name ));
1738
1739         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
1740
1741         /* and save it */
1742         refresh_sequence_number(domain, False);
1743         wcache_save_user(domain, status, info);
1744
1745         return status;
1746 }
1747
1748
1749 /* Lookup groups a user is a member of. */
1750 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
1751                                   TALLOC_CTX *mem_ctx,
1752                                   const DOM_SID *user_sid,
1753                                   uint32 *num_groups, DOM_SID **user_gids)
1754 {
1755         struct winbind_cache *cache = get_cache(domain);
1756         struct cache_entry *centry = NULL;
1757         NTSTATUS status;
1758         unsigned int i;
1759         fstring sid_string;
1760
1761         if (!cache->tdb)
1762                 goto do_query;
1763
1764         centry = wcache_fetch(cache, domain, "UG/%s",
1765                               sid_to_fstring(sid_string, user_sid));
1766
1767         /* If we have an access denied cache entry and a cached info3 in the
1768            samlogon cache then do a query.  This will force the rpc back end
1769            to return the info3 data. */
1770
1771         if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1772             netsamlogon_cache_have(user_sid)) {
1773                 DEBUG(10, ("lookup_usergroups: cached access denied and have cached info3\n"));
1774                 domain->last_status = NT_STATUS_OK;
1775                 centry_free(centry);
1776                 goto do_query;
1777         }
1778
1779         if (!centry)
1780                 goto do_query;
1781
1782         *num_groups = centry_uint32(centry);
1783
1784         if (*num_groups == 0)
1785                 goto do_cached;
1786
1787         (*user_gids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_groups);
1788         if (! (*user_gids)) {
1789                 smb_panic_fn("lookup_usergroups out of memory");
1790         }
1791         for (i=0; i<(*num_groups); i++) {
1792                 centry_sid(centry, mem_ctx, &(*user_gids)[i]);
1793         }
1794
1795 do_cached:
1796         status = centry->status;
1797
1798         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status: %s\n",
1799                 domain->name, nt_errstr(status) ));
1800
1801         centry_free(centry);
1802         return status;
1803
1804 do_query:
1805         (*num_groups) = 0;
1806         (*user_gids) = NULL;
1807
1808         /* Return status value returned by seq number check */
1809
1810         if (!NT_STATUS_IS_OK(domain->last_status))
1811                 return domain->last_status;
1812
1813         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
1814                 domain->name ));
1815
1816         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
1817
1818         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
1819                 goto skip_save;
1820
1821         /* and save it */
1822         refresh_sequence_number(domain, False);
1823         centry = centry_start(domain, status);
1824         if (!centry)
1825                 goto skip_save;
1826
1827         centry_put_uint32(centry, *num_groups);
1828         for (i=0; i<(*num_groups); i++) {
1829                 centry_put_sid(centry, &(*user_gids)[i]);
1830         }
1831
1832         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
1833         centry_free(centry);
1834
1835 skip_save:
1836         return status;
1837 }
1838
1839 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
1840                                    TALLOC_CTX *mem_ctx,
1841                                    uint32 num_sids, const DOM_SID *sids,
1842                                    uint32 *num_aliases, uint32 **alias_rids)
1843 {
1844         struct winbind_cache *cache = get_cache(domain);
1845         struct cache_entry *centry = NULL;
1846         NTSTATUS status;
1847         char *sidlist = talloc_strdup(mem_ctx, "");
1848         int i;
1849
1850         if (!cache->tdb)
1851                 goto do_query;
1852
1853         if (num_sids == 0) {
1854                 *num_aliases = 0;
1855                 *alias_rids = NULL;
1856                 return NT_STATUS_OK;
1857         }
1858
1859         /* We need to cache indexed by the whole list of SIDs, the aliases
1860          * resulting might come from any of the SIDs. */
1861
1862         for (i=0; i<num_sids; i++) {
1863                 fstring tmp;
1864                 sidlist = talloc_asprintf(mem_ctx, "%s/%s", sidlist,
1865                                           sid_to_fstring(tmp, &sids[i]));
1866                 if (sidlist == NULL)
1867                         return NT_STATUS_NO_MEMORY;
1868         }
1869
1870         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
1871
1872         if (!centry)
1873                 goto do_query;
1874
1875         *num_aliases = centry_uint32(centry);
1876         *alias_rids = NULL;
1877
1878         if (*num_aliases) {
1879                 (*alias_rids) = TALLOC_ARRAY(mem_ctx, uint32, *num_aliases);
1880
1881                 if ((*alias_rids) == NULL) {
1882                         centry_free(centry);
1883                         return NT_STATUS_NO_MEMORY;
1884                 }
1885         } else {
1886                 (*alias_rids) = NULL;
1887         }
1888
1889         for (i=0; i<(*num_aliases); i++)
1890                 (*alias_rids)[i] = centry_uint32(centry);
1891
1892         status = centry->status;
1893
1894         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
1895                   "status %s\n", domain->name, nt_errstr(status)));
1896
1897         centry_free(centry);
1898         return status;
1899
1900  do_query:
1901         (*num_aliases) = 0;
1902         (*alias_rids) = NULL;
1903
1904         if (!NT_STATUS_IS_OK(domain->last_status))
1905                 return domain->last_status;
1906
1907         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
1908                   "for domain %s\n", domain->name ));
1909
1910         status = domain->backend->lookup_useraliases(domain, mem_ctx,
1911                                                      num_sids, sids,
1912                                                      num_aliases, alias_rids);
1913
1914         /* and save it */
1915         refresh_sequence_number(domain, False);
1916         centry = centry_start(domain, status);
1917         if (!centry)
1918                 goto skip_save;
1919         centry_put_uint32(centry, *num_aliases);
1920         for (i=0; i<(*num_aliases); i++)
1921                 centry_put_uint32(centry, (*alias_rids)[i]);
1922         centry_end(centry, "UA%s", sidlist);
1923         centry_free(centry);
1924
1925  skip_save:
1926         return status;
1927 }
1928
1929
1930 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
1931                                 TALLOC_CTX *mem_ctx,
1932                                 const DOM_SID *group_sid, uint32 *num_names,
1933                                 DOM_SID **sid_mem, char ***names,
1934                                 uint32 **name_types)
1935 {
1936         struct winbind_cache *cache = get_cache(domain);
1937         struct cache_entry *centry = NULL;
1938         NTSTATUS status;
1939         unsigned int i;
1940         fstring sid_string;
1941
1942         if (!cache->tdb)
1943                 goto do_query;
1944
1945         centry = wcache_fetch(cache, domain, "GM/%s",
1946                               sid_to_fstring(sid_string, group_sid));
1947         if (!centry)
1948                 goto do_query;
1949
1950         *num_names = centry_uint32(centry);
1951
1952         if (*num_names == 0)
1953                 goto do_cached;
1954
1955         (*sid_mem) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_names);
1956         (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
1957         (*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
1958
1959         if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
1960                 smb_panic_fn("lookup_groupmem out of memory");
1961         }
1962
1963         for (i=0; i<(*num_names); i++) {
1964                 centry_sid(centry, mem_ctx, &(*sid_mem)[i]);
1965                 (*names)[i] = centry_string(centry, mem_ctx);
1966                 (*name_types)[i] = centry_uint32(centry);
1967         }
1968
1969 do_cached:
1970         status = centry->status;
1971
1972         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status: %s\n",
1973                 domain->name, nt_errstr(status)));
1974
1975         centry_free(centry);
1976         return status;
1977
1978 do_query:
1979         (*num_names) = 0;
1980         (*sid_mem) = NULL;
1981         (*names) = NULL;
1982         (*name_types) = NULL;
1983
1984         /* Return status value returned by seq number check */
1985
1986         if (!NT_STATUS_IS_OK(domain->last_status))
1987                 return domain->last_status;
1988
1989         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
1990                 domain->name ));
1991
1992         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
1993                                                   sid_mem, names, name_types);
1994
1995         /* and save it */
1996         refresh_sequence_number(domain, False);
1997         centry = centry_start(domain, status);
1998         if (!centry)
1999                 goto skip_save;
2000         centry_put_uint32(centry, *num_names);
2001         for (i=0; i<(*num_names); i++) {
2002                 centry_put_sid(centry, &(*sid_mem)[i]);
2003                 centry_put_string(centry, (*names)[i]);
2004                 centry_put_uint32(centry, (*name_types)[i]);
2005         }
2006         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2007         centry_free(centry);
2008
2009 skip_save:
2010         return status;
2011 }
2012
2013 /* find the sequence number for a domain */
2014 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2015 {
2016         refresh_sequence_number(domain, False);
2017
2018         *seq = domain->sequence_number;
2019
2020         return NT_STATUS_OK;
2021 }
2022
2023 /* enumerate trusted domains
2024  * (we need to have the list of trustdoms in the cache when we go offline) -
2025  * Guenther */
2026 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2027                                 TALLOC_CTX *mem_ctx,
2028                                 uint32 *num_domains,
2029                                 char ***names,
2030                                 char ***alt_names,
2031                                 DOM_SID **dom_sids)
2032 {
2033         struct winbind_cache *cache = get_cache(domain);
2034         struct cache_entry *centry = NULL;
2035         NTSTATUS status;
2036         int i;
2037
2038         if (!cache->tdb)
2039                 goto do_query;
2040
2041         centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2042
2043         if (!centry) {
2044                 goto do_query;
2045         }
2046
2047         *num_domains = centry_uint32(centry);
2048
2049         if (*num_domains) {
2050                 (*names)        = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2051                 (*alt_names)    = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2052                 (*dom_sids)     = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2053
2054                 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2055                         smb_panic_fn("trusted_domains out of memory");
2056                 }
2057         } else {
2058                 (*names) = NULL;
2059                 (*alt_names) = NULL;
2060                 (*dom_sids) = NULL;
2061         }
2062
2063         for (i=0; i<(*num_domains); i++) {
2064                 (*names)[i] = centry_string(centry, mem_ctx);
2065                 (*alt_names)[i] = centry_string(centry, mem_ctx);
2066                 centry_sid(centry, mem_ctx, &(*dom_sids)[i]);
2067         }
2068
2069         status = centry->status;
2070
2071         DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2072                 domain->name, *num_domains, nt_errstr(status) ));
2073
2074         centry_free(centry);
2075         return status;
2076
2077 do_query:
2078         (*num_domains) = 0;
2079         (*dom_sids) = NULL;
2080         (*names) = NULL;
2081         (*alt_names) = NULL;
2082
2083         /* Return status value returned by seq number check */
2084
2085         if (!NT_STATUS_IS_OK(domain->last_status))
2086                 return domain->last_status;
2087
2088         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2089                 domain->name ));
2090
2091         status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2092                                                 names, alt_names, dom_sids);
2093
2094         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2095          * so that the generic centry handling still applies correctly -
2096          * Guenther*/
2097
2098         if (!NT_STATUS_IS_ERR(status)) {
2099                 status = NT_STATUS_OK;
2100         }
2101
2102
2103 #if 0    /* Disabled as we want the trust dom list to be managed by
2104             the main parent and always to make the query.  --jerry */
2105
2106         /* and save it */
2107         refresh_sequence_number(domain, False);
2108
2109         centry = centry_start(domain, status);
2110         if (!centry)
2111                 goto skip_save;
2112
2113         centry_put_uint32(centry, *num_domains);
2114
2115         for (i=0; i<(*num_domains); i++) {
2116                 centry_put_string(centry, (*names)[i]);
2117                 centry_put_string(centry, (*alt_names)[i]);
2118                 centry_put_sid(centry, &(*dom_sids)[i]);
2119         }
2120
2121         centry_end(centry, "TRUSTDOMS/%s", domain->name);
2122
2123         centry_free(centry);
2124
2125 skip_save:
2126 #endif
2127
2128         return status;
2129 }
2130
2131 /* get lockout policy */
2132 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2133                                TALLOC_CTX *mem_ctx,
2134                                SAM_UNK_INFO_12 *policy){
2135         struct winbind_cache *cache = get_cache(domain);
2136         struct cache_entry *centry = NULL;
2137         NTSTATUS status;
2138
2139         if (!cache->tdb)
2140                 goto do_query;
2141
2142         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2143
2144         if (!centry)
2145                 goto do_query;
2146
2147         policy->duration = centry_nttime(centry);
2148         policy->reset_count = centry_nttime(centry);
2149         policy->bad_attempt_lockout = centry_uint16(centry);
2150
2151         status = centry->status;
2152
2153         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2154                 domain->name, nt_errstr(status) ));
2155
2156         centry_free(centry);
2157         return status;
2158
2159 do_query:
2160         ZERO_STRUCTP(policy);
2161
2162         /* Return status value returned by seq number check */
2163
2164         if (!NT_STATUS_IS_OK(domain->last_status))
2165                 return domain->last_status;
2166
2167         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2168                 domain->name ));
2169
2170         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2171
2172         /* and save it */
2173         refresh_sequence_number(domain, False);
2174         wcache_save_lockout_policy(domain, status, policy);
2175
2176         return status;
2177 }
2178
2179 /* get password policy */
2180 static NTSTATUS password_policy(struct winbindd_domain *domain,
2181                                 TALLOC_CTX *mem_ctx,
2182                                 SAM_UNK_INFO_1 *policy)
2183 {
2184         struct winbind_cache *cache = get_cache(domain);
2185         struct cache_entry *centry = NULL;
2186         NTSTATUS status;
2187
2188         if (!cache->tdb)
2189                 goto do_query;
2190
2191         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2192
2193         if (!centry)
2194                 goto do_query;
2195
2196         policy->min_length_password = centry_uint16(centry);
2197         policy->password_history = centry_uint16(centry);
2198         policy->password_properties = centry_uint32(centry);
2199         policy->expire = centry_nttime(centry);
2200         policy->min_passwordage = centry_nttime(centry);
2201
2202         status = centry->status;
2203
2204         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2205                 domain->name, nt_errstr(status) ));
2206
2207         centry_free(centry);
2208         return status;
2209
2210 do_query:
2211         ZERO_STRUCTP(policy);
2212
2213         /* Return status value returned by seq number check */
2214
2215         if (!NT_STATUS_IS_OK(domain->last_status))
2216                 return domain->last_status;
2217
2218         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2219                 domain->name ));
2220
2221         status = domain->backend->password_policy(domain, mem_ctx, policy);
2222
2223         /* and save it */
2224         refresh_sequence_number(domain, False);
2225         wcache_save_password_policy(domain, status, policy);
2226
2227         return status;
2228 }
2229
2230
2231 /* Invalidate cached user and group lists coherently */
2232
2233 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2234                        void *state)
2235 {
2236         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2237             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2238                 tdb_delete(the_tdb, kbuf);
2239
2240         return 0;
2241 }
2242
2243 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2244
2245 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2246                                 NET_USER_INFO_3 *info3)
2247 {
2248         struct winbind_cache *cache;
2249
2250         /* dont clear cached U/SID and UG/SID entries when we want to logon
2251          * offline - gd */
2252
2253         if (lp_winbind_offline_logon()) {
2254                 return;
2255         }
2256
2257         if (!domain)
2258                 return;
2259
2260         cache = get_cache(domain);
2261         netsamlogon_clear_cached_user(cache->tdb, info3);
2262 }
2263
2264 int wcache_invalidate_cache(void)
2265 {
2266         struct winbindd_domain *domain;
2267
2268         for (domain = domain_list(); domain; domain = domain->next) {
2269                 struct winbind_cache *cache = get_cache(domain);
2270
2271                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2272                            "entries for %s\n", domain->name));
2273                 if (cache) {
2274                         if (cache->tdb) {
2275                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
2276                         } else {
2277                                 return -1;
2278                         }
2279                 }
2280         }
2281         return 0;
2282 }
2283
2284 bool init_wcache(void)
2285 {
2286         if (wcache == NULL) {
2287                 wcache = SMB_XMALLOC_P(struct winbind_cache);
2288                 ZERO_STRUCTP(wcache);
2289         }
2290
2291         if (wcache->tdb != NULL)
2292                 return True;
2293
2294         /* when working offline we must not clear the cache on restart */
2295         wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
2296                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2297                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2298                                 O_RDWR|O_CREAT, 0600);
2299
2300         if (wcache->tdb == NULL) {
2301                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2302                 return False;
2303         }
2304
2305         return True;
2306 }
2307
2308 /************************************************************************
2309  This is called by the parent to initialize the cache file.
2310  We don't need sophisticated locking here as we know we're the
2311  only opener.
2312 ************************************************************************/
2313
2314 bool initialize_winbindd_cache(void)
2315 {
2316         bool cache_bad = True;
2317         uint32 vers;
2318
2319         if (!init_wcache()) {
2320                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2321                 return False;
2322         }
2323
2324         /* Check version number. */
2325         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2326                         vers == WINBINDD_CACHE_VERSION) {
2327                 cache_bad = False;
2328         }
2329
2330         if (cache_bad) {
2331                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2332                         "and re-creating with version number %d\n",
2333                         WINBINDD_CACHE_VERSION ));
2334
2335                 tdb_close(wcache->tdb);
2336                 wcache->tdb = NULL;
2337
2338                 if (unlink(lock_path("winbindd_cache.tdb")) == -1) {
2339                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2340                                 lock_path("winbindd_cache.tdb"),
2341                                 strerror(errno) ));
2342                         return False;
2343                 }
2344                 if (!init_wcache()) {
2345                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
2346                                         "init_wcache failed.\n"));
2347                         return False;
2348                 }
2349
2350                 /* Write the version. */
2351                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2352                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2353                                 tdb_errorstr(wcache->tdb) ));
2354                         return False;
2355                 }
2356         }
2357
2358         tdb_close(wcache->tdb);
2359         wcache->tdb = NULL;
2360         return True;
2361 }
2362
2363 void close_winbindd_cache()
2364 {
2365         if (!wcache)
2366                 return;
2367         if (wcache->tdb) {
2368                 tdb_close(wcache->tdb);
2369                 wcache->tdb = NULL;
2370         }
2371 }
2372
2373 void cache_store_response(pid_t pid, struct winbindd_response *response)
2374 {
2375         fstring key_str;
2376
2377         if (!init_wcache())
2378                 return;
2379
2380         DEBUG(10, ("Storing response for pid %d, len %d\n",
2381                    pid, response->length));
2382
2383         fstr_sprintf(key_str, "DR/%d", pid);
2384         if (tdb_store(wcache->tdb, string_tdb_data(key_str),
2385                       make_tdb_data((uint8 *)response, sizeof(*response)),
2386                       TDB_REPLACE) == -1)
2387                 return;
2388
2389         if (response->length == sizeof(*response))
2390                 return;
2391
2392         /* There's extra data */
2393
2394         DEBUG(10, ("Storing extra data: len=%d\n",
2395                    (int)(response->length - sizeof(*response))));
2396
2397         fstr_sprintf(key_str, "DE/%d", pid);
2398         if (tdb_store(wcache->tdb, string_tdb_data(key_str),
2399                       make_tdb_data((uint8 *)response->extra_data.data,
2400                                     response->length - sizeof(*response)),
2401                       TDB_REPLACE) == 0)
2402                 return;
2403
2404         /* We could not store the extra data, make sure the tdb does not
2405          * contain a main record with wrong dangling extra data */
2406
2407         fstr_sprintf(key_str, "DR/%d", pid);
2408         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2409
2410         return;
2411 }
2412
2413 bool cache_retrieve_response(pid_t pid, struct winbindd_response * response)
2414 {
2415         TDB_DATA data;
2416         fstring key_str;
2417
2418         if (!init_wcache())
2419                 return False;
2420
2421         DEBUG(10, ("Retrieving response for pid %d\n", pid));
2422
2423         fstr_sprintf(key_str, "DR/%d", pid);
2424         data = tdb_fetch(wcache->tdb, string_tdb_data(key_str));
2425
2426         if (data.dptr == NULL)
2427                 return False;
2428
2429         if (data.dsize != sizeof(*response))
2430                 return False;
2431
2432         memcpy(response, data.dptr, data.dsize);
2433         SAFE_FREE(data.dptr);
2434
2435         if (response->length == sizeof(*response)) {
2436                 response->extra_data.data = NULL;
2437                 return True;
2438         }
2439
2440         /* There's extra data */
2441
2442         DEBUG(10, ("Retrieving extra data length=%d\n",
2443                    (int)(response->length - sizeof(*response))));
2444
2445         fstr_sprintf(key_str, "DE/%d", pid);
2446         data = tdb_fetch(wcache->tdb, string_tdb_data(key_str));
2447
2448         if (data.dptr == NULL) {
2449                 DEBUG(0, ("Did not find extra data\n"));
2450                 return False;
2451         }
2452
2453         if (data.dsize != (response->length - sizeof(*response))) {
2454                 DEBUG(0, ("Invalid extra data length: %d\n", (int)data.dsize));
2455                 SAFE_FREE(data.dptr);
2456                 return False;
2457         }
2458
2459         dump_data(11, (uint8 *)data.dptr, data.dsize);
2460
2461         response->extra_data.data = data.dptr;
2462         return True;
2463 }
2464
2465 void cache_cleanup_response(pid_t pid)
2466 {
2467         fstring key_str;
2468
2469         if (!init_wcache())
2470                 return;
2471
2472         fstr_sprintf(key_str, "DR/%d", pid);
2473         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2474
2475         fstr_sprintf(key_str, "DE/%d", pid);
2476         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2477
2478         return;
2479 }
2480
2481
2482 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2483                        char **domain_name, char **name,
2484                        enum lsa_SidType *type)
2485 {
2486         struct winbindd_domain *domain;
2487         struct winbind_cache *cache;
2488         struct cache_entry *centry = NULL;
2489         NTSTATUS status;
2490         fstring tmp;
2491
2492         domain = find_lookup_domain_from_sid(sid);
2493         if (domain == NULL) {
2494                 return False;
2495         }
2496
2497         cache = get_cache(domain);
2498
2499         if (cache->tdb == NULL) {
2500                 return False;
2501         }
2502
2503         centry = wcache_fetch(cache, domain, "SN/%s",
2504                               sid_to_fstring(tmp, sid));
2505         if (centry == NULL) {
2506                 return False;
2507         }
2508
2509         if (NT_STATUS_IS_OK(centry->status)) {
2510                 *type = (enum lsa_SidType)centry_uint32(centry);
2511                 *domain_name = centry_string(centry, mem_ctx);
2512                 *name = centry_string(centry, mem_ctx);
2513         }
2514
2515         status = centry->status;
2516         centry_free(centry);
2517         return NT_STATUS_IS_OK(status);
2518 }
2519
2520 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2521                         const char *domain_name,
2522                         const char *name,
2523                         DOM_SID *sid,
2524                         enum lsa_SidType *type)
2525 {
2526         struct winbindd_domain *domain;
2527         struct winbind_cache *cache;
2528         struct cache_entry *centry = NULL;
2529         NTSTATUS status;
2530         fstring uname;
2531         bool original_online_state;
2532
2533         domain = find_lookup_domain_from_name(domain_name);
2534         if (domain == NULL) {
2535                 return False;
2536         }
2537
2538         cache = get_cache(domain);
2539
2540         if (cache->tdb == NULL) {
2541                 return False;
2542         }
2543
2544         fstrcpy(uname, name);
2545         strupper_m(uname);
2546
2547         /* If we are doing a cached logon, temporarily set the domain
2548            offline so the cache won't expire the entry */
2549
2550         original_online_state = domain->online;
2551         domain->online = False;
2552         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
2553         domain->online = original_online_state;
2554
2555         if (centry == NULL) {
2556                 return False;
2557         }
2558
2559         if (NT_STATUS_IS_OK(centry->status)) {
2560                 *type = (enum lsa_SidType)centry_uint32(centry);
2561                 centry_sid(centry, mem_ctx, sid);
2562         }
2563
2564         status = centry->status;
2565         centry_free(centry);
2566
2567         return NT_STATUS_IS_OK(status);
2568 }
2569
2570 void cache_name2sid(struct winbindd_domain *domain,
2571                     const char *domain_name, const char *name,
2572                     enum lsa_SidType type, const DOM_SID *sid)
2573 {
2574         refresh_sequence_number(domain, False);
2575         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2576                                 sid, type);
2577 }
2578
2579 /*
2580  * The original idea that this cache only contains centries has
2581  * been blurred - now other stuff gets put in here. Ensure we
2582  * ignore these things on cleanup.
2583  */
2584
2585 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2586                                TDB_DATA dbuf, void *state)
2587 {
2588         struct cache_entry *centry;
2589
2590         if (is_non_centry_key(kbuf)) {
2591                 return 0;
2592         }
2593
2594         centry = wcache_fetch_raw((char *)kbuf.dptr);
2595         if (!centry) {
2596                 return 0;
2597         }
2598
2599         if (!NT_STATUS_IS_OK(centry->status)) {
2600                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2601                 tdb_delete(the_tdb, kbuf);
2602         }
2603
2604         centry_free(centry);
2605         return 0;
2606 }
2607
2608 /* flush the cache */
2609 void wcache_flush_cache(void)
2610 {
2611         if (!wcache)
2612                 return;
2613         if (wcache->tdb) {
2614                 tdb_close(wcache->tdb);
2615                 wcache->tdb = NULL;
2616         }
2617         if (opt_nocache)
2618                 return;
2619
2620         /* when working offline we must not clear the cache on restart */
2621         wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"),
2622                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2623                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2624                                 O_RDWR|O_CREAT, 0600);
2625
2626         if (!wcache->tdb) {
2627                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2628                 return;
2629         }
2630
2631         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2632
2633         DEBUG(10,("wcache_flush_cache success\n"));
2634 }
2635
2636 /* Count cached creds */
2637
2638 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2639                                     void *state)
2640 {
2641         int *cred_count = (int*)state;
2642
2643         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2644                 (*cred_count)++;
2645         }
2646         return 0;
2647 }
2648
2649 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2650 {
2651         struct winbind_cache *cache = get_cache(domain);
2652
2653         *count = 0;
2654
2655         if (!cache->tdb) {
2656                 return NT_STATUS_INTERNAL_DB_ERROR;
2657         }
2658
2659         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2660
2661         return NT_STATUS_OK;
2662 }
2663
2664 struct cred_list {
2665         struct cred_list *prev, *next;
2666         TDB_DATA key;
2667         fstring name;
2668         time_t created;
2669 };
2670 static struct cred_list *wcache_cred_list;
2671
2672 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2673                                     void *state)
2674 {
2675         struct cred_list *cred;
2676
2677         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2678
2679                 cred = SMB_MALLOC_P(struct cred_list);
2680                 if (cred == NULL) {
2681                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2682                         return -1;
2683                 }
2684
2685                 ZERO_STRUCTP(cred);
2686
2687                 /* save a copy of the key */
2688
2689                 fstrcpy(cred->name, (const char *)kbuf.dptr);
2690                 DLIST_ADD(wcache_cred_list, cred);
2691         }
2692
2693         return 0;
2694 }
2695
2696 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2697 {
2698         struct winbind_cache *cache = get_cache(domain);
2699         NTSTATUS status;
2700         int ret;
2701         struct cred_list *cred, *oldest = NULL;
2702
2703         if (!cache->tdb) {
2704                 return NT_STATUS_INTERNAL_DB_ERROR;
2705         }
2706
2707         /* we possibly already have an entry */
2708         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2709
2710                 fstring key_str, tmp;
2711
2712                 DEBUG(11,("we already have an entry, deleting that\n"));
2713
2714                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2715
2716                 tdb_delete(cache->tdb, string_tdb_data(key_str));
2717
2718                 return NT_STATUS_OK;
2719         }
2720
2721         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2722         if (ret == 0) {
2723                 return NT_STATUS_OK;
2724         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
2725                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2726         }
2727
2728         ZERO_STRUCTP(oldest);
2729
2730         for (cred = wcache_cred_list; cred; cred = cred->next) {
2731
2732                 TDB_DATA data;
2733                 time_t t;
2734
2735                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
2736                 if (!data.dptr) {
2737                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
2738                                 cred->name));
2739                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2740                         goto done;
2741                 }
2742
2743                 t = IVAL(data.dptr, 0);
2744                 SAFE_FREE(data.dptr);
2745
2746                 if (!oldest) {
2747                         oldest = SMB_MALLOC_P(struct cred_list);
2748                         if (oldest == NULL) {
2749                                 status = NT_STATUS_NO_MEMORY;
2750                                 goto done;
2751                         }
2752
2753                         fstrcpy(oldest->name, cred->name);
2754                         oldest->created = t;
2755                         continue;
2756                 }
2757
2758                 if (t < oldest->created) {
2759                         fstrcpy(oldest->name, cred->name);
2760                         oldest->created = t;
2761                 }
2762         }
2763
2764         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
2765                 status = NT_STATUS_OK;
2766         } else {
2767                 status = NT_STATUS_UNSUCCESSFUL;
2768         }
2769 done:
2770         SAFE_FREE(wcache_cred_list);
2771         SAFE_FREE(oldest);
2772
2773         return status;
2774 }
2775
2776 /* Change the global online/offline state. */
2777 bool set_global_winbindd_state_offline(void)
2778 {
2779         TDB_DATA data;
2780
2781         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
2782
2783         /* Only go offline if someone has created
2784            the key "WINBINDD_OFFLINE" in the cache tdb. */
2785
2786         if (wcache == NULL || wcache->tdb == NULL) {
2787                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
2788                 return False;
2789         }
2790
2791         if (!lp_winbind_offline_logon()) {
2792                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
2793                 return False;
2794         }
2795
2796         if (global_winbindd_offline_state) {
2797                 /* Already offline. */
2798                 return True;
2799         }
2800
2801         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
2802
2803         if (!data.dptr || data.dsize != 4) {
2804                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
2805                 SAFE_FREE(data.dptr);
2806                 return False;
2807         } else {
2808                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
2809                 global_winbindd_offline_state = True;
2810                 SAFE_FREE(data.dptr);
2811                 return True;
2812         }
2813 }
2814
2815 void set_global_winbindd_state_online(void)
2816 {
2817         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
2818
2819         if (!lp_winbind_offline_logon()) {
2820                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
2821                 return;
2822         }
2823
2824         if (!global_winbindd_offline_state) {
2825                 /* Already online. */
2826                 return;
2827         }
2828         global_winbindd_offline_state = False;
2829
2830         if (!wcache->tdb) {
2831                 return;
2832         }
2833
2834         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
2835         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
2836 }
2837
2838 bool get_global_winbindd_state_offline(void)
2839 {
2840         return global_winbindd_offline_state;
2841 }
2842
2843 /***********************************************************************
2844  Validate functions for all possible cache tdb keys.
2845 ***********************************************************************/
2846
2847 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
2848                                                   struct tdb_validation_status *state)
2849 {
2850         struct cache_entry *centry;
2851
2852         centry = SMB_XMALLOC_P(struct cache_entry);
2853         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
2854         if (!centry->data) {
2855                 SAFE_FREE(centry);
2856                 return NULL;
2857         }
2858         centry->len = data.dsize;
2859         centry->ofs = 0;
2860
2861         if (centry->len < 8) {
2862                 /* huh? corrupt cache? */
2863                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
2864                 centry_free(centry);
2865                 state->bad_entry = True;
2866                 state->success = False;
2867                 return NULL;
2868         }
2869
2870         centry->status = NT_STATUS(centry_uint32(centry));
2871         centry->sequence_number = centry_uint32(centry);
2872         return centry;
2873 }
2874
2875 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
2876                            struct tdb_validation_status *state)
2877 {
2878         if (dbuf.dsize != 8) {
2879                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
2880                                 keystr, (unsigned int)dbuf.dsize ));
2881                 state->bad_entry = True;
2882                 return 1;
2883         }
2884         return 0;
2885 }
2886
2887 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
2888                        struct tdb_validation_status *state)
2889 {
2890         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
2891         if (!centry) {
2892                 return 1;
2893         }
2894
2895         (void)centry_uint32(centry);
2896         if (NT_STATUS_IS_OK(centry->status)) {
2897                 DOM_SID sid;
2898                 (void)centry_sid(centry, mem_ctx, &sid);
2899         }
2900
2901         centry_free(centry);
2902
2903         if (!(state->success)) {
2904                 return 1;
2905         }
2906         DEBUG(10,("validate_ns: %s ok\n", keystr));
2907         return 0;
2908 }
2909
2910 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
2911                        struct tdb_validation_status *state)
2912 {
2913         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
2914         if (!centry) {
2915                 return 1;
2916         }
2917
2918         if (NT_STATUS_IS_OK(centry->status)) {
2919                 (void)centry_uint32(centry);
2920                 (void)centry_string(centry, mem_ctx);
2921                 (void)centry_string(centry, mem_ctx);
2922         }
2923
2924         centry_free(centry);
2925
2926         if (!(state->success)) {
2927                 return 1;
2928         }
2929         DEBUG(10,("validate_sn: %s ok\n", keystr));
2930         return 0;
2931 }
2932
2933 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
2934                       struct tdb_validation_status *state)
2935 {
2936         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
2937         DOM_SID sid;
2938
2939         if (!centry) {
2940                 return 1;
2941         }
2942
2943         (void)centry_string(centry, mem_ctx);
2944         (void)centry_string(centry, mem_ctx);
2945         (void)centry_string(centry, mem_ctx);
2946         (void)centry_string(centry, mem_ctx);
2947         (void)centry_uint32(centry);
2948         (void)centry_sid(centry, mem_ctx, &sid);
2949         (void)centry_sid(centry, mem_ctx, &sid);
2950
2951         centry_free(centry);
2952
2953         if (!(state->success)) {
2954                 return 1;
2955         }
2956         DEBUG(10,("validate_u: %s ok\n", keystr));
2957         return 0;
2958 }
2959
2960 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
2961                             struct tdb_validation_status *state)
2962 {
2963         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
2964
2965         if (!centry) {
2966                 return 1;
2967         }
2968
2969         (void)centry_nttime(centry);
2970         (void)centry_nttime(centry);
2971         (void)centry_uint16(centry);
2972
2973         centry_free(centry);
2974
2975         if (!(state->success)) {
2976                 return 1;
2977         }
2978         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
2979         return 0;
2980 }
2981
2982 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
2983                             struct tdb_validation_status *state)
2984 {
2985         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
2986
2987         if (!centry) {
2988                 return 1;
2989         }
2990
2991         (void)centry_uint16(centry);
2992         (void)centry_uint16(centry);
2993         (void)centry_uint32(centry);
2994         (void)centry_nttime(centry);
2995         (void)centry_nttime(centry);
2996
2997         centry_free(centry);
2998
2999         if (!(state->success)) {
3000                 return 1;
3001         }
3002         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3003         return 0;
3004 }
3005
3006 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3007                          struct tdb_validation_status *state)
3008 {
3009         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3010
3011         if (!centry) {
3012                 return 1;
3013         }
3014
3015         (void)centry_time(centry);
3016         (void)centry_hash16(centry, mem_ctx);
3017
3018         /* We only have 17 bytes more data in the salted cred case. */
3019         if (centry->len - centry->ofs == 17) {
3020                 (void)centry_hash16(centry, mem_ctx);
3021         }
3022
3023         centry_free(centry);
3024
3025         if (!(state->success)) {
3026                 return 1;
3027         }
3028         DEBUG(10,("validate_cred: %s ok\n", keystr));
3029         return 0;
3030 }
3031
3032 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3033                        struct tdb_validation_status *state)
3034 {
3035         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3036         int32 num_entries, i;
3037
3038         if (!centry) {
3039                 return 1;
3040         }
3041
3042         num_entries = (int32)centry_uint32(centry);
3043
3044         for (i=0; i< num_entries; i++) {
3045                 DOM_SID sid;
3046                 (void)centry_string(centry, mem_ctx);
3047                 (void)centry_string(centry, mem_ctx);
3048                 (void)centry_string(centry, mem_ctx);
3049                 (void)centry_string(centry, mem_ctx);
3050                 (void)centry_sid(centry, mem_ctx, &sid);
3051                 (void)centry_sid(centry, mem_ctx, &sid);
3052         }
3053
3054         centry_free(centry);
3055
3056         if (!(state->success)) {
3057                 return 1;
3058         }
3059         DEBUG(10,("validate_ul: %s ok\n", keystr));
3060         return 0;
3061 }
3062
3063 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3064                        struct tdb_validation_status *state)
3065 {
3066         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3067         int32 num_entries, i;
3068
3069         if (!centry) {
3070                 return 1;
3071         }
3072
3073         num_entries = centry_uint32(centry);
3074
3075         for (i=0; i< num_entries; i++) {
3076                 (void)centry_string(centry, mem_ctx);
3077                 (void)centry_string(centry, mem_ctx);
3078                 (void)centry_uint32(centry);
3079         }
3080
3081         centry_free(centry);
3082
3083         if (!(state->success)) {
3084                 return 1;
3085         }
3086         DEBUG(10,("validate_gl: %s ok\n", keystr));
3087         return 0;
3088 }
3089
3090 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3091                        struct tdb_validation_status *state)
3092 {
3093         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3094         int32 num_groups, i;
3095
3096         if (!centry) {
3097                 return 1;
3098         }
3099
3100         num_groups = centry_uint32(centry);
3101
3102         for (i=0; i< num_groups; i++) {
3103                 DOM_SID sid;
3104                 centry_sid(centry, mem_ctx, &sid);
3105         }
3106
3107         centry_free(centry);
3108
3109         if (!(state->success)) {
3110                 return 1;
3111         }
3112         DEBUG(10,("validate_ug: %s ok\n", keystr));
3113         return 0;
3114 }
3115
3116 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3117                        struct tdb_validation_status *state)
3118 {
3119         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3120         int32 num_aliases, i;
3121
3122         if (!centry) {
3123                 return 1;
3124         }
3125
3126         num_aliases = centry_uint32(centry);
3127
3128         for (i=0; i < num_aliases; i++) {
3129                 (void)centry_uint32(centry);
3130         }
3131
3132         centry_free(centry);
3133
3134         if (!(state->success)) {
3135                 return 1;
3136         }
3137         DEBUG(10,("validate_ua: %s ok\n", keystr));
3138         return 0;
3139 }
3140
3141 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3142                        struct tdb_validation_status *state)
3143 {
3144         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3145         int32 num_names, i;
3146
3147         if (!centry) {
3148                 return 1;
3149         }
3150
3151         num_names = centry_uint32(centry);
3152
3153         for (i=0; i< num_names; i++) {
3154                 DOM_SID sid;
3155                 centry_sid(centry, mem_ctx, &sid);
3156                 (void)centry_string(centry, mem_ctx);
3157                 (void)centry_uint32(centry);
3158         }
3159
3160         centry_free(centry);
3161
3162         if (!(state->success)) {
3163                 return 1;
3164         }
3165         DEBUG(10,("validate_gm: %s ok\n", keystr));
3166         return 0;
3167 }
3168
3169 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3170                        struct tdb_validation_status *state)
3171 {
3172         /* Can't say anything about this other than must be nonzero. */
3173         if (dbuf.dsize == 0) {
3174                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3175                                 keystr));
3176                 state->bad_entry = True;
3177                 state->success = False;
3178                 return 1;
3179         }
3180
3181         DEBUG(10,("validate_dr: %s ok\n", keystr));
3182         return 0;
3183 }
3184
3185 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3186                        struct tdb_validation_status *state)
3187 {
3188         /* Can't say anything about this other than must be nonzero. */
3189         if (dbuf.dsize == 0) {
3190                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3191                                 keystr));
3192                 state->bad_entry = True;
3193                 state->success = False;
3194                 return 1;
3195         }
3196
3197         DEBUG(10,("validate_de: %s ok\n", keystr));
3198         return 0;
3199 }
3200
3201 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3202                               struct tdb_validation_status *state)
3203 {
3204         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3205         int32 num_domains, i;
3206
3207         if (!centry) {
3208                 return 1;
3209         }
3210
3211         num_domains = centry_uint32(centry);
3212
3213         for (i=0; i< num_domains; i++) {
3214                 DOM_SID sid;
3215                 (void)centry_string(centry, mem_ctx);
3216                 (void)centry_string(centry, mem_ctx);
3217                 (void)centry_sid(centry, mem_ctx, &sid);
3218         }
3219
3220         centry_free(centry);
3221
3222         if (!(state->success)) {
3223                 return 1;
3224         }
3225         DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3226         return 0;
3227 }
3228
3229 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3230                                   TDB_DATA dbuf,
3231                                   struct tdb_validation_status *state)
3232 {
3233         if (dbuf.dsize == 0) {
3234                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3235                           "key %s (len ==0) ?\n", keystr));
3236                 state->bad_entry = True;
3237                 state->success = False;
3238                 return 1;
3239         }
3240
3241         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3242         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3243         return 0;
3244 }
3245
3246 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3247                             struct tdb_validation_status *state)
3248 {
3249         if (dbuf.dsize != 4) {
3250                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3251                                 keystr, (unsigned int)dbuf.dsize ));
3252                 state->bad_entry = True;
3253                 state->success = False;
3254                 return 1;
3255         }
3256         DEBUG(10,("validate_offline: %s ok\n", keystr));
3257         return 0;
3258 }
3259
3260 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3261                                   struct tdb_validation_status *state)
3262 {
3263         if (dbuf.dsize != 4) {
3264                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3265                           "key %s (len %u != 4) ?\n",
3266                           keystr, (unsigned int)dbuf.dsize));
3267                 state->bad_entry = True;
3268                 state->success = False;
3269                 return 1;
3270         }
3271
3272         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3273         return 0;
3274 }
3275
3276 /***********************************************************************
3277  A list of all possible cache tdb keys with associated validation
3278  functions.
3279 ***********************************************************************/
3280
3281 struct key_val_struct {
3282         const char *keyname;
3283         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3284 } key_val[] = {
3285         {"SEQNUM/", validate_seqnum},
3286         {"NS/", validate_ns},
3287         {"SN/", validate_sn},
3288         {"U/", validate_u},
3289         {"LOC_POL/", validate_loc_pol},
3290         {"PWD_POL/", validate_pwd_pol},
3291         {"CRED/", validate_cred},
3292         {"UL/", validate_ul},
3293         {"GL/", validate_gl},
3294         {"UG/", validate_ug},
3295         {"UA", validate_ua},
3296         {"GM/", validate_gm},
3297         {"DR/", validate_dr},
3298         {"DE/", validate_de},
3299         {"TRUSTDOMS/", validate_trustdoms},
3300         {"TRUSTDOMCACHE/", validate_trustdomcache},
3301         {"WINBINDD_OFFLINE", validate_offline},
3302         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3303         {NULL, NULL}
3304 };
3305
3306 /***********************************************************************
3307  Function to look at every entry in the tdb and validate it as far as
3308  possible.
3309 ***********************************************************************/
3310
3311 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3312 {
3313         int i;
3314         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3315
3316         /* Paranoia check. */
3317         if (kbuf.dsize > 1024) {
3318                 DEBUG(0,("cache_traverse_validate_fn: key length too large (%u) > 1024\n\n",
3319                                 (unsigned int)kbuf.dsize ));
3320                 return 1;
3321         }
3322
3323         for (i = 0; key_val[i].keyname; i++) {
3324                 size_t namelen = strlen(key_val[i].keyname);
3325                 if (kbuf.dsize >= namelen && (
3326                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3327                         TALLOC_CTX *mem_ctx;
3328                         char *keystr;
3329                         int ret;
3330
3331                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3332                         if (!keystr) {
3333                                 return 1;
3334                         }
3335                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
3336                         keystr[kbuf.dsize] = '\0';
3337
3338                         mem_ctx = talloc_init("validate_ctx");
3339                         if (!mem_ctx) {
3340                                 SAFE_FREE(keystr);
3341                                 return 1;
3342                         }
3343
3344                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3345                                                           v_state);
3346
3347                         SAFE_FREE(keystr);
3348                         talloc_destroy(mem_ctx);
3349                         return ret;
3350                 }
3351         }
3352
3353         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3354         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3355         DEBUG(0,("data :\n"));
3356         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3357         v_state->unknown_key = True;
3358         v_state->success = False;
3359         return 1; /* terminate. */
3360 }
3361
3362 static void validate_panic(const char *const why)
3363 {
3364         DEBUG(0,("validating cache: would panic %s\n", why ));
3365         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3366         exit(47);
3367 }
3368
3369 /***********************************************************************
3370  Try and validate every entry in the winbindd cache. If we fail here,
3371  delete the cache tdb and return non-zero.
3372 ***********************************************************************/
3373
3374 int winbindd_validate_cache(void)
3375 {
3376         int ret = -1;
3377         const char *tdb_path = lock_path("winbindd_cache.tdb");
3378         TDB_CONTEXT *tdb = NULL;
3379
3380         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3381         smb_panic_fn = validate_panic;
3382
3383
3384         tdb = tdb_open_log(tdb_path,
3385                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3386                            ( lp_winbind_offline_logon()
3387                              ? TDB_DEFAULT
3388                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3389                            O_RDWR|O_CREAT,
3390                            0600);
3391         if (!tdb) {
3392                 DEBUG(0, ("winbindd_validate_cache: "
3393                           "error opening/initializing tdb\n"));
3394                 goto done;
3395         }
3396         tdb_close(tdb);
3397
3398         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3399
3400         if (ret != 0) {
3401                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3402                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3403                 unlink(tdb_path);
3404         }
3405
3406 done:
3407         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3408         smb_panic_fn = smb_panic;
3409         return ret;
3410 }
3411
3412 /***********************************************************************
3413  Try and validate every entry in the winbindd cache.
3414 ***********************************************************************/
3415
3416 int winbindd_validate_cache_nobackup(void)
3417 {
3418         int ret = -1;
3419         const char *tdb_path = lock_path("winbindd_cache.tdb");
3420
3421         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3422         smb_panic_fn = validate_panic;
3423
3424
3425         if (wcache == NULL || wcache->tdb == NULL) {
3426                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3427         } else {
3428                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3429         }
3430
3431         if (ret != 0) {
3432                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3433                            "successful.\n"));
3434         }
3435
3436         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3437                    "function\n"));
3438         smb_panic_fn = smb_panic;
3439         return ret;
3440 }
3441
3442 /*********************************************************************
3443  ********************************************************************/
3444
3445 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3446                                        struct winbindd_tdc_domain **domains,
3447                                        size_t *num_domains )
3448 {
3449         struct winbindd_tdc_domain *list = NULL;
3450         size_t idx;
3451         int i;
3452         bool set_only = False;
3453
3454         /* don't allow duplicates */
3455
3456         idx = *num_domains;
3457         list = *domains;
3458
3459         for ( i=0; i< (*num_domains); i++ ) {
3460                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3461                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3462                                   new_dom->name));
3463                         idx = i;
3464                         set_only = True;
3465
3466                         break;
3467                 }
3468         }
3469
3470         if ( !set_only ) {
3471                 if ( !*domains ) {
3472                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3473                         idx = 0;
3474                 } else {
3475                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3476                                                      struct winbindd_tdc_domain,
3477                                                      (*num_domains)+1);
3478                         idx = *num_domains;
3479                 }
3480
3481                 ZERO_STRUCT( list[idx] );
3482         }
3483
3484         if ( !list )
3485                 return False;
3486
3487         list[idx].domain_name = talloc_strdup( list, new_dom->name );
3488         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3489
3490         if ( !is_null_sid( &new_dom->sid ) )
3491                 sid_copy( &list[idx].sid, &new_dom->sid );
3492
3493         if ( new_dom->domain_flags != 0x0 )
3494                 list[idx].trust_flags = new_dom->domain_flags;
3495
3496         if ( new_dom->domain_type != 0x0 )
3497                 list[idx].trust_type = new_dom->domain_type;
3498
3499         if ( new_dom->domain_trust_attribs != 0x0 )
3500                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3501
3502         if ( !set_only ) {
3503                 *domains = list;
3504                 *num_domains = idx + 1;
3505         }
3506
3507         return True;
3508 }
3509
3510 /*********************************************************************
3511  ********************************************************************/
3512
3513 static TDB_DATA make_tdc_key( const char *domain_name )
3514 {
3515         char *keystr = NULL;
3516         TDB_DATA key = { NULL, 0 };
3517
3518         if ( !domain_name ) {
3519                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3520                 return key;
3521         }
3522
3523
3524         asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name );
3525         key = string_term_tdb_data(keystr);
3526
3527         return key;
3528 }
3529
3530 /*********************************************************************
3531  ********************************************************************/
3532
3533 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3534                              size_t num_domains,
3535                              unsigned char **buf )
3536 {
3537         unsigned char *buffer = NULL;
3538         int len = 0;
3539         int buflen = 0;
3540         int i = 0;
3541
3542         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3543                   (int)num_domains));
3544
3545         buflen = 0;
3546
3547  again:
3548         len = 0;
3549
3550         /* Store the number of array items first */
3551         len += tdb_pack( buffer+len, buflen-len, "d",
3552                          num_domains );
3553
3554         /* now pack each domain trust record */
3555         for ( i=0; i<num_domains; i++ ) {
3556
3557                 fstring tmp;
3558
3559                 if ( buflen > 0 ) {
3560                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3561                                   domains[i].domain_name,
3562                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3563                 }
3564
3565                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3566                                  domains[i].domain_name,
3567                                  domains[i].dns_name,
3568                                  sid_to_fstring(tmp, &domains[i].sid),
3569                                  domains[i].trust_flags,
3570                                  domains[i].trust_attribs,
3571                                  domains[i].trust_type );
3572         }
3573
3574         if ( buflen < len ) {
3575                 SAFE_FREE(buffer);
3576                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3577                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3578                         buflen = -1;
3579                         goto done;
3580                 }
3581                 buflen = len;
3582                 goto again;
3583         }
3584
3585         *buf = buffer;
3586
3587  done:
3588         return buflen;
3589 }
3590
3591 /*********************************************************************
3592  ********************************************************************/
3593
3594 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3595                                   struct winbindd_tdc_domain **domains )
3596 {
3597         fstring domain_name, dns_name, sid_string;
3598         uint32 type, attribs, flags;
3599         int num_domains;
3600         int len = 0;
3601         int i;
3602         struct winbindd_tdc_domain *list = NULL;
3603
3604         /* get the number of domains */
3605         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3606         if ( len == -1 ) {
3607                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3608                 return 0;
3609         }
3610
3611         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3612         if ( !list ) {
3613                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3614                 return 0;
3615         }
3616
3617         for ( i=0; i<num_domains; i++ ) {
3618                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3619                                    domain_name,
3620                                    dns_name,
3621                                    sid_string,
3622                                    &flags,
3623                                    &attribs,
3624                                    &type );
3625
3626                 if ( len == -1 ) {
3627                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3628                         TALLOC_FREE( list );
3629                         return 0;
3630                 }
3631
3632                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
3633                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
3634                           domain_name, dns_name, sid_string,
3635                           flags, attribs, type));
3636
3637                 list[i].domain_name = talloc_strdup( list, domain_name );
3638                 list[i].dns_name = talloc_strdup( list, dns_name );
3639                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
3640                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
3641                                   domain_name));
3642                 }
3643                 list[i].trust_flags = flags;
3644                 list[i].trust_attribs = attribs;
3645                 list[i].trust_type = type;
3646         }
3647
3648         *domains = list;
3649
3650         return num_domains;
3651 }
3652
3653 /*********************************************************************
3654  ********************************************************************/
3655
3656 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
3657 {
3658         TDB_DATA key = make_tdc_key( lp_workgroup() );
3659         TDB_DATA data = { NULL, 0 };
3660         int ret;
3661
3662         if ( !key.dptr )
3663                 return False;
3664
3665         /* See if we were asked to delete the cache entry */
3666
3667         if ( !domains ) {
3668                 ret = tdb_delete( wcache->tdb, key );
3669                 goto done;
3670         }
3671
3672         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
3673
3674         if ( !data.dptr ) {
3675                 ret = -1;
3676                 goto done;
3677         }
3678
3679         ret = tdb_store( wcache->tdb, key, data, 0 );
3680
3681  done:
3682         SAFE_FREE( data.dptr );
3683         SAFE_FREE( key.dptr );
3684
3685         return ( ret != -1 );
3686 }
3687
3688 /*********************************************************************
3689  ********************************************************************/
3690
3691 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
3692 {
3693         TDB_DATA key = make_tdc_key( lp_workgroup() );
3694         TDB_DATA data = { NULL, 0 };
3695
3696         *domains = NULL;
3697         *num_domains = 0;
3698
3699         if ( !key.dptr )
3700                 return False;
3701
3702         data = tdb_fetch( wcache->tdb, key );
3703
3704         SAFE_FREE( key.dptr );
3705
3706         if ( !data.dptr )
3707                 return False;
3708
3709         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
3710
3711         SAFE_FREE( data.dptr );
3712
3713         if ( !*domains )
3714                 return False;
3715
3716         return True;
3717 }
3718
3719 /*********************************************************************
3720  ********************************************************************/
3721
3722 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
3723 {
3724         struct winbindd_tdc_domain *dom_list = NULL;
3725         size_t num_domains = 0;
3726         bool ret = False;
3727
3728         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
3729                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
3730                   domain->name, domain->alt_name,
3731                   sid_string_dbg(&domain->sid),
3732                   domain->domain_flags,
3733                   domain->domain_trust_attribs,
3734                   domain->domain_type));
3735
3736         if ( !init_wcache() ) {
3737                 return False;
3738         }
3739
3740         /* fetch the list */
3741
3742         wcache_tdc_fetch_list( &dom_list, &num_domains );
3743
3744         /* add the new domain */
3745
3746         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
3747                 goto done;
3748         }
3749
3750         /* pack the domain */
3751
3752         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
3753                 goto done;
3754         }
3755
3756         /* Success */
3757
3758         ret = True;
3759  done:
3760         TALLOC_FREE( dom_list );
3761
3762         return ret;
3763 }
3764
3765 /*********************************************************************
3766  ********************************************************************/
3767
3768 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
3769 {
3770         struct winbindd_tdc_domain *dom_list = NULL;
3771         size_t num_domains = 0;
3772         int i;
3773         struct winbindd_tdc_domain *d = NULL;
3774
3775         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
3776
3777         if ( !init_wcache() ) {
3778                 return False;
3779         }
3780
3781         /* fetch the list */
3782
3783         wcache_tdc_fetch_list( &dom_list, &num_domains );
3784
3785         for ( i=0; i<num_domains; i++ ) {
3786                 if ( strequal(name, dom_list[i].domain_name) ||
3787                      strequal(name, dom_list[i].dns_name) )
3788                 {
3789                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
3790                                   name));
3791
3792                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
3793                         if ( !d )
3794                                 break;
3795
3796                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
3797                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
3798                         sid_copy( &d->sid, &dom_list[i].sid );
3799                         d->trust_flags   = dom_list[i].trust_flags;
3800                         d->trust_type    = dom_list[i].trust_type;
3801                         d->trust_attribs = dom_list[i].trust_attribs;
3802
3803                         break;
3804                 }
3805         }
3806
3807         TALLOC_FREE( dom_list );
3808
3809         return d;
3810 }
3811
3812
3813 /*********************************************************************
3814  ********************************************************************/
3815
3816 void wcache_tdc_clear( void )
3817 {
3818         if ( !init_wcache() )
3819                 return;
3820
3821         wcache_tdc_store_list( NULL, 0 );
3822
3823         return;
3824 }
3825
3826
3827 /*********************************************************************
3828  ********************************************************************/
3829
3830 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
3831                                     NTSTATUS status,
3832                                     const DOM_SID *user_sid,
3833                                     const char *homedir,
3834                                     const char *shell,
3835                                     const char *gecos,
3836                                     uint32 gid)
3837 {
3838         struct cache_entry *centry;
3839         fstring tmp;
3840
3841         if ( (centry = centry_start(domain, status)) == NULL )
3842                 return;
3843
3844         centry_put_string( centry, homedir );
3845         centry_put_string( centry, shell );
3846         centry_put_string( centry, gecos );
3847         centry_put_uint32( centry, gid );
3848
3849         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
3850
3851         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
3852
3853         centry_free(centry);
3854 }
3855
3856 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
3857                               const DOM_SID *user_sid,
3858                               TALLOC_CTX *ctx,
3859                               ADS_STRUCT *ads, LDAPMessage *msg,
3860                               char **homedir, char **shell, char **gecos,
3861                               gid_t *p_gid)
3862 {
3863         struct winbind_cache *cache = get_cache(domain);
3864         struct cache_entry *centry = NULL;
3865         NTSTATUS nt_status;
3866         fstring tmp;
3867
3868         if (!cache->tdb)
3869                 goto do_query;
3870
3871         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
3872                               sid_to_fstring(tmp, user_sid));
3873
3874         if (!centry)
3875                 goto do_query;
3876
3877         *homedir = centry_string( centry, ctx );
3878         *shell   = centry_string( centry, ctx );
3879         *gecos   = centry_string( centry, ctx );
3880         *p_gid   = centry_uint32( centry );
3881
3882         centry_free(centry);
3883
3884         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
3885                   sid_string_dbg(user_sid)));
3886
3887         return NT_STATUS_OK;
3888
3889 do_query:
3890
3891         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
3892                                   homedir, shell, gecos, p_gid );
3893
3894         if ( NT_STATUS_IS_OK(nt_status) ) {
3895                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
3896                                          *homedir, *shell, *gecos, *p_gid );
3897         }
3898
3899         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
3900                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
3901                          domain->name ));
3902                 set_domain_offline( domain );
3903         }
3904
3905         return nt_status;
3906 }
3907
3908
3909 /* the cache backend methods are exposed via this structure */
3910 struct winbindd_methods cache_methods = {
3911         True,
3912         query_user_list,
3913         enum_dom_groups,
3914         enum_local_groups,
3915         name_to_sid,
3916         sid_to_name,
3917         rids_to_names,
3918         query_user,
3919         lookup_usergroups,
3920         lookup_useraliases,
3921         lookup_groupmem,
3922         sequence_number,
3923         lockout_policy,
3924         password_policy,
3925         trusted_domains
3926 };