source3/winbindd/winbindd_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind cache backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Gerald Carter   2003-2007
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2005
  10    Copyright (C) Michael Adam    2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "tdb_validate.h"
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_WINBIND
  32
  33 #define WINBINDD_CACHE_VERSION 1
  34 #define WINBINDD_CACHE_VERSION_KEYSTR "WINBINDD_CACHE_VERSION"
  35
  36 extern struct winbindd_methods reconnect_methods;
  37 #ifdef HAVE_ADS
  38 extern struct winbindd_methods ads_methods;
  39 #endif
  40 extern struct winbindd_methods builtin_passdb_methods;
  41
  42 /*
  43  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
  44  * Here are the list of entry types that are *not* stored
  45  * as form struct cache_entry in the cache.
  46  */
  47
  48 static const char *non_centry_keys[] = {
  49         "SEQNUM/",
  50         "DR/",
  51         "DE/",
  52         "WINBINDD_OFFLINE",
  53         WINBINDD_CACHE_VERSION_KEYSTR,
  54         NULL
  55 };
  56
  57 /************************************************************************
  58  Is this key a non-centry type ?
  59 ************************************************************************/
  60
  61 static bool is_non_centry_key(TDB_DATA kbuf)
  62 {
  63         int i;
  64
  65         if (kbuf.dptr == NULL || kbuf.dsize == 0) {
  66                 return false;
  67         }
  68         for (i = 0; non_centry_keys[i] != NULL; i++) {
  69                 size_t namelen = strlen(non_centry_keys[i]);
  70                 if (kbuf.dsize < namelen) {
  71                         continue;
  72                 }
  73                 if (strncmp(non_centry_keys[i], (const char *)kbuf.dptr, namelen) == 0) {
  74                         return true;
  75                 }
  76         }
  77         return false;
  78 }
  79
  80 /* Global online/offline state - False when online. winbindd starts up online
  81    and sets this to true if the first query fails and there's an entry in
  82    the cache tdb telling us to stay offline. */
  83
  84 static bool global_winbindd_offline_state;
  85
  86 struct winbind_cache {
  87         TDB_CONTEXT *tdb;
  88 };
  89
  90 struct cache_entry {
  91         NTSTATUS status;
  92         uint32 sequence_number;
  93         uint8 *data;
  94         uint32 len, ofs;
  95 };
  96
  97 void (*smb_panic_fn)(const char *const why) = smb_panic;
  98
  99 #define WINBINDD_MAX_CACHE_SIZE (50*1024*1024)
 100
 101 static struct winbind_cache *wcache;
 102
 103 void winbindd_check_cache_size(time_t t)
 104 {
 105         static time_t last_check_time;
 106         struct stat st;
 107
 108         if (last_check_time == (time_t)0)
 109                 last_check_time = t;
 110
 111         if (t - last_check_time < 60 && t - last_check_time > 0)
 112                 return;
 113
 114         if (wcache == NULL || wcache->tdb == NULL) {
 115                 DEBUG(0, ("Unable to check size of tdb cache - cache not open !\n"));
 116                 return;
 117         }
 118
 119         if (fstat(tdb_fd(wcache->tdb), &st) == -1) {
 120                 DEBUG(0, ("Unable to check size of tdb cache %s!\n", strerror(errno) ));
 121                 return;
 122         }
 123
 124         if (st.st_size > WINBINDD_MAX_CACHE_SIZE) {
 125                 DEBUG(10,("flushing cache due to size (%lu) > (%lu)\n",
 126                         (unsigned long)st.st_size,
 127                         (unsigned long)WINBINDD_MAX_CACHE_SIZE));
 128                 wcache_flush_cache();
 129         }
 130 }
 131
 132 /* get the winbind_cache structure */
 133 static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 134 {
 135         struct winbind_cache *ret = wcache;
 136
 137         /* We have to know what type of domain we are dealing with first. */
 138
 139         if (domain->internal) {
 140                 domain->backend = &builtin_passdb_methods;
 141                 domain->initialized = True;
 142         }
 143         if ( !domain->initialized ) {
 144                 init_dc_connection( domain );
 145         }
 146
 147         /*
 148            OK.  listen up becasue I'm only going to say this once.
 149            We have the following scenarios to consider
 150            (a) trusted AD domains on a Samba DC,
 151            (b) trusted AD domains and we are joined to a non-kerberos domain
 152            (c) trusted AD domains and we are joined to a kerberos (AD) domain
 153
 154            For (a) we can always contact the trusted domain using krb5
 155            since we have the domain trust account password
 156
 157            For (b) we can only use RPC since we have no way of
 158            getting a krb5 ticket in our own domain
 159
 160            For (c) we can always use krb5 since we have a kerberos trust
 161
 162            --jerry
 163          */
 164
 165         if (!domain->backend) {
 166 #ifdef HAVE_ADS
 167                 struct winbindd_domain *our_domain = domain;
 168
 169                 /* find our domain first so we can figure out if we
 170                    are joined to a kerberized domain */
 171
 172                 if ( !domain->primary )
 173                         our_domain = find_our_domain();
 174
 175                 if ((our_domain->active_directory || IS_DC)
 176                     && domain->active_directory
 177                     && !lp_winbind_rpc_only()) {
 178                         DEBUG(5,("get_cache: Setting ADS methods for domain %s\n", domain->name));
 179                         domain->backend = &ads_methods;
 180                 } else {
 181 #endif  /* HAVE_ADS */
 182                         DEBUG(5,("get_cache: Setting MS-RPC methods for domain %s\n", domain->name));
 183                         domain->backend = &reconnect_methods;
 184 #ifdef HAVE_ADS
 185                 }
 186 #endif  /* HAVE_ADS */
 187         }
 188
 189         if (ret)
 190                 return ret;
 191
 192         ret = SMB_XMALLOC_P(struct winbind_cache);
 193         ZERO_STRUCTP(ret);
 194
 195         wcache = ret;
 196         wcache_flush_cache();
 197
 198         return ret;
 199 }
 200
 201 /*
 202   free a centry structure
 203 */
 204 static void centry_free(struct cache_entry *centry)
 205 {
 206         if (!centry)
 207                 return;
 208         SAFE_FREE(centry->data);
 209         free(centry);
 210 }
 211
 212 static bool centry_check_bytes(struct cache_entry *centry, size_t nbytes)
 213 {
 214         if (centry->len - centry->ofs < nbytes) {
 215                 DEBUG(0,("centry corruption? needed %u bytes, have %d\n",
 216                          (unsigned int)nbytes,
 217                          centry->len - centry->ofs));
 218                 return false;
 219         }
 220         return true;
 221 }
 222
 223 /*
 224   pull a uint32 from a cache entry
 225 */
 226 static uint32 centry_uint32(struct cache_entry *centry)
 227 {
 228         uint32 ret;
 229
 230         if (!centry_check_bytes(centry, 4)) {
 231                 smb_panic_fn("centry_uint32");
 232         }
 233         ret = IVAL(centry->data, centry->ofs);
 234         centry->ofs += 4;
 235         return ret;
 236 }
 237
 238 /*
 239   pull a uint16 from a cache entry
 240 */
 241 static uint16 centry_uint16(struct cache_entry *centry)
 242 {
 243         uint16 ret;
 244         if (!centry_check_bytes(centry, 2)) {
 245                 smb_panic_fn("centry_uint16");
 246         }
 247         ret = CVAL(centry->data, centry->ofs);
 248         centry->ofs += 2;
 249         return ret;
 250 }
 251
 252 /*
 253   pull a uint8 from a cache entry
 254 */
 255 static uint8 centry_uint8(struct cache_entry *centry)
 256 {
 257         uint8 ret;
 258         if (!centry_check_bytes(centry, 1)) {
 259                 smb_panic_fn("centry_uint8");
 260         }
 261         ret = CVAL(centry->data, centry->ofs);
 262         centry->ofs += 1;
 263         return ret;
 264 }
 265
 266 /*
 267   pull a NTTIME from a cache entry
 268 */
 269 static NTTIME centry_nttime(struct cache_entry *centry)
 270 {
 271         NTTIME ret;
 272         if (!centry_check_bytes(centry, 8)) {
 273                 smb_panic_fn("centry_nttime");
 274         }
 275         ret = IVAL(centry->data, centry->ofs);
 276         centry->ofs += 4;
 277         ret += (uint64_t)IVAL(centry->data, centry->ofs) << 32;
 278         centry->ofs += 4;
 279         return ret;
 280 }
 281
 282 /*
 283   pull a time_t from a cache entry. time_t stored portably as a 64-bit time.
 284 */
 285 static time_t centry_time(struct cache_entry *centry)
 286 {
 287         return (time_t)centry_nttime(centry);
 288 }
 289
 290 /* pull a string from a cache entry, using the supplied
 291    talloc context
 292 */
 293 static char *centry_string(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 294 {
 295         uint32 len;
 296         char *ret;
 297
 298         len = centry_uint8(centry);
 299
 300         if (len == 0xFF) {
 301                 /* a deliberate NULL string */
 302                 return NULL;
 303         }
 304
 305         if (!centry_check_bytes(centry, (size_t)len)) {
 306                 smb_panic_fn("centry_string");
 307         }
 308
 309         ret = TALLOC_ARRAY(mem_ctx, char, len+1);
 310         if (!ret) {
 311                 smb_panic_fn("centry_string out of memory\n");
 312         }
 313         memcpy(ret,centry->data + centry->ofs, len);
 314         ret[len] = 0;
 315         centry->ofs += len;
 316         return ret;
 317 }
 318
 319 /* pull a hash16 from a cache entry, using the supplied
 320    talloc context
 321 */
 322 static char *centry_hash16(struct cache_entry *centry, TALLOC_CTX *mem_ctx)
 323 {
 324         uint32 len;
 325         char *ret;
 326
 327         len = centry_uint8(centry);
 328
 329         if (len != 16) {
 330                 DEBUG(0,("centry corruption? hash len (%u) != 16\n",
 331                         len ));
 332                 return NULL;
 333         }
 334
 335         if (!centry_check_bytes(centry, 16)) {
 336                 return NULL;
 337         }
 338
 339         ret = TALLOC_ARRAY(mem_ctx, char, 16);
 340         if (!ret) {
 341                 smb_panic_fn("centry_hash out of memory\n");
 342         }
 343         memcpy(ret,centry->data + centry->ofs, 16);
 344         centry->ofs += 16;
 345         return ret;
 346 }
 347
 348 /* pull a sid from a cache entry, using the supplied
 349    talloc context
 350 */
 351 static bool centry_sid(struct cache_entry *centry, TALLOC_CTX *mem_ctx, DOM_SID *sid)
 352 {
 353         char *sid_string;
 354         sid_string = centry_string(centry, mem_ctx);
 355         if ((sid_string == NULL) || (!string_to_sid(sid, sid_string))) {
 356                 return false;
 357         }
 358         return true;
 359 }
 360
 361
 362 /*
 363   pull a NTSTATUS from a cache entry
 364 */
 365 static NTSTATUS centry_ntstatus(struct cache_entry *centry)
 366 {
 367         NTSTATUS status;
 368
 369         status = NT_STATUS(centry_uint32(centry));
 370         return status;
 371 }
 372
 373
 374 /* the server is considered down if it can't give us a sequence number */
 375 static bool wcache_server_down(struct winbindd_domain *domain)
 376 {
 377         bool ret;
 378
 379         if (!wcache->tdb)
 380                 return false;
 381
 382         ret = (domain->sequence_number == DOM_SEQUENCE_NONE);
 383
 384         if (ret)
 385                 DEBUG(10,("wcache_server_down: server for Domain %s down\n",
 386                         domain->name ));
 387         return ret;
 388 }
 389
 390 static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now )
 391 {
 392         TDB_DATA data;
 393         fstring key;
 394         uint32 time_diff;
 395
 396         if (!wcache->tdb) {
 397                 DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n"));
 398                 return NT_STATUS_UNSUCCESSFUL;
 399         }
 400
 401         fstr_sprintf( key, "SEQNUM/%s", domain->name );
 402
 403         data = tdb_fetch_bystring( wcache->tdb, key );
 404         if ( !data.dptr || data.dsize!=8 ) {
 405                 DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key ));
 406                 return NT_STATUS_UNSUCCESSFUL;
 407         }
 408
 409         domain->sequence_number = IVAL(data.dptr, 0);
 410         domain->last_seq_check  = IVAL(data.dptr, 4);
 411
 412         SAFE_FREE(data.dptr);
 413
 414         /* have we expired? */
 415
 416         time_diff = now - domain->last_seq_check;
 417         if ( time_diff > lp_winbind_cache_time() ) {
 418                 DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n",
 419                         domain->name, domain->sequence_number,
 420                         (uint32)domain->last_seq_check));
 421                 return NT_STATUS_UNSUCCESSFUL;
 422         }
 423
 424         DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n",
 425                 domain->name, domain->sequence_number,
 426                 (uint32)domain->last_seq_check));
 427
 428         return NT_STATUS_OK;
 429 }
 430
 431 static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain )
 432 {
 433         TDB_DATA data;
 434         fstring key_str;
 435         uint8 buf[8];
 436
 437         if (!wcache->tdb) {
 438                 DEBUG(10,("store_cache_seqnum: tdb == NULL\n"));
 439                 return NT_STATUS_UNSUCCESSFUL;
 440         }
 441
 442         fstr_sprintf( key_str, "SEQNUM/%s", domain->name );
 443
 444         SIVAL(buf, 0, domain->sequence_number);
 445         SIVAL(buf, 4, domain->last_seq_check);
 446         data.dptr = buf;
 447         data.dsize = 8;
 448
 449         if ( tdb_store_bystring( wcache->tdb, key_str, data, TDB_REPLACE) == -1 ) {
 450                 DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str ));
 451                 return NT_STATUS_UNSUCCESSFUL;
 452         }
 453
 454         DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n",
 455                 domain->name, domain->sequence_number,
 456                 (uint32)domain->last_seq_check));
 457
 458         return NT_STATUS_OK;
 459 }
 460
 461 /*
 462   refresh the domain sequence number. If force is true
 463   then always refresh it, no matter how recently we fetched it
 464 */
 465
 466 static void refresh_sequence_number(struct winbindd_domain *domain, bool force)
 467 {
 468         NTSTATUS status;
 469         unsigned time_diff;
 470         time_t t = time(NULL);
 471         unsigned cache_time = lp_winbind_cache_time();
 472
 473         if ( IS_DOMAIN_OFFLINE(domain) ) {
 474                 return;
 475         }
 476
 477         get_cache( domain );
 478
 479 #if 0   /* JERRY -- disable as the default cache time is now 5 minutes */
 480         /* trying to reconnect is expensive, don't do it too often */
 481         if (domain->sequence_number == DOM_SEQUENCE_NONE) {
 482                 cache_time *= 8;
 483         }
 484 #endif
 485
 486         time_diff = t - domain->last_seq_check;
 487
 488         /* see if we have to refetch the domain sequence number */
 489         if (!force && (time_diff < cache_time) &&
 490                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 491                         NT_STATUS_IS_OK(domain->last_status)) {
 492                 DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name));
 493                 goto done;
 494         }
 495
 496         /* try to get the sequence number from the tdb cache first */
 497         /* this will update the timestamp as well */
 498
 499         status = fetch_cache_seqnum( domain, t );
 500         if (NT_STATUS_IS_OK(status) &&
 501                         (domain->sequence_number != DOM_SEQUENCE_NONE) &&
 502                         NT_STATUS_IS_OK(domain->last_status)) {
 503                 goto done;
 504         }
 505
 506         /* important! make sure that we know if this is a native
 507            mode domain or not.  And that we can contact it. */
 508
 509         if ( winbindd_can_contact_domain( domain ) ) {
 510                 status = domain->backend->sequence_number(domain,
 511                                                           &domain->sequence_number);
 512         } else {
 513                 /* just use the current time */
 514                 status = NT_STATUS_OK;
 515                 domain->sequence_number = time(NULL);
 516         }
 517
 518
 519         /* the above call could have set our domain->backend to NULL when
 520          * coming from offline to online mode, make sure to reinitialize the
 521          * backend - Guenther */
 522         get_cache( domain );
 523
 524         if (!NT_STATUS_IS_OK(status)) {
 525                 DEBUG(10,("refresh_sequence_number: failed with %s\n", nt_errstr(status)));
 526                 domain->sequence_number = DOM_SEQUENCE_NONE;
 527         }
 528
 529         domain->last_status = status;
 530         domain->last_seq_check = time(NULL);
 531
 532         /* save the new sequence number in the cache */
 533         store_cache_seqnum( domain );
 534
 535 done:
 536         DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n",
 537                    domain->name, domain->sequence_number));
 538
 539         return;
 540 }
 541
 542 /*
 543   decide if a cache entry has expired
 544 */
 545 static bool centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry)
 546 {
 547         /* If we've been told to be offline - stay in that state... */
 548         if (lp_winbind_offline_logon() && global_winbindd_offline_state) {
 549                 DEBUG(10,("centry_expired: Key %s for domain %s valid as winbindd is globally offline.\n",
 550                         keystr, domain->name ));
 551                 return false;
 552         }
 553
 554         /* when the domain is offline return the cached entry.
 555          * This deals with transient offline states... */
 556
 557         if (!domain->online) {
 558                 DEBUG(10,("centry_expired: Key %s for domain %s valid as domain is offline.\n",
 559                         keystr, domain->name ));
 560                 return false;
 561         }
 562
 563         /* if the server is OK and our cache entry came from when it was down then
 564            the entry is invalid */
 565         if ((domain->sequence_number != DOM_SEQUENCE_NONE) &&
 566             (centry->sequence_number == DOM_SEQUENCE_NONE)) {
 567                 DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n",
 568                         keystr, domain->name ));
 569                 return true;
 570         }
 571
 572         /* if the server is down or the cache entry is not older than the
 573            current sequence number then it is OK */
 574         if (wcache_server_down(domain) ||
 575             centry->sequence_number == domain->sequence_number) {
 576                 DEBUG(10,("centry_expired: Key %s for domain %s is good.\n",
 577                         keystr, domain->name ));
 578                 return false;
 579         }
 580
 581         DEBUG(10,("centry_expired: Key %s for domain %s expired\n",
 582                 keystr, domain->name ));
 583
 584         /* it's expired */
 585         return true;
 586 }
 587
 588 static struct cache_entry *wcache_fetch_raw(char *kstr)
 589 {
 590         TDB_DATA data;
 591         struct cache_entry *centry;
 592         TDB_DATA key;
 593
 594         key = string_tdb_data(kstr);
 595         data = tdb_fetch(wcache->tdb, key);
 596         if (!data.dptr) {
 597                 /* a cache miss */
 598                 return NULL;
 599         }
 600
 601         centry = SMB_XMALLOC_P(struct cache_entry);
 602         centry->data = (unsigned char *)data.dptr;
 603         centry->len = data.dsize;
 604         centry->ofs = 0;
 605
 606         if (centry->len < 8) {
 607                 /* huh? corrupt cache? */
 608                 DEBUG(10,("wcache_fetch_raw: Corrupt cache for key %s (len < 8) ?\n", kstr));
 609                 centry_free(centry);
 610                 return NULL;
 611         }
 612
 613         centry->status = centry_ntstatus(centry);
 614         centry->sequence_number = centry_uint32(centry);
 615
 616         return centry;
 617 }
 618
 619 /*
 620   fetch an entry from the cache, with a varargs key. auto-fetch the sequence
 621   number and return status
 622 */
 623 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 624                                         struct winbindd_domain *domain,
 625                                         const char *format, ...) PRINTF_ATTRIBUTE(3,4);
 626 static struct cache_entry *wcache_fetch(struct winbind_cache *cache,
 627                                         struct winbindd_domain *domain,
 628                                         const char *format, ...)
 629 {
 630         va_list ap;
 631         char *kstr;
 632         struct cache_entry *centry;
 633
 634         if (!winbindd_use_cache()) {
 635                 return NULL;
 636         }
 637
 638         refresh_sequence_number(domain, false);
 639
 640         va_start(ap, format);
 641         smb_xvasprintf(&kstr, format, ap);
 642         va_end(ap);
 643
 644         centry = wcache_fetch_raw(kstr);
 645         if (centry == NULL) {
 646                 free(kstr);
 647                 return NULL;
 648         }
 649
 650         if (centry_expired(domain, kstr, centry)) {
 651
 652                 DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n",
 653                          kstr, domain->name ));
 654
 655                 centry_free(centry);
 656                 free(kstr);
 657                 return NULL;
 658         }
 659
 660         DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n",
 661                  kstr, domain->name ));
 662
 663         free(kstr);
 664         return centry;
 665 }
 666
 667 static void wcache_delete(const char *format, ...) PRINTF_ATTRIBUTE(1,2);
 668 static void wcache_delete(const char *format, ...)
 669 {
 670         va_list ap;
 671         char *kstr;
 672         TDB_DATA key;
 673
 674         va_start(ap, format);
 675         smb_xvasprintf(&kstr, format, ap);
 676         va_end(ap);
 677
 678         key = string_tdb_data(kstr);
 679
 680         tdb_delete(wcache->tdb, key);
 681         free(kstr);
 682 }
 683
 684 /*
 685   make sure we have at least len bytes available in a centry
 686 */
 687 static void centry_expand(struct cache_entry *centry, uint32 len)
 688 {
 689         if (centry->len - centry->ofs >= len)
 690                 return;
 691         centry->len *= 2;
 692         centry->data = SMB_REALLOC_ARRAY(centry->data, unsigned char,
 693                                          centry->len);
 694         if (!centry->data) {
 695                 DEBUG(0,("out of memory: needed %d bytes in centry_expand\n", centry->len));
 696                 smb_panic_fn("out of memory in centry_expand");
 697         }
 698 }
 699
 700 /*
 701   push a uint32 into a centry
 702 */
 703 static void centry_put_uint32(struct cache_entry *centry, uint32 v)
 704 {
 705         centry_expand(centry, 4);
 706         SIVAL(centry->data, centry->ofs, v);
 707         centry->ofs += 4;
 708 }
 709
 710 /*
 711   push a uint16 into a centry
 712 */
 713 static void centry_put_uint16(struct cache_entry *centry, uint16 v)
 714 {
 715         centry_expand(centry, 2);
 716         SIVAL(centry->data, centry->ofs, v);
 717         centry->ofs += 2;
 718 }
 719
 720 /*
 721   push a uint8 into a centry
 722 */
 723 static void centry_put_uint8(struct cache_entry *centry, uint8 v)
 724 {
 725         centry_expand(centry, 1);
 726         SCVAL(centry->data, centry->ofs, v);
 727         centry->ofs += 1;
 728 }
 729
 730 /*
 731    push a string into a centry
 732  */
 733 static void centry_put_string(struct cache_entry *centry, const char *s)
 734 {
 735         int len;
 736
 737         if (!s) {
 738                 /* null strings are marked as len 0xFFFF */
 739                 centry_put_uint8(centry, 0xFF);
 740                 return;
 741         }
 742
 743         len = strlen(s);
 744         /* can't handle more than 254 char strings. Truncating is probably best */
 745         if (len > 254) {
 746                 DEBUG(10,("centry_put_string: truncating len (%d) to: 254\n", len));
 747                 len = 254;
 748         }
 749         centry_put_uint8(centry, len);
 750         centry_expand(centry, len);
 751         memcpy(centry->data + centry->ofs, s, len);
 752         centry->ofs += len;
 753 }
 754
 755 /*
 756    push a 16 byte hash into a centry - treat as 16 byte string.
 757  */
 758 static void centry_put_hash16(struct cache_entry *centry, const uint8 val[16])
 759 {
 760         centry_put_uint8(centry, 16);
 761         centry_expand(centry, 16);
 762         memcpy(centry->data + centry->ofs, val, 16);
 763         centry->ofs += 16;
 764 }
 765
 766 static void centry_put_sid(struct cache_entry *centry, const DOM_SID *sid)
 767 {
 768         fstring sid_string;
 769         centry_put_string(centry, sid_to_fstring(sid_string, sid));
 770 }
 771
 772
 773 /*
 774   put NTSTATUS into a centry
 775 */
 776 static void centry_put_ntstatus(struct cache_entry *centry, NTSTATUS status)
 777 {
 778         uint32 status_value = NT_STATUS_V(status);
 779         centry_put_uint32(centry, status_value);
 780 }
 781
 782
 783 /*
 784   push a NTTIME into a centry
 785 */
 786 static void centry_put_nttime(struct cache_entry *centry, NTTIME nt)
 787 {
 788         centry_expand(centry, 8);
 789         SIVAL(centry->data, centry->ofs, nt & 0xFFFFFFFF);
 790         centry->ofs += 4;
 791         SIVAL(centry->data, centry->ofs, nt >> 32);
 792         centry->ofs += 4;
 793 }
 794
 795 /*
 796   push a time_t into a centry - use a 64 bit size.
 797   NTTIME here is being used as a convenient 64-bit size.
 798 */
 799 static void centry_put_time(struct cache_entry *centry, time_t t)
 800 {
 801         NTTIME nt = (NTTIME)t;
 802         centry_put_nttime(centry, nt);
 803 }
 804
 805 /*
 806   start a centry for output. When finished, call centry_end()
 807 */
 808 struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status)
 809 {
 810         struct cache_entry *centry;
 811
 812         if (!wcache->tdb)
 813                 return NULL;
 814
 815         centry = SMB_XMALLOC_P(struct cache_entry);
 816
 817         centry->len = 8192; /* reasonable default */
 818         centry->data = SMB_XMALLOC_ARRAY(uint8, centry->len);
 819         centry->ofs = 0;
 820         centry->sequence_number = domain->sequence_number;
 821         centry_put_ntstatus(centry, status);
 822         centry_put_uint32(centry, centry->sequence_number);
 823         return centry;
 824 }
 825
 826 /*
 827   finish a centry and write it to the tdb
 828 */
 829 static void centry_end(struct cache_entry *centry, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 830 static void centry_end(struct cache_entry *centry, const char *format, ...)
 831 {
 832         va_list ap;
 833         char *kstr;
 834         TDB_DATA key, data;
 835
 836         if (!winbindd_use_cache()) {
 837                 return;
 838         }
 839
 840         va_start(ap, format);
 841         smb_xvasprintf(&kstr, format, ap);
 842         va_end(ap);
 843
 844         key = string_tdb_data(kstr);
 845         data.dptr = centry->data;
 846         data.dsize = centry->ofs;
 847
 848         tdb_store(wcache->tdb, key, data, TDB_REPLACE);
 849         free(kstr);
 850 }
 851
 852 static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 853                                     NTSTATUS status, const char *domain_name,
 854                                     const char *name, const DOM_SID *sid,
 855                                     enum lsa_SidType type)
 856 {
 857         struct cache_entry *centry;
 858         fstring uname;
 859
 860         centry = centry_start(domain, status);
 861         if (!centry)
 862                 return;
 863         centry_put_uint32(centry, type);
 864         centry_put_sid(centry, sid);
 865         fstrcpy(uname, name);
 866         strupper_m(uname);
 867         centry_end(centry, "NS/%s/%s", domain_name, uname);
 868         DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
 869                   uname, sid_string_dbg(sid), nt_errstr(status)));
 870         centry_free(centry);
 871 }
 872
 873 static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS status,
 874                                     const DOM_SID *sid, const char *domain_name, const char *name, enum lsa_SidType type)
 875 {
 876         struct cache_entry *centry;
 877         fstring sid_string;
 878
 879         centry = centry_start(domain, status);
 880         if (!centry)
 881                 return;
 882
 883         if (NT_STATUS_IS_OK(status)) {
 884                 centry_put_uint32(centry, type);
 885                 centry_put_string(centry, domain_name);
 886                 centry_put_string(centry, name);
 887         }
 888
 889         centry_end(centry, "SN/%s", sid_to_fstring(sid_string, sid));
 890         DEBUG(10,("wcache_save_sid_to_name: %s -> %s (%s)\n", sid_string,
 891                   name, nt_errstr(status)));
 892         centry_free(centry);
 893 }
 894
 895
 896 static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WINBIND_USERINFO *info)
 897 {
 898         struct cache_entry *centry;
 899         fstring sid_string;
 900
 901         if (is_null_sid(&info->user_sid)) {
 902                 return;
 903         }
 904
 905         centry = centry_start(domain, status);
 906         if (!centry)
 907                 return;
 908         centry_put_string(centry, info->acct_name);
 909         centry_put_string(centry, info->full_name);
 910         centry_put_string(centry, info->homedir);
 911         centry_put_string(centry, info->shell);
 912         centry_put_uint32(centry, info->primary_gid);
 913         centry_put_sid(centry, &info->user_sid);
 914         centry_put_sid(centry, &info->group_sid);
 915         centry_end(centry, "U/%s", sid_to_fstring(sid_string,
 916                                                   &info->user_sid));
 917         DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name));
 918         centry_free(centry);
 919 }
 920
 921 static void wcache_save_lockout_policy(struct winbindd_domain *domain,
 922                                        NTSTATUS status,
 923                                        struct samr_DomInfo12 *lockout_policy)
 924 {
 925         struct cache_entry *centry;
 926
 927         centry = centry_start(domain, status);
 928         if (!centry)
 929                 return;
 930
 931         centry_put_nttime(centry, lockout_policy->lockout_duration);
 932         centry_put_nttime(centry, lockout_policy->lockout_window);
 933         centry_put_uint16(centry, lockout_policy->lockout_threshold);
 934
 935         centry_end(centry, "LOC_POL/%s", domain->name);
 936
 937         DEBUG(10,("wcache_save_lockout_policy: %s\n", domain->name));
 938
 939         centry_free(centry);
 940 }
 941
 942
 943
 944 static void wcache_save_password_policy(struct winbindd_domain *domain,
 945                                         NTSTATUS status,
 946                                         struct samr_DomInfo1 *policy)
 947 {
 948         struct cache_entry *centry;
 949
 950         centry = centry_start(domain, status);
 951         if (!centry)
 952                 return;
 953
 954         centry_put_uint16(centry, policy->min_password_length);
 955         centry_put_uint16(centry, policy->password_history_length);
 956         centry_put_uint32(centry, policy->password_properties);
 957         centry_put_nttime(centry, policy->max_password_age);
 958         centry_put_nttime(centry, policy->min_password_age);
 959
 960         centry_end(centry, "PWD_POL/%s", domain->name);
 961
 962         DEBUG(10,("wcache_save_password_policy: %s\n", domain->name));
 963
 964         centry_free(centry);
 965 }
 966
 967 /***************************************************************************
 968  ***************************************************************************/
 969
 970 static void wcache_save_username_alias(struct winbindd_domain *domain,
 971                                        NTSTATUS status,
 972                                        const char *name, const char *alias)
 973 {
 974         struct cache_entry *centry;
 975         fstring uname;
 976
 977         if ( (centry = centry_start(domain, status)) == NULL )
 978                 return;
 979
 980         centry_put_string( centry, alias );
 981
 982         fstrcpy(uname, name);
 983         strupper_m(uname);
 984         centry_end(centry, "NSS/NA/%s", uname);
 985
 986         DEBUG(10,("wcache_save_username_alias: %s -> %s\n", name, alias ));
 987
 988         centry_free(centry);
 989 }
 990
 991 static void wcache_save_alias_username(struct winbindd_domain *domain,
 992                                        NTSTATUS status,
 993                                        const char *alias, const char *name)
 994 {
 995         struct cache_entry *centry;
 996         fstring uname;
 997
 998         if ( (centry = centry_start(domain, status)) == NULL )
 999                 return;
1000
1001         centry_put_string( centry, name );
1002
1003         fstrcpy(uname, alias);
1004         strupper_m(uname);
1005         centry_end(centry, "NSS/AN/%s", uname);
1006
1007         DEBUG(10,("wcache_save_alias_username: %s -> %s\n", alias, name ));
1008
1009         centry_free(centry);
1010 }
1011
1012 /***************************************************************************
1013  ***************************************************************************/
1014
1015 NTSTATUS resolve_username_to_alias( TALLOC_CTX *mem_ctx,
1016                                     struct winbindd_domain *domain,
1017                                     const char *name, char **alias )
1018 {
1019         struct winbind_cache *cache = get_cache(domain);
1020         struct cache_entry *centry = NULL;
1021         NTSTATUS status;
1022         char *upper_name;
1023
1024         if ( domain->internal )
1025                 return NT_STATUS_NOT_SUPPORTED;
1026
1027         if (!cache->tdb)
1028                 goto do_query;
1029
1030         if ( (upper_name = SMB_STRDUP(name)) == NULL )
1031                 return NT_STATUS_NO_MEMORY;
1032         strupper_m(upper_name);
1033
1034         centry = wcache_fetch(cache, domain, "NSS/NA/%s", upper_name);
1035
1036         SAFE_FREE( upper_name );
1037
1038         if (!centry)
1039                 goto do_query;
1040
1041         status = centry->status;
1042
1043         if (!NT_STATUS_IS_OK(status)) {
1044                 centry_free(centry);
1045                 return status;
1046         }
1047
1048         *alias = centry_string( centry, mem_ctx );
1049
1050         centry_free(centry);
1051
1052         DEBUG(10,("resolve_username_to_alias: [Cached] - mapped %s to %s\n",
1053                   name, *alias ? *alias : "(none)"));
1054
1055         return (*alias) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1056
1057 do_query:
1058
1059         /* If its not in cache and we are offline, then fail */
1060
1061         if ( get_global_winbindd_state_offline() || !domain->online ) {
1062                 DEBUG(8,("resolve_username_to_alias: rejecting query "
1063                          "in offline mode\n"));
1064                 return NT_STATUS_NOT_FOUND;
1065         }
1066
1067         status = nss_map_to_alias( mem_ctx, domain->name, name, alias );
1068
1069         if ( NT_STATUS_IS_OK( status ) ) {
1070                 wcache_save_username_alias(domain, status, name, *alias);
1071         }
1072
1073         if ( NT_STATUS_EQUAL( status, NT_STATUS_NONE_MAPPED ) ) {
1074                 wcache_save_username_alias(domain, status, name, "(NULL)");
1075         }
1076
1077         DEBUG(5,("resolve_username_to_alias: backend query returned %s\n",
1078                  nt_errstr(status)));
1079
1080         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1081                 set_domain_offline( domain );
1082         }
1083
1084         return status;
1085 }
1086
1087 /***************************************************************************
1088  ***************************************************************************/
1089
1090 NTSTATUS resolve_alias_to_username( TALLOC_CTX *mem_ctx,
1091                                     struct winbindd_domain *domain,
1092                                     const char *alias, char **name )
1093 {
1094         struct winbind_cache *cache = get_cache(domain);
1095         struct cache_entry *centry = NULL;
1096         NTSTATUS status;
1097         char *upper_name;
1098
1099         if ( domain->internal )
1100                 return  NT_STATUS_NOT_SUPPORTED;
1101
1102         if (!cache->tdb)
1103                 goto do_query;
1104
1105         if ( (upper_name = SMB_STRDUP(alias)) == NULL )
1106                 return NT_STATUS_NO_MEMORY;
1107         strupper_m(upper_name);
1108
1109         centry = wcache_fetch(cache, domain, "NSS/AN/%s", upper_name);
1110
1111         SAFE_FREE( upper_name );
1112
1113         if (!centry)
1114                 goto do_query;
1115
1116         status = centry->status;
1117
1118         if (!NT_STATUS_IS_OK(status)) {
1119                 centry_free(centry);
1120                 return status;
1121         }
1122
1123         *name = centry_string( centry, mem_ctx );
1124
1125         centry_free(centry);
1126
1127         DEBUG(10,("resolve_alias_to_username: [Cached] - mapped %s to %s\n",
1128                   alias, *name ? *name : "(none)"));
1129
1130         return (*name) ? NT_STATUS_OK : NT_STATUS_OBJECT_NAME_NOT_FOUND;
1131
1132 do_query:
1133
1134         /* If its not in cache and we are offline, then fail */
1135
1136         if ( get_global_winbindd_state_offline() || !domain->online ) {
1137                 DEBUG(8,("resolve_alias_to_username: rejecting query "
1138                          "in offline mode\n"));
1139                 return NT_STATUS_NOT_FOUND;
1140         }
1141
1142         /* an alias cannot contain a domain prefix or '@' */
1143
1144         if (strchr(alias, '\\') || strchr(alias, '@')) {
1145                 DEBUG(10,("resolve_alias_to_username: skipping fully "
1146                           "qualified name %s\n", alias));
1147                 return NT_STATUS_OBJECT_NAME_INVALID;
1148         }
1149
1150         status = nss_map_from_alias( mem_ctx, domain->name, alias, name );
1151
1152         if ( NT_STATUS_IS_OK( status ) ) {
1153                 wcache_save_alias_username( domain, status, alias, *name );
1154         }
1155
1156         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1157                 wcache_save_alias_username(domain, status, alias, "(NULL)");
1158         }
1159
1160         DEBUG(5,("resolve_alias_to_username: backend query returned %s\n",
1161                  nt_errstr(status)));
1162
1163         if ( NT_STATUS_EQUAL(status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ) {
1164                 set_domain_offline( domain );
1165         }
1166
1167         return status;
1168 }
1169
1170 NTSTATUS wcache_cached_creds_exist(struct winbindd_domain *domain, const DOM_SID *sid)
1171 {
1172         struct winbind_cache *cache = get_cache(domain);
1173         TDB_DATA data;
1174         fstring key_str, tmp;
1175         uint32 rid;
1176
1177         if (!cache->tdb) {
1178                 return NT_STATUS_INTERNAL_DB_ERROR;
1179         }
1180
1181         if (is_null_sid(sid)) {
1182                 return NT_STATUS_INVALID_SID;
1183         }
1184
1185         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1186                 return NT_STATUS_INVALID_SID;
1187         }
1188
1189         fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
1190
1191         data = tdb_fetch(cache->tdb, string_tdb_data(key_str));
1192         if (!data.dptr) {
1193                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1194         }
1195
1196         SAFE_FREE(data.dptr);
1197         return NT_STATUS_OK;
1198 }
1199
1200 /* Lookup creds for a SID - copes with old (unsalted) creds as well
1201    as new salted ones. */
1202
1203 NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
1204                           TALLOC_CTX *mem_ctx,
1205                           const DOM_SID *sid,
1206                           const uint8 **cached_nt_pass,
1207                           const uint8 **cached_salt)
1208 {
1209         struct winbind_cache *cache = get_cache(domain);
1210         struct cache_entry *centry = NULL;
1211         NTSTATUS status;
1212         time_t t;
1213         uint32 rid;
1214         fstring tmp;
1215
1216         if (!cache->tdb) {
1217                 return NT_STATUS_INTERNAL_DB_ERROR;
1218         }
1219
1220         if (is_null_sid(sid)) {
1221                 return NT_STATUS_INVALID_SID;
1222         }
1223
1224         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1225                 return NT_STATUS_INVALID_SID;
1226         }
1227
1228         /* Try and get a salted cred first. If we can't
1229            fall back to an unsalted cred. */
1230
1231         centry = wcache_fetch(cache, domain, "CRED/%s",
1232                               sid_to_fstring(tmp, sid));
1233         if (!centry) {
1234                 DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n",
1235                           sid_string_dbg(sid)));
1236                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1237         }
1238
1239         t = centry_time(centry);
1240
1241         /* In the salted case this isn't actually the nt_hash itself,
1242            but the MD5 of the salt + nt_hash. Let the caller
1243            sort this out. It can tell as we only return the cached_salt
1244            if we are returning a salted cred. */
1245
1246         *cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
1247         if (*cached_nt_pass == NULL) {
1248                 fstring sidstr;
1249
1250                 sid_to_fstring(sidstr, sid);
1251
1252                 /* Bad (old) cred cache. Delete and pretend we
1253                    don't have it. */
1254                 DEBUG(0,("wcache_get_creds: bad entry for [CRED/%s] - deleting\n",
1255                                 sidstr));
1256                 wcache_delete("CRED/%s", sidstr);
1257                 centry_free(centry);
1258                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1259         }
1260
1261         /* We only have 17 bytes more data in the salted cred case. */
1262         if (centry->len - centry->ofs == 17) {
1263                 *cached_salt = (const uint8 *)centry_hash16(centry, mem_ctx);
1264         } else {
1265                 *cached_salt = NULL;
1266         }
1267
1268         dump_data_pw("cached_nt_pass", *cached_nt_pass, NT_HASH_LEN);
1269         if (*cached_salt) {
1270                 dump_data_pw("cached_salt", *cached_salt, NT_HASH_LEN);
1271         }
1272
1273         status = centry->status;
1274
1275         DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
1276                   sid_string_dbg(sid), nt_errstr(status) ));
1277
1278         centry_free(centry);
1279         return status;
1280 }
1281
1282 /* Store creds for a SID - only writes out new salted ones. */
1283
1284 NTSTATUS wcache_save_creds(struct winbindd_domain *domain,
1285                            TALLOC_CTX *mem_ctx,
1286                            const DOM_SID *sid,
1287                            const uint8 nt_pass[NT_HASH_LEN])
1288 {
1289         struct cache_entry *centry;
1290         fstring sid_string;
1291         uint32 rid;
1292         uint8 cred_salt[NT_HASH_LEN];
1293         uint8 salted_hash[NT_HASH_LEN];
1294
1295         if (is_null_sid(sid)) {
1296                 return NT_STATUS_INVALID_SID;
1297         }
1298
1299         if (!(sid_peek_rid(sid, &rid)) || (rid == 0)) {
1300                 return NT_STATUS_INVALID_SID;
1301         }
1302
1303         centry = centry_start(domain, NT_STATUS_OK);
1304         if (!centry) {
1305                 return NT_STATUS_INTERNAL_DB_ERROR;
1306         }
1307
1308         dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
1309
1310         centry_put_time(centry, time(NULL));
1311
1312         /* Create a salt and then salt the hash. */
1313         generate_random_buffer(cred_salt, NT_HASH_LEN);
1314         E_md5hash(cred_salt, nt_pass, salted_hash);
1315
1316         centry_put_hash16(centry, salted_hash);
1317         centry_put_hash16(centry, cred_salt);
1318         centry_end(centry, "CRED/%s", sid_to_fstring(sid_string, sid));
1319
1320         DEBUG(10,("wcache_save_creds: %s\n", sid_string));
1321
1322         centry_free(centry);
1323
1324         return NT_STATUS_OK;
1325 }
1326
1327
1328 /* Query display info. This is the basic user list fn */
1329 static NTSTATUS query_user_list(struct winbindd_domain *domain,
1330                                 TALLOC_CTX *mem_ctx,
1331                                 uint32 *num_entries,
1332                                 WINBIND_USERINFO **info)
1333 {
1334         struct winbind_cache *cache = get_cache(domain);
1335         struct cache_entry *centry = NULL;
1336         NTSTATUS status;
1337         unsigned int i, retry;
1338
1339         if (!cache->tdb)
1340                 goto do_query;
1341
1342         centry = wcache_fetch(cache, domain, "UL/%s", domain->name);
1343         if (!centry)
1344                 goto do_query;
1345
1346         *num_entries = centry_uint32(centry);
1347
1348         if (*num_entries == 0)
1349                 goto do_cached;
1350
1351         (*info) = TALLOC_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
1352         if (! (*info)) {
1353                 smb_panic_fn("query_user_list out of memory");
1354         }
1355         for (i=0; i<(*num_entries); i++) {
1356                 (*info)[i].acct_name = centry_string(centry, mem_ctx);
1357                 (*info)[i].full_name = centry_string(centry, mem_ctx);
1358                 (*info)[i].homedir = centry_string(centry, mem_ctx);
1359                 (*info)[i].shell = centry_string(centry, mem_ctx);
1360                 centry_sid(centry, mem_ctx, &(*info)[i].user_sid);
1361                 centry_sid(centry, mem_ctx, &(*info)[i].group_sid);
1362         }
1363
1364 do_cached:
1365         status = centry->status;
1366
1367         DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status: %s\n",
1368                 domain->name, nt_errstr(status) ));
1369
1370         centry_free(centry);
1371         return status;
1372
1373 do_query:
1374         *num_entries = 0;
1375         *info = NULL;
1376
1377         /* Return status value returned by seq number check */
1378
1379         if (!NT_STATUS_IS_OK(domain->last_status))
1380                 return domain->last_status;
1381
1382         /* Put the query_user_list() in a retry loop.  There appears to be
1383          * some bug either with Windows 2000 or Samba's handling of large
1384          * rpc replies.  This manifests itself as sudden disconnection
1385          * at a random point in the enumeration of a large (60k) user list.
1386          * The retry loop simply tries the operation again. )-:  It's not
1387          * pretty but an acceptable workaround until we work out what the
1388          * real problem is. */
1389
1390         retry = 0;
1391         do {
1392
1393                 DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n",
1394                         domain->name ));
1395
1396                 status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info);
1397                 if (!NT_STATUS_IS_OK(status)) {
1398                         DEBUG(3, ("query_user_list: returned 0x%08x, "
1399                                   "retrying\n", NT_STATUS_V(status)));
1400                 }
1401                 if (NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL)) {
1402                         DEBUG(3, ("query_user_list: flushing "
1403                                   "connection cache\n"));
1404                         invalidate_cm_connection(&domain->conn);
1405                 }
1406
1407         } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) &&
1408                  (retry++ < 5));
1409
1410         /* and save it */
1411         refresh_sequence_number(domain, false);
1412         centry = centry_start(domain, status);
1413         if (!centry)
1414                 goto skip_save;
1415         centry_put_uint32(centry, *num_entries);
1416         for (i=0; i<(*num_entries); i++) {
1417                 centry_put_string(centry, (*info)[i].acct_name);
1418                 centry_put_string(centry, (*info)[i].full_name);
1419                 centry_put_string(centry, (*info)[i].homedir);
1420                 centry_put_string(centry, (*info)[i].shell);
1421                 centry_put_sid(centry, &(*info)[i].user_sid);
1422                 centry_put_sid(centry, &(*info)[i].group_sid);
1423                 if (domain->backend && domain->backend->consistent) {
1424                         /* when the backend is consistent we can pre-prime some mappings */
1425                         wcache_save_name_to_sid(domain, NT_STATUS_OK,
1426                                                 domain->name,
1427                                                 (*info)[i].acct_name,
1428                                                 &(*info)[i].user_sid,
1429                                                 SID_NAME_USER);
1430                         wcache_save_sid_to_name(domain, NT_STATUS_OK,
1431                                                 &(*info)[i].user_sid,
1432                                                 domain->name,
1433                                                 (*info)[i].acct_name,
1434                                                 SID_NAME_USER);
1435                         wcache_save_user(domain, NT_STATUS_OK, &(*info)[i]);
1436                 }
1437         }
1438         centry_end(centry, "UL/%s", domain->name);
1439         centry_free(centry);
1440
1441 skip_save:
1442         return status;
1443 }
1444
1445 /* list all domain groups */
1446 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
1447                                 TALLOC_CTX *mem_ctx,
1448                                 uint32 *num_entries,
1449                                 struct acct_info **info)
1450 {
1451         struct winbind_cache *cache = get_cache(domain);
1452         struct cache_entry *centry = NULL;
1453         NTSTATUS status;
1454         unsigned int i;
1455
1456         if (!cache->tdb)
1457                 goto do_query;
1458
1459         centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name);
1460         if (!centry)
1461                 goto do_query;
1462
1463         *num_entries = centry_uint32(centry);
1464
1465         if (*num_entries == 0)
1466                 goto do_cached;
1467
1468         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1469         if (! (*info)) {
1470                 smb_panic_fn("enum_dom_groups out of memory");
1471         }
1472         for (i=0; i<(*num_entries); i++) {
1473                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1474                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1475                 (*info)[i].rid = centry_uint32(centry);
1476         }
1477
1478 do_cached:
1479         status = centry->status;
1480
1481         DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status: %s\n",
1482                 domain->name, nt_errstr(status) ));
1483
1484         centry_free(centry);
1485         return status;
1486
1487 do_query:
1488         *num_entries = 0;
1489         *info = NULL;
1490
1491         /* Return status value returned by seq number check */
1492
1493         if (!NT_STATUS_IS_OK(domain->last_status))
1494                 return domain->last_status;
1495
1496         DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n",
1497                 domain->name ));
1498
1499         status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info);
1500
1501         /* and save it */
1502         refresh_sequence_number(domain, false);
1503         centry = centry_start(domain, status);
1504         if (!centry)
1505                 goto skip_save;
1506         centry_put_uint32(centry, *num_entries);
1507         for (i=0; i<(*num_entries); i++) {
1508                 centry_put_string(centry, (*info)[i].acct_name);
1509                 centry_put_string(centry, (*info)[i].acct_desc);
1510                 centry_put_uint32(centry, (*info)[i].rid);
1511         }
1512         centry_end(centry, "GL/%s/domain", domain->name);
1513         centry_free(centry);
1514
1515 skip_save:
1516         return status;
1517 }
1518
1519 /* list all domain groups */
1520 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
1521                                 TALLOC_CTX *mem_ctx,
1522                                 uint32 *num_entries,
1523                                 struct acct_info **info)
1524 {
1525         struct winbind_cache *cache = get_cache(domain);
1526         struct cache_entry *centry = NULL;
1527         NTSTATUS status;
1528         unsigned int i;
1529
1530         if (!cache->tdb)
1531                 goto do_query;
1532
1533         centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name);
1534         if (!centry)
1535                 goto do_query;
1536
1537         *num_entries = centry_uint32(centry);
1538
1539         if (*num_entries == 0)
1540                 goto do_cached;
1541
1542         (*info) = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
1543         if (! (*info)) {
1544                 smb_panic_fn("enum_dom_groups out of memory");
1545         }
1546         for (i=0; i<(*num_entries); i++) {
1547                 fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx));
1548                 fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx));
1549                 (*info)[i].rid = centry_uint32(centry);
1550         }
1551
1552 do_cached:
1553
1554         /* If we are returning cached data and the domain controller
1555            is down then we don't know whether the data is up to date
1556            or not.  Return NT_STATUS_MORE_PROCESSING_REQUIRED to
1557            indicate this. */
1558
1559         if (wcache_server_down(domain)) {
1560                 DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n"));
1561                 status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1562         } else
1563                 status = centry->status;
1564
1565         DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status: %s\n",
1566                 domain->name, nt_errstr(status) ));
1567
1568         centry_free(centry);
1569         return status;
1570
1571 do_query:
1572         *num_entries = 0;
1573         *info = NULL;
1574
1575         /* Return status value returned by seq number check */
1576
1577         if (!NT_STATUS_IS_OK(domain->last_status))
1578                 return domain->last_status;
1579
1580         DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n",
1581                 domain->name ));
1582
1583         status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info);
1584
1585         /* and save it */
1586         refresh_sequence_number(domain, false);
1587         centry = centry_start(domain, status);
1588         if (!centry)
1589                 goto skip_save;
1590         centry_put_uint32(centry, *num_entries);
1591         for (i=0; i<(*num_entries); i++) {
1592                 centry_put_string(centry, (*info)[i].acct_name);
1593                 centry_put_string(centry, (*info)[i].acct_desc);
1594                 centry_put_uint32(centry, (*info)[i].rid);
1595         }
1596         centry_end(centry, "GL/%s/local", domain->name);
1597         centry_free(centry);
1598
1599 skip_save:
1600         return status;
1601 }
1602
1603 /* convert a single name to a sid in a domain */
1604 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
1605                             TALLOC_CTX *mem_ctx,
1606                             enum winbindd_cmd orig_cmd,
1607                             const char *domain_name,
1608                             const char *name,
1609                             DOM_SID *sid,
1610                             enum lsa_SidType *type)
1611 {
1612         struct winbind_cache *cache = get_cache(domain);
1613         struct cache_entry *centry = NULL;
1614         NTSTATUS status;
1615         fstring uname;
1616
1617         if (!cache->tdb)
1618                 goto do_query;
1619
1620         fstrcpy(uname, name);
1621         strupper_m(uname);
1622         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
1623         if (!centry)
1624                 goto do_query;
1625
1626         status = centry->status;
1627         if (NT_STATUS_IS_OK(status)) {
1628                 *type = (enum lsa_SidType)centry_uint32(centry);
1629                 centry_sid(centry, mem_ctx, sid);
1630         }
1631
1632         DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status: %s\n",
1633                 domain->name, nt_errstr(status) ));
1634
1635         centry_free(centry);
1636         return status;
1637
1638 do_query:
1639         ZERO_STRUCTP(sid);
1640
1641         /* If the seq number check indicated that there is a problem
1642          * with this DC, then return that status... except for
1643          * access_denied.  This is special because the dc may be in
1644          * "restrict anonymous = 1" mode, in which case it will deny
1645          * most unauthenticated operations, but *will* allow the LSA
1646          * name-to-sid that we try as a fallback. */
1647
1648         if (!(NT_STATUS_IS_OK(domain->last_status)
1649               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1650                 return domain->last_status;
1651
1652         DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n",
1653                 domain->name ));
1654
1655         status = domain->backend->name_to_sid(domain, mem_ctx, orig_cmd,
1656                                               domain_name, name, sid, type);
1657
1658         /* and save it */
1659         refresh_sequence_number(domain, false);
1660
1661         if (domain->online &&
1662             (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))) {
1663                 wcache_save_name_to_sid(domain, status, domain_name, name, sid, *type);
1664
1665                 /* Only save the reverse mapping if this was not a UPN */
1666                 if (!strchr(name, '@')) {
1667                         strupper_m(CONST_DISCARD(char *,domain_name));
1668                         strlower_m(CONST_DISCARD(char *,name));
1669                         wcache_save_sid_to_name(domain, status, sid, domain_name, name, *type);
1670                 }
1671         }
1672
1673         return status;
1674 }
1675
1676 /* convert a sid to a user or group name. The sid is guaranteed to be in the domain
1677    given */
1678 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
1679                             TALLOC_CTX *mem_ctx,
1680                             const DOM_SID *sid,
1681                             char **domain_name,
1682                             char **name,
1683                             enum lsa_SidType *type)
1684 {
1685         struct winbind_cache *cache = get_cache(domain);
1686         struct cache_entry *centry = NULL;
1687         NTSTATUS status;
1688         fstring sid_string;
1689
1690         if (!cache->tdb)
1691                 goto do_query;
1692
1693         centry = wcache_fetch(cache, domain, "SN/%s",
1694                               sid_to_fstring(sid_string, sid));
1695         if (!centry)
1696                 goto do_query;
1697
1698         status = centry->status;
1699         if (NT_STATUS_IS_OK(status)) {
1700                 *type = (enum lsa_SidType)centry_uint32(centry);
1701                 *domain_name = centry_string(centry, mem_ctx);
1702                 *name = centry_string(centry, mem_ctx);
1703         }
1704
1705         DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status: %s\n",
1706                 domain->name, nt_errstr(status) ));
1707
1708         centry_free(centry);
1709         return status;
1710
1711 do_query:
1712         *name = NULL;
1713         *domain_name = NULL;
1714
1715         /* If the seq number check indicated that there is a problem
1716          * with this DC, then return that status... except for
1717          * access_denied.  This is special because the dc may be in
1718          * "restrict anonymous = 1" mode, in which case it will deny
1719          * most unauthenticated operations, but *will* allow the LSA
1720          * sid-to-name that we try as a fallback. */
1721
1722         if (!(NT_STATUS_IS_OK(domain->last_status)
1723               || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED)))
1724                 return domain->last_status;
1725
1726         DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n",
1727                 domain->name ));
1728
1729         status = domain->backend->sid_to_name(domain, mem_ctx, sid, domain_name, name, type);
1730
1731         /* and save it */
1732         refresh_sequence_number(domain, false);
1733         wcache_save_sid_to_name(domain, status, sid, *domain_name, *name, *type);
1734
1735         /* We can't save the name to sid mapping here, as with sid history a
1736          * later name2sid would give the wrong sid. */
1737
1738         return status;
1739 }
1740
1741 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
1742                               TALLOC_CTX *mem_ctx,
1743                               const DOM_SID *domain_sid,
1744                               uint32 *rids,
1745                               size_t num_rids,
1746                               char **domain_name,
1747                               char ***names,
1748                               enum lsa_SidType **types)
1749 {
1750         struct winbind_cache *cache = get_cache(domain);
1751         size_t i;
1752         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1753         bool have_mapped;
1754         bool have_unmapped;
1755
1756         *domain_name = NULL;
1757         *names = NULL;
1758         *types = NULL;
1759
1760         if (!cache->tdb) {
1761                 goto do_query;
1762         }
1763
1764         if (num_rids == 0) {
1765                 return NT_STATUS_OK;
1766         }
1767
1768         *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
1769         *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
1770
1771         if ((*names == NULL) || (*types == NULL)) {
1772                 result = NT_STATUS_NO_MEMORY;
1773                 goto error;
1774         }
1775
1776         have_mapped = have_unmapped = false;
1777
1778         for (i=0; i<num_rids; i++) {
1779                 DOM_SID sid;
1780                 struct cache_entry *centry;
1781                 fstring tmp;
1782
1783                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1784                         result = NT_STATUS_INTERNAL_ERROR;
1785                         goto error;
1786                 }
1787
1788                 centry = wcache_fetch(cache, domain, "SN/%s",
1789                                       sid_to_fstring(tmp, &sid));
1790                 if (!centry) {
1791                         goto do_query;
1792                 }
1793
1794                 (*types)[i] = SID_NAME_UNKNOWN;
1795                 (*names)[i] = talloc_strdup(*names, "");
1796
1797                 if (NT_STATUS_IS_OK(centry->status)) {
1798                         char *dom;
1799                         have_mapped = true;
1800                         (*types)[i] = (enum lsa_SidType)centry_uint32(centry);
1801
1802                         dom = centry_string(centry, mem_ctx);
1803                         if (*domain_name == NULL) {
1804                                 *domain_name = dom;
1805                         } else {
1806                                 talloc_free(dom);
1807                         }
1808
1809                         (*names)[i] = centry_string(centry, *names);
1810
1811                 } else if (NT_STATUS_EQUAL(centry->status, NT_STATUS_NONE_MAPPED)) {
1812                         have_unmapped = true;
1813
1814                 } else {
1815                         /* something's definitely wrong */
1816                         result = centry->status;
1817                         goto error;
1818                 }
1819
1820                 centry_free(centry);
1821         }
1822
1823         if (!have_mapped) {
1824                 return NT_STATUS_NONE_MAPPED;
1825         }
1826         if (!have_unmapped) {
1827                 return NT_STATUS_OK;
1828         }
1829         return STATUS_SOME_UNMAPPED;
1830
1831  do_query:
1832
1833         TALLOC_FREE(*names);
1834         TALLOC_FREE(*types);
1835
1836         result = domain->backend->rids_to_names(domain, mem_ctx, domain_sid,
1837                                                 rids, num_rids, domain_name,
1838                                                 names, types);
1839
1840         /*
1841           None of the queried rids has been found so save all negative entries
1842         */
1843         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1844                 for (i = 0; i < num_rids; i++) {
1845                         DOM_SID sid;
1846                         const char *name = "";
1847                         const enum lsa_SidType type = SID_NAME_UNKNOWN;
1848                         NTSTATUS status = NT_STATUS_NONE_MAPPED;
1849
1850                         if (!sid_compose(&sid, domain_sid, rids[i])) {
1851                                 return NT_STATUS_INTERNAL_ERROR;
1852                         }
1853
1854                         wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1855                                                 name, type);
1856                 }
1857
1858                 return result;
1859         }
1860
1861         /*
1862           Some or all of the queried rids have been found.
1863         */
1864         if (!NT_STATUS_IS_OK(result) &&
1865             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
1866                 return result;
1867         }
1868
1869         refresh_sequence_number(domain, false);
1870
1871         for (i=0; i<num_rids; i++) {
1872                 DOM_SID sid;
1873                 NTSTATUS status;
1874
1875                 if (!sid_compose(&sid, domain_sid, rids[i])) {
1876                         result = NT_STATUS_INTERNAL_ERROR;
1877                         goto error;
1878                 }
1879
1880                 status = (*types)[i] == SID_NAME_UNKNOWN ?
1881                         NT_STATUS_NONE_MAPPED : NT_STATUS_OK;
1882
1883                 wcache_save_sid_to_name(domain, status, &sid, *domain_name,
1884                                         (*names)[i], (*types)[i]);
1885         }
1886
1887         return result;
1888
1889  error:
1890
1891         TALLOC_FREE(*names);
1892         TALLOC_FREE(*types);
1893         return result;
1894 }
1895
1896 /* Lookup user information from a rid */
1897 static NTSTATUS query_user(struct winbindd_domain *domain,
1898                            TALLOC_CTX *mem_ctx,
1899                            const DOM_SID *user_sid,
1900                            WINBIND_USERINFO *info)
1901 {
1902         struct winbind_cache *cache = get_cache(domain);
1903         struct cache_entry *centry = NULL;
1904         NTSTATUS status;
1905         fstring tmp;
1906
1907         if (!cache->tdb)
1908                 goto do_query;
1909
1910         centry = wcache_fetch(cache, domain, "U/%s",
1911                               sid_to_fstring(tmp, user_sid));
1912
1913         /* If we have an access denied cache entry and a cached info3 in the
1914            samlogon cache then do a query.  This will force the rpc back end
1915            to return the info3 data. */
1916
1917         if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1918             netsamlogon_cache_have(user_sid)) {
1919                 DEBUG(10, ("query_user: cached access denied and have cached info3\n"));
1920                 domain->last_status = NT_STATUS_OK;
1921                 centry_free(centry);
1922                 goto do_query;
1923         }
1924
1925         if (!centry)
1926                 goto do_query;
1927
1928         /* if status is not ok then this is a negative hit
1929            and the rest of the data doesn't matter */
1930         status = centry->status;
1931         if (NT_STATUS_IS_OK(status)) {
1932                 info->acct_name = centry_string(centry, mem_ctx);
1933                 info->full_name = centry_string(centry, mem_ctx);
1934                 info->homedir = centry_string(centry, mem_ctx);
1935                 info->shell = centry_string(centry, mem_ctx);
1936                 info->primary_gid = centry_uint32(centry);
1937                 centry_sid(centry, mem_ctx, &info->user_sid);
1938                 centry_sid(centry, mem_ctx, &info->group_sid);
1939         }
1940
1941         DEBUG(10,("query_user: [Cached] - cached info for domain %s status: %s\n",
1942                 domain->name, nt_errstr(status) ));
1943
1944         centry_free(centry);
1945         return status;
1946
1947 do_query:
1948         ZERO_STRUCTP(info);
1949
1950         /* Return status value returned by seq number check */
1951
1952         if (!NT_STATUS_IS_OK(domain->last_status))
1953                 return domain->last_status;
1954
1955         DEBUG(10,("query_user: [Cached] - doing backend query for info for domain %s\n",
1956                 domain->name ));
1957
1958         status = domain->backend->query_user(domain, mem_ctx, user_sid, info);
1959
1960         /* and save it */
1961         refresh_sequence_number(domain, false);
1962         wcache_save_user(domain, status, info);
1963
1964         return status;
1965 }
1966
1967
1968 /* Lookup groups a user is a member of. */
1969 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
1970                                   TALLOC_CTX *mem_ctx,
1971                                   const DOM_SID *user_sid,
1972                                   uint32 *num_groups, DOM_SID **user_gids)
1973 {
1974         struct winbind_cache *cache = get_cache(domain);
1975         struct cache_entry *centry = NULL;
1976         NTSTATUS status;
1977         unsigned int i;
1978         fstring sid_string;
1979
1980         if (!cache->tdb)
1981                 goto do_query;
1982
1983         centry = wcache_fetch(cache, domain, "UG/%s",
1984                               sid_to_fstring(sid_string, user_sid));
1985
1986         /* If we have an access denied cache entry and a cached info3 in the
1987            samlogon cache then do a query.  This will force the rpc back end
1988            to return the info3 data. */
1989
1990         if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) &&
1991             netsamlogon_cache_have(user_sid)) {
1992                 DEBUG(10, ("lookup_usergroups: cached access denied and have cached info3\n"));
1993                 domain->last_status = NT_STATUS_OK;
1994                 centry_free(centry);
1995                 goto do_query;
1996         }
1997
1998         if (!centry)
1999                 goto do_query;
2000
2001         *num_groups = centry_uint32(centry);
2002
2003         if (*num_groups == 0)
2004                 goto do_cached;
2005
2006         (*user_gids) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_groups);
2007         if (! (*user_gids)) {
2008                 smb_panic_fn("lookup_usergroups out of memory");
2009         }
2010         for (i=0; i<(*num_groups); i++) {
2011                 centry_sid(centry, mem_ctx, &(*user_gids)[i]);
2012         }
2013
2014 do_cached:
2015         status = centry->status;
2016
2017         DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status: %s\n",
2018                 domain->name, nt_errstr(status) ));
2019
2020         centry_free(centry);
2021         return status;
2022
2023 do_query:
2024         (*num_groups) = 0;
2025         (*user_gids) = NULL;
2026
2027         /* Return status value returned by seq number check */
2028
2029         if (!NT_STATUS_IS_OK(domain->last_status))
2030                 return domain->last_status;
2031
2032         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n",
2033                 domain->name ));
2034
2035         status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids);
2036
2037         if ( NT_STATUS_EQUAL(status, NT_STATUS_SYNCHRONIZATION_REQUIRED) )
2038                 goto skip_save;
2039
2040         /* and save it */
2041         refresh_sequence_number(domain, false);
2042         centry = centry_start(domain, status);
2043         if (!centry)
2044                 goto skip_save;
2045
2046         centry_put_uint32(centry, *num_groups);
2047         for (i=0; i<(*num_groups); i++) {
2048                 centry_put_sid(centry, &(*user_gids)[i]);
2049         }
2050
2051         centry_end(centry, "UG/%s", sid_to_fstring(sid_string, user_sid));
2052         centry_free(centry);
2053
2054 skip_save:
2055         return status;
2056 }
2057
2058 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
2059                                    TALLOC_CTX *mem_ctx,
2060                                    uint32 num_sids, const DOM_SID *sids,
2061                                    uint32 *num_aliases, uint32 **alias_rids)
2062 {
2063         struct winbind_cache *cache = get_cache(domain);
2064         struct cache_entry *centry = NULL;
2065         NTSTATUS status;
2066         char *sidlist = talloc_strdup(mem_ctx, "");
2067         int i;
2068
2069         if (!cache->tdb)
2070                 goto do_query;
2071
2072         if (num_sids == 0) {
2073                 *num_aliases = 0;
2074                 *alias_rids = NULL;
2075                 return NT_STATUS_OK;
2076         }
2077
2078         /* We need to cache indexed by the whole list of SIDs, the aliases
2079          * resulting might come from any of the SIDs. */
2080
2081         for (i=0; i<num_sids; i++) {
2082                 fstring tmp;
2083                 sidlist = talloc_asprintf(mem_ctx, "%s/%s", sidlist,
2084                                           sid_to_fstring(tmp, &sids[i]));
2085                 if (sidlist == NULL)
2086                         return NT_STATUS_NO_MEMORY;
2087         }
2088
2089         centry = wcache_fetch(cache, domain, "UA%s", sidlist);
2090
2091         if (!centry)
2092                 goto do_query;
2093
2094         *num_aliases = centry_uint32(centry);
2095         *alias_rids = NULL;
2096
2097         if (*num_aliases) {
2098                 (*alias_rids) = TALLOC_ARRAY(mem_ctx, uint32, *num_aliases);
2099
2100                 if ((*alias_rids) == NULL) {
2101                         centry_free(centry);
2102                         return NT_STATUS_NO_MEMORY;
2103                 }
2104         } else {
2105                 (*alias_rids) = NULL;
2106         }
2107
2108         for (i=0; i<(*num_aliases); i++)
2109                 (*alias_rids)[i] = centry_uint32(centry);
2110
2111         status = centry->status;
2112
2113         DEBUG(10,("lookup_useraliases: [Cached] - cached info for domain: %s "
2114                   "status %s\n", domain->name, nt_errstr(status)));
2115
2116         centry_free(centry);
2117         return status;
2118
2119  do_query:
2120         (*num_aliases) = 0;
2121         (*alias_rids) = NULL;
2122
2123         if (!NT_STATUS_IS_OK(domain->last_status))
2124                 return domain->last_status;
2125
2126         DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info "
2127                   "for domain %s\n", domain->name ));
2128
2129         status = domain->backend->lookup_useraliases(domain, mem_ctx,
2130                                                      num_sids, sids,
2131                                                      num_aliases, alias_rids);
2132
2133         /* and save it */
2134         refresh_sequence_number(domain, false);
2135         centry = centry_start(domain, status);
2136         if (!centry)
2137                 goto skip_save;
2138         centry_put_uint32(centry, *num_aliases);
2139         for (i=0; i<(*num_aliases); i++)
2140                 centry_put_uint32(centry, (*alias_rids)[i]);
2141         centry_end(centry, "UA%s", sidlist);
2142         centry_free(centry);
2143
2144  skip_save:
2145         return status;
2146 }
2147
2148
2149 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
2150                                 TALLOC_CTX *mem_ctx,
2151                                 const DOM_SID *group_sid, uint32 *num_names,
2152                                 DOM_SID **sid_mem, char ***names,
2153                                 uint32 **name_types)
2154 {
2155         struct winbind_cache *cache = get_cache(domain);
2156         struct cache_entry *centry = NULL;
2157         NTSTATUS status;
2158         unsigned int i;
2159         fstring sid_string;
2160
2161         if (!cache->tdb)
2162                 goto do_query;
2163
2164         centry = wcache_fetch(cache, domain, "GM/%s",
2165                               sid_to_fstring(sid_string, group_sid));
2166         if (!centry)
2167                 goto do_query;
2168
2169         *num_names = centry_uint32(centry);
2170
2171         if (*num_names == 0)
2172                 goto do_cached;
2173
2174         (*sid_mem) = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_names);
2175         (*names) = TALLOC_ARRAY(mem_ctx, char *, *num_names);
2176         (*name_types) = TALLOC_ARRAY(mem_ctx, uint32, *num_names);
2177
2178         if (! (*sid_mem) || ! (*names) || ! (*name_types)) {
2179                 smb_panic_fn("lookup_groupmem out of memory");
2180         }
2181
2182         for (i=0; i<(*num_names); i++) {
2183                 centry_sid(centry, mem_ctx, &(*sid_mem)[i]);
2184                 (*names)[i] = centry_string(centry, mem_ctx);
2185                 (*name_types)[i] = centry_uint32(centry);
2186         }
2187
2188 do_cached:
2189         status = centry->status;
2190
2191         DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status: %s\n",
2192                 domain->name, nt_errstr(status)));
2193
2194         centry_free(centry);
2195         return status;
2196
2197 do_query:
2198         (*num_names) = 0;
2199         (*sid_mem) = NULL;
2200         (*names) = NULL;
2201         (*name_types) = NULL;
2202
2203         /* Return status value returned by seq number check */
2204
2205         if (!NT_STATUS_IS_OK(domain->last_status))
2206                 return domain->last_status;
2207
2208         DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n",
2209                 domain->name ));
2210
2211         status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names,
2212                                                   sid_mem, names, name_types);
2213
2214         /* and save it */
2215         refresh_sequence_number(domain, false);
2216         centry = centry_start(domain, status);
2217         if (!centry)
2218                 goto skip_save;
2219         centry_put_uint32(centry, *num_names);
2220         for (i=0; i<(*num_names); i++) {
2221                 centry_put_sid(centry, &(*sid_mem)[i]);
2222                 centry_put_string(centry, (*names)[i]);
2223                 centry_put_uint32(centry, (*name_types)[i]);
2224         }
2225         centry_end(centry, "GM/%s", sid_to_fstring(sid_string, group_sid));
2226         centry_free(centry);
2227
2228 skip_save:
2229         return status;
2230 }
2231
2232 /* find the sequence number for a domain */
2233 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
2234 {
2235         refresh_sequence_number(domain, false);
2236
2237         *seq = domain->sequence_number;
2238
2239         return NT_STATUS_OK;
2240 }
2241
2242 /* enumerate trusted domains
2243  * (we need to have the list of trustdoms in the cache when we go offline) -
2244  * Guenther */
2245 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
2246                                 TALLOC_CTX *mem_ctx,
2247                                 uint32 *num_domains,
2248                                 char ***names,
2249                                 char ***alt_names,
2250                                 DOM_SID **dom_sids)
2251 {
2252         struct winbind_cache *cache = get_cache(domain);
2253         struct cache_entry *centry = NULL;
2254         NTSTATUS status;
2255         int i;
2256
2257         if (!cache->tdb)
2258                 goto do_query;
2259
2260         centry = wcache_fetch(cache, domain, "TRUSTDOMS/%s", domain->name);
2261
2262         if (!centry) {
2263                 goto do_query;
2264         }
2265
2266         *num_domains = centry_uint32(centry);
2267
2268         if (*num_domains) {
2269                 (*names)        = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2270                 (*alt_names)    = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
2271                 (*dom_sids)     = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
2272
2273                 if (! (*dom_sids) || ! (*names) || ! (*alt_names)) {
2274                         smb_panic_fn("trusted_domains out of memory");
2275                 }
2276         } else {
2277                 (*names) = NULL;
2278                 (*alt_names) = NULL;
2279                 (*dom_sids) = NULL;
2280         }
2281
2282         for (i=0; i<(*num_domains); i++) {
2283                 (*names)[i] = centry_string(centry, mem_ctx);
2284                 (*alt_names)[i] = centry_string(centry, mem_ctx);
2285                 if (!centry_sid(centry, mem_ctx, &(*dom_sids)[i])) {
2286                         sid_copy(&(*dom_sids)[i], &global_sid_NULL);
2287                 }
2288         }
2289
2290         status = centry->status;
2291
2292         DEBUG(10,("trusted_domains: [Cached] - cached info for domain %s (%d trusts) status: %s\n",
2293                 domain->name, *num_domains, nt_errstr(status) ));
2294
2295         centry_free(centry);
2296         return status;
2297
2298 do_query:
2299         (*num_domains) = 0;
2300         (*dom_sids) = NULL;
2301         (*names) = NULL;
2302         (*alt_names) = NULL;
2303
2304         /* Return status value returned by seq number check */
2305
2306         if (!NT_STATUS_IS_OK(domain->last_status))
2307                 return domain->last_status;
2308
2309         DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n",
2310                 domain->name ));
2311
2312         status = domain->backend->trusted_domains(domain, mem_ctx, num_domains,
2313                                                 names, alt_names, dom_sids);
2314
2315         /* no trusts gives NT_STATUS_NO_MORE_ENTRIES resetting to NT_STATUS_OK
2316          * so that the generic centry handling still applies correctly -
2317          * Guenther*/
2318
2319         if (!NT_STATUS_IS_ERR(status)) {
2320                 status = NT_STATUS_OK;
2321         }
2322
2323
2324 #if 0    /* Disabled as we want the trust dom list to be managed by
2325             the main parent and always to make the query.  --jerry */
2326
2327         /* and save it */
2328         refresh_sequence_number(domain, false);
2329
2330         centry = centry_start(domain, status);
2331         if (!centry)
2332                 goto skip_save;
2333
2334         centry_put_uint32(centry, *num_domains);
2335
2336         for (i=0; i<(*num_domains); i++) {
2337                 centry_put_string(centry, (*names)[i]);
2338                 centry_put_string(centry, (*alt_names)[i]);
2339                 centry_put_sid(centry, &(*dom_sids)[i]);
2340         }
2341
2342         centry_end(centry, "TRUSTDOMS/%s", domain->name);
2343
2344         centry_free(centry);
2345
2346 skip_save:
2347 #endif
2348
2349         return status;
2350 }
2351
2352 /* get lockout policy */
2353 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
2354                                TALLOC_CTX *mem_ctx,
2355                                struct samr_DomInfo12 *policy)
2356 {
2357         struct winbind_cache *cache = get_cache(domain);
2358         struct cache_entry *centry = NULL;
2359         NTSTATUS status;
2360
2361         if (!cache->tdb)
2362                 goto do_query;
2363
2364         centry = wcache_fetch(cache, domain, "LOC_POL/%s", domain->name);
2365
2366         if (!centry)
2367                 goto do_query;
2368
2369         policy->lockout_duration = centry_nttime(centry);
2370         policy->lockout_window = centry_nttime(centry);
2371         policy->lockout_threshold = centry_uint16(centry);
2372
2373         status = centry->status;
2374
2375         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2376                 domain->name, nt_errstr(status) ));
2377
2378         centry_free(centry);
2379         return status;
2380
2381 do_query:
2382         ZERO_STRUCTP(policy);
2383
2384         /* Return status value returned by seq number check */
2385
2386         if (!NT_STATUS_IS_OK(domain->last_status))
2387                 return domain->last_status;
2388
2389         DEBUG(10,("lockout_policy: [Cached] - doing backend query for info for domain %s\n",
2390                 domain->name ));
2391
2392         status = domain->backend->lockout_policy(domain, mem_ctx, policy);
2393
2394         /* and save it */
2395         refresh_sequence_number(domain, false);
2396         wcache_save_lockout_policy(domain, status, policy);
2397
2398         return status;
2399 }
2400
2401 /* get password policy */
2402 static NTSTATUS password_policy(struct winbindd_domain *domain,
2403                                 TALLOC_CTX *mem_ctx,
2404                                 struct samr_DomInfo1 *policy)
2405 {
2406         struct winbind_cache *cache = get_cache(domain);
2407         struct cache_entry *centry = NULL;
2408         NTSTATUS status;
2409
2410         if (!cache->tdb)
2411                 goto do_query;
2412
2413         centry = wcache_fetch(cache, domain, "PWD_POL/%s", domain->name);
2414
2415         if (!centry)
2416                 goto do_query;
2417
2418         policy->min_password_length = centry_uint16(centry);
2419         policy->password_history_length = centry_uint16(centry);
2420         policy->password_properties = centry_uint32(centry);
2421         policy->max_password_age = centry_nttime(centry);
2422         policy->min_password_age = centry_nttime(centry);
2423
2424         status = centry->status;
2425
2426         DEBUG(10,("lockout_policy: [Cached] - cached info for domain %s status: %s\n",
2427                 domain->name, nt_errstr(status) ));
2428
2429         centry_free(centry);
2430         return status;
2431
2432 do_query:
2433         ZERO_STRUCTP(policy);
2434
2435         /* Return status value returned by seq number check */
2436
2437         if (!NT_STATUS_IS_OK(domain->last_status))
2438                 return domain->last_status;
2439
2440         DEBUG(10,("password_policy: [Cached] - doing backend query for info for domain %s\n",
2441                 domain->name ));
2442
2443         status = domain->backend->password_policy(domain, mem_ctx, policy);
2444
2445         /* and save it */
2446         refresh_sequence_number(domain, false);
2447         if (NT_STATUS_IS_OK(status)) {
2448                 wcache_save_password_policy(domain, status, policy);
2449         }
2450
2451         return status;
2452 }
2453
2454
2455 /* Invalidate cached user and group lists coherently */
2456
2457 static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2458                        void *state)
2459 {
2460         if (strncmp((const char *)kbuf.dptr, "UL/", 3) == 0 ||
2461             strncmp((const char *)kbuf.dptr, "GL/", 3) == 0)
2462                 tdb_delete(the_tdb, kbuf);
2463
2464         return 0;
2465 }
2466
2467 /* Invalidate the getpwnam and getgroups entries for a winbindd domain */
2468
2469 void wcache_invalidate_samlogon(struct winbindd_domain *domain,
2470                                 struct netr_SamInfo3 *info3)
2471 {
2472         DOM_SID sid;
2473         fstring key_str, sid_string;
2474         struct winbind_cache *cache;
2475
2476         /* dont clear cached U/SID and UG/SID entries when we want to logon
2477          * offline - gd */
2478
2479         if (lp_winbind_offline_logon()) {
2480                 return;
2481         }
2482
2483         if (!domain)
2484                 return;
2485
2486         cache = get_cache(domain);
2487
2488         if (!cache->tdb) {
2489                 return;
2490         }
2491
2492         sid_copy(&sid, info3->base.domain_sid);
2493         sid_append_rid(&sid, info3->base.rid);
2494
2495         /* Clear U/SID cache entry */
2496         fstr_sprintf(key_str, "U/%s", sid_to_fstring(sid_string, &sid));
2497         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2498         tdb_delete(cache->tdb, string_tdb_data(key_str));
2499
2500         /* Clear UG/SID cache entry */
2501         fstr_sprintf(key_str, "UG/%s", sid_to_fstring(sid_string, &sid));
2502         DEBUG(10, ("wcache_invalidate_samlogon: clearing %s\n", key_str));
2503         tdb_delete(cache->tdb, string_tdb_data(key_str));
2504
2505         /* Samba/winbindd never needs this. */
2506         netsamlogon_clear_cached_user(info3);
2507 }
2508
2509 bool wcache_invalidate_cache(void)
2510 {
2511         struct winbindd_domain *domain;
2512
2513         for (domain = domain_list(); domain; domain = domain->next) {
2514                 struct winbind_cache *cache = get_cache(domain);
2515
2516                 DEBUG(10, ("wcache_invalidate_cache: invalidating cache "
2517                            "entries for %s\n", domain->name));
2518                 if (cache) {
2519                         if (cache->tdb) {
2520                                 tdb_traverse(cache->tdb, traverse_fn, NULL);
2521                         } else {
2522                                 return false;
2523                         }
2524                 }
2525         }
2526         return true;
2527 }
2528
2529 bool init_wcache(void)
2530 {
2531         if (wcache == NULL) {
2532                 wcache = SMB_XMALLOC_P(struct winbind_cache);
2533                 ZERO_STRUCTP(wcache);
2534         }
2535
2536         if (wcache->tdb != NULL)
2537                 return true;
2538
2539         /* when working offline we must not clear the cache on restart */
2540         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2541                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2542                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2543                                 O_RDWR|O_CREAT, 0600);
2544
2545         if (wcache->tdb == NULL) {
2546                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2547                 return false;
2548         }
2549
2550         return true;
2551 }
2552
2553 /************************************************************************
2554  This is called by the parent to initialize the cache file.
2555  We don't need sophisticated locking here as we know we're the
2556  only opener.
2557 ************************************************************************/
2558
2559 bool initialize_winbindd_cache(void)
2560 {
2561         bool cache_bad = true;
2562         uint32 vers;
2563
2564         if (!init_wcache()) {
2565                 DEBUG(0,("initialize_winbindd_cache: init_wcache failed.\n"));
2566                 return false;
2567         }
2568
2569         /* Check version number. */
2570         if (tdb_fetch_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, &vers) &&
2571                         vers == WINBINDD_CACHE_VERSION) {
2572                 cache_bad = false;
2573         }
2574
2575         if (cache_bad) {
2576                 DEBUG(0,("initialize_winbindd_cache: clearing cache "
2577                         "and re-creating with version number %d\n",
2578                         WINBINDD_CACHE_VERSION ));
2579
2580                 tdb_close(wcache->tdb);
2581                 wcache->tdb = NULL;
2582
2583                 if (unlink(cache_path("winbindd_cache.tdb")) == -1) {
2584                         DEBUG(0,("initialize_winbindd_cache: unlink %s failed %s ",
2585                                 cache_path("winbindd_cache.tdb"),
2586                                 strerror(errno) ));
2587                         return false;
2588                 }
2589                 if (!init_wcache()) {
2590                         DEBUG(0,("initialize_winbindd_cache: re-initialization "
2591                                         "init_wcache failed.\n"));
2592                         return false;
2593                 }
2594
2595                 /* Write the version. */
2596                 if (!tdb_store_uint32(wcache->tdb, WINBINDD_CACHE_VERSION_KEYSTR, WINBINDD_CACHE_VERSION)) {
2597                         DEBUG(0,("initialize_winbindd_cache: version number store failed %s\n",
2598                                 tdb_errorstr(wcache->tdb) ));
2599                         return false;
2600                 }
2601         }
2602
2603         tdb_close(wcache->tdb);
2604         wcache->tdb = NULL;
2605         return true;
2606 }
2607
2608 void close_winbindd_cache(void)
2609 {
2610         if (!wcache) {
2611                 return;
2612         }
2613         if (wcache->tdb) {
2614                 tdb_close(wcache->tdb);
2615                 wcache->tdb = NULL;
2616         }
2617 }
2618
2619 void cache_store_response(pid_t pid, struct winbindd_response *response)
2620 {
2621         fstring key_str;
2622
2623         if (!init_wcache())
2624                 return;
2625
2626         DEBUG(10, ("Storing response for pid %d, len %d\n",
2627                    (int)pid, response->length));
2628
2629         fstr_sprintf(key_str, "DR/%d", (int)pid);
2630         if (tdb_store(wcache->tdb, string_tdb_data(key_str),
2631                       make_tdb_data((uint8 *)response, sizeof(*response)),
2632                       TDB_REPLACE) == -1)
2633                 return;
2634
2635         if (response->length == sizeof(*response))
2636                 return;
2637
2638         /* There's extra data */
2639
2640         DEBUG(10, ("Storing extra data: len=%d\n",
2641                    (int)(response->length - sizeof(*response))));
2642
2643         fstr_sprintf(key_str, "DE/%d", (int)pid);
2644         if (tdb_store(wcache->tdb, string_tdb_data(key_str),
2645                       make_tdb_data((uint8 *)response->extra_data.data,
2646                                     response->length - sizeof(*response)),
2647                       TDB_REPLACE) == 0)
2648                 return;
2649
2650         /* We could not store the extra data, make sure the tdb does not
2651          * contain a main record with wrong dangling extra data */
2652
2653         fstr_sprintf(key_str, "DR/%d", (int)pid);
2654         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2655
2656         return;
2657 }
2658
2659 bool cache_retrieve_response(pid_t pid, struct winbindd_response * response)
2660 {
2661         TDB_DATA data;
2662         fstring key_str;
2663
2664         if (!init_wcache())
2665                 return false;
2666
2667         DEBUG(10, ("Retrieving response for pid %d\n", (int)pid));
2668
2669         fstr_sprintf(key_str, "DR/%d", (int)pid);
2670         data = tdb_fetch(wcache->tdb, string_tdb_data(key_str));
2671
2672         if (data.dptr == NULL)
2673                 return false;
2674
2675         if (data.dsize != sizeof(*response))
2676                 return false;
2677
2678         memcpy(response, data.dptr, data.dsize);
2679         SAFE_FREE(data.dptr);
2680
2681         if (response->length == sizeof(*response)) {
2682                 response->extra_data.data = NULL;
2683                 return true;
2684         }
2685
2686         /* There's extra data */
2687
2688         DEBUG(10, ("Retrieving extra data length=%d\n",
2689                    (int)(response->length - sizeof(*response))));
2690
2691         fstr_sprintf(key_str, "DE/%d", (int)pid);
2692         data = tdb_fetch(wcache->tdb, string_tdb_data(key_str));
2693
2694         if (data.dptr == NULL) {
2695                 DEBUG(0, ("Did not find extra data\n"));
2696                 return false;
2697         }
2698
2699         if (data.dsize != (response->length - sizeof(*response))) {
2700                 DEBUG(0, ("Invalid extra data length: %d\n", (int)data.dsize));
2701                 SAFE_FREE(data.dptr);
2702                 return false;
2703         }
2704
2705         dump_data(11, (uint8 *)data.dptr, data.dsize);
2706
2707         response->extra_data.data = data.dptr;
2708         return true;
2709 }
2710
2711 void cache_cleanup_response(pid_t pid)
2712 {
2713         fstring key_str;
2714
2715         if (!init_wcache())
2716                 return;
2717
2718         fstr_sprintf(key_str, "DR/%d", (int)pid);
2719         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2720
2721         fstr_sprintf(key_str, "DE/%d", (int)pid);
2722         tdb_delete(wcache->tdb, string_tdb_data(key_str));
2723
2724         return;
2725 }
2726
2727
2728 bool lookup_cached_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
2729                        char **domain_name, char **name,
2730                        enum lsa_SidType *type)
2731 {
2732         struct winbindd_domain *domain;
2733         struct winbind_cache *cache;
2734         struct cache_entry *centry = NULL;
2735         NTSTATUS status;
2736         fstring tmp;
2737
2738         domain = find_lookup_domain_from_sid(sid);
2739         if (domain == NULL) {
2740                 return false;
2741         }
2742
2743         cache = get_cache(domain);
2744
2745         if (cache->tdb == NULL) {
2746                 return false;
2747         }
2748
2749         centry = wcache_fetch(cache, domain, "SN/%s",
2750                               sid_to_fstring(tmp, sid));
2751         if (centry == NULL) {
2752                 return false;
2753         }
2754
2755         if (NT_STATUS_IS_OK(centry->status)) {
2756                 *type = (enum lsa_SidType)centry_uint32(centry);
2757                 *domain_name = centry_string(centry, mem_ctx);
2758                 *name = centry_string(centry, mem_ctx);
2759         }
2760
2761         status = centry->status;
2762         centry_free(centry);
2763         return NT_STATUS_IS_OK(status);
2764 }
2765
2766 bool lookup_cached_name(TALLOC_CTX *mem_ctx,
2767                         const char *domain_name,
2768                         const char *name,
2769                         DOM_SID *sid,
2770                         enum lsa_SidType *type)
2771 {
2772         struct winbindd_domain *domain;
2773         struct winbind_cache *cache;
2774         struct cache_entry *centry = NULL;
2775         NTSTATUS status;
2776         fstring uname;
2777         bool original_online_state;
2778
2779         domain = find_lookup_domain_from_name(domain_name);
2780         if (domain == NULL) {
2781                 return false;
2782         }
2783
2784         cache = get_cache(domain);
2785
2786         if (cache->tdb == NULL) {
2787                 return false;
2788         }
2789
2790         fstrcpy(uname, name);
2791         strupper_m(uname);
2792
2793         /* If we are doing a cached logon, temporarily set the domain
2794            offline so the cache won't expire the entry */
2795
2796         original_online_state = domain->online;
2797         domain->online = false;
2798         centry = wcache_fetch(cache, domain, "NS/%s/%s", domain_name, uname);
2799         domain->online = original_online_state;
2800
2801         if (centry == NULL) {
2802                 return false;
2803         }
2804
2805         if (NT_STATUS_IS_OK(centry->status)) {
2806                 *type = (enum lsa_SidType)centry_uint32(centry);
2807                 centry_sid(centry, mem_ctx, sid);
2808         }
2809
2810         status = centry->status;
2811         centry_free(centry);
2812
2813         return NT_STATUS_IS_OK(status);
2814 }
2815
2816 void cache_name2sid(struct winbindd_domain *domain,
2817                     const char *domain_name, const char *name,
2818                     enum lsa_SidType type, const DOM_SID *sid)
2819 {
2820         refresh_sequence_number(domain, false);
2821         wcache_save_name_to_sid(domain, NT_STATUS_OK, domain_name, name,
2822                                 sid, type);
2823 }
2824
2825 /*
2826  * The original idea that this cache only contains centries has
2827  * been blurred - now other stuff gets put in here. Ensure we
2828  * ignore these things on cleanup.
2829  */
2830
2831 static int traverse_fn_cleanup(TDB_CONTEXT *the_tdb, TDB_DATA kbuf,
2832                                TDB_DATA dbuf, void *state)
2833 {
2834         struct cache_entry *centry;
2835
2836         if (is_non_centry_key(kbuf)) {
2837                 return 0;
2838         }
2839
2840         centry = wcache_fetch_raw((char *)kbuf.dptr);
2841         if (!centry) {
2842                 return 0;
2843         }
2844
2845         if (!NT_STATUS_IS_OK(centry->status)) {
2846                 DEBUG(10,("deleting centry %s\n", (const char *)kbuf.dptr));
2847                 tdb_delete(the_tdb, kbuf);
2848         }
2849
2850         centry_free(centry);
2851         return 0;
2852 }
2853
2854 /* flush the cache */
2855 void wcache_flush_cache(void)
2856 {
2857         if (!wcache)
2858                 return;
2859         if (wcache->tdb) {
2860                 tdb_close(wcache->tdb);
2861                 wcache->tdb = NULL;
2862         }
2863         if (!winbindd_use_cache()) {
2864                 return;
2865         }
2866
2867         /* when working offline we must not clear the cache on restart */
2868         wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"),
2869                                 WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
2870                                 lp_winbind_offline_logon() ? TDB_DEFAULT : (TDB_DEFAULT | TDB_CLEAR_IF_FIRST),
2871                                 O_RDWR|O_CREAT, 0600);
2872
2873         if (!wcache->tdb) {
2874                 DEBUG(0,("Failed to open winbindd_cache.tdb!\n"));
2875                 return;
2876         }
2877
2878         tdb_traverse(wcache->tdb, traverse_fn_cleanup, NULL);
2879
2880         DEBUG(10,("wcache_flush_cache success\n"));
2881 }
2882
2883 /* Count cached creds */
2884
2885 static int traverse_fn_cached_creds(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2886                                     void *state)
2887 {
2888         int *cred_count = (int*)state;
2889
2890         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2891                 (*cred_count)++;
2892         }
2893         return 0;
2894 }
2895
2896 NTSTATUS wcache_count_cached_creds(struct winbindd_domain *domain, int *count)
2897 {
2898         struct winbind_cache *cache = get_cache(domain);
2899
2900         *count = 0;
2901
2902         if (!cache->tdb) {
2903                 return NT_STATUS_INTERNAL_DB_ERROR;
2904         }
2905
2906         tdb_traverse(cache->tdb, traverse_fn_cached_creds, (void *)count);
2907
2908         return NT_STATUS_OK;
2909 }
2910
2911 struct cred_list {
2912         struct cred_list *prev, *next;
2913         TDB_DATA key;
2914         fstring name;
2915         time_t created;
2916 };
2917 static struct cred_list *wcache_cred_list;
2918
2919 static int traverse_fn_get_credlist(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf,
2920                                     void *state)
2921 {
2922         struct cred_list *cred;
2923
2924         if (strncmp((const char *)kbuf.dptr, "CRED/", 5) == 0) {
2925
2926                 cred = SMB_MALLOC_P(struct cred_list);
2927                 if (cred == NULL) {
2928                         DEBUG(0,("traverse_fn_remove_first_creds: failed to malloc new entry for list\n"));
2929                         return -1;
2930                 }
2931
2932                 ZERO_STRUCTP(cred);
2933
2934                 /* save a copy of the key */
2935
2936                 fstrcpy(cred->name, (const char *)kbuf.dptr);
2937                 DLIST_ADD(wcache_cred_list, cred);
2938         }
2939
2940         return 0;
2941 }
2942
2943 NTSTATUS wcache_remove_oldest_cached_creds(struct winbindd_domain *domain, const DOM_SID *sid)
2944 {
2945         struct winbind_cache *cache = get_cache(domain);
2946         NTSTATUS status;
2947         int ret;
2948         struct cred_list *cred, *oldest = NULL;
2949
2950         if (!cache->tdb) {
2951                 return NT_STATUS_INTERNAL_DB_ERROR;
2952         }
2953
2954         /* we possibly already have an entry */
2955         if (sid && NT_STATUS_IS_OK(wcache_cached_creds_exist(domain, sid))) {
2956
2957                 fstring key_str, tmp;
2958
2959                 DEBUG(11,("we already have an entry, deleting that\n"));
2960
2961                 fstr_sprintf(key_str, "CRED/%s", sid_to_fstring(tmp, sid));
2962
2963                 tdb_delete(cache->tdb, string_tdb_data(key_str));
2964
2965                 return NT_STATUS_OK;
2966         }
2967
2968         ret = tdb_traverse(cache->tdb, traverse_fn_get_credlist, NULL);
2969         if (ret == 0) {
2970                 return NT_STATUS_OK;
2971         } else if ((ret == -1) || (wcache_cred_list == NULL)) {
2972                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2973         }
2974
2975         ZERO_STRUCTP(oldest);
2976
2977         for (cred = wcache_cred_list; cred; cred = cred->next) {
2978
2979                 TDB_DATA data;
2980                 time_t t;
2981
2982                 data = tdb_fetch(cache->tdb, string_tdb_data(cred->name));
2983                 if (!data.dptr) {
2984                         DEBUG(10,("wcache_remove_oldest_cached_creds: entry for [%s] not found\n",
2985                                 cred->name));
2986                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2987                         goto done;
2988                 }
2989
2990                 t = IVAL(data.dptr, 0);
2991                 SAFE_FREE(data.dptr);
2992
2993                 if (!oldest) {
2994                         oldest = SMB_MALLOC_P(struct cred_list);
2995                         if (oldest == NULL) {
2996                                 status = NT_STATUS_NO_MEMORY;
2997                                 goto done;
2998                         }
2999
3000                         fstrcpy(oldest->name, cred->name);
3001                         oldest->created = t;
3002                         continue;
3003                 }
3004
3005                 if (t < oldest->created) {
3006                         fstrcpy(oldest->name, cred->name);
3007                         oldest->created = t;
3008                 }
3009         }
3010
3011         if (tdb_delete(cache->tdb, string_tdb_data(oldest->name)) == 0) {
3012                 status = NT_STATUS_OK;
3013         } else {
3014                 status = NT_STATUS_UNSUCCESSFUL;
3015         }
3016 done:
3017         SAFE_FREE(wcache_cred_list);
3018         SAFE_FREE(oldest);
3019
3020         return status;
3021 }
3022
3023 /* Change the global online/offline state. */
3024 bool set_global_winbindd_state_offline(void)
3025 {
3026         TDB_DATA data;
3027
3028         DEBUG(10,("set_global_winbindd_state_offline: offline requested.\n"));
3029
3030         /* Only go offline if someone has created
3031            the key "WINBINDD_OFFLINE" in the cache tdb. */
3032
3033         if (wcache == NULL || wcache->tdb == NULL) {
3034                 DEBUG(10,("set_global_winbindd_state_offline: wcache not open yet.\n"));
3035                 return false;
3036         }
3037
3038         if (!lp_winbind_offline_logon()) {
3039                 DEBUG(10,("set_global_winbindd_state_offline: rejecting.\n"));
3040                 return false;
3041         }
3042
3043         if (global_winbindd_offline_state) {
3044                 /* Already offline. */
3045                 return true;
3046         }
3047
3048         data = tdb_fetch_bystring( wcache->tdb, "WINBINDD_OFFLINE" );
3049
3050         if (!data.dptr || data.dsize != 4) {
3051                 DEBUG(10,("set_global_winbindd_state_offline: offline state not set.\n"));
3052                 SAFE_FREE(data.dptr);
3053                 return false;
3054         } else {
3055                 DEBUG(10,("set_global_winbindd_state_offline: offline state set.\n"));
3056                 global_winbindd_offline_state = true;
3057                 SAFE_FREE(data.dptr);
3058                 return true;
3059         }
3060 }
3061
3062 void set_global_winbindd_state_online(void)
3063 {
3064         DEBUG(10,("set_global_winbindd_state_online: online requested.\n"));
3065
3066         if (!lp_winbind_offline_logon()) {
3067                 DEBUG(10,("set_global_winbindd_state_online: rejecting.\n"));
3068                 return;
3069         }
3070
3071         if (!global_winbindd_offline_state) {
3072                 /* Already online. */
3073                 return;
3074         }
3075         global_winbindd_offline_state = false;
3076
3077         if (!wcache->tdb) {
3078                 return;
3079         }
3080
3081         /* Ensure there is no key "WINBINDD_OFFLINE" in the cache tdb. */
3082         tdb_delete_bystring(wcache->tdb, "WINBINDD_OFFLINE");
3083 }
3084
3085 bool get_global_winbindd_state_offline(void)
3086 {
3087         return global_winbindd_offline_state;
3088 }
3089
3090 /***********************************************************************
3091  Validate functions for all possible cache tdb keys.
3092 ***********************************************************************/
3093
3094 static struct cache_entry *create_centry_validate(const char *kstr, TDB_DATA data,
3095                                                   struct tdb_validation_status *state)
3096 {
3097         struct cache_entry *centry;
3098
3099         centry = SMB_XMALLOC_P(struct cache_entry);
3100         centry->data = (unsigned char *)memdup(data.dptr, data.dsize);
3101         if (!centry->data) {
3102                 SAFE_FREE(centry);
3103                 return NULL;
3104         }
3105         centry->len = data.dsize;
3106         centry->ofs = 0;
3107
3108         if (centry->len < 8) {
3109                 /* huh? corrupt cache? */
3110                 DEBUG(0,("create_centry_validate: Corrupt cache for key %s (len < 8) ?\n", kstr));
3111                 centry_free(centry);
3112                 state->bad_entry = true;
3113                 state->success = false;
3114                 return NULL;
3115         }
3116
3117         centry->status = NT_STATUS(centry_uint32(centry));
3118         centry->sequence_number = centry_uint32(centry);
3119         return centry;
3120 }
3121
3122 static int validate_seqnum(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3123                            struct tdb_validation_status *state)
3124 {
3125         if (dbuf.dsize != 8) {
3126                 DEBUG(0,("validate_seqnum: Corrupt cache for key %s (len %u != 8) ?\n",
3127                                 keystr, (unsigned int)dbuf.dsize ));
3128                 state->bad_entry = true;
3129                 return 1;
3130         }
3131         return 0;
3132 }
3133
3134 static int validate_ns(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3135                        struct tdb_validation_status *state)
3136 {
3137         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3138         if (!centry) {
3139                 return 1;
3140         }
3141
3142         (void)centry_uint32(centry);
3143         if (NT_STATUS_IS_OK(centry->status)) {
3144                 DOM_SID sid;
3145                 (void)centry_sid(centry, mem_ctx, &sid);
3146         }
3147
3148         centry_free(centry);
3149
3150         if (!(state->success)) {
3151                 return 1;
3152         }
3153         DEBUG(10,("validate_ns: %s ok\n", keystr));
3154         return 0;
3155 }
3156
3157 static int validate_sn(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3158                        struct tdb_validation_status *state)
3159 {
3160         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3161         if (!centry) {
3162                 return 1;
3163         }
3164
3165         if (NT_STATUS_IS_OK(centry->status)) {
3166                 (void)centry_uint32(centry);
3167                 (void)centry_string(centry, mem_ctx);
3168                 (void)centry_string(centry, mem_ctx);
3169         }
3170
3171         centry_free(centry);
3172
3173         if (!(state->success)) {
3174                 return 1;
3175         }
3176         DEBUG(10,("validate_sn: %s ok\n", keystr));
3177         return 0;
3178 }
3179
3180 static int validate_u(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3181                       struct tdb_validation_status *state)
3182 {
3183         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3184         DOM_SID sid;
3185
3186         if (!centry) {
3187                 return 1;
3188         }
3189
3190         (void)centry_string(centry, mem_ctx);
3191         (void)centry_string(centry, mem_ctx);
3192         (void)centry_string(centry, mem_ctx);
3193         (void)centry_string(centry, mem_ctx);
3194         (void)centry_uint32(centry);
3195         (void)centry_sid(centry, mem_ctx, &sid);
3196         (void)centry_sid(centry, mem_ctx, &sid);
3197
3198         centry_free(centry);
3199
3200         if (!(state->success)) {
3201                 return 1;
3202         }
3203         DEBUG(10,("validate_u: %s ok\n", keystr));
3204         return 0;
3205 }
3206
3207 static int validate_loc_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3208                             struct tdb_validation_status *state)
3209 {
3210         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3211
3212         if (!centry) {
3213                 return 1;
3214         }
3215
3216         (void)centry_nttime(centry);
3217         (void)centry_nttime(centry);
3218         (void)centry_uint16(centry);
3219
3220         centry_free(centry);
3221
3222         if (!(state->success)) {
3223                 return 1;
3224         }
3225         DEBUG(10,("validate_loc_pol: %s ok\n", keystr));
3226         return 0;
3227 }
3228
3229 static int validate_pwd_pol(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3230                             struct tdb_validation_status *state)
3231 {
3232         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3233
3234         if (!centry) {
3235                 return 1;
3236         }
3237
3238         (void)centry_uint16(centry);
3239         (void)centry_uint16(centry);
3240         (void)centry_uint32(centry);
3241         (void)centry_nttime(centry);
3242         (void)centry_nttime(centry);
3243
3244         centry_free(centry);
3245
3246         if (!(state->success)) {
3247                 return 1;
3248         }
3249         DEBUG(10,("validate_pwd_pol: %s ok\n", keystr));
3250         return 0;
3251 }
3252
3253 static int validate_cred(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3254                          struct tdb_validation_status *state)
3255 {
3256         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3257
3258         if (!centry) {
3259                 return 1;
3260         }
3261
3262         (void)centry_time(centry);
3263         (void)centry_hash16(centry, mem_ctx);
3264
3265         /* We only have 17 bytes more data in the salted cred case. */
3266         if (centry->len - centry->ofs == 17) {
3267                 (void)centry_hash16(centry, mem_ctx);
3268         }
3269
3270         centry_free(centry);
3271
3272         if (!(state->success)) {
3273                 return 1;
3274         }
3275         DEBUG(10,("validate_cred: %s ok\n", keystr));
3276         return 0;
3277 }
3278
3279 static int validate_ul(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3280                        struct tdb_validation_status *state)
3281 {
3282         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3283         int32 num_entries, i;
3284
3285         if (!centry) {
3286                 return 1;
3287         }
3288
3289         num_entries = (int32)centry_uint32(centry);
3290
3291         for (i=0; i< num_entries; i++) {
3292                 DOM_SID sid;
3293                 (void)centry_string(centry, mem_ctx);
3294                 (void)centry_string(centry, mem_ctx);
3295                 (void)centry_string(centry, mem_ctx);
3296                 (void)centry_string(centry, mem_ctx);
3297                 (void)centry_sid(centry, mem_ctx, &sid);
3298                 (void)centry_sid(centry, mem_ctx, &sid);
3299         }
3300
3301         centry_free(centry);
3302
3303         if (!(state->success)) {
3304                 return 1;
3305         }
3306         DEBUG(10,("validate_ul: %s ok\n", keystr));
3307         return 0;
3308 }
3309
3310 static int validate_gl(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3311                        struct tdb_validation_status *state)
3312 {
3313         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3314         int32 num_entries, i;
3315
3316         if (!centry) {
3317                 return 1;
3318         }
3319
3320         num_entries = centry_uint32(centry);
3321
3322         for (i=0; i< num_entries; i++) {
3323                 (void)centry_string(centry, mem_ctx);
3324                 (void)centry_string(centry, mem_ctx);
3325                 (void)centry_uint32(centry);
3326         }
3327
3328         centry_free(centry);
3329
3330         if (!(state->success)) {
3331                 return 1;
3332         }
3333         DEBUG(10,("validate_gl: %s ok\n", keystr));
3334         return 0;
3335 }
3336
3337 static int validate_ug(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3338                        struct tdb_validation_status *state)
3339 {
3340         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3341         int32 num_groups, i;
3342
3343         if (!centry) {
3344                 return 1;
3345         }
3346
3347         num_groups = centry_uint32(centry);
3348
3349         for (i=0; i< num_groups; i++) {
3350                 DOM_SID sid;
3351                 centry_sid(centry, mem_ctx, &sid);
3352         }
3353
3354         centry_free(centry);
3355
3356         if (!(state->success)) {
3357                 return 1;
3358         }
3359         DEBUG(10,("validate_ug: %s ok\n", keystr));
3360         return 0;
3361 }
3362
3363 static int validate_ua(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3364                        struct tdb_validation_status *state)
3365 {
3366         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3367         int32 num_aliases, i;
3368
3369         if (!centry) {
3370                 return 1;
3371         }
3372
3373         num_aliases = centry_uint32(centry);
3374
3375         for (i=0; i < num_aliases; i++) {
3376                 (void)centry_uint32(centry);
3377         }
3378
3379         centry_free(centry);
3380
3381         if (!(state->success)) {
3382                 return 1;
3383         }
3384         DEBUG(10,("validate_ua: %s ok\n", keystr));
3385         return 0;
3386 }
3387
3388 static int validate_gm(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3389                        struct tdb_validation_status *state)
3390 {
3391         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3392         int32 num_names, i;
3393
3394         if (!centry) {
3395                 return 1;
3396         }
3397
3398         num_names = centry_uint32(centry);
3399
3400         for (i=0; i< num_names; i++) {
3401                 DOM_SID sid;
3402                 centry_sid(centry, mem_ctx, &sid);
3403                 (void)centry_string(centry, mem_ctx);
3404                 (void)centry_uint32(centry);
3405         }
3406
3407         centry_free(centry);
3408
3409         if (!(state->success)) {
3410                 return 1;
3411         }
3412         DEBUG(10,("validate_gm: %s ok\n", keystr));
3413         return 0;
3414 }
3415
3416 static int validate_dr(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3417                        struct tdb_validation_status *state)
3418 {
3419         /* Can't say anything about this other than must be nonzero. */
3420         if (dbuf.dsize == 0) {
3421                 DEBUG(0,("validate_dr: Corrupt cache for key %s (len == 0) ?\n",
3422                                 keystr));
3423                 state->bad_entry = true;
3424                 state->success = false;
3425                 return 1;
3426         }
3427
3428         DEBUG(10,("validate_dr: %s ok\n", keystr));
3429         return 0;
3430 }
3431
3432 static int validate_de(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3433                        struct tdb_validation_status *state)
3434 {
3435         /* Can't say anything about this other than must be nonzero. */
3436         if (dbuf.dsize == 0) {
3437                 DEBUG(0,("validate_de: Corrupt cache for key %s (len == 0) ?\n",
3438                                 keystr));
3439                 state->bad_entry = true;
3440                 state->success = false;
3441                 return 1;
3442         }
3443
3444         DEBUG(10,("validate_de: %s ok\n", keystr));
3445         return 0;
3446 }
3447
3448 static int validate_pwinfo(TALLOC_CTX *mem_ctx, const char *keystr,
3449                            TDB_DATA dbuf, struct tdb_validation_status *state)
3450 {
3451         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3452
3453         if (!centry) {
3454                 return 1;
3455         }
3456
3457         (void)centry_string(centry, mem_ctx);
3458         (void)centry_string(centry, mem_ctx);
3459         (void)centry_string(centry, mem_ctx);
3460         (void)centry_uint32(centry);
3461
3462         centry_free(centry);
3463
3464         if (!(state->success)) {
3465                 return 1;
3466         }
3467         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3468         return 0;
3469 }
3470
3471 static int validate_nss_an(TALLOC_CTX *mem_ctx, const char *keystr,
3472                            TDB_DATA dbuf,
3473                            struct tdb_validation_status *state)
3474 {
3475         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3476
3477         if (!centry) {
3478                 return 1;
3479         }
3480
3481         (void)centry_string( centry, mem_ctx );
3482
3483         centry_free(centry);
3484
3485         if (!(state->success)) {
3486                 return 1;
3487         }
3488         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3489         return 0;
3490 }
3491
3492 static int validate_nss_na(TALLOC_CTX *mem_ctx, const char *keystr,
3493                            TDB_DATA dbuf,
3494                            struct tdb_validation_status *state)
3495 {
3496         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3497
3498         if (!centry) {
3499                 return 1;
3500         }
3501
3502         (void)centry_string( centry, mem_ctx );
3503
3504         centry_free(centry);
3505
3506         if (!(state->success)) {
3507                 return 1;
3508         }
3509         DEBUG(10,("validate_pwinfo: %s ok\n", keystr));
3510         return 0;
3511 }
3512
3513 static int validate_trustdoms(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3514                               struct tdb_validation_status *state)
3515 {
3516         struct cache_entry *centry = create_centry_validate(keystr, dbuf, state);
3517         int32 num_domains, i;
3518
3519         if (!centry) {
3520                 return 1;
3521         }
3522
3523         num_domains = centry_uint32(centry);
3524
3525         for (i=0; i< num_domains; i++) {
3526                 DOM_SID sid;
3527                 (void)centry_string(centry, mem_ctx);
3528                 (void)centry_string(centry, mem_ctx);
3529                 (void)centry_sid(centry, mem_ctx, &sid);
3530         }
3531
3532         centry_free(centry);
3533
3534         if (!(state->success)) {
3535                 return 1;
3536         }
3537         DEBUG(10,("validate_trustdoms: %s ok\n", keystr));
3538         return 0;
3539 }
3540
3541 static int validate_trustdomcache(TALLOC_CTX *mem_ctx, const char *keystr,
3542                                   TDB_DATA dbuf,
3543                                   struct tdb_validation_status *state)
3544 {
3545         if (dbuf.dsize == 0) {
3546                 DEBUG(0, ("validate_trustdomcache: Corrupt cache for "
3547                           "key %s (len ==0) ?\n", keystr));
3548                 state->bad_entry = true;
3549                 state->success = false;
3550                 return 1;
3551         }
3552
3553         DEBUG(10,    ("validate_trustdomcache: %s ok\n", keystr));
3554         DEBUGADD(10, ("  Don't trust me, I am a DUMMY!\n"));
3555         return 0;
3556 }
3557
3558 static int validate_offline(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3559                             struct tdb_validation_status *state)
3560 {
3561         if (dbuf.dsize != 4) {
3562                 DEBUG(0,("validate_offline: Corrupt cache for key %s (len %u != 4) ?\n",
3563                                 keystr, (unsigned int)dbuf.dsize ));
3564                 state->bad_entry = true;
3565                 state->success = false;
3566                 return 1;
3567         }
3568         DEBUG(10,("validate_offline: %s ok\n", keystr));
3569         return 0;
3570 }
3571
3572 static int validate_cache_version(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf,
3573                                   struct tdb_validation_status *state)
3574 {
3575         if (dbuf.dsize != 4) {
3576                 DEBUG(0, ("validate_cache_version: Corrupt cache for "
3577                           "key %s (len %u != 4) ?\n",
3578                           keystr, (unsigned int)dbuf.dsize));
3579                 state->bad_entry = true;
3580                 state->success = false;
3581                 return 1;
3582         }
3583
3584         DEBUG(10, ("validate_cache_version: %s ok\n", keystr));
3585         return 0;
3586 }
3587
3588 /***********************************************************************
3589  A list of all possible cache tdb keys with associated validation
3590  functions.
3591 ***********************************************************************/
3592
3593 struct key_val_struct {
3594         const char *keyname;
3595         int (*validate_data_fn)(TALLOC_CTX *mem_ctx, const char *keystr, TDB_DATA dbuf, struct tdb_validation_status* state);
3596 } key_val[] = {
3597         {"SEQNUM/", validate_seqnum},
3598         {"NS/", validate_ns},
3599         {"SN/", validate_sn},
3600         {"U/", validate_u},
3601         {"LOC_POL/", validate_loc_pol},
3602         {"PWD_POL/", validate_pwd_pol},
3603         {"CRED/", validate_cred},
3604         {"UL/", validate_ul},
3605         {"GL/", validate_gl},
3606         {"UG/", validate_ug},
3607         {"UA", validate_ua},
3608         {"GM/", validate_gm},
3609         {"DR/", validate_dr},
3610         {"DE/", validate_de},
3611         {"NSS/PWINFO/", validate_pwinfo},
3612         {"TRUSTDOMS/", validate_trustdoms},
3613         {"TRUSTDOMCACHE/", validate_trustdomcache},
3614         {"NSS/NA/", validate_nss_na},
3615         {"NSS/AN/", validate_nss_an},
3616         {"WINBINDD_OFFLINE", validate_offline},
3617         {WINBINDD_CACHE_VERSION_KEYSTR, validate_cache_version},
3618         {NULL, NULL}
3619 };
3620
3621 /***********************************************************************
3622  Function to look at every entry in the tdb and validate it as far as
3623  possible.
3624 ***********************************************************************/
3625
3626 static int cache_traverse_validate_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, void *state)
3627 {
3628         int i;
3629         unsigned int max_key_len = 1024;
3630         struct tdb_validation_status *v_state = (struct tdb_validation_status *)state;
3631
3632         /* Paranoia check. */
3633         if (strncmp("UA/", (const char *)kbuf.dptr, 3) == 0) {
3634                 max_key_len = 1024 * 1024;
3635         }
3636         if (kbuf.dsize > max_key_len) {
3637                 DEBUG(0, ("cache_traverse_validate_fn: key length too large: "
3638                           "(%u) > (%u)\n\n",
3639                           (unsigned int)kbuf.dsize, (unsigned int)max_key_len));
3640                 return 1;
3641         }
3642
3643         for (i = 0; key_val[i].keyname; i++) {
3644                 size_t namelen = strlen(key_val[i].keyname);
3645                 if (kbuf.dsize >= namelen && (
3646                                 strncmp(key_val[i].keyname, (const char *)kbuf.dptr, namelen)) == 0) {
3647                         TALLOC_CTX *mem_ctx;
3648                         char *keystr;
3649                         int ret;
3650
3651                         keystr = SMB_MALLOC_ARRAY(char, kbuf.dsize+1);
3652                         if (!keystr) {
3653                                 return 1;
3654                         }
3655                         memcpy(keystr, kbuf.dptr, kbuf.dsize);
3656                         keystr[kbuf.dsize] = '\0';
3657
3658                         mem_ctx = talloc_init("validate_ctx");
3659                         if (!mem_ctx) {
3660                                 SAFE_FREE(keystr);
3661                                 return 1;
3662                         }
3663
3664                         ret = key_val[i].validate_data_fn(mem_ctx, keystr, dbuf,
3665                                                           v_state);
3666
3667                         SAFE_FREE(keystr);
3668                         talloc_destroy(mem_ctx);
3669                         return ret;
3670                 }
3671         }
3672
3673         DEBUG(0,("cache_traverse_validate_fn: unknown cache entry\nkey :\n"));
3674         dump_data(0, (uint8 *)kbuf.dptr, kbuf.dsize);
3675         DEBUG(0,("data :\n"));
3676         dump_data(0, (uint8 *)dbuf.dptr, dbuf.dsize);
3677         v_state->unknown_key = true;
3678         v_state->success = false;
3679         return 1; /* terminate. */
3680 }
3681
3682 static void validate_panic(const char *const why)
3683 {
3684         DEBUG(0,("validating cache: would panic %s\n", why ));
3685         DEBUGADD(0, ("exiting instead (cache validation mode)\n"));
3686         exit(47);
3687 }
3688
3689 /***********************************************************************
3690  Try and validate every entry in the winbindd cache. If we fail here,
3691  delete the cache tdb and return non-zero.
3692 ***********************************************************************/
3693
3694 int winbindd_validate_cache(void)
3695 {
3696         int ret = -1;
3697         const char *tdb_path = cache_path("winbindd_cache.tdb");
3698         TDB_CONTEXT *tdb = NULL;
3699
3700         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3701         smb_panic_fn = validate_panic;
3702
3703
3704         tdb = tdb_open_log(tdb_path,
3705                            WINBINDD_CACHE_TDB_DEFAULT_HASH_SIZE,
3706                            ( lp_winbind_offline_logon()
3707                              ? TDB_DEFAULT
3708                              : TDB_DEFAULT | TDB_CLEAR_IF_FIRST ),
3709                            O_RDWR|O_CREAT,
3710                            0600);
3711         if (!tdb) {
3712                 DEBUG(0, ("winbindd_validate_cache: "
3713                           "error opening/initializing tdb\n"));
3714                 goto done;
3715         }
3716         tdb_close(tdb);
3717
3718         ret = tdb_validate_and_backup(tdb_path, cache_traverse_validate_fn);
3719
3720         if (ret != 0) {
3721                 DEBUG(10, ("winbindd_validate_cache: validation not successful.\n"));
3722                 DEBUGADD(10, ("removing tdb %s.\n", tdb_path));
3723                 unlink(tdb_path);
3724         }
3725
3726 done:
3727         DEBUG(10, ("winbindd_validate_cache: restoring panic function\n"));
3728         smb_panic_fn = smb_panic;
3729         return ret;
3730 }
3731
3732 /***********************************************************************
3733  Try and validate every entry in the winbindd cache.
3734 ***********************************************************************/
3735
3736 int winbindd_validate_cache_nobackup(void)
3737 {
3738         int ret = -1;
3739         const char *tdb_path = cache_path("winbindd_cache.tdb");
3740
3741         DEBUG(10, ("winbindd_validate_cache: replacing panic function\n"));
3742         smb_panic_fn = validate_panic;
3743
3744
3745         if (wcache == NULL || wcache->tdb == NULL) {
3746                 ret = tdb_validate_open(tdb_path, cache_traverse_validate_fn);
3747         } else {
3748                 ret = tdb_validate(wcache->tdb, cache_traverse_validate_fn);
3749         }
3750
3751         if (ret != 0) {
3752                 DEBUG(10, ("winbindd_validate_cache_nobackup: validation not "
3753                            "successful.\n"));
3754         }
3755
3756         DEBUG(10, ("winbindd_validate_cache_nobackup: restoring panic "
3757                    "function\n"));
3758         smb_panic_fn = smb_panic;
3759         return ret;
3760 }
3761
3762 bool winbindd_cache_validate_and_initialize(void)
3763 {
3764         close_winbindd_cache();
3765
3766         if (lp_winbind_offline_logon()) {
3767                 if (winbindd_validate_cache() < 0) {
3768                         DEBUG(0, ("winbindd cache tdb corrupt and no backup "
3769                                   "could be restored.\n"));
3770                 }
3771         }
3772
3773         return initialize_winbindd_cache();
3774 }
3775
3776 /*********************************************************************
3777  ********************************************************************/
3778
3779 static bool add_wbdomain_to_tdc_array( struct winbindd_domain *new_dom,
3780                                        struct winbindd_tdc_domain **domains,
3781                                        size_t *num_domains )
3782 {
3783         struct winbindd_tdc_domain *list = NULL;
3784         size_t idx;
3785         int i;
3786         bool set_only = false;
3787
3788         /* don't allow duplicates */
3789
3790         idx = *num_domains;
3791         list = *domains;
3792
3793         for ( i=0; i< (*num_domains); i++ ) {
3794                 if ( strequal( new_dom->name, list[i].domain_name ) ) {
3795                         DEBUG(10,("add_wbdomain_to_tdc_array: Found existing record for %s\n",
3796                                   new_dom->name));
3797                         idx = i;
3798                         set_only = true;
3799
3800                         break;
3801                 }
3802         }
3803
3804         if ( !set_only ) {
3805                 if ( !*domains ) {
3806                         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, 1 );
3807                         idx = 0;
3808                 } else {
3809                         list = TALLOC_REALLOC_ARRAY( *domains, *domains,
3810                                                      struct winbindd_tdc_domain,
3811                                                      (*num_domains)+1);
3812                         idx = *num_domains;
3813                 }
3814
3815                 ZERO_STRUCT( list[idx] );
3816         }
3817
3818         if ( !list )
3819                 return false;
3820
3821         list[idx].domain_name = talloc_strdup( list, new_dom->name );
3822         list[idx].dns_name = talloc_strdup( list, new_dom->alt_name );
3823
3824         if ( !is_null_sid( &new_dom->sid ) ) {
3825                 sid_copy( &list[idx].sid, &new_dom->sid );
3826         } else {
3827                 sid_copy(&list[idx].sid, &global_sid_NULL);
3828         }
3829
3830         if ( new_dom->domain_flags != 0x0 )
3831                 list[idx].trust_flags = new_dom->domain_flags;
3832
3833         if ( new_dom->domain_type != 0x0 )
3834                 list[idx].trust_type = new_dom->domain_type;
3835
3836         if ( new_dom->domain_trust_attribs != 0x0 )
3837                 list[idx].trust_attribs = new_dom->domain_trust_attribs;
3838
3839         if ( !set_only ) {
3840                 *domains = list;
3841                 *num_domains = idx + 1;
3842         }
3843
3844         return true;
3845 }
3846
3847 /*********************************************************************
3848  ********************************************************************/
3849
3850 static TDB_DATA make_tdc_key( const char *domain_name )
3851 {
3852         char *keystr = NULL;
3853         TDB_DATA key = { NULL, 0 };
3854
3855         if ( !domain_name ) {
3856                 DEBUG(5,("make_tdc_key: Keyname workgroup is NULL!\n"));
3857                 return key;
3858         }
3859
3860
3861         if (asprintf( &keystr, "TRUSTDOMCACHE/%s", domain_name ) == -1) {
3862                 return key;
3863         }
3864         key = string_term_tdb_data(keystr);
3865
3866         return key;
3867 }
3868
3869 /*********************************************************************
3870  ********************************************************************/
3871
3872 static int pack_tdc_domains( struct winbindd_tdc_domain *domains,
3873                              size_t num_domains,
3874                              unsigned char **buf )
3875 {
3876         unsigned char *buffer = NULL;
3877         int len = 0;
3878         int buflen = 0;
3879         int i = 0;
3880
3881         DEBUG(10,("pack_tdc_domains: Packing %d trusted domains\n",
3882                   (int)num_domains));
3883
3884         buflen = 0;
3885
3886  again:
3887         len = 0;
3888
3889         /* Store the number of array items first */
3890         len += tdb_pack( buffer+len, buflen-len, "d",
3891                          num_domains );
3892
3893         /* now pack each domain trust record */
3894         for ( i=0; i<num_domains; i++ ) {
3895
3896                 fstring tmp;
3897
3898                 if ( buflen > 0 ) {
3899                         DEBUG(10,("pack_tdc_domains: Packing domain %s (%s)\n",
3900                                   domains[i].domain_name,
3901                                   domains[i].dns_name ? domains[i].dns_name : "UNKNOWN" ));
3902                 }
3903
3904                 len += tdb_pack( buffer+len, buflen-len, "fffddd",
3905                                  domains[i].domain_name,
3906                                  domains[i].dns_name,
3907                                  sid_to_fstring(tmp, &domains[i].sid),
3908                                  domains[i].trust_flags,
3909                                  domains[i].trust_attribs,
3910                                  domains[i].trust_type );
3911         }
3912
3913         if ( buflen < len ) {
3914                 SAFE_FREE(buffer);
3915                 if ( (buffer = SMB_MALLOC_ARRAY(unsigned char, len)) == NULL ) {
3916                         DEBUG(0,("pack_tdc_domains: failed to alloc buffer!\n"));
3917                         buflen = -1;
3918                         goto done;
3919                 }
3920                 buflen = len;
3921                 goto again;
3922         }
3923
3924         *buf = buffer;
3925
3926  done:
3927         return buflen;
3928 }
3929
3930 /*********************************************************************
3931  ********************************************************************/
3932
3933 static size_t unpack_tdc_domains( unsigned char *buf, int buflen,
3934                                   struct winbindd_tdc_domain **domains )
3935 {
3936         fstring domain_name, dns_name, sid_string;
3937         uint32 type, attribs, flags;
3938         int num_domains;
3939         int len = 0;
3940         int i;
3941         struct winbindd_tdc_domain *list = NULL;
3942
3943         /* get the number of domains */
3944         len += tdb_unpack( buf+len, buflen-len, "d", &num_domains);
3945         if ( len == -1 ) {
3946                 DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3947                 return 0;
3948         }
3949
3950         list = TALLOC_ARRAY( NULL, struct winbindd_tdc_domain, num_domains );
3951         if ( !list ) {
3952                 DEBUG(0,("unpack_tdc_domains: Failed to talloc() domain list!\n"));
3953                 return 0;
3954         }
3955
3956         for ( i=0; i<num_domains; i++ ) {
3957                 len += tdb_unpack( buf+len, buflen-len, "fffddd",
3958                                    domain_name,
3959                                    dns_name,
3960                                    sid_string,
3961                                    &flags,
3962                                    &attribs,
3963                                    &type );
3964
3965                 if ( len == -1 ) {
3966                         DEBUG(5,("unpack_tdc_domains: Failed to unpack domain array\n"));
3967                         TALLOC_FREE( list );
3968                         return 0;
3969                 }
3970
3971                 DEBUG(11,("unpack_tdc_domains: Unpacking domain %s (%s) "
3972                           "SID %s, flags = 0x%x, attribs = 0x%x, type = 0x%x\n",
3973                           domain_name, dns_name, sid_string,
3974                           flags, attribs, type));
3975
3976                 list[i].domain_name = talloc_strdup( list, domain_name );
3977                 list[i].dns_name = talloc_strdup( list, dns_name );
3978                 if ( !string_to_sid( &(list[i].sid), sid_string ) ) {
3979                         DEBUG(10,("unpack_tdc_domains: no SID for domain %s\n",
3980                                   domain_name));
3981                 }
3982                 list[i].trust_flags = flags;
3983                 list[i].trust_attribs = attribs;
3984                 list[i].trust_type = type;
3985         }
3986
3987         *domains = list;
3988
3989         return num_domains;
3990 }
3991
3992 /*********************************************************************
3993  ********************************************************************/
3994
3995 static bool wcache_tdc_store_list( struct winbindd_tdc_domain *domains, size_t num_domains )
3996 {
3997         TDB_DATA key = make_tdc_key( lp_workgroup() );
3998         TDB_DATA data = { NULL, 0 };
3999         int ret;
4000
4001         if ( !key.dptr )
4002                 return false;
4003
4004         /* See if we were asked to delete the cache entry */
4005
4006         if ( !domains ) {
4007                 ret = tdb_delete( wcache->tdb, key );
4008                 goto done;
4009         }
4010
4011         data.dsize = pack_tdc_domains( domains, num_domains, &data.dptr );
4012
4013         if ( !data.dptr ) {
4014                 ret = -1;
4015                 goto done;
4016         }
4017
4018         ret = tdb_store( wcache->tdb, key, data, 0 );
4019
4020  done:
4021         SAFE_FREE( data.dptr );
4022         SAFE_FREE( key.dptr );
4023
4024         return ( ret != -1 );
4025 }
4026
4027 /*********************************************************************
4028  ********************************************************************/
4029
4030 bool wcache_tdc_fetch_list( struct winbindd_tdc_domain **domains, size_t *num_domains )
4031 {
4032         TDB_DATA key = make_tdc_key( lp_workgroup() );
4033         TDB_DATA data = { NULL, 0 };
4034
4035         *domains = NULL;
4036         *num_domains = 0;
4037
4038         if ( !key.dptr )
4039                 return false;
4040
4041         data = tdb_fetch( wcache->tdb, key );
4042
4043         SAFE_FREE( key.dptr );
4044
4045         if ( !data.dptr )
4046                 return false;
4047
4048         *num_domains = unpack_tdc_domains( data.dptr, data.dsize, domains );
4049
4050         SAFE_FREE( data.dptr );
4051
4052         if ( !*domains )
4053                 return false;
4054
4055         return true;
4056 }
4057
4058 /*********************************************************************
4059  ********************************************************************/
4060
4061 bool wcache_tdc_add_domain( struct winbindd_domain *domain )
4062 {
4063         struct winbindd_tdc_domain *dom_list = NULL;
4064         size_t num_domains = 0;
4065         bool ret = false;
4066
4067         DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
4068                   "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
4069                   domain->name, domain->alt_name,
4070                   sid_string_dbg(&domain->sid),
4071                   domain->domain_flags,
4072                   domain->domain_trust_attribs,
4073                   domain->domain_type));
4074
4075         if ( !init_wcache() ) {
4076                 return false;
4077         }
4078
4079         /* fetch the list */
4080
4081         wcache_tdc_fetch_list( &dom_list, &num_domains );
4082
4083         /* add the new domain */
4084
4085         if ( !add_wbdomain_to_tdc_array( domain, &dom_list, &num_domains ) ) {
4086                 goto done;
4087         }
4088
4089         /* pack the domain */
4090
4091         if ( !wcache_tdc_store_list( dom_list, num_domains ) ) {
4092                 goto done;
4093         }
4094
4095         /* Success */
4096
4097         ret = true;
4098  done:
4099         TALLOC_FREE( dom_list );
4100
4101         return ret;
4102 }
4103
4104 /*********************************************************************
4105  ********************************************************************/
4106
4107 struct winbindd_tdc_domain * wcache_tdc_fetch_domain( TALLOC_CTX *ctx, const char *name )
4108 {
4109         struct winbindd_tdc_domain *dom_list = NULL;
4110         size_t num_domains = 0;
4111         int i;
4112         struct winbindd_tdc_domain *d = NULL;
4113
4114         DEBUG(10,("wcache_tdc_fetch_domain: Searching for domain %s\n", name));
4115
4116         if ( !init_wcache() ) {
4117                 return false;
4118         }
4119
4120         /* fetch the list */
4121
4122         wcache_tdc_fetch_list( &dom_list, &num_domains );
4123
4124         for ( i=0; i<num_domains; i++ ) {
4125                 if ( strequal(name, dom_list[i].domain_name) ||
4126                      strequal(name, dom_list[i].dns_name) )
4127                 {
4128                         DEBUG(10,("wcache_tdc_fetch_domain: Found domain %s\n",
4129                                   name));
4130
4131                         d = TALLOC_P( ctx, struct winbindd_tdc_domain );
4132                         if ( !d )
4133                                 break;
4134
4135                         d->domain_name = talloc_strdup( d, dom_list[i].domain_name );
4136                         d->dns_name = talloc_strdup( d, dom_list[i].dns_name );
4137                         sid_copy( &d->sid, &dom_list[i].sid );
4138                         d->trust_flags   = dom_list[i].trust_flags;
4139                         d->trust_type    = dom_list[i].trust_type;
4140                         d->trust_attribs = dom_list[i].trust_attribs;
4141
4142                         break;
4143                 }
4144         }
4145
4146         TALLOC_FREE( dom_list );
4147
4148         return d;
4149 }
4150
4151
4152 /*********************************************************************
4153  ********************************************************************/
4154
4155 void wcache_tdc_clear( void )
4156 {
4157         if ( !init_wcache() )
4158                 return;
4159
4160         wcache_tdc_store_list( NULL, 0 );
4161
4162         return;
4163 }
4164
4165
4166 /*********************************************************************
4167  ********************************************************************/
4168
4169 static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
4170                                     NTSTATUS status,
4171                                     const DOM_SID *user_sid,
4172                                     const char *homedir,
4173                                     const char *shell,
4174                                     const char *gecos,
4175                                     uint32 gid)
4176 {
4177         struct cache_entry *centry;
4178         fstring tmp;
4179
4180         if ( (centry = centry_start(domain, status)) == NULL )
4181                 return;
4182
4183         centry_put_string( centry, homedir );
4184         centry_put_string( centry, shell );
4185         centry_put_string( centry, gecos );
4186         centry_put_uint32( centry, gid );
4187
4188         centry_end(centry, "NSS/PWINFO/%s", sid_to_fstring(tmp, user_sid) );
4189
4190         DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
4191
4192         centry_free(centry);
4193 }
4194
4195 NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
4196                               const DOM_SID *user_sid,
4197                               TALLOC_CTX *ctx,
4198                               ADS_STRUCT *ads, LDAPMessage *msg,
4199                               char **homedir, char **shell, char **gecos,
4200                               gid_t *p_gid)
4201 {
4202         struct winbind_cache *cache = get_cache(domain);
4203         struct cache_entry *centry = NULL;
4204         NTSTATUS nt_status;
4205         fstring tmp;
4206
4207         if (!cache->tdb)
4208                 goto do_query;
4209
4210         centry = wcache_fetch(cache, domain, "NSS/PWINFO/%s",
4211                               sid_to_fstring(tmp, user_sid));
4212
4213         if (!centry)
4214                 goto do_query;
4215
4216         *homedir = centry_string( centry, ctx );
4217         *shell   = centry_string( centry, ctx );
4218         *gecos   = centry_string( centry, ctx );
4219         *p_gid   = centry_uint32( centry );
4220
4221         centry_free(centry);
4222
4223         DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
4224                   sid_string_dbg(user_sid)));
4225
4226         return NT_STATUS_OK;
4227
4228 do_query:
4229
4230         nt_status = nss_get_info( domain->name, user_sid, ctx, ads, msg,
4231                                   homedir, shell, gecos, p_gid );
4232
4233         DEBUG(10, ("nss_get_info returned %s\n", nt_errstr(nt_status)));
4234
4235         if ( NT_STATUS_IS_OK(nt_status) ) {
4236                 DEBUG(10, ("result:\n\thomedir = '%s'\n", *homedir));
4237                 DEBUGADD(10, ("\tshell = '%s'\n", *shell));
4238                 DEBUGADD(10, ("\tgecos = '%s'\n", *gecos));
4239                 DEBUGADD(10, ("\tgid = '%u'\n", *p_gid));
4240
4241                 wcache_save_user_pwinfo( domain, nt_status, user_sid,
4242                                          *homedir, *shell, *gecos, *p_gid );
4243         }
4244
4245         if ( NT_STATUS_EQUAL( nt_status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) ) {
4246                 DEBUG(5,("nss_get_info_cached: Setting domain %s offline\n",
4247                          domain->name ));
4248                 set_domain_offline( domain );
4249         }
4250
4251         return nt_status;
4252 }
4253
4254
4255 /* the cache backend methods are exposed via this structure */
4256 struct winbindd_methods cache_methods = {
4257         true,
4258         query_user_list,
4259         enum_dom_groups,
4260         enum_local_groups,
4261         name_to_sid,
4262         sid_to_name,
4263         rids_to_names,
4264         query_user,
4265         lookup_usergroups,
4266         lookup_useraliases,
4267         lookup_groupmem,
4268         sequence_number,
4269         lockout_policy,
4270         password_policy,
4271         trusted_domains
4272 };